Aggregator

在本系列中，我们将对以太坊现有的安全问题和前沿的各类型漏洞挖掘方法进行综述。本文是本系列的第一篇文章，主要介绍以太坊的机制和存在的安全问题的分类。 01 什么是以太坊智能合约？ 以太坊智能合约基于区块链（Blockchain）技术，作为一种旨在以信息化方式传播、验证或执行的计算机协议，为各类分布式应用服务提供了基础。简单来讲：如果把比特币看作是分布式的记账本；以太坊便是可以运行程序的分布式计算平台，程序运行的基础则是Solidity智能合约。 智能合约早在1995年就由尼克萨博提出，

通过编写CodeQL脚本来查询响应包中是否包含了我所关心的敏感数据（例如手机号、身份证号），其中的一种情景是返回值是Map类型的变量，所以分享一下CodeQL对Map类型的一些支持。

Chris Ensor highlights some important elements of the NCSC's new Technology Assurance strategy.

很喜欢支付宝收款码的这组皮肤

一个最典型的要使用pu_relax()锁的场景是忙等待（也就是死循环等一个事情的发生），在内核里面有大量的代码，比如等寄存器状态：比如做延迟：简单来说，你如果在内核里面写了忙等待的代码，都...

What do hay storage, Akamai?s Edge Connect solution, and machine learning have in common? We use the serverless machine learning system to keep our hay storage safe and secure.

不知不觉中BurpCrypto从诞生到现在已经一岁半了，在这段时间里我对插件的基础功能进行了持续的Bug修复与 …

继续阅读“BurpCrypto未来开发计划”

Summary Researchers at Claroty discovered 11 vulnerabilities in NagiosXI that, in combination, could be used to take over network infrastructure remotely. Updates to NagiosXI have been released to address the issues. Overview Eleven vulnerabilities in NagiosXI were discovered and disclosed by researchers at Claroty. These include remote code execution (RCE), server-side request forgery (SSRF), SQL injection, local privilege escalation (LPE), local file inclusion, open redirect, and path traversal vulnerabil

This week, Gartner released its new 2021 Magic Quadrant for Web Application and API Protection (WAAP) report, which replaces the Magic Quadrant for Web Application Firewalls (WAF) report, and Akamai has been named a Leader. Akamai was named a Leader in the four previous WAF Magic Quadrants.

上课和搬砖的闲暇时间摸鱼打了个第五空间网络安全大赛，也就随意看了看Misc题。

See the most recent research from Amit Serper on a vulnerability in Autodiscover from Microsoft Outlook that affects credential leaks.

Managing hardened systems without exposing them to unwanted attack vectors is difficult. Jump boxes are one way to do it—learn why and how.

The TCP three-way handshake is one of the critical building blocks of the internet. It facilitates the smooth and consistent flow of information across and among different networks without compromising security.

本文主要介绍如何为自定义的 CodeQL 规则创建测试文件，以及如何使用 test run 子命令执行测试。

为 CodeQL 自定义查询规则编写测试

前言 这篇博客打算重点介绍一下IAST相关的内容，以及IAST如何在DevSecOps中的CI/CD中的结合。做一期大杂烩，同时也是对我这半年多来的实习一次技术总结。 大致需要了解的内容为： CI/CD的介绍 DevOps的介绍 IAST的介绍 在Jenkins流水线引入IAST CI/CD的介绍

另一种方式的指纹识别

New to the scene, monster-sized botnet M?ris is raising some eyebrows with giant requests per second (rps) attacks as shared by Cloudflare (17.2M rps, reported August 19), Yandex (peaking at 21.8M rps on September 5), and KrebsOnSecurity (2M rps on September 9). Some commentary came in on Slashdot, The Record, and The Hacker News.