每日安全动态推送(2-28)

渗透技巧 1年前 (2023) admin
367 0 0
Tencent Security Xuanwu Lab Daily News

• [Tools, Web] Toxssin – Open-source Penetration Testing Tool That Automates Exploiting Cross-Site Scripting (XSS):
https://skynettools.com/toxssin-open-source-penetration-testing-tool-that-automates-exploiting-cross-site-scripting-xss/

   ・ Toxssin:XSS自动化利用工具 – keenan


• CVE-2023-21839:
https://github.com/4ra1n/CVE-2023-21839

   ・ Weblogic CVE-2023-21839 RCE的漏洞利用代码,该漏洞为Weblogic IIOP/T3协议的实现缺陷 – xmzyshypnc


• [Tools] kraken-ng/Kraken: Kraken, a modular multi-language webshell coded by @secu_x11:
https://github.com/kraken-ng/Kraken

   ・ 模块化的、支持多语言的webshell – WireFish


• [Fuzzing] libafl-wasm:
https://github.com/AFLplusplus/LibAFL/tree/main/fuzzers/baby_fuzzer_wasm#libafl-wasm

   ・ 将libafl harness编译为wasm来进行fuzz。 – Atum


• ProxmoxVE 下的 Windows 内核调试环境配置:
https://paper.seebug.org/2052/

   ・ ProxmoxVE 下的 Windows 内核调试环境配置 – lanying37


• [Android, Reverse Engineering] apk.sh: makes reverse engineering Android apps easier:
https://securityonline.info/apk-sh-makes-reverse-engineering-android-apps-easier/

   ・ 安卓APP逆向工程实用脚本 – WireFish


• [Firmware] GitHub – realoriginal/bootlicker: A generic UEFI bootkit used to achieve initial usermode execution. It works with modifications.:
https://github.com/realoriginal/bootlicker

   ・ 通用UEFI bootkit,可实现用户态代码执行 – WireFish


• [Vulnerability] Unauthenticated RCE in Goanywhere – vsociety:
https://www.vicarius.io/vsociety/blog/unauthenticated-rce-in-goanywhere

   ・ Goanaywhere存在因反序列化导致的RCE漏洞。 – Atum


• Apple Privilege Escalation Bug Let Attacker Execute Arbitrary Code:
https://gbhackers.com/apple-privilege-escalation/

   ・ 缓解措施NSPredicateVisitor可被绕过,允许攻击者执行任意代码。 – keenan


• oledump & MSI Files:
https://i5c.us/d29584

   ・ 使用oledump分析MSI文件。 – Atum


• [Malware] A tale of Phobos – how we almost cracked a ransomware using CUDA : ReverseEngineering:
https://www.reddit.com/r/ReverseEngineering/comments/11axztr/a_tale_of_phobos_how_we_almost_cracked_a/

   ・ 如何利用Phobos 勒索软件特定版本的问题对密钥生成可能性进行剪枝,从而在理论上实现对该勒索软件的暴力破解。 – P4nda


* 查看或搜索历史推送内容请访问:
https://sec.today

* 新浪微博账号:腾讯玄武实验室
https://weibo.com/xuanwulab


原文始发于微信公众号(腾讯玄武实验室):每日安全动态推送(2-28)

版权声明:admin 发表于 2023年2月28日 上午10:44。
转载请注明:每日安全动态推送(2-28) | CTF导航

相关文章

暂无评论

您必须登录才能参与评论!
立即登录
暂无评论...