Aggregator

腾讯混元大模型热招中，欢迎加入

基于大语言模型的代码缺陷定位

对代码预训练模型的多目标后门攻击

This post recaps our recent webinar "How MSSPs Can Leverage Automation to Reduce Alerts & Maximize their Analysts." Check it out to see key takeaways related to their automation journey.

近日，绿盟科技CERT监测到致远OA前台任意用户密码修改漏洞，由于用户在修改密码时短信验证码认证存在缺陷，攻击者可以通过构造恶意数据修改任意用户密码，导致任意用户登录，进一步利用可实现远程代码执行。

近日，绿盟科技CERT监测发现Google官方修复了一个堆缓冲区溢出漏洞（CVE-2023-4863），攻击者通过诱导用户访问恶意网站触发该漏洞，最终导致在目标系统上任意执行代码。目前已监测到该漏洞存在在野利用。

文末附带福利哦~

This is the second installment in a series revisiting the User-Defined Reflective Loader (UDRL). In part one, we aimed to simplify the development and debugging of custom loaders and introduced the User-Defined Reflective Loader Visual Studio (UDRL-VS) template. In this installment, we’ll build upon the original UDRL-VS loader and explore how to apply our own [...]

Read More... from Revisiting the User-Defined Reflective Loader Part 2: Obfuscation and Masking

The post Revisiting the User-Defined Reflective Loader Part 2: Obfuscation and Masking appeared first on Cobalt Strike.

With a mention in the new National Cyber Workforce and Education Strategy and even a dedicated state law , K–12 cybersecurity education clearly has the eye of policymakers. However, despite public attention and new opportunities for high school students to pursue cybersecurity coursework, high schools often struggle to provide students with a clear understanding of what cybersecurity careers actually look like. Hands-on learning experiences, like those we’ve had at our schools and during our internship with NICE at NIST, can help bring cybersecurity education and career pathways into focus for

征集一种方法

有趣的XSS系列 二

当TemplatesImpl被resolveClass拉黑时，如何使用JDK 中的类绕过黑名单

“我去过很多宇宙，但最喜欢这里。你们宇宙最棒的地方就是一切行为都会有后果。这太罕见了。大部分宇宙都乱糟糟的。”

2023年NISL实验室教师节活动

分享一个在护网中使用的漏洞挖掘思路。

背景

因为工作需求要去验证一些PoC，而很多PoC需要开natives-syntax才能跑，如果转成纯JS实现又需要花更多时间，所以需要在Android的app/webview里也实现添加 js-flags，方便后面搞分析 :)

详细讲解如何使用JNI加密字节码，通过JVMTI解密字节码以保护代码

书接上回，对 Spring 全家桶中的 URL 解析和鉴权代码进行分析。