每日安全动态推送(09-15)

Tencent Security Xuanwu Lab Daily News

• Pwn2Own Miami 2022: Unified Automation C++ Demo Server DoS:
https://sector7.computest.nl/post/2022-09-unified-automation-opcua-cpp/

   ・ Unified Automation OPC UA C++ Demo Server (CVE-2022-37013) 拒绝服务漏洞分析 – Jett

• Myths About External C2:
https://xret2pwn.github.io/Myths-About-External-C2/

   ・ Cobalt Strike 引入新特性 – External C2，这篇文章介绍如何自己构建一个 External C2 – Jett

• Bypassing IP based brute force protection with IPv6:
https://www.cyberis.com/article/bypassing-ip-based-brute-force-protection-ipv6

   ・ 利用 IPv6 绕过通过封源 IP 实现的爆破防护 – Jett

• +1进阶，护航未来 | KCon 2022 黑客大会部分议题 PPT 公布:
https://paper.seebug.org/1967/

   ・ KCon 2022 黑客大会部分议题 PPT 公布 – Jett

• [PDF] https://www.zx2c4.com/projects/linux-rng-5.17-5.18/inside-linux-kernel-rng-presentation-sept-13-2022.pdf:
https://www.zx2c4.com/projects/linux-rng-5.17-5.18/inside-linux-kernel-rng-presentation-sept-13-2022.pdf

   ・ Linux 内核随机数生成器的实现内幕分析 – Jett

• [Android] Attacking the Android kernel using the Qualcomm TrustZone:
https://tamirzb.com/attacking-android-kernel-using-qualcomm-trustzone

   ・ 利用 Qualcomm TrustZone 通信协议的漏洞攻击 Android 内核 – Jett

• Caching the Un-cacheables – Abusing URL Parser Confusions (Web Cache Poisoning Technique):
https://nokline.github.io/bugbounty/2022/09/02/Glassdoor-Cache-Poisoning.html

   ・ 利用 XSS 漏洞污染 Glassdoor 页面的缓存 – Jett

• 基于图卷积神经网络的 web 登录入口识别方法:
https://paper.seebug.org/1969/

   ・ 基于图卷积神经网络的 web 登录入口识别方法 – lanying37

• [Windows] PoC/CVE-2022-34721 at main · 78ResearchLab/PoC:
https://github.com/78ResearchLab/PoC/tree/main/CVE-2022-34721

   ・ Windows IKE RCE 漏洞的 PoC（CVE-2022-34721） – Jett

• [Tools] GitHub – epi052/feroxfuzz: A structure-aware HTTP fuzzing library:
https://github.com/epi052/feroxfuzz

   ・ FeroxFuzz – 基于 LibAFL 实现的 HTTP Fuzz 库 – Jett

* 查看或搜索历史推送内容请访问：
https://sec.today

* 新浪微博账号： 腾讯玄武实验室
https://weibo.com/xuanwulab

原文始发于微信公众号（腾讯玄武实验室）：每日安全动态推送(09-15)