SecWiki周刊（第46期）
2015/01/12-2015/01/18
安全资讯
2015移动安全挑战赛
http://msc.pediy.com/
http://msc.pediy.com/
2014年互联网十大安全漏洞及思考
http://security.alibaba.com/blog/blog.htm?spm=0.0.0.0.9YDnsM&id=8
http://security.alibaba.com/blog/blog.htm?spm=0.0.0.0.9YDnsM&id=8
复杂网络前沿问题研讨会日程
http://blog.sciencenet.cn/blog-3075-859295.html
http://blog.sciencenet.cn/blog-3075-859295.html
Anatomy of a privacy leak: Apple OS X search engine in the Spotlight
https://nakedsecurity.sophos.com/2015/01/11/anatomy-of-a-privacy-leak-apple-os-x-search-engine-in-the-spotlight/
https://nakedsecurity.sophos.com/2015/01/11/anatomy-of-a-privacy-leak-apple-os-x-search-engine-in-the-spotlight/
AtlSecCon 2015 Speakers
http://atlseccon.com/speakers/
http://atlseccon.com/speakers/
Facebook Vulnerability Allows to Video-Call Mark Zuckerberg!
http://blog.hackersonlineclub.com/2015/01/facebook-vulnerability-allows-to-video.html
http://blog.hackersonlineclub.com/2015/01/facebook-vulnerability-allows-to-video.html
Obama pushes cybercrime law
http://www.politico.com/story/2015/01/obama-cybersecurity-crime-proposal-114211.html
http://www.politico.com/story/2015/01/obama-cybersecurity-crime-proposal-114211.html
Blackhat – A Review
https://blog.whitehatsec.com/blackhat-a-review/
https://blog.whitehatsec.com/blackhat-a-review/
微软2015年7月结束对Windows Server 2003支持服务
http://www.youxia.org/2015-7-windows-server-2003.html
http://www.youxia.org/2015-7-windows-server-2003.html
Politicians and journalists stung by fake open Wi-Fi protest
http://www.welivesecurity.com/2015/01/16/politicians-journalists-stung-fake-open-wi-fi-security-conference/
http://www.welivesecurity.com/2015/01/16/politicians-journalists-stung-fake-open-wi-fi-security-conference/
2014年Linux界发生的好事，坏事和丑事
http://linux.cn/article-4659-1.html
http://linux.cn/article-4659-1.html
2015 ShmooCon Hiring
https://docs.google.com/spreadsheets/d/1TytbnvqekJEF0jxLANe6sNa5fu05dFaHEP7zudlJej0/edit#gid=0
https://docs.google.com/spreadsheets/d/1TytbnvqekJEF0jxLANe6sNa5fu05dFaHEP7zudlJej0/edit#gid=0
2015年国内最具成长力的八家安全企业
http://www.aqniu.com/news/6326.html
http://www.aqniu.com/news/6326.html
冷眼观CES 2015：可能被Hacking的产品
http://www.secpulse.com/archives/4220.html
http://www.secpulse.com/archives/4220.html
西安电子科大成立网络与信息安全学院
http://www.sn.xinhuanet.com/2014-12/31/c_1113840868.htm
http://www.sn.xinhuanet.com/2014-12/31/c_1113840868.htm
San Francisco Senior Network Security Engineer Job
http://jobs.akamai.com/job/San-Francisco-Senior-Network-Security-Engineer-Job-CA-94101/227544300/
http://jobs.akamai.com/job/San-Francisco-Senior-Network-Security-Engineer-Job-CA-94101/227544300/
安全技术
IDA_Pro_v6.6_and_Hex-Rays_Decompiler_(ARM,x64,x.86)
http://www.52pojie.cn/thread-319763-1-1.html
http://www.52pojie.cn/thread-319763-1-1.html
Android Internals: A Confectioner's Cookbook
http://www.newandroidbook.com/
http://www.newandroidbook.com/
pyspider 爬虫教程（三）：使用 PhantomJS 渲染带 JS 的页面
http://segmentfault.com/blog/binux/1190000002477913
http://segmentfault.com/blog/binux/1190000002477913
在线数据包分析实现 - Online Pcap Analyzer
http://le4f.net/post/post/pcap-online-analyzer
http://le4f.net/post/post/pcap-online-analyzer
pyspider 爬虫教程（一）：HTML 和 CSS 选择器
http://segmentfault.com/blog/binux/1190000002477863
http://segmentfault.com/blog/binux/1190000002477863
简单获取CDN背后网站的真实IP
http://zone.wooyun.org/content/18058
http://zone.wooyun.org/content/18058
吊丝如何逆袭女神—-Android安全审计与攻击框架—-drozer全功能介绍
http://hj-h.com/565.html
http://hj-h.com/565.html
Android逆向必备网址
http://hj-h.com/563.html
http://hj-h.com/563.html
Dionaea蜜罐指南
http://drops.wooyun.org/papers/4584
http://drops.wooyun.org/papers/4584
论PHP常见的漏洞
http://drops.wooyun.org/papers/4544
http://drops.wooyun.org/papers/4544
pyspider 爬虫教程（二）：AJAX 和 HTTP
http://segmentfault.com/blog/binux/1190000002477870
http://segmentfault.com/blog/binux/1190000002477870
EasyPR:中文的开源车牌识别系统
https://github.com/liuruoze/EasyPR
https://github.com/liuruoze/EasyPR
乌云沙龙：赛棍的自我修养
http://bobao.360.cn/learning/detail/196.html
http://bobao.360.cn/learning/detail/196.html
北京10月机器学习班的所有PPT
http://pan.baidu.com/s/1o6r6dWA
http://pan.baidu.com/s/1o6r6dWA
CTFs - Wiki-like CTF write-ups repository
https://github.com/ctfs
https://github.com/ctfs
Sqlmap小技巧
https://sobug.com/article/detail/2
https://sobug.com/article/detail/2
The Double-Edged sword of HSTS persistence and privacy
http://paper.aliapp.com/md/super-cookie-over-HSTS.txt
http://paper.aliapp.com/md/super-cookie-over-HSTS.txt
ESP8266App:基于ESP8266芯片的WiFi模块固件
https://git.oschina.net/supergis/ESP8266App
https://git.oschina.net/supergis/ESP8266App
MS15-002 telnet服务缓冲区溢出漏洞分析与POC构造
http://drops.wooyun.org/papers/4621
http://drops.wooyun.org/papers/4621
DockerCon EU Breakouts from Day 2
http://blog.docker.com/2015/01/dockercon-eu-breakouts-from-day-2/
http://blog.docker.com/2015/01/dockercon-eu-breakouts-from-day-2/
使用渗透测试框架Xposed Framework hook调试Android APP
http://www.freebuf.com/articles/terminal/56453.html
http://www.freebuf.com/articles/terminal/56453.html
Powershell script to automatically generate a malicious Excel document
https://github.com/enigma0x3/Generate-Macro/blob/master/Generate-Macro.ps1
https://github.com/enigma0x3/Generate-Macro/blob/master/Generate-Macro.ps1
Python自然语言处理：相关类库
http://www.mathackers.com/2015/01/nlpy-libraries/
http://www.mathackers.com/2015/01/nlpy-libraries/
2014 Top Security Tools
http://www.toolswatch.org/2015/01/2014-top-security-tools-as-voted-by-toolswatch-org-readers/
http://www.toolswatch.org/2015/01/2014-top-security-tools-as-voted-by-toolswatch-org-readers/
GRR Rapid Response: remote live forensics for incident response
https://github.com/google/grr
https://github.com/google/grr
Examining Shellcode in a Debugger through Control of the Instruction Pointer
http://digital-forensics.sans.org/blog/2014/12/30/taking-control-of-the-instruction-pointer?utm_content=buffer1a3ee&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer
http://digital-forensics.sans.org/blog/2014/12/30/taking-control-of-the-instruction-pointer?utm_content=buffer1a3ee&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer
proxmark3: RFID penetration testing tool
http://github.com/Proxmark/proxmark3
http://github.com/Proxmark/proxmark3
软件加密解密第三版视频教程
http://pan.baidu.com/s/1hqsYXMW%20
http://pan.baidu.com/s/1hqsYXMW%20
Analyzing the WeakSauce Exploit
http://www.newandroidbook.com/Articles/HTC.html
http://www.newandroidbook.com/Articles/HTC.html
返璞归真—流量中提取文件的五种方法
http://blog.sina.com.cn/s/blog_e8e60bc00102vfd9.html
http://blog.sina.com.cn/s/blog_e8e60bc00102vfd9.html
Security Onion: New securityonion-samples packages
http://blog.securityonion.net/2015/01/new-securityonion-samples-packages.html
http://blog.securityonion.net/2015/01/new-securityonion-samples-packages.html
Python自然语言处理:语料库
http://www.mathackers.com/2015/01/nlpy-corpora/
http://www.mathackers.com/2015/01/nlpy-corpora/
OSXCollector: Forensic Collection and Automated Analysis for OS X
http://engineeringblog.yelp.com/2015/01/osxcollector-forensic-collection-and-automated-analysis-for-os-x.html
http://engineeringblog.yelp.com/2015/01/osxcollector-forensic-collection-and-automated-analysis-for-os-x.html
Javascript恶意脚本Scanbox源码分析与演示
http://www.freebuf.com/tools/56092.html
http://www.freebuf.com/tools/56092.html
pcapng:Convert PcapNG to PCAP
http://pcapng.com/
http://pcapng.com/
Python_Pin:Python bindings for pin
https://github.com/blankwall/Python_Pin
https://github.com/blankwall/Python_Pin
Post-Exploitation Using Veil-Pillage
http://resources.infosecinstitute.com/post-exploitation-using-veil-pillage/
http://resources.infosecinstitute.com/post-exploitation-using-veil-pillage/
华硕路由器9999端口远程命令执行研究报告 V1
http://blog.knownsec.com/2015/01/%e5%8d%8e%e7%a1%95%e8%b7%af%e7%94%b1%e5%99%a89999%e7%ab%af%e5%8f%a3%e8%bf%9c%e7%a8%8b%e5%91%bd%e4%bb%a4%e6%89%a7%e8%a1%8c%e7%a0%94%e7%a9%b6%e6%8a%a5%e5%91%8a-v1/
http://blog.knownsec.com/2015/01/%e5%8d%8e%e7%a1%95%e8%b7%af%e7%94%b1%e5%99%a89999%e7%ab%af%e5%8f%a3%e8%bf%9c%e7%a8%8b%e5%91%bd%e4%bb%a4%e6%89%a7%e8%a1%8c%e7%a0%94%e7%a9%b6%e6%8a%a5%e5%91%8a-v1/
MMD-0030-2015 New ELF malware on Shellshock: the ChinaZ
http://blog.malwaremustdie.org/2015/01/mmd-0030-2015-new-elf-malware-on.html
http://blog.malwaremustdie.org/2015/01/mmd-0030-2015-new-elf-malware-on.html
Arp欺骗原理及Android环境下的检测方法
http://www.freebuf.com/articles/terminal/55987.html
http://www.freebuf.com/articles/terminal/55987.html
USBdriveby: Weaponized USB Backdoor
http://samy.pl/usbdriveby
http://samy.pl/usbdriveby
Exploit Pack - The next Exploit Framework
http://exploitpack.com/
http://exploitpack.com/
sql++: cross-database command line SQL client
https://github.com/samyk/sqlpp/
https://github.com/samyk/sqlpp/
DCS、SCADA安全漏洞分析
http://www.youxia.org/dcs-scada-huangmin.html
http://www.youxia.org/dcs-scada-huangmin.html
Analyzing text protocols with a TCP proxy
http://www.leaseweblabs.com/2015/01/tcp-proxy-analyzing-text-protocols/
http://www.leaseweblabs.com/2015/01/tcp-proxy-analyzing-text-protocols/
DiscuzX系列命令执行分析公开
http://drops.wooyun.org/papers/4611
http://drops.wooyun.org/papers/4611
Diving into a Silverlight Exploit and Shellcode - Analysis and Techniques
http://www.checkpoint.com/downloads/partners/TCC-Silverlight-Jan2015.pdf
http://www.checkpoint.com/downloads/partners/TCC-Silverlight-Jan2015.pdf
Open-Source USB Exploitation Library - Teensyduino
http://malware.cat/?p=89
http://malware.cat/?p=89
BARF : open source Binary Analysis and Reverse Framework
https://github.com/programa-stic/barf-project
https://github.com/programa-stic/barf-project
A Simple Performance Comparison of HTTPS, SPDY and HTTP/2
http://blog.httpwatch.com/2015/01/16/a-simple-performance-comparison-of-https-spdy-and-http2/
http://blog.httpwatch.com/2015/01/16/a-simple-performance-comparison-of-https-spdy-and-http2/
Cracking a Captcha . Nullcon| EMC2 CTF 2015
http://garage4hackers.com/entry.php?b=3103
http://garage4hackers.com/entry.php?b=3103
Skeleton Key Malware Analysis
http://www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-malware-analysis/
http://www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-malware-analysis/
CTF Writeup Summary
http://sec.yka.me/
http://sec.yka.me/
ConEmu:Windows console with tabs
http://sourceforge.net/projects/conemu/
http://sourceforge.net/projects/conemu/
Windows Exploitation in 2014
http://www.welivesecurity.com/wp-content/uploads/2015/01/Windows-Exploitation-in-2014.pdf
http://www.welivesecurity.com/wp-content/uploads/2015/01/Windows-Exploitation-in-2014.pdf
SQL Injection via DNS
http://drops.wooyun.org/tips/4605
http://drops.wooyun.org/tips/4605
Kippo蜜罐指南
http://drops.wooyun.org/papers/4578
http://drops.wooyun.org/papers/4578
Docker Secure Deployment Guidelines
http://blog.gdssecurity.com/labs/2015/1/12/docker-secure-deployment-guidelines.html
http://blog.gdssecurity.com/labs/2015/1/12/docker-secure-deployment-guidelines.html
Powershell Popups + Capture
http://www.room362.com/blog/2015/01/12/powershell-popups-plus-capture/
http://www.room362.com/blog/2015/01/12/powershell-popups-plus-capture/
PHP tainted analysis extension
https://github.com/laruence/php-taint
https://github.com/laruence/php-taint
《安全参考》HACKCTO-201501-25
http://pan.baidu.com/s/1pJiG4sj
http://pan.baidu.com/s/1pJiG4sj
-----微信ID：SecWiki-----
SecWiki，13年来一直专注安全技术资讯分析！
SecWiki：https://www.sec-wiki.com本期原文地址: SecWiki周刊(第46期)
