SecWiki周刊（第154期）
2017/02/06-2017/02/12
安全资讯
[设备安全]  日本车联网信息安全发展现状与分析
http://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664108338&idx=1&sn=aeb39e4c32d9b1181e68f40574a21012&scene=0#wechat_redirect
[其它]  冰点调查 | 揭秘微信里的暴力色流，日流水400万
http://mp.weixin.qq.com/s/0i6VlEJjAXcYAsLrMF0JJA
[移动安全]  76款流行iOS应用易受中间人攻击，1800万用户受影响
http://www.4hou.com/info/3291.html
[其它]  CISSP 知识体系权重和常见问题
http://mp.weixin.qq.com/s/i-9p2KD15yXCxhfB8E6T0A
[人物]  Tony Lee：从微软安全专家到京东安全的勇士之路
https://mp.weixin.qq.com/s?__biz=MzIzMTAzNzUxMQ==&mid=2652877778&idx=1&sn=ac823e022888aaeced5fa1f42472e6bf&chksm=f3415cfac436d5ecde6e7d1e9c578453ac8f5db9b1f2da86898933ee26727f93700d90fb6c54&scene=0
[事件]  美国电视公司Vizio搜集用户数据，知道你看的每一部剧
http://www.4hou.com/info/3278.html
[观点]  我回阿里的29个月
http://mp.weixin.qq.com/s/_snozlQIcfROxuexpVTe9Q
[新闻]  一个隐秘却又疯狂的地下市场诞生：支付牌照买卖
http://m.cebnet.com.cn/20170210/102363588.html?from=timeline
[人物]  专访：黑客段子手“呆子不开口”
http://www.leiphone.com/news/201701/BUCpAjTHrX8PK5Ej.html
[人物]  以流量分析为基因的安全公司——科来
http://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651070423&idx=1&sn=c1dd8802cbc6d572452c8c9c059cb5cc&scene=0#wechat_redirect
[新闻]  A Hacker Just Pwned Over 150,000 Printers Left Exposed Online
https://www.bleepingcomputer.com/news/security/a-hacker-just-pwned-over-150-000-printers-left-exposed-online/
[观点]  从创新沙盒看"效率"将成为评估安全产品的首要标准
http://mp.weixin.qq.com/s?__biz=MzAwNjA3MzEwNg==&mid=2651329418&idx=1&sn=3dbcba973a9d7339aa7d5368c8d3a6f2&scene=0#wechat_redirect
[新闻]  RSA创新沙盒优胜者11年融资并购回顾
http://www.aqniu.com/industry/22800.html
安全技术
[Web安全]   Unpatched (0day) jQuery Mobile XSS
http://sirdarckcat.blogspot.jp/2017/02/unpatched-0day-jquery-mobile-xss.html
[Web安全]  基于机器学习的web异常检测
http://www.4hou.com/info/news/3293.html
[Web安全]  直播攻击学校网站，厉害了我的哥
http://www.4hou.com/info/attitude/3300.html
[其它]  环境搭建:Docker给你不一样的渗透体验
http://mp.weixin.qq.com/s/Sv9l--OK7ADihDG9kUsarA
[漏洞分析]  Attack and Defend: Linux Privilege Escalation Techniques of 2016
https://www.sans.org/reading-room/whitepapers/testing/attack-defend-linux-privilege-escalation-techniques-2016-37562
[运维安全]  一个人的“安全部”
http://www.freebuf.com/articles/security-management/126254.html
[数据挖掘]  自然语言处理导论-课程网页
http://ccl.pku.edu.cn/alcourse/nlp/
[Web安全]  MS14-068域权限提升漏洞总结
http://www.mottoin.com/95877.html
[Web安全]  攻击JavaScript引擎：一个JavaScriptCore的学习案例(CVE-2016-4622 (2016-10-27))
http://www.mottoin.com/95838.html
[Web安全]  Bot Traffic Report 2016
https://www.incapsula.com/blog/bot-traffic-report-2016.html
[移动安全]  逆向修改手机内核，绕过反调试
http://mp.weixin.qq.com/s/c6maBlFu0DLK9qDooMm8fA
[其它]  今天我放出1000万密码
https://xato.net/today-i-am-releasing-ten-million-passwords-b6278bbe7495#.op6kkkh88
[Web安全]  web-proxy: 基于 Tornado 实现的 Web 站点反向代理
https://github.com/restran/web-proxy
[移动安全]  如何在Android上发送加密邮件？推荐这四大神器
http://www.4hou.com/info/news/3318.html
[Web安全]  fWaf – Machine learning driven Web Application Firewall
http://fsecurify.com/fwaf-machine-learning-driven-web-application-firewall/?from=timeline
[取证分析]  Windows恶意软件API调用特征分析
http://www.4hou.com/technology/3267.html
[恶意分析]  Learn&Fuzz: Machine Learning for Input Fuzzing
https://arxiv.org/pdf/1701.07232.pdf
[运维安全]  我的ELK搭建笔记（阿里云上部署）
https://mp.weixin.qq.com/s?__biz=MzI5ODE0ODA5MQ==&mid=2652277928&idx=1&sn=5e44c058dbf9748a8c94098815c2a7eb&chksm=f748653cc03fec2aaa4f83dcb160089ff6874cfb4d1309142b15da738f44ad5be00f455f4d40hn71
[编程技术]  阿里巴巴Java开发手册（正式版）
http://techforum-img.cn-hangzhou.oss-pub.aliyun-inc.com/%E9%98%BF%E9%87%8C%E5%B7%B4%E5%B7%B4Java%E5%BC%80%E5%8F%91%E6%89%8B%E5%86%
[恶意分析]  Analyzing BotNets with Suricata & Machine Learning
http://blogs.splunk.com/2017/01/30/analyzing-botnets-with-suricata-machine-learning/
[运维安全]  DbDat: Db Database Assessment Tool 数据库审计工具
https://github.com/foospidy/DbDat
[编程技术]  Python爬虫——DNS解析缓存
http://blog.csdn.net/bone_ace/article/details/55000101
[移动安全]  Android免Root环境下Hook框架Legend原理分析
https://zhuanlan.zhihu.com/p/25200724
[其它]  互联网企业安全建设之路：规划篇
http://www.freebuf.com/articles/security-management/126202.html
[Web安全]  渗透测试阿里巴巴的思路与收获
https://zhuanlan.zhihu.com/p/25100915
[运维安全]  python-icap-yara: An ICAP Server with yara scanner for URL or content.
https://github.com/RamadhanAmizudin/python-icap-yara
[恶意分析]  APT黑客利用.chm文件攻击俄罗斯重要机构
http://mp.weixin.qq.com/s/gjIEgqqQq_5czufuuiqM-Q
[文档]  RSA USA 2017 PPT 抢先下
https://pan.baidu.com/s/1eSh13kY#list/path=%2F
[恶意分析]  From RTF to Cobalt Strike passing via Flash
https://zairon.wordpress.com/2017/02/05/from-rtf-to-cobalt-strike-passing-via-flash/
[取证分析]  Threat Hunting with Splunk
http://mp.weixin.qq.com/s?__biz=MzI4NzU2NjU4NQ==&mid=2247483960&idx=1&sn=31ec650a5aaeb9be46ab7a11b10ddcd4&scene=0#wechat_redirect
[Web安全]  BurpSuite和Fiddler串联使用解决App测试漏包和速度慢的问题
http://www.mottoin.com/95865.html
[工具]  安卓版kali-linux
http://thief.one/2017/02/10/%E5%AE%89%E5%8D%93%E7%89%88Kali-linux/
[Web安全]  GrepBugs: A regex based source code scanner 基于正则的源码审计工具
https://github.com/foospidy/GrepBugs
[Web安全]  基于WAVSEP的靶场搭建指南
http://www.freebuf.com/sectool/125940.html
[Web安全]  文件上传绕过姿势汇总
http://thief.one/2016/09/22/%E4%B8%8A%E4%BC%A0%E6%9C%A8%E9%A9%AC%E5%A7%BF%E5%8A%BF%E6%B1%87%E6%80%BB-%E6%AC%A2%E8%BF%8E%E8%A1%A5%E5%85%85/
[运维安全]  互联网企业安全高级指南读书笔记之二
http://www.mottoin.com/95828.html
[漏洞分析]  IDA Pro使用（静态分析+动态调试）
http://skysider.com/?p=458
[工具]  Sci-Hub: 英文文献下载利器
http://sci-hub.cc/
[数据挖掘]  基于R语言的文本-向量算法实现Twitter文章的情感分析
http://analyzecore.com/2017/02/08/twitter-sentiment-analysis-doc2vec/
[Web安全]  How to Exploit XSS with an Image
http://resources.infosecinstitute.com/exploit-xss-image/
[其它]  安全应急响应的一些经验总结
http://www.4hou.com/special/2572.html
[数据挖掘]  Rethinkdb搭建与使用
http://thief.one/2017/02/07/rethinkdb%E6%90%AD%E5%BB%BA%E4%B8%8E%E4%BD%BF%E7%94%A8/
[设备安全]  使用ZoomEye批量快速攻击目标
http://www.92ez.com/?action=show&id=23436
[恶意分析]  Predicting Domain Generation Algorithms using LSTMs DGA恶意域名自动发现
https://github.com/endgameinc/dga_predict
[运维安全]  有了漏洞扫描器，如何用好？一点不成熟的小总结
http://www.freebuf.com/articles/neopoints/126205.html
[其它]  博士这五年
https://zhuanlan.zhihu.com/p/25099638
[设备安全]  面向工控系统的高交互蜜罐
https://mp.weixin.qq.com/s?__biz=MzA5OTMwMzY1NQ==&mid=2647833905&idx=1&sn=462ebf63e3402def50e2fec4ed9c6dfe&chksm=88a274b9bfd5fdaf759493716c2a2d183298ca8c449a259b1988a60b185d12b945891fcf652a
[Web安全]  PowerShell安全专题之攻击工具篇
http://www.4hou.com/technology/3134.html
[运维安全]  2017SANS网络威胁情报峰会
http://mp.weixin.qq.com/s?__biz=MzA3MTUwMzI5Nw==&mid=2654431137&idx=1&sn=41a139286d511ba474a694b7f4ae4006&scene=0#wechat_redirect
[运维安全]  HTTPS性能优化实践
http://mp.weixin.qq.com/s?__biz=MzI4NzE1NTYyMg==&mid=2651102678&idx=1&sn=174f549c1f21d03cfcaa0314014fc02a&scene=0#wechat_redirect
[设备安全]  智能硬件入门
https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458281897&idx=1&sn=bededbe90195ed48a7fc5cf6617c3000&chksm=b181572386f6de35984d324d47fed6b7e1b4600b2c904481d860a7ebe99c9070c050f0e34b1e
[工具]  利用 scapy 造一个 Passive DNS Collector 工具：Pdns_sniff
http://www.mottoin.com/95822.html
[移动安全]  当EFBFBD和它的朋友相遇：研究字符数组转换字符串
http://www.mottoin.com/95897.html
[Web安全]  Harbor中的用户密码加密机制探究
http://phantom0301.cc/2017/02/08/harborpass/
[杂志]  SecWiki周刊（第153期)
https://www.sec-wiki.com/weekly/153
[Web安全]  SOP bypass / UXSS on IE11 htmlFile
http://www.brokenbrowser.com/uxss-ie-htmlfile/
[设备安全]  Car Hacking: The definitive source
http://illmatics.com/carhacking.html
[Web安全]  MySQL Out-of-Band Hacking
chrome-extension://ikhdkkncnoglghljlkmcimlnlhkeamad/pdf-viewer/web/viewer.html?file=https%3A%2F%2Fwww.exploit-db.com%2Fdocs%2F41273.pdf
[文档]  2016年中国网站安全漏洞分析报告 #密码: 2viy
https://pan.baidu.com/s/1cH1gGA
[移动安全]  CRYPTKEEPER 发现通用密码事件分析报告
http://www.antiy.com/response/cryptkeeper/cryptkeeper.pdf
[移动安全]  Android逆向基础之Dalvik指令集
https://mp.weixin.qq.com/s?__biz=MzI4NjEyMDk0MA==&mid=2649846140&idx=1&sn=a248dbec47578c37f276fe461aa82b8f&chksm=f3e41fffc49396e9020490703eb4f7270e4dd6063575b65bedecedbe69c31e0a70e4a96f4cec&scene=0&key=63570224b333d6fd7954fa9343865bc0b865bbe08a0acb3c
[运维安全]  构建风控系统之排坑扫雷（二）
http://www.4hou.com/info/industry/3251.html
[其它]  PowerShell安全专题之 PS5 安全增强功能
http://www.4hou.com/technology/3144.html
[Web安全]  利用 Node.js 反序列化来进行远程命令执行
http://www.mottoin.com/95916.html
[其它]  Fileless attacks against enterprise networks
https://securelist.com/blog/research/77403/fileless-attacks-against-enterprise-networks/
[Web安全]  The technology and implementation of PHP automated white box audit
http://www.aijiaonang.com/function/100439.html
[运维安全]  全解Google（谷歌）基础设施架构安全设计
http://www.freebuf.com/special/126159.html
[恶意分析]  The Week in Ransomware - CryptoShield, Spora, and Exploit Kits
https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-february-3rd-2017-cryptoshield-spora-and-exploit-kits/
[漏洞分析]  9-Feb-2017: Symbolic execution 符号执行
https://yurichev.com/blog/symbolic/#XOR swap
[运维安全]  实施CIS关键安全控制措施
http://mp.weixin.qq.com/s?__biz=MzI4NzU2NjU4NQ==&mid=2247483966&idx=1&sn=346ab4ecbdfb0b8ded5eeacee2bdfc7b&scene=0#wechat_redirect
[其它]  如何用区块链技术提升网络安全？
http://www.4hou.com/info/observation/3277.html
[Web安全]  利用 Node.js 反序列化远程执行代码
http://paper.seebug.org/213/
[Web安全]  10 Most Common Web Security Vulnerabilities
http://www.thesecurityblogger.com/10-most-common-web-security-vulnerabilities/
[恶意分析]  匿名者自述是如何黑掉一万多个暗网网站的？
http://www.4hou.com/info/3259.html
[Web安全]  用SQL注入穿IE沙箱
http://xlab.tencent.com/cn/2017/01/19/ie-sandbox-escape-with-sql-injection/
[论文]  如何写论文？
http://www.52cs.org/?p=1544
[Web安全]  WordPress REST API 内容注入
http://139.129.31.35/index.php/archives/444/
[移动安全]  浅入浅出 Android 安全
http://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458281912&idx=1&sn=f7f30e1a7f2d24d97d2acecbd5cb2497&scene=0#wechat_redirect
[Web安全]  Web path scanner
https://github.com/maurosoria/dirsearch
[Web安全]  Network reconnaissance and vulnerability assessment tools.
https://github.com/RoliSoft/ReconScan
[文档]   Web, Database and OS scripting cmd line reference
https://ss64.com/
[Web安全]  Alternative for Information_Schema.Tablesin MySQL
https://www.exploit-db.com/docs/41274.pdf
[恶意分析]  Exploring the Cybercrime Underground: Part 4
http://researchcenter.paloaltonetworks.com/2017/02/unit42-exploring-cybercrime-underground-part-4-darknet-markets/?adbsc=social69980316&adbid=829797044411772928&adbpl=tw&adbpr=4487645412
[数据挖掘]  浅谈区块链（下）：应用展望
http://www.arkteam.net/?p=1538
-----微信ID：SecWiki-----
SecWiki，12年来一直专注安全技术资讯分析！
SecWiki：https://www.sec-wiki.com

本期原文地址: SecWiki周刊(第154期)