Aggregator

IOS逆向之appsflyer平台解密

浮萍
3 years 4 months ago
0x00 前言

前段时间有这样一个需求，需要抓一下IOS端下appsflyer这个平台的数据，于是就帮忙看了一下。这里其实和APP没多大关系，需要接入appsflyer这个平台的APP就可以，然后将抓包获取的加密数据进行解密。

浮萍

记一次简单计算验证码的识别过程

浮萍
3 years 4 months ago
0x00 前言

某CMS的验证码是简单的计算验证码，都是一位数的加减乘除运算，之前尝试用分割的方法识别，但成功率较低。后来采用了pytorch训练后进行识别，可以达到98%以上的识别率，于是整理一下过程，水一篇文章。

浮萍

记一次APP爬虫比赛

浮萍
3 years 4 months ago
0x01 前言

5月中旬的时候，猿人学举行了一个APP爬虫大赛，共设10题，主要涉及Android反混淆，双向认证，tls指纹对抗等技术。而且只需要答对一题就有参与奖，即可获得一件猿人学定制T恤。另外第一题不涉及so，仅涉及java层加密。为了T恤，立马去报了名参赛。

浮萍

BlueBleed Data Leak

X-Force Exchange - Collection Feed
3 years 4 months ago
Summary SOCRadar, a cyber intelligence company, has reported that they have discovered a data leakfrom a Microsoft Azure Blob Storage location. Microsoft has acknowledged the incident. However, details on the severity of the leak vary between Microsoft and the SOCRadar report. Threat Type Data Leak Overview Microsoft has published a blog on their Security Response Center in response to a report from a cyber intelligence company called SOCRadar. SOCRadar discovered and reported on a data leak in a misconfig

ROPC - So, you think you have MFA?

Embrace The Red
3 years 4 months ago

This post will highlight a pattern I have seen across multiple production Microsoft Azure Active Directory tenants which led to MFA bypasses using ROPC.

The key take-away: Always enforce MFA! Sounds easy, but there are often misconfigurations and unexpected exceptions. So, test your own AAD tenant for ROPC based MFA bypass opportunities.

Github: https://github.com/wunderwuzzi23/ropci

Update: The latest free issue of Pentest Magazine has a ropci article. Check it out.

Student Insights on Cybersecurity Careers

NIST | Cybersecurity Insights
3 years 4 months ago
Hi, our names are Aubrie, Kyle, and Lindsey! We participated in internships at the National Initiative for Cybersecurity Education (NICE) Program Office this past year. This is a career pivot for Aubrie, meaning this is her introduction to cybersecurity from another career; she is earning her master’s with a concentration in cybersecurity. Kyle was an undergraduate intern majoring in Computer Engineering. He is almost finished with his education and will soon be transitioning into the workforce. Lindsey is a high school member of the program. The three of us come from different academic and
Aubrie Kendall, Kyle Truong, Lindsey Walter

Trustlook's Integration with OKC (OKX Chain)

Trustlook
3 years 4 months ago

San Jose, California, Oct. 19, 2022, Trustlook, the global leader of  AI-powered cybersecurity, today announced an integration with OKC (OKX Chain) an EVM-compatible L1 built on Cosmos with a focus on true interoperability (IBC) and maximized performance. Trustlook will provide their extensive portfolio of blockchain security products to OKC, which

Lifan Xu

Java Apache Commons Text Vulnerability

X-Force Exchange - Collection Feed
3 years 4 months ago
Summary A remote code execution vulnerability has been disclosed in Java Apache Commons Text. This vulnerability affects all versions prior to 1.10.0. Users of Apache Commons Text are advised to upgrade in order to mitigate this vulnerability. Threat Type Vulnerability Overview ***Update #1, October 19, 2022*** A proof-of-concept has been released by SeanWrightSec on GitHub. At present, there is no indication of this exploit being used in the wild. However, with a PoC released, organizations should be on

浅谈云原生安全建设

leveryd
3 years 4 months ago
背景我想总结一下我理解的云原生安全，内容源于我的工作经历、我看到的公开分享、最近面试时被问到的。kubern

浅谈云原生安全建设

leveryd
3 years 4 months ago
背景我想总结一下我理解的云原生安全，内容源于我的工作经历、我看到的公开分享、最近面试时被问到的。kubern

浅谈云原生安全建设

leveryd
3 years 4 months ago
背景我想总结一下我理解的云原生安全，内容源于我的工作经历、我看到的公开分享、最近面试时被问到的。kubern

Managed ad