3月10日-每日安全知识热点

1.Black Hat 2015 欧洲会议所有视频

https://www.youtube.com/playlist?list=PLH15HpR5qRsVd9jdTWUB5s16fmr2VCQyS

2.dcept:部署和检测活动目录token蜜罐 

https://github.com/secureworks/dcept

3."libotr"中的内存破坏漏洞 

https://www.x41-dsec.de/lab/advisories/x41-2016-001-libotr/

4.Flask/Jinja2中的服务端模板注入 

https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2/

5.SpagoBI的远程代码执行漏洞（需要认证权限） 

https://remoteawesomethoughts.blogspot.tw/2016/03/spagobi-remote-code-execution-by.html

6.Banload恶意软件影响巴西异常复杂的感染过程 

http://researchcenter.paloaltonetworks.com/2016/03/banload-malware-affecting-brazil-exhibits-unusually-complex-infection-process/

7.Pidgin-OTR 插件的 (CVE-2015-8833) UAF漏洞 

https://blog.fuzzing-project.org/39-Heap-use-after-free-in-Pidgin-OTR-plugin.html

8.Hypro: linux rootkit检测工具 

https://github.com/jianpingjwang/Hypro?platform=hootsuite

9.恶意软件公开使用的技术总结 

https://github.com/LordNoteworthy/al-khaser

10.利用ftfp协议进行反射放大dos攻击 

http://securityaffairs.co/wordpress/45159/hacking/tftp-ddos-amplification-attacks.html

11.宏恶意软件连接到github下载其他的payload 

http://labs.bromium.com/2016/03/09/macro-malware-connecting-to-github/

12.通过 timing prefetch绕过kaslr的poc 

https://github.com/xairy/kaslr-bypass-via-prefetch

13.google开源他的binexport:将ida分析结果导入到BinNavi数据库的工具 

https://github.com/google/binexport

14.很多公司遭受同一种钓鱼攻击（通过Snapchat来钓鱼） 

https://nakedsecurity.sophos.com/2016/03/09/more-companies-snared-by-same-type-of-phishing-attack-that-hit-snapchat/

15.对 AlphaLeon HTTP Bot的测试 

http://www.arbornetworks.com/blog/asert/alpha-testing-alphaleon-http-bot/

16.能够触发IE/EDGE崩溃的漏洞 

https://blogs.technet.microsoft.com/srd/2016/01/12/triaging-the-exploitability-of-ieedge-crashes/

17.宏恶意软件结合Dridex恶意软件被发现新的隐藏方式 

https://blogs.mcafee.com/mcafee-labs/macro-malware-associated-dridex-finds-new-ways-hide/

18.Binmap: 系统扫描器 

http://blog.quarkslab.com/binmap-a-system-scanner.html

19.最近暴露的几个CVE，允许轻松ROOT访问android系统 

http://blog.trendmicro.com/trendlabs-security-intelligence/android-vulnerabilities-allow-easy-root-access