SecWiki周刊（第313期）
2020/02/24-2020/03/01
安全资讯
2019 年断网报告
https://www.solidot.org/story?sid=63648
https://www.solidot.org/story?sid=63648
安全技术
自动化渗透测试工具包：APT2
https://mp.weixin.qq.com/s/Jvhj7jUeXLxGKRUfS8LdFw
https://mp.weixin.qq.com/s/Jvhj7jUeXLxGKRUfS8LdFw
利用CodeQL寻找Java Deserialization Vulnerabilities
https://uxss.net/2020/05/04/%E5%88%A9%E7%94%A8CodeQL%E5%AF%BB%E6%89%BEJava%20Deserialization%20Vulnerabilities/
https://uxss.net/2020/05/04/%E5%88%A9%E7%94%A8CodeQL%E5%AF%BB%E6%89%BEJava%20Deserialization%20Vulnerabilities/
绝路逢生出0day——SYTSTEM权限内网漫游
https://blog.blankshell.com/2020/02/26/%e7%bb%9d%e8%b7%af%e9%80%a2%e7%94%9f%e5%87%ba0day-system%e6%9d%83%e9%99%90%e5%86%85%e7%bd%91%e6%bc%ab%e6%b8%b8/
https://blog.blankshell.com/2020/02/26/%e7%bb%9d%e8%b7%af%e9%80%a2%e7%94%9f%e5%87%ba0day-system%e6%9d%83%e9%99%90%e5%86%85%e7%bd%91%e6%bc%ab%e6%b8%b8/
linux无文件执行— fexecve 揭秘
https://mp.weixin.qq.com/s/Hywbb1ZnRo6n4gFFp5rbcQ
https://mp.weixin.qq.com/s/Hywbb1ZnRo6n4gFFp5rbcQ
沙盒syscall监控组件：strace and wtrace
https://mp.weixin.qq.com/s/AkXj7K2ZswSXeY4AkGz5hQ
https://mp.weixin.qq.com/s/AkXj7K2ZswSXeY4AkGz5hQ
一篇文章读懂Java代码审计之XXE
https://blog.csdn.net/sun1318578251/article/details/104426472
https://blog.csdn.net/sun1318578251/article/details/104426472
APT 分析及 TTPs 提取
https://projectsharp.org/2020/02/23/APT%20%E5%88%86%E6%9E%90%E5%8F%8A%20TTPs%20%E6%8F%90%E5%8F%96/
https://projectsharp.org/2020/02/23/APT%20%E5%88%86%E6%9E%90%E5%8F%8A%20TTPs%20%E6%8F%90%E5%8F%96/
信息安全风险评估与FAIR模型学习笔记
https://zhuanlan.zhihu.com/p/108995767
https://zhuanlan.zhihu.com/p/108995767
商业网络培训靶场的形态及思考
https://mp.weixin.qq.com/s/kbiZuNEnhb-WggRemUN9TQ
https://mp.weixin.qq.com/s/kbiZuNEnhb-WggRemUN9TQ
网安产业结构和动力分析——从合规型向能力型
https://mp.weixin.qq.com/s/V6P-6X_fnw_kvHWMxtqwLg
https://mp.weixin.qq.com/s/V6P-6X_fnw_kvHWMxtqwLg
针对航空电子系统的攻击
https://www.anquanke.com/post/id/198063
https://www.anquanke.com/post/id/198063
SecWiki周刊（第312期)
https://www.sec-wiki.com/weekly/312
https://www.sec-wiki.com/weekly/312
自研万亿级图数据库 & 图计算实践
https://mp.weixin.qq.com/s/uYP8Eyz36JyTWska0hvtuA
https://mp.weixin.qq.com/s/uYP8Eyz36JyTWska0hvtuA
Detecting attackers using anomalous patterns in machine learning
https://www.elastic.co/cn/blog/discovering-anomalous-patterns-based-on-parent-child-process-relationships
https://www.elastic.co/cn/blog/discovering-anomalous-patterns-based-on-parent-child-process-relationships
2020 Google夏日编程之安全项目列表
https://mp.weixin.qq.com/s/Gf937RjTpA0QsT2DJFQRqQ
https://mp.weixin.qq.com/s/Gf937RjTpA0QsT2DJFQRqQ
grapl: Graph platform for Detection and Response
https://github.com/insanitybit/grapl
https://github.com/insanitybit/grapl
SDL最初实践（完结）Paper下载
https://mp.weixin.qq.com/s/WSKpvCEDLpixXUQzKCFcvA
https://mp.weixin.qq.com/s/WSKpvCEDLpixXUQzKCFcvA
Pwning VMware, Part 2: ZDI-19-421, a UHCI bug
https://nafod.net/blog/2020/02/29/zdi-19-421-uhci.html
https://nafod.net/blog/2020/02/29/zdi-19-421-uhci.html
Cobalt Strike 从入门到入狱
https://mp.weixin.qq.com/s/WAqgHn0DrXerEeow131w4Q
https://mp.weixin.qq.com/s/WAqgHn0DrXerEeow131w4Q
CVE-2018-8453 从BSOD到ExpLoit (下)
http://www.whsgwl.net/blog/CVE-2018-8453_1.html
http://www.whsgwl.net/blog/CVE-2018-8453_1.html
Web源码泄漏漏洞及其利用
https://mp.weixin.qq.com/s/2sjGHIiLICxHl91xIqdXfg
https://mp.weixin.qq.com/s/2sjGHIiLICxHl91xIqdXfg
浅析CORS攻击及其挖洞思路
https://xz.aliyun.com/t/7242
https://xz.aliyun.com/t/7242
CVE-2018-8453 从BSOD到ExpLoit (上)
http://www.whsgwl.net/blog/CVE-2018-8453_0.html
http://www.whsgwl.net/blog/CVE-2018-8453_0.html
SSH隧道技术在实战中的使用
https://xz.aliyun.com/t/7245
https://xz.aliyun.com/t/7245
Top disclosed reports from HackerOne
https://github.com/reddelexc/hackerone-reports
https://github.com/reddelexc/hackerone-reports
Pwning VMWare, Part 1: RWCTF 2018 Station-Escape
https://nafod.net/blog/2019/12/21/station-escape-vmware-pwn.html
https://nafod.net/blog/2019/12/21/station-escape-vmware-pwn.html
AWS IAM Privilege Escalation – Methods and Mitigation
https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/
https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/
HotFuzz – Fuzzing Java Programs for Algorithmic Complexity Vulnerabilities
https://mweissbacher.com/blog/2020/02/23/hotfuzz-fuzzing-java-programs-for-algorithmic-complexity-vulnerabilities/
https://mweissbacher.com/blog/2020/02/23/hotfuzz-fuzzing-java-programs-for-algorithmic-complexity-vulnerabilities/
OilRig攻击的DNS隧道行为简介
https://www.aqniu.com/tools-tech/64283.html
https://www.aqniu.com/tools-tech/64283.html
使用Suricata和ELK进行流量检测
https://xz.aliyun.com/t/7263
https://xz.aliyun.com/t/7263
-----微信ID：SecWiki-----
SecWiki，12年来一直专注安全技术资讯分析！
SecWiki：https://www.sec-wiki.com本期原文地址: SecWiki周刊(第313期)
