Cybersecurity Flow

Powershell后漏洞利用脚本

Article Link: https://isc.sans.edu/diary/rss/29398
1 post - 1 participant
Read full topic

身份证图片生成工具-仅供学习交流。已打包Maocs app和Windows exe，可直接下载使用

最近看了一下x86matthew关于hook方法的一篇文章，相对于传统的一些hook方式，个人认为StealthHook的最大优点并不在于不修改内存保护，而是其隐蔽性，这种hook方式是难以检测的，因为其没有直接作用于目标函数。

Repository for all my dotfile configurations

Kubernetes Goat is a "Vulnerable by Design" cluster environment to learn and practice Kubernetes security using an interactive hands-on playground 🚀

Nimbo-C2 is yet another (simple and lightweight) C2 framework

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a document that has more then 1 `childNode`.
[GitHub]This repository contains a collection of data files on known Common Vulnerabilities and Exposures (CVEs). Each file is in JSON format and contains detailed information about

The data breach suffered by LastPass in August 2022 may have been more severe than previously thought. In August password management software firm LastPass disclosed a security breach, threat actors had access to portions of the company development environment through a single compromised developer account and stole portions of source code and some proprietary technical information. […]
The post LastPass revealed that encrypted password vaults were stolen appeared first on Security Affairs.
LastPass 在2022年8月遭受的数据破坏可能比之前想象的更为严重。8月份，密码管理软件公司 LastPass 披露了一个安全漏洞，威胁行为者可以通过一个受到攻击的开发者账户访问公司开发环境的某些部分，并窃取部分源代码和一些专有技术信息。[...]
LastPass 的帖子披露，加密密码库被盗首先出现在《安全事务》(Security Affairs)上。

天才黑客 George Hotz 突然从Twitter辞职的消息在圈内引起广泛讨论。

从fofa中搜索RDP，会看到它会解析出RDP的信息。 本文探索如何自己实现一个。 Nmap指纹在 阅读全文>>

把安全贯穿数据治理全过程，构建政府、企业、社会多方协同的治理模式，创新政府治理方式，明确各方主体责任和义务。

作者:Phakpoom Chinprutthiwong,Raj Vardhan,GuangLiang Yang,Guofei Gu 程序:- 漏洞类型:XSS,Service worker based XSS 赏金:-

社区整理的nuclei扫描器fuzz模版

REvil勒索软件的分析报告

沉重悼念！！！
2022年11月30日12时13分，江泽民同志在上海逝世，享年96岁。

为国之安全而奋斗，为信息安全而发声！
沉痛悼念江泽民同志！肩负前辈的使命，我们新青年义不容辞！

The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.
[GitHub]RCE exploit for CVE-2020-11896 (Ripple20 IP-in-IP Heap Overflow Vulnerability) targeting Digi Connect ME 9210
6.0.1.66之前的 Treck TCP/IP 堆栈允许远程代码执行，与 IPv4隧道相关。
针对 Digi Connect ME 9210的 CVE-2020-11896(Ripple20 IP-in-IP 堆溢出漏洞)的 RCE 利用

Article Link: NVIDIA security advisory (AV22-666) - Canadian Centre for Cyber Security
1 post - 1 participant
Read full topic
文章链接: NVIDIA 安全咨询(AV22-666)-加拿大网络安全中心
1名1职参与者
阅读完整主题

timwhitez starred JerryLinLinLin/Huorong-ATP-Rules Nov 29, 2022
JerryLinLinLin/Huorong-ATP-Rules
一款火绒增强HIPS自定义规则
Python
181 Updated Sep 14