SecWiki周刊（第132期）
2016/09/05-2016/09/11
安全资讯
[无线安全]  成都一男子被骗数万元 曾多次核实骗子号码真伪
http://cd.qq.com/a/20160909/008606.htm?pgv_ref=aio2015&ptlang=2052
[工具]  黑皮书：安全领域聚合性APP
http://mp.weixin.qq.com/s?__biz=MzIxODQxMjUwMw==&mid=2247483670&idx=1&sn=203a952cd606ccae112389bde70bf4fd&scene=1&srcid=0901gJ98WuqsapStZlaMXWj8#rd
[运维安全]  G20网络安保新趋势：安全SaaS+MSS+TI成标配
http://mp.weixin.qq.com/s?__biz=MzA5MDIwMjI4MQ==&mid=2688641790&idx=1&sn=58d1cf18feadad6534f4510cbbde8ccb&scene=1&srcid=0908RQHeUiCctcddtiS7koej#rd
[人物]  FreeBuf专访百度安全实验室X-Team负责人黄正
http://www.freebuf.com/articles/people/113223.html
[爆库]  1亿明文口令泄露 俄罗斯搜索引擎Rambler.ru被黑
http://www.aqniu.com/hack-geek/19449.html
[其它]  强推10+网络安全趋势厂商
http://mp.weixin.qq.com/s?__biz=MzAwNDE4Mzc1NA==&mid=2650824705&idx=1&sn=a4eace7749b80b8ebaeeb5d8ec111f6d&scene=1&srcid=0908z5RxVXls52bxYt9biPtm#rd
[爆库]  知名色情网站Brazzers 80万用户数据遭泄露
http://www.freebuf.com/news/113904.html
[事件]  Oui, La NSA hacked France in 2012
https://medium.com/@msuiche/nsa-hacked-france-in-2012-414d8de4bdcf?swoff=true#.l4lkmqdaa
[其它]  创业路上所有的坑，都是必经的坑
https://www.v2ex.com/t/305082#reply0
[事件]  U.S. investigating potential covert Russian plan to disrupt November elections
https://www.washingtonpost.com/world/national-security/intelligence-community-investigating-covert-russian-influence-operations-in-the-united-states/2016/09/04/aec27fa0-7156-11e6-8533-6b0b0ded0253_story.html
[其它]  2017互联网校招，两个微妙的变化在发生
https://zhuanlan.zhihu.com/p/22218563?utm_campaign=official_account&utm_source=weibo&utm_medium=zhihu&utm_content=zhuanlan
[法规]  美国网络安全领域军民融合的发展路径分析
http://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664107769&idx=1&sn=37f18fa11a9b5b3114a6d38640425413&scene=1&srcid=0906M1vlGDGFzRmu0EHJR9CG#rd
[爆库]  俄罗斯即时通讯QIP.ru 3300万明文密码被盗
http://mp.weixin.qq.com/s?__biz=MzI4MjA1MzkyNA==&mid=2655294340&idx=5&sn=5a2c7fff69ad957280eb35ef1de7c873
[事件]  美国政府任命首位首席信息安全官（CSO）：雷戈里·陶希尔
http://mp.weixin.qq.com/s?__biz=MjM5MzM3NjM4MA==&mid=2654678262&idx=8&sn=0bd10bfc0ba99491d628830b99f54d7b&scene=1&srcid=0909dnYXbWfDMgKYzuBkOoWv#rd
[人物]  陈奋的传奇：“安全狗”如何变成哮天犬？
http://mp.weixin.qq.com/s?__biz=MzIzMTAzNzUxMQ==&mid=2652875245&idx=1&sn=d22105ad8faf357f387b9e00f1652c24&scene=0#rd
[恶意分析]  Alleged vDOS Proprietors Arrested in Israel
http://krebsonsecurity.com/2016/09/alleged-vdos-proprietors-arrested-in-israel/
安全技术
[Web安全]  web中各种命令注入的检测和利用二
http://blog.csdn.net/qq_29277155/article/details/52420033
[会议]  最新最全的KCon 2016 顶级黑客议题PPT
http://bobao.360.cn/learning/detail/3006.html
[运维安全]  华为数据安全管理实践学习笔记
http://www.lewisec.com/2016/09/05/%E5%8D%8E%E4%B8%BA%E6%95%B0%E6%8D%AE%E5%AE%89%E5%85%A8%E7%AE%A1%E7%90%86%E5%AE%9E%E8%B7%B5%E5%AD%A6%E4%B9%A0%E7%AC%94%E8%AE%B0/
[移动安全]  Introducing nOBEX – a tool for testing Bluetooth phone and messaging profiles
https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2016/september/introducing-nobex-a-tool-for-testing-bluetooth-phone-and-messaging-profiles/
[工具]  DET – Data Exfiltration Toolkit
https://github.com/sensepost/DET
[其它]  CISSP备考经验
http://www.lewisec.com/2016/09/04/CISSP%E5%A4%87%E8%80%83%E7%BB%8F%E9%AA%8C/
[工具]  Black Hat Europe 2016 ARSENAL
http://www.blackhat.com/eu-16/arsenal.html
[漏洞分析]  xcon2016:Advanced Exploitation Techniques: Breaking AV-Emulator
http://www.vxjump.net/files/seccon/BAVE_xcon2016.pdf
[Web安全]  Exponent-cms任意文件上传漏洞分析 (cve-2016-7095)
http://bobao.360.cn/learning/detail/3001.html
[运维安全]  OpenSCAP：安全防护和威胁扫描的开源工具
https://www.open-scap.org/
[比赛]  2016西安“华山杯” CTF WEB 部分Writeup
https://www.ohlinge.cn/ctf/2016xdctf_writeup.html
[恶意分析]  隐写技巧——在PE文件的数字证书中隐藏Payload
http://www.mottoin.com/88915.html
[Web安全]  利用机器学习的方法保护非政府组织
http://slides.com/eldraco/stratosphere-fsfe#/
[比赛]  “百度杯”CTF Writeup 第一期
https://www.ohlinge.cn/ctf/bctf001.html
[文档]  KCon 2016 Slide
https://github.com/knownsec/KCon/tree/master/2016
[漏洞分析]  Fuzzing IOCTLs with angr
http://thunderco.re/project/security/2016/07/18/fuzzing-ioctls/
[漏洞分析]  PEGASUS iOS 内核漏洞分析第二部分
http://sektioneins.de/en/blog/16-09-05-pegasus-ios-kernel-vulnerability-explained-part-2.html
[其它]  Kali Linux 2016.2初体验
http://www.mottoin.com/88941.html
[工具]  cnki-downloader: 知网(CNKI)文献下载工具
https://github.com/amyhaber/cnki-downloader
[运维安全]  Centos安全配置(常见案例)
http://mp.weixin.qq.com/s?__biz=MzI3NzMzNzE5Ng==&mid=2247483860&idx=1&sn=25f992833fadcd093c02def9996d2f03&scene=1&srcid=0908L7UIWDTpqESCSUaaEsLv#rd
[恶意分析]  方程式黑客组织工具集遭泄露事件分析
http://www.arkteam.net/?p=1137
[移动安全]  Android渗透测试实验环境搭建
http://www.hackingarticles.in/build-android-penetration-testing-lab/
[Web安全]  京东代码安全审计平台第一期建设思路
http://mp.weixin.qq.com/s?__biz=MjM5OTk2MTMxOQ==&mid=2727827297&idx=1&sn=277c0178ebead359392018be205020ad&scene=1
[恶意分析]  分享一款失败的国产加密勒索软件
http://blogs.360.cn/360safe/2016/09/07/failedransomeware/
[运维安全]  TLS1.3版本安全性分析
https://www.int21.de/slides/berlinsec-versionintolerance/#/
[比赛]  DARPA网络超级挑战赛情况及思考
http://www.arkteam.net/?p=1095
[Web安全]  Fox-scan: 基于SQLMAP的主动和被动资源发现的漏洞扫描工具
https://github.com/fengxuangit/Fox-scan/
[编程技术]  常见的python漏洞分析
https://access.redhat.com/blogs/766093/posts/2592591
[恶意分析]  机密文件曝光大量美国神秘监控设备（挂灯、垃圾桶、鸟巢）
http://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649712001&idx=2&sn=0b4e70486bfa95fc454e7f18d45320f8
[移动安全]  browser_vuln_check: 快速检测Webview 和浏览器环境是否存在安全漏洞
https://github.com/lcatro/browser_vuln_check
[漏洞分析]  代码战争：伪装和狙杀——从“壳”到“病毒混淆器
http://mp.weixin.qq.com/s?__biz=MjM5Mjc3MDM2Mw==&mid=2651132585&idx=1&sn=6e4daa40092d8abe79d98d43536c7a53&scene=1
[文档]  中国互联网发展趋势报告2016
http://m.analysys.cn/report/detail/1000234.html?from=timeline&isappinstalled=0
[漏洞分析]  如何构造Office漏洞POC（以CVE-2012-0158为例）
http://www.freebuf.com/articles/system/113945.html
[运维安全]  捻乱止于河防——浅谈企业入侵防御体系建设
http://mp.weixin.qq.com/s?__biz=MzA3MzYwNjQ3NA==&mid=2651297130&idx=1&sn=bf6d7d50501fcd53e1ee59482b6c34a8&scene=1&srcid=09082u3vxpBbxif82QL5S45d#rd
[无线安全]  WiFi安全
http://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458279512&idx=1&sn=2bfbaff70e31bdd4f5f76977962b1943&scene=1&srcid=0906BFO0gYKwkb9aUj4COORC#rd
[设备安全]  Snagging creds from locked machines
https://room362.com/post/2016/snagging-creds-from-locked-machines/
[Web安全]  Penetration Testing tools 渗透测试相关工具
https://github.com/Aptive/penetration-testing-tools
[漏洞分析]  Online Banking Vulnerabilities: Authorization Flaws Lead the Way
http://blog.ptsecurity.com/2016/09/online-banking-vulnerabilities.html
[编程技术]  美团外卖订单中心的演进
http://tech.meituan.com/mt_waimai_order_evolution.html
[Web安全]  XSS Tricks - 从 SelfXSS 到登录你的账户
http://www.n0tr00t.com/2016/09/07/Baidu-XSS-Tricks.html
[Web安全]  HellRaiser: 基于端口的漏洞扫描及CVE标识
https://github.com/m0nad/HellRaiser
[运维安全]  Logcool：开源的集日志和事件的轻量级数据采集系统
https://github.com/wgliang/logcool
[工具]  Github开源安全项目
https://github.com/showcases/security?s=stars
[恶意分析]  quicksand.io:Office document malware analysis
https://quicksand.io/
[编程技术]  对话东航：技术选型为何选择MongDB？
http://mp.weixin.qq.com/s?__biz=MjM5MDE0Mjc4MA==&mid=2650994053&idx=1&sn=dfe7173d8c557aad90e2f01e291ffb69&scene=1&srcid=0909PEzc0QdKGz6AzwV2PR7g#rd
[漏洞分析]  A list of Reverse Engineering articles, books, and papers
https://github.com/onethawt/reverseengineering-reading-list
-----微信ID：SecWiki-----
SecWiki，12年来一直专注安全技术资讯分析！
SecWiki：https://www.sec-wiki.com

本期原文地址: SecWiki周刊(第132期)