Aggregator

各种隐藏C2 Server的方式众多，其中Domain Fronted域前置的方式在2016年低被提出，近些年一直被大家研究利用，本文将结合实践对该技术再次进行介绍，弥补目前网上资料的一些不完整的地方。

本文主要记录我在Web漏洞扫描器实践过程中的一些思考，篇幅较长，没有图片，都是文字性叙述，大多结论、论述来自自己的思考、近些年的所见所闻、朋友的交流等，肯定有很多不全面、错误的地方，欢迎指教与交流。

2018.12.10晚上，看到有人发tp5命令执行，第一眼看到poc大致猜到什么原因，后来看到斗鱼src公众号的分析文章。这里分析记录一下。

在 macOS 上禁止 App 连网的一个方法 在 macOS 上可以使用沙盒策略来禁止 App 连网。 App 假设目标 App 的目录结构如下： /Applications/AbcdEfg.app └── Contents ├── Info.plist ├── MacOS │   ├── AbcdEfg ├── PkgInfo ├...

文件包含getshell 的场景有哪些？JSP&ASPX是否可以？

House of Foce 是堆溢出在特定场景下的一种简单利用方式，通过一个例子来学习下。

Attackers probed Australian applications for vulnerabilities on the most commonly used ports, and credential stuffing attacks were prevalent.

Cloud security breaches happen, but how prevalent and dangerous are they? More than you might think.

今天天空阴沉沉的，还下了点小雨，我坐在公司天台的秋千上，抽着烟思考着人生。正在这时，手机响了一下，我拿起手机

We have released the December security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to turn on automatic updates. More information about this month’s security updates can be found in the Security Update Guide. As a reminder, Windows 7 and Windows Server 2008 R2 will be out of extended support and no longer receiving updates as of January 14, 2020.

We have released the December security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to turn on automatic updates. More information about this month’s security updates can be found in the Security Update Guide. As a reminder, Windows 7 and Windows Server 2008 R2 will be out of extended support and no longer receiving updates as of January 14, 2020.

DanaBot makes a strong resurgence at the end of 2019, using new tactics and techniques and expanding beyond its traditional banking targets.

首先我们登陆抓个包,可以发现有一个sign签名认证,在app与服务端接口安全的问题上,sign是一个很好的办

信息收集是指通过各种方式获取所需的信息。信息收集是信息得以利用的第一步，也是关键的一步。---百度百科

前言 前几天寻思着想挖几个通用的洞 于是在fofa poc列表上找找目标. 锁定目标为php cms 已有0day. 很快就锁定到了这个迅睿cms. 发现可以在

Privileged Access Management is part of a zero-trust model. Guardicore strengthens its offering by integrating with CyberArk.