SecWiki周刊（第30期）
2014/09/22-2014/09/28
安全资讯
[Web安全]  CVE-2014-6271扫描脚本
https://github.com/ctxis/ActiveScanPlusPlus/blob/master/activeScan%2B%2B.py
[Web安全]  一周海外安全事件回顾（9.15-9.21）: 说好的分手呢？
http://www.freebuf.com/news/44839.html
[Web安全]  A Week in Security (Sept 14 – 20)
https://blog.malwarebytes.org/online-security/2014/09/a-week-in-security-sept-14-20/
安全技术
[Web安全]  Even uploading a JPG file can lead to Cross Domain Data Hijacking (client-side a
https://soroush.secproject.com/blog/2014/05/even-uploading-a-jpg-file-can-lead-to-cross-domain-data-hijacking-client-side-attack/
[Web安全]  xss挑战赛writeup
http://drops.wooyun.org/tips/3059
[恶意分析]  A very well done post on solving the FireEye challenges
http://www.ghettoforensics.com/2014/09/a-walkthrough-for-flare-re-challenges.html
[Web安全]  Upload a web.config File for Fun & Profit
https://soroush.secproject.com/blog/2014/07/upload-a-web-config-file-for-fun-profit/
[设备安全]  Heatmiser WiFi thermostat vulnerabilities
http://cybergibbons.com/security-2/heatmiser-wifi-thermostat-vulnerabilities/
[其它]  WiFiPineApple应用介绍
http://wiki.radiowar.org/WiFiPineApple%E5%BA%94%E7%94%A8%E4%BB%8B%E7%BB%8D
[编程技术]  Sublime Text 全程指引
http://www.cnblogs.com/figure9/p/sublime-text-complete-guide.html
[移动安全]  Droidmarking: resilient software watermarking for impeding android application
http://dl.acm.org/citation.cfm?id=2642977
[无线安全]  Kali Linux NetHunter Download
http://www.offensive-security.com/kali-linux-nethunter-download/
[移动安全]  Kisskiss - Unpacker for various Android packers/protectors
https://github.com/strazzere/android-unpacker/tree/master/native-unpacker
[编程技术]  Elasticsearch权威指南中文版
https://github.com/looly/elasticsearch-definitive-guide-cn
[Web安全]  mitmproxy中libmproxy简单介绍
http://drops.wooyun.org/tips/2943
[运维安全]  无状态扫描工具masscan 介绍
http://labs.redcoast.org/?p=28
[移动安全]  金刚——安卓APP安全漏洞审计系统
http://service.security.tencent.com/kingkong
[数据挖掘]  用 Python 做文本挖掘的流程
http://zhuanlan.zhihu.com/textmining-experience/19630762
[Web安全]  The Mole to exploit SQL Injections using SQLMAP
http://themole.sourceforge.net/?q=tutorial
[数据挖掘]  Python自然语言处理实践: 在NLTK中使用斯坦福中文分词器
http://www.52nlp.cn/python%e8%87%aa%e7%84%b6%e8%af%ad%e8%a8%80%e5%a4%84%e7%90%86%e5%ae%9e%e8%b7%b5-%e5%9c%a8nltk%e4%b8%ad%e4%bd%bf%e7%94%a8%e6%96%af%e5%9d%a6%e7%a6%8f%e4%b8%ad%e6%96%87%e5%88%86%e8%af%8d%e5%99%a8
[Web安全]  14 Best Open Source Web Application Vulnerability Scanners
http://resources.infosecinstitute.com/14-popular-web-application-vulnerability-scanners/
[无线安全]  Kali Nethunter初体验
http://drops.wooyun.org/tools/3113
[漏洞分析]  CVE-2014-6271资料汇总
http://drops.wooyun.org/papers/3064
[编程技术]  Web扫描器科普系列:Web2.0爬虫
http://www.imiyoo.com/webscan/2014/09/23/271.html
[数据挖掘]  Choosing a Recommender Model
http://blog.graphlab.com/choosing-a-recommender-model
[漏洞分析]  Exploit-Exercises Nebula全攻略
https://github.com/1u4nx/Exploit-Exercises-Nebula
[漏洞分析]  BASH BUG:cve-2014-6271验证与利用
http://bobao.360.cn/learning/detail/43.html
[其它]  pwc-moneytree-q2-2014-summary-report
http://vdisk.weibo.com/s/C72IDYVydM0Va/1411294602
[Web安全]  xss挑战赛writeup
http://drops.wooyun.org/tips/3059
[漏洞分析]  CVE2014-6271 Bash Environment Variables Code Injection Vulnerability Analysis
http://www.cnblogs.com/LittleHann/p/3992778.html
[其它]  张益唐：我若在中国无法取得今天这样的学术突破
http://www.mysanco.cn/wenda/index.php?class=discuss&action=question_item&questionid=6591
[杂志]  《安全参考》HACKCTO-201409-21
http://pan.baidu.com/s/1c07wz64
[Web安全]  XSS 那些事儿
http://pan.baidu.com/share/link?shareid=585295668&uk=4110645937
[Web安全]  Bash漏洞批量检测工具与修复方案
http://www.freebuf.com/tools/45311.html
[漏洞分析]  破壳漏洞(CVE-2014-6271)综合分析
http://www.antiy.com/response/Bash%20Shellshock(cve-2014-6271)_V1.5.pdf
[Web安全]  Scaling the NetScaler
http://console-cowboys.blogspot.hk/2014/09/scaling-netscaler.html
[恶意分析]  Fileless Infections from Exploit Kit: An Overview
https://blog.malwarebytes.org/exploits-2/2014/09/fileless-infections-from-exploit-kit-an-overview/
[漏洞分析]  反调试之遍历驱动名-熙甫JoyChou
http://vdisk.weibo.com/s/zFE_kIDWI5fx-/1411349943
[Web安全]  绕过浏览器的XSS防御机制（4）
http://parsec.me/780.html
[编程技术]  Google Android官方培训课程中文版(v0.4)
https://github.com/kesenhoo/android-training-course-in-chinese
[移动安全]  Blind Return Oriented Programming (BROP) Attack
http://drops.wooyun.org/tips/3071
[Web安全]  Beebeeto:安全研究人员所共同维护的POC/EXP平台
http://beebeeto.com/
[Web安全]  A Security Analysis Of Browser Extensions
http://drops.wooyun.org/web/2918
[Web安全]  [CTF]AliCTF-Quals-2014-L-WriteUp
http://le4f.net/post/writeup/-ctf-alictf-quals-2014-l-writeup
[Web安全]  未知攻焉知防——XXE漏洞攻防
http://security.tencent.com/index.php/blog/msg/69
[Web安全]  CSAW CTF 2014
https://ctf.isis.poly.edu/
[Web安全]  SlimerJS:A scriptable browser for Web developers
http://www.slimerjs.org/index.html
[Web安全]  CSAW CTF 2014 – Web 300 – hashes writeup
http://wiremask.eu/csaw-ctf-2014-web-300-hashes-writeup/
[移动安全]  Android逆向之动态调试总结
http://www.52pojie.cn/thread-293648-1-1.html
[设备安全]  2014年工控系统安全态势报告
http://www.i170.com/Attach/FD280BDD-245E-4F2E-AF1B-5AE139C8A50F
[恶意分析]  Malicious Documents – PDF Analysis in 5 steps
http://countuponsecurity.com/2014/09/22/malicious-documents-pdf-analysis-in-5-steps/
[编程技术]  web前端_PHP开发视频
http://www.imooc.com/course/list
[移动安全]  聊着聊着我就上了你……的微信
http://lvwei.me/liao-zhuo-liao-zhuo-wo-jiu-shang-liao-ni-di-wei-xin-liang-chu-du-ke-yi-jie-chi-wei-xin-deng-lu-di-lou-dong-395.html
[数据挖掘]  基于云计算的微博敏感信息挖掘系统
https://github.com/alsotang/ciscn_docs
[编程技术]  蔡学镛架构设计方法
http://vdisk.weibo.com/s/q8FZMJO4W2qq
[恶意分析]  FinFisher Malware Dropper Analysis
https://www.codeandsec.com/FinFisher-Malware-Dropper-Analysis
[Web安全]  Trying to hack Redis via HTTP requests
http://drops.wooyun.org/papers/3062
[编程技术]  FrozenUI:移动端web框架
http://frozenui.github.io/
[移动安全]  Packetbeat：应用监控和包跟踪系统
http://packetbeat.com/
[运维安全]  Linux内核实现多路镜像流量聚合和复制
http://www.freebuf.com/tools/44308.html
[恶意分析]  Javascript Deobfuscation Tools Redux
http://www.kahusecurity.com/2014/javascript-deobfuscation-tools-redux/
[编程技术]  UICloud:User Interface Design Search Engine
http://ui-cloud.com/
[运维安全]  nginx apache lighttpd 禁止某些目录执行php
https://baoz.net/nginx-apache-lighttpd-disable-php/
[编程技术]  绕过360安全卫士的部分代码
http://blog.csdn.net/chinafe/article/details/39477997
[编程技术]  地理空间距离计算优化
http://tech.meituan.com/lucene-distance.html
-----微信ID：SecWiki-----
SecWiki，12年来一直专注安全技术资讯分析！
SecWiki：https://www.sec-wiki.com

本期原文地址: SecWiki周刊(第30期)