SecWiki周刊（第137期）
2016/10/10-2016/10/16
安全资讯
[新闻]  "网络空间安全" 重点专项 2017 年度项目申报指南
http://www.most.gov.cn/mostinfo/xinxifenlei/fgzc/gfxwj/gfxwj2016/201610/t20161013_128183.htm
[人物]  CNCC 人物专访 谭晓生（上）
http://m.leiphone.com/news/201610/nlOvp2QmHI6yOg5e.html%3Ffrom%3Dtimeline%26isappinstalled%3D0%26viewType%3Dweixin
[新闻]  初见（NSRC公众号开张）
http://mp.weixin.qq.com/s%3F__biz%3DMzIxNDI0MDAxNg%3D%3D%26mid%3D2247483656%26idx%3D1%26sn%3Df04e3c199ffc312d875bafc6167d94bd%26chksm%3D97abdf77a0dc5661ff6a95c3a2268041274847c0975a9bd708e5e838eaf957b7be0781ff6b46%26mp
[事件]   CIA Prepping for Possible Cyber Strike Against Russia
http://www.nbcnews.com/news/us-news/cia-prepping-possible-cyber-strike-against-russia-n666636
[新闻]  阿里云安全算法挑战赛英雄榜榜单
http:/mp.weixin.qq.com/s%3F__biz%3DMzAwNjM1ODkxNQ%3D%3D%26mid%3D2650886776%26idx%3D1%26sn%3D0ab55457add1828d7ed428c7e354d94a%26chksm%3D80fb6094b78ce982dffd440dcc0fc80adf962604d682a852f030f6d7d6f17f1455a74cd616d8%26mp
[事件]  英国家网络安全中心将正式投入运行
http://mp.weixin.qq.com/s%3F__biz%3DMzIwMTU0NDA0MQ%3D%3D%26mid%3D2650104929%26idx%3D4%26sn%3Daf83b99fad75adbd57693df65c73aa74%26chksm%3D8eed9c67b99a1571637ecb4ca7cbc8cf469009d075c0a473a919cef79975ae7214a876399bc4%26mp
[其它]  黑客小说：杀手 （第五章 追踪 上）
http://www.jianshu.com/p/63af53d8d5be%3Futm_campaign%3Dhugo%26utm_medium%3Dreader_share%26utm_content%3Dnote%26utm_source%3Dweixin-timeline%26from%3Dtimeline%26isappinstalled%3D0
[事件]  新加坡正式公布国家网络安全策略
http://www.freebuf.com/news/116395.html
[新闻]  HackerOne CEO专访：我们正在打造全球最大的安全人才库
http://www.freebuf.com/articles/neopoints/116064.html
安全技术
[运维安全]  ssh-audit:开源SSH服务器审计工具
http://www.mottoin.com/90572.html
[恶意分析]  黑帽SEO之暗链
http://thief.one/2016/10/12/%E9%BB%91%E5%B8%BDSEO%E4%B9%8B%E6%9A%97%E9%93%BE/
[编程技术]  TcpScanner端口存活性检测
http://thief.one/2016/10/14/TcpScanner%E7%AB%AF%E5%8F%A3%E5%AD%98%E6%B4%BB%E6%8E%A2%E6%B5%8B/
[Web安全]  windows服务器信息收集工具
http://thief.one/2016/09/04/windows%E6%9C%8D%E5%8A%A1%E5%99%A8%E4%BF%A1%E6%81%AF%E6%94%B6%E9%9B%86%E5%B7%A5%E5%85%B7/
[运维安全]  从甲方的角度谈谈WAF测试方法--part2
http://www.lewisec.com/2016/10/10/%E4%BB%8E%E7%94%B2%E6%96%B9%E7%9A%84%E8%A7%92%E5%BA%A6%E8%B0%88%E8%B0%88WAF%E6%B5%8B%E8%AF%95%E6%96%B9%E6%B3%95-part2/
[移动安全]  基于御安全APK加固的游戏反外挂方案
http://yaq.qq.com/blog/11
[移动安全]  Android安全之WebViewUXSS漏洞
http://yaq.qq.com/blog/12
[视频]  Black Hat USA 2016 Video
https://www.youtube.com/playlist?list=PLbHqJuIbKd_6jPpl9pnXGUmUj8gtlWony
[其它]  起点:如何成为一名黑客?
http://suip.cc/d/1--
[Web安全]  BurpSuite中的安全测试插件推荐
http://www.mottoin.com/90188.html
[移动安全]  Android安全之Https中间人攻击漏洞
http://yaq.qq.com/blog/13
[编程技术]  SQLMAP源码分析—第一讲:架构篇
http://v.youku.com/v_show/id_XMTc1NDI5NjA0OA==.html?refer=eco-h5-wbtb&tuid=UNTgxMDQzNzI4
[运维安全]  OJ/gobuster: Directory/file & DNS busting tool written in Go
https://github.com/OJ/gobuster
[取证分析]  基于linux嵌入式固件动态分析-FIRMADYNE
http://www.bincker.net/?p=429
[数据挖掘]  How to perform real time Text Analytics on Twitter streaming data in SAS ESP
http://blogs.sas.com/content/sgf/2016/10/05/how-to-perform-real-time-text-analytics-on-twitter-streaming-data-in-sas-esp/
[恶意分析]  Mirai源码分析报告
http://blog.nsfocus.net/mirai-source-analysis-report/
[运维安全]  解析Mimikatz日志文件
http://www.mottoin.com/90550.html
[运维安全]  使用随机用户代理进行WAF测试
http://www.mottoin.com/90178.html
[数据挖掘]  利用python进行识别相似图片(二)
https://segmentfault.com/a/1190000004500523?_ea=630748
[无线安全]  【Electronic Warfare Payloads of UAVs】无人机电子战载荷的新发展
http://mp.weixin.qq.com/s?__biz=MzAwMDE3MzgxMQ==&mid=2654113135&idx=1&sn=ca97f2f7a1266217308650abac3ce48d&chksm=812adef3b65d57e5dc69ccade33475fccf45ecc3c20ba44a8d8ffaefd3b263203d98a4c3190c&mpshare=1&scene=1&srcid=1016YGQhMu5mAYVzrC4OnUnv#rd
[Web安全]  如何利用配置错误的SUID获取root权限并提权
http://www.mottoin.com/90304.html
[Web安全]  BBQSQL:SQL注入利用工具
http://www.mottoin.com/90324.html
[数据挖掘]  Domain Generation Algorithms
https://blog.opendns.com/2016/10/10/domain-generation-algorithms-effective/
[数据挖掘]  利用python进行识别相似图片(一)
https://segmentfault.com/a/1190000004467183
[其它]  Github just censored my research data
http://gwillem.gitlab.io/2016/10/14/github-censored-research-data/
[漏洞分析]  CVE-2016-4977: RCE in Spring Security Oauth漏洞分析
http://www.mottoin.com/90527.html
[设备安全]  2016绿盟科技网络视频监控系统安全报告
http://blog.nsfocus.net/wp-content/uploads/2016/10/2016_NSFOCUS_Network_Video_Surveillance_System_Security_Report_1014.pdf
[Web安全]  attackercan/regexp-security-cheatsheet
https://github.com/attackercan/regexp-security-cheatsheet
[恶意分析]  打造不被检测的Metasploit WAR
http://www.mottoin.com/90302.html
[恶意分析]  ShinoBOT – Malware Attack Simulator Framework
http://www.sectechno.com/shinobot-malware-attack-simulator-framework/
[漏洞分析]  通过Win10PE SE ISO或WIM实现持久化后门
http://www.mottoin.com/90351.html
[论文]  System Security Circus v2.0
http://s3.eurecom.fr/~balzarot/notes/top4/
[漏洞分析]  玩一场漏洞游戏:网易开源Pomelo游戏服务端框架远程命令执行
http://www.mottoin.com/90444.html
[漏洞分析]  PostScript语言安全研究(一)ImageMagick新漏洞分析
http://drops.wiki/index.php/2016/10/15/postscript/
[编程技术]  基于Python的WebServer
http://thief.one/2016/09/14/%E5%9F%BA%E4%BA%8EPython%E7%9A%84WebServer/
[恶意分析]  黑帽SEO之网页劫持
http://thief.one/2016/10/12/%E9%BB%91%E5%B8%BDSEO%E4%B9%8B%E7%BD%91%E9%A1%B5%E5%8A%AB%E6%8C%81/
[Web安全]  从活动目录中Dump NTDS.dit文件
http://www.mottoin.com/90278.html
[漏洞分析]  基于浏览器的指纹识别: 影响和缓解措施
http://paper.seebug.org/64/
[Web安全]  细数那些鲜为人知的后缀名隐藏技巧
http://www.mottoin.com/90109.html
[比赛]  2016CCF大数据与计算智能大赛
http://www.wid.org.cn/data/science/activity/ccf2016/index.html
[编程技术]  使用Python实现指定Twitter用户Followers收集
http://www.mottoin.com/90327.html
[运维安全]  渗透+风险模型+威胁情报(上)
http://mp.weixin.qq.com/s?__biz=MzA3MTEwNDE1NA==&mid=210199950&idx=1&sn=2bd6d480cc06af5e5cdd8891364becf2&mpshare=1&scene=24&srcid=1007KAlFEWPZjxFBr57kmnQN#rd
[文档]  黑产白皮书 DDoS 篇——乌云笼罩下的产业百态
http://www.freebuf.com/articles/network/116340.html
[漏洞分析]  逆向智能咖啡机协议实现终端控制
http://www.mottoin.com/90168.html
[漏洞分析]  DMA attacking over USB-C and Thunderbolt 3
http://blog.frizk.net/2016/10/dma-attacking-over-usb-c-and.html
[漏洞分析]  a series tutorial for linux exploit development to newbie
https://github.com/hardenedlinux/linux-exploit-development-tutorial
[比赛]  HITCON 2016 Web 总结
http://0x48.pw/2016/10/14/0x24/
[漏洞分析]  PyCmd 加密隐形木马
http://thief.one/2016/09/18/PyCmd-%E5%8A%A0%E5%AF%86%E9%9A%90%E5%BD%A2%E6%9C%A8%E9%A9%AC/
[Web安全]  PHP Code Injection Analysis
http://www.mottoin.com/90370.html
[编程技术]  谈一谈SQLite Load_Extension的妙用
http://www.mottoin.com/90266.html
[数据挖掘]  Teaching Machines Security: Identifying Botnet Panels
https://blog.cylance.com/teaching-machines-security-identifying-botnet-panels
[移动安全]  spade: APK backdoor embedder
https://github.com/suraj-root/spade
[Web安全]  通过远程资源注入的xss利用分析
http://www.mottoin.com/90126.html
[漏洞分析]  Django CSRF 防护绕过漏洞分析
https://virusdefender.net/index.php/archives/753/
[比赛]  orangetw: Collection of CTF Web challenges
https://github.com/orangetw/My-CTF-Web-Challenges
[漏洞分析]  从老漏洞到新漏洞—iMessage 0day(CVE-2016-1843)挖掘实录
http://blog.knownsec.com/2016/10/imessage-0day_cve-2016-1843/
[运维安全]  使用Nginx+uWSGI+Supervisor部署Flask应用
http://www.bibodeng.com/?post=190
[杂志]  SecWiki周刊(第136期)
https://www.sec-wiki.com/weekly/136
-----微信ID：SecWiki-----
SecWiki，13年来一直专注安全技术资讯分析！
SecWiki：https://www.sec-wiki.com

本期原文地址: SecWiki周刊(第137期)