Skip to content

Latest commit

 

History

History
170 lines (146 loc) · 25.4 KB

README_201905.md

File metadata and controls

170 lines (146 loc) · 25.4 KB
Raw

数据--所有

数据--年度

201905 信息源与信息类型占比

201905-信息源占比-secwiki

201905-信息源占比-xuanwu

201905-最喜欢语言占比

政策 推荐

title url
数据安全管理办法（征求意见稿） http://www.cac.gov.cn/2019-05/28/c_1124546022.htm
关于《网络安全审查办法（征求意见稿）》公开征求意见 http://www.cac.gov.cn/2019-05/24/c_1124532846.htm

微信公众号 推荐

nickname_english weixin_no title url
绿盟科技行业BG第一业务本部 军工行业工控安全防护思路 https://mp.weixin.qq.com/s/AVRYyob-bQdRRQ8i15SK3w
奇安信集团 qianxin-keji 一次攻防实战演习复盘总结 https://mp.weixin.qq.com/s/sfUQnFBlkRKf4uRDIVkG5Q
TideSec安全团队 TideSec ApacheTomca远程执行代码（CVE-2019-0232）漏洞浅析和复现 https://mp.weixin.qq.com/s/dhry2nxTyN4C0BUeBvOdZQ
苹果资本 Applefunds 网络安全行业不会一家独大 https://mp.weixin.qq.com/s/pyJYZZqrdiVjjtCdRaxkOw
阿里技术 ali_tech 异常检测的N种方法，阿里工程师都盘出来了 https://mp.weixin.qq.com/s/w7SbAHxZsmHqFtTG8ZAXNg
绿盟科技研究通讯 nsfocus_research 智能威胁分析之图数据构建 https://mp.weixin.qq.com/s/15Avw3KTnmGIftxYhK34mQ
学蚁致用 sudo_i 蚁剑绕WAF进化图鉴 https://mp.weixin.qq.com/s/u8_d8MXvFuwOyIMZZMBsog
SIGAI SIGAICN 深度学习算法地图 https://mp.weixin.qq.com/s/fRBdRo8eI1N_bUqh7k7I3A
黑鸟 blackorbird 欲亲临国内外网络战争现场，关注他们就够了 https://mp.weixin.qq.com/s/QaYPI8z4bXLUChuOrNxC-A
阿里安全响应中心 alisrc 基于设备指纹的风控建模以及机器学习的尝试 https://mp.weixin.qq.com/s/iifhFE8S_3E5d5MvGRbVow
绿盟科技 NSFOCUS-weixin 威胁情报的“魔力” https://mp.weixin.qq.com/s/Agy_I_TjwiJjvPL4q7j6nQ
永安在线情报平台 YongAnOnline 如何利用开源风控系统（星云）防止撞库？ https://mp.weixin.qq.com/s/r7EY1zcydTmaaEY91H1m5A
有无科技法 youwulaw 重磅！最新！网络存证未获取法院支持判决书全文！, 网络存证 https://mp.weixin.qq.com/s/dqXA8KT_zFJWEx39RGd9Qg
安全学术圈 secquan DNS Cache-Based User Tracking https://mp.weixin.qq.com/s/cSjoVgxjOAuIUlewX9iIoA
奇安信威胁情报中心 gh_166784eae33e 海量信息如何处理? 推荐几个优质开源情报分析源 https://mp.weixin.qq.com/s/xegDRXu9A0YMx3v8_E86Ow
嘶吼专业版 Pro4hou CVE-2019-3568： WhatsApp 0 day漏洞分析 https://mp.weixin.qq.com/s/NC9bSf1QGXugPBPYVgaEsQ
中关村杂志 zgcmagazine “网安卫士”刘文懋 https://mp.weixin.qq.com/s/GryQEbF3wxAmT7e-76X-mw
Tide安全团队 TideSec GeoServer漏洞利用总结及案例参考 https://mp.weixin.qq.com/s/lz5cAvLbYIdAQ3aRiiseYg
PaperWeekly paperweekly 基于小样本学习的意图识别冷启动 https://mp.weixin.qq.com/s/FLXeHnLo03r-8qfUX48VHw
这里是河马 https://mp.weixin.qq.com/s/FupNkLOOWAabvnC3Yob_uw
数字经济与社会 gh_feb1819ed27c 布拉格5G安全大会 “布拉格提案” https://mp.weixin.qq.com/s/sktQAoNeE-3na9lBPm9nzg
情报分析师 qingbaofenxishi 情报指挥中心加入公安部直属机关序列 https://mp.weixin.qq.com/s/ULHbGTI1YosdZG23aAE4Qw
安在 AnZer_SH 人物 , 饿了么王彬：安全即是公平 实现要靠运营 https://mp.weixin.qq.com/s/3UYObnoZV_g-AZFdSoxJLg
安全树洞 treeholeofsec 关于请教问题、一些圈子以及简历 https://mp.weixin.qq.com/s?__biz=MzU2NzkwNTQxNg==&mid=2247483719&idx=1&sn=1f68582237b3ece6f07bdf3be60fc1ec&chksm=fc975ca0cbe0d5b65824d2ec0bf2b11a2d26d69f6935371c73114db689fc3a56a13eeb6eeefb&token=1697253642&lang=zh_CN#rd
国际安全简报 securitybrief 赛门铁克公司加入美国防部的网络威胁情报共享项目 https://mp.weixin.qq.com/s/tHjveTuc1bi0TxmJKwMoGw
DappReview dappreview 2600万TRX被盗背后的罗生门 https://mp.weixin.qq.com/s/aInEaYdS9X7HP7FbzWl6AQ?from=timeline

组织github账号 推荐

github_id title url org_url org_profile org_geo org_repositories org_people org_projects repo_lang repo_star repo_forks
Microsoft SpeculationControl - 微软开发的用于获得当前 CPU Speculative Execution 相关缓解措施启用状态的脚本 https://github.com/Microsoft/SpeculationControl https://opensource.microsoft.com Open source, from Microsoft with love Redmond, WA 2457 4265 0 C,TypeScript,CMake,C#,JavaScript,C++,Python,Objective-C,HTML,PowerShell,CSS 76000 10400
microsoft AttackSurfaceAnalyzer - 微软开源了一个用于分析软件对系统攻击面影响的工具，Diff 软件安装前后对系统安全配置的影响 https://github.com/microsoft/AttackSurfaceAnalyzer https://opensource.microsoft.com Open source, from Microsoft with love Redmond, WA 2457 4265 0 Jupyter,TypeScript,CMake,C#,JavaScript,C++,Python,Objective-C,HTML,Rich,Go,Java,PowerShell,CSS 76100 10400
paypal yurita: Anomaly detection framework @ PayPal https://github.com/paypal/yurita http://developer.paypal.com/ San Jose, CA 181 32 0 Shell,Java,Clojure,Scala,C#,JavaScript,Python,Objective-C,Go,PHP,Ruby 1800 938
angr Phuzzer - 用于与 AFL Fuzzer 交互的 Python Wrapper 工具 https://github.com/angr/phuzzer http://angr.horse Next-generation binary analysis framework! http://angr.horse 30 16 0 C,Shell,Python,C++,HTML,POV-Ray 3500 600
nccgroup Blackbox protobuf - NCC Group 开源的用于解码和编辑 Protobuf 数据包的 Burp Suite 扩展 https://github.com/nccgroup/blackboxprotobuf https://www.nccgroup.trust Please report all security issues to security at nccgroup dot com Global 180 15 0 C,Shell,Java,Python,JavaScript,TypeScript,C#,HTML,Elixir,Go,Rust 692 63
CTFTraining CTFTraining: CTF Training 经典赛题复现环境 https://github.com/CTFTraining/CTFTraining https://CTFTraining.github.io A platform to provide challenge for CTFer China 50 1 1 TypeScript,Python,JavaScript,Perl,Shell,HTML,PHP,Dockerfile,CSS 137 27
google tarpc - Google 开源的 Rust 语言的 RPC 框架库 https://github.com/google/tarpc https://opensource.google.com/ Google ❤️ Open Source https://opensource.google.com/ 1472 2533 0 C,Shell,Jupyter,Python,JavaScript,C++,Dart,HTML,Go,Java,Rust 0 0
intel ModernFW - Intel 开源的一个实现性项目，旨在为云主机服务器提供一个最小可用的平台固件 https://github.com/intel/ModernFW mailto:[email protected] [email protected] 616 23 0 C,Shell,Java,Python,JavaScript,C++,TypeScript,Go,Rust 0 0
monzo response: Monzos real-time incident response and reporting tool https://github.com/monzo/response https://monzo.com/ We’re building the best bank on the planet. London, UK 110 31 0 Python,Ruby,JavaScript,C++,Objective-C,Swift,Go,Dockerfile 0 0
quarkslab Quarkslab 公开了很多他们团队近几年在安全会议上做过的演讲的资料 https://github.com/quarkslab/conf-presentations http://www.quarkslab.com http://www.quarkslab.com 46 2 0 Python,Shell,TeX,JavaScript,C++ 0 0
AzureAD Microsoft Authentication Library (MSAL) - AzureAD 团队开源的用于 Azure Active Directory 认证的 Python 库 https://github.com/AzureAD/microsoft-authentication-library-for-python http://azure.microsoft.com/en-us/services/active-directory/ Redmond, WA 37 82 0 C,TypeScript,Java,C#,JavaScript,Python,Objective-C,HTML,PHP,Ruby,PowerShell 0 0
Cisco-Talos Talos 团队开源了一批用于 Fuzz ClamAV 杀软的种子文件 https://github.com/Cisco-Talos/clamav-fuzz-corpus http://www.talosintelligence.com The official Organizational account of the Talos Group at Cisco http://www.talosintelligence.com 36 0 0 C,Shell,Python,JavaScript,C++,Lua,HTML,PHP 0 0
sslab-gatech 文件系统Fuzz工具，相关工作已发表在Oakland19 https://github.com/sslab-gatech/janus https://gts3.org https://gts3.org School of Computer Science, Georgia Tech 35 0 0 C,Filebench,Python,Makefile,C++,HTML,Smali 0 0
x41sec 平常在测试 Java 站点时经常能看到 500 错误所泄露出来的异常信息，为此该作者提供了一个网站输入异常信息即可展示出异常中所使用的 Java 组件的版本以及 CVE 编号，其做法是通过 类名、方法名、代码行数做Hash 之后存入数据库，最后通过检索数据库来确定版本信息。 https://github.com/x41sec/slides/blob/master/2019-bsides-stuttgart/YourStackTracesAreLeakingCVEs.pdf https://www.x41-dsec.de https://www.x41-dsec.de 8 0 0 C#,C,Java 0 0
w-digital-scanner w12scan: 网络资产发现引擎 https://github.com/w-digital-scanner/w12scan None Network security products && w(\d+)scan None 5 1 0 Python,CSS 0 0
advanced-threat-research McAfee 高级威胁研究团队开源了一个辅助寻找 ROP Gadget 的工具 - xbypass，xbypass 可以帮我们找到可以绕过 XML 文件格式字符限制的 Gadget 地址 https://github.com/advanced-threat-research/xbypass https://www.mcafee.com/enterprise/en-us/threat-center/advanced-threat-research.html https://www.mcafee.com/enterprise/en-us/threat-center/advanced-threat-research.html 4 0 0 Python,YARA 0 0
openitsystem itops: 基于Python + Django的AD\Exchange管理系统 https://github.com/openitsystem/itops?from=timeline https://www.opscaff.com 为行业提供更好的开源IT系统 https://www.opscaff.com 4 0 0 Python,Shell,JavaScript 0 0
redhuntlabs List of Awesome Asset Discovery Resources https://github.com/redhuntlabs/Awesome-Asset-Discovery http://redhuntlabs.com/ Discover and Assess your Attack Surface http://redhuntlabs.com/ 3 2 0 Python 0 0
QBDI QBDI - QuarksLab 开源的一款二进制动态插桩框架，支持 Linux, macOS, Android, iOS 和 Windows。 https://github.com/QBDI/QBDI https://qbdi.quarkslab.com QuarkslaB Dynamic binary Instrumentation Quarkslab 2 2 0 HTML,C++ 0 0
webarx-security wpbullet: A static code analysis for WordPress (and PHP) https://github.com/webarx-security/wpbullet https://www.webarxsecurity.com/ WebARX is a cyber security company focusing on web application security. https://www.webarxsecurity.com/ 1 0 0 Python 0 0

私人github账号 推荐

github_id title url p_url p_profile p_loc p_company p_repositories p_projects p_stars p_followers p_following repo_lang repo_star repo_forks
justjavac 免费的计算机编程类中文书籍 https://github.com/justjavac/free-programming-books-zh_CN https://github.com/denoland Creator of vscode-deno. Currently a contributor to Deno @denoland and author of @denodev. Tianjin, China None 64 0 810 11800 128 TypeScript,JavaScript,HTML 0 0
robertdavidgraham 研究员 robertdavidgraham 基于 zerosum0x0 CVE-2019-0708 扫描器的代码和开源 rdesktop 项目，移植了一个可以在 macOS 和 Windows 编译的 CVE-2019-0708 扫描器 https://github.com/robertdavidgraham/rdpscan http://robertgraham.com @ErrataRob None 37 0 0 1200 4 C 9900 1600
0vercl0k Exploit for CVE-2019-9810 Firefox on Windows 64 bits https://github.com/0vercl0k/CVE-2019-9810 https://doar-e.github.com/ US/FR None 15 0 7 704 0 Python,JavaScript,C++ 760 157
zerosum0x0 研究员 zerosum0x0 公开 Windows RDP RCE CVE-2019-0708 漏洞的扫描器 https://github.com/zerosum0x0/CVE-2019-0708 https://zerosum0x0.blogspot.com USSA None 83 0 23 697 2 Python,C#,C,C++ 1300 362
SandboxEscaper SandboxEscaper公开了一个task scheduler服务未正确模拟client令牌导致LPE的0day。 https://github.com/SandboxEscaper/polarbearrepo None None None 1 0 0 692 0 C++ 157 88
ChiChou 研究员 CodeColorist 公开了一个 iOS 12.3 刚刚修复的 medialibraryd CVE-2019-8577 漏洞的 PoC 代码 https://github.com/ChiChou/sploits/tree/master/NotByMe/CVE-2019-8577 https://github.com/alipay 我要卖掉我的代码 浪迹天涯 Beijing, China @alipay 55 0 1500 588 245 Objective-C,JavaScript,C,Vue 1100 155
Ekultek BlueKeep - Ekultek 研究员公开 Windows RDP CVE-2019-0708 RCE PoC https://github.com/Ekultek/BlueKeep None U3VjY2VzcyBpcyBpbiB0aGUgZXllIG9mIHRoZSBiZWhvbGRlci4= None None 89 0 122 497 11 Python,C++ 3700 952
rasta-mouse Watson - 用于探测 Windows 环境缺失补丁枚举可利用本地提权漏洞的工具 https://github.com/rasta-mouse/Watson/tree/2.0 https://github.com/ZeroPointSecurity None @ZeroPointSecurity 20 0 58 373 7 C#,PowerShell 0 0
xorrior CobaltStrike 基于 WebSockets 的 C2 远控组件 https://github.com/xorrior/raven https://www.xorrior.com PowerShell, C#, Obj-C, macOS Security, Red Team Operator None SpecterOps 53 0 93 363 9 C#,Objective-C,PowerShell,C++ 358 82
xoofx 基于 .NET 写的一个 C/C++ Parser 工具，可以得到 full AST、macros 信息 https://github.com/xoofx/CppAst https://github.com/Unity-Technologies Grenoble - France @Unity-Technologies 58 0 209 339 19 C# 1500 417
Tuhinshubhra ExtAnalysis: Browser Extension Analysis Framework https://github.com/Tuhinshubhra/ExtAnalysis https://twitter.com/r3dhax0r I code and hack for fun! ... None 13 0 2 316 0 Python,PHP,JavaScript,CSS 0 0
0x4D31 大规模网络指纹探测与数据聚类分析，作者利用网络指纹信息追踪攻击者及攻击工具，同时发布了一个工具 FATT。来自 AusCERT 2019 会议 https://github.com/0x4D31/Presentations https://github.com/salesforce Lead Threat Detection Engineer @salesforce Sydney, Australia None 21 0 1100 307 77 Python,Go 793 164
ExpLife0011 CVE-2019-0803: Win32k Elevation of Privilege Poc https://github.com/ExpLife0011/CVE-2019-0803 None None None 2800 0 3000 288 489 Python,C#,C,Assembly,C++ 672 227
yeyintminthuhtut Browser、Mitigation 、Kernel 等漏洞利用相关研究 https://github.com/yeyintminthuhtut/Awesome-Advanced-Windows-Exploitation-References http://pentest.space Twitter @yeyint_mth Singapore None 287 0 477 223 19 Shell 0 0
DrDonk Patch VMware ESXi 以支持 VMware 安装 macOS 系统的工具，支持 VMware ESXi 6.5 and 6.7 https://github.com/DrDonk/esxi-unlocker None None None 14 0 0 180 0 Python,C,Shell,JavaScript 902 179
secgroundzero tetanus: Helper script for mangling CS payloads https://github.com/secgroundzero/tetanus None None None 10 0 4 157 7 Python,C#,JavaScript,Shell 2100 285
Bypass007 应急响应实战笔记 https://github.com/Bypass007/Emergency-Response-Notes None 欢迎关注公众号Bypass--，专注于信息安全。 Xiamen, China None 4 0 3 133 0 Python 806 164
guedou 为 Ghidra 逆向框架提供对东芝 MeP-c4 处理器架构的支持，源文件 https://github.com/guedou/ghidra-processor-mep None Paris, France None 29 0 73 108 0 Python,OCaml 3900 881
patois HRDevHelper - IDA HexRays 反汇编工具的插件，用于支持实时查看反编译后 C 代码的 ctree 信息 https://github.com/patois/HRDevHelper None Yo, was github? 127.0.0.1 None 32 0 233 86 48 Python 184 19
yadox666 硬件黑客的工具箱，里面涵盖了硬件安全各个领域中使用的软件和硬件工具的介绍和推荐。 https://github.com/yadox666/The-Hackers-Hardware-Toolkit/blob/master/TheHackersHardwareToolkit.pdf https://twitter.com/yadox Yago Hansen is a recognized authority in IT security topics. He successfully managed projects related to the design of Security technologies and devices. Madrid Mundo Hacker 8 0 1 78 1 Python 863 103
tarafans XuWen在zer0con上关于js和DOM fuzz的议题，提出了一种Emulation-based generation的fuzz思路。 https://github.com/tarafans/collections/blob/master/ZeroCon2019.pdf https://gts3.org/~wen Atlanta Georgia Tech 20 0 5 75 10 Python,C,HTML 17 4
TarlogicSecurity 从 Linux 内存中 dump 出Kerberos 票据 https://github.com/TarlogicSecurity/tickey https://www.tarlogic.com/en/ Cyber security, cyber intelligence, Red Team None Tarlogic 11 0 0 56 0 Go,Python,C,C++ 87 19
jiansiting Decryption-Tools: 勒索病毒解密工具的汇总 https://github.com/jiansiting/Decryption-Tools None 剑思庭 China Industrial Control Security Researcher 12 0 8 53 0 Python 90 49
qingxp9 macOS Mojave 10.14.4 802.1X 组件网络流量劫持逻辑漏洞的 PoC https://github.com/qingxp9/CVE-2019-6203-PoC https://qingxp9.github.io/ Wireless Security Researcher None 360 PegasusTeam 18 0 118 52 22 Python,C,Shell 3800 859
IgorKorkin 基于 HyperPlatform / DdiMon 实现的驱动程序内核内存访问保护。作者举的实际应用例子是防止劫持其它驱动程序的 FILE_OBJECT 对象，但似乎有点大材小用。 https://github.com/IgorKorkin/MemoryRanger http://igorkorkin.blogspot.com An expert in digital security, full of passion and curiosity Im focusing on protection the Windows OS Kernel. #MEPhI alumni None None 16 0 3 49 29 C++ 53 14
terjanq 一款JS编码工具，可以将 JS 编码成仅含有 /[a-z().]/ 字符的代码 https://github.com/terjanq/JS-Alpha/tree/master None Student of Informatics and Mathematics at University of Wroclaw None None 21 0 17 28 7 HTML,JavaScript,C++ 166 7
digital-missiles 上周爆出 CVE-2019-0708 远程桌面服务的蠕虫级 RCE 漏洞，但是一只没有 PoC 公开出来。昨天 GitHub 上 digital-missiles 公开了一个可以触达漏洞函数路径的 PoC，不会引起拒绝服务。 https://github.com/digital-missiles/CVE-2019-0708-PoC-Hitting-Path None None None 1 0 0 27 0 Python 183 67
zerobyte-id Bashter: Web Crawler, Scanner, and Analyzer Framework (Shell-Script based) https://github.com/zerobyte-id/Bashter https://zerobyte.id Dumb Repo None None 11 0 3 26 0 Shell,JavaScript,PHP 0 0
DanyL 作者公开了iOS12.3中修复的漏洞CVE-2019-8637和CVE-2019-8593的exploits https://github.com/DanyL/lockdownd_playground None None None 16 0 15 24 7 Tcl,C,Shell,Ruby,Objective-C 40 9
lyxhh HTTPDecrypt: 利用HTTP协议 远程加解密数据包，实现Burp一条龙服务 https://github.com/lyxhh/lxhToolHTTPDecrypt None None None 5 0 169 23 0 Python,JavaScript,HTML 354 112
vulmon Vulmap: Vulmap Online Local Vulnerability Scanners Project https://github.com/vulmon/Vulmap https://github.com/yavuzatlas Open source tools of Vulmon @yavuzatlas @ozelfatih None None 1 0 1 20 0 Python 0 0
linhlhq 微软 2 月份修复的 SharePoint RCE 漏洞的 PoC 代码（CVE-2019-0604） https://github.com/linhlhq/CVE-2019-0604 https://twitter.com/linhlhq None None 53 0 2 17 3 C,C#,C++,Python,Pascal,Go,PowerShell 75 45
c0d3p1ut0s FasterXML jackson-databind 2.x 服务器任意文件读漏洞（CVE-2019-12086） https://github.com/c0d3p1ut0s/CVE-2019-12086-jackson-databind-file-read https://c0d3p1ut0s.github.io/ Hangzhou China None 5 0 2 15 0 Python,HTML,Java 61 7
ReAbout datacon比赛方向三-攻击源与攻击者分析writeup https://github.com/ReAbout/datacon None Re.About Beijing Tsinghua University 4 0 124 10 2 Python 21 8
W00t3k Awesome-Cellular-Hacking https://github.com/W00t3k/Awesome-Cellular-Hacking None Wireless eap peap lootbooty None Lootb00ty Inc. 601 0 85 9 3 Python,C,HTML 71 8
lucamassarelli 二进制函数相似性比对工具，相关论文已公开。相比于之前使用机器学习方法解决此类问题的研究，其亮点是引入了 RNN 神经网络中的 Self-Attentive (自注意力) 技术，且仅使用了汇编指令的特征。论文中与 Gemini 做了实验对比，各项数据都优于 Gemini 。 https://github.com/lucamassarelli/yarasafe None Phd Student @ Sapienza University of Rome Rome None 7 0 7 6 0 Python,C,CSS 52 7
KTN1990 WordPress Ninja Forms File Uploads 插件任意文件上传漏洞 PoC（CVE-2019-10869） https://github.com/KTN1990/CVE-2019-10869/blob/master/README.md https://www.facebook.com/KtN.1990 𝖍𝖆𝖈𝖐 𝖙𝖔 𝖑𝖎𝖛𝖊 𝖆𝖓𝖉 𝖑𝖎𝖛𝖊 𝖙𝖔 𝖍𝖆𝖈𝖐 DZ ⓪ⓧ⑥⑥⑥ 11 0 8 6 3 Python,Perl 7 0
sharepub CheckVM-Sandbox https://github.com/sharepub/CheckVM-Sandbox None None None 1 0 0 3 0 C++ 70 17
idapython IDA Pro IDAPython 项目的源代码 https://github.com/idapython/src None None None None 0 0 0 0 0 Python 0 0
compsec-snu Fuzz内核中条件竞争漏洞的工具，相关工作已经发表在Oakland19上 https://github.com/compsec-snu/razzer None None None None 0 0 0 0 0 C 0 0
YanxinTang Watermark: 网页添加水印的库 https://github.com/YanxinTang/Watermark https://yanx.in Frontend Developer None None 13 0 65 0 2 JavaScript 0 0

medium 推荐

title url
本地攻击三星手机 ContainerAgent APP 的导出组件，导致持久化的本地DOS http://medium.com/@fs0c131y/how-to-brick-all-samsung-phones-6aae4389bea
搭建一个 Drupal Core RCE（CVE-2019–6340 ）漏洞的蜜罐 http://medium.com/@SecurityBender/building-a-real-world-web-honeypot-for-cve-2019-6340-rce-in-drupal-core-f4240f989c3f
CVE-2019–0708 Windows RDP RCE 漏洞的影响面有多大，以及如何利用 Sigma 规则、Elastic、ArcSight 检测这种攻击 http://medium.com/@ab_65156/proactive-detection-content-cve-2019-0708-vs-mitre-att-ck-sigma-elastic-and-arcsight-22f9ebae7d82
利用 Slack Windows 版本客户端的漏洞窃取 Slack 用户下载的所有文件 http://link.medium.com/eFLkuCEvLW
WordPress 5.0.0 RCE(CVE-2019–6977) 漏洞的详细分析 http://medium.com/@knownsec404team/the-detailed-analysis-of-wordpress-5-0-rce-a171ed719681
CORS（跨域资源共享）错误配置漏洞的高级利用 http://link.medium.com/UTKkk4wvGW
组合 4 个 CSRF 漏洞搞定公司的账户 http://medium.com/a-bugz-life/4x-csrfs-chained-for-company-account-takeover-f9fada416986

medium 推荐

title url
A Debugging Primer with CVE-2019–0708 https://medium.com/@straightblast426/a-debugging-primer-with-cve-2019-0708-ccfa266682f6
Detecting Patterns with Unsupervised Learning https://medium.com/code-gin/detecting-patterns-with-unsupervised-learning-88ba737d4f34
Details of SIM port hack https://medium.com/coinmonks/the-most-expensive-lesson-of-my-life-details-of-sim-port-hack-35de11517124?sk=4c29b27bacb2eff038ec8fe4d40cd615
Even more secret Telegrams https://medium.com/@labunskya/secret-telegrams-bdd2035b6e84
Stealing Downloads from Slack Users https://medium.com/tenable-techblog/stealing-downloads-from-slack-users-be6829a55f63
Reversing Golang Binaries: Part-2 https://medium.com/@nishanmaharjan17/reversing-golang-binaries-part-2-26f522264d01
Reversing Golang Binaries: Part-1 https://medium.com/@nishanmaharjan17/reversing-golang-binaries-part-1-c273b2ca5333
An Old Cisco OpenSSH Bug https://medium.com/tenable-techblog/an-old-cisco-openssh-bug-342ce6679f61

知乎 推荐

title url
知识图谱怎么入门 https://zhuanlan.zhihu.com/p/65457826
使用Suricata和ELK进行流量检测 https://zhuanlan.zhihu.com/p/64742715

论坛 推荐

title url
某CMS组合漏洞至Getshell https://xz.aliyun.com/t/5277
CVE-2018-12067及类似漏洞分析与相关思考 https://xz.aliyun.com/t/5248
国赛-bbvvmm-SM4逆向分析，虚拟机指令分析 https://xz.aliyun.com/t/5195
APT28分析之CVE-2015-1641样本分析 https://xz.aliyun.com/t/5198
RCTF 2019 Web Writeup https://xz.aliyun.com/t/5218
一次综合渗透测试 https://xz.aliyun.com/t/5128
我的CSP绕过思路及总结 https://xz.aliyun.com/t/5084
Kerberos Security https://xz.aliyun.com/t/5004

日更新程序

python update_daily.py