Cloud Security

Internal email address leakage of Shenzhen Design co-channel Company (with a clear view of sensitive information) Internal email address leakage of Shenzhen Design co-channel Company (with a clear view of sensitive information)Detailed description:  

Troubleshoot a Linux trojan virus intrusion (DbSecuritySpt) A newly started company suddenly threw a development and testing machine directly to the public network. The output traffic increased by more than 300 M, which directly led to high server

Credential stuffing caused by an improper design of an osscmd Interface Credential stuffing caused by an improper design of an osscmd InterfaceDetailed description: Http://www.aoshitang.com/login.actionthe local code was not verified at the

After 28 rounds of the Return key: a Linux vulnerability can cause a "one-click" intrusion on the machine. Some people say that the definition of 'madge' is to repeatedly repeat something, but expect a different result. However, it turns out that

Comprehensive Analysis of Redis events 0 × 00 Preface Unauthorized access to redis has not been paid much attention to until November 4. This blog was published: redis can control the server by writing an SSH Key, and security personnel began to pay

Analysis of Internal attack detection methods based on user file objects Preface A few days ago, I saw an article on FB about the application of machine learning in the security field, "is machine learning ready for the security industry?". It seems

Google Chrome FontData: Bound Function Integer Overflow Vulnerability (CVE-2015-6781)Google Chrome FontData: Bound Function Integer Overflow Vulnerability (CVE-2015-6781) Release date:Updated on:Affected Systems: Google Chrome Description:

Android Wi-Fi information leakage Vulnerability (CVE-2015-6629)Android Wi-Fi information leakage Vulnerability (CVE-2015-6629) Release date:Updated on:Affected Systems: Android Description: CVE (CAN) ID: CVE-2015-6629Android is a mobile phone

Adobe Reader dc agm remote code execution vulnerability in CVE-2015-8458)Adobe Reader dc agm remote code execution vulnerability in CVE-2015-8458) Release date:Updated on:Affected Systems: Adobe Reader DC Description: CVE (CAN) ID: CVE-2015-845

Jenkins deserialization Remote Code Execution Vulnerability (CVE-2015-8103)Jenkins deserialization Remote Code Execution Vulnerability (CVE-2015-8103) Release date:Updated on:Affected Systems: Jenkins jenkins 〈= LTS 1.625.1Jenkins jenkins 〈=

Huawei eSpace U2980/2990 Denial of Service Vulnerability (CVE-2015-8229)Huawei eSpace U2980/2990 Denial of Service Vulnerability (CVE-2015-8229) Release date:Updated on:Affected Systems: Huawei eSpace U2990Huawei eSpace U2980 Description: CVE (

Nordex NC2 XSS (CVE-2015-6477)Nordex NC2 XSS (CVE-2015-6477) Release date:Updated on:Affected Systems: Nordex NC2 Description: CVE (CAN) ID: CVE-2015-6477Nordex Control 2 is a Web-based SCADA System for wind power stations.Nordex Control 2

Qolsys IQ Panel hardcoded Key Vulnerability (CVE-2015-6032)Qolsys IQ Panel hardcoded Key Vulnerability (CVE-2015-6032) Release date:Updated on:Affected Systems: Qolsys IQ Panel Description: CVE (CAN) ID: CVE-2015-6032Qolsys IQ Panel is an

ARPspoof source code can be viewed in an easy way. PrefaceIf your target is a hacker who will use the tool, ignore all of the following content. If your goal is to have your own penetration testing tool and write your own xxxtools, the source code

Tracking from helldog: in-depth analysis of Labrador Virus Recently, the security dog Hellhound analysis system obtained a very large virus sample Labrade (Hellhound-20157516 ). The virus can infect a large number of exe programs, so that the PE

Payload instance analysis: Encrypted malicious documents The malicious office document we analyzed today is a download tool: 2ELJ2E1OPJ0OT.doc The oledump result shows that the malicious document contains a VBA macro, but the plug-in cannot extract

Binary files protected by virtual machines in reverse order 0x00 Introduction In code obfuscation, virtual machines are used to run different machine instruction sets on a program. For example, a virtual machine can run the ARM Instruction Set on a

Use multipart/form-data to bypass waf The LuManager high-risk SQL injection 0-day analysis mentions the use of payload as follows: Attackers can see that the multipart/form-data format is used to send payload. For applications, the data obtained

Use location to deform our XSS Payload This article is a gesture I learned from a group some time ago. I will share it with you ~ In XSS, sometimes some filters are abnormal and filter many special symbols and keywords, such as &, (,), #, ', and ",

How CSRF generates tokens to prevent attacks In the past, we talked about CSRF and the principle of CSRF attacks. This article describes how to prevent CSRF and the encryption principles and implementation examples behind Token Generation. 1. Token