SecWiki周刊（第62期）
2015/05/04-2015/05/10
安全资讯
FIDO: Automated Security Incident Response
http://techblog.netflix.com/2015/05/introducing-fido-automated-security.html
http://techblog.netflix.com/2015/05/introducing-fido-automated-security.html
硅谷夜话之RSA2015 （1）
http://weibo.com/p/1001603840227939594309
http://weibo.com/p/1001603840227939594309
2015网络安全市场报告（下）
http://www.freebuf.com/news/special/66278.html
http://www.freebuf.com/news/special/66278.html
安全技术
Fuzzing nginx - Hunting vulnerabilities with afl-fuzz
https://lolware.net/2015/04/28/nginx-fuzzing.html
https://lolware.net/2015/04/28/nginx-fuzzing.html
XSS via window.stop() - Google Safen Up
http://blog.bentkowski.info/2015/05/xss-via-windowstop-google-safen-up.html?m=1
http://blog.bentkowski.info/2015/05/xss-via-windowstop-google-safen-up.html?m=1
Android Native API Hooking with Library Injection and ELF Introspection
http://www.evilsocket.net/2015/05/04/android-native-api-hooking-with-library-injecto/
http://www.evilsocket.net/2015/05/04/android-native-api-hooking-with-library-injecto/
安卓APP动态调试-IDA实用攻略
http://drops.wooyun.org/mobile/5942
http://drops.wooyun.org/mobile/5942
WPS Pixie Dust Attack (Offline WPS Attack)
https://forums.kali.org/showthread.php?24286
https://forums.kali.org/showthread.php?24286
pfSense: free network firewall distribution
https://www.pfsense.org/
https://www.pfsense.org/
ctf-tools:Some setup scripts for security research tools
https://github.com/zardus/ctf-tools
https://github.com/zardus/ctf-tools
隐藏在显存中的基于GPU的rootkit和键盘记录器
https://0xicf.wordpress.com/2015/05/09/new-gpu-based-linux-rootkit-and-keylogger-proof-of-concept-gpu-rootkit-hides-in-vram-snoops-system-activities/
https://0xicf.wordpress.com/2015/05/09/new-gpu-based-linux-rootkit-and-keylogger-proof-of-concept-gpu-rootkit-hides-in-vram-snoops-system-activities/
On the Arms Race in Spamming Botnet Mitigation
http://blog.ourren.com/2015/05/08/on-the-arms-race-in-spamming-botnet-mitigation/
http://blog.ourren.com/2015/05/08/on-the-arms-race-in-spamming-botnet-mitigation/
Tinba - Yet another anti-sandbox tricks
https://www.f-secure.com/weblog/archives/00002810.html
https://www.f-secure.com/weblog/archives/00002810.html
SSL/TLS协议安全系列：SSL/TLS概述
http://drops.wooyun.org/tips/6002
http://drops.wooyun.org/tips/6002
jellyfish:Linux based userland gpu rootkit
https://github.com/x0r1/jellyfish
https://github.com/x0r1/jellyfish
一例“无实体文件”恶意样本分析报告
http://mp.weixin.qq.com/s?__biz=MjM5MTA3Nzk4MQ==&mid=207025811&idx=1&sn=76130bdd0d6273af23f234e13faa160f#rd
http://mp.weixin.qq.com/s?__biz=MjM5MTA3Nzk4MQ==&mid=207025811&idx=1&sn=76130bdd0d6273af23f234e13faa160f#rd
commix:Automated All-in-One OS Command Injection and Exploitation Tool
https://github.com/stasinopoulos/commix
https://github.com/stasinopoulos/commix
IIS at Risk: An In-depth Look into CVE-2015-1635
http://blog.trendmicro.com/trendlabs-security-intelligence/iis-at-risk-an-in-depth-look-into-cve-2015-1635/
http://blog.trendmicro.com/trendlabs-security-intelligence/iis-at-risk-an-in-depth-look-into-cve-2015-1635/
Instrumenting Android Applications with Frida
http://www.frida.re/news/2015/05/09/frida-4-0-0-released/
http://www.frida.re/news/2015/05/09/frida-4-0-0-released/
Forcing XXE Reflection through Server Error Messages
https://blog.netspi.com/forcing-xxe-reflection-server-error-messages/
https://blog.netspi.com/forcing-xxe-reflection-server-error-messages/
New malicious Office docs trick
http://bartblaze.blogspot.com/2015/05/new-malicious-office-docs-trick.html
http://bartblaze.blogspot.com/2015/05/new-malicious-office-docs-trick.html
Python tools for penetration testers
https://github.com/dloss/python-pentest-tools
https://github.com/dloss/python-pentest-tools
Finding targets in drone and quadcopter video streams
http://www.pyimagesearch.com/2015/05/04/target-acquired-finding-targets-in-drone-and-quadcopter-video-streams-using-python-and-opencv/
http://www.pyimagesearch.com/2015/05/04/target-acquired-finding-targets-in-drone-and-quadcopter-video-streams-using-python-and-opencv/
Deploying Dionaea on a Raspberry Pi using MHN
https://github.com/threatstream/mhn/wiki/Deploying-Dionaea-on-a-Raspberry-Pi
https://github.com/threatstream/mhn/wiki/Deploying-Dionaea-on-a-Raspberry-Pi
Attacking POS Supply Chains
https://blogs.rsa.com/attacking-a-pos-supply-chain-part-1/
https://blogs.rsa.com/attacking-a-pos-supply-chain-part-1/
Ios App Reverse Engineering
http://www.lulu.com/shop/zishe-sha/ios-app-reverse-engineering/ebook/product-22147315.html
http://www.lulu.com/shop/zishe-sha/ios-app-reverse-engineering/ebook/product-22147315.html
(IN)SECURE Magazine：RSA 2015 SPECIAL ISSUE
http://www.net-security.org/insecuremag.php
http://www.net-security.org/insecuremag.php
armpwn:memory corruption on the ARM platform
https://github.com/saelo/armpwn
https://github.com/saelo/armpwn
Many ways of malware persistence
http://jumpespjump.blogspot.com/2015/05/many-ways-of-malware-persistence-that.html
http://jumpespjump.blogspot.com/2015/05/many-ways-of-malware-persistence-that.html
Dynamically inject a shared library into a running process on Android/ARM
http://www.evilsocket.net/2015/05/01/dynamically-inject-a-shared-library-into-a-running-process-on-androidarm/#sthash.P013X45P.dpbs
http://www.evilsocket.net/2015/05/01/dynamically-inject-a-shared-library-into-a-running-process-on-androidarm/#sthash.P013X45P.dpbs
OfficeDissector: parser library for static security analysis of Office
https://github.com/grierforensics/officedissector
https://github.com/grierforensics/officedissector
CYBERSECURITY MARKET REPORT
http://www.valleytalk.org/2015/05/05/cybersecurity-market-report/
http://www.valleytalk.org/2015/05/05/cybersecurity-market-report/
malice:VirusTotal Wanna Be
https://github.com/blacktop/malice
https://github.com/blacktop/malice
dumplib:Windows Kernel Dump Analyzer
https://github.com/nforest/dumplib
https://github.com/nforest/dumplib
Windows Kernel Exploitation Humla Mumbai
http://null.co.in/2015/05/07/windows-kernel-exploitation-hacksys-extreme-vulnerable-driver/
http://null.co.in/2015/05/07/windows-kernel-exploitation-hacksys-extreme-vulnerable-driver/
IE安全系列：脚本先锋（II）
http://drops.wooyun.org/tips/5765
http://drops.wooyun.org/tips/5765
-----微信ID：SecWiki-----
SecWiki，12年来一直专注安全技术资讯分析！
SecWiki：https://www.sec-wiki.com本期原文地址: SecWiki周刊(第62期)
