SecWiki周刊（第170期）
2017/05/29-2017/06/04
安全资讯
[法规]  国家标准《信息安全技术 数据出境安全评估指南》（草案）
http://www.tc260.org.cn/ueditor/jsp/upload/20170527/87491495878030102.pdf
[爆库]  2017年上半年重大黑客事件盘点
http://www.freebuf.com/news/135842.html
[新闻]   Announcing Google Capture the Flag 2017
https://security.googleblog.com/2017/06/announcing-google-capture-flag-2017.html
[观点]  连续收购/投资网络安全公司，身背数锅的微软想从以色列买到什么？
https://mp.weixin.qq.com/s?__biz=MzI1NTYzMTc5Mw%3D%3D&mid=2247483691&idx=1&sn=f3af54e8102bf4226bc3f2f6985e37df&scene=45#wechat_redirect
安全技术
[Web安全]  逻辑漏洞之支付漏洞
https://mp.weixin.qq.com/s/w22omfxO8vU6XzixXWmBxg
[Web安全]  逻辑漏洞之密码重置
https://mp.weixin.qq.com/s/Lynmqd_ieEoNJ3mmyv9eQQ
[Web安全]  逻辑漏洞之越权访问
https://mp.weixin.qq.com/s/ChiXtcrEyQeLkGOkm4PTog
[运维安全]  配置漏洞之DNS域传送
https://mp.weixin.qq.com/s?__biz=MzI5MDQ2NjExOQ==&mid=2247485215&idx=2&sn=121c0b351d2eab3ef231988f01832a3b&chksm=ec1e3737db69be216
[Web安全]  自律方能自由，《网络安全法》实施后的白帽子行为参考
https://sosly.me/index.php/2017/06/02/wangluoanquanfa/
[漏洞分析]  A Dissection of the “EsteemAudit” Windows Remote Desktop Exploit
http://researchcenter.paloaltonetworks.com/2017/05/unit42-dissection-esteemaudit-windows-remote-desktop-exploit/
[Web安全]  渗透标准
https://www.processon.com/view/583e8834e4b08e31357bb727
[运维安全]  IOC sharing - we are doing it wrong
https://www.slideshare.net/CsabaFitzl/ioc-sharing-we-are-doing-it-wrong
[运维安全]  新一代数据中心网络安全产品的旁路部署方式探讨
http://blog.nsfocus.net/generation-data-center-product-bypass-deployment/
[漏洞分析]  GhostButt - CVE-2017-8291利用分析
http://paper.seebug.org/310/
[新闻]  Chrome漏洞可致恶意站点在用户在不知情的情况下录制音频和视频
http://www.freebuf.com/news/136015.html
[比赛]  信息安全与对抗技术竞赛（ISCC 2017）WriteUp（详细，通俗易懂）
http://www.freebuf.com/articles/others-articles/135825.html
[Web安全]  Web App 特征识别库
http://www.thinkings.org//2017/05/29/characteristics-data.html
[观点]  2年乙方安全从业经验谈
http://pirogue.org/2017/06/02/2%E5%B9%B4%E4%B9%99%E6%96%B9%E5%AE%89%E5%85%A8%E4%BB%8E%E4%B8%9A%E7%BB%8F%E9%AA%8C%E8%B0%88/
[会议]  Alex lonescu在#SyScan360# 上关于Windows Container机制的slide
http://www.alex-ionescu.com/publications/syscan/syscan2017.pdf
[Web安全]  浅谈跨站脚本攻击与防御
http://thief.one/2017/05/31/1/
[运维安全]  从蜜罐数据到SSH蜜罐的典型攻击分析
http://bobao.360.cn/learning/detail/3929.html
[恶意分析]  基于机器学习的分布式webshell检测系统-项目代码
https://github.com/Lingerhk/fshell
[移动安全]  Pwning the Nexus ™ of Every Pixel ™
https://blog.flanker017.me/wp-content/uploads/2017/06/qmss2017.pdf
[运维安全]  运维安全之安全隐患
http://mp.weixin.qq.com/s/ZDfjqfLm2gqBdxaLT4yiBQ
[移动安全]  安天移动安全2017年Q1移动终端钓鱼网站分析报告
http://www.freebuf.com/articles/terminal/135986.html
[编程技术]  初见 Chrome Headless Browser
https://lightless.me/archives/first-glance-at-chrome-headless-browser.html
[Web安全]  代码安全之文件上传
http://mp.weixin.qq.com/s/W8z_bv4MmAWUU48AzhMnJQ
[Web安全]  代码安全之文件包含
https://mp.weixin.qq.com/s/v1ovyOf9uPuUVgIkLJ7fBQ
[Web安全]  如何保护网页按钮不被XSS自动点击
http://www.freebuf.com/articles/web/135759.html
[编程技术]  初见 Chrome Headless 第二弹
https://lightless.me/archives/chrome-headless-second.html
[运维安全]  Linux曝新安全漏洞：用户执行sudo命令可获取root权限
http://www.freebuf.com/vuls/136156.html
[Web安全]  Python 第三方库安全: 钓鱼实战与数据统计分析
http://blog.fatezero.org/2017/06/01/package-fishing/
[Web安全]  evilwaf: Web Application Firewall (WAF) Detection Tool
https://github.com/eviltik/evilwaf
[恶意分析]  基于机器学习的分布式Webshell检测系统-绪论篇
http://www.s0nnet.com/archives/fshell
[恶意分析]  基于机器学习的分布式webshell检测系统-特征工程（1）
http://www.s0nnet.com/archives/fshell-feature-1
[Web安全]  平台安全之文件解析
https://mp.weixin.qq.com/s/49Ao-omFIn0QixqzdjrWeg
[工具]  Black Hat USA 2017 兵工厂兵器列表
https://www.blackhat.com/us-17/arsenal.html
[书籍]  CNCERT《2016年中国互联网网络安全报告》电子版
http://www.cert.org.cn/publish/main/upload/File/2016_cncert_report.pdf
[取证分析]  TOP的威胁情报服务比较
https://mp.weixin.qq.com/s?__biz=MzI4NzU2NjU4NQ==&mid=2247484765&idx=1&sn=0b802b9185978a5ab785a20a8a100fc2&scene=0#wechat_redirect
[Web安全]  WAF Bypass at PHDays VII: Results and Answers
http://blog.ptsecurity.com/2017/06/waf-bypass-at-phdays-vii-results-and.html
[恶意分析]  分享一种可关闭大多数杀软的技术（对360安全卫士已验证成功）
http://www.freebuf.com/articles/system/135708.html
[数据挖掘]  学点算法做安全之垃圾邮件识别（上）
http://www.freebuf.com/column/135863.html
[工具]  Pentest BOX安装和使用
http://www.jianshu.com/p/022b0090d640
[运维安全]  HatCloud: Bypass CloudFlare with Ruby 真实 IP 查找
https://github.com/HatBashBR/HatCloud
[运维安全]  说说压力测试工具
https://huoding.com/2017/05/31/620
[其它]  【Twitter实时技术-2017.6.01】|行业资讯
https://xianzhi.aliyun.com/forum/read/1638.html
[移动安全]  How-to-locate-CRED | ne2der
https://ne2der.github.io/2017/How-to-locate-CRED/
[Web安全]  TerraMaster NAS TOS <= 3.0.30 Unauthenticated RCE as Root
https://www.evilsocket.net/2017/05/30/Terramaster-NAS-Unauthenticated-RCE-as-root/#.WS1gUW36cHI.reddit
[运维安全]  Feedback on how build SMB Honeypot
http://benkowlab.blogspot.jp/2017/05/feedback-on-how-to-build-smb-honeypot.html
[杂志]  SecWiki周刊（第169期)
https://www.sec-wiki.com/weekly/169
[无线安全]  常见无线DOS攻击
常见无线DOS攻击
[Web安全]  Study Notes of using BGInfo to bypass Application Whitelisting
https://3gstudent.github.io/3gstudent.github.io/Study-Notes-of-using-BGInfo-to-bypass-Application-Whitelisting/
[设备安全]  Training: Security of BIOS/UEFI System Firmware from Attacker and Defender
https://github.com/advanced-threat-research/firmware-security-training
[运维安全]  学点算法做安全之垃圾邮件识别（下）
https://mp.weixin.qq.com/s?__biz=MzIwOTc0MDU3NA==&mid=2247483902&idx=1&sn=93b2fe52a78f99d540df4def1fa28fd8&chksm=976e778fa019fe99ad4ee9e63742519471207ac195e5a0be4b83cc4c8e4143a614006d3ee65e&mpshare=1&scene=1&srcid=05306mKXAceidkq6UYpGwjNg&key=b51ca9e
[移动安全]  EPOXY: Shielding Bare-Metal Embedded Systems
https://nebelwelt.net/publications/files/17SyScan360-presentation.pdf
[观点]  PR的盛宴之下，不能缺席的是技术的纯真——WannaCry事件之反思|技术讨论
https://xianzhi.aliyun.com/forum/read/1645.html
[比赛]  13th届Syclover承办的ctf比赛题解
https://github.com/SycloverSecurity/ctf/tree/master/13th_cuit_game
-----微信ID：SecWiki-----
SecWiki，12年来一直专注安全技术资讯分析！
SecWiki：https://www.sec-wiki.com

本期原文地址: SecWiki周刊(第170期)