作者： CDK-Team
项目地址：https://github.com/cdk-team/CDK/CDK是一款为容器环境定制的渗透测试工具，在已攻陷的容器内部提供零依赖的常用命令及PoC/EXP。集成Docker/K8s场景特有的 逃逸、横向移动、持久化利用方式，插件化管理。
一月 28, 2021
CDK:一款针对容器场景的多功能渗透工具
挖洞经验 | 通过谷歌广告越权获取Youtube私享视频图像帧
本文通过谷歌广告中的视频制作功能，作者发现了Youtube私享（Private）视频图像帧的越权获取漏洞，利用该漏洞可以获取知晓视频ID号的任意Youtube私享（Private）视频的所有图像帧，从而可完整拼凑出整个视频图像信息。漏洞最终获得了谷歌官方$5k的奖励。
一月 28, 2021
挖洞经验 | 构造基于时间的盲注漏洞（Time-Based SQLi）
某天，当我参与某个漏洞众测项目中，偶尔发现之前一个从未见过的子域名网站，因此我决定深入测试一下。该网站主界面是 […]
一月 28, 2021
Linux通过栈溢出进行提权实战（dpwwn03）
最近在刷vulnhub靶场，偶然间做到了dpwwn系列的靶场，其中dpwwn03靶场提权用的是程序栈溢出的漏洞，相对常规方法还是比较少见的，所以拿出来单独在这里研究下。既然讲到了提权，顺带介绍下常规的提权方式：
一月 28, 2021
网络空间日光浴委员会白皮书：对拜登政府的网络安全建议 (全文翻译)
在美国网络空间日光浴委员会（CSC）相继发布《疫情中吸取的关于网络安全的教训》、《网络安全劳动力发展战略框架》 […]
一月 28, 2021
Oscorp, a new Android malware targets Italian users
Researchers from security firm AddressIntel spotted a new Android malware dubbed Oscorp, its name comes from the title of the login page of its [...]
一月 28, 2021
Lebanese Cedar APT group broke into telco and ISPs worldwide
Clearsky researchers linked the Lebanese Cedar group (aka Volatile Cedar) to a cyber espionage campaign that targeted companies around the world.
一月 28, 2021
超1499元即没收？上海市市场监管局：“严打茅台加价销售”消息不实
春节临近，飞天茅台的需求不断增大，使得飞天茅台价格也一路飙升。元旦之前，茅台酒厂在经销渠道、直营店等全渠道投放了7500吨的飞天茅台酒的同时要求店家将80%的茅台酒拆箱售卖想借此回落茅台的价格。
一月 28, 2021
TeamTNT group adds new detection evasion tool to its Linux miner
The TeamTNT cybercrime group has upgraded their Linux cryptocurrency miner by adding open-source detection evasion capabilities, AT&T Alien Labs [...]
一月 28, 2021
LogoKit, a new phishing kit that dynamically creates phishing forms
Researchers from RiskIQ discovered a new phishing kit that outstands for its ability to dynamically create phishing messages to target specific users.
一月 28, 2021
国家漏洞库CNNVD：关于SonicWall SSL-VPN 安全漏洞的预警
近日，国家信息安全漏洞库（CNNVD）收到关于SonicWall SSL-VPN安全漏洞（CNNVD-2021 […]
一月 28, 2021
XNU kauth 子系统解读
作者：wzt
原文链接：https://mp.weixin.qq.com/s/Tm4z-_po6DmurcneKQ536AXNU将进程凭证credential、文件系统acl授权、进程和文件系统监控这几个安全功能抽象为一个安全框架，叫做kauth子系统。它的具体功能主要包含：
一月 28, 2021
CISA warns of high-severity flaws in Fuji Electric Tellus Lite V-Simulator and Server Lite
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a security advisory to warn industrial organizations of some high severity flaws in [...]
一月 27, 2021
探讨“实名认证” (一)：App实名认证收集个人信息现状分析
网络匿名的恶意辱骂、诽谤造谣、网络诈骗、低俗文化传播等行为对个人利益和公共利益造成了极大的损害，也为网络空间治 […]
一月 27, 2021
Law enforcement announced global action against NetWalker Ransomware
Law enforcement authorities in the U.S. and Europe have seized the dark web sites used by NetWalker ransomware operators. The authorities also charged a [...]
一月 27, 2021
Emotet Botnet dismantled in a joint international operation
A global operation of law enforcement, lead by Europol, has dismantled the infrastructure of the infamous Emotet botnet.
一月 27, 2021
Pwn2Own 2021, more than $1,500,000 in cash and prizes for contestants
Trend Micro’s Zero Day Initiative (ZDI) on this week announced the forthcoming Pwn2Own Vancouver 2021 hacking competition that will take place on April 6-8.
一月 27, 2021
Maritime port cybersecurity
In order to better understand the evolutionary trend of worldwide shipping and port facilities from 2007 to present, it is necessary to talk again about [...]
一月 27, 2021
Apple addresses three iOS zero-day flaws exploited in the wild
Apple has addressed three zero-day vulnerabilities in iOS that have been exploited in the wild with the release of security updates (iOS 14.4).
一月 27, 2021
2020网安投融资报告：五大领域引领行业投资，网安企业进入千亿时代
前言 毫无疑问，疫情是2020年最大的关键词之一。受疫情影响，全球经济形势不容乐观，网络安全产业也受到了一定的 […]
一月 27, 2021
Heap-based buffer overflow in Linux Sudo allows local users to gain root privileges
Sudo is one of the most important, powerful, and commonly used utilities that comes as a core command pre-installed on macOS and almost [...]
一月 27, 2021
SAP Solution Manager远程代码执行漏洞 (CVE-2020-6207) 预警
一、基本情况 近日，监测到国外研究员披露关于SAP Solution Manager远程代码执行漏洞（CVE- […]
一月 26, 2021
Apache Hadoop潜在权限提升漏洞 (CVE-2020-9492) 通告
0x00 漏洞概述 CVE ID CVE-2020-9492 时 间 2021-01-27 类 型 权限提升 […]
一月 26, 2021