Aggregator

这几个月来，发生了很多事情，也就耽误了些思考和总结的时间。现在，收拾收拾重新出发。

“我与我周旋久，宁作我” - 《世说新语·品藻》

FART脱壳机理论上来讲能脱大多数壳，但是仍有例外，需要自行摸索

本文分享了VIPKID安全团队在内网穿透反向代理软件frp的部分安全实践，希望可以抛砖引玉，欢迎各位安全小伙伴一起讨论学习。

The presence of public "over-the-top" DNS resolution alternatives is a strong motivator for internet service providers (ISPs) to invest in making their DNS resolution infrastructure the best that it can be. Resolvers are the glue that binds subscribers to their fixed and mobile broadband services.

2020 has shown both record-busting bps and pps attacks and the most prolific DDoS extortion campaign recorded by Akamai.

我司洋仔对SPA的分析，说实话，我俩对SPA都不咋看好，有点隔靴搔痒的感觉。

By Gal Bitensky, Executive Summary Link scanners are a critical component in multiple classes of security products including email security suites, websites that suggest direct inspection of a suspicious link, and others. Behind the scenes, these services use web clients...

一大早朋友圈就炸了，鱼哥、猪猪侠、何艺等一众大佬都在谈论这事儿赶紧去FireEye官网了解下具体发生了什么。

漏洞本身有趣的成因和触发条件，在利用时无需明文密码，只要具备NTHash即可成功，在利用方式上会相对更加灵活。同时，存在漏洞的功能点本身具备持久化功能，利用成功后将直接进行持久化行为，在不修复漏洞的情况下将永远存在。

Today FireEye shared that they were victim of a cyberattack and internal red teaming tooling was accessed by adversaries. More details in this NYT article. This reminded me that I wanted to do a post on actively protecting pen testers and pen testing assets for a while. Against persistent adversaries it is only a matter of time when they succeed, not if they will succeed. The big question is do you know when an adversary starts poking around, and when they succeed?

We explore the three general job roles and skill sets in cybersecurity: engineering defenses, testing security, and responding to cyberattacks.

人望山，鱼窥荷

Hi Folks, We want to continue to highlight changes we’ve made to our Security Update Guide. We have received a lot of feedback, much of which has been very positive. We acknowledge there have been some stability problems and we are actively working through reports of older browsers not being able to run the new application.

Hi Folks, We want to continue to highlight changes we’ve made to our Security Update Guide. We have received a lot of feedback, much of which has been very positive. We acknowledge there have been some stability problems and we are actively working through reports of older browsers not being able to run the new application.

2020 was a challenging year for many of us, as the COVID-19 pandemic disrupted life and introduced challenges in almost all elements of living. 2020 was also challenging from a cybersecurity point of view, as nearly the entire workforce moved...

In part 1 of this series, I drew the architectural distinction between a centralized cloud platform and a distributed edge network. This is an important foundation upon which to explain the difference between cloud computing and edge computing. The two serve very different and complementary purposes. However, in my experience, business leaders, product owners, and application developers often mistake them as competitive.

Over the past several years, questions about how to protect information exchanged in the Domain Name System (DNS) have come to the forefront. One of these questions was posed first to DNS resolver operators in the middle of the last decade, and is now being brought to authoritative name server operators: “to encrypt or not […]

The post A Balanced DNS Information Protection Strategy: Minimize at Root and TLD, Encrypt When Needed Elsewhere appeared first on Verisign Blog.

本报告部分引自Week in OSINT栏目，每周推荐好玩实用的工具，站点，技巧，文章等，适用于任何领域的研究人员，分析测试人员。

This is Part 2 of a 3-part blog series highlighting some of the distinguishing aspects of Akamai's DNS services, Edge DNS and Global Traffic Management.