2020.8.17-8.23一周安全知识动态

转自image-20200929114557052

漏洞挖掘相关

•HFL: Hybrid Fuzzing on the Linux Kernel

1
https://chungkim.io/doc/ndss20-hfl.pdfNdss2020 linux内核漏洞挖掘论文

•On Measuring and Visualizing Fuzzer Performance

1
https://hexgolems.com/2020/08/on-measuring-and-visualizing-fuzzer-performance/提升fuzzer评估效率的方法

•Everything Old is New Again: Binary Security of WebAssembly

1
https://www.usenix.org/system/files/sec20-lehmann.pdfUsenix2020WebAssembly漏洞论文

•Responsible and Effective Bugfinding

1
https://blog.regehr.org/archives/2037漏洞挖掘的有效方法

IOT漏洞相关

•A PRACTICAL GUIDE FOR CRACKING AES-128 ENCRYPTED FIRMWARE UPDATES

1
https://gethypoxic.com/blogs/technical/a-practical-guide-for-cracking-aes-128-encrypted-firmware-updates实战破解AES-128加密的固件升级包

•Breaking the D-Link DIR3060 Firmware Encryption - Recon - Part 1

1
https://0x434b.dev/breaking-the-d-link-dir3060-firmware-encryption-recon-part-1/D-Link DIR3060固件加密解析

漏洞利用相关

•Buffer-Overflow-Exploit-Development-Practice

1
https://github.com/freddiebarrsmith/Buffer-Overflow-Exploit-Development-Practice栈溢出实战练习仓库

操作系统漏洞相关

•SassyKitdi: Kernel Mode TCP Sockets + LSASS Dump

1
https://zerosum0x0.blogspot.com/2020/08/sassykitdi-kernel-mode-tcp-sockets.htmlwindows通用kernel payload

•CVE-2020-1571 Windows Setup Elevation of Privileges Bypass 0day

1
https://github.com/klinix5/Windows-Setup-EoPCVE-2020-1571 windows提权漏洞exp

•Windows AppX Deployment Service Local Privilege Escalation (CVE-2020-1488)

1
https://www.activecyber.us/activelabs/windows-appx-deployment-service-local-privilege-escalation-cve-2020-1488CVE-2020-1488WindowsAppXDeployment服务提权漏洞分析

•BLIZZARD JAILBREAK

1
https://geosn0w.github.io/getblizzard/开源的越狱工具IOS 11.0至 IOS 13.5

•CVE-2020-1337: my two cents

1
https://blog.hiveminds.es/en/posts/cve-2020-1337_my_two_cents/CVE-2020-1337漏洞分析

应用程序漏洞相关

•List of bug bounty writeups

1
https://pentester.land/list-of-bug-bounty-writeups.html#bug-bounty-writeups-published-in-2020bounty 报告

•Bludit Auth BF mitigation bypass exploit / PoC

1
https://github.com/noraj/Bludit-auth-BF-bypassExploit/ PoCfor CVE-2019-17240

•Understanding and Preventing LDAP Injection

1
https://www.securecoding.com/understanding-and-preventing-ldap-injection/LDAP注入及防御机制分析

•A SmorgasHORDE of Vulnerabilities :: A Comparative Analysis of Discovery

1
https://srcincite.io/blog/2020/08/19/a-smorgashorde-of-vulnerabilities-a-comparative-analysis-of-discovery.htmlSmorgasHORDE漏洞挖掘分析

•Struts2 S2-059 漏洞分析

1
https://wxn.qq.com/cmsid/20200816A03TC200

其它

•PowerShell Commands for Incident Response

1
https://www.securityinbits.com/incident-response/powershell-commands-for-incident-response/powershell 奇淫技巧命令

•Why you should always scan UDP ports (part 1/2)

1
https://medium.com/@securityshenaningans/why-you-should-always-scan-udp-ports-part-1-2-d8ee7eb26727扫描UDP端口的作用
⬆︎UP