2016/12/30 資安晨摘

漏洞分析：

1.thinksaas任意文件讀取 by Joseph

2.Android: Heap-overflow in "tlc_server" via LOAD_TUI_RESOURCE command by laginimaineb

3.CHECK POINT DISCLOSES 3 PHP 0-DAYS by Check Point

4.HackingElasticSearch by Wallarm_d0znpp


惡意軟體分析：

1.Switcher: Android joins the ‘attack-the-router’ club by Nikita Buchka


硬體安全分析：

1.Ghost in the PLC Designing an Undetectable Programmable Logic Controller Rootkit via Pin Control Attack by Ali Abbasi1、Majid Hashemi


釣魚姿勢：

1.Shortcuts: another neat phishing trick by Rik van Duijn


PT測項：

1.LtR101: Web Application Testing Methodologies by Andy G


基礎概念教學：

1.SQL Attack (Constraint-based) by Dhaval Kapil

2.從CTF中學USB流量捕獲與解析 by ELPH

3.如何在Kali Linux下編譯Windows Exploit by HACKING TUTORIALS；翻譯：MottoIN

4.Why do XSS strings often start with ">? by Arminius

5.Intel CPU security features by Chariton Karamitas


工具：

1.Reflected-File-Download-Checker-BurpSuite-Plugin by onurkarasalihoglu

2.Web Application Testing - Tooling by Andy G

3.IoTSeeker by rapid7


其他：

1.SCADA Vulnerabilities and Exposures Database by critifence

2.Windows X86 System Call Table by Vexillium_Mateusz ‘j00ru’ Jurczyk