2017-05-12 10:27:32
阅读:155次
点赞(0)
收藏
作者:adlab_puky
热点概要:惠普电脑的音频驱动中发现内置的keylogger、OnePlus OTA相关的漏洞分析与利用、基于DOM的AngularJS沙箱逃逸、Vanilla Forums 2.3以下版本无需认证的远程代码执行漏洞、EnCase Forensic Imager取证工具存在栈溢出漏洞可以被恶意软件实现远程控制、OpenVPN 2.4.0未认证的拒绝服务、漫谈同源策略攻防、Hack php mail additional_parameters
资讯类:
惠普电脑的音频驱动中发现内置的键盘记录器
http://securityaffairs.co/wordpress/59013/hacking/hp-keylogger-conexant-audio-driver.html
技术类:
我的汽车保险如何暴露我的位置
https://www.andreascarpino.it/posts/how-my-car-insurance-exposed-my-position.html
惠普电脑的音频驱动中发现内置的keylogger
https://www.modzero.ch/advisories/MZ-17-01-Conexant-Keylogger.txt
哈希套件 - windows密码安全审查工具
http://www.openwall.com/lists/oss-security/2017/05/10/3
OnePlus OTA相关的漏洞分析与利用
https://alephsecurity.com/2017/05/11/oneplus-ota/
OpenVPN 2.4评估和报告
https://www.privateinternetaccess.com/blog/2017/05/openvpn-2-4-evaluation-summary-report/
对Mac os上的Proton.B恶意样本分析
https://www.cybereason.com/labs-proton-b-what-this-mac-malware-actually-does/
基于DOM的AngularJS沙箱逃逸
http://blog.portswigger.net/2017/05/dom-based-angularjs-sandbox-escapes.html
Gixy的主要目标是防止Nginx安全配置错误,并自动进行缺陷检测
https://github.com/yandex/gixy
Vanilla Forums <= 2.3 Host头注入CVE-2016-10073
https://exploitbox.io/vuln/Vanilla-Forums-Exploit-Host-Header-Injection-CVE-2016-10073-0day.html
Vanilla Forums <= 2.3无需认证的远程代码执行漏洞
https://exploitbox.io/vuln/Vanilla-Forums-Exploit-RCE-0day-Remote-Code-Exec-CVE-2016-10033.html
通过一个ImageMagick 漏洞泄漏 dropbox.com 和 box.com服务器上的内存
https://scarybeastsecurity.blogspot.com/2017/05/proving-missing-aslr-on-dropboxcom-and.html
EnCase Forensic Imager取证工具存在栈溢出漏洞可以被恶意软件实现远程控制
http://blog.sec-consult.com/2017/05/chainsaw-of-custody-manipulating.html
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170511-0_Guidance_Software_Encase_Stack_based_buffer_overflow_v10.txt
Windows 10 HAL’s Heap – Extinction of the "HalpInterruptController" Table Exploitation Technique
https://labs.bluefrostsecurity.de/blog/2017/05/11/windows-10-hals-heap-extinction-of-the-halpinterruptcontroller-table-exploitation-technique/
黑客XSS的天堂
http://xssor.io/
AppLocker Bypass – Regsvr32
https://pentestlab.blog/2017/05/11/applocker-bypass-regsvr32/
Hack PHP mail additional_parameters
http://blog.nsfocus.net/hack-php-mail-additional_parameters/
百度BSRC SQL注入挑战赛部分writeup
http://blog.nudtcat.org/SQL%E6%B3%A8%E5%85%A5/%E7%99%BE%E5%BA%A6BSRC-SQL%E6%B3%A8%E5%85%A5%E6%8C%91%E6%88%98%E8%B5%9B%E9%83%A8%E5%88%86writeup/
漫谈同源策略攻防
https://eth.space/same-origin-policy-101/
乐固加固(17年1月)逆向分析
http://bbs.pediy.com/thread-217556.htm
关于Android应用程序漏洞的防护措施
http://www.CodeSec.Net/articles/terminal/134018.html
Microsoft OneDrive iOS App 8.13 URI处理不当
https://cxsecurity.com/issue/WLB-2017050071
OpenVPN 2.4.0未认证的拒绝服务
https://www.exploit-db.com/exploits/41993/
XXE漏洞利用的一些技巧
http://www.91ri.org/17052.html
本文由 安全客 原创发布,如需转载请注明来源及本文地址。
本文地址:http://bobao.360.cn/learning/detail/3846.html