villain / sec-daily-2020

2020年发布到阿尔法实验室微信公众号的所有安全资讯汇总

欢迎关注阿尔法实验室微信公众号

20201231

[漏洞]

2020年增加的10个最严重的CVE

• https://blog.detectify.com/2020/12/30/top-10-critical-cves-added-in-2020/

Chromium RawClipboardHostImpl中的UAF漏洞

• https://bugs.chromium.org/p/chromium/issues/detail?id=1101509

[工具]

Sarenka：OSINT工具，将来自shodan、censys等服务的数据集中在一处，帮助您获得和了解攻击面

• https://github.com/pawlaczyk/sarenka

SyscallsInject：从磁盘上的ntdll.dll获取Syscall Stub，向远程进程注入shellcode

• https://github.com/ajpc500/BOFs/tree/main/SyscallsInject

[技术]

Apple Type-C端口控制器的秘密：公开基于USB-PD的消息传递协议AppleVDM，Part1

• https://blog.t8012.dev/ace-part-1/

Writeup for Flare-On 7 challenge #8 - "Aardvark"

• https://github.com/LeoCodes21/ctf-writeups/tree/main/Flare-On%202020/08-aardvark

使用Ghidra、x64dbg和Python逆向游戏

• https://www.youtube.com/watch?v=cwBoUuy4nGc

针对PHP环境的攻击

• https://srcincite.io/assets/out-of-hand-attacks-against-php-environments.pdf

20201230

[漏洞]

Google VRP：劫持谷歌文档截图

• https://blog.geekycat.in/google-vrp-hijacking-your-screenshots/

漏洞赏金中发现的HTML注入漏洞

• https://medium.com/bugbountywriteup/a-html-injection-worth-600-dollars-5f065be0ab49

[恶意代码]

一种用Golang语言编写的在Windows和Linux服务器上投递XMRig Miner的蠕虫

• https://www.intezer.com/blog/research/new-golang-worm-drops-xmrig-miner-on-servers/

针对南美用户的Revenge RAT

• https://www.uptycs.com/blog/revenge-rat-targeting-users-in-south-america

永远不要将勒索软件样本上传到互联网

• https://0xc0decafe.com/2020/12/28/never-upload-ransomware-samples-to-the-internet/

恶意代码Yara规则收集

• https://github.com/StefanKelm/yara-rules

[技术]

从SUNBURST DNS Beacon中提取安全产品

• https://www.netresec.com/?page=Blog&month=2020-12&post=Extracting-Security-Products-from-SUNBURST-DNS-Beacons

探索Nmap，Part1：自动化诱饵扫描和源欺骗的过程

• https://redcodelabs.io/blog/exploring_nmap_1.html

使用CIS强化Docker，Part4：Docker Daemon配置文件

• https://blog.jtnydv.com/harden-docker-with-cis-p4-docker-daemon-configuration-files/

使用QEMU-USER在X86上运行ARM 二进制文件

• https://azeria-labs.com/arm-on-x86-qemu-user/

Burp Suite for Pentester: Burp Sequencer

• https://www.hackingarticles.in/burp-suite-for-pentester-burp-sequencer/

介绍如何在Mac系统上利用虚拟化框架来启动小型VM

• https://blog.xpnsec.com/bring-your-own-vm-mac-edition/

深入研究站点隔离，Part2

• https://microsoftedge.github.io/edgevr/posts/deep-dive-into-site-isolation-part-2/

20201229

[漏洞]

SolarWinds Orion本地文件披露漏洞PoC（CVE-2020-10148）

• https://gist.github.com/0xsha/75616ef6f24067c4fb5b320c5dfa4965

Zyxel产品中未记录的用户帐户（CVE-2020-29583）

• https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.html

披露了大约8个零日漏洞，并提出一种绕过常见防病毒软件自我保护和CVE-2020-16902补丁绕过的新颖方法

• https://halove23.blogspot.com/2020/12/oh-so-you-have-antivirus-nameevery-bug.html

SAP BusinessObjects 商业智能平台（Web服务）CVE-2020-6308 POC

• https://github.com/InitRoot/CVE-2020-6308-PoC

[工具]

PcapMonkey：提供使用最新版本的Suricata和Zeek分析pcap的简便方法

• https://github.com/certego/PcapMonkey
• https://www.certego.net/en/news/introducing-pcapmonkey/

Vulnerable-Kext：针对iOS/macOS的带漏洞的kext，用于玩耍和学习iOS/macOS内核漏洞利用

• https://github.com/ant4g0nist/Vulnerable-Kext

2020年Hacking工具Top 20

• https://www.kitploit.com/2020/12/top-20-most-popular-hacking-tools-in.html

Wynis：审核Win10和Win Server2016的最佳实践

• https://github.com/Sneakysecdoggo/Wynis

[恶意代码]

一种新的基于宏的恶意软件

• https://twitter.com/Arkbird_SOLG/status/1343001491121065984

[技术]

破解任天堂游戏与手表

• https://www.youtube.com/watch?v=rLT9c4Miesw

作者介绍自己的12年渗透测试之旅

• https://blog.scrt.ch/2020/12/28/state-of-pentesting-2020/

讨论如何使用宏从Excel与Outlook进行交互，发布一个PoC，将Outlook转换为键盘记录程序

• https://adepts.of0x.cc/vba-outlook/

逆向Go二进制文件，Part1

• https://x0r19x91.gitlab.io/post/reversing-go-part-1/

使用Radamsa对一个简单的C程序进行模糊cesium

• https://www.youtube.com/watch?v=1FRsXVNpynQ

使用Postman和Newman查找在线格式化工具中保存的有用数据

• https://medium.com/bugbountywriteup/finding-data-leaks-in-online-formatters-404503b9fcb0

使用Microsoft 365 Defender来识别，调查和响应Solorigate攻击

• https://www.microsoft.com/security/blog/2020/12/28/using-microsoft-365-defender-to-coordinate-protection-against-solorigate/

Having fun with ANSI codes and x64 Linux Assembly

• https://www.guitmz.com/having-fun-with-ansi-codes-and-x64-linux-assembly/

Burp Suite For Pentester: HackBar

• https://www.hackingarticles.in/burp-suite-for-pentester-hackbar/

20201228

[漏洞]

SolarWinds Orion API身份验证绕过允许远程执行命令

• https://kb.cert.org/vuls/id/843464

Joomla ACL安全漏洞CVE-2020-35616

• https://blog.securelayer7.net/latest-joomla-exploit-cve-2020-35616-acl-security-vulnerabilities/

[恶意代码]

分析针对Active Directory环境的分布式挖矿蠕虫

• https://www.certego.net/en/news/handling-a-destributed-cryptominer-ad-worm/

攻击者使用伪造的亚马逊礼品卡骗局来投递Dridex银行木马

• https://www.cybereason.com/blog/amazon-gift-card-offer-serves-up-dridex-banking-trojan

[工具]

Rebuilderd：监视linux发行版的软件包存储库，并使用诸如archlinux-repro之类的rebuilder后端来验证所提供的二进制软件包是否可以从给定的源代码中复制出来

• https://github.com/kpcyrd/rebuilderd

Sparrow：在Azure / m365环境中检测可能的受感染帐户和应用程序

• https://github.com/cisagov/Sparrow

proxify：针对代理的瑞士军刀工具，可随时随地捕获、操作和重放- http / - httpS流量

• https://github.com/projectdiscovery/proxify

teatime：用于区块链节点的RPC攻击框架

• https://github.com/dmuhs/teatime

social-analyzer：PI和Web应用程序，用于在+300个社交媒体网站上分析和查找个人资料

• https://github.com/qeeqbox/social-analyzer

sub404：检查子域接管漏洞的python工具

• https://github.com/r3curs1v3-pr0xy/sub404

php-jpeg-injector：将php有效负载注入jpeg图像

• https://github.com/dlegs/php-jpeg-injector

aura：大规模的Python源代码审核和静态分析

• https://github.com/SourceCode-AI/aura

vulmap：Web漏洞扫描和验证工具，可对Web容器、Web服务器、Web中间件以及CMS等Web程序进行漏洞扫描，并且具备漏洞利用功能

• https://github.com/zhzyker/vulmap

exploit-workshop：探讨Node.js和Java应用程序中的各种漏洞

• https://github.com/snyk/exploit-workshop

[技术]

通过重播TLS Server Hello伪造JARM签名

• https://grimminck.medium.com/spoofing-jarm-signatures-i-am-the-cobalt-strike-server-now-a27bd549fc6b

对SMTP进行渗透测试

• https://luemmelsec.github.io/Pentest-Everything-SMTP/

通过反射绕过AMSI

• https://www.redteam.cafe/red-team/powershell/using-reflection-for-amsi-bypass

Active Directory的Kerberos和NTLM身份验证方法

• https://gupta-bless.medium.com/authentication-on-active-directory-2b7e5985cb4c

逆向具有四相逻辑的早期计算器芯片

• http://www.righto.com/2020/12/reverse-engineering-early-calculator.html

逆向BioNTech / Pfizer SARS-CoV-2疫苗的源代码

• https://berthub.eu/articles/posts/reverse-engineering-source-code-of-the-biontech-pfizer-vaccine/

Android渗透测试工具Drozer

• https://www.hackingarticles.in/android-penetration-testing-drozer/

20201225

[漏洞]

WSUS本地提权漏洞（CVE-2020-1013）的微补丁

• https://blog.0patch.com/2020/12/micropatch-is-available-for-wsus.html

[工具]

Chameleon：可定制的蜜罐，用于监视网络流量，漫游器活动和用户名\密码凭据

• https://github.com/qeeqbox/chameleon

censys-python：用于Censys搜索引擎 API包装器

• https://github.com/censys/censys-python

clairvoyance：在希尔伯特曲线上可视化Windows进程的虚拟地址空间

• https://github.com/0vercl0k/clairvoyance

CRT：识别并帮助缓解Azure Active Directory中的风险

• https://github.com/CrowdStrike/CRT
• https://www.crowdstrike.com/blog/crowdstrike-launches-free-tool-to-identify-and-help-mitigate-risks-in-azure-active-directory/

ImprosecPasswordAuditor：Active Directory环境密码审计工具

• https://github.com/improsec/ImprosecPasswordAuditor

[恶意代码]

SUNBURST后门其他技术细节

• https://www.fireeye.com/blog/threat-research/2020/12/sunburst-additional-technical-details.html

Cybereason vs. Clop Ransomware

• https://www.cybereason.com/blog/cybereason-vs.-clop-ransomware

[技术]

高级XXE漏洞利用

• https://gosecure.github.io/xxe-workshop/#0

漏洞赏金Tips: 10

• https://www.infosecmatter.com/bug-bounty-tips-10-dec-24/

解释UEFI运行时驱动的概念，它们如何与OS交互以及尝试提取它们

• https://standa-note.blogspot.com/2020/12/experiment-in-extracting-runtime.html
• https://github.com/tandasat/kraft_dinner/tree/main/kraft_dinner

第三方API：如何防止枚举攻击

• https://threatpost.com/third-party-apis-enumeration-attacks/162589/

20201224

[漏洞]

在团队云服务器（NoMagic，3DS）中发现漏洞, 政府/企业使用该漏洞设计火箭、导弹和卫星。

• https://sick.codes/finding-a-vulnerability-in-teamwork-cloud-server-nomagic-3ds-which-is-used-by-gov-enterprise-to-design-rockets-missiles-and-satellites/

V8堆溢出漏洞利用

• https://medium.com/bugbountywriteup/novel-points-exploit-the-heap-overflow-bug-ctf-2019-oob-v8-97530977e5bd

Facebook漏洞赏金：查找私人活动的隐藏成员

• https://medium.com/bugbountywriteup/facebook-bug-bounty-finding-the-hidden-members-of-the-private-events-977dc1784ff9

[工具]

Kenzer：自动化Web资产枚举、扫描工具

• https://github.com/ARPSyndicate/kenzer

kubestrike：针对Kubernetes的快速审计工具

• https://github.com/vchinnipilli/kubestrike

Grawler：用PHP编写的工具，带有网络界面，可自动执行使用Google dork的任务，抓取结果，并将其存储在文件中

• https://github.com/A3h1nt/Grawler

gdb_scripts：ARM64 Android/Linux内核调试脚本

• https://github.com/duasynt/gdb_scripts

[恶意代码]

展示Lamer Exterminator病毒在真实的Amiga 500上的行为方式，然后通过一些Python代码规避其加密例程

• https://www.youtube.com/watch?v=s7K98Vuw5aA

经过将近两个月的休整之后，Emotet僵尸网络重新活跃并更新的有效负载，每天攻击目标达到100,000个

• https://threatpost.com/emotet-returns-100k-mailboxes/162584/

总结分析人员需要了解的有关Cobalt Strike的知识，以便在事件发生时快速进行识别和分析

• https://www.randhome.io/blog/2020/12/20/analyzing-cobalt-strike-for-fun-and-profit/

APT组织Lazarus袭击新冠有关的制药公司、政府组织

• https://securelist.com/lazarus-covets-covid-19-related-intelligence/99906/

[技术]

使用Falco检测Kubernetes漏洞CVE-2020-8554

• https://sysdig.com/blog/detect-cve-2020-8554-using-falco/

Burp Suite for Pentester: Burp Collaborator

• https://www.hackingarticles.in/burp-suite-for-pentester-burp-collaborator/

供应链污染：应对CTF挑战中的每周1600万下载的npm软件包漏洞

• https://spaceraccoon.dev/supply-chain-pollution-hunting-a-16-million-download-week-npm-package

手机的物理内存安全

• https://corellium.com/blog/mobile-physical-memory-security

检测二进制文件中的RC4

• https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries/

20201223

[资讯]

IT巨头VMware和Cisco透露，它们受到了最近披露的SolarWinds供应链攻击的影响

• https://securityaffairs.co/wordpress/112535/security/solarwinds-vmware-cisco.html

[漏洞]

Webmin中的任意命令执行漏洞（CVE-2020-35606）

• https://www.pentest.com.tr/exploits/Webmin-1962-PU-Escape-Bypass-Remote-Command-Execution.html

介绍各种物联网门铃, 发现的一些主要安全问题，以及它们对现实生活的影响

• https://research.nccgroup.com/2020/12/18/domestic-iot-nightmares-smart-doorbells/

Apple macOS 6LowPAN内核漏洞（CVE-2020-9967）

• https://alexplaskett.github.io/CVE-2020-9967/

介绍3个FireFox漏洞

• https://nishimunea.medium.com/%E4%BB%8A%E5%B9%B4%E8%A6%8B%E3%81%A4%E3%81%91%E3%81%9Ffirefox%E3%81%AE%E8%84%86%E5%BC%B1%E6%80%A7-2020%E5%B9%B4-a3e7f1ef33ad

[工具]

SharpMapExec：C#版本的CrackMapExec

• https://github.com/cube0x0/SharpMapExec

SharpZipRunner：通过加密的zip执行独立于位置的shellcode

• https://github.com/jfmaes/SharpZipRunner

[恶意代码]

SUNBURST后门，第三部分：DGA和安全软件

• https://blog.prevasio.com/2020/12/sunburst-backdoor-part-iii-dga-security.html

[技术]

逆向游戏Zelda的命中检测

• https://www.youtube.com/watch?v=FBk-QkzMeIk

脱壳FlawedAmmyy恶意软件

• https://www.youtube.com/watch?v=D1-O19AwW8U

逆向游戏《帝国时代》，打补丁实现作弊

• https://www.youtube.com/watch?v=BhVvbJyJ7dI

模板注入实战

• https://gosecure.github.io/template-injection-workshop/#0

讨论移动物理内存安全

• https://corellium.com/blog/mobile-physical-memory-security

Google地图中的SSTI

• https://www.ehpus.com/post/ssti-in-google-maps

近期Kubernetes中间人攻击漏洞的汇总（CVE-2020-8554）

• https://unit42.paloaltonetworks.com/cve-2020-8554/

从纯iOS安全研究人员的角度出发，引导您完成从错误描述到在Samsung Galaxy S10上进行内核读取/写入/执行的整个过程

• https://googleprojectzero.blogspot.com/2020/12/an-ios-hacker-tries-android.html

以合理的价格使用公开可用的工具研究了对可信平台模块（TPM）的SPI接口的嗅探攻击

• https://labs.f-secure.com/blog/sniff-there-leaks-my-bitlocker-key/

静态分析101

• https://sandboxescaper.blogspot.com/2020/12/static-analysis-101.html

20201222

[漏洞]

FreeBSD中利用”chroot监狱”ftpchroot提权为Root（CVE-2020-7468）

• https://www.zerodayinitiative.com/blog/2020/12/21/cve-2020-7468-turning-imprisonment-to-advantage-in-the-freebsd-ftpd-chroot-jail

详细介绍关闭并解决Google问题编号134447889和155544987所经历的过程

• https://security.love/blog/gcp/2020/11/22/lateral-movement-and-privesc-in-GCP.html

在RAUC嵌入式固件更新框架中发现了重大漏洞(CVE-2020-25860)

• https://www.vdoo.com/blog/cve-2020-25860-significant-vulnerability-discovered-rauc-embedded-firmware-update-framework

Facebook Business Suite应用程序漏洞可导致在Instagram上查看任何人的私人电子邮件和生日

• https://medium.com/nassec-cybersecurity-writeups/this-is-how-i-was-able-to-view-anyones-private-email-and-birthday-on-instagram-1469f44b842b

[恶意代码]

政府工作人员使用NSO Group的Pegasus间谍软件入侵了半岛电视台的36部属于记者，制片人，主持人和执行人员的个人电话

• https://citizenlab.ca/2020/12/the-great-ipwn-journalists-hacked-with-suspected-nso-group-imessage-zero-click-exploit/

在SolarWinds网络攻击分析中发现了新的SUPERNOVA后门

• https://unit42.paloaltonetworks.com/solarstorm-supernova/

[工具]

Bbht：Bash脚本，自动安装一些可用于侦察、漏洞利用的工具

• https://github.com/0xApt/awesome-bbht

pongoOS-QEMU：可以在QEMU上运行的PongoOS

• https://github.com/citruz/pongoOS-QEMU

[技术]

自动哈希验证：一种提高代码签名安全性的方法

• https://garantir.io/automated-hash-validation/

使用工具对Terraform代码进行静态分析，以便在云安全问题和配置错误造成实际安全风险之前就可以识别它们

• https://blog.christophetd.fr/shifting-cloud-security-left-scanning-infrastructure-as-code-for-security-issues/

理解Active Directory

• https://gupta-bless.medium.com/understanding-active-directory-e53965fed24

OWASP TimeGap Theory Handbook

• https://t.co/pDS0SFDVP2?amp=1

分块- http传输编码

• https://swende.se/blog/- httpChunked.html

Rust和Panda的全系统仿真和分析

• https://panda-re.mit.edu/blog/panda-rs/

hxp CTF 2020 pfoten

• https://mem2019.github.io/jekyll/update/2020/12/21/hxp2020-pfoten.html

利用一个Binder中的单一指令竞赛条件

• https://blog.longterm.io/cve-2020-0423.html

.NET程序集的故事，Cobalt Strike大小限制和反射

• https://redteamer.tips/a-tale-of-net-assemblies-cobalt-strike-size-constraints-and-reflection/

20201221

[工具]

Hexxed：十六进制编辑器

• https://github.com/meme/hexxed

python-websocket-proxy：拦截Python中的WebSocket通信

• https://github.com/pollev/python-websocket-proxy

GRecon：自动化Google Dorking过程

• https://github.com/adnane-X-tebbaa/GRecon

Bheem：bash脚本集合，可迭代运行以执行各种工具，并以有组织的方式对过程进行检查和存储输出

• https://github.com/harsh-bothra/Bheem

fawkes：搜索易受SQL注入攻击的目标

• https://github.com/0xdutra/fawkes

[恶意代码]

恶意Excel 4.0宏分析

• https://www.goggleheadedhacker.com/blog/post/21

分析Solorigate：被篡改的DLL文件如何引发了复杂的网络攻击

• https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/

US-CERT发布的APT组织使用SolarWinds Orion平台工具政府机构、关键基础设施和私营部门组织的警告

• https://us-cert.cisa.gov/ncas/alerts/aa20-352a

Sunburst: connecting the dots in the DNS requests

• https://securelist.com/sunburst-connecting-the-dots-in-the-dns-requests/99862/

[技术]

PineCone BL602 RISC-V评估板快速浏览

• https://lupyuen.github.io/articles/pinecone#reverse-engineer-the-bluetooth-le-and-wifi-drivers

构建Ghidra调试器分支的代码

• https://www.youtube.com/watch?v=RDmqfjM7ZBo

检测被挂钩的系统调用

• https://www.ired.team/offensive-security/defense-evasion/detecting-hooked-syscall-functions

危险的自编译恶意软件

• https://seberry.medium.com/the-danger-of-self-compiling-malware-741807817106

绕过Windows SmartScreen

• https://www.gironsec.com/blog/2020/12/bypassing-windows-smartscreen/

逆向第一个MOS计算器中的时钟芯片

• http://www.righto.com/2020/12/reverse-engineering-clock-chip-in-first.html

渗透测试者与漏洞赏金猎人的区别

• https://www.infosecmatter.com/become-a-penetration-tester-vs-bug-bounty-hunter/

从Linux中转储LAPS密码

• https://www.n00py.io/2020/12/dumping-laps-passwords-from-linux/

Ghidra调试器初探

• https://wrongbaud.github.io/posts/ghidra-debugger/

HackTheBox - Laser

• https://www.youtube.com/watch?v=vD3jSJlc0ro

中间人攻击清单

• https://github.com/Sab0tag3d/MITM-cheatsheet

20201218

[漏洞]

Epic Games P2P多人游戏服务的漏洞

• https://billdemirkapi.me/insecure-by-design-epic-games-p2p-multiplayer-services/

OAuth 2.0认证漏洞

• https://portswigger.net/web-security/oauth

趋势科技InterScan网页全虚拟设备(IWSVA)的多个漏洞

• https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-trend-micro-interscan-web-security-virtual-appliance/

Bouncy Castle的OpenBSDBcrypt类中发现的身份验证绕过漏洞，允许攻击者绕过密码检查（CVE-2020-28052）

• https://www.synopsys.com/blogs/software-security/cve-2020-28052-bouncy-castle/

GNU Readline中基于堆的缓冲区溢出的根本原因分析

• https://insinuator.net/2020/12/root-cause-analysis-of-a-heap-based-buffer-overflow-in-gnu-readline/

Android Studio中的RCE漏洞

• https://www.youtube.com/watch?v=hAPkSGxh9H0

开源CMS Typo3的RCE漏洞

• https://www.synacktiv.com/publications/typo3-leak-to-remote-code-execution.html

BIG-IP APM 漏洞CVE-2020-27716

• https://support.f5.com/csp/article/K51574311

[工具]

逆向框架Ghidra发布了调试器

• https://github.com/NationalSecurityAgency/ghidra/tree/debugger

Nimplant：用Nim编写的跨平台植入物

• https://github.com/MythicAgents/Nimplant

WhiteChocolateMacademiaNut：与基于Chromium的浏览器的调试端口进行交互，以查看打开的标签页，已安装的扩展程序和Cookie

• https://github.com/slyd0g/WhiteChocolateMacademiaNut

rpc2socks：后渗透工具，使用可扩展的自定义RPC协议在Windows主机上启用SOCKS隧道

• https://github.com/lexfo/rpc2socks

lumen：私有的Lumina服务器

• https://github.com/naim94a/lumen

Ransomulator：BloodHound数据库的勒索模拟器，可用于衡量网络对勒索病毒感染的恢复能力，并确定网络中的“弱链接”

• https://github.com/zeronetworks/BloodHound-Tools/tree/main/Ransomulator

SunBurst_DGA_Decode：SunBurst DGA解码脚本

• https://github.com/RedDrip7/SunBurst_DGA_Decode

[恶意代码]

Increase In Attack: SocGholish

• https://www.menlosecurity.com/blog/increase-in-attack-socgholish

SignSight行动：对东南亚认证机构的供应链攻击

• https://www.welivesecurity.com/2020/12/17/operation-signsight-supply-chain-attack-southeast-asia/

[技术]

Windows恶意代码中的API Hashing

• https://www.ired.team/offensive-security/defense-evasion/windows-api-hashing-in-malware

使用Python自动化盲SQL注入

• https://bad-jubies.github.io/Blind-SQLi-1/

RFID邻近克隆攻击

• https://www.blackhillsinfosec.com/rfid-proximity-cloning-attacks/

通过Chromium的远程调试器端口转储Cookie

• https://posts.specterops.io/hands-in-the-cookie-jar-dumping-cookies-with-chromiums-remote-debugger-port-34c4f468844e

通过UART访问和转储固件

• https://www.cyberark.com/resources/threat-research-blog/accessing-and-dumping-firmware-through-uart

使用Objection框架执行Android Hooking核SSL Pinning

• https://www.hackingarticles.in/android-hooking-and-sslpinning-using-objection-framework/

查找和利用- http请求走私

• https://zonduu.me/posts/- http-smuggling-writeup

使用IDA Pro进行位置独立代码分析

• https://www.youtube.com/watch?v=FNFZjdPlHc8

20201217

[漏洞]

一个影响SAP HANA实施SAML标准的特定漏洞，此漏洞可能使具有身份验证访问权限的攻击者诱使SAP HANA实例以其他用户身份进行身份验证

• https://www.secureauth.com/blog/secureauth-uncovers-saml-validation-weakness-in-sap-hana/

HPE披露了其专有的适用于Windows和Linux的HPE Systems Insight Manager（SIM）软件的最新版本中的0Day漏洞

• https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04068en_us

[工具]

social-analyzer：用于在+300个社交媒体网站上分析和查找个人资料的API。

• https://github.com/qeeqbox/social-analyzer

APKLab：内置于VSCode中的终极Android逆向体验

• https://github.com/Surendrajat/APKLab

SymlinkProtect：Windows文件系统minifilter驱动，用于阻止符号链接攻击

• https://github.com/sgabe/SymlinkProtect

[恶意代码]

勒索软件运营商将商用工具SystemBC用作现成的RAT与Tor后门

• https://news.sophos.com/en-us/2020/12/16/systembc/

使用移动设备仿真器的基础结构来进行大规模欺诈行为的恶意活动

• https://securityintelligence.com/posts/mobile-emulator-fraud-robs-banks-of-10m-in-days/

RubyGems从开源软件存储库中删除了2个包含恶意代码的gem

• https://blog.sonatype.com/rubygems-laced-with-bitcoin-stealing-malware

SolarWinds Orion软件构建和代码签名基础结构受到破坏，Orion源代码已被植入恶意后门

• https://blog.reversinglabs.com/blog/sunburst-the-next-level-of-stealth

来自AridViper的新型信息窃取木马PyMICROPSIA

• https://unit42.paloaltonetworks.com/pymicropsia/

检测到的矿工蠕虫Gitpaste-12的新一波攻击

• https://blogs.juniper.net/en-us/threat-research/everything-but-the-kitchen-sink-more-attacks-from-the-gitpaste-12-worm

[技术]

Linux 5.10中的静态调用

• https://blog.yossarian.net/2020/12/16/Static-calls-in-Linux-5-10

Risk8s业务：Kubernetes集群的风险分析

• https://tldrsec.com/guides/kubernetes/

5G SA核心安全研究

• https://positive-tech.com/knowledge-base/research/5g-sa-core-security-research/

VM Forking & Hypervisor-Based Fuzzing with Xen

• https://www.youtube.com/watch?v=3MYo8ctD_aU

20201216

[漏洞]

苹果本周修复影响了iOS和iPadOS的严重代码执行漏洞

• https://securityaffairs.co/wordpress/112304/security/ios-ipados-flaws.html

Postgresql提权漏洞（CVE-2020-25695）

• https://staaldraad.github.io/post/2020-12-15-cve-2020-25695-postgresql-privesc/

Rapid7的Windows Insight IDR代理中的本地提权

• https://pentestmag.com/local-privilege-escalation-in-rapid7s-windows-insight-idr-agent/

[工具]

Solarflare：SolarWinds Orion账户审计、密码转储工具

• https://github.com/mubix/solarflare

AFL++发布3.0版

• https://github.com/AFLplusplus/AFLplusplus/releases/tag/3.0c

emba：基于Linux的嵌入式设备固件分析器

• https://github.com/e-m-b-a/emba

Jackalope：二进制、基于覆盖的Fuzzer，支持Windows、macOS

• https://github.com/googleprojectzero/Jackalope

lumina_server：包含IDA Lumina特性的本地服务器

• https://github.com/synacktiv/lumina_server
• https://www.synacktiv.com/publications/investigating-ida-lumina-feature.html

[恶意代码]

Dark Halo Leverages SolarWinds Compromise to Breach Organizations

• https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/

逆向窃密软件KPOT v2.0

• https://github.com/Dump-GUY/Malware-analysis-and-Reverse-engineering/blob/main/kpot2/KPOT.md

[技术]

攻击macOS上的无人值守安装

• https://medium.com/tenable-techblog/attacking-unattended-installs-on-macos-dfc1f57984e0

跨层攻击及其使用方法(用于DNS缓存中毒, 设备跟踪等)

• https://arxiv.org/pdf/2012.07432.pdf

攻击使用受密码保护的Excel做密码管理器的情景

• https://s3cur3th1ssh1t.github.io/Phish-password-protected-Excel-files/

通过Wi-Fi信号从物理隔离计算机中窃取数据（无需Wi-Fi硬件）

• https://thehackernews.com/2020/12/exfiltrating-data-from-air-gapped.html

Intigriti XSS挑战赛的意外解决方案

• https://medium.com/bugbountywriteup/intigritis-december-xss-challenge-2020-unintended-solution-8205b4a4b95b

使用日志处理器fluent-bit进行Fuzzing集成、漏洞分析和漏洞修补

• https://github.com/fluent/fluent-bit/blob/master/doc-reports/cncf-fuzzing-audit.pdf

性能分析的统计方法

• https://aakinshin.net/posts/statistics-for-performance/

20201215

[漏洞]

Go的标准库中encoding/xml与round-trips相关的三个严重漏洞

• https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/

大规模扫描和利用FortiOS SSL VPN Web门户中的路径遍历漏洞，可允许未经身份验证的攻击者通过特制的- http资源请求（CVE-2018-13379）下载FortiOS系统文件

• https://github.com/Zeop-CyberSec/fortios_vpnssl_traversal_leak

[工具]

Reverie：一个优化的零知识证明系统

• https://github.com/trailofbits/reverie
• https://blog.trailofbits.com/2020/12/14/reverie-an-optimized-zero-knowledge-proof-system/

[恶意代码]

黑客组织UNC2452在全球范围内的攻击，利用SUNBURST后门和SolarWinds Orion商业软件实现传播

• https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html

SolarWinds高级网络攻击：发生了什么以及现在该怎么办

• https://blog.malwarebytes.com/threat-analysis/2020/12/advanced-cyber-attack-hits-private-and-public-sector-via-supply-chain-software-update/

针对MySQL服务器的PLEASE_READ_ME勒索软件攻击

• https://www.tripwire.com/state-of-security/security-data-protection/please_read_me-ransomware-campaign-targeting-mysql-servers/

[技术]

自动化十六进制转储分析

• https://suszter.com/hexlasso/automating-hexdump-analysis

虚拟机中的页面错误注入：从HVMI访问交换出的页面

• https://hvmi.github.io/blog/2020/12/14/pfinjection.html

HTB：二进制漏洞利用介绍

• https://www.youtube.com/watch?v=MVeRz2ZdSdk

在研究BBC Micro光盘保护过程中遇到的天才之处

• https://scarybeastsecurity.blogspot.com/2020/12/the-cleverest-floppy-disc-protection.html?m=1

AS_REP Roastin和Kerberoasting之间的确切区别

• https://luemmelsec.github.io/Kerberoasting-VS-AS-REP-Roasting/

使用Qiling框架脱壳TA505样本

• https://www.blueliv.com/cyber-security-and-cyber-threat-intelligence-blog-blueliv/using-qiling-framework-to-unpack-ta505-packed-samples/

如何使用Defensics SDK构建串行端口Fuzzer

• https://www.synopsys.com/blogs/software-security/serial-port-fuzzer-defensics-sdk/

Autopsy Tool综合指南（Windows）

• https://www.hackingarticles.in/comprehensive-guide-on-autopsy-tool-windows/

为了推进机器学习在恶意代码分类方向的发展，网络安全公司Sophos和ReversingLabs联合发布了数据集SoReL-20M，包括2000万个PE样本（1000万恶意+1000万良性）以及一组基于PyTorch和LightGBM的机器学习模型

• https://thehackernews.com/2020/12/sorel-20m-huge-dataset-of-20-million.html
• https://github.com/sophos-ai/SOREL-20M
• https://ai.sophos.com/2020/12/14/sophos-reversinglabs-sorel-20-million-sample-malware-dataset/

针对WordPress的渗透测试

• https://gupta-bless.medium.com/penetration-testing-on-wordpress-f96bc701832e

传递哈希的其他方法（PtH）

• https://www.n00py.io/2020/12/alternative-ways-to-pass-the-hash-pth/

20201214

[漏洞]

Ini软件包的原型污染漏洞

• https://snyk.io/vuln/SNYK-JS-INI-1048974

[工具]

Aprox：Android代理配置工具

• https://github.com/aktsk/aprox

wadcoms：交互式清单, 包含一些Unix/Windows攻击性工具的命令, 支持过滤

• https://wadcoms.github.io/

sqerzo：图数据库的小型ORM库，支持Neo4j, RedisGraph, AWS Neptune，Gremlin

• https://github.com/cr0hn/sqerzo

ContiUnpacker：Conti样本自动脱壳工具

• https://github.com/cdong1012/ContiUnpacker

DetectCobaltStomp：检测由Cobalt Strike实施的Module Stomping

• https://github.com/slaeryan/DetectCobaltStomp

[恶意代码]

黑客组织Palmerworm集团发起的新间谍活动，涉及一套全新的自定义恶意软件，这些攻击针对中美等多个国家的组织

• https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/palmerworm-blacktech-espionage-apt

PgMiner僵尸网络利用有争议的CVE破解不安全的PostgreSQL数据库

• https://unit42.paloaltonetworks.com/pgminer-postgresql-cryptocurrency-mining-botnet/

[技术]

HackTheBox University CTF Writeups

• https://www.goggleheadedhacker.com/blog/post/20

通过Robocraft漏洞了解Linux下的Mono/.NET注入

• https://journal.lunar.sh/2020/12/11/mono-dot-net-injection.html

由7500个WordPress Pingback构成的僵尸网络

• https://www.secjuice.com/make-wordpress-pingback-great-again/

了解静态分析工具Semgrep可以为云/平台安全团队提供什么

• https://www.marcolancini.it/2020/blog-semgrep-for-cloud-security/

How I hacked Facebook: Part One

• https://alaa0x2.medium.com/how-i-hacked-facebook-part-one-282bbb125a5d

滥用AirWatch MDM服务绕过MFA

• https://www.optiv.com/explore-optiv-insights/source-zero/abusing-airwatch-mdm-services-bypass-mfa

对TLS指纹识别工具JARM的测试

• https://silascutler.com/2020/12/10/LoveAndHateWithJARM/

如何使用单个链接来破坏PDF的内容并将其泄漏到远程服务器，就像Blind XSS攻击一样

• https://portswigger.net/research/portable-data-exfiltration

识别和利用SQL注入：手动和自动

• https://medium.com/bugbountywriteup/identifying-exploiting-sql-injection-manual-automated-79c932f0c9b5

HTB OpenkeyS

• https://medium.com/bugbountywriteup/htb-openkeys-writeup-531264648200

移动应用程序请求伪造漏洞利用的新时代

• http://dphoeniixx.com/2020/12/13-2/

使用IDA从零开始学逆向，Part33

• https://kienmanowar.wordpress.com/2020/12/13/reversing-with-ida-from-scratch-p33/

20201211

[漏洞]

Apple macOS内核越界写入导致提权漏洞（CVE-2020-27897）

• https://www.zerodayinitiative.com/blog/2020/12/9/cve-2020-27897-apple-macos-kernel-oob-write-privilege-escalation-vulnerability

WiFi直连手机进行文件传输的模式存在漏洞，影响Huawei Share，LG SmartShare Beam，Xiaomi Mi Share

• https://blog.doyensec.com/2020/12/10/novel-abuses-wifi-direct-mobile-file-transfers.html

容器containerd-shim漏洞CVE-2020-15257的利用与修复

• https://research.nccgroup.com/2020/12/10/abstract-shimmer-cve-2020-15257-host-networking-is-root-equivalent-again/

用于网络游戏通信的库Valve's Game Networking Sockets存在多个漏洞，该库是大量在线游戏的基础

• https://research.checkpoint.com/2020/game-on-finding-vulnerabilities-in-valves-steam-sockets/

海上通讯和连接套件Dualog Connection Suite中的严重漏洞

• https://www.pentestpartners.com/security-blog/serious-vulnerabilities-in-dualog-connection-suite/

Exchange2010 authorized RCE

• https://github.com/Airboi/CVE-2020-17144-EXP

[恶意代码]

分析用于释放Emotet的PrnLoader恶意代码

• https://www.youtube.com/watch?v=5_-oR_135ss

俄罗斯APT组织使用新冠诱饵投递Zebrocy恶意软件

• https://www.intezer.com/blog/research/russian-apt-uses-covid-19-lures-to-deliver-zebrocy//

远控njRAT利用Pastebin C2隧道来避免检测

• https://unit42.paloaltonetworks.com/njrat-pastebin-command-and-control/

Python后门，使用Ngrok与C&C通信

• https://isc.sans.edu/diary/rss/26866

Qakbot恶意软件的驻留机制：在设备关闭之前立即激活其驻留机制，并在系统重新启动或从睡眠中唤醒时自动删除所有痕迹

• https://www.binarydefense.com/qakbot-upgrades-to-stealthier-persistence-method/

[工具]

vulnerable-web-application：Web App靶机

• https://github.com/milad00ahmadi/vulnerable-web-application

DarkSide：信息收集工具

• https://github.com/ultrasecurity/DarkSide

[技术]

逆向经典的实时策略游戏《帝国时代》并修补代码实现作弊

• https://www.youtube.com/watch?v=w7gBkVXuDSQ

介绍防御者可以做的一些简单的事情，以使攻击者更难成功

• https://www.trustedsec.com/blog/4-free-easy-wins-that-make-red-teams-harder/

使用Intel Pin挂钩Get.Workspace

• https://streetfight.us/reversing_workspace

从火眼被泄露的红队工具中发现的战术，技术和程序

• https://www.picussecurity.com/resource/blog/techniques-tactics-procedures-utilized-by-fireeye-red-team-tools

CLSID(Class ID)的简要介绍，以及绕过Avast沙箱

• https://medium.com/stolabs/a-brief-introduction-about-clsid-and-a-bypass-found-c11be972a38b

内部认证中心管理的精髓

• https://levelup.gitconnected.com/nitty-gritties-of-managing-an-internal-certificate-authority-275ffbd9a6c

某些版本的WinZip文件压缩工具中的服务器-客户端通信不安全，可以进行修改以向用户投递恶意软件或欺诈性内容

• https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/insecure-communication-in-winzip-24-could-lead-to-malware/

20201210

[资讯]

富士康本周二发表声明，声称其在美洲某些业务的信息系统遭受勒索软件攻击，攻击者要求3400万美元赎金

• https://www.bleepingcomputer.com/news/security/foxconn-electronics-giant-hit-by-ransomware-34-million-ransom/

[漏洞]

PsExec的本地提权漏洞

• https://medium.com/tenable-techblog/psexec-local-privilege-escalation-2e8069adc9c8

Mirabella Genio系列产品的EZ模式配对过程中，WiFi凭据和其他纯文本秘密值将广播给范围内的任何人以供收听

• https://www.elttam.com/blog/ez-mode-pairing/

CVE-2020-17049：Kerberos青铜比特攻击–概述

• https://blog.netspi.com/cve-2020-17049-kerberos-bronze-bit-overview/

CVE-2020-17049 PoC

• fortra/impacket#1013

[恶意代码]

黑客利用即将到来的新冠疫苗，进行各种恶意活动，从简单的网络钓鱼诈骗到复杂的Zebrocy恶意软件投递，应有尽有

• https://blog.knowbe4.com/theyre-here-covid-19-vaccine-phishes-finally-arrive

[技术]

Lexmark打印机固件提取，PartA

• https://www.medigate.io/lexmark-printers-firmware-extraction-part-a/

探讨2020年Web安全的实践状态

• https://almanac.- httparchive.org/en/2020/security

高级威胁介绍

• http://www.blackstormsecurity.com/docs/BHACK2020.pdf

Atheris Python Fuzzer的工作方式

• https://security.googleblog.com/2020/12/how-atheris-python-fuzzer-works.html

在Oxygen Forensic Detective中通过Checkm8提取Apple iOS文件系统

• https://www.forensicfocus.com/news/apple-ios-file-system-extraction-via-checkm8-in-oxygen-forensic-detective/

软件安全论文收集

• https://github.com/AdaLogics/software-security-paper-list

通过GitHub进行敏感数据公开：深入研究bug海洋

• https://medium.com/bugbountywriteup/sensitive-data-exposure-through-github-a-deep-dive-into-bug-ocean-a43ed5a0a3da

20201209

[漏洞]

Amnesia:33：一系列新的漏洞，影响TCP/IP堆栈，涉及150多家供应商的数百万台路由器以及IoT和OT设备

• https://www.forescout.com/company/resources/amnesia33-how-tcp-ip-stacks-breed-critical-vulnerabilities-in-iot-ot-and-it-devices/

Kubernetes中间人漏洞，影响所有Kubernetes版本（CVE-2020-8554）

• https://groups.google.com/g/kubernetes-announce/c/GPpZzVtGwiI/m/mN2nRETUAgAJ?pli=1

D-Link VPN路由器中的三个漏洞，包括命令注入漏洞和经过身份验证的crontab注入漏洞

• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10195

Citrix XenMobile 目录遍历漏洞（CVE-2020-8209）批量检测脚本

• https://github.com/B1anda0/CVE-2020-8209

[工具]

Depix：从打马赛克的截图中恢复被打码的字符串

• https://github.com/beurtschipper/Depix
• https://www.linkedin.com/pulse/recovering-passwords-from-pixelized-screenshots-sipke-mellema

rizin：Fork自Radare2的逆向框架，

• https://rizin.re/

• https://github.com/rizinorg/rizin

• httpSignatures：Burp扩展，实现了- http 消息签名（draft-ietf-- httpbis-message-signatures-01 draft）

• https://github.com/nccgroup/- httpSignatures

• https://research.nccgroup.com/2020/12/08/tool-release-- httpsignatures-a-burp-suite-extension-implementing-- http-signatures/

ADLab：用于渗透测试的Active Directory实验室

• https://github.com/browninfosecguy/ADLab

wp_hunter：静态搜索Wordpress插件漏洞

• https://github.com/Josue87/wp_hunter

[技术]

利用解释语言的隐藏攻击面

• https://securitylab.github.com/research/now-you-c-me-part-two

VBA宏代码，检测EDR Hook

• https://gist.github.com/X-C3LL/7bb17ecf01f59f50ad52569467af68d6

使用RMIScout爆破RMI-IIOP的经验教训

• https://labs.bishopfox.com/tech-blog/lessons-learned-on-brute-forcing-rmi-iiop-with-rmiscout

深入探讨TLS的新扩展Encrypted Client Hello（ECH），有望显着增强此关键Internet协议的隐私性

• https://blog.cloudflare.com/encrypted-client-hello/

微软发布解决DNS解析器中的地址欺骗漏洞的指南

• https://msrc.microsoft.com/update-guide/en-US/vulnerability/ADV200013

Android渗透实验室配置与ADB命令清单

• https://www.hackingarticles.in/android-pentest-lab-setup-adb-command-cheatsheet/

Linux取证案例研究

• https://www.forensicfocus.com/articles/a-linux-forensics-starter-case-study/

动态逃逸历险记

• https://posts.specterops.io/adventures-in-dynamic-evasion-1fe0bac57aa
• https://github.com/matterpreter/SHAPESHIFTER

20201208

[漏洞]

PlayStation Now版本11.0.2的Websocket漏洞可导致RCE，在同一台计算机上的任何浏览器中加载的任何网站都可以在该计算机上运行任意代码

• https://hackerone.com/reports/873614

Microsoft Teams的严重RCE漏洞，零点击、可传播、跨平台

• https://github.com/oskarsve/ms-teams-rce/blob/main/README.md

由于修改的IMMEDIATE ASSIGNMENT消息导致三星基带中的远程堆栈溢出（SVE-2019-13963）

• https://fredericb.info/2020/12/sve-2019-13963-remote-stack-overflow-in-samsung-baseband-caused-by-malformed-immediate-assignment-message.html

McAfee ePolicy Orchestrator中的漏洞

• https://swarm.ptsecurity.com/vulnerabilities-in-mcafee-epolicy-orchestrator/

思科安全管理器中的Java反序列化漏洞

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csm-java-rce-mWJEedcD

[工具]

SnitchDNS：由数据库驱动的带有Web UI的DNS服务器，使用Python和Twisted编写，可在不重新启动任何系统服务的情况下立即应用所有配置更改，从而使DNS管理更加轻松

• https://github.com/ctxis/SnitchDNS

pyintelowl：与IntelOwl的API进行交互的Python SDK和客户端

• https://github.com/intelowlproject/pyintelowl

passive-ssh：用于存储和查找每个主机的SSH密钥和指纹（IPv4/IPv6/onion），由扫描器和服务器组成

• https://github.com/D4-project/passive-ssh

Oblivion：实时监视新数据泄漏，并通知用户凭据是否已泄漏

• https://github.com/loseys/Oblivion

DecryptAutoLogon：命令行工具，用于提取/解密SysInternals AutoLogon在LSA中存储的密码

• https://github.com/securesean/DecryptAutoLogon

cloudlist：列出来自多个云提供商的资产

• https://github.com/projectdiscovery/cloudlist

hijackthis：扫描Windows系统以查找广告软件、间谍软件、恶意软件和其他有害程序所更改的设置

• https://github.com/dragokas/hijackthis

[恶意代码]

Nefilim 勒索软件TTP的详细演练

• https://www.picussecurity.com/resource/blog/how-to-beat-nefilim-ransomware-attacks

一个以电子商务网站为目标的网络犯罪组织于今年早些时候发起了“多阶段恶意活动”，其目的是投递窃密工具和基于JavaScript的付款skimmers

• https://www.group-ib.com/blog/fakesecurity

俄罗斯政府资助的黑客利用VMware漏洞来访问被攻击系统上的受保护数据

• https://media.defense.gov/2020/Dec/07/2002547071/-1/-1/0/CSA_VMWARE%20ACCESS_U_OO_195076_20.PDF

Rana Android恶意软件，可以监视WhatsApp、Telegram、Skype等中的即时消息

• https://blog.reversinglabs.com/blog/rana-android-malware

[技术]

从安全的角度看PHP8

• https://dustri.org/b/php8-from-a-security-point-of-view.html

XS-Leaks Wiki

• https://xsleaks.dev/

使用C++编写自己的C2植入物

• https://shogunlab.gitbook.io/building-c2-implants-in-cpp-a-primer/

检测并解码损坏的BASE64字符串

• https://isc.sans.edu/diary/rss/26616

WHOIS数据库在网络安全及其他方面的作用

• https://latesthackingnews.com/2020/12/07/the-role-a-whois-db-plays-in-cybersecurity-and-beyond/

20201207

[漏洞]

两个影响主流Web浏览器（Chrome/Firefox/Edge）的信息泄露漏洞，可以利用这些漏洞泄露大量已安装的应用程序，包括安全产品

• https://www.fortinet.com/blog/threat-research/leaking-browser-url-protocol-handlers

kibana由原型污染导致RCE的漏洞（CVE-2019-7609）

• https://www.youtube.com/watch?v=KVDOIFeRaPQ

[工具]

Atheris：谷歌开源的基于覆盖引导的Python Fuzzing引擎

• https://github.com/google/atheris
• https://opensource.googleblog.com/2020/12/announcing-atheris-python-fuzzer.html

restler-fuzzer：针对Stateful REST API的模糊测试工具，用于通过其REST API自动测试云服务并查找这些服务中的安全性和可靠性错误

• https://github.com/microsoft/restler-fuzzer

stegseek：隐写爆破工具，快速从文件中提取隐藏数据

• https://github.com/RickdeJager/stegseek

CastleBravo：漏洞赏金自动化工具

• https://github.com/m4ll0k/CastleBravo

BurpSuite_403Bypasser：Burp扩展，绕过403受限目录

• https://github.com/sting8k/BurpSuite_403Bypasser

Go365：Office 365用户攻击工具

• https://github.com/optiv/Go365

[技术]

逆向3D电影制作工具，Part4：编写自己的汇编器

• https://benstoneonline.com/posts/reverse-engineering-3d-movie-maker-part-four/

HTB：二进制漏洞利用介绍

• https://www.youtube.com/watch?v=3Snd6A_duSQ

介绍几种network pivoting技术以及执行横向移动的现有工具

• https://blog.raw.pm/en/state-of-the-art-of-network-pivoting-in-2019/

cloudgoat漏洞利用系列：通过LAMBDA和IAM PASS角色进行的特权提升

• https://makosecblog.com/aws-pentest/lambda-privesc/

了解和检测DCSync攻击

• https://www.blacklanternsecurity.com/2020-12-04-DCSync/

Metasploit插件：导入PowerSploit Invoke-Portscan程序

• https://tactifail.wordpress.com/2020/12/04/plugin-release-metasploit-db-importer-for-powersploit-invoke-portscan/
• https://github.com/TactiFail/Metasploit-Plugins/blob/master/powersploit_portscan_db_import.rb

PHP Shell MARIJUANA中的混淆技术

• https://blog.sucuri.net/2020/12/obfuscation-techniques-in-marijuana-shell-bypass.html

20201204

[漏洞]

CVE-2020-25988：Genexis Platinum 4410 v2.1.34H家用路由器基于UPnP的凭据泄露

• https://niteshsurana.medium.com/cve-2020-25988-a-upnp-abuse-424f0db73129

远程3D打印机管理软件“ Repetier-Server”的漏洞，使攻击者能够以SYSTEM级特权远程利用托管该软件的Windows服务器

• https://www.securifera.com/blog/2020/12/02/a-3d-printed-shell/

NAT slipstreaming漏洞PoC

• https://github.com/jrozner/slipstream

[工具]

objtree：追踪Objective-C函数调用树

• https://github.com/hot3eed/objtree

ImHex：用于逆向的16进制编辑器

• https://github.com/WerWolv/ImHex

TinyCheck：轻松地捕获来自智能手机或可与Wi-Fi接入点关联的任何设备的网络通信，以便快速分析它们 /- https://github.com/KasperskyLab/TinyCheck

red-detector：使用Vuls（- https://vuls.io/en/）扫描EC2实例以查找其漏洞

• https://github.com/lightspin-tech/red-detector

Carnivore：评估本地Microsoft服务器身份验证，例如ADFS，Skype，Exchange和RDWeb

• https://github.com/nccgroup/Carnivore
• https://research.nccgroup.com/2020/12/03/tool-release-carnivore-microsoft-external-assessment-tool/

[恶意代码]

黑客组织DeathStalker开发的新的Windows PowerShell后门PowerPepper

• https://securelist.com/what-did-deathstalker-hide-between-two-ferns/99616/

[技术]

恶意代码分析学习资源

• https://agdcservices.com/blog/resources-for-learning-malware-analysis/

内核提权：Kubernetes容器隔离如何影响提权攻击

• https://snyk.io/blog/kernel-privilege-escalation/

网站加固：从架构到部署

• https://www.yavs.io/Article_18Nov20_SecureWebsite/ref/reddit_netsec

Kubernetes安全最佳实战

• https://resources.whitesourcesoftware.com/blog-whitesource/kubernetes-security

Fuzzer如何判定崩溃是不是唯一的

• https://insinuator.net/2020/12/how-fuzzers-decide-if-a-crash-is-unique/

通过挂钩NtlmShared.dll中的MsvpPasswordValidate来转储本地凭据

• https://offnotes.notso.pro/abusing-credentials/dumping-credentials/msvppasswordvalidate-hook

20201203

[工具]

fibratus：用于探索和追踪Windows内核的现代工具

• https://github.com/rabbitstack/fibratus

ELFPatch：使用动态大小的补丁为ELF打补丁

• https://github.com/ret2jazzy/ELFPatch

writehat：在编写渗透测试过程中不用MS Word

• https://github.com/blacklanternsecurity/writehat
• https://www.blacklanternsecurity.com/2020-12-02-WriteHat/

meta- http：一个bash脚本，通过XXE自动扫描目标网络的- http资源

• https://github.com/vp777/meta- http

ADSearch：使用LDAP协议查询Active Directory

• https://github.com/tomcarver16/ADSearch

A-xex：简单直观的网络安全工具

• https://github.com/farinap5/A-xex

[恶意代码]

APT组织Turla使用新后门Crutch从Dropbox中提取窃取的文档

• https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/

挖矿僵尸网络Xanthe, 以错误配置的Docker API为目标

• https://blog.talosintelligence.com/2020/12/xanthe-docker-aware-miner.html

[技术]

自动去除使用gobfuscate添加的混淆

• https://www.kryptoslogic.com/blog/2020/12/automated-string-de-gobfuscation/

制作一个可在Windows终端上执行的.wsb文件，挂载用户的文件系统，从而在隐藏的VM内执行植入，并绕过主机上的任何AV/EDR

• https://blog.syscall.party/post/weaponizing-windows-sandbox/

在谷歌云平台上使用Root-The-Box运行CTF OWASP Juice Shop

• https://snikt.net/blog/2020/12/02/running-owasp-juice-shop-with-root-the-box-on-google-cloud-platform/

介绍- http枚举器monsoon

• https://blog.redteam-pentesting.de/2020/introducing-monsoon/
• https://github.com/RedTeamPentesting/monsoon

不要扫描我的网站：利用旧版本的Wappalyzer

• https://medium.com/@csal/dont-scan-my-website-i-exploiting-an-old-version-of-wappalyzer-14c001279434

Drupal Core：漏洞的背后，Part2：Defacement, Stored XSS, Self-XSS

• https://www.checkmarx.com/blog/drupal-core-behind-the-vulnerability-part-2-defacement-stored-xss-and-self-xss

Windows内存损坏漏洞利用，Part1：栈溢出

• https://www.cyberark.com/resources/threat-research-blog/a-modern-exploration-of-windows-memory-corruption-exploits-part-i-stack-overflows

不要相信您的反恶意软件

• https://whichbuffer.medium.com/do-not-trust-your-anti-malware-aeec134d017f

Android应用程序框架，初学者指南

• https://www.hackingarticles.in/android-application-framework-beginners-guide/

Linux内核堆隔离与UAF漏洞利用

• http://blog.ptsecurity.com/2020/12/linux-kernel-heap-quarantine-versus-use.html

20201202

[漏洞]

iOS未经身份验证的内核内存损坏漏洞，该漏洞导致无线电邻近的所有iOS设备重新启动，而无需用户交互

• https://googleprojectzero.blogspot.com/2020/12/an-ios-zero-click-radio-proximity.html

iOS 1Day狩猎：了解和探索iOS内核内存泄漏漏洞（CVE-2020-27950）

• https://www.synacktiv.com/publications/ios-1-day-hunting-uncovering-and-exploiting-cve-2020-27950-kernel-memory-leak.html

开源健康记录管理软件OpenClinic的四个漏洞，其中最严重的漏洞是未经身份验证的攻击者可以从该应用程序读取患者PHI

• https://labs.bishopfox.com/advisories/openclinic-version-0.8.2

WebKit的多个漏洞

• https://blog.talosintelligence.com/2020/11/vuln-spotlight-webkit-use-after-free-nov-2020.html

[工具]

online-opsec：供一般人使用的在上网时保持安全、隐私的威胁模型和工具

• https://github.com/devbret/online-opsec

Damn-Vulnerable-WooCommerce-Plugins：为多个WooCommerce插件漏洞准备的Docker环境

• https://github.com/parzel/Damn-Vulnerable-WooCommerce-Plugins

pyOracle2：Python编写的Padding Oracle工具

• https://github.com/liquidsec/pyOracle2
• https://blog.liquidsec.net/2020/11/30/introducing-pyoracle2/

Micro Focus Operations Bridge Manager的多个RCE漏洞

• https://github.com/pedrib/PoC/blob/master/advisories/Micro_Focus/Micro_Focus_OBM.md

[恶意代码]

在npm注册表中发现了新的Bladabindi木马

• https://blog.sonatype.com/bladabindi-njrat-rat-in-jdb.js-npm-malware

被认为与APT组织海莲花有关的macOS后门

• https://www.trendmicro.com/en_us/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html

如何检测实现了免杀的恶意软件

• https://securityboulevard.com/2020/12/how-to-spot-razy-malware-undetected-by-av-systems/

黑客组织使用挖矿技术躲避检测

• https://www.microsoft.com/security/blog/2020/11/30/threat-actor-leverages-coin-miner-techniques-to-stay-under-the-radar-heres-how-to-spot-them/

[技术]

虚拟机环境（VME）检测的潜在用途

• https://debugactiveprocess.medium.com/mapping-possible-functions-to-identify-virtual-machine-environent-vme-25a02be96dc4

对开源国际象棋引擎Stockfish的分析

• https://chess.resistant.tech/

使用Brim，Zeek和NetworkX可视化IP流量

• https://medium.com/brim-securitys-knowledge-funnel/visualizing-ip-traffic-with-brim-zeek-and-networkx-3844a4c25a2f

快速评估EDR是否加载到了进程中，并在某些重要功能上执行用户级Hooking

• https://redteaming.co.uk/2020/12/01/worried-about-edr-hooking-catching-you-out/

漏洞赏金Writeup收集

• https://github.com/devanshbatham/Awesome-Bugbounty-Writeups

使用Arkime捕获解密的TLS流量

• https://www.netresec.com/index.ashx?page=Blog&month=2020-12&post=Capturing-Decrypted-TLS-Traffic-with-Arkime

20201201

[漏洞]

支持Docker和常见Kubernetes配置的容器运行时containerd向外公开的API可导致提权（CVE-2020-15257）

• https://research.nccgroup.com/2020/11/30/technical-advisory-containerd-containerd-shim-api-exposed-to-host-network-containers-cve-2020-15257/

[恶意代码]

针对德国用户的Gootkit银行木马和REvil勒索软件

• https://blog.malwarebytes.com/threat-analysis/2020/11/german-users-targeted-with-gootkit-banker-or-revil-ransomware/

[工具]

在线工具BigMatch，匹配二进制文件中的开源代码

• https://bigmatch.rev.ng/static/index.html

alpha_decoder：命令行工具，解码基于Alpha2的Shellcode

• https://github.com/LeoCodes21/alpha_decoder

fortiscan：高性能的FortiGate SSL-VPN漏洞扫描和利用工具

• https://github.com/anasbousselham/fortiscan

js-x-ray：JavaScript和Node.js开源SAST扫描器。用于检测最常见的恶意模式的静态分析

• https://github.com/fraxken/js-x-ray

[技术]

汇编代码编辑教程

• https://www.youtube.com/watch?v=_Sm84vARhbw

一个x86-64 CPU有多少寄存器?

• https://blog.yossarian.net/2020/11/30/How-many-registers-does-an-x86-64-cpu-have

说明什么是Kerberoasting攻击以及如何缓解

• https://thalpius.com/2020/11/30/microsoft-defender-for-identity-kerberoasting/

多云安全策略的基础

• https://cloudberry.engineering/article/multi-cloud-security-strategy-foundations/

改善OAuth应用到应用的安全性：描述Android和iOS上本机应用程序与Web应用程序之间重定向的挑战，并根据移动操作系统和浏览器的当前可用功能推荐了解决方案

• https://danielfett.de/2020/11/27/improving-app2app/

白皮书：NTS如何工作，为什么重要

• https://www.netnod.se/time-and-frequency/white-paper-how-does-nts-work-and-why-is-it-important

解密PowerShell Payload

• https://isc.sans.edu/forums/diary/Decrypting+PowerShell+Payloads+video/26838/

CMS漏洞扫描器：WordPress，Joomla，Drupal，Moodle，Typo3

• https://www.infosecmatter.com/cms-vulnerability-scanners-for-wordpress-joomla-drupal-moodle-typo3/

测试目录或路径遍历漏洞

• https://medium.com/bugbountywriteup/testing-for-directory-or-path-traversal-vulnerabilities-dfbe49fdfe92

DL-0921 (CPS-B-21)逆向

• https://gitlab.com/loic.petit/cps2-reverse/-/tree/master/DLs/DL-0921

20201130

[恶意代码]

分析Go语言编写的高度混淆后们Blackrota

• https://blog.netlab.360.com/blackrota-an-obfuscated-backdoor-written-in-go-en/

分析一个未知黑客组织的样本及其后端基础架构

• https://marcoramilli.com/2020/11/27/threat-actor-unkown/

[工具]

jwt-key-id-injector：检查JWT漏洞的Python脚本

• https://github.com/dariusztytko/jwt-key-id-injector

s3_objects_check：白盒评估有效的S3对象权限，以识别可公开访问的对象

• https://github.com/nccgroup/s3_objects_check

cloudquery：将云配置和元数据转换为可查询的sql表，无需编写代码即可提供强大的分析和监视功能

• https://github.com/cloudquery/cloudquery

Neurax：Golang编写的二进制文件，可以在本地网络上传播，而无需使用任何外部服务器

• https://github.com/redcode-labs/Neurax

PoshBot：基于PowerShell的聊天机器人框架

• https://github.com/poshbotio/PoshBot

freki：恶意代码分析平台

• https://github.com/crhenr/freki

webscan：基于浏览器的网络IP扫描和本地IP检测

• https://github.com/samyk/webscan

go-amd64-emulator：Go语言编写的用户模式Linux/AMD64仿真工具

• https://github.com/eatonphil/go-amd64-emulator
• https://notes.eatonphil.com/emulating-amd64-starting-with-elf.html

stats：Metasploit插件，提供一些命令来显示有关当前工作空间的统计信息，例如最受欢迎的端口、主机/服务总数等

• https://github.com/TactiFail/Metasploit-Plugins

dnsx：一种快速的多用途DNS工具包，允许运行带有用户提供的解析器列表的多个DNS查询

• https://github.com/projectdiscovery/dnsx

FullPowers：恢复本地/网络服务帐户的默认权限集

• https://github.com/itm4n/FullPowers

tracee：使用eBPF的轻量级容器和系统事件跟踪

• https://github.com/aquasecurity/tracee

Admin-Scanner：通过使用自定义单词列表或默认单词列表轻松找到任何网站的管理面板

• https://github.com/alienwhatever/Admin-Scanner

[技术]

逆向早期德州仪器（TI）计算器芯片中的RAM存储

• http://www.righto.com/2020/11/reverse-engineering-ram-storage-in.html?m=1

Writeup: FlareOn 2020: 008 - Aardvark

• https://whitehatlab.eu/en/blog/writeup/flareon/2020/008-aardvark/

DNSMon: 用DNS数据进行威胁发现

• https://blog.netlab.360.com/use-dns-data-produce-threat-intelligence/

使用JARM识别后渗透工具Koadic C2的服务器指纹

• https://blog.tofile.dev/2020/11/28/koadic_jarm.html

HTB SneakyMailer Writeup：大规模电子邮件钓鱼、PyPi包文件滥用与pip3

• https://medium.com/bugbountywriteup/htb-sneakymailer-writeup-bb32e94f593

使用开放网络的中间人WiFi攻击

• https://medium.com/bugbountywriteup/mitm-wifi-attacks-using-open-networks-7c0cc283524c

ParrotOS 与 HTB Buildout，Part2

• https://medium.com/bugbountywriteup/parrotos-and-hack-the-box-buildout-part-2-4bf04b0efcd3

对SHA-256的SAT解算器、优化和信念传播攻击

• https://medium.com/bugbountywriteup/sat-solver-optimization-and-belief-propagation-attacks-on-sha-256-33c0233440e9

20201127

[漏洞]

VMware NSX-T中间人攻击漏洞 (CVE-2020-3993)

• https://insinuator.net/2020/11/vmware-nsx-t-mitm-vulnerability-cve-2020-3993/

[工具]

bento：一个极简的基于fedora的容器，通过添加GUI应用程序进行渗透测试

• https://github.com/higatowa/bento

blight：对编译/构建工具进行包装和插桩

• https://github.com/trailofbits/blight
• https://blog.trailofbits.com/2020/11/25/high-fidelity-build-instrumentation-with-blight/

intrudex：Burp插件，提供了一个基于正则表达式生成Instruder Payload的接口

• https://github.com/TactiFail/Burp-Plugins/blob/master/intrudex/README.md
• https://tactifail.wordpress.com/2020/11/26/burp-plugin-release-intrudex/

根据人脸图片生成逼真的人脸图片，用于欺骗人脸识别

• https://generated.photos/anonymizer#

[恶意代码]

Bandook木马，属于第三方出售给全球政府和黑客组织的攻击性基础架构的一部分，以促进攻击性网络运营

• https://research.checkpoint.com/2020/bandook-signed-delivered/

[技术]

Writeup: FlareOn 2020: 008 - Aardvark

• https://whitehatlab.eu/en/blog/writeup/flareon/2020/008-aardvark/

SD-PWN系列文章Part4：VMware VeloCloud

• https://medium.com/realmodelabs/sd-pwn-part-4-vmware-velocloud-the-last-takeover-a7016f9a9175

CyberAlarm：独立的安全审查...以及为什么要避免它

• https://paul.reviews/cyberalarm-an-independent-security-review-and-why-you-should-avoid-it/

勒索软件架构，Part2：用Python代码说明一些概念，以及介绍使用pycryptodome库进行加密的基本用法

• https://securityshenaningans.medium.com/architecture-of-a-ransomware-2-2-e22d8eb11cee

在受限环境中躲避检测的故事：DLL旁加载+ Phantom DLL镂空+ Google Apps脚本实现与C&C通信

• https://www.blackarrow.net/hindering-threat-hunting-a-tale-of-evasion-in-a-restricted-environment/

在CobaltStrike Artifact工具包中直接使用syscall来绕过EDR解决方案的实现

• https://br-sn.github.io/Implementing-Syscalls-In-The-CobaltStrike-Artifact-Kit/

他们如何在不眨眼的情况下骗走100,000美元：BEC（商业电子邮件妥协）审计分析

• https://www.securityartwork.es/2020/11/26/how-they-swindle-100000-without-blinking-an-eye-forensic-analysis-of-a-bec-business-email-compromise-iv/

20201126

[漏洞]

自动化服务器管理工具cPanel漏洞，可通过爆破绕过2FA

• https://www.digitaldefense.com/news/zero-day-cpanel-and-webhost-manager/

[工具]

elk-tls-docker: 使用docker-compose创建启用了证书和安全性的ELK堆栈

• https://github.com/swimlane/elk-tls-docker

NetworkSniffer：无需代理即可记录iOS网络流量

• https://github.com/evilpenguin/NetworkSniffer

[恶意代码]

Ryuk勒索软件介绍

• https://heimdalsecurity.com/blog/ryuk-ransomware/

[技术]

D810：为IDA创建可扩展的反混淆插件

• https://eshard.com/posts/d810_blog_post_1/?s=09
• https://gitlab.com/eshard/d810

使用Git和CI跟踪Windows更新

• https://blog.tofile.dev/2020/11/19/actions.html

初学者指南：用于漏洞赏金侦查自动化的VPS设置

• https://medium.com/bugbountywriteup/beginners-guide-vps-setup-for-bug-bounty-recon-automation-6b0ba1e051ef

使用协议的日历文件和GoPhish实现初始访问

• https://cyberarms.wordpress.com/2020/11/23/initial-access-with-evil-calendar-files-and-gophish/

意大利电信（TIM）：Azure子域接管

• https://security-obscurity.blogspot.com/2020/11/telecom-italia-tim-azure-subdomain.html

安全情报手册第3章：安全情报生命周期

• https://www.recordedfuture.com/security-intelligence-lifecycle-overview/

Verizon推出2020年网络间谍活动报告

• https://www.verizon.com/business/resources/reports/cyber-espionage-report/

使用恶意Office 365应用的网络钓鱼活动

• https://info.phishlabs.com/blog/office-365-phishing-uses-malicious-app-persist-password-reset

Group-IB发布的2020/2021年高科技犯罪趋势年度报告

• https://www.group-ib.com/resources/threat-research/2020-report.html

使用PowerShell实时为Windows API调用打补丁

• https://isc.sans.edu/diary/rss/26826

IoT安全系列文章

• https://www.troyhunt.com/iot-unravelled-part-3-security/
• https://www.troyhunt.com/iot-unravelled-part-2-ip-addresses-network-zigbee-custom-firmware-and-soldering/
• https://www.troyhunt.com/iot-unravelled-part-1-its-a-mess-but-then-theres-home-assistant/

20201125

[漏洞]

蓝牙攻击可以在几分钟内偷走特斯拉Model X

• https://www.wired.com/story/tesla-model-x-hack-bluetooth/

详细介绍SaltStack命令注入漏洞

• https://www.zerodayinitiative.com/blog/2020/11/24/detailing-saltstack-salt-command-injection-vulnerabilities

基于Elixir的分页器中的远程代码执行

• https://www.alphabot.com/security/blog/2020/elixir/Remote-code-execution-vulnerability-in-Elixir-based-Paginator-project.html

P-TMSI重新分配命令格式错误，导致三星基带中的远程堆栈溢出

• https://fredericb.info/2020/11/remote-stack-overflow-in-samsung-baseband-caused-by-malformed-p-tmsi-reallocation-command.html

Windows提权漏洞PoC（CVE-2020-1034）

• https://github.com/yardenshafir/CVE-2020-1034

[恶意代码]

深入研究CryptoWall勒索软件使用的所有加密和混淆方法

• https://ryancor.medium.com/genetic-analysis-of-cryptowall-ransomware-843f86055c7f

黑客组织Stantinko操纵的广告软件和僵尸挖矿软件的新变种，针对Linux服务器

• https://www.intezer.com/blog/research/stantinkos-proxy-after-your-apache-server/

新型恶意软件WAPDropper：一家由电信公司向受害者订购高级服务的Android恶意软件

• https://research.checkpoint.com/2020/enter-wapdropper-subscribe-users-to-premium-services-by-telecom-companies/

[工具]

siras：安全事件响应自动模拟，在实际场景中练习事件响应计划和过程

• https://github.com/Stuxend/siras

amlsec：使用基于AutomationML的工程数据自动进行安全风险识别

• https://github.com/sbaresearch/amlsec

[技术]

什么是导入表哈希，以及如何在蓝队种利用它

• https://hackerspot.net/2020/11/24/import-hashing-aka-imphashes/

勒索软件的体系结构

• https://securityshenaningans.medium.com/architecture-of-a-ransomware-1-2-1b9fee757fcb

通过WHOIS和DNS记录进行XSS

• https://medium.com/tenable-techblog/cross-site-scripting-via-whois-and-dns-records-a25c33667fff

以HTB Android挑战“ Cat”为例，进行简单的Android备份文件审核

• https://medium.com/bugbountywriteup/extract-an-android-backup-file-96172efd4d86

Report: Spotify Targeted in Potential Fraud Scheme

• https://www.vpnmentor.com/blog/report-spotify-scam/

利用基于DOM的Open重定向

• https://gupta-bless.medium.com/exploiting-dom-based-open-redirect-94738506824c

黑客学习手册，涉及漏洞、技术、侦察、漏洞利用等

• https://github.com/domssilva/vulnsearch

20201124

[漏洞]

npm private-ip容易受到多个服务器端请求伪造（SSRF）绕过的攻击：正则表达式无法解决localhost和其他私有IP范围的变化（CVE-2020-28360）

• https://johnjhacking.com/blog/cve-2020-28360/

Windows Print Spooler服务的提权漏洞影响了应用程序逻辑，攻击者可以将任意DLL加载到打印后台处理程序进程中

• https://www.accenture.com/us-en/blogs/cyber-defense/discovering-exploiting-shutting-down-dangerous-windows-print-spooler-vulnerability

思科集成管理控制器多个远程执行代码漏洞

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-api-rce-UXwpeDHd

[恶意代码]

PYSA / Mespinozaler勒索软件，使用了Empire和Koadic以及RDP实现横向渗透

• https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/

Cobalt Strike Beacon分析

• https://isc.sans.edu/forums/diary/Quick+Tip+Cobalt+Strike+Beacon+Analysis/26818/

[工具]

osi.ig：针对Instagram账户的信息收集工具

• https://github.com/th3unkn0n/osi.ig

[技术]

使用Intel EPT的内存管理单元（MMU）进行虚拟化的技术细节，Part1：扩展页表的动机，与性能相关的许多问题以及与MMU虚拟化相关的不同体系结构组件

• https://revers.engineering/mmu-ept-technical-details/

从二进制数据样本自动发现和校验算法

• https://dl.acm.org/doi/pdf/10.1145/3411506.3417599

分析用作丹麦公共交通的非接触式集成电路卡Rejsekort的实现

• https://oneeyedtechs.com/post/rejsekortet-an-obsolete-smart-card

探索椭圆曲线密码学（ECC）Ed25519的代码实现

• https://eiken.dev/blog/2020/11/code-spotlight-the-reference-implementation-of-ed25519-part-1/

测试报告：MAYHEM射频渗透测试HackRF / Portapack固件

• https://telescope.ac/petazzoni/mayhem-the-rf-pentesting-hackrf-portapack-firmware

评估Precursor的硬件安全性

• https://www.bunniestudios.com/blog/?p=5979

Windows密码转储清单

• https://www.hackingarticles.in/password-dumping-cheatsheet-windows/

围绕CVE-2020-1034创建稳定的利用程序，在不使计算机崩溃的情况下提升本地特权

• https://windows-internals.com/exploiting-a-simple-vulnerability-in-35-easy-steps-or-less/

使用使用Outlook VbsProject.OTM文件实现驻留的多种新方式

• https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/

20201123

[漏洞]

基于DNS的服务发现软件HashiCorp：从信息泄露到RCE

• https://lab.wallarm.com/consul-by-hashicorp-from-infoleak-to-rce/?utm_source=Reddit&utm_medium=post&utm_campaign=Consul

[工具]

urlhunter：侦查工具，允许搜索通过简化服务公开的URL

• https://github.com/utkusen/urlhunter

BloodHound发布4.0版本

• https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350

GG-AESY：在图像中隐藏代码

• https://github.com/jfmaes/GG-AESY

Xerror：完全自动化的渗透测试工具

• https://github.com/Chudry/Xerror

uafuzz：二进制级别定向Fuzzing工具，针对UAF漏洞

• https://github.com/strongcourage/uafuzz

doctrack：用于将跟踪像素插入Office Open XML文档（Word，Excel）的工具

• https://github.com/wavvs/doctrack

[技术]

ImageMagick：通过PDF密码进行Shell注入

• https://insert-script.blogspot.com/2020/11/imagemagick-shell-injection-via-pdf.html

逆向分析教程，覆盖x86, x64, 32-bit ARM & 64-bit ARM架构

• https://github.com/mytechnotalent/Reverse-Engineering-Tutorial

My First Kernel Module: A Debugging Nightmare

• https://reberhardt.com/blog/2020/11/18/my-first-kernel-module.html

模糊哈希与常规哈希

• https://hackerspot.net/2020/11/20/fuzzy-hashing-vs-regular-hashing/

Burp Suite与OWASP ZAP对比

• https://jaw33sh.wordpress.com/2020/11/22/burp-suite-vs-owasp-zap-a-comparison-series/

特权容器逃逸，以在容器主机上执行任意命令

• https://ajxchapman.github.io/containers/2020/11/19/privileged-container-escape.html

.NET中几种动态调用方法，可用于绕过内联和IAT挂钩

• https://blog.nviso.eu/2020/11/20/dynamic-invocation-in-net-to-bypass-hooks/

使用杀毒软件转储进程内存

• https://www.archcloudlabs.com/projects/dumping-memory-with-av/

High Security, Plausible Deniability and Two Factor Encryption: You're the Weak Link

• https://www.alvarez.io/posts/two-factor-encryption/

HTB Buff [writeup]

• https://medium.com/bugbountywriteup/htb-buff-writeup-5d118ab695c0

攻击1Password：在没有加密知识的情况下解密数据

• https://www.youtube.com/watch?v=ZTEXpPQTz5o

路由器渗透测试

• https://www.hackingarticles.in/router-penetration-testing/

将基于盲错误的SQL注入转换为可利用的漏洞

• https://ozguralp.medium.com/turning-blind-error-based-sql-injection-into-an-exploitable-boolean-one-85d6be3ca23b

通过命名管道分析检测Cobalt Strike默认模块

• https://labs.f-secure.com/blog/detecting-cobalt-strike-default-modules-via-named-pipe-analysis/

XXE注入完全指南

• https://www.hackingarticles.in/comprehensive-guide-on-xxe-injection/

20201120

[漏洞]

Android版Facebook Messenger漏洞, 使呼叫者可以在另一端的人接听电话之前未经允许而收听其他用户的周围环境

• https://bugs.chromium.org/p/project-zero/issues/detail?id=2098

下载量超1亿的通信应用GO SMS Pro被发现可以公开展示应用程序用户之间传输的媒体

• https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/go-sms-pro-vulnerable-to-media-file-theft/

开源CMS Drupal的严重RCE漏洞（CVE-2020-13671）

• https://www.drupal.org/sa-core-2020-012

Sqreen RCE漏洞

• https://www.ambionics.io/blog/sqreen-rce

[工具]

Phonerator：高级有效电话号码生成器

• https://www.martinvigo.com/phonerator-an-advanced-valid-phone-number-generator/

apple-ocsp-noiser：Apple Developer ID OCSP的隐私保护噪声机

• https://github.com/kiding/apple-ocsp-noiser

toothpicker：一个用于iOS的进程内、覆盖引导的模糊测试器

• https://github.com/seemoo-lab/toothpicker

DevSecOps资源收集

• https://github.com/hahwul/DevSecOps

[恶意代码]

我们渗透了一个IRC僵尸网络，看看我们发现了什么

• https://cybernews.com/security/we-infiltrated-an-irc-botnet-heres-what-we-found/

[技术]

利用动态渲染引擎接管Web App

• https://r2c.dev/blog/2020/exploiting-dynamic-rendering-engines-to-take-control-of-web-apps/

适用于金融服务的多账户AWS组织最佳实践

• https://www.clickittech.com/aws/aws-organizations-best-practices/amp/

2020年第三季度网络层DDoS攻击趋势

• https://blog.cloudflare.com/network-layer-ddos-attack-trends-for-q3-2020/

代理Android应用流量：常见问题与清单

• https://blog.nviso.eu/2020/11/19/proxying-android-app-traffic-common-issues-checklist/

越狱永不消亡：iOS 13.7漏洞利用

• https://cyberweek.ae/materials/2020/D2T1%20-%20Jailbreaks%20Never%20Die%20-%20Exploiting%20iOS%2013.7.pdf

赛门铁克2021年网络安全预测

• https://symantec-enterprise-blogs.security.com/blogs/feature-stories/symantec-2021-cyber-security-predictions-looking-toward-future

IBM与Cisco合作消除Webex Meetings的漏洞

• https://securityintelligence.com/posts/ibm-works-with-cisco-exorcise-ghosts-webex-meetings/

20201119

[漏洞]

UOKOO安全摄像头的身份认证后RCE漏洞与驻留

• https://hex.fish/2020/11/17/post-auth-rce-and-persistence-on-uokoo-security-cameras/

JamoDat – TSMManager授权绕过漏洞（CVE-2020-28054）和Tivoli Storage Manager基于堆栈的缓冲区溢出漏洞

• https://voidsec.com/tivoli-madness/
• https://github.com/VoidSec/Tivoli-Madness

Citrix XenMobile服务器上的路径遍历漏洞

• https://swarm.ptsecurity.com/path-traversal-on-citrix-xenmobile-server/

[工具]

Kali Linux发布2020.4版

• https://www.kali.org/news/kali-linux-2020-4-release/

wow64Jit：从WoW64层直接调用32位NtDLL API

• https://github.com/aaaddress1/wow64Jit

teler：基于Web日志的实时入侵检测和威胁警报工具，在终端中运行

• https://github.com/kitabisa/teler

openedr：开源的EDR系统，在基本安全事件级别分析整个环境中发生的事情

• https://github.com/ComodoSecurity/openedr

MachoDecrypt：运行时解密iOS平台mach-o二进制文件

• https://github.com/evilpenguin/MachoDecrypt

atheris：覆盖引导的Python Fuzzing引擎，支持FuzzingPython代码和CPython的原生执行扩展

• https://github.com/google/atheris

untrusted-types：Chrome扩展程序，滥用可信类型来记录DOMXSS接收器

• https://github.com/filedescriptor/untrusted-types

[恶意代码]

APT组织TA505攻击活动的简要历史

• https://research.nccgroup.com/2020/11/18/ta505-a-brief-history-of-their-time/

勒索软件RegretLocker，不止对磁盘上的普通文件进行加密，还搜索VHD文件，使用Windows Virtual Storage API挂载它们，然后对在这些VHD文件中找到的所有文件进行加密

• http://chuongdong.com/reverse%20engineering/2020/11/17/RegretLocker/

[技术]

Decompetition CTF Writeup

• https://medium.com/bugbountywriteup/writeup-to-the-decompetition-capture-the-flag-2020-3a3f14887525

实战可以在端口53上创建反向连接并在必要时执行DNS隧道的工具DNScat2

• https://www.hackingarticles.in/dnscat2-application-layer-cc/

SQL注入攻击与SQL注入利用，Part2

• https://blog.securelayer7.net/sql-injection-attack-and-exploiting-sql-injection-part-2/

在语言解释器中针对堆溢出的灰盒自动化Exp生成

• https://sean.heelan.io/2020/11/18/phd-thesis-greybox-automatic-exploit-generation-for-heap-overflows-in-language-interpreters/

2020年Volatility插件大赛比赛结果

• https://volatility-labs.blogspot.com/2020/11/the-2020-volatility-plugin-contest-results.html

DynamicWrapperEx – Registration-Free In-Process COM Automation Server

• https://www.youtube.com/watch?v=JbQyIcIyOvI

NYX：使用快速快照和仿射类型进行Greybox Hypervisor模糊测试

• https://www.usenix.org/system/files/sec21summer_schumilo.pdf

网络协议（自动化）逆向分析的工具与论文收集

• https://github.com/techge/PRE-list

使用Github工作流程的持续性CTF挑战部署

• https://medium.com/bugbountywriteup/continuous-ctf-challenge-deployments-using-github-workflows-aa8306fd58b6

20201118

[漏洞]

Apache Unomi RCE漏洞（CVE-2020-13942）

• https://www.checkmarx.com/blog/apache-unomi-cve-2020-13942-rce-vulnerabilities-discovered/

思科安全管理器路径遍历漏洞（CVE-2020-27130）

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csm-path-trav-NgeRnqgR
• https://gist.github.com/Frycos/8bf5c125d720b3504b4f28a1126e509e

VoltPillager攻击：通过控制CPU内核电压来破坏Intel SGX飞地的机密性和完整性

• https://zt-chen.github.io/voltpillager/

理解IonMonkey：CVE-2019-9810漏洞根源

• https://doar-e.github.io/blog/2019/06/17/a-journey-into-ionmonkey-root-causing-cve-2019-9810/

[工具]

Goblin：枚举EventLog服务模块（wevtsvc.dll）的所有线程并杀死它们，以使EventLog服务无法注册任何新事件，即使该服务似乎正在运行

• https://github.com/slaeryan/AQUARMOURY/tree/master/Goblin

Brownie：可以快速制作DLL劫持原型并将其武器化的平台

• https://github.com/slaeryan/AQUARMOURY/tree/master/Brownie

Shellycoat：辅助绕过AV/NGAV/EDR/Sandboxes/DLP等使用的用户模式Hooking

• https://github.com/slaeryan/AQUARMOURY/blob/master/Shellycoat

Wraith：为安全隐秘地将Stage-1/Beaconing植入物或Stage-2/Post-Ex植入物铺在内存中铺平道路

• https://github.com/slaeryan/AQUARMOURY/blob/master/Wraith

[技术]

讨论有关流行视频游戏中的作弊行为的最新趋势及其在最新游戏中的流行情况

• https://medium.com/tenable-techblog/hacking-in-among-us-b43ea0fdd3d7

逆向Garmin ConnectIQ虚拟机

• https://www.atredis.com/blog/2020/11/4/garmin-forerunner-235-dion-blazakis

使用JARM轻松识别Internet上的恶意服务器

• https://engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a
• https://github.com/salesforce/jarm

危险的委托OCSP响应者证书（Delegated OCSP Responder Certificate）问题的解决方案

• https://research.kudelskisecurity.com/2020/11/16/a-solution-to-the-dangerous-delegated-responder-certificate-problem/

自动化JavaScript文件侦察

• https://medium.com/bugbountywriteup/javascript-files-recon-23ac49fe6120

深入了解帐户接管：绕过电子邮件网关的钓鱼攻击，导致大规模的危害

• https://www.darkreading.com/edge/theedge/an-inside-look-at-an-account-takeover/b/d-id/1339461

蜜罐综合指南

• https://www.hackingarticles.in/comprehensive-guide-on-honeypots/

使用Radare2分析Shellcode

• https://www.youtube.com/watch?v=gzbC_Etc6vk
• https://github.com/unixfreaxjp/malwaremustdie/blob/master/slides/R2CON2020.pdf

Chrome浏览器的现代攻击：优化和反优化

• https://doar-e.github.io/blog/2020/11/17/modern-attacks-on-the-chrome-browser-optimizations-and-deoptimizations/

优化用于漏洞赏金计划的VDP中的搜索结果：从敏感的信息披露到访问可用于检索客户数据的隐藏API

• https://medium.com/bugbountywriteup/optimizing-hunting-results-in-vdp-for-use-in-bug-bounty-programs-from-sensitive-information-607c55f11ed5

网络犯罪的“日志云”：出售被盗数据访问权的新兴地下业务

• https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/cybercriminal-cloud-of-logs-the-emerging-underground-business-of-selling-access-to-stolen-data

20201117

[漏洞]

Android版Firefox浏览器漏洞，可导致攻击者借助网页从Android设备窃取文件，包括但不限于来自任何已访问网站的cookie（CVE-2020–15647）

• https://medium.com/@kanytu/firefox-and-how-a-website-could-steal-all-of-your-cookies-581fe4648e8d

通过服务器端模板注入的RCE：如何识别远程代码执行漏洞并绕过Akamai WAF规则

• https://cyc10n3.medium.com/rce-via-server-side-template-injection-ad46f8e0c2ae

[恶意代码]

用.NET编写的Jupyter窃密程序，针对基于Chromium的浏览器和Firefox等知名的浏览器

• https://blog.morphisec.com/jupyter-infostealer-backdoor-introduction

研究人员利用WIZVERA VeraPort软件发现一种新颖的Lazarus供应链攻击

• https://www.welivesecurity.com/2020/11/16/lazarus-supply-chain-attack-south-korea/

[工具]

rusolver：用Rust编写的快速DNS解析器，支持多平台

• https://github.com/Edu4rdSHL/rusolver

kerbrute：执行Kerberos预认证暴力破解的工具

• https://github.com/ropnop/kerbrute

OSINT框架：专注于从免费工具或资源中收集信息，目的是帮助人们找到免费的OSINT资源

• https://osintframework.com/

[技术]

逆向被遗忘的1970年代英特尔双核野兽：8271，一个新的ISA

• https://scarybeastsecurity.blogspot.com/2020/11/reverse-engineering-forgotten-1970s.html

域密钥标识邮件（DKIM）是什么，为何谷歌需要定期轮换发布DKIM密钥以消除犯罪分子窃取和泄漏电子邮件的强烈动机

• https://blog.cryptographyengineering.com/2020/11/16/ok-google-please-publish-your-dkim-secret-keys/

在Active Directory环境中使用Impacket的NTLM中继功能

• https://clement.notin.org/blog/2020/11/16/ntlm-relay-of-adws-connections-with-impacket/

自定义修改C&C框架的源码以实现免杀

• https://s3cur3th1ssh1t.github.io/Customizing_C2_Frameworks/

SD-PWN Part2：在Citrix SD-WAN平台中实现远程代码执行

• https://medium.com/realmodelabs/sd-pwn-part-2-citrix-sd-wan-center-another-network-takeover-a9c950a1a27c

使用几行Go代码从头开始实现容器

• https://github.com/rewanth1997/containers-from-scratch

攻击JSON Web Tokens (JWTs)：伪造令牌以获得未经授权的访问

• https://medium.com/bugbountywriteup/attacking-json-web-tokens-jwts-d1d51a1e17cb

在2分钟内禁用WiFi网络的绝妙方法

• https://medium.com/bugbountywriteup/disable-a-wi-fi-access-point-service-9f404fc2dc5f

在CPU的内部：对P6微代码进行逆向

• https://www.youtube.com/watch?v=4oFOpDflJMA

漏洞赏金技巧，Part9

• https://www.infosecmatter.com/bug-bounty-tips-9-nov-16/

绕过了/frame.html以进行注入和渲染的访问限制html，绕过了csp使用元素执行远程javascript文件的权限，绕过了完整性检查并突破了iframe的沙箱来执行alert(origin)

• https://dev.to/pirateducky/wacky-2g84

一种绕过AV检测/阻止对LSASS进程进行凭据转储访问的方法

• https://skelsec.medium.com/duping-av-with-handles-537ef985eb03

20201116

[漏洞]

Forklift <=3.3.9 and <=3.4 Local Privilege Escalations on macOS (CVE-2020-15349/CVE-2020-27192)

• https://insinuator.net/2020/11/forklift-lpe/

[恶意代码]

模块化后门ModPipe，可以通过从Windows注册表值解密来窃取PoS系统数据库的密码

• https://www.welivesecurity.com/2020/11/12/hungry-data-modpipe-backdoor-hits-pos-software-hospitality-sector/

[工具]

Ghidra发布9.2版

• https://ghidra-sre.org/releaseNotes_9.2.html

Damn-Vulnerable-Bank：带漏洞的Android平台银行App，用于详细了解android应用程序的内部和安全性

• https://github.com/rewanth1997/Damn-Vulnerable-Bank

XSS-Scanner：通过注入恶意脚本来扫描网站的XSS漏洞

• https://github.com/MariaGarber/XSS-Scanner

scripthunter：查找网站上的JavaScript文件

• https://github.com/robre/scripthunter

[技术]

逆向经典MK4116 16千位DRAM芯片

• http://www.righto.com/2020/11/reverse-engineering-classic-mk4116-16.html?m=1

解释针对DNS的新攻击SAD DNS，该漏洞是什么，与以前的此类攻击有何关系

• https://blog.cloudflare.com/sad-dns-explained/

如何向任何通信软件中添加端到端加密

• https://soatok.blog/2020/11/14/going-bark-a-furrys-guide-to-end-to-end-encryption/

查找和利用S3 Amazon存储桶以获取漏洞赏金

• https://medium.com/bugbountywriteup/finding-and-exploiting-s3-amazon-buckets-4ce2d501b0d4

Oops, I missed it again!

• https://googleprojectzero.blogspot.com/2020/11/oops-i-missed-it-again.html

如何将一个看似无趣的请求走私漏洞与一个甚至更无趣的基于标题的XSS链接在一起的故事

• https://www.rcesecurity.com/2020/11/Smuggling-an-un-exploitable-xss/

逃避过滤器以执行任意URL重定向攻击

• https://medium.com/bugbountywriteup/evading-filters-to-perform-the-arbitrary-url-redirection-attack-cce628b9b6a0

识别SSL/TLS中的漏洞并对其进行攻击

• https://medium.com/bugbountywriteup/identifying-vulnerabilities-in-ssl-tls-and-attacking-them-e7487877619a

Plundervolt攻击：通过执行飞地计算时的电压，能够破坏Intel Core处理器上Intel SGX的完整性，即使是英特尔SGX的内存加密/身份验证技术也无法防范

• https://plundervolt.com/

使用Sysmon检测已知的DLL劫持和命名管道令牌模拟攻击

• https://labs.jumpsec.com/detecting-known-dll-hijacking-and-named-pipe-token-impersonation-attacks-with-sysmon/

HTB: Intense

• https://0xdf.gitlab.io/2020/11/14/htb-intense.html

20201113

[恶意代码]

新的Skimmer使用WEBSOCKETS和伪造的信用卡形式窃取敏感数据

• https://blogs.akamai.com/2020/11/a-new-skimmer-uses-websockets-and-a-fake-credit-card-form-to-steal-sensitive-data.html

追踪Pay2Key勒索软件的新发现

• https://research.checkpoint.com/2020/pay2key-the-plot-thickens/

[工具]

CobaltStrike：泄露的CobaltStrike源码

• https://github.com/Freakboy/CobaltStrike

devi：使用运行时信息在c++二进制文件中对虚拟调用进行去虚拟化处理

• https://github.com/murx-/devi
• https://insinuator.net/2020/11/reversing-c-without-getting-a-heart-attack-devirtualize-virtual-calls-with-devi/

enum4linux-ng：enum4linux的下一代版本，在Windows、Samba系统上枚举信息

• https://github.com/cddmp/enum4linux-ng

pytmipe：Python库和客户端，用于令牌操作和模拟，在Windows上进行特权升级

• https://github.com/quentinhardy/pytmipe

MacC2：Mac C&C工具，使用内部API调用代替命令行

• https://github.com/cedowens/MacC2

[技术]

MVSC编译器如何生成XFG函数原型哈希

• https://blog.quarkslab.com/how-the-mvsc-compiler-generates-xfg-function-prototype-hashes.html

SAD DNS：经典DNS缓冲投毒攻击的复兴，利用所有现代操作系统中存在的新颖网络侧通道，允许路径外部攻击者将恶意DNS记录注入DNS缓存

• https://www.cs.ucr.edu/~zhiyunq/SADDNS.html

在PyPi上狩猎恶意的包

• https://jordan-wright.com/blog/post/2020-11-12-hunting-for-malicious-packages-on-pypi/

Kubernetes Security Is Not Container Security

• https://blog.alcide.io/kubernetes-security-is-not-container-security

高级MSSQL注入技巧

• https://swarm.ptsecurity.com/advanced-mssql-injection-tricks/

一个SQLi的有趣案例

• https://medium.com/@mrnikhilsri/interesting-case-of-sqli-84cc3f4a5255

2分钟内创建虚假AP

• https://medium.com/bugbountywriteup/creating-a-fake-wireless-acess-point-in-2-minutes-7ff3e8400658

20201112

[漏洞]

Sleep Attack: Intel Bootguard vulnerability waking from S3

• https://trmm.net/Sleep_attack/

无意中在Ubuntu 20.04中发现的提权漏洞

• https://securitylab.github.com/research/Ubuntu-gdm3-accountsservice-LPE

施耐德电气Modicon M221可编程逻辑控制器（PLC）和EcoStruxure Machine Machine Expert Basic中四个漏洞

• https://www.claroty.com/2020/11/10/blog-research-schneider-m221-plcs/

[恶意代码]

RegretLocker勒索软件，可以加密Windows虚拟硬盘

• https://blog.malwarebytes.com/ransomware/2020/11/regretlocker-new-ransomware-can-encrypt-windows-virtual-hard-disks/

[工具]

XPCSniffer：嗅嗅你的iOS设备上的XPC好东西，转储到一个文件和控制台

• https://github.com/evilpenguin/XPCSniffer

Garud：自动化工具，支持扫描子域、子域接管，然后过滤出xss、ssti、ssrf和更多注入点参数

• https://github.com/R0X4R/Garud

[技术]

Bitdefender开源的Shellcode模拟器bdshemu

• https://hvmi.github.io/blog/2020/11/11/bdshemu.html

如何还原 HP 打印机固件，禁止固件自动升级并继续使用第三方碳粉盒

• https://kevin.deldycke.com/2020/11/revert-hp-printer-ban-on-third-party-ink-cartridges/

探索最近的ICMPv6漏洞“Bad Neighbor” 的可利用性（CVE-2020-16898）

• https://blog.zecops.com/vulnerabilities/exploring-the-exploitability-of-bad-neighbor-the-recent-icmpv6-vulnerability-cve-2020-16898/

英特尔融合安全和管理引擎（Intel CSME）安全白皮书

• https://www.intel.com/content/dam/www/public/us/en/security-advisory/documents/intel-csme-security-white-paper.pdf

使用Cloudgoat演练如何通过AWS Elastic Container Service进行数据透视并获得对AWS Elastic File Share的访问权限

• https://rhinosecuritylabs.com/cloud-security/cloudgoat-aws-ecs_efs_attack/

Linux内核漏洞利用：使用QEMU调试内核

• https://blog.k3170makan.com/2020/11/linux-kernel-exploitation-0x0-debugging.html

Introducing osctrl-api

• https://javuto.medium.com/introducing-osctrl-api-715d3ff38d07

HTB Tabby [writeup]

• https://medium.com/bugbountywriteup/htb-tabby-writeup-e5d25fb57329

漏洞赏金Tips收集

• https://gowsundar.gitbook.io/book-of-bugbounty-tips/

Firefox漏洞研究，Part2

• https://blog.exodusintel.com/2020/11/10/firefox-vulnerability-research-part-2/

解密OpenSSH会话

• https://research.nccgroup.com/2020/11/11/decrypting-openssh-sessions-for-fun-and-profit/

20201111

[漏洞]

Linux版Azure Network Watcher Agent（Azure VM扩展） 的提权漏洞（CVE-2020-16995）

• https://www.intezer.com/blog/cloud-security/cve-2020-16995-microsoft-azure-network-watcher-linux-extension/

Bitdefender防病毒引擎脱PE文件的UPX壳时的一系列内存损坏漏洞

• https://landave.io/2020/11/bitdefender-upx-unpacking-featuring-ten-memory-corruptions/

Firefox for Android：基于LAN的Intent触发

• https://blog.mozilla.org/attack-and-defense/2020/11/10/firefox-for-android-lan-based-intent-triggering/

[恶意代码]

勒索软件运营商使用虚假的Microsoft Teams更新来部署Cobalt Strike并破坏目标网络

• https://www.bleepingcomputer.com/news/security/fake-microsoft-teams-updates-lead-to-cobalt-strike-deployment/

新的APT32恶意软件针对柬埔寨政府发动攻击

• https://www.recordedfuture.com/apt32-malware-campaign/
• https://go.recordedfuture.com/hubfs/reports/cta-2020-1110.pdf

[技术]

什么是片上系统（SoC），为什么我们要关心它们是否是开源的？

• https://www.bunniestudios.com/blog/?p=5971

PLATYPUS：在Intel服务器，台式机和笔记本电脑CPU上展示基于软件的新型功率旁通道攻击

• https://platypusattack.com/

Making Mass Effect not require administrator rights, or maybe how not to write a boolean check

• https://www.me3tweaks.com/blog/modding/making-me1-not-require-admin-rights-part-2/

Everyone Talks About Insecure Randomness, But Nobody Does Anything About It

• https://www.airza.net/2020/11/09/everyone-talks-about-insecure-randomness-but-nobody-does-anything-about-it.html

在某网站串联密码重置链接中毒、IDOR和信息泄漏以实现帐户接管

• https://medium.com/bugbountywriteup/chaining-password-reset-link-poisoning-idor-account-information-leakage-to-achieve-account-bb5e0e400745

2020年加密攻击状态报告：分析隐藏在加密流量中的66亿个威胁，以更深入地研究不断发展的攻击技术

• https://info.zscaler.com/resources-industry-reports-state-of-encrypted-attacks

Guardsquare发布2020年全球报告，重点介绍跨操作系统的移动应用程序不安全

• https://insights.guardsquare.com/state-of-mobile-application-security-report

20201110

[漏洞]

使用闪存驱动器接管TP-Link：制作符号链接以扎根TP-Link AC1750(CVE-2020-5795)

• https://medium.com/tenable-techblog/tp-link-takeover-with-a-flash-drive-d493666f6b39
• https://www.tenable.com/security/research/tra-2020-60

银峰Unity协调器RCE漏洞

• https://medium.com/realmodelabs/silver-peak-unity-orchestrator-rce-2928d65ef749

世界第三大电视制造商TCL的Android电视中发现了非常多的漏洞

• https://sick.codes/extraordinary-vulnerabilities-discovered-in-tcl-android-tvs-now-worlds-3rd-largest-tv-manufacturer/

Wordpress插件Ultimate Member严重提权漏洞，影响10万网站

• https://www.wordfence.com/blog/2020/11/critical-privilege-escalation-vulnerabilities-affect-100k-sites-using-ultimate-member-plugin/

[恶意代码]

一些自定义恶意软件格式的解析器

• https://github.com/hasherezade/funky_malware_formats

xHunt攻击行动：在入侵科威特一家组织的Microsoft Exchange Server时使用的新后门TriFive和Snugy，使用删除的电子邮件草稿和DNS隧道进行C&C

• https://unit42.paloaltonetworks.com/xhunt-campaign-backdoors/

黑客组织Guildma将银行木马Tétrade迁移到移动平台

• https://securelist.com/ghimob-tetrade-threat-mobile-devices/99228/

Discord.dll: successor to npm “fallguys” malware went undetected for 5 months

• https://blog.sonatype.com/discord.dll-successor-to-npm-fallguys-

[工具]

xpcspy：针对iOS和macOS的双向XPC消息拦截，基于Frida

• https://github.com/hot3eed/xpcspy

N1QLMap：通过利用N1QL注入漏洞从Couchbase数据库中窃取数据

• https://github.com/FSecureLABS/N1QLMap

routopsy：用于攻击经常被忽视的网络协议的工具包，例如动态路由协议（DRP）和第一跳冗余协议（FHRP）

• https://github.com/sensepost/routopsy

PCWT：辅助渗透测试和漏洞赏金的Web应用

• https://github.com/ascr0b/PCWT

linux-evil-toolkit：一个旨在为渗透测试专家集中，标准化和简化各种安全工具使用的框架

• https://github.com/th3void/linux-evil-toolkit

[技术]

逆向Web应用程序的10个想法

• http://thehazarika.com/blog/programming/how-to-reverse-engineer-web-apps/

使用Brim客户端和Zeek狩猎银行木马Emotet

• https://medium.com/brim-securitys-knowledge-funnel/hunting-emotet-with-brim-and-zeek-1000c2f5c1ff

Etherify：bringing the ether back to ethernet

• https://lipkowski.com/etherify/
• https://github.com/sq5bpf/etherify
• https://youtu.be/ueC4SLPrtNg

Wow64 Hook：WOW64子系统内部原理与Hooking技术

• https://www.fireeye.com/blog/threat-research/2020/11/wow64-subsystem-internals-and-hooking-techniques.html

20201109

[漏洞]

Facebook网站使用postMessage实现基于DOM的XSS

• https://ysamm.com/?p=493

[恶意代码]

僵尸网络Gitpaste-12通过GitHub和Pastebin传播

• https://www.bleepingcomputer.com/news/security/reverse-shell-botnet-gitpaste-12-spreads-via-github-and-pastebin/

北极星行动：幕后花絮

• https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-behind-the-scenes/

[工具]

ghinja：在BinaryNinja中嵌入Ghidra反编译器

• https://github.com/Martyx00/ghinja

gsocket：全局套接字，允许NAT/防火墙后面的两个用户彼此建立安全的TCP连接

• https://github.com/hackerschoice/gsocket

pigasus：入侵检测和防御系统（IDS / IPS），使用一台配备FPGA的服务器即可达到100Gbps

• https://github.com/cmu-snap/pigasus

ashirt-server：Adversary Simulators High-Fidelity Intelligence and Reporting Toolkit

• https://github.com/theparanoids/ashirt-server

threagile：威胁建模工具，允许直接在IDE内部以YAML文件的形式灵活地使用其资产对体系结构进行建模

• https://github.com/Threagile/threagile

showstopper：帮助恶意软件研究人员探索和测试反调试技术，或验证调试器插件，或其他与标准反调试方法冲突的解决方案

• https://github.com/CheckPointSW/showstopper

SSLBypass：在iOS8-14中绕过SSL证书绑定

• https://github.com/evilpenguin/SSLBypass

APKProxyHelper：paches an apk for proxying

• https://github.com/evilpenguin/APKProxyHelper

tempomail：1秒钟内创建临时邮件并接收邮件

• https://github.com/kavishgr/tempomail

XAPKDetector：跨平台安卓分析工具包

• https://github.com/horsicq/XAPKDetector

[技术]

bddisasm：快速、轻巧的x86 / x64指令解码器

• https://hvmi.github.io/blog/2020/11/04/bddisasm.html

如何在各种配置中使用timeless分析来测量Windows 10的后台活动

• https://blog.tetrane.com/2020/Profiling_Windows_10_Execution.html

基于kubectl命令的红队备忘单

• https://github.com/lightspin-tech/red-kube

攻击Java中的URL类

• https://blog.pwnl0rd.me/post/lfi-netdoc-file-java/

使用Nitro Enclaves构建极其安全的密码存储机制

• https://www.sentiatechblog.com/ultra-secure-password-storage-with-nitropepper
• https://github.com/donkersgoed/nitropepper-enclave-app

使用Burp渗透，Part2：使用Intruder进行Fuzzing

• https://www.hackingarticles.in/burpsuite-for-pentester-fuzzing-with-intruder-part-2/

Metasploit清单

• https://www.comparitech.com/fr/net-admin/metasploit-cheat-sheet/

了解黑客清除其物理痕迹（清除存储在硬件设备和存储介质上的数字信息）所使用的方法

• https://medium.com/bugbountywriteup/anatomy-of-disk-recovery-evasion-5c2e31580ad4

Splunking with Sysmon，Part3：在您的环境中检测PsExec

• https://hurricanelabs.com/splunk-tutorials/splunking-with-sysmon-part-3-detecting-psexec-in-your-environment/

GDA漏洞扫描引擎，由漏洞检测引擎和规则解释引擎组成

• https://github.com/charles2gan/GDA-android-reversing-Tool/wiki/GDA-Vulnerability-Scanner

通过网络管道攻击Kubernetes集群，Part1

• https://www.cyberark.com/resources/threat-research-blog/attacking-kubernetes-clusters-through-your-network-plumbing-part-1

FTK Imager的全面指南

• https://www.hackingarticles.in/comprehensive-guide-on-ftk-imager/

Flare-On 2020 Solutions Write-Ups

• http://tonyweb.xyz/index.php/2020/11/07/flare-on-2020-solutions-write-ups/

CSRF漏洞理解与利用

• https://medium.com/bugbountywriteup/understanding-exploiting-cross-site-request-forgery-csrf-vulnerabilities-935952375b71

使用Volatility Workbench进行内存审计

• https://www.hackingarticles.in/memory-forensics-using-volatility-workbench/

对英特尔8008处理器中的超前进位电路进行逆向

• http://www.righto.com/2020/11/reverse-engineering-carry-lookahead.html

命令注入漏洞利用

• https://gupta-bless.medium.com/exploiting-command-injection-114b4c3e5a6e

localbrute.ps1：用纯PowerShell编写的简单本地Windows帐户爆破工具

• https://www.infosecmatter.com/minimalistic-local-admin-bruteforcer-windows-privilege-escalation/

从恶意文档中快速提取所有VBA代码

• https://isc.sans.edu/diary/rss/26772

20201106

[漏洞]

GitHub Desktop远程执行代码漏洞

• https://blog.blazeinfosec.com/attack-of-the-clones-github-desktop-remote-code-execution/

Git大文件存储（git-lfs）远程执行代码漏洞

• https://legalhackers.com/advisories/Git-LFS-RCE-Exploit-CVE-2020-27955.html

我如何在Brave浏览器内发现了一个Tor漏洞 (CVE-2020-8276)

• https://community.disclose.io/t/how-i-found-a-tor-vulnerability-in-brave-browser-reported-it-watched-it-get-patched-got-a-cve-cve-2020-8276-and-a-small-bounty-all-in-one-working-day/65

[恶意代码]

INJ3CTOR3行动：检查攻击者使用的感染媒介以及所利用的漏洞，调查活动背后的威胁参与者，解释他们的作案手法

• https://research.checkpoint.com/2020/inj3ctor3-operation-leveraging-asterisk-servers-for-monetization/
• https://blog.checkpoint.com/2020/11/05/whos-calling-gaza-and-west-bank-hackers-exploit-and-monetize-corporate-voip-phone-system-vulnerability-internationally/

[工具]

SwiftyInsta：Instagram私有API，Swift版本

• https://github.com/TheM4hd1/SwiftyInsta

sammler：从文档中提取出有用的信息

• https://github.com/redcode-labs/sammler

KaiMonkey：提供一个脆弱基础设施的示例，以辅助探索和理解通过基础设施作为代码暴露的常见云安全威胁

• https://github.com/accurics/KaiMonkey

brutto：简易、通用的爆破工具

• https://github.com/jofpin/brutto

[技术]

FCSC CTF：逆向混淆代码

• https://therealunicornsecurity.github.io/Keykoolol/

Pwn2Own Tokyo 2020，第一天

• https://www.youtube.com/watch?v=jX0b8iKXnbI

Linux进程的生与死

• https://natanyellin.com/posts/life-and-death-of-a-linux-process/

Android平台拦截- httpS流量

• https://- httptoolkit.tech/blog/intercepting-android-- https/

PowerShell中绕过AMSI：一个很好的案例研究

• https://medium.com/bugbountywriteup/bypass-amsi-in-powershell-a-nice-case-study-f3c0c7bed24d

使用串行bootloader在STM32上读取和写入固件

• https://cybergibbons.com/hardware-hacking/reading-and-writing-firmware-on-an-stm32-using-the-serial-bootloader/

20201105

[漏洞]

思科AnyConnect安全移动客户端任意代码执行漏洞(CVE-2020-3556)

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-ipc-KfQO9QhK

Solaris中的缓冲区溢出漏洞可能导致远程接管— CVE-2020-14871

• https://www.fireeye.com/blog/threat-research/2020/11/critical-buffer-overflow-vulnerability-in-solaris-can-allow-remote-takeover.html

BIDS应用程序和Boutique容器的安全漏洞分析

• https://github.com/big-data-lab-team/container-vulnerabilities-paper

[恶意代码]

新的APT使用DLL旁加载用于执行恶意代码

• https://news.sophos.com/en-us/2020/11/04/a-new-apt-uses-dll-side-loads-to-killlsomeone/

QBot银行木马使用电子邮件劫持技术，再次引发了垃圾邮件的浪潮

• https://blog.malwarebytes.com/cybercrime/2020/11/qbot-delivered-via-malspam-campaign-exploiting-us-election-uncertainties/

2020年第3季度APT趋势报告

• https://securelist.com/apt-trends-report-q3-2020/99204/

诈骗者使用265种不同的Google表格来欺骗毫无戒心的顶级品牌用户

• https://blog.zimperium.com/scammers-used-265-different-google-forms-to-dupe-unsuspecting-users-of-top-brands/

[技术]

Writeup: FlareOn 2020: 006 - codeit

• https://whitehatlab.eu/en/blog/writeup/flareon/2020/006-codeit/

使用/proc/maps在Android应用程序中检测动态加载

• https://sayfer.io/blog/dynamic-loading-in-android-applications-with-proc-maps/

通过一个Debug会话调试Bootloader和应用程序

• https://mcuoneclipse.com/2020/11/03/debugging-bootloader-and-application-with-one-debug-session/

AggressiveProxy：两个代理和一个悲惨的beacon的故事

• https://medium.com/encode-threat-labs/aggressiveproxy-a-tale-of-two-proxies-and-a-sad-beacon-43042a04a0d0

使用SWD在STM32上读写固件

• https://cybergibbons.com/hardware-hacking/reading-and-writing-firmware-on-an-stm32-using-swd/

DICOM文件安全性：恶意软件如何隐藏在受HIPAA保护的图像后面

• https://votiro.com/blog/dicom-file-security-how-malware-can-hide-behind-hipaa-protected-images/

Office 365网络钓鱼：使用图像反转绕过检测

• https://www.wmcglobal.com/blog/office-365-phishing-uses-image-inversion-to-bypass-detection

利用卷积神经网络的可解释性能力，对恶意代码进行可视化

• https://www.crowdstrike.com/blog/malware-through-the-eyes-of-a-convolutional-neural-network/

20201104

[漏洞]

Apache Tomcat WebSocket漏洞Exploit（CVE-2020-13935）

• https://github.com/RedTeamPentesting/CVE-2020-13935

[恶意代码]

黑客组织UNC1945针对Oracle Solaris操作系统，利用Windows和Linux操作系统的多种工具和实用程序，加载和运行自定义虚拟机，并采用了逃避检测的技术

• https://www.fireeye.com/blog/threat-research/2020/11/live-off-the-land-an-overview-of-unc1945.html

[工具]

forkever：Fork Free Fail Repeat

• https://github.com/haxkor/forkever

Instagram-Bot：使用Selenium框架开发的Instagram机器人

• https://github.com/mustafadalga/Instagram-Bot

git-dumper：从网站转储git存储库

• https://github.com/arthaud/git-dumper

cb-multios ：DARPA挑战二进制文件（CB），是专门设计的程序，旨在包含代表各种导致软件崩溃的漏洞

• https://github.com/trailofbits/cb-multios

rengine：一个自动侦察框架，用于在Web应用程序的渗透测试期间收集信息

• https://github.com/yogeshojha/rengine

GitHack：一个.git泄露利用脚本，通过泄露的.git文件夹下的文件，重建还原工程源代码

• https://github.com/lijiejie/GitHack

[技术]

Writeup to the FLARE-ON 7 Challenge

• https://medium.com/bugbountywriteup/writeup-to-the-flare-on-7-challenge-47c8d2ef3366

使用Python自动化目录Fuzzing

• https://medium.com/bugbountywriteup/directory-fuzzing-24265834552b

漏洞赏金案例：.git文件夹泄漏导致RCE

• https://james-clee.com/2020/11/01/leaked-git-folder-leads-to-rce/

使用Burp为Web和android应用程序设置代理

• https://www.hackingarticles.in/burp-suite-for-pentester-configuring-proxy/

TryHackMe- ToolsRus CTF Writeup (Detailed)

• https://medium.com/bugbountywriteup/tryhackme-toolsrus-ctf-writeup-detailed-a995fd0a6293

20201103

[资讯]

注重隐私的社交网络应用程序True Social由于配置错误使其一台服务器暴露在外, 泄露了成千上万个用户的敏感数据

• https://www.hackread.com/privacy-focused-true-social-network-user-data/

[漏洞]

ServiceStack的一个JWT认证绕过漏洞

• https://www.shielder.it/blog/2020/11/re-discovering-a-jwt-authentication-bypass-in-servicestack/

Windows Microsoft Store游戏的提权漏洞（CVE-2020-16877）

• https://labs.ioactive.com/2020/11/cve-2020-16877-exploiting-microsoft.html

深入解析Apache Tomcat的一个WebSocket漏洞

• https://blog.redteam-pentesting.de/2020/websocket-vulnerability-tomcat/

OAuth协议实施不当导致100万互联网银行帐户存在被接管的风险

• https://medium.com/bugbountywriteup/internet-bank-account-takeover-of-1m-users-real-scenario-e119a6a3267d

[恶意代码]

EGREGOR勒索软件：深入了解其活动和技术

• https://cybleinc.com/2020/10/31/egregor-ransomware-a-deep-dive-into-its-activities-and-techniques/

分析朝鲜APT组织使用的间谍软件套件Kimsuky KGH

• https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite

Trick or treat: that twilio-npm package is brandjacking malware in disguise!

• https://blog.sonatype.com/twilio-npm-is-brandjacking-malware-in-disguise

[工具]

python框架，可与汽车行业中使用的规范化协议（CAN，ISOTP，UDS）进行交互

• https://www.youtube.com/watch?v=Myp4-RsdE-Y
• https://github.com/renault/cananalyze

pi-pwnbox-rogueap：自制流氓AP，基于树莓派

• https://github.com/koutto/pi-pwnbox-rogueap

[技术]

如何分析历史集成电路中的结构并理解它们

• https://www.youtube.com/watch?v=KohIewYHHMY

通过进行一些工程设计，使通过化学过程提取固件的过程自动化

• https://www.youtube.com/watch?v=vbWGjzsY44w

分析内存和缓存子系统，并研究英特尔在两个异构FPGA-CPU平台上启用的Rowhammer和缓存攻击

• https://www.youtube.com/watch?v=BpocgiNuJKY

从在线视频游戏作弊中获得的启示，Part2

• https://labs.bishopfox.com/industry-blog/cheating-at-online-video-games-part-2

容器安全实用介绍

• https://cloudberry.engineering/article/practical-introduction-container-security/

利用- http请求走私

• https://gupta-bless.medium.com/exploiting-- http-request-smuggling-71a629e68dfe

崩溃重现系列：Microsoft Edge传统

• https://blog.zecops.com/vulnerabilities/crash-reproduction-series-microsoft-edge-legacy/

20201102

[资讯]

Let's Encrypt刚刚发布了许多新证书，包括新的根证书和一些中间产品

• https://scotthelme.co.uk/lets-encrypts-new-root-and-intermediate-certificates/

[漏洞]

Windows内核缓冲区溢出漏洞发现在野利用(CVE-2020-17087)

• https://bugs.chromium.org/p/project-zero/issues/detail?id=2104

CVE-2020-16889：Windows KernelStream处理内存对象时的信息泄露漏洞

• https://github.com/nghiadt1098/MyResearch/tree/main/CVE-2020-16889

[恶意代码]

使用Discord做C&C的远控Abaddon

• https://github.com/MalPhobic/MalwareReports/blob/main/AbbadonRAT/Abbadon_RAT.pdf

[工具]

nfcgate：用于捕获、分析或修改NFC流量的Android应用程序

• https://github.com/nfcgate/nfcgate

paradoxiaRAT：Windows远控工具

• https://github.com/quantumcored/paradoxiaRAT

Nethive-Project：由CVSS自动测量支持的安全信息和事件管理（SIEM）基础结构

• https://github.com/chrisandoryan/Nethive-Project

ReconNote：eb应用程序安全自动化框架，可重新定义各种资产的目标，以最大程度地提高安全专业人员和错误猎人的攻击面

• https://github.com/0xdekster/ReconNote

[技术]

Flare-On 7 2020 Write-Ups

• https://eviatargerzi.medium.com/flare-on-7-2020-write-ups-4342fb819039

逆向3D电影制作器，Part3：脚本引擎

• https://benstoneonline.com/posts/reverse-engineering-3d-movie-maker-part-three/

关于反编译程序的符号执行

• https://divine.fi.muni.cz/2020/decompile/

使用Linux 审计 API跟踪进程

• https://natanyellin.com/posts/using-linux-audit-to-track-processes/

探索一系列流行的媒体流Roku

• https://adtechmadness.wordpress.com/2020/11/01/attacking-roku-sticks-for-fun-and-profit/

NAT Slipstreaming：攻击者可以仅通过受害者访问网站来绕过受害者的NAT /防火墙（任意防火墙针孔控制），来远程访问绑定到受害者计算机的任何TCP / UDP服务

• https://samy.pl/slipstream/

以书信（epistolary）方式进行黑客攻击：在纯VBA中实现kerberoast

• https://adepts.of0x.cc/kerberoast-vba-macro/

GoLang包Fuzzing工具go-fuzz入门

• https://adalogics.com/blog/getting-started-with-go-fuzz

HTB Fuse writeup：域控制器侦察、密码喷雾、暴力攻击、SeLoadDriver特权滥用

• https://medium.com/bugbountywriteup/htb-fuse-writeup-2c181d837b78

在Apple III中使用的堆叠RAM模块内部

• http://www.righto.com/2020/10/inside-stacked-ram-modules-used-in.html

使用C# Shellcode和ConfuserEx绕过UAC

• https://hausec.com/2020/10/30/using-a-c-shellcode-runner-and-confuserex-to-bypass-uac-while-evading-av/

识别和升级- http主机头注入攻击

• https://medium.com/bugbountywriteup/identifying-escalating-- http-host-header-injection-attacks-7586d0ff2c67

20201030

[漏洞]

用于电子健康记录和医疗实践管理的开源软件OpenEMR的3个漏洞

• https://blog.sonarsource.com/openemr-5-0-2-1-command-injection-vulnerability

CVE-2020–14882 Weblogic Unauthorized bypass RCE

• https://github.com//jas502n//CVE-2020-14882

[恶意代码]

Firestarter恶意软件使用Google Firebase Cloud Messaging通知其作者有效负载的最终位置，即使删除了C2，DoNot团队仍可以使用Google基础结构将恶意软件重定向到另一个C2

• https://blog.talosintelligence.com/2020/10/donot-firestarter.html

针对医疗保健和公共卫生部门的勒索软件活动

• https://us-cert.cisa.gov/ncas/alerts/aa20-302a

Android远控AhMyth报告

• https://github.com/quark-engine/quark-reports/blob/main/AhMyth_Report-Quark-Engine.pdf

Unhappy Hour Special: KEGTAP and SINGLEMALT With a Ransomware Chaser

• https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html

[工具]

scrying：将RDP、Web和VNC屏幕截图全部收集到一起的工具

• https://github.com/nccgroup/scrying

checkra1n 11.0补丁，用于为运行iOS 14的A10和A11设备启用越狱功能

• https://github.com/Exploite-d/checkra1n_patch_A10_A11

漏洞赏金中的javascript侦查自动化

• https://github.com/KathanP19/JSFScan.sh

[技术]

Writeup: FlareOn 2020: 005 - TKApp

• https://whitehatlab.eu/en/blog/writeup/flareon/2020/005-tkapp/

研究网游作弊，以及它可以教给我们有关AppSec的知识，Part1

• https://labs.bishopfox.com/industry-blog/cheating-at-online-video-games-part-1

Zoom的端到端加密中的奇异设计选择

• https://soatok.blog/2020/10/28/bizarre-design-choices-in-zooms-end-to-end-encryption/

内存审计：使用Volatility框架

• https://www.hackingarticles.in/memory-forensics-using-volatility-framework/

使用LD_PRELOAD劫持rand()函数

• https://blog.secureideas.com/2020/10/not-so-random-using-ld_preload-to-hijack-the-rand-function.html
• https://github.com/ProfessionallyEvil/LD_PRELOAD-rand-Hijack-Example

20201029

[漏洞]

CVE-2020-15999

• https://github.com/marcinguy/CVE-2020-15999

[恶意代码]

朝鲜APT组织Kimsuky

• https://us-cert.cisa.gov/ncas/alerts/aa20-301a

与伊朗联系的APT瞄准T20峰会、慕尼黑安全会议与会者

• https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/

[工具]

Frida发布14.0版，具有基于QuickJS的全新运行时，并且在所有平台上的二进制文件都小得多

• https://frida.re/news/2020/10/28/frida-14-0-released/

earlybird：敏感的数据检测工具，能够扫描源代码存储库，以清除明文密码违规、PII、过时的加密方法、密钥文件等

• https://github.com/americanexpress/earlybird

grype：针对容器镜像和文件系统的漏洞扫描器

• https://github.com/anchore/grype

ThreatPursuit-VM：继FLARE-VM和Commando VM之后，火眼发布的用于威胁情报分析和狩猎的基于Windows的虚拟机

• https://github.com/fireeye/ThreatPursuit-VM
• https://www.fireeye.com/blog/threat-research/2020/10/threatpursuit-vm-threat-intelligence-and-hunting-virtual-machine.html

[技术]

使用DTrace跟踪内核函数：FBT stack()和内置arg变量的实现

• https://zinascii.com/2020/fbt-args-and-stack.html

Writeup: FlareOn 2020: 004 - report

• https://whitehatlab.eu/en/blog/writeup/flareon/2020/004-report/

在字节级别探索ELF格式，理解ELF如何工作

• https://www.youtube.com/watch?v=nC1U1LJQL8o

网络数据透视和隧道指南

• https://catharsis.net.au/blog/network-pivoting-and-tunneling-guide/

逆向最新版本的Pulse Secure Connect客户端的凭证存储

• https://quentinkaiser.be/reversing/2020/10/27/pule-secure-credentials/

使用Dalfox和Paramspider自动进行XSS识别

• https://medium.com/bugbountywriteup/automating-xss-identification-with-dalfox-paramspider-e14283bb7916

Android安全资源收集

• https://github.com/saeidshirazi/awesome-android-security

WebGoat客户端课程

• https://medium.com/bugbountywriteup/webgoat-client-side-lessons-4a75d3bf28da

TryHackMe- Lian_Yu CTF Writeup (Detailed)

• https://medium.com/bugbountywriteup/tryhackme-lian-yu-ctf-writeup-detailed-7c229b1904fd

SQL注入与SQL注入漏洞利用

• https://blog.securelayer7.net/sql-injection-and-exploiting-sql-injection-part-1/

即使在修复CVE-2020-1317漏洞之后，仍然可以通过滥用组策略客户端中的联结和Set Security调用实现SYSTEM提权

• https://decoder.cloud/2020/10/27/when-a-stupid-oplock-leads-you-to-system/

Web缓存纠缠：投毒的新途径

• https://blog.detectify.com/2020/10/27/web-cache-entanglement-novel-pathways-to-poisoning/

可用于渗透的PowerShell命令

• https://www.infosecmatter.com/powershell-commands-for-pentesters/

20201028

[漏洞]

Windows组策略DACL覆盖权限升级漏洞详情（CVE-2020-16939）

• https://www.zerodayinitiative.com/blog/2020/10/27/cve-2020-16939-windows-group-policy-dacl-overwrite-privilege-escalation

Ubuntu桌面版中三个CVE的故事

• https://www.eyecontrol.nl/blog/the-story-of-3-cves-in-ubuntu-desktop.html

知名的聊天应用程序，包括LINE、Slack、Twitter DM等，可能泄漏位置数据并与第三方服务器共享私人信息

• https://www.mysk.blog/2020/10/25/link-previews/

偶然观察到的严重IDOR漏洞

• https://medium.com/bugbountywriteup/accidental-observation-to-critical-idor-d4d910a855bf

[工具]

taser：Python资源库，用于简化创建攻击性安全工具的过程，尤其是那些与Web或外部评估有关的工具

• https://github.com/m8r0wn/taser

invoke-antivm：用于虚拟机检测和逃逸的PowerShell脚本

• https://github.com/robomotic/invoke-antivm

jsmon：JavaScript修改监控工具，可用于漏洞赏金

• https://github.com/robre/jsmon

decoder-plus-plus：将数据解码/编码为各种格式

• https://github.com/bytebutcher/decoder-plus-plus

jwt-hack：对JWT进行安全测试，支持对JWT进行编码/解码，为JWT攻击和非常快速的破解生成有效载荷（dict / brutefoce）

• https://github.com/hahwul/jwt-hack

py3webfuzz：用于辅助Web应用程序Fuzzing的Python3库

• https://github.com/jangelesg/py3webfuzz

[技术]

Writeup: FlareOn 2020: 003 - wednesday

• https://whitehatlab.eu/en/blog/writeup/flareon/2020/003-wednesday/

使用Python从头开始设计符号测试生成器的原型

• https://www.fuzzingbook.org/beta/html/PrototypingWithPython.html

失落但未被遗忘的故事，未记录的NetSync，Part1

• https://www.trustedsec.com/blog/the-tale-of-the-lost-but-not-forgotten-undocumented-netsync-part-1/

Chrome中一个textbook UAF漏洞的利用

• https://securitylab.github.com/research/CVE-2020-6449-exploit-chrome-uaf

滥用Teams客户端协议绕过Teams安全策略

• https://o365blog.com/post/teams-policies/

有关如何修改或提取Python源代码的几种方法

• https://rushter.com/blog/python-code-isolation/

绕过WAF以执行Error-Based SQL注入

• https://medium.com/bugbountywriteup/bypassing-waf-to-do-error-based-sql-injection-dd52773a66d3

事件响应详解

• https://searchsecurity.techtarget.com/definition/incident-response

20201027

[漏洞]

Ruckus IoT控制器中的远程命令执行（CVE-2020-26878和CVE-2020-26879）

• https://adepts.of0x.cc/ruckus-vriot-rce/

Citrix ADC（Netscaler ADC）多因素身份验证绕过漏洞

• https://vdalabs.com/2020/10/26/citrix-adc-netscaler-adc-multi-factor-bypass/

Pulse Connect Secure：通过登录消息读取任意文件（CVE-2020-8255）

• https://research.nccgroup.com/2020/10/26/technical-advisory-pulse-connect-secure-arbitrary-file-read-via-logon-message-cve-2020-8255/

Genexis Platinum-4410路由器存储型XSS漏洞

• https://exploit.kitploit.com/2020/10/genexis-platinum-4410-cross-site.html

[工具]

pongoOS：基于checkra1n构建的苹果板的预引导执行环境。

• https://github.com/checkra1n/pongoOS

[技术]

使用Cheat Engine在Packet Tracer中作弊

• https://ferib.dev/blog.php?l=post/Cheating_Your_Grades_with_Cheat_Engine__The_Roast_of_Packet_Tracer

漏洞利用开发者聚焦：PlayBit的故事

• https://research.checkpoint.com/2020/graphology-of-an-exploit-playbit/

Writeup: FlareOn 2020: 002 – garbage

• https://whitehatlab.eu/en/blog/writeup/flareon/2020/002-garbage/

Process Herpaderping：通过在映像映射后修改磁盘上的内容来掩盖进程意图，绕过安全软件检测

• https://jxy-s.github.io/herpaderping/
• https://github.com/jxy-s/herpaderping

网络层上的Active Directory（AD）攻击和枚举

• https://www.lares.com/blog/active-directory-ad-attacks-enumeration-at-the-network-layer/

通过U-boot恢复固件

• https://cybergibbons.com/hardware-hacking/recovering-firmware-through-u-boot/

介绍Shellbag和使用Shellbag Explorer进行取证分析

• https://www.hackingarticles.in/forensic-investigation-shellbags/

20201026

[资讯]

大量的美国选民和消费者数据库在黑客之间流传，卖家声称选民数据包括1.86亿条记录，如果正确，则意味着包含了几乎美国所有选民的信息。

• https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/massive-us-voters-and-consumers-databases-circulate-among-hackers/

印度婚礼策划网站WedMeGood近134万用户数据在一个俄语论坛泄露，泄露文件的大小约为500MB，包括电子邮件ID、密码哈希、联系电话和活动记录等

• https://cybleinc.com/2020/10/24/indian-wedding-planning-website-wedmegood-breached-1-34-million-accounts-leaked-in-darkweb/

[恶意代码]

Gacrux：C语言编写的具有自定义PE加载程序的恶意软件

• https://krabsonsecurity.com/2020/10/24/gacrux-a-basic-c-malware-with-a-custom-pe-loader/

Abaddon远控，使用Discord做C&C

• https://twitter.com/malwrhunterteam/status/1319236824070500353

[工具]

Binary Ninja发布2.2版

• https://binary.ninja/2020/10/22/2.2-release.html

wsb-detect：检测程序是否运行在Windows沙箱中

• https://github.com/LloydLabs/wsb-detect

FAMA：集成了Autopsy模块的Android提取和分析框架，可以轻松地从设备中转储用户数据，并为Autopsy或外部应用程序生成报告

• https://github.com/labcif/FAMA

Pesidious：使用人工智能来变异PE32恶意样本，以绕过AI支持的分类器，同时保持其功能完整

• https://github.com/CyberForce/Pesidious

CertEagle：武器化实时CT日志以自动监视资产

• https://github.com/devanshbatham/CertEagle
• https://medium.com/@Asm0d3us/weaponizing-live-ct-logs-for-automated-monitoring-of-assets-39c6973177c7

manuka：OSINT蜜罐，用于监视威胁行为者的侦察企图并为Blue Teamers生成可操作的情报

• https://github.com/spaceraccoon/manuka

bucky：自动化S3存储桶发现工具

• https://github.com/smaranchand/bucky

[技术]

2020 Flare-On CTF challenges Writeups

• https://github.com/LeoCodes21/ctf-writeups/tree/main/Flare-On%202020

漏洞研究简介：调试与WinDBG简介

• https://suchsecurity.com/intro-to-vulnerability-research-debugging-and-intro-to-windbg.html

了解有关有效的社会工程事件响应计划的关键点，以隔离危险并控制后果

• https://www.lykosec.com/blog/social-engineering-incident-response

采购硬件黑客工具包

• https://cybergibbons.com/hardware-hacking/sourcing-a-hardware-hacking-toolkit/

从嵌入式设备中拷贝固件

• https://cybergibbons.com/hardware-hacking/copying-firmware-from-embedded-devices/

TryHackMe- Ignite CTF Writeup (Detailed)

• https://medium.com/bugbountywriteup/tryhackme-ignite-ctf-writeup-detailed-67a4adba148b

引导加载如何使历史悠久的Intel 8008处理器成为可能

• http://www.righto.com/2020/10/how-bootstrap-load-made-historic-intel.html

20201023

[资讯]

荷兰研究员Victor Gevers使用MAGA2020登陆了特朗普总统的个人Twitter帐户，并注意到其账户没有使用2FA

• https://www.hackread.com/researcher-logs-trump-twitter-password-maga2020/

[漏洞]

详细介绍两个VMWare WorkStation toctou漏洞

• https://www.zerodayinitiative.com/blog/2020/10/22/detailing-two-vmware-workstation-toctou-vulnerabilities

[恶意代码]

伊朗APT组织影响和干扰美国大选

• https://us-cert.cisa.gov/ncas/alerts/aa20-296b

有俄罗斯政府背景的APT组织以美国政府为攻击目标

• https://us-cert.cisa.gov/ncas/alerts/aa20-296a

KashmirBlack僵尸网络的犯罪活动，part2

• https://www.imperva.com/blog/crimeops-of-the-kashmirblack-botnet-part-ii/

On the trail of the XMRig miner

• https://securelist.com/miner-xmrig/99151/

Malware of the Day – APT1 Virtually There

• https://www.activecountermeasures.com/malware-of-the-day-apt1-virtually-there/

[工具]

asthook：APK静态和动态分析

• https://gitlab.com/MadSquirrels/mobile/asthook
• https://madsquirrels.gitlab.io/mobile/asthook/

从多个平台收集的大量恶意代码的源码

• https://github.com/vxunderground/MalwareSourceCode

advmlthreatmatrix：辅助抵御对抗性AI攻击的框架

• https://github.com/mitre/advmlthreatmatrix
• https://venturebeat.com/2020/10/22/microsoft-and-mitre-release-framework-to-help-fend-off-adversarial-ai-attacks/

[技术]

我们如何将用户经历的几起事件与大规模的广告注入活动联系起来

• https://www.perimeterx.com/tech-blog/2020/the-missing-lnkr/

如何对Pagefile.sys文件进行取证调查

• https://www.hackingarticles.in/forensic-investigation-pagefile-sys/

用GPU构建高性能的模糊器

• https://blog.trailofbits.com/2020/10/22/lets-build-a-high-performance-fuzzer-with-gpus/

使用Splunk Enterprise Security查找Zerologon攻击尝试

• https://hurricanelabs.com/splunk-tutorials/using-splunk-enterprise-security-to-look-for-zerologon-exploit-attempts/

针对初学者的Azure密码收集指南

• https://blog.netspi.com/a-beginners-guide-to-gathering-azure-passwords/

Typo 1: VulnHub CTF walkthrough (part 2)

• https://resources.infosecinstitute.com/typo-1-vulnhub-ctf-walkthrough-part-2/

GitHub存储库劫持：利用供应链

• https://blog.securityinnovation.com/repo-jacking-exploiting-the-dependency-supply-chain

20201022

[漏洞]

企业VPN解决方案Citrix Gateway插件中发现的多个提权漏洞

• https://cymptom.com/gateway2hell-multiple-privilege-escalation-vulnerabilities-in-citrix-gateway-plug-in/2020/10/

Telerik UI ASP.NET AJAX的RadAsyncUpload (RAU)组件的.NET反序列化漏洞

• https://packetstormsecurity.com/files/159653/telerik_rau_deserialization.rb.txt

移动端浏览器中的多个地址欺骗漏洞

• https://www.rafaybaloch.com/2020/10/multiple-address-bar-spoofing-vulnerabilities.html

思科FXOS软件Firepower机箱管理器跨站点请求伪造漏洞

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fxosfcm-csrf-uhO4e5BZ

VMware ESXi UAF导致RCE的漏洞(CVE-2020-3992)

• https://www.zerodayinitiative.com/advisories/ZDI-20-1269/

[技术]

通过综合行为替代对软件安全性进行推理

• https://synthesis.to/papers/phd_thesis.pdf

从一个500M的蜜罐网络流量数据中取证

• https://www.netresec.com/index.ashx?page=Blog&month=2020-10&post=Honeypot-Network-Forensics

HTB Blunder [writeup]

• https://medium.com/bugbountywriteup/htb-blunder-writeup-6785bd826bfa

逆向谷歌Web工具包GWTMap

• https://labs.f-secure.com/blog/gwtmap-reverse-engineering-google-web-toolkit-applications/
• https://github.com/FSecureLABS/GWTMap

解决工业物联网和OT中的网络安全风险

• https://www.microsoft.com/security/blog/2020/10/21/addressing-cybersecurity-risk-in-industrial-iot-and-ot/

从XSS到TSS：滥用XSS的技术支持诈骗活动

• https://blog.malwarebytes.com/cybercrime/2020/10/xss-to-tss-tech-support-scam-campaign/

AI如何增强鱼叉式网络钓鱼

• https://www.darkreading.com/edge/theedge/how-ai-will-supercharge-spear-phishing-/b/d-id/1339210?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

20201021

[资讯]

由于不受保护的Google Cloud存储桶，制药巨头辉瑞公司已经泄漏了美国处方药用户的私人医疗数据，时间已有几个月甚至几年之久。

• https://www.vpnmentor.com/blog/report-pfizer-breach/

MMO游戏Street Mobster由于SQL Injection严重漏洞泄露了190万用户的数据

• https://securityaffairs.co/wordpress/109788/data-breach/street-mobster-data-leak.html

[漏洞]

GitHub Pages不安全的Kramdown配置导致的多个漏洞

• https://devcraft.io/2020/10/20/github-pages-multiple-rces-via-kramdown-config.html

Firefox漏洞研究

• https://blog.exodusintel.com/2020/10/20/firefox-vulnerability-research/?utm_source=feedly&utm_medium=rss&utm_campaign=firefox-vulnerability-research

QRadar RemoteJavaScript反序列化漏洞（CVE-2020-4280）

• https://cxsecurity.com/issue/WLB-2020100128

[工具]

一个bash脚本，可以自动通过DNS进行数据泄露，以防服务器上除DNS外的所有出站连接均被阻止

• https://github.com/vp777/DNS-data-exfiltration

RDP中间人攻击攻击PyRDP发布1.0版

• https://www.gosecure.net/blog/2020/10/20/announcing-pyrdp-1/
• https://github.com/GoSecure/pyrdp

widevine-l3-decryptor：Chrome扩展，用于展示绕过DRM系统Widevine L3

• https://github.com/tomer8007/widevine-l3-decryptor

apkleaks：扫描APK文件，查找URL、终端和secret

• https://github.com/dwisiswant0/apkleaks

[技术]

学习使用酸沉积解封装集成电路

• https://jcjc-dev.com/2020/10/20/learning-to-decap-ics/

Segmentation Vault：克隆胖客户端访问

• https://www.mdsec.co.uk/2020/10/segmentation-vault/

20201020

[资讯]

通过将瞬间图像插入路边广告牌来欺骗自动驾驶

• https://www.nassiben.com/phantoms

Albion在线游戏制造商披露了数据泄露事件，黑客利用一个已知漏洞来访问公司论坛数据库。

• https://securityaffairs.co/wordpress/109731/data-breach/albion-online-data-breach.html

[漏洞]

FRITZ!Box路由器漏洞，可导致绕过DNS绑定保护，解析指向IP地址的DNS

• https://www.redteam-pentesting.de/en/advisories/rt-sa-2020-003/-fritz-box-dns-rebinding-protection-bypass

挖掘开源游戏AssaultCube的RCE漏洞：技术分析

• https://medium.com/@elongl/assaultcube-rce-technical-analysis-e12dedf680e5

GitHub Gist-通过开放重定向接管帐户

• https://devcraft.io/2020/10/19/github-gist-account-takeover.html

对于Windows内核提权漏洞CVE-2020-1034的研究

• https://blog.br0vvnn.io/pages/blogpost.aspx?id=2

Secret fragments: Remote code execution on Symfony based websites

• https://www.ambionics.io/blog/symfony-secret-fragment

Microsoft SharePoint SSI / ViewState RCE漏洞利用模块（CVE-2020-16952）

• https://packetstormsecurity.com/files/159612/sharepoint_ssi_viewstate.rb.txt

[恶意代码]

针对巴西银行客户的Vizom恶意软件，使用远程覆盖技术和DLL劫持来实现隐藏

• https://securityintelligence.com/posts/vizom-malware-targets-brazilian-bank-customers-remote-overlay/

GravityRAT远控首次推出了新的macOS和Android变体，伪装成合法的应用程序

• https://securelist.com/gravityrat-the-spy-returns/99097/

Gamaredon APT组织对乌克兰的攻击

• https://cybleinc.com/2020/10/19/gamaredon-apt-targeting-ukraine-with-new-variants/

[工具]

ssj：向日常使用的Linux（Ubuntu, Debian等）发行版中安装的Docker容器中部署数百个渗透和取证工具

• https://github.com/thirdbyte/ssj

GitDorker：利用GitHub Search API和从各种来源汇编的GitHub dork列表，搜索github上存储的敏感信息

• https://github.com/obheda12/GitDorker

StethoInjector：篡改apk以注入Facebook Stetho库，以通过Chrome浏览器检查应用程序沙箱数据，可用于非Root设备

• https://github.com/darvincisec/StethoInjector

开源云安全工具收集

• https://cloudberry.engineering/tool/

PPScan：客户端原型污染扫描器

• https://github.com/msrkp/PPScan

[技术]

BEC（商业电子邮件妥协）的取证分析分析，Part1：他们如何在一眨眼的情况下骗走10万美元

• https://www.securityartwork.es/2020/10/19/how-they-steal-e100000-without-blinking-i/

动态分析Android克隆应用程序中的应用程序

• https://darvincitech.wordpress.com/2020/07/18/all-your-crypto-keys-belongs-to-me-in-android-virtual-containers/
• https://darvincitech.wordpress.com/2020/10/11/virtual-dynamic-analysis-part-2/

利用Host-Header实现注入

• https://medium.com/@gupta.bless/exploiting-host-header-injection-5554fef7e25

从头开始构建基于机器学习的Web应用程序防火墙

• http://www.debasish.in/2020/10/videobuilding-machine-learning-based.html
• https://www.youtube.com/playlist?list=PLKwUZp9HwWoA7AjUeuWnvQdNXcQ7bF3e1

讨论MacOS上的MACL

• https://blog.xpnsec.com/we-need-to-talk-about-macl/

在全新安装的Ubuntu 18.04上安装ETM

• https://github.com/blacklanternsecurity/enter_the_matrix
• https://www.blacklanternsecurity.com/2020-10-19-Enter-The-Matrix/

埃森哲发布的《2020年网络威胁报告》

• https://www.accenture.com/us-en/insights/security/cyber-threatscape-report

20201019

[漏洞]

CVE-2020-16898 – Bad Neighbor 漏洞利用

• http://blog.pi3.com.pl/?p=780

Discord桌面客户端串联多个漏洞实现RCE

• https://mksben.l0.cm/2020/10/discord-desktop-rce.html

高通QCMAP（移动访问点）体系结构中的四个主要漏洞

• https://www.vdoo.com/blog/qualcomm-qcmap-vulnerabilities

CVE-2020-5135-SonicWall VPN中的缓冲区溢出漏洞

• https://isc.sans.edu/forums/diary/CVE20205135+Buffer+Overflow+in+SonicWall+VPNs+Patch+Now/26692/

[工具]

stegbrute：隐写爆破工具，Rust编写

• https://github.com/R4yGM/stegbrute

TruffleSnout：用于攻击性目的的AD发现工具包

• https://github.com/dsnezhkov/TruffleSnout

Taken：接管AWS ips，有一个子域接管的PoC

• https://github.com/In3tinct/Taken

WinPmem：多平台支持的物理内存获取工具

• https://github.com/Velocidex/WinPmem

[技术]

逆向工程3D Movie Maker-第2部分

• https://benstoneonline.com/posts/reverse-engineering-3d-movie-maker-part-two/

无需登陆CloudTrail即可枚举角色的某些AWS API权限

• https://frichetten.com/blog/aws-api-enum-vuln/

开发Burp扩展：从手工测试到安全自动化

• https://github.com/doyensec/burpdeveltraining

使用Volatility进行内存分析，Part2

• https://medium.com/bugbountywriteup/memory-analysis-for-beginners-with-volatility-coreflood-trojan-part-2-42bdb46683f2

TryHackMe- Psycho Break CTF Writeup (Super-Detailed)

• https://medium.com/bugbountywriteup/tryhackme-psycho-break-ctf-writeup-super-detailed-64db523169c0

详解命令注入

• https://medium.com/bugbountywriteup/breaking-down-command-injections-97d1029576

关于漏洞挖掘时的一些教程和一些要做的事情

• https://github.com/KathanP19/HowToHunt

恶意代码脱壳：以最新Emotet样本为例

• https://medium.com/bugbountywriteup/malware-analysis-101-unpacking-malwares-case-study-a-fresh-emotet-sample-f2ea07d90d18

20201016

[资讯]

游戏开发商Crytek被Egregor勒索软件袭击，攻击者泄露了窃取的300 MB文件，包含与命运竞技场和Warface等游戏开发相关的数据，以及该公司的旧版Gface社交游戏网络

• https://securityaffairs.co/wordpress/109530/malware/egregor-ransomware-gang-ubisoft-crytek.html

[漏洞]

SoC中的一个漏洞：Glitching The MediaTek BootROM

• https://research.nccgroup.com/2020/10/15/theres-a-hole-in-your-soc-glitching-the-mediatek-bootrom/

[工具]

Phishing.Database：网络钓鱼域、URL网站和威胁的数据库

• https://github.com/mitchellkrogza/Phishing.Database

mikrot8over：Mikrotik RouterOS快速漏洞利用工具

• https://github.com/vulnersCom/mikrot8over

apk-medit：一个内存搜索和补丁工具，用于可调试的apk，无需Root和NDK

• https://github.com/aktsk/apk-medit

Zracker：Zip密码爆破工具

• https://github.com/devim-stuffs/Zracker

[技术]

攻击HTML到PDF的转换器

• https://sidechannel.tempestsi.com/html-to-pdf-converters-can-i-hack-them-a681cfee0903

DOS2RCE：利用V8 NULL指针解引用漏洞的新技术

• https://blog.br0vvnn.io/pages/blogpost.aspx?id=1&ln=0

Dockerfile安全最佳实战

• https://cloudberry.engineering/article/dockerfile-security-best-practices/

如何查找并删除GCP(谷歌云平台)文件

• https://cloudberry.engineering/article/find-and-delete-idle-gcp-projects/

在Linux上跟踪运行进程的困难

• https://natanyellin.com/posts/tracking-running-processes-on-linux/

构建可以在Azure中使用的HoneyToken

• https://zolder.io/2020/10/15/honeytokens-azure-keyvaults/

成功执行网络钓鱼的秘诀，Part2

• https://medium.com/bugbountywriteup/recipe-for-a-successful-phishing-campaign-part-2-2-68552806dcba

利用任务栏实现代码注入

• https://vx-underground.org/papers/VXUG/Exclusive/CodeInjectionusingTaskbar/Paper.pdf

红队战术：隐藏Windows服务

• https://www.sans.org/blog/red-team-tactics-hiding-windows-services/

当目标服务器存在代码执行漏洞但Web目录不可写时如何创建Web Shell

• https://www.mdsec.co.uk/2020/10/covert-web-shells-in-net-with-read-only-web-paths/

20201015

[资讯]

黑客从迈阿密的科技公司Intcomex窃取了近1TB的数据，在俄罗斯黑客论坛上公开了许多被盗文件，包括完整的信用卡信息，对敏感文件的扫描，如护照、银行对账单和财务文件，甚至客户数据库

• https://cybernews.com/security/miami-based-tech-company-suffers-massive-1tb-data-leak/

[漏洞]

XAMPP中403回复可导致RCE

• https://www.securifera.com/blog/2020/10/13/403-to-rce-in-xampp/

Linux内核4.8及更高版本中的基于堆的类型混淆漏洞（CVE-2020-12351）

• https://github.com/google/security-research/security/advisories/GHSA-h637-c88j-47wq

CVE-2020-12928 Exploit PoC，AMD Ryzen Master驱动中的提权漏洞

• https://h0mbre.github.io/RyzenMaster_CVE/#

SonicWall VPN Portal Critical Flaw (CVE-2020-5135)

• https://www.tripwire.com/state-of-security/vert/sonicwall-vpn-portal-critical-flaw-cve-2020-5135/

[恶意代码]

黑客组织FIN11，最近专注于勒索软件

• https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html

[工具]

PrismX：针对AWS的云安全仪表盘，基于ScoutSuite

• https://github.com/omaidf/PrismX

burp-multiplayer：Burp插件，允许多人协同工作，实时同步处理范围内的请求/响应、评论和高亮显示

• https://github.com/moloch--/burp-multiplayer

RmiTaste：使用来自ysoserial的小工具调用远程方法，使安全专业人员可以检测、枚举、交互和攻击RMI服务

• https://github.com/STMSolutions/RmiTaste

MEDUZA：针对iOS的通用SSL解绑定工具

• https://github.com/kov4l3nko/MEDUZA

AtomicTestHarnesses：用于模拟攻击技术的PowerShell套件

• https://github.com/redcanaryco/AtomicTestHarnesses

[技术]

使用Datalog & Rust做程序分析

• https://hexgolems.com/2020/10/getting-started-with-ddlog/
• https://github.com/eqv/ddlog_bse

以PyYAML的0Day为例，说明默认安全配置的重要性

• https://blog.arxenix.dev/pyyaml-cve/

面向文件流的编程：SECCON CTF 2020-lazynote挑战求解

• https://faraz.faith/2020-10-13-FSOP-lazynote/

从内而外破解- http CORS：从理论到实践的方法

• https://medium.com/bugbountywriteup/hacking-- http-cors-from-inside-out-512cb125c528

使用Python的基于UNION的盲SQLi：使用Python获取高于Burp Suite的Hacking效率

• https://medium.com/bugbountywriteup/blind-union-based-sqli-with-python-f1a8190feb43

漏洞赏金Tips，Part8

• https://www.infosecmatter.com/bug-bounty-tips-8-oct-14/

2020年虚拟设备安全状况报告：Orca扫描了540个不同软件公司的2,218个虚拟设备映像，占整个市场份额的69.3％，总共发现了401,571个漏洞

• https://orca.security/virtual-appliance-security-report

云数据库安全实践：永远不要公开内部使用的服务

• https://www.imperva.com/blog/never-leave-your-cloud-database-publicly-accessible/

20201014

[资讯]

印度铁路餐饮和旅游公司（IRCTC）2019年泄露的90万用户数据可在暗网免费下载，泄漏的数据包括敏感的用户信息，例如手机号码、生日、电子邮件、性别、婚姻状况、姓名、城市和州

• https://cybleinc.com/2020/10/13/irctc-2019-alleged-user-data-resurfaced-on-darkweb-900000-users-records-exposed/

[漏洞]

CVE-2020-16898：Windows TCP/IP 协议栈处理ICMPv6路由器播发数据包时的RCE漏洞

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16898

CVE-2020-16898检测工具

• https://github.com/advanced-threat-research/CVE-2020-16898
• https://www.mcafee.com/blogs/other-blogs/mcafee-labs/cve-2020-16898-bad-neighbor

Hindotech HK1 TV Box 不正确的访问控制导致用户提权至Root

• https://sick.codes/sick-2020-004/

Mac 版本呢的趋势科技杀毒软件通过国际化域名同形文字攻击（Puny码）漏洞绕过Web威胁防护

• https://www.inputzero.io/2020/08/bypass-trend-micro-web-threat-protection.html

CVE-2020-16952：微软SharePoint 服务器DataFormWebPart CreateChildControls服务器端包含远程执行代码漏洞

• https://srcincite.io/pocs/cve-2020-16952.py.txt

[恶意代码]

柠檬鸭(Lemon Duck)加密货币挖矿僵尸网络活动高峰

• https://blog.talosintelligence.com/2020/10/lemon-duck-brings-cryptocurrency-miners.html

[工具]

Mobexler：移动应用渗透测试平台

• https://github.com/enciphers/Mobexler

DamnVulnerableCryptoApp：不安全的加密应用程序。用于查看/测试/利用弱加密实现，并了解有关加密的更多信息，而无需深入了解其背后的数学原理

• https://github.com/DamnVulnerableCryptoApp/DamnVulnerableCryptoApp

apicheck：用于测试REST API的完整工具集

• https://github.com/BBVA/apicheck
• https://bbva.github.io/apicheck/

ail-framework：一个模块化框架，用于分析来自非结构化数据源（如Pastebin或类似服务的粘贴或非结构化数据流）的潜在信息泄漏

• https://github.com/ail-project/ail-framework

[技术]

Google CTF: BEGINNER挑战求解

• https://www.youtube.com/watch?v=rBYrQ1OEhik

分析iOS的Amazon Kindle应用程序中的电子书保护

• https://abjurato.github.io/stories/kindleEbooks.html

漏洞赏金Tips

• https://github.com/Fawadkhanfk/Hunting-Tips

二进制插桩中，异常处理能力的影响

• http://seclab.cs.stonybrook.edu/seclab/pubs/feast20.pdf

总结成功的网络钓鱼经验，Part1

• https://medium.com/bugbountywriteup/recipe-for-a-successful-phishing-campaign-part-1-2-dc23d927ec55

典型的Wi-Fi攻击

• https://splone.com/blog/2020/10/13/typical-wi-fi-attacks/

XXE：Web App安全基础

• https://medium.com/bugbountywriteup/xxe-web-app-security-basics-70ef8ed274f0

LD_PRELOAD –简介

• https://blog.secureideas.com/2020/10/ld_preload-introduction.html

Becoming resilient by understanding cybersecurity risks: Part 1

• https://www.microsoft.com/security/blog/2020/10/13/becoming-resilient-by-understanding-cybersecurity-risks-part-1/

20201013

[资讯]

黑客组织Spectre123泄露了北约和哈维尔桑（土耳其军事/国防制造商）的机密文件，包含多个SoW、合同、提案、3D设计、简历，包含原材料信息，财务报表和其他敏感文档的excel表

• https://cybleinc.com/2020/10/12/alleged-sensitive-documents-of-nato-and-turkey-leaked-case-of-cyber-hacktivism-or-cyber-espionage/

[恶意代码]

微软破坏了世界上最持久的僵尸网络Trickbot

• https://www.microsoft.com/security/blog/2020/10/12/trickbot-disrupted/

APT组织透明部落对印度军事目标的攻击

• https://cybleinc.com/2020/10/12/transparent-tribe-apt-targets-indian-military/

[工具]

pwndoc：渗透测试报告生成器

• https://github.com/pwndoc/pwndoc
• https://pwndoc.github.io/pwndoc/#/

yaxpeax-ia64：ia64 (itanium) decoder implemented as part of the yaxpeax project.

• https://github.com/iximeow/yaxpeax-ia64

[技术]

在进程内执行程序集和邮件槽

• https://teamhydra.blog/2020/10/12/in-process-execute-assembly-and-mail-slots/

使用terraform在云中一键部署全球蜜罐网络

• https://0xbanana.com/blog/one-click-global-honeypot-network-in-the-cloud/

macOS越狱：创建一个类似于充电器大小的专用设备，将T2置于DFU模式，运行checkra1n，替换EFI并上传密钥记录器以捕获所有密钥

• https://blog.t8012.dev/plug-n-pwn/

PWNED 1: VulnHub CTF walkthrough

• https://resources.infosecinstitute.com/pwned-1-vulnhub-ctf-walkthrough/

HTB ‘Cache’ [writeup]

• https://medium.com/bugbountywriteup/htb-cache-writeup-c3966ac8867c

TryHackMe- Pickle Rick CTF Writeup (Detailed)

• https://medium.com/bugbountywriteup/tryhackme-pickle-rick-ctf-writeup-detailed-bd7a3c6893ba

Windows横向渗透，Part3：DLL劫持

• https://www.mdsec.co.uk/2020/10/i-live-to-move-it-windows-lateral-movement-part-3-dll-hijacking/

WebGoat CSRF 7 8：发送Json格式的Payload

• https://medium.com/bugbountywriteup/webgoat-csrf-7-8-916f52dbc3d3

沙箱逃逸：识别和攻击分析人员

• https://www.securityartwork.es/2020/10/12/sandbox-evasion-identifying-blue-teams

通过Windows更新客户端(wuauclt)实现代码执行

• https://dtm.uk/wuauclt/

20201012

[资讯]

全球最大的邮轮运营商嘉年华公司（Carnival Corporation），在八月份勒索软件攻击中泄露客户、员工和船员的个人信息

• https://securityaffairs.co/wordpress/109308/data-breach/carnival-data-breach.html

汽车营销公司Friendemic因为配置错误的Amazon S3存储桶，泄露了270万客户的数据

• https://www.comparitech.com/blog/information-security/car-dealer-marketing-service-exposes-2-7-million-customer-records/

[工具]

mintotp：极简的TOTP（基于时间的一次性密码）生成器

• https://github.com/susam/mintotp

PowerShell-Red-Team：用于从主机收集数据的PowerShell脚本收集

• https://github.com/tobor88/PowerShell-Red-Team

qasan：自定义的QEMU仿真器，使用AddressSanitizer检测Guest中的内存漏洞

• https://github.com/andreafioraldi/qasan

NTLMRawUnHide：解析网络数据包捕获，并以可破解的格式提取NTLMv2哈希

• https://github.com/mlgualtieri/NTLMRawUnHide

[技术]

Binsec/Rel：常量时间内进行高效的二进制级别的关系符号执行

• https://binsec.github.io/new/publication/2020/05/18/s&p20.html
• https://github.com/binsec/Rel

CRM Salesforce Lightning中常见的错误配置漏洞利用

• https://www.enumerated.de/index/salesforce

Rundll32.exe 深入解析

• https://medium.com/@nasbench/a-deep-dive-into-rundll32-exe-642344b41e90

一个VoIP安全测试的故事

• https://medium.com/bugbountywriteup/a-tale-of-voip-security-testing-39937fe8c6fd

Defense Evasion with obfuscated Empire

• https://www.hackingarticles.in/defense-evasion-with-obfuscated-empire/

XBALTI网络钓鱼诈骗

• https://blog.medarkus.net/2020/10/11/XBALTI-Kit.html

使用xxe和ssrf检索EC2实例的IAM凭据

• https://medium.com/@gupta.bless/exploiting-xxe-for-ssrf-c23892374c0c

工作坊：使用攻击机器性学习攻击AMSI提供者

• https://www.youtube.com/watch?v=F0i5qmSOye8

20201010

[漏洞]

Android版Facebook App的下载功能可导致任意代码执行

• https://medium.com/@dPhoeniixx/arbitrary-code-execution-on-facebook-for-android-through-download-feature-fb6826e33e0f

[恶意代码]

GoLang编写的远控，通过Oracle WebLogic 服务器漏洞进行传播

• https://labs.bitdefender.com/2020/10/theres-a-new-a-golang-written-rat-in-town/

复杂的新型Android恶意软件，标志着移动平台勒索软件的最新发展

• https://www.microsoft.com/security/blog/2020/10/08/sophisticated-new-android-malware-marks-the-latest-evolution-of-mobile-ransomware/

APT组织针对SLTT、关键基础设施和选举组织的攻击，串联多个漏洞

• https://us-cert.cisa.gov/ncas/alerts/aa20-283a

[工具]

bbrf-client：漏洞赏金侦察框架（BBRF）的客户端组件，用于促进安全研究人员跨多个设备的工作流程

• https://github.com/honoki/bbrf-client
• https://honoki.net/2020/10/08/introducing-bbrf-yet-another-bug-bounty-reconnaissance-framework/

vscode-maudit：VSCode插件，用于在VSCode中审计代码

• https://github.com/m4yfly/vscode-maudit

c41n：可自动创建多种类型的流氓AP，执行Evil Twin攻击

• https://github.com/MS-WEB-BN/c41n

Carnivore ：Microsoft用户名枚举和外部密码喷洒（Skype for Business, ADFS, RDWeb, Exchange，Office 365）

• https://github.com/ReverendThing/Carnivore
• https://www.youtube.com/watch?v=LJFuydx-HtE

[技术]

击败受管制的电子烟保护装置的旅程

• https://labs.ioactive.com/2020/10/a-journey-into-defeating-regulated.html

使用Frida观察iOS按钮的效果

• https://saml98.github.io/jekyll/update/2020/10/09/frida-tracing.html

从UEFI模块的手动逆向过渡到UEFI固件的动态仿真

• https://labs.sentinelone.com/moving-from-manual-re-of-uefi-modules-to-dynamic-emulation-of-uefi-firmware/

关于恶意软件脱壳的个人笔记

• https://marcoramilli.com/2020/10/09/how-to-unpack-malware-personal-notes/

CSRF：Web App安全基础

• https://medium.com/bugbountywriteup/csrf-web-app-security-basics-dd4628122fea

2020年互联网犯罪组织的威胁评估报告（IOCTA）

• https://www.europol.europa.eu/activities-services/main-reports/internet-organised-crime-threat-assessment-iocta-2020

（电子书）理解DOM：文档对象模型

• https://www.digitalocean.com/community/books/understanding-the-dom-document-object-model-ebook

Azure Sentinel To-Go，Part2：如何集成ARM模板，以将Azure Sentinel解决方案与其他模板部署到基本的Windows网络实验室

• https://medium.com/@Cyb3rWard0g/azure-sentinel-to-go-part-2-integrating-a-basic-windows-lab-via-arm-templates-1c3ded181d3d

攻击面监视：检测网络钓鱼子域的两种方法

• http://www.circleid.com/posts/20201009-attack-surface-monitoring-ways-to-detect-phishing-subdomains/

无线渗透测试，Part4：执行实际的无线渗透

• https://www.ethicalhacker.net/features/root/wireless-pentesting-part-4-performing-an-actual-wireless-pentest

20201009

[资讯]

开发者成功编译了泄露的Windows XP源码

• https://securityaffairs.co/wordpress/108966/security/windows-xp-server-2003-compiled.html

阿联酋国际航空公司由于服务器配置错误数据泄漏，泄露数据在暗网传播，包括14个文件夹和53,555个文件，类别包括：护照扫描、机票预订、酒店预订、员工与客户之间的电子邮件通信、国际旅行保险单等

• https://www.defcon-lab.org/vazamento-de-dados-ira-e-emirados-arabes-kelvinsecteam/

亚洲流行的食品配送平台Chowbus被黑客入侵，攻击者声称窃取了包含客户数据的公司的整个数据库，包括4300条饭店记录和80万条客户记录，当前公开的数据包括客户名称、电子邮件地址、电话号码、Chowbus合作餐厅的地址（城市，州，邮政编码）、价格和地址

• https://www.reddit.com/r/UIUC/comments/j5fcjp/chowbus_is_hacked_leaks_800000_entries_of/

澳大利亚新闻共享平台Snewpit存储在AWS服务器上的数据可被公开访问，存储桶包含将近80,000条用户记录，包括用户名、全名、电子邮件地址和个人资料图片

• https://cybernews.com/security/australian-social-news-platform-leaks-80000-user-records/

[漏洞]

D-Link在处理HNAP协议时的2个身份认证绕过漏洞（CVE-2020-8863、CVE-2020-8864）

• https://www.zerodayinitiative.com/blog/2020/9/30/the-anatomy-of-a-bug-door-dissecting-two-d-link-router-authentication-bypasses

KensingtonWorks中的另一个RCE漏洞

• https://robertheaton.com/another-rce-in-kensingtonworks/

CVE-2020-15702(批处理PID时的竞态条件漏洞)的技术说明

• https://flattsecurity.hatenablog.com/entry/2020/09/30/130844

两个流行的工业远程访问系统的严重安全漏洞，可以被利用实现禁止访问工业生产车间、侵入公司网络、篡改数据甚至窃取敏感的商业秘密

• https://www.otorio.com/news-events/press-release/otorio-discovers-critical-vulnerabilities-in-leading-industrial-remote-access-software-solutions/
• https://us-cert.cisa.gov/ics/advisories/icsa-20-273-03

惠普设备管理器的3个漏洞，可导致未经身份验证远程执行具有SYSTEM特权的命令（CVE-2020-6925，CVE-2020-6926，CVE-2020-6927）

• https://nickbloor.co.uk/2020/10/05/hp-device-manager-cve-2020-6925-cve-2020-6926-cve-2020-6927/

具有Intel处理器和辅助T2芯片的macOS系统受影响的一个漏洞

• https://ironpeak.be/blog/crouching-t2-hidden-danger/

AV软件最常见的漏洞如何使攻击者提权，研究人员测试的每个主流杀软供应商都可以被利用

• https://www.cyberark.com/resources/threat-research-blog/anti-virus-vulnerabilities-who-s-guarding-the-watch-tower

在测试某Web App时发现的多个漏洞，串联起来可导致账户接管

• https://ninetyn1ne.github.io/2020-10-05-open-redir-to-ato/

HashiCorp Vault中的两个身份验证漏洞

• https://googleprojectzero.blogspot.com/2020/10/enter-the-vault-auth-issues-hashicorp-vault.html

A brief encounter with Leostream Connect Broker

• https://adepts.of0x.cc/leostream-xss-to-rce/

Pulse Connect Secure由模板注入导致的RCE漏洞（CVE-2020-8243）

• https://research.nccgroup.com/2020/10/06/technical-advisory-pulse-connect-secure-rce-via-template-injection-cve-2020-8243/

Apache Struts框架中的最近代码执行漏洞CVE-2019-0230

• https://www.zerodayinitiative.com/blog/2020/10/7/cve-2019-0230-apache-struts-ognl-remote-code-execution

WarezTheRemote：将遥控器变成收听设备

• https://www.guardicore.com/2020/10/wareztheremote-turning-remotes-into-listening-devices/

思科Webex Teams客户端的DLL劫持漏洞

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-teams-dll-drsnH5AN

Microsoft Azure中发现的两个漏洞

• https://www.intezer.com/blog/kud-i-enter-your-server-new-vulnerabilities-in-microsoft-azure/

[恶意代码]

僵尸网络InterPlanetary Storm的新变种，感染13K Mac、Android设备，采用新的逃避检测策略

• https://blog.barracuda.com/2020/10/01/threat-spotlight-new-interplanetary-storm-variant-iot/

Ttint: 一款通过2个0-day漏洞传播的IoT远控木马

• https://blog.netlab.360.com/ttint-an-iot-rat-uses-two-0-days-to-spread/

MosaicRegressor：研究中发现的将恶意植入物感染到UEFI固件镜像的案例

• https://securelist.com/mosaicregressor/98849/
• https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/10/05094208/MosaicRegressor_Technical-details.pdf

揭秘Kraken：滥用Windows错误报告服务的无文件APT攻击

• https://blog.malwarebytes.com/malwarebytes-news/2020/10/kraken-attack-abuses-wer-service/

PoetRAT：针对阿塞拜疆公共和私营部门的恶意软件

• https://blog.talosintelligence.com/2020/10/poetrat-update.html

HEH：一种新的物联网P2P僵尸网络

• https://blog.netlab.360.com/heh-an-iot-p2p-botnet/

黑客组织Ryuk最近的一次勒索软件攻击行动

• https://thedfirreport.com/2020/10/08/ryuks-return/

一种基于Mirai的新攻击

• https://blogs.juniper.net/en-us/security/priority-threat-actors-adopt-mirai-source-code

[工具]

holehe：检查邮件是否在不同的网站（例如twitter，instagram）上使用，并使用忘记密码功能检索有关网站的信息

• https://github.com/megadose/holehe

gitlab-watchman：使用GitLab API对GitLab内部暴露的敏感数据和凭证进行审计

• https://github.com/PaperMtn/gitlab-watchman

TinyAFL：基于AFL和TinyInst，可以对MacOS用户模式应用程序（无需源码）进行模糊测试

• https://github.com/linhlhq/TinyAFL/tree/TinyAFL-MacOS

HexraysToolbox：IDA Hexrays插件，从反编译后的代码（AST）中查找代码模式

• https://github.com/patois/HexraysToolbox

webshell-analyzer：WebShell扫描和分析工具

• https://github.com/tstillz/webshell-analyzer

lockphish：针对锁定屏幕的网络钓鱼攻击，旨在通过- https链接获取Windows凭据、Android PIN和iPhone密码

• https://github.com/jaykali/lockphish
• https://www.kalilinux.in/2020/05/lockphish.html

Legion：基于覆盖率的软件测试工具

• https://github.com/Alan32Liu/Legion

trident：自动化密码喷洒工具

• https://github.com/praetorian-inc/trident

ad-honeypot-autodeploy：完全自动为RDP 蜜罐部署一个小型的、带漏洞的、易受攻击的Windows域

• https://github.com/tothi/ad-honeypot-autodeploy

SFPolDevChk：Salesforce策略偏差检查器

• https://github.com/nccgroup/SFPolDevChk

ghunt：OSINT工具，可提取某人的Google帐户电子邮件的许多信息

• https://github.com/mxrch/ghunt

nuubi：信息收集工具

• https://github.com/pikpikcu/nuubi

o365enum：使用ActiveSync、Autodiscover v1或office.com登录页面枚举Office 365中的有效用户名

• https://github.com/gremwell/o365enum

uriDeep：基于机器学习的Unicode编码攻击

• https://github.com/mindcrypt/uriDeep

asnap：通过提供有关哪些公司拥有哪个ipv4或ipv6地址的更新数据，并使用户可以自动执行初始端口和服务扫描，从而使侦察阶段变得更加容易

• https://github.com/paradoxxer/asnap

jwt-heartbreaker：使用来自公开源的密钥，检查JWT

• https://github.com/wallarm/jwt-heartbreaker
• https://lab.wallarm.com/meet-jwt-heartbreaker-a-burp-extension-that-finds-thousands-weak-secrets-automatically/

pastego：使用GO和语法表达（PEG）抓取/解析Pastebin内容

• https://github.com/notdodo/pastego

voyager：针对Win 10 x64的Hyper-V Hacking框架（AMD和Intel）

• https://githacks.org/xerox/voyager

capa-explorer：Cutter插件，在Cutter中查看capa的分析结果

• https://github.com/ninewayhandshake/capa-explorer

• httpx：快速且多功能的- http工具包，允许使用retryable- http库运行多个探测器，旨在通过增加线程来保持结果的可靠性

• https://github.com/projectdiscovery/- httpx

powerglot：使用多义字编码进攻性的Powershell脚本

• https://github.com/mindcrypt/powerglot

GoldenNuggets-1：Burp插件，用于轻易的创建Wordlist

• https://github.com/GainSec/GoldenNuggets-1

sploit：用于二进制分析和开发的Go软件包

• https://github.com/zznop/sploit

RPR-Run-Pause-Resume：用于BurpSuite/Turbo-Intruder，在指定数量的测试请求后设置暂停时间，以避免目标站点阻止攻击

• https://github.com/abiwaddell/RPR-Run-Pause-Resume

feroxbuster：用Rust编写的一种快速、简单、递归的内容发现工具

• https://github.com/epi052/feroxbuster

aemscan：Adobe Experience Manager漏洞扫描程序

• https://github.com/Raz0r/aemscan

go-cve-dictionary：在本地创建CVE (NVD和日本JVN)副本，服务器模式可简化查询

• https://github.com/kotakanbe/go-cve-dictionary

AdvPhishing：高级网络钓鱼工具

• https://github.com/Ignitetch/AdvPhishing

ReversePowerShell：可用于通过PowerShell获取反向Shell的函数

• https://github.com/tobor88/ReversePowerShell

serenity：Serenity操作系统，类Unix的图形操作系统，针对x86

• https://github.com/SerenityOS/serenity

Raccine：一个简易的勒索软件

• https://github.com/Neo23x0/Raccine

OFFPORT_KILLER：自动识别指定端口后运行的潜在服务，当nmap或任何扫描工具不可用时，以及在您进行了手动端口扫描然后想要确定正在运行的服务的情况下，该工具非常有用

• https://github.com/TH3xACE/OFFPORT_KILLER

2020年IDA插件大赛结果

• https://www.hex-rays.com/contests_details/contest2020/

bip：IDAPython API的高级抽象，简化使用Python与IDA交互过程

• https://github.com/synacktiv/bip
• https://synacktiv.github.io/bip/build/html/index.html#

fingermatch：IDA插件，从已分析的二进制文件中收集函数、数据、类型和注释，并在另一个二进制文件中对它们进行模糊匹配

• https://github.com/jendabenda/fingermatch

ida_medigate：IDA插件，辅助C++逆向，尤其是虚表调度

• https://github.com/medigate-io/ida_medigate

Renamer：IDA插件，基于函数内使用的字符串，为函数提供合适的名称

• https://github.com/ClarotyICS/ResearchTools/tree/master/IDA/Renamer

Burp Hashcat Maskprocessor Extension

• https://github.com/quahac/burp-intruder-hashcat-maskprocessor

TheCl0n3r：用于下载和管理Git仓库

• https://github.com/an00byss/TheCl0n3r

kube-score：对Kubernetes对象定义执行静态代码分析

• https://github.com/zegl/kube-score

vPrioritizer：了解整个组织中资产-漏洞关系级别上的背景风险（vPRisk），以便团队就他们应该补救（或承受不了）什么（漏洞/关系）以及在哪个（资产）上做出更明智的决定

• https://github.com/varchashva/vPrioritizer

CSRFER：基于vulnerable requests生成CSRF Payload

• https://github.com/luisfontes19/CSRFER

[技术]

使用动态二进制插桩技术(QBDI)解决原生代码混淆

• https://www.romainthomas.fr/publication/20-bh-asia-dbi/

硬件Hacking实验：从嵌入式设备中提取固件

• https://github.com/koutto/hardware-hacking/blob/master/Hardware-Hacking-Experiments-Jeremy-Brun-Nouvion-2020.pdf

我如何自动化麦当劳FriesHit游戏以赢得免费iPhone

• https://ferib.dev/blog.php?l=post/How_I_automated_McDonalds_mobile_game_to_win_free_iphones

使用复制和粘贴功能入侵Grindr帐户

• https://www.troyhunt.com/hacking-grindr-accounts-with-copy-and-paste/

漏洞利用图谱：通过查找作者的指纹来寻找漏洞利用

• https://research.checkpoint.com/2020/graphology-of-an-exploit-volodya/

如何枚举和使用IAM权限以使自己受益：现实世界实例

• https://medium.com/bugbountywriteup/exploiting-aws-iam-permissions-for-total-cloud-compromise-a-real-world-example-part-2-2-f27e4b57454e

利用某些移动设备管理（MDM）服务器中的- http Request Smuggling，并将任何MDM命令发送到在其上注册的任何设备

• https://medium.com/@ricardoiramar/the-powerful-- http-request-smuggling-af208fafa142

Attacks on GCM with Repeated Nonces

• https://www.elttam.com/blog/key-recovery-attacks-on-gcm/

强制Firefox在302重定向期间执行XSS有效负载

• https://www.gremwell.com/firefox-xss-302

Hack the Box — Blackfield

• https://medium.com/bugbountywriteup/hack-the-box-blackfield-35b64183a696

Relevant: 1 Vulnhub Walkthrough

• https://www.hackingarticles.in/relevant-1-vulnhub-walkthrough/

HA: Narak: Vulnhub Walkthrough

• https://www.hackingarticles.in/ha-narak-vulnhub-walkthrough/

Panabee: 1: Vulnhub Walkthrough

• https://www.hackingarticles.in/panabee-1-vulnhub-walkthrough/

不安全的代码管理/版本控制历史记录

• https://medium.com/@gupta.bless/exploiting-insecure-code-management-23fcd00eba60

• http Host header attacks

• https://portswigger.net/web-security/host-header

NVIDIA系统管理界面（nvidia-smi）程序DLL劫持

• https://www.pentestpartners.com/security-blog/dll-hijacking-in-nvidia-smi/

将Firefox用于渗透测试：隐私和保护附件

• https://www.hackingarticles.in/firefox-for-pentester-privacy-and-protection-add-ons/

在拥有20000+用户的网站中利用LFI实现RCE

• https://medium.com/bugbountywriteup/leveraging-lfi-to-rce-in-a-website-with-20000-users-129050f9982b

Vuls：无客户端的漏洞扫描器

• https://www.hackingarticles.in/vuls-an-agentless-vulnerability-scanner/

攻击基于智能卡的Active Directory网络

• https://ethicalchaos.dev/2020/10/04/attacking-smart-card-based-active-directory-networks/

使用Windows API Un-Hooking来绕过BitDefender总体安全性，从而执行进程注入

• https://shells.systems/defeat-bitdefender-total-security-using-windows-api-unhooking-to-perform-process-injection/

智能合约Hacking，第7章：委托调用攻击向量

• http://console-cowboys.blogspot.com/2020/10/smart-contract-hacking-chapter-7.html

使用DLL代理实现驻留

• https://www.ired.team/offensive-security/persistence/dll-proxying-for-persistence

如何在浏览器中存储会话Token

• https://blog.ropnop.com/storing-tokens-in-browser/

（书籍）恶意软件分析和检测工程：一种检测和分析现代恶意软件的综合方法

• https://github.com/Apress/malware-analysis-detection-engineering
• https://www.amazon.com/Malware-Analysis-Detection-Engineering-Comprehensive/dp/1484261925

逆向3D电影制作工具，Part1：使用Ghidra脚本恢复C++类继承结构

• https://benstoneonline.com/posts/reverse-engineering-3d-movie-maker-part-one/

2020年家用路由器安全报告

• https://www.fkie.fraunhofer.de/content/dam/fkie/de/documents/HomeRouter/HomeRouterSecurity_2020_Bericht.pdf

对思科RV110W固件更新程序进行补丁比较

• https://quentinkaiser.be/exploitdev/2020/10/01/patch-diffing-cisco-rv110/

Mitre ATT&CK技术，Part1：劫持执行流程

• https://blog.nviso.eu/2020/10/06/mitre-attack-turned-purple-part-1-hijack-execution-flow/

关于白盒加密的安全性研究

• https://tel.archives-ouvertes.fr/tel-02953586/document

CET Updates – CET on Xanax

• https://windows-internals.com/cet-updates-cet-on-xanax/

仔细研究PlayStation 4硬件，以及多年来如何利用不同的漏洞来破坏游戏机的安全性

• https://www.youtube.com/watch?v=OxRTGMe_RuE

.NET灰盒方法：源代码审查和动态分析

• https://voidsec.com/net-grey-box-approach-source-code-review/

OAuth 2.0安全性最佳最新实践

• https://www.ietf.org/id/draft-ietf-oauth-security-topics-16.html

使用mutation XSS再次绕过DOMPurify

• https://portswigger.net/research/bypassing-dompurify-again-with-mutation-xss

逆向电缆调制解调器，并将其转换为SDR（软件定义无线电）

• https://stdw.github.io/cm-sdr/

使用Ghidra逆向Go二进制文件

• https://cujo.com/reverse-engineering-go-binaries-with-ghidra/

Muney：无泄漏堆漏洞利用技术

• https://maxwelldulin.com/BlogPost?post=6967456768

Hack the Box (HTB) machines walkthrough series — Cascade (part 2)

• https://resources.infosecinstitute.com/hack-the-box-htb-walkthrough-cascade-part-2/

Hack The Box Walkthrough — Magic

• https://medium.com/bugbountywriteup/hack-the-box-walkthrough-magic-d633fb94bca4

Metasploit后渗透模块参考

• https://www.infosecmatter.com/post-exploitation-metasploit-modules-reference/

在Windows Shell链接解析器中查找漏洞

• https://hitcon.org/2020/slides/From%20LNK%20to%20RCE%20Finding%20bugs%20in%20Windows%20Shell%20Link%20Parser.pdf

20200930

[资讯]

美国的保险巨头Arthur J.Gallagher遭受勒索软件袭击

• https://www.bleepingcomputer.com/news/security/ransomware-hits-us-based-arthur-j-gallagher-insurance-giant/

[漏洞]

微星MSI Ambient Link驱动程序的提权漏洞（CVE-2020-17382）

• https://github.com/uf0o/CVE-2020-17382

CVE-2020-4464和CVE-2020-4448：利用IBM WebSphere中的远程协议

• https://www.zerodayinitiative.com/blog/2020/9/29/exploiting-other-remote-protocols-in-ibm-websphere

收集由于document.location解析而易受原型污染的库的示例

• https://github.com/BlackFan/client-side-prototype-pollution

[恶意代码]

SideCopy行动：针对印度国防军的APT攻击行动

• https://www.seqrite.com/blog/operation-sidecopy/

[工具]

RpcSsImpersonator：通过RpcSs服务实现提权

• https://github.com/sailay1996/RpcSsImpersonator

MFASweep：用于检查多个Microsoft服务上是否启用了MFA的工具

• https://github.com/dafthack/MFASweep
• https://www.blackhillsinfosec.com/exploiting-mfa-inconsistencies-on-microsoft-services/

HackBrowserData：一个解密浏览器数据（密码|历史记录|Cookies|书签）的导出工具，支持全平台主流浏览器

• https://github.com/moonD4rk/HackBrowserData

nerve：持续性侦察、漏洞扫描引擎

• https://github.com/PaytmLabs/nerve

byte_stinker：PE转储工具，提取程序中存储的二进制文件

• https://github.com/Sinclairq/byte_stinker

iotmap：同时使用一种或多种协议为物联网网络建模

• https://github.com/AlgoSecure/iotmap

DecryptRDCManager：.NET版本的Decrypt-RDCMan.ps1，远程桌面管理器密码收集器

• https://github.com/mez-0/DecryptRDCManager

APIMiner：记录Windows可执行文件的API调用

• https://github.com/poona/APIMiner

[技术]

compfest 12 CTF决赛：二进制漏洞利用

• https://reversingpwn.wordpress.com/2020/09/29/compfest-12-finals-pwn-writeup/

Kimsuky网络钓鱼活动

• https://threatconnect.com/blog/kimsuky-phishing-operations-putting-in-work

沙箱逃逸类型的挑战MathSH Writeup

• https://gist.github.com/bennofs/6a4466cdc746a5b994a32cfa923a9e8e

使用Single Sign-On和不安全的JSONP调用，接管Kolesa网站的任何帐户

• https://medium.com/bugbountywriteup/taking-down-the-sso-account-takeover-in-3-websites-of-kolesa-due-to-insecure-jsonp-call-facd79732e45

HTB Admirer [Writeup]

• https://medium.com/bugbountywriteup/htb-admirer-writeup-171abd8d399c

使用具有（半）合法的Linux工具安装未签名的iOS应用

• https://medium.com/bugbountywriteup/jailbreaking-ios-without-a-mac-1-4-the-plan-b49c0edc1759

如何枚举和使用IAM权限以使自己受益：现实世界实例

• https://medium.com/bugbountywriteup/exploiting-fine-grained-aws-iam-permissions-for-total-cloud-compromise-a-real-world-example-part-5a2f3de4be08

打印机的安全隐患

• https://www.lykosec.com/post/the-hidden-dangers-of-printers

在Azure Sentinel中使用Azure Defender数据分析Web Shell攻击

• https://techcommunity.microsoft.com/t5/azure-sentinel/analysing-web-shell-attacks-with-azure-defender-data-in-azure/ba-p/1724130

声明式影子DOM：直接在HTML中实现和使用Shadow DOM的新方法

• https://web.dev/declarative-shadow-dom/

深入探讨Zerologon核心中的加密漏洞的详细信息，对其进行解释并介绍一个模拟器，以在主要漏洞之上演示一些其他可能的利用

• https://medium.com/@TalBeerySec/zeroing-in-on-zerologon-crypto-more-than-zeros-5d90fe5e4fd3

20200929

[资讯]

因为配置错误的Elasticsearch服务器，波兰的时装零售公司BrandBQ泄露1 TB数据，涉及10亿条记录，包括公司客户的一系列个人身份信息（PII），例如全名，电子邮件地址、电话号码、不带卡号的付款明细、增值税号、付款方式、包裹接收者的姓名以及与订单相关的购买信息。

• https://www.vpnmentor.com/blog/report-answear-leak/

[漏洞]

AWS KMS和AWS Encryption SDK中的安全性问题

• https://vnhacker.blogspot.com/2020/09/advisory-security-issues-in-aws-kms-and.html

[恶意代码]

FinFisher Filleted：对macOS平台下FinSpy 恶意软件的分类

• https://objective-see.com/blog/blog_0x4F.html

The Emerald Connection: EquationGroup collaboration with Stuxnet

• https://fmmresearch.files.wordpress.com/2020/09/theemeraldconnectionreport_fmmr-2.pdf

[工具]

PwnFox：Firefox/Burp扩展，为安全审计提供有用的工具

• https://github.com/B-i-t-K/PwnFox

RpcGetWinVersion：通过RPC远程获取Windows系统的build number，利用Impacket实现

• https://github.com/airbus-cyber/CyberSecRessources/tree/master/RpcGetWinVersion

CobaltStrikeScan：扫描进程内存，查找Cobalt Strike beacons并解析器配置

• https://github.com/Apr4h/CobaltStrikeScan

[技术]

r2-pay: whitebox (part 2)

• https://www.romainthomas.fr/post/20-09-r2con-obfuscated-whitebox-part2/

Safari阅读器模式下Hacking之旅

• https://payatu.com/blog/nikhil-mittal/my-hacking-adventures-with-safari-reader-mode

Artifactory Hacking指南

• https://www.errno.fr/artifactory/Attacking_Artifactory

使用仿真框架Qiling来反混淆与解密VAC3模块

• https://github.com/ioncodes/vacation3-emu

后门混淆: tempnam和URL编码

• https://blog.sucuri.net/2020/09/backdoor-obfuscation-tempnam-url-encoding.html

如何在组织中正确执行漏洞评估

• https://www.techrepublic.com/article/cybersecurity-how-to-properly-perform-vulnerability-assessments-in-your-organization/

20200928

[漏洞]

Airbnb的8个XSS漏洞，可绕过XSS过滤器、WAF、CSP和Chrome Auditor

• https://www.youtube.com/watch?v=d4KQqQz4LZI

[恶意代码]

Android平台最著名的恶意软件之一Jocker与谷歌商店的猫鼠游戏

• https://www.zscaler.com/blogs/security-research/joker-playing-hide-and-seek-google-play

2020年上半年工业自动化系统的威胁态势报告

• https://ics-cert.kaspersky.com/reports/2020/09/24/threat-landscape-for-industrial-automation-systems-h1-2020/

[工具]

Eagle：基于插件的漏洞扫描程序，支持多线程，可用于大规模检测低挂起（low-hanging）的漏洞

• https://github.com/BitTheByte/Eagle

wacker：一组脚本，可辅助对WPA3接入点执行在线词典攻击

• https://github.com/blunderbuss-wctf/wacker

UrbanBishopLocal：C#代码，用于内联Shellcode执行

• https://github.com/slyd0g/UrbanBishopLocal

Fork-n-Run：对Fork&Run操作进行可重用组件的实验

• https://github.com/rasta-mouse/Fork-n-Run

hetty：用于安全研究的- http工具包，目标是成为Burp的替代者

• https://github.com/dstotijn/hetty

yaya：自动管理开源yara规则并运行扫描

• https://github.com/EFForg/yaya

[技术]

ARM64上的Swift调用约定：Float/Double

• https://vivekseth.com/swift-arm64-float-double/

在渗透测试期间可能会遇到的RMI接口：结构、侦察和通信

• https://medium.com/@afinepl/java-rmi-for-pentesters-structure-recon-and-communication-non-jmx-registries-a10d5c996a79

漏洞赏金技巧，Part7

• https://www.infosecmatter.com/bug-bounty-tips-7-sep-27/

一键式Meterpreter利用链与BeEF和AV/AMSI绕过

• https://medium.com/@bluedenkare/1-click-meterpreter-exploit-chain-with-beef-and-av-amsi-bypass-96b0eb61f1b6

可用于执行kerberos攻击的命令备忘单

• https://gist.github.com/TarlogicSecurity/2f221924fef8c14a1d8e29f3cb5c5c4a

Hacking the Medium partner program

• https://medium.com/bugbountywriteup/hacking-the-medium-partner-program-84c0e9fa340

揭秘SVCHOST.EXE进程极其命令行参数

• https://medium.com/@nasbench/demystifying-the-svchost-exe-process-and-its-command-line-options-508e9114e747

针对初学者的网络缓存欺骗教程

• https://www.youtube.com/watch?v=3YLFZvxZbRc

使用Linux内核模块进行试验，以尝试并了解有关内核如何工作的更多信息

• https://github.com/xcellerator/linux_kernel_hacking

HTML转PDF功能中的SSRF漏洞

• https://github.com/incredibleindishell/SSRF_Vulnerable_Lab/tree/master/pdf_generator

解码不完整的Base64字符串

• https://isc.sans.edu/forums/diary/Decoding+Corrupt+BASE64+Strings/26606/

2020年面向安全专业人员的8大最佳Web安全和黑客软件

• https://gbhackers.com/best-hacking-software/

20200927

[资讯]

总部位于新加坡的加密货币交易所KuCoin披露了一项安全漏洞，黑客从其热钱包中窃取了1.5亿美元

• https://securityaffairs.co/wordpress/108771/cyber-crime/kucoin-cryptocurrency-exchange-hack.html

[漏洞]

Lansweeper应用程序通过CSRF进行提权的漏洞（CVE-2020-13658）

• https://research.nccgroup.com/2020/09/25/technical-advisory-lansweeper-privilege-escalation-via-csrf-using-- http-method-interchange/

FortiGate VPN客户端仅验证CA是由Fortigate（或另一个受信任的CA）颁发的，攻击者可以轻松实现中间人攻击。

• https://securingsam.com/breaching-the-fort/

CVE-2020-1472补丁验证脚本

• https://github.com/cisagov/cyber.dhs.gov/tree/master/assets/report/ed-20-04_script

Punkbuster服务器的目录遍历漏洞可被利用实现RCE

• https://medium.com/@prizmant/hacking-punkbuster-e22e6cf2f36e

Windows Server 2012/2016/2019 SIGRed (CVE-2020–1350)漏洞利用

• https://medium.com/@datafarm.cybersecurity/exploiting-sigred-cve-2020-1350-on-windows-server-2012-2016-2019-80dd88594228

[恶意代码]

HpReact攻击行动：APT-C-43窃取委内瑞拉的军事机密，为反动派提供情报支持

• https://blog.360totalsecurity.com/en/apt-c-43-steals-venezuelan-military-secrets-to-provide-intelligence-support-for-the-reactionaries-hpreact-campaign/

介绍一个相对较新且鲜为人知的Android银行木马, Alien

• https://www.threatfabric.com/blogs/alien_the_story_of_cerberus_demise.html

FinSpy是由慕尼黑公司FinFisher Gmbh生产的商业间谍软件套件，通过对该最新变种进行技术调查，研究人员发现了FinSpy的Android、Linux、macOS版本

• https://www.amnesty.org/en/latest/research/2020/09/german-made-finspy-spyware-found-in-egypt-and-mac-and-linux-versions-revealed/

APT28使用北约主题作为诱饵进行Zebrocy恶意软件攻击

• https://quointelligence.eu/2020/09/apt28-zebrocy-malware-campaign-nato-theme/

通过恶意广告活动进行传播的Taurus Project窃密工具

• https://blog.malwarebytes.com/malwarebytes-news/2020/09/taurus-project-stealer-now-spreading-via-malvertising-campaign/

[工具]

wave-share：通过声音分享本地文件，在浏览器中运行，适用于所有带有麦克风和扬声器的设备。支持Serverless、P2P

• https://github.com/ggerganov/wave-share

AutoDirbuster：自动运行Dirbuster扫描，并保存多个IP的扫描结果

• https://github.com/NetSPI/AutoDirbuster

EkoParty_Advanced_Fuzzing_Workshop：高级Fuzzing工作室

• https://github.com/antonio-morales/EkoParty_Advanced_Fuzzing_Workshop

utopia：一个Linux后渗透框架，利用Linux SSH漏洞提供类似于Shell的连接

• https://github.com/entynetproject/utopia

gitjacker：从错误配置的网站中下载git存储库，并提取其内容

• https://github.com/liamg/gitjacker

AMSI.fail：具有- http触发器的C＃Azure函数，可生成混淆的PowerShell代码段，这些代码段将中断或禁用当前进程的AMSI

• https://github.com/Flangvik/AMSI.fail

PSMDATP：用于管理Microsoft Defender高级威胁防护的PowerShell模块

• https://github.com/alexverboon/PSMDATP

[技术]

使用nmap进行端口扫描和侦察，Part2：NMap脚本

• https://www.hackers-arise.com/post/port-scanning-and-recon-with-nmap-part-2-the-nmap-scripts-nse

信息系统和组织的安全和隐私控制（书籍）

• https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf

如何执行源代码审查以查找Web应用程序中的漏洞

• https://vickieli.dev/hacking/code-review-101/

Windows系统上实现Payload的小型化

• https://www.solomonsklash.io/smaller-c-payloads-on-windows.html

SonicWall发布的2020年网络威胁年中报告

• https://www.sonicwall.com/2020-cyber-threat-report/

介绍一种SMBGhost漏洞利用程序的开发，该漏洞利用率比公共PoC更高，并且在更广泛的环境中使用，并介绍了在此过程中发现的未经身份验证的远程DOS漏洞

• https://blog.diffense.co.kr/2020/09/24/SMBGhost.html

内部网站保护指南

• https://medium.com/@0snet/a-guide-to-secure-internal-websites-in-15-minutes-6c10423db853

针对密码管理器的网络钓鱼

• https://medium.com/@curtbraz/phishing-your-password-manager-8e8f90e52918

通过签名二进制文件绕过恶意软件模型

• https://embracethered.com/blog/posts/2020/microsoft-machine-learning-security-evasion-competition/

使用虚拟机实例实现驻留和逃避检测

• https://embracethered.com/blog/shadowbunny.html

Bypassing Android MDM Using Electromagnetic Fault Injection By A Gas Lighter For $1.5

• https://payatu.com/blog/arun/bypassing-android-mdm-using-electromagnetic-fault-injection-by-a-gas-lighter-for-$1.5$

自动生成微体系结构模型

• https://publikationen.sulb.uni-saarland.de/handle/20.500.11880/29336

逆向Gophe Spambot：面对COM代码并克服STL障碍

• https://github.com/strictlymike/presentations/blob/master/2020/2020.02.08_BSidesHuntsville/2020.02.08_Gophe_v1.5.pdf

如何创建一个攻击性的VPS

• https://medium.com/@robertscocca/how-to-build-a-hacking-vps-44159f1eb55c

20200925

[漏洞]

Apple开发工具中的设计漏洞，同一网络中的攻击者可以在目标设备上远程执行代码（CVE-2020-9992）

• https://github.com/c0ntextomy/c0ntextomy

Android和iOS的Instagram应用中的代码执行漏洞

• https://research.checkpoint.com/2020/instagram_rce-code-execution-vulnerability-in-instagram-app-for-android-and-ios/

[恶意代码]

恶意软件通过与从NTP服务器获取时间戳，比较时间差，来检测沙箱

• https://isc.sans.edu/forums/diary/Sandbox+Evasion+Using+NTP/26534/

黑客组织Gadolinium，使用云服务和开源工具来增强其恶意软件有效载荷的武器化能力

• https://www.microsoft.com/security/blog/2020/09/24/gadolinium-detecting-empires-cloud/

俄罗斯顶级公司和银行受到OldGremlin勒索软件运营商的攻击

• https://www.group-ib.com/blog/oldgremlin

多阶段网络钓鱼攻击，攻击者冒充政府实体和电信，以金融机构及其客户为目标

• https://info.phishlabs.com/blog/royal-ripper-multi-stage-phishing-attack-adapts-to-victim-input

SiteCloak页面混淆技术导致更多的网络钓鱼攻击无法被检测到

• https://blog.sonicwall.com/en-us/2020/09/sitecloak-page-obfuscation-techniques-leading-to-greater-number-of-missed-phishing-attacks/

[工具]

nosqli：NoSQL注入扫描器

• https://github.com/Charlie-belmer/nosqli
• https://nullsweep.com/nosqli-a-fast-nosql-injection-framework/

enum4linux：Linux版本的enum.exe，用于枚举Windows和Samba主机中的数据

• https://github.com/CiscoCXSecurity/enum4linux

maalik：功能丰富的后渗透框架

• https://github.com/quantumcored/maalik

[技术]

从红队和蓝队的角度了解CVE-2020-1472，以及如何检测、修补和hack ZeroLogon

• https://blog.zsec.uk/zerologon-attacking-defending/

使用R2实战求解一个逻辑炸弹

• https://agsyndro.me/tag/r2/

使用Dharma对V8引擎 WebAssembly API进行模糊测试

• https://academy.fuzzinglabs.com/fuzzing-v8-engine-javascript-webassembly-api-using-dharma

滥用Zerologon (CVE-2020-1472)的一种不同方式

• https://dirkjanm.io/a-different-way-of-abusing-zerologon/

从红队和蓝队的角度理解AWS IAM

• https://medium.com/bugbountywriteup/aws-iam-explained-for-red-and-blue-teams-2dda8b20fbf7

针对区块链节点和区块链网络的攻击

• https://resources.infosecinstitute.com/category/certifications-training/blockchain-security-overview/attacks-on-blockchain/

2020年第2季度互联网安全报告：恶意软件攻击在第二季度有所下降，但变得更加隐蔽

• https://www.watchguard.com/wgrd-resource-center/security-report-q2-2020

以VMware Workstation为例，介绍一种使用Fuzzing方法在闭源应用程序中查找漏洞的方法

• https://blog.khonggianmang.vn/vmware-workstation-attack-surface-through-virtual-printer/

内核漏洞利用：武器化CVE-2020-17382 MSI Ambient Link驱动程序

• https://www.matteomalvica.com/blog/2020/09/24/weaponizing-cve-2020-17382/

使用PowerShell ISE分析PowerShell脚本

• https://isc.sans.edu/forums/diary/Party+in+Ibiza+with+PowerShell/26594/

20200924

[资讯]

印度建立的新冠监控工具“北方邦新冠监控平台”泄露了数百万的用户数据，包括在北方邦（UP）、印度最大的州之一和印度其他地区测试过COVID-19阳性的每个人的全名、性别、年龄、居住地址和联系电话

• https://www.vpnmentor.com/blog/report-india-covid-leak/

健身俱乐部连锁店Town Sports因为不安全的数据库，在网上泄露了60万条会员和雇员的记录

• https://www.comparitech.com/blog/information-security/gym-chain-town-sports-exposes-personal-details-of-600000-members-staff-online-report/

[漏洞]

用于监视IT基础架构和网络的开源软件Pandora FMS的多个漏洞, 远程攻击者可以在任何Pandora FMS服务器上执行任意代码

• https://blog.sonarsource.com/pandora-fms-742-critical-code-vulnerabilities-explained

漏洞赏金：我如何看到其他用户在旅行应用程序中付款

• https://medium.com/@haxor8595/bugbounty-how-i-was-able-to-see-other-users-payments-in-a-travel-application-idor-800-2060db62cbbe

[恶意代码]

Mispadu银行木马重现, 以西班牙语和葡萄牙语为系统语言的系统为目标

• https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/mispadu-banking-trojan-resurfaces

白皮书：复杂的群体和网络犯罪分子将目光投向了利润丰厚的金融部门

• https://symantec.broadcom.com/hubfs/SED-Threats-Financial-Sector.pdf

[工具]

dnxfirewall：纯Python编写的下一代防火墙，基于Linux内核/ netfilter

• https://github.com/DOWRIGHTTV/dnxfirewall

Shield：在macOS上防护进程注入

• https://github.com/theevilbit/Shield
• https://theevilbit.github.io/shield/

mitra：生成binary polyglots

• https://github.com/corkami/mitra

[技术]

重新定义不可能：没有任意JavaScript的XSS

• https://portswigger.net/research/redefining-impossible-xss-without-arbitrary-javascript

使用CyberChef了解二进制和数据表示形式

• https://www.pentestpartners.com/security-blog/understanding-binary-and-data-representation-with-cyberchef/

暴力破解物联网和嵌入式设备系统密码

• https://cybergibbons.com/reverse-engineering-2/brute-forcing-device-passwords/

滥用组策略缓存

• https://decoder.cloud/2020/09/23/abusing-group-policy-caching/

使用mimikatz的lsadump :: setntlm进行Azure帐户劫持

• https://www.trustedsec.com/blog/azure-account-hijacking-using-mimikatzs-lsadumpsetntlm/

通过命令行工具使用日志分析来探索Linux日志

• https://dzone.com/articles/using-log-analysis-with-command-line-tools-to-expl

适用于IoT的Azure Defender提供了无代理安全性，可以连续监视工业和关键基础架构网络中的运营技术（OT）设备

• https://techcommunity.microsoft.com/t5/microsoft-security-and/azure-defender-for-iot-agentless-security-for-ot/ba-p/1698679

通过情境感知来挫败对抗性AI

• https://arxiv.org/pdf/2007.09763.pdf

20200923

[资讯]

研究人员搜索到一个可公开访问的ElasticSearch服务器，其中存储了Microsoft Bing移动应用程序用户的搜索查询和位置数据

• https://www.wizcase.com/blog/bing-leak-research/

游戏公司动视遭受黑客攻击，攻击者窃取了超过50万《使命召唤》玩家帐户

• https://securityaffairs.co/wordpress/108588/data-breach/activision-hack.html

[漏洞]

uTorrent CVE-2020-8437漏洞利用概述

• https://blog.whtaguy.com/2020/09/utorrent-cve-2020-8437-vulnerability.html

结合使用不安全的Hadoop和MCollective，关闭整个云托管公司网络

• https://medium.com/bugbountywriteup/combining-hadoop-and-mcollective-for-total-network-compromise-cda00429af27

Web应用程序TinyTinyRSS 的漏洞利用

• https://www.digeex.de/blog/tinytinyrss/

Citrix Workspace应用程序的漏洞可以使攻击者获取SYSTEM Shell

• https://www.pentestpartners.com/security-blog/the-return-of-raining-system-shells-with-citrix-workspace-app/

[恶意代码]

US-Cert发布警告称，自2020年7月以来，LokiBot恶意软件攻击显着增加

• https://us-cert.cisa.gov/ncas/alerts/aa20-266a

[工具]

crowdsec：用Golang编写的现代行为检测系统。基于Fail2ban的理念，使用Grok模式和YAML语法来分析日志，一旦检测到恶意行为，可以使用各种方式（阻止，403，验证码等）纠正威胁，并且被阻止的IP在所有用户之间共享，以进一步提高其安全性

• https://github.com/crowdsecurity/crowdsec

[技术]

Espressif ESP32故障注入：绕过加密的安全启动（CVE-2020-13629）

• https://raelize.com/posts/espressif-esp32-bypassing-encrypted-secure-boot-cve-2020-13629/

使用client-puzzle协议，对抗Web机器人, 使机器人的速度与正常人一样慢，极大地阻止机器人在网站上执行不必要的操作

• https://littlemaninmyhead.wordpress.com/2020/09/20/fighting-bots-with-the-client-puzzle-protocol/
• https://github.com/ScottContini/client-puzzle

关于公开的DoH服务器的调查

• https://firejaildns.wordpress.com/2020/09/22/a-survey-of-public-dns-over-- https-servers/

IEEE 802.11帧，以及如何获取它们

• https://splone.com/blog/2020/9/22/ieee-80211-frames-and-how-to-get-them/

古老的二进制文件suPHP可用于获取Root Shell

• https://vulnerable.af/posts/suphp-ghost-in-your-shell/

在对2,064个Google Cloud存储桶的调查中，发现其中131个存储桶容易受到用户的非法访问，可以列出、下载和/或上传文件

• https://www.comparitech.com/blog/information-security/google-cloud-buckets-unauthorized-access-report/

如何配置Android虚拟机用于移动渗透测试

• https://blog.secureideas.com/2020/09/how-to-configure-android-virtual-for-mobile-pentest.html

Fun with Header and Forget Password

• https://medium.com/bugbountywriteup/fun-with-header-and-forget-password-without-that-nasty-twist-cbf45e5cc8db

Cewlkid: 1 Vulnhub Walkthrough

• https://www.hackingarticles.in/cewlkid-1-vulnhub-walkthrough/

Hacking XML数据：使用XPATH注入获得非法数据访问

• https://vkili.github.io/blog/hacking/xpath-injection/

20200922

[漏洞]

Metasploit模块，利用VyOS命令注入漏洞和不安全的默认sudo配置来以root用户身份执行任意系统命令

• https://packetstormsecurity.com/files/159234/vyos_restricted_shell_privesc.rb.txt

[漏洞]

几条关于CVE-2020-15148（yii2反序列化）的绕过

• https://github.com/Maskhe/CVE-2020-15148-bypasses

[恶意代码]

检测Cobalt Strike的科学与艺术

• https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/094/942/original/Talos_Cobalt_Strike.pdf

Rampant Kitten：正在进行的针对伊朗侨民和持不同政见者的伊朗实体监视行动

• https://research.checkpoint.com/2020/rampant-kitten-an-iranian-espionage-campaign/

Salesforce网络钓鱼电子邮件的分析

• https://isc.sans.edu/forums/diary/Analysis+of+a+Salesforce+Phishing+Emails/26582/

[工具]

duplicut：快速删除大规模wordlist中的重复项，不更改顺序

• https://github.com/nil0x42/duplicut

rtfsig：一种帮助恶意软件分析师识别RTF文档独特部分的工具

• https://github.com/PwCUK-CTO/rtfsig

[技术]

解决r2con2020会议期间发布的r2-pay挑战，Part1：反调试、反root和反frida

• https://www.romainthomas.fr/post/20-09-r2con-obfuscated-whitebox-part1/

Writeup-Vulnhub-Kioptrix

• https://medium.com/bugbountywriteup/writeup-vulnhub-kioptrix-5-3ac4bcae9f15

讨论SOC的一些弱点和基本局限性，以及为什么将来很可能会继续发生数据泄露，安全事件和勒索软件攻击

• https://www.infosecmatter.com/fundamental-weaknesses-of-a-soc/

TokyoWesterns CTF 2020 | writeups

• https://gist.github.com/terjanq/e2198440c4fdfbdec43e921b600d4a1d#tokyowesterns-ctf-2020--writeups-by-terjanq

逆向Apple使用的两个Protobuf的一部分，一个用于Note格式本身，另一个用于嵌入式对象

• https://ciofecaforensics.com/2020/09/18/apple-notes-revisited-protobuf/

如何真正存储和检查密码

• https://medium.com/leonard-cyber/how-really-to-store-your-users-passwords-and-api-tokens-which-are-passwords-5132cec8835b

在macOS平台上使用.LNK和Dock实现驻留

• https://posts.specterops.io/are-you-docking-kidding-me-9aa79c24bdc1

使用Kubernetes和App Engine在Google Cloud Platform上创建可扩展的CTF基础架构

• https://medium.com/@sam.calamos/creating-scalable-ctf-infrastructure-on-google-cloud-platform-with-kubernetes-and-app-engine-8c0a7847a53c

通过第三方框架进行macOS注入

• https://www.trustedsec.com/blog/macos-injection-via-third-party-frameworks

Capture the flag: A walkthrough of SunCSR’s Geisha

• https://resources.infosecinstitute.com/capture-the-flag-ctf-suncsrs-geisha

20200921

[漏洞]

在源代码中使用硬编码凭据会导致管理面板访问(CVE-2020–24115)

• https://medium.com/bugbountywriteup/cve-2020-24115-use-of-hardcoded-credentials-in-source-code-leads-to-admin-panel-access-8262cb51d119

Synology子域上未经身份验证的文件上传漏洞

• https://blog.securelayer7.net/unauthenticated-file-upload-vulnerability-on-synology-sub-domain/

Android版Firefox浏览器的SSDP引擎中存在漏洞，攻击者可以利用该漏洞劫持Android手机

• https://twitter.com/LukasStefanko/status/1307013106615418883
• https://gitlab.com/gitlab-com/gl-security/security-operations/gl-redteam/red-team-tech-notes/-/blob/master/firefox-android-2020/ffssdp.py

[恶意代码]

可以重新感染已清洁文件的PHP恶意软件

• https://blog.sucuri.net/2020/09/the-hidden-php-malware-that-reinfects-cleaned-files.html

Rudeminer, Blacksquid and Lucifer Walk Into A Bar

• https://research.checkpoint.com/2020/rudeminer-blacksquid-and-lucifer-walk-into-a-bar/

Ashok：用于侦察的瑞士军刀

• https://github.com/ankitdobhal/Ashok

回顾Linux APT攻击的最后十年

• https://www.intezer.com/blog/cloud-security/looking-back-on-the-last-decade-of-linux-apt-attacks/

[工具]

在线版的反向Shell生成器

• https://weibell.github.io/reverse-shell-generator/

chromium-ipc-sniffer：使用Wireshark捕获Chromium进行之间通过IPC通信的数据

• https://github.com/tomer8007/chromium-ipc-sniffer

Winshark：Wireshark插件，用于插桩ETW

• https://github.com/airbus-cert/Winshark

bxss：盲XSS注入工具

• https://github.com/ethicalhackingplayground/bxss

Brutus：基于Python的漏洞利用框架

• https://github.com/MatthewZito/Brutus

crlfmap：查找- http分割漏洞

• https://github.com/ethicalhackingplayground/crlfmap

Zin：用于漏洞赏金的Payload注入器

• https://github.com/ethicalhackingplayground/Zin

[技术]

HP纳米处理器，Part2：对模板的电路进行逆向工程

• http://www.righto.com/2020/09/hp-nanoprocessor-part-ii-reverse.html

使用BigQuery在IIS上查找隐藏的文件和文件夹

• https://blog.assetnote.io/2020/09/18/finding-hidden-files-folders-iis-bigquery/

使用二维码隐藏C&C流量

• https://medium.com/@curtbraz/one-part-steganography-four-redirectors-and-a-splash-of-c2-e13e5a65daa9

使用Hell’s Gate实现直接系统调用

• https://teamhydra.blog/2020/09/18/implementing-direct-syscalls-using-hells-gate/
• https://github.com/N4kedTurtle/HellsGatePoC

针对渗透测试和安全研究人员的关于在线赌博轮盘的指南

• https://research.nccgroup.com/2020/09/18/online-casino-roulette-a-guideline-for-penetration-testers-and-security-researchers/

A Year and a Half of End-to-End Encryption at Misakey

• https://about.misakey.com/cryptography/white-paper.html

关于开源Web Fuzzing工具FFUF你不可不知的一切

• https://codingo.io/tools/ffuf/bounty/2020/09/17/everything-you-need-to-know-about-ffuf.html

IoT设备密码爆破

• https://cybergibbons.com/reverse-engineering-2/brute-forcing-device-passwords/

将TCP代理服务构建到Thinkst Canary设备中，使其成为交互式蜜罐

• https://research.nccgroup.com/2020/09/14/extending-a-thinkst-canary-to-become-an-interactive-honeypot/

Winja CTF 2020: Write-up

• https://medium.com/bugbountywriteup/winja-ctf-write-up-f33db5ee7afe

Chili: 1 Vulnhub Walkthrough

• https://www.hackingarticles.in/chili-1-vulnhub-walkthrough/

CengBox: 2: Vulnhub Walkthrough

• https://www.hackingarticles.in/cengbox-2-vulnhub-walkthrough/

CryptoBank: 1: Vulnhub Walkthrough

• https://www.hackingarticles.in/cryptobank-1-vulnhub-walkthrough/

攻击者正在滥用Google的App Engine来规避企业安全解决方案

• https://medium.com/@marcelx/attackers-are-abusing-googles-app-engine-to-circumvent-enterprise-security-solutions-again-eda8345d531d

Categorizing human phishing difficulty: a Phish Scale

• https://academic.oup.com/cybersecurity/article/6/1/tyaa009/5905453

使用python抓取（使用Javascript实时填充或渲染的）动态网站

• https://www.youtube.com/watch?v=8Uxxu0-dAKQ

How SSRF (and XXE) Vary in Severity (Part 1)

• https://www.synack.com/blog/how-ssrf-and-xxe-vary-in-severity-part-1/

20200918

[资讯]

新泽西大学医院（UHNJ）遭受SunCrypt勒索软件攻击，攻击者声称窃取了240 GB的数据，并发布了其中的1.7G，包含超过48,000个文档

• https://www.bleepingcomputer.com/news/security/university-hospital-new-jersey-hit-by-suncrypt-ransomware-data-leaked/

[漏洞]

Micropatch for Zerologon, the "perfect" Windows vulnerability (CVE-2020-1472)

• https://blog.0patch.com/2020/09/micropatch-for-zerologon-perfect.html

Invoke-ZeroLogon：利用ZeroLogon攻击的PowerShell脚本

• https://github.com/BC-SECURITY/Invoke-ZeroLogon

基于HiSilicon hi3520d硬件的IPTV / H.264 / H.265视频编码器中的严重漏洞, 所有漏洞都可以远程利用，并且可能导致敏感信息泄露、拒绝服务和远程执行代码，从而完全接管设备

• https://kojenov.com/2020-09-15-hisilicon-encoder-vulnerabilities/

反垃圾邮件产品 SpamTitan Gateway的一些漏洞，可导致未经身份验证的远程代码执行

• https://sensepost.com/blog/2020/clash-of-the-spamtitan/
• https://github.com/sensepost/ClashofSpamTitan

[恶意代码]

垃圾邮件活动中，攻击者为绕过垃圾邮件检测系统而使用新的的url混淆技术：将ip地址编码为十六进制，以及执行URL语义攻击

• https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/evasive-urls-in-spam/

迷宫勒索软件为了躲避检测使用的Ragnar Locker虚拟机技术

• https://news.sophos.com/en-us/2020/09/17/maze-attackers-adopt-ragnar-locker-virtual-machine-technique/

[工具]

dorkX：Pipe different tools with google dork Scanner

• https://github.com/ethicalhackingplayground/dorkX

masm_shc：辅助创建Shellcode：清除由MSVC生成的MASM文件，给出重构提示

• https://github.com/hasherezade/masm_shc

unmap：将JavaScript Source Map解压缩到文件系统结构中

• https://github.com/chbrown/unmap

[技术]

用照片和Zip文件混淆宏文档，降低在VT的检出率

• https://billdemirkapi.me/Defeating-Macro-Document-Static-Analysis-with-Pictures-of-My-Cat/
• https://gist.github.com/D4stiny/3429852f2fe8b7f7725e7f5cc18cafbd

LLVM模糊测试库部分libFuzzer如何与rev.ng结合使用，以执行覆盖率指导的可执行二进制文件的黑盒模糊测试

• https://rev.ng/blog/fuzzing/post.html

编写C#代码自动提取ReZer0的Payload和配置

• https://maxkersten.nl/binary-analysis-course/analysis-scripts/automatic-rezer0-payload-and-configuration-extraction/

Hacking on Bug Bounties for Four Years

• https://blog.assetnote.io/2020/09/15/hacking-on-bug-bounties-for-four-years/

使用Beacon对象文件扩展Cobalt Strike：Zerologon、SMBGhost和环境感知

• https://blog.cobaltstrike.com/2020/09/17/beacon-object-file-adventures-some-zerologon-smbghost-and-situational-awareness/

Windows横向渗透，Part2：DCOM

• https://www.mdsec.co.uk/2020/09/i-like-to-move-it-windows-lateral-movement-part-2-dcom/

From a comment to a CVE: Content filter strikes again!

• https://blog.zecops.com/vulnerabilities/from-a-comment-to-a-cve-content-filter-strikes-again/

武器化Active Directory组策略对象(Group Policy Objects)

• https://www.trustedsec.com/blog/weaponizing-group-policy-objects-access

20200917

[漏洞]

Apache OFBiz 套件中反序列化导致RCE的漏洞(CVE-2020-9496)

• https://www.zerodayinitiative.com/blog/2020/9/14/cve-2020-9496-rce-in-apache-ofbiz-xmlrpc-via-deserialization-of-untrusted-data

Tor 0Day：介绍用于标识用户和隐藏服务的真实网络地址的不同情况，以及可以将一些出口流量映射回最终用户的情况

• https://www.hackerfactor.com/blog/index.php?/archives/896-Tor-0day-Finding-IP-Addresses.html

[恶意代码]

介绍朝鲜背景与俄语背景的网络犯罪分子的公开报道的可信度：检查TrickBot、TA505和Dridex，并试图了解这些威胁与朝鲜黑客之间的潜在联系

• https://public.intel471.com/blog/partners-in-crime-north-koreans-and-elite-russian-speaking-cybercriminals/

[工具]

graylog2thehive：将Graylog(开源日志管理工具)告警转换为The Hive(开源事件响应平台)告警

• https://github.com/reconinfosec/graylog2thehive

whalescan：针对Windows容器的漏洞扫描器，执行多个基准测试检查，以及检查容器上的CVEs/脆弱包

• https://github.com/nccgroup/whalescan

memfuck：绕过用户模式Hooking

• https://github.com/jackullrich/memfuck
• https://winternl.com/memfuck/

v8_dll_resolver：一个针对v8的javascript dll解析器

• https://github.com/Geluchat/v8_dll_resolver

h2csmuggler: - http Request Smuggling over - http/2 Cleartext (h2c)

• https://github.com/BishopFox/h2csmuggler

[技术]

UEFI安全启动自定义

• https://media.defense.gov/2020/Sep/15/2002497594/-1/-1/0/CTR-UEFI-SECURE-BOOT-CUSTOMIZATION-20200915.PDF/CTR-UEFI-SECURE-BOOT-CUSTOMIZATION-20200915.PDF

编译自定义的Mimikatz二进制文件，绕过AV/EDR

• https://s3cur3th1ssh1t.github.io/Building-a-custom-Mimikatz-binary/

漏洞赏金脑图

• https://blog.it-securityguard.com/patriks-bug-bounty-tools-%f0%9f%9b%a0%ef%b8%8f/

恶意活动检测的过去、现在和将来

• https://posts.specterops.io/detections-of-past-present-and-future-26af95517e77

20200916

[漏洞]

Zerologon漏洞PoC（CVE-2020-1472）

• https://github.com/dirkjanm/CVE-2020-1472

滥用CVE-2020-1472（Zerologon）接管域，然后修复本地存储的计算机帐户密码

• https://github.com/bb00/zer0dump

SharpZeroLogon：CVE-2020-1472 Exploit

• https://github.com/nccgroup/nccfsas/tree/main/Tools/SharpZeroLogon

Acronis Cyber Backup未经身份认证的SSRF漏洞，攻击者可通过滥用绑定到本地主机的Web服务向任何收件人发送完全可自定义的电子邮件

• https://www.rcesecurity.com/2020/09/CVE-2020-16171-Exploiting-Acronis-Cyber-Backup-for-Fun-and-Emails/

BM Spectrum Protect Plus 10.1.6-1974多个漏洞（CVE-2020-4711/ CVE-2020-4703）

• https://www.tenable.com/security/research/tra-2020-54

Microsoft 365的新漏洞，在启用WS-Trust的云环境中也可以绕过多因素身份验证

• https://www.proofpoint.com/us/blog/cloud-security/new-vulnerabilities-bypass-multi-factor-authentication-microsoft-365

[工具]

analyzer：离线威胁情报分析器，用于从文件/转储中提取工件和IoC到可读格式

• https://github.com/qeeqbox/analyzer

MIDNIGHTTRAIN：一个隐蔽的驻留框架

• https://github.com/slaeryan/MIDNIGHTTRAIN
• https://slaeryan.github.io/posts/midnighttrain.html

恶意hisilicon脚本

• https://github.com/tothi/malicious-hisilicon-scripts

• httptoolkit：拦截、检查和重写从任何地方到任何地方的- http（S）流量，支持跨平台

• https://github.com/- httptoolkit/- httptoolkit

adversary_emulation_library：攻击者仿真库，旨在使组织能够根据实际的TTP测试其防御能力。当前只添加了FIN6的仿真计划

• https://github.com/center-for-threat-informed-defense/adversary_emulation_library
• https://medium.com/mitre-engenuity/center-releases-fin6-adversary-emulation-plan-775d8c5ebe9b

onefuzz：自托管的Fuzzing-As-A-Service平台

• https://github.com/microsoft/onefuzz

[技术]

固件基础简要概述

• https://eclecticlight.co/2020/09/15/firmware-fundamentals/

使用Wireshark从网络流量中识别恶意负载

• https://isc.sans.edu/diary/26566

拆解集成了区块链的智能锁360Lock

• https://www.pentestpartners.com/security-blog/360lock-smart-lock-review/

以tesla.com为攻击目标，演示渗透过程

• https://threat.tevora.com/attacking-the-perimeter/

使用Aircrack-ng对邻居执行取消认证攻击，将邻居从其网络中踢出去

• https://medium.com/bugbountywriteup/your-neighbours-music-sucks-aircrack-ng-for-the-rescue-a5124a2e2734

我如何入侵在线汽车票务应用程序Redbus

• https://medium.com/bugbountywriteup/how-i-hacked-redbus-an-online-bus-ticketing-application-24ef5bb083cd

漏洞赏金中如何正确的执行侦察操作

• https://medium.com/bugbountywriteup/how-to-do-your-reconnaissance-properly-before-chasing-a-bug-bounty-49ca4e1f580

使用黑客的思维方式找回丢失的电话号码

• https://medium.com/bugbountywriteup/recovering-a-lost-phone-number-using-hacker-mindset-5e7e7a30edbd

HEVD writeups

• https://yuvaly0.github.io/2020/09/15/hevd-writeups.html

BLESA:对低能量蓝牙重新连接的欺骗攻击

• https://friends.cs.purdue.edu/pubs/WOOT20.pdf

20200915

[资讯]

巨型办公零售公司Staples披露了数据泄露事件，攻击者在9月初访问了其有限数量的客户订单数据，未泄露敏感数据

• https://securityaffairs.co/wordpress/108271/data-breach/staples-data-breach.html

[漏洞]

ZeroLogon技术细节：Unauthenticated domain controller compromise by subverting Netlogon cryptography (CVE-2020-1472)

• https://www.secura.com/pathtoimg.php?id=2055

组合硬件漏洞和CVE-2020-15048将任意值加载到PC寄存器中

• https://raelize.com/posts/espressif-systems-esp32-bypassing-flash-encryption/

[工具]

bantam：一个PHP后门管理和生成工具，具有端到端加密的有效负载流，旨在绕过WAF，IDS，SIEM系统

• https://github.com/gellin/bantam

monkey-shell：反向Shell Bash脚本

• https://github.com/spyx/monkey-shell

hfinger：用于对恶意软件的- http请求进行指纹识别

• https://github.com/CERT-Polska/hfinger

TransitionalPeriod：生成从内核模式到用户模式的Payload（x64 / x86）

• https://github.com/SecIdiot/TransitionalPeriod

XXE Payload列表

• https://gist.github.com/honoki/d7035c3ccca1698ec7b541c77b9410cf

[技术]

书籍《Ghidra Book》目录

• https://maxkersten.nl/2020/09/13/a-review-of-the-ghidra-book

基于boolean的高级SQLi过滤器过滤技术

• https://www.secjuice.com/advanced-sqli-waf-bypass/

智能协议Hacking，Part5：了解和攻击以太坊区块链上的身份验证和授权

• http://console-cowboys.blogspot.com/2020/09/smart-contract-hacking-chapter-5.html

使用Evil-WinRM以SYSTEM权限运行代码

• https://malicious.link/post/2020/run-as-system-using-evil-winrm

钓鱼工具evilginx2 2.4版更新内容

• https://breakdev.org/evilginx-2-4-gone-phishing/

进攻式开发：EDR世界中的后渗透Tradecraft

• https://github.com/mdsecresearch/Publications/blob/master/presentations/Offensive%20Development%20-%20Post-Exploitation%20Tradecraft%20in%20an%20EDR%20World%20-%20x33fcon%202020.pdf

在IIS/.NET中查找隐藏文件和目录

• https://www.youtube.com/watch?v=HrJW6Y9kHC4

20200914

[资讯]

美国最大的IT人员配置公司之一的Artech信息系统在1月初遭受REvil勒索软件攻击，攻击者窃取了337MB机密文件

• https://www.bleepingcomputer.com/news/security/us-staffing-firm-artech-discloses-ransomware-attack-data-breach/

研究人员发现一个属于游戏硬件制造商Razer的可公开访问的数据库，包括大约10万条用户从Razer在线商店购买商品的信息，其中包括客户信息、订单信息、送货地址等

• https://www.linkedin.com/pulse/thousands-razer-customers-order-shipping-details-web-diachenko/

[漏洞]

Facebook MobileIron MDM上未经身份验证的RCE

• https://blog.orange.tw/2020/09/how-i-hacked-facebook-again-mobileiron-mdm-rce.html
• https://hitcon.org/2020/slides/How%20I%20Hacked%20Facebook%20Again!.pdf

Linux内核UAF漏洞和2个CVE（CVE-2020-14356 & CVE-2020-25220）

• http://blog.pi3.com.pl/?p=720

Giggle; laughable security

• https://research.digitalinterruption.com/2020/09/10/giggle-laughable-security/

WordPress插件Email Subscribers的未经身份验证的电子邮件伪造/欺骗漏洞

• https://www.tenable.com/security/research/tra-2020-53

使用Impacket库测试Zerologon exploit（CVE-2020-1472）

• https://github.com/SecuraBV/CVE-2020-1472
• https://www.secura.com/blog/zero-logon

[工具]

lucid：交互式IDA微码（Microcode）探索器

• https://github.com/gaasedelen/lucid
• https://blog.ret2.io/2020/09/11/lucid-hexrays-microcode-explorer/

az5：MongoDB SCRAM-SHA-1 bruteforcer

• https://github.com/anthrax1/az5

kb：一个极简的知识库管理器

• https://github.com/gnebbia/kb

darkshot：爬虫工具，用于分析Lightshot上公开的20亿张照片

• https://github.com/mxrch/darkshot

BugBountyScanner：用于漏洞赏金侦察阶段的Bash脚本，以Headless方式使用

• https://github.com/chvancooten/BugBountyScanner

rshijack：TCP连接劫持工具，shijack的Rust重写版

• https://github.com/kpcyrd/rshijack

mzap：在ZAP中执行多目标扫描

• https://github.com/hahwul/mzap

TIGMINT：Twitter, Instagram and Geo-Tagging Media Intelligence

• https://github.com/TIGMINT/TIGMINT

SIPTorch：针对会话初始化协议（SIP：Session Initiation Protocol）的测试工具

• https://github.com/0xInfection/SIPTorch

spyre：基于Yara的IoC扫描器

• https://github.com/spyre-project/spyre

CrossC2：生成CobaltStrike的跨平台beacon

• https://github.com/gloxec/CrossC2

crlfuzz：扫描CRLF漏洞，GoLang编写

• https://github.com/dwisiswant0/crlfuzz

Some-Tools：辅助渗透工具安装和自动更新

• https://github.com/som3canadian/Some-Tools

• http-revshell：PowerShell编写的反向Shell，使用- http/S协议，支持AMSI绕过和代理感知

• https://github.com/3v4Si0N/- http-revshell

DockerENT：在运行时分析Docker容器和Docker网络的漏洞和配置问题

• https://github.com/r0hi7/DockerENT

Monitorizer：终极子域名监控框架

• https://github.com/BitTheByte/Monitorizer

[技术]

逆向《我的世界》：iconic pack.png image的种子是如何找到的

• https://www.youtube.com/watch?v=ea6py9q46QU

BinaryNinja提供的用户知情的数据流（UIDF）分析功能

• https://binary.ninja/2020/09/10/user-informed-dataflow.html

使用Cutter分析恶意代码

• https://malwology.com/2019/03/14/intro-to-cutter-for-malware-analysis/

针对谷歌Chrome浏览器的Man-in-the-Browser攻击，Part2：定位SSL_Write和SSL_Read

• https://plainsec.org/man-in-the-browser-in-google-chrome-part-2-locating-ssl-write-and-ssl-read/

控制流完整性的最新发展

• https://eiken.dev/blog/2020/09/recent-developments-in-control-flow-integrity/

理解和防止web应用程序中的DoS

• https://r2c.dev/blog/2020/understanding-and-preventing-dos-in-web-apps/

如何执行容器审核和漏洞评估

• https://www.hackingarticles.in/docker-for-pentester-image-vulnerability-assessment/

逆向第一个FPGA（可编程门阵列）芯片：XC2064

• http://www.righto.com/2020/09/reverse-engineering-first-fpga-chip.html

机器学习攻击系列：暴力破解图像查找错误的预测

• https://embracethered.com/blog/posts/2020/husky-ai-machine-learning-attack-bruteforce/

20200911

[资讯]

世界上最大的托管数据中心和互联网连接提供商之一Equinix受到Netwalker勒索软件攻击，攻击者窃取数据并勒索450万美元赎金

• https://securityaffairs.co/wordpress/108115/cyber-crime/equinix-netwalker-ransomware.html

[漏洞]

BlindSide：在推测性执行域（speculative execution domain）中进行BROP式攻击，以反复探测和解除内核地址空间的随机化，制作任意内存读取小工具，并实现可靠的利用

• https://www.vusec.net/projects/blindside/
• https://download.vusec.net/papers/blindside_ccs20.pdf

迈阿密Pwn2Own竞赛上演示的在Schneider Electric的EcoStruxure操作员终端软件上实现的代码执行漏洞

• https://www.zerodayinitiative.com/blog/2020/9/9/performing-sql-backflips-to-achieve-code-execution-on-schneider-electrics-ecostruxure-operator-terminal-expert-at-pwn2own-miami-2020

漏洞挖掘：在NVIDIA GeForce NOW虚拟机上执行任意代码

• https://habr.com/en/company/drweb/blog/518052/

MS Exchange服务器DlpUtils AddTenantDlpPolicy远程执行代码漏洞（CVE-2020-16875）

• https://srcincite.io/advisories/src-2020-0019/
• https://srcincite.io/pocs/cve-2020-16875.py.txt
• https://srcincite.io/pocs/cve-2020-16875.ps1.txt

MS Hypver-V hvix64模块（管理程序）中存在的漏洞会导致无限递归，从而导致堆栈溢出和DoS（CVE-2020-0751）

• https://labs.bluefrostsecurity.de/advisories/bfs-sa-2020-001/

MS Hyper-V（hvix64）仿真处理程序中用于VMLAUNCH / VMRESUME的漏洞，可导致恶意的L2虚拟机管理程序触发L1虚拟机管理程序中的NULL指针解引用（CVE-2020-0890）

• https://labs.bluefrostsecurity.de/advisories/bfs-sa-2020-002/

MS Hyper-V（hvix64）哈希表实现中存在的漏洞，可导致取消对哈希表结构对象附近（或属于该哈希表结构对象）的内存的引用（CVE-2020-0904）

• https://labs.bluefrostsecurity.de/advisories/bfs-sa-2020-003/

[恶意代码]

针对特殊VoIP平台的恶意软件CDRThief

• https://www.welivesecurity.com/2020/09/10/who-callin-cdrthief-linux-voip-softswitches/

In-Depth Malicious Windows Link with Embedded Microsoft Cabinet

• https://www.youtube.com/watch?v=S69_X6ExTpk

针对Linux系统的攻击与APT概述

• https://securelist.com/an-overview-of-targeted-attacks-and-apts-on-linux/98440/

[工具]

malware-ioc-hash：对从多个站点抓取的包含IoC-Hash的文章进行搜索。当前包括文章个数: 11757，当前包括Hash个数: 37871

• https://github.com/alphaSeclab/malware-ioc-hash

pug：Active Directory取证工具，旨在搜索域的快照之间的差异

• https://github.com/jonisakov/pug

proxyfor：快速验证给定的代理列表是否可以访问指定网站

• https://github.com/0xsha/proxyfor

CloudBrute：在顶级云服务提供商上查找给定公司（目标）的基础设施、文件和App

• https://github.com/0xsha/CloudBrute
• https://0xsha.io/posts/introducing-cloudbrute-wild-hunt-on-the-clouds

StreamDivert：将（特定的）TCP，UDP和ICMP通信重定向到另一个目标

• https://github.com/jellever/StreamDivert
• https://research.nccgroup.com/2020/09/10/streamdivert-relaying-specific-network-connections/

Azure-Sentinel：存储库包含开箱即用的检测、探索查询、搜寻查询、工作簿、剧本等等，用于辅助充分利用Azure Sentinel，并提供安全性内容以保护环境并寻找威胁

• https://github.com/Azure/Azure-Sentinel

针对Windows平台的OneLiner收集

• https://github.com/trickster0/Windows_OneLiners

常见的C＃攻击性工具的Nightly构建，从它们各自的主分支中重新生成

• https://github.com/Flangvik/SharpCollection

来自JWT示例代码和自述文件的“secrets”列表 jwt_secrets：- https://github.com/BBhacKing/jwt_secrets

[技术]

使用BPF拦截Zoom的加密数据

• https://confused.ai/posts/intercepting-zoom-tls-encryption-bpf-uprobes

使用Ghidra Server实现协作式逆向分析

• https://byte.how/posts/collaborative-reverse-engineering/

针对Twitter账户的钓鱼攻击活动：使用Twitter对最近对网络钓鱼帐户凭据的违反的回复和邮件投递平台SendGrid进行网络钓鱼

• https://code.firstlook.media/attackers-are-using-twitter-s-response-to-recent-breach-to-phish-account-credentials-using-sendgrid-for-their-campaign

构建安全的Amazon S3 Bucket (AWS)

• https://www.fugue.co/blog/building-a-secure-amazon-s3-bucket-aws

黑客组织进行的凭证收集活动的战术细节，以及检测此类活动的新模式

• https://www.microsoft.com/security/blog/2020/09/10/strontium-detecting-new-patters-credential-harvesting/

Web App安全101

• https://github.com/cranelab/webapp-tech

20200910

[资讯]

巴基斯坦领先的电力提供商K-ElectricK遭受NetWalker勒索软件攻击，影响了其账单和在线服务，攻击者索要$ 3,850,000赎金

• https://www.hackread.com/netwalker-ransomware-hits-pakistan-power-supplier-k-electric/

斯洛伐克加密交易所ETERBASE在星期一晚上遭受黑客攻击，攻击者盗走高达500万美元的加密货币

• https://www.hackread.com/hackers-attack-european-crypto-exchange-eterbase/

[漏洞]

Raccoon：TLS 规范中的计时漏洞，影响- httpS和其他依赖SSL和TLS的服务

• https://raccoon-attack.com/

罗克韦尔和西门子等顶级ICS供应商使用的第三方工业组件中存在六个严重漏洞，未经身份验证的远程攻击者可以利用该漏洞发起各种恶意攻击，包括部署勒索软件，关闭甚至接管关键系统

• https://www.claroty.com/2020/09/08/blog-research-wibu-codemeter-vulnerabilities/
• https://us-cert.cisa.gov/ics/advisories/icsa-20-203-01

英特尔在其主动管理技术（AMT）中修补了一个严重的特权提升漏洞，该漏洞可能使未经身份验证的攻击者获得对英特尔vPro公司系统的提升的特权

• https://blogs.intel.com/technology/2020/09/intel-september-2020-security-advisories/#gs.f5n8b0

PHP Phar反序列化漏洞利用

• https://vkili.github.io/blog/insecure%20deserialization/php-phar/

Projected file system - escalation of privilege

• https://docs.google.com/document/d/1E1Qsbz1CT5E2VQDEsENbv-kCVTVnGVol3Qt3XLqPero/edit#

蓝牙系统的BLURtooth漏洞：使用交叉传输密钥派生（CTKD）进行配对的同时支持Bluetooth BR / EDR和LE的设备容易受到密钥覆盖的攻击，攻击者可以通过降低加密密钥强度或限制获得对不受限制的配置文件或服务的其他访问权限

• https://kb.cert.org/vuls/id/589825

[恶意代码]

黑客组织TeamTNT滥用合法的云监控工具Weave Scope进行网络攻击，在目标Docker和Kubernetes集群上建立了无文件后门

• https://www.intezer.com/blog/cloud-workload-protection/attackers-abusing-legitimate-cloud-monitoring-tools-to-conduct-cyber-attacks/

Zeppelin勒索软件重新流行

• https://blogs.juniper.net/en-us/threat-research/zeppelin-ransomware-returns-with-a-fresh-wave-of-attacks

[工具]

rakkess：kubectl插件，显示服务器资源的访问矩阵

• https://github.com/corneliusweig/rakkess

PEzor：PE加壳工具，将现有的多种工具集成到一起, 构成工具链，实现免杀

• https://github.com/phra/PEzor

[技术]

动态构建控制流图（CFG）实战

• https://homepages.dcc.ufmg.br/~fernando/publications/papers/RimsaSPE20.pdf

通过手动修改绕过AMSI，Part2：构建不会触发AMSI的自定义Invoke-Mimikatz脚本

• https://s3cur3th1ssh1t.github.io/Bypass-AMSI-by-manual-modification-part-II/

Pico CTF 2018: Be Quick or Be Dead (R2)

• https://agsyndro.me/be-quick-or-be-dead/

扩展客户端审查规避工具Geneva，实现第一个纯粹的服务器端审查逃避策略，以自动发现和实施服务器端策略，并将其应用于四个国家（**，印度，伊朗和哈萨克斯坦）和五个协议（DNS-over-TCP，FTP，- http ，- httpS和SMTP）

• https://dl.acm.org/doi/abs/10.1145/3387514.3405889
• https://geneva.cs.umd.edu/posts/server-side/

使用Fuzzilli对JavaScript引擎进行Fuzzing

• https://blog.doyensec.com/2020/09/09/fuzzilli-jerryscript.html

检测Excel文件是否包括4.0宏的多种方式

• https://blog.reversinglabs.com/blog/excel-4.0-macros

20200909

[漏洞]

XSS->Fix->Bypass: 10000$ bounty in Google Maps

• https://www.ehpus.com/post/xss-fix-bypass-10000-bounty-in-google-maps

攻击高通Adreno GPU：介绍可从Android应用程序沙箱访问的有趣的攻击面：GPU硬件

• https://googleprojectzero.blogspot.com/2020/09/attacking-qualcomm-adreno-gpu.html

MoFi网络路由器的多个漏洞，包括可以用来远程入侵设备的严重漏洞

• https://www.criticalstart.com/critical-vulnerabilities-discovered-in-mofi-routers/

(Windows10)当在进程之外使用StorageFolder类时，它可以绕过安全检查来读写AppContainer不允许的文件

• https://bugs.chromium.org/p/project-zero/issues/detail?id=2055

[恶意代码]

Shlayer恶意软件的最新变种ZShlayer：率先采用苹果公司的Zsh而不是Bash作为其默认的Shell语言，并采用了一种新颖的编码方法来避免检测

• https://www.sentinelone.com/blog/coming-out-of-your-shell-from-shlayer-to-zshlayer/

[工具]

twistrs：Rust编写的域名枚举工具

• https://github.com/JuxhinDB/twistrs
• https://blog.digital-horror.com/twistrs/

cryptoguard：在Java和Android程序中查找错误使用的加密（cryptographic）

• https://github.com/CryptoGuardOSS/cryptoguard
• https://www.computer.org/csdl/pds/api/csdl/proceedings/download-article/1mbmHwIxTb2/pdf

PurpleCloud：云中小型Active Directory渗透测试实验室的基础架构即代码（IaC：Infrastructure as Code）部署

• https://github.com/iknowjason/PurpleCloud

[技术]

渗透工具包Axiom介绍

• https://adamsvoboda.net/axiom-feels-like-cheating/

h2c Smuggling: Request Smuggling Via - http/2 Cleartext (h2c)

• https://labs.bishopfox.com/tech-blog/h2c-smuggling-request-smuggling-via-- http/2-cleartext-h2c

Elastic Kubernetes服务（EKS）的安全组（SG）和网络访问控制列表（NACL）配置

• https://www.padok.fr/en/blog/sg-nacl-eks

滥用Azure AD中的动态组进行特权升级

• https://www.mnemonic.no/blog/abusing-dynamic-groups-in-azure/

被低估的Obscurity安全性：针对Obscurity不安全的反驳

• https://utkusen.com/blog/security-by-obscurity-is-underrated.html

WSUS攻击，Part2：CVE-2020-1013，一个Win 10本地特权升级1-Day

• https://www.gosecure.net/blog/2020/09/08/wsus-attacks-part-2-cve-2020-1013-a-windows-10-local-privilege-escalation-1-day/

SIEM：使用Splunk监控Windows客户端

• https://www.hackingarticles.in/siem-windows-client-monitoring-with-splunk/

Fuzzing：挑战与反思

• https://www.slideshare.net/mboehme/fuzzing-challenges-and-reflections

Empire 3.4.0版本中的Malleable C2功能，可通过profile文件进行配置

• https://www.bc-security.org/post/empire-malleable-c2-profiles/

使用二进制仿真自动动态解析导入表

• https://lopqto.me/posts/automated-dynamic-import-resolving

漏洞赏金Tips

• https://github.com/KingOfBugbounty/KingOfBugBountyTips

暗网的网络安全状态研究：

• https://www.immuniweb.com/blog/state-cybersecurity-dark-web-exposure.html

20200908

[资讯]

智利的三大银行之一的BancoEstado在周一发生了勒索软件攻击之后，被迫关闭所有分支机构，可能持续几天。该事件是由员工收到并打开的恶意Office文档引起的

• https://www.zdnet.com/article/chilean-bank-shuts-down-all-branches-following-ransomware-attack/

阿根廷的官方移民局DirecciónNacional de Migraciones遭受了Netwalker勒索软件攻击，使阿根廷的出入境暂时停止。攻击者索要400万美元的赎金

• https://www.bleepingcomputer.com/news/security/netwalker-ransomware-hits-argentinian-government-demands-4-million/

在4月的一次针对澳大利亚新南威尔士州政府机构的网络攻击中，攻击者通过被黑的47个服务人员的电子邮件窃取了380万份文档，总计738GB，包括大约186,000个客户的详细信息

• https://www.hackread.com/hackers-stole-738-gb-data-australian-government-agency/

[恶意代码]

Word恶意文档分析

• https://malwr-analysis.com/2020/09/07/word-document-malware-analysis/

法国CERT发布的针对法国公司和管理部门的Emotet攻击警告

• https://www.cert.ssi.gouv.fr/alerte/CERTFR-2020-ALE-019/

银行木马Cerberus的安全代码审查

• https://blog.shiftleft.io/security-code-review-of-a-banking-trojan-cerberus-10df386b9f6b

[工具]

tafferugli：Twitter分析框架，可以过滤、收集和分析tweets

• https://github.com/sowdust/tafferugli

MEAT：辅助iOS设备取证，从iOS设备上获取各种信息

• https://github.com/jfarley248/MEAT

从PE文件或内存转储中解析CobaltStrike Beacon的配置文件

• https://github.com/Sentinel-One/CobaltStrikeParser/blob/master/parse_beacon_config.py

[技术]

逆向奔驰仪表集群，显示自定义文本

• https://www.youtube.com/watch?v=iKwVWPU5P0I

3A大作《毁灭战士永恒》的图形系统研究

• https://simoncoenen.com/blog/programming/graphics/DoomEternalStudy.html

漏洞赏金Tips, Part 6

• https://www.infosecmatter.com/bug-bounty-tips-6-sep-07/

安全Tips的一些脑图：OAuth, 2FA, iOS漏洞

• https://github.com/hackerscrolls/SecurityTips/tree/master/MindMaps

TryHackMe：基础渗透测试演练

• https://medium.com/bugbountywriteup/tryhackme-basic-pentesting-walkthrough-7817c719fd04

理解CSRF漏洞（初学者指南）

• https://www.hackingarticles.in/understanding-the-csrf-vulnerability-a-beginners-guide/

ARM逆向与漏洞利用

• http://highaltitudehacks.com/2020/09/06/arm64-reversing-and-exploitation-part-3-a-simple-rop-chain/
• http://highaltitudehacks.com/2020/09/06/arm64-reversing-and-exploitation-part-2-use-after-free/
• http://highaltitudehacks.com/2020/09/05/arm64-reversing-and-exploitation-part-1-arm-instruction-set-heap-overflow/

Google CTF 2020 teleport Chromium沙箱溢出

• https://trungnguyen1909.github.io/blog/post/GGCTF20/

XSS挑战解决方案：SVG标签滥用

• https://insert-script.blogspot.com/2020/09/xss-challenge-solution-svg-use.html

The - http Series (Part 5): Security

• https://dzone.com/articles/the-- http-series-part-5-security

恶意软件作者使用.NET库创建恶意Excel文档来绕过安全检查

• https://gbhackers.com/excel-documents-library/

20200907

[资讯]

一家运行囚犯与外界通信服务的公司Telmate，泄漏了包含其数据的数据库，涉及囚犯的私人消息、通话记录、帐户余额、发件人和收件人的个人信息等

• https://www.comparitech.com/blog/information-security/prison-phone-service-exposes-millions-inmate-records/

微软最终在2021年1月之前终止对Adobe Flash的支持

• https://www.bleepingcomputer.com/news/microsoft/microsoft-to-finally-kill-adobe-flash-support-by-january-2021/

[漏洞]

在Shell创建对象任务服务器中的特权升级

• https://docs.google.com/document/d/e/2PACX-1vTP5OvJToWToMOKyeMyPcIPJhqbnESgWY6dYje9seJY96-ezCEJbXsMkfMWhoqPRaCNRs6BOO7urQyF/pub

UBUNTU PPP的CVE-2020-15704总结

• https://www.synacktiv.com/publications/ubuntu-ppps-cve-2020-15704-wrap-up

[恶意代码]

Android平台银行木马Cerberus的详细分析报告

• https://www.buguroo.com/en/labs/full-report-on-cerberus-an-android-banking-trojan

在SEG保护的环境中发现的网络钓鱼

• https://cofense.com/message-quarantine-campaign-overlying-potential/

深入探讨Evilnum小组的最新活动，并探索其新的感染链和工具

• https://www.cybereason.com/blog/no-rest-for-the-wicked-evilnum-unleashes-pyvil-rat

BitRAT远控分析，Part2：隐藏的浏览器，SOCKS5代理和UnknownProducts被屏蔽

• https://krabsonsecurity.com/2020/09/04/bitrat-pt-2-hidden-browser-socks5-proxy-and-unknownproducts-unmasked/

Visa发出了有关新的信用卡JavaScript skimmer（称为Baka）的警告，该skimmer实施了新功能来逃避检测

• https://usa.visa.com/content/dam/VCOM/global/support-legal/documents/visa-security-alert-baka-javascript-skimmer.pdf

[工具]

PCILeech：直接内存攻击工具，使用PCIe硬件设备读取和写入目标系统内存

• https://github.com/ufrisk/PCILeech

SharpScribbles：C#工具，用于从Windows Sticky Notes数据库中提取数据，以及从Thunderbird和Firefox检索数据（联系人，电子邮件，历史记录，Cookie和凭据）

• https://github.com/V1V1/SharpScribbles

GRAT2：Python3和.NET 4.0编写的C&C工具，可用于后渗透

• https://github.com/r3nhat/GRAT2

yacd：在iOS 13.4.1及更低版本上解密FairPlay应用，不需要越狱

• https://github.com/DerekSelander/yacd

hardcodes：从源代码中找到硬编码的字符串

• https://github.com/s0md3v/hardcodes

h4rpy：自动化的WPA / WPA2 PSK攻击工具，是对aircrack-ng框架的包装

• https://github.com/MS-WEB-BN/h4rpy

wordlist_generator：使用tomnomnom的报告“Who, What, Where, When”中提到的技术生成独特的单词列表

• https://github.com/SomeKirill/wordlist_generator

CFGgrind：使用valgrind动态构建CFG

• https://github.com/rimsa/CFGgrind

nvd-scrapper：从国家漏洞数据库中拉出数据，并将其推到GCP桶中

• https://github.com/clglavan/nvd-scrapper

TREVORspray：基于MSOLSpray的功能强大的Python O365 sprayer，使用Microsoft Graph API

• https://github.com/blacklanternsecurity/TREVORspray

unimap：Scan only once by IP address and reduce scan times with Nmap for large amounts of data.

• https://github.com/Edu4rdSHL/unimap

[技术]

使用二进制仿真框架Qiling分析实模式二进制文件

• https://blog.lazym.io/2020/09/05/Dive-deeper-Analyze-real-mode-binaries-like-a-Pro-with-Qiling-Framework/

使用Microsoft Defender Advanced Threat保护来检测对本地管理员组的更改

• https://www.verboon.info/2020/09/hunting-for-local-group-membership-changes/

如何使用端到端加密来保护您的敏感数据来记录ProtonDrive的安全模型

• https://protonmail.com/blog/protondrive-security/

绕过SQL注入过滤器来执行盲SQL注入

• http://www.mannulinux.org/2020/09/sql-injection-filter-bypass-to-perform.html

使用Active Directory域信息转储工具goddi，探索MITER ATT＆CK发现的策略和技巧

• https://awakesecurity.com/blog/hunting-for-goddi-uncovering-mitre-attck-discovery-tactics-techniques/

使用WinAFL Fuzzing一个简单的C程序

• https://www.youtube.com/watch?v=Va_Wtxf3DMc

半自动代码去混淆(r2con2020 workshop)

• https://www.youtube.com/watch?v=_TsV0RXoIQE

针对Android App的时间旅行测试

• https://mboehme.github.io/paper/ICSE20.TTT.pdf

使用Cobalt Strike Beacon对象文件实现的自定义DLL注入

• https://x64sec.sh/custom-dll-injection-with-cobalt-strike/

IDOR：攻击向量、利用、绕过和链

• https://www.notion.so/IDOR-Attack-vectors-exploitation-bypasses-and-chains-0b73eb18e9b640ce8c337af83f397a6b

演示Spring框架中不受限制的视图名称操作有多危险

• https://github.com/veracode-research/spring-view-manipulation/

使用YARA规则处理Windows事件记录

• https://blog.dylan.codes/pwning-windows-event-logging/

源代码分析和利用API密钥

• https://medium.com/bugbountywriteup/source-code-analysis-and-api-keys-exploitations-1796b3e731eb

WSUS（Windows服务器升级服务）攻击第1部分：PyWSUS简介

• https://www.gosecure.net/blog/2020/09/03/wsus-attacks-part-1-introducing-pywsus/
• https://github.com/GoSecure/pywsus

跟踪移动云：如何通过制图连续跟踪云资产

• https://www.marcolancini.it/2020/blog-tracking-moving-clouds-with-cartography/

从SSH证书蜜罐中学到的教训

• https://systemoverlord.com/2020/09/04/lessons-learned-from-ssh-credential-honeypots.html

安装hongfuzz并fuzzing简单的c程序

• https://www.youtube.com/watch?v=6OBXJtEe-d8

Defcon 2020 Red Team CTF – Seeding Part 1 & 2

• https://www.securifera.com/blog/2020/09/05/defcon-2020-red-team-village-ctf-seeding-part-1-2/

云端一键部署取证实验室

• https://0xbanana.com/blog/one-click-forensics-lab-in-the-cloud/

8086微码反汇编

• https://www.reenigne.org/blog/8086-microcode-disassembled/

使用FireFox执行爆破攻击和绕过Rate限制

• https://www.youtube.com/watch?v=it_V3ig1_4o

Remote — HackTheBox Writeup OSCP Style

• https://medium.com/bugbountywriteup/remote-hackthebox-writeup-oscp-style-1e35ed0f9951

20200904

[资讯]

印度总理莫迪的Twitter帐户遭到黑客攻击，攻击者发送了一系列推文，要求追随者将加密货币捐赠给救济基金

• https://securityaffairs.co/wordpress/107881/hacking/modi-twitter-account-hacked.html

研究人员发现一个属于在线营销公司View Media的可公开访问的Amazon S3存储桶，包含5,302个文件，其中包括3876万条美国公民记录 s

• https://cybernews.com/security/online-marketing-company-exposes-data-of-millions-americans/

[漏洞]

WordPress插件File Manager的严重漏洞，使任何网站访问者都能完全访问该网站，影响700k WordPress网站

• https://blog.sucuri.net/2020/09/critical-vulnerability-file-manager-affecting-700k-wordpress-websites.html

Adobe Reader UAF漏洞利用（CVE-2020-9715）

• https://www.zerodayinitiative.com/blog/2020/9/2/cve-2020-9715-exploiting-a-use-after-free-in-adobe-reader

Keycloak Web服务器的DOS漏洞（CVE-2020-10758）

• https://www.soluble.ai/blog/keycloak-cve-2020-10758

探讨Project Zero Issue 2046，这是一个似乎无法利用且简单的bug，事实证明它可以以非常复杂的方式加以利用

• https://www.elttam.com/blog/simple-bugs-with-complex-exploits/#content

Microsoft Hyper-V DoS PoC

• https://github.com/gerhart01/hyperv_local_dos_poc

[工具]

PTRB：Shell脚本，获取IP地址列表，并将未找到白名单的二级域名（example.com）的IP输出到文件

• https://github.com/3CORESec/PTRB

AngryGhidra：Ghidra插件，直接在Ghidra界面中使用Angr的二进制分析和符号执行功能

• https://github.com/Nalen98/AngryGhidra

fluffi：一个分布式、进化式的二进制Fuzzer

• https://github.com/siemens/fluffi

XSS-Catcher：盲XSS攻击工具

• https://github.com/daxAKAhackerman/XSS-Catcher

bbrecon：用于漏洞赏金侦察的命令行工具，也可作为Python库使用

• https://github.com/serain/bbrecon

Moriarty-Project：针对手机号码的信息收集工具

• https://github.com/AzizKpln/Moriarty-Project

geo-recon：一个OSINT CLI工具，快速跟踪IP声誉和地理位置

• https://github.com/radioactivetobi/geo-recon

[技术]

微软反恶意代码服务命令行工具MpCmdRun.exe可以用来下载恶意软件

• https://www.bleepingcomputer.com/news/microsoft/microsoft-defender-can-ironically-be-used-to-download-malware/

使用Miasm模拟勒索软件NotPetya的MBR部分

• https://aguinet.github.io/blog/2020/08/29/miasm-bootloader.html
• https://github.com/aguinet/miasm-bootloader/

Sushiswap智能协议审计报告

• https://github.com/peckshield/publications/blob/master/audit_reports/PeckShield-Audit-Report-SushiSwap-v1.0.pdf

事件响应：Windows帐户登录和登录事件

• https://www.hackingarticles.in/incident-response-windows-account-logon-and-logon-events/

使用Linux二进制文件进行数据渗透

• https://www.hackingarticles.in/data-exfiltration-using-linux-binaries/

如何使用BMC/IPMI漏洞利用将直接sqlmap直连到数据库，以危害大型云托管客户端，Part2

• https://medium.com/bugbountywriteup/how-a-badly-configured-db-allowed-us-to-own-an-entire-cloud-of-over-25k-hosts-part-2-2-5a63da194bc1

微软发布的漏洞利用保护参考

• https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference

US-CERT发布的发现和补救恶意活动的技术方法

• https://us-cert.cisa.gov/ncas/alerts/aa20-245a

N1QL注入：针对NoSQL数据库的一种SQL注入

• https://labs.f-secure.com/blog/n1ql-injection-kind-of-sql-injection-in-a-nosql-database/

用于漏洞挖掘的VPS清单

• https://medium.com/bugbountywriteup/vps-cheatsheet-for-bug-hunting-bf0a5fe08ef4

TryHackMe: Reversing ELF Writeup

• https://medium.com/bugbountywriteup/tryhackme-reversing-elf-writeup-6fd006704148

如何创建基于开源代码的YARA签名以使用OST库查找使用了开源代码的恶意软件

• https://www.intezer.com/blog/threat-hunting/turning-open-source-against-malware/

IDA使用的Tips

• https://swarm.ptsecurity.com/ida-pro-tips/

Twitter漏洞赏金Tips&&Tricks收集

• https://github.com/giteshnxtlvl/YourNextBugTip

20200903

[漏洞]

Java的ByteBuffer缓冲区溢出漏洞（CVE-2020-2803）和可变方法类型导致沙箱逃逸漏洞（CVE-2020-2805）

• https://insinuator.net/2020/09/java-buffer-overflow-with-bytebuffer-cve-2020-2803-and-mutable-methodtype-cve-2020-2805-sandbox-escapes/

Windows10最新版内核提权漏洞CVE-2020-0986，如何被攻击者利用，如何修复以及如何实施其他缓解措施

• https://securelist.com/operation-powerfall-cve-2020-0986-and-variants/98329/

Go的CGI和FastCGI传输的不一致行为可能导致XSS

• https://www.redteam-pentesting.de/de/advisories/rt-sa-2020-004/-inconsistent-behavior-of-gos-cgi-and-fastcgi-transport-may-lead-to-cross-site-scripting

在SonicWall的云管理平台API中发现的IDOR（不安全的直接对象引用）漏洞，任何用户都可以将自己添加到使用该帐户的任何组织的任何帐户中

• https://www.pentestpartners.com/security-blog/cloud-firewall-management-api-snafu-put-500k-sonicwall-customers-at-risk/

研究人员发现了Cisco Jabber中的四个漏洞。其中一个漏洞是通过在群聊中或直接向目标用户发送特制的聊天消息来实现RCE，无需用户交互，即使Cisco Jabber在后台运行，也可以利用此漏洞

• https://watchcom.no/nyheter/nyhetsarkiv/uncovers-cisco-jabber-vulnerabilities/

[恶意代码]

银行木马Cerberus分析

• https://www.biznet.com.tr/wp-content/uploads/2020/08/Cerberus.pdf
• https://github.com/ics-iot-bootcamp/cerberus_research

ThiefBot：针对土耳其银行用户的新型Android银行木马

• https://business.xunison.com/thiefbot-a-new-android-banking-trojan-targeting-turkish-banking-users/

以前未公开的KryptoCibule恶意软件家族正在发动与三方面相关的与加密货币有关的攻击，同时部署了RAT来为其受害者建立后门

• https://www.welivesecurity.com/2020/09/02/kryptocibule-multitasking-multicurrency-cryptostealer/

[工具]

GoPurple：Shellcode运行器，包括不同的用于评估终端安全解决方案检测能力的技术

• https://github.com/sh4hin/GoPurple

SharpSecDump：远程SAM + LSA实现密码转储，为impacket secretsdump.py脚本的.NET移植版

• https://github.com/G0ldenGunSec/SharpSecDump

Chimera：PowerShell混淆脚本，用于绕过AMSI和商业防病毒解决方案

• https://github.com/tokyoneon/Chimera

medusa_combo_files：用于爆破的默认用户名-密码对

• https://github.com/wintrmvte/medusa_combo_files

vmpdump：动态VMP转储与导入表修复

• https://github.com/0xnobody/vmpdump

RedCommander：使用Ansible在AWS中创建的红队C2基础设施

• https://github.com/guidepointsecurity/RedCommander

[技术]

Windows横向渗透，Part1：WMI事件订阅

• https://www.mdsec.co.uk/2020/09/i-like-to-move-it-windows-lateral-movement-part-1-wmi-event-subscription/

攻击1Password：解密协议

• https://www.youtube.com/watch?v=EPqMcw3xC84&feature=youtu.be

网路钓鱼诈骗使用Sharepoint和One Note引诱用户输入密码

• https://nakedsecurity.sophos.com/2020/09/02/phishing-scam-uses-sharepoint-and-one-note-to-go-after-passwords/

使用assert()在PHP 7环境中执行恶意代码

• https://blog.sucuri.net/2020/09/using-assert-to-execute-malware-php-7.html

使用机器学习实时检测混淆的PowerShell攻击性脚本

• https://blog.fox-it.com/2020/09/02/machine-learning-from-idea-to-reality-a-powershell-case-study/

The Hash Monster：ESP32 Tamagotchi WiFi破解

• https://telescope.ac/petazzoni/the-hash-monster-esp32-tamagotchi-for-wifi-cracking

如何通过手动修改绕过AMSI

• https://s3cur3th1ssh1t.github.io/Bypass_AMSI_by_manual_modification/

PRIME网络中的安全性-当前状态

• https://www.tarlogic.com/en/blog/security-in-prime-networks-current-status/

利用Docker容器漏洞扫描器的漏洞

• https://medium.com/@matuzg/testing-docker-cve-scanners-part-2-5-exploiting-cve-scanners-b37766f73005
• https://github.com/gmatuz/cve-scanner-exploiting-pocs

深入解析电子邮件安全：MTA-STS策略

• https://habr.com/en/company/mailru/blog/517544/

代码注入：优化GhostWriting注入

• https://blog.sevagas.com/?Code-Injection-Weaponize-GhostWriting-Injection

Bitlocker的锁屏、绕过与提权

• https://docs.google.com/document/d/1S4jU7knBG_Km_AdHXf8JyE8zl0SOxQ9VvYFPanQy1g8/edit#

20200902

[资讯]

俄罗斯《生意人报》商业报纸报道说，一个包含数百万美国选民详细信息的数据库已经出现在俄罗斯黑暗网上

• https://securityaffairs.co/wordpress/107784/data-breach/us-voters-db-leak.html

[漏洞]

前置NGINX的TAS群集可能易受DoS攻击（CVE-2020-5416）

• https://tanzu.vmware.com/security/cve-2020-5416

FreeBSD在8月份修复的内核提权漏洞（CVE-2020-7460）

• https://www.zerodayinitiative.com/blog/2020/9/1/cve-2020-7460-freebsd-kernel-privilege-escalation

介绍在现代Web浏览器中查找和利用JavaScript引擎漏洞所涉及的技术挑战，评估了当前的缓解漏洞技术

• https://googleprojectzero.blogspot.com/2020/09/jitsploitation-one.html
• https://googleprojectzero.blogspot.com/2020/09/jitsploitation-two.html
• https://googleprojectzero.blogspot.com/2020/09/jitsploitation-three.html

Magento电子商务网站使用的第三方插件Magmi的多个漏洞(CVE-2020-5776, CVE-2020-5777)

• https://www.tenable.com/blog/cve-2020-5776-cve-2020-5777-multiple-vulnerabilities-in-the-magmi-magento-mass-import-plugin

[恶意代码]

在野发现的无需不使用Microsoft Office即可创建装载宏的Excel工作簿的攻击方式

• https://blog.nviso.eu/2020/09/01/epic-manchego-atypical-maldoc-delivery-brings-flurry-of-infostealers/

QNAP NAS在野漏洞攻击事件

• https://blog.netlab.360.com/in-the-wild-qnap-nas-attacks/

对远控ComRAT v4的详尽分析

• https://www.msreverseengineering.com/blog/2020/8/31/an-exhaustively-analyzed-idb-for-comrat-v4

BLINDINGCAN远控以及朝鲜的恶意攻击活动

• https://www.sentinelone.com/blog/the-blindingcan-rat-and-malicious-north-korean-activity/

深入研究黑客组织Fin7进行的BadUSB攻击

• https://threatintel.blog/OPBlueRaven-Part2/

使用Telegram做C&C的信用卡Skimmer

• https://twitter.com/AffableKraut/status/1299206119185952768

2020年夏季的事件响应趋势报告

• https://blog.talosintelligence.com/2020/09/CTIR-quarterly-trends-Q4-2020.html

CrowdStrike发布的2020全球威胁报告

• https://www.crowdstrike.com/resources/reports/2020-crowdstrike-global-threat-report/

[工具]

lib-lir：Lua语言通用中间表示，类似于LLVM

• https://github.com/DefCon42/lib-lir

WMIHACKER：免杀横向移动命令执行测试工具(无需445端口)

• https://github.com/360-Linton-Lab/WMIHACKER

[技术]

Google CTF Quals 2020 sprint task

• https://www.youtube.com/watch?v=jcUK9VRvzbk

针对CouchDB的渗透测试

• https://www.hackingarticles.in/penetration-testing-on-couchdb-5984/

威胁狩猎：使用Velociraptor用于端点监控

• https://www.hackingarticles.in/threat-hunting-velociraptor-for-endpoint-monitoring/

Android App后门植入指南

• https://blog.nviso.eu/2020/08/31/backdooring-android-apps-for-dummies/

如何使用BMC/IPMI漏洞利用将直接sqlmap直连到数据库，以危害大型云托管客户端

• https://medium.com/@securityshenaningans/how-a-badly-configured-db-allowed-us-to-own-an-entire-cloud-of-over-25k-hosts-part-1-2-8846beab691e

PE文件的静态检测方式

• https://winternl.com/static-detection-of-portable-executable-files/

Azure AD PRT之旅：通过pass-the-token和pass-the-cert获得访问权限

• https://o365blog.com/post/prt/

使用hashcat破解密码

• https://dzone.com/articles/crack-hashed-passwords-with-hashcat

Force firmware code to be measured and attested by Secure Launch on Windows 10

• https://www.microsoft.com/security/blog/2020/09/01/force-firmware-code-to-be-measured-and-attested-by-secure-launch-on-windows-10/

20200901

[漏洞]

作者发现并修复的三个重要漏洞，它们正处于open状态，只是在等待有人注意到

• https://randomascii.wordpress.com/2020/08/30/the-easy-ones-three-bugs-hiding-in-the-open/

Slack和Zomato都存在的- http Request Smuggling导致账户接管的漏洞

• https://www.youtube.com/watch?v=gzM4wWA7RFo&feature=youtu.be

通过损害worker节点的实例角色来提升AWS Elastic Kubernetes Service（EKS）中的特权

• https://blog.christophetd.fr/privilege-escalation-in-aws-elastic-kubernetes-service-eks-by-compromising-the-instance-role-of-worker-nodes/

思科IOS XR软件DVMRP内存耗尽漏洞(CVE-2020-3566/CVE-2020-3569)

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-dvmrp-memexh-dSmpdvfz

[恶意代码]

对一次网络攻击的分析，攻击者从通过RDP登陆到在所有域主机上投递NetWalker勒索软件，共计花费1小时

• https://thedfirreport.com/2020/08/31/netwalker-ransomware-in-1-hour/

苹果的公证服务无意间公证了伪装成Adobe Flash Player更新的Shlayer恶意软件

• https://objective-see.com/blog/blog_0x4E.html

[工具]

rbcd-attack：使用Impacket从外部进行基于Kerberos资源的受限委托攻击

• https://github.com/tothi/rbcd-attack

Evil_DLL：可以测试各种注入方法的简单的DLL

• https://github.com/theflakes/Evil_DLL

[技术]

通过Metasploit加载器实现免杀

• https://medium.com/securebit/bypassing-av-through-metasploit-loader-64-bit-9abe55e3e0c8
• https://medium.com/securebit/bypassing-av-through-metasploit-loader-32-bit-6d62930151ad

开发一个游戏服务器的仿真器

• https://krystalgamer.github.io/avengers-emulator/

恶意代码开发，Part1：Go中的动态模块加载

• https://posts.specterops.io/malware-development-pt-1-dynamic-module-loading-in-go-1121f07f3a5a

Web应用程序渗透测试的来龙去脉

• https://www.codementor.io/@seanhiggins550/the-ins-and-outs-of-penetration-testing-for-web-apps-19jhhqsexo

分析QText锁定的文档和对DOS程序进行逆向的过程

• https://pipornithology.dev/2020/08/25/qtext.html

Certulitis – one tool that keeps on giving

• https://www.hexacorn.com/blog/2020/08/30/certulitis-one-tool-that-keeps-on-giving/

DogByte Attack: Playing Red Team for Eth2.0 VDF

• https://medium.com/zengo/dogbyte-attack-playing-red-team-for-eth2-0-vdf-ea2b9b2152af

谷歌商店核心库中自动发现的持久性代码执行

• https://blog.oversecured.com/Oversecured-automatically-discovers-persistent-code-execution-in-the-Google-Play-Core-Library/

关于LoRa模块P2P标准的一个教训(或缺乏)

• https://davywybiral.blogspot.com/2020/08/a-lesson-in-lora-module-p2p-standards.html

针对智能锁的SpiKey攻击：记录来自智能手机的点击，通过识别咔嗒声之间的时间间隔，来识别键脊之间的距离，使用此信息创建几个可能的密钥

• https://www.comp.nus.edu.sg/~junhan/papers/SpiKey_HotMobile20_CamReady.pdf

20200831

[资讯]

印度的电子商务支付网关Paytm被入侵，攻击者声称能够在Paytm Mall应用程序/网站上上传后门/管理员，并且能够不受限制地访问其整个数据库

• https://cybleinc.com/2020/08/30/paytm-mall-suffered-a-massive-data-breach-data-hacked-ransom-demanded/

[漏洞]

Slack桌面客户端的RCE漏洞

• https://hackerone.com/reports/783877

研究人员发现了支付卡EMV标准实施中的漏洞，可以绕过PIN验证

• https://arxiv.org/pdf/2006.08249.pdf

Pulse Secure RCE (CVE-2020-8218) PoC

• https://github.com/withdk/pulse-gosecure-rce-poc
• https://www.gosecure.net/blog/2020/08/26/forget-your-perimeter-rce-in-pulse-connect-secure/

如何发现和利用postMessage漏洞

• https://medium.com/@bamalkaranbamal/how-to-spot-and-exploit-postmessage-vulnerablities-329079d307cc

[恶意代码]

The Anatomy of a Malicious Package (Part 2)

• https://blog.phylum.io/nodejs-npm-malicious-javascript-package/

The Kittens Are Back in Town 3

• https://www.clearskysec.com/wp-content/uploads/2020/08/The-Kittens-are-Back-in-Town-3.pdf

[工具]

C编写的程序，自带多种类型的漏洞，可用于显示Fuzzing技术

• https://github.com/hardik05/Damn_Vulnerable_C_Program

graphtage：基于语义的比较工具，用于语义上比较和合并树状结构，例如JSON，JSON5，XML，HTML，YAML和TOML文件

• https://github.com/trailofbits/graphtage
• https://blog.trailofbits.com/2020/08/28/graphtage/

urlgrab：通过网站搜索其他链接，支持JavaScript渲染

• https://github.com/IAmStoxe/urlgrab

bluescan：强大的蓝牙扫描器，可扫描BR / LE设备，LMP，SDP，GATT和漏洞！

• https://github.com/fO-000/bluescan

LibAFL：将AFL++作为库使用

• https://github.com/AFLplusplus/LibAFL

bulwark：组织资产和漏洞管理工具，集成Jira，旨在生成应用程序安全报告

• https://github.com/softrams/bulwark

DNS服务器，使用C# 8.0和.NET Core3.1，安全、现代、全功能、一体化跨架构和跨平台

• https://github.com/Texnomic/SecureDNS

iblessing：一个iOS安全开发工具包，主要包括应用程序信息采集、静态分析和动态分析。可用于逆向、二进制分析和漏洞挖掘

• https://github.com/Soulghost/iblessing

cloud-sniper：用于在云环境中管理安全操作的平台，允许通过准确分析和关联本地云构件来响应安全事件

• https://github.com/nicolasriverocorvalan/cloud-sniper

vmx_intrinsics：用于Hex-Ray反编译的VMX intrinsics插件

• https://github.com/synacktiv/vmx_intrinsics

[技术]

OWASP UnCrackable Android App解题

• https://www.youtube.com/watch?v=xRQVljerl0A
• https://www.youtube.com/watch?v=P6rNPkM2DdY

调试95年老游戏“Dust: A Tale of the Wired West”，使其在Win7上运行

• https://mrxstudios.home.blog/2020/08/28/debugging-dust-a-tale-of-the-wired-west/

How To Hack: Bastion From HackTheBox

• https://medium.com/bugbountywriteup/how-to-hack-bastion-from-hackthebox-729cd2317c6e

使用Microsoft 365应用程序密码进行持久化

• https://github.com/rgeoghan/app-password-persistence

使用Django REST Framework和PostgreSQL构建一个搜索引擎，以针对来自公开披露的漏洞/数据库泄漏的泄漏凭证建立搜索引擎，可在几秒钟内搜索超过50亿个密码

• https://threat.tevora.com/diy-leaked-credential/

逆向一个智能锁

• https://www.blackhillsinfosec.com/reverse-engineering-a-smart-lock/

使用crashwalk筛选崩溃，使用GDB分析根本原因

• https://www.youtube.com/watch?v=5R2gPkCXZkM

免费的在线恶意代码沙箱列表

• https://www.untrustednetwork.net/en/sandboxes/

All of the Threats Intelligence Modeling

• https://www.youtube.com/watch?v=7ryw3A_pFGY

现代企业的成本效益云安全:第2部分

• https://www.bitglass.com/blog/cost-effective-cloud-security-for-the-modern-enterprise-part-2

20200828

[漏洞]

引入CWE-1265：一种新的了解带漏洞的可重入控制流的方法

• https://www.zerodayinitiative.com/blog/2020/8/25/introducing-cwe-1265-a-new-way-to-understand-vulnerable-reentrant-control-flows

Zamzar API 在将打开的Office ODT文件转换为PDF 时的SSRF漏洞

• https://labs.bishopfox.com/advisories/zamzar-api

Firefox JIT漏洞利用（CVE-2019-17026）

• https://labs.f-secure.com/blog/exploiting-cve-2019-17026-a-firefox-jit-bug/
• https://github.com/maxpl0it/CVE-2019-17026-Exploit

用于分析、监视和数据可视化的开源应用程序Grafana的任意文件读取漏洞（CVE-2019-19499）

• https://swarm.ptsecurity.com/grafana-6-4-3-arbitrary-file-read/

[恶意代码]

针对云App和Linux的Lemon_Duck挖矿软件

• https://news.sophos.com/en-us/2020/08/25/lemon_duck-cryptominer-targets-cloud-apps-linux/

[工具]

Hack-Tools：针对Web渗透的多合一浏览器扩展

• https://github.com/LasCC/Hack-Tools

speakeasy：Windows内核和用户模式二进制文件仿真器

• https://github.com/fireeye/speakeasy

Impost3r：利用C语言编写,用来窃取linux下各类密码(ssh,su,sudo)的工具

• https://github.com/ph4ntonn/Impost3r

monsoon：快速- http枚举器，可执行大量- http请求、过滤响应并实时显示它们

• https://github.com/RedTeamPentesting/monsoon

为Windows编译的CrackMapExec v5.1.0

• https://github.com/MichaelKCortez/CrackMapExecWin

[技术]

使用静态分析改进覆盖引导的Fuzzing

• https://repret.wordpress.com/2017/05/01/improving-coverage-guided-fuzzing-using-static-analysis/

如何在Spark集群的每个节点上获得Shell

• https://www.youtube.com/watch?v=EAzdGo-i8vE

如何实现BGP欺骗和实现对SSH的MiTM攻击

• https://github.com/BetterWayElectronics/bgp_spoofing_ssh_mitm

身份验证绕过：泄漏Google Cloud服务帐户和项目。通过为IAM API的projects.serviceAccounts.list方法伪造pageToken，可以列出任何Google Cloud Platform项目的IAM服务帐户（给定其项目号）

• https://www.ezequiel.tech/2020/08/leaking-google-cloud-projects.html?m=1

在Linux上使用AFL对简单的C程序进行Fuzzing

• https://www.youtube.com/watch?v=NiGC1jxFx78&feature=youtu.be

编写示例C程序，使用AFL发现不同类型的漏洞

• https://www.youtube.com/watch?v=m1RkShHzx_8

Side-Channel攻击指南

• https://soatok.blog/2020/08/27/soatoks-guide-to-side-channel-attacks/

分析使用Themida 3.0.8.0.保护的二进制文件

• https://github.com/quosego/analysis.oreans/blob/master/Documentations/Version%203/Themida/x32/3.0.8.0/Advanced%20API-Wrapping/README.md

一个可以**所有人的漏洞？ 嵌入式替换和伪造微控制器的安全性

• https://www.usenix.org/conference/woot20/presentation/obermaier
• https://github.com/JohannesObermaier/f103-analysis

探索Ubiquiti UniFi Cloud Key Gen2 Plus：界定攻击面，为UniFi Protect和UniFi管理门户API设置调试，并查找未经身份验证的API漏洞

• https://medium.com/tenable-techblog/exploring-the-ubiquiti-unifi-cloud-key-gen2-plus-f5b0f7ca688

使用Cobalt Strike进行渗透测试：不太明显的功能

• https://www.trustedsec.com/blog/red-teaming-with-cobalt-strike-not-so-obvious-features/

我的Safari 阅读模式下的黑客探险

• https://payatu.com/blog/nikhil-mittal/my-hacking-adventures-with-safari-reader-mode

通过AMSI和机器学习阻止Active Directory攻击和其他后渗透行为

• https://www.microsoft.com/security/blog/2020/08/27/stopping-active-directory-attacks-and-other-post-exploitation-behavior-with-amsi-and-machine-learning/

Avoiding detection via DHCP options

• https://sensepost.com/blog/2020/avoiding-detection-via-dhcp-options/

20200827

[漏洞]

微软拒绝修复的usosvc服务中的两个稳定的堆地址泄漏漏洞

• https://github.com/hhlxf/USO_Info_Leak

Pulse Secure SSL VPN中的RCE漏洞（CVE-2020-8218）

• https://www.gosecure.net/blog/2020/08/26/forget-your-perimeter-rce-in-pulse-connect-secure/

hide.me VPN Windows客户端特权升级漏洞

• http://zeifan.my/security/privesc/2020/08/26/hideme-vpn-privesc.html

[恶意代码]

MassLogger示例执行链中使用的加载程序之一ReZer0v4

• https://maxkersten.nl/binary-analysis-course/malware-analysis/rezer0v4-loader/

2020年第2季度威胁态势报告

• https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/threat-landscape-trends-q2-2020

朝鲜APT组织BeagleBoyz对银行发动的攻击

• https://us-cert.cisa.gov/ncas/alerts/aa20-239a

[工具]

ezEmu：通过各种执行技术测试对手的行为，有点像“蓝色团队的进攻性框架”，没有任联网/ C2功能，只专注于创建本地测试遥测

• https://github.com/jwillyamz/ezEmu

DefendTheFlag：通过Azure资源管理器(ARM)和所需的状态配置(DSC)从零开始构建实验室，快速开始测试微软的安全产品

• https://github.com/microsoft/DefendTheFlag

VolExp：类似于Process Explorer/Hacker，可以访问内存转储，可以作为Volatility插件工作

• https://github.com/memoryforensics1/VolExp

LazyGhidra：Ghidra插件

• https://github.com/AllsafeCyberSecurity/LazyGhidra

PCAP-ATTACK：PCAP捕获映射到相关的攻击策略

• https://github.com/sbousseaden/PCAP-ATTACK

[技术]

C++内存损坏：2种C ++特定的漏洞利用技术，Part1

• https://blog.infosectcbr.com.au/2020/08/c-memory-corruption-part-1.html

Fuzzing Linux内核(x86)入口代码

• https://blogs.oracle.com/linux/fuzzing-the-linux-kernel-x86-entry-code%2c-part-1-of-3
• https://blogs.oracle.com/linux/fuzzing-the-linux-kernel-x86-entry-code%2c-part-2-of-3

一个从加固的Docker容器中逃逸的故事

• https://www.redtimmy.com/docker/a-tale-of-escaping-a-hardened-docker-container/

SIEM：使用Splunk记录监视实验室设置

• https://www.hackingarticles.in/siem-log-monitoring-lab-setup-with-splunk/

DMV :1 Vulnhub Walkthrough

• https://www.hackingarticles.in/dmv-1-vulnhub-walkthrough/

防御规避：利用NTFS文件系统的备用数据流数据结构

• https://www.hackingarticles.in/defense-evasion-alternate-data-streams/

了解有关结构感知的模糊测试并查找JSON漏洞

• https://blog.forallsecure.com/learning-about-structure-aware-fuzzing-and-finding-json-bugs-to-boot

Dredd的自动检测规则分析

• https://sra.io/blog/automated-detection-rule-analysis-with-dredd/

在.NET Core Web中实现AntiXssMiddleware

• https://www.loginradius.com/engineering/blog/anti-xss-middleware-asp-core/

通过MongoDB对象ID预测进行IDOR

• https://techkranti.com/idor-through-mongodb-object-ids-prediction/

NMap端口扫描初学者指南

• https://medium.com/@hakluke/haklukes-guide-to-nmap-port-scanning-is-just-the-beginning-25d971692fdb

Google CTF - 2020 Writeup

• https://blog.s1r1us.ninja/CTF/IuseBing

20200826

[漏洞]

对IE的JS引擎UAF漏洞的分析（CVE-2020-1380）

• https://www.trendmicro.com/en_us/research/20/h/cve-2020-1380-analysis-of-recently-fixed-ie-zero-day.html

利用Windows系统的任意文件/目录删除漏洞获取NT AUTHORITY\SYSTEM权限

• https://github.com/sailay1996/delete2SYSTEM

CVE-2020-10611：在Triangle MicroWorks SCADA数据网关上实现代码执行

• https://www.zerodayinitiative.com/blog/2020/8/24/cve-2020-10611-achieving-code-execution-on-the-triangle-microworks-scada-data-gateway

Akamai的企业应用程序访问（EAA）客户端中的漏洞，该漏洞允许攻击者实现提权和RCE（CVE-2019-18847）

• https://blogs.akamai.com/2020/08/enterprise-application-access-client-eaa-vulnerability-cve-2019-18847.html

[恶意代码]

与朝鲜联系的APT组织正在将重点转移到针对加密货币和金融垂直行业

• https://labs.f-secure.com/assets/BlogFiles/f-secureLABS-tlp-white-lazarus-threat-intel-report2.pdf

[工具]

gdb_2_root：GDB脚本，添加在没有符号的情况下调试内核的有用命令

• https://github.com/c3r34lk1ll3r/gdb_2_root

DVS：DCOM漏洞扫描器，利用DCOM实现横向渗透

• https://github.com/ScorpionesLabs/DVS

aws-recon：一个多线程的AWS库存收集工具

• https://github.com/darkbitio/aws-recon

PwnXSS：漏洞(XSS)扫描器利用

• https://github.com/pwn0sec/PwnXSS

Tweettioc-Splunk-App：Tweettioc Splunk App

• https://github.com/fatihsirin/Tweettioc-Splunk-App

[技术]

Intel管理引擎漏洞利用，Part3：USB劫持（INTEL-SA-00086）

• https://kakaroto.ca/2020/08/exploiting-intels-management-engine-part-3-usb-hijacking-intel-sa-00086/

为编程语言编写测试用例生成器

• https://fitzgeraldnick.com/2020/08/24/writing-a-test-case-generator.html

使用伪造的VPN检查Android - http流量

• https://- httptoolkit.tech/blog/inspecting-android-- http

建立SIEM：将ELK，Wazuh HIDS和Elastalert结合起来以获得最佳性能

• https://medium.com/bugbountywriteup/building-a-siem-combining-elk-wazuh-hids-and-elastalert-for-optimal-performance-f1706c2b73c6

PowerSHell日志记录：混淆和某些新的（ISH）绕过，Part1

• https://www.bc-security.org/post/powershell-logging-obfuscation-and-some-newish-bypasses-part-1/

绕过Windows Defender Credential Guard

• https://teamhydra.blog/2020/08/25/bypassing-credential-guard/

TryHackMe: Overpass 2 — Hacked Walkthrough

• https://medium.com/bugbountywriteup/tryhackme-overpass-2-hacked-walkthrough-351daeaeca89

为什么我们仍然无法和平浏览：网络浏览历史的独特性和可识别性

• https://www.usenix.org/system/files/soups2020-bird.pdf

A Hands-On Introduction to Mandiant's Approach to OT Red Teaming

• https://www.fireeye.com/blog/threat-research/2020/08/hands-on-introduction-to-mandiant-approach-to-ot-red-teaming.html

使用打印机协议攻击Windows计算机

• https://www.youtube.com/watch?v=be2jOZM8Whs

20200825

[资讯]

Mitre发布的防御框架Shield

• https://shield.mitre.org/matrix/

美国股票人寿保险公司National Western Life被REvil勒索软件入侵，攻击者获取656 GB机密数据

• https://cybleinc.com/2020/08/24/national-western-life-insurance-company-nightmare-continues/

微软宣布Internet Explorer 11的退休时间表

• https://hotforsecurity.bitdefender.com/blog/microsoft-announces-internet-explorer-11s-retirement-timeline-23981.html

[漏洞]

C编写的针对嵌入式的TLS1.3客户端wolfSSL可导致中间人攻击的漏洞（CVE-2020-24613）

• https://research.nccgroup.com/2020/08/24/technical-advisory-wolfssl-tls-1-3-client-man-in-the-middle-attack/

2020年全球勒索软件攻击中使用的前四大漏洞

• https://blog.sensecy.com/2020/08/20/global-ransomware-attacks-in-2020-the-top-4-vulnerabilities/

TeamViewer高危漏洞，可允许攻击者窃取密码（CVE-2020-13699）

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13699

[恶意代码]

RTF Royal Road释放了一个新的MFC后门，与Goblin Panda相关

• https://medium.com/@Sebdraven/rtf-royal-road-drops-a-new-backdoor-mfc-and-links-with-goblin-panda-90db06f80611

银行木马QBot初始恶意文档中使用的新技术

• https://blog.morphisec.com/qakbot-qbot-maldoc-two-new-techniques

揭开黑客雇佣军DeathStalker的面纱

• https://securelist.com/deathstalker-mercenary-triumvirate/98177/

移动平台广告欺诈软件Triada和xhelper预装在20万台廉价手机上

• https://www.upstreamsystems.com/well-known-malware-committing-click-ad-fraud-low-end-devices-emerging-markets-uncovered-secure-d/

假冒的Malwarebytes安装文件投递基于XMRig的门罗币挖矿软件

• https://blog.avast.com/fake-malwarebytes-installation-files-distributing-coinminer

[工具]

Red-EC2：在AWS上通过Ansible构建RedTeam基础设施

• https://github.com/jfmaes/Red-EC2

drovorub-hunt：以网络为基础，协助搜寻Drovorub恶意软件C&C

• https://github.com/Insane-Forensics/drovorub-hunt

[技术]

Windows通过端口监视器实现驻留

• https://posts.slayerlabs.com/monitor-persistence/

结合使用Microsoft Graph API和Python来查找Office365邮箱中的恶意收件箱规则

• https://blog.rothe.uk/risky-rules-in-office365/

XSS：算术运算符和可选链接，以绕过过滤器和Sanitization

• https://www.secjuice.com/xss-arithmetic-operators-chaining-bypass-sanitization/

在“下载”文件夹中执行“Python”命令可能导致代码执行

• https://glyph.twistedmatrix.com/2020/08/never-run-python-in-your-downloads-folder.html

如何实现Office格式的Dropper

• https://marcoramilli.com/2020/08/24/how-to-reverse-office-droppers-personal-notes/

• httpOnly标志：保护Cookies免受XSS攻击

• https://www.acunetix.com/blog/web-security-zone/- httponly-flag-protecting-cookies/

certutil – one more GUI lolbin

• https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin/

PC-3000闪存：如何从microSD卡恢复数据

• https://blog.acelaboratory.com/pc-3000-flash-circuit-board-and-msd-card-preparing-and-soldering.html

使用深度强化学习加持的WiFi攻击工具Pwnagotchi破解WiFi握手包

• https://www.youtube.com/watch?v=2DIPVpcjR1I

逆向Android平台的新冠追踪App

• https://www.youtube.com/watch?v=KIKyTSsrHSw

Python基础：使用Scapy构造数据包

• https://medium.com/python-in-plain-english/python-basics-packet-crafting-with-scapy-b3e4ea5c8111

使用Safari网络共享API窃取本地文件

• https://blog.redteam.pl/2020/08/stealing-local-files-using-safari-web.html

在Azure中检测和锁定基于网络的恶意软件

• https://www.sans.org/blog/detecting-and-locking-down-network-based-malware-in-azure/

20200824

[资讯]

世界上最大的在线图形资源网站之一Freepik数据泄露：黑客通过SQL注入窃取了830万条记录

• https://www.bleepingcomputer.com/news/security/freepik-data-breach-hackers-stole-83m-records-via-sql-injection/

[漏洞]

KaiOS预安装的移动应用程序中的多个HTML注入漏洞

• https://research.nccgroup.com/2020/08/21/technical-advisory-multiple-html-injection-vulnerabilities-in-kaios-pre-installed-mobile-applications/

HP电子商务平台X-Cart由文件写入导致未经身份验证RCE的漏洞

• https://nickbloor.co.uk/2020/08/21/x-cart-5/

Apache Struts RCE漏洞CVE-2019-0230 PoC

• https://github.com/ramoncjs3/CVE-2019-0230

滥用共享内存以获取施耐德电气Modbus串行驱动程序上的本地权限升级(CVE-2020-7523)

• https://airbus-cyber-security.com/abusing-a-shared-memory-for-getting-a-local-privilege-escalation-on-the-schneider-electric-modbus-serial-driver-cve-2020-7523/

[恶意代码]

恶意程序包剖析

• https://blog.phylum.io/malicious-javascript-code-in-npm-malware/

漏洞利用工具包的当前状态，Part2：Addressing ACG, XFG, CET, and VBS/HVCI

• https://www.crowdstrike.com/blog/state-of-exploit-development-part-2/

AWS Community AMI中发现嵌入的挖矿软件

• https://medium.com/mitiga-io/security-advisory-mitiga-recommends-all-aws-customers-running-community-amis-to-verify-them-for-5c3e8b47d2d8

远控BitRAT：最新的Copy-pasted恶意软件

• https://krabsonsecurity.com/2020/08/22/bitrat-the-latest-in-copy-pasted-malware-by-incompetent-developers/

[工具]

osw-fs-windows：Windows文件系统git历史

• https://github.com/Wenzel/osw-fs-windows

adbsploit：通过ADB开发和管理Android设备，Python编写

• https://github.com/mesquidar/adbsploit

dropengine：Payload创建工具

• https://github.com/s0lst1c3/dropengine

DumpChromePasswords：PowerShell脚本，转储Chrome密码

• https://github.com/gtworek/PSBits/blob/master/Misc/DumpChromePasswords.ps1

idapm：IDA插件管理器，通过Github仓库管理IDA插件

• https://github.com/tkmru/idapm

scan-for-webcams：自动探测可公开访问的网络摄像头

• https://github.com/JettChenT/scan-for-webcams

SharpKatz：Porting of mimikatz sekurlsa::logonpasswords, sekurlsa::ekeys and lsadump::dcsync commands

• https://github.com/b4rtik/SharpKatz

wacker：对WPA3 AP执行在线字典攻击

• https://github.com/blunderbuss-wctf/wacker

[技术]

从照片逆向8086的算术/逻辑单元

• http://www.righto.com/2020/08/reverse-engineering-8086s.html?m=1

如何调查网络钓鱼活动

• https://letsdefend.io/blog/how-to-investigate-phishing-campaigns/

HackTheBox Writeup: Magic

• https://t3chnocat.com/htb-magic/

.NET Branca实现的ChaCha20-Poly1305算法一瞥

• https://brycx.github.io/2020/08/22/a-look-at-a-branca-implementation.html

在AFL上对FFMpeg进行Fuzzing

• https://hardik05.wordpress.com/2020/08/22/fuzzing-ffmpeg-with-afl-on-ubuntu/

对PHP7 Zend引擎的研究

• https://github.com/0xbigshaq/php7-internals

子域枚举：过滤通配符域

• https://0xpatrik.com/wildcard-domains/

使用KLEE进行符号执行：从安装到在开源软件中挖掘漏洞

• https://adalogics.com/blog/symbolic-execution-with-klee

每个Web开发者都需要知道的XSS知识

• https://www.loginradius.com/engineering/blog/cross-domain-security/

DIE：使用方面保留突变(aspect-preserving mutation) Fuzzing JavaScript引擎

• https://github.com/sslab-gatech/DIE
• https://ieeexplore.ieee.org/abstract/document/9152648/

Linux事件响应清单

• https://www.hackingarticles.in/incident-response-linux-cheatsheet/

使用Kubelet客户机攻击Kubernetes集群

• https://securityboulevard.com/2020/08/using-kubelet-client-to-attack-the-kubernetes-cluster

[ExpDev] Vulnserver — Part 6

• https://medium.com/bugbountywriteup/expdev-vulnserver-part-6-8c98fcdc9131

揭秘PHP中不安全的反序列化

• https://medium.com/@sghosh2402/demystifying-insecure-deserialization-in-php-684cab9c4d24

谷歌Chrome中间人，Part1：定位SSL VMT

• https://plainsec.org/man-in-the-browser-in-google-chrome-part-1-locating-the-ssl-vmt/

Exploit Development: Between a Rock and a (Xtended Flow) Guard Place: Examining XFG

• https://connormcgarr.github.io/examining-xfg/

漏洞赏金中如何更有效的利用Amass

• https://medium.com/@hakluke/haklukes-guide-to-amass-how-to-use-amass-more-effectively-for-bug-bounties-7c37570b83f7

滥用P2P网络入侵300万台摄像头

• https://www.youtube.com/watch?v=Z_gKEF76oMM

20200821

[资讯]

消费者信用报告机构Experian的南非分公司发生数据泄露事件，影响2400万南非人和793749个商业实体

• https://www.sabric.co.za/media-and-news/press-releases/experian-data-breach/

[漏洞]

我是如何发现Horde Groupware Webmail应用程序的漏洞的，以及如何利用漏洞实现RCE

• https://srcincite.io/blog/2020/08/19/a-smorgashorde-of-vulnerabilities-a-comparative-analysis-of-discovery.html

如何在谷歌托管的关系数据库服务Cloud SQL上释放Shell

• https://offensi.com/2020/08/18/how-to-contact-google-sre-dropping-a-shell-in-cloud-sql/

IBM Db2共享内存漏洞(CVE-2020-4414)

• https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/ibm-db2-shared-memory-vulnerability-cve-2020-4414/

macOS Mojave 10.14中远程登录（ssh）中的漏洞仍然存在

• https://eclecticlight.co/2020/08/20/the-vulnerability-in-remote-login-ssh-persists/

Cisco vWAAS for Cisco ENCS 5400-W系列和CSP 5000-W系列默认证书漏洞

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-waas-encsw-cspw-cred-hZzL29A7

[恶意代码]

Transparent Tribe: Evolution analysis, part 1

• https://securelist.com/transparent-tribe-part-1/98127/
• https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf

[工具]

reconspider：开源OSINT框架，用于扫描IP地址、邮件、网站和组织，从不同的源查找信息

• https://github.com/bhavsec/reconspider

Backdoorplz：使用win32api添加后门用户

• https://github.com/jfmaes/Backdoorplz

DmaBackdoorHv：Hyper-V后门，它提供了一个接口，用于从来宾或主机分区检查虚拟机监控程序状态（VMCS，物理/虚拟内存，寄存器等）并执行VM逃逸攻击

• https://github.com/Cr4sh/s6_pcie_microblaze/tree/master/python/payloads/DmaBackdoorHv#deploying-the-backdoor-using-firmware-flash-infection

bof_helper：Cobalt Strike引入了用于Beacon agent的Beacon Object File (BOF)的概念，此工具用于辅助创建BOF

• https://github.com/dtmsecurity/bof_helper

[技术]

绕过Web框架Play Framework的CSRF防护

• https://blog.doyensec.com/2020/08/20/playframework-csrf-bypass.html

如何使用WEB代理窃取内部信息

• https://sefod.eu/posts/web_proxies/

2020年OSCP备考终极指南

• https://johnjhacking.com/blog/the-oscp-preperation-guide-2020/

Office 365邮件转发规则（以及其他邮件规则）

• https://isc.sans.edu/diary/26484

我是如何在不被邻居察觉的情况下破解其密码的

• https://arstechnica.com/information-technology/2012/08/wireless-password-easily-cracked/

从奇虎360安全浏览器和Tor浏览器中提取密码

• https://eforensicsmag.com/extracting-passwords-from-qihoo-360-safe-browser-and-tor-browser-by-oleg-afonin/

为什么扫描UDP端口如此重要，Part2

• https://medium.com/@securityshenaningans/why-you-should-always-scan-udp-part-2-2-42050fb136d8

Kernel Panic: DEF CON 2020回顾

• https://dttw.tech/posts/Skww4fzGP

DHCP饥饿攻击：不用发出任何DHCP请求

• https://medium.com/bugbountywriteup/dhcp-starvation-attack-without-making-any-dhcp-requests-bef0022133c9

WordPress用户管理终极指南

• https://www.wpwhitesecurity.com/ultimate-guide-wordpress-user-management/

攻击Azure & Azure AD, Part II

• https://posts.specterops.io/attacking-azure-azure-ad-part-ii-5f336f36697d

Bypass Windows Defender Attack Surface Reduction

• https://blog.sevagas.com/IMG/pdf/bypass_windows_defender_attack_surface_reduction.pdf

20200820

[资讯]

数据抓取公司Comparitech泄露了来自Instagram、TikTok和Youtube的2.35亿用户个人资料

• https://www.hackread.com/data-scraping-firm-leaks-instagram-tiktok-youtube-records/

[漏洞]

开源Concrete5 CMS RCE漏洞

• https://www.edgescan.com/vulnerabilities-discovered-concrete-5/

The Confused Mailman: Sending SPF and DMARC passing mail as any Gmail or G Suite customer

• https://ezh.es/blog/2020/08/the-confused-mailman-sending-spf-and-dmarc-passing-mail-as-any-gmail-or-g-suite-customer/

Windows .Net Core SDK Elevation of Privilege

• https://itm4n.github.io/dotnet-sdk-eop/

[恶意代码]

FritzFrog：一个复杂的针对SSH服务器的P2P僵尸网络

• https://www.guardicore.com/2020/08/fritzfrog-p2p-botnet-infects-ssh-servers/

ELF恶意代码分析101，Part2：初始分析

• https://www.intezer.com/blog/linux/elf-malware-analysis-101-initial-analysis

US-CERT对朝鲜远控BLINDINGCAN发布的警告

• https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a

[工具]

AtomVM：最小的Erlang VM，支持ErlangVM功能的子集，并且能够在非常小的系统（如MCU）上运行未修改的BEAM二进制文件

• https://github.com/bettio/AtomVM

ail-yara-rules：用于AIL框架检测泄漏或信息公开的一组YARA规则

• https://github.com/ail-project/ail-yara-rules

go-safeweb：用于在Go中编写secure-by-default - http服务器的库集合

• https://github.com/google/go-safeweb

ida-vscode-theme：用于IDA 7.x的仿VSCode黑色主题

• https://github.com/alexander-pick/ida-vscode-theme

scrape：从Pastebin和Github Gists中抓取感兴趣的文本文件，给定关键词，可以按关键词搜索或正则匹配搜索

• https://github.com/averagesecurityguy/scrape

Parth：自动扫描- http参数可能存在的风险

• https://github.com/s0md3v/Parth

[技术]

SQL注入技术回顾

• https://www.hernanracciatti.com/tecnicas-de-sql-injection-un-repaso/

模板注入中MS文档的使用

• https://github.com/1d8/tempinject

使用Tracee自动发现恶意软件有效载荷执行

• https://blog.aquasec.com/ebpf-container-tracing-malware-detection

破解三星NFC芯片的固件

• https://www.youtube.com/watch?v=aLe-xW-Ws4c
• https://www.pentestpartners.com/security-blog/breaking-samsung-firmware-or-turning-your-s8-s9-s10-into-a-diy-proxmark/

针对Azure AD主机的“Pass The Certificate”攻击，并让您获得对远程计算机的访问权限

• https://medium.com/@mor2464/azure-ad-pass-the-certificate-d0c5de624597

2020年上半年工控系统的威胁和漏洞报告

• https://f.hubspotusercontent20.net/hubfs/2553528/Claroty_Biannual_ICS_Risk_Vulnerability_Report_1H2020.pdf

使用深度学习减少Side-Channel攻击面的攻击指南

• https://youtu.be/oPHWLIo88b8

如何检查网络钓鱼的成效

• https://cybersecurity.att.com/blogs/security-essentials/how-to-check-the-effectiveness-of-phishing

20200819

[资讯]

DopplePaymer勒索软件入侵了加拿大皇家军事学院（RMC），发布了大约1GB的泄露数据

• https://cybleinc.com/2020/08/18/dopplepaymer-ransomware-operators-allegedly-struck-royal-military-college-of-canada/

纽约一家名为Cense的人工智能公司泄露了250万条包含敏感和机密数据的病历，其中包括个人身份信息（PII）和其他敏感信息，例如患者姓名、保险记录、医疗诊断和付款信息

• https://securethoughts.com/medical-data-of-auto-accident-victims-exposed-online/

[漏洞]

对私人项目发现的一个可以窃取数据的XSS漏洞

• https://medium.com/bugbountywriteup/stealing-your-data-using-xss-bf7e4a31e6ee

开源多平台通信应用Rocket.Chat XSS导致RCE（CVE-2020-15926）

• https://blog.redteam.pl/2020/08/rocket-chat-xss-rce-cve-2020-15926.html

CVE-2020-10029：GNU LIBC三角函数中的缓冲区溢出

• https://blog.forallsecure.com/cve-2020-10029-buffer-overflow-in-gnu-libc-trigonometry-functions

发现和利用多人游戏引擎中的漏洞

• https://www.youtube.com/watch?v=4weoWSzuCxs

[恶意代码]

黑客组织TeamTNT使用加密采矿蠕虫攻击AWS，收集AWS凭证并安装Monero加密矿工

• https://www.cadosecurity.com/2020/08/17/teamtnt-the-first-crypto-mining-worm-to-steal-aws-credentials/

Duri活动：广告软件通过HTML Smuggling投递

• https://www.menlosecurity.com/blog/new-attack-alert-duri

[工具]

mole：验性质的IDS，用Yara作为匹配引擎，并使用PF_RING进行高速数据包捕获

• https://github.com/mole-ids/mole

sinter：使用Swift编写的MacOS用户模式应用程序授权系统

• https://github.com/trailofbits/sinter

redshell：交互式命令提示符，通过proxychains执行命令，并自动将它们记录在Cobalt Strike服务器上

• https://github.com/Verizon/redshell

centrifuge-toolkit：可视化和实证分析二进制文件中编码的信息

• https://github.com/BinaryResearch/centrifuge-toolkit

Kali Linux发布2020.3版

• https://www.kali.org/news/kali-2020-3-release/

OpenRedireX：针对OpenRedirect问题的异步Fuzzer

• https://github.com/devanshbatham/OpenRedireX

[技术]

Linux内核运行时防护（LKRG）简介

• https://www.openwall.com/presentations/OSTconf2020-LKRG-In-A-Nutshell/

Fun with header and forget password, with a twist

• https://medium.com/bugbountywriteup/fun-with-header-and-forget-password-with-a-twist-af095b426fb2

智能协议Hacking：Solidity for Penetration Testers

• http://console-cowboys.blogspot.com/2020/08/smart-contract-hacking-chapter-1.html

白盒演示，以及使用QBDI对目标进行检测和分析，以产生执行痕迹

• https://blog.quarkslab.com/introduction-to-whiteboxes-and-collision-based-attacks-with-qbdi.html

逆向GTA V的特技跳跃系统

• https://hackery.site/writing/gta-v-stunt-jumps/

汇编语言教程

• https://www.techteaching.co.uk/posts/learning-assembly-language-a-helpful-guide-part-1
• https://www.techteaching.co.uk/posts/learning-assembly-language-a-helpful-guide-part-2

为什么需要扫描UDP端口

• https://medium.com/@securityshenaningans/why-you-should-always-scan-udp-ports-part-1-2-d8ee7eb26727

Windows事件响应清单

• https://www.hackingarticles.in/incident-response-windows-cheatsheet/

20200818

[资讯]

东南亚最大的钢板公司之一了Hoa Sen Group被Maze勒索软件入侵，攻击者发布了大约1.64 GB的泄露数据

• https://cybleinc.com/2020/08/17/one-of-the-largest-steel-sheet-companies-in-southeast-asia-got-allegedly-breached-by-maze/

阿拉伯工业有限责任公司被Maze勒索软件入侵，攻击者发布了大约1.8 GB的泄漏数据

• https://cybleinc.com/2020/08/17/maze-ransomware-operators-allegedly-targeted-arabian-industries-llc/

美国领先的应急响应恢复和重建公司Interstate Restoration被Maze勒索软件入侵，发布大约800 MB的泄露数据

• https://cybleinc.com/2020/08/17/interstate-restoration-got-allegedly-breached-by-maze-ransomware-operators/

微软的Control Flow Guard引入了Rust和LLVM编译器

• https://msrc-blog.microsoft.com/2020/08/17/control-flow-guard-for-clang-llvm-and-rust/

[漏洞]

英国零售巨头Monsoon使用具有已知漏洞的Pulse Connect Secure VPN版本，可导致黑客窃取或勒索敏感的内部公司文件、客户数据等

• https://vpnpro.com/blog/monsoon-vulnerability/

WordPress Sell Photo插件的存储型XSS漏洞

• https://melbin.in/2020/08/14/stored-xss-vulnerability-in-wordpress-sell-photo-plugin/

GlueBall: The story of CVE-2020–1464

• https://medium.com/@TalBeerySec/glueball-the-story-of-cve-2020-1464-50091a1f98bd

TinyMCE HTML文本编辑器的XSS漏洞

• https://labs.bishopfox.com/advisories/tinymce-version-5.2.1

[工具]

NoVmp：适用于VMProtect x64 3.x的静态反虚拟化程序

• https://github.com/can1357/NoVmp

urlbuster：Web目录模糊处理程序，用于查找现有和/或隐藏的文件或目录

• https://github.com/cytopia/urlbuster

vmpattack：VMP to VTIL lifter

• https://github.com/0xnobody/vmpattack

spacesiren：一个AWS的honey token管理和警报系统

• https://github.com/spacesiren/spacesiren

houndsploit：带GUI界面的Exploit-DB搜索引擎

• https://github.com/nicolas-carolo/houndsploit

ysomap：一个基于ysoserial的Java反序列化开发框架

• https://github.com/wh1t3p1g/ysomap

Noctilucent：使用TLS 1.3逃避审查，绕过网络防御，并融入噪音

• https://github.com/SixGenInc/Noctilucent
• https://youtu.be/TDg092qe50g

msticpy：微软的威胁情报安全工具

• https://github.com/microsoft/msticpy
• https://github.com/microsoft/msticnb
• https://medium.com/@msticmed/announcing-mstic-notebooklets-d32479bd07f

[技术]

使用POPAD小工具解决高度混淆的二进制文件

• https://www.rakach.com/post/solving-highly-obfuscated-binary-using-popad-gadgets

PE实施中的错误导致二进制Ninja和radare2中的部分映射不正确

• https://www.rakach.com/post/sloppy-implementation-of-pe-leads-to-incorrect-section-mapping-in-binary-ninja-and-radare2

使用白盒分析发现有趣的Java反序列化漏洞，Part1：JMS

• https://blog.silentsignal.eu/2020/08/17/unexpected-deserialization-pt-1-jms/

Lin.Security: 1 Vulnhub Machine Walkthrough

• https://melbin.in/2020/08/17/lin-security-1-vulnhub-machine-walkthrough/

自动从Github收集的PoC

• https://github.com/nomi-sec/PoC-in-GitHub

Android渗透测试实验室搭建与实战

• https://medium.com/bugbountywriteup/android-pentesting-lab-4a6fe1a1d2e0

以一种不寻常的方式泄漏AWS元数据

• https://medium.com/bugbountywriteup/leaking-aws-metadata-f5bc8de03284

WebAssembly二进制文件中可利用的漏洞的程度以及与本机代码的比较

• https://www.usenix.org/system/files/sec20-lehmann.pdf

FireWalker：一种绕过用户空间EDR Hooking的普遍新方法

• https://www.mdsec.co.uk/2020/08/firewalker-a-new-approach-to-generically-bypass-user-space-edr-hooking/
• https://github.com/mdsecactivebreach/firewalker

使用Echidna测试智能合约库

• https://blog.trailofbits.com/2020/08/17/using-echidna-to-test-a-smart-contract-library/

从Azure到本地AD的横向移动

• https://posts.specterops.io/death-from-above-lateral-movement-from-azure-to-on-prem-ad-d18cb3959d4d

Bug Bounty Tips #5

• https://www.infosecmatter.com/bug-bounty-tips-5-aug-17/

在11个月内对多达66,606次的蜜罐进行的未经请求的呼叫的首次大规模，纵向分析

• https://www.usenix.org/system/files/sec20-prasad.pdf

关于测量和可视化Fuzzer性能

• https://hexgolems.com/2020/08/on-measuring-and-visualizing-fuzzer-performance/

CobaltStrike资源收集

• https://github.com/zer0yu/Awesome-CobaltStrike

2020年年中数据泄露快速查看报告

• https://pages.riskbasedsecurity.com/en/2020-mid-year-data-breach-quickview-report

如何通过Pass-the-PRT的攻击向云进行横向移动

• https://blog.stealthbits.com/lateral-movement-to-the-cloud-pass-the-prt

20200817

[资讯]

美国烈酒和葡萄酒公司Brown-Forman被REvil勒索软件入侵，攻击者声称已窃取1TB的机密数据，并计划将最敏感的信息用于拍卖

• https://securityaffairs.co/wordpress/107190/data-breach/sodinokibi-ransomware-brown-forman.html

迷宫勒索软件运营商已经在线泄漏了据称在最近的勒索软件攻击中从佳能窃取的未加密文件

• https://securityaffairs.co/wordpress/107138/data-breach/maze-ransomware-gang-canon.html

[漏洞]

GOG Galaxy 客户端中的一个严重的本地特权升级漏洞

• https://www.positronsecurity.com/blog/2020-08-13-gog-galaxy_client-local-privilege-escalation_deuce/

Bludit Auth BF mitigation bypass exploit / PoC（CVE-2019-17240.）

• https://github.com/noraj/Bludit-auth-BF-bypass

[恶意代码]

XCSSER恶意软件：向Xcode项目中插入恶意代码，向Safari植入UXSS后门，利用2个0Day Exploit

• https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf

超过600个组织受到Microsoft Office365网络钓鱼活动的攻击

• https://blog.vairav.net/2020/08/16/600-organization-hit-by-microsoft-office365-phishing-campaign/

脱壳恶意软件IcedID

• https://kienmanowar.wordpress.com/2020/08/16/manual-unpacking-icedid-write-up/

[工具]

AutoGadgetFS：在不深入了解USB协议的情况下评估USB设备及其关联的主机/驱动程序/软件

• https://agfs.io
• https://github.com/ehabhussein/AutoGadgetFS

hackium：nodejs库，扩展了puppeteer来控制Chromium，用于分析、自动化和操纵网站

• https://github.com/jsoverson/hackium
• https://medium.com/@jsoverson/introducing-hackium-723790c00d03

ODBParser：在可公开访问的数据库中搜索个人隐私信息（PII）

• https://github.com/citcheese/ODBParser

TelemetrySourcerer：枚举和禁用AV/EDR常使用的遥测源（telemetry source）

• https://github.com/jthuraisamy/TelemetrySourcerer

awsreport：分析AWS资源的Python包

• https://github.com/bsd0x/awsreport

pantagrule：从超过8.4亿个泄露的密码中生成的hashcat规则

• https://github.com/rarecoil/pantagrule

Phirautee：PowerShell编写的勒索软件，能窃取信息、保留数据以作为支付赎金的要挟，或永久加密/删除数据

• https://github.com/Viralmaniar/Phirautee

SQLi-Query-Tampering：在Burp Intruder中扩展和添加自定义Payload生成器/处理器

• https://github.com/xer0days/SQLi-Query-Tampering

xssmap：一款基于 Python3 开发用于检测 XSS 漏洞的工具

• https://github.com/Jewel591/xssmap

[技术]

使用Jupyter Notebooks做威胁狩猎，Part1：连接到Elasticsearch

• https://marcusedmondson.com/2020/08/14/threat-hunting-with-jupyter-notebooks-part-1-connect-to-elasticsearch/

Open Sesame：通过电子代码审查将Open Redirect升级为RCE

• https://spaceraccoon.dev/open-sesame-escalating-open-redirect-to-rce-with-electron-code-review

Stopping phishing campaigns with bash：how to poison phishing sites with fake data

• https://blog.haschek.at/2020/stopping-phishing-campaigns-with-bash.html

Hacker101 CTF: Android Challenge Writeups

• https://medium.com/bugbountywriteup/hacker101-ctf-android-challenge-writeups-f830a382c3ce

XSS漏洞利用

• https://www.hackingarticles.in/cross-site-scripting-exploitation/

在Linux中使用Autospy取证浏览器

• https://www.hackingarticles.in/forensic-investigation-autopsy-forensic-browser-in-linux/

False2True, Match and Replace bug hunting — A cautionary tale

• https://medium.com/bugbountywriteup/false2true-match-and-replace-bug-hunting-a-cautionary-tale-fbe7020f02ad

使用Windows调试器API解析内存转储，不需要硬编码偏移量和版本检查

• https://medium.com/swlh/windows-debugger-api-the-end-of-versioned-structures-ac4acaa351bd

隐藏PE导入项

• https://roblehesa.com/posts/hiding-pe-imports/

武器化的虚假信息如何降低城市的电网

• https://journals.plos.org/plosone/article?id=10.1371/journal.pone.0236517

使用Ghidra逆向一个PWN挑战

• https://www.youtube.com/watch?v=aCWI61QX1OU
• https://www.youtube.com/watch?v=NOrcM-WQghQ

HTB：Traceback

• https://t3chnocat.com/htb-traceback/
• https://rizemon.github.io/hackthebox/windows/lua/motd/2020/08/16/traceback-htb.html

在一次私人Bug Bounty中发现的问题

• https://medium.com/bugbountywriteup/a-country-hijacking-3180c24a14b5

Crypto CTF 2020 Writeup

• https://yoshiking.hatenablog.jp/entry/2020/08/16/014102

8086处理器如何在内部处理电源和时钟

• http://www.righto.com/2020/08/how-8086-processor-handles-power-and.html

逆向教程

• https://www.youtube.com/watch?v=S6XSzosRk6A

介绍Windows NT的内核模式Payload：SassyKitdi：内核模式TCP套接字+ LSASS转储

• https://zerosum0x0.blogspot.com/2020/08/sassykitdi-kernel-mode-tcp-sockets.html

bug bounty writeup列表

• https://pentester.land/list-of-bug-bounty-writeups.html

20200814

[漏洞]

亚马逊的Alexa虚拟助手中存在严重的安全漏洞, 可能使其容易受到多种恶意攻击

• https://research.checkpoint.com/2020/amazons-alexa-hacked/

MMS漏洞利用，Part5：击败Android ASLR，获得RCE

• https://googleprojectzero.blogspot.com/2020/08/mms-exploit-part-5-defeating-aslr-getting-rce.html

"ENE Technology Inc" - vulnerable drivers global provider

• https://swapcontext.blogspot.com/2020/08/ene-technology-inc-vulnerable-drivers.html

CVE-2020–14979：EVGA Precision X1中的本地提权漏洞

• https://posts.specterops.io/cve-2020-14979-local-privilege-escalation-in-evga-precisionx1-cf63c6b95896

[恶意代码]

先前未知的APT组织RedCurl的分析报告，重点关注企业间谍活动

• https://www.group-ib.com/resources/threat-research/red-curl.html

APT组织CactusPete在针对东欧金融和军事组织的攻击中使用的最新Bisonal后门

• https://securelist.com/cactuspete-apt-groups-updated-bisonal-backdoor/97962/

俄罗斯情报局（GRU）使用以前未公开的Linux恶意软件工具集Drovorub进行间谍活动

• https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF

[工具]

OpenJailbreak：开源的iOS 11 – 13越狱项目

• https://github.com/GeoSn0w/OpenJailbreak

Windows Graphics Device Interface (GDI+) fuzzer

• https://github.com/math1as/Windows-GDI-fuzzer

dnsobserver：用Go语言编写的便捷DNS服务，可帮助检测多种类型的Blind漏洞

• https://github.com/allyomalley/dnsobserver

[技术]

Azure Sphere Internals - Overview

• https://www.comae.com/posts/2020-08-12_azure-sphere-internals-overview/

XSS全面指南

• https://www.hackingarticles.in/comprehensive-guide-on-cross-site-scripting-xss/

wget缓存投毒

• https://medium.com/bugbountywriteup/cache-poisoning-of-wget-94a4d70104b1

我们如何从一个加密的zip文件中恢复了XXX,000比特币

• https://www.youtube.com/watch?v=iFS25HfTe20

Hacking学习资源终极列表

• https://www.infosecmatter.com/learn-ethical-hacking-ultimate-list-of-resources-to-practice/

Swift在ARM64上的调用约定：Int/Bool

• https://vivekseth.com/swift-arm64-int-bool/

跨平台后渗透工具Mythic迎重大更新

• https://posts.specterops.io/a-change-of-mythic-proportions-21debeb03617
• https://github.com/its-a-feature/Mythic

Hack the Box Walkthrough — Forwardslash

• https://medium.com/bugbountywriteup/hack-the-box-walkthrough-forwardslash-9036c5422e67

Weaponizing Recon for Fun & Profit

• https://medium.com/bugbountywriteup/weaponizing-recon-for-fun-profit-by-tushar-verma-625472564f79

开源工具扫描器Semgrep实用介绍

• https://www.notsosecure.com/semgrep-a-practical-introduction/

20200813

[资讯]

SANS研究所遭受了数据泄露，暴露了包含个人身份信息（PII）的28,000条用户记录

• https://www.sans.org/dataincident2020

[漏洞]

QNX Slinger中隐藏的目录遍历漏洞

• https://www.vdoo.com/blog/directory-traversal-vulnerability-in-qnx-slinger/

Windows Print Spooler提权漏洞PoC(CVE-2020-1337)

• https://github.com/sailay1996/cve-2020-1337-poc
• https://github.com/neofito/CVE-2020-1337

如何在Active Directory中滥用GenericWrite ACE配置错误以运行任意可执行文件

• https://sensepost.com/blog/2020/ace-to-rce/

ReVoLTE攻击：利用LTE实现缺陷，恢复加密的VoLTE呼叫内容

• https://revolte-attack.net/

在WordPress插件中狩猎SQL注入（SQLis）和跨站点请求伪造（CSRF）漏洞

• https://medium.com/tenable-techblog/hunting-for-sql-injections-sqlis-and-cross-site-request-forgeries-csrfs-in-wordpress-plugins-632dafc9cd2f

microsoft.com和Nextcloud上的无密码WebAuthn中的PIN绕过

• https://hwsecurity.dev/2020/08/webauthn-pin-bypass/

发现和分析Windows PhoneBook UAF漏洞（CVE-2020-1530）

• https://symeonp.github.io/2020/12/08/phonebook-uaf-analysis.html

[恶意代码]

PowerFall行动：攻击者使用的Internet Explorer和Windows 0Day漏洞

• https://securelist.com/ie-and-windows-zero-day-operation-powerfall/97976/

Android平台恶意代码收集

• https://github.com/mstfknn/android-malware-sample-library

Dharma勒索软件攻击详细分析

• https://news.sophos.com/en-us/2020/08/12/color-by-numbers-inside-a-dharma-ransomware-as-a-service-attack/

银行木马DiamondFox家族的新成员DiamondFox Kettu

• https://fr3d.hk/blog/diamondfox-bank-robbers-will-be-replaced

[工具]

DefensiveInjector：Shellcode注入器

• https://github.com/bats3c/DefensiveInjector
• https://labs.jumpsec.com/2020/08/11/defending-your-malware/

litewaf：简易的In-App WAF

• https://github.com/echo-devim/litewaf

vps-docker-for-pentest：用docker在谷歌云平台或Digital Ocean上创建用于渗透的VPS

• https://github.com/aaaguirrep/vps-docker-for-pentest

Zolom：C＃可执行文件，可以反射性地用于在未安装Python的系统上运行（嵌入的）Python代码

• https://github.com/checkymander/Zolom

[技术]

Fuzzing sockets, part 2: FreeRDP

• https://securitylab.github.com/research/fuzzing-sockets-FreeRDP

如何对安全工具进行基准测试：使用WebGoat的案例研究

• https://about.gitlab.com/blog/2020/08/11/how-to-benchmark-security-tools/

将Splunk转换成漏洞扫描器

• https://vulners.blog/2020/08/12/game-changing-plugin-for-your-splunk-try-out-new/

(权限不足时)导出Outlook私钥和解密基于S/MIME加密的电子邮件

• https://www.errno.fr/OutlookDecrypt/OutlookDecrypt

如何利用最新的TLS检查解决方案中的安全功能进行隐秘的数据渗透

• https://www.mnemonic.no/blog/introducing-snicat
• https://github.com/mnemonic-no/SNIcat

To the Brim at the Gates of Mordor Pt. 1

• https://holisticinfosec.io/post/brim-mordor/

利用Windows电源管理API实现代码执行和检测规避

• https://github.com/am0nsec/vx/tree/master/Virus.Win64.DeusSomnum
• https://vxug.fakedoma.in/papers/VXUG/Exclusive/AbusingtheWindowsPowerManagementAPI.pdf

Google App Engine，Azure App Service在网络钓鱼活动中被滥用

• https://www.netskope.com/blog/a-big-catch-cloud-phishing-from-google-app-engine-and-azure-app-service

20200812

[资讯]

研究人员发现了一个不安全的AWS S3存储桶，其中包含超过550万个文件，大小超过343GB，疑似属于项目管理软件公司InMotionNow

• https://www.vpnmentor.com/blog/report-multiple-firms-breach/

[漏洞]

通过逆向多个供应商的固件寻找新的BLE Exploit

• https://www.youtube.com/watch?v=MRRkBWv4VVU

Windows Print Spooler修补程序绕过可重新启用持久性后门：绕过CVE-2020-1048和修复该漏洞的新修补程序

• https://www.zerodayinitiative.com/blog/2020/8/11/windows-print-spooler-patch-bypass-re-enables-persistent-backdoor

细解释如何触发PrintDemon漏洞利用，并剖析如何发现新的0Day（CVE-2020-1337）

• https://voidsec.com/cve-2020-1337-printdemon-is-dead-long-live-printdemon/

三星手机“查找我的手机” 软件包中存在多个漏洞，可能导致手机用户完全丢失数据（恢复出厂设置），以及实时位置跟踪、电话和短信检索、电话锁定、电话解锁等

• https://char49.com/tech-reports/fmmx1-report.pdf

CVE-2020-1337 Windows Privilege Escalation Exploit

• https://github.com/math1as/CVE-2020-1337-exploit

[工具]

pyvirusshare：Python库，与VirusShare API v2交互

• https://github.com/chrsow/pyvirusshare

渗透测试工具收集

• https://github.com/S3cur3Th1sSh1t/Pentest-Tools

汇编语言、逆向、恶意代码分析的资源收集

• https://gist.github.com/navneetmuffin/ff678b1fda17e6188aa0462a99626121

Flask会话Cookie解码器/编码器

• https://github.com/noraj/flask-session-cookie-manager

[技术]

使用Symlink攻击击败Secure Boot

• https://www.anvilventures.com/blog/defeating-secure-boot-with-symlink-attacks.html

滥用AWS连接跟踪

• https://frichetten.com/blog/abusing-aws-connection-tracking/

Hack the Box (HTB) machines walkthrough series — ServMon

• https://resources.infosecinstitute.com/hack-the-box-htb-walkthrough-servmon

Just another Null Byte Poison via Unicode variant (MuPDF mutool RCE)

• https://gynvael.coldwind.pl/?id=732

渗透测试时使用端口转发访问内部计算机

• https://medium.com/bugbountywriteup/gain-access-to-an-internal-machine-using-port-forwarding-penetration-testing-518c0b6a4a0e

Barbervisor：用英特尔VT-x开发快照Fuzzer的旅程

• https://blog.talosintelligence.com/2020/08/barbervisor.html
• https://github.com/Cisco-Talos/Barbervisor

检测访问令牌操纵

• https://i.blackhat.com/USA-20/Thursday/us-20-Burgess-Detecting-Access-Token-Manipulation.pdf

通过利用Windows公开的调试框架, 使用调试API在目标进程中调用任意.NET代码

• https://blog.xpnsec.com/debugging-into-net/

20200811

[漏洞]

vBulletin远程代码执行漏洞(CVE-2019-16759)的补丁不足以阻止漏洞利用，演示如何绕过补丁

• https://blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-fail/

作者如何发现并帮助Google 修补Chrome浏览器中的零日漏洞的故事，该漏洞可能允许攻击者自Chrome 73（2019年3月）以来完全绕过CSP规则

• https://www.perimeterx.com/tech-blog/2020/csp-bypass-vuln-disclosure/

UltraLoq智能锁的配置错误和其他安全问题，允许攻击者只用MAC地址即可远程开锁

• https://www.tripwire.com/state-of-security/featured/tripwire-research-iot-smart-lock-vulnerability/

TeamViewer严重漏洞CVE 2020-13699，远程攻击者可利用此漏洞窃取密码

• https://thehackernews.com/2020/08/teamviewer-password-hacking.html

CVE-2020-11518：通过爆破进入Active Directory环境

• https://honoki.net/2020/08/10/cve-2020-11518-how-i-bruteforced-my-way-into-your-active-directory/

Ghostscript SAFER Sandbox Breakout (CVE-2020-15900)

• https://insomniasec.com/blog/ghostscript-cve-2020-15900

[工具]

IRFuzz：使用Yara规则扫描文档归档或任意文件

• https://github.com/oxiqa/IRFuzz

VirtualDynamicAnalysis：基本的Android渗透测试环境，可以无需Root攻击Android App，或对App重打包

• https://github.com/darvincisec/VirtualDynamicAnalysis

basic_mutator：基于honggfuzz的简易仿真器

• https://github.com/gamozolabs/basic_mutator

Noctilucent：使用TLS 1.3逃避检查器，绕过网络防御并混入噪声

• https://github.com/SixGenInc/Noctilucent
• https://www.youtube.com/watch?v=TDg092qe50g

burpcollaborator-docker：使用LetsEncrypt通配符证书在Docker环境中安装Burp Collaborator Server，尽可能简化设置和维护服务器的过程

• https://github.com/integrity-sa/burpcollaborator-docker

MsvpPasswordValidate.js：Hook MsvpPasswordValidate绕过认证&演示NTLM泄漏

• https://github.com/FuzzySecurity/Fermion/blob/master/Examples/MsvpPasswordValidate.js

[技术]

在受害者系统中隐藏artiface逃避检测的各种方法：隐藏文件和目录、隐藏系统用户、隐藏文件系统和NTFS文件属性

• https://www.hackingarticles.in/defense-evasion-hide-artifacts/

常见的Linux提权

• https://medium.com/bugbountywriteup/write-up-11-common-linux-privilege-escalation-92528853b616

2020年恶意Tor中继如何攻击Tor用户，Part1：一个神秘组织劫持了Tor出口节点以执行SSL剥离攻击

• https://medium.com/@nusenu/how-malicious-tor-relays-are-exploiting-users-in-2020-part-i-1097575c0cac

ASUSWRT URL Processing Stack Buffer Overflow

• https://starlabs.sg/blog/2020/08/asuswrt-url-processing-stack-buffer-overflow/

NPM生态系统的状态

• https://blog.phylum.io/what-is-the-state-of-npm/

安全存储器上的黑盒激光故障注入

• https://i.blackhat.com/USA-20/Thursday/us-20-Heriveaux-Black-Box-Laser-Fault-Injection-On-A-Secure-Memory.pdf

初始访问经纪人的秘密生活

• https://ke-la.com/the-secret-life-of-an-initial-access-broker/

[其他]

2020年第2季度DDoS攻击报告

• https://securelist.com/ddos-attacks-in-q2-2020/98077/

20200810

[漏洞]

高通公司的Snapdragon芯片上的400多个漏洞，对全球手机的安全构成威胁

• https://blog.checkpoint.com/2020/08/06/achilles-small-chip-big-peril/

(Pwn2Own 2020)利用6个漏洞组成的漏洞利用链，通过Safari攻击macOS内核

• https://github.com/sslab-gatech/pwn2own2020

在梅赛德斯-奔驰E级轿车中发现的数十个漏洞

• https://www.blackhat.com/us-20/briefings/schedule/#security-research-on-mercedes-benz-from-hardware-to-car-control-20746

[恶意代码]

基于PowerShell的恶意软件”sLoad”中的随机代码生成

• https://securityliterate.com/random-code-generation-in-powershell-based-malware-sload/

Water Nue网络钓鱼活动：针对C-Suite Office 365帐户的钓鱼活动

• https://blog.trendmicro.com/trendlabs-security-intelligence/water-nue-campaign-targets-c-suites-office-365-accounts/

使用同形文字攻击的Card Skimmer

• https://blog.malwarebytes.com/threat-analysis/2020/08/inter-skimming-kit-used-in-homoglyph-attacks/

[工具]

radare2-python：与Radare2交互的Python脚本

• https://github.com/nimrodpar/radare2-python

IntelOwl：通过一个单独的API请求，以多种方式大规模地分析文件、域和ip

• https://github.com/intelowlproject/IntelOwl

evine：交互式命令行网络爬虫

• https://github.com/saeeddhqan/evine

reconness：一个允许连续侦查（CR）的平台，可以在其中建立侦察工具（代理）的管道并根据计划或事件触发它

• https://github.com/reconness/reconness

Obfuscator：Shellcode混淆工具

• https://github.com/3xpl01tc0d3r/Obfuscator
• https://3xpl01tc0d3r.blogspot.com/2020/08/introduction-to-obfuscator.html

[技术]

Latches inside：逆向工程Intel 8086的指令寄存器

• http://www.righto.com/2020/08/latches-inside-reverse-engineering.html

逆向LYFT的乘车历史API以分析6年的乘车价值

• https://blog.jonlu.ca/posts/reversing-lyft

Zoom安全漏洞挖掘与测试

• https://mazinahmed.net/blog/hacking-zoom/

RS：针对Redis SDK客户端的提案规范，该规范允许使用别名隐藏真实的Redis命令

• https://github.com/cr0hn/rsm

在32位模式下用AFL Fuzzing Adobe的字体构建工具afdko

• https://hardik05.wordpress.com/2020/08/08/fuzzing-afdko-with-afl-in-32bit-mode/

绕过Internet连接和复制粘贴限制，以渗透恶意数据

• http://www.mannulinux.org/2020/08/bypassing-internet-connectivity-and.html

伪装成合法的ZigBee灯泡，利用在网桥中发现的漏洞，使用远程over-the-air ZigBee exploit渗透IP网络

• https://research.checkpoint.com/2020/dont-be-silly-its-only-a-lightbulb/

对CPU prefetching攻击的根本原因的系统分析

• https://arxiv.org/pdf/2008.02307.pdf

无括号的XSS：违反严格的CSP政策

• https://medium.com/@terjanq/arbitrary-parentheses-less-xss-e4a1cf37c13d

Hacking OAuth 2.0 For Beginners

• https://www.youtube.com/watch?v=0T8WG2liEC0

用打印机协议入侵Windows电脑

• https://www.youtube.com/watch?v=be2jOZM8Whs

20200807

[资讯]

Intel泄露了一个20GB的具有机密知识产权的文件夹，该文件夹由一个匿名消息来源发布，声称不久将要发布更多信息。许多文档的标题确实与泄露者发布的声称信息列表相关。

• https://www.tomshardware.com/news/massive-20gb-intel-data-breach-floods-the-internet-mentions-backdoors

[漏洞]

TNAS设备的TerraMaster操作系统的漏洞可导致未经身份验证的的Root权限访问

• https://ssd-disclosure.com/ssd-advisory-terramaster-os-exportuser-php-remote-code-execution/

Cisco SD-WAN vManage 19.2.2：从CSRF到远程代码执行

• https://medium.com/walmartglobaltech/hacking-cisco-sd-wan-vmanage-19-2-2-from-csrf-to-remote-code-execution-5f73e2913e77

From Knowing Nothing to Knowing Something：BLE RCEs

• https://github.com/darkmentorllc/publications/blob/master/2020/TI_SILABS_BLE_RCEs/whitepaper_TI_SILABS_BLE_RCEs_v1.0.0.pdf

Breaking Samsung’s Root of Trust：Exploiting Samsung S10 S-Boot

• https://github.com/TrapaSecurity/presentations/blob/master/us-20-Chao-Breaking-Samsung's-Root-of-Trust-Exploiting-Samsung-Secure-Boot.pdf

SecurEnvoy中的路径遍历漏洞会通过文件上传导致远程命令执行

• https://sidechannel.tempestsi.com/path-traversal-vulnerability-in-securenvoy-impacts-on-remote-command-execution-through-file-upload-ec2e731bd50a

Android漏洞，可以诱骗Android将短信显示为来自受害者手机上的任何联系人

• https://jameshfisher.com/2020/08/06/smear-phishing-how-to-scam-an-android-user/

[恶意代码]

(书)Mac平台恶意代码分析

• https://taomm.org/vol1/analysis.html

如何防御黑客组织NSO Group的复杂间谍软件Pegasus

• https://code.firstlook.media/how-to-defend-against-pegasus-nso-group-s-sophisticated-spyware

[工具]

浏览器检测与相应工具

• https://github.com/weaklayer/gateway
• https://github.com/weaklayer/sensor
• https://weaklayer.com/2020/06/28/Getting-Started/

ghidra_kernelcache：在Ghidra中逆向iOS Kernel Cache的辅助脚本

• https://github.com/0x36/ghidra_kernelcache

PowerShell武器库

• https://github.com/MScholtes/TechNet-Gallery

Powershell ebserver：PowerShell实现的Web服务器，无需IIS，支持PowerShell命令执行、脚本执行、上传、下载等功能

• https://github.com/MScholtes/TechNet-Gallery/tree/master/Powershell%20Webserver

PS2EXE-GUI：将PowerShell脚本转换为EXE文件

• https://github.com/MScholtes/TechNet-Gallery/tree/master/PS2EXE-GUI

go_parser：用于解析GoLang二进制文件的IDAPython脚本

• https://github.com/0xjiayu/go_parser

spybrowse：窃取指定浏览器的配置文件

• https://github.com/1d8/spybrowse

FavFreak：执行基于favicon.ico的侦察

• https://github.com/devanshbatham/FavFreak
• https://medium.com/@Asm0d3us/weaponizing-favicon-ico-for-bugbounties-osint-and-what-not-ace3c214e139

[技术]

如何挖掘和利用盲RCE漏洞

• https://medium.com/@viveik.chauhan/blind-remote-code-execution-b9c4e119f7c3

Robots, Oracles and Protocols; Breaking Cryptography Through Information Leakage

• https://medium.com/dataseries/robots-oracles-and-protocols-breaking-cryptography-through-information-leakage-3a1e73c9483a

对主刷新令牌( Primary Refresh Token)的进一步研究

• https://dirkjanm.io/digging-further-into-the-primary-refresh-token/

Reversing the Root：识别在野使用的可被用的0Day

• https://github.com/maddiestone/ConPresentations/blob/master/BH2020.ReversingTheRoot.pdf

介绍JXA(JavaScript for Automation)对macOS Tradecraft开发的好处，重点介绍了一种众所周知的持久性方法和一些鲜为人知的JXA执行方法

• https://posts.specterops.io/persistent-jxa-66e1c3cd1cf5
• https://github.com/D00MFist/PersistentJXA

Reverse Engineering Netgear's Auth to extend my Meural

• https://ma.rtin.so/posts/reverse-engineering-netgear-auth-to-extend-my-meural/

通过攻击安全内核（Secure Kernel）绕过VSM

• https://github.com/microsoft/MSRC-Security-Research/blob/master/presentations/2020_08_BlackHatUSA/Breaking_VSM_by_Attacking_SecureKernel.pdf

通过Cloud API横向移动和权限提升攻破任意GCP组织

• https://www.youtube.com/watch?v=Ml09R38jpok

Capture the flag: A walkthrough of SunCSR’s Sumo

• https://resources.infosecinstitute.com/capture-the-flag-a-walkthrough-of-suncsrs-sumo

实时检测虚假的4G基站

• https://i.blackhat.com/USA-20/Wednesday/us-20-Quintin-Detecting-Fake-4G-Base-Stations-In-Real-Time.pdf

20200806

[资讯]

佳能遭受Maze勒索软件攻击，影响了许多服务，包括佳能的电子邮件、微软团队、美国网站以及其他内部应用程序。其云照片和视频存储服务的可疑中断，可能导致了10GB的用户丢失数据

• https://www.bleepingcomputer.com/news/security/canon-hit-by-maze-ransomware-attack-10tb-data-allegedly-stolen/

俄罗斯黑客在黑客论坛上泄露了913个Pulse Secure VPN企业服务器机密信息，数据可免费下载，内容包括服务器的IP地址、固件版本、纯文本用户名和密码、本地用户及其各自的密码哈希列表、SSH密钥、VPN的会话cookie

• https://www.hackread.com/900-pulse-secure-vpn-servers-data-leaked-hacker-forum/

[漏洞]

2020年ICS Pwn2Own上使用的Rockwell Studio 5000 Logix Designer 的漏洞利用链，从XXE到RCE

• http://muffsec.com/blog/?p=608

npm包express-fileupload存在严重漏洞，使攻击者能够在服务器上执行拒绝服务（DoS）攻击或获得完整的远程Shell访问权限。此npm包被下载700万次

• https://blog.p6.is/Real-World-JS-1/

[工具]

manticore-cli：威胁仿真客户端工具

• https://github.com/Manticore-Platform/manticore-cli

xeca：创建用于攻击性目的的加密的PowerShell Payload，也可以从DLL文件创建位置独立的Shellcode

• https://github.com/postrequest/xeca

DLInjector：DLL注入器，依靠进程名注入，可以等待进程启动后再注入

• https://github.com/fatihsnsy/DLInjector-GUI
• https://github.com/fatihsnsy/DLInjector-CLI

Netenum：以被动的方式发现网络内的活跃主机

• https://github.com/wintrmvte/Netenum

Ciphey：使用自然语言处理和人工智能以及一些常识的全自动解密工具

• https://github.com/Ciphey/Ciphey

PurpleSharp：威胁模拟工具，该工具执行adversar技术，在受监视的Windows环境中生成attack telemetry

• https://github.com/mvelazc0/PurpleSharp
• https://medium.com/threat-hunters-forge/sharpen-your-simulation-game-part-1-introduction-85d785cda32c

spectre：Windows内核Rootkit，滥用合法的通信渠道来控制机器

• https://github.com/d4stiny/spectre

[技术]

逆向Netflix Falcor API

• https://idiomaticprogrammers.com/post/reverse-engineering-netflix-api/

深入了解集容器安全性扫描

• https://www.loginradius.com/engineering/blog/container-security-scanning/

理解Firefox中的Web安全检查，Part2

• https://blog.mozilla.org/attack-and-defense/2020/08/05/understanding-web-security-checks-in-firefox-part-2/

使用AST注入在两个众所周知的模板引擎中触发RCE

• https://blog.p6.is/AST-Injection/

如何使用AWS创建无限旋转IP地址

• https://medium.com/@devinjaystokes/using-proxycannon-ng-to-create-unlimited-rotating-proxies-fccffa70a728

实战使用IDA分析恶意代码

• https://www.youtube.com/watch?v=AZ6Ax-v2ooc

利用以太网电缆中的分组攻击来绕过防火墙和NAT

• https://www.armis.com/etheroops/

调试DLL的3种技术

• https://blog.nviso.eu/2020/08/04/debugging-dlls-3-techniques-to-help-you-get-started/

什么是Web缓存投毒以及哪些行为可能导致Web缓存投毒漏洞

• https://portswigger.net/web-security/web-cache-poisoning

如何在Ubuntu 20.04上设置带漏洞的PostgreSQL环境，以及如何进行PostgreSQL渗透测试

• https://www.hackingarticles.in/penetration-testing-on-postgresql-5432/

Open Redirect完全指南

• https://www.hackingarticles.in/comprehensive-guide-on-open-redirect/

不良行为者可能会隐藏在Microsoft Teams更新程序流量中

• https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/microsoft-teams-updater-living-off-the-land/

Web缓存投毒的新途径

• https://portswigger.net/research/web-cache-entanglement

IDA逆向新手教程

• https://www.youtube.com/playlist?list=PLKwUZp9HwWoDDBPvoapdbJ1rdofowT67z

20200805

[资讯]

美国在线食品订购和交付平台UberEats的用户记录在暗网泄露。泄露文件为9个TXT文件，其中包含UberEATS交付驱动程序、交付合作伙伴和客户的详细信息、579位UberEATS客户的登录凭据和100个交付驱动程序的详细信息。公开的记录包括诸如登录凭据、全名、联系电话、旅行详细信息、银行卡详细信息、帐户创建日期之类的信息。

• https://cybleinc.com/2020/08/04/user-records-of-ubereats-leaked-on-darkweb/

[漏洞]

跨平台的Java应用程序Openfire管理控制台中的漏洞

• https://swarm.ptsecurity.com/openfire-admin-console/

TouchID的新功能中的漏洞，可使攻击者获取对iCloud帐户的未授权访问

• https://www.computest.nl/en/knowledge-platform/blog/vulnerability-new-touchid-feature-iCloud-accounts-at-risk-breached/

CVE-2020-15654技术分析和Firefox“浏览器锁定”漏洞的历史记录

• https://news.sophos.com/en-us/2020/08/03/technical-analysis-cve-2020-15654-and-a-history-of-firefox-browser-lock-bugs/

Wordpress插件Newsletter的反射XSS漏洞和PHP对象注入漏洞

• https://www.wordfence.com/blog/2020/08/newsletter-plugin-vulnerabilities-affect-over-300000-sites/

[恶意代码]

OpBlueRaven: Unveiling Fin7/Carbanak - Part 1 : Tirion

• https://threatintel.blog/OPBlueRaven-Part1/

2020年第2季度APT趋势报告

• https://www.brighttalk.com/webcast/15591/424426/new-threats-in-a-changing-world-apt-trends-in-q2-2020

[工具]

link-lock：用于加密和解密URL的工具。用户访问加密的URL时，将提示他们输入密码。如果密码正确，Link Lock会检索原始URL，然后将其重定向到该URL。否则，将显示错误

• https://github.com/jstrieb/link-lock

Arcane：向iOS包植入后门

• https://github.com/tokyoneon/Arcane

EnumerationList：用于子域名枚举的wordlist

• https://github.com/Droidzzzio/EnumerationList

Osintgram：针对Instagram的OSINT工具

• https://github.com/Datalux/Osintgram

[技术]

lldb自动追踪断点后的所有call

• https://www.youtube.com/watch?v=Xudnes3jf38

MMS漏洞利用，Part4：在最新的三星旗舰设备上完成远程零点击MMS攻击

• https://googleprojectzero.blogspot.com/2020/08/mms-exploit-part-4-completing-aslr-oracle.html

快速解决在Windows环境中进行红队活动时可怕的两次跳跃问题

• https://posts.slayerlabs.com/double-hop/

Hypervisor内存自省介绍

• https://medium.com/@hvmi/a-gentle-introduction-to-hvmi-baa91e1571d1

掩盖恶意内存伪像，Part3：绕过防御性扫描程序

• https://securityboulevard.com/2020/08/masking-malicious-memory-artifacts-part-iii-bypassing-defensive-scanners/

Bug Bounty Tips #4

• https://www.infosecmatter.com/bug-bounty-tips-4-aug-03/

20200804

[资讯]

全球第七大轮胎制造商ApolloTires被Netwalker勒索软件攻击，攻击者泄露了ApolloTires的敏感数据，例如预算、用户、项目、库存数量、审计报告等

• https://cybleinc.com/2020/08/03/apollo-tyres-allegedly-breached-by-netwalker/

[漏洞]

一个完整的针对PlayStation4 6.70 - 6.72的“ipv6 uaf”内核漏洞利用

• https://github.com/ChendoChap/ps4-ipv6-uaf

In-DRAM RowHammer缓解措施的秘密缺陷

• https://www.youtube.com/watch?v=9gSxQfoARAI

SKYSEA活动监视器漏洞利用(CVE-2020-5617)

• https://acru3l.github.io/2020/08/03/exploiting-activity-monitor-driver/

从5到0：VPN安全缺陷给具有远程OT人员的组织带来网络风险

• https://www.claroty.com/2020/07/28/vpn-security-flaws/

[恶意代码]

McAfee的最新报告显示，Netwalker勒索软件在短短五个月内赚了2500万美元

• https://www.mcafee.com/blogs/other-blogs/mcafee-labs/take-a-netwalk-on-the-wild-side

恶意软件Dridex从word文档到目标接管的整个攻击链

• https://thedfirreport.com/2020/08/03/dridex-from-word-to-domain-dominance/

[工具]

Mistica：将数据嵌入到应用程序层协议字段中，目的是为任意通信建立双向通道

• https://github.com/IncideDigital/Mistica

[技术]

Unbricking a $2,000 Bike With a $10 Raspberry Pi

• https://ptx2.net/posts/unbricking-a-bike-with-a-raspberry-pi/

利用WebRTC中的漏洞实现Android Messenger利用，Part1

• https://googleprojectzero.blogspot.com/2020/08/exploiting-android-messengers-part-1.html

Apache Struts近10年的漏洞研究，Part3：漏洞利用

• https://www.synopsys.com/blogs/software-security/apache-struts-research-exploitation/

FIDLing with Decompilers

• https://www.youtube.com/watch?v=wd5bNMoepmc

在移动应用程序上实施安全生物特征认证

• https://blog.mindedsecurity.com/2020/07/implementing-secure-biometric.html

渗透指南，Part5：揭露WAF并查找源

• https://delta.navisec.io/a-pentesters-guide-part-5-unmasking-wafs-and-finding-the-source/

InCTF-2020 GoSQLv3 challenge writeup

• https://spyclub.tech/2020/08/02/inctf2020-gosqlv3-challenge-writeup/

[其他]

2020年数据泄露成本报告。报告显示：2020年，全球数据泄露的平均总成本为386万美元，比2019年的研究下降约1.5％

• https://www.ibm.com/security/digital-assets/cost-data-breach-report/

20200803

[资讯]

澳大利亚领先的老年护理私人提供商——瑞吉斯老年护理服务公司被Maze勒索软件攻击，泄露677M敏感和机密文件，包括客户的住宿和直接借记协议、各种俱乐部服务的登录凭据、员工培训和出勤记录文件、Regis Burnside盛大开业的RSVP列表等

• https://cybleinc.com/2020/07/31/largest-providers-of-aged-care-in-australia-regis-aged-care-pty-ltd-allegedly-breached-by-maze/

[漏洞]

ClickOnce部署清单(Deployment Manifests)的hash-disclosure漏洞

• http://blog.redxorblue.com/2020/07/one-click-to-compromise-fun-with.html

macOS漏洞利用链：利用3个逻辑漏洞，从用户层到内核层，绕过内核的系统完整性保护

• https://objective-see.com/blog/blog_0x4D.html
• https://github.com/A2nkF/unauthd

Grafana未授权Full-Read SSRF（CVE-2020-13379）

• https://rhynorater.github.io/CVE-2020-13379-Write-Up

EternalBlueC：永恒之蓝工具包，包括MS17-010 Exploit，永恒之蓝漏洞检测器，DoublePulsar检测器和DoublePulsar Shellcode & DLL uploader

• https://github.com/bhassani/EternalBlueC

[恶意代码]

勒索软件WastedLocker技术分析

• https://securelist.com/wastedlocker-technical-analysis/97944/

[工具]

BruteShark：网络分析工具，能对网络数据包执行深度处理和探查

• https://github.com/odedshimon/BruteShark

SharpAppLocker：PowerShell脚本Get-AppLockerPolicy的C#版

• https://github.com/Flangvik/SharpAppLocker

festin：从域名中发现公开的S3 bucket，可以发现S3 bucket的漏洞

• https://github.com/cr0hn/festin

ariacloud：用于远程渗透测试的Docker容器

• https://github.com/iknowjason/ariacloud
• https://medium.com/bugbountywriteup/pentesting-in-the-clouds-introducing-ariacloud-58cb5cc1c50d

Kubei：一个灵活的Kubernetes运行时扫描器，提供精准的漏洞评估

• https://github.com/Portshift/Kubei

ida-plugins：IDA插件，查找寄存器的交叉引用

• https://github.com/repnz/ida-plugins

cookie_dough：从Fuzzer内部观察和测量Fuzzer的行为，可用于比较Fuzzer，而不必担心它们具有不同的性能和覆盖定义

• https://github.com/gamozolabs/cookie_dough

Convex：一组可独立部署到participant Azure环境中的CTF

• https://github.com/Azure/Convex

Bug-Bounty-Toolz：可用于Bug Bounty的脚本收集

• https://github.com/m4ll0k/Bug-Bounty-Toolz

CWFF：创建用于Fuzzing的自定义wordlist

• https://github.com/D4Vinci/CWFF

vulnerable-AD：创建带漏洞的Active Directory环境，可以在本地实验室中执行大多数针对Active Directory的攻击

• https://github.com/WazeHell/vulnerable-AD

[技术]

逆向Intel 8086里的加法器

• https://www.righto.com/2020/08/reverse-engineering-adder-inside-intel.html

Android APK逆向

• https://epic.blog/reverse-engineering/2020/07/27/reverse-engineering-android-app.html

使用Base64进行数据渗透

• https://www.trenchesofit.com/2020/08/01/data-exfiltration-with-base64/

LCD和可视密码学带来的乐趣

• https://justi.cz/security/2020/07/30/lcd-crypto.html

针对SETUID Root Program的ARM堆栈溢出攻击教程

• https://www.fortinet.com/blog/threat-research/tutorial-arm-stack-overflow-exploit-against-setuid-root-program

Windows进程注入: 命令行和环境变量

• https://modexp.wordpress.com/2020/07/31/wpi-cmdline-envar/

远程文件包含（RFI）完全指南

• https://www.hackingarticles.in/comprehensive-guide-on-remote-file-inclusion-rfi/

Apple的核心是PPL：打破XNU内核的内核

• https://googleprojectzero.blogspot.com/2020/07/the-core-of-apple-is-ppl-breaking-xnu.html

Aspnet_Compiler.exe的奇怪案例：使用aspnet_compiler.exe实现代码执行

• https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/

逆向Starling Bank App，Part2：越狱和调试器检测，弱点和缓解措施

• https://hot3eed.github.io/2020/08/02/starling_p2_detections_mitigations.html

247CTF - The Secret Lock Writeup

• https://rehex.ninja/posts/247ctf-the-secret-lock/

使用签名驱动移除内核回调

• https://br-sn.github.io/Removing-Kernel-Callbacks-Using-Signed-Drivers/

Windows API Hooking与DLL注入

• https://dzone.com/articles/windows-api-hooking-and-dll-injection

适用于测试人员和安全专业人员的最重要的Android渗透测试工具

• https://gbhackers.com/android-security-penetration-testing/

面向黑客和安全专家的完整渗透测试和黑客工具列表

• https://gbhackers.com/hacking-tools-list/

20200731

[漏洞]

介绍识别Tor Bridge网络流量的方法, 包括两个新的0day漏洞：一个用于检测obfs4，另一个用于检测meek

• https://www.hackerfactor.com/blog/index.php?/archives/889-Tor-0day-Burning-Bridges.html

使用ShiftLeft Ocular在Cisco数据中心网络管理器（DCNM）中挖掘漏洞

• https://blog.shiftleft.io/hunting-0-days-in-cisco-dcnm-with-shiftleft-ocular-a3091bb8ef29

[工具]

CAPA_JsonConver：将Capa工具导出的结果从.json格式转换为不同工具支持的其他格式

• https://github.com/Dump-GUY/CAPA_JsonConver

hvmi：Hypervisor内存自省工具, 能够在对运行在KVM和Xen上的Windows和Linux vm的性能影响最小的情况下提供实时保护

• https://github.com/hvmi/hvmi

napoca：轻量级的type-1 hypervisor，通过提供对虚拟客户操作系统的CPU和内存资源的全面控制，为构建高级的以安全为重点的功能提供了坚实的基础

• https://github.com/napocahv/napoca

[技术]

一种新的iOS内核利用技术，该技术可将一个字节控制的堆溢出直接转换为任意物理地址的读/写原语，同时完全避开了当前的缓解措施，例如KASLR，PAC和zone_require

• https://googleprojectzero.blogspot.com/2020/07/one-byte-to-rule-them-all.html

现实世界JS漏洞系列

• https://blog.p6.is/Real-World-JS-1/

Sunset: Midnight Vulnhub Walkthrough

• https://www.hackingarticles.in/sunset-midnight-vulnhub-walkthrough/

在野发现0Day后的根本原因分析

• https://googleprojectzero.blogspot.com/2020/07/root-cause-analyses-for-0-day-in-wild.html

KLEE符号执行引擎介绍

• https://www.youtube.com/watch?v=z6bsk-lsk1Q

分析基于LLVM的混淆方式YANSOllvm

• https://k0deless.github.io/posts/yansollvm/

逆向iOS平台的App Starling Bank，Part1：混淆技术

• https://hot3eed.github.io/2020/07/30/starling_p1_obfuscations.html

关于“模态偏差(modulo bias)及其避免方法”的权威指南

• https://research.kudelskisecurity.com/2020/07/28/the-definitive-guide-to-modulo-bias-and-how-to-avoid-it/

渗透测试实验室配置：MS-SQL服务器安装与配置

• https://www.hackingarticles.in/penetration-testing-lab-setupms-sql/

Android InsecureBankv2 Walkthrough

• https://medium.com/bugbountywriteup/android-insecurebankv2-walkthrough-part-1-9e0788ba5552
• https://medium.com/bugbountywriteup/android-insecurebankv2-walkthrough-part-2-429b4ab4a60f
• https://medium.com/bugbountywriteup/android-insecurebankv2-walkthrough-part-3-2b3e5843fe91

Hack the Box (HTB) machines walkthrough series — Nest, part 1

• https://securityboulevard.com/2020/07/hack-the-box-htb-machines-walkthrough-series-nest-part-1/

在扫描子域时使用XAMPP和Burp Intruder查找有趣的行为和代码

• https://medium.com/@zseano/using-xampp-and-burp-intruder-when-scanning-for-subdomains-to-look-for-interesting-behaviour-code-f24c511d15ed

Office 365网络钓鱼：滥用Google Ads绕过电子邮件过滤器

• https://www.bleepingcomputer.com/news/security/office-365-phishing-abuses-google-ads-to-bypass-email-filters/

通过DLL劫持和伪造目录绕过UAC

• https://daniels-it-blog.blogspot.com/2020/07/uac-bypass-via-dll-hijacking-and-mock.html?m=1

[其他]

2020年第2季度威胁报告

• https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf

20200730

[漏洞]

BootHole：GRUB2 bootloader漏洞，即便开启Secure Boot，在启动时也可以实现任意代码执行

• https://eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/

Getting from 5 to 0: VPN Security Flaws Pose Cyber Risk to Organizations with Remote OT Personnel

• https://www.claroty.com/2020/07/28/vpn-security-flaws/

MMS漏洞利用Part3：构造内存破坏原语

• https://googleprojectzero.blogspot.com/2020/07/mms-exploit-part-3-constructing-primitives.html

在流行的OkCupid约会应用程序上发现的漏洞

• https://research.checkpoint.com/2020/hacker-22-seeks-ltr-with-your-data-vulnerabilities-found-on-popular-okcupid-dating-app/

CVE-2020–9934: Bypassing TCC

• https://objective-see.com/blog/blog_0x4C.html

[恶意代码]

2020年第2季度APT趋势报告

• https://securelist.com/apt-trends-report-q2-2020/97937/

[工具]

Magma：用于测试Fuzzing框架的基准(Benchmark)

• https://hexhive.epfl.ch/magma/

urldozer：URL操作库，提取路径、参数名称和/或值、域名、主机名等

• https://github.com/offensivedev/urldozer

timeless-timing-attacks：测试- http服务器是否有Timeless Timing Attack漏洞

• https://github.com/DistriNet/timeless-timing-attacks

unfurl：从URL中提取并可视化数据

• https://github.com/obsidianforensics/unfurl

[技术]

恶意代码逆向手册

• https://ccdcoe.org/uploads/2020/07/Malware_Reverse_Engineering_Handbook.pdf

离线解密用于内部密码管理的综合解决方案Thycotic Secret Server（TSS）

• https://www.trustedsec.com/blog/thycotic-secret-server-offline-decryption-methodology

关于x86 / x64二进制反汇编的所有您想知道但都不敢问的内容，

• https://arxiv.org/abs/2007.14266

破解Zoom私人会议密码

• https://www.tomanthony.co.uk/blog/zoom-security-exploit-crack-private-meeting-passwords/

20200729

[资讯]

德国最大的私人多服务提供商Dussmann集团被Nefilim勒索软件攻击，攻击者共窃取了16,805个公司的文件，第一个文件大小约为15.7 GB，其中包括公司的索偿解决文件、强制抵押抵押文件、法律合同、合作和项目协议等

• https://cybleinc.com/2020/07/28/nefilim-ransomware-operators-allegedly-targeted-the-dussmann-group-germanys-largest-private-multi-service-provider/

世界著名的化妆品品牌Avon因为错误配置的云数据库，导致7 GB以上的数据可被公开访问，包含公司网站和移动网站的API日志，这意味着数据泄露暴露了所有生产服务器信息，包括内部“ OAuth令牌”

• https://www.safetydetectives.com/blog/avon-leak-report/

总部位于以色列的营销视频创建网站Promo发生数据泄露，黑客在论坛上免费发布了包含2200万用户记录的数据库，包括140万个破解的密码

• https://www.bleepingcomputer.com/news/security/promocom-discloses-data-breach-after-22m-user-records-leaked-online/

[漏洞]

绕过OSX TCC框架，无授权访问敏感的用户数据（CVE-2020-9934）

• https://medium.com/@mattshockl/cve-2020-9934-bypassing-the-os-x-transparency-consent-and-control-tcc-framework-for-4e14806f1de8

Google票务系统（Google-GUTS）中的授权绕过

• https://www.ehpus.com/post/authorization-bypass-in-google-s-ticketing-system

盘古团队在MOSEC上演示了iOS中不可修复的Secure Enclave Processor（SEP）芯片漏洞

• https://androidrookies.com/team-pangu-demonstrates-unpatchable-secure-enclave-processor-sep-chip-vulnerability-in-ios/

Kubernetes节点上网络组件kube-proxy的漏洞CVE-2020-8558，可能导致集群被接管

• https://unit42.paloaltonetworks.com/cve-2020-8558/

DELL服务器的iDRAC组件的路径遍历漏洞，可使远程攻击者接管服务器操作

• https://www.dell.com/support/article/pt-pt/sln322125/dsa-2020-128-idrac-local-file-inclusion-vulnerability?lang=en

Wordpress插件wpDiscuz修补了严重的任意文件上传漏洞

• https://www.wordfence.com/blog/2020/07/critical-arbitrary-file-upload-vulnerability-patched-in-wpdiscuz-plugin/

[恶意代码]

检测率很低的针对Docker服务器的恶意软件Doki

• https://www.intezer.com/container-security/watch-your-containers-doki-infecting-docker-servers-in-the-cloud/

卡巴斯基声称，VHD勒索软件背后是朝鲜黑客Lazarus

• https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/

[工具]

pe_tree：以树的形式查看PE文件的内容

• https://github.com/blackberry/pe_tree

intelspy：执行自动化网络侦察扫描

• https://github.com/maldevel/intelspy

lightbulb-framework：用于审计WAF的框架

• https://github.com/portswigger/lightbulb-framework

tiny_tracer_tag_to_cutter：将基于IntelPin的API追踪工具tiny_tracer输出的.tag文件导入到Cutter

• https://github.com/Dump-GUY/tiny_tracer_tag_to_cutter

TrustJack：Windows DLL劫持PoC

• https://github.com/jfmaes/TrustJack

[技术]

抢注和其他针对开源依赖的攻击

• https://blog.phylum.io/malicious-packages-typosquatting-and-other-attacks-against-open-source-dependencies/

使用BürtleinaBoard入侵IoT和RF设备

• https://securityaffairs.co/wordpress/106477/hacking/hacking-iot-rf-devices-burtleinaboard.html

Web缓存投毒详解

• https://blog.detectify.com/2020/07/28/do-you-trust-your-cache-web-cache-poisoning-explained/

使用Ghidra做逆向分析

• https://www.youtube.com/watch?v=d4Pgi5XML8E
• https://www.youtube.com/watch?v=uyWVztMHWtk
• https://www.youtube.com/watch?v=RFG5FuqY0CE
• https://www.youtube.com/watch?v=5QBXNF7FKxM

20200728

[资讯]

黑客从Git分析工具Waydev窃取了Github和Gitlab的OAuth令牌，进而能够访问Waydev公司客户的Github和Gitlab项目。

• https://www.zdnet.com/article/hackers-stole-github-and-gitlab-oauth-tokens-from-git-analytics-firm-waydev/

安卓银行木马Cerberus的源代码在暗网出售，售价10万美金

• https://securityaffairs.co/wordpress/106433/malware/cerberus-android-trojan-auction.html

[漏洞]

使用一个”.terminal”文件实现流行macOS Apps的漏洞利用

• https://medium.com/@metnew/exploiting-popular-macos-apps-with-a-single-terminal-file-f6c2efdfedaa

[恶意代码]

Phobos勒索软件新变种来袭

• https://blog.360totalsecurity.com/en/new-variant-of-phobos-ransomware-is-coming/

APT组织Lazarus在针对macOS平台的攻击中使用的4个不同家族的恶意软件

• https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/

Ensiko：一个有勒索软件功能的Webshell

• https://blog.trendmicro.com/trendlabs-security-intelligence/ensiko-a-webshell-with-ransomware-capabilities/

逆向WooCommerce WordPress信用卡诈骗器(Swiper)

• https://blog.sucuri.net/2020/07/reverse-string-woocommerce-wordpress-credit-card-swiper.html

[工具]

sitedorks：用指定关键词搜索Google, Bing, Yahoo，Yandex等网站

• https://github.com/Zarcolio/sitedorks

[技术]

内存中解码Cobalt Strike Shellcode Beacon实现免杀

• https://shells.systems/in-memory-shellcode-decoding-to-evade-avs/

IDA反编译辅助脚本，FIDL介绍

• https://conference.hitb.org/hitblockdown002/materials/D1T1%20-%20FIDLing%20with%20Decompilers%20-%20Carlos%20Garcia%20Prado%20&%20Ryan%20Warns.pdf

渗透测试中Docker的使用

• https://www.hackingarticles.in/docker-for-pentester-pentesting-framework/

TryHackMe Overpass Writeup

• https://medium.com/bugbountywriteup/tryhackme-overpass-writeup-af945ec29be9

利用Notarized Payloads和Sparkle实现初始访问

• https://posts.specterops.io/sparkling-payloads-a2bd017095c

20200727

[资讯]

黑客组织ShinyHunters泄露了数字银行App Dave的750万用户记录，在暗网可免费下载

• https://cybleinc.com/2020/07/25/around-7-million-user-records-of-dave-com-leaked-on-darknet-for-free/

[漏洞]

挖掘VirtualBox的漏洞

• http://blog.paulch.ru/2020-07-26-hunting-for-bugs-in-virtualbox-first-take.html

[恶意代码]

Crimson远控恶意代码分析

• https://malwr-analysis.com/2020/07/24/crimson-rat-malware-analysis/

OSCP考试报告模板，Markdown格式

• https://github.com/noraj/OSCP-Exam-Report-Template-Markdown

Zero2Auto - CruLoader

• https://0x00sec.org/t/zero2auto-cruloader/22420

[工具]

Search-API-plugin：用于API搜索的IDA插件

• https://github.com/AlyaGomaa/Search-API-plugin

mailpl0it：监控exploit-db的主页，如果发现符合用户提供query的exploit，则通知用户

• https://github.com/bad-bit/mailpl0it   SourceWolf：Response爬虫，在源码中寻找有趣的东西
• https://github.com/micha3lb3n/SourceWolf

autoenum：自动化服务枚举脚本

• https://github.com/Gr1mmie/autoenum

SpaceRunner：编译C#程序，使程序运行任意PowerShell脚本，而无需通过runspace启动PowerShell进程

• https://github.com/Mr-B0b/SpaceRunner

[技术]

HTB：Cascade

• https://chr0x6eos.github.io/2020/07/25/htb-Cascade.html
• https://t3chnocat.com/htb-cascade/

使用android studio绕过客户端授权和泄露用户密码

• https://co0nan.gitbook.io/wirteups/

使用Python进行基于信誉的检测

• https://letsdefend.io/blog/reputation-based-detection-with-python/

Espressif ESP32：使用EMFI绕过安全引导

• https://raelize.com/posts/espressif-systems-esp32-bypassing-sb-using-emfi/

How to create your own Russian bot army

• https://0x00sec.org/t/how-to-create-your-own-russian-bot-army/22370

DNS Rebinding, The treacherous attack it can be

• https://medium.com/bugbountywriteup/dns-rebinding-the-treacherous-attack-it-can-be-b367c61b4372

在Google Home Mini上运行自定义代码（第1部分）

• https://courk.cc/running-custom-code-google-home-mini-part1#running-custom-code-google-home-mini-part1

分析一个Meterpreter的Shellcode实例

• https://trustedsignal.blogspot.com/2020/07/analyzing-instance-of-meterpreters.html

20200724

[资讯]

FortressIQ推出世界上第一个基于学习和自适应计算机视觉的防火墙

• https://securityboulevard.com/2020/07/fortressiq-launches-worlds-first-learning-and-adaptive-computer-vision-based-firewall

[漏洞]

nmap脚本，扫描思科Adaptive Security Appliance和FTD软件中的未授权远程文件读取漏洞（cve-2020-3452）

• https://raw.githubusercontent.com/RootUp/PersonalStuff/master/- http-vuln-cve2020-3452.nse

（Pwn2Own）串联Rockwell FactoryTalk View SE的5个漏洞实现代码执行

• https://www.zerodayinitiative.com/blog/2020/7/22/chaining-5-bugs-for-code-execution-on-the-rockwell-factorytalk-hmi-at-pwn2own-miami

Tor浏览器0Day

• https://www.hackerfactor.com/blog/index.php?/archives/888-Tor-0day-Stopping-Tor-Connections.html

[恶意代码]

新发现的以挖矿为目的的僵尸网络Prometei

• https://blog.talosintelligence.com/2020/07/prometei-botnet-and-its-quest-for-monero.html

勒索软件WastedLocker，通过NTFS的备用数据流（ADS）隐藏

• https://labs.sentinelone.com/wastedlocker-ransomware-abusing-ads-and-ntfs-file-attributes/

[工具]

lazybee：创建用于爆破攻击的独特的wordlist

• https://github.com/noob-hackers/lazybee

cantordust：Ghidra插件，用于二进制可视化，允许人类利用其优越的视觉模式来识别二进制数据中的模式

• https://github.com/Battelle/cantordust

DeimosC2：GoLang编写的C&C框架，用于后渗透

• https://github.com/DeimosC2/DeimosC2

[技术]

漏洞赏金平台如何存储有关黑客的信息？

• https://www.rcesecurity.com/2020/07/Bug-Bounty-Platforms-vs-GDPR-A-Case-Study/

Timeless Timing Attacks: 利用并发性在远程连接上泄漏机密

• https://tom.vg/papers/timeless-timing-attack_usenix2020.pdf

基于内核状态的Fuzzer：一种LLVM方式

• https://github.com/hardenedlinux/harbian-qa/blob/master/syzkaller/kstate_resource.md

DJI GO 4 Android应用程序的隐私评估

• https://blog.grimm-co.com/2020/07/dji-privacy-analysis-validation.html

SSRF资源收集

• https://github.com/jdonsec/AllThingsSSRF

基于深度学习的行为信号融合，用于威胁检测

• https://www.microsoft.com/security/blog/2020/07/23/seeing-the-big-picture-deep-learning-based-fusion-of-behavior-signals-for-threat-detection/

MMS漏洞利用，Part2：对Qmage Codec的有效Fuzzing

• https://googleprojectzero.blogspot.com/2020/07/mms-exploit-part-2-effective-fuzzing-qmage.html

攻击MS Exchange Web接口

• https://swarm.ptsecurity.com/attacking-ms-exchange-web-interfaces/

20200723

[资讯]

Google资助的配送服务Dunzo被攻击，泄露了11GB的数据，包括超过800万行的信息。数据泄露的确切日期尚不清楚，Dunzo也没有透露受影响用户的数量。信息字段包括：用户名、国家、设备、全名、秘密密钥、电子邮件地址、密码散列 、电话号码、令牌号码、加入日期、第一个/最后一个位置等

• https://www.hackread.com/google-delivery-service-dunzo-hacked-data-leaked/

[漏洞]

AVAST SecureLine VPN任意文件创建漏洞

• https://nafiez.github.io/security/arbitrary%20file/eop/2020/07/21/avast-secureline-vpn-arb-file-eop.html

Citrix Workspace在SYSTEM账户下的远程命令执行漏洞（CVE-2020-8207）

• https://www.pentestpartners.com/security-blog/raining-system-shells-with-citrix-workspace-app/

Roundcube webmail App存储型XSS漏洞（CVE-2020-15562）

• https://ssd-disclosure.com/ssd-advisory-roundcube-incoming-emails-stored-xss/

在使用推荐的浏览器扩展时，Azure AD个人帐户认证令牌可能泄露给恶意网站（CVE-2019-1172）

• https://clement.notin.org/blog/2020/07/22/cve-2019-1172-disclosure-of-azure-ad-personal-account-auth-token-to-malicious-websites-when-using-the-recommended-browser-extension-1/
• https://clement.notin.org/blog/2020/07/22/cve-2019-1172-disclosure-of-azure-ad-personal-account-auth-token-to-malicious-websites-when-using-the-recommended-browser-extension-2/

CVE-2020-6287-exploit

• https://github.com/duc-nt/CVE-2020-6287-exploit

[恶意代码]

用户友好的加载器和加密程序，简化了入侵和恶意软件的投递

• https://www.recordedfuture.com/user-friendly-loaders-crypters/

MATA恶意软件框架，模块化，针对多个平台

• https://securelist.com/mata-multi-platform-targeted-malware-framework/97746/

针对Maze勒索软件的深入研究

• https://labs.sentinelone.com/enter-the-maze-demystifying-an-affiliate-involved-in-maze-snow/

OilRig瞄准了中东电信组织，使用带有隐写术的新型C&C通道

• https://unit42.paloaltonetworks.com/oilrig-novel-c2-channel-steganography/

[工具]

bddisasm：快速、轻量级的指令解码器，还包括一个专门检测类似shellcode代码行为的指令仿真器

• https://github.com/bitdefender/bddisasm

ADB-Toolkit：Android设备测试工具

• https://github.com/ASHWIN990/ADB-Toolkit

dazzleUP：检测Windows操作系统中由于配置错误和缺少更新而引起的提权漏洞

• https://github.com/hlldz/dazzleUP

tugarecon：快速子域名枚举工具

• https://github.com/LordNeoStark/tugarecon

fawkes：针对面部识别的隐私保护工具

• https://github.com/Shawn-Shan/fawkes
• http://sandlab.cs.uchicago.edu/fawkes/#code

avain：模块化框架，用于在基于IP的网络中做自动化漏洞分析

• https://github.com/ra1nb0rn/avain

depthcharge：使用U-Boot bootloader对嵌入式平台进行安全研究和“越狱”的工具包

• https://github.com/nccgroup/depthcharge
• https://research.nccgroup.com/2020/07/22/depthcharge/

RustScan：快速查找开放端口，然后自动运行nmap扫描端口。将17分钟的nmap扫描缩短到19秒

• https://github.com/brandonskerritt/RustScan

[技术]

HTML注入完全指南

• https://www.hackingarticles.in/comprehensive-guide-on-html-injection/

NMap网络映射介绍

• https://www.youtube.com/watch?v=_mHwudEOt8c

横向渗透：服务

• https://pentestlab.blog/2020/07/21/lateral-movement-services/

harbian-qa：基于状态的目标定向Fuzzing系统，基于syzkaller

• https://github.com/hardenedlinux/harbian-qa/blob/master/syzkaller/design_inplementation_intro.md

使用Ghidra、Jupyter Notebook和Graphframes扩展Windows RPC方法调用其他函数的漏洞利用与分析

• https://medium.com/threat-hunters-forge/extending-the-exploration-and-analysis-of-windows-rpc-methods-calling-other-functions-with-ghidra-e4cdaa9555bd

我是如何攻击到Telecom网络的，Part4：获取CDR、SS7应用和VLR的访问

• https://medium.com/@TheCyb3rAlpha/how-i-hacked-into-a-telecom-network-part-4-getting-access-to-cdrs-ss7-applications-vlrs-9a8cf95e2648

解密DLINK专有固件映像

• https://nstarke.github.io/0036-decrypting-dlink-proprietary-firmware-images.html

扩展Hex-Rays反编译器，支持Intel AVX指令

• https://blog.ret2.io/2020/07/22/ida-pro-avx-decompiler/

Ruby Sanitize <5.2.1中的HTML消毒(sanitization)绕过

• https://research.securitum.com/html-sanitization-bypass-in-ruby-sanitize-5-2-1/

20200722

[资讯]

美国的软件公司MacKiev因为ElasticSearch服务器错误配置，导致25GB的数据泄漏，大约有60,000用户受影响。泄漏的数据包括敏感的用户详细信息

• https://www.wizcase.com/blog/mackiev-leak-research/

研究人员偶然发现了五个电子学习网站，因为配置错误和不安全的服务器，泄露了将近100万用户（包括未成年人）的个人信息

• https://www.wizcase.com/blog/educational-breaches-research/

英国服装品牌Regatta被NetWalker勒索软件攻击，攻击者发布了窃取数据的样例，其中包括供应商的银行详细信息、银行对帐单、公司的会计凭证、客户的详细信息等等

• https://cybleinc.com/2020/07/21/leading-apparel-brand-of-europe-regatta-allegedly-struck-by-netwalker/

[漏洞]

IBM WebSphere应用程序服务器的2个漏洞，滥用Java远程协议实现RCE和信息泄露

• https://www.zerodayinitiative.com/blog/2020/7/20/abusing-java-remote-protocols-in-ibm-websphere

[工具]

peniot：针对IoT设备的渗透工具

• https://github.com/yakuza8/peniot

[技术]

逆向博世的FlexiDome摄像机固件

• https://www.anvilventures.com/blog/unpacking-bosch-surveillance-camera-firmware.html

测试移动应用程序的SSL Pinning

• https://medium.com/@david.arteaga/testing-ssl-pinning-in-a-mobile-application-2dcac9ab3d0c

Azure AD SSO中，主刷新令牌的滥用

• https://dirkjanm.io/abusing-azure-ad-sso-with-the-primary-refresh-token/

[其他]

Crowdstrike发布的网络前线报告：从2019年事件响应和主动服务的前线获得的观察结果，以及对2020年至关重要的见解

• https://www.crowdstrike.com/resources/reports/crowdstrike-services-cyber-front-lines-2020/

20200721

[资讯]

阿根廷最大的互联网服务提供商之一遭到REVil勒索软件攻击，大约有18,000台计算机被感染，攻击者勒索750万美元赎金

• https://securityaffairs.co/wordpress/106147/cyber-crime/telecom-argentina-revil-ransomware.html

[漏洞]

Fastjson：特殊的反序列化漏洞

• https://www.alphabot.com/security/blog/2020/java/Fastjson-exceptional-deserialization-vulnerabilities.html

从零开始编写iOS内核Exploit

• https://secfault-security.com/blog/chain3.html

针对SharePoint Server的攻击中滥用DataSet实现RCE

• https://srcincite.io/blog/2020/07/20/sharepoint-and-pwn-remote-code-execution-against-sharepoint-server-abusing-dataset.html

Mail.ru 的DOM XSS漏洞的故事

• https://medium.com/bugbountywriteup/the-1-000-worth-cookie-6cf48af08e08

[恶意代码]

新发现的银行木马BlackRock

• https://www.threatfabric.com/blogs/blackrock_the_trojan_that_wanted_to_get_them_all.html

针对mac平台的伪装成加密货币交易软件的木马

• https://www.welivesecurity.com/2020/07/16/mac-cryptocurrency-trading-application-rebranded-bundled-malware/

[工具]

weizz-fuzzer：对结构化二进制格式的自动化灰盒Fuzzing

• https://github.com/andreafioraldi/weizz-fuzzer

[技术]

GLibc 2.32中引入的Safe-Linking机制分析，以及绕过方式

• https://awaraucom.wordpress.com/2020/07/19/house-of-io-remastered/?repost

自动重写Meterpreter的70万行代码库，实现免杀，Part2：如何手动隐藏二进制文件中的API导入，然后自动化对每个C/C++编写软件执行此过程

• https://blog.scrt.ch/2020/07/15/engineering-antivirus-evasion-part-ii/

使用JavaScript检测虚拟机

• https://www.youtube.com/watch?v=_eTCtl7JGZo&feature=youtu.be

使用IP对手机进行地理定位

• https://nixintel.info/osint/geolocating-mobile-phones-with-an-ip/

评估为Windows内核启用SMAP的可行性

• https://github.com/microsoft/MSRC-Security-Research/blob/master/papers/2020/Evaluating%20the%20feasibility%20of%20enabling%20SMAP%20for%20the%20Windows%20kernel.pdf

在macOS上进行低级别进程Hunting：了解复杂的父/子进程关系

• https://objective-see.com/blog/blog_0x4A.html

证书透明度：鸟瞰图

• https://emilymstark.com/2020/07/20/certificate-transparency-a-birds-eye-view.html

Win10商店的wsreset.exe可以被利用删除主机上的任意文件，进而实现免杀

• http://daniels-it-blog.blogspot.com/2020/07/arbitrary-file-delete-via-wsresetexe.html

20200720

[资讯]

研究人员发现一个公开的数据库，其中包括7个声称不记录日志的VPN品牌的用户数据，涉及VPN品牌：UFO VPN, FAST VPN, Free VPN, Super VPN, Flash VPN, Secure VPN, 和Rabbit VPN，泄露数据共1.2TB

• https://www.vpnmentor.com/blog/report-free-vpns-leak/

法国电信公司Orange确认遭受勒索软件攻击，泄露了20个企业客户的数据

• https://www.bleepingcomputer.com/news/security/orange-confirms-ransomware-attack-exposing-business-customers-data/

[漏洞]

MMS漏洞利用，Part1：三星Qmage编解码器和远程攻击面介绍

• https://googleprojectzero.blogspot.com/2020/07/mms-exploit-part-1-introduction-to-qmage.html

Nexus Repository Manager 3 Java 注入漏洞分析（CVE-2018-16621）

• https://securitylab.github.com/research/bean-validation-RCE

PostMessage漏洞分析，Part2

• https://jlajara.gitlab.io/web/2020/07/17/Dom_XSS_PostMessage_2.html

PoC for CVE-2020-6287, CVE-2020-6286 (SAP RECON vulnerability)

• https://github.com/chipik/SAP_RECON

AvertX IP摄像头发现的3个安全漏洞

• https://unit42.paloaltonetworks.com/avertx-ip-cameras-vulnerabilities/

[恶意代码]

macOS平台恶意软件ThiefQuest的新变种分析

• https://blog.trendmicro.com/trendlabs-security-intelligence/updates-on-thiefquest-the-quickly-evolving-macos-malware

僵尸网络Emotet沉寂5个月后重新开始活跃

• https://blog.malwarebytes.com/trojans/2020/07/long-dreaded-emotet-has-returned/

[工具]

GLORYHook：Linux Hook框架：可以将2个二进制文件融合成1个

• https://github.com/tsarpaul/GLORYHook

ProcMon-for-Linux：Linux版本的Process Monitor，追踪系统调用

• https://github.com/microsoft/ProcMon-for-Linux

revp：反向- http代理，支持Linux，Windows和macOS

• https://github.com/jafarlihi/revp

saferwall：恶意代码分析平台

• https://github.com/saferwall/saferwall

remote_system_forensics：基于- http的Python木马，用于远程系统取证和特权传输

• https://github.com/NimishMishra/networking/tree/master/remote_system_forensics
• https://medium.com/bugbountywriteup/python-- http-based-trojan-for-remote-system-forensics-and-privilege-transfer-ae128891b4de

pentest：Docker镜像，包括用于快速创建渗透环境的工具

• https://github.com/aaaguirrep/pentest

t14m4t：自动化爆破攻击工具

• https://github.com/MS-WEB-BN/t14m4t

klo-gba.js：Klonoa GBA游戏的逆向工具

• https://github.com/macabeus/klo-gba.js

Oralyzer：识别网站的开放重定向漏洞

• https://github.com/0xNanda/Oralyzer

Bramble：Hacking工具包

• https://github.com/marcrowProject/Bramble

[技术]

glibc 2.32安全链接及其绕过概述

• https://smallkirby.hatenablog.com/entry/safeunlinking

Intel 8086处理器的寄存器:从芯片到晶体管

• https://www.righto.com/2020/07/the-intel-8086-processors-registers.html

逆向分析SanDisk高续航时间microSDXC卡

• https://ripitapart.com/2020/07/16/reverse-engineering-and-analysis-of-sandisk-high-endurance-microsdxc-card/

HTB：Sauna

• https://t3chnocat.com/htb-sauna/
• https://medium.com/@sif0/hack-the-box-sauna-write-up-w-covenant-c2-c2d71141c90b

HTB：Sizzle

• https://medium.com/bugbountywriteup/hack-the-box-sizzle-write-up-62f3464701be

How to make SUID Lua scripts not drop privileges

• https://www.elttam.com/blog/lua-suid-shells/

具有角色链管理功能的持久AWS访问

• https://posts.specterops.io/persistent-aws-access-with-role-chain-juggling-9f96acd348e9

使用频率分析识别由计算机算法伪造的图像

• https://www.sciencedaily.com/releases/2020/07/200716101532.htm

Pwned-1: Vulnhub Walkthorugh

• https://www.hackingarticles.in/pwned-1-vulnhub-walkthorugh/

[ExpDev] Vulnserver

• https://medium.com/@bigb0ss/expdev-vulnserver-part-3-24859bd31c0a
• https://medium.com/bugbountywriteup/expdev-vulnserver-part-2-46de4dd7bdde
• https://medium.com/@bigb0ss/expdev-vulnserver-part-1-ba35b9e36478

BlackRose: 1 Vulnhub Walkthrough

• https://www.hackingarticles.in/blackrose-1-vulnhub-walkthrough/

路径遍历完全指南

• https://www.hackingarticles.in/comprehensive-guide-on-path-traversal/

探索MS-DOS存根

• https://osandamalith.com/2020/07/19/exploring-the-ms-dos-stub/

20200717

[资讯]

号称零日志的VPN公司UFO VPN，泄露了超过2000万用户日志

• https://www.comparitech.com/blog/vpn-privacy/ufo-vpn-data-exposure/

总部位于新奥尔良的在线人才招聘机构MyCastingFile.com泄露大约26万用户的个人数据

• https://www.zdnet.com/article/us-actor-casting-company-leaked-private-data-of-over-260000-individuals/

[漏洞]

Windows DNS DoS漏洞（SIGRed）Exploit

• https://github.com/maxpl0it/CVE-2020-1350-DoS

Windows服务器的容器逃逸漏洞

• https://unit42.paloaltonetworks.com/windows-server-containers-vulnerabilities/

PHP编写的开源CMS MicroWeber的未经身份验证导致用户数据库泄露的漏洞（CVE-2020-13405）

• https://rhinosecuritylabs.com/research/microweber-database-disclosure/

测试Ripple20：仔细查看CVE-2020-11898和PoC脚本

• https://blog.nviso.eu/2020/07/16/testing-ripple20-a-closer-look-and-proof-of-concept-script-for-cve-2020-11898/

[恶意代码]

Sodinikibi勒索软件分析

• https://www.pandasecurity.com/mediacenter/pandalabs/sodinikibi-ransomware-report/

[工具]

PhishingKitTracker：用于取证和分析的钓鱼工具包集合

• https://github.com/marcoramilli/PhishingKitTracker

capa：自动化识别可执行文件的功能/能力

• https://github.com/fireeye/capa
• https://www.fireeye.com/blog/threat-research/2020/07/capa-automatically-identify-malware-capabilities.html

[技术]

二进制重写教程：反编译、转换和重链接

• https://grammatech.github.io/gtirb/md_stack-stamp.html

使用MapViewOfFile3 + NtSetInformationProcess实现更加隐蔽的进程注入

• https://splintercod3.blogspot.com/p/weaponizing-mapping-injection-with.html

ActiveDirectory中的gpLink可以被恶意利用

• https://markgamache.blogspot.com/2020/07/exploiting-ad-gplink-for-good-or-evil.html

SQL注入清单

• https://securityboulevard.com/2020/07/sql-injection-cheat-sheet-for-developers

使用Checkra1n和iOS BFU Triage脚本提取iOS完整文件系统，Part1：准备阶段

• https://www.sans.org/blog/checkra1n---part-1---prep/

Cobalt Strike4.1中添加的特性BOF(Beacon Object File)的一些不太明显的限制

• https://www.trustedsec.com/blog/a-developers-introduction-to-beacon-object-files

渗透测试中Azure文件共享的使用

• https://blog.netspi.com/azure-file-shares-for-pentesters/

使用Azure Pipelines验证我的Sysmon配置

• https://medium.com/falconforce/using-azure-pipelines-to-validate-my-sysmon-configuration-48315dba7571

QUIC-based UDP Transport for Secure Shell (SSH)

• https://datatracker.ietf.org/doc/draft-bider-ssh-quic/

20200716

[资讯]

新西兰财产管理公司因为不安全的Amazon S3 bucket，泄露了30,000位用户的个人数据，包括护照、驾驶执照和年龄证明文件等

• https://cybernews.com/security/new-zealand-property-management-company-leaks-30000-passports-drivers-licenses/

在线写作平台Wattpad的2.71亿个客户的用户记录可以在英语和俄语的黑客论坛免费获取

• https://cybleinc.com/2020/07/15/wattpad-data-breach-leading-to-the-leak-of-270-million-user-records-one-of-the-largest-data-breaches-ever-recorded-in-the-books-of-history/

印尼在线商店Bhinneka的数据库在黑客论坛发布，包含126万帐户记录

• https://www.hackread.com/indonesia-bhinneka-database-dumped-1-million-accounts/

[漏洞]

RemoteFX中的多个漏洞会影响AMD、英特尔芯片

• https://blog.talosintelligence.com/2020/07/vuln-spotlight-intel-amd-microsoft-july-2020.html

V-SOL家庭路由器上的任意OS命令注入漏洞

• https://www.karansaini.com/os-command-injection-v-sol/

[恶意代码]

Android平台勒索软件CryCryptor分析

• https://www.youtube.com/watch?v=deyBbSKKGk8&feature=youtu.be

[工具]

Sublist3r-Scrap：子域名爬取工具Sublist3r的fork版，支持每个页面的爬取

• https://github.com/pucarasec/Sublist3r-Scrap

Z80Explorer：Zilog Z80网表级仿真器，能够运行Z80机器代码

• https://github.com/gdevic/Z80Explorer
• https://baltazarstudios.com/z80explorer/

access_parser：Python脚本，解析MS Access数据库文件

• https://github.com/ClarotyICS/access_parser

maskprocessor：高性能word生成器，可以为每个位置配置字符集

• https://github.com/hashcat/maskprocessor

[技术]

在Win10上绕过LSA保护

• https://www.redcursor.com.au/blog/bypassing-lsa-protection-aka-protected-process-light-without-mimikatz-on-windows-10
• https://github.com/RedCursorSecurityConsulting/PPLKiller

将树莓派作为渗透测试植入物（Dropbox）

• https://systemoverlord.com/2020/07/14/raspberry-pi-as-a-penetration-testing-implant.html

Git源码仓库渗透测试

• https://www.errno.fr/Attacking_source_repositories

Shaking secrets out of CircleCI builds - insecure configuration and the threat of malicious pull requests

• https://nathandavison.com/blog/shaking-secrets-out-of-circleci-builds

在假冒思科设备中寻找后门

• https://labs.f-secure.com/assets/BlogFiles/2020-07-the-fake-cisco.pdf

使用Frida分析一款国际象棋游戏

• https://cronop-io.github.io/posts/binary%20analysis/2020-06-25-dreamchess_frida/

利用导入的库，绕过WAF

• https://medium.com/bugbountywriteup/exploiting-imported-libraries-to-bypass-cloudflare-waf-7aed99186c5a

攻击检测基础：C&C与数据渗透

• https://labs.f-secure.com/blog/attack-detection-fundamentals-c2-and-exfiltration-lab-1/
• https://labs.f-secure.com/blog/attack-detection-fundamentals-c2-and-exfiltration-lab-2/
• https://labs.f-secure.com/blog/attack-detection-fundamentals-c2-and-exfiltration-lab-3/

20200715

[资讯]

黑客在暗网上出售1.42亿米高梅酒店客人的详细信息，攻击者声称是从泄露的网络安全公司Night Lion的数据中获取的，违规事件发生在2019年夏天

• https://www.zdnet.com/article/a-hacker-is-selling-details-of-142-million-mgm-hotel-guests-on-the-dark-web/

[漏洞]

Windows DNS服务器已存在17年之久的严重RCE漏洞（CVE-2020-1350）

• https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/

Internet Explorer CVE-2019–1367漏洞利用

• https://blog.confiant.com/internet-explorer-cve-2019-1367-exploitation-part-2-8143242b5780
• https://blog.confiant.com/internet-explorer-cve-2019-1367-exploitation-part-3-a92d3011b38

Internet Explorer CVE-2019–1367漏洞发现在野利用

• https://blog.confiant.com/internet-explorer-cve-2019-1367-in-the-wild-exploitation-prelude-ef546f19cd30

SAP NetWeaver AS Java中的严重漏洞（CVE-2020-6287）

• https://us-cert.cisa.gov/ncas/alerts/aa20-195a

Sophos XG - A Tale of the Unfortunate Re-engineering of an N-Day and the Lucky Find of a 0-Day

• https://codewhitesec.blogspot.com/2020/07/sophos-xg-tale-of-unfortunate-re.html

LibreHealth应用程序2.0.0版的5个高危漏洞

• https://labs.bishopfox.com/advisories/librehealth-version-2.0.0-0

[恶意代码]

Android平台聊天应用Welcome Chat被用作间谍App，而且数据存储在可公开访问的服务器中

• https://www.welivesecurity.com/2020/07/14/welcome-chat-secure-messaging-app-nothing-further-truth/

恶意代码Valak的新的攻击活动

• https://securitynews.sonicwall.com/xmlpost/valak-initial-infection/

[工具]

fuzzer：基于ptrace的fuzzer

• https://github.com/marcinguy/fuzzer

padding-oracle-attacker：命令行工具和库，轻松执行padding oracle攻击，支持并发请求

• https://github.com/KishanBagaria/padding-oracle-attacker

[技术]

威胁狩猎中，使用Word2Vec识别异常

• https://blog.nviso.eu/2020/07/14/using-word2vec-to-find-the-word-that-doesnt-belong/

Windows热补丁机制介绍

• https://dev.to/pelock/windows-hot-patching-mechanism-explained-2m1f

将400英镑的BBC Micro（1981）变成40,000美元的光盘刻录机（1987）

• https://scarybeastsecurity.blogspot.com/2020/07/turning-400-bbc-micro-1981-into-40000.html

数据取证，Part2：实时内存获取与分析

• https://www.hackers-arise.com/post/2016/09/27/digital-forensics-part-2-live-memory-acquisition-and-analysis

在已加入Azure AD的计算机上为浏览器SSO请求Azure AD Request Token

• https://posts.specterops.io/requesting-azure-ad-request-tokens-on-azure-ad-joined-machines-for-browser-sso-2b0409caad30

实战安全工程：有状态的检测

• https://www.elastic.co/blog/practical-security-engineering-stateful-detection

使用Excel中的”隐藏”宏进行社会工程

• https://github.com/1d8/macros

在Python Web App中如何防止HTML电子邮件注入

• https://r2c.dev/blog/2020/how-to-prevent-HTML-email-injection-in-python-web-apps/

安全代码审查最佳实践

• https://blog.hackedu.com/secure-code-review-best-practices

20200714

[资讯]

黑客声称从美国网络安全公司Night Lion Security盗窃了8200多个数据库，在暗网中公开了其花费三个月时间窃取大量数据的攻击细节，以及窃取数据库的完整列表

• https://securityaffairs.co/wordpress/105820/data-breach/night-lion-allegedly-hacked.html

在线拍卖网站LiveAuctioneers泄露了340万条用户记录，攻击者在暗网出售泄露数据，包括用户的电子邮件地址、用户名、MD5哈希密码、名称、电话号码、地址、IP地址和社交媒体配置文件等。另外，卖方还说，其中有300万个帐户的密码已解密

• https://cloudsek.com/threatintelligence/3-4-m-liveauctioneers-users-pii-and-cracked-passwords-for-sale-on-data-sharing-forum

[漏洞]

V-SOL OLT中发现多个漏洞

• https://pierrekim.github.io/blog/2020-07-14-v-sol-olt-0day-vulnerabilities.html

[恶意代码]

基于Python编写的恶意代码逐渐增多

• https://www.cyborgsecurity.com/python-malware-on-the-rise/

IRC蠕虫分析，最后一部分

• https://www.youtube.com/watch?v=FAFuSO9oAl0

[工具]

FinDOM-XSS：快速查找潜在的基于DOM的XSS漏洞

• https://github.com/dwisiswant0/findom-xss

SqlClient：.NET编写的MSSQL客户端，可以通过beacon访问数据库数据

• https://github.com/FortyNorthSecurity/SqlClient
• https://fortynorthsecurity.com/blog/sql-client-post/

BurpSuite-Asset_History：Burp扩展，充当被动扫描器，提取scope中的域，从WayBackMachine识别它们的历史url，并在issues部分列出它们

• https://github.com/redhuntlabs/BurpSuite-Asset_History
• https://redhuntlabs.com/blog/asset-history-burp-extension.html

[技术]

DMV 1: VulnHub Capture the Flag (CTF) walkthrough

• https://resources.infosecinstitute.com/dmv-1-vulnhub-capture-the-flag-ctf-walkthrough

如何在图像文件中嵌入秘密数据

• https://blog.nviso.eu/2020/07/13/how-to-embed-secret-data-in-jpeg-files/

从NoSQL注入到服务端JavaScript注入

• https://medium.com/bugbountywriteup/nosql-injection-8732c2140576

10分钟讲清楚DLL注入

• https://www.youtube.com/watch?v=ilRJRkMyzlA

Broken Authentication和会话管理的详尽指南

• https://www.hackingarticles.in/comprehensive-guide-on-broken-authentication-session-management/

操作系统命令注入详尽指南

• https://www.hackingarticles.in/comprehensive-guide-to-os-command-injection/

That loyal MySQL is a rogue one: a tale of a (partially) failed idea

• https://x-c3ll.github.io/posts/rogue-mysqld-steal-net-ntlm/

探讨移动端WebView中使用<iframe>的安全问题，重点是差分上下文漏洞（Differential Context Vulnerabilities）的问题

• https://byte.how/posts/webview-androids-most-convenient-footgun/

Copy pasting the copy-paste adversary for ̶l̶u̶l̶z̶ science.

• https://medium.com/@b1tst0rm/copy-pasting-the-copy-paste-adversary-for-%CC%B6l%CC%B6u%CC%B6l%CC%B6z%CC%B6-science-7e3efecb389d

使用网络扫描数据和自动化进行外部检测

• https://www.fireeye.com/blog/threat-research/2020/07/scandalous-external-detection-using-network-scan-data-and-automation.html

EDR逆向与绕过指南

• http://jackson-t.ca/edr-reversing-evading-01.html

PE加壳工具PEzor的设计与实现

• https://iwantmore.pizza/posts/PEzor.html

密码管理器：可以使用浏览器的内置密码管理工具吗？

• https://www.zdnet.com/article/is-it-ok-to-use-your-browsers-built-in-password-manager/

20200713

[资讯]

来往泰国和马来西亚的4500万游客的旅行记录在暗网出售

• https://cybleinc.com/2020/07/12/records-of-45-million-travelers-to-thailand-and-malaysia-leaked-on-darkweb/

[漏洞]

理解TMUI RCE漏洞CVE-2020-5902的根本原因

• https://research.nccgroup.com/2020/07/12/understanding-the-root-cause-of-f5-networks-k52145254-tmui-rce-vulnerability-cve-2020-5902/

多款主流Web浏览器都存在地址栏伪造漏洞

• https://www.inputzero.io/p/advisory-web-browser-address-bar.html

[恶意代码]

Remcos远控的宏Dropper分析

• https://github.com/1d8/analyses/blob/master/RemcosDocDropper.MD

[工具]

procmon-parser：ProcessMonitor配置文件动态解析与生成，以及读取PML日志文件并转换为Python对象

• https://github.com/eronnen/procmon-parser

hotwax：覆盖导向的二进制Fuzzer，基于Frida Stalker

• https://github.com/meme/hotwax

Citadel：渗透测试脚本收集

• https://github.com/wintrmvte/Citadel

subscraper：侦察工具，扫描javascript文件的子域，然后迭代所有托管在后续子域的javascript文件，枚举给定URL的子域列表

• https://github.com/Cillian-Collins/subscraper

Agamotto：使用轻量级虚拟机检查点加速内核驱动程序的Fuzzing

• https://github.com/securesystemslab/agamotto

sentinel-attack：在Azure Sentinel上快速部署基于Sysmon和MITRE ATT&CK的威胁狩猎系统

• https://github.com/BlueTeamLabs/sentinel-attack

dorkScanner：A typical search engine dork scanner that scrapes search engines with queries that you provide in order to find vulnerable URLs.

• https://github.com/madhavmehndiratta/dorkScanner

viewgen：一个ViewState工具，能够使用泄露的验证密钥或web.config文件生成签名和加密的Payload

• https://github.com/0xacb/viewgen

debotnet：控制Win10许多隐私相关的配置

• https://github.com/builtbybel/debotnet

SharpDllProxy：获取合法DLL的导出表，生成代理DLL的源码/模板，用于DLL代理加载

• https://github.com/Flangvik/SharpDllProxy
• https://redteaming.co.uk/2020/07/12/dll-proxy-loading-your-favorite-c-implant/

Windows平台二进制文件索引

• https://m417z.com/winbindex/
• https://m417z.com/Introducing-Winbindex-the-Windows-Binaries-Index/

[技术]

实战去除驱动程序的混淆

• https://colton1skees.github.io/posts/MutationRemoval.html

高级Windows恶意代码分析：获取内存工件

• https://darungrim.com/research/2020-07-10-windows-malware-analysis-process-artifacts.html

badWPAD攻击：利用暴雪战网客户端进行的（不急于邮件的）鱼叉式网络钓鱼攻击

• https://blog.redteam.pl/2020/07/badwpad-phishing-battle-net.html

如何避免暴露你的内部代理

• https://medium.com/flant-com/stop-exposing-your-internal-proxy-dfdb7e5faff5

云安全会议fwd:cloudsec 2020年会议视频列表

• https://www.youtube.com/playlist?list=PLCPCP1pNWD7OBQvDY7vLCFhxWxok9DITl

HTB：Book

• https://t3chnocat.com/htb-book/

使用AFL-Fuzz对FastCGI进行Fuzzing

• https://medium.com/@omaidfaizyar/fuzzing-fastcgi-an-odyssey-4ffc1c72a732

克隆信用卡只需要一分钟：如何从EMV芯片和非接触式接口截获卡数据，并用于创建新的磁条卡

• https://www.cyberdlab.com/content/dam/cyberdlab/insights/it-only-takes-a-minute-to-clone-a-credit-card-thanks-to-a-50-year-old-problem/It_Only_Takes_a_Minute_to_Clone_a_Credit_Card_%20Thanks_to_a_50_Year_Old_Problem.pdf

利用AMSI提供者实现驻留

• https://b4rtik.github.io/posts/antimalware-scan-interface-provider-for-persistence/

paper_collection：与Fuzzing、二进制分析和漏洞开发相关的论文收集

• https://github.com/0xricksanchez/paper_collection

文件系统MiniFilter Hooking

• https://medium.com/@aviadshamriz/part-1-fs-minifilter-hooking-7e743b042a9d

Impacket的使用与检测

• https://neil-fox.github.io/Impacket-usage-&-detection/

我如何使用IDN Homograph 攻击更改受害者的密码

• https://medium.com/@abhishek.karle92/how-i-was-able-to-change-victims-password-using-idn-homograph-attack-587111843aff

使用Chrome Devtools 提升你的Hacking技巧

• https://www.youtube.com/watch?v=Y1S5s3FmFsI

20200710

[资讯]

印度健康保险公司Religare泄露500万条个人记录

• https://cybleinc.com/2020/07/09/one-of-the-leading-health-insurer-religare-struck-by-hackers-5million-records-at-risk/

[漏洞]

Windows平台下Zoom客户端的RCE 0Day

• https://blog.0patch.com/2020/07/remote-code-execution-vulnerability-in.html

Active Directory漏洞Top16

• https://www.infosecmatter.com/top-16-active-directory-vulnerabilities/

在unc0ver发布iOS 13.5越狱的4小时内，识别越狱使用的0Day

• https://googleprojectzero.blogspot.com/2020/07/how-to-unc0ver-0-day-in-4-hours-or-less.html

Windows cab文件导致的RCE漏洞（CVE-2020-1300）

• https://www.zerodayinitiative.com/blog/2020/7/8/cve-2020-1300-remote-code-execution-through-microsoft-windows-cab-files

Android MX Player 路径遍历漏洞可导致代码执行

• https://medium.com/tenable-techblog/android-mx-player-path-traversal-to-code-execution-9134b623eb34

威图（Rittal）制造商设备的多个严重漏洞

• https://sec-consult.com/en/blog/advisories/multiple-critical-vulnerabilities-in-multiple-rittal-products-based-on-same-software/

[恶意代码]

深入了解黑客组织Evilnum的运作及其使用的工具包

• https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/

勒索软件Conti，有成为Ryuk继任者的迹象

• https://www.bleepingcomputer.com/news/security/conti-ransomware-shows-signs-of-being-ryuks-successor/

Jocker恶意软件是如何再次混进谷歌商店的

• https://research.checkpoint.com/2020/new-joker-variant-hits-google-play-with-an-old-trick/

[工具]

WordListGen：用于Fuzzing和爆破的Wordlist生成器

• https://github.com/frizb/WordListGen

Netenum：以被动方式发现网络上的活跃主机

• https://github.com/wintrmvte/Netenum

slicer：自动化apk recon过程

• https://github.com/mzfr/slicer

SierraTwo：基于Slack的反向Shell

• https://github.com/berkgoksel/SierraTwo

[技术]

高级VBA宏：零命中绕过olevba静态分析

• https://www.certego.net/en/news/advanced-vba-macros/

逆向DexGuard，Part3：代码虚拟化

• https://www.pnfsoftware.com/blog/reversing-dexguard-virtualization/

通过Falcon的实时响应API自动化TrickBot的远程修复

• https://www.crowdstrike.com/blog/automating-remote-remediation-of-trickbot-part-2/

配置Windows域以动态分析混淆的横向移动工具

• https://www.fireeye.com/blog/threat-research/2020/07/configuring-windows-domain-dynamically-analyze-obfuscated-lateral-movement-tool.html

Redirect auction

• https://securelist.com/redirect-auction/96944/

How to Hack Engineers: An “Unknown Knowledge Attack”

• https://dzone.com/articles/the-agency-of-people-or-how-to-hack-engineers-not

20200709

[资讯]

印度众筹平台Impact Guru发生数据泄露，攻击者在暗网出售50万用户记录

• https://cybleinc.com/2020/07/08/impact-guru-indias-leading-crowdfunding-platform-breached-500000-user-records-leaked-in-darkweb/

[漏洞]

在应用程序中使用唯一标识符可能导致的问题

• https://proacksecurity.com/research/insecure-use-of-unique-identifiers/

LoRaWAN 1.0、1.1版中的漏洞和向后兼容性

• https://www.tarlogic.com/en/blog/lorawan-1-0-vulnerabilities-and-backward-compatibility-in-version-1-1/

Citrix ADC RCE漏洞CVE-2019-19781

• https://swarm.ptsecurity.com/remote-code-execution-in-citrix-adc/

IE11 UAF漏洞利用研究（CVE-2020-1062）

• https://www.accenture.com/us-en/blogs/cyber-defense/exploitation-case-study-cve-2020-1062-vulnerability-in-ie11

Bean Stalking: Growing Java beans into RCE

• https://securitylab.github.com/research/bean-validation-RCE

[恶意代码]

APT组织百科全书（436页pdf），数百个黑客组织的资料介绍

• https://www.thaicert.or.th/downloads/files/Threat_Group_Cards_v2.0.pdf

俄罗斯黑客组织Cosmic Lynx的崛起

• https://www.agari.com/cyber-intelligence-research/whitepapers/acid-agari-cosmic-lynx.pdf

NtCreateFile可以创建和访问使用”.”命名的目录，而CreateFile不行。基于此，可以向杀软隐藏目录

• https://github.com/dalvarezperez/CreateFile_based_rootkit/

[工具]

sif：针对CS系统结构的socket注入Fuzzer

• https://github.com/mmmds/sif
• https://logicaltrust.net/blog/2020/07/socketfuzzer.html

[技术]

从曝光到接管：150亿个被盗凭证允许帐户接管

• https://resources.digitalshadows.com/whitepapers-and-reports/from-exposure-to-takeover

DLL搜索路径劫持的武器化与一般发现方式

• https://www.contextis.com/en/blog/dll-search-order-hijacking

pokewalker（一款专为精灵宝可梦和灵魂银游戏设计的设备）逆向

• https://github.com/mamba2410/reverse-pokewalker

Citrix漏洞挖掘历险记

• https://dmaasland.github.io/posts/citrix.html

An offensive guide to the Authorization Code grant

• https://research.nccgroup.com/2020/07/07/an-offensive-guide-to-the-authorization-code-grant/

Windows进程注入：EM_GETHANDLE、WM_PASTE、EM_SETWORDBREAKPROC

• https://modexp.wordpress.com/2020/07/07/wpi-wm-paste/

From Web to Pwn：不带FFI::cdef 或 FFI::load的任意读/写

• http://blog.huntergregal.com/2020/07/from-web-to-pwn-ffi-arbitrary-readwrite.html

Fuzzing Windows API用于免杀

• https://winternl.com/fuzzing-the-windows-api-for-av-evasion/

VBA恶意代码中EnhMetaFileBits和AddPicture的滥用

• https://medium.com/@laughing_mantis/malicious-shapes-in-office-part-2-910375cd05f3

20200708

[资讯]

全球IT服务和解决方案提供商DXC Technology的子公司Xchanging，上周末受到勒索软件攻击

• https://securityaffairs.co/wordpress/105601/hacking/xchanging-ransomware-attack.html

[漏洞]

Parity Substrate区块链框架FRAME运行时中一个简单漏洞，该漏洞使攻击者无需支付任何额外费用即可进行无限大的交易

• https://mudit.blog/free-blockchain-storage-bug-substrate/

Metasploit添加Spring云配置服务器路径遍历漏洞利用模块（cve-2020-5410）

• https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/- http/springcloud_directory_traversal.rb

BullGuard杀软的在线防护功能的多个漏洞

• https://palant.info/2020/07/06/dismantling-bullguard-antivirus-online-protection/

MIcrosoft-Word-Use-After-Free

• https://github.com/whiteHat001/MIcrosoft-Word-Use-After-Free

PlayStation 4 UAF漏洞，可导致任意内核读写

• https://hackerone.com/reports/826026

CDATA OLT中发现多个漏洞

• https://pierrekim.github.io/blog/2020-07-07-cdata-olt-0day-vulnerabilities.html

MikroTik RouterOS的3个内存崩溃漏洞和1个除零漏洞

• https://seclists.org/fulldisclosure/2020/Jul/6

[恶意代码]

谷歌商店发现的银行木马Cerberus

• https://blog.avast.com/avast-finds-banking-trojan-cerberus-on-google-play-avast

Lampion木马新版本在葡萄牙传播，VBS下载功能有改进

• https://seguranca-informatica.pt/new-release-of-lampion-trojan-spreads-in-portugal-with-some-improvements-on-the-vbs-downloader/#.XwT6kigzZU9

Try2Cry勒索软件，通过USB闪存驱动器进行传播

• https://www.gdatasoftware.com/blog/2020/07/36200-ransomware-tries-to-worm

[工具]

leakdb：构建和部署自己的内部类似"Have I Been Pwned"的服务

• https://github.com/moloch--/leakdb

Airshare：局域网内容共享工具。Python编写的命令行工具

• https://github.com/KuroLabs/Airshare

[技术]

BattlEye客户端仿真：无需安装BattlEye即可在线玩任何受BattlEye保护的游戏

• https://secret.club/2020/07/06/bottleye.html
• https://github.com/thesecretclub/bottleye

在无文件攻击中，攻击者如何使用LOLBins

• https://www.sentinelone.com/blog/how-do-attackers-use-lolbins-in-fileless-attacks/

如何编写用于CSRF攻击的网站

• https://medium.com/bugbountywriteup/how-to-write-a-csrf-website-be09801315c3

20200707

[漏洞]

Metasploit添加F5 BIG-IP TMUI路径遍历和文件上传RCE漏洞的模块（CVE-2020-5902）

• rapid7/metasploit-framework#13807

F5 Big-IP CVE-2020-5902 exp

• https://github.com/dunderhay/CVE-2020-5902

[恶意代码]

分析Android银行木马EventBot

• https://youtu.be/qqwOrLR2rgU

漏洞利用工具包Purple Fox添加了两个针对Microsoft漏洞的利用程序

• https://www.proofpoint.com/us/blog/threat-insight/purple-fox-ek-adds-exploits-cve-2020-0674-and-cve-2019-1458-its-arsenal

至少一年来，来自朝鲜的黑客一直在窃取美国和欧洲大型零售商客户的支付卡信息

• https://sansec.io/research/north-korea-magecart

针对asp.net网站的信用卡诈骗

• https://blog.malwarebytes.com/threat-analysis/2020/07/credit-card-skimmer-targets-asp-net-sites/

智能手机广告软件研究报告

• https://securelist.com/pig-in-a-poke-smartphone-adware/97607/

[工具]

NSE脚本，快速扫描F5 BIG-IP TMUI远程代码执行漏洞CVE-2020-5902（CVE-2020-0674/CVE-2019-1458）

• https://github.com/RootUp/PersonalStuff/blob/master/- http-vuln-cve2020-5902.nse

ssti-payloads：服务端模板注入的Payload

• https://github.com/payloadbox/ssti-payloads

SNOWCRASH：Payload生成器，将指定Payload嵌入单独polyglot模板中，生成新的平台独立的Payload

• https://github.com/wintrmvte/SNOWCRASH

delator：利用证书透明度日志挖掘子域名的工具

• https://github.com/netevert/delator

[技术]

使用Frida逆向Nike Run Club Android App

• https://yasoob.me/posts/reverse-engineering-nike-run-club-using-frida-android/

分析USB控制器的固件

• https://8051enthusiast.github.io/2020/04/14/001-USB_Firmware.html

通过机器学习使威胁情报自动化：从地下讨论和OSINT中提取基本概念

• https://delvesecurity.com/automating-threat-intel-with-machine-learning-extracting-the-underlying-concepts-from-underground-discussions-and-osint/

破解D-Link DIR3060固件加密：解密例程静态分析-第2.1部分

• https://0x00sec.org/t/breaking-the-d-link-dir3060-firmware-encryption-static-analysis-of-the-decryption-routine-part-2-1/22099

Web App的竞态条件漏洞

• https://blog.pucarasec.com/2020/07/06/web-application-race-conditions-its-not-just-for-binaries/

Windows系统可以用作间接命令执行的二进制文件收集

• https://pentestlab.blog/2020/07/06/indirect-command-execution/

您所有的SPF都属于我们：通过全球范围的SPF挖掘来探索信任关系

• https://medium.com/@jason_trost/all-your-spf-are-belong-to-us-exploring-trust-relationships-through-global-scale-spf-mining-a666c7a7d368

Utilizing RPC Telemetry

• https://posts.specterops.io/utilizing-rpc-telemetry-7af9ea08a1d5

本地文件包含（LFI）全面指南

• https://www.hackingarticles.in/comprehensive-guide-to-local-file-inclusion/

滥用Shape Data，存储要在VBA中执行的命令

• https://medium.com/@laughing_mantis/malicious-shapes-in-office-part-1-8a4efca74358

A Concurrency Cost Hierarchy

• https://travisdowns.github.io/blog/2020/07/06/concurrency-costs.html

20200706

[资讯]

研究人员发现5个约会应用程序的数据库，因为配置错误可以公开访问。涉及数百万用户数据，包括敏感信息和机密信息，例如真实姓名，账单地址，电子邮件地址，电话号码，私人消息等

• https://www.wizcase.com/blog/dating-breaches-research/

[漏洞]

BIG-IP TMUI（Traffic Management User Interface）RCE漏洞（CVE-2020-5902）

• https://support.f5.com/csp/article/K52145254?sf235665517=1
• https://github.com/jas502n/CVE-2020-5902/

一家数据中心的CORS错误配置导致账户接管和敏感数据泄露的漏洞

• https://lutfumertceylan.com.tr/posts/ato-and-data-leakage-via-cors-misc/

谷歌Chrome PDFium Javascript Regexp内存崩溃漏洞

• https://talosintelligence.com/vulnerability_reports/TALOS-2020-1044

在后台使用Moodle作为LMS的电子学习应用程序的SQL注入漏洞

• https://medium.com/bugbountywriteup/moodle-lms-sql-injection-using-unicode-characters-fe01232f2727

[工具]

hackingtool：多合一Hacking工具

• https://github.com/Z4nzu/hackingtool

ShellGen：反向Shellcode生成器

• https://github.com/thejoker3000/ShellGen

VTIL-BinaryNinja：Binary Ninja插件，分析VTIL代码（虚拟化代码）

• https://github.com/vtil-project/VTIL-BinaryNinja

dyld-shared-cache-big-sur：修改了苹果的dyld项目，修正了从macOS Big Sur中提取dyld_shared_cache时的Objective-C信息，帮助Hopper生成可读的伪代码

• https://github.com/antons/dyld-shared-cache-big-sur

ARMRef：ARM汇编参考手册，可安装在iOS, iPadOS, macOS系统

• https://github.com/evilpenguin/ARMRef

Leonidas：在云端进行自动化的攻击模拟，可使用YAML格式定义攻击者使用的TTP和关联的检测属性

• https://github.com/fsecurelabs/leonidas

GoGhost：高性能、轻量级、便携式、大规模SMBGhost扫描器

• https://github.com/deepsecurity-pe/GoGhost

OnionIngestor：收集、抓取和监测洋葱网站，在Elasticsearch中索引收集的信息。可扩展

• https://github.com/danieleperera/OnionIngestor

[技术]

加密软件Boxcryptor代码审计

• https://research.kudelskisecurity.com/2020/07/03/code-audit-of-boxcryptor/

JS引擎V8深入解析

• https://blog.appsignal.com/2020/07/01/a-deep-dive-into-v8.html

Microsoft为消除Windows中未初始化的内核池内存漏洞所做的工作

• https://msrc-blog.microsoft.com/2020/07/02/solving-uninitialized-kernel-pool-memory-on-windows/

恶意代码逆向，Part4：Windows Internals

• https://www.hackers-arise.com/post/2017/07/04/reverse-engineering-malware-part-4-windows-internals

使用VBScript与物理隔绝主机通信

• https://medium.com/@laughing_mantis/abusing-vba-for-air-gap-communications-4046c6b5b561
• https://gist.github.com/glinares/65e0b1a7ec8338f1cd807be22a33e87a

Windows中的硬件断点与异常

• https://ling.re/hardware-breakpoints/

Linux 10年安全报告

• https://grsecurity.net/10_years_of_linux_security.pdf

在不使用Cookie的情况下，使用ETag追踪未登陆用户

• https://levelup.gitconnected.com/no-cookies-no-problem-using-etags-for-user-tracking-3e745544176b

HTB：ForwardSlash

• https://t3chnocat.com/htb-forwardslash/

DexGuard逆向，Part2：资产与代码加密

• https://www.pnfsoftware.com/blog/reversing-dexguard-encryption/

ATM Hacking历险记

• https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/adventures-in-atm-hacking/

使用递归神经网络检测Windows事件的安全性

• https://medium.com/@ditrizna/security-detections-on-windows-events-with-recurrent-neural-networks-346d0b2738fe

20200703

[资讯]

总部位于拉斯维加斯的健身品牌V Shred，因为不安全的AWS S3 Bucket泄露了超过99,000名客户和培训师的个人身份信息。存储桶于5月14日发现，包含130万个文件，总计606GB数据，其中有3个csv文件，分别包含潜在客户生成列表、客户电子邮件列表和培训师列表。其他数据包括用户的一些敏感照片等

• https://www.vpnmentor.com/blog/report-vshred-breach/

自2005年至今，美国学校共发生1,327次数据泄露，一共2,450万条记录

• https://www.comparitech.com/blog/vpn-privacy/us-schools-data-breaches/

Maze勒索软件攻击了印度国家公路管理局（NHAI），在暗网发布了泄露数据的5%，主要是敏感的公司运营文件，例如公司的员工名单、NHAI前董事长的护照副本、NHAI雇员的受养家庭成员的详细信息、NHAI内部审计报告等等。不过，NHAI对外发布公告成，在发生攻击时由于及时关闭了邮件服务器，所以并没有发生数据泄露。

• https://cybleinc.com/2020/07/02/maze-ransomware-operators-allegedly-targeted-national-highways-authority-of-india-nhai-data-leak/

[漏洞]

思科小型企业路由器Web管理界面的XSS漏洞（CVE-2020-3431）

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sa-rv-routers-xss-K7Z5U6q3

Mozilla Firefox URL mPath信息泄露漏洞

• https://talosintelligence.com/vulnerability_reports/TALOS-2020-1088

Apache流行的远程桌面网关Apache Guacamole中的严重漏洞

• https://research.checkpoint.com/2020/apache-guacamole-rce/

macOS安装程序本地根权限升级(CVE-2020-9817)

• https://research.nccgroup.com/2020/07/02/technical-advisory-macos-installer-local-root-privilege-escalation-cve-2020-9817/

Zimbra上的SSRF漏洞导致以明文形式转储所有凭据

• https://medium.com/bugbountywriteup/story-of-a-2-5k-bounty-ssrf-on-zimbra-led-to-dump-all-credentials-in-clear-text-6fe826005ccc

Windows Telemetry服务提权漏洞

• https://secret.club/2020/07/01/diagtrack.html

Telia路由器的多个漏洞可导致运行任意代码和获取Root权限

• https://full-disclosure.eu/reports/2019/FDEU-CVE-2019-10222-telia-savitarna-backdoor.html

[恶意代码]

针对工控系统的EKANS勒索软件

• https://www.fortinet.com/blog/threat-research/ekans-ransomware-targeting-ot-ics-systems

Thanos勒索软件的功能更新，添加RIPlace免杀技术等

• https://labs.sentinelone.com/thanos-ransomware-riplace-bootlocker-and-more-added-to-feature-set/

[工具]

KITT-Lite：Python编写的渗透框架

• https://github.com/Cisc0-gif/KITT-Lite

bof：在Visual Studio中构建Cobalt Strike BOF2的模板项目

• https://github.com/nccgroup/nccfsas/tree/main/Tools/bof-vs-template

SpoolSystem：Cobalt Strike的CAN脚本，使用Print Spooler命名管道模拟技术获取SYSTEM权限

• https://github.com/nccgroup/nccfsas/tree/main/Tools/spoolsystem

[技术]

DDoS解释：分布式拒绝服务攻击正变得越来越普遍和强大

• https://www.csoonline.com/article/3222095/ddos-explained-how-denial-of-service-attacks-are-evolving.html

PANGOLIN：增量混合模糊测试与多面体路径抽象

• https://qingkaishi.github.io/public_pdfs/SP2020.pdf

通过Miasm学习符号执行

• https://sudhackar.github.io/blog/learning-symbolic-execution-with-miasm

检测.NET Core滥用自定义垃圾回收器的逃逸行为

• https://pentestlaboratories.com/2020/07/02/net-core-evasion-detection/

使用Azure Sentinel检测横向移动

• https://zolder.io/2020/07/01/using-a-firewall-and-sentinel-to-detect-lateral-movement/?a=q

拦截并挽回价值5,000美元的网络钓鱼密码

• https://medium.com/mycrypto/intercepting-and-saving-5-000-worth-of-phished-crypto-9d2d6db6c527

滥用谷歌地图API密钥

• https://medium.com/bugbountywriteup/exploiting-google-maps-api-keys-for-profit-3903dd2c829c

S3 Bucket的访问控制配置错误导致的严重漏洞

• https://medium.com/bugbountywriteup/s3-bucket-misconfigured-access-controls-to-critical-vulnerability-6b535e3df9a5

深入解析三星TrustZone，Part3

• https://blog.quarkslab.com/a-deep-dive-into-samsungs-trustzone-part-3.html

Windows平台的LOLBin添加新成员desktopimgdownldr.exe，可以作为certutil的备选，用于下载任意文件

• https://labs.sentinelone.com/living-off-windows-land-a-new-native-file-downldr/

通过XSS窃取邮件对话，mail.ru和myMail iOS应用程序中的联系人的故事

• https://medium.com/@kminthein/story-of-stealing-mail-conversation-contacts-in-mail-ru-and-mymail-ios-applications-via-xss-1e49c4ed560

20200702

[资讯]

Maze勒索软件最新受害者施乐公司，攻击者对其文件加密并勒索赎金。施乐公司在《财富》 500强榜单中排名第347位

• https://cybleinc.com/2020/07/01/xerox-corporation-allegedly-struck-by-maze-ransomware-data-encrypted/

[漏洞]

Palo Alto Global Protect客户端的authentication_cookie值允许处于MiTM位置的攻击者劫持会话，并获得对VPN网络的访问

• https://medium.com/@real_bitmap/cve-2020-2033-palo-alto-global-protect-remote-session-hijack-8bffc8a2827f

重新审视一个影响Citrix NetScaler / ADC的远程执行代码漏洞(CVE-2019-19781)

• https://blog.fox-it.com/2020/07/01/a-second-look-at-cve-2019-19781-citrix-netscaler-adc/

macOS隐私保护绕过

• https://lapcatsoftware.com/articles/disclosure2.html

DisplayLink USB图形软件任意文件写入漏洞可导致特权提升

• https://offsec.almond.consulting/displaylink-usb-graphics-arbitrary-file-write-eop.html

[恶意代码]

通过盗版传播的新Mac勒索软件

• https://blog.malwarebytes.com/mac/2020/06/new-mac-ransomware-spreading-through-piracy/

TrickBot恶意软件现在检查屏幕分辨率以逃避分析

• https://www.bleepingcomputer.com/news/security/trickbot-malware-now-checks-screen-resolution-to-evade-analysis/

Alina恶意软件正在使用DNS隧道来窃取支付卡数据

• https://blog.centurylink.com/alina-point-of-sale-malware-still-lurking-in-dns/

[工具]

detection-rules：Elastic安全检测引擎的规则

• https://github.com/elastic/detection-rules
• https://www.elastic.co/blog/elastic-security-opens-public-detection-rules-repo

speedlify：持续地测量站点的性能

• https://github.com/zachleat/speedlify
• https://www.zachleat.com/web/speedlify/

basecrack：可以解码所有字母数字基编码方案的Python脚本

• https://github.com/mufeedvh/basecrack

C&C框架SharpC2的CoreAgentModule模块介绍

• https://www.youtube.com/watch?v=gb_baprYC0Q

GhostShell：能够绕过杀软、虚拟机、沙箱的恶意代码

• https://github.com/jakuta-tech/GhostShell

ida-cmake：CMake编译脚本一个Python脚本，用于轻松编译用于Windows、macOS和Linux的C++ IDA插件

• https://github.com/Jinmo/ida-cmake

efiXplorer：IDA插件，用于UEFI固件分析和逆向自动化

• https://github.com/binarly-io/efiXplorer

degoogle：搜索谷歌并直接提取结果。跳过所有的点击链接和其他概略

• https://github.com/deepseagirl/degoogle

[技术]

渗透测试中在Kali Linux上使用PowerShell

• https://www.offensive-security.com/offsec/kali-linux-powershell-pentesting/

逆向Cellebrite的通用取证设备（UFED），挖掘漏洞

• https://blog.korelogic.com/blog/2020/06/29/cellebrite_good_times_come_on

银行的网络情报评估清单

• https://medium.com/@Bank_Security/banks-cyber-intelligence-assessment-8c63247ec342

恢复旧的AMSI绕过技术

• https://sensepost.com/blog/2020/resurrecting-an-old-amsi-bypass/

嵌入式系统安全与TrustZone

• https://embeddedsecurity.io/

对Android通信库Ok- http在重定向到第三方域期间保留身份验证标头行为的讨论

• https://medium.com/bugbountywriteup/are-you-sure-that-youre-not-leaking-user-s-access-tokens-to-third-parties-da16d63faaf4

Mobile IoT modules vulnerable to FOTA updates backdooring at scale

• https://penthertz.com/blog/mobile-iot-modules-FOTA-backdooring-at-scale.html

防御源自Tor的恶意网络活动

• https://www.us-cert.gov/ncas/alerts/aa20-183a

Find more bugs by detecting failure better: An introduction to SanitizerProcessMonitorAgent

• https://www.synopsys.com/blogs/software-security/fuzzing-agent-instrumentation-framework/

20200701

[漏洞]

VPN SDK (anchorFree)一个SYSTEM级别的代码执行漏洞（CVE-2020-12828）

• https://0xsha.io/posts/zombievpn-breaking-that-internet-security

一个Envoy堆漏洞的利用

• https://blog.envoyproxy.io/exploiting-an-envoy-heap-vulnerability-96173d41792

libalias中的一个漏洞同时存在于VirtualBox和FreeBSD中（CVE-2020-7454）

• https://www.zerodayinitiative.com/blog/2020/6/29/cve-2020-7454-killing-two-systems-with-one-bug-in-libalias

[恶意代码]

新发现的针对macOS平台的勒索软件OSX.EvilQuest

• https://objective-see.com/blog/blog_0x59.html

[工具]

• http Toolkit工具包，可以拦截/查看所有Android - http(S)流量，模拟终端或整个服务器，重写、重定向或注入错误
• https://- httptoolkit.tech/android

kube-bench：检查Kubernetes部署是否遵守了CIS Kubernetes基准中定义的安全最佳实践

• https://github.com/aquasecurity/kube-bench

SponsorMonitor：监控Github Sponsors，并自动将他们添加/删除到Github组织团队

• https://github.com/byt3bl33d3r/SponsorMonitor

puff：Simple clientside vulnerability fuzzer, powered by puppeteer.

• https://github.com/FlameOfIgnis/puff

[技术]

绕过CrowdStrike端点检测和响应

• https://www.redcursor.com.au/blog/bypassing-crowdstrike-endpoint-detection-and-response

SAP日志与Splunk SIEM如何集成

• https://www.wallsec.de/blog/siem-your-sap-security-audit-log-with-splunk

如何在SSH连接中使用FIDO2 USB身份验证密钥

• https://www.stavros.io/posts/u2f-fido2-with-ssh/

使用pe-afl对LNK文件格式进行模糊测试

• https://ezqelusia.blogspot.com/2020/06/some-dos-bugs-while-processing.html

使用Meltdown泄漏某些特定的内核数据，并破坏最新的Windows版本KASLR，尽管引入了KVA Shadow机制来缓解Meltdown

• https://labs.bluefrostsecurity.de/blog/2020/06/30/meltdown-reloaded-breaking-windows-kaslr/
• https://github.com/bluefrostsecurity/Meltdown-KVA-Shadow-Leak

Android11中的系统加固

• https://android-developers.googleblog.com/2020/06/system-hardening-in-android-11.html

自动化发现Windows DLL劫持

• https://posts.specterops.io/automating-dll-hijack-discovery-81c4295904b0

Ghidra逆向教程

• https://www.youtube.com/watch?v=rblRVBd2Xws

对IoT设备的- httpS流量进行中间人攻击的3种方式

• https://labs.bishopfox.com/tech-blog/breaking-- https-in-the-iot

对npm生态系统的担忧

• https://sambleckley.com/writing/npm.html

20200630

[漏洞]

SMBleedingGhost Writeup Part III: From Remote Read (SMBleed) to RCE

• https://blog.zecops.com/vulnerabilities/smbleedingghost-writeup-part-iii-from-remote-read-smbleed-to-rce/

CVE-2020-2021 PAN-OS：SAML认证绕过

• https://security.paloaltonetworks.com/CVE-2020-2021

OCS库存NG v2.7 RCE漏洞(CVE-2020-14947)

• https://shells.systems/ocs-inventory-ng-v2-7-remote-command-execution-cve-2020-14947/

从PartitionAlloc利用到沙箱逃逸的旅程：Chromium Fullchain-0CTF 2020

• https://blog.perfect.blue/Chromium-Fullchain

[恶意代码]

全球高级持续性威胁（APT）2020年中报告（奇安信）

• https://ti.qianxin.com/uploads/2020/06/29/e4663b4f11f01e5ec8a1a5d91a71dc72.pdf

macOS平台的恶意软件Dropper投递VindInstaller广告软件

• https://www.sentinelone.com/blog/how-a-new-macos-malware-dropper-delivers-vindinstaller-adware/

Java平台远控Ratty＆Adwind投递Jar的一些有趣策略

• https://www.securityinbits.com/malware-analysis/interesting-tactic-by-ratty-adwind-distribution-of-jar-appended-to-signed-msi/

.ics日历附件中的网络钓鱼链接

• https://cofense.com/youre-invited-phishing-links-inside-ics-calendar-attachments/

macOS平台广告软件mm-install-macos变种

• https://www.carbonblack.com/2020/06/29/tau-threat-analysis-bundlore-macos-mm-install-macos/

过去4年层多次曝光的黑客组织PROMETHIUM，正在扩大其覆盖范围，并尝试在多个国家/地区感染新目标

• https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html

[工具]

Pwdb-Public：从10亿互联网泄露凭据里提取的数据

• https://github.com/FlameOfIgnis/Pwdb-Public

Xeexe-TopAntivirusEvasion：免杀工具，使用自定义key编译免杀的Payload，支持顶级杀软免杀

• https://github.com/persianhydra/Xeexe-TopAntivirusEvasion

browsertunnel：使用DNS协议从浏览器中窃取数据

• https://github.com/veggiedefender/browsertunnel

hackerone_wordlist：使用HackerOne bug bounty平台上公开的报告编制的wordlist

• https://github.com/xyele/hackerone_wordlist

一些国外大厂的IP地址范围列表

• https://github.com/pry0cc/cloud-ranges

Go4aRun：在GoLang种执行Shellcode，支持Shellcode加密、进程注入、block dll和父进程伪造

• https://github.com/D00MFist/Go4aRun

Assemblyline：大规模自动化恶意代码分析平台（由加拿大网络安全中心开发，此前托管在Bitbucket，现迁移到Github）

• https://github.com/CybercentreCanada

[技术]

MCUXpresso SDK教程：在OKdo E1板上使用I2C驱动程序

• https://mcuoneclipse.com/2020/06/29/mcuxpresso-sdk-tutorial-using-i2c-driver-on-okdo-e1-board/

禁用TLS 1.0和TLS 1.1

• https://thomasvilhena.com/2020/06/disabling-tls-1-0-and-tls-1-1

使用Azure Sentinel搜索数据中的异常会话

• https://techcommunity.microsoft.com/t5/azure-sentinel/hunting-for-anomalous-sessions-in-your-data-with-azure-sentinel/ba-p/1492490

XACML的基本介绍

• https://dzone.com/articles/a-beginners-guide-to-xacml

20200629

[资讯]

美国明尼苏达州最大的报纸Star Tribune的230万挑用户记录在暗网出售，包括以下字段：用户名和密码、电子邮件地址、名字、实际地址、电话号码、性别

• https://cybleinc.com/2020/06/28/personal-data-of-2-3-million-subscribers-of-a-popular-news-website-for-sale/

印度尼西亚金融服务提供商Kreditplus的超过89万客户记录在暗网出售，出售数据包括以下字段：名字、电子邮件地址、密码、现在/实际地址、电话号码、工作数据、公司资料、家庭数据

• https://cybleinc.com/2020/06/28/890k-customer-records-of-finance-service-provider-of-indonesia-being-sold-on-darknet/

[漏洞]

GeoVision监视设备和指纹扫描仪中的多个漏洞

• https://www.acronis.com/en-us/blog/posts/backdoor-wide-open-critical-vulnerabilities-uncovered-geovision

Oracle VirtualBox VHWA Use-After-Free Privilege Escalation Vulnerability

• https://starlabs.sg/blog/2020/06/oracle-virtualbox-vhwa-use-after-free-privilege-escalation-vulnerability/

[恶意代码]

隐藏在Docker容器镜像中的挖矿软件，从Docker Hub累积下载超过33万次

• https://blog.aquasec.com/container-vulnerability-dzmlt-dynamic-container-analysis

[工具]

Espionage：网络数据包嗅探与拦截，可实现ARP欺骗等

• https://github.com/josh0xA/Espionage

BSF：僵尸网络仿真框架，提供一个离散的模拟环境来实现和扩展点对点僵尸网络，调整他们的设置，并允许防御者评估监控和对策。

• https://github.com/tklab-tud/BSF

Max：用一套简单的工具使BloodHound最大化

• https://github.com/knavesec/Max
• https://whynotsecurity.com/blog/max/

OSSEM：开源安全事件元数据，社区主导的项目，主要关注来自不同数据源和操作系统的安全事件日志的文档化和标准化

• https://github.com/hunters-forge/OSSEM

tigma：在JS环境中加载、解析和验证Sigma规则的库

• https://github.com/binalyze/tigma

clr-meterpreter：在CLR上实现的Meterpreter

• https://github.com/OJ/clr-meterpreter

pencode：辅助创建Payload编码链

• https://github.com/ffuf/pencode

checkm8-a5：checkm8 port for S5L8940X/S5L8942X/S5L8945X

• https://github.com/a1exdandy/checkm8-a5

[技术]

利用DVD播放器Hacking PlayStation 2

• https://cturt.github.io/freedvdboot.html
• https://github.com/CTurt/FreeDVDBoot
• https://www.youtube.com/watch?v=ez0y-hz3VuM

结合BeEF实现meterpreter漏洞利用链，可以绕过杀软/AMSI

• https://medium.com/@bluedenkare/1-click-meterpreter-exploit-chain-with-beef-and-av-amsi-bypass-96b0eb61f1b6

Die shrink: How Intel scaled down the 8086 processor

• http://www.righto.com/2020/06/die-shrink-how-intel-scaled-down-8086.html

Sys：在浏览器代码中发现漏洞的静态/符号化工具

• https://cseweb.ucsd.edu/~dstefan/pubs/brown:2020:sys.pdf

APC系列：KiUserApcDispatcher与Wow64

• https://repnz.github.io/posts/apc/wow64-user-apc/

滥用Windows电源管理API

• https://vxug.fakedoma.in/papers/VXUG/Exclusive/AbusingtheWindowsPowerManagementAPI.pdf

试图使用DNS MX记录来映射全球电子邮件安全提供商全景

• https://medium.com/@jason_trost/mining-dns-mx-records-for-fun-and-profit-7a069da9ee2d

使用Angle Grinder分析Apache日志

• https://blog.pentesteracademy.com/apache-log-analysis-using-angle-grinder-236fa77194bb

不用Cookie进行服务器端追踪

• https://marvinblum.de/blog/server-side-tracking-without-cookies-in-go-OxdzmGZ1Bl
• https://github.com/emvi/pirsch

与浏览器安全有关的一切

• https://medium.com/bugbountywriteup/almost-everything-about-browser-security-for-beginners-part-1-85e4dae5ca04
• https://medium.com/bugbountywriteup/almost-everything-about-browser-security-for-beginners-part2-a16f8592ab49

20200628

[资讯]

2020年开源安全状态报告。该报告阐明了开源软件的当前安全状况，并反映了开源安全问题，程序包和容器映像中漏洞的趋势，并研究了维护者和组织在保护软件方面所采用的做法

• https://snyk.io/open-source-security-report/

美国商业咨询公司Frost＆Sullivan遭受数据泄露，攻击者在黑客论坛上出售其数据库。数据库包含大约6,000个客户记录和6,146条员工记录，员工数据包括包括名字和姓氏、登录名、电子邮件地址和哈希密码，客户数据包括客户名称、电子邮件地址、公司联系方式、是否保密以及其他数据

• https://www.bleepingcomputer.com/news/security/exposed-frost-and-sullivan-databases-for-sale-on-hacking-forum/

黑客组织Anonymous Brazil声称本月早些时候获取了包括总统贾尔·博尔索纳罗在内的高级政府官员的个人详细信息，以及超过20万名军人和政府官员的数据。调查显示，为了获取信息，仅在南里奥格兰德州，就有90多个机构遭到袭击

• https://www.zdnet.com/article/brazilian-federal-police-investigates-presidential-data-leak/

[漏洞]

Docker Desktop本地提权漏洞PoC（CVE-2020-10665）

• https://github.com/spaceraccoon/CVE-2020-10665

赛门铁克端点保护中的任意文件移动漏洞利用(CVE-2020-5825)

• https://www.accenture.com/us-en/blogs/cyber-defense/exploiting-arbitrary-file-move-in-symantec-endpoint-protection

Inductive Automation Ignition (Ignition) SCADA产品漏洞，串联3个漏洞实现RCE

• https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Miami_2020/rce_me_v2/rce_me_v2.md

JSON RSA to HMAC and None Algorithm Vulnerability POC

• https://github.com/Goron/TokenBreaker

使用EWS错误配置访问电子邮件收件箱和转储全局地址列表，最终使用未注册到MFA的AD帐户的故事

• https://medium.com/bugbountywriteup/from-recon-to-bypassing-mfa-implementation-in-owa-by-using-ews-misconfiguration-b6a3518b0a63

自定义Ysoserial Payloads实现Java反序列化漏洞利用

• https://rhinosecuritylabs.com/research/java-deserializationusing-ysoserial/

NETGEAR R6700v3路由器固件UPNP daemon的栈溢出漏洞

• https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Tokyo_2019/tokyo_drift/tokyo_drift.md
• https://www.zerodayinitiative.com/blog/2020/6/24/zdi-20-709-heap-overflow-in-the-netgear-nighthawk-r6700-router

一种对PostgreSQL数据库实现远程代码执行的通用技术

• https://srcincite.io/blog/2020/06/26/sql-injection-double-uppercut-how-to-achieve-remote-code-execution-against-postgresql.html

针对Windows LNK RCE漏洞的微补丁(CVE-2020-1299)

• https://blog.0patch.com/2020/06/micropatch-is-available-for-windows-lnk.html

[恶意代码]

混淆的VBS脚本，释放Ursnif，Qakbot和Dridex木马Zloader

• https://blog.morphisec.com/obfuscated-vbscript-drops-zloader-ursnif-qakbot-dridex

Magnitude EK漏洞利用工具包过去一年内的进化

• https://securelist.com/magnitude-exploit-kit-evolution/97436/

XORDDoS和Kaiji僵尸网络针对暴露的Docker服务器

• https://blog.trendmicro.com/trendlabs-security-intelligence/xorddos-kaiji-botnet-malware-variants-target-exposed-docker-servers/

Lucifer：混合Cryptojacking和DDoS功能的恶意软件，具备针对Windows主机的各种攻击手段

• https://unit42.paloaltonetworks.com/lucifer-new-cryptojacking-and-ddos-hybrid-malware/

勒索软件CryCryptor，伪装成加拿大官方的新冠追踪应用App，通过两个网站分发给加拿大的Android用户

• https://www.welivesecurity.com/2020/06/24/new-ransomware-uses-covid19-tracing-guise-target-canada-eset-decryptor/

对于恶意软件Glupteba的详尽调查

• https://news.sophos.com/wp-content/uploads/2020/06/glupteba_final.pdf

从2019年1月至2020年1月底，摩洛哥记者遭受利用NSO Group的工具进行的网络注入攻击

• https://www.amnesty.org/en/latest/research/2020/06/moroccan-journalist-targeted-with-network-injection-attacks-using-nso-groups-tools/

Docker Hub存在植入挖矿软件的恶意镜像，被下载超过200万次

• https://unit42.paloaltonetworks.com/cryptojacking-docker-images-for-mining-monero/

针对PHP的僵尸网络DarkCrewBot

• https://research.checkpoint.com/2020/the-return-of-the-bot-shop-crew/

Web skimmer隐藏在EXIF元数据中，窃取的信用卡数据以图片方式返回

• https://blog.malwarebytes.com/threat-analysis/2020/06/web-skimmer-hides-within-exif-metadata-exfiltrates-credit-cards-via-image-files/

US Local Government Services Targeted by New Magecart Credit Card Skimming Attack

• https://blog.trendmicro.com/trendlabs-security-intelligence/us-local-government-services-targeted-by-new-magecart-credit-card-skimming-attack/

[工具]

HawkScan：针对网站的信息收集和侦察工具

• https://github.com/c0dejump/HawkScan

DeepBinDiff：二进制Diff工具

• https://github.com/yueduan/DeepBinDiff

pDiff：对pcap进行一些基本的差异分析，并提供对未知协议的深入了解

• https://github.com/netspooky/pdiff

cs-rdll-ipc-example：示例程序，在Cobalt Strike中使用命名管道实现的IPC和ReflectiveDlls

• https://github.com/rxwx/cs-rdll-ipc-example

EagleShell：提高渗透体验的高质量脚本

• https://github.com/TRSTN4/EagleShell

behave：浏览器扩展，监控访问的网页是否在执行一些恶意操作

• https://github.com/mindedsecurity/behave

grap：输入模式和二进制文件，使用基于Casptone的反汇编工具获取二进制文件的控制流图，然后与模式匹配

• https://github.com/QuoSecGmbH/grap

approxis-groundtruth：在调试符号的帮助下生成二进制的ground truth映射

• https://github.com/LL-MM/approxis-groundtruth

Cloudtopolis：在谷歌云Shell平台上安装并使用Hashtopolis，免费破解hash

• https://github.com/JoelGMSec/Cloudtopolis

[技术]

利用Windows快捷方式文件，以零接触的方式下载并启动网络连接

• https://isc.sans.edu/diary/Using+Shell+Links+as+zero-touch+downloaders+and+to+initiate+network+connections/26276

一个严重的错误：1970年代的Intel 8271磁盘芯片吞噬了我的数据！

• https://scarybeastsecurity.blogspot.com/2020/06/a-wild-bug-1970s-intel-8271-disc-chip.html

使用ModSecurity & ELK进行持续安全监控

• https://www.notsosecure.com/continuous-security-monitoring/

One Token to leak them all : The story of a $8000 NPM_TOKEN

• https://medium.com/bugbountywriteup/one-token-to-leak-them-all-the-story-of-a-8000-npm-token-79b13af182a3

执行Active Directory安全检查

• https://www.hub.trimarcsecurity.com/post/securing-active-directory-performing-an-active-directory-security-review

在可以控制环境变量时，如何使用各种脚本语言的解释器执行任意命令

• https://www.elttam.com/blog/env/

使用LeakLooker进行进攻性泄漏搜寻

• https://www.offensiveosint.io/offensive-osint-so1e07-offensive-leak-hunt-with-leaklooker/
• https://github.com/woj-ciech/LeakLooker-X

漏洞赏金Tips，Part1

• https://www.infosecmatter.com/bug-bounty-tips-1/

GitRoot: 1 Vulnhub Walkthrough

• https://www.hackingarticles.in/gitroot-1-vulnhub-walkthrough/

HTB入门

• https://medium.com/bugbountywriteup/things-i-learned-after-rooting-25-hack-the-box-machines-e9eada4ea6ca

HackTheBox Writeup: PlayerTwo

• https://t3chnocat.com/htb-playertwo/

使用IDA Pro导出的假调试符号修复Windbg破损的栈跟踪记录

• http://www.debasish.in/2020/06/fixing-windbg-broken-stack-trace-using.html

在Firefox中禁用剪贴板事件覆盖

• https://rawsec.ml/en/disable-clipboard-events/

逆向分析中动态二进制插桩工具Intel Pin的使用

• https://www.youtube.com/playlist?list=PLKwUZp9HwWoDXHo51cWvYz1GRlM4dI5F2
• https://github.com/shsirk/proctracer

IoT Hacking笔记：使用绑定挂载临时修改只读文件

• https://blog.nviso.eu/2020/06/26/iot-hacking-fieldnotes-2-using-bind-mounts-to-temporarily-modify-read-only-files/

Shellcode：使用转义序列更快编码Null字节

• https://modexp.wordpress.com/2020/06/26/shellcode-encoding-null-bytes-faster/

Hack the Box — DevOops Write-up

• https://medium.com/bugbountywriteup/hack-the-box-devoops-write-up-367d260d550c

将.NET程序集注入到非托管进程

• https://ired.team/offensive-security/code-injection-process-injection/injecting-and-executing-.net-assemblies-to-unmanaged-process

破解D-Link DIR3060固件加密

• https://0x00sec.org/t/breaking-the-d-link-dir3060-firmware-encryption-recon-part-1/21943

Weak bits floppy disc protection: an alternate origins story on 8-bit

• https://scarybeastsecurity.blogspot.com/2020/06/weak-bits-floppy-disc-protection.html

20200624

[资讯]

总部位于印度古尔冈的印度企业集团IndiaBulls Group遭受CLOP勒索软件入侵，攻击者泄漏了从公司偷来的数据的样本，并威胁说如果受害者不支付赎金，将在24小时内释放整个转储。当前的数据泄漏包括该公司与银行高度敏感的文件的快照，例如帐户交易明细，凭证，发送给银行经理的信等等。

• https://cybleinc.com/2020/06/23/clop-ransomware-operators-have-allegedly-struck-indiabulls-group-a-well-established-indian-conglomerate-data-leak/

微软正式发布Linux版的Microsoft Defender ATP（高级威胁防护），支持六个最常见的Linux服务器发行版的最新版本 s

• https://techcommunity.microsoft.com/t5/microsoft-defender-atp/microsoft-defender-atp-for-linux-is-now-generally-available/ba-p/1482344

[漏洞]

在2020年1月ZDI的Pwn2Own Miami 2020比赛中使用的Java漏洞利用链

• https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Miami_2020/rce_me_v2/rce_me_v2.md

趋势科技密码管理器的DLL劫持漏洞(CVE-2020–8469)

• https://sidechannel.tempestsi.com/dll-hijacking-at-the-trend-micro-password-manager-cve-2020-8469-461477b796d8

[恶意代码]

WastedLocker：由Evil Corp Group开发的新勒索软件变种

• https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/

Sodinokibi勒索软件，扫描受害者的网络以获取信用卡或PoS软件

• https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/sodinokibi-ransomware-cobalt-strike-pos

谷歌商店发现的47个广告App，下载量超过1500万

• https://blog.avast.com/avast-discovers-47-android-adware-apps-avast

[工具]

hmmcookies：使用快捷文件从Firefox, Chrome, Opera获取cookies(绕过UAC)

• https://github.com/thelinuxchoice/hmmcookies

spoolsystem：使用Print Spooler命名管道伪造技巧，获取SYSTEM权限，无需创建新进程或跨进程shellcode注入

• https://github.com/rxwx/spoolsystem

frida-boot：使用Firda的二进制插桩工作间

• https://github.com/leonjza/frida-boot

XPEViewer：PE文件查看/编辑工具

• https://github.com/horsicq/XPEViewer

[技术]

使用icebox查看Windows内存

• https://thalium.github.io/blog/posts/windows-full-memory-introspection-with-icebox/

使用Psalm检测PHP安全漏洞

• https://psalm.dev/articles/detect-security-vulnerabilities-with-psalm

滥用.NET Core的垃圾收集器实现免杀

• https://pentestlaboratories.com/2020/06/23/abusing-net-core-application-whitelisting/
• https://www.contextis.com/en/blog/bring-your-own-.net-core-garbage-collector
• https://github.com/am0nsec/MCGC

20200623

[资讯]

BlueLeaks：一个名为DDoSecrets的组织发布了269 GB的数据转储，其中包含来自200多个警察部门的24年记录 s

• https://krebsonsecurity.com/2020/06/blueleaks-exposes-files-from-hundreds-of-police-departments/

在线MMO游戏Stalker Online被黑客入侵，攻击者在黑客论坛上出售了120万条用户记录，包括玩家的用户名、密码、电子邮件地址、电话号码和IP地址

• https://cybernews.com/security/popular-mmo-game-stalker-online-hacked-1-2-million-user-records-put-for-sale-on-hacker-forums/

[漏洞]

Bitdefender杀软漏洞，可导致任何网站都可以使用当前用户的特权在用户的系统上执行任意代码。无需任何用户交互，支持任何浏览器，无论安装了什么浏览器扩展（CVE-2020-8102）

• https://palant.info/2020/06/22/exploiting-bitdefender-antivirus-rce-from-any-website/

[恶意代码]

对TrickBot早期攻击报告的扩展：Cobalt Strike攻击服务器

• https://labs.sentinelone.com/inside-a-trickbot-cobaltstrike-attack-server/

利用RDP爆破传播的勒索软件Snatch

• https://thedfirreport.com/2020/06/21/snatch-ransomware/

Web skimming with Google Analytics

• https://securelist.com/web-skimming-with-google-analytics/97414/

IndigoDrop：高度模块化的Dropper，以军事主题做诱饵，传播Cobalt Strike Beacon

• https://blog.talosintelligence.com/2020/06/indigodrop-maldocs-cobalt-strike.html

Dridex: the secret in a PostMessage()

• https://reaqta.com/2020/06/dridex-the-secret-in-a-postmessage/

[工具]

unicorn-ppc：用Power-PC架构扩展Unicorn引擎

• https://github.com/DGA-MI-SSI/unicorn-ppc

CorsMe：GoLang编写的CORS错误配置扫描器

• https://github.com/Shivangx01b/CorsMe

[技术]

逆向Snapchat，Part2：反混淆

• https://hot3eed.github.io/2020/06/22/snap_p2_deobfuscation.html

Android App逆向

• https://yasoob.me/posts/reverse-engineering-android-apps-apktool/

Windows中的DLL劫持

• https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows

简要回顾BusyBox未修复的漏洞(CVE-2018-1000500)和漏洞组件BusyBox Wget

• https://www.vdoo.com/blog/busybox-wget-case

如何设置Mutual TLS

• https://dzone.com/articles/hakky54mutual-tls-1

[其他]

逆向分析终极资源列表

• https://medium.com/@vignesh4303/reverse-engineering-resources-beginners-to-intermediate-guide-links-f64c207505ed

20200622

[资讯]

印度尼西亚23万多名新冠患者记录在暗网出售

• https://cybleinc.com/2020/06/21/230k-indonesian-covid-19-patients-personal-information-leaked-in-the-darknet/

[漏洞]

使用静态分析工具检查了2,000个npm模块的安全性弱点和漏洞，发现的一些常见问题：硬编码的secret、未经验证的令牌等

• https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/

IBM最近在其Maximo资产管理解决方案中修复了一个高危漏洞，该漏洞可能会促进对公司网络的攻击

• https://securityaffairs.co/wordpress/104991/hacking/ibm-maximo-asset-management-flaw.html

CVE-2017-5123 PoC：本地提权，绕过SMEP/SMAP。无KASLR

• https://github.com/c3r34lk1ll3r/CVE-2017-5123

使用一个小的文件系统漏洞，崩溃VMware Guests

• https://medium.com/tenable-techblog/crashing-vmware-guests-with-a-silly-filesystem-bug-425ee43d85e4

Windows Defender提权漏洞（CVE-2020-1170）

• https://itm4n.github.io/cve-2020-1170-windows-defender-eop/

[恶意代码]

窃密软件NitroHack通过修改Discord账户进行传播

• https://www.bleepingcomputer.com/news/security/discord-modified-to-steal-accounts-by-new-nitrohack-malware/

Payload将自身编码为ASCII字符，伪装成错误日志来进行隐藏

• https://blog.huntresslabs.com/hiding-in-plain-sight-556469e0a4e

研究发现，使用Golang编写的针对SSH的机器人越来越多

• https://labs.bitdefender.com/2020/06/ssh-targeting-golang-bots-becoming-the-new-norm/

[工具]

exynos-usbdl：Exynos BootROM的无符号代码加载程序

• https://github.com/frederic/exynos-usbdl
• https://fredericb.info/2020/06/exynos-usbdl-unsigned-code-loader-for-exynos-bootrom.html

Talon：一个密码猜测工具，针对Windows Active Directory环境中的Kerberos和LDAP服务

• https://github.com/optiv/Talon
• https://www.optiv.com/explore-optiv-insights/blog/digging-your-talons-new-take-password-guessing

autocrack：Responder中捕获Hash之后，立刻将Hash发送到hashcat进行破解

• https://github.com/pry0cc/autocrack
• https://0x00sec.org/t/autocrack-a-responder-to-hashcat-queue-with-notifications/21843

Macrome：Excel宏文档读写工具

• https://github.com/michaelweber/Macrome

DroidTracker：生成Android App的脚本，实时追踪目标的位置

• https://github.com/thelinuxchoice/DroidTracker

[技术]

破解BattlEye的数据包加密

• https://secret.club/2020/06/19/battleye-packet-encryption.html

使用Impacket滥用Kerberos

• https://www.hackingarticles.in/abusing-kerberos-using-impacket/

逆向并比较两个Game Boy音频放大器芯片

• http://www.righto.com/2020/06/reverse-engineering-and-comparing-two.html

Hyper-V memory internals. EXO partition memory access

• http://hvinternals.blogspot.com/2020/06/hyper-v-memory-internals-exo-partition.html

恶意软件 (Loki, Nanocore, Phobos)如何在没有管理员权限的清空下挂载恶意ISO文件

• https://vxug.fakedoma.in/papers/VXUG/Exclusive/WeaponizingWindowsVirtualization.pdf
• https://vxug.fakedoma.in/papers/VXUG/Exclusive/WeaponizingWindowsVirtualizationCode.txt

调试软件断点和硬件断点解释

• https://www.youtube.com/watch?v=29j7AQUj38g

利用全球蜜罐网络检测有针对性的ICS攻击

• https://ccdcoe.org/uploads/2020/05/CyCon_2020_15_Dodson_Beresford_Vingaard.pdf

ZH3R0 CTF — Challenge Writeups

• https://medium.com/bugbountywriteup/zh3r0-ctf-challenge-writeups-fe0ef9027457

使用Python进行基于信誉（Reputation）的检测

• https://en.ogunal.com/reputation-based-detection-with-python/

HackTheBox Writeup: Servmon

• https://t3chnocat.com/htb-servmon/

针对渗透测试和漏洞赏金的侦察指南

• https://www.offensity.com/de/blog/just-another-recon-guide-pentesters-and-bug-bounty-hunters/

自动重写Meterpreter的70万行代码库，实现免杀

• https://blog.scrt.ch/2020/06/19/engineering-antivirus-evasion/

入侵星巴克并访问近1亿客户记录

• https://medium.com/@hungrybytes/hacking-starbucks-and-accessing-nearly-100-million-customer-records-d0ae4bf25e9b

使用Scapy构造数据包的艺术

• https://scapy.disruptivelabs.in/

Trace Together Token: Teardown and Design Overview

• https://xobs.io/trace-together-token-teardown/

20200619

[资讯]

德国的配送服务Foodora泄露727,000多名客户的信息，这些客户来自14个欧洲国家（包括法国，西班牙，芬兰，意大利和奥地利）。据称，该数据在2019年遭到破坏，并且大多数暴露信息都可以追溯到2016年。

• https://www.hackread.com/foodora-data-breach-14-countries-users-affected/

[恶意代码]

黑客组织Cobalt的攻击策略和攻击工具的更新

• https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/cobalt_upd_ttps/

移动端银行木马Ginp改变其针对性策略，专注于攻击土耳其

• https://securityintelligence.com/posts/ginp-malware-operations-rising-expansions-turkey/

黑客组织CHIMBORAZO在攻击中将网站与验证码结合使用，避免自动化分析

• https://twitter.com/MsftSecIntel/status/1273359829390655488

APT-C-08基于AndroidRAT开发的远控BitterRAT的发展历史，以及是如何通过谷歌商店进行投递的

• https://labs.bitdefender.com/2020/06/bitterapt-revisited-the-untold-evolution-of-an-android-espionage-tool/

深入挖掘InvisiMole用于隐藏的武器库

• https://www.welivesecurity.com/2020/06/18/digging-up-invisimole-hidden-arsenal/

银行木马IcedID近期的攻击行动分析

• https://blogs.juniper.net/en-us/threat-research/covid-19-and-fmla-campaigns-used-to-install-new-icedid-banking-malware

[工具]

tsunami-security-scanner：通用网络安全扫描器，带有可扩展的插件系统，用于检测安全漏洞

• https://github.com/google/tsunami-security-scanner
• https://opensource.googleblog.com/2020/06/tsunami-extensible-network-scanning.html

FuzzGen：在给定环境中对指定的库进行全系统分析，推断库的接口，并为该库生成Fuzzer

• https://github.com/HexHive/FuzzGen
• https://www.usenix.org/system/files/sec20fall_ispoglou_prepub.pdf

dankAlerts：Windows安全事件日志查看工具

• https://github.com/firstoctet/dankAlerts

shaggy-rogers：扫描blob文件查找敏感内容

• https://github.com/mthbernardes/shaggy-rogers

[技术]

Frida初学者教程

• https://www.youtube.com/watch?v=CLpW1tZCblo

诱导用户转账的鱼叉式网络钓鱼攻击

• https://blog.redteam.pl/2020/06/spear-phishing-muhammad-appleseed1-mail-ru.html

Snapchat逆向，Part1：混淆技术

• https://hot3eed.github.io/snap_part1_obfuscations.html

对移动端银行App的漏洞与威胁调查

• https://www.ptsecurity.com/upload/corporate/ww-en/analytics/vulnerabilities-mobile-banks-2020-eng.pdf

The Internet’s New Arms Dealers: Malicious Domain Registrars

• https://awakesecurity.com/blog/the-internets-new-arms-dealers-malicious-domain-registrars/

20200618

[资讯]

社交媒体研究小组Graphika今天发布了一份长达120页的报告，揭露了俄罗斯代号为Secondary Infektion的组织，自2014年以来依靠虚假新闻报道、虚假泄密和伪造文件在欧洲和北美国家引发政治丑闻

• https://secondaryinfektion.org/downloads/secondary-infektion-report.pdf

[漏洞]

Win32k提权漏洞PoC(CVE-2020-1054)

• https://github.com/0xeb-bp/cve-2020-1054

数据可视化程序DigDash Enterprise的SSRF、内容注入和XSS漏洞

• https://know.bishopfox.com/advisories/digdash-version-2018

FF沙箱逃逸（CVE-2020-12388）

• https://googleprojectzero.blogspot.com/2020/06/ff-sandbox-escape-cve-2020-12388.html

Java管理扩展（JMX）桥Jolokia的漏洞挖掘与利用

• https://blog.it-securityguard.com/how-i-made-more-than-30k-with-jolokia-cves/

USB for Remote Desktop漏洞可使攻击者添加虚假设备

• https://labs.sentinelone.com/click-from-the-backyard-cve-2020-9332/

Microsoft SharePoint Server RCE漏洞（CVE-2020-1181）

• https://www.zerodayinitiative.com/blog/2020/6/16/cve-2020-1181-sharepoint-remote-code-execution-through-web-parts

[恶意代码]

.NET编写的恶意软件MassLogger

• https://fr3d.hk/blog/masslogger-frankenstein-s-creation

In(ter)ception行动：针对欧洲和中东的知名航空航天和军事公司的网络间谍活动

• https://www.welivesecurity.com/2020/06/17/operation-interception-aerospace-military-companies-cyberspies/

新的恶意软件家族AcidBox，复杂、稀有，可能是更大工具集的一部分，利用VirtualBox的合法驱动程序

• https://unit42.paloaltonetworks.com/acidbox-rare-malware/

多阶段的APT攻击，释放使用了Malleable C2特性的Cobalt Strike Beacon

• https://blog.malwarebytes.com/threat-analysis/2020/06/multi-stage-apt-attack-drops-cobalt-strike-using-malleable-c2-feature/

[工具]

kubernetes-goat：带漏洞的Kubernetes Cluster

• https://github.com/madhuakula/kubernetes-goat

SecretFinder：在JavaScript文件中查找敏感数据，如apikey, accesstoken, authorizations, jwt等

• https://github.com/m4ll0k/SecretFinder

symcc：基于编译器的高效符号执行

• https://github.com/eurecom-s3/symcc
• http://www.s3.eurecom.fr/docs/usenixsec20_symcc.pdf

[技术]

Microsoft Defender高级威胁防护通过新的统一可扩展固件接口（UEFI）扫描程序将其保护功能扩展到固件级别

• https://www.microsoft.com/security/blog/2020/06/17/uefi-scanner-brings-microsoft-defender-atp-protection-to-a-new-level/

使用Frida进行Windows逆向

• https://darungrim.com/research/2020-06-17-using-frida-for-windows-reverse-engineering.html

Metasploit Framework的RCE功能

• https://www.infosecmatter.com/rce-on-windows-from-linux-part-5-metasploit-framework/

使用Google Analytics（分析）绕过CSP窃取用户的私人数据

• https://medium.com/perimeterx/exfiltrating-users-private-data-using-google-analytics-to-bypass-csp-5f91eb3b880

使用bcov可视化程序图

• https://blog.formallyapplied.com/2020/06/bcov-program-graphs/

20200617

[资讯]

Ripple20漏洞：研究人员在Treck，Inc.开发的被广泛使用的低级TCP / IP软件库中发现了一系列零日漏洞，将这19个漏洞统称为Ripple20，影响亿万个设备（或更多）。其中包含多个远程执行代码漏洞，可以使远程攻击者完全控制目标设备，而无需任何用户交互。

• https://www.jsof-tech.com/ripple20/

营销公司Ariix的意大利分支机构Ariix Italia因为不安全的S3 Bucket泄露数据，包含 7,515个PDF和 25,895个JPG文件，包括身份证、国家电子身份证、健康保险卡、信用卡、销售代表注册合同等。

• https://securityaffairs.co/wordpress/104854/breaking-news/ariix-30k-italian-sales-agents-data-leak.html

几个“另类约会”App共享同一个开发人员，数据存储在同一个AWS账户中，因为账户配置不安全，导致潜在的数以百万计的用户面临危险。数据总大小：845 GB

• https://www.vpnmentor.com/blog/report-dating-apps-leak/

美国芯片制造商MaxLinear在5月24日发现了从4月中旬开始对其系统的未经授权的访问，6月10日向受影响的个人发送了数据泄露通知。6月15日，Maze勒索软件从据称失窃的超过1TB数据中泄漏了10.3GB的会计和财务信息。这些泄漏的信息可能包括个人身份（PII）和财务信息，例如“姓名，个人和公司电子邮件地址和个人邮寄地址，员工ID号，驾驶执照号，财务帐号，社会保险号，日期出生，工作地点，薪酬和福利信息，受抚养人和受雇日期。”

• https://www.bleepingcomputer.com/news/security/chipmaker-maxlinear-reports-data-breach-after-maze-ransomware-attack/

[漏洞]

SMBleedingGhost Writeup Part II：未授权内存读取，为RCE做准备

• https://blog.zecops.com/vulnerabilities/smbleedingghost-writeup-part-ii-unauthenticated-memory-read-preparing-the-ground-for-an-rce/

Composr CMS无需认证即可触发的RCE漏洞

• https://github.com/MegadodoPublications/exploits/blob/master/composr.md

Windows OLE整数溢出导致RCE漏洞的微补丁(CVE-2020-1281)

• https://blog.0patch.com/2020/06/micropatch-is-available-for-ms-windows.html

SOHO设备漏洞利用

• https://blog.grimm-co.com/2020/06/soho-device-exploitation.html

Mimosa路由器提权和认证绕过漏洞

• https://ssd-disclosure.com/ssd-advisory-mimosa-routers-privilege-escalation-and-authentication-bypass/

[恶意软件]

利用Apple的APSDaemon.exe，AnyToIso和CrystalBit软件中的DLL劫持漏洞来传播的挖矿软件

• https://blog.morphisec.com/crystalbit-apple-double-dll-hijack

[工具]

fsociety：模块化渗透测试框架

• https://github.com/fsociety-team/fsociety

evildll：生成用于DLL劫持的恶意DLL

• https://github.com/thelinuxchoice/evildll

Modality：Radare2插件，将angr的符号执行功能集成到Radare2

• https://github.com/chase1635321/Modality

[技术]

Android 加固应用Hook方式-Frida

• https://github.com/xiaokanghub/Android

逆向Exynos BootROM USB栈

• https://fredericb.info/2020/06/reverse-engineer-usb-stack-of-exynos-bootrom.html

iOS上拦截Flutter流量

• https://blog.nviso.eu/2020/06/12/intercepting-flutter-traffic-on-ios/

云渗透清单

• https://github.com/dafthack/CloudPentestCheatsheets

[其他]

美国参议院两党今天发表的一份报告称，美国联邦通信委员会和其他美国机构未能适当监管在美国运营的**电信公司

• https://www.hsgac.senate.gov/imo/media/doc/2020-06-09%20PSI%20Staff%20Report%20-%20Threats%20to%20U.S.%20Communications%20Networks.pdf

20200616

[资讯]

据南非星期日时报报道，2018年一名南非银行员工在一张纸上打印了36位的主密钥，随后在2019年3月至12月期间使用万能钥匙进行了超过25,000起欺诈性交易，从客户余额中窃取了超过320万美元。银行现在必须用主密钥替换所有生成的客户卡，此操作将花费超过5800万美元

• https://www.zdnet.com/article/south-african-bank-to-replace-12m-cards-after-employees-stole-master-key/

[漏洞]

威胁向量：GTP：LTE和5G网络漏洞

• https://positive-tech.com/storage/articles/gtp-2020/threat-vector-gtp-2020-eng.pdf

Privilege escalation in Partners Portal to Admin access

• https://ysamm.com/?p=460

exploit：利用efivar_ssdt入口点将acpi表注入到Ubuntu Bionic 18.04内核中，其中efivar_ssdt不受内核锁定的保护。 结果是，随后可以将未签名的内核驱动程序加载到启用了安全启动的系统中，而无需对模块进行签名

• https://git.zx2c4.com/american-unsigned-language/tree/american-unsigned-language.sh

攻击FreeIPA：Part IV: CVE-2020–10747

• https://posts.specterops.io/attacking-freeipa-part-iv-cve-2020-10747-7c373a1bf66b

一个Webroot类型混淆漏洞的利用

• https://medium.com/tenable-techblog/exploiting-a-webroot-type-confusion-bug-215308145e32

[恶意代码]

IRC僵尸网络逆向，Part2：用x64dbg和IDA PRO分析内存结构

• https://www.youtube.com/watch?v=LtgLa1n9EzE

[工具]

RTSPhuzz：针对RTSP服务器的Fuzzer。基于Boofuzz框架

• https://github.com/IncludeSecurity/RTSPhuzz

[技术]

使用函数Hook和DLL注入绕过AMSI

• https://x64sec.sh/understanding-and-bypassing-amsi/

漏洞赏金方法论, V4

• https://drive.google.com/file/d/1aG_qqRvNW-s5_8vvPk5rJiMSMeNL2uY9/view

帐户管理工具Gsuite中的SMTP注入

• https://www.ehpus.com/post/smtp-injection-in-gsuite

Mr. Robot -TryHackMe- CTF Writeup

• https://medium.com/@bitdestroyer/mr-robot-tryhackme-ctf-writeup-82cfe15c3481

Another "Fappening" on the Horizon?

• https://www.sociosploit.com/2020/06/another-fappening-on-horizon.html

Heresy's Gate：动态生成和执行ntoskrnl.exe未导出的内核模式syscall存根的通用方法

• https://zerosum0x0.blogspot.com/2020/06/heresys-gate-kernel-zwntdll-scraping.html
• https://github.com/zerosum0x0/heresy

从三星Galaxy S7转储Exynos 8890 bootROM

• https://fredericb.info/2020/06/exynos8890-bootrom-dump-dump-exynos-8890-bootrom-from-samsung-galaxy-s7.html

使用Frida逆向的教程

• https://www.youtube.com/playlist?list=PLKwUZp9HwWoC1E8S8MHHo5qLjldip3oi-

在Linux系统上执行Kerberoasting和Pass the Ticket攻击

• https://www.hackingarticles.in/kerberoasting-and-pass-the-ticket-attack-using-linux/

Fast-Google-Dorks-Scan：使用Google Dorks枚举Web页面

• https://github.com/IvanGlinkin/Fast-Google-Dorks-Scan

NahamCon 2020 CTF Writeup

• https://medium.com/bugbountywriteup/nahamcon-2020-ctf-writeup-33105bee3ffd

20200615

[资讯]

研究人员开发并演示了一种新颖的旁道攻击技术，通过观察屋中挂着的灯泡（可从窗户看到），并测量其发出的光量，来恢复房间中的秘密对话

• https://thehackernews.com/2020/06/lamphone-light-bulb-spy.html

[漏洞]

D-Link修复家用路由器的6个严重漏洞

• https://unit42.paloaltonetworks.com/6-new-d-link-vulnerabilities-found-on-home-routers/

OOB to RCE：Hobbes函数解释器的漏洞利用

• https://know.bishopfox.com/advisories/oob-to-rce-exploitation-of-the-hobbes-functional-interpreter

Windows10隐私设置错误导致的提权漏洞

• https://www.fortinet.com/blog/threat-research/fortiguard-labs-security-researcher-discovers-privilege-escalation-vulnerability-in-windows-platform

UPnP设备CallStranger漏洞检测器（CVE-2020-12695）

• https://github.com/yunuscadirci/CallStranger

[恶意代码]

在any.run找到真正的恶意软件，分析其整个初始阶段

• https://0x00sec.org/t/zero2auto-initial-stagers-from-one-email-to-a-trojan/21722

针对葡萄牙语用户的窃密软件TroyStealer

• https://securityaffairs.co/wordpress/104699/malware/troystealer-targets-portugal.html

意大利公司CloudEyE将其二进制加密器出售给黑客组织，获得了超过500,000美元的收入

• https://research.checkpoint.com/2020/guloader-cloudeye/

Black Kingdom勒索软件

• https://blog.redteam.pl/2020/06/black-kingdom-ransomware.html

[工具]

fa：固件分析：轻松执行代码探索、符号搜索和其他功能

• https://github.com/doronz88/fa

KatroLogger：针对Linux系统的键盘记录器

• https://github.com/Katrovisch/KatroLogger

Shodanfy.py：使用Shodan获取指定IP地址的端口、漏洞、信息和Banner等

• https://github.com/m4ll0k/Shodanfy.py

evilpdf：在pdf文件中嵌入可执行文件

• https://github.com/thelinuxchoice/evilpdf

URLCADIZ：生成可用于社工攻击的隐藏URL

• https://github.com/PerezMascato/URLCADIZ

[技术]

PE解析与绕过AV/EDR的API Hook

• https://www.solomonsklash.io/pe-parsing-defeating-hooking.html

HTB：Monteverde Walkthrough

• https://www.hackingarticles.in/hack-the-box-monteverde-walkthrough/
• https://t3chnocat.com/htb-monteverde/

凭据转储：域缓存凭据

• https://www.hackingarticles.in/credential-dumping-domain-cache-credential/

绕过CSRF保护来执行成功的CSRF攻击，借助客户端验证绕过，通过更改密码来执行完全帐户接管

• https://medium.com/bugbountywriteup/lets-bypass-csrf-protection-password-confirmation-to-takeover-victim-accounts-d-4a21297847ff

Python winappdbg逆向系列教程

• https://www.youtube.com/playlist?list=PLKwUZp9HwWoDCm0qqSyXtZqfmbFahmDfn

APT29攻击链中的步骤19，使用反射加载到内存中的SDELETE工具执行文件的秘密删除，但是在红队操作期间反复导致流程崩溃

• https://www.microsoft.com/security/blog/2020/06/11/blue-teams-helping-red-teams-a-tale-of-a-process-crash-powershell-and-the-mitre-attck-evaluation/

网络安全公司的威胁报告系统地低估了对公民社会的威胁

• https://www.tandfonline.com/doi/full/10.1080/19331681.2020.1776658

使用Sojobo和B2R2二进制分析框架去除ADVobfuscator混淆（C++）

• https://antonioparata.blogspot.com/2020/06/deobfuscating-c-advobfuscator-with.html

如何创建注册机

• https://www.youtube.com/watch?v=rlM9JGx81xk

实战X64汇编与C++

• https://www.youtube.com/playlist?list=PL0C5C980A28FEE68D

通过DNS进行威胁狩猎

• https://www.youtube.com/watch?v=J6_-y8Glxxk

逆向Comtech AHA363 PCIe Gzip加速器板

• https://tomverbeure.github.io/2020/06/14/AHA363-Reverse-Engineering.html

20200612

[资讯]

财富500强保险控股公司Genworth Financial披露，未经授权的第三方使用泄露的登录凭据访问了保险代理的在线帐户后，发生了数据泄露。攻击者可以访问包含以下某些信息的在线文档：姓名，地址，年龄，性别，出生日期，财务信息，社会保险号和签名

• https://www.bleepingcomputer.com/news/security/fortune-500-insurance-firm-genworth-discloses-data-breach/

[漏洞]

最近的iOS内核漏洞调查

• https://googleprojectzero.blogspot.com/2020/06/a-survey-of-recent-ios-kernel-exploits.html

GTP协议中的漏洞可能允许从几乎任何地方对蜂窝网络进行DoS，欺诈和数据盗窃攻击

• https://positive-tech.com/storage/articles/gtp-2020/threat-vector-gtp-2020-eng.pdf

Cmd Hijack - a command/argument confusion with path traversal in cmd.exe

• https://hackingiscool.pl/cmdhijack-command-argument-confusion-with-path-traversal-in-cmd-exe/

Windows Link RCE漏洞(CVE-2020-1299)

• https://blog.vincss.net/2020/06/cve49-microsoft-windows-lnk-remote-code-execution-vuln-cve-2020-1299-eng.html

ARM MbedOS USB大容量存储驱动内存崩溃漏洞

• https://research.nccgroup.com/2020/06/11/technical-advisory-arm-mbedos-usb-mass-driver-storage-memory-corruption/

[恶意代码]

黑客组织Gamaredon在最近的攻击中频繁使用Microsoft Office、Outlook Payload

• https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/

[工具]

Atlas：根据返回的状态码，建议可绕过WAF/IDS/IPS的sqlmap tampers

• https://github.com/m4ll0k/Atlas

COMRunner：简易COM服务器，提供了一个运行Shellcode的组件

• https://github.com/leoloobeek/COMRunner

api_palette：IDA API代码搜索与补全

• https://github.com/0xKira/api_palette

abyss：IDAPython脚本，对反编译输出进行过滤、强化显示等

• https://github.com/patois/abyss

noia：一个基于web的工具，简化浏览Android应用程序沙箱的过程，直接预览SQLite数据库、图像等

• https://github.com/0x742/noia

SwiftBelt：macOS系统枚举工具

• https://github.com/cedowens/SwiftBelt

zelos：全面的二进制仿真和插桩平台

• https://github.com/zeropointdynamics/zelos

jvm-dump-proxy：在JNI级别转储JVM类的代理DLL

• https://github.com/ViRb3/jvm-dump-proxy

[技术]

区块链上的恶意软件

• https://www.exablue.de/en/blog/2020-06-11-malware-on-the-blockchain.html

受保护的平台上复活JTAG/SWD接口

• https://limitedresults.com/2020/06/nrf52-debug-resurrection-approtect-bypass/

处理高级威胁

• http://www.blackstormsecurity.com/docs/Handling_Advanced_Threats_SANS_2020.pdf

通过/proc/pid/root滥用对挂载命名空间的访问

• https://labs.f-secure.com/blog/abusing-the-access-to-mount-namespaces-through-procpidroot/

CTF：EVM walkthrough

• https://resources.infosecinstitute.com/capture-the-flag-a-walkthrough-of-evm-1

利用Windows版Facebook Messenger的漏洞实现驻留

• https://blog.reasonsecurity.com/2020/06/11/persistence-method-using-facebook-messenger-desktop-app/

ECDSA（椭圆曲线数字签名算法）: Handle with Care

• https://blog.trailofbits.com/2020/06/11/ecdsa-handle-with-care/

使用Python收集Linux主机上的信息

• https://en.ogunal.com/data-collection-with-python-on-linux-system/
• https://github.com/omergunal/Simple-Live-Data-Collection

U2F可以防止受害者和Duo服务器之间的MITM攻击，但不能防止受害者和应用程序之间的MITM攻击

• https://pberba.github.io/security/2020/06/12/duo-u2f-phising/

编写简易的TCP / UDP端口扫描器

• https://www.infosecmatter.com/minimalistic-tcp-and-udp-port-scanner/

Win10 VEH转储

• https://dimitrifourny.github.io/2020/06/11/dumping-veh-win10.html

[其他]

Hooking相关资源收集，全平台

• https://github.com/alphaSeclab/hooking

20200611

[资讯]

日本游戏巨头任天堂已确认，自4月初以来，黑客已突破300,000个帐户，财务数据并未泄露

• https://securityaffairs.co/wordpress/104556/hacking/300000-nintendo-accounts-hacked.html

医疗保健提供商巴比伦报告数据泄露，其GP视频应用程序的“咨询重播”部分可以查看其他人与医生、治疗师或其他健康专家交谈的视频

• https://www.infosecurity-magazine.com/news/healthcare-babylon-breach/

骗子在Youtube上冒充SpaceX的Elon Musk，成功诈骗15万美元的比特币

• https://www.hackread.com/youtube-scammers-impersonated-elon-musk-spacex-stole-btc/

[漏洞]

OLE VARIANT marshaling整数溢出漏洞可导致堆溢出，进一步触发RCE和提权

• https://github.com/guhe120/Windows-EoP/blob/master/CVE-2020-1281/CVE-2020-1281.pdf

[恶意代码]

RagnarLocker勒索软件

• https://www.mcafee.com/blogs/other-blogs/mcafee-labs/ragnarlocker-ransomware-threatens-to-release-confidential-information

Lockbit勒索软件，通过RDP爆破传播

• https://thedfirreport.com/2020/06/10/lockbit-ransomware-why-you-no-spread/

勒索软件Thanos，使用RIPlace技术绕过杀软防护

• https://www.recordedfuture.com/thanos-ransomware-builder/

[工具]

SecureScaner：基于nmap的扫描脚本

• https://github.com/klionsec/SecureScaner

ApkAnalyser：一键提取安卓应用中可能存在的敏感信息

• https://github.com/TheKingOfDuck/ApkAnalyser

printf-tac-toe：A c implementation of tic-tac-toe in a single call to printf

• https://github.com/carlini/printf-tac-toe

bcov：静态插桩x86-64 ELF二进制文件，无需编译器支持，实现二进制级别的代码覆盖分析

• https://github.com/abenkhadra/bcov

Infosec-Alfred：跨平台网络爬虫，自动爬取安全相关信息

• https://github.com/0xsha/InfoSec-Alfred
• https://0xsha.io/posts/the-art-of-automation-creating-your-own-alfred

serpentine：Windows平台远控，使用RESTful服务器做C&C

• https://github.com/jafarlihi/serpentine

[技术]

使用WinDBG调试内核的清单

• https://github.com/repnz/windbg-cheat-sheet

理解Firefox是如何实现Web安全基础的，Part1

• https://blog.mozilla.org/attack-and-defense/2020/06/10/understanding-web-security-checks-in-firefox-part-1/

从动态控制流中挖掘输入语法

• https://publications.cispa.saarland/3101/1/fse2020-mimid.pdf

介绍卡巴斯基推出的依靠代码相似性的威胁归因引擎：KTAE，Part1

• https://securelist.com/big-threats-using-code-similarity-part-1/97239/

程序集“包装”：一种反-反汇编技术

• https://medium.com/swlh/assembly-wrapping-a-new-technique-for-anti-disassembly-c144eb90e036

针对神经网络的能量延迟攻击

• https://www.lightbluetouchpaper.org/2020/06/08/how-to-jam-neural-networks/

Pwn2Win 2020 - Hardware Trojan write-up

• https://github.com/pwn2winctf/challenges-2020/blob/master/rev-pwn-hw-Hardware-Trojan/README.md

逆向Android平台加固方案DexGuard（ProGuard的商业版）

• https://www.pnfsoftware.com/blog/reversing-dexguard/

20200610

[资讯]

针对Intel CPU的CacheOut和SGAxe攻击

• https://sgaxe.com/

针对Intel CPU的CrossTalk攻击

• https://www.vusec.net/projects/crosstalk/

在数十亿个UPNP设备中发现的CallStranger漏洞可用于泄露数据（即使您具有适当的DLP /边界安全手段）或扫描您的网络，甚至导致您的网络参与DDoS攻击

• https://callstranger.com/
• https://github.com/yunuscadirci/CallStranger

黑客在暗网出售从印度国防承包商BEML窃取的敏感数据，包括多个BEML的电子邮件对话、客户的详细记录、多个办公室间的备忘录、货运发票和其他文档

• https://cybleinc.com/2020/06/09/beml-indian-defence-contractor-suffers-data-breach-politically-motivated/

日本汽车制造商本田已经证实受到网络攻击，影响了其部分业务，包括日本以外的生产系统

• https://twitter.com/HondaCustSvc/status/1270048801307234304

[漏洞]

遗留LVFS S3 bucket接管和CVE-2020-10759 fwupd签名验证绕过

• https://github.com/justinsteven/advisories/blob/master/2020_fwupd_dangling_s3_bucket_and_CVE-2020-10759_signature_verification_bypass.md

内核内存远程泄露漏洞SMBleed，与SMBGhost漏洞组合使用，可实现RCE

• https://blog.zecops.com/vulnerabilities/smbleedingghost-writeup-chaining-smbleed-cve-2020-1206-with-smbghost/

GKE Kubelet TLS引导程序提权简介

• https://rhinosecuritylabs.com/cloud-security/kubelet-tls-bootstrap-privilege-escalation/

RoyalTS SSH隧道认证绕过[CVE-2020-13872]

• https://hacktips.it/royalts-ssh-tunnel-authentication-bypass/

滥用Windows组策略接管Windows系统（CVE-2020-1317）

• https://www.cyberark.com/resources/threat-research-blog/group-policies-going-rogue

[恶意代码]

黑客组织TA410，在针对美国公用事业部门的攻击中使用新的名为FlowCloud的恶意软件家族

• https://www.proofpoint.com/us/blog/threat-insight/ta410-group-behind-lookback-attacks-against-us-utilities-sector-returns-new

揭秘黑客组织Dark Basin，在过去七年的时间里受雇主委托攻击了全球数千名记者、团体和政治人物

• https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/

黑客正在攻击一家德国跨国公司的高层管理人员，该公司受德国政府委托采购个人防护设备（PPE），攻击者试图窃取100多位高级主管的用户凭证

• https://securityintelligence.com/posts/german-task-force-for-covid-19-medical-equipment-targeted-in-ongoing-phishing-campaign/

[工具]

kerbrute：kerberos爆破脚本，基于impacket

• https://github.com/TarlogicSecurity/kerbrute

ntlm_theft：生成多种类型的可以窃取NTLMv2 hash的Payload

• https://github.com/Greenwolf/ntlm_theft
• https://medium.com/greenwolf-security/ntlm-theft-a-file-payload-generator-for-forced-ntlm-hash-disclosure-2d5f1fe5b964

urlcrazy：生成并测试域名的拼写错误和变体，以检测和执行域名拼写抢注、URL劫持、网络钓鱼和企业间谍活动

• https://github.com/urbanadventurer/urlcrazy

[技术]

实战针对Windows平台的渗透测试框架Evil-Winrm

• https://www.hackingarticles.in/evil-winrm-winrm-pentesting-framework/

**在线投票系统的安全性分析

• https://internetpolicy.mit.edu/wp-content/uploads/2020/06/OmniBallot.pdf

滥用Windows Telemetry实现驻留

• https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence/

在Google Colab上运行hashcat，支持会话备份和恢复

• https://github.com/someshkar/colabcat

骗子正在优化SEO结果以吸引受害者

• https://blog.avast.com/scammers-using-seo-to-lure-victims-avast

20200609

[漏洞]

TLS 1.3会话恢复工作不需要主密钥，可导致MITM（CVE-2020-13777）

• https://gitlab.com/gnutls/gnutls/-/issues/1011

XSS导致数据库凭证泄露与数据库访问

• https://medium.com/bugbountywriteup/xss-to-database-credential-leakage-database-access-story-of-total-luck-77c990be8ab2

使用honggfuzz挖掘到的VLC双重释放漏洞（CVE-2019-12874）

• https://www.pentestpartners.com/security-blog/double-free-rce-in-vlc-a-honggfuzz-how-to/

印度政府为实现“数字印度” 提供的在线服务Digilocker存在一个漏洞，可导致绕过密码访问用户钱包中存储的敏感信息

• https://securityaffairs.co/wordpress/104459/breaking-news/digilocker-critical-falw.html

Apache Kylin 3.0.1命令注入漏洞

• https://community.sonarsource.com/t/apache-kylin-3-0-1-command-injection-vulnerability/25706

[工具]

hacker-container：Docker容器，包括所有的用于hacking Kubernetes Clusters的工具和命令

• https://github.com/madhuakula/hacker-container
• https://blog.madhuakula.com/hacker-container-for-kubernetes-security-assessments-7d1522e96073

Adaz：在Azure中自动部署可定制的Active Directory labs

• https://github.com/christophetd/Adaz
• https://blog.christophetd.fr/automating-the-provisioning-of-active-directory-labs-in-azure/

WindowsVulnScan：基于主机的漏洞扫描工具

• https://github.com/chroblert/WindowsVulnScan

FrameScan：一款python3编写的简易的cms漏洞检测框架

• https://github.com/qianxiao996/FrameScan

SpoofWeb：一键部署- httpS钓鱼站

• https://github.com/klionsec/SpoofWeb

VpsEnvInstall：一键部署VPS渗透环境

• https://github.com/klionsec/VpsEnvInstall

tangalanga：Zoom会议扫描工具

• https://github.com/elcuervo/tangalanga

[技术]

使用SharpChisel进行内网穿透

• https://medium.com/@shantanukhande/red-team-using-sharpchisel-to-exfil-internal-network-e1b07ed9b49
• https://github.com/shantanu561993/SharpChisel

使用HoneyDB、Suricata和Azure Sentinel分析蜜罐数据并提供有用的见解

• https://blog.rothe.uk/analysing-honeypot-data/

漏洞利用练习：Protostar | Format 3

• https://medium.com/bugbountywriteup/expdev-exploit-exercise-protostar-format-3-33e8d8f1e83

理解证书锁定（Certificate pinning）

• https://littlemaninmyhead.wordpress.com/2020/06/08/understanding-certificate-pinning/

HTB：Nest

• https://khaoticdev.net/?p=852

系统性构建安全的系统

• https://github.com/veeral-patel/learn-security-engineering

域驻留：DC Shadow攻击

• https://www.hackingarticles.in/domain-persistence-dc-shadow-attack/

逆向联想电脑UEFI密码管理

• https://www.synacktiv.com/posts/reverse-engineering/a-journey-in-reversing-uefi-lenovo-passwords-management.html

[其他]

CORS one liner command exploiter

• https://github.com/kleiton0x00/CORS-one-liner
• https://medium.com/bugbountywriteup/cors-one-liner-command-exploiter-88c06903cca0

20200608

[资讯]

美国的学生贷款公司被发现一个可公开访问的AWS S3存储库，包括贷款支持人员与消费者之间5万5千个通话记录，和25000多个PDF（其中许多是收入证明的扫描件或照片）

• https://cybernews.com/security/student-loan-company-stole-millions-leaks-phone-calls-ssns-tax-records/

印度视频点播巨头ZEE5已被黑客入侵，攻击者扬言要在网络犯罪地下市场上出售窃取数据库，其中包括超过150GB的实时数据以及该网站的源代码（Bitbucket）

• https://securityaffairs.co/wordpress/104396/data-breach/zee5-hack.html

VT圣安东尼奥航空航天公司的系统被Maze勒索软件入侵，攻击者声称已窃取了1.5 TB的未加密文件，并向VT SAA索要赎金

• https://www.bleepingcomputer.com/news/security/us-aerospace-services-provider-breached-by-maze-ransomware/

[漏洞]

通过更改- http响应进行简单的垂直特权升级

• https://medium.com/bugbountywriteup/from-3-99-to-1-650-usd-part-i-simple-vertical-privilege-escalation-by-changing-- http-response-2fd8ebb7f67b

SWARCO制造的交通信号灯控制器中的一个关键漏洞，可能已被攻击者用来破坏交通信号灯

• https://securityaffairs.co/wordpress/104380/hacking/traffic-lights-controllers-flaw.html

Facebook上的另一个图像删除漏洞

• https://blog.darabi.me/2020/06/image-removal-vulnerability-on-facebook.html

Weblogic Vuln POC EXP cve-2020-2551 cve-2020-2555 cve-2020-2883

• https://github.com/zzwlpx/weblogicPoc

[恶意代码]

谷歌商店发现的Barcode Reader Apps，使用新的广告欺诈技术

• https://blog.trendmicro.com/trendlabs-security-intelligence/barcode-reader-apps-on-google-play-found-using-new-ad-fraud-technique/

谷歌商店发现新的广告欺诈App Tekya

• https://blog.trendmicro.com/trendlabs-security-intelligence/new-tekya-ad-fraud-found-on-google-play/

一个VBS样本的检测分析环境的点

• https://www.joesecurity.org/blog/745788703303246608

Java编写的跨平台勒索软件Tycoon

• https://blogs.blackberry.com/en/2020/06/threat-spotlight-tycoon-ransomware-targets-education-and-software-sectors

[工具]

git-scanner：在漏洞赏金/渗透测试中，扫描目标网站的公开可访问的.git存储库，并转储.git存储库的内容

• https://github.com/HightechSec/git-scanner

JSshell：JavaScript编写的反向Shell，用于XSS远程利用，或查找盲XSS

• https://github.com/shelld3v/JSshell

astsu：使用scapy开发的网络扫描工具

• https://github.com/ReddyyZ/astsu

jshole：JavaScript漏洞组件扫描器，基于RetireJS

• https://github.com/callforpapers-source/jshole

recox：用于Web侦察的Shell脚本

• https://github.com/samhaxr/recox

idacode：在VSCode中执行和调试IDA脚本

• https://github.com/ioncodes/idacode

ShellcodeLoader：将shellcode用rsa加密并动态编译exe，自带几种反沙箱技术

• https://github.com/Hzllaga/ShellcodeLoader

[技术]

编写简易的多态引擎

• https://pop.rdi.sh/writing-a-simple-polymorphic-engine/

源码分析101

• https://berk.red/Source-Code-Analysis

通过取证技术，挖掘红队活动

• https://www.exploit-db.com/docs/48498

域驻留：AdminSDHolder

• https://www.hackingarticles.in/domain-persistence-adminsdholder/

对Solidity编译器solc进行模糊测试

• https://blog.trailofbits.com/2020/06/05/breaking-the-solidity-compiler-with-a-fuzzer/

Kubernetes审计

• https://dzone.com/articles/kubernetes-auditing

20200605

[资讯]

总部位于美国新泽西州的商业服务公司Conduent遭受Maze勒索软件攻击，攻击者窃取了未加密的文件和加密的设备。为了证明攻击的真实性，攻击者发布了价值1GB的文件，各种财务电子表格、客户审计、发票、佣金对帐单和其他杂项文档

• https://www.bleepingcomputer.com/news/security/business-services-giant-conduent-hit-by-maze-ransomware/

[漏洞]

Cyblesoft的Thinfinity VirtualUI Web应用程序中发现了两个漏洞，分别为路径遍历和- http标头注入，可以利用执行XSS有效负载

• https://labs.nettitude.com/blog/cve-2019-16384-85-cyblesoft-thinfinity-virtualui-path-traversal-- http-header-injection/

Apache Tomcat反序列化导致RCE漏洞（Apache Tomcat RCE）

• https://www.redtimmy.com/java-hacking/apache-tomcat-rce-by-deserialization-cve-2020-9484-write-up-and-exploit/

When it’s not only about a Kubernetes CVE…

• https://medium.com/@BreizhZeroDayHunters/when-its-not-only-about-a-kubernetes-cve-8f6b448eafa8

谷歌云平台OS Login提权

• https://gitlab.com/gitlab-com/gl-security/gl-redteam/red-team-tech-notes/-/tree/master/oslogin-privesc-june-2020

[恶意代码]

朝鲜背景APT组织Higaisa在攻击中使用快捷方式文件

• https://blog.malwarebytes.com/threat-analysis/2020/06/higaisa/

GoLang编写的恶意软件Stealthworker，对Web服务和平台进行爆破

• https://blogs.akamai.com/sitr/2020/06/stealthworker-golang-based-brute-force-malware-still-an-active-threat.html

[工具]

GitMonitor：Github扫描系统，可以根据规则查找泄露的敏感信息

• https://github.com/Talkaboutcybersecurity/GitMonitor

shannon-dbg：Shannon基带调试器

• https://github.com/synacktiv/shannon-dbg

TinyInst：轻量级DBI库

• https://github.com/googleprojectzero/TinyInst

[技术]

理解与滥用Access Token

• https://medium.com/@seemant.bisht24/understanding-and-abusing-access-tokens-part-ii-b9069f432962
• https://medium.com/@seemant.bisht24/understanding-and-abusing-process-tokens-part-i-ee51671f2cfa

在几分钟内使用Terraform模块在AWS上设置SSH堡垒

• https://www.padok.fr/en/blog/ssh-bastion-aws-terraform

使用Unicorn仿真框架分析Shellcode的方法

• https://darungrim.com/research/2020-06-04-UsingMemoryArtifactsAsShellcodeEmulationEnvironment.html

Be careful what you request for

• https://r2c.dev/blog/2020/be-careful-what-you-request-for-django-method/

二进制数据隐藏在VB6执行文件中

• http://sandsprite.com/blogs/index.php?uid=7&pid=491&year=2020

[其他]

Game Hacking资源收集

• https://github.com/mrT4ntr4/CTF-Game-Challenges

20200604

[资讯]

Android手机现神奇漏洞：将特定图片设置为三星手机的壁纸，可导致手机崩溃。此漏洞需更新固件才能解决

• https://twitter.com/UniverseIce/status/1267295176046723072

旧金山员工退休系统（SFERS）遭受了数据泄露，包含大约74,000个SFERS成员的信息

• https://www.bleepingcomputer.com/news/security/san-francisco-retirement-program-sfers-suffers-data-breach/

[漏洞]

视频软件Zoom发现2个新漏洞，可导致代码执行

• https://blog.talosintelligence.com/2020/06/vuln-spotlight-zoom-code-execution-june-2020.html

SAP的Sybase Adaptive Server Enterprise软件存在严重漏洞，可导致数据库被完全接管

• https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/system-takeover-through-new-sap-ase-vulnerabilities/

十大漏洞：内部基础架构渗透测试

• https://www.infosecmatter.com/top-10-vulnerabilities-internal-infrastructure-pentest/

[恶意代码]

Magecart live, again ! (not for long ?)

• https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Additional%20Analysis/Magecart/2020-06-02/Analysis.md

黑客组织Cycldek最新活动和操作方式

• https://securelist.com/cycldek-bridging-the-air-gap/97157/

挖矿软件Kinsing

• https://blog.redteam.pl/2020/06/kinsing-malware-liferay.html

macOS平台后门TinyTim（基于开源Unix后门Tiny SHell的改版）

• https://objective-see.com/blog/blog_0x58.html

[工具]

DynamicKernelShellcode：演示x64内核Shellcode如何动态查找和使用内核(从ntoskrnl导出的)API

• https://github.com/DownWithUp/DynamicKernelShellcode

SuperDllHijack：一种通用Dll劫持技术，不再需要手工导出Dll的函数接口了

• https://github.com/anhkgg/SuperDllHijack

C2concealer：命令行工具，随机生成Cobalt Strike使用的C2 malleable profiles

• https://github.com/FortyNorthSecurity/C2concealer

SharpC2：.NET编写的C&C框架

• https://github.com/SharpC2/SharpC2/tree/dev

安全相关的Python和Bash脚本收集

• https://github.com/PeterMosmans/security-scripts

shad0w：一个后渗透框架，用于在严密监控的环境下隐秘操作

• https://github.com/bats3c/shad0w

[技术]

JavaScript字符串串联反混淆

• https://maxkersten.nl/binary-analysis-course/analysis-scripts/javascript-string-concatenation-deobfuscation/

Android渗透环境配置

• https://securityjunky.com/guide-to-setting-up-android-pentesting-lab/

20200603

[资讯]

西班牙在线学习平台8Belts，因AWS S3 Storage Bucket配置错误导致超过10万用户私人详细信息被泄露

• https://www.vpnmentor.com/blog/report-8belts-leak/

美国国家铁路旅客公司（Amtrak）披露了一项数据泄露事件，泄露发生在4月16日晚上。该公司没有透露有多少个帐户被盗

• https://www.zdnet.com/article/amtrak-discloses-data-breach-potential-leak-of-sensitive-customer-information/

[漏洞]

LG手机漏洞，影响过去7年内出售的Android智能手机，可导致冷启动攻击（CVE-2020-12753）

• https://douevenknow.us/post/619763074822520832/an-el1el3-coldboot-vulnerability

IP-in-IP隧道协议中的漏洞可被利用来进行DoS攻击并绕过安全控制，影响思科和其他供应商的设备（CVE-2020-10136）

• https://kb.cert.org/vuls/id/636397

SMBGhost RCE PoC

• https://github.com/chompie1337/SMBGhost_RCE_PoC
• https://ricercasecurity.blogspot.com/2020/04/ill-ask-your-body-smbghost-pre-auth-rce.html

云服务交付平台VMware Cloud Director的一个漏洞，可导致平台被完全接管（CVE-2020-3956）

• https://citadelo.com/en/blog/full-infrastructure-takeover-of-vmware-cloud-director-CVE-2020-3956/

[恶意代码]

恶意软件家族Team9深入分析

• https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/

深入分析影响了葡萄牙和巴西的一个银行木马

• https://seguranca-informatica.pt/in-depth-analysis-of-a-trojan-banker-impacting-portugal-and-brazil/#.XtbdLToza5h

[工具]

WinDbg_Scripts：使用调试器数据模型的WinDbg脚本

• https://github.com/yardenshafir/WinDbg_Scripts

Forerunner：快速和可扩展的网络扫描库，支持多线程、ping探测和扫描获取

• https://github.com/jasondrawdy/Forerunner

Attacker-Group-Predictor：基于ATT&CK框架，使用攻击技术和攻击使用的软件，预测发起攻击的组织

• https://github.com/omergunal/Attacker-Group-Predictor

DNS爆破单词表生成器

• https://github.com/codingo/DNSCewl

[技术]

ARM反汇编工具研究

• https://yajin.org/papers/issta20.pdf

快速逆向二进制文件的秘诀：视觉模式识别

• https://towardsdatascience.com/malware-analysis-with-visual-pattern-recognition-5a4d087c9d26

Active Directory安全清单

• https://www.cert.ssi.gouv.fr/uploads/guide-ad.html

Windows主机上通过系统调用实现Shellcode注入

• https://www.solomonsklash.io/syscalls-for-shellcode-injection.html
• https://github.com/SolomonSklash/SyscallPOC

让Windows系统10年前的老漏洞重新焕发光彩

• https://itm4n.github.io/chimichurri-reloaded/

学习Shodan基础使用

• https://github.com/ninoseki/shodan-dojo

使用CERT的基本Fuzzing框架对Left4Dead 2进行Fuzzing

• https://rhinosecuritylabs.com/research/fuzzing-left4dead-2-with-fuzzing-framework/

检测内存中程序集执行的另一种方法，以及进一步改进的潜在策略

• https://www.mdsec.co.uk/2020/06/detecting-and-advancing-in-memory-net-tradecraft/

20200602

[资讯]

REvil勒索软件背后的黑客阻止攻击了新的目标，包括：来自知识产权律师事务所Vierra Magen Marcus的1.2TB数据，英国的电力批发市场Elexon和斯里兰卡电信电信运营商

• https://www.hackreports.com/revil-hacker-group-data-breach-vierra-magen-marcus-and-elexon-data-leak/

新兴的新电子支付平台BHIM遭受了大规模数据泄露，泄露数据共409 GB，包括大约700万印度人的敏感财务数据

• https://www.vpnmentor.com/blog/report-csc-bhim-leak/

开源CMS Joomla上周公布发生数据泄露，影响2,700个resources.joomla.org帐户，泄露内容包括：全名、营业地址、公司电子邮件地址、营业电话、公司网址、业务性质、加密密码（散列）、IP地址、通讯订阅首选项

• https://thehackernews.com/2020/06/joomla-data-breach.html

[漏洞]

Tokopedia反射XSS

• https://medium.com/bugbountywriteup/information-disclosure-and-reflected-xss-on-tokopedia-1b3a00ec64c6

我是如何发现Facebook的一个SSRF漏洞

• https://medium.com/@win3zz/how-i-made-31500-by-submitting-a-bug-to-facebook-d31bb046e204

[恶意代码]

Maze: the ransomware that introduced an extra twist

• https://blog.malwarebytes.com/threat-spotlight/2020/05/maze-the-ransomware-that-introduced-an-extra-twist/

[工具]

infhook19041：SyscallHook改版，使SyscallHook可在win10 19041可用

• https://github.com/fIappy/infhook19041

ADCollector：一个轻量级工具，快速从Active Directory环境中提取有价值的信息，用于攻击和防御

• https://github.com/dev-2null/ADCollector

bing-ip2hosts：一个Bing.com网站爬虫，通过IP地址发现网站

• https://github.com/urbanadventurer/bing-ip2hosts

pakkero：Go语言编写的加壳器，可以保护脚本和ELF文件

• https://github.com/89luca89/pakkero

Collabfiltrator：使用Burp Collaborator通过DNS提取盲RCE输出。

• https://github.com/0xC01DF00D/Collabfiltrator

enumy：针对Linux系统的后渗透工具，枚举常见提权漏洞

• https://github.com/luke-goddard/enumy

[技术]

凭证转储：LAPS

• https://www.hackingarticles.in/credential-dumpinglaps/

Win10内置数据包嗅探器PktMon简介

• https://isc.sans.edu/diary/Windows+10+Built-in+Packet+Sniffer+-+PktMon/26186

绕过Glibc安全链接缓解措施

• https://www.researchinnovations.com/post/bypassing-the-upcoming-safe-linking-mitigation

Amazon S3一个奇怪的“子域名接管”模式

• https://medium.com/@secureITmania/weird-subdomain-take-over-pattern-of-amazon-s3-75165ab2e883

攻击FreeIPA，Part3：寻找路径

• https://posts.specterops.io/attacking-freeipa-part-iii-finding-a-path-677405b5b95e

[其他]

跟驻留/持久化有关的资源，包括平台：Windows、Linux、macOS、Android、iOS

• https://github.com/alphaSeclab/persistence

关于数据泄露后人们是否会修改密码的研究报告

• https://www.ieee-security.org/TC/SPW2020/ConPro/papers/bhagavatula-conpro20.pdf

20200601

[资讯]

今年3月份为暗网提供托管服务的最大的免费网络提供商Daniel's Hosting被黑，攻击者窃取了其数据库，清楚了所有的服务器。两周后，DH永久关闭了其服务。5月底，一个名叫KingNull的黑客在文件托管门户网站上上传了DH被盗数据库的副本。根据对数据转储的粗略分析，泄漏的数据包括3,671个电子邮件地址，7,205个帐户密码和.onion（暗网）域的8,580个私钥

• https://www.zdnet.com/article/hacker-leaks-database-of-dark-web-hosting-provider/

几周前，威胁情报公司Cyble在暗网中发现了一个数据库，其中包含超过2000万**公民的详细信息。数据库大小为3.5 GB，公开的数据包括全名、完整地址、ID、性别、出生日期和其他信息 s

• https://securityaffairs.co/wordpress/103990/deep-web/taiwan-db-dark-web.html

澳大利亚最受欢迎的体育迷网站BigFooty被发现泄漏了大约132 GB数据，包括7000万条记录，设计100,000个成员的私人信息

• https://hotforsecurity.bitdefender.com/blog/bigfooty-com-leaks-70-million-records-from-sports-fan-members-23399.html

[漏洞]

“Sign in with Apple”功能的0Day, 可导致账户被完全接管

• https://bhavukjain.com/blog/2020/05/30/zeroday-signin-with-apple/

在ZyXel V5.13固件(VMG3925-B10B)路由器(后认证)中添加root用户的漏洞

• http://f-60.com/post/0x01.html

Return of the iOS sandbox escape: lightspeed's back in the race

• https://www.synacktiv.com/posts/exploit/return-of-the-ios-sandbox-escape-lightspeeds-back-in-the-race.html

短视频App账户接管漏洞

• https://servicenger.com/blog/mobile/mitron-app-account-takeover-vulnerability-unpatched/

r0pwn：Android Debug Bridge RCE exploit

• https://github.com/enty8080/r0pwn

Wordpress插件BBPress逻辑漏洞，导致未认证提权（CVE-2020-13693）

• https://b.ou.is/articles/2020-05/CVE-2020-13693

[恶意代码]

在一系列针对不同国家/地区组织的攻击中使用的隐写术

• https://ics-cert.kaspersky.com/reports/2020/05/28/steganography-in-targeted-attacks-on-industrial-enterprises/

IRC僵尸网络逆向，Part1：在IDA PRO中准备用于分析的二进制文件

• https://www.youtube.com/watch?v=JPvcLLYR0tE

IcedID新版本，隐藏配置文件

• https://www.group-ib.com/blog/icedid

针对拉丁美洲的银行木马Grandoreiro最新版添加了Latenbot-C2功能

• https://seguranca-informatica.pt/the-updated-grandoreiro-malware-equipped-with-latenbot-c2-features-in-q2-2020-now-extended-to-portuguese-banks/#.XtRFYDoza5g

[工具]

SSRFire：自动SSRF探测器

• https://github.com/micha3lb3n/SSRFire

ThreadSpy：硬件辅助的线程劫持，劫持所有正在运行的线程，而不需要动态Hook任何指令字节，可以将所有类型的代码或R/W内存注入到所需的进程上下文中

• https://github.com/Kelvinhack/ThreadSpy

ANDRAX：针对Android、ARM设备和树莓派等的渗透测试平台

• https://gitlab.com/crk-mythical/andrax-hackers-platform/

droidfiles：从Android目录、内部和外部存储中获取文件（图片，下载，Whatsapp，视频等）

• https://github.com/thelinuxchoice/droidfiles

AMSITrigger：Hunting for malicious strings

• https://github.com/RythmStick/AMSITrigger

interlock：基于Cloudflare API的DNS故障转移和管理工具

• https://github.com/fnzv/interlock

django-DefectDojo：漏洞关联和安全编排工具

• https://github.com/DefectDojo/django-DefectDojo

terragoat：一个学习和培训项目，演示常见的配置错误如何进入生产云环境

• https://github.com/bridgecrewio/terragoat

go-gtfo：从终端搜索gtfobins

• https://github.com/mzfr/go-gtfo

angry_gadget：在libc中找到一个gadget RCE的工具

• https://github.com/ChrisTheCoolHut/angry_gadget

fisy-fuzz：文件系统Fuzzing框架

• https://github.com/0xricksanchez/fisy-fuzz

[技术]

进程注入时用GetEnvironmentVariable替换WriteProcessMemory

• https://x-c3ll.github.io/posts/GetEnvironmentVariable-Process-Injection/

绕过LastPass的“高级” YubiKey MFA：一次中间人钓鱼攻击

• https://pberba.github.io/security/2020/05/28/lastpass-phishing/

针对英特尔和AMD的CPU的新的抗噪声攻击，使基于刷新的攻击有效

• https://thehackernews.com/2020/05/noise-resilient-flush-attack.html

HTB：Resolute

• https://t3chnocat.com/htb-resolute/

2020.Linux加固和其他配置

• https://vez.mrsk.me/linux-hardening.html

Hardware Root of Trust：Bios and UEFI

• https://maxfieldchen.com/posts/2020-05-31-Hardware-Root-Of-Trust-Bios-UEFI.html

20200529

[资讯]

日本电信巨头NTT表示，黑客破坏了其内部网络，并窃取了621位客户的数据

• https://www.zdnet.com/article/fortune-500-company-ntt-discloses-security-breach/

Hacking Team创始人和前CEO在其官方LinkedIn帐户上宣称其老东家“Hacking Team已死”

• https://www.vice.com/en_us/article/n7wbnd/hacking-team-is-dead

美国的独立艺术家市场Minted发生数据泄露，黑客在暗网出售包含500万用户记录的数据库

• https://www.bleepingcomputer.com/news/security/minted-discloses-data-breach-after-5m-user-records-sold-online/

[漏洞]

Wordpress插件PageLayer被发现几个严重漏洞，影响20万网站

• https://www.wordfence.com/blog/2020/05/high-severity-vulnerabilities-in-pagelayer-plugin-affect-over-200000-wordpress-sites/

[恶意代码]

对去年发现的一起利用Google Chrome和Windows 0Day漏洞的经典水坑攻击的深入分析

• https://securelist.com/the-zero-day-exploits-of-operation-wizardopium/97086/

Octopus Scanner恶意软件：攻击开源供应链，在Github存储库中识别NetBeans项目文件，并将恶意有效载荷嵌入项目文件和构建JAR文件中，而存储库所有者可能完全不知情

• https://securitylab.github.com/research/octopus-scanner-malware-open-source-supply-chain

美国NSA发布告警：俄罗斯APT阻止Sandworm Team自2019年起，一直在利用Exim邮件传输代理（MTA）软件中的一个严重漏洞（CVE-2019-10149）

• https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/2196511/exim-mail-transfer-agent-actively-exploited-by-russian-gru-cyber-actors/

改进版的Valak Loader，针对Microsoft Exchange服务器，窃取企业的邮件信息、密码和企业证书

• https://www.cybereason.com/blog/valak-more-than-meets-the-eye

Hoaxcalls僵尸网络遭遇失败的故事

• https://blog.radware.com/security/botnets/2020/05/ghosting-bots-the-story-of-hoaxcalls-failures/

[工具]

基于DynamoRIO的恶意代码分析插件Dynamic Data Resolver (DDR)发布1.0beta

• https://blog.talosintelligence.com/2020/05/dynamic-data-resolver-1-0.html

DotNetDeserializationScanner：扫描.net程序集中的反序列化漏洞

• https://github.com/leechristensen/DotNetDeserializationScanner

[技术]

VPN安全及漏洞简介

• https://blog.securelayer7.net/guide-to-vpn-security-vulnerabilities/

One ring (zero) to rule them all.

• https://medium.com/@b1tst0rm/one-ring-zero-to-rule-them-all-9ec99d914c68

探索macOS日历警报，Part2：提取数据（CVE-2020-3882）

• https://research.nccgroup.com/2020/05/28/exploring-macos-calendar-alerts-part-2-exfiltrating-data-cve-2020-3882/

从Burp Intruder输出中提取文件

• https://www.n00py.io/2020/05/extracting-files-from-burp-intruder-output/
• https://github.com/n00py/BurpIntruderDownloader

漏洞利用练习：Protostar

• https://medium.com/bugbountywriteup/expdev-exploit-exercise-protostar-format-1-c5182332a69a
• https://medium.com/bugbountywriteup/expdev-exploit-exercise-protostar-format-2-73ef08011a8c

流量隐藏：- http request smuggling

• https://blog.detectify.com/2020/05/28/hiding-in-plain-sight-- http-request-smuggling/

绕过WAF执行XSS

• https://medium.com/bugbountywriteup/bypassing-waf-to-perform-xss-2d2f5a4367f3

漏洞扫描的优缺点

• https://www.itgovernance.co.uk/blog/the-pros-and-cons-of-vulnerability-scanning

对开源软件Ansible（软件自动配置管理和部署）进行安全评估

• https://blog.quarkslab.com/ansible-security-assessment.html

入侵胖客户端简介，Part4：程序集

• https://blog.netspi.com/introduction-to-hacking-thick-clients-part-4-the-assemblies/

[其他]

Verizon发布的2020数据泄露报告

• https://enterprise.verizon.com/resources/reports/2020-data-breach-investigations-report.pdf

20200528

[资讯]

2019年最受欢迎的黑客工具，Python和Go高居榜首

• https://www.imperva.com/blog/python-and-go-top-the-chart-of-2019s-most-popular-hacking-tools/

黑客论坛可免费下载2600万个LiveJournal帐户信息，数据库包括电子邮件地址、用户名、配置文件URL和密码（最初密码为MD5，已转换为纯文本）

• https://www.bleepingcomputer.com/news/security/26-million-livejournal-accounts-being-shared-on-hacker-forums/

总部位于加利福尼亚州的软件公司Tellus在Amazon建议存储服务上托管的敏感数据可公开访问，数据为6,729个CSV文件，来源于公司旗下的房地产App，内容包括该用户记录、聊天日志和交易记录等

• https://cybernews.com/security/real-estate-app-leaking-thousands-of-user-records-and-sensitive-private-messages/

软件安全状态：开源版本。对85,000个应用程序中的开源库进行了深入分析，70%应用程序具有一个安全漏洞，该漏洞可追溯到一个或多个开源库

• https://info.veracode.com/report-state-of-software-security-open-source-edition.html

[漏洞]

splwow64.exe任意指针解引用漏洞导致的IE浏览器沙箱逃逸漏洞

• https://byteraptors.github.io/windows/exploitation/2020/05/24/sandboxescape.html

视频游戏Left4Dead 2缓冲区溢出漏洞导致代码执行

• https://rhinosecuritylabs.com/research/buffer-overflow-leading-to-code-execution-in-left4dead-2/

[恶意代码]

挖矿软件Mockingbird从2019年12月起已感染超过1000家企业系统

• https://redcanary.com/blog/blue-mockingbird-cryptominer/

基于Java的勒索软件PonyFinal

• https://securityaffairs.co/wordpress/103885/malware/ponyfinal-ransomware-attacks.html

[工具]

OhMyQR：社会工程学攻击工具，影响所有依赖“扫描二维码登陆”的App，扫描攻击者的二维码，实现会话劫持

• https://github.com/thelinuxchoice/ohmyqr

RainbowSQL：非常快的dork&SQL注入扫描器

• https://github.com/syrex1013/RainbowSQL

APKEnum：用于Android应用程序的被动枚举

• https://github.com/shivsahni/APKEnum

bloaty：对二进制文件进行深入分析，准确地将二进制文件的每个字节都归到产生它的符号或编译单元

• https://github.com/google/bloaty

uthenticode：验证Windows PE二进制文件Authenticode签名的库，跨平台

• https://github.com/trailofbits/uthenticode
• https://blog.trailofbits.com/2020/05/27/verifying-windows-binaries-without-windows/

winchecksec：静态检测Windows二进制文件的安全特性

• https://github.com/trailofbits/winchecksec

keimpx：通过SMB快速检查网络上的有效凭证

• https://github.com/nccgroup/keimpx

[技术]

USBFuzz：通过设备模拟Fuzz USB驱动程序的框架，使用一个软件模拟的USB设备来提供随机设备数据到驱动程序

• http://hexhive.epfl.ch/publications/files/20SEC3.pdf

LadderLeak: Breaking ECDSA With Less Than One Bit Of Nonce Leakage

• https://eprint.iacr.org/2020/615

Shellcode：回收Z80、8088、6502、8086和68K架构的压缩算法

• https://modexp.wordpress.com/2020/05/27/komposite-shellcode/

凭证转储：DCSync攻击

• https://www.hackingarticles.in/credential-dumping-dcsync-attack/

创建网络安全实验室

• https://medium.com/@robertscocca/building-a-cyber-security-lab-4874bddd056b

使用LLVM来防止Objective-C通过去虚拟化进行混合

• https://tech.guardsquare.com/posts/objc-methodcall-lowering/

在AVR固件上使用Z3公式（使用python）打破使用线性不等式或等式（如可满足性模理论）的弱密码检查器。

• https://medium.com/@ryancor/using-z3-theorem-on-avr-firmware-c6d2f45ac9c2

使用谷歌云存储的网络钓鱼活动

• https://isc.sans.edu/forums/diary/Frankensteins+phishing+using+Google+Cloud+Storage/26174/

C++异常处理内部原理

• https://monoinfinito.wordpress.com/series/exception-handling-in-c/

使用QEMU仿真固件

• https://www.zerodayinitiative.com/blog/2020/5/27/mindshare-how-to-just-emulate-it-with-qemu

为何反病毒引擎看起来像内核Rootkit

• https://volatility-labs.blogspot.com/2020/05/when-anti-virus-engines-look-like.html

横线渗透：Pass the Ticket攻击

• https://www.hackingarticles.in/lateral-movement-pass-the-ticket-attack/

通过分析和利用TurboFan中的漏洞来检查利用Chrome中的1-Day漏洞是否仍然可行

• https://blog.exodusintel.com/2020/02/24/a-eulogy-for-patch-gapping-chrome/

Bug Hunting Stories: Schneider Electric & the Andover Continuum Web.Client

• https://www.cyberark.com/threat-research-blog/bug-hunting-stories-schneider-electric-the-andover-continuum-web-client/

20200527

[资讯]

Android严重漏洞StrandHogg 2.0，攻击者能够访问几乎所有应用程序（CVE-2020-0096）。利用此漏洞，一旦设备上安装了恶意应用，攻击者就可以访问私人SMS消息和照片，窃取受害者的登录凭据，跟踪GPS移动，进行和/或记录电话对话以及通过电话的摄像头和麦克风进行间谍活动。

• https://promon.co/strandhogg-2-0/

泰国主流移动网络运营商Advanced Info Service（AIS）泄漏了包含83亿条互联网记录的数据库

• https://rainbowtabl.es/2020/05/25/thai-database-leaks-internet-records/

暗网出售4750万印度人Truecaller记录，数据来自2019年，包括电话号码、运营商、姓名、性别、城市、电子邮件、Facebook ID等。售价仅1000美元

• https://cybleinc.com/2020/05/26/47-5-million-indian-truecaller-records-on-sale-for-only-1000/

[漏洞]

Moodle Security的一个存储XSS导致RCE的漏洞

• https://cube01.io/blog/Moodle-DOM-Stored-XSS-to-RCE.html

Uber基础设施中发现的一个Docker容器管理接口，利用Websocket接口实现的TCP代理机制没有添加限制，无认证即可访问

• https://medium.com/@andrewaeva_55205/how-dangerous-is-request-splitting-a-vulnerability-in-golang-or-how-we-found-the-rce-in-portainer-7339ba24c871

[恶意代码]

Turla APT使用的ComRAT远控的最新变种，使用Gmail接收指令和渗透数据

• https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf

AnarchyGrabber木马的更新版本，窃取受害者的纯文本密码，并在Discord上感染受害者的朋友

• https://www.tripwire.com/state-of-security/security-data-protection/updated-anarchygrabber-steals-passwords-spreads-to-discord-friends/

袭击意大利的[F]Unicorn勒索软件，利用假冒的新冠感染地图做诱饵

• https://www.bleepingcomputer.com/news/security/new-f-unicorn-ransomware-hits-italy-via-fake-covid-19-infection-map/

双枪团伙新动向，借云服务管理数十万僵尸网络

• https://blog.netlab.360.com/shuang-qiang-zui-xin-huo-dong-fen-xi-bao-gao-nei-bu-bao-gao-ban/

[工具]

sgn：一种多态二进制编码器，可生成静态不可检测的二进制有效负载

• https://github.com/EgeBalci/sgn

使用wordlist和爆破策略，枚举Java RMI函数，并利用RMI参数反序列化漏洞

• https://github.com/BishopFox/rmiscout

[技术]

对实时操作系统Zephyr和硬件独立的Bootloader MCUboot的安全评估

• https://research.nccgroup.com/2020/05/26/research-report-zephyr-and-mcuboot-security-assessment/

AppDomainManager注入与检测

• https://pentestlaboratories.com/2020/05/26/appdomainmanager-injection-and-detection/

JavaScript中的文本隐藏

• https://blog.bitsrc.io/how-to-hide-secrets-in-strings-modern-text-hiding-in-javascript-613a9faa5787

These Aren’t the Phish You’re Looking For：网络钓鱼时黑名单的绕过

• https://medium.com/@curtbraz/these-arent-the-phish-you-re-looking-for-7374c3986af5

利用Clang中的控制流完整性(CFI)对抗Exploit

• https://www.redhat.com/en/blog/fighting-exploits-control-flow-integrity-cfi-clang

[其他]

源码混淆和二进制混淆，包括多种语言和多个平台。250+工具和600+文章

• https://github.com/alphaSeclab/obfuscation-stuff

一个建立和改进你的内部红队的模型

• https://redteams.fyi/

20200526

[资讯]

3个黑客论坛：Sinful Site，SUXX.TO 和Nulled的数据发生泄露

• https://cybleinc.com/2020/05/24/this-time-the-hacking-forums-got-targeted-massive-data-leak/

访问eBay时，将运行一个脚本扫描计算机本地端口，检测远程支持和远程访问应用程序

• https://nullsweep.com/why-is-this-website-port-scanning-me/

日本日程安排应用程序Lifebear有3,670,561个帐户在暗网出售，包括电子邮件地址、用户名和密码

• https://www.facebook.com/Cyberologue/posts/913114185768816

[漏洞]

HEVD缓冲区溢出漏洞逆向与利用

• https://medium.com/@b1tst0rm/one-ring-zero-to-rule-them-all-9ec99d914c68

[恶意代码]

Sarwent恶意软件滥用开放RDP端口进行远程访问

• https://labs.sentinelone.com/sarwent-malware-updates-command-detonation/

[工具]

metasploit-omnibus：使用omnibus对metasploit-framework进行打包，与Metasploit社区版不同，只包含命令行接口和相关工具和模块

• https://github.com/rapid7/metasploit-omnibus

SharpeningCobaltStrike：实时v35/40 .NET编译器，编译linux Cobalt Strike C2

• https://github.com/cube0x0/SharpeningCobaltStrike

WinAllocTracer：Pintool，记录以下函数的调用：RtlAllocateHeap, RtlReAllocateHeap, RtlFreeHeap, VirtualAllocEx, 和VirtualFreeEx

• https://github.com/fdiskyou/WinAllocTracer

S3BucketList：Firefox插件，列出在request中找到的Amazon S3 bucket

• https://github.com/AlecBlance/S3BucketList

VulnFanatic：在漏洞研究过程中提供一个完整的参数来源跟踪选定的功能

• https://github.com/Martyx00/VulnFanatic

[技术]

渗透测试101：Working With Exploits

• https://www.infosecmatter.com/pentesting-101-working-with-exploits/

横向渗透：Pass the Cache

• https://www.hackingarticles.in/lateral-movement-pass-the-ccache/

滥用Microsoft Outlook 365来捕获NTLM

• https://www.hackingarticles.in/abusing-microsoft-outlook-365-to-capture-ntlm/

Gf-Patterns：GF Paterns For (ssrf,RCE,Lfi,sqli,ssti,idor,url redirection,debug_logic) parameters grep

• https://github.com/1ndianl33t/Gf-Patterns

Zoom规划中的端对端加密系统的白皮书

• https://github.com/zoom/zoom-e2e-whitepaper

SQL注入- MySQL注释:双破折号之谜

• https://rawsec.ml/en/sql-injection-mysql-comment/

CloudGoat 2.0逐步演练

• https://github.com/appsecco/attacking-cloudgoat2

Abusing PackageKit on Fedora/CentOS for fun & profit (from wheel to root).

• https://sysdream.com/news/lab/2020-05-25-abusing-packagekit-on-fedora-centos-for-fun-profit-from-wheel-to-root/

Windows KTM漏洞利用，Part5：漏洞检测和更好的读/写原语（CVE-2018-8611）

• https://research.nccgroup.com/2020/05/25/cve-2018-8611-exploiting-windows-ktm-part-5-5-vulnerability-detection-and-a-better-read-write-primitive/

[其他]

注入资源收集，包括：PE注入、DLL注入、进程注入、线程注入、代码注入、Shellcode注入、ELF注入、Dylib注入等

• https://github.com/alphaSeclab/injection-stuff

杀软和免杀资源收集

• https://github.com/alphaSeclab/anti-av

Radare2资源收集

• https://github.com/radareorg/awesome-radare2

20200525

[资讯]

苹果商店教育类排名第4的数学App Mathway发生数据泄露，2500万条用户记录在暗网出售，包括用户名、密码和其他数据

• https://www.hackreports.com/mathway-hacked-data-breach-25m-user-data-leak-on-dark-web/

2910万印度求职者的个人详细信息在暗网泄露，可免费下载

• https://cybleinc.com/2020/05/23/29-1-million-indian-jobseekers-personal-details-leaked-in-deepweb-for-free/

在线教育平台EduCBA披露数据泄露并重置用户秘密。该平台发出的通知中不包括有关攻击的技术细节，仅说明电子邮件、名称、密码、访问的课程等可能已被访问。

• https://securityaffairs.co/wordpress/103688/data-breach/educba-data-breach.html

知名的黑客论坛上泄露近200万印尼人的2014年选民信息，这些记录是从印度尼西亚KPU大选委员会盗窃的，包括姓名、地址、ID号、出生日期等

• https://securityaffairs.co/wordpress/103671/data-breach/voter-indonesians-leaked-online.html

日本怀疑HGV攻击导弹数据泄漏是三菱电气公司遭受网络攻击的一部分

• https://gbhackers.com/japan-suspects-hgv-missile-data-leak/

黑客论坛Nulled.ch发生数据泄露，数据被发布到有竞争关系的黑客论坛，泄露数据包括IP、邮件地址、用户名、密码（MD5）和网站管理员的私人消息历史

• https://www.facebook.com/Cyberologue/posts/912511005829134

[漏洞]

思科呼叫中心平台Unified CCX基于Java的远程管理界面中的严重反序列化漏洞，该漏洞可能允许没有凭据的远程攻击者在设备上安装恶意软件

• https://www.zdnet.com/article/cisco-critical-java-flaw-strikes-call-center-in-a-box-patch-urgently/

[恶意代码]

极其危险的Android银行木马DEFENSOR ID，可以执行一系列恶意操作，尤其是清除受害者的银行帐户或加密货币钱包，并接管其电子邮件或社交媒体帐户

• https://www.welivesecurity.com/2020/05/22/insidious-android-malware-gives-up-all-malicious-features-but-one-gain-stealth/

mazedecoder：反混淆Maze的控制流混淆

• https://github.com/shamrockhoax/mazedecoder

基于Zeus银行木马的僵尸网络Silent Night（寂静之夜）在几个地下论坛中出售。研究人员发布的186页的详细分析报告

• https://resources.malwarebytes.com/files/2020/05/The-Silent-Night-Zloader-Zbot_Final.pdf

Discord客户端被更新的恶意软件变成了密码窃取者

• https://www.bleepingcomputer.com/news/security/discord-client-turned-into-a-password-stealer-by-updated-malware/

[工具]

tlsprofiler：将web服务器的TLS配置与Mozilla TLS配置文件进行比较

• https://github.com/danielfett/tlsprofiler
• https://danielfett.de/2020/05/22/open-source-tls-scanner//

shotlooter：一个侦察工具，可以在上传到prnt.sc的截图中找到敏感数据

• https://github.com/utkusen/shotlooter

ligolo：简单易用的反向隧道

• https://github.com/sysdream/ligolo

njsscan：一个语义感知的SAST工具，可以在Node.js应用程序中找到不安全的代码模式

• https://github.com/ajinabraham/njsscan

[技术]

从浏览器攻击MSI RGB Lighting

• https://sameorigin.link/msi_rgb.html

绕过谷歌验证码reCAPTCHA v2的另类方式：选择为视力障碍者提供的音频朗读选项，录音，将音频上传到谷歌语音识别，将识别结果填入验证码。

• https://www.sociosploit.com/2020/05/bypassing-captcha-with-visually.html

OBJ_DONT_REPARSE is (mostly) Useless.

• https://www.tiraniddo.dev/2020/05/objdontreparse-is-mostly-useless.html

20200522

[资讯]

欧洲第5大银行桑坦德银行的比利时分行错误配置博客域，导致允许搜索引擎将其所有文件编入索引，这些索引文件中包含一个重要的info.json文件，该文件似乎包含其Cloudfront API密钥

• https://securityaffairs.co/wordpress/103604/breaking-news/santander-leaking-sensitive-data.html

黑客声称窃取了超过2亿个印度尼西亚公民数据，并提供230万印尼公民身份和选举数据公开下载，公开数据为2.36 GB，分为几个文件夹，所有文件夹均包含PDF文件中，包括公民的全名、地址、注册号、家庭卡号、出生日期和出生地点等

• https://www.hackread.com/hacker-leaks-indonesian-citizenship-voter-data-for-download/

黑客声称已经从澳大利亚运输和物流巨头Toll获得了200 GB以上的存档数据，并且在该公司拒绝支付赎金之后，他们已经开始泄漏该数据的“第一部分”，其中似乎包含各种类型的财务文件，例如财务报告、董事会报告、工资单文件和发票，其历史可以追溯到2003年

• https://www.securityweek.com/hackers-start-leaking-files-stolen-shipping-giant-toll

在青少年中流行的社交应用Wishbone数据库泄露，黑客公开出售获取的4000万用户的详细信息，包括用户信息、例如用户名、电子邮件、电话号码、城市/州/国家，还包括哈希密码

• https://www.zdnet.com/article/hacker-selling-40-million-user-records-from-popular-wishbone-app/

日本继续调查今年三菱电机公司遭受的网络攻击，怀疑可能泄漏包括原型导弹细节在内的数据

• https://securityaffairs.co/wordpress/103547/data-breach/mitsubishi-data-breach.html

[漏洞]

AnyConnect < 4.8.02042路径遍历导致提权漏洞PoC（CVE-2020-3153）

• https://github.com/goichot/CVE-2020-3153

谷歌云部署管理器的RCE漏洞

• https://www.ezequiel.tech/2020/05/rce-in-cloud-dm.html

Parallels Desktop提权漏洞（CVE-2020-8871）

• https://www.zerodayinitiative.com/blog/2020/5/20/cve-2020-8871-privilege-escalation-in-parallels-desktop-via-vga-device

[恶意代码]

Winnti APT利用新发现的模块化后门PipeMon，攻击韩国和**开发MMO游戏的多家视频游戏公司

• https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/

Ragnar Locker勒索软件躲避检测的奇葩方式：将49KB的勒索软件隐藏在282M的虚拟机镜像中，在目标设备上部署完整的虚拟机

• https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/

银行木马ZLoader的新变种

• https://www.proofpoint.com/us/blog/threat-insight/zloader-loads-again-new-zloader-variant-returns

伊朗背景的APT组织Chafer APT针对科威特和沙特阿拉伯关键基础设施的网络间谍活动

• https://www.bitdefender.com/files/News/CaseStudies/study/332/Bitdefender-Whitepaper-Chafer-creat4491-en-EN-interactive.pdf

2020年APT15的代码库的演变

• https://www.intezer.com/blog/research/the-evolution-of-apt15s-codebase-2020/

[工具]

protolesshooks：通过return劫持实现的Hook引擎，不需要知道函数原型

• https://github.com/vovkos/protolesshooks

Web Hacking工具收集

• https://github.com/hahwul/WebHackersWeapons

Shuffle：安全栈的自动化平台

• https://github.com/frikky/Shuffle
• https://medium.com/security-operation-capybara/introducing-shuffle-an-open-source-soar-platform-part-1-58a529de7d12

[技术]

在JS开发人员不知情的情况下，使用Websockets从开发人员窃取Secrets

• https://medium.com/@stestagg/stealing-secrets-from-developers-using-websockets-254f98d577a0

Safe-Linking安全机制：保护malloc()的单链表不被攻击者篡改

• https://research.checkpoint.com/2020/safe-linking-eliminating-a-20-year-old-malloc-exploit-primitive/

分析一次用Office扫描仪的网络钓鱼攻击

• https://tech.firstlook.media/when-your-office-scanner-is-framed-for-phishing

分析了100多万英国大公司泄露的密码

• https://www.passlo.com/blog/analysing-over-1m-leaked-passwords-from-the-uks-biggest-companies/

使用二进制仿真框架完成简单的逆向工作

• https://trib0r3.github.io/posts/qiling-scripting-and-simple-re-task/

20200521

[资讯]

路由器漏洞利用工具包GhostDNS因为犯罪分子的疏忽，源代码被杀软厂商Avast获取

• https://decoded.avast.io/simonamusilova/ghostdns-source-code-leaked/

Snake勒索软件在在线粘贴网站上发布了从德国费森尤斯医药用品窃取的部分患者数据，包括名字和姓氏、性别、出生日期、患者的国籍、职业、邮寄地址、电话号码

• https://www.bleepingcomputer.com/news/security/snake-ransomware-leaks-patient-data-from-fresenius-medical-care/

上周，勒索软件REvil背后的黑客组织威胁要泄露特普朗的数据，然而在最近却表示，数据已经在暗网上出售了，而且他们的政策是只卖一份，所以不会继续泄露特普朗的数据。

• https://www.hackread.com/revil-sold-trump-data-now-targets-food-distributors/

[漏洞]

研究人员披露了5个Windows未修补的漏洞，其中4个被评为高风险

• https://securityaffairs.co/wordpress/103507/hacking/microsoft-windows-zero-days.html

PrintDemon漏洞的微补丁(CVE-2020-1048)

• https://blog.0patch.com/2020/05/micropatching-printdemon-vulnerability.html

使用.NET处理XPS文件可能导致代码执行的漏洞（CVE-2020-0605）

• https://www.mdsec.co.uk/2020/05/analysis-of-cve-2020-0605-code-execution-using-xps-files-in-net/

2005年，qmail中发现了三个漏洞，但是从未修复，因为开发者认为默认安装清空下漏洞无法利用。现如今，这些漏洞可以用于实现RCE了（CVE-2005-1513）

• https://www.qualys.com/2020/05/19/cve-2005-1513/remote-code-execution-qmail.txt

[恶意代码]

犯罪分子使用Java远控Adwind对印度合作银行的攻击

• https://www.seqrite.com/blog/java-rat-campaign-targets-co-operative-banks-in-india/

Netwalker勒索软件用PowerShell和反射式DLL加载的方式，实现无文件感染

• https://blog.trendmicro.com/trendlabs-security-intelligence/netwalker-fileless-ransomware-injected-via-reflective-loading/

[工具]

Spray：用于获取Active Directory凭证的密码喷洒攻击工具

• https://github.com/Greenwolf/Spray

captcha22：使用神经网络破解验证码，准确率80%

• https://github.com/FSecureLABS/captcha22
• https://labs.f-secure.com/blog/releasing-the-captcha-cracken/

axiom：一组用于管理漏洞赏金和渗透测试的小型动态基础设施工具包

• https://github.com/pry0cc/axiom

harddns：RFC8484 and DoH/JSON resolver

• https://github.com/stealth/harddns

IDA发布7.5版

• https://www.hex-rays.com/products/ida/news/7_5/

[技术]

滥用WebRTC来显示Signal中的粗略位置数据

• https://medium.com/tenable-techblog/turning-signal-app-into-a-coarse-tracking-device-643eb4298447

Epic Games Ignored Epic Subdomain Takeover on their Authentication Domain, Promoted $1 Million Bounty to Address User Complaints

• https://medium.com/@thezedwards/epic-games-ignored-epic-subdomain-takeover-on-their-authentication-domain-promoted-1-million-b4d809039b0e

COM劫持实现驻留

• https://pentestlab.blog/2020/05/20/persistence-com-hijacking/

将AWS ECS任务定义武器化：以从正在运行的容器中窃取凭证

• https://rhinosecuritylabs.com/aws/weaponizing-ecs-task-definitions-steal-credentials-running-containers/

静态反虚拟化的故事，Part1：虚拟化工作原理，以及如何去除

• https://0xnobody.github.io/devirtualization-intro/

20200520

[资讯]

英国航空公司EasyJet声称受到“高度复杂”的网络攻击，泄露大约900万客户的电子邮件地址和旅行详细信息

• https://securityaffairs.co/wordpress/103468/breaking-news/easyjet-cyber-attack.html

一家名为LeaseSolution的公司的租赁管理软件被发现拥有一个公开的数据库，其中包含600万个条目，详细列出了包括三星和劳斯莱斯在内的9家公司的机密商业信息

• https://www.gizmodo.co.uk/2020/05/samsung-rolls-royce-information-exposed-by-leaky-database-security-firm-says/

巴西在线零售商Natura＆Co在亚马逊托管的服务器上泄露了1.92亿条记录，包括个人身份信息（PII）

• https://www.safetydetectives.com/blog/natura-leak-report/

[漏洞]

DNS递归解析器的新漏洞，以及NXNSAttack：利用DNS递归解析器在接收包含域名服务器但没有相应IP地址(即nxnsaddress)的NS引用响应时的操作方式

• http://www.nxnsattack.com/dns-ns-paper.pdf

QNAP PhotoStation和CGI程序中的多个漏洞，组合利用可实现预授权Root权限RCE。影响约45万个QNAS NAS实例

• https://medium.com/bugbountywriteup/qnap-pre-auth-root-rce-affecting-450k-devices-on-the-internet-d55488d28a05

分析私人BugBounty目标密码重置功能中的加密模式，发现严重漏洞，导致账户接管

• https://medium.com/bugbountywriteup/weak-cryptography-in-password-reset-to-full-account-takeover-fc61c75b36b9

[恶意代码]

Android平台远控DenDroid的变种WolfRAT

• https://blog.talosintelligence.com/2020/05/the-wolf-is-back.html

[工具]

ExtendedMacro：Burp插件，提供与BurpSuite宏特性类似但对其进行了扩展

• https://github.com/FrUh/ExtendedMacro

ATOR-Burp：Burp插件，认证Token获取与替换

• https://github.com/synopsys-sig/ATOR-Burp

将IDA、Ghidra的反编译功能集成到VS Code

• https://marketplace.visualstudio.com/items?itemName=tintinweb.vscode-decompiler

BlackDir-Framework：Web App漏洞扫描器

• https://github.com/RedVirus0/BlackDir-Framework

Frida发布12.9版本

• https://frida.re/news/2020/05/19/frida-12-9-released/

sast-scan：开源DevSecOps平台

• https://github.com/ShiftLeftSecurity/sast-scan

[技术]

使用Python进行汽车Hacking，Part1：数据渗透：GPS和OBDII / CAN总线

• https://medium.com/bugbountywriteup/car-hacking-with-python-part-1-data-exfiltration-gps-and-obdii-can-bus-69bc6b101fd1

MFA绕过网络钓鱼：OAuth2授予访问用户数据的权限而无需输入密码

• https://cofense.com/mfa-bypass-phish-caught-oauth2-grants-access-user-data-without-password/

CTF：Pooot Writeup

• https://medium.com/bugbountywriteup/pooot-writeup-217384a6b69c

漏洞练习：Protostar | Stack 6

• https://medium.com/@bigb0ss/expdev-exploit-exercise-protostar-stack-6-ef75472ec7c6

20200519

[资讯]

威胁泄露对特朗普不利数据的黑客组织Sodinokibi发布了一封电子邮件，其中显示了所谓的证据，证明他们确实有声称的有关特朗普的材料

• https://www.hackread.com/revil-hackers-leaks-email-conversation-on-trump/

梅赛德斯-奔驰汽车品牌有一个可公开访问的Git门户网站，研究人员注册了账户并下载580多个Git存储库，其中包含安装在Mercedez货车中的板载逻辑单元（OLU）的源代码

• https://www.zdnet.com/article/mercedes-benz-onboard-logic-unit-olu-source-code-leaks-online/

对欧洲议会发起的网络攻击已导致严重的数据泄露，其中包括与1200位当选官员、工作人员和15,000名欧盟事务专业人员有关的信息

• https://www.cybersecurity-insiders.com/european-parliament-data-breach-due-to-cyber-attack/

黑客在暗网论坛上出售包含莫斯科1.29亿车主的记录数据库

• https://www.bleepingcomputer.com/news/security/hacker-sells-129-million-sensitive-records-of-russian-car-owners/

Firefox将于2020年底全面放弃Flash支持

• https://hotforsecurity.bitdefender.com/blog/firefox-to-fully-drop-flash-support-by-the-end-of-2020-23284.html

BIAS：蓝牙模拟攻击，蓝牙标准提供了基于长期配对密钥的身份验证机制，这些机制已被破坏，并且攻击者可以利用它们来假冒任何蓝牙主设备或从设备。基本上影响所有蓝牙设备。

• https://francozappa.github.io/about-bias/

[漏洞]

iOS应用程序Edison Mail的漏洞，使一些用户可以无需认证访问其他人的电子邮件帐户

• https://securityaffairs.co/wordpress/103418/data-breach/edison-mail-ios-app-bug.html

微软在2月份发布的第二个反向RDP补丁程序使某些第3方RDP客户端易遭受攻击，使用第3方RDP客户端的需要注意

• https://www.hackreports.com/reverse-rdp-attack-vulnerability-rdp-patch/

CVE-2020-11022/CVE-2020-11023: jQuery 3.5.0安全修复细节

• https://mksben.l0.cm/2020/05/jquery3.5.0-xss.html

Windows错误报告（WER）服务的任意文件删除漏洞（CVE-2020–1088）

• https://medium.com/csis-techblog/cve-2020-1088-yet-another-arbitrary-delete-eop-a00b97d8c3e2

WordPress插件WP Product Review未认证存储型XSS漏洞

• https://labs.sucuri.net/unauthenticated-stored-cross-site-scripting-in-wp-support-review/

[工具]

ConfigureDefender：配置Windows 10内置Defender杀毒设置

• https://github.com/AndyFul/ConfigureDefender

hellscape：GIMPLE混淆器，支持所有使用GIMPLE的GCC目标（C/C++/Go/...）

• https://github.com/meme/hellscape

HelloIommuPkg：演示如何编写DMA重新映射的DXE运行时驱动程序示例

• https://github.com/tandasat/HelloIommuPkg
• https://standa-note.blogspot.com/2020/05/introductory-study-of-iommu-vt-d-and.html

C&C框架PoshC2发布6.0版

• https://github.com/nettitude/PoshC2/releases
• https://labs.nettitude.com/blog/introducing-poshc2-v6-0/

[技术]

使用FeatureUsage为Windows 10任务栏取证

• https://www.crowdstrike.com/blog/how-to-employ-featureusage-for-windows-10-taskbar-forensics/

HTB：Mango

• https://resources.infosecinstitute.com/hack-the-box-htb-walkthrough-mango/

Windows KTM漏洞利用，Part4：从race win到内核primitive读写(CVE-2018-8611)

• https://research.nccgroup.com/2020/05/18/cve-2018-8611-exploiting-windows-ktm-part-4-5-from-race-win-to-kernel-read-and-write-primitive/

如何使用趋势科技的Rootkit Remover安装Rootkit

• https://d4stiny.github.io/How-to-use-Trend-Micro-Rootkit-Remover-to-Install-a-Rootkit/

Unleashing an Ultimate XSS Polyglot

• https://github.com/0xsobky/HackVault/wiki/Unleashing-an-Ultimate-XSS-Polyglot

重用VB6 Pcode函数

• http://sandsprite.com/blogs/files/Reusing_Pcode_functions.pdf

介绍IOMMU (VT-d)和英特尔处理器上的内核DMA保护

• http://standa-note.blogspot.com/2020/05/introductory-study-of-iommu-vt-d-and.html

持久化：辅助功能

• https://www.hackingarticles.in/persistence-accessibility-features/

[其他]

2020年第1季度网络层DDoS攻击趋势

• https://blog.cloudflare.com/network-layer-ddos-attack-trends-for-q1-2020/

20200518

[资讯]

此前，REvil勒索软件窃取了纽约一家律师事务所GSMS的名人客户数据，后勒索赎金2100万美元。到勒索截至日期，GSMS只同意支付36.5万美元，于是黑客将勒索赎金提高一倍至4200万美元，发布了2.4G包含LadyGaga法律文件的数据，将勒索日期延长一周，进一步威胁弱若不支付赎金，将公布与美国总统唐纳德·特朗普有关的文件，并表示如果这些文件被公布，特普朗的美国总统就别想当了。

• https://www.zdnet.com/article/ransomware-gang-asks-42m-from-ny-law-firm-threatens-to-leak-dirt-on-trump/

联系人(Address Book)管理App Covve泄露90G用户信息，超过2200万人的数据记录，包括地址、电话号码、用户名、密码、社交媒体链接

• https://www.troyhunt.com/the-unattributable-db8151dd-data-breach/

英国电网网络的中间人Elexon受到网络攻击，仅影响了内部IT网络，包括公司的电子邮件服务器和员工笔记本电脑，员工无法发送或接收电子邮件

• https://www.telegraph.co.uk/business/2020/05/14/key-part-electricity-network-hit-cyber-attack/

网络犯罪市场MagBo出售对43,000个被黑网站的访问权限

• https://ke-la.com/access-as-a-service-remote-access-markets-in-the-cybercrime-underground/

[漏洞]

如何使用未认证RCE漏洞在MyLittleAdmin管理工具上执行任意命令

• https://ssd-disclosure.com/ssd-advisory-mylittleadmin-preauth-rce/

[恶意代码]

APT组织lazarus使用的Dacls远控出现macOS版本

• https://objective-see.com/blog/blog_0x57.html

渗透测试人员评估OAuth 2.0指南：Authorization Code Grant

• https://maxfieldchen.com/posts/2020-05-17-penetration-testers-guide-oauth-2.html

近期针对超级计算机Archer的攻击

• https://www.cadosecurity.com/2020/05/16/1318/

分析勒索软件Snake

• https://medium.com/@nishanmaharjan17/malware-analysis-snake-ransomware-a0e66f487017

深入解析TrickBot模块”mexec”

• https://assets.sentinelone.com/labs/sentinel-one-mexec-r

Android平台恶意软件Mandrake

• https://www.bitdefender.com/files/News/CaseStudies/study/329/Bitdefender-PR-Whitepaper-Mandrake-creat4464-en-EN-interactive.pdf

[工具]

cafecompare：Java代码比较工具（jar/class）

• https://github.com/GraxCode/cafecompare

chatter：用于OSINT的Telegram bot，可以监视twitter的内容、reddit的提交标题和4chan的特定关键字的帖子内容

• https://github.com/visualbasic6/chatter

reg1c1de：用C＃编写的注册表权限扫描程序，用于在注册表中查找潜在的特权途径（privesc avenues）

• https://github.com/deadjakk/reg1c1de
• https://deadjakk.github.io/registry_privesc.html

hidden-cry：Windows加密器/解密器生成器，支持AES 256位密钥

• https://github.com/thelinuxchoice/hidden-cry

URLBrute：网站子域名和目录爆破

• https://github.com/ReddyyZ/URLBrute

safecopy：Burp扩展，安全的拷贝requests

• https://github.com/yashrs/safecopy

[技术]

Hacking Reolink cameras for fun and profit

• https://www.thirtythreeforty.net/posts/2020/05/hacking-reolink-cameras-for-fun-and-profit/

将托管代码加载到非托管进程

• https://www.accenture.com/us-en/blogs/cyber-defense/clrvoyance-loading-managed-code-into-unmanaged-processes

RCE on Windows from Linux Part 3: Pass-The-Hash Toolkit

• https://www.infosecmatter.com/rce-on-windows-from-linux-part-3-pth-toolkit/

从8087数学协处理器的die中提取ROM常量

• http://www.righto.com/2020/05/extracting-rom-constants-from-8087-math.html

如何使用Win10内置的网络数据包嗅探器pktmon

• https://www.bleepingcomputer.com/news/microsoft/windows-10-quietly-got-a-built-in-network-sniffer-how-to-use/

[其他]

过去3个月全球的流量变化

• https://habr.com/en/company/qrator/blog/502194/

硬件安全相关的资源收集

• https://github.com/hardenedlinux/firmware-anatomy/blob/master/hack_ME/hw_security.md

谷歌开源了内部使用的Fuzzing字典

• https://github.com/google/fuzzing

20200515

[资讯]

挪威国家投资基金Norfund的电子邮件系统在数月前被攻击，攻击者监视了该基金员工及其合作伙伴之间长达数月的通信，然后在最近从Norfund窃取了1000万美元

• https://securityaffairs.co/wordpress/103242/cyber-crime/norway-norfund-scam.html

俄罗斯快递服务CDEK的900万客户数据泄露

• https://www.ehackingnews.com/2020/05/data-of-9-million-customers-of-russian.html

金融交易和点差交易服务提供商City Index在5月8日给用户发送通知，表示其网络“被未经授权的第三方访问，并且可能已查看了客户的个人数据”

• https://www.infosecurity-magazine.com/news/city-index-data-breach/

[漏洞]

反向RDP：绕过微软为RDP客户端路径遍历漏洞打的补丁，以及绕过根据微软最佳实战执行的任意路径规范化检查。微软核心路径遍历检查的绕过漏洞尚未修复，敦促所有软件开发人员和安全研究人员注意此问题

• https://research.checkpoint.com/2020/reverse-rdp-the-path-not-taken/

Windows提权漏洞CVE-2020-1015 PoC

• https://github.com/0xeb-bp/cve-2020-1015
• https://0xeb-bp.github.io/blog/2020/05/12/cve-2020-1015-analysis.html

谷歌官方的Wordpress插件Site Kit的严重漏洞，利用此漏洞，任何经过身份验证的用户都可以成为运行Google站点套件的任何网站的Google Search Console所有者

• https://www.wordfence.com/blog/2020/05/vulnerability-in-google-wordpress-plugin-grants-attacker-search-console-access/

Adobe Acrobat Reader中的安全漏洞，可使攻击者静默地在macOS上获得Root权限

• https://rekken.github.io/2020/05/14/Security-Flaws-in-Adobe-Acrobat-Reader-Allow-Malicious-Program-to-Gain-Root-on-macOS-Silently/

拥有超过100万活跃安装的WordPress插件Page Builder存在几个漏洞，可使攻击者完整接管网站

• https://latesthackingnews.com/2020/05/14/page-builder-wordpress-plugin-bugs-could-allow-complete-site-takeover/

Cyberoam安全设备的2个严重漏洞，使未经身份验证的远程攻击者能够执行任意命令

• https://www.vpnmentor.com/blog/report-cyberoam-vulnerabilities/

[恶意代码]

APT组织针对中亚公司和政府机构的一系列网络攻击

• https://blog.avast.com/apt-attack-targets-central-asian-companies-avast

COMpfun远控变种，从- http错误代码获取命令

• https://securelist.com/compfun-- http-status-based-trojan/96874/

[工具]

saycheese：使用Ngrok端口转发方法生成恶意- httpS页面，然后使用JavaScript代码执行摄像头请求，获取网络摄像头拍摄

• https://github.com/thelinuxchoice/saycheese

apkurlgrep：从apk文件中提取endpoints

• https://github.com/ndelphit/apkurlgrep

[技术]

HTB：Open Admin Box Walkthrough

• https://www.hackingarticles.in/hack-the-box-open-admin-box-walkthrough/

将SharePoint作为钓鱼平台

• https://research.nccgroup.com/2020/05/14/using-sharepoint-as-a-phishing-platform/

Grandstream PBX Hacking

• https://medium.com/tenable-techblog/grandstream-pbx-hacking-29f61c0d9179

Fuzzing TLS certificates from their ASN.1 grammar

• https://blog.doyensec.com/2020/05/14/asn1fuzz.html

使用Excel 4.0宏和BIFF8 XLS格式进行逃避检测

• https://malware.pizza/2020/05/12/evading-av-with-excel-macros-and-biff8-xls/

如果攻击者掌握了AWS CLI

• https://www.cyberark.com/threat-research-blog/when-a-cli-falls-for-an-attacker/

20200514

[资讯]

一家涉嫌诈骗的商店，以价格低于正常水平为特色，连续数天在Google搜索结果中名列前茅

• https://www.bbc.com/news/technology-52627272

从Windows 10 2004开始，微软将不再提供Windows 10 32位版本OEM

• https://www.bleepingcomputer.com/news/microsoft/rip-microsoft-to-drop-support-for-windows-10-on-32-bit-systems/

英国外包公司Interserve泄露超过10万个人详细信息，包括雇员姓名、地址、银行详细信息、工资信息、近亲详细信息、HR记录\缺勤日期和退休金信息等

• https://www.binarydefense.com/threat_watch/interserve-breached-approximately-100000-employee-records-accessed/

英国超级计算机ARCHER的登录节点在网络攻击中被利用

• https://www.theregister.co.uk/2020/05/13/uk_archer_supercomputer_cyberattack/

[漏洞]

Sricam CMS和DeviceViewer的堆栈缓冲区溢出漏洞，通过创建特制的“用户名”并将其值复制到“用户/邮件”登录字段中，攻击者将能够在当前登录用户的上下文中执行任意代码

• https://voidsec.com/a-tale-of-a-kiosk-escape-sricam-cms-stack-buffer-overflow/

使用一个PowerShell命令触发漏洞CVE-2020-1048，安装后门

• https://windows-internals.com/printdemon-cve-2020-1048/

SaltStack Salt Master/Minion未经身份验证的远程代码执行，metasploit模块

• https://packetstormsecurity.com/files/157678/saltstack_salt_unauth_rce.rb.txt

MS Office Excel s_Schema功能存在的代码执行漏洞

• https://talosintelligence.com/vulnerability_reports/TALOS-2020-1015

[恶意代码]

研究人员发现了多个为物理隔离网络量身定制的恶意软件实例

• https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/

时隔3个月复出的木马Lampion，使用新的混淆层和C&C

• https://seguranca-informatica.pt/trojan-lampion-is-back-after-3-months/#.Xrx-L2gzZ6L

银行木马Zeus Sphinx的多种最新技术

• https://securityintelligence.com/posts/zeus-sphinx-back-in-business-some-core-modifications-arise/

[工具]

jnitrace：追踪Android App对JNI API的使用，基于Frida

• https://github.com/chame1eon/jnitrace

kernel-fuzzer-for-xen-project：针对Xen项目的内核Fuzzer

• https://github.com/intel/kernel-fuzzer-for-xen-project

[技术]

手机渗透测试清单（Android&iOS）

• https://github.com/mirfansulaiman/Command-Mobile-Penetration-Testing-Cheatsheet

Hyper-V内部资料

• https://github.com/gerhart01/Hyper-V-Internals

Chromium使用多进程架构，进程间使用IPC通信。Chromium的研发团队计划将Chromium重构为一大批较小的服务，为此开发了Mojo通讯框架

• https://blogs.igalia.com/gyuyoung/

iOS App安全实验室配置，Part1

• https://medium.com/bugbountywriteup/ios-application-security-lab-setup-part-1-22c6b872c39b

绕过魔兽世界的代码只读保护（crc32）

• https://ferib.dev/blog.php?l=post/Bypassing_World_of_Warcraft_Crc32_Integrity_Checks

解决Windows上未初始化的堆栈内存

• https://msrc-blog.microsoft.com/2020/05/13/solving-uninitialized-stack-memory-on-windows/

20200513

[资讯]

研究人员发布报告称，由于后端服务Firebase数据库配置错误，估计有24,000个Android应用正在泄漏用户数据

• https://www.comparitech.com/blog/information-security/firebase-misconfiguration-report/

美国一家名人律师事务所被黑客入侵，攻击者窃取了756 GB的数据，包括属于客户的合同和个人电子邮件，其中不乏演艺界的知名人士，例如Lady Gaga。攻击者向BBC勒索赎金，并发布了麦当娜合同的屏幕截图。

• https://www.silicon.co.uk/security/cyberwar/celebrity-law-firm-hacked-343585

几乎每个应用程序都使用开源组件，而最新研究表明：91％的应用程序使用的库已过时或已完全废弃

• https://www.synopsys.com/software-integrity/resources/analyst-reports/2020-open-source-security-risk-analysis.html

[漏洞]

GLPI RCE漏洞（CVE-2020-11060）（GLPI：PHP编写的开源IT资产管理、问题追踪、服务桌面系统）

• https://offsec.almond.consulting/playing-with-gzip-rce-in-glpi.html

ManageEngine OpManger未授权任意文件读取漏洞（CVE-2020-12116）

• https://github.com/BeetleChunks/CVE-2020-12116

[恶意代码]

窃密软件Astaroth，采用复杂的混淆、反分析、躲避检测技术，用Youtube频道说明做C&C

• https://blog.talosintelligence.com/2020/05/astaroth-analysis.html

US-CERT最新发布的朝鲜远控/木马信息：COPPERHEDGE、TAINTEDSCRIBE、PEBBLEDASH

• https://www.us-cert.gov/ncas/analysis-reports/ar20-133a
• https://www.us-cert.gov/ncas/analysis-reports/ar20-133b
• https://www.us-cert.gov/ncas/analysis-reports/ar20-133c

[工具]

Frida清单与代码片段（针对Android）

• https://erev0s.com/blog/frida-code-snippets-for-android/

wifipumpkin3：流氓AP攻击框架

• https://github.com/P0cL4bs/wifipumpkin3

ERC.Xdbg：x64dbg插件，辅助漏洞开发

• https://github.com/Andy53/ERC.Xdbg

[技术]

在移动设备上使用深度学习的性能敏感恶意软件检测系统

• https://arxiv.org/abs/2005.04970

Shell算术扩展和评估滥用

• https://research.nccgroup.com/2020/05/12/shell-arithmetic-expansion-and-evaluation-abuse/

MageCart感染溯源

• https://maxkersten.nl/2020/05/06/backtracking-magecart-infections/

在Inter-CESTI 2019挑战赛中，我们“偶然地”发现了一个时序差异（timing difference），可揭示通过标准API OwnerPIN.check JavaCar处理的PIN的长度

• https://blog.quarkslab.com/how-a-security-anomaly-was-accidentally-found-in-an-eal6-javacard.html

STAMINA：基于深度学习的恶意代码检测技术，将恶意软件表示为图像

• https://www.intel.com/content/www/us/en/artificial-intelligence/documents/stamina-deep-learning-for-malware-protection-whitepaper.html

反编译上万公开的Github repo中的Python字节码，发现的秘密

• https://blog.jse.li/posts/pyc/

从Django作者的角度看待SQL注入预防

• https://blog.r2c.dev/2020/preventing-sql-injection-a-django-authors-perspective/

云安全：CloudGoat AWS Scenario Walkthrough: “EC2_SSRF”

• https://rhinosecuritylabs.com/cloud-security/cloudgoat-aws-scenario-ec2_ssrf/

打破典型的WINDOWS强化措施

• https://www.trustedsec.com/blog/breaking-typical-windows-hardening-implementations/

[其他]

2020年第1季度数据泄露报告

• https://pages.riskbasedsecurity.com/en/2020-q1-data-breach-quickview-report

NodeJS安全资源收集

• https://github.com/lirantal/awesome-nodejs-security

20200512

[资讯]

4月底关闭的黑客论坛/市场WeLeakData.com，其数据库在暗网出售，包括使用该网站的黑客的私下对话

• https://www.bleepingcomputer.com/news/security/hackers-private-chats-leaked-in-stolen-weleakdata-database/

[漏洞]

Oracle WebLogic服务器在野被利用漏洞的分析（CVE-2020-2883）

• https://www.zerodayinitiative.com/blog/2020/5/8/details-on-the-oracle-weblogic-vulnerability-being-exploited-in-the-wild

Thunderspy：使用Thunderbolt端口定位设备，打破Thunderbolt 3安全性。如果您的计算机具有这样的端口，则即使您的驱动器已加密且计算机已锁定或设置为睡眠状态，只要对其进行了短暂的物理访问，攻击者就可以读取和复制所有数据

• h