SecWiki周刊（第328期） – 作者:SecWiki

安全资讯

[观点]  《黑镜》：斯诺登揭露NSA的社交图谱工厂

https://www.anquanke.com/post/id/207943

[新闻]  工控安全事件汇总与分析

https://mp.weixin.qq.com/s/rG1oG8nz07DtRKTRaJjM7A

安全技术

[恶意分析]  玖色直播安全情报报告

https://www.anquanke.com/post/id/207825

[Web安全]  碎遮SZhe_Scan Web漏洞扫描器

https://github.com/Cl0udG0d/SZhe_Scan

[Web安全]  Python 代码审计

https://github.com/MisakiKata/python_code_audit

[漏洞分析]  ScanCVE: 监控Github上CVE增量

https://github.com/grayddq/ScanCVE

[工具]  基于正则的VSCode代码审计插件

https://github.com/m4yfly/vscode-maudit

[Web安全]  MSSQL注入 突破不能堆叠的限制执行系统命令

https://mp.weixin.qq.com/s/CcgUb7mLlP2xjcrpy5VGbQ

[Web安全]  XSS修炼之-独孤九剑

http://xcao.vip/test/xss%E4%BF%AE%E7%82%BC%E4%B9%8B%E7%8B%AC%E5%AD%A4%E4%B9%9D%E5%89%91.pdf

[漏洞分析]  我对外挂的理解

https://forum.90sec.com/t/topic/1095

[Web安全]  冰蝎改造之适配基于tomcat Filter的无文件webshell

https://mp.weixin.qq.com/s/n1wrjep4FVtBkOxLouAYfQ

[Web安全]  渗透中的内网渗透

https://mp.weixin.qq.com/s/Mk5P_04SAitUjRztc9e-Rw

[漏洞分析]  JAVA 8u20 反序列化漏洞分析

https://paper.seebug.org/1232/

[运维安全]  操作系统基线检查脚本

https://www.freebuf.com/sectool/237396.html

[Web安全]  记一次测试Gitlab

https://xz.aliyun.com/t/7870

[取证分析]  [Sec-Trans-12] Github信息收集

https://mp.weixin.qq.com/s/LnjKK1YJ7BvMXPuFbeq37w

[恶意分析]  开源软件供应链攻击回顾

https://www.anquanke.com/post/id/207836

[数据挖掘]  AISecOps：打造可信任安全智能

https://mp.weixin.qq.com/s/Tz9V05CHqLg_Wt4yfJZffQ

[恶意分析]  探索如何使用自动化实现对恶意JavaScript脚本的反混淆处理

https://www.anquanke.com/post/id/207813

[漏洞分析]  ShellCode远程加载器改造计划

https://uknowsec.cn/posts/notes/ShellCode%E8%BF%9C%E7%A8%8B%E5%8A%A0%E8%BD%BD%E5%99%A8%E6%94%B9%E9%80%A0%E8%AE%A1%E5%88%92.html

[漏洞分析]  Monstra CMS RCE漏洞分析（CVE-2020-13384）

https://xz.aliyun.com/t/7850

[恶意分析]  代码克隆检测技术初探和开源工具地址分享

https://www.freebuf.com/sectool/233772.html

[漏洞分析]  用于UAF漏洞的二进制级定向模糊测试

https://www.anquanke.com/post/id/207827

[漏洞分析]  Java 8u20反序列化漏洞分析

http://blog.topsec.com.cn/java-8u20%e5%8f%8d%e5%ba%8f%e5%88%97%e5%8c%96%e6%bc%8f%e6%b4%9e%e5%88%86%e6%9e%90/

[漏洞分析]  从CVE-2018-4441看jsc的OOB利用

http://blog.topsec.com.cn/%e4%bb%8ecve-2018-4441%e7%9c%8bjsc%e7%9a%84oob%e5%88%a9%e7%94%a8/

[杂志]  SecWiki周刊（第327期)

https://www.sec-wiki.com/weekly/327

[漏洞分析]  Diving into the SMBLost vulnerability (CVE-2020-1301)

https://airbus-cyber-security.com/diving-into-the-smblost-vulnerability-cve-2020-1301/amp/?__twitter_impression=true

[Web安全]  白盒系列之变量追踪引擎（一）

https://www.freebuf.com/articles/web/236537.html

[Web安全]  Careem AWS S3 Bucket Takeover

https://ahussam.me/careem-aws-s3-bucket-takeover/

[Web安全]  BetterSafetyKatz: SafetyKatz dynamically fetches the latest pre-compile

https://github.com/Flangvik/BetterSafetyKatz

[漏洞分析]  vBulletin 5.6.1 SQL注入漏洞

https://xz.aliyun.com/t/7831

[Web安全]  LFCMS的一次审计

https://xz.aliyun.com/t/7844

[恶意分析]  Predict attacker groups from the techniques and software used

https://github.com/omergunal/Attacker-Group-Predictor

[Web安全]  pyc 混淆从入门到工具实现

https://mp.weixin.qq.com/s/qvbwTAmDOvpHrAoNdQ7RRA

[运维安全]  MySQL数据库巡检系统的设计与应用

https://tech.meituan.com/2020/06/04/mysql-detection-system.html

[工具]  GREYONE: Data Flow Sensitive Fuzzing

https://securitygossip.com/blog/2020/05/29/greyone-data-flow-sensitive-fuzzing/

[Web安全]  初探PythonOpcode逃逸

https://xz.aliyun.com/t/7828

[论文]  Google 技术文档写作课

https://developers.google.com/tech-writing/one

[设备安全]  Misbinding Attacks on Secure Device Pairing and Bootstrapping

https://securitygossip.com/blog/2020/05/19/misbinding-attacks-on-secure-device-pairing-and-bootstrapping/

[Web安全]  Anti-Debugging JavaScript Techniques

https://isc.sans.edu/forums/diary/AntiDebugging+JavaScript+Techniques/26228/

[设备安全]  D-Link DIR815路由器缓冲区溢出漏洞再分析

https://xz.aliyun.com/t/7835

[恶意分析]  php-malware-finder – Detect Potentially Malicious PHP

https://github.com/jvoisin/php-malware-finder

[Web安全]  2019年中国国内安全会议年报

https://www.hackinn.com/index.php/archives/688/

-----微信ID：SecWiki-----
SecWiki，8年来一直专注安全技术资讯分析！
SecWiki：https://www.sec-wiki.com

本期原文地址: SecWiki周刊(第328期)

来源：freebuf.com 2020-06-15 10:40:18 by: SecWiki