Cloud Security

Technology sharing-getting started with WIFI phishingIntroduction This experiment first sets up a test environment, then creates a false Wireless Access Point, connects the network to a false access point, and forces the user to connect to a false

Samba internal DNS server out-of-bounds read Vulnerability (CVE-2016-0771)Samba internal DNS server out-of-bounds read Vulnerability (CVE-2016-0771) Release date:Updated on:Affected Systems: Samba Samba 4.0.0 － 4.4.0rc3 Description: CVE (CAN) ID:

OpenSSL Bleichenbacher oracle Vulnerability (CVE-2016-0704)OpenSSL Bleichenbacher Oracle Vulnerability (CVE-2016-0704) Release date:Updated on:Affected Systems: OpenSSL Project OpenSSL 〈＝1.0.0qOpenSSL Project OpenSSL 〈＝ 1.0.1lOpenSSL Project OpenSSL

Webshell's key_access to a locally encrypted webshell in a browser By chance, an encrypted webshell is found, which is encrypted by PHP shield Var 1.54. The notepad was opened with a bunch of garbled characters, and Baidu had a hero.The method is to

Technology sharing: how to embed an EXE file in a PowerShell script I am trying to solve a problem, that is, only PowerShell scripts are used as the attack load in client attacks. Using PowerShell to run malicious code has many advantages, including:

Analysis of Cross-Site Request Forgery (CSRF) attack principles: beyond imagination Cross-Site Request Forgery (XSS) is perhaps the most incomprehensible attack method, but the danger is also underestimated. In the "Open Web Application Security

Analysis on arbitrary JS code execution beyond the XSS character limit I. Summary Some XSS vulnerabilities cannot be effectively exploited due to a limited number of characters. Only one dialog box can be displayed for YY. This article mainly

Analysis of the implementation and Prediction Techniques of the rand function in the glibc Library Thanks to 0CTF, I held a very deep CTF competition at Jiaotong University.This competition has a web question. The question is very simple and is

Can I use a train ticket to restore my ID card number? Today, we will show you how to use a train ticket to restore the complete ID card number. As we all know, a train ticket can have an incomplete name and ID card number. The four digits in the ID

Suspected that the mobile phone assistant of Qihoo 360 has a low-risk Elasticsearch information leakage (any operation or SQL Execution is allowed) Rt   Mask Region 1. http ://**. **. **/_ searchpreety _ **************** c62633ba46b55a24e8

If the account system of a system in AVIC certificate is inappropriate, you can access the Intranet (you need to change the password) If the account system of a system in AVIC certificate is inappropriate, you can access the Intranet (OA

The Youku shared iframe player page has the dom xss vulnerability to obtain user cookies (vulnerability analysis process included) Xss vulnerability exists on the Youku shared iframe player page. You can exploit this vulnerability to obtain user

Information on the platform interface of the Didi driver client is leaked (the information is stored in the ShareSDK. xml file) Didi driver information leakage Information of Android mobile client of Didi driver is leaked, which exposes interface

Authentication mechanism must be added for full-site source code leakage in the Shui Mu community (indirect secondary code audit is allowed) Full-site source code leakage in the Shui Mu community (indirect secondary code audit can expand the

Bilibili any user name can be registered repeatedly \ has already registered webmaster bishi as the user name (this vulnerability can cause B station registration system Denial of Service) For example, this problem was not found at the first

Multiple TCL system commands have the executable Vulnerability (involving 6 management platforms, management systems, and multiple database account passwords) Multiple TCL System Command Execution Vulnerabilities (two Windows servers have won \ 6

A detailed analysis of Xtep security detection report (involving multiple backbone systems and numerous internal information data) A detailed analysis of Xtep security detection report (involving multiple backbone systems/involving a large amount of

Command Execution at a site of Guodian South Swiss jiehong can scan the Intranet (involving a large number of staff information reports/can scan Intranet hosts)   Http: // 211.160.21.126: 7002/EICS/jsp/login. jsp Command Execution exists,A large

Wei Feng ios app has SQL injection (SQL map-based full POST Base64 encoding instance) Objective: To detect SQL injection in the following areas:POST http://push.feng.com/index.php? R = api/client/startergonomic all HTTP/1.1Host: push.feng.comContent-

Intrusion into connected trucks and buses Shodan is an extremely powerful search engine. Unlike Google, Shodan does not search Web sites on the Internet, but directly enters the channel behind the internet. It keeps searching for all servers,