Safety technology

[vulnerability analysis] memcached Command Execution Vulnerability (cve-2016-8704, cve-2016-8705, cve-2016-8706) http://paper.seebug.org/95/

Ene = 0 × Rd

[web security] Zhihu anti cheating system evolution http://www.infoq.com/cn/presentations/zhihu-anti-cheat-system-evolution

[web security] Java deserialization tool - Java deserialization exp toolshttps://www.webshell.cc/6238.html

[Video] the topic of SSC summit, evolution of webshell, http://m.youku.com/video/id_xmtc3otc4odgzng = =. HTML? Refer = pc-sns-1

[other] alienvault - open thread exchangehttp://otx.alienvault.com/dashboard/new/

[mobile security] Android reverse modification kernel bypasses anti debugging http://www.whitecell-club.org/? P = 1442

= 1 & scene = 1 & srcid = 1103uqdgpsxsvpubsgzd2a7d × Rd

[document] black hat Europe 2016 slideshttps://www.blackhat.com/eu-16/briefs.html

[device security] iotseeker: scan a network for specific types of IOT deviceshttps://github.com/rapid7/iotseeker

[web security] IOT: Internet of things security test experience summary http://www.button.com/91246.html

[web security] same source method Execution Vulnerability mining http://www.button.com/91299.html

[forensics analysis] China's largest webshell backdoor case investigation, all open Damascus's troops are destroyed http://www.freebuf.com/news/topnews/118424.html? From = single message & isappinstalled = 0ා10006-weixin-1-52626-6b3bffd01fdde4900130bc5a2751b6d1

[operation and maintenance security] proxybroker: http://proxybroker.readthedocs.io/en/latest/

[vulnerability analysis] mysql-maria-percona-privescrace-cve-2016-6663-5616-exploit http://legalhackers.com/advisors/mysql-maria-percona-privescrace-cve-2016-6663-5616-exploit.html

[vulnerability analysis] read files on application server, leads to rce of gitlabhttps://hacker.com/reports/178152

Wechat? Redirect

[web security] backslash powered scanning: hunting unknown vulnerability classshttp://blog.portswigger.net/2016/11/backslash-powered-scanning-hunting.html

[web security] Multi Tool and multi-user HTTP proxy http://www.button.com/91204.html

[vulnerability analysis] dirty cow - (cve-2016-5195) - docker container escapeehttp://blog.paranoidsoftware.com/dirty-cow-cve-2016-5195-docker-container-escape/

[web security] front end black magic: using JS to detect remote users' antivirus software http://www.motoin.com/91264.html

Share = 1 & scene = 2 & srcid = 1101odprjsygwaivxufah0rx & from = timeline × Rd

[mobile security] lookout released a 42 page technical document explaining Pegasus (3 IOS vulns) https://info.lookout.com/rs/051-esq-475/images/pegasus-exploits-technical-details.pdf

[tools] the most popular penetration testing system for Linux distribution in 2016 http://www.button.com/91202.html

Ene = 0 × Rd

[operation and maintenance security] spark streaming + elasticsearch build app anomaly monitoring platform http://tech.meituan.com/spark-streaming-es.html

[operation and maintenance security] unlimited risk control with limited information! http://mp.weixin.qq.com/s?__biz=MzI5ODE0ODA5MQ==&mid=2652277539&idx=1&sn=87fa4119dc190cf23025602cabf12720&chksm=f74862b7c03feba1a1a3f45e92207353dac7c9a7ed347f77c2a1663e8634ba19159d2adfab62&mpshare=1&scene=1&srcid=1031etHOMTwlfGZcPmlsOgo5#rd

[vulnerability analysis] FIREYE 2016 flare on challenge solutions https://www.fireeye.com/blog/thread-research/2016/11/2016_flare on_challenge.html

92c74f & mpshare = 1 & scene = 2 & srcid = 1101dmyuo6gwvph6j5ywske & from = Ti Meline#rd

[O & M security] Threat Intelligence 2012-2016 meeting notes http://www.tanjiti.top/threatintelligencenote.html

[book] U.S. Army commanders guide to human intelligence (HUMINT) https://info.publicintelligence.net/call-commandersguidehumint.pdf

[web security] DOM basic XSS vulnerability in wix.com http://www.button.com/91302.html

[web security] opendoor: OWASP directory access scannerhttps://github.com/standislav-web/opendoor/

[malicious analysis] the document incarnates the commercial Trojan horse. The analysis and traceability of "stealing God" http://www.freebuf.com/news/117354.html

[paper] practical attacks against privacy and availability in 4G / LTE mobile communicationhttps://arxiv.org/pdf/1510.07563.pdf

[document] rootkit analysis use case on hidedrv [PDF] http://www.sekoia.fr/blog/wp-content/uploads/2016/10/rootkit-analysis-use-case-on-hidedrv-v1.6.pdf

[web security] anti XSS: an open source XSS vulnerability scannerhttps://github.com/lewangbtcc/anti-xss

[web security] share the sentence of some featureless PHP https://www.leavesongs.com/peeneration/php-callback-backdoor.html

[vulnerability analysis] ability to access all user authentication tokens, leads to rce of gitlabhttps://hacker.com/reports/158330

[device security] badusb small try http://www.button.com/91187.html

[mobile security] appie: Portable Android penetration test kit http://www.button.com/91363.html

In this paper, the author analyzes the characteristics of

[operation and maintenance security] security issues to be solved by enterprises http://www.bincker.net/? P = 452

[other] an experience shows how quickly the Internet of things can be hackedhttp://www.npr.org/sections/alltechconnected/2016/11/01/500253637/an-experience-shows-how-quickly-the-internet-of-things-can-be-hacked

[mobile security] how to take advantage of rowhammer vulnerability root Android mobile phone (including demo video + exploit source code) http://www.freebuf.com/news/118163.html

[web security] IPS community suite PHP Remote Code Execution Vulnerability Analysis http://blog.nsfocus.net/ips-community-autoloaded-php-code-injection-vulnerability/

[malicious analysis] the hookads malvertising campaign https://blog.malwarebytes.com/cybercrime/exploits/2016/11/the-hookads-malvertising-campaign/

[book] webusb API under editor's draftttps://wicg.github.io/webusb/

[document] en route with sednit Part 1: approving the target [PDF] http://www.wellivesecurity.com/wp-content/uploads/2016/10/set-sednit-part1.pdf

[device security] Ukraine power grid attack analysis 20161101http://blog.nsfocus.net/wp-content/uploads/2016/11/% E4% B9% 8C% E5% 85% 8b% E5% 85% B0% E7% 94% B5% E7% BD% 91% E6% 94% BB% E5% 87% BB% E5% 88% 86% E6% 9E% 9020161101.pdf

[operation and maintenance security] Spark's practice in anti cheating clustering scenario https://zhanglan.zhihu.com/p/23385044

[web security] Command Execution Vulnerability caused by gitlab application server file read http://www.button.com/91325.html

[mobile security] awesome ADB: ADB usage complete / ADB usage complete https://github.com/mzlogin/awesome-adb

[forensic analysis] packet capture generator for IDS and regular expression evaluation http://www.kitploit.com/2016/11/sniffles-packet-capture-generator-for.html? UTM? Source = dlvr. It & UTM? Medium = twitter

[magazine] sec wiki weekly (issue 139) https://www.sec-wiki.com/weekly/139

[operation and maintenance security] route tracking procedure http://www.arkteam.net/? P = 1303

[malicious analysis] pornhub bypasses ad blockers with websocketshttp://blog.bugreplay.com/post/152579164219/pornhudgesadblockersusingwebsockets

[vulnerability analysis] PWN a camera step by step (WEB ver.) https://ricterz.me/posts/pwn% 20A% 20camera% 20step% 20BY% 20step% 20% 28web% 20ver.% 29? = 14780566015650

2 & srcid = 1030etrx1bz4memnef8qx1oy & from = timeline & isappinstalled = 0 × Rd

[document] bypassing antivirus with a sharp syringehttp://www.exploit-db.com/docs/20420.pdf

[web security] awesome static analysis: a curved list of static analysis tools https://github.com/mre/awesome-static-analysisාpython