cnbird_个人页

Metasploit jboss deployment file repository exploit

MC pushed out a new exploit today (jboss_deploymentfilerrepository) so while it lists 4.

Using the Metasploit PHP Remote File Include Module

Metasploit has a nifty PHP Remote File Include module that allows you to get a command shell from a RFI.

Watch Your WHOIS Entries

Thanks to sites like the Sucuri Security blog, domain name administrators should be learning tha...

Kerberos 协议

http://zh.wikipedia.org/zh/Kerberos   OpenSSH on Linux using Windows/Kerberos for Authentication  http://port25.

Nginx Security Law

Please Check your server. http://www.80sec.com/nginx-securit.

Remote Installation Service (RIS) in Windows Server 2003

http://www.computerperformance.co.uk/w2k3/W2K3_RIS.

Security Templates

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/sag_scedefaultpols.

SCW 入门

http://technet.microsoft.com/zh-cn/library/cc787506(WS.

Invision Power Board Multiple SQL Injection Vulnerabilities

apache.org incident report for 8/28/2009

https://blogs.apache.org/infra/entry/apache_org_downtime_report ...

信息系统审计书籍

计算机审计案例 http://www.china-pub.com/14264#ml   计算机信息系统审计 http://www.

iso 27001手册以及信息安全范文

http://item.taobao.com/auction/item_detail.htm?item_num_id=5093912577 ...

Lock down Windows Server 2003 with the Security Configuration Wizard

http://articles.techrepublic.com.com/5100-10878_11-6081763.

microsoft 安全风险管理指南

http://www.microsoft.com/china/technet/security/guidance/secrisk/default.

IT研发人员不能说的秘密-13种泄密方式

对IT研发人员来说，有些秘密是不能说的。法律是战争爆发的底线。与其事后诉诸法律，不如防范于未然，通过制度和技术保障，让机密不大白于天下。

ITIL 2010考题

http://search.taobao.com/search?q=2010+itil&from=rs&navlog=rs-3-q-2010+itil     CISA http://search.

List of Free Firewalls for Windows!

http://pentestit.com/2010/04/04/list-free-firewalls-windows/ ...

信息安全国家标准全集

http://www.csres.com/s.jsp?keyword=%D0%C5%CF%A2%B0%B2%C8%AB+GB&xx=on&wss=on&zf=on&fz=on&pageSize...

securitytube.net security video update

1.Building a Blind TCP IP Hijacking Tool http://www.

防SSLtrip攻击解决方案

由于目前一种专门针对SSL、HTTPS的新型攻击工具在网上广泛传播，严重影响SSL/HTTPS所保护的用户身份等敏感信息数据的安全性。

rel=nofollow互联网为超链接戴上安全套

http://www.google.com/support/webmasters/bin/answer.py?hl=cn&answer=96569 http://www.dmseo.com/seo/seo_18_893.html   摘要:Google联合Yahoo! MSN和主要Blog服务提供商:推出一个新的搜索引擎收录服务标准，超链的rel="nofollow"属性。

Defeating SSL using SSLStrip

http://securitytube.net/Defeating-SSL-using-SSLStrip-(Marlinspike-Blackhat)-video.

cisco pentest tools

http://www.mirrorservice.org/sites/ftp.isc.org/isc/IRRToolSet/ http://pwhois.

Medium security hole in Varnish reverse proxy

Hi,I've identified a couple of security flaws affecting the Varnish reverse proxy which may allow privilege escalation.

Scanning windows Deeper with nmap Scanning Engine

http://www.sans.org/reading_room/whitepapers/testing/scanning_windows_deeper_with_the_nmap_scann...

hacking oracle笔记

###author:hiphop### ###qq:70381908###为什么要关注 Oracle ?因为Oracle 被大量企业所使用,有许多目标可以选择来渗透许多企业都没有更新且有潜在的...

sudo protection bypass exploit

#!/bin/sh## root shell exploit for postfix + sudo# tested on debian powerpc unstable## by Charle...

薪酬体系的制定

 在我们身边经常听到以下的话题和牢骚：     “小王啊听说你的工资又涨了？你在单位干的一不定很不错。

Joomla's RFI Summary

#######################################################################/ ## ...

PHP in the user agent (attacking log analysis tools?)

Lately I started to see a few web-based attacks with a php script inside the user agent.

The Importance of logging for web applications - Security talk

If you think that your logs are only useful when something crashes or when you need to troublesh...

Apache.org defaced - Security archive case study

May 5th, 2000. It was almost ten years ago that news came out.

WEBLOGIC 10 server hardending

http://download.oracle.com/docs/cd/E12840_01/wls/docs103/sitemap.

Bypassing CSRF protections wich clickjacking and http parameter Pollution

This idea occurred to me a few weeks back when discussing the potential impact of ClickJacking attacks with Luca.

CITRIX: Owning the Legitimate Backdoor

The other day I was performing some CITRIX poking, so I had a lot of fun with breaking GUIs, whi...

ncpfs, Multiple Vulnerabilities

============================================ ncpfs, Multiple Vulnerabilities March 5, 2010 CV...

Top 10 Hacks of 2009 and WAF Mitigations

Jeremiah Grossman gave his “2010: A Web Hacking Odyssey – The Top Ten Hacks of the Year” talk he...

WordPress Exploit Scanner

http://wordpress.org/extend/plugins/exploit-scanner/

IIS Web Server Security

With the sharp increase of hacking attacks over the last couple of years, and the introduction o...

Java编译错误“No enclosing instance of type AA is accessible. Must qualify the allocation with an enclosing instance of type SimpleTh

这是因为AA是一个动态的内部类，创建这样的对象必须有实例与之对应，程序是在静态方法中直接调用动态内部类会报这样错误。

securitytube video update

http://www.securitytube.net/SSH-Gymnastics-using-ProxyChains-video.

IBM WebSphere解决方案

http://tech.it168.com/wec.shtml http://baike.baidu.

Apache Spamassassin Milter Plugin Remote Root Command Execution

Description: The Spamassassin Milter plugin suffers from a remote root command execution vulnerability.

websphere 视频教程列表

http://www.webspherechina.net/club/tag-WebSphere%E8%A7%86%E9%A2%91.

再探偏移注射

转自t00ls 关于Union偏移注射这个东西，最早貌似是lake2大黑客提出来的，以前一直当他是鸡肋，没去关注过，直到昨天遇到一个mysql 4.1的点。

单点登录和企业目录

http://www.56cto.com/html/Safe/4/34302.html http://www.

mysql的比较运算

在menzhi007的blog里看到非常有意思的东西：http://hi.baidu.com/menzhi007/blog/item/c2e98551a18754848c54301c.

Security Ressources Sites

Security Ressources SitesOperating systems architecture http://www.

OpenLDAP学习笔记

http://www.ringkee.com/note/opensource/openldap.

Using OpenLDAP with Microsoft SQL Server and Oracle Backend Databases

http://www.easysoft.com/applications/openldap/back-sql-odbc.