SecWiki周刊（第268期）
2019/04/15-2019/04/21
安全资讯
[事件]  维基解密公开的数千份可下载敏感文件
https://nosec.org/home/detail/2487.html
[人物]  腾讯云鼎实验室掌门人Killer谈网络安全
https://mp.weixin.qq.com/s/MLvd1AmxE9YnkWWmB9L9VQ
[观点]  企业海外机构信息安全保密风险分析及对策建议
https://mp.weixin.qq.com/s/jJyq7bYuq1xxGXpfnmKP3g
[法规]  互联网个人信息安全保护指南
http://www.beian.gov.cn/portal/topicDetail?id=88
[新闻]  全球最大网络安全演习北约“锁盾”：法国夺冠
https://mp.weixin.qq.com/s/uY9EzJAg7OtJKgcFYwOVEA
[新闻]  国家安全机关公布三起境外网络攻击窃密案件
http://www.xinhuanet.com/legal/2019-04/18/c_1124383501.htm
[新闻]  中央企业负责人经营业绩考核办法
http://www.sasac.gov.cn/n2588035/n2588320/n2588335/c8108632/content.html
[新闻]  网络安全技术应用试点示范项目公示
http://www.miit.gov.cn/n1146285/n1146352/n3054355/n3057724/n3057728/c6794942/content.html
安全技术
[Web安全]  Netsparker5.3破解版 Netsparker Pro 5.3.0.23162[cracked]
https://www.ddosi.com/b170/
[Web安全]  FuzzScanner：自研信息搜集开源小工具
https://mp.weixin.qq.com/s/qy_iunNY1DNnrnAsCpB3mw
[Web安全]  Web弱口令通用检测方法探究
https://mp.weixin.qq.com/s/R0M1V0X4eG_GnSyZK3Fz_A
[设备安全]  针对VxWorks设备的分析工具VxHunter介绍
https://mp.weixin.qq.com/s/RPLGCwb6do2LbIodFGoGBQ
[Web安全]  Go语言安全编码规范-翻译
https://bloodzer0.github.io/ossa/application-security/sdl/go-scp/
[观点]  真真假假的创新 - RSAC2019之三
https://mp.weixin.qq.com/s/pWZ3rRrRHOVMpxUc_vWgAg
[漏洞分析]  客串逆向工程，一瞬获悬镜WAF规则
https://drivertom.blogspot.com/2019/04/waf.html?m=1
[设备安全]  VxWorks固件逆向：WRT54Gv8
https://www.anquanke.com/post/id/176481
[漏洞分析]  iSCSI未授权访问漏洞，数万iSCSI可能受影响
https://nosec.org/home/detail/2491.html
[漏洞分析]  Confluence 未授权 RCE 分析（CVE-2019-3396）
https://paper.seebug.org/893/
[恶意分析]  2019年僵尸网络主动监测报告（第一期）
https://mp.weixin.qq.com/s/ptimjyH9wlamO83nPZMa-Q
[Web安全]  一文洞悉DAST、SAST、IAST —Web应用安全测试技术对比浅谈
https://mp.weixin.qq.com/s/EWn9ktce3KB4P6zi4slnTA
[数据挖掘]  数据分析与可视化：谁是安全圈的吃鸡第一人
https://www.freebuf.com/articles/web/199925.html
[文档]  Exposed: Cyberattacks on Cloud Honeypots
http://www.sophos.com/CloudHoneypotsReport
[数据挖掘]  下一代SIEM@AI：从UEBA到SOAR
https://mp.weixin.qq.com/s/OYPooeIZp8hq4JebOHDJMg
[取证分析]  欺骗防御未来已来
https://www.freebuf.com/articles/es/201020.html
[其它]  理清弄透：加密&解密、签名&验签
https://mp.weixin.qq.com/s/aw5V95kelBslFv-ScxUVMw
[漏洞分析]  Spring Cloud Config Server 路径穿越与任意文件读取漏洞分析
https://xz.aliyun.com/t/4844
[Web安全]  阿里巴巴被发现了一个可以绕过waf的漏洞
https://nosec.org/home/detail/2483.html
[漏洞分析]  个人PWN入坑常见方法总结
https://www.freebuf.com/articles/rookie/200207.html
[Web安全]  DNScat2工具:通过DNS进行C&C通信
https://www.4hou.com/tools/17226.html
[Web安全]  Multiple Vulnerabilities + WAF bypass to Account Takeover
https://medium.com/@y.shahinzadeh/chaining-multiple-vulnerabilities-waf-bypass-to-account-takeover-in-almost-all-alibabas-websites-f8643eaa2855
[运维安全]  osquery源码解读之分析shell_history
http://www.polaris-lab.com/index.php/archives/634/
[运维安全]  Red Team从0到1的实践与思考
https://mp.weixin.qq.com/s/cyxC4Of4Ic9c_vujQayTLg
[Web安全]  后门木马变形计
https://mp.weixin.qq.com/s/CYuNP7d52R_iwnpYNBREDw
[数据挖掘]  乱弹网络空间X检索
https://mp.weixin.qq.com/s/OvTHpWXCwCH-k0jf8cQBTg
[取证分析]  隐私币应用全景观察
https://mp.weixin.qq.com/s/bhWaKtVTqOLlJ1lj362rNA
[Web安全]  Bypass XSS Protection with xmp, noscript, noframes.. etc..
https://www.hahwul.com/2019/04/bypass-xss-protection-with-xmp-noscript-etc....html
[数据挖掘]  基于Flink构建用户实时基础行为工程
https://www.infoq.cn/article/rQ*fI3BN9mWGsDcTjAHf
[运维安全]  osquery源码解读之分析process_open_socket
http://www.polaris-lab.com/index.php/archives/638/
[恶意分析]  Revisiting TTPs: TimeStomper
https://posts.specterops.io/revisiting-ttps-timestomper-622d4c28a655
[数据挖掘]  Virgilio: Your new Mentor for Data Science E-Learning
https://github.com/clone95/Virgilio
[设备安全]  Reverse-engineering Broadcom wireless chipsets
https://blog.quarkslab.com/reverse-engineering-broadcom-wireless-chipsets.html
[恶意分析]  CRYPTOPOKEMON: Simple C++ cryptolocker Blowfish CBC
https://github.com/PokemonGoTeam/CRYPTOPOKEMON
[数据挖掘]  刘知远：NLP研究入门之道（一）
https://mp.weixin.qq.com/s/PVoQI85YkDSzlA46FRU1OQ
[移动安全]  Android Cloak and Dagger Attack
https://medium.com/@targetpractice/cloak-and-dagger-malware-techniques-demystified-c4d8a035b94e
[数据挖掘]  浅析基于人格特征的内部高风险用户识别方法
https://www.freebuf.com/articles/network/200564.html
-----微信ID：SecWiki-----
SecWiki，12年来一直专注安全技术资讯分析！
SecWiki：https://www.sec-wiki.com

本期原文地址: SecWiki周刊(第268期)