2014年05月_cnbird2008

12月 11月 10月 09月 08月 07月 06月 05月 04月 03月 02月 01月

转载 CVE-2014-0246 POC

When using a GRUB bootloader password, the md5 hash of said password was collected and stored in the resulting archive of debugging information when running sosreport. An attacker able to access the a

2014-05-30 12:58:25 1286

转载 CVE-2014-0199 CVE-2014-0200 CVE-2014-0201 POC

It was found that the ovirt-engine-reports setup script logged the reportsdatabase password in plain text to a world-readable file. An attacker witha local user account on the Red Hat Enterprise

2014-05-30 12:55:12 1145

转载 CVE-2014-0243 POC

[myhost]$ pwd /var/lib/check_mk_agent/job [myhost]$ ls -l total 0 [myhost]$ ln -s /etc/shadow [myhost]$ ls -la total 4 drwxrwxrwt 2 root root 4096 May 21 15:17 . d

2014-05-30 12:45:30 1568

转载 Elasticsearch 代码执行漏洞

http://xxx.com:9200/_search?source={%22size%22:1,%22query%22:{%22filtered%22:{%22query%22:{%22match_all%22:{}}}},%22script_fields%22:{%22exp%22:{%22script%22:%22import%20java.util.*;\nimport%20java.io

2014-05-29 16:41:05 2077

转载 DZ自动爆破工具原理分析

ID：GENXORTEAM：360网站卫士[转载请注明出处自 : 360网站卫士博客-blog.wangzhan.360.cn]0×01 原理分析最近爆出关于利用社工库爆破Discuz论坛用户名密码的工具，造成很多大的论坛用户信息泄露，分析原理如下。这里Discuz判断访问IP主要用了下面这段逻辑，private function _get_cl

2014-05-19 16:26:08 4941

转载 Linux入侵审查浅谈转自2cto

1. 检查帐户?12345# less /etc/passwd# grep :0: /etc/passwd（检查是否产生了新用户，和UID、GID是0的用户）# ls -l /etc/passwd（查看文件修改日期）# awk -F: ‘$3= =0 {print $

2014-05-15 17:50:23 992 1

转载 java漏洞分析

http://www.secniu.com/blog/page/2/https://media.blackhat.com/bh-us-12/Briefings/Oh/BH_US_12_Oh_Recent_Java_Exploitation_Trends_and_Malware_WP.pdf

2014-05-15 17:18:40 953

转载 Insecure default in Elasticsearch enables remote code execution

Elasticsearch has a flaw in its default configuration which makes it possible for any webpage to execute arbitrary code on visitors with Elasticsearch installed. If you’re running Elasticsearch in d

2014-05-15 16:37:21 2042

转载 f5 icontrol exploit

http://wenku.baidu.com/link?url=awoYxUopvjR9miMvaVQvgtpGDUMmjilVlaHfOuUBEliyFC7SJl-F0Pc05E_6vnBy5fSyOisTqLfrDZOG9A-z1MlOWSeIAz8cIygiSYm3Xz_

2014-05-15 14:52:27 1414

转载大型网站系统与Java中间件实践

http://product.china-pub.com/3803691

2014-05-14 18:44:10 1496

转载 java debug 渗透测试

JDWP Arbitrary Java Code Execution Exploitation===============================================Java Debugging Wire Protocol (JDWP) is the lowlevel protocol used forcommunication between a debugger a

2014-05-13 14:07:30 4411

附件2 金融行业信息系统信息安全等级保护测评指南(报批稿)

2013-06-21

ISO 27000中文系列

ISO 27000中文系列主要是包括iso 27001 ISO 27002实施指南 iso 27003风险评估指南

2010-07-04

空空如也

TA创建的收藏夹 TA关注的收藏夹

TA关注的人