Qi Wang | Tsinghua University

About Me

Hi! I’m Qi Wang, also known as Eki. I’m a PhD student at the Institute for Network Sciences and Cyberspace, Tsinghua University. I conduct my research in the Network and Information Security Lab (NISL), under the supervision of Prof. JianJun Chen. My work primarily focuses on Web security and network protocol security. By identifying vulnerabilities and designing secure protocol solutions, I aim to help build a more robust and resilient internet infrastructure.

In addition to my academic research, I’m an active Capture the Flag (CTF) player. I’m a member of Redbud, Tsinghua University’s CTF team, a former member of Dubhe, and a co-founder of Merak. My main strengths in CTF competitions lie in Web and Misc challenges.

Research Interests

Web Security: Web application security, web vulnerability detection, web attack defense
Protocol Security: Network protocol security, protocol vulnerability analysis
AI & Security: Applying AI to enhance security measures, and ensuring the security of AI

News

[July 2025] Our paper about Zip Parsing Vulnerability is accepted to USENIX Security 2025. Congratulations to Yufan!
[May 2025] Our research about New Cross-Origin Web Attacks is accepted to Blackhat USA 2025. Congratulations to Pinji!

Publications

My ZIP isn't your ZIP: Identifying and Exploiting Semantic Gaps Between ZIP Parsers

Yufan You, Jianjun Chen, Qi Wang, Haixin Duan

34th USENIX Security Symposium, 2025

to be appeared

NDSS'25

Cross-Origin Web Attacks via HTTP/2 Server Push and Signed HTTP Exchange

Pinji Chen, Jianjun Chen, Mingming Zhang, Qi Wang, Yiming Zhang, Mingwei Xu, Haixin Duan

2025 Network and Distributed System Security Symposium

PDF BibTex Presented at BlackHat USA 2025[link]

CCS'24

Inbox Invasion: Exploiting MIME Ambiguities to Evade Email Attachment Detectors

Jiahe Zhang, Jianjun Chen, Qi Wang, Hangyu Zhang, Chuhan Wang, Jianwei Zhuge, Haixin Duan

31th ACM Conference on Computer and Communications Security

PDF Code BibTex Presented at BlackHat AISA 2025[link]

S&P'24

Break the Wall from bottom: Automated Discovery of Protocol-Level Evasion Vulnerabilities in Web Application Firewalls

Qi Wang, Jianjun Chen, Zheyu Jiang, Run Guo, Ximeng Liu, Chao Zhang, Haixin Duan

2024 IEEE Symposium on Security and Privacy

PDF Code BibTex Presented at BlackHat USA 2024[link]

Rewards

[Feb. 2025] Got 🥈 at Aliyun CTF 2025 with 「Redbud」
[Dec. 2024] Got 🏅 at TSGCTF 2024 with 「blue-lotus」
[Nov. 2024] Got 🥈 at Byte AI Security Competition with 「一般通过」
[Oct. 2024] Got 🏅 at Geekcon DAF with 「Redbud」
[Jun. 2024] Got 🏅 at XCTF-Final with 「Redbud」
[Dec. 2023] Got 🥈 at TCTF2022 Rising Star Final with 「Redbud」
[May 2023] Got 🥈 at D^3CTF 2023 with 「满分冰美式」
[Dec. 2022] Got 🏅 at 5th "Qiangwang" (cyberspace power) International Elite Challenge on Cyber Mimic Defense with 「Dubhe」
[Sep. 2022] Got 🏅 at 6th "Blue Hat Cup" National College Students' Cyber Security Skills Competition with 「一般通过」
[Oct. 2021] Got 🏅 at XCTF-SCTF2021 with 「Dubhe」
[Sep. 2021] Got 🥈 at TCTF2021 Rising Star with 「emmmm」

Services

Teaching Assistant

Web Security (Course No. 84120252). Fall 2024

Education

Ph.D. in Cyberspace Security, 2023-2028 (expected)
Institute for Network Sciences and Cyberspace, Tsinghua University
Bachelor in Cyberspace Security, 2019-2023
School of Cyberspace Security, Beijing University of Posts and Telecommunications