Aggregator

最近疫情搞的有些emo了,一直在被隔离,写点东西记录下吧 最近一直没学习,一直在挖漏洞,说点mysql sql注入挖掘tips吧 先来常见的 (1)if: SELECT if(1=1,1,0) (2)case when: SELECT case when 1=1 then 1 else 0 end

戳上面的蓝字关注我吧！本篇文章10549个词，预计阅读时长30分钟。假设本文的读者已经有相关SpringBo

introduce

OS: Linux
Difficulty: Hard
Points: 40
Release: 23 Oct 2021
IP: 10.10.11.119

亲亲子清，悠悠我心，写一点文字，给我刚出生不久的女儿

不争眼前长短，要谋来日方长。再艰难的日子也要努力的生活，保持身体健康、磨练坚韧心智，未来一定无限美好。

K4YT3X https://k4yt3x.com/fcitx5-pinyin-%E6%89%B9%E9%87%8F%E5%AF%BC%E5%85%A5%E6%90%9C%E7%8B%97%E8%AF%8D%E5%BA%93/ -

虽然 fcitx5-configtool 内可以为 fcitx5-pinyin 导入搜狗词库，但它并不能批量导入词库，因而特此写一篇教程记录下我研究出的批量导入搜狗词库的方案。

批量下载词库

批量下载词库的方法多种多样，在此我以 搜狗词库爬虫 (Sougou_dict_spider) 为例，批量下载所有词典。

批量转换为 libime dict

接下来将所有需要转换的词典收集到同一个目录下方便操作，下面的这条目录复制了所有官方推荐的词典到 recommended 目录下。命令中还用 -not 参数排除了几个不需要的类别。

1 find . -type f -iname '*官方推荐*.scel' -not -path "./436/*" -not -path "./403/*" -exec cp {} ~/sogou/recommended/ \;

接下来我们需要使用 fcitx5-chinese-addons 包提供的 scel2org5 命令将 scel 文件转成文本格式，再用 libime 提供的 libime_pinyindict 命令将 .txt 文本转换为 libime 可以识别的 .dict 格式。下面这个脚本可以批量转换当前目录下的所有 .scel 文件并将转换完的文件输出到 dict/ 子目录中。

1 2 3 4 5 6 7 8 9 10 #!/usr/bin/python # -*- coding: utf-8 -*- import pathlib import subprocess for file in pathlib.Path("scel/").glob("*.scel"): subprocess.run(["/usr/bin/scel2org5", str(file), "-o", f"txt/{file.stem}.txt"]) for file in pathlib.Path("txt/").glob("*.txt"): subprocess.run(["/usr/bin/libime_pinyindict", str(file), f"dict/{file.stem}.dict"]) 将 dict 文件导入 fcitx5-pinyin

词典的导入相当简单，只需要把转换完的 .dict 文件复制到 ~/.local/share/fcitx5/pinyin/dictionaries 即可。您可能需要重新加载 Fcitx5 来使新词典生效。

- https://k4yt3x.com/fcitx5-pinyin-%E6%89%B9%E9%87%8F%E5%AF%BC%E5%85%A5%E6%90%9C%E7%8B%97%E8%AF%8D%E5%BA%93/ - 2019-2024 K4YT3X. All rights reserved.

一、背景 二、整体框架 三、SO保护壳分析 四、DEX保护壳分析 五、Native原理分析 六、总结 一、背景 最近朋友让我帮忙对他们银行APP进行黑盒分析,检测其安全性，探未知程序漏洞与安全性测试，提升业务整体安全能力，我拿到APP后进行安装抓包后发现都是加密传输的，用JEB进行反编译找数据组合的

2021年的科幻出版物分析报告出炉啦，依然是从图书

Summary ***Updated 04/08/2022*** The Spring-Projects team has released a blog in an effort to clear up confusion about the alleged deserialization RCE vulnerability. There are, however, vulnerabilities that have been patched and a Yara rule has been published. Please see the latest recommendations. Threat Type Vulnerability Overview ***UPDATE #5, April 8, 2022*** A report from Chinese cybersecurity firm, Qihoo 360, has reported on the first confirmed case(s) of Spring4Shell being leveraged to gain access a

壳整体是指令抽取加方法native化二者结合，所有被抽走的指令还原后dump出来也能分析出80%左右的代码，其它被native化的用JNItrace配合分析，所以用该加固方案客户端代码安全性一般。

0x00 前言太久没有整活了可以说是十分懈怠了。现在整活的门槛也越来越高，去年群友还只是每天rce就很开心了

他们告诉开发者如果部署SDK可每个月赚取 100 到 10000 美元甚至更多，这取决于它可以提供多少活跃用户。

Summary According to multiple sources an OpenSSL vulnerability in some Palo Alto appliances could be exploited to trigger a denial of service (DOS) condition. This vulnerability has been patched in OpenSSL but not all Palo Alto appliances. Threat Type Vulnerability Overview X-Force is tracking the disclosure of an OpenSSL vulnerability in some Palo Alto appliances that if exploited could lead to a denial of service (DOS) condition. In early March of 2022, updates were released by OpenSSL to address CVE-20

本文介绍了SurFree，这是一种基于几何原理的对抗攻击算法，可以在最苛刻的条件下，即基于黑盒决策的攻击，仅仅依赖最终的分类标签来大幅减少查询花销。

一套基于反向代理的流程化、模板化水坑攻击，全程只使用前端，做到受害者无感知使用的技术

MAC 的Nox模拟器依赖virtualbox模拟，一直卡在99%，因为nox只是个封装调用，实际上还是virtualbox,virtualbox单独启动报错： virtualbox也是最新版 报错信息如下： Kernel driver not installed (rc=-1908) Make s

Conti is a notorious ransomware group that targets high-revenue organizations. They were first detected in 2020, and appear to be based in Russia. It is believed that the group is the successor to Ryuk ransomware group. According to Chainalysis, The ransomware group was the highest grossing of all ransomware groups in 2021, with an estimated revenue of at least 180 million dollars.

Microsoft is excited to announce the addition of Exchange on-premises, SharePoint on-premises, and Skype for Business on-premises to the Applications and On-Premises Servers Bounty Program. Through this expanded program, we encourage researchers to discover and report high-impact security vulnerabilities to help protect customers. We offer awards up to $26,000 USD for eligible submissions.

本文是以一个虚拟的大型互联网公司的视角对DevSecOps体系构建的总结和思考。