Aggregator

Additional research and information provided by Asaf Nadler Recent changes to the Pykspa v2 domain generation algorithm (DGA) have made it more selective. Akamai researchers have tracked these changes and believe that part of the reason for selective domain generation...

Non-email sending (parked) domains can be used to generate spam email, but they're easy to protect.

情况: 在maven中引入两个包都有项目的包名和类名，只是jar包的名字不同。两个包的一部分在代码中的不同地方都需要用到。 网上找的大部分都是: 只有改变编译器优先选择的jar顺序（这个顺序是可以改变的）：包jdk放到前面就好了。 解决: 在maven中也是这样，只要调整好dependency的顺序

Understanding the significance of the three foundational information security principles: confidentiality, integrity, and availability.

Learn the difference between VMware?s segmentation offerings, NSX-T vs NSX-V, and understand the several potential pitfalls that are important to consider before deployment.

严格来说，这其实是Symantec的第二次被并购。大马华裔陈福阳带领的Broadcom传出150亿美元价格并

关于成电的季节里，我最喜欢的便是夏天。那是我初入校

换了一个apk实验后 apktool b -f -p. xxx也不行，仍然报资源错误 看了一下可能是鹅厂出的AndResGuard工具，会将资源文件夹/Res/xxx重命名为/r/x类的目录，导致资源解析出错 针对这个混淆有shakaApktool来对抗，但由于太久没有更新所以已经失修了 于是无奈回归apktool -r不解析资源文件、原样打包的思路 对于AndroidManifest.xml的二...

Charles的Map功能可以将某个请求进行重定向，用重定向的内容响应请求的内容。这个功能非常方便。在抓包过程当中，有时候为了调试方便，需要将线上的服务定位到内网。比如我们线上的服务器域名为 api.example.com，而内网的用于调试的服务器域名为 test.neiwang.com，那么就需要

One thing every red team should attempt early on and regularly is to perform some password spray testing across their organization to identify and help remediate usage of weak passwords. In the past I have done this on Windows a lot, but now I built a simple version for it for Bash to run it also from a Mac. Check it out: Bash Spray Ideally, a script like bashspray.sh is integrated into your response pipelines, and SOC, Blue Team as well as account owner get notified - so they change their password right away, and any SOC investigation can be performed if necessary.

In the final part of our mobile app series, we cover the DevSecOps components related to mobile app security: rolling out requirements, training, testing, and operational practices.

认真点，我是来看热闹的~

A newcomer to the malware scene, Golang-based malware has been seen installing cryptominers specifically targeting Moreno cryptocurrency.

开始鹅厂实习的社畜搬砖生活(°∀°)ﾉ frida-gadget的优势在于通过对应用重打包，加入gadget.so的调用，从而实现frida的hook 这种途径避免了注入所需要的root权限 发现了一个现成的脚本，但测了一下似乎有一些问题，明天修一下看看 以下是手动流程 解包 apktool d xxx.apk -r选项可以使得不解析资源，但AndroidManifest.xml也不会解析，此时无...

2017年8月19日，中国贵州射电望远镜“天眼”接收到一个来自外太空4光年外的可疑信号。2017年8月19日

Overview In recent weeks, a series of DDoS attacks were directed at multiple financial institutions. The attacks utilized a seldom seen reflection vector known as TCP SYN-ACK reflection. SYN-ACK reflection isn't new, but it's rarely observed due mostly to its...

本文主要针对于目前漏洞管理的一些新要求提出了一些见解。

几年前笔者当时在为终端安全的发展找路的时候，主要看了两个方面，一个是计算环境的变化产生的市场，就是基于移动终

Linux x64 下的万能 Gadget

Similar to April, threat actors in May continued targeting the deserialization vulnerabilities found in Oracle WebLogic to mine cryptocurrency.