每日攻防资讯简报[Sept.8th]

1.Word恶意文档分析

https://malwr-analysis.com/2020/09/07/word-document-malware-analysis/

2.法国CERT发布的针对法国公司和管理部门的Emotet攻击警告

https://www.cert.ssi.gouv.fr/alerte/CERTFR-2020-ALE-019/

3.银行木马Cerberus的安全代码审查

https://blog.shiftleft.io/security-code-review-of-a-banking-trojan-cerberus-10df386b9f6b

1.tafferugli：Twitter分析框架，可以过滤、收集和分析tweets

https://github.com/sowdust/tafferugli

2.MEAT：辅助iOS设备取证，从iOS设备上获取各种信息

https://github.com/jfarley248/MEAT

3.从PE文件或内存转储中解析CobaltStrike Beacon的配置文件

https://github.com/Sentinel-One/CobaltStrikeParser/blob/master/parse_beacon_config.py

1.逆向奔驰仪表集群，显示自定义文本

2.3A大作《毁灭战士永恒》的图形系统研究

https://simoncoenen.com/blog/programming/graphics/DoomEternalStudy.html

3.漏洞赏金Tips, Part 6

https://www.infosecmatter.com/bug-bounty-tips-6-sep-07/

4.安全Tips的一些脑图：OAuth, 2FA, iOS漏洞

https://github.com/hackerscrolls/SecurityTips/tree/master/MindMaps

5.TryHackMe：基础渗透测试演练

https://medium.com/bugbountywriteup/tryhackme-basic-pentesting-walkthrough-7817c719fd04

6.理解CSRF漏洞（初学者指南）

https://www.hackingarticles.in/understanding-the-csrf-vulnerability-a-beginners-guide/

7.ARM逆向与漏洞利用

http://highaltitudehacks.com/2020/09/06/arm64-reversing-and-exploitation-part-3-a-simple-rop-chain/

http://highaltitudehacks.com/2020/09/06/arm64-reversing-and-exploitation-part-2-use-after-free/

http://highaltitudehacks.com/2020/09/05/arm64-reversing-and-exploitation-part-1-arm-instruction-set-heap-overflow/

8.Google CTF 2020 teleport Chromium沙箱溢出https://trungnguyen1909.github.io/blog/post/GGCTF20/

9.XSS挑战解决方案：SVG标签滥用

https://insert-script.blogspot.com/2020/09/xss-challenge-solution-svg-use.html

10.The HTTP Series (Part 5): Security

https://dzone.com/articles/the-http-series-part-5-security

11.恶意软件作者使用.NET库创建恶意Excel文档来绕过安全检查

https://gbhackers.com/excel-documents-library/