Cloud Security

Measure the test taker's knowledge about DOS Vulnerabilities in the Android system.0x00 Preface There are some vulnerabilities in the Android system that can cause the system to restart. Of course, restarting the system is only a phenomenon. Some

The essence of Security Vulnerabilities0x00 Preface Fuzzing is a popular and efficient method for discovering vulnerabilities. Of course, it also takes some time to write the Fuzzing program. However, not all things need to write Fuzzing programs,

Study on unauthorized MySQL reading During the penetration test, you may encounter many times of MySQL environment. Once you get the root account of MySQL and it is a Windows system, you can use UDF or MOF to raise the permission to get the system

Wargama-leviathan WriteupLevel 0 This is a simple introduction to the game. Of course, there is also a clear account and password. Open the web page and you will see it again.Level 0-> 1 Use the account and password obtained from the previous

O & M shell commands 1. display the 10 processes that consume the most memory/CPU Ps aux | sort-nk + 4 | tail-10Ps aux | sort-nk + 3 | tail-10 2. view the number of concurrent Apache requests and their TCP connection status netstat -n | awk

Decrypt 10 million passwords: view human nature through passwords (1) We already know a lot about the password. For example, most passwords are short, simple, and easy to crack. However, we know little about the psychological reasons for a person

Cheap and insurmountable TCP tunnel Encryption I haven't written anything for a long time, so I plan to write something. I used to perform penetration tests for a customer, so I have been planning to publish some of my findings. On an application

Phpyun v3.2 (20141226) Injection The first newly discovered item is In model/redeem. class. php Function dh_action () {$ this-> public_action (); if (! $ This-> uid &&! $ This-> username) {$ this-> obj-> ACT_layer_msg ("You have not logged on yet.

An SQL blind injection vulnerability exists in a substation of Tianji. SQL blind injection (with verification script) The Tipask Q & A system has 12 injection packages:

Douban mobile csrf replies to any post Csrf can be used for spam comments -- POST/group/topic/72292507/comments HTTP/1.1 Host: m. douban. comUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv: 35.0) Gecko/20100101 Firefox/35.0 Accept: text/html,

Considerations and testing methods for DDOS Security Products in the Internet cloud ecosystem (2)The early DDOS defense of traditional solutions is detected and implemented through firewalls and routers. Such a solution has a certain protective

Database hit attacks due to improper configuration of tiandixing Interface Let's talk about a security logic problem that is not close to this vulnerability. To prevent unauthorized users from having a key, the key and user name will be

YYjia cms front-end filtering is lax, resulting in injection #2 YYjia cms front-end filtering is lax, resulting in injection #2I looked at this file and found that there are still vulnerabilities: Elseif ($ caozuo = "delapp") {$ uploadid = $ _ GET

Research on the New Arbitrary File Read Vulnerability0x00 Preface Boooom has discovered many Arbitrary File Read vulnerabilities on wooyun, which are like Http: // target/.../etc [wooyun]/passwd In this way. At that time, I felt very novel, because

Read.html5.qq.comHttp://read.html5.qq.com/image? ImageUrl = http: // XXX is a service that compresses third-party images for mobile users and uses HAProxy for load balancing.In actual tests, it is found that the page content can be contaminated

Methods to break through the jsp website after encountering a firewall There is a website with an upload point and any suffix. Then I rushed to upload a common jsp without a password. However, when I visited the address, I found that the browser

51 auto network password Modification Vulnerability for any user 51 cars can be scanned in batches on the registration page The following is a scanned number, which is only used for testing.  Retrieve the password on your mobile phone 

The chance of a virtual machine breaking through the physical machine is the dawn of mysql injection failure! The reason is that I tried to enter a second-level website of my high school alma mater. The last thing came to my head. I felt lucky and

Gray-box web Security Detection Technology In traditional application testing methods, gray-box testing is between white-box testing and black-box testing. Gray-box web Security Detection still follows the concept of gray-box testing, but only

YXcms background csrf add administrator + getshell YXcms background csrf add administrator + getshell Without any verification, the PHP file can be created by adding another template function, resulting in getshell 1. Add management in the