SecWiki周刊（第322期） – 作者:SecWiki

安全资讯

[法规]  网络安全审查办法

https://mp.weixin.qq.com/s/nAjbLxdDnflhc_89y0e01Q

安全技术

[Web安全]  2020攻防演练弹药库

https://blog.riskivy.com/2020%E6%94%BB%E9%98%B2%E6%BC%94%E7%BB%83%E5%BC%B9%E8%8D%AF%E5%BA%93-%E6%82%A8%E6%9C%89%E4%B8%BB%E6%9C%BA%E4%B8%8A%E7%BA%BF%E8%AF%B7%E6%B3%A8%E6%84%8F/

[Web安全]  某门户系统授权渗透测试

https://mp.weixin.qq.com/s/n3AQ88RPYGUWxY1Los5tbQ

[工具]  beholder:一款监控端口变化的系统

https://github.com/zj1244/beholder_scanner

[其它]  谈谈工作和学习中，所谓的主动性

https://mp.weixin.qq.com/s/qB9phQwF8NulwSGINQz3yA

[Web安全]  SonarQube实现自动化代码扫描

https://mp.weixin.qq.com/s/L5WeEFvu6etVTAigx6jjcQ

[恶意分析]  WebShell通用免杀的思考

https://mp.weixin.qq.com/s/GjAPqrpMT6cHwkWTRjUu1Q

[无线安全]  短信身份验证的安全风险

https://xz.aliyun.com/t/7638

[恶意分析]  The DGA of Zloader

https://johannesbader.ch/blog/the-dga-of-zloader/

[法规]  《网络安全审查办法》要点解读

https://www.freebuf.com/news/235177.html

[Web安全]  渗透利器Cobalt Strike在野利用情况专题分析

https://mp.weixin.qq.com/s/Agr3doBvYMK6Bs0tH6urcw

[Web安全]  Fastjson反序列化进攻利用

https://mp.weixin.qq.com/s/i7-g89BJHIYTwaJbLuGZcQ

[Web安全]  Fortify: 源代码漏洞の审计

https://github.com/wooyunwang/Fortify

[Web安全]  Spring Boot Actuator 漏洞利用

https://mp.weixin.qq.com/s/q0y2WNIhkmR88Mdpyv4_QQ

[观点]  相信技术的力量 – RSAC 2020 (2)

https://mp.weixin.qq.com/s/C_qQtuisG0NVcwad4y0BqQ

[数据挖掘]  基于大数据的Uber数据实时监控（Part 1：Spark机器学习）

https://mp.weixin.qq.com/s/mr-007pdIzOXPDaAUha1Ww

[漏洞分析]  CVE-2020-0932: remote code execution on microsoft sharepoint

https://www.zerodayinitiative.com/blog/2020/4/28/cve-2020-0932-remote-code-execution-on-microsoft-sharepoint-using-typeconverters

[漏洞分析]  Linux 内核内存管理与漏洞利用

https://paper.seebug.org/1153/

[其它]  Kobold: Evaluating Decentralized Access Control for Remote NSXPC Methods on iOS

https://securitygossip.com/blog/2020/04/21/kobold-evaluating-decentralized-access-control-for-remote-nsxpc-methods-on-ios/

[漏洞分析]  Patchguard: Detection of Hypervisor Based Introspection [P2]

https://revers.engineering/patchguard-detection-of-hypervisor-based-instrospection-p2/

[数据挖掘]  基于大数据的Uber数据实时监控（Prat 3：使用Vert.x的实时仪表盘）

https://mp.weixin.qq.com/s/ARz1tytLWwkAlFA4XV-MYA

[漏洞分析]  Patchguard: Detection of Hypervisor Based Instrospection [P1]

https://revers.engineering/patchguard-detection-of-hypervisor-based-instrospection-p1/

[运维安全]  应急响应之CC攻击事件

https://mp.weixin.qq.com/s/idoKIGK7-z3SOjMKCflJlg

[数据挖掘]  在网络安全领域应用机器学习的困难和对策

https://mp.weixin.qq.com/s/j7vuiAWz6kY4ePsjb5EtDw

[其它]  2019年网络安全报告精选

https://mp.weixin.qq.com/s/YCSuRXhiFYGaE-f3_C8l5A

[恶意分析]  LeetHozer Botnet分析报告

https://blog.netlab.360.com/the-leethozer-botnet/

[工具]  Joystick :transform the ATT&CK Evaluations data into concise views

https://github.com/mitre-attack/joystick

[杂志]  SecWiki周刊（第321期)

https://www.sec-wiki.com/weekly/321

[数据挖掘]  基于大数据的Uber数据实时监控（Part 2：Kafka和Spark Streaming）

https://mp.weixin.qq.com/s/GAHYECAWLvOob7TSQHHaiQ

[其它]  Mimikatz的18种免杀姿势及防御策略(上)

https://mp.weixin.qq.com/s/CiOaMnJBcEQfZXV_hopzLw

[漏洞分析]  西门子 PLC S7-1500 漏洞分析与复现（附演示视频）

https://paper.seebug.org/1189/

[数据挖掘]  在注册时检测社交网络中的虚假账户—以Wechat为例

https://mp.weixin.qq.com/s/DYYvjF6Rx1Xg7PVB80EKKA

[恶意分析]  COVID-19攻击手段与数据分析

https://mp.weixin.qq.com/s/C_BN96qI9Wb96KcyqXb4_Q

[其它]  Mimikatz的18种免杀姿势及防御策略(下)

https://mp.weixin.qq.com/s/0p88rj-tWClLa_geKMkPgw

[Web安全]  利用Cloudflare Worker来隐藏C2基础设施

https://www.freebuf.com/sectool/232555.html

[其它]  How to hook Android Native methods with Frida (Noob Friendly) |

https://erev0s.com/blog/how-hook-android-native-methods-frida-noob-friendly/

[恶意分析]  在Kali Linux 2020系统中安装、配置和使用cuckoo沙箱

https://www.freebuf.com/sectool/234251.html

[Web安全]  远控免杀专题-终结篇

https://mp.weixin.qq.com/s/4shT8tP-Gu3XX7fnWKQHAA

[漏洞分析]  Rick教你写shellcode系列之邪恶的pdf

https://xz.aliyun.com/t/7684

[运维安全]  企业快速实践部署IAST/RASP的一种新思路

https://www.freebuf.com/articles/es/235441.html

[设备安全]  西门子S7comm协议Read SZL解析

http://blog.nsfocus.net/s7comm-readszl-0427/

[运维安全]  SSDLC安全需求分析

https://www.freebuf.com/articles/es/232542.html

-----微信ID：SecWiki-----
SecWiki，8年来一直专注安全技术资讯分析！
SecWiki：https://www.sec-wiki.com

本期原文地址: SecWiki周刊(第322期)

来源：freebuf.com 2020-05-04 20:11:58 by: SecWiki