SecWiki周刊(第170期)
2017/05/29-2017/06/04
安全资讯
[法规]  国家标准《信息安全技术 数据出境安全评估指南》(草案)
http://www.tc260.org.cn/ueditor/jsp/upload/20170527/87491495878030102.pdf
[爆库]  2017年上半年重大黑客事件盘点
http://www.freebuf.com/news/135842.html
[观点]  连续收购/投资网络安全公司,身背数锅的微软想从以色列买到什么?
https://mp.weixin.qq.com/s?__biz=MzI1NTYzMTc5Mw%3D%3D&mid=2247483691&idx=1&sn=f3af54e8102bf4226bc3f2f6985e37df&scene=45#wechat_redirect
安全技术
[Web安全]  逻辑漏洞之支付漏洞
https://mp.weixin.qq.com/s/w22omfxO8vU6XzixXWmBxg
[Web安全]  逻辑漏洞之密码重置
https://mp.weixin.qq.com/s/Lynmqd_ieEoNJ3mmyv9eQQ
[Web安全]  逻辑漏洞之越权访问
https://mp.weixin.qq.com/s/ChiXtcrEyQeLkGOkm4PTog
[Web安全]  自律方能自由,《网络安全法》实施后的白帽子行为参考
https://sosly.me/index.php/2017/06/02/wangluoanquanfa/
[漏洞分析]  GhostButt - CVE-2017-8291利用分析
http://paper.seebug.org/310/
[漏洞分析]  A Dissection of the “EsteemAudit” Windows Remote Desktop Exploit
http://researchcenter.paloaltonetworks.com/2017/05/unit42-dissection-esteemaudit-windows-remote-desktop-exploit/
[比赛]  信息安全与对抗技术竞赛(ISCC 2017)WriteUp(详细,通俗易懂)
http://www.freebuf.com/articles/others-articles/135825.html
[新闻]  Chrome漏洞可致恶意站点在用户在不知情的情况下录制音频和视频
http://www.freebuf.com/news/136015.html
[Web安全]  浅谈跨站脚本攻击与防御
http://thief.one/2017/05/31/1/
[运维安全]  IOC sharing - we are doing it wrong
https://www.slideshare.net/CsabaFitzl/ioc-sharing-we-are-doing-it-wrong
[运维安全]  新一代数据中心网络安全产品的旁路部署方式探讨
http://blog.nsfocus.net/generation-data-center-product-bypass-deployment/
[Web安全]  代码安全之文件包含
https://mp.weixin.qq.com/s/v1ovyOf9uPuUVgIkLJ7fBQ
[恶意分析]  基于机器学习的分布式webshell检测系统-项目代码
https://github.com/Lingerhk/fshell
[Web安全]  代码安全之文件上传
http://mp.weixin.qq.com/s/W8z_bv4MmAWUU48AzhMnJQ
[会议]  Alex lonescu在#SyScan360# 上关于Windows Container机制的slide
http://www.alex-ionescu.com/publications/syscan/syscan2017.pdf
[运维安全]  从蜜罐数据到SSH蜜罐的典型攻击分析
http://bobao.360.cn/learning/detail/3929.html
[工具]  Black Hat USA 2017 兵工厂兵器列表
https://www.blackhat.com/us-17/arsenal.html
[移动安全]  Pwning the Nexus ™ of Every Pixel ™
https://blog.flanker017.me/wp-content/uploads/2017/06/qmss2017.pdf
[运维安全]  运维安全之安全隐患
http://mp.weixin.qq.com/s/ZDfjqfLm2gqBdxaLT4yiBQ
[运维安全]  Linux曝新安全漏洞:用户执行sudo命令可获取root权限
http://www.freebuf.com/vuls/136156.html
[恶意分析]  基于机器学习的分布式Webshell检测系统-绪论篇
http://www.s0nnet.com/archives/fshell
[Web安全]  Python 第三方库安全: 钓鱼实战与数据统计分析
http://blog.fatezero.org/2017/06/01/package-fishing/
[工具]  Pentest BOX安装和使用
http://www.jianshu.com/p/022b0090d640
[Web安全]  evilwaf: Web Application Firewall (WAF) Detection Tool
https://github.com/eviltik/evilwaf
[恶意分析]  分享一种可关闭大多数杀软的技术(对360安全卫士已验证成功)
http://www.freebuf.com/articles/system/135708.html
[移动安全]  安天移动安全2017年Q1移动终端钓鱼网站分析报告
http://www.freebuf.com/articles/terminal/135986.html
[Web安全]  如何保护网页按钮不被XSS自动点击
http://www.freebuf.com/articles/web/135759.html
[编程技术]  初见 Chrome Headless 第二弹
https://lightless.me/archives/chrome-headless-second.html
[运维安全]  说说压力测试工具
https://huoding.com/2017/05/31/620
[Web安全]  平台安全之文件解析
https://mp.weixin.qq.com/s/49Ao-omFIn0QixqzdjrWeg
[运维安全]  HatCloud: Bypass CloudFlare with Ruby 真实 IP 查找
https://github.com/HatBashBR/HatCloud
[恶意分析]  基于机器学习的分布式webshell检测系统-特征工程(1)
http://www.s0nnet.com/archives/fshell-feature-1
[书籍]  CNCERT《2016年中国互联网网络安全报告》电子版
http://www.cert.org.cn/publish/main/upload/File/2016_cncert_report.pdf
[其它]  【Twitter实时技术-2017.6.01】|行业资讯
https://xianzhi.aliyun.com/forum/read/1638.html
[杂志]  SecWiki周刊(第169期)
https://www.sec-wiki.com/weekly/169
[数据挖掘]  学点算法做安全之垃圾邮件识别(上)
http://www.freebuf.com/column/135863.html
[Web安全]  WAF Bypass at PHDays VII: Results and Answers
http://blog.ptsecurity.com/2017/06/waf-bypass-at-phdays-vii-results-and.html
[移动安全]  How-to-locate-CRED | ne2der
https://ne2der.github.io/2017/How-to-locate-CRED/
[设备安全]  Training: Security of BIOS/UEFI System Firmware from Attacker and Defender
https://github.com/advanced-threat-research/firmware-security-training
[无线安全]  常见无线DOS攻击
常见无线DOS攻击
[比赛]  13th届Syclover承办的ctf比赛题解
https://github.com/SycloverSecurity/ctf/tree/master/13th_cuit_game
[Web安全]  TerraMaster NAS TOS <= 3.0.30 Unauthenticated RCE as Root
https://www.evilsocket.net/2017/05/30/Terramaster-NAS-Unauthenticated-RCE-as-root/#.WS1gUW36cHI.reddit
[Web安全]  Study Notes of using BGInfo to bypass Application Whitelisting
https://3gstudent.github.io/3gstudent.github.io/Study-Notes-of-using-BGInfo-to-bypass-Application-Whitelisting/
[移动安全]  EPOXY: Shielding Bare-Metal Embedded Systems
https://nebelwelt.net/publications/files/17SyScan360-presentation.pdf
[观点]  PR的盛宴之下,不能缺席的是技术的纯真——WannaCry事件之反思|技术讨论
https://xianzhi.aliyun.com/forum/read/1645.html
-----微信ID:SecWiki-----
SecWiki,8年来一直专注安全技术资讯分析!
SecWiki:https://www.sec-wiki.com

本期原文地址: SecWiki周刊(第170期)