[{"data":1,"prerenderedAt":1127},["ShallowReactive",2],{"blog-file-attack-html-smuggling":3,"blog-all-for-related":635},{"id":4,"title":5,"author":6,"body":7,"cardAlt":616,"categories":617,"description":620,"draft":621,"extension":622,"headerImage":623,"keywords":624,"meta":625,"name":626,"navigation":627,"path":628,"seo":629,"series":630,"stem":632,"updated":6,"year":633,"__hash__":634},"blog\u002Fblog\u002Ffile-attack-html-smuggling.md","File Attack Deep Dives, Part 2: HTML Smuggling",null,{"type":8,"value":9,"toc":609},"minimark",[10,17,26,29,34,44,91,94,257,264,272,276,285,288,310,318,322,325,375,378,462,466,469,488,492,495,565,568,571,605],[11,12,13],"key-takeaway",{"dataCallout":11},[14,15,16],"p",{},"HTML smuggling never sends the malware. It sends a recipe: encoded text plus a\nsmall script that rebuilds the file inside your browser. Catch it by watching\nwhat the page builds, not what crosses the wire.",[14,18,19,20,25],{},"Part 1 of this series, ",[21,22,24],"a",{"href":23},"\u002Fblog\u002Ffile-attack-field-guide","the field guide",", mapped\nthe file attack families and named HTML smuggling as the one that assembles its\npayload after inspection. This part opens up that family: the exact browser\nflow, why gateways miss it, and the tells that catch it.",[14,27,28],{},"This is the family I see most often in the wild, so it is the one I would learn\nfirst if I were building detection tomorrow.",[30,31,33],"h2",{"id":32},"how-does-html-smuggling-land","How does HTML smuggling land?",[14,35,36,37,43],{},"The delivery is an HTML page or HTML attachment. Inside it sits the payload as\nencoded text, usually Base64, plus a short script. When the victim opens the\npage, the browser follows the recipe and writes the real file to disk. The\ncanonical flow, documented as ",[21,38,42],{"href":39,"rel":40},"https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1027\u002F006\u002F",[41],"nofollow","MITRE T1027.006",":",[45,46,47,51,59,66,77,88],"ol",{},[48,49,50],"li",{},"The page carries the payload as an encoded string, often Base64 inside a\nJavaScript block.",[48,52,53,54,58],{},"The script decodes it, typically with ",[55,56,57],"code",{},"atob()",", into raw bytes.",[48,60,61,62,65],{},"It wraps the bytes in a ",[55,63,64],{},"Blob",", an in-memory file-like object.",[48,67,68,69,72,73,76],{},"It calls ",[55,70,71],{},"URL.createObjectURL(blob)"," to mint a temporary ",[55,74,75],{},"blob:"," URL.",[48,78,79,80,83,84,87],{},"It creates an anchor element, sets ",[55,81,82],{},"href"," to the Blob URL and the\n",[55,85,86],{},"download"," attribute to the chosen filename, and clicks it programmatically.",[48,89,90],{},"The browser treats it as a download and saves the assembled file.",[14,92,93],{},"The whole sequence fits in a few lines:",[95,96,101],"pre",{"className":97,"code":98,"language":99,"meta":100,"style":100},"language-js shiki shiki-themes github-light github-dark","const bytes = Uint8Array.from(atob(encodedPayload), (c) => c.charCodeAt(0));\nconst blob = new Blob([bytes], { type: \"application\u002Foctet-stream\" });\nconst a = document.createElement(\"a\");\na.href = URL.createObjectURL(blob);\na.download = \"invoice.iso\";\na.click();\n","js","",[55,102,103,160,186,210,231,245],{"__ignoreMap":100},[104,105,108,112,116,119,123,127,130,133,136,140,143,146,149,152,154,157],"span",{"class":106,"line":107},"line",1,[104,109,111],{"class":110},"szBVR","const",[104,113,115],{"class":114},"sj4cs"," bytes",[104,117,118],{"class":110}," =",[104,120,122],{"class":121},"sVt8B"," Uint8Array.",[104,124,126],{"class":125},"sScJk","from",[104,128,129],{"class":121},"(",[104,131,132],{"class":125},"atob",[104,134,135],{"class":121},"(encodedPayload), (",[104,137,139],{"class":138},"s4XuR","c",[104,141,142],{"class":121},") ",[104,144,145],{"class":110},"=>",[104,147,148],{"class":121}," c.",[104,150,151],{"class":125},"charCodeAt",[104,153,129],{"class":121},[104,155,156],{"class":114},"0",[104,158,159],{"class":121},"));\n",[104,161,163,165,168,170,173,176,179,183],{"class":106,"line":162},2,[104,164,111],{"class":110},[104,166,167],{"class":114}," blob",[104,169,118],{"class":110},[104,171,172],{"class":110}," new",[104,174,175],{"class":125}," Blob",[104,177,178],{"class":121},"([bytes], { type: ",[104,180,182],{"class":181},"sZZnC","\"application\u002Foctet-stream\"",[104,184,185],{"class":121}," });\n",[104,187,189,191,194,196,199,202,204,207],{"class":106,"line":188},3,[104,190,111],{"class":110},[104,192,193],{"class":114}," a",[104,195,118],{"class":110},[104,197,198],{"class":121}," document.",[104,200,201],{"class":125},"createElement",[104,203,129],{"class":121},[104,205,206],{"class":181},"\"a\"",[104,208,209],{"class":121},");\n",[104,211,213,216,219,222,225,228],{"class":106,"line":212},4,[104,214,215],{"class":121},"a.href ",[104,217,218],{"class":110},"=",[104,220,221],{"class":114}," URL",[104,223,224],{"class":121},".",[104,226,227],{"class":125},"createObjectURL",[104,229,230],{"class":121},"(blob);\n",[104,232,234,237,239,242],{"class":106,"line":233},5,[104,235,236],{"class":121},"a.download ",[104,238,218],{"class":110},[104,240,241],{"class":181}," \"invoice.iso\"",[104,243,244],{"class":121},";\n",[104,246,248,251,254],{"class":106,"line":247},6,[104,249,250],{"class":121},"a.",[104,252,253],{"class":125},"click",[104,255,256],{"class":121},"();\n",[14,258,259,260,263],{},"On older Internet Explorer and legacy Edge builds, the same outcome goes\nthrough ",[55,261,262],{},"window.navigator.msSaveBlob(blob, filename)"," instead of the anchor\nflow, so smuggling kits probe for it as a fallback path.",[14,265,266,267,271],{},"Strip the script away and what is left is a base64 string. Paste a sample into\nthe ",[21,268,270],{"href":269},"\u002Ftools\u002Fbase64","Base64 workbench"," and you can decode it by hand to see the\nfile it rebuilds. That is the whole trick: the malware is a text file until the\nbrowser turns it into a binary.",[30,273,275],{"id":274},"why-do-gateways-miss-html-smuggling","Why do gateways miss HTML smuggling?",[14,277,278,279,284],{},"A gateway inspects what crosses the wire. In HTML smuggling, what crosses the\nwire is benign-looking HTML and JavaScript plus encoded text. There is no\nexecutable, no archive, no container to detonate at the choke point. Microsoft's\nwriteup of the technique puts it plainly: gateways only see benign HTML and\nJavaScript traffic while the malicious file is created on the endpoint after\nthe page loads (",[21,280,283],{"href":281,"rel":282},"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2021\u002F11\u002F11\u002Fhtml-smuggling-surges-highly-evasive-loader-technique-increasingly-used-in-banking-malware-targeted-attacks\u002F",[41],"HTML smuggling surges",").",[14,286,287],{},"Three properties combine to make that gap reliable:",[289,290,291,298,304],"ul",{},[48,292,293,297],{},[294,295,296],"strong",{},"Assembly happens after inspection."," Decoding and Blob construction run at\nrender time, on the victim's machine, past every transit scanner.",[48,299,300,303],{},[294,301,302],{},"The page looks ordinary."," Encoded strings and Blob calls are also what\nlegitimate export-to-CSV and document-preview features use, so naive pattern\nblocks drown in false positives.",[48,305,306,309],{},[294,307,308],{},"The payload shape is free."," Attackers split the encoded text across\nvariables, nest encodings, or serve it as fragments, so no single static\nsignature survives rotation.",[14,311,312,313,284],{},"This is not theoretical. In May 2024, Huntress documented a mass campaign that\npaired an HTML smuggling payload with an injected iframe proxying the Outlook\nlogin portal, stealing sessions when victims logged in (",[21,314,317],{"href":315,"rel":316},"https:\u002F\u002Fwww.huntress.com\u002Fblog\u002Fsmugglers-gambit-uncovering-html-smuggling-adversary-in-the-middle-tradecraft",[41],"Smuggler's Gambit",[30,319,321],{"id":320},"what-does-html-smuggling-look-like-to-detection","What does HTML smuggling look like to detection?",[14,323,324],{},"Detection lives where the file materializes: the endpoint and the browser, not\nthe wire. Work through these in order of signal quality.",[289,326,327,351,357,363,369],{},[48,328,329,332,333,335,336,339,340,343,344,347,348,350],{},[294,330,331],{},"Script pattern in the page."," ",[55,334,57],{}," or equivalent decoding feeding\n",[55,337,338],{},"new Blob()",", followed by ",[55,341,342],{},"URL.createObjectURL()"," and a programmatic\n",[55,345,346],{},".click()"," on an anchor with a ",[55,349,86],{}," attribute. Any one call is common;\nthe chained sequence in a single page is the tell.",[48,352,353,356],{},[294,354,355],{},"Oversized HTML with encoded weight."," An HTML attachment carrying a large\nBase64 block or concatenated string fragments, especially paired with\nobfuscated script, deserves sandbox detonation rather than a static pass.",[48,358,359,362],{},[294,360,361],{},"Download with no matching fetch."," The browser writes a file, often an ISO,\nZIP, or LNK, to Downloads or temp with no corresponding network object of\nthat type. A download that appears from nowhere was built locally.",[48,364,365,368],{},[294,366,367],{},"Browser-as-parent file writes."," A browser process writing an executable,\narchive, or disk image, followed within seconds by execution, is the\nbehavioral pair that survives obfuscation.",[48,370,371,374],{},[294,372,373],{},"Missing Mark of the Web."," A payload that runs without the Zone.Identifier\nmarker it should carry suggests a container stripped provenance on the way\nin. Treat absent MOTW on an internet-born file as an anomaly, not a detail.",[14,376,377],{},"Pick a pattern below, see how it lands, then reveal the tell and the detection.",[95,379,383],{"className":380,"code":381,"language":382,"meta":100,"style":100},"language-files shiki shiki-themes github-light github-dark","[\n  {\n    \"name\": \"HTML smuggling\",\n    \"how\": \"An HTML page or attachment carries Base64-encoded bytes plus script. On open, the browser decodes them, builds a Blob, mints a blob: URL, and triggers a download with the anchor download attribute.\",\n    \"tell\": \"Decoding calls feeding new Blob(), URL.createObjectURL with a programmatic click, and a download with no matching network fetch.\",\n    \"detect\": \"Detonate HTML attachments in a sandbox that emulates script, watch for Blob and download behavior, and inspect the materialized file.\"\n  },\n  {\n    \"name\": \"Direct malicious attachment (contrast)\",\n    \"how\": \"A plain executable or macro document travels intact across the wire. The malicious bytes are present at the gateway and visible to static inspection.\",\n    \"tell\": \"Known-bad hash or extension, malicious strings in the attachment bytes themselves, no browser assembly step.\",\n    \"detect\": \"Hash and signature matching at the gateway plus sandbox detonation catch it before delivery.\"\n  }\n]\n","files",[55,384,385,390,395,400,405,410,415,421,426,432,438,444,450,456],{"__ignoreMap":100},[104,386,387],{"class":106,"line":107},[104,388,389],{},"[\n",[104,391,392],{"class":106,"line":162},[104,393,394],{},"  {\n",[104,396,397],{"class":106,"line":188},[104,398,399],{},"    \"name\": \"HTML smuggling\",\n",[104,401,402],{"class":106,"line":212},[104,403,404],{},"    \"how\": \"An HTML page or attachment carries Base64-encoded bytes plus script. On open, the browser decodes them, builds a Blob, mints a blob: URL, and triggers a download with the anchor download attribute.\",\n",[104,406,407],{"class":106,"line":233},[104,408,409],{},"    \"tell\": \"Decoding calls feeding new Blob(), URL.createObjectURL with a programmatic click, and a download with no matching network fetch.\",\n",[104,411,412],{"class":106,"line":247},[104,413,414],{},"    \"detect\": \"Detonate HTML attachments in a sandbox that emulates script, watch for Blob and download behavior, and inspect the materialized file.\"\n",[104,416,418],{"class":106,"line":417},7,[104,419,420],{},"  },\n",[104,422,424],{"class":106,"line":423},8,[104,425,394],{},[104,427,429],{"class":106,"line":428},9,[104,430,431],{},"    \"name\": \"Direct malicious attachment (contrast)\",\n",[104,433,435],{"class":106,"line":434},10,[104,436,437],{},"    \"how\": \"A plain executable or macro document travels intact across the wire. The malicious bytes are present at the gateway and visible to static inspection.\",\n",[104,439,441],{"class":106,"line":440},11,[104,442,443],{},"    \"tell\": \"Known-bad hash or extension, malicious strings in the attachment bytes themselves, no browser assembly step.\",\n",[104,445,447],{"class":106,"line":446},12,[104,448,449],{},"    \"detect\": \"Hash and signature matching at the gateway plus sandbox detonation catch it before delivery.\"\n",[104,451,453],{"class":106,"line":452},13,[104,454,455],{},"  }\n",[104,457,459],{"class":106,"line":458},14,[104,460,461],{},"]\n",[30,463,465],{"id":464},"how-do-you-defend-against-it","How do you defend against it?",[14,467,468],{},"The fix follows the tell. Detonate HTML attachments in a sandbox that actually\nruns the script and watches what gets written, alert on the browser-writes-then-\nexecutes pair at the endpoint, and treat missing Mark of the Web as a signal.\nBlocking external HTML attachments outright is the blunt version of the same\nidea and fits some environments.",[470,471,472,477,480,485],"faq",{"dataFaq":100},[14,473,474],{},[294,475,476],{},"Does blocking HTML attachments stop HTML smuggling?",[14,478,479],{},"Mostly, for the email path. No HTML attachment means no in-browser assembly\nfrom mail. But the same recipe works from a link to a hosted page, so endpoint\nbehavioral detection still matters.",[14,481,482],{},[294,483,484],{},"Why not just alert on every Blob and download call?",[14,486,487],{},"Because legitimate web apps build files the same way: exports, previews, and\ngenerated reports all use Blob plus the download attribute. Alert on the full\nchain, decoding into Blob construction into a programmatic download, ideally\npaired with a file write the endpoint did not fetch.",[30,489,491],{"id":490},"test-yourself","Test yourself",[14,493,494],{},"A quick self-check on HTML smuggling. Pick an option to see the answer.",[95,496,500],{"className":497,"code":498,"language":499,"meta":100,"style":100},"language-quiz shiki shiki-themes github-light github-dark","[\n  {\n    \"q\": \"Where is the malicious file assembled in HTML smuggling?\",\n    \"options\": [\"On the email gateway\", \"In the victim's browser\", \"On the attacker's server\"],\n    \"answer\": 1,\n    \"explain\": \"Encoded bytes travel across the wire; the browser decodes them and builds the file via Blob APIs at render time.\"\n  },\n  {\n    \"q\": \"Which API sequence is the core smuggling tell?\",\n    \"options\": [\"fetch() then innerHTML\", \"atob() to new Blob() to URL.createObjectURL() with a programmatic click\", \"WebSocket then localStorage\"],\n    \"answer\": 1,\n    \"explain\": \"Decoding feeding Blob construction, a blob: URL, and a forced download is the chained pattern to watch for.\"\n  }\n]\n","quiz",[55,501,502,506,510,515,520,525,530,534,538,543,548,552,557,561],{"__ignoreMap":100},[104,503,504],{"class":106,"line":107},[104,505,389],{},[104,507,508],{"class":106,"line":162},[104,509,394],{},[104,511,512],{"class":106,"line":188},[104,513,514],{},"    \"q\": \"Where is the malicious file assembled in HTML smuggling?\",\n",[104,516,517],{"class":106,"line":212},[104,518,519],{},"    \"options\": [\"On the email gateway\", \"In the victim's browser\", \"On the attacker's server\"],\n",[104,521,522],{"class":106,"line":233},[104,523,524],{},"    \"answer\": 1,\n",[104,526,527],{"class":106,"line":247},[104,528,529],{},"    \"explain\": \"Encoded bytes travel across the wire; the browser decodes them and builds the file via Blob APIs at render time.\"\n",[104,531,532],{"class":106,"line":417},[104,533,420],{},[104,535,536],{"class":106,"line":423},[104,537,394],{},[104,539,540],{"class":106,"line":428},[104,541,542],{},"    \"q\": \"Which API sequence is the core smuggling tell?\",\n",[104,544,545],{"class":106,"line":434},[104,546,547],{},"    \"options\": [\"fetch() then innerHTML\", \"atob() to new Blob() to URL.createObjectURL() with a programmatic click\", \"WebSocket then localStorage\"],\n",[104,549,550],{"class":106,"line":440},[104,551,524],{},[104,553,554],{"class":106,"line":446},[104,555,556],{},"    \"explain\": \"Decoding feeding Blob construction, a blob: URL, and a forced download is the chained pattern to watch for.\"\n",[104,558,559],{"class":106,"line":452},[104,560,455],{},[104,562,563],{"class":106,"line":458},[104,564,461],{},[14,566,567],{},"Next in this series: Document macros, then PDF URL actions, then LNK and ISO\nsmuggling, each with its own payload pattern and detection.",[14,569,570],{},"Useful references:",[289,572,573,579,585,591,598],{},[48,574,575],{},[21,576,578],{"href":39,"rel":577},[41],"HTML Smuggling, sub-technique T1027.006",[48,580,581],{},[21,582,584],{"href":281,"rel":583},[41],"HTML smuggling surges: a highly evasive loader technique (Microsoft)",[48,586,587],{},[21,588,590],{"href":315,"rel":589},[41],"Smuggler's Gambit: HTML smuggling plus adversary-in-the-middle tradecraft (Huntress)",[48,592,593],{},[21,594,597],{"href":595,"rel":596},"https:\u002F\u002Fabnormal.ai\u002Fblog\u002Fwhat-is-html-smuggling",[41],"What is HTML smuggling? (Abnormal)",[48,599,600],{},[21,601,604],{"href":602,"rel":603},"https:\u002F\u002Fgithub.com\u002Fsublime-security\u002Fsublime-rules",[41],"Open-source detection rules for HTML smuggling (Sublime Security)",[606,607,608],"style",{},"html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .s4XuR, html code.shiki .s4XuR{--shiki-default:#E36209;--shiki-dark:#FFAB70}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":100,"searchDepth":162,"depth":162,"links":610},[611,612,613,614,615],{"id":32,"depth":162,"text":33},{"id":274,"depth":162,"text":275},{"id":320,"depth":162,"text":321},{"id":464,"depth":162,"text":465},{"id":490,"depth":162,"text":491},"Browser assembling a downloaded file from a Blob URL",[618,619],"Security","Systems","How attackers assemble malware inside the browser with Blob URLs, and the URL and script tells that catch it.",false,"md","blog\u002Ffile-attack-html-smuggling\u002Ffile-attack-html-smuggling-card.webp","html smuggling, blob url, download attribute, email security, detection",{},"file-attack-html-smuggling",true,"\u002Fblog\u002Ffile-attack-html-smuggling",{"title":5,"description":620},{"name":631,"part":162},"File Attack Deep Dives","blog\u002Ffile-attack-html-smuggling","2026-09-12","_p9iWWrjgcbsrPImqb0QrfGIqXKOyzsItRFb4wLCkoc",[636,644,651,659,668,675,682,689,695,701,707,713,719,726,731,734,741,748,754,761,767,773,779,785,791,797,803,809,816,823,829,835,841,847,853,859,865,871,877,883,889,895,901,908,914,920,926,933,939,945,952,959,965,972,978,985,991,998,1004,1010,1016,1022,1028,1034,1040,1046,1052,1058,1064,1070,1077,1083,1090,1096,1102,1108,1115,1121],{"path":637,"title":638,"description":639,"categories":640,"draft":627,"year":643,"series":6},"\u002Fblog\u002Fai-assisted-workstation","Building an AI-Assisted Personal Workstation","How I built a personal AI workstation: markdown knowledge base, portable agent skills, handoff-driven sessions. What worked, what broke, what I would change.",[641,642],"Productivity","Programming","2026-08-26",{"path":645,"title":646,"description":647,"categories":648,"draft":621,"year":650,"series":6},"\u002Fblog\u002Faws-s3-golang","Uploading images to AWS S3 in Golang","In this tutorial I cover how to upload, fetch and manage other operations for objects on AWS S3 in Golang",[649,642],"Golang","2020-01-12",{"path":652,"title":653,"description":654,"categories":655,"draft":621,"year":658,"series":6},"\u002Fblog\u002Fbooks-for-engineers","Best Books for Software Engineers","Best Books to help you build you software engineering career - ranging from fundamentats, interview prep to productivity.",[656,657],"Books","Life","2021-12-26",{"path":660,"title":661,"description":662,"categories":663,"draft":621,"year":667,"series":6},"\u002Fblog\u002Fbuilding-acrons","Building Acrons 🚀","Building Acrons, a one-stop tool to decode everyday acronyms like DIY, FOMO, and BRB without losing your flow.",[664,665,666],"Side Projects","Web","Tools","2020-05-26",{"path":669,"title":670,"description":671,"categories":672,"draft":621,"year":674,"series":6},"\u002Fblog\u002Fcap-theorem","CAP Theorem Explained","Learn the concept and misconceptions around popular CAP theorem in system design.",[673,642],"System Design","2021-07-26",{"path":676,"title":677,"description":678,"categories":679,"draft":621,"year":681,"series":6},"\u002Fblog\u002Fcode-reviews","Code Review Checklist","Why code reviews matter, and best practices that catch bugs early and keep code quality high before merge.",[680],"Engineering Principles","2020-07-20",{"path":683,"title":684,"description":685,"categories":686,"draft":621,"year":688,"series":6},"\u002Fblog\u002Fdark-mode","Add Dark mode to websites","Dark mode is ❤️️ Add it to your websites with little CSS and JS",[687,665],"Javascript","2020-07-04",{"path":690,"title":691,"description":692,"categories":693,"draft":621,"year":694,"series":6},"\u002Fblog\u002Fdate-time-golang","Working with Date and Time in Go","Learn how to use time in Golang - Multiple formats, locations and using date.",[649,642],"2020-10-09",{"path":696,"title":697,"description":698,"categories":699,"draft":621,"year":700,"series":6},"\u002Fblog\u002Fdefer-in-golang","Understanding Defer In Golang","Learn about defer keyword in golang and how it can help you avoid panics due to bugs.",[649,642],"2021-05-05",{"path":702,"title":703,"description":704,"categories":705,"draft":621,"year":706,"series":6},"\u002Fblog\u002Fenums-golang","Implementing Enums in Golang","Enums are a way to defined set of constant values. Learn how to implement enums in Go using iota with examples.",[649,642],"2021-12-18",{"path":708,"title":709,"description":710,"categories":711,"draft":621,"year":712,"series":6},"\u002Fblog\u002Fenvironment-variable-golang","Guide to Environment variables in Go","Learn what are environment variables and how to use them in Go",[649,642],"2020-08-14",{"path":714,"title":715,"description":716,"categories":717,"draft":621,"year":718,"series":6},"\u002Fblog\u002Ferror-handling-golang","Handle errors the right way — Golang","How to handle errors in golang to make your life easy",[649,642],"2020-01-30",{"path":720,"title":721,"description":722,"categories":723,"draft":627,"year":724,"series":725},"\u002Fblog\u002Ffile-attack-document-macros","File Attack Deep Dives, Part 3: Document Macros","How malicious VBA hides in vbaProject.bin, which AutoOpen entry points fire it, and the sandbox signals that catch it.",[618,619],"2026-09-17",{"name":631,"part":188},{"path":23,"title":727,"description":728,"categories":729,"draft":621,"year":643,"series":730},"How File-Based Attacks Land: A Detection Engineer's Field Guide","A practical taxonomy of how malware and phishing arrive as files, why classic controls miss them, and how detection should think.",[618,619],{"name":631,"part":107},{"path":628,"title":5,"description":620,"categories":732,"draft":621,"year":633,"series":733},[618,619],{"name":631,"part":162},{"path":735,"title":736,"description":737,"categories":738,"draft":627,"year":739,"series":740},"\u002Fblog\u002Ffile-attack-lnk-iso","File Attack Deep Dives, Part 5: LNK and ISO Smuggling","How ISO containers and weaponized shortcuts bypass Mark of the Web, and the forensic fields that catch them.",[618,619],"2026-10-01",{"name":631,"part":233},{"path":742,"title":743,"description":744,"categories":745,"draft":627,"year":746,"series":747},"\u002Fblog\u002Ffile-attack-pdf-url-actions","File Attack Deep Dives, Part 4: PDF URL Actions","How PDF OpenAction, Launch, and URI actions turn opening a document into a phishing click, and the action audit that catches them.",[618,619],"2026-09-24",{"name":631,"part":212},{"path":749,"title":750,"description":751,"categories":752,"draft":621,"year":753,"series":6},"\u002Fblog\u002Ffile-upload-golang","Uploading Files in Golang with Multipart Request","Learn how to upload files from your client to server as a multipart request in Golang.",[649,642],"2021-03-13",{"path":755,"title":756,"description":757,"categories":758,"draft":621,"year":760,"series":6},"\u002Fblog\u002Fgit-branch","Git Branch 101","Branching is a new path of development that makes it a lot easier to build features. Learn why and how to use branching in git.",[759,642],"Git","2022-03-20",{"path":762,"title":763,"description":764,"categories":765,"draft":621,"year":766,"series":6},"\u002Fblog\u002Fgit-pull-request-template","Guide to Pull Request Templates","Improve collaboration and code reviews with pull request templates. Blog include PR template and how to create one on github\u002Fgitlab",[759,642],"2023-08-24",{"path":768,"title":769,"description":770,"categories":771,"draft":621,"year":772,"series":6},"\u002Fblog\u002Fgit-remove-sensitive-info","Securing Git: Remove Sensitive Information","Protect your code from security breaches by using BFG tool to remove sensitive information from Git history. Learn how to do it in this comprehensive guide.",[759,642],"2023-10-16",{"path":774,"title":775,"description":776,"categories":777,"draft":621,"year":778,"series":6},"\u002Fblog\u002Fgit-tags-explained","Git tags : Explained","What Git tags are, why and when to use them, and how to start tagging releases in your own projects.",[759,642],"2020-06-18",{"path":780,"title":781,"description":782,"categories":783,"draft":621,"year":784,"series":6},"\u002Fblog\u002Fgo-dependency-injection","Dependency Injection in Go using Wire","Learn about dependency injection, its benefits and how to implement it in Go services using wire",[649,642],"2022-11-26",{"path":786,"title":787,"description":788,"categories":789,"draft":621,"year":790,"series":6},"\u002Fblog\u002Fgo-generics","Introduction to Generics in Go","Learn about generics in Golang, it's benefits and how to implement it in applications.",[649,642],"2022-11-27",{"path":792,"title":793,"description":794,"categories":795,"draft":621,"year":796,"series":6},"\u002Fblog\u002Fgo-in-memory-cache","Building In-Memory Cache in Go","Learn about in-memory caching in Golang, it's benefits and how to implement it with and without generics with a TTL(expiry).",[649,642],"2024-03-28",{"path":798,"title":799,"description":800,"categories":801,"draft":621,"year":802,"series":6},"\u002Fblog\u002Fgo-makefile","Ultimate Makefile for Golang","Boost your productivity and save time with ultimate Makefile for Golang projects.",[649,642],"2024-06-10",{"path":804,"title":805,"description":806,"categories":807,"draft":621,"year":808,"series":6},"\u002Fblog\u002Fgo-middleware","Mastering Middlewares in Golang","Learn about middlewares, their use cases and how to implement them in Golang applications",[649,642],"2022-03-13",{"path":810,"title":811,"description":812,"categories":813,"draft":621,"year":815,"series":6},"\u002Fblog\u002Fgo-naming-conventions","Naming Conventions in Golang","Why naming conventions matter in Go, with best practices and practical examples for clear, readable, maintainable code.",[649,642,814],"Code Quality","2023-05-19",{"path":817,"title":818,"description":819,"categories":820,"draft":621,"year":822,"series":6},"\u002Fblog\u002Fgo-with-redis","Go with Redis","A practical introduction to using Redis with Golang to make your applications faster with in-memory data storage.",[649,821,642],"Database","2020-05-03",{"path":824,"title":825,"description":826,"categories":827,"draft":621,"year":828,"series":6},"\u002Fblog\u002Fgolang-maps","Learn Maps in Golang (with examples)","A complete guide to maps in Golang: creating maps, adding and removing items, iterating, and how map equality works.",[649,642],"2020-09-10",{"path":830,"title":831,"description":832,"categories":833,"draft":621,"year":834,"series":6},"\u002Fblog\u002Fguide-to-cdn","Guide to Content Delivery Network","CDN is one of the backbone of modern world internet infrastructure. Learn about Content Delivery Network, it's working, types and benefits.",[673,642],"2022-01-23",{"path":836,"title":837,"description":838,"categories":839,"draft":621,"year":840,"series":6},"\u002Fblog\u002Fguide-to-rule-engines","Guide to Rule Engines","Rule Engines help in solving changing business requirements with ease. Learn all about Rule engines, it's working, benefits and how to implement one in Golang",[649,642],"2022-09-12",{"path":842,"title":843,"description":844,"categories":845,"draft":621,"year":846,"series":6},"\u002Fblog\u002Fhexagonal-architecture","Guide to Hexagonal Architecture","Learn how to design efficient application with hexagonal architecture with practical example",[673,642],"2020-12-13",{"path":848,"title":849,"description":850,"categories":851,"draft":621,"year":852,"series":6},"\u002Fblog\u002Fhttp-status-codes","Learn HTTP Status Codes","A tour of HTTP response status codes, what each class means, and when to use which code in your applications.",[665,642],"2020-07-30",{"path":854,"title":855,"description":856,"categories":857,"draft":621,"year":858,"series":6},"\u002Fblog\u002Fintroduction-to-goroutines","Introduction to Goroutines","Understand the basics of concurrency and learn how to work with Goroutines in golang.",[649,642],"2021-04-10",{"path":860,"title":861,"description":862,"categories":863,"draft":621,"year":864,"series":6},"\u002Fblog\u002Fjson-in-postgres-with-golang","Storing JSON in Postgres with Golang","Learn how to store JSON objects in Postgres and how to implement it in Golang.",[642,821,649],"2021-02-13",{"path":866,"title":867,"description":868,"categories":869,"draft":621,"year":870,"series":6},"\u002Fblog\u002Fjson-web-token","Complete Guide to JWT","JSON Web Tokens are a very compact way to carry information. Learn about JWTs in depth, from its structure to when to use it.",[642,665],"2021-11-20",{"path":872,"title":873,"description":874,"categories":875,"draft":621,"year":876,"series":6},"\u002Fblog\u002Flearn-to-say-no","Learning to say No","Learn why it's important to say 'NO'. How it helps in increasing productivity and explore strategies for saying No",[657,656],"2022-04-09",{"path":878,"title":879,"description":880,"categories":881,"draft":621,"year":882,"series":6},"\u002Fblog\u002Flearn-unlearn-relearn","Learn - Unlearn - Relearn","Unlearning things to learn new is the way to grow. Discover how to do that!",[641,657],"2020-09-25",{"path":884,"title":885,"description":886,"categories":887,"draft":621,"year":888,"series":6},"\u002Fblog\u002Flinting-in-golang","Introduction to Linting in Go","Introduction to improving code quality using linting. Learn how to add linting in your Go projects.",[649,642],"2021-07-07",{"path":890,"title":891,"description":892,"categories":893,"draft":621,"year":894,"series":6},"\u002Fblog\u002Fload-balancing","Load Balancing 101","Complete guide on load balancers explaining the internal working and how does it help in making applications efficient.",[673,642],"2021-05-29",{"path":896,"title":897,"description":898,"categories":899,"draft":621,"year":900,"series":6},"\u002Fblog\u002Fmaking-decisions-the-right-way","Making Decisions: The right way","Decisions are hard! Learn how to make the right decisions always",[641,657],"2020-06-07",{"path":902,"title":903,"description":904,"categories":905,"draft":621,"year":907,"series":6},"\u002Fblog\u002Fmanage-logs-with-logrotate","Using Logrotate to manage logs","Learn how to use logrotate system utility to manage logs with example",[906,642],"Linux","2020-09-08",{"path":909,"title":910,"description":911,"categories":912,"draft":621,"year":913,"series":6},"\u002Fblog\u002Fmarshal-structs-golang","Marshal structs the right way: Golang","Why Golang marshals empty structs into your JSON instead of null, and how to marshal structs the right way.",[649,642],"2020-03-31",{"path":915,"title":916,"description":917,"categories":918,"draft":621,"year":919,"series":6},"\u002Fblog\u002Fnotes-almanack-naval","Book Notes : Almanack of Naval Ravikant","My notes\u002Fhighlights from Almanack of Naval Ravikant book by Eric Jorgenson",[656,657],"2020-10-17",{"path":921,"title":922,"description":923,"categories":924,"draft":621,"year":925,"series":6},"\u002Fblog\u002Fnotes-anything-you-want","Book Notes : Anything you want","My notes\u002Fhighlights from Anything you want book by Derek Sivers",[656,657],"2021-09-25",{"path":927,"title":928,"description":929,"categories":930,"draft":621,"year":932,"series":6},"\u002Fblog\u002Fnotes-getting-real","Book Notes : Getting Real","My notes and highlights from Getting Real by Jason Fried and David Heinemeier Hansson on building web applications.",[656,931],"Startups","2020-11-03",{"path":934,"title":935,"description":936,"categories":937,"draft":621,"year":938,"series":6},"\u002Fblog\u002Fnotes-hell-yeah-or-no","Book Notes : Hell Yeah or No","My notes\u002Fhighlights from Hell Yeah or No book by Derek Sivers",[656,657],"2020-09-16",{"path":940,"title":941,"description":942,"categories":943,"draft":621,"year":944,"series":6},"\u002Fblog\u002Fnotes-how-to-be-a-capitalist","Book Notes : How to Be a Capitalist Without Any Capital","My notes\u002Fhighlights from How to Be a Capitalist Without Any Capital by Nathan Latka",[656,931],"2020-01-07",{"path":946,"title":947,"description":948,"categories":949,"draft":621,"year":951,"series":6},"\u002Fblog\u002Fnotes-lean-b2b","Book Notes : Lean B2B","My notes and highlights from Lean B2B by Étienne Garbugli on assessing markets, building MVPs, and selling to businesses.",[656,950],"Entrepreneurship","2022-07-02",{"path":953,"title":954,"description":955,"categories":956,"draft":621,"year":958,"series":6},"\u002Fblog\u002Fnotes-lets-talk-money","Book Notes : Let's Talk Money","My notes and highlights from Let's Talk Money by Monica Halan on managing personal finances and savings.",[656,957],"Personal Finance","2021-02-26",{"path":960,"title":961,"description":962,"categories":963,"draft":621,"year":964,"series":6},"\u002Fblog\u002Fnotes-obviously-awesome","Book Notes : Obviously Awesome","My notes and highlights from Obviously Awesome by April Dunford on product positioning and marketing strategy.",[656,931],"2020-04-26",{"path":966,"title":967,"description":968,"categories":969,"draft":621,"year":971,"series":6},"\u002Fblog\u002Fnotes-refactoring-ui","Book Notes: Refactoring UI","My notes and highlights from Refactoring UI by Adam Wathan and Steve Schoger, full of practical design tips for engineers.",[656,970],"Design","2020-05-09",{"path":973,"title":974,"description":975,"categories":976,"draft":621,"year":977,"series":6},"\u002Fblog\u002Fnotes-rework","Book Notes: Rework","My notes and highlights from Rework by Jason Fried and David Heinemeier Hansson on a better way to succeed in business.",[656,931],"2021-04-14",{"path":979,"title":980,"description":981,"categories":982,"draft":621,"year":984,"series":6},"\u002Fblog\u002Fone-on-one-meetings","Guide to Effective 1:1 Meetings","One on One meetings are important for your personal & professional growth. Learn how to master 1:1s with your manager and peers.",[983,641],"Career","2023-03-05",{"path":986,"title":987,"description":988,"categories":989,"draft":621,"year":990,"series":6},"\u002Fblog\u002Fpersonal-okrs","Personal OKRs for Success","Why one should set personal OKRs and how to achieve success with them",[641,657],"2020-06-27",{"path":992,"title":993,"description":994,"categories":995,"draft":621,"year":997,"series":6},"\u002Fblog\u002Fpoker-tips","Poker Tips: Johns Hopkins Poker Class","Notes from Johns Hopkins poker course. This guide will help you improve in Poker and win some large pots.",[657,996],"Poker","2020-06-13",{"path":999,"title":1000,"description":1001,"categories":1002,"draft":621,"year":1003,"series":6},"\u002Fblog\u002Fpomodoro","Get work done: The Pomo Way","Learn to focus and get productive by following the Pomodoro Technique",[641],"2020-10-24",{"path":1005,"title":1006,"description":1007,"categories":1008,"draft":621,"year":1009,"series":6},"\u002Fblog\u002Fpostgres-constraints","Postgres Constraints","Constraints are line of defense for database. Explore various types of constrainsts in postgres",[821,642],"2020-11-07",{"path":1011,"title":1012,"description":1013,"categories":1014,"draft":621,"year":1015,"series":6},"\u002Fblog\u002Fppf-explained","PPF Explained","Learn basics about Public Provident Fund and why you should invest",[657,957],"2020-12-24",{"path":1017,"title":1018,"description":1019,"categories":1020,"draft":621,"year":1021,"series":6},"\u002Fblog\u002Fproductivity-chrome-extensions","Boost Productivity with Chrome Extensions","Utitizing chrome extensions to boost your productivity!",[641,666,665],"2020-04-24",{"path":1023,"title":1024,"description":1025,"categories":1026,"draft":621,"year":1027,"series":6},"\u002Fblog\u002Fproductivity-in-vscode","Improve your productivity with VS Code","Key VS Code features like the integrated terminal, shortcuts, and extensions that improved my everyday productivity.",[641,642],"2020-03-12",{"path":1029,"title":1030,"description":1031,"categories":1032,"draft":621,"year":1033,"series":6},"\u002Fblog\u002Freading-101","Improving Reading 101","Why reading matters, how to build a reading habit, and what to read next - from my own journey into books.",[656,657],"2020-04-04",{"path":1035,"title":1036,"description":1037,"categories":1038,"draft":621,"year":1039,"series":6},"\u002Fblog\u002Freverse-proxy","Understanding Reverse Proxy","Learn about reverse proxy, how it is different from forward proxy and explore advantages of using it in system design.",[673,642],"2021-10-03",{"path":1041,"title":1042,"description":1043,"categories":1044,"draft":621,"year":1045,"series":6},"\u002Fblog\u002Frunning-periodic-background-task-golang","Running periodic background tasks in Golang","How to run periodic background tasks in Golang by combining cron-style scheduling with background execution.",[649,642],"2019-11-21",{"path":1047,"title":1048,"description":1049,"categories":1050,"draft":621,"year":1051,"series":6},"\u002Fblog\u002Fsessions-in-golang","Sessions using Golang and Redis","How cookies and sessions work, and how to implement persistent login sessions in Golang using Redis.",[649,821,642],"2020-02-25",{"path":1053,"title":1054,"description":1055,"categories":1056,"draft":621,"year":1057,"series":6},"\u002Fblog\u002Fsolid-dry-kiss-yagni","Solid Dry Kiss Yagni","An introduction to the SOLID, DRY, KISS, and YAGNI principles and how they help you write cleaner, robust code.",[680],"2020-07-17",{"path":1059,"title":1060,"description":1061,"categories":1062,"draft":621,"year":1063,"series":6},"\u002Fblog\u002Fstack-in-golang","Implement Stack in Golang","Learn how to implement stack data structure in Golang (Full code)",[649,642],"2020-09-14",{"path":1065,"title":1066,"description":1067,"categories":1068,"draft":621,"year":1069,"series":6},"\u002Fblog\u002Fstart-oss-today","Start your Open Source journey today","Start your OSS journey with intro to GIT. Participate in Hacktoberfest!",[759,642],"2020-09-19",{"path":1071,"title":1072,"description":1073,"categories":1074,"draft":621,"year":1076,"series":6},"\u002Fblog\u002Fsticky-social-bar","Sticky social share component in HTML","Learn how to build a social media sharing component in HTML and add it to your website.",[642,1075],"Frontend","2021-02-05",{"path":1078,"title":1079,"description":1080,"categories":1081,"draft":621,"year":1082,"series":6},"\u002Fblog\u002Fterm-insurance","Term insurance Simplified","Everything you need to know before you buy a term insurance.",[657,957],"2020-11-29",{"path":1084,"title":1085,"description":1086,"categories":1087,"draft":621,"year":1089,"series":6},"\u002Fblog\u002Fterminal-output-with-redirection","Handling terminal outputs with Redirection","Learn how to handle terminal outputs with Redirection and saving it to files",[906,1088,642],"Terminal","2020-09-06",{"path":1091,"title":1092,"description":1093,"categories":1094,"draft":621,"year":1095,"series":6},"\u002Fblog\u002Fthink-and-grow-rich","Book Notes: Think and Grow Rich","My notes and highlights from Think and Grow Rich by Napoleon Hill, covering its process for building wealth.",[656,657],"2020-05-19",{"path":1097,"title":1098,"description":1099,"categories":1100,"draft":621,"year":1101,"series":6},"\u002Fblog\u002Ftransactions-postgres-golang","Transactions on Postgres with Golang","Performing Postgres database operations in Golang with GORM, from basic queries to full transaction support.",[649,821,642],"2020-03-18",{"path":1103,"title":1104,"description":1105,"categories":1106,"draft":621,"year":1107,"series":6},"\u002Fblog\u002Fwaitgroups-in-golang","WaitGroups in Golang","Learn about WaitGroups in golang and how to use them to perform concurrent operations without blocking the main thread.",[649,642],"2022-05-31",{"path":1109,"title":1110,"description":1111,"categories":1112,"draft":621,"year":1114,"series":6},"\u002Fblog\u002Fwhat-i-use","What I Use: Products and Softwares","List of what I use in my day to day life ranging from terminal, editors, softwares, devices to accessories",[657,1113],"Tech","2024-06-01",{"path":1116,"title":1117,"description":1118,"categories":1119,"draft":621,"year":1120,"series":6},"\u002Fblog\u002Fyear-in-review-2020","Year in Review: 2020","It's a wrap! 2020 was a crazy year, See how my year went!",[657],"2020-12-31",{"path":1122,"title":1123,"description":1124,"categories":1125,"draft":621,"year":1126,"series":6},"\u002Fblog\u002Fyear-in-review-2021","Year in Review: 2021","It's a wrap! 2021 was a mixed bag, full of ups and downs. Key Goal for 2022: Start now!",[657],"2021-12-31",1789719029773]