[{"data":1,"prerenderedAt":1273},["ShallowReactive",2],{"blog-file-attack-field-guide":3,"blog-all-for-related":808},{"id":4,"title":5,"author":6,"body":7,"cardAlt":5,"categories":790,"description":793,"draft":794,"extension":795,"headerImage":796,"keywords":797,"meta":798,"name":799,"navigation":800,"path":801,"seo":802,"series":803,"stem":805,"updated":6,"year":806,"__hash__":807},"blog\u002Fblog\u002Ffile-attack-field-guide.md","How File-Based Attacks Land: A Detection Engineer's Field Guide",null,{"type":8,"value":9,"toc":775},"minimark",[10,17,20,23,28,31,34,57,60,64,67,151,154,159,170,173,176,180,190,193,197,200,203,206,210,217,220,224,227,230,234,237,240,243,457,461,464,467,470,474,477,566,569,595,598,602,605,608,635,639,642,740,743,746,771],[11,12,13],"key-takeaway",{"dataCallout":11},[14,15,16],"p",{},"Files are still the most reliable way past a human. The attackers who keep\nwinning do not rely on clever signatures. They rely on render-time behavior,\nin-browser assembly, and human trust. Detection has to care about what a file\ndoes when it opens, not just what it is called.",[14,18,19],{},"Every day, security teams block email by filename and extension. Attackers have\nmoved past that. Whether a campaign targets a finance lead with a PDF or an\nengineer with a crafted image document, the file is still the fastest route past\nthe human on the other side.",[14,21,22],{},"This is the mental model I reach for when I look at an inbound attachment. What\nis this file really doing? Why might the gateway miss it? And what should\ndetection actually look at instead?",[24,25,27],"h2",{"id":26},"why-is-the-file-still-the-attackers-favorite-delivery","Why is the file still the attacker's favorite delivery?",[14,29,30],{},"Because it plays on trust. A link asks the user to leave the inbox and enter a\nURL. A file asks for nothing except a click, and it can look exactly like the\ndocument the user was already expecting.",[14,32,33],{},"Most delivery that gets past a human relies on one of three things:",[35,36,37,45,51],"ul",{},[38,39,40,44],"li",{},[41,42,43],"strong",{},"Render-time behavior."," The payload fires when the file is opened or\nrendered, which happens as far away from the gateway as possible.",[38,46,47,50],{},[41,48,49],{},"In-browser assembly."," The malicious file is rebuilt after inspection, so\nnothing bad ever crosses the wire in its final form.",[38,52,53,56],{},[41,54,55],{},"Human reaction."," The warning to keep going \"is only one click away,\" and\nusers are conditioned to click it.",[14,58,59],{},"That combination is why filename blocking and static signing keep failing. The\nfile looks fine at the choke point and dangerous at the point of use.",[24,61,63],{"id":62},"how-do-the-main-file-attack-families-work","How do the main file attack families work?",[14,65,66],{},"There are a small number of repeating families. Once you can name them, you can\nspot them. The map below shows the way a payload is used as a vector: a file\narrives, and the danger activates at a specific surface.",[68,69,74],"pre",{"className":70,"code":71,"language":72,"meta":73,"style":73},"language-mermaid shiki shiki-themes github-light github-dark","flowchart TD\n  A[\"Inbound file crosses the boundary\"] --> B{\"Where does the payload activate?\"}\n  B --> C[\"Inside the user's office app\"]\n  B --> D[\"Inside the browser\"]\n  B --> E[\"When a container is mounted\"]\n  B --> F[\"When the client renders\"]\n  B --> G[\"When a model reads it\"]\n  C --> C1[\"Office macro\"]\n  D --> D1[\"HTML smuggling (Blob and download)\"]\n  E --> E1[\"ZIP \u002F ISO \u002F LNK \u002F OneNote\"]\n  F --> F1[\"PDF, self-rendering EML or SVG\"]\n  G --> G1[\"Prompt injection\"]\n","mermaid","",[75,76,77,85,91,97,103,109,115,121,127,133,139,145],"code",{"__ignoreMap":73},[78,79,82],"span",{"class":80,"line":81},"line",1,[78,83,84],{},"flowchart TD\n",[78,86,88],{"class":80,"line":87},2,[78,89,90],{},"  A[\"Inbound file crosses the boundary\"] --> B{\"Where does the payload activate?\"}\n",[78,92,94],{"class":80,"line":93},3,[78,95,96],{},"  B --> C[\"Inside the user's office app\"]\n",[78,98,100],{"class":80,"line":99},4,[78,101,102],{},"  B --> D[\"Inside the browser\"]\n",[78,104,106],{"class":80,"line":105},5,[78,107,108],{},"  B --> E[\"When a container is mounted\"]\n",[78,110,112],{"class":80,"line":111},6,[78,113,114],{},"  B --> F[\"When the client renders\"]\n",[78,116,118],{"class":80,"line":117},7,[78,119,120],{},"  B --> G[\"When a model reads it\"]\n",[78,122,124],{"class":80,"line":123},8,[78,125,126],{},"  C --> C1[\"Office macro\"]\n",[78,128,130],{"class":80,"line":129},9,[78,131,132],{},"  D --> D1[\"HTML smuggling (Blob and download)\"]\n",[78,134,136],{"class":80,"line":135},10,[78,137,138],{},"  E --> E1[\"ZIP \u002F ISO \u002F LNK \u002F OneNote\"]\n",[78,140,142],{"class":80,"line":141},11,[78,143,144],{},"  F --> F1[\"PDF, self-rendering EML or SVG\"]\n",[78,146,148],{"class":80,"line":147},12,[78,149,150],{},"  G --> G1[\"Prompt injection\"]\n",[14,152,153],{},"Here is the roster I keep coming back to.",[155,156,158],"h3",{"id":157},"document-macros","Document macros",[14,160,161,162,165,166,169],{},"The oldest trick. A ",[75,163,164],{},".doc"," or ",[75,167,168],{},".xls"," carries VBA that runs when the document\nopens and the user enables content. Classic controls look for a known macro hash\nor flag any macro at all.",[14,171,172],{},"Attackers respond with low-volume, per-target documents, so signatures miss and\nthe generic \"enable macros\" warning still gets clicked by enough people.",[14,174,175],{},"Detection looks at structure: inspect the OLE or zip layout, extract and review\nthe macros, and run the document in a sandbox that simulates a user enabling\ncontent.",[155,177,179],{"id":178},"image-only-office-files","Image-only office files",[14,181,182,183,165,186,189],{},"A ",[75,184,185],{},"docx",[75,187,188],{},"pptx"," that contains exactly one embedded image and almost no\nextractable text. The attack is a callback or credential phishing page rendered\nas a picture. Because the text lives in pixels, body and text scanners find\nnothing to flag.",[14,191,192],{},"The tell is structural. A well-known community rule looks for a textless Office\nfile with a single embedded image, then extracts the image and reads the text in\nit to pull out a callback URL. This is a great example of detecting the file the\nway attackers wrote it.",[155,194,196],{"id":195},"html-smuggling","HTML smuggling",[14,198,199],{},"The payload never crosses the wire in its final form. An HTML page or attachment\ncarries the malicious bytes encoded and reassembles them in the browser using\nJavaScript Blob APIs and the download attribute. This is a documented MITRE\ntechnique, T1027.006.",[14,201,202],{},"Because the bytes are encoded text, the gateway inspects something that looks\nbenign. The real file is assembled only when the page renders. Campaigns have\nnested a double-Base64-encoded ZIP inside an HTML attachment, which adds another\nlayer between inspection and execution.",[14,204,205],{},"Detection needs to emulate the script, watch for Blob and download behavior, and\nfollow what gets created.",[155,207,209],{"id":208},"container-formats-and-mark-of-the-web","Container formats and Mark of the Web",[14,211,212,213,216],{},"Password-protected ZIPs keep scanner-invisible contents hidden from inspection.\nISO, VHD, and LNK files get used because a downloaded image is not stamped with\nMark of the Web the way a direct ",[75,214,215],{},".exe"," is. The ISO mounts and runs without the\nblock a downloaded executable would get. OneNote documents have joined this\nroster too.",[14,218,219],{},"Detection has to inspect inside containers, preserve provenance onto derived\nfiles, and watch the mount and execute sequence rather than any single artifact.",[155,221,223],{"id":222},"pdfs-and-self-rendering-attachments","PDFs and self-rendering attachments",[14,225,226],{},"PDFs hide URLs in annotations, form fields, and older JavaScript actions. And an\nattached EML, or an SVG placed inside an iframe, can auto-render in an email\nclient. That means delivery needs no click at all.",[14,228,229],{},"Detection extracts URLs and embedded actions, and treats client-side rendering\nas an execution surface, not a display nicety.",[155,231,233],{"id":232},"ai-and-llm-payloads","AI and LLM payloads",[14,235,236],{},"The newest family. Prompt injection gets smuggled into the same files an\nassistant reads: a PDF, a cached page, an imported document. It is the same\ndelivery model, with a different final executor.",[14,238,239],{},"Detection treats model-facing content as untrusted input, filters prompt\ninjection the way it filters an executable, and monitors what tools and actions\nthe model is allowed to take.",[14,241,242],{},"Before we move on, try this. Pick a file type, see how it lands, then reveal the\ntell and how detection catches it.",[68,244,248],{"className":245,"code":246,"language":247,"meta":73,"style":73},"language-files shiki shiki-themes github-light github-dark","[\n  {\n    \"name\": \"Office macro\",\n    \"how\": \"A .doc or .xls that runs VBA when the user enables content. Detection says the macro hash is unknown or the doc is a fresh, per-target build.\",\n    \"tell\": \"VBA present, generic enable-content warning, low-volume sender the team has not seen.\",\n    \"detect\": \"Inspect the OLE or zip structure, extract and audit the macros, and sandbox a user enabling content.\"\n  },\n  {\n    \"name\": \"Image-only Office doc\",\n    \"how\": \"A docx or pptx with one embedded image and almost no text. The attack is a callback or credential page rendered as a picture.\",\n    \"tell\": \"No extractable text, a single embedded image, and a URL or phone number hiding in the pixels.\",\n    \"detect\": \"Reject textless single-image files, extract the image, OCR it, and pull out the callback URL.\"\n  },\n  {\n    \"name\": \"HTML smuggling\",\n    \"how\": \"Malicious bytes arrive encoded and are rebuilt in the browser with JavaScript Blob and download APIs, so nothing bad crosses the wire.\",\n    \"tell\": \"Encoded blob text in the page, Blob and download API calls, and a file constructed before save.\",\n    \"detect\": \"Emulate the script, watch for Blob and download behavior, and inspect the file it materializes.\"\n  },\n  {\n    \"name\": \"Container (ZIP \u002F ISO \u002F LNK)\",\n    \"how\": \"A password-protected ZIP or a disk image that mounts later and drops a link file. The container is not stamped with Mark of the Web.\",\n    \"tell\": \"Encrypted archive, ISO or LNK where a plain executable would be blocked, a mount-and-execute chain.\",\n    \"detect\": \"Open the container, persist provenance onto derived files, and follow mount to execution.\"\n  },\n  {\n    \"name\": \"PDF \u002F self-rendering\",\n    \"how\": \"A PDF with URL actions and form fields, or an attached EML or SVG that auto-renders in the client. Delivery can need no click.\",\n    \"tell\": \"Embedded URLs and actions, auto-rendering attachment types, no user interaction needed.\",\n    \"detect\": \"Extract URLs and embedded actions, and treat client-side rendering as an execution surface.\"\n  },\n  {\n    \"name\": \"AI \u002F LLM payload\",\n    \"how\": \"A prompt injection rides inside a document or page a model is asked to read, and the trigger is the read itself.\",\n    \"tell\": \"Instruction-shaped text in otherwise benign content, signals from unexpected tool calls or outputs.\",\n    \"detect\": \"Treat model-read content as untrusted input, filter prompt injection, and monitor the tools the model can call.\"\n  }\n]\n","files",[75,249,250,255,260,265,270,275,280,285,289,294,299,304,309,314,319,325,331,337,343,348,353,359,365,371,377,382,387,393,399,405,411,416,421,427,433,439,445,451],{"__ignoreMap":73},[78,251,252],{"class":80,"line":81},[78,253,254],{},"[\n",[78,256,257],{"class":80,"line":87},[78,258,259],{},"  {\n",[78,261,262],{"class":80,"line":93},[78,263,264],{},"    \"name\": \"Office macro\",\n",[78,266,267],{"class":80,"line":99},[78,268,269],{},"    \"how\": \"A .doc or .xls that runs VBA when the user enables content. Detection says the macro hash is unknown or the doc is a fresh, per-target build.\",\n",[78,271,272],{"class":80,"line":105},[78,273,274],{},"    \"tell\": \"VBA present, generic enable-content warning, low-volume sender the team has not seen.\",\n",[78,276,277],{"class":80,"line":111},[78,278,279],{},"    \"detect\": \"Inspect the OLE or zip structure, extract and audit the macros, and sandbox a user enabling content.\"\n",[78,281,282],{"class":80,"line":117},[78,283,284],{},"  },\n",[78,286,287],{"class":80,"line":123},[78,288,259],{},[78,290,291],{"class":80,"line":129},[78,292,293],{},"    \"name\": \"Image-only Office doc\",\n",[78,295,296],{"class":80,"line":135},[78,297,298],{},"    \"how\": \"A docx or pptx with one embedded image and almost no text. The attack is a callback or credential page rendered as a picture.\",\n",[78,300,301],{"class":80,"line":141},[78,302,303],{},"    \"tell\": \"No extractable text, a single embedded image, and a URL or phone number hiding in the pixels.\",\n",[78,305,306],{"class":80,"line":147},[78,307,308],{},"    \"detect\": \"Reject textless single-image files, extract the image, OCR it, and pull out the callback URL.\"\n",[78,310,312],{"class":80,"line":311},13,[78,313,284],{},[78,315,317],{"class":80,"line":316},14,[78,318,259],{},[78,320,322],{"class":80,"line":321},15,[78,323,324],{},"    \"name\": \"HTML smuggling\",\n",[78,326,328],{"class":80,"line":327},16,[78,329,330],{},"    \"how\": \"Malicious bytes arrive encoded and are rebuilt in the browser with JavaScript Blob and download APIs, so nothing bad crosses the wire.\",\n",[78,332,334],{"class":80,"line":333},17,[78,335,336],{},"    \"tell\": \"Encoded blob text in the page, Blob and download API calls, and a file constructed before save.\",\n",[78,338,340],{"class":80,"line":339},18,[78,341,342],{},"    \"detect\": \"Emulate the script, watch for Blob and download behavior, and inspect the file it materializes.\"\n",[78,344,346],{"class":80,"line":345},19,[78,347,284],{},[78,349,351],{"class":80,"line":350},20,[78,352,259],{},[78,354,356],{"class":80,"line":355},21,[78,357,358],{},"    \"name\": \"Container (ZIP \u002F ISO \u002F LNK)\",\n",[78,360,362],{"class":80,"line":361},22,[78,363,364],{},"    \"how\": \"A password-protected ZIP or a disk image that mounts later and drops a link file. The container is not stamped with Mark of the Web.\",\n",[78,366,368],{"class":80,"line":367},23,[78,369,370],{},"    \"tell\": \"Encrypted archive, ISO or LNK where a plain executable would be blocked, a mount-and-execute chain.\",\n",[78,372,374],{"class":80,"line":373},24,[78,375,376],{},"    \"detect\": \"Open the container, persist provenance onto derived files, and follow mount to execution.\"\n",[78,378,380],{"class":80,"line":379},25,[78,381,284],{},[78,383,385],{"class":80,"line":384},26,[78,386,259],{},[78,388,390],{"class":80,"line":389},27,[78,391,392],{},"    \"name\": \"PDF \u002F self-rendering\",\n",[78,394,396],{"class":80,"line":395},28,[78,397,398],{},"    \"how\": \"A PDF with URL actions and form fields, or an attached EML or SVG that auto-renders in the client. Delivery can need no click.\",\n",[78,400,402],{"class":80,"line":401},29,[78,403,404],{},"    \"tell\": \"Embedded URLs and actions, auto-rendering attachment types, no user interaction needed.\",\n",[78,406,408],{"class":80,"line":407},30,[78,409,410],{},"    \"detect\": \"Extract URLs and embedded actions, and treat client-side rendering as an execution surface.\"\n",[78,412,414],{"class":80,"line":413},31,[78,415,284],{},[78,417,419],{"class":80,"line":418},32,[78,420,259],{},[78,422,424],{"class":80,"line":423},33,[78,425,426],{},"    \"name\": \"AI \u002F LLM payload\",\n",[78,428,430],{"class":80,"line":429},34,[78,431,432],{},"    \"how\": \"A prompt injection rides inside a document or page a model is asked to read, and the trigger is the read itself.\",\n",[78,434,436],{"class":80,"line":435},35,[78,437,438],{},"    \"tell\": \"Instruction-shaped text in otherwise benign content, signals from unexpected tool calls or outputs.\",\n",[78,440,442],{"class":80,"line":441},36,[78,443,444],{},"    \"detect\": \"Treat model-read content as untrusted input, filter prompt injection, and monitor the tools the model can call.\"\n",[78,446,448],{"class":80,"line":447},37,[78,449,450],{},"  }\n",[78,452,454],{"class":80,"line":453},38,[78,455,456],{},"]\n",[24,458,460],{"id":459},"why-do-classic-controls-miss-these-attacks","Why do classic controls miss these attacks?",[14,462,463],{},"Because they inspect the wrong moment. Static signing and block-by-type look at\nthe bytes at the choke point, when the file is still encoded, still whole, still\ndormant.",[14,465,466],{},"Nearly every family above defeats that by moving the danger to a later moment:\nrender time, browser execution, or a container that is opened after inspection.",[14,468,469],{},"The gap is not the file extension. It is the behavior that happens after the\nfile is trusted.",[24,471,473],{"id":472},"how-should-detection-actually-think-about-files","How should detection actually think about files?",[14,475,476],{},"Treat the label as a hint, not a verdict. Then combine payload signals with\nbehavior. The pipeline below is the mental model: the file goes in, you render\nand follow the chain, then you act on behavior. Click each stage for the detail.",[68,478,482],{"className":479,"code":480,"language":481,"meta":73,"style":73},"language-diagram shiki shiki-themes github-light github-dark","{\n  \"title\": \"A detection pipeline view of the field guide\",\n  \"steps\": [\n    {\n      \"title\": \"Inbound file\",\n      \"detail\": \"The file crosses the boundary as a document, archive, image, or script. It looks like the thing the user already expected, which is why it gets opened.\"\n    },\n    {\n      \"title\": \"Render + follow the chain\",\n      \"detail\": \"Detection emulates the open and follows what the file does: decode, extract URLs, watch Blob or mount-and-execute behavior, then follow DNS and requests.\"\n    },\n    {\n      \"title\": \"Detect the behavior\",\n      \"detail\": \"Name the behavior, not the file type. Keep provenance across containers, preserve Mark of the Web, and keep a strong allowlist so the signals are trusted.\"\n    }\n  ]\n}\n","diagram",[75,483,484,489,494,499,504,509,514,519,523,528,533,537,541,546,551,556,561],{"__ignoreMap":73},[78,485,486],{"class":80,"line":81},[78,487,488],{},"{\n",[78,490,491],{"class":80,"line":87},[78,492,493],{},"  \"title\": \"A detection pipeline view of the field guide\",\n",[78,495,496],{"class":80,"line":93},[78,497,498],{},"  \"steps\": [\n",[78,500,501],{"class":80,"line":99},[78,502,503],{},"    {\n",[78,505,506],{"class":80,"line":105},[78,507,508],{},"      \"title\": \"Inbound file\",\n",[78,510,511],{"class":80,"line":111},[78,512,513],{},"      \"detail\": \"The file crosses the boundary as a document, archive, image, or script. It looks like the thing the user already expected, which is why it gets opened.\"\n",[78,515,516],{"class":80,"line":117},[78,517,518],{},"    },\n",[78,520,521],{"class":80,"line":123},[78,522,503],{},[78,524,525],{"class":80,"line":129},[78,526,527],{},"      \"title\": \"Render + follow the chain\",\n",[78,529,530],{"class":80,"line":135},[78,531,532],{},"      \"detail\": \"Detection emulates the open and follows what the file does: decode, extract URLs, watch Blob or mount-and-execute behavior, then follow DNS and requests.\"\n",[78,534,535],{"class":80,"line":141},[78,536,518],{},[78,538,539],{"class":80,"line":147},[78,540,503],{},[78,542,543],{"class":80,"line":311},[78,544,545],{},"      \"title\": \"Detect the behavior\",\n",[78,547,548],{"class":80,"line":316},[78,549,550],{},"      \"detail\": \"Name the behavior, not the file type. Keep provenance across containers, preserve Mark of the Web, and keep a strong allowlist so the signals are trusted.\"\n",[78,552,553],{"class":80,"line":321},[78,554,555],{},"    }\n",[78,557,558],{"class":80,"line":327},[78,559,560],{},"  ]\n",[78,562,563],{"class":80,"line":333},[78,564,565],{},"}\n",[14,567,568],{},"Now the concrete moves, step by step.",[35,570,571,577,583,589],{},[38,572,573,576],{},[41,574,575],{},"Render or emulate"," the file in a controlled sandbox that clicks the buttons\nand enables the content a user would.",[38,578,579,582],{},[41,580,581],{},"Follow the chain."," Decode, extract URLs, follow them through DNS and\nrequests, and watch for the download or process that follows.",[38,584,585,588],{},[41,586,587],{},"Preserve provenance."," Carry Mark of the Web and trust signals across\ncontainers so a nested file keeps its origin.",[38,590,591,594],{},[41,592,593],{},"Keep a known-good baseline."," Allowlisting known and trusted senders and\nfiles cuts false positives so the behavioral signals can be taken seriously.",[14,596,597],{},"The winning posture is not a longer blocklist. It is a pipeline that treats every\nfile as a story: where it came from, how it changes when it opens, and where it\ntries to go.",[24,599,601],{"id":600},"where-do-you-start","Where do you start?",[14,603,604],{},"Pick the family that maps to the most risk in your environment and start there.\nFor most teams that is the ones that need no deliberate user action: image-only\ndocuments, HTML smuggling, containers, and self-rendering attachments.",[14,606,607],{},"Stand up the render and follow-the-chain loop first. You will be surprised how\nmuch of the stream resolves just by emulating the click.",[609,610,611,616,619,624,627,632],"faq",{"dataFaq":73},[14,612,613],{},[41,614,615],{},"Is the risk really in the file type?",[14,617,618],{},"Mostly not. The risk is in what the file does after it is trusted. The type only\nnarrows down which behavior to watch for.",[14,620,621],{},[41,622,623],{},"Does sandboxing catch everything?",[14,625,626],{},"No. A sandbox is a strong signal, not a silver bullet. Evasive files detect the\nsandbox and behave differently, so sandboxing works best alongside behavioral\nand provenance signals, not alone.",[14,628,629],{},[41,630,631],{},"Is prompt injection really a file attack?",[14,633,634],{},"It is the same delivery model. The payload travels inside a document or page the\nmodel is asked to read, and the trigger is the read itself. Treating read content\nas input is the secure default.",[24,636,638],{"id":637},"test-yourself","Test yourself",[14,640,641],{},"A quick self-check on the field guide so far. Pick an option to see the answer.",[68,643,647],{"className":644,"code":645,"language":646,"meta":73,"style":73},"language-quiz shiki shiki-themes github-light github-dark","[\n  {\n    \"q\": \"Which delivery can need no user click at all?\",\n    \"options\": [\"Office macro\", \"Image-only docx\", \"PDF or self-rendering EML\"],\n    \"answer\": 2,\n    \"explain\": \"PDFs and EML or SVG attachments can auto-render in the client, so no click is required.\"\n  },\n  {\n    \"q\": \"In HTML smuggling, where is the malicious file assembled?\",\n    \"options\": [\"On the email gateway\", \"In the victim's browser\", \"Inside the attachment bytes\"],\n    \"answer\": 1,\n    \"explain\": \"The bytes arrive encoded and are rebuilt client-side with Blob and download APIs, after inspection.\"\n  },\n  {\n    \"q\": \"What is the structural tell of an image-only Office file?\",\n    \"options\": [\"A large macro\", \"No extractable text and one embedded image\", \"A password on the file\"],\n    \"answer\": 1,\n    \"explain\": \"A textless docx or pptx with a single embedded image is a callback page rendered as a picture.\"\n  }\n]\n","quiz",[75,648,649,653,657,662,667,672,677,681,685,690,695,700,705,709,713,718,723,727,732,736],{"__ignoreMap":73},[78,650,651],{"class":80,"line":81},[78,652,254],{},[78,654,655],{"class":80,"line":87},[78,656,259],{},[78,658,659],{"class":80,"line":93},[78,660,661],{},"    \"q\": \"Which delivery can need no user click at all?\",\n",[78,663,664],{"class":80,"line":99},[78,665,666],{},"    \"options\": [\"Office macro\", \"Image-only docx\", \"PDF or self-rendering EML\"],\n",[78,668,669],{"class":80,"line":105},[78,670,671],{},"    \"answer\": 2,\n",[78,673,674],{"class":80,"line":111},[78,675,676],{},"    \"explain\": \"PDFs and EML or SVG attachments can auto-render in the client, so no click is required.\"\n",[78,678,679],{"class":80,"line":117},[78,680,284],{},[78,682,683],{"class":80,"line":123},[78,684,259],{},[78,686,687],{"class":80,"line":129},[78,688,689],{},"    \"q\": \"In HTML smuggling, where is the malicious file assembled?\",\n",[78,691,692],{"class":80,"line":135},[78,693,694],{},"    \"options\": [\"On the email gateway\", \"In the victim's browser\", \"Inside the attachment bytes\"],\n",[78,696,697],{"class":80,"line":141},[78,698,699],{},"    \"answer\": 1,\n",[78,701,702],{"class":80,"line":147},[78,703,704],{},"    \"explain\": \"The bytes arrive encoded and are rebuilt client-side with Blob and download APIs, after inspection.\"\n",[78,706,707],{"class":80,"line":311},[78,708,284],{},[78,710,711],{"class":80,"line":316},[78,712,259],{},[78,714,715],{"class":80,"line":321},[78,716,717],{},"    \"q\": \"What is the structural tell of an image-only Office file?\",\n",[78,719,720],{"class":80,"line":327},[78,721,722],{},"    \"options\": [\"A large macro\", \"No extractable text and one embedded image\", \"A password on the file\"],\n",[78,724,725],{"class":80,"line":333},[78,726,699],{},[78,728,729],{"class":80,"line":339},[78,730,731],{},"    \"explain\": \"A textless docx or pptx with a single embedded image is a callback page rendered as a picture.\"\n",[78,733,734],{"class":80,"line":345},[78,735,450],{},[78,737,738],{"class":80,"line":350},[78,739,456],{},[14,741,742],{},"Part 1 sets up the map. Later parts in this series will take each family one at\na time, with a real payload pattern, examples, and the detection that works.\nPart 2 will start with macros and image-only Office files.",[14,744,745],{},"Useful references:",[35,747,748,757,764],{},[38,749,750],{},[751,752,756],"a",{"href":753,"rel":754},"https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1027\u002F006\u002F",[755],"nofollow","HTML Smuggling, sub-technique T1027.006",[38,758,759],{},[751,760,763],{"href":761,"rel":762},"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2021\u002F11\u002F11\u002Fhtml-smuggling-surges-highly-evasive-loader-technique-increasingly-used-in-banking-malware-targeted-attacks\u002F",[755],"HTML smuggling surges: a highly evasive loader technique",[38,765,766],{},[751,767,770],{"href":768,"rel":769},"https:\u002F\u002Fsublime.security\u002Fblog\u002F",[755],"Sublime Security blog: attack spotlights and detection rules",[772,773,774],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":73,"searchDepth":87,"depth":87,"links":776},[777,778,786,787,788,789],{"id":26,"depth":87,"text":27},{"id":62,"depth":87,"text":63,"children":779},[780,781,782,783,784,785],{"id":157,"depth":93,"text":158},{"id":178,"depth":93,"text":179},{"id":195,"depth":93,"text":196},{"id":208,"depth":93,"text":209},{"id":222,"depth":93,"text":223},{"id":232,"depth":93,"text":233},{"id":459,"depth":87,"text":460},{"id":472,"depth":87,"text":473},{"id":600,"depth":87,"text":601},{"id":637,"depth":87,"text":638},[791,792],"Security","Systems","A practical taxonomy of how malware and phishing arrive as files, why classic controls miss them, and how detection should think.",false,"md","blog\u002Ffile-attack-field-guide\u002Ffile-attack-field-guide-card.webp","malware delivery, email security, HTML smuggling, payload detection, phishing, document macros",{},"file-attack-field-guide",true,"\u002Fblog\u002Ffile-attack-field-guide",{"title":5,"description":793},{"name":804,"part":81},"File Attack Deep Dives","blog\u002Ffile-attack-field-guide","2026-08-26","wQrO8lg5SmnG6pcOjFevtumo0B4sxSREGQwxveCfBfY",[809,816,823,831,840,847,854,861,867,873,879,885,891,894,900,907,913,919,925,931,937,943,949,955,962,969,975,981,987,993,999,1005,1011,1017,1023,1029,1035,1041,1047,1054,1060,1066,1072,1079,1085,1091,1098,1105,1111,1118,1124,1131,1137,1144,1150,1156,1162,1168,1174,1180,1186,1192,1198,1204,1210,1216,1223,1229,1236,1242,1248,1254,1261,1267],{"path":810,"title":811,"description":812,"categories":813,"draft":800,"year":806,"series":6},"\u002Fblog\u002Fai-assisted-workstation","Building an AI-Assisted Personal Workstation","How I built a personal AI workstation: markdown knowledge base, portable agent skills, handoff-driven sessions. What worked, what broke, what I would change.",[814,815],"Productivity","Programming",{"path":817,"title":818,"description":819,"categories":820,"draft":794,"year":822,"series":6},"\u002Fblog\u002Faws-s3-golang","Uploading images to AWS S3 in Golang","In this tutorial I cover how to upload, fetch and manage other operations for objects on AWS S3 in Golang",[821,815],"Golang","2020-01-12",{"path":824,"title":825,"description":826,"categories":827,"draft":794,"year":830,"series":6},"\u002Fblog\u002Fbooks-for-engineers","Best Books for Software Engineers","Best Books to help you build you software engineering career - ranging from fundamentats, interview prep to productivity.",[828,829],"Books","Life","2021-12-26",{"path":832,"title":833,"description":834,"categories":835,"draft":794,"year":839,"series":6},"\u002Fblog\u002Fbuilding-acrons","Building Acrons 🚀","Building Acrons, a one-stop tool to decode everyday acronyms like DIY, FOMO, and BRB without losing your flow.",[836,837,838],"Side Projects","Web","Tools","2020-05-26",{"path":841,"title":842,"description":843,"categories":844,"draft":794,"year":846,"series":6},"\u002Fblog\u002Fcap-theorem","CAP Theorem Explained","Learn the concept and misconceptions around popular CAP theorem in system design.",[845,815],"System Design","2021-07-26",{"path":848,"title":849,"description":850,"categories":851,"draft":794,"year":853,"series":6},"\u002Fblog\u002Fcode-reviews","Code Review Checklist","Why code reviews matter, and best practices that catch bugs early and keep code quality high before merge.",[852],"Engineering Principles","2020-07-20",{"path":855,"title":856,"description":857,"categories":858,"draft":794,"year":860,"series":6},"\u002Fblog\u002Fdark-mode","Add Dark mode to websites","Dark mode is ❤️️ Add it to your websites with little CSS and JS",[859,837],"Javascript","2020-07-04",{"path":862,"title":863,"description":864,"categories":865,"draft":794,"year":866,"series":6},"\u002Fblog\u002Fdate-time-golang","Working with Date and Time in Go","Learn how to use time in Golang - Multiple formats, locations and using date.",[821,815],"2020-10-09",{"path":868,"title":869,"description":870,"categories":871,"draft":794,"year":872,"series":6},"\u002Fblog\u002Fdefer-in-golang","Understanding Defer In Golang","Learn about defer keyword in golang and how it can help you avoid panics due to bugs.",[821,815],"2021-05-05",{"path":874,"title":875,"description":876,"categories":877,"draft":794,"year":878,"series":6},"\u002Fblog\u002Fenums-golang","Implementing Enums in Golang","Enums are a way to defined set of constant values. Learn how to implement enums in Go using iota with examples.",[821,815],"2021-12-18",{"path":880,"title":881,"description":882,"categories":883,"draft":794,"year":884,"series":6},"\u002Fblog\u002Fenvironment-variable-golang","Guide to Environment variables in Go","Learn what are environment variables and how to use them in Go",[821,815],"2020-08-14",{"path":886,"title":887,"description":888,"categories":889,"draft":794,"year":890,"series":6},"\u002Fblog\u002Ferror-handling-golang","Handle errors the right way — Golang","How to handle errors in golang to make your life easy",[821,815],"2020-01-30",{"path":801,"title":5,"description":793,"categories":892,"draft":794,"year":806,"series":893},[791,792],{"name":804,"part":81},{"path":895,"title":896,"description":897,"categories":898,"draft":794,"year":899,"series":6},"\u002Fblog\u002Ffile-upload-golang","Uploading Files in Golang with Multipart Request","Learn how to upload files from your client to server as a multipart request in Golang.",[821,815],"2021-03-13",{"path":901,"title":902,"description":903,"categories":904,"draft":794,"year":906,"series":6},"\u002Fblog\u002Fgit-branch","Git Branch 101","Branching is a new path of development that makes it a lot easier to build features. Learn why and how to use branching in git.",[905,815],"Git","2022-03-20",{"path":908,"title":909,"description":910,"categories":911,"draft":794,"year":912,"series":6},"\u002Fblog\u002Fgit-pull-request-template","Guide to Pull Request Templates","Improve collaboration and code reviews with pull request templates. Blog include PR template and how to create one on github\u002Fgitlab",[905,815],"2023-08-24",{"path":914,"title":915,"description":916,"categories":917,"draft":794,"year":918,"series":6},"\u002Fblog\u002Fgit-remove-sensitive-info","Securing Git: Remove Sensitive Information","Protect your code from security breaches by using BFG tool to remove sensitive information from Git history. Learn how to do it in this comprehensive guide.",[905,815],"2023-10-16",{"path":920,"title":921,"description":922,"categories":923,"draft":794,"year":924,"series":6},"\u002Fblog\u002Fgit-tags-explained","Git tags : Explained","What Git tags are, why and when to use them, and how to start tagging releases in your own projects.",[905,815],"2020-06-18",{"path":926,"title":927,"description":928,"categories":929,"draft":794,"year":930,"series":6},"\u002Fblog\u002Fgo-dependency-injection","Dependency Injection in Go using Wire","Learn about dependency injection, its benefits and how to implement it in Go services using wire",[821,815],"2022-11-26",{"path":932,"title":933,"description":934,"categories":935,"draft":794,"year":936,"series":6},"\u002Fblog\u002Fgo-generics","Introduction to Generics in Go","Learn about generics in Golang, it's benefits and how to implement it in applications.",[821,815],"2022-11-27",{"path":938,"title":939,"description":940,"categories":941,"draft":794,"year":942,"series":6},"\u002Fblog\u002Fgo-in-memory-cache","Building In-Memory Cache in Go","Learn about in-memory caching in Golang, it's benefits and how to implement it with and without generics with a TTL(expiry).",[821,815],"2024-03-28",{"path":944,"title":945,"description":946,"categories":947,"draft":794,"year":948,"series":6},"\u002Fblog\u002Fgo-makefile","Ultimate Makefile for Golang","Boost your productivity and save time with ultimate Makefile for Golang projects.",[821,815],"2024-06-10",{"path":950,"title":951,"description":952,"categories":953,"draft":794,"year":954,"series":6},"\u002Fblog\u002Fgo-middleware","Mastering Middlewares in Golang","Learn about middlewares, their use cases and how to implement them in Golang applications",[821,815],"2022-03-13",{"path":956,"title":957,"description":958,"categories":959,"draft":794,"year":961,"series":6},"\u002Fblog\u002Fgo-naming-conventions","Naming Conventions in Golang","Why naming conventions matter in Go, with best practices and practical examples for clear, readable, maintainable code.",[821,815,960],"Code Quality","2023-05-19",{"path":963,"title":964,"description":965,"categories":966,"draft":794,"year":968,"series":6},"\u002Fblog\u002Fgo-with-redis","Go with Redis","A practical introduction to using Redis with Golang to make your applications faster with in-memory data storage.",[821,967,815],"Database","2020-05-03",{"path":970,"title":971,"description":972,"categories":973,"draft":794,"year":974,"series":6},"\u002Fblog\u002Fgolang-maps","Learn Maps in Golang (with examples)","A complete guide to maps in Golang: creating maps, adding and removing items, iterating, and how map equality works.",[821,815],"2020-09-10",{"path":976,"title":977,"description":978,"categories":979,"draft":794,"year":980,"series":6},"\u002Fblog\u002Fguide-to-cdn","Guide to Content Delivery Network","CDN is one of the backbone of modern world internet infrastructure. Learn about Content Delivery Network, it's working, types and benefits.",[845,815],"2022-01-23",{"path":982,"title":983,"description":984,"categories":985,"draft":794,"year":986,"series":6},"\u002Fblog\u002Fguide-to-rule-engines","Guide to Rule Engines","Rule Engines help in solving changing business requirements with ease. Learn all about Rule engines, it's working, benefits and how to implement one in Golang",[821,815],"2022-09-12",{"path":988,"title":989,"description":990,"categories":991,"draft":794,"year":992,"series":6},"\u002Fblog\u002Fhexagonal-architecture","Guide to Hexagonal Architecture","Learn how to design efficient application with hexagonal architecture with practical example",[845,815],"2020-12-13",{"path":994,"title":995,"description":996,"categories":997,"draft":794,"year":998,"series":6},"\u002Fblog\u002Fhttp-status-codes","Learn HTTP Status Codes","A tour of HTTP response status codes, what each class means, and when to use which code in your applications.",[837,815],"2020-07-30",{"path":1000,"title":1001,"description":1002,"categories":1003,"draft":794,"year":1004,"series":6},"\u002Fblog\u002Fintroduction-to-goroutines","Introduction to Goroutines","Understand the basics of concurrency and learn how to work with Goroutines in golang.",[821,815],"2021-04-10",{"path":1006,"title":1007,"description":1008,"categories":1009,"draft":794,"year":1010,"series":6},"\u002Fblog\u002Fjson-in-postgres-with-golang","Storing JSON in Postgres with Golang","Learn how to store JSON objects in Postgres and how to implement it in Golang.",[815,967,821],"2021-02-13",{"path":1012,"title":1013,"description":1014,"categories":1015,"draft":794,"year":1016,"series":6},"\u002Fblog\u002Fjson-web-token","Complete Guide to JWT","JSON Web Tokens are a very compact way to carry information. Learn about JWTs in depth, from its structure to when to use it.",[815,837],"2021-11-20",{"path":1018,"title":1019,"description":1020,"categories":1021,"draft":794,"year":1022,"series":6},"\u002Fblog\u002Flearn-to-say-no","Learning to say No","Learn why it's important to say 'NO'. How it helps in increasing productivity and explore strategies for saying No",[829,828],"2022-04-09",{"path":1024,"title":1025,"description":1026,"categories":1027,"draft":794,"year":1028,"series":6},"\u002Fblog\u002Flearn-unlearn-relearn","Learn - Unlearn - Relearn","Unlearning things to learn new is the way to grow. Discover how to do that!",[814,829],"2020-09-25",{"path":1030,"title":1031,"description":1032,"categories":1033,"draft":794,"year":1034,"series":6},"\u002Fblog\u002Flinting-in-golang","Introduction to Linting in Go","Introduction to improving code quality using linting. Learn how to add linting in your Go projects.",[821,815],"2021-07-07",{"path":1036,"title":1037,"description":1038,"categories":1039,"draft":794,"year":1040,"series":6},"\u002Fblog\u002Fload-balancing","Load Balancing 101","Complete guide on load balancers explaining the internal working and how does it help in making applications efficient.",[845,815],"2021-05-29",{"path":1042,"title":1043,"description":1044,"categories":1045,"draft":794,"year":1046,"series":6},"\u002Fblog\u002Fmaking-decisions-the-right-way","Making Decisions: The right way","Decisions are hard! Learn how to make the right decisions always",[814,829],"2020-06-07",{"path":1048,"title":1049,"description":1050,"categories":1051,"draft":794,"year":1053,"series":6},"\u002Fblog\u002Fmanage-logs-with-logrotate","Using Logrotate to manage logs","Learn how to use logrotate system utility to manage logs with example",[1052,815],"Linux","2020-09-08",{"path":1055,"title":1056,"description":1057,"categories":1058,"draft":794,"year":1059,"series":6},"\u002Fblog\u002Fmarshal-structs-golang","Marshal structs the right way: Golang","Why Golang marshals empty structs into your JSON instead of null, and how to marshal structs the right way.",[821,815],"2020-03-31",{"path":1061,"title":1062,"description":1063,"categories":1064,"draft":794,"year":1065,"series":6},"\u002Fblog\u002Fnotes-almanack-naval","Book Notes : Almanack of Naval Ravikant","My notes\u002Fhighlights from Almanack of Naval Ravikant book by Eric Jorgenson",[828,829],"2020-10-17",{"path":1067,"title":1068,"description":1069,"categories":1070,"draft":794,"year":1071,"series":6},"\u002Fblog\u002Fnotes-anything-you-want","Book Notes : Anything you want","My notes\u002Fhighlights from Anything you want book by Derek Sivers",[828,829],"2021-09-25",{"path":1073,"title":1074,"description":1075,"categories":1076,"draft":794,"year":1078,"series":6},"\u002Fblog\u002Fnotes-getting-real","Book Notes : Getting Real","My notes and highlights from Getting Real by Jason Fried and David Heinemeier Hansson on building web applications.",[828,1077],"Startups","2020-11-03",{"path":1080,"title":1081,"description":1082,"categories":1083,"draft":794,"year":1084,"series":6},"\u002Fblog\u002Fnotes-hell-yeah-or-no","Book Notes : Hell Yeah or No","My notes\u002Fhighlights from Hell Yeah or No book by Derek Sivers",[828,829],"2020-09-16",{"path":1086,"title":1087,"description":1088,"categories":1089,"draft":794,"year":1090,"series":6},"\u002Fblog\u002Fnotes-how-to-be-a-capitalist","Book Notes : How to Be a Capitalist Without Any Capital","My notes\u002Fhighlights from How to Be a Capitalist Without Any Capital by Nathan Latka",[828,1077],"2020-01-07",{"path":1092,"title":1093,"description":1094,"categories":1095,"draft":794,"year":1097,"series":6},"\u002Fblog\u002Fnotes-lean-b2b","Book Notes : Lean B2B","My notes and highlights from Lean B2B by Étienne Garbugli on assessing markets, building MVPs, and selling to businesses.",[828,1096],"Entrepreneurship","2022-07-02",{"path":1099,"title":1100,"description":1101,"categories":1102,"draft":794,"year":1104,"series":6},"\u002Fblog\u002Fnotes-lets-talk-money","Book Notes : Let's Talk Money","My notes and highlights from Let's Talk Money by Monica Halan on managing personal finances and savings.",[828,1103],"Personal Finance","2021-02-26",{"path":1106,"title":1107,"description":1108,"categories":1109,"draft":794,"year":1110,"series":6},"\u002Fblog\u002Fnotes-obviously-awesome","Book Notes : Obviously Awesome","My notes and highlights from Obviously Awesome by April Dunford on product positioning and marketing strategy.",[828,1077],"2020-04-26",{"path":1112,"title":1113,"description":1114,"categories":1115,"draft":794,"year":1117,"series":6},"\u002Fblog\u002Fnotes-refactoring-ui","Book Notes: Refactoring UI","My notes and highlights from Refactoring UI by Adam Wathan and Steve Schoger, full of practical design tips for engineers.",[828,1116],"Design","2020-05-09",{"path":1119,"title":1120,"description":1121,"categories":1122,"draft":794,"year":1123,"series":6},"\u002Fblog\u002Fnotes-rework","Book Notes: Rework","My notes and highlights from Rework by Jason Fried and David Heinemeier Hansson on a better way to succeed in business.",[828,1077],"2021-04-14",{"path":1125,"title":1126,"description":1127,"categories":1128,"draft":794,"year":1130,"series":6},"\u002Fblog\u002Fone-on-one-meetings","Guide to Effective 1:1 Meetings","One on One meetings are important for your personal & professional growth. Learn how to master 1:1s with your manager and peers.",[1129,814],"Career","2023-03-05",{"path":1132,"title":1133,"description":1134,"categories":1135,"draft":794,"year":1136,"series":6},"\u002Fblog\u002Fpersonal-okrs","Personal OKRs for Success","Why one should set personal OKRs and how to achieve success with them",[814,829],"2020-06-27",{"path":1138,"title":1139,"description":1140,"categories":1141,"draft":794,"year":1143,"series":6},"\u002Fblog\u002Fpoker-tips","Poker Tips: Johns Hopkins Poker Class","Notes from Johns Hopkins poker course. This guide will help you improve in Poker and win some large pots.",[829,1142],"Poker","2020-06-13",{"path":1145,"title":1146,"description":1147,"categories":1148,"draft":794,"year":1149,"series":6},"\u002Fblog\u002Fpomodoro","Get work done: The Pomo Way","Learn to focus and get productive by following the Pomodoro Technique",[814],"2020-10-24",{"path":1151,"title":1152,"description":1153,"categories":1154,"draft":794,"year":1155,"series":6},"\u002Fblog\u002Fpostgres-constraints","Postgres Constraints","Constraints are line of defense for database. Explore various types of constrainsts in postgres",[967,815],"2020-11-07",{"path":1157,"title":1158,"description":1159,"categories":1160,"draft":794,"year":1161,"series":6},"\u002Fblog\u002Fppf-explained","PPF Explained","Learn basics about Public Provident Fund and why you should invest",[829,1103],"2020-12-24",{"path":1163,"title":1164,"description":1165,"categories":1166,"draft":794,"year":1167,"series":6},"\u002Fblog\u002Fproductivity-chrome-extensions","Boost Productivity with Chrome Extensions","Utitizing chrome extensions to boost your productivity!",[814,838,837],"2020-04-24",{"path":1169,"title":1170,"description":1171,"categories":1172,"draft":794,"year":1173,"series":6},"\u002Fblog\u002Fproductivity-in-vscode","Improve your productivity with VS Code","Key VS Code features like the integrated terminal, shortcuts, and extensions that improved my everyday productivity.",[814,815],"2020-03-12",{"path":1175,"title":1176,"description":1177,"categories":1178,"draft":794,"year":1179,"series":6},"\u002Fblog\u002Freading-101","Improving Reading 101","Why reading matters, how to build a reading habit, and what to read next - from my own journey into books.",[828,829],"2020-04-04",{"path":1181,"title":1182,"description":1183,"categories":1184,"draft":794,"year":1185,"series":6},"\u002Fblog\u002Freverse-proxy","Understanding Reverse Proxy","Learn about reverse proxy, how it is different from forward proxy and explore advantages of using it in system design.",[845,815],"2021-10-03",{"path":1187,"title":1188,"description":1189,"categories":1190,"draft":794,"year":1191,"series":6},"\u002Fblog\u002Frunning-periodic-background-task-golang","Running periodic background tasks in Golang","How to run periodic background tasks in Golang by combining cron-style scheduling with background execution.",[821,815],"2019-11-21",{"path":1193,"title":1194,"description":1195,"categories":1196,"draft":794,"year":1197,"series":6},"\u002Fblog\u002Fsessions-in-golang","Sessions using Golang and Redis","How cookies and sessions work, and how to implement persistent login sessions in Golang using Redis.",[821,967,815],"2020-02-25",{"path":1199,"title":1200,"description":1201,"categories":1202,"draft":794,"year":1203,"series":6},"\u002Fblog\u002Fsolid-dry-kiss-yagni","Solid Dry Kiss Yagni","An introduction to the SOLID, DRY, KISS, and YAGNI principles and how they help you write cleaner, robust code.",[852],"2020-07-17",{"path":1205,"title":1206,"description":1207,"categories":1208,"draft":794,"year":1209,"series":6},"\u002Fblog\u002Fstack-in-golang","Implement Stack in Golang","Learn how to implement stack data structure in Golang (Full code)",[821,815],"2020-09-14",{"path":1211,"title":1212,"description":1213,"categories":1214,"draft":794,"year":1215,"series":6},"\u002Fblog\u002Fstart-oss-today","Start your Open Source journey today","Start your OSS journey with intro to GIT. Participate in Hacktoberfest!",[905,815],"2020-09-19",{"path":1217,"title":1218,"description":1219,"categories":1220,"draft":794,"year":1222,"series":6},"\u002Fblog\u002Fsticky-social-bar","Sticky social share component in HTML","Learn how to build a social media sharing component in HTML and add it to your website.",[815,1221],"Frontend","2021-02-05",{"path":1224,"title":1225,"description":1226,"categories":1227,"draft":794,"year":1228,"series":6},"\u002Fblog\u002Fterm-insurance","Term insurance Simplified","Everything you need to know before you buy a term insurance.",[829,1103],"2020-11-29",{"path":1230,"title":1231,"description":1232,"categories":1233,"draft":794,"year":1235,"series":6},"\u002Fblog\u002Fterminal-output-with-redirection","Handling terminal outputs with Redirection","Learn how to handle terminal outputs with Redirection and saving it to files",[1052,1234,815],"Terminal","2020-09-06",{"path":1237,"title":1238,"description":1239,"categories":1240,"draft":794,"year":1241,"series":6},"\u002Fblog\u002Fthink-and-grow-rich","Book Notes: Think and Grow Rich","My notes and highlights from Think and Grow Rich by Napoleon Hill, covering its process for building wealth.",[828,829],"2020-05-19",{"path":1243,"title":1244,"description":1245,"categories":1246,"draft":794,"year":1247,"series":6},"\u002Fblog\u002Ftransactions-postgres-golang","Transactions on Postgres with Golang","Performing Postgres database operations in Golang with GORM, from basic queries to full transaction support.",[821,967,815],"2020-03-18",{"path":1249,"title":1250,"description":1251,"categories":1252,"draft":794,"year":1253,"series":6},"\u002Fblog\u002Fwaitgroups-in-golang","WaitGroups in Golang","Learn about WaitGroups in golang and how to use them to perform concurrent operations without blocking the main thread.",[821,815],"2022-05-31",{"path":1255,"title":1256,"description":1257,"categories":1258,"draft":794,"year":1260,"series":6},"\u002Fblog\u002Fwhat-i-use","What I Use: Products and Softwares","List of what I use in my day to day life ranging from terminal, editors, softwares, devices to accessories",[829,1259],"Tech","2024-06-01",{"path":1262,"title":1263,"description":1264,"categories":1265,"draft":794,"year":1266,"series":6},"\u002Fblog\u002Fyear-in-review-2020","Year in Review: 2020","It's a wrap! 2020 was a crazy year, See how my year went!",[829],"2020-12-31",{"path":1268,"title":1269,"description":1270,"categories":1271,"draft":794,"year":1272,"series":6},"\u002Fblog\u002Fyear-in-review-2021","Year in Review: 2021","It's a wrap! 2021 was a mixed bag, full of ups and downs. Key Goal for 2022: Start now!",[829],"2021-12-31",1788073834793]