强网杯CTF 2019 Web review
upload
www.tar.gz 源代码泄露
审计代码发现使用的路由
Aggregator
定价的力量
6 years 9 months ago
很多年前阅读过一篇文章《定价的力量》，今天在此借用这个标题，分享我个人对产品定价的工作体会。
CVE-2019-11245
6 years 9 months ago
container uid changes to root after first restart or if image is already pulled to the node
Java下的tinylog日志打印 - 羊小弟
6 years 9 months ago
做个笔记。 做某个功能时需要DEBUG调试日志，但是直接System.out.println 是打印在终端，有些情况下是看不到输出的，所以需要用日志框架去打印输出值。 经过搜索完以后发现Logback性能等方面都比较好，打算选它做日志框架时，发现其他的jar包里面也有Logback，起冲突了，修改这
羊小弟
2019RCTF 部分Web的WriteUp
6 years 9 months ago
hurricane618
【原创】一文彻底搞懂安卓WebView白名单校验 - rebeyond
6 years 9 months ago
前言 近两年公司端侧发现的漏洞很大一部分都出在WebView白名单上，针对这类漏洞安全编码团队也组织过多次培训，但是这种漏洞还是屡见不鲜。下面本人就结合产品中容易出现问题的地方，用实例的方式来总结一下如何正确使用WebView白名单，给开发的兄弟们作为参考。 在Android SDK中封装了一个可以
rebeyond
【原创】利用动态二进制加密实现新型一句话木马之客户端篇 - rebeyond
6 years 9 months ago
概述 本系列文章重写了java、.net、php三个版本的一句话木马，可以解析并执行客户端传递过来的加密二进制流，并实现了相应的客户端工具。从而一劳永逸的绕过WAF或者其他网络防火墙的检测。 本来是想把这三个版本写在一篇文章里，过程中发现篇幅太大，所以分成了四篇，分别是： 利用动态二进制加密实现新型
rebeyond
【原创】利用动态二进制加密实现新型一句话木马之PHP篇 - rebeyond
6 years 9 months ago
概述 本系列文章重写了java、.net、php三个版本的一句话木马，可以解析并执行客户端传递过来的加密二进制流，并实现了相应的客户端工具。从而一劳永逸的绕过WAF或者其他网络防火墙的检测。 本来是想把这三个版本写在一篇文章里，过程中发现篇幅太大，所以分成了四篇，分别是： 利用动态二进制加密实现新型
rebeyond
【原创】利用动态二进制加密实现新型一句话木马之.NET篇 - rebeyond
6 years 9 months ago
概述 本系列文章重写了java、.net、php三个版本的一句话木马，可以解析并执行客户端传递过来的加密二进制流，并实现了相应的客户端工具。从而一劳永逸的绕过WAF或者其他网络防火墙的检测。当然，截止到今天，这三个版本一句话木马也是可以绕过基于主机的各种文件特征检测防护系统的，比如安全狗、D盾以及各
rebeyond
【原创】利用动态二进制加密实现新型一句话木马之Java篇 - rebeyond
6 years 9 months ago
概述 本系列文章重写了java、.net、php三个版本的一句话木马，可以解析并执行客户端传递过来的加密二进制流，并实现了相应的客户端工具。从而一劳永逸的绕过WAF或者其他网络防火墙的检测。 本来是想把这三个版本写在一篇文章里，过程中发现篇幅太大，所以分成了四篇，分别是： 利用动态二进制加密实现新型
rebeyond
Shifting to DevSecOps Is as Much About Culture as Technology and Methodology
6 years 9 months ago
F5 Labs' Preston Hogue writes for Security Week, discussing how the shift to DevSecOps brings a massive shift in the application landscape with real cultural impact on security teams.
震惊! 破译了 “真有"韭菜"排队...”的一个常用密码
6 years 9 months ago
本期，公开本人耗尽心力才破译的一个密码含义...
RCTF2019 baby_crypto & baby_aes
6 years 9 months ago
密码学只做出来两题 baby, 暗示我还是学密码学的 baby (逃
Lyrebird - Hack the hacker (and take a picture)
6 years 9 months ago
The idea for Lyrebird came from observing that sometimes when someone forgets lock their workstation, someone else might mess with their computer. Since I wanted to learn more on how to program a webcam and take pictures - I figured why not create a little tool that takes a screenshot and uses the webcam to take pictures of anyone that interacts with the computer while I’m gone.
The way this work is simple, start Lyrebird. It will take a screenshot of the current desktop and then enter its observation mode.
4 Areas Where Infosec Facts and Fiction Clash: Mind the Gap Pt. 3
6 years 9 months ago
There are gaps in security programs between what we think is going on, and what’s really going on. In this final part in our trilogy, we examine the possible causes for this—and solutions to close these gaps.
4 Areas Where Infosec Facts and Fiction Clash: Mind the Gap Pt. 3
6 years 9 months ago
There are gaps in security programs between what we think is going on, and what’s really going on. In this final part in our trilogy, we examine the possible causes for this—and solutions to close these gaps.
4 Areas Where Infosec Facts and Fiction Clash: Mind the Gap Pt. 3
6 years 9 months ago
There are gaps in security programs between what we think is going on, and what’s really going on. In this final part in our trilogy, we examine the possible causes for this—and solutions to close these gaps.
远程桌面远程代码执行漏洞（CVE-2019-0708）Poc - PaperPen
6 years 9 months ago
本文介绍了如何检测目标主机是否含有CVE-2019-0708漏洞
PaperPen
16Shop: Commercial Phishing Kit Has A Hidden Backdoor
6 years 9 months ago
Additional research by Or Katz When it comes to targeting Apple users and their personal and financial data, 16Shop has emerged as a go to kit for those who can afford it. While 16Shop is sold to criminals looking to...
Amiram Cohen
Preventing the Top Data Center Breaches
6 years 9 months ago
Data center breaches can seem impossible to avoid, but good data center security can seriously reduce your risk. We look at famous breaches Equifax, Yahoo, & more.
Dave Klein