#security #hack #virus MIT Tech Review 提到的 IoT 僵尸网络，去年DDoS FB, Twitter 元凶 https://github.com/jgamblin/Mirai-Source-Code

#security #hack #virus MIT Tech Review 提到的 IoT 僵尸网络，去年DDoS FB, Twitter 元凶 https://github.com/jgamblin/Mirai-Source-Code

https://en.wikipedia.org/wiki/Return-to-libc_attack return to libc attack 也就是现在所说的 ROP，在 CTF 里是个很常见的攻击？因为 Memory 有 (DEP, or data execution prevention, means that you can't run code from anywhere you want anymore)，再加 stack 的 ramdomization， Buffer overflow 攻击就基本杜绝注入攻击了。但 ROP 还是可以的 #security #system

if the stack is DEP, then just begin the exploit at the ret and call the following chain of gadgets. Finally got the idea of ROP. 把 Caller 的 stack overwrite 掉，跳到目标 gadget 然后 return 就好了。 btw, pop 是个好东西，popping means restoring whatever is on top of the stack into the register #ROP #security

https://aws.amazon.com/ec2/nitro/nitro-enclaves/ AWS EC2 有 enclave support 了 #security #cloud

https://pentesterlab.com/exercises/web_for_pentester/attachments #security

https://www.exploit-db.com/ #exploition #security #OSCP

https://whereismydata.wordpress.com/2009/06/01/forensics-what-is-the-bitmap/ hey where is your data! INI security还有一个专门的取证课 Forensics #data #filesystem #bitmap #security

https://azure.microsoft.com/en-us/blog/microsoft-introduces-steps-to-improve-internet-routing-security/ how Azure protect BGP #BGP #security

https://robertheaton.com/2020/04/27/how-does-a-tcp-reset-attack-work/ Nice article about TCP RST attack #network #security

http://phrack.org/issues/70/3.html Attacking JavaScript Engines with CVE-2016-4622 #security #browsersecurity #hacking #JS #JSEngine

https://cloud.google.com/beyondcorp/ Google's ZeroTrust 实现，主页的paper 都很值得读 #zerotrust #security

https://blog.gimo.me/posts/getting-started-with-yubikey/ Cloudflare 的用户可以便宜买 Yubikey！ #cloudflare #yubikey #security

https://en.wikipedia.org/wiki/Cloudbleed 5年前的今天的 Cloudbleed #cloudflare #security #cloudbleed

https://portswigger.net/daily-swig/path-confusion-web-cache-deception-threatens-user-information-online Cache deception attack #cache #security #cachedeception

https://book.hacktricks.xyz 很棒的 security index #hack #security