Aggregator

上课和搬砖的闲暇时间摸鱼打了个第五空间网络安全大赛，也就随意看了看Misc题。

See the most recent research from Amit Serper on a vulnerability in Autodiscover from Microsoft Outlook that affects credential leaks.

Managing hardened systems without exposing them to unwanted attack vectors is difficult. Jump boxes are one way to do it—learn why and how.

Managing hardened systems without exposing them to unwanted attack vectors is difficult. Jump boxes are one way to do it—learn why and how.

The TCP three-way handshake is one of the critical building blocks of the internet. It facilitates the smooth and consistent flow of information across and among different networks without compromising security.

null is one of the most active, open security communities since 2010. One of the main objectives for null is spreading information security awareness. Keeping that aim in mind, null has started null Study Groups. About null Study Groups null Study Group is a place where like-minded people get together and learn about different domains of security like web, cloud, etc.

本文主要介绍如何为自定义的 CodeQL 规则创建测试文件，以及如何使用 test run 子命令执行测试。

为 CodeQL 自定义查询规则编写测试

前言 这篇博客打算重点介绍一下IAST相关的内容，以及IAST如何在DevSecOps中的CI/CD中的结合。做一期大杂烩，同时也是对我这半年多来的实习一次技术总结。 大致需要了解的内容为： CI/CD的介绍 DevOps的介绍 IAST的介绍 在Jenkins流水线引入IAST CI/CD的介绍

另一种方式的指纹识别

New to the scene, monster-sized botnet Mēris is raising some eyebrows with giant requests per second (rps) attacks as shared by Cloudflare (17.2M rps, reported August 19), Yandex (peaking at 21.8M rps on September 5), and KrebsOnSecurity (2M rps on September 9). Some commentary came in on Slashdot, The Record, and The Hacker News.

设备指纹技术是使用更多的信息来完成对终端设备的唯一性识别，在业务中可以有效辨别设备是真实用户还是机器在注册、登录，及时检测出单设备登入多帐号、防止批量注册、登录等操作行为。

设备指纹技术是使用更多的信息来完成对终端设备的唯一性识别，在业务中可以有效辨别设备是真实用户还是机器在注册、登录，及时检测出单设备登入多帐号、防止批量注册、登录等操作行为。

设备指纹技术是使用更多的信息来完成对终端设备的唯一性识别，在业务中可以有效辨别设备是真实用户还是机器在注册、登录，及时检测出单设备登入多帐号、防止批量注册、登录等操作行为。