Aggregator

While the main goal for any security team is avoiding a breach, having a comprehensive preparedness plan for when an attack occurs is equally, if not more, crucial.  This month, our host Peter Manev is joined by Xavier Ashe, senior vice president of Truist’s Cyber Defense Division. 

During the episode Xavier shares fascinating stories from the front lines of the cybersecurity industry and explains the importance of organizations being ready and able to quickly pivot and recover from adverse cyber events. Will your plan stand up to the test? 

Xavier also sheds light on the competitive nature of the cyber industry, especially for newcomers, and why aspiring enthusiasts should embrace the challenges and focus on understanding how the internet and security function. 

Tune in this month for a riveting discussion that unveils the necessity of being cyber resilient and offers invaluable insights for industry newcomers.

在某次测试过程中，遇到了这样一个网站，存在登录页面但却无法直接通过地址栏访问login页面。在 JS 文件中发现了默认密码，同时找到了登录接口，然而密码进行了加密。通过分析JS文件，最终通过两种方式来实现了登录，一种是找到密码的加密方法，一种是让登录接口”重见天日”。

由于之前用的手机是IPhone6s，版本是12.4，有一些APP打开会直接闪退，于是换了一部6sp，版本是14.6。对其进行越狱，安装一些所需要的插件，并记录一下过程。

Jumpserver是一个开源的django架构的堡垒机系统，由lawliet & zhiniang peng(@edwardzpeng) with Sangfor在上个月报送了这个漏洞

• https://github.com/jumpserver/jumpserver/security/advisories/GHSA-7prv-g565-82qp

漏洞原理其实比较神奇，一个常用的第三方组件库django-simple-captcha有泄露随机数种子的问题，再配合Jumpserver使用了错误的随机数方案导致了最终的漏洞。