SecWiki周刊（第210期）
2018/03/05-2018/03/11
安全资讯
[新闻]  Hacking Team's infamous surveillance tool detected by ESET systems
https://www.welivesecurity.com/2018/03/09/new-traces-hacking-team-wild/
[新闻]  美国2018年版《国防战略报告》概要(全文翻译)
https://mp.weixin.qq.com/s/m_aj7s3X0MtDK1ADpV5dGQ
[人物]  黑产猎人：老毕
https://mp.weixin.qq.com/s/Ii7dZSaN1XDWupYP8aVKIw
[新闻]  3月7日这一夜，黑客耍了所有人
https://mp.weixin.qq.com/s/z39hBMif1bQJeb4Ar_zRAw
[新闻]  直接接管暗网网站，钓出几十万毒品买卖家信息
https://mp.weixin.qq.com/s/DqE9u4eSClAA7d1MFuUcBA
安全技术
[Web安全]  PHPYun_v4.3 CMS重装到Getshell
https://mp.weixin.qq.com/s?__biz=MzA3NzE2MjgwMg==&mid=2448903576&idx=1&sn=0174317711c2b6cb1a65a669be512955&chksm=8b55ddc5bc2254d3c84ed74bea12110e358f2f89ab003edc48082f704cd37616c5b1a2478f8f&mpshare=1&scene=23&srcid=03032K577e9mHP4IA68y4vMU#rd
[人物]  tombkeeper 教主微博语录
https://github.com/findneo/TKposts
[Web安全]  Newbie-Security-List-网络安全学习资料小合集
https://github.com/findneo/Newbie-Security-List
[恶意分析]  Hunting-Attacker-Activities
https://www.botconf.eu/wp-content/uploads/2017/12/2017_tomonaga-muda-Hunting-Attacker-Activities.pdf
[Web安全]  Java Web 代码安全审计实战1-跨站 XSS
https://www.ibm.com/developerworks/cn/java/j-lo-audit-xss/index.html
[Web安全]  Java Web 代码安全审计实战2-SQL 注入
https://www.ibm.com/developerworks/cn/java/j-lo-audit-sql-injection/index.html
[Web安全]  ThinkSNS_V4 后台任意文件下载导致Getshell
https://mp.weixin.qq.com/s?__biz=MzA3NzE2MjgwMg==&mid=2448903598&idx=1&sn=597d488c492fca52b49b0f5ddddcadb8&chksm=8b55ddf3bc2254e5135ff7f9a10cdde3ce710e32d53fb4575b02411a9b3bbe23ec26207f8196&mpshare=1&scene=23&srcid=0311KzWTeNcTSxfCLzcIRd7F#rd
[Web安全]  EasySNS_V1.6远程图片本地化导致Getshell
https://mp.weixin.qq.com/s?__biz=MzA3NzE2MjgwMg==&mid=2448903594&idx=1&sn=5e4395fca668f5ce466353317e5f44f7&chksm=8b55ddf7bc2254e1c0c125e0f2190990b4b0b271c36d7b2af80d6cac75da8bb09473b1fb3cbe&mpshare=1&scene=23&srcid=0311nNZoJktliQhkFAL2s307#rd
[Web安全]  Java Web 代码安全审计实战3-文件路径操纵、系统日志欺骗、线程安全和资源未释放
https://www.ibm.com/developerworks/cn/java/j-lo-audit-file-safe/index.html
[编程技术]  PaperAirplane: 一个类似于Proxifier的SOCKS5代理工具
https://github.com/liulilittle/PaperAirplane
[Web安全]  从SQL注入到Getshell：记一次禅道系统的渗透
http://www.cnblogs.com/iamstudy/articles/chandao_pentest_1.html
[漏洞分析]   区块链安全 - 以太坊短地址攻击
http://blog.csdn.net/u011721501/article/details/79476587
[取证分析]  ATT&CK™ Navigator: 新版恶意策略、技术和常识模型
https://mitre.github.io/attack-navigator/enterprise/
[Web安全]  代码审计指南
http://blog.nsfocus.net/code-audit-instruction/
[Web安全]  PHP SSRF Techniques - How to bypass filter_var(), preg_match() and parse_url()
https://medium.com/secjuice/php-ssrf-techniques-9d422cb28d51
[漏洞分析]  The Bug Hunters Methodology v2.1
https://docs.google.com/presentation/d/1VpRT8dFyTaFpQa9jhehtmGaC7TqQniMSYbUdlHN6VrY/edit#slide=id.p
[Web安全]  Java Web 代码安全审计实战4-环境加固
https://www.ibm.com/developerworks/cn/java/j-lo-audit-environmental-reinforcement/index.html
[Web安全]  Java代码审计-层层推进
https://mp.weixin.qq.com/s/muv_q5ENH_0_zpWZqqvHVw
[Web安全]  Drcomdecoder: Drcom 数据库账号密码加解密
https://github.com/scanfsec/Drcomdecoder
[Web安全]  Mozilla Rhino 反序列化漏洞 POC 分析
https://mp.weixin.qq.com/s/qm3mS78r43IIOHgZ-6YyGw
[漏洞分析]  Exim Off-by-one RCE: Exploiting CVE-2018-6789 with Fully Mitigations Bypassing
https://devco.re/blog/2018/03/06/exim-off-by-one-RCE-exploiting-CVE-2018-6789-en/
[Web安全]  S7scan: 集七种功能的漏洞综合检测利用工具
https://github.com/jiangsir404/S7scan
[取证分析]  SSH后门分析总结
https://blog.formsec.cn/2018/02/13/SSH%e5%90%8e%e9%97%a8%e5%88%86%e6%9e%90%e6%80%bb%e7%bb%93/
[Web安全]  Getting any Facebook user's friend list and partial payment card details
https://www.josipfranjkovic.com/blog/facebook-friendlist-paymentcard-leak
[其它]  我的时间管理之路（一）
https://mp.weixin.qq.com/s/v_Uw6XbK3ksecPOH2bcDfw
[工具]  Python Remote Administration Tool (RAT) to gain meterpreter session
https://github.com/islamTaha12/Python-Rootkit
[编程技术]  基于Python的自动化代码审计
https://blog.formsec.cn/2018/02/11/python-audit-auto/media/python_audit.pdf
[工具]  Abusing Certificate Transparency logs for getting HTTPS websites subdomains.
https://github.com/UnaPibaGeek/ctfr
[漏洞分析]  以太坊区块链网络的Eclipse攻击详解
http://www.4hou.com/technology/10570.html
[杂志]  SecWiki周刊（第209期)
https://www.sec-wiki.com/weekly/209
[工具]  Source Code Search Engine
https://publicwww.com/
[移动安全]  血族手游Lua脚本及资源文件解密
https://blog.sectown.cn/archives/320/
[其它]  基于MetaSploit内网穿透渗透测试
https://blog.sectown.cn/archives/323/
[Web安全]  Apache Fineract SQL Inject—CVE-2017-5663
https://xianzhi.aliyun.com/forum/topic/1978
[漏洞分析]  Encryption 101系列：破解之道
https://xianzhi.aliyun.com/forum/topic/2132
[其它]  思科年度安全报告(2018)
https://xianzhi.aliyun.com/forum/topic/2105?from=timeline
[取证分析]  digital-forensics-artifacts-of-interactive-sessions
https://countuponsecurity.com/2017/11/22/digital-forensics-artifacts-of-interactive-sessions/comment-page-1
[Web安全]  渗透Facebook 的思路与发现
https://xianzhi.aliyun.com/forum/topic/2128
[编程技术]  爬虫基础篇[Web 漏洞扫描器]
http://blog.fatezero.org/2018/03/05/web-scanner-crawler-01/
[漏洞分析]  Debug Blocker反调试技术分析
https://www.anquanke.com/post/id/100115
[设备安全]  2017年我国联网智能设备安全情况报告
https://mp.weixin.qq.com/s/3t8-Wc-0Z0ROB66A36jZ4w
[运维安全]  威胁情报之落地实战-由灰向黑篇
https://mp.weixin.qq.com/s/-EcZnVvwBo2AEO7aHUIvMQ
[恶意分析]  CVE-2018-4878 (Flash Player up to 28.0.0.137) and Exploit Kits
https://malware.dontneedcoffee.com/2018/03/CVE-2018-4878.html
[运维安全]  0xB8 威胁情报体系与企业SIEM结合的那些套路—威胁情报的需求判定和选择
https://zhuanlan.zhihu.com/p/34336700?group_id=955089373448953856
[Web安全]  How I found a $5,000 Google Maps XSS (by fiddling with Protobuf)
https://medium.com/@marin_m/how-i-found-a-5-000-google-maps-xss-by-fiddling-with-protobuf-963ee0d9caff
[恶意分析]  使用 Pin 和 Cuckoo 自动化追踪恶意软件
http://blog.fernandodominguez.me/automating-malware-tracing-with-pin-and-cuckoo/
[恶意分析]  malware-ioc: Indicators of Compromises (IOC) of eset
https://github.com/eset/malware-ioc
[编程技术]  Code Review Best Practices
https://medium.com/@palantir/code-review-best-practices-19e02780015f
[编程技术]  Headless Chrome and API
https://thief.one/2018/03/06/1/
[取证分析]  Lazarus APT组织最新攻击活动揭露
https://mp.weixin.qq.com/s/-cCnpo1kBebvJ7WMRj65tg
[Web安全]  Password Filter DLL在渗透测试中的应用
https://3gstudent.github.io/3gstudent.github.io/Password-Filter-DLL%E5%9C%A8%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95%E4%B8%AD%E7%9A%84%E5%BA%94%E7%94%A8/
[Web安全]  企业安全项目-前端绕过专项整改
http://mp.weixin.qq.com/s/0zWcGrZwB5siMNDeFUJcEg
[Web安全]  Laravel Stored XSS Vulnerability
https://x1m.nl/poc/2018/03/07/Laravel-XSS-Vuln/
[编程技术]  利用Debug Help Library定位Windows NT内核未导出的函数和结构体
http://www.4hou.com/system/10590.html
[取证分析]  如何清除window上的RDP连接记录
https://xianzhi.aliyun.com/forum/topic/2102
[漏洞分析]  针对Linux邮件传输代理Exim缓冲区溢出漏洞的分析
https://www.anquanke.com/post/id/100447
[Web安全]  谈谈Selenium Server的安全问题 - 未完
http://www.polaris-lab.com/index.php/archives/454/
[工具]  OpticSpy：用于解码光学隐蔽信道传输的数据的工具
http://www.4hou.com/tools/10583.html
[Web安全]  敏信审计系列之Dorado5开发框架
https://xianzhi.aliyun.com/forum/topic/2114
[Web安全]  前端黑魔法之远程控制地址栏
https://www.leavesongs.com/PENETRATION/use-target-to-spoof-fishing.html
[运维安全]  Port-knocking 简单教程
http://www.cnblogs.com/xiaoxiaoleo/p/8523322.html
[Web安全]  TOMCAT安全测试概要
http://www.91ri.org/17611.html
[Web安全]  XSS-hunter: 收集Webview 页面上存在的反射,储存型XSS
https://github.com/lcatro/XSS-hunter
[取证分析]  以“威胁应对”为中心,看企业信息安全能力建设
https://www.sec-un.org/%E4%BB%A5%E5%A8%81%E8%83%81%E5%BA%94%E5%AF%B9%E4%B8%BA%E4%B8%AD%E5%BF%83%E7%9C%8B%E4%BC%81%E4%B8%9A%E4%BF%A1%E6%81%AF%E5%AE%89%E5%85%A8%E8%83%BD%E5%8A%9B%E5%BB%BA%E8%AE%BE-%E6%9D%8E/
[漏洞分析]  区块链安全-DAO攻击事件解析
http://blog.csdn.net/u011721501/article/details/79450122
[文档]  how-to-learn-powershell(内有部分资源列表)
http://www.jaapbrasser.com/how-to-learn-powershell/
[其它]  互联网反欺诈体系漫谈
https://mp.weixin.qq.com/s/KcXd8lssUajdnron0A2gXw
[漏洞分析]  An Exploration of Security When Building Docker Containers
https://blog.heroku.com/exploration-of-security-when-building-docker-containers
[文档]  finding-evil-whitelist
https://www.sans.org/reading-room/whitepapers/Whitelists/finding-evil-whitelist-35832?show=finding-evil-whitelist-35832
[Web安全]  fineract v1.1.0 CVE三连爆
https://mp.weixin.qq.com/s/g3qha-O4gdMZQrPmXEcy_A
[设备安全]  Deconstructing the Xbox Boot ROM
https://mborgerson.com/deconstructing-the-xbox-boot-rom/
[Web安全]  敏信审计系列之dorado5开发框架
https://mp.weixin.qq.com/s/y1TOfw063Zh6DHhgLQPpzQ
-----微信ID：SecWiki-----
SecWiki，13年来一直专注安全技术资讯分析！
SecWiki：https://www.sec-wiki.com

本期原文地址: SecWiki周刊(第210期)