alphaSeclab / sec-daily-2019

2019年天融信阿尔法实验室在微信公众号发布的所有安全资讯汇总

欢迎关注天融信阿尔法实验室微信公众号

20191231

[技术]

使用IDA从零开始学逆向, Part27

• https://medium.com/p/5fa5c173547c

36C3 CTF Writeups

• https://bananamafia.dev/post/36c3ctf/

再探同形文字攻击

• https://alephsecurity.com/2019/12/29/revised-homograph-attacks/

对1个Dell SonicWALL虚拟办公室的登录界面进行Password Spraying攻击

• https://www.n00py.io/2019/12/password-spraying-dell-sonicwall-virtual-office/

不是很出名的Android渗透测试工具

• https://captmeelo.com/pentest/2019/12/30/lesser-known-tools-for-android-pentest.html

Web Assembly逆向

• https://anee.me/reversing-web-assembly-wasm-dd59eb2a52d4

Abusing Signals with SIGROP Exploits

• https://sec.alexflor.es/post/minipwn/

实战.NET编写的C&C工具Covenant

• https://cyberarms.wordpress.com/2019/12/30/covenant-the-net-based-c2-on-kali-linux/
• https://rastamouse.me/2019/12/covenant-tasks-101/

恶意代码聚焦: Fileless恶意软件

• https://resources.infosecinstitute.com/malware-spotlight-fileless-malware/

MISRA使用入门

• https://www.viva64.com/en/b/0702/

编写Airbnb信息收集和提取脚本

• https://medium.com/p/ee418c06f60e

Linux HIDS代理摘要和用户状态Hook

• https://medium.com/p/f1bb17295456

[漏洞]

.NET一个可导致RCE的反序列化漏洞

• https://medium.com/@frycos/yet-another-net-deserialization-35f6ce048df7

FreeBSD fd提权漏洞

• https://packetstormsecurity.com/files/155790/fbsd1902-escalate.txt

PS4 CVE-2018-4386 Exploit

• https://github.com/Fire30/bad_hoist

[工具]

blc: 以插件的形式在IDA中集成Ghidra反编译器

• https://github.com/cseagle/blc

dlinject: 不使用ptrace将共享库注入到Linux进程

• https://github.com/DavidBuchanan314/dlinject

qc_image_unpacker: 从Android设备中提取并unpack镜像

• https://github.com/anestisb/qc_image_unpacker

purgeable: Purgeable memory allocations for Linux

• https://github.com/skeeto/purgeable

20191230

[技术]

Wifi取消身份验证攻击和家庭安全

• https://mjg59.dreamwidth.org/53968.html

PE导入表劫持实现驻留

• https://hackingiscool.pl/pe-import-table-hijacking-as-a-way-of-achieving-persistence-or-exploiting-dll-side-loading/

游戏逆向: Carrot Crazy, Part1

• https://www.huderlem.com/blog/posts/carrot-crazy-1/

使用Radare2给二进制文件打补丁

• https://rderik.com/blog/using-radare2-to-patch-a-binary/

威胁情报、漏洞、密罐与网络数据包

• https://0xsha.io/posts/threat-intelligence-building-your-citadel

恶意代码在登录到密罐之后的36分钟内完成了横向渗透

• https://www.wilbursecurity.com/2019/12/from-zero-to-lateral-movement-in-36-minutes/

逆向破解1个.NET Crackme

• https://medium.com/bugbountywriteup/reverse-engineering-beating-a-trial-on-a-net-crackme-d4ab6604f10b

iOS App渗透测试快速入门(iOS13)

• https://spaceraccoon.dev/from-checkra1n-to-frida-ios-app-pentesting-quickstart-on-ios-13

在iOS应用中搜寻证书和秘密

• https://spaceraccoon.dev/low-hanging-apples-hunting-credentials-and-secrets-in-ios-apps

[漏洞]

游戏蜘蛛侠2000在加载时的缓冲区溢出漏洞

• https://krystalgamer.github.io/spidey-buffer-overflow/

[恶意代码]

使用了来自葡萄牙政府财政和税务局的模板电子邮件进行传播的Lampion木马

• https://securityaffairs.co/wordpress/95731/malware/lampion-malware-targets-portugal.html

[工具]

ollvm-breaker: 使用Binary Ninja去除ollvm流程平坦混淆

• https://github.com/amimo/ollvm-breaker

awesome-rat: 开源远控收集, 以及恶意远控的分析报告

• https://github.com/alphaSeclab/awesome-rat

caponeme: 带漏洞的云环境, 用于重现Capital One数据泄漏

• https://github.com/avishayil/caponeme

parsuite: Python编写的解析器框架, 快速编写文件解析器

• https://github.com/arch4ngel/parsuite

windows_exploit_dowser: 识别Windows操作系统漏洞

• https://github.com/akabe1/windows_exploit_dowser

git-vuln-finder: 在git提交消息中查找潜在的软件漏洞

• https://github.com/cve-search/git-vuln-finder

RansomCoinPublic: 从二进制文件中提取加密货币地址和IoC

• https://github.com/Concinnity-Risks/RansomCoinPublic

[其他]

网络安全知识体系, 854页PDF

• https://www.cybok.org/media/downloads/cybok_version_1.0.pdf

20191227

[技术]

Hack the Box: Heist Walkthrough

• https://www.hackingarticles.in/hack-the-box-heist-walkthrough/

记针对某单位一次相对完整的渗透测试

• https://xz.aliyun.com/t/6979

如何成为事件响应者

• https://resources.infosecinstitute.com/cyber-work-with-infosec-how-to-become-an-incident-responder/

移动设备安全性测试平台

• https://blog.securelayer7.net/the-testbed-for-mobile-device-security/

MITER ATT＆CK漏洞聚焦: 强制身份验证

• https://resources.infosecinstitute.com/mitre-attck-vulnerability-spotlight-forced-authentication/

绕过Brand Collabs Manager的资格标准, 并在不符合标准和政策的情况下注册页面

• https://medium.com/p/7d26523da816

[漏洞]

CVE-2019-17571/Apache Log4j 1.2.X存在反序列化远程代码执行漏洞

• https://github.com/shadow-horse/CVE-2019-17571

Google Chrome RCE漏洞: Magellan 2.0

• https://securityaffairs.co/wordpress/95633/hacking/chrome-magellan-2-0-flaws.html

常用漏洞集合

• https://github.com/Amzza0x00/Zerooo-Exploitation-Framework

[恶意代码]

Valak C2 分析

• https://medium.com/p/3497fdb79bf7

恶意软件聚焦: 什么是点击欺诈？

• https://resources.infosecinstitute.com/malware-spotlight-what-is-click-fraud/

FIN7组织复盘分析-PART1-投递与执行

• http://blog.nsfocus.net/fin7-review-analysis-part1-delivery-and-execution/

黑客组织FIN7最新使用的恶意代码与BOOSTWRITE有很多相似之处

• https://www.fortinet.com/blog/threat-research/bioload-fin7-boostwrite-lost-twin.html

[工具]

Fuzzing-Survey: Fuzzing相关论文收集

• https://github.com/SoftSec-KAIST/Fuzzing-Survey

quark-engine: 可以无视混淆的Android恶意代码评分系统

• https://github.com/quark-engine/quark-engine

futurerestore: A hacked up idevicerestore wrapper, which allows specifying SEP and Baseband for restoring

• https://github.com/tihmstar/futurerestore

svm: 执行漏洞分析并自动生成报告

• https://github.com/simplevulnerabilitymanager/svm

vmlinux-to-elf: 通过提取内核符号表（kallsyms）, 从原始内核中恢复可完全分析的.ELF

• https://github.com/marin-m/vmlinux-to-elf

20191226

[技术]

FIC2020 prequals CTF write-up

• https://www.synacktiv.com/posts/challenges/fic2020-prequals-ctf-write-up.html

Docker初学者介绍

• https://medium.com/p/4c7785b70ccc

(CTF)Kringlecon 2: Turtle Doves

• https://pollev.github.io/Kringlecon-2-Turtle-Doves/

摆脱局限的OWASP TOP-10 / SANS TOP-25 / Bug Bounty心态

• http://raviramesh.info/mindset.html

由棋盘游戏触发的攻击向量的深入分析

• https://r00tten.com/in-depth-analysis-attack-vector-triggered-by-risk/

如何查找API密钥并用其实现认证

• https://medium.com/cyberverse/find-secret-api-keys-22cdcc829976
• https://github.com/momenbasel/keyFinder

2FA绕过技巧清单

• https://medium.com/@surendirans7777/2fa-bypass-techniques-32ec135fb7fe

使用RSA NetWitness检测C&C

• https://community.rsa.com/community/products/netwitness/blog/2019/12/20/using-rsa-netwitness-to-detect-cc-covenant

[漏洞]

Bukalapak损坏链接导致子目录被接管

• https://medium.com/p/3aa985e622c4

Linux内核本地提权漏洞exp(CVE-2019-13272)

• https://github.com/jiayy/android_vuln_poc-exp/tree/master/EXP-CVE-2019-13272-aarch64

GraphQL IDOR (Insecure Direct Object Reference)可导致信息泄漏

• https://medium.com/@R0X4R/graphql-idor-leads-to-information-disclosure-175eb560170d

[恶意代码]

BabaYaga后门

• https://resources.infosecinstitute.com/malware-spotlight-what-is-babayaga/

[工具]

sr2t: 将Nessus，Nmap(和更多工具)的结果解析并转换为XLSX/CSV格式

• https://gitlab.com/0bs1d1an/sr2t

XOpcodeCalc: OpCode计算器

• https://github.com/horsicq/XOpcodeCalc

pylane: 基于gdb的python进程注入和调试工具

• https://github.com/NtesEyes/pylane

PAKURI: 多合一渗透工具

• https://github.com/01rabbit/PAKURI

scout: 主机侦查工具

• https://github.com/jaredhaight/scout

hb_dec: Harbour反编译器, 从已编译的Harbor脚本中查找、加载和打印Harbor操作码

• https://github.com/KasperskyLab/hb_dec

20191225

[技术]

探查TLS Web流量, Part3

• https://blogs.akamai.com/2019/12/inspecting-tls-web-traffic---part-3.html

Guessy challenge writeup wtftime CTF

• https://medium.com/p/43417f9caa

使用Mozilla Rhino在Java环境中执行JS

• https://parsiya.net/blog/2019-12-22-using-mozilla-rhino-to-run-javascript-in-java/

使用PVS-Studio分析Avalonia UI源码发现的漏洞

• https://www.viva64.com/en/b/0701/

针对WordPress站点的攻击技巧

• https://blog.trendmicro.com/trendlabs-security-intelligence/looking-into-attacks-and-techniques-used-against-wordpress-sites/

从中兴WF721蜂窝家用电话恢复SIM卡PIN码

• https://ripitapart.com/2019/12/21/recovering-the-sim-card-pin-from-the-zte-wf721-cellular-home-phone/

利用CLR实现代码执行和驻留

• https://vxug.fakedoma.in/papers/Common%20Language%20Runtime%20Hook%20for%20Persistence%20_%20Context%20Information%20Security.pdf

在AcitveDirectory环境中使用PowerShell的Tips && Tricks

• https://blog.stealthbits.com/powershell-tips-and-tricks-for-scripting-active-directory-test-environments/

[漏洞]

Android设备Strandhogg漏洞分析

• https://medium.com/p/db3ba1a512e9

Microsoft Edge (Chromium) - EoP via XSS to Potential RCE

• https://leucosite.com/Edge-Chromium-EoP-RCE/

[恶意代码]

恶意代码分析: VB编写的远控WSHRAT

• https://www.youtube.com/watch?v=h3KLKCdMUUY

脱壳Bottle漏洞利用工具包的Payload

• http://www.pwncode.io/2019/12/unpacking-payload-used-in-bottle-ek.html

银行木马Gozi V3使用的绕过终端防护的技术

• https://news.sophos.com/en-us/2019/12/24/gozi-v3-tracked-by-their-own-stealth/

[工具]

chaps: 检查系统安全设置的PowerShell脚本，其中包含其他软件和评估工具

• https://github.com/cutaway-security/chaps

harpoon: 后渗透脚本收集

• https://github.com/ProfessionallyEvil/harpoon

karonte: 静态分析工具, 检测嵌入式固件中的漏洞

• https://github.com/ucsb-seclab/karonte

IotShark: 监控并分析IoT流量

• https://github.com/sahilmgandhi/IotShark

LKWA: 用于测试和练习鲜为人知的网络攻击的实验室

• https://github.com/weev3/LKWA

TuxResponse: Linux事件响应工具

• https://github.com/la3ar0v/TuxResponse

20191224

[技术]

Active Directory链接属性指南

• https://blog.stealthbits.com/a-guide-to-active-directory-linked-attributes/

MITRE ATT&CK漏洞聚焦: 凭证访问漏洞利用

• https://resources.infosecinstitute.com/mitre-attck-vulnerability-spotlight-exploitation-for-credential-access/

使用Cutter给二进制文件打补丁的5种方式

• https://www.megabeets.net/5-ways-to-patch-binaries-with-cutter/

使用元数据信息对社交媒体用户进行识别和混淆

• https://arxiv.org/abs/1803.10133

漏洞赏金清单

• https://medium.com/@cc1h2e1/bug-bounty-check-list-by-c1-2beb7ae3c116

Go二进制文件逆向

• https://blog.osiris.cyber.nyu.edu/2019/12/19/go-deepdive/
• https://blog.osiris.cyber.nyu.edu/2019/12/19/ugo-ghidra-plugin/

提取内存以供分析的多种方式

• https://www.hackingarticles.in/multiple-ways-to-capture-memory-for-analysis/

iOS平台抖音App的深度分析

• https://objective-see.com/blog/blog_0x52.html

使用MCUXpresso IDE调试ARM Cortex® M33核心

• https://mcuoneclipse.com/2019/12/23/investigating-arm-cortex-m33-core-dual-core-debug-tutorial/

[漏洞]

加拿大约会App的API会暴露用户地址

• https://theappanalyst.com/plentyoffish.html

Apache Olingo反序列化漏洞(CVE-2019-17556)

• https://medium.com/bugbountywriteup/cve-2019-17556-unsafe-deserialization-in-apache-olingo-8ebb41b66817

[工具]

huskyCI: 协调安全测试并将所有结果集中到数据库中，以进行进一步的分析和度量

• https://github.com/globocom/huskyCI

Empire发布3.0版

• https://github.com/BC-SECURITY/Empire
• https://www.bc-security.org/post/the-empire-3-0-strikes-back

Shelly: 后门管理器

• https://github.com/tegal1337/Shelly

Lunar: 轻量级DLL映射库, 支持直接从内存中做映射

• https://github.com/Dewera/Lunar

BetterBackdoor: Java编写的多功能后门

• https://github.com/ThatcherDev/BetterBackdoor

spraykatz: 在Windows计算机和大型Active Directory环境中检索凭据

• https://github.com/aas-n/spraykatz

vasilisk: V8 JIT Fuzzer

• https://github.com/osirislab/vasilisk
• https://blog.osiris.cyber.nyu.edu/2019/12/22/vasilisk/

[其他]

2020年网络安全预测

• https://resources.infosecinstitute.com/top-cybersecurity-predictions-for-2020/

20191223

[技术]

攻击WPA3, Part2: 理解OWE

• https://posts.specterops.io/war-never-changes-attacks-against-wpa3s-enhanced-open-part-2-understanding-owe-90fdc29126a1

Pwning VMWare, Part 1: RWCTF 2018 Station-Escape

• https://nafod.net/blog/2019/12/21/station-escape-vmware-pwn.html

Google Cast协议研究: 使用Xposed在Android上禁用设备身份验证

• https://yingtongli.me/blog/2019/12/20/gcast-auth.html

使用Ghidra逆向, Part1: 数据、函数和脚本

• https://www.shogunlab.com/blog/2019/12/22/here-be-dragons-ghidra-1.html

在Chrome中使用WebRTC ICE服务器做端口扫描

• https://medium.com/tenable-techblog/using-webrtc-ice-servers-for-port-scanning-in-chrome-ce17b19dd474

Linux随机数生成的工作原理

• https://research.nccgroup.com/2019/12/19/on-linuxs-random-number-generation/

SQL注入简单解析

• http://ghostlulz.com/source-code-analysis-sql-injection/

“Out-of-band”攻击的概念、逻辑及其用法

• https://omercitak.com/out-of-band-attacks-en/

AWS提权方法研究

• https://know.bishopfox.com/research/privilege-escalation-in-aws

逆向中LLDB的使用

• https://rderik.com/blog/using-lldb-for-reverse-engineering/

[漏洞]

Drupal 8文件上传漏洞

• https://www.aon.com/cyber-solutions/aon_cyber_labs/file-upload-vulnerability-in-drupal8/

WordPress DoS: 一个未修补的0Day

• https://labs.arcturus.net/post/WordPress-DoS.html

Win10本地提权漏洞分析(CVE-2019-1184)

• https://www.zerodayinitiative.com/blog/2019/12/19/privilege-escalation-via-the-core-shell-com-registrar-object

[恶意代码]

恶意软件JsOutProx, 使用大量反混淆、反分析技术, 与主流恶意软件不同

• https://blog.yoroi.company/research/unveiling-jsoutprox-a-new-enterprise-grade-implant/

Shamoon 2012完整分析

• https://malwareindepth.com/shamoon-2012/

[工具]

automatic-api-attack-tool: 自动化API攻击工具, 以API规范做为输入, 生成并运行基于输入的攻击

• https://github.com/imperva/automatic-api-attack-tool

sherlock: 在不同的社交网络上通过用户名搜寻账户

• https://github.com/sherlock-project/sherlock

Dali: 使用图片进行C&C通信的PoC

• https://github.com/h0mbre/Dali
• https://h0mbre.github.io/Image_Based_C2_PoC/#

Elemental: ATT&CK威胁库

• https://github.com/Elemental-attack/Elemental

cve-2019-12750: Symantec本地提权PoC(CVE-2019-12750)

• https://github.com/v-p-b/cve-2019-12750

20191220

[技术]

HTB-Jarvis

• https://resources.infosecinstitute.com/hack-the-box-htb-walkthrough-jarvis/

Intel x64二进制逆向资料

• https://github.com/0xdidu/Reverse-Engineering-Intel-x64-101

一种绕过Mona.py生成的POP-POP-RETN地址的方法，用于通过DLL注入来利用本地SEH溢出

• https://github.com/FULLSHADE/POPPOPRET-nullbyte-DLL-bypass

[漏洞]

(Viva)2019年C++/Java/C#项目中发现的漏洞Top10

• https://www.viva64.com/en/b/0700/
• https://www.viva64.com/en/b/0699/
• https://www.viva64.com/en/b/0698/

Wordpress插件301 Redirects的严重漏洞

• https://www.wordfence.com/blog/2019/12/critical-vulnerability-patched-in-301-redirects-easy-redirect-manager/

宏基电脑预装的快速访问工具, 可导致DLL搜索路径劫持(CVE-2019-18670)

• https://safebreach.com/Post/Acer-Quick-Access-DLL-Search-Order-Hijacking-and-Potential-Abuses-CVE-2019-18670

监控系统PandoraFMS 7 RCE漏洞

• https://medium.com/@k4m1ll0/remote-code-execution-vulnerability-in-pandorafms-7-x-8ce55d4b1d5a

今年在Pwn2Own赢得了特斯拉Model 3大奖的漏洞: Chromium regexp漏洞

• https://www.zerodayinitiative.com/blog/2019/12/18/regular-exploitation-of-a-tesla-model-3-through-chromium-regexp

[恶意代码]

针对macOS平台的CrescentCore后门

• https://www.carbonblack.com/2019/12/19/threat-analysis-unit-tau-threat-intelligence-notification-crescentcore-macos/

Hornet's Nest行动: 一次性部署6种不同的恶意软件

• https://www.deepinstinct.com/2019/12/18/untangling-legion-loaders-hornet-nest-of-malware/

攻击者利用RDP服务中的合法功能实现无文件攻击, 释放用于设备指纹识别和植入恶意代码的多功能工具

• https://labs.bitdefender.com/2019/12/rdp-abuse-and-swiss-army-knife-tool-used-to-pillage-encrypt-and-manipulate-data/

Spelevo漏洞利用工具包使用新的社工技巧

• https://blog.malwarebytes.com/threat-analysis/2019/12/spelevo-exploit-kit-debuts-new-social-engineering-trick/

[工具]

Silver: 结合masscan和nmap, 大规模扫描IP地址, 查找有漏洞的服务

• https://github.com/s0md3v/Silver

ReconCobra: 信息收集工具

• https://github.com/haroonawanofficial/ReconCobra

secretx: 通过请求指定列表中的每个网址来提取API密钥和机密

• https://github.com/xyele/secretx

[其他]

趋势科技发布的2020网络安全预测报告

• https://documents.trendmicro.com/assets/rpt/rpt-the-new-norm-trend-micro-security-predictions-for-2020.pdf

网络安全的关键性能指标

• https://medium.com/p/30971d04672

20191219

[技术]

配置威胁狩猎环境

• https://hakin9.org/the-threat-hunting-environment/

滥用Electron App绕过macOS的安全控制

• https://wojciechregula.blog/post/abusing-electron-apps-to-bypass-macos-security-controls/

渗透测试和漏洞赏金中Docker的使用

• https://www.youtube.com/watch?v=5G6tA8Q9AuQ

加密算法逆向, 查找加密算法mistake的轻松方式, 探查加密的数据和网络流量

• https://docs.google.com/presentation/d/1uEf6jSATaZDkvdLNIEeq1B4cpnkLko_22A1hMb8xRJE/edit#slide=id.p1
• https://www.youtube.com/watch?v=obJdpKDpFBA

从.NET中调用本地Windows RPC服务器

• https://googleprojectzero.blogspot.com/2019/12/calling-local-windows-rpc-servers-from.html

XSS学习, Part1: 反射XSS（简要概念，技术，挑战演练）

• https://medium.com/@onehackman/learning-xss-part-1-reflected-xss-brief-concept-techniques-challenge-walkthrough-85f6b165541b

三星TrustZone深入解析, Part2

• https://blog.quarkslab.com/a-deep-dive-into-samsungs-trustzone-part-2.html

利用DropBoxUpdater服务获取SYSTEM权限

• https://decoder.cloud/2019/12/18/from-dropboxupdater-to-nt-authoritysystem/

[漏洞]

谷歌云平台StackDriver SSRF

• https://ngailong.wordpress.com/2019/12/19/google-vrp-ssrf-in-google-cloud-platform-stackdriver/

Global Payments漏洞, SSL完整性检查被禁用后导致中间人攻击

• https://winterdragon.ca/global-payments-vulnerability/

今年2月份修补的SharePoint RCE漏洞

• https://www.zerodayinitiative.com/blog/2019/12/18/looking-back-at-the-impact-of-cve-2019-0604-a-sharepoint-rce

[恶意代码]

针对韩国工业公司的APT攻击行动

• https://cyberx-labs.com/blog/gangnam-industrial-style-apt-campaign-targets-korean-industrial-companies/

DeathRansom勒索软件

• https://www.carbonblack.com/2019/12/18/threat-analysis-unit-tau-threat-intelligence-notification-deathransom-ransomware/

[工具]

Frida发布12.8版本, 大大增强了对进程内Fuzz用例的支持, 包括Objective-C和Java调用

• https://frida.re/news/2019/12/18/frida-12-8-released/

PeculiarLog: 轻量级日志过滤工具, 支持正则表达式

• https://github.com/alexhude/PeculiarLog

jdbc-backdoor: 伪造的JDB驱动, 准许命令执行

• https://github.com/airman604/jdbc-backdoor

PHP-Antimalware-Scanner: PHP反病毒扫描脚本

• https://github.com/marcocesarato/PHP-Antimalware-Scanner

ida-genesis: 用于SEGA Genesis ROM hacking的IDA脚本

• https://github.com/zznop/ida-genesis

20191218

[技术]

10个视频讲解ZAP的功能和资源

• https://www.alldaydevops.com/zap-in-ten

使用Sacara编写加壳器

• http://antonioparata.blogspot.com/2019/12/writing-packer-in-sacara.html
• https://gist.github.com/enkomio/35b14084c1422db6740b5ed98cdb2db7

GraphQL批量攻击

• https://lab.wallarm.com/graphql-batching-attack/

缓冲区溢出漏洞利用的交互式教程

• https://nagarrosecurity.com/blog/interactive-buffer-overflow-exploitation

使用WebAssembly和libFuzzer在浏览器中Fuzz C/C++程序

• https://github.com/jonathanmetzman/wasm-fuzzing-demo

[漏洞]

分析1个TTF字体文件越界读取的漏洞(CVE-2019-1244)

• https://blog.tetrane.com/2019/11/17/Analyzing_an_Out_of_Bounds_read_in_a_TTF_font_file.html

WIN32K.SYS中通过索引彩色调色板实现本地提权

• https://www.zerodayinitiative.com/blog/2019/12/16/local-privilege-escalation-in-win32ksys-through-indexed-color-palettes

WhatsApp崩溃和数据丢失漏洞分析

• https://research.checkpoint.com/2019/breakingapp-whatsapp-crash-data-loss-bug/

解析谷歌云Shell的4个漏洞

• https://offensi.com/2019/12/16/4-google-cloud-shell-bugs-explained-introduction/

Abusing feature to steal your tokens

• https://medium.com/@rootxharsh_90844/abusing-feature-to-steal-your-tokens-f15f78cebf74

TP-Link Archer路由器严重漏洞, 可导致攻击者无密码登录

• https://securityaffairs.co/wordpress/95245/hacking/tp-link-archer-routers-flaws.html

[恶意代码]

Poison Frog后门

• https://securelist.com/oilrigs-poison-frog/95490/

APT组织Lazarus开发的双平台远控Dacls

• https://blog.netlab.360.com/dacls-the-dual-platform-rat-en/

恶意代码分析: Perl DDoS IRC Bot

• https://www.youtube.com/watch?v=mpNLcGkUbvM

一起从2018年1月中旬开始活跃至今的, 针对巴西，德国，匈牙利，拉脱维亚，菲律宾，土耳其，英国和美国等多个国家的攻击事件分析

• http://blog.ptsecurity.com/2019/12/turkish-tricks-with-worms-rats-and.html

[工具]

WSPIH: 网站个人敏感信息文件扫描器

• https://github.com/jerrychan807/WSPIH

scout: 轻量级URL Fuzzer, 发现Web服务器的未公开文件和目录

• https://github.com/liamg/scout

Lockdoor-Framework: 渗透测试框架

• https://github.com/SofianeHamlaoui/Lockdoor-Framework

nodeCrypto: nodejs编写的勒索软件, 针对Linux

• https://github.com/atmoner/nodeCrypto

nginx_log_check: Nginx日志安全分析脚本

• https://github.com/al0ne/nginx_log_check

thethe: 威胁狩猎环境

• https://github.com/ElevenPaths/thethe

20191216

[技术]

使用PrependMigrate隐藏Shell

• https://www.hackingarticles.in/hiding-shell-using-prependmigrate-metasploit/

逆向Windows容器发现了什么

• https://unit42.paloaltonetworks.com/what-i-learned-from-reverse-engineering-windows-containers/

Exploiting v8: *CTF 2019 oob-v8

• https://syedfarazabrar.com/2019-12-13-starctf-oob-v8-indepth/

IoT设备渗透的瑞士军刀HomePwn实战

• https://hakin9.org/homepwn-swiss-army-knife-for-pentesting-of-iot-devices/

T0RTT: 加快建立洋葱匿名网络节点的智能数学算法

• https://eprint.iacr.org/2019/1433.pdf

[漏洞]

eGain Web API邮件头注入漏洞(CVE-2019-17123)

• https://medium.com/maverislabs/cve-2019-17123-cbc946c99f8

通过Apache Olingo中的Retry-After Header实现DoS(CVE-2019-17555)

• https://blog.gypsyengineer.com/en/security/cve-2019-17555-dos-via-retry-after-header-in-apache-olingo.html

西门子SPPA-T3000控制系统被爆数十个漏洞, 可被用于攻击化石和可再生能源发电厂

• https://cert-portal.siemens.com/productcert/pdf/ssa-451445.pdf

赛门铁克终端防护软件本地提权漏洞(cve-2019-12750), Part2

• https://labs.nettitude.com/blog/cve-2019-12750-symantec-endpoint-protection-local-privilege-escalation-part-2/

串联多个漏洞实现Safari沙箱逃逸

• https://gts3.org/2019/Real-World-CTF-2019-Safari.html

知名Wordpress插件‘Ultimate Addons for Elementor’ & ‘Ultimate Addons for Beaver Builder’发现严重漏洞, 可导致攻击者无需任何密码即可获得对站点的管理访问权限

• https://www.malcare.com/blog/critical-vulnerability-ultimate-addons-wpastra-elementor-beaver-builder/

AirDoS: iPhone/iPad漏洞, 附近的攻击者可使iPhone/iPad无法使用

• https://kishanbagaria.com/airdos/
• https://github.com/KishanBagaria/AirDoS

[恶意代码]

黑客组织GALLIUM针对全球电信供应商的网络攻击行动

• https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/

基于PowerShell的多阶段下载器sLoad, 滥用BITS(后台智能传输服务)实现恶意活动

• https://www.microsoft.com/security/blog/2019/12/12/multi-stage-downloader-trojan-sload-abuses-bits-almost-exclusively-for-malicious-activities/

[工具]

exist: 汇总和分析网络威胁情报的Web应用程序

• https://github.com/nict-csl/exist

hashcobra: Hash破解工具

• https://github.com/sepehrdaddev/hashcobra

haaukins: 用于安全教育的高度可访问的自动化虚拟化平台

• https://github.com/aau-network-security/haaukins

RTTM: 威胁情报实时监控工具

• https://github.com/NaveenRudra/RTTM

dsiem: 安全事件关联引擎

• https://github.com/defenxor/dsiem

CyberRange: 创建基于AWS云的私人研究实验室, 提供完整的进攻、防御、逆向工程和安全情报工具

• https://github.com/secdevops-cuse/CyberRange

CTF资源收集

• https://apsdehal.in/awesome-ctf/

Exploitivator: Metasploit扫描和利用的自动化

• https://github.com/N1ckDunn/Exploitivator

20191213

[技术]

Linux 5.x Hook 系统调用Call

• https://jm33.me/hook-system-calls-in-linux-5x.html

HTB-Nibbles

• https://resources.infosecinstitute.com/hack-the-box-htb-machines-walkthrough-series-nibbles/

认识 JavaAgent --获取目标进程已加载的所有类

• https://medium.com/p/d613f471012

MITRE ATT&CK: 滥用外部远程服务以获得未经授权的内部网络访问

• https://resources.infosecinstitute.com/mitre-attck-external-remote-services/

From iPhone to NT AUTHORITY\SYSTEM

• https://decoder.cloud/2019/12/12/from-iphone-to-nt-authoritysystem/

[漏洞]

SetWindowsHookEx泄漏内核指针(CVE-2019-1469)

• https://www.ragestorm.net/blogs/?p=486

OpenBSD本地提权漏洞(CVE-2019-19726)

• https://blog.qualys.com/laws-of-vulnerabilities/2019/12/11/openbsd-local-privilege-escalation-vulnerability-cve-2019-19726

[恶意代码]

针对iPhone用户的智能恶意软件Krampus-3PC

• https://mediatrust.com/sites/default/files/2019-12/Krampus-3PC_2019-1211.pdf

Bottle漏洞利用工具包

• https://nao-sec.org/2019/12/say-hello-to-bottle-exploit-kit.html

[工具]

使用Process Hollowing技术实现隐藏自身的门罗币矿机

• https://blog.trendmicro.com/trendlabs-security-intelligence/almost-hollow-and-innocent-monero-miner-remains-undetected-via-process-hollowing/

frida-fuzzer: 基于Frida的Fuzzer, 用于内存内API Fuzzing

• https://github.com/andreafioraldi/frida-fuzzer

crimson-forge: 为x86和AMD64架构上的原生代码提供可持续的shellcode evasion功能

• https://github.com/zeroSteiner/crimson-forge

EVABS: Android平台靶机

• https://github.com/abhi-r3v0/EVABS

[其他]

Carbon Black发布的假日威胁报告

• https://www.carbonblack.com/2019-holiday-threat-report/

卡巴斯基发布的2019安全数据统计

• https://securelist.com/kaspersky-security-bulletin-2019-statistics/95475/

2020网络安全预测

• https://www.checkmarx.com/2019/12/12/2020-predictions-our-experts-weigh-in/

20191212

[技术]

路由器漏洞利用工具包介绍

• https://vavkamil.cz/wp-content/uploads/2019/12/an-introduction-to-the-router-exploit-kits.pdf

通过Fuzzing挖掘闭源软件的漏洞

• https://www.apriorit.com/dev-blog/640-qa-fuzzing-for-closed-source-windows-software

Nginx njs exploitation

• https://www.offensivecon.org/speakers/2020/alisa-esage.html

Bootstrap XSS收集

• https://gist.github.com/BlackFan/e968b5209637952cca1580dc8ffdfde6

使用Office Application Startup文件夹实现驻留

• https://pentestlab.blog/2019/12/11/persistence-office-application-startup/

如何从智能手机中提取数据(长文)

• https://privacyinternational.org/long-read/3256/technical-look-phone-extraction

通过修改Azure云Shell存储文件实现Azure提权

• https://blog.netspi.com/attacking-azure-cloud-shell/

对unbound DNS服务器的安全审计

• https://www.x41-dsec.de/security/research/job/news/2019/12/11/unbound/

[漏洞]

iOS内核漏洞SockPuppet是如何被发现的(CVE-2019-8605)

• https://www.youtube.com/watch?v=YV3jewkUJ54

OpenBSD动态加载器的本地提权漏洞(CVE-2019-19726)

• https://www.openwall.com/lists/oss-security/2019/12/11/9

Squiz Matrix CMS - Multiple Issues

• https://zxsecurity.co.nz/wp-content/uploads/2019/12/ZX%20Security%20Advisory%20-%20Squiz%20Matrix%20CMS%20-%20Multiple%20Vulnerabilities.pdf

KeyWe智能门锁可轻易被绕过, 且无法修复

• https://labs.f-secure.com/advisories/keywe-smart-lock-unauthorized-access-traffic-interception

Deserialized Double Dirty

• https://www.coalfire.com/The-Coalfire-Blog/December-2019/Deserialized-Double-Dirty

WhatsApp CVE-2019-3568详细逆向

• https://thecyberwire.com/stories/Maddie-Stone-Whatsup-with-WhatsApp-A-Detailed-Walk-Through-of-Reverse-Engineering-CVE-2019-3568.html

[恶意代码]

分析1个Google Chrome密码窃取器

• https://www.youtube.com/watch?v=mYGt98FzzbU

重新活跃的黑客组织Waterbear, 使用API Hooking绕过安全软件防护

• https://blog.trendmicro.com/trendlabs-security-intelligence/waterbear-is-back-uses-api-hooking-to-evade-security-product-detection/

部署挖矿软件的键盘记录器

• https://cofense.com/advanced-keylogger-delivers-cryptocurrency-miner/

[工具]

SysWhispers: 直接调用system call, 避免用户模式API调用, 绕过杀软

• https://github.com/jthuraisamy/SysWhispers

batea: 网络设备排名框架, 基于AI, 由context驱动

• https://github.com/delvelabs/batea

qsym: 一个实用的Concolic执行引擎, 转为Hybrid Fuzzing设计

• https://github.com/sslab-gatech/qsym

iptanalyzer: Intel PT日志分析器

• https://github.com/ohjeongwook/iptanalyzer

20191211

[技术]

深入了解三星的TrustZone, Part1

• https://blog.quarkslab.com/a-deep-dive-into-samsungs-trustzone-part-1.html

macOS文件名同形字

• https://www.mdsec.co.uk/2019/12/macos-filename-homoglyphs-revisited/

Plundervolt: 针对英特尔SGX的基于软件的Fault注入攻击

• https://www.plundervolt.com/doc/plundervolt.pdf

Buffer Overflow: Favorite Color CTF

• https://openpunk.com/post/11

[漏洞]

Solismed应用程序中发现9个漏洞

• https://know.bishopfox.com/advisories/solismed-critical

Blink XT2安全摄像头系统命令注入漏洞

• https://medium.com/tenable-techblog/blink-xt2-camera-system-command-injection-flaws-4768fced9ece

SockPuppet: iOS 12.4内核利用演练

• https://googleprojectzero.blogspot.com/2019/12/sockpuppet-walkthrough-of-kernel.html

Keepkey Crypto硬件钱包发现的漏洞, Part2

• https://blog.kraken.com/post/3248/flaw-found-in-keepkey-crypto-hardware-wallet-part-2/

EA游戏Origin客户端的本地提权漏洞(CVE-2019-19248)

• https://enigma0x3.net/2019/12/10/cve-2019-19248-local-privilege-escalation-in-eas-origin-client/

asp.net ajax文件上传和.NET反序列化漏洞的exploit(CVE-2017-11317, CVE-2017-11357, CVE-2019-18935)

• https://github.com/bao7uo/RAU_crypto

[恶意代码]

针对macOS平台的Bundlore Loader分析

• https://blog.confiant.com/new-macos-bundlore-loader-analysis-ca16d19c058c

数百个在线鞋店的网站被注入了信用卡skimmer

• https://blog.malwarebytes.com/threat-analysis/2019/12/hundreds-of-counterfeit-online-shoe-stores-injected-with-credit-card-skimmer/

Snatch勒索软件, 重启PC进入安全模式, 绕过电脑的安全防护

• https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/

[工具]

grandmaster: 辅助实现iOS固件自动化解密

• https://github.com/GuardianFirewall/grandmaster

sec-tool-list: 超过16000安全工具, 按Github星数排序, 包括Markdown和Json两种格式

• https://github.com/alphaSeclab/sec-tool-list

awesome-reverse-engineering: 逆向资源收集, 包括各个平台(Windows/Linux/macOS/Android/iOS/IoT), 包括各种逆向工具和文章

• https://github.com/alphaSeclab/awesome-reverse-engineering

awesome-cyber-security: 网络安全资源收集, 包括9000左右工具, 按功能进行基本分类

• https://github.com/alphaSeclab/awesome-cyber-security

Kali-TX: 用于部署Kali Linux缺少的一些重要工具

• https://github.com/M507/Kali-TX

pci: Packet Communication Investigator

• https://github.com/michoo/pci

20191210

[技术]

使用jQuery绕过CSP

• https://www.doyler.net/security-not-included/csp-bypass-via-jquery

Android CTF — KGB Messenger

• https://medium.com/bugbountywriteup/android-ctf-kgb-messenger-d9069f4cedf8

配置恶意软件动态分析环境, 用于分析加密的- httpS和SMTPS流量, 而无需允许恶意软件连接到互联网

• https://www.netresec.com/index.ashx?page=Blog&month=2019-12&post=Installing-a-Fake-Internet-with-INetSim-and-PolarProxy

macOS Red Team: 无需构建二进制文件的情况下调用Apple API

• https://www.sentinelone.com/blog/macos-red-team-calling-apple-apis-without-building-binaries/

当服务器的- http Out of Band不允许时, 利用XSS漏洞读取服务器文件

• https://www.noob.ninja/2019/12/spilling-local-files-via-xxe-when-- http.html

PHP自动加载: 本地文件包含

• https://medium.com/@ss23/php-autloading-local-file-inclusion-by-design-71aafe627877

Windows库代码

• https://repnz.github.io/posts/reversing-windows-libraries/

Formatting is Unreasonably Expensive for Embedded Rust

• https://jamesmunns.com/blog/fmt-unreasonably-expensive/

O(n^2), again, now in WMI

• https://randomascii.wordpress.com/2019/12/08/on2-again-now-in-wmi/

了解Windows访问令牌操作

• https://www.slideshare.net/JustinBui5/understanding-windows-access-token-manipulation

[漏洞]

针对Alpine Linux的Freelist堆利用

• https://blog.infosectcbr.com.au/2019/12/freelist-heap-exploitation-on-docker.html

访问控制解决访问Paxton Net2的RCE漏洞

• https://labs.f-secure.com/advisories/paxton-net2-rce/

大多数Linux发行版和其他*nix系统都存在一个漏洞, 导致网络相邻的攻击者判断用户是否使用VPN连接, 并劫持VPN隧道的TCP连接

• https://seclists.org/oss-sec/2019/q4/122

[恶意代码]

TrickBot广告活动: 使用虚假工资电子邮件进行网络钓鱼攻击

• https://unit42.paloaltonetworks.com/trickbot-campaign-uses-fake-payroll-emails-to-conduct-phishing-attacks/

[工具]

dronesploit: 无人机渗透测试框架

• https://github.com/dhondta/dronesploit

Malwinx: 学习恶意代码和Win32函数

• https://github.com/MohitDabas/malwinx
• http://securityviacode.in/view_article/+MalwinX:+A+framework+for+learning+Malware+and+win32+functions

path-auditor: 通过审计libc函数挖掘文件访问漏洞

• https://github.com/google/path-auditor
• https://security.googleblog.com/2019/12/detecting-unsafe-path-access-patterns.html

continuity: Apple Continuity广播协议的重新实现

• https://github.com/evanslify/continuity

DeStroid: 对抗Android恶意代码中的字符串加密

• https://github.com/fkie-cad/DeStroid

20191209

[技术]

使用字符串向量追踪黑客组织

• https://www.bromium.com/tracking-malware-campaigns-using-string-metrics/

用Shellcode实现数据压缩

• https://modexp.wordpress.com/2019/12/08/shellcode-compression/

创建Rootkit学习C

• https://h0mbre.github.io/Learn-C-By-Creating-A-Rootkit/#

Google Chrome portal element fuzzing

• https://blog.redteam.pl/2019/12/chrome-portal-element-fuzzing.html

Windows 服务用户利用NTLM本地认证提权到SYSTEM(Windows Server 2019/Windows 10 1809)

• https://decoder.cloud/2019/12/06/we-thought-they-were-potatoes-but-they-were-beans/

HTB-Wall

• https://khaoticdev.net/?p=736

使用MySQL服务做流量隧道

• https://x-c3ll.github.io/posts/Pivoting-MySQL-Proxy/

Fuzz SEGA创世纪模拟器

• https://zznop.com/2019/12/08/fuzzing-sega-genesis-emulators/

使用IDAPython生成漂亮的调用图

• https://yurichev.com/news/20191208_callgraphs/

用x86汇编编写Hello World

• https://www.youtube.com/watch?v=HgEGAaYdABA

[漏洞]

Firefox CVE-2019-11708 & CVE-2019-9810 Exploit(Windows x64)

• https://github.com/0vercl0k/CVE-2019-11708/

Telegram (v4.9.155353)渲染file://格式的链接并通过NSWorkspace.open打开, 会导致代码执行

• https://github.com/Metnew/telegram-links-nsworkspace-open

Cesanta Mongoose库6.16版本MQTT协议整数溢出漏洞

• https://blog.cystack.net/mongoose-integer-overflow/

Aviatrix VPN客户端多个提权漏洞

• https://immersivelabs.com/2019/12/04/aviatrix-vpn-client-vulnerability/

Windows IIS - http/2 Ping洪水导致DoS的漏洞(CVE-2019-9512)

• https://www.zerodayinitiative.com/blog/2019/12/4/cve-2019-9512-a-microsoft-windows-- http2-ping-flood-denial-of-service

[恶意代码]

恶意代码分析: 使用PowerShell实现的挖矿软件

• https://www.youtube.com/watch?v=TOof8VVjA8M

俄罗斯论坛售卖的Buer Loader使用的有趣的驻留技巧

• https://krabsonsecurity.com/2019/12/05/buer-loader-new-russian-loader-on-the-market-with-interesting-persistence/

[工具]

wpbrute-rs: 高性能的Wordpress登录爆破器

• https://github.com/leo-lb/wpbrute-rs

ntlmrecon: NTLM侦查工具

• https://github.com/sachinkamath/ntlmrecon

issue2report: 通过Github issues生成渗透报告

• https://github.com/issue2report/issue2report

bin2sc: 二进制文件转换为Shellcode

• https://github.com/SkyBulk/bin2sc

20191204

[技术]

文件的哈系冲突与利用

• https://speakerdeck.com/ange/colltris
• https://github.com/corkami/collisions/blob/master/workshop/README.md

安全审计的报告收集, 按编程语言分类

• https://github.com/pomerium/awesome-security-audits

过期链接劫持

• http://ghostlulz.com/broken-link-hijacking/

Windows渗透测试中Certutil的使用

• https://www.hackingarticles.in/windows-for-pentester-certutil/

鱼叉攻击邮件、示例与防护

• https://perception-point.io/resources/education/spear-phishing-101/

[漏洞]

Linux内核: USB子系统x3多个漏洞

• https://www.openwall.com/lists/oss-security/2019/12/03/4

Django Admin提权漏洞(CVE-2019-19118)

• https://www.openwall.com/lists/oss-security/2019/12/02/1

Autodesk桌面程序提权漏洞(CVE-2019-7365)

• https://safebreach.com/Post/Autodesk-Desktop-Application-Privilege-Escalation-to-SYSTEM-N40-CVE-2019-7365-N41

卡巴斯基安全连接软件DLL预加载与潜在滥用(CVE-2019-15689)

• https://safebreach.com/Post/Kaspersky-Secure-Connection-DLL-Preloading-and-Potential-Abuses-CVE-2019-15689

[恶意代码]

APT组织Lazarus针对Mac平台开发的"无文件"恶意软件

• https://objective-see.com/blog/blog_0x51.html

[工具]

后渗透工具Empire发布3.0 beta版

• https://github.com/BC-SECURITY/Empire

libptrace: 事件驱动的进程调试、追踪与操纵框架

• https://github.com/immunityinc/libptrace

WEASEL: DNS covert channel implant for Red Teams.

• https://github.com/facebookincubator/WEASEL

hashashin: BinaryNinja插件, 模糊匹配工具

• https://github.com/riverloopsec/hashashin
• https://www.riverloopsecurity.com/blog/2019/12/binary-hashing-hashashin/

lsassy: 远程解析lsass转储并提取凭证

• https://github.com/Hackndo/lsassy
• https://beta.hackndo.com/remote-lsass-dump-passwords/

20191203

[技术]

BlueHat 2019 Seattle中的所有材料

• https://github.com/ga1ois/BlueHat-2019-Seattle

Evading WinDefender ATP credential-theft: a hit after a hit-and-miss start

• https://www.matteomalvica.com/blog/2019/12/02/win-defender-atp-cred-bypass/

MS分享的网络鱼叉攻击事件, 发布警告

• https://www.microsoft.com/security/blog/2019/12/02/spear-phishing-campaigns-sharper-than-you-think/

分析恶意ElectrumX服务器的源码

• http://www.peppermalware.com/2019/12/analysis-of-malicious-electrumx-servers.html

测试Firefox内置的HTML Sanitizer, 防止UXSS漏洞

• https://blog.mozilla.org/security/2019/12/02/help-test-firefoxs-built-in-html-sanitizer-to-protect-against-uxss-bugs/

TP-LINK TL-WR841N路由器的硬件逆向, Part2

• https://www.zerodayinitiative.com/blog/2019/12/2/mindshare-hardware-reversing-with-the-tp-link-tl-wr841n-router-part-2

邮件认证: SPF, DKIM and DMARC out in the wild

• https://blog.jonlu.ca/posts/spf-dkim?ref=netsec

[漏洞]

Android未修复的StrandHogg严重漏洞被发现在野利用

• https://promon.co/security-news/strandhogg/

Microsoft应用程序容易受到身份验证漏洞的影响, 该问题可能会导致Azure帐户接管

• https://www.cyberark.com/threat-research-blog/blackdirect-microsoft-azure-account-takeover/

Trend Micro Security 16: DLL搜索路径劫持及潜在滥用(CVE-2019-15628)

• https://safebreach.com/Post/Trend-Micro-Security-16-DLL-Search-Order-Hijacking-and-Potential-Abuses-CVE-2019-15628

[恶意代码]

Clop勒索软件脱壳

• https://medium.com/@Sebdraven/unpacking-clop-416b83718e0f

[工具]

hidviz: 用于深入分析USB HID设备通信

• https://github.com/ondrejbudai/hidviz

goblin: Rust编写的用于二进制解析的工具

• https://github.com/m4b/goblin

20191202

[技术]

使用AIP扫描器发现敏感信息

• https://blog.stealthbits.com/using-the-aip-scanner-to-discover-sensitive-data/

Shellcoding: Finding EIP/RIP

• https://blog.xenoscr.net/Finding-EIP/

Linux系统通过滥用Capabilities实现提权

• https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/

ELF二进制文件与重定位项

• http://stffrdhrn.github.io/hardware/embedded/openrisc/2019/11/29/relocs.html

多种使用Windows API进行进程注入的方式

• https://malwareanalysis.co/wp-content/uploads/2019/11/Hunting-Process-Injection-by-Windows-API-Calls.pdf

恶意代码开发之: 利用对方的浏览器建立Shell连接

• https://medium.com/@d.bougioukas/red-team-diary-entry-3-custom-malware-development-establish-a-shell-through-the-browser-bed97c6398a5

HTB-Heist

• https://rizemon.github.io/hackthebox/windows/winrm/memorydump/2019/12/01/heist-htb.html
• https://0xrick.github.io/hack-the-box/heist/

CertGraph: 可视化受信任CA的部署

• https://michaelhendrickx.com/201911-certgraph-visualizing-the-distribution-of-trusted-cas.html

调试Shellcode, 查找Exploit失败原因的多种方式

• https://www.youtube.com/watch?v=re4teYmSoXA

[漏洞]

利用路径回溯获取Gitlab管理员账户

• https://about.gitlab.com/blog/2019/11/29/shopping-for-an-admin-account/

[恶意代码]

IDA脚本编写介绍: 自动解析REvil勒索软件的动态导入表

• https://www.youtube.com/watch?v=R4xJou6JsIE

恶意代码分析: Legion窃密木马/后门

• https://www.youtube.com/watch?v=aj56VYpbhzQ

ENDTRADE行动: 黑客组织Tick的多阶段后门

• https://blog.trendmicro.com/trendlabs-security-intelligence/operation-endtrade-finding-multi-stage-backdoors-that-tick/

[工具]

PHR-model: 抵御网络攻击的概念模型

• https://github.com/JYVSECTEC/PHR-model

IDA Pro评估版, 包含64位反编译器

• https://out7.hex-rays.com/demo/request

attack_monitor: 终端检测（Windows）与自动化恶意代码动态分析

• https://github.com/yarox24/attack_monitor

mordor: Re-play Adversarial Techniques

• https://github.com/hunters-forge/mordor

20191129

[技术]

什么是僵尸网络

• https://www.sentinelone.com/blog/what-is-a-botnet-and-why-are-they-dangerous/

电子书: 如何应对无文件攻击

• https://www.carbonblack.com/resource/how-to-combat-fileless-attacks-ebook/

MITRE ATT&CK漏洞聚焦: 注册表中的凭证

• https://resources.infosecinstitute.com/mitre-attck-vulnerability-spotlight-credentials-in-registry/

使用Wireshark进行故障排除: TCP Challenge ACK

• https://www.networkdefenseblog.com/post/wireshark-tcp-challenge-ack

Hacking doom for fun, health and ammo

• https://sensepost.com/blog/2019/hacking-doom-for-fun-health-and-ammo/

使用Radare2/ltrace和Ghidra解一个Crack Me

• https://maxkersten.nl/binary-analysis-course/assembly-basics/practical-case-crack-me-0x03/

Red Teaming Tactics and Techniques

• https://github.com/mantvydasb/RedTeam-Tactics-and-Techniques

Hacking WebSocket

• https://medium.com/swlh/hacking-websocket-25d3cba6a4b9

Testing for XSS (Like a KNOXSS)

• https://brutelogic.com.br/blog/testing-for-xss-like-a-knoxss/

爬过防火墙的葡萄树: 对**的长期攻击

• https://www.virusbulletin.com/blog/2019/11/vb2019-paper-vine-climbing-over-great-firewall-long-term-attack-against-china/

[漏洞]

graph.facebook.com中反射XSS导致IE/Edge中的帐户被接管

• https://ysamm.com/?p=343

Windows内核事务管理器(KTM)竟态漏洞的利用(CVE-2018-8611)

• http://www.powerofcommunity.net/poc2019/Adams.pdf

网络存储设备Synology DSM远程命令注入漏洞

• https://ssd-disclosure.com/archives/4047/ssd-advisory-synology-dsm-remote-command-injection

SSH认证协议的安全漏洞可导致SSH公钥泄漏私有的基础设施

• https://rushter.com/blog/public-ssh-keys/

[恶意代码]

勒索软件 MedusaLocker

• https://www.sentinelone.com/blog/how-medusalocker-ransomware-aggressively-targets-remote-hosts/

[工具]

ATFuzzer: Android智能手机AT接口的动态分析

• https://github.com/Imtiazkarimik23/ATFuzzer

XXE注入Payload列表

• https://github.com/payloadbox/xxe-injection-payload-list

jackdaw: 收集域名的所有信息, 存入数据库, 再以图标的方式显示

• https://github.com/skelsec/jackdaw

MOSP: 用于创建、编辑和分享与安全有关的Json对象的平台

• https://github.com/CASES-LU/MOSP

20191128

[技术]

Your Debugger Sucks

• https://robert.ocallahan.org/2019/11/your-debugger-sucks.html

RIPlace: 使用旧文件系统“重命名”操作, 绕过现代大多数杀软/反勒索软/终端防护系统

• https://www.nyotron.com/collateral/RIPlace-report_compressed-3.pdf

(CTF)第三届广东省的红帽杯比赛Kaleidoscope

• http://matshao.com/2019/11/11/Redhat2019-Kaleidoscope/

Windows全盘加密指南

• https://jumpcloud.com/blog/windows-full-disk-encryption/

拆解Costco远程吸顶灯

• https://hclxing.wordpress.com/2019/11/26/tearing-down-a-costco-remote-ceiling-light/

SHA-256算法工作原理

• https://medium.com/bugbountywriteup/breaking-down-sha-256-algorithm-2ce61d86f7a3

在二进制和抽象代码之间建立优雅精致的联系

• https://ssrg.ece.vt.edu/papers/memocode19.pdf

[漏洞]

知名JavaScript库Lodash RCE与"原型"污染漏洞(CVE-2018-16487)

• https://blog.sonatype.com/cve-2018-16487-lodash-rce-prototype-pollution

[恶意代码]

Excel 4.0宏分析: Cobalt Strike Shellcode注入

• https://www.youtube.com/watch?v=XnN_UWfHlNM

黑客组织Tick过去10年间在中东的攻击活动

• https://www.slideshare.net/JackyMinseokCha/tick-group-avar2019-20191111-cha-minseokpublish

[工具]

在线分析工具: 检查网站是否把第3方的Tracker伪装成网站本身的Tracker, Cookie会被发送给第3方Tracker, 从而可能导致攻击者访问你在此网站的账户

• https://trackingthetrackers.com/

IDA JNI调用重命名脚本

• https://github.com/strazzere/android-scripts/tree/master/IDA/IDA_JNI_Rename

MaliciousMacroMSBuild: 生成恶意的宏, 通过MSBuild应用程序白名单绕过执行Powershell或Shellcode

• https://github.com/infosecn1nja/MaliciousMacroMSBuild

Corsy: 错误配置扫描器

• https://github.com/s0md3v/Corsy

使用PowerShell转储进程内存

• https://gist.github.com/dmaasland/b8a1e66a14d448ec5a28640e2e2a1605

hydrabus-framework: 提供了多个模块, 可让你有效地工作并节省任何硬件项目的时间

• https://github.com/hydrabus-framework/framework
• https://hydrabus.com/
• https://0x00sec.org/t/hydrabus-framework/17057

See-SURF: 扫描查找可能的SSRF参数

• https://github.com/In3tinct/See-SURF

20191127

[技术]

Freedom Hosting 2: Conclusion

• https://blog.hyperiongray.com/freedom-hosting-2-odds-ends/

使用C#托管代码绕过杀软

• https://eforensicsmag.com/bypassing-avs-by-c-managed-code-reverse-shell-by-damon-mohammadbagher/

MITRE ATT&CK 漏洞聚焦: 文件中的凭证

• https://resources.infosecinstitute.com/mitre-attck-vulnerability-spotlight-credentials-in-files/

HTB Chainsaw中的LD_PRELOAD Rootkit

• https://0xdf.gitlab.io/2019/11/26/htb-chainsaw-rootkit.html

腾讯Apk加壳工具乐固初探

• https://blog.quarkslab.com/a-glimpse-into-tencents-legu-packer.html

macOS Red Team: 利用有权限的辅助工具获取ROOT权限

• https://www.sentinelone.com/blog/macos-red-team-spoofing-privileged-helpers-and-others-to-gain-root/

Azure AD: 特权身份管理

• https://www.peerlyst.com/posts/azure-ad-privileged-identity-management-pim-huy-kha

CTHoW v2.0: Windows威胁狩猎

• https://www.peerlyst.com/posts/cthow-v2-0-cyber-threat-hunting-on-windows-huy-kha

漏洞扫描工具Tenable Nessus Tips&&Tricks

• https://astrix.co.uk/news/2019/11/26/nessus-professional-tips-and-tricks

无线热点2.0, 新型的WiFi邪恶双子攻击

• https://medium.com/@adam.toscher/new-hot-spot-2-0-wifi-evil-twin-attack-2d63b1dd61eb

Win10随机数生成架构的深入分析

• https://www.microsoft.com/security/blog/2019/11/25/going-in-depth-on-the-windows-10-random-number-generation-infrastructure/

[漏洞]

uClibc Unlink堆利用

• https://drive.google.com/file/d/12t63zxBZO5K6H69Kls2Mdq0enrcvdG9-/view

Pwn2Own上的1个Webkit漏洞

• https://www.zerodayinitiative.com/blog/2019/11/25/diving-deep-into-a-pwn2own-winning-webkit-bug

[恶意代码

谷歌商店发现的恶意App Crazy Brainstorming

• https://www.whiteops.com/blog/another-day-another-fraudulent-app

对Dexphot恶意软件长达1年时间的跟踪发现

• https://www.microsoft.com/security/blog/2019/11/26/insights-from-one-year-of-tracking-a-polymorphic-threat/]

[工具]

Kali Linux发布2019.04版

• https://www.kali.org/news/kali-linux-2019-4-release/

ITWSV: 自动化渗透测试: 信息收集、审计与报告

• https://github.com/penetrate2hack/ITWSV

[其他]

TAG Cyber发布的2020年网络安全年度报告

• https://www.whiteops.com/2020-tag-cyber

2019年第3季度垃圾邮件和钓鱼报告

• https://securelist.com/spam-report-q3-2019/95177/

20191126

[技术]

利用人工智能预防高级网络攻击

• https://pages.checkpoint.com/artificial-intelligence-prevent-cyberattacks-whitepaper.html

2分钟内Hack Android电视

• https://medium.com/@drakkars/hacking-an-android-tv-in-2-minutes-7b6f29518ff3

攻击FreeIPA, Part1: 认证

• https://posts.specterops.io/attacking-freeipa-part-i-authentication-77e73d837d6a

Volatility 3 Beta版本初探

• https://www.youtube.com/watch?v=ozeedYjv5Lw

键盘固件分析, Part3

• https://mrexodia.github.io/reversing/2019/11/25/Not-analyzing-keyboard-firmware-part-3

使用cutter逆向MalwareTech CTF最难的Vm1

• https://daringjoker.wordpress.com/2019/11/26/malwaretech-vm/

使用Python和手机爆破宾馆TV

• https://github.com/victorqribeiro/bruteforcetv

Impersonating JA3 signatures

• https://github.com/CUCyber/ja3transport
• https://medium.com/cu-cyber/impersonating-ja3-fingerprints-b9f555880e42

[漏洞]

WhatsApp可导致RCE漏洞CVE-2019-11932的库libpl_droidsonroids_gif.so已修复漏洞, 但许多App依然在使用未修补的版本

• https://blog.trendmicro.com/trendlabs-security-intelligence/patched-gif-processing-vulnerability-cve-2019-11932-still-afflicts-multiple-mobile-apps/

FORNET产品中的弱加密密钥和硬编码密钥

• https://sec-consult.com/en/blog/advisories/weak-encryption-cipher-and-hardcoded-cryptographic-keys-in-fortinet-products/

杀软K7 Security的本地提权漏洞的利用(CVE-2019-16897)

• https://0x00sec.org/t/anti-virus-exploitation-local-privilege-escalation-in-k7-security-cve-2019-16897/17655

[恶意代码]

Malware Hunter: 分析超过100万恶意样本之后

• https://securityaffairs.co/wordpress/94359/malware/1-million-malware-samples.html

[工具]

haybale: LLVM IR符号执行, 引擎用Rust编写

• https://github.com/PLSysSec/haybale

Chepy: Python编写的命令行工具, 网络安全瑞士军刀

• https://github.com/securisec/chepy

aiengine: AI驱动的网络入侵检测系统, 交互式, 可编程(支持Python/Ruby/Java/Lua/Go)

• https://bitbucket.org/camp0/aiengine/src/master/

FIDL: 对IDA反编译API的包装, 简化IDA反编译API的使用

• https://github.com/fireeye/FIDL

20191125

[技术]

Kubernetes渗透测试方法论, Part3

• https://www.cyberark.com/threat-research-blog/kubernetes-pentest-methodology-part-3/

Stories Of IDOR-Part 2

• https://medium.com/bugbountywriteup/stories-of-idor-part-2-29d313a39e55

绕过受限Shell的多种方式

• https://www.hackingarticles.in/multiple-methods-to-bypass-restricted-shell/

从lInux传递Kerberos Tickets的实用指南

• https://0xeb-bp.github.io/blog/2019/11/21/practical-guide-pass-the-ticket.html

Hack The Box - Chainsaw

• https://0xrick.github.io/hack-the-box/chainsaw/

CNAME Cloaking: 第三方跟踪器的危险伪装

• https://medium.com/nextdns/cname-cloaking-the-dangerous-disguise-of-third-party-trackers-195205dc522a

零信任架构设计原则

• https://www.ncsc.gov.uk/blog-post/zero-trust-architecture-design-principles
• https://github.com/ukncsc/zero-trust-architecture

特斯拉Powerwall 2 (PW)电池存储解决方案的安全研究

• https://github.com/hackerschoice/thc-tesla-powerwall2-hack

[漏洞]

开源项目VNC的多个漏洞可导致RCE

• https://ics-cert.kaspersky.com/reports/2019/11/22/vnc-vulnerability-research/

Alcatel Flip 2多个漏洞

• https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-alcatel-flip-2/

Technion Confessions管理员的去匿名化

• https://m417z.com/The-De-anonymization-of-the-Technion-Confessions-Admin/

macOS 10.14.6 - root->kernel通过update_dyld_shared_cache实现提权

• https://www.exploit-db.com/exploits/47708

Linksys Velop路由器系列漏洞

• https://puzzor.github.io/Linksys-Velop-Vulneraibility-Series

[恶意代码]

使用Radare2分析TA505 Get2

• https://www.goggleheadedhacker.com/blog/post/13

银行木马Trickbot更新窃密模块, 窃取OpenSSH和OpenVPN凭证

• https://unit42.paloaltonetworks.com/trickbot-updates-password-grabber-module/

Ginp - A malware patchwork borrowing from Anubis

• https://www.threatfabric.com/blogs/ginp_a_malware_patchwork_borrowing_from_anubis.html

[工具]

DockerPwn.py: 使用Python实现Docker.sock滥用的自动化

• https://github.com/AbsoZed/DockerPwn.py

zero_fuzzer: 基于语法的Fuzzer, 快速生成Rust App

• https://github.com/gamozolabs/fzero_fuzzer

DNCI: .Net 代码注入器

• https://github.com/guibacellar/DNCI

COM-Code-Helper: IDAPython脚本, 重建Microsoft COM代码

• https://github.com/fboldewin/COM-Code-Helper

20191122

[技术]

AMSI as a Service: 自动化AV绕过

• https://medium.com/@two06/amsi-as-a-service-automating-av-evasion-2e2f54397ff9

juice jacking详解

• https://blog.malwarebytes.com/explained/2019/11/explained-juice-jacking/

ARM-X Challenge: Breaking the webs

• https://no-sec.net/arm-x-challenge-breaking-the-webs/

动态恶意代码分析的陷阱和局限性

• https://docs.google.com/presentation/d/1nPG_VQqAmoU8ur0pvj4D6pZQMIjlpm5OB7hNo5oLFNM/edit#slide=id.p

AppLocker内部原理, Part4: Blocking DLL Loading

• https://tyranidslair.blogspot.com/2019/11/the-internals-of-applocker-part-4.html

创建RedTeam物理工具箱

• https://medium.com/@tomac/building-up-a-basic-physical-red-team-toolkit-and-skillset-81670a2dd454

SATURN: 基于LLVM的软件反混淆框架

• https://arxiv.org/abs/1909.01752
• https://blog.zimperium.com/saturn-software-deobfuscation-framework-based-on-llvm/

如何创建polyglot HTML/JS/WebAssembly模块

• https://webassembly-security.com/polyglot-webassembly-module-html-js-wasm/

Windows进程注入: Explorer投毒

• https://secrary.com/Random/windows_process_injection/

针对Electron编写的App的Exploit是如何工作的, 以及如何有效的设计App避免这些攻击

• https://know.bishopfox.com/research/reasonably-secure-electron

[漏洞]

Bad Binder: Android In-The-Wild Exploit

• https://googleprojectzero.blogspot.com/2019/11/bad-binder-android-in-wild-exploit.html

Code42服务器DLL搜索路径劫持与潜在滥用(CVE-2019-16861)

• https://safebreach.com/Post/Code42-Server-for-Windows-DLL-Search-Order-Hijacking-and-Potential-Abuses-CVE-2019-16861

[恶意代码]

DePriMon下载者, 注册为"默认打印监控"

• https://www.welivesecurity.com/2019/11/21/deprimon-default-print-monitor-malicious-downloader/

Raccoon窃密软件, 可绕过Symantec和MS网关

• https://cofense.com/raccoon-stealer-found-rummaging-past-symantec-microsoft-gateways/

勒索软件RIPlace的杀软绕过技巧

• https://www.nyotron.com/riplace/

Roboto僵尸网络

• https://blog.netlab.360.com/the-awaiting-roboto-botnet-en/

[工具]

ghidra-pyi-generator: 为Ghidra的所有API生成 .pyi 类型stub, 使在PyCharm中编写脚本时获得智能提示

• https://github.com/VDOO-Connected-Trust/ghidra-pyi-generator

flan: Cloudflare开源的轻量级漏洞扫描器

• https://github.com/cloudflare/flan
• https://blog.cloudflare.com/introducing-flan-scan/

CustomHeader: Burp插件, 自定义- http请求的Header

• https://github.com/mirfansulaiman/CustomHeader

20191121

[技术]

绕过SOP读取机密数据

• https://medium.com/swlh/hacking-the-same-origin-policy-f9f49ad592fc

Building Fast Fuzzers

• https://arxiv.org/abs/1911.07707

云网络安全101, Part2: AWS安全组与NACL

• https://www.fugue.co/blog/cloud-network-security-101-aws-security-groups-vs-nacls

在MS Office 365启用保护视图的情况下触发恶意文档

• https://medium.com/@curtbraz/getting-malicious-office-documents-to-fire-with-protected-view-4de18668c386

罕见的SQL数据库警报-Informix SQL注入

• https://labs.f-secure.com/blog/uncommon-sql-database-alert-informix-sql-injection/

[漏洞]

使用Turbo Intruder功能触发竟态, 破解验证码(reCAPTCHA)

• https://portswigger.net/research/cracking-recaptcha-turbo-intruder-style

Android可能导致RCE的严重漏洞

• https://www.nowsecure.com/blog/2019/11/13/nowsecure-discovers-critical-android-vuln-that-may-lead-to-remote-code-execution/

MS Edge 本地文件包含与EoP

• https://leucosite.com/Edge-Local-File-Disclosure-and-EoP/

[恶意代码]

APT组织Lazarus在针对韩国用户的攻击中使用的Mac平台后门

• https://blog.trendmicro.com/trendlabs-security-intelligence/mac-backdoor-linked-to-lazarus-targets-korean-users/

Phoenix键盘记录器

• https://www.cybereason.com/blog/phoenix-the-tale-of-the-resurrected-alpha-keylogger

2019年秋季漏洞利用工具包回顾

• https://blog.malwarebytes.com/exploits-and-vulnerabilities/2019/11/exploit-kits-fall-2019-review/

针对拉美地区的银行木马Mispadu, 利用伪装成麦当劳的恶意广告

• https://www.welivesecurity.com/2019/11/19/mispadu-advertisement-discounted-unhappy-meal/

[工具]

awesome-cyber-security: 网络安全资源收集, 8000+开源工具, 包括工具的星数、最近修改时间和主要语言. 按照功能进行了大致分类

• https://github.com/xrkk/awesome-cyber-security

ddoor: 跨平台后门, 使用DNS txt记录通信

• https://github.com/rek7/ddoor

WinPwn: Windows渗透/AD安全自动化

• https://github.com/S3cur3Th1sSh1t/WinPwn

一些用于渗透的PowerShell脚本

• https://github.com/kmkz/PowerShell

backoori: 滥用Windows URI机制辅助实现驻留

• https://github.com/giuliocomi/backoori

20191120

[技术]

2020年威胁狩猎策略

• https://www.ccsinet.com/blog/threat-hunting-strategies-2020/

Google CTF 2019最终解决方案

• https://github.com/google/google-ctf/blob/master/2019/finals/solutions.pdf

使用OwnCloud配置云渗透实验室的多种方法

• https://www.hackingarticles.in/multi-ways-to-setup-cloud-pentest-lab-using-owncloud/

从紫队(Purple Team)的视角看待Serverless与GraphQL

• https://drive.google.com/file/d/1dW3kg41YUaxQN-knUwv4NWTO0DyVgdC_/view

Playing With Old Hacks

• https://www.trustedsec.com/blog/playing-with-old-hacks/

[漏洞]

MITER ATT&CK漏洞聚焦：帐户操纵

• https://resources.infosecinstitute.com/mitre-attck-vulnerability-spotlight-account-manipulation/

MITRE ATT&CK漏洞聚焦: Bash历史

• https://resources.infosecinstitute.com/mitre-attck-vulnerability-spotlight-bash-history/

Docker cp命令导致容器逃逸的漏洞详细分析(CVE-2019-14271)

• https://unit42.paloaltonetworks.com/docker-patched-the-most-severe-copy-vulnerability-to-date-with-cve-2019-14271/

Win7安全桌面的UAC弹出框导致提权的漏洞分析(CVE-2019-1388)

• https://www.zerodayinitiative.com/blog/2019/11/19/thanksgiving-treat-easy-as-pie-windows-7-secure-desktop-escalation-of-privilege

SQL注入Payload列表

• https://github.com/payloadbox/sql-injection-payload-list

Wordpress插件WP Maintenance严重漏洞

• https://www.wordfence.com/blog/2019/11/high-severity-vulnerability-patched-in-wp-maintenance-plugin/

[恶意代码]

AsyncRAT远控

• https://www.carbonblack.com/2019/11/19/threat-analysis-unit-tau-threat-intelligence-notification-asyncrat/

Estemani勒索软件

• https://www.carbonblack.com/2019/11/19/threat-analysis-unit-tau-threat-intelligence-notification-estemani-ransomware/

Phorpiex僵尸网络

• https://research.checkpoint.com/phorpiex-breakdown/

Brushaloader Dropper

• https://www.cert.pl/en/news/single/brushaloader-gaining-new-layers-like-a-pro/

APT33针对美国企业的攻击分析

• https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/APT33/16-11-19/Analysis%20APT33.md

[工具]

Javafuzz: 针对Java的coverage-guided Fuzz

• https://github.com/fuzzitdev/javafuzz

genesis: 基于代码片段生成唯一测试用例的框架

• https://github.com/thisislibra/genesis

andor: 盲SQL注入工具, Go语言编写

• https://github.com/sadicann/andor

seeker: 使用社会工程学精确定位智能手机

• https://github.com/thewhiteh4t/seeker
• https://hakin9.org/seeker-accurately-locate-smartphones-using-social-engineering/

20191119

[技术]

AppLocker内部原理Part2: Blocking进程创建

• https://tyranidslair.blogspot.com/2019/11/the-internals-of-applocker-part-2.html

用于物理安全评估的法律用语和文档的集合

• https://github.com/trustedsec/physical-docs

Detection in the Dark: 利用C&C面板中的漏洞来检测恶意代码

• https://drive.google.com/file/d/1nQozBXzOBUXkoZMAO5OiYNS13POOhJK6/view

云网络安全101: AWS VPC 终端

• https://www.fugue.co/blog/network-security-vpc-endpoints-101

RITSEC CTF 2019 - Write-up

• https://www.sudokaikan.com/2019/11/ritsec-ctf-2019-write-up.html

深入研究: 避免页面大小更改时的机器检查错误

• https://software.intel.com/security-software-guidance/insights/deep-dive-machine-check-error-avoidance-page-size-change-0

深入研究: 英特尔®事务同步扩展（Intel®TSX）异步中止

• https://software.intel.com/security-software-guidance/insights/deep-dive-intel-transactional-synchronization-extensions-intel-tsx-asynchronous-abort

绕过Instagram为之前我提交的某个漏洞做的补丁

• https://medium.com/bugbountywriteup/bypassing-the-fix-of-my-previous-instagram-bug-49ece4ea7e1d

跳转条件代码错误的缓解措施

• https://www.intel.com/content/dam/support/us/en/documents/processors/mitigations-jump-conditional-code-erratum.pdf

[漏洞]

2019年11月Android固件漏洞, 146个CVE

• https://www.kryptowire.com/android-firmware-2019/

某知名组织的隐私免责声明页面的任意代码执行漏洞

• https://pankajupadhyay.in/2019/11/17/command-execution-in-security-portal/

GMail的动态邮件特性AMP4Email可通过DOM Clobbering实现XSS

• https://research.securitum.com/xss-in-amp4email-dom-clobbering/

me_sa86_exploit: 针对Intel ME 11缓冲溢出的exploit生成器

• https://github.com/peterbjornx/me_sa86_exploit

bluekeep: Public work for CVE-2019-0708

• https://github.com/0xeb-bp/bluekeep

[恶意代码]

APT组织“拍拍熊”对巴勒斯坦政府攻击事件报告

• https://mp.weixin.qq.com/s/lUtXwWjPVMHXfR6oLnXYhQ

分析新出现的跨平台后门ACBackdoor

• https://www.intezer.com/blog-acbackdoor-analysis-of-a-new-multiplatform-backdoor/

分析1个混淆的PowerShell Dropper

• https://www.youtube.com/watch?v=gwHBvAqasPc&feature=youtu.be

为1个简单的C#恶意代码变种编写简易的反混淆器

• https://blog.syscall.party/post/writing-a-simple-net-deobfuscator/

[工具]

readexe: 读取DOS/MZ exe的Header

• https://github.com/segin/readexe

subdomain_recon: 子域名侦查工具

• https://github.com/Charlie-belmer/subdomain_recon
• https://nullsweep.com/subdomain-recon-a-subdomain-reconnaissance-tool/

xsser: 自动检测、利用并报告Web App中的XSS漏洞

• https://github.com/epsylon/xsser

20191118

[技术]

破解密码防止Credential Stuffing

• https://datto.engineering/post/cracking-passwords-to-prevent-credential-stuffing

RdpThief: 从远程桌面客户端中提取明文凭证

• https://www.mdsec.co.uk/2019/11/rdpthief-extracting-clear-text-credentials-from-remote-desktop-clients/
• https://github.com/0x09AL/RdpThief

Hack The Box - Networked

• https://rizemon.github.io/hackthebox/linux/bash/php/2019/11/17/networked-htb.html
• https://medium.com/bugbountywriteup/hackthebox-networked-93ebbd6a70e3
• https://phaz0n.github.io/writeup/2019/11/16/networked-writeup/
• https://khaoticdev.net/?p=695

使用DNS重绑定实现SSRF, 泄露aws key

• https://geleta.eu/2019/my-first-ssrf-using-dns-rebinfing/

为已废弃的设备编写用户模式USB驱动

• https://blog.benjojo.co.uk/post/userspace-usb-drivers

逆向高通Hexagon QDSP调制解调器, Part1

• https://bkerler.github.io/2019/11/15/bring-light-to-the-darkness/

使用CodeQL进行漏洞挖掘, 以Rsyslog为例进行演示

• https://securitylab.github.com/research/bug-hunting-codeql-rsyslog

Man-in-the-Network: Network Devices are Endpoints too

• https://medium.com/@c2defense/man-in-the-network-network-devices-are-endpoints-too-d5bd4a279e37

Spoyl数据泄漏背后的故事

• https://medium.com/bugbountywriteup/spoylleak-4ea0a8641561

[漏洞]

Linux内核一个无线漏洞的解析

• https://securitylab.github.com/research/anatomy-of-a-coffee-bean-wireless-vulnerabilities-in-linux-kernel

ZombieLoad Attack: 继Meltdown, Spectre, Foreshadow之后, 现代处理器更严重的漏洞, 处理器会恢复你的私人浏览历史和其他敏感数据

• https://zombieloadattack.com/

A journey into IonMonkey: root-causing CVE-2019-9810

• https://doar-e.github.io/blog/2019/06/17/a-journey-into-ionmonkey-root-causing-cve-2019-9810/

[工具]

pax: 用于PKCS7 padding oracle攻击的命令行工具

• https://github.com/liamg/pax

rsh: 反向Shell生成工具, 支持Linux/Windows

• https://github.com/mzfr/rsh

snek: 在PowerShell中调用Python

• https://github.com/adamdriscoll/snek

Geneva: 人工智能工具, 利用传感器中的漏洞来打败传感器, 自动学习如何绕过国家级别的传感器

• https://github.com/Kkevsterrr/geneva

Jandroid: 自动识别Android App中可被利用的逻辑漏洞

• https://labs.f-secure.com/blog/automating-pwn2own-with-jandroid/
• https://github.com/FSecureLABS/Jandroid

frida-js-afl-instr: 使用Frida和AFL++实现高性能内存Fuzzing

• https://github.com/andreafioraldi/frida-js-afl-instr

jaeles: 自动化Web App测试的瑞士军刀

• https://github.com/jaeles-project/jaeles

iCloudBypassCA: iCloud CA绕过

• https://github.com/crazymind90/iCloudBypassCA

20191115

[技术]

20种新型的钓鱼技巧

• https://resources.infosecinstitute.com/be-aware-of-these-20-new-phishing-techniques/

Pwn the ESP32 Forever: 绕过安全启动和Flash加密, 实现永久性Exploit

• https://limitedresults.com/2019/11/pwn-the-esp32-forever-flash-encryption-and-sec-boot-keys-extraction/

Office宏指令, Evasion和恶意的自我引用(Self-Reference)

• https://blog.rapid7.com/2019/11/14/we-dont-want-white-font-office-macros-evasion-and-malicious-self-reference/

[漏洞]

H2HC 2019 Slides/Materials/Presentations

• https://github.com/h2hconference/2019

Intel管理引擎漏洞利用, Part1: 理解Intel PT TXE PoC (INTEL-SA-00086), Part2: 在Intel ME 11.x 中启用Red JTAG解锁(INTEL-SA-00086)

• https://kakaroto.homelinux.net/2019/11/exploiting-intels-management-engine-part-1-understanding-pts-txe-poc/
• https://kakaroto.homelinux.net/2019/11/exploiting-intels-management-engine-part-2-enabling-red-jtag-unlock-on-intel-me-11-x-intel-sa-00086/

提权: 武器化CVE-2019-1405/CVE-2019-1322

• https://github.com/apt69/COMahawk

对高通处理器TrustZone App进行Fuzz

• https://research.checkpoint.com/the-road-to-qualcomm-trustzone-apps-fuzzing/

QuickZip 4.60 - Win10 WoW64 SEH Overflow Exploit

• https://iwantmore.pizza/posts/quickzip-seh-win10-wow64.html

MS Office Excel WorksheetOptions代码执行漏洞

• https://talosintelligence.com/vulnerability_reports/TALOS-2019-0886

CVE-2019-1378: Win10 更新助手(WUA)中的访问控制权限提升漏洞

• https://www.embercybersecurity.com/blog/cve-2019-1378-exploiting-an-access-control-privilege-escalation-vulnerability-in-windows-10-update-assistant-wua

Android Web浏览器CM Browser: - httpS URL Leak

• https://blog.quarkslab.com/cm-browser-- https-url-leak.html

思科VoIP适配器的RCE漏洞

• https://medium.com/p/115784b6d32b

[恶意代码]

自定义Dropper的猫鼠游戏

• https://blog.talosintelligence.com/2019/11/custom-dropper-hide-and-seek.html

恶意代码分析: Salseo反向Shell

• https://www.youtube.com/watch?v=DVpNsObawBc

APT32使用多个经过多层混淆的僵尸网络, 针对特定的几个目标发动攻击

• https://blog.trendmicro.com/trendlabs-security-intelligence/more-than-a-dozen-obfuscated-apt33-botnets-used-for-extreme-narrow-targeting/

新发现的APT组织TA2101, 主要目标为德国、意大利和美国的企业和组织

• https://www.proofpoint.com/us/threat-insight/post/ta2101-plays-government-imposter-distribute-malware-german-italian-and-us

Don’t Get Kicked Out! A Tale of Rootkits and Other Backdoors

• https://capsule8.com/blog/dont-get-kicked-out-a-tale-of-rootkits-and-other-backdoors/

[工具]

iVerify: 针对iPhone用户的安全工具包

• https://blog.trailofbits.com/2019/11/14/introducing-iverify-the-security-toolkit-for-iphone-users/

IDA更新 7.4 SP1

• https://www.hex-rays.com/products/ida/7.4sp1/index.shtml

x86 ASCII AND-SUB Encoder

• https://iwantmore.pizza/posts/and-sub-encoder.html

20191114

[技术]

使用JQF Fuzz Java

• https://www.pentagrid.ch/en/blog/fuzzing_java_with_jqf/

滥用签名的Windows驱动

• https://repnz.github.io/posts/abusing-signed-drivers/

Fuzz VxWorks嵌入式系统

• https://www.petergoodman.me/docs/qpss-2019-slides.pdf

针对macOS平台的恶意软件与提权, Part2

• https://www.sentinelone.com/blog/privilege-escalation-macos-malware-the-path-to-root-part-2/

利用Windows系统的易用性功能实现提权

• https://pentestlab.blog/2019/11/13/persistence-accessibility-features/

狩猎LoLBins: 通过思科产品来研究LOLBins的使用, 介绍最常滥用的Windows系统二进制文件，并通过分析来自Cisco AMP for Endpoints的数据来评估其使用情况

• https://blog.talosintelligence.com/2019/11/hunting-for-lolbins.html

用于检测对AWS控制台进行手动更改的AWS Cloudtrail告警规则

• https://arkadiyt.com/2019/11/12/detecting-manual-aws-console-actions/

GWP-ASan: Sampling heap memory error detection in-the-wild

• https://www.chromium.org/Home/chromium-security/articles/gwp-asan

[漏洞]

(谷歌漏洞赏金)Mass XS-Search using Cache Attack

• https://terjanq.github.io/Bug-Bounty/Google/cache-attack-06jd2d2mz2r0/index.html

2019年早期公布了处理器漏洞ZombieLoad, 研究员发现了其更新版: ZombieLoad 2.0, 对新处理器和软件补丁有效(又名: TSX Asynchronous Abort)

• https://www.tugraz.at/en/tu-graz/services/news-stories/media-service/singleview/article/zombieload-2-0-greift-auch-neue-prozessoren-und-software-patch-an0/

基于英特尔固件的TPM（fTPM）以及STMicroelectronics半导体的TPM芯片中存在时序泄漏(TPM: 受信平台模块)

• http://tpm.fail/
• http://tpm.fail/tpmfail.pdf

Windows系统解析PE文件时的重定为机制存在漏洞, 可导致鼠标旋停在文件上时使系统崩溃(CVE-2019-1347)

• https://blog.tetrane.com/2019/11/12/pe-parser-crash.html

通过COM本地服务实现提权的2个漏洞: CVE-2019-1405/CVE-2019-1322

• https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2019/november/cve-2019-1405-and-cve-2019-1322-elevation-to-system-via-the-upnp-device-host-service-and-the-update-orchestrator-service/

McAfee全版本产品的自我防护绕过, 以及潜在利用(CVE-2019-3648)

• https://safebreach.com/Post/McAfee-All-Editions-MTP-AVP-MIS-Self-Defense-Bypass-and-Potential-Usages-CVE-2019-3648

从任意文件覆盖, 到SYSTEM权限

• https://decoder.cloud/2019/11/13/from-arbitrary-file-overwrite-to-system/

[恶意代码]

HWP + SlackBot恶意软件分析

• https://lysine7.tistory.com/m/66

[工具]

BurpSuite-Asset_Discover: Burp扩展, 利用被动扫描从- http恢复中发现资产

• https://github.com/redhuntlabs/BurpSuite-Asset_Discover

NetAss2: 网络评估框架

• https://github.com/zerobyte-id/NetAss2

rsdl: 通过Ping的方式扫描子域名

• https://github.com/tismayil/rsdl

SCShell: 利用ChangeServiceConfigA执行命令, 实现无文件横向渗透

• https://github.com/Mr-Un1k0d3r/SCShell

zpp_hypervisor: 简易hypervisor, 学习Intel硬件虚拟化特性

• https://github.com/eyalz800/zpp_hypervisor

TLS-Attacker-BurpExtension: 基于TLS-Attacker的Burp扩展, 用于评估TLS服务器的配置

• https://github.com/RUB-NDS/TLS-Attacker-BurpExtension

20191113

[技术]

工控系统安全蓝图

• https://blog.checkpoint.com/2019/11/12/blueprint-for-securing-industrial-control-systems/

如何加密USB数据

• https://hakin9.org/how-and-why-you-should-encrypt-your-usb-data/

如何更好的将持续改进(Continuous Improvement)集成到安全监控中

• https://github.com/d3sre/Use_Case_Applicability

云端Linux漏洞评估指南

• https://www.uptycs.com/blog/how-to-conduct-a-vulnerability-assessment

[漏洞]

Windows hh.exe(已编译HTML帮助查看器)逻辑漏洞, 可导致代码执行

• https://twitter.com/FlatL1ne/status/1194208167976165376

知名嵌入式设备bootloader Das U-Boot 的多个严重漏洞

• https://blog.forallsecure.com/forallsecure-uncovers-critical-vulnerabilities-in-das-u-boot

Ghost Potato: Windows系统一个存在15年之久的具有欺骗性的Bug

• https://shenaniganslabs.io/2019/11/12/Ghost-Potato.html

Cache Probing Attack可导致多款谷歌产品泄漏用户信息

• https://medium.com/@terjanq/massive-xs-search-over-multiple-google-products-416e50dd2ec6

Wordpress CVE-2017-8295漏洞利用的一些笔记

• https://dustri.org/b/some-notes-about-the-exploitation-of-cve-2017-8295.html

A tale of two worlds: Assessing the vulnerability of enclave shielding runtimes

• https://github.com/jovanbulck/0xbadc0de

How I accidentally took down GitHub Actions

• https://blog.teddykatz.com/2019/11/12/github-actions-dos.html

[恶意代码]

恶意软件QSnatch使用的域名随机生成算法(DGA)

• https://bin.re/blog/the-dga-of-qsnatch/

最臭名昭著的恶意软件WannaMine v4.0深度分析

• https://www.crowdstrike.com/blog/weeding-out-wannamine-v4-0-analyzing-and-remediating-this-mineware-nightmare/

Zimperium z9如何检测被AV忽略的移动端恶意软件

• https://blog.zimperium.com/how-zimperiums-z9-detected-unknown-mobile-malware-overlooked-by-the-av-industry/

黑客组织Cobalt Gang和FIN6在攻击中使用的PureLocker勒索软件

• https://www.intezer.com/blog-purelocker-ransomware-being-used-in-targeted-attacks-against-servers/

[工具]

pwninit: 自动开始二进制漏洞利用挑战

• https://github.com/io12/pwninit

hal: 硬件分析器

• https://github.com/emsec/hal

Audix: 快速配置用于安全监控的Windows事件审计策略. PowerShell脚本

• https://github.com/littl3field/Audix

[其他]

威胁告警(11月09): 针对Amazon, SoftLayer 和 Telecom基础设施的DDoS攻击

• https://blog.radware.com/security/2019/11/threat-alert-tcp-reflection-attacks/

20191112

[技术]

MITRE ATT&CK: 命令行接口

• https://resources.infosecinstitute.com/mitre-attck-command-line-interface/

配置Frida+BurpSuite+Genymotion, 绕过Android SSL Pinning

• https://spenkk.github.io/bugbounty/Configuring-Frida-with-Burp-and-GenyMotion-to-bypass-SSL-Pinning/

恶意代码分析中Yara规则的使用

• https://www.youtube.com/watch?v=mQ-mqxOfopk

通过Slack自定义主题进行CSS注入, 实现键盘记录

• https://fletchto99.dev/2019/november/slack-vulnerability/

狩猎高级IoT恶意软件

• https://drive.google.com/file/d/1XYZu-iAUmHYn04qZuHLHF1LOuyw5fHYV/view

GSM流量与加密: A5/1 Stream Cipher

• https://www.blackhillsinfosec.com/gsm-traffic-and-encryption-a5-1-stream-cipher/

使用Arduino和ESP32快速开发基于蓝牙的服装道具

• https://jcjc-dev.com/2019/11/11/esp32-arduino-bluetooth-halloween-costume/

[漏洞]

Windows UniFi视频服务器未授权命令注入漏洞可导致提权

• https://hackerone.com/reports/544928

你用它上网，我用它进你内网! 中华电信数据机远端代码执行漏洞

• https://blog.orange.tw/2019/11/HiNet-GPON-Modem-RCE.html

利用SQL Server全局临时表的竟态条件

• https://blog.netspi.com/exploiting-sql-server-global-temporary-table-race-conditions/

iOS沙箱逃逸+内核读写, 导致RCE, 实现越狱

• https://ssd-disclosure.com/archives/4066/ssd-advisory-via-ios-jailbreak-sandbox-escape-and-kernel-r-w-leading-to-rce

[恶意代码]

金星121，朝鲜叛逃者赞助商“龙信使”移动APT攻击

• https://blog.alyac.co.kr/2588

VMware安全团队监控到的使用BlueKeep Windows漏洞攻击的案例

• https://www.carbonblack.com/2019/11/11/wild-blue-yonder-vmware-carbon-black-threatsight-dissects-bluekeep-windows-exploit/

[工具]

wesome-ida: 跟IDA Pro有关的资源收集。当前包括的工具个数400+，并根据功能进行了粗糙的分类。部分工具添加了中文描述。

• https://github.com/xrkk/awesome-ida

Bleak: Windows DLL注入框架, 支持多种注入方式

• https://github.com/Akaion/Bleak

DeepBlueCLI: 通过Windows事件日志进行威胁狩猎. PowerShell模块

• https://github.com/sans-blue-team/DeepBlueCLI

Bluekeep-scanner: PowerShell编写的BlueKeep漏洞扫描器

• https://github.com/vletoux/Bluekeep-scanner

[其他]

2019年第3季度DDoS攻击报告

• https://securelist.com/ddos-report-q3-2019/94958/

20191111

[技术]

攻击Hyper-V

• https://github.com/FoxHex0ne/Slides/blob/master/POC2019.pdf

枚举权限为RWX的内存区域, 用于代码注入

• https://ired.team/offensive-security/defense-evasion/finding-all-rwx-protected-memory-regions

苹果设备在Boot过程的所有阶段中bootchain内存布局情况, 尤其与SecuROM和iBoot相关的内容

• http://re.alisa.sh/notes/iBoot-address-space.html

Apple Mail将加密邮件存储在明文数据库中

• https://medium.com/@boberito/apple-mail-stores-encrypted-emails-in-plain-text-database-fix-included-3c2369ce26d4

(HTB)Jarvis

• https://0xrick.github.io/hack-the-box/jarvis/

(CTF)Mexican Crackme, 2种自动化解题方案

• https://medium.com/syscall59/solved-solving-mexican-crackme-82d71a28e189

(CTF)Pwn2Win CTF 2019: calc

• https://github.com/lbherrera/writeups/tree/master/pwn2win-2019/calc

The One Weird Trick SecureROM Hates

• http://iokit.racing/oneweirdtrick.pdf

使用P4wnP1创建口袋中的渗透测试平台

• https://gideonwolfe.com/posts/security/p4wnp1/

修复远程Windows内核Payload, 绕过Meltdown KVA Shadow

• https://zerosum0x0.blogspot.com/2019/11/fixing-remote-windows-kernel-payloads-meltdown.html

[漏洞]

win32k驱动信息泄漏漏洞(CVE-2019-1071)

• https://www.ragestorm.net/blogs/?p=458

MS Edge: 本地文件包含与EoP

• https://leucosite.com/Edge-Local-File-Disclosure-and-EoP/

mysql npm包(2.x ≤ 2.17.1)本地文件包含漏洞

• https://www.synacktiv.com/ressources/advisories/Local_file_disclosure_mysql_npm_package_2.17.1.pdf

分析Android UAF漏洞CVE-2019-2215

• https://dayzerosec.com/posts/analyzing-androids-cve-2019-2215-dev-binder-uaf/

邮件通知服务Sendy内置的验证码(reCAPTCHA)无效

• https://victorzhou.com/blog/sendy-recaptcha-security/

[恶意代码]

APT组织Platinum在攻击中使用的高级后门Titanium

• https://securelist.com/titanium-the-platinum-group-strikes-again/94961/

[工具]

tfsec: 对terraform模板进行静态分析, 查找潜在的安全问题

• https://github.com/liamg/tfsec

goquery: 利用osquery的交互式API提供一个远程的交互式Shell

• https://github.com/AbGuthrie/goquery

ChickenHook: 跨平台Hook框架, 支持Linux/Android/macOS

• https://github.com/ChickenHook/ChickenHook

ra1nsn0w: A tethered booter for 64bit iOS devices vulnerable to checkm8

• https://github.com/tihmstar/ra1nsn0w

sgx-step: 针对Intel SGX平台旁道攻击的攻击框架

• https://github.com/jovanbulck/sgx-step

dfirtriage: 针对Windows系统的数字取证工具

• https://github.com/travisfoley/dfirtriage

20191108

[技术]

利用RDP虚拟通道实现C&C通信

• https://ijustwannared.team/2019/11/07/c2-over-rdp-virtual-channels/

无源码时如何检测软件漏洞

• https://www.apriorit.com/dev-blog/644-reverse-vulnerabilities-software-no-code-dynamic-fuzzing

SOP(同源策略)和CORS(跨源资源共享)介绍

• https://blog.hackedu.io/same-origin-policy-and-cross-origin-resource-sharing/

EC2安全策略

• https://asecure.cloud/g/strategy_ec2_security/

TLS1.3中椭圆曲线密码是如何工作的

• https://habr.com/en/company/qrator/blog/474810/

Windows平台LoLBins实战

• https://liberty-shell.com/sec/2019/11/06/living-off-the-land-pt2/

IBM, sonic delay lines, and the history of the 80×24 display

• http://www.righto.com/2019/11/ibm-sonic-delay-lines-and-history-of.html

[漏洞]

亚马逊的Ring Video Doorbell Pro(视频门铃)存在漏洞, 附近攻击者可窃取Wifi密码

• https://www.bitdefender.com/files/News/CaseStudies/study/294/Bitdefender-WhitePaper-RDoor-CREA3949-en-EN-GenericUse.pdf

Nvidia的多款产品存在漏洞, 可导致提权、DOS等

• https://threatpost.com/gamers-hit-with-nvidia-gpu-driver-geforce-flaws/149992/

广泛应用于Amazon Kindles、ARM Chromebook等嵌入式设备的通用bootloader Das U-Boot存在代码执行漏洞

• https://threatpost.com/amazon-kindle-embedded-devices-code-execution/150003/

Android系统第3方TTS软件存在漏洞(CVE-2019-16253), 可导致获取SYSTEM shell

• https://blog.flanker017.me/text-to-speech-speaks-pwned/

针对Twitter利用CSP绕过触发XSS

• https://medium.com/bugbountywriteup/making-an-xss-triggered-by-csp-bypass-on-twitter-561f107be3e5

绕过AngularJS绑定HTML

• https://portswigger.net/research/bypassing-angularjs-bind-html

[恶意代码]

APT34使用的恶意软件Glimpse的DNS隧道功能分析

• https://ironnet.com/blog/a-glimpse-into-glimpse/

分析1个针对树莓派的恶意软件，使用3种方式实现驻留

• https://youtu.be/_biOeAD0YUY

[工具]

getallurls: 从AlienVault的 Open Threat Exchange(公开威胁情报交换)提取url

• https://github.com/lc/hacks/tree/master/getallurls

powertools: 攻击性PowerShell脚本

• https://github.com/am0nsec/powertools

HyperViper: Hyper-V安全研究资料

• https://github.com/FoxHex0ne/HyperViper

20191107

[技术]

逆向Maschine Mikro的IPC协议

• https://medium.com/@lerner98/rage-against-the-maschine-3357be1abc48

使用 Google Analytics检测网络钓鱼

• https://blogs.akamai.com/sitr/2019/11/phishing-detection-via-analytic-networks.html

无意中在Airbnb发现的全国范围的骗局

• https://www.vice.com/en_us/article/43k7z3/nationwide-fake-host-scam-on-airbnb

macOS提权研究, Part2

• https://www.sentinelone.com/blog/privilege-escalation-macos-malware-path-to-root/

The Ethereal Beauty of a Missing Header

• https://tyranidslair.blogspot.com/2019/11/the-ethereal-beauty-of-missing-header.html

使用Semmle QL进行漏洞挖掘: DOM XSS

• https://msrc-blog.microsoft.com/2019/11/06/vulnerability-hunting-with-semmle-ql-dom-xss/

SMEP + KPTI绕过

• https://github.com/pr0cf5/kernel-exploit-practice/tree/master/bypass-smep

使用WinAFL对知名的图片查看器进行Fuzzing

• https://www.apriorit.com/dev-blog/644-reverse-vulnerabilities-software-no-code-dynamic-fuzzing

MITRE ATT&CK: Input capture

• https://resources.infosecinstitute.com/mitre-attck-input-capture/

[漏洞]

某网站的SSRF漏洞(漏洞赏金)

• https://jin0ne.blogspot.com/2019/11/bugbounty-simple-ssrf.html

Adobe Mobile SDK中提供的示例/默认配置文件存在不安全选项

• https://wwws.nightwatchcybersecurity.com/2019/11/06/insecure-defaults-in-adobes-mobile-sdks/

LEADTOOLS工具箱的代码执行漏洞

• https://blog.talosintelligence.com/2019/11/vulnerability-spotlight-code-execution.html

[工具]

Kamerka-GUI: IoT/工控系统侦察工具, 终极版

• https://github.com/woj-ciech/Kamerka-GUI
• https://medium.com/@woj_ciech/hack-the-planet-with-%EA%93%98amerka-gui-ultimate-internet-of-things-industrial-control-systems-5ff7d9686b29
• https://woj-ciech.github.io/kamerka-demo/kamerka.html

kido: 通过机器学习和敲击键盘的声音, 破解密码

• https://github.com/tikeswar/kido
• https://towardsdatascience.com/clear-and-creepy-danger-of-machine-learning-hacking-passwords-a01a7d6076d5

sparrow-wifi: Wifi和蓝牙分析工具, GUI

• https://github.com/ghostop14/sparrow-wifi

[其他]

网络犯罪社区商品的定价分析报告

• https://go.flashpoint-intel.com/docs/pricing-analysis-of-goods-in-cybercrime-communities

20191106

[技术]

区块链漏洞利用实验室, Part3: 利用整数Overflows 和 Underflows

• http://console-cowboys.blogspot.com/2019/11/blockchain-exploitation-labs-part-3.html

绕过Github OAuth流程

• https://blog.teddykatz.com/2019/11/05/github-oauth-bypass.html

硬件分析之: 固件提权

• https://2019.hack.lu/archive/2019/snarf-it_pub.pdf

Smart Meters – Threats and Attacks to PRIME Meters

• https://www.tarlogic.com/en/blog/smart-meters-threats-and-attacks-to-prime-meters/

使用PowerShell Profile文件实现驻留

• https://pentestlab.blog/2019/11/05/persistence-powershell-profile/

使用LIEF 和 kaitai隔离设备通信协议的加密和解密部分代码

• https://x-c3ll.github.io/posts/blackbox-lief-kaitai/

[漏洞]

BigTree CMS 4.4.6 后端SQL注入漏洞

• https://blog.ripstech.com/2019/sql-injection-big-tree/

知名压缩库Libarchive UAF漏洞

• https://medium.com/@social_62682/new-libarchive-use-after-free-vulnerability-36c4b141fe89

Windows svchost.exe可导致提权, 微软回复不会修复

• https://nafiez.github.io/security/eop/2019/11/05/windows-service-host-process-eop.html

[恶意代码]

卡巴斯基研究人员从2017年ShadowBrokers发布的资料中发现了1个之前未披露的APT组织DarkUniverse

• https://securelist.com/darkuniverse-the-mysterious-apt-framework-27/94897/

Android平台下载超4千万的虚拟键盘App ai.type, 被发现通过模拟点击购买物品, 可能已导致用户近1800万美元的损失

• https://www.upstreamsystems.com/secure-d-uncovers-suspicious-mobile-transactions-android-keyboard-app-ai-type-generating-non-human-clicks-making-unwanted-purchases/

新发现的漏洞利用工具包 Capesand, 尝试利用近期MS IE的Adobe Flash漏洞

• https://blog.trendmicro.com/trendlabs-security-intelligence/new-exploit-kit-capesand-reuses-old-and-new-public-exploits-and-tools-blockchain-ruse/

[工具]

ntlm_challenger: 向接受NTLM认证的- http终端发送NTLM协商消息, 解析并显示返回的challenge消息

• https://github.com/b17zr/ntlm_challenger

mallory: 基于SSH协议的- http/- httpS代码

• https://github.com/justmao945/mallory

opentitan: Open source silicon root of trust

• https://github.com/lowRISC/opentitan
• https://opentitan.org/

trivy: 针对容器的漏洞扫描器

• https://github.com/aquasecurity/trivy

20191105

[技术]

Multi-party ECDSA 安全审计报告

• https://cybermashup.files.wordpress.com/2019/10/kzen_mpecdsa_audit_20191022.pdf

使用NetCease和SAMRi10增加内部侦查的难度

• https://blog.stealthbits.com/making-internal-reconnaissance-harder-using-netcease-and-samri1o/

MITRE ATT&CK: 截屏

• https://resources.infosecinstitute.com/mitre-attck-screen-capture/

谷歌CTF 2019: RIDL

• https://gist.github.com/mkow/2b73b1c6f389a40b3e49895ff37520a1
• https://github.com/oranav/ctf-writeups/tree/master/gctf19/RIDL

Python3.7的Asyncio库在Hacking中的应用

• https://0xsha.io/posts/python-3-7-asyncio-for-hackers

使用blockdlls(Cobalt Strike命令)和ACG防护恶意代码

• https://blog.xpnsec.com/protecting-your-malware/

远程PE文件注入

• https://ired.team/offensive-security/code-injection-process-injection/pe-injection-executing-pes-inside-remote-processes

针对声控系统的基于激光的音频注入

• https://lightcommands.com/

内核漏洞利用实战: return to user

• https://github.com/pr0cf5/kernel-exploit-practice/tree/master/return-to-user

利用fopen的第2个参数实现任意代码执行

• http://hugeh0ge.github.io/2019/11/04/Getting-Arbitrary-Code-Execution-from-fopen-s-2nd-Argument/

[漏洞]

Investintech Able2Extract 2个RCE漏洞

• https://blog.talosintelligence.com/2019/11/vuln-spotlight-RCE-investintech-able2extract-nov-2019.html

[恶意代码]

研究人员在某服务器上发现的多个恶意样本研究

• https://blog.talosintelligence.com/2019/11/c2-with-it-all.html

Bladabindi远控分析

• https://www.youtube.com/watch?v=OqhGU1s6kVk

WordPress插件WP-VCD实际上是恶意代码

• https://www.wordfence.com/wp-content/uploads/2019/11/Wordfence-WP-VCD-Whitepaper.pdf

[工具]

Fail2Ban: 扫描/var/log/auth.log等日志文件, 禁用多次尝试登录并失败的IP

• https://github.com/fail2ban/fail2ban

uptux: Linux系统提权检查(systemd, dbus, socket fun, etc)

• https://github.com/initstring/uptux

WatchAD: Active Directory入侵检测系统

• https://github.com/0Kee-Team/WatchAD

20191104

[技术]

配置树莓派执行基础的侦查扫描

• https://x1m.nl/posts/recon-pi/

使用Ghidra调用原生函数

• https://poxyran.github.io/poxyblog/src/pages/02-11-2019-calling-native-functions-with-frida.html

IoT设备API的简单分析

• https://www.youtube.com/watch?v=zs0-m14_DE4

基于OWASP的Web安全清单

• https://www.wst.space/the-long-curated-web-security-checklist-based-on-owasp/

Let's Make Windows Defender Angry

• https://speakerdeck.com/icchy/lets-make-windows-defender-angry-antivirus-can-be-an-oracle

Haystack (HTB)

• https://phaz0n.github.io/writeup/2019/11/02/haystack-writeup/
• https://0xrick.github.io/hack-the-box/haystack/

在Windows中编写shellcode实现socket重绑定

• https://www.shelliscoming.com/2019/11/retro-shellcoding-for-current-threats.html

分析Go语言二进制文件

• https://www.pnfsoftware.com/blog/analyzing-golang-executables/
• https://github.com/pnfsoftware/jeb-golang-analyzer

FuzzFactory: AFL扩展, 使用Waypoints针对domain-specific测试生成coverage-guided fuzzing

• https://www.youtube.com/watch?v=34A1jtgfgsU
• https://github.com/rohanpadhye/FuzzFactory

一次LinkedIn钓鱼溯源

• http://garwarner.blogspot.com/2019/11/a-phish-from-linkedin-connection.html

[漏洞]

WebSocket反向代理的问题可能导致smuggle - http请求

• https://github.com/0ang3el/websocket-smuggle

WizardOpium行动: 研究人员发现利用未知exploit的攻击行动, 后识别为新的Google Chrome 0-Day(CVE-2019-13720)

• https://securelist.com/chrome-0-day-exploit-cve-2019-13720-used-in-operation-wizardopium/94866/

CVE-2013-0007: MS XML核心服务 UAF漏洞

• https://github.com/badd1e/Disclosures/tree/master/CVE-2013-0007_MSXML6
• http://phrack.org/issues/69/10.html

Mac版本的MS Office的"禁用所有宏"功能可能导致远程未授权攻击者执行任意代码

• https://kb.cert.org/vuls/id/125336/

rConfig全版本未授权RCE漏洞(CVE-2019-16662&CVE-2019-16663)

• https://www.sudokaikan.com/2019/11/cve-2019-16662-cve-2019-16663.html

针对ClamAV的exploit

• https://pastebin.com/cfP7X89m

[恶意代码]

在野发现利用Windows RDP漏洞CVE 2019-0708(BlueKeep)传播的恶意软件

• https://www.kryptoslogic.com/blog/2019/11/bluekeep-cve-2019-0708-exploitation-spotted-in-the-wild/

使用Ghidra一步一步分析Corona DDoS僵尸网络

• https://maxkersten.nl/binary-analysis-course/malware-analysis/corona-ddos-bot/

分析1个只用于禁用Windows Defender的恶意软件

• https://www.youtube.com/watch?v=yV6xqui3l5c

恶意软件agent tesla分析

• https://0xsha.io/posts/malware-fight-back-the-tale-of-agent-tesla

[工具]

polytracker: 基于LLVM的插桩工具, 通用污点分析工具

• https://github.com/trailofbits/polytracker
• https://blog.trailofbits.com/2019/11/01/two-new-tools-that-tame-the-treachery-of-files/

PolyFile: 识别并映射文件的语义结构

• https://github.com/trailofbits/polyfile

20191101

[技术]

构建用于Shellcode分析的自定义工具

• https://www.sentinelone.com/blog/building-a-custom-tool-for-shellcode-analysis/

Web App中的竟态条件(Race Condition)

• https://lab.wallarm.com/race-condition-in-web-applications/

GoLang文件逆向, 以及为JEB编写Python扩展辅助分析

• https://www.pnfsoftware.com/blog/analyzing-golang-executables/
• https://github.com/pnfsoftware/jeb-golang-analyzer

用差分模糊测试(differential fuzzing)破解x86_64指令解码器

• https://blog.trailofbits.com/2019/10/31/destroying-x86_64-instruction-decoders-with-differential-fuzzing/
• https://github.com/trailofbits/mishegos

使用MixMode监控AWS CloudTrail服务

• https://mixmode.ai/blog/leveraging-mixmode-to-monitor-aws-cloudtrail/

• http请求hop-by-hop Header的滥用

• https://nathandavison.com/blog/abusing-- http-hop-by-hop-request-headers

[漏洞]

The Little Bitmap That Could(n’t)

• https://www.zerodayinitiative.com/blog/2019/10/31/the-little-bitmap-that-couldnt

Apache Solr RCE via Velocity template

• https://gist.githubusercontent.com/s00py/a1ba36a3689fa13759ff910e179fc133/raw/fae5e663ffac0e3996fd9dbb89438310719d347a/gistfile1.txt

Avast桌面版AV软件(Windows) XSS漏洞(CVE-2019–18653 & CVE-2019–18654)

• https://medium.com/bugbountywriteup/5-000-usd-xss-issue-at-avast-desktop-antivirus-for-windows-yes-desktop-1e99375f0968

[恶意代码]

Gafgyt僵尸网络变种, 针对Zyxel和华为路由器, 以及使用Realtek RTL81xx芯片的设备, 用于DDoS攻击

• https://unit42.paloaltonetworks.com/home-small-office-wireless-routers-exploited-to-attack-gaming-servers/

黑客使用Discord托管恶意软件、做C&C服务器或执行恶意行为

• https://www.bleepingcomputer.com/news/security/discord-abused-to-spread-malware-and-harvest-stolen-data/

[工具]

Spooky Halloween 2019 exploits

• https://medium.com/@social_62682/bf48fc10a5f0

OffensiveCloudDistribution: 利用Terraform和AWS的功能实现分布式、大规模跨云实例安全扫描

• https://github.com/jordanpotti/OffensiveCloudDistribution

PESTO: 解析/提取PE文件中的安全特性并存入数据库

• https://github.com/ElevenPaths/PESTO

[其他]

Akamai安全研究报告: 黑客使用基于企业的策略来进行网络钓鱼套件的开发和部署

• https://www.prnewswire.com/news-releases/akamai-security-research-cybercriminals-using-enterprise-based-strategies-for-phishing-kit-development-and-deployment-300947875.html

COFENSE 2019年度网络钓鱼报告

• https://go.cofense.com/phishing-report-2019-bundles/

20191031

[技术]

使用Task Scheduler实现驻留

• https://www.a12d404.net/windows/2019/10/30/schedsvc-persist-without-task.html

利用DLL注入读取游戏内玩家的坐标

• https://www.youtube.com/watch?v=Xd_egp8WeKE

SYLK文件格式滥用: MS Office近期版本依然支持此格式

• https://outflank.nl/blog/2019/10/30/abusing-the-sylk-file-format/

借助智能合约实现基于区块链的安全的电子投票系统

• https://arxiv.org/abs/1910.13635

IoT家庭网络的两阶段身份验证和基于VPN的安全通信

• https://arxiv.org/abs/1910.13625

安全浏览(safe browsing)协议并不能保护用户隐私

• https://blog.trailofbits.com/2019/10/30/how-safe-browsing-fails-to-protect-user-privacy/

开发自定义的C&C通信协议

• https://cobbr.io/Covenant-Developing-Custom-C2-Protocols.html
• https://github.com/cobbr/C2Bridge

数字证书: Models for Trust and Targets for Misuse. 包括: 破解Windows/Linux/UEFI固件的Authenticode安全模型等共10篇文章

• https://blog.reversinglabs.com/blog/rocking-the-foundations-of-a-trust-based-digital-code-signing-system

使用BITS(后台智能传输服务) Job实现驻留(Windows)

• https://pentestlab.blog/2019/10/30/persistence-bits-jobs/

[漏洞]

Kibana原型污染漏洞导致RCE(CVE-2019-7609)

• https://research.securitum.com/prototype-pollution-rce-kibana-cve-2019-7609/

为何Struts 2总是出问题

• https://www.checkmarx.com/2019/10/30/hacker-vs-struts2-game-has-no-ending/

近期PHP-FPM RCE(CVE-2019-11043)漏洞的分析与思考

• http://blog.orange.tw/2019/10/an-analysis-and-thought-about-recently.html

[恶意代码]

移动间谍软件的商品化

• https://blog.talosintelligence.com/2019/10/the-commoditization-of-mobile-espionage.html

一次事件响应中的恶意代码分析, Part2

• https://insinuator.net/2019/10/dissection-of-an-incident-part-2/

[工具]

pcode-emulator: Ghidra插件, 用于模拟执行PCode

• https://github.com/kc0bfv/pcode-emulator

iOS13沙箱配置文件收集, 二进制格式

• https://github.com/Proteas/ios13-sandbox-profile-format

[其他]

2019年及以后对电子竞技行业的威胁

• https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/cheats-hacks-and-cyberattacks-threats-to-the-esports-industry-in-2019-and-beyond

20191030

[技术]

通过Windows Netsh命令实现驻留

• https://pentestlab.blog/2019/10/29/persistence-netsh-helper-dll/

Hacking雄迈的网络摄像头

• https://www.youtube.com/watch?v=l3Z5hgWLY6c
• https://www.youtube.com/watch?v=7LJbVJHzWwE

使用KTRW创建可调试的iPhone

• https://googleprojectzero.blogspot.com/2019/10/ktrw-journey-to-build-debuggable-iphone.html
• https://github.com/googleprojectzero/ktrw

利用XSS漏洞实现账户接管

• https://medium.com/@mastomi/xss-to-account-takeover-d5beddc5c704

EEPROM: When Tearing-Off Becomes a Security Issue

• https://blog.quarkslab.com/eeprom-when-tearing-off-becomes-a-security-issue.html

[漏洞]

LabKey服务器的3个漏洞分析: XSS(CVE-2019-9758), 可导致RCE的SSRF(CVE-2019-9926), 可导致任意文件读取的XXE(CVE-2019-9757)

• https://rhinosecuritylabs.com/application-security/labkey-server-vulnerabilities-to-rce/

欧盟跨境认证软件（EIDAS NODE）中的漏洞

• https://sec-consult.com/en/blog/2019/10/vulnerability-in-eu-cross-border-authentication-software-eidas-node/

使用LXD系统容器测试php-fpm漏洞CVE-2019-11043

• https://blog.simos.info/testing-cve-2019-11043-php-fpm-security-vulnerability-with-lxd-system-containers/

Wordpress <=5.2.3: 查看未认证文章漏洞PoC

• https://0day.work/proof-of-concept-for-wordpress-5-2-3-viewing-unauthenticated-posts/

Apache mod_rewrite漏洞CVE-2019-10098 PoC

• https://0day.work/open-redirects-in-improperly-configured-mod_rewrite-rules-poc-for-cve-2019-10098/

视频游戏Untitled Goose Game的不安全的序列化导致的代码执行漏洞

• https://pulsesecurity.co.nz/advisories/untitled-goose-game-deserialization

小米智能宠物喂食器存在漏洞, 研究者利用漏洞定位全球10,950个喂食器

• https://www.zdnet.com/article/security-researcher-gets-access-to-all-xiaomi-pet-feeders-around-the-world/

[恶意代码]

TrickBot分析, Part2

• https://www.sneakymonkey.net/2019/10/29/trickbot-analysis-part-ii/

Adwind远控新变种使用正常的Java命令掩盖自身行为

• https://www.menlosecurity.com/blog/hiding-in-plain-sight-new-adwind-jrat-variant-uses-normal-java-commands-to-mask-its-behavior

Android平台广告App Xhelper, 通过重新安装自己实现驻留

• https://www.symantec.com/blogs/threat-intelligence/xhelper-android-malware

针对macOS平台的广告软件AdLoad详细分析

• https://www.sentinelone.com/blog/how-adload-macos-malware-continues-to-adapt-evade/

[工具]

LinPwn: 交互式后渗透工具

• https://github.com/3XPL017/LinPwn

CloudUnflare: 绕过Cloudflare获取真实IP

• https://github.com/greycatz/CloudUnflare

XORpass: 通过异或操作绕过WAF过滤器的编码器

• https://github.com/devploit/XORpass

cloud-service-enum: 云服务枚举, 支持AWS/Azure/GCP

• https://github.com/NotSoSecure/cloud-service-enum

20191029

[技术]

从Chrome浏览器IndexedDB数据库窃取信息

• https://medium.com/p/67d56a29efa7

现代无线技术争霸, Part1: 基础理论之: Evil Twin和Karma攻击

• https://posts.specterops.io/modern-wireless-attacks-pt-i-basic-rogue-ap-theory-evil-twin-and-karma-attacks-35a8571550ee

云服务枚举: AWS, Azure 和 GCP

• https://www.notsosecure.com/cloud-services-enumeration-aws-azure-and-gcp/

堆内存快照: 追踪所有堆内存分配

• https://randomascii.wordpress.com/2019/10/27/heap-snapshots-tracing-all-heap-allocations/

使用scdbg查找Shellcode

• https://isc.sans.edu/diary/Using+scdbg+to+Find+Shellcode/25460

Binary Ninja UI插件编写, Part1

• https://carstein.github.io/2019/10/27/binja-ui-part1.html

使用Frida实现进程内Fuzz

• https://bananamafia.dev/post/frida-fuzz/

去匿名化: 网站利用点击劫持技巧, 识别访问者的id, 包括其完整名称, 可能包含其他访问者信息

• https://m417z.com/De-anonymization-via-Clickjacking-in-2019/

[漏洞]

RouterOS: 从未授权的DNS访问到Root

• https://medium.com/tenable-techblog/routeros-chain-to-root-f4e0b07c0b21

某网络审计工具的栈溢出漏洞(CVE-2019-17424)Write-Up, 以及实现RCE

• https://blog.vastart.dev/2019/10/stack-overflow-cve-2019-17424.html

[恶意代码]

窃密软件Raccoon, 感染量超10万

• https://www.cybereason.com/blog/hunting-raccoon-stealer-the-new-masked-bandit-on-the-block

Did You Check Your Quarantine?!

• https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/did-you-check-your-quarantine/

黑客组织SWEED对意大利精密仪器组织发起的攻击

• https://marcoramilli.com/2019/10/28/sweed-targeting-precision-engineering-companies-in-italy/

[工具]

sadcloud: A tool for standing up (and tearing down!) purposefully insecure cloud infrastructure

• https://github.com/nccgroup/sadcloud

Cryptovenom: 密码学的瑞士军刀

• https://github.com/lockedbyte/cryptovenom

SauronEye: 查找包含特定关键词的特定文件

• https://github.com/vivami/SauronEye

IOSSecuritySuite: iOS安全工具箱, 纯Swift编写

• https://github.com/securing/IOSSecuritySuite

HomePwn: IoT设备渗透测试的瑞士军刀

• https://github.com/ElevenPaths/HomePWN

[其他]

白皮书: 小型安全团队如何保护成千上万的网站

• https://www.netsparker.com/how-to-secure-thousands-of-websites-with-a-small-security-team-whitepaper/

20191028

[技术]

逆向中如何处理编译器优化: 乘除法

• https://repnz.github.io/posts/reversing-optimizations-division/

符号执行系统的系统比较: 中间表示及其生成

• http://s3.eurecom.fr/tools/symbolic_execution/

高通安全启动链(Chains)分析

• https://blog.quarkslab.com/analysis-of-qualcomm-secure-boot-chains.html

从1个安全文件共享公司窃取私钥(XSS)

• https://timvisee.com/blog/stealing-private-keys-from-secure-file-sharing-service/

(Hack The Box)Safe

• https://0xrick.github.io/hack-the-box/safe/

测试并破坏JWT身份认证的实用方法

• https://mazinahmed.net/blog/breaking-jwt/

如何使用手动测试查找特定的AV签名, 以及如何绕过

• https://www.trustedsec.com/blog/discovering-the-anti-virus-signature-and-bypassing-it/

Entrust IdentityGuard soft tokens的设计缺陷

• https://medium.com/@ss23/the-poor-design-decisions-of-entrust-identityguard-soft-tokens-2d355a9fe786

GateKeeper - Bypass or not bypass?

• https://theevilbit.github.io/posts/gatekeeper_bypass_or_not_bypass/

[漏洞]

Azure DevOps 和 Team Foundation Server 的RCE的漏洞分析(CVE-2019-1306)

• https://www.zerodayinitiative.com/blog/2019/10/23/cve-2019-1306-are-you-my-index

LSP4XML(XML文件解析库, 被VSCode/Eclipse等知名编辑器中使用) XXE漏洞可导致RCE(CVE-2019-18213/CVE-2019-18212)

• https://www.shielder.it/blog/dont-open-that-xml-xxe-to-rce-in-xml-plugins-for-vs-code-eclipse-theia/

YouPHPTube-Encoder 2.3 多个未认证RCE漏洞

• https://www.sudokaikan.com/2019/10/multiple-unauthenticated-remote-code.html

Autodesk FBX 2个DoS漏洞的发现与分析

• https://fuzzit.dev/2019/10/25/discovery-and-analysis-of-2-dos-vulnerabilities-in-autodesk-fbx-1-unpatched/

checkm8 exploit的深入分析

• https://habr.com/en/company/dsec/blog/472762/

滥用Dell的 DUP 框架实现懒(Lazy)提权(CVE-2019-3726)

• https://www.cyberark.com/threat-research-blog/lazy-privilege-escalation-abusing-dells-dup-framework-cve-2019-3726/

[恶意代码]

苹果App商店发现17款App感染点击木马

• https://www.wandera.com/mobile-security/ios-trojan-malware/

[工具]

concerto: 生成TLS证书

• https://github.com/lowleveldesign/concerto

pythonfuzz: 对Python包进行Fuzz的coverage-guided fuzzer

• https://github.com/fuzzitdev/pythonfuzz

Ghidra-Cpp-Class-Analyzer: Ghidra插件, 用于分析C++类和运行时类型信息

• https://github.com/astrelsky/Ghidra-Cpp-Class-Analyzer

apk-mitm: 自动修改Android Apk文件, 探查其- httpS流量

• https://github.com/shroudedcode/apk-mitm

jwt-pwn: JWT安全测试脚本

• https://github.com/mazen160/jwt-pwn

20191024

[技术]

基于机器学习的Android恶意代码和异常检测

• https://arxiv.org/abs/1910.10660

利用Windows时间提供者(Time Providers)实现驻留

• https://pentestlab.blog/2019/10/22/persistence-time-providers/

通过Redis的内存空间, 给CMS添加隐蔽后门

• https://medium.com/@d.bougioukas/red-team-diary-entry-2-stealthily-backdooring-cms-through-redis-memory-space-5813c62f8add

CPDoS: Web缓存投毒攻击, 可导致web资源和网站DoS

• https://cpdos.org/

利用字符串格式化漏洞和缓冲区溢出漏洞绕过防护并获得Shell

• https://d4mianwayne.github.io/posts/fmt-bof

[恶意代码]

恶意代码脱壳之: Maze勒索软件

• https://poxyran.github.io/poxyblog/src/pages/22-10-2019-unpacking-malware-series-maze-ransomware.html

Emotet与Ryuk勒索软件

• https://www.virusbulletin.com/blog/2019/10/vb2019-papers-emotet-and-ryuk/

Stealthworker攻击行动揭秘

• https://www.fortinet.com/blog/threat-research/unveiling-stealthworker-campaign.html

NukeSped远控深入分析

• https://www.fortinet.com/blog/threat-research/deep-analysis-nukesped-rat.html

BadPatch攻击行动: 使用Python编译的多组件恶意代码

• https://www.fortinet.com/blog/threat-research/badpatch-campaign-uses-python-malware.html

[工具]

armx: ARM-X固件模拟框架

• https://github.com/therealsaumil/armx
• https://armx.exploitlab.net/

UhOh365: 检查邮箱地址是否是有效的Office365账户(不是通过尝试登录的方式)

• https://github.com/Raikia/UhOh365

PowerShellProfiler: PowerShell脚本静态分析工具

• https://github.com/pan-unit42/public_tools/tree/master/powershellprofiler
• https://unit42.paloaltonetworks.com/practical-behavioral-profiling-of-powershell-scripts-through-static-analysis-part-1/

EventList: 结合MS安全基准与MITRE ATT&CK框架, 提升审计能力, 辅助建立安全中心

• https://github.com/miriamxyra/EventList
• https://www.youtube.com/watch?v=nkMDsw4MA48

BLACKPHENIX: 恶意代码分析自动化框架

• https://github.com/fortinet/ips-bph-framework
• https://www.fortinet.com/blog/threat-research/blackhat-black-phenix-framework.html

20191023

[技术]

Rethinking Encryption

• https://www.lawfareblog.com/rethinking-encryption

PHP漏洞审计清单

• https://github.com/dustyfresh/PHP-vulnerability-audit-cheatsheet

虚拟机逃逸相关资料(当前只有QEMU相关)

• https://github.com/ray-cp/vm-escape

HackTheBox: Ellingson

• https://0xdf.gitlab.io/2019/10/19/htb-ellingson.html

利用反向代理注入恶意代码并提取敏感信息

• https://versprite.com/blog/application-security/reverse-proxy-attack/

Flare-On 6 CTF WriteUp (Part 11/12)

• https://blog.attify.com/flare-on-6-ctf-writeup-part12/
• https://blog.attify.com/flare-on-6-ctf-writeup-part11/

[漏洞]

SyntaxHighlighter Evolved插件存储型XSS漏洞

• https://www.wordfence.com/blog/2019/10/stored-xss-patched-in-syntaxhighlighter-evolved-plugin/

Pimcore 6.2.0版中的Drive-By漏洞, 攻击者可通过诱使管理员利用命令注入漏洞来执行OS命令

• https://blog.ripstech.com/2019/driveby-rce-exploit-pimcore/

php-fpm (CVE-2019-11043) Exp

• https://github.com/neex/phuip-fpizdam

OpenBSD TCP栈漏洞(CVE-2019-8460)

• https://research.checkpoint.com/tcp-sack-security-issue-in-openbsd-cve-2019-8460/

OpenStack 一个古老noVNC XSS漏洞利用(CVE-2017-18635)

• https://www.shielder.it/blog/exploiting-an-old-novnc-xss-cve-2017-18635-in-openstack/

趋势科技的Anti-Threat Toolkit会加载名称为cmd.exe/regedit.exe的任意文件, 可导致RCE(CVE-2019-9491)

• http://hyp3rlinx.altervista.org/advisories/TREND-MICRO-ANTI-THREAT-TOOLKIT-(ATTK)-REMOTE-CODE-EXECUTION.txt

NTFS文件系统MFT解析功能0Day, 可由USB触发, 导致BSOD

• https://exatrack.com/public/vuln_NTFS_EN.pdf

[恶意代码]

Looking into Ransomware as a Service (Project Root

• https://www.sentinelone.com/blog/behind-enemy-lines-looking-into-raas-project-root/

被遗忘的链接: 黑客组织Magecart Group 4和Cobalt重叠的注册域名

• https://blog.malwarebytes.com/threat-analysis/2019/10/the-forgotten-domain-exploring-a-link-between-magecart-group-5-and-the-carbanak-apt/

以德国组织为目标, 通过垃圾邮件活动传播的Buran勒索软件

• https://www.bromium.com/buran-ransomware-targets-german-organisations-through-malicious-spam-campaign/

[工具]

joern: C/C++代码分析平台

• https://github.com/ShiftLeftSecurity/joern

OneLogicalMyth_Shell: A HTA shell to assist with breakout assessments.

• https://github.com/nccgroup/OneLogicalMyth_Shell

20191022

[技术]

利用"安全支持提供商"实现驻留的多种方式

• https://pentestlab.blog/2019/10/21/persistence-security-support-provider/

为嵌入式系统实现优化的密码学

• https://cryptoservices.github.io/post-quantum/cryptography/2019/10/21/falcon-implementation.html

Diffie-Hellman Key Exchange

• https://eli.thegreenplace.net/2019/diffie-hellman-key-exchange/

Compiling a CPU, in a cheap FPGA board

• https://www.thanassis.space/myowncpu.html

使用Tomasulo算法实现CPU乱序执行

• https://stffrdhrn.github.io/hardware/embedded/openrisc/2019/10/21/or1k_marocchino_tomasulo.html

扫描Orchard CMS代码挖掘漏洞

• https://www.viva64.com/en/b/0681/

[漏洞]

WordPress主题Bridge Open Redirect漏洞

• https://www.wordfence.com/blog/2019/10/open-redirect-vulnerability-patched-in-bridge-theme/

Avira Antivirus 2019漏洞, 可通过加载任意非签名DLL, 实现躲避检测、驻留、提权等(CVE-2019-17449)

• https://safebreach.com/Post/Avira-Antivirus-2019-4-Services-DLL-Preloading-and-Potential-Abuses-CVE-2019-17449

LibreOffice文件格式转换漏洞(CVE-2019-17400)

• https://buer.haus/2019/10/18/a-tale-of-exploitation-in-spreadsheet-file-conversions/

利用Win10的“提供讲述人反馈”功能实现无文件驻留

• https://giuliocomi.blogspot.com/2019/10/abusing-windows-10-narrators-feedback.html

[恶意代码]

REvil勒索软件分析

• https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-crescendo/

Remcos远控新变种

• https://www.fortinet.com/blog/threat-research/new-variant-of-remcos-rat-observed-in-the-wild.html

Microsoft SQL Server后门: skip‑2.0

• https://www.welivesecurity.com/2019/10/21/winnti-group-skip2-0-microsoft-sql-server-backdoor/

垃圾邮件活动传播Emotet木马

• https://blog.360totalsecurity.com/en/attention-your-blog-may-be-used-to-spread-the-emotet-trojan/

Geost僵尸网络: 从OpSec错误中发现新的Android银行木马的故事

• https://www.virusbulletin.com/blog/2019/10/vb2019-paper-geost-botnet-story-discovery-new-android-banking-trojan-opsec-error/

银行木马Gustuff新变种的新功能

• https://blog.talosintelligence.com/2019/10/gustuffv2.html

[工具]

SUID3NUM: 使用Python的内置模块枚举SUID bins, 区分默认bin和自定义bin, 将枚举的bin与GTFO Bins进行交叉对比, 并自动化利用

• https://github.com/Anon-Exploiter/SUID3NUM

BloodhoundAD资源收集

• https://github.com/chryzsh/awesome-bloodhound

create_macos_recovery: 在运行macOS 10.13.x或更高版本的Mac上修复恢复卷（APFS）或分区（HFS +）的

• https://github.com/rtrouton/create_macos_recovery

20191021

[技术]

IDA教程: 逆向恶意代码的动态导入表

• https://youtu.be/hM2Zvsak3GM

智能管家变身智能间谍: Alexa和Google Home变身窃听器

• https://srlabs.de/bites/smart-spies/

CSS注入

• https://x-c3ll.github.io/posts/CSS-Injection-Primitives/

针对WPA3 Dragonfly握手的基于模型的Fuzzing

• https://incolumitas.com/2019/10/19/model-based-fuzzing-of-the-WPA3-dragonfly-handshake/

Weaponizing and Gamifying AI for WiFi Hacking: Presenting Pwnagotchi 1.0.0

• https://www.evilsocket.net/2019/10/19/Weaponizing-and-Gamifying-AI-for-WiFi-Hacking-Presenting-Pwnagotchi-1-0-0

Hack The Box - Ellingson

• https://0xrick.github.io/hack-the-box/ellingson/

绕过LLMNR/NBT-NS蜜罐

• https://blog.redteam.pl/2019/10/bypassing-llmnr-nbns-honeypot.html

ByePg通过Exception-Hooking绕过Patchguard

• https://blog.can.ac/2019/10/19/byepg-defeating-patchguard-using-exception-hooking/
• https://github.com/can1357/ByePg

Android平台下载量超5亿的UC浏览器存在安全隐患

• https://www.zscaler.com/blogs/research/uc-browser-app-abuses-may-have-exposed-500-million-users

[漏洞]

已有四年历史的Linux Wi-Fi严重漏洞, 正在修补中(CVE-2019-17666)

• https://threatpost.com/critical-linux-wi-fi-bug-system-compromise/149325/

Cisco IOS XE认证绕过漏洞(CVE-2019-12643)

• https://www.zerodayinitiative.com/blog/2019/10/17/cve-2019-12643-cisco-ios-xe-authentication-bypass-vulnerability

Nostromo Web服务器未认证RCE漏洞(CVE-2019-16278)

• https://www.sudokaikan.com/2019/10/cve-2019-16278-unauthenticated-remote.html

[恶意代码]

与APT34相关的PoisonFrog恶意软件使用DNS隧道进行通信的技术分析

• https://ironnet.com/blog/chirp-of-the-poisonfrog/

[工具]

bn-brainfuck: BinaryNinja插件, 处理和加载Brainfuck架构文件

• https://github.com/zznop/bn-brainfuck

chrome_password_grabber: 获取Chrome保存的密码, 明文形式

• https://github.com/x899/chrome_password_grabber

C64LoaderWV: Ghidra中加载C64程序

• https://github.com/zeroKilo/C64LoaderWV
• https://www.youtube.com/watch?v=thl6VciaUzg

at51: 辅助逆向8051固件

• https://github.com/8051Enthusiast/at51

jsfuzz: 对JavaScript的coverage-guided fuzzing工具

• https://github.com/fuzzitdev/jsfuzz

domdig: 对单页App(SPA)进行递归式的DOM XSS扫描

• https://github.com/fcavallarin/domdig

frizzer: 基于Frida的通用Fuzzer

• https://github.com/demantz/frizzer

rbuster: yet another dirbuster

• https://github.com/smirnovvad/rbuster

20191018

[技术]

使用IDA从0开始学逆向, Part23

• https://kienmanowar.wordpress.com/2019/10/17/reversing-with-ida-from-scratch-p23/

PASETO: 一项创建可在网络上安全共享的安全无状态令牌的新标准

• https://paseto.io/
• https://developer.okta.com/blog/2019/10/17/a-thorough-introduction-to-paseto

Github实时监控与secret发现工具shhgit介绍

• https://darkport.co.uk/blog/ahh-shhgit!/

JavaScript原型污染(Prototype Pollution)

• https://slides.com/securitymb/prototype-pollution-in-kibana/#/

Flare-On 6 CTF WriteUp (Part 8/9)

• https://blog.attify.com/flare-on-6-ctf-writeup-part9/
• https://blog.attify.com/flare-on-6-ctf-writeup-part8/

HITCON CTF 2019 Quals

• https://medium.com/@ktecv2000/hitcon-ctf-2019-quals-one-punch-man-pwn-292pts-3e94eb3fd312

Managing macOS Catalina’s FileVault 2 with fdesetup

• https://derflounder.wordpress.com/2019/10/17/managing-macos-catalinas-filevault-2-with-fdesetup/

在macOS中如何使用网络Hooking代理网络活动

• https://www.apriorit.com/dev-blog/641-mac-network-hooks-macos

[漏洞]

YouPHPTube多个漏洞

• https://blog.talosintelligence.com/2019/10/vuln-spotlight-php-tube-sql-vulns-oct-2019.html

Wordpress插件Fast Velocity Minify中等严重漏洞

• https://www.wordfence.com/blog/2019/10/medium-severity-vulnerability-patched-in-fast-velocity-minify-plugin/

[恶意代码]

欧洲国际机场超过50％的计算系统感染了Monero挖矿软件

• https://www.cyberbit.com/blog/endpoint-security/cryptocurrency-miners-exploit-airport-resources/

银行木马Redaman将C&C隐藏在比特币区块链中

• https://research.checkpoint.com/ponys-cc-servers-hidden-inside-the-bitcoin-blockchain/

幽灵行动: 最近发现的APT29使用3款新的恶意软件(PolyglotDuke/RegDuke/FatDuke)的攻击活动

• https://www.welivesecurity.com/2019/10/17/operation-ghost-dukes-never-left/

[工具]

volatility3: Volatility 的3.0版

• https://github.com/volatilityfoundation/volatility3

LinuxForensic: Linux取证Workshop

• https://github.com/ashemery/LinuxForensic

acCOMplice: 发现并利用COM劫持攻击

• https://github.com/nccgroup/acCOMplice

sechub: 在1个API/Client中使用多个不同的安全工具

• https://github.com/daimler/sechub
• https://daimler.github.io/sechub/latest/sechub-techdoc.html

[其他]

2019年网络钓鱼趋势和情报报告

• https://info.phishlabs.com/hubfs/2019%20PTI%20Report/2019%20Phishing%20Trends%20and%20Intelligence%20Report.pdf

20191017

[技术]

一个通过浏览器API收集用户行为数据的实验平台

• https://arxiv.org/abs/1910.07455

部署RDP蜜罐之后捕获的攻击活动

• https://www.wilbursecurity.com/2019/10/rdp-honeypotting/

如何使用Falco检测sudo漏洞(CVE-2019-14287)

• https://sysdig.com/blog/detecting-cve-2019-14287/

802.11p V2X Hunting

• https://harrisonsand.com/802-11p-v2x-hunting/

使用机器学习检测SMB流量中的随机文件名, 识别安全威胁

• https://blog.fox-it.com/2019/10/16/detecting-random-filenames-using-unsupervised-machine-learning/

RFID/NFC自动售货机逆向与Hacking

• https://securityaffairs.co/wordpress/92537/hacking/vending-machine-hacking.html

ThinVNC客户端认证绕过

• https://redteamzone.com/ThinVNC/

Android Vendor binder 服务的检查与利用, Part1

• https://blog.flanker017.me/examining-and-exploiting-android-vendor-binder-services-part1/

[漏洞]

Kubernetes最近修补的2个漏洞分析(CVE-2019-16276/CVE-2019-11253)

• https://blog.paloaltonetworks.com/2019/10/cloud-kubernetes-vulnerabilities/

Solaris 11.x xscreensaver 导致本地提权漏洞分析

• https://techblog.mediaservice.net/2019/10/local-privilege-escalation-on-solaris-11-x-via-xscreensaver/

绕过Razer 的 OTP 码要求

• https://medium.com/@anandadhakal13/how-i-was-able-to-bypass-otp-token-requirement-in-razer-the-story-of-a-critical-bug-fc63a94ad572

libssh2另一个整数溢出漏洞(CVE-2019-17498)

• https://blog.semmle.com/libssh2-integer-overflow-CVE-2019-17498/

[恶意代码]

攻击者将后门和挖矿软件隐藏在WAV音频文件中

• https://threatvector.cylance.com/en_us/home/malicious-payloads-hiding-beneath-the-wav.html

Graboid: 首次在Docker Hub的映像中​​发现的Cryptojacking蠕虫

• https://unit42.paloaltonetworks.com/graboid-first-ever-cryptojacking-worm-found-in-images-on-docker-hub/

The Ramnit Web Browser Specialist: Hooker Number II

• https://www.emanueledelucia.net/the-ramnit-web-browser-specialist-hooker-number-ii/

[工具]

Tor-Wireless-Router: Bash脚本, 自动创建Tor WiFi AP

• https://github.com/cis34ux/Tor-Wireless-Router

rita: 网络数据包分析

• https://github.com/activecm/rita

ssrf-sheriff: SSRF探测器, Go编写

• https://github.com/teknogeek/ssrf-sheriff

20191016

[技术]

Overthewire Bandit Challenges Writeup

• https://avicoder.me/2019/10/15/bandit/

不用代理绕过GFW

• https://infatica.io/blog/cachebrowser-bypassing-chinese-firewall-without-proxies/

Postscript Pat and His Black and White Hat

• https://srcincite.io/assets/postscript-pat-and-his-black-and-white-hat.pdf

Request smuggling between Amazon ALBs and Go net/- http

• https://99designs.com.au/blog/engineering/request-smuggling/

网络渗透入门课程

• https://github.com/hmaverickadams/Beginner-Network-Pentesting
• https://www.youtube.com/watch?v=qlK174d_uu8&list=PLLKT__MCUeiwBa7d7F_vN1GUwz_2TmVQj

Flare-On 6 CTF WriteUp (Part 6/7)

• https://blog.attify.com/flare-on-6-ctf-writeup-part7/
• https://blog.attify.com/flare-on-6-ctf-writeup-part6/

Windows Defender Exploit Guard 介绍

• https://medium.com/p/860b69db2ad2

使用Umlauts破解密码

• https://www.blackhillsinfosec.com/cracking-passwords-with-umlauts/

iOS App和macOS软件逆向基础

• https://www.apriorit.com/dev-blog/363-how-to-reverse-engineer-os-x-and-ios-software

[漏洞]

Adobe Acrobat Reader DC之前1个漏洞的补丁无效, 会导致RCE

• https://blog.talosintelligence.com/2019/10/vuln-spotlight-adobe-reader-redux-oct-2019.html

php_html_entities()整数溢出

• https://hackerone.com/reports/140865

Tailoring CVE-2019-2215 to Achieve Root

• https://hernan.de/blog/2019/10/15/tailoring-cve-2019-2215-to-achieve-root/

[恶意代码]

瑞典黑客组织售卖的Blackremote远控

• https://unit42.paloaltonetworks.com/blackremote-money-money-money-a-swedish-actor-peddles-an-expensive-new-rat/

IoT: a malware story

• https://securelist.com/iot-a-malware-story/94451/

虚假的iOS越狱网站, 引诱用户下载点击欺诈App

• https://blog.talosintelligence.com/2019/10/checkrain-click-fraud.html

[工具]

pyhexraysdeob: IDA microcode插件(反混淆)HexRaysDeob的官方版本, Python实现

• https://github.com/idapython/pyhexraysdeob

Burpee: 从- http请求中提取header和POST数据

• https://github.com/xscorp/Burpee

aah: 利用unicorn和libffi在macOS上运行iOS arm64二进制文件

• https://github.com/zydeco/aah

postenum: Linux提权工具

• https://github.com/mbahadou/postenum

使用Frida重播FaceTime

• https://github.com/googleprojectzero/Street-Party/tree/master/FaceTime/frida

20191015

[技术]

Amazon S3 泄露与 bucket 接管攻击

• https://medium.com/@woj_ciech/fun-with-amazon-s3-leaks-and-bucket-takeover-attack-ddb17da1c431

Docker容器加固

• https://0x00sec.org/t/securing-docker-containers/16913

利用McAfee工具绕过McAfee终端安全软件

• https://dmaasland.github.io/posts/mcafee.html

hitcon quals 2019(CTF)

• https://github.com/david942j/ctf-writeups/tree/master/hitcon-quals-2019
• https://github.com/bruce30262/CTF_challenge_public/tree/master/hitcon2019_qual
• https://github.com/scwuaptx/CTF/tree/master/2019-writeup/hitcon

使命召唤: 现代浏览器之战

• https://cyberweek.ae/materials/D2%20COMMSEC%20-%20Call%20Of%20Duty-%20Modern%20Browser%20Warfare%20-%20Dhiraj%20Mishra.pdf

Docker容器安全

• https://cyberweek.ae/materials/D1%20COMMSEC%20-%20Docker%20Container%20%28In%29Security%20-%20Suraj%20Khetani.pdf

测试和破坏JWT身份验证的实用方法

• https://cyberweek.ae/materials/D1%20COMMSEC%20-%20Practical%20Approaches%20for%20Testing%20and%20Breaking%20JWT%20Authentication%20JWT%20-%20Mazin%20Ahmed.pdf

揭开无线攻击与防御的神秘面纱

• https://cyberweek.ae/materials/D2%20COMMSEC%20-%20On%20the%20Wings%20of%20Time-%20Demystifying%20Wireless%20Ethical%20Hacking%20and%20Defenses%20-%20Harshit%20Agrawal%20%26%20Himanshu%20Mehta.pdf

可用作钓鱼的反向代理Modlishka分析

• https://blogs.akamai.com/2019/10/phishing-tool-analysis-modlishka.html

Office 365网络攻击: 通过不安全的Reply URL获得对电子邮件和文件的访问

• https://dirkjanm.io/office-365-network-attacks-via-insecure-reply-url/

一些关于Win10 AltSystemCallHandlers的研究

• https://github.com/0xcpu/WinAltSyscallHandler

AngularJS CSP绕过

• https://portswigger.net/research/angularjs-csp-bypass-in-56-characters

[漏洞]

Sudo 1.8.28修复的安全漏洞CVE-2019-14287, 可导致用户在受限时依然以Root权限执行命令

• https://www.openwall.com/lists/oss-security/2019/10/14/1
• https://www.sudo.ws/alerts/minus_1_uid.html

Nostromo - httpd 严重漏洞(CVE-2019-16278/CVE-2019-16279) Exploit

• https://git.sp0re.sh/sp0re/N- httpd-exploits

[恶意代码]

发现APT攻击中隐藏的无文件WebShell

• https://cyberweek.ae/materials/D1%20COMMSEC%20-%20Discover%20Invisible%20Fileless%20Webshell%20in%20the%20APT%20Attack%20-%20Tim%20Yeh%20%26%20Dove%20Chiu.pdf

中东APT组织Muddy Waters在攻击中使用的TTP分析

• https://cyberweek.ae/materials/D2%20COMMSEC%20-%20Looking%20Through%20Muddy%20Waters-%20Insight%20into%20TTPs%20of%20a%20Middle%20Eastern%20Threat%20Actor%20-%20Jaromir%20Horejsi.pdf

揭露黑客组织Winnti新的武器库和攻击方法

• https://www.welivesecurity.com/2019/10/14/connecting-dots-exposing-arsenal-methods-winnti/

伊朗黑客组织Silent Librarian, 利用钓鱼攻击窃取大学图书馆的访问权限

• https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta407-silent-librarian

Fallout漏洞利用工具包与Raccoon窃密软件分析

• https://labs.bitdefender.com/2019/10/a-close-look-at-fallout-exploit-kit-and-raccoon-stealer/

持续进行的SideWinder攻击活动

• https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Indian/APT/SideWinder/11-10-2019/Analysis.md

[工具]

IDA发布7.4版, 支持Python3

• https://hex-rays.com/products/ida/7.4/index.shtml

ghidra-emotionengine: Ghidra处理器, 处理PS2的Emotion Engine CPU(基于MIPS)

• https://github.com/beardypig/ghidra-emotionengine

uniFuzzer: 基于Unicorn和LibFuzzer的Fuzzing工具

• https://github.com/PAGalaxyLab/uniFuzzer

Net-GPPPassword: .NET版本的 Get-GPPPassword: 获取组策略Preferences推送的帐户的明文密码和其他信息

• https://github.com/outflanknl/Net-GPPPassword

20191014

[技术]

Simjacker: 在29个国家/地区使用的SIM卡容易受到Simjacker攻击

• https://simjacker.com/downloads/technicalpapers/AdaptiveMobile_Security_Simjacker_Technical_Paper_v1.01.pdf

绕过WebARX WAF

• https://osandamalith.com/2019/10/12/bypassing-the-webarx-web-application-firewall-waf/

使用Yabasic Hacking PS2

• https://cturt.github.io/ps2-yabasic.html

分析键盘固件, Part2

• https://mrexodia.github.io/reversing/2019/10/13/Analyzing-keyboard-firmware-part-2

AWAE/OSWE PREP: xss导致RCE的实例研究: 通过分析Web App源码发现漏洞并使用Python实现自动化利用

• https://sarthaksaini.com/2019/awae/xss-rce.html

Hack The Box - Writeup

• https://rizemon.github.io/hackthebox/linux/cmsmadesimple/ssh/2019/10/13/writeup-htb.html
• https://sarthaksaini.com/2019/June/Writeup-htb/writeup.html
• https://phaz0n.github.io/writeup/2019/10/12/writeup-writeup/

Linux daemon (LXD)提权

• https://www.hackingarticles.in/lxd-privilege-escalation/

Flare-On 6 CTF WriteUp

• https://blog.attify.com/flare-on-6-ctf-writeup-part5/
• https://blog.attify.com/flare-on-6-ctf-writeup-part4/
• https://blog.attify.com/flare-on-6-ctf-writeup-part3/

使用Metasploit实现EternalBlue/BlueKeep漏洞利用

• https://hakin9.org/ispy-exploiting-eternalblue-and-bluekeep-vulnerabilities-with-metasploit/

[恶意代码]

逆向JNBridge为CVE-2019-7839编写Exploit

• https://nickbloor.co.uk/2019/10/12/reversing-jnbridge-to-build-an-n-day-exploit-for-cve-2019-7839/

利用广告活动传播的MAC平台恶意软件OSX/Tarmac

• https://blog.confiant.com/osx-shlayer-new-shurprise-unveiling-osx-tarmac-f965a32de887

与伊朗有关联的APT小组“Charming Kitten”在8月至9月之间的攻击中采用了新的鱼叉式网络钓鱼方法

• https://www.clearskysec.com/wp-content/uploads/2019/10/The-Kittens-Are-Back-in-Town-2.pdf

Mac平台后门AppleJeus

• https://objective-see.com/blog/blog_0x49.html

[工具]

C2-Blockchain: 基于以太坊智能合约实现的C&C

• https://github.com/geek-repo/C2-Blockchain

fsmon: 监控多种OS的文件系统(iOS/OS X/Android/FirefoxOS/Linux)

• https://github.com/nowsecure/fsmon

traxss: 自动化XSS漏洞扫描器

• https://github.com/M4cs/traxss

20191011

[技术]

改善JavaScript生态系统的密码学

• https://paragonie.com/blog/2019/10/improving-cryptography-javascript-ecosystem

挖洞时挖掘sqlmap的全部潜力

• https://vavkamil.cz/2019/10/09/understanding-the-full-potential-of-sqlmap-during-bug-bounty-hunting/

OS:iBoot

• http://newosxbook.com/bonus/iBoot.pdf

Zombieland CTF: 针对逆向初学者

• https://mcb101.blog/2019/10/11/zombieland-ctf-reverse-engineering-for-beginners/

Intel Management Engine OS介绍, Part2

• https://pbx.sh/intelme-sw2/

Flash click2play in Web Browsers and other Horror Stories

• https://docs.google.com/presentation/d/1C4ymBShCdL2uSm6cQFrJBhie3ZHRpDITIFMuJcvlcG0/edit#slide=id.g5c2daf6640_0_0

[漏洞]

从漏洞利用的角度分析Exim MTA, 以及CVE-2019-15846 PoC

• https://www.synacktiv.com/posts/exploit/scraps-of-notes-on-exploiting-exim-vulnerabilities.html

Sophos Cyberoam防火墙预认证RCE漏洞分析(CVE-2019-17059)

• https://thebestvpn.com/cyberoam-preauth-rce/?=cve-2019-17059-flaw

通过时间回溯调试(Time Travel Debugging)分析Adobe Reader某漏洞的根本成因

• https://darungrim.com/research/2019-10-10-vulnerability-root-cause-analysis-with-time-travel-debugging.html

HP Touchpoint Analytics DLL劫持搜索顺序漏洞分析与潜在滥用(CVE-2019-6333)

• https://safebreach.com/Post/HP-Touchpoint-Analytics-DLL-Search-Order-Hijacking-Potential-Abuses-CVE-2019-6333

WhatsApp怎么了: CVE-2019-3568详细逆向分析

• https://github.com/maddiestone/ConPresentations/blob/master/Jailbreak2019.WhatsUpWithWhatsApp.pdf

[恶意代码]

Attor恶意软件, 以不寻常的策略攻击政府和外交部门

• https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf

[工具]

ghidra-lx-loader: Ghidra Loader, 加载Linear eXecutable格式文件

• https://github.com/oshogbo/ghidra-lx-loader

policy_sentry: IAM 最小权限策略生成器

• https://github.com/salesforce/policy_sentry

DMG-CPU-Inside: Reverse-engineered schematics for DMG-CPU-B

• https://github.com/furrtek/DMG-CPU-Inside

PowerDropper: 生成PowerShell Dropper脚本, 脚本用于加载.NET可执行文件

• https://github.com/gigajew/PowerDropper

jeb2frida: 使用JEB自动生成Frida hook

• https://github.com/Hamz-a/jeb2frida
• https://bhamza.me/2019/10/06/Automated-Frida-hook-generation-with-JEB.html

20191010

[技术]

使用Ghidra破解CrackMe, Part2

• https://youtu.be/Eu9YC1Jq1Do

IDAPython清单

• https://github.com/inforion/idapython-cheatsheet

如何渗透提取 AWS EC2 数据

• https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/

将Windows API映射到Sysmon事件

• https://posts.specterops.io/uncovering-the-unknowns-a47c93bb6971
• https://github.com/jsecurity101/Windows-API-To-Sysmon-Events

XS-Leak: Leaking IDs using focus

• https://portswigger.net/research/xs-leak-leaking-ids-using-focus

挖掘内存分配漏洞

• https://blog.shiftleft.io/zero-day-snafus-hunting-memory-allocation-bugs-797e214fab6c

Flare-On 6 CTF WriteUp (Part 1)

• https://blog.attify.com/flare-on-6-ctf-writeup-part1/

BrokenStrokes: 关于无线键盘安全性的研究

• https://arxiv.org/abs/1910.03895

宙斯盾：智能家居系统的上下文感知安全框架

• https://arxiv.org/abs/1910.03750

[漏洞]

NitroPDF多个RCE漏洞

• https://blog.talosintelligence.com/2019/10/vuln-spotlight-Nitro-PDF-RCE-bugs-sept-19.html

AtherosSvc服务(高通Atheros无线/蓝牙驱动)漏洞(CVE-2019-10617)

• https://silentbreaksecurity.com/cve-2019-10617/

在Mozilla开源支持计划中发现的iTerm2严重漏洞

• https://blog.mozilla.org/security/2019/10/09/iterm2-critical-issue-moss-audit/

WooCommerce 3.6.4 CSRF绕过与存储型XSS

• https://blog.ripstech.com/2019/woocommerce-csrf-to-stored-xss/

[恶意代码]

Go编写的勒索软件Eris

• https://lekstu.ga/posts/go-under-the-hood-eris/

黑客攻击了Volusion的基础设施, 并部署恶意软件窃取用户的支付卡信息

• https://blog.usejournal.com/sesame-street-volusion-customers-are-comprised-how-the-cookie-monster-is-stealing-cc-numbers-21eb51ec613b

分析最近的Magnitude样本

• https://www.fortinet.com/blog/threat-research/magnitude-exploit-kit-sample-analysis.html

[工具]

Maryam: OSINT框架

• https://github.com/saeeddhqan/Maryam

20191009

[技术]

MITRE ATT&CK: 浏览器收藏夹发现

• https://resources.infosecinstitute.com/mitre-attck-browser-bookmark-discovery/

FIDO2: 解决密码问题

• https://research.kudelskisecurity.com/2019/10/08/fido2-solving-the-password-problem/

Azure AD和通用WS-Trust MFA绕过详解

• https://securecloud.blog/2019/10/08/advisories-1-2-azure-ad-and-common-ws-trust-mfa-bypass-explained/

(Super) Magic Hashes

• https://offsec.almond.consulting/super-magic-hash.html

可利用Windows快捷方式实现驻留的几个工具

• https://pentestlab.blog/2019/10/08/persistence-shortcut-modification/

利用服务实现驻留

• https://pentestlab.blog/2019/10/07/persistence-new-service/

Hack the Box (HTB) machines walkthrough series — Luke

• https://resources.infosecinstitute.com/hack-the-box-htb-walkthrough-luke/

[漏洞]

对Adobe Reader符号的研究

• https://googleprojectzero.blogspot.com/2019/10/the-story-of-adobe-reader-symbols.html

Windows错误报告服务以SYSTEM权限移动/重命名文件的漏洞可导致提权

• https://offsec.almond.consulting/windows-error-reporting-arbitrary-file-move-eop.html

TwinCAT 2个 DoS 漏洞(CVE 2019-5637/2019-5636)

• https://blog.rapid7.com/2019/10/08/r7-2019-32-denial-of-service-vulnerabilities-in-beckhoff-twincat-plc-environment-fixed/

针对.NET Remoting服务漏洞的利用工具(CVE-2014-1806/CVE-2014-4149)

• https://github.com/tyranid/ExploitRemotingService

Schneider Electric Modicon M580多个漏洞

• https://blog.talosintelligence.com/2019/10/vuln-spotlight-schneider-electric-m580-part-2-sept-2019.html

WordPress插件All In One WP Security的Open Redirect漏洞

• https://www.pluginvulnerabilities.com/2019/10/08/vulnerability-details-open-redirect-in-all-in-one-wp-security/

[恶意代码]

分析1个Go编写的针对Linux的勒索软件

• https://www.fortinet.com/blog/threat-research/new-golang-ransomware-targeting-linux-systems.html

Android平台广告软件, 通过移除图标的方式隐藏自身, 或者隐藏到系统配置项中

• https://news.sophos.com/en-us/2019/10/08/icon-hiding-android-adware-returns-to-the-play-market/

[工具]

entroPy: 二进制文件熵值可视化工具

• https://github.com/gcmartinelli/entroPy

[其他]

托管检测和响应分析报告(2019年上半年)

• https://securelist.com/managed-detection-and-response-analytics-report/94076/

20191008

[技术]

使用Frida进行移动渗透测试

• https://drive.google.com/file/d/1JccmMLi6YTnyRrp_rk6vzKrUX3oXK_Yw/view

动态执行路径收集与离线分析

• https://blog.quarkslab.com/exploring-execution-trace-analysis.html

内部域名冲突

• https://blog.redteam.pl/2019/10/internal-domain-name-collision-dns.html

使用objection框架对iOS App进行动态运行时渗透测试

• https://blog.securelayer7.net/a-run-time-approach-for-penetration-testing-of-ios-apps-part-i/

Android App渗透指南

• https://github.com/nightowl131/AAPG

Swift App逆向

• https://github.com/iOS-Reverse-Engineering-Dev/Swift-Apps-Reverse-Engineering/blob/master/Reverse%20Engineering%20Swift%20Applications.pdf

Pair Locking your iPhone with Configurator 2

• https://arkadiyt.com/2019/10/07/pair-locking-your-iphone-with-configurator-2/

JWT漏洞利用介绍

• http://intx0x80.blogspot.com/2019/10/JWT.html

[漏洞]

dbell智能门铃输入验证问题可导致攻击者远程开门

• http://noahclements.com/Improper-Input-Validation-on-dbell-Smart-Doorbell-Can-Lead-To-Attackers-Remotely-Unlocking-Door/

协作笔记HackMD的存储型XSS漏洞和桌面客户端RCE漏洞

• https://5alt.me/2019/10/HackMD%20Stored%20XSS%20and%20HackMD%20Desktop%20RCE/

多款D-Link路由器的未授权RCE漏洞

• https://www.fortinet.com/blog/threat-research/d-link-routers-found-vulnerable-rce.html

[恶意代码]

• http僵尸网络和Loader DarkRat v2.2.0分析
• https://github.com/albertzsigovits/malware-writeups/tree/master/DarkRATv2

一个多阶段恶意代码的分析(doc/vba/jscript/exe/shellcode/mapped exe/iat rebuild)

• https://youtu.be/qJB-6Aj8zX8

[工具]

LambdaGuard: AWS Lambda审计工具

• https://github.com/Skyscanner/LambdaGuard

penta: 用于自动化渗透的多合一工具, 命令行

• https://github.com/takuzoo3868/penta

amtracker: 从Android恶意代码中提取某些有用的信息

• https://github.com/jacobsoo/amtracker

dns-rebinding-tool: DNS重绑定工具

• https://github.com/h43z/dns-rebinding-tool

calexe: 自动查找公开的日历

• https://github.com/bugbounty-site/calexe

weirdhta: 创建免杀的hta文件

• https://github.com/felamos/weirdhta

20190929

[技术]

滑板车Hacking: How I Created $100k Worth Of Free Rides

• https://web.archive.org/web/20190928130035/- https://fant.io/p/hacking-voi/

(CTF)Flare-On第6个挑战

• https://maxkersten.nl/binary-analysis-course/assembly-basics/practical-case-crack-me-0x02/

Hack The Box: SwagShop

• https://khaoticdev.net/?p=520

使用Kali和Wireshark攻击路由器, 以及5种简单的防护技巧

• https://www.networkdefenseblog.com/post/5-easy-router-attacks-and-protections

RedTeaming介绍

• https://blog.zsec.uk/redteam-intro/

使用Multi-Bit DPA破解AES128

• https://crysec.dev/2019/08/25/breaking-aes128-with-multi-bit-dpa.html

经济且高效的无人机检测解决方案

• https://www.contextis.com/en/blog/cost-effective-drone-detection

XSS魔法技巧

• https://www.slideshare.net/GarethHeyes/xss-magic-tricks

使用树莓派做WiFi AP, 利用透明TLS代理将解密后的流量保存至pcap文件

• https://www.netresec.com/?page=Blog&month=2019-09&post=Raspberry-PI-WiFi-Access-Point-with-TLS-Inspection

初步了解Mac和iOS取证中的Protobuf数据

• https://www.mac4n6.com/blog/2019/9/27/just-call-me-buffy-the-proto-slayer-an-initial-look-into-protobuf-data-in-mac-and-ios-forensics

Flare-On CTF 2019 by FireEye

• https://github.com/gray-panda/grayrepo/tree/master/2019_flareon

[漏洞]

checkm8: 一个永远无法修补的iOS设备漏洞, 影响数亿设备

• https://github.com/axi0mX/ipwndfu#checkm8

PHP 7.1-7.3 disable_functions bypass

• https://github.com/mm0r1/exploits/tree/master/php-json-bypass

squid-cache proxy Out of Bound Write in Gopher

• https://marcograss.github.io/security/2019/09/27/squid-cache-proxy-out-of-bound-write.html

[恶意代码]

AirDropBot僵尸网络(Linux平台)

• https://blog.malwaremustdie.org/2019/09/mmd-0064-2019-linuxairdropbot.html

Nodersok攻击事件: 攻击者自带2个LOLBin, 攻击分多个阶段, 利用无文件技术, 投递基于Node.js的恶意软件

• https://www.microsoft.com/security/blog/2019/09/26/bring-your-own-lolbin-multi-stage-fileless-nodersok-campaign-delivers-rare-node-js-based-malware/

Masad窃密软件: 使用Telegram进行数据渗透

• https://forums.juniper.net/t5/Threat-Research/Masad-Stealer-Exfiltrating-using-Telegram/ba-p/468559

[工具]

BurpFeed: 将大批量的URL添加到Burp的sitemap/target面板

• https://github.com/ZephrFish/BurpFeed

rebel-framework: 渗透测试框架, 功能高级, 易于使用

• https://github.com/reb311ion/rebel-framework

fav-up: 利用网站的favicon图标和Shodan, 查找真实IP

• https://github.com/pielco11/fav-up

20190927

[技术]

二进制代码相似性调查

• https://arxiv.org/abs/1909.11424

监控Github上泄漏的敏感信息的多种方式

• https://duo.com/labs/research/how-to-monitor-github-for-secrets

(CppCon2019)消灭未初始化内存: 在不影响性能的情况下保护操作系统

• https://github.com/microsoft/MSRC-Security-Research/blob/master/presentations/2019_09_CppCon/CppCon2019%20-%20Killing%20Uninitialized%20Memory.pdf

Fuzz循环自动化: 利用覆盖率分析改善测试和Fuzz开发

• https://blog.forallsecure.com/beginning-fuzz-cycle-automation-improving-testing-and-fuzz-development-with-coverage-analysis

多种PHP Webshell上传技巧

• https://www.hackingarticles.in/web-shells-penetration-testing/

近期1个XSS挑战的Write-up

• https://medium.com/@terjanq/dom-clobbering-techniques-8443547ebe94

区块链与IoT安全: 将区块链集成到IoT网络中的好处、主要挑战和实现此目标的可能方式, 以及实际用例的展示

• https://www.apriorit.com/dev-blog/638-blockchain-how-can-blockchain-secure-iot-networks

[漏洞]

Wordpress插件GiveWP的认证绕过漏洞

• https://www.wordfence.com/blog/2019/09/authentication-bypass-vulnerability-in-givewp-plugin/

[恶意代码]

macOS平台恶意软件: OSX/Shlayer与OSX/Tarmac

• https://blog.confiant.com/osx-shlayer-new-shurprise-unveiling-osx-tarmac-f965a32de887

REvil/Sodinokibi勒索软件

• https://www.secureworks.com/research/revil-sodinokibi-ransomware

Divergent: "Fileless" NodeJS Malware Burrows Deep Within the Host

• https://blog.talosintelligence.com/2019/09/divergent-analysis.html

[工具]

Mumbai SEO: 带漏洞的/练习漏洞利用的虚拟机

• https://caffeinatedengineers.com/?p=70

Sniffle: 蓝牙5和4.x LE嗅探器

• https://github.com/nccgroup/sniffle
• https://www.nccgroup.trust/us/our-research/sniffle-a-sniffer-for-bluetooth-5/?research=Public+tools

TRunPE: 改版的process hollowing技巧代码, 附加TLS区段调用OEP, 避免使用SetThreadContext

• https://github.com/jackullrich/TRunPE
• https://winternl.com/trunpe/

Burp-LFI-tests: 使用Burp对LFI进行Fuzz

• https://github.com/Team-Firebugs/Burp-LFI-tests

Router-Exploit-Shovel: 无线路由器上堆栈溢出类型的自动应用程序生成

• https://github.com/arthastang/Router-Exploit-Shovel

[其他]

Black Hat USA 2019视频列表

• https://www.youtube.com/playlist?list=PLH15HpR5qRsWrfkjwFSI256x1u2Zy49VI

20190926

[技术]

渗透测试之: Tor, VPN与代理

• https://resources.infosecinstitute.com/penetration-testing-tor-vpn-or-proxy/

使用IDA从零开始学逆向, Part21

• https://medium.com/p/17ce2ee804af

Mass Triage Part 4: Processing Returned Files - AppCache/Shimcache

• https://digital-forensics.sans.org/blog/2019/09/25/mass-triage-part-4-processing-returned-files-appcacheshimcache

USBsamurai初学者指南(USBsamurai: 可远程控制的恶意USB设备)

• https://medium.com/p/4bd47abf8f87

解析Sysmon日志, 查找IR指标

• https://digital-forensics.sans.org/blog/2019/09/25/parsing-sysmon-events-for-ir-indicators
• https://github.com/CrowdStrike/Forensics

Windows漏洞利用技巧: 伪造命名管道客户端PID

• https://googleprojectzero.blogspot.com/2019/09/windows-exploitation-tricks-spoofing.html

Crowdstrike与Dragos集成

• https://www.crowdstrike.com/blog/tech-center/crowdstrike-store-dragos/

[漏洞]

在野发现Rich Reviews插件0Day的利用

• https://www.wordfence.com/blog/2019/09/rich-reviews-plugin-vulnerability-exploited-in-the-wild/

Jira Service Desk路径回溯导致信息泄漏漏洞分析(CVE-2019-14994)

• https://samcurry.net/analysis-of-cve-2019-14994/

三星手机TTS引擎本地提权漏洞

• https://exploit.kitploit.com/2019/09/samsung-mobile-android-samsungtts.html

[恶意代码]

黑客组织Tortoiseshell是如何创建了个假的招聘网站来托管恶意代码的

• https://blog.talosintelligence.com/2019/09/tortoiseshell-fake-veterans.html

JSWorm勒索软件

• https://www.carbonblack.com/2019/09/25/cb-tau-threat-intelligence-notification-jsworm-ransomware-encrypts-files-amends-file-extensions/

8月底的一次攻击事件分析(TrickBot or Treat )

• https://www.fortinet.com/blog/threat-research/trickbot-or-treat-threat-analysis.html

谷歌商店发现一些App, 本身功能简单, 在免费或低价App中有相同功能, 却向用户收取高价费用

• https://news.sophos.com/en-us/2019/09/25/fleeceware-apps-overcharge-users-for-basic-app-functionality/

近期的"Aggah"攻击事件的新线索

• https://blog.yoroi.company/research/apt-or-not-apt-whats-behind-the-aggah-campaign/

窃密软件AZORult

• https://www.carbonblack.com/2019/09/24/cb-tau-threat-intelligence-notification-common-to-russian-underground-forums-azorult-aims-to-connect-to-cc-server-steal-sensitive-data/

Emotet JavaScript下载者分析

• https://www.bromium.com/reawakening-of-emotet-an-analysis-of-its-javascript-downloader/

2019年8月勒索软件流行性分析

• https://blog.360totalsecurity.com/en/the-epidemic-analysis-of-ransomware-in-august-2019/

[其他]

2019年医疗行业网络攻击趋势报告

• https://www.fortinet.com/blog/industry-trends/healthcare-cyberattack-trends-2019.html

20190925

[技术]

4秒钟内破解智能门锁

• https://www.pentestpartners.com/security-blog/drilling-open-a-smart-door-lock-in-4-seconds/

创建模仿原始签名二进制文件的二进制文件, 注入DNS 和 - https Cobalt Strike stager shellcode, 然后通过合法的MS域名进行投递(使用域名转发技术)

• https://blog.hunniccyber.com/staging-over-- https-and-dns-simultaneously-with-cobalt-strike-2/

使用Netlify创建钓鱼网站

• https://blog.hunniccyber.com/phishing-with-netlify/

CODESYS运行时: 1个PLC控制框架

• https://ics-cert.kaspersky.com/media/KICS-CERT-Codesys-En.pdf

(CTF)DSCTF 2019: 未知CPU架构的逆向

• https://www.robertxiao.ca/hacking/dsctf-2019-cpu-adventure-unknown-cpu-reversing/

Linux堆libc基址泄漏方法(开启ASLR)

• http://blog.infosectcbr.com.au/2019/09/linux-heap-unsorted-bin-libc-base-leak.html

多个反汇编工具的导出结果对比

• https://blog.quarkslab.com/an-experimental-study-of-different-binary-exporters.html

[漏洞]

vBulletin 5.x 0day pre-auth RCE exploit

• https://seclists.org/fulldisclosure/2019/Sep/31

MS Office URI处理器漏洞分析(CVE-2019-0801)

• https://www.zerodayinitiative.com/blog/2019/9/24/cve-2019-0801-microsoft-office-uri-hyperlink-hijinks

[恶意代码]

Plurox变种基于DNS请求结果进行控制流混淆

• https://sysopfb.github.io/malware,/crypters/2019/09/23/Plurox-packer-layer-unpacked.html

利用钓鱼传播的NetWire远控变种

• https://www.fortinet.com/blog/threat-research/new-netwire-rat-variant-spread-by-phishing.html

[工具]

NST: 用于网络安全分析和监控的Linux发行版

• https://sourceforge.net/projects/nst/

Ghidra发布9.1版本

• https://ghidra-sre.org/releaseNotes_9.1.html

用于Red Team的脚本

• https://github.com/d0nkeys/redteam

thetick: 简易的嵌入式Linux后门

• https://github.com/nccgroup/thetick

IA32 MSR解码工具(IDA脚本)

• https://github.com/RceNinja/Re-Scripts

[其他]

Spectre和Meltdown类型漏洞的分类(交互式展示)

• https://transient.fail/

俄罗斯APT组织地图

• https://apt-ecosystem.com/russia/map/

20190924

[技术]

一个智能卡的逆向分析

• https://blog.compass-security.com/2019/09/smart-card-odyssee/

Sysmon配置入门

• https://www.blackhillsinfosec.com/getting-started-with-sysmon/

4.3BSD and Metasploit

• https://astr0baby.wordpress.com/2019/09/22/4-3bsd-and-metasploit/

当今时代C++程序的逆向

• https://drive.google.com/file/d/1PgK-gWSgq48oVWQE7borOQHG4rpdmt60/view

使用IDA调试ios内核

• https://akayn.github.io/2019/09/21/debugging-the-ios-kernel-in-ida.html
• https://github.com/Synacktiv-contrib/kernelcache-laundering

绕过macOS隐私控制

• https://blog.xpnsec.com/bypassing-macos-privacy-controls/

使用mutation XSS绕过DOMPurify 2.0.0

• https://research.securitum.com/dompurify-bypass-using-mxss/

[漏洞]

我是如何发现Windows本地提权漏洞CVE-2019–1082的

• https://medium.com/@bazyli.michal/more-than-a-penetration-test-cve-2019-1082-647ba2e59034

一次渗透中的Oracle BI Publisher XEE注入实战

• https://medium.com/@osama.alaa/xxe-injection-in-oracle-application-server-11g-cc05f6ab55ab

[恶意代码]

朝鲜黑客组织使用DTrack远控攻击印度的研究中心

• https://securelist.com/my-name-is-dtrack/93338/

谷歌商店发现多款广告App, 下载后隐藏自身, 显示全屏广告, 下载量超210万

• https://www.symantec.com/blogs/threat-intelligence/hidden-adware-google-play

一个钓鱼攻击事件中的xls文档分析

• https://www.carbonblack.com/2019/09/23/cb-tau-threat-intelligence-notification-formbook-harvests-data-by-intercepting-clients/

[工具]

SocialPath: 收集指定用户名在多个社交媒体上的信息

• https://github.com/woj-ciech/SocialPath
• https://medium.com/@woj_ciech/socialpath-track-users-across-social-media-platforms-ed5226c8ee8c

csf: 容器安全框架. 可扩展，模块化，API优先，可针对CIS和其他自定义安全检查对Docker安装和容器进行定期安全监视

• https://github.com/armourbird/csf

dfir-orc: 用于artefacts收集的取证工具(Windows)

• https://github.com/dfir-orc/dfir-orc
• https://www.ssi.gouv.fr/en/actualite/dfir-orc-an-open-source-forensics-tool-dedicated-to-artefact-collection/

RedTeamCSharpScripts: 用于Red Team的C#脚本

• https://github.com/Mr-Un1k0d3r/RedTeamCSharpScripts

redqueen: 针对X86二进制文件的快速通用Fuzzer(Fuz­zing with In­put-to-Sta­te Cor­re­spon­dence)

• https://github.com/RUB-SysSec/redqueen

2019年IDA插件大赛结果

• https://www.hex-rays.com/contests/2019/index.shtml

20190923

[CTF]

(CTF)CPU Adventure task from Dragon CTF 2019 teaser

• https://github.com/koriakin/cpuadventure/

teaser_dragon_ctf_2019

• https://github.com/gynvael/random-stuff/tree/master/teaser_dragon_ctf_2019

(CTF)Phoenix挑战的解决方案

• https://blog.lamarranet.com/index.php/exploit-education-phoenix-solutions/
• http://exploit.education/phoenix/

DroidCon, SEC-T CTF 2019

• https://anee.me/droidcon-sec-t-ctf-2019-d796be91bb3f

Hack The Box - Kryptos

• https://0xrick.github.io/hack-the-box/kryptos/

VolgaCTF 2019 SmartHome Writeup

• https://blog.blackfan.ru/2019/09/volgactf-2019-smarthome-writeup.html

[技术]

卸载Sysmon Minifilter驱动

• https://osandamalith.com/2019/09/22/unloading-the-sysmon-minifilter-driver/

通过ETW事件和HELK进行威胁狩猎, Part1: 安装SilkETW

• https://medium.com/threat-hunters-forge/threat-hunting-with-etw-events-and-helk-part-1-installing-silketw-6eb74815e4a0

使用Ghidra破解CrackMe

• https://www.youtube.com/watch?v=6p5Qviusskk

使用headless Ghidra自动生成.fidb(Ghidra的函数签名系统)

• https://blog.threatrack.de/2019/09/20/ghidra-fid-generator/
• https://github.com/threatrack/ghidra-fid-generator

搜索公开的文件共享, 查找敏感信息

• https://medium.com/@markmotig/search-open-file-shares-for-potentially-sensitive-info-55446f11e5dd
• https://github.com/fashionproof/SearchOpenFileShares

[漏洞]

Jira服务器模板注入漏洞(CVE-2019-15001)

• https://confluence.atlassian.com/jira/jira-security-advisory-2019-09-18-976766250.html
• https://www.tenable.com/blog/cve-2019-14994-url-path-traversal-vulnerability-in-jira-service-desk-leads-to-information

WordPress Editor到Administrator的提权漏洞

• https://stazot.tk/wordpress-privilege-escalation-from-an-editor-to-administrator

Forcepoint VPN Windows客户端不带引号的搜索路径导致的漏洞, 及滥用方式: 提权、驻留、绕过防护(CVE-2019-6145)

• https://safebreach.com/Post/Forcepoint-VPN-Client-for-Windows-Unquoted-Search-Path-and-Potential-Abuses-CVE-2019-6145

Groovy沙箱逃逸漏洞(SECURITY-1538 / CVE-2019-10393, CVE-2019-10394, CVE-2019-10399, CVE-2019-10400)

• https://insinuator.net/2019/09/jenkins-groovy-sandbox-breakout-security-1538-cve-2019-10393-cve-2019-10394-cve-2019-10399-cve-2019-10400/

[工具]

Andromeda: 交互式Android App逆向工具

• https://github.com/secrary/Andromeda

SSRF_Vulnerable_Lab: SSRF漏洞练习实验室(PHP)

• https://github.com/incredibleindishell/SSRF_Vulnerable_Lab

API-Security: OWASP API Security Project

• https://github.com/OWASP/API-Security

aura-botnet: 超级便携的僵尸网络框架, 使用Django做C&C服务器, 客户端可由Rust/Bash/PowerShell编写

• https://github.com/watersalesman/aura-botnet

docem: 向docx,odt,pptx等文件中嵌入 XXE/XSS Payload

• https://github.com/whitel1st/docem

pwnagotchi: 无线攻击与深度强化学习的结合, 从Wifi环境中学习, 自动操作bettercap以最大化捕获的WPA密钥材料(任何形式的可破解握手包, 包括PMKID、完整的和不完整的WPA握手包)

• https://github.com/evilsocket/pwnagotchi

Fermion: Electron编写的UI, 对frida-node和monaco-editor的包装, 提供了一个完全集成的环境, 通过单个UI来原型化、测试和完善Frida脚本

• https://github.com/FuzzySecurity/Fermion

HRShell: - httpS/- http 反向Shell, Flask编写

• https://github.com/chrispetrou/HRShell

ScoutSuite: 云环境安全审计工具

• https://github.com/nccgroup/ScoutSuite

[其他]

Shodan查询语句收集

• https://github.com/jakejarvis/awesome-shodan-queries

20190920

[技术]

(CTF)Hacktivity 2018 badge

• https://jumpespjump.blogspot.com/2019/09/hacktivity-2018-badge-quick-start-guide.html

HacktheBox — Luke

• https://medium.com/bugbountywriteup/luke-hackthebox-writeup-531495c2706

漏洞挖掘持续集成/持续部署（CI / CD）管道

• https://drive.google.com/file/d/1U8PkppFvLWnJ-Fpmc0Q9TDkX2PB_lEPa/view

DerbyCon 2019 CTF Write Up

• https://labs.nettitude.com/blog/derbycon-2019-ctf-write-up/

恶意代码分析101: 静态分析基础

• https://medium.com/bugbountywriteup/malware-analysis-101-basic-static-analysis-db59119bc00a

[漏洞]

V-gHost: QEMU-KVM虚拟机逃逸漏洞

• https://blade.tencent.com/en/advisories/v-ghost/

Apache流量服务器- http Smuggling漏洞(CVE-2018-8004)详细分析

• https://regilero.github.io/english/security/2019/10/17/security_apache_traffic_server_- http_smuggling/

Microsoft SharePoint BDC反序列化导致代码执行的漏洞分析(CVE-2019-1257)

• https://www.zerodayinitiative.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization

Harbor严重提权漏洞(CVE-2019-16097)

• https://unit42.paloaltonetworks.com/critical-vulnerability-in-harbor-enables-privilege-escalation-from-zero-to-admin-cve-2019-16097/

[恶意代码]

一起针对海运业的攻击事件中的Payload分析

• https://labs.nettitude.com/blog/maritime-malware-campaigns-document-payloads/

无文件挖矿软件GhostMiner, 利用WMI对象, 杀掉其他挖矿软件的Payload

• https://blog.trendmicro.com/trendlabs-security-intelligence/fileless-cryptocurrency-miner-ghostminer-weaponizes-wmi-objects-kills-other-cryptocurrency-mining-payloads/

针对POS机的恶意软件“FrameworkPOS”

• https://www.sentinelone.com/blog/fin6-frameworkpos-point-of-sale-malware-analysis-internals/

[工具]

Sooty: 多合一SOC分析工具, 命令行, 可自动化并加速工作流程

• https://github.com/TheresAFewConors/Sooty

dolos_cloak: 使用高级的中间人攻击自动绕过802.1x解决方案

• https://github.com/fkasler/dolos_cloak

FudgeC2: C&C框架, 基于Flask/PowerShell和.NET

• https://github.com/Ziconius/FudgeC2

mihari: 与TheHive协作, 持续性监控恶意主机

• https://github.com/ninoseki/mihari

ticket_converter: 基于impacket, 将ccache tickets和kirbi (KRB-CRED)互相转换

• https://github.com/Zer1t0/ticket_converter

[其他]

电信故障：俄罗斯电信基础设施如何暴露

• https://www.upguard.com/breaches/mts-nokia-telecom-inventory-data-exposure

20190919

[技术]

Pwning Master of PHP like it's Real Real World CTF

• https://blog.bushwhackers.ru/pwning-master-of-php-like-its-real-real-world-ctf/

Nonce-based CSP + Service Worker = CSP bypass?

• https://shhnjk.blogspot.com/2019/09/nonce-based-csp-service-worker-csp.html

从Go文件中提取Type信息

• https://lekstu.ga/posts/extracting-go-types/

三个将二进制文件翻译为LLVM的工具的对比(McSema, mctoll, retdec)

• https://adalogics.com/blog/binary-to-llvm-comparison

[漏洞]

macOS 内核0Day的Exploit(CVE未分配)

• https://github.com/A2nkF/macOS-Kernel-Exploit

QEMU-KVM客户机到宿主机内核逃逸漏洞(CVE-2019-14835)

• https://www.openwall.com/lists/oss-security/2019/09/17/1

phpMyAdmin <= 4.9.0.1 CSRF 0Day(CVE-2019-12922)

• https://seclists.org/fulldisclosure/2019/Sep/23

virtualbox_3d_exp.py

• https://gist.github.com/peternguyen93/73a9558386935696086823b66a17d026

[恶意代码]

黑客组织BlackTech使用的PLEAD/TSCookie变种成功入侵大型网络

• https://blogs.jpcert.or.jp/en/2019/09/tscookie-loader.html

Linux平台挖矿软件Skidmap, 利用内核模式Rootkit躲避检测

• https://blog.trendmicro.com/trendlabs-security-intelligence/skidmap-linux-malware-uses-rootkit-capabilities-to-hide-cryptocurrency-mining-payload/

Smominru僵尸网络及其变种的攻击行动的深入分析, 着重在受害者分析和攻击的基础架构

• https://www.guardicore.com/2019/09/smominru-botnet-attack-breaches-windows-machines-using-eternalblue-exploit

Adwind远控的传奇

• https://unit42.paloaltonetworks.com/the-legend-of-adwind-a-commodity-rat-saga-in-eight-parts/

[工具]

Frida发布12.7版, 增加CModule API, 函数ObjC.choose()提速100倍

• https://frida.re/news/2019/09/18/frida-12-7-released/

SharpExcel4-DCOM: PowerShell+Cobalt Strike脚本, 通过DCOM执行Excel 4.0 / XLM宏, 实现横向渗透

• https://github.com/rvrsh3ll/SharpExcel4-DCOM
• https://github.com/outflanknl/Excel4-DCOM

expandpass: 简单的字符串扩展器, 可用于破解你有点记不清的密码

• https://github.com/Phildo/expandpass

Real-Time-Voice-Cloning: 实时声音克隆, 输入1个人的5秒钟的声音, 即可使用此人声音实时生成任意语音

• https://github.com/CorentinJ/Real-Time-Voice-Cloning
• https://arxiv.org/abs/1806.04558

Shhmon: 卸载Sysmon的驱动, 使其监控不到任何内容

• https://github.com/matterpreter/Shhmon
• https://posts.specterops.io/shhmon-silencing-sysmon-via-driver-unload-682b5be57650

Proof Pudding: 攻击ProofPoint的电子邮件评分系统, 通过窃取评分数据集(core/data/*.csv)之后创建copy-cat模型来滥用

• https://github.com/moohax/Proof-Pudding
• https://www.youtube.com/watch?v=CsvkYoxtexQ

[其他]

Akamai Wednesday宣称其近期遭受了利用UDP放大技术(WS-Discovery)的DDOS攻击, 峰值达35/GBPS

• https://blogs.akamai.com/sitr/2019/09/new-ddos-vector-observed-in-the-wild-wsd-attacks-hitting-35gbps.html

最危险的软件错误Top 25(2019)

• https://cwe.mitre.org/top25/archive/2019/2019_cwe_top25.html

20190918

[技术]

Azure AD提权: 将默认应用程序权限接管为Application Admin

• https://dirkjanm.io/azure-ad-privilege-escalation-application-admin/

服务端模板注入解析, 以Java模板引擎Pebble为例

• https://research.securitum.com/server-side-template-injection-on-the-example-of-pebble/

MacOS Spotify客户端自动化Hooking/Patching, 实现Skip追踪

• https://medium.com/swlh/skiptracing-automated-hook-resolution-74eda756533d

AWS中VPC流量监控的滥用

• https://rhinosecuritylabs.com/aws/abusing-vpc-traffic-mirroring-in-aws/

Handshake: 提供一种CA的替代方案, 分布式, 提高域名的安全性

• https://www.namebase.io/blog/meet-handshake-decentralizing-dns-to-improve-the-security-of-the-internet/
• https://github.com/handshake-org/hsd

BFS 2019 Exploitation Challenge

• https://www.synacktiv.com/posts/exploit/bfs-2019-exploitation-challenge.html

[漏洞]

某些AMD Radeon卡的ATIDXX64.DLL驱动包含RCE漏洞(CVE-2019-5049)

• https://blog.talosintelligence.com/2019/09/vuln-spotlight-AMD-Radeon-ATI-sept-19.html

Flask Jinja模板注入的RCE漏洞

• https://medium.com/@akshukatkar/rce-with-flask-jinja-template-injection-ea5d0201b870

Oracle WebLogic年初工具却由两个补丁修复的漏洞(CVE-2019-2618)

• https://www.zerodayinitiative.com/blog/2019/9/16/patch-analysis-examining-a-missing-dot-dot-in-oracle-weblogic

多家供应商的SOHO路由器和NAS设备中发现125个漏洞

• https://www.securityevaluators.com/whitepaper/sohopelessly-broken-2/

[恶意代码]

Android平台远控MobiHok RAT, 包含古老远控SpyNote RAT的代码

• https://blog.sensecy.com/2019/09/15/arabic-speaking-threat-actor-recycles-the-source-code-of-popular-rat-spynote-and-sells-it-in-the-dark-web-as-new/

[工具]

vulnerable-sso: 带漏洞的单点登录App(OAuth, Saml, Open ID Connect)

• https://github.com/dogangcr/vulnerable-sso

pdlist: 被动子域名查找器

• https://github.com/gnebbia/pdlist

halive: - http/- https探查器, 快速检查url是否存活

• https://github.com/gnebbia/halive

act-platform: 用于收集和交换威胁情报信息的开放平台

• https://github.com/mnemonic-no/act-platform

SmapTrace: Windbg插件, 快速检测Windows内核中的double fetch漏洞

• https://github.com/intelstormteam/Projects/tree/master/SmapTrace
• https://github.com/h2hconference/2018/blob/master/H2HC%20-%20Artem%20Shishkin%20-%20SMAPwn.pptx

ProcessMonitor: 基于Apple的新终端安全框架编写的进程监控库

• https://github.com/objective-see/ProcessMonitor
• https://objective-see.com/blog/blog_0x47.html

[其他]

银行木马GootKit的MongoDB数据库未加密暴露在公网, 数百万账户存在安全风险

• https://securitydiscovery.com/banking-trojan-database-exposed-millions-of-users-at-risk/

20190917

[技术]

(CTF)Dezhou Instrumentz Writeup

• https://gist.github.com/saelo/f6e3abd0faa5447ab52f9d34efa93a4d

Real World CTF 2019 Accessible Write-upG

• https://mem2019.github.io/jekyll/update/2019/09/16/Real-World-2019-Accessible.html

Investigating ARM Cortex® M33 core with TrustZone® – Using the Pins Config Tool

• https://mcuoneclipse.com/2019/09/16/investigating-arm-cortex-m33-core-with-trustzone-using-the-pins-config-tool/

检测进程重镜像行为

• https://posts.specterops.io/you-can-run-but-you-cant-hide-detecting-process-reimaging-behavior-e6bb9a10c40b

服务端模板注入解析

• https://0x00sec.org/t/explaining-server-side-template-injections/16297

iOS 12.4.1越狱

• https://www.youtube.com/watch?v=TwDk64yzQJc

[漏洞]

文件管理App ES-file严重漏洞, 不安全的FTP Activity执行可导致认证绕过(CVE-2019–11380)

• https://medium.com/@bhaveshthakur2015/cve-2019-11380-how-i-was-able-to-access-complete-storage-of-es-fileexplorer-end-user-9bd8da5ac3b8

lastpass, 绕过do_popupregister()可泄漏用户在上一个网站(tab)的凭据

• https://bugs.chromium.org/p/project-zero/issues/detail?id=1930

[恶意代码]

黑客冒充合法企业, 欺骗证书颁发机构获取证书后在黑市出售

• https://blog.reversinglabs.com/blog/digital-certificates-impersonated-executives-as-certificate-identity-fronts

[工具]

eBPF-for-Ghidra: Ghidra插件, 使Ghidra支持eBPF架构

• https://github.com/Nalen98/eBPF-for-Ghidra

deREferencing: IDA插件, 使用IDA调试时的栈和寄存器窗口更加友好

• https://github.com/danigargu/deREferencing

ProcessReimaging: 进程重镜像(reimaging)技巧

• https://github.com/djhohnstein/ProcessReimaging
• https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/in-ntdll-i-trust-process-reimaging-and-endpoint-security-solution-bypass/

ConPtyShell: 交互式反向Shell(针对Windows系统)

• https://github.com/antonioCoco/ConPtyShell

SVD-Loader-Ghidra: Ghidra插件, 解析SVD文件, 自动为650多种不同的微控制器处理整个外围结构和存储器映射, 简化ARM固件逆向

• https://github.com/leveldown-security/SVD-Loader-Ghidra
• https://leveldown.de/blog/svd-loader/

kubesec: Kubernetes资源安全威胁分析

• https://github.com/controlplaneio/kubesec

RedPeanut: .NET编写的简易远控

• https://github.com/b4rtik/RedPeanut

PeFixup: PE文件感染/修改工具, 可修改PE文件的多项属性

• https://github.com/obscuritylabs/PeFixup

MiniDump: 功能与procdump相同

• https://github.com/Mr-Un1k0d3r/MiniDump

DeviceMon: Windows驱动, 拦截/监控PCI设备和内核驱动的通信

• https://github.com/Kelvinhack/DeviceMon

20190916

[技术]

基于LLVM的软件反混淆框架

• https://arxiv.org/abs/1909.01752

Hack The Box: Luke

• https://khaoticdev.net/?p=557

Moo模拟器探秘

• https://www.synacktiv.com/ressources/sf30_r2con.pdf

使用TCP握手包实现C&C通信

• https://thesw4rm.gitlab.io/nfqueue_c2/2019/09/15/Command-and-Control-via-TCP-Handshake/

Android平台游戏HackEx逆向

• https://0x00sec.org/t/reversing-hackex-an-android-game/16243

利用TCP和IPV6数据包中的"Tokenized"字段阻止DDoS攻击

• https://medium.com/@sean.greathouse/a-blueprint-for-stopping-ddos-attacks-forever-using-tokenized-fields-in-tcp-or-ipv6-packets-b1de90682f1e

SSH证书与SSH安全

• https://smallstep.com/blog/use-ssh-certificates/

使用TensorFlow /机器学习进行自动RF旁道攻击分类

• https://leveldown.de/blog/tensorflow-sidechannel-analysis/

[漏洞]

2个无效的Instagram账户可远程使任意Instagram App崩溃(Android)

• https://medium.com/bugbountywriteup/how-two-dead-users-allowed-remote-crash-of-any-instagram-android-user-8f20e88b1b59

Adobe Acrobat Reader / Pro DC 近期修复漏洞(CVE-2019-8014)的深入分析(对此漏洞的修复正好绕过了6年前修复的漏洞CVE-2013-2729)

• https://xlab.tencent.com/en/2019/09/12/deep-analysis-of-cve-2019-8014/

在iOS 13发布前一周, 研究人员就公布了passcode绕过漏洞

• https://securityaffairs.co/wordpress/91240/hacking/passcode-bypass-bug-ios-13.html

某App在将上传文件存储到Amazon S3之前, 临时存储文件2秒, 此竟态条件(Race Condition)可导致RCE

• https://medium.com/@YoKoKho/race-condition-that-could-result-to-rce-a-story-with-an-app-that-temporary-stored-an-uploaded-9a4065368ba3

[恶意代码]

InnfiRAT远控, 窃取加密货币钱包

• https://www.zscaler.com/blogs/research/innfirat-new-rat-aiming-your-cryptocurrency-and-more

[工具]

PDBDumpWV: PDB信息提取工具

• https://github.com/zeroKilo/PDBDumpWV
• https://www.youtube.com/watch?v=St7pEx05mKs

XEXLoaderWV: Ghidra Loader, 加载X360 XEX文件

• https://github.com/zeroKilo/XEXLoaderWV
• https://www.youtube.com/watch?v=dBoofGgraKM

pixload: 创建Payload并注入图片

• https://github.com/chinarulezzz/pixload

requests-racer: 辅助检测/利用Web App种的竟态(race condition)漏洞

• https://github.com/nccgroup/requests-racer
• https://www.nccgroup.trust/us/our-research/requests-racer-a-python-library-for-exploiting-concurrency-related-vulnerabilities-in-web-applications/

CURRYFINGER: 通过SNI & Host header欺骗获取CDN后服务器的真实IP

• https://github.com/tbiehn/CURRYFINGER
• https://dualuse.io/blog/curryfinger/

VyAPI: 基于云的 vulnerable hybrid Android App

• https://github.com/appsecco/VyAPI

SharpSniper: 在Active Directory中依靠用户名和IP地址查找用户

• https://github.com/HunnicCyber/SharpSniper

stegify: 隐写术工具, 在图片中隐藏任意文件

• https://github.com/DimitarPetrov/stegify

postshell: 后渗透Shell, 包含绑定和回连Shell

• https://github.com/rek7/postshell

TinkererShell: 简单的反向Shell

• https://github.com/4n4nk3/TinkererShell

DetExploit: Windows平台软件漏洞和未安装补丁扫描

• https://github.com/detexploit/DetExploit

20190912

[技术]

Win10中引入的Execution Aliases概述

• https://tyranidslair.blogspot.com/2019/09/overview-of-windows-execution-aliases.html

OWASP 清单系列

• https://cheatsheetseries.owasp.org/

MacOS Red Teaming 208: macOS ATT&CK Techniques

• https://lockboxx.blogspot.com/2019/09/macos-red-teaming-208-macos-att.html

Hypber-V内存深入解析之: 客户机内存访问

• https://hvinternals.blogspot.com/2019/09/hyper-v-memory-internals-guest-os-memory-access.html

攻击Hyper-V VM Worker Process

• https://msrc-blog.microsoft.com/2019/09/11/attacking-the-vm-worker-process/

软件保护工具Epona的混淆机制浅析

• https://blog.quarkslab.com/epona-and-the-obfuscation-paradox-transparent-for-users-a-pain-for-reversers.html

Ballot SC22: 缩短证书生命周期

• https://scotthelme.co.uk/ballot-sc22-reduce-certificate-lifetimes/

Extended Validation not so... extended? How I revoked $1,000,000 worth of EV certificates!

• https://scotthelme.co.uk/extended-validation-not-so-extended/

虚拟磁盘中的恶意代码可绕过Windows平台下杀软的检测

• https://www.bleepingcomputer.com/news/security/virtual-disk-attachments-can-bypass-gmail-and-chrome-security/

[漏洞]

libssh2 整数溢出漏洞挖掘

• https://blog.semmle.com/integer-overflow-libssh2/

Telestar Digital GmbH IoT 无线电设备的0Day, 攻击者可远程利用这些漏洞劫持系统, 无需任何用户交互

• https://securityaffairs.co/wordpress/91069/hacking/telestar-iot-radio-devices-hack.html

Libra字节码解析器的漏洞

• https://blog.openzeppelin.com/libra-vulnerability-summary/

[恶意代码]

与Ryuk相关的恶意软件窃取财务、军事和执法文件

• https://www.bleepingcomputer.com/news/security/ryuk-related-malware-steals-confidential-military-financial-files/

1万行代码的TrickBot Dropper

• https://blog.yoroi.company/research/dissecting-the-10k-lines-of-the-new-trickbot-dropper/

在针对巴西公民的钓鱼攻击中发现Astaroth木马, 以及在感染链中使用了Facebook和Youtube

• https://cofense.com/astaroth-uses-facebook-youtube-within-infection-chain/

[工具]

findrpc: IDAPython脚本, 从二进制文件中提取RPC接口/结构

• https://github.com/lucasg/findrpc

botb: 容器分析和漏洞利用工具

• https://github.com/brompwnie/botb

unicorefuzz: 使用AFL-Unicorn Fuzz内核

• https://github.com/fgsect/unicorefuzz

20190911

[技术]

水坑攻击浅析

• https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/how-visiting-a-trusted-site-could-infect-your-employees/

NetCAT: 基于网络的缓存旁路攻击实战: 利用英特尔芯片组嗅探SSH密码

• https://www.vusec.net/projects/netcat/

绕过LinkedIn搜索API的次数限制

• https://habr.com/en/post/466801/

谷歌日历中1个疑似SSRF漏洞的"密罐"

• https://www.komodosec.com/post/an-accidental-ssrf-honeypot-in-google-calendar

[漏洞]

BLIS认证漏洞(CVE-2019-5617, CVE-2019-5643, CVE-2019-5644)

• https://blog.rapid7.com/2019/09/10/r7-2019-09-cve-2019-5617-cve-2019-5643-cve-2019-5644-c4g-blis-authentication-and-authorization-vulnerabilities-fixed/

Windows LNK文件导致RCE的漏洞(CVE-2019-1280)

• https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2019-1280

Palo Alto GlobalProtect预认证RCE漏洞(CVE-2019-1579), Part2

• https://www.securifera.com/blog/2019/09/10/preauth-rce-on-palo-alto-globalprotect-part-ii-cve-2019-1579/

基于GPS的儿童追踪器包含多个漏洞, 影响60W设备

• https://decoded.avast.io/martinhron/the-secret-life-of-gps-trackers/

Comba和D-Link路由器的多个漏洞

• https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/multiple-vulnerabilities-in-comba-and-d-link-routers/

我们是如何发现Netflix DIAL软件的漏洞的

• https://blog.forallsecure.com/forallsecure-uncovers-vulnerability-in-netflix-dial-software

Another Local Privilege Escalation Vulnerability Using Process Creation Impersonation

• https://www.fortinet.com/blog/threat-research/another-local-privilege-escalation-lpe-vulnerability.html

[恶意代码]

针对美国制造行业的垃圾邮件活动, 传播LokiBot和窃密软件

• https://www.fortinet.com/blog/threat-research/new-infostealer-attack-uses-lokibot.html

[工具]

RECON: 信息收集自动化工具, 可用于CTF

• https://github.com/gotr00t0day/RECON

BinRida: Binary Ninja插件, 可在Binary Ninja中使用Firda的Interceptor

• https://github.com/bowline90/BinRida

QDBI更新7.0版, 以及使用QDBI脱腾讯App的壳(Android)(QDBI: 基于LLVM的动态二进制插桩框架)

• https://blog.quarkslab.com/qbdi-070.html

[其他]

TheNTInsiders, 2019年9-10月刊

• https://www.osr.com/nt-insider/2019-issue1/

揭秘地下网络犯罪中的物联网威胁

• https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/the-internet-of-things-in-the-cybercrime-underground

20190910

[技术]

关于Mitre ATT&CK, 你需要知道的一切

• https://hakin9.org/mitre-attck-framework-everything-you-need-to-know/

Hack the Box (HTB) machines walkthrough series — Waldo

• https://resources.infosecinstitute.com/hack-the-box-htb-walkthrough-waldo/

恶意代码沙箱逃逸技巧的进化

• https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/evolution-of-malware-sandbox-evasion-tactics-a-retrospective-study/

Taskbar Latency and Kernel Calls

• https://randomascii.wordpress.com/2019/09/08/taskbar-latency-and-kernel-calls/

一种有效地将新二进制文件中的函数与大型函数数据库进行比较的有效方法

• https://blog.quarkslab.com/weisfeiler-lehman-graph-kernel-for-binary-function-analysis.html

利用JSONP, 从API终端提取私有数据, 绕过服务器的安全检查

• https://medium.com/bugbountywriteup/exploiting-jsonp-and-bypassing-referer-check-2d6e40dfa24

[漏洞]

近期Chrome 1Day的发现、分析与利用

• https://blog.exodusintel.com/2019/09/09/patch-gapping-chrome/

Dabman & Imperial (i&d)多个漏洞

• https://www.vulnerability-lab.com/get_content.php?id=2183

某些NETGEAR路由器的DoS漏洞

• https://blog.talosintelligence.com/2019/09/vuln-spotlight-Netgear-N300-routers-DoS-sept-2019.html

[恶意代码]

无文件恶意代码Purple Fox, 使用Rootkit组件, 滥用PowerShell

• https://blog.trendmicro.com/trendlabs-security-intelligence/purple-fox-fileless-malware-with-rookit-component-delivered-by-rig-exploit-kit-now-abuses-powershell/

7种常见的应用程序后门

• https://resources.infosecinstitute.com/7-most-common-application-backdoors/

APT组织Patchwork的恶意代码分析

• https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Indian/APT/Patchwork/27-08-19/Malware%20analysis%2027-08-19.md

黑客组织Stealth Falcon在攻击中使用新的后门, 使用Windows BITS服务隐蔽的窃取数据

• https://www.welivesecurity.com/2019/09/09/backdoor-stealth-falcon-group/

[工具]

stringsifter: 一种机器学习工具，可根据与恶意软件分析的相关性自动对字符串进行排名。

• https://github.com/fireeye/stringsifter
• https://www.fireeye.com/blog/threat-research/2019/09/open-sourcing-stringsifter.html

ActiveReign: 网络枚举和攻击工具包

• https://github.com/m8r0wn/ActiveReign

revshellgen: Python编写的反向Shell生成器

• https://github.com/t0thkr1s/revshellgen

[其他]

认知攻击循环和网络犯罪行为的三个阶段

• https://www.carbonblack.com/resources/threat-research/cognitions-of-a-cybercriminal/

20190909

[技术]

编写并扩展JS代码混淆工具

• https://antoinevastel.com/javascript/2019/09/09/improving-obfuscator.html

使用Ghidra反编译X360 XEX文件

• https://youtu.be/coGz0f7hHTM

通过- http cache cross-site leaks进行Web追踪(Chrome/Firefox默认配置)

• https://polict.net/blog/web-tracking-via-- http-cache-xs-leaks/

Bastion — HackTheBox Writeup

• https://medium.com/bugbountywriteup/bastion-hackthebox-writeup-3c57d89476e4
• https://rizemon.github.io/hackthebox/smb/mremoteng/windows/ssh/2019/09/07/bastion-htb.html
• https://mzfr.github.io/HackTheBox-writeups/Bastion/
• https://khaoticdev.net/?p=564

BlueKeep漏洞的MSF利用模块(CVE-2019-0708)

• https://blog.rapid7.com/2019/09/06/initial-metasploit-exploit-module-for-bluekeep-cve-2019-0708/

CSRF is (really) dead

• https://scotthelme.co.uk/csrf-is-really-dead/

Write up of two - http Requests Smuggling

• https://medium.com/@cc1h2e1/write-up-of-two-- http-requests-smuggling-ff211656fe7d

EXE sideloading技巧

• https://medium.com/@reegun/microsoft-teams-exe-sideloading-aka-exe-proxying-part-1-b868d5459349
• https://www.youtube.com/watch?v=3aZM0Rfjgy4

Trendmicro CTF ChakraCore exploit

• https://gist.github.com/itszn/3277e8aa56c91f8296d88d25d96df717

Android智能手机加固

• https://medium.com/p/32b28ae3fbd8

[漏洞]

如果Exim接受TLS连接, 可导致攻击者以Root权限执行命令(CVE-2019-15846). 与TLS库无关, 影响GnuTLS和OpenSSL

• https://exim.org/static/doc/security/CVE-2019-15846.txt

[工具]

UEFI_RETool: 用于UEFI固件分析的IDA插件

• https://github.com/yeggor/UEFI_RETool
• https://yeggor.github.io/UEFI_RETool/

r2ghidra-dec: 将Ghidra反编译器深度集成到Radare2

• https://github.com/radareorg/r2ghidra-dec

shhgit: 在Github近期提交的代码中查找敏感信息

• https://github.com/eth0izzle/shhgit

LetsMapYourNetwork: 物理网络可视化工具

• https://github.com/varchashva/LetsMapYourNetwork

20190906

[技术]

探索AMSI的有趣经历

• https://medium.com/@byte_St0rm/adventures-in-the-wonderful-world-of-amsi-25d235eb749c

数据压缩安全问题的简单分析

• https://sidechannel.tempestsi.com/a-brief-analysis-of-data-compression-security-issues-2d6368782e31

使用TensorFlow /机器学习进行自动RF侧通道攻击分类

• https://leveldown.de/blog/tensorflow-sidechannel-analysis/

Chrome添加的新HTML元素的安全性分析

• https://research.securitum.com/security-analysis-of-portal-element/

TokyoWesterns CTF 2019 - gnote

• https://rpis.ec/blog/tokyowesterns-2019-gnote/

TokyoWesterns CTF 5th 2019 WriteUp

• https://r3kapig.com/writeup/20190904-tokyowesterns/

[漏洞]

DASAN Zhone ZNID Web接口的多个XSS漏洞(CVE-2019-10677)

• https://blog.redteam.pl/2019/09/cve-2019-10677-dasan-zhone-znid.html

MS Edge 通用 XSS

• https://leucosite.com/Microsoft-Edge-uXSS/?q

Samba漏洞: 参数和权限的组合可以允许用户从共享路径定义中逃脱(CVE-2019-10197), 影响Samba 4.9.0之后的所有版本

• https://www.samba.org/samba/security/CVE-2019-10197.html

Pulse Secure Connect RCE 漏洞PoX(CVE-2019-11539)

• https://github.com/0xDezzy/CVE-2019-11539

[恶意代码]

垃圾邮件活动利用PHP函数实现驻留

• https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abuses-php-functions-for-persistence-uses-compromised-devices-for-evasion-and-intrusion/

银行木马Gootkit分析, Part3: 最终Payload

• https://www.sentinelone.com/blog/gootkit-banking-trojan-retrieving-final-payload/

某未知以色列APT活动的恶意软件分析

• https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Israel/APT/Unknown/26-08-19/Malware%20analysis%2026-08-19.md

[工具]

GhIDA: IDA插件, 向IDA中集成Ghidra反编译器

• https://github.com/Cisco-Talos/GhIDA

Ghidraaas: Web服务器, 使用 REST API向外提供Ghidra分析服务

• https://github.com/Cisco-Talos/Ghidraaas
• https://blog.talosintelligence.com/2019/09/ghida.html

btlejack: 操作低功耗蓝牙设备的瑞士军刀

• https://github.com/virtualabs/btlejack

Sandokan: 基于NetBSD的渗透测试系统

• https://astr0baby.wordpress.com/2019/09/04/sandokan-netbsd-based-penetration-testers-system/

PyFuscation: 通过替换函数名、变量和参数, 混淆PowerShell脚本

• https://github.com/CBHue/PyFuscation

[其他]

2019年国家互联网细分可靠性研究与报告

• https://habr.com/en/company/qrator/blog/466287/

20190905

[技术]

Apple TV取证, Part3: 分析

• https://blog.elcomsoft.com/2019/09/apple-tv-forensics-03-analysis/

Kubernetes安全笔记与最佳实战

• https://github.com/kabachook/k8s-security

Windows日志, Sysmon 与 ELK

• https://youtu.be/FeCSJBKYFBQ

(CTF)pwning your kernelz

• https://trungnguyen1909.github.io/blog/post/CampCTF/PwningKernelz/

攻击Pulse Secure SSL VPN的指南

• https://medium.com/bugbountywriteup/pulse-secure-ssl-vpn-post-auth-rce-to-ssh-shell-2b497d35c35b

操作游戏内部的Lua虚拟机, 以ROBLOX客户端为例

• https://openpunk.com/post/2

近期一个Linux LTS Spectre失败的补丁的深入分析

• https://grsecurity.net/teardown_of_a_failed_linux_lts_spectre_fix.php

针对现代Android智能手机的高级短信网络钓鱼攻击

• https://research.checkpoint.com/advanced-sms-phishing-attacks-against-modern-android-based-smartphones/

macOS事件响应, Part3: 系统操作

• https://www.sentinelone.com/blog/macos-incident-response-part-3-system-manipulation/

[漏洞]

Chrome XSS Auditor存在多个安全问题, Chrome研发人员决定弃用

• https://www.netsparker.com/blog/web-security/goodbye-xss-auditor/

Aruba Mobility Controller (ArubaOS) RCE漏洞(CVE-2018-7081)

• https://x-c3ll.github.io//posts/CVE-2018-7081-RCE-ArubaOS/

Qualcomm Atheros WLAN 驱动程序服务(QcomWlanSrvx64.exe)内核驱动Write-What-Where漏洞

• https://medium.com/tenable-techblog/kernel-write-what-where-in-qualcomm-driver-lpe-f08389f6fce9

多个Zyxel设备的多个漏洞, 包括硬编码凭证, 以及可因未授权DNS请求被黑的漏洞等

• https://securityaffairs.co/wordpress/90801/hacking/zyxel-products-flaws.html

[恶意代码]

恶意软件Winnti 4.0分析

• https://www.carbonblack.com/2019/09/04/cb-tau-threat-intelligence-notification-winnti-malware-4-0/

Glupteba Campaign Hits Network Routers and Updates C&C Servers with Data from Bitcoin Transactions

• https://blog.trendmicro.com/trendlabs-security-intelligence/glupteba-campaign-hits-network-routers-and-updates-cc-servers-with-data-from-bitcoin-transactions/

论坛售卖的窃密软件Krypton

• https://securityboulevard.com/2019/09/krypton-stealer-kryptonite-for-credentials/

分析谷歌商店发现的间谍软件Joker

• https://medium.com/csis-techblog/analysis-of-joker-a-spy-premium-subscription-bot-on-googleplay-9ad24f044451

[工具]

单元测试框架DeepState添加Ensemble Fuzzing功能

• https://blog.trailofbits.com/2019/09/03/deepstate-now-supports-ensemble-fuzzing/

gitGraber: 实时监控Github并查找敏感信息

• https://github.com/hisxo/gitGraber

dfex: 利用DNS协议进行文件渗透

• https://github.com/ekiojp/dfex

20190904

[技术]

分析最近发现的1个攻击Web App的漏洞利用链(SNMP>XSS>RCE)

• https://www.offensive-security.com/offsec/analyzing-a-creative-attack-chain/

TP-Link TL-WR841N无线路由器逆向

• https://www.zerodayinitiative.com/blog/2019/9/2/mindshare-hardware-reversing-with-the-tp-link-tl-wr841n-router

Ghidra入门教程

• https://youtu.be/Cgukr7v9eg0

使用UART Hack硬件

• https://www.blackhillsinfosec.com/how-to-hack-hardware-using-uart/

一种使用深度学习检测恶意PowerShell的新方法

• https://www.microsoft.com/security/blog/2019/09/03/deep-learning-rises-new-methods-for-detecting-malicious-powershell/

最近发现的1个被黑的网站, 使用社工工具在过去几周内吸引了10万次访问

• https://blog.malwarebytes.com/cybercrime/social-engineering-cybercrime/2019/09/new-social-engineering-toolkit-draws-inspiration-from-previous-web-campaigns/

SQL注入攻击之: Blind SQLi Boolean Based

• https://medium.com/@chawdamrunal/when-i-found-boolean-based-sql-injection-c82e66ca2634

(TokyoWesterns CTF 2019)Multi Heap

• https://github.com/hama7230/multi-heap

绕过基于机器学习的恶意代码分类

• https://medium.com/@william.fleshman/evading-machine-learning-malware-classifiers-ce52dabdb713

[漏洞]

分析最近影响多个- http/2实现的DoS漏洞

• https://randywestergren.com/a-closer-look-at-recent-- http-2-vulnerabilities-affecting-k8s-and-other-implementations/

Bitbucket 6.1.1路径回溯到RCE

• https://blog.ripstech.com/2019/bitbucket-path-traversal-to-rce/

USBAnywhere漏洞: 超微(Supermicro)服务器BMC面板(baseboard management controller)的漏洞, 可允许攻击者轻松连接到服务器, 并通过任何网络（包括Internet）远程将其选择的任何USB设备Mount到服务器上

• https://eclypsium.com/2019/09/03/usbanywhere-bmc-vulnerability-opens-servers-to-remote-attack/
• https://github.com/eclypsium/USBAnywhere

[恶意代码]

反混淆34000行的JS下载者Ostap

• https://www.bromium.com/deobfuscating-ostap-trickbots-javascript-downloader/

[工具]

ehtools: WiFi渗透框架

• https://github.com/entynetproject/ehtools

Wordlister: Wordlist生成和管理工具

• https://github.com/4n4nk3/Wordlister

SharPersist: Windows驻留工具包, C#编写

• https://github.com/fireeye/SharPersist
• https://www.fireeye.com/blog/threat-research/2019/09/sharpersist-windows-persistence-toolkit.html

20190903

[技术]

恶意代码分析中一直被忽视的虚拟内存分析

• http://dreamofareverseengineer.blogspot.com/2019/09/virtual-memory-analysis-overlooked-part.html

利用AWS Lambdas的漏洞实现驻留

• https://www.twistlock.com/labs-blog/gaining-persistency-vulnerable-lambdas/

攻击SSL VPN, Part3: Golden Pulse VPN RCE链, 用Twitter做示例

• https://blog.orange.tw/2019/09/attacking-ssl-vpn-part-3-golden-pulse-secure-rce-chain.html

资产枚举: 扩展目标的攻击面

• https://captmeelo.com/bugbounty/2019/09/02/asset-enumeration.html

攻击Jenkins服务器的笔记

• https://github.com/gquere/pwn_jenkins

如何构建内部的Red Team

• https://medium.com/@prsecurity_/how-to-build-an-internal-red-team-7957ec644695

使用LLVM和Epona混淆Java字节码

• https://blog.quarkslab.com/obfuscating-java-bytecode-with-llvm-and-epona.html

SMT Solvers Z3 介绍, 以及在WebApp安全中的应用

• https://alephsecurity.com/2019/09/02/Z3-for-webapp-security/

[漏洞]

使用fault注入可以在物理上破坏ESP32 CPU, 绕过安全启动/证书验证

• https://www.espressif.com/en/news/Espressif_Security_Advisory_Concerning_Fault_Injection_and_Secure_Boot

Bluekeep漏洞利用(CVE-2019-0708)

• https://blog.firosolutions.com/exploits/bluekeep/

SharePoint RCE漏洞, 可绕过工作流保护机制

• https://www.nccgroup.trust/uk/our-research/technical-advisory-bypassing-workflows-protection-mechanisms-remote-code-execution-on-sharepoint/

HTML to PDF converter bug leads to RCE in Facebook server.

• https://ysamm.com/?p=280

[恶意代码]

XMR挖矿软件, 之前攻击ARM IoT设备, 现在转为攻击X86/I686 Intel服务器

• https://blogs.akamai.com/sitr/2019/08/xmr-cryptomining-targeting-x86i686-systems.html

Forbix蠕虫分析

• https://persianov.net/windows-worms-forbix-worm-analysis

Astaroth背后的黑客组织使用Cloudflare Workers绕过安全解决方案

• https://medium.com/@marcelx/threat-actor-behind-astaroth-is-now-using-cloudflare-workers-to-bypass-your-security-solutions-2c658d08f4c

[工具]

DebugAutoPatch: IDA插件, 自动将打补丁的字节应用的被调试文件

• https://github.com/scottmudge/DebugAutoPatch

ghidra-firmware-utils: Ghidra插件, 辅助分析PC固件

• https://github.com/al3xtjames/ghidra-firmware-utils
• https://blogs.coreboot.org/blog/2019/08/22/gsoc-ghidra-firmware-utilities-wrap-up/

wip-devilutiondroid: Android版大菠萝逆向

• https://github.com/Jimmy-cell/wip-devilutiondroid

fennec: 可编写函数替换任意x86-64 ELF二进制文件中的函数

• https://github.com/trailofbits/fennec
• https://blog.trailofbits.com/2019/09/02/rewriting-functions-in-compiled-binaries/

C3: 自定义C&C框架, 可与现有工具集成

• https://github.com/mwrlabs/C3
• https://labs.mwrinfosecurity.com/tools/c3

barq: AWS Cloud Post Exploitation框架

• https://github.com/Voulnet/barq

Telegra_Csharp_C2: 用于Telegram Bot通信的C&C工具

• https://github.com/sf197/Telegra_Csharp_C2

20190902

[技术]

使用Ghidra反编译N64 ROM

• https://www.youtube.com/watch?v=3d3a39LuCwc

使用不带引号的服务路径(Unquoted Service Paths)创建服务, 实现隐蔽驻留的技巧

• https://blog.christophetd.fr/stealthier-persistence-using-new-services-purposely-vulnerable-to-path-interception/

Hack The Box - OneTwoSeven Write-up

• https://blog.chadp.me/posts/htb-onetwoseven
• https://epi052.gitlab.io/notes-to-self/blog/2019-08-25-hack-the-box-onetwoseven/

易配置的网络数据包深度分析工具LogRhythm NetMon

• https://www.trenchesofit.com/2019/09/01/logrhythm-network-forensics-at-home/

在Kubernetes集群上进行DNS欺骗

• https://blog.aquasec.com/dns-spoofing-kubernetes-clusters

分析常见的身份认证协议: OpenID Connect vs OAuth 2.0 vs SAML 2.0

• https://blog.hackedu.io/analysis-of-common-federated-identity-protocols/

检查Android App中的加密选项

• https://carvesystems.com/news/android-hard-coded-secrets/

MiniDumpWriteDump via COM+ Services DLL

• https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/

[漏洞]

Windows BlueKeep漏洞利用(CVE-2019-0708): 无需RDP PDU即可向内存写入数据的3种方式

• https://unit42.paloaltonetworks.com/exploitation-of-windows-cve-2019-0708-bluekeep-three-ways-to-write-data-into-the-kernel-with-rdp-pdu/

Webmin 1.920 RCE

• https://github.com/jamesbercegay/advisories/blob/master/%5BGTSA-00130%5D%20Webmin%201.920%20Remote%20Code%20Execution.txt

近期披露的Jenkins插件的信息泄漏漏洞

• https://blog.trendmicro.com/trendlabs-security-intelligence/hiding-in-plain-text-jenkins-plugin-vulnerabilities/

iOS/OSX漏洞的分析与重现(CVE-2019-7286)

• https://blog.zecops.com/vulnerabilities/analysis-and-reproduction-of-cve-2019-7286/

More on FreeBSD Refcount Overflows

• https://secfault-security.com/blog/FreeBSD-SA-1924.mqueuefs.html

[恶意代码]

针对巴西用户的Android平台远控BRATA

• https://securelist.com/spying-android-rat-from-brazil-brata/92775/

[工具]

safeside: 辅助理解与缓解software-observable side-channels

• https://github.com/google/safeside

printer-telnet-ftp-report: 查找启用了telnet/ftp服务的打印机

• https://github.com/thom-s/netsec-ps-scripts/tree/master/printer-telnet-ftp-report

• http-request-smuggler: Burp插件, 辅助执行- http Smuggling攻击

• https://github.com/PortSwigger/- http-request-smuggler

B-XSSRF: 检测并追踪Blind XSS, XXE & SSRF

• https://github.com/SpiderMate/B-XSSRF

hashcatch: 自动捕捉附近Wifi网络的握手包

• https://github.com/staz0t/hashcatch

constellation: 数据可视化与交互式分析App

• https://github.com/constellation-app/constellation

burp-scope-monitor: Burp插件, 监控与追踪新的scope

• https://github.com/Regala/burp-scope-monitor

20190830

[技术]

使用Binary Ninja进行反向污点分析

• https://blog.trailofbits.com/2019/08/29/reverse-taint-analysis-using-binary-ninja/

Westwild: 2 Vulnhub Walkthrough

• https://www.hackingarticles.in/westwild-2-vulnhub-walkthrough/

macOS事件响应, Part2: 用户数据、活动和行为

• https://www.sentinelone.com/blog/macos-incident-response-part-2-user-data-activity-and-behavior/

劫持COM对象时发生了什么, 以及如何为原本的COM服务器添加代理, 避免被注入进程崩溃

• https://adapt-and-attack.com/2019/08/29/proxying-com-for-stable-hijacks/

使用Burp的会话处理规则将授权cookie插入Intruder，Repeater甚至sqlmap

• https://blog.nviso.be/2019/08/29/using-burps-session-handling-rules-to-insert-authorization-cookies-into-intruderrepeater-and-even-sqlmap/

使用树莓派4构建Ethical Hacking平台

• https://cyberarms.wordpress.com/2019/08/29/pi-4-hacking-platform-using-dietpi-and-ptf/

如何从iPhone中提取并解密Signal对话历史

• https://blog.elcomsoft.com/2019/08/how-to-extract-and-decrypt-signal-conversation-history-from-the-iphone/

如何执行全面的Linux内核模块安全测试

• https://www.apriorit.com/dev-blog/634-qa-how-to-perform-comprehensive-linux-kernel-module-security-testing

[漏洞]

在野发现的iOS漏洞利用链超详细分析(系列文章)(ProjectZero)

• https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html

Avira Optimizer本地提权漏洞

• https://enigma0x3.net/2019/08/29/avira-optimizer-local-privilege-escalation/

利用CVE-2019–15055 Root RouterOS

• https://medium.com/tenable-techblog/rooting-routeros-with-a-usb-drive-16d7b8665f90

[恶意代码]

Heatstroke攻击行动: 使用多阶段钓鱼攻击窃取PayPal和信用卡信息

• https://blog.trendmicro.com/trendlabs-security-intelligence/heatstroke-campaign-uses-multistage-phishing-attack-to-steal-paypal-and-credit-card-information/

TrickBot向美国移动运营商网站注入代码, 窃取用户PIN码

• https://www.secureworks.com/blog/trickbot-modifications-target-us-mobile-users

谷歌商店2款下载超150万的App含有隐蔽的广告点击功能

• https://www.symantec.com/blogs/threat-intelligence/stealthy-ad-clicking-apps-google-play

TimThumb Attacks: The Scale of Legacy Malware Infections

• https://blog.sucuri.net/2019/08/timthumb-attacks-the-scale-of-legacy-malware-infections.html

[工具]

Sudomy: 子域名枚举与分析工具

• https://github.com/Screetsec/Sudomy

[其他]

KCon 2019 PPT

• https://github.com/knownsec/KCon/tree/master/2019

2018事件响应报告

• https://securelist.com/incident-response-analytics-report-2018/92732/

20190829

[技术]

在Linux内核中搜索漏洞模式

• http://blog.ptsecurity.com/2019/08/case-study-searching-for-vulnerability.html

使用GOT投毒技巧, 实现ELF64运行时感染的PoC

• https://github.com/En14c/Erebus

对一个知名的数字货币服务发动远程攻击, 证明盲从Web标准的危害

• https://blog.ret2.io/2019/08/28/sia-coin-dns-rebinding/

Analysis of Survival Password Genetics

• https://www.netmux.com/blog/survivor-password-hashes

从Windows注册表中提取证书

• https://blog.nviso.be/2019/08/28/extracting-certificates-from-the-windows-registry/

使用LDAP搜索过滤器, 狩猎侦查活动

• https://techcommunity.microsoft.com/t5/Microsoft-Defender-ATP/Hunting-for-reconnaissance-activities-using-LDAP-search-filters/ba-p/824726

对主流手机射频辐射的调查

• https://www.chicagotribune.com/investigations/ct-cell-phone-radiation-testing-20190821-72qgu4nzlfda5kyuhteiieh4da-story.html

[漏洞]

分析Jet数据库引擎漏洞补丁(CVE-2018-8423)

• https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/analyzing-and-identifying-issues-with-the-microsoft-patch-for-cve-2018-8423/

思科多款产品的多个严重漏洞(Cisco UCS Director, Cisco Integrated Management Controller Supervisor, Cisco UCS Director Express for Big Data)

• https://raw.githubusercontent.com/pedrib/PoC/master/advisories/cisco-ucs-rce.txt

Kubernetes容器漏洞的严重性(CVE-2019-11245)

• https://www.twistlock.com/labs-blog/non-root-containers-kubernetes-cve-2019-11245-care/

Cross-Site Request Forgery (CSRF)/Settings Change Vulnerability in Customize Feeds for Twitter

• https://www.pluginvulnerabilities.com/2019/08/28/cross-site-request-forgery-csrf-settings-change-vulnerability-in-customize-feeds-for-twitter/

Wordpress插件Blog2Social PHP对象注入漏洞

• https://www.pluginvulnerabilities.com/2019/08/28/our-proactive-monitoring-caught-an-authenticated-php-object-injection-vulnerability-being-introduced-in-to-blog2social-social-media-auto-post-scheduler/

[恶意代码]

Ratatouille远控

• https://blog.talosintelligence.com/2019/08/rat-ratatouille-revrat-orcus.html

疑似Gorgon黑客组织在肯尼亚和印度的网络钓鱼活动

• https://blog.360totalsecurity.com/en/fishing-activities-in-kenya-and-india-by-suspected-gorgon-hacking-organization/

在拉丁美洲传播的Retadup蠕虫

• https://decoded.avast.io/janvojtesek/putting-an-end-to-retadup-a-malicious-worm-that-infected-hundreds-of-thousands/

利用ADB传播的僵尸网络ARES

• https://www.wootcloud.com/blogs/ars_botnet.html

[工具]

psalm: PHP代码静态分析工具, 查找代码错误

• https://github.com/vimeo/psalm
• https://psalm.dev/

nebulousAD: 自动化凭证审计工具

• https://github.com/NuID/nebulousAD

[其他]

2019年第2季度垃圾邮件和钓鱼报告

• https://securelist.com/spam-and-phishing-in-q2-2019/92379/

20190828

[技术]

Synthetic类型, 以及使用WinDbg追踪系统调用call

• https://lowleveldesign.org/2019/08/27/synthetic-types-and-tracing-syscalls-in-windbg/

Windows进程注入: APC

• https://modexp.wordpress.com/2019/08/27/process-injection-apc/

Burp Suite Tips, Part1

• https://medium.com/@ryan.wendel/- https-medium-com-ryan-wendel-burp-suite-tips-volume-1-3a37f49f8931

JTAG: 微控制器调试

• https://www.blackhillsinfosec.com/jtag-micro-controller-debugging/

使用C语言运行位置无关代码(无指针, 无函数)

• https://osandamalith.com/2019/08/27/running-shellcode-directly-in-c/

使用SAML和SSO Providers钓鱼

• https://jordanpotti.com/2019/08/26/phishing-with-saml-and-sso-providers/

区块链交易平台在网络安全领域中的角色

• https://medium.com/@anubhavsingh2709/the-role-of-blockchain-trading-platform-in-cybersecurity-3be8c4884359

Codefest’19 CTF Writeups

• https://medium.com/bugbountywriteup/codefest19-ctf-writeups-a8f4e9b45d1

Linux登录与加密目录

• https://easylang.online/blog/pamscr-encfs.html

Empire Was Great Again...For a Week

• https://www.bc-security.org/post/microsoft-makes-empire-great-again

调整漏洞利用框架以绕过Microsoft ATP

• https://github.com/BC-SECURITY/DEFCON27

[漏洞]

PS Vita 固件3.65-3.72 内核expolit

• https://github.com/TheOfficialFloW/h-encore-2

Facebook验证新的Gmail/G-Suite账户时的CSRF漏洞

• https://medium.com/@lokeshdlk77/csrf-email-confirmation-vulnerability-for-gmail-g-suite-in-facebook-5ab551a0a526

Check Point Endpoint终端安全客户端(Windows版)提权漏洞

• https://safebreach.com/Post/Check-Point-Endpoint-Security-Initial-Client-for-Windows-Privilege-Escalation-to-SYSTEM

[恶意代码]

谷歌商店发现的广告App, 下载量超1亿

• https://securelist.com/dropper-in-google-play/92496/

新发现的黑客组织LYCEUM, 从2018年4月份开始活跃, 近期针对中东石油和天然气公司发动攻击

• https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign

[工具]

ccat: 云容器攻击工具

• https://github.com/RhinoSecurityLabs/ccat
• https://rhinosecuritylabs.com/aws/cloud-container-attack-tool/

[其他]

全球威胁研究系列报告

• https://www.carbonblack.com/resources/threat-research/global-threat-report-series/

20190827

[技术]

使用IDA从0开始学逆向, Part20

• https://medium.com/p/adc2bad58cc3

使用Ghidra逆向Cisco IOS原始二进制固件镜像

• https://gist.github.com/nstarke/ed0aba2c882b8b3078747a567ee00520

在满补丁的Win10域主机上绕过图形接口依赖实现本地提权

• https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2019/august/kerberos-resource-based-constrained-delegation-when-an-image-change-leads-to-a-privilege-escalation/

对dalek库的安全审计

• https://blog.quarkslab.com/security-audit-of-dalek-libraries.html

使用Frida绕过Android App的SSL pinning

• https://medium.com/@ved_wayal/hail-frida-the-universal-ssl-pinning-bypass-for-android-e9e1d733d29

[漏洞]

CVE-2019-13272: Linux LPE via 'PTRACE_TRACEME'

• https://jm33.me/cve-2019-13272-linux-lpe-via-ptrace_traceme.html

CVE-2019-9358 PoC

• https://github.com/hyrathon/PoCs/tree/master/CVE-2019-9358

新发现的Instagram账户接管漏洞

• https://thezerohack.com/hack-instagram-again

Twitter VPN pre-auth RCE

• https://hackerone.com/reports/591295

[工具]

GhidraX64Dbg: 从Ghidra中提取注释, 导入到x64dbg

• https://github.com/revolver-ocelot-saa/GhidraX64Dbg

osctrl: 快速且有效的osquery管理方案

• https://github.com/jmpsec/osctrl
• https://medium.com/@javuto/introducing-osctrl-91583e3fa75d

yar: 针对Github repo/用户/组织的侦查工具

• https://github.com/Furduhlutur/yar

Chrome密码转储工具(Windows)

• https://github.com/roflsandwich/Chrome-Password-Dumper

packetStrider: SSH通信取证工具

• https://github.com/benjeems/packetStrider

keyFinder: 查找公开的或隐藏的API Key

• https://github.com/momenbasel/keyFinder
• https://medium.com/@sumitcfe/finding-hidden-api-keys-how-to-use-them-11b1e5d0f01d

medaudit: 用于审核医疗设备和医疗保健基础设施的工具

• https://github.com/anirudhduggal/medaudit

EMAGNET: 从pastebin上传的泄漏数据库中捕获电子邮件地址和密码

• https://github.com/wuseman/EMAGNET

20190826

[技术]

利用Windows文本服务框架的漏洞实现提权, 以及缓解措施

• https://blog.stealthbits.com/using-ctftool-exe-to-escalate-privileges-by-leveraging-text-services-framework-and-mitigation-processes-and-steps/

2019 DEFCON CTF Challenge -- Super Smash OOOs

• https://github.com/o-o-overflow/dc2019f-super-smash-ooos

Ghidra Loader, 加载Super Mario Bros. 3 NES ROM

• https://smb3.bf0.org/ghidra-loader/ghidra-plugin/2019-08-20-ghidra-loader/

浏览器中的Cookie怪兽

• https://speakerdeck.com/filedescriptor/the-cookie-monster-in-your-browsers

Cracking Konami M2 Encryption

• https://youtu.be/xpuLKpaIbeE

上传XAMLX文件, 利用ASP.NET反序列化漏洞获取Shell

• https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2019/august/getting-shell-with-xamlx-files/

[漏洞]

联想笔记本预装的解决方案中心软件的提权漏洞(CVE-2019-6177)

• https://www.pentestpartners.com/security-blog/privesc-in-lenovo-solution-centre-10-minutes-later/

QEMU虚拟机逃逸漏洞利用(CVE-2019-14378)

• https://blog.bi0s.in/2019/08/24/Pwn/VM-Escape/2019-07-29-qemu-vm-escape-cve-2019-14378/

[恶意代码]

反混淆JS脚本, 调查钓鱼域名

• https://www.youtube.com/watch?v=e0Dd0znmNas

使用x64dbg脱壳Remcos远控

• https://www.youtube.com/watch?v=DIH4SvKuktM

恶意软件通过移除API Hook, 躲避安全检测

• https://www.bromium.com/agent-tesla-evading-edr-by-removing-api-hooks/

TrickBot新技巧

• https://www.binarydefense.com/trickbot-ono-new-tricks/

[工具]

gtfo: 搜索可被利用的可执行文件(gtfobins/lolbas), 支持Windows和Linux

• https://github.com/mzfr/gtfo

sublert: 侦查工具, 利用certificate transparency自动监控由特定组织部署的新的子域名, 和有问题的TLS/SSL证书

• https://github.com/yassineaboukir/sublert

4CAN: 汽车安全研究工具

• https://github.com/alexdetrano/4CAN
• https://blog.talosintelligence.com/2019/08/new-4can-tool-helps-identify.html

zigdiggity: 渗透测试工具包

• https://github.com/BishopFox/zigdiggity

windbg2ida: 转储Windbg每一步的内容, 并在IDA中显示

• https://github.com/SinaKarvandi/windbg2ida
• https://windbg2ida.ntdebug.com/

wiki-dictionary-creator: 利用维基百科所有文章的标题创建wordlist

• https://github.com/ChrisAD/wiki-dictionary-creator

smalien: Andorid App信息流分析和信息泄漏检测工具

• https://github.com/h1nayoshi/smalien

dr_robot: 聚合多个开源OSINT工具的结果, 枚举指定企业的子域名

• https://github.com/sandialabs/dr_robot

pwn_debug: 辅助快速构建CTFs pwn game

• https://github.com/ray-cp/pwn_debug

20190823

[技术]

会话劫持攻击简介

• https://www.netsparker.com/blog/web-security/session-hijacking/

(Windows)利用Common Language Runtime实现驻留

• https://www.contextis.com/en/blog/common-language-runtime-hook-for-persistence

zip文件密码破解工具fcrackzip完全指南

• https://www.hackingarticles.in/comprehensive-guide-on-fcrackzip-tool/

智能设备的隐私泄漏

• https://mirror.netcologne.de/CCC/events/camp2019/h264-hd/camp19-10355-eng-Privacy_leaks_in_smart_devices_Extracting_data_from_used_smart_home_devices.mp4

利用泄漏的进程和线程句柄

• http://hatriot.github.io/blog/2019/08/22/exploiting-leaked-process-and-thread-handles/

The Imitation Game: Attacker Emulation

• https://www.pwc.co.uk/issues/imitation-game-attacker-emulation.html

DEFCON 2019回顾

• https://dttw.tech/posts/SJ40_7MNS

获取Burp Collaborator会话的持续性访问

• https://www.onsecurity.co.uk/blog/gaining-persistent-access-to-burps-collaborator-sessions

将Android设备作为恶意USB, 执行命令注入

• https://carvesystems.com/news/command-injection-with-usb-peripherals/

现在的Android密码管理App依然存在FLAG_SECURE错误使用的问题

• https://blog.doyensec.com/2019/08/22/modern-password-managers-flag-secure.html

[漏洞]

Wordpress GDPR插件漏洞

• https://www.pluginvulnerabilities.com/2019/08/22/gdpr-plugins-for-wordpress-continue-to-be-insecure/

开源Web代理Squid的缓存溢出漏洞可导致代码执行(CVE-2019-12527)

• https://www.zerodayinitiative.com/blog/2019/8/22/cve-2019-12527-code-execution-on-squid-proxy-through-a-heap-buffer-overflow

WordPress插件Import Export Users = 1.3.0 CSV注入漏洞(CVE-2019-15092)

• https://medium.com/bugbountywriteup/cve-2019-15092-wordpress-plugin-import-export-users-1-3-0-csv-injection-b5cc14535787

BitDefender Antivirus2020免费版提权漏洞

• https://safebreach.com/Post/BitDefender-Antivirus-Free-2020-Privilege-Escalation-to-SYSTEM

iMessage漏洞CVE-2019-8646的多种可能性

• https://googleprojectzero.blogspot.com/2019/08/the-many-possibilities-of-cve-2019-8646.html

Pulse Secure SSL VPN 任意文件读取漏洞(CVE-2019-11510)Exploit

• https://github.com/projectzeroindia/CVE-2019-11510

[恶意代码]

Asruex后门变种使用古老的MS Office和Adobe漏洞感染Word和PDF文档

• https://blog.trendmicro.com/trendlabs-security-intelligence/asruex-backdoor-variant-infects-word-documents-and-pdfs-through-old-ms-office-and-adobe-vulnerabilities/

基于开源工具AhMyth的Android间谍软件

• https://www.welivesecurity.com/2019/08/22/first-spyware-android-ahmyth-google-play/

[工具]

hacktronian: 多合一Hacking工具, 针对Linux和Android

• https://github.com/thehackingsage/hacktronian

qiling: 二进制模拟框架(基于Unicorn)

• https://github.com/qilingframework/qiling

Lime-Crypter: 混淆工具, 支持.NET和原生文件

• https://github.com/NYAN-x-CAT/Lime-Crypter

20190822

[技术]

使用Radare2和Python逆向Go编写的二进制文件

• https://carvesystems.com/news/reverse-engineering-go-binaries-using-radare-2-and-python/

使用Osquery辅助事件响应和威胁狩猎

• https://medium.com/@d.bougioukas/blue-team-diary-entry-1-leveraging-osquery-for-enhanced-incident-response-threat-hunting-70935538c9c3

XSLT注入基础: Saxon

• https://blog.hunniccyber.com/ektron-cms-remote-code-execution-xslt-transform-injection-java/

macOS事件响应, Part1: 收集设备、文件和系统数据

• https://www.sentinelone.com/blog/macos-incident-response-part-1-collecting-device-file-system-data/

Hacking Containers and Kubernetes

• https://koeln.ftp.media.ccc.de/events/camp2019/h264-hd/camp19-10178-eng-Hacking_Containers_and_Kubernetes.mp4

Cobalt Strike进程注入功能的实现细节

• https://blog.cobaltstrike.com/2019/08/21/cobalt-strikes-process-injection-the-details/

Securing the Cloud: A Story of Research, Discovery, and Disclosure

• https://www.blackhillsinfosec.com/securing-the-cloud-a-story-of-research-discovery-and-disclosure/

XSS via - http Headers

• https://brutelogic.com.br/blog/xss-via-- http-headers/

Android Keystore认证的安全性分析

• https://labs.mwrinfosecurity.com/blog/how-secure-is-your-android-keystore-authentication/

[漏洞]

趋势科技Maximum Security 2019提权漏洞(Windows)

• https://sidechannel.tempestsi.com/trend-micro-maximum-security-2019-vulnerability-allows-for-privilege-escalation-attacks-on-windows-bab9b90be90d

SuiteCRM 7.11.4漏洞可作为攻击者进入内网的突破口

• https://blog.ripstech.com/2019/breaking-into-your-internal-network/

[恶意代码]

僵尸网络Haikai变种, 利用D-Link路由器漏洞在拉丁美洲传播

• https://sidechannel.tempestsi.com/hakai-botnet-shows-signs-of-intense-activity-in-latin-america-724ffb84d5cb

俄国APT组织Silence针对美国，欧洲，非洲和亚洲30多个国家银行的攻击行动

• https://www.group-ib.com/media/silence-attacks/

从2013年至今的Neutrino恶意代码攻击事件始末

• http://blog.ptsecurity.com/2019/08/finding-neutrino.html

疑似朝鲜的黑客组织对多国外交部和智囊团的攻击

• https://www.anomali.com/blog/suspected-north-korean-cyber-espionage-campaign-targets-multiple-foreign-ministries-and-think-tanks#When:14:00:00Z

[工具]

PEpper: PE文件静态分析工具

• https://github.com/Th3Hurrican3/PEpper

airspy: 从服务器的角度, 探索并追踪Apple AirDrop协议的实现与进化. 基于Frida

• https://github.com/nowsecure/airspy

Covenant: C#编写的C&C框架

• https://github.com/cobbr/Covenant
• https://blog.stealthbits.com/next-gen-open-source-c2-frameworks/

binee: 完整的二进制仿真环境, 专注于所有IO操作的内省(introspection)

• https://github.com/carbonblack/binee

20190821

[技术]

Attack Jupyter

• https://heapspray.io/attack-jupyter.html

使用WebDriver进行自动化渗透测试

• https://heapspray.io/automating-pentests-with-webdriver.html

网站mangago.me的反爬技术分析

• https://nullablevoidptr.github.io/Mangago/

使用PVS-Studio审计CMake的源码

• https://www.viva64.com/en/b/0658/

[漏洞]

Nest Cam IQ Indoor摄像头多个漏洞

• https://blog.talosintelligence.com/2019/08/vuln-spotlight-nest-camera-openweave-aug-2019.html

Steam Windows客户端再爆本地提权0Day

• https://amonitoring.ru/article/onemore_steam_eop_0day/

Win10内核UAF漏洞(CVE-2019-1159)

• https://cpr-zero.checkpoint.com/vulns/cprid-2132/

开源工具rest-client管理者帐号被劫持, 攻击者在1.6.13版本中植入代码, 从pastebin下载恶意脚本并执行

• rest-client/rest-client#713

Xilinx Zynq UltraScale+ SoCs Boards 安全漏洞

• https://raw.githubusercontent.com/inversepath/advisories/master/Security_Advisory-Ref_FSC-HWSEC-VR2019-0001-Xilinx_ZU%2B-Encrypt_Only_Secure_Boot_bypass.txt

QEMU VM逃逸漏洞利用(cve-2019-14378)

• https://blog.bi0s.in/2019/08/20/Pwn/VM-Escape/2019-07-29-qemu-vm-escape-cve-2019-14378/

[恶意代码]

具有蠕虫传播功能的挖矿软件, 在受害主机检测到知名的游戏运行时, 会暂停挖矿行为

• https://labs.bitdefender.com/2019/08/worm-cryptominer-combo-lets-you-game-while-using-nsa-exploits-to-move-laterally/

[工具]

out-of-tree: 内核(module, exploit)开发工具

• https://github.com/jollheef/out-of-tree
• https://out-of-tree.io/

AuthCov: Web认证覆盖扫描工具

• https://github.com/authcov/authcov

truegaze: Android/iOS App静态分析工具, 专注于源码之外的安全问题, 例如: 资源字符串, 第三方库, 配置文件

• https://github.com/nightwatchcybersecurity/truegaze

UsoDllLoader: 利用Windows weaponize privileged file write漏洞实现DLL加载

• https://github.com/itm4n/UsoDllLoader
• https://itm4n.github.io/usodllloader-part1/
• https://itm4n.github.io/usodllloader-part2/

Chiaki: 在Linux/Windows/MacOS等平台上远程玩PS4

• https://github.com/thestr4ng3r/chiaki

cotopaxi: 使用指定IoT网络协议, 对IoT设备进行安全测试

• https://github.com/Samsung/cotopaxi

VECTR: 跟踪红色和蓝色团队测试活动, 测量不同攻击场景的检测和预防功能

• https://github.com/SecurityRiskAdvisors/VECTR

20190820

[技术]

Sushi Roll: 研究性CPU内核, 最小噪音(cycle-by-cycle micro-architectural introspection)

• https://gamozolabs.github.io/metrology/2019/08/19/sushi_roll.html

Exploiting A/B Testing for Fun and Profit (Part 1)

• https://medium.com/@89berner/exploiting-a-b-testing-for-fun-and-profit-part-1-f39d48a07076

隐蔽数据渗透打破路由器网络隔离

• https://www.usenix.org/system/files/woot19-paper_ovadia.pdf

分析恶意代码对于TLS回调的使用

• https://www.ringzerolabs.com/2019/08/analyzing-tls-callbacks.html
• https://youtu.be/YJxxzUK6Mhs

绕过Steam Reg-symlink提权漏洞的补丁

• https://xiaoyinl.github.io/steam_EoP_bypass.html

使用DotNet Core绕过AWL, 以及其他的躲避检测技巧

• https://bohops.com/2019/08/19/dotnet-core-a-vector-for-awl-bypass-defense-evasion/

Write Fuzzable Code

• https://blog.regehr.org/archives/1687

[漏洞]

分析近期的WIndows RDP堆溢出漏洞

• https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

VLC最近修复的多个漏洞

• https://blog.semmle.com/vlc-vulnerability-heap-overflow

Firefox漏洞Write-up(CVE-2019-11707)

• https://blog.bi0s.in/2019/08/18/Pwn/Browser-Exploitation/cve-2019-11707-writeup/

Firefox 66.0.3 CVE-2019-11707 Exploit

• https://github.com/vigneshsrao/CVE-2019-11707

[恶意代码]

用户层Rootkit恶意代码分析

• https://youtu.be/FvYjM8eZ7Ck

伪装为NordVPN App的恶意银行木马Bolik

• https://news.drweb.com/show/?i=13388&lng=en&c=5

近期APT41攻击行动的检测与阻止s

• https://www.fireeye.com/blog/threat-research/2019/08/game-over-detecting-and-stopping-an-apt41-operation.html

MyKings变种, 新的驻留技巧

• https://blog.trendmicro.com/trendlabs-security-intelligence/uncovering-a-mykings-variant-with-bootloader-persistence-via-managed-detection-and-response/

[工具]

Squally: 用于教汇编语言和Game Hacking(cocos2d-x)的游戏

• https://github.com/Squalr/Squally
• https://medium.com/squallygame/we-open-sourced-our-steam-game-and-why-it-was-a-good-idea-2d5ac72c9802

eyeballer: 用于分析渗透screenshots的卷积神经网络

• https://github.com/bishopfox/eyeballer

X-Tunnel-Opaque-Predicates: IDA插件, 使用前向有界DSE提取不透明谓词, 使用X-Tunnel做示例

• https://github.com/JonathanSalwan/X-Tunnel-Opaque-Predicates
• http://sebastien.bardin.free.fr/2017-sp.pdf

PhysicalMemoryRW: Ring0物理内存读写工具, 基本版

• https://github.com/zouxianyu/PhysicalMemoryRW

[其他]

2019年第2季度IT威胁演变

• https://securelist.com/it-threat-evolution-q2-2019/91994/
• https://securelist.com/it-threat-evolution-q2-2019-statistics/92053/

20190819

[技术]

反Fuzz技巧: 阻碍对二进制文件的Fuzz

• https://www.usenix.org/system/files/sec19-guler.pdf

FUZZIFICATION: 反-Fuzz技巧

• https://www.usenix.org/system/files/sec19fall_jung_prepub.pdf

逆向话题深度探讨: 栈

• https://revers.engineering/applied-re-the-stack/

LayerOne 2019 CTF - LogViewer

• https://www.somersetrecon.com/blog/2019/8/5/layerone-2019-ctf-log-viewer

Helpline Box Write-up

• https://blog.chadp.me/posts/htb-helpline
• https://0xrick.github.io/hack-the-box/helpline/

横向渗透的多种方式

• https://hausec.com/2019/08/12/offensive-lateral-movement/

Bloodhound实战

• https://blog.zsec.uk/bloodhound-101/

Who to blame for the bytes in the WASM?

• https://gist.github.com/cdyk/47c8580e67b628a0109e3759191b0bf1

如何优化代码和RAM大小

• https://mcuoneclipse.com/2019/08/17/tutorial-how-to-optimize-code-and-ram-size/

Uploading web.config for Fun and Profit 2

• https://soroush.secproject.com/blog/2019/08/uploading-web-config-for-fun-and-profit-2/

[漏洞]

系统管理工具Webmin RCE漏洞(0Day)

• https://blog.firosolutions.com/exploits/webmin/

[恶意代码]

King Ouroboros勒索软件分析

• https://maskop9.tech/index.php/2019/08/18/analysis-of-king-ouroboros-ransomware/

loligang僵尸网络样本分析

• https://youtu.be/vIqacDG2FGQ

Chrome搜索劫持插件PUP.Optional.QxSearch

• https://blog.malwarebytes.com/pups/2019/08/qxsearch-hijacker-fakes-failed-installs/

谷歌商店发现伪装为摄影和游戏应用的广告App, 超过80款, 下载超800万次

• https://blog.trendmicro.com/trendlabs-security-intelligence/adware-posing-as-85-photography-and-gaming-apps-on-google-play-installed-over-8-million-times/

[工具]

hammer: AWS云安全工具

• https://github.com/dowjones/hammer

LOGITacker: 使用nRF52840无线电加密狗枚举和测试Logitech无线输入设备是否存在漏洞

• https://github.com/mame82/LOGITacker

iris: WinDbg扩展, 显示Windows进程mitigations

• https://github.com/fdiskyou/iris

[其他]

USBSamurai: 售价不足10美元的恶意USB HID Injecting Cable, 可远程控制

• https://securityaffairs.co/wordpress/89978/hacking/usbsamurai-usb-hid.html

20190816

[技术]

反检测的艺术, Part4: 自我防御

• https://pentest.blog/art-of-anti-detection-4-self-defense/

Hacking a random fiber router

• https://youtu.be/co4Drm-TytY

RouterOS后渗透

• https://medium.com/tenable-techblog/routeros-post-exploitation-784c08044790

All Your Clicks Belong to Me: 关于Web页面点击劫持的调查

• https://www.usenix.org/system/files/sec19fall_zhang_prepub.pdf

什么是点击劫持, 以及如何避免

• https://securityboulevard.com/2019/08/clickjacking-attacks-what-they-are-and-how-to-prevent-them/

Apache Solr参数注入

• https://www.veracode.com/blog/security-news/new-research-apache-solr-parameter-injection
• https://github.com/veracode-research/solr-injection

在托管代码中通过P/Invoke调用Win32 API

• https://posts.specterops.io/offensive-p-invoke-leveraging-the-win32-api-from-managed-code-7eef4fdef16d

Understanding modern UEFI-based platform boot

• https://depletionmode.com/uefi-boot.html

[漏洞]

卡巴斯基反病毒软件存在多年的漏洞, 泄露用户敏感数据

• https://www.heise.de/ct/artikel/Kasper-Spy-Kaspersky-Anti-Virus-puts-users-at-risk-4496138.html

通过通用宿主控制接口, 接管VMWare, Part2(Pwn2Own)

• https://www.zerodayinitiative.com/blog/2019/8/15/taking-control-of-vmware-through-the-universal-host-control-interface-part-2

Trend Micro Password Manager提权漏洞(CVE-2019-14687)

• https://safebreach.com/Post/Trend-Micro-Password-Manager-Privilege-Escalation-to-SYSTEM

[恶意代码]

挖矿软件Hidden Bea的感染链分析, Part1: stegano壳

• https://blog.malwarebytes.com/threat-analysis/2019/08/the-hidden-bee-infection-chain-part-1-the-stegano-pack/

深入解析银行木马GOOTKIT的反分析功能

• https://www.sentinelone.com/blog/gootkit-banking-trojan-deep-dive-anti-analysis-features/

Remcos远控新变种分析

• https://blog.trendmicro.com/trendlabs-security-intelligence/analysis-new-remcos-rat-arrives-via-phishing-email/

使用复杂混淆技术的挖矿软件Norman

• https://www.varonis.com/blog/monero-cryptominer/

[工具]

DrSemu: 基于动态行为的恶意代码检测和分类系统

• https://github.com/secrary/DrSemu

cleaner_wrasse: 远程启动RouterOS隐藏的busybox shell

• https://github.com/tenable/routeros/tree/master/cleaner_wrasse

routeros: RouterOS安全研究工具与PoC

• https://github.com/tenable/routeros

20190815

[技术]

重新思考高级SSL证书的价值

• https://perezbox.com/2019/08/rethinking-the-value-of-premium-ssl-certificates/

蓝牙Key协商(KNOB)攻击: 打破蓝牙安全

• https://knobattack.com/

交互式SSRF教程

• https://application.security/

使用DNS防火墙进行威胁狩猎

• https://blog.redteam.pl/2019/08/threat-hunting-dns-firewall.html

MITRE ATT&CK漏洞系列: Trusted relationship

• https://resources.infosecinstitute.com/mitre-attck-vulnerability-series-trusted-relationship/

The Twin Journey, Part 3: I’m Not a Twin, Can’t You See my Whitespace at the End?

• https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/the-twin-journey-part-3-im-not-a-twin-cant-you-see-my-whitespace-at-the-end/

使用PVS-Studio静态分析器检查.NET Core库的源码

• https://www.viva64.com/en/b/0656/

[漏洞]

Comodo AV软件内核minifilter驱动竟态UAF漏洞(CVE-2019-14694)

• http://rce4fun.blogspot.com/2019/08/comodo-antivirus-sandbox-race-condition.html

lovense hush buttplug漏洞利用链

• https://github.com/smealum/butthax

Path-Style Model for AWS S3 Can Lead to Namespace Squatting

• https://wwws.nightwatchcybersecurity.com/2019/08/14/path-style-model-for-aws-s3-can-lead-to-namespace-squatting/

[恶意代码]

Karagany恶意软件

• https://www.carbonblack.com/2019/08/12/cb-tau-threat-intelligence-notification-karagany-malware/

针对北美酒店行业的网络钓鱼攻击

• https://blog.360totalsecurity.com/en/phishing-email-attack-against-hotel-industry-in-north-america/

Neko, Mirai, 和 Bashlite变种, 使用多种Exploit攻击路由器等设备

• https://blog.trendmicro.com/trendlabs-security-intelligence/back-to-back-campaigns-neko-mirai-and-bashlite-malware-variants-use-various-exploits-to-target-several-routers-devices/

Android平台恶意银行软件Cerberus, 使用计步器躲避分析

• https://www.threatfabric.com/blogs/cerberus-a-new-banking-trojan-from-the-underworld.html

在希腊半岛传播的2款有相似功能的后门和远控: BalkanDoor 和 BalkanRAT

• https://www.welivesecurity.com/2019/08/14/balkans-businesses-double-barreled-weapon/

[工具]

sampler: Shell命令执行、可视化和告警工具

• https://github.com/sqshq/sampler

SysmonHunter: 基于ATT&CK的Sysmon Hunting工具

• https://github.com/baronpan/SysmonHunter

email2phonenumber: OSINT工具, 由某人的邮箱地址获取其电话号码

• https://github.com/martinvigo/email2phonenumber

IPRotate_Burp_Extension: Burp扩展, 使用AWS API Gateway, 在每次请求时轮换IP

• https://github.com/RhinoSecurityLabs/IPRotate_Burp_Extension

20190814

[技术]

HVACking: Understanding the Delta Between Security and Reality

• https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/hvacking-understanding-the-delta-between-security-and-reality/
• https://youtu.be/ZHxw5Q11Aio

高级代码注入技术现状

• https://adalogics.com/blog/the-state-of-advanced-code-injections

自动化无线协议逆向

• https://www.usenix.org/system/files/woot19-paper_pohl.pdf

(BlackHat)攻破三星ARM TrustZone

• https://i.blackhat.com/USA-19/Thursday/us-19-Peterlin-Breaking-Samsungs-ARM-TrustZone.pdf

一个简单的利用异常达到反逆向的技巧

• https://secrary.com/Random/anti_re_simple/

LLMNR投毒与WPAD嗅探

• https://medium.com/bugbountywriteup/llmnr-poisoning-and-wpad-spoofing-69bfd8d8c504

从电子邮箱到手机号码, 一种新的OSINT方式

• https://www.martinvigo.com/email2phonenumber/

使用NLP生成个性化的Wordlist, 用于密码猜测/爆破攻击

• https://utkusen.com/blog/generating-personalized-wordlists.html

使用AWS API网关, 绕过基于IP的黑名单

• https://rhinosecuritylabs.com/aws/bypassing-ip-based-blocking-aws/

使用Burp拦截Flutter App与其后端的通信

• https://blog.nviso.be/2019/08/13/intercepting-traffic-from-android-flutter-applications/

Code Execution via Fiber Local Storage

• http://hatriot.github.io/blog/2019/08/12/code-execution-via-fiber-local-storage/

报告和协作工具Dradis实战

• https://www.hackingarticles.in/dradis-reporting-and-collaboration-tool/

Google.org 点击劫持 DOM XSS

• https://appio.dev/vulns/clickjacking-xss-on-google-org/

Down the Rabbit-Hole...

• https://googleprojectzero.blogspot.com/2019/08/down-rabbit-hole.html

[漏洞]

• http/2 Denial of Service Advisory
• https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md

开源营销自动化软件Mautic RCE漏洞

• https://github.com/MegadodoPublications/exploits/blob/master/mautic.md

[工具]

goop: 谷歌搜索爬虫, 可绕过验证码

• https://github.com/s0md3v/goop

ThreatHunting: Splunk App, 包含若干dashboard和报告, 辅助威胁狩猎

• https://github.com/olafhartong/ThreatHunting

subasm: subleq assembler / interpreter / rop chain

• https://github.com/lunixbochs/subasm

ctftool: 交互式CTF Exploration Tool

• https://github.com/taviso/ctftool

20190813

[技术]

(BlackHat).NET平台恶意软件威胁: 内部原理与逆向

• http://www.blackstormsecurity.com/docs/ALEXANDREBORGES_DEFCON_2019.pdf

关于使用公共平台做C&C的概述

• https://kindredsec.com/2019/08/12/an-overview-of-public-platform-c2s/

40多款Windows驱动有常见的设计漏洞,

• https://eclypsium.com/2019/08/10/screwed-drivers-signed-sealed-delivered/

MS Azure 子域名接管

• https://blog.cystack.net/subdomain-takeover-chapter-two-azure-services/

无需脱焊(desoldering)从EEPROM设备读取数据的简单方式

• http://blog.securelayer7.net/reading-data-from-eeprom-without-desoldering/

Apache Solr注入研究

• https://github.com/artsploit/solr-injection

Windows进程注入: KnownDlls缓存投毒

• https://modexp.wordpress.com/2019/08/12/windows-process-injection-knowndlls/

Windows代码注入: 使用KnownDlls绕过代码完整性防护

• https://tyranidslair.blogspot.com/2019/08/windows-code-injection-bypassing-cig.html

(BlackHat)5G安全体系结构和对策中的新漏洞, Part1

• https://infosec.sintef.no/en/informasjonssikkerhet/2019/08/new-vulnerabilities-in-5g-security-architecture-countermeasures/
• https://i.blackhat.com/USA-19/Wednesday/us-19-Shaik-New-Vulnerabilities-In-5G-Networks.pdf

(BlackHat)Inside The Apple T2

• https://i.blackhat.com/USA-19/Thursday/us-19-Davidov-Inside-The-Apple-T2.pdf

(BlackHat)SSO Wars: The Token Menace

• https://www.blackhat.com/us-19/briefings/schedule/#sso-wars-the-token-menace-15092
• https://github.com/pwntester/DupeKeyInjector

Apple hardware(APRR) secrets

• https://siguza.github.io/APRR/
• https://github.com/Siguza/APRR

[工具]

hackertarget: 网络情报工具, 辅助组织发现攻击面和识别安全漏洞

• https://github.com/ismailtasdelen/hackertarget

fuzzowski: 网络协议Fuzzer

• https://github.com/nccgroup/fuzzowski

[其他]

Hacking杂志Paged Out第1期

• https://pagedout.institute/download/PagedOut_001_beta1.pdf

DEFCON 27工坊: 使用WinDBG Preview进行现代化调试

• https://github.com/hugsy/defcon_27_windbg_workshop

20190812

[技术]

Kubernetes渗透方法论, Part1

• https://securityboulevard.com/2019/08/kubernetes-pentest-methodology-part-1/

使用tmux提权

• https://www.hackingarticles.in/linux-for-pentester-tmux-privilege-escalation/

Windows进程注入: Breaking BaDDEr

• https://modexp.wordpress.com/2019/08/09/windows-process-injection-breaking-badder/

Vulnhub Write-up Kioptrix 5

• https://medium.com/bugbountywriteup/vulnhub-oscp-type-kioptrix-5-writeup-16b73a3afa10

Arkham: Hack The Box Walkthrough

• https://secbytes.net/Arkham-Hack-The-Box-Walkthrough/
• https://blog.chadp.me/posts/htb-arkham

基于Grep的代码扫描

• https://littlemaninmyhead.wordpress.com/2019/08/04/dont-underestimate-grep-based-code-scanning/

使用恶意的SQLite数据库实现代码执行

• https://research.checkpoint.com/select-code_execution-from-using-sqlite/

用勒索软件感染摄像机

• https://research.checkpoint.com/say-cheese-ransomware-ing-a-dslr-camera/

使用Ghidra进行C++逆向(系列视频)

• https://www.youtube.com/playlist?list=PLRAe18TJ_NTE9cr18OPphn82WS8gVv-te

Making it Rain shells in Kubernetes

• https://raesene.github.io/blog/2019/08/10/making-it-rain-shells-in-Kubernetes/

[漏洞]

在野发现利用Firefox 0-day攻击案例

• https://blog.coinbase.com/responding-to-firefox-0-days-in-the-wild-d9c85a57f15b

[工具]

heob: 覆盖堆管理函数, 检测堆overrun和内存泄漏

• https://github.com/ssbssa/heob

Firmware_Slap: 通过concolic analysis 和 function clustering挖掘固件漏洞

• https://github.com/ChrisTheCoolHut/Firmware_Slap

cft: Java反编译器

• https://github.com/leibnitz27/cfr

riscv-alphanumeric-shellcoding: 辅助编写能够运行任意代码的RISC-V指令集Shellcode

• https://github.com/RischardV/riscv-alphanumeric-shellcoding

pinjectra: Windows进程注入技巧的C++实现(专注Windows 10 64位)

• https://github.com/SafeBreach-Labs/pinjectra

commando-vm: 基于Windows的渗透环境配置, 更新至2.0版

• https://github.com/fireeye/commando-vm

RunasCs: 使用与当前登录用户不同的权限运行指定进程

• https://github.com/antonioCoco/RunasCs

AbsoluteZero: Python APT Backdoor

• https://github.com/TheSph1nx/AbsoluteZero

20190809

[技术]

适用于Windows系统的基于LAN的盲SSRF攻击

• https://initblog.com/2019/switcheroo/

如何使用树莓派4构建自己的渗透测试Dropbox

• https://artificesecurity.com/blog/2019/8/6/how-to-build-your-own-penetration-testing-drop-box-using-a-raspberry-pi-4

使用dbgsrv.exe绕过应用程序白名单

• https://www.fortynorthsecurity.com/how-to-bypass-wdac-with-dbgsrv-exe/

使用反向RDP, 攻击Hyper-V

• https://research.checkpoint.com/reverse-rdp-the-hyper-v-connection/

The red-teamer’s cheat-sheet

• https://www.komodosec.com/post/github-the-red-teamer-s-cheat-sheet

使用Panda创建恶意代码沙箱, Part1

• https://adalogics.com/blog/Building-a-custom-malware-sandbox-with-PANDA-Part-1

Windows进程注入: DNS客户端API

• https://modexp.wordpress.com/2019/08/08/windows-process-injection-dnsapi/

Attacking Unmarshallers :: JNDI Injection using Getter Based Deserialization Gadgets

• https://srcincite.io/blog/2019/08/07/attacking-unmarshallers-jndi-injection-using-getter-based-deserialization.html

威胁情报中机器学习的应用

• https://www.microsoft.com/security/blog/2019/08/08/from-unstructured-data-to-actionable-intelligence-using-machine-learning-for-threat-intelligence/

(BlackHat2019)Android 预装App深度逆向

• https://github.com/maddiestone/ConPresentations/blob/master/Blackhat2019.SecuringTheSystem.pdf

(BlackHat2019)Attacking iPhone XS Max

• https://i.blackhat.com/USA-19/Thursday/us-19-Wang-Attacking-IPhone-XS-Max.pdf

(BlackHat2019)MS Cloud的攻击与防御

• https://adsecurity.org/wp-content/uploads/2019/08/2019-BlackHat-US-Metcalf-Morowczynski-AttackingAndDefendingTheMicrosoftCloud.pdf

[漏洞]

Electron 框架的漏洞可使攻击者向合法Electron App中注入恶意代码, 且不会引起任何警告

• https://www.contextis.com/en/blog/basic-electron-framework-exploitation

Steam 命令注入漏洞PoC

• https://github.com/roflsandwich/Steam-EoP

[恶意代码]

brbot恶意软件是如何使用资源段存储Payload的

• https://www.youtube.com/watch?v=pbnfLfPy9KE

[工具]

redViper: 使用Reddit做C&C通信

• https://github.com/itsKindred/redViper

social_attacker: 自动化社交媒体钓鱼框架

• https://github.com/Greenwolf/social_attacker

AttackSurfaceMapper: 侦察过程自动化工具

• https://github.com/superhedgy/AttackSurfaceMapper

20190808

[技术]

IoT设备渗透测试学习

• http://blog.securelayer7.net/learn-about-iot-device-penetration-testing/

Meteor App盲NoSQL注入

• https://medium.com/rangeforce/meteor-blind-nosql-injection-29211775cd01

打破- http请求的隔离, 将恶意- http请求连接到其他的- http请求上

• https://portswigger.net/blog/- http-desync-attacks-request-smuggling-reborn

新的针对移动核心网络的攻击向量

• http://www.sicherheitsforschung-magdeburg.de/uploads/journal/MJS_064_Holtmanns_MobileCoreNetworks.pdf

如何攻击Kerberos

• https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html

一种对抗动态符号执行(DSE)的保护方式

• https://arxiv.org/pdf/1908.01549.pdf

[漏洞]

The Fully Remote Attack Surface of the iPhone

• https://googleprojectzero.blogspot.com/2019/08/the-fully-remote-attack-surface-of.html

iMessage URL反序列化堆溢出漏洞

• https://blog.firosolutions.com/exploits/imessage/

Cloud Foundry UAA提权漏洞(CVE-2019-11270)

• https://www.twistlock.com/labs-blog/privilege-escalation-in-cloud-foundry-uaa-cve-2019-11270/

Steam Windows客户端本地提权漏洞

• https://amonitoring.ru/article/steamclient-0day/

[恶意代码]

恶意软件OilRig进化时间线

• https://marcoramilli.com/2019/08/07/oilrig-the-techniques-evolution-over-time/

How a Prominent Cryptomining Botnet is Paving the Way for a Lucrative and Illicit Revenue Model

• https://www.carbonblack.com/resources/threat-research/access-mining/

Python编写的恶意软件F-Scrack-mimikatz

• https://decoded.avast.io/ondrejmokos/f-scrack-mimikatz-a-bundle-of-tools/

多功能密码窃取工具Clipsa

• https://decoded.avast.io/janrubin/clipsa-multipurpose-password-stealer/

谷歌商店发现间谍App, 主要针对韩国和日本

• https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/moqhao-related-android-spyware-targeting-japan-and-korea-found-on-google-play/

[工具]

fwanalyzer: 文件系统镜像分析工具

• https://github.com/cruise-automation/fwanalyzer
• https://medium.com/cruise/firmware-security-fwanalyzer-dcbd95cef717

20190807

[技术]

安装并配置基于Tor的隐藏邮件服务

• https://www.youtube.com/watch?v=E2x5CmjPXPw

The Twin Journey, Part 2: Evil Twins in a Case In-sensitive Land

• https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/the-twin-journey-part-2-evil-twins-in-a-case-in-sensitive-land/

使用IDA从零开始学逆向, Part19

• https://medium.com/p/b8a5ccc0efbc

Cordova App调试

• https://www.appknox.com/security/debugging-cordova-applications

黑客是如何通过OSINT获取你的组织的信息的

• https://ledgerops.com/blog/how-hackers-can-profile-your-organization-using-osint/08/06/2019

谷歌计算在新版Android中引入的短信验证码自动填充功能存在安全隐患

• https://www.benthamsgaze.org/2019/08/06/next-version-of-android-might-introduce-new-security-risks-for-online-banking-2fa-and-more/

在Linux平台开发C++时, 用PVS-Studio静态分析代码

• https://www.viva64.com/en/b/0652/

[漏洞]

Galaxy S8漏洞, 与V8漏洞组合, 可安装任意App(2017年底)

• https://blog.flanker017.me/galaxy-leapfrogging-pwning-the-galaxy-s8/

[恶意代码]

The Evolution of Aggah: From Roma225 to the RG Campaign

• https://blog.yoroi.company/research/the-evolution-of-aggah-from-roma225-to-the-rg-campaign/

LokiBot变种, 新的驻留技巧, 使用隐写书隐藏自身代码

• https://blog.trendmicro.com/trendlabs-security-intelligence/lokibot-gains-new-persistence-mechanism-uses-steganography-to-hide-its-tracks/

[工具]

Molasses: Message Layer Security群发消息协议的早期实现版本

• https://github.com/trailofbits/molasses
• https://blog.trailofbits.com/2019/08/06/better-encrypted-group-chat/

Mirage: 无线通信分析, 模块化

• http://homepages.laas.fr/rcayre/mirage-documentation/index.html
• https://redmine.laas.fr/projects/mirage

subzy: 检查子域名接管漏洞

• https://github.com/LukaSikic/subzy

SMTPTester: SMTP服务器常见漏洞检测

• https://github.com/xFreed0m/SMTPTester

mondoo: Cloud-Native安全和漏洞风险管理系统

• https://github.com/mondoolabs/mondoo
• https://mondoo.io/
• https://mondoo.io/docs/get-started/

unicorn-bios: 用于Unicorn引擎的BIOS模拟器, 基础版

• https://github.com/macmade/unicorn-bios

[其他]

查询邮件发件人恶意值的免费API

• https://blog.sublimesecurity.com/emailrep-query-and-report/

Fortinet发布的2019年第2季度威胁报告

• https://www.fortinet.com/content/dam/fortinet/assets/threat-reports/threat-report-q2-2019.pdf

MITRE ATT&CK Windows Logging Cheat Sheets

• https://github.com/MalwareArchaeology/ATTACK

20190806

[技术]

C++逆向领域中的自动化技巧

• https://www.msreverseengineering.com/blog/2019/8/5/automation-techniques-in-c-reverse-engineering

Windows进程注入之: Multiple Provider Router (MPR) DLL 与 Shell Notifications

• https://modexp.wordpress.com/2019/08/05/windows-process-injection-scn/

Hacking 无线电爆破系统

• https://securityaffairs.co/wordpress/89418/hacking/hacking-radio-blasting-systems.html

如何开始IoT设备固件逆向

• http://blog.securelayer7.net/how-to-start-iot-device-firmware-reverse-engineering/

利用基于AngularJS的XSS实现提权

• https://www.shawarkhan.com/2019/08/leveraging-angularjs-based-xss-to-privilege-escalation.html

[漏洞]

FB50智能锁漏洞(CVE-2019-13143)

• https://icyphox.sh/blog/fb50/

KDE 4/5 KDesktopFile命令注入

• https://gist.githubusercontent.com/zeropwn/630832df151029cb8f22d5b6b9efaefb/raw/64aa3d30279acb207f787ce9c135eefd5e52643b/kde-kdesktopfile-command-injection.txt

[恶意代码]

MS检测到的APT28对知名IoT设备的攻击行动

• https://msrc-blog.microsoft.com/2019/08/05/corporate-iot-a-path-to-intrusion/

Trickbot最新版, 利用严重混淆的JS文件进行投递

• https://blog.trendmicro.com/trendlabs-security-intelligence/latest-trickbot-campaign-delivered-via-highly-obfuscated-js-file/

恶意软件LookBack, 通过对美国公用事业部门进行网络钓鱼攻击进行传播

• https://www.proofpoint.com/us/threat-insight/post/lookback-malware-targets-united-states-utilities-sector-phishing-attacks

Sodinokibi勒索软件分析

• https://www.cybereason.com/blog/the-sodinokibi-ransomware-attack

一起针对委内瑞拉军队的攻击事件分析

• https://www.welivesecurity.com/2019/08/05/sharpening-machete-cyberespionage/

Wordpress插件WP Security, 恶意加密文章内容

• https://blog.sucuri.net/2019/08/malicious-plugin-used-to-encrypt-wordpress-posts.html

[工具]

AutoRecon: 网络侦察工具, 自动枚举服务, 多线程

• https://github.com/Tib3rius/AutoRecon

BRUTAL-IDA: IDA插件, 禁用IDA7.3版本添加的undo/redo功能

• https://github.com/tmr232/BRUTAL-IDA

[其他]

2019年第2季度DDoS攻击报告

• https://securelist.com/ddos-report-q2-2019/91934/

20190805

[技术]

DRAGONBLOOD: Analysing WPA3's Dragonfly Handshake

• https://wpa3.mathyvanhoef.com/

Capital One因为云端错误配置导致数据泄漏的技术分析

• https://www.fugue.co/blog/a-technical-analysis-of-the-capital-one-cloud-misconfiguration-breach

针对Linux堆分配器的攻击, 使堆元数据崩溃, 强制程序Double Free并使malloc返回任意指针

• http://blog.infosectcbr.com.au/2019/08/linux-heap-fast-bin-double-free.html

在Chrome 76中使用timing攻击检测匿名模式

• https://blog.jse.li/posts/chrome-76-incognito-filesystem-timing/

Fortune: Hack The Box Walkthrough

• https://secbytes.net/Fortune-Hack-the-box-walkthrough/
• https://0xrick.github.io/hack-the-box/fortune/
• https://medium.com/@d_f4u1t/fortune-write-up-9f651136ca2c

审计Kubernetes RBAC策略的工具与方法

• https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/august/tools-and-methods-for-auditing-kubernetes-rbac-policies/

Winning PHDays 9 The Standoff: The chronicle by the True0xA3 team

• https://habr.com/en/post/462205/

在WSL上安装John the Ripper

• https://securityboulevard.com/2019/08/installing-john-the-ripper-on-microsofts-windows-subsystem-for-linux-wsl/

JavaScript模板攻击: 自动为目标Exploit推断主机信息

• https://www.ndss-symposium.org/wp-content/uploads/2019/02/ndss2019_01B-4_Schwarz_paper.pdf
• https://youtu.be/xtCo9ilSQyc

使用超便宜的ESP8266远程控制AtomicPI

• https://www.thanassis.space/remotepower.html
• https://github.com/ttsiodras/RemotePowerViaESP8266

[漏洞]

Adobe Coldfusion Java反序列化漏洞(CVE-2019-7839)PoC与Crashplan服务器Java反序列化漏洞(CVE-2017-9830)

• https://github.com/securifera/CVE-2019-7839
• https://www.securifera.com/blog/2019/08/03/poc-or-stop-the-calc-popping-videos-cve-2017-9830-cve-2019-7839/

Gitea的几个漏洞(Gitea: 轻量级Git服务)

• https://blog.firosolutions.com/exploits/gitea/

测试21款Android AV App, 发现的安全问题: 有些App甚至会泄漏用户的地址簿

• https://www.comparitech.com/antivirus/android-antivirus-vulnerabilities/

[恶意代码]

Lord漏洞利用工具包

• https://blog.malwarebytes.com/threat-analysis/2019/08/say-hello-to-lord-exploit-kit/

黑客组织SectorE02在针对巴基斯坦政府的攻击中使用新版的YTY框架

• https://threatrecon.nshc.net/2019/08/02/sectore02-updates-yty-framework-in-new-targeted-campaign-against-pakistan-government/

解密L0rdix远控的C&C

• https://www.bromium.com/decrypting-l0rdix-rats-c2/

使用内存断点脱壳勒索软件

• https://www.ringzerolabs.com/2019/08/generically-unpacking-ransomware-with.html

[工具]

mordor: 重播对抗技巧(Re-play Adversarial Techniques)

• https://github.com/Cyb3rWard0g/mordor
• https://posts.specterops.io/enter-mordor-pre-recorded-security-events-from-simulated-adversarial-techniques-fdf5555c9eb1

w13scan: 被动安全扫描器

• https://github.com/boy-hack/w13scan

[其他]

VMProtect发布3.4版本, 增加了.NET程序的支持

• http://vmpsoft.com/20190803/vmprotect-3-4/

pykd发布0.3.4.8版本

• https://githomelab.ru/pykd/pykd/wikis/0.3.4.8

20190802

[技术]

在Seeed Arch Mix NXP i.MX RT1052开发板上恢复固件

• https://mcuoneclipse.com/2019/08/01/restoring-default-firmware-on-seeed-arch-mix-nxp-i-mx-rt1052-board/

容器平台安全最佳实战

• https://medium.com/cruise/container-platform-security-7a3057a27663

使用Ghidra和x64dbg分析Crackme

• https://maxkersten.nl/binary-analysis-course/assembly-basics/practical-case-crack-me-0x01/

使用Ghidra和Neo4j分析RPC服务

• https://blog.xpnsec.com/analysing-rpc-with-ghidra-neo4j/

审计加密货币钱包/系统和基础设施

• https://blog.doyensec.com/2019/08/01/common-crypto-bugs.html

哈萨克斯坦政府要求公民安装数字证书, 监听公民网络通信

• https://www.f5.com/labs/articles/threat-intelligence/kazakhstan-attempts-to-mitm-itscitizens

一种未公布过的利用原生库和JNI(Java原生接口)实现H2数据库漏洞利用的方式

• https://codewhitesec.blogspot.com/2019/08/exploit-h2-database-native-libraries-jni.html

一种针对HMValidateHandle技巧的简单防护方式

• https://theevilbit.github.io/posts/a_simple_protection_against_hmvalidatehandle_technique/

[漏洞]

某网站CORS验证绕过

• https://medium.com/@saadahmedx/bypassing-cors-13e46987a45b

SanDisk SSD Dashboard Vulnerabilities: CVE-2019-13466 & CVE-2019-13467

• https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/sandisk-ssd-dashboard-vulnerabilities-cve-2019-13466-cve-2019-13467/

Belkin SURF N300路由器的多个漏洞分析

• https://www.zerodayinitiative.com/blog/2019/8/1/wipe-out-hanging-more-than-ten-on-your-old-belkin-surf-router

[恶意代码]

Clop勒索软件

• https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/clop-ransomware/

恶意代码Carbanak分析, 4部分

• https://www.youtube.com/watch?v=jAq-ylewZ_c

SystemBC Proxy恶意软件, 利用Sock5躲避检测

• https://www.proofpoint.com/us/threat-insight/post/systembc-christmas-july-socks5-malware-and-exploit-kits

广告软件DealPly利用Microsoft Smartscreen躲避杀软

• https://blog.ensilo.com/leveraging-reputation-services

挖矿软件Lemon_Duck, 利用永恒之蓝漏洞快速传播

• https://www.sentinelone.com/blog/eternalblue-and-the-lemon-duck-cryptominer-attack/

[工具]

phantap: ‘invisible’ network tap aimed at red teams

• https://github.com/nccgroup/phantap

MalConfScan: Volatility插件, 从已知的恶意代码家族中提取配置信息

• https://github.com/JPCERTCC/MalConfScan
• https://blogs.jpcert.or.jp/en/2019/08/malconfscan.html

buster: 邮件信息收集工具

• https://github.com/sham00n/buster

[其他]

1.2G PowerShell恶意软件下载(2017年)

• https://www.reddit.com/r/netsec/comments/cks2gr/12gb_of_powershell_malware/

20190801

[技术]

r2con 2019 PwnDebian Challenge: Exploiting radare2

• https://bananamafia.dev/post/r2-pwndebian/

使用原始服务器IP地址, 绕过Cloudflare WAF

• https://blog.detectify.com/2019/07/31/bypassing-cloudflare-waf-with-the-origin-server-ip-address/

在恶意代码分析中, 使用工具Far Manager 和 Hiew

• http://dreamofareverseengineer.blogspot.com/2019/07/using-far-manager-and-hiew-duo-in.html

BloodHouns实战

• https://beta.hackndo.com/bloodhound/

The Twin Journey, Part 1

• https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/the-twin-journey-part-1/

SWD part 2 : the MEM-AP

• https://research.kudelskisecurity.com/2019/07/31/swd-part-2-the-mem-ap/

在线广告(advertising)的黑暗面

• https://blog.talosintelligence.com/2019/07/malvertising-deepdive.html

[漏洞]

Linux内核NULL指针解引用漏洞PoC(CVE-2019-10207)

• https://github.com/butterflyhack/CVE-2019-10207

Linux内核漏洞PoC(CVE-2019-13272)

• https://github.com/jas502n/CVE-2019-13272

[恶意代码]

REvil勒索软件脱壳

• https://www.youtube.com/watch?v=0raUaL4TIo4

MegaCortex勒索软件

• https://www.carbonblack.com/2019/07/31/cb-tau-threat-intelligence-notification-megacortex-ransomware/

Mirai新变种, 利用Tor网络实现C&C

• https://blog.trendmicro.com/trendlabs-security-intelligence/keeping-a-hidden-identity-mirai-ccs-in-tor-network/

[工具]

BADministration: 从进攻者的角度, 与管理类型的应用程序进行交互

• https://github.com/ThunderGunExpress/BADministration
• https://ijustwannared.team/2019/07/31/badministration-mcafee-epo/

[其他]

2019年上半年金融行业安全威胁报告

• https://securelist.com/financial-threats-in-h1-2019/91899/

2019年上半年企业移动平台安全状态报告

• https://get.zimperium.com/threat-report-2019-h1/

20190731

[技术]

探索AutoIT FUD加密器

• https://raw-data.gitlab.io/post/autoit_fud/

Synacktiv 2019夏季挑战Writeup

• https://www.synacktiv.com/posts/challenges/2019-summer-challenge-writeup.html

Frenchy Shellcode分析

• http://www.peppermalware.com/2019/07/analysis-of-frenchy-shellcode.html#more

如何使用WHID Elite逆向、嗅探、Fuzz有漏洞的RF成人玩具

• https://medium.com/p/6f52b7fb84bf

在PC上进行与移动平台相关的数字取证

• https://blog.elcomsoft.com/2019/07/extended-mobile-forensics-analyzing-desktop-computers/

使用Docker和WSL体验信息安全工具

• https://blog.stealthbits.com/using-docker-and-windows-subsystem-for-linux/

WhatsApp逆向: Encryption for Chat Manipulation and More

• https://blog.checkpoint.com/2019/07/30/reverse-engineering-whatsapp-encryption-for-chat-manipulation-and-more-at-black-hat-usa/

[漏洞]

Jet数据库引擎漏洞利用分析(CVE-2018-8423)

• https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/jet-database-engine-flaw-may-lead-to-exploitation-analyzing-cve-2018-8423/

谷歌安全研究员公布了iOS 5个安全漏洞, 其中4个有PoC

• https://securityaffairs.co/wordpress/89144/hacking/ios-rce-flaws.html

Windows vbscript 2个漏洞PoC(CVE-2019-0752/CVE-2018-8174)

• https://github.com/smgorelik/Windows-RCE-exploits/tree/master/Web/VBScript

OXID eShops严重漏洞, 可导致未认证用户接管OXID eShops

• https://blog.ripstech.com/2019/oxid-esales-shop-software/

[工具]

mapguard: 漏洞缓解PoC, 保护基于mmap的页面分配

• https://github.com/struct/mapguard
• https://struct.github.io/mapguard.html

Re2Pcap: 由原始- http请求/回复, 创建pcap数据包

• https://github.com/Cisco-Talos/Re2Pcap
• https://blog.talosintelligence.com/2019/07/new-re2pcap-tool-speeds-up-pcap-process.html

[其他]

2019数据泄漏统计

• https://hostreviews.co.uk/data-breaches-statistics/

2019移动威胁报告

• https://www.crowdstrike.com/resources/reports/mobile-threat-report-2019

20190730

[技术]

Linux堆 TCache 故意损坏或投毒, 使malloc返回任意指针

• http://blog.infosectcbr.com.au/2019/07/linux-heap-tcache-poisoning.html

密码学(Cryptographic)攻击的方方面面

• https://research.checkpoint.com/cryptographic-attacks-a-guide-for-the-perplexed/

在因特网范围的端口扫描期间, 寻找速度和准确度之间的平衡点

• https://captmeelo.com/pentest/2019/07/29/port-scanning.html

使用tcpdump解除受限Shell的限制

• https://insinuator.net/2019/07/how-to-break-out-of-restricted-shells-with-tcpdump/

如何优化渗透测试报告

• https://www.blackhillsinfosec.com/your-reporting-matters-how-to-improve-pen-test-reporting/

XSS Payload生成器

• https://labs.nettitude.com/blog/cross-site-scripting-xss-payload-generator/

Making a Blind SQL Injection a Little Less Blind

• https://medium.com/@tomnomnom/making-a-blind-sql-injection-a-little-less-blind-428dcb614ba8

在Ghidra中集成离线的MSDN文档

• https://blag.nullteilerfrei.de/2019/07/29/ghidra-msdn-offline-library-love/

Mshta文件的恶意利用方式, 与对应的防护方法

• https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/what-is-mshta-how-can-it-be-used-and-how-to-protect-against-it/

Hack the Box (HTB) machines walkthrough series — Netmon

• https://resources.infosecinstitute.com/hack-the-box-htb-walkthrough-netmon/

Windows域内提权, Part1

• https://blog.compass-security.com/2019/07/privilege-escalation-in-windows-domains-1-3/

免杀工具AVET介绍

• https://govolution.files.wordpress.com/2019/07/avet-introduction-root-cologne.pdf

[漏洞]

最广泛使用的实时操作系统VxWorks被曝11个0Day

• https://armis.com/urgent11/

Amcrest IP2M-841B网络摄像头信息泄露漏洞(CVE-2019–3948), 可在未认证情况下通过- http远程监听IP2M-841B音频

• https://medium.com/tenable-techblog/i-always-feel-like-somebodys-w%CC%B6a%CC%B6t%CC%B6c%CC%B6h%CC%B6i%CC%B6n%CC%B6g%CC%B6-listening-to-me-938cc14aa13c

高通Snapdragon芯片的多个漏洞

• https://blog.firosolutions.com/exploits/qualcomm/

[恶意代码]

针对Andorid平台的勒索软件Filecoder.C

• https://www.welivesecurity.com/2019/07/29/android-ransomware-back/

Dridex新变种的伪装和代码注入技巧

• https://www.bromium.com/dridex-threat-analysis-july-2019-variant/

[工具]

BLUESPAWN: 实时监控Windows系统, 检测异常活动, 对抗黑客攻击

• https://github.com/ION28/BLUESPAWN

[其他]

密码策略需要改变, 相关引用收集

• https://littlemaninmyhead.wordpress.com/2019/07/28/collection-of-references-on-why-password-policies-need-to-change/

20190729

[技术]

Safari CSP绕过

• https://akayn.github.io/2019/07/24/Safari-SOP.html

Hack The Box - LaCasaDePapel

• https://0xrick.github.io/hack-the-box/lacasadepapel/
• https://khaoticdev.net/?p=372

AWS IAM提权方法收集

• https://github.com/RhinoSecurityLabs/AWS-IAM-Privilege-Escalation

Error.prepareStackTrace可以捕获跨域执行的JS脚本的运行时错误

• https://insert-script.blogspot.com/2019/07/errorpreparestacktrace-allows-to-catch.html

如何创建高效的PWN开发环境

• https://github.com/bet4it/build-an-efficient-pwn-environment

Underscoring the “private” in private key

• https://koen.io/2019/07/26/underscoring-the-private-in-private-key/c

在Virtualbox中练习Solaris 10 x86漏洞的配置、修补与利用

• https://astr0baby.wordpress.com/2019/07/28/solaris-10-x86-in-virtualbox-infosec-exercise-cve-2019-2832/

实战使用ICMP隧道做C&C

• https://www.hackingarticles.in/command-and-control-tunnelling-via-icmp/

使用在MSDN中标注为废弃但最新Win10系统依然包含的DLL(Winsock Helper Functions)实现进程注入

• https://modexp.wordpress.com/2019/07/27/process-injection-winsock/

在Seeed Arch Mix NXP i.MX RT1052板上通过FLASH调试和执行代码

• https://mcuoneclipse.com/2019/07/27/debug-and-execute-code-from-flash-on-the-seeed-arch-mix-nxp-i-mx-rt1052-board/

通过可写入的/etc/passwd文件实现Linux提权

• https://hacknpentest.com/linux-privilege-escalation-via-writeable-etc-passwd-file/

[漏洞]

Webkit系列逻辑漏洞的发现与利用(CVE-2019-8658)

• https://akayn.github.io/2019/07/25/PwningWebkit.html

Windows内核NULL指针解引用漏洞利用(CVE–2019-1132)

• https://pwnrip.com/exploiting-cve-2019-1132-another-null-pointer-dereference-in-windows-kernel/

LibreOffice 代码执行漏洞(CVE-2019-9848)

• https://insinuator.net/2019/07/libreoffice-a-python-interpreter-code-execution-vulnerability-cve-2019-9848/

[工具]

hyperpwn: Hyper插件(基于Electron的终端), 增强GDB调试体验

• https://github.com/bet4it/hyperpwn

IPv6teal: 使用IPV6 covert channel进行隐蔽的数据渗透

• https://github.com/christophetd/IPv6teal

Orbit: 区块链交易调查

• https://github.com/s0md3v/Orbit

[其他]

r2frida cheatsheet

• https://github.com/alanvivona/pwnshop/blob/master/utils/r2frida-cheatsheet.md

20190726

[技术]

Malicious payloads vs. deep visibility: a PowerShell story

• https://www.youtube.com/watch?v=h1Sbb-1wRKw

访问iCloud的安全性问题

• https://blog.elcomsoft.com/2019/07/accessing-icloud-with-and-without-a-password-in-2019/
• https://blog.elcomsoft.com/2019/07/breaking-and-securing-apple-icloud-accounts/

iOS13取证

• https://blog.elcomsoft.com/2019/07/ios-13-beta-forensics/

Hack the Box (HTB) machines walkthrough series — Access

• https://resources.infosecinstitute.com/hack-the-box-htb-walkthrough-access/

配置Ghidra服务器, 使不同用户对同一个文件进行协同分析

• https://www.youtube.com/watch?v=MhDtaFqcLUM

Fake Google Domains Used in Evasive Magento Skimmer

• https://blog.sucuri.net/2019/07/fake-google-domains-used-in-evasive-magento-skimmer.html

[漏洞]

Adobe ColdFusion 代码执行漏洞(CVE-2019-7839)

• https://www.zerodayinitiative.com/blog/2019/7/25/cve-2019-7839-coldfusion-code-execution-through-jnbridge

FreeBSD内核cdroom设备漏洞(cve-2019-5602)

• https://www.synacktiv.com/posts/exploit/exploiting-a-no-name-freebsd-kernel-vulnerability.html

安卓多媒体框架严重RCE漏洞CVE-2019-2107 PoC, 播放恶意视频可导致RCE

• https://github.com/marcinguy/CVE-2019-2107

Linux内核 5.1.17 未授权访问漏洞(CVE-2019-13272)

• https://0day.life/exploit/0day-636.html

WordPress插件WP Super Cache Persistent XSS漏洞

• https://www.pluginvulnerabilities.com/2019/07/25/vulnerability-details-persistent-cross-site-scripting-xss-in-wp-super-cache/

[恶意代码]

在分析GandCrab勒索软件时发现其使用的类似Process Doppelgänging的技术, 深入分析后发现7个版本

• https://blog.ensilo.com/txhollower-process-doppelganging

[工具]

evil-winrm: Windows远程管理(WinRM) Shell, 终极版, 用于Hacking

• https://github.com/Hackplayers/evil-winrm

20190725

[技术]

针对初学者的Windows Shellcode执行技巧

• https://www.contextis.com/en/blog/a-beginners-guide-to-windows-shellcode-execution-techniques

如何执行网站安全审计

• https://blog.sucuri.net/2019/07/how-to-perform-a-website-security-audit-with-checklist.html

如何分析浏览器插件

• https://maxkersten.nl/binary-analysis-course/binary-types/browser-plug-in/

使用Errant回调实现Oulook沙箱枚举与逃逸

• https://www.bc-security.org/post/i-think-you-have-the-wrong-number-using-errant-callbacks-to-enumerate-and-evade-outlook-s-sandbox

渗透指南Part4: Grabbing Hashes and Forging External Footholds

• https://delta.navisec.io/a-pentesters-guide-part-4-grabbing-hashes-and-forging-external-footholds/

How (not) to sign a JSON object

• https://latacora.micro.blog/2019/07/24/how-not-to.html

Day 5: The VM-Exit Handler, Event Injection, Context Modifications, And CPUID Emulation

• https://revers.engineering/day-5-vmexits-interrupts-cpuid-emulation/

精确比较Win10的进程和线程的内核对象

• https://sscalzo.home.blog/2019/07/24/accurately-comparing-process-thread-kernel-objects-in-windows-10/

[漏洞]

MikroTik RouterOS的2个漏洞(CVE-2019-13954, CVE-2019-13955)

• https://seclists.org/fulldisclosure/2019/Jul/20

U-Boot boot loader 13个RCE漏洞

• https://blog.semmle.com/uboot-rce-nfs-vulnerability/

SnagIt本地提权漏洞(CVE-2019–13382)

• https://posts.specterops.io/cve-2019-13382-local-privilege-escalation-in-snagit-abe5f31c349

[恶意代码]

由俄罗斯特殊技术中心(Special Technology Center)开发的移动平台监控软件(surveillanceware): Monokle

• https://www.lookout.com/documents/threat-reports/lookout-discovers-monokle-threat-report.pdf

Phobos勒索软件深入分析

• https://blog.malwarebytes.com/threat-analysis/2019/07/a-deep-dive-into-phobos-ransomware/

黑客组织FIN8使用的新的反向Shell BADHATCH

• https://atr-blog.gigamon.com/2019/07/23/abadbabe-8badf00d:-discovering-badhatch-and-a-detailed-look-at-fin8's-tooling

挖矿软件WatchBog新变种, 增加BlueKeep漏洞扫描模块和其他Linux Exploit

• https://www.intezer.com/blog-watching-the-watchbog-new-bluekeep-scanner-and-linux-exploits/

[工具]

lesspass: 无状态密码管理器

• https://github.com/lesspass/lesspass
• https://lesspass.com/#/

ATTACK-Python-Client: 访问ATT&CK, Python编写

• https://github.com/hunters-forge/ATTACK-Python-Client

Amazon Inspector: 基于云的漏洞评估工具

• https://resources.infosecinstitute.com/amazon-aws-inspector-walkthrough/

20190724

[技术]

在执行RedTeaming之前, 需要做些什么

• https://threatweek.co.uk/2019/05/29/things-to-do-before-you-conduct-a-red-team-assessment/

AWS IAM提权方法与缓解措施, Part2

• https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/

XXE注入深入解析

• https://www.synack.com/blog/a-deep-dive-into-xxe-injection/

使用ELK实时分析Microsoft Defender ATP的数据

• https://medium.com/p/c435d2943605

揭开区块链的神秘面纱: 关于Benefits、Examples与Choices

• https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/demystifying-blockchain-sifting-through-benefits-examples-and-choices/

[漏洞]

Yes-co ORES Authenticated Persistent Cross-Site Scripting (XSS) Vulnerability

• https://www.pluginvulnerabilities.com/2019/07/23/our-proactive-monitoring-caught-an-authenticated-persistent-cross-site-scripting-xss-vulnerability-in-yes-co-ores/

Grave Vulnerabilità in ProFTPd

• https://blog.yoroi.company/warning/warning-grave-vulnerabilita-in-proftpd/

[恶意代码]

针对亚洲企业的DLTMiner挖矿攻击事件

• https://www.carbonblack.com/2019/07/23/cb-tau-technical-analysis-dltminer-campaign-targeting-corporations-in-asia/

Shade勒索软件通过漏洞利用工具包在日本传播

• https://www.cybereason.com/blog/exploit-kits-shade-into-new-territory

Winnti在针对越南的攻击中使用rtf exploit 8.t

• https://medium.com/p/13300d432272

针对Elasticsearch数据库的多阶段攻击, 投递BillGates/Setag后门, 可将Elasticsearch转变为DDoS僵尸网络

• https://blog.trendmicro.com/trendlabs-security-intelligence/multistage-attack-delivers-billgates-setag-backdoor-can-turn-elasticsearch-databases-into-ddos-botnet-zombies/

在P2P网络中传播的挖矿软件

• https://blog.yoroi.company/research/p2p-worm-spreads-crypto-miners-in-the-wild/

[工具]

Arch加固脚本

• https://gitlab.com/madaidan/arch-hardening-script

subEnum: 子域名爆破脚本

• https://github.com/itsKindred/subEnum

[其他]

通过浏览器扩展发生灾难性数据泄漏事件的报告

• https://securitywithsam.com/2019/07/dataspii-leak-via-browser-extensions/

rapid7对过去9个月内180起渗透测试的回顾与总结

• https://www.rapid7.com/research/report/under-the-hoodie-2019/

2019数据泄漏调查报告

• https://enterprise.verizon.com/en-gb/resources/reports/dbir/

20190723

[技术]

On the IoT road: perks, benefits and security of moving smartly

• https://securelist.com/on-the-iot-road/91833/

Windows DLL搜索路径劫持

• https://resources.infosecinstitute.com/mitre-attck-vulnerability-dll-search-order-hijacking/

Hack the Box (HTB) machines walkthrough series — Blocky

• https://resources.infosecinstitute.com/hack-the-box-htb-walkthrough-blocky/

利用DNS重绑定, 从互联网攻击私有网络

• https://medium.com/@brannondorsey/attacking-private-networks-from-the-internet-with-dns-rebinding-ea7098a2d325

编写Shellcode, 在内存中执行JavaScript/VBScript/JScript和XSL

• https://modexp.wordpress.com/2019/07/21/inmem-exec-script/

MacOS/OSX平台EvilOSX远控实战

• https://www.hackingarticles.in/evilosx-rat-for-macos-osx/

使用ExifTool读/写/操纵多种文件格式的元数据

• https://www.hackingarticles.in/exiftool-a-meta-data-extractor/

向Linux服务器上传枚举工具

• https://prune2000.github.io/post/upload-tools/

RDP: 从补丁到远程代码执行

• https://github.com/blackorbird/APT_REPORT/blob/master/exploit_report/%23bluekeep%20RDP%20from%20patch%20to%20remote%20code%20execution.pdf

[漏洞]

npm的SheetJS模块未对公式注入做任何防御

• https://pankajupadhyay.in/2019/07/22/formula-injection-in-npms-xlsx-module/

Axway SecureTransport 5.x XML Injection / XXE

• https://zero.lol/2019-07-21-axway-securetransport-xml-injection/

COModo沙箱逃逸并提权漏洞(CVE-2019–3969)

• https://medium.com/tenable-techblog/comodo-from-sandbox-to-system-cve-2019-3969-b6a34cc85e67

Jackson反序列化漏洞导致RCE(CVE-2019-12384)

• https://blog.doyensec.com/2019/07/22/jackson-gadgets.html

[恶意代码]

恶意软件IcedID深入解析, Part3: 子进程分析

• https://www.fortinet.com/blog/threat-research/deep-dive-icedid-malware-analysis-of-child-processes.html

利用最近Wordpress漏洞的恶意广告攻击实例

• https://www.wordfence.com/blog/2019/07/recent-wordpress-vulnerabilities-targeted-by-malvertising-campaign/

[工具]

渗透工具收集

• https://prune2000.github.io/tools/pentest/

SUDO_KILLER: 识别并利用sudo规则的错误配置

• https://github.com/TH3xACE/SUDO_KILLER

20190722

[技术]

在Excel中使用VBA绕过AMSI

• https://codewhitesec.blogspot.com/2019/07/heap-based-amsi-bypass-in-vba.html

MySQL HQL注入攻击

• https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/hql-injection-exploitation-in-mysql/

PGP Certificate Flooding攻击(CVE-2019-13050)

• https://tech.michaelaltfield.net/2019/07/14/mitigating-poisoned-pgp-certificates/

利用BLE的安全漏洞追踪匿名蓝牙设备

• https://petsymposium.org/2019/files/papers/issue3/popets-2019-0036.pdf

ROP技巧基础

• https://trustfoundry.net/basic-rop-techniques-and-tricks/

Hack The Box - CTF

• https://0xrick.github.io/hack-the-box/ctf/

WebGoat SQL注入

• https://gitlab.com/BlackSheepSpicy/WebGoat/blob/master/WebGoat%20SQL%20Injection%20(Introduction).pdf

使用ooanalyzer和Ghidra逆向OO代码

• https://insights.sei.cmu.edu/sei_blog/2019/07/using-ooanalyzer-to-reverse-engineer-object-oriented-code-with-ghidra.html

都2019年了, 还不能禁用WOW64

• https://mercaldim.gitbook.io/writeups/20190721

物理渗透介绍

• https://diablohorn.com/2019/07/21/introduction-to-physical-penetration-tests/

交互式地图创建工具Kamerka添加新模块: RTSP与MQTT

• https://medium.com/@woj_ciech/journey-over-unsecured-iot-devices-with-kamerka-rtsp-and-mqtt-aba98839574

理解Docker容器溢出

• https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/

[代码]

InfinityHook: Windows内核驱动, 用于在内核层Hook系统调用call, 上下文切换, 页面错误, DPC等

• https://github.com/everdox/InfinityHook

Cafebabe: Java字节码编辑器

• https://github.com/GraxCode/Cafebabe

dsvpn: 超简易VPN

• https://github.com/jedisct1/dsvpn

Proxadd: 向Proxychains配置中添加代理项

• https://github.com/TheSecondSun/Proxadd

git-hound: 在Github上搜寻暴露的API key

• https://github.com/tillson/git-hound

GameBoy_GhidraSleigh: Ghidra Nintendo Game Boy处理器模块

• https://github.com/CTurt/GameBoy_GhidraSleigh

DrMITM: 记录指定网站的所有流量

• https://github.com/Imgp3Dev/DrMITM

Cloudmare: 获取由Cloudflare保护的网站的真实IP

• https://github.com/MrH0wl/Cloudmare

[其他]

HackerOne总结的网安漏洞Top10

• https://hackwarenews.com/hackerone-breaks-down-the-top-10-cybersecurity-vulnerabilities/

20190719

[技术]

Solving Flaggy Bird (Google CTF 2019)

• https://blog.nviso.be/2019/07/18/solving-flaggy-bird-google-ctf-2019/

Google keep的WebAssembly模块分析

• https://webassembly-security.com/google-keep-webassembly-module-analysis/

Docker与渗透测试

• https://blog.ropnop.com/docker-for-pentesters/

研究人员发现可以轻松的绕过Cylance的基于AI的AV软件的检测

• https://www.vice.com/en_ca/article/9kxp83/researchers-easily-trick-cylances-ai-based-antivirus-into-thinking-malware-is-goodware

• http Security Headers完全指南

• https://nullsweep.com/- http-security-headers-a-complete-guide/

[漏洞]

之前公布的Zoom Mac客户端的漏洞可导致RCE

• https://blog.assetnote.io/bug-bounty/2019/07/17/rce-on-zoom/

DELL Windows电脑预装的SupportAssist又发现了新的本地提权漏洞

• https://d4stiny.github.io/Local-Privilege-Escalation-on-most-Dell-computers/

Android Hevcfright漏洞PoC(CVE-2019-2107)

• https://github.com/marcinguy/CVE-2019-2107

[恶意代码]

Android恶意代码分析之: Hydra Dropper

• https://pentest.blog/android-malware-analysis-dissecting-hydra-dropper/

[代码/工具]

cslogwatch: Cobalt Strike 日志追踪、解析与存储

• https://github.com/attactics/cslogwatch
• https://attactics.org/2019/07/18/cslogwatch-cobalt-strike-tracking-parsing-storage/

GitGot: 快速搜索GitHub上的大量公共数据，以获取敏感的秘密. 半自动化、反馈驱动

• https://github.com/BishopFox/GitGot

CORS-vulnerable-Lab: 与COSR配置错误相关的漏洞代码

• https://github.com/incredibleindishell/CORS-vulnerable-Lab

[其他]

Prisma公开云漏洞扫描API, 扫描Docker镜像/虚拟机

• https://vscanapidoc.redlock.io/

20190718

[技术]

Android智能手机内置的Accelerometer传感器可被用于窃听喇叭传出的声音, 无需任何设备权限

• https://arxiv.org/pdf/1907.05972.pdf

The PGP Problem

• https://latacora.micro.blog/2019/07/16/the-pgp-problem.html

Windows内核调试与漏洞利用, Part1: 环境配置

• https://voidsec.com/windows-kernel-debugging-exploitation/

That XMR is MINE!

• https://pwnable.club/That-XMR-is-MINE/

IoT Hacking: 通过Hack手机App,使与其相连的头发拉直器起火

• https://www.pentestpartners.com/security-blog/burning-down-the-house-with-iot/

使用Radare2的宏和unicorn模拟器解决CrackMe

• https://medium.com/syscall59/re-using-macros-emulation-voodo-to-solve-a-crackme-a90566e9c7c9

使用本地DTD(文件类型声明)文件实现XXE漏洞利用

• https://www.gosecure.net/blog/2019/07/16/automating-local-dtd-discovery-for-xxe-exploitation

在Tinder上可获取任意Instagram用户的用户名

• https://medium.com/bugbountywriteup/wrong-swipe-tinder-29fe1eb0203c

[漏洞]

联想NAS固件漏洞, 可泄漏敏感信息

• https://verticalstructure.com/best-practices-in-identifying-and-remediating-vulnerabilities

LibreLogo任意脚本执行漏洞(CVE-2019-9848)

• https://www.libreoffice.org/about-us/security/advisories/cve-2019-9848

LLVM Arm后端的栈保护特性, 在某些情况下会变得无效, 被保护函数可能遭受基于栈的攻击

• https://www.kb.cert.org/vuls/id/129209/

Palo Alto的SSL VPN产品GlobalProtect的预认证RCE漏洞, 静默修补的1Day

• http://blog.orange.tw/2019/07/attacking-ssl-vpn-part-1-preauth-rce-on-palo-alto.html

Oracle Business Intelligence的多个漏洞

• https://github.com/vah13/Oracle-BI-bugs

[恶意代码]

Hong Kong Based Malvertiser Brokers Traffic To Fake Antivirus Scams — Over 100 Million Ads Compromised In 2019 So Far

• https://blog.confiant.com/hong-kong-based-malvertiser-brokers-traffic-to-fake-antivirus-scams-over-100-million-ads-300e251eff06

勒索软件Lucky分析与文件加密

• https://medium.com/@knownsec404team/lucky-ransomware-analysis-and-file-decryption-1581a7180c1c

[代码/工具]

Dlint: Python代码安全性审查

• https://github.com/duo-labs/dlint

[其他]

Binary Ninja出了云端版本

• https://binary.ninja/2019/07/17/cloud-open-beta-is-live.html

反人脸识别眼镜

• https://www.hackread.com/meet-irpair-anti-facial-recognition-glasses/

20190717

[技术]

Exploring the Power of Phished Persistent Cookies in AWS

• https://rhinosecuritylabs.com/aws/aws-phished-persistent-cookies/

身份认证设备(例如YubiKey)是如何存储凭证的

• https://duo.com/labs/tech-notes/how-security-keys-store-credentials

通过对漏洞代码创建模型, 实现漏洞的自动化挖掘

• https://www.zerodayinitiative.com/blog/2019/7/16/mindshare-automated-bug-hunting-by-modeling-vulnerable-code

Windows系统中不同的本地提权方法, 以及如何检测

• https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment

逆向与汇编入门介绍

• https://3keys.dev/2019/07/16/assembly/

[漏洞]

基于以太坊的P2P交易协议0x的严重漏洞

• https://medium.com/p/b0cbc31a76e

使用KNOXSS查找到的小米网站反射XSS漏洞

• https://learn.hackersid.com/2019/07/reflected-xss-on-xiaomi-with-knoxss.html

Slack漏洞可导致中间人攻击

• https://sysrant.com/500-bounty-man-in-the-middle-on-slack/

TYPO3 CMS严重漏洞解析(CVE-2019-12747), 可导致RCE

• https://blog.ripstech.com/2019/typo3-overriding-the-database/

FreeBSD内核解析ELF头的漏洞可导致内核内存泄漏(CVE-2018-6924)

• https://blog.quarkslab.com/cve-2018-6924-freebsd-elf-header-parsing-kernel-memory-disclosure.html

[恶意代码]

修改DNS的木马Extenbro, 阻止主机访问安全网站域名

• https://blog.malwarebytes.com/trojans/2019/07/extenbro-a-new-dns-changer-trojan-protecting-adware/

银行木马Metamorfo变种

• https://blog.ensilo.com/metamorfo-avast-abuser

[工具]

riposte: 使用Python编写交互式Shell工具

• https://github.com/fwkz/riposte

racepwn: 测试使用TCP连接的协议是否有Race Condition漏洞的框架

• https://github.com/racepwn/racepwn

SLUB恶意软件与C&C通信的方式抛弃了Github, 改为主要使用Slack

• https://blog.trendmicro.com/trendlabs-security-intelligence/slub-gets-rid-of-github-intensifies-slack-use/

[其他]

防御0Day攻击白皮书

• https://pages.checkpoint.com/zero-day-attack-prevention.html

Kali NetHunter App商店

• https://store.nethunter.com

20190716

[技术]

在树莓派上安装Kali

• https://cyberarms.wordpress.com/2019/07/15/installing-kali-linux-on-raspberry-pi-partial-book-chapter/

设计恶意网站, 使爬虫在爬取网站内容时泄露爬虫所在主机的敏感信息

• https://medium.com/alertot/web-scraping-considered-dangerous-leaking-files-from-the-spiders-host-bd508f81d498

使用PAM和JEA辅助Privileged Active Directory安全管理

• https://lolware.net/2019/07/13/ad-security-with-pam.html

小米Zigbee分析, Part3: 实时调试

• https://alephsecurity.com/2019/07/15/xiaomi-zigbee-3/

FUDGE: Fuzz Driver Generation at Scale

• https://ai.google/research/pubs/pub48314

Exploiting TurboFan Through Bounds Check Elimination

• https://gts3.org/2019/turbofan-BCE-exploit.html

如何破解数十亿的密码？

• https://medium.com/@ScatteredSecrets/how-to-crack-billions-of-passwords-6773af298172

Linux文本操作命令ed提权漏洞利用

• https://www.hackingarticles.in/linux-for-pentester-ed-privilege-escalation/

Active Directory中滥用Kerberos delegation

• https://horizon.guidepointsecurity.com/tutorials/delegating-like-a-boss-abusing-kerberos-delegation-in-active-directory/

[漏洞]

我是如何发现了1个可以hack任意Instagram账户的Instagram漏洞的

• https://thezerohack.com/hack-any-instagram

WhatsApp和Telegram的Android端App的媒体文件可被劫持

• https://www.symantec.com/blogs/expert-perspectives/symantec-mobile-threat-defense-attackers-can-manipulate-your-whatsapp-and-telegram-media

Wordpress插件Ad Inserter RCE漏洞

• https://www.wordfence.com/blog/2019/07/critical-vulnerability-patched-in-ad-inserter-plugin/

PHP Laravel框架token反序列化RCE漏洞利用模块

• https://packetstormsecurity.com/files/153641/laravel_token_unserialize_exec.rb.txt

Airbnb账户接管漏洞, Part2

• https://medium.com/@princechaddha/account-takeover-on-airbnb-acquisition-an-unusual-bug-part-2-45fab11dc407

[恶意代码]

APT组织Lazarus的最新攻击活动分析

• https://blog.alyac.co.kr/2418

非官方的Telegram App向用户推送广告

• https://www.symantec.com/blogs/threat-intelligence/unofficial-telegram-app-malicious-sites

[工具]

lain: Rust编写的Fuzz框架

• https://github.com/microsoft/lain

griscv: Ghidra插件, RISC-V处理器模块

• https://github.com/lcq2/griscv

passpie: 跨平台密码管理器, 命令行工具

• https://github.com/marcwebbie/passpie
• https://passpie.readthedocs.io/en/latest/

pown-duct: 使用DNS side-channels查找盲注攻击

• https://github.com/pownjs/pown-duct

20190715

[技术]

Tesla Model 3破解(Bug Bounty)

• https://samcurry.net/cracking-my-windshield-and-earning-10000-on-the-tesla-bug-bounty-program/

深入挖掘WSL P9文件系统

• https://tyranidslair.blogspot.com/2019/07/digging-into-wsl-p9-file-system.html

iOS URL Scheme容易被劫持

• https://blog.trendmicro.com/trendlabs-security-intelligence/ios-url-scheme-susceptible-to-hijacking/

隐写术实战: 将任意文本隐藏在音频/视频/图像和文本中的多种方式

• https://www.hackingarticles.in/steganography-the-art-of-concealing/

HackTheBox Writeups: Friendzone

• https://mzfr.github.io/HackTheBox-writeups/Friendzone/
• https://0xrick.github.io/hack-the-box/friendzone/

以漏洞猎人的视角, 探索持续集成服务

• https://edoverflow.com/2019/ci-knew-there-would-be-bugs-here/

VMCS(虚拟机控制结构)初始化、分段和操作可视化

• https://revers.engineering/day-4-vmcs-segmentation-ops/

Hooking Golden Axe VBlanks

• https://zznop.github.io/romhacking/2019/07/14/hooking-golden-axe-vblanks.html

[漏洞]

去中心化身份管理系统Atlassian Crowd RCE漏洞(CVE-2019-11580)

• https://www.corben.io/atlassian-crowd-rce/

[恶意代码]

研究人员发现的使用公有云服务器(Azure)做C&C的复杂的攻击事件

• https://securityboulevard.com/2019/07/detecting-the-impossible-serverless-c2-in-the-cloud/amp/

分析1个最终释放Ursnif的混淆脚本

• https://isc.sans.edu/diary/Russian+Dolls+Malicious+Script+Delivering+Ursnif/25126

[代码/工具]

Revssl: 自动生成 OpenSSL 反向Shell

• https://github.com/TheSecondSun/Revssl

secretz: 减小持续集成服务的攻击面

• https://github.com/lc/secretz

pyattck: 与ATT&CK框架交互, Python模块

• https://github.com/swimlane/pyattck

Ghostfuscator: 将Python脚本混淆, 并添加密码保护. 使用AES加密

• https://github.com/alberties/Ghostfuscator

RL78_sleigh: Ghidra插件, RL78 ISA的具体实现

• https://github.com/hedgeberg/RL78_sleigh

[其他]

数据泄漏查询, 收集了7780起数据泄漏事件泄漏的数据

• https://weleakinfo.com/

20190712

[技术]

Hack the Box (HTB) machines walkthrough series — YPuffy

• https://resources.infosecinstitute.com/hack-the-box-htb-walkthrough-ypuffy

黑客大会里头, 啥都不安全, 比如: 咖啡机

• https://medium.com/p/8501bf14f41a

渗透实战之: 提取敏感的固件数据

• https://www.youtube.com/watch?v=wxEebZkJj5s

CSP解析, 以及常见的绕过策略

• https://blog.detectify.com/2019/07/11/content-security-policy-csp-explained-including-common-bypasses/

Fuzzing DNS zone解析器

• https://www.cambus.net/fuzzing-dns-zone-parsers/

ZoneMinder Second order SQL injection

• https://www.qbit.nl/blog/second-order-sql-injection-in-zoneminder/

[漏洞]

在iOS 13 Public Beta 2 和 Developer Beta 3 版本中, Face ID在允许访问iCloud Keychain之前没有进行认证

• https://thetapedrive.com/face-id-fail-ios-13

Citrix SD-WAN Center (SDWC)和SD-WAN本身的多个严重漏洞, 以及可组合的漏洞利用链

• https://medium.com/tenable-techblog/an-exploit-chain-against-citrix-sd-wan-709db08fb4ac

我们是如何发现2个漏洞的(exiv2:CVE-2019-13504)(mongoose:CVE-2019-13503), 以及API Fuzzing的重要性

• https://fuzzit.dev/2019/07/11/discovering-cve-2019-13504-cve-2019-13503-and-the-importance-of-api-fuzzing/

ChakraCore的1个可导致RCE的漏洞

• https://phoenhex.re/2019-07-10/ten-months-old-bug

[恶意代码]

揭秘黑客组织Buhtrap, 及其在最近的攻击中使用的0Day

• https://www.welivesecurity.com/2019/07/11/buhtrap-zero-day-espionage-campaigns/

‘Oto Gonderici’ Excel formula injections target Turkish victims

• https://news.sophos.com/en-us/2019/07/11/oto-gonderici-excel-formula-injections-target-turkish-victims

[工具]

Cisco Threat Response Casebook: 浏览器插件, 收集并检测网页中可能存在的IoC

• https://blogs.cisco.com/security/cisco-threat-response-plugin-defeat-threats-with-just-a-few-clicks

boomerang: Boomerang反编译器

• https://github.com/BoomerangDecompiler/boomerang

echidna: Ethereum Fuzzing框架

• https://github.com/crytic/echidna

[其他]

Awesome-Mainframe-Hacking: Mainframe Hacking/渗透资源收集

• https://github.com/samanL33T/Awesome-Mainframe-Hacking

Awesome-Cellular-Hacking: Cellular Hacking资源收集

• https://github.com/W00t3k/Awesome-Cellular-Hacking

20190711

[技术]

在macOS上狩猎恶意软件

• https://www.sentinelone.com/blog/malware-hunting-macos-practical-guide/

在QEMU上运行最新版的Android Oreo, 并用Burp拦截所有流量

• https://astr0baby.wordpress.com/2019/07/09/android-8-1-in-qemu-and-burp-suite-ssl-interception/

Decoded: Rogue

• http://www.maizure.org/projects/decoded-rogue/index.html

Frida高级应用之: 将混淆的原生库变为Web API

• https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/june/advanced-frida-witchcraft-turning-an-android-application-into-a-voodoo-doll/

使用SPF(Sender Policy Framework)宏检测钓鱼

• https://duo.com/labs/tech-notes/detecting-phishing-with-spf-macros

使用Windows注册表的Waves Maxx Audio项实现DLL旁加载

• https://versprite.com/blog/security-research/windows-registry/

[漏洞]

Selfblow exploit,影响所有Tegra设备

• https://github.com/balika011/selfblow

罗技几款键盘鼠标的漏洞, 可导致攻击者窃听按键，感染主机

• https://www.heise.de/ct/artikel/Logitech-keyboards-and-mice-vulnerable-to-extensive-cyber-attacks-4464533.html

Windows ActiveX数据对象(ADO) UAF漏洞(CVE-2019-0888)

• https://news.sophos.com/en-us/2019/07/09/cve-2019-0888-use-after-free-in-windows-activex-data-objects-ado/

在野发现的Windows本地提权0Day(CVE‑2019‑1132)

• https://www.welivesecurity.com/2019/07/10/windows-zero-day-cve-2019-1132-exploit/

Bol.com XXE漏洞

• https://medium.com/@jonathanbouman/xxe-at-bol-com-7d331186de54

[恶意代码]

研究人员发现间谍软件FinSpy的iOS和Android版本

• https://securelist.com/new-finspy-ios-and-android-implants-revealed-itw/91685

针对NAS设备的勒索软件QNAPCrypt

• https://thehackernews.com/2019/07/ransomware-nas-devices.html

Android平台恶意软件Agent Smith, 感染量2500万

• https://blog.checkpoint.com/2019/07/10/agent-smith-android-malware-mobile-phone-hack-virus-google/

Mirai的新变种Miori, 使用独特的基于二进制的协议与C&C通信

• https://blog.trendmicro.com/trendlabs-security-intelligence/new-miori-variant-uses-unique-protocol-to-communicate-with-cc/

[工具]

disasm.ninja: 实时汇编/反汇编工具

• https://github.com/ret2got/disasm.ninja

cloud-security-audit: AWS安全审计工具

• https://github.com/Appliscale/cloud-security-audit

20190710

[技术]

Hack the Box: Netmon Walkthrough hackingarticles.in/hack-the-box-netmon-walkthrough

小米Zigbee协议分析, Part2

• https://alephsecurity.com/2019/07/09/xiaomi-zigbee-2/

CloudGoat Official Walkthrough Series: “rce_web_app”

• https://rhinosecuritylabs.com/aws/cloudgoat-walkthrough-rce_web_app/

使用RAMDisk和自定义PE Loader绕过AV/EDR

• https://medium.com/@d.bougioukas/red-team-diary-entry-1-making-nsas-peddlecheap-rat-invisible-f88ccbdc484d

测试Flash内存芯片是否可以融化

• https://blog.nviso.be/2019/07/09/will-they-melt-testing-the-resistance-of-flash-memory-chips/

Android App绕过系统权限设置的研究

• https://www.ftc.gov/system/files/documents/public_events/1415032/privacycon2019_serge_egelman.pdf

针对加密货币业务的鱼叉攻击

• https://blogs.jpcert.or.jp/en/2019/07/spear-phishing-against-cryptocurrency-businesses.html

海龟DNS劫持攻击事件

• https://blog.talosintelligence.com/2019/07/sea-turtle-keeps-on-swimming.html

[漏洞]

Logitech无线设备漏洞汇总

• https://github.com/mame82/misc/blob/master/logitech_vuln_summary.md

[恶意代码]

IcedID深入分析, Part1: 脱壳, Hook与进程注入 fortinet.com/blog/threat-research/icedid-malware-analysis-part-one.html

[代码/工具]

Vxscan: 敏感文件探测(目录扫描与js泄露接口)，WAF/CDN识别，端口扫描，指纹/服务识别，操作系统识别，弱口令探测，POC扫描，SQL注入，绕过CDN，查询旁站等功能

• https://github.com/al0ne/Vxscan

QCSuper: 在高通手机/猫上, 捕获无线2G/3G/4G数据包

• https://github.com/P1sec/QCSuper

rifiuti2: Windows回收站分析工具

• https://github.com/abelcheung/rifiuti2

linux-smart-enumeration: Linux系统安全相关信息枚举工具, 可用于渗透或CTF

• https://github.com/diego-treitos/linux-smart-enumeration

DeTTECT: 辅助蓝对检测ATT&CK, 对抗威胁

• https://github.com/rabobank-cdc/DeTTECT

[其他]

漏洞赏金资源收集

• https://github.com/SmitherSec/bug-bounty-resources

20190709

[技术]

DIY无线磁悬浮月亮灯

• https://mcuoneclipse.com/2019/07/06/diy-wireless-magnetic-levitating-moon-lamp/

Time-efficient assessment of open-source projects for Red Teamers

• https://2019.pass-the-salt.org/files/slides/11-Time_efficient_%20assessment_of_%20open-source_projects_for_Red_Teamers.pdf

Seriously, stop using RSA

• https://blog.trailofbits.com/2019/07/08/fuck-rsa/

WCTF2019: Gyotaku The Flag

• https://westerns.tokyo/wctf2019-gtf/wctf2019-gtf-slides.pdf

[漏洞]

Mac Zoom客户端漏洞, 可导致恶意网站在未经用户许可下启用摄像头, 400万用户受影响

• https://medium.com/@jonathan.leitschuh/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5

libssh2整数溢出与越界读取漏洞(CVE-2019-13115)

• https://blog.semmle.com/libssh2-integer-overflow

FreeBSD文件描述符引用计数泄漏漏洞利用(CVE-2019-5596)

• https://secfault-security.com/blog/FreeBSD-SA-1902.fd.html

GLPI < 9.4.3存储型XSS漏洞

• https://www.synacktiv.com/ressources/advisories/GLPI_9.4.0_stored_XSS.pdf

GLPI < 9.4.1不安全的密码重置漏洞

• https://www.synacktiv.com/ressources/advisories/GLPI_9.4.0_unsafe_reset.pdf

Windows内核UAF/Double Free漏洞分析(CVE-2018-8453)

• https://github.com/thepwnrip/leHACK-Analysis-of-CVE-2018-8453

索尼BRAVIA智能电视DoS漏洞 exploit.kitploit.com/2019/07/sony-bravia-smart-tv-denial-of-service.html

[恶意代码]

Maze勒索软件 carbonblack.com/2019/07/08/cb-tau-threat-intelligence-notification-maze-ransomware

在针对韩国的攻击中, 攻击者使用种子文件(torrent)传播后门

• https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/

研究人员在Ruby的strong_password库中发现后门

• https://securityaffairs.co/wordpress/88093/hacking/ruby-strong_password-library-backdoor.html

Android平台恶意软件Anubis新变种

• https://blog.trendmicro.com/trendlabs-security-intelligence/anubis-android-malware-returns-with-over-17000-samples/

银行木马Dridex利用RMS远控进行传播

• https://cofense.com/double-duty-dridex-banking-malware-delivered-rms-rat/

使用非主流格式文件作为初始Dropper的恶意软件逐渐增多, 有其实ISO镜像文件

• https://blog.yoroi.company/research/spotting-rats-tales-from-a-criminal-attack/

Microsoft Defender ATP发现的Astaroth无文件攻击

• https://www.microsoft.com/security/blog/2019/07/08/dismantling-a-fileless-campaign-microsoft-defender-atp-next-gen-protection-exposes-astaroth-attack/

[工具]

Kali-Linux-Tools-Interface: 通过Web界面, 使用各种Kali工具

• https://github.com/lucasfrag/Kali-Linux-Tools-Interface

SneakyEXE: 在自定义的Payload中嵌入"UAC绕过"功能

• https://github.com/Zenix-Blurryface/SneakyEXE

20190708

[技术]

Symfonos:1 Vulnhub Walkthrough

• https://www.hackingarticles.in/symfonos1-vulnhub-walkthrough/

用.git实现提权(Linux系统)

• https://www.hackingarticles.in/linux-for-pentester-git-privilege-escalation/

WCTF2019 TPM2137

• https://github.com/q3k/tpm2137

WCTF 2019 Onsite(Master) Challenge

• https://github.com/r3kapig/WCTF-2019

利用PHP查询字符串的解析器, 绕过IDS/IPS/WAF

• https://www.secjuice.com/abusing-php-query-string-parser-bypass-ids-ips-waf/

Android App逆向教程

• https://github.com/tlamb96/kgb_messenger
• https://www.youtube.com/watch?v=ddxhuz1bmj4

Hack The Box - Hackback

• https://0xrick.github.io/hack-the-box/hackback/

Win10 NT 堆漏洞利用

• https://www.slideshare.net/AngelBoy1/windows-10-nt-heap-exploitation-chinese-version

[漏洞]

Razer Surround 提权漏洞(CVE-2019–13142)

• https://posts.specterops.io/cve-2019-13142-razer-surround-1-1-63-0-eop-f18c52b8be0c

QEMU漏洞, 可导致在Guest系统中使QEMU崩溃

• https://lists.nongnu.org/archive/html/qemu-devel/2019-07/msg01651.html

思科数据中心网络管理器的认证绕过漏洞和任意文件上传漏洞, 导致RCE(PoC)

• https://raw.githubusercontent.com/pedrib/PoC/master/advisories/cisco-dcnm-rce.txt

Linux Mint 18.3-19.1 'yelp'命令注入漏洞

• https://github.com/b1ack0wl/linux_mint_poc

聊天客户端irssi UAF漏洞

• http://blog.firosolutions.com/exploits/irssi2019/

[代码/工具]

MouHidInputHook: 向HID USB鼠标设备的输入数据流中注入数据包, 并可对数据流进行过滤和修改, 无需修改鼠标设备栈

• https://github.com/changeofpace/MouHidInputHook
• https://github.com/changeofpace/MouClassInputInjection

emu-strings: JS/VBS恶意软件自动化分析系统

• https://github.com/psrok1/emu-strings

[其他]

移动渗透测试清单

• https://hackersonlineclub.com/mobile-security-penetration-testing/

20190705

[技术]

IDA批量反编译

• http://www.hexacorn.com/blog/2019/07/04/batch-decompilation-with-ida-hex-rays-decompiler/

如何将Windows SFS(动态磁盘)分区转换为可用于正常取证分析的分区

• https://www.andreafortuna.org/2019/07/04/how-to-convert-a-windows-sfs-dynamic-disks-partition-to-regular-partition-for-forensic-analysis/

测试SAML终端挖掘XML Signature Wrapping漏洞

• https://web-in-security.blogspot.com/2019/07/testing-saml-endpoints-for-xml.html

逆向网游Dofus的游戏文件

• https://dev.to/crimsonmed/reverse-engineering-game-files-217e

[漏洞]

Android系统EvilParcel漏洞分析

• https://habr.com/en/company/drweb/blog/457610/

The D-Link DIR-655C - From Nothing to RCE

• https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/july/the-d-link-dir-655c-from-nothing-to-rce/

3款虚拟现实产品存在漏洞, 可导致攻击者控制虚拟聊天室, 操纵用户行为

• https://www.vice.com/en_us/article/8xz33p/hackers-hijacked-vr-chatrooms-to-manipulate-users-reality

[恶意代码]

黑客组织TA505在最近的攻击中使用的Gelup和FlowerPippi后门

• https://documents.trendmicro.com/assets/Tech-Brief-Latest-Spam-Campaigns-from-TA505-Now-Using-New-Malware-Tools-Gelup-and-FlowerPippi.pdf

[代码/工具]

Hexext: 通过修改IDA反编译结果的microcode, 优化反编译结果

• https://github.com/chrisps/Hexext

fbchecker: 大规模Facebook账户验证

• https://github.com/fdciabdul/fbchecker

[其他]

公有云安全的7个最佳实战

• https://news.sophos.com/en-us/2019/07/04/7-best-practices-for-securing-the-public-cloud/

在VirtualBox中运行macOS Catalina Beta版本

• https://astr0baby.wordpress.com/2019/07/04/running-macos-catalina-beta-on-virtualbox-linux/

20190704

[技术]

绕过Chrome下载保护

• https://wwws.nightwatchcybersecurity.com/2019/07/02/another-download-protection-bypass-in-google-chrome-bin-files-in-mac-os/

(CTF)IDS Bypass contest at PHDays: writeup and solutions

• http://blog.ptsecurity.com/2019/07/ids-bypass-contest-at-phdays-writeup.html

Windows系统安装Ghidra

• https://youtu.be/IL60yGDbRGw

使用短域名生成器绕过IDOR保护

• https://blog.detectify.com/2019/07/03/lerhan-bypassing-idor-protection-with-url-shorteners/

使用Postman辅助进行API渗透测试, Part4

• https://blog.secureideas.com/2019/06/better-api-penetration-testing-with-postman-part-4.html

EternalRelay攻击指南

• https://medium.com/@technicalsyn/eternalrelayx-py-non-admin-ntlm-relaying-eternalblue-exploitation-dab9e2b97337

[漏洞]

智能协议的Gridlock漏洞

• https://blog.trailofbits.com/2019/07/03/avoiding-smart-contract-gridlock-with-slither/

Firefox种潜藏17年之久的漏洞: 用Firefox打开下载的html文件, 可导致攻击者窃取磁盘文件

• https://quitten.github.io/Firefox/

Simple DirectMedia Layer RCE漏洞

• https://blog.talosintelligence.com/2019/07/vulnerability-spotlight-SDL-PCX-RCE-vulnerabilities-july-19.html

Wordpress插件WP Statistics存储XSS漏洞

• https://blog.sucuri.net/2019/07/wordpress-plugin-wp-statistics-unauthenticated-stored-xss-under-certain-configurations.html

[恶意软件]

Sodin勒索软件

• https://securelist.com/sodin-ransomware/91473/

Android平台银行木马BianLian更新录屏功能

• https://www.bleepingcomputer.com/news/security/bianlian-android-banking-trojan-upgraded-with-screen-recorder/

Trickbot木马增加Cookie窃取模块

• https://www.bleepingcomputer.com/news/security/trickbot-trojan-now-has-a-separate-cookie-stealing-module/

持续活跃的Fallout漏洞利用工具包

• https://www.cybereason.com/blog/watch-where-you-browse-the-fallout-exploit-kit-stays-active

Android平台样本BianLian

• https://www.fortinet.com/blog/threat-research/new-wave-bianlian-malware.html

[代码/工具]

jeb-plugin-libra: JEB插件, 用于Libra反编译

• https://github.com/pnfsoftware/jeb-plugin-libra

AntiCheat-Testing-Framework: 用于测试反作弊系统的框架, 可用于测试市场上所有的反作弊系统

• https://github.com/niemand-sec/AntiCheat-Testing-Framework

hash-identifier: Software to identify the different types of hashes used to encrypt data and especially passwords

• https://github.com/blackploit/hash-identifier

[其他]

暗网发展的7个趋势

• https://securityintelligence.com/articles/7-ways-the-hidden-world-of-the-darknet-is-evolving/

Youtube发布新策略, 禁止上传Hacking教程

• https://www.malwaretech.com/2019/07/youtubes-new-policy-on-hacking-tutorial-is-a-problem.html

20190703

[技术]

(CTF) Hack the Box (HTB) machines walkthrough series — Hawk

• https://resources.infosecinstitute.com/hack-the-box-htb-walkthrough-hawk/

漏洞赏金方法论

• https://eforensicsmag.com/bug-bounty-methodology-ttp-tacticstechniques-and-procedures-v-2-0/

Seeing Inside The Encrypted Envelope

• https://drive.google.com/file/d/1TkBq8Y8pBmNM-uBV3p5TyMF_ZAWVTyVY/view

调试三星Android内核, Part3

• https://medium.com/@alex91ar/debugging-the-samsung-android-kernel-part-3-c27e916c9a7d

使用反向Shell控制摄像头

• https://ctrlaltdel.blog/2019/07/02/reverse-shells-and-controlling-webcams/

Web App渗透测试清单

• https://www.apriorit.com/dev-blog/622-qa-web-application-pen-testing-owasp-checklist

绕过思科AnyConnect对VPN连接的阻断, 可通过VPN执行渗透测试等

• https://blog.silentsignal.eu/2019/07/02/evading-cisco-anyconnect-blocking-lan-connections/

使用Sqlmap挖掘SQL注入漏洞

• https://dev.to/silviobuss/are-you-vulnerable-to-a-sql-injection-attack-exploiting-with-sqlmap-4087

使用Burp挖掘Web App中的提权漏洞

• https://sirpwnalot.blogspot.com/2019/06/hunting-for-privilege-escalation-with.html

分析Arlo安全摄像头

• https://medium.com/tenable-techblog/an-analysis-of-arlo-6f1b691236b5

哈系碰撞详解

• https://speakerdeck.com/ange/colltris

快速定位ELF恶意软件变种的main()函数的行之有效的方法

• https://blog.trendmicro.com/trendlabs-security-intelligence/a-quick-and-efficient-method-for-locating-the-main-function-of-linux-elf-malware-variants/

[漏洞]

Windows错误报告组件的0Day(CVE-2019-0863)

• https://unit42.paloaltonetworks.com/tale-of-a-windows-error-reporting-zero-day-cve-2019-0863/

MailEnable邮件服务器的多个漏洞

• https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-mailenable/

Magento 2.3.1: 未授权存储XSS与RCE

• https://blog.ripstech.com/2019/magento-rce-via-xss/

Zipato智能Hub的3个漏洞

• https://blackmarble.sh/zipato-smart-hub/

[恶意软件]

Mac平台恶意软件OSX/CrescentCore

• https://www.intego.com/mac-security-blog/osx-crescentcore-mac-malware-designed-to-evade-antivirus/

分析在野发现的Go语言编写的恶意软件

• https://unit42.paloaltonetworks.com/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/

LooCipher勒索软件

• https://blog.yoroi.company/research/loocipher-the-new-infernal-ransomware/

[代码/工具]

opencti: 开源的网络安全情报平台

• https://github.com/OpenCTI-Platform/opencti

[其他]

从公开的泄漏数据中收集到的以.fr结尾的邮箱的常用密码

• https://github.com/tarraschk/richelieu

在云服务器提供商DigitalOcean的服务器上用官方Kali镜像构建系统

• https://www.kali.org/news/kali-linux-in-the-digitalocean-cloud/

20190702

[技术]

JEB的多架构反汇编器的设计

• https://docs.google.com/presentation/d/17Vlv5JD8fGeeNMQqDuwDQXN3d9U6Yxmfb1aebfbMM98/view

小米的智能IoT设备使用的Zigbee协议分析, Part1: 硬件部分

• https://alephsecurity.com/2019/07/01/xiaomi-zigbee-1/

Kill MD5: 揭开哈系碰撞的神秘面纱

• https://speakerdeck.com/ange/kill-md5

驻留技巧的演变过程

• https://github.com/REhints/Publications/blob/master/Conferences/OFFZONE'2019/offzone2019_keynote_public.pdf

拦截kerberos认证过程的第1个数据包, 获取用户密码的hash

• https://dumpco.re/blog/asreqroast

使用网络映射工具amass做自动化攻击面映射

• https://danielmiessler.com/study/amass/

Chrome的2个可被滥用的特性: PNaCl与Chromium-Intercept

• https://shhnjk.blogspot.com/2019/07/intro-to-chromes-gold-features.html

我们是如何黑掉学校里的智能家居的

• https://securelist.com/fibaro-smart-home/91416/

Metasploit基础操作, Part5: Metasploit 5中添加的新的免杀模块

• https://www.hackers-arise.com/single-post/2019/03/27/Metasploit-Basics-for-Hackers-Part-24-The-New-Evasion-Modules-in-Metasploit-5

[漏洞]

去年修补的Firefox UAF漏洞CVE-2018-18492分析

• https://www.zerodayinitiative.com/blog/2019/7/1/the-left-branch-less-travelled-a-story-of-a-mozilla-firefox-use-after-free-vulnerability

Centreon v19.04 RCE漏洞(CVE-2019-13024)

• https://shells.systems/centreon-v19-04-remote-code-execution-cve-2019-13024/

V8引擎Array.prototype内存崩溃漏洞

• https://blog.talosintelligence.com/2019/07/vulnerability-spotlight-Google-V8-June-19.html

[恶意代码]

使用Radare2分析恶意软件Robbinhood

• https://goggleheadedhacker.com/blog/post/12

Godlua后门分析

• https://blog.netlab.360.com/an-analysis-of-godlua-backdoor-en/

APT组织海莲花在针对越南的攻击中使用远控Ratsnif, 修改网页并劫持SSL

• https://threatvector.cylance.com/en_us/home/threat-spotlight-ratsnif-new-network-vermin-from-oceanlotus.html

恶意软件使用新型的Loader躲避杀软

• https://blog.talosintelligence.com/2019/07/rats-and-stealers-rush-through-heavens.html

谷歌商店和第3方App商店发现大量伪装为游戏/摄像机App, 实际为广告软件

• https://blog.trendmicro.com/trendlabs-security-intelligence/adware-campaign-identified-from-182-game-and-camera-apps-on-google-play-and-third-party-stores-like-9apps/

逆向Brazilian远控

• https://securityintelligence.com/posts/taking-over-the-overlay-reverse-engineering-a-brazilian-remote-access-trojan-rat/

[工具]

robotstxt: robots.txt解析与匹配工具

• https://github.com/google/robotstxt

20190701

[技术]

(CTF)Hack The Box - Netmon

• https://0xrick.github.io/hack-the-box/netmon/

PHDays "Best Reverser" contest (SEGA Genesis/MD ROM) write-up

• http://romhack.github.io/doc/segaBestReverserWriteup/

GOTCHA: Taking phishing to a whole new level

• https://medium.com/intigriti/gotcha-taking-phishing-to-a-whole-new-level-72eda9e30bef

为Windows X64编写Shellcode

• https://nytrosecurity.com/2019/06/30/writing-shellcodes-for-windows-x64/

侦察自动化指南

• https://medium.com/bugbountywriteup/beginners-guide-to-recon-automation-f95b317c6dbb

利用二维码钓鱼, 躲避URL检测

• https://cofense.com/radar-phishing-using-qr-codes-evade-url-analysis/

漏洞赏金Tips收集

• https://medium.com/@vignesh4303/collection-of-bug-bounty-tip-will-be-updated-daily-605911cfa248

[漏洞]

KeySteal: Apple Keychain漏洞利用

• https://objectivebythesea.com/v2/talks/OBTS_v2_Henze.pdf

SKS Keyserver Network Under Attack

• https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f

开源PaaS的用户账户和认证服务器的2个漏洞

• https://www.twistlock.com/labs-blog/cloud-foundry-uaa-cve-2019-11268-identity-zones-sql-vulnerability/

Microsoft Teams的更新功能可被用于下载恶意包, 导致任意代码执行

• https://medium.com/@reegun/nuget-squirrel-uncontrolled-endpoints-leads-to-arbitrary-code-execution-80c9df51cf12

[恶意代码]

跟踪驱动程序发现的Rootkit

• https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/

多阶段恶意软件Nicro最终执行Payload的过程分析

• https://github.com/maddiestone/ConPresentations/blob/master/REcon2019.PathToThePayload.pdf

TrickBot变种分析, 采用了新的注入技巧

• http://garwarner.blogspot.com/2019/06/trickbot-new-injects-new-host.html

谷歌商店发现的恐怖游戏, 带窃密功能

• https://www.wandera.com/mobile-security/scary-granny-game-stealing-data/

Dridex变种躲避杀软的新方式

• https://www.esentire.com/blog/new-dridex-variant-evading-traditional-antivirus/

[代码/工具]

cutter-plugins: Cutter插件和脚本列表

• https://github.com/radareorg/cutter-plugins

awesome-frida-ui: 为Frida编写的UI

• https://github.com/viva-frida/awesome-frida-ui

PivotSuite: 网络Pivoting工具包, 使用被攻克的系统在网络内部移动

• https://github.com/RedTeamOperations/PivotSuite

burp-extensions: Burp扩展收集

• https://github.com/Meatballs1/burp-extensions

渗透测试/OSCP清单

• https://github.com/OlivierLaflamme/Cheatsheet-God

20190628

[技术]

字符串连接和格式字符串漏洞的问题探讨

• https://www.netsparker.com/blog/web-security/string-concatenation-format-string-vulnerabilities/

无需Multi-Meter识别UART Pins

• https://blog.securelayer7.net/identifying-uart-pins-without-a-multi-meter/

ARM漏洞利用系列之: ARM架构介绍

• https://blog.securelayer7.net/arm-exploitation-series-1-introduction-to-the-arm-architecture/

Inside the MSRC – Anatomy of a SSIRP incident

• https://msrc-blog.microsoft.com/2019/06/27/inside-the-msrc-anatomy-of-a-ssirp-incident/

来自**的黑客组织Cloud Hopper, 长期针对大型企业的客户进行攻击, 目标包括IBM，HPE，Tata CS，富士通和NTT

• https://www.reuters.com/investigates/special-report/china-cyber-cloudhopper/

Windows操作系统引入的Application shimming可扰乱导入表恢复

• https://hshrzd.wordpress.com/2019/06/27/application-shimming-vs-import-table-recovery/

针对MS Excel的新的攻击面: 攻击者可攻击远程系统, 且无需用户交互

• https://www.mimecast.com/blog/2019/06/exploit-using-microsoft-excel-power-query-for-remote-dde-execution-discovered/

使用AS-REP Roasting破解Active Directory密码

• https://blog.stealthbits.com/cracking-active-directory-passwords-with-as-rep-roasting/

如何测试基于GFWX的图像编码程序

• https://www.apriorit.com/dev-blog/621-qa-testing-image-encoding-application

[漏洞]

Ultraloq UL3智能锁的漏洞

• https://www.pentestpartners.com/security-blog/the-not-so-ultra-lock/

[恶意代码]

3个僵尸软件简要分析

• https://www.gironsec.com/blog/2019/06/yet-another-botnet-writeup/

Java编写的针对小众ATM的恶意软件ATMJaDi, 能让ATM吐钱

• https://securelist.com/criminals-atms-and-a-cup-of-coffee/91406/

ShadowGate Returns to Worldwide Operations With Evolved Greenflash Sundown Exploit Kit

• https://blog.trendmicro.com/trendlabs-security-intelligence/shadowgate-returns-to-worldwide-operations-with-evolved-greenflash-sundown-exploit-kit/

新出现的漏洞利用工具包Spelevo

• https://blog.talosintelligence.com/2019/06/spelevo-exploit-kit.html

[代码/工具]

cifiro: 库的依赖路径扫描

• https://github.com/firosolutions/cifiro
• http://blog.firosolutions.com/2019/06/secondrelease/

iKy: 收集指定邮件地址的信息并展示. 有华丽的界面

• https://gitlab.com/kennbroorg/iKy

代码审计工具PVS-Studio以插件形式集成到了VisualStudio

• https://www.viva64.com/en/b/0635/

[其他]

1000个包含各种漏洞的容器

• https://vulnerablecontainers.org/

2019网络犯罪趋势Top5

• https://eforensicsmag.com/top-5-cybercrime-trends-of-2019-by-jane-smith/

20190627

[技术]

(CTF)Sandstone(Google CTF 2019)

• https://github.com/yoava333/ctf-writeups/blob/master/googlectf_quals/2019/sandstone/README.md

使用受信且带数字签名的文件运行Payload的方式

• https://twitter.com/MrUn1k0d3r/status/1143928885211537408

从Ellipal硬件钱包中提取seed

• https://ledger-donjon.github.io/Ellipal-Security/

攻击Intel的Transactional Synchronization扩展

• http://blog.ret2.io/2019/06/26/attacking-intel-tsx/

使用Ghidra分析IcedID/Bokbot

• https://medium.com/@dawid.golak/icedid-aka-bokbot-analysis-with-ghidra-560e3eccb766

威胁建模

• https://hackernoon.com/how-to-get-started-with-threat-modeling-before-you-get-hacked-1bf0ea3310df

国产的侦查/取证工具MFSocket分析

• https://medium.com/@fs0c131y/mfsocket-a-chinese-surveillance-tool-58e8850c3de4

作者讲述一次差点被钓鱼的经历

• https://robertheaton.com/2019/06/24/i-was-7-words-away-from-being-spear-phished/

SANS网络安全峰会的文件归档

• https://www.sans.org/cyber-security-summit/archives/

[漏洞]

EA游戏平台的多个漏洞

• https://research.checkpoint.com/ea-games-vulnerability/

[恶意代码]

ViceLeaker行动: 向合法移动App注入恶意Samli后重打包. 针对中东

• https://securelist.com/fanning-the-flames-viceleaker-operation/90877/

通过大型恶意广告活动进行传播的GreenFlash Sundown漏洞利用工具包

• https://blog.malwarebytes.com/threat-analysis/2019/06/greenflash-sundown-exploit-kit-expands-via-large-malvertising-campaign/

How Two Firefox Zero Days Led to Two macOS Backdoors

• https://www.sentinelone.com/blog/how-two-firefox-zero-days-led-to-two-macos-backdoors/

利用ISO磁盘镜像文件传播的LokiBot & NanoCore

• https://www.netskope.com/blog/lokibot-nanocore-iso-disk-image-files

针对Linux平台的恶意软件HiddenWasp

• https://www.intezer.com/blog-hiddenwasp-emergence-of-linux-threats/

[代码/工具]

rx-proc-ghidra: Renesas RX处理器模块, 用于Ghidra

• https://github.com/ballon-rouge/rx-proc-ghidra

anteater: CI/CD Gate Check Framework

• https://github.com/anteater/anteater

cwe_checker: BAP插件, 在二进制文件中根据已知漏洞的模式来挖掘未知漏洞

• https://github.com/fkie-cad/cwe_checker

slurp: S3 bucket枚举

• https://github.com/hehnope/slurp

AggressorAssessor: Aggressor脚本, 用于渗透或RedTeam

• https://github.com/FortyNorthSecurity/AggressorAssessor
• https://rastamouse.me/2019/06/the-return-of-aggressor/

[其他]

2018年Web App攻击回顾

• https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Web-application-attacks-2019-eng.pdf

20190626

[技术]

Phishing Users with MFA on AWS

• https://rhinosecuritylabs.com/aws/mfa-phishing-on-aws/

追踪Spotify MacOS桌面客户端的skip

• https://medium.com/@lerner98/skiptracing-part-2-ios-3c610205858b

When document.domain is not equal to document.domain

• https://blog.thinkst.com/2019/06/when-documentdomain-is-not-equal-to.html

利用机器学习提升IDA的分析效果

• https://research.checkpoint.com/thumbs-up-using-machine-learning-to-improve-idas-analysis/

"House of Corrosion" glibc 对漏洞利用技巧

• https://github.com/CptGibbon/House-of-Corrosion

(CTF)T19 CTF Solution Writeup

• https://www.twistlock.com/labs-blog/t19-ctf-solution-writeup/

(CTF) Solving SEGA Genesis ROM CTF Challenge

• https://ctfs.ghost.io/solving-sega-genesis-rom-ctf-challenge/

卡巴斯基的自我防护功能中隐藏的攻击面

• https://github.com/v-p-b/kaspy_toolz/blob/master/S2_EUSKALHACK_Self-defenseless.pdf

Pillaging the Jenkins Treasure Chest

• https://dolosgroup.io/blog/2019/6/20/pillaging-the-jenkins-treasure-chest

关于如何创建llvm-sanitizer的教程

• https://github.com/trailofbits/llvm-sanitizer-tutorial

[漏洞]

利用dotCMS的SQL注入漏洞实现RCE

• https://blog.ripstech.com/2019/dotcms515-sqli-to-rce/

Webex Meetings移动App漏洞可导致中间人攻击

• https://pankajupadhyay.in/2019/06/24/webex-meetings-are-vulnerable-to-mitm/

[恶意代码]

Soft Cell行动: 针对全球范围电信提供商的攻击行动

• https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers

恶意代码分析与Volatility

• https://resources.infosecinstitute.com/ransomware-analysis-with-volatility/

Mobile stalkerware: a long history of detection

• https://blog.malwarebytes.com/android/2019/06/mobile-stalkerware-a-long-history-of-detection/

[代码/工具]

hexext-releases-IDA7.0: IDA插件, 通过操作microcode, 优化反编译输出(无源码)

• https://github.com/chrisps/hexext-releases-IDA7.0

DarkScrape: 暗网爬虫

• https://github.com/itsmehacker/DarkScrape

RedGhost: 后渗透工具, 可用于实现驻留、侦查

• https://github.com/d4rk007/RedGhost

pockint: 用于DFIR/OSINT的瑞士军刀

• https://github.com/netevert/pockint

20190624

[技术]

编写在内存中执行DLL的Shellcode

• https://modexp.wordpress.com/2019/06/24/inmem-exec-dll/

(CTF)Hack The Box - Querier

• https://0xrick.github.io/hack-the-box/querier/

恢复Go二进制文件的函数信息

• https://lekstu.ga/posts/pclntab-function-recovery/

以一种不同寻常的方式破解IDA的安装密码

• https://devco.re/blog/2019/06/21/operation-crack-hacking-IDA-Pro-installer-PRNG-from-an-unusual-way/

ATT&CK: 检测与分析

• https://medium.com/mitre-attack/getting-started-with-attack-detection-a8e49e4960d0

在AIX和Power架构上运行Metasploit Framework

• https://astr0baby.wordpress.com/2019/06/23/metasploit-framework-on-aix-7-2/

恶意软件与域名转发

• https://community.rsa.com/community/products/netwitness/blog/2019/06/19/domain-fronting-malware

NMap与机器学习

• https://blog.amossys.fr/nmap-ml.html

[漏洞]

Page Admin Disclosure | Facebook Bug Bounty 2019

• https://medium.com/bugbountywriteup/page-admin-disclosure-facebook-bug-bounty-2019-ee9920e768eb

DELL主机预装的电脑医生服务的都个漏洞, 可被用于提权和驻留

• https://safebreach.com/Post/OEM-Software-Puts-Multiple-Laptops-At-Risk

Windows ActiveX Data Objects UAF漏洞PoC(CVE-2019-0888)

• https://github.com/sophoslabs/CVE-2019-0888

macOS双重释放漏洞(CVE-2019-8635)可导致提权与任意代码执行

• https://blog.trendmicro.com/trendlabs-security-intelligence/cve-2019-8635-double-free-vulnerability-in-apple-macos-lets-attackers-escalate-system-privileges-and-execute-arbitrary-code/

VLC双重释放漏洞可导致RCE

• https://www.pentestpartners.com/security-blog/double-free-rce-in-vlc-a-honggfuzz-how-to/

[代码/工具]

SNetKiller: 使用Frida向谷歌服务中注入agent, 阻止其访问特定文件, 可用于绕过SafetyNet attestation

• https://github.com/iGio90/SNetKiller

project-black: bug bounty或渗透项目中, 进行Scope控制/扫描和进度追踪

• https://github.com/c0rvax/project-black

GraphQLmap: 与graphql端点进行交互的脚本引擎, 可用于渗透测试

• https://github.com/swisskyrepo/GraphQLmap

BlueGhost: 辅助蓝队封禁攻击者对Linux服务器的访问

• https://github.com/d4rk007/BlueGhost

BoomER: 后渗透阶段本地漏洞利用框架

• https://github.com/Josue87/BoomER

20190621

[技术]

移动App渗透测试最佳实战

• https://www.nowsecure.com/blog/2019/06/20/best-practices-for-mobile-app-pen-testing/

(CTF) Hack the Box (HTB) machine walkthrough series — Irked

• https://resources.infosecinstitute.com/hack-the-box-htb-walkthrough-irked/

使用Burp扩展进行Web App测试

• https://appsecconsulting.com/blog/ten-useful-burp-suite-pro-extensions-for-web-application-testing

隐蔽的Implant加载器

• https://attactics.org/2019/06/21/stealthy-targeted-implant-loaders/

Getting 2FA Right in 2019

• https://blog.trailofbits.com/2019/06/20/getting-2fa-right-in-2019/

Tls Padding Oracle Scanning

• https://github.com/RUB-NDS/TLS-Padding-Oracles/blob/master/TlsPaddingOracleScanning.pdf

在渗透中使用Linux的Time命令提升权限

• https://www.hackingarticles.in/linux-for-pentester-time-privilege-escalation/

[漏洞]

Ruby on Rails的Active Storage组件反序列化漏洞导致RCE(CVE-2019-5420)

• https://www.zerodayinitiative.com/blog/2019/6/20/remote-code-execution-via-ruby-on-rails-active-storage-insecure-deserialization

[恶意软件]

利用Firefox 0Day释放macOS后门的恶意软件

• https://objective-see.com/blog/blog_0x43.html

LoudMiner使用QUEM和VirtualBox在虚拟机中挖矿的恶意软件

• https://www.welivesecurity.com/2019/06/20/loudminer-mining-cracked-vst-software/

利用ADB和SSH传播的挖矿僵尸软件

• https://blog.trendmicro.com/trendlabs-security-intelligence/cryptocurrency-mining-botnet-arrives-through-adb-and-spreads-through-ssh/

Adobe Worm Faker Uses LOLbins And Dynamic Techniques To Deliver Customized Payloads

• https://www.cybereason.com/blog/adobe-worm-faker-uses-lolbins-and-dynamic-techniques-to-deliver-customized-payloads

窃取数字货币的Razy木马, 为用户电脑安装或更新浏览器扩展

• https://securelist.com/razy-in-search-of-cryptocurrency/89485/

[代码/工具]

URLextractor: 信息收集&网站侦查工具

• https://github.com/eschultze/URLextractor

GhostSquadHackers: JS代码加密编码工具

• https://github.com/s1egesystems/GhostSquadHackers-Javascript-Encrypter-Encoder

XSS Vectors/Payloads列表

• https://github.com/RenwaX23/XSS-Payloads

20190620

[技术]

Apple TV与Apple Watch取证

• https://blog.elcomsoft.com/2019/06/apple-tv-and-apple-watch-forensics-01-acquisition/

使用第三方服务窃取凭证

• https://resources.infosecinstitute.com/third-party-services-used-for-credential-theft/

红对战术之: 组合直接系统调用与sRDI绕过AV/EDR

• https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/
• https://github.com/outflanknl/Dumpert

[漏洞]

Fortinet FortiCam FCM-MB40摄像头的多个漏洞

• https://xor.cat/2019/06/19/fortinet-forticam-vulns/

BlueKeep漏洞分析(CVE-2019-0708)

• https://www.malwaretech.com/2019/05/analysis-of-cve-2019-0708-bluekeep.html

BlueKeep漏洞的扫描工具

• https://github.com/robertdavidgraham/rdpscan

OpenConnect VPN客户端漏洞(CVE-2018-20319)

• https://labs.nettitude.com/blog/why-you-should-always-have-two-factor-authentication-on-your-vpn-cve-2018-20319/

[恶意代码]

Cryptomining Dropper and Cronjob Creator

• https://blog.sucuri.net/2019/06/cryptomining-dropper-and-cronjob-creator.html

nodejs编写的木马, 伪装成游戏外挂

• https://news.drweb.com/show/?i=13315&lng=en&c=5

模块化后门Plurox

• https://securelist.com/plurox-modular-backdoor/91213/

[代码/工具]

Slackor: 使用Slack做C&C

• https://github.com/Coalfire-Research/Slackor
• https://www.coalfire.com/The-Coalfire-Blog/June-2019/Introducing-Slackor

KernelSymbolsHelper: 从Windows符号服务器获取未文档化内核函数的地址, 以及数据结构的偏移等, 辅助Windows内核研究

• https://github.com/SouhailHammou/KernelSymbolsHelper

GitMAD: 监控/发现/告警Github上发现的敏感信息和数据泄漏

• https://github.com/deepdivesec/gitmad

[其他]

意大利的工控系统状态

• https://voidsec.com/state-of-industrial-control-systems-ics-in-italy/

20190619

[技术]

Universal Radio Hacker: Investigate Wireless Protocols like a Boss

• https://hakin9.org/universal-radio-hacker-investigate-wireless-protocols-like-a-boss/

工具工业IoT路由器

• https://www.pentestpartners.com/security-blog/sharing-the-secrets-pwning-an-industrial-iot-router/

使用Wireshark解密SSL/TLS流量

• https://resources.infosecinstitute.com/decrypting-ssl-tls-traffic-with-wireshark/

使用PE-sieve修复导入表

• https://youtu.be/eTt3QU0F7V0

Saycure Binary CTF解题

• https://maskop9.tech/index.php/2019/02/25/saycure-ctf-for-beginners/

利用未文档化的CodeStar API实现AWS IAM权限提升

• https://rhinosecuritylabs.com/aws/escalating-aws-iam-privileges-undocumented-codestar-api/

LLDBagility: macOS内核调试实战

• https://blog.quarkslab.com/lldbagility-practical-macos-kernel-debugging.html
• https://github.com/quarkslab/LLDBagility

攻击V8引擎的TurboFan优化编译器

• https://doar-e.github.io/presentations/typhooncon2019/AttackingTurboFan_TyphoonCon_2019.pdf

3个知名JS库的漏洞, 影响上千使用JS库作为第3方库的网站

• https://dmsec.io/hacking-thousands-of-websites-via-third-party-javascript-libraries/

[漏洞]

组合Microsoft AttackSurfaceAnalyzer的3个漏洞实现RCE

• https://parsiya.net/blog/2019-06-18-chaining-three-bugs-to-get-rce-in-microsoft-attacksurfaceanalyzer/

组合利用PS Vita的6个漏洞实现模拟器逃逸

• https://theofficialflow.github.io/2019/06/18/trinity.html

Linux内核TCP协议栈的3个漏洞

• https://access.redhat.com/security/vulnerabilities/tcpsack

P-Link Wi-Fi Extenders爆严重漏洞, 可导致RCE

• https://securityintelligence.com/posts/critical-rce-vulnerability-in-tp-link-wi-fi-extenders-can-grant-attackers-remote-control/

[恶意代码]

HawkEye新变种分析

• https://www.fortinet.com/blog/threat-research/hawkeye-malware-analysis.html

Bouncing Golf行动: 针对中东国家的网络攻击, 主要在移动端

• https://blog.trendmicro.com/trendlabs-security-intelligence/mobile-cyberespionage-campaign-bouncing-golf-affects-middle-east/

模块化后门Plurox

• https://securelist.com/plurox-modular-backdoor/91213/

[代码/工具]

Konan: Web App目录扫描工具

• https://github.com/m4ll0k/Konan

20190618

[技术]

(CTF) Hack the Box (HTB) machine walkthrough series — DevOops

• https://resources.infosecinstitute.com/hack-the-box-htb-walkthrough-devoops/

The Mobile Watering Hole: How A Sip Leads to A Trojan Compromise

• https://blog.zimperium.com/the-mobile-watering-hole-how-a-sip-leads-to-a-trojan-compromise/

iOS平台OpenVPN取证分析

• https://eforensicsmag.com/forensic-analysis-of-openvpn-on-ios-by-jack-farley/

在Azure中部署私有的Burp Collaborator

• https://medium.com/bugbountywriteup/deploy-a-private-burp-collaborator-server-in-azure-f0d932ae1d70

使用Burp的匹配/替换功能, 提升用户权限, 查找隐藏特性

• https://www.jonbottarini.com/2019/06/17/using-burp-suite-match-and-replace-settings-to-escalate-your-user-privileges-and-find-hidden-features/

macOS平台恶意软件驻留方式

• https://www.sentinelone.com/blog/how-malware-persists-on-macos/

现代恶意代码分析之: 处理混淆的代码

• http://www.blackstormsecurity.com/CONFIDENCE_2019_ALEXANDRE.pdf

逆向恶意样本中的RC4算法

• https://youtu.be/CiJocXXMXK4

网游Fallout 76的反作弊绕过

• https://douggemhax.wordpress.com/2019/06/13/how-to-get-caught-by-fallouts-anti-cheat/

在QEMU中运行iOS, 获得交互式Shell

• https://alephsecurity.com/2019/06/17/xnu-qemu-arm64-1/

AWS GuardDuty从入门到精通

• https://medium.com/@brianwarehime_79186/nights-watch-zero-to-hero-with-aws-guardduty-84c8e343c6a4

针对BlueTeam的Azure & Office 365监控指南

• https://0x00sec.org/t/a-blue-team-guide-to-azure-office-365-monitoring/14411

恶意软件绕过基于SMS的2FA认证的新方式

• https://www.welivesecurity.com/2019/06/17/malware-google-permissions-2fa-bypass/

From Targeted Attack to Untargeted Attack

• https://marcoramilli.com/2019/06/17/from-targeted-attack-to-untargeted-attack/

[漏洞]

Linux和FreeBSD内核多个基于TCP的DoS漏洞

• https://www.openwall.com/lists/oss-security/2019/06/17/5

[代码/工具]

Constole: 扫描并利用Consul客户端, 获取Shell

• https://github.com/TestingPens/Constole

20190617

[技术]

利用Windows通知组件进行进程注入

• https://modexp.wordpress.com/2019/06/15/4083/

绕过Sysmon的DNS监控

• https://blog.xpnsec.com/evading-sysmon-dns-monitoring/

(CTF)Hack The Box - FluJab

• https://0xrick.github.io/hack-the-box/flujab/

使用Python实现免杀

• https://medium.com/bugbountywriteup/antivirus-evasion-with-python-49185295caf1

(CTF)fb-ctf所有挑战解题

• https://medium.com/bugbountywriteup/solving-each-and-every-fb-ctf-challenge-part-1-4bce03e2ecb0

使用Dophin模拟器对游戏进行Fuzzing

• https://jamchamb.github.io/portfolio/fuzzydolphin

逆向巫师3的渲染过程, Part15: 迷雾

• https://astralcode.blogspot.com/2019/06/reverse-engineering-rendering-of.html

Windows数字取证与事件响应清单

• https://jpminty.github.io/cheatsheet/DFIR/

使用SSH控制台对SSH密码进行钓鱼

• https://insinger.me/posts/2019/06/susssh-passphrase-phishing-via-the-ssh-prompt/

[漏洞]

Linux xxd命令提权

• https://www.hackingarticles.in/linux-for-pentester-xxd-privilege-escalation/

[恶意代码]

勒索软件Sodinokibi分析

• https://www.certego.net/en/news/malware-tales-sodinokibi/

[代码/工具]

IDA发布7.3版, 支持撤销操作

• https://www.hex-rays.com/products/ida/7.3/index.shtml

0xsp-Mongoose: Linux提权枚举工具包

• https://github.com/lawrenceamer/0xsp-Mongoose

sliver: 通用、跨平台的Implant框架, 支持多种方式的C2

• https://github.com/BishopFox/sliver

IDAPython脚本, 加载Megadrive ROM

• https://gist.github.com/zznop/b14ceecda44c29a83dcaf15659e99107

lst2x64dbg: 从IDA的.lst文件中提取所有Label, 导入到x64dbg数据库

• https://github.com/utkonos/lst2x64dbg

[其他]

黑客组织百科全书, 273页

• https://www.dropbox.com/s/ds0ra0c8odwsv3m/Threat%20Group%20Cards.pdf?dl=0

从多个数据源收集的6亿明文密码和对应的hash值下载

• https://a.ndronic.us/pre-computed-hash-table-v-1-0/

20190614

[技术]

在Kubernetes中创建与部署密罐

• https://www.apriorit.com/dev-blog/619-web-cybersecurity-honeypots-in-kubernetes

使用Burp拦截- httpS流量

• https://resources.infosecinstitute.com/intercepting-- https-traffic-with-burp-suite/

针对网络安全的深度强化学习

• https://arxiv.org/abs/1906.05799

区块链游戏的安全案例研究

• https://arxiv.org/abs/1906.05538

针对IDA用户的Ghidra技巧, Part4: 函数调用图

• https://isc.sans.edu/diary/A+few+Ghidra+tips+for+IDA+users%2C+part+4+-+function+call+graphs/25032

LDAP瑞士军刀

• https://www.exploit-db.com/docs/english/46986-ldap-swiss-army-knife.pdf

[漏洞]

qemu虚拟机逃逸漏洞利用(CVE-2019-6778)

• https://github.com/Kira-cxy/qemu-vm-escape

Thunderbird堆溢出漏洞(CVE-2019-11704)

• https://www.x41-dsec.de/lab/advisories/x41-2019-001-thunderbird/

CVE-2019-1040漏洞利用

• https://dirkjanm.io/exploiting-CVE-2019-1040-relay-vulnerabilities-for-rce-and-domain-admin/

phpMyAdmin 4.8 CSRF漏洞

• https://0day.today/exploit/32859

[恶意代码]

利用Linux邮件服务器的一个古老的漏洞进行传播的挖矿蠕虫

• https://www.cybereason.com/blog/new-pervasive-worm-exploiting-linux-exim-server-vulnerability

在分布式挖矿攻击中发现的高级定向攻击工具

• https://blog.trendmicro.com/trendlabs-security-intelligence/advanced-targeted-attack-tools-used-to-distribute-cryptocurrency-miners/

黑客组织Outlaw控制的僵尸网络被发现传播矿机和基于Perl的后门

• https://blog.trendmicro.com/trendlabs-security-intelligence/outlaw-hacking-groups-botnet-observed-spreading-miner-perl-based-backdoor/

[代码/工具]

Alfred: 针对初学者的渗透框架

• https://github.com/D4mianWayne/Alfred

BKScan: BlueKeep漏洞扫描(CVE-2019-0708)

• https://github.com/nccgroup/BKScan

kube-env-stealer: Automated GKE Kubelet Impersonation and Cluster Secret Stealer via kube-env

• https://github.com/bgeesaman/kube-env-stealer

Salsa-tools: 反向Shell工具收集, 支持免杀

• https://github.com/Hackplayers/Salsa-tools

PhoneInfoga: 针对手机号码的信息收集工具

• https://github.com/sundowndev/PhoneInfoga

[其他]

网络安全供需热力图

• https://www.cyberseek.org/heatmap.html

2019年第1季度网络安全威胁景观

• https://www.ptsecurity.com/ww-en/analytics/cybersecurity-threatscape-2019-q1/

20190613

[代码/工具]

ASLR_disabler: Python脚本, 禁用二进制文件的ASLR

• https://github.com/MaKiPL/ASLR_disabler

Android Apk扫描器

• https://www.vegabird.com/yaazhini/

[技术]

OS X 文件的版本

• https://versprite.com/blog/security-research/file-versioning-mac-os-x/

利用googleplex.com的盲XSS访问谷歌内网

• https://appio.dev/vulns/googleplex-com-blind-xss/

在macOS系统上绕过谷歌Santa程序的白名单

• https://www.praetorian.com/blog/bypassing-google-santa-application-whitelisting-on-macos-part-2

勒索软件的识别与检测

• https://www.gdatasoftware.com/blog/2019/06/31666-ransomware-identification-for-the-judicious-analyst

攻击弱配置的EAP-TLS无线基础设施

• https://versprite.com/blog/application-security/eap-tls-wireless-infrastructure/

挖掘由CakePHP搭建的网站的漏洞

• https://medium.com/tenable-techblog/intro-to-cakephp-for-bug-hunters-97b89f8876bd

如何实现对Burp Collaborator会话的持续性访问

• https://0x00sec.org/t/achieving-persistent-access-to-burp-collaborator-sessions/14311

Win10堆溢出漏洞利用详解

• https://blog.rapid7.com/2019/06/12/heap-overflow-exploitation-on-windows-10-explained/

AMSI绕过

• https://www.contextis.com/en/blog/amsi-bypass

二进制漏洞利用系列, Part7: RelRO绕过

• https://made0x78.com/bseries-fullrelro/

[漏洞]

Intel NUC固件的提权、DoS和信息泄漏漏洞

• https://threatpost.com/intel-patches-nuc-firmware/145620/

印象笔记插件的严重漏洞可泄漏用户敏感信息

• https://www.bleepingcomputer.com/news/security/critical-flaw-in-evernote-add-on-exposed-sensitive-data-of-millions/

Analyzing ARP to Discover & Exploit Stale Network Address Configurations

• https://www.blackhillsinfosec.com/analyzing-arp-to-discover-exploit-stale-network-address-configurations/

20190612

[技术]

恶意软件调试之: 快速禁用ASLR

• https://youtu.be/DGX7oZvdmT0

Web防火墙完全指南

• https://medium.com/schkn/web-application-firewall-guide-125645343beb

Windows提权检查脚本PowerUp.ps1的高级使用指南

• https://recipeforroot.com/advanced-powerup-ps1-usage/

使用PowerBI可视化BloodHound数据

• https://medium.com/p/ba8ea4908422

[漏洞]

Wordpress在线聊天插件可导致攻击者窃取并劫持会话

• https://thehackernews.com/2019/06/wordpress-live-chat-plugin.html

Windows系统加密库SymCrypt的DoS漏洞, 可由修改过的证书文件触发

• https://bugs.chromium.org/p/project-zero/issues/detail?id=1804

论坛软件MyBB(<= 1.8.20)由Stored XSS到RCE

• https://blog.ripstech.com/2019/mybb-stored-xss-to-rce/

RAMBleed旁道攻击: 读取其他进程的物理内存

• https://rambleed.com/

Windows任务调度器提权漏洞利用(CVE-2019-1069)

• https://www.zerodayinitiative.com/blog/2019/6/11/exploiting-the-windows-task-scheduler-through-cve-2019-1069

MS NTLM认证协议包含3个逻辑漏洞, 可使所有Windows系统遭受RCE攻击

• https://www.bleepingcomputer.com/news/security/microsoft-ntlm-flaws-expose-all-windows-machines-to-rce-attacks/

MSRC-52108 A Case of a Win32k Race Condition

• https://rce.wtf/2019/06/10/w2k.html

[恶意代码]

S3勒索软件的预防与防御

• https://rhinosecuritylabs.com/aws/s3-ransomware-part-2-prevention-and-defense/

[代码/工具]

Malcolm: 网络流量分析套件, 功能强大, 容易部署

• https://github.com/idaholab/Malcolm

BurpJSLinkFinder: Burp插件, 被动扫描JS文件

• https://github.com/InitRoot/BurpJSLinkFinder

20190611

[技术]

使用UNICODE实现XSS WAF绕过

• https://medium.com/p/128cd9972a30

Software Ethology: 一种准确而有弹性的语义二进制分析框架

• https://arxiv.org/abs/1906.02928

数百个知名且广泛使用的Java库/编译器依然在使用- http协议下载依赖, 易受中间人攻击

• https://medium.com/@jonathan.leitschuh/want-to-take-over-the-java-ecosystem-all-you-need-is-a-mitm-1fc329d898fb

移动平台恶意软件分析概述

• https://eybisi.run/Mobile-Malware-Analysis-Overlay-and-How-to-Counter-it/

使用JS全局变量绕过XSS过滤器

• https://www.secjuice.com/bypass-xss-filters-using-javascript-global-variables/

钓鱼框架Evilginx2实战

• https://www.hackingarticles.in/evilginx2-advanced-phishing-attack-framework/

分布式个人数据和数字身份的联合授权框架

• https://arxiv.org/abs/1906.03552

(CTF) Protostar stack6 ret2libc

• https://medium.com/p/24680c38a3a8

[恶意代码]

APT组织MuddyWater在新的攻击中使用的多阶段后门POWERSTATS V3和新的后渗透工具

• https://blog.trendmicro.com/trendlabs-security-intelligence/muddywater-resurfaces-uses-multi-stage-backdoor-powerstats-v3-and-new-post-exploitation-tools/

利用WebLogic Server漏洞传播的门罗币矿机, 将恶意代码隐藏在证书文件中

• https://blog.trendmicro.com/trendlabs-security-intelligence/cve-2019-2725-exploited-and-certificate-files-used-for-obfuscation-to-deliver-monero-miner/

分析1个有意思的JS混淆样本

• https://isc.sans.edu/forums/diary/Interesting+JavaScript+Obfuscation+Example/25020/

[代码/工具]

icebox: 虚拟机自省(Introspection)解决方案, 可隐秘的追踪或调试任意进程

• https://github.com/thalium/icebox

EVTX-ATTACK-SAMPLES: 与ATT&CK对应的Windows事件样例

• https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES

userrecon: 在75个社交网站上查找用户名

• https://github.com/thelinuxchoice/userrecon

20190610

[技术]

Mimikatz探秘, Part2: SSP

• https://blog.xpnsec.com/exploring-mimikatz-part-2/

(CTF) Hack The Box - Help

• https://0xrick.github.io/hack-the-box/help/

逆向Spotify.app

• https://medium.com/@lerner98/skiptracing-reversing-spotify-app-3a6df367287d

(CTF)hm0x14 CTF: 逆向crackme

• https://antonioparata.blogspot.com/2019/06/hm0x14-ctf-reversing-not-so-simple.html

逆向一个不太安全的IoT设备

• https://mcuoneclipse.com/2019/05/26/reverse-engineering-of-a-not-so-secure-iot-device/

Android App深入分析, Part1: Drozer + Burp

• https://medium.com/bugbountywriteup/digging-android-applications-part-1-drozer-burp-4fd4730d1cf2

利用Windows过滤平台(Windows Filtering Platform)实现隐蔽通信

• https://x-c3ll.github.io/posts/windows-port-knocking/

Bloodhound walkthrough

• https://www.pentestpartners.com/security-blog/bloodhound-walkthrough-a-tool-for-many-tradecrafts/

[恶意代码]

窃密软件Baldr分析

• https://krabsonsecurity.com/2019/06/04/taking-a-look-at-baldr-stealer/

[代码/工具]

Intensio-Obfuscator: Python源码混淆

• https://github.com/Hnfull/Intensio-Obfuscator

liffy: 本地文件包含漏洞利用工具

• https://github.com/mzfr/liffy

youzer: 在Active Directory环境中创建虚假用户

• https://github.com/SpiderLabs/youzer

lme: Windows客户端安全相关日志查看与攻击检测工具

• https://github.com/ukncsc/lme
• https://www.ncsc.gov.uk/blog-post/logging-made-easy

spotexfil: 使用spotify API进行数据渗透

• https://github.com/sourcefrenchy/spotexfil
• https://medium.com/@jeanmichel.amblat/exfiltration-series-spotexfil-9aee76382b74

RDPassSpray: 在Windows域环境中使用RDP进行密码喷洒攻击

• https://github.com/xFreed0m/RDPassSpray

droidlysis: Android App属性提取工具

• https://github.com/cryptax/droidlysis

gustave: 嵌入式操作系统内核的Fuzzer, 基于QEMU和AFL

• https://github.com/airbus-seclab/gustave

functrace: 使用DynamoRIO追踪函数调用

• https://github.com/invictus1306/functrace

20190531

[技术]

(CTF)Apocalyst

• https://resources.infosecinstitute.com/hack-the-box-htb-walkthrough-apocalyst/

逆向WyzeSense网桥协议, Part2

• https://hclxing.wordpress.com/2019/05/30/reverse-engineering-wyzesense-bridge-protocol-part-ii/

关于ATM攻击与诈骗, 你不可不知的东西, Part1

• https://blog.malwarebytes.com/101/2019/05/everything-you-need-to-know-about-atm-attacks-and-fraud-part-1/

(CTF)Coding a WebAssembly CTF Challenge

• https://medium.com/tenable-techblog/coding-a-webassembly-ctf-challenge-5560576e9cb7

E-mount电子协议逆向

• https://www.dyxum.com/dforum/emount-electronic-protocol-reverse-engineering_topic119522_page11.html

在C/C++程序中x86-64指令使用的研究

• https://aakshintala.com/papers/instrpop-systor19.pdf

为Ghidra实现新的CPU架构

• https://docs.google.com/presentation/d/1b955DV2ii-Dgv6YR4kUrJtjGugEqXD3FffTHRfvVSYo/edit#slide=id.g4525dccad7_0_0

逆向三星Exynos 9820 bootloader和TrustZone

• http://allsoftwaresucks.blogspot.com/2019/05/reverse-engineering-samsung-exynos-9820.html?m=1

时间回溯调试

• https://blogs.technet.microsoft.com/srd/2019/05/29/time-travel-debugging-its-a-blast-from-the-past/

[漏洞]

研究员发现Windows内置Notepad的RCE漏洞

• https://securityaffairs.co/wordpress/86297/hacking/code-execution-flaw-notepad.html

Docker漏洞可导致使用Root权限访问宿主机文件系统

• https://duo.com/decipher/docker-bug-allows-root-access-to-host-file-system#d-nav-drawer

开源Linux容器rtk的3个未修补的CVE漏洞

• https://www.twistlock.com/labs-blog/breaking-out-of-coresos-rkt-3-new-cves/

Windows RCE漏洞PoC(CVE-2019-0708)

• https://github.com/Ekultek/BlueKeep

使用调试器识别触发CVE-2019–0708的代码路径

• https://medium.com/@straightblast426/a-debugging-primer-with-cve-2019-0708-ccfa266682f6

Lexmark打印机的多个漏洞

• https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-lexmark-printers/

1次失败的Red-Teaming中发现了个0Day

• https://www.komodosec.com/post/when-all-else-fails-find-a-0-day

[恶意代码]

The Nansh0u Campaign: signed rootkit, exposed infrastructure and PE exploits in a massive MS-SQL & PHPMyAdmin attack campaign

• https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/

[代码/工具]

pitchfork: 使用符号执行检测Spectre漏洞

• https://github.com/cdisselkoen/pitchfork

userrecon-py: 在社交网络中查找指定用户名是否存在

• https://github.com/decoxviii/userrecon-py

wpbullet: Wordpress静态代码分析工具

• https://github.com/webarx-security/wpbullet

20190529

[技术]

Provoking browser quirks with behavioural fuzzing

• https://portswigger.net/blog/provoking-browser-quirks-with-behavioural-fuzzing

Office文档漏洞利用, Part3: “weaponized” RTF

• https://www.forcepoint.com/blog/security-labs/assessing-risk-office-documents-part-3-exploited-%E2%80%9Cweaponized%E2%80%9D-rtfs

使用PowerShell Empire进行数据渗透

• https://www.hackingarticles.in/data-exfiltration-using-powershell-empire/

[漏洞]

Slick Popup插件提权漏洞

• https://www.wordfence.com/blog/2019/05/privilege-escalation-flaw-present-in-slick-popup-plugin/

WordPress数据库备份插件的OS命令注入漏洞

• https://www.wordfence.com/blog/2019/05/os-command-injection-vulnerability-patched-in-wp-database-backup-plugin/

PDFreactor SSRF/XXE漏洞

• https://blog.gdssecurity.com/labs/2019/5/28/ssrf-and-xxe-vulnerabilities-in-pdfreactor.html

远程桌面服务漏洞CVE-2019-0708的详细分析

• https://www.zerodayinitiative.com/blog/2019/5/27/cve-2019-0708-a-comprehensive-analysis-of-a-remote-desktop-services-vulnerability

Windows DHCP客户端漏洞CVE-2019-0547以及补丁中的漏洞CVE-2019-0726

• https://sensepost.com/blog/2019/analysis-of-a-1day-cve-2019-0547-and-discovery-of-a-forgotten-condition-in-the-patch-cve-2019-0726-part-1-of-2/

MS Edge沙箱逃逸漏洞CVE-2019-0938, part2

• https://blog.exodusintel.com/2019/05/27/pwn2own-2019-microsoft-edge-sandbox-escape-cve-2019-0938-part-2/

[恶意软件]

勒索软件Shade在俄国之外的国家广泛传播, 针对高科技/批发/教育部门

• https://unit42.paloaltonetworks.com/shade-ransomware-hits-high-tech-wholesale-education-sectors-in-u-s-japan-india-thailand-canada/

[代码/工具]

0pack: 向调试器隐藏代码(ELF)

• https://github.com/Luis-Hebendanz/0pack

fatt: 从pcap或实时网络流量中提取元数据和指纹. 基于pyshark

• https://github.com/0x4D31/fatt

leprechaun: 网络数据可视化工具

• https://github.com/vonahi-security/leprechaun
• https://blog.vonahi.io/post-exploitation-with-leprechaun/

[其他]

2019年第1季度威胁情报报告

• https://www.rapid7.com/research/report/2019-q1-threat-report/

20190528

[技术]

反调试技巧, 带实例

• https://www.apriorit.com/dev-blog/367-anti-reverse-engineering-protection-techniques-to-use-before-releasing-software

驻留之: COM劫持

• https://www.mdsec.co.uk/2019/05/persistence-the-continued-or-prolonged-existence-of-something-part-2-com-hijacking/

‘Plata o plomo’代码注入/执行技巧

• http://www.hexacorn.com/blog/2019/05/26/plata-o-plomo-code-injections-execution-tricks/

[漏洞]

Samsung Galaxy S9 TEE 受信应用程序漏洞利用

• https://labs.bluefrostsecurity.de/blog/2019/05/27/tee-exploitation-on-samsung-exynos-devices-introduction/

Apache Tomcat – CVE-2019-0221

• https://wwws.nightwatchcybersecurity.com/2019/05/27/xss-in-ssi-printenv-command-apache-tomcat-cve-2019-0221/

[恶意代码]

分析恶意软件ISFB第2阶段Loader

• https://0ffset.net/reverse-engineering/malware-analysis/analyzing-isfb-second-loader/

HawkEye Malware Operators Renew Attacks on Business Users

• https://securityintelligence.com/hawkeye-malware-operators-renew-attacks-on-business-users/

[代码/工具]

Frida发布12.6版本

• https://frida.re/news/2019/05/28/frida-12-6-released/

razzer: 主要针对竟态漏洞的内核Fuzzer

• https://github.com/compsec-snu/razzer

Windows-Insight: 辅助分析Windows操作系统工作原理

• https://github.com/ernw/Windows-Insight

slither: 智能协议静态分析工具

• https://github.com/crytic/slither

tickey: 后渗透工具, 从内核key中提取Kerberos ticket

• https://github.com/TarlogicSecurity/tickey

HiddenWall: Linux内核模块生成器, 用于自定义网络过滤规则

• https://github.com/CoolerVoid/HiddenWall

20190527

[技术]

Joomla和Wordpress网站被感染.htaccess注入器

• https://blog.sucuri.net/2019/05/htaccess-injector-on-joomla-and-wordpress-websites.html

PHP Webshell反混淆教程

• https://labs.detectify.com/2019/05/24/how-to-tutorial-php-webshell-de-obfuscation/

使用Apostille窃取证书

• https://malicious.link/post/2018/stealing-certificates-with-apostille/

使用Windbg和JS简化恶意代码分析

• https://drive.google.com/file/d/1jG18ytw-XzaowFxmfbTNgrv8nxx6MWTC/view

AWS渗透笔记

• https://github.com/PinkP4nther/aws-testing-notes

驻留技巧, Part1: MS Office

• https://www.mdsec.co.uk/2019/05/persistence-the-continued-or-prolonged-existence-of-something-part-1-microsoft-office/

MacOS X GateKeeper绕过

• https://www.fcvl.net/vulnerabilities/macosx-gatekeeper-bypass

基于神经网络的反编译技术

• https://arxiv.org/abs/1905.08325

(CTF) HackTheBox: Chaos

• https://khaoticdev.net/?p=448

ASIC固件脱壳

• https://serhack.me/articles/unpacking-asic-firmware-antminer-exploited

利用- http标准返回值301缓存投毒, 实现永久性URL劫持

• https://blog.duszynski.eu/domain-hijack-through-- http-301-cache-poisoning/

Windows进程注入: 恶意软件FinFisher/FinSpy使用的KernelCallBackTable

• https://modexp.wordpress.com/2019/05/25/windows-injection-finspy/

[漏洞]

Linux内核RCE漏洞的简要分析(CVE-2019-11815)

• https://stazot.tk/CVE-2019-11815.html

Safari沙箱逃逸(CVE-2019-8603)

• https://phoenhex.re/2019-05-26/attribution-is-hard-at-least-for-dock

CVE-2019-9817 PoC

• https://github.com/l4wio/PoC/tree/master/CVE-2019-9817

从Facebook的内部CDN揭露文件内容

• https://ysamm.com/?p=272

[代码/工具]

在线汇编/反汇编工具

• https://github.com/shahril96/Online-Assembler-Disassembler
• https://shahril96.github.io/Online-Assembler-Disassembler/

LeakLooker: 使用Shodan查找公开的数据库

• https://github.com/woj-ciech/LeakLooker
• https://medium.com/@woj_ciech/leaklooker-v2-find-more-open-servers-and-source-code-leaks-25e671700e41

gdbghidra: gdb调试会话与Ghidra数据同步

• https://github.com/Comsecuris/gdbghidra

HRDevHelper: IDAPython脚本, 可视化反编译函数的ctree

• https://github.com/patois/HRDevHelper

ip-finder-cli: IPFinder的命令行版本

• https://github.com/ipfinder-io/ip-finder-cli

TeleShadow3: Telegram桌面会话窃取

• https://github.com/EternalC0der/TeleShadow3

crosslinked: Linkedin枚举工具, 提取组织内有效的员工名称

• https://github.com/m8r0wn/crosslinked

[其他]

安全加固相关的指南/工具/资源收集

• https://github.com/decalage2/awesome-security-hardening

20190523

[技术]

劫持macOS内核

• https://blog.chichou.me/modjack-hijacking-the-macos-kernel-a75e3631547e

使用McSema和Dyninst将二进制文件反编译为LLVM IR

• https://is.muni.cz/th/pxe1j/?lang=en

如何使用机器学习创建恶意代码检测系统

• https://www.evilsocket.net/2019/05/22/How-to-create-a-Malware-detection-system-with-Machine-Learning/

使用Fuzzing框架Kitty, 对WebSocket进行Fuzz

• https://snikt.net/blog/2019/05/22/to-fuzz-a-websocket/

基于XAMPP堆栈的Web服务器后门程序, Part3

• https://www.tarlogic.com/en/blog/backdoors-modulos-apache/

使用Homograph攻击的复杂的鱼叉攻击事件

• https://www.offensity.com/en/newsroom/sophisticated-spear-phishing-campaigns-using-homograph-attacks/

Abusing jQuery for CSS powered timing attacks

• https://portswigger.net/blog/abusing-jquery-for-css-powered-timing-attacks

1种隐蔽的在内存中加载.NET程序集的方式

• https://gist.github.com/mattifestation/8958b4c18d8bca9e221b29252cfee26b

[漏洞]

西部数据NAS设备RCE漏洞

• https://bnbdr.github.io/posts/wd/

用户SandboxEscaper在Github放出的新的0Day: 任意DACL写入, 可导致本地提权

• https://github.com/SandboxEscaper/polarbearrepo

[恶意代码]

分析1个AutoHotKey恶意软件

• https://osandamalith.com/2019/05/22/analyzing-an-autohotkey-malware/

[代码/工具]

MagicCopy: 后渗透阶段快速提取大文件, 将大文件切割成多个小块并用AES加密, 支持多线程

• https://github.com/p3nt4/MagicCopy

20190522

[技术]

(CTF)My5tery solved

• https://www.securityartwork.es/2019/05/21/my5tery-solved/

SIM端口攻击详情, 以及我学到的教训

• https://medium.com/coinmonks/the-most-expensive-lesson-of-my-life-details-of-sim-port-hack-35de11517124

追踪Windows启动过程: 从UEFI到内核

• https://blog.tetrane.com/2019/From-UEFI-to-Windows-Boot.html

AWS安全事件响应指南

• https://d1.awsstatic.com/whitepapers/aws_security_incident_response.pdf

The Tier of Threat Actors – Cheatsheet

• https://itblogr.com/tier-of-threat-actors-cheatsheet/

2000day in Safari

• https://speakerdeck.com/bo0om/2000day-in-safari

分析全盘加密的解决方案

• https://diablohorn.com/2019/05/21/introduction-to-analysing-full-disk-encryption-solutions/

[漏洞]

SanDisk X600 SATA SED SSD多个漏洞

• https://www.westerndigital.com/support/productsecurity/wdc-19006-sandisk-x600-sata-ssd

Linux LXD提权漏洞

• https://shenaniganslabs.io/2019/05/21/LXD-LPE.html
• https://github.com/initstring/lxd_root

不用Shellcode实现IE漏洞利用(CVE-2019-0752)

• https://www.zerodayinitiative.com/blog/2019/5/21/rce-without-native-code-exploitation-of-a-write-what-where-in-internet-explorer

CVE-2019-0708: CVE-2019-0708扫描PoC

• https://github.com/zerosum0x0/CVE-2019-0708

Wordpress插件Slimstat管理员面板的XSS漏洞

• https://blog.sucuri.net/2019/05/slimstat-stored-xss-from-visitors.html

[恶意软件]

商业钓鱼工具16Shop包含后门

• https://blogs.akamai.com/sitr/2019/05/16shop-commercial-phishing-kit-has-a-hidden-backdoor.html

[代码/工具]

pymetasploit3: Metasploit自动化库, PowerShell编写

• https://github.com/DanMcInerney/pymetasploit3
• https://www.coalfire.com/The-Coalfire-Blog/May-2019/pymetasploit3-Metasploit-Automation-Library

python-iocextract: IoC提取工具

• https://github.com/InQuest/python-iocextract

covertele: 基于Telegram的私有covert channels

• https://github.com/LabunskyA/covertele
• https://habr.com/en/post/452434/

XSSCon: 简易XSS扫描器

• https://github.com/menkrep1337/XSSCon

Kali发布2019.2版

• https://www.kali.org/news/kali-linux-2019-2-release/

[其他]

有关威胁狩猎的4个常见误解

• https://www.carbonblack.com/2019/05/21/4-common-misconceptions-about-threat-hunting/

2019年第1季度DDoS攻击报告

• https://securelist.com/ddos-report-q1-2019/90792/

20190521

[技术]

Ghidra教程, Part3: Xor crackme

• https://youtu.be/3QZoqNr3pKE

My making of a Metasploit Module

• http://www.irongeek.com/i.php?page=videos/nolacon2019/nolacon-2019-c-11-my-making-of-a-metasploit-module-aaron-ringo
• https://github.com/aringo/My-making-of-a-Metasploit-Module

使用Python/Frida和RPC调用iOS原生函数

• https://grepharder.github.io/blog/0x04_calling_ios_native_functions_from_python_using_frida_and_rpc.html

(CTF)Harekaze CTF 2019 challenges

• https://github.com/TeamHarekaze/HarekazeCTF2019-challenges

[漏洞]

浏览器漏洞利用系列教程

• https://liveoverflow.com/getting-into-browser-exploitation-new-series-introduction-browser-0x00/

PWN2OWN 2019: MS Edge渲染器漏洞利用(CVE-2019-0940), Part1

• https://blog.exodusintel.com/2019/05/19/pwn2own-2019-microsoft-edge-renderer-exploitation-cve-2019-9999-part-1/

Linux内核提权漏洞(CVE-2019-11815)

• https://securityaffairs.co/wordpress/85892/security/cve-2019-11815-linux-flaws.html

ZombieLoad: Intel CPU最新的Side Channel漏洞

• https://threatpost.com/zombieload-how-intels-latest-side-channel-bug-was-discovered-and-disclosed/144849/

Wordpress RCE漏洞(CVE-2019–6977)详细分析

• https://medium.com/@knownsec404team/the-detailed-analysis-of-wordpress-5-0-rce-a171ed719681

[恶意代码]

黑水行动(BlackWater): 疑似APT组织MuddyWater, 使用新的躲避检测的技术, 安装基于PowerShell的后门

• https://blog.talosintelligence.com/2019/05/recent-muddywater-associated-blackwater.html

被黑的网站托管W97M/Downloader Dropper

• https://securityboulevard.com/2019/05/w97m-downloader-malware-dropper-served-from-compromised-websites/

研究人员发现恶意软件Winnti的Linux变种

• https://medium.com/chronicle-blog/winnti-more-than-just-windows-and-gates-e4f03436031a

[代码/工具]

Sojobo: 二进制文件分析框架

• https://github.com/enkomio/Sojobo
• https://antonioparata.blogspot.com/2019/05/sojobo-yet-another-binary-analysis.html

dvcw: 带漏洞的Ethereum数字货币钱包, JS编写

• https://gitlab.com/badbounty/dvcw

flashsploit: 使用ATtiny85 HID设备的漏洞利用框架

• https://github.com/thewhiteh4t/flashsploit

Scavenger: 在多个paste网站上搜索泄漏的凭证

• https://github.com/rndinfosecguy/Scavenger

20190520

[技术]

(CTF)Harekaze CTF 2019 WEB Writeup (Yokosuka Hackers)

• https://gist.github.com/stypr/9219055eaaf39bc1c3cdd694755d9295

JWT: Signature-vs-MAC attacks

• https://snikt.net/blog/2019/05/16/jwt-signature-vs-mac-attacks/

使用libopcodes进行反汇编

• https://blog.yossarian.net/2019/05/18/Basic-disassembly-with-libopcodes

逆向PS游戏Colony Wars的3D模型

• https://suxin.space/notes/cw-reverse-engineering-models/

逆向监控工具: ExamCookie

• https://vmcall.github.io/reversal/2019/05/16/exam-surveillance2.html

Golang二进制文件逆向, Part2

• https://medium.com/@nishanmaharjan17/reversing-golang-binaries-part-2-26f522264d01

构建一个基础的密罐

• http://www.hackerfactor.com/blog/index.php?/archives/841-Building-a-Basic-Honeypot.html

反向Shell清单

• https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md

(CTF)Hack The Box - Conceal

• https://0xrick.github.io/hack-the-box/conceal/

使用Azure Apps做C&C

• https://vincentyiu.co.uk/red-team/attack-infrastructure/azure-apps-for-command-and-control

[漏洞]

Twitter隐私相关的漏洞, 攻击者可以在用户访问恶意网站时将Twitter用户识别出来

• https://hackerone.com/reports/505424

Slack Windows版客户端漏洞, 可导致攻击者修改客户端的默认下载路径, 可修改为攻击者控制的SMB服务器

• https://medium.com/tenable-techblog/stealing-downloads-from-slack-users-be6829a55f63

搜索引擎存储搜索历史时未验证源, 可导致攻击者修改用户的搜索历史(Google/Facebook/Linkin/...)

• https://medium.com/@mazin.ahmed/search-engine-abuse-in-popular-social-networks-14509e8a0203

Suspected Bug Collision: iOS/OSX Content Filter Kernel UAF Analysis + POC

• https://blog.zecops.com/vulnerabilities/analysis-and-poc-of-content-filter-kernel-use-after-free/

Cisco Prime 基础设施的未授权RCE漏洞

• https://srcincite.io/blog/2019/05/17/panic-at-the-cisco-unauthenticated-rce-in-prime-infrastructure.html
• https://srcincite.io/pocs/src-2019-0034.py.txt

Win32k 0Day, 可导致Chrome沙箱逃逸(CVE-2019-0808)

• https://blog.exodusintel.com/2019/05/17/windows-within-windows/

xnu内核堆信息泄漏(CVE-2019-6207)PoC

• https://github.com/maldiohead/CVE-2019-6207

macOS/iOS 内核栈信息泄漏(CVE-2019-8540)PoC

• https://github.com/maldiohead/CVE-2019-8540

[代码/工具]

cbr-doc: 从近2000个网络安全相关的资讯、博客站点中爬取的文章/工具等, 可对文章/工具从多个维度进行索引. 已收录30W左右文章和1W+安全相关开源工具

• https://github.com/xrkk/cbr-doc

pown-cdb: 自动化常用的Chrome调试协议任务, 在命令行中监控并拦截- http请求和回复

• https://github.com/pownjs/pown-cdb

TravisLeaks: 在Travis日志中查找敏感的Key和密码

• https://github.com/Shashank-In/TravisLeaks/

TCPRelayInjecter: 向非托管进程中注入“TCP Relay”托管程序集

• https://github.com/Arno0x/TCPRelayInjecter

vxsig: 从相似的二进制文件集合中自动生成AV byte签名

• https://github.com/google/vxsig

dragondance: Ghidra插件, 二进制代码覆盖可视化

• https://github.com/0ffffffffh/dragondance

bandit: 查找Python代码中的常见安全问题

• https://github.com/PyCQA/bandit

20190517

[技术]

使用Frida解CTF: DEFCON Quals 2019 Veryandroidoso

• https://eybisi.run/DEF-CON-Quals-2019-Veryandroidoso/

在macOS系统上使用Frida追踪子进程

• https://medium.com/rock-with-frida/trace-child-process-with-frida-on-macos-3b8f0f953f3d

UC浏览器下载并运行未验证代码的漏洞是如何产生的, 以及攻击者可如何利用此漏洞

• https://habr.com/en/company/drweb/blog/452076/

Linux ELF文件理解与分析

• https://linux-audit.com/elf-binaries-on-linux-understanding-and-analysis/

利用x509数字证书实现数据渗透

• https://medium.com/@jeanmichel.amblat/abusing-certificates-for-data-exfiltration-d6bff2533cd0

查找Facebook用户未公开的好友和社团列表

• https://techblog.mediaservice.net/2019/05/find-hidden-friends-and-community-for-any-facebook-user/

Is MIME Sniffing XSS a real thing? [The story of weird Google bug bounties]

• https://www.komodosec.com/post/mime-sniffing-xss

Android App Diffing: 比较原始Apk和打包后的Apk

• https://blog.quarkslab.com/android-application-diffing-analysis-of-modded-version.html

[漏洞]

分析Win10 DHCP严重漏洞CVE-2019-0726

• http://blog.ptsecurity.com/2019/05/dhcp-security-in-windows-10-analyzing.html

CVE-2019-0812 Exploit

• https://phoenhex.re/2019-05-15/non-jit-bug-jit-exploit

在野发现的0Day汇总, 从2014到2019

• https://googleprojectzero.blogspot.com/p/0day.html

Sysdig绕过漏洞(CVE-2019-8339)

• https://www.twistlock.com/labs-blog/falco-vulnerability-cve-2019-8339/

[代码/工具]

Frida发布12.5版

• https://frida.re/news/2019/05/15/frida-12-5-released/

trivy: 针对容器的漏洞扫描器

• https://github.com/knqyf263/trivy

miteru: 钓鱼工具包检测工具

• https://github.com/ninoseki/miteru

SecurityRAT: 在程序开发期间辅助定位安全需求

• https://github.com/SecurityRAT/SecurityRAT

20190515

[技术]

Firfox Send服务的数据加密分析

• http://irq5.io/2019/05/14/data-encryption-on-firefox-send/

如何经济高效地动态分析UEFI恶意软件

• https://www.fortinet.com/blog/threat-research/how-to-cost-effectively-dynamically-analyze-uefi-malware.html

Owning O365 Through Better Brute-Forcing

• https://www.trustedsec.com/2019/05/owning-o365-through-better-brute-forcing/

针对最近披露的Intel CPU "MDS" 硬件漏洞的攻击

• https://mdsattacks.com/

清楚的解释Tor以及围绕Tor的各种神话

• https://write.privacytools.io/my-thoughts-on-security/slicing-onions-part-1-myth-busting-tor

对加密库的差分模糊测试

• https://guidovranken.com/2019/05/14/differential-fuzzing-of-cryptographic-libraries/

[漏洞]

爬虫框架scrapy telnet服务的漏洞

• https://medium.com/alertot/web-scraping-considered-dangerous-exploiting-the-telnet-service-in-scrapy-1-5-2-ad5260fea0db

Panda反病毒软件本地提权漏洞(CVE-2019-12042)

• https://rce4fun.blogspot.com/2019/05/panda-antivirus-local-privilege.html

Windows远程桌面服务的严重漏洞

• https://www.cert.govt.nz/it-specialists/advisories/vulnerability-microsoft-rdp-services/

Adobe Acrobat Reader RCE漏洞

• https://blog.talosintelligence.com/2019/05/vuln-spotlight-adobe-RCE-may-2019.html

Antenna House Rainbow PDF Office文档转换器的RCE漏洞

• https://blog.talosintelligence.com/2019/05/vuln-spotlight-antenna-rainbow-pdf-may-2019.html

[恶意代码]

2019年春季漏洞利用工具包回顾

• https://blog.malwarebytes.com/threat-analysis/2019/05/exploit-kits-spring-2019-review/

伪装为Adobe Flash Player更新程序的JCry勒索软件

• https://www.carbonblack.com/2019/05/14/cb-tau-threat-intelligence-notification-jcry-ransomware-pretends-to-be-adobe-flash-player-update-installer/

恶意Excel文档分析

• https://eforensicsmag.com/analysis-of-malicious-excel-spreadsheet-by-monnappa-k-a/

通过路由器级别的MitM攻击传播的Plead恶意软件

• https://www.welivesecurity.com/2019/05/14/plead-malware-mitm-asus-webstorage/

[代码/工具]

gotools: Ghidra插件, 辅助逆向Go文件

• https://github.com/felberj/gotools

muraena: 反向代理, 自动执行钓鱼和后-钓鱼活动

• https://github.com/muraenateam/muraena

20190514

[技术]

Ques-Chain: 基于以太坊的电子投票系统

• https://arxiv.org/abs/1905.05041

识别工业控制系统中的安全关键网络物理组件

• https://arxiv.org/abs/1905.04796

软件层面的传感器防御(SDI): 基于实用软件的位置传感器欺骗攻击检测

• https://arxiv.org/abs/1905.04691

PowerShell: Angriff unter dem Radar

• https://insinuator.net/wp-content/uploads/2019/05/phillips_milenkoski_powershell.pdf

Reverse engineering a high-end soldering station

• https://habr.com/en/post/451246/

SameSite cookies实战

• https://blog.benpri.me/blog/2019/05/13/samesite-cookies-in-practice/

(CTF)DEF CON Quals 2019 - Speedrun 12

• https://zeroload.github.io/ctf/2019/05/14/DEF-CON-Quals-2019-Speedrun-12/

(CTF)Hack the Box (HTB) machines walkthrough series — Curling

• https://resources.infosecinstitute.com/hack-the-box-htb-walkthrough-series-curling/

[漏洞]

Roav A1 Dashcam多个漏洞

• https://blog.talosintelligence.com/2019/05/vulnerability-spotlight-multiple.html

WordPress Ultimate Member插件多个漏洞

• https://blog.sucuri.net/2019/05/multiple-vulnerabilities-in-the-wordpress-ultimate-member-plugin.html

Hackerrank任意文件读取漏洞

• https://blog.cystack.net/arbitrary-file-read-vulnerability-in-hackerrank/

Thrangrycat: 思科两个路由器产品的漏洞(CVE-2019-1649/CVE-2019-1862)

• https://thrangrycat.com/

Linksys智能Wifi路由器敏感信息泄漏漏洞

• https://badpackets.net/over-25000-linksys-smart-wi-fi-routers-vulnerable-to-sensitive-information-disclosure-flaw/

Alpine官方Docker镜像漏洞(CVE-2019-5021)

• https://anchore.com/enforcing-alpine-linux-docker-images-vulnerability-cve-2019-5021-with-anchore/

Linux内核5.0.8之前版本的RCE漏洞

• https://www.bleepingcomputer.com/news/security/linux-kernel-prior-to-508-vulnerable-to-remote-code-execution/

Ninja Forms未授权任意文件上传漏洞(CVE-2019-10869)

• https://github.com/KTN1990/CVE-2019-10869

[恶意代码]

黑客组织ScarCruft在最近中的攻击中引入了蓝牙(Bluetooth harvester)

• https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/

恶意银行软件Banload的新技巧

• https://www.sentinelone.com/blog/cybercrime-banload-banking-malware-fraud/

AgentTesla SMTP变种快速分析

• http://www.peppermalware.com/2019/05/quick-analysis-of-agenttesla-smtp-variant-stealer.html

njRAT分析

• https://securityboulevard.com/2019/05/a-look-at-hworm-houdini-aka-njrat/

[代码/工具]

Nuages: 模块化C2框架

• https://github.com/p3nt4/Nuages

Horn3t: 子域名枚举工具

• https://github.com/janniskirschner/horn3t

ANBU: 使用Pin进行脱壳

• https://github.com/Fare9/ANBU

findomain: 使用Certificate Transparency日志查找子域名

• https://github.com/Edu4rdSHL/findomain

20190513

[技术]

从WhatsApp的备份数据库中提取消息

• https://medium.com/@1522933668924/extracting-whatsapp-messages-from-backups-with-code-examples-49186de94ab4

如何通过Excel 4.0宏启用64位shellcode的执行

• https://www.cybereason.com/blog/excel4.0-macros-now-with-twice-the-bits

使用EvtxECmd解析evtx记录

• https://www.kazamiya.net/en/ParseCarvedEVTX

Exploring Mimikatz - Part 1 - WDigest

• https://blog.xpnsec.com/exploring-mimikatz-part-1/

(CTF)HackTheBox: Lightweight

• https://khaoticdev.net/?p=216

利用PHP应用程序中的RFI(远程文件包含)绕过远程URL包含限制

• http://www.mannulinux.org/2019/05/exploiting-rfi-in-php-bypass-remote-url-inclusion-restriction.html

交互式反汇编工具Carbon

• https://cerbero-blog.com/?p=1768

Bug Bounty ~ Work Smarter, Not Harder

• https://vavkamil.cz/wp-content/uploads/2019/05/ctjb_2019_bugbounty.pdf

[漏洞]

jenkins pre-auth RCE PoC(CVE-2018-1000861, CVE-2019-1003005, CVE-2019-1003029)

• https://github.com/orangetw/awesome-jenkins-rce-2019

三星手机DOS漏洞, 可导致手机变砖

• https://medium.com/@fs0c131y/how-to-brick-all-samsung-phones-6aae4389bea
• https://github.com/fs0c131y/SamsungLocker

Chrome的JS编译器TurboFan的漏洞分析

• https://googleprojectzero.blogspot.com/2019/05/trashing-flow-of-data.html

[代码/工具]

consonance: 使用Noise协议实现的WhatsApp握手过程

• https://github.com/tgalal/consonance

Invoke-GPPCSE: 根据已知CSE(客户端扩展)获取GPO列表, Powershell脚本

• https://github.com/OneLogicalMyth/Invoke-GPPCSE
• https://glanfield.co.uk/make-group-policy-preferences-guid-again/

eazfuscator.net-symbol-decrypter: 对Eazfuscator.net符号名加密进行解密

• https://github.com/silentsignal/eazfuscator.net-symbol-decrypter
• https://blog.silentsignal.eu/2019/05/10/decrypting-eazfuscator-net-encrypted-symbol-names/

MatchandReplace: Burp插件, 根据自定义规则进行匹配和替换

• https://github.com/Leoid/MatchandReplace

SilkETW: C#编写的ETW的Wrapper

• https://github.com/fireeye/SilkETW

easy-linux-pwn: Linux漏洞利用示例, 针对初学者

• https://github.com/xairy/easy-linux-pwn

DS_Store_crawler_parser: .DS_Store文件解析脚本

• https://github.com/anantshri/DS_Store_crawler_parser

Shellcoding: Shellcode相关工具

• https://github.com/Mr-Un1k0d3r/Shellcoding

Ghidra脚本, 用Ghidra的P-Code功能挖掘漏洞

• https://github.com/0xAlexei/INFILTRATE2019/blob/master/PCodeMallocDemo/MallocTrace.java
• https://www.riverloopsecurity.com/blog/2019/05/pcode/

wiggle: 可执行文件搜索引擎

• https://github.com/ChiChou/wiggle

iCULeak.py: 从电话配置文件中查找和提取凭据

• https://github.com/llt4l/iCULeak.py

用于转储Lsass进程的Shellcode

• https://osandamalith.com/2019/05/11/shellcode-to-dump-the-lsass-process/

FinalRecon: 多合一Web侦查工具

• https://github.com/thewhiteh4t/FinalRecon

ReconT: 侦查和信息收集工具

• https://github.com/jaxBCD/ReconT

20190510

[技术]

(CTF)OnionFarm WriteUp

• https://mstajbakhsh.ir/onionfarm-writeup/

(CTF)Matrix 1: CTF walkthrough

• https://resources.infosecinstitute.com/matrix-1-ctf-walkthrough/

数据库安全最佳实战

• https://blog.stealthbits.com/database-security-best-practices-simple-worthwhile-concepts-part-2/

自动挖掘Win10逻辑提权漏洞

• https://conference.hitb.org/hitbsecconf2019ams/materials/D1T2%20-%20Automated%20Discovery%20of%20Logical%20Privilege%20Escalation%20Bugs%20in%20Windows%2010%20-%20Wenxu%20Wu%20&%20Shi%20Qin.pdf

Circumventing Chrome's hardening of typer bugs

• https://doar-e.github.io/blog/2019/05/09/circumventing-chromes-hardening-of-typer-bugs/

替换系统bash, 窥探用户输入的每个bash命令

• https://youtu.be/KPTpufWmCPc

[漏洞]

MakerDAO投票合约中的严重ItchyDAO漏洞

• https://medium.com/@peckshield/critical-itchydao-bug-in-the-voting-contract-of-makerdao-5fad7c69a0b2

SeasCoASA: Exploiting a Small Leak in a Great Ship

• https://conference.hitb.org/hitbsecconf2019ams/materials/D1T1%20-%20SeasCoASA%20-%20Exploiting%20a%20Small%20Leak%20in%20a%20Great%20Ship%20-%20Kaiyi%20Xu%20&%20Lily%20Tang.pdf

僵尸网络Mirai的代码存在漏洞, 可导致C&C崩溃

• https://www.ankitanubhav.info/post/crash

SQLite RCE漏洞(CVE-2019-5018)

• https://blog.talosintelligence.com/2019/05/vulnerability-spotlight-remote-code.html

[恶意代码]

针对瑞士中小企业的严重勒索软件攻击

• https://www.govcert.ch/blog/36/severe-ransomware-attacks-against-swiss-smes

在野发现的与ATMitch攻击关联的样本

• https://blog.yoroi.company/research/atmitch-new-evidence-spotted-in-the-wild/

攻击者利用Jenkins漏洞传播挖矿软件(CVE-2018-1000861)

• https://isc.sans.edu/diary/rss/24916

[代码/工具]

donut: 将.NET程序集注入Windows进程

• https://github.com/TheWover/donut
• https://thewover.github.io/Introducing-Donut/

ExtAnalysis: 浏览器扩展分析框架

• https://github.com/Tuhinshubhra/ExtAnalysis

CQTools: 终极Windows Hacking工具包

• https://www.kitploit.com/2019/05/cqtools-new-ultimate-windows-hacking.html

fn_fuzzy.py: IDAPython脚本, 快速对多个二进制文件进行Diffing

• https://github.com/TakahiroHaruyama/ida_haru/tree/master/fn_fuzzy
• https://www.carbonblack.com/2019/05/09/fn_fuzzy-fast-multiple-binary-diffing-triage-with-ida/

blazescan: Linux web服务器恶意代码扫描和事件响应工具

• https://github.com/Hestat/blazescan
• https://eforensicsmag.com/blazescan-digital-forensic-open-source-tool-by-brian-laskowski/

[其他]

资产发现(Asset Discovery)相关的资源收集

• https://github.com/redhuntlabs/Awesome-Asset-Discovery

20190509

[技术]

工控系统安全: IT vs OT

• https://www.contextis.com/en/blog/ics-security-it-vs-ot

针对PCI合规性的分段渗透测试

• https://resources.infosecinstitute.com/segmentation-penetration-testing-for-pci-compliance/

逆向DropBox客户端, 去混淆, 并反编译为Python代码

• https://anvilventures.com/blog/looking-inside-the-box.html

通过Client Domain Hooking劫持浏览器TLS流量: 强制应用程序仅通过攻击者控制的域进行通信, 同时不破坏应用程序的功能

• https://blog.duszynski.eu/hijacking-browser-tls-traffic-through-client-domain-hooking/

只使用CSS监控鼠标运动轨迹

• https://twitter.com/davywtf/status/1124130932573839360
• https://gist.github.com/wybiral/c8f46fdf1fc558d631b55de3a0267771

Cyber-All-Intel: 与网络安全威胁情报相关的AI

• https://arxiv.org/abs/1905.02895

[恶意代码]

Dharma勒索软件伪装成杀软, 界面显示扫描病毒, 后台偷偷加密文件

• https://blog.trendmicro.com/trendlabs-security-intelligence/dharma-ransomware-uses-av-tool-to-distract-from-malicious-activities/

APT组织FIN7的部分成员被捕之后, 该组织依然活跃

• https://securelist.com/fin7-5-the-infamous-cybercrime-rig-fin7-continues-its-activities/90703/

过去几周针对罗马尼亚的关键基础设施能源供应商的邮件攻击

• https://www.fortinet.com/blog/threat-research/new-spam-attack-targets-romanian-corporation.html

[其他]

Bromium发布的Threat Insights报告

• https://www.bromium.com/resource/bromium-threat-insights-report-april-2019/

移动平台攻击面

• https://www.nowsecure.com/blog/2019/05/08/peering-inside-the-mobile-attack-surface/

20190508

[技术]

macOS内核调试概述

• https://blog.quarkslab.com/an-overview-of-macos-kernel-debugging.html

使用RECmd查找通过注册表实现驻留的恶意软件

• https://digital-forensics.sans.org/blog/2019/05/07/malware-persistence-recmd

CQTools: 终极黑客工具包

• https://www.blackhat.com/asia-19/briefings/schedule/#cqtools-the-new-ultimate-hacking-toolkit-14425

Android预装App分析

• https://arxiv.org/abs/1905.02713

解析Android平台挖矿软件

• https://arxiv.org/abs/1905.02602

RelExt: 使用深度学习方法进行网络安全知识图改进的关系提取

• https://arxiv.org/abs/1905.02497

PowerCat实战(PowerShell版本的Netcat)

• https://www.hackingarticles.in/powercat-a-powershell-netcat/

逆向实战之: 反编译keinitializeapc

• https://iamismael.com/2019/05/06/practical-reverse-engineeringpg-35-5-decompiling-keinitializeapc/

通过芯片分析和EDA逆向仿真老式集成电路

• https://youtu.be/M3nFcTpAwoM

使用Frida在游戏Doom中作弊

• https://github.com/sensepost/frida-windows-playground/blob/master/doom-cheats.js

[漏洞]

JIG漏洞利用技巧

• https://saelo.github.io/presentations/41con_19_jit_exploitation_tricks.pdf

通过UHCI控制VMware: 分析Pwn2Own大会VMware漏洞

• https://www.zerodayinitiative.com/blog/2019/5/7/taking-control-of-vmware-through-the-universal-host-controller-interface-part-1

JavaScript JIT引擎的逻辑漏洞利用

• http://phrack.org/papers/jit_exploitation.html

反恐精英的中间人攻击和XSS漏洞

• https://github.com/kkthxbye-code/csgo_bugs/blob/master/panorama_mitm_xss/README.md

[恶意代码]

勒索软件GandCrab新的感染链

• https://www.cybereason.com/blog/gandcrab-evasive-infection-chain

挖矿软件使用Rootkit和Confluence漏洞传播

• https://blog.trendmicro.com/trendlabs-security-intelligence/cve-2019-3396-redux-confluence-vulnerability-exploited-to-deliver-cryptocurrency-miner-with-rootkit/

LightNeuron后门: Turla APT组织使用的复杂后门

• https://www.welivesecurity.com/2019/05/07/turla-lightneuron-email-too-far/

[代码/工具]

jalesc: Linux本地枚举脚本

• https://github.com/itsKindred/jalesc

BruteDum: 对多个服务进行爆破攻击, 包括: SSH, FTP, Telnet, PostgreSQL, RDP, Hydra, Medusa和Ncrack

• https://github.com/GitHackTools/BruteDum

DLL-Injection: C#编写的DLL注入工具

• https://github.com/ihack4falafel/DLL-Injection

CyberScan: 渗透工具, 主要用于数据包取证

• https://github.com/medbenali/cyberscan
• https://hakin9.org/cyberscan-hackers-favourite-toolkit/

[其他]

2019年数据泄露调查报告

• https://enterprise.verizon.com/resources/reports/2019-data-breach-investigations-report.pdf

20190507

[技术]

(CTF)DC-3 Walkthrough

• https://www.hackingarticles.in/dc-3-walkthrough/

渗透测试时利用虚拟机文件

• https://appsecconsulting.com/blog/virtually-physical-access-exploiting-virtual-machine-files-on-penetration-t

如何安全扫描医疗设备的安全漏洞

• https://blog.rapid7.com/2019/05/06/medical-device-security-part-2-how-to-give-medical-devices-a-security-checkup/

(CTF)Hack the Box (HTB) machines walkthrough series — Bounty

• https://resources.infosecinstitute.com/hack-the-box-htb-machines-walkthrough-series-bounty/

基于云的应用程序的渗透测试：指南

• https://eforensicsmag.com/pen-testing-of-cloud-based-apps-the-guide-by-daniel-wilson/

网络钓鱼攻击的认知分类

• https://arxiv.org/abs/1905.02162

用于Windows PE恶意软件分类的基准API调用数据集

• https://arxiv.org/abs/1905.01999

DeepCheck: 基于深度学习的非侵入式控制流完整性检查

• https://arxiv.org/abs/1905.01858

(CTF)BIGHEAD

• https://3mrgnc3.ninja/2019/05/bighead/

使用Apple的APSDaemon.exe签名二进制文件执行恶意DLL

• https://0x00sec.org/t/malicious-dll-execution-using-apples-apsdaemon-exe-signed-binary/13409

优化Elasticsearch安全日志收集, Part1: 减少分片数量

• https://blog.nviso.be/2019/05/06/optimize-elasticsearch-for-security-log-collection-part-1-reducing-the-number-of-shards/

WordPress 5.2: 供应链攻击缓解措施

• https://paragonie.com/blog/2019/05/wordpress-5-2-mitigating-supply-chain-attacks-against-33-internet

恶意MS Office文档创建助手EvilClippy实战

• https://outflank.nl/blog/2019/05/05/evil-clippy-ms-office-maldoc-assistant/

[漏洞]

Jenkins GitLab插件信息泄露漏洞(CVE-2019-10300)

• https://talosintelligence.com/vulnerability_reports/TALOS-2019-0788

Jenkins Swarm插件XML外部实体信息泄露漏洞(CVE-2019-10309)

• https://talosintelligence.com/vulnerability_reports/TALOS-2019-0783

Jenkins Ansible Tower插件信息泄露漏洞(CVE-2019-10310)

• https://talosintelligence.com/vulnerability_reports/TALOS-2019-0786

CVE-2019–5418: WAF绕过与缓存

• https://blog.pentesterlab.com/cve-2019-5418-on-waf-bypass-and-caching-10e93f9a1981

利用ASP.NET的x-up-devcap-post-charset Header绕过WAF

• https://soroush.secproject.com/blog/2019/05/x-up-devcap-post-charset-header-in-aspnet-to-bypass-wafs-again/

Firefox CVE-2019-9810 Exploit

• https://github.com/0vercl0k/CVE-2019-9810

[恶意代码]

苹果/谷歌商店扩展中的广告软件

• https://www.sentinelone.com/blog/adware-apple-google-extensions-put-users-at-risk/

[代码/工具]

autoBOF: 自动化漏洞开发工具

• https://github.com/DiscipleOfDust/autoBOF
• https://0x00sec.org/t/autobof-a-journey-into-automation-exploit-development-and-buffer-overflows/13415

PeekABoo: 在目标主机上启动RDP, 可用于渗透

• https://github.com/viralmaniar/peekaboo

[其他]

CppCon2018幻灯片和其他材料

• https://github.com/CppCon/CppCon2018

20190506

[技术]

浏览器指纹识别研究

• https://arxiv.org/abs/1905.01051

HADES-IoT：一种实用的基于主机的物联网设备异常检测系统

• https://arxiv.org/abs/1905.01027

CharBot：一种简单有效的逃避DGA分类器的方法

• https://arxiv.org/abs/1905.01078

使用IDA从0开始学逆向, Part13

• https://medium.com/p/adc88403c295

利用Catalog Hygiene绕过应用程序白名单

• https://bohops.com/2019/05/04/abusing-catalog-file-hygiene-to-bypass-application-whitelisting/

Windows计划任务命令行包含空格, 可"隐藏"启动项

• https://medium.com/p/1c7bfe38a67c

(CTF)UUTCTF 2019 WriteUp

• https://medium.com/bugbountywriteup/uutcf-2019-writeups-6c11ea3f9d22

BadWPAD攻击分析, Part2

• https://blog.redteam.pl/2019/05/badwpad-and-wpad-pl-wpadblocking-com.html

(CTF)Kriss Kross Jump-themed SEGA Genesis ROM CTF

• https://github.com/zznop/jump

获取Android手机的终极授权

• https://speakerdeck.com/hhj4ck/el3-tour-get-the-ultimate-privilege-of-android-phone

如何分析固件: 工具与技巧

• https://www.pentestpartners.com/security-blog/how-to-do-firmware-analysis-tools-tips-and-tricks/

使用JEB中的工具SiglibGen生成自定义的签名库, 快速识别不同可执行文件间的相似代码

• https://www.pnfsoftware.com/blog/siglibgen-native-signatures-generation-for-jeb/

[漏洞]

WebLogic反序列化RCE漏洞解析(CVE-2019-2725)

• https://blog.rapid7.com/2019/05/03/weblogic-deserialization-remote-code-execution-vulnerability-cve-2019-2725-what-you-need-to-know/

[恶意代码]

MegaCortex勒索软件

• https://news.sophos.com/en-us/2019/05/03/megacortex-ransomware-wants-to-be-the-one/

使用AutoIT脱壳NanoCore样本

• https://goggleheadedhacker.com/blog/post/11

Redaman脱壳: 自注入壳解析

• https://youtu.be/YXnNO3TipvM

Megumin木马深入分析

• https://fumik0.com/2019/05/03/lets-nuke-megumin-trojan/

[代码/工具]

Instruction-Stomp: 指令计数工具, 基于QEMU, 支持多架构, 可用于CTF

• https://github.com/ChrisTheCoolHut/Instruction-Stomp

kostebek: 侦察工具, 通过公司的商标发现他们的域名

• https://github.com/esecuritylab/kostebek

20190505

[技术]

针对IDA用户的Ghidra技巧, Part3: 转换，标签和评论

• https://isc.sans.edu/diary/rss/24908

ESI注入, Part2: 滥用specific implementations

• https://www.gosecure.net/blog/2019/05/02/esi-injection-part-2-abusing-specific-implementations

掌握逆向工具Ghidra

• https://github.com/0xAlexei/INFILTRATE2019

逆向并修复微型投影仪

• https://ktln2.org/2019/04/30/from-zero-to-hero/

独立研究人员如何创建500个虚拟机Fuzzing挖漏洞

• https://kciredor.com/throwing-500-vms-fuzzing-target-individual-security-researcher.html

(CTF)Hack The Box - BigHead

• https://0xrick.github.io/hack-the-box/bighead/

(CTF)LTDH19 RE

• https://blog.syscall.party/post/ltdh-re-walkthrough/

[漏洞]

Android App Diffing: CVE-2019-10875 Inspection

• https://blog.quarkslab.com/android-application-diffing-cve-2019-10875-inspection.html

MachSwap: an iOS 12 Kernel Exploit

• https://sparkes.zone/blog/ios/2019/04/30/machswap-ios-12-kernel-exploit.html

Firefox释放后写入漏洞分析与利用(CVE-2018-18500)

• https://news.sophos.com/en-us/2019/04/18/protected-cve-2018-18500-heap-write-after-free-in-firefox-analysis-and-exploitation/

Twitter Wormable XSS

• https://www.virtuesecurity.com/tale-of-a-wormable-twitter-xss/

Jenkins的数百插件中有100多个插件存在CSRF/SSRF漏洞

• https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2019/may/story-of-a-hundred-vulnerable-jenkins-plugins/

Why You Shouldn't Use a Password Manager For Your Linode Account

• https://utkusen.com/blog/why-you-shouldnt-use-password-manager-for-linode.html

DELL电脑预装的支持助手工具的RCE漏洞

• https://d4stiny.github.io/Remote-Code-Execution-on-most-Dell-computers/

Apache Tomcat CGI Servlet RCE漏洞(CVE-2019-0232)

• https://wwws.nightwatchcybersecurity.com/2019/04/30/remote-code-execution-rce-in-cgi-servlet-apache-tomcat-on-windows-cve-2019-0232/

iOS voucher_swap漏洞

• https://www.darkmatter.ae/papers-articles/from-zero-to-tfp0-part-2-a-walkthrough-of-the-voucher_swap-exploit/

GLPI SQL注入漏洞

• https://www.synacktiv.com/ressources/advisories/GLPI_9.3.3_SQL_Injection.pdf

[恶意代码]

APT34: Glimpse project

• https://marcoramilli.com/2019/05/02/apt34-glimpse-project/

黑客组织Mirrorthief利用Magecart Skimming Attack攻击美国和加拿大的数百个校园网上商店

• https://blog.trendmicro.com/trendlabs-security-intelligence/mirrorthief-group-uses-magecart-skimming-attack-to-hit-hundreds-of-campus-online-stores-in-us-and-canada/

3月份APT组织OilRig泄漏数据的分析

• https://unit42.paloaltonetworks.com/behind-the-scenes-with-oilrig/

银行木马Retefe在4月份对瑞士和德国的攻击

• https://www.proofpoint.com/us/threat-insight/post/2019-return-retefe

FormBook的字符串加密与解密

• https://usualsuspect.re/article/formbook-hiding-in-plain-sight

[代码/工具]

response: 实时事件响应与报告工具

• https://github.com/monzo/response

vulcan: 多种注入技巧的实现

• https://github.com/praetorian-code/vulcan
• https://p16.praetorian.com/blog/process-injection-and-process-hollowing-attck-t1055-t1093

or-axe: 多线程、低带宽消耗的- http DoS工具

• https://github.com/ajmwagar/lor-axe

jqf: 以反馈为导向的结构化Fuzzing平台. 针对Java

• https://github.com/rohanpadhye/jqf

bncov: BinaryNinja插件, 使用静态分析结果进行覆盖分析和可视化

• https://github.com/ForAllSecure/bncov

SymCrypt: Windows当前使用的核心加密功能库

• https://github.com/Microsoft/SymCrypt

SharpClipHistory: 读取用户剪切版历史(从Windows 10 1809 Build开始支持)

• https://github.com/mwrlabs/SharpClipHistory
• https://labs.mwrinfosecurity.com/tools/sharpcliphistory/

autoSource: 自动化代码审查框架, 与SonarQube集成

• https://github.com/Securityautomation/autoSource

argumentinjectionhammer: Burp插件, 识别参数注入漏洞

• https://github.com/nccgroup/argumentinjectionhammer
• https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/may/argument-injection-hammer/

DumpTheGit: 搜索公开的代码仓库, 查找敏感信息

• https://github.com/Securityautomation/DumpTheGit

Bashter: Web爬取、扫描分析框架

• https://github.com/zerobyte-id/Bashter

Flerken: 混淆命令检测工具

• https://github.com/We5ter/Flerken

20190430

[技术]

技术支持诈骗新技巧: 使用iFrame冻结浏览器

• https://blog.trendmicro.com/trendlabs-security-intelligence/tech-support-scam-employs-new-trick-by-using-iframe-to-freeze-browsers/

Office Autoruns与自启动

• https://digital-forensics.sans.org/blog/2019/04/29/offline-autoruns-revisited

使用PVS-Studio挖掘LLVM8的漏洞

• https://www.viva64.com/en/b/0629/

(CTF)Sunday

• https://resources.infosecinstitute.com/hack-the-box-htb-walkthrough-sunday/

How to Catch when Proxies Lie

• https://conferences.sigcomm.org/imc/2018/papers/imc18-final122.pdf

Hacking Dropbox Live in the Heart of Singapore at h1-65

• https://www.hackerone.com/blog/hacking-dropbox-live-heart-singapore-h1-65

Android逆向工作室

• https://github.com/maddiestone/AndroidAppRE
• https://maddiestone.github.io/AndroidAppRE/

区块链强盗: 在以太坊的区块链上发现超过700个活跃私钥

• https://www.securityevaluators.com/casestudies/ethercombing/

IRONHIDE: 一种安全的多核架构, 利用硬件隔离来抵御微架构状态攻击

• https://arxiv.org/abs/1904.12729

Typer vs CAPTCHA: 基于私人信息的验证码, 防止crowdsourcing作弊

• https://arxiv.org/abs/1904.12542

探索大型网络入侵检测的信息中心

• https://arxiv.org/abs/1904.12138

[漏洞]

V8引擎逃逸漏洞分析(CVE-2017-5121)

• https://exp101t.blogspot.com/2019/04/cve-2017-5121-escape-analysis.html

MS Edge类型混淆漏洞分析(CVE-2019–0539)

• https://medium.com/@benoit.sevens/a-closer-beginners-look-at-cve-2019-0539-f2a801afa189

JS引擎漏洞分析(CVE-2019-5790), 以及此漏洞是如何发现的

• https://labs.bluefrostsecurity.de/blog/2019/04/29/dont-follow-the-masses-bug-hunting-in-javascript-engines/

WooCommerce Checkout管理器的提权漏洞

• https://blog.sucuri.net/2019/04/insufficient-privilege-validation-in-woocommerce-checkout-manager.html

[恶意代码]

I know what you did last summer, MuddyWater blending in the crowd

• https://securelist.com/muddywaters-arsenal/90659/

TrickBot使用新方式传播

• https://www.fortinet.com/blog/threat-research/quick-analysis-new-method-spreading-trickbot.html

分析Amadey

• https://nao-sec.org/2019/04/Analyzing-amadey.html

Electrum僵尸网络感染量超过15万

• https://blog.malwarebytes.com/cybercrime/2019/04/electrum-ddos-botnet-reaches-152000-infected-hosts/

[代码/工具]

modDetective: 分析系统上文件的编辑时间, 调查最近的系统行为

• https://github.com/itsKindred/modDetective

ScanQLi: SQL注入扫描器

• https://github.com/bambish/ScanQLi

从Gnuk / Nitrokey Start固件中提取PGP密钥

• https://github.com/rot42/gnuk-extractor

save-page-state: Chrome扩展, 保存页面状态, 供以后分析

• https://github.com/vrtdev/save-page-state

[其他]

macOS '.DS_Store'文件格式规范

• https://formats.kaitai.io/ds_store/index.html

经常被混淆的安全话题

• https://resources.infosecinstitute.com/commonly-confused-security-topics/

20190429

[技术]

Mac平台供应链攻击, Part1: 使用URL投递

• https://www.crowdstrike.com/blog/new-mac-delivery-attack-scheme-video-rsa-2019/

使用Voyager做安全测试(GraphQL)

• https://medium.com/p/86d3c634bcd9

(CTF)HackTheBox Write-up Irked

• https://medium.com/bugbountywriteup/hackthebox-write-up-irked-4f1911ca1511

通过逆向CTF, 对比IDA与Ghidra

• https://youtu.be/S06pgk4DjFQ

使用Firda Hook Android libbinder

• https://bhamza.me/2019/04/24/Frida-Android-libbinder.html

伪造地址栏: 钓鱼新方式

• https://jameshfisher.com/2019/04/27/the-inception-bar-a-new-phishing-method/

对以NoSQL数据库做后端的App的注入攻击

• https://github.com/riyazwalikar/injection-attacks-nosql-talk

计算机网络中入侵检测的端到端对抗性学习

• https://arxiv.org/abs/1904.11577

[漏洞]

CVE-2019-8518 FTL LICM GetByVal hoisted OOB

• https://github.com/dwfault/blog/blob/master/source/_posts/CVE-2019-8518%20FTL%20LICM%20GetByVal%20hoisted%20OOB.md

Android下载提供者(Download Provider)的多个漏洞分析(CVE-2018-9468, CVE-2018-9493, CVE-2018-9546)

• https://ioactive.com/multiple-vulnerabilities-in-androids-download-provider-cve-2018-9468-cve-2018-9493-cve-2018-9546/

[代码/工具]

Office-365-Extractor: 从Office 365环境中提取Unified Audit Log

• https://github.com/jrentenaar/Office-365-Extractor

PSWinReporting: 监控并读取Windows事件, PowerShell脚本

• https://github.com/EvotecIT/PSWinReporting
• https://evotec.xyz/the-only-powershell-command-you-will-ever-need-to-find-out-who-did-what-in-active-directory/

EvilClippy: 辅助创建恶意Office文档, 跨平台

• https://github.com/outflanknl/EvilClippy

ParamPamPam: 爆破GET和POST参数

• https://github.com/Bo0oM/ParamPamPam

GitHacker: Git源码泄漏工具, 可恢复整个git repo, 用于白盒审计和理解开发者的思维

• https://github.com/WangYihang/GitHacker

MalConfScan: Volatility插件, 从已知的恶意软件家族中提取配置信息

• https://github.com/jpcertcc/malconfscan

20190428

[技术]

Weaponizing Privileged File Writes with Windows Collector Service

• https://rastamouse.me/2019/04/weaponizing-privileged-file-writes-with-windows-collector-service/

Returning the call – ‘moshi moshi’, the API way (a.k.a. API cold calling), Part 2

• http://www.hexacorn.com/blog/2019/04/27/returning-the-call-moshi-moshi-the-api-way-a-k-a-api-cold-calling-part-2/

使用IDA从0开始学逆向, P12

• https://threatrecon.nshc.net/2019/01/30/operation-kitty-phishing/

使用Ghidra破解CrackMe

• https://www.kalitut.com/2019/04/using-ghidra-to-attack-crackme.html

使用memfd_create系统调用创建简易的运行时Crypter(Linux ELF)

• https://www.guitmz.com/linux-elf-runtime-crypter/

创建被动的IMSI捕获器

• https://harrisonsand.com/imsi-catcher/

(CTF)Hack The Box - Irked

• https://0xrick.github.io/hack-the-box/irked/

Vulnhub Write-up —DC-1

• https://medium.com/bugbountywriteup/vulnhub-writeup-dc-1-37dcf92b456a

Exploring Continuous Integration Services as a Bug Bounty Hunter

• https://edoverflow.com/2019/ci-knew-there-would-be-bugs-here/

使用KDNET附加到虚拟机内Win10内核

• https://medium.com/@ophirharpaz/kdnet-tutorial-for-noobs-68669778bbd4

使用基于ESP的设备嗅探802.11数据包

• https://z4ziggy.wordpress.com/2019/04/27/how-bout-sniffin-those-802-11-packets/

AMD-V for Hackers

• http://tandasat.github.io/VXCON/AMD-V_for_Hackers.pdf

[漏洞]

数百个品牌的安全摄像头、婴儿监视器和“智能”门铃都存在严重安全漏洞, 可使攻击者劫持设备, 监控用户

• https://hacked.camera/

WooCommerce插件任意文件上传漏洞

• https://www.webarxsecurity.com/woocommerce-checkout-manager/

[恶意代码]

AESDDoS僵尸网络变种利用CVE-2019-3396传播, 可执行DDoS攻击和挖矿

• https://blog.trendmicro.com/trendlabs-security-intelligence/aesddos-botnet-malware-exploits-cve-2019-3396-to-perform-remote-code-execution-ddos-attacks-and-cryptocurrency-mining/

[代码/工具]

okadminfinder3: 管理员面板路径查找/管理员登录面板路径查找

• https://github.com/mIcHyAmRaNe/okadminfinder3

[其他]

Troopers19完整视频列表

• https://insinuator.net/2019/04/troopers-chill/

20190426

[技术]

破解全盘加密: 一个可启动的闪存驱动器就够了

• https://blog.elcomsoft.com/2019/04/a-bootable-flash-drive-to-extract-encrypted-volume-keys-break-full-disk-encryption/

Android App数据加密方法Top7

• https://www.apriorit.com/dev-blog/612-mobile-cybersecurity-encryption-in-android

XSS-Auditor — the protector of unprotected

• https://medium.com/bugbountywriteup/xss-auditor-the-protector-of-unprotected-f900a5e15b7b

Through the cloud – remote debugging to crack MQ

• https://www.komodosec.com/post/through-the-cloud-remote-debugging-to-crack-mq

使用性能监视计数器检测针对AES的时间分段缓存攻击

• https://arxiv.org/abs/1904.11268

使用Frida在Windows系统上创建通用密码后门

• https://sensepost.com/blog/2019/recreating-known-universal-windows-password-backdoors-with-frida/

PowerDrive: 对Powershell恶意样本进行精确的反混淆和分析

• https://arxiv.org/abs/1904.10270

利用Azure信息保护(AIP)进行网络钓鱼

• https://www.trustedsec.com/2019/04/next-gen-phishing-leveraging-azure-information-protection/

现代软件开发环境中的供应链攻击

• https://p16.praetorian.com/blog/red-team-supply-chain-attacks-in-modern-software-development-environments

利用MS安全威胁检测平台(MSRD)挖掘VeryPDF阅读器的漏洞

• https://www.vdalabs.com/2019/04/25/microsoft-security-risk-detection-0day-in-verypdf-reader-part-1/

[漏洞]

Oracle WebLogic反序列化RCE漏洞

• https://devcentral.f5.com/articles/oracle-weblogic-deserialization-remote-code-execution-34185

Internet of Planes: Hacking Millionaires’ Jet Cabins

• https://act-on.ioactive.com/acton/attachment/34793/f-df29659f-1366-4a9d-9320-bdef69b2048a/1/-/-/-/-/IoP%20-%20Technical%20Advisory%20Paper%20%28Martinez%29.pdf

Win10 DHCP客户端RCE漏洞(CVE-2019-0726)

• https://www.zerodayinitiative.com/blog/2019/4/25/cve-2019-0726-an-rce-vulnerability-in-the-windows-10-dhcp-client

Sierra Wireless AirLink ES450多个漏洞

• https://blog.talosintelligence.com/2019/04/vulnerability-sierra-airlink.html

WooCommerce Checkout Manager任意文件上传漏洞

• https://www.webarxsecurity.com/woocommerce-checkout-manager/

[恶意代码]

分析某Word文档中的VBA代码和P-code

• https://pcsxcetrasupport3.wordpress.com/2019/04/25/a-look-at-stomped-vba-code-and-the-p-code-in-a-word-document/

使用Ghidra分析ShadowHammer攻击行动的第1阶段样本

• https://youtu.be/gI0nZR4z7_M

APT组织Lazarus在针对macOS用户的攻击中使用的恶意文档分析

• https://www.sentinelone.com/blog/lazarus-apt-targets-mac-users-poisoned-word-document/

银行木马Emotet添加新的躲避检测技巧, 使用被黑的设备做与C&C之间的代理

• https://blog.trendmicro.com/trendlabs-security-intelligence/emotet-adds-new-evasion-technique-and-uses-connected-devices-as-proxy-cc-servers/

JasperLoader重新出现, 针对意大利, 加载Gootkit银行木马

• https://blog.talosintelligence.com/2019/04/jasperloader-targets-italy.html

[代码/工具]

ida-climacros: 在IDA的命令行接口中定义并使用静态或动态的宏

• https://github.com/0xeb/ida-climacros
• http://0xeb.net/2019/04/climacros-ida-productivity-tool/

Frida脚本, 查看Android libbinder流量

• https://github.com/Hamz-a/frida-android-libbinder

20190425

[技术]

3个新的代码注入技巧

• http://www.hexacorn.com/blog/2019/04/24/3-new-code-injection-tricks/

用于时钟同步的协议NTP,也可做C&C通道

• https://www.virusbulletin.com/blog/2019/04/paper-alternative-communication-channel-over-ntp/

使用YETI和Elastic Stack进行威胁狩猎

• https://blog.ensilo.com/threat-hunting-tips
• https://github.com/breakingmalwareresearch/yetitoelastic

NFC支付的安全性分析

• https://arxiv.org/abs/1904.10623

如何高效地识别不同版本的Android中的相同代码(Diffing)

• https://blog.quarkslab.com/android-application-diffing-engine-overview.html

OAuth2.0 Hack的常见方式

• https://habr.com/en/post/449182/

基于DNS的威胁狩猎与DoH (DNS over - httpS)

• https://blog.redteam.pl/2019/04/dns-based-threat-hunting-and-doh.html

如何绕过防火墙访问Cardholder Data Environment

• https://markitzeroday.com/pci/active-directory/kerberoast/firewall/2019/04/24/gaining-access-to-card-data-using-the-windows-domain-to-bypass-firewalls.html

Besder网络摄像头研究

• http://blog.0x42424242.in/2019/04/besder-investigative-journey-part-1_24.html

从未知文件系统中重建j2me固件

• http://recon.cx/2018/montreal/schedule/system/event_attachments/attachments/000/000/058/original/RECON-MTL-2018-This_Dump_is_a_Puzzle.pdf

[漏洞]

WebLogic 0Day RCE漏洞

• https://www.waratek.com/new-weblogic-zero-day-rce-vulnerability/

巴西银行系列恶意软件增加新成员: NovaLoader

• https://www.zscaler.com/blogs/research/novaloader-yet-another-brazilian-banking-malware-family

Apache Tomcat RCE漏洞(CVE-2019-0232)

• https://blog.trendmicro.com/trendlabs-security-intelligence/uncovering-cve-2019-0232-a-remote-code-execution-vulnerability-in-apache-tomcat/

RoR使用Rubyzip处理Zip文件的路径回溯漏洞, 可被利用实现RCE

• https://blog.doyensec.com/2019/04/24/rubyzip-bug.html

高通公司基于硬件的密钥库可被提取私钥

• https://www.nccgroup.trust/us/our-research/private-key-extraction-qualcomm-keystore/

[恶意代码]

LockerGoga: When Ransomware Strikes Back

• https://www.lastline.com/labsblog/lockergoga-when-ransomware-strikes-back/

Emotet使用WMI运行Powershell

• https://www.carbonblack.com/2019/04/24/cb-tau-threat-intelligence-notification-emotet-utilizing-wmi-to-launch-powershell-encoded-code/

The Russian Shadow in Eastern Europe: Ukrainian MOD Campaign

• https://blog.yoroi.company/research/the-russian-shadow-in-eastern-europe-ukrainian-mod-campaign/

黑客组织TA505使用新的后门和Lolbin对金融企业的攻击行动分析

• https://www.cybereason.com/blog/threat-actor-ta505-targets-financial-enterprises-using-lolbins-and-a-new-backdoor-malware

使用Cutter和Radare2对APT组织海莲花在攻击中使用的样本进行控制流的反混淆

• https://research.checkpoint.com/deobfuscating-apt32-flow-graphs-with-cutter-and-radare2/

[代码/工具]

procSpy: 监控并记录用户执行的命令(Linux)

• https://github.com/itsKindred/procSpy

ffuf: Go语言编写的高速Web Fuzzer

• https://github.com/ffuf/ffuf

Venator: 在macOS设备上检测并收集恶意活动信息

• https://github.com/richiercyrus/Venator
• https://posts.specterops.io/introducing-venator-a-macos-tool-for-proactive-detection-34055a017e56

[其他]

AFL介绍与相关资源收集

• https://habr.com/ru/company/dsec/blog/449134/

磁盘加密101

• https://resources.infosecinstitute.com/disk-encryption-101/

20190424

[技术]

代码注入新技巧

• http://www.hexacorn.com/blog/2019/04/23/wordwarper-new-code-injection-trick/

macOS系统利用脚本文件实现驻留

• https://theevilbit.github.io/posts/macos_persisting_through-application_script_files/

从Nordic RF微控制器中提取固件

• https://blog.rapid7.com/2019/04/23/extracting-firmware-from-microcontrollers-onboard-flash-memory-part-2-nordic-rf-microcontrollers/

一行代码逃逸 Safari 沙箱

• https://blog.chichou.me/one-liner-safari-sandbox-escape-8a6ecd665b05

Metasploit payload在Linux平台的免杀

• https://astr0baby.wordpress.com/2019/04/23/metasploit-payloads-evasion-against-linux-av/

Windows 10 egghunter (wow64)

• https://www.corelan.be/index.php/2019/04/23/windows-10-egghunter/

混淆代码的行为分析

• https://pdfs.semanticscholar.org/7e88/2053c31831399b730e9b9cc5e9bec00f8e7c.pdf

[漏洞]

[XSS] Reflected XSS Bypass Filter

• https://medium.com/p/de41d35239a3

macOS漏洞详解(CVE-2019-8507)

• https://www.fortinet.com/blog/threat-research/detailed-analysis-mac-os-vulnerability-cve-2019-8507.html

Confluence路径回溯漏洞可导致任意文件写入(CVE-2019-3398)

• https://devcentral.f5.com/articles/confluence-arbitrary-file-write-via-path-traversal-cve-2019-3398-34181

我是如何在Mod Security CRS中发现5个ReDOS漏洞的

• https://medium.com/@somdevsangwan/how-i-found-5-redos-vulnerabilities-in-mod-security-crs-ce8474877e6e?sk=c64852245215d6fead387acbd394b7db

Getting access to Zendesk’s Google Cloud and Artifactory from GitHub dotfile repos

• https://blog.assetnote.io/bug-bounty/2019/04/23/getting-access-zendesk-gcp/

jQuery原型污染漏洞

• https://snyk.io/blog/after-three-years-of-silence-a-new-jquery-prototype-pollution-vulnerability-emerges-once-again/

Symantec终端防护软件内核内存泄漏漏洞

• https://blog.talosintelligence.com/2019/04/vulnerability-spotlight-symantec.html

[恶意代码]

DNSpionage攻击事件背后的组织开发的新恶意软件Karkoff

• https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html

利用Google Sites的File Cabinet投递恶意软件

• https://securityledger.com/2019/04/drive-by-malware-uses-google-sites-for-drive-by-download-attacks/

使用Ghidra分析Emotet

• https://medium.com/@0xd0cf11e/analyzing-emotet-with-ghidra-part-1-4da71a5c8d69
• https://medium.com/@0xd0cf11e/analyzing-emotet-with-ghidra-part-2-9efbea374b14

ShadowHammer行动: 之前针对华硕的供应链攻击只是ShadowHammer行动的一部分

• https://securelist.com/operation-shadowhammer-a-high-profile-supply-chain-attack/90380/

滥用Windows MSI安装包的自定义行为执行恶意脚本(JavaScript, VBScript, PowerShell)

• https://blog.trendmicro.com/trendlabs-security-intelligence/analysis-abuse-of-custom-actions-in-windows-installer-msi-to-run-malicious-javascript-vbscript-and-powershell-scripts/

使用植入后门的TeamViewer对欧洲多个大使馆发动的攻击行动分析

• https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

分析APT32泄漏的用于DNS攻击的代码webmask

• https://marcoramilli.com/2019/04/23/apt34-webmask-project/

[代码/工具]

APT组织Carbanak泄漏的源码, 超10万行代码(2年前上传到VT)

• https://github.com/Aekras1a/Updated-Carbanak-Source-with-Plugins 火眼发布的系列分析
• https://www.fireeye.com/blog/threat-research/2019/04/carbanak-week-part-one-a-rare-occurrence.html
• https://www.fireeye.com/blog/threat-research/2019/04/carbanak-week-part-two-continuing-source-code-analysis.html

termshark: 控制台版本的Tshark UI

• https://github.com/gcla/termshark

MalConfScan-with-Cuckoo: Cuckoo沙箱插件, 从已知类型的恶意样本中提取配置文件

• https://github.com/JPCERTCC/MalConfScan-with-Cuckoo

WhatBreach: OSINT工具, 查找泄漏的邮件和数据库

• https://github.com/Ekultek/WhatBreach

C语言编写的反向Shell(Linux), 支持TLS/SSL

• https://github.com/odzhan/shellcode/tree/master/os/linux/c
• https://modexp.wordpress.com/2019/04/24/glibc-shellcode/

EasySploit: Metasploit自动化工具

• https://github.com/KALILINUXTRICKSYT/easysploit

reverie: 自动化渗透工具(用于Parrot Linux)

• https://github.com/baguswiratmaadi/reverie

[其他]

国外网友分享的被国内伪装成安全从业者诈骗的经历

• https://medium.com/@EIP41414141/my-experience-of-being-defrauded-by-a-fake-security-researcher-yushi-liang-yux1xi-15bb53eb2f57

无人机的隐私和安全问题

• https://resources.infosecinstitute.com/privacy-and-security-issues-with-drones/

使用开源软件实现DevSecOps

• https://www.notsosecure.com/achieving-devsecops-with-open-source-tools/

网站的安全盲点

• https://www.perimeterx.com/blog/client-side-security-blindspot/

20190423

[技术]

Windows系统CreateProcess API的复杂度研究

• https://randomascii.wordpress.com/2019/04/21/on2-in-createprocess/

禁用Burp的更新界面, Part1

• https://parsiya.net/blog/2019-04-21-disabling-burps-update-screen---part-1---analysis-and-failures/

使用PVS-Studio审计CUBA Platform的代码

• https://www.viva64.com/en/b/0626/

针对IDA用户的Ghidra技巧, Part2: 字符串与参数

• https://digital-forensics.sans.org/blog/2019/04/22/a-few-ghidra-tips-for-ida-users-part-2-strings-and-parameters

(CTF)Ch4inrulz 1.0.1: CTF walkthrough, part 1

• https://resources.infosecinstitute.com/ch4inrulz-ctf-walkthrough-part-1/

使用深度神经网络检测ADS-B欺骗攻击

• https://arxiv.org/abs/1904.09969

使用Wayback Machine挖掘漏洞

• https://medium.com/@ghostlulzhacks/wayback-machine-e678a3567ec
• https://github.com/ghostlulzhacks/waybackMachine

在Mac OS系统上获取Office 365凭证

• https://medium.com/@adam.toscher/how-to-obtain-office-365-credentials-on-mac-os-275c1ea8c011

编写IoT平台的Shellcode: 带密码保护的反向Shell(Linux/ARM)

• https://medium.com/syscall59/shellcode-for-iot-a-password-protected-reverse-shell-linux-arm-a18fcda4853b

近10年发生的供应链攻击事件中, 向C/C++运行时苦注入代码的攻击分析

• https://blog.trendmicro.com/trendlabs-security-intelligence/analyzing-c-c-runtime-library-code-tampering-in-software-supply-chain-attacks/

[漏洞]

可获取Facebook内部JS模块的漏洞

• https://ysamm.com/?p=256

[恶意代码]

HopLight木马(朝鲜相关)重用大量代码

• https://www.carbonblack.com/2019/04/22/cb-tau-threat-intelligence-notification-hoplight-campaign-linked-to-north-korea-is-reusing-substantial-amount-of-code/

[代码/工具]

二进制分析平台angr添加Java/Android支持

• http://angr.io/blog/java_angr/

netmap.js: 基于浏览器的网络发现工具(主机发现/端口扫描)

• https://github.com/serain/netmap.js

anevicon: 基于UDP的流量生成器, Rust编写, 高性能

• https://github.com/Gymmasssorla/anevicon

php-compiler: PHP代码编译器

• https://github.com/ircmaxell/php-compiler
• https://blog.ircmaxell.com/2019/04/compilers-ffi.html

[其他]

What 10 million passwords reveal about the people who choose them

• https://wpengine.com/unmasked/

20190422

[技术]

通用命令行Fuzzy查找器Fzf实战

• https://medium.com/p/a7de312403ff

MythX智能协议安全分析API深入解析

• https://medium.com/p/3c2cd8e6a338

关于操作系统命令漏洞中的参数注入, 我们还需要知道些什么

• https://medium.com/p/827a0b63c003

现代C++可能导致漏洞的一些习惯用法

• https://alexgaynor.net/2019/apr/21/modern-c++-wont-save-us/

在多GPU系统上使用hashcat进行密码破解

• https://paumunoz.tech/2019/04/19/mastering-hashcat-for-multi-gpu-linux-hash-cracking/

逆向1个未文档化的游戏文件格式

• https://www.unknowncheats.me/forum/general-programming-and-reversing/332048-example-reversing-undocumented-game-file-format.html

qgrep命令内部原理

• https://zeux.io/2019/04/20/qgrep-internals/

(CTF)Teacher

• https://github.com/mzfr/Wargames-Solutions/tree/master/HackTheBox/Teacher
• https://0xrick.github.io/hack-the-box/teacher/
• https://khaoticdev.net/?p=168

针对嵌入式系统的现代漏洞研究技巧

• https://breaking-bits.gitbook.io/breaking-bits/vulnerability-discovery/reverse-engineering/modern-approaches-toward-embedded-research

恶意代码常用的PE变形/畸形方式

• https://youtu.be/-0DEEbQq8jU

通过无法检测到的网络(Covert Channel)从目标主机窃取数据

• https://www.hackingarticles.in/covert-channel-the-hidden-network/

Active Directory渗透

• http://blog.securelayer7.net/exploring-exploiting-active-directory-pen-test/

[漏洞]

组合利用多个漏洞, 绕过几乎所有阿里巴巴网站的WAF, 并实现账户接管

• http://docs.ioin.in/writeup/medium.com/__y_shahinzadeh_chaining_multiple_vulnerabilities_waf_bypass_to_account_takeover_in_almost_all_alibabas_websites_f8643eaa2855/index.html

IE浏览器XXE注入漏洞(0Day), 可导致攻击者窃取文件、系统信息等

• https://blog.trendmicro.com/trendlabs-security-intelligence/zero-day-xml-external-entity-xxe-injection-vulnerability-in-internet-explorer-can-let-attackers-steal-files-system-info/

使用Zendesk和Help Scout, 以更危险的方式和有趣的攻击向量再次利用ticket trick

• https://sites.google.com/securifyinc.com/secblogs/scary-tickets

深入解析Linux提权漏洞“SUDO_INJECT”

• https://www.i-secure.co.th/2019/04/in-depth-analysis-of-eop-vulnerability-sudo-inject/

Twitter的搜索链接可能暴露被保护推文, 进而泄漏敏感信息

• https://hackerone.com/reports/491473

Facebook漏洞收集

• https://github.com/emadshanab/facebook-bug-bounty-writeups/blob/master/Bugs

macOS root本地提权漏洞(CVE-2019-8565), Part2

• https://medium.com/@CodeColorist/rootpipe-reborn-part-ii-e5a1ffff6afe

V8引擎语言解析器的堆缓存溢出漏洞(CVE-2019-5790)

• https://bugs.chromium.org/p/chromium/issues/detail?id=914736

[恶意样本]

海莲花使用的自定义格式的可执行文件样本分析

• https://blog.malwarebytes.com/threat-analysis/2019/04/funky-malware-format-found-in-ocean-lotus-sample/

[代码/工具]

OpenMailRelayFuzzer: 查找Open Mail Relay的Fuzzer

• https://github.com/tg12/OpenMailRelayFuzzer

pyEmbed: 将恶意Python代码嵌入到其他的Python代码中, 例如标准库代码

• https://github.com/itsKindred/pyEmbed

miniprint: 打印机密罐, 中等交互级别

• https://github.com/sa7mon/miniprint

dollhouse: 谷歌云平台审计工具

• https://github.com/gojek/dollhouse

FTPBruter: FTP服务器爆破工具

• https://github.com/GitHackTools/FTPBruter

WDExtract: 从vdm文件中提取Windows Defender数据库并unpack

• https://github.com/hfiref0x/WDExtract

mongoBuster: 扫描网络中公开的Mongodb数据库(默认扫描整个互联网)

• https://github.com/yashpl/mongoBuster

PowerShell脚本, 检查SQL帐号过期日期

• https://github.com/guyrleech/Microsoft/blob/master/Check%20SQL%20account%20expiry.ps1

[其他]

捕获的华为P30 Pro发出的DNS请求

• https://github.com/pe3zx/huawei-block-list

瑞士电子投票系统的应用级安全性概述

• https://mazinahmed.net/uploads/Overview%20of%20the%20Application-Level%20Security%20of%20the%20Swiss%20Evoting%20System.pdf

20190419

[技术]

从区块链节点中删除数据

• https://arxiv.org/abs/1904.08901

基于模糊规则插值的入侵检测机制

• https://arxiv.org/abs/1904.08790

Docker容器中的用户权限

• https://medium.com/jobteaser-dev-team/docker-user-best-practices-a8d2ca5205f4

使用Slack做C&C

• https://p16.praetorian.com/blog/using-slack-as-c2-channel-mitre-attack-web-service-t1102

静态脱壳加密狗包含的PEFile

• https://github.com/batteryshark/writeups/tree/master/20190417

深入解析PEAP

• https://sensepost.com/blog/2019/understanding-peap-in-depth/

逆向iOS的沙箱内核扩展(Vs com.apple.security.sandbox)

• https://census-labs.com/media/sandbox-argp-csw2019-public.pdf

如何备份/恢复组策略对象

• https://blog.stealthbits.com/how-to-backup-and-recover-group-policy-objects/

使用IDA从零开始学逆向, Part11

• https://medium.com/p/34e6214132d6

Kali Linux渗透指南

• https://www.apriorit.com/dev-blog/611-kali-linux-for-pentesting

(CTF)Fowsniff 1: CTF walkthrough

• https://resources.infosecinstitute.com/fowsniff-ctf-walkthrough/

Trusted Types and the end of DOM XSS

• https://www.slideshare.net/kkotowicz/trusted-types-and-the-end-of-dom-xss

[漏洞]

Foxit Reader提权漏洞(CVE-2018-20310)

• https://srcincite.io/advisories/src-2019-0025/

为已公开漏洞编写Exploit(CVE-2018-19204)

• https://sensepost.com/blog/2019/being-stubborn-pays-off-pt.-1-cve-2018-19204/

Drop-by-Drop: Bleeding through libvips

• https://blog.silentsignal.eu/2019/04/18/drop-by-drop-bleeding-through-libvips/

PDFReacter SSRF漏洞导致Root级别的本地文件读取, 进一步导致RCE

• https://medium.com/p/eb460ffb3129

Pwn2Own大会上Firefox的2个JIT漏洞

• https://www.zerodayinitiative.com/blog/2019/4/18/the-story-of-two-winning-pwn2own-jit-vulnerabilities-in-mozilla-firefox

Firefox堆内存释放后写入漏洞(CVE-2018-18500)分析与利用

• https://news.sophos.com/en-us/2019/04/18/protected-cve-2018-18500-heap-write-after-free-in-firefox-analysis-and-exploitation/

Chromium UXSS exploit的分析与缓解

• https://ai.google/research/pubs/pub48028

[恶意代码]

窃密软件Predator the Thief新变种

• https://www.fortinet.com/blog/threat-research/predator-the-thief-new-routes-delivery.html

谷歌商店的App "Peel Smart Remote"会泄漏用户图片

• https://hakin9.org/google-play-app-peel-smart-remote-leaks-users-pictures-by-the-pradeo-lab/

[代码/工具]

BlueCommand: 为PowerShell Empire编写的前端

• https://github.com/leeberg/BlueCommand

web-cve-tests: 测试Web App是否对已公开的CVE免疫

• https://github.com/foospidy/web-cve-tests
• https://medium.com/@foospidy/simple-tool-for-testing-cve-mitigation-in-web-apps-f7fc03843b99

Vampire: aggressor脚本, 右键点击beacon时添加菜单"Mark Owned"

• https://github.com/Coalfire-Research/Vampire

SharpGPO-RemoteAccessPolicies: 通过组策略枚举远程访问策略

• https://github.com/mwrlabs/SharpGPO-RemoteAccessPolicies

EfiGuard: x64 UEFI bootkit, 在系统启动时禁用PatchGuard和DSE

• https://github.com/Mattiwatti/EfiGuard

fireELF: 无文件Linux恶意代码框架

• https://github.com/rek7/fireELF

20190418

[技术]

如何从pagefile.sys中提取审计信息

• https://www.andreafortuna.org/2019/04/17/how-to-extract-forensic-artifacts-from-pagefile-sys/

使用RSA NetWitness检测横向渗透

• https://community.rsa.com/community/products/netwitness/blog/2019/04/17/detecting-lateral-movement-in-rsa-netwitness-smbexec

5G安全的现状和主要的安全挑战

• https://arxiv.org/abs/1904.08394

解密SSL/TLS流量, 检测隐藏威胁

• https://arxiv.org/abs/1904.08383

OWASP Top 10: 不同类型的XSS

• http://blog.securelayer7.net/owasp-top-10-what-are-different-types-of-xss/

(CTF)SP eric: Vulnhub Lab Walkthrough

• https://www.hackingarticles.in/sp-eric-vulnhub-lab-walkthrough/

Subaru StarLink(斯巴鲁森林人)越狱

• https://github.com/sgayou/subaru-starlink-research/blob/master/doc/README.md

密码喷洒攻击的常见错误以及如何避免

• https://medium.com/@adam.toscher/password-spraying-common-mistakes-and-how-to-avoid-them-3fd16b1a352b

Windows Server 2016 PAM(Privileged Access Management)的错误使用方式, 可导致跨森林攻击

• https://www.labofapenetrationtester.com/2019/04/abusing-PAM.html

逆向Broadcom无线芯片组

• https://blog.quarkslab.com/reverse-engineering-broadcom-wireless-chipsets.html

逆向Broadcom NIC固件

• https://www.devever.net/~hl/ortega

利用ProcessDebugObjectHandle实现反-反调试技巧

• https://tyranidslair.blogspot.com/2019/04/processdebugobjecthandle-anti-anti.html

[漏洞]

Firefox UAF漏洞 CVE-2018-18500 PoC

• https://github.com/sophoslabs/CVE-2018-18500

Microsoft Edge Uses a Secret Trick And Breaks Internet Explorer's Security

• https://blog.0patch.com/2019/04/microsoft-edge-uses-secret-trick-and.html

Azure云服务的漏洞可导致攻击者劫持Windows服务: Windows Live Tiles

• https://www.golem.de/news/subdomain-takeover-microsoft-loses-control-over-windows-tiles-1904-140717.html

macOS版印象笔记的本地文件路径回溯漏洞(CVE-2019-10038)

• https://www.inputzero.io/2019/04/evernote-cve-2019-10038.html

EA Origin桌面客户端的RCE漏洞

• https://blog.underdogsecurity.com/rce_in_origin_client/

内核指针解引用导致的提权漏洞(CVE-2017-18019)

• https://labs.nettitude.com/blog/privilege-escalation-via-a-kernel-pointer-dereference-cve-2017-18019/

ThinkPHP 5.x RCE漏洞

• https://blog.sucuri.net/2019/04/thinkphp-5-x-remote-code-execution.html

[恶意代码]

Aggah攻击行动: 使用Bit.ly, BlogSpot和Pastebin做C&C的大规模攻击行动

• https://unit42.paloaltonetworks.com/aggah-campaign-bit-ly-blogspot-and-pastebin-used-for-c2-in-large-scale-campaign/

将脚本引擎AutoHotkey和恶意脚本嵌入到Excel文件中的恶意样本

• https://blog.trendmicro.com/trendlabs-security-intelligence/potential-targeted-attack-uses-autohotkey-and-malicious-script-embedded-in-excel-file-to-avoid-detection/

Understanding the cyber threat from Iran

• https://www.mwrinfosecurity.com/our-thinking/understanding-the-cyber-threat-from-iran/

有国家背景的DNS劫持攻击事件分析

• https://blog.talosintelligence.com/2019/04/seaturtle.html

[代码/工具]

CoreHook: 对.NET应用程序的函数调用进行拦截, 类似与对原生程序进行Hook的框架EasyHook

• https://github.com/unknownv2/CoreHook

GhidraPAL: 基于抽象解释(abstract interpretation)的Ghidra反混淆插件

• https://github.com/RolfRolles/GhidraPAL

flounder: 基于Bing的语料收集工具

• https://github.com/gamozolabs/flounder

Platypus: 反向Shell会话管理工具, Go编写

• https://github.com/WangYihang/Platypus

flashmingo: SWF文件自动化分析工具

• https://github.com/fireeye/flashmingo
• https://www.fireeye.com/blog/threat-research/2019/04/flashmingo-open-source-automatic-analysis-tool-for-flash.html

[其他]

Bad Bot Report 2019

• https://resources.distilnetworks.com/white-paper-reports/bad-bot-report-2019

20190417

[技术]

DNS安全、攻击与对策

• https://documentcloud.adobe.com/link/track?uri=urn%3Aaaid%3Ascds%3AUS%3Ab1e9dd2a-e85a-4064-89fd-33738b3df6bc

使用Wireshark解析SSL转发代理

• https://devcentral.f5.com/articles/ssl-forward-proxy-explained-using-wireshark-34165

隐写书识别

• https://arxiv.org/abs/1904.07554

从Atmel微控制器中提取固件

• https://blog.rapid7.com/2019/04/16/extracting-firmware-from-microcontrollers-onboard-flash-memory-part-1-atmel-microcontrollers/

老兄, 我车哪儿去了?

• https://fidusinfosec.com/dude-wheres-my-car-keyless-car-theft-101/

(CTF)PlaidCTF 2019: Potent Quotables (Web 300)

• https://blog.pspaul.de/posts/plaidctf-2019-potent-quotables/

探索AFL背后的灰箱Fuzzing算法, 以及我们如何利用它来解决自动化漏洞挖掘的各种问题

• https://www.fuzzingbook.org/html/GreyboxFuzzer.html

(CTF)plaidctf-2019

• https://github.com/david942j/ctf-writeups/tree/master/plaidctf-2019

Windows漏洞利用技巧: 滥用用户模式调试器

• https://googleprojectzero.blogspot.com/2019/04/windows-exploitation-tricks-abusing.html

AMSI(反恶意代码扫描接口)工作原理, 以及已知的绕过技巧

• https://iwantmore.pizza/posts/amsi.html

Chrome的JS编译器介绍

• https://docs.google.com/presentation/d/1DJcWByz11jLoQyNhmOvkZSrkgcVhllIlCHmal1tGzaw/edit#slide=id.p

Python编写的僵尸网络/后门Ares实战

• https://www.hackingarticles.in/command-control-ares/

OSINT技术分享

• https://0x00sec.org/t/my-personal-osint-techniques-part-1-of-2-key-layer-contingency-seeding/13033

[漏洞]

Win10 DHCP严重漏洞CVE-2019-0726

• https://habr.com/ru/company/pt/blog/448378/

ManageEngine ADManager提权漏洞

• https://research.digitalinterruption.com/2019/04/15/privilege-escalation-in-manageengine-admanager-plus-6/

Sitecore对象反序列化漏洞

• https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf

利用DICOM的漏洞将恶意软件嵌入到CT/MRI图像中

• https://labs.cylera.com/2019/04/16/pe-dicom-medical-malware/

[恶意代码]

银行木马Danabot预警

• https://www.carbonblack.com/2019/04/16/cb-tau-threat-intelligence-notification-danabot-trojan-targets-financial-services-industry-via-stolen-credentials/

大规模的eGobbler恶意广告活动, 利用Chrome漏洞, 针对iOS用户

• https://blog.confiant.com/massive-egobbler-malvertising-campaign-leverages-chrome-vulnerability-to-target-ios-users-a534b95a037f

Scranos行动: 使用签名的Rootkit, 窃取登录和支付信息

• https://labs.bitdefender.com/2019/04/inside-scranos-a-cross-platform-rootkit-enabled-spyware-operation/

黑客组织OilRig使用的利用DNS隧道技术与C&C通信的工具

• https://unit42.paloaltonetworks.com/dns-tunneling-in-the-wild-overview-of-oilrigs-dns-tunneling/

针对越南政府的APT攻击中一个有趣的恶意文档样本

• https://blog.en.elevenpaths.com/2019/04/new-research-docless-vietnam-apt.html

Electrum Bitcoin wallets under siege

• https://blog.malwarebytes.com/cybercrime/2019/04/electrum-bitcoin-wallets-under-siege/

[代码/工具]

ddisasm: 精准的反汇编工具, 反汇编后的代码可重新汇编为可执行文件

• https://github.com/grammatech/ddisasm
• https://blogs.grammatech.com/open-source-tools-for-binary-analysis-and-rewriting

purple-team-attack-automation: Metasploit automation of MITRE ATT&CK™ TTPs

• https://github.com/praetorian-inc/purple-team-attack-automation

pywhatcms: 是哟给你 whatcms.org 的API检测CMS(非官方)

• https://github.com/HA71/pywhatcms

Ghidra-Keybindings: Ghidra常用的按键绑定(对应IDA)

• https://github.com/JeremyBlackthorne/Ghidra-Keybindings

remote-code-cover: a CLI tool for code coverage using instrumentation for remote environments

• https://github.com/perimeterx/remote-code-cover
• https://www.perimeterx.com/blog/instrument-everything/

TimeStomper: 使用SetFileTime() API操纵Windows文件时间

• https://github.com/justinbui/timestomper
• https://medium.com/p/622d4c28a655

[其他]

权游最新一季的钓鱼攻击

• https://blog.checkpoint.com/2019/04/16/game-of-thrones-phishing-scams-and-how-to-avoid-them/

能源行业的安全报告

• https://s3-eu-central-1.amazonaws.com/evermade-fsecure-assets/wp-content/uploads/2019/04/15105531/F-Secure_energy_report.pdf

20190416

[技术]

(CTF)PlaidCTF 2019 - R u SAd?

• http://duksctf.github.io/2019/04/13/PlaidCTF2019-rusad.html

(CTF)Hack the Box(HTB) Machines Walkthrough Series — Devel

• https://resources.infosecinstitute.com/hack-the-box-walkthrough-devel/

2019Troopers会议上的徽章

• https://insinuator.net/2019/04/troopers-19-hack-your-badge/

(CTF)Plaid CTF 2019 Pwn 250 Plaid Adventure II

• https://ddaa.tw/plaidctf_pwn_250_plaid_adventure_ii.html

检测针对加密货币钱包的爆破攻击

• https://arxiv.org/abs/1904.06943

IoD-Crypt: 无人机网络的轻量级加密框架

• https://arxiv.org/abs/1904.06829

Cobalt Strike. Walkthrough for Red Teamers

• https://www.pentestpartners.com/security-blog/cobalt-strike-walkthrough-for-red-teamers/

使用Ghidra逆向MD380固件

• https://github.com/travisgoodspeed/md380tools/wiki/GHIDRA

[漏洞]

Synaptics声卡驱动的本地提权漏洞

• http://jackson-t.ca/synaptics-cxutilsvc-lpe.html

Adblock Plus列表过滤功能可导致执行任意代码

• https://armin.dev/blog/2019/04/adblock-plus-code-injection/

Office365创建群组时可添加邮箱用户名为-的用户

• https://blog.ettic.ca/the-outlook-winner-is-dash-ac15dbc4098d

Apache Tomcat RCE漏洞PoC(CVE-2019-0232)

• https://github.com/pyn3rd/CVE-2019-0232

Kentico CMS未授权RCE漏洞

• https://blog.gdssecurity.com/labs/2019/4/15/unauthenticated-remote-code-execution-in-kentico-cms.html

Shimo VPN辅助工具的多个漏洞

• https://blog.talosintelligence.com/2019/04/vulnerability-spotlight-multiple.html

VMWare Workstation 15 DoS漏洞(CVE-2019-5516)

• https://blog.talosintelligence.com/2019/04/VMware-DoS-vulnerability-April-19.html

win32k.sys发现新的0Day(CVE-2019-0859)

• https://securelist.com/new-win32k-zero-day-cve-2019-0859/90435/

[恶意代码]

窃密软件HawkEye新变种出现, 疑似所有权发生改变

• https://blog.talosintelligence.com/2019/04/hawkeye-reborn.html

黑客组织Silence Group分析

• https://www.fortinet.com/blog/threat-research/silence-group-playbook.html

逆向使用ConfuserEx+KoiVM混淆的.NET IrcBot Deucalion样本

• http://www.peppermalware.com/2019/04/analysis-of-net-deucalion-ircbot-sample.html

Account With Admin Privileges Abused to Install BitPaymer Ransomware via PsExec

• https://blog.trendmicro.com/trendlabs-security-intelligence/account-with-admin-privileges-abused-to-install-bitpaymer-ransomware-via-psexec/

[代码/工具]

Coerchck: 扫描网络, 搜索Windows主机上的本地管理员账户

• https://github.com/PresComm/Coerchck
• https://0x00sec.org/t/coerchck-powershell-script-for-listing-local-admins/12987

PartyLoud: 生成虚假的Web浏览记录, 防止本地网络追踪

• https://github.com/realtho/PartyLoud

w12scan: 网络资产发现引擎

• https://github.com/boy-hack/w12scan

20190415

[技术]

使用PVS-Studio审计rdesktop/xrdp源码

• https://www.viva64.com/en/b/0624/

Windows Defeneder详解: 工作原理

• https://www.contextis.com/en/blog/windows-defender-functionality

使用BloodHound进行密码分析

• https://medium.com/p/a3d264736c7

RELOAD+REFRESH: 滥用缓存替换策略执行隐蔽的缓存攻击

• https://arxiv.org/abs/1904.06278

使用xmp, noscript, noframes绕过XSS防护

• https://www.hahwul.com/2019/04/bypass-xss-protection-with-xmp-noscript-etc....html

通过SSRF攻击云容器

• https://dylankatz.com/attacking-cloud-containers-using-ssrf/

(CTF)Hack The Box - RedCross

• https://0xrick.github.io/hack-the-box/redcross/

(CTF)HTB: RedCross

• https://0xdf.gitlab.io/2019/04/13/htb-redcross.html

P4wnP1 USB与赛门铁克反病毒绕过

• https://medium.com/@fbotes2/advance-av-evasion-symantec-and-p4wnp1-usb-c7899bcbc6af

将机器学习应用到Timing攻击中

• https://parzelsec.de/timing-attacks-with-machine-learning/

使用Ghidra逆向, Part0:简易CrackMe

• https://www.shogunlab.com/blog/2019/04/12/here-be-dragons-ghidra-0.html

使用VT对恶意代码事件进行深入挖掘

• https://storage.googleapis.com/vt-gtm-wp-media/virustotal-for-investigators.pdf

[漏洞]

Weaponizing CVE-2019-0841 with LAPS

• https://rastamouse.me/2019/04/weaponizing-cve-2019-0841-with-laps/

2个利用sudo token实现提权的技巧(Linux)

• https://github.com/nongiach/sudo_inject

开源代理Envoy的2个漏洞(CVE-2019-9900/CVE-2019-9901)

• https://www.twistlock.com/labs-blog/unpacking-envoy-vulnerabilities-cve-2019-9900-cve-2019-9901-impacts-istio/

macOS Mojave TimeMachine诊断扩展的命令注入漏洞(CVE-2019–8513)

• https://medium.com/0xcc/rootpipe-reborn-part-i-cve-2019-8513-timemachine-root-command-injection-47e056b3cb43
• https://objective-see.com/blog/blog_0x40.html

使用OpenCMS实现已知Apache Solr漏洞的利用

• https://www.shielder.it/blog/exploit-apache-solr-through-opencms/

[恶意代码]

谷歌商店发现伪装为Instagram助手的窃密App

• https://blog.malwarebytes.com/cybercrime/2019/04/instagram-password-stealing-apps-found-on-google-play/

起源于**的挖矿软件, 利用多种方式传播

• https://blog.trendmicro.com/trendlabs-security-intelligence/miner-malware-spreads-beyond-china-uses-multiple-propagation-methods-including-eternalblue-powershell-abuse/

针对意大利的大规模网络攻击, 传播Gootkit银行木马

• https://blog.360totalsecurity.com/en/carrying-gootkit-bank-trojans-to-break-in-in-full-fury%ef%bc%8cthe-massive-phishing-attacks-against-italy/

[代码/工具]

UAFinator: 利用符号执行挖掘UAF漏洞. Hook所有的free函数, 检查地址是否已经被free过

• https://github.com/JordyZomer/UAFinator

pepe: 从Pastebin收集邮件地址的信息

• https://github.com/woj-ciech/pepe
• https://hackernoon.com/advanced-credential-stuffing-with-pepe-8152d540fc1e

ThreatIngestor: 从公开的情报中提取并聚合IoC(ThreatKB/MISP)

• https://github.com/InQuest/ThreatIngestor

SwiftnessX: 给渗透测试人员的笔记记录/目标追踪App

• https://github.com/ehrishirajsharma/SwiftnessX

kalel: 网络压力测试和渗透测试工具

• https://github.com/noobscode/kalel

regipy: 离线解析注册表Hive

• https://github.com/mkorman90/regipy

regrippy: 从Windows注册表Hive中提取有用的取证信息

• https://github.com/airbus-cert/regrippy

revsync: IDA和BinaryNinja实时同步插件

• https://github.com/lunixbochs/revsync

TeleKiller: Telegram Session劫持, 窃取本地passcode

• https://github.com/ultrasecurity/TeleKiller

[其他]

Apple’s App-Site Association - The New robots.txt

• https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/april/apples_app_site_association_the_new_robots_txt/

渗透测试脚本/工具/清单收集

• https://github.com/mgeeky/Penetration-Testing-Tools
• https://github.com/wtsxDev/Penetration-Testing
• https://github.com/GoVanguard/list-pentest-tools

20190412

[技术]

给IDA用户的几个Ghidra技巧, Part1: 反编译器和无法到达的代码

• https://isc.sans.edu/forums/diary/A+few+Ghidra+tips+for+IDA+users+part+1+the+decompilerunreachable+code/24822/

大规模SIM swap诈骗

• https://securelist.com/large-scale-sim-swap-fraud/90353/

DNS缓存投毒, Part2

• https://www.alienvault.com/blogs/security-essentials/dns-cache-poisoning-part-2-1

(CTF)Typhoon 1.02: CTF Walkthrough

• https://resources.infosecinstitute.com/typhoon-ctf-walkthrough/

恶意软件逃逸之攻击与防御

• https://arxiv.org/abs/1904.05747

IoT安全中的机器学习: 当前的解决方案和未来的挑战

• https://arxiv.org/abs/1904.05735

针对语音和说话人识别系统的隐藏语音攻击实战

• https://arxiv.org/abs/1904.05734

Android平台安全模型

• https://arxiv.org/abs/1904.05572

DNA密码学研究综述

• https://arxiv.org/abs/1904.05528

通过攻击图分析优化IoT设备的部署

• https://arxiv.org/abs/1904.05853

通过在主机上安装“另一个”杀软来实现免杀

• https://www.komodosec.com/post/av-wars-fighting-fire-with-fire

Active Directory帐号锁定绕过

• https://medium.com/@markmotig/bypassing-ad-account-lockout-for-a-compromised-account-5c908d663de8

使用GDB逆向古老的游戏(塞尔达传说-众神的三角力量)

• https://sideway.re/Reverse-Engineering-alttp-GBA-ep1/

创建灵活的hypervisor级别的调试器

• https://youtu.be/-nXY_p8c_bQ

暴露docker.sock可导致容器被接管

• https://dejandayoff.com/the-danger-of-exposing-docker.sock/

在野发现的新的BGP劫持攻击事件

• https://habr.com/en/company/qrator/blog/447776/

HTML5的标签可被滥用, 使用户在不知请情况下对指定目标发起网络请求, 用户规模大时可形成DDoS攻击

• https://www.imperva.com/blog/the-ping-is-the-thing-popular-html5-feature-used-to-trick-chinese-mobile-users-into-joining-latest-ddos-attack/

利用COM劫持绕过Windows Defender SmartScreen

• https://blog.en.elevenpaths.com/2019/04/hijacking-research-smartscreen.html

Sextortion profits decline despite higher volume, new techniques

• https://blog.talosintelligence.com/2019/04/sextortion-update.html

Reversing w/o reversing – how to become Alex in practice

• http://www.hexacorn.com/blog/2019/04/11/reversing-w-o-reversing-how-to-become-alex-in-practice/

[漏洞]

在野发现利用Wordpress插件yellow-pencil-visual-theme-customizer 0Day的攻击

• https://wordpress.org/plugins/yellow-pencil-visual-theme-customizer/

Wordpress插件Advanced Contact Form 7 DB的SQL注入漏洞

• https://blog.sucuri.net/2019/04/sql-injection-in-advance-contact-form-7-db.html

几乎无限的内存: Chrome沙箱逃逸

• https://googleprojectzero.blogspot.com/2019/04/virtually-unlimited-memory-escaping.html

Drupal点击图片导致RCE漏洞的分析

• https://www.zerodayinitiative.com/blog/2019/4/11/a-series-of-unfortunate-images-drupal-1-click-to-rce-exploit-chain-detailed

[恶意代码]

针对关基础设施的勒索软件LockerGoga

• https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html

Anatova勒索软件

• https://www.fortinet.com/blog/threat-research/looking-into-anatova-ransomware.html

[代码/工具]

从命令行中调用Ghidra的反编译功能

• https://gist.github.com/guedou/a358df609c80d9fdc1ec4c348129005b

使用PowerShell创建Web服务器, 托管HTA Payload

• https://gist.github.com/caseysmithrc/2197d8b447cb963896914ee5cb8c8dd2

sic: 执行Sequential Import Chaining(XSS)

• https://github.com/d0nutptr/sic

Zeebsploit: Web扫描、漏洞利用、信息收集

• https://github.com/jaxBCD/Zeebsploit

[其他]

编程书籍收集

• https://github.com/majikarp/awesome-programming-books

操作系统加固指南

• https://github.com/dev-sec/chef-os-hardening

税务欺诈和“身份盗窃需求”在暗网持续发酵

• https://www.carbonblack.com/resources/threat-research/tax-fraud-identity-theft-dark-web/

威胁狩猎面试问题与答案Top31

• https://resources.infosecinstitute.com/top-31-threat-hunting-interview-questions-and-answers-for-2019/

2018年工控系统漏洞回顾

• https://www.ptsecurity.com/ww-en/analytics/ics-vulnerabilities-2019/

20190411

[技术]

重建结构化P2P僵尸网络的C&C通道

• https://arxiv.org/abs/1904.05119

KEY-SSD: 为驱动器(Drive)添加访问控制, 防止勒索软件攻击

• https://arxiv.org/abs/1904.05012

针对视频识别模型的黑盒攻击

• https://arxiv.org/abs/1904.05181

从简短的充满噪音的文本中检测安全事件

• https://arxiv.org/abs/1904.05054

利用表达式语言(Expression Language)注入实现RCE

• https://blog.zsec.uk/el-injection-rce/

渗透测试指南, Part3: OSINT, 泄漏转储和密码喷洒

• https://delta.navisec.io/osint-for-pentesters-part-3-password-spraying-methodology/

利用HTML注入实现Exfiltration

• https://medium.com/@d0nut/better-exfiltration-via-html-injection-31c72a2dae8b

使用Ghidra逆向LiveMaker/LiveNovel

• https://pmrowla.com/blog/reverse-engineering-livemaker/

移动平台恶意软件分析技巧

• https://medium.com/@targetpractice/cloak-and-dagger-malware-techniques-demystified-c4d8a035b94e

开发格式化敏感(format-aware)的hypercall fuzzer: Hyperseed, 挖掘Hyper-V的漏洞

• https://youtu.be/I7xl7DcKbEg

ARM漏洞开发工作室

• https://azeria-labs.com/downloads/Slides-SAS_final.pdf
• https://azeria-labs.com/downloads/Lab-Workbook-v1.0-public.pdf

利用DLL劫持实现UAC绕过

• https://www.activecyber.us/activelabs/uac-bypass-in-system-reset-binary-via-dll-hijacking

[漏洞]

Confluence服务器Widget Connector路径回溯漏洞PoC(CVE-2019-3396)

• https://github.com/x-f1v3/CVE-2019-3396

Adobe Acrobat Pro类型混淆漏洞导致RCE(CVE-2019-7128)

• https://srcincite.io/advisories/src-2019-0024/

Dragonblood: 研究人员发现WPA3的SAE握手漏洞

• https://papers.mathyvanhoef.com/dragonblood.pdf

监控软件Nagios XSS可导致RCE与本地提权

• https://www.shielder.it/blog/nagios-xi-5-5-10-xss-to-root-rce/

利用Moodle的特性和漏洞实现XSS

• https://medium.com/@daniel.thatcher/obtaining-xss-using-moodle-features-and-minor-bugs-2035665989cc

FFmpeg处理HLS时的SSRF漏洞

• https://medium.com/@valeriyshevchenko/ssrf-vulnerability-via-ffmpeg-hls-processing-f3823c16f3c7

Adobe Acrobat Reader RCE漏洞(CVE-2018-19716)

• https://blog.talosintelligence.com/2019/04/vulnerability-spotlight-adobe-acrobat-rce-april-2019.html

[恶意代码]

利用WinRar CVE-2018-20250漏洞的某定向攻击分析

• https://www.microsoft.com/security/blog/2019/04/10/analysis-of-a-targeted-attack-exploiting-the-winrar-cve-2018-20250-vulnerability/

HOPLIGHT木马分析报告(朝鲜)

• https://www.us-cert.gov/ncas/analysis-reports/AR19-100A

SneakyPastes行动: 黑客组织Gaza Cybergang对中东/北非的攻击事件

• https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/

[代码/工具]

ida-qscripts: IDA插件, 用于使IDA脚本编写更有效率, 可在任意文本编辑器中编写IDA脚本后在IDA中运行

• https://github.com/0xeb/ida-qscripts
• http://0xeb.net/2019/04/ida-qscripts/

mysql-magic: 从内存中转储mysql客户端的密码

• https://github.com/hc0d3r/mysql-magic

[其他]

如何查找Android平台恶意样本

• https://youtu.be/DrKQU8diYcs

Credential-stuffing attacks behind 30 billion login attempts in 2018

• https://www.akamai.com/us/en/multimedia/documents/state-of-the-internet/soti-security-credential-stuffing-attacks-and-economies-report-2019.pdf

20190410

[技术]

Instagram取证分析(Windows App版本)

• https://eforensicsmag.com/instagram-forensics-windows-app-store-by-justin-boncaldo/

CoRT: 工控系统组件的通信稳定性测试平台

• https://arxiv.org/abs/1904.04286

ShortPaper: 使用代码插入技术, 创建恶意软件

• https://arxiv.org/abs/1904.04802

Thinkey: 可扩展的区块链架构

• https://arxiv.org/abs/1904.04560

通过MAC地址关联实现高效的无源ICS设备发现与识别

• https://arxiv.org/abs/1904.04271

如何劫持Youtube用户的通知

• https://hackademic.co.in/youtube-bug/

我们是如何在渗透测试期间发现了个RCE漏洞的

• https://blog.cobalt.io/how-customer-collaboration-during-a-pentest-can-lead-to-finding-a-remote-code-execution-rce-da59cb3d1dfb

攻击暴露在公网的QA平台: Selenium Grid

• https://www.tarlogic.com/en/blog/attacking-selenium-grid/

使用Meterpreter在内存中执行.NET程序集

• https://p16.praetorian.com/blog/running-a-.net-assembly-in-memory-with-meterpreter

正则表达式和Fuzzing是如何改变了我挖掘漏洞的方式的

• http://securityviacode.in/view_article/How%20regular%20expression%20and%20fuzzing%20change%20my%20approach%20for%20finding%20vulnerabilities%20(Series%20part%201.)

将IDA的数据库导入到Ghidra中

• https://revers3c.blogspot.com/2019/04/import-ida-pro-database-into-ghidra.html?m=1#more

利用WMI事件订阅实现驻留

• https://in.security/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/

如何在MacOS上逆向恶意软件并避免被感染, Part2

• https://www.sentinelone.com/blog/how-to-reverse-macos-malware-part-two/

[漏洞]

Wordpress XSS漏洞可导致RCE

• https://www.netsparker.com/blog/web-security/wordpress-xss-rce-vulnerability/

Golang 1.12.2之前的版本DLL劫持漏洞(CVE-2019-9634)

• https://www.openwall.com/lists/oss-security/2019/04/09/1

Apache Axis过期域名导致RCE漏洞(CVE-2019-0227)

• https://rhinosecuritylabs.com/application-security/cve-2019-0227-expired-domain-rce-apache-axis/

DACL漏洞, 低权限攻击者可通过覆盖由NT AUTHORITY\SYSTEM拥有的文件的权限, 实现文件劫持

• https://krbtgt.pw/dacl-permissions-overwrite-privilege-escalation-cve-2019-0841/

Cuppa CMS未认证RCE漏洞PoC

• https://github.com/mthbernardes/CuppaCMS

Confluence服务器RCE漏洞(CVE-2019-3396)

• https://chybeta.github.io/2019/04/06/Analysis-for-%E3%80%90CVE-2019-3396%E3%80%91-SSTI-and-RCE-in-Confluence-Server-via-Widget-Connector/

Verizon Fios路由器授权命令注入漏洞

• https://medium.com/tenable-techblog/verizon-fios-router-authenticated-command-injection-f6d2ddec30fd

小米浏览器之前的补丁无效, 漏洞依然存在, 影响数百万设备

• https://www.bleepingcomputer.com/news/security/xiaomi-browsers-still-vulnerable-after-failed-patches/

[恶意代码]

卡巴斯基揭秘之前未披露过的APT组织TajMahal

• https://securelist.com/project-tajmahal/90240/

恶意软件通过调试自身防止被分析

• https://www.bromium.com/malware-debugs-itself-prevent-analysis/

针对跨国公司的凭证窃取攻击活动

• https://securityintelligence.com/credential-dumping-campaign-hits-multinational-corporations/

海莲花APT组织macOS平台恶意软件更新

• https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/

针对澳大利亚金融行业的Gustuff僵尸软件, Android平台

• https://blog.talosintelligence.com/2019/04/gustuff-targets-australia.html

新型窃密软件Baldr

• https://blog.malwarebytes.com/threat-analysis/2019/04/say-hello-baldr-new-stealer-market/

[代码/工具]

DeathMetal: 利用Intel AMT的功能做渗透和RedTeam

• https://github.com/Coalfire-Research/DeathMetal
• https://www.coalfire.com/The-Coalfire-Blog/April-2019/The-Death-Metal-Suite

ghidra_installer: Ghidra自动安装脚本, 自动配置OpenJDK 11, 可配置Ghidra适应4K屏幕

• https://github.com/bkerler/ghidra_installer

swordphish-awareness: 创建并管理伪造的钓鱼攻击, 提升用户对钓鱼攻击的警觉性

• https://github.com/certsocietegenerale/swordphish-awareness

[其他]

现代攻击场景中的隐写术

• https://www.carbonblack.com/2019/04/09/steganography-in-the-modern-attack-landscape/

20190409

[技术]

(CTF)Vulnhub Write-up — Toppo

• https://medium.com/p/1ac541bf185a

Wireshark3.x版本的源码审计

• https://www.viva64.com/en/b/0623/

如何利用LLMNR和SMB Message Signing

• https://www.blackhillsinfosec.com/an-smb-relay-race-how-to-exploit-llmnr-and-smb-message-signing-for-fun-and-profit/

数据货币交易所CoinBene被黑事件分析报告

• https://medium.com/p/6d4a3ed3b715

绕过Windows 10 build 1809版本引入的用户模式APC注入检测

• http://rce4fun.blogspot.com/2019/04/circumventing-windows-defender-atps.html

探索区块链的攻击面: 系统概述

• https://arxiv.org/abs/1904.03487

Web应用程序安全监控的可视化模型

• https://arxiv.org/abs/1904.03320

基于网络和主机的入侵检测系统概要

• https://arxiv.org/abs/1904.03491

使用机器学习和深度学习进行恶意软件检测

• https://arxiv.org/abs/1904.02441

符合GDPR标准的个人数据管理: 基于区块链的解决方案

• https://arxiv.org/abs/1904.03038

区块链网络分布式共识协议综述

• https://arxiv.org/abs/1904.04098

关于训练健壮的PDF恶意软件分类器

• https://arxiv.org/abs/1904.03542

NSA在RSA2019大会上对Ghidra的介绍

• https://www.reddit.com/r/ReverseEngineering/comments/bb1rx4/come_get_your_free_nsa_reverse_engineering_tool/

{CTF}Oldschool - CONFidence Teaser 2019

• https://ctfs.ghost.io/oldschool-confidence-teaser-2019/

[漏洞]

Apache提权漏洞CVE-2019-0211 PoC

• https://github.com/cfreal/exploits/tree/master/CVE-2019-0211-apache

Uber微服务漏洞可导致攻击者获取任意用户的token

• https://ngailong.wordpress.com/2019/04/07/old-but-gold-dot-dot-slash-to-get-the-flag-uber-microservice/

Istio/Envoy路径回溯漏洞(CVE-2019-9901)

• https://github.com/eoftedal/writings/blob/master/published/CVE-2019-9901-path-traversal.md

TP-Link路由器的缓冲区溢出漏洞可使攻击者远程接管路由器

• https://securityintelligence.com/buffer-overflow-vulnerability-in-tp-link-routers-can-allow-remote-attackers-to-take-control/

[恶意代码]

Emotet分析, Part2

• https://persianov.net/emotet-malware-analysis-part-2

Epic游戏商店的间谍行为分析

• https://nickcano.com/epic-games-spyware/

[代码/工具]

LFI-Enum: 通过LFI执行枚举(进程/网络/文件)

• https://github.com/mthbernardes/LFI-Enum

sienna-locomotive: 对程序员友好的Fuzzing工具, 无需太多的安全知识

• https://github.com/trailofbits/sienna-locomotive
• https://blog.trailofbits.com/2019/04/08/user-friendly-fuzzing-with-sienna-locomotive/

[其他]

OWASP清单系列

• https://github.com/OWASP/CheatSheetSeries

MS发布基于Chromium的Edge浏览器的预览版

• https://thehackernews.com/2019/04/chromium-edge-browser.html

20190408

[技术]

HomeBrood 0x00: 在macOS上肆意劫持Homebrew

• https://blacksunhackers.club/2019/04/Surreptitious-hijacking-brew-macOS/

通过验证码的Accessibility特性破解验证码

• https://hakin9.org/accessibility-vs-security-breaking-captchas-by-exploiting-their-accessibility-features-by-gautam-krishnan/

如何绕过2FA执行钓鱼攻击

• https://hakin9.org/how-to-perform-phishing-attack-with-2fa-bypass-by-valeriy-shevchenko/

在Burp扩展中修改- http请求的2种方式

• https://parsiya.net/blog/2019-04-06-hiding-options---an-adventure-in-dealing-with-burp-proxy-in-an-extension/

Car Hacking, Part2

• http://console-cowboys.blogspot.com/2019/04/hacking-all-cars-part-2.html

Hacking区块链认证

• https://github.com/cclabsInc/BlockChainExploitation
• http://console-cowboys.blogspot.com/2019/04/blockchain-exploitation-labs-part-2.html
• https://www.youtube.com/playlist?list=PLCwnLq3tOElp0PFnuUFUIhpEeju5qrKJI

Huawei and Security Analysis

• https://grsecurity.net/huawei_and_security_analysis.php

(CTF)Hack The Box - Vault

• https://0xrick.github.io/hack-the-box/vault/

开发Ghidra插件用于漏洞研究

• https://www.somersetrecon.com/blog/2019/ghidra-plugin-development-for-vulnerability-research-part-1

On Eggs and Egg-hunters (Linux/x64)

• https://medium.com/syscall59/on-eggs-and-egg-hunters-linux-x64-305b947f792e

[漏洞]

WordPress插件Duplicate-Page的SQL注入漏洞

• https://blog.sucuri.net/2019/04/sql-injection-in-duplicate-page-wordpress-plugin.html

[恶意代码]

APT28开发的下载者SedUploader/Zebrocy分析

• https://www.carbonblack.com/2019/04/05/cb-threat-intelligence-notification-hunting-apt28-downloaders/

勒索软件IEncrypt变种分析

• https://www.guardicore.com/2019/04/iresponse-to-iencrypt/

Android恶意软件Anubis分析

• https://eybisi.run/Mobile-Malware-Analysis-Tricks-used-in-Anubis/

某Office Dropper分析

• https://marcoramilli.com/2019/04/05/step-by-step-office-dropper-dissection/

Hiding in Plain Sight

• https://blog.talosintelligence.com/2019/04/hiding-in-plain-sight.html

以乌克兰2019大选为诱饵内容的恶意文档分析

• https://www.securityartwork.es/2019/04/04/ukraine-election-2019-polls-maldoc-analysis/

[代码/工具]

Ghidar: 源码发布, Release发布9.0.2版本

• https://github.com/NationalSecurityAgency/ghidra
• https://ghidra-decompiler-docs.netlify.com/

BlueHive: Active Directory 蜜用户账户(Honey User Account)管理, 基于PowerShell

• https://github.com/leeberg/BlueHive

多线程FTP扫描器

• https://gist.github.com/tg12/e7967017a8ccf99daaf0bf74dd4f5dbe

SharpExec: 辅助实现横向渗透的工具, C#编写

• https://github.com/anthemtotheego/SharpExec
• https://blog.redxorblue.com/2019/04/sharpexec-lateral-movement-with-your.html?m=1

fracker: PHP函数调用追踪与分析工具

• https://github.com/cyrus-and/fracker

chatter: OSINT监控工具, 可监控twitter hashtags, reddit标题和4chan文章内容, 可自定义关键词

• https://github.com/visualbasic6/chatter

ATTACKdatamap: A datasource assessment on an event level to show potential ATT&CK coverage

• https://github.com/olafhartong/attackdatamap
• https://medium.com/p/f44884cfed11

LeechCore: 使用于ActiveDirectory环境中Windows远程物理内存获取和分析工具

• https://github.com/ufrisk/LeechCore
• http://blog.frizk.net/2019/04/LeechAgent.html

[其他]

如何防御移动App的深度链接(Deep Link)滥用

• https://www.nowsecure.com/blog/2019/04/05/how-to-guard-against-mobile-app-deep-link-abuse/

白皮书: JS代码反混淆

• https://www.netsparker.com/deobfuscating-javascript-phishing-website/

20190404

[技术]

使用PVS-Studio审计.NET编译平台Roslyn的源码

• https://www.viva64.com/en/b/0622/

如何使用Volatility分析VMware内存镜像

• https://www.andreafortuna.org/2019/04/03/how-to-analyze-a-vmware-memory-image-with-volatility/

Windows Store应用(APPX)分析, 包括脚本和ppt

• https://github.com/ydkhatri/Appx-Analysis

后渗透工具koadic实战

• https://www.prismacsi.com/en/post-exploitation-with-koadic

Active Directory可视化, 用于Blue Team和威胁狩猎

• https://p16.praetorian.com/blog/active-directory-visualization-for-blue-teams-and-threat-hunters

谷歌搜索自动建议(autosuggestions)劫持

• https://medium.com/bugbountywriteup/how-i-am-able-to-hijack-you-1cab793a01d1

滥用Linux文件系统事件监控工具inotify API

• https://x-c3ll.github.io/posts/rethinking-inotify/

在V8引擎漏洞在源码中Patch掉但没有发布Patch的Chrome版本时, 如何开发能够工作的exploit

• https://blog.exodusintel.com/2019/04/03/a-window-of-opportunity/

[漏洞]

Electron App的预加载漏洞, 影响一大票App

• https://blog.doyensec.com/2019/04/03/subverting-electron-apps-via-insecure-preload.html

Qt5框架的特性导致Cisco Webex Teams和Malwarebytes Anti-Malware等产品的安全漏洞(CVE-2019-1636/CVE-2019-6739)

• https://www.zerodayinitiative.com/blog/2019/4/3/loading-up-a-pair-of-qt-bugs-detailing-cve-2019-1636-and-cve-2019-6739

Apache提权漏洞(CVE-2019-0211)

• https://cfreal.github.io/carpe-diem-cve-2019-0211-apache-local-root.html

WAF绕过与缓存(CVE-2019–5418)

• https://blog.pentesterlab.com/cve-2019-5418-on-waf-bypass-and-caching-10e93f9a1981

Sonos桌面控制器的多个漏洞

• https://securify.nl/en/blog/SFY20190403/sonos-desktop-controller-contain-multiple-vulnerabilities.html

[恶意代码]

信用卡信息窃取脚本JS-sniffer深入分析

• https://www.group-ib.com/resources/threat-research/js-sniffers.html

通过- httpS站点中“知名的"隐藏目录来投递恶意软件

• https://www.zscaler.com/blogs/research/abuse-hidden-well-known-directory-- https-sites

黑客组织Roaming Mantis在近期攻击中使用的工具和技巧

• https://securelist.com/roaming-mantis-part-iv/90332/

警惕stalkerware

• https://securelist.com/beware-of-stalkerware/90264/

IoT恶意软件Bashlite更新, 增加挖矿和后门指令, 针对WeMo设备

• https://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-iot-malware-updated-with-mining-and-backdoor-commands-targets-wemo-devices/

[代码/工具]

APC-PPID: 向指定线程的APC队列注入用户模式异步APC对象, 并伪造父进程

• https://github.com/hlldz/APC-PPID

instainsane: 多线程Instagram爆破工具

• https://github.com/thelinuxchoice/instainsane

[其他]

如何识别伪造的Android App

• https://www.nowsecure.com/blog/2019/04/03/infographic-how-to-spot-a-fake-android-app/

2019年2月网络攻击数据统计

• https://www.hackmageddon.com/2019/04/03/february-2019-cyber-attacks-statistics/

黑客使用自动驾驶系统远程驾驶Tesla Model S

• https://securityledger.com/2019/04/hackers-remotely-steer-tesla-model-s-using-autopilot-system/

工业4.0时代的安全: 应对智能制造环境的威胁

• https://www.trendmicro.com/vinfo/us/security/news/internet-of-things/security-in-the-era-of-industry-4-dealing-with-threats-to-smart-manufacturing-environments

劫持邮件回复链

• https://www.webroot.com/blog/2019/04/03/hijacked-email-reply-chains/

20190403

[技术]

(CTF)Vulnserver LTER EIP Overwrite – A Little Easier This Time

• https://www.doyler.net/security-not-included/vulnserver-lter-eip-overwrite

Wordpress密码攻击

• https://hakin9.org/pwning-wordpress-passwords-by-mitch-moser-2/

RPC漏洞挖掘案例研究, Part2

• https://www.fortinet.com/blog/threat-research/rpc-bug-hunting-case-studies---part-2.html

使用Ghidra和x64dbg分析AZORult

• https://blog.yoroi.company/research/ghidra-sre-the-azorult-field-test/

使用Ok- http绕过混淆后Android App的SSL Pinning

• https://blog.nviso.be/2019/04/02/circumventing-ssl-pinning-in-obfuscated-apps-with-ok- http/

后渗透框架WMImplant介绍

• https://www.fortynorthsecurity.com/wmimplant-post-exploitation-an-introduction/

x86系统中的外部中断, Part1: 中断控制器

• https://habr.com/en/post/446312/

直接调用RAiLaunchAdminProcess绕过UAC

• https://www.rump.beer/2017/slides/from_alpc_to_uac_bypass.pdf
• https://github.com/DimopoulosElias/alpc-mmc-uac-bypass

一种基于特征选择和集成分类器的高效网络入侵检测系统

• https://arxiv.org/abs/1904.01352

SurFi: 使用Wi-Fi信道状态信息检测监控摄像机循环攻击（扩展版）

• https://arxiv.org/abs/1904.01350

DNS-Morph: 针对Tor的基于UDP的引导协议

• https://arxiv.org/abs/1904.01240

ScriptNet: 用于恶意JavaScript检测的神经静态分析

• https://arxiv.org/abs/1904.01126

(CTF)Wizard Labs - Devlife

• https://0xrick.github.io/wizard-labs/devlife/

iOS App逆向教程

• https://github.com/ivRodriguezCA/RE-iOS-Apps

将Android APK反编译为Java和XML

• https://youtu.be/UwFXndJH_34

[漏洞]

VB脚本堆溢出漏洞分析(CVE-2019-0666)

• https://www.malwaretech.com/2019/04/analysis-of-a-vb-script-heap-overflow.html

MS Edge/IE 0Day可使攻击者获取机密会话数据

• https://blog.trendmicro.com/trendlabs-security-intelligence/microsoft-edge-and-internet-explorer-zero-days-allow-access-to-confidential-session-data/

FileZilla非受信搜索路径漏洞可导致RCE

• https://medium.com/tenable-techblog/filezilla-untrusted-search-path-bc3a7b3ae51e

[恶意代码]

XLoader变种, 使用新的方式引诱用户下载安装

• https://blog.trendmicro.com/trendlabs-security-intelligence/new-version-of-xloader-that-disguises-as-android-apps-and-an-ios-profile-holds-new-links-to-fakespy/

组合使用Emotet、TrickBot木马、Ryuk勒索软件的攻击行动

• https://www.cybereason.com/blog/one-two-punch-emotet-trickbot-and-ryuk-steal-then-ransom-data
• https://www.cybereason.com/blog/triple-threat-emotet-deploys-trickbot-to-steal-data-spread-ryuk-ransomware

Xwo: Python编写的扫描类恶意软件

• https://www.alienvault.com/blogs/labs-research/xwo-a-python-based-bot-scanner

Pipdig事件后续: 否认指控、删除证据以及进行其他非法活动

• https://www.wordfence.com/blog/2019/04/pipdig-update-dishonest-denials-erased-evidence-and-ongoing-offenses/

1个恶意文档分析

• https://www.securityartwork.es/2019/04/02/military-financing-maldoc-analysis/

APT组织海莲花使用隐写书加载后门

• https://www.cylance.com/en-us/lp/threat-research-and-intelligence/oceanlotus-steganography-malware-analysis-white-paper-2019.html

[代码/工具]

KatzKatz: 解析包含Mimikatz输出的txt文件

• https://github.com/xFreed0m/KatzKatz

GoMet: 多平台Agent和控制器, Go编写, 支持支持TCP转发/socks5/隧道/Shell/下载/执行等

• https://github.com/mimah/GoMet

Goreport: 从Gophish收集攻击事件数据并生成报告

• https://github.com/chrismaddalena/GoReport
• https://posts.specterops.io/go-phishing-with-goreport-418294e8ee45

[其他]

全球事件响应威胁报告

• https://www.carbonblack.com/global-incident-response-threat-report/april-2019/#form

20190402

[技术]

树莓派3启用Verified boot

• https://blog.nviso.be/2019/04/01/enabling-verified-boot-on-raspberry-pi-3/

Splitting atoms in XNU

• https://googleprojectzero.blogspot.com/2019/04/splitting-atoms-in-xnu.html

Cuckoo沙箱架构

• https://eforensicsmag.com/cuckoo-sandbox-architecture/

homographs攻击浅析

• https://wildfire.blazeinfosec.com/what-you-see-is-not-what-you-get-when-homographs-attack/

从App安全的角度看待GraphQL攻击与防御

• https://github.com/righettod/poc-graphql

Exploiting signed bootloaders to circumvent UEFI Secure Boot

• https://habr.com/en/post/446238/

一种基于机器学习和二进制可视化的恶意软件检测系统

• https://arxiv.org/abs/1904.00859

H2B: 使用压电振动传感器生成基于心跳的密钥

• https://arxiv.org/abs/1904.00750

使用深度神经网络进行Android恶意软件检测

• https://arxiv.org/abs/1904.00736

XBox One游戏控制台的取证分析

• https://arxiv.org/abs/1904.00734

区块链与互联网的未来: 综合评述

• https://arxiv.org/abs/1904.00733

基于区块链的智能合约高效并行化研究

• https://arxiv.org/abs/1904.00731

[恶意代码]

近期的Emotet攻击行动, 利用网络钓鱼，PDF和Droppers冒充合法应用程序

• https://www.carbonblack.com/2019/04/01/cb-tau-threat-intelligence-notification-recent-emotet-campaign-leverages-phishing-pdfs-droppers-impersonating-legitimate-applications/

Wordpress插件pipdig会向竞争对手发动DDoS攻击

• https://www.jemjabella.co.uk/2019/security-alert-pipdig-insecure-ddosing-competitors/

Game of Threats

• https://securelist.com/game-of-threats/90116/

[代码/工具]

FindCrypt-Ghidra: Ghidra插件, 快速查找密码学相关的函数及引用

• https://github.com/d3v1l401/FindCrypt-Ghidra

fireprox: AWS API网关管理工具, 用于动态创建- http传递代理以实现唯一的IP轮换

• https://github.com/ustayready/fireprox

PoshC2_Python: Python编写的PoshC2服务器, 用于辅助渗透/RedTeam/后渗透/横向渗透等

• https://github.com/nettitude/PoshC2_Python
• https://labs.nettitude.com/blog/introducing-poshc2-v4-8-includes-c-dropper-task-management-and-more-part-one/

Macro-Keystrokes: 利用Word宏实现代码执行的PoC, 无需rundll32.exe和kernel32.dll, 只依靠向主机发送按键

• https://github.com/SECFORCE/Macro-Keystrokes
• https://www.secforce.com/blog/2019/04/death-by-keystrokes/

docker-gophish: 快速部署Gophish的Docker镜像

• https://github.com/matteoggl/docker-gophish

sandshrew: 用于加密验证的原型concolic单元测试工具

• https://github.com/trailofbits/sandshrew
• https://blog.trailofbits.com/2019/04/01/performing-concolic-execution-on-cryptographic-primitives/

[其他]

DragonEX交易所价值600万美元的Token被盗事件分析

• https://medium.com/p/50b52ccd22ad

IoT威胁景观报告

• https://s3-eu-central-1.amazonaws.com/evermade-fsecure-assets/wp-content/uploads/2019/04/01094545/IoT-Threat-Landscape.pdf

20190401

[技术]

(CTF)Insomni’Hack 2019 CTF – Perfectly Unbreakable Flag – 500

• https://phil242.wordpress.com/2019/03/28/insomnihack-2019-ctf-perfectly-unbreakable-flag-500/

BootKeeper: 验证引导固件映像上的软件完整性

• https://arxiv.org/abs/1903.12505

Dronecrypt: 小型空中无人机的高效加密框架

• https://arxiv.org/abs/1903.12301

(CTF)Hack The Box - Curling

• https://0xrick.github.io/hack-the-box/curling/

PWK/OSCP考试准备指南

• https://www.netsecfocus.com/oscp/2019/03/29/The_Journey_to_Try_Harder-_TJNulls_Preparation_Guide_for_PWK_OSCP.html

Shellcode/AES/Go三位一体

• https://medium.com/syscall59/a-trinity-of-shellcode-aes-go-f6cec854f992

Down the Rabbit Hole - Part III: Patching the Whitelist

• https://erfur.github.io/down_the_rabbit_hole_pt3/

逆向某古老PC游戏的数据文件

• http://www.muppetlabs.com/~breadbox/txt/bure.html

使用IDA从0开始学逆向, Part10

• https://medium.com/p/f054072cc4cd

Vulnserver LTER SEH exploit. Part2

• https://www.doyler.net/security-not-included/lter-seh-continued

使用Sboxr自动挖掘并利用DOM客户端XSS漏洞, Part3

• https://medium.com/p/2ea910dfb429

TLS库分析框架TLS-Attacker实战

• https://web-in-security.blogspot.com/2019/03/playing-with-tls-attacker.html

利用Chakra JIT引擎攻击MS Edge

• https://i.blackhat.com/asia-19/Fri-March-29/bh-asia-Li-Using-the-JIT-Vulnerability-to-Pwning-Microsoft-Edge.pdf

[漏洞]

Kubernetes路径回溯漏洞(CVE-2019-1002101)

• https://www.twistlock.com/labs-blog/disclosing-directory-traversal-vulnerability-kubernetes-copy-cve-2019-1002101/

ENTTEC照明控制器的若干漏洞

• https://www.mogozobo.com/?p=3476

[恶意代码]

Android平台间谍软件Exodus

• https://securitywithoutborders.org/blog/2019/03/29/exodus.html

ShadowHammer供应链攻击时间线和变种

• https://labsblog.f-secure.com/2019/03/29/a-hammer-lurking-in-the-shadows/

模块化恶意软件Emotet投递Nymaim恶意软件, 后者进一步加载Nozelesn勒索软件

• https://blog.trendmicro.com/trendlabs-security-intelligence/emotet-distributed-ransomware-loader-for-nozelesn-found-via-managed-detection-and-response/

广告软件开发工具包BatMobi分析

• https://blog.malwarebytes.com/cybercrime/2019/03/awaking-the-beast-adware-batmobi/

分析恶意Magecart脚本

• https://maxkersten.nl/binary-analysis-course/malware-analysis/magecart/

解密Qrypter Payload

• https://blog.yoroi.company/research/decrypting-the-qrypter-payload/

[代码/工具]

rayman_disasm: 逆向1995年的MS-DOS游戏Rayman

• https://github.com/marespiaut/rayman_disasm

Blue ATT&CK: Mapping your blue team to ATT&CK

• https://github.com/rabobank-cdc/Blue-ATTACK

padcheck: TLS CBC Padding Oracle Checker

• https://github.com/tripwire/padcheck

vulncode-db: 漏洞及漏洞源码数据库

• https://github.com/google/vulncode-db
• https://www.evonide.com/vulncode-db-a-vulnerable-code-database/

EventLogParser: 解析PowerShell和安全事件日志, 查找敏感信息

• https://github.com/djhohnstein/EventLogParser

phpMussel: 基于PHP的反病毒/反木马/反恶意代码框架

• https://github.com/phpMussel/phpMussel

[其他]

很多Electron应用程序默认情况下都是LOLBins

• http://www.hexacorn.com/blog/2019/03/30/sqirrel-packages-manager-as-a-lolbin-a-k-a-many-electron-apps-are-lolbins-by-default/

2018年机器人和僵尸网络相关统计

• https://securelist.com/bots-and-botnets-in-2018/90091/

2018年网络钓鱼和诈骗报告

• https://www.f5.com/labs/articles/threat-intelligence/2018-phishing-and-fraud-report--attacks-peak-during-the-holidays

2018年Android安全和隐私报告

• https://source.android.com/security/reports/Google_Android_Security_2018_Report_Final.pdf

2017年暗网服务提供商Freedom Hosting泄漏的数据分析

• https://blog.hyperiongray.com/freedom-hosting-2-overview/

20190329

[技术]

程序Diffing的过去与现在

• https://docs.google.com/presentation/d/19h0T8BBn_96ZkdclFHV_MSgLPSGRrbWJpU_99heav88/edit

利用Bayesian Abductive Reasoning(贝叶斯诱导推理)对基于签名的入侵检测系统进行扩展

• https://arxiv.org/abs/1903.12101

大数据环境下基于网络异常行为的DDoS攻击检测方法

• https://arxiv.org/abs/1903.11844

(CTF)Vulnserver LTER write-up

• https://www.doyler.net/security-not-included/vulnserver-lter-seh

使用Ghidra对某exe文件进行详细分析

• https://youtu.be/sk1wAGeM9Hw

使用PVS-Studio对Elasticsearch进行源码审计的报告

• https://www.viva64.com/en/b/0621/

如何回滚/恢复Active Directory 对象属性

• https://blog.stealthbits.com/how-to-rollback-and-recover-active-directory-object-attributes/

如何使用CSP(内容安全策略)减少前端工具向量

• https://www.mindpointgroup.com/blog/application-security/using-csps-to-reduce-front-end-attack-vectors/

[漏洞]

TP-Link SR20智能Hub/路由器的任意命令执行漏洞

• https://twitter.com/mjg59/status/1111106885736787975
• https://pastebin.com/GAzccR95

博客软件BlogEngine.NET的RCE漏洞(CVE-2019-6714)

• https://blog.gdssecurity.com/labs/2019/3/28/remote-code-execution-in-blogenginenet.html

Magento Core的SQL注入漏洞

• https://www.ambionics.io/blog/magento-sqli
• https://blog.sucuri.net/2019/03/sql-injection-in-magento-core.html

Go语言的get命令可导致命令执行(CVE-2018-16873)

• https://staaldraad.github.io/post/2019-03-28-go-get-vuln/

利用Okta SSO认证时的回复时间进行用户名枚举

• https://blog.rapid7.com/2019/03/28/r7-2018-43-username-enumeration-in-okta-sso-del-auth-through-response-timing/

[恶意软件]

勒索软件CryptoMixClop禁用系统启动时修复功能, 删除/修改Shadow Volume Copies

• https://www.carbonblack.com/2019/03/28/cb-tau-threat-intelligence-notification-cryptomix-clop-ransomware-disables-startup-repair-removes-edits-shadow-volume-copies/

利用BOM(Byte Order Mark)技术躲避检测的恶意软件重新出现

• https://securelist.com/the-return-of-the-bom/90065/

针对韩国网站的钓鱼攻击, 通过水坑攻击窃取凭证

• https://blog.trendmicro.com/trendlabs-security-intelligence/desktop-mobile-phishing-campaign-targets-south-korean-websites-steals-credentials-via-watering-hole/

ShadowHammer供应链攻击第一阶段的Payload分析

• https://countercept.com/our-thinking/analysis-shadowhammer-asus-attack-first-stage-payload/

由AutoIt编写的窃密软件Qulab分析

• https://fumik0.com/2019/03/25/lets-play-with-qulab-an-exotic-malware-developed-in-autoit/

[代码/工具]

Ghidra发布9.0.1版

• https://www.ghidra-sre.org/releaseNotes.html#9_0_1

CutterDRcov: Cutter插件, 将DynamoRIO的代码覆盖分析结果导入到Cutter中并进行可视化

• https://github.com/oddcoder/CutterDRcov

commando-vm: PowerShell脚本, 将Windows系统配置为渗透测试/RedTeam环境.(火眼开源)

• https://github.com/fireeye/commando-vm
• https://www.fireeye.com/blog/threat-research/2019/03/commando-vm-windows-offensive-distribution.html

mkYARA: 根据二进制文件的代码自动生成Yara规则. 包含独立版本和IDA插件版本

• https://github.com/fox-it/mkyara
• https://blog.fox-it.com/2019/03/28/mkyara-writing-yara-rules-for-the-lazy-analyst/

[其他]

Fuzzing In The Year 2000

• https://blog.trailofbits.com/2019/03/28/fuzzing-in-the-year-2000/

BSidesSF 2019视频列表

• https://www.youtube.com/playlist?list=PLbZzXF2qC3RvGRbNQwKcf2KVaTCjzOB8o

20190328

[技术]

CSS代码片段导致MS的C++编译器崩溃

• https://www.viva64.com/en/b/0620/

ElectronCash比特比钱包插件CashShuffle的审计报告

• https://cybermashup.files.wordpress.com/2019/03/report-cashshuffle-20190325-2.pdf

渗透测试之: 在远程执行PowerShell命令

• https://resources.infosecinstitute.com/powershell-for-pentesters-part-5-remoting-with-powershell/

How to Purge Google and Start Over – Part 2

• https://www.blackhillsinfosec.com/how-to-purge-google-and-start-over-part-2/

通过深度学习将可执行文件转换为图像, 并进行恶意软件检测和分类

• https://arxiv.org/abs/1903.11551

BSEA-1: 基于流密码的后门技术

• https://arxiv.org/abs/1903.11063

基于SMTP会话异常检测的僵尸网络指纹识别方法

• https://arxiv.org/abs/1903.11400

(CTF)HackTheBox - Carrier CTF Walkthrough

• https://youtu.be/RJ1psxnVI84

Windows 10 RS4 PatchGuard分析(更新)

• https://blog.tetrane.com/downloads/Tetrane_PatchGuard_Analysis_RS4_v1.01.pdf

菲利普TriMedia架构探查

• https://github.com/quarkslab/conf-presentations/blob/master/Troopers19/trimedia-research-nriva.pdf

Step v0.9.0: easily curl services secured by mutual TLS and more

• https://smallstep.com/blog/easily-curl-services-secured-by-- https-tls.html

内存中执行ELF文件

• https://www.guitmz.com/running-elf-from-memory/

使用Ghidra分析Wannacry的死亡开关

• https://youtu.be/Sv8yu12y5zM

在Linux平台使用Radare2给二进制文件打补丁

• https://rayoflightz.github.io/linux/assembly/2019/03/26/Binary-patching-using-radare2.html

解析恶意代码常用的逃逸技巧

• https://www.vmray.com/cyber-security-blog/resource/sans-webcast-dissecting-popular-evasive-malware-techniques/

[漏洞]

Windows内核的引用计数漏洞分析(CVE-2018-8410)

• https://blog.tetrane.com/2019/Analysis-Windows-Kernel-Bug-CVE-2018-8410.html

NVIDIA GeForce Experience任意文件写入导致命令执行漏洞(CVE-2019-5674)

• https://rhinosecuritylabs.com/application-security/nvidia-arbitrary-file-writes-to-command-execution-cve-2019-5674/

开源搜索平台Apache Solr对不信任数据反序列化产生的漏洞CVE-2019-0192

• https://blog.trendmicro.com/trendlabs-security-intelligence/cve-2019-0192-mitigating-unsecure-deserialization-in-apache-solr/

[恶意代码]

.NET编写的模块化恶意软件PsiXBot的进化过程

• https://blog.fox-it.com/2019/03/27/psixbot-the-evolution-of-a-modular-net-bot/

LockerGoga勒索软件分析

• https://labsblog.f-secure.com/2019/03/27/analysis-of-lockergoga-ransomware/

WannaMine Dropper: 混淆的PowerShell脚本

• https://www.xednaps.com/2019/03/26/wannamine-dropper-powershell-obfuscation/

[代码/工具]

android-restriction-bypass: Android运行时限制绕过PoC

• https://github.com/quarkslab/android-restriction-bypass
• https://blog.quarkslab.com/android-runtime-restrictions-bypass.html

dnschef: 用于渗透测试和恶意代码分析的DNS代理

• https://github.com/byt3bl33d3r/dnschef

使用MS ACCESS TransformXML实现横向渗透

• https://gist.github.com/Philts/1c6a41048501d5067fd0ab4b933a38c8

CQTools: 终极Hacking工具包

• https://cqureacademy.com/blog/no-category/black-hat-asia-2019-tools

[其他]

卡巴斯基实验室发布的2018下半年工业自动化系统的威胁景观报告

• https://ics-cert.kaspersky.com/reports/2019/03/27/threat-landscape-for-industrial-automation-systems-h2-2018/

20190327

[技术]

使用图片对智能协议进行深入浅出的讲解

• https://medium.com/p/bc21c7ab89b6/

使用MythX挖掘智能协议的严重漏洞

• https://medium.com/p/9c568d7db7a6

有史以来最恶劣的脚本引擎SharpShell实战

• https://hakin9.org/sharpshell-the-worst-scripting-engine-of-all-time-by-ryan-cobb/

编写脚本监控恶意代码调用的内核API和参数

• https://resources.infosecinstitute.com/virtual-machine-introspection-in-malware-analysis-use-case/

Android渗透环境配置

• http://blog.securelayer7.net/setting-up-an-android-pentesting-environment/

绕过ASR规则(禁止PSExec/WMI命令创建进程)实现横向移动

• https://ionize.com.au/lateral-movement-in-an-environment-with-attack-surface-reduction/

物联网环境中, 使用区块链技术保存法庭证据的解决方案

• https://arxiv.org/abs/1903.10770

使用Venkman限制推测执行期间的控制流程

• https://arxiv.org/abs/1903.10651

Don't Pick the Cherry: 针对Android恶意软件检测方法的评估方法

• https://arxiv.org/abs/1903.10560

通过随机离散化防御白盒对抗性攻击

• https://arxiv.org/abs/1903.10586

理解Android系统架构

• http://blog.securelayer7.net/understanding-android-os-architecture/

识别容器镜像中的敏感信息

• https://anchore.com/blog/identifying-secrets-in-your-container-images/

如何利用Java反序列化漏洞攻击Java RMI服务

• https://mogwailabs.de/blog/2019/03/attacking-java-rmi-services-after-jep-290/

Metasploit开发日记: 2019年第1季度

• https://www.rapid7.com/research/report/metasploit-development-diaries-q1-2019/

自动化绕过Windows Defender的黑名单防护

• https://www.cyberguider.com/bypassing-av-cat-vs-mouse/

(CTF)$50 million CTF Writeup

• https://github.com/manoelt/50M_CTF_Writeup/blob/master/README.md

[漏洞]

文档管理系统LogicalDOC路径回溯漏洞(CVE-2019-9723), 可导致攻击者窃取任意文档

• https://blog.ripstech.com/2019/logicaldoc-path-traversal/

RoR任意文件读取漏洞(CVE-2019-5418)

• https://devcentral.f5.com/articles/ruby-on-rails-arbitrary-file-read-cve-2019-5418-34022

GOG Galaxy视频游戏的多个漏洞

• https://blog.talosintelligence.com/2019/03/vulnerability-spotlight-multiple.html

应用在近亿设备的嵌入式蓝牙栈BlueSDK的0Day分析

• https://www.cymotive.com/wp-content/uploads/2019/03/Hell2CAP-0day.pdf

谷歌群组(Google Group)认证绕过漏洞

• https://www.komodosec.com/post/google-groups-authorization-bypass

移动端UC浏览器可绕过GooglePlay服务器下载任意软件模块

• https://news.drweb.com/show/?i=13176

[恶意代码]

APT组织Lazarus对数字货币依旧契而不舍

• https://securelist.com/cryptocurrency-businesses-still-being-targeted-by-lazarus/90019/

使用CyberChef反混淆PowerShell脚本

• https://youtu.be/ptsF2PvD4vY

Plugin vulnerabilities exploited in traffic monetization schemes

• https://blog.malwarebytes.com/threat-analysis/2019/03/plugin-vulnerabilities-exploited-traffic-monetization-schemes/

黑客使用Ursnif木马对意大利发动持续性攻击

• https://blog.yoroi.company/research/the-ursnif-gangs-keep-threatening-italy/

LockerGoga勒索软件分析

• https://www.sentinelone.com/blog/lockergoga-ransomware-targets-industrial-companies/

[代码/工具]

automated-pentest: 自动创建基于Parrot OS的Docker容器, 并运行自动化扫描、渗透

• https://github.com/vishnudxb/automated-pentest

Fuzzlon: 802.15.4 Fuzzer. 随机生成有效的IEEE 802.15.4数据包并使用ApiMote发送

• https://github.com/enigmatos/Fuzzlon
• https://www.enigmatos.com/2019/03/24/fuzzlon/

CypherDog: PowerShell脚本, 使用Neo4j REST API与BloodHound交互

• https://github.com/SadProcessor/CypherDog

xori: 具备自动化分析功能的反汇编/静态分析库, 针对PE32/Shellcode. Rust编写

• https://github.com/endgameinc/xori

[其他]

揭秘俄罗斯和叙利亚的GPS欺骗攻击行动

• https://static1.squarespace.com/static/566ef8b4d8af107232d5358a/t/5c99488beb39314c45e782da/1553549492554/Above+Us+Only+Stars.pdf

网络安全在维持业务发展中的作用

• https://www.radware.com/social/ert-report-2018

Rethinking Response

• https://countercept.com/blog/rethinking-response/

20190326

[技术]

未初始化内核内存的取证分析

• https://dfir.ru/2019/03/25/forensic-analysis-of-disclosed-uninitialized-kernel-memory/

Clang CFI/SafeStack Analysis

• https://github.com/dobin/clang-cfi-safestack-analysis

使用Sboxr实现DOM XSS漏洞的自动挖掘与利用

• https://medium.com/p/2e55c120c9e1

Windows平台软件逆向的正确方式

• https://www.apriorit.com/dev-blog/364-how-to-reverse-engineer-software-windows-in-a-right-way

EMC文件活动监控

• https://blog.stealthbits.com/emc-file-activity-monitoring/

(CTF) Hack the Box (HTB) Machines Walkthrough Series — Active

• https://resources.infosecinstitute.com/hack-the-box-htb-machines-walkthrough-series-active/

[漏洞]

利用Gogs/Gitea的RCE漏洞(CVE-2018-18925, CVE-2018-20303)获取管理员权限

• https://github.com/TheZ3ro/gogsownz

Grandstream(潮流)设备的多个漏洞

• https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=23920 Grandstream(潮流)设备多个RCE漏洞的PoC
• https://github.com/scarvell/grandstream_exploits

From alert to driver vulnerability: Microsoft Defender ATP investigation unearths privilege escalation flaw

• https://www.microsoft.com/security/blog/2019/03/25/from-alert-to-driver-vulnerability-microsoft-defender-atp-investigation-unearths-privilege-escalation-flaw/

1行代码实现Safari沙箱逃逸

• https://medium.com/0xcc/one-liner-safari-sandbox-escape-exploit-91082ddbe6ef

iOS/OSX漏洞CVE-2019-7286分析, Part2: 获取PC控制权限

• https://blog.zecops.com/vulnerabilities/exploit-of-cve-2019-7286/

[恶意代码]

ShadowHammer行动: 利用ASUS更新软件的供应链攻击行动分析

• https://securelist.com/operation-shadowhammer/89992/

Gh0stRAT的1个奇怪变种分析

• https://www.alienvault.com/blogs/labs-research/the-odd-case-of-a-gh0strat-variant

[代码/工具]

anevicon: 基于UDP的压力测试工具. Rust编写

• https://github.com/gymmasssorla/anevicon

BadArchitect: 滥用SketchUp在Windows系统上实现驻留

• https://github.com/mthbernardes/BadArchitect

[其他]

2018年勒索软件趋势与分析报告

• https://info.nettitude.com/ransomware-trends-march-2019

20190325

[技术]

针对Android UI的攻击

• https://docs.google.com/presentation/d/1Ya2BThnbkXzAtXR3zh9SAiLAZ_mC3nYt8Zxm-KAIqZ4/edit#slide=id.p

[CTF] Hack The Box - Frolic

• https://0xrick.github.io/hack-the-box/frolic/

获取漏洞交易平台0day.today的真实IP

• https://www.secjuice.com/disclosure-of-origin-ip-of-0-day-today-market/

Ghidra初探

• https://biniamdemissie.com/2019/03/24/playing-with-the-nsas-ghidra/

邮件服务器安全: 潜在的漏洞与防护方式

• https://www.apriorit.com/qa-blog/428-mail-server-security-testing

Hacking小米手环3

• https://hakin9.org/i-hacked-miband-3-and-here-is-how-i-did-it-part-i-by-yogesh-ojha/

使用IDA从零开始学逆向, part9

• https://medium.com/p/3ead456499d2

[漏洞]

Critical Vulnerability Affects Medtronic CareLink Monitors, Programmers, and ICDs

• https://www.hipaajournal.com/critical-vulnerability-medtronic-carelink-monitors-programmers-icds/

[恶意代码]

使用Ghidra分析Gootkit, part1

• https://dannyquist.github.io/gootkit-reversing-ghidra/

LockerGoga勒索软件

• https://www.carbonblack.com/2019/03/22/tau-threat-intelligence-notification-lockergoga-ransomware/

窃密软件AZORult的重写历史

• https://securelist.com/azorult-analysis-history/89922/

组合使用多种反分析技术的挖矿木马SeroMiner分析

• https://blog.360totalsecurity.com/en/analysis-of-serominer-trojan-combine-multiple-anti-analytic-techniques/

使用IDAPython分析Trickbot

• https://cyber.wtf/2019/03/22/using-ida-python-to-analyze-trickbot/

分析.NET编写的窃密软件GrandSteal

• http://www.peppermalware.com/2019/03/analysis-of-net-stealer-grandsteal-2019.html

[代码/工具]

endlessh: 以非常慢的速度无限制的向SSH客户端发送随机SSH banner, 锁定SSH客户端, 使脚本小子们陷在虚假的SSH服务中

• https://github.com/skeeto/endlessh

legion: Python编写的渗透工具, 带GUI

• https://github.com/govanguard/legion

beagle: 事件响应、数据取证工具, 将安全日志和数据转化为图表

• https://github.com/yampelo/beagle

router_badusb: 针对树莓派的BadUSB框架

• https://github.com/tenable/router_badusb

GhidraVmlinuxLoader: 使Ghidra加载vmlinux内核镜像

• https://github.com/idl3r/GhidraVmlinuxLoader

ghidra-scala-loader: Ghidra扩展, 使Ghidra可加载Scala编写的脚本

• https://github.com/edmcman/ghidra-scala-loader

[其他]

嵌入式设备的电源管理与保护系统

• https://medium.com/p/2750c8ee54ea

如何高效的对AWS基础设施进行安全审计

• https://www.apriorit.com/qa-blog/604-aws-infrastructure-security-audit

20190322

[技术]

OSX系统的免杀

• https://danielsauder.com/2019/03/21/antivirus-evasion-on-osx/

长度受限制情况下的SQL注入

• https://www.directdefense.com/limited-length-sql-injection/

对Android平台聊天App进行高效渗透的方式

• https://medium.com/p/46221d8a040f

大多数人都无法抗拒插入找到的USB的诱惑

• https://zakird.com/papers/usb.pdf

利用Azure自动化账户获取Key Vaults中的敏感信息

• https://blog.netspi.com/azure-automation-accounts-key-stores/

利用终端防护软件(Heimdal Thor)实现命令注入

• https://www.pentestpartners.com/security-blog/remote-command-injection-through-an-endpoint-security-product/

从安全的USB设备中提取固件

• https://securelist.com/hacking-microcontroller-firmware-through-a-usb/89919/

使用Empire对OSX进行渗透攻击

• https://www.hackingarticles.in/osx-exploitation-with-powershell-empire/

理解STIR/SHAKEN

• https://transnexus.com/whitepapers/understanding-stir-shaken/

使用IDA逆向Go语言编译的文件

• https://medium.com/@nishanmaharjan17/reversing-golang-binaries-part-1-c273b2ca5333

后渗透工具Silenttrinity实战

• https://www.hackingarticles.in/command-control-silenttrinity-post-exploitation-agent/

[漏洞]

谷歌图书(Google Books)的跨站搜索漏洞

• https://medium.com/@terjanq/google-books-x-hacking-29c249862f19

(Wordpress)Social Warfare插件0Day漏洞详情与攻击数据

• https://www.wordfence.com/blog/2019/03/social-warfare-plugin-zero-day-details-and-attack-data/

(Wordpress)Easy WP SMTP插件严重漏洞, 影响数千网站

• https://blog.sucuri.net/2019/03/0day-vulnerability-in-easy-wp-smtp-affects-thousands-of-sites.html
• https://www.wordfence.com/blog/2019/03/hackers-abusing-recently-patched-vulnerability-in-easy-wp-smtp-plugin/

[恶意代码]

BokBot核心模块分析之: 复杂的proxy模块是如何引诱受害者向C&C发送敏感信息的

• https://www.crowdstrike.com/blog/bokbots-man-in-the-browser-overview/

[代码/工具]

goscan: 交互式网络扫描器

• https://github.com/marco-lancini/goscan

npk: 分布式Hash破解平台

• https://github.com/Coalfire-Research/npk
• https://www.coalfire.com/The-Coalfire-Blog/March-2019/High-Power-Hash-Cracking-with-NPK

Karta: IDA插件, 识别二进制文件中的开源库函数, 并进行相似度对比

• https://github.com/CheckPointSW/Karta
• https://research.checkpoint.com/karta-matching-open-sources-in-binaries/

mXtract: Linux内存提取与分析工具

• https://github.com/rek7/mXtract

RapidRepoPull: 快速pull/维护多个与安全相关的repo

• https://github.com/tbalz2319/RapidRepoPull

picasso-like-canvas-fingerprinting: 基于Canvas的指纹识别技术

• https://github.com/antoinevastel/picasso-like-canvas-fingerprinting
• https://antoinevastel.com/browser%20fingerprinting/2019/03/21/picasso-canvas-fingerprinting.html

TikiTorch: Process Hollowing具体实现

• https://github.com/rasta-mouse/tikitorch
• https://rastamouse.me/2019/03/tikitorch/

[其他]

Linux内核清单

• https://github.com/************/linux-kernel-module-cheat

从行业的角度看待主流Bot的威胁

• https://blog.radware.com/security/2019/03/cisos-know-your-enemy-an-industry-wise-look-at-major-bot-threats/

我在加密货币交易中损失了139,000美元后学到了什么

• https://medium.com/p/c974c86326a7/

如何成为漏洞赏金猎人

• https://www.stationx.net/how-to-become-a-bug-bounty-hunter/

20190321

[技术]

使用CarbonBlack Response和AnyRun对勒索软件进行威胁狩猎

• https://threat.tevora.com/threat-hunting-for-ransomware-with-carbonblack-response-and-anyrun/

使用内置工具进行横向渗透的几种方式

• https://threat.tevora.com/lateral-movement-when- https-threat-tevora-com-p-765ee696-b24a-4a53-aee6-6fd30ff342e8-powershell-is-locked-down/

Hacking with Go

• https://www.youtube.com/watch?v=_ZIRYeWEzU4

逆向蓝牙灯泡

• https://www.youtube.com/watch?v=-IEvDBJ6D9Y

使用John The Ripper破解MS Excel文档

• https://www.andreafortuna.org/cybersecurity/cracking-microsoft-excel-documents-using-john-the-ripper/

Connected camera cock up

• https://www.pentestpartners.com/security-blog/connected-camera-cock-up/

通过静态+动态分析, 去除Android App的混淆

• https://www.virusbulletin.com/blog/2019/03/vb2018-paper-and-video-android-app-deobfuscation-using-static-dynamic-cooperation/

无线安全指南之: LEAP认证介绍

• https://resources.infosecinstitute.com/wireless-security-guide-introduction-to-leap-authentication/

模拟器练习: Xbox 360的FMA指令

• https://randomascii.wordpress.com/2019/03/20/exercises-in-emulation-xbox-360s-fma-instruction/

Kerberos认证协议工作原理, part1: 理论

• https://www.tarlogic.com/en/blog/how-kerberos-works/

缓冲区溢出实战演练: ret2libc

• https://0xrick.github.io/binary-exploitation/bof6/

滥用Windows系统特权文件操作操作

• http://offsec.provadys.com/intro-to-file-operation-abuse-on-Windows.html

Windows Defender绕过

• https://www.cyberguider.com/bypassing-windows-defender-the-tedious-way/

[漏洞]

谷歌照片(Google Photos)漏洞可导致攻击者朋友和定位历史

• https://www.imperva.com/blog/now-patched-google-photos-vulnerability-let-hackers-track-your-friends-and-location-history/

Chrome FileReader API UAF 0Day(CVE-2019-5786) 分析

• https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/analysis-of-a-chrome-zero-day-cve-2019-5786/

Ghidra 工程加载过程的XXE漏洞, 可导致RCE

• https://xlab.tencent.com/en/2019/03/18/ghidra-from-xxe-to-rce/

PostgreSQL任意命令执行漏洞(CVE-2019–9193)

• https://medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5

SolarWinds数据库性能分析器的反射XSS漏洞

• https://medium.com/greenwolf-security/reflected-xss-in-solarwinds-database-performance-analyzer-988bd7a5cd5

Credit Karma App使用硬编码的- http地址通信, 可能导致钓鱼攻击

• https://gist.github.com/soatok/7636aafc1d97fcb6c24657319b2a62ba

Avira VPN更新路径不安全, 可导致提权

• https://enigma0x3.net/2019/03/20/avira-vpn-2-15-2-28160-elevation-of-privilege-through-insecure-update-location/

[恶意代码]

NanoCore恶意软件的新技巧

• https://www.carbonblack.com/2019/03/20/tau-threat-intelligence-notification-nanocore-old-malware-new-tricks/

APT组织海莲花开发的后门使用的最新技术解析

• https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/

勒索软件LockerGoga简单分析

• https://www.joesecurity.org/blog/2995389471535835488

针对以色列的Fin-Tech公司的Cardinal远控分析

• https://unit42.paloaltonetworks.com/cardinal-rat-sins-again-targets-israeli-fin-tech-firms/

勒索软件LockerGoga分析

• https://blog.talosintelligence.com/2019/03/lockergoga.html

[代码]

WinPwn: Windows渗透自动化/ActiveDirectory安全相关的PowerShell脚本

• https://github.com/SecureThisShit/WinPwn

A-Detector: 基于anomaly的入侵检测系统

• https://github.com/alexfrancow/A-Detector

fuzzilli: 针对JS引擎的Fuzzer

• https://github.com/googleprojectzero/fuzzilli

macOS-enterprise-privileges: macOS系统权限管理辅助工具, 用于普通用户的日常使用

• https://github.com/sap/macos-enterprise-privileges

[其他]

Python代码片段清单, 完全版

• https://gto76.github.io/python-cheatsheet/

用于无线渗透的Linux发行版SigintOS预览

• https://medium.com/p/a7ea93ee8f8b

(IBM X-Force)2019年威胁情报索引报告

• https://www.ibm.com/account/reg/us-en/signup?formid=urx-36763

20190320

[技术]

使用Semmle QL进行漏洞挖掘, Part2

• https://blogs.technet.microsoft.com/srd/2019/03/19/vulnerability-hunting-with-semmle-ql-part-2/

使用- http Pipelining隐藏恶意请求

• https://digi.ninja/blog/pipelining.php

将Hak5 Packet Squirrel作为自动化Tor匿名器

• http://disbauxes.upc.es/security/transform-your-hak5-packet-squirrel-into-an-automatic-tor-annonymizer/

1种新的Win10 KASLR绕过方式

• https://www.offensive-security.com/vulndev/development-of-a-new-windows-10-kaslr-bypass-in-one-windbg-command/

Shlayer Purveyor VeryMal Renounces Steganography In Favor Of Google Firebase As Malvertisers Shift Towards Subtle Payloads

• https://blog.confiant.com/shlayer-purveyor-verymal-renounces-steganography-in-favor-of-google-firebase-as-malvertisers-shift-3a6119ecba24

数字取证技巧: 如何检测入侵者对组策略的修改

• https://habr.com/en/post/444048/

开源远控工具Pupy实战

• https://www.hackingarticles.in/command-control-tool-pupy/

• http缓存跨站泄漏

• http://sirdarckcat.blogspot.com/2019/03/- http-cache-cross-site-leaks.html

(CTF)You Shall Not Pass

• https://medium.com/tsscyber/ctf-writeup-you-shall-not-pass-2c7a9254549b

BotGraph: 基于网站地图的Web机器人检测

• https://arxiv.org/abs/1903.08074

计算机安全趋势: 加密/用户身份验证/拒绝服务和入侵检测

• https://arxiv.org/abs/1903.08052

基于从深度置信网络提取的特征, 进行DDoS攻击检测

• https://arxiv.org/abs/1903.07889

使用JTAG提取固件内存

• https://www.gracefulsecurity.com/extracting-flash-memory-using-jtag/

Burp+ProxyMesh实现IP地址旋转, 绕过IP地址黑名单

• https://www.blackhillsinfosec.com/how-to-rotate-your-source-ip-address/

More on Dnsden[.]biz Swipers and Radix Obfuscation

• https://blog.sucuri.net/2019/03/more-on-dnsden-biz-swipers-and-radix-obfuscation.html

DDoS攻击101

• https://resources.infosecinstitute.com/ddos-attacks-101/

Java序列化漏洞利用指南

• http://rapid7.com/exploiting-jsos

网络钓鱼攻击之: HTML文件属性

• https://www.sentinelone.com/blog/technical-analysis-paypal-phishing-scam/

对世界排名第2的开源计算器SpeedCrunch进行源码审计

• https://www.viva64.com/en/b/0618/

对高度混淆的crackme MarsAnalytica进行分析

• https://www.pnfsoftware.com/blog/marsanalytica-crackme-solution-part-1/

Radio Hacking简介

• https://www.gracefulsecurity.com/keyfob-cloning/

硬件hacking介绍(系列文章)

• https://www.gracefulsecurity.com/introduction-to-hardware-hacking/

XSLeaks攻击讨论

• http://sirdarckcat.blogspot.com/2019/03/- http-cache-cross-site-leaks.html

[漏洞]

某网站的跨站内容与状态类型(Content and Status Types)泄漏漏洞

• https://medium.com/@terjanq/cross-site-content-and-status-types-leakage-ef2dab0a492

CUJO智能防火墙的多个漏洞分析

• https://blog.talosintelligence.com/2019/03/vuln-spotlight-cujo.html

[恶意代码]

一次新的门罗币挖矿软件攻击事件分析

• https://blog.checkpoint.com/2019/03/19/check-point-forensic-files-monero-cryptominer-campaign-cryptojacking-crypto-apt-hacking/

[代码/工具]

daenerys-sre: IDA和Ghidra脚本互通工具

• https://github.com/daenerys-sre/source
• http://0xeb.net/2019/03/daenerys-ida-pro-and-ghidra-interoperability-framework/

pown-whoarethey: 快速识别社交网络帐号

• https://github.com/pownjs/pown-whoarethey

[其他]

无线电频率技术对工业部分带来的风险

• https://blog.trendmicro.com/how-radio-frequency-technology-is-putting-the-industrial-sector-at-risk/

20190319

[技术]

Small dumps in the big pool

• https://blahcat.github.io/2019/03/17/small-dumps-in-the-big-pool/

区块链的安全与隐私

• https://arxiv.org/abs/1903.07602

在macOS上获取和滥用Slack Legacy Tokens

• https://blacksunhackers.club/2019/03/acquiring-and-abusing-legacy-slack-tokens/

针对IoT的区块链技术: 现在与未来

• https://arxiv.org/abs/1903.07448

利用Apple的桌面搜索实用程序恢复macOS上已删除的文件元数据

• https://arxiv.org/abs/1903.07053

使用Empire攻击OSX系统的多种方式

• https://www.hackingarticles.in/multiple-ways-to-exploiting-osx-using-powershell-empire/

编写自定义的Shellcode编码器

• https://medium.com/@0x0FFB347/writing-a-custom-shellcode-encoder-31816e767611

现实攻击实例: 银行遭遇DDoS攻击

• https://youtu.be/xUGx_M36Q98

[CTF] Hack the Box(HTB) Machines Walkthrough Series — Tenten

• https://resources.infosecinstitute.com/hack-the-boxhtb-machines-walkthrough-series-tenten/

使用PVS-Studio检查FreeRDP

• https://www.viva64.com/en/b/0617/

巫师3渲染过程逆向, Part12: stupid sky tricks

• http://astralcode.blogspot.com/2019/03/reverse-engineering-rendering-of_17.html

[漏洞]

WP-Fastest-Cache任意文件删除

• https://blog.sucuri.net/2019/03/arbitrary-directory-deletion-in-wp-fastest-cache.html

CVE-2019–5420漏洞利用

• https://medium.com/p/b502a64a80dd

开源Pusher服务器实现Slanger的RCE漏洞

• https://www.honoki.net/2019/03/rce-in-slanger-0-6-0/

Apache Struts OGNL注入漏洞利用(CVE-2017-5638/CVE-2018-11776)

• https://pentest-tools.com/blog/exploiting-ognl-injection-in-apache-struts/

Mozilla AWS网络某0Day漏洞的挖掘, 以及实现代码执行

• https://blog.assetnote.io/bug-bounty/2019/03/19/rce-on-mozilla-zero-day-webpagetest/

动态PDF文档生成框架TCPDF的反序列化漏洞(CVE-2018-17057)

• https://polict.net/blog/CVE-2018-17057

罗技无线鼠标的按键注入漏洞

• https://www.davidsopas.com/popular-wireless-logitech-mouse-vulnerable-to-keystroke-injection/

[恶意代码]

银行木马BlackMoon的历史版本和最新版本分析

• https://www.peppermalware.com/2019/03/analysis-of-blackmoon-banking-trojans.html

Mirai新变种, 添加了更多的Exploit

• https://www.bleepingcomputer.com/news/security/new-mirai-variant-comes-with-27-exploits-targets-enterprise-devices/

TAU Threat Intelligence Notification: Operation SharpShooter

• https://www.carbonblack.com/2019/03/18/tau-threat-intelligence-notification-operation-sharpshooter/

Excel 4.0宏样本分析

• https://isc.sans.edu/forums/diary/Video+Maldoc+Analysis+Excel+40+Macro/24752/

[代码/工具]

mitmengine: 准确检测- httpS拦截和TLS指纹, 检测中间人攻击

• https://github.com/cloudflare/mitmengine [介绍] - https://blog.cloudflare.com/monsters-in-the-middleboxes/

Hamburglar: 从url/目录/文件中收集有用信息

• https://github.com/needmorecowbell/Hamburglar

pastebin_scraper: 自动监控pastebin中的有趣/敏感信息

• https://github.com/Critical-Start/pastebin_scraper [介绍] - https://www.criticalstart.com/2019/03/automated-tool-to-monitor-pastebin-for-interesting-information/

DOGE: Darknet Osint Graph Explorer

• https://github.com/pielco11/DOGE

sandboxed-api: 谷歌开源的Sandboxed API

• https://github.com/google/sandboxed-api [介绍] - https://security.googleblog.com/2019/03/open-sourcing-sandboxed-api.html

[其他]

与渗透相关的NodeJS资源收集

• https://github.com/jesusprubio/awesome-nodejs-pentest

代码分析工具Top15

• https://resources.infosecinstitute.com/secure-coding-top-15-code-analysis-tools/

网络安全威胁景观2018年: 趋势和预测

• https://www.ptsecurity.com/ww-en/analytics/cybersecurity-threatscape-2018/

IPv6 unmasking via UPnP

• https://blog.talosintelligence.com/2019/03/ipv6-unmasking-via-upnp.html

20190318

[技术]

Walkthrough. Investigating an SSD

• https://www.pentestpartners.com/security-blog/walkthrough-investigating-an-ssd/

恶意代码混淆中, 非常见十进制基数(Radixes)的使用

• https://blog.sucuri.net/2019/03/uncommon-radixes-used-in-malware-obfuscation.html

使用IDA从0开始学逆向, Part8

• https://medium.com/p/c627c70b5efd

[CTF] In BSidesSF CTF, calc.exe exploits you!

• https://blog.skullsecurity.org/2019/in-bsidessf-ctf-calc-exe-exploits-you-author-writeup-of-launchcode

如何编写安全的代码之: CSS防护

• https://medium.com/p/b2757b59cd4b

从Winbond SPI EEPROM中提取固件

• http://www.offensiveops.io/tools/extracting-firmware-from-a-winbond-spi-eeprom/

TrojDRL: 针对深度学习强化客户端的木马攻击

• https://arxiv.org/abs/1903.06638

AccFlow: 抵御无线传感器网络中的低速TCP DoS攻击

• https://arxiv.org/abs/1903.06394

[CTF] Break the Ice — Hardware CTF

• https://medium.com/sector443/break-the-ice-hardware-ctf-c63cbb0062f5?sk=11a4609b5978c41b0f8b27d643f9b51f

One-Way Shellcode for firewall evasion using Out Of Band data

• https://www.shelliscoming.com/2019/03/one-way-shellcode-for-firewall-evasion.html

[CTF] Hack The Box - Carrier

• https://0xrick.github.io/hack-the-box/carrier/

利用Windows商店的二进制文件实现无文件UAC绕过

• https://www.activecyber.us/activelabs/windows-uac-bypass

绕过MaxScale(MySQL代理)的防火墙和Masking规则

• https://blog.tarq.io/maxscale-firewall-bypass/

基于用户名+邮箱+手机号码的常见安全注册流程解析

• https://www.technolush.com/blog/secure-registration-flow

常见的Web App威胁

• https://www.technolush.com/blog/common-web-application-threats

使用Ghidra Patch SEGA Genesis ROM, 实现ROM劫持

• https://zznop.github.io/romhacking/2019/03/14/sega-genesis-rom-hacking-with-ghidra.html

Python在逆向ELF文件中的应用

• https://dev.to/icyphox/python-for-reverse-engineering-1-elf-binaries-1fo4

使用Jupyter和Radare2分析二进制文件

• https://isc.sans.edu/forums/diary/Binary+Analysis+with+Jupyter+and+Radare2/24748/

DOM API导致跨站信息泄漏的资料收集

• https://github.com/xsleaks/xsleaks

[漏洞]

Steam客户端获取服务器信息时缓冲区溢出, 导致RCE

• https://hackerone.com/reports/470520

VMWare Horizon信息泄漏漏洞(CVE-2019-5513)

• https://www.atredis.com/blog/2019/3/15/cve-2019-5513-information-leaks-in-vmware-horizon

Windows DHCP客户端RCE漏洞(CVE-2019-0726)

• https://labs.mwrinfosecurity.com/advisories/windows-dhcp-client/

[恶意代码]

一些Metasploit payload分析(Linux/x64)

• https://medium.com/@0x0FFB347/analysis-of-some-metasploit-network-payloads-linux-x64-ab8a8d11bbae

攻击者在针对Office365和G-Suite云账户的攻击中, 使用IMAP协议绕过MFA

• https://www.proofpoint.com/us/threat-insight/post/threat-actors-leverage-credential-dumps-phishing-and-legacy-email-protocols

[代码/工具]

APK Utilities: APK文件操纵脚本

• https://github.com/ViRb3/apk-utilities

GHIDRApy_FunctionStringAssociate: Ghidra脚本, 实现与IDA插件FunctionStringAssociate相同的功能

• https://github.com/partoftheworlD/GHIDRApy_FunctionStringAssociate

subdomain-bruteforce: 子域名爆破工具, 支持Win98-Win10

• https://github.com/visualbasic6/subdomain-bruteforce

PowerHub: 传输PowerShell模块/执行文件/代码片段, 可绕过AV和应用程序白名单

• https://github.com/AdrianVollmer/PowerHub

SSRFmap: 自动化SSRF Fuzz与利用

• https://github.com/swisskyrepo/SSRFmap

pypykatz_agent_dn: .NET实现的Pypykatz agent

• https://github.com/skelsec/pypykatz_agent_dn

pocsuite3: 远程漏洞测试与PoC开发框架

• https://github.com/knownsec/pocsuite3

mad-metasploit: Metasploit自定义模块/插件/资源/脚本等收集

• https://github.com/hahwul/mad-metasploit

hashboy-tool: Hash查询工具

• https://github.com/sf197/hashboy-tool/

20190315

[技术]

[CTF] Hack the Box (HTB) Machines Walkthrough Series — SolidState

• https://resources.infosecinstitute.com/hack-the-box-htb-machines-walkthrough-series-solidstate/

将Self-XSS转变成可利用的XSS

• https://www.netsparker.com/blog/web-security/transforming-self-xss-into-exploitable-xss/

为macOS开发内核扩展(Kexts)

• https://www.apriorit.com/dev-blog/430-macos-kext-development

使用Ghidra破解一个内嵌固件的加密机制

• https://youtu.be/4urMITJKQQs

[CTF] HackInOS:1: Vulnhub Lab Walkthrough

• https://www.hackingarticles.in/hackinos1-vulnhub-lab-walkthrough/

恶意代码分析框架: Cuckoo/REMnux/GRR

• https://eforensicsmag.com/malware-analysis-frameworks-by-prasanna-b-mundas/

动态恶意代码分析之: 进程监控

• https://eforensicsmag.com/dynamic-malware-analysis-process-monitor-and-explorer-by-prasanna-b-mundas/

[漏洞]

V8引擎漏洞(CVE-2019-5790)

• https://mtowalski.github.io/

Sonatype Nexus Repository Manager 3 缺乏访问控制导致RCE(CVE-2019-7238)

• https://blog.trendmicro.com/trendlabs-security-intelligence/cve-2019-7238-insufficient-access-controls-in-sonatype-nexus-repository-manager-3-allows-remote-code-execution/

Windows内核逻辑漏洞Class: IO管理器访问模式不匹配

• https://googleprojectzero.blogspot.com/2019/03/windows-kernel-logic-bug-class-access.html

利用Windows IO管理器实现本地提权

• https://blogs.technet.microsoft.com/srd/2019/03/14/local-privilege-escalation-via-the-windows-i-o-manager-a-variant-finding-collaboration/

Wordpress PHAR注入漏洞的进一步利用

• https://blog.cystack.net/wordpress-phar/

2个Safari JIT漏洞详情与PoC(CVE-2019-6216/6217)

• https://www.zerodayinitiative.com/blog/2019/3/14/the-apple-bug-that-fell-near-the-webkit-tree

StackStorm CORS错误配置漏洞导致RCE(CVE-2019-9580)

• https://github.com/mpgn/CVE-2019-9580

[恶意代码]

SimBad: 谷歌商店广告软件分析

• https://research.checkpoint.com/simbad-a-rogue-adware-campaign-on-google-play/

针对日本和韩国地区的恶意软件攻击分析

• https://www.bromium.com/location-aware-malware-targets-japanese-korean-endpoints/

反恐精英1.6中的0Day漏洞可导致恶意服务器攻克玩家的PC

• https://news.drweb.com/show/?i=13135&c=23&lng=en&p=0

云端的挖矿攻击

• https://www.alienvault.com/blogs/labs-research/making-it-rain-cryptocurrency-mining-attacks-in-the-cloud

Emotet revisited: pervasive threat still a danger to businesses

• https://blog.malwarebytes.com/cybercrime/2019/03/emotet-revisited-this-pervasive-persistent-threat-is-still-a-danger-to-businesses/

[代码/工具]

email-enum: 检查邮箱是否在主流网站注册过

• https://github.com/Frint0/email-enum

pypykatz_server: Pypykatz服务器

• https://github.com/skelsec/pypykatz_server

Privilege-Escalation-Framework: Privilege Escilation training project, with an emphasis on the distinction between vulnerability research & it's exposure and exploitation methods(which are CVE-independent.)

• https://github.com/scalys7/Privilege-Escalation-Framework

[其他]

密钥Key大小和算法建议完全指南(2019版)

• https://paragonie.com/blog/2019/03/definitive-2019-guide-cryptographic-key-sizes-and-algorithm-recommendations

20190314

[技术]

如何编写安全代码之: 强壮的认证与会话管理

• https://medium.com/p/d4823bc2e86d

有关Windows内存管理的一些想法

• https://www.andreafortuna.org/cybersecurity/some-thoughts-about-windows-memory-management/

macOS平台iCloud认证Token的获取

• https://blacksunhackers.club/2019/03/iCloud-Authentication-Token-acquisition-on-macOS/

一个检测恶意代码变种的机器学习模型

• https://blog.trendmicro.com/trendlabs-security-intelligence/a-machine-learning-model-to-detect-malware-variants/

智能家居的私人助理: 安全与隐私审查

• https://arxiv.org/abs/1903.05593

防止滥用廉价托管Web服务器进行货币化攻击的企图

• https://arxiv.org/abs/1903.05470

移动平台恶意代码脱壳的N种方式

• https://pentest.blog/n-ways-to-unpack-mobile-malware/

通过对抗训练学习对称和不对称隐写术

• https://arxiv.org/abs/1903.05297

数亿IoT设备的硬件/软件安全补丁

• https://arxiv.org/abs/1903.05266

SoK: 无人机时代的安全和隐私: 威胁、挑战、解决方案机制和科学差距

• https://arxiv.org/abs/1903.05155

关于智能移动物联网(M-IoT)的安全、隐私和信任的调查

• https://arxiv.org/abs/1903.05362

BenchPress: 分析Android应用程序漏洞基准测试套件

• https://arxiv.org/abs/1903.05170

Ghidra与DLL劫持

• https://liberty-shell.com/sec/2019/03/12/dll-hijacking/

利用苹果的游戏引擎进行威胁检测

• https://speakerdeck.com/patrickwardle/leveraging-apples-game-engine-to-detect-threats

从TPM中提取BitLocker密钥

• https://pulsesecurity.co.nz/articles/TPM-sniffing

[漏洞]

黑莓AtHoc平台XXE漏洞

• https://www.mindpointgroup.com/blog/pen-test/xxe-vulnerability-in-blackberry-athoc-networked-crisis-communication-platform/

1 Click to Excessive Permissions

• https://www.sentinelone.com/blog/adware-apple-google-extensions-put-users-at-risk/

tor(8.0.6) + firefox(65.0.2) RCE和沙箱逃逸0Day

• https://youtu.be/QH5EoGCd31I

Zimbra全版本最少存在1个RCE漏洞

• https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html

WordPress 5.1 由CSRF到RCE

• https://blog.ripstech.com/2019/wordpress-csrf-to-rce/

MS Sharepoint RCE漏洞详解(CVE-2019-0604)

• https://www.zerodayinitiative.com/blog/2019/3/13/cve-2019-0604-details-of-a-microsoft-sharepoint-rce-vulnerability

SiteGround Optimizer & Caldera Forms Pro 提权漏洞

• https://blog.sucuri.net/2019/03/vulnerability-disclosure-siteground-optimizer-caldera-forms.html

[恶意代码]

利用多个高危漏洞进行传播的挖矿蠕虫PsMiner

• https://blog.360totalsecurity.com/en/new-mining-worm-psminer-uses-multiple-high-risk-vulnerabilities-to-spread/

The fourth horseman: CVE-2019-0797 vulnerability

• https://securelist.com/cve-2019-0797-zero-day-vulnerability/89885/

黑客组织OrangeWorm开发的Kwampirs远控分析

• https://www.securityartwork.es/2019/03/13/orangeworm-group-kwampirs-analysis-update/

新近开售的PoS恶意软件GlitchPOS分析

• https://blog.talosintelligence.com/2019/03/glitchpos-new-pos-malware-for-sale.html

[代码/工具]

docker-blackeye: 使用Blackeye创建钓鱼网站的Docker容器

• https://github.com/vishnudxb/docker-blackeye

lpc_sniffer_tpm: ICEStick的低引脚数嗅探器 - 针对TPM芯片

• https://github.com/denandz/lpc_sniffer_tpm

powershellveryless: Powershell受限模式下绕过AMSI

• https://github.com/decoder-it/powershellveryless

GSCXScanner: iOS漏洞扫描器

• https://github.com/google/GSCXScanner

[其他]

堆管理中的Tcache bins介绍

• https://payatu.com/introduction-of-tcache-bins-in-heap-management/

20190313

[技术]

限制输入格式与XSS

• https://brutelogic.com.br/blog/xss-limited-input-formats/

Brute Forcing User IDS via CSRF To Delete all Users with CSRF attack.

• https://medium.com/p/216ccd4d832c

[CTF] Some crypto challenges: Author writeup from BSidesSF CTF

• https://blog.skullsecurity.org/2019/some-crypto-challenges-author-writeup-from-bsidessf-ctf

大规模接管公开可编辑的Github Wiki

• http://blog.shashank.co/2019/03/taking-over-publicly-editable-github.html

失落的艺术之: Shellcode编码器/解码器

• https://cybersecpolitics.blogspot.com/2019/03/the-lost-art-of-shellcode.html

动态Shellcode执行

• https://countercept.com/our-thinking/dynamic-shellcode-execution/

权力下放和智能合约简介

• https://arxiv.org/abs/1903.04806

在IoT领域, 区块链技术可以带来的安全和隐私的强化

• https://arxiv.org/abs/1903.04794

使用基于环形振荡器网络的监督机器学习技术, 进行木马检测

• https://arxiv.org/abs/1903.04677

IskiOS: 针对内核级代码重用攻击的轻量级防御

• https://arxiv.org/abs/1903.04654

沉默的Cylance: 现代EDR(终端检测与防御)解决方案的绕过

• https://www.mdsec.co.uk/2019/03/silencing-cylance-a-case-study-in-modern-edrs/

Active Directory渗透测试, Part2

• https://hausec.com/2019/03/12/penetration-testing-active-directory-part-ii/

如何发现开放的MongoDB/Elasticsearch数据库

• https://habr.com/en/post/443132/

免费版IDA与Ghidra在打补丁(patch)方面的比较

• https://youtu.be/5xdaLy9gtIY

游戏Hacking教程: 使用cheatengine追踪Unity游戏中的按键事件

• https://youtu.be/KTFmk3EiV-Q

为Ghidra编写wasm加载器

• https://m.habr.com/en/post/443318/

使用PVS-Studio对MS公开的计算器源码进行静态分析, 然后发现了漏洞

• https://m.habr.com/en/company/pvs-studio/blog/443400

Trapdoor commitments in the SwissPost e-voting shuffle proof

• https://people.eng.unimelb.edu.au/vjteague/SwissVote

[漏洞]

三星Dual Messenger沙箱逃逸与提权

• https://www.perspectiverisk.com/samsung-dual-messenger-sandbox-escape-and-privilege-escalation/

Genuitec Secure Delivery Center (SDC)本地文件包含漏洞利用

• https://www.n00py.io/2019/03/exploiting-genuitec-secure-delivery-center-sdc-version-5-4-7-local-file-inclusion/

CircuitWerkes Sicon-8客户端认证绕过漏洞详解

• https://blog.rapid7.com/2019/03/12/r7-2019-01-circuitwerkes-sicon-8-client-side-authentication-read-only-bypass-cve-2019-5616/

开源事件追踪系统StackStorm RCE漏洞(CVE-2019-9580)

• https://quitten.github.io/StackStorm/

Apache Tika命令注入漏洞利用(CVE-2018-1335)

• https://rhinosecuritylabs.com/application-security/exploiting-cve-2018-1335-apache-tika/

Cerberus FTP盲CSS导致RCE漏洞

• https://blog.secu.dk/blog/Cerberusftp/

潘多拉的盒子: Box泄露所有敏感数据的另一种新方法

• https://www.adversis.io/research/pandorasbox

CleanMyMac X的帮助服务的提权漏洞

• https://blog.talosintelligence.com/2019/03/CleanMyMacX-helper-service-remote-code-execution-vuln.html

[恶意代码]

木马Ursnif新变种, 更强的窃密功能

• https://www.cybereason.com/blog/new-ursnif-variant-turns-to-cryptocurrency-as-banks-become-more-secure

恶意代码Powload的进化: 从Fileless技术到隐写术

• https://blog.trendmicro.com/trendlabs-security-intelligence/from-fileless-techniques-to-using-steganography-examining-powloads-evolution/

针对亚洲游戏开发者的供应链攻击

• https://www.welivesecurity.com/2019/03/11/gaming-industry-scope-attackers-asia/

银行木马Emotet

• https://www.sentinelone.com/blog/inside-emotet-banking-trojan-malware-distributor/

[代码/工具]

AnchorWatch: 按固定间隔扫描子网, 发现新设备后以邮件方式通知

• https://github.com/iamrootsh3ll/AnchorWatch

Stepper: Burp插件, Repeater的进阶版

• https://github.com/CoreyD97/Stepper

letsproxy: 超简单的反向代理, 自动从Let's Encrypt获取TLS证书

• https://github.com/audibleblink/letsproxy

IoT-Home-Guard: IoT设备中的恶意行为检测

• https://github.com/arthastang/IoT-Home-Guard

[其他]

BinDiff发布V5版本

• https://www.zynamics.com/bindiff/manual/index.html

汽车Hacking工具收集

• https://github.com/jgamblin/CarHackingTools

MS发布Windows平台动态追踪框架DTrace, 可实时查看Windows用户模式/内核模式的运行状态

• https://techcommunity.microsoft.com/t5/Windows-Kernel-Internals/DTrace-on-Windows/ba-p/362902

漏洞研究相关面试问题Top30

• https://resources.infosecinstitute.com/top-30-vulnerability-researcher-interview-questions-and-answers-for-2019/

2018年诈骗和钓鱼报告

• https://securelist.com/spam-and-phishing-in-2018/89701/

20190312

[技术]

通过IDA从0开始学逆向, Part7

• https://medium.com/p/986cb6c09405

使用RSA NetWitness检测Empire C&C

• https://community.rsa.com/community/products/netwitness/blog/2019/03/11/command-and-control-powershell-empire

PE编译时间戳与取证

• http://www.hexacorn.com/blog/2019/03/11/pe-compilation-timestamps-vs-forensics/

[CTF] BSidesSF CTF author writeup: genius

• https://blog.skullsecurity.org/2019/bsidessf-ctf-author-writeup-genius

[CTF] Casino Royale VulnHub Walkthrough

• https://www.doyler.net/security-not-included/casino-royale-vulnhub

如何编写能够对抗注入攻击的安全代码

• https://medium.com/p/aad4fff058da

[CTF] Raven 1: CTF Walkthrough

• https://resources.infosecinstitute.com/raven-1-ctf-walkthrough/

编写Office宏, 伪造宏创建的进程的父进程和命令行参数

• https://blog.christophetd.fr/building-an-office-macro-to-spoof-process-parent-and-command-line/

Windows文件活动监控

• https://blog.stealthbits.com/windows-file-activity-monitoring/

使用Python编写macOS平台下的简易键盘记录器

• https://hakin9.org/writing-a-basic-keylogger-for-macos-in-python-by-andrew-scott/

[漏洞]

Wordpress插件Abandoned Cart存在XSS漏洞, 可导致Wordpress网站被接管

• https://www.wordfence.com/blog/2019/03/xss-flaw-in-abandoned-cart-plugin-leads-to-wordpress-site-takeovers/

AWS Elastic Beanstalk由SSRF到RCE

• https://medium.com/p/74cc21bfa7ee

[恶意代码]

恶意软件Emotet的进化

• https://www.sentinelone.com/blog/inside-emotet-banking-trojan-malware-distributor/

Emotet传播的新模块分析

• https://www.fortinet.com/blog/threat-research/analysis-of-the-new-modules-that-emotet-spreads.html

窃密软件Predator分析

• https://securelist.com/a-predatory-tale/89779/

[代码/工具]

calculator: MS开源Windows平台的计算器

• https://github.com/microsoft/calculator

20190311

[技术]

利用JS混淆绕过AV

• https://securityaffairs.co/wordpress/82166/malware/malware-javascript-obfuscation.html

渗透过程中利用系统自带工具进行文件传输的多种方式

• https://www.exploit-db.com/docs/english/46515-file-transfer-skills-in-the-red-team-post-penetration-test.pdf

使用Empire绕过用户权限控制

• https://www.hackingarticles.in/bypass-user-access-control-using-empire/

使用OWASP 2017测试用例进行API渗透测试

• http://blog.securelayer7.net/api-penetration-testing-with-owasp-2017-test-cases/

使用Python编写恶意代码, Part3: 窃取凭证和Cookie

• https://0x00sec.org/t/malware-writing-python-malware-part-3-stealing-credentials-and-cookies/12099

BSidesSF CTF 2019 release

• https://github.com/BSidesSF/ctf-2019-release

Reverse Engineering and Modding Mario Pinball Land (GBA)

• http://cturt.github.io/pinball.html

使用Ghidra分析Meterpreter Payload

• https://www.dshield.org/forums/diary/Analysing+meterpreter+payload+with+Ghidra/24722/

Windows 10 RS4 PatchGuard分析

• https://blog.tetrane.com/2019/Analysis-Windows-PatchGuard.html

Ghidra教程之: 破解crackme

• https://youtu.be/fTGTnrgjuGA

Ghidra快速入门

• http://hwreblog.com/projects/ghidra.html

编写一个带密码保护的反向Shell

• https://medium.com/@0x0FFB347/writing-a-password-protected-reverse-shell-linux-x64-5f4d3a28d91a

NMap技巧之: RTFM

• https://blog.zsec.uk/nmap-rtfm/

2018年初整理的一些内网渗透TIPS(Ridter)

• https://github.com/Ridter/Intranet_Penetration_Tips

鼠标劫持: 从鼠标到Shell, Part2

• https://www.jimwilbur.com/2019/03/mousejack-from-mouse-to-shell-part-2/

Tomcat exploit变种: 可访问的host-manager

• https://www.certilience.fr/2019/03/tomcat-exploit-variant-host-manager/

[CTF] Hack The Box - Ethereal

• https://0xrick.github.io/hack-the-box/ethereal/

[漏洞]

视频网站Vimeo SSRF漏洞, 可能导致代码执行

• https://medium.com/@rootxharsh_90844/vimeo-ssrf-with-code-execution-potential-68c774ba7c1e

Apache Solr RCE PoC(CVE-2019-0192)

• https://github.com/mpgn/CVE-2019-0192

两个最大的汽车警报系统存在严重的安全漏洞, 可导致汽车被盗, 影响全球范围内超过300万辆汽车

• https://www.pentestpartners.com/security-blog/gone-in-six-seconds-exploiting-car-alarms/

向谷歌地图的工程文档中注入任意文件

• https://appio.dev/vulns/google-earth-studio-vulnerability/

WebKit exploit, 在PS4 6.20上利用CVE-2018-4441获取RCE

• https://github.com/Cryptogenic/PS4-6.20-WebKit-Code-Execution-Exploit

Cantemo Portal版本3.8.4: CSS

• https://www.bishopfox.com/news/2019/03/cantemo-portal-version-3-8-4-cross-site-scripting/

[代码/工具]

[Gist] 使用Frida从Android应用程序自动提取KeyStore对象和相对密码

• https://gist.github.com/ceres-c/cb3b69e53713d5ad9cf6aac9b8e895d2

wordlistctl: 从网站和种子Peer中获取、安装并搜索Wordlist

• https://github.com/BlackArch/wordlistctl

SharPyShell: 用于C# Web App的WebShell, 混淆版

• https://github.com/antonioCoco/SharPyShell

webtech: 识别网站使用的技术

• https://github.com/ShielderSec/webtech [介绍] - https://www.shielder.it/blog/webtech-identify-technologies-used-on-websites/

TrustMeAlready: Android系统范围内禁用SSL Pinning和SSL验证

• https://github.com/ViRb3/TrustMeAlready

bn-genesis: BinaryNinja插件, 用于辅助SEGA Genesis ROM hacking

• https://github.com/zznop/bn-genesis

EdXposed: A Riru module trying to provide a ART hooking framework (mainly for Android Pie) which delivers consistent APIs with the OG Xposed, leveraging YAHFA hooking framework

• https://github.com/ElderDrivers/EdXposed

ghidra-mep: 用于Ghidra的Toshiba MeP处理器模块

• https://github.com/xyzz/ghidra-mep

automactc: 自动Mac取证分流收集器

• https://github.com/CrowdStrike/automactc [介绍] - https://www.crowdstrike.com/blog/automating-mac-forensic-triage/

AutoRDPwn: 对Windows自动执行Shadow攻击

• https://github.com/JoelGMSec/AutoRDPwn

rootOS: 尝试利用多个CVE获取Root/Sudo权限(macOS)

• https://github.com/thehappydinoa/rootOS

catnip: 简易自动化渗透测试工具

• https://github.com/baguswiratmaadi/catnip

[其他]

sec4dev 2019议题列表

• https://sec4dev.io/2019

20190308

[技术]

macOS平台利用iTerm实现驻留

• https://blacksunhackers.club/2019/03/macOS-persistence-via-iterm/

AppLocker与PowerShell是如何紧密合作的

• https://p0w3rsh3ll.wordpress.com/2019/03/07/applocker-and-powershell-how-do-they-tightly-work-together/

浏览器的自动填充技术对Web安全有哪些影响

• https://www.netsparker.com/blog/web-security/impact-autocomplete-feature-web-security/

如何创建有影响力的网络钓鱼电子邮件: 研究与时机

• https://blog.rapid7.com/2019/03/07/this-one-time-on-a-pen-test-the-power-of-a-well-researched-and-well-timed-phishing-email/

[CTF] Hack the Box (HTB) Machines Walkthrough Series — Mirai

• https://resources.infosecinstitute.com/hack-the-box-htb-machines-walkthrough-series-mirai/

通过IDA从零开始学逆向, Part6

• https://medium.com/p/ec232b87a091

Windows进程注入: Print Spooler

• https://modexp.wordpress.com/2019/03/07/process-injection-print-spooler/

使用机器学习技术检测高级的恶意软件

• https://arxiv.org/abs/1903.02966

DIALOG: 数字取证知识的建模、分析和重用的框架

• https://arxiv.org/abs/1903.03061

Android Messaging: A Few Bugs Short of a Chain

• https://googleprojectzero.blogspot.com/2019/03/android-messaging-few-bugs-short-of.html

软件逆向平台Ghidra快速查看, 以及与IDA的简单对比

• http://0xeb.net/2019/03/ghidra-a-quick-overview/

Android"附近连接"API的逆向/分析与攻击

• https://francozappa.github.io/publication/rearby/

容器逃逸实战

• https://capsule8.com/blog/practical-container-escape-exercise/

使用传统的备份对抗勒索软件

• https://eforensicsmag.com/is-your-backup-a-real-backup-part-ii-combating-ransomware-with-traditional-backups-by-jason-thomas/

[漏洞]

在Advantech WebAccess中滥用不正当的访问控制实现提权(ZDI-19-257)

• https://www.zerodayinitiative.com/blog/2019/3/6/webaccess-uncontrol

损坏的GIF图片会触发Facebook Messenger服务器随机泄漏内存数据

• https://www.vulnano.com/2019/03/facebook-messenger-server-random-memory.html

Final Safari Exploit Challenge(Engine for Neophytes) write-up

• https://github.com/vngkv123/aSiagaming/tree/master/Safari-JSC-RealWorldCTF

Mac平台下Pixar Renderman的多个漏洞, 可用于实现提权

• https://blog.talosintelligence.com/2019/03/vuln-spotlight-pixar-renderman-local-2019.html

[恶意代码]

利用Github托管恶意代码, 利用Slack通信的恶意软件SLUG分析

• https://blog.trendmicro.com/trendlabs-security-intelligence/new-slub-backdoor-uses-github-communicates-via-slack/

恶意软件Ursnif是如何躲避检测的

• https://www.bromium.com/how-ursnif-evades-detection/

[代码/工具]

ghidra_scripts: ghidra脚本

• https://github.com/ghidraninja/ghidra_scripts

VulDeePecker: 基于深度学习的漏洞检测系统

• https://github.com/CGCL-codes/VulDeePecker

FDsploit: 文件包含/路径回溯漏洞的挖掘/枚举和利用

• https://github.com/chrispetrou/FDsploit

automactc: 自动化Mac取证分类

• https://github.com/crowdstrike/automactc [介绍] - https://www.crowdstrike.com/blog/automating-mac-forensic-triage/

[其他]

ghidra在线教程

• http://ghidra.re/online-courses/

Tezos区块链和智能合约概述

• https://www.apriorit.com/dev-blog/602-tezos-blockchain-smart-contract-overview

2018年金融业网络安全威胁报告

• https://securelist.com/financial-cyberthreats-in-2018/89788/

使用VMWare调试Linux内核

• https://xakcop.com/post/vmw-kernel-debugging/

20190307

[技术]

Windows 进程/线程Token与Pass The Hash

• https://threat.tevora.com/windows-process-and-thread-tokens-primer/

我是如何黑掉小米MiBand 2健身追踪器的

• https://hakin9.org/how-i-hacked-my-xiaomi-miband-2-fitness-tracker%e2%80%8a-%e2%80%8aa-step-by-step-linux-guide-by-andrey-nikishaev/

Rust库Curv代码安全性审计报告

• https://cybermashup.files.wordpress.com/2019/03/kzen-curv-audit_20190301.pdf

C#编写的简易Windows代码注入示例

• https://www.andreafortuna.org/programming/a-simple-windows-code-injection-example-written-in-c/

如何使用Canary Tokens保护文件

• https://resources.infosecinstitute.com/how-to-protect-files-with-canary-tokens/

使用Wireshark查看- http协议

• https://devcentral.f5.com/articles/- http-2-protocol-in-plain-english-using-wireshark-33639

MachineAccountQuota有时是有用的: 利用Active Directory最奇怪的设置之一

• https://blog.netspi.com/machineaccountquota-is-useful-sometimes/

从垃圾箱中恢复Active Directory对象

• https://blog.stealthbits.com/active-directory-object-recovery-recycle-bin/

威胁狩猎#26: 远程Windows服务创建/侦查

• https://blog.menasec.net/2019/03/threat-hunting-26-remote-windows.html

渗透时使用Empire隐藏IP地址

• https://www.hackingarticles.in/hiding-ip-during-pentest-using-powershell-empire-- http_hop/

ARM堆利用教程, Part1: 理解glibc的堆实现

• https://azeria-labs.com/heap-exploitation-part-1-understanding-the-glibc-heap-implementation/

数字取证Tips&Tricks: 如何在内存转储中查找活跃的VPN连接

• https://habr.com/en/post/442590/

Captive Portals完全指南

• https://rootsh3ll.com/captive-portal-guide/

从安全视角看待由4G到5G的演变

• https://www.rsaconference.com/writable/presentations/file_upload/idy-f01-4g-to-5g-evolution-in-depth-security-perspective.pdf

Red Teaming中突破并评估物理环境的方式Top5

• https://medium.com/@adam.toscher/top-5-ways-the-red-team-breached-and-assessed-the-physical-environment-fa567695b354

Hacking WebSockets

• https://www.vdalabs.com/2019/03/05/hacking-web-sockets-all-web-pentest-tools-welcomed/

[Gitlab] x86/x64汇编介绍

• https://gitlab.com/mcmfb/intro_x86-64

Hacking安全摄像头VStarCam. Part1

• http://blog.0x42424242.in/2019/03/vstarcam-investigational-security.html

ARIS: 实时物联网系统的身份验证

• https://arxiv.org/abs/1903.02142

基于贝叶斯防御图的自主车辆风险评估

• https://arxiv.org/abs/1903.02034

[漏洞]

SMoTherSpectre PoC: 使用端口争用作为side channel(而不是缓存)来泄漏寄存器/内存数据的瞬态执行攻击

• https://github.com/HexHive/SMoTherSpectre
• http://nebelwelt.net/blog/20190306-SMoTherSpectre.html

Windows Server部署服务中RCE漏洞的挖掘(CVE-2018-8476)

• https://research.checkpoint.com/pxe-dust-finding-a-vulnerability-in-windows-servers-deployment-services/

家庭中启用UPnP的联网设备, 以及未修补的已知漏洞

• https://blog.trendmicro.com/trendlabs-security-intelligence/upnp-enabled-connected-devices-in-home-unpatched-known-vulnerabilities/

[恶意代码]

Pistacchietto行动: 过去几周疑似意大利黑客发起的一波攻击行动

• https://securityaffairs.co/wordpress/82066/cyber-crime/op-pistacchietto-hacking-campaign.html

Whitefly: Espionage Group has Singapore in Its Sights

• https://www.symantec.com/blogs/threat-intelligence/whitefly-espionage-singapore

黑客在攻击中使用跳板机管理工具Termites, 作为实现驻留和远控的工具

• https://www.alienvault.com/blogs/labs-research/internet-of-termites

New Stealth Worker Campaign Creates a Multi-platform Army of Brute Forcers

• https://www.fortinet.com/blog/threat-research/new-stealth-worker-campaign-creates-a-multi-platform-army-of-bru.html

年初发现的使用torrent tracker传播的恶意代码分析

• https://securelist.com/piratebay-malware/89740/

Troldesh勒索软件简要分析

• https://blog.malwarebytes.com/threat-analysis/2019/03/spotlight-troldesh-ransomware-aka-shade/

移动平台伪装成挖矿软件的几个App

• https://www.fortinet.com/blog/threat-research/a-mobile-bitcoin-miner--really-.html

[代码/工具]

vagabondworkstation: Linux发行版, 户能够拥有多个零交叉的身份, 执行匿名操作运行匿名服务等

• https://github.com/vagabondworkstation/vagabondworkstation/releases/tag/0.1.2 [介绍] - http://go-beyond.org/post/announcing-vagabondworkstation/

legion: 易于使用、强可扩展