【行业资讯】【Twitter实时技术-2017.6.03】
致谢
-
@Todaro
-
@Avfisher
- @章鱼小团子
Untrusted Java serialization in Soffid IAM console allows remote attackers to achieve remote code execution
http://www.soffid.com/security-advisory1-update/
Why Your Encrypted Database Is Not Secure
https://eprint.iacr.org/2017/468.pdf
MISP Galaxy Cluster including Exploit-Kit, Microsoft Activity Group actor, Preventive Measure, Ransomware, TDS...
https://www.misp.software/galaxy.html
Deploying Microsoft Advanced Threat Analytics
Arbitrary File Reading in Next.js < 2.4.1
https://raz0r.name/vulnerabilities/arbitrary-file-reading-in-next-js-2-4-1/
WAF Bypass at PHDays VII: Results and Answers
http://blog.ptsecurity.com/2017/06/waf-bypass-at-phdays-vii-results-and.html
A book-in-progress about the linux kernel and its insides.
https://0xax.gitbooks.io/linux-insides/content/
LazyDroid：bash script to facilitate some aspects of an Android application assessment
https://github.com/nccgroup/LazyDroid
phone number exposure for riders/drivers given email/uuid in Uber
https://hackerone.com/reports/225243
New version of MWI using CVE-2017-0199 to load an HTA for payload delivery/execution and reports about the system
PowerLessShell : Rely on MSBuild.exe to remotely execute PowerShell scripts/cmds without spawing powershell.exe
https://github.com/Mr-Un1k0d3r/PowerLessShell
APT# #钓鱼分析# PowerPoint File Downloads Malware When You Hover a Link, No Macros Required：
httpstat：curl statistics made simple
https://github.com/reorx/httpstat
MultiScanner is a file analysis framework that assists the user in evaluating a set of files by automatically running a suite of tools for the user and aggregating the output.
https://github.com/mitre/multiscanner
Threat actors leverage EternalBlue exploit to deliver non-WannaCry payloads
Announcing Google Capture the Flag 2017
https://security.googleblog.com/2017/06/announcing-google-capture-flag-2017.html?m=1 ;
谷歌ctf看似开始了
Blackhat 2017#安全工具集：
Android, iOS and Mobile Hacking
Android Tamer
链接：Android Tamer · GitHub
DiffDroid
链接：GitHub - antojoseph/diff-droid: Various Scripts fo...
Kwetza
链接：GitHub - sensepost/kwetza: Python script to inject...
Needle
链接：GitHub - mwrlabs/needle: The iOS Security Testing ...
NoPE Proxy (Non-HTTP Proxy Extension)
链接：GitHub - summitt/Burp-Non-HTTP-Extension: Non-HTTP...
Code Assessment
Puma Scan
链接：GitHub - pumasecurity/puma-scan: Puma Scan is the ...
Tintorera: Source Code Intelligence (Code not yet uploaded)
链接：GitHub - vulnex/Tintorera: Source Code Intelligenc...
Cryptography
Hashview
链接：GitHub - hashview/hashview: A web front-end for pa...
Gibber Sense
链接：GitHub - smxlabs/gibbersense: Extract Sense out of...
Data Forensics and Incident Response
PcapDB: Optimized Full Network Packet Capture for Fast and Efficient Retrieval
链接：GitHub - dirtbags/pcapdb: A Distributed, Search-Op...
SCOT (Sandia Cyber Omni Tracker) Threat Intelligence and Incident Response Management System
链接：GitHub - sandialabs/scot: Sandia Cyber Omni Tracke...
Security Monkey
链接：GitHub - Netflix/security_monkey: Security Monkey
ThreatResponse: An Open Source Toolkit for Automating Incident Response in AWS
链接：ThreatResponse · GitHub
Yalda — Automated Bulk Intelligence Collection (Code not yet uploaded)
链接：gitaziabari/Yalda · GitHub
Exploitation and Ethical Hacking
AVET — AntiVirus Evasion Tool
链接：GitHub - govolution/avet: AntiVirus Evasion Tool
GDB Enhanced Features (GEF)
链接：GitHub - hugsy/gef: Multi-Architecture GDB Enhance...
Leviathan Framework
链接：GitHub - leviathan-framework/leviathan: wide range...
MailSniper
链接：GitHub - dafthack/MailSniper: MailSniper is a pene...
Seth
链接：GitHub - SySS-Research/Seth: Perform a MitM attack...
Hardware/Embedded
ChipWhisperer
链接：GitHub - newaetech/chipwhisperer: ChipWhisperer - ...
DYODE, a DIY, Low-Cost Data Diode for ICS
链接：GitHub - arnaudsoullie/dyode: A low-cost data diod...
FTW: Framework for Testing WAFs
链接：GitHub - fastly/ftw: Framework for Testing WAFs (F...
The Bicho: An Advanced Car Backdoor Maker
链接：GitHub - UnaPibaGeek/CBM: Car Backdoor Maker - by ...
Internet of Things
Hacker Mode
链接：GitHub - xssninja/Alexa-Hacker-Mode: Node JS code ...
Universal Radio Hacker: Investigate Wireless Protocols Like a Boss
链接：GitHub - jopohl/urh: Universal Radio Hacker: inves...
Malware Defense
Aktaion v2 — Open Source Machine Learning and Active Defense Tool
链接：GitHub - jzadeh/Aktaion
Cuckoo Sandbox
链接：GitHub - cuckoosandbox/cuckoo: Cuckoo Sandbox is a...
LimaCharlie
链接：GitHub - refractionPOINT/limacharlie: Endpoint mon...
Malboxes
链接：GitHub - GoSecure/malboxes: Builds malware analysi...
Network Attacks
BloodHound 1.3
链接：GitHub - BloodHoundAD/BloodHound: Six Degrees of D...
CrackMapExec v4
链接：GitHub - byt3bl33d3r/CrackMapExec: A swiss army kn...
DELTA: SDN Security Evaluation Framework
链接：GitHub - OpenNetworkingFoundation/DELTA: PROJECT D...
eaphammer
链接：GitHub - s0lst1c3/eaphammer: Targeted evil twin at...
gr-lora: An Open-Source SDR Implementation of the LoRa PHY
链接：GitHub - BastilleResearch/gr-lora: GNU Radio OOT m...
Yasuo
链接：GitHub - 0xsauby/yasuo: A ruby script that scans f...
Network Defense
Assimilator
链接：GitHub - videlanicolas/assimilator: Automatic fire...
Noddos
链接：GitHub - noddos/noddos: Noddos client
SITCH: Distributed, Coordinated GSM Counter-Surveillance
链接：GitHub - sitch-io/sensor: Sensor software
Sweet Security
链接：GitHub - TravisFSmith/SweetSecurity: Create a defe...
OSINT — Open Source Intelligence
Datasploit — Automated Open Source Intelligence (OSINT) Tool
链接：GitHub - DataSploit/datasploit: A tool to perform ...
Dradis: 10 Years Helping Security Teams Spend More Time Testing and Less Time Reporting
链接：GitHub - dradis/dradis-ce: Dradis Framework: Colll...
OSRFramework: Open Sources Research Framework
链接：GitHub - i3visio/osrframework: OSRFramework, the O...
Reverse Engineering
BinGrep
链接：GitHub - m4b/bingrep: like grep, but for binaries
Vulnerability Assessment
Aardvark and Repokid
链接：GitHub - square/Aardvark: Aardvark is a library th...
SERPI
标题：
Deploying Microsoft Advanced Threat Analytics
链接：
https://zh.scribd.com/document/340534777/Deploying-Microsoft-Advanced-Threat-Analytics-
点评：
部署微软高级威胁分析系统：ATA是微软提供的一套基威胁分析系统，核心的通过四步进行保护：
1、深度数据包分析流量
2、自学习用户、设备与资源，并绘制安全图
3、在组织安全图构造好后，实时发现异常行为
4、告警
可以参考国内的安装手册：
https://docs.microsoft.com/zh-cn/advanced-threat-analytics/deploy-use/ata-silent-installationATA-tuto-de-A-a-Z
技术交流QQ群： 397745473
来自:https://xianzhi.aliyun.com/forum/read/1670.html?fpage=2
评论
发表评论