From 865c477066102b64a25764cc04fdaec55009ed48 Mon Sep 17 00:00:00 2001 From: MasonLiu <2857911564@qq.com> Date: Mon, 6 Jan 2025 17:06:15 +0800 Subject: [PATCH] update --- Core.py | 3 +- config/check_config.py | 6 +- config/config.yaml | 8 +- log/core.log | 4 - resources/JSON/anquanke.json | 176 +++---- resources/JSON/doonsec.json | 784 +++++++++++++++--------------- resources/JSON/freebuf.json | 122 ++--- resources/JSON/qianxin.json | 28 +- resources/JSON/seebug.json | 122 +++++ resources/db/4hou.db | Bin 319488 -> 319488 bytes resources/db/anquanke.db | Bin 12288 -> 12288 bytes resources/db/doonsec.db | Bin 69632 -> 81920 bytes resources/db/freebuf.db | Bin 20480 -> 20480 bytes resources/db/github.db | Bin 94208 -> 0 bytes resources/db/qianxin.db | Bin 12288 -> 12288 bytes resources/db/seebug.db | Bin 12288 -> 24576 bytes resources/db/xianzhi.db | Bin 24576 -> 24576 bytes resources/history/sec_news.md | 182 +++++++ resources/history/tech_passage.md | 306 ++++++++++++ resources/log/core.log | 184 +------ 20 files changed, 1195 insertions(+), 730 deletions(-) delete mode 100644 log/core.log create mode 100644 resources/JSON/seebug.json delete mode 100644 resources/db/github.db diff --git a/Core.py b/Core.py index c236fc2..2262828 100644 --- a/Core.py +++ b/Core.py @@ -102,7 +102,7 @@ def send_job_RSS(time_1): result_4hou_long = Src_4hou(time_1, False) result_anquanke_long = Src_anquanke(time_1, False) result_doonsec_long = Src_doonsec(False, Doonsec_switch, Doonsec) - print(result_doonsec_long) + # print(result_doonsec_long) result_xianzhi_long = Src_xianzhi(time_1, False) result_freebuf_long = Src_freebuf(time_1, False) result_qianxin_long = Src_qianxin(time_1, False) @@ -190,6 +190,7 @@ def main_job(e_hour): send_job_SX() if 2 in choice: send_job_github(e_hour) + logger.info("单次运行结束，等待下一次运行...") def main_loop(time_choice): if time_choice == 1: diff --git a/config/check_config.py b/config/check_config.py index f87db8b..5d51999 100644 --- a/config/check_config.py +++ b/config/check_config.py @@ -4,7 +4,7 @@ from loguru import logger # 清除所有已有的日志记录器配置 logger.remove() -logger.add("./log/core.log", +logger.add("./resources/log/core.log", format="{time:YYYY-MM-DD HH:mm:ss} - {level} - {name}:{function}:{line} - {message}", rotation="100 MB", compression="zip", @@ -17,8 +17,8 @@ def get_core_config(): # 加载参数 with open('./config/config.yaml', 'r', encoding="utf-8") as file: config = yaml.safe_load(file) - debug = f"{config['debug']}" - if debug == "True": + debug = config.get('debug', 'False') # 使用 get 方法提供默认值 + if str(debug).lower() == "true": # 统一转换为小写进行比较 logger.debug("Debug mode is on") logger.debug(f"Loaded config: {config}") # 输出加载的配置 diff --git a/config/config.yaml b/config/config.yaml index 69af1b5..0baa056 100644 --- a/config/config.yaml +++ b/config/config.yaml @@ -1,10 +1,8 @@ # 飞书相关配置信息 # fs_activate: True -# fs_key: aa04a02f-d7bf-4279-bd48-44c4f28c8f74 # 此处填写token，记得冒号后空一格，如aa04a02f-d7bf-4279-bd48-44c4f28c8f74 -# fs_secret: 4tq65T4jm1MO2IlxvHxBWe # 此处填写签名密钥，记得冒号后空一格，如4tq65T4jm1MO2IlxvHxBWe fs_activate: True -fs_key: 202d7e51-9a46-422e-a035-863bc42bc459 # 此处填写token，记得冒号后空一格，如aa04a02f-d7bf-4279-bd48-44c4f28c8f74 -fs_secret: eZaSCl5DSqtJyZ8QpJBDFh # 此处填写签名密钥，记得冒号后空一格，如4tq65T4jm1MO2IlxvHxBWe +fs_key: aa04a02f-d7bf-4279-bd48-44c4f28c8f74 # 此处填写token，记得冒号后空一格，如aa04a02f-d7bf-4279-bd48-44c4f28c8f74 +fs_secret: 4tq65T4jm1MO2IlxvHxBWe # 此处填写签名密钥，记得冒号后空一格，如4tq65T4jm1MO2IlxvHxBWe # 企业微信相关配置信息 wx_activate: False @@ -26,7 +24,7 @@ sender: test@masonliu.com receivers: ['2857911564@qq.com'] # 结算时间范围 e_hour: 4 # 程序运行时间间隔 -time_mode: 1 +time_mode: 0 # 0：定时运行模式，仅在指定时间运行（参照Core.py中设置） # 1：启用循环，一定间隔时间后运行 mode: [0] # 运行模式，可多选 diff --git a/log/core.log b/log/core.log deleted file mode 100644 index 168bdc1..0000000 --- a/log/core.log +++ /dev/null @@ -1,4 +0,0 @@ -2025-01-06 00:28:38 - DEBUG - config.check_config:get_core_config:20 - Loaded config: {'fs_activate': True, 'fs_key': '202d7e51-9a46-422e-a035-863bc42bc459', 'fs_secret': 'eZaSCl5DSqtJyZ8QpJBDFh', 'wx_activate': False, 'wx_key': None, 'ding_activate': False, 'ding_key': None, 'lx_activate': False, 'lx_key': None, 'mail_host': 'smtp.masonliu.com', 'mail_user': 'test@masonliu.com', 'mail_pass': 'Test123456', 'sender': 'test@masonliu.com', 'receivers': ['2857911564@qq.com'], 'e_hour': 4, 'time_mode': 1, 'mode': [0], 'url': 'https://info.masonliu.com/', 'debug': True} -2025-01-06 00:29:41 - DEBUG - config.check_config:get_core_config:20 - Loaded config: {'fs_activate': True, 'fs_key': '202d7e51-9a46-422e-a035-863bc42bc459', 'fs_secret': 'eZaSCl5DSqtJyZ8QpJBDFh', 'wx_activate': False, 'wx_key': None, 'ding_activate': False, 'ding_key': None, 'lx_activate': False, 'lx_key': None, 'mail_host': 'smtp.masonliu.com', 'mail_user': 'test@masonliu.com', 'mail_pass': 'Test123456', 'sender': 'test@masonliu.com', 'receivers': ['2857911564@qq.com'], 'e_hour': 4, 'time_mode': 1, 'mode': [0], 'url': 'https://info.masonliu.com/', 'debug': True} -2025-01-06 00:33:10 - DEBUG - config.check_config:get_core_config:20 - Loaded config: {'fs_activate': True, 'fs_key': '202d7e51-9a46-422e-a035-863bc42bc459', 'fs_secret': 'eZaSCl5DSqtJyZ8QpJBDFh', 'wx_activate': False, 'wx_key': None, 'ding_activate': False, 'ding_key': None, 'lx_activate': False, 'lx_key': None, 'mail_host': 'smtp.masonliu.com', 'mail_user': 'test@masonliu.com', 'mail_pass': 'Test123456', 'sender': 'test@masonliu.com', 'receivers': ['2857911564@qq.com'], 'e_hour': 4, 'time_mode': 1, 'mode': [0], 'url': 'https://info.masonliu.com/', 'debug': True} -2025-01-06 00:33:15 - DEBUG - config.check_config:get_core_config:20 - Loaded config: {'fs_activate': True, 'fs_key': '202d7e51-9a46-422e-a035-863bc42bc459', 'fs_secret': 'eZaSCl5DSqtJyZ8QpJBDFh', 'wx_activate': False, 'wx_key': None, 'ding_activate': False, 'ding_key': None, 'lx_activate': False, 'lx_key': None, 'mail_host': 'smtp.masonliu.com', 'mail_user': 'test@masonliu.com', 'mail_pass': 'Test123456', 'sender': 'test@masonliu.com', 'receivers': ['2857911564@qq.com'], 'e_hour': 4, 'time_mode': 1, 'mode': [0], 'url': 'https://info.masonliu.com/', 'debug': True} diff --git a/resources/JSON/anquanke.json b/resources/JSON/anquanke.json index 740537e..f08deb8 100644 --- a/resources/JSON/anquanke.json +++ b/resources/JSON/anquanke.json @@ -1,4 +1,92 @@ [ + { + "guid": "https://www.anquanke.com/post/id/303291", + "title": "2024年度十大网络安全热点事件盘点：时代暗涌下的安全危机", + "author": " 安全客", + "description": null, + "source": "微信", + "pubDate": "2025-01-06 11:00:15" + }, + { + "guid": "https://www.anquanke.com/post/id/303282", + "title": "关键截止日期： 在 2025 年 1 月 7 日之前更新旧 .NET 域名以避免服务中断", + "author": " 安全客", + "description": null, + "source": "TheHackersNews", + "pubDate": "2025-01-06 10:52:56" + }, + { + "guid": "https://www.anquanke.com/post/id/303279", + "title": "项目隔离： PyPI 抵御恶意软件的新防线", + "author": " 安全客", + "description": null, + "source": "securityonline", + "pubDate": "2025-01-06 10:48:40" + }, + { + "guid": "https://www.anquanke.com/post/id/303275", + "title": "CVE-2024-12912 & CVE-2024-13062： 华硕路由器面临风险", + "author": " 安全客", + "description": null, + "source": "securityonline", + "pubDate": "2025-01-06 10:37:22" + }, + { + "guid": "https://www.anquanke.com/post/id/303270", + "title": "35+ 款 Chrome 浏览器扩展程序遭入侵：250 万用户面临风险", + "author": " 安全客", + "description": null, + "source": "securityonline", + "pubDate": "2025-01-06 10:21:36" + }, + { + "guid": "https://www.anquanke.com/post/id/303267", + "title": "通过恶意 npm 软件包对以太坊开发人员进行供应链攻击", + "author": " 安全客", + "description": null, + "source": "securityonline", + "pubDate": "2025-01-06 10:11:35" + }, + { + "guid": "https://www.anquanke.com/post/id/303288", + "title": "每分钟就有 4,080 份记录在数据泄露事件中受损", + "author": " 安全客", + "description": null, + "source": "helpnetsecurity", + "pubDate": "2025-01-06 10:09:03" + }, + { + "guid": "https://www.anquanke.com/post/id/303264", + "title": "SysBumps：在 macOS 上打破 Apple Silicon 的内核地址空间布局随机化", + "author": " 安全客", + "description": null, + "source": "securityonline", + "pubDate": "2025-01-06 10:02:40" + }, + { + "guid": "https://www.anquanke.com/post/id/303285", + "title": "现代 CISO 是组织成功的基石", + "author": " 安全客", + "description": null, + "source": "helpnetsecurity", + "pubDate": "2025-01-06 10:01:09" + }, + { + "guid": "https://www.anquanke.com/post/id/303259", + "title": "CVE-2025-22275 (CVSS 9.3)：iTerm2 修补了暴露用户输入和输出的重大安全漏洞", + "author": " 安全客", + "description": null, + "source": "securityonline", + "pubDate": "2025-01-06 09:55:57" + }, + { + "guid": "https://www.anquanke.com/post/id/303256", + "title": "黑客针对Google Chrome的数十个VPN和AI扩展以泄露数据", + "author": " 安全客", + "description": null, + "source": "therecord", + "pubDate": "2025-01-06 09:51:53" + }, { "guid": "https://www.anquanke.com/post/id/303249", "title": "2025年数字安全十大趋势预测：挑战、机遇、变革与战略布局", @@ -70,93 +158,5 @@ "description": null, "source": "hackread", "pubDate": "2025-01-03 10:12:25" - }, - { - "guid": "https://www.anquanke.com/post/id/303221", - "title": "官员警告：黑客泄露了罗德岛州勒索软件攻击的数据", - "author": " 安全客", - "description": null, - "source": "cybersecuritydive", - "pubDate": "2025-01-03 10:04:05" - }, - { - "guid": "https://www.anquanke.com/post/id/303208", - "title": "2024年度盘点之漏洞威胁：AI技术降低漏洞利用门槛，网络边缘设备成重灾区", - "author": " 安全客", - "description": null, - "source": "微信", - "pubDate": "2025-01-02 16:51:55" - }, - { - "guid": "https://www.anquanke.com/post/id/303205", - "title": "66,000 台 DrayTek 网关存在远程命令注入漏洞 (CVE-2024-12987)，已发布 PoC", - "author": " 安全客", - "description": null, - "source": "securityonline", - "pubDate": "2025-01-02 16:41:12" - }, - { - "guid": "https://www.anquanke.com/post/id/303202", - "title": "D-Link 就易受僵尸网络攻击的报废路由器发出警告", - "author": " 安全客", - "description": null, - "source": "securityonline", - "pubDate": "2025-01-02 16:35:11" - }, - { - "guid": "https://www.anquanke.com/post/id/303199", - "title": "CVE-2024-12108 (CVSS 9.6) 及更高版本： Progress 为 WhatsUp Gold 网络监控软件发布关键补丁程序", - "author": " 安全客", - "description": null, - "source": "securityonline", - "pubDate": "2025-01-02 16:27:46" - }, - { - "guid": "https://www.anquanke.com/post/id/303196", - "title": "针对 Windows 零点击漏洞 CVE-2024-49112 发布 PoC 漏洞利用程序", - "author": " 安全客", - "description": null, - "source": "securityonline", - "pubDate": "2025-01-02 16:20:29" - }, - { - "guid": "https://www.anquanke.com/post/id/303193", - "title": "拟议更新HIPAA安全规则授权，以在72小时内恢复某些相关电子信息系统和数据的丢失", - "author": " 安全客", - "description": null, - "source": "securityaffairs", - "pubDate": "2025-01-02 15:15:33" - }, - { - "guid": "https://www.anquanke.com/post/id/303187", - "title": "新的 “双重点击劫持 ”漏洞绕过了主要网站的点击劫持保护措施", - "author": " 安全客", - "description": null, - "source": "TheHackersNews", - "pubDate": "2025-01-02 14:53:40" - }, - { - "guid": "https://www.anquanke.com/post/id/303182", - "title": "新的 IOCONTROL 恶意软件用于关键基础设施攻击", - "author": " 安全客", - "description": null, - "source": "嘶吼", - "pubDate": "2025-01-02 14:44:44" - }, - { - "guid": "https://www.anquanke.com/post/id/303179", - "title": "2025 年医疗保健网络监管和立法前景如何？", - "author": " 安全客", - "description": null, - "source": "govinfosecurity", - "pubDate": "2025-01-02 14:27:41" - }, - { - "guid": "https://www.anquanke.com/post/id/303176", - "title": "FortiGuard Labs 将新的 EC2 Grouper 黑客与 AWS 凭证漏洞联系起来", - "author": " 安全客", - "description": null, - "source": "hackread", - "pubDate": "2025-01-02 14:19:55" } ] \ No newline at end of file diff --git a/resources/JSON/doonsec.json b/resources/JSON/doonsec.json index 948f132..ead98d0 100644 --- a/resources/JSON/doonsec.json +++ b/resources/JSON/doonsec.json @@ -1,4 +1,324 @@ [ + { + "title": "CVE-2024-50379|条件竞争Tomcat RCE POC（首发）", + "link": "https://mp.weixin.qq.com/s?__biz=Mzg2NTk4MTE1MQ==&mid=2247486408&idx=1&sn=ac34350ed2c25084cb78cec5ff40275e", + "description": "半通杀|Tomcat RCE！无敌！", + "author": "TtTeam", + "category": "TtTeam", + "pubDate": "2025-01-06T14:41:19" + }, + { + "title": "【渗透利器】比proxifier更好用的代理神器，可轻松配置代理--sunnynet", + "link": "https://mp.weixin.qq.com/s?__biz=Mzk0OTY3OTc5Mw==&mid=2247484914&idx=1&sn=ffcae701630227b7da949c2c63b66b04", + "description": null, + "author": "网安鲲为帝", + "category": "网安鲲为帝", + "pubDate": "2025-01-06T14:27:36" + }, + { + "title": "实战攻防中的信息收集", + "link": "https://mp.weixin.qq.com/s?__biz=MzkyMjU2Nzc1Mg==&mid=2247484483&idx=1&sn=8f7983ac3a289460203b71969a365dbe", + "description": null, + "author": "LHACK安全", + "category": "LHACK安全", + "pubDate": "2025-01-06T14:00:57" + }, + { + "title": "CVE-2024-43452：针对 Windows 特权提升漏洞的 PoC 漏洞发布", + "link": "https://mp.weixin.qq.com/s?__biz=MzAxMjYyMzkwOA==&mid=2247526837&idx=1&sn=bdc1792b20bbc0e3485123421c3c240c", + "description": null, + "author": "Ots安全", + "category": "Ots安全", + "pubDate": "2025-01-06T13:53:08" + }, + { + "title": "CVE-2024-47575：FortiManager FortiManager Cloud 缺少身份验证允许执行任意代码或命令", + "link": "https://mp.weixin.qq.com/s?__biz=MzAxMjYyMzkwOA==&mid=2247526827&idx=1&sn=02106475443306b2005d8031e320d35f", + "description": null, + "author": "Ots安全", + "category": "Ots安全", + "pubDate": "2025-01-06T13:44:09" + }, + { + "title": "ThievingFox——从密码管理器和 Windows 实用程序远程检索凭据", + "link": "https://mp.weixin.qq.com/s?__biz=MzAxMjYyMzkwOA==&mid=2247526827&idx=2&sn=357dc695b40732b89fd8115f61111e9a", + "description": "ThievingFox 是一组后漏洞利用工具，用于在渗透测试和类似活动中从工作站和服务器收集凭据。它的工作原理是让目标应用程序加载恶意库，该库执行内存挂钩以收集凭据。", + "author": "Ots安全", + "category": "Ots安全", + "pubDate": "2025-01-06T13:44:09" + }, + { + "title": "【成功复现】爱数AnyShare SMTP_GetConfig 信息泄露漏洞", + "link": "https://mp.weixin.qq.com/s?__biz=MzU2NDgzOTQzNw==&mid=2247502853&idx=1&sn=6116493ef276d07ee2f6c5105fb25d62", + "description": "【成功复现】爱数AnyShare SMTP_GetConfig 信息泄露漏洞", + "author": "弥天安全实验室", + "category": "弥天安全实验室", + "pubDate": "2025-01-06T12:18:51" + }, + { + "title": "工具集：PotatoTool【1.3更新】集合解密、分析、扫描、溯源、免杀、提权等功能的网络安全综合工具", + "link": "https://mp.weixin.qq.com/s?__biz=Mzk0MjY1ODE5Mg==&mid=2247485088&idx=1&sn=dde3f7615d6d2e96776b49bce1762bea", + "description": null, + "author": "风铃Sec", + "category": "风铃Sec", + "pubDate": "2025-01-06T12:17:41" + }, + { + "title": "JAVA XXE 学习总结", + "link": "https://mp.weixin.qq.com/s?__biz=MzUyODkwNDIyMg==&mid=2247546440&idx=1&sn=1aafdd4bc381662ded1bedaacb7191f8", + "description": null, + "author": "掌控安全EDU", + "category": "掌控安全EDU", + "pubDate": "2025-01-06T12:02:15" + }, + { + "title": "从js到高危垂直越权漏洞挖掘", + "link": "https://mp.weixin.qq.com/s?__biz=MzI4NTcxMjQ1MA==&mid=2247614973&idx=1&sn=0cb7f44aa7d6b3d7f0b82a6e1490a6cc", + "description": null, + "author": "白帽子左一", + "category": "白帽子左一", + "pubDate": "2025-01-06T12:01:05" + }, + { + "title": "Java安全小记-FastJson反序列化", + "link": "https://mp.weixin.qq.com/s?__biz=Mzk0ODY1NzEwMA==&mid=2247485169&idx=1&sn=804880c5f2fad83f50d7217bbe3dfe60", + "description": null, + "author": "土拨鼠的安全屋", + "category": "土拨鼠的安全屋", + "pubDate": "2025-01-06T12:00:23" + }, + { + "title": "浅析CTF中PWN题堆类型的ORW技术", + "link": "https://mp.weixin.qq.com/s?__biz=MjM5MjEyMTcyMQ==&mid=2651037243&idx=1&sn=6fcfd1790adc07489a7aa79613c56bfd", + "description": "浅析ctf中pwn题堆类型的orw", + "author": "SAINTSEC", + "category": "SAINTSEC", + "pubDate": "2025-01-06T11:52:08" + }, + { + "title": "某华命令执行Rce原理分析", + "link": "https://mp.weixin.qq.com/s?__biz=MzkyMjM5NDM3NQ==&mid=2247486194&idx=1&sn=1edc0eb964a23d4ef1d95e0668354d48", + "description": null, + "author": "进击安全", + "category": "进击安全", + "pubDate": "2025-01-06T11:45:51" + }, + { + "title": "[溯源]HuntBack(反击狩猎)，用于攻防演练中，防守方对恶意ip进行web指纹扫描与识别", + "link": "https://mp.weixin.qq.com/s?__biz=Mzg4NTgxNTc5Mg==&mid=2247486805&idx=1&sn=53ec3f82f35a73b14adc666c9ed0ca22", + "description": null, + "author": "W啥都学", + "category": "W啥都学", + "pubDate": "2025-01-06T11:41:44" + }, + { + "title": "漏洞通告 | Windows 轻量级目录访问协议 (LDAP) 拒绝服务漏洞", + "link": "https://mp.weixin.qq.com/s?__biz=Mzg5MTc3ODY4Mw==&mid=2247507635&idx=1&sn=3ed64fc475689a3cd2c08cc3a146a471", + "description": "立即查看漏洞详情", + "author": "微步在线研究响应中心", + "category": "微步在线研究响应中心", + "pubDate": "2025-01-06T10:50:43" + }, + { + "title": "【介质取证】“隐藏”在日志文件里的行为痕迹", + "link": "https://mp.weixin.qq.com/s?__biz=MzI0OTEyMTk5OQ==&mid=2247494068&idx=1&sn=7903df1ae2f96b57d88bdccc88dbdb38", + "description": null, + "author": "平航科技", + "category": "平航科技", + "pubDate": "2025-01-06T10:01:02" + }, + { + "title": "刷脸登录银行 App 现他人信息，银行回应称“网络抖动带来的极小概率事件”|Windows 曝9.8分漏洞，已有PoC及利用情况", + "link": "https://mp.weixin.qq.com/s?__biz=MzAxMjE3ODU3MQ==&mid=2650606244&idx=1&sn=8000e773da8fb2b362bc7283a912db76", + "description": null, + "author": "黑白之道", + "category": "黑白之道", + "pubDate": "2025-01-06T09:55:05" + }, + { + "title": "针对 PostgreSQL 数据库的攻击研究", + "link": "https://mp.weixin.qq.com/s?__biz=MzI5MDQ2NjExOQ==&mid=2247499743&idx=1&sn=f6f99cdd5962403d8c00657ceaa708a5", + "description": null, + "author": "信安之路", + "category": "信安之路", + "pubDate": "2025-01-06T09:37:29" + }, + { + "title": "【漏洞文章】大华智能物联综合管理平台远程代码执行漏洞", + "link": "https://mp.weixin.qq.com/s?__biz=MzkyMTY1NDc2OA==&mid=2247487256&idx=1&sn=5f02d951d459a7c2ef37977afc806005", + "description": null, + "author": "小羊安全屋", + "category": "小羊安全屋", + "pubDate": "2025-01-06T09:13:34" + }, + { + "title": "【漏洞复现】快云服务器助手GetDetail接口文件任意文件读取漏洞", + "link": "https://mp.weixin.qq.com/s?__biz=MzI1NTE2NzQ3NQ==&mid=2247485521&idx=2&sn=21fccb1beac3a0dcc9a565a36fcfa9a7", + "description": null, + "author": "网络安全007", + "category": "网络安全007", + "pubDate": "2025-01-06T09:01:03" + }, + { + "title": "【Nday漏洞分析】ProjectSend 身份认证绕过漏洞(CVE-2024-11680)", + "link": "https://mp.weixin.qq.com/s?__biz=Mzk0Mzc1MTI2Nw==&mid=2247486903&idx=1&sn=0a066aff4189674338d0ffe68e405275", + "description": null, + "author": "神农Sec", + "category": "神农Sec", + "pubDate": "2025-01-06T09:00:39" + }, + { + "title": "vulnhub之unknowndevice2的实践", + "link": "https://mp.weixin.qq.com/s?__biz=MzA3MjM5MDc2Nw==&mid=2650748903&idx=1&sn=f3265733267791c930270b071e833d0e", + "description": null, + "author": "云计算和网络安全技术实践", + "category": "云计算和网络安全技术实践", + "pubDate": "2025-01-06T08:46:59" + }, + { + "title": "内网渗透之ADCS权限维持", + "link": "https://mp.weixin.qq.com/s?__biz=Mzg4MTU4NTc2Nw==&mid=2247494683&idx=1&sn=ff1e934c2bb0dee6e9959d04e96218c0", + "description": "文章前言本篇文章主要介绍如何通过证书服务来实现权限维持的目的基本原理在微软的文档里有一段话\\\\x26quot;当使用PKCA时", + "author": "七芒星实验室", + "category": "七芒星实验室", + "pubDate": "2025-01-06T08:46:33" + }, + { + "title": "企业安全建设之蜜罐搭建与使用", + "link": "https://mp.weixin.qq.com/s?__biz=Mzg4MTU4NTc2Nw==&mid=2247494683&idx=2&sn=2fb0376ca472b4a0a1eff27d319df088", + "description": "基本介绍HFish是一款基于Golang开发的跨平台多功能主动诱导型开源国产蜜罐框架系统，它从内网失陷检测、", + "author": "七芒星实验室", + "category": "七芒星实验室", + "pubDate": "2025-01-06T08:46:33" + }, + { + "title": "W&Jsoft-D-Security数据仿泄露系统(DLP)存在任意文件读取漏洞", + "link": "https://mp.weixin.qq.com/s?__biz=Mzg2NzkxOTQ0OA==&mid=2247484492&idx=1&sn=7da5690238bdb790765079470195bd8e", + "description": "W\\\\x26amp;Jsoft-D-Security数据仿泄露系统(DLP)存在任意文件读取漏洞", + "author": "菜鸟学渗透", + "category": "菜鸟学渗透", + "pubDate": "2025-01-06T08:30:31" + }, + { + "title": "【实用工具】Windows应急响应上机排查工具", + "link": "https://mp.weixin.qq.com/s?__biz=MzIxOTk0ODY0NQ==&mid=2247485387&idx=1&sn=59722752cf6054be5cf5ff0645012d04", + "description": "在上机排查过程中，通过“事件查看器”逐个查看系统日志太过繁琐。这样的话，我们可以通过此工具一键对系统日志进行分类核查，有效提高上机研判、处置能力。", + "author": "如棠安全", + "category": "如棠安全", + "pubDate": "2025-01-06T08:15:40" + }, + { + "title": "免杀系列 - 无法让管理员找到你的木马进程", + "link": "https://mp.weixin.qq.com/s?__biz=MzkzMDQ5MDM3NA==&mid=2247487937&idx=1&sn=f424ff0e311911b564ad87924e90b994", + "description": null, + "author": "SecretTeam安全团队", + "category": "SecretTeam安全团队", + "pubDate": "2025-01-06T08:08:29" + }, + { + "title": "【神兵利器】GRS内网穿透工具", + "link": "https://mp.weixin.qq.com/s?__biz=MzU2NzY5MzI5Ng==&mid=2247504721&idx=1&sn=e25858d7e5772aa1d94b191a42a49d49", + "description": null, + "author": "菜鸟学信安", + "category": "菜鸟学信安", + "pubDate": "2025-01-06T08:03:20" + }, + { + "title": "记一次某道CMS审计过程", + "link": "https://mp.weixin.qq.com/s?__biz=MzkwMzMwODg2Mw==&mid=2247510233&idx=1&sn=0159324632f603442a3a7b5d5bec845c", + "description": null, + "author": "李白你好", + "category": "李白你好", + "pubDate": "2025-01-06T08:01:49" + }, + { + "title": "Hacking Scanner 一键渗透扫描器", + "link": "https://mp.weixin.qq.com/s?__biz=Mzk0ODM0NDIxNQ==&mid=2247493163&idx=1&sn=cd8f69d7ecc43e8bc09da662d0094ede", + "description": null, + "author": "夜组安全", + "category": "夜组安全", + "pubDate": "2025-01-06T08:01:01" + }, + { + "title": "X-Ways Forensics 包含报告表/标签的使用", + "link": "https://mp.weixin.qq.com/s?__biz=Mzg3NTU3NTY0Nw==&mid=2247489479&idx=1&sn=a196e28523a7438789bb56901d775f8d", + "description": "关于包含报告表/标签功能，笔者也是在一次偶然之中领悟到了其强大之处，因为之前一直都认为报告表功能并无大用。现在，标签列是我分析页面中 的常驻列，并且往往处在较为靠前的位置。笔者希望能通过本文介绍包含报告表/标签的强大之处和高效用法。", + "author": "网络安全与取证研究", + "category": "网络安全与取证研究", + "pubDate": "2025-01-06T08:00:57" + }, + { + "title": "漏洞预警 | WordPress Plugin Tutor SQL注入漏洞", + "link": "https://mp.weixin.qq.com/s?__biz=MzkwMTQ0NDA1NQ==&mid=2247491992&idx=1&sn=fbd0590c31f7e295b5743345888e231c", + "description": "WordPress插件Tutor LMS的/wp-admin/admin-ajax.php接口存在SQL注入漏洞，未经身份验证的攻击者可以通过该漏洞获取数据库敏感信息。", + "author": "浅安安全", + "category": "浅安安全", + "pubDate": "2025-01-06T08:00:30" + }, + { + "title": "漏洞预警 | 友数聚CPAS审计管理系统SQL注入和任意文件读取漏洞", + "link": "https://mp.weixin.qq.com/s?__biz=MzkwMTQ0NDA1NQ==&mid=2247491992&idx=2&sn=1e67ec9b7cddeda507a7d80598525961", + "description": "友数聚CPAS审计管理系统存在SQL注入和任意文件读取漏洞，未经身份验证的攻击者可以通过该漏洞获取敏感信息，建议相关用户及时更新。", + "author": "浅安安全", + "category": "浅安安全", + "pubDate": "2025-01-06T08:00:30" + }, + { + "title": "工具 | Hfish", + "link": "https://mp.weixin.qq.com/s?__biz=MzkwMTQ0NDA1NQ==&mid=2247491992&idx=4&sn=22a306b858e629b4d99395f890731306", + "description": "HFish是一款社区型免费蜜罐。", + "author": "浅安安全", + "category": "浅安安全", + "pubDate": "2025-01-06T08:00:30" + }, + { + "title": "Ember Bear APT 攻击模拟", + "link": "https://mp.weixin.qq.com/s?__biz=MzkwOTE5MDY5NA==&mid=2247504432&idx=1&sn=89ec75cbd0580342d7cde65855139ace", + "description": "这是对 （Ember Bear） APT 组织针对乌克兰能源组织的攻击的模拟，攻击活动于 2021 年 4 月活跃，攻击链开", + "author": "安全狗的自我修养", + "category": "安全狗的自我修养", + "pubDate": "2025-01-06T07:09:53" + }, + { + "title": "浅谈密码相关原理及代码实现", + "link": "https://mp.weixin.qq.com/s?__biz=MzU2NDY2OTU4Nw==&mid=2247518163&idx=1&sn=e2b7200747c06902d53e3556d78d9c31", + "description": null, + "author": "船山信安", + "category": "船山信安", + "pubDate": "2025-01-06T00:12:23" + }, + { + "title": "安卓逆向2025 -- Frida学习之环境搭建", + "link": "https://mp.weixin.qq.com/s?__biz=MzA4MzgzNTU5MA==&mid=2652037473&idx=1&sn=fc63b8d78a7113b33bc9630af30dce5b", + "description": null, + "author": "逆向有你", + "category": "逆向有你", + "pubDate": "2025-01-06T00:00:29" + }, + { + "title": "Windows 11 BitLocker被绕过，来提取卷加密密钥", + "link": "https://mp.weixin.qq.com/s?__biz=Mzg2NjY2MTI3Mg==&mid=2247498072&idx=2&sn=d5947fa42d47876f2c6a88dfd33a2479", + "description": null, + "author": "河南等级保护测评", + "category": "河南等级保护测评", + "pubDate": "2025-01-06T00:00:20" + }, + { + "title": "黑客利用 DoS 漏洞禁用 Palo Alto Networks 防火墙", + "link": "https://mp.weixin.qq.com/s?__biz=Mzg3ODY0NTczMA==&mid=2247491876&idx=1&sn=1ffb723d73f1a24290998ff19c4f929e", + "description": null, + "author": "犀牛安全", + "category": "犀牛安全", + "pubDate": "2025-01-06T00:00:00" + }, + { + "title": "记两次内网入侵溯源", + "link": "https://mp.weixin.qq.com/s?__biz=Mzg2NDYwMDA1NA==&mid=2247543401&idx=1&sn=529638018a2a223edc0be924bf6d9d30", + "description": null, + "author": "Hacking黑白红", + "category": "Hacking黑白红", + "pubDate": "2025-01-05T23:26:58" + }, { "title": "国外红队大佬内核+系统级后门维持骚姿势【附代码】", "link": "https://mp.weixin.qq.com/s?__biz=MzI1Mjc3NTUwMQ==&mid=2247538309&idx=1&sn=dd64f573e068a0ec20c175049061bcb5", @@ -23,6 +343,14 @@ "category": "安全初心", "pubDate": "2025-01-05T22:32:13" }, + { + "title": "研究人员发布针对 Windows LDAP 漏洞的 PoC 漏洞利用程序", + "link": "https://mp.weixin.qq.com/s?__biz=MzkxNDM4OTM3OQ==&mid=2247505530&idx=4&sn=d74d0d52adbd4477bc0279d88f92f1e3", + "description": null, + "author": "网络研究观", + "category": "网络研究观", + "pubDate": "2025-01-05T21:27:48" + }, { "title": "Windows 曝9.8分漏洞，已有PoC及利用情况", "link": "https://mp.weixin.qq.com/s?__biz=MzI5NTM4OTQ5Mg==&mid=2247633558&idx=3&sn=52cfdbc169143c290a49fffc945d77d6", @@ -47,6 +375,54 @@ "category": "芳华绝代安全团队", "pubDate": "2025-01-05T18:53:58" }, + { + "title": "【漏洞复现】内训宝 SCORM 模块存在任意文件上传漏洞", + "link": "https://mp.weixin.qq.com/s?__biz=MzI1NTE2NzQ3NQ==&mid=2247485511&idx=1&sn=24c216754ea9f84396bd3159a2ec4b0f", + "description": "内训宝 SCORM 模块存在任意文件上传漏洞|附复现过程！", + "author": "网络安全007", + "category": "网络安全007", + "pubDate": "2025-01-05T16:26:41" + }, + { + "title": "【渗透 Tips】解决Edge的IE模式下无法抓包情况", + "link": "https://mp.weixin.qq.com/s?__biz=MzIzNDU5Mzk2OQ==&mid=2247486346&idx=1&sn=abef247f01a77843ed143f35d85ae810", + "description": null, + "author": "阿呆攻防", + "category": "阿呆攻防", + "pubDate": "2025-01-05T16:07:40" + }, + { + "title": "JS逆向系列17-Hook_cookie v0.2脚本原理解析", + "link": "https://mp.weixin.qq.com/s?__biz=MzkzNTcwOTgxMQ==&mid=2247485234&idx=1&sn=3948bce9c853c43f96632533b5ef236a", + "description": null, + "author": "Spade sec", + "category": "Spade sec", + "pubDate": "2025-01-05T15:47:51" + }, + { + "title": "2024 数证杯流量分析WP", + "link": "https://mp.weixin.qq.com/s?__biz=MzU2NDY2OTU4Nw==&mid=2247518156&idx=1&sn=6b52ea6ce0a870f4a425c6cdbc325f5e", + "description": null, + "author": "船山信安", + "category": "船山信安", + "pubDate": "2025-01-05T10:45:23" + }, + { + "title": "针对潜在危险的 Windows LDAP 漏洞的利用代码已发布", + "link": "https://mp.weixin.qq.com/s?__biz=Mzg2NjY2MTI3Mg==&mid=2247498048&idx=2&sn=76a1a1db4b128f834fc607a9518b2f8d", + "description": null, + "author": "河南等级保护测评", + "category": "河南等级保护测评", + "pubDate": "2025-01-05T00:12:58" + }, + { + "title": "安卓逆向 -- 某TV抓包和jce响应解析", + "link": "https://mp.weixin.qq.com/s?__biz=MzA4MzgzNTU5MA==&mid=2652037449&idx=1&sn=37bae8ad1d88fb2fe194256e6326e768", + "description": null, + "author": "逆向有你", + "category": "逆向有你", + "pubDate": "2025-01-05T00:01:26" + }, { "title": "（滥用） ClickOnce 实现可信任意代码执行", "link": "https://mp.weixin.qq.com/s?__biz=MzAxODM5ODQzNQ==&mid=2247486184&idx=1&sn=5c1bd5ddbc40812af82fbfa7a9f22770", @@ -55,6 +431,22 @@ "category": "securitainment", "pubDate": "2025-01-04T23:04:05" }, + { + "title": "网络抓包神器：Tcpdump实用技巧与案例解析", + "link": "https://mp.weixin.qq.com/s?__biz=MzkxMzMyNzMyMA==&mid=2247569384&idx=1&sn=3dda4be3d2a2361e8de95a139536e7b4", + "description": null, + "author": "马哥网络安全", + "category": "马哥网络安全", + "pubDate": "2025-01-04T17:01:47" + }, + { + "title": "【成功复现】大华智能物联综合管理平台远程代码执行漏洞", + "link": "https://mp.weixin.qq.com/s?__biz=MzU2NDgzOTQzNw==&mid=2247502826&idx=1&sn=59edd406e818caad16fece8fe8cb6fc0", + "description": "【成功复现】大华智能物联综合管理平台远程代码执行漏洞", + "author": "弥天安全实验室", + "category": "弥天安全实验室", + "pubDate": "2025-01-04T16:06:44" + }, { "title": "Steam假入库深入解析", "link": "https://mp.weixin.qq.com/s?__biz=MzkyOTc0NDY2Nw==&mid=2247484579&idx=1&sn=59e527ca060e26343855dce02d6e5eb5", @@ -1206,397 +1598,5 @@ "author": "白帽子左一", "category": "白帽子左一", "pubDate": "2024-12-31T12:01:31" - }, - { - "title": "记一次护网通过外网弱口令一路到内网", - "link": "https://mp.weixin.qq.com/s?__biz=MzUyODkwNDIyMg==&mid=2247546389&idx=1&sn=15e113a1110bf9fa380626975cd8f0d4", - "description": "记一次护网通过外网弱口令一路到内网", - "author": "掌控安全EDU", - "category": "掌控安全EDU", - "pubDate": "2024-12-31T12:01:11" - }, - { - "title": "CVE-2024-52046 Apache MINA反序列化漏洞", - "link": "https://mp.weixin.qq.com/s?__biz=MzU1NzczNTM1MQ==&mid=2247485113&idx=1&sn=50df90ad4a66b95ba4c48d29d449b8b0", - "description": null, - "author": "云梦安全", - "category": "云梦安全", - "pubDate": "2024-12-31T11:52:13" - }, - { - "title": "CVE-2024-12856 四信Four-Faith路由器存在命令注入漏洞", - "link": "https://mp.weixin.qq.com/s?__biz=MzU1NzczNTM1MQ==&mid=2247485113&idx=2&sn=45c7416f428ce01ae543c22d001b2eaa", - "description": null, - "author": "云梦安全", - "category": "云梦安全", - "pubDate": "2024-12-31T11:52:13" - }, - { - "title": "Burp Suite 插件 BurpGPT，可执行额外的被动扫描，以发现高度定制的漏洞，并可以运行任何类型的基于流量的分析。", - "link": "https://mp.weixin.qq.com/s?__biz=Mzk0ODM0NDIxNQ==&mid=2247493117&idx=1&sn=5cbf11851c6bc22bb2af1ea69009af0a", - "description": null, - "author": "夜组安全", - "category": "夜组安全", - "pubDate": "2024-12-31T11:30:21" - }, - { - "title": "免杀基础-shellcode注入详解", - "link": "https://mp.weixin.qq.com/s?__biz=Mzg5MDg3OTc0OA==&mid=2247489219&idx=1&sn=ab08d440a570716aea2c25f3b733a19d", - "description": null, - "author": "Relay学安全", - "category": "Relay学安全", - "pubDate": "2024-12-31T10:17:35" - }, - { - "title": "【漏洞通告】Apache Traffic Control SQL注入漏洞安全风险通告", - "link": "https://mp.weixin.qq.com/s?__biz=MzU4NjY4MDAyNQ==&mid=2247496908&idx=1&sn=352ac8e21fec342905ad73d02a58e740", - "description": "近日，嘉诚安全监测到Apache Traffic Control中存在一个SQL注入漏洞，鉴于漏洞危害较大，嘉诚安全提醒相关用户尽快更新至安全版本，避免引发漏洞相关的网络安全事件。", - "author": "嘉诚安全", - "category": "嘉诚安全", - "pubDate": "2024-12-31T09:31:25" - }, - { - "title": "2024年挖洞记录", - "link": "https://mp.weixin.qq.com/s?__biz=MzI4MjI2NDI1Ng==&mid=2247484781&idx=1&sn=725693ce15070d359938fdf8d8150f59", - "description": "回顾下2024年挖的一些洞", - "author": "安全艺术", - "category": "安全艺术", - "pubDate": "2024-12-31T09:15:34" - }, - { - "title": "Word宏样本分析", - "link": "https://mp.weixin.qq.com/s?__biz=MzkzMDQ5MDM3NA==&mid=2247487882&idx=1&sn=4d675bac7378edc520bf2fa1c78f07e2", - "description": null, - "author": "SecretTeam安全团队", - "category": "SecretTeam安全团队", - "pubDate": "2024-12-31T09:14:08" - }, - { - "title": "日志分析——被入侵的 WordPress", - "link": "https://mp.weixin.qq.com/s?__biz=MzkyMjcxNzE2MQ==&mid=2247484530&idx=1&sn=a72d1b6359f2f7027e778942fe23eae2", - "description": "日志分析——被入侵的 WordPress", - "author": "白帽攻防", - "category": "白帽攻防", - "pubDate": "2024-12-31T09:06:01" - }, - { - "title": "应急研判|原创最详细Windows应急响应研判思路讲解", - "link": "https://mp.weixin.qq.com/s?__biz=MzkzMDE5OTQyNQ==&mid=2247488222&idx=1&sn=89431823197e067fe4cc9e210ca5ebca", - "description": "本次视频学习以下内容：Windows主机排查、WEB日志研研判分析、综合流量分析，主要知识点：利用任何可利用的工具进行快速应急研判，不限于命令行，视频讲的比较细，所以时长较长，请沉浸式观看", - "author": "州弟学安全", - "category": "州弟学安全", - "pubDate": "2024-12-31T09:03:19" - }, - { - "title": "攻击者正在利用 Four-Faith 工业路由器中的命令注入漏洞来部署反向 shell", - "link": "https://mp.weixin.qq.com/s?__biz=MzI2NzAwOTg4NQ==&mid=2649793690&idx=3&sn=6545990d8d094c2f6b2efa2c79bf0e8a", - "description": "对工业路由器的攻击行动。", - "author": "军哥网络安全读报", - "category": "军哥网络安全读报", - "pubDate": "2024-12-31T09:00:40" - }, - { - "title": "利用云服务实现分布式信息收集&&新插件", - "link": "https://mp.weixin.qq.com/s?__biz=MzkwMDY5OTA3OA==&mid=2247483755&idx=1&sn=c64fc33dc9fed3035c74effb79a4319e", - "description": null, - "author": "SecSentry", - "category": "SecSentry", - "pubDate": "2024-12-31T08:30:48" - }, - { - "title": "Weblogic 8.x早期版本后台部署war包获取shell方法与坑点总结", - "link": "https://mp.weixin.qq.com/s?__biz=MzkyMDM4NDM5Ng==&mid=2247490003&idx=1&sn=0bedacadfd73ce1b8527185f53972a86", - "description": "过去几年，在内网中多次遇到weblogic 8.x，与10.x及后续版本相比，早期版本的weblogic后台获取shell的过程会比较复杂", - "author": "安全洞察知识图谱", - "category": "安全洞察知识图谱", - "pubDate": "2024-12-31T08:30:31" - }, - { - "title": "漏洞预警 | GeoServer远程代码执行漏洞", - "link": "https://mp.weixin.qq.com/s?__biz=MzkwMTQ0NDA1NQ==&mid=2247491934&idx=1&sn=c056c4384930ffec5352c63b06b11434", - "description": "GeoServer的/geoserver/wfs接口存在远程代码执行漏洞，如果应用程序使用某些GeoTools功能来评估用户输入提供的XPath表达式，则未经身份验证的攻击者可以通过该漏洞远程执行任意代码，从而控制目标服务器。", - "author": "浅安安全", - "category": "浅安安全", - "pubDate": "2024-12-31T08:03:53" - }, - { - "title": "漏洞预警 | Sophos Firewall SQL注入、弱凭证和代码注入漏洞", - "link": "https://mp.weixin.qq.com/s?__biz=MzkwMTQ0NDA1NQ==&mid=2247491934&idx=3&sn=d94a3dfc31a0ad8f9e870fdff248dc44", - "description": "Sophos Firewall存在多个安全漏洞，攻击者可通过漏洞获取敏感信息、特权访问、执行任意代码等，建议相关用户及时更新。", - "author": "浅安安全", - "category": "浅安安全", - "pubDate": "2024-12-31T08:03:53" - }, - { - "title": "MuMu模拟器Frida 逆向某颜色APP实战", - "link": "https://mp.weixin.qq.com/s?__biz=Mzg5MzMzNTUzMA==&mid=2247485990&idx=1&sn=e53fd4c06aa08935844f4aeabb00ee50", - "description": "免责声明：由于传播、利用本公众号SSP安全研究所提供的信息而造成的任何直接或者间接的后果及损失，均由使用者本人", - "author": "SSP安全研究", - "category": "SSP安全研究", - "pubDate": "2024-12-31T08:00:31" - }, - { - "title": "警惕！锐捷网络云平台曝严重漏洞，全球约 5 万台设备或遭远程控制！", - "link": "https://mp.weixin.qq.com/s?__biz=MzA4NTY4MjAyMQ==&mid=2447899889&idx=1&sn=6060673f25972e58339a5a40ae67e4be", - "description": "近日，网络安全研究人员发现锐捷网络开发的云管理平台存在多个安全漏洞，攻击者可以利用这些漏洞控制接入该平台的网络设备。", - "author": "技术修道场", - "category": "技术修道场", - "pubDate": "2024-12-31T08:00:11" - }, - { - "title": "【神兵利器】基于PE Patch后渗透免杀工具", - "link": "https://mp.weixin.qq.com/s?__biz=Mzg4MTU4NTc2Nw==&mid=2247494392&idx=1&sn=e8f6de1032f93d1fe80ea8c5bfce5ce4", - "description": null, - "author": "七芒星实验室", - "category": "七芒星实验室", - "pubDate": "2024-12-31T07:00:13" - }, - { - "title": "Kerberos协议之AS_REQ&AS_REP", - "link": "https://mp.weixin.qq.com/s?__biz=Mzg4MTU4NTc2Nw==&mid=2247494392&idx=2&sn=d2c5e1af4cc775d8403dc1d43c17166c", - "description": null, - "author": "七芒星实验室", - "category": "七芒星实验室", - "pubDate": "2024-12-31T07:00:13" - }, - { - "title": "CVE-2024-42327：Zabbix SQL注入漏洞分析漏洞分析", - "link": "https://mp.weixin.qq.com/s?__biz=MzU2NDY2OTU4Nw==&mid=2247517945&idx=1&sn=866df104f09aad13fccf1e26c6c78bc8", - "description": null, - "author": "船山信安", - "category": "船山信安", - "pubDate": "2024-12-31T02:00:20" - }, - { - "title": "Four-Faith 路由器pre-auth 命令注入漏洞（CVE-2024-12856）", - "link": "https://mp.weixin.qq.com/s?__biz=MzUxMjc0MTE3Mw==&mid=2247494831&idx=1&sn=5aaadb7d61edb505bc39101bbd83d4b9", - "description": "此漏洞允许远程攻击者通过 /apply.cgi 接口的 adj_time_year 参数，在修改设备系统时间（submit_type=adjust_sys_time）时注入恶意命令。", - "author": "锋刃科技", - "category": "锋刃科技", - "pubDate": "2024-12-31T00:15:42" - }, - { - "title": "利用白加黑静/动态逃逸杀软", - "link": "https://mp.weixin.qq.com/s?__biz=MzkwNjczOTQwOA==&mid=2247493760&idx=1&sn=6d4d7227c23451c32bddd0f938a694d3", - "description": null, - "author": "星落安全团队", - "category": "星落安全团队", - "pubDate": "2024-12-31T00:00:44" - }, - { - "title": "记一次某红蓝演练经历", - "link": "https://mp.weixin.qq.com/s?__biz=Mzg2NTk4MTE1MQ==&mid=2247486396&idx=1&sn=1c3899153360d0cf36bd7469b356fccb", - "description": null, - "author": "TtTeam", - "category": "TtTeam", - "pubDate": "2024-12-31T00:00:14" - }, - { - "title": "【漏洞预警】Craft CMS register_argc_argv 致模板注入代码执行漏洞（CVE-2024-56145）", - "link": "https://mp.weixin.qq.com/s?__biz=MzI3NzMzNzE5Ng==&mid=2247489376&idx=1&sn=c143a56e17c582e5f043c8486dacb182", - "description": null, - "author": "飓风网络安全", - "category": "飓风网络安全", - "pubDate": "2024-12-30T22:54:39" - }, - { - "title": "【免杀实战】 - 低权限kill火绒，让火绒6.0内存扫描形同虚设", - "link": "https://mp.weixin.qq.com/s?__biz=MzkyNDUzNjk4MQ==&mid=2247484809&idx=1&sn=e6b27e3ceffc6692ee50c8ee813cb39b", - "description": "火绒正在绞尽脑子的保护你的电脑！！！", - "author": "零攻防", - "category": "零攻防", - "pubDate": "2024-12-30T21:57:19" - }, - { - "title": "CVE-2024-21182 - Oracle Weblogic Server 漏洞利用 PoC 发布", - "link": "https://mp.weixin.qq.com/s?__biz=MzAxMjYyMzkwOA==&mid=2247526526&idx=1&sn=b40e4e0b3bfdf287bdb7d6d93a01a914", - "description": null, - "author": "Ots安全", - "category": "Ots安全", - "pubDate": "2024-12-30T20:19:59" - }, - { - "title": "Krueger 是一种概念验证 (PoC) .NET 后利用工具", - "link": "https://mp.weixin.qq.com/s?__biz=MzAxMjYyMzkwOA==&mid=2247526526&idx=2&sn=cef20dd8649aac66ad56c7106ed00265", - "description": null, - "author": "Ots安全", - "category": "Ots安全", - "pubDate": "2024-12-30T20:19:59" - }, - { - "title": "近期 Apache Struts 2 严重漏洞开始被利用", - "link": "https://mp.weixin.qq.com/s?__biz=MzU1NjczNjA0Nw==&mid=2247486138&idx=1&sn=ea815812a6b145f0e3cff283fef7d86e", - "description": "研究人员警告称，恶意攻击利用 Apache Struts 2 中最近修补的严重漏洞，导致远程代码执行 (RCE)。", - "author": "三沐数安", - "category": "三沐数安", - "pubDate": "2024-12-30T19:53:51" - }, - { - "title": "webshell取证工具 - webshell-decryptor", - "link": "https://mp.weixin.qq.com/s?__biz=MzIzNTE0Mzc0OA==&mid=2247486017&idx=1&sn=f782c6501d8c4529267e674e968698ff", - "description": null, - "author": "GSDK安全团队", - "category": "GSDK安全团队", - "pubDate": "2024-12-30T19:48:03" - }, - { - "title": "复测 Apache Tomcat 远程代码执行漏洞(CVE-2024-50379)", - "link": "https://mp.weixin.qq.com/s?__biz=MzU4NDY3MTk2NQ==&mid=2247491006&idx=1&sn=ae1eb85988018523b6fede2de404e828", - "description": "1、可以跨目录进行上传文件，除了../和./ ，必须知道目录，不然报错\\\\x0d\\\\x0a\\\\x0d\\\\x0a2、功能点如果只是读取文件不落地，该漏洞不会有影响\\\\x0d\\\\x0a\\\\x0d\\\\x0a3、全版本存在漏洞", - "author": "网安守护", - "category": "网安守护", - "pubDate": "2024-12-30T19:05:52" - }, - { - "title": "安全卫士 | 魔方安全漏洞周报", - "link": "https://mp.weixin.qq.com/s?__biz=MzI3NzA5NDc0MA==&mid=2649291998&idx=1&sn=36120636ca1c352ce916cebd14212209", - "description": "成事在微，筑防于先。魔方安全提醒您:注意企业网络空间资产安全!", - "author": "魔方安全", - "category": "魔方安全", - "pubDate": "2024-12-30T18:31:00" - }, - { - "title": "Palo Alto 修复已遭利用的严重PAN-OS DoS 漏洞", - "link": "https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247521932&idx=1&sn=518332fa38f3263ee23df7a70c1187d3", - "description": "速修复", - "author": "代码卫士", - "category": "代码卫士", - "pubDate": "2024-12-30T18:12:31" - }, - { - "title": "细说软件保护", - "link": "https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458587900&idx=1&sn=c8d213caf6ea7d09c475c09634b099a5", - "description": "看雪论坛作者ID：Payne-Wu", - "author": "看雪学苑", - "category": "看雪学苑", - "pubDate": "2024-12-30T17:59:30" - }, - { - "title": "CS免杀姿势", - "link": "https://mp.weixin.qq.com/s?__biz=MzkxNTIwNTkyNg==&mid=2247552839&idx=1&sn=c7854ed5aca05663f752275799218405", - "description": null, - "author": "蚁景网络安全", - "category": "蚁景网络安全", - "pubDate": "2024-12-30T17:36:33" - }, - { - "title": "资产收集常用工具以及思路总结", - "link": "https://mp.weixin.qq.com/s?__biz=MzkxMzMyNzMyMA==&mid=2247569252&idx=1&sn=e54c1fa0bea69d42456678ba88583486", - "description": null, - "author": "马哥网络安全", - "category": "马哥网络安全", - "pubDate": "2024-12-30T17:03:21" - }, - { - "title": "某小型CMS漏洞复现审计", - "link": "https://mp.weixin.qq.com/s?__biz=MzkyNTY3Nzc3Mg==&mid=2247488005&idx=1&sn=62d81de1aeddc3b12a7c5e00acfa04cb", - "description": "记录一次CMS的漏洞复现过程。", - "author": "蚁景网安", - "category": "蚁景网安", - "pubDate": "2024-12-30T16:30:19" - }, - { - "title": "2024年网鼎杯初赛和半决赛部分题解--PWN", - "link": "https://mp.weixin.qq.com/s?__biz=MzkxNTc1MzQyNw==&mid=2247488717&idx=1&sn=6650a89222f154da3605f27cf7fa1c21", - "description": null, - "author": "Undefin3d安全团队", - "category": "Undefin3d安全团队", - "pubDate": "2024-12-30T14:29:08" - }, - { - "title": "【工具分享】SpringBootVul-GUI 半自动图形化打点工具", - "link": "https://mp.weixin.qq.com/s?__biz=Mzg4MTkwMTI5Mw==&mid=2247488486&idx=1&sn=8447ecb599d814fcfe6e6e317e3fa092", - "description": "本着简单到极致的原则，开发了这么一款半自动化工具（PS：这个工具所包含多个漏洞，开发不易)", - "author": "星悦安全", - "category": "星悦安全", - "pubDate": "2024-12-30T12:11:16" - }, - { - "title": "漏洞分析 | Apache SkyWalking SQL注入漏洞分析", - "link": "https://mp.weixin.qq.com/s?__biz=Mzg5Njg5ODM0OQ==&mid=2247485970&idx=1&sn=9b76a2caa9f387177dd7ead1489c5aad", - "description": "当SkyWalking使用H2、MySQL或者TiDB作为存储方案时，攻击者可通过默认未授权的GraphQL接口构造恶意请求，从而获取敏感数据。", - "author": "杂七杂八聊安全", - "category": "杂七杂八聊安全", - "pubDate": "2024-12-30T11:36:29" - }, - { - "title": "免杀基础-DLL注入详解（学不会你打我）", - "link": "https://mp.weixin.qq.com/s?__biz=Mzg5MDg3OTc0OA==&mid=2247489203&idx=1&sn=5d24620f587994655eff662e827dc137", - "description": null, - "author": "Relay学安全", - "category": "Relay学安全", - "pubDate": "2024-12-30T11:35:19" - }, - { - "title": "记一次某红蓝演练经历", - "link": "https://mp.weixin.qq.com/s?__biz=MzkzMjIxNjExNg==&mid=2247486094&idx=1&sn=e704a94ef7316948bf0aaeec785f2c29", - "description": null, - "author": "沃克学安全", - "category": "沃克学安全", - "pubDate": "2024-12-30T11:24:51" - }, - { - "title": "【技术分享】微信小程序AppSecret秘钥利用方式", - "link": "https://mp.weixin.qq.com/s?__biz=MzkxMTY1MTIzOA==&mid=2247484459&idx=1&sn=8f70d6d283f4aa7949b14a75ac65dc85", - "description": "AppID与AppSecret可以调用接口获取临时登录凭证（access_token），用于在开发过程中验证用户身份。通过获取到的access_token可以在微信开发平台调式工具调用接口进行调式，可以理解为接管接口提供的一系列服务。", - "author": "剁椒Muyou鱼头", - "category": "剁椒Muyou鱼头", - "pubDate": "2024-12-30T10:22:15" - }, - { - "title": "记一次某红蓝实战演练的经历", - "link": "https://mp.weixin.qq.com/s?__biz=Mzg2NTk4MTE1MQ==&mid=2247486390&idx=1&sn=c3cde76e6b3df4698e512f60e9c0cdec", - "description": null, - "author": "TtTeam", - "category": "TtTeam", - "pubDate": "2024-12-30T10:20:24" - }, - { - "title": "记一次某红蓝实战演练的经历", - "link": "https://mp.weixin.qq.com/s?__biz=MzAxMjE3ODU3MQ==&mid=2650605966&idx=3&sn=a520a4b214874df858c7956733b8373d", - "description": null, - "author": "黑白之道", - "category": "黑白之道", - "pubDate": "2024-12-30T10:15:16" - }, - { - "title": "APP客户端安全问题扫描工具", - "link": "https://mp.weixin.qq.com/s?__biz=MzAxMjE3ODU3MQ==&mid=2650605966&idx=4&sn=7001edcbe19c8e314026639aaa2f362a", - "description": null, - "author": "黑白之道", - "category": "黑白之道", - "pubDate": "2024-12-30T10:15:16" - }, - { - "title": "急需升级，D-Link 路由器漏洞被僵尸网络广泛用于 DDoS 攻击", - "link": "https://mp.weixin.qq.com/s?__biz=Mzg3NTY0MjIwNg==&mid=2247485293&idx=1&sn=1138242da1a830b127c4b00f230940f8", - "description": "Mirai 和 Keksec 僵尸网络变体正在利用 D-Link 路由器中的关键漏洞", - "author": "星尘安全", - "category": "星尘安全", - "pubDate": "2024-12-30T10:00:55" - }, - { - "title": "16 款 Chrome 插件被黑，60W+用户面临数据被盗风险", - "link": "https://mp.weixin.qq.com/s?__biz=MjM5Mzc4MzUzMQ==&mid=2650260337&idx=1&sn=854e45d4bb0f235f913a467c9a9b5896", - "description": null, - "author": "骨哥说事", - "category": "骨哥说事", - "pubDate": "2024-12-30T09:55:02" - }, - { - "title": "初探免杀与持久化", - "link": "https://mp.weixin.qq.com/s?__biz=MzkzNzI2Mzc0Ng==&mid=2247486374&idx=1&sn=ac6969783db2c7d82ff98224ed21ba0f", - "description": "“A9 Team 甲方攻防团队，成员来自某证券、微步、青藤、长亭、安全狗等公司。", - "author": "A9 Team", - "category": "A9 Team", - "pubDate": "2024-12-30T09:47:32" - }, - { - "title": "记一次某红蓝演练经历", - "link": "https://mp.weixin.qq.com/s?__biz=Mzk0MTIzNTgzMQ==&mid=2247518973&idx=1&sn=666b20eacb63dbb1b7b2e4f76c06feab", - "description": null, - "author": "亿人安全", - "category": "亿人安全", - "pubDate": "2024-12-30T09:45:01" } ] \ No newline at end of file diff --git a/resources/JSON/freebuf.json b/resources/JSON/freebuf.json index fc73539..af732fb 100644 --- a/resources/JSON/freebuf.json +++ b/resources/JSON/freebuf.json @@ -1,4 +1,44 @@ [ + { + "title": "恶意软件通过木马 VPN 应用和 SEO 投毒传播，推测其目标是中文用户", + "link": "https://www.freebuf.com/news/419140.html", + "description": "一种名为PLAYFULGHOST的新恶意软件具有多种信息收集功能，例如键盘记录、屏幕捕获、音频捕获、远程 shell 以及文件传输/执行。", + "body": "

网络安全研究人员发现一种名为PLAYFULGHOST的新恶意软件，它具有多种信息收集功能，例如键盘记录、屏幕捕获、音频捕获、远程 shell 以及文件传输/执行。

据谷歌安全团队称，该后门与一种名为Gh0st RAT 的已知远程管理工具在功能上存在重叠，后者的源代码于 2008 年被公开泄露。

PLAYFULGHOST 的初始访问途径包括使用带有行为准则相关诱饵的网络", + "category": "资讯", + "pubDate": "Mon, 06 Jan 2025 13:42:35 +0800" + }, + { + "title": "LegionLoader滥用Chrome扩展传播多种恶意软件", + "link": "https://www.freebuf.com/news/419136.html", + "description": "据gbhackers消息，名为LegionLoader 的恶意软件正通过Chrome 扩展分发窃密软件，包括对受害者实施电子邮件操纵、跟踪浏览，甚至将受感染的浏览器转变为攻击者的代理服务器，使其能够使用受害者的凭证浏览网页。自 2024 年 8 月以来，研究人员观察到LegionLoader 通过 Chrome 扩展程序分发各种窃取程序，包括 LummaC2、Rhadamanthys 和 Stea", + "body": "

据gbhackers消息，名为LegionLoader 的恶意软件正通过Chrome 扩展分发窃密软件，包括对受害者实施电子邮件操纵、跟踪浏览，甚至将受感染的浏览器转变为攻击者的代理服务器，使其能够使用受害者的凭证浏览网页。近日，研究人员发现，有大量的恶意npm软件包，它们冒充以太坊开发者使用的Hardhat开发环境，正在窃取私钥和其他敏感数据。研究人员称，这些恶意软件包总共被下载了一千多次。

\"\"libraryofleaks是由分布式拒绝秘密组织（Distributed Denial of Secrets，简称DDoSecrets）推出的一个公共搜索引擎，被称为“泄密库”（Library of Leaks），这个平台允许用户搜索数百万份来自数十起泄密事件的文件，而且每天都会添加更多", + "category": "资讯", + "pubDate": "Mon, 06 Jan 2025 10:43:48 +0800" + }, + { + "title": "知名化工巨头被勒索攻击，泄露761.8GB数据", + "link": "https://www.freebuf.com/news/419127.html", + "description": "此次攻击涉及对其部分服务器上的电子数据进行加密，而勒索软件组织Hunters International声称对此事负责。", + "body": "

Nikki - Universal有限公司是一家知名的化学制造商，近期沦为一起复杂勒索软件攻击的受害者。该公司于2024年12月27日证实了这一事件，此次攻击涉及对其部分服务器上的电子数据进行加密，而勒索软件组织Hunters International声称对此事负责。

全球动态

1. 超过300万台未加密的邮件服务器暴露

目前，超过300万台未启用TLS加密的POP3和IMAP邮件服务器暴露在互联网上，容易受到网络嗅探攻击。【外刊-关于Threatcl

Threatcl是一款功能强大的威胁记录模型，可以帮助广大研究人员更加清楚地记录威胁，并推动安全态势的提升。

shiro-core

本篇文章只阐述最核心内容，从整体描述shiro-core，目的是能在研究shiro的漏洞时有一个全局观，因此不可能涉及全部细节。