SecWiki周刊（第77期）
2015/08/17-2015/08/23
安全资讯
[论文]  ACM CCS 2015 Accepted Papers
http://www.sigsac.org/ccs/CCS2015/pro_paper.html
[其它]  New data uncovers the surprising predictability of Android lock patterns
http://arstechnica.com/security/2015/08/new-data-uncovers-the-surprising-predictability-of-android-lock-patterns/
[会议]  DerbyCon 2015 Schedule and Abstract
http://www.derbycon.com/derbycon-2015-schedule-and-abstract/
[其它]  Science Isn’t Broken
http://fivethirtyeight.com/features/science-isnt-broken/
[Web安全]  AVA: A Social Engineering Vulnerability Scanner
https://www.schneier.com/blog/archives/2015/08/ava_a_social_en.html
[恶意分析]  2015年第34周安全通报
http://blog.topsec.com.cn/ad_lab/2015%e5%b9%b4%e7%ac%ac34%e5%91%a8%e5%ae%89%e5%85%a8%e9%80%9a%e6%8a%a5/
[会议]  BlackHat Trainings Experience
http://www.sec-un.org/blackhat-trainings-experience.html
[运维安全]  How to Exploit BitTorrent for Large-Scale DoS Attacks
http://thehackernews.com/2015/08/bittorrent-dos-attack.html
[其它]  Fifteen Famous Bug Bounty Hunters
http://resources.infosecinstitute.com/fifteen-famous-bug-bounty-hunters/
[会议]  BlackHat & Defcon 2015 观感
http://weibo.com/p/1001603876902510403147
[会议]  10+ Years of System Security Circus
http://s3.eurecom.fr/~balzarot/notes/top4/index.html
安全技术
[Web安全]  Discuz!后台秒getshell（第三方安全问题）
http://0day5.com/archives/3339
[Web安全]  Discuz全版本存储型DOM XSS（可打管理员）
http://0day5.com/archives/3323
[Web安全]  PHP 7 ZEND_HASH_IF_FULL_DO_RESIZE Use After Free 漏洞分析
http://blog.knownsec.com/2015/08/php-7-zend_hash_if_full_do_resize-use-after-free-analysis/
[Web安全]  Wordpress4.2.3提权与SQL注入漏洞(CVE-2015-5623)分析
http://security.tencent.com/index.php/blog/msg/93
[运维安全]  Distributed Nmap Port Scanning with a DNmap Megacluster
http://www.tripwire.com/state-of-security/vulnerability-management/distributed-nmap-port-scanning-dnmap-megacluster/
[书籍]  Modern Windows Exploit Development
http://expdev-kiuhnm.rhcloud.com/download-the-book/
[文档]  UCSD Computer Security Course Slide
http://cseweb.ucsd.edu/classes/fa12/cse127-a/syllabus.html
[Web安全]  HackingTeamfulldump (不算完整235g压缩版)
http://pan.baidu.com/s/1kTBzrVp
[Web安全]  Cookies Lack Integrity: Real-World Implications
https://www.usenix.org/system/files/conference/usenixsecurity15/sec15-paper-zheng-updated.pdf
[恶意分析]  Inside Neutrino botnet builder
https://blog.malwarebytes.org/botnets/2015/08/inside-neutrino-botnet-builder/
[恶意分析]  利用机器学习进行恶意代码分类
http://drops.wooyun.org/tips/8151
[Web安全]  NetRipper - Smart traffic sniffing for penetration testers
https://github.com/NytroRST/NetRipper
[恶意分析]  Discuz! X系列远程代码执行漏洞分析
http://www.secpulse.com/archives/35819.html
[Web安全]  WAF绕过(网站安全狗示例)
http://pan.baidu.com/share/link?shareid=4040209898&uk=2517263830
[运维安全]  “企业应急响应和反渗透”之真实案例分析
http://drops.wooyun.org/tips/8130
[无线安全]  Setup Your Own MITM, Packet Sniffing WiFi Access Point
http://blog.hackersonlineclub.com/2015/08/snifflab-setup-your-own-mitm-packet.html
[取证分析]  A light-weight forensic analysis of the AshleyMadison Hack
http://blog.includesecurity.com/2015/08/forensic-analysis-of-the-AshleyMadison-Hack.html
[取证分析]  Extortionists Target Ashley Madison Users
http://krebsonsecurity.com/2015/08/extortionists-target-ashley-madison-users/
[运维安全]  You Dirty RAT: Analyzing an AlienSpy Payload
https://www.proofpoint.com/us/threat-insight/post/You-Dirty-RAT
[移动安全]  Camera 360应用隐私数据泄露的分析
http://drops.wooyun.org/tips/8209
[恶意分析]  New activity of The Blue Termite APT
https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/
[漏洞分析]  iOS:CVE-2015-5774
http://blog.pangu.io/cve-2015-5774/
[漏洞分析]  Exploiting Ammyy Admin – developing an 0day
https://www.scriptjunkie.us/2014/09/exploiting-ammyy-admin-developing-an-0day/
[运维安全]  BlackHat议题分析：浅析BGP劫持利用
http://www.freebuf.com/articles/network/75305.html
[Web安全]  SQL注入速查表（上）
http://drops.wooyun.org/tips/7840
[运维安全]  Deploying, Managing, and Leveraging Honeypots in the Enterprise
https://www.threatstream.com/blog/deploying-managing-and-leveraging-honeypots-in-the-enterprise-using-open-source-tools#When:17:11:00Z
[比赛]  DEFCON 23 CTF 战记
http://blog.ztrix.me/blog/2015/08/16/defcon-23/
[漏洞分析]  BinNavi binary analysis tool open sourced by Google
https://github.com/google/binnavi
[漏洞分析]  UAC Bypass Vulnerability in the Windows Script Host.
http://seclist.us/uac-bypass-vulnerability-in-the-windows-script-host.html
[移动安全]  Snifflab: An environment for testing mobile devices
https://openeffect.ca/snifflab-an-environment-for-testing-mobile-devices/
[Web安全]  Sybase数据库安全
http://drops.wooyun.org/%e8%bf%90%e7%bb%b4%e5%ae%89%e5%85%a8/7962
[其它]  A Neat Stack Corruption, Reverse P/Invoke Structure Packing with Output Param
http://blogs.microsoft.co.il/sasha/2015/08/18/a-neat-stack-corruption/
[会议]  携程安全沙龙现场笔记&PPT
http://www.secpulse.com/archives/35915.html
[Web安全]  Stealth Techniques: Hiding Files in the Registry
http://www.codereversing.com/blog/archives/261
[设备安全]  Analysis of PS4's security and the state of hacking
http://cturt.github.io/ps4.html
[视频]  Chaos Communication Camp 2015
https://media.ccc.de/browse/conferences/camp2015/index.html
-----微信ID：SecWiki-----
SecWiki，12年来一直专注安全技术资讯分析！
SecWiki：https://www.sec-wiki.com

本期原文地址: SecWiki周刊(第77期)