每日攻防资讯简报[Mar.12th]

1.Regexploit：分析正则表达式并寻找ReDoS漏洞

https://github.com/doyensec/regexploit

https://blog.doyensec.com/2021/03/11/regexploit.html

2.ronin：用于漏洞研究和Exploit开发的平台

https://github.com/ronin-rb/ronin

1.深入解析Win10中引入的沙箱技术

https://research.checkpoint.com/2021/playing-in-the-windows-sandbox/

2.对无线路由器使用白盒和黑盒技术挖洞，效果相近

https://www.zerodayinitiative.com/blog/2021/3/11/the-battle-between-white-box-and-black-box-bug-hunting-in-wireless-routers

3.预防CSRF攻击：示例和缓解措施

https://goteleport.com/blog/csrf-attacks

4.使用Burp Suite执行API扫描

https://portswigger.net/blog/api-scanning-with-burp-suite

5.用于Cobalt Strike的简单DNS重定向器

https://blog.cobaltstrike.com/2021/03/11/simple-dns-redirectors-for-cobalt-strike/

6.依赖混淆攻击：讨论一些利用软件包管理器有趣行为的技术以及诸如Typosquatting之类的一般问题

https://redhuntlabs.com/blog/dependency-confusion-attack-what-why-and-how.html