每日攻防资讯简报[Sept.28th]

1.Android平台最著名的恶意软件之一Jocker与谷歌商店的猫鼠游戏

https://www.zscaler.com/blogs/security-research/joker-playing-hide-and-seek-google-play

2.2020年上半年工业自动化系统的威胁态势报告

https://ics-cert.kaspersky.com/reports/2020/09/24/threat-landscape-for-industrial-automation-systems-h1-2020/

1.Eagle：基于插件的漏洞扫描程序，支持多线程，可用于大规模检测低挂起（low-hanging）的漏洞

https://github.com/BitTheByte/Eagle

2.wacker：一组脚本，可辅助对WPA3接入点执行在线词典攻击

https://github.com/blunderbuss-wctf/wacker

3.UrbanBishopLocal：C#代码，用于内联Shellcode执行

https://github.com/slyd0g/UrbanBishopLocal

4.Fork-n-Run：对Fork&Run操作进行可重用组件的实验

https://github.com/rasta-mouse/Fork-n-Run

5.hetty：用于安全研究的HTTP工具包，目标是成为Burp的替代者

https://github.com/dstotijn/hetty

6.yaya：自动管理开源yara规则并运行扫描

https://github.com/EFForg/yaya

1.ARM64上的Swift调用约定：Float/Double

https://vivekseth.com/swift-arm64-float-double/

2.在渗透测试期间可能会遇到的RMI接口：结构、侦察和通信

https://medium.com/@afinepl/java-rmi-for-pentesters-structure-recon-and-communication-non-jmx-registries-a10d5c996a79

3.漏洞赏金技巧，Part7

https://www.infosecmatter.com/bug-bounty-tips-7-sep-27/

4.一键式Meterpreter利用链与BeEF和AV/AMSI绕过

https://medium.com/@bluedenkare/1-click-meterpreter-exploit-chain-with-beef-and-av-amsi-bypass-96b0eb61f1b6

5.可用于执行kerberos攻击的命令备忘单

https://gist.github.com/TarlogicSecurity/2f221924fef8c14a1d8e29f3cb5c5c4a

6.Hacking the Medium partner program

https://medium.com/bugbountywriteup/hacking-the-medium-partner-program-84c0e9fa340

7.揭秘SVCHOST.EXE进程极其命令行参数

https://medium.com/@nasbench/demystifying-the-svchost-exe-process-and-its-command-line-options-508e9114e747

8.针对初学者的网络缓存欺骗教程

9.使用Linux内核模块进行试验，以尝试并了解有关内核如何工作的更多信息

https://github.com/xcellerator/linux_kernel_hacking

10.HTML转PDF功能中的SSRF漏洞

https://github.com/incredibleindishell/SSRF_Vulnerable_Lab/tree/master/pdf_generator

11.解码不完整的Base64字符串

https://isc.sans.edu/forums/diary/Decoding+Corrupt+BASE64+Strings/26606/

12.2020年面向安全专业人员的8大最佳Web安全和黑客软件

https://gbhackers.com/best-hacking-software/