freeBuf
主站

分类

漏洞 工具 极客 Web安全 系统安全 网络安全 无线安全 设备/客户端安全 数据安全 安全管理 企业安全 工控安全

特色

头条 人物志 活动 视频 观点 招聘 报告 资讯 区块链安全 标准与合规 容器安全 公开课

官方公众号企业安全新浪微博

FreeBuf.COM网络安全行业门户,每日发布专业的安全资讯、技术剖析。

FreeBuf+小程序

FreeBuf+小程序

SecWiki周刊(第321期)
2020-04-27 16:21:03

安全技术

[Web安全]  内网横向渗透攻击流程

https://forum.90sec.com/t/topic/949

[Web安全]  通达OA 任意用户登录漏洞(匿名RCE)分析

https://www.zrools.org/2020/04/23/%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1-%E9%80%9A%E8%BE%BEOA-%E4%BB%BB%E6%84%8F%E7%94%A8%E6%88%B7%E7%99%BB%E5%BD%95%E6%BC%8F%E6%B4%9E%EF%BC%88%E5%8C%BF%E5%90%8DRCE%EF%BC%89%E5%88%86%E6%9E%90/

[Web安全]  Windows域环境及域渗透

https://mp.weixin.qq.com/s/gvDzKFIsdhtkOKRANscEJA

[取证分析]  关于防守方封IP的一些想法

https://mp.weixin.qq.com/s/pgaTlc8LoUvH7RtgeKCBrg

[Web安全]  Vulfocus: 漏洞docker镜像集成平台

https://mp.weixin.qq.com/s/ArDDWYuc1A64qUzeyPRzZA

[其它]  一次有趣的钓鱼测试

https://mp.weixin.qq.com/s/JZs26mle8diovfPpAggP7A

[比赛]  2020 虎符网络安全竞赛 web Writeup

https://www.anquanke.com/post/id/203417

[运维安全]  安全架构设计与评审

https://mp.weixin.qq.com/s/PXCr_QrV7iLUz44750JXcA

[Web安全]  waf-bypass学习

https://xz.aliyun.com/t/7578

[Web安全]  短兵:API安全典型漏洞剖析

https://zine.la/article/1eaf51e700924b3290218f0d6c7b7247/?from=timeline

[Web安全]  Pulsar:一款功能强大的可视化网络足迹扫描平台

https://www.freebuf.com/articles/network/232520.html

[数据挖掘]  以虎嗅网4W+文章的文本挖掘为例,展现数据分析的一整套流程

https://www.jiqizhixin.com/articles/2018-12-20-18

[移动安全]  移动 app安全评估检测技术分析

https://www.kiwisec.com/news/detail/5e97cf7142bc562941eb0069.html

[设备安全]  近源渗透测试之USBninja实战

https://mp.weixin.qq.com/s/qCA-6zXbwpj8nyn5791zfg

[数据挖掘]  基于数据流的越权检测

https://mp.weixin.qq.com/s/FC6ROeMAdGUxkjVjFd914A

[Web安全]  红队测评技巧:对公司发起OSINT

https://xz.aliyun.com/t/7610

[移动安全]  Android程序安全分析入门

https://mp.weixin.qq.com/s/58HGpBRngfov1yXReaTpNA

[运维安全]  宜信SDL实践:产品经理如何驱动产品安全建设

https://segmentfault.com/a/1190000021257429

[其它]  MacOS Dylib Injection through Mach-O Binary Manipulation

https://malwareunicorn.org/workshops/macos_dylib_injection.html#0

[取证分析]  流量分析在安全攻防上的探索实践

https://mp.weixin.qq.com/s/xz9v7cxQiGdsCUWbl5Lp1A

[恶意分析]  刨析NSA/ASD的WebShell防御指南

https://mp.weixin.qq.com/s/oswnCc18UhYOrc6OC0COaA

[Web安全]  Exploiting POST-based XSSI

https://blog.cm2.pw/exploiting-post-based-xssi/

[漏洞分析]  DLL hijacking vulnerabilities in Nirsoft tools

http://borncity.com/win/2020/04/16/dll-hijacking-vulnerabilities-in-nirsoft-tools/

[漏洞分析]  IFFA文件格式漏洞交互式分析系统

http://www.asm64.com/IFFA/index.html

[工具]  Stowaway -- Multi-hop Proxy Tool for pentesters

https://github.com/ph4ntonn/Stowaway

[移动安全]  haidragon/KiwiVM-1: virtualization encryption software for mobile applications

https://github.com/haidragon/KiwiVM-1

[其它]  Lateral Movement: PowerShell Remoting

https://medium.com/@subhammisra45/lateral-movement-powershell-remoting-89da402a9885

[其它]  Terminal Escape Injection

https://www.infosecmatter.com/terminal-escape-injection/

[漏洞分析]  Tale of two hypervisor bugs - Escaping from FreeBSD bhyve

http://www.phrack.org/papers/escaping_from_freebsd_bhyve.html

[移动安全]  Android 中的特殊攻击面(一)——邪恶的对话框

https://paper.seebug.org/1174/

[漏洞分析]  SMBGhost pre-auth RCE abusing Direct Memory Access structs

https://ricercasecurity.blogspot.com/2020/04/ill-ask-your-body-smbghost-pre-auth-rce.html

[漏洞分析]  CVE-2020-0791

https://cpr-zero.checkpoint.com/vulns/cprid-2147/

[Web安全]  Subdomain Takeover: Thoughts on Risks

https://mp.weixin.qq.com/s/fn3_2kC6ljUL3ac1Mhuh1A

[Web安全]  Python RASP 工程化:一次入侵的思考

https://mp.weixin.qq.com/s/icWaHsC6dzlclxfLhvQjYA

[工具]  GhostBuild - MSBuild launchers for various GhostPack/.NET projects

https://github.com/bohops/GhostBuild

[工具]  CryptoHack – A fun platform for learning cryptography

https://cryptohack.org/

[漏洞分析]  Uninitialized Memory Disclosures in Web Applications

https://blog.silentsignal.eu/2020/04/20/uninitialized-memory-disclosures-in-web-applications/

[漏洞分析]  OSS-Fuzz data in Vulners

https://vulners.blog/2020/04/17/ossfuzz-from-vulners/

[移动安全]  The Zaheck of Android Deep Links!

https://medium.com/@shivsahni2/the-zaheck-of-android-deep-links-a5f57dc4ae4c

[恶意分析]  Tinyshell Under the Microscope

https://themittenmac.com/tinyshell-under-the-microscope/

[Web安全]  Everything You Need to Know About IDOR

https://medium.com/@aysebilgegunduz/everything-you-need-to-know-about-idor-insecure-direct-object-references-375f83e03a87

[其它]  Dissecting the Windows Defender Driver

https://www.n4r1b.com/posts/2020/04/dissecting-the-windows-defender-driver-wdfilter-part-4/

[恶意分析]  Sqlserver, or the Miner in the Basement

https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/

[移动安全]  How We Hacked an Android Game And Ranked First globally

https://payatu.com/blog/hrushikesh/how-i-hacked-an-android-game-and-ranked-first

[工具]  Assistant plugin for vulnerability research

https://github.com/Martyx00/VulnFanatic

[漏洞分析]  Exploiting (Almost) Every Antivirus Software

https://www.rack911labs.com/research/exploiting-almost-every-antivirus-software/

[移动安全]  Android 中的特殊攻击面(二)——危险的deeplink

https://paper.seebug.org/1175/

[工具]  Is BGP safe yet? · Cloudflare

https://isbgpsafeyet.com/

[设备安全]  OWASP Firmware Security Testing Methodology

https://scriptingxss.gitbook.io/firmware-security-testing-methodology/

[Web安全]  JSON Web Token Validation Bypass in Auth0 Authentication API

https://insomniasec.com/blog/auth0-jwt-validation-bypass

[工具]  joincap: Merge multiple pcap files together, gracefully.

https://github.com/assafmo/joincap

[移动安全]  iOS acquisition methods compared: logical, full file system and iCloud

https://blog.elcomsoft.com/2020/04/ios-acquisition-methods-compared-logical-full-file-system-and-icloud/

[Web安全]  体系化的WAF安全运营实践

https://mp.weixin.qq.com/s/BiH23k7xAeuwb5wwaOEKVw

[Web安全]  webshell "干掉" RASP

https://mp.weixin.qq.com/s/yykliM-b4_rStX5ucPWO2w

[Web安全]  PHP代码审计之CTF系列(3)

https://mp.weixin.qq.com/s/o9HL8kPCuw5f8nvsWhzEhQ

[工具]  A HTTP PoC Endpoint for cve-2020-5260

https://github.com/brompwnie/cve-2020-5260/

[其它]  Grammar based fuzzing PDFs with Domato

https://symeonp.github.io/2020/04/18/grammar-based-fuzzing.html

[漏洞分析]  GHSL-2020-038: Use after free in Chrome WebAudio

https://securitylab.github.com/advisories/GHSL-2020-038-chrome

[Web安全]  Abusing HTTP Path Normalization and Cache Poisoning to steal accounts

https://samcurry.net/abusing-http-path-normalization-and-cache-poisoning-to-steal-rocket-league-accounts/

[编程技术]  Building a Basic C2

https://0xrick.github.io/misc/c2/

[工具]  pingfisher: A ping detection tool for linux

https://github.com/xscorp/pingfisher

[移动安全]  移动基带安全研究系列文章之概念与系统篇

https://paper.seebug.org/1178/

[工具]  SystemToken: Steal privileged token to obtain SYSTEM shell

https://github.com/yusufqk/SystemToken

[恶意分析]  A Defender's Guide For Rootkit Detection: Episode 1

https://labs.jumpsec.com/2020/04/20/a-defenders-guide-for-rootkit-detection-episode-1-kernel-drivers/?preview=true

[其它]  爱奇艺的业务安全风控“秘籍”

https://www.freebuf.com/articles/people/233378.html

[Web安全]  This challenge is Inon Shkedy's 31 days API Security Tips.

https://github.com/smodnix/31-days-of-API-Security-Tips

[工具]  半自动化挖掘 request 实现多种中间件回显

https://paper.seebug.org/1181/

[Web安全]  一些流行的云waf、cdn、lb的域名列表

https://bacde.me/post/some-waf-cdn-lb-list/

[工具]  AIL framework - Analysis Information Leak framework

https://github.com/ail-project/ail-framework

[设备安全]  当PLC偶遇老旧但不乏经典的高级组包工具Hping3

https://mp.weixin.qq.com/s/iV9Ib9l4rrbC0oZe1gdDcg

[Web安全]  Critical CSRF to RCE bug chain in Prestashop v1.7.6.4 and below

https://stazot.com/prestashop-csrf-to-rce-article/

[Web安全]  远控免杀专题-白名单(113个)总结篇

https://mp.weixin.qq.com/s/2bC5otYgIgGnod-cXwkfqw

[文档]  2019年我国互联网网络安全态势综述

https://ncstatic.clewm.net/rsrc/2020/0420/16/976527b7158e60845a7671eded20c6ee.pdf

[工具]  Attacking and Auditing Docker Containers and Kubernetes Clusters

https://github.com/appsecco/attacking-and-auditing-docker-containers-and-kubernetes-clusters

[编程技术]  The Hitchhiker's Guide to Shellcoding

https://slaeryan.github.io/

[杂志]  SecWiki周刊(第320期)

https://www.sec-wiki.com/weekly/320

[漏洞分析]  xioc: Extract IOCs from text, including "escaped" ones.

https://github.com/assafmo/xioc

[运维安全]  零信任安全架构实践之路

https://mp.weixin.qq.com/s/jWBnS144PvBRM-wnMnwseA

[设备安全]  2019年工业控制网络安全态势白皮书

https://mp.weixin.qq.com/s/phcpafQnNBnyQ10FOcSriQ

[比赛]  一次Reverse出题手记

https://xz.aliyun.com/t/7619

[恶意分析]  记一次对PUBG外挂病毒的反制过程

https://xz.aliyun.com/t/7626

[Web安全]  构建企业级研发安全编码规范

https://mp.weixin.qq.com/s/PNvCvV4gYJkfIsKJ1ccneA

[文档]  awesome-virtualization: Collection of resources about Virtualization

https://github.com/Wenzel/awesome-virtualization

[Web安全]  Handbook of information collection for penetration testing and src

https://github.com/Qftm/Information_Collection_Handbook

[移动安全]  Xiaomi Mi9 (Pwn2Own 2019)

https://labs.f-secure.com/advisories/xiaomi-mi9/

[移动安全]  Android Kernel Exploitation

https://cloudfuzz.github.io/android-kernel-exploitation/

-----微信ID:SecWiki-----
SecWiki,8年来一直专注安全技术资讯分析!
SecWiki:https://www.sec-wiki.com

本期原文地址: SecWiki周刊(第321期)

footer.png

# 在线杂志 # 安全杂志 # 安全期刊 # 在线期刊
本文为 独立观点,未经允许不得转载,授权请联系FreeBuf客服小蜜蜂,微信:freebee2022
被以下专辑收录,发现更多精彩内容
+ 收入我的专辑
+ 加入我的收藏
相关推荐
  • 0 文章数
  • 0 关注者