SecWiki周刊（第12期）
2014/05/19-2014/05/25
安全资讯
[运维安全]  Sucuri CloudProxy – Website Firewall Enhancements
http://blog.sucuri.net/2014/05/sucuri-cloudproxy-website-firewall-enhancements.html
[Web安全]  一周海外安全事件回顾（20140512-0518）
http://www.freebuf.com/news/special/34645.html
[漏洞分析]  Technical Analysis of CVE-2014-0515 Adobe Flash Player Exploit
http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Technical-Analysis-of-CVE-2014-0515-Adobe-Flash-Player-Exploit/ba-p/6482744#.U39XrXWSykB
安全技术
[漏洞分析]  没事捣腾了一下yuange的DVE
http://weibo.com/p/1001603713879803836905
[移动安全]  OWASP 移动安全漏洞Top 10
http://www.truesec.net/?p=130
[漏洞分析]  MemPick: High-Level Data Structure Detection in C/C++ Binaries
http://www.cs.vu.nl/~herbertb/papers/mempick_wcre13.pdf
[漏洞分析]  BinTrace record and dump traces of an executable program
https://bitbucket.org/mihaila/bintrace/wiki/Home
[Web安全]  Metasploit: Controlling Internet Explorer user traffic through a proxy PAC file
http://www.shelliscoming.com/2013/12/metasploit-controlling-internet.html
[书籍]  Mathematics for Computer Science，Eric Lehman et al 2013
http://courses.csail.mit.edu/6.042/fall13/mcs.pdf
[书籍]  《Storm入门》中文版
http://ifeve.com/getting-started-with-stom-index/
[Web安全]  Linux后门的两种姿势(suid shell与inetd后门)
http://www.91ri.org/9026.html
[移动安全]  锤子手机云服务漏洞详情
http://silic.org/post/SQL_Injection_Smartisan_Cloud_Server
[恶意分析]  Reversing RIG EK’s Flash File
http://www.kahusecurity.com/2014/reversing-rig-eks-flash-file/
[Web安全]  WebGoat视频
http://pan.baidu.com/s/1pJlsfQ7
[漏洞分析]  CVE-2013-4547 Nginx解析漏洞深入利用及分析
http://sec.baidu.com/index.php?research/detail/id/19
[数据挖掘]  中文分词器性能比较
http://www.52ml.net/15536.html
[Web安全]  Elasticsearch 代码执行漏洞利用工具
http://lcx.cc/?i=4339
[取证分析]  OSXAuditor:Mac OS X计算机取证工具
https://github.com/jipegit/OSXAuditor
[漏洞分析]  在渗透测试中使用fuzz技术(附windows安装指南)
http://www.freebuf.com/articles/network/34136.html
[漏洞分析]  360CM解答
http://www.52pojie.cn/thread-257028-1-1.html
[编程技术]  从输入 URL 到页面加载完成的过程中都发生了什么事情
http://fex.baidu.com/blog/2014/05/what-happen/
[Web安全]  上传文件的陷阱
http://drops.wooyun.org/tips/2031
[Web安全]  NMAP 基础教程
http://drops.wooyun.org/tips/2002
[书籍]  Chrome扩展及应用开发
http://www.ituring.com.cn/book/1421
[漏洞分析]  从Fuzzing到0day
http://worm.cc/from-fuzzing-to-0day.html
[漏洞分析]  mitmproxy now supports #gotofail
http://corte.si/posts/security/gotofail-mitmproxy.html
[运维安全]  购买 Linux VPS 服务器后简单的安全设置
http://ttt.tt/104/
[Web安全]  Linux x86 Reverse Engineering
http://www.exploit-db.com/download_pdf/33429
[运维安全]  邪恶的JAVA HASH DOS攻击
http://security.alibaba.com/blog/blog_4.htm?spm=0.0.0.0.OJKNZd
[运维安全]  moloch:网络数据收集与索引系统
https://github.com/aol/moloch
[Web安全]  How I bypassed 2-Factor-Authentication on Google, Facebook, Yahoo, LinkedIn
http://shubh.am/how-i-bypassed-2-factor-authentication-on-google-yahoo-linkedin-and-many-others/
[Web安全]  How I XSS’ed All Of Yahoo’s Services
http://nahamsec.com/?p=210
[运维安全]  基于nginx和lua的WAF系统 nginx-lua-ds-waf
https://github.com/Hevienz/nginx-lua-ds-waf
[Web安全]  DEFCON 22 CTF Qualifiers Writeup
http://blog.spiderlabs.com/2014/05/defcon-22-ctf-qualifiers-writeup.html
[Web安全]  批量网站DNS区域传送漏洞检测
http://drops.wooyun.org/tips/2014
[编程技术]  大牛分享：MongoDB技术资料汇总
http://wenku.it168.com/wenji/2137
[设备安全]  从美国起诉我5名军官一事，谈网络国防的不对称性
http://blog.sina.com.cn/s/blog_7110463b0101it8w.html
[数据挖掘]  交大开设《机器学习》课程
http://pan.baidu.com/share/link?shareid=3053312914&uk=2620399451#dir
[漏洞分析]  Insecure default in Elasticsearch enables remote code execution
http://bouk.co/blog/elasticsearch-rce/
[其它]  大量云计算资料
http://www.chinacloud.cn/list.aspx?cid=13
[Web安全]  Mysql漏洞利用
http://www.truesec.net/?p=127
[运维安全]  BYON给企业带来的安全挑战
http://mp.weixin.qq.com/s?__biz=MjM5MzQ5ODYwNA==&mid=200180774&idx=1&sn=024a13a5af0b126b08f60d65bffda427#rd
[运维安全]  使用nginx搭建https服务器
http://www.zeroplace.cn/article.asp?id=899
[Web安全]  PHP中该怎样防止SQL注入？
http://blog.jobbole.com/67875/
[运维安全]  DDoS攻防补遗
http://www.icylife.net/blog/?p=947
[Web安全]  Baby's first NX+ASLR bypass
http://blog.spiderlabs.com/2014/05/babys-first-nx-aslr-bypass.html
[恶意分析]  Java-based Malware Distributed Through Spam
http://blog.spiderlabs.com/2014/05/java-based-remote-access-trojan-distributed-through-spam.html
[Web安全]  USENIX:List of Accepted Papers
https://www.usenix.org/conference/usenixsecurity14/list-accepted-papers
[其它]  科学网—浅谈产业界与学术界的合作研究
http://blog.sciencenet.cn/blog-414166-795432.html
[漏洞分析]  IE11SandboxEscapes
https://github.com/tyranid/IE11SandboxEscapes
[漏洞分析]  Award-Winning Web Casting & Online Seminar Hosting Software
https://www2.gotomeeting.com/register/400294658
[Web安全]  Thotcon 0×5 Phishing Frenzy
http://www.pentestgeek.com/2014/05/15/thotcon-phishing-frenzy/
[Web安全]  Exploiting LFI Vulnerabilities with Liffy
http://rotlogix.com/2014/05/21/exploiting-local-file-includes-with-liffy/
[Web安全]  Effective NTLM / SMB Relaying
http://www.room362.com/blog/2014/05/21/effective-ntlm-slash-smb-relaying/
[Web安全]  Windows键盘记录软件
http://www.coolhacker.org/?p=1657
[恶意分析]  The PLA and the 8:00am-5:00pm Work Day
http://www.fireeye.com/blog/technical/2014/05/the-pla-and-the-800am-500pm-work-day-fireeye-confirms-dojs-findings-on-apt1-intrusion-activity.html
[移动安全]  Android Hacking and Security, Part 6: Exploiting Debuggable Android Applications
http://resources.infosecinstitute.com/android-hacking-security-part-6-exploiting-debuggable-android-applications/
[漏洞分析]  逆向基础（四）
http://drops.wooyun.org/tips/2046
[漏洞分析]  Internet_Explorer_11_Exploit
https://github.com/demi6od/Internet_Explorer_11_Exploit
[Web安全]  一些常见的重置密码漏洞分析整理
http://drops.wooyun.org/papers/2035
-----微信ID：SecWiki-----
SecWiki，13年来一直专注安全技术资讯分析！
SecWiki：https://www.sec-wiki.com

本期原文地址: SecWiki周刊(第12期)