每日攻防资讯简报[Mar.3th]

1.通过Windows Callback执行Shellcode

https://github.com/S4R1N/AlternativeShellcodeExec

2.Stargather：Github标星者追踪工具

https://github.com/dwisiswant0/stargather

3.OWT：用于WiFi攻击的bash脚本

https://github.com/clu3bot/OWT

4.fake-sms：简单的命令行工具，使用充当代理的临时电话号码来跳过基于电话号码的SMS验证

https://github.com/Narasimha1997/fake-sms

5.ASST：Web安全扫描器

https://github.com/OWASP/ASST

1.FlawedGrace样本详尽分析后的IDB

https://www.msreverseengineering.com/blog/2021/3/2/an-exhaustively-analyzed-idb-for-flawedgrace

2.使用Ghidra反编译游戏超级猴子

https://www.smokingonabike.com/2021/02/28/hacking-super-monkey-ball-part-2-decompilation-with-ghidra/

3.使用Panda记录和重放整个系统仿真，进行可重复式逆向

4.特权升级简介，以及滥用elevation control机制的基本示例

https://sysdig.com/blog/mitre-privilege-escalation-falco/

5.缓解JSON互操作性漏洞的最佳实践

https://medium.com/swlh/best-practices-to-mitigate-json-interoperability-vulnerabilities-45dac573b625

6.CertWatcher：使用Apps脚本自动化证书透明性OSINT

https://medium.com/maverislabs/tool-osint-certwatcher-in-apps-script-aa0ded3dc423

https://github.com/ruddawg26/CertWatcher

7.在Windows Mini-Filter驱动中挖掘漏洞

https://googleprojectzero.blogspot.com/2021/01/hunting-for-bugs-in-windows-mini-filter.html

8.内核内存泄露与CANVAS，Part 1 - Spectre: tips & tricks

https://www.immunityinc.com/downloads/Kernel-Memory-Disclosure-and-Canvas_Part_1.pdf

9.HTB: Sneaky

https://0xdf.gitlab.io/2021/03/02/htb-sneaky.html