Safety technology

[vulnerability analysis] development of Java RMI deserialization vulnerability detection tool https://bbs.ichunqiu.com/thread-20414-1-1.html? From = sec

[other] some awesome blogs recommend http://mp.weixin.qq.com/s/cxbbbymkybdvwmeyfxps3ya

[web security] logic vulnerability summary https://tom0li.github.io/2017/07/17/% E9% 80% BB% E8% be% 91% E6% BC% 8F% E6% B4% 9E% E5% B0% 8F% E7% BB% 93/

[web security] small close circle backup - JSON version https://github.com/andreaom/xiaomiquan'u bak

[web security] browser vulnerability mining ideas https://zhanglan.zhihu.com/p/28719766? UTM ﹣ medium = Social & UTM ﹣ source = Weibo

[other] hitb sg2017https://gsec.hitb.org/materials/sg2017/

[vulnerability analysis] geetest_break: source code + manual https://github.com/fanhuaandluomu/geetest_break

[operation and maintenance security] mimikatz usage notes [non interactive access to local password plaintext and hash] https://klionsec.github.io/2016/07/23/mimikatz-one/

[wireless security] airtrack & hashcat non dictionary high speed attack target wireless password https://klionsec.github.io/2015/04/14/airtrack-hascat/

[document] ppthttps: / / MP. Weixin. QQ. COM / S? Biz = mzi1nty2mtkwnw = = & mid = 2247483798 & IDX = 1 & Sn = 8992a94f41f91945f201ebcd48a104c5 & scene = 0? Wechat? Redirect

[web security] ThinkPHP cache function design defects lead to getshell vulnerability recurrence https://drops.org.cn/index.php/archives/262/

[web security] architecture and design of distributed penetration framework https://xuanlan.zhihu.com/p/28781870

[vulnerability analysis] cve-2017-6327: Symantec messaging gateway < = 10.6.3-2 unauthenticated root rcehttp://seclists.org/fulldisclosure/2017/aug/28

[web security] windows licensing series (2): http://mp.weixin.qq.com/s/erxolhwo0-ljbmv143i8ha

[web security] QQ mailbox reflective XSS vulnerability http://pirogue.org/2017/08/25/qqmailxss/

[web security] Cai Bi's PHP one sentence: the way to learn Trojans https://bbs.ichunqiu.com/thread-26365-1-1.html? From = sec

[web security] how to use socat to more easily penetrate the target intranet https://klionsec.github.io/2017/07/31/socat-meterpreter/

[web security] penetration test learning notes case 3 http://avfisher.win/archives/766

[web security] most of the time, all you need is a shellhttps://klionsec.github.io/2016/09/27/restore-shell/

[operation and maintenance security] autosonda: automatic detection firewall rule tool http://www.solidot.org/story? Sid = 53559

[programming technology] rendertron: docker version of chrome headlesshttps://github.com/google chrome/rendertron

[web security] Ctrip security automation test path http://techshow.ctrip.com/archives/2315.html

[vulnerability analysis] scrumworks Pro remote code executionhttps://blogs.securiteam.com/index.php/archives/3387

[web security] using phantom JS + Python to complete dynamic detection xsshttp://blog.fr1day.me/2016/09/05/xss ﹣ dynamic ﹣ detection ﹣ using ﹣ phantom JS/

[web security] honeypot and intranet security from 0 to 1 (I) https://sosly.me/index.php/2017/08/23/goldenspark1/

[tool] information collection - Zombie scanning http://mp.weixin.qq.com/s/1i8bbkgsvcxpiq9_tk30zw

[vulnerability analysis] d-link-dir-850l-remote Command Execution Vulnerability https://xianzhi.aliyun.com/forum/read/2010.html

[web security] XSS challenges notes http://www.cnblogs.com/r00tuser/p/7413526.html

[web security] Discuz x3.3 patch security analysis https://cert.360.cn/static/files/discuz% 20x3.3% E8% A1% a5% E4% B8% 81% E5% AE% 89% E5% 85% A8% E5% 88% 86% E6% 9E% 90.pdf

[O & M security] db_security: database security audit tool https://github.com/aweimiaomiao/db_security

[web security] HTTP proxy scan: using censys.io to quickly crawl HTTP proxy https://github.com/t4mo/http-proxy-scan

[other] anti social workers for human flesh once https://bbs.ichunqiu.com/thread-26353-1-1.html? From = sec

[other] cheating in Internet advertisements (Part 2): https://mp.weixin.qq.com/s/ut0_yj2yopmweekendpv5g

[programming technology] three steps to realize simple language interpreter (self-made simple programming language) http://www.4hou.com/technology/7328.html

[web security] from the perspective of Java, in-depth analysis of the impenetrable thief -- "XSS" http://mp.weixin.qq.com/s? \653; biz = mzizmzgxot5na = = & mid = 1000000340 & IDX = 1 & Sn = 6ca4ec15ef6338daf1d4a907351d7c08 & chksm = 68fe9e5d5f89174b44f

[vulnerability analysis] triggering a DNS lookup using java deserialization https://blog.paranoidssoftware.com/triggering-a-dns-lookup-using-java-deserialization/

[data mining] practice of machine learning in security attack and defense http://blog.nsfocus.net/machine-learning-techworld2017/

[web security] XSS tricks: from self XSS to Baidu http://blog.fr1day.me/2016/09/07/xss_tricks_% E4% BB% 8eself XSS% E5% 88% B0% E4% B8% 8A% E4% Ba% 86% E4% BD% A0% E7% 9A% 84% E7% 99% be% E5% Ba% A6/

[document] awesome Hacking: collection of awesome lists for hackers, pentesters & Security https://securityonline.info/awesome-hacking-collection-awesome-lists-hackers-pentesters-security-researchers/? Utm_source = revifuldpost & utm_medium = Social & utm_campaign = revifuldpost

[device security] exploit.rs Wiki: IOT exploits listshttps://www.exploitee.rs/index.php/main'page

[web security] re understanding HTTP protocol https://klionsec.github.io/2017/06/18/http-basic/

[malicious analysis] use venom encryption payload to bypass killing software https://www.linkedin.com/pulse/bypass-anti-virus-detection-encrypted-payloads-using-virus-james-ceh

[mobile security] column: IDA disassembly / decompilation static analysis IOS simulator program http://blog.csdn.net/column/details/ios-ida.html

[malicious analysis] the international network crime infrastructure has been exposed https://mp.weixin.qq.com/s? ᥴ biz = mzi4oda4mtcxma = = & mid = 2649550825 & IDX = 1 & Sn = 872c19bf16f23764962dec2b5c520ea4 & scene = 0 ﹐ wechat ﹐ redirect

[web security] in depth understanding of HTTPS encryption process https://klionsec.github.io/2017/07/31/https-learn/

[operation and maintenance security] vulscan: Advanced vulnerability scanning with nmap nsehttps://github.com/scipag/vulscan

[web security] phpcmsv9 bypasses getshellhttps://mp.weixin.qq.com/s? Biz = mzi5mzy2m0mw = = & mid = 2247484057 & IDX = 1 & Sn = f06345169823dfc359287bf33bda34e0

[web security] hacker's Pathfinder - recondog - information collection tool https://bbs.ichunqiu.com/thread-26242-1-1.html? From = sec

[web security] discussion on session mechanism and CSRF attack and defense http://mp.weixin.qq.com/s/aid_9bgq91em26qvsvbxw

PC * NZ * o5lm2hqpyx5rflhmcq99agpd * zj7fv1viy=

[web security] hitb-2017-write-upshtttps://rawsec.ml/en/hitb-2017-write-ups/

[malicious analysis] identify the malicious code related to targeted attack through shellcode clustering https://mp.weixin.qq.com/s/5ryomeyoa5kr-yq9so07sa

[other] sec wiki weekly (issue 181) https://www.sec-wiki.com/weekly/181

[other] remote control Trojans perform the trick of stealing the sky in vain: uncover the secret of stealing and brushing the undercurrent behind the fake cracking tool http://www.freebuf.com/articles/terminal/144590.html

[vulnerability analysis] zzcms foreground arbitrary script upload vulnerability replication https://bbs.ichunqiu.com/thread-25803-1-1.html? From = sec

[point of view] learn from foreign skills: some experiences of black hat 2017 conference https://mp.weixin.qq.com/s? ﺌ biz = mzi2nta4mde5nq = = & mid = 2651622427 & IDX = 1 & Sn = 8dd1d69ffa8ae9de43c79c564aae91 & scene = 0 ﹐ wechat ﹐ redirect

[mobile security] 360 reinforcement and protection key technologies http://www.freebuf.com/articles/terminal/145102.html

[operation and maintenance security] threat intelligence system built by public cloud manufacturer http://www.4hou.com/technology/7355.html

[vulnerability analysis] cve-2017-1708-exploits https://dl.packetstormsecurity.net/1708-exploits/msedgechakraint-overflow.txt

[operation and maintenance security] dockerscan: docker Security Analysis & test tool http://www.freebuf.com/column/145215.html

[malicious analysis] spam and phishing in 2017 Q2 Kabbah spam and phishing analysis report https://securelist.com/spam-and-phishing-in-q2-2017/81537/

[wireless security] wireless penetration (I) -- WPA encryption https://mp.weixin.qq.com/s? ᥴ biz = mzi5mdq2njexoq = = & mid = 2247484868 & IDX = 1 & Sn = c9f9547e9bdb4fb9699ab47f2e307d35 & chksm = ec1e35ecdb69bcfa42443929bac42d030adda02d1885222aa53d6b4c49b736736be97d11ae7e#rd

[viewpoint] an attack that does not modify data is called data attack http://blog.sina.com.cn/s/blog e506df0102x9fa.html

[paper] the technology of automatically searching administrator in Intranet http://www.4hou.com/dependency/7332.html

[web security] command line search script based on censys API https://github.com/gelim/censys

[other] OSS fuzzy Google's continuous fuzzy service for open source softwarehttps://www.usenix.org/sites/default/files/conference/protected-files/usenixsecurity17'u slides'serebryony.pdf

An example of [web security] fuzzy testing https://bbs.ichunqiu.com/thread-26336-1-1.html? From = sec

[vulnerability analysis] accidental directory streamhttps://tyrandslair.blogspot.co.uk/2017/08/accidental-directory-stream.html

[tools] spiderfoot and shodanhttps://ascinema.org/a/127601

[tool] generate common payloadhttp://mp.weixin.qq.com/s/fnpwtblreywxgvyetifu8a with MSF

[malicious analysis] understanding the Mirai botnethttps://www.usenix.org/system/files/conference/usenixsecurity17/sec17-antonakakis.pdf

[web security] a brief account of IPC shell: https://klionsec.github.io/2016/09/24/ipc-reverse-shell/

[vulnerability analysis] tunnel Manager - from rce to docker escapeehttp://xianzhi.aliyun.com/forum/read/2009.html