Aggregator

Cyber attackers seem to follow President Trump to every important international meeting, but Russia was not the main source of cyber attacks during the recent Trump-Putin meeting, China was.

会陆陆续续的把GoogleCTF题目的相关复现整理出来，这里先放一部分。通过这次Beginner训练还是了解到了许多之前没接触过的，比如PWN题中的libc地址问题。

之前的博客荒废掉了，所以在github上开一个新的博客希望能够坚持下去吧。也不讲太多矫情的话了，撸起袖子就是肝。

一开始会更新的比较慢，hexo的博客还需要一段时间适应，之后会逐渐加快。

周末看了看GoogleCTF的beginner题目，感觉有些题目还不错，这里就先分析其中一道题JS Safe。

题目

YOURLS 简介 YOURLS (Your Own URL Shortener) 是一款开源的PHP程序，让你可以轻松建立属于自己的短网址生成系统。而无需第三方平台你就可以获得所有的数据统计，并且支持一系列插件扩展。

The underlying protocols of the Internet continue to evolve, and massive events such as the World Cup are a great opportunity to see this in action.

前文介绍了导入表hook，现在来说下导出表的hook。导出表的hook的流程如下。1、获取动态库基值 2、计算program header table实际地址 通过ELF文件头获取到程序表头的偏移地址及表头的个数 3、遍历program header table，找到类型为PT_DYNAMIC的区段

全局符号表(GOT表)hook实际是通过解析SO文件，将待hook函数在got表的地址替换为自己函数的入口地址，这样目标进程每次调用待hook函数时，实际上是执行了我们自己的函数。 GOT表其实包含了导入表和导出表，导出表指将当前动态库的一些函数符号保留，供外部调用，导入表中的函数实际是在该动态库中

F5 Labs' Ray Pompon writes for HelpNetSecurity, discussing the grey areas of threat research and some common issues researchers encounter.

6月30日，首届工业互联网安全精英邀请赛颁奖典礼在2018年第二十二届中国国际软件博览会“软件之夜”盛典上隆重…

Gootkit malware uses misleading code to hinder manual research and automated analysis.

The Fourth of July is characterized by barbeques, fireworks, and patriotism – and now cyberattacks! Just this past Independence Day,...

The post Popular Social Media App Timehop Hit With Huge Data Breach appeared first on McAfee Blog.

新项目用的 PHP 7.1.13 版本，在使用过程中发现 浮点类型 数据经过 json_encode 之后会出现精度问题。 举个例子： $data = [ 'stock' => '100', 'amount' => 10, 'price' => 0.1 ]; var_dump($data); echo json_encode($data); 输出结果： array(3) { ["stock"]=> string(3) "100" ["amount"]=> int(10) ["price"]=> float(0.1) } { "stock":"100",

7月5日上午，2018年工业信息安全技能大赛开幕赛，西部赛区初赛启动仪式在四川大学望江校区体育馆正式拉开帷幕。…

Today, we released security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to turn on automatic updates. More information about this month’s security updates can be found on the Security Update Guide.

Today, we released security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to turn on automatic updates. More information about this month’s security updates can be found on the Security Update Guide.

Threat actors continue to find creative yet relatively unsophisticated ways to launch new campaigns to reap profits from crypto-mining operations.