(转载)2020.8.17-8.23一周安全知识动态
2020.8.17-8.23一周安全知识动态
转自
漏洞挖掘相关
•HFL: Hybrid Fuzzing on the Linux Kernel
1 | https://chungkim.io/doc/ndss20-hfl.pdfNdss2020 linux内核漏洞挖掘论文 |
•On Measuring and Visualizing Fuzzer Performance
1 | https://hexgolems.com/2020/08/on-measuring-and-visualizing-fuzzer-performance/提升fuzzer评估效率的方法 |
•Everything Old is New Again: Binary Security of WebAssembly
1 | https://www.usenix.org/system/files/sec20-lehmann.pdfUsenix2020WebAssembly漏洞论文 |
•Responsible and Effective Bugfinding
1 | https://blog.regehr.org/archives/2037漏洞挖掘的有效方法 |
IOT漏洞相关
•A PRACTICAL GUIDE FOR CRACKING AES-128 ENCRYPTED FIRMWARE UPDATES
1 | https://gethypoxic.com/blogs/technical/a-practical-guide-for-cracking-aes-128-encrypted-firmware-updates实战破解AES-128加密的固件升级包 |
•Breaking the D-Link DIR3060 Firmware Encryption - Recon - Part 1
1 | https://0x434b.dev/breaking-the-d-link-dir3060-firmware-encryption-recon-part-1/D-Link DIR3060固件加密解析 |
漏洞利用相关
•Buffer-Overflow-Exploit-Development-Practice
1 | https://github.com/freddiebarrsmith/Buffer-Overflow-Exploit-Development-Practice栈溢出实战练习仓库 |
操作系统漏洞相关
•SassyKitdi: Kernel Mode TCP Sockets + LSASS Dump
1 | https://zerosum0x0.blogspot.com/2020/08/sassykitdi-kernel-mode-tcp-sockets.htmlwindows通用kernel payload |
•CVE-2020-1571 Windows Setup Elevation of Privileges Bypass 0day
1 | https://github.com/klinix5/Windows-Setup-EoPCVE-2020-1571 windows提权漏洞exp |
•Windows AppX Deployment Service Local Privilege Escalation (CVE-2020-1488)
1 | https://www.activecyber.us/activelabs/windows-appx-deployment-service-local-privilege-escalation-cve-2020-1488CVE-2020-1488WindowsAppXDeployment服务提权漏洞分析 |
•BLIZZARD JAILBREAK
1 | https://geosn0w.github.io/getblizzard/开源的越狱工具IOS 11.0至 IOS 13.5 |
•CVE-2020-1337: my two cents
1 | https://blog.hiveminds.es/en/posts/cve-2020-1337_my_two_cents/CVE-2020-1337漏洞分析 |
应用程序漏洞相关
•List of bug bounty writeups
1 | https://pentester.land/list-of-bug-bounty-writeups.html#bug-bounty-writeups-published-in-2020bounty 报告 |
•Bludit Auth BF mitigation bypass exploit / PoC
1 | https://github.com/noraj/Bludit-auth-BF-bypassExploit/ PoCfor CVE-2019-17240 |
•Understanding and Preventing LDAP Injection
1 | https://www.securecoding.com/understanding-and-preventing-ldap-injection/LDAP注入及防御机制分析 |
•A SmorgasHORDE of Vulnerabilities :: A Comparative Analysis of Discovery
1 | https://srcincite.io/blog/2020/08/19/a-smorgashorde-of-vulnerabilities-a-comparative-analysis-of-discovery.htmlSmorgasHORDE漏洞挖掘分析 |
•Struts2 S2-059 漏洞分析
1 | https://wxn.qq.com/cmsid/20200816A03TC200 |
其它
•PowerShell Commands for Incident Response
1 | https://www.securityinbits.com/incident-response/powershell-commands-for-incident-response/powershell 奇淫技巧命令 |
•Why you should always scan UDP ports (part 1/2)
1 | https://medium.com/@securityshenaningans/why-you-should-always-scan-udp-ports-part-1-2-d8ee7eb26727扫描UDP端口的作用 |