Aggregator

在CodeQL CLI中使用自定义查询 为了使用CodeQL进行定制分析，我们可以通过自己编写查询来实现查找漏洞或错误。CodeQL的查询类型有： 告警查询：突出显示代码中特定位置的问题的查询。 路径查询：代码中source和sink之间信息流的查询。 基本查询结构 用CodeQL编写的查询文件扩展

时间过得好快，一晃一天又一天，没有技术积累和数据积累确实让我很难受。话说野路子该不该进入安全行业这个我可以把

最近学了一些反爬知识，记录一下。

第二篇 ：次集成时代及服务交付

A dns&http log server for verify SSRF/XXE/RFI/RCE vulnerability

Excited to announce that I will be presenting at BSides Singapore this year. The topic is adversarial usage of virtual machines during lateral movement. And we will also cover threat hunting and detection ideas. I have been referring to this technique as the Shadowbunny over the years. :) The conferences is on September 24th-25th, it will be all virtual and free to attend. Check out the BSidesSG 2020 website and schedule for other talks and details.

今天又看到有一些安全预警平台爆出的Jackson反序列漏洞，要求把Jackson升级到2.9.10.6，所以在下面对漏洞原理和适用范围做一下分析，并给出poc。

Website logins are under constant assault, with attackers quickly modifying their bots to evade simplistic defenses.

前言 前些日子有人问到我溯源反制方面的问题，我就想到了MySQL任意文件读取这个洞，假设你在内网发现或扫到了

My parents were first-generation immigrants from India. They worked hard, made Singapore their home and took all and any challenges head on. They have always lived by the simple philosophy, 'to be the change'. It's a philosophy that I try to live too, and in many ways it's what attracted me to Akamai not too long ago.

手把手教你搭建钓鱼Wi-Fi

Today I’m gonna talk about a class of application security issues I ran across a few times over the years. In particular, let’s discuss race conditions when it comes to files with sensitive content and permissions. Race conditions can allow an adversary to gain access to sensitive information on machines. Assume a system creates a file that contains sensitive information and afterwards applies permissions to lockdown that file. Understanding the race condition Let’s look at a practical example seen in the wild a few times.

.

Fofa采集工具-自修改版本

又一个0day来了，我该怎么办？

刚刚收到宝塔推送安全更新推送短信，请宝塔用户务必重视

还是学生的时候，我曾无数次憧憬，幻想过，以后工作的日子，希望早日成为一个社会人。现如今，工作一月有余，才发现

目录: 一、产品特点 二、什么是设备指纹？ 三、设备指纹的应用场景 四、设备指纹原理分析 五、设备风险识别原理分析 六、破解虚拟机保护 七、破解设备指纹与风险识别 八、总结 一、产品特点 1.1 优点： 该产品在安全防破解方面个人认为算是业 内做到了比较高标准的安全保护机制，主要表现在以下几点: 安

该产品在安全防破解方面个人认为算是业内做到了比较高标准的安全保护机制，主要表现在以下几点: 安全虚拟机中实现加解密过程 将算法代码转换为安全虚拟机指令，将换后指令解释执行在虚拟机之中