SecWiki周刊（第268期） – 作者:SecWiki

安全资讯

[事件]  维基解密公开的数千份可下载敏感文件

https://nosec.org/home/detail/2487.html

[新闻]  国家安全机关公布三起境外网络攻击窃密案件

http://www.xinhuanet.com/legal/2019-04/18/c_1124383501.htm

[新闻]  中央企业负责人经营业绩考核办法

http://www.sasac.gov.cn/n2588035/n2588320/n2588335/c8108632/content.html

[法规]  互联网个人信息安全保护指南

http://www.beian.gov.cn/portal/topicDetail?id=88

[人物]  腾讯云鼎实验室掌门人Killer谈网络安全

https://mp.weixin.qq.com/s/MLvd1AmxE9YnkWWmB9L9VQ

[新闻]  网络安全技术应用试点示范项目公示

http://www.miit.gov.cn/n1146285/n1146352/n3054355/n3057724/n3057728/c6794942/content.html

[新闻]  全球最大网络安全演习北约“锁盾”：法国夺冠

https://mp.weixin.qq.com/s/uY9EzJAg7OtJKgcFYwOVEA

[观点]  企业海外机构信息安全保密风险分析及对策建议

https://mp.weixin.qq.com/s/jJyq7bYuq1xxGXpfnmKP3g

安全技术

[Web安全]  阿里巴巴被发现了一个可以绕过waf的漏洞

https://nosec.org/home/detail/2483.html

[Web安全]  Netsparker5.3破解版 Netsparker Pro 5.3.0.23162[cracked]

https://www.ddosi.com/b170/

[Web安全]  一文洞悉DAST、SAST、IAST —Web应用安全测试技术对比浅谈

https://mp.weixin.qq.com/s/EWn9ktce3KB4P6zi4slnTA

[其它]  理清弄透：加密&解密、签名&验签

https://mp.weixin.qq.com/s/aw5V95kelBslFv-ScxUVMw

[设备安全]  针对VxWorks设备的分析工具VxHunter介绍

https://mp.weixin.qq.com/s/RPLGCwb6do2LbIodFGoGBQ

[运维安全]  osquery源码解读之分析shell_history

http://www.polaris-lab.com/index.php/archives/634/

[恶意分析]  2019年僵尸网络主动监测报告（第一期）

https://mp.weixin.qq.com/s/ptimjyH9wlamO83nPZMa-Q

[取证分析]  隐私币应用全景观察

https://mp.weixin.qq.com/s/bhWaKtVTqOLlJ1lj362rNA

[运维安全]  osquery源码解读之分析process_open_socket

http://www.polaris-lab.com/index.php/archives/638/

[Web安全]  Web弱口令通用检测方法探究

https://mp.weixin.qq.com/s/R0M1V0X4eG_GnSyZK3Fz_A

[漏洞分析]  Spring Cloud Config Server 路径穿越与任意文件读取漏洞分析

https://xz.aliyun.com/t/4844

[设备安全]  VxWorks固件逆向：WRT54Gv8

https://www.anquanke.com/post/id/176481

[观点]  真真假假的创新 – RSAC2019之三

https://mp.weixin.qq.com/s/pWZ3rRrRHOVMpxUc_vWgAg

[数据挖掘]  乱弹网络空间X检索

https://mp.weixin.qq.com/s/OvTHpWXCwCH-k0jf8cQBTg

[漏洞分析]  客串逆向工程，一瞬获悬镜WAF规则

https://drivertom.blogspot.com/2019/04/waf.html?m=1

[运维安全]  Red Team从0到1的实践与思考

https://mp.weixin.qq.com/s/cyxC4Of4Ic9c_vujQayTLg

[数据挖掘]  基于Flink构建用户实时基础行为工程

https://www.infoq.cn/article/rQ*fI3BN9mWGsDcTjAHf

[Web安全]  FuzzScanner：自研信息搜集开源小工具

https://mp.weixin.qq.com/s/qy_iunNY1DNnrnAsCpB3mw

[Web安全]  后门木马变形计

https://mp.weixin.qq.com/s/CYuNP7d52R_iwnpYNBREDw

[漏洞分析]  个人PWN入坑常见方法总结

https://www.freebuf.com/articles/rookie/200207.html

[漏洞分析]  Confluence 未授权 RCE 分析（CVE-2019-3396）

https://paper.seebug.org/893/

[Web安全]  DNScat2工具:通过DNS进行C&C通信

https://www.4hou.com/tools/17226.html

[Web安全]  Go语言安全编码规范-翻译

https://bloodzer0.github.io/ossa/application-security/sdl/go-scp/

[数据挖掘]  数据分析与可视化：谁是安全圈的吃鸡第一人

https://www.freebuf.com/articles/web/199925.html

[文档]  Exposed: Cyberattacks on Cloud Honeypots

http://www.sophos.com/CloudHoneypotsReport

[数据挖掘]  刘知远：NLP研究入门之道（一）

https://mp.weixin.qq.com/s/PVoQI85YkDSzlA46FRU1OQ

[取证分析]  欺骗防御未来已来

https://www.freebuf.com/articles/es/201020.html

[Web安全]  Multiple Vulnerabilities + WAF bypass to Account Takeover

https://medium.com/@y.shahinzadeh/chaining-multiple-vulnerabilities-waf-bypass-to-account-takeover-in-almost-all-alibabas-websites-f8643eaa2855

[漏洞分析]  iSCSI未授权访问漏洞，数万iSCSI可能受影响

https://nosec.org/home/detail/2491.html

[数据挖掘]  下一代SIEM@AI：从UEBA到SOAR

https://mp.weixin.qq.com/s/OYPooeIZp8hq4JebOHDJMg

[数据挖掘]  浅析基于人格特征的内部高风险用户识别方法

https://www.freebuf.com/articles/network/200564.html

[Web安全]  Bypass XSS Protection with xmp, noscript, noframes.. etc..

https://www.hahwul.com/2019/04/bypass-xss-protection-with-xmp-noscript-etc….html

[设备安全]  Reverse-engineering Broadcom wireless chipsets

https://blog.quarkslab.com/reverse-engineering-broadcom-wireless-chipsets.html

[移动安全]  Android Cloak and Dagger Attack

https://medium.com/@targetpractice/cloak-and-dagger-malware-techniques-demystified-c4d8a035b94e

[数据挖掘]  Virgilio: Your new Mentor for Data Science E-Learning

https://github.com/clone95/Virgilio

[恶意分析]  CRYPTOPOKEMON: Simple C++ cryptolocker Blowfish CBC

https://github.com/PokemonGoTeam/CRYPTOPOKEMON

[恶意分析]  Revisiting TTPs: TimeStomper

https://posts.specterops.io/revisiting-ttps-timestomper-622d4c28a655

-----微信ID：SecWiki-----
SecWiki，8年来一直专注安全技术资讯分析！
SecWiki：https://www.sec-wiki.com

本期原文地址: SecWiki周刊(第268期)

来源：freebuf.com 2019-04-22 13:14:19 by: SecWiki