每日安全动态推送(07-01)

Tencent Security Xuanwu Lab Daily News

• GitHub – achuna33/MYExploit: OAExploit一款基于产品的一键扫描工具。:
https://github.com/achuna33/MYExploit

   ・ MYExploit: OAExploit一款基于产品的一键扫描工具。 – lanying37

• eBPF for Security Observability – Speaker Deck:
https://speakerdeck.com/lizrice/ebpf-for-security-observability

   ・ eBPF for Security Observability – Jett

• HDiff: A Semi-automatic Framework for Discovering Semantic Gap Attack in HTTP Implementations | Kaiwen Shen:
https://shenkaiwen.com/publication/2022-hdiff/

   ・ HDiff – 半自动检测 HTTP 请求处理过程中中间服务器处理不一致导致的 Semantic Gap Attack（Paper） – Jett

• XCTF-ACTF 部分区块链题目 – 跳跳糖:
https://tttang.com/archive/1637/

   ・ XCTF-ACTF 部分区块链题目  – lanying37

• The SessionManager IIS backdoor:
https://securelist.com/the-sessionmanager-iis-backdoor/106868/

   ・ 有攻击者利用 ProxyLogon 漏洞在 IIS 中部署 SessionManager 后门模块 – Jett

• 2022 0-day In-the-Wild Exploitation…so far:
https://googleprojectzero.blogspot.com/2022/06/2022-0-day-in-wild-exploitationso-far.html

   ・ 2022 上半年已经发现的野外利用漏洞 – Jett

• [macOS] 2022年开源操作系统训练营:
https://learningos.github.io/rust-based-os-comp2022/

   ・ 2022年开源操作系统训练营 – lanying37

• The Chromium super (inline cache) type confusion | The GitHub Blog:
https://github.blog/2022-06-29-the-chromium-super-inline-cache-type-confusion/

   ・ Chromium V8 Inline cache 类型混淆 RCE 漏洞分析（CVE-2022-1134） – Jett

• Spoofing Call Stacks To Confuse EDRs:
https://labs.withsecure.com/blog/spoofing-call-stacks-to-confuse-edrs/

   ・ 通过伪造调用栈的方式欺骗 EDR 的检测 – Jett

• Golang code review notes:
https://www.elttam.com/blog/golang-codereview/

   ・ Go 语言代码安全审计 – Jett

* 查看或搜索历史推送内容请访问：
https://sec.today

* 新浪微博账号：腾讯玄武实验室
https://weibo.com/xuanwulab

原文始发于微信公众号（腾讯玄武实验室）：每日安全动态推送(07-01)