
腾讯玄武实验室安全动态推送
Tencent Xuanwu Lab Security Daily News
-
[ Conference ] r2con 2018 大会议题材料公开: https://github.com/radareorg/r2con/tree/master/2018/talks
-
[ Firmware ] InternalBlue - 深入了解蓝牙控制器固件: https://media.ccc.de/v/2018-154-internalblue-a-deep-dive-into-bluetooth-controller-firmware
-
[ Tools ] James Forshaw 发布 OleView.Net v1.5版本 : https://tyranidslair.blogspot.com/2018/09/finding-interactive-user-com-objects_9.htmlGitHub: https://github.com/tyranid/oleviewdotnet
-
[ Tools ] drmemory - 支持多平台的内存调试器: https://github.com/DynamoRIO/drmemory
-
[ Tools ] WinHeap-Explorer - 检测 Windows 应用基于堆的错误的 POC 项目: https://github.com/WinHeapExplorer/WinHeap-Explorer
-
[ Tools ] Easy-Pickings - 用于 Fuzz 交叉架构二进制文件的自动函数导出和链接工具: https://github.com/ChrisTheCoolHut/Easy-Pickings
-
[ Web Security ] 通过 ACME http-01 证书认证方式实现 XSS 攻击: https://labs.detectify.com/2018/09/04/xss-using-quirky-implementations-of-acme-http-01/
-
[ Browser ] JavaScriptCore 中的内联缓存: http://www.filpizlo.com/slides/pizlo-icooolps2018-inline-caches-slides.pdf
-
[ Detect ] 寻找隐藏在邮件服务器中的 WebShell: https://www.sans.org/summit-archives/file/summit-archive-1536345486.pdf
-
[ MalwareAnalysis ] 首款集勒索、间谍、银行木马于一体的新型综合型Android病毒深度分析: https://mp.weixin.qq.com/s/XbAWPGMWCWG831lQfJXuGg
-
[ Pentest ] 使用 SCF 文件泄露 NetNTLM Hash: https://1337red.wordpress.com/using-a-scf-file-to-gather-hashes/
-
[ Popular Software ] Mac AppStore 中的热门应用 Adware Doctor 悄悄窃取用户浏览器历史记录: https://objective-see.com/blog/blog_0x37.html
-
[ Popular Software ] Jenkins 错误配置导致的 RCE 漏洞实例: https://blog.securitybreached.org/2018/09/07/rce-jenkins-instance-dosomething-org-bug-bounty-poc/
-
-
-
-
[ Windows ] windows 10 build 1774 的模块变化信息 : http://redplait.blogspot.com/2018/09/apisetschemadll-from-windows-10-build.html
-
[ Windows ] DLL 劫持原理讲解: https://astr0baby.wordpress.com/2018/09/08/understanding-how-dll-hijacking-works/