“创新领航 智连世界”东软NetEye亮相第二届民航科教创新成果展
东软NetEye产品目前已为国内5亿多航旅用户出行提供网络安全保障。
Aggregator
一个隐藏在Go语言标准库中的目录穿越漏洞 CVE-2022-29804
2 years ago
一天，我看完了番剧后，闲着无聊审计了一下我用来做内网共享的小工具——"Go HTTP File Server"。
这是一个文件服务器,可以快速搭建http服务器共享文件.
启动的默认路径为当前路径(./)
白帽酱
OpenAI, MinIO, And Why You Should Always Use docker-cli-scan To Keep Your Supply chAIn Clean
2 years ago
ChatGPT recently announced a "plugin" capability which lets their revolutionary chatbot and API reach out and touch external resources, enabling prompt engineers to — essentially — build complete, working applications. Unfortunately their examples contain an outdated component which attackers are actively exploiting in other contexts.
【漏洞预警】MinIO 敏感信息泄露漏洞（CVE-2023-28432）
2 years ago
漏洞描述MinIO 是一种开源的对象存储服务，它兼容 Amazon S3 API，可以在私有云或公有云中使用。MinIO 是一...
匿名者
常见安全工具的扫描流量特征分析与检测
2 years ago
前言
端口扫描在红队渗透中是非常重要的一个环,日常使用的很多工具都具有端口扫描功能.
这篇文章会横向比较不同工具在端口扫描时的流量包特征和扫描器的扫描探活方法.从中提取出IDS和防火墙规则,达到拦截或检测网络中的扫描流量的目的.
*本文不讨论高频发包和异常连接等行为上的检测.
白帽酱
koko-moni 一个网络空间搜索引擎监控平台
2 years ago
这个项目其实是我自己写的一个测绘平台的其中的一个小模块 先开放出来给大家试用一下 前端太难写了
KOKO-MONIhttps://github.com/burpheart/koko-moni/
介绍本项目是一个网络空间搜索引擎监控平台，本项目聚合了 Fofa、Hunter、Quake、Zoomeye 和 Threatbook 的数据源，并对获取到的数据进行去重与清洗。
白帽酱
Cacti的命令注入(CVE-2022-46169) 回显poc构造
2 years ago
白帽酱
What Is Cloud Architecture?
2 years ago
What is cloud architecture? And what types of clouds are there? Cloud architecture defines how all the components that enable cloud computing come together.
Pavel Despot
MinIO未授权信息泄露（CVE-2023-28432）
2 years ago
漏洞范围： MinIO RELEASE.2019-12-17T23-16-33Z <= version […]
print("")
关于企业日志脱敏治理的经验之谈
2 years ago
在个人信息保护越来越受到重视的当下，数据安全管控力度也不断加强，有关部门也对金融单位提出了更高的要求。
时代的鱼和个人的熊掌
2 years ago
写下这篇文章的时候大概是自由职业1周年，一年的时间说长不长说短不短，期间有很多经历很多感受，对我自己来说可能是一个很神奇的人生经历与阶段。
What the NIS2 Directive Means for Your Business and Your APIs
2 years ago
Learn how implementing a comprehensive cybersecurity program that addresses all aspects of API security can ensure compliance with the NIS2 Directive.
Steven Duckaert
Pancakes Con: Cyber + Interests = The Best Con (ever?!)
2 years ago
If you’re looking for an extremely wholesome conference to attend, look no further than PancakesCon. This conference requires speakers to talk about 2 things: (1) a brief talk about any cybersecurity topic and (2) a brief talk about something which is not IT-related. As you might imagine, this leads to some great talks!
Chatbots, Celebrities, and Victim Retargeting: Why Crypto Giveaway Scams Are Still So Successful
2 years ago
Shiran Guez
〇 - 自动化工具迅速打点命令集合 - zha0gongz1
2 years ago
总结梳理自动化弱点探测技巧
zha0gongz1
以放款额度为抓手的零售信贷数字化风控策略
2 years ago
风浪越大，鱼越贵！能力越强，额度越大！
Defeating Triple Extortion Ransomware: The Potent Combo of Ransomware and DDoS Attacks
2 years ago
Protect your organization from triple extortion ransomware ? the devastating combination of ransomware and a DDoS attack ? with these four steps.
Venkat Praneeth Nangineni & Steve Winterfeld
Research Highlights Cyber Security's Underestimated Role as a Business and Revenue-enabler
2 years ago
Don’t Let Your Team Drown in Netflow
2 years ago
Whether you’re working with netflow data collected from your own devices, flow logs from a cloud provider, or purchasing data from netflow providers, you may find it challenging to get immediate value out of it.
XSCAN 内测
2 years ago
XSS扫描器成长记自动化获得微软漏洞赏金的经历.md根据公众号以前文章的思想，做了一款名为“xscan”的程