[ Android ]  Kali NetHunter 3.0 Released : Android Mobile Penetration Testing Platform : https://www.offensive-security.com/kali-nethunter/nethunter-3-0-released/

[ Attrack ]  Neutrino Exploit Kit http://countuponsecurity.com/2016/01/06/neutrino-exploit-kit/

[ Attrack ]  Phishing Attacks Using Public Data http://goo.gl/k3XiJY #Phishing #SocialEngineering #SQLInjections #Trojans #Vulnerabilities

[ Attrack ]  Rigging compromise - RIG Exploit Kit http://blog.talosintel.com/2016/01/rigging-compromise.html

[ Crypto ]  Researchers demonstrate new collision attacks against SHA-1 and MD5 in TLS, IKE and SSH - http://ow.ly/WL0bu

[ Detect ]  New in the BApp Store: Java Deserialization Scanner - scans for Java deserialization vulnerabilities https://portswigger.net/bappstore/ShowBappDetails.aspx?uuid=228336544ebe4e68824b5146dbbd93ae

[ Device ]  EZCast dongle wifi key can be guessed and RCE vulns used to compromise device remotely. No vendor response. https://blog.checkpoint.com/wp-content/uploads/2015/12/EZCast_Report_Check_Point.pdf #IoT

[ Device ]  [RT-SA-2015-001] AVM FRITZ!Box: Remote Code Execution via Buffer Overflow http://goo.gl/fb/DxK8ik #FullDisclosure

[ Device ]  [RT-SA-2014-014] AVM FRITZ!Box: Arbitrary Code Execution Through Manipulated… http://goo.gl/fb/GUOQvK #FullDisclosure

[ Device ]  New post: Android-based Smart TVs Hit By Backdoor Spread Via Malicious App http://bit.ly/1TGFqyQ @ TrendMicro

[ Fuzzing ]  Retweeted Iván (@ aszy): Targeted Program Transformations for Symbolic Execution http://www.doc.ic.ac.uk/~cristic/papers/symex-transf-fse-ni-15.pdf http://fb.me/LJMNjKV8

[ Mac OS X ]  Using the OS X 10.10 Hypervisor Framework : A Simple DOS Emulator : http://www.pagetable.com/?p=764

[ Malware ]  Malicious Pastebin Replacement for jQuery http://ow.ly/WK2iU

[ Network ]  Cisco VLAN Trunking Protocol Vulnerabilities : http://tools.cisco.com/security/center/content/CiscoSecurityResponse/cisco-sr-20060913-vtp

[ Others ]  Insightful thesis on detecting previously unseen code injection attacks & targeted malware http://www.crysys.hu/~pek/thesis/thesis.pdf (via @ maartenvhb) #DFIR

[ Others ]  Deserialization Vulnerability : Automating the hunt http://blog.h3xstream.com/2016/01/deserialization-vulnerability.html

[ Others ]  BMP / x86 Polyglot https://warroom.securestate.com/bmp-x86-polyglot/

[ Others ]  Wrote a little DoS tool for apps that deserialize Java objects, none of the recent defenses do anything about it: https://www.contrastsecurity.com/security-influencers/java-deserializing-open-source-tool

[ Popular Software ]  Looks like I got the first bug disclosed for 2016 from @ thezdi! http://www.zerodayinitiative.com/advisories/ZDI-16-001/

[ ReverseEngineering ]  Just released the source code of WWCD - What Would Capstone Decode IDA plugin https://github.com/sektioneins/WWCD for demo see: http://youtu.be/GooE05QnuY0

[ Tools ]  TCP Reverse Shell with Password Prompt - 151 bytes : https://www.exploit-db.com/exploits/39185/

[ Tools ]  Viper : Binary Analysis Framework for Malware : http://viper.li/ cc : @ botherder

[ Web Security ]  Facebook Vulnerability Reflected File Download http://blog.infogen.al/2016/01/facebook-vulnerability-reflected-file.html #websec #vuln #bugbounty #hacking #infosec https://t.co/Ib0O1SoDJt

[ Web Security ]  http://pkav.net/XSS2.png 有用也好，无用也罢，愿 XSS 为你所用。