【原创】一文彻底搞懂安卓WebView白名单校验 - rebeyond
前言 近两年公司端侧发现的漏洞很大一部分都出在WebView白名单上，针对这类漏洞安全编码团队也组织过多次培训，但是这种漏洞还是屡见不鲜。下面本人就结合产品中容易出现问题的地方，用实例的方式来总结一下如何正确使用WebView白名单，给开发的兄弟们作为参考。 在Android SDK中封装了一个可以
Aggregator
【原创】利用动态二进制加密实现新型一句话木马之客户端篇 - rebeyond
6 years 9 months ago
概述 本系列文章重写了java、.net、php三个版本的一句话木马，可以解析并执行客户端传递过来的加密二进制流，并实现了相应的客户端工具。从而一劳永逸的绕过WAF或者其他网络防火墙的检测。 本来是想把这三个版本写在一篇文章里，过程中发现篇幅太大，所以分成了四篇，分别是： 利用动态二进制加密实现新型
rebeyond
【原创】利用动态二进制加密实现新型一句话木马之PHP篇 - rebeyond
6 years 9 months ago
概述 本系列文章重写了java、.net、php三个版本的一句话木马，可以解析并执行客户端传递过来的加密二进制流，并实现了相应的客户端工具。从而一劳永逸的绕过WAF或者其他网络防火墙的检测。 本来是想把这三个版本写在一篇文章里，过程中发现篇幅太大，所以分成了四篇，分别是： 利用动态二进制加密实现新型
rebeyond
【原创】利用动态二进制加密实现新型一句话木马之.NET篇 - rebeyond
6 years 9 months ago
概述 本系列文章重写了java、.net、php三个版本的一句话木马，可以解析并执行客户端传递过来的加密二进制流，并实现了相应的客户端工具。从而一劳永逸的绕过WAF或者其他网络防火墙的检测。当然，截止到今天，这三个版本一句话木马也是可以绕过基于主机的各种文件特征检测防护系统的，比如安全狗、D盾以及各
rebeyond
【原创】利用动态二进制加密实现新型一句话木马之Java篇 - rebeyond
6 years 9 months ago
概述 本系列文章重写了java、.net、php三个版本的一句话木马，可以解析并执行客户端传递过来的加密二进制流，并实现了相应的客户端工具。从而一劳永逸的绕过WAF或者其他网络防火墙的检测。 本来是想把这三个版本写在一篇文章里，过程中发现篇幅太大，所以分成了四篇，分别是： 利用动态二进制加密实现新型
rebeyond
Shifting to DevSecOps Is as Much About Culture as Technology and Methodology
6 years 9 months ago
F5 Labs' Preston Hogue writes for Security Week, discussing how the shift to DevSecOps brings a massive shift in the application landscape with real cultural impact on security teams.
震惊! 破译了 “真有"韭菜"排队...”的一个常用密码
6 years 9 months ago
本期，公开本人耗尽心力才破译的一个密码含义...
RCTF2019 baby_crypto & baby_aes
6 years 9 months ago
密码学只做出来两题 baby, 暗示我还是学密码学的 baby (逃
Lyrebird - Hack the hacker (and take a picture)
6 years 9 months ago
The idea for Lyrebird came from observing that sometimes when someone forgets lock their workstation, someone else might mess with their computer. Since I wanted to learn more on how to program a webcam and take pictures - I figured why not create a little tool that takes a screenshot and uses the webcam to take pictures of anyone that interacts with the computer while I’m gone.
The way this work is simple, start Lyrebird. It will take a screenshot of the current desktop and then enter its observation mode.
4 Areas Where Infosec Facts and Fiction Clash: Mind the Gap Pt. 3
6 years 9 months ago
There are gaps in security programs between what we think is going on, and what’s really going on. In this final part in our trilogy, we examine the possible causes for this—and solutions to close these gaps.
4 Areas Where Infosec Facts and Fiction Clash: Mind the Gap Pt. 3
6 years 9 months ago
There are gaps in security programs between what we think is going on, and what’s really going on. In this final part in our trilogy, we examine the possible causes for this—and solutions to close these gaps.
4 Areas Where Infosec Facts and Fiction Clash: Mind the Gap Pt. 3
6 years 9 months ago
There are gaps in security programs between what we think is going on, and what’s really going on. In this final part in our trilogy, we examine the possible causes for this—and solutions to close these gaps.
远程桌面远程代码执行漏洞（CVE-2019-0708）Poc - PaperPen
6 years 9 months ago
本文介绍了如何检测目标主机是否含有CVE-2019-0708漏洞
PaperPen
16Shop: Commercial Phishing Kit Has A Hidden Backdoor
6 years 9 months ago
Additional research by Or Katz When it comes to targeting Apple users and their personal and financial data, 16Shop has emerged as a go to kit for those who can afford it. While 16Shop is sold to criminals looking to...
Amiram Cohen
Preventing the Top Data Center Breaches
6 years 9 months ago
Data center breaches can seem impossible to avoid, but good data center security can seriously reduce your risk. We look at famous breaches Equifax, Yahoo, & more.
Dave Klein
Application Protection Report 2019, Episode 3: Web Injection Attacks Get Meaner
6 years 9 months ago
Web injection represents an even greater risk than it did previously, thanks to the growth of third-party content and increasingly complex attack surfaces.
Application Protection Report 2019, Episode 3: Web Injection Attacks Get Meaner
6 years 9 months ago
Web injection represents an even greater risk than it did previously, thanks to the growth of third-party content and increasingly complex attack surfaces.
Application Protection Report 2019, Episode 3: Web Injection Attacks Get Meaner
6 years 9 months ago
Web injection represents an even greater risk than it did previously, thanks to the growth of third-party content and increasingly complex attack surfaces.
嵌入式设备的漏洞利用框架-RouterSploit初使用（路由器）
6 years 9 months ago
### Github
RouterSploit Git地址：https://github.com/threat9/routersploit
### 介绍
RouterSploit是一个开源的嵌...
Poacher
嵌入式设备的漏洞利用框架-RouterSploit初使用（路由器）
6 years 9 months ago
### Github
RouterSploit Git地址：https://github.com/threat9/routersploit
### 介绍
RouterSploit是一个开源的嵌...
Poacher