Safety technology

[web security] s2-052 replication process (with POC utilization) heatlevelhttps://bbs.ichunqiu.com/thread-26789-1-1.html

[web security] s2-053 vulnerability recurrence (with exp) http://www.lsablog.com/network/security/dependency/s2-053-bug-repeat/

[document] kcon 2017 PPT download https://github.com/knownsec/kcon/tree/master/2017

[O & M security] s2-052 Python detection script https://github.com/ysrc/xunfeng/commit/f9ae69fe176c8bca622831e126cd94414ebe26f6? From = timeline & isappinstalled = 0

[tools] nmap use guide (final version) http://www.myh0st.cn/index.php/archives/39/

[web security] Remote Code Execution Vulnerability Analysis of struts 2 s2-052 http://blog.topsec.com.cn/ad'lab/struts 2-s2-052% E8% BF% 9C% E7% A8% 8b% E4% BB% A3% E7% A0% 81% E6% 89% A7% E8% A1% 8C% E6% BC% 8F% E6% B4% 9E% E5% 88% 86% E6% 9E% 90/

Rd

[web security] coballtstrike 3.8 cracked https://evi1cg.me/archives/coballstrike ﹣ 3 ﹣ 8 ﹣ cracked-html.html

[web security] penetration test learning notes case IV http://avfisher.win/archives/784

[mobile security] Android shelling Jihad -- Analysis of 360 reinforcement analysis and shelling tutorial https://mp.weixin.qq.com/s/xse2zrv9ev4qran99ymnra

[web security] MySQL injection map - learning chapter https://mp.weixin.qq.com/s? ʎ biz = mzi5mdq2njexoq = = & mid = 2247484937 & IDX = 1 & Sn = 2a0eed8c5855302951ee07a4e3ee2cae1 & chksm = ec1e3621db69bf37f538b683a7f382f386a12751ae681d5262bad66ec3f49dec0263dc9ca38 Rd

[web security] shadow broker September toolshttps://mega.nz/ ාf! Mzwyjslq! Rnkf1ndr1lrqkztvqb5qa! 8jgbnc7s

[web security] windowless penetration test experiment https://xianzhi.aliyun.com/forum/read/2061.html

[malicious analysis] analyze a case of Telecom hijacking and downloading erotic app https://www.92ez.com/? Action = show & id = 23453

[web security] build Android mobile penetration artifact based on termux (updated on July 22, 2017) http://blackwolfsec.cc/2016/12/10/termux/

[operation and maintenance security] hunting Pastebin with pastehunter https://techniarch.net/2017/09/hunting-pastebin-with-pastehunter/

[malicious analysis] using Python to detect DGA domain name http://www.freebuf.com/articles/web/145981.html

[malicious analysis] use sklearn to detect webshellhttp://www.polaris-lab.com/index.php/archives/372/

[web security] cmspoc: CMS penetration test framework https://github.com/chybeta/cmspoc

[web security] thinkerphp background remote arbitrary code execution vulnerability https://xianzhi.aliyun.com/forum/read/2084.html

[web security] Web Test Method tools http://mp.weixin.qq.com/s/iblbpjvne ﹣ mon6ru2o1yg

Ward

[programming technology] Slate: beautiful static documentation for your API project documentation assistant https://github.com/lord/slate

[other] how to trace attack tactics from log files? http://www.4hou.com/penetration/7571.html

[operation and maintenance security] talk about the experience and principle of port detection http://www.freebuf.com/articles/network/146087.html

[tool] malwareinfosec / ekfiddle: a framework to study exploit kitshttps://github.com/malwareinfosec/ekfiddle

[mobile security] record APK detection once http://5alt.me/2017/09 /% E8% AE% B0% E4% B8% 80% E6% AC% a1apk% E6% A3% 80% E6% B5% 8B/

[mobile security] see how I build Android penetration test environment http://www.4hou.com/technology/7573.html

[tool] jgamblin / nmaptable: Transform nmap scans to an d3.js HTML tablehttps://github.com/jgamblin/nmaptable/

[vulnerability analysis] Remote Code Execution Vulnerability cve-2017-9805 struts 2.5 to 2.5.12 affected https://bbs.ichunqiu.com/thread-26778-1-1.html? From = sec

[operation and maintenance security] overview of honeynet technology based on Sdn https://mp.weixin.qq.com/s/qvuvacmgeypyorritvfq

[web security] XSS without dots https://markitzeroday.com/character-restrictions/xss/2017/07/26/xss-without-dots.html

[device security] D-Link router information disclosure and remote command execution vulnerability analysis and global data analysis report https://paper.seebug.org/385/

[web security] using alternate data streams to bypass user account controlshttps://www.redcanary.com/blog/using-alternate-data-streams-bypass-user-account-controls/

[programming technology] tspider: yet another web spider dynamic web crawler https://github.com/twi1ight/tspider

[O & M security] passmaker: a password dictionary generator that can customize rules https://github.com/bit4woo/passmaker

[mobile security] analysis of Android startup process http://www.4hou.com/mobile/7373.html

[web security] using JavaScript frameworks to bypass XSS mitigationshttp://blog.portswigger.net/2017/09/using-javascript-frameworks-to-bypass.html

[web security] race asp.net request validation bypass using request encoding https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2017/race-asp.net-request-validation-bypass-using-request-encoding/

[web security] digital signature attack report: security crisis destroying the "credit system" of software identity http://www.freebuf.com/articles/network/146274.html

[vulnerability analysis] Pwned in translation from subtitles to rcehttps://hitcon.org/2017/cmt/slide-files/d2 s20; r1.pdf

[book] [book] deep learning with Python https://github.com/fchollet/deep-learning-with-python-notebooks

[web security] Uber bug Bounty: Gaming access to an internal chat systemhttp://blog.mish.re/index.php/2017/09/06/uber-bug-bounty-gaming-access-to-an-internal-chat-system/

[web security] modern web application penetration testing, hash length extension attackshttps://isc.sans.edu/forums/daily/modern + web + application + penetration + testing + hash + length + extension + attacks / 22792/

[web security] detecting chrome headless https://antoinevacuum.github.io/bot% 20detection/2017/08/05/detect-chrome-headless.html

[magazine] sec wiki weekly (183) https://www.sec-wiki.com/weekly/183

[web security] practice: see how I changed LFI into RFI https://xianzhi.aliyun.com/forum/read/2060.html

[malicious analysis] the past and present life of Kronos bank Trojan http://www.4hou.com/technology/7527.html

[device security] firmware exploitation with Jeb Part 3: reversing the smartrg's sr505nhttps://www.pnfsoftware.com/blog/firmware-exploitation-with-jeb-part-3-upgrading-the-smartrgs-sr505n/

[device security] firmware deployment with Jeb part 2https://www.pnfsoftware.com/blog/firmware-deployment-with-jeb-part-2/

[web security] expanding Python deserialization vulnerabilities http://crowdshield.com/blog.php? Name = expanding Python deserialization vulnerabilities

[wireless security] can disabling Wi Fi prevent Android phones from sending wireless frames? http://www.4hou.com/wireless/7545.html

[web security] proof of concept JavaScript malware implemented as a proxy auto configurationhttps://github.com/safereach-labs/pacdoor

[Others] Windows10 subsystem Bash environment installation https://bbs.ichunqiu.com/thread-26614-1-1.html? From=sec

[programming technology] a Yara rule generator for finding related samples and huntinghttps://github.com/alienvault-otx/yabin

[web security] honeypot and intranet security from 0 to 1 (2) https://sosly.me/index.php/2017/09/05/jymiguan2/

[other] cloud security planning policy http://www.freebuf.com/column/146950.html

[web security] URL spoofing with modern browserhttps://www.math1as.com/index.php/archives/505/

[vulnerability analysis] shellcode execution code iptables - P input accepthttp://www.91ri.org/17267.html

[web security] ASP code audit https://bbs.ichunqiu.com/thread-26815-1-1.html? From = sec

[web security] on PHP format string from WordPress sqli https://paper.seebug.org/386/

[tool] Frida scripts: a collection of frida.re scripts reverse appshttps://github.com/0xdea/frida scripts/

[web security] fastjson debugging utilization record http://5alt.me/2017/09/fastjson% E8% B0% 83% E8% AF% 95% E5% 88% A9% E7% 94% A8% E8% AE% B0% E5% BD% 95/

[equipment safety] safety inspection report of networked production system (power industry) https://mp.weixin.qq.com/s/jdqb8i6t33x3xlkpuxljjw

[other] researchers find a way to disable Intel me components (country story version) http://www.freebuf.com/news/146032.html

[other] beyond Domain Admins – domain controller & ad administrationhttp://link.crwd.fr/2bsu ා https://adsecurity.org/? P = 3700

[malicious analysis] hunting adwindrat with SSL heuristics http://www.netresec.com/? Page = blog & month = 2017-09 & post = hunting adwindrat with SSL heuristics

[other] who is Marcus Hutchins? Https://krebsonsesecurity.com/2017/09/who-is-marcus-hutchins/

[other] broadpwn: remote control of Android and IOS via bug in Broadcom's wi-fihttps://blog.exodusintel.com/2017/07/26/broadpwn/

[O & M security] domainfrontinglists: examples of websites using different CDN services https://github.com/vysec/domainfrontinglists

[malicious analysis] malware source code databasehttps://github.com/mwsrc

[other] automated red team infrastructure deployment with terrain - Part 1https://rastamouse.me/2017/08/automated-red-team-infrastructure-deployment-with-terrain --- Part-1/

[device security] firmware deployment with Jeb part 2https://www.pnfsoftware.com/blog/firmware-deployment-with-jeb-part-1/