每日攻防资讯简报[Dec.30th]

1.Google VRP：劫持谷歌文档截图

https://blog.geekycat.in/google-vrp-hijacking-your-screenshots/

2.漏洞赏金中发现的HTML注入漏洞

https://medium.com/bugbountywriteup/a-html-injection-worth-600-dollars-5f065be0ab49

1.一种用Golang语言编写的在Windows和Linux服务器上投递XMRig Miner的蠕虫

https://www.intezer.com/blog/research/new-golang-worm-drops-xmrig-miner-on-servers/

2.针对南美用户的Revenge RAT

https://www.uptycs.com/blog/revenge-rat-targeting-users-in-south-america

3.永远不要将勒索软件样本上传到互联网

https://0xc0decafe.com/2020/12/28/never-upload-ransomware-samples-to-the-internet/

4.恶意代码Yara规则收集

https://github.com/StefanKelm/yara-rules

1.从SUNBURST DNS Beacon中提取安全产品

https://www.netresec.com/?page=Blog&month=2020-12&post=Extracting-Security-Products-from-SUNBURST-DNS-Beacons

2.探索Nmap，Part1：自动化诱饵扫描和源欺骗的过程

https://redcodelabs.io/blog/exploring_nmap_1.html

3.使用CIS强化Docker，Part4：Docker Daemon配置文件

https://blog.jtnydv.com/harden-docker-with-cis-p4-docker-daemon-configuration-files/

4.使用QEMU-USER在X86上运行ARM 二进制文件

https://azeria-labs.com/arm-on-x86-qemu-user/

5.Burp Suite for Pentester: Burp Sequencer

https://www.hackingarticles.in/burp-suite-for-pentester-burp-sequencer/

6.介绍如何在Mac系统上利用虚拟化框架来启动小型VM

https://blog.xpnsec.com/bring-your-own-vm-mac-edition/

7.深入研究站点隔离，Part2

https://microsoftedge.github.io/edgevr/posts/deep-dive-into-site-isolation-part-2/