{"title": "狩猎二进制重命名", "url": "https://www.freebuf.com/articles/others-articles/237473.html", "time": "2020-06-16", "level": "", "num_look": 1048, "num_comment": 1, "author": "Avenger", "tags": ["其他"], "text": "ATT&CK 技术项编号为 T1036 的二进制重命名技术，正在被越来越多的恶意软件所采用，本文介绍如何使用多种方法对该技术进行监控与检测。"}
{"title": "超全！CIS Controls中英双语对照", "url": "https://www.freebuf.com/articles/es/237502.html", "time": "2020-06-16", "level": "现金奖励", "num_look": 31589, "num_comment": 5, "author": "吞龙", "tags": ["企业安全"], "text": "CIS是一个社区驱动的非营利组织，负责管理维护CIS Controls®和CIS benchmark™，全球公认保护IT系统和数据的最佳实践。CIS领导全球IT专业人士不断发展这些标准，并提供产品和服务，积极防范新出现的威胁。"}
{"title": "全国23省市“新基建”网安任务重点梳理", "url": "https://www.freebuf.com/news/240329.html", "time": "2020-06-16", "level": "", "num_look": 3575, "num_comment": 1, "author": "Sandra1432", "tags": ["标准与合规", "资讯"], "text": "新基建从未像今天这样，被寄予厚望。中央及地方政府频频发声，相关政策密集出台。"}
{"title": "十年归来，仍是少年 | FreeBuf十周年重磅改版即将上线", "url": "https://www.freebuf.com/fevents/240241.html", "time": "2020-06-16", "level": "红色标题", "num_look": 3061, "num_comment": 9, "author": "FB客服", "tags": ["活动"], "text": "当初小小机房里的那个论坛，怀揣着“改变这个行业”的初心，在这个十年里，已然茁壮成长。但是，这还不够。因为我们还有下一个十年，为了迎接更好的我们，向下一个十年出发，我们做出了一个决定：重大改版，全面升级。"}
{"title": "为攻防对抗，细谈微隔离", "url": "https://www.freebuf.com/articles/neopoints/237386.html", "time": "2020-06-16", "level": "", "num_look": 7102, "num_comment": 2, "author": "安全狗safedog", "tags": ["观点"], "text": "在越来越关注攻防对抗实战防护能力的今天，在零信任网络被炒的越来越热的今天，我们重新审视按照这些新理念构建的纵深防御体系，结果发现依然问题重重。"}
{"title": "D-Link DIR878路由器命令执行漏洞分析", "url": "https://www.freebuf.com/vuls/237533.html", "time": "2020-06-16", "level": "现金奖励", "num_look": 12938, "num_comment": 2, "author": "黄培扬payoung", "tags": ["漏洞", "终端安全"], "text": "本文复现了D-Link DIR878型号当中存在的一个命令执行漏洞，漏洞编号CVE-2019-8316，漏洞链接。"}
{"title": "FreeBuf早报｜新的移动互联网协议漏洞使黑客瞄准4G或5G用户；勒索病毒不只攻击电脑，主流 NAS服务器也成头号目标；为了反对种族歧视，代码托管平台GitHub可能要改术语了", "url": "https://www.freebuf.com/news/240299.html", "time": "2020-06-16", "level": "红色标题", "num_look": 11471, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "新发布的研究警告说，可以利用移动网络运营商（MNO）使用的现代通信协议中的高影响力漏洞来拦截用户数据，并进行假冒、欺诈和拒绝服务（DoS）攻击。"}
{"title": "周三15点开播 | HTTPS在互联网安全领域的应用与实践公开课", "url": "https://www.freebuf.com/open/240214.html", "time": "2020-06-15", "level": "红色标题", "num_look": 9912, "num_comment": 3, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "6月17日下午15:00，天威诚信资深技术专家、天威诚信SSL业务技术负责人陈大鹏将带来《HTTPS在互联网安全领域的应用与实践》公开课，为大家深入解析关于HTTPS的内容。"}
{"title": "意大利公司出售加密器给恶意软件团伙，获利超过50万美元", "url": "https://www.freebuf.com/news/240203.html", "time": "2020-06-15", "level": "", "num_look": 16185, "num_comment": 4, "author": "日影飞趣", "tags": ["资讯"], "text": "意大利公司CloudEyE通过将其二进制加密器出售给恶意软件团伙而获得了超过500,000美元的收入。"}
{"title": "实战笔记：滑动验证码攻防对抗", "url": "https://www.freebuf.com/articles/web/238038.html", "time": "2020-06-15", "level": "现金奖励", "num_look": 60456, "num_comment": 16, "author": "N10th九号", "tags": ["WEB安全"], "text": "在业务安全领域，滑动验证码已经是国内继，传统字符型验证码之后的标配。"}
{"title": "Intercept：一套强大的代码静态分析审计策略", "url": "https://www.freebuf.com/articles/database/237069.html", "time": "2020-06-15", "level": "", "num_look": 13286, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["数据安全"], "text": "INTERCEPT是一套强大的代码静态分析审计策略，这套策略集简单易用，占用空间小，可以通过快速且强大的多行扫描工具来扫描你的代码库。"}
{"title": "中国光大银行总行信息安全团队招聘启事", "url": "https://www.freebuf.com/jobs/240122.html", "time": "2020-06-15", "level": "", "num_look": 22472, "num_comment": 3, "author": "yuantao", "tags": ["安全招聘"], "text": "中国光大银行（CHINA EVERBRIGHT BANK、光大银行）成立于1992年8月，是经国务院批复并经中国人民银行批准设立的全国性股份制商业银行，总部设在北京。"}
{"title": "精选公开课 | 5月FreeBuf公开课集锦强势来袭", "url": "https://www.freebuf.com/open/240080.html", "time": "2020-06-15", "level": "红色标题", "num_look": 10909, "num_comment": 2, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "让我们来一起回顾下5月公开课的精彩内容吧~"}
{"title": "工业控制系统蜜罐的初步介绍", "url": "https://www.freebuf.com/articles/ics-articles/237518.html", "time": "2020-06-15", "level": "", "num_look": 19704, "num_comment": 4, "author": "等待未来66大顺", "tags": ["工控安全"], "text": "随着科技的发展，工业控制系统逐渐的接入互联网，而当前互联网上存在着大量的攻击，直接影响着工业控制系统的安全，工控系统面临的安全形势也越来越严重。"}
{"title": "FreeBuf早报｜Lamphone：通过观察房间里的灯泡来监视对话；D-Link发布了一个新的安全固件；特斯拉废弃零件存在泄密隐患", "url": "https://www.freebuf.com/news/240157.html", "time": "2020-06-15", "level": "红色标题", "num_look": 29145, "num_comment": 3, "author": "日影飞趣", "tags": ["资讯"], "text": "以色列内盖夫本古里安大学和Lamphone 研究人员演示了如何仅通过测量灯泡发出的光量来远程监视附近房间中的秘密对话。"}
{"title": "6月17日直播预告|“云安全体系建设及HTTPS最佳实践方案”线上沙龙", "url": "https://www.freebuf.com/fevents/239736.html", "time": "2020-06-15", "level": "", "num_look": 28849, "num_comment": 1, "author": "FB客服", "tags": ["活动"], "text": "在数字化业务已成主流的今天，企业基础设施架构正发生着重大变化，传统的安全模式已无法为快速变化的应用和日益增长的用户提供足够的保护。"}
{"title": "2020第一季度安全威胁分析", "url": "https://www.freebuf.com/articles/network/237302.html", "time": "2020-06-14", "level": "", "num_look": 23219, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "第一季度因为冠状病毒在全世界爆发，网络犯罪分子加强了对该主题的利用。"}
{"title": "DEDECMS伪随机漏洞 (二) ：Cookie算法与Rootkey随机强度分析", "url": "https://www.freebuf.com/vuls/236360.html", "time": "2020-06-14", "level": "", "num_look": 21540, "num_comment": 21540, "author": "光通天下", "tags": ["漏洞", "网络安全"], "text": "本篇为《DEDECMS伪随机漏洞 (一) ：PHP下随机函数的研究》的续篇，研究DEDECMS的cookie生成的算法, 以及rootkey生成的算法, 确认rootkey使用的随机算法的强度, 计算攻击耗时。"}
{"title": "Wireshark分析实验：一次病毒入侵报文的分析", "url": "https://www.freebuf.com/articles/network/237631.html", "time": "2020-06-14", "level": "现金奖励", "num_look": 28961, "num_comment": 1, "author": "GalaxyLu", "tags": ["网络安全"], "text": "一次抓包，可能会有几万个报文，熟练地使用过滤功能，可以快速定位到需要分析的内容。在这里过滤http报文，直接对http报文进行分析。"}
{"title": "Terrier：一款功能强大的镜像&容器安全分析工具", "url": "https://www.freebuf.com/articles/terminal/236070.html", "time": "2020-06-13", "level": "", "num_look": 27804, "num_comment": 27804, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "Terrier是一款针对OCI镜像和容器的安全分析工具，Terrier可以帮助研究人员扫描OCI镜像和容器文件，并根据哈希来识别和验证特定文件是否存在。"}
{"title": "挖洞经验 | 雷蛇电子钱包APP漏洞分析", "url": "https://www.freebuf.com/vuls/237273.html", "time": "2020-06-13", "level": "", "num_look": 33800, "num_comment": 33800, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "作者通过APP逆向分析，利用Frida调试，发现了雷蛇支付电子钱包（Razer Pay Ewallet）中的用户签名（Signature）生成漏洞。"}
{"title": "使用ZoomEye寻找APT攻击的蛛丝马迹", "url": "https://www.freebuf.com/sectool/237758.html", "time": "2020-06-13", "level": "", "num_look": 37381, "num_comment": 2, "author": "知道创宇404实验室", "tags": ["工具"], "text": "今年一月发布的ZoomEye 2020里上线了ZoomEye的历史数据查询API接口，这个历史数据接口还是非常有价值的，这里就介绍我这几天做的一些尝试追踪APT的几个案例。"}
{"title": "SRC漏洞挖掘信息收集与挖掘技巧", "url": "https://www.freebuf.com/articles/web/237876.html", "time": "2020-06-13", "level": "现金奖励", "num_look": 45486, "num_comment": 6, "author": "HONGSON", "tags": ["WEB安全"], "text": "分享自己常用的“信息收集”思路以及漏洞挖掘技巧。信息收集在渗透测试中的地位不言而喻，你拥有的“资产信息”决定你的漏洞产出。"}
{"title": "Nuclei：一款快速自定义模板扫描工具", "url": "https://www.freebuf.com/articles/network/235745.html", "time": "2020-06-12", "level": "", "num_look": 31127, "num_comment": 31127, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "Nuclei是一款运行速度非常快的扫描工具，它可以帮助研究人员基于模板执行可配置的目标扫描任务，并提供大量可扩展接口以辅助使用。"}
{"title": "以威胁情报视角看最近超算系统受攻击事件", "url": "https://www.freebuf.com/vuls/237119.html", "time": "2020-06-12", "level": "", "num_look": 28211, "num_comment": 4, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "有报道称英国爱丁堡大学（The University of Edinburgh）用来进行新冠病毒研究的超算系统Archer，由于遭受网络攻击，被迫下线停止工作。"}
{"title": "鼎信测评诚招渗透测试工程师", "url": "https://www.freebuf.com/jobs/239523.html", "time": "2020-06-12", "level": "", "num_look": 53721, "num_comment": 1, "author": "鼎信测评DX", "tags": ["安全招聘"], "text": "河南省鼎信信息安全等级测评有限公司（以下简称“鼎信测评”）成立于2011年，是一家专业从事计算机系统安全等级技术测评与安全技术服务的高科技企业。"}
{"title": "如何隐藏多人运动的证据？时间刺客之数据加密篇", "url": "https://www.freebuf.com/articles/database/236214.html", "time": "2020-06-12", "level": "现金奖励", "num_look": 98836, "num_comment": 11, "author": "阿哥有鸟无巢", "tags": ["数据安全"], "text": "多人运动心潮澎湃，深夜开黑，饥渴难耐。"}
{"title": "黑灰产的廉价“温床”—跑分平台", "url": "https://www.freebuf.com/articles/network/237120.html", "time": "2020-06-12", "level": "", "num_look": 57606, "num_comment": 2, "author": "暗影安全实验室", "tags": ["网络安全"], "text": "根据我们以往的经验，这很有可能是诈骗团伙使用第三方平台获取的收款码或银行卡信息来逃避追责，以降低安全风险，或者平台跑路。"}
{"title": "日志标准化解析的关键内容", "url": "https://www.freebuf.com/articles/network/239475.html", "time": "2020-06-12", "level": "", "num_look": 33682, "num_comment": 4, "author": "secisland", "tags": ["安全管理", "网络安全"], "text": "之前的文章中阐述过五种最常见的关联分析模型，在文中也介绍了：要想达到很好的关联分析效果，前提是对采集过来的日志进行标准化解析。"}
{"title": "操作系统基线检查脚本", "url": "https://www.freebuf.com/sectool/237396.html", "time": "2020-06-12", "level": "现金奖励", "num_look": 44491, "num_comment": 12, "author": "freewill", "tags": ["工具"], "text": "写这个脚本的起因是，某厂商对我司出售客户那边的产品做基线检查，发现操作系统存在很多不符合项，需进行整改。拿到了对方的检测报告，于是就有了这个脚本，原报告暂不方便直接给出，后续我处理一下再给出来吧。"}
{"title": "FreeBuf早报｜英特尔处理器又曝两个SGX新漏洞，攻击者可轻松提取敏感数据；为协助FBI追捕罪犯 Facebook对嫌疑人展开黑客攻击；Windows 10 SMBv3新漏洞可用于数据盗窃和RCE攻击", "url": "https://www.freebuf.com/news/240045.html", "time": "2020-06-12", "level": "红色标题", "num_look": 55859, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "ARM漏洞发现是Google发起的Safeside计划的其中一部分研究结果，目前只在ARMv8-A，也就是Cortex-A系列处理器里发现。"}
{"title": "黑客组织头目服刑10年，出狱后成网络“文盲”", "url": "https://www.freebuf.com/news/239936.html", "time": "2020-06-11", "level": "", "num_look": 111495, "num_comment": 8, "author": "kirazhou", "tags": ["资讯"], "text": "长达10年的技术隔离。"}
{"title": "深入分析NukeSped RAT", "url": "https://www.freebuf.com/articles/others-articles/237416.html", "time": "2020-06-11", "level": "", "num_look": 26529, "num_comment": 26529, "author": "Avenger", "tags": ["其他"], "text": "朝鲜 APT 组织 HIDDEN COBRA 使用的远控工具 NukeSped 出现了新样本，分析人员对其进行了详细的分析与归因的判断。"}
{"title": "HiveJack：一款安全研究Windows凭证导出工具", "url": "https://www.freebuf.com/articles/system/236979.html", "time": "2020-06-11", "level": "", "num_look": 21971, "num_comment": 21971, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "HiveJack是一款专用于内部渗透测试过程中的Windows凭证导出工具，在该工具的帮助下，广大安全研究人员不仅可以轻松地从一台已成功入侵的设备中获取到SYSTEM、SECURITY和SAM注册表内容，而且还可以在导出这些Windows…"}
{"title": "攻防实战之蓝队视角下的战前准备", "url": "https://www.freebuf.com/articles/es/239219.html", "time": "2020-06-11", "level": "现金奖励", "num_look": 93755, "num_comment": 14, "author": "snail2333", "tags": ["企业安全"], "text": "孙子兵法中曾讲到“知己知彼，百战不殆”。"}
{"title": "假冒SpaceX的YouTube频道骗取15万美元比特币", "url": "https://www.freebuf.com/news/239948.html", "time": "2020-06-11", "level": "", "num_look": 32884, "num_comment": 32884, "author": "Avenger", "tags": ["资讯"], "text": "骗子通过仿冒 SpaceX 的 YouTube 账户骗取成千上万的观众共计 15.31 万美元的比特币“捐款”。"}
{"title": "隐私问题，吴声威VS爱奇艺谁对谁错？", "url": "https://www.freebuf.com/articles/neopoints/239969.html", "time": "2020-06-11", "level": "", "num_look": 22995, "num_comment": 22995, "author": "Doraemon", "tags": ["观点"], "text": "首先YS君非常赞同法庭关于“超前点播案”中诉爱奇艺公司网络服务合同纠纷一案的宣判结果。VIP会员的已有正当利益必须坚决维护，这里给吴声威律师点个大大的赞。"}
{"title": "通过GIF图片可对Microsoft Teams用户账户进行劫持", "url": "https://www.freebuf.com/vuls/237034.html", "time": "2020-06-11", "level": "", "num_look": 41325, "num_comment": 4, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "近期，以色列安全公司cyberark通过Microsoft Teams的子域名劫持漏洞结合GIF图片传播，可以针对使用Microsoft Teams的组织机构实现用户数据窃取和全部Teams账户劫持。"}
{"title": "恶意软件通过虚构Black Lives Matter活动进一步传播", "url": "https://www.freebuf.com/news/239912.html", "time": "2020-06-11", "level": "", "num_look": 33238, "num_comment": 4, "author": "超不A的伞居柏", "tags": ["资讯"], "text": "最近，一起网络钓鱼电子邮件活动正在进行。威胁者通过“Black Lives Matter”（黑人人权运动）匿名投票传播TrickBot恶意软件。"}
{"title": "新浪微博回应被约谈：热搜、热门话题榜停更一周", "url": "https://www.freebuf.com/news/239914.html", "time": "2020-06-11", "level": "", "num_look": 53085, "num_comment": 7, "author": "日影飞趣", "tags": ["头条", "资讯"], "text": "6月10日，国家互联网信息办公室指导北京市互联网信息办公室，约谈新浪微博负责人，针对微博在蒋某舆论事件中干扰网上传播秩序，以及传播违法违规信息等问题，责令其立即整改."}
{"title": "Gartner 2020十大数据分析趋势", "url": "https://www.freebuf.com/articles/neopoints/239917.html", "time": "2020-06-11", "level": "", "num_look": 20924, "num_comment": 2, "author": "宇宸de研究室", "tags": ["观点"], "text": "这些数据和分析技术趋势将有助于在未来三到五年内加速更新、推动创新和重建社会。"}
{"title": "GlobeImposter勒索病毒新变种东山再起", "url": "https://www.freebuf.com/articles/system/236912.html", "time": "2020-06-11", "level": "", "num_look": 36153, "num_comment": 2, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "随着疫情的缓解，各地企业纷纷复工，而勒索病毒家族也并没有停下他们的脚步。"}
{"title": "CentOS 7系统使用firewalld防火墙创建包过滤规则", "url": "https://www.freebuf.com/sectool/237569.html", "time": "2020-06-11", "level": "现金奖励", "num_look": 39664, "num_comment": 6, "author": "regitnew", "tags": ["工具"], "text": "最近做了一些CentOS 7系统的安全加固，涉及到firewalld防火墙的配置。以前对iptables比较熟悉，用firewalld比较少，所以特意学习了firewalld的用法，并在这里分享。"}
{"title": "FreeBuf早报｜印度IT公司7年入侵1万多电子邮件账户，殃及多国政要；任天堂称黑客入侵后账户数量突破了300,000；黑客利用COVID-19危机，发送恶意软件", "url": "https://www.freebuf.com/news/239864.html", "time": "2020-06-11", "level": "红色标题", "num_look": 43935, "num_comment": 6, "author": "日影飞趣", "tags": ["资讯"], "text": "一家总部位于新德里的BellTroX信息技术公司为客户提供黑客服务，在7年里入侵了全球1万多个电子邮件账户，其中包括欧洲的政府官员、巴哈马的博彩大亨以及美国私募股权巨头和一些著名的投资机构。"}
{"title": "Django初次尝试编写Web漏洞扫描器挖坑记录", "url": "https://www.freebuf.com/articles/web/237522.html", "time": "2020-06-11", "level": "", "num_look": 54064, "num_comment": 8, "author": "国光", "tags": ["WEB安全"], "text": "Django 很适合用来写安全小工具，因为很多安全工具都是 Python 编写的，所以 Django 集成的话就可以少走很多弯路，又因为 Django 的官方文档比较全，目前 Django 最新的版本都已经到 Django3 了，很适合新手上手使…"}
{"title": "手机APP过度侵犯隐私，我们该如何保护个人信息？", "url": "https://www.freebuf.com/articles/database/239684.html", "time": "2020-06-10", "level": "红色标题", "num_look": 58445, "num_comment": 16, "author": "日影飞趣", "tags": ["专栏", "数据安全"], "text": "不久前微信团队在其官方平台上辟谣：“微信监听人们聊天记录”的消息，近日央视又曝光多起手机APP频繁自启动搜集用户隐私的事件。有关手机app侵犯个人信息安全的事件，可谓是一波未平一波又起。"}
{"title": "Sophos防火墙0day漏洞分析（一）", "url": "https://www.freebuf.com/articles/network/237571.html", "time": "2020-06-10", "level": "", "num_look": 36727, "num_comment": 36727, "author": "Kriston", "tags": ["网络安全"], "text": "攻击者使用了未知的SQL注入漏洞针对Sophos防火墙发起攻击，该漏洞可通过防火墙远程代码执行。攻击中使用了一系列Linux Shell脚本，下载了为防火墙操作系统编译的恶意软件。该攻击针对的是Sophos产品，旨在从防火墙…"}
{"title": "日本导弹机密信息疑似泄露，国防承包商成供应链攻击“头号靶子”", "url": "https://www.freebuf.com/news/239750.html", "time": "2020-06-10", "level": "", "num_look": 41684, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "针对三菱电机公司的网络攻击活动，可能导致日本\"高超音速滑翔导弹\"（HGV）的指标机密信息泄露。"}
{"title": "印度IT公司7年入侵1万多电邮账户 多国商业政要遭殃", "url": "https://www.freebuf.com/news/239695.html", "time": "2020-06-10", "level": "", "num_look": 32665, "num_comment": 4, "author": "超不A的伞居柏", "tags": ["资讯"], "text": "一家印度黑客公司7年内入侵了全球超过1万个电子邮件账户。"}
{"title": "应急响应之SqlServr.exe挖矿病毒行为分析", "url": "https://www.freebuf.com/articles/system/236927.html", "time": "2020-06-10", "level": "现金奖励", "num_look": 140687, "num_comment": 10, "author": "bbbbbbig", "tags": ["系统安全"], "text": "接到朋友电话，说客户现场存在PowerShell的异常进程，针对现象进行分析。"}
{"title": "本田公司遭受网络攻击被迫暂停部分生产", "url": "https://www.freebuf.com/news/239809.html", "time": "2020-06-10", "level": "", "num_look": 33478, "num_comment": 3, "author": "日影飞趣", "tags": ["资讯"], "text": "本田遭遇了极为惨烈的勒索软件攻击，在攻击中，本田的服务器访问，电子邮件和内部系统受损，并且日本以外的生产系统也产生了影响。"}
{"title": "红队技巧：攻防演练中常见的Azure Web App服务", "url": "https://www.freebuf.com/articles/system/236990.html", "time": "2020-06-10", "level": "", "num_look": 39185, "num_comment": 3, "author": "周大涛", "tags": ["系统安全"], "text": "在本博客中，我将介绍如何将Azure App Services用于进攻目的。您可能会问什么是Azure应用服务？"}
{"title": "北京暗泉信息诚招人才", "url": "https://www.freebuf.com/jobs/238780.html", "time": "2020-06-10", "level": "", "num_look": 33610, "num_comment": 4, "author": "anquanxinxi", "tags": ["安全招聘"], "text": "北京暗泉信息技术有限公司（简称暗泉信息）是以国内十年以上资深信息安全从业人员为核心的、在新的信息安全形势下专业从事网络信息安全技术的自主创新型企业。"}
{"title": "话题讨论 | 聊聊你所了解的黑灰产中的“第四方支付”", "url": "https://www.freebuf.com/articles/neopoints/239514.html", "time": "2020-06-10", "level": "红色标题", "num_look": 68649, "num_comment": 11, "author": "Sandra1432", "tags": ["观点"], "text": "支付宝、微信等第三方支付如今已经普及开来了，深入人们生活的方方面面，极大地便利人们的生活。"}
{"title": "SpringBoot2.2.x 版本CPU增高BUG", "url": "https://www.freebuf.com/articles/web/234448.html", "time": "2020-06-10", "level": "现金奖励", "num_look": 33297, "num_comment": 6, "author": "hsw123123", "tags": ["WEB安全"], "text": "项目在上线之后，运行24小时之后CPU突然增高，导致不得不重启机器。"}
{"title": "FreeBuf早报｜本田暂停部分生产，或因网络攻击；日本军工传出噩耗，高超音速导弹信息被泄露；CallStranger UPnP漏洞影响数十亿台设备", "url": "https://www.freebuf.com/news/239652.html", "time": "2020-06-10", "level": "红色标题", "num_look": 48693, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "本田正在应对全球计算机网络中断的问题，该问题导致本田中断了其部分北美生产工作。"}
{"title": "电动车电子钥匙重放（我要偷电动车养你）", "url": "https://www.freebuf.com/articles/wireless/236839.html", "time": "2020-06-10", "level": "现金奖励", "num_look": 49932, "num_comment": 4, "author": "꧁", "tags": ["无线安全"], "text": "汽车的电子钥匙可以重放，电动车的肯定更容易，只要重复造轮子就能偷尽学校的电动车，迎娶漂亮学姐，走向人生巅峰？"}
{"title": "交通信号灯曝严重漏洞，可人为操控引发交通瘫痪", "url": "https://www.freebuf.com/news/239632.html", "time": "2020-06-09", "level": "", "num_look": 60270, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "入侵交通信号系统来控制红绿灯是我们常在电影中看到的场景，攻击者利用这种方式进行犯罪活动，可如今它却发生在现实生活中。"}
{"title": "针对德国用户投递Netwire RAT", "url": "https://www.freebuf.com/articles/others-articles/236919.html", "time": "2020-06-09", "level": "", "num_look": 18556, "num_comment": 1, "author": "Avenger", "tags": ["其他"], "text": "近日，研究人员发现一个针对德国用户的垃圾邮件攻击行动，该行动通过 Excel 文件中的 PowerShell 代码传播 NetWire RAT。"}
{"title": "「FreeBuf 私享会」上海站“开聊”倒计时，报名仅剩3天！", "url": "https://www.freebuf.com/fevents/239480.html", "time": "2020-06-09", "level": "红色标题", "num_look": 40400, "num_comment": 5, "author": "FB客服", "tags": ["活动"], "text": "FreeBuf作者&读者首场线下交流活动即将拉开序幕，此次活动报名仅剩3天，想在这场私享会中碰撞出思想的火花？你不容错过！"}
{"title": "设备风控攻防新挑战：定制ROM改机", "url": "https://www.freebuf.com/articles/network/237821.html", "time": "2020-06-09", "level": "", "num_look": 36393, "num_comment": 2, "author": "永安在线", "tags": ["网络安全"], "text": "改机是黑产团伙大规模作恶所依赖的重要技术手段。通过改机，黑产可以批量伪造新设备，进而绕过甲方的业务风控。"}
{"title": "挖洞经验 | 由Google Voice插件触发的DOM-XSS漏洞", "url": "https://www.freebuf.com/vuls/236884.html", "time": "2020-06-09", "level": "", "num_look": 48191, "num_comment": 3, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文讲述了作者在安装了Google Voice插件的环境中，通过Gmail接收邮件时偶尔发现的一个DOM XSS漏洞，经对Google Voice插件的源代码分析，最终找到了漏洞根源。漏洞获得了谷歌$3,133.7的奖励。"}
{"title": "斗鱼安全招人啦", "url": "https://www.freebuf.com/jobs/239497.html", "time": "2020-06-09", "level": "", "num_look": 70678, "num_comment": 10, "author": "武汉斗鱼网络科技有限公司", "tags": ["安全招聘"], "text": "武汉斗鱼网络科技有限公司是中国直播行业龙头企业、中国互联网百强企业、中国十大软件著作权人、武汉市“独角兽”级互联网创业公司，目前稳坐直播行业头把交椅。"}
{"title": "被“偷窥”的我们：手机App频繁自启动收集隐私信息", "url": "https://www.freebuf.com/news/239544.html", "time": "2020-06-09", "level": "", "num_look": 61938, "num_comment": 11, "author": "日影飞趣", "tags": ["资讯"], "text": "“优学院”十几分钟访问手机照片文件近25000次；“TIM”一小时内自启动近7000次频繁读取通讯录；“全民K歌”“王者荣耀”“新浪微博”可唤醒手机里其余十几个App一起在后台偷偷运行……"}
{"title": "应急响应之X系统数据库篡改应急分享", "url": "https://www.freebuf.com/articles/web/236766.html", "time": "2020-06-09", "level": "现金奖励", "num_look": 156835, "num_comment": 11, "author": "bbbbbbig", "tags": ["WEB安全"], "text": "最近接到一客户电话，客户反馈：“单位A服务器数据库信息被修改，原本字段的内容被修改为其它”。"}
{"title": "英国新成立了一个网络军团", "url": "https://www.freebuf.com/news/239415.html", "time": "2020-06-09", "level": "", "num_look": 54433, "num_comment": 12, "author": "日影飞趣", "tags": ["资讯"], "text": "英国国防部长本·华莱士近日宣布，国防部将继续进行现代化改造以应对未来的威胁。"}
{"title": "以Docker容器的形式运行GVM-11", "url": "https://www.freebuf.com/articles/container/236909.html", "time": "2020-06-09", "level": "现金奖励", "num_look": 34576, "num_comment": 4, "author": "regitnew", "tags": ["容器安全"], "text": "前面我发表了一篇关于OpenVAS的文章，讲述如何以docker容器的方式运行OpenVAS进行漏洞扫描。"}
{"title": "越权漏洞之测试与修复", "url": "https://www.freebuf.com/articles/web/236988.html", "time": "2020-06-09", "level": "现金奖励", "num_look": 68455, "num_comment": 4, "author": "freebuf01", "tags": ["WEB安全"], "text": "这几年，开发人员的安全意识与安全开发水平都有了很大程度的提高。"}
{"title": "FreeBuf早报｜身份证丢失后被入职16家公司，网友：走上人生巅峰；美国民兵III核武器信息遭泄露；严重漏洞可使攻击者控制交通信号灯", "url": "https://www.freebuf.com/news/239504.html", "time": "2020-06-09", "level": "红色标题", "num_look": 60726, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "一黑客从美国军事承包商韦斯特赫（Westech）窃取了机密文件，该文件提供了美国民兵III核武器的关键信息。"}
{"title": "电商薅羊毛研究报告", "url": "https://www.freebuf.com/articles/network/238258.html", "time": "2020-06-09", "level": "金币+20", "num_look": 58510, "num_comment": 4, "author": "GEETEST极验", "tags": ["网络安全"], "text": "薅羊毛是从业者众多的一项黑灰产业，并且根生于各大互联网行业中，是企业风控管理的重要对象。"}
{"title": "一个价值十万美金的苹果认证机制0day漏洞分析", "url": "https://www.freebuf.com/vuls/239562.html", "time": "2020-06-09", "level": "", "num_look": 41747, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["数据安全", "漏洞"], "text": "如果我告诉你，我只需要拿到你的电子邮件ID，我就可以入侵你所有的网站以及App账号，我就问你怕不怕？"}
{"title": "预告｜2020西湖论剑·网络安全线上峰会，将同期上线7个分论坛", "url": "https://www.freebuf.com/fevents/239674.html", "time": "2020-06-09", "level": "", "num_look": 17224, "num_comment": 17224, "author": "杭州安恒信息", "tags": ["活动"], "text": "2020西湖论剑·网络安全线上峰会将于6月16日召开，主题为“数治安全 智理未来”。"}
{"title": "“未来网络安全20问”全球征集令", "url": "https://www.freebuf.com/fevents/239672.html", "time": "2020-06-09", "level": "", "num_look": 14881, "num_comment": 14881, "author": "杭州安恒信息", "tags": ["活动"], "text": "疫情蔓延全球，原本的工作与生活，围绕着抗疫进行展开。而正是这特殊时间，人们对网络需求场景越加明显。"}
{"title": "报名啦｜金融数字化转型安全讨论会", "url": "https://www.freebuf.com/fevents/239487.html", "time": "2020-06-08", "level": "", "num_look": 21044, "num_comment": 1, "author": "FB客服", "tags": ["活动"], "text": "疫情期间，金融机构纷纷推出新型的“非接触”线上金融服务场景。"}
{"title": "FreeBuf 咨询《2020中国漏洞管理解决方案研究报告》正式启动", "url": "https://www.freebuf.com/news/239025.html", "time": "2020-06-08", "level": "红色标题", "num_look": 52221, "num_comment": 1, "author": "FreeBuf咨询", "tags": ["安全报告", "资讯"], "text": "漏洞管理（Vulnerability Management）是一个老生常谈的概念，但也是信息安全领域里最为人熟知的、最需要被企业重视与落地的一个概念。"}
{"title": "浅谈Forrester零信任架构评估的7个技术维度", "url": "https://www.freebuf.com/articles/network/239395.html", "time": "2020-06-08", "level": "红色标题", "num_look": 47461, "num_comment": 9, "author": "Doraemon", "tags": ["网络安全"], "text": "零信任是由Forrester Research的分析师John Kindervag在2009开发，并在2010年正式提出的。在过去的10年间，随着云计算、移动互联等技术发展以及全球范围内部威胁的不断涌现，零信任越来越为产业界所接受。"}
{"title": "绝望的受害者：“虚假”勒索软件解密器的陷阱导致双重加密", "url": "https://www.freebuf.com/news/239394.html", "time": "2020-06-08", "level": "", "num_look": 35090, "num_comment": 4, "author": "kirazhou", "tags": ["资讯"], "text": "一个伪造的STOP Djvu勒索软件解密器正在传播，但实际上，但这只是诱使已经绝望的人们再度感染的陷阱。"}
{"title": "针对南亚的恶意软件BackConfig分析", "url": "https://www.freebuf.com/articles/network/236924.html", "time": "2020-06-08", "level": "", "num_look": 32360, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "在过去4个月中发现，Hangover组织使用BackConfig恶意软件，通过鱼叉式网络钓鱼攻击南亚的政府和军​​事组织。"}
{"title": "构建零信任网络安全的技术介绍", "url": "https://www.freebuf.com/articles/network/238809.html", "time": "2020-06-08", "level": "现金奖励", "num_look": 49763, "num_comment": 6, "author": "糖果L5Q", "tags": ["网络安全"], "text": "现在很多企业单位开始重视零信任网络安全的建设，基于代理流量和外部准入认证，对于外部可见的请求进行安全性的确认。"}
{"title": "汉化远控木马下发挖矿程序，利用肉鸡资源捞金", "url": "https://www.freebuf.com/articles/system/236732.html", "time": "2020-06-08", "level": "", "num_look": 43848, "num_comment": 4, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近日，深信服安全团队排查定位到一款伪装为Windows系统帮助文件的远控木马，攻击者通过远控木马下发挖矿程序到被害主机，占用主机资源进行挖矿。"}
{"title": "ret2syscall原理详解与实例分析", "url": "https://www.freebuf.com/articles/system/234228.html", "time": "2020-06-08", "level": "金币+20", "num_look": 46764, "num_comment": 4, "author": "菜鸡CaiH", "tags": ["系统安全"], "text": "对于初学pwn的同学来说，在学习ret2syscall的时候，看到其原理为“控制程序执行系统调用,获取 shell”，那么怎么理解“控制程序执行系统调用,获取 shell”这句话呢？"}
{"title": "FreeBuf早报｜后抗疫时期，储存着个人隐私的健康码该离开还是留下；当黑客瞄上航运网络，攻击量分分钟上涨4倍；因秘密收集用户数据，谷歌将至少50亿美元罚款", "url": "https://www.freebuf.com/news/239314.html", "time": "2020-06-08", "level": "红色标题", "num_look": 50715, "num_comment": 4, "author": "日影飞趣", "tags": ["资讯"], "text": "在一项拟议的集体诉讼中，谷歌被指控用户在浏览器“无痕隐身模式”的上网过程中仍然被跟踪采集个人上网数据，从而非法侵犯了自2016年6月1日以来的数百万用户的数据隐私。"}
{"title": "DSMM之数据销毁安全", "url": "https://www.freebuf.com/articles/database/236515.html", "time": "2020-06-08", "level": "金币+20", "num_look": 34272, "num_comment": 4, "author": "LJ_Monica", "tags": ["数据安全"], "text": "今天就来说一说数据安全生命周期的最后一个阶段——数据销毁安全。"}
{"title": "GoBrut僵尸网络新变种", "url": "https://www.freebuf.com/articles/others-articles/236935.html", "time": "2020-06-07", "level": "", "num_look": 23844, "num_comment": 23844, "author": "Avenger", "tags": ["其他"], "text": "使用 Go 编写的多平台 GoBrut 僵尸网络最近部署了新变种进行传播，同时正对数以百万计的 WordPress 网站进行爆破。"}
{"title": "PhantomLance多版本攻击分析", "url": "https://www.freebuf.com/articles/network/236398.html", "time": "2020-06-07", "level": "", "num_look": 27395, "num_comment": 27395, "author": "Kriston", "tags": ["网络安全"], "text": "2019年7月Dr. Web报道了Google Play中的后门木马，研究人员将其称为“PhantomLance”，它最早活动记录可追溯到2015年12月。"}
{"title": "新工具：使用USBCulprit窃取气隙计算机数据", "url": "https://www.freebuf.com/news/239303.html", "time": "2020-06-07", "level": "", "num_look": 34496, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "气隙计算机，简单来说，即完全断网的计算机设备。攻击气隙计算机即在PC设备不联网的情况下入侵获取数据。"}
{"title": "BUF大事件丨fastjson被曝“高危”远程代码执行漏洞；价值10万美金的Apple ID登录漏洞", "url": "https://www.freebuf.com/news/239301.html", "time": "2020-06-07", "level": "红色标题", "num_look": 44231, "num_comment": 2, "author": "willhuang", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，fastjson被曝存“高危”远程代码执行漏洞；Apple ID登录漏洞，无需密码登录用户账号。"}
{"title": "白盒系列之变量追踪引擎（一）", "url": "https://www.freebuf.com/articles/web/236537.html", "time": "2020-06-07", "level": "现金奖励", "num_look": 39149, "num_comment": 39149, "author": "nightmarelee", "tags": ["WEB安全"], "text": "在开始变量追踪的正式讲解之前，先概括的看一下目前各大厂对于白盒的使用情况，可以简单的概括为下图的模型。"}
{"title": "iOS逆向之人脸识别绕过", "url": "https://www.freebuf.com/vuls/236835.html", "time": "2020-06-07", "level": "现金奖励", "num_look": 53724, "num_comment": 4, "author": "LDrakura", "tags": ["漏洞"], "text": "人脸识别校验状态存储在服务端，因此即使通过该种方法绕过客户端人脸识别，由于并未获得合法session，因此无任何危害，仅做为IOS逆向学习思路。"}
{"title": "Zeek：高度定制化的DNS事件及文件还原", "url": "https://www.freebuf.com/sectool/236614.html", "time": "2020-06-06", "level": "红色标题", "num_look": 41872, "num_comment": 4, "author": "Shell.", "tags": ["工具"], "text": "本地环境中部署了2台NTA（Suricata）接收内网12台DNS服务器的流量，用于发现DNS请求中存在的安全问题。"}
{"title": "挖洞经验 | 用Chrome浏览器工具发现Gmail中的DOM XSS", "url": "https://www.freebuf.com/vuls/236621.html", "time": "2020-06-06", "level": "", "num_look": 51152, "num_comment": 1, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文讲述了作者用Chrome浏览器开发工具DevTool，在Gmail的跨域通信中发现了隐蔽的DOM XSS漏洞，最终收获了谷歌$5000的奖励。"}
{"title": "Modbus安全：M340停启和流量分析", "url": "https://www.freebuf.com/articles/ics-articles/236154.html", "time": "2020-06-06", "level": "现金奖励", "num_look": 36307, "num_comment": 7, "author": "黄一113530", "tags": ["工控安全"], "text": "这次为大家演示Schneider的PLC M340停启操作以及中间涉及的流量分析。"}
{"title": "Cowrie蜜罐的Docker部署过程及Elasticsearch+Kibana可视化", "url": "https://www.freebuf.com/articles/network/236525.html", "time": "2020-06-06", "level": "现金奖励", "num_look": 50909, "num_comment": 50909, "author": "FreeAChao", "tags": ["网络安全"], "text": "蜜罐是一种刻意让攻击者进入的设备，目前有很多应用场景，比如可以为威胁情报的信息采集提供信息。"}
{"title": "FCC以安全风险为由将中国企业排除在外", "url": "https://www.freebuf.com/news/239048.html", "time": "2020-06-05", "level": "", "num_look": 36719, "num_comment": 2, "author": "日影飞趣", "tags": ["资讯"], "text": "本周Pacific Networks及其全资子公司ComNet表示：希望美国联邦通讯委员会（FCC）不要关停其在美国的业务。"}
{"title": "基于golang+lua的Web日志安全分析系统", "url": "https://www.freebuf.com/sectool/238366.html", "time": "2020-06-05", "level": "现金奖励", "num_look": 72278, "num_comment": 3, "author": "leviath", "tags": ["WEB安全", "工具"], "text": "FBI-Analyzer是一个灵活的日志分析系统，基于golang和lua，插件风格类似ngx-lua。"}
{"title": "挖洞经验 | 从postMessage跨域通信中发现的Facebook DOM XSS（$20000）", "url": "https://www.freebuf.com/vuls/236373.html", "time": "2020-06-05", "level": "", "num_look": 57571, "num_comment": 5, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "文章讲述了作者分析Facebook开发者网站，从中发现网站postMessage()方法存在安全配置问题。"}
{"title": "永安在线（原威胁猎人）招聘安全人才", "url": "https://www.freebuf.com/jobs/238184.html", "time": "2020-06-05", "level": "", "num_look": 33985, "num_comment": 1, "author": "永安在线", "tags": ["安全招聘"], "text": "深圳永安在线科技有限公司是国际领先的反欺诈服务提供商。成立于2017年1月，致力于基于对黑灰产的布控能力，为互联网及金融行业提供反欺诈解决方案，为公安提供网络犯罪打击工具。"}
{"title": "一次对果聊诈骗的分析：那些你不知道的套路诈骗", "url": "https://www.freebuf.com/articles/others-articles/236005.html", "time": "2020-06-05", "level": "现金奖励", "num_look": 74063, "num_comment": 13, "author": "Jdicsp", "tags": ["其他"], "text": "突然有陌生“美女”加你微信，你第一反应是啥？"}
{"title": "通达OA远程命令执行漏洞分析", "url": "https://www.freebuf.com/vuls/236034.html", "time": "2020-06-05", "level": "金币+15", "num_look": 64255, "num_comment": 1, "author": "elvadisas", "tags": ["漏洞"], "text": "此文旨在学习web漏洞的研究方法并以此漏洞为实践，强化对web漏洞利用技术的认识，记录之。"}
{"title": "FreeBuf早报｜报道称美缉毒局被暂时授权对抗议者进行“秘密监视”；新的USBCulprit间谍工具窃取了气隙计算机的数据；新的Tycoon勒索软件针对Windows和Linux系统", "url": "https://www.freebuf.com/news/239112.html", "time": "2020-06-05", "level": "红色标题", "num_look": 44330, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "卡巴斯基（Kaspersky）近日发表的一项最新研究显示，一名黑客已经开发出新的工具来攻击气隙系统，以窃取敏感数据进行间谍活动。"}
{"title": "利用罗技漏洞制作一个特别的BadUSB", "url": "https://www.freebuf.com/geek/235527.html", "time": "2020-06-05", "level": "现金奖励", "num_look": 63416, "num_comment": 8, "author": "piptsmile", "tags": ["极客"], "text": "在2019年有研究人员发现了罗技的四个漏洞，分别是CVE-2019-13054   CVE-2019-13055   CVE-2019013052     CVE-2019-13053前两个漏洞官方修复了但是后两个漏洞将保持持续开放状态。"}
{"title": "报名仅剩5天 | FreeTalk线上沙龙，高能的白帽技术趴", "url": "https://www.freebuf.com/fevents/239064.html", "time": "2020-06-04", "level": "红色标题", "num_look": 33104, "num_comment": 1, "author": "FB客服", "tags": ["活动"], "text": "不变的技术深度，没看过的实操性干货，想不到的SAO操作，不容错过的精彩互动，活动报名已进入倒计时阶段，仅剩  5 天，入场资格已所剩不多，还没报名的小伙伴抓紧了！"}
{"title": "Frida-Fuzzer：一款针对API的内存模糊测试框架", "url": "https://www.freebuf.com/sectool/233013.html", "time": "2020-06-04", "level": "", "num_look": 49914, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具", "终端安全"], "text": "Frida-Fuzzer是一款针对API的内存模糊测试框架，该工具的设计和开发灵感来源于AFL/AFL++"}
{"title": "没装中国软件就弹出祝贺信息？谷歌下架印度热门App", "url": "https://www.freebuf.com/news/238995.html", "time": "2020-06-04", "level": "", "num_look": 104944, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "昨日，谷歌确认下架Play商店的一个印度应用程序，名为“Remove China App”（删除中国软件）。"}
{"title": "阿里安全钱磊：数字基建浪潮下，企业需要怎样的安全架构？", "url": "https://www.freebuf.com/articles/people/238757.html", "time": "2020-06-04", "level": "红色标题", "num_look": 272177, "num_comment": 9, "author": "Sandra1432", "tags": ["人物志"], "text": "今年政府工作报告提出，加强新型基础设施建设。这是自2018年底“新基建”概念提出以来，首次被写入政府工作报告。"}
{"title": "VMware Cloud Director中的关键漏洞将允许黑客接管组织的基础设施", "url": "https://www.freebuf.com/vuls/238886.html", "time": "2020-06-04", "level": "", "num_look": 44841, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["漏洞"], "text": "该漏洞的CVE编号为CVE-2020-3956，攻击者一旦成功利用该漏洞，那么将允许他们接管并滥用目标组织的网络服务器以及基础设施。"}
{"title": "24岁黑客多次入侵苹果服务器仅判缓刑", "url": "https://www.freebuf.com/news/239012.html", "time": "2020-06-04", "level": "", "num_look": 51772, "num_comment": 2, "author": "日影飞趣", "tags": ["资讯"], "text": "一名澳大利亚男子因从苹果公司的服务器中提取员工资料并在Twitter上发布，被判处5000澳元的罚款和18个月的观察期。"}
{"title": "我的主机是不是被gank了？Windows入侵排查初探", "url": "https://www.freebuf.com/articles/system/238860.html", "time": "2020-06-04", "level": "现金奖励", "num_look": 301318, "num_comment": 2, "author": "IceyHac", "tags": ["系统安全"], "text": "所以，凭什么说我的主机被入侵了呢？"}
{"title": "2020年第一季度APT趋势报告", "url": "https://www.freebuf.com/articles/network/235773.html", "time": "2020-06-04", "level": "", "num_look": 44308, "num_comment": 3, "author": "Kriston", "tags": ["网络安全"], "text": "卡巴斯基全球研究与分析团队（GReAT）两年多来一直在发布APT活动季度趋势报告，本文是在2020年第一季度观察到的活动。"}
{"title": "黑客利用Github机器人，仅100秒窃取1200美金的ETH", "url": "https://www.freebuf.com/news/238895.html", "time": "2020-06-04", "level": "", "num_look": 54635, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "“一名黑客得到了我的助记词，在 100 秒内从我的 Metamask 钱包里偷走了价值 1200 美元的ETH。”"}
{"title": "“黑玫瑰露西”回归-演变为勒索软件", "url": "https://www.freebuf.com/articles/terminal/236081.html", "time": "2020-06-04", "level": "", "num_look": 41801, "num_comment": 2, "author": "暗影安全实验室", "tags": ["终端安全"], "text": "长期以来，勒索软件攻击已成为安全领域的一部分。我们熟悉的臭名昭著恶意软件，例如CryptoLocker，WannaCry和Ryuk，它们全都对全球组织和私人资产造成了巨大破坏。"}
{"title": "总结机器学习与安卓恶意软件分析方案", "url": "https://www.freebuf.com/articles/neopoints/236703.html", "time": "2020-06-04", "level": "", "num_look": 31361, "num_comment": 4, "author": "战争贩子", "tags": ["观点"], "text": "根据安卓应用特点，我们可以风险分析分为静态与动态两种。分析的过程不执行应用的方法称之为静态分析。"}
{"title": "一个给新手进阶的IAT加密壳", "url": "https://www.freebuf.com/articles/system/235918.html", "time": "2020-06-04", "level": "现金奖励", "num_look": 52817, "num_comment": 2, "author": "m0h1e0", "tags": ["系统安全"], "text": "上篇文章（一份专供初学者食用的AES加密壳）中我们分析了一个简单的AES壳的加壳与解壳的过程，在加壳的过程中，直接将源程序加密后，追加到壳的最后一个节当中，这种壳可被秒脱。"}
{"title": "FreeBuf早报｜黑客使用Github机器人在100秒内盗取1200美元的ETH；美国持续从电信网络中剥离中国公司；iCloud经历短时宕机，用户遭遇登录和验证失败等问题", "url": "https://www.freebuf.com/news/238844.html", "time": "2020-06-04", "level": "红色标题", "num_look": 60350, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "在几天前，一个名叫Ty Cooper的Reddit用户就在短短100秒钟内，损失了1200美元的以太币。"}
{"title": "网络隐匿之道：减少痕迹、伪装迷惑", "url": "https://www.freebuf.com/articles/others-articles/235873.html", "time": "2020-06-04", "level": "金币+5", "num_look": 74746, "num_comment": 9, "author": "Pannet", "tags": ["其他"], "text": "行走于网络，总会留下痕迹。"}
{"title": "SpaceX火箭发射成功，勒索团伙入侵其IT供应商内网并留下祝贺信息", "url": "https://www.freebuf.com/news/238769.html", "time": "2020-06-03", "level": "", "num_look": 75043, "num_comment": 4, "author": "日影飞趣", "tags": ["资讯"], "text": "DopplePaymer勒索团伙在祝贺SpaceX和美国宇航局NASA首次载人火箭发射成功后，即刻宣布他们入侵了一家名为DMI的公司内网，这家公司正是NASA的一家IT承包商。"}
{"title": "预告 | 《2020中国网络流量监测与分析产品研究报告》即将发布", "url": "https://www.freebuf.com/news/238402.html", "time": "2020-06-03", "level": "红色标题", "num_look": 73185, "num_comment": 6, "author": "FreeBuf咨询", "tags": ["安全报告", "资讯"], "text": "被Gartner评选为2017年十一大信息安全新兴技术之一的NTA究竟是什么？网络流量监测与分析在攻防演练中如何有效应用？"}
{"title": "全球粮食供应链受到冲击，恐成网络战最新目标", "url": "https://www.freebuf.com/articles/neopoints/238021.html", "time": "2020-06-03", "level": "", "num_look": 25312, "num_comment": 25312, "author": "安数君", "tags": ["观点"], "text": "当全球最大的猪肉供应商史密斯菲尔德食品公司关闭美国工厂，泰森食品公司，嘉吉公司和美国JBS公司关闭肉类和家禽工厂，主流媒体头条新闻里醒目的字眼传递着让人不安的讯息——“美国濒临粮食短缺的边缘”。"}
{"title": "Jackdaw：一款带有SQL数据库的域名信息收集工具", "url": "https://www.freebuf.com/sectool/233010.html", "time": "2020-06-03", "level": "", "num_look": 52777, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具", "网络安全"], "text": "Jackdaw这款工具能够帮助广大研究人员收集关于目标域名的所有详细信息，并将这些数据存储在一个SQL数据库中。"}
{"title": "五月热榜 | 盘点FreeBuf热门文章&优秀作者，你上榜了吗？", "url": "https://www.freebuf.com/fevents/238414.html", "time": "2020-06-03", "level": "红色标题", "num_look": 67316, "num_comment": 14, "author": "FB客服", "tags": ["活动"], "text": "根据网站围观量、评论量，原创与否，我们统计了相关数据，评出FreeBuf五月「热门文章TOP10」、「原创作者TOP10」、「勤奋作者TOP3」三大榜单，你和你的佳作，上榜了吗？"}
{"title": "勒索不成搞拍卖？REvil公开喊价50000美元", "url": "https://www.freebuf.com/news/238748.html", "time": "2020-06-03", "level": "", "num_look": 39522, "num_comment": 4, "author": "超不A的伞居柏", "tags": ["资讯"], "text": "近日，勒索软件运营REvil建立了一个类似eBay的拍卖网站，他们表示，未来将在该网站上出售自己窃取到的企业数据。"}
{"title": "2020年第一季度DDoS攻击报告", "url": "https://www.freebuf.com/articles/network/236329.html", "time": "2020-06-03", "level": "", "num_look": 44711, "num_comment": 2, "author": "Kriston", "tags": ["网络安全"], "text": "2020年初以来受COVID-2019的影响，人们的生活完全转移到了网上，世界各地的人们在网上工作、学习、购物和娱乐。近期DDoS攻击的目标也反映了这一点。"}
{"title": "鼎信测评诚招渗透测试工程师", "url": "https://www.freebuf.com/jobs/238437.html", "time": "2020-06-03", "level": "", "num_look": 33741, "num_comment": 11, "author": "鼎信测评DX", "tags": ["安全招聘"], "text": "河南省鼎信信息安全等级测评有限公司（以下简称“鼎信测评”）成立于2011年，是一家专业从事计算机系统安全等级技术测评与安全技术服务的高科技企业。"}
{"title": "主机安全：洋葱Webshell检测实践与思考", "url": "https://www.freebuf.com/articles/system/238691.html", "time": "2020-06-03", "level": "", "num_look": 62295, "num_comment": 2, "author": "腾讯安全平台部", "tags": ["系统安全"], "text": "Webshell是网站入侵的常用后门，利用Webshell可以在Web服务器上执行系统命令、窃取数据等恶意操作，危害极大。"}
{"title": "6月5日见 | 字节跳动「安全范儿」沙龙第一期直播开启！", "url": "https://www.freebuf.com/open/237641.html", "time": "2020-06-03", "level": "红色标题", "num_look": 170488, "num_comment": 1, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "6月5日下午14:00-17:30，《字节跳动[安全范儿]沙龙——第1期：业务安全攻与防》即将开播。"}
{"title": "空指针Base on windows Writeup", "url": "https://www.freebuf.com/geek/236450.html", "time": "2020-06-03", "level": "", "num_look": 34611, "num_comment": 1, "author": "知道创宇404实验室", "tags": ["极客"], "text": "周末看了一下这次空指针的第三次Web公开赛，稍微研究了下发现这是一份最新版DZ3.4几乎默认配置的环境，我们需要在这样一份几乎真实环境下的DZ中完成Get shell。"}
{"title": "后堆栈时代的信息泄露漏洞挖掘思路", "url": "https://www.freebuf.com/vuls/237398.html", "time": "2020-06-03", "level": "", "num_look": 63149, "num_comment": 3, "author": "kingsoftsec", "tags": ["漏洞"], "text": "在后堆栈时代，安全人员在挖掘信息泄露类漏洞时，面临哪些机遇和挑战？"}
{"title": "CVE-2020-0729分析：LNK文件中的远程命令执行", "url": "https://www.freebuf.com/vuls/234534.html", "time": "2020-06-03", "level": "", "num_look": 64270, "num_comment": 1, "author": "s1len0eye", "tags": ["漏洞"], "text": "本文是趋势科技漏洞研究中心一篇漏洞报告的摘录，漏洞报告中详细介绍了最近的一个Microsoft Windows .LNK文件中的远程命令执行(RCE)漏洞。"}
{"title": "FreeBuf早报｜研究人员披露苹果登录系统的一个严重漏洞，获10万美元赏金；快递单裸奔、App过度索权，个人信息保护面临新挑战；执法活动正在削弱网络犯罪分子对暗网的信任", "url": "https://www.freebuf.com/news/238675.html", "time": "2020-06-03", "level": "红色标题", "num_look": 43219, "num_comment": 3, "author": "日影飞趣", "tags": ["资讯"], "text": "个人信息保护法的出台有望解决个人信息保护面临的突出问题，守好个人信息安全防线。"}
{"title": "代码克隆检测技术初探和开源工具地址分享", "url": "https://www.freebuf.com/sectool/233772.html", "time": "2020-06-03", "level": "金币+10", "num_look": 53303, "num_comment": 1, "author": "薇拉vera", "tags": ["工具"], "text": "代码克隆能够提高效率，但也可能意外引入外部漏洞。本文是对代码克隆检测技术的简单整理。"}
{"title": "漏洞赏金活动 | 高危赏金令：凭高危赢取额外高额漏洞奖金", "url": "https://www.freebuf.com/fevents/238666.html", "time": "2020-06-02", "level": "", "num_look": 40738, "num_comment": 40738, "author": "漏洞盒子", "tags": ["活动"], "text": "6月1日起，将在高危赏金令活动页面不定期放出不同级别的高危漏洞赏金项目，提交活动项目高危漏洞，即可赢取相应任务中的高危漏洞额外赏金，并获得专属活动称号。"}
{"title": "Elemental：一款功能强大的MITRE ATT&CK威胁库", "url": "https://www.freebuf.com/articles/network/235740.html", "time": "2020-06-02", "level": "", "num_look": 64954, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "Elemental是一款针对MITRE攻击技术的集中式威胁库。"}
{"title": "价值10万美金的Apple ID登录漏洞，无需密码完全接管你的账户", "url": "https://www.freebuf.com/news/238574.html", "time": "2020-06-02", "level": "", "num_look": 95529, "num_comment": 95529, "author": "Sandra1432", "tags": ["资讯"], "text": "苹果用户在使用APP或者登录网站账号时，不可避免地会遇到“使用Apple ID登录”的弹框提示，这种操作可以免去重新注册账号的麻烦。"}
{"title": "针对台湾地区的勒索软件ColdLock", "url": "https://www.freebuf.com/articles/network/236451.html", "time": "2020-06-02", "level": "", "num_look": 55937, "num_comment": 3, "author": "Kriston", "tags": ["网络安全"], "text": "近期名为ColdLock的勒索软件有针对性的攻击了台湾地区的几个组织，勒索软件会对数据库和电子邮件服务器进行加密。"}
{"title": "十年归来，仍是少年｜「FreeBuf 私享会」上海站报名启动！", "url": "https://www.freebuf.com/fevents/237017.html", "time": "2020-06-02", "level": "红色标题", "num_look": 76771, "num_comment": 4, "author": "FB客服", "tags": ["活动"], "text": "2010～2020，FreeBuf走过第一个十年，广大的Buffer们也和FreeBuf一同成长。现在我们即将开展首场「FreeBuf 私享会」，面向FreeBuf作者&读者，在这里尽可畅所欲言。"}
{"title": "SMB RPC类漏洞攻防对抗系列：利用SMB_COM_WRITE_ANX分割PRC流量特征", "url": "https://www.freebuf.com/vuls/235800.html", "time": "2020-06-02", "level": "", "num_look": 99514, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["漏洞", "系统安全"], "text": "本文是一系列SMB绕过文章中的第一篇，后续会进行持续的分享各种绕过SMB RPC类漏洞防御的方法"}
{"title": "FreeBuf老友记——宇宸｜他用三年的时间去弥补十年的遗憾", "url": "https://www.freebuf.com/articles/people/238480.html", "time": "2020-06-02", "level": "红色标题", "num_look": 124525, "num_comment": 7, "author": "shidongqi", "tags": ["人物志"], "text": "都说30岁是职业生涯的一个坎，基本在此之后都会有一个相对稳定的工作节奏。而宇宸32岁那年，正式离开东北老家去了杭州，用他的话说就是「从头开始」。"}
{"title": "FreeBuf早报｜你的微信被监听？腾讯回应：不会监测用户聊天记录，更不会据此推送广告；超过10万个使用PageLayer插件的WordPress网站易遭受攻击；黑客针对日本和欧洲工业企业开展隐写术攻击", "url": "https://www.freebuf.com/news/238488.html", "time": "2020-06-02", "level": "红色标题", "num_look": 84736, "num_comment": 4, "author": "Sandra1432", "tags": ["资讯"], "text": "PageLayer WordPress插件中的两个安全漏洞可被利用来秘密擦除内容或接管WordPress网站。PageLayer是WordPress页面构建插件，它非常易于使用。"}
{"title": "自己动手DIY：N1软路由", "url": "https://www.freebuf.com/geek/236219.html", "time": "2020-06-02", "level": "现金奖励", "num_look": 100609, "num_comment": 9, "author": "LEdge1", "tags": ["极客"], "text": "现在大家家里面都有路由器了。"}
{"title": "Modbus PLC攻击分析：Python和Mbtget读写PLC", "url": "https://www.freebuf.com/articles/ics-articles/235586.html", "time": "2020-06-02", "level": "金币+20", "num_look": 56655, "num_comment": 2, "author": "黄一113530", "tags": ["工控安全"], "text": "如今工业控制系统设计的领域包括交通运输、能源行业、装备制造、机械制造等多个国家关键基础领域。"}
{"title": "“佛洛伊德之死”引发全美骚乱，黑客组织“匿名者”入局", "url": "https://www.freebuf.com/news/238492.html", "time": "2020-06-01", "level": "红色标题", "num_look": 89667, "num_comment": 2, "author": "kirazhou", "tags": ["资讯"], "text": "赫赫有名的黑客组织“匿名者”正式入局，公开指责美国警方有“可怕的暴力和腐败记录”。"}
{"title": "限额报名开启｜FreeTalk线上白帽沙龙，白帽圈的独家带货姿势", "url": "https://www.freebuf.com/fevents/238010.html", "time": "2020-06-01", "level": "红色标题", "num_look": 53346, "num_comment": 1, "author": "FB客服", "tags": ["活动"], "text": "打破空间壁垒，跨越地域距离，难得的大咖分享，不变的技术深度，没看过的实操性干货，想不到的SAO操作，不容错过的精彩互动，在这场FreeTalk，ALL IN吧！"}
{"title": "Invoker：一款功能强大的渗透测试实用工具", "url": "https://www.freebuf.com/sectool/236088.html", "time": "2020-06-01", "level": "", "num_look": 84880, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Invoker是一款功能强大的渗透测试实用工具，在该工具的帮助下，广大研究人员可以通过GUI接口访问某些Windows操作系统功能，其中部分功能可能会要求管理员权限。"}
{"title": "格鲁乌的黑暗？揭露Sandworm黑客组织长达数月的邮件服务器劫持", "url": "https://www.freebuf.com/news/238417.html", "time": "2020-06-01", "level": "", "num_look": 41163, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "外媒报道：俄罗斯军方网络威胁者Sandworm已经利用一个版本的电子邮件服务器漏洞至少数月之久。"}
{"title": "挖洞经验 | 用多态图片实现谷歌学术网站（Google Scholar）XSS漏洞触发", "url": "https://www.freebuf.com/vuls/236182.html", "time": "2020-06-01", "level": "", "num_look": 108375, "num_comment": 4, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文讲述了作者利用多态图片触发谷歌学术网站（ Google Scholar）XSS漏洞的测试，漏洞最终获得了谷歌$9400的奖励。"}
{"title": "HackerOne宣布已向全世界白帽子支付了1亿美元赏金", "url": "https://www.freebuf.com/news/238334.html", "time": "2020-06-01", "level": "", "num_look": 90050, "num_comment": 6, "author": "日影飞趣", "tags": ["漏洞", "资讯"], "text": "截至 2020 年 5 月 底，HackerOne平台宣布，已经向全世界的白帽子们支付了 1 亿美元的赏金。\r\n\r\n该赏金是给予白帽子们发现并向组织报告了有效安全漏洞的奖励，以便各公司和机构可以更加安全地解决各项网络问题。"}
{"title": "《网络安全审查办法》今天起正式生效", "url": "https://www.freebuf.com/news/topnews/238393.html", "time": "2020-06-01", "level": "", "num_look": 72596, "num_comment": 4, "author": "日影飞趣", "tags": ["头条", "标准与合规"], "text": "《网络安全审查办法》于2020年6月1日开始实施。本文介绍了《网络安全审查办法》的全文与答记者问，你想了解的都在这里。"}
{"title": "基于指纹识别的漏洞扫描设计", "url": "https://www.freebuf.com/articles/es/235883.html", "time": "2020-06-01", "level": "", "num_look": 101427, "num_comment": 7, "author": "滴滴安全蓝军", "tags": ["企业安全"], "text": "漏洞扫描器大家都不陌生，几乎是每家公司必备的安全产品。几乎早在快10年前，作为安全乙方，就需要扛着一台极光扫描器，到全国各地去做各种安服。"}
{"title": "零知识证明：从“洞穴”到数字货币", "url": "https://www.freebuf.com/articles/blockchain-articles/235849.html", "time": "2020-06-01", "level": "", "num_look": 78435, "num_comment": 2, "author": "狴犴安全团队", "tags": ["区块链安全"], "text": "零知识证明是一种可在多方交互验证需求中实现隐私保护的密码学方案，用于在不泄露具体数据的情况下对数据知识的掌握或相关计算的正确性进行证明。"}
{"title": "FreeBuf早报｜Java库fastjson被曝存“高危”远程代码执行漏洞；NSA发警告：俄黑客组织Sandworm渗入电子邮件软件；研究人员发现“Apple 登录”安全漏洞：某些用户帐户可能被接管", "url": "https://www.freebuf.com/news/238368.html", "time": "2020-06-01", "level": "红色标题", "num_look": 71483, "num_comment": 4, "author": "Sandra1432", "tags": ["资讯"], "text": "上周，美国安局(NSA)警告公众，俄罗斯军方网络攻击者至少已经利用一个版本的电子邮件软件长达数月之久。"}
{"title": "黑科技：把手机DIY成一台硬件WAF", "url": "https://www.freebuf.com/articles/web/235835.html", "time": "2020-06-01", "level": "", "num_look": 88512, "num_comment": 6, "author": "w2sfoot", "tags": ["WEB安全", "极客"], "text": "WAF即Web应用防火墙（Web application firewall），是用于网站安全防护的。"}
{"title": "TorghostNG：一款功能强大的网络流量匿名化工具", "url": "https://www.freebuf.com/articles/network/236080.html", "time": "2020-05-31", "level": "", "num_look": 72551, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "TorghostNG是一款功能强大的网络流量匿名化工具，该工具基于Python3开发，并对TorGhost工具进行了重构。T"}
{"title": "Naikon APT组织分析", "url": "https://www.freebuf.com/articles/network/236076.html", "time": "2020-05-31", "level": "", "num_look": 49016, "num_comment": 2, "author": "Kriston", "tags": ["网络安全"], "text": "Naikon APT组织正在对亚太地区（APAC）国家政府进行网络攻击活动"}
{"title": "“Sauron Locker”家族病毒新变种", "url": "https://www.freebuf.com/articles/terminal/236158.html", "time": "2020-05-31", "level": "", "num_look": 48693, "num_comment": 1, "author": "暗影安全实验室", "tags": ["终端安全"], "text": "近期，我们发现了一款名为“Covid19”的病毒软件，其代码结构与“SauronLocker”家族病毒及其相似，我们怀疑是该病毒家族的新变种。"}
{"title": "BUF大事件丨泰国移动运营商泄露83亿互联网记录；StrandHogg 2.0安卓漏洞影响超过10亿台设备", "url": "https://www.freebuf.com/news/238352.html", "time": "2020-05-31", "level": "红色标题", "num_look": 52384, "num_comment": 52384, "author": "willhuang", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，三星手机因锁屏APP闰月bug无限重；StrandHogg 2.0安卓漏洞影响超过10亿台设备；泰国移动运营商泄露83亿互联网记录。"}
{"title": "Nazar APT组织分析", "url": "https://www.freebuf.com/articles/network/236253.html", "time": "2020-05-30", "level": "", "num_look": 47532, "num_comment": 47532, "author": "Kriston", "tags": ["网络安全"], "text": "最近，安全研究员透露了一个先前被错误识别且未知的威胁组织Nazar，本文将对Nazar组件进行深入分析。"}
{"title": "挖洞经验 | Townscript票务平台的任意账户劫持", "url": "https://www.freebuf.com/vuls/235776.html", "time": "2020-05-30", "level": "", "num_look": 85545, "num_comment": 2, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文讲述了印度票务平台Townscript缺乏速率限制，以及密码重置缺陷导致的任意账户劫持漏洞。"}
{"title": "高级威胁：Ramsay恶意软件针对隔离网络的攻击技术分析", "url": "https://www.freebuf.com/articles/network/238137.html", "time": "2020-05-30", "level": "", "num_look": 53689, "num_comment": 53689, "author": "腾讯电脑管家", "tags": ["网络安全"], "text": "近期，国外安全公司ESET发布了恶意软件Ramsay针对物理隔离网络的攻击报告，本文针对该物理隔离网络的一些攻击进行技术层面的分析。"}
{"title": "东欧杀手：Gamaredon APT组织定向攻击乌克兰事件分析", "url": "https://www.freebuf.com/articles/system/236131.html", "time": "2020-05-30", "level": "", "num_look": 49610, "num_comment": 49610, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "GamaredonAPT组织是疑似具有东欧背景的APT团伙，该组织攻击活动最早可追溯到2013年，其主要针对乌克兰政府机构官员，反对党成员和新闻工作者，以窃取情报为目的。"}
{"title": "西门子PLC的网络仿真搭建方法探讨", "url": "https://www.freebuf.com/articles/ics-articles/236250.html", "time": "2020-05-30", "level": "现金奖励", "num_look": 47060, "num_comment": 47060, "author": "thx0405", "tags": ["工控安全"], "text": "在手上没有真实的西门子PLC设备情况的情况下，PLC本地仿真器可以为我们进行开关量和简单模拟量的程序仿真。"}
{"title": "FreeBuf的十年之战", "url": "https://www.freebuf.com/news/238306.html", "time": "2020-05-29", "level": "红色标题", "num_look": 78685, "num_comment": 14, "author": "FB客服", "tags": ["资讯"], "text": "Free、Open、Share，这些在时代潮流中逐渐褪色的黑客精神，我们曾知道它们有多么闪闪发光。"}
{"title": "利用Domain+CDN隐藏VPS真实IP", "url": "https://www.freebuf.com/articles/network/236341.html", "time": "2020-05-29", "level": "", "num_look": 64577, "num_comment": 7, "author": "5h4d0w", "tags": ["网络安全"], "text": "在攻防演练中,目标在内网cs上线如果不做任何保护,自己的VPS很容易泄露IP。我们利用简单的域+CND来做一个简单的隐匿,增加防守溯源的一些难度。"}
{"title": "挖洞经验 | 一次性验证密码（OTP）的简单绕过", "url": "https://www.freebuf.com/vuls/234844.html", "time": "2020-05-29", "level": "", "num_look": 108335, "num_comment": 25, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "今天分享的是作者在众测过程中实现的一次性验证密码（OTP）绕过技巧，通过拦截修改响应中的内容即可有效绕过OTP，姿势非常简单，但也值得学习借鉴，一起来看看。"}
{"title": "设备指纹干扰与反干扰检测", "url": "https://www.freebuf.com/articles/web/235885.html", "time": "2020-05-29", "level": "红色标题", "num_look": 97130, "num_comment": 6, "author": "w2sfoot", "tags": ["WEB安全"], "text": "设备指纹，是安全场景中很常用的。"}
{"title": "GitLab任意文件读取漏洞CVE-2020-10977", "url": "https://www.freebuf.com/vuls/235982.html", "time": "2020-05-29", "level": "", "num_look": 97360, "num_comment": 2, "author": "深信服千里目安全实验室", "tags": ["WEB安全", "漏洞"], "text": "2020年4月28日，GitLab的一个任意文件读取漏洞的漏洞细节被公开。该漏洞补丁于2020年3月26号由GitLab官方发布。"}
{"title": "“三员系统”中常见的越权问题", "url": "https://www.freebuf.com/articles/web/235153.html", "time": "2020-05-29", "level": "", "num_look": 62408, "num_comment": 2, "author": "nercis", "tags": ["WEB安全"], "text": "越权访问（Broken Access Control，简称BAC）是Web应用程序中一种常见的漏洞，由于其存在范围广、危害大，被OWASP列为Web应用十大安全隐患的第二名。"}
{"title": "FreeBuf早报｜HackerOne向全球白帽子支付了1亿美元的赏金；房地产应用泄露了数千条用户记录和敏感私人消息；德国政府敦促iOS用户修复Mail应用程序的严重漏洞", "url": "https://www.freebuf.com/news/238099.html", "time": "2020-05-29", "level": "红色标题", "num_look": 74993, "num_comment": 6, "author": "日影飞趣", "tags": ["资讯"], "text": "Bug赏金平台HackerOne宣布，截至2020年5月26日，它已向全球白帽子 支付了1亿美元的奖励。"}
{"title": "挖洞经验 | 篡改JWT实现账户劫持", "url": "https://www.freebuf.com/vuls/235700.html", "time": "2020-05-28", "level": "", "num_look": 73798, "num_comment": 6, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "今天分享的这篇Writeup是关于JSON Web Tokens (JWT)的，其利用点是可以绕过用户邮件验证码确认，实现密码重置从而达到账户劫持目的。"}
{"title": "今晚7点直播见｜《攻防演练对企业安全运营的启示》公开课", "url": "https://www.freebuf.com/open/238034.html", "time": "2020-05-28", "level": "红色标题", "num_look": 43419, "num_comment": 2, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "5月28日（今天）晚上7点，斗象科技南区技术支持总监胡云海将为大家带来《攻防演练对企业安全运营的启示》直播公开课。分享攻防演练后双方在复盘中应重点关注的问题及思考方向，共同提升企业的安全防御能力。"}
{"title": "朝鲜APT组织Kimsuky的技术研究分析", "url": "https://www.freebuf.com/articles/network/233629.html", "time": "2020-05-28", "level": "", "num_look": 53299, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "我们将深入分析近期一个活动比较频繁的朝鲜APT组织，该组织名为Kimsuky，我们将对其所使用的攻击技术以及样本进行深入分析。"}
{"title": "国内“双枪”僵尸网络利用百度贴吧图像进行分发", "url": "https://www.freebuf.com/news/238039.html", "time": "2020-05-28", "level": "", "num_look": 63854, "num_comment": 63854, "author": "Sandra1432", "tags": ["资讯"], "text": "玩个游戏也能被黑客盯上？电脑设备一不小心就沦为“肉鸡”。僵尸网络潜藏在人们的日常生活中，表面看似波澜不惊，实则暗潮涌动。"}
{"title": "黑客使用Sophos防火墙中的0day漏洞部署勒索软件", "url": "https://www.freebuf.com/news/237659.html", "time": "2020-05-28", "level": "", "num_look": 47685, "num_comment": 4, "author": "日影飞趣", "tags": ["资讯"], "text": "黑客试图利用Sophos XG防火墙中的0day漏洞将勒索软件分发到Windows计算机，但遭到Sophos发布的修补程序阻止。"}
{"title": "Kimsuky APT组织利用假冒的ESET安全软件更新程序进行恶意活动", "url": "https://www.freebuf.com/articles/terminal/235603.html", "time": "2020-05-28", "level": "", "num_look": 58987, "num_comment": 2, "author": "亚信安全", "tags": ["终端安全"], "text": "新冠疫情的发展动态，仍然是全球关注的焦点，目前国外确诊病例已经超过300万，美国确诊病例将接近100万。"}
{"title": "CVE-2020-0796 SMBv3漏洞LPE利用调试分析", "url": "https://www.freebuf.com/articles/terminal/235349.html", "time": "2020-05-28", "level": "现金奖励", "num_look": 81093, "num_comment": 3, "author": "kczwa1", "tags": ["终端安全"], "text": "尝试重新调试走一遍，主要记录调试过程及其他文章中未能读懂的部分。"}
{"title": "FreeBuf早报｜英国政府将减少华为制造的设备在其5G网络中的存在；2600万份LiveJournal凭证在线泄漏；苹果修复iOS重大Bug，iPhone用户可以正常打开App", "url": "https://www.freebuf.com/news/237994.html", "time": "2020-05-28", "level": "红色标题", "num_look": 70888, "num_comment": 2, "author": "kirazhou", "tags": ["资讯"], "text": "HIBP数据泄露索引宣布，它收到了LiveJournal用户数据库的副本，并在其网站上对其进行了索引。"}
{"title": "一文全览两会信息技术提案", "url": "https://www.freebuf.com/news/237790.html", "time": "2020-05-28", "level": "", "num_look": 81904, "num_comment": 81904, "author": "宇宸de研究室", "tags": ["资讯"], "text": "互联网/IT行业代表们提交的两会提案有哪些？信息技术领域代表在两会关心的热点问题是什么？"}
{"title": "手机中的生物识别数据泄露漏洞分析", "url": "https://www.freebuf.com/vuls/235579.html", "time": "2020-05-28", "level": "", "num_look": 50459, "num_comment": 50459, "author": "SIGsecurity", "tags": ["漏洞"], "text": "OnePlus7 Pro 信息泄露漏洞在近日被披露。OnePlus 7 Pro10.0.3.GM21BA之前的版本中存在安全漏洞。攻击者可利用该漏洞从指纹感应器中获取指纹图像（位图）。新思科技对此漏洞进行了解析。"}
{"title": "三院士三委员共话“安全基建”：让数字基建的每块砖都安全可溯源", "url": "https://www.freebuf.com/news/237903.html", "time": "2020-05-27", "level": "", "num_look": 43342, "num_comment": 43342, "author": "kirazhou", "tags": ["资讯"], "text": "“新基建”在迎来风口的同时，也面临网络安全的挑战。"}
{"title": "“伪装下的窃密者”：安卓新型提权漏洞利用可伪装成正常APP窃取信息", "url": "https://www.freebuf.com/news/237914.html", "time": "2020-05-27", "level": "", "num_look": 68377, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "还记得去年银行卡余额神秘消失事件吗？幕后黑手“安卓系统的维京海盗” Strandhogg漏洞至今还让人心有余悸。"}
{"title": "DeathRansom：一款教育目的的Python勒索软件开发平台", "url": "https://www.freebuf.com/articles/network/235747.html", "time": "2020-05-27", "level": "", "num_look": 46245, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "DeathRansom是一款基于Python开发的勒索软件平台，DeathRansom生成的勒索软件将带有强大的绕过技术，该工具仅出于教育目的，请不要将其用于恶意行为。"}
{"title": "今晚7点直播｜教你「快速布置防守阵型的正确姿势」", "url": "https://www.freebuf.com/open/237803.html", "time": "2020-05-27", "level": "红色标题", "num_look": 43894, "num_comment": 43894, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "攻击浪潮来势汹汹，面对无孔不入的攻击队，如何守住自己的防线？"}
{"title": "挖洞经验 | COVID-19期间数百个曝露在互联网上的内部服务台系统（Service Desks）", "url": "https://www.freebuf.com/vuls/234996.html", "time": "2020-05-27", "level": "", "num_look": 84351, "num_comment": 2, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "作为intigriti众测平台的白帽主管，Inti De Ceukelaire在工作之余也会努力去发现漏洞。"}
{"title": "GDPR两周年，理想与现实的差距在哪？", "url": "https://www.freebuf.com/articles/database/237854.html", "time": "2020-05-27", "level": "红色标题", "num_look": 73563, "num_comment": 6, "author": "日影飞趣", "tags": ["数据安全"], "text": "2020年5月25日欧盟正式实施通用数据保护条例（GDPR）的两周年纪念日。然而两年来有关遵守该条例的数据表明，理想的条例遵守情况与现实发展之间存在重大脱节。"}
{"title": "新型间谍木马来袭", "url": "https://www.freebuf.com/articles/terminal/235526.html", "time": "2020-05-27", "level": "", "num_look": 64732, "num_comment": 5, "author": "暗影安全实验室", "tags": ["终端安全"], "text": "近些年，地下黑产组织针对全世界各国大型银行进行持续性的APT攻击，尤其是针对韩国、西班牙、葡萄牙等大型银行，采用仿冒、间谍软件、钓鱼劫持、勒索等技术手段。"}
{"title": "加密固件分析实战", "url": "https://www.freebuf.com/articles/terminal/234978.html", "time": "2020-05-27", "level": "", "num_look": 65542, "num_comment": 1, "author": "bey0nd", "tags": ["终端安全"], "text": "设备固件的安全性分析是IoT安全审计中非常重要的部分。获取固件是分析中的众多挑战之一，你可以通过多种技术来做到这一点。"}
{"title": "FreeBuf早报｜政协委员建议严格监管互联网弹窗广告；多个国家的在线商店遭黑客入侵；新冠病毒电信诈骗令美国人损失3900万美元", "url": "https://www.freebuf.com/news/237841.html", "time": "2020-05-27", "level": "红色标题", "num_look": 45317, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "全国政协委员陶桂芳建言，建议加大互联网弹窗广告的监管力度。当前在经济利益驱使下，部分网站、App客户端、软件利用弹出式广告，发布具有色情暴力、诱导消费、内容虚假、欺诈行为的垃圾有害信息。"}
{"title": "Modbus PLC攻击分析：Smod渗透框架研究", "url": "https://www.freebuf.com/articles/ics-articles/235047.html", "time": "2020-05-27", "level": "现金奖励", "num_look": 56659, "num_comment": 2, "author": "黄一113530", "tags": ["工控安全"], "text": "Modbus 是由Modicon公司1979年发行的，已经被广泛应用于工业控制现场的应用层协议，如Modbus协议已被广泛应用于在监控和控制现场设备。"}
{"title": "曝泰国最大移动运营商泄露83亿条用户数据记录", "url": "https://www.freebuf.com/news/237786.html", "time": "2020-05-26", "level": "", "num_look": 49031, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "昨日，安全研究人员Justin Paine在一篇文章中表明自己发现了一个公开的ElasticSearch数据库，而该数据背后所属直指泰国一家移动网络运营商分部AIS。"}
{"title": "CC攻击应急：自动拉黑IP的Shell脚本", "url": "https://www.freebuf.com/articles/web/235370.html", "time": "2020-05-26", "level": "现金奖励", "num_look": 97672, "num_comment": 10, "author": "mozili", "tags": ["WEB安全"], "text": "前两天参加面试，面试官问我：如果攻击方采用代理ip进行cc攻击，我们应该如何应急？"}
{"title": "精彩纪录 | 6张图带你回顾等保2.0公开课", "url": "https://www.freebuf.com/open/237776.html", "time": "2020-05-26", "level": "红色标题", "num_look": 62408, "num_comment": 62408, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "通过6张图，一起回顾这6期精彩的公开课吧！"}
{"title": "话题讨论 | 聊聊即将实施的《网络安全审查办法》", "url": "https://www.freebuf.com/articles/neopoints/237115.html", "time": "2020-05-26", "level": "红色标题", "num_look": 60475, "num_comment": 11, "author": "kirazhou", "tags": ["观点"], "text": "温故知新，重点讨论……"}
{"title": "挖洞经验 | 一次搞笑的航空里程奖励测试", "url": "https://www.freebuf.com/vuls/234744.html", "time": "2020-05-26", "level": "", "num_look": 89863, "num_comment": 2, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "我在众测平台上，针对一些奖励里程数的航空公司网站发起了安全测试，由于当时新冠疫情还没发生，所以我就想以挖洞方式获取一些航空里程奖励，好好出去旅游旅游。"}
{"title": "【FreeBuf字幕组】H1-202大赛“最具价值黑客”：André Baptista", "url": "https://www.freebuf.com/video/237682.html", "time": "2020-05-26", "level": "红色标题", "num_look": 45242, "num_comment": 45242, "author": "willhuang", "tags": ["视频"], "text": "André Baptista，葡萄牙人，2018年3月以一个价值$25,000美金的Shopify SSRF高危漏洞荣获H1-202大赛“最具价值黑客”称号。此次采访，André 和我们分享了如何保持挖洞动力，以及他自己的一些测试目标。"}
{"title": "多个国家的在线商店遭黑客入侵，SQL数据库正在出售", "url": "https://www.freebuf.com/news/237770.html", "time": "2020-05-26", "level": "", "num_look": 57591, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "黑客正在出售从多个国家的在线商店窃取的SQL数据库。"}
{"title": "今晚7点直播|《实战演练前的安全隐患排查工作指南》主题公开课", "url": "https://www.freebuf.com/open/237637.html", "time": "2020-05-26", "level": "红色标题", "num_look": 51866, "num_comment": 1, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "在演练前需要排查的安全隐患与风险有哪些？我们该通过怎样的技术手段进行事前排查？"}
{"title": "一份专供初学者食用的AES加密壳", "url": "https://www.freebuf.com/articles/system/235167.html", "time": "2020-05-26", "level": "现金奖励", "num_look": 101731, "num_comment": 11, "author": "m0h1e0", "tags": ["系统安全"], "text": "一个源程序加壳与解壳的过程。"}
{"title": "后疫情时期，初创企业安全生存指南", "url": "https://www.freebuf.com/articles/neopoints/237039.html", "time": "2020-05-26", "level": "", "num_look": 39453, "num_comment": 2, "author": "知道创宇KCSC", "tags": ["观点"], "text": "2020年初，疫情⿊天鹅突然降临，全球原本的发展节奏被打乱，众多创业公司更是危机重重。截至五月初，国内的疫情已得到有效控制，然而，国外的抗疫行动正面临严峻挑战。"}
{"title": "FreeBuf早报｜全国人大常委会工作报告：个人信息保护法将制定；泰国移动运营商泄露83亿互联网记录；三星手机黑屏系统崩溃，有用户维修后丢失1千多张照片", "url": "https://www.freebuf.com/news/237720.html", "time": "2020-05-26", "level": "红色标题", "num_look": 50801, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "研究人员发现了泰国移动运营商 Advanced Info Service (AIS)子公司控制的一个 ElasticSearch 数据库可公开访问，数据库包含大约 83 亿记录。"}
{"title": "利用驱动人生升级通道传播的木马溯源", "url": "https://www.freebuf.com/articles/system/225729.html", "time": "2020-05-26", "level": "现金奖励", "num_look": 76737, "num_comment": 3, "author": "xiaoxinling", "tags": ["系统安全"], "text": "最近在应急过程中，某单位电脑感染了更新后的驱动人生木马，需求为对病毒进行溯源，找到病毒的传播源与传播途径，防止内网机器其他被感染。"}
{"title": "FPS游戏反作弊系统设计：特征码扫描与启发扫描", "url": "https://www.freebuf.com/geek/235229.html", "time": "2020-05-26", "level": "现金奖励", "num_look": 59338, "num_comment": 6, "author": "huoji120", "tags": ["极客", "游戏安全"], "text": "本文将介绍特征码扫描与启发式扫描。"}
{"title": "WatchBird: 专为AWD而生的新一代纯PHP防火墙", "url": "https://www.freebuf.com/sectool/234402.html", "time": "2020-05-25", "level": "金币+15", "num_look": 74378, "num_comment": 2, "author": "goodclid", "tags": ["工具"], "text": "Watchbird是一个专门为AWD而生的PHP防火墙,采用纯PHP+JS+CSS编写而成,单文件设计模式,无任何外部依赖。"}
{"title": "启明星辰严望佳：关于推动人工智能赋能工业互联网安全发展的提案", "url": "https://www.freebuf.com/news/237694.html", "time": "2020-05-25", "level": "", "num_look": 39651, "num_comment": 1, "author": "kirazhou", "tags": ["资讯"], "text": "工业互联网是新一代信息通信技术与先进制造业深度融合所形成的新兴业态与应用模式。"}
{"title": "红队技巧：仿冒Windows登录", "url": "https://www.freebuf.com/articles/system/234747.html", "time": "2020-05-25", "level": "", "num_look": 100329, "num_comment": 8, "author": "周大涛", "tags": ["系统安全"], "text": "在本文中，我们将使用钓鱼技术来收集凭据。"}
{"title": "Linux流行病毒家族&清除方法集锦", "url": "https://www.freebuf.com/articles/system/235071.html", "time": "2020-05-25", "level": "", "num_look": 83913, "num_comment": 3, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "自2020年开始，深信服安全团队监测到Linux恶意软件挖矿事件大量增多，且有持续上升的趋势。"}
{"title": "「红蓝军演练之钥」第二期直播公开课即将开讲啦", "url": "https://www.freebuf.com/open/237331.html", "time": "2020-05-25", "level": "红色标题", "num_look": 71061, "num_comment": 7, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "「红蓝军演练之钥」第二期直播公开课5月26-28日每晚19:00开课"}
{"title": "云安全运营总结", "url": "https://www.freebuf.com/articles/security-management/236249.html", "time": "2020-05-25", "level": "", "num_look": 79617, "num_comment": 4, "author": "Haczhou", "tags": ["安全管理"], "text": "做云安全运营也有一年多时间了，对云上安全建设和运营有一点粗浅的经验，希望可以抛砖引玉，借此文章能有机会和大佬们交流 安全运营，安全建设方向的经验。"}
{"title": "IDA Pro进阶之签名文件制作", "url": "https://www.freebuf.com/articles/terminal/235070.html", "time": "2020-05-25", "level": "现金奖励", "num_look": 444104, "num_comment": 3, "author": "dolphin", "tags": ["终端安全"], "text": "最近使用IDA Pro查看一个x86的exe文件，发现为静态编译文件，其中包含大量的OpenSSL的库函数，于是上网搜索对应的签名文件，并没有找到该版本OpenSSL的库函数签名，便亲自做一个签名文件。"}
{"title": "FreeBuf早报｜任天堂泄露事件愈演愈烈，3DS操作系统源代码泄露；七成Chrome安全漏洞是内存安全问题；新出现的iOS Bug阻止部分App打开", "url": "https://www.freebuf.com/news/237564.html", "time": "2020-05-25", "level": "红色标题", "num_look": 78600, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "任天堂泄露事件愈演愈烈，目前3DS操作系统的完整源代码已经流传到了网上。这次的泄露虽然没有包含设计文档，不过包含了许多有趣的开发文件。"}
{"title": "网络战分析之「闪亮交响曲」行动", "url": "https://www.freebuf.com/articles/paper/235778.html", "time": "2020-05-25", "level": "红色标题", "num_look": 64106, "num_comment": 3, "author": "tasnrh", "tags": ["安全报告"], "text": "从2018年到2020年间，美国国家安全档案馆陆续收到并公开了有关解密后的美军对“ISIS组织”网络作战系列文件。伴随解密文件，我们也能得以一窥美军网络作战的组织、规划、协同、评估等部分细节。"}
{"title": "「2020 中国视频会议行业网络风险报告」发布", "url": "https://www.freebuf.com/articles/paper/237585.html", "time": "2020-05-25", "level": "", "num_look": 87134, "num_comment": 2, "author": "云科安信001", "tags": ["安全报告"], "text": "近年来，中国视频会议产业随着国家相关政策的引导及互联网经济的发展日驱成熟，产业链向着更加多元化、精细化方向发展，视频会议产业生态日渐完善。"}
{"title": "Outlaw黑客组织武器更新分析", "url": "https://www.freebuf.com/articles/network/234627.html", "time": "2020-05-24", "level": "", "num_look": 59421, "num_comment": 59421, "author": "Kriston", "tags": ["网络安全"], "text": "网络犯罪集团保持沉默不一定意味着没有活动，过去几个月一直保持沉默的黑客组织Outlaw更新了其武器库。"}
{"title": "在网络安全领域应用机器学习的困难和对策", "url": "https://www.freebuf.com/articles/neopoints/234939.html", "time": "2020-05-24", "level": "红色标题", "num_look": 61698, "num_comment": 3, "author": "安全狗safedog", "tags": ["观点"], "text": "网络安全领域的独特对抗属性给人工智能应用落地带来了重重困难，但我们并不认为这最终会阻碍人工智能成为网络安全利器。"}
{"title": "窥探裸聊诈骗背后黑色产业链的一角", "url": "https://www.freebuf.com/articles/terminal/235339.html", "time": "2020-05-24", "level": "", "num_look": 88317, "num_comment": 88317, "author": "奇安信威胁情报中心", "tags": ["终端安全"], "text": "近日，奇安信病毒响应中心在日常黑产挖掘过程中发现有人以裸聊的形式在社交网络上传播某种视频直播软件。"}
{"title": "技术讨论 | 某真实渗透实践案例分析", "url": "https://www.freebuf.com/vuls/235140.html", "time": "2020-05-24", "level": "", "num_look": 95917, "num_comment": 6, "author": "6cloud", "tags": ["工控安全", "漏洞"], "text": "网络渗透测试完全模拟黑客可能使用的攻击技术和漏洞发现技术，对目标系统的安全做深入的探测，发现网络脆弱环节，能直观的让网络管理员知道自己网络所面临的问题。"}
{"title": "BUF大事件丨两会提案盘点，聚焦网络安全；任天堂起诉Switch破解工具零售商", "url": "https://www.freebuf.com/news/237548.html", "time": "2020-05-24", "level": "红色标题", "num_look": 44578, "num_comment": 44578, "author": "willhuang", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，任天堂起诉Switch破解工具零售商；两会提案盘点，聚焦网络安全；程序员窃取公司《传奇霸业》源码被判刑。"}
{"title": "2021年网络黑产市场恐比肩世界第三大经济体", "url": "https://www.freebuf.com/articles/neopoints/237354.html", "time": "2020-05-23", "level": "", "num_look": 43566, "num_comment": 43566, "author": "Avenger", "tags": ["观点"], "text": "随着组织数字化，犯罪也随之数字化，地下犯罪产业正在前所未有地蓬勃发展。如今，网络犯罪已经成为一项庞大的业务，随着公司与消费者一同投入这个万亿美元的数字世界。"}
{"title": "滥用Google广告处置服务的勒索分析", "url": "https://www.freebuf.com/news/236920.html", "time": "2020-05-23", "level": "", "num_look": 39507, "num_comment": 1, "author": "Avenger", "tags": ["资讯"], "text": "近日，一种新型电子邮件勒索正在传播，针对的目标是通过 Google AdSense 服务投放广告的网站所有者。"}
{"title": "AgentTesla新变体分析", "url": "https://www.freebuf.com/articles/network/234356.html", "time": "2020-05-23", "level": "", "num_look": 44519, "num_comment": 44519, "author": "Kriston", "tags": ["网络安全"], "text": "AgentTesla是基于.Net的恶意软件，可从受害机器窃取不同应用程序的数据（例如浏览器，FTP客户端和文件下载器）。"}
{"title": "美商务部将360、云从科技等33家中国公司/机构列入“实体清单”", "url": "https://www.freebuf.com/news/237525.html", "time": "2020-05-23", "level": "红色标题", "num_look": 77970, "num_comment": 5, "author": "你要的白不是黑", "tags": ["资讯"], "text": "美国商务部5月22日宣布，将33家中国公司及机构列“实体清单”，其中24家实体被指为中国军方采购使用的物资。"}
{"title": "一文详解Webshell", "url": "https://www.freebuf.com/articles/web/235651.html", "time": "2020-05-23", "level": "", "num_look": 98847, "num_comment": 5, "author": "青藤云安全", "tags": ["WEB安全"], "text": "Webshell是黑客经常使用的一种恶意脚本，其目的是获得对服务器的执行操作权限，比如执行系统命令、窃取用户数据、删除web页面、修改主页等，其危害不言而喻。"}
{"title": "反诈骗之旅：诈骗软件又现新变种", "url": "https://www.freebuf.com/articles/terminal/234636.html", "time": "2020-05-23", "level": "", "num_look": 56540, "num_comment": 1, "author": "暗影安全实验室", "tags": ["终端安全"], "text": "一批针对中国、越南、马来西亚、美国等国用户的钓鱼软件。"}
{"title": "MetInfo5.3.19代码审计思路", "url": "https://www.freebuf.com/vuls/235093.html", "time": "2020-05-23", "level": "现金奖励", "num_look": 68459, "num_comment": 2, "author": "阔诺dio哒", "tags": ["WEB安全", "漏洞"], "text": "最近在学习代码审计，就想着拿个cms来练练手，然后选择了MetInfo5.3.19，来一次完整的代码审计，并把审计的思路都写下来。"}
{"title": "RMS-Runtime-Mobile-Security：一款针对Android Java类和方法的运行时分析工具", "url": "https://www.freebuf.com/articles/terminal/235742.html", "time": "2020-05-22", "level": "", "num_look": 59241, "num_comment": 59241, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "Runtime Mobile Security (RMS)是一款功能强大的Web接口，在它的帮助下，研究人员可以在运行时对Android Java类和方法进行分析和修改。"}
{"title": "今晚八点专家作者线上解读｜《网上银行系统信息安全通用规范》合规建设思路", "url": "https://www.freebuf.com/articles/es/228402.html", "time": "2020-05-22", "level": "现金奖励", "num_look": 414801, "num_comment": 8, "author": "haiczh", "tags": ["企业安全", "标准与合规"], "text": "2020年2月，中国人民银行发布了新版《网上银行系统信息安全通用规范》(JR/T 0068-2020)（以下简称“新标准”），对《网上银行系统信息安全通用规范》(JR/T 0068-2012)进行了更新。"}
{"title": "解密L0rdix RAT的C&C流量", "url": "https://www.freebuf.com/articles/others-articles/233304.html", "time": "2020-05-22", "level": "", "num_look": 46949, "num_comment": 46949, "author": "Avenger", "tags": ["其他", "网络安全"], "text": "本文介绍了 L0rdix 的控制面板与构建组件，并发现了控制面板中硬编码的密钥 3sc3RLrpd17。根据该密钥计算的 SHA-256 值用于加密/解密 C&C 流量的 AES 密钥，样本构建时也可以指定该密钥。"}
{"title": "LokiBot间谍木马再升级，窃取iOS应用信息", "url": "https://www.freebuf.com/articles/network/234877.html", "time": "2020-05-22", "level": "", "num_look": 51558, "num_comment": 1, "author": "亚信安全", "tags": ["网络安全"], "text": "近日亚信安全截获了LokiBot间谍木马最新变种，LokiBot是一款著名的间谍木马，其通过垃圾邮件传播，窃取用户敏感数据，包括浏览器、电子邮箱、ftp、sftp密码及凭证。"}
{"title": "CVE-2020-8816: Pi-hole中的远程代码执行漏洞分析及复现", "url": "https://www.freebuf.com/vuls/234533.html", "time": "2020-05-22", "level": "现金奖励", "num_look": 65398, "num_comment": 3, "author": "s1len0eye", "tags": ["漏洞"], "text": "CVE-2020-8816是Pi-hole软件中的一个远程代码执行漏洞，Pi-hole是一个用于内容过滤的DNS服务器，也提供DHCP服务。"}
{"title": "FreeBuf早报｜Xbox和Windows NT 3.5源代码被泄漏到网上；乌克兰逮捕黑客 Sanix；数以万计的以色列网站遭到破坏", "url": "https://www.freebuf.com/news/237434.html", "time": "2020-05-22", "level": "红色标题", "num_look": 64309, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "微软初代Xbox游戏机的源代码已经在网上泄露，同时泄露的还有Windows NT 3.5的代码。Xbox的源代码包括了该游戏机上的操作系统内核，是Windows 2000的定制版本。"}
{"title": "一次SQL注入到代码审计之路", "url": "https://www.freebuf.com/vuls/234382.html", "time": "2020-05-22", "level": "", "num_look": 171789, "num_comment": 3, "author": "lesssafe", "tags": ["WEB安全", "漏洞"], "text": "在测试时后发现有一个信息查询框，就是下面这个图片显示的。一般信息查询框会和数据库存在交互。"}
{"title": "美媒揭露疑点？以色列vs伊朗，港口袭击的幕后黑手", "url": "https://www.freebuf.com/news/237407.html", "time": "2020-05-21", "level": "", "num_look": 41199, "num_comment": 8, "author": "日影飞趣", "tags": ["资讯"], "text": "2020年5月18日美国《华盛顿邮报》披露，伊朗的阿巴斯港市的 Shahid Rajaei港口于本月初计算机系统遭受的攻击似乎是以色列发起的“报复”。"}
{"title": "两会盘点 | 聚焦网络安全，大佬们带来了哪些提案？", "url": "https://www.freebuf.com/news/237359.html", "time": "2020-05-21", "level": "红色标题", "num_look": 97187, "num_comment": 9, "author": "kirazhou", "tags": ["资讯"], "text": "互联网企业家们已然成为两会的话题之一，作为企业群体的代表，他们的发声值得关注。"}
{"title": "重磅 | 黑镜调查：深渊背后的真相之「第四方支付黑灰产」调查报告", "url": "https://www.freebuf.com/articles/paper/235129.html", "time": "2020-05-21", "level": "红色标题", "num_look": 567728, "num_comment": 12, "author": "FreeBuf咨询", "tags": ["安全报告"], "text": "全民代理盛大开幕，月入百万不是梦！官方充值通道，请放心支付……这样的Slogan是不是很耳熟?"}
{"title": "Sandcastle：一款针对AWS S3 Bucket的Python枚举脚本", "url": "https://www.freebuf.com/sectool/233014.html", "time": "2020-05-21", "level": "", "num_look": 77813, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具", "网络安全"], "text": "Amazon S3[简单存储服务]是互联网中的一项云存储服务，用户如需要上传数据（照片、视频、文档等），首先要在AWS的一个区域中创建一个Bucket，然后便可以将任意数量的对象上传到Bucket中了。"}
{"title": "挖洞经验 | OAuth实现机制中的常见安全问题", "url": "https://www.freebuf.com/vuls/234519.html", "time": "2020-05-21", "level": "", "num_look": 71559, "num_comment": 1, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "在测试网站安全性的过程中，我们会不时在某些服务端身上遇到OAuth授权认证机制。"}
{"title": "今晚8点 | 金融行业数据安全的研究与实践公开课", "url": "https://www.freebuf.com/open/237306.html", "time": "2020-05-21", "level": "红色标题", "num_look": 64943, "num_comment": 64943, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "今晚8点，天威诚信资深技术专家、天威诚信SSL业务技术负责人陈大鹏将为大家带来《金融行业数据安全的研究与实践》主题公开课。"}
{"title": "李彦宏两会提案：对疫情期间采集的个人信息设立退出机制", "url": "https://www.freebuf.com/news/237316.html", "time": "2020-05-21", "level": "", "num_look": 54144, "num_comment": 54144, "author": "kirazhou", "tags": ["资讯"], "text": "5月20日，两会开幕前夕，全国政协委员、百度董事长李彦宏提交了四份提案，分别涉及新基建、智能交通、支持继续教育以及个人信息保护。"}
{"title": "Wi-Fi WPA2 Kr00k漏洞分析与复现", "url": "https://www.freebuf.com/vuls/233238.html", "time": "2020-05-21", "level": "", "num_look": 64240, "num_comment": 64240, "author": "ADLab", "tags": ["漏洞"], "text": "在今年2月份的RSA大会上，ESET的研究人员公开披露Wi-Fi芯片存在严重安全漏洞CVE-2019-15126，并将其命名为“Kr00k”。"}
{"title": "APP安全检测手册", "url": "https://www.freebuf.com/articles/terminal/234926.html", "time": "2020-05-21", "level": "现金奖励", "num_look": 156989, "num_comment": 15, "author": "吞龙", "tags": ["终端安全"], "text": "随着运营商新技术新业务的发展，运营商层面对安全的要求有所变化，渗透测试工作将会面临内容安全、计费安全、业务逻辑及APP等方面的挑战。"}
{"title": "AWVS漏洞扫描实战：HDwiki XSS漏洞发现、利用及修复", "url": "https://www.freebuf.com/vuls/200745.html", "time": "2020-05-21", "level": "现金奖励", "num_look": 94724, "num_comment": 7, "author": "艾瑞斯0315", "tags": ["WEB安全", "漏洞"], "text": "最近在刷CTF的题，遇到一道使用HDwiki5.1作为背景的Web题目，解题思路是利用SQL注入漏洞爆出用户名和密码，然后使用用户名和密码登录进去，再利用网站提供的模板上传功能上传一句话木马，从而获得flag。"}
{"title": "FreeBuf早报｜出售了数十亿个被盗凭证的著名黑客被逮捕；ZDI 公布多个未修复的Windows高危0day详情；激活工具散播锁首病毒“麻辣香锅”", "url": "https://www.freebuf.com/news/237286.html", "time": "2020-05-21", "level": "红色标题", "num_look": 64434, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "乌克兰特勤局（SSU）逮捕了一个名叫Sanix的黑客，该黑客在黑客论坛和Telegram渠道上出售了数十亿个被盗凭证，引起关注。"}
{"title": "瞄准“两牙”：新型银行木马攻击葡萄牙和西班牙语用户", "url": "https://www.freebuf.com/articles/system/234958.html", "time": "2020-05-21", "level": "", "num_look": 65951, "num_comment": 1, "author": "Sandra1432", "tags": ["系统安全"], "text": "近期，研究人员分析了一种新的Android银行木马，该木马似乎针对说西班牙语或葡萄牙语的国家（即西班牙、葡萄牙、巴西和拉丁美洲等地区）。"}
{"title": "从AST到100个某知名OA前台注入", "url": "https://www.freebuf.com/articles/web/237291.html", "time": "2020-05-20", "level": "", "num_look": 69034, "num_comment": 2, "author": "斗象智能安全平台", "tags": ["WEB安全"], "text": "知名OA是使用Java编写的一个OA套件, 代码相对古老, 其中sql查询语句多是拼接, 且代码中没有过滤, 其过滤是通过统一的Filter实现的, 存在一些绕过的情况。"}
{"title": "FProbe：一款HTTP/HTTPS服务器快速探测工具", "url": "https://www.freebuf.com/sectool/233012.html", "time": "2020-05-20", "level": "", "num_look": 90374, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具"], "text": "FProbe是一款HTTP/HTTPS服务器快速探测工具，广大研究人员只需要给FProbe提供一个域名或子域名列表，它就可以帮助我们探测目标域名后台运行的是HTTP服务器还是HTTPS服务器了。"}
{"title": "攻击者正在向云端转移", "url": "https://www.freebuf.com/articles/network/234420.html", "time": "2020-05-20", "level": "", "num_look": 62838, "num_comment": 62838, "author": "Kriston", "tags": ["网络安全"], "text": "最近研究Legion Loader恶意软件时，研究人员偶然发现了一个下载装置，从云服务下载执行恶意有效负载。"}
{"title": "蓝牙冒充攻击（BIAS）威胁数十亿设备", "url": "https://www.freebuf.com/news/237226.html", "time": "2020-05-20", "level": "", "num_look": 57564, "num_comment": 2, "author": "kirazhou", "tags": ["资讯"], "text": "Boffins披露了一个被称为BIAS的蓝牙安全漏洞，攻击者可能会利用该漏洞欺骗远程配对的设备。"}
{"title": "今晚8点开始 | 金融科技安全发展的新态势和机遇公开课", "url": "https://www.freebuf.com/open/237208.html", "time": "2020-05-20", "level": "红色标题", "num_look": 69049, "num_comment": 1, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "今晚8点，上海市信息安全行业协会金融科技安全专委会秘书长、上海安言信息技术有限公司总经理秦峰将为大家带来《金融科技安全发展的新态势和机遇》公开课。"}
{"title": "FPS游戏反作弊系统设计：API调用回溯", "url": "https://www.freebuf.com/articles/system/234548.html", "time": "2020-05-20", "level": "金币+20", "num_look": 104749, "num_comment": 20, "author": "huoji120", "tags": ["极客", "游戏安全"], "text": "目前自己在制作csgo游戏的反作弊系统。国内外有名的游戏反作弊系统有TP/NP/BE和EAC，但国内外几乎没有关于反作弊系统方面的资料。"}
{"title": "构造带有堆栈保护的指令流", "url": "https://www.freebuf.com/articles/system/234987.html", "time": "2020-05-20", "level": "金币+20", "num_look": 62122, "num_comment": 3, "author": "好好学习er", "tags": ["系统安全"], "text": "我们在学ropgadgets与ret2syscall技术原理时，构造指令流时，是没有加堆栈保护的。"}
{"title": "FreeBuf早报｜任天堂起诉Switch破解工具零售商；最高法：未成年人网络打赏可以退还；梅赛德斯奔驰OLU源代码在网上曝光", "url": "https://www.freebuf.com/news/237196.html", "time": "2020-05-20", "level": "红色标题", "num_look": 50254, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "梅赛德斯-奔驰货车上安装的“智能汽车”零部件源代码上周末在网上泄露。而在泄密事件发生之前，瑞士软件工程师Till Kottmann发现了一个属于戴姆勒公司(Daimler AG)的Git门户网站。"}
{"title": "Modbus PLC攻击分析：从Modbus PollSlave到M340", "url": "https://www.freebuf.com/articles/ics-articles/234845.html", "time": "2020-05-20", "level": "现金奖励", "num_look": 70056, "num_comment": 8, "author": "黄一113530", "tags": ["工控安全"], "text": "本文主要研究Modbus Poll/Salve模拟器的使用以及对Schneider（施耐德）PLC M340的连接测试。"}
{"title": "周鸿祎全国两会提四份提案 聚焦新基建网络安全", "url": "https://www.freebuf.com/news/237188.html", "time": "2020-05-19", "level": "", "num_look": 59709, "num_comment": 1, "author": "kirazhou", "tags": ["资讯"], "text": "“网络安全是我的‘老话题’，但是随着国家新基建战略的提出和实施，今年又有了不少‘新内容’”，周鸿祎表示。"}
{"title": "“网络军火商”Zerodium：iOS漏洞太多了，我们收不过来了", "url": "https://www.freebuf.com/news/237142.html", "time": "2020-05-19", "level": "", "num_look": 146802, "num_comment": 8, "author": "Sandra1432", "tags": ["资讯"], "text": "停止收购iOS漏洞？这不是偶然，是必然。"}
{"title": "近三年ATM攻击分析", "url": "https://www.freebuf.com/articles/network/234879.html", "time": "2020-05-19", "level": "", "num_look": 54712, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "针对ATM的攻击历史悠久，攻击者每年都会进一步提高感染ATM系统的能力，根据2017年至2019年数据分析，2020年ATM攻击又会有何变化？"}
{"title": "今晚8点开播 | 金融APP应用安全架构设计实战公开课", "url": "https://www.freebuf.com/open/237043.html", "time": "2020-05-19", "level": "红色标题", "num_look": 73651, "num_comment": 2, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "今晚8点，华泰证券工程效率与应用安全团队负责人庄飞将与大家分享《金融APP应用安全架构设计实战》公开课。"}
{"title": "从勒索软件危机中学到的五点经验", "url": "https://www.freebuf.com/articles/neopoints/234276.html", "time": "2020-05-19", "level": "", "num_look": 53608, "num_comment": 1, "author": "Avenger", "tags": ["观点"], "text": "从亚特兰大和纽约的恢复经验中，我们可以学到很多经验教训。这些经验教训可以在处理其他地方机构面临的勒索软件威胁时带来帮助。"}
{"title": "随笔之提取Shellcode简单利用本地缓冲区溢出", "url": "https://www.freebuf.com/articles/system/234277.html", "time": "2020-05-19", "level": "金币+20", "num_look": 88282, "num_comment": 7, "author": "wwwhxy", "tags": ["系统安全"], "text": "在经过一系列的汇编基础训练之后，决定将此次任务目标上升几个档次，（开始奔向pwn一系列的学习）所以这只是一个开端。"}
{"title": "实战中应急响应溯源思路", "url": "https://www.freebuf.com/articles/system/234657.html", "time": "2020-05-19", "level": "现金奖励", "num_look": 103199, "num_comment": 10, "author": "bbbbbbig", "tags": ["系统安全"], "text": "每次工作中遇到的应急，我会把每个应急看成一个目的地，而抵达目的地的路径则是应急过程中的思路，抵达目的地的路径有很多，而最短路径则是工作经验。"}
{"title": "FreeBuf早报｜Zerodium宣布暂停购买iOS漏洞；程序员因窃取公司《传奇霸业》源码被判刑；FBI警告ProLock勒索软件解密器无法正常使用", "url": "https://www.freebuf.com/news/237063.html", "time": "2020-05-19", "level": "红色标题", "num_look": 62486, "num_comment": 4, "author": "Sandra1432", "tags": ["资讯"], "text": "据外媒报道，愿意为苹果iOS操作系统漏洞支付200万美元的Zerodium表示，由于最近针对该平台的黑客数量的大幅增加，该公司宣布暂停购买该平台漏洞。"}
{"title": "全国政协委员、启明星辰CEO严望佳：树立城市建设安全先行的理念", "url": "https://www.freebuf.com/news/237105.html", "time": "2020-05-19", "level": "", "num_look": 50568, "num_comment": 1, "author": "百里不守约", "tags": ["资讯"], "text": "如何确保海量数据在融合与使用过程中让居民个人隐私信息、企业和政府敏感数据不被入侵篡改和肆意泄露，有效保障智慧城市大数据安全，无疑是智慧城市建设过程中面临的艰巨任务。"}
{"title": "关于APP渗透测试的实践与思考", "url": "https://www.freebuf.com/articles/terminal/235143.html", "time": "2020-05-19", "level": "红色标题", "num_look": 114988, "num_comment": 7, "author": "极客安全MobileSecurity", "tags": ["终端安全"], "text": "在此结合相关移动APP检测标准和工作经验，从渗透测试角度，对移动APP的检测进行概要性总结说明。"}
{"title": "今晚8点 | 2019金融行业网络安全报告解读公开课", "url": "https://www.freebuf.com/open/236962.html", "time": "2020-05-18", "level": "红色标题", "num_look": 77347, "num_comment": 1, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "5月18日（今天）20:00，FreeBuf咨询技术经理张志鹏将与大家分享《2019金融行业网络安全报告解读》。"}
{"title": "Chromepass：一款功能强大的Chrome保存密码收集工具", "url": "https://www.freebuf.com/articles/database/233805.html", "time": "2020-05-18", "level": "", "num_look": 83756, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["数据安全"], "text": "Chromepass是一款功能强大的Chrome保存密码收集工具，本质上来说Chromepass是一个基于Python的控制台终端应用程序，它也可以生成一个Windows可执行程序。"}
{"title": "一次针对Intel 471的攻击分析", "url": "https://www.freebuf.com/articles/network/233181.html", "time": "2020-05-18", "level": "", "num_look": 61648, "num_comment": 1, "author": "Avenger", "tags": ["网络安全"], "text": "我们本周发现了一件针对团队中一名员工的攻击尝试，本文是对次攻击尝试的分析。有趣的是，员工的电子邮件地址仅在极少数外部场合披露过。"}
{"title": "复活Navex：使用图查询进行代码分析", "url": "https://www.freebuf.com/articles/network/236954.html", "time": "2020-05-18", "level": "", "num_look": 57935, "num_comment": 2, "author": "斗象智能安全平台", "tags": ["网络安全"], "text": "从了解到修复 Navex, 其中花了一年多, 从对自动化代码审计一无所知到学习PL/Static Analysis, 翻阅十几年前的文档, 补全Gremlin Step, 理解AST, CFG, DDG, PDG, CPG。"}
{"title": "应急响应系列之利用ProcessMonitor进行恶意文件分析", "url": "https://www.freebuf.com/sectool/234417.html", "time": "2020-05-18", "level": "现金奖励", "num_look": 100292, "num_comment": 7, "author": "feiniao", "tags": ["工具", "系统安全"], "text": "在前期的不断学习与实践中，发现可以通过ProcesMonitor这款工具来进行病毒行为的分析."}
{"title": "施耐德PLC漏洞历险记", "url": "https://www.freebuf.com/articles/ics-articles/234714.html", "time": "2020-05-18", "level": "现金奖励", "num_look": 443270, "num_comment": 8, "author": "cilan", "tags": ["工控安全"], "text": "最近，瑞不可当工控团队入手 了一台施耐德PLC，就让我们一起本着增加自身知识储备、实践维护国家安全，怀着激动的心开始守卫世界和平啦。"}
{"title": "FreeBuf早报｜蔡英文办公室电脑被曝遭黑客入侵；黑客控制多台超算挖门罗币；192个App因违法违规收集个人信息被责令改正", "url": "https://www.freebuf.com/news/236936.html", "time": "2020-05-18", "level": "红色标题", "num_look": 63520, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "据台湾“中时电子报”报道，台湾地区领导人蔡英文办公室电脑惊传遭黑客入侵，4月间蔡英文与台当局“行政院长”苏贞昌会面时幕僚帮忙准备的资料，遭变造、伪造，并以黑函方式散布。"}
{"title": "数字新基建成本优化：从谷歌DeepMind实践我们体会到了什么？", "url": "https://www.freebuf.com/articles/neopoints/236567.html", "time": "2020-05-18", "level": "金币+10", "num_look": 55000, "num_comment": 55000, "author": "宇宸de研究室", "tags": ["观点"], "text": "近日新基建、数字新基建的标题到处飞，几天前信通院发表了一篇《“新基建”数据中心能否摘掉“能耗大户”的帽子？》的文章。"}
{"title": "两会召开在即，全国政协委员肖新光继续为网络安全建言献策", "url": "https://www.freebuf.com/news/237051.html", "time": "2020-05-18", "level": "", "num_look": 37125, "num_comment": 37125, "author": "kirazhou", "tags": ["资讯"], "text": "受新冠疫情影响，每年3月召开的全国两会时间推迟，4月29日，根据央视新闻官方消息，两会时间确定。"}
{"title": "手撕伪YARRAQ勒索病毒", "url": "https://www.freebuf.com/articles/system/236545.html", "time": "2020-05-17", "level": "现金奖励", "num_look": 76004, "num_comment": 8, "author": "langyajiekou", "tags": ["系统安全"], "text": "最近，一个勒索病毒的对抗个人觉得挺有意思，权且记记。"}
{"title": "Eavesarp：基于ARP请求分析的内部通信主机和过期网络地址配置的识别工具", "url": "https://www.freebuf.com/articles/network/234256.html", "time": "2020-05-17", "level": "", "num_look": 49137, "num_comment": 49137, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "Eavesarp是一款基于ARP请求分析的内部通信主机和过期网络地址配置的识别工具，它本质上一个网络侦察工具，它可以通过分析ARP请求来识别可能跟其他设备通信的主机。"}
{"title": "挖洞经验 | 发现Google Tez的XSS漏洞（$3133.7）", "url": "https://www.freebuf.com/vuls/234084.html", "time": "2020-05-17", "level": "", "num_look": 233896, "num_comment": 15, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "该篇Writeup讲述的是作者发现Google Tez网站的一个DOM based XSS漏洞，从而收获$3133.7奖励的经历，漏洞非常非常简单，我们一起来看看。"}
{"title": "挖矿病毒深度分析", "url": "https://www.freebuf.com/articles/system/234492.html", "time": "2020-05-17", "level": "", "num_look": 70175, "num_comment": 2, "author": "Gh0stWa1ker", "tags": ["系统安全"], "text": "朋友公司遇到了一起挖矿病毒事件，找我帮忙看看。"}
{"title": "SpyNote间谍软件利用“新冠肺炎”传播恶意程序", "url": "https://www.freebuf.com/articles/terminal/234127.html", "time": "2020-05-17", "level": "", "num_look": 76804, "num_comment": 76804, "author": "暗影安全实验室", "tags": ["终端安全"], "text": "PaloaltoNetworks团队最早于2016年发现了一款新的AndroidRAT（远程管理工具）-SpyNote，该间谍软件允许恶意软件所有者获得对Android设备的远程管理控制。"}
{"title": "技术讨论 | Fuzz绕过安全狗4.0实现SQL注入", "url": "https://www.freebuf.com/articles/web/234487.html", "time": "2020-05-17", "level": "现金奖励", "num_look": 86835, "num_comment": 14, "author": "Anubis24", "tags": ["WEB安全"], "text": "本文使用了burp的intruder模块进行fuzz,并修改了sqlmap工具的tamper脚本，对安全狗进行绕过。"}
{"title": "pwndrop：一款针对红队设计的Payload共享托管服务", "url": "https://www.freebuf.com/articles/network/234806.html", "time": "2020-05-16", "level": "", "num_look": 58295, "num_comment": 58295, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "pwndrop是一款支持自主部署的文件托管服务，在pwndrop的帮助下，红队研究人员将能够通过HTTP、HTTPS或WebDAV来发送、上传或共享Payload以及各种机密文件。"}
{"title": "APT41 Speculoos后门分析", "url": "https://www.freebuf.com/articles/network/233776.html", "time": "2020-05-16", "level": "", "num_look": 55746, "num_comment": 55746, "author": "Kriston", "tags": ["网络安全"], "text": "2020年3月25日，FireEye发表了APT41全球攻击活动报告。此攻击活动发生在1月20日至3月11日期间，主要对Citrix，Cisco和Zoho网络设备进行攻击。"}
{"title": "深度解析电商刷单产业链：千万刷手暗潮涌动，平台攻防不断升级", "url": "https://www.freebuf.com/articles/network/236258.html", "time": "2020-05-16", "level": "", "num_look": 71749, "num_comment": 3, "author": "GEETEST极验", "tags": ["网络安全"], "text": "“刷单”（Click farming）指由买家提供购买费用，帮指定的网店卖家购买商品从而提高销量和信用度，并填写虚假好评的行为。"}
{"title": "Sodinokibi新变种呈现定制化，疑似团伙连续作案", "url": "https://www.freebuf.com/articles/system/234366.html", "time": "2020-05-16", "level": "", "num_look": 69691, "num_comment": 69691, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近日，深信服安全团队连续收到不少用户中了勒索病毒的求助。"}
{"title": "内网渗透：使用ew实现socks代理", "url": "https://www.freebuf.com/sectool/234254.html", "time": "2020-05-16", "level": "", "num_look": 125669, "num_comment": 3, "author": "regitnew", "tags": ["WEB安全", "工具"], "text": "earthworm与reGeorg都可以实现socks代理功能，但是reGeorg的服务端是webshell，而earthworm的服务端和客户端使用相同的可执行文件。另外earthworm不需要跳板机运行web服务，并且它支持更加复杂的渗透任务。"}
{"title": "BUF大事件丨世界最大在线沙盒《Roblox》遭黑客攻击；雷电3接口曝出无法修复的安全漏洞，数百万设备受影响", "url": "https://www.freebuf.com/news/236903.html", "time": "2020-05-16", "level": "红色标题", "num_look": 48544, "num_comment": 48544, "author": "willhuang", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，雷电3接口曝出无法修复的安全漏洞；工信部发布通报称，当当等16款APP侵害用户权益；世界最大在线沙盒《Roblox》遭黑客攻击。"}
{"title": "在云环境下Tomcat7存在Struts2-020如何Getshell", "url": "https://www.freebuf.com/vuls/234346.html", "time": "2020-05-15", "level": "红色标题", "num_look": 575009, "num_comment": 10, "author": "꧁", "tags": ["漏洞"], "text": "在一次给某甲方做模拟攻击中发现某网站存在Struts2-020，但是中间件是tomcat7不能直接getshell。"}
{"title": "Ursnif针对意大利公司的新攻击", "url": "https://www.freebuf.com/articles/others-articles/234275.html", "time": "2020-05-15", "level": "", "num_look": 23105, "num_comment": 23105, "author": "Avenger", "tags": ["其他"], "text": "Ursnif 是十分活跃的威胁之一，通常针对意大利和欧洲多个行业发起垃圾邮件攻击。"}
{"title": "F5陈亮：Nginx加持的全数据通路应用安全防护", "url": "https://www.freebuf.com/articles/people/236870.html", "time": "2020-05-15", "level": "", "num_look": 89182, "num_comment": 89182, "author": "shidongqi", "tags": ["人物志"], "text": "陈亮提出全数据通路的保护思路。从代码的生成、测试、验证，发布，持续集成、持续发布之后，对应的安全设备就要做安全的防护、策略的调整，这是一条整体的全数据通路保护通道。"}
{"title": "IIS Raid：使用本地模块构建的IIS后门", "url": "https://www.freebuf.com/sectool/231973.html", "time": "2020-05-15", "level": "", "num_look": 95467, "num_comment": 95467, "author": "Ca3tie1", "tags": ["工具"], "text": "之前刷TW的时候在墙外看到老外分享的这款使用IIS的本地模块构建IIS后门，功能可以自定义命令执行，dumhash等。"}
{"title": "2019年数据泄露调查报告", "url": "https://www.freebuf.com/articles/network/234133.html", "time": "2020-05-15", "level": "", "num_look": 65956, "num_comment": 2, "author": "Kriston", "tags": ["网络安全"], "text": "报告是基于各种来源的数据进行分析，例如公开披露的安全事件，Verizon（VTRAC）和合作单位等提供的案例。"}
{"title": "技术讨论 | 利用Python程序实现某OA系统的自动定位", "url": "https://www.freebuf.com/sectool/231250.html", "time": "2020-05-15", "level": "现金奖励", "num_look": 107842, "num_comment": 6, "author": "biubiugo", "tags": ["工具"], "text": "本文介绍了笔者通过python程序实现某OA系统自动考勤打卡功能及相关逻辑原理的解析。"}
{"title": "FreeBuf早报｜Facebook与中国移动建设海底电缆，让更多非洲人上网；美政府宣布“华为中兴供货禁令”延长至明年5月；传Xbox国行将更新修复漏洞，修复后只能使用国行服务器", "url": "https://www.freebuf.com/news/236829.html", "time": "2020-05-15", "level": "红色标题", "num_look": 67591, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "美国总统唐纳德·特朗普(Donald Trump)宣布延长针对华为和中兴等中国公司的供应链禁令至2021年5月。上述禁令是特朗普于2019年5月签署的。"}
{"title": "Chepy：一款基于CyberChef工具的Python库&命令行实现", "url": "https://www.freebuf.com/sectool/232504.html", "time": "2020-05-14", "level": "", "num_look": 91413, "num_comment": 91413, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Chepy是一款基于CyberChef工具的Python库&命令行实现，它是一个Python库/命令行，实现了跟CyberChef工具相同的功能。"}
{"title": "数字时代下的安全新基建 | 阿里安全公开课精彩回顾", "url": "https://www.freebuf.com/open/236739.html", "time": "2020-05-14", "level": "红色标题", "num_look": 96923, "num_comment": 2, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "昨晚阿里安全公开课都讲了什么？"}
{"title": "2019年金融行业网络威胁报告", "url": "https://www.freebuf.com/articles/network/234176.html", "time": "2020-05-14", "level": "", "num_look": 70469, "num_comment": 70469, "author": "Kriston", "tags": ["网络安全"], "text": "金融行业网络威胁是指针对在线银行，电子货币和加密货币等服务的攻击，攻击者试图获取对金融组织及其基础设施的访问权限。"}
{"title": "哔哩哔哩招聘安全人才", "url": "https://www.freebuf.com/jobs/236630.html", "time": "2020-05-14", "level": "", "num_look": 124238, "num_comment": 13, "author": "哔哩哔哩弹幕网", "tags": ["安全招聘"], "text": "哔哩哔哩（bilibili）是中国领先的年轻人文化社区，该网站于2009年6月26日创建，被粉丝们亲切的称为“B站”。"}
{"title": "华为顶级安全专家提交Linux内核补丁，被指低级漏洞", "url": "https://www.freebuf.com/news/236721.html", "time": "2020-05-14", "level": "红色标题", "num_look": 641789, "num_comment": 7, "author": "kirazhou", "tags": ["资讯"], "text": "引发了多种基于政治背景下的阴谋论……"}
{"title": "TrickBot银行木马“锦上添花”：再增加载器模块", "url": "https://www.freebuf.com/articles/terminal/233418.html", "time": "2020-05-14", "level": "", "num_look": 86038, "num_comment": 1, "author": "亚信安全", "tags": ["终端安全"], "text": "TrickBot银行木马自2016年问世以来，一直活跃至今。它从最初的银行木马发展到今天已经成为一款强大的恶意家族软件，其功能包括盗取用户电子邮箱、收集系统信息以及盗取浏览器隐私信息等等。"}
{"title": "经典写配置漏洞与几种变形", "url": "https://www.freebuf.com/vuls/236655.html", "time": "2020-05-14", "level": "红色标题", "num_look": 547243, "num_comment": 4, "author": "phithon", "tags": ["漏洞"], "text": "近期看到奇安信发表的一篇文章《这是一篇“不一样”的真实渗透测试案例分析文章》提到一个Discuz后台getshell漏洞，也涉及了相关知识，我们来总结一下吧。"}
{"title": "金融行业安全面面观 | 企业安全online公开课下周一开课", "url": "https://www.freebuf.com/open/236613.html", "time": "2020-05-14", "level": "红色标题", "num_look": 115273, "num_comment": 2, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "5月18日（下周一）20:00起，企业安全online系列金融行业安全专场正式开启。"}
{"title": "FreeBuf早报｜新的Ramsay恶意软件从气隙网络中窃取敏感文件；哈萨尔克斯坦部分国家机关官网遭黑客攻击；盗字母哥账号黑客被锁定，系16岁少年盗号为了泡妞", "url": "https://www.freebuf.com/news/236683.html", "time": "2020-05-14", "level": "红色标题", "num_look": 70492, "num_comment": 2, "author": "kirazhou", "tags": ["资讯"], "text": "美国最大 ATM 供应商 Diebold Nixdorf遭勒索软件攻击。该公司表示黑客未能接触 ATM 或客户网络，只影响其企业网络。"}
{"title": "生物安全背后的隐私问题何去何从", "url": "https://www.freebuf.com/articles/database/233468.html", "time": "2020-05-14", "level": "", "num_look": 89896, "num_comment": 89896, "author": "Sandra1432", "tags": ["数据安全"], "text": "在COVID-19这段特殊时期，政府和公司正以公共安全的名义大肆使用生物识别技术和地理位置来跟踪潜在的冠状病毒患者。"}
{"title": "代码审计 | SiteServerCMS密钥攻击", "url": "https://www.freebuf.com/vuls/234549.html", "time": "2020-05-14", "level": "金币+20", "num_look": 74725, "num_comment": 2, "author": "zrools", "tags": ["WEB安全", "漏洞"], "text": "加密和签名本着使数据更安全，但有时它们在一起的时候也会产生相反的效果。"}
{"title": "Dirble：一款高性能目录扫描与爬取工具", "url": "https://www.freebuf.com/sectool/233627.html", "time": "2020-05-13", "level": "", "num_look": 119564, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Dirble工具，它是一款易于使用的高性能网站目录扫描工具。"}
{"title": "从排查端口弱口令研究打造完美防御的思路", "url": "https://www.freebuf.com/articles/es/233403.html", "time": "2020-05-13", "level": "现金奖励", "num_look": 125212, "num_comment": 15, "author": "少帅力", "tags": ["企业安全"], "text": "很多公司要排查高危端口的弱口令工作，我觉得是很有代表性的工作，我构思一个思路总结下当个典型发出来。这工作虽然看似简单，如果要做好还是有些复杂，所以写一篇文章做个总结。"}
{"title": "AgentTesla新变种窃取WiFi密码", "url": "https://www.freebuf.com/articles/others-articles/234418.html", "time": "2020-05-13", "level": "", "num_look": 40447, "num_comment": 1, "author": "Avenger", "tags": ["其他"], "text": "AgentTesla 是一个基于 .NET 的信息窃密恶意软件，能够从失陷主机的不同应用程序（浏览器、FTP 客户端和下载工具等）中窃取数据。"}
{"title": "悬镜安全招聘了，北京，四川，广州任你选", "url": "https://www.freebuf.com/jobs/236170.html", "time": "2020-05-13", "level": "", "num_look": 63535, "num_comment": 6, "author": "悬镜安全实验室", "tags": ["安全招聘"], "text": "悬镜安全，由北京大学白帽黑客团队“XMIRROR”发起创立，致力以AI技术赋能信息安全，专注于DevSecOps软件供应链生命周期的高级威胁检测防御。"}
{"title": "今晚8点 | 如何用安全基建理念打造新一代泛应用安全体系", "url": "https://www.freebuf.com/open/236551.html", "time": "2020-05-13", "level": "红色标题", "num_look": 75850, "num_comment": 75850, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "今晚8点，来自阿里安全的铁花老师将为我们带来公开课《传统SDL已过时，如何用安全基建理念打造新一代泛应用安全体系》。"}
{"title": "FBI和CISA披露十大常被利用漏洞", "url": "https://www.freebuf.com/news/236564.html", "time": "2020-05-13", "level": "", "num_look": 74361, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "今日，网络安全和基础架构安全局（CISA）和联邦调查局（FBI）发布2016年至2019年以来最常被利用的十大安全漏洞。"}
{"title": "WannaCry三周年之际，美国披露了新型朝鲜恶意软件", "url": "https://www.freebuf.com/news/236555.html", "time": "2020-05-13", "level": "", "num_look": 68501, "num_comment": 1, "author": "kirazhou", "tags": ["资讯"], "text": "美韩在网络空间的博弈愈演愈烈。"}
{"title": "技术讨论 | Glibc中堆管理的变化", "url": "https://www.freebuf.com/articles/system/234219.html", "time": "2020-05-13", "level": "金币+10", "num_look": 75070, "num_comment": 75070, "author": "白里个白sofr", "tags": ["系统安全"], "text": "在学pwn的道路上，我们大多从linux入手，从栈到堆，各种漏洞利用，都和Glibc或多或少打过交道。"}
{"title": "探索云安全面临的常见威胁", "url": "https://www.freebuf.com/articles/network/234582.html", "time": "2020-05-13", "level": "", "num_look": 68233, "num_comment": 2, "author": "Sandra1432", "tags": ["网络安全"], "text": "随着云服务的采用和普及，企业需要知道如何去保护企业的网络环境，本文对于云上会遇到的常见风险做了梳理。"}
{"title": "FreeBuf早报｜雷电3接口漏洞影响数百万计算机；德克萨斯法院遭到勒索软件攻击；世界最大在线沙盒《Roblox》遭黑客攻击", "url": "https://www.freebuf.com/news/236533.html", "time": "2020-05-13", "level": "红色标题", "num_look": 58341, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "雷电3（Thunderbolt）接口存在缺陷，2019 年之前生产、出货的配备雷电3的设备都容易受到攻击。而自2019 年后已交付的提供内核DMA保护的设备，也在一定程度上易受攻击。"}
{"title": "攻防演练中红队如何识别蜜罐保护自己", "url": "https://www.freebuf.com/articles/network/236485.html", "time": "2020-05-12", "level": "", "num_look": 147075, "num_comment": 6, "author": "Elina3000", "tags": ["网络安全"], "text": "最近在攻防演练中经常会遇到蜜罐，这次就来唠唠蜜罐。"}
{"title": "GitHub 500GB数据窃贼再出手，出售10家企业7320万条用户记录", "url": "https://www.freebuf.com/news/236465.html", "time": "2020-05-12", "level": "", "num_look": 53611, "num_comment": 53611, "author": "Sandra1432", "tags": ["资讯"], "text": "一波未平，一波又起。最近Shiny Hunters这个黑客组织有点忙。"}
{"title": "Alphanumeric Shellcode：纯字符Shellcode生成指南", "url": "https://www.freebuf.com/articles/system/232280.html", "time": "2020-05-12", "level": "红色标题", "num_look": 83489, "num_comment": 2, "author": "taqini", "tags": ["系统安全"], "text": "alphanumeric shellcode(纯字符shellcode)是比较实用的一项技术，因为有些时候程序会对用户输入的字符进行限制，比如只允许输入可见字符，这时就需要用到纯字符的shellcode了。"}
{"title": "雷电3接口漏洞影响数百万计算机：5分钟解锁设备，无法修复", "url": "https://www.freebuf.com/news/236419.html", "time": "2020-05-12", "level": "红色标题", "num_look": 119632, "num_comment": 6, "author": "kirazhou", "tags": ["资讯"], "text": "这可能直接影响未来的 USB 4 和Thunderbolt 4 等标准，需要对芯片进行重新设计。"}
{"title": "等保2.0一周年 | FreeBuf X 腾讯安全「等保合规」系列直播公开课报名启动！", "url": "https://www.freebuf.com/open/236431.html", "time": "2020-05-12", "level": "红色标题", "num_look": 119148, "num_comment": 2, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "一转眼，距离等保2.0发布已经过去了整整一周年。作为我国网络安全领域的重要制度与方法，等保2.0对于企业安全建设重要性不言而喻。"}
{"title": "2020年Q1钓鱼攻击分析", "url": "https://www.freebuf.com/articles/network/233863.html", "time": "2020-05-12", "level": "", "num_look": 69088, "num_comment": 69088, "author": "Kriston", "tags": ["网络安全"], "text": "Verizon《2019年数据泄露调查报告》显示，近三分之一（32％）的数据泄露涉及网络钓鱼攻击。"}
{"title": "话题讨论 | 那些攻防演练中的“骚套路”", "url": "https://www.freebuf.com/articles/neopoints/236403.html", "time": "2020-05-12", "level": "红色标题", "num_look": 244787, "num_comment": 18, "author": "kirazhou", "tags": ["观点"], "text": "网站一张图……"}
{"title": "火热新基建下的“冷思考”", "url": "https://www.freebuf.com/articles/neopoints/236267.html", "time": "2020-05-12", "level": "红色标题", "num_look": 76302, "num_comment": 2, "author": "kirazhou", "tags": ["观点"], "text": "随着国家发改委对新型基础设施的范围的明确，“新基建”一词可预见地会成为2020年的核心关键词之一。"}
{"title": "与ret2shellcode的初相识", "url": "https://www.freebuf.com/articles/system/234286.html", "time": "2020-05-12", "level": "", "num_look": 85409, "num_comment": 2, "author": "h778890", "tags": ["系统安全"], "text": "ret2shellcode，也就是return to shellcode，在执行完某个函数之后，跳到shellcode上，达到get shell的目的。"}
{"title": "FreeBuf早报｜国内5000多万条个人信息在暗网倒卖；GitHub 500GB数据窃贼再出手，出售10家企业数据；IDC：2019年人工智能基础架构市场规模达20.9亿美元，同比增长58.7%", "url": "https://www.freebuf.com/news/236382.html", "time": "2020-05-12", "level": "红色标题", "num_look": 82624, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "IDC发布的《人工智能基础架构市场（2019下半年）跟踪》报告显示，2019年人工智能基础架构市场规模达到20.9亿美元，同比增长58.7%。"}
{"title": "以Docker容器的形式运行openvas", "url": "https://www.freebuf.com/sectool/234253.html", "time": "2020-05-12", "level": "现金奖励", "num_look": 126831, "num_comment": 19, "author": "regitnew", "tags": ["容器安全", "工具"], "text": "OpenVAS（Open Vulnerability Assessment System）是在nessus基础上发展起来的一个开源的漏洞扫描程序，其核心部件是一套漏洞测试程序，可以检测远程系统和应用程序中的安全问题。"}
{"title": "OPC安全研究分析", "url": "https://www.freebuf.com/articles/ics-articles/234344.html", "time": "2020-05-12", "level": "现金奖励", "num_look": 79870, "num_comment": 3, "author": "黄一113530", "tags": ["工控安全"], "text": "随着过程控制自动化的发展，自动化系统厂商希望能够集成不同厂家的不同硬件设备和软件产品，各家设备之间实现互操作工业现场的数据能够从车间级汇入到整个企业信息系统中。正是基于这种需要产生了OPC标准。"}
{"title": "FreeTalk 2020 白帽线上沙龙，不变的技术深度 | 议题征集ing", "url": "https://www.freebuf.com/fevents/236264.html", "time": "2020-05-11", "level": "", "num_look": 69622, "num_comment": 69622, "author": "FB客服", "tags": ["活动"], "text": "重大漏洞或安全事件的分析及复现、漏洞挖掘分析类前沿技术或工具科普分享、CTF、逆向分析、渗透测试、web安全、工控安全、代码审计...只要议题的内容足够吸引人，统统抛过来，FreeTalk的舞台属于你。"}
{"title": "FreeBuf 咨询《2020中国网络流量监测与分析产品研究报告》正式启动", "url": "https://www.freebuf.com/articles/paper/235506.html", "time": "2020-05-11", "level": "红色标题", "num_look": 138422, "num_comment": 9, "author": "FreeBuf咨询", "tags": ["安全报告"], "text": "随着企业上云、5G落地、物联网设备激增，网络爆炸式发展，网络流量海量化、复杂化成为常态，如何识别、监测、分析网络流量成为重要研究方向和企业关注热点。"}
{"title": "Inhale：一款功能强大的恶意软件分析与分类工具", "url": "https://www.freebuf.com/articles/network/233623.html", "time": "2020-05-11", "level": "", "num_look": 68440, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "Inhale是一款针对恶意软件的分析与分类工具，广大安全研究人员可以利用Inhale来对恶意软件中的很多的静态分析操作进行自动化实现以及扩大覆盖范围。"}
{"title": "二维码劫持案例分析", "url": "https://www.freebuf.com/vuls/234121.html", "time": "2020-05-11", "level": "现金奖励", "num_look": 146956, "num_comment": 13, "author": "xiaopan233", "tags": ["漏洞"], "text": "微信扫描二维码登录网站，相信很多网站登录中都有这个功能。但是这个功能使用不当，将会出现劫持漏洞。"}
{"title": "The Turkish Rat攻击活动分析", "url": "https://www.freebuf.com/articles/network/233519.html", "time": "2020-05-11", "level": "", "num_look": 54335, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "近期Check Point研究人员发现大规模恶意邮件攻击活动，其主要针对80多家土耳其公司。恶意软件使用了不同的方法来绕过目标安防机制。"}
{"title": "Nexus Repository Manager 3几次表达式解析漏洞", "url": "https://www.freebuf.com/vuls/233700.html", "time": "2020-05-11", "level": "", "num_look": 72588, "num_comment": 1, "author": "知道创宇404实验室", "tags": ["其他", "漏洞"], "text": "Nexus Repository Manager 3最近曝出两个el表达式解析漏洞，编号为CVE-2020-10199，CVE-2020-10204，都是由Github Secutiry Lab团队的@pwntester发现。"}
{"title": "FreeBuf早报｜银保监会对中信银行泄露客户账户信息启动立案调查程序；史上最昂贵越狱？40多万的Mac Pro被黑客攻破；博通完成旗下赛门铁克网络安全服务业务出售", "url": "https://www.freebuf.com/news/236235.html", "time": "2020-05-11", "level": "红色标题", "num_look": 61204, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "安全公司McAfee的一份新研究发现，在新型冠状病毒疫情期间，针对微软远程桌面协议(RDP)的攻击数量显著增加，并且发现被盗的RDP证书中有52%来自中国用户。"}
{"title": "关于PLC安全的一次实验", "url": "https://www.freebuf.com/articles/ics-articles/233938.html", "time": "2020-05-11", "level": "现金奖励", "num_look": 108651, "num_comment": 7, "author": "等待未来66大顺", "tags": ["工控安全"], "text": "随着工业 4.0 的高速发展，工业自动化程度越来越高，但工控设备暴露在公网的情况也越发明显。而其中尤其以PLC最为明显，这些PLC设备的来源多为国外厂商，安全变得不可控。"}
{"title": "因密码太简单，疫情期间国内大量RDP端口暴露", "url": "https://www.freebuf.com/articles/network/236148.html", "time": "2020-05-10", "level": "", "num_look": 97343, "num_comment": 2, "author": "Kriston", "tags": ["网络安全"], "text": "COVID-19使许多公司员工利用RDP远程桌面办公，员工可以远程访问公司内部资源，远程与系统进行通信。为了维持业务连续性，许多组织对安全的要求降低，使攻击者有机可乘。"}
{"title": "Envizon：一款功能强大的网络可视化&漏洞管理与报告框架", "url": "https://www.freebuf.com/sectool/232518.html", "time": "2020-05-10", "level": "", "num_look": 108703, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具", "网络安全"], "text": "为了回报安全社区，我们发布了我们内部使用和开发的最先进的网络可视化和漏洞报告工具“Envizon”。我们希望您的反馈将有助于改进和进一步完善Envizon的功能。"}
{"title": "挖洞经验 | 利用Slack的TURN服务器访问Slack内部网络", "url": "https://www.freebuf.com/vuls/233854.html", "time": "2020-05-10", "level": "", "num_look": 96499, "num_comment": 1, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "该篇Writeup介绍了作者通过TURN服务器的中继作用，实现对Slack的内部网络和AWS元数据资源的访问。文中涉及到了STUN、TURN协议和WebRTC知识。"}
{"title": "重磅 | FreeBuf黑镜调查：深渊背后的真相之「网络博彩黑灰产业链」报告", "url": "https://www.freebuf.com/news/topnews/167829.html", "time": "2020-05-10", "level": "红色标题", "num_look": 809744, "num_comment": 22, "author": "FreeBuf咨询", "tags": ["头条", "安全报告"], "text": "你来人间一趟，要多看看太阳。"}
{"title": "Blackloan：针对中国、越南、马来西亚VISA用户的新黑产组织", "url": "https://www.freebuf.com/articles/terminal/233411.html", "time": "2020-05-10", "level": "", "num_look": 120600, "num_comment": 2, "author": "奇安信威胁情报中心", "tags": ["终端安全"], "text": "近期奇安信病毒响应中心在日常监测中，发现了一批针对中国、越南、马来西亚等国用户的钓鱼APP。"}
{"title": "技术讨论 | Ret2dl_resolve漏洞利用分析", "url": "https://www.freebuf.com/articles/system/233513.html", "time": "2020-05-10", "level": "金币+15", "num_look": 67061, "num_comment": 1, "author": "白里个白sofr", "tags": ["系统安全"], "text": "ret2dl_resolve是linux下一种利用linux系统延时绑定机制的一种漏洞利用方法，其主要思想是利用_dl_runtime_resolve()函数写GOT表的操作。"}
{"title": "重磅｜FreeBuf咨询 & 深信服《2019年金融行业网络安全报告》正式发布", "url": "https://www.freebuf.com/articles/paper/229573.html", "time": "2020-05-09", "level": "红色标题", "num_look": 569775, "num_comment": 15, "author": "FreeBuf咨询", "tags": ["安全报告"], "text": "2020年伊始，一场突如其来的疫情给各行各业都按下了「慢放」键，也因此让我们有了更充分的时间来总结思考2019年的行业形势。在平稳迈过疫情这道坎的同时，为2020年接下来的发展积蓄动力。"}
{"title": "聊聊最近几款非常流行的勒索病毒", "url": "https://www.freebuf.com/articles/terminal/236105.html", "time": "2020-05-09", "level": "", "num_look": 104392, "num_comment": 1, "author": "熊猫正正", "tags": ["终端安全"], "text": "2020年勒索病毒攻击比以往都来的更猛了一点，各种不同的勒索病毒黑客组织都似乎加大了这方面的投入，而且又有一些新的黑客组织加入进来，导致现在勒索病毒攻击越来越频繁了。"}
{"title": "下周三晚8点 | 如何用安全基建理念打造新一代泛应用安全体系", "url": "https://www.freebuf.com/open/235415.html", "time": "2020-05-09", "level": "红色标题", "num_look": 130179, "num_comment": 130179, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "下周三晚8点，阿里巴巴集团安全部资深技术专家、阿里安全防控端负责人铁花将为我们带来主题为《传统SDL已过时，如何用安全基建理念打造新一代泛应用安全体系》的公开课。"}
{"title": "Astra：针对REST API的自动化安全测试工具", "url": "https://www.freebuf.com/sectool/232503.html", "time": "2020-05-09", "level": "", "num_look": 116645, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具", "网络安全"], "text": "REST即表述性状态传递（英文：Representational State Transfer，简称REST）是一套新兴的WEB通讯协议，访问方式和普通的HTTP类似，平台接口分GET和POST两种请求方式。"}
{"title": "特朗普颁发电力设备禁令，专家建议直接开源", "url": "https://www.freebuf.com/news/236141.html", "time": "2020-05-09", "level": "", "num_look": 77876, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "“我，美国总统特朗普，最近发现某些外国对手正在加紧利用美国大功率电力系统（BPS）中的漏洞开展攻击，而这些大功率电力系统是国防、关键基础设施、经济、民生等领域重要的支持设设备。”"}
{"title": "价值五千万美元的非洲IP地址盗窃案", "url": "https://www.freebuf.com/news/233865.html", "time": "2020-05-09", "level": "", "num_look": 97657, "num_comment": 1, "author": "Avenger", "tags": ["资讯"], "text": "负责将 IP 地址分配给非洲企业和其他组织的非盈利组织的高管被控告秘密经营着几家不同的公司，通过这些公司向他人出售了价值数千万美元的 IP 地址资源。"}
{"title": "SystemedMiner再次更新，使用Socket5中转访问C&C", "url": "https://www.freebuf.com/articles/system/233138.html", "time": "2020-05-09", "level": "", "num_look": 93910, "num_comment": 4, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "最近，深信服安全团队捕获到SystemdMiner挖矿木马最新变种，该家族在2019年被首次发现，起初因其组件都以systemd-命名而得名。"}
{"title": "加密就安全了？一览用户的数据安全盲点", "url": "https://www.freebuf.com/articles/database/233154.html", "time": "2020-05-09", "level": "", "num_look": 119483, "num_comment": 2, "author": "Sandra1432", "tags": ["数据安全"], "text": "追溯至网络通信安全起始之初，数据安全人员就不得不面对证书使用这一挑战。网页证书是传输层安全通信的基础，增加了网络站点连接的安全性，通常显示为“https”中的“s”。"}
{"title": "FreeBuf早报｜黑客威胁曝光Lady Gaga等明星的法律事务信息，索要比特币赎金；DT下载器木马感染2万台电脑；公安部部署打击贷款类诈骗收网行动，15省市同步开展", "url": "https://www.freebuf.com/news/236097.html", "time": "2020-05-09", "level": "红色标题", "num_look": 57730, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "纽约一知名娱乐法律事务所遭到勒索软件攻击后，数十位全球大牌音乐和电影明星（包括Lady Gaga、Elton John、Robert DeNiro和麦当娜）的私人法律事务面临曝光的风险。"}
{"title": "SDL流程控制工作心得", "url": "https://www.freebuf.com/articles/security-management/233899.html", "time": "2020-05-09", "level": "红色标题", "num_look": 95571, "num_comment": 4, "author": "tf2fdx", "tags": ["安全管理"], "text": "推动SDL流程控制不仅仅是符合等保要求，在工作中落实SDL还能控制安全成本，提高产品上线质量和速度，保障业务安全。"}
{"title": "流量分析的瑞士军刀：Zeek", "url": "https://www.freebuf.com/sectool/235587.html", "time": "2020-05-08", "level": "现金奖励", "num_look": 157566, "num_comment": 7, "author": "dongne", "tags": ["工具"], "text": "Zeek (Bro) 是一款大名鼎鼎的开源网络安全分析工具。通过 Zeek 可以监测网络流量中的可疑活动，通过 Zeek 的脚本可以实现灵活的分析功能，可是实现多种协议的开相机用的分析。"}
{"title": "如何从物联网的角度保护云计算", "url": "https://www.freebuf.com/news/232031.html", "time": "2020-05-08", "level": "", "num_look": 57611, "num_comment": 1, "author": "晶颜123", "tags": ["资讯"], "text": "针对一台设备的攻击可能会造成灾难性安全事件。"}
{"title": "黑客声称窃取GitHub 500GB源代码，准备不出售直接泄露", "url": "https://www.freebuf.com/news/236054.html", "time": "2020-05-08", "level": "", "num_look": 120571, "num_comment": 5, "author": "Sandra1432", "tags": ["资讯"], "text": "“我们已经成功入侵微软的GitHub私人储存库，并从中窃取了500GB的数据，本来打算再暗网上出售的，现在改变主意了，打算免费发布。”"}
{"title": "火眼0day漏洞利用研究（一）", "url": "https://www.freebuf.com/articles/network/233237.html", "time": "2020-05-08", "level": "", "num_look": 92423, "num_comment": 3, "author": "Kriston", "tags": ["网络安全"], "text": "FireEye Mandiant威胁情报强调了CTI在漏洞管理中的价值，并详细介绍了最新威胁，趋势和安全建议等研究数据。"}
{"title": "DEDECMS伪随机漏洞 (一) ：PHP下随机函数的研究", "url": "https://www.freebuf.com/vuls/234563.html", "time": "2020-05-08", "level": "", "num_look": 66578, "num_comment": 66578, "author": "光通天下", "tags": ["漏洞", "网络安全"], "text": "主要研究和分析一下在PHP5和PHP7下mtrand/mtsrand和rand/srand函数的特性, 从中找到一些结论, 方便后面对算法的分析与评估。"}
{"title": "西门子S7系列中间人攻击：防御和流量异常检测（三）", "url": "https://www.freebuf.com/articles/ics-articles/233603.html", "time": "2020-05-08", "level": "现金奖励", "num_look": 95403, "num_comment": 3, "author": "黄一113530", "tags": ["工控安全"], "text": "互联与共享成为工业控制系统新的发展方向，工控系统与企业办公网和互联网逐渐相连，工业控制网络环境变得越来越开放。"}
{"title": "ret2libc过地址随机化", "url": "https://www.freebuf.com/articles/system/233514.html", "time": "2020-05-08", "level": "", "num_look": 103518, "num_comment": 5, "author": "菜鸡CaiH", "tags": ["系统安全"], "text": "我们在编译c文件时，开启了栈不可执行和地址随机化，system和'/bin/sh'会发生改变，那我们该如何获取system等的位置呢？"}
{"title": "FreeBuf早报｜无锡警方成功破获全国首起“暗网”平台案；台湾两大石化企业遭黑客攻击；Zoom收购加密初创公司Keybase", "url": "https://www.freebuf.com/news/235995.html", "time": "2020-05-08", "level": "红色标题", "num_look": 79400, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": "近8年来，一名黑客一直在悄无声息地将D-Link NVRs(网络录像机)和NAS(网络附加存储)设备劫持到一个僵尸网络中，其唯一目的是连接到在线网站并下载动漫视频。"}
{"title": "关于网络安全域隔离问题的研究与思考", "url": "https://www.freebuf.com/articles/network/233308.html", "time": "2020-05-08", "level": "现金奖励", "num_look": 144502, "num_comment": 5, "author": "shengl99", "tags": ["企业安全", "网络安全"], "text": "从历史发展的角度看，安全域隔离一直是传统安全领域广泛采用的防御手段。"}
{"title": "攻击者利用COVID-19进行恶意行为的七种方式", "url": "https://www.freebuf.com/news/233232.html", "time": "2020-05-07", "level": "", "num_look": 64542, "num_comment": 64542, "author": "Avenger", "tags": ["资讯"], "text": "此前的一些报道中已经描述了攻击者如何利用新型冠状病毒的大流行来传播恶意软件或者进行敲诈勒索。这种恐慌仍然在蔓延，利用这种恐慌进行攻击仍然还起作用。"}
{"title": "送书福利｜看完别再说你不懂渗透测试！", "url": "https://www.freebuf.com/fevents/235900.html", "time": "2020-05-07", "level": "红色标题", "num_look": 171639, "num_comment": 120, "author": "FB客服", "tags": ["活动"], "text": "想成为“黑客”？快来参加活动领取《黑客秘笈》！"}
{"title": "26项网络安全国家标准获批发布", "url": "https://www.freebuf.com/news/235965.html", "time": "2020-05-07", "level": "", "num_look": 65479, "num_comment": 65479, "author": "百里不守约", "tags": ["资讯"], "text": "全国信息安全标准化技术委员会归口的GB/T 20281-2020《信息安全技术 防火墙安全技术要求和测试评价方法》等26项国家标准正式发布。"}
{"title": "2019年度垃圾和钓鱼邮件报告", "url": "https://www.freebuf.com/articles/network/233165.html", "time": "2020-05-07", "level": "", "num_look": 68834, "num_comment": 68834, "author": "Kriston", "tags": ["网络安全"], "text": "近日，卡巴斯基发布2019年垃圾邮件和钓鱼邮件分析报告。"}
{"title": "时隔10个月委内瑞拉又断电？攻击致使全国大面积停电", "url": "https://www.freebuf.com/news/235920.html", "time": "2020-05-07", "level": "红色标题", "num_look": 107571, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "5月5日委内瑞拉国家电网干线遭到攻击，造成全国大面积停电。委国家电力公司正组织人力全力抢修，部分地区已经恢复供电。"}
{"title": "Hermit（隐士）APT组织2020年最新攻击活动分析", "url": "https://www.freebuf.com/articles/network/235010.html", "time": "2020-05-07", "level": "", "num_look": 68453, "num_comment": 68453, "author": "腾讯电脑管家", "tags": ["网络安全"], "text": "2020年，“Hermit（隐士）”APT组织依然保持较高的活跃度，攻击方式和木马行为上也有了较大的更新，因此我们对近期的攻击活动做一个整理，并对木马的一些更新情况做一个详细分析汇总。"}
{"title": "DLP数据泄露检测原理浅析", "url": "https://www.freebuf.com/articles/database/229358.html", "time": "2020-05-07", "level": "", "num_look": 133556, "num_comment": 4, "author": "hackeryeah", "tags": ["数据安全"], "text": "最近团队在部署DLP，作为一个技术人员对于黑盒看不到的地方还是充满了好奇心。"}
{"title": "APP隐私合规介绍和实施方案", "url": "https://www.freebuf.com/articles/security-management/233732.html", "time": "2020-05-07", "level": "金币+15", "num_look": 156771, "num_comment": 5, "author": "hostlove@qq.com", "tags": ["安全管理"], "text": "近期咨询app隐私合规的人有点多，正好借这个机会把相关内容整理一下供大家学习参考。"}
{"title": "FreeBuf早报｜美国启动电网零部件来源审查；成人网站CAM4泄漏超过108.8亿条数据库记录；网络志愿者发布了26000个COVID-19威胁的黑名单", "url": "https://www.freebuf.com/news/235889.html", "time": "2020-05-07", "level": "红色标题", "num_look": 59188, "num_comment": 2, "author": "kirazhou", "tags": ["资讯"], "text": "美国商务部宣布将审查美国变压器、变压器铁芯、变压器调节器等零部件的进口量是否威胁了国家安全，这可能导致美国针对电网零部件加征新关税。"}
{"title": "统一安全管控之密钥管理KMS", "url": "https://www.freebuf.com/articles/es/229311.html", "time": "2020-05-07", "level": "", "num_look": 115743, "num_comment": 3, "author": "hackeryeah", "tags": ["企业安全"], "text": "谈到信息安全免不了要解决一个问题就是数据加密。加密就会涉及到密钥相关的问题，比如密钥的生成、传输、保存、泄露等问题。如何保护好密钥的安全就成了信息安全的非常重要的一个部分。"}
{"title": "Sherloq：一款开源的数字图片取证工具", "url": "https://www.freebuf.com/sectool/233682.html", "time": "2020-05-06", "level": "", "num_look": 105128, "num_comment": 105128, "author": "Alpha_h4ck", "tags": ["工具"], "text": "数字图像取证分析是应用图像科学领域里的一种专业知识，这项技术可以在法律事务中解释图像的内容或图像本身所代表的含义。"}
{"title": "Hoaxcalls DDoS僵尸网络分析", "url": "https://www.freebuf.com/articles/network/233180.html", "time": "2020-05-06", "level": "", "num_look": 68134, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "Hoaxcalls同时利用CVE-2020-8515和CVE-2020-5722进行传播。"}
{"title": "漏洞一披露就被利用，LineageOS、Ghost 服务器遭黑客入侵", "url": "https://www.freebuf.com/news/235833.html", "time": "2020-05-06", "level": "红色标题", "num_look": 71523, "num_comment": 2, "author": "百里不守约", "tags": ["资讯"], "text": "安全公司 F-Secure 的研究人员披露了SaltStack两个高危漏洞，黑客很快就利用该漏洞对 LineageOS、Ghost 和DigiCert 的服务器发起了攻击。"}
{"title": "黑吃黑?NEMTY勒索病毒RAAS服务私有化", "url": "https://www.freebuf.com/articles/system/235786.html", "time": "2020-05-06", "level": "", "num_look": 111922, "num_comment": 1, "author": "熊猫正正", "tags": ["系统安全"], "text": "勒索病毒已经被公认成为企业最大的安全威胁，通过近几个月时间的监控，2020年针对企业或个人的勒索病毒攻击已经变的越来越频繁。"}
{"title": "亚信安全陆光明：「安全定义边界」是 5G 时代必然趋势", "url": "https://www.freebuf.com/articles/people/235859.html", "time": "2020-05-06", "level": "", "num_look": 97311, "num_comment": 1, "author": "shidongqi", "tags": ["人物志"], "text": "“4G改变生活，5G改变社会”，5G时代社会的改变深入到各行各业，云网协同的新基础架构使产业发生深刻的变化。"}
{"title": "被“摸底”的任天堂，遭史上最大规模的黑客攻击", "url": "https://www.freebuf.com/news/235808.html", "time": "2020-05-06", "level": "红色标题", "num_look": 194872, "num_comment": 6, "author": "kirazhou", "tags": ["资讯"], "text": "1600万的泄露风波还没有平静，短短几日，任天堂再遭大规模黑客攻击。"}
{"title": "手把手用C++解密Chrome80版本数据库", "url": "https://www.freebuf.com/sectool/232490.html", "time": "2020-05-06", "level": "现金奖励", "num_look": 146378, "num_comment": 5, "author": "hijacking", "tags": ["工具"], "text": "Google Chrome浏览器又称谷歌浏览器采用Chromium内核全球最受欢迎的免费网页浏览器追求速度、隐私安全的网络浏览器。"}
{"title": "西门子S7系列中间人攻击：PLC探测和流量分析（二）", "url": "https://www.freebuf.com/articles/ics-articles/233160.html", "time": "2020-05-06", "level": "现金奖励", "num_look": 117426, "num_comment": 5, "author": "黄一113530", "tags": ["工控安全"], "text": "工业控制系统（ICS）是国家基础设施的重要组成部分，也是工业基础设施的核心，被广泛用于炼油、化工、电力、电网、水厂、交通、水利等领域。"}
{"title": "FreeBuf早报｜个人健康信息码国家标准发布；LineageOS、Ghost和DigiCert服务器遭黑客入侵；小米被指记录用户的Web和手机使用数据", "url": "https://www.freebuf.com/news/235788.html", "time": "2020-05-06", "level": "红色标题", "num_look": 68027, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "据网信办下发的《关于开展网络恶意营销账号专项整治行动的通知》显示，北京网信办将于5月1至6月30日开展为期两个月的网络恶意营销账号专项整治行动。"}
{"title": "等保2.0时代，没有WAF功能的IDC会怎么样？", "url": "https://www.freebuf.com/news/233620.html", "time": "2020-05-06", "level": "", "num_look": 63919, "num_comment": 4, "author": "w2sfoot", "tags": ["资讯"], "text": "本文先从网站客户的角度谈等保2.0时代网站防护的必要性，再指出等保时代没有WAF功能的IDC会怎么样，以及该如何做。"}
{"title": "GitHound：一款针对GitHub的API密钥和敏感数据搜索工具", "url": "https://www.freebuf.com/articles/network/233684.html", "time": "2020-05-05", "level": "", "num_look": 79732, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "GitHound可以利用模式匹配、提交历史楼所和一个独特的结果评分系统来精确定位GitHub上的公开API密钥，从本质上来说，GitHound就是一款基于批量爬取、模式匹配和补丁攻击的敏感数据搜索工具。"}
{"title": "通过代码重用攻击绕过现代XSS防御", "url": "https://www.freebuf.com/articles/web/233521.html", "time": "2020-05-05", "level": "", "num_look": 130728, "num_comment": 3, "author": "周大涛", "tags": ["WEB安全"], "text": "XSS已有近二十年的历史了，也已经发展了许多机制来减轻漏洞的影响。我经常会误以为这些机制可以作为针对XSS的保护，今天，我们将了解为什么情况并非如此。"}
{"title": "配合格式化字符串漏洞绕过canary保护机制", "url": "https://www.freebuf.com/articles/system/233515.html", "time": "2020-05-05", "level": "现金奖励", "num_look": 121285, "num_comment": 14, "author": "wwwhxy", "tags": ["系统安全"], "text": "我们知道，缓冲区溢出漏洞利用的关键处就是溢出时，覆盖栈上保存的函数返回地址来达到攻击效果。"}
{"title": "从乌克兰电网事件看工控安全态势", "url": "https://www.freebuf.com/articles/ics-articles/233680.html", "time": "2020-05-05", "level": "红色标题", "num_look": 125317, "num_comment": 125317, "author": "elvadisas", "tags": ["工控安全"], "text": "目前，工控系统作为国家重点信息基础设施的重要组成部分，正在成为全世界最新的地缘政治角逐战场。"}
{"title": "红队技巧：绕过Sysmon检测", "url": "https://www.freebuf.com/articles/system/233015.html", "time": "2020-05-04", "level": "红色标题", "num_look": 105411, "num_comment": 1, "author": "周大涛", "tags": ["系统安全"], "text": "Sysmon和Windows事件日志都是防御者中极为强大的工具。它们非常灵活的配置使他们可以深入了解设备上的活动，从而使检测攻击者的过程变得更加容易。出于这个原因，我将带领您完成击败他们的旅程。"}
{"title": "使用Miasm分析Shellcode", "url": "https://www.freebuf.com/articles/terminal/232540.html", "time": "2020-05-04", "level": "红色标题", "num_look": 102637, "num_comment": 1, "author": "周大涛", "tags": ["终端安全"], "text": "Shellcode是一个有趣的东西，我一直想使用miasm来学习很久了（因为几年前我在SSTIC上看到了第一次演讲），现在，我终于可以在这个新冠的夜晚里学习了。"}
{"title": "谁动了我的宽带？记一次HTTP劫持的发现过程", "url": "https://www.freebuf.com/articles/network/232568.html", "time": "2020-05-04", "level": "现金奖励", "num_look": 170294, "num_comment": 15, "author": "neilwoo", "tags": ["网络安全"], "text": "本文记录了自己家用宽带HTTP劫持的发现过程。相比DNS劫持，HTTP劫持则更为流氓，解决起来也比较棘手。"}
{"title": "病毒事件取证之如何确认中了病毒", "url": "https://www.freebuf.com/articles/system/233476.html", "time": "2020-05-04", "level": "现金奖励", "num_look": 114641, "num_comment": 9, "author": "bbbbbbig", "tags": ["系统安全"], "text": "目前安全行业发展红火，感知平台的推出，让内网安全一目了然，网络管理人员可使用感知平台实时了解失陷终端、失陷业务、网络攻击、业务外联情况、业务连接情况等信息。"}
{"title": "域渗透：使用蜜罐检测出Kerberoast攻击", "url": "https://www.freebuf.com/articles/system/232669.html", "time": "2020-05-03", "level": "红色标题", "num_look": 87727, "num_comment": 87727, "author": "周大涛", "tags": ["系统安全"], "text": "我们知道，如果攻击者进入域(内网)环境中，攻击影响不敢想象，所以最重要的是快速检测它们。"}
{"title": "Pekraut：近期新出现的RAT", "url": "https://www.freebuf.com/articles/others-articles/232550.html", "time": "2020-05-03", "level": "", "num_look": 41443, "num_comment": 41443, "author": "Avenger", "tags": ["其他"], "text": "最近新出现了一个功能丰富的 RAT 名为 Pekraut，经过分析后推测可能来源于德国。"}
{"title": "等保测评2.0：Oracle身份鉴别（中）", "url": "https://www.freebuf.com/articles/database/233009.html", "time": "2020-05-03", "level": "现金奖励", "num_look": 116503, "num_comment": 116503, "author": "起于凡而非于凡", "tags": ["数据安全", "标准与合规"], "text": "本篇文章主要说一说oracle数据库中身份鉴别控制点中测评项a的相关内容和理解"}
{"title": "Metaspolit下配合Ngrok同时实现内网反弹+转发", "url": "https://www.freebuf.com/sectool/232677.html", "time": "2020-05-03", "level": "", "num_look": 127214, "num_comment": 4, "author": "waowao", "tags": ["工具"], "text": "我既想通过Ngrok在metaspolit下反弹shell，同时又想把对方的3389端口转发到本地，在meterperter下鱼和熊掌我都要！"}
{"title": "起底世界上最大的防弹主机服务提供商", "url": "https://www.freebuf.com/news/232775.html", "time": "2020-05-02", "level": "", "num_look": 62969, "num_comment": 2, "author": "Avenger", "tags": ["资讯"], "text": "过去至少十年中，一个被称为Yalishanda、Downlow、Stas_vl的人运营着世界上最受欢迎的“防弹主机”服务提供商之一，该服务满足了众多的恶意需求，如网络钓鱼、网络犯罪论坛、恶意软件下载服务器等。"}
{"title": "挖洞经验 | Facebook OAuth漏洞导致的Facebook账户劫持", "url": "https://www.freebuf.com/vuls/229944.html", "time": "2020-05-02", "level": "", "num_look": 133666, "num_comment": 3, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "平时在用“Login with Facebook”功能进行跳转登录时，因为其用到了多个URL重定向跳转，所以总会给我有一种不安全的感觉。"}
{"title": "Windows SMB Ghost（CVE-2020-0796）漏洞分析", "url": "https://www.freebuf.com/vuls/233263.html", "time": "2020-05-02", "level": "", "num_look": 152841, "num_comment": 2, "author": "ADLab", "tags": ["漏洞"], "text": "微软在其官方SRC发布了CVE-2020-0796的安全公告，本文对该漏洞进行了深入的分析，并在Windows 10系统上进行了复现。"}
{"title": "白话物联网安全（五）：公网数据下的IoT", "url": "https://www.freebuf.com/articles/network/233441.html", "time": "2020-05-02", "level": "金币+10", "num_look": 85457, "num_comment": 85457, "author": "大胖", "tags": ["网络安全"], "text": "这一章，站在公网的数据角度上我们来看看现在的IoT安全。"}
{"title": "全国政协委员周鸿祎：针对工业互联网安全挑战的三大建议", "url": "https://www.freebuf.com/news/237031.html", "time": "2020-05-01", "level": "", "num_look": 6861, "num_comment": 6861, "author": "kirazhou", "tags": ["资讯"], "text": "5月1日午间消息，360集团董事长兼CEO周鸿祎作为全国政协委员、经济委员会委员，近日参加了十三届全国政协第35次双周协商座谈会，并作为发言代表，从工业互联网安全的角度，对网络安全、新基建等做了发言。"}
{"title": "uDork：一款功能强大的Google Hacking工具", "url": "https://www.freebuf.com/sectool/232507.html", "time": "2020-05-01", "level": "", "num_look": 136428, "num_comment": 136428, "author": "Alpha_h4ck", "tags": ["工具"], "text": "uDork是一款功能强大的Google Hacking工具，uDork本质上来说，是一个采用Python编程语言开发的脚本工具。"}
{"title": "挖洞经验 | 缺乏速率限制（Rate Limitation）导致的Instagram账户密码枚举", "url": "https://www.freebuf.com/vuls/231013.html", "time": "2020-05-01", "level": "", "num_look": 126285, "num_comment": 5, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "今天分享的这篇Writeup关于速率限制问题（请求次数限制，Rate Limitation），这也是面向公众网站的设计中常常会忽略掉的防护措施。"}
{"title": "在Kali Linux 2020系统中安装、配置和使用cuckoo沙箱", "url": "https://www.freebuf.com/sectool/234251.html", "time": "2020-05-01", "level": "", "num_look": 123028, "num_comment": 123028, "author": "regitnew", "tags": ["工具"], "text": "今天为大家介绍在kali linux 2020系统中cuckoo软件及沙箱的安装、配置和使用方法。"}
{"title": "利用Cloudflare Worker来隐藏C2基础设施", "url": "https://www.freebuf.com/sectool/232555.html", "time": "2020-05-01", "level": "现金奖励", "num_look": 99094, "num_comment": 3, "author": "无业废物ksakf", "tags": ["工具"], "text": "由于Cloudflare会检查HTTPs请求中的SNI和Host字段能否对应上，所以在Cloudflare利用Domain fronting几乎是不可能的。"}
{"title": "智能网联汽车开发篇：行驶轨迹跟踪", "url": "https://www.freebuf.com/geek/215912.html", "time": "2020-05-01", "level": "现金奖励", "num_look": 116074, "num_comment": 2, "author": "xutiejun", "tags": ["极客"], "text": "有时，在老婆下班开车回家的路上，我总是需要打电话问你到哪里了。真希望能有个程序能实时了解车的实时位置。于是有了本篇文章。"}
{"title": "xShock：一款针对Shellshock漏洞的利用工具", "url": "https://www.freebuf.com/sectool/232277.html", "time": "2020-04-30", "level": "", "num_look": 94965, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "xShock是一款针对Shellshock漏洞的利用工具，该工具由Hulya Karabag开发，当前版本号为v1.0.0。在xShock的帮助下，广大安全研究人员可以轻松对ShellShock漏洞（CVE-2014-6271）进行漏洞利用测试。"}
{"title": "谷歌Project Zero团队揭苹果众多新漏洞，聊天图像暗藏危机", "url": "https://www.freebuf.com/news/235667.html", "time": "2020-04-30", "level": "红色标题", "num_look": 77110, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "Apple Mail风波才刚刚过去，谷歌又炸出了苹果一波新漏洞，这一操作是否又让苹果用户的信心碎了一地？"}
{"title": "TrickMo绕过2FA认证", "url": "https://www.freebuf.com/articles/network/232046.html", "time": "2020-04-30", "level": "", "num_look": 75360, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "研究人员近期发现Android恶意软件“TrickMo”，该程序可通过TrickBot木马感染用户。"}
{"title": "白帽直播课Live｜小班速成营：零基础带你入门web安全", "url": "https://www.freebuf.com/open/235649.html", "time": "2020-04-30", "level": "", "num_look": 109247, "num_comment": 2, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "课程内容包括但不限于Web基础、信息收集、SQL注入漏洞及原理、常见注入、XSS、CSRF和SSRF不得不说的故事、常见漏洞、漏洞扫描、Metasploi框架、WebShell、后渗透、Powershell装逼指南、源代码审计等。"}
{"title": "Mimikatz的18种免杀姿势及防御策略", "url": "https://www.freebuf.com/articles/system/234365.html", "time": "2020-04-30", "level": "现金奖励", "num_look": 523020, "num_comment": 6, "author": "Tide重剑无锋", "tags": ["系统安全"], "text": "Mimikatz是法国人Benjamin Delpy编写的一款轻量级的调试工具，理论上可以抓取所有windows系统的明文密码（winxp之前的好像不行），因此在内网渗透过程中应用非常广。"}
{"title": "对抗DDoS攻击的法律武器", "url": "https://www.freebuf.com/geek/229421.html", "time": "2020-04-30", "level": "", "num_look": 122392, "num_comment": 3, "author": "acstar", "tags": ["极客"], "text": "若干年前读大学时候我接触的第一门专业课是“网络基础课”，还记得第一节课时老师就以ping命令为切入点介绍DDoS攻击。"}
{"title": "疑似响尾蛇APT组织利用冠状病毒相关信息传播恶意lnk文件", "url": "https://www.freebuf.com/articles/paper/233166.html", "time": "2020-04-30", "level": "现金奖励", "num_look": 110875, "num_comment": 2, "author": "fuckgod", "tags": ["安全报告"], "text": "响尾蛇（SideWinder）组织是据称具有南亚背景的APT团伙，其主要针对周边国家政府机构等重要组织开展攻击活动，窃取敏感信息。"}
{"title": "FreeBuf早报｜俄罗斯黑客被指控入侵LinkedIn、Dropbox和Formspring；曾攻击洛杉矶时报的黑客再次袭击媒体；微软开放内部库完成QUIC连接", "url": "https://www.freebuf.com/news/235627.html", "time": "2020-04-30", "level": "红色标题", "num_look": 56825, "num_comment": 1, "author": "kirazhou", "tags": ["资讯"], "text": "俄罗斯黑客叶夫根尼·尼库林被控入侵LinkedIn、Dropbox和Formspring，后来又出售了数亿用户的被盗数据。"}
{"title": "Liferay portal java反序列化漏洞分析", "url": "https://www.freebuf.com/vuls/233296.html", "time": "2020-04-30", "level": "金币+15", "num_look": 95443, "num_comment": 95443, "author": "MrCoding", "tags": ["漏洞"], "text": "最近liferay portal被爆了一个json的反序列化漏洞，本着学习的态度准备研究一番，于是搭建了低版本环境，顺手搜了下readObject函数，意外发现TunnelServlet存在java反序列化漏洞。"}
{"title": "等保测评2.0：Oracle身份鉴别（上）", "url": "https://www.freebuf.com/articles/database/232551.html", "time": "2020-04-29", "level": "现金奖励", "num_look": 154858, "num_comment": 2, "author": "起于凡而非于凡", "tags": ["数据安全", "标准与合规"], "text": "本篇文章主要说一下Oracle数据库中身份验证控制点中关于身份鉴别的知识点，由于这个地方比较“复杂”，所以这篇文章就不写测评项方面的东西了，放在下篇文章中。"}
{"title": "Ninja：一款专为隐藏红队活动的开源C2服务器", "url": "https://www.freebuf.com/articles/network/232519.html", "time": "2020-04-29", "level": "", "num_look": 81706, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "Ninja是一个开源的命令控制C2服务器，由Purple团队设计、开发和维护。在Ninjia的帮助下，红队研究人员可以隐藏他们的计算机和活动目录枚举活动，并且不会被SIEM和反病毒产品检测到。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列：Nathaniel Wakelam", "url": "https://www.freebuf.com/video/235510.html", "time": "2020-04-29", "level": "红色标题", "num_look": 60424, "num_comment": 4, "author": "willhuang", "tags": ["视频"], "text": "Nathaniel Wakelam ，25岁，来自澳大利亚，在一家名为Gravity的安全咨询公司担任首席信息安全官。在HackerOne平台的有效提交漏洞为707个，排名第9。"}
{"title": "挖洞经验 | 以未授权方式查看特斯拉未公开车型Model Y参数数据", "url": "https://www.freebuf.com/vuls/228004.html", "time": "2020-04-29", "level": "", "num_look": 154042, "num_comment": 7, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "在2019年6月买了一台特斯拉Model 3之后，我就开始研究它的工作机制，并把重点放在了其信息系统上。"}
{"title": "《网络安全审查办法》与信安从业者有什么关系", "url": "https://www.freebuf.com/articles/compliance/235397.html", "time": "2020-04-29", "level": "红色标题", "num_look": 93041, "num_comment": 7, "author": "宇宸de研究室", "tags": ["标准与合规"], "text": "近日《网络安全审查办法》刷遍安全圈，为何如此被各大厂商争相转载。那么《办法》与我们信安从业者又有何相关？"}
{"title": "智联安全诚招安全人才", "url": "https://www.freebuf.com/jobs/235085.html", "time": "2020-04-29", "level": "", "num_look": 47615, "num_comment": 1, "author": "智联招聘安全应急响应中心", "tags": ["安全招聘"], "text": "智联招聘是中国领先的职业发展平台，为用户的整个职业生涯提供相关职业及发展机会。"}
{"title": "《中国互联网络发展状况统计报告》：被植入后门的网站数量近乎翻三倍", "url": "https://www.freebuf.com/news/235508.html", "time": "2020-04-29", "level": "", "num_look": 79407, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "4月28日，中国互联网络信息中心（CNNIC）发布第45次《中国互联网络发展状况统计报告》（以下简称《报告》）。"}
{"title": "揭秘外挂产业链：流水线式生产，主播组队买挂", "url": "https://www.freebuf.com/articles/network/234971.html", "time": "2020-04-29", "level": "", "num_look": 108687, "num_comment": 9, "author": "GEETEST极验", "tags": ["游戏安全", "网络安全"], "text": "马克思在《资本论》里提到：资本会逃避动乱和纷争，是胆怯的。但一有适当的利润，资本就会非常胆壮起来。"}
{"title": "企业快速实践部署IAST/RASP的一种新思路", "url": "https://www.freebuf.com/articles/es/235441.html", "time": "2020-04-29", "level": "", "num_look": 158322, "num_comment": 12, "author": "平安银行应用安全团队", "tags": ["企业安全"], "text": "近两年，百度的OpenRasp在安全业内大火，各大厂的安全团队都在纷纷跟进研究，捣鼓自己的IAST/RASP产品。"}
{"title": "FreeBuf早报｜以色列政府称本国水处理公司已遭攻击；谷歌Play Store新漏洞导致相同版本的应用重复更新；英国NHS拒绝部署苹果&谷歌的接触者追踪技术", "url": "https://www.freebuf.com/news/235497.html", "time": "2020-04-29", "level": "红色标题", "num_look": 55272, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "截至2019年12月，国家计算机网络应急技术处理协调中心监测发现我国境内被篡改网站185573个，较2018年底（7049个）增长较大；被植入后门的网站数量达到84850个。"}
{"title": "SSDLC安全需求分析", "url": "https://www.freebuf.com/articles/es/232542.html", "time": "2020-04-29", "level": "现金奖励", "num_look": 138439, "num_comment": 2, "author": "随便看看", "tags": ["企业安全"], "text": "软件开发安全生命周期SSDLC是微软提出的从安全角度指导软件开发过程的管理模式，在传统软件开发生命周期SDLC的各个阶段增加了一些必要的安全活动，目的是减少软件中的漏洞数量和降低其严重级别。"}
{"title": "B站知名up主遭勒索", "url": "https://www.freebuf.com/news/235381.html", "time": "2020-04-28", "level": "红色标题", "num_look": 169636, "num_comment": 12, "author": "kirazhou", "tags": ["资讯"], "text": "党妹：我被勒索了！"}
{"title": "Largebin attack漏洞利用分析", "url": "https://www.freebuf.com/articles/system/232676.html", "time": "2020-04-28", "level": "金币+20", "num_look": 77477, "num_comment": 1, "author": "白里个白sofr", "tags": ["系统安全"], "text": "由于相较其他heap，largebin 中的机制相对复杂，所以largebin attack 一直是CTF的堆漏洞利用常规而少见的一种，但是却一直活着人们的心中。"}
{"title": "InQL：一款针对GraphQL安全测试的Burp扩展", "url": "https://www.freebuf.com/articles/network/232833.html", "time": "2020-04-28", "level": "", "num_look": 73322, "num_comment": 73322, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "InQL Scanner是一款安全测试工具，也是一个Burp Suite扩展，在它的帮助下，广大研究人员可以更好地对GraphQL技术进行安全审计。"}
{"title": "流量分析在安全攻防上的探索实践", "url": "https://www.freebuf.com/articles/es/235051.html", "time": "2020-04-28", "level": "", "num_look": 155074, "num_comment": 1, "author": "腾讯安全平台部", "tags": ["企业安全"], "text": "传统基础安全领域，在通用产品能力上，一般分为三大件：网络层的防DDoS、主机层的防入侵和应用层的防漏洞。除了防DDoS之外，其他两个领域也给流量分析应用留下足够的想象空间。"}
{"title": "GIF动图只能用做表情包？黑客拿来入侵微软视频会议软件", "url": "https://www.freebuf.com/news/235361.html", "time": "2020-04-28", "level": "", "num_look": 77749, "num_comment": 77749, "author": "Sandra1432", "tags": ["资讯"], "text": "说到GIF动图，大家可能第一反应是手机微信里那各式各样的表情包了，用表情包斗图是现在人们的一种沟通方式。然而，GIF动图到了黑客手里，就不仅是一种“沟通方式”了。"}
{"title": "挖洞经验 | 获取Facebook CDN托管文件的有效URL签名", "url": "https://www.freebuf.com/vuls/232056.html", "time": "2020-04-28", "level": "", "num_look": 106298, "num_comment": 106298, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "该篇Writeup涉及的漏洞可使攻击者获得Facebook CDN服务器中托管文件的有效URL签名，漏洞原因在于Facebook某服务端可以为任意Facebook CDN托管文件生成有效的URL签名参数，从而形成有效的文件访问链接。"}
{"title": "传统岗位新挑战：信息安全之路", "url": "https://www.freebuf.com/articles/network/232341.html", "time": "2020-04-28", "level": "现金奖励", "num_look": 175907, "num_comment": 19, "author": "nexpose", "tags": ["安全管理", "网络安全"], "text": "就职某保险公司，为信息安全部门负责人，职责归纳起来是负责控制整个公司内外部风险，应对新领域的安全挑战和对抗。"}
{"title": "微盟招聘信息安全人才", "url": "https://www.freebuf.com/jobs/235180.html", "time": "2020-04-28", "level": "", "num_look": 56938, "num_comment": 4, "author": "SixSixSix", "tags": ["安全招聘"], "text": "微盟集团（Weimob Inc.）， 香港主板上市企业（股票代码：2013.HK），成立于2013年4月，现有员工超3200人，渠道代理商超1600家，注册商户超300万。"}
{"title": "廉颇老矣还是浪子回头？6年勒索软件Shade公布75万个解密密钥", "url": "https://www.freebuf.com/news/235342.html", "time": "2020-04-28", "level": "", "num_look": 73120, "num_comment": 73120, "author": "kirazhou", "tags": ["资讯"], "text": "对于过往的深受其害的人来说，这无疑是个好消息。甚至，这个网络犯罪团伙还为因他们而造成的受害者损失道歉（？？？）。"}
{"title": "一条网站攻击日志分析引发的思考", "url": "https://www.freebuf.com/articles/web/233083.html", "time": "2020-04-28", "level": "现金奖励", "num_look": 133378, "num_comment": 4, "author": "si1ence", "tags": ["WEB安全"], "text": "前几天发现自己的VPS服务器莫名其妙遭受一些漏洞利用的扫描事件，然后就抓个包看一下到底是个什么情况。"}
{"title": "MMCore针对南亚地区的攻击活动分析", "url": "https://www.freebuf.com/articles/network/234483.html", "time": "2020-04-28", "level": "", "num_look": 103882, "num_comment": 2, "author": "腾讯安全", "tags": ["网络安全"], "text": "MMCore是一款有趣的恶意文件，为下载器下载后在内存中解密执行的一个恶意文件。该恶意文件也被称为BaneChant，最早由fireeye在2013年曝光。此外Forcepoint也在2017年初曝光过而恶意文件的一些攻击活动。"}
{"title": "FreeBuf早报｜利用GIF图像漏洞入侵Microsoft Teams帐户；城门失火殃及池鱼？继Pandownload被抓后云盘万能钥匙宣布关闭；亚马逊试点视频会议打假，已审核中美等1000多家新商户", "url": "https://www.freebuf.com/news/235287.html", "time": "2020-04-28", "level": "红色标题", "num_look": 56613, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "Microsoft修复了Teams工作场所视频聊天和协作平台中的一个漏洞，该漏洞可能使攻击者通过向用户发送GIF图像的恶意链接来获取Team帐户。"}
{"title": "企业安全建设之资产管理与运营", "url": "https://www.freebuf.com/articles/security-management/232452.html", "time": "2020-04-28", "level": "现金奖励", "num_look": 122147, "num_comment": 6, "author": "jary123", "tags": ["安全管理"], "text": "现在的网络环境，威胁跟隐患越来越多，不是今天哪个框架又有远程代码执行漏洞了？明天哪个外网服务器又开放新的高危端口了？哪个系统又被黑了？"}
{"title": "《网络安全审查办法》要点解读", "url": "https://www.freebuf.com/news/235177.html", "time": "2020-04-27", "level": "红色标题", "num_look": 143401, "num_comment": 9, "author": "kirazhou", "tags": ["资讯"], "text": "12部门联合发布《网络安全审查办法》，将于今年6月1日起实施。"}
{"title": "Gospider：一款基于Go语言的快速Web爬虫", "url": "https://www.freebuf.com/sectool/232276.html", "time": "2020-04-27", "level": "", "num_look": 107310, "num_comment": 107310, "author": "Alpha_h4ck", "tags": ["工具", "网络安全"], "text": "Gospider是一款运行速度非常快的Web爬虫程序，Gospider采用Go语言开发。"}
{"title": "COVID-19攻击手段与数据分析", "url": "https://www.freebuf.com/articles/network/234843.html", "time": "2020-04-27", "level": "", "num_look": 79190, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "随着新冠病毒在世界范围内传播，研究人员发现自2月初以来，与冠状病毒相关的搜索和浏览量大幅增加，同时网络罪犯正利用新冠话题获利。"}
{"title": "网信办发布《网络安全审查办法》，6月1日起正式实施", "url": "https://www.freebuf.com/articles/compliance/235163.html", "time": "2020-04-27", "level": "红色标题", "num_look": 67270, "num_comment": 2, "author": "百里不守约", "tags": ["标准与合规"], "text": "国家互联网信息办公室、国家发展和改革委员会、工业和信息化部、公安部、国家安全部等多个部门联合制定了《网络安全审查办法》，现予公布。"}
{"title": "Warzone RAT分析报告", "url": "https://www.freebuf.com/articles/network/231568.html", "time": "2020-04-27", "level": "", "num_look": 77636, "num_comment": 2, "author": "Kriston", "tags": ["网络安全"], "text": "网络犯罪分子通过出售恶意软件服务获利，各种远程访问工具变得越来越流行。 尽管这些RAT是恶意工具，但售卖者假装他们只是向系统管理员出售合法软件，并提供订阅服务和客户服务。"}
{"title": "HACKUSB内测版本评测：年轻人的第一条黑客数据线", "url": "https://www.freebuf.com/articles/terminal/232552.html", "time": "2020-04-27", "level": "红色标题", "num_look": 565917, "num_comment": 12, "author": "淡年华", "tags": ["极客", "终端安全"], "text": "国内的极客团队HACKUSB，他们整的一手好活，这款近源渗透利器号称年轻极客的第一条黑客数据线，起码别的不说，这个价格很香，功能齐全。"}
{"title": "儿童游戏软件中隐藏着Tekya木马风险预警", "url": "https://www.freebuf.com/articles/terminal/232920.html", "time": "2020-04-27", "level": "", "num_look": 105454, "num_comment": 2, "author": "暗影安全实验室", "tags": ["终端安全"], "text": "继2020年2月，Clicker木马新家族-Haken木马通过在Google Play分发8种不同的恶意应用来感染用户设备。最近暗影安全实验室在Google Play上发现了一个新木马家族—Tekya木马。"}
{"title": "FreeBuf早报｜120万悄无声息被盗？黑客行为全曝光；第一宗！中兴工程师泄露5G核心技术文档；互金整治新突破，全国在营网贷剩139家，近5000家出局", "url": "https://www.freebuf.com/news/235088.html", "time": "2020-04-27", "level": "红色标题", "num_look": 68034, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "近日，苏州市工业园区公安分局举行新闻通气会，通报了这起在“净网2020”行动中破获的黑客团伙非法入侵计算机信息系统盗取网络财产案。"}
{"title": "甲方数据安全：业务场景中BYOD安全的应用", "url": "https://www.freebuf.com/articles/es/232640.html", "time": "2020-04-27", "level": "现金奖励", "num_look": 129176, "num_comment": 6, "author": "Mark2019", "tags": ["企业安全"], "text": "甲方安全从业者都听过大量的关于数据安全的解决方案，这些通用性方案为我们在实际企业安全建设过程中提供了一定的思路和技术支持，但通用方案落地到具体的业务场景中，如何很好的结合业务落地？"}
{"title": "COVID19如何改变网络安全行业", "url": "https://www.freebuf.com/articles/neopoints/234468.html", "time": "2020-04-26", "level": "", "num_look": 97951, "num_comment": 97951, "author": "安数君", "tags": ["观点"], "text": "2020年3月，Infosecurity杂志举办了网络研讨会，会同各大企业的高管，讨论COVID-19对网络安全行业的影响。"}
{"title": "Jeopardize：一款针对钓鱼域名的低功耗威胁情报&响应工具", "url": "https://www.freebuf.com/sectool/231977.html", "time": "2020-04-26", "level": "", "num_look": 87772, "num_comment": 87772, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Jeopardize工具的主要目标是以尽可能低的成本来提供针对网络钓鱼域名的基本威胁情报和响应能力，它可以检测到已注册的潜在钓鱼域名。"}
{"title": "Facebook认罚50亿美元创纪录，剑桥分析事件尘埃落定", "url": "https://www.freebuf.com/news/235026.html", "time": "2020-04-26", "level": "红色标题", "num_look": 366203, "num_comment": 4, "author": "Sandra1432", "tags": ["资讯"], "text": "昨日，联邦法院正式批准美国联邦贸易委员会和Facebook之间的用户个人隐私问题和解协议，Facebook认罚50亿美元。"}
{"title": "超过8000不安全Redis暴露在云端", "url": "https://www.freebuf.com/articles/network/232788.html", "time": "2020-04-26", "level": "", "num_look": 88909, "num_comment": 3, "author": "Kriston", "tags": ["网络安全"], "text": "研究人员在云端发现约8000个不安全的Redis，这些Redis未使用TLS加密且未设密码保护。"}
{"title": "小试牛刀之CVE-2010-2883", "url": "https://www.freebuf.com/vuls/231105.html", "time": "2020-04-26", "level": "现金奖励", "num_look": 135083, "num_comment": 2, "author": "wnltc0", "tags": ["漏洞"], "text": "近来正在学习《漏洞战争》，也是头一回分析二进制漏洞，花了好大一番功夫才搞明白，便想记录下过程。"}
{"title": "FreeBuf早报｜网信办启动针对营销号的专项整治行动；FCC考虑以国家安全为由吊销三家中国电信公司的运营牌照；专家在28种防病毒产品中发现了Symlink race漏洞", "url": "https://www.freebuf.com/news/234998.html", "time": "2020-04-26", "level": "红色标题", "num_look": 60497, "num_comment": 4, "author": "kirazhou", "tags": ["资讯"], "text": "国家网信办宣布启动专项整治行动打击恶意营销号。"}
{"title": "Zelos：一款功能强大的代码模拟和测试平台", "url": "https://www.freebuf.com/articles/system/231609.html", "time": "2020-04-25", "level": "", "num_look": 94036, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "Zelos是一款功能强大的代码模拟和测试平台，Zelos英文全称为“Zeropoint Emulated Lightweight Operating System”，即Zeropoint轻量级模拟操作系统。"}
{"title": "ERC-20 USDT 代币增发分析", "url": "https://www.freebuf.com/articles/blockchain-articles/233107.html", "time": "2020-04-25", "level": "现金奖励", "num_look": 101923, "num_comment": 4, "author": "北京链安安全实验室", "tags": ["区块链安全"], "text": "近日，听说以太坊上的泰达币（USDT）频繁被增发。本着学习的目的在 etherscan 上审计了泰达币的智能合约（TetherToken）源码以及 USDT 增发相关的调用事件，本文记录一下分析过程。"}
{"title": "针对电子商务的组织Magecart又研发了新的攻击工具", "url": "https://www.freebuf.com/articles/database/227997.html", "time": "2020-04-25", "level": "", "num_look": 121063, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["数据安全"], "text": "如果你有信用卡的话，这篇文章你就得仔细看一下了。保护个人金融资产永远是网络安全社区中最重要的话题之一。"}
{"title": "阿里云招聘云安全解决方案高级专家和业务发展高级专家", "url": "https://www.freebuf.com/jobs/234585.html", "time": "2020-04-25", "level": "", "num_look": 47475, "num_comment": 4, "author": "阿里云安全", "tags": ["安全招聘"], "text": "自2009年阿里云成立的第一天起安全就是头等大事。经过10年的积累阿里云安全在为国家重大活动以及天猫、淘宝、支付宝的护航过程中沉淀了强大的工程化能力和大项目护航能力。"}
{"title": "使用FakeNet-NG改进动态恶意软件分析", "url": "https://www.freebuf.com/articles/others-articles/232557.html", "time": "2020-04-25", "level": "", "num_look": 37308, "num_comment": 1, "author": "Avenger", "tags": ["其他"], "text": "实际上 FakeNet-NG 有许多有用的功能，但通常很多人都不知道。本文将会展示一些使用 FakeNet-NG 的案例，使得 FakeNet-NG 成为网络分析的好帮手。"}
{"title": "BUF大事件丨苹果安全漏洞曝光：约5亿部iPhone易受攻击；任天堂开始调查NS账户大范围异常登录，已出现盗刷案例", "url": "https://www.freebuf.com/news/234787.html", "time": "2020-04-25", "level": "红色标题", "num_look": 99770, "num_comment": 99770, "author": "Darry端", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，苹果安全漏洞曝光：可能有5亿部iPhone易受攻击；任天堂开始调查NS账户大范围异常登录，已出现盗刷案例；2.67亿Facebook用户信息以500英镑在暗网出售。"}
{"title": "俄罗斯Rostelecom劫持事件，BGP安全不止于此", "url": "https://www.freebuf.com/articles/network/233075.html", "time": "2020-04-25", "level": "", "num_look": 78899, "num_comment": 78899, "author": "kirazhou", "tags": ["网络安全"], "text": "BGP的安全问题，真实伤不起。"}
{"title": "shuffleDNS：一款基于主动爆破的子域名枚举工具", "url": "https://www.freebuf.com/sectool/231959.html", "time": "2020-04-24", "level": "", "num_look": 106929, "num_comment": 106929, "author": "Alpha_h4ck", "tags": ["工具"], "text": "shuffleDNS是一款基于MassDNS开发的强大工具，该工具采用Go语言开发，shuffleDNS可以通过使用主动爆破以及基于通配符的子域名解析方法来帮助广大研究人员枚举有效子域名。"}
{"title": "苹果回应“八年0day漏洞”：对用户无直接风险，补丁即将发布", "url": "https://www.freebuf.com/news/234727.html", "time": "2020-04-24", "level": "红色标题", "num_look": 130794, "num_comment": 7, "author": "Sandra1432", "tags": ["头条", "资讯"], "text": "本周四，苹果在一份声明中对前一日ZecOps公布的苹果“八年0dy漏洞”做出回应，否认了漏洞情况的严重性。"}
{"title": "每个人，都可以成为“大侠” | A计划，安全大厂直播招人四期回顾与总结", "url": "https://www.freebuf.com/fevents/234963.html", "time": "2020-04-24", "level": "", "num_look": 62564, "num_comment": 62564, "author": "FB客服", "tags": ["活动"], "text": "完美世界高级安全总监何艺是我们FreeBuf的老朋友了，一出现就受到了现场观众的热烈欢迎；而完美世界集团信息安全团队HRBP 33也凭借实力美貌、温婉气质获得了弹幕的满满的赞美。"}
{"title": "APT28攻击活动分析报告", "url": "https://www.freebuf.com/articles/network/231640.html", "time": "2020-04-24", "level": "", "num_look": 86323, "num_comment": 86323, "author": "Kriston", "tags": ["网络安全"], "text": "在过去的一年中，俄罗斯最大的黑客组织APT28一直在扫描和探测互联网中存在漏洞的电子邮件服务器。"}
{"title": "金融江湖，锐少的数据安全治理", "url": "https://www.freebuf.com/articles/people/234755.html", "time": "2020-04-24", "level": "红色标题", "num_look": 110511, "num_comment": 5, "author": "kirazhou", "tags": ["人物志"], "text": "这是一个曾在游戏里和好友互称“少侠”，最后顶着“锐少”这个名字在安全圈行走十几年的网安人，或者用锐少的话来说，一个网络安全布道者。"}
{"title": "NSA披露Web Shell漏洞列表，警惕黑客部署后门", "url": "https://www.freebuf.com/news/234873.html", "time": "2020-04-24", "level": "红色标题", "num_look": 72626, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "美国国家安全局（NSA）和澳大利亚信号局（ASD）联合发布一份报告，警告黑客正利用易受攻击的Web服务器来部署Web Shell。"}
{"title": "曝越南黑客组织对我国长达3个月的入侵，意图窃取COVID-19相关情报", "url": "https://www.freebuf.com/news/234855.html", "time": "2020-04-24", "level": "", "num_look": 141443, "num_comment": 4, "author": "kirazhou", "tags": ["资讯"], "text": "至少从2020年1月至2020年4月，越南黑客组织APT32（OceanLotus Group）针对我国开展持续入侵活动，试图收集COVID-19相关情报。"}
{"title": "合合信息招聘安全专家", "url": "https://www.freebuf.com/jobs/234707.html", "time": "2020-04-24", "level": "", "num_look": 47014, "num_comment": 3, "author": "SixSixSix", "tags": ["安全招聘"], "text": "上海合合信息科技发展有限公司成立于2006年，经过十余年奋斗与发展，合合信息已成长为国内领先的人工智能&大数据提供商。"}
{"title": "数据泄露比你想象的更“贴近”你的生活", "url": "https://www.freebuf.com/articles/neopoints/231871.html", "time": "2020-04-24", "level": "", "num_look": 126164, "num_comment": 126164, "author": "知道创宇KCSC", "tags": ["观点"], "text": "2016年7月臭名昭著的暗网市场“真实交易”（TheRealDeal）里一位名叫 “和平”的卖家挂出了约2亿个雅虎账户和密码进行出售，雅虎数据泄露事件就此开始发酵。"}
{"title": "如何解密AWVS?15行代码就够了！", "url": "https://www.freebuf.com/geek/232921.html", "time": "2020-04-24", "level": "现金奖励", "num_look": 154189, "num_comment": 6, "author": "gatlindada", "tags": ["极客"], "text": "AWVS一直以来在圈子中都比较火，以速度快和高准确性深受大家喜爱。很多人想研究其运作机制却因闭源而不得其解。今天这里通过一个极其简单的方式，只用几行代码就能让你一见其核心代码。"}
{"title": "FreeBuf早报｜NSA分享了通常用于植入Web Shell的漏洞列表；泰尔实验室破解AI伪造人脸；iOS被曝存在八年的0day漏洞", "url": "https://www.freebuf.com/news/234846.html", "time": "2020-04-24", "level": "红色标题", "num_look": 63093, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "泰尔终端实验室发布了“AI伪造人脸鉴别平台”，基于单帧和多帧的方法，利用人脸生物特征、抖动精度等特性，结合多轮训练模型、测试集技术，能够识别图像、视频文件的异常，进而辨别真伪。"}
{"title": "SSDLC实践：安全设计评审", "url": "https://www.freebuf.com/articles/es/232543.html", "time": "2020-04-24", "level": "现金奖励", "num_look": 134296, "num_comment": 3, "author": "随便看看", "tags": ["企业安全"], "text": "软件设计处于软件工程中的核心地位，开发不管采用何种开发模式，都离不开软件设计。当需求分析完成后进入设计阶段，设计的好坏直接影响着软件的质量。"}
{"title": "A计划预告第四辑，完美世界多个高薪内推岗可投 | FB招聘站特别企划", "url": "https://www.freebuf.com/jobs/233909.html", "time": "2020-04-23", "level": "红色标题", "num_look": 70245, "num_comment": 1, "author": "FB独家", "tags": ["安全招聘"], "text": "4月23号晚19:00，完美世界直播招人。"}
{"title": "Pulsar：一款功能强大的可视化网络足迹扫描平台", "url": "https://www.freebuf.com/articles/network/232520.html", "time": "2020-04-23", "level": "", "num_look": 105656, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "Pulsar是一款专为红队研究人员、渗透测试人员和Bug Hunter们设计的自动化网络足迹扫描平台，该工具可以帮助我们在对目标组织基础设施了解不多的情况下，尽可能多地发现组织面向外部的资产。"}
{"title": "娄鹤：网络安全人员真的“安全”吗？", "url": "https://www.freebuf.com/articles/people/234381.html", "time": "2020-04-23", "level": "红色标题", "num_look": 157464, "num_comment": 8, "author": "Sandra1432", "tags": ["人物志"], "text": "“由于对IT技术、互联网创新业务的热爱，始终在关注这个行业，也发现了一些现象和问题，特别是安全技术人员的弱势、背锅、无意识犯罪，感到非常可惜，也值得社会反思和法律人的投入。”"}
{"title": "Tekya恶意软件混入Google Play", "url": "https://www.freebuf.com/articles/network/231545.html", "time": "2020-04-23", "level": "", "num_look": 68534, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "Google采取多种措施保护其应用商店并阻止恶意软件进入，但黑客仍在寻找渗透应用商店和访问用户设备的方法。"}
{"title": "《CS：GO》和《军团要塞2》源代码泄漏，Valve：稳住，别慌", "url": "https://www.freebuf.com/news/234706.html", "time": "2020-04-23", "level": "", "num_look": 75854, "num_comment": 3, "author": "kirazhou", "tags": ["游戏安全", "资讯"], "text": "面对《CS：GO》（《反恐精英：全球攻势》）和《TF2》（《军团要塞2》）源代码泄露事件引发的安全担忧，Valve表示：不用担心。"}
{"title": "登录就送小龙虾与苹果Pro！| A计划，安全大厂直播招人三期回顾", "url": "https://www.freebuf.com/jobs/234767.html", "time": "2020-04-23", "level": "红色标题", "num_look": 34665, "num_comment": 34665, "author": "FB独家", "tags": ["安全招聘"], "text": "今晚19点，最后一场「A计划！安全大厂直播招人」即将开始！来自完美世界的何艺、曹珊珊两位老师又将带给我们什么样的惊喜呢？"}
{"title": "CVE-2020-3119 Cisco CDP协议栈溢出漏洞分析", "url": "https://www.freebuf.com/vuls/231873.html", "time": "2020-04-23", "level": "", "num_look": 121845, "num_comment": 2, "author": "知道创宇404实验室", "tags": ["漏洞"], "text": "最近Cisco CDP协议爆了几个漏洞，挑了个栈溢出的CVE-2020-3119先来搞搞，Armis Labs也公开了他们的分析Paper。"}
{"title": "实战中如何绕过杀软用mimikatz获取账号密码", "url": "https://www.freebuf.com/articles/web/232534.html", "time": "2020-04-23", "level": "现金奖励", "num_look": 184740, "num_comment": 10, "author": "可爱又迷人的反派角色", "tags": ["WEB安全"], "text": "目标机system权限，安装了360，准备获取密码。"}
{"title": "关于MciroPython的智慧农业检测控制系统", "url": "https://www.freebuf.com/geek/196892.html", "time": "2020-04-23", "level": "现金奖励", "num_look": 113095, "num_comment": 1, "author": "_橙子 ゝ", "tags": ["极客"], "text": "智慧农业就是将物联网技术运用到传统农业中去，运用传感器和软件通过移动平台或者电脑平台对农业生产进行控制，使传统农业更具有“智慧”。"}
{"title": "FreeBuf早报｜洛杉矶都会区遭DoppelPaymer勒索软件攻击，部分文件泄露；OpenSSL 曝出一个高危漏洞；世卫和盖茨基金会被黑？疑2.5万电邮账号密码被公开", "url": "https://www.freebuf.com/news/234676.html", "time": "2020-04-23", "level": "红色标题", "num_look": 67531, "num_comment": 4, "author": "kirazhou", "tags": ["资讯"], "text": "据称，加利福尼亚州洛杉矶都会区的托伦斯市遭到DoppelPaymer勒索软件的攻击，未加密的数据被盗，设备被加密。"}
{"title": "宿主机利用在虚拟机中建立的VPN加密隧道连接内网", "url": "https://www.freebuf.com/sectool/234695.html", "time": "2020-04-23", "level": "现金奖励", "num_look": 102745, "num_comment": 2, "author": "regitnew", "tags": ["工具"], "text": "今天为大家介绍如何让宿主机利用在虚拟机中建立的VPN加密隧道连接内网。"}
{"title": "Pentest-Tools-Framework：一款专为渗透测试初学者设计的强大框架", "url": "https://www.freebuf.com/sectool/231606.html", "time": "2020-04-22", "level": "", "num_look": 140075, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Pentest-Tools-Framework是一个专为渗透测试设计的框架，其中包含了大量漏洞利用脚本、漏洞扫描器以及渗透测试工具。"}
{"title": "安全有你，pick you up！ | A计划，安全大厂直播招人二期回顾", "url": "https://www.freebuf.com/jobs/234610.html", "time": "2020-04-22", "level": "红色标题", "num_look": 41110, "num_comment": 41110, "author": "FB独家", "tags": ["安全招聘"], "text": "今晚19点，「A计划！安全大厂直播招人」精彩继续，来自字节跳动的林涛、宋丹两位老师将作客FreeBuf直播间招贤纳士！"}
{"title": "DRAMDig：最快69秒逆向触发Rowhammer攻击的DRAM地址映射", "url": "https://www.freebuf.com/articles/system/234605.html", "time": "2020-04-22", "level": "", "num_look": 94358, "num_comment": 1, "author": "百度安全实验室", "tags": ["系统安全"], "text": "谈到Rowhammer攻击，整个安全行业一定都不陌生。"}
{"title": "白帽公开课｜快速掌握安卓APP漏洞挖掘", "url": "https://www.freebuf.com/open/234634.html", "time": "2020-04-22", "level": "", "num_look": 82736, "num_comment": 82736, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "本课程适用于初中阶网络安全入门者，通过本节课的学习可快速掌握基本app的漏洞挖掘及理解，从代码、业务、web各个逻辑逐个击破。"}
{"title": "美国国家安全局发布2020年《缓解云漏洞指南》", "url": "https://www.freebuf.com/news/234592.html", "time": "2020-04-22", "level": "", "num_look": 70568, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "2020年1月，美国国家安全局（The U.S. National Security Agency）发布了一份指南，用于指导美国政府各机构处理云漏洞问题。"}
{"title": "话题讨论 | 国内白帽子“生存”现状", "url": "https://www.freebuf.com/news/234456.html", "time": "2020-04-22", "level": "红色标题", "num_look": 224603, "num_comment": 37, "author": "kirazhou", "tags": ["资讯"], "text": "钱少，活多，离家远？"}
{"title": "“洗钱“意外留下元数据？黑客被迫退回2500万美金", "url": "https://www.freebuf.com/news/234573.html", "time": "2020-04-22", "level": "", "num_look": 70493, "num_comment": 6, "author": "kirazhou", "tags": ["资讯"], "text": "攻击一天，收拾烂摊子（还钱）两天，3天白忙活。"}
{"title": "美发布俄罗斯GRU网络攻击行动报告", "url": "https://www.freebuf.com/articles/network/232403.html", "time": "2020-04-22", "level": "", "num_look": 75257, "num_comment": 2, "author": "Kriston", "tags": ["网络安全"], "text": "美国情报界Booz Allen Hamilton本周发布了一份综合报告，详细介绍了俄罗斯黑客近15年的网络攻击活动。"}
{"title": "今晚19:00直播预告，字节跳动安全岗位虚席以待 | FB招聘站特别企划", "url": "https://www.freebuf.com/jobs/233761.html", "time": "2020-04-22", "level": "", "num_look": 62490, "num_comment": 3, "author": "FB独家", "tags": ["安全招聘"], "text": "4月22号晚19:00，字节跳动直播间在线招人。"}
{"title": "一个例子引出的PLT与GOT姐妹花", "url": "https://www.freebuf.com/articles/others-articles/232329.html", "time": "2020-04-22", "level": "现金奖励", "num_look": 395175, "num_comment": 20, "author": "Plutol", "tags": ["其他", "系统安全"], "text": "最近刚刚接触到PLT与GOT，所以就想以此篇文章来巩固一下我对于这对姐妹花的理解啦！"}
{"title": "FreeBuf早报｜任天堂疑似遇安全漏洞；工信部推荐「数字化赋能」产品；安全研究员披露了4个IBM 0day漏洞", "url": "https://www.freebuf.com/news/234556.html", "time": "2020-04-22", "level": "红色标题", "num_look": 47395, "num_comment": 4, "author": "shidongqi", "tags": ["资讯"], "text": "任系新闻站LootPots创始人Pixelpar发推怀疑自己Switch关联的任天堂账号被黑，并称虽然所使用的的密码强度够大，其账户还是在一夜之间被多次异地访问。"}
{"title": "Kernel Hack实战：修改并编译手机内核源码对抗反调试", "url": "https://www.freebuf.com/articles/terminal/229624.html", "time": "2020-04-22", "level": "现金奖励", "num_look": 125029, "num_comment": 3, "author": "张召忠", "tags": ["终端安全"], "text": "攻防对立。程序调试与反调试之间的对抗是一个永恒的主题。在安卓逆向工程实践中，通过修改和编译安卓内核源码来对抗反调试是一种常见的方法。"}
{"title": "XXExploiter：一款功能强大的XXE漏洞扫描与利用工具", "url": "https://www.freebuf.com/sectool/231978.html", "time": "2020-04-21", "level": "", "num_look": 125383, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "XXExploiter是一款功能强大的XXE漏洞扫描与利用工具，在它的帮助下，广大安全研究人员可以轻松发现和利用XXE漏洞。"}
{"title": "昨晚的直播间发生了什么？ | A计划，安全大厂直播招人首期回顾", "url": "https://www.freebuf.com/jobs/234506.html", "time": "2020-04-21", "level": "红色标题", "num_look": 39229, "num_comment": 1, "author": "FB独家", "tags": ["安全招聘"], "text": "今晚19点，「A计划！安全大厂直播招人」继续，来自360的宋申雷、孙红民两位老师将来到FreeBuf直播间招揽群贤！"}
{"title": "挖洞经验 | HackerOne用户头像名称变化导致的DoS漏洞", "url": "https://www.freebuf.com/vuls/232237.html", "time": "2020-04-21", "level": "", "num_look": 150876, "num_comment": 7, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "该漏洞原因在于，当HackerOne注册用户在上传自己的头像图片时，由于在头像图片的文件名处（filename:unnamed.jpg）未设置有恰当的字符长度限制。"}
{"title": "阿里安全响应中心", "url": "https://www.freebuf.com/jobs/234199.html", "time": "2020-04-21", "level": "", "num_look": 54830, "num_comment": 1, "author": "alibaba", "tags": ["安全招聘"], "text": "阿里巴巴集团一直致力于建设诚信、共赢、繁荣的电子商务产业生态圈。安全是其健康成长的核心要素，为此特成立阿里安全响应中心。"}
{"title": "2.67亿Facebook用户信息以500英镑在暗网出售", "url": "https://www.freebuf.com/news/234439.html", "time": "2020-04-21", "level": "", "num_look": 65770, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "在这个特殊的风险时期，暗网市场似乎异常的活跃，一波未平一波又起，前有Zoom逾50万用户数据出售，后有2.67亿的Facebook用户数据上市。"}
{"title": "A计划第二场，360多个内推岗位可投 | FB招聘站特别企划", "url": "https://www.freebuf.com/jobs/233577.html", "time": "2020-04-21", "level": "", "num_look": 62508, "num_comment": 1, "author": "FB独家", "tags": ["安全招聘"], "text": "4月21号晚19:00，FB招聘站特别企划——360直播开启，参与就有机会获得 360 内推名额。"}
{"title": "Rocke Group团伙新挖矿病毒变种分析", "url": "https://www.freebuf.com/articles/system/232412.html", "time": "2020-04-21", "level": "", "num_look": 150908, "num_comment": 2, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近期，深信服安全团队捕获到Rocke Group黑产团伙运营的新挖矿病毒，并根据其传播域名特征将其命名为AliyunMiner。"}
{"title": "记一次域控服务器应急", "url": "https://www.freebuf.com/articles/system/231947.html", "time": "2020-04-21", "level": "现金奖励", "num_look": 465223, "num_comment": 20, "author": "bbbbbbig", "tags": ["系统安全"], "text": "解决问题过程中，由于客户给的压力较大，甚至几次都找错方向，但最终还是将问题解决，在这里我分享一下此次应急，希望能帮助到工作中的您。"}
{"title": "暗网流行数据报告，个人数据只值1美元", "url": "https://www.freebuf.com/articles/neopoints/234317.html", "time": "2020-04-21", "level": "", "num_look": 117623, "num_comment": 5, "author": "kirazhou", "tags": ["观点"], "text": "根据Terbium Labs的数据，欺诈指南占暗网上销售数据总量的将近一半（49％），其次是个人数据，占15.6％。"}
{"title": "关于Network Discovery的一些思考", "url": "https://www.freebuf.com/sectool/226489.html", "time": "2020-04-21", "level": "现金奖励", "num_look": 93907, "num_comment": 7, "author": "灭迹下的荒诞", "tags": ["工具"], "text": "在下这有一份你要搞的那个内网的主机端口明细表。"}
{"title": "FreeBuf早报｜数据泄露事件显示伊朗使用聊天应用进行间谍活动；“新基建”范围首次明确，发改委将出台发展指导意见；暗网盗卖金融信息，银行账户安全面临新挑战", "url": "https://www.freebuf.com/news/234403.html", "time": "2020-04-21", "level": "红色标题", "num_look": 52386, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "2020年4月20日，国家互联网应急中心（CNCERT）编写的《2019年我国互联网网络安全态势综述》报告正式发布。"}
{"title": "CNCERT发布《2019年我国互联网网络安全态势综述》", "url": "https://www.freebuf.com/articles/paper/234421.html", "time": "2020-04-21", "level": "", "num_look": 154052, "num_comment": 154052, "author": "CNCERT", "tags": ["安全报告"], "text": "2020年4月20日，国家互联网应急中心（CNCERT）编写的《2019年我国互联网网络安全态势综述》报告（以下简称“2019年态势报告”）正式发布。"}
{"title": "新手段：智能手机和PC散热风扇“合谋”窃取计算机数据", "url": "https://www.freebuf.com/news/234339.html", "time": "2020-04-20", "level": "", "num_look": 67253, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "近日，以色列的一个研究团队发现，可以利用一种特别的方式，“不动声色”地从计算机中窃取数据。"}
{"title": "Burpy：连接你的BurpSuite和Python", "url": "https://www.freebuf.com/sectool/231825.html", "time": "2020-04-20", "level": "现金奖励", "num_look": 148356, "num_comment": 9, "author": "m0nst3r", "tags": ["工具"], "text": "在App测试的时候，一般会选择Brida，它将BurpSuite和Frida结合了起来，这样BurpSuite里可以集成我们写的hook脚本，避免了在命令行和Burp之间的复制粘贴，极大了提高了渗透测试的效率。"}
{"title": "红蓝对抗场景下的二三事", "url": "https://www.freebuf.com/vuls/232185.html", "time": "2020-04-20", "level": "现金奖励", "num_look": 237232, "num_comment": 8, "author": "si1ence", "tags": ["企业安全", "漏洞"], "text": "未知攻焉知防,警察想要抓小偷,就该先摸透小偷的想法,才能更快捷的抓到小偷毕竟小偷抓小偷更容易。"}
{"title": "卢明樊：爱奇艺的业务安全风控“秘籍”", "url": "https://www.freebuf.com/articles/people/233378.html", "time": "2020-04-20", "level": "红色标题", "num_look": 174035, "num_comment": 6, "author": "kirazhou", "tags": ["人物志"], "text": "如果风控是一本真经的话，那么修炼之前一定要打通任督二脉，才能事半功倍，日进千里……"}
{"title": "APT41多漏洞网络攻击分析", "url": "https://www.freebuf.com/articles/network/231801.html", "time": "2020-04-20", "level": "", "num_look": 96715, "num_comment": 4, "author": "Kriston", "tags": ["网络安全"], "text": "研究人员发现自今年开始APT41开展了大范围的网络活动。从1月20日到3月11日APT41利用了Citrix NetScaler/ADC，Cisco路由器和Zoho ManageEngine Desktop Central等漏洞进行攻击攻击活动。"}
{"title": "A计划今晚首播，阿里安全岗位全新上架 | FB招聘站特别企划", "url": "https://www.freebuf.com/jobs/233559.html", "time": "2020-04-20", "level": "", "num_look": 77629, "num_comment": 1, "author": "FB独家", "tags": ["安全招聘"], "text": "4月20号晚19:00，FB招聘站特别企划——阿里安全直播开启，参与就有机会获得阿里安全内推名额。"}
{"title": "西门子S7系列中间人攻击：流量劫持和转发（一）", "url": "https://www.freebuf.com/articles/ics-articles/231701.html", "time": "2020-04-20", "level": "现金奖励", "num_look": 147478, "num_comment": 10, "author": "黄一113530", "tags": ["工控安全"], "text": "前一篇文章我主要讲述了西门子S7系列PLC安全防护，在攻击利用方面也重点提到了中间人攻击，今天我主要来讲述一下中间人攻击的第一步流量劫持和转发，也是最关键的那一步。"}
{"title": "SASE是一个什么样的黑科技", "url": "https://www.freebuf.com/articles/network/233942.html", "time": "2020-04-20", "level": "现金奖励", "num_look": 197026, "num_comment": 5, "author": "宇宸de研究室", "tags": ["网络安全"], "text": "Gartner对SASE的定义：SASE 是一种基于实体的身份、实时上下文、企业安全/合规策略，以及在整个会话中持续评估风险/信任的服务。"}
{"title": "路由抓包的种种姿势", "url": "https://www.freebuf.com/articles/network/232048.html", "time": "2020-04-20", "level": "金币+15", "num_look": 242865, "num_comment": 2, "author": "꧁", "tags": ["网络安全"], "text": "路由器在内网的重要性就不多说了，当我们拿到核心路由器，不会用的它仅仅是一台路由器，会用的或许已经完成了整套渗透的一大半，而本篇文章讲的是路由抓包。"}
{"title": "远控免杀从入门到实践之白名单（113个）总结篇", "url": "https://www.freebuf.com/articles/system/232074.html", "time": "2020-04-20", "level": "现金奖励", "num_look": 431171, "num_comment": 10, "author": "Tide重剑无锋", "tags": ["系统安全"], "text": "相信大家对白名单程序利用的手法也已经非常熟悉了，白名单程序利用其实是起源于LOLBins，全称“Living-Off-the-Land Binaries”。"}
{"title": "FreeBuf早报｜青岛胶州6000余人就诊名单泄露；725 个 Ruby 库发现剪切板劫持恶意程序；Tor项目裁员三分之一", "url": "https://www.freebuf.com/news/234282.html", "time": "2020-04-20", "level": "红色标题", "num_look": 57541, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": "4月19日，青岛胶州中心医院就诊名单被泄露一事有最新进展。胶州市公安局通报调查结果，认定最初获得名单并在微信群转发名单的3人侵犯了公民的个人隐私。"}
{"title": "Web Application核心防御机制记要", "url": "https://www.freebuf.com/articles/web/232186.html", "time": "2020-04-19", "level": "金币+15", "num_look": 146303, "num_comment": 3, "author": "灭迹下的荒诞", "tags": ["WEB安全"], "text": "为防止恶意输入，应用程序实施了大量的安全机制，而这些安全机制在概念上都具有相似性。"}
{"title": "SOC日志可视化工具：SOC Sankey Generator", "url": "https://www.freebuf.com/sectool/231106.html", "time": "2020-04-19", "level": "红色标题", "num_look": 111645, "num_comment": 1, "author": "lenny", "tags": ["工具"], "text": "作者身处甲方公司，有幸近两次参与到攻防演练行动当中，在这两次行动中也帮助公司逐步建立起来了一套SOC平台。"}
{"title": "域控管理员帐户架构扩展", "url": "https://www.freebuf.com/articles/es/230271.html", "time": "2020-04-19", "level": "红色标题", "num_look": 132827, "num_comment": 132827, "author": "周大涛", "tags": ["企业安全"], "text": "AD中的内置管理模型存在非常高的风险，它允许将Domain Admins和其他敏感帐户暴露给当今大多数企业网络中。"}
{"title": "RFID实战应用之常见射频卡扇区数据分析及破解", "url": "https://www.freebuf.com/articles/terminal/231555.html", "time": "2020-04-19", "level": "现金奖励", "num_look": 140290, "num_comment": 2, "author": "zyh0830", "tags": ["终端安全"], "text": "上篇文章我们已经介绍了ID卡的工作原理与破解方法。这篇文章在此介绍IC卡的原理及破解方法。"}
{"title": "TEA：一款基于TAS框架的SSH客户端蠕虫", "url": "https://www.freebuf.com/articles/network/231963.html", "time": "2020-04-18", "level": "", "num_look": 71294, "num_comment": 71294, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "TEA是一款基于TAS框架的SSH客户端蠕虫。"}
{"title": "Unicode同形字符域漏洞", "url": "https://www.freebuf.com/vuls/229446.html", "time": "2020-04-18", "level": "", "num_look": 137012, "num_comment": 137012, "author": "Kriston", "tags": ["WEB安全", "漏洞"], "text": "攻击者使用同形字符在gTLD（.com，.net等）以及某些公司的子域中注册同形字符域名，其外观上与其合法的域或子域并无明显差别。攻击者利用该手段对目标组织进行有针对性的攻击。"}
{"title": "BUF大事件丨警方抓获百度网盘“破解版”Pandownload 开发者；福特、大众畅销车曝安全漏洞，黑客可窃取隐私操控车辆", "url": "https://www.freebuf.com/news/234179.html", "time": "2020-04-18", "level": "红色标题", "num_look": 186369, "num_comment": 1, "author": "Darry端", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，警方抓获百度网盘“破解版”Pandownload 开发者；20余款App违规，瑞幸每日优鲜必胜客春雨医生等被点名；福特、大众畅销车曝安全漏洞，黑客可窃取隐私、操控车辆。"}
{"title": "DevOps专业人员如何成为网络安全拥护者", "url": "https://www.freebuf.com/articles/network/231806.html", "time": "2020-04-18", "level": "", "num_look": 71302, "num_comment": 1, "author": "晶颜123", "tags": ["网络安全"], "text": "打破信息孤岛，成为网络安全领域的拥护者，将会对您、您的职业以及您的企业组织产生有利影响。"}
{"title": "Github中间人攻击原理分析", "url": "https://www.freebuf.com/articles/web/231802.html", "time": "2020-04-18", "level": "现金奖励", "num_look": 158014, "num_comment": 5, "author": "WindsonYang", "tags": ["WEB安全"], "text": "3 月 26 日，国内多个地区访问 Github 以及 Github pages 的时候，谷歌浏览器提示“您的连接不是私密连接”的错误信息，不少用户想知道为什么会这样。"}
{"title": "Manul：一款基于覆盖率引导的并行模糊测试工具", "url": "https://www.freebuf.com/articles/terminal/227865.html", "time": "2020-04-17", "level": "", "num_look": 128888, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "Manul是一款基于覆盖率引导的并行模糊测试工具，该工具采用纯Python开发，并且已完全开源，广大研究人员可以使用Manul在Windows、Linux和macOS平台上对目标代码进行模糊测试或黑盒测试。"}
{"title": "记录过某常见WAF最新版", "url": "https://www.freebuf.com/articles/web/231905.html", "time": "2020-04-17", "level": "现金奖励", "num_look": 196056, "num_comment": 19, "author": "淡年华", "tags": ["WEB安全"], "text": "今天又有人问我怎么过某WAF，所以决定写个文章，记录下我注入时是如何过WAF的。"}
{"title": "网络层绕过IDSIPS的一些探索", "url": "https://www.freebuf.com/articles/system/233678.html", "time": "2020-04-17", "level": "", "num_look": 104922, "num_comment": 4, "author": "腾讯安全平台部", "tags": ["系统安全"], "text": "近两年兴起的大型网络攻防对抗比赛以实战的方式进行，这个举措非常好，以攻促防（“talk is cheap，show me the shell”），参赛大企业会更加关注实际的安全威胁并且想办法缓解。"}
{"title": "挖洞经验 | 用HTTP请求重写实现JSON CSRF", "url": "https://www.freebuf.com/vuls/230243.html", "time": "2020-04-17", "level": "", "num_look": 142039, "num_comment": 4, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "在该篇Writeup中，介绍了作者在某漏洞测试项目中发现JSON类型跨站请求伪造漏洞（Cross-Site Request Forgery,CSRF）的过程。"}
{"title": "微众银行信息安全部招人啦", "url": "https://www.freebuf.com/jobs/233611.html", "time": "2020-04-17", "level": "", "num_look": 98856, "num_comment": 4, "author": "微众银行SRC", "tags": ["安全招聘"], "text": "微众银行于2014年12月获得由深圳银监局颁发的金融许可证，是由腾讯、百业源和立业等多家知名企业发起设立、国内首家开业的民营银行。"}
{"title": "TrickBot木马将获取交易身份验证码的应用推向德国银行客户", "url": "https://www.freebuf.com/articles/terminal/231903.html", "time": "2020-04-17", "level": "", "num_look": 111974, "num_comment": 2, "author": "暗影安全实验室", "tags": ["终端安全"], "text": "最近暗影实验室获取到一个应用名为Avast Sicherheitskontrolle的恶意程序。"}
{"title": "FreeBuf早报｜黑客在暗网上出售1.15亿巴基斯坦移动用户的数据；恶意URL可能会导致Git将存储的凭据提供给错误的服务器；黑客叫卖数百万银行客户信息，农行平安等否认称系不法分子伪造", "url": "https://www.freebuf.com/news/234080.html", "time": "2020-04-17", "level": "红色标题", "num_look": 53338, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "来自巴西的黑客发起网络钓鱼活动，通过特制的Android Trojan-Banker攻击葡萄牙银行组织的客户。"}
{"title": "关于WordPress InfiniteWP Client的身份认证绕过漏洞的分析与利用", "url": "https://www.freebuf.com/vuls/232278.html", "time": "2020-04-17", "level": "现金奖励", "num_look": 124680, "num_comment": 1, "author": "Neroqi", "tags": ["WEB安全", "漏洞"], "text": "InfiniteWP Client是一个WordPress插件，当它与InfiniteWP Admin Panel结合使用时，可以方便快捷地集中管理多个WordPress站点。"}
{"title": "UEBA实践：CISO内部威胁管理指南", "url": "https://www.freebuf.com/articles/es/234017.html", "time": "2020-04-16", "level": "", "num_look": 152623, "num_comment": 1, "author": "安恒信息", "tags": ["企业安全"], "text": "智慧城市的建设推动着我国生产模式的变革，随着经济数字化、政府数字化的建设，数据和网络已经成为我国政府和企业不可或缺的一部分。"}
{"title": "今晚8点 | 云时代下的DDoS安全体系建设", "url": "https://www.freebuf.com/open/233982.html", "time": "2020-04-16", "level": "红色标题", "num_look": 78933, "num_comment": 78933, "author": "FB独家", "tags": ["FreeBuf公开课"], "text": "今晚8点，腾讯安全高级工程师陈国将带来《云时代下的DDoS安全体系建设》直播公开课。"}
{"title": "福特、大众畅销车曝安全漏洞，黑客可窃取隐私、操控车辆", "url": "https://www.freebuf.com/news/233955.html", "time": "2020-04-16", "level": "", "num_look": 83127, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "近日，一份来自英国消费者协会杂志《Which?》调查报告发现，福特和大众的两款畅销车存在严重安全漏洞，黑客可利用该漏洞发动攻击，窃取车主的个人隐私信息，甚至是操控车辆。"}
{"title": "Dirble：一款高性能目录扫描与爬取工具", "url": "https://www.freebuf.com/articles/network/231596.html", "time": "2020-04-16", "level": "", "num_look": 103713, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "今天给大家介绍的是一款名叫Dirble工具，它是一款易于使用的高性能网站目录扫描工具。"}
{"title": "白帽公开课｜PWN入门到得分（Level0）", "url": "https://www.freebuf.com/open/233787.html", "time": "2020-04-16", "level": "", "num_look": 85376, "num_comment": 2, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "本课程将简单介绍C语言可执行文件的运行原理，讲解C语言从源文件到可运行文件的过程，并通过解读C语言反编译伪代码解决CTF pwn题。"}
{"title": "突破百度网盘限速工具Pandownload作者被抓，存在泄露用户隐私数据风险", "url": "https://www.freebuf.com/news/233830.html", "time": "2020-04-16", "level": "红色标题", "num_look": 366764, "num_comment": 39, "author": "你要的白不是黑", "tags": ["资讯"], "text": "今年2月，受害人刘某报案称其下载的“Pandownload”软件会在未授权的情况下，将自己百度网盘的数据共享出去，导致隐私照片和文件泄露。"}
{"title": "伊组织对美发起新一轮攻击", "url": "https://www.freebuf.com/articles/network/231307.html", "time": "2020-04-16", "level": "", "num_look": 77021, "num_comment": 77021, "author": "Kriston", "tags": ["网络安全"], "text": "研究人员近期发现了APT34利用新工具集进行的网络活动。根据此次发现的网络钓鱼文件，伊朗黑客组织将美国Westat员工或Westat提供服务的组织作为攻击目标。"}
{"title": "多款光纤路由器设备在野0-day漏洞简报", "url": "https://www.freebuf.com/vuls/233868.html", "time": "2020-04-16", "level": "", "num_look": 149780, "num_comment": 1, "author": "360Netlab", "tags": ["漏洞"], "text": "这是我们过去30天内的第3篇IoT 0-day漏洞文章，之前我们还披露了DrayTek Router在野0-day漏洞分析报告，LILIN DVR在野0-day漏洞分析报告。"}
{"title": "Python代码审计实战案例总结之反序列化和命令执行", "url": "https://www.freebuf.com/vuls/231797.html", "time": "2020-04-16", "level": "现金奖励", "num_look": 171544, "num_comment": 3, "author": "米怀特", "tags": ["WEB安全", "漏洞"], "text": "Python代码审计方法多种多样，但是总而言之是根据前人思路的迁移融合扩展而形成。目前Python代码审计思路，呈现分散和多样的趋势。"}
{"title": "USB流量取证分析", "url": "https://www.freebuf.com/articles/database/231809.html", "time": "2020-04-16", "level": "现金奖励", "num_look": 177449, "num_comment": 1, "author": "polemo", "tags": ["数据安全"], "text": "通过对USB接口流量的监听，我们可以得到键盘的击键记录、鼠标的移动轨迹、磁盘的传输内容等一系列信息。"}
{"title": "FreeBuf早报｜警方抓获百度网盘“破解版”Pandownload 开发者；Nemty勒索软件将在10个月后关闭服务；EA服务器遭攻击 《战地5》《FIFA 20》都无法登录", "url": "https://www.freebuf.com/news/233822.html", "time": "2020-04-16", "level": "红色标题", "num_look": 63672, "num_comment": 4, "author": "kirazhou", "tags": ["资讯"], "text": "Nemty勒索软件的运营商本周宣布，他们将在运营10个月后关闭其服务。"}
{"title": "当PLC偶遇老旧但不乏经典的高级组包工具Hping3", "url": "https://www.freebuf.com/vuls/230453.html", "time": "2020-04-16", "level": "金币+20", "num_look": 176854, "num_comment": 3, "author": "VllTomFord", "tags": ["工控安全", "漏洞"], "text": "自从购买了PLC设备后，经常在网上搜索一些关于PLC的漏洞进行复现，但网上根本找不到漏洞相关的exp，只好自己摸着石头过河。"}
{"title": "Lazarus APT组织利用新冠疫情诱饵针对某国地区的定向攻击分析", "url": "https://www.freebuf.com/articles/system/233528.html", "time": "2020-04-16", "level": "", "num_look": 87950, "num_comment": 87950, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "Lazarus是疑似具有东北亚背景的APT组织，因2014年攻击索尼影业开始受到广泛关注，其攻击活动最早可追溯到2007年。"}
{"title": "今晚8点见 | 国内抗DDoS产品研究报告解读公开课", "url": "https://www.freebuf.com/open/233766.html", "time": "2020-04-15", "level": "红色标题", "num_look": 79320, "num_comment": 1, "author": "FB独家", "tags": ["FreeBuf公开课"], "text": "4月15日（今天），20：00，由FreeBuf主编、FreeBuf咨询研究经理鲍弘捷，为大家带来《国内抗DDoS产品研究报告解读》的分享。"}
{"title": "Phorpiex僵尸网络技术分析（二）", "url": "https://www.freebuf.com/articles/network/230724.html", "time": "2020-04-15", "level": "", "num_look": 92063, "num_comment": 92063, "author": "Kriston", "tags": ["网络安全"], "text": "Phorpiex僵尸网络中有超过1,000,000台被感染的Windows计算机。"}
{"title": "Fireeye勒索软件部署趋势分析", "url": "https://www.freebuf.com/articles/system/231447.html", "time": "2020-04-15", "level": "", "num_look": 103644, "num_comment": 2, "author": "Kriston", "tags": ["系统安全"], "text": "勒索软件是一个远程数字化恶意软件，具有破坏性强和经济影响高，影响范围广的特点，从尖端空间技术公司到羊毛工业，再到工业环境都受其影响。"}
{"title": "因未启用HTTPS，利用漏洞可向TikTok用户推送虚假视频", "url": "https://www.freebuf.com/news/233600.html", "time": "2020-04-15", "level": "红色标题", "num_look": 151665, "num_comment": 6, "author": "Sandra1432", "tags": ["漏洞", "资讯"], "text": "近日，抖音海外版TikTok披露了一个安全隐患，当部分视频没有启用HTTPS链接时，容易受到黑客拦截追踪、甚至是进行篡改攻击。"}
{"title": "欧洲能源巨头遭勒索，用1000万欧元换10TB数据？", "url": "https://www.freebuf.com/news/233712.html", "time": "2020-04-15", "level": "", "num_look": 113287, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "近日，攻击者利用Ragnar Locker勒索软件袭击了葡萄牙跨国能源公司EDP（Energias de Portugal），并且索要1580的比特币赎金（折合约1090万美元/990万欧元）。"}
{"title": "杀软对抗：利用图床匿名上传恶意PE文件", "url": "https://www.freebuf.com/articles/system/227532.html", "time": "2020-04-15", "level": "", "num_look": 128578, "num_comment": 9, "author": "hijacking", "tags": ["系统安全"], "text": "思路源于渗透测试当中图片马原理。今天要说的不是修改头来伪装成图片，而是使用cmd的copy命令来进行文件上传。"}
{"title": "全职漏洞猎人的故事，这个职业令人向往但并不容易", "url": "https://www.freebuf.com/articles/network/233554.html", "time": "2020-04-15", "level": "", "num_look": 140151, "num_comment": 12, "author": "kirazhou", "tags": ["网络安全"], "text": "如果你做得好，钱就多。"}
{"title": "浅谈远程办公安全", "url": "https://www.freebuf.com/articles/es/231605.html", "time": "2020-04-15", "level": "", "num_look": 163756, "num_comment": 2, "author": "feil", "tags": ["企业安全"], "text": "2020年的1月一场疫情的突然来袭，由于病毒传播的特性，为了避免群体聚集，保障生命安全。远程办公就成为了一场如火如荼又势在必行人人参与的工程。"}
{"title": "FreeBuf早报｜国家安全部披露多起境外APT窃密案例；400万Quidd用户账户信息在黑客论坛上共享；Zoom将允许付费用户选择特定区域的数据中心", "url": "https://www.freebuf.com/news/233687.html", "time": "2020-04-15", "level": "红色标题", "num_look": 71432, "num_comment": 5, "author": "shidongqi", "tags": ["资讯"], "text": "Quidd是一个销售贴纸、卡片、玩具和其他收藏品的在线市场，在2019年似乎遭遇了数据泄露，目前约有400万用户的详细信息正在地下黑客论坛上免费分享。"}
{"title": "记一次对PUBG外挂病毒的反制过程", "url": "https://www.freebuf.com/articles/web/231670.html", "time": "2020-04-15", "level": "现金奖励", "num_look": 143031, "num_comment": 13, "author": "夜无名", "tags": ["WEB安全"], "text": "因翻出了此USB加密狗，心血来潮想开把游戏试试还有没有效果，进入商家之前提供的下载地址下载软件……这不是赤裸裸的远控吗？"}
{"title": "国家安全部披露多起境外APT窃密案例", "url": "https://www.freebuf.com/news/233626.html", "time": "2020-04-14", "level": "", "num_look": 80673, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "在第五个“全民国家安全教育日”之际，国家安全部披露多起有关APT（Adavanced Persistent Threat，是指针对明确目标的持续的、复杂的网络攻击）窃密的案例。"}
{"title": "浅析Docker运行安全", "url": "https://www.freebuf.com/articles/es/231647.html", "time": "2020-04-14", "level": "", "num_look": 178283, "num_comment": 4, "author": "白河·愁", "tags": ["企业安全", "容器安全"], "text": "docker 安全的第三部分。"}
{"title": "PsiXBot：模块化.NET僵尸网络的进化", "url": "https://www.freebuf.com/articles/system/230877.html", "time": "2020-04-14", "level": "", "num_look": 103010, "num_comment": 1, "author": "Avenger", "tags": ["系统安全"], "text": "本文中我们将分享我们对模块化恶意软件 PsiXBot 的分析。该恶意软件于 2017 年首次出现，最近一段时间核心代码与模块有了很大改变。"}
{"title": "挖洞经验 | 利用XML和ZIP格式解析漏洞实现RCE", "url": "https://www.freebuf.com/vuls/228592.html", "time": "2020-04-14", "level": "", "num_look": 173981, "num_comment": 2, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "在该篇Writeup中，作者通过利用XXE和ZIP文件目录遍历漏洞，在目标Web应用系统中成功创建了Webshell，实现远程代码执行（RCE）。"}
{"title": "平安科技诚聘SDL安全工程师", "url": "https://www.freebuf.com/jobs/233309.html", "time": "2020-04-14", "level": "", "num_look": 90130, "num_comment": 90130, "author": "melody312", "tags": ["安全招聘"], "text": "平安科技是平安集团旗下科技解决方案专家，致力于运用人工智能、云等技术，赋能金融、医疗、房产、汽车、智慧城市五大生态圈。"}
{"title": "等保测评2.0：SQLServer访问控制（下）", "url": "https://www.freebuf.com/articles/database/228119.html", "time": "2020-04-14", "level": "现金奖励", "num_look": 187604, "num_comment": 2, "author": "起于凡而非于凡", "tags": ["数据安全", "标准与合规"], "text": "本篇文章主要说一说SQLServer数据库中访问控制控制点的测评项的理解。"}
{"title": "入侵分析钻石模型学习笔记", "url": "https://www.freebuf.com/articles/network/228120.html", "time": "2020-04-14", "level": "", "num_look": 119200, "num_comment": 4, "author": "安恒信息安全研究院", "tags": ["网络安全"], "text": "《TheDiamond Model of Intrusion Analysis》是Sergio Caltagirone等人在2013年发表的一篇论文，这篇论文详细介绍了一个描述入侵分析的模型，作者称之为“钻石模型”。"}
{"title": "FreeBuf早报｜英国政府在应对新冠流行时使用大量机密病人信息；暗网论坛上提供了数千个Zoom凭据；最高检：境外黑客组织“暗夜小组”被全链条摧毁", "url": "https://www.freebuf.com/news/233500.html", "time": "2020-04-14", "level": "红色标题", "num_look": 75604, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "安全研究人员在一个暗网论坛上发现了一个存档，其中包含成千上万个受损的Zoom凭据。一些记录还包括会议ID、名称和主持人密钥。"}
{"title": "三十而弃：老牌杀软“小红伞”Avira接受被收购命运", "url": "https://www.freebuf.com/news/233442.html", "time": "2020-04-14", "level": "", "num_look": 67828, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "4月9日，巴林投资银行(Investcorp Bank)旗下的私募股权部门Investcorp Technology Partners（ITP）宣布收购德国网络安全公司Avira，这让Avira的总估值达到1.8亿美元（约合人民币12.7亿元）。"}
{"title": "超级产品力系列 | 国内抗DDoS产品研究报告公开课即将开课", "url": "https://www.freebuf.com/open/233469.html", "time": "2020-04-13", "level": "红色标题", "num_look": 134864, "num_comment": 1, "author": "FB独家", "tags": ["FreeBuf公开课"], "text": "4月15日-16日，「超级产品力系列 | 2020国内抗DDoS产品研究报告公开课」即将上线。"}
{"title": "Gadgetinspector：一款针对Java应用程序库的字节码分析工具", "url": "https://www.freebuf.com/sectool/228003.html", "time": "2020-04-13", "level": "", "num_look": 117044, "num_comment": 117044, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Gadgetinspector是一款针对Java应用程序/库的字节码分析工具，它可以帮助研究人员寻找和分析Java应用程序中的反序列化小工具链（Gadget Chain）。"}
{"title": "白帽公开课｜安全测试学习指南（入门篇）", "url": "https://www.freebuf.com/fevents/233437.html", "time": "2020-04-13", "level": "", "num_look": 73908, "num_comment": 73908, "author": "FB客服", "tags": ["活动"], "text": "通过本次课程，讲师将带大家入门安全测试，掌握常用的测试工具，同时结合实战玩转web、主机漏洞测试。"}
{"title": "话题讨论 | 企业机构的研究院如何为企业创造价值?", "url": "https://www.freebuf.com/articles/neopoints/233330.html", "time": "2020-04-13", "level": "红色标题", "num_look": 961992, "num_comment": 11, "author": "kirazhou", "tags": ["观点"], "text": "看着领导远去的背影，脑子里浮现出一个令人头秃的问题……"}
{"title": "一起名不见经传的勒索事件的启示：“小心“第三方供应商", "url": "https://www.freebuf.com/news/233352.html", "time": "2020-04-13", "level": "", "num_look": 69903, "num_comment": 2, "author": "kirazhou", "tags": ["资讯"], "text": "事情要从一场看似普普通通的勒索攻击说起。"}
{"title": "银行手机木马分析", "url": "https://www.freebuf.com/articles/terminal/231108.html", "time": "2020-04-13", "level": "", "num_look": 153495, "num_comment": 3, "author": "Kriston", "tags": ["终端安全"], "text": "Android银行木马Geost是最初监视HtBot恶意代理网络检测到的。该僵尸网络以俄罗斯银行为目标，受害者人数已超过80万。该木马使用了混淆，加密，反射和注入非功能代码等方法使逆向分析更加困难。"}
{"title": "旧金山国际机场遭网络攻击，黑客窃取Windows用户凭据", "url": "https://www.freebuf.com/news/233344.html", "time": "2020-04-13", "level": "", "num_look": 64222, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "上周五，旧金山国际机场（SFO）披露了一起数据泄露事件，起因是其两个网站遭遇网络攻击，黑客窃取了用户的Windows登录凭据。"}
{"title": "新银行木马“Eventbot”，影响234个金融应用", "url": "https://www.freebuf.com/articles/terminal/231459.html", "time": "2020-04-13", "level": "", "num_look": 173464, "num_comment": 1, "author": "奇安信威胁情报中心", "tags": ["终端安全"], "text": "2020年无疑是多灾多难的一年，虽然时间目前只过去了四分之一。但借着“新冠肺炎”各种衍生的自然灾难、人为灾难接踵而至。"}
{"title": "漫谈SDL：开篇明义", "url": "https://www.freebuf.com/articles/es/232252.html", "time": "2020-04-13", "level": "现金奖励", "num_look": 538297, "num_comment": 13, "author": "若水行", "tags": ["企业安全"], "text": "SDL只是方法论，忌为SDL而SDL"}
{"title": "CSRF的攻击、防御与挖掘", "url": "https://www.freebuf.com/articles/web/231614.html", "time": "2020-04-13", "level": "", "num_look": 152408, "num_comment": 7, "author": "jerrybird", "tags": ["WEB安全"], "text": "聊一聊关于CSRF的攻击、防御与挖掘等问题……"}
{"title": "FreeBuf早报｜旧金山机场遭网络攻击已确认：用户Windows密码被盗；两名小学生状告谷歌非法收集隐私；拒绝被勒索后SpaceX、特斯拉、波音的机密文件遭黑客泄露", "url": "https://www.freebuf.com/news/233319.html", "time": "2020-04-13", "level": "红色标题", "num_look": 76230, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "黑客在网络攻击期间设法破坏了旧金山国际机场的两个网站：SFOConnect.com和SFOConstruction.com。"}
{"title": "工业互联网安全研究笔记", "url": "https://www.freebuf.com/articles/ics-articles/231508.html", "time": "2020-04-13", "level": "", "num_look": 180670, "num_comment": 7, "author": "xxx幸xxx", "tags": ["工控安全"], "text": "工业互联网作为我国打造制造强国的核心手段，也是最近大家谈论很多的“新基建”之一。那么，咱们今天要谈的工业互联网安全，它的防护对象有哪些呢？"}
{"title": "火眼：COVID-19对网络威胁形势影响有限", "url": "https://www.freebuf.com/articles/network/233146.html", "time": "2020-04-12", "level": "", "num_look": 106562, "num_comment": 1, "author": "Sandra1432", "tags": ["网络安全"], "text": "虽然COVID-19重创我们的社会经济，但是在网络安全领域，它产生的影响还是有限的，最主要的原因还是在于目前所追踪的攻击者使用的工具手法其实和以前一样。"}
{"title": "在Linux上狩猎Netwire RAT", "url": "https://www.freebuf.com/articles/others-articles/230353.html", "time": "2020-04-12", "level": "", "num_look": 50451, "num_comment": 50451, "author": "Avenger", "tags": ["其他"], "text": "如今攻击者可以选择多种 RAT，现在的这些 RAT 不仅针对 Windows 而是跨平台的（如 CrossRAT、Pupy 与 Netwire）。"}
{"title": "Mirai新变体Mukashi分析", "url": "https://www.freebuf.com/articles/network/231117.html", "time": "2020-04-12", "level": "", "num_look": 102484, "num_comment": 102484, "author": "Kriston", "tags": ["网络安全"], "text": "CVE-2020-9054 PoC于上个月公开发布后立即被用来感染Zyxel NAS设备。"}
{"title": "利用“新冠”的勒索病毒和短信蠕虫", "url": "https://www.freebuf.com/articles/terminal/231246.html", "time": "2020-04-12", "level": "", "num_look": 141907, "num_comment": 1, "author": "暗影安全实验室", "tags": ["终端安全"], "text": "“新型冠状病毒肺炎”已上升为全球性事件。"}
{"title": "缓冲区溢出之Strcpy和Memcpy", "url": "https://www.freebuf.com/articles/others-articles/230731.html", "time": "2020-04-12", "level": "", "num_look": 56814, "num_comment": 56814, "author": "Plutol", "tags": ["其他"], "text": "定义三个函数fu'n1,fun2,fun3，不使用嵌入式汇编调用和函数调用，仅仅字符串的操作按顺序调用他们。"}
{"title": "Lazydocker：一款功能强大的Docker管理套件", "url": "https://www.freebuf.com/sectool/231110.html", "time": "2020-04-11", "level": "", "num_look": 185725, "num_comment": 185725, "author": "Alpha_h4ck", "tags": ["容器安全", "工具"], "text": "Lazydocker是一款专为懒人设计的Docker以及Docker-Compose终端管理工具，该工具采用Go语言开发，基于gocui实现。"}
{"title": "M-Trends 2020报告", "url": "https://www.freebuf.com/articles/network/230954.html", "time": "2020-04-11", "level": "", "num_look": 183759, "num_comment": 183759, "author": "Kriston", "tags": ["安全报告", "网络安全"], "text": "15年来FireEye每天都在检测和响应网络攻击， M-Trends 2020是为网络安全社区提供一线安全信息报告的第11年。"}
{"title": "中国移动苏州研发中心招聘安全研发工程师", "url": "https://www.freebuf.com/jobs/232799.html", "time": "2020-04-11", "level": "", "num_look": 59880, "num_comment": 1, "author": "secgeorge", "tags": ["安全招聘"], "text": "中移（苏州）软件技术有限公司（简称中移软件）是中国移动通信集团有限公司2014年注资成立的全资子公司（对内也称中国移动苏州研发中心）。"}
{"title": "BUF大事件丨WannaRen勒索病毒：从传播到解密；Switch全系告破，黑客开售硬件；黑客揭iPhone相机0day漏洞，获7.5万美元奖励", "url": "https://www.freebuf.com/news/233274.html", "time": "2020-04-11", "level": "红色标题", "num_look": 215173, "num_comment": 1, "author": "Darry端", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，WannaRen勒索病毒：从传播到解密共7天；Switch全系告破 黑客开售硬件模块；黑客揭iPhone相机0day漏洞，获7.5万美元奖励。"}
{"title": "对抗中的主动防御：攻防演练和小规模网络对抗的战术分析", "url": "https://www.freebuf.com/articles/others-articles/232889.html", "time": "2020-04-11", "level": "", "num_look": 74626, "num_comment": 74626, "author": "Knownsec知道创宇", "tags": ["其他"], "text": "结合四年来攻防演练的经验，以及对近年来国内外实战对抗的总结后，我认为要想把攻防演练和小规模网络对抗的防御工作做好，必须解决这些问题。"}
{"title": "通读审计之DOYOCMS", "url": "https://www.freebuf.com/vuls/229823.html", "time": "2020-04-11", "level": "现金奖励", "num_look": 206250, "num_comment": 15, "author": "Heihu577", "tags": ["WEB安全", "漏洞"], "text": "给大家分享一下我个人的整个代码审计过程，以及如何发现漏洞，如何自己构造语句等等。"}
{"title": "Extended ssrf search：一款功能强大的SSRF智能漏洞扫描工具", "url": "https://www.freebuf.com/sectool/228925.html", "time": "2020-04-10", "level": "", "num_look": 169652, "num_comment": 169652, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Extended ssrf search是一款功能强大的SSRF智能漏洞扫描工具，该工具可以通过在请求中设置不同的预定义参数来搜索SSRF漏洞，这些参数包括路径、主机、Header、POST和GET参数。"}
{"title": "重金活动｜盒子梦想趴の金融专场，可能是上半年最奥利给的机会来了", "url": "https://www.freebuf.com/fevents/233266.html", "time": "2020-04-10", "level": "", "num_look": 87996, "num_comment": 87996, "author": "漏洞盒子", "tags": ["活动"], "text": "停止柠檬，不要羡慕。梦想趴金融专场，让别人来羡慕你！"}
{"title": "超级产品力系列之抗DDoS「领先层」产品 | FreeBuf咨询发布", "url": "https://www.freebuf.com/articles/paper/233216.html", "time": "2020-04-10", "level": "红色标题", "num_look": 186900, "num_comment": 2, "author": "FreeBuf咨询", "tags": ["安全报告"], "text": "FreeBuf咨询通过对国内近百家企业的使用情况进行对比分析，最终有中国电信（云堤）、绿盟科技、阿里云、腾讯云、知道创宇、天融信以及上海云盾七家厂商入选超级产品力系列之抗DDoS「领先层」产品。"}
{"title": "红队战术：流程监控技术", "url": "https://www.freebuf.com/articles/es/230273.html", "time": "2020-04-10", "level": "红色标题", "num_look": 207275, "num_comment": 207275, "author": "周大涛", "tags": ["企业安全"], "text": "我们将探索著名的过程监控程序的功能，并演示Red Team在进攻性行动中如何使用这些工具背后的技术。"}
{"title": "虎牙直播安全招聘", "url": "https://www.freebuf.com/jobs/232035.html", "time": "2020-04-10", "level": "", "num_look": 105828, "num_comment": 9, "author": "jidangege", "tags": ["安全招聘"], "text": "虎牙公司是一家以游戏直播为核心业务、致力于打造全球领先直播平台的技术驱动型内容公司，旗下产品包括知名游戏直播平台虎牙直播、风靡东南亚和南美的游戏直播平台NimoTV等，产品覆盖PC、Web、移动三端。"}
{"title": "A计划 ，安全大厂直播招人｜FB招聘站特别企划", "url": "https://www.freebuf.com/jobs/233161.html", "time": "2020-04-10", "level": "红色标题", "num_look": 164480, "num_comment": 1, "author": "FB独家", "tags": ["FreeBuf公开课", "安全招聘"], "text": "4月20-23日，每晚19：00，FB招聘站联合阿里安全、360、字节跳动、完美世界四家企业共同开启安全行业首场线上直播招聘会。"}
{"title": "又以“国家安全”之名，美司法部要求FCC撤销中国电信的运营授权", "url": "https://www.freebuf.com/news/233197.html", "time": "2020-04-10", "level": "", "num_look": 104255, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "一些美国行政部门机构正在要求联邦通信委员会（FCC）撤销并终止中国电信美洲公司提供往来美国的国际电信服务授权。"}
{"title": "DDG的新征程——自研P2P协议构建混合P2P网络", "url": "https://www.freebuf.com/articles/network/233213.html", "time": "2020-04-10", "level": "", "num_look": 117193, "num_comment": 2, "author": "360Netlab", "tags": ["网络安全"], "text": "DDG Mining Botnet 是一个活跃已久的挖矿僵尸网络，其主要的盈利方式是挖 XMR。从 2019.11 月份至今，我们的 Botnet 跟踪系统监控到 DDG Mining Botnet 一直在频繁跟新。"}
{"title": "21世纪以来14起最大的数据泄露事件", "url": "https://www.freebuf.com/articles/database/231332.html", "time": "2020-04-10", "level": "", "num_look": 229155, "num_comment": 2, "author": "Sandra1432", "tags": ["数据安全"], "text": "以前，影响几百万人的数据泄露事件就能成为新闻头条，而如今，影响数亿甚至数十亿的事件却比比皆是。21世纪以来，14起最大的数据泄露事件波及约有35亿人，其中影响最小的事件涉及1.34亿人。"}
{"title": "网赚江湖与流量欺诈", "url": "https://www.freebuf.com/articles/network/230875.html", "time": "2020-04-10", "level": "红色标题", "num_look": 157347, "num_comment": 6, "author": "GEETEST极验", "tags": ["网络安全"], "text": "只需要一部手机，就可以轻松实现日入 2000。"}
{"title": "透明部落组织利用印度美女为诱饵的攻击样本分析", "url": "https://www.freebuf.com/articles/paper/232780.html", "time": "2020-04-10", "level": "现金奖励", "num_look": 156478, "num_comment": 2, "author": "fuckgod", "tags": ["安全报告"], "text": "透明部落(Transparent Tribe ),别名APT36,ProjectM,C-Major,据称具有南亚背景，主要针对周边国家政治军事进行定向攻击活动，专属木马为CrimsonRAT。"}
{"title": "等保测评2.0：SQLServer访问控制（上）", "url": "https://www.freebuf.com/articles/database/226586.html", "time": "2020-04-10", "level": "现金奖励", "num_look": 339712, "num_comment": 3, "author": "起于凡而非于凡", "tags": ["数据安全", "标准与合规"], "text": "本篇文章主要说一说SQLServer数据库中访问控制控制点涉及到的SQLServer基础知识。"}
{"title": "FreeBuf早报｜“小红伞”Avira被巴林投资银行收购；WannaRen勒索病毒作者主动提供解密密钥；谷歌禁止员工在笔记本使用Zoom视频会议应用", "url": "https://www.freebuf.com/news/233168.html", "time": "2020-04-10", "level": "红色标题", "num_look": 82487, "num_comment": 4, "author": "shidongqi", "tags": ["资讯"], "text": "据报道，Avira已经被巴林投资银行(Investcorp Bank)旗下的PE部门Investcorp Technology Partners（ITP）抢购了。巴林投资银行的计划是帮助Avira执行更大规模的安全领域收购整合。"}
{"title": "中央发布重磅意见，数据首次正式被纳入生产要素范围，强调要加快培育数据要素市场", "url": "https://www.freebuf.com/news/233172.html", "time": "2020-04-10", "level": "红色标题", "num_look": 93923, "num_comment": 1, "author": "百里不守约", "tags": ["资讯"], "text": "《意见》分类提出了土地、劳动力、资本、技术、数据五个要素领域改革的方向，明确了完善要素市场化配置的具体举措。数据作为一种新型生产要素首次正式出现在官方文件中，意义非同一般。"}
{"title": "WannaRen勒索病毒作者主动公开RSA私钥，经验证可成功解密文件", "url": "https://www.freebuf.com/news/232638.html", "time": "2020-04-09", "level": "", "num_look": 275035, "num_comment": 19, "author": "Sandra1432", "tags": ["资讯"], "text": "近日，网络开始传播一种新型勒索病毒“WannaRen”，该类型的勒索病毒可以加密Windows系统中几乎所有的文件，大量网友中招。今日，勒索病毒作者主动公开RSA密钥，经验证可成功解密文件。"}
{"title": "Http-Asynchronous-Reverse-Shell：一款基于HTTP协议的异步反向Shell", "url": "https://www.freebuf.com/articles/network/229825.html", "time": "2020-04-09", "level": "", "num_look": 120744, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "目前，我们有很多种方法可以创建一个反向Shell，并尝试绕过防火墙以成功控制远程设备。但实际上，传出的连接并不一定都会被过滤。"}
{"title": "NSO与Facebook：由间谍软件引发的爱恨情仇？", "url": "https://www.freebuf.com/news/233067.html", "time": "2020-04-09", "level": "", "num_look": 62778, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "这波被告转原告的既视感是怎么回事？Facebook直接变“贼喊捉贼”了？不过，面对NSO的陈述，Facebook表示：没有这回事，这是NSO意图转移焦点。"}
{"title": "重磅｜超级产品力系列之《2020国内抗DDoS产品研究报告》正式发布", "url": "https://www.freebuf.com/articles/paper/230721.html", "time": "2020-04-09", "level": "红色标题", "num_look": 428384, "num_comment": 10, "author": "FreeBuf咨询", "tags": ["安全报告"], "text": "2019年，云上DDoS攻击发生近百万次，日均攻击2000余次，与2018年整体持平，但 相比2019年上半年有所下降。同时，应用层DDoS(CC攻击)成为常见的攻击类型，与2018年相比，攻击手 法也更为多变复杂。"}
{"title": "Phorpiex僵尸网络技术分析（一）", "url": "https://www.freebuf.com/articles/network/230546.html", "time": "2020-04-09", "level": "", "num_look": 121965, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "Phorpiex僵尸网络中有超过1,000,000台被感染的Windows计算机。在本文中会对该僵尸网络的恶意模块的技术细节进行分析。"}
{"title": "【FreeBuf字幕组】Web安全漏洞系列：XSS（跨站脚本攻击）", "url": "https://www.freebuf.com/video/232923.html", "time": "2020-04-09", "level": "红色标题", "num_look": 73116, "num_comment": 1, "author": "willhuang", "tags": ["视频"], "text": "XSS（跨站脚本攻击）是Web应用程序中最常见的漏洞之一，指恶意攻击者往Web页面里插入恶意Script代码，当用户浏览该页之时，嵌入其中Web里面的Script代码会被执行，从而达到恶意攻击用户的目的。"}
{"title": "WannaRen无力查杀？其来路早已被切断", "url": "https://www.freebuf.com/articles/system/233016.html", "time": "2020-04-09", "level": "", "num_look": 182948, "num_comment": 2, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "近日，有网友在社交媒体公开求助，称感染了一款名为WannaRen的新型勒索软件，部分文件被加密，需要支付0.05个比特币（约合2500元）。"}
{"title": "渗透测试靶场初体验", "url": "https://www.freebuf.com/articles/es/229924.html", "time": "2020-04-09", "level": "", "num_look": 186885, "num_comment": 3, "author": "安全狗safedog", "tags": ["企业安全"], "text": "近日得到了红日安全团队制作的一套渗透测试靶场，由于笔者对内网和域渗透并不熟悉，正好借此来学习一下渗透测试的基本操作和流程。"}
{"title": "照弹不误：出站端口受限环境下反弹Shell的思考", "url": "https://www.freebuf.com/vuls/232544.html", "time": "2020-04-09", "level": "现金奖励", "num_look": 591020, "num_comment": 38, "author": "yangyangwithgnu", "tags": ["WEB安全", "漏洞"], "text": "这次遇到的目标，通过 nday 轻松拿到 webshell，打点的过程毫无波澜，甚至有一丝无聊。"}
{"title": "Bugo：新款Golang实现的勒索软件", "url": "https://www.freebuf.com/articles/system/231251.html", "time": "2020-04-09", "level": "", "num_look": 153946, "num_comment": 3, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "近日，奇安信病毒响应中心在日常样本监控过程中发现一款新型勒索病毒在地下论坛上被售卖，贩卖者宣称该加密软件性能高，速度快，可自定义联系方式和加密后缀。"}
{"title": "FreeBuf早报｜黑客揭iPhone相机0day漏洞，获7.5万美元奖励；“WannaRen”勒索病毒攻击源曝光 ；一个针对广泛设备的新型物联网僵尸网络：Dark nexus", "url": "https://www.freebuf.com/news/232996.html", "time": "2020-04-09", "level": "红色标题", "num_look": 71949, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "原来，“WannaRen”勒索病毒的作者正是此前借“永恒之蓝”漏洞祸乱网络的“匿影”组织。"}
{"title": "堪称奇葩的BTC诈骗案例分析", "url": "https://www.freebuf.com/articles/blockchain-articles/231094.html", "time": "2020-04-09", "level": "红色标题", "num_look": 145939, "num_comment": 7, "author": "cgf99", "tags": ["区块链安全"], "text": "3月21日，登陆pastebin网站偶然发现”Public Pastes“里面有一个名为”SSH Wallet“的文件，打开后发现文件内容居然明文写着IP地址、SSH登录账号和密码……"}
{"title": "暗网卖口罩，推特卖厕纸，疫情下的海外黑灰产", "url": "https://www.freebuf.com/articles/others-articles/232850.html", "time": "2020-04-08", "level": "红色标题", "num_look": 158912, "num_comment": 4, "author": "GEETEST极验", "tags": ["其他", "观点"], "text": "此次新冠疫情期间，黑产异常活跃。随着疫情逐渐蔓延，我们发现，境外黑产也开始忙碌起来......"}
{"title": "WannaRen勒索软件事件分析报告", "url": "https://www.freebuf.com/articles/system/232797.html", "time": "2020-04-08", "level": "", "num_look": 121404, "num_comment": 5, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "4月6号，有网友在知乎、贴吧、论坛等国内平台上求助，称自己中了一款名为WannaRen的新型勒索软件，索要0.05比特币。"}
{"title": "限时免费 | 今晚8点，逆向工具Ghidra介绍及应用系列公开课", "url": "https://www.freebuf.com/open/232897.html", "time": "2020-04-08", "level": "红色标题", "num_look": 107047, "num_comment": 1, "author": "FB独家", "tags": ["FreeBuf公开课"], "text": "4月8日（今天），FreeBuf最新上架免费公开课《逆向工具Ghidra介绍及应用》系列课程。"}
{"title": "针对某国际信息通信公司从前期探测到内网提权的一次成功漏洞测试", "url": "https://www.freebuf.com/vuls/230441.html", "time": "2020-04-08", "level": "", "num_look": 185415, "num_comment": 3, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文记录的是作者针对某国际大型信通公司进行的一次漏洞测试。"}
{"title": "意大利电子邮件服务商遭黑客入侵，60万用户数据及部分源代码泄露", "url": "https://www.freebuf.com/news/232822.html", "time": "2020-04-08", "level": "", "num_look": 63048, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "上周日，NN黑客组织宣布入侵了意大利电子邮件服务商Email.it，在推特上发布暗网出售Email.it数据的地址，以及数据文件的截图。"}
{"title": "「漏洞盒子快报」4月刊，月度最强白帽与最新活动发布", "url": "https://www.freebuf.com/fevents/232929.html", "time": "2020-04-08", "level": "", "num_look": 44591, "num_comment": 44591, "author": "漏洞盒子", "tags": ["活动"], "text": "等到春暖花开时，盒子带你去撒欢。第四届盒子白帽梦想趴强势来袭！目前第一名的大表哥已经领到了近3W5的旅游基金了。"}
{"title": "涉疫犯罪案件数达“非典”时期8倍，最高检加强打击网络犯罪举措", "url": "https://www.freebuf.com/news/232825.html", "time": "2020-04-08", "level": "", "num_look": 46286, "num_comment": 2, "author": "kirazhou", "tags": ["资讯"], "text": "在涉疫网络犯罪方面，截至4月7日，全国检察机关批捕的涉新疫情犯罪案件数、人数已分别达到“非典”时期的8倍和5倍左右。"}
{"title": "Molerats在多国政府和电信部门安装后门", "url": "https://www.freebuf.com/articles/network/230021.html", "time": "2020-04-08", "level": "", "num_look": 77080, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "从2019年10月到2019年12月初研究人员发现多起网络钓鱼攻击事件与Molerats组织（又称AKA Gaza和Gaza Cybergang）有关，其目标是政府、电信、保险和零售业等，涵盖6个不同国家的8个组织。"}
{"title": "WannaRen新型病毒勒索预警及样本", "url": "https://www.freebuf.com/news/232786.html", "time": "2020-04-08", "level": "", "num_look": 178506, "num_comment": 9, "author": "CyAnogeN", "tags": ["漏洞", "资讯"], "text": "最近比较热门的WannaRen勒索病毒，今天（应该是昨天）测试了一堆，死活都不加密我的文件。最终总算找到原因，原来下载的是解密程序。"}
{"title": "最高检召开党组会研究打击网络犯罪举措，成立惩治网络犯罪维护网络安全研究指导组", "url": "https://www.freebuf.com/news/232809.html", "time": "2020-04-08", "level": "", "num_look": 64176, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "把习近平总书记依法治网的要求落实落细落具体，最高检召开党组会研究打击网络犯罪举措，成立惩治网络犯罪维护网络安全研究指导组。"}
{"title": "Clicker木马新家族：Haken木马", "url": "https://www.freebuf.com/articles/terminal/230524.html", "time": "2020-04-08", "level": "", "num_look": 122793, "num_comment": 1, "author": "暗影安全实验室", "tags": ["终端安全"], "text": "Clicker木马是广泛的恶意程序，旨在提高网站访问率在线赚钱。它们通过单击链接和其他交互式元素来模拟网页上的用户操作，实现无声地模拟与广告网站的交互，自动订阅付费服务。"}
{"title": "漏洞管理面面观", "url": "https://www.freebuf.com/vuls/232791.html", "time": "2020-04-08", "level": "", "num_look": 194509, "num_comment": 1, "author": "Doraemon", "tags": ["安全管理", "漏洞"], "text": "随着企业对网络安全风险意识的增强、合规性要求的提高和网络安全事件的频发，漏洞管理越来越被更多的企业所重视，成为了信息安全项目的必备基石。"}
{"title": "大型企业如何部署落地（云）主机EDR+态势感知平台", "url": "https://www.freebuf.com/articles/es/230196.html", "time": "2020-04-08", "level": "", "num_look": 119029, "num_comment": 1, "author": "安全狗safedog", "tags": ["企业安全"], "text": "大型企业的项目实施往往涉及到大量部门和分、子公司的协调配合，这带来了双方面的困难。"}
{"title": "网络安全等级保护2.0等级测评结论判定方法", "url": "https://www.freebuf.com/articles/neopoints/230868.html", "time": "2020-04-08", "level": "金币+15", "num_look": 143047, "num_comment": 5, "author": "艾尔等保之道", "tags": ["标准与合规", "观点"], "text": "网络安全等级保护2.0正式实施后，等级测评结论的判定较等保1.0时代的判定方法有着重大的变化，本篇对等保2.0时代等级测评结论的判定方法进行概述。"}
{"title": "FreeBuf早报｜8000余未受保护的开源 Redis 实例可遭任意访问；Switch全系告破；域名注册商暂停600个可疑的冠状病毒网站", "url": "https://www.freebuf.com/news/232781.html", "time": "2020-04-08", "level": "红色标题", "num_look": 62679, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": "台湾政府机构已被告知，出于安全和隐私方面的考虑，不要使用Zoom，但可以使用谷歌和微软(Microsoft)等替代产品。Zoom公司承认存在安全漏洞，并就隐私问题进行了道歉。"}
{"title": "Dockerfile安全介绍", "url": "https://www.freebuf.com/articles/es/230852.html", "time": "2020-04-08", "level": "金币+15", "num_look": 111042, "num_comment": 111042, "author": "白河·愁", "tags": ["企业安全", "容器安全"], "text": "本文是docker安全的第二篇，讨论dockerfile和镜像安全。"}
{"title": "信安标委下达2020年第一批推荐性网络安全国家标准计划", "url": "https://www.freebuf.com/news/232727.html", "time": "2020-04-07", "level": "", "num_look": 61992, "num_comment": 2, "author": "shidongqi", "tags": ["标准与合规", "资讯"], "text": "2020年4月3日，国家标准化管理委员会下达 2020 年第一批推荐性国家标准计划，由信安标委归口的标准项目共计16项，均为推荐性标准。"}
{"title": "Coinminer恶意软件与Zoom捆绑传播", "url": "https://www.freebuf.com/articles/network/232569.html", "time": "2020-04-07", "level": "", "num_look": 82841, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "近期发现Coinminer与Zoom安装程序捆绑在一起，诱骗目标下载安装恶意软件。这些安装软件并不是来自Zoom官方下载中心，都是来自虚假恶意网站。"}
{"title": "QQ二维码登陆机制分析+双重SSRF钓鱼利用", "url": "https://www.freebuf.com/vuls/229694.html", "time": "2020-04-07", "level": "现金奖励", "num_look": 273178, "num_comment": 13, "author": "꧁", "tags": ["WEB安全", "漏洞"], "text": "随着移动应用的普及，二维码在我们的日常生活中显得越来越重要。其中二维码有一个功能用于移动端和PC端的交互认证。"}
{"title": "Fuzzowski：一款功能强大的网络协议模糊测试工具", "url": "https://www.freebuf.com/sectool/227869.html", "time": "2020-04-07", "level": "", "num_look": 144327, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Fuzzowski的设计核心理念，就是想让任何一个网络安全从业人员都会第一选择去使用它，该工具可以帮助研究人员对网络协议进行模糊测试，并且能够在整个测试过程中给我们提供帮助。"}
{"title": "深信服VPN设备漏洞被黑客组织利用，针对我国驻外机构及部分政府单位（附完整修复方案）", "url": "https://www.freebuf.com/news/232618.html", "time": "2020-04-07", "level": "", "num_look": 248943, "num_comment": 4, "author": "百里不守约", "tags": ["资讯"], "text": "日前，深信服 SSL VPN 设备被曝存在漏洞，APT组织Darkhotel（APT-C-06）利用该组织对我国多驻外机构发起攻击，甚至近期已经开始针对北京、上海等地政府相关机构。"}
{"title": "挖洞经验 | 密码重置Token可预测性导致的账号劫持漏洞", "url": "https://www.freebuf.com/vuls/227857.html", "time": "2020-04-07", "level": "", "num_look": 119911, "num_comment": 4, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "今天分享的Writeup是一个有趣的账号劫持漏洞，漏洞原因在于目标服务端重置用户密码时，其Token生成算法有问题，存在可预测和可枚举可能，导致网站注册用户面临账号被劫持风险。"}
{"title": "玩转Vulnhub靶场 ——第一期-Me and My Girlfriend", "url": "https://www.freebuf.com/articles/others-articles/227157.html", "time": "2020-04-07", "level": "", "num_look": 68573, "num_comment": 3, "author": "Jdicsp", "tags": ["其他"], "text": "Vulnhub是一个提供各种漏洞环境的靶场，每个镜像会有破解的目标，挑战的目标是通过网络闯入系统获取root权限和查看flag。"}
{"title": "完美世界何艺：零信任架构的开发和落地", "url": "https://www.freebuf.com/articles/people/232177.html", "time": "2020-04-07", "level": "红色标题", "num_look": 190802, "num_comment": 8, "author": "Sandra1432", "tags": ["人物志"], "text": "随着攻击手段的复杂化、多样化，边界防护日渐衰微。此次邀请完美集团高级安全总监何艺来分享在传统安全架构逐渐失效的背景下，利用零信任架构建设企业安全的实践经验。"}
{"title": "ATT&CK矩阵Linux系统安全实践", "url": "https://www.freebuf.com/articles/es/231784.html", "time": "2020-04-07", "level": "现金奖励", "num_look": 234438, "num_comment": 8, "author": "罹♛殇", "tags": ["企业安全"], "text": "MITRE在2013年推出了ATT&CK模型，根据真实的观察数据来描述和分类对抗行为。"}
{"title": "打造你的云渗透主机：阿里云部署Kali Docker", "url": "https://www.freebuf.com/sectool/231107.html", "time": "2020-04-07", "level": "现金奖励", "num_look": 163187, "num_comment": 18, "author": "阿哥有鸟无巢", "tags": ["容器安全", "工具"], "text": "docker最好在CentOS7以上的系统安装，因为它对Linux内核版本有要求，具体可以百度。"}
{"title": "FreeBuf早报｜Zoom数万视频被公开围观，CEO考虑开源；Google 公布 130 多个国家的手机位置数据；新型 PC 勒索病毒“WannaRen”传播：大部分杀毒软件无法拦截", "url": "https://www.freebuf.com/news/232573.html", "time": "2020-04-07", "level": "红色标题", "num_look": 105730, "num_comment": 5, "author": "kirazhou", "tags": ["资讯"], "text": "创始人袁征坦言，如果安全问题不解决，甚至会考虑开源Zoom代码。"}
{"title": "零信任安全保障未来的医疗健康行业", "url": "https://www.freebuf.com/articles/network/231163.html", "time": "2020-04-07", "level": "", "num_look": 74790, "num_comment": 1, "author": "Sandra1432", "tags": ["网络安全"], "text": "在2019年，我们可以看到信息安全漏洞数量突破记录。根据《IBM X-Force威胁情报指数2020》，总共有85亿条信息记录遭到泄露，是2018年的三倍。"}
{"title": "PolyShell：一款适用于Bash、Batch、PowerShell的polyglot", "url": "https://www.freebuf.com/sectool/228758.html", "time": "2020-04-06", "level": "", "num_look": 109106, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具", "系统安全"], "text": "PolyShell是一款功能强大的polyglot脚本，它可以同时适用于Bash、Windows Bash和PowerShell。"}
{"title": "Turla利用水坑攻击植入后门", "url": "https://www.freebuf.com/articles/network/230436.html", "time": "2020-04-06", "level": "", "num_look": 95816, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "研究人员发现了针对Armenian知名网站的水坑攻击。 它依靠假的Adobe Flash更新，欺骗目标下载两个以前未记录的恶意软件NetFlash和PyFlash。"}
{"title": "文件解压引发的Getshell", "url": "https://www.freebuf.com/articles/others-articles/229928.html", "time": "2020-04-06", "level": "", "num_look": 62272, "num_comment": 2, "author": "安全狗safedog", "tags": ["其他"], "text": "随着对抗不断升级，开发人员的安全意识的不断提高，多多少少也学会了使用黑名单或者白名单等一些手段进行防御，但刁钻的攻击者，依然发现了疏忽之处。本文以两个实例，简单介绍文件解压功能导致的getshell问题。"}
{"title": "工业网络，最新的地缘政治角逐战场", "url": "https://www.freebuf.com/articles/neopoints/230767.html", "time": "2020-04-06", "level": "", "num_look": 117070, "num_comment": 1, "author": "kirazhou", "tags": ["观点"], "text": "民族国家的对手正在瞄准能源和其他关键基础设施领域。"}
{"title": "记一次编写安全资产管理平台", "url": "https://www.freebuf.com/sectool/231097.html", "time": "2020-04-06", "level": "现金奖励", "num_look": 155974, "num_comment": 6, "author": "jerrybird", "tags": ["工具"], "text": "这是一款因为日常需要而编写的一款服务器的安全资产管理平台，可以帮助监测云环境上对外开放了哪些端口、开放数量在前十的端口以及对应的服务、检查服务器上的基线情况以及是否具有存在公开EXP的主机漏洞。"}
{"title": "黑客帝国？论美国Hacker的养成之路", "url": "https://www.freebuf.com/articles/neopoints/230985.html", "time": "2020-04-06", "level": "", "num_look": 130794, "num_comment": 4, "author": "kirazhou", "tags": ["观点"], "text": "黑客本身的力量没有善恶之分，好坏被定义在这种力量如何使用的那一刻。"}
{"title": "PrivescCheck：一款针对Windows系统的提权枚举脚本", "url": "https://www.freebuf.com/articles/system/229405.html", "time": "2020-04-05", "level": "", "num_look": 92580, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "PrivescCheck是一款针对Windows系统的提权枚举脚本，该脚本能够枚举出目标Windows系统中常见的Windows错误安全配置。"}
{"title": "网络犯罪天堂Deer.io之死", "url": "https://www.freebuf.com/news/232163.html", "time": "2020-04-05", "level": "红色标题", "num_look": 59770, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "FBI这一役，宣判了曾经的网络犯罪天堂Deer.io之死。"}
{"title": "利用COVID-19发起的网络攻击分析", "url": "https://www.freebuf.com/articles/network/230475.html", "time": "2020-04-05", "level": "", "num_look": 73684, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "Check Point发现了针对蒙古公共部门的网络攻击活动，该组织利用了冠状病毒恐慌情绪向目标发送恶意软件。"}
{"title": "企业漏洞管理的4大误区", "url": "https://www.freebuf.com/articles/neopoints/232027.html", "time": "2020-04-05", "level": "", "num_look": 109869, "num_comment": 2, "author": "kirazhou", "tags": ["观点"], "text": "漏洞管理的重要性通常被低估或忽视。我们来看看有哪些常见的漏洞管理认知误区并且来揭穿它们。"}
{"title": "BUF大事件丨万豪再次报告数据泄露，涉及520万客人隐私；Zoom频繁爆出安全问题，数据与隐私堪忧", "url": "https://www.freebuf.com/news/232509.html", "time": "2020-04-05", "level": "红色标题", "num_look": 63372, "num_comment": 63372, "author": "willhuang", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，万豪再次报告数据泄露，涉及520万客人隐私；App Store出现色情应用；公安部刑侦局提醒预防“二次实名认证”诈骗；Zoom客户端爆出安全漏洞。"}
{"title": "Wazuh：如何对异构数据进行关联告警", "url": "https://www.freebuf.com/sectool/230505.html", "time": "2020-04-05", "level": "现金奖励", "num_look": 101014, "num_comment": 9, "author": "Shell.", "tags": ["工具"], "text": "这并不是什么高精尖的架构与技术。这只是我个人在工作中结合目前手头的资源进行了一些整合 。"}
{"title": "美国2020~2022年反情报战略", "url": "https://www.freebuf.com/articles/network/230126.html", "time": "2020-04-04", "level": "", "num_look": 80629, "num_comment": 80629, "author": "Kriston", "tags": ["网络安全"], "text": "2020年2月10日美国国家反间谍与安全中心发布了新战略，阐述了美国所面对的日益严峻的情报威胁以及美国需如何应对这些威胁。"}
{"title": "挖洞经验分享：关于IDOR的几个奇怪案例分析", "url": "https://www.freebuf.com/vuls/228918.html", "time": "2020-04-04", "level": "", "num_look": 92627, "num_comment": 92627, "author": "Alpha_h4ck", "tags": ["漏洞", "网络安全"], "text": "果阿这个地方一直是冒险者的天堂，就在前不久，我们几个朋友计划去果阿旅行，于是乎我们便在Skyscanner上搜索廉价机票，然后找到了一个名为“whereIDORsLive.com”的网站。"}
{"title": "Android Cerberus恶意样本分析", "url": "https://www.freebuf.com/articles/terminal/230628.html", "time": "2020-04-04", "level": "红色标题", "num_look": 118138, "num_comment": 118138, "author": "北京链安安全实验室", "tags": ["终端安全"], "text": "前段时间网上流传 Android 平台 Cerberus 木马家族出现了新的变种，在网上找了一番没有找到新变种的木马样本反而找到了 2019 年 6 月披露的一批样本。"}
{"title": "玩家与黑客：对游戏公司和游戏玩家的网络威胁", "url": "https://www.freebuf.com/articles/network/230920.html", "time": "2020-04-04", "level": "", "num_look": 70989, "num_comment": 70989, "author": "Sandra1432", "tags": ["网络安全"], "text": "在过去的几十年中，视频游戏领域发生了翻天覆地的变化。这些变化也导致网络威胁领域的巨变，而游戏公司、游戏本身以及玩家们都开始直面这些威胁了。"}
{"title": "JMX远程代码漏洞研究", "url": "https://www.freebuf.com/vuls/231132.html", "time": "2020-04-04", "level": "现金奖励", "num_look": 99045, "num_comment": 99045, "author": "MrCoding", "tags": ["漏洞"], "text": "前一段时间apace solr JMX因为配置不当出现远程代码执行漏洞，最近自己在看一套java系统时，发现该系统也存在JMX远程代码漏洞，于是乎就想研究下JMX这种通用型漏洞。"}
{"title": "Zoom的“漏洞”围城，从新增用户1.9亿到股价下跌16%", "url": "https://www.freebuf.com/articles/neopoints/232446.html", "time": "2020-04-03", "level": "红色标题", "num_look": 149310, "num_comment": 4, "author": "kirazhou", "tags": ["观点"], "text": "漏洞安全问题，终究是给Zoom上了一课。"}
{"title": "Syborg：一款带有断路躲避系统的DNS子域名递归枚举工具", "url": "https://www.freebuf.com/sectool/227851.html", "time": "2020-04-03", "level": "", "num_look": 96332, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Syborg是一款DNS子域名递归枚举工具，它的扫描模式既非主动，也非完全被动的。该工具可以直接构造一个域名，然后通过指定的DNS服务器查询该域名。"}
{"title": "CVE-2020-8794：OpenSMTPD默认安装中的LPE和RCE漏洞分析", "url": "https://www.freebuf.com/vuls/228704.html", "time": "2020-04-03", "level": "", "num_look": 104238, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["漏洞", "系统安全"], "text": "我们通过分析之后，在OpenBSD的邮件服务器OpenSMTPD中发现了一个安全漏洞，这个漏洞是一个越界读取漏洞，在该漏洞的帮助下，攻击者将能够在目标设备上以非Root用户身份实现远程Shell命令执行。"}
{"title": "技术讨论 | 如何编写一段内存蠕虫？", "url": "https://www.freebuf.com/articles/web/229597.html", "time": "2020-04-03", "level": "", "num_look": 127676, "num_comment": 3, "author": "好好学习er", "tags": ["WEB安全"], "text": "我们怎么写一段代码，能够在程序内存里面不停移动？就是让shellcode代码能在内存中不停的复制自己，并且一直执行下去，也就是内存蠕虫。"}
{"title": "WAF机制及绕过方法总结：注入篇", "url": "https://www.freebuf.com/articles/web/229982.html", "time": "2020-04-03", "level": "", "num_look": 178644, "num_comment": 3, "author": "DigApis", "tags": ["WEB安全"], "text": "本篇文章主要介绍WAF的一些基本原理，总结常见的SQL注入Bypass WAF技巧。"}
{"title": "FreeBuf早报｜华盛顿州通过面部识别保障法；MongoDB 推出字段级数据库加密；Zoom宣布90天冻结功能更新", "url": "https://www.freebuf.com/news/232399.html", "time": "2020-04-03", "level": "红色标题", "num_look": 48225, "num_comment": 4, "author": "shidongqi", "tags": ["资讯"], "text": "针对最近暴露出来的一系列隐私和安全问题，Zoom宣布未来90天冻结功能更新，并承诺在此期间解决这些问题。"}
{"title": "一种工控蜜罐识别与反识别技术研究与应用实践", "url": "https://www.freebuf.com/articles/ics-articles/230402.html", "time": "2020-04-03", "level": "现金奖励", "num_look": 194438, "num_comment": 3, "author": "yy0308", "tags": ["工控安全"], "text": "本文章结合作者在资产探测、入侵检测、网络攻防、蜜罐研究相关工作中大量实践,在此对工控蜜罐识别与反识别的技术进行研究与应用实践与大家进行分享与探讨。"}
{"title": "2019年网络安全态势报告", "url": "https://www.freebuf.com/articles/paper/232371.html", "time": "2020-04-02", "level": "红色标题", "num_look": 201162, "num_comment": 3, "author": "深信服千里目安全实验室", "tags": ["安全报告"], "text": "2019年，频繁的信息泄露、网络攻击事件，以及等保2.0国家标准等网络安全政策法规的发布，都使得网络安全在全国范围内获得相比往年更高的关注度。那么，在这一年里，中国的网络安全现状究竟如何？"}
{"title": "2020斗象生态合作伙伴线上大会 | 协同未来，智绘安全", "url": "https://www.freebuf.com/fevents/232363.html", "time": "2020-04-02", "level": "", "num_look": 56392, "num_comment": 2, "author": "斗象科技官方", "tags": ["活动"], "text": "4月9日，2020斗象生态合作伙伴线上大会即将召开。"}
{"title": "Zeek如何提供对加密通信的感知", "url": "https://www.freebuf.com/articles/network/229767.html", "time": "2020-04-02", "level": "", "num_look": 75580, "num_comment": 1, "author": "Avenger", "tags": ["网络安全"], "text": "加密通信现已无处不在，但从某种程度上说，加密不仅保证了信息的机密性，也没有阻碍对流量进行分析。"}
{"title": "直播预告 | 今晚7点，攻防对抗之流量安全溯源分析实践", "url": "https://www.freebuf.com/open/232315.html", "time": "2020-04-02", "level": "红色标题", "num_look": 95948, "num_comment": 95948, "author": "FB独家", "tags": ["FreeBuf公开课"], "text": "今晚19：00，斗象科技高级安全专家张志鹏将带来《攻防对抗之流量安全溯源分析实践》的分享，站在防御者视角，分享斗象科技在网络流量安全分析溯源领域的典型实践与思考。"}
{"title": "白帽公开课 | XSS漏洞由浅入深", "url": "https://www.freebuf.com/open/232283.html", "time": "2020-04-02", "level": "", "num_look": 90885, "num_comment": 90885, "author": "Nixgnos", "tags": ["FreeBuf公开课"], "text": "XSS漏洞所造成的危害性可低可高，甚至可以获取系统权限。那么我们该如何挖掘？如何利用？如何防御？我们的课程将会从原理到实战，再到防御来一一为大家揭晓。"}
{"title": "警惕：Vollgar僵尸网络每天成功感染近3000台MSSQL服务器", "url": "https://www.freebuf.com/news/232295.html", "time": "2020-04-02", "level": "红色标题", "num_look": 68056, "num_comment": 5, "author": "kirazhou", "tags": ["资讯"], "text": "网络安全研究人员发现了一个名为Vollgar的加密挖矿僵尸网络，该僵尸网络至少自2018年以来一直在劫持MSSQL服务器。"}
{"title": "CVE-2020-2555：Oracle WebLogic RCE漏洞分析", "url": "https://www.freebuf.com/vuls/229972.html", "time": "2020-04-02", "level": "", "num_look": 124838, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["漏洞", "网络安全"], "text": "在对Java Web应用程序进行研究时，不安全的反序列化漏洞现在已经成为了攻击者或研究人员的常见目标了。"}
{"title": "西门子S7系列PLC安全防护研究", "url": "https://www.freebuf.com/articles/ics-articles/230676.html", "time": "2020-04-02", "level": "现金奖励", "num_look": 187547, "num_comment": 10, "author": "黄一113530", "tags": ["工控安全"], "text": "近年来，随着中国制造的不断崛起，工业控制系统已成为国家关键基础设施的重中之重，工控系统的安全问题也随之而来。"}
{"title": "中国网安招聘安全人才", "url": "https://www.freebuf.com/jobs/231728.html", "time": "2020-04-02", "level": "", "num_look": 62234, "num_comment": 6, "author": "瞧一瞧看一看", "tags": ["安全招聘"], "text": "中国电子科技网络信息安全有限公司（简称中国网安）是中国电科集团公司（十大军工集团之一）根据国家安全战略发展需要，汇聚中国电科内部资源重点打造的网络信息安全子集团。"}
{"title": "Zoom客户端漏洞允许黑客窃取用户Windows密码", "url": "https://www.freebuf.com/news/232288.html", "time": "2020-04-02", "level": "", "num_look": 124960, "num_comment": 4, "author": "Sandra1432", "tags": ["资讯"], "text": "Zoom开发至今，已经九年了。在冠状病毒流行期间，人们迫切需要一个易于使用的视频会议应用程序，因此，Zoom在一夜之间成为数百万人所青睐的工具。"}
{"title": "“新冠肺炎”勒索病毒出现，Anubis起死回生", "url": "https://www.freebuf.com/articles/terminal/230737.html", "time": "2020-04-02", "level": "", "num_look": 127345, "num_comment": 3, "author": "奇安信威胁情报中心", "tags": ["终端安全"], "text": "继Cerberus银行木马利用“新冠肺炎“传播以后，“新冠肺炎”勒索病毒也已经出现。"}
{"title": "FreeBuf早报｜SMBGhost漏洞允许Windows系统上的提权；Holy Water黑客组织瞄准亚洲的宗教人物和慈善机构；伊朗非官方版本Telegram应用用户的4200万记录在线泄漏", "url": "https://www.freebuf.com/news/232263.html", "time": "2020-04-02", "level": "红色标题", "num_look": 62697, "num_comment": 4, "author": "kirazhou", "tags": ["资讯"], "text": "专家发布了Windows上CVE-2020-0796权限提升漏洞的PoC漏洞，该漏洞被命名为SMBGhost，可用于本地提权。"}
{"title": "自己动手DIY：编译路由器固件", "url": "https://www.freebuf.com/geek/230220.html", "time": "2020-04-02", "level": "现金奖励", "num_look": 160527, "num_comment": 6, "author": "LEdge1", "tags": ["极客"], "text": "上一期的文章发出之后，得到了很多小伙伴的关注，这次还是围绕之前见到的那个路由器做文章。"}
{"title": "阿里安全发布“青色计划”   招募未来安全人才", "url": "https://www.freebuf.com/jobs/232235.html", "time": "2020-04-01", "level": "", "num_look": 52586, "num_comment": 52586, "author": "阿里安全", "tags": ["安全招聘"], "text": "作为阿里巴巴集团最为神秘的部门，阿里安全近日正式启动2020年校园招聘计划，并面向高校在校生发布“青色计划”招募令。"}
{"title": "精选公开课 | 3月FreeBuf公开课集锦强势来袭", "url": "https://www.freebuf.com/fevents/232200.html", "time": "2020-04-01", "level": "红色标题", "num_look": 83435, "num_comment": 2, "author": "FB独家", "tags": ["活动"], "text": "3月FreeBuf公开课集锦来啦~"}
{"title": "HoneyBot：一款功能强大的网络流量捕捉与分析框架", "url": "https://www.freebuf.com/sectool/229968.html", "time": "2020-04-01", "level": "", "num_look": 115779, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["工具", "网络安全"], "text": "HoneyBot是一款功能强大的网络流量捕捉、上传和分析框架，本质上HoneyBot可以实现基于云的PCAP分析，由PacketTotal.com驱动。"}
{"title": "今晚7点线上直播｜攻方视角下的攻击路线及实际案例", "url": "https://www.freebuf.com/open/232187.html", "time": "2020-04-01", "level": "红色标题", "num_look": 95027, "num_comment": 1, "author": "FB独家", "tags": ["FreeBuf公开课"], "text": "今晚19：00，斗象科技高级攻防专家李慎亮将带来《攻防对抗中的应急日志分析》的分享，通过FreeBuf直播公开课为大家答疑解惑。"}
{"title": "万豪再次报告数据泄露，事件影响多达520万客人", "url": "https://www.freebuf.com/news/232159.html", "time": "2020-04-01", "level": "", "num_look": 91577, "num_comment": 7, "author": "Sandra1432", "tags": ["资讯"], "text": "今天，万豪国际披露在2020年2月底检测到的数据泄露事件，声明这次事件影响了大约520万酒店客人。"}
{"title": "白帽专访｜漏洞盒子S级白帽，20岁前实现买房买车", "url": "https://www.freebuf.com/articles/people/232063.html", "time": "2020-04-01", "level": "", "num_look": 151134, "num_comment": 151134, "author": "漏洞盒子", "tags": ["人物志"], "text": "00后白帽如何走上网络安全之路，如何一步步成为漏洞盒子S级白帽，如何通过自己的努力达成买房成就，淡黄的长裙，蓬松的头发，有哪些不为人知的故事呢？"}
{"title": "NetSupport Manager RAT钓鱼攻击分析", "url": "https://www.freebuf.com/articles/network/228898.html", "time": "2020-04-01", "level": "", "num_look": 72029, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "2020年1月安全人员发现了一个伪造为受密码保护的恶意Microsoft Word文档，该文档在网络钓鱼活动中用于传播商业化远程访问工具（NetSupport Manager）。"}
{"title": "中国东方航空诚聘安全人才", "url": "https://www.freebuf.com/jobs/232070.html", "time": "2020-04-01", "level": "", "num_look": 57972, "num_comment": 19, "author": "SixSixSix", "tags": ["安全招聘"], "text": "中国东方航空股份有限公司（ChinaEastern Airlines），是一家总部位于中国上海的国有控股航空公司，在原中国东方航空集团公司的基础上，兼并中国西北航空公司，联合中国云南航空公司重组而成。"}
{"title": "微软SMBv3 ClientServer远程代码执行漏洞CVE-2020-0796", "url": "https://www.freebuf.com/vuls/232129.html", "time": "2020-04-01", "level": "", "num_look": 142189, "num_comment": 5, "author": "深信服千里目安全实验室", "tags": ["漏洞", "系统安全"], "text": "服务器消息块（SMB），是一个网络通信协议，用于提供共享访问到文件，打印机和串行端口的节点之间的网络上。"}
{"title": "浅论云访问安全代理CASB的重要性", "url": "https://www.freebuf.com/articles/network/230403.html", "time": "2020-04-01", "level": "", "num_look": 66884, "num_comment": 2, "author": "Sandra1432", "tags": ["网络安全"], "text": "随着企业IT运营逐渐从本地上云，他们就开始寻找从内部数据中心引入云运营的安全访问控制方法。"}
{"title": "ASRC 2019年邮件安全趋势回顾", "url": "https://www.freebuf.com/articles/paper/229541.html", "time": "2020-04-01", "level": "", "num_look": 138199, "num_comment": 2, "author": "softnext守内安", "tags": ["安全报告"], "text": "2019 年总体来说，垃圾邮件与病毒邮件的数量呈现均匀分布，没有哪个月份特别爆量，但是相较于 2018 年，数量稍有增长。"}
{"title": "FreeBuf早报｜万豪报告数据泄露影响多达520万客人；黑客论坛曝光了超过490万乔治亚州居民的详细个人信息；工信部预计年底全国5G基站超60万个", "url": "https://www.freebuf.com/news/232121.html", "time": "2020-04-01", "level": "红色标题", "num_look": 68438, "num_comment": 6, "author": "shidongqi", "tags": ["资讯"], "text": "万豪国际披露，在2020年2月底发现的数据泄露事件中，约520万酒店客人的个人信息受到影响。"}
{"title": "CVE-2010-3333漏洞复现", "url": "https://www.freebuf.com/vuls/230461.html", "time": "2020-04-01", "level": "现金奖励", "num_look": 147583, "num_comment": 4, "author": "dolphin", "tags": ["漏洞"], "text": "最近看CVE-2010-3333漏洞，便亲自动手做一个弹出计算器的POC。"}
{"title": "对一次钓鱼事件的分析", "url": "https://www.freebuf.com/articles/network/230406.html", "time": "2020-03-31", "level": "红色标题", "num_look": 129296, "num_comment": 17, "author": "一个神秘的人", "tags": ["网络安全"], "text": "本文是对一次钓鱼事件的分析，在下水平实在不高，请路过的高手勿喷。像网络钓鱼这种违法事件时不时地出现在我们身边，下面是本人的亲身经历。"}
{"title": "Projectsandcastle：一款针对iPhone的AndroidLinux支持工具", "url": "https://www.freebuf.com/sectool/229967.html", "time": "2020-03-31", "level": "", "num_look": 103115, "num_comment": 103115, "author": "Alpha_h4ck", "tags": ["工具", "系统安全"], "text": "Projectsandcastle是一款针对iPhone的Android/Linux支持工具，该工具可以给广大研究人员提供以下实用工具。"}
{"title": "从零开始学习fastjson反序列化", "url": "https://www.freebuf.com/vuls/228099.html", "time": "2020-03-31", "level": "", "num_look": 118034, "num_comment": 2, "author": "打大狼", "tags": ["漏洞"], "text": "JDK提供了API可以将Java对象转换为字节序列保存在磁盘或网络传输，接收方可以把字节序列再恢复为Java对象。"}
{"title": "关于俄罗斯联邦安全局FSB承包商0day公司的秘辛", "url": "https://www.freebuf.com/articles/network/231392.html", "time": "2020-03-31", "level": "", "num_look": 80637, "num_comment": 3, "author": "奇安信威胁情报中心", "tags": ["网络安全"], "text": "俄罗斯联邦安全局，简称FSB，作为克格勃的继任者，主要负责联邦安全，包括反情报，内部以及边境安全，反恐和监视，以及调查其他一些严重罪行和违反联邦法律的行为。"}
{"title": "Zeus Sphinx恶意软件重现，利用COVID-19救济款进行网络钓鱼", "url": "https://www.freebuf.com/news/232009.html", "time": "2020-03-31", "level": "", "num_look": 64659, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "近期发现Zeus Sphinx银行木马程序在沉寂了三年后重新回归人们视线——以冠状病毒为主题开展网络钓鱼活动。COVID-19是目前网络攻击最为常见、最为流行的主题。"}
{"title": "Goby——新一代安全工具", "url": "https://www.freebuf.com/sectool/232007.html", "time": "2020-03-31", "level": "", "num_look": 209691, "num_comment": 22, "author": "cliekkas", "tags": ["工具"], "text": "Goby是一款新的网络安全测试工具，由赵武Zwell（Pangolin、JSky、FOFA作者）打造，它能够针对一个目标企业梳理最全的攻击面信息，同时能进行高效、实战化漏洞扫描。"}
{"title": "挖洞经验 | 劫持Google Data Studio的共享报告链接", "url": "https://www.freebuf.com/vuls/229332.html", "time": "2020-03-31", "level": "", "num_look": 108188, "num_comment": 6, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "这篇Writeup介绍了谷歌数据报表平台Google Data Studio中的一个授权漏洞，作者利用该漏洞可以修改其他人分享的报告链接，实现对他人报告的劫持。"}
{"title": "招聘｜陌陌安全暑期实习指南", "url": "https://www.freebuf.com/jobs/231879.html", "time": "2020-03-31", "level": "", "num_look": 26568, "num_comment": 3, "author": "陌陌安全", "tags": ["安全招聘"], "text": "陌陌安全致力于以务实的工作保障陌陌旗下所有产品及亿万用户的信息安全，以开放的心态拥抱信息安全机构、团队与个人之间的共赢协作，以自由的氛围和丰富的资源支撑优秀同学的个人发展与职业成长。"}
{"title": "基于风险的应用程序安全方法可增强安全防御", "url": "https://www.freebuf.com/articles/network/230230.html", "time": "2020-03-31", "level": "", "num_look": 66324, "num_comment": 2, "author": "Sandra1432", "tags": ["网络安全"], "text": "如今，不可否认的是网络犯罪已逐渐进入人们的生活，为人们所重视。无论何时，随意浏览新闻都能看到新漏洞的发现，或者是敏感信息的泄露、窃取等。"}
{"title": "FreeBuf早报 | 沙特在美国从事监听活动，追踪其公民手机位置；美国中小企业遭遇以行政捐助为诱饵的网络钓鱼；部分企业采购间谍软件监视远程工作的雇员", "url": "https://www.freebuf.com/news/231957.html", "time": "2020-03-31", "level": "红色标题", "num_look": 68173, "num_comment": 4, "author": "Sandra1432", "tags": ["资讯"], "text": "1月下旬，俄语黑客利用恶意软件攻击了至少两家欧洲制药公司。根据攻击工具，可以看出黑客可能是像Silence和TA505这样的以金钱为目标的组织团体。"}
{"title": "Docker守护进程安全配置介绍", "url": "https://www.freebuf.com/articles/system/230587.html", "time": "2020-03-31", "level": "现金奖励", "num_look": 156997, "num_comment": 4, "author": "白河·愁", "tags": ["企业安全", "容器安全"], "text": "本文将为大家介绍docker守护进程的相关安全配置项目。"}
{"title": "今晚7点线上直播｜攻方视角下的攻击路线及实际案例", "url": "https://www.freebuf.com/open/231925.html", "time": "2020-03-30", "level": "红色标题", "num_look": 104653, "num_comment": 2, "author": "FB独家", "tags": ["FreeBuf公开课"], "text": "3月31日（明天）晚上19：00，来自斗象科技高级安全服务工程师余礼龙将为大家带来主题为《攻方视角下的攻击路线及实际案例》的分享。"}
{"title": "Shiro权限绕过漏洞分析（CVE-2020-1957）", "url": "https://www.freebuf.com/vuls/231909.html", "time": "2020-03-30", "level": "红色标题", "num_look": 172076, "num_comment": 7, "author": "斗象智能安全平台", "tags": ["WEB安全", "漏洞"], "text": "2020年3月23号，Shiro开发者Brian Demers在用户社区发表帖子，提醒shiro用户进行安全更新，本次更新进行了三个修复，其中就包括了对编号为CVE-2020-1957的Shrio授权绕过漏洞的修复。"}
{"title": "Multi-Juicer：针对OWASP Juice Shop的多用户CTF及安全培训平台", "url": "https://www.freebuf.com/articles/network/228706.html", "time": "2020-03-30", "level": "", "num_look": 74748, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "Multi-Juicer是一款帮助用户结合OWASP Juice Shop来运行CTF以及安全培训的多用户平台工具集。"}
{"title": "让你的SQL盲注快起来", "url": "https://www.freebuf.com/articles/web/231741.html", "time": "2020-03-30", "level": "现金奖励", "num_look": 519606, "num_comment": 34, "author": "dongne", "tags": ["WEB安全"], "text": "SQL 注入是当前 Web 安全中最常见的安全问题之一，其危害性也比较大，众多白帽子在渗透测试过程中往往会首先着重进行 SQL 注入的测试。"}
{"title": "收到包含泰迪熊和USB的礼物包裹？来自FIN7 APT组织的“阴谋”", "url": "https://www.freebuf.com/news/231861.html", "time": "2020-03-30", "level": "", "num_look": 60895, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "以网络钓鱼邮件攻击企业闻名的FIN7 APT组织，正在针对企业网络发动新一轮的攻击。"}
{"title": "看我如何通过XSS窃取localStorage中的JWT", "url": "https://www.freebuf.com/vuls/228787.html", "time": "2020-03-30", "level": "", "num_look": 127647, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["WEB安全", "漏洞"], "text": "在过去的几个月时间里，我遇到过一些JSON Web令牌（JWT）的不安全实现，而这些不安全实现最终导致了目标Web应用程序遭到黑客入侵。"}
{"title": "阿里云安全能力建设团队社招&校招", "url": "https://www.freebuf.com/jobs/230850.html", "time": "2020-03-30", "level": "", "num_look": 89596, "num_comment": 89596, "author": "郑瀚AndrewHann", "tags": ["安全招聘"], "text": "自2009年阿里云成立的第一天起，安全就是头等大事。经过10年的积累，阿里云安全在为国家重大活动以及天猫、淘宝、支付宝的护航过程中沉淀了强大的工程化能力和大项目护航能力。"}
{"title": "黑客利用DrayTek设备中的0day漏洞对企业网络发动攻击", "url": "https://www.freebuf.com/news/231857.html", "time": "2020-03-30", "level": "", "num_look": 132113, "num_comment": 5, "author": "Sandra1432", "tags": ["漏洞", "资讯"], "text": "上周，研究人员披露了两场对台湾DrayTek生产的企业级网络设备0day漏洞在野利用攻击活动的详细信息。"}
{"title": "一次利用疫情传播的Nanocore分析", "url": "https://www.freebuf.com/articles/web/229969.html", "time": "2020-03-30", "level": "现金奖励", "num_look": 103943, "num_comment": 2, "author": "fuckgod", "tags": ["WEB安全"], "text": "近期，随着疫情在国外爆发，一些国外的黑产团伙也开始蠢蠢欲动，某不存在的社交网站上安全研究员披露了多起利用疫情为诱饵进行的攻击活动。"}
{"title": "Antsword流量分析与还原", "url": "https://www.freebuf.com/sectool/229627.html", "time": "2020-03-30", "level": "现金奖励", "num_look": 116433, "num_comment": 2, "author": "Kriston", "tags": ["工具"], "text": "近期研究了一下各种的shell脚本，发现aspx脚本与php、jsp在执行上有很大的不同。"}
{"title": "FreeBuf早报 | Google发出了4万次国家支持黑客攻击警告；Dharma勒索软件的源代码在黑客论坛开售；华为等提议采用一种新的核心网络技术新标准，名为“New IP”", "url": "https://www.freebuf.com/news/231829.html", "time": "2020-03-30", "level": "红色标题", "num_look": 88174, "num_comment": 4, "author": "Sandra1432", "tags": ["资讯"], "text": "自2019年12月初以来，一个神秘的黑客组织一直在接管DrayTek企业路由器，以窃听公司网络内部的FTP和电子邮件流量。"}
{"title": "信息安全意识培训可以这样做", "url": "https://www.freebuf.com/articles/es/231310.html", "time": "2020-03-30", "level": "", "num_look": 189239, "num_comment": 8, "author": "softgirl", "tags": ["企业安全"], "text": "安全意识的淡薄，总能让我们看到听到一幕幕血的教训。"}
{"title": "网络安全圈为什么男多女少？男女薪资差距达17%", "url": "https://www.freebuf.com/articles/neopoints/230294.html", "time": "2020-03-30", "level": "", "num_look": 124826, "num_comment": 4, "author": "kirazhou", "tags": ["观点"], "text": "根据Tessian的说法，如果在美国从事网络安全工作的女性人数与男性持平，那么美国网络安全行业的经济成本将增加304亿美元。"}
{"title": "GDBFrontend：一款灵活可扩展的GUI调试工具", "url": "https://www.freebuf.com/articles/system/227872.html", "time": "2020-03-29", "level": "", "num_look": 93229, "num_comment": 93229, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "今天给大家介绍的是一款名叫GDBFrontend的工具，这是一款GUI调试工具，该工具易于使用，并且灵活可扩展。"}
{"title": "挖洞经验 | 从负载均衡或CDN应用中发现的配置类漏洞", "url": "https://www.freebuf.com/vuls/227805.html", "time": "2020-03-29", "level": "", "num_look": 121224, "num_comment": 2, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文分享的Writeup是作者在测试一些目标服务相关的负载均衡或CDN应用时发现的错误配置型漏洞，这些漏洞有些发生服务端犄角旮旯的响应消息中，可能很少会引人注意，我们一起来看看。"}
{"title": "“中毒新闻行动”——黑客利用后门对香港iOS用户发起水坑攻击", "url": "https://www.freebuf.com/news/231737.html", "time": "2020-03-29", "level": "", "num_look": 78896, "num_comment": 78896, "author": "kirazhou", "tags": ["资讯"], "text": "这是一场旨在利用iOS后门感染香港用户的运动，该iOS后门被命名为lightSpy，可使攻击者接管设备。"}
{"title": "Apache Tomcat从文件包含到RCE漏洞原理深入分析", "url": "https://www.freebuf.com/news/230186.html", "time": "2020-03-29", "level": "", "num_look": 150918, "num_comment": 2, "author": "alphalab", "tags": ["WEB安全", "漏洞"], "text": "本篇文章针对Apache Tomcat Ajp（CVE-2020-1938）漏洞的文件包含和RCE的利用方式以及原理进行的深入的分析，同时包括漏洞复现和分析环境搭建的详细步骤。"}
{"title": "Windows Softether VPN配置端口转发", "url": "https://www.freebuf.com/articles/system/229845.html", "time": "2020-03-29", "level": "红色标题", "num_look": 135508, "num_comment": 2, "author": "lll377", "tags": ["系统安全"], "text": "我们来先科普一下什么是SoftEther吧，SoftEther是由日本筑波大学的登大遊在硕士论文中提出的开源、跨平台、多重协议的虚拟专用网方案,是专门为穿过防火墙而设计的。"}
{"title": "Windows主机漏洞扫描工具", "url": "https://www.freebuf.com/sectool/229655.html", "time": "2020-03-28", "level": "红色标题", "num_look": 184429, "num_comment": 3, "author": "jerrybird", "tags": ["工具"], "text": "这是一款基于主机的漏洞扫描工具，采用多线程确保可以快速的请求数据，采用线程锁可以在向sqlite数据库中写入数据避免database is locked的错误，采用md5哈希算法确保数据不重复插入。"}
{"title": "NTLMRecon：一款针对Web应用NTLM认证信息的枚举工具", "url": "https://www.freebuf.com/sectool/229960.html", "time": "2020-03-28", "level": "", "num_look": 93136, "num_comment": 93136, "author": "Alpha_h4ck", "tags": ["工具"], "text": "NTLMRecon是一款针对Web应用NTLM认证信息的枚举工具，如果目标Web节点启用了NTLM认证功能，那么广大研究人员就可以使用NTLMRecon来枚举目标相关信息。"}
{"title": "工信部：加强5G网络基础设施安全保障，强化5G网络数据安全保护，培育5G网络安全产业生态", "url": "https://www.freebuf.com/news/231791.html", "time": "2020-03-28", "level": "", "num_look": 48424, "num_comment": 48424, "author": "Sandra1432", "tags": ["资讯"], "text": "为深入贯彻落实习近平总书记关于推动5G网络加快发展的重要讲话精神，全力推进5G网络建设、应用推广、技术发展和安全保障，工信部作出如下通知。"}
{"title": "近期使用新冠疫情（COVID-19）为诱饵的APT攻击活动汇总", "url": "https://www.freebuf.com/articles/network/231594.html", "time": "2020-03-28", "level": "", "num_look": 117571, "num_comment": 2, "author": "腾讯电脑管家", "tags": ["网络安全"], "text": "目前，由新型冠状病毒引起的肺炎疫情（COVID-19）在全球蔓延，已有190个国家存在确诊病例，全球确诊人数已经超过43万人，死亡病例超过1.9万。"}
{"title": "云服务客户落实网络安全等级保护2.0", "url": "https://www.freebuf.com/articles/neopoints/229993.html", "time": "2020-03-28", "level": "红色标题", "num_look": 136573, "num_comment": 2, "author": "艾尔等保之道", "tags": ["观点"], "text": "网络安全等级保护制度中两个关键动作“定级”、“测评”，关于云服务客户如何顺利开展这两项关键动作，需明确：面向“对象”和面向“责任”。"}
{"title": "Cobalt Strike折腾踩坑填坑记录", "url": "https://www.freebuf.com/sectool/229965.html", "time": "2020-03-28", "level": "红色标题", "num_look": 120589, "num_comment": 4, "author": "Ca3tie1", "tags": ["工具"], "text": "对Cobalt strike的学习和研究中我也同样遇到很多的问题，这里把过程中一些问题和解决办法记录下来，以便以后查阅，同时也希望对刚接触Cobatl strike的朋友有所帮助。"}
{"title": "BUF大事件丨黑客1亿美元叫卖AMD源码；Pwn2Own 2020春季赛落下帷幕；淘宝出现“内测版本将到期” 弹窗Bug", "url": "https://www.freebuf.com/news/231744.html", "time": "2020-03-28", "level": "红色标题", "num_look": 170650, "num_comment": 170650, "author": "Darry端", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，淘宝出现“内测版本将到期” 弹窗Bug，官方回应：关闭提醒即可；黑客1亿美元叫卖AMD源码；Pwn2Own 2020春季赛落下帷幕，Fluoroacetate团队成最大赢家。"}
{"title": "HackerOne百万美元白帽采访：一个因入侵美国军方入狱的黑客逆袭", "url": "https://www.freebuf.com/video/231616.html", "time": "2020-03-27", "level": "红色标题", "num_look": 241494, "num_comment": 8, "author": "willhuang", "tags": ["视频"], "text": "青年Tommy因入侵美国军方和政府电脑两次被捕，出狱后不断学习安全技术，成为HackerOne、Bugcrowd和Synack众测平台的高产白帽，入选多家知名厂商漏洞测试名人堂，是2017年HackerOne Top 25黑客之一。"}
{"title": "XCTR-Hacking-Tools：一款多合一功能的信息收集工具", "url": "https://www.freebuf.com/sectool/229270.html", "time": "2020-03-27", "level": "", "num_look": 118048, "num_comment": 118048, "author": "Alpha_h4ck", "tags": ["工具"], "text": "XCTR-Hacking-Tools是一款整合了多种功能为一身的信息收集工具。"}
{"title": "Github疑似遭中间人劫持，网友反馈访问报证书错误", "url": "https://www.freebuf.com/news/231667.html", "time": "2020-03-27", "level": "", "num_look": 443729, "num_comment": 8, "author": "Sandra1432", "tags": ["资讯"], "text": "昨日，部分网友反馈Github网站无法访问，疑似有攻击者大规模地发起中间人劫持。除了Github网站，京东、koajs 等其他网站似乎也受到影响。"}
{"title": "「红蓝军演练之钥」系列直播公开课首期报名启动", "url": "https://www.freebuf.com/fevents/231475.html", "time": "2020-03-27", "level": "红色标题", "num_look": 100838, "num_comment": 5, "author": "FB独家", "tags": ["活动"], "text": "3月31日-4月2日，斗象科技带来「红蓝军演练之钥」系列直播公开课第一期即将开课。"}
{"title": "白帽公开课｜CTF中Web各种题目的解题姿势", "url": "https://www.freebuf.com/open/231704.html", "time": "2020-03-27", "level": "", "num_look": 100234, "num_comment": 100234, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "为了让大家更深入地了解我们Lo36r老师及课程，FreeBuf公开课特邀Lo36r老师为大家分享相关技术文章《一个Webshell的深入思考》。"}
{"title": "如何使用BPF将SSH会话转换为结构化事件", "url": "https://www.freebuf.com/articles/system/228936.html", "time": "2020-03-27", "level": "", "num_look": 77241, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "Teleport 4.2引入了一个名叫增强型会话记录（Enhanced Session Recording）的新功能，该功能可以接收一个非结构化的SSH会话，并输出结构化事件的数据流。"}
{"title": "斗象科技春招来了！安全行业Top创业公司&前景福利双赢的offer不香吗？", "url": "https://www.freebuf.com/jobs/231655.html", "time": "2020-03-27", "level": "红色标题", "num_look": 102687, "num_comment": 3, "author": "FB客服", "tags": ["安全招聘"], "text": "大家好，我是斗象的HR招聘官。受疫情影响，很多FB铁粉在这个招聘旺季是不是还没遇到心仪的offer？没关系，我们带着一大波热腾腾的岗位来啦~"}
{"title": "Apache ShardingShpere(CVE-2020-1947)漏洞分析", "url": "https://www.freebuf.com/vuls/230031.html", "time": "2020-03-27", "level": "", "num_look": 150711, "num_comment": 2, "author": "云影实验室", "tags": ["WEB安全", "漏洞"], "text": "2020年3月9日，Apache官方修复了一处由奇安信云影实验室maoge发现并提交的远程代码执行漏洞CVE-2020-1947。"}
{"title": "网络设备被垃圾报文攻击实例浅析", "url": "https://www.freebuf.com/articles/network/230056.html", "time": "2020-03-27", "level": "现金奖励", "num_look": 182529, "num_comment": 14, "author": "沃行山水369", "tags": ["网络安全"], "text": "本案例主要分析网络设备OLT被（IPV6） MLD报文攻击导致用户ONU大面积掉注册的故障现象。"}
{"title": "FreeBuf早报 | 女黑客1亿美元叫卖AMD源码；MacOS蓝牙漏洞可实现零点击无接触远程利用；有攻击者发动中间人攻击，GitHub和京东受影响最大", "url": "https://www.freebuf.com/news/231648.html", "time": "2020-03-27", "level": "红色标题", "num_look": 71531, "num_comment": 4, "author": "Sandra1432", "tags": ["资讯"], "text": "AMD芯片设计师透露，黑客窃取了即将推出的GPU源码，其中一些文件已经在网上发布。"}
{"title": "女黑客1亿美元叫卖AMD源码", "url": "https://www.freebuf.com/news/231641.html", "time": "2020-03-26", "level": "红色标题", "num_look": 177686, "num_comment": 11, "author": "kirazhou", "tags": ["资讯"], "text": "黑客之前叫卖1亿美元，如果没人买就放到Github上。"}
{"title": "今晚8点见 | APP中的个人信息保护公开课", "url": "https://www.freebuf.com/open/231590.html", "time": "2020-03-26", "level": "红色标题", "num_look": 99152, "num_comment": 2, "author": "FB独家", "tags": ["FreeBuf公开课"], "text": "3月26日（今天）晚上20：00，本节免费公开课特邀某世界500强企业中国区信息安全和风险负责人锐少，为大家带来主题为《APP中的个人信息保护》的分享。"}
{"title": "WiFi-Passview：一款基于Batch脚本的开源WiFi密码查看器", "url": "https://www.freebuf.com/articles/network/229287.html", "time": "2020-03-26", "level": "", "num_look": 94163, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "WiFi Passview是一款基于Batch脚本实现的开源程序，它可以帮助我们在几秒钟之内轻松恢复WiFi密码。"}
{"title": "两封发票主题攻击邮件分析", "url": "https://www.freebuf.com/articles/system/229856.html", "time": "2020-03-26", "level": "现金奖励", "num_look": 134173, "num_comment": 6, "author": "cgf99", "tags": ["系统安全"], "text": "一大早收到了两封“发票主题”攻击邮件。"}
{"title": "一例门罗币矿工Downloader的DGA解析", "url": "https://www.freebuf.com/articles/others-articles/228761.html", "time": "2020-03-26", "level": "", "num_look": 42615, "num_comment": 1, "author": "Avenger", "tags": ["其他"], "text": "Bert Hubert 注意到了一个涉及 .tickets、.blackfriday、.feedback 等顶级域名的 DGA 域名，并将其发布到 Twitter。"}
{"title": "v8利用入门：从越界访问到RCE", "url": "https://www.freebuf.com/vuls/230182.html", "time": "2020-03-26", "level": "", "num_look": 133915, "num_comment": 4, "author": "alphalab", "tags": ["WEB安全", "漏洞"], "text": "最近笔者分析了一个chrome v8引擎的漏洞chromium821137，虽然这是一个老的漏洞，但是从漏洞分析利用中我们还是可以学习到v8漏洞利用的一些基础知识，对于入门学习浏览器漏洞利用具有较高的研究价值。"}
{"title": "FreeBuf早报｜HPE警告企业级SSD硬盘Bug，使用4万小时后数据全部丢失；印度宣布全国封锁隔离 21 天；严重的RCE漏洞影响了数百万基于OpenWrt的网络设备", "url": "https://www.freebuf.com/news/231547.html", "time": "2020-03-26", "level": "红色标题", "num_look": 77068, "num_comment": 8, "author": "kirazhou", "tags": ["资讯"], "text": "莫迪在讲话中警告称，走出家门的任何人都可能面对刑事公诉，他严厉命令 13.7 亿印度人在未来 21 天呆在家里。"}
{"title": "今晚8点不见不散 | 公有云数据安全架构免费公开课", "url": "https://www.freebuf.com/open/231505.html", "time": "2020-03-25", "level": "红色标题", "num_look": 108078, "num_comment": 1, "author": "FB独家", "tags": ["FreeBuf公开课"], "text": "3月25日（今天）晚上20：00，前轻松筹信息安全负责人韩晋，为大家带来主题为《公有云数据安全架构》的分享。"}
{"title": "Mouse Framework：一款针对iOS和macOS的后渗透漏洞利用框架", "url": "https://www.freebuf.com/articles/system/228785.html", "time": "2020-03-25", "level": "", "num_look": 101048, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "Mouse Framework是一款针对iOS和macOS的后渗透漏洞利用框架。"}
{"title": "从苹果“解锁门”事件反思国内疫情当前的公众安全和个人隐私", "url": "https://www.freebuf.com/articles/neopoints/230096.html", "time": "2020-03-25", "level": "", "num_look": 153964, "num_comment": 4, "author": "Sandra1432", "tags": ["观点"], "text": "说到公众安全和个人隐私，这的确是个老生常谈的话题了，最早在2016年FBI要求苹果解锁罪犯手机时，这个话题就曾引发热议，一场公众安全和个人隐私孰重孰轻的争执至今也没有定论。"}
{"title": "白帽公开课｜纯实战化攻防教学：玩转白帽子操作系统Blackarch", "url": "https://www.freebuf.com/open/231469.html", "time": "2020-03-25", "level": "", "num_look": 96267, "num_comment": 96267, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "对于白帽子而言，装备、工具、软件等资源集合就好比我们的「军火库」，是否配备完善且得心顺手，直接决定了后续战斗中能否更快更准拿下目标。"}
{"title": "Adobe修复了其Creative Cloud中可致任意文件删除的严重漏洞", "url": "https://www.freebuf.com/news/231488.html", "time": "2020-03-25", "level": "", "num_look": 63714, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "近日，Adobe修复了Windows版Creative Cloud桌面应用程序的一个严重漏洞，发布了带外安全更新，对漏洞进行修复。"}
{"title": "新的APT组织Wild Pressure正在瞄准中东的工业部门", "url": "https://www.freebuf.com/news/231463.html", "time": "2020-03-25", "level": "", "num_look": 61586, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "2019年8月，卡巴斯基发现了一个恶意活动，该活动分发了一个成熟的C ++木马，我们称为Milum，而记录的所有受害者都来自中东组织。"}
{"title": "个人金融信息保护技术规范解读", "url": "https://www.freebuf.com/articles/database/229963.html", "time": "2020-03-25", "level": "现金奖励", "num_look": 216847, "num_comment": 1, "author": "IRONMAN娄大壮", "tags": ["数据安全", "标准与合规"], "text": "2020年2月20日，全国金融标准化技术委员会公示了推荐性行业标准《个人金融信息保护技术规范》，该标准由中国人民银行于2020年2月13日发布并于当日实施。"}
{"title": "Android应用程序篡改检测研究（含验证代码）", "url": "https://www.freebuf.com/articles/terminal/229094.html", "time": "2020-03-25", "level": "", "num_look": 149769, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "Android应用程序在上传至Play Sotre之前，开发者需要先使用私钥来对其进行签名。"}
{"title": "Mimikatz提取Windows用户凭证分析", "url": "https://www.freebuf.com/articles/system/229225.html", "time": "2020-03-25", "level": "", "num_look": 128032, "num_comment": 2, "author": "新华三攻防团队", "tags": ["系统安全"], "text": "攻击者在获取到Windows shell之后，有可能会上传Mimikatz提取用户凭证。"}
{"title": "黑客组织Fancy Bear：窃取高知名度的网络钓鱼电子邮件帐户", "url": "https://www.freebuf.com/news/231381.html", "time": "2020-03-25", "level": "", "num_look": 54702, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "趋势科技的安全研究人员表示，与俄罗斯有关的网络间谍组织Pawn Storm一直在利用窃取的电子邮件帐户向潜在受害者发送钓鱼邮件。"}
{"title": "薅“疫情公益”羊毛，黑产恶意爬取各大出版社电子书上万册", "url": "https://www.freebuf.com/news/229579.html", "time": "2020-03-25", "level": "红色标题", "num_look": 73795, "num_comment": 7, "author": "GEETEST极验", "tags": ["资讯"], "text": "这个特殊的时期，企业不仅受到疫情的影响，还有线上的网络安全问题，重灾之一就是恶意爬虫攻击。"}
{"title": "FreeBuf早报｜黑客企图侵入WHO；疫情期间欧洲议会将通过电子邮件方式进行电子投票；肯尼亚政府批准Loon的热气球网络连接服务", "url": "https://www.freebuf.com/news/231427.html", "time": "2020-03-25", "level": "红色标题", "num_look": 58331, "num_comment": 4, "author": "shidongqi", "tags": ["资讯"], "text": "本月初精英黑客试图侵入世界卫生组织(WHO)，其中一位高级机构官员表示，对WHO的网络攻击增加了两倍多。WHO信息安全官员Flavio Aggio表示，黑客的身份尚不清楚，而且没有成功侵入。"}
{"title": "今晚8点！小米总监带你实践企业隐私保护技术", "url": "https://www.freebuf.com/open/231366.html", "time": "2020-03-24", "level": "红色标题", "num_look": 94673, "num_comment": 1, "author": "FB独家", "tags": ["FreeBuf公开课"], "text": "3月24日（今天）晚上20：00，小米安全合规的宋文宽总监，为大家带来主题为《隐私保护技术的企业实践》的分享。"}
{"title": "基于代理的防火墙安全性探讨", "url": "https://www.freebuf.com/articles/network/229592.html", "time": "2020-03-24", "level": "", "num_look": 96355, "num_comment": 96355, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "其实一直以来，基于代理的防火墙或Web代理都被认为是一种非常重要的安全组件。但问题就在于，这种类型的代理针对可以帮助用户保证他们的安全吗？"}
{"title": "攻击者利用通达OA漏洞释放勒索病毒，用户数据遭到加密", "url": "https://www.freebuf.com/vuls/230909.html", "time": "2020-03-24", "level": "", "num_look": 155682, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["WEB安全", "漏洞"], "text": "近日，通达OA官方论坛发布了一则安全更新，披露了近期出现攻击者利用通达OA文件上传和文件包含漏洞释放勒索病毒的攻击事件。"}
{"title": "微软情报团队看勒索：从自动化到手动", "url": "https://www.freebuf.com/articles/system/231316.html", "time": "2020-03-24", "level": "", "num_look": 123191, "num_comment": 123191, "author": "Sandra1432", "tags": ["系统安全"], "text": "近些年，我们经常看到很多机构包括水利，电力，能源，医疗等基础设施机构甚至包括政府被勒索软件攻击。"}
{"title": "MSBuild安全分析", "url": "https://www.freebuf.com/articles/system/227954.html", "time": "2020-03-24", "level": "", "num_look": 81084, "num_comment": 81084, "author": "周大涛", "tags": ["系统安全"], "text": "MSBuild特征之一是需要配置文件，攻击者可以使用一个特殊的XML标记，指定一个内联任务，其中包含将由MSBuild编译并加载到内存中的源代码。"}
{"title": "Nginx内存内容泄漏：问题复现与修复方案解析", "url": "https://www.freebuf.com/vuls/231098.html", "time": "2020-03-24", "level": "现金奖励", "num_look": 121846, "num_comment": 5, "author": "糖果L5Q", "tags": ["漏洞"], "text": "最近HackerOne公布了Nginx内存内容泄漏的问题，如果说内存内容泄漏的问题是个Bug的话，那这个Bug是个比较典型的程序没有对输入异常数据做适当的过滤处理而形成的。"}
{"title": "便利蜂招聘安全工程师", "url": "https://www.freebuf.com/jobs/230779.html", "time": "2020-03-24", "level": "", "num_look": 48599, "num_comment": 48599, "author": "李玉的机械毛驴", "tags": ["安全招聘"], "text": "便利蜂于2016年底创立于北京，属于一家创业型公司，公司业务在快速发展中，以线下便利店、智能货柜业务为主。截止2019年9月，门店已突破1000家，集中在华北、华东地区。"}
{"title": "微软警告：2个未修补的0day漏洞影响所有Windows版本", "url": "https://www.freebuf.com/vuls/231295.html", "time": "2020-03-24", "level": "", "num_look": 122526, "num_comment": 3, "author": "kirazhou", "tags": ["漏洞"], "text": "微软发布了一个新的安全公告，提醒数十亿Windows用户——两个新的未修复的0day漏洞将使黑客远程控制目标计算机。"}
{"title": "通读审计之AACMS", "url": "https://www.freebuf.com/vuls/229981.html", "time": "2020-03-24", "level": "现金奖励", "num_look": 170909, "num_comment": 13, "author": "Heihu577", "tags": ["WEB安全", "漏洞"], "text": "其实没什么好说的，该cms不是主流的cms，但是感觉该cms是一篇很好的MVC框架的例子，故记录下来。给大家分享一下自己代码审计的经验。"}
{"title": "FreeBuf早报 | 俄罗斯将禁止发行和销售加密货币；工信部部署开展2020年IPv6端到端贯通能力提升专项行动；更新导致Windows Defender故障：安全扫描跳过检查项", "url": "https://www.freebuf.com/news/231262.html", "time": "2020-03-24", "level": "红色标题", "num_look": 90909, "num_comment": 4, "author": "Sandra1432", "tags": ["资讯"], "text": "Windows Defender更新破坏了Windows 10上的防病毒扫描，并且防病毒保护软件报告了“扫描期间跳过的项目”错误。"}
{"title": "渗透测试面试近期热门题", "url": "https://www.freebuf.com/vuls/228750.html", "time": "2020-03-24", "level": "现金奖励", "num_look": 481701, "num_comment": 63, "author": "绿帽子技术分享", "tags": ["漏洞", "网络安全"], "text": "近期面试喜欢问的问题，总结了一下。"}
{"title": "Windows凭证的伪造和窃取技术总结", "url": "https://www.freebuf.com/articles/system/229333.html", "time": "2020-03-23", "level": "", "num_look": 122805, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "在Windows环境中，当程序执行时经常会需要用户输入自己的域凭证来实现身份验证，或者说在触发用户账号控制时要求用户输入凭证来实现授权或提权，这种情况是很常见的。"}
{"title": "赠书福利 |《内网安全攻防：渗透测试实战指南》", "url": "https://www.freebuf.com/fevents/231051.html", "time": "2020-03-23", "level": "红色标题", "num_look": 225399, "num_comment": 63, "author": "FB客服", "tags": ["活动"], "text": "美好的周一，从新一轮赠书活动开始。评论参与互动，即有机会获得赠书《内网安全攻防：渗透测试实战指南》，还在等什么！"}
{"title": "Malwarebytes Labs发布2020年恶意软件威胁态势报告", "url": "https://www.freebuf.com/articles/paper/227998.html", "time": "2020-03-23", "level": "", "num_look": 169753, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["安全报告"], "text": "想必安全行业内的从业人员都知道，每年2月份的第二个星期二，是国际互联网安全日。"}
{"title": "如何检测Linux Guest VM使用的哪种虚拟化技术", "url": "https://www.freebuf.com/articles/network/229040.html", "time": "2020-03-23", "level": "", "num_look": 98541, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "如果我有一台基于云的虚拟机，并且运行了Ubuntu或CentOS的Linux服务器系统，而这些设备可能是虚拟化的，也可能不是虚拟化的，那我们应该如何去判断这台Linux Guest系统设备使用的是哪种虚拟化技术呢？"}
{"title": "今晚8点开课 | 娄鹤律师：网络安全，以“人”为本", "url": "https://www.freebuf.com/open/231015.html", "time": "2020-03-23", "level": "红色标题", "num_look": 96791, "num_comment": 96791, "author": "FB独家", "tags": ["FreeBuf公开课"], "text": "今晚20：00，FreeBuf公开课特邀北京德和衡（上海）律师事务所的娄鹤律师，为大家带来主题为《网络安全：以人为本》的分享。"}
{"title": "手机APP客户端安全性测试相关", "url": "https://www.freebuf.com/articles/terminal/229590.html", "time": "2020-03-23", "level": "现金奖励", "num_look": 611800, "num_comment": 11, "author": "艾登——皮尔斯", "tags": ["终端安全", "网络安全"], "text": "前些阵子因为疫情蔓延的关系，大家基本都在家自我隔离&远程办公。微信好友张三让我帮忙测试他们公司开发的房地产工程建设相关的APP客户端等相关测试项目。"}
{"title": "FreeBuf早报｜北京警方破获涉疫情电信网络诈骗案件63起；几内亚在选举前断网；Pwn2Own 2020春季赛落下帷幕", "url": "https://www.freebuf.com/news/231126.html", "time": "2020-03-23", "level": "红色标题", "num_look": 65042, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": "3月21日，北京警方通报，从一月底至今，已破获涉疫情电信网络诈骗案件63起，抓获犯罪嫌疑人85名，累计避免群众财产损失1.3亿余元。"}
{"title": "关保笔记（三）：安全防护", "url": "https://www.freebuf.com/articles/es/228833.html", "time": "2020-03-23", "level": "现金奖励", "num_look": 139846, "num_comment": 4, "author": "宇宸de研究室", "tags": ["企业安全", "标准与合规"], "text": "安全防护是关保标准中的第二个环节，也是重点环节，基于等保开展定级、备案、测评、建设、整改和自查工作。"}
{"title": "数据丨2019年中国网络安全行业投融资年度报告", "url": "https://www.freebuf.com/articles/paper/231191.html", "time": "2020-03-23", "level": "", "num_look": 152247, "num_comment": 152247, "author": "CyberOpportunity", "tags": ["安全报告"], "text": "随着我国网络安全产业的不断壮大，近五年网络安全企业资本交易活动活跃程度明显提升，大量投资机构涌入市场助力产业发展，2019年我国网络安全市场资本交易总额达到225.6亿元。"}
{"title": "任意文件读取漏洞的曲折历程", "url": "https://www.freebuf.com/articles/web/229648.html", "time": "2020-03-23", "level": "现金奖励", "num_look": 434822, "num_comment": 14, "author": "CSeroad", "tags": ["WEB安全"], "text": "这周授权测试了某系统，凭借着一个任意文件读取的漏洞，不断深挖，一波三折，历时将近24小时，也和Tide安全的小伙伴不断讨论，最终拿下目标的webshell。过程简直不要太美、太狗血，在此做个整理。"}
{"title": "Pwn2Own 2020春季赛落下帷幕，Fluoroacetate团队成最大赢家", "url": "https://www.freebuf.com/news/231109.html", "time": "2020-03-22", "level": "", "num_look": 175966, "num_comment": 4, "author": "百里不守约", "tags": ["资讯"], "text": "每年春季在加拿大温哥华 CanSecWest 网络安全会议上举办的 Pwn2Own 黑客大赛刚刚落下帷幕，今年的大赢家是由安全研究人员 Amat Cama 和 Richard Zhu 组成的 Fluoroacetate 团队。"}
{"title": "Xencrypt：一款基于PowerShell脚本实现的反病毒绕过工具", "url": "https://www.freebuf.com/sectool/229249.html", "time": "2020-03-22", "level": "", "num_look": 127727, "num_comment": 127727, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的这款工具名叫Xencrypt，它是一款基于PowerShell脚本实现的反病毒绕过工具。"}
{"title": "挖洞经验 | 密码重置Token可预测性导致的账号劫持漏洞", "url": "https://www.freebuf.com/vuls/227858.html", "time": "2020-03-22", "level": "", "num_look": 123281, "num_comment": 1, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "今天分享的Writeup是一个有趣的账号劫持漏洞。"}
{"title": "阿里巴巴归零实验室招聘情报专家", "url": "https://www.freebuf.com/jobs/230863.html", "time": "2020-03-22", "level": "", "num_look": 63484, "num_comment": 5, "author": "阿里安全", "tags": ["安全招聘"], "text": "阿里安全归零实验室成立于2017年11月，致力于对黑灰产技术的研究。实验室的愿景是通过技术手段解决当前日益严重的网络违规和网络犯罪问题，为阿里新经济体保驾护航。"}
{"title": "关于钓鱼邮件的学习笔记", "url": "https://www.freebuf.com/articles/web/227694.html", "time": "2020-03-22", "level": "现金奖励", "num_look": 693129, "num_comment": 8, "author": "sec360zz", "tags": ["WEB安全"], "text": "前段时间公司组织了一次以钓鱼邮件攻击为主题的攻防活动，对于攻击方来说，目标是提高钓鱼邮件攻击能力，包括探索各种钓鱼方式和实战技巧。"}
{"title": "等保测评2.0：MySQL安全审计", "url": "https://www.freebuf.com/articles/database/228760.html", "time": "2020-03-22", "level": "现金奖励", "num_look": 226895, "num_comment": 6, "author": "起于凡而非于凡", "tags": ["数据安全", "标准与合规"], "text": "本篇文章主要说一说MySQL数据库安全审计控制点的相关内容和理解。MySQL除了自身带有的审计功能外，还存在着一些其它的审计插件。"}
{"title": "DnsFookup：一款功能强大的DNS重绑定工具", "url": "https://www.freebuf.com/articles/network/229255.html", "time": "2020-03-21", "level": "", "num_look": 89422, "num_comment": 89422, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "今天给大家介绍的这款工具名叫DnsFookup，这是一款功能强大的DNS重绑定工具，广大研究人员可以使用该工具来对目标DNS服务器进行安全测试。"}
{"title": "BUF大事件丨微博泄露事件卧底调查报告：隐私一览无余；Intel处理器曝新漏洞：打补丁性能骤降77％", "url": "https://www.freebuf.com/news/231071.html", "time": "2020-03-21", "level": "红色标题", "num_look": 104039, "num_comment": 4, "author": "Darry端", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，微博泄露事件卧底调查报告：隐私一览无余；Intel处理器曝新漏洞：打补丁性能骤降77％；严防健康码数据泄露，需要从源头加强监管。"}
{"title": "跟踪sLoad十个月再回顾", "url": "https://www.freebuf.com/articles/others-articles/228089.html", "time": "2020-03-21", "level": "", "num_look": 33020, "num_comment": 1, "author": "Avenger", "tags": ["其他"], "text": "sLoad（TH-163）是自从 2018 年第三季度开始针对意大利、英国和加拿大发起持续不断攻击的主角，Proofpoint的分析报告也揭露了这一行动。"}
{"title": "蚂蚁金服诚聘安全研发专家", "url": "https://www.freebuf.com/jobs/230677.html", "time": "2020-03-21", "level": "", "num_look": 51286, "num_comment": 6, "author": "billzone", "tags": ["安全招聘"], "text": "蚂蚁金服是一家旨在为世界带来普惠金融服务的科技企业。蚂蚁金服起步于 2004 年成立的支付宝。"}
{"title": "2020年应该引起关注的8种移动安全威胁", "url": "https://www.freebuf.com/articles/terminal/228900.html", "time": "2020-03-21", "level": "", "num_look": 147459, "num_comment": 147459, "author": "Sandra1432", "tags": ["终端安全"], "text": "如今，移动安全已成为每个公司关注的重点对象，因为现在几乎所有员工都能够定期地从智能手机访问公司数据。"}
{"title": "DLink RCE漏洞CVE-2019-17621分析", "url": "https://www.freebuf.com/vuls/228726.html", "time": "2020-03-21", "level": "现金奖励", "num_look": 159338, "num_comment": 159338, "author": "ww5466064", "tags": ["漏洞", "系统安全"], "text": "本次打算尝试一下MIPS系统，于是选了最近DLink路由器的漏洞CVE-2019-17621作为目标。"}
{"title": "挖洞经验 | 不被PayPal待见的6个安全漏洞", "url": "https://www.freebuf.com/vuls/228755.html", "time": "2020-03-20", "level": "", "num_look": 120181, "num_comment": 5, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "最近，Cybernews分析人员称，他们发现了和PayPal相关的6个高危漏洞，攻击者利用这些漏洞可以实现：绕过PayPal登录后的双因素认证（2FA）、使用其内部智能聊天系统发送恶意代码。"}
{"title": "斗象科技2020春季安全技术专场招聘启动啦 | 加入我们，创新安全", "url": "https://www.freebuf.com/jobs/230600.html", "time": "2020-03-20", "level": "红色标题", "num_look": 103903, "num_comment": 3, "author": "FB客服", "tags": ["安全招聘"], "text": "斗象科技创立于2014年，为用户提供互联网化的网络安全服务以及智能安全分析产品解决方案。现在，斗象科技春季安全技术专场招聘开始啦！一大波新鲜的岗位正在来的路上，大家千万不要错过~"}
{"title": "阿里云发布《2019云上企业安全指南》，破解云上安全运营难题", "url": "https://www.freebuf.com/articles/paper/230997.html", "time": "2020-03-20", "level": "", "num_look": 171967, "num_comment": 1, "author": "阿里云安全", "tags": ["安全报告"], "text": "近日，据阿里云安全运营中心发布了《2019云上企业安全指南》，对2019年网络安全态势做了分析，并给出2020年云上安全运营建议。"}
{"title": "隐私一览无余！微博泄露事件卧底调查报告", "url": "https://www.freebuf.com/news/230960.html", "time": "2020-03-20", "level": "红色标题", "num_look": 597774, "num_comment": 23, "author": "百里不守约", "tags": ["资讯"], "text": "本次数据泄露据说是由微博而来，在小道消息的引导下，我们找到了购买隐私数据其中一个根据地：电报（Telegram），通过电报按图索骥、购买服务，摸清了灰产的整个服务架构。"}
{"title": "ExchangeServer漏洞CVE-2020-0688复现", "url": "https://www.freebuf.com/vuls/228681.html", "time": "2020-03-20", "level": "现金奖励", "num_look": 177777, "num_comment": 5, "author": "Kriston", "tags": ["漏洞"], "text": "近期爆出Exchange邮件服务器远程执行命令漏洞,对其进行了分析并在本地进行了复现，其中也遇到了一些问题。"}
{"title": "等保测评2.0：SQLServer安全审计", "url": "https://www.freebuf.com/articles/database/227859.html", "time": "2020-03-20", "level": "现金奖励", "num_look": 208517, "num_comment": 4, "author": "起于凡而非于凡", "tags": ["数据安全", "标准与合规"], "text": "本篇文章主要说一说SQLServer数据库安全审计控制点的相关内容和理解。"}
{"title": "突破正则匹配：探寻SQL注入绕过WAF的本源之道", "url": "https://www.freebuf.com/vuls/229300.html", "time": "2020-03-20", "level": "现金奖励", "num_look": 147327, "num_comment": 6, "author": "DD想上学了", "tags": ["WEB安全", "漏洞"], "text": "前言：网络上SQL注入绕过WAF的帖子文章纷繁多样，良莠不齐，眉毛胡子一把抓，各种姿势让人眼花缭乱。于是，便有学生问我，SQL注入绕过WAF的最本质原理是什么。"}
{"title": "FreeBuf早报｜微博回应“数据泄露”事件；法国警告称将有新的勒索团伙袭击地方政府；苹果iOS 13.4越狱工具发布", "url": "https://www.freebuf.com/news/230957.html", "time": "2020-03-20", "level": "红色标题", "num_look": 96820, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": "苹果发布iOS 13.4 beta 6/GM版系统，紧随其后越狱大神卢卡斯就发布了checkra1n 0.9.9版本解决iOS13.4无法越狱的问题。目前checkra1n 0.9.9版仅限macOS系统下越狱，暂无U盘一键越狱。"}
{"title": "记录并浅析一次服务器被黑事件", "url": "https://www.freebuf.com/articles/web/229518.html", "time": "2020-03-20", "level": "现金奖励", "num_look": 144593, "num_comment": 7, "author": "cgf99", "tags": ["WEB安全", "系统安全"], "text": "偶然发现一台web服务器很怪异，其网站页面上增加了一堆外文的页面链接，点击一篇进去之后，内容如下图所示。"}
{"title": "永远修复不完的Linux本地ASLR漏洞", "url": "https://www.freebuf.com/articles/system/228731.html", "time": "2020-03-19", "level": "", "num_look": 94489, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "ASLR，应为全称为Address Space Layout Randomization，即地址空间布局随机化。它是一种概率性安全防御机制，由PaX团队于2001年正式提出，并在2005年开始引入到Linux内核之中。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列：Cody Brocious", "url": "https://www.freebuf.com/video/230805.html", "time": "2020-03-19", "level": "红色标题", "num_look": 84289, "num_comment": 2, "author": "willhuang", "tags": ["视频"], "text": "Cody Brocious 有超过15年的信息安全研究和教育经验，主要研究方向为硬件逆向和软件开发，2017年至2019年9月任职Hacker101主管，负责Hacker101的CTF和Web安全培训。"}
{"title": "永安在线（原威胁猎人）招聘人才", "url": "https://www.freebuf.com/jobs/230656.html", "time": "2020-03-19", "level": "", "num_look": 50068, "num_comment": 1, "author": "永安在线", "tags": ["安全招聘"], "text": "深圳永安在线科技有限公司是国际领先的反欺诈服务提供商。成立于2017年1月，致力于基于对黑灰产的布控能力，为互联网及金融行业提供反欺诈解决方案，为公安提供网络犯罪打击工具。"}
{"title": "惨遭删库，这笔账应该怎么算？", "url": "https://www.freebuf.com/articles/database/230698.html", "time": "2020-03-19", "level": "", "num_look": 182035, "num_comment": 3, "author": "Doraemon", "tags": ["数据安全"], "text": "微盟删库事件持续发酵，在数据逐步恢复的同时，对广大商家（SaaS用户）的损失赔偿方案引发了新一轮热议。"}
{"title": "VIPKID诚意满满，诚邀安全英才加入！", "url": "https://www.freebuf.com/jobs/230807.html", "time": "2020-03-19", "level": "", "num_look": 56624, "num_comment": 1, "author": "VIPKID安全团队", "tags": ["安全招聘"], "text": "本次招聘开放基础安全、业务安全、数据安全等多个方向的职位，诚邀优秀人才加入，共建安全。"}
{"title": "巧用匿名函数绕过D盾", "url": "https://www.freebuf.com/articles/web/229649.html", "time": "2020-03-19", "level": "现金奖励", "num_look": 129312, "num_comment": 10, "author": "p1k3m4n", "tags": ["WEB安全"], "text": "之前看了smile大佬的webshell绕过，跟着smile大佬的思路，自己来挖掘了一下绕过D盾的方式。"}
{"title": "权限维持及后门持久化技巧总结", "url": "https://www.freebuf.com/articles/system/229209.html", "time": "2020-03-19", "level": "", "num_look": 130989, "num_comment": 5, "author": "新华三攻防团队", "tags": ["系统安全"], "text": "在攻击者利用漏洞获取到某台机器的控制权限之后，会考虑将该机器作为一个持久化的据点，种植一个具备持久化的后门，从而随时可以连接该被控机器进行深入渗透。"}
{"title": "FreeBuf早报 | 黑客创建了数千个冠状病毒（COVID-19）相关站点；TrickBot现在利用受感染的PC发起RDP蛮力攻击；Nefilim勒索软件运营商扬言要释放被盗数据", "url": "https://www.freebuf.com/news/230843.html", "time": "2020-03-19", "level": "红色标题", "num_look": 80214, "num_comment": 4, "author": "kirazhou", "tags": ["资讯"], "text": "根据Check Point Research发布的一份新报告，黑客正在利用COVID-19疫情传播攻击目标受害者，包括注册与冠状病毒相关的恶意域，出售现成的打折恶意软件。"}
{"title": "CVE-2020-0688 exchange远程代码执行漏洞复现", "url": "https://www.freebuf.com/vuls/228735.html", "time": "2020-03-19", "level": "", "num_look": 133848, "num_comment": 4, "author": "DigApis", "tags": ["漏洞"], "text": "近日网络公开了一个编号为CVE-2020-0688的Microsoft Exchange Server远程代码执行漏洞。"}
{"title": "合规、技术、实践，从隐私保护走向数据安全 | 企业安全online公开课即将开课", "url": "https://www.freebuf.com/open/230831.html", "time": "2020-03-18", "level": "", "num_look": 83752, "num_comment": 1, "author": "FB独家", "tags": ["FreeBuf公开课"], "text": "从3月23日（下周一）开始，企业安全online系列专场免费线上公开课正式开启。"}
{"title": "红队基本操作：通用Shellcode加载器", "url": "https://www.freebuf.com/articles/network/228795.html", "time": "2020-03-18", "level": "红色标题", "num_look": 127033, "num_comment": 2, "author": "Elina3000", "tags": ["网络安全"], "text": "Shellcode加载器是一种基本的规避技术。尽管shellcode加载器通常可以促进payload的初始执行，但是启发式检测方法仍可以标记payload的其他方面和行为。"}
{"title": "增强企业对冠状病毒的抵御能力的三项措施", "url": "https://www.freebuf.com/articles/network/230791.html", "time": "2020-03-18", "level": "", "num_look": 84389, "num_comment": 84389, "author": "Sandra1432", "tags": ["网络安全"], "text": "根据Gartner的研究，随着冠状病毒（COVID-19）的传播，短期内首席信息官应采取三项措施，来提高其组织对病毒的抵御能力，并为其反弹和增长的趋势做准备。"}
{"title": "深入分析Citrix ADC远程代码执行（RCE）漏洞CVE-2019-19781", "url": "https://www.freebuf.com/vuls/227319.html", "time": "2020-03-18", "level": "", "num_look": 95066, "num_comment": 1, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "2019年年底，Citrix ADC和Citrix Gateway被曝出存在远程代码执行的高危漏洞CVE-2019-19781，该漏洞最吸引人的地方在于，未授权的攻击者可以利用它入侵控制Citrix设备，并实现进一步的内网资源访问获取。"}
{"title": "全球数字化转型加速，中国企业更担心安全技能不足", "url": "https://www.freebuf.com/news/230611.html", "time": "2020-03-18", "level": "", "num_look": 49570, "num_comment": 4, "author": "shidongqi", "tags": ["资讯"], "text": "据IDC预测，到2023年，中国由数字化产品和服务驱动的数字经济的占比将达到51.3%，数字化产品和服务将成为主流，这与F5近期发布《2020年应用服务状况报告（亚太版）》所体现出来的趋势基本吻合。"}
{"title": "工控安全 | 西门子S7-300攻击分析", "url": "https://www.freebuf.com/articles/ics-articles/228770.html", "time": "2020-03-18", "level": "现金奖励", "num_look": 211771, "num_comment": 8, "author": "黄一113530", "tags": ["工控安全"], "text": "随着等保2.0的普及，工控安全大家也越来越重视，研究工控安全的小伙伴也越来越多。工控安全主要包括工控设备私有协议的安全分析，工控设备固件系统安全以及工控设备应用程序安全等。"}
{"title": "谨防新型跟踪恶意软件：Monitor Minor", "url": "https://www.freebuf.com/news/230619.html", "time": "2020-03-18", "level": "", "num_look": 67879, "num_comment": 6, "author": "kirazhou", "tags": ["资讯"], "text": "可以跟踪Gmail，WhatsApp，Instagram和Facebook的用户活动。"}
{"title": "APT攻防之红队入侵：DLL劫持与白利用", "url": "https://www.freebuf.com/articles/system/227824.html", "time": "2020-03-18", "level": "", "num_look": 111400, "num_comment": 5, "author": "木星安全实验室", "tags": ["系统安全"], "text": "DLL劫持技术已经存在了多年，早在2010年就被发现，那为什么我们还要不停的炒剩饭呢？因为它仍然是一种可行的方法，并且在在野的APT攻击样本中仍然占有一席之地！"}
{"title": "FreeBuf早报 | GitHub宣布收购npm 接管整个JavaScript生态系统；美国卫生部网络系统遭受黑客攻击；中国信通院发布《2020数字医疗：疫情防控期间网络安全风险研究报告》", "url": "https://www.freebuf.com/news/230727.html", "time": "2020-03-18", "level": "红色标题", "num_look": 76846, "num_comment": 4, "author": "Sandra1432", "tags": ["资讯"], "text": "欧洲刑警组织与西班牙和罗马尼亚国家警察一道，通过SIM交换攻击劫持了人们的电话号码，逮捕了26人，涉嫌盗窃超过350万欧元（390万美元）。"}
{"title": "简化版（小素数版）RSA算法的PHP实现", "url": "https://www.freebuf.com/articles/database/229334.html", "time": "2020-03-18", "level": "现金奖励", "num_look": 171622, "num_comment": 1, "author": "NeptLiang", "tags": ["数据安全"], "text": "我们这学期的课程《信息安全与保密》要求期末作业实现一个密码算法及对应的加解密系统，其中做RSA的要求实现加解密、数字签名。"}
{"title": "内网渗透之域关系探测神器：Bloodhound", "url": "https://www.freebuf.com/sectool/228329.html", "time": "2020-03-17", "level": "红色标题", "num_look": 167619, "num_comment": 3, "author": "130421106", "tags": ["工具"], "text": "为了有效管理，安全团队必须具有良好定义的策略和可靠的检测功能。"}
{"title": "谷歌、微软等科技巨头联合声明：共同打击COVID-19相关虚假信息", "url": "https://www.freebuf.com/news/230660.html", "time": "2020-03-17", "level": "", "num_look": 55066, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "在冠状病毒盛行期间，谷歌、微软、Facebook、Twitter等科技公司发出声明，呼吁寻求帮助共同对抗“虚假信息”。"}
{"title": "MacOS恶意软件Shlayer分析", "url": "https://www.freebuf.com/articles/network/227482.html", "time": "2020-03-17", "level": "", "num_look": 80310, "num_comment": 3, "author": "Kriston", "tags": ["网络安全"], "text": "近两年来，Shlayer木马一直是Mac OS平台上最常见的恶意软件，十分之一的Mac OS用户受到它的攻击。"}
{"title": "等保测评2.0：MySQL身份鉴别（下）", "url": "https://www.freebuf.com/articles/database/228104.html", "time": "2020-03-17", "level": "现金奖励", "num_look": 170201, "num_comment": 11, "author": "起于凡而非于凡", "tags": ["数据安全", "标准与合规"], "text": "本篇文章主要说一下MySQL数据中身份鉴别控制点中b、c、d测评项的相关知识点和理解。"}
{"title": "流氓应用隐私收割利器：苹果设备剪贴板泄漏GPS信息隐患分析", "url": "https://www.freebuf.com/articles/terminal/228485.html", "time": "2020-03-17", "level": "", "num_look": 145568, "num_comment": 4, "author": "奇安信威胁情报中心", "tags": ["终端安全"], "text": "苹果iPhone或iPad用户在平常使用APP过程中，难免会碰到一些APP会请求打开定位权限，从而可以获取用户的当前位置用于分析处理，例如地图，外卖等生活类APP。"}
{"title": "FreeBuf早报 | 以色列总理称将利用反恐技术对抗新冠疫情传播；WhatsApp将支持“阅后即焚”：最长可一年后自动删除；疫情追踪应用暗藏CovidLock勒索软件，下载安装请留心", "url": "https://www.freebuf.com/news/230567.html", "time": "2020-03-17", "level": "红色标题", "num_look": 62782, "num_comment": 4, "author": "Sandra1432", "tags": ["资讯"], "text": "据PhoneArena报道，WhatsApp此前一直在测试消息自动删除（self-destructing）功能，类似于阅后即焚，只不过可以自由设置时间，有消息称WhatsApp将向个人聊天形式引入此功能。"}
{"title": "境外黑产团伙也复工，针对国内相关单位发起钓鱼攻击", "url": "https://www.freebuf.com/articles/system/229983.html", "time": "2020-03-17", "level": "", "num_look": 92686, "num_comment": 6, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "近日，奇安信病毒响应中心在日常样本监控过程中发现境外黑客团伙以国内某银行的名义向相关单位发送钓鱼邮件诱导收件人打开附件，从而运行恶意程序，导致单位信息、机密文件被窃取。"}
{"title": "信安标委发布《网络安全标准实践指南—远程办公安全防护》，重点防护设备、数据、环境等方面", "url": "https://www.freebuf.com/news/230540.html", "time": "2020-03-16", "level": "", "num_look": 69742, "num_comment": 2, "author": "Sandra1432", "tags": ["标准与合规", "资讯"], "text": "上周，全国信息安全标准化技术委员会（简称“信安标委”）针对远程办公安全问题发布了《网络安全标准实践指南—远程办公安全防护》（以下简称《实践指南》）。"}
{"title": "今晚8点｜企业安全体系中WAF的探讨免费公开课", "url": "https://www.freebuf.com/fevents/230512.html", "time": "2020-03-16", "level": "红色标题", "num_look": 82872, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "今晚 20：00，本节免费公开课特邀FreeBuf年度作者、你好现在科技股份有限公司安全工程师——煜阳（宋子烨），为大家带来主题为《企业安全体系中WAF的探讨》的分享。"}
{"title": "看我如何利用单一注入点从Firefox浏览器中提取CSS数据", "url": "https://www.freebuf.com/vuls/227326.html", "time": "2020-03-16", "level": "", "num_look": 85506, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["漏洞", "网络安全"], "text": "在几个月之前，我在Firefox浏览器中发现了一个安全漏洞，这个漏洞就是CVE-2019-17016。"}
{"title": "多个Moxa AWK-3131A（工控无线网络设备）漏洞可导致任意代码执行", "url": "https://www.freebuf.com/vuls/228434.html", "time": "2020-03-16", "level": "", "num_look": 85351, "num_comment": 85351, "author": "Alpha_h4ck", "tags": ["漏洞"], "text": "近期，在Moxa AWK-3131A网络设备中发现了三个严重的安全漏洞，这些漏洞将允许攻击者在安装了该款设备的工业环境中执行恶意活动。"}
{"title": "肖力：云原生安全下看企业新边界——身份管理", "url": "https://www.freebuf.com/articles/people/230338.html", "time": "2020-03-16", "level": "红色标题", "num_look": 201304, "num_comment": 7, "author": "kirazhou", "tags": ["人物志"], "text": "人、身份和云端，这三者之间的角力、千丝万缕和无限可能，正是此次采访的最大收获。"}
{"title": "COVID-19时代恶意软件蹿行，该国COVID-19测试中心惨遭攻击", "url": "https://www.freebuf.com/news/230479.html", "time": "2020-03-16", "level": "", "num_look": 84159, "num_comment": 2, "author": "kirazhou", "tags": ["资讯"], "text": "世界各地的医院都在应对日益增长的COVID-19病毒感染浪潮，但是，网络犯罪活动毁掉了欧洲一个测试中心的努力。"}
{"title": "每日获取变更的CVE漏洞", "url": "https://www.freebuf.com/articles/es/228571.html", "time": "2020-03-16", "level": "现金奖励", "num_look": 185271, "num_comment": 16, "author": "煜阳yuyang", "tags": ["企业安全"], "text": "查看CVE推送每日更新，做成类似于新闻头条的推送是企业安全从业人员最应该掌控的能力。"}
{"title": "研究发现Microsoft Edge的遥测技术会侵犯用户隐私", "url": "https://www.freebuf.com/news/230481.html", "time": "2020-03-16", "level": "", "num_look": 55955, "num_comment": 55955, "author": "Sandra1432", "tags": ["资讯"], "text": "虽然Microsoft Edge与Chrome浏览器共享相同的源代码，但它为用户提供了更好的隐私保护。然而，据新的研究表明，与其他浏览器相比，Microsoft Edge的遥测技术或将侵犯用户隐私。"}
{"title": "从网络侧分析蚁剑交互流量", "url": "https://www.freebuf.com/articles/network/229193.html", "time": "2020-03-16", "level": "", "num_look": 105120, "num_comment": 3, "author": "新华三攻防团队", "tags": ["网络安全"], "text": "中国蚁剑是一款跨平台且十分优秀的开源网站管理工具，面向于合法授权的渗透测试安全人员以及进行常规操作的网站管理员。"}
{"title": "FreeBuf早报｜特朗普签署法案禁止使用联邦资金采购华为设备；研究称多个苹果iPhone应用监视剪贴板数据；公主邮轮承认公司存在数据泄露问题", "url": "https://www.freebuf.com/news/230458.html", "time": "2020-03-16", "level": "红色标题", "num_look": 73525, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "最新研究显示数十种流行的iOS应用程序，在未经用户同意的情况下，读取剪贴板的内容，其中可能包含敏感信息。"}
{"title": "Roaming Mantis恶意活动分析报告", "url": "https://www.freebuf.com/articles/network/228769.html", "time": "2020-03-15", "level": "", "num_look": 70759, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "卡巴斯基持续关注分析Roaming Mantis相关网络活动。该组织的攻击方法有所改进，不断在新的攻击目标上窃取资金。攻击者利用白名单和运行环境检测等技术避免被分析溯源。"}
{"title": "JudasDNS：域名服务器DNS投毒测试工具", "url": "https://www.freebuf.com/articles/network/227984.html", "time": "2020-03-15", "level": "", "num_look": 96193, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "JudasDNS是一款针对DNS域名服务器的安全测试工具，在JudasDNS的帮助下，广大安全研究人员可以方便地对目标域名服务器进行DNS投毒攻击测试。"}
{"title": "Netgear R6400 upnp栈溢出漏洞分析", "url": "https://www.freebuf.com/vuls/228293.html", "time": "2020-03-15", "level": "现金奖励", "num_look": 91737, "num_comment": 2, "author": "klovey", "tags": ["漏洞"], "text": "Netgear R6400 多个固件版本中的upnpd存在栈溢出漏洞(CVE-2020-9373)。"}
{"title": "挖洞经验 | 利用Jira的邮件服务器连通测试功能发现其CSRF漏洞", "url": "https://www.freebuf.com/vuls/227971.html", "time": "2020-03-14", "level": "", "num_look": 92586, "num_comment": 92586, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "去年10月，Tenable研究员发现Jira v8.4.1版本存在一个跨站请求伪造漏洞（CSRF）-CVE-2019-20099，籍此可以让目标Jira服务去连接任意内部主机。"}
{"title": "2019年移动恶意软件总结报告", "url": "https://www.freebuf.com/articles/terminal/228295.html", "time": "2020-03-14", "level": "", "num_look": 140972, "num_comment": 140972, "author": "Kriston", "tags": ["终端安全"], "text": "2019年，有两个趋势特别突出：攻击者对用户个人数据的攻击变得更加频繁，在应用市场上检测到木马软件变得更加频繁。本报告将以示例和统计数据更详细地讨论每一项。"}
{"title": "华为终端云服务招聘高级安全工程师(Purple Team)", "url": "https://www.freebuf.com/jobs/230351.html", "time": "2020-03-14", "level": "", "num_look": 77957, "num_comment": 3, "author": "insight", "tags": ["安全招聘"], "text": "华为终端(消费者BG)是华为当前四大业务之一，华为终端云服务当前覆盖全球170多个国家和地区，拥有5亿+用户，并在全球15个数据中心为用户存储了80PB+的数据。"}
{"title": "网络版“黑吃黑”？神秘黑客组织每天分发受感染的黑客工具", "url": "https://www.freebuf.com/news/230004.html", "time": "2020-03-14", "level": "", "num_look": 84132, "num_comment": 2, "author": "kirazhou", "tags": ["资讯"], "text": "本是同根生，互黑没道理。"}
{"title": "RobbinHood勒索软件另辟渠道，通过驱动漏洞干翻杀毒软件", "url": "https://www.freebuf.com/articles/system/228338.html", "time": "2020-03-14", "level": "", "num_look": 89890, "num_comment": 89890, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "2月初，奇安信病毒响应中心在日常样本监控过程中发现了一款名为“RobbinHood”的勒索软件通过使用“另类”的方式关闭并删除杀软。"}
{"title": "等保测评2.0：MySQL访问控制", "url": "https://www.freebuf.com/articles/database/228624.html", "time": "2020-03-14", "level": "现金奖励", "num_look": 168576, "num_comment": 6, "author": "起于凡而非于凡", "tags": ["数据安全", "标准与合规"], "text": "本篇文章主要说一说MySQL中访问控制控制点的相关内容和理解。"}
{"title": "BUF大事件丨天猫超市大数据“杀熟”？官方网友在线Battle；新版个人信息安全规范正式发布，隐私安全得到高度重视", "url": "https://www.freebuf.com/news/230248.html", "time": "2020-03-14", "level": "红色标题", "num_look": 141405, "num_comment": 2, "author": "Darry端", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，天猫超市大数据“杀熟”？官方否认，网友又拿出新证据；新版个人信息安全规范正式发布，隐私安全得到高度重视；无节制流氓推广，2345旗下下载站正在传播木马程序。"}
{"title": "内网横向移动技巧总结", "url": "https://www.freebuf.com/articles/system/229200.html", "time": "2020-03-14", "level": "", "num_look": 149330, "num_comment": 8, "author": "新华三攻防团队", "tags": ["系统安全"], "text": "在攻击者获取到某台内网机器的控制权限之后，进一步会考虑如何在内网进行横向移动，以及攻击域控服务器，本文总结了突破边界后进一步的攻击技巧。"}
{"title": "SMBv3远程代码执行漏洞(CVE-2020-0796)分析", "url": "https://www.freebuf.com/news/232738.html", "time": "2020-03-13", "level": "", "num_look": 24612, "num_comment": 24612, "author": "斗象智能安全平台", "tags": ["资讯"], "text": "微软泄露一个SMB远程代码执行漏洞(CVE-2020-0796), 根据该漏洞描述是 CompressionTransformHeader 的使用出现了问题。"}
{"title": "白帽公开课｜CTF之逆向分析技术 | 冠军选手帮你把CTF知识点各个击破", "url": "https://www.freebuf.com/open/230321.html", "time": "2020-03-13", "level": "", "num_look": 92825, "num_comment": 1, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "在本课程中，首先会为大家解释什么是逆向以及 逆向工程的核心思路 ，介绍逆向中的基础知识，再结合CTF比赛中的常见题目类型，讲解逆向涉及到的各类知识技能。"}
{"title": "更新：补丁发布 | Microsoft Windows SMBv3.0服务远程代码执行漏洞（CVE-2020-0796）通告", "url": "https://www.freebuf.com/articles/system/230288.html", "time": "2020-03-13", "level": "红色标题", "num_look": 158045, "num_comment": 1, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "2020年3月11日，某国外安全公司发布了一个近期微软安全补丁包所涉及漏洞的综述，其中谈到了一个威胁等级被标记为Critical的SMB服务远程代码执行漏洞（CVE-2020-0796）。"}
{"title": "挖洞经验 | 静态分析APK文件发现APP应用硬编码密码泄露", "url": "https://www.freebuf.com/vuls/228474.html", "time": "2020-03-13", "level": "", "num_look": 95762, "num_comment": 3, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "今天分享的Writeup是一篇关于安卓APP的静态分析，由于该APP存在不安全存储和硬编码密码泄露问题，导致可以登录其短信管理系统，劫持其短信接口配置，以下为相关分析研究，希望能对大家有一些参考借鉴作用。"}
{"title": "技术分析：针对gMSA密码的NTLM中继攻击", "url": "https://www.freebuf.com/vuls/227987.html", "time": "2020-03-13", "level": "", "num_look": 74707, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["漏洞", "系统安全"], "text": "gMSA，英文全称为“Group Managed Service Accounts”，即活动目录AD中的组托管服务账户。"}
{"title": "微软发布针对SMBv3漏洞的安全更新，建议用户尽快安装", "url": "https://www.freebuf.com/news/230295.html", "time": "2020-03-13", "level": "", "num_look": 104931, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "微软发布了KB4551762安全更新，修复了在微软服务器消息块3.1.1（SMBv3）中发现的预授权RCE Windows 10漏洞。"}
{"title": "关于分段免杀执行的思考", "url": "https://www.freebuf.com/articles/system/228579.html", "time": "2020-03-13", "level": "现金奖励", "num_look": 110742, "num_comment": 5, "author": "好好学习er", "tags": ["系统安全"], "text": "我们在写shellcode时候，做分段免杀执行时，如何做到边解码然后执行再调用解码，解码后再执行？就是分段执行而且解密的密钥是不一样的，对于这个问题，我们应该想想这三个问题。"}
{"title": "周鸿祎回应“RSA参会者感染新冠病毒”：一直在家自行隔离情况良好", "url": "https://www.freebuf.com/news/230107.html", "time": "2020-03-13", "level": "", "num_look": 68755, "num_comment": 1, "author": "百里不守约", "tags": ["资讯"], "text": "RSA 安全会议主办方周二表示：上月参加旧金山举办的 RSA 网络安全会议的两名与会人员，已被确诊患上新冠病毒感染导致的呼吸系统疾病。"}
{"title": "FreeBuf早报 | Avast因严重漏洞禁用JavaScript引擎组件；披露英特尔处理器新漏洞Load Value Injection；荷兰政府声明丢失了690万器官捐赠者的数据", "url": "https://www.freebuf.com/news/230247.html", "time": "2020-03-13", "level": "红色标题", "num_look": 59563, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "据国外媒体报道，欧盟正在恢复去年其与美国科技公司建立的、打击网上政治虚假信息的联盟，如今它们的关注焦点则是打击有关新冠肺炎疫情的虚假信息。"}
{"title": "从OilRig APT攻击分析恶意DNS流量阻断在企业安全建设中的必要性", "url": "https://www.freebuf.com/articles/others-articles/228700.html", "time": "2020-03-13", "level": "红色标题", "num_look": 34350, "num_comment": 3, "author": "奇安信安全服务", "tags": ["其他"], "text": "OilRig也被称为APT34 (Crambus，“人面马”组织，Cobalt Gypsy)，是一个来自于伊朗的APT组织，该组织从2014年开始活动。"}
{"title": "基于USB的攻击向量总结", "url": "https://www.freebuf.com/articles/terminal/229042.html", "time": "2020-03-13", "level": "金币+20", "num_look": 152867, "num_comment": 2, "author": "战争贩子", "tags": ["终端安全"], "text": "本文，我将主要通过上图的分类方式来探讨针对USB的攻击向量问题。最上层涉及到更多关于人类应用、业务的基本交互场景。传输层包括设备的固件、协议栈等。物理层则主要描述USB总线上的通信问题。"}
{"title": "今晚8点开课 | 动态防御WAF技术原理及编程实战免费公开课", "url": "https://www.freebuf.com/fevents/230157.html", "time": "2020-03-12", "level": "", "num_look": 85164, "num_comment": 2, "author": "FB独家", "tags": ["活动"], "text": "今天晚上20：00，此次公开课的讲师为资深程序员、网络安全专家；ShareWAF开发者；沃奇德格CTO的王丽文，为大家带来主题为《动态防御WAF技术原理及编程实战》的分享。"}
{"title": "阴影！DDR4仍将面临Rowhammer风险", "url": "https://www.freebuf.com/news/230164.html", "time": "2020-03-12", "level": "", "num_look": 42287, "num_comment": 42287, "author": "kirazhou", "tags": ["资讯"], "text": "当前的解决方案对于已知的Rowhammer变种是有效的，但是攻击的可能性是无穷无尽的，仍然有可能被利用。"}
{"title": "看我如何绕过Windows 10的用户组策略", "url": "https://www.freebuf.com/articles/system/228006.html", "time": "2020-03-12", "level": "", "num_look": 88529, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "在这篇文章中，我们将教大家如何利用Windows系统中的一个功能来绕过Windows 10的用户组策略。"}
{"title": "挖洞经验 | 利用Acunetix发现Google的一个$5000美金XSS漏洞", "url": "https://www.freebuf.com/vuls/228113.html", "time": "2020-03-12", "level": "", "num_look": 136761, "num_comment": 11, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "我和朋友linkks只是稍微勤快和幸运一点，再配合上漏扫利器Acunetix Vulnerability Scanner，就发现了Google的一个XSS漏洞，收获了$5000。"}
{"title": "白帽公开课｜CTF之WEB安全入门 | 冠军选手帮你把CTF知识点各个击破", "url": "https://www.freebuf.com/open/229990.html", "time": "2020-03-12", "level": "红色标题", "num_look": 87734, "num_comment": 1, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "为了让大家更好的了解CTF，找准学习方向，FreeBuf联合XMan特训营，邀请了多位CTF冠军选手讲师，结合近几年比赛中出现的题目和比赛实战经验推出了本套适合CTF新手的匠心课程。"}
{"title": "容器简史：从1979至今的日子", "url": "https://www.freebuf.com/articles/network/229004.html", "time": "2020-03-12", "level": "", "num_look": 108114, "num_comment": 2, "author": "青藤云安全", "tags": ["容器安全", "网络安全"], "text": "随着云计算的发展，容器的使用越来越广泛，尤其是近两年，越来越多企业机构都开始采用容器作为新的IT基础设施。"}
{"title": "关保笔记（二）：识别认定", "url": "https://www.freebuf.com/articles/es/228533.html", "time": "2020-03-12", "level": "现金奖励", "num_look": 119986, "num_comment": 4, "author": "宇宸de研究室", "tags": ["企业安全", "标准与合规"], "text": "识别认定作为关保标准要求的第一个环节，要求对组织业务、资产、风险等进行识别和梳理。类似风险评估识别阶段，在这里《要求》也建议参考GB/T 20984的分析方法。"}
{"title": "数据显示：美国只有38％的政府工作人员接受了勒索软件预防培训", "url": "https://www.freebuf.com/articles/network/228903.html", "time": "2020-03-12", "level": "", "num_look": 60960, "num_comment": 1, "author": "Sandra1432", "tags": ["网络安全"], "text": "IBM调查显示，有73％的政府人员担心勒索软件会威胁到全国各地的城市。与自然灾害和恐怖袭击相比，更多人担心对社区的网络攻击。"}
{"title": "FreeBuf早报｜两名参加上月RSA安全会议的人员被检出COVID-19阳性；Windows SMBv3 高危漏洞被公开，但未修复；美官方再次宣布延期华为临时许可", "url": "https://www.freebuf.com/news/230089.html", "time": "2020-03-12", "level": "红色标题", "num_look": 51464, "num_comment": 4, "author": "kirazhou", "tags": ["资讯"], "text": "上月参加旧金山举办的RSA网络安全会议的两名与会人员，已被确诊患上新冠病毒感染导致的呼吸系统疾病。"}
{"title": "自己动手DIY：路由器刷机改造", "url": "https://www.freebuf.com/geek/228825.html", "time": "2020-03-12", "level": "现金奖励", "num_look": 231229, "num_comment": 12, "author": "LEdge1", "tags": ["极客"], "text": "最近小区结束了封闭管理，晚上抽个人少的时间段，去外面跑跑步，毕竟将近一个月没有出去过了。没想到在回家的路上见到了一个大博的路由器。"}
{"title": "从防护角度看一句话木马的发展变形", "url": "https://www.freebuf.com/articles/web/229172.html", "time": "2020-03-12", "level": "", "num_look": 96480, "num_comment": 2, "author": "新华三攻防团队", "tags": ["WEB安全"], "text": "一句话木马用到了一个比较有趣的命令下发思路，即不直接发送命令编码，而是将命令代码直接发送给木马端执行，这样木马端文件会特别小，而由于每条命令需要通过网络传输，数据包会比较大。"}
{"title": "今晚8点 | 国内WAF产品研究报告解读公开课开课", "url": "https://www.freebuf.com/fevents/230057.html", "time": "2020-03-11", "level": "", "num_look": 84834, "num_comment": 84834, "author": "FB独家", "tags": ["活动"], "text": "今天晚上20：00，作为FreeBuf主编、FreeBuf咨询研究经理的鲍弘捷先生，带来主题为《国内WAF产品研究报告解读》的公开课分享。"}
{"title": "CVE-2020-8813：Cacti v1.2.8 中经过身份验证的RCE漏洞分析", "url": "https://www.freebuf.com/vuls/228016.html", "time": "2020-03-11", "level": "", "num_look": 91465, "num_comment": 91465, "author": "Alpha_h4ck", "tags": ["漏洞", "网络安全"], "text": "Cacti是一套基于PHP,MySQL,SNMP及RRDTool开发的网络流量监测图形分析工具。"}
{"title": "Firefox漏洞利用研究（二）", "url": "https://www.freebuf.com/articles/network/227130.html", "time": "2020-03-11", "level": "现金奖励", "num_look": 76453, "num_comment": 2, "author": "Kriston", "tags": ["网络安全"], "text": "在Linux的js shell环境下利用成功了之后，我不禁开始思考，为什么每次都是在Linux环境下拿到一个shell呢？从一个CTF成长为一名真正的黑客还有多少路需要走？"}
{"title": "警惕疫情次生伤害，黑产这波「疫情流量」将决定很多行业的未来", "url": "https://www.freebuf.com/articles/network/229952.html", "time": "2020-03-11", "level": "红色标题", "num_look": 112079, "num_comment": 6, "author": "GEETEST极验", "tags": ["网络安全"], "text": "3月9日，中科院武汉病毒所石正丽主任面对媒体采访表示，出现下个“新”冠状病毒将是大概率事件。"}
{"title": "微软宣布成功破坏已感染了全球900万台PC的Necurs僵尸网络", "url": "https://www.freebuf.com/news/229994.html", "time": "2020-03-11", "level": "", "num_look": 93424, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "微软昨日宣布成功破坏了Necurs恶意软件的僵尸网络，该僵尸网络已感染了全球超过900万台计算机，并劫持了其大部分基础设施。"}
{"title": "抗疫期间，等保工作开展指南", "url": "https://www.freebuf.com/articles/network/229904.html", "time": "2020-03-11", "level": "红色标题", "num_look": 123318, "num_comment": 6, "author": "中国评测网安中心", "tags": ["标准与合规", "网络安全"], "text": "网络安全一直是没有硝烟的战场，这场突如其来的新冠肺炎疫情期间有更多来自外部的攻击和威胁，多部委发布关于涉新冠肺炎疫情的网络安全风险提示。"}
{"title": "网空威胁情报（CTI）日益成熟： 2020年SANS CTI调查结果解读", "url": "https://www.freebuf.com/articles/system/228817.html", "time": "2020-03-11", "level": "", "num_look": 62611, "num_comment": 1, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "2020年2月份，SANS如期公布了《2020 SANS Cyber Threat Intelligence(CTI) Survey》，报告中首先强调了一下CTI的定义。"}
{"title": "企业面临这些网络攻击风险，却很少采取预防措施？", "url": "https://www.freebuf.com/articles/neopoints/229030.html", "time": "2020-03-11", "level": "", "num_look": 133654, "num_comment": 3, "author": "kirazhou", "tags": ["观点"], "text": "尽管企业在移动设备上遭受网络攻击的风险越来越高，但是许多企业并未采取措施来保护他们的智能手机和平板电脑。"}
{"title": "一个错综复杂的网络钓鱼故事：使用聊天机器人来“帮助”受害者", "url": "https://www.freebuf.com/news/229884.html", "time": "2020-03-11", "level": "", "num_look": 41860, "num_comment": 5, "author": "kirazhou", "tags": ["资讯"], "text": "这是一个复杂的网络钓鱼诈骗，攻击者利用“客服”聊天机器人来引导受害者填写各种表格，从而窃取受害者个人信息、信用卡号和银行帐户信息。"}
{"title": "FreeBuf早报｜2345旗下下载站正在传播木马程序；Google 移除伊朗官方的新冠感染跟踪应用；调查发现医院很多设备采用过时操作系统", "url": "https://www.freebuf.com/news/229974.html", "time": "2020-03-11", "level": "红色标题", "num_look": 58079, "num_comment": 6, "author": "shidongqi", "tags": ["资讯"], "text": "当前，正值复工复产时期，新疆警方从近期破获的案件中发现，一些不法分子利用非接触式复工、居家隔离等情景,实施新型电信网络诈骗，导致一些群众遭受不同程度的财产损失。"}
{"title": "代码审计 | SiteServerCMS身份认证机制", "url": "https://www.freebuf.com/vuls/228448.html", "time": "2020-03-11", "level": "现金奖励", "num_look": 89938, "num_comment": 89938, "author": "zrools", "tags": ["WEB安全", "漏洞"], "text": "SiteServerCMS是一款开源免费的企业级CMS系统，功能比较丰富，代码一多起来，难免会有些漏洞产生。"}
{"title": "2019年全国网络安全态势分析报告", "url": "https://www.freebuf.com/articles/network/229025.html", "time": "2020-03-11", "level": "", "num_look": 96469, "num_comment": 1, "author": "安恒风暴中心", "tags": ["网络安全"], "text": "安全数据大脑针对2019年全国WEB站点的安全态势进行分析，对全国网站进行梳理，整体安全态势要点如下。"}
{"title": "DLLPasswordFilterImplant：一款功能带有提取功能的DLL密码过滤器", "url": "https://www.freebuf.com/articles/system/228126.html", "time": "2020-03-10", "level": "", "num_look": 64684, "num_comment": 64684, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "DLLPasswordFilterImplant是一个自定义的密码过滤器DLL，它可以帮助广大安全研究人员捕捉目标用户的凭证信息。"}
{"title": "疫情之下，组织如何做好应对准备", "url": "https://www.freebuf.com/articles/es/229617.html", "time": "2020-03-10", "level": "红色标题", "num_look": 152160, "num_comment": 2, "author": "宇宸de研究室", "tags": ["企业安全"], "text": "无论是否准备好，多数新冠病毒应急计划都需要远程工作。抓住机会支持你的策略，并为未来的工作场所和员工需求做好准备。"}
{"title": "研究揭露AMD处理器存在漏洞，可致两种新型侧信道攻击", "url": "https://www.freebuf.com/news/229866.html", "time": "2020-03-10", "level": "", "num_look": 45494, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "根据最新发布的研究，从2011年至2019年，AMD处理器一直存在以前从未公开的漏洞，这些漏洞使它们容易受到两种新型的侧信道攻击。"}
{"title": "2019年第四季度DDoS攻击报告", "url": "https://www.freebuf.com/articles/network/227290.html", "time": "2020-03-10", "level": "", "num_look": 67881, "num_comment": 67881, "author": "Kriston", "tags": ["网络安全"], "text": "在过去的一个季度中，DDoS组织者继续利用非标准协议进行放大攻击。在上一次报告中介绍了WS-Discovery之后，犯罪分子转向Apple远程管理服务（ARMS）。"}
{"title": "建立零信任IT环境的5个步骤", "url": "https://www.freebuf.com/articles/network/229265.html", "time": "2020-03-10", "level": "", "num_look": 77064, "num_comment": 2, "author": "Sandra1432", "tags": ["网络安全"], "text": "零信任不是产品或服务，当然也不仅仅是流行语。相反，它是网络安全防御的一种特殊方法。顾名思义，不是“先验证，然后信任”，而是“永远不要信任，永远要验证”。"}
{"title": "2023年，超过40％的隐私合规技术将依赖AI", "url": "https://www.freebuf.com/articles/neopoints/228851.html", "time": "2020-03-10", "level": "", "num_look": 126476, "num_comment": 5, "author": "kirazhou", "tags": ["观点"], "text": "根据Gartner的数据，到2023年，超过40％的隐私合规技术将依赖人工智能（AI），而目前这一比例仅5％。"}
{"title": "FreeBuf早报 | Android安全警告：10亿台设备不再获得更新；把消毒剂称为“神药”？国外这些虚假疫情信息屡禁不止；Debian Linux被列为过去20年漏洞数量最多的操作系统", "url": "https://www.freebuf.com/news/229827.html", "time": "2020-03-10", "level": "红色标题", "num_look": 58813, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "北卡罗来纳州达勒姆市上周末遭受Ryuk勒索软件的网络攻击后，已关闭其网络。"}
{"title": "如何使用Frida绕过Android网络安全配置", "url": "https://www.freebuf.com/vuls/227697.html", "time": "2020-03-09", "level": "", "num_look": 84111, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["漏洞", "系统安全"], "text": "在这篇文章中，我们将演示如何利用Frida脚本来绕过Android的网络安全配置。"}
{"title": "超级产品力系列 | 国内WAF产品研究报告专场公开课即将开课", "url": "https://www.freebuf.com/fevents/229707.html", "time": "2020-03-09", "level": "红色标题", "num_look": 93390, "num_comment": 3, "author": "FB独家", "tags": ["FreeBuf公开课", "活动"], "text": "3月11日-16日，「超级产品力系列 | 国内WAF产品研究报告专场公开课」即将上线。"}
{"title": "用CVE-2019-19781漏洞黑掉一台Citrix设备", "url": "https://www.freebuf.com/vuls/227343.html", "time": "2020-03-09", "level": "", "num_look": 128767, "num_comment": 4, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "去年底，Citrix高危漏洞CVE-2019-19781被披露，158多个国家的8万多家公司网络系统受其影响，面临严重安全风险，漏洞包含目录遍历和远程代码执行。"}
{"title": "美国《间谍法》修订案旨在保护披露政府后门的研究人员", "url": "https://www.freebuf.com/news/229700.html", "time": "2020-03-09", "level": "", "num_look": 50896, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "2020年3月5日，美国众议员Ro Khanna（美国加利福尼亚州）向国会引进了一项新法案，即美国1917年通过的《间谍法》的修订方案，美国参议员Ron Wyden（美国俄勒冈州）很快将其引入参议院。"}
{"title": "从防护角度看Weblogic反序列化历史漏洞", "url": "https://www.freebuf.com/vuls/229140.html", "time": "2020-03-09", "level": "", "num_look": 100782, "num_comment": 2, "author": "新华三攻防团队", "tags": ["WEB安全", "漏洞"], "text": "Weblogic反序列化漏洞是一个经典的漏洞系列，根源在于Weblogic（及其他很多java服务器应用）在通信过程中传输数据对象，涉及到序列化和反序列化操作。"}
{"title": "Apollo框架可行性分析", "url": "https://www.freebuf.com/articles/es/228674.html", "time": "2020-03-09", "level": "现金奖励", "num_look": 113171, "num_comment": 5, "author": "煜阳yuyang", "tags": ["企业安全"], "text": "Apollo（阿波罗）是携程框架部门研发的开源配置管理中心，能够集中化管理应用不同环境、不同集群的配置，配置修改后能够实时推送到应用端，并且具备规范的权限、流程治理等特性。"}
{"title": "该不该给人脸识别热潮“降降温”？", "url": "https://www.freebuf.com/articles/network/228850.html", "time": "2020-03-09", "level": "", "num_look": 73529, "num_comment": 5, "author": "Sandra1432", "tags": ["网络安全"], "text": "人脸识别技术，说起来对于大多数人而言并不陌生，支付宝的刷脸支付、之前一夜爆火的ZAO娱乐APP、各种会议利用刷脸签到的设备等等，人脸识别如今可以说是渗透到人们生活中的方方面面了。"}
{"title": "FreeBuf早报｜CVE-2019-0090漏洞影响过去5年中发布的英特尔芯片；Ryuk勒索软件损害了EVRAZ的北美业务；美国防承包商遭勒索软件攻击，至今未完全复工", "url": "https://www.freebuf.com/news/229636.html", "time": "2020-03-09", "level": "红色标题", "num_look": 73771, "num_comment": 4, "author": "kirazhou", "tags": ["资讯"], "text": "Positive Technologies的安全专家警告，被跟踪为CVE-2019-0090的漏洞影响了过去5年中发布的所有Intel处理器，且该漏洞目前无法修补。"}
{"title": "基于Smali源码的安卓功能捆绑研究", "url": "https://www.freebuf.com/articles/terminal/228180.html", "time": "2020-03-09", "level": "现金奖励", "num_look": 119079, "num_comment": 1, "author": "Kriston", "tags": ["终端安全"], "text": "在日常分析恶意软件过程中发现了很多恶意软件的捆绑方式，例如将两个app放入同一个安装包中同时释放，将一个app绑在另一个的头部释放等等。"}
{"title": "拿起Mac来渗透：恢复凭证", "url": "https://www.freebuf.com/articles/system/228243.html", "time": "2020-03-08", "level": "红色标题", "num_look": 77134, "num_comment": 1, "author": "周大涛", "tags": ["系统安全"], "text": "获取凭证信息是红队的常用套路，因为这些凭证可横向移动的一把好手。网上很多用Windows进行凭据恢复的研究，随着渗透人员经济条件越来越好，各位师傅都换上了Mac。"}
{"title": "5G改变企业威胁模型的4种方式", "url": "https://www.freebuf.com/articles/terminal/229046.html", "time": "2020-03-08", "level": "", "num_look": 118824, "num_comment": 2, "author": "Sandra1432", "tags": ["终端安全"], "text": "随着5G在全球范围内普及，企业组织需要认真考虑部署该技术的安全隐患。"}
{"title": "CVE-2020-0609&CVE-2020-0610：RDG中的两个漏洞分析", "url": "https://www.freebuf.com/articles/network/226962.html", "time": "2020-03-08", "level": "", "num_look": 81998, "num_comment": 81998, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "在2020年1月份的安全更新中，微软修复了RDG中存在的两个漏洞，而这两个漏洞都可以允许攻击者在目标设备上实现预认证远程代码执行。"}
{"title": "远控免杀从入门到实践（8）-shellcode免杀实践", "url": "https://www.freebuf.com/articles/system/228233.html", "time": "2020-03-08", "level": "现金奖励", "num_look": 187493, "num_comment": 6, "author": "雨夜RainyNight", "tags": ["系统安全"], "text": "最近在研究shellcode的免杀技术，因本人以前主要是搞逆向的，shellcode免杀方面还是个小白，所以就想着去看一看我老师任晓珲写的《黑客免杀攻防》想从中寻找一些思路。"}
{"title": "2019全球高级持续性威胁（APT）研究报告", "url": "https://www.freebuf.com/articles/paper/229374.html", "time": "2020-03-08", "level": "", "num_look": 171043, "num_comment": 2, "author": "腾讯电脑管家", "tags": ["安全报告"], "text": "高级可持续性攻击，又称APT攻击，通常由国家背景的相关攻击组织进行攻击的活动。APT攻击常用于国家间的网络攻击行动。"}
{"title": "学习平台“刷分”工具隐藏勒索病毒", "url": "https://www.freebuf.com/news/227988.html", "time": "2020-03-08", "level": "", "num_look": 71442, "num_comment": 2, "author": "360安全", "tags": ["资讯"], "text": "在疫情胶着的特殊时期，全民上下一盘棋，坚持自我隔离解除疫情；而在不能随意外出的日子里，也恰恰是大家学习锻炼、提升自我、补强固弱的大好时机。"}
{"title": "渗透测试专业人员使用的11种工具", "url": "https://www.freebuf.com/sectool/228565.html", "time": "2020-03-08", "level": "", "num_look": 247157, "num_comment": 7, "author": "Sandra1432", "tags": ["工具"], "text": "渗透测试是模拟一种网络攻击，在真正的黑客入侵之前，模拟黑客入侵企业网络来发现薄弱之处。就像电影《Sneakers》一样，黑客顾问闯入公司网络来发现网络的弱点。"}
{"title": "看我如何逆向分析一款可编程接口控制器", "url": "https://www.freebuf.com/articles/terminal/229056.html", "time": "2020-03-08", "level": "", "num_look": 98815, "num_comment": 98815, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "在AeroCTF中，有一类挑战是以分析可编程接口控制器（PIC）为主要内容的。"}
{"title": "CVE-2020-5405 Spring Cloud Config Server 目录穿越", "url": "https://www.freebuf.com/news/232744.html", "time": "2020-03-07", "level": "", "num_look": 16279, "num_comment": 16279, "author": "斗象智能安全平台", "tags": ["资讯"], "text": "Spring Cloud Config为分布式系统的外部配置提供客户端的服务端的支持。使用了它，开发人员就可以在一个中心仓库管理应用程序在所有环境中的外部配置。2020-02-26 Spring 收到漏洞报告, Spring Cloud Config Server…"}
{"title": "如何从内存加载DLL", "url": "https://www.freebuf.com/articles/system/227996.html", "time": "2020-03-07", "level": "红色标题", "num_look": 87906, "num_comment": 3, "author": "周大涛", "tags": ["系统安全"], "text": "本教程介绍了一种技术，该技术可如何从内存中加载动态链接库(DLL)。"}
{"title": "Windows Service Tracing中的权限提升漏洞分析 CVE-2020-0668", "url": "https://www.freebuf.com/vuls/227557.html", "time": "2020-03-07", "level": "", "num_look": 78512, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["漏洞", "系统安全"], "text": "在这篇文章中，我们将讨论Windows Service Tracing中的一个任意文件移动漏洞。在我们的测试过程中，该漏洞将影响从Windows Vista至Windows 10的所有版本操作系统。"}
{"title": "下一只沉默的羔羊是谁？诺崇狮APT组织揭露", "url": "https://www.freebuf.com/articles/network/228800.html", "time": "2020-03-07", "level": "", "num_look": 57613, "num_comment": 57613, "author": "奇安信威胁情报中心", "tags": ["网络安全"], "text": "基于长期的分析整理，本文公开一波持续几年的定向攻击活动及背后的团伙，值得分享到安全社区以增进我们对地缘政治背景下的网络行动的理解。"}
{"title": "你的管理员可信吗？五条构建管理员信任的建议", "url": "https://www.freebuf.com/articles/system/229393.html", "time": "2020-03-07", "level": "", "num_look": 58804, "num_comment": 58804, "author": "Sandra1432", "tags": ["系统安全"], "text": "内部和外部网络管理员拥有访问权限，这可能会导致滥用和错误，从而暴露系统和数据。 这些做法可以帮助避免这种情况。"}
{"title": "远控免杀从入门到实践(7)-代码篇-Golang+Ruby", "url": "https://www.freebuf.com/articles/system/227468.html", "time": "2020-03-07", "level": "现金奖励", "num_look": 498047, "num_comment": 2, "author": "Tide重剑无锋", "tags": ["系统安全"], "text": "用Golang做免杀的不是很多，不过也有一些go写的免杀工具，比如专题21里介绍的HERCULES就是把利用go来嵌入shellcode然后编译exe。"}
{"title": "删库背后，是权限管控的缺失", "url": "https://www.freebuf.com/articles/security-management/229084.html", "time": "2020-03-07", "level": "金币+8", "num_look": 195948, "num_comment": 3, "author": "船长Plus", "tags": ["安全管理"], "text": "这次事件只需要最简单的双人复核就能避免，多一次打扰，少亏12亿。那么为什么最初级的操作也做不到呢？"}
{"title": "近期Win7蓝屏大爆发？详细解读和应对方案", "url": "https://www.freebuf.com/articles/terminal/228256.html", "time": "2020-03-07", "level": "", "num_look": 122636, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "近期，不少客户咨询关于Win7蓝屏大爆发的问题，大概内容指“Win7服役结束，微软不再更新补丁，电脑集体蓝屏，错误代码为F4，蓝屏与漏洞补丁有关联等等。"}
{"title": "BUF大事件丨实锤！涉美CIA攻击组织对我国发起网络攻击；国家互联网信息办公室：禁止网络暴力、人肉搜索", "url": "https://www.freebuf.com/news/229406.html", "time": "2020-03-07", "level": "红色标题", "num_look": 132258, "num_comment": 2, "author": "Darry端", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，实锤！涉美CIA攻击组织对我国发起网络攻击；国家互联网信息办公室：禁止网络暴力、人肉搜索。"}
{"title": "突破PHP函数禁用执行Shell代码分析", "url": "https://www.freebuf.com/vuls/227684.html", "time": "2020-03-07", "level": "金币+8", "num_look": 87739, "num_comment": 87739, "author": "坐忘哪需无心", "tags": ["漏洞", "系统安全"], "text": "本文为yangyangwithgnu师傅的bypass_disablefunc_via_LD_PRELOAD工程代码分析。"}
{"title": "攻击者巧借时机，用有关过期安全证书的虚假警报传播恶意软件", "url": "https://www.freebuf.com/news/229502.html", "time": "2020-03-06", "level": "", "num_look": 41529, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "网络罪犯分子一直在尝试一种新的分发恶意软件的方法：通过含有指向恶意软件的“安装（推荐）”按钮的过期安全证书虚假警报。"}
{"title": "适用于IDA Pro 7的官方VirusTotal插件", "url": "https://www.freebuf.com/articles/network/227977.html", "time": "2020-03-06", "level": "", "num_look": 59430, "num_comment": 59430, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "VirusTotal近期发布了一个针对IDA Pro v7的新型插件，该插件能够直接将VT Intelligence的内容搜索功能直接整合进IDA之中。"}
{"title": "【FreeBuf字幕组】Hacker101白帽进阶之路-文件上传、终止符bug、未经检查重定向", "url": "https://www.freebuf.com/video/229478.html", "time": "2020-03-06", "level": "红色标题", "num_look": 66712, "num_comment": 1, "author": "willhuang", "tags": ["视频"], "text": "本节课程，我们继续来学习Hacker101的视频课程。今天介绍文件上传、终止符bug和未经检查重定向三个漏洞，主要围绕该三个漏洞的成因、漏洞利用和缓解防护等方面来讲解。"}
{"title": "SonicWall SRA产品中的多个漏洞分析", "url": "https://www.freebuf.com/vuls/227308.html", "time": "2020-03-06", "level": "", "num_look": 60380, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["漏洞", "网络安全"], "text": "就在不久之前，安全研究人员Orange Tsai在一些常见的SSL-VPN产品中发现了几个安全漏洞，这些漏洞将允许攻击者通过安全防护设备来入侵目标网络系统。"}
{"title": "精品公开课｜漏洞挖掘组合拳，各大SRC打通关", "url": "https://www.freebuf.com/open/229445.html", "time": "2020-03-06", "level": "", "num_look": 84515, "num_comment": 84515, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "漏洞挖掘的乐趣就在于不断的发掘有趣的利用姿势，挖掘的骚思路主要为大胆尝试，而后靠知识面来利用实现。"}
{"title": "话题讨论 | 听说年前裸辞的翻车了，你的工作受影响了吗？", "url": "https://www.freebuf.com/special/229433.html", "time": "2020-03-06", "level": "红色标题", "num_look": 213037, "num_comment": 8, "author": "FB客服", "tags": ["特别企划"], "text": "身在湖北老家，小编至今还没能返回上海。远程办公都已经满月了，都还没等来一纸「通行令」，再过一个月怕是要等来一封辞退信……"}
{"title": "从防护角度看Thinkphp历史漏洞", "url": "https://www.freebuf.com/vuls/229093.html", "time": "2020-03-06", "level": "", "num_look": 98345, "num_comment": 3, "author": "新华三攻防团队", "tags": ["WEB安全", "漏洞"], "text": "19年初，网上公开了2个Thinkphp5的RCE漏洞，漏洞非常好用，导致有很多攻击者用扫描器进行全网扫描。"}
{"title": "电信巨头T-Mobile数据泄露导致用户个人财务信息曝光", "url": "https://www.freebuf.com/news/229456.html", "time": "2020-03-06", "level": "", "num_look": 54170, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "T-Mobile宣布了一项数据泄露事件，事件起因在于其电子邮件供应商遭到黑客入侵，导致从电子邮件中泄露了一些客户的个人和财务信息。"}
{"title": "移花接木病毒来袭，赌博软件伺机而动", "url": "https://www.freebuf.com/articles/network/228703.html", "time": "2020-03-06", "level": "", "num_look": 72974, "num_comment": 72974, "author": "腾讯手机管家", "tags": ["网络安全"], "text": "移花接木，指暗中使用巧计在事情进行过程中更换人或事物来欺骗别人。"}
{"title": "远控免杀从入门到实践(6)-代码篇-Powershell", "url": "https://www.freebuf.com/articles/system/227467.html", "time": "2020-03-06", "level": "现金奖励", "num_look": 334977, "num_comment": 4, "author": "Tide重剑无锋", "tags": ["系统安全"], "text": "powershell具有在硬盘中易绕过，内存中难查杀的特点。一般在后渗透中，攻击者可以在计算机上执行代码时，会下载powershell脚本来执行，ps1脚本文件无需写入到硬盘中，直接可以在内存中执行。"}
{"title": "Tomcat-Ajp漏洞：我是如何一步步写出POC的？", "url": "https://www.freebuf.com/vuls/228111.html", "time": "2020-03-06", "level": "现金奖励", "num_look": 99851, "num_comment": 2, "author": "MrCoding", "tags": ["漏洞"], "text": "本文主要讲述一个小白如何一步步调试分析，编写poc的过程。"}
{"title": "警惕“驱动人生”无文件挖矿再次更新", "url": "https://www.freebuf.com/articles/terminal/228521.html", "time": "2020-03-06", "level": "", "num_look": 165729, "num_comment": 3, "author": "亚信安全", "tags": ["终端安全"], "text": "近日，“驱动人生”无文件挖矿病毒计划任务再次更新，此次更新中的恶意脚本将会篡改hosts文件指向随机域名。"}
{"title": "FreeBuf早报｜Ryuk勒索软件攻击财富500强公司EMCOR；国泰航空因客户数据泄露被罚款50万英镑；网络安全初创公司Corellium被苹果起诉", "url": "https://www.freebuf.com/news/229429.html", "time": "2020-03-06", "level": "红色标题", "num_look": 103677, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "苹果公司近日就版权侵犯问题起诉网络安全初创公司Corellium，原因是该公司发布了一款能在iPhone手机上安装安卓系统的产品。"}
{"title": "挖洞经验 | 登录注册表单渗透", "url": "https://www.freebuf.com/articles/web/228146.html", "time": "2020-03-06", "level": "现金奖励", "num_look": 192184, "num_comment": 17, "author": "星空111", "tags": ["WEB安全"], "text": "大家在甲方授权的渗透测试中，经常会遇到各种表单：登录、注册、密码修改、密码找回等表单，本技术稿着重介绍关于各种表单的渗透经验，抛砖引玉，欢迎大家交流互动。"}
{"title": "今晚8点开播 | SDN安全架构的最佳实践探索", "url": "https://www.freebuf.com/fevents/229337.html", "time": "2020-03-05", "level": "", "num_look": 74467, "num_comment": 74467, "author": "FB独家", "tags": ["活动"], "text": "3月5日（今晚）晚上20：00，纳通医疗集团的信息安全高级经理肖寒先生，为大家带来主题为《SDN安全架构的最佳实践探索》的分享。"}
{"title": "重磅 | FreeBuf企业安全系列之《2020国内WAF产品研究报告》正式发布", "url": "https://www.freebuf.com/articles/paper/226524.html", "time": "2020-03-05", "level": "红色标题", "num_look": 898507, "num_comment": 24, "author": "FreeBuf咨询", "tags": ["安全报告"], "text": "近年来，针对Web应用的攻击已成为企业面临的主要安全问题之一。而WAF，正是通过执行一系列针对HTTP/HTTPS的安全策略来专门为Web应用提供保护的一款产品。"}
{"title": "构造关联用户搜索的LNK文件研究", "url": "https://www.freebuf.com/articles/system/227976.html", "time": "2020-03-05", "level": "", "num_look": 62547, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "在近期的一次研究过程中，FireEye Mandiant的研究人员遇到了一种能够验证攻击者是否访问目标文件的LNK文件"}
{"title": "不违反法律的情况下，如何从暗网收集威胁情报", "url": "https://www.freebuf.com/news/229317.html", "time": "2020-03-05", "level": "", "num_look": 75054, "num_comment": 6, "author": "kirazhou", "tags": ["资讯"], "text": "威胁情报收集者如果不注意的话，很容易违反美国联邦刑法。"}
{"title": "在IPA中重签名iOS应用程序", "url": "https://www.freebuf.com/articles/system/227306.html", "time": "2020-03-05", "level": "", "num_look": 57517, "num_comment": 57517, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "当我们在对iOS应用程序执行黑盒安全测试时，我们一般只能从AppStore来访问和获取iOS应用程序。但是在大多数情况下，客户都会给我们提供一个IPA文件。"}
{"title": "中国平安人寿招聘安全人才", "url": "https://www.freebuf.com/jobs/229041.html", "time": "2020-03-05", "level": "", "num_look": 55653, "num_comment": 2, "author": "风若新", "tags": ["安全招聘"], "text": "中国平安人寿保险股份有限公司成立于2002年，是中国平安保险（集团）股份有限公司旗下的重要成员。"}
{"title": "远控免杀从入门到实践(5)-代码篇-Python", "url": "https://www.freebuf.com/articles/system/227466.html", "time": "2020-03-05", "level": "现金奖励", "num_look": 340804, "num_comment": 7, "author": "Tide重剑无锋", "tags": ["系统安全"], "text": "由于python使用比较简单方便，所以现在很多免杀都是使用python来对shellcode进行处理，做一些加密、混淆，用python来实现各种加密也比较简单而且免杀效果相对不错。"}
{"title": "FreeBuf早报｜Citrix漏洞可用于潜在的国防部招聘数据库访问；朝鲜APT Kimsuky 对南韩发起了攻击；Nemty勒索软件运营商启动其数据泄漏网站", "url": "https://www.freebuf.com/news/229260.html", "time": "2020-03-05", "level": "红色标题", "num_look": 55278, "num_comment": 6, "author": "kirazhou", "tags": ["资讯"], "text": "澳大利亚信号局（ASD）透露，圣诞节期间披露的Citrix漏洞可能已被恶意攻击者用来访问澳大利亚国防部招聘数据库。"}
{"title": "Anubis新的网络钓鱼活动", "url": "https://www.freebuf.com/articles/terminal/228102.html", "time": "2020-03-05", "level": "", "num_look": 95886, "num_comment": 4, "author": "暗影安全实验室", "tags": ["终端安全"], "text": "自从2018年7月首次撰写有关Anbuis的文章以来，Anubis的恶意下载程序的新版本会定期出现在GooglePlay市场和第三方应用程序商店中。"}
{"title": "个人金融信息漫游指南：《个人金融信息保护技术规范》解读", "url": "https://www.freebuf.com/articles/network/228353.html", "time": "2020-03-05", "level": "金币+8", "num_look": 69571, "num_comment": 1, "author": "acstar", "tags": ["标准与合规", "网络安全"], "text": "虽然个人信息在我国《民法典（草案）》中被放置于“人格权编”部分，通常会认为个人信息是一类具有财产属性的人格权，会体现一定的经济利益。"}
{"title": "从防护角度看Struts2历史漏洞", "url": "https://www.freebuf.com/vuls/229080.html", "time": "2020-03-04", "level": "", "num_look": 105881, "num_comment": 3, "author": "新华三攻防团队", "tags": ["WEB安全", "漏洞"], "text": "Struts2漏洞是一个经典的漏洞系列，根源在于Struts2引入了OGNL表达式使得框架具有灵活的动态性。"}
{"title": "提取Chrome中Cookie工具分享", "url": "https://www.freebuf.com/sectool/227149.html", "time": "2020-03-04", "level": "", "num_look": 436045, "num_comment": 1, "author": "周大涛", "tags": ["工具", "极客"], "text": "这个工具将从Google Chrome浏览器中提取Cookie，是一个.NET程序集，可以在C2中通过工具如PoshC2使用或CobaltStrike的命令。"}
{"title": "安全从业者该去甲方还是乙方", "url": "https://www.freebuf.com/articles/es/228621.html", "time": "2020-03-04", "level": "现金奖励", "num_look": 321891, "num_comment": 40, "author": "softgirl", "tags": ["企业安全"], "text": "最近有很多安全从业者咨询我，去甲方做安全好还是去乙方做安全好，尤其是应届生或工作1-3年的安全从业者。"}
{"title": "今晚8点不见不散｜零信任架构远程办公实战免费公开课", "url": "https://www.freebuf.com/fevents/229182.html", "time": "2020-03-04", "level": "", "num_look": 71988, "num_comment": 71988, "author": "FB独家", "tags": ["活动"], "text": "3月4日（周三）晚上20：00，FreeBuf 企业安全线上沙龙抗疫系列专场第二期——「坚守·抵御」第二节课程准时开课。"}
{"title": "创建你的RedTeam基础架构", "url": "https://www.freebuf.com/geek/227377.html", "time": "2020-03-04", "level": "", "num_look": 181218, "num_comment": 1, "author": "周大涛", "tags": ["极客"], "text": "随着RedTeaming行业的发展，我们对构建可靠环境的需求也越来越高。至关重要的是要拥有维护健壮的基础架构的能力。"}
{"title": "永安在线联合FreeBuf发布《业务安全蓝军测评标准白皮书》", "url": "https://www.freebuf.com/articles/paper/229052.html", "time": "2020-03-04", "level": "", "num_look": 141475, "num_comment": 1, "author": "永安在线", "tags": ["安全报告"], "text": "与基础安全的严防死打不同，业务安全的目标通常不是杜绝攻击，而是将攻击流量的占比控制在可接受的范围内，平衡攻击损失与业务盈利间的关系，保证业务收益的最大化。"}
{"title": "Fastjson JtaTransactionConfig远程代码执行漏洞", "url": "https://www.freebuf.com/vuls/229168.html", "time": "2020-03-04", "level": "", "num_look": 45792, "num_comment": 45792, "author": "深信服千里目安全实验室", "tags": ["WEB安全", "漏洞"], "text": "fastjson是一个Java语言编写的高性能功能完善的JSON库。它采用一种“假定有序快速匹配”的算法，把JSON Parse的性能提升到极致，是目前Java语言中最快的JSON库。"}
{"title": "由于漏洞，Let's Encrypt将从今天起撤销近300万个TLS证书", "url": "https://www.freebuf.com/news/229128.html", "time": "2020-03-04", "level": "", "num_look": 81414, "num_comment": 1, "author": "kirazhou", "tags": ["资讯"], "text": "建议相关用户尽快更换受影响的证书，否则网站访客会看到一个与证书失效有关的安全警告。"}
{"title": "远控免杀从入门到实践（4）：代码篇-C#", "url": "https://www.freebuf.com/articles/system/227464.html", "time": "2020-03-04", "level": "现金奖励", "num_look": 212303, "num_comment": 4, "author": "Tide重剑无锋", "tags": ["系统安全"], "text": "使用C#加载shellcode也是比较常见的一种免杀方式，比如之前文章里的zirikatu、veil、AVIator、SpookFlare等工具都可以对C#代码进行免杀处理。"}
{"title": "QQ邮箱从Self-XSS到钓鱼攻击分析（多漏洞利用攻击链）", "url": "https://www.freebuf.com/vuls/228042.html", "time": "2020-03-04", "level": "现金奖励", "num_look": 152649, "num_comment": 19, "author": "꧁", "tags": ["WEB安全", "漏洞"], "text": "疫情在家闲着无聊准备挖洞提src换点钱买个新电脑，对着TX的域名一顿操作，奈何太菜只在QQ邮箱发现一个存储型self-xss。"}
{"title": "新型攻击方法SurferingAttack以超声波入侵手机", "url": "https://www.freebuf.com/news/229043.html", "time": "2020-03-04", "level": "", "num_look": 49434, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "研究人员发现了一种新的攻击方法，可以通过在固体材料中传播超声波来入侵声控设备，从而在受害者不知情的情况下使用他人听不见的声控命令与声控设备连接并进行破坏。"}
{"title": "云原生之容器安全实践", "url": "https://www.freebuf.com/articles/others-articles/228615.html", "time": "2020-03-04", "level": "", "num_look": 82788, "num_comment": 2, "author": "美团点评安全应急响应中心", "tags": ["其他", "容器安全"], "text": "笔者主要负责美团内部操作系统安全、云原生安全、重大高危漏洞应急响应。"}
{"title": "披露美国中央情报局CIA攻击组织对中国关键领域长达十一年的网络渗透攻击", "url": "https://www.freebuf.com/articles/network/229066.html", "time": "2020-03-04", "level": "红色标题", "num_look": 282150, "num_comment": 17, "author": "国际安全智库", "tags": ["网络安全"], "text": "记载历史时刻，全球首家实锤！涉美CIA攻击组织对我国发起网络攻击。"}
{"title": "Qakbot恶意行为检测", "url": "https://www.freebuf.com/articles/network/228047.html", "time": "2020-03-04", "level": "", "num_look": 63897, "num_comment": 2, "author": "Kriston", "tags": ["网络安全"], "text": "Qakbot是一款窃取敏感信息的恶意软件，也被称为Qbot。该恶意软件家族已经活跃了多年，本文利用Wireshark分析Qakbot恶意流量数据包。了解分析这些流量模式对于检测和调查Qakbot至关重要。"}
{"title": "FreeBuf早报｜侵犯用户数据隐私，美国运营商或面临超2亿美元罚款；研究发现 Brave 浏览器收集的数据最少；Have I Been Pwned 将继续独立运营", "url": "https://www.freebuf.com/news/229112.html", "time": "2020-03-04", "level": "红色标题", "num_look": 55004, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": "一位曾预测2008年住房危机和经济衰退的经济学家现在预测，2020年将是全球第一次全面网络战的年份。"}
{"title": "今晚8点开课｜麒麟框架-不是虚拟机的虚拟机免费公开课", "url": "https://www.freebuf.com/fevents/228882.html", "time": "2020-03-03", "level": "", "num_look": 78735, "num_comment": 2, "author": "FB独家", "tags": ["活动"], "text": "3月3日（今天）晚上20：00，来自京东安全牧者实验室负责人Kaijern Lau、麒麟二进制框架维护者kabeor，为大家带来主题为《麒麟框架-不是虚拟机的虚拟机》的分享。"}
{"title": "Hades开源白盒审计系统V1.0.0", "url": "https://www.freebuf.com/sectool/228762.html", "time": "2020-03-03", "level": "红色标题", "num_look": 249951, "num_comment": 16, "author": "默安科技_影武者实验室", "tags": ["工具"], "text": "凭借自己对语言的理解，以及编码能力，自己构造出一个像样的白盒审计系统，所以便有了Hades这个白盒审计系统的项目。"}
{"title": "精品公开课｜如何在Windows系统下进行二进制安全学习", "url": "https://www.freebuf.com/open/228826.html", "time": "2020-03-03", "level": "", "num_look": 65831, "num_comment": 65831, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "虽然市面上已经有了许多的经典书籍可以让二进制安全爱好者们来学习。但是似乎没有人提出一条清晰有效的学习路线，避免初学者误入歧途。这也就是这个课程诞生的目的。"}
{"title": "挖洞经验 | Facebook接口存在的三个信息泄露漏洞", "url": "https://www.freebuf.com/vuls/227287.html", "time": "2020-03-03", "level": "", "num_look": 86899, "num_comment": 2, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本篇Writeup分享的是作者在测试Facebook接口时，发现的三个信息泄露漏洞，可获取任意Facebook应用的管理员账号、开发者联系人邮箱、商务用户账号ID。"}
{"title": "快讯｜Gitee遭受DDoS攻击，官方建议不要在hosts里绑定IP地址", "url": "https://www.freebuf.com/news/228942.html", "time": "2020-03-03", "level": "红色标题", "num_look": 56393, "num_comment": 3, "author": "百里不守约", "tags": ["资讯"], "text": "3月2日，国内代码托管平台Gitee发布消息称，近期遭受疯狂的DDoS攻击。由于部署了高防产品，具备一定的防御DDoS攻击能力，对于大多数用户并没有收到影响。"}
{"title": "杭州孝道科技诚聘安全人才", "url": "https://www.freebuf.com/jobs/122754.html", "time": "2020-03-03", "level": "", "num_look": 229994, "num_comment": 33, "author": "hz_qiufang", "tags": ["安全招聘"], "text": "杭州孝道科技有限公司是一家国家高新技术企业，公司一直围绕以”业务和数据为核心”，以”不是需要更多的安全软件、而是需要更安全的软件“和”未知攻、焉知防，攻防结合”为发展理念。"}
{"title": "远控免杀从入门到实践(3)-代码篇-C/C++", "url": "https://www.freebuf.com/articles/system/227463.html", "time": "2020-03-03", "level": "现金奖励", "num_look": 480253, "num_comment": 8, "author": "Tide重剑无锋", "tags": ["系统安全"], "text": "在此之前对各种常见免杀工具进行了介绍，也可以从中了解很多免杀工具的原理，很多都是使用msfvenom生成shellcode，然后对shellcode进行混淆、编码等各种处理，最终再使用各种语言进行编译或加载。"}
{"title": "盒子线上梦想趴｜等到春暖花开时，盒子带你去撒欢", "url": "https://www.freebuf.com/fevents/228939.html", "time": "2020-03-03", "level": "", "num_look": 35151, "num_comment": 35151, "author": "漏洞盒子", "tags": ["活动"], "text": "境外游、三亚双人行、双人国内周边游、双人迪士尼...等战胜疫情，想去哪里，你说了算！"}
{"title": "从RSAC看DevSecOps的进化与落地思考", "url": "https://www.freebuf.com/articles/neopoints/228886.html", "time": "2020-03-03", "level": "", "num_look": 267530, "num_comment": 267530, "author": "悬镜安全实验室", "tags": ["观点"], "text": "如何把安全无缝柔和地集成到敏捷和DevOps开发中，就是DevSecOps重点关注的方向。总的来说，文化、技术和流程的协同在DevSecOps的落地实践中扮演着重要的角色。"}
{"title": "浅谈甲方企业信息安全建设的方法论", "url": "https://www.freebuf.com/articles/es/228582.html", "time": "2020-03-03", "level": "金币+20", "num_look": 155414, "num_comment": 2, "author": "shengl99", "tags": ["企业安全"], "text": "从目前了解的情况来看，甲方安全团队规模在一个企业内部的人员占比还是非常低的，在企业安全建设中，大部分安全措施的落地都是由系统、业务和开发团队来实施。"}
{"title": "先斩后奏：一个靠入侵社交账号打商业广告的黑客组织", "url": "https://www.freebuf.com/articles/system/227749.html", "time": "2020-03-03", "level": "", "num_look": 70814, "num_comment": 5, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "Hi, we are OurMine.——这一句话一旦出现在一个大V推特账号推文时，就意味着他的账号被黑了。"}
{"title": "Pwn In Kernel（一）：基础知识", "url": "https://www.freebuf.com/articles/system/227357.html", "time": "2020-03-03", "level": "金币+20", "num_look": 75891, "num_comment": 2, "author": "Mask6asok", "tags": ["系统安全"], "text": "简单分析一下CTF Kernel Pwn题目的形式，以2017 CISCN babydrive为例子，先对文件包解压，得到boot.sh，bzImage，rootfs.cpio三个文件。"}
{"title": "FreeBuf早报 | 美政府限制华为新办法的会议被延期至3月11日；委内瑞拉大规模停电导致部分网络中断；全国公共交通乘客信息采集系统正式上线", "url": "https://www.freebuf.com/news/228928.html", "time": "2020-03-03", "level": "红色标题", "num_look": 49284, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "据路透社报道，美国政府原定于28日举行的以限制外国将具有美国技术的产品销售给华为的会议延期到3月11日举行。"}
{"title": "全年观测：增长的利润意味着更多的勒索软件攻击", "url": "https://www.freebuf.com/news/228222.html", "time": "2020-03-03", "level": "", "num_look": 26715, "num_comment": 1, "author": "kirazhou", "tags": ["资讯"], "text": "各个组织正在更快地检测和遏制攻击，全球停留时间中位数（即网络入侵开始到被识别之间的持续时间）已缩短为56天。"}
{"title": "IPv6Tools：一款模块化的IPv6安全审计框架", "url": "https://www.freebuf.com/articles/network/226953.html", "time": "2020-03-02", "level": "", "num_look": 61189, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "IPv6Tools是一款功能健壮的IPv6功能审计框架，该框架以模块化架构实现，并且集成了大量功能模块和插件来帮助用户对启用了IPv6的网络进行安全审计。"}
{"title": "挖洞经验 | 跨站Websocket Hijacking漏洞导致的Facebook账号劫持", "url": "https://www.freebuf.com/vuls/227050.html", "time": "2020-03-02", "level": "", "num_look": 78474, "num_comment": 2, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "作者在测试Facebook的近期推出的某个新应用中，存在跨站Websocket Hijacking漏洞，可实现对目标受害者的Facebook账号劫持。"}
{"title": "业务稳定性迁移实验", "url": "https://www.freebuf.com/articles/es/228354.html", "time": "2020-03-02", "level": "现金奖励", "num_look": 109040, "num_comment": 1, "author": "煜阳yuyang", "tags": ["企业安全"], "text": "在业务安全中，不仅仅要考虑业务是否有被攻击的可能，同时也要考虑整个业务的稳定性。"}
{"title": "全球高级持续性威胁（APT）2019年报告", "url": "https://www.freebuf.com/articles/system/227159.html", "time": "2020-03-02", "level": "", "num_look": 91684, "num_comment": 5, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "过去的一年，在网络威胁（Cyber Threat）领域度过了颇为不平静的一年。网络威胁和攻击似乎更为广泛的应用于地缘政治和军事冲突之下，其作为除了军事打击之外更为有效的手段。"}
{"title": "FreeBuf早报 | 美国立法禁用华为设备，斥资10亿美元补助小型电信运营商；《网络信息内容生态治理规定》3月1日施行；OnlyFans回应大量视频泄露：未遭到黑客攻击", "url": "https://www.freebuf.com/news/228788.html", "time": "2020-03-02", "level": "红色标题", "num_look": 49434, "num_comment": 6, "author": "kirazhou", "tags": ["资讯"], "text": "美国参议院于2月28日批准了一项立案，该立案将禁止使用联邦资金从“被视为存在国家安全威胁的公司”（例如中国华为）购买电信设备。"}
{"title": "免费开源软件的潜在安全风险", "url": "https://www.freebuf.com/articles/network/227686.html", "time": "2020-03-02", "level": "", "num_look": 61452, "num_comment": 2, "author": "Sandra1432", "tags": ["网络安全"], "text": "Linux Foundation和Harvard的研究得出结论，不安全的开发人员账号，旧版软件和非标准的命名方案是免费开源软件的主要问题。"}
{"title": "Citrix Gateway/ADC 远程代码执行漏洞分析", "url": "https://www.freebuf.com/news/232752.html", "time": "2020-03-01", "level": "", "num_look": 20264, "num_comment": 20264, "author": "斗象智能安全平台", "tags": ["资讯"], "text": "Citrix NetScaler 是优化Web 应用交付的综合解决方案。作为特定用途设备，NetScaler 可将Web 应用交付加速5倍或更多，同时保护Web应用不受如今最危险的安全威胁的攻击。"}
{"title": "Fugu：首个基于Checkm8漏洞的iOS设备开源越狱工具", "url": "https://www.freebuf.com/articles/system/226954.html", "time": "2020-03-01", "level": "", "num_look": 66307, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "Fugu是目前第一款开源的针对Checkm8漏洞的越狱工具。"}
{"title": "扩大Android攻击面：React Native Android应用程序分析", "url": "https://www.freebuf.com/articles/terminal/226947.html", "time": "2020-03-01", "level": "", "num_look": 109286, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "React Native是一款移动端应用程序框架，由于该框架允许开发人员使用React和原生平台功能，目前有很多Android和iOS应用程序都是基于该框架进行开发的。"}
{"title": "Weblogic IIOP反序列化漏洞(CVE-2020-2551) 漏洞分析", "url": "https://www.freebuf.com/vuls/227920.html", "time": "2020-03-01", "level": "", "num_look": 144872, "num_comment": 1, "author": "WebRAY", "tags": ["漏洞", "网络安全"], "text": "Oracle官方发布2020年1月关键补丁更新公告CPU（CriticalPatch Update），其中CVE-2020-2551的漏洞，漏洞等级为高危，CVVS评分为9.8分，漏洞利用难度低。"}
{"title": "由于压力和倦怠，CISO的平均任期仅为26个月", "url": "https://www.freebuf.com/articles/neopoints/227222.html", "time": "2020-03-01", "level": "红色标题", "num_look": 119065, "num_comment": 2, "author": "kirazhou", "tags": ["观点"], "text": "绝大多数受访的CISO高管（88％）表示压力很大，其中三分之一由于压力引发了身体健康问题，一半导致精神健康问题。"}
{"title": "Ctftool：一款功能强大的交互式CTF漏洞利用工具", "url": "https://www.freebuf.com/sectool/227330.html", "time": "2020-02-29", "level": "", "num_look": 144048, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具", "系统安全"], "text": "Ctftool是一款交互式的命令行工具，可以帮助安全研究人员对CTF（Windows平台下用于实现文本服务的协议）进行安全测试。"}
{"title": "BUF大事件丨微盟员工删库跑路，公司市值暴跌10亿；迪卡侬数据库泄露1.23亿员工的数据；RSAC 2020于旧金山举行", "url": "https://www.freebuf.com/news/228737.html", "time": "2020-02-29", "level": "红色标题", "num_look": 105836, "num_comment": 105836, "author": "willhuang", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，微盟员工删库跑路，公司市值暴跌10亿；迪卡侬数据库泄露了1.23亿员工的数据；RSAC 2020于旧金山举行，大会主题：Human Elements。"}
{"title": "F-Secure Internet Gatekeeper中的堆溢出漏洞分析", "url": "https://www.freebuf.com/vuls/226687.html", "time": "2020-02-29", "level": "", "num_look": 96497, "num_comment": 96497, "author": "Alpha_h4ck", "tags": ["漏洞", "终端安全"], "text": "在这篇文章中，我们将对F-Secure Internet Gatekeeper应用程序中的一个堆溢出漏洞进行解析，并介绍为何一个简单的错误就导致了一个可利用的未认证远程代码执行漏洞存在。"}
{"title": "RSAC 2020正在进行时，FreeBuf图文直播带你“亲临”现场！", "url": "https://www.freebuf.com/news/topnews/228018.html", "time": "2020-02-29", "level": "红色标题", "num_look": 180605, "num_comment": 8, "author": "Sandra1432", "tags": ["头条"], "text": "RSA 2020这场全球性安全盛会将于美国当地时间2月24日8点（北京时间2月25日0点）在旧金山正式开幕。会议时间长达5天，从2月24日至28日。"}
{"title": "详解64位静态编译程序的fini_array劫持及ROP攻击", "url": "https://www.freebuf.com/articles/system/226003.html", "time": "2020-02-29", "level": "现金奖励", "num_look": 75764, "num_comment": 1, "author": "taqini", "tags": ["系统安全"], "text": "用gdb调试main函数的时候，不难发现main的返回地址是__libc_start_main也就是说main并不是程序真正开始的地方，__libc_start_main是main的爸爸。"}
{"title": "逻辑漏洞小结之SRC篇", "url": "https://www.freebuf.com/articles/web/225770.html", "time": "2020-02-29", "level": "现金奖励", "num_look": 176639, "num_comment": 16, "author": "听闻他叫无剧", "tags": ["WEB安全"], "text": "最近在挖各大src，主要以逻辑漏洞为主，想着总结一下我所知道的一些逻辑漏洞分享一下以及举部分实际的案例展示一下，方便大家理解。"}
{"title": "CVE-2020-0646：SharePoint中的远程代码执行漏洞分析", "url": "https://www.freebuf.com/vuls/226717.html", "time": "2020-02-28", "level": "", "num_look": 84087, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["漏洞", "系统安全"], "text": "2019年11月份，安全研究人员在微软SharePoint Online的工作流中发现了一个代码注入漏洞，并将其上报给微软公司。"}
{"title": "FBI透露，近六年里支付给勒索攻击者的赎金超过1.4亿美金", "url": "https://www.freebuf.com/news/228665.html", "time": "2020-02-28", "level": "", "num_look": 66349, "num_comment": 2, "author": "百里不守约", "tags": ["资讯"], "text": "在本周的RSA 2020会议上，FBI特别探员Joel DeCapua分享了关于勒索软件相关的话题。FBI通过私人分享或者VirusTotal等渠道收集比特币钱包和赎金记录，来统计近六年来受害者支付了多少赎金。"}
{"title": "手把手教你如何将学校饭卡复制到小米手环NFC版上", "url": "https://www.freebuf.com/geek/227717.html", "time": "2020-02-28", "level": "现金奖励", "num_look": 714373, "num_comment": 18, "author": "一个假的CPU", "tags": ["极客"], "text": "NFC是Near Field Communication缩写，即近距离无线通讯技术。由飞利浦公司和索尼公司共同开发的NFC是一种非接触式识别和互联技术。"}
{"title": "OpenBSD SMTP漏洞分析报告", "url": "https://www.freebuf.com/vuls/228494.html", "time": "2020-02-28", "level": "", "num_look": 93315, "num_comment": 1, "author": "Kriston", "tags": ["漏洞"], "text": "安全人员在OpenBSD SMTP中发现了一个存在长达4年的漏洞，攻击者可利用该漏洞远程执行代码，多个linux发行版本受到影响。"}
{"title": "2020年仍然有效的一些XSS Payload", "url": "https://www.freebuf.com/articles/web/226719.html", "time": "2020-02-28", "level": "", "num_look": 130208, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "很多的XSS Cheat Sheet都是直接从其他地方粗制粘贴过来的，而且有的测试用例早在十年前就已经没用了，但是也没人去整理和清理。"}
{"title": "“冠状病毒”引发的移动安全事件", "url": "https://www.freebuf.com/articles/terminal/227337.html", "time": "2020-02-28", "level": "", "num_look": 108929, "num_comment": 1, "author": "暗影安全实验室", "tags": ["终端安全"], "text": "武汉冠状病毒爆发及蔓延引发人们对全球公共卫生危机的广泛担忧，威胁行为者利用人类的恐惧情感——尤其是当一个全球性事件已经造成了恐惧和恐慌的时候进行网络犯罪。"}
{"title": "FreeBuf早报 | 思科正在努力修补新的Kr00k WiFi漏洞；FCC开始收集美国网络中的华为通讯设备使用数据；印度BGR的SQL数据库在黑客论坛上共享", "url": "https://www.freebuf.com/news/228632.html", "time": "2020-02-28", "level": "红色标题", "num_look": 44918, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "据外媒报道，美国联邦通信委员会(FCC)目前正在收集使用华为和中兴网络设备的美国运营商的数据。"}
{"title": "HackerOne去年发放超过8200万美元的赏金，联邦政府参与度大幅上涨", "url": "https://www.freebuf.com/news/228590.html", "time": "2020-02-27", "level": "", "num_look": 57808, "num_comment": 57808, "author": "Sandra1432", "tags": ["资讯"], "text": "2019年，由黑客驱动的漏洞赏金平台HackerOne支付的漏洞奖金几乎是前几年总和的两倍，达到8200万美元。"}
{"title": "微盟删库事故启示录", "url": "https://www.freebuf.com/news/228514.html", "time": "2020-02-27", "level": "红色标题", "num_look": 187933, "num_comment": 16, "author": "shidongqi", "tags": ["资讯"], "text": "近期热议的微盟系统故障事件，想必大部分人都已经有所关注。截止2月26日中午，微盟官网仍然挂着公告，表示数据还在修复过程中。"}
{"title": "RSA大会的唇枪舌战：美国华为禁令背后的供应链安全探讨", "url": "https://www.freebuf.com/news/228547.html", "time": "2020-02-27", "level": "红色标题", "num_look": 60123, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "在一场小组会议中，华为高管CSO Andy Purdy和美国国防部官员Katie Arrington同台谈论关于华为技术是否为政府继续使用的问题。"}
{"title": "能听听你们的声音吗？｜特殊时期的网络安全调研", "url": "https://www.freebuf.com/fevents/228061.html", "time": "2020-02-27", "level": "", "num_look": 56348, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "FreeBuf 特推出一份疫期特殊时期调查问卷，诚挚邀请每一位bufer、厂商、甲方参与。"}
{"title": "Obfuscapk：一款针对Android应用程序的黑盒混淆工具", "url": "https://www.freebuf.com/sectool/226391.html", "time": "2020-02-27", "level": "", "num_look": 114621, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具", "终端安全"], "text": "Obfuscapk是一款模块化的Python工具，它可以帮助研究人员在无需应用程序源代码的情况下对Android App进行混淆处理。"}
{"title": "疫情期间处理勒索病毒的收获", "url": "https://www.freebuf.com/articles/system/226654.html", "time": "2020-02-27", "level": "现金奖励", "num_look": 209025, "num_comment": 209025, "author": "绿帽子技术分享", "tags": ["企业安全", "数据安全"], "text": "大家都明白新变种的病毒，很少有现成解密方式，本文会以某中招5ss5c勒索事件处理为例展开。"}
{"title": "挖洞经验 | Snapchat不当输入验证漏洞导致的任意构造短信发送", "url": "https://www.freebuf.com/vuls/227092.html", "time": "2020-02-27", "level": "", "num_look": 77012, "num_comment": 2, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "今天分享的这篇Writeup是关于Snapchat网站的不当输入验证漏洞。"}
{"title": "数据泄露暴露了Clearview AI的客户列表，大多为美国执法部门", "url": "https://www.freebuf.com/news/228501.html", "time": "2020-02-27", "level": "", "num_look": 62658, "num_comment": 4, "author": "kirazhou", "tags": ["资讯"], "text": "Clearview AI，一家面部识别创业公司，今年早些时候被揭露为美国数百家执法机构所使用，因采集用户图片数据，还接二连三遭互联网巨头（Google，Facebook和Microsoft）“封杀”，据悉，已遭受数据泄露。"}
{"title": "渗透痕迹分析随笔", "url": "https://www.freebuf.com/articles/others-articles/226423.html", "time": "2020-02-27", "level": "现金奖励", "num_look": 117693, "num_comment": 117693, "author": "freebuf01", "tags": ["其他", "系统安全"], "text": "网上，关于入侵痕迹分析的文章很多，在此将个人工作中常用的一些方法技巧(班门弄斧了)，以及爬过的坑总结如下（当然，其中有些方法也是从各位前辈的经验中学习的）。"}
{"title": "勒索软件运营商正在公开“羞辱”未支付赎金的受害者，并发布窃取的文件", "url": "https://www.freebuf.com/news/228410.html", "time": "2020-02-27", "level": "", "num_look": 56271, "num_comment": 5, "author": "kirazhou", "tags": ["资讯"], "text": "DoppelPaymer勒索软件的运营商启动了一个站点，他们将使用该站点用来羞辱那些不支付赎金的受害者，并发布在加密受害者计算机之前盗取的所有文件。"}
{"title": "SecOps团队在了解安全工具的运作时面临挑战", "url": "https://www.freebuf.com/articles/system/227678.html", "time": "2020-02-27", "level": "", "num_look": 54024, "num_comment": 3, "author": "Sandra1432", "tags": ["系统安全"], "text": "根据Keysight最新发布的报告，目前安全专业人员对自己所用的安全工具过于自信。然而，有50％的人却表示自己遇到过安全漏洞，因为他们的在用安全产品没有发挥应有的作用。"}
{"title": "FreeBuf早报 | 迪卡侬数据库泄露了1.23亿员工的数据；微软承认KB4532693更新包含错误，并提供恢复个人资料的新方案；新的Emotet攻击活动利用了COVID-19", "url": "https://www.freebuf.com/news/228459.html", "time": "2020-02-27", "level": "红色标题", "num_look": 65183, "num_comment": 4, "author": "kirazhou", "tags": ["资讯"], "text": "专家发现了一个泄漏的数据库，其中有超过1.23亿条记录属于迪卡侬西班牙（可能还有迪卡侬英国）。"}
{"title": "等保测评2.0：MySQL身份鉴别（上）", "url": "https://www.freebuf.com/articles/database/227336.html", "time": "2020-02-27", "level": "现金奖励", "num_look": 186174, "num_comment": 3, "author": "起于凡而非于凡", "tags": ["数据安全", "标准与合规"], "text": "本篇文章主要说一下MySQL数据中身份鉴别控制点中a测评项的相关知识点和理解。"}
{"title": "Pytm：一款Python风格的威胁建模框架", "url": "https://www.freebuf.com/sectool/226951.html", "time": "2020-02-26", "level": "", "num_look": 129987, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Pytm是一款Python风格的威胁建模框架，它可以帮助我们以Python语言风格的形式并使用pytm框架中的元素和属性来定义你的系统。"}
{"title": "RSA 2020大会隆重开幕：RSA总裁Rohit Ghai谈如何改变安全叙事", "url": "https://www.freebuf.com/news/228371.html", "time": "2020-02-26", "level": "红色标题", "num_look": 40113, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "美国当地时间2月25日8点（北京时间2月26日0点），RSA 2020大会隆重开幕，著名演员George Takei围绕主题“Human Element”为大会作了开场白。"}
{"title": "精品公开课｜漏洞挖掘神器训练营", "url": "https://www.freebuf.com/fevents/228343.html", "time": "2020-02-26", "level": "", "num_look": 84721, "num_comment": 2, "author": "FB客服", "tags": ["活动"], "text": "针对网络安全爱好者、网络安全初学者的学习需求，邀请了国内多位技术大佬、优秀讲师，甄选出九大精华专题，打造了这套匠心课程：《漏洞挖掘神器训练营》。"}
{"title": "KBOT研究报告", "url": "https://www.freebuf.com/articles/network/226952.html", "time": "2020-02-26", "level": "", "num_look": 53009, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "KBOT能够通过Internet或本地网络或受感染的外部媒介攻击用户计算机。"}
{"title": "Pikachu靶场系列之XSS钓鱼攻击与PHP中的HTTP认证", "url": "https://www.freebuf.com/articles/web/226365.html", "time": "2020-02-26", "level": "金币+8", "num_look": 75037, "num_comment": 6, "author": "FengSec", "tags": ["WEB安全"], "text": "最近在Pikachu靶场中复现钓鱼攻击时，最后一步Basic认证后数据无法发送到后台，而是一直重复弹出认证提示框。经过一番折腾后终于发现了原因并解决。"}
{"title": "FreeBuf｜欧盟要求员工放弃使用WhatsApp和Messenger；英国金融监管机构承认泄露消费者机密数据；谷歌在主动攻击下修补Chrome的0day漏洞", "url": "https://www.freebuf.com/news/228299.html", "time": "2020-02-26", "level": "红色标题", "num_look": 50167, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "谷歌发布了一个Chrome更新程序，以解决三个安全漏洞，其中包括一个零日漏洞，该漏洞正在被积极利用。"}
{"title": "疫情下个人数据安全和工作机制的思考", "url": "https://www.freebuf.com/articles/security-management/227625.html", "time": "2020-02-26", "level": "现金奖励", "num_look": 237716, "num_comment": 6, "author": "blsnjun", "tags": ["安全管理"], "text": "2019年12月武汉爆发了“新冠”病毒引发的疫情，病毒引起发烧、咳嗽等症状，具备“人传人”可能且暂无特效药，有人因此丢掉生命。"}
{"title": "免费报名｜疫情环境影响下的企业内部安全建设系列公开课，下周二见！", "url": "https://www.freebuf.com/open/228217.html", "time": "2020-02-25", "level": "", "num_look": 58625, "num_comment": 1, "author": "FB独家", "tags": ["FreeBuf公开课"], "text": "3月3日（周二）开始，FreeBuf 联手京东安全、完美世界、纳通医疗集团，带来「坚守抵御 · 疫情环境影响下的企业内部安全建设」 系列公开课。"}
{"title": "RSAC 2020：最热门的36款网络安全产品", "url": "https://www.freebuf.com/news/228255.html", "time": "2020-02-25", "level": "", "num_look": 103245, "num_comment": 1, "author": "默安科技", "tags": ["资讯"], "text": "RSAC 2020第一天，国外安全媒体CSO ONLINE即根据现场发布的新产品评选出了36款今年最热门的安全产品。"}
{"title": "Dufflebag：一款针对亚马逊EBS弹性块存储服务的安全检测工具", "url": "https://www.freebuf.com/sectool/226681.html", "time": "2020-02-25", "level": "", "num_look": 90384, "num_comment": 90384, "author": "Alpha_h4ck", "tags": ["工具", "网络安全"], "text": "Dufflebag可以帮助研究人员搜索公共EBS弹性块存储服务中的敏感信息，使用它之后，你可能找到很多遗留在EBS卷里的密码以及其他敏感数据。"}
{"title": "RSAC 2020创新沙盒冠军正式揭晓！SECURITI.ai解决隐私合规问题", "url": "https://www.freebuf.com/news/228197.html", "time": "2020-02-25", "level": "红色标题", "num_look": 55670, "num_comment": 5, "author": "Sandra1432", "tags": ["资讯"], "text": "美国当地时间2月24日，备受瞩目的全球盛会RSA 2020在旧金山正式开幕。在当天下午，这个被称为“网络安全风向标”的创新沙盒环节正式揭晓决赛冠军,SECURITI.ai拔得头筹。"}
{"title": "Github敏感数据分析", "url": "https://www.freebuf.com/articles/network/226672.html", "time": "2020-02-25", "level": "", "num_look": 99901, "num_comment": 3, "author": "Kriston", "tags": ["网络安全"], "text": "很少有数据存储库可以比GitHub更广泛地应用于代码开发生产，然而，正如老话所说的“速度越快，风险越大”。"}
{"title": "阿里云联合FreeBuf发布《2019年Web应用安全年度报告》", "url": "https://www.freebuf.com/articles/paper/228128.html", "time": "2020-02-25", "level": "红色标题", "num_look": 219838, "num_comment": 1, "author": "阿里云安全", "tags": ["安全报告"], "text": "2019年 Web应用安全威胁不断升级，从用户信息泄露到羊毛党的狂欢，无时无刻不在考验着每一个行业每一个Web应用的安全水位。"}
{"title": "XSS扫描器成长记", "url": "https://www.freebuf.com/articles/web/227275.html", "time": "2020-02-25", "level": "", "num_look": 118001, "num_comment": 5, "author": "知道创宇404实验室", "tags": ["WEB安全"], "text": "为了实现自动刷SRC的目标，过年前就开始对w13scan的xss扫描功能进行优化，灵感注入xray所引起的基于语义的扫描技术。"}
{"title": "FreeBuf早报 | Windows 10获取临时补丁，已在更新后修复关键漏洞；蚂蚁金服员工录屏从钉钉获取8万条个人信息被开除；Safari将停止信任过期时间超过13个月的证书", "url": "https://www.freebuf.com/news/228137.html", "time": "2020-02-25", "level": "红色标题", "num_look": 59847, "num_comment": 5, "author": "Sandra1432", "tags": ["资讯"], "text": "据外媒报道，莫斯科公共交通运营商上周指示，如果中国公民上了他们的公共汽车，司机应迅速将相关信息告知调度员，由调度员负责报警。"}
{"title": "网络安全成为上游石油和天然气公司数字投资的重点", "url": "https://www.freebuf.com/articles/network/227606.html", "time": "2020-02-25", "level": "", "num_look": 55717, "num_comment": 4, "author": "kirazhou", "tags": ["网络安全"], "text": "当被问及组织在投资哪种数字技术时，61％的受访者都在谈论网络安全，这个比例是2017年（12%）的5倍。"}
{"title": "360作为国内7家展商之一，精彩亮相RSAC 2020", "url": "https://www.freebuf.com/fevents/228331.html", "time": "2020-02-25", "level": "", "num_look": 51231, "num_comment": 51231, "author": "360安全", "tags": ["活动"], "text": "美国时间2月24日至28日，RSAC 2020在旧金山拉开帷幕。作为网络安全行业风向标，本届大会主题为“Human Element”，象征着人在未来安全行业发展中将发挥不可或缺的作用。"}
{"title": "Apache AJP 协议 CVE-2020-1938 漏洞分析", "url": "https://www.freebuf.com/vuls/228108.html", "time": "2020-02-24", "level": "红色标题", "num_look": 134354, "num_comment": 8, "author": "平安银行应用安全团队", "tags": ["WEB安全", "漏洞"], "text": "最近CVE-2020-1938炒的比较热闹，前几天比较忙，今天抽空跟了一下这个漏洞，时间线上肯定比别的大佬晚很多了，所以就选择从环境搭建开始写的详细一点。"}
{"title": "TAS：一款轻量级tty修改与代码伪造框架", "url": "https://www.freebuf.com/articles/network/226575.html", "time": "2020-02-24", "level": "", "num_look": 59311, "num_comment": 59311, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "TAS是一款轻量级框架，在它的帮助下，研究人员可以轻松修改tty并创建伪造的代码。"}
{"title": "稿费双倍+精美礼品｜庆贺斗象科技完成数亿元C轮融资", "url": "https://www.freebuf.com/fevents/228053.html", "time": "2020-02-24", "level": "红色标题", "num_look": 83972, "num_comment": 23, "author": "FB客服", "tags": ["活动"], "text": "斗象科技近日宣布完成C轮数亿元融资，由钟鼎资本领投，同创伟业、惠友资本、云栖创投、线性资本跟投，致远资本担任本轮独立融资财务顾问。"}
{"title": "Firefox漏洞利用研究（一）", "url": "https://www.freebuf.com/vuls/226853.html", "time": "2020-02-24", "level": "现金奖励", "num_look": 92983, "num_comment": 1, "author": "Kriston", "tags": ["漏洞"], "text": "SpiderMonkey是目前Firefox浏览器中使用的JavaScript引擎，负责浏览器当中所有的JavaScript语句的解析执行，同时也是第一个JavaScript引擎。"}
{"title": "Deniz Kizi(美人鱼)打响2020年全球勒索病毒攻击的第一战", "url": "https://www.freebuf.com/articles/terminal/227331.html", "time": "2020-02-24", "level": "", "num_look": 109355, "num_comment": 3, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "全球几乎每天都有被勒索病毒攻击的新闻被曝光，勒索病毒攻击成为了2019年网络安全的最大威胁之一。"}
{"title": "亚信安全2019-2020威胁情报态势分析线上发布会报名开启", "url": "https://www.freebuf.com/fevents/227718.html", "time": "2020-02-24", "level": "", "num_look": 125698, "num_comment": 3, "author": "FB独家", "tags": ["活动"], "text": "“亚信安全2019-2020 威胁情报态势分析” 线上发布会将于2月24日晚上20：00举行。"}
{"title": "FreeBuf早报｜谷歌下架近600款安卓应用；一名加州男子因政治动机的DDoS被捕；美国国防信息系统局披露数据泄露事件", "url": "https://www.freebuf.com/news/228011.html", "time": "2020-02-24", "level": "红色标题", "num_look": 56020, "num_comment": 4, "author": "shidongqi", "tags": ["资讯"], "text": "一家负责向美国政府提供信息技术和通信支持的美国国防机构表示，其网络可能已经“受损”。美国国防信息系统局(DISA)本月初向可能的受害者致信，警告该机构运行的系统涉及“数据泄露”。"}
{"title": "初识《关键信息基础设施网络安全保护基本要求》：基于等保，高于等保", "url": "https://www.freebuf.com/articles/security-management/227378.html", "time": "2020-02-24", "level": "现金奖励", "num_look": 889543, "num_comment": 6, "author": "宇宸de研究室", "tags": ["安全管理", "标准与合规"], "text": "等保2.0刚刚实施不久，接踵而来的是《关键信息基础设施网络安全保护基本要求》。当前网络安全无论是技术还是国家战略，都需要我们持续关注并加强管理力度。"}
{"title": "精品公开课｜CobaltStrike基础到进阶", "url": "https://www.freebuf.com/open/227850.html", "time": "2020-02-23", "level": "", "num_look": 83413, "num_comment": 3, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "本课程将带同学们学习Cobaltstrike的使用方法，分享Cobaltstrike在渗透测试中实用的一些功能，包括端口扫描&截图&浏览器代理、横向移动与控制持久化、会话互转与网站克隆等，一起探寻此款神兵利器的强大！"}
{"title": "Hershell：一款功能强大的跨平台反向Shell生成器", "url": "https://www.freebuf.com/articles/network/226491.html", "time": "2020-02-23", "level": "", "num_look": 76947, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "Hershell是一款功能强大的跨平台反向Shell生成器，该工具使用Go语言开发，基于TCP反向Shell实现其功能。"}
{"title": "Google Play恶意软件分析", "url": "https://www.freebuf.com/articles/network/226808.html", "time": "2020-02-23", "level": "", "num_look": 64983, "num_comment": 2, "author": "Kriston", "tags": ["网络安全"], "text": "根据分析，3000个恶意软件变体或恶意有效负载会下载到设备上，伪装成设备启动程序或程序列表上不显示图标的系统程序。"}
{"title": "美司法部起诉中国“网络攻击”，故事开头要从Struts漏洞说起", "url": "https://www.freebuf.com/news/226955.html", "time": "2020-02-23", "level": "现金奖励", "num_look": 672028, "num_comment": 3, "author": "DD想上学了", "tags": ["资讯"], "text": "当地时间2月10日，美国司法部宣布对中国军方的4名军人提起诉讼，理由是他们相互串谋侵入Equifax公司的计算机网络，并对这些计算机进行未经授权的访问，并窃取了大约1.45亿美国受害者的敏感个人身份信息。"}
{"title": "如何编写一个Android inline hook框架", "url": "https://www.freebuf.com/articles/terminal/224917.html", "time": "2020-02-23", "level": "现金奖励", "num_look": 83662, "num_comment": 2, "author": "fixthing", "tags": ["其他", "终端安全"], "text": "想写一个让大多数人更容易使用、了解实现细节、能更容易参与开发完善的Android inline hook项目。"}
{"title": "ApplicationInspector：一款功能强大的软件源代码分析与审计工具", "url": "https://www.freebuf.com/sectool/226392.html", "time": "2020-02-22", "level": "", "num_look": 136384, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "ApplicationInspector是一款功能强大的软件源代码分析与审计工具，它可以帮助研究人员识别和发现目标应用程序中的公众周知的功能以及源代码中有意思的特性，并清楚目标应用的本质特征以及实现的功能。"}
{"title": "如何分析和解密已加密的路由器固件", "url": "https://www.freebuf.com/articles/terminal/226696.html", "time": "2020-02-22", "level": "", "num_look": 101598, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "我们直奔主题！现在，查看你的路由器品牌及型号信息，然后去对应厂商的官方网站下载你路由器对应的固件。"}
{"title": "BUF大事件丨伪造3D头像成功骗过支付宝人脸认证；米高梅酒店1060万客人信息被公布", "url": "https://www.freebuf.com/news/227891.html", "time": "2020-02-22", "level": "红色标题", "num_look": 148359, "num_comment": 2, "author": "Darry端", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，4人非法购买公民个人信息伪造3D头像成功骗过支付宝人脸认证；1060多万名米高梅酒店客人信息被泄露；Face ID遭遇Bug 导致iPhone解锁后出现鬼影键盘。"}
{"title": "用ModSecurity启动WAF的一次小试", "url": "https://www.freebuf.com/articles/web/227217.html", "time": "2020-02-22", "level": "", "num_look": 90232, "num_comment": 90232, "author": "Sandra1432", "tags": ["WEB安全"], "text": "在CfgMgmtCamp期间，我参加了FranziskaBühler（@bufrasch）主题为《WAF——您的DevOps pipeline的朋友》的演讲。她谈到了WAF和OWASP的核心规则集（CRS）。"}
{"title": "Vulhub漏洞靶场搭建", "url": "https://www.freebuf.com/sectool/226207.html", "time": "2020-02-22", "level": "金币+20", "num_look": 244011, "num_comment": 4, "author": "FengSec", "tags": ["WEB安全", "工具"], "text": "Vulhub是一个面向大众的开源漏洞靶场，无需docker知识，简单执行两条命令即可编译、运行一个完整的漏洞靶场镜像。"}
{"title": "已满半岁，「FreeBuf+」小程序更好用了", "url": "https://www.freebuf.com/news/227924.html", "time": "2020-02-21", "level": "红色标题", "num_look": 56381, "num_comment": 2, "author": "FB客服", "tags": ["资讯"], "text": "从最初的测试版到现在已经逐渐做出了不少的改变，尽管产品计划列表中还有一系列任务待完成，但目前「FreeBuf+」小程序早已具备很强的可用性。"}
{"title": "RSAC 2020：“Human Element”主题永不过时的三个原因", "url": "https://www.freebuf.com/articles/network/227934.html", "time": "2020-02-21", "level": "红色标题", "num_look": 96558, "num_comment": 96558, "author": "Sandra1432", "tags": ["网络安全"], "text": "RSA这场重大的安全盛会开幕在即，不知道大家是否已敲定了自己的2020年RSA会议行程？今年的大会主题是“Human Element”，为网络安全注入人的元素和价值。"}
{"title": "初识MonkeyDev", "url": "https://www.freebuf.com/sectool/226310.html", "time": "2020-02-21", "level": "现金奖励", "num_look": 131586, "num_comment": 5, "author": "tales", "tags": ["工具"], "text": "过年在家无聊，原本打算装个抢红包插件发笔小横财，却掉进了很多坑，折腾损失了不少(时间和精力)红包。顺便学习了下猴神MonkeyDev的使用。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列：Zhi Wei Eugene", "url": "https://www.freebuf.com/video/227827.html", "time": "2020-02-21", "level": "红色标题", "num_look": 120416, "num_comment": 2, "author": "willhuang", "tags": ["视频"], "text": "Zhi Wei Eugene，24岁新加坡人，2018年毕业于耶鲁大学计算机系和历史系，现服役于新加坡武装部队通信指挥连，拥有OSWE和高级React认证"}
{"title": "比特币市值波动刺激挖矿木马活跃，腾讯安全发布2019年度挖矿木马报告", "url": "https://www.freebuf.com/articles/paper/227657.html", "time": "2020-02-21", "level": "", "num_look": 189998, "num_comment": 189998, "author": "腾讯电脑管家", "tags": ["安全报告"], "text": "2019年8月，国家发布支持深圳建设中国特色社会主义先行示范区的意见，其中提到，支持在深圳开展数字货币研究与移动支付等创新应用。"}
{"title": "xHunt利用科威特政府网站攻击分析", "url": "https://www.freebuf.com/articles/network/226630.html", "time": "2020-02-21", "level": "", "num_look": 53442, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "在对xHunt攻击活动分析中，发现一个科威特组织的网页被用作水坑攻击。该网页包含一个隐藏图像，其与xHunt攻击活动使用的域名相关联。"}
{"title": "精品公开课｜从零开始Burpsuite渗透之旅", "url": "https://www.freebuf.com/open/227671.html", "time": "2020-02-21", "level": "", "num_look": 79320, "num_comment": 5, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "Burpsuite是用于攻击web 应用程序的集成平台，包含了许多工具。Burpsuite为这些工具设计了许多接口，以加快攻击应用程序的过程。"}
{"title": "跟谁学（美股上市公司）招聘各类安全工程师", "url": "https://www.freebuf.com/jobs/225324.html", "time": "2020-02-21", "level": "", "num_look": 68140, "num_comment": 4, "author": "我要吸得你喵喵叫", "tags": ["安全招聘"], "text": "百家互联是一家中国领先的互联网教育科技公司，2014年6月由陈向东带领创建， 团队成员主要由来自新东方等著名教育培训机构及百度、阿里、腾讯等互联网公司的精英组成。"}
{"title": "央行发布《个人金融信息保护技术规范》，无资质不得收集手机号等信息", "url": "https://www.freebuf.com/news/227879.html", "time": "2020-02-21", "level": "红色标题", "num_look": 97502, "num_comment": 2, "author": "Sandra1432", "tags": ["标准与合规", "资讯"], "text": "近日，全国金融标准化技术委员会发布了《个人金融信息保护技术规范》。《规范》适用于提供金融产品和服务的金融业机构，并为安全评估机构开展安全检查与评估工作提供参考。"}
{"title": "远控免杀从入门到实践（2）工具总结篇", "url": "https://www.freebuf.com/articles/system/227462.html", "time": "2020-02-21", "level": "现金奖励", "num_look": 532821, "num_comment": 13, "author": "Tide重剑无锋", "tags": ["系统安全"], "text": "在了解了免杀的一些基础知识和 Metasploit 自带的一些免杀方式之后，我开始学习和研究市面上知名度比较高的免杀工具，从互联网上筛选出来了 21 个工具进行免杀测试和学习。"}
{"title": "2020年企业吸引网络人才的5个技巧", "url": "https://www.freebuf.com/articles/network/226864.html", "time": "2020-02-21", "level": "", "num_look": 58681, "num_comment": 5, "author": "Sandra1432", "tags": ["网络安全"], "text": "网络安全行业正面临招聘危机。目前，虽然该领域的专业人员达280万，但是随着不断扩张的网络安全市场和愈发严峻的网络安全形势，这个数字远远不够。"}
{"title": "FreeBuf早报｜美英正式指责俄罗斯大规模毁损格鲁吉亚网站；Apache Tomcat 文件包含漏洞；1060多万名米高梅酒店客人信息被公布在黑客论坛上", "url": "https://www.freebuf.com/news/227870.html", "time": "2020-02-21", "level": "红色标题", "num_look": 51758, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "美国和英国政府发表官方声明，正式指责俄罗斯军事情报机构GRU在2019年10月对格鲁吉亚数千个网站进行了协同网络攻击。"}
{"title": "安全人员的代码水平", "url": "https://www.freebuf.com/articles/neopoints/226755.html", "time": "2020-02-21", "level": "现金奖励", "num_look": 180067, "num_comment": 15, "author": "virusdefender", "tags": ["观点"], "text": "Citrix 官方放了一个 CVE-2019-19781 – Verification Tool，是一个 Python 脚本，链接在 https://support.citrix.com/article/CTX269180。"}
{"title": "Check-LocalAdminHash：一款基于PowerShell的本地管理员识别工具", "url": "https://www.freebuf.com/sectool/226492.html", "time": "2020-02-20", "level": "", "num_look": 91098, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Check-LocalAdminHash是一款基于PowerShell开发的工具，它可以尝试通过WMI或SMB来对多台主机进行身份验证，并通过密码哈希来判断用户提供的凭证是否属于本地管理员账户。"}
{"title": "戴尔以20.75亿美元将RSA出售给私募股权公司", "url": "https://www.freebuf.com/news/227769.html", "time": "2020-02-20", "level": "红色标题", "num_look": 47632, "num_comment": 5, "author": "Sandra1432", "tags": ["资讯"], "text": "戴尔公司周二宣布，已同意将其子公司RSA出售给私募股权公司Symphony Technology Group（STG），交易总价超过20亿美元。"}
{"title": "如何实时查看MISP实例的威胁情报信息", "url": "https://www.freebuf.com/articles/network/226685.html", "time": "2020-02-20", "level": "", "num_look": 69282, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "在这篇文章中，将会给大家介绍如何利用Misp-Dashboard实时查看来自MISP实例的威胁情报信息。"}
{"title": "平安科技招聘安全防护和检测方向高级资深工程师", "url": "https://www.freebuf.com/jobs/227747.html", "time": "2020-02-20", "level": "", "num_look": 66538, "num_comment": 3, "author": "女娲", "tags": ["安全招聘"], "text": "中国平安是中国第一家股份制企业，至今已经发展成为金融保险、银行、投资三大主营业务为一体，核心金融与互联网金融业务为一体、并行发展的个人金融生活服务集团之一。"}
{"title": "注册模块上线前安全测试checklist", "url": "https://www.freebuf.com/articles/web/226526.html", "time": "2020-02-20", "level": "现金奖励", "num_look": 80075, "num_comment": 3, "author": "freebuf01", "tags": ["WEB安全"], "text": "系统上线前，有必要对注册模块进行重点测试。"}
{"title": "FreeBuf早报｜美国CISA警告：勒索软件攻击影响管道运营；安全专家说黑客可以在5天之内入侵俄罗斯银行；亚马逊首名员工：公司收集用户信息让我感到恐惧", "url": "https://www.freebuf.com/news/227701.html", "time": "2020-02-20", "level": "红色标题", "num_look": 57258, "num_comment": 5, "author": "kirazhou", "tags": ["资讯"], "text": "网络安全与基础设施安全局（CISA）向美国所有关键基础设施领域的组织发出了警报——有关最近一次影响天然气压缩设施的勒索软件攻击。"}
{"title": "2020年的网络安全：从安全代码到深度防御", "url": "https://www.freebuf.com/articles/network/227162.html", "time": "2020-02-20", "level": "", "num_look": 68889, "num_comment": 3, "author": "Sandra1432", "tags": ["网络安全"], "text": "自2014年以来，信息管理协会的权威调查IT趋势研究数据显示，CIO在面对IT管理问题时，已经将网络安全提升至数一数二的位置了。"}
{"title": "AgentSmith-HIDS：一套轻量级高性能的基于主机的入侵检测系统（HIDS）", "url": "https://www.freebuf.com/articles/system/226496.html", "time": "2020-02-19", "level": "", "num_look": 81051, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "从技术角度来说，AgentSmith-HIDS严格意义上来说并不是一个传统的“基于主机的入侵检测系统”（HIDS），因为就该项目目前开源的部分来说，它还缺少了规则引擎以及相关的检测能力。但是它可以作为一个高性能的主机信息…"}
{"title": "纵观RSAC历年来主题的变化与发展", "url": "https://www.freebuf.com/articles/network/227562.html", "time": "2020-02-19", "level": "红色标题", "num_look": 83666, "num_comment": 2, "author": "Sandra1432", "tags": ["网络安全"], "text": "RSAC 2020即将到来，在今年的2月24日至28日在美国旧金山隆重举办，作为网络安全行业风向标，从1991年至今，RSA大会已经走过29个年头。"}
{"title": "Vlunstack ATT&CK实战系列0x1", "url": "https://www.freebuf.com/articles/web/226497.html", "time": "2020-02-19", "level": "现金奖励", "num_look": 107390, "num_comment": 6, "author": "Hackhy", "tags": ["WEB安全"], "text": "这个靶场是红日安全团队的一个靶场项目~ 非常好，方便了我这类懒得搭建域（不会）的人。"}
{"title": "深圳华为公司招聘网络安全高端人才", "url": "https://www.freebuf.com/jobs/222767.html", "time": "2020-02-19", "level": "", "num_look": 102621, "num_comment": 102621, "author": "nishis", "tags": ["安全招聘"], "text": "深圳华为公司大量招聘网络安全高端人才，要求安全工作经验5年及以上（技术厉害的可适当放宽），本科学历，有英语四六级证，具体岗位可参考如下。"}
{"title": "硬蹭热点？黑产控制药物研究机构邮箱搞钓鱼", "url": "https://www.freebuf.com/articles/system/226746.html", "time": "2020-02-19", "level": "", "num_look": 75236, "num_comment": 5, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "面对目前严峻的疫情形势，许多境内外黑客组织和网络犯罪团伙有了自己的小心思，纷纷发起了“国难财”，从普通黑产到国家级组织不一而足。"}
{"title": "AWS Transit Gateway实践与使用场景的思考", "url": "https://www.freebuf.com/articles/network/226889.html", "time": "2020-02-19", "level": "金币+8", "num_look": 59533, "num_comment": 2, "author": "ZhiXian", "tags": ["网络安全"], "text": "AWS Transit Gateway可以将用户的 AmazonVirtual Private Clouds (VPC) 和本地网络连接到一个网关。随着 AWS 上运行的工作负载数量不断增加，必须能够跨多个账户和 Amazon VPC 扩展您的网络，才能跟上发展步伐。"}
{"title": "FreeBuf早报｜NSA的Python培训手册被公开；美用情报共享威胁德国禁用华为；谷歌确认再次下架间谍消息应用ToTok", "url": "https://www.freebuf.com/news/227568.html", "time": "2020-02-19", "level": "红色标题", "num_look": 53384, "num_comment": 5, "author": "shidongqi", "tags": ["资讯"], "text": "美国驻德国大使格雷内尔16日表示，总统特朗普明确指示他“任何选择使用不值得信任的5G供应商的国家”都有危及与美国共享情报和信息的风险。"}
{"title": "工信部：部署做好疫情防控期间信息通信行业网络安全保障工作", "url": "https://www.freebuf.com/news/227534.html", "time": "2020-02-18", "level": "红色标题", "num_look": 64656, "num_comment": 3, "author": "Sandra1432", "tags": ["标准与合规", "资讯"], "text": "工业和信息化部发文要求各相关单位重点做好保障重点地区重点用户网络系统安全、加强信息安全和网络数据保护、进一步强化责任落实和工作协同等三方面工作。"}
{"title": "国外红队常用的21种资源", "url": "https://www.freebuf.com/geek/226811.html", "time": "2020-02-18", "level": "红色标题", "num_look": 253591, "num_comment": 6, "author": "周大涛", "tags": ["极客"], "text": "本文介绍了国外关于红队技巧的博客，Twitter，网站。"}
{"title": "Nfstream：一款易于扩展的网络数据分析框架", "url": "https://www.freebuf.com/sectool/226570.html", "time": "2020-02-18", "level": "", "num_look": 102178, "num_comment": 102178, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Nfstream本质上来说是一款Python包，它可以提供快速、灵活且有效的数据结构，支持针对在线或离线状态的网络数据进行分析，这种方式既简单又直观。"}
{"title": "伊朗黑客入侵VPN服务器，意图在世界各地的公司植入后门", "url": "https://www.freebuf.com/news/227508.html", "time": "2020-02-18", "level": "", "num_look": 96354, "num_comment": 5, "author": "kirazhou", "tags": ["资讯"], "text": "伊朗黑客已将Pulse Secure、Fortinet、Palo Alto Networks和Citrix VPN定位为入侵大型公司的工具。"}
{"title": "远控免杀从入门到实践（1）：基础篇", "url": "https://www.freebuf.com/articles/system/227461.html", "time": "2020-02-18", "level": "现金奖励", "num_look": 325894, "num_comment": 14, "author": "Tide重剑无锋", "tags": ["系统安全"], "text": "从互联网上搜集了大约20款知名度比较高的免杀工具研究免杀原理及免杀效果测试，后面还学习了一下各种语言编译加载shellcode的各种姿势，又补充了一些白名单加载payload的常见利用。"}
{"title": "避免凭证转储攻击的5个技巧", "url": "https://www.freebuf.com/articles/web/226680.html", "time": "2020-02-18", "level": "", "num_look": 56376, "num_comment": 2, "author": "Sandra1432", "tags": ["WEB安全"], "text": "在Windows设备网络上使用这五个技巧，减少企业组织遭受凭证转储攻击的漏洞风险。"}
{"title": "好未来教育集团招聘安全人才", "url": "https://www.freebuf.com/jobs/226627.html", "time": "2020-02-18", "level": "", "num_look": 52564, "num_comment": 52564, "author": "100tal", "tags": ["安全招聘"], "text": "好未来（NYSE：TAL），是一家中国领先的K12教育科技企业，以科技驱动、人才亲密、品质领先为发展的核心目标。"}
{"title": "RSA 2020前瞻：大会主题畅想曲", "url": "https://www.freebuf.com/articles/neopoints/227539.html", "time": "2020-02-18", "level": "", "num_look": 133105, "num_comment": 133105, "author": "绿盟科技", "tags": ["观点"], "text": "2020年RSA大会，吸引着全世界安全的目光。今年大会主题词是“Human Element”（人的要素），重点讨论人与技术的关系。RSA大会连续举办多年，到今年已经是29届。"}
{"title": "WordPress主题插件严重漏洞修复，影响将近20万个网站", "url": "https://www.freebuf.com/news/227490.html", "time": "2020-02-18", "level": "", "num_look": 79937, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "WordPress的ThemeGrill Demo Importer程序的开发人员已更新了该插件，删除一个严重漏洞，该漏洞为未经身份验证的用户提供了管理员特权。"}
{"title": "2019年度勒索病毒专题报告", "url": "https://www.freebuf.com/articles/paper/226835.html", "time": "2020-02-18", "level": "", "num_look": 161174, "num_comment": 4, "author": "腾讯电脑管家", "tags": ["安全报告"], "text": "勒索病毒作为全球最严峻的网络安全威胁之一，2019年持续对全球范围内的医疗、教育、能源、交通等社会基础服务设施，社会支柱产业造成重创。"}
{"title": "FreeBuf早报 | 疫情数据是否泄漏个人隐私？工信部：目前只向部省两级联防联控机制提供分析数据；以色列国防士兵被“性感女郎”诱骗安装恶意软件；思科疑似准备收购网络安全公司FireEye，目前市值35.7亿美元", "url": "https://www.freebuf.com/news/227469.html", "time": "2020-02-18", "level": "红色标题", "num_look": 53388, "num_comment": 4, "author": "Sandra1432", "tags": ["资讯"], "text": "Google Project Zero (GPZ)团队近日向三星发出警告，表示在Galaxy系列手机中修改内核代码的行为将会暴露更多的安全漏洞。"}
{"title": "2020年网络安全支出趋势", "url": "https://www.freebuf.com/articles/network/227362.html", "time": "2020-02-18", "level": "", "num_look": 74607, "num_comment": 5, "author": "Sandra1432", "tags": ["网络安全"], "text": "一年之计在于春，现在有些重要的问题值得引人发问，比如，在2020年企业是否会增加网络安全预算？如果答案是肯定的，那么他们的要求和投资重点又是什么？"}
{"title": "8点开播 | 远程办公千万条，安全保障第一条", "url": "https://www.freebuf.com/fevents/227401.html", "time": "2020-02-17", "level": "红色标题", "num_look": 65435, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "今晚8点，来自安恒信息的首席云安全战略官郑赳，为大家带来主题为《远程办公的困惑与建议》的分享。"}
{"title": "从免费的WEB应用防火墙hihttps谈机器学习之生成对抗规则过程", "url": "https://www.freebuf.com/articles/web/226418.html", "time": "2020-02-17", "level": "现金奖励", "num_look": 90937, "num_comment": 8, "author": "websecurity", "tags": ["WEB安全"], "text": "hihttps是一款免费的web应用防火墙，既支持传统WAF的所有功能如SQL注入、XSS、恶意漏洞扫描、密码暴力破解、CC、DDOS等，又支持无监督机器学习，自主对抗，重新定义web安全。"}
{"title": "360政企安全集团华东区招聘安全人才", "url": "https://www.freebuf.com/jobs/226992.html", "time": "2020-02-17", "level": "", "num_look": 85742, "num_comment": 3, "author": "Hedysx", "tags": ["安全招聘"], "text": "360政企安全，中国企业级网络安全市场的领军者，是专注于为政府和企业提供新一代网络安全产品和服务的综合型集团公司。"}
{"title": "负载均衡有多神密？来研究下ShareWAF的开源负载均衡！", "url": "https://www.freebuf.com/articles/web/226757.html", "time": "2020-02-17", "level": "现金奖励", "num_look": 79377, "num_comment": 6, "author": "w2sfoot", "tags": ["WEB安全"], "text": "hareWAF有一款开源的负载均衡，名为ShareWAF-Blance（后文也简称其为Blance），本文通过解析这款负载均衡工具，来揭开负载均衡的神秘面纱。"}
{"title": "FreeBuf早报｜奥运会、国际奥委会推特账号被黑；匿名组织声称拥有世界领导人和名人的 DNA 样本；美国网络司令部公布朝鲜APT最新样本", "url": "https://www.freebuf.com/news/227349.html", "time": "2020-02-17", "level": "红色标题", "num_look": 54706, "num_comment": 4, "author": "shidongqi", "tags": ["资讯"], "text": "奥运会官方推特账号和国际奥委会(IOC)媒体事务的推特账号被黑客入侵，目前已被暂时锁定。推特公司的发言人在一封电子邮件声明中说，这些账号是通过第三方平台被黑的。"}
{"title": "极客 | 从损坏的手机中获取数据", "url": "https://www.freebuf.com/geek/226538.html", "time": "2020-02-17", "level": "", "num_look": 188704, "num_comment": 3, "author": "kirazhou", "tags": ["极客"], "text": "有时候，犯罪分子会故意损坏手机来破坏数据。比如粉碎、射击手机或是直接扔进水里，但取证专家仍然可以找到手机里的证据。"}
{"title": "网络“生死”战：谈医疗行业的网络安全隐患", "url": "https://www.freebuf.com/articles/neopoints/226820.html", "time": "2020-02-17", "level": "", "num_look": 141118, "num_comment": 3, "author": "kirazhou", "tags": ["观点"], "text": "如果说这次攻击只是网络安全世界的一个小小的缩影，那么，它提醒了我们一个事实：扛起生死的医疗机构，面对网络安全时，却更加脆弱。"}
{"title": "RSA创新沙盒盘点｜Elevate Security——“以人为本”的安全行为改善平台", "url": "https://www.freebuf.com/news/227543.html", "time": "2020-02-17", "level": "", "num_look": 87775, "num_comment": 87775, "author": "绿盟科技", "tags": ["资讯"], "text": "2020年2月24日-28日，网络安全行业盛会RSA Conference将在旧金山拉开帷幕。大会的创新沙盒环节备受瞩目，成为全球网络安全行业技术创新和投资的风向标。"}
{"title": "今晚8点见 | 远程办公受热捧，安全如何从容应对免费公开课报名开启", "url": "https://www.freebuf.com/fevents/227332.html", "time": "2020-02-16", "level": "", "num_look": 59809, "num_comment": 59809, "author": "FB独家", "tags": ["活动"], "text": "今晚8点，来自深信服的移动安全运营总监、资深移动安全专家杨志刚，为大家带来主题为《远程办公受热捧，安全如何从容应对》的分享。"}
{"title": "Qiling：一款功能强大的高级代码模拟框架", "url": "https://www.freebuf.com/articles/terminal/226494.html", "time": "2020-02-16", "level": "", "num_look": 70926, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "Qiling是一款功能强大的高级代码模拟框架，该工具由Unicorn引擎驱动，并且拥有下列功能："}
{"title": "2019年10大网络安全并购交易", "url": "https://www.freebuf.com/articles/network/226469.html", "time": "2020-02-16", "level": "", "num_look": 93550, "num_comment": 1, "author": "Sandra1432", "tags": ["网络安全"], "text": "2019年是网络安全行业并购交易的（M＆A）又一重要年份。根据Momentum Cyber的数据，今年完成了150多次网络交易，总价值超过230亿美元。"}
{"title": "微步在线诚聘木马分析师、病毒分析师、安全研究员等职位！", "url": "https://www.freebuf.com/jobs/220566.html", "time": "2020-02-16", "level": "", "num_look": 60426, "num_comment": 60426, "author": "Threatbook", "tags": ["安全招聘"], "text": "微步在线成立于2015年7月，是专注威胁情报能力输出的安全企业，也是国内下一代安全的代表性公司，提供专业的威胁检测／响应类产品与威胁情报订阅服务。"}
{"title": "亚太地区DDoS防护和WAF市场的一些预测", "url": "https://www.freebuf.com/news/227097.html", "time": "2020-02-16", "level": "", "num_look": 47396, "num_comment": 1, "author": "kirazhou", "tags": ["资讯"], "text": "企业对始终在线、可扩展和无需管理的安全服务的兴趣日益增长。"}
{"title": "BUF大事件丨雅诗兰黛泄露4.4亿数据记录，官方紧急关闭数据库；热门影片免费下载，都是恶意软件陷阱", "url": "https://www.freebuf.com/news/227293.html", "time": "2020-02-16", "level": "红色标题", "num_look": 104170, "num_comment": 104170, "author": "willhuang", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，雅诗兰黛泄露4.4亿数据记录，官方紧急关闭数据库；热门影片免费下载？小心都是恶意软件陷阱；FreeBuf 上线企业安全线上沙龙——抗疫系列专场免费公开课。"}
{"title": "等保测评2.0：SQLServer身份鉴别（下）", "url": "https://www.freebuf.com/articles/database/226485.html", "time": "2020-02-16", "level": "现金奖励", "num_look": 159970, "num_comment": 159970, "author": "起于凡而非于凡", "tags": ["数据安全", "标准与合规"], "text": "本篇文章主要说一说SQLServer数据库中身份鉴别控制点的中c、d测评项相关内容和理解。"}
{"title": "RSA 创新沙盒盘点｜Sqreen——WAF和RASP综合解决方案", "url": "https://www.freebuf.com/news/227547.html", "time": "2020-02-16", "level": "", "num_look": 18341, "num_comment": 18341, "author": "绿盟科技", "tags": ["资讯"], "text": "Sqreen公司是一家来自美国的网络安全初创公司，总部在美国湾区，公司创立于2015年，目前完成三轮融资，最近是A轮融资，累积金额1800万美元。"}
{"title": "第四节8点开课 | 疫情期在线移动办公风潮，如何提升企业安全管理效率", "url": "https://www.freebuf.com/fevents/227296.html", "time": "2020-02-15", "level": "", "num_look": 57440, "num_comment": 57440, "author": "FB独家", "tags": ["活动"], "text": "今晚8点，来自腾讯安全的高级产品经理赖凌华，为大家带来主题为《 疫情期在线移动办公风潮，如何提升企业安全管理效率》。"}
{"title": "Lsassy：如何远程从lsaas中提取用户凭证", "url": "https://www.freebuf.com/sectool/226170.html", "time": "2020-02-15", "level": "", "num_look": 126582, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "我们将跟大家介绍Lsassy这款功能强大的工具，广大研究人员可以利用Lsassy来从目标设备的lsass中远程提取出用户凭证。"}
{"title": "Pikachu漏洞靶场系列之XSS", "url": "https://www.freebuf.com/articles/web/226367.html", "time": "2020-02-15", "level": "金币+8", "num_look": 118704, "num_comment": 8, "author": "FengSec", "tags": ["WEB安全"], "text": "跨站脚本攻击(Cross-Site Scripting)简称为“CSS”，为避免与前端叠成样式表的缩写\"CSS\"冲突，故又称XSS。"}
{"title": "如何应对动态的网络犯罪形势", "url": "https://www.freebuf.com/articles/network/226408.html", "time": "2020-02-15", "level": "", "num_look": 55979, "num_comment": 55979, "author": "kirazhou", "tags": ["网络安全"], "text": "过去5年中，网络安全威胁格局如何演变？eSentire看到了哪些不明显的威胁？"}
{"title": "永安在线（原威胁猎人）招聘安全人才", "url": "https://www.freebuf.com/jobs/227100.html", "time": "2020-02-15", "level": "", "num_look": 46618, "num_comment": 3, "author": "永安在线", "tags": ["安全招聘"], "text": "深圳永安在线科技有限公司是国际领先的反欺诈服务提供商。成立于2017年1月，致力于基于对黑灰产的布控能力，为互联网及金融行业提供反欺诈解决方案，为公安提供网络犯罪打击工具。"}
{"title": "等保测评2.0：Windows安全审计", "url": "https://www.freebuf.com/articles/system/226033.html", "time": "2020-02-15", "level": "现金奖励", "num_look": 96972, "num_comment": 3, "author": "起于凡而非于凡", "tags": ["标准与合规", "系统安全"], "text": "本篇文章主要说一说windows系统中安全审计的控制点的相关内容和理解。"}
{"title": "利用屏幕亮度从非联网计算机中窃取数据", "url": "https://www.freebuf.com/articles/system/226518.html", "time": "2020-02-15", "level": "", "num_look": 68291, "num_comment": 68291, "author": "Sandra1432", "tags": ["系统安全"], "text": "黑客只要简单地改变屏幕亮度就可以从计算机窃取敏感信息，听起来这似乎是一件不可思议的事，然而，却真实存在。"}
{"title": "GDA：一款基于C++的新型Android逆向分析工具", "url": "https://www.freebuf.com/sectool/226185.html", "time": "2020-02-14", "level": "", "num_look": 125594, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具", "系统安全"], "text": "GDA是一款完全基于C++开发的新型反编译工具，因此该工具并不仅依赖于Java平台。该工具使用起来非常方便，而且运行速度非常快，支持APK、DEX、OBED和oat等文件格式。"}
{"title": "今晚8点 | 远程办公下，网络安全“抗疫”指南？免费公开课报名开启", "url": "https://www.freebuf.com/fevents/227233.html", "time": "2020-02-14", "level": "", "num_look": 53337, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "今晚8点，来自亚信安全的资深技术顾问李杰，为大家带来主题为《远程办公下，网络安全“抗疫”指南？》的免费公开课分享。"}
{"title": "如何使用Grouper2来查找活动目录组策略中的漏洞", "url": "https://www.freebuf.com/articles/network/226495.html", "time": "2020-02-14", "level": "", "num_look": 46118, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "Grouper2是一款针对AD组策略安全的渗透测试工具，该工具采用C#开发，在Grouper2的帮助下，渗透测试人员可以轻松在活动目录组策略中查找到安全相关的错误配置。"}
{"title": "USRC特别活动 | 齐心携手战新冠，宅家挖洞双贡献", "url": "https://www.freebuf.com/fevents/227248.html", "time": "2020-02-14", "level": "", "num_look": 41942, "num_comment": 41942, "author": "FB客服", "tags": ["活动"], "text": "银联安全应急响应中心与白帽子共同战疫。"}
{"title": "平安科技招聘高级资深安全工程师", "url": "https://www.freebuf.com/jobs/225177.html", "time": "2020-02-14", "level": "", "num_look": 59919, "num_comment": 1, "author": "艾惠", "tags": ["安全招聘"], "text": "中国平安成立于1988年，是中国第一家股份制企业，至今已经发展成为金融保险、银行、投资三大主营业务为一体，核心金融与互联网金融业务为一体、并行发展的个人金融生活服务集团之一。"}
{"title": "工信部网络安全管理局：关于涉新冠肺炎疫情的网络安全风险提示", "url": "https://www.freebuf.com/news/227209.html", "time": "2020-02-14", "level": "", "num_look": 58131, "num_comment": 1, "author": "kirazhou", "tags": ["标准与合规", "资讯"], "text": "近期，工业和信息化部网络安全威胁信息共享平台收到网络安全企业及机构报告，发现多起利用新冠肺炎疫情实施网络攻击的行为。"}
{"title": "FreeBuf早报 | 注意！工信部发布涉新冠肺炎疫情的网络安全风险提示；捷克当局就出售用户数据事件已着手调查杀毒公司Avast；超过600次安装的WordPress Cookie Consent插件易受黑客攻击", "url": "https://www.freebuf.com/news/227187.html", "time": "2020-02-14", "level": "红色标题", "num_look": 67275, "num_comment": 4, "author": "Sandra1432", "tags": ["资讯"], "text": "在对Avast数据收集策略进行深入分析，并发现将超过1亿用户的浏览历史信息出售给科技巨头之后，捷克共和国的数据监管机构已经着手对这家杀毒公司开展深入调查。"}
{"title": "用NodeJS实现反爬虫，原理&源码放送", "url": "https://www.freebuf.com/articles/web/226038.html", "time": "2020-02-14", "level": "现金奖励", "num_look": 97163, "num_comment": 8, "author": "w2sfoot", "tags": ["WEB安全"], "text": "爬虫让很多人对其深感苦恼，今天的Node.JS实战，将实现一种防护性能很强的反爬虫系统。"}
{"title": "Winnti组织恶意行为分析", "url": "https://www.freebuf.com/articles/network/226336.html", "time": "2020-02-13", "level": "", "num_look": 67404, "num_comment": 2, "author": "Kriston", "tags": ["网络安全"], "text": "在2019年11月发现Winnti发起对两个香港大学的网络攻击。发现隶属于该组织的后门变种，其中嵌入了许多功能模块。"}
{"title": "See-SURF：一款基于Python的潜在SSRF参数扫描工具", "url": "https://www.freebuf.com/sectool/226258.html", "time": "2020-02-13", "level": "", "num_look": 119720, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "See-SURF是一款基于Python开发的扫描工具，它可以帮助安全研究人员查找并发现目标Web应用程序中潜在的SSRF参数。"}
{"title": "今晚不见不散 | 提高远程办体验，确保终端“零信任”安全接入免费公开课报名开启", "url": "https://www.freebuf.com/fevents/227112.html", "time": "2020-02-13", "level": "", "num_look": 52458, "num_comment": 3, "author": "FB独家", "tags": ["活动"], "text": "今晚8点，来自F5的解决方案顾问陈建森，为大家带来主题为“提高远程办体验，确保终端“零信任”安全接入”的分享。"}
{"title": "新华三集团招聘渗透测试工程师", "url": "https://www.freebuf.com/jobs/226869.html", "time": "2020-02-13", "level": "", "num_look": 60419, "num_comment": 3, "author": "H3CSecurity", "tags": ["安全招聘"], "text": "新华三集团（简称新华三）是业界领先的数字化解决方案领导者，致力于成为帮助客户业务创新、数字化转型最可信赖的合作伙伴。"}
{"title": "雅诗兰黛泄露4.4亿数据记录，官方声明未涵盖客户信息", "url": "https://www.freebuf.com/news/227101.html", "time": "2020-02-13", "level": "", "num_look": 75249, "num_comment": 5, "author": "Sandra1432", "tags": ["资讯"], "text": "1月30日，安全研究员Jeremiah Fowler在网上发现了一个数据库，其中包含 “大量记录”。这个在网上公开的数据库没有密码保护，总共包含440,336,852条记录。"}
{"title": "2020 RSA大会参与安全厂家分析", "url": "https://www.freebuf.com/news/226720.html", "time": "2020-02-13", "level": "金币+15", "num_look": 54979, "num_comment": 2, "author": "MaplerD", "tags": ["资讯"], "text": "RSA Conference 相信大家都已经耳熟能详了，2020年2月23日在美国旧金山将举办2020届RSA大会，现在我简单介绍一下。"}
{"title": "情报内生：高级威胁检测实践的必要条件", "url": "https://www.freebuf.com/articles/system/225806.html", "time": "2020-02-13", "level": "", "num_look": 69604, "num_comment": 4, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "威胁情报是发现网络威胁的有效手段。针对流行的恶意代码和攻击，主要依赖基于互联网流量和样本数据生成的威胁情报。"}
{"title": "从RSA 2020大会的十大网络安全热门话题看行业未来发展", "url": "https://www.freebuf.com/articles/network/227036.html", "time": "2020-02-13", "level": "红色标题", "num_look": 83156, "num_comment": 3, "author": "Sandra1432", "tags": ["网络安全"], "text": "目前在网络安全行业有哪些热门话题？即将在旧金山举行的2020年RSA大会将为此提交一份出色的答卷。"}
{"title": "FreeBuf早报｜雅诗兰黛的在线数据库暴露了4.4亿条记录，不涉及客户数据；微软2月补丁周修复了IE 0day漏洞；新的网络钓鱼活动伪装成来自美国运通和大通的欺诈保护电子邮件", "url": "https://www.freebuf.com/news/227079.html", "time": "2020-02-13", "level": "红色标题", "num_look": 64176, "num_comment": 5, "author": "kirazhou", "tags": ["资讯"], "text": "1月30日，安全研究员Jeremiah Fowler在网上发现了一个数据库，该数据库没有密码保护，总共包含440,336,852条记录。"}
{"title": "等保测评2.0：SQLServer身份鉴别（上）", "url": "https://www.freebuf.com/articles/database/226363.html", "time": "2020-02-13", "level": "金币+15", "num_look": 158175, "num_comment": 4, "author": "起于凡而非于凡", "tags": ["数据安全", "标准与合规"], "text": "本篇文章主要说一说SQLServer数据库中身份鉴别控制点的中a、b测评项相关内容和理解。"}
{"title": "精品公开课｜90分钟之内入门SQL注入", "url": "https://www.freebuf.com/open/227062.html", "time": "2020-02-12", "level": "", "num_look": 77728, "num_comment": 1, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "本课程从 sql注入介绍及原理、mysql入门、php基本语法入门、注入讲解与实验演示四个方面展开，让零基础学员在90分钟之内入门！"}
{"title": "境外黑客组织提前行动，瞄准我国公司实施网络攻击", "url": "https://www.freebuf.com/vuls/226797.html", "time": "2020-02-12", "level": "", "num_look": 137717, "num_comment": 4, "author": "ADLab", "tags": ["漏洞", "网络安全"], "text": "近日，境外黑客组织（包括匿名者组织在内的多个黑客组织组成的黑客联盟）声称将于2020年2月13日针对我国视频监控系统实施网络攻击破坏活动。"}
{"title": "RSA Conference 2020：参会前需要了解的5件事", "url": "https://www.freebuf.com/news/227009.html", "time": "2020-02-12", "level": "红色标题", "num_look": 38841, "num_comment": 4, "author": "kirazhou", "tags": ["资讯"], "text": "在RSA大会，你可以期待一场为期五天的分享培训，包括数百场专家会议，700多家参展商以及大量的高水平网络安全交流。简而言之，这就一个很好的机会。"}
{"title": "MassDNS：一款功能强大的高性能DNS子域名查询枚举侦察工具", "url": "https://www.freebuf.com/sectool/226276.html", "time": "2020-02-12", "level": "", "num_look": 126538, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "MassDNS是一款功能强大的高性能DNS stub解析工具，它可以帮助研究人员解析数百万甚至上亿个域名。"}
{"title": "今晚8点见 | 特殊时期如何做好云上安全建设·FreeBuf抗疫系列公开课", "url": "https://www.freebuf.com/fevents/226942.html", "time": "2020-02-12", "level": "红色标题", "num_look": 62468, "num_comment": 2, "author": "FB独家", "tags": ["活动"], "text": "来自阿里云的安全专家王晓东（麓飞），为大家带来主题为《特殊时期如何做好云上安全建设》的免费公开课分享。"}
{"title": "针对中东政府组织SharePoint攻击研究", "url": "https://www.freebuf.com/articles/network/226430.html", "time": "2020-02-12", "level": "", "num_look": 60792, "num_comment": 2, "author": "Kriston", "tags": ["网络安全"], "text": "2019年9月10日发现未知攻击者利用CVE-2019-0604 SharePoint漏洞在中​​东政府组织的网站上安装了多个Web Shell。这些Web Shell中有Github上免费提供的开源AntSword Web Shell。"}
{"title": "RSA 2020创新沙盒决赛十强盘点，聚焦SaaS、DevSecOps等热点方向", "url": "https://www.freebuf.com/articles/network/226895.html", "time": "2020-02-12", "level": "红色标题", "num_look": 89451, "num_comment": 2, "author": "Sandra1432", "tags": ["网络安全"], "text": "近期，RSA 大会宣布了第15届创新沙盒竞赛的十位决赛入围者。2020年2月24日，入围RSA大会创新沙盒十强的企业将在现场各自进行3分钟左右的展示并回答委员会的问题。"}
{"title": "国务院：不符合网络安全要求的政务信息系统未来将不给经费", "url": "https://www.freebuf.com/news/226972.html", "time": "2020-02-12", "level": "", "num_look": 79041, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "近日，国务院办公厅印发《国家政务信息化项目建设管理办法》（以下简称《办法》），对国家政务信息系统的规划、审批、建设、共享和监管作出规定。"}
{"title": "戴尔发布SupportAssist软件漏洞修复，建议用户尽早更新", "url": "https://www.freebuf.com/news/226967.html", "time": "2020-02-12", "level": "", "num_look": 43433, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "戴尔近期发布了一个安全更新，修补了SupportAssist Client软件漏洞，该漏洞可能会让本地攻击者利用感染的计算机，以管理员权限执行任意代码。"}
{"title": "FreeBuf早报｜FTC警告使用冠状病毒诱饵的骗局；韩国友利银行被指控未经授权使用客户数据；Echobot恶意软件导致OT攻击显著增加", "url": "https://www.freebuf.com/news/226956.html", "time": "2020-02-12", "level": "红色标题", "num_look": 45410, "num_comment": 4, "author": "shidongqi", "tags": ["资讯"], "text": "美国联邦贸易委员会（FTC）警告，目前正在进行的诈骗活动正在利用当前的冠状病毒全球规模的健康危机，通过网络钓鱼电子邮件，短信和社交媒体诱骗美国的潜在目标。"}
{"title": "老赵说安全系列：破解CISSP-AIO7模拟Exam DB后的反思", "url": "https://www.freebuf.com/articles/others-articles/223865.html", "time": "2020-02-12", "level": "现金奖励", "num_look": 128714, "num_comment": 5, "author": "xiaoguazh", "tags": ["其他", "数据安全"], "text": "这次的话题是“破解 CISSP-AIO7-模拟Exam DB后的反思”。"}
{"title": "美国以「网络攻击」为由，起诉中国盗取 1.45 亿公民数据", "url": "https://www.freebuf.com/news/226938.html", "time": "2020-02-11", "level": "", "num_look": 85844, "num_comment": 3, "author": "Allen别bb", "tags": ["资讯"], "text": "美国司法部本周一( 2 月 10 日)宣布，对中国军方的 4 名军人提起诉讼。称他们涉嫌参与了 2017 年对美国信用评级机构巨头 Equifax 数据库的大规模攻击，获取了 1.45 亿美国公民的隐私数据。"}
{"title": "Socialscan：一款准确且快速的在线邮件地址及用户名查询工具", "url": "https://www.freebuf.com/articles/network/226283.html", "time": "2020-02-11", "level": "", "num_look": 79301, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "Socialscan是一款社交账号搜索工具，它可以帮助用户检测在线平台上已注册的邮件地址以及用户名，并且准确率为100%。"}
{"title": "Fortify Sca自定义扫描规则", "url": "https://www.freebuf.com/articles/others-articles/224474.html", "time": "2020-02-11", "level": "现金奖励", "num_look": 89837, "num_comment": 89837, "author": "随便看看", "tags": ["其他"], "text": "那么代码安全扫描工具到底应该怎么使用？"}
{"title": "这些知识点你都了解了吗？CISSP-D2：资产安全", "url": "https://www.freebuf.com/articles/security-management/226287.html", "time": "2020-02-11", "level": "金币+8", "num_look": 196307, "num_comment": 2, "author": "hjy103", "tags": ["安全管理"], "text": "资产安全知识域涵盖信息和信息资产在其生命周期中的安全保护，包括恰当的收集、分类、处置以及控制措施的选择和使用。"}
{"title": "字节跳动「安全评估」及「攻防实验室」团队在线招聘", "url": "https://www.freebuf.com/jobs/226922.html", "time": "2020-02-11", "level": "", "num_look": 79199, "num_comment": 4, "author": "bytedance", "tags": ["安全招聘"], "text": "字节跳动在海内外推出了多款有影响力的产品，包括综合资讯类的今日头条，视频类的抖音、抖音火山版、TikTok、西瓜视频、Vigo Video，以及教育产品、企业SaaS等新业务。"}
{"title": "大规模DDoS攻击降低了伊朗25％的互联网连接率", "url": "https://www.freebuf.com/news/226874.html", "time": "2020-02-11", "level": "", "num_look": 44361, "num_comment": 2, "author": "kirazhou", "tags": ["资讯"], "text": "伊朗再次受到网络攻击，大规模的DDos攻击摧毁了伊朗很大一部分的互联网访问权限。"}
{"title": "FreeBuf早报 | 以色列选举管理应用程序意外泄露了数百万选民的数据；大规模DDoS攻击降低了25％的伊朗互联网连接率；三大运营商可查个人轨迹，30天内去过哪里一目了然", "url": "https://www.freebuf.com/news/226857.html", "time": "2020-02-11", "level": "红色标题", "num_look": 61901, "num_comment": 6, "author": "Sandra1432", "tags": ["资讯"], "text": "以色列报纸 Haaretz 报道称，由第三方管理的 Elector 选举应用，近日曝出了严重的问题，导致超过 600 万的选民数据被意外泄露。"}
{"title": "AWS无服务(Serverless)LambdaHello World实践与安全防护简析", "url": "https://www.freebuf.com/articles/network/226014.html", "time": "2020-02-11", "level": "", "num_look": 66591, "num_comment": 4, "author": "ZhiXian", "tags": ["网络安全"], "text": "随着业务的不断迭代，计算服务从最初的物理服务器向虚拟化发展，接着又出现容器技术，无论是哪种技术，降低成本、提高效率才是云服务永恒不变的主题。"}
{"title": "等保测评2.0：Windows入侵防范", "url": "https://www.freebuf.com/articles/system/226156.html", "time": "2020-02-11", "level": "现金奖励", "num_look": 108349, "num_comment": 9, "author": "起于凡而非于凡", "tags": ["标准与合规", "系统安全"], "text": "本篇文章主要说一说windows系统中入侵防范控制点的相关内容和理解。"}
{"title": "话题讨论｜远程办公模式开启，这是你想要的SOHO吗？", "url": "https://www.freebuf.com/articles/neopoints/226765.html", "time": "2020-02-10", "level": "红色标题", "num_look": 219867, "num_comment": 15, "author": "shidongqi", "tags": ["观点"], "text": "不知道多少人在此之前羡慕自由职业者的SOHO办公，不用挤地铁，坐着、躺着、趴着解锁72种办公姿势。没想到，2020年第一个愿望就这样实现了……"}
{"title": "ATTCK-PenTester-Book：根据ATT&CK知识体系编制的长达400页的渗透手册", "url": "https://www.freebuf.com/articles/system/226119.html", "time": "2020-02-10", "level": "", "num_look": 128631, "num_comment": 5, "author": "secist", "tags": ["系统安全"], "text": "ATTCK-PenTester-Book是由DeadEye团队联合多家安全公司及安全团队的安全研究人员，根据ATT&CK知识体系整理编辑的一份长达400多页的渗透参考手册。"}
{"title": "phpMydmin的GetShell思路", "url": "https://www.freebuf.com/articles/web/226240.html", "time": "2020-02-10", "level": "金币+8", "num_look": 110931, "num_comment": 3, "author": "FengSec", "tags": ["WEB安全"], "text": "phpMyadmin是一个以PHP为基础的MySQL数据库管理工具，使网站管理员可通过Web接口管理数据库 。"}
{"title": "免费报名｜逆行护航·远程协同办公的企业安全公开课本周三上线", "url": "https://www.freebuf.com/fevents/226756.html", "time": "2020-02-10", "level": "红色标题", "num_look": 77130, "num_comment": 2, "author": "FB独家", "tags": ["活动"], "text": "「逆行护航·远程协同办公的企业安全」免费线上公开课报名开启。"}
{"title": "KM系统的构建及安全考量", "url": "https://www.freebuf.com/articles/es/225364.html", "time": "2020-02-10", "level": "现金奖励", "num_look": 125664, "num_comment": 4, "author": "softgirl", "tags": ["企业安全"], "text": "KM（Knowledge Management），是有系统的管理与运用企业的经营智能，透过信息技术加以存储和呈现，并作为企业营运的参考信息。"}
{"title": "《2019年云上挖矿僵尸网络趋势报告》首发：挖矿木马全面蠕虫化", "url": "https://www.freebuf.com/articles/paper/226605.html", "time": "2020-02-10", "level": "", "num_look": 184032, "num_comment": 2, "author": "阿里云安全", "tags": ["安全报告"], "text": "挖矿木马是一类利用漏洞入侵计算机，并植入挖矿软件挖掘加密数字货币牟利的木马，被植入挖矿木马的计算机会出现CPU使用率飙升、系统卡顿、业务服务无法正常使用等情况。"}
{"title": "Apereo CAS 4.X反序列化漏洞分析及复现", "url": "https://www.freebuf.com/vuls/226149.html", "time": "2020-02-10", "level": "金币+8", "num_look": 138170, "num_comment": 138170, "author": "DreamXu", "tags": ["WEB安全", "漏洞"], "text": "这篇文章记录了自己的一些想法以及相关的知识点，方便自己日后忘记可以重新拾起。"}
{"title": "FreeBuf早报｜IB集团在Joker's Stash 上检测到46万+印度银行卡；美国国土安全部承认使用数据库追踪数百万手机用户；勒索软件安装合法 Gigabyte 驱动去关闭安全软件", "url": "https://www.freebuf.com/news/226748.html", "time": "2020-02-10", "level": "红色标题", "num_look": 56218, "num_comment": 4, "author": "kirazhou", "tags": ["资讯"], "text": "IB集团的专家检测到一个数据库，其中包含超过460,000张支付卡记录，这些记录已上传到卡店Joker's Stash，而大多数记录来自印度的银行。"}
{"title": "叮咚！您有一份远程办公安全防范指南，请注意查收", "url": "https://www.freebuf.com/articles/network/226636.html", "time": "2020-02-10", "level": "红色标题", "num_look": 110048, "num_comment": 1, "author": "shidongqi", "tags": ["网络安全"], "text": "FreeBuf根据多数企业远程办公条件，总结了一些安全建议可供参考，通过自查以及主动防范来降低远程办公不同场景下的安全风险。"}
{"title": "快讯｜网信办：为疫情防控收集的个人信息，不得用于其他用途", "url": "https://www.freebuf.com/news/226736.html", "time": "2020-02-09", "level": "红色标题", "num_look": 64204, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "2月9日，中央网络安全和信息化委员会办公室发布了《关于做好个人信息保护利用大数据支撑联防联控工作的通知》，针对当下疫情防控工作中所涉及到个人隐私安全问题做了具体要求。"}
{"title": "ReconCobra：一款针对信息收集的全自动化渗透测试框架", "url": "https://www.freebuf.com/sectool/226180.html", "time": "2020-02-09", "level": "", "num_look": 128829, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["工具", "终端安全"], "text": "今天给大家介绍的是一款名叫ReconCobra的全自动渗透测试框架，该框架可以帮助安全研究人员在研究的信息收集阶段自动化完成绝大部分的任务。"}
{"title": "CVE-2019-1215：Windows内核ws2ifsl.sys中的用后释放漏洞分析", "url": "https://www.freebuf.com/vuls/226167.html", "time": "2020-02-09", "level": "", "num_look": 86583, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["漏洞", "系统安全"], "text": "我们将对近期刚刚修复的用后释放漏洞（CVE-2019-1215）进行分析，该漏洞存在于ws2ifsl.sys中，一旦成功利用，攻击者将有可能实现本地提权。"}
{"title": "防治“病毒疫情”的同时，也要守住这场“信息疫情”战", "url": "https://www.freebuf.com/articles/neopoints/226661.html", "time": "2020-02-09", "level": "", "num_look": 150560, "num_comment": 150560, "author": "Sandra1432", "tags": ["观点"], "text": "自新冠病毒疫情传播以来，网络上就出现了很多防疫谣言：民间偏方大蒜水、麻油滴鼻法；独家秘方盐水漱口能防病毒；吸烟、喝酒能够抵抗病毒；开空调暖气能杀死病毒……"}
{"title": "沙特网战风云：王储亲自攻击亚马逊CEO后，纽约·时报记者再成目标", "url": "https://www.freebuf.com/articles/system/226372.html", "time": "2020-02-09", "level": "", "num_look": 92413, "num_comment": 5, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "2018年5月1日下午，亚马逊CEO杰夫·贝索斯（Jeff Bezos）的iphoneX手机收到了一条来自WhatsApp信息，信息中含有一段视频。而发送该条信息的账号，经查实发现，是由沙特·阿拉伯王国王储穆罕·默德·本·萨勒曼。"}
{"title": "BUF大事件丨新型冠状病毒疫情专题", "url": "https://www.freebuf.com/news/226688.html", "time": "2020-02-09", "level": "红色标题", "num_look": 165819, "num_comment": 165819, "author": "willhuang", "tags": ["视频", "资讯"], "text": "这场突如其来的疫情几乎打破了所有人对2020年的美好期待，当疫情阻击战打响的同时，网络空间其实也在进行着另一场没有硝烟的战争。前方的战士正在阻击疫情，后方的公众个人信息安全防线却在动摇。"}
{"title": "PHP代码审计之入门实战", "url": "https://www.freebuf.com/vuls/225993.html", "time": "2020-02-09", "level": "现金奖励", "num_look": 116852, "num_comment": 7, "author": "国光", "tags": ["WEB安全", "漏洞"], "text": "虽然这是一个不知名的小系统，但是安全加固还是考虑到的，很多本应该有漏洞的地方均被加固修复了，导致国光我一开始一直碰壁。"}
{"title": "这些知识点你都了解了吗？CISSP-D1：安全和风险管理", "url": "https://www.freebuf.com/articles/security-management/226120.html", "time": "2020-02-09", "level": "金币+8", "num_look": 183301, "num_comment": 183301, "author": "hjy103", "tags": ["安全管理"], "text": "安全和风险管理知识域包含了许多基本的信息安全概念、原则以及信息安全管理相关活动和方法。"}
{"title": "Scallion：一款基于GPU的Onion哈希生成器", "url": "https://www.freebuf.com/sectool/226179.html", "time": "2020-02-08", "level": "", "num_look": 75243, "num_comment": 75243, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Scallion可以帮助我们使用OpenCL来创建GPG密钥以及针对Tor隐藏服务的.onion地址。"}
{"title": "分析逆向通信HACK升降桌后感想", "url": "https://www.freebuf.com/geek/226037.html", "time": "2020-02-08", "level": "现金奖励", "num_look": 162600, "num_comment": 2, "author": "LEdge1", "tags": ["极客"], "text": "前面看了一个工程师硬改升降桌的视频，从中学习到了不少东西，当然也有自己的一些想法吧！"}
{"title": "曾两次入侵任天堂的黑客认罪，多次窃取数据", "url": "https://www.freebuf.com/articles/network/226600.html", "time": "2020-02-08", "level": "", "num_look": 70692, "num_comment": 2, "author": "Sandra1432", "tags": ["网络安全"], "text": "上周，一名入侵任天堂服务器的加州男子对其指控供认不讳，正在等待判决。该青年男子曾两次入侵任天堂，并泄露了该公司尚未发布的Switch游戏机相关数据。"}
{"title": "等保测评2.0：Windows访问控制", "url": "https://www.freebuf.com/articles/system/225994.html", "time": "2020-02-08", "level": "现金奖励", "num_look": 115344, "num_comment": 115344, "author": "起于凡而非于凡", "tags": ["标准与合规", "系统安全"], "text": "本篇文章主要说一说windows系统中访问控制的控制点的相关内容和理解。"}
{"title": "WAF对WebShell流量检测的性能分析", "url": "https://www.freebuf.com/articles/web/226053.html", "time": "2020-02-08", "level": "金币+8", "num_look": 240729, "num_comment": 2, "author": "LittleT1ger", "tags": ["WEB安全"], "text": "最近在一次授权渗透测试中遇到了一个棘手的场景，万能的队友已经找到了后台上传点，并传了小马然后开心地用antsword进行连接。"}
{"title": "谭晓生：疫情对2020年网络安全行业总体影响不会太大", "url": "https://www.freebuf.com/news/226674.html", "time": "2020-02-07", "level": "", "num_look": 159418, "num_comment": 159418, "author": "Sandra1432", "tags": ["观点", "资讯"], "text": "2020年新春，中国遭遇了新型冠状病毒感染肺炎疫情，为了防控疫情很多企业延迟开工，餐饮等行业客流量的骤减也让大量中小企业面临生存挑战。"}
{"title": "100%课程收益，FreeBuf公开课全网寻找CTF讲师", "url": "https://www.freebuf.com/open/226576.html", "time": "2020-02-07", "level": "", "num_look": 67124, "num_comment": 1, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "全网寻找CTF大咖，网络安全的“韩商言”，和FreeBuf公开课一起为信息安全人才的培养做出努力和贡献。"}
{"title": "LOLBITS：一款基于后台智能传输服务（BITS）的C#反向Shell", "url": "https://www.freebuf.com/articles/system/226165.html", "time": "2020-02-07", "level": "", "num_look": 60366, "num_comment": 60366, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "LOLBITS是一款C#反向Shell，它使用了微软后台智能传输服务（BITS）作为传输信道来与后端命令控制服务器进行交互。"}
{"title": "2020：“深度伪造”与“深度欺骗”的一年", "url": "https://www.freebuf.com/articles/network/226230.html", "time": "2020-02-07", "level": "", "num_look": 70340, "num_comment": 70340, "author": "Sandra1432", "tags": ["网络安全"], "text": "在过去的一年中，可用于生成逼真、虚假或人为操控的音视频机器学习模型deepfake逐渐见诸报端，成为媒体争相报道的对象，并成为新兴的网络安全威胁。"}
{"title": "shell中的幽灵：web Shell攻击调查", "url": "https://www.freebuf.com/articles/network/226539.html", "time": "2020-02-07", "level": "", "num_look": 82504, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "近期发现某服务器配置错误，攻击者可在web服务器上的多个文件夹中部署webshell，导致服务帐户和域管理帐户被攻击。"}
{"title": "CSS-T | Mysql Client 任意文件读取攻击链拓展", "url": "https://www.freebuf.com/vuls/225420.html", "time": "2020-02-07", "level": "", "num_look": 83410, "num_comment": 1, "author": "知道创宇404实验室", "tags": ["漏洞", "系统安全"], "text": "这应该是一个很早以前就爆出来的漏洞，而我见到的时候是在TCTF2018 final线下赛的比赛中，是被 Dragon Sector 和 Cykor 用来非预期h4x0r's club这题的一个技巧。"}
{"title": "FreeBuf早报｜欧洲名校遭黑客勒索 付了30个比特币赎金；360杀毒软件与统一操作系统UOS完成适配；思科发现协议的高危漏洞", "url": "https://www.freebuf.com/news/226593.html", "time": "2020-02-07", "level": "红色标题", "num_look": 53812, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "Check Point专家发现了飞利浦Hue智能灯泡的高严重性漏洞，可利用该漏洞进入目标WiFi网络。"}
{"title": "数据安全实践之数据资产管理", "url": "https://www.freebuf.com/articles/database/225431.html", "time": "2020-02-07", "level": "现金奖励", "num_look": 138598, "num_comment": 138598, "author": "Alkaid13", "tags": ["数据安全"], "text": "在企业安全建设中，资产管理是很多安全工作的基础。而数据资产管理可以帮助我们更准确的发现安全风险，执行更有效的控制措施，在数据安全体系化建设中也有着举足轻重的作用。"}
{"title": "【FreeBuf字幕组】CTF难题挑战：任意写入House of Force（堆利用）", "url": "https://www.freebuf.com/video/220109.html", "time": "2020-02-06", "level": "红色标题", "num_look": 119441, "num_comment": 1, "author": "Darry端", "tags": ["视频"], "text": "本期视频是围绕House of Force展开讲解，House Of Force属于House Of XXX系列，House Of XXX是2004年“ Malloc Maleficarum-Glibc Malloc开发技术”中提出的glibc堆栈器的一系列方法。"}
{"title": "Stowaway：安全工作者的多级代理工具", "url": "https://www.freebuf.com/sectool/225862.html", "time": "2020-02-06", "level": "金币+8", "num_look": 122039, "num_comment": 3, "author": "Phantom11235", "tags": ["工具"], "text": "此工具是因为看到了Dliv3师傅的Venom工具后，想着自己也写一个属于自己的多级代理工具，故而利用闲暇时间编写的（是的，我又在重复造轮子), 在此感谢Dliv3师傅 XD。"}
{"title": "国家卫健委：加强网络信息安全工作，为疫情防控工作提供可靠支撑", "url": "https://www.freebuf.com/news/226543.html", "time": "2020-02-06", "level": "红色标题", "num_look": 109839, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "国家卫生健康委办公厅发布关于加强信息化支撑新型冠状病毒感染的肺炎疫情防控工作的通知，强调加强网络信息安全工作，为疫情防控工作提供可靠支撑。"}
{"title": "针对Docker恶意行为的分析", "url": "https://www.freebuf.com/articles/network/226210.html", "time": "2020-02-06", "level": "", "num_look": 70212, "num_comment": 70212, "author": "Kriston", "tags": ["容器安全", "网络安全"], "text": "2019年9月至12月研究人员定期扫描和收集互联网中Docker的元数据，研究发现攻击者针对Docker的攻击策略和技术。"}
{"title": "百融云创招聘", "url": "https://www.freebuf.com/jobs/226424.html", "time": "2020-02-06", "level": "", "num_look": 67027, "num_comment": 1, "author": "百融云创科技股份有限公司", "tags": ["安全招聘"], "text": "百融云创科技股份有限公司成立于2014年3月，是一家利用人工智能、大数据、云计算等先进技术为金融机构提供客户全生命周期管理服务、为个人和小微企业推荐合适的金融产品和服务的大数据应用公司。"}
{"title": "疫情当下，更要守好个人信息安全防线", "url": "https://www.freebuf.com/articles/neopoints/226427.html", "time": "2020-02-06", "level": "", "num_look": 191642, "num_comment": 2, "author": "kirazhou", "tags": ["观点"], "text": "当前方的战士正在阻击疫情，后方的公众个人信息安全防线却在动摇。公众知情权和个人隐私权的权衡，成为当下疫情发展的关键问题。"}
{"title": "DIY天线+SDR+GNURadio实现低成本接收解码韩国GK-2A气象卫星信号", "url": "https://www.freebuf.com/geek/226035.html", "time": "2020-02-06", "level": "现金奖励", "num_look": 193063, "num_comment": 9, "author": "吃葡萄不吐葡萄皮的雪碧", "tags": ["极客"], "text": "这几年玩了很多种 SDR 开发板，春节封路，在家闲着没事，也在尝试着玩各种天线，分析解码不同协议的无线信号，以此打发时间。"}
{"title": "FreeBuf早报｜黑客滥用Bitbucket传播恶意软件，全球各地感染50万+计算机；雅虎就数据泄露寻求和解，用户最高可获100美元赔偿；黑客利用Twitter Bug查找用户的关联电话号码", "url": "https://www.freebuf.com/news/226470.html", "time": "2020-02-06", "level": "红色标题", "num_look": 63961, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "Bitbucket是合法的托管服务提供商，却被网络犯罪分子滥用以传播恶意软件。"}
{"title": "如何规范有效的进行风险评估？", "url": "https://www.freebuf.com/articles/security-management/224380.html", "time": "2020-02-06", "level": "现金奖励", "num_look": 224941, "num_comment": 6, "author": "jary123", "tags": ["安全管理"], "text": "如何规范的实施风险评估，保证信息系统的安全，成为很多企业安全负责人认真考虑的问题。"}
{"title": "安全基线检查平台", "url": "https://www.freebuf.com/sectool/225224.html", "time": "2020-02-05", "level": "金币+8", "num_look": 226830, "num_comment": 6, "author": "jerrybird", "tags": ["工具"], "text": "最近在做安全基线检查相关的，网上有一些代码比较零散；也有一些比较完整的项目，比如owasp中的安全基线检查项目，但是收费；还有一些开源且完整的，比如lynis，但是不符合我的要求。"}
{"title": "上传绕过WAF姿势与防御漫谈", "url": "https://www.freebuf.com/articles/web/226000.html", "time": "2020-02-05", "level": "现金奖励", "num_look": 185419, "num_comment": 6, "author": "星空111", "tags": ["WEB安全"], "text": "WAF(Web Application Firewall)简单的来说就是执行一系列针对HTTP/HTTPS的安全策略来专门为Web应用提供保护的一款产品。"}
{"title": "华为云安全实验室招聘", "url": "https://www.freebuf.com/jobs/226252.html", "time": "2020-02-05", "level": "", "num_look": 124236, "num_comment": 10, "author": "shellsniper", "tags": ["安全招聘"], "text": "华为云用在线的方式将华为30多年在ICT基础设施领域的技术积累和产品解决方案开放给客户，致力于提供稳定可靠、安全可信、可持续创新的云服务。"}
{"title": "一次对BT种子的追踪小记", "url": "https://www.freebuf.com/articles/network/226069.html", "time": "2020-02-05", "level": "现金奖励", "num_look": 140463, "num_comment": 10, "author": "TBDChen", "tags": ["网络安全"], "text": "过年期间，宅在家里闲来无事，我在网上找各种资源。终于通过自己的不懈努力，找到了一套非常优质的资源：画面高清，中文字幕，每日定期更新十部。"}
{"title": "聚焦疫情｜逆行的不只是白衣天使，还有「白帽子」", "url": "https://www.freebuf.com/articles/neopoints/226341.html", "time": "2020-02-05", "level": "红色标题", "num_look": 210822, "num_comment": 5, "author": "shidongqi", "tags": ["观点"], "text": "假如我是一名黑客，我想黑掉时光老人的手表，把时间拨回2019年12月31日23点59分59秒，重新说一声：你好啊，2020！"}
{"title": "FreeBuf早报｜中兴华为督促 FCC 不要认定其构成国家安全风险；印度APT组织趁火打劫对我国医疗机构发起定向攻击；HPE收购零信任网络安全公司Scytale", "url": "https://www.freebuf.com/news/226386.html", "time": "2020-02-05", "level": "红色标题", "num_look": 115471, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": "中国信息通信研究院和IMT-2020（5G）推进组联合发布《5G安全报告》，涵盖5G发展重大意义、5G网络概述、5G安全理念、5G安全分析、5G安全思路和措施等多个方面。"}
{"title": "记一次某城乡结合部应急支撑工作", "url": "https://www.freebuf.com/articles/system/225822.html", "time": "2020-02-05", "level": "现金奖励", "num_look": 89517, "num_comment": 4, "author": "redhatd", "tags": ["系统安全"], "text": "本文文章不涉过多及脱壳和逆向技术，仅对病毒作行为分析，相对简单易学。逆向苦手不用害怕。"}
{"title": "无损检测Fastjson DoS漏洞以及盲区分Fastjson与Jackson组件", "url": "https://www.freebuf.com/news/232758.html", "time": "2020-02-05", "level": "", "num_look": 19890, "num_comment": 19890, "author": "斗象智能安全平台", "tags": ["资讯"], "text": "针对Fastjson DoS 漏洞的检测，相对较好识别，但其需要发送 DoS 的请求包，就会有一个时间延迟，但是部分使用者或 SRC平台对 DoS 类漏洞持保守态度。"}
{"title": "SysWhispers：如何通过直接系统调用实现AVEDR绕过", "url": "https://www.freebuf.com/sectool/224932.html", "time": "2020-02-04", "level": "", "num_look": 96179, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具", "系统安全"], "text": "SysWhispers能够生成Header文件和ASM文件，并通过发送直接系统调用来绕过反病毒以及终端防护响应工具。"}
{"title": "基于流量的网络入侵检测系统实践若干问题分析与思考", "url": "https://www.freebuf.com/articles/es/224574.html", "time": "2020-02-04", "level": "现金奖励", "num_look": 194323, "num_comment": 5, "author": "shengl99", "tags": ["企业安全"], "text": "网络入侵检测在发展过程中，主要有两大流派：基于日志的入侵检测和基于流量的入侵检测。"}
{"title": "Sudo漏洞允许非特权Linux和macOS用户以root身份运行命令", "url": "https://www.freebuf.com/news/226301.html", "time": "2020-02-04", "level": "", "num_look": 93374, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "苹果安全团队成员Joe Vennix发现了sudo实用程序中的一个重要漏洞，即在特定配置下，它可能允许低特权用户或恶意程序在Linux或macOS系统上以 root身份执行命令。"}
{"title": "Openvas配置slave的debug之路", "url": "https://www.freebuf.com/sectool/226016.html", "time": "2020-02-04", "level": "金币+20", "num_look": 248261, "num_comment": 6, "author": "LittleT1ger", "tags": ["工具"], "text": "在众多开源扫描器中，相信有很多人会选择openvas，绿骨头组织的这款产品因其性能卓越，扩展性强，接入点、接入方式灵活等众多优点，至今已经成为了企业的安全解决方案之一。"}
{"title": "FreeBuf早报 | 美国FCC出手：将对无线实时定位数据泄露采取行动；推特封号脸书“删帖”，全球社交媒体向疫情谣言“宣战”；Firefox允许用户查看被收集的遥测数据", "url": "https://www.freebuf.com/news/226273.html", "time": "2020-02-04", "level": "红色标题", "num_look": 61901, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "近日，全球知名社交媒体如Instagram、推特、脸书、TikTok等接连向各自平台上与疫情相关的谣言宣战。"}
{"title": "漏洞组合拳之XSS+CSRF记录", "url": "https://www.freebuf.com/vuls/225096.html", "time": "2020-02-04", "level": "现金奖励", "num_look": 125444, "num_comment": 4, "author": "TeamsSix", "tags": ["漏洞"], "text": "今天学习一下 XSS + CSRF 组合拳，现将笔记记录如下。"}
{"title": "从运营角度看数据安全", "url": "https://www.freebuf.com/articles/database/223960.html", "time": "2020-02-04", "level": "现金奖励", "num_look": 122210, "num_comment": 3, "author": "邹先生007", "tags": ["数据安全"], "text": "早在笔者刚入行的那个时期，安全岗位基本只有两种，WEB安全工程师和Android安全工程师，回忆一下前几年企业出现的风险事件、大多是安全工程师参围绕应用安全漏洞，以及如何在漏洞攻与防之间进行技术博弈。"}
{"title": "警惕利用“新型冠状病毒”名义的网络钓鱼攻击", "url": "https://www.freebuf.com/news/226214.html", "time": "2020-02-03", "level": "红色标题", "num_look": 197788, "num_comment": 7, "author": "kirazhou", "tags": ["资讯"], "text": "疫情当前，不容“黑客”妄行。笔者整理了几类比较典型的攻击案例，借此希望帮助大家更好地识别虚假、恶意信息。"}
{"title": "恶意软件远程管理配置分析", "url": "https://www.freebuf.com/articles/network/224848.html", "time": "2020-02-03", "level": "", "num_look": 63228, "num_comment": 2, "author": "Kriston", "tags": ["网络安全"], "text": "在攻击活动中，攻击者和APT组经常利用远程配置控制恶意软件。此类配置通常包含命令和控制（C2）服务器、服务器通信密码、活动标识符、互斥锁、安装位置等。"}
{"title": "CVE-2019-16662&16663：rConfig v3.9.2远程命令执行漏洞分析", "url": "https://www.freebuf.com/vuls/224782.html", "time": "2020-02-03", "level": "", "num_look": 94638, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["漏洞", "系统安全"], "text": "rConfig是一款开源的网络设备配置管理实用工具，在rConfig的帮助下，网络工程师可以快速、频繁地管理网络设备的快照。"}
{"title": "业务安全架构思维", "url": "https://www.freebuf.com/articles/es/224583.html", "time": "2020-02-03", "level": "现金奖励", "num_look": 171366, "num_comment": 5, "author": "煜阳yuyang", "tags": ["企业安全"], "text": "架构思维要从多方面考虑整体架构的设计，接下来的架构思维会涉及业务，各位看官需要自行对接业务来分析看待架构思维。"}
{"title": "FreeBuf早报 | 微软检测到新的TA505恶意软件攻击；日本NEC国防合同信息可能遭到破坏；黑客利用人们对冠状病毒的恐惧传播恶意软件", "url": "https://www.freebuf.com/news/226158.html", "time": "2020-02-03", "level": "红色标题", "num_look": 60696, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "微软表示，正在进行的TA505网络钓鱼活动正在使用带有HTML重定向器的附件来传送恶意Excel文档。"}
{"title": "微服务渗透之信息搜集", "url": "https://www.freebuf.com/articles/web/224605.html", "time": "2020-02-03", "level": "金币+8", "num_look": 103897, "num_comment": 5, "author": "130421106", "tags": ["WEB安全"], "text": "随着web安全从业人员的增多，很多人都有个疑问：怎么洞越来越难挖了!!?大网站是不是没有这些漏洞!!?"}
{"title": "WindowsFirewallRuleset：一套针对Windows防火墙规则集的PowerShell脚本", "url": "https://www.freebuf.com/articles/system/225030.html", "time": "2020-02-02", "level": "", "num_look": 67262, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "WindowsFirewallRuleset工具根据下列因素，已将Windows防火墙规则组织成为了单独的PowerShell脚本。"}
{"title": "挖洞经验 | PayPal验证码质询功能（reCAPTCHA Challenge）存在的用户密码泄露漏洞", "url": "https://www.freebuf.com/vuls/225330.html", "time": "2020-02-02", "level": "", "num_look": 92243, "num_comment": 3, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "近期，安全研究者Alex Birsanl对PayPal登录界面的身份验证机制进行分析，发现了其中一个隐藏的高危漏洞。"}
{"title": "“一个人”的互金企业安全建设总结续篇", "url": "https://www.freebuf.com/articles/es/225580.html", "time": "2020-02-02", "level": "现金奖励", "num_look": 181846, "num_comment": 3, "author": "pur0", "tags": ["企业安全"], "text": "又经历了两年，时间匆匆，随着安全的发展，有些想法已经改变了，有始有终，把这个文章结尾。"}
{"title": "Exploit Spring Boot Actuator之Spring Cloud Env学习笔记", "url": "https://www.freebuf.com/articles/web/223923.html", "time": "2020-02-02", "level": "", "num_look": 72957, "num_comment": 1, "author": "小米安全中心", "tags": ["WEB安全"], "text": "今年二月份，Michael Stepankin 大佬写了一篇关于 Spring Boot Actuator 的利用文章，文中介绍了多种利用思路和方式。"}
{"title": "疑似南亚地区新APT组织GroupA21相关攻击活动分析", "url": "https://www.freebuf.com/articles/paper/225604.html", "time": "2020-02-02", "level": "", "num_look": 156189, "num_comment": 1, "author": "Threatbook", "tags": ["安全报告"], "text": "在持续跟踪全球主流黑客组织的过程中，微步在线发现了一个至少自2017年开始活动，主要针对南亚地区各国开展网络间谍活动的新APT组织。"}
{"title": "TuxResponse：一款针对Linux平台的事件响应工具", "url": "https://www.freebuf.com/articles/system/225114.html", "time": "2020-02-01", "level": "", "num_look": 60919, "num_comment": 60919, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "TuxResponse是一款采用Bash语言开发编写的专门针对Linux系统平台的事件响应脚本。"}
{"title": "如何使用XposedOrNot来判断自己的密码是否泄露", "url": "https://www.freebuf.com/sectool/225032.html", "time": "2020-02-01", "level": "", "num_look": 121994, "num_comment": 121994, "author": "Alpha_h4ck", "tags": ["工具"], "text": "XposedOrNot(XoN)这款工具可以搜索一个由约8.5亿个实时密码组成的xposed密码聚合存储库，而网络攻击这可以使用这种泄露的密码来对用户的个人账户产生威胁。"}
{"title": "利用驱动人生升级通道传播的木马手工查杀记", "url": "https://www.freebuf.com/articles/system/224381.html", "time": "2020-02-01", "level": "现金奖励", "num_look": 85285, "num_comment": 4, "author": "xiaoxinling", "tags": ["系统安全"], "text": "驱动人生木马在1月24日的基础上再次更新，将攻击组件安装为计划任务、服务并启动。本次手工查杀主要针对该木马。"}
{"title": "软件安全策略分享", "url": "https://www.freebuf.com/articles/web/225028.html", "time": "2020-02-01", "level": "现金奖励", "num_look": 96638, "num_comment": 96638, "author": "alka1d", "tags": ["WEB安全", "系统安全"], "text": "我想作为一个信息安全从业者，无论是在渗透测试、代码审计亦或是其他安全服务中都会接触到各种各样的漏洞。面对类型如此丰富漏洞，我们要如何进行处理呢？"}
{"title": "APP调试中容易被忽视的安全项", "url": "https://www.freebuf.com/vuls/224998.html", "time": "2020-02-01", "level": "现金奖励", "num_look": 224046, "num_comment": 224046, "author": "吞龙", "tags": ["安全报告", "漏洞"], "text": "Android调试桥 (adb) 是一种命令行工具，可与安卓设备进行通信。"}
{"title": "INAV：一款专用的日志审查导航工具", "url": "https://www.freebuf.com/sectool/225113.html", "time": "2020-01-31", "level": "", "num_look": 97420, "num_comment": 97420, "author": "Alpha_h4ck", "tags": ["工具"], "text": "LNAV，即Log File Navigator，INAV是一款增强型日志文件查看工具，安全审计人员可以利用INAV来分析并检查日志文件，并从中收集到相关的语义信息，例如时间戳和日志级别。"}
{"title": "追踪分析LiquorBot僵尸网络", "url": "https://www.freebuf.com/articles/network/225398.html", "time": "2020-01-31", "level": "", "num_look": 65547, "num_comment": 65547, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "自2016年起，Mirai僵尸网络就因发动大规模网络攻击并摧毁各种基础设施而闻名于众，它也已经成为了网络安全领域对中、大型物联网僵尸网络评估的一个参考因子。"}
{"title": "开源WAF测试评估方法", "url": "https://www.freebuf.com/articles/web/224473.html", "time": "2020-01-31", "level": "现金奖励", "num_look": 91681, "num_comment": 91681, "author": "煜阳yuyang", "tags": ["WEB安全"], "text": "在这里讲一下开源WAF的测试评估方法，以成品文档为例。"}
{"title": "SDL思考之评价考核体系", "url": "https://www.freebuf.com/articles/neopoints/224485.html", "time": "2020-01-31", "level": "金币+20", "num_look": 196307, "num_comment": 196307, "author": "page100", "tags": ["观点"], "text": "一个概念或者一个事情如果有一个标准来判断好与不好，好的话那么是好到什么程度。有了这个标准可以知道当前的状态，如何往更好的方向努力。"}
{"title": "DSMM之数据交换安全", "url": "https://www.freebuf.com/articles/database/225593.html", "time": "2020-01-30", "level": "现金奖励", "num_look": 111733, "num_comment": 3, "author": "LJ_Monica", "tags": ["数据安全"], "text": "截止到目前，已经介绍和分享了五个部分，分别为DSMM开篇的总结与交流、数据采集安全、数据传输安全、数据存储安全、数据处理安全。"}
{"title": "如何使用RansomCoin从源码文件中提取加密货币地址以及其他IoC", "url": "https://www.freebuf.com/articles/blockchain-articles/225118.html", "time": "2020-01-30", "level": "", "num_look": 143669, "num_comment": 143669, "author": "Alpha_h4ck", "tags": ["区块链安全"], "text": "RansomCoin是一款DFIR工具，可以帮助广大研究人员从二进制源码文件中提取加密货币地址以及其他的入侵威胁指标IoC。"}
{"title": "企业级渗透测试服务思考", "url": "https://www.freebuf.com/articles/es/225116.html", "time": "2020-01-30", "level": "金币+20", "num_look": 146100, "num_comment": 1, "author": "两块", "tags": ["企业安全"], "text": "业务与数据安全已经被推上战争的高地，成为企业保护自身安全的重中之重，成为企业信息安全官在战略计划汇报中不得不谨慎对待的课题。"}
{"title": "挖洞经验 | 用BurpSuite实现越权漏洞（IDOR）的自动发现识别", "url": "https://www.freebuf.com/vuls/225701.html", "time": "2020-01-29", "level": "", "num_look": 164373, "num_comment": 164373, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "这里分享一个自动化发现IDOR（越权）漏洞的方法，那就是在BurpSuite中利用Autozie和Autorepeater插件实现IDOR漏洞的探测识别，而无需针对每个请求手动去变化参数或请求。"}
{"title": "浅谈ATT&CK对提升主机EDR检测能力的探索", "url": "https://www.freebuf.com/articles/es/223972.html", "time": "2020-01-29", "level": "", "num_look": 153127, "num_comment": 153127, "author": "安全狗safedog", "tags": ["企业安全"], "text": "我们从自己的角度出发对ATT&CK进行了一些探讨，希望能够还原其本来面目、消除过度的“神秘感”，重新审视这一技术的真正价值。"}
{"title": "简析移动客户端安全", "url": "https://www.freebuf.com/articles/terminal/219480.html", "time": "2020-01-29", "level": "金币+20", "num_look": 91552, "num_comment": 1, "author": "HackerButWhite", "tags": ["终端安全"], "text": "层出不穷的攻击方式无疑是为我们现阶段大家生活必不可少的工具——手机带来更多的烦恼与危害。"}
{"title": "自己动手DIY一台2.4G简易频谱仪", "url": "https://www.freebuf.com/geek/225853.html", "time": "2020-01-28", "level": "现金奖励", "num_look": 204440, "num_comment": 3, "author": "LEdge1", "tags": ["极客"], "text": "作为一名电子爱好者，自己动手制作一些简单的硬件小设备还是非常有趣的。我之前也是发布了《制作HackCube中的坎坎坷坷》。这次带来的是一个简易的频谱仪。"}
{"title": "IotShark：一款专用于物联网流量的监控与分析平台", "url": "https://www.freebuf.com/articles/terminal/225112.html", "time": "2020-01-28", "level": "", "num_look": 83152, "num_comment": 83152, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "IoTShark是一款物联网监控服务平台，它可以帮助广大研究人员监控其物联网设备所发送或接收的数据趋势。"}
{"title": "CVE-2019-0708 漏洞分析及相关测试", "url": "https://www.freebuf.com/vuls/224828.html", "time": "2020-01-28", "level": "现金奖励", "num_look": 191394, "num_comment": 5, "author": "XXL0sir", "tags": ["漏洞"], "text": "在CVE-2019-0708公布后几天就已经尝试过复现该漏洞，但借助当时exp并没能成功复现反弹shell的过程遂放弃，故借助这次漏洞复现报告再来尝试复现该漏洞。"}
{"title": "一次对浏览器解析和XSS的深度探究", "url": "https://www.freebuf.com/articles/web/222849.html", "time": "2020-01-28", "level": "金币+20", "num_look": 103686, "num_comment": 11, "author": "小逗哔是大腿", "tags": ["WEB安全"], "text": "为什么要进行编码？主要是因为某些数据不适合传输。原因多种多样，如 Size 过大，包含隐私数据，另外重要的一点就是有些字符会引起歧义。"}
{"title": "App违法风潮：解读《App违法违规收集使用个人信息行为认定方法》", "url": "https://www.freebuf.com/articles/terminal/225767.html", "time": "2020-01-27", "level": "现金奖励", "num_look": 80692, "num_comment": 1, "author": "咸味奶黄豆沙包", "tags": ["终端安全"], "text": "1月8日，工业和信息化部信息通信管理局通报第二批侵害用户权益行为的App名单，15款产品在列。"}
{"title": "挖洞经验 | 谷歌翻译服务（Google Translator）的跨站漏洞", "url": "https://www.freebuf.com/vuls/225133.html", "time": "2020-01-27", "level": "", "num_look": 111782, "num_comment": 2, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "在这篇文章里，越南籍作者通过发现了谷歌翻译服务（Google Translator）越翻英界面中存在的跨站漏洞（XSS），最后经测试验证，获得了谷歌官方奖励的$3133.70，我们一起来看看。"}
{"title": "记一次对Steam盗号病毒的反制过程", "url": "https://www.freebuf.com/articles/network/224412.html", "time": "2020-01-27", "level": "金币+8", "num_look": 101075, "num_comment": 9, "author": "夜无名", "tags": ["网络安全"], "text": "有些安全意识的朋友都知道陌生可执行的文件千万不要随便去运行。 下载下来后，AV软件不出所料的报红了……"}
{"title": "挖洞经验 | 知名在线教育平台的IDOR漏洞", "url": "https://www.freebuf.com/vuls/225134.html", "time": "2020-01-26", "level": "", "num_look": 120351, "num_comment": 120351, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "今天来聊聊一个最近发现的IDOR漏洞，出于保密原因，文中提及的目标网站我们以xyz.com代替，漏洞获得厂商$3,650的奖励。"}
{"title": "CVE-2018-8174双杀漏洞分析复现及防御", "url": "https://www.freebuf.com/vuls/224379.html", "time": "2020-01-26", "level": "现金奖励", "num_look": 108584, "num_comment": 2, "author": "Lostpoet", "tags": ["漏洞"], "text": "CVE-2018-8174漏洞是360追日安全团队于4份捕获到的，并将其命名为“双杀”漏洞，意指在IE浏览器以及office均可以引发的漏洞。"}
{"title": "伊朗相关网络活动总结", "url": "https://www.freebuf.com/articles/network/225149.html", "time": "2020-01-26", "level": "", "num_look": 78095, "num_comment": 78095, "author": "Kriston", "tags": ["网络安全"], "text": "以下威胁总结包含与伊朗活动有关的历史攻击摘要，以及自2020年1月3日事件以来发生的任何新的威胁或攻击。"}
{"title": "开源工具 | H1ve攻防训练平台（解题+AWD）", "url": "https://www.freebuf.com/sectool/221739.html", "time": "2020-01-25", "level": "金币+8", "num_look": 151296, "num_comment": 151296, "author": "Ph0rse", "tags": ["工具"], "text": "H1ve是一款自研CTF平台，同时具备解题、攻防对抗模式。"}
{"title": "挖洞经验 | 雅虎（Yahoo）的速率限制漏洞（$2k）", "url": "https://www.freebuf.com/vuls/225674.html", "time": "2020-01-25", "level": "", "num_look": 92203, "num_comment": 3, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "速率限制（Rate Limit）是为了限制某种资源在某段时间内被访问的次数，即客户端发起请求的或服务端响应请求的次数，目的在于防止DoS攻击或对资源的无限请求下载。"}
{"title": "Oski Stealer窃密木马，盗取美国地区用户的浏览器和加密钱包数据", "url": "https://www.freebuf.com/articles/system/225958.html", "time": "2020-01-25", "level": "金币+8", "num_look": 67397, "num_comment": 67397, "author": "熊猫正正", "tags": ["系统安全"], "text": "最近国外安全研究人员发现一款新型的窃密木马Oski Stealer正在地下黑客论坛进行广告宣传。"}
{"title": "聊聊区块链中的几个技术点", "url": "https://www.freebuf.com/articles/blockchain-articles/225085.html", "time": "2020-01-25", "level": "", "num_look": 165373, "num_comment": 165373, "author": "知道创宇404实验室", "tags": ["区块链安全"], "text": "随着技术浪潮的涌动，国家政策的推动，区块链又慢慢的进入了我们的视野中。在 2020 年初这个时刻，不妨我们再回头看看区块链的发展，聊聊区块链中的几个技术点，为新的一年打打基础。"}
{"title": "基线检查平台之Linux与Windows", "url": "https://www.freebuf.com/sectool/224603.html", "time": "2020-01-25", "level": "", "num_look": 126877, "num_comment": 2, "author": "jerrybird", "tags": ["工具"], "text": "最近在做安全基线检查相关的，网上有一些代码比较零散；也有一些比较完整的项目，比如owasp中的安全基线检查项目，但是收费；还有一些开源且完整的，比如lynis，但是不符合我的要求。"}
{"title": "BetterBackdoor：一个专为渗透测试人员设计的多功能后门程序", "url": "https://www.freebuf.com/sectool/225119.html", "time": "2020-01-24", "level": "", "num_look": 104075, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具", "系统安全"], "text": "BetterBackdoor是一款多功能的后门工具，广大安全研究人员可以利用BetterBackdoor来获取目标设备的远程访问权限。"}
{"title": "全勤矿工systemdMiner最新变种利用暗网代理下载恶意模块", "url": "https://www.freebuf.com/articles/system/225146.html", "time": "2020-01-24", "level": "", "num_look": 78086, "num_comment": 78086, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近日，深信服安全团队捕获到一款新型的Linux挖矿木马，该木马通过bash命令下载执行多个功能模块，通过SSH暴力破解、SSH免密登录利用、Hadoop Yarn未授权访问漏洞和自动化运维工具内网扩散。"}
{"title": "申请CVE的姿势总结", "url": "https://www.freebuf.com/articles/web/224609.html", "time": "2020-01-24", "level": "金币+8", "num_look": 103588, "num_comment": 103588, "author": "米怀特", "tags": ["WEB安全"], "text": "CVE的全称叫做“Common Vulnerabilities & Exposures”中文含义是公共漏洞和暴露。"}
{"title": "挖洞经验 | 简单技巧绕过人机身份验证（Captcha）", "url": "https://www.freebuf.com/vuls/224488.html", "time": "2020-01-23", "level": "", "num_look": 144667, "num_comment": 1, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "今天分享的Writeup是作者在目标网站漏洞测试中发现的一种简单的人机身份验证（Captcha）绕过方法"}
{"title": "网络欺诈阻碍了三分之一的企业扩展其数字能力", "url": "https://www.freebuf.com/news/225337.html", "time": "2020-01-23", "level": "", "num_look": 52929, "num_comment": 52929, "author": "kirazhou", "tags": ["资讯"], "text": "最具创新性的业务同时也是面临最大欺诈威胁的业务。"}
{"title": "技术研究 | 如何绕过杀毒软件自我保护", "url": "https://www.freebuf.com/vuls/220997.html", "time": "2020-01-23", "level": "现金奖励", "num_look": 157847, "num_comment": 9, "author": "huoji120", "tags": ["漏洞", "系统安全"], "text": "在WIN7 X64位系统后杀毒软件的自我保护一般都是通过OBOperationRegistration实现……"}
{"title": "等保测评2.0：Windows身份鉴别", "url": "https://www.freebuf.com/articles/system/224829.html", "time": "2020-01-23", "level": "现金奖励", "num_look": 142157, "num_comment": 9, "author": "起于凡而非于凡", "tags": ["标准与合规", "系统安全"], "text": "本篇文章主要说一说windows系统中身份鉴别控制点中a、b测评项的相关内容和理解，都比较基础和简单（但很繁琐）。"}
{"title": "FreeBuf早报 | 绝密文件：美军声称曾通过黑客行动打击ISIS网络；贝索斯的手机曾被沙特王储入侵；FireEye收购了云安全创业公司Cloudvisory", "url": "https://www.freebuf.com/news/225984.html", "time": "2020-01-23", "level": "", "num_look": 80366, "num_comment": 80366, "author": "kirazhou", "tags": ["资讯"], "text": "2016年，美国网络司令部成功开展了反对伊斯兰国（ISIS）在线宣传的行动。这是在周二发布的解密后的国家安全绝密文件中得出的信息……"}
{"title": "网络安全这10年", "url": "https://www.freebuf.com/news/225152.html", "time": "2020-01-23", "level": "", "num_look": 85572, "num_comment": 85572, "author": "kirazhou", "tags": ["资讯"], "text": "风云起于2010年，辉煌终将再延续！"}
{"title": "CVE-2020-0601漏洞详细分析", "url": "https://www.freebuf.com/vuls/225879.html", "time": "2020-01-22", "level": "", "num_look": 180640, "num_comment": 4, "author": "奇安信代码卫士", "tags": ["漏洞"], "text": "2020年1月15日，微软公布了1月份的补丁更新列表，其中存在一个位于CryptoAPI椭圆曲线密码(ECC)证书检测绕过相关的漏洞(CVE-2020-0601)，该漏洞为NSA发现并汇报给微软。"}
{"title": "僵尸网络新动向", "url": "https://www.freebuf.com/articles/network/224541.html", "time": "2020-01-22", "level": "", "num_look": 66745, "num_comment": 66745, "author": "Kriston", "tags": ["网络安全"], "text": "最近发现一些恶意软件活动影响了许多运行Linux的设备，该平台今年刚刚解决了许多问题。"}
{"title": "瑞星2019年中国网络安全报告", "url": "https://www.freebuf.com/articles/paper/225741.html", "time": "2020-01-22", "level": "", "num_look": 194578, "num_comment": 194578, "author": "瑞星", "tags": ["安全报告"], "text": "2019年瑞星“云安全”系统共截获病毒样本总量1.03亿个，病毒感染次数4.38亿次，病毒总体数量比2018年同期上涨32.69%。"}
{"title": "云上零信任网络：从传统安全范围到软件定义范围", "url": "https://www.freebuf.com/articles/network/224582.html", "time": "2020-01-22", "level": "金币+8", "num_look": 61816, "num_comment": 1, "author": "130421106", "tags": ["网络安全"], "text": "安全边界曾被视为安全分界线内部的区域，该区域将那些在区域外部被认为是不安全或不受信任的因素与内部被认为安全或受信任的因素隔离开。"}
{"title": "土耳其图兰军宣称将于今日下午三点攻击中国站点", "url": "https://www.freebuf.com/news/225962.html", "time": "2020-01-22", "level": "红色标题", "num_look": 282246, "num_comment": 17, "author": "Akane", "tags": ["网络安全", "资讯"], "text": "土耳其图兰军又开始了，1月21日晚23:00左右，他们宣称将于22日下午15:00，集中对中国站点进行ddos攻击，并在网页下方提供了相关的部分攻击工具，以及攻击用服务器。"}
{"title": "Windows身份认证及利用思路", "url": "https://www.freebuf.com/articles/system/224171.html", "time": "2020-01-22", "level": "", "num_look": 120465, "num_comment": 2, "author": "DigApis", "tags": ["系统安全"], "text": "在进行本地登录认证时操作系统会使用用户输入的密码作为凭证去与系统中的密码进行对比验证。"}
{"title": "浅析如何让你的Responder更强大之增强篇", "url": "https://www.freebuf.com/sectool/224282.html", "time": "2020-01-22", "level": "金币+8", "num_look": 124509, "num_comment": 2, "author": "Wreck1t", "tags": ["工具"], "text": "前几天写过一篇关于Responder的文章《浅析如何让你的Responder更强大》。在那篇文章中，我们修复了Responder 实现的SMBv1&SMBv2的问题。"}
{"title": "FreeBuf早报 | 乌克兰政府招聘官网曝出网络安全事件；NIST发布了隐私框架的1.0版；FTCODE勒索软件再升级", "url": "https://www.freebuf.com/news/225952.html", "time": "2020-01-22", "level": "红色标题", "num_look": 52132, "num_comment": 52132, "author": "shidongqi", "tags": ["资讯"], "text": "乌克兰政府招聘门户官网近日被爆出现公民信息被泄漏事件，当地官员声称他们已经发现并修复了他们所说的“漏洞”。"}
{"title": "新型冠状病毒肺炎可人传人，请广大Buffer注意预防", "url": "https://www.freebuf.com/news/225932.html", "time": "2020-01-21", "level": "红色标题", "num_look": 105150, "num_comment": 5, "author": "Sandra1432", "tags": ["资讯"], "text": "临近春节，一场突如其来的新型冠状病毒肺炎打乱了人们的过节计划。昨日晚间，钟南山院士接受央视采访，向公众通报疫情情况，确认新型冠状病毒肺炎呈现人传人特点。"}
{"title": "挖洞经验 | 用浏览器缓存绕过同源策略（SOP）限制", "url": "https://www.freebuf.com/vuls/224601.html", "time": "2020-01-21", "level": "", "num_look": 75430, "num_comment": 75430, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文分享的Writeup是作者在做Keybase.io的漏洞众测中发现的SOP（同源策略）绕过漏洞，由于Keybase.io在用的多个API端点都启用了CORS（跨域资源共享）机制，这种缓解同源策略的机制某种程度上克服了同源策略的严格限…"}
{"title": "论单位或个人应急演练的重要性", "url": "https://www.freebuf.com/articles/system/224742.html", "time": "2020-01-21", "level": "金币+8", "num_look": 139022, "num_comment": 2, "author": "竹林再遇北极熊", "tags": ["企业安全", "系统安全"], "text": "把应用系统安全作为比较对象，分析应急演练和攻防演练的区别。"}
{"title": "企业进入年度总结，谨防TrickBot木马窃取信息", "url": "https://www.freebuf.com/articles/terminal/224581.html", "time": "2020-01-21", "level": "", "num_look": 63408, "num_comment": 63408, "author": "亚信安全", "tags": ["终端安全"], "text": "TrickBot木马最早发现于2016年，早期是一款专门针对银行发动攻击的木马程序，其攻击目标包括400余家知名国际银行。"}
{"title": "断网超过150天，克什米尔终于部分恢复互联网", "url": "https://www.freebuf.com/news/225734.html", "time": "2020-01-21", "level": "", "num_look": 49718, "num_comment": 2, "author": "kirazhou", "tags": ["资讯"], "text": "克什米尔至今断网已经近5个月，超过150天。这是目前印度持续时间最长的断网事件。"}
{"title": "云工作负载安全（泛主机安全）2019年度安全报告：探讨广泛用户的IT场景安全", "url": "https://www.freebuf.com/articles/paper/225898.html", "time": "2020-01-21", "level": "", "num_look": 162659, "num_comment": 162659, "author": "安全狗safedog", "tags": ["安全报告"], "text": "近年来，随着网络攻防向攻击方倾斜，各类高危漏洞(0day、1day、Nday)快速武器化，APT定向攻击泛滥，勒索和挖矿病毒肆虐猖獗。"}
{"title": "关于Java中的RMI-IIOP", "url": "https://www.freebuf.com/geek/224262.html", "time": "2020-01-21", "level": "", "num_look": 147199, "num_comment": 147199, "author": "知道创宇404实验室", "tags": ["极客"], "text": "在写完《Java中RMI、JNDI、LADP、JRMP、JMX、JMS那些事儿（上）》的时候，又看到一个包含RMI-IIOP的议题，在16年Blackhat JNDI注入议题中也提到了这个协议的利用，当时想着没太看到或听说有多少关于IIOP的漏洞。"}
{"title": "使用VC2017+IDA模拟复现CVE-2017-11882缓冲区溢出", "url": "https://www.freebuf.com/vuls/224934.html", "time": "2020-01-21", "level": "金币+15", "num_look": 70840, "num_comment": 70840, "author": "花仙子", "tags": ["漏洞"], "text": "缓冲区溢出是一种非常普遍的漏洞，广泛存在于操作系统和各种应用软件中。"}
{"title": "FreeBuf早报 | 欧洲隐私数据保护法催生1.3亿美元罚款，通告16万起侵权行为；隐私保护升级！苹果iPhone 11彻底关闭位置跟踪；Citrix发布针对ADC 11.1和12.0中CVE-2019-19781漏洞的永久修复程序", "url": "https://www.freebuf.com/news/225906.html", "time": "2020-01-21", "level": "红色标题", "num_look": 44295, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "近日，据Hindenburg Research发布研究报告显示，Opera向Google Play提交了多个贷款APP，其贷款期限与利率均违反了商店规定。"}
{"title": "基于机器学习的恶意软件加密流量检测研究分享", "url": "https://www.freebuf.com/news/231059.html", "time": "2020-01-20", "level": "", "num_look": 95226, "num_comment": 95226, "author": "斗象智能安全平台", "tags": ["资讯"], "text": "本文将为大家介绍一种在不解密流量的情况，可以高精度地检测恶意软件HTTPS流量的技术。"}
{"title": "【FreeBuf字幕组】Hacker101白帽黑客进阶之路-会话固定、点击劫持、文件包含分析", "url": "https://www.freebuf.com/video/225882.html", "time": "2020-01-20", "level": "红色标题", "num_look": 155951, "num_comment": 2, "author": "willhuang", "tags": ["视频"], "text": "本节课程，我们一起来简单讨论会话固定（Session Fixation）、点击劫持（ClickJacking）和文件包含（File Inclusion）三种攻击形式的成因、检测和缓解措施。"}
{"title": "腾讯科恩实验室招聘安全人才", "url": "https://www.freebuf.com/jobs/225893.html", "time": "2020-01-20", "level": "", "num_look": 90456, "num_comment": 3, "author": "腾讯安全科恩实验室", "tags": ["安全招聘"], "text": "腾讯科恩实验室作为腾讯集团云与智慧产业事业群旗下一支国际一流的信息安全团队，技术实力和科研成果处于国际领先水平。"}
{"title": "阿拉伯木马成功汉化，多款APP惨遭模仿用于攻击", "url": "https://www.freebuf.com/articles/terminal/224438.html", "time": "2020-01-20", "level": "", "num_look": 101230, "num_comment": 8, "author": "奇安信威胁情报中心", "tags": ["终端安全"], "text": "近日，奇安信病毒响应中心在日常样本监控过程中发现了一批伪装成点读通.apk、作业帮.apk、手机找回.apk、PUBG.apk等国内用户常用软件的MobiHok家族样本。"}
{"title": "内网渗透实验：基于Cobaltstrike的一系列实验", "url": "https://www.freebuf.com/vuls/224507.html", "time": "2020-01-20", "level": "现金奖励", "num_look": 154564, "num_comment": 6, "author": "绿帽子技术分享", "tags": ["漏洞", "终端安全"], "text": "去年年初发了一篇文章Web渗透实验：基于Weblogic的一系列漏洞，今年把这篇文章接力写一下。"}
{"title": "SDL软件安全开发流程总结", "url": "https://www.freebuf.com/articles/es/225001.html", "time": "2020-01-20", "level": "金币+15", "num_look": 173958, "num_comment": 8, "author": "山城安全MTSec", "tags": ["企业安全"], "text": "现在有很多公司SDL的流程刚刚起步，我想分享一下自己在SDL中的一些经验。由于经验尚浅，无法估量整个 SDL的建设情况，以下只是自己在工作中的理解和拍脑袋的想法，请各位大佬指点。"}
{"title": "FreeBuf早报 | 黑客泄露了超过50万台服务器、路由器和IoT设备的密码；黑客给思杰服务器打补丁以部署自己的后门；土耳其黑客袭击了希腊政府网站和当地证券交易所", "url": "https://www.freebuf.com/news/225849.html", "time": "2020-01-20", "level": "", "num_look": 80525, "num_comment": 2, "author": "kirazhou", "tags": ["资讯"], "text": "黑客在一个论坛上发布了大量的Telnet凭据列表，这些凭据用于超过515000台服务器、家用路由器和IoT智能设备。"}
{"title": "Redis未授权访问漏洞复现", "url": "https://www.freebuf.com/vuls/223432.html", "time": "2020-01-19", "level": "金币+15", "num_look": 135957, "num_comment": 18, "author": "shineT", "tags": ["漏洞"], "text": "完整的漏洞复现及修复建议。"}
{"title": "硬核报告｜《发展网络安全能力》中文完整版发布", "url": "https://www.freebuf.com/articles/paper/225637.html", "time": "2020-01-19", "level": "金币+15", "num_look": 340294, "num_comment": 16, "author": "宇宸de研究室", "tags": ["安全报告"], "text": "历时半年多，利用业余时间，一点点啃完了整份报告的正文部分。关于后边引用的资料和附件部分没有翻译，意义不是很大。本研究报告推荐阅读人群：CEO、CIO、CISO、合规安全研究员。"}
{"title": "渗透测试工程师视角下的渗透测试流程", "url": "https://www.freebuf.com/articles/network/224495.html", "time": "2020-01-19", "level": "现金奖励", "num_look": 176182, "num_comment": 9, "author": "星空111", "tags": ["网络安全"], "text": "大家应该都知道正规的渗透测试需要授权好多细节，尤其是在现如今这种法律高压下，细节就显得尤为重要了。"}
{"title": "血债黑站偿？美国斩首行动后伊朗民间报复性黑客活动的技术分析", "url": "https://www.freebuf.com/articles/system/224606.html", "time": "2020-01-19", "level": "", "num_look": 81064, "num_comment": 6, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "伊拉克时间1月3日凌晨，其首都巴格达国际机场附近遭到三枚导弹袭击，两部车辆被烧毁，造成至少7人死亡。"}
{"title": "阿里云发布《2019年DDoS攻击态势报告》", "url": "https://www.freebuf.com/articles/paper/225731.html", "time": "2020-01-19", "level": "", "num_look": 177030, "num_comment": 177030, "author": "阿里云安全", "tags": ["安全报告"], "text": "近日，阿里云正式发布《2019年DDoS攻击态势报告》，以下简称“报告”。"}
{"title": "FreeBuf早报 | 微软发布公告称 IE 0day 漏洞已遭利用，且无补丁；FBI查封被盗用户数据贩卖网站weleakinfo.com；欧盟考虑五年内禁止在公共场所使用人脸识别技术", "url": "https://www.freebuf.com/news/225801.html", "time": "2020-01-19", "level": "红色标题", "num_look": 57206, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "据外媒报道，欧盟委员会正在草拟一项计划，在3到5年时间里禁止在公共场所使用人脸识别技术，以便有时间研究如何防止这项技术被滥用。"}
{"title": "2019年移动安全总结", "url": "https://www.freebuf.com/articles/terminal/224992.html", "time": "2020-01-19", "level": "", "num_look": 175066, "num_comment": 3, "author": "奇安信威胁情报中心", "tags": ["终端安全"], "text": "随着2019年的逝去，二十一世纪第二个十年也已随之结束。回顾过去的十年，我们的生活随着科技的进步发生了翻天覆地的变化，这其中，手机就是其中一个最直观的表现。"}
{"title": "2019年汽车网络安全事件数量翻番，自2016年增加605%", "url": "https://www.freebuf.com/articles/terminal/224936.html", "time": "2020-01-19", "level": "红色标题", "num_look": 82535, "num_comment": 5, "author": "Sandra1432", "tags": ["终端安全", "网络安全"], "text": "Upstream Security发布了2020年《汽车网络安全报告》，深入统计相关数据，这些数据是针对过去十年中367起公开报道的汽车网络安全事件分析，重点是2019年发现的漏洞及分析。"}
{"title": "如何使用XSpear完成XSS扫描与参数分析", "url": "https://www.freebuf.com/articles/web/224933.html", "time": "2020-01-18", "level": "", "num_look": 82286, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "XSpear是一款功能强大的XSS扫描与参数分析工具，该工具基于Ruby开发，广大研究人员可以将XSpear作为一款XSS扫描工具来使用，并保证目标应用的安全。"}
{"title": "拼多多安全团队招聘直通车", "url": "https://www.freebuf.com/jobs/225192.html", "time": "2020-01-18", "level": "", "num_look": 89686, "num_comment": 9, "author": "拼多多", "tags": ["安全招聘"], "text": "拼多多隶属于上海寻梦信息技术有限公司，创立于2015年9月，是一家致力于为最广大用户提供物有所值的商品和有趣互动购物体验的“新电子商务”平台。"}
{"title": "僵尸网络中区块链的利用方法分析", "url": "https://www.freebuf.com/articles/network/224747.html", "time": "2020-01-18", "level": "", "num_look": 72395, "num_comment": 72395, "author": "DigApis", "tags": ["网络安全"], "text": "本文旨在归纳僵尸网络中区块链的利用方法。在区块链火热的大背景下，与各位安全同仁共同探讨，提前预警，提前防御。"}
{"title": "“软件供应链污染”新案例：FlashFXP破解版遭投毒攻击", "url": "https://www.freebuf.com/articles/system/225225.html", "time": "2020-01-18", "level": "", "num_look": 79847, "num_comment": 6, "author": "安全豹", "tags": ["系统安全"], "text": "近期毒霸安全团队通过“捕风”威胁感知系统监控到一起特殊的窃密后门攻击事件， 网络中广泛流传的“FlashFXP”破解版被黑客恶意篡改植入盗号后门，目前正在通过百度SEM诱导安装和定向钓鱼等方式广泛传播。"}
{"title": "BUF大事件丨微软修复了国家安全局上报的Windows严重漏洞；App年度报告刷屏背后：隐私问题引争议", "url": "https://www.freebuf.com/news/225698.html", "time": "2020-01-18", "level": "红色标题", "num_look": 192417, "num_comment": 1, "author": "Darry端", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，微软修复了国家安全局上报的Windows严重漏洞；App年度报告刷屏背后：隐私问题引争议；交通运输部等六部门:网约车平台采集的个人信息保存期限不少于2年。"}
{"title": "针对在有效数字证书内植入远控木马病毒分析报告", "url": "https://www.freebuf.com/articles/paper/224147.html", "time": "2020-01-18", "level": "", "num_look": 151377, "num_comment": 1, "author": "瑞星", "tags": ["安全报告"], "text": "由于病毒作者使用了“白加黑”劫持、进程注入、自身带有的有效的数字签名以及向系统导入自制根证书在内的多种手段来规避杀毒软件的查杀，故很难被察觉，一旦有受害者中招，将被植入“大灰狼”远程控制木马。"}
{"title": "千万不要打开XML！利用vscode构造RCE利用链分析", "url": "https://www.freebuf.com/articles/system/223168.html", "time": "2020-01-18", "level": "现金奖励", "num_look": 87158, "num_comment": 1, "author": "freexploit", "tags": ["系统安全"], "text": "LSP4XML是一个XML文件解析库，被VSCode/Eclipse/Theia等知名编辑器中使用。"}
{"title": "FreeBuf安全意识街采｜如果这是一场考试，你能拿几分？", "url": "https://www.freebuf.com/video/225743.html", "time": "2020-01-17", "level": "红色标题", "num_look": 193987, "num_comment": 8, "author": "willhuang", "tags": ["视频"], "text": "为了培养广大用户对于网络安全问题的防范意识，FreeBuf 小分队针对网民的上网安全意识与习惯，安全知识的关注与学习，网络诈骗防范意识，网络诈骗心理影响，安全软件的使用和密码管理等方面进行了街头采访。"}
{"title": "FreeBuf精品公开课讲师招募 | 确认过眼神，你就是对的人！", "url": "https://www.freebuf.com/open/225470.html", "time": "2020-01-17", "level": "", "num_look": 73940, "num_comment": 73940, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "一身挖洞神技无人知晓渗透、二进制、Python样样能玩转周末却只能一个人在家玩面包板请停止挥霍自己的年华请不要埋没自己的优秀加入FreeBuf公开课讲师团队让你的知识技术更有价值。"}
{"title": "Turbolist3r：一款带有域名分析与发现功能的子域名枚举工具", "url": "https://www.freebuf.com/sectool/224894.html", "time": "2020-01-17", "level": "", "num_look": 110720, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Turbolist3r是子域名发现工具sublist3r的一个分支，除了sublist3r原始的资源情报收集功能之外，Turbolist3r还集成了一些针对子域名发现的自动化分析功能。"}
{"title": "外挂盯上支付宝：集福神器、蚂蚁森林外挂泛滥", "url": "https://www.freebuf.com/articles/terminal/225652.html", "time": "2020-01-17", "level": "红色标题", "num_look": 132542, "num_comment": 12, "author": "GEETEST极验", "tags": ["游戏安全", "终端安全"], "text": "一大早，基友狗蛋就在朋友圈狂刷两条动态。是的，又到年底了，支付宝开始集福了。"}
{"title": "仿冒“百度、微信”应用的风险提示", "url": "https://www.freebuf.com/articles/terminal/224577.html", "time": "2020-01-17", "level": "", "num_look": 69211, "num_comment": 3, "author": "暗影安全实验室", "tags": ["终端安全"], "text": "随着移动互联网的快速发展，用户可以“随时、随地、随心”地享受互联网业务带来的便捷，不管是工作、娱乐、生活、购物等方方方面都在使用着各种APP，既省时又省力的为我们提供很多方便。"}
{"title": "奇安信CERT(A-TEAM)期待您的加入", "url": "https://www.freebuf.com/jobs/225229.html", "time": "2020-01-17", "level": "", "num_look": 88965, "num_comment": 3, "author": "simia1992", "tags": ["安全招聘"], "text": "HuntingTeam隶属奇安信CERT(A-TEAM)旗下，是一支高质量的高级威胁研究发现溯源、产品赋能团队。"}
{"title": "极验2019交互安全行业研究报告", "url": "https://www.freebuf.com/articles/paper/225621.html", "time": "2020-01-17", "level": "", "num_look": 139930, "num_comment": 2, "author": "GEETEST极验", "tags": ["安全报告"], "text": "2019 年已经过去，在过去的一年，经济下行对各个行业带来地冲击有目共睹，以数字货币带动的整个区块链行业昙花一现之后几乎销声匿迹。"}
{"title": "从苹果入局卫星通信，看硅谷大佬掀起的新一轮“太空竞赛”", "url": "https://www.freebuf.com/news/224213.html", "time": "2020-01-17", "level": "", "num_look": 54651, "num_comment": 3, "author": "0day情报局", "tags": ["资讯"], "text": "如果说发生在美苏冷战时期的那场“太空竞赛”，已经是半世纪前的老黄历，那么最近几年，一帮硅谷大佬的“太空梦”又催生新一轮太空竞赛。"}
{"title": "FreeBuf早报 | 试用APP三天后直接扣款：全球将近6亿Android用户中招；Satan勒索软件沉寂后，5ss5c勒索软件出现；六银行App遭点名，监管开出罕见数据治理罚单", "url": "https://www.freebuf.com/news/225692.html", "time": "2020-01-17", "level": "红色标题", "num_look": 73013, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "据外媒消息，社交媒体Instagram曾多次出现冒名的英国知名财经门户网站“省钱专家”的创始人Martin Lewis的欺诈广告。"}
{"title": "基于DNS的数据泄露开源测试工具篇（四）", "url": "https://www.freebuf.com/sectool/224233.html", "time": "2020-01-17", "level": "", "num_look": 92429, "num_comment": 1, "author": "DigApis", "tags": ["工具"], "text": "本文将讨论最后一个开源工具Egress-Assess。"}
{"title": "浅论无人机信息安全威胁", "url": "https://www.freebuf.com/news/224578.html", "time": "2020-01-17", "level": "", "num_look": 79973, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "无人机已经从军用领域走向工业生产和人们的日常生活。Gartner的最新预测表明，到2020年，企业将更频繁地部署无人机。"}
{"title": "对美国联邦存储图书馆网站被攻击挂黑页事件的简要技术分析", "url": "https://www.freebuf.com/articles/neopoints/224824.html", "time": "2020-01-16", "level": "", "num_look": 185702, "num_comment": 4, "author": "clouds", "tags": ["观点"], "text": "这种挂黑页的行为并不足为奇，尤其在过去几年一些带有宗教政治宣传的黑客攻击中屡屡出现，但正好这件事情如此突然，被炒得像是拉开网络战的前奏，所以借此机会，从威胁情报视角，来对它做个简要的技术分析。"}
{"title": "谷歌宣布iPhone可以兼作Google账户的安全密钥", "url": "https://www.freebuf.com/news/225627.html", "time": "2020-01-16", "level": "", "num_look": 50122, "num_comment": 50122, "author": "Sandra1432", "tags": ["资讯"], "text": "谷歌宣布，iOS 10或更高版本的iPhone现在可以用作安全密钥，无需配对即可验证登录Chrome OS、iOS、macOS和Windows 10设备，保护Google账户免受网络钓鱼攻击。"}
{"title": "下一个十年，隐蔽且威胁无边的关键基础设施攻击", "url": "https://www.freebuf.com/articles/ics-articles/224313.html", "time": "2020-01-16", "level": "", "num_look": 205589, "num_comment": 2, "author": "0day情报局", "tags": ["工控安全"], "text": "针对关键基础设施攻击，在我看来，是可与 “911”划等号的威胁。回顾2019年，关键基础设施攻击此起彼伏。"}
{"title": "开源WAF的建设架构说明与应急预案", "url": "https://www.freebuf.com/articles/web/224472.html", "time": "2020-01-16", "level": "现金奖励", "num_look": 141618, "num_comment": 6, "author": "煜阳yuyang", "tags": ["WEB安全"], "text": "之前有在体系建设中写到开源WAF的利用，本次就继续这个话题给出使用手册+应急预案来做生产级开源WAF的支撑。"}
{"title": "Go语言代码安全审计分享", "url": "https://www.freebuf.com/articles/web/224363.html", "time": "2020-01-16", "level": "现金奖励", "num_look": 173958, "num_comment": 13, "author": "随便看看", "tags": ["WEB安全"], "text": "由于Go语言代码审计资料较少，这里就把最近学习的对Vulnerability-goapp项目的审计过程分享一下。"}
{"title": "“正版”监控软件被黑产利用，输出把关不严或成另一个TeamViewer？", "url": "https://www.freebuf.com/articles/system/225335.html", "time": "2020-01-16", "level": "", "num_look": 96508, "num_comment": 2, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "近日，奇安信病毒响应中心在日常跟踪黑产团伙过程中，发现了一个利用正规监控软件窃取用户信息，甚至监控聊天记录的黑客团伙。"}
{"title": "揭露电信诈骗之悄无声息的转走资金", "url": "https://www.freebuf.com/articles/terminal/223878.html", "time": "2020-01-16", "level": "", "num_look": 93491, "num_comment": 4, "author": "暗影安全实验室", "tags": ["终端安全"], "text": "近几年电信诈骗事件层出不穷，针对2019年6月13日发生的电信诈骗案例“我被电信诈骗53万！却无从追回”。暗影实验室通过分析该案例中涉及的仿冒APP来揭露案件面貌还原真相，以提醒更多用户谨慎下载使用来路不明的应用…"}
{"title": "FreeBuf早报 | WordPress插件中的严重安全漏洞影响320000个网站；黑客出售美国数据经纪商LimeLeads的4900万条用户记录；澳大利亚银行P&N Bank数据泄露", "url": "https://www.freebuf.com/news/225583.html", "time": "2020-01-16", "level": "红色标题", "num_look": 55169, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "WordPress的2个插件：InfiniteWP和WP Time Capsule存在严重安全漏洞，预计影响32万个网站。"}
{"title": "Kali Linux认证专家考前培训指南", "url": "https://www.freebuf.com/articles/system/223975.html", "time": "2020-01-16", "level": "金币+8", "num_look": 94605, "num_comment": 3, "author": "c9t9h5", "tags": ["系统安全"], "text": "本文是结合笔者多年网络安全工作经验，并参照这本Kali Linux官方教程《Kali Linux Revealed》，献给信息安全爱好者及想参加Kali Linux Certified Professional (KLCP) Kali Linux认证专家考试的同学。"}
{"title": "专访联想耿晶鑫：在智能物联时代下，共建产品安全创新生态", "url": "https://www.freebuf.com/articles/people/225539.html", "time": "2020-01-16", "level": "", "num_look": 162175, "num_comment": 162175, "author": "Sandra1432", "tags": ["人物志"], "text": "5G、物联网、人工智能等新一代技术相互赋能，在信息融合的时代下技术创新力逐渐成为社会生产和发展的动力。"}
{"title": "“微软超级漏洞”？关于CVE-2020-0601的官方回复", "url": "https://www.freebuf.com/vuls/225524.html", "time": "2020-01-15", "level": "红色标题", "num_look": 237800, "num_comment": 237800, "author": "kirazhou", "tags": ["漏洞"], "text": "在微软例行公布了的1 月的补丁更新列表中，有一个漏洞引起了大家的高度关注：一个位于 CryptoAPI.dll 椭圆曲线密码 ( ECC ) 证书的验证绕过漏洞——CVE-2020-0601。"}
{"title": "s3tk：一款针对Amazon S3的安全审计套件", "url": "https://www.freebuf.com/articles/network/224931.html", "time": "2020-01-15", "level": "", "num_look": 71679, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "s3tk是一款针对Amazon S3的安全审计套件，广大安全研究人员可以使用s3tk来对Amazon S3 Bucket进行安全测试。"}
{"title": "数据隐私不仅仅是指机密性", "url": "https://www.freebuf.com/articles/database/225311.html", "time": "2020-01-15", "level": "金币+15", "num_look": 116553, "num_comment": 2, "author": "两块", "tags": ["数据安全"], "text": "考虑到数据使用的方式，我们需要将更多的精力放在保护数据的完整性和可用性上。"}
{"title": "AppleJeus行动分析", "url": "https://www.freebuf.com/articles/network/225140.html", "time": "2020-01-15", "level": "", "num_look": 71657, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "Lazarus组织是目前最活跃的APT组织之一。 2018年，卡巴斯基针发现由该组织发起的名为AppleJeus的攻击行动。"}
{"title": "MZP勒索软件分析", "url": "https://www.freebuf.com/articles/network/225298.html", "time": "2020-01-15", "level": "", "num_look": 69510, "num_comment": 69510, "author": "兰云科技银河实验室", "tags": ["网络安全"], "text": "近日，兰云科技银河实验室通过“兰眼下一代威胁感知系统”发现一款新型勒索软件 —— MZP 勒索软件，也可叫作 Dot 勒索软件，最早由 AmigoA 和 AkhmendTaia 在 2019 年 12 月 31 日首次发现。"}
{"title": "渗透技巧之Powershell实战思路", "url": "https://www.freebuf.com/articles/web/220046.html", "time": "2020-01-15", "level": "金币+15", "num_look": 171637, "num_comment": 10, "author": "CSeroad", "tags": ["WEB安全"], "text": "早就听闻powershell是一个功能强大的shell，如同linux的bash，并且支持.NET，全凭命令操作windows服务。现被更广泛用于渗透攻击等方面，在不需要写入磁盘的情况下执行命令，也可以逃避Anti-Virus检测。"}
{"title": "FreeBuf早报 | 微软正式终止支持Win7；博通芯片组件惊现内核级漏洞；日本用量子保密通信技术传输大量基因组数据", "url": "https://www.freebuf.com/news/225403.html", "time": "2020-01-15", "level": "红色标题", "num_look": 56694, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": "博通（Broadcom）调制解调器芯片曝出内核级安全漏洞，该漏洞为Cable Haunt（CVE-2019-19494）。利用该漏洞，攻击者可以通过端点，远程控制且完全控制调制解调器。"}
{"title": "Office控件钓鱼：混淆拼接篇", "url": "https://www.freebuf.com/articles/es/224347.html", "time": "2020-01-15", "level": "金币+15", "num_look": 112688, "num_comment": 7, "author": "꧁", "tags": ["企业安全"], "text": "钓鱼邮件作为APT常用手法之一，手法层出不穷，各大企业和组织的安全部门也把钓鱼防控列为重点。"}
{"title": "Tishna：一款功能强大的自动化Web应用渗透测试框架", "url": "https://www.freebuf.com/articles/web/224920.html", "time": "2020-01-14", "level": "", "num_look": 127975, "num_comment": 7, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "Tishna是一款功能强大的自动化Web应用渗透测试框架，广大Web安全研究人员可使用该工具来对Web服务器以及应用程序层来进行安全分析。"}
{"title": "CSRF攻击防御原理", "url": "https://www.freebuf.com/articles/web/224446.html", "time": "2020-01-14", "level": "现金奖励", "num_look": 886495, "num_comment": 12, "author": "糖果L5Q", "tags": ["WEB安全"], "text": "因为现代浏览器的工作机制原因，造成一种WEB攻击形态的存在， 这种攻击形式叫做CSRF攻击，以往我们是从攻击角度分析这种攻击的原理和操作。"}
{"title": "机器学习之恶意流量检测的特征工程", "url": "https://www.freebuf.com/articles/web/223481.html", "time": "2020-01-14", "level": "现金奖励", "num_look": 134713, "num_comment": 4, "author": "邹先生007", "tags": ["WEB安全", "网络安全"], "text": "传统的机器学习除了使用Tfidf-ngram的方式外还有其他做特征工程方式，还可以通过定义不同维度的特征来做特征工程，这种特征工程方式需要安全工程师对每一种攻击有良好特征提取能力。"}
{"title": "FreeBuf早报 | MageCart袭击澳大利亚丛林大火慈善捐助网站；Google Play商店删除了1700多个被Joker 恶意软件感染的应用程序；国家计算机病毒应急处理中心：监测发现24款违法App", "url": "https://www.freebuf.com/news/225289.html", "time": "2020-01-14", "level": "红色标题", "num_look": 71056, "num_comment": 4, "author": "Sandra1432", "tags": ["资讯"], "text": "Google透露，它在过去三年中成功从Play商店中删除了1700多个被Joker恶意软件感染的应用程序。Joker恶意软件是伪装成系统应用程序的恶意代码，它使攻击者能够执行很多的恶意操作。"}
{"title": "Hessian反序列化RCE漏洞复现及分析", "url": "https://www.freebuf.com/vuls/224280.html", "time": "2020-01-14", "level": "金币+15", "num_look": 115156, "num_comment": 2, "author": "21superman", "tags": ["WEB安全", "漏洞"], "text": "Hessian是一个轻量级的RPC框架。它基于HTTP协议传输，使用Hessian二进制序列化，对于数据包比较大的情况比较友好。"}
{"title": "MultiScanner：一款功能强大的模块化文件扫描与分析框架", "url": "https://www.freebuf.com/articles/system/224909.html", "time": "2020-01-13", "level": "", "num_look": 89403, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "MultiScanner是一款功能强大的文件分析框架，可帮助用户自动化对大量文件集进行分析，并聚合输出分析结果。"}
{"title": "揭秘Agent Tesla间谍木马攻击活动", "url": "https://www.freebuf.com/articles/terminal/223968.html", "time": "2020-01-13", "level": "", "num_look": 90243, "num_comment": 4, "author": "亚信安全", "tags": ["终端安全"], "text": "这些攻击活动使用的邮件附件通常是伪装成系统镜像ISO文件（亚信安全检测为Mal_GENISO）以及RAR和LZH压缩文档，其中包括使用AutoIt编译和.NET编译的Agent Tesla间谍木马（也被称为Negasteal）。"}
{"title": "FreeBuf早报 | 50多家组织致信谷歌：允许用户卸载所有Android预装应用程序；监控厂商向警方兜售墓碑上的摄像头；Sodinokibi勒索软件首次发布被盗数据", "url": "https://www.freebuf.com/news/225130.html", "time": "2020-01-13", "level": "红色标题", "num_look": 72929, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "近日，Alphabet和Google首席执行官Sundar Pichai发出公开信，就Android设备预装软件所存在的漏洞以及它们如何给消费者带来隐私风险表明了自己的立场。"}
{"title": "记一次Redis+Getshell经验分享", "url": "https://www.freebuf.com/vuls/224235.html", "time": "2020-01-12", "level": "金币+20", "num_look": 197195, "num_comment": 12, "author": "ch8411", "tags": ["漏洞"], "text": "当我们接到一个授权渗透测试的时候，常规漏洞如注入、文件上传等尝试无果后，扫描端口可能会发现意外收获。"}
{"title": "APT32样本分析", "url": "https://www.freebuf.com/articles/network/223654.html", "time": "2020-01-12", "level": "", "num_look": 92285, "num_comment": 4, "author": "北京计算机技术及应用研究所", "tags": ["网络安全"], "text": "本次攻击时使用恶意宏代码的方式来加载恶意模块，并通过社会工程学的方式伪装成360的提示信息来博取用户的信任，从而诱骗用户启用恶意宏代码。"}
{"title": "智能门铃背后的安全风险", "url": "https://www.freebuf.com/articles/system/223468.html", "time": "2020-01-12", "level": "", "num_look": 90533, "num_comment": 2, "author": "Sandra1432", "tags": ["系统安全"], "text": "虽然“黑色星期五”和“网络星期一”已经结束，但更大的购物浪潮还在后面，一年中总有可以让快递包裹在门口和走廊堆积如山的时候。"}
{"title": "一款优秀的XSS批量检测工具", "url": "https://www.freebuf.com/sectool/223009.html", "time": "2020-01-11", "level": "金币+20", "num_look": 210229, "num_comment": 9, "author": "帕克飞走了", "tags": ["工具"], "text": "NoXss是一个供web安全工程师批量检测xss隐患的脚本工具。"}
{"title": "Snake勒索软件正在威胁全球的企业网络", "url": "https://www.freebuf.com/news/225062.html", "time": "2020-01-11", "level": "", "num_look": 74705, "num_comment": 1, "author": "kirazhou", "tags": ["资讯"], "text": "Snake是一种新的勒索软件，它正和最流行的勒索软件家族（如Ryuk，Maze，Sodinokibi，LockerGoga，BitPaymer，DoppelPaymer，MegaCortex和LockerGoga）一起威胁着全球。"}
{"title": "电诈团伙的千里眼：伪装成银监会移动端的恶意APP分析", "url": "https://www.freebuf.com/articles/terminal/223585.html", "time": "2020-01-11", "level": "", "num_look": 286454, "num_comment": 1, "author": "奇安信威胁情报中心", "tags": ["终端安全"], "text": "近日，奇安信病毒响应中心在日常移动样本监控过程中发现一款伪装名为“CBRC”的APP。"}
{"title": "BUF大事件丨手机QQ显示实时电量会泄露隐私？腾讯回应称不用担心；超500万台新手机被植入木马病毒，涉31省市4500种机型", "url": "https://www.freebuf.com/news/225095.html", "time": "2020-01-11", "level": "红色标题", "num_look": 199499, "num_comment": 3, "author": "Darry端", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，手机QQ显示实时电量会泄露隐私？腾讯回应称不用担心；超500万台新手机被植入木马病毒，涉31省市4500种机型；微信发原图会泄露个人信息，建议P个图再发。"}
{"title": "机器学习与恶意代码检测", "url": "https://www.freebuf.com/articles/others-articles/224051.html", "time": "2020-01-11", "level": "", "num_look": 80062, "num_comment": 80062, "author": "东巽科技2046Lab", "tags": ["其他"], "text": "业界公认人工智能的起源是1956年的达特茅斯会议。出席这次会议的有麦卡锡、明斯基、香农、所罗门诺夫、纽厄尔、司马贺、西蒙、撒缪尔、塞弗里奇、罗切斯特、和摩尔，可谓人才济济。"}
{"title": "基于AFL的Java程序Fuzz工具：Kelinci", "url": "https://www.freebuf.com/sectool/224294.html", "time": "2020-01-10", "level": "金币+20", "num_look": 132945, "num_comment": 1, "author": "成王败寇", "tags": ["工具"], "text": "Fuzzing一直以来是漏洞挖掘非常有效的方式，我最喜欢的工具仍然是经久不衰的AFL，你可以基于AFL来打造各种fuzz工具，当然这得益于AFL中最具有魔性的遗传算法corpus变异。"}
{"title": "2019年网络攻击分析报告", "url": "https://www.freebuf.com/articles/network/224409.html", "time": "2020-01-10", "level": "", "num_look": 146621, "num_comment": 2, "author": "Kriston", "tags": ["网络安全"], "text": "此报告使用的数据来自203个国家和地区，统计时间自2018年11月至2019年10月。"}
{"title": "绿盟科技（社招）驻场岗位招聘简章", "url": "https://www.freebuf.com/jobs/223044.html", "time": "2020-01-10", "level": "", "num_look": 117557, "num_comment": 9, "author": "wangchuanzhen", "tags": ["安全招聘"], "text": "绿盟科技始终专注于网络安全技术的研究，是中国网络安全领域的技术领先者。基于所掌握的核心技术，我们已形成围绕安全威胁管理、安全内容管理、漏洞评估及合规管理和综合安全审计等领域的产品家族。"}
{"title": "谷歌Project Zero漏洞披露政策变更，建议满90天后再公开", "url": "https://www.freebuf.com/news/225059.html", "time": "2020-01-10", "level": "红色标题", "num_look": 51082, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "谷歌Project Zero网络安全团队试行一项新政策，该政策表明在即时漏洞修复之后也不会过早地披露漏洞细节。该缓冲期默认为90天，这意味着无论何时修复漏洞，都要求期满后才能披露漏洞细节。"}
{"title": "MITRE发布首个针对工业控制系统（ICS）的ATT＆CK知识库", "url": "https://www.freebuf.com/news/224982.html", "time": "2020-01-10", "level": "", "num_look": 100161, "num_comment": 4, "author": "kirazhou", "tags": ["资讯"], "text": "1月7日，MITER发布了ATT＆CK for ICS知识库，主要介绍了网络攻击者在攻击工业控制系统（ICS）时所使用的策略和技术，为关键基础设施和其他使用工业控制系统的组织评估网络风险提供了参考。"}
{"title": "基于DNS的数据泄露开源测试工具篇（三）", "url": "https://www.freebuf.com/sectool/223929.html", "time": "2020-01-10", "level": "", "num_look": 125382, "num_comment": 1, "author": "DigApis", "tags": ["工具"], "text": "在基于DNS的数据窃取开源工具篇(一)和基于DNS的数据窃取开源工具篇(二)中，已经讨论DET和PyExfil两个开源项目关于利用DNS完成数据窃取的部分。"}
{"title": "ATT&CK之防御逃逸", "url": "https://www.freebuf.com/articles/network/223910.html", "time": "2020-01-10", "level": "红色标题", "num_look": 156982, "num_comment": 3, "author": "alphalab", "tags": ["网络安全"], "text": "基于MITRE ATT&CK框架中关于“防御逃逸”（Defense Evasion）的战术专题，笔者将深入介绍其中大部分防御逃逸手段的技术原理、检测方法及缓解方案。"}
{"title": "FreeBuf早报｜三星手机漏洞遭黑客利用；Mozilla 释出补丁修复一个正被利用的 Firefox 漏洞；报告显示WannaCry依然是最让人头疼的勒索软件", "url": "https://www.freebuf.com/news/225038.html", "time": "2020-01-10", "level": "", "num_look": 75676, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "Dispatch发布的一份报告显示，一些一线演员、偶像，甚至是一名著名厨师，都曾遭到了黑客的勒索。这些黑客通过三星旗舰Galaxy手机上的一个漏洞获取了这些受害者的私人数据。"}
{"title": "应急响应日志分析小脚本", "url": "https://www.freebuf.com/sectool/223446.html", "time": "2020-01-10", "level": "现金奖励", "num_look": 144111, "num_comment": 8, "author": "菜鸟的菜", "tags": ["工具"], "text": "能不能利用脚本去完成一些常规的排查过程，来辅助完成日志分析工作。"}
{"title": "重磅 | FreeBuf 「企业安全产品名录」今天正式上线", "url": "https://www.freebuf.com/news/topnews/224592.html", "time": "2020-01-09", "level": "红色标题", "num_look": 322460, "num_comment": 3, "author": "FB独家", "tags": ["头条", "特别企划"], "text": "不搞排名、实时更新、免费使用、免费入驻的「企业安全产品名录」上线啦～"}
{"title": "挖洞经验 | 利用越权漏洞窃取Airbnb房东的收款资金", "url": "https://www.freebuf.com/vuls/224431.html", "time": "2020-01-09", "level": "", "num_look": 118389, "num_comment": 6, "author": "clouds", "tags": ["漏洞"], "text": "今天分享的Writeup是作者在2017年发现，在最近披露的Airbnb平台漏洞，漏洞类型为越权（IDOR）。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列：John Colston", "url": "https://www.freebuf.com/video/224913.html", "time": "2020-01-09", "level": "红色标题", "num_look": 162051, "num_comment": 1, "author": "willhuang", "tags": ["视频"], "text": "自2018年接触了漏洞众测之后，John Colston就一发不可收拾，被Hacking技术深深吸引，经常花大量时间进行漏洞分析测试，仅用了一年多，他就在HackerOne平台发现了130多个有效漏洞。"}
{"title": "Python代码审计实战案例总结之CRLF和任意文件读取", "url": "https://www.freebuf.com/vuls/222679.html", "time": "2020-01-09", "level": "现金奖励", "num_look": 125676, "num_comment": 9, "author": "米怀特", "tags": ["WEB安全", "漏洞"], "text": "目前Python代码审计思路，呈现分散和多样的趋势。Python微薄研发经验以及结合实际遇到的思路和技巧进行总结，以便于朋友们的学习和参考。"}
{"title": "从0开始策划ISO 27001制度文件", "url": "https://www.freebuf.com/articles/es/223645.html", "time": "2020-01-09", "level": "现金奖励", "num_look": 130288, "num_comment": 7, "author": "softgirl", "tags": ["企业安全"], "text": "从业多年，有幸在某家企业从0开始建设ISO 27001，整个过程有收益良多。本篇文章跟大家分享一下ISO 27001的制度文件策划，希望能帮到正在建设ISO 27001或比较迷茫的人。"}
{"title": "抖音海外版TikTok修复多个严重安全漏洞", "url": "https://www.freebuf.com/vuls/224963.html", "time": "2020-01-09", "level": "金币+15", "num_look": 127687, "num_comment": 3, "author": "黑鸟", "tags": ["漏洞"], "text": "抖音海外版TikTok作为一款成功冲出国门，走到全球的现象级产品，2019年它在全球APP下载量排名第三，在成功的同时，这也引来了繁华势力的眼红，美国海军、陆军纷纷表示不得安装该应用。"}
{"title": "腾讯安全平台部｜安全AI算法工程师招聘", "url": "https://www.freebuf.com/jobs/222506.html", "time": "2020-01-09", "level": "", "num_look": 67197, "num_comment": 1, "author": "秋刀鱼的猫12", "tags": ["安全招聘"], "text": "腾讯安全平台部成立于2005年，发展至今，安全平台部对自身安全能力规划为业务安全、应用运维安全两大体系。"}
{"title": "Linux HIDS agent 概要和用户态HOOK(一）", "url": "https://www.freebuf.com/geek/223409.html", "time": "2020-01-09", "level": "", "num_look": 135732, "num_comment": 8, "author": "知道创宇404实验室", "tags": ["极客"], "text": "最近在实现linux的HIDS agent, 搜索资料时发现虽然资料不少, 但是每一篇文章都各自有侧重点, 少有循序渐进, 讲的比较全面的中文文章, 在一步步学习中踩了不少坑。"}
{"title": "FreeBuf早报｜黑客使用ATM分离器从美国银行骗取40万美金；TikTok修复了可能使黑客操纵帐户并访问个人数据的安全漏洞；苹果要求开发者验证身份，中国区要求自拍", "url": "https://www.freebuf.com/news/224924.html", "time": "2020-01-09", "level": "红色标题", "num_look": 78851, "num_comment": 4, "author": "kirazhou", "tags": ["资讯"], "text": "自动取款机是获取资金的便捷方式，遍布全球各个城市。但是，使用称为“ skimmer”（分离器）的设备（通常是读卡器和相机的组合）就可以通过ATM获取卡号和PIN码。"}
{"title": "浅析如何让你的Responder更强大之修复篇", "url": "https://www.freebuf.com/sectool/219788.html", "time": "2020-01-09", "level": "现金奖励", "num_look": 126177, "num_comment": 2, "author": "Wreck1t", "tags": ["工具"], "text": "渗透圈内，Responder声名远扬。去年在使用中发现了一些异常，脑子抽筋，读了smb协议和Responder源码，进而发现了Responder在实现上存在一些问题，然后进行了修复和完善。"}
{"title": "CIS 2019「X-Tech技术派对」精选议题回顾", "url": "https://www.freebuf.com/fevents/224646.html", "time": "2020-01-08", "level": "", "num_look": 52500, "num_comment": 1, "author": "FB客服", "tags": ["活动"], "text": "一年一度的安全盛宴，自然少不了一年一场的「X-Tech技术派对」。这是一场真正的属于安全人的年度盛会，了不起的研究者们和“黑科技”成果交相辉映、第一代黑客前辈与新生代白帽子同台畅谈。"}
{"title": "针对WordPress的攻击调查", "url": "https://www.freebuf.com/articles/network/224520.html", "time": "2020-01-08", "level": "", "num_look": 93490, "num_comment": 2, "author": "Kriston", "tags": ["网络安全"], "text": "WordPress是一个著名的开源内容管理系统（CMS），用于创建网站和个人博客，据估计，目前35%的网站都在使用CMS。"}
{"title": "挖洞经验 | 在账户注册和意见反馈处发现越权漏洞（IDOR)", "url": "https://www.freebuf.com/vuls/223987.html", "time": "2020-01-08", "level": "", "num_look": 128181, "num_comment": 4, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "今天分享几点关于越权漏洞（IDOR）的发现经验，这类型漏洞通常发生在Web应用提供给用户基于输入的对象中，漏洞造成的影响将会致使攻击者可以绕过授权限制，访问到目标系统内其它不应该被访问到的资源或数据。"}
{"title": "Gartner：2020年十大战略技术趋势（下篇）", "url": "https://www.freebuf.com/articles/paper/223963.html", "time": "2020-01-08", "level": "金币+15", "num_look": 191218, "num_comment": 2, "author": "宇宸de研究室", "tags": ["安全报告"], "text": "边缘计算描述了一种计算拓扑，在这种拓扑中，信息处理、内容收集和交付被放置在离源码、资源库以及使用者更近的位置。"}
{"title": "Google Play恶意软件指向SideWinder组织", "url": "https://www.freebuf.com/articles/terminal/224707.html", "time": "2020-01-08", "level": "", "num_look": 71807, "num_comment": 1, "author": "Kriston", "tags": ["终端安全"], "text": "在Google Play商店中发现了三款恶意应用，恶意应用会攻击目标设备并收集用户信息，其中一个名为CAMMO，利用漏洞编号为CVE-2019-2215。这是在野第一个已知的使用use-after-free漏洞的主动攻击。"}
{"title": "我眼中的数据安全治理", "url": "https://www.freebuf.com/articles/database/224617.html", "time": "2020-01-08", "level": "红色标题", "num_look": 129746, "num_comment": 4, "author": "平安银行应用安全团队", "tags": ["数据安全"], "text": "随着大数据时代的到来，带了很多的便利，但是也带来了更多的风险，作为一名安全行业工作者，对于这种变革更是体会深刻。"}
{"title": "不给钱就撕票！论现代勒索软件的野蛮进化史", "url": "https://www.freebuf.com/articles/system/224099.html", "time": "2020-01-08", "level": "", "num_look": 72489, "num_comment": 3, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "年末已至，奇安信病毒响应中心在对本年度勒索软件相关线索、情报和新闻整理和研判的过程中，发现了勒索软件在未来两个值得关注的趋势。第一是勒索软件攻击的定向化、攻击手法朝着APT攻击转变。"}
{"title": "赠书福利｜道哥鼎力推荐新书《大型互联网企业安全架构》", "url": "https://www.freebuf.com/fevents/224448.html", "time": "2020-01-08", "level": "红色标题", "num_look": 110689, "num_comment": 49, "author": "FB客服", "tags": ["活动"], "text": "新的一年都需要新的东西来充实自己。因此，2020年的第一波送书福利，FreeBuf为大家准备了一本企业安全方向的新书，还有道哥联合推荐哦～"}
{"title": "FreeBuf早报｜安卓提权漏洞再遭利用；委内瑞拉在国民议会议长选举前短暂限制社交网络；0.08%的RDP暴力破解能够成功", "url": "https://www.freebuf.com/news/224831.html", "time": "2020-01-08", "level": "红色标题", "num_look": 60031, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": "趋势科技近日发布报告称，他们在Google Play商店中发现了三个恶意应用程序，主要功能是破坏受害者的设备并收集用户信息。"}
{"title": "致命APP，牟利7亿，10人殒命", "url": "https://www.freebuf.com/articles/network/223383.html", "time": "2020-01-07", "level": "", "num_look": 200142, "num_comment": 13, "author": "GEETEST极验", "tags": ["网络安全"], "text": "最近有一个名为「阿尔法象」的平台，在背后孵化 855 个APP，整个生态链条牟利超过 7 亿元，至少10个人疑似因此失去了生命......"}
{"title": "挖洞经验 | 用空字节（Null Byte）触发内存泄露的4万美金漏洞", "url": "https://www.freebuf.com/vuls/224088.html", "time": "2020-01-07", "level": "", "num_look": 157132, "num_comment": 10, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "作为前言，当我在7月底发现本文中的漏洞时，我还不知道有“空字节溢出”这种类型的安全问题。我仅只是对一个标准Web应用的用户输入点进行了Fuzzing测试，就发现了这么一个有意思的漏洞。"}
{"title": "浅析前端加密后数据包的修改方法", "url": "https://www.freebuf.com/articles/web/223011.html", "time": "2020-01-07", "level": "现金奖励", "num_look": 159070, "num_comment": 17, "author": "True521", "tags": ["WEB安全"], "text": "渗透测试过程中，使用BurpSuite对Web站点进行数据包拦截时，有时会遇到应用程序在前端对数据进行了加密后再传输，导致拦截或监听到的数据包为密文的形式。"}
{"title": "360企业安全集团 招聘安全分析师、情报分析师", "url": "https://www.freebuf.com/jobs/224540.html", "time": "2020-01-07", "level": "", "num_look": 87778, "num_comment": 2, "author": "redrain", "tags": ["安全招聘"], "text": "我们是一个聚焦安全对抗领域的360内部团队，团队成员曾追溯过多个网络恶意活动和APT团伙并形成可靠研究。"}
{"title": "Kali Linux将默认启用非root用户，因被当作主力系统的需求增加", "url": "https://www.freebuf.com/news/224681.html", "time": "2020-01-07", "level": "", "num_look": 189519, "num_comment": 4, "author": "Sandra1432", "tags": ["资讯"], "text": "从即将推出的2020.1版本开始，Kali Linux将默认非root用户运行，向新的安全模型转变。该版本将于2020年1月下旬发布，但用户可以通过“the daily builds”进行测试。"}
{"title": "Web防护自给自足：给Express写一个WAF中间件！", "url": "https://www.freebuf.com/articles/web/223735.html", "time": "2020-01-07", "level": "金币+15", "num_look": 82409, "num_comment": 2, "author": "w2sfoot", "tags": ["WEB安全"], "text": "NodeJS做为后端神器是很流行的。"}
{"title": "FreeBuf早报 | 泄密者公开剑桥分析公司10万份文件，涉及全球68个国家业务；手机QQ显示实时电量会泄露隐私？腾讯回应称不用担心；央行：严禁大数据公司等违规查询个人信息", "url": "https://www.freebuf.com/news/224508.html", "time": "2020-01-07", "level": "红色标题", "num_look": 92693, "num_comment": 5, "author": "Sandra1432", "tags": ["资讯"], "text": "1月6日消息，据腾讯科技援引外媒消息，英国数据分析企业剑桥分析公司(Cambridge Analytica)多达10万份文件将被陆续公开，这将暴露该公司的内部运作情况，该公司在被披露盗用了8700万份Facebook个人资料后倒闭。"}
{"title": "深度学习之Keras检测恶意流量", "url": "https://www.freebuf.com/articles/web/222902.html", "time": "2020-01-07", "level": "现金奖励", "num_look": 120022, "num_comment": 5, "author": "邹先生007", "tags": ["WEB安全"], "text": "Keras是由 Python 编写的神经网络库，专注于深度学习，运行在 TensorFlow 或 Theano 之上。TensorFlow和Theano是当前比较流行的两大深度学习库，但是对初学者来说相对有些复杂。"}
{"title": "挖洞经验 | Firefox for iOS浏览器的二维码扫码XSS漏洞", "url": "https://www.freebuf.com/vuls/224069.html", "time": "2020-01-06", "level": "", "num_look": 106706, "num_comment": 3, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "在手机中，我们通常访问一个网站的做法是打开浏览器在地址栏中输入网站地址，一般来说这样的方法有些烦人，所以，有些网站访问对象通常也会生成一个二维码图片，方便用户直接扫码访问。"}
{"title": "应急响应系列之Linux库文件劫持技术分析", "url": "https://www.freebuf.com/articles/system/223311.html", "time": "2020-01-06", "level": "现金奖励", "num_look": 250283, "num_comment": 16, "author": "feiniao", "tags": ["系统安全"], "text": "Linux库文件劫持案例，当时的情况是有台服务器不断向个可疑IP发包，尝试建立连接，后续使用杀软杀出木马，重启后该服务器还是不断的发包，使用netstat、lsof等常用系统命令无法查看到相应的PID。"}
{"title": "手把手带你利用SQLmap结合OOB技术实现音速盲注", "url": "https://www.freebuf.com/sectool/222967.html", "time": "2020-01-06", "level": "现金奖励", "num_look": 211989, "num_comment": 36, "author": "十三夫子13fuzi", "tags": ["WEB安全", "工具"], "text": "通过sqlmap神器通过OOB 把漫长几个小时的盲注的时间，缩短到了几秒。这篇文章就是把这些东西记录下来，并将具体的实现过程详细步骤分享给大家。"}
{"title": "北京便利蜂招聘安全工程师", "url": "https://www.freebuf.com/jobs/224567.html", "time": "2020-01-06", "level": "", "num_look": 109231, "num_comment": 2, "author": "李玉的机械毛驴", "tags": ["安全招聘"], "text": "便利蜂于2016年底创立于北京，属于一家创业型公司，公司业务在快速发展中，以线下便利店、智能货柜业务为主。"}
{"title": "Gartner：2020年十大战略技术趋势（上篇）", "url": "https://www.freebuf.com/articles/paper/223702.html", "time": "2020-01-06", "level": "金币+20", "num_look": 316104, "num_comment": 7, "author": "宇宸de研究室", "tags": ["安全报告"], "text": "战略技术趋势既可能创造机会，也可能造成重大损失。企业架构和技术创新领导者必须评估这些超前趋势，以确定如何通过趋势的组合为企业创新战略提供动力。"}
{"title": "USRC春节活动 | 感恩回馈辞猪年，抽奖壕礼贺新春", "url": "https://www.freebuf.com/fevents/224704.html", "time": "2020-01-06", "level": "", "num_look": 41652, "num_comment": 41652, "author": "FB客服", "tags": ["活动"], "text": "开年好运来，礼多人不怪。USRC继周年庆之后又双叒叕来给大家送年货了~"}
{"title": "评估的意义", "url": "https://www.freebuf.com/articles/es/223603.html", "time": "2020-01-06", "level": "金币+20", "num_look": 113650, "num_comment": 3, "author": "煜阳yuyang", "tags": ["企业安全"], "text": "这一期主题是体系评估，那么这里其实评估的不仅仅的是安全体系的评估，还有业务的评估、风险的评估、设备的评估、人员的评估等等。而且主要是涉及中层的工作。"}
{"title": "FreeBuf早报 | 美国政府官网遭伊朗黑客攻击：特朗普被打到流血；工信部通报下架第一批侵害用户权益App名单，人人视频上榜；Mozilla 在 Firefox 72 中添加“删除遥测数据”设置", "url": "https://www.freebuf.com/news/224496.html", "time": "2020-01-06", "level": "红色标题", "num_look": 85533, "num_comment": 4, "author": "Sandra1432", "tags": ["资讯"], "text": "美国有线电视新闻网（CNN）5日报道，一名高级政府官员证实，美国国土安全部已经监控到这家美国联邦寄存图书馆计划政府网站明显遭到黑客攻击。"}
{"title": "Apache Tomcat AJP协议文件包含漏洞分析", "url": "https://www.freebuf.com/news/232748.html", "time": "2020-01-05", "level": "", "num_look": 19238, "num_comment": 19238, "author": "斗象智能安全平台", "tags": ["资讯"], "text": "Tomcat是由Apache软件基金会属下Jakarta项目开发的Servlet容器，按照Sun Microsystems提供的技术规范，实现了对Servlet和JavaServer Page（JSP）的支持。"}
{"title": "2020年网络安全行业趋势预测", "url": "https://www.freebuf.com/articles/network/223431.html", "time": "2020-01-05", "level": "", "num_look": 156989, "num_comment": 2, "author": "Sandra1432", "tags": ["网络安全"], "text": "在2020年，网络威胁随着云技术、大数据、物联网、人工智能等技术的发展，也将变得更加复杂、棘手、难以应对。网络安全投入持续增加，市场规模将进一步扩大，发展潜力也将继续被激发出来。"}
{"title": "挖洞经验 | 在密码重置请求包中添加X-Forwarded-Host实现受害者账户完全劫持", "url": "https://www.freebuf.com/vuls/223882.html", "time": "2020-01-05", "level": "", "num_look": 132410, "num_comment": 11, "author": "clouds", "tags": ["漏洞"], "text": "今天分享的这篇Writeup为作者通过利用目标网站“忘记密码”功能，在重置密码请求发包中添加X-Forwarded-Host主机信息，欺骗目标网站把重置密码的链接导向到自己的服务器，从而实现对受害者账户的完全劫持。"}
{"title": "关于File Upload的一些思考", "url": "https://www.freebuf.com/articles/web/223679.html", "time": "2020-01-05", "level": "现金奖励", "num_look": 139005, "num_comment": 11, "author": "灭迹下的荒诞", "tags": ["WEB安全"], "text": "这里就讲如何绕过服务端代码的检测，服务端会出现文件上传的什么安全配置。"}
{"title": "奇幻熊（APT28） 样本分析", "url": "https://www.freebuf.com/articles/network/223653.html", "time": "2020-01-05", "level": "", "num_look": 93607, "num_comment": 93607, "author": "北京计算机技术及应用研究所", "tags": ["网络安全"], "text": "本次样本分析的样本来自于我单位捕获到的样本数据，经过分析为Zepakab下载器。在此做一个简单的分析，以窥探Zepakab的技术秘密。"}
{"title": "为安全妥协，起底普京XP系统背后的信息主权之争", "url": "https://www.freebuf.com/news/223523.html", "time": "2020-01-04", "level": "", "num_look": 84365, "num_comment": 1, "author": "0day情报局", "tags": ["资讯"], "text": "近日，克里姆林宫发布了一张总统普京办公照，眼毒的媒体直接从照片细节，推测出普京大帝电脑操作系统，竟是2014年既已停服的Win XP。"}
{"title": "美国FBI最想定罪的“邪恶公司”首领：年仅32岁吸金亿万美元", "url": "https://www.freebuf.com/news/223492.html", "time": "2020-01-04", "level": "", "num_look": 84294, "num_comment": 3, "author": "0day情报局", "tags": ["资讯"], "text": "美国FBI刷新了网络黑客的最高悬赏金额，32岁的俄罗斯小伙马克西姆·雅库贝斯（Maksim Yakubets）以500万美元的“身价”，成为FBI最想要的男人。"}
{"title": "下一代网络隔离方案：自适应微隔离应该如何设计？", "url": "https://www.freebuf.com/articles/es/223314.html", "time": "2020-01-04", "level": "", "num_look": 135749, "num_comment": 1, "author": "安全狗safedog", "tags": ["企业安全"], "text": "包含有敏感数据和业务的云计算工作负载，在云环境下网络边界变得模糊，传统防火墙、WAF、IPS等端点安全和网络安全手段在云环境下显得捉襟见肘。"}
{"title": "在网上“裸奔”的儿童信息", "url": "https://www.freebuf.com/articles/neopoints/223410.html", "time": "2020-01-04", "level": "", "num_look": 191675, "num_comment": 1, "author": "Sandra1432", "tags": ["观点"], "text": "近期，抖音海外版TikTok母公司字节跳动因涉嫌触犯美国《儿童在线隐私保护法》(COPPA)，收集未成年用户信息在伊利诺斯州被起诉，但随后迅速达成和解。"}
{"title": "BUF大事件丨儿童智能手表爆高危漏洞，黑客能轻易追踪位置；“酷我音乐”借“大数据”名义，窥探并收集用户隐私长达数年", "url": "https://www.freebuf.com/news/224456.html", "time": "2020-01-04", "level": "红色标题", "num_look": 117851, "num_comment": 117851, "author": "Darry端", "tags": ["资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，儿童智能手表爆高危漏洞，黑客能轻易追踪孩子；“净网2019”集群战役打掉黑产公司210余家，抓获1.4万余人；“酷我音乐”借“大数据”名义窥探并收集用户隐私长达数年。"}
{"title": "浅析通过操纵BGP Communities影响路由选路", "url": "https://www.freebuf.com/articles/network/223879.html", "time": "2020-01-03", "level": "现金奖励", "num_look": 86929, "num_comment": 1, "author": "Chris东方", "tags": ["网络安全"], "text": "安全领域的讨论离不开漏洞，但是若说世界上最严重的漏洞是什么呢？（不许说是人~），如果说是BGP的漏洞，应该没有人反对吧？（二进制和web大佬表示不服......）"}
{"title": "漏洞披露的双刃剑效应", "url": "https://www.freebuf.com/articles/neopoints/223312.html", "time": "2020-01-03", "level": "现金奖励", "num_look": 185478, "num_comment": 6, "author": "安数君", "tags": ["观点"], "text": "黑客和服务商双双受益，而用户是最大的受害者。"}
{"title": "盛况空前｜数说CIS 2019网络安全创新大会", "url": "https://www.freebuf.com/news/224426.html", "time": "2020-01-03", "level": "", "num_look": 53960, "num_comment": 1, "author": "FB独家", "tags": ["资讯"], "text": "2019年11月27日-28日，CIS 2019网络安全创新大会在上海圆满收官，也正式完成了从FIT到CIS的完美进化。"}
{"title": "手把手教大家搭建一个低成本的多功能移动渗透测试站点", "url": "https://www.freebuf.com/geek/223115.html", "time": "2020-01-03", "level": "现金奖励", "num_look": 264248, "num_comment": 9, "author": "一个神秘的人", "tags": ["极客"], "text": "凡是搞过物联网开发的朋友们都应该知道树莓派这个东东吧？特别是RPI ZERO，小身材，大功能！"}
{"title": "APT29分析报告", "url": "https://www.freebuf.com/articles/network/222558.html", "time": "2020-01-03", "level": "现金奖励", "num_look": 98904, "num_comment": 1, "author": "LordCasser", "tags": ["网络安全"], "text": "APT29是威胁组织，已被归于俄罗斯政府情报组织，APT29至少从2008年开始运作，具有YTTRIUM、The Dukes、Cozy Duke、Cozy Bear、Office Monkeys等别名。主要攻击目标为美国和东欧的一些国家。"}
{"title": "FreeBuf早报｜俄罗斯最严法令今年7月生效，未安装规定应用不能销售；微软称与朝鲜有关的黑客窃取了敏感信息；MSP 服务商遭遇勒索软件攻击，影响数千客户", "url": "https://www.freebuf.com/news/224400.html", "time": "2020-01-03", "level": "红色标题", "num_look": 75977, "num_comment": 5, "author": "kirazhou", "tags": ["资讯"], "text": "在默认情况下，所有在俄罗斯销售的电子设备都必须安装由俄罗斯互联网企业开发的浏览器「Yandex」以及其他本土应用程序，而且这将产生额外的技术开发和许可等额外费用。"}
{"title": "CIS 2019「等保2.0」研讨专场精选议题回顾", "url": "https://www.freebuf.com/fevents/224190.html", "time": "2020-01-02", "level": "", "num_look": 64318, "num_comment": 64318, "author": "FB客服", "tags": ["活动"], "text": "CIS 2019大会「等保2.0」研讨专场精选议题回顾视频以公开课的形式正式上线！关注等保2.0，学习等保2.0，精彩不容错过！"}
{"title": "这款流行聊天APP，居然是一个国家的监听工具", "url": "https://www.freebuf.com/articles/terminal/223811.html", "time": "2020-01-02", "level": "", "num_look": 142466, "num_comment": 12, "author": "奇安信威胁情报中心", "tags": ["终端安全"], "text": "ToTok是阿联酋的一种手机通讯应用程序，已有数百万台手机下载并安装。"}
{"title": "福布斯公布42条2020年网络安全行业趋势预测", "url": "https://www.freebuf.com/articles/network/223169.html", "time": "2020-01-02", "level": "", "num_look": 97863, "num_comment": 1, "author": "Sandra1432", "tags": ["网络安全"], "text": "过去的2019年里，从扰乱选举到有目标的勒索软件、到隐私法规，再到Deepfakes和恶意AI，2020年的141条网络安全预测远远不够，因此本文又公布了42名网络安全高管提供的网络安全预测。"}
{"title": "聊一聊安全测试的各种姿势", "url": "https://www.freebuf.com/articles/es/223176.html", "time": "2020-01-02", "level": "金币+15", "num_look": 198932, "num_comment": 7, "author": "shengl99", "tags": ["企业安全"], "text": "在此，笔者就来聊聊渗透测试的各种姿势，以方便大家在购买安全服务时进行比较。"}
{"title": "星巴克开发人员在GitHub Public Repo中暴露API密钥", "url": "https://www.freebuf.com/news/224348.html", "time": "2020-01-02", "level": "", "num_look": 78140, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "星巴克开发人员的一个失误暴露了一个API密钥，攻击者可以使用该API密钥访问内部系统并篡改授权用户列表。由于可以访问星巴克JumpCloud API的密钥，该漏洞的威胁性评级为“严重”。"}
{"title": "浅析Docker容器安全管控方法", "url": "https://www.freebuf.com/articles/es/223187.html", "time": "2020-01-02", "level": "", "num_look": 156871, "num_comment": 1, "author": "安全狗safedog", "tags": ["企业安全", "容器安全"], "text": "Docker通过把应用的运行时环境和应用打包在一起，解决了部署环境依赖等问题。"}
{"title": "机器学习之KNN检测恶意流量", "url": "https://www.freebuf.com/articles/web/223056.html", "time": "2020-01-02", "level": "现金奖励", "num_look": 116626, "num_comment": 9, "author": "邹先生007", "tags": ["WEB安全"], "text": "任何智能活动的都可以称为人工智能，而机器学习（Machine Learning）属于人工智能的一个分支，深度学习（Deep Learning）则是机器学习的分支。"}
{"title": "FreeBuf早报｜纽约特奥会被黑客入侵；星巴克开发人员在GitHub Public Repo中保留API密钥；印度海军全面禁止智能手机", "url": "https://www.freebuf.com/news/224323.html", "time": "2020-01-02", "level": "红色标题", "num_look": 75473, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "公安部网安局部署北京等11个省份牵头，全国共同开展“净网2019”十大集群战役5个月以来，共打掉各类黑色产业公司210余家，抓获嫌疑人1.4万余名，缴获公民个人信息12.63亿条。"}
{"title": "漏洞非小事，金融服务机构如何对抗代码缺陷？", "url": "https://www.freebuf.com/articles/neopoints/223031.html", "time": "2020-01-01", "level": "金币+15", "num_look": 123225, "num_comment": 2, "author": "RIodian", "tags": ["观点"], "text": "在快节奏的软件开发环境中，由于代码缺陷造成的软件系统漏洞却给推向市场的金融应用埋下了安全隐患。金融服务机构该如何应对这些威胁呢？"}
{"title": "Rancor组织东南亚攻击活动分析", "url": "https://www.freebuf.com/articles/network/223258.html", "time": "2020-01-01", "level": "", "num_look": 64264, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "在2018年6月下旬，研究人员发现了一个未知的网络间谍组织Rancor，该组织在2017年和2018年期间在东南亚进行了有针对性的攻击。在研究这些攻击时发现了一个未记录的自定义恶意软件家族Dudell。"}
{"title": "新年之际，Sodinokibi勒索病毒利用NSIS再造变种", "url": "https://www.freebuf.com/articles/terminal/224227.html", "time": "2020-01-01", "level": "", "num_look": 78816, "num_comment": 1, "author": "亚信安全", "tags": ["终端安全"], "text": "近期，亚信安全监测到多个勒索病毒异常活跃，这其中就包括知名的Sodinokibi勒索病毒"}
{"title": "论爬虫持久战", "url": "https://www.freebuf.com/articles/database/221679.html", "time": "2020-01-01", "level": "", "num_look": 130590, "num_comment": 1, "author": "芯盾时代trusfort", "tags": ["数据安全"], "text": "据国际知名金融广告服务平台提供商Dianomi的报告《2018 Robot traffic report》的数据，在互联网上人类流量仅仅占了48.2%，也就是说，一个页面的10000个点击里面，大约5100个来自机器人。"}
{"title": "立法回顾：美国的网络隐私数据保护", "url": "https://www.freebuf.com/articles/network/223945.html", "time": "2020-01-01", "level": "", "num_look": 87909, "num_comment": 1, "author": "Sandra1432", "tags": ["网络安全"], "text": "几十年来，美国将数据隐私视为一个老化的房屋，仅在新的暴风雨袭来时才去修补个人的数据安全漏洞和相关法案。"}
{"title": "PHP反序列化漏洞入门", "url": "https://www.freebuf.com/articles/web/221213.html", "time": "2020-01-01", "level": "金币+8", "num_look": 114553, "num_comment": 2, "author": "Sch0lar", "tags": ["WEB安全"], "text": "序列化就是将一个对象转换成字符串。字符串包括 属性名 属性值 属性类型和该对象对应的类名。反序列化则相反将字符串重新恢复成对象。"}
{"title": "微软起诉朝鲜黑客组织Thallium", "url": "https://www.freebuf.com/news/224261.html", "time": "2019-12-31", "level": "", "num_look": 89187, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "微软起诉了一个网络间谍组织Thallium，该组织与朝鲜关系密切。据12月27日收到的起诉书表明，该组织通过鱼叉式网络钓鱼攻击侵入其客户的账户和网络，以窃取敏感信息。"}
{"title": "2020年网络安全薪酬调查结果", "url": "https://www.freebuf.com/articles/network/223579.html", "time": "2019-12-31", "level": "红色标题", "num_look": 178121, "num_comment": 21, "author": "Sandra1432", "tags": ["网络安全"], "text": "2020年网络安全薪酬调查是一项由The Hacker News发布的线上调查，旨在为网络安全从业者提供有关薪酬细节参考。"}
{"title": "聊聊网络安全行业这十年（2010-2019）", "url": "https://www.freebuf.com/articles/network/223613.html", "time": "2019-12-31", "level": "", "num_look": 95171, "num_comment": 4, "author": "奇安信代码卫士", "tags": ["网络安全"], "text": "当我们迈入2010年时，多数企业的做法仍然毫无改观，但到2018年至2019年时，网络安全专家和安全及风险专业人员成为董事会及新闻中的常客。"}
{"title": "奇安信代码安全实验室安全类岗位火热招聘", "url": "https://www.freebuf.com/jobs/223930.html", "time": "2019-12-31", "level": "", "num_look": 90274, "num_comment": 6, "author": "奇安信代码卫士", "tags": ["安全招聘"], "text": "代码安全实验室是专门从事源代码、二进制漏洞挖掘和分析的研究团队，主要研究方向包括：Windows/Linux/MacOS操作系统、应用软件、开源软件、网络设备、IoT设备、区块链等。"}
{"title": "个人隐私保护之三：数据安全防护实践", "url": "https://www.freebuf.com/articles/database/223045.html", "time": "2019-12-31", "level": "现金奖励", "num_look": 1076639, "num_comment": 3, "author": "Alkaid13", "tags": ["数据安全"], "text": "本文着重探讨服务端及企业内部数据安全策略方面的数据安全保护机制，包括数据存储，使用，共享，转让，公开等数据生命周期中的核心环节。"}
{"title": "警惕伪装成“Synaptics触摸板驱动程序”的新型蠕虫病毒", "url": "https://www.freebuf.com/articles/terminal/222991.html", "time": "2019-12-31", "level": "", "num_look": 184550, "num_comment": 4, "author": "亚信安全", "tags": ["终端安全"], "text": "亚信安全截获伪装成“Synaptics触摸板驱动程序”的新型蠕虫病毒，该病毒具有很强的传播性，既可以通过带有恶意宏代码的Excel文档传播，也可以通过对正常的EXE文件进行偷梁换柱的方式传播。"}
{"title": "FreeBuf早报 | 《App违法违规收集使用个人信息行为认定方法》正式发布；联合国批准俄中提案有关新网络犯罪公约的决议；大学生受网警之托攻破赌博网站，发现4个月流水280万", "url": "https://www.freebuf.com/news/224215.html", "time": "2019-12-31", "level": "", "num_look": 70994, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "12月30日，为落实《网络安全法》等法律法规，《App违法违规收集使用个人信息行为认定方法》正式发布，为认定App违法违规收集使用个人信息行为提供参考。"}
{"title": "我创建了自己的Deepfake，两个星期花费了552美元", "url": "https://www.freebuf.com/geek/223270.html", "time": "2019-12-31", "level": "", "num_look": 169798, "num_comment": 3, "author": "kirazhou", "tags": ["极客"], "text": "本文，我将仔细研究这项技术本身，通过自己创建作品的方式，来回答：Deepfake软件如何工作？使用起来有多难？效果如何？"}
{"title": "基于DNS的数据泄露开源测试工具篇（二）", "url": "https://www.freebuf.com/sectool/223123.html", "time": "2019-12-30", "level": "", "num_look": 140857, "num_comment": 140857, "author": "DigApis", "tags": ["工具"], "text": "在基于DNS的数据窃取开源测试工具篇(一)中，简要分析了DET基于DNS进行数据窃取部分的源码。本文将继续探讨图1中所示的PyExfil中利用DNS完成数据窃取的部分。"}
{"title": "挖洞经验 | 通过Vimeo的文件上传功能发现其SSRF漏洞（$5000）", "url": "https://www.freebuf.com/vuls/223456.html", "time": "2019-12-30", "level": "", "num_look": 114196, "num_comment": 9, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文分享的是视频分享网站Vimeo的一个SSRF漏洞，作者通过Vimeo上传功能中Vimeo分次读取部份文件流的机制发现了该漏洞，漏洞最终获得了Vimeo官方$5,000美金奖励。"}
{"title": "穷源溯流：KONNI APT组织伪装韩国Android聊天应用的攻击活动剖析", "url": "https://www.freebuf.com/articles/terminal/223567.html", "time": "2019-12-30", "level": "", "num_look": 76288, "num_comment": 2, "author": "奇安信威胁情报中心", "tags": ["终端安全"], "text": "2019年8月，韩国安全厂商ESTsecurity[1]披露了KONNIAPT组织使用Android端木马的新攻击活动，并称其与APT组织Kimsuky存在关联。"}
{"title": "物联网供应商Wyze确认服务器数据泄漏", "url": "https://www.freebuf.com/news/224108.html", "time": "2019-12-30", "level": "", "num_look": 79355, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "Wyze是一家销售安全设备的物联网公司，如安全摄像机、智能插头、智能灯泡和智能门锁等。该公司昨日证实发生了服务器数据泄漏事件，该事件泄露了大约240万客户的详细信息。"}
{"title": "专治各种套路，《App违法违规收集使用个人信息行为认定方法》正式发布", "url": "https://www.freebuf.com/news/224109.html", "time": "2019-12-30", "level": "红色标题", "num_look": 135974, "num_comment": 7, "author": "Allen别bb", "tags": ["资讯"], "text": "12月30日，为落实《网络安全法》等法律法规，《App违法违规收集使用个人信息行为认定方法》正式发布，为认定App违法违规收集使用个人信息行为提供参考。"}
{"title": "行走的漏洞利用机器人：僵尸网络病毒携71个EXP占领高地", "url": "https://www.freebuf.com/articles/system/223181.html", "time": "2019-12-30", "level": "", "num_look": 86966, "num_comment": 1, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "僵尸网络 Botnet 是指采用一种或多种传播手段，将大量主机感染bot程序（僵尸程序）病毒，从而在控制者和被感染主机之间所形成的一个可一对多控制的网络。"}
{"title": "金融科技网络信息安全法规梳理与解读（三）", "url": "https://www.freebuf.com/articles/neopoints/223267.html", "time": "2019-12-30", "level": "现金奖励", "num_look": 161356, "num_comment": 1, "author": "當春日漸暖", "tags": ["观点"], "text": "监管法规的日渐严苛与监管技术的不断迭代给金融机构带来越来越多的要求和束缚，而金融机构却可以将网络信息安全合规作为促进业务发展和数字化转型的良好机遇。"}
{"title": "FreeBuf早报｜物联网供应商Wyze确认服务器数据泄漏；犯罪分子在圣诞节前袭击美国卫生产业；新型木马Lampion瞄准了葡萄牙", "url": "https://www.freebuf.com/news/224093.html", "time": "2019-12-30", "level": "", "num_look": 75768, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "Wyze是一家销售安全设备的公司，该公司证实发生了服务器泄漏，涉及大约240万客户的详细信息。"}
{"title": "谈高效漏洞挖掘之Fuzzing的艺术", "url": "https://www.freebuf.com/vuls/221129.html", "time": "2019-12-30", "level": "", "num_look": 293117, "num_comment": 20, "author": "Qclover", "tags": ["WEB安全", "漏洞"], "text": "漏洞挖掘/黑盒测试过程中的遇到过的一些fuzz技术思想有必要借用我遇到过的实战中的例子来归纳总结下，通过实例对fuzz的思想进行展开。"}
{"title": "挖洞经验 | 如何发现更多的IDOR漏洞（越权漏洞）", "url": "https://www.freebuf.com/vuls/223500.html", "time": "2019-12-29", "level": "", "num_look": 127642, "num_comment": 3, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "我非常喜欢搞IDOR漏洞，它通常被称为不安全的直接对象引用或是越权，一般来说它的发现手段相对简单，利用方式也不太难，但是对网站业务的危害影响却比较严重。"}
{"title": "挖洞经验 | 利用Instagram版权功能构造CSRF漏洞删除其他用户文件", "url": "https://www.freebuf.com/vuls/223496.html", "time": "2019-12-29", "level": "", "num_look": 79444, "num_comment": 4, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "最近，我注意到Instagram增加了大量的版权说明部分，其中声称，当用户上传到Instagram的媒体文件侵犯了其他地方的知识版权后，就会显示一个通知反映媒体文件的版权上诉信息，之后Instagram会自动删除该文件。"}
{"title": "404 Keylogger最新木马，盗取受害者浏览器网站帐号和密码", "url": "https://www.freebuf.com/articles/system/222808.html", "time": "2019-12-29", "level": "", "num_look": 81484, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近日深信服安全团队捕获到一个最新的404 Keylogger木马变种，通过OFFICE文档嵌入恶意宏代码进行传播，盗取受害者浏览器的网站帐号和密码。"}
{"title": "[HTB]", "url": "https://www.freebuf.com/articles/web/222562.html", "time": "2019-12-29", "level": "金币+15", "num_look": 93129, "num_comment": 3, "author": "guoyouy@126.com", "tags": ["WEB安全"], "text": "今天我们来看一下hackthebox里的一个靶机“Heist”，直接开始渗透。"}
{"title": "黑客入侵八岁儿童房间摄像头，播放恐怖音乐竟是为了……", "url": "https://www.freebuf.com/articles/terminal/223249.html", "time": "2019-12-28", "level": "", "num_look": 111165, "num_comment": 2, "author": "GEETEST极验", "tags": ["终端安全"], "text": "本月12月4日，8岁的Alyssa如往常一样，在自家小公寓的走廊玩耍。突然，她的卧室响起一阵诡异的音乐，播放的是《Tiptoe Through the Tulips》，该歌曲曾是恐怖电影《阴儿房》、《行尸走肉》里面的插曲。"}
{"title": "挖洞经验 | AirDoS攻击能远程让附近的iPhone或iPad设备无法使用", "url": "https://www.freebuf.com/vuls/223497.html", "time": "2019-12-28", "level": "", "num_look": 90689, "num_comment": 1, "author": "clouds", "tags": ["漏洞", "系统安全"], "text": "如果你一走进某个房间就能让里面的所有iPhone或iPad设备无法使用，会怎么样？是不是听起来非常邪恶？有什么好的方法让那些老是低头刷苹果手机的人停下来？"}
{"title": "金融科技网络信息安全法规梳理与解读(一）", "url": "https://www.freebuf.com/articles/neopoints/221180.html", "time": "2019-12-28", "level": "现金奖励", "num_look": 381777, "num_comment": 6, "author": "當春日漸暖", "tags": ["企业安全", "安全管理"], "text": "金融机构是国家层面的重要基础设施，承担着融通资金、服务实体经济、防范金融风险和服务大众的重要作用，是关乎国计民生的重要行业领域。"}
{"title": "漫谈大数据平台安全风险与建设", "url": "https://www.freebuf.com/articles/database/222720.html", "time": "2019-12-28", "level": "", "num_look": 141033, "num_comment": 141033, "author": "superhuawei", "tags": ["数据安全"], "text": "大数据平台安全伴随着大数据平台而生。随着互联网和大数据应用的普及，新闻头条上发布的数据泄露、滥用、诈骗层出不穷，引发了一系列发人深思的社会事件和问题。"}
{"title": "BUF大事件丨FreeBuf 2019年度数据盘点；数十万家用摄像头被非法控制变偷拍器；Twitter应用曝出安全漏洞", "url": "https://www.freebuf.com/news/224025.html", "time": "2019-12-28", "level": "红色标题", "num_look": 161742, "num_comment": 161742, "author": "Darry端", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，FreeBuf 2019年度数据盘点；个人信息保护法明年正式进入立法进程；Android端Twitter应用曝出安全漏洞：信息恐已泄漏 推荐尽快更改密码；数十万只家用摄像头被非…"}
{"title": "Haaukins：一款高度自动化和可访问的安全教育虚拟化平台", "url": "https://www.freebuf.com/articles/terminal/223184.html", "time": "2019-12-27", "level": "", "num_look": 68625, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "Haaukins是一个高度可访问和自动化的安全教育虚拟化平台，它由三个主要组件组成，即Docker、Virtualbox和Golang，各个组件之间的通信和调用通过Go编程语言来进行管理。"}
{"title": "ATT&CK框架：攻击者最常用的TOP7攻击技术及其检测策略", "url": "https://www.freebuf.com/articles/network/223122.html", "time": "2019-12-27", "level": "", "num_look": 120729, "num_comment": 5, "author": "青藤云安全", "tags": ["网络安全"], "text": "本文将通过对比Mitre ATT&CK的Top 20攻击技术及Red Canary基于ATT&CK的Top 20攻击技术，确定了攻击者最常用的七项ATT&CK技术，并对其进行了详细分析。"}
{"title": "木星安全实验室2020年安全研究员增编", "url": "https://www.freebuf.com/jobs/223802.html", "time": "2019-12-27", "level": "", "num_look": 102039, "num_comment": 3, "author": "木星安全实验室", "tags": ["安全招聘"], "text": "广州三零卫士(“广州三零卫士信息安全有限公司”)，成立于2005年，是中央十二大军工集团——中国网安集团的旗下公司，客户覆盖政府、大型国企、涵盖军工及其他行业，全国累积约1000家。"}
{"title": "FreeBuf早报 | 为防止俄罗斯干预美国大选？美媒：美军正制定信息战策略；新西兰员工拒绝人脸识别打卡被开除，公司被判索赔；微信公众号文章遭遇访问故障，聊天功能正常", "url": "https://www.freebuf.com/news/223992.html", "time": "2019-12-27", "level": "", "num_look": 66785, "num_comment": 66785, "author": "Sandra1432", "tags": ["资讯"], "text": "2019年12月26日，中国信息通信研究院在北京召开“2020年中国信通院ICT深度观察报告会”，大会旨在剖析2019年ICT及融合领域发展热点问题，展望未来发展趋势。"}
{"title": "说说信息安全证书那些事儿", "url": "https://www.freebuf.com/articles/neopoints/221776.html", "time": "2019-12-27", "level": "现金奖励", "num_look": 186042, "num_comment": 12, "author": "Kevinshan", "tags": ["观点"], "text": "写这篇文章，主要是经常被问及和看到一些准备入行的新人经常问到这个问题。对于证书不屑的大佬，可以去网站看看其他技术文章，如有需要继续看。"}
{"title": "XSSFORK：新一代XSS自动扫描测试工具", "url": "https://www.freebuf.com/sectool/223208.html", "time": "2019-12-26", "level": "", "num_look": 232396, "num_comment": 10, "author": "fuckerbox", "tags": ["工具"], "text": "xssfork是一款新一代xss漏洞探测工具，其开发的目的是帮助安全从业者高效率的检测xss安全漏洞。"}
{"title": "RSA Conference 2020 提前早知道", "url": "https://www.freebuf.com/articles/network/223830.html", "time": "2019-12-26", "level": "", "num_look": 427488, "num_comment": 427488, "author": "MaplerD", "tags": ["网络安全"], "text": "RSA会议是一系列IT安全会议。每年大约有45,000人参加，其主打事件是每年在旧金山举行的安全会议。"}
{"title": "由HTTPS抓包引发的一系列思考", "url": "https://www.freebuf.com/articles/web/222564.html", "time": "2019-12-26", "level": "金币+10", "num_look": 259013, "num_comment": 42, "author": "True521", "tags": ["WEB安全"], "text": "对于使用HTTPS协议的站点，在BurpSuite中拦截到的数据包为何也是“明文传输”？"}
{"title": "2019年勒索软件：针对市政部门的全面攻击", "url": "https://www.freebuf.com/articles/network/223202.html", "time": "2019-12-26", "level": "", "num_look": 82144, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "回顾过去三年，勒索软件在恶意软件总数中所占的比例从2.8％上升到3.5％。"}
{"title": "阿里巴巴集团政务钉钉事业部招聘", "url": "https://www.freebuf.com/jobs/222513.html", "time": "2019-12-26", "level": "", "num_look": 92280, "num_comment": 5, "author": "228178562", "tags": ["安全招聘"], "text": "政务钉钉以政府工作人员为主要客户，以助力政务数字化转型，提高政务办事效率为目标，借力阿里巴巴的技术和业务沉淀，通过数字政务协同中台的建设，帮助打通政府大量现存的工作系统。"}
{"title": "从0开始入门Chrome Ext安全（二）：安全的Chrome Ext", "url": "https://www.freebuf.com/vuls/222316.html", "time": "2019-12-26", "level": "", "num_look": 84974, "num_comment": 2, "author": "知道创宇404实验室", "tags": ["WEB安全", "漏洞"], "text": "在2019年初，微软正式选择了Chromium作为默认浏览器，并放弃edge的发展。并在19年4月8日，Edge正式放出了基于Chromium开发的Edge Dev浏览器，并提供了兼容Chrome Ext的配套插件管理。"}
{"title": "摄像头失控的背后，“黑帽子”的圣诞老人", "url": "https://www.freebuf.com/news/223729.html", "time": "2019-12-26", "level": "", "num_look": 102150, "num_comment": 2, "author": "kirazhou", "tags": ["资讯"], "text": "\"我是你最好的朋友，我是圣诞老人。\""}
{"title": "基于DNS的数据泄露开源测试工具篇（一）", "url": "https://www.freebuf.com/sectool/222561.html", "time": "2019-12-26", "level": "", "num_look": 141111, "num_comment": 141111, "author": "DigApis", "tags": ["工具"], "text": "在“假定失陷(Assume Breach)”的现状下，作为防御方我们必须深入分析攻击者在实际攻击活动中正在使用、可能使用的技术，然后从攻击原理的角度指导防御策略制定、防御系统搭建，从而尽可能的在攻防博弈中占据主动地位…"}
{"title": "FreeBuf早报｜数十万只家用摄像头被非法控制变成偷拍器；新型Mozi P2P僵尸网络针对Netgear、D-Link、华为路由器；美国警告英国，采用华为5G设备存在风险", "url": "https://www.freebuf.com/news/223890.html", "time": "2019-12-26", "level": "", "num_look": 94370, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "近日，温州警方破获非法控制家用摄像头案，控制犯罪嫌疑人32名。警方介绍，犯罪分子非法贩卖某公司品牌APP破解工具，利用APP破解工具对他人的摄像头进行扫描，控制数十万只家用摄像头。"}
{"title": "久等啦 | CIS 2019「金融科技安全」专场精选议题回顾", "url": "https://www.freebuf.com/fevents/223691.html", "time": "2019-12-25", "level": "", "num_look": 54112, "num_comment": 1, "author": "FB客服", "tags": ["活动"], "text": "CIS 2019大会「金融科技安全」专场部分的演讲嘉宾视频以公开课形式正式上线啦，欢迎大家报名观看、学习和分享！"}
{"title": "VulnHub靶机系列：Os-ByteSec", "url": "https://www.freebuf.com/articles/system/221949.html", "time": "2019-12-25", "level": "", "num_look": 138793, "num_comment": 6, "author": "VVhAt2", "tags": ["系统安全"], "text": "Vulnhub是一个提供各种漏洞环境的靶场平台，供安全爱好者学习渗透使用。"}
{"title": "Gafgyt家族物联网僵尸网络家族分析", "url": "https://www.freebuf.com/articles/others-articles/222677.html", "time": "2019-12-25", "level": "", "num_look": 110634, "num_comment": 1, "author": "cyberti", "tags": ["其他"], "text": "随着IOT（物联网）设备被越来越多的使用，互联网上针对IOT设备的攻击也在日益增加。相对于对传统终端安全性的重视程度，如各种杀软，终端检测，防火墙的使用，个人及企业用户对IOT设备的安全性重视仍然不够。"}
{"title": "软件安全构建成熟度实践尝试", "url": "https://www.freebuf.com/articles/neopoints/220837.html", "time": "2019-12-25", "level": "现金奖励", "num_look": 104624, "num_comment": 4, "author": "當春日漸暖", "tags": ["观点"], "text": "软件安全构建通过在软件开发生命周期（SDL）中增加安全的控制点，保障软件架构安全性，减少脆弱性和软件安全漏洞的出现，实现软件缺省安全（Security By Default）。"}
{"title": "还记得当初的Flag么？FreeBuf 2019年度数据盘点", "url": "https://www.freebuf.com/fevents/223593.html", "time": "2019-12-25", "level": "红色标题", "num_look": 327560, "num_comment": 12, "author": "FB客服", "tags": ["活动"], "text": "在今年年初甚至是2018年底，FreeBuf就列好了2019年的工作计划，其中包含几项网站体验优化、线下活动以及大家现在已经看到的「FreeBuf企业安全」微信公众号、「FreeBuf+」小程序等，立下的flag基本完成。"}
{"title": "西门子S7comm-plus通信过程及重放攻击分析", "url": "https://www.freebuf.com/articles/ics-articles/220239.html", "time": "2019-12-25", "level": "现金奖励", "num_look": 233023, "num_comment": 4, "author": "yy0308", "tags": ["工控安全"], "text": "本文主要利用手上S7-1200 V3.0.2 固件版本的PLC和TIA13等环境进行S7comm-plus加密协议初步分析及防重放攻击分析"}
{"title": "FreeBuf早报 | Citrix严重漏洞可能影响全球8万家公司；联邦调查局发布LockerGoga和MegaCortex勒索软件警报；谷歌浏览器受新的Magellan 2.0漏洞影响", "url": "https://www.freebuf.com/news/223795.html", "time": "2019-12-25", "level": "", "num_look": 80508, "num_comment": 1, "author": "kirazhou", "tags": ["资讯"], "text": "Citrix应用交付控制器和Citrix网关出现了一个严重漏洞，这可能导致使用Citrix相关技术发布应用的企业会将其内部网络在未经授权下就能访问。"}
{"title": "代码审计思路讨论", "url": "https://www.freebuf.com/articles/web/222877.html", "time": "2019-12-25", "level": "", "num_look": 118571, "num_comment": 7, "author": "掌控安全独行", "tags": ["WEB安全"], "text": "文章主要是写下我自己在代码审计的时候所思所想，主要是写出了审计SQL,XSS,CSRF,文件包含漏洞的思路。"}
{"title": "报告 | 永安在线发布《黑产攻击流程自动化体系》详解黑产自动化攻击", "url": "https://www.freebuf.com/articles/paper/223589.html", "time": "2019-12-24", "level": "", "num_look": 144393, "num_comment": 144393, "author": "永安在线", "tags": ["安全报告"], "text": "今日，永安在线正式发布《黑产攻击流程自动化体系》的报告。"}
{"title": "色情性感如何区分，怎样的风控能力能防止“平台两行泪”？", "url": "https://www.freebuf.com/news/222072.html", "time": "2019-12-24", "level": "", "num_look": 124826, "num_comment": 10, "author": "腾讯安全", "tags": ["网络安全", "资讯"], "text": "“道路千万条，安全第一条，行车不规范，亲人两行泪”——这句话，出自科幻电影《流浪地球》，却也恰巧概括出内容平台的“辛酸经历”。"}
{"title": "圣诞节到了，有一本很酷的书想送给你", "url": "https://www.freebuf.com/fevents/223457.html", "time": "2019-12-24", "level": "红色标题", "num_look": 610348, "num_comment": 76, "author": "FB客服", "tags": ["活动"], "text": "恰逢圣诞节、临近元旦，也没给大家准备什么礼物，恰好最近发现一本很酷的书……"}
{"title": "挖洞经验 | 一个非常简单的Instagram逻辑漏洞（$XXXX）", "url": "https://www.freebuf.com/vuls/223098.html", "time": "2019-12-24", "level": "", "num_look": 149948, "num_comment": 23, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文分享的是作者通过普通浏览就发现的Instagram的一个逻辑漏洞，漏洞非常非常非常简单，最终该漏洞获得了Facebook官方$XXXX的奖励和榜单致谢。"}
{"title": "携带数十个恶意软件的《星战9》种子资源，你还敢下载吗？", "url": "https://www.freebuf.com/news/223674.html", "time": "2019-12-24", "level": "", "num_look": 113310, "num_comment": 4, "author": "kirazhou", "tags": ["资讯"], "text": "当很多人期待电影时，往往也是盗版资源和恶意软件的的“最佳”机会。"}
{"title": "调研 ｜《企业安全系列之WAF产品研究报告》厂商名录收集", "url": "https://www.freebuf.com/fevents/223667.html", "time": "2019-12-24", "level": "红色标题", "num_look": 91991, "num_comment": 4, "author": "FB独家", "tags": ["活动"], "text": "2020年1月，首部《企业安全系列之WAF产品研究报告》即将推出。"}
{"title": "安全实验室的发展及展望", "url": "https://www.freebuf.com/articles/es/211571.html", "time": "2019-12-24", "level": "现金奖励", "num_look": 1428066, "num_comment": 26, "author": "绿帽子技术分享", "tags": ["企业安全"], "text": "在近几年公司的发展过程中，队伍在不断扩大，业务上主要为在甲方驻场，为甲方提供各项安全服务。但由于甲乙方立场不同，导致在公司的技术发展和人员管理上存在一些问题。"}
{"title": "勒索病毒攻击新玩法，先盗数据再勒索", "url": "https://www.freebuf.com/articles/system/223494.html", "time": "2019-12-24", "level": "", "num_look": 88529, "num_comment": 1, "author": "熊猫正正", "tags": ["系统安全"], "text": "2019年是勒索病毒团伙针对企业进行勒索攻击爆发的一年，全球多个国家的政府组织机构、企事业单位都成为了勒索病毒团伙攻击的目标，勒索病毒也成为了网络安全最大的网络安全威胁。"}
{"title": "FreeBuf早报 | 阿联酋社交应用ToTok被发现监视其用户，已被下架；FBI全新IDLE项目通过“虚假数据”帮助公司阻止黑客窃取数据；Avast/AVG扩展程序重新上架：此前因违规收集数据而下架", "url": "https://www.freebuf.com/news/223646.html", "time": "2019-12-24", "level": "", "num_look": 85144, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "与WhatsApp和Skype相似，阿联酋的用户消息传递应用程序ToTok对外宣称旨在缩短人们之间的距离。但是，美国官员却发现该应用程序的不纯目的。"}
{"title": "密码体制如何应对“量子霸权”？", "url": "https://www.freebuf.com/articles/database/222939.html", "time": "2019-12-24", "level": "", "num_look": 119097, "num_comment": 4, "author": "狴犴安全团队", "tags": ["数据安全"], "text": "量子计算是目前全世界范围内的前沿研究热点，并可能正以量子体积每年翻倍的“量子摩尔定律”向前发展。然而，由于量子计算机的强大运算能力，一旦“量子霸权”成为现实，现有密码体制可能发生颠覆性的崩塌。"}
{"title": "工业控制系统ICS网络安全简析", "url": "https://www.freebuf.com/articles/ics-articles/222456.html", "time": "2019-12-24", "level": "", "num_look": 187657, "num_comment": 187657, "author": "xu5eii", "tags": ["工控安全"], "text": "本文对这些针对工业控制系统的专用的网络攻击方法进行简单的介绍。"}
{"title": "PBTK：一款针对Protobuf App的逆向工程与模糊测试套件", "url": "https://www.freebuf.com/articles/system/223128.html", "time": "2019-12-23", "level": "", "num_look": 93905, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "Protobuf是Google设计的一种序列化格式，目前已被广泛应用在各种Android端、Web端和桌面端应用程序之中。"}
{"title": "OSCP学习经验分享", "url": "https://www.freebuf.com/articles/neopoints/221948.html", "time": "2019-12-23", "level": "金币+20", "num_look": 1271652, "num_comment": 9, "author": "安全圈套的套哥", "tags": ["观点"], "text": "很多小伙伴问我如何学习OSCP这种实操类的课程，秉承官方“Try Harder”的精神，我是推荐自学的。"}
{"title": "挖洞经验 | 700美金的WordPress Dos漏洞CVE-2018-6389分析", "url": "https://www.freebuf.com/vuls/222786.html", "time": "2019-12-23", "level": "", "num_look": 119454, "num_comment": 3, "author": "clouds", "tags": ["漏洞"], "text": "本文分享的Writeup是关于WordPress的DoS通杀漏洞CVE-2018-6389，该漏洞影响3.x至4.x所有版本的WordPress程序，作者针对该漏洞对目标网站进行了测试验证，从而获得了$700的漏洞赏金。"}
{"title": "玄猫安全实验室招聘渗透测试人才", "url": "https://www.freebuf.com/jobs/223548.html", "time": "2019-12-23", "level": "", "num_look": 119080, "num_comment": 14, "author": "玄猫安全实验室", "tags": ["安全招聘"], "text": "玄猫安全实验室专注于WEB安全、红蓝军攻防演练、漏洞挖掘、高级渗透测试、区块链安全等领域，团队成员来自于腾讯、阿里、360等国际顶尖安全团队，在国内网络安全领域拥有十年以上的从业经验团队。"}
{"title": "印度核电厂被攻击幕后阴谋渐显：“他们正在下一步很大的棋”", "url": "https://www.freebuf.com/articles/system/222596.html", "time": "2019-12-23", "level": "", "num_look": 89733, "num_comment": 5, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "印度Kudankulam核电厂遭到网络武器Dtrack攻击一事已经渐渐接近尾声，基于外网信息，补充一些此前未被国内提及的细节以及攻击团伙幕后的信息。"}
{"title": "FreeBuf早报 | 个人信息保护法等纳入明年立法规划；美媒披露惊人文件：1200多万美国人被精确追踪；Android端Twitter应用曝出安全漏洞", "url": "https://www.freebuf.com/news/223508.html", "time": "2019-12-23", "level": "", "num_look": 89732, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "近日，国家互联网信息办公室发布了《网络信息内容生态治理规定》（以下简称《规定》），自2020年3月1日起施行。"}
{"title": "HIDS系统存储方案探索与实践", "url": "https://www.freebuf.com/articles/es/222976.html", "time": "2019-12-23", "level": "现金奖励", "num_look": 531245, "num_comment": 6, "author": "糖果L5Q", "tags": ["企业安全"], "text": "企业有各种安全防护手段，HIDS与网络流量监听一样， 是一种威胁检测的手段。HIDS（Host-based Intrusion Detection System）基于主机型入侵检测系统。"}
{"title": "2019第三季度某地网络安全监测报告", "url": "https://www.freebuf.com/articles/paper/222907.html", "time": "2019-12-22", "level": "", "num_look": 101068, "num_comment": 4, "author": "百达智慧Patec", "tags": ["安全报告"], "text": "2019年第三季度，百达智慧内容安全监测平台对某市网站安全防护情况进行抽样调查分析。调查结果为进一步建设网络安全防护工作提供参考依据或建议指导。"}
{"title": "2019年第三季度的垃圾邮件和网络钓鱼分析", "url": "https://www.freebuf.com/articles/network/221709.html", "time": "2019-12-22", "level": "", "num_look": 94544, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "本文主要分析了2019年第三季度的垃圾邮件和网络钓鱼情况，以下为分析内容。"}
{"title": "Nemty勒索病毒结盟僵尸网络，黑产合作已成趋势威胁倍增", "url": "https://www.freebuf.com/articles/system/222034.html", "time": "2019-12-22", "level": "", "num_look": 75595, "num_comment": 1, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "近日Nemty勒索家族新变种开始肆虐，目前已经监测到国内有用户陆续中招，由于新变种暂无解密工具，我们提醒政企用户多加防范。"}
{"title": "如何成为一名漏洞赏金猎人", "url": "https://www.freebuf.com/articles/others-articles/222244.html", "time": "2019-12-22", "level": "", "num_look": 124910, "num_comment": 4, "author": "安啦鹿233", "tags": ["其他"], "text": "恭喜你！当你决定当一个安全研究员并且准备学习一些新的技能时候，是非常令人激动。我们将在下面收集一些资源来帮助你开始你的安全之旅。请跟着我的脚步往下读。"}
{"title": "你和最佳CISO，只差一个安全团队年终绩效评估模板", "url": "https://www.freebuf.com/news/222386.html", "time": "2019-12-21", "level": "", "num_look": 64272, "num_comment": 3, "author": "安数君", "tags": ["资讯"], "text": "又到了年终总结的时候，作为安全团队的负责人，你还在为团队年终绩效评估发愁吗？"}
{"title": "生物认证数据安全威胁分析", "url": "https://www.freebuf.com/articles/network/221796.html", "time": "2019-12-21", "level": "", "num_look": 69800, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "最初，数字生物数据处理系统主要由政府机构和特别服务部门（警察、海关等）使用，信息技术的快速发展使得生物数据系统可供“民用”使用，它们正成为我们日常生活的一部分。"}
{"title": "WiFi安全团队招募安全人才", "url": "https://www.freebuf.com/jobs/223113.html", "time": "2019-12-21", "level": "", "num_look": 70167, "num_comment": 70167, "author": "半夏初晴。", "tags": ["安全招聘"], "text": "WiFi万能钥匙安全团队由黑客教父龚蔚（goodwell)带领，团队大多数核心人员拥有多年互联网以及安全领域实践经验，参与过大型互联网公司的安全体系建设，具备丰富的攻防对抗经验。"}
{"title": "100行代码手撸一个个人版“pocsuite”", "url": "https://www.freebuf.com/sectool/220998.html", "time": "2019-12-21", "level": "现金奖励", "num_look": 142185, "num_comment": 4, "author": "六翼", "tags": ["工具"], "text": "距离笔者在gayhub发布“AngelSword”这款工具已有两年时间，最近半年多这个项目已经不再维护，因为时间原因不再继续添加poc，最主要原因是觉得这个项目写的并不美观且功能不够强大，所以才有了这篇文章。"}
{"title": "从数据粉碎机ZeroCleare，看伊朗黑客的“摧毁型”攻击", "url": "https://www.freebuf.com/news/222246.html", "time": "2019-12-21", "level": "", "num_look": 69272, "num_comment": 69272, "author": "0day情报局", "tags": ["资讯"], "text": "2012年开始，“破坏王”Shamoon凭借着近乎不可逆的数据摧毁攻击，成为了波斯湾石油巨头们的噩梦。到了2019年， Shamoon阴云还未散去，毁灭者ZeroCleare空降中东，给局势焦灼的海湾，再添阴霾。"}
{"title": "BUF大事件丨QQ等41款APP违规收集、使用个人信息；2019年“最烂密码榜”发布；3D面具破解人脸识别，支付宝微信沦陷", "url": "https://www.freebuf.com/news/223348.html", "time": "2019-12-21", "level": "红色标题", "num_look": 178015, "num_comment": 1, "author": "Darry端", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，违规收集、使用个人信息，QQ等41款APP仍未整改；2019年“最烂密码榜”发布，123456又是一年冠军；美公司3D面具破解人脸识别，支付宝微信回应：如有盗刷可申请全额…"}
{"title": "Facebook全球2.67亿用户ID和电话号码遭泄露", "url": "https://www.freebuf.com/news/223394.html", "time": "2019-12-20", "level": "", "num_look": 86028, "num_comment": 2, "author": "kirazhou", "tags": ["资讯"], "text": "一个包含超过2.67亿Facebook用户ID、电话号码和姓名的数据库再次在网上公开，任何人甚至不需要密码或其他身份验证，就能直接访问该数据库。"}
{"title": "挖洞经验 | 利用捐款功能形成重放攻击实现Facebook身份认证绕过分析", "url": "https://www.freebuf.com/vuls/222545.html", "time": "2019-12-20", "level": "", "num_look": 107521, "num_comment": 1, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "该篇Writeup是利用Facebook捐款功能形成身份验证重放攻击，实现Facebook账户双因素认证（2FA）绕过的漏洞，原因在于Facebook在URL会话中加入的身份认证措施不够完善。"}
{"title": "加密劫持的潜在风险", "url": "https://www.freebuf.com/articles/system/222578.html", "time": "2019-12-20", "level": "", "num_look": 86035, "num_comment": 1, "author": "Sandra1432", "tags": ["系统安全"], "text": "许多行业研究发现，一种称为“加密劫持”的威胁，悄无声息地增长，且其速度比任何其他类型的网络事件都快。"}
{"title": "蚂蚁金服招聘基础架构安全相关人才", "url": "https://www.freebuf.com/jobs/222963.html", "time": "2019-12-20", "level": "", "num_look": 83877, "num_comment": 2, "author": "billzone", "tags": ["安全招聘"], "text": "蚂蚁金服是一家旨在为世界带来普惠金融服务的科技企业。蚂蚁金服起步于 2004 年成立的支付宝。2014 年 10 月，蚂蚁金服正式成立，旗下拥有支付宝、支付宝钱包、余额宝、招财宝、蚂蚁小贷及网商银行等品牌。"}
{"title": "“海莲花”(OceanLotus)2019年针对中国攻击活动汇总", "url": "https://www.freebuf.com/articles/paper/222126.html", "time": "2019-12-20", "level": "", "num_look": 178559, "num_comment": 2, "author": "腾讯电脑管家", "tags": ["安全报告"], "text": "\"海莲花\"被认为是来自越南的APT攻击组织，自2012年活跃以来，一直针对中国大陆的敏感目标进行攻击活动，是近几年来针对中国大陆进行攻击活动最活跃的APT攻击组织，甚至没有之一。"}
{"title": "“123456”连续七年霸榜，2019最糟糕密码榜单出炉", "url": "https://www.freebuf.com/news/223285.html", "time": "2019-12-20", "level": "红色标题", "num_look": 159597, "num_comment": 14, "author": "Allen别bb", "tags": ["资讯"], "text": "又到年底，听说 SplashData 公布了2019年最烂密码榜单TOP 100，我都不用点开都能想到“123456”第一名稳如X。"}
{"title": "使用IDA处理U-Boot二进制流文件", "url": "https://www.freebuf.com/sectool/221983.html", "time": "2019-12-20", "level": "", "num_look": 119519, "num_comment": 119519, "author": "Knownsec知道创宇", "tags": ["工具"], "text": "最近在研究IoT设备的过程中遇到一种情况。一个IoT设备，官方不提供固件包，网上也搜不到相关的固件包，所以我从flash中直接读取。"}
{"title": "FreeBuf早报｜多家加密货币交易所客户电子邮件地址可能被非法泄露；法官裁定，美国政府有权获得斯诺登的所有书籍收益；MyKingz使用Taylor Swift的图片隐藏恶意软件有效负载", "url": "https://www.freebuf.com/news/223353.html", "time": "2019-12-20", "level": "", "num_look": 70348, "num_comment": 1, "author": "kirazhou", "tags": ["资讯"], "text": "日本虚拟货币交易协会发布公告称，多家加密货币交易所客户的电子邮件地址可能被非法泄露，已通过交易所敦促客户更改交易服务密码。"}
{"title": "金融科技网络信息安全法规梳理与解读（二）", "url": "https://www.freebuf.com/articles/neopoints/221134.html", "time": "2019-12-20", "level": "", "num_look": 115872, "num_comment": 1, "author": "當春日漸暖", "tags": ["观点"], "text": "金融科技网络信息安全在纵向上面临法律、行政法规、央行、银保监会、证监会和公安机关等多层面的监管，在横向的技术层面上以网络安全等级保护基本要求为基础框架，可以识别到金融科技所面临的监管合规风险。"}
{"title": "SEED：缓冲区溢出漏洞实验", "url": "https://www.freebuf.com/vuls/221081.html", "time": "2019-12-19", "level": "现金奖励", "num_look": 105908, "num_comment": 3, "author": "吃石榴不吐籽", "tags": ["漏洞", "系统安全"], "text": "本文是基于美国雪城大学的seed实验所做的缓冲区溢出实验，笔者在进行实验的时候参考了网上已有的部分博客，但是发现存在部分细节没有详细解释，导致实验过程中难以复现上述攻击。"}
{"title": "【FreeBuf字幕组】Hacker101白帽黑客进阶之路-SQL注入、目录遍历、命令执行和盲注", "url": "https://www.freebuf.com/video/223163.html", "time": "2019-12-19", "level": "红色标题", "num_look": 163889, "num_comment": 4, "author": "willhuang", "tags": ["视频"], "text": "本次课程中，我们来聊聊四种重要漏洞：SQL注入、目录遍历、命令执行和盲注，主要对其成因、类型、漏洞利用和缓解防护措施做一些简单介绍，其中包括了一些实例，可具体参考学习。"}
{"title": "2019年APT回顾与思考", "url": "https://www.freebuf.com/articles/network/222059.html", "time": "2019-12-19", "level": "", "num_look": 127950, "num_comment": 2, "author": "Kriston", "tags": ["网络安全"], "text": "在这一年里，APT进行了哪些活动？我们可以从中学到什么？"}
{"title": "企业安全建设之漏洞管理与运营", "url": "https://www.freebuf.com/articles/security-management/221508.html", "time": "2019-12-19", "level": "现金奖励", "num_look": 1926489, "num_comment": 15, "author": "jary123", "tags": ["安全管理"], "text": "对于企业内部的安全工程师来说，对漏洞一直又爱又怕，爱在，漏洞的发现与验证实现的过程，充满满满的成就感；怕在，不断的新系统上线，老系统版本更新迭代，造就一批批的漏洞如雨后春笋般争相露头。"}
{"title": "微博安全工程师招聘（北京杭州）", "url": "https://www.freebuf.com/jobs/222873.html", "time": "2019-12-19", "level": "", "num_look": 64227, "num_comment": 64227, "author": "shiyao", "tags": ["安全招聘"], "text": "微博作为全球最大的中文社交媒体平台，于2014年正式登陆美国纳斯达克。"}
{"title": "新披露金眼狗黑产团伙：木马诱饵污秽不堪", "url": "https://www.freebuf.com/articles/system/222357.html", "time": "2019-12-19", "level": "", "num_look": 115583, "num_comment": 5, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "近期在日常跟踪黑产团伙过程中，发现了一个针对在东南亚从事博彩、狗推相关人员以及海外华人群体的黑客团伙，其业务范围涵盖远控、挖矿、DDOS和流量相关。"}
{"title": "APP隐私保护之二：用户端隐私保护实践（下）", "url": "https://www.freebuf.com/articles/database/220833.html", "time": "2019-12-19", "level": "现金奖励", "num_look": 174238, "num_comment": 4, "author": "Alkaid13", "tags": ["数据安全"], "text": "本篇文章接上篇：APP隐私保护之二：用户端隐私保护实践（上）"}
{"title": "FreeBuf早报｜新的WhatsApp漏洞使群组聊天崩溃，永久删除历史记录；“江南工业风”APT活动针对全球工业公司；主张“华为威胁论”的捷克网络安全局局长被开除", "url": "https://www.freebuf.com/news/223241.html", "time": "2019-12-19", "level": "", "num_look": 79285, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "安全研究人员表示，他们已经在WhatsApp中检测到一个漏洞，一旦黑客在聊天中引入破坏性消息，该漏洞便会导致群聊崩溃，整个群组聊天记录将被永久删除。"}
{"title": "Glances：一款功能强大的操作系统安全监控平台", "url": "https://www.freebuf.com/articles/system/221843.html", "time": "2019-12-18", "level": "", "num_look": 110230, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "Glances是一款跨平台的安全监控工具，该工具可以通过一个curse或Web界面来帮助研究人员完成大规模数据监控，这些所有的数据回根据用户接口的情况来进行动态适配。"}
{"title": "2019年Mac威胁检测呈上升趋势", "url": "https://www.freebuf.com/news/223121.html", "time": "2019-12-18", "level": "", "num_look": 59712, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "传统观点认为，尽管Mac对于网络威胁不是零攻击的，但与Windows PC相比，Mac受到的感染要少得多。然而，在回顾2019 Mac威胁检测时，我们注意到了其惊人的上升趋势。的确，时代在变。"}
{"title": "CVE-2019-17498：libssh2整形溢出漏洞分析", "url": "https://www.freebuf.com/vuls/221898.html", "time": "2019-12-18", "level": "", "num_look": 116897, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["漏洞", "系统安全"], "text": "该漏洞并不是一个Openssh漏洞，所以它不会影响ssh。Libssh2是一个客户端C代码库，它能够帮助应用程序与SSH服务器建立连接。"}
{"title": "记一次IIS劫持处置", "url": "https://www.freebuf.com/articles/web/222060.html", "time": "2019-12-18", "level": "红色标题", "num_look": 389866, "num_comment": 20, "author": "r41nbow", "tags": ["WEB安全"], "text": "晚上十一点四十，刚准备休息，收到朋友电话，其一个站点被入侵篡改，导致某web接口异常，帮忙远程处理。"}
{"title": "永安在线（原威胁猎人）招聘安全人才", "url": "https://www.freebuf.com/jobs/222997.html", "time": "2019-12-18", "level": "", "num_look": 75815, "num_comment": 3, "author": "永安在线", "tags": ["安全招聘"], "text": "深圳永安在线科技有限公司是国际领先的反欺诈服务提供商，致力于基于对黑灰产的布控能力。"}
{"title": "拒不履行信息网络安全管理义务可处三年以下有期徒刑等处罚", "url": "https://www.freebuf.com/news/223125.html", "time": "2019-12-18", "level": "红色标题", "num_look": 81235, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "2019年11月1日起，最高人民法院、最高人民检察院日前联合发布的《最高人民法院、最高人民检察院关于办理非法利用信息网络、帮助信息网络犯罪活动等刑事案件适用法律若干问题的解释》正式实施。"}
{"title": "追踪奥地利钓鱼木马，回顾仿冒美团钓鱼事件", "url": "https://www.freebuf.com/articles/terminal/221846.html", "time": "2019-12-18", "level": "", "num_look": 86378, "num_comment": 4, "author": "奇安信威胁情报中心", "tags": ["终端安全"], "text": "近日，奇安信病毒响应中心在日常的样本运营过程中，通过盘古平台发现了一款仿冒奥地利“Willhaben”软件的钓鱼木马APP。"}
{"title": "FreeBuf早报｜Facebook承认用户关闭“位置服务”后 相关数据仍会被获取；工业网络间谍活动针对数百家公司；华为部分手机存在身份验证漏洞", "url": "https://www.freebuf.com/news/223116.html", "time": "2019-12-18", "level": "", "num_look": 62563, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "Facebook对美国的两位参议员解释了，为什么即使关闭了跟踪服务，他们也仍会跟踪用户的位置。但立法者依然表示，Facebook应该给用户更多的数据控制权。"}
{"title": "TP-Link Archer系列路由器漏洞可使Admin账户密码保护失效", "url": "https://www.freebuf.com/vuls/223076.html", "time": "2019-12-17", "level": "", "num_look": 112797, "num_comment": 1, "author": "freexploit", "tags": ["漏洞", "终端安全"], "text": "Internet路由器是连接我们工作，服务和休闲的无所不在的设备，已经成为每个家庭，企业和公共场所不可或缺的一部分。尽管它们对于我们与世界的连接至关重要，但它们却是我们每天使用的最不安全的设备之一。"}
{"title": "上课啦｜CIS 2019 「白帽LIVE」精品公开课正式上线", "url": "https://www.freebuf.com/news/222992.html", "time": "2019-12-17", "level": "", "num_look": 46835, "num_comment": 1, "author": "FB客服", "tags": ["活动", "资讯"], "text": "有趣有料的顶尖白帽，用每一枚漏洞，每一行代码，每一段神奇经历，将创新思维当作信仰去践行，最好的第一视角，就是坐在白帽对面。在这里，遇见这群人，成为这群人。"}
{"title": "Attack Monitor：一款功能强大的终端检测&恶意软件分析软件", "url": "https://www.freebuf.com/articles/network/221893.html", "time": "2019-12-17", "level": "", "num_look": 90393, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "Attack Monitor是一款Python应用程序，可以帮助安全研究人员增强Windows 7/2008（及所有更高版本）工作站或服务器的安全监控功能，并且能够自动对恶意软件进行动态分析。"}
{"title": "隔离网络那点事", "url": "https://www.freebuf.com/articles/network/222263.html", "time": "2019-12-17", "level": "红色标题", "num_look": 127811, "num_comment": 4, "author": "大清绿帽子王", "tags": ["网络安全"], "text": "通过无法访问互联网的封闭网络保护重要资产，攻击者不能与隔离网络（全文都在说物理隔离网络）直接通过网络接触，传统攻击渗透手段都会失效，但是隔离网络并不代表绝对安全。"}
{"title": "分析隐藏在比特币区块链中的Pony C&C服务器", "url": "https://www.freebuf.com/articles/blockchain-articles/221822.html", "time": "2019-12-17", "level": "", "num_look": 191807, "num_comment": 8, "author": "Alpha_h4ck", "tags": ["区块链安全"], "text": "Redaman是一种通过网络钓鱼攻击活动进行传播的银行恶意软件，主要目标用户为俄语用户。"}
{"title": "小米安全团队招新又双叒叕开始啦！", "url": "https://www.freebuf.com/jobs/223042.html", "time": "2019-12-17", "level": "", "num_look": 88097, "num_comment": 6, "author": "小米安全中心", "tags": ["安全招聘"], "text": "小米安全团队成立于2013年11月，致力于保障海量终端用户的安全。在这里你可以学习到各种黑客技术，可以第一手测试好玩的智能硬件。"}
{"title": "APT组织“蔓灵花”对巴基斯坦攻击事件报告", "url": "https://www.freebuf.com/articles/es/222232.html", "time": "2019-12-17", "level": "", "num_look": 104801, "num_comment": 6, "author": "瑞星", "tags": ["企业安全"], "text": "近期，瑞星威胁情报中心捕获到一起针对巴基斯坦攻击事件，攻击者疑似APT组织“蔓灵花”，该组织利用CVE-2017-11882漏洞，通过投递带有恶意链接的DOCX文档对受害者进行攻击。"}
{"title": "FreeBuf早报 | 新泽西州最大医院确认遭遇勒索软件的网络攻击；美国俩程序员认罪：其盗版视频网站用户数已超奈飞；英特尔以20亿美元收购Habana Labs", "url": "https://www.freebuf.com/news/223012.html", "time": "2019-12-17", "level": "", "num_look": 62985, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "美国两名程序员创办的盗版视频软件，用了短短数年时间，用户数量竟然超过了世界流媒体巨头Netflix。近日，这一案件被美国司法部公之于众。"}
{"title": "不传之密：杀毒软件开发之二，感染型病毒查杀、启发式杀毒", "url": "https://www.freebuf.com/articles/system/220573.html", "time": "2019-12-17", "level": "现金奖励", "num_look": 312113, "num_comment": 6, "author": "w2sfoot", "tags": ["系统安全"], "text": "编程殿堂中，工作无贵贱，但技术真有高低。在黑暗领域，PE感染型病毒历久以来处于技术金字塔的顶端，长久以来都蒙着一层神密的面纱。"}
{"title": "《2019 DDoS攻击态势报告》发布", "url": "https://www.freebuf.com/articles/paper/223048.html", "time": "2019-12-17", "level": "", "num_look": 116873, "num_comment": 1, "author": "绿盟科技", "tags": ["安全报告"], "text": "在网络安全事件频发，破坏威力越来越大的当下，如何及早洞察DDoS趋势，了解其攻击手法并做出有效应对，成为人们的焦点。"}
{"title": "AntiSpy：一款功能强大的反病毒&反Rootkit免费工具套件", "url": "https://www.freebuf.com/articles/system/221820.html", "time": "2019-12-16", "level": "", "num_look": 104181, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "AntiSpy是一款免费但功能强大的反病毒与反rootkit工具套件，该工具可以给安全研究人员提供最高级别的权限来帮助我们检测、分析和恢复各种内核修改以及钩子设置。"}
{"title": "挖洞经验 | 用IP轮换+暴力猜解禁用未确认的Facebook账户", "url": "https://www.freebuf.com/vuls/222128.html", "time": "2019-12-16", "level": "", "num_look": 144538, "num_comment": 8, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文分享的是通过IP轮换结合暴力破解方法禁用Facebook新创建的未确认用户。"}
{"title": "企业安全建设之自动化代码扫描", "url": "https://www.freebuf.com/articles/es/221198.html", "time": "2019-12-16", "level": "红色标题", "num_look": 227686, "num_comment": 12, "author": "hackeryeah", "tags": ["企业安全"], "text": "网上关于代码扫描的介绍无一不是在推荐基于语法语义分析的代码扫描工具，典型的代表就是fortify、Checkmarx。"}
{"title": "龙湖集团诚聘安全人才", "url": "https://www.freebuf.com/jobs/222922.html", "time": "2019-12-16", "level": "", "num_look": 126167, "num_comment": 4, "author": "cn_H5", "tags": ["安全招聘"], "text": "龙湖集团1993年创建于重庆，发展于全国，业务涵盖地产开发、商业运营、长租公寓、智慧服务四大主航道业务，并积极试水养老、产城等创新领域。"}
{"title": "TrickBot的演变历程", "url": "https://www.freebuf.com/articles/network/222252.html", "time": "2019-12-16", "level": "", "num_look": 78642, "num_comment": 2, "author": "深信服千里目安全实验室", "tags": ["网络安全"], "text": "鉴于该家族近期较为活跃，我们从其演变历程的角度给大家揭晓TrickBot银行木马背后那些事。"}
{"title": "调研400家企业的IT决策者：增加安全预算、采取混合IT环境成首选", "url": "https://www.freebuf.com/articles/network/221974.html", "time": "2019-12-16", "level": "", "num_look": 69603, "num_comment": 2, "author": "kirazhou", "tags": ["网络安全"], "text": "451 Research调研了400家大型公司的IT决策者，了解他们所处组织面临的网络安全现状、施行的安全计划，了解企业如何适应新兴技术进行数字化转型。"}
{"title": "FreeBuf早报 | 印度再次关闭互联网；iPhone用户成为恶意软件Krampus-3PC的目标；黑客攻破美一女孩房间安全摄像头并称自己是圣诞老人", "url": "https://www.freebuf.com/news/222903.html", "time": "2019-12-16", "level": "", "num_look": 83394, "num_comment": 2, "author": "kirazhou", "tags": ["资讯"], "text": "印度是世界上最频繁使用断网这一手段的国家，为了控制新入籍政策引发的抗议，它切断了阿萨姆邦和梅加拉亚邦的互联网访问。"}
{"title": "2020多行业安全预测", "url": "https://www.freebuf.com/articles/network/221918.html", "time": "2019-12-15", "level": "", "num_look": 109470, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "本文主要对5G、企业组织、金融以及医疗健康等产业2020安全进行预测。"}
{"title": "挖洞经验 | 百万用户个人信息泄露漏洞", "url": "https://www.freebuf.com/vuls/222028.html", "time": "2019-12-15", "level": "", "num_look": 154817, "num_comment": 6, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "今天分享的信息泄露漏洞涉及两家大公司的网站，出于隐私保密原因就不具体标明公司名称，漏洞导致将近百万用户的个人医疗数据PII和公司合作方信息存在泄露风险。"}
{"title": "Adobe Flash Player木马惊现新变种", "url": "https://www.freebuf.com/articles/terminal/221555.html", "time": "2019-12-15", "level": "", "num_look": 87064, "num_comment": 1, "author": "暗影安全实验室", "tags": ["终端安全"], "text": "最近暗影安全实验室在日常监测中发现了一款新的木马病毒Ginp，虽然他和前两周发布的反间谍之旅004报告中描述的“Flash Player”木马病毒名称很相似都带有“Flash Player”,但是他们却属于不同病毒家族。"}
{"title": "Docker容器安全性分析", "url": "https://www.freebuf.com/articles/system/221319.html", "time": "2019-12-15", "level": "", "num_look": 240569, "num_comment": 2, "author": "狴犴安全团队", "tags": ["容器安全", "系统安全"], "text": "Docker是目前最具代表性的容器技术之一，对云计算及虚拟化技术产生了颠覆性的影响。"}
{"title": "挖洞经验 | 利用graph.facebook.com中的反射型XSS实现Facebook账户劫持", "url": "https://www.freebuf.com/vuls/222260.html", "time": "2019-12-14", "level": "", "num_look": 109162, "num_comment": 3, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文分享的是graph.facebook.com中存在的反射型XSS漏洞，攻击者利用该漏洞可以构造恶意链接引诱受害者访问，添加账户绑定邮箱或手机号，从而实现对受害者Facebook账户的劫持。"}
{"title": "2019第三季度威胁报告", "url": "https://www.freebuf.com/articles/network/220575.html", "time": "2019-12-14", "level": "", "num_look": 1210617, "num_comment": 3, "author": "Kriston", "tags": ["安全报告", "网络安全"], "text": "每天Proofpoint都会分析超过50亿封电子邮件、数亿条社交媒体帖子和超过2.5亿个恶意软件样本，研究人员通过电子邮件、社交媒体和网络观察，监控复杂的威胁态势，为揭示和分析网络攻击策略、技术和程序（TTP）提供最…"}
{"title": "GarrantyDecrypt勒索病毒最新变种居然做出这种事", "url": "https://www.freebuf.com/articles/system/220878.html", "time": "2019-12-14", "level": "", "num_look": 86556, "num_comment": 86556, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近日，深信服安全团队追踪到GarrantyDecrypt勒索病毒的最新变种，该变种会加密其所能访问的除Windows目录以外的所有文件，可谓寸草不生。"}
{"title": "BUF大事件丨Elasticsearch 27亿数据泄露，波及中国大厂；460,000+张支付卡数据在暗网论坛出售；uTorrent遭杀毒软件围剿", "url": "https://www.freebuf.com/news/222882.html", "time": "2019-12-14", "level": "红色标题", "num_look": 160891, "num_comment": 2, "author": "Darry端", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，Elasticsearch 27亿数据泄露：10亿明文，波及中国大厂；460,000+张支付卡数据在暗网论坛出售；uTorrent遭杀毒软件围剿。"}
{"title": "工控CTF之某固件分析解题", "url": "https://www.freebuf.com/articles/ics-articles/221625.html", "time": "2019-12-14", "level": "", "num_look": 216578, "num_comment": 2, "author": "ww5466064", "tags": ["工控安全"], "text": "在2019年工业信息安全技能大赛第一场线上赛中有一道固件分析的题目，当时虽然Get到了答案，却终归是知其然不知其所以然，于是决定搭个环境来完整分析一下，顺便学习一下路由器漏洞分析。"}
{"title": "【FreeBuf字幕组】CTF难题挑战：泄漏堆和 Libc 地址（二）", "url": "https://www.freebuf.com/video/218202.html", "time": "2019-12-13", "level": "红色标题", "num_look": 113855, "num_comment": 113855, "author": "Darry端", "tags": ["视频"], "text": "CTF难题挑战主要聚焦于各种CTF比赛中的难题讲解。本期视频讲师围绕2016年的Boston Key Party CTF cookbook一题展开讲解，本期视频的主要内容为泄漏堆和 Libc 地址。"}
{"title": "BaseQuery：一款数据漏洞以及泄露数据的强大搜索工具", "url": "https://www.freebuf.com/sectool/221780.html", "time": "2019-12-13", "level": "", "num_look": 152315, "num_comment": 152315, "author": "Alpha_h4ck", "tags": ["工具"], "text": "是如果你想确切地知道其他人可以获得你的哪些信息，该怎么办呢？BaseQuery就是答案，BaseQuery是一个多功能应用程序，可以轻松地导入和搜索成千上万的泄露数据。"}
{"title": "谷歌紧急修复两个严重的零日漏洞，Chrome用户需尽快更新", "url": "https://www.freebuf.com/news/222816.html", "time": "2019-12-13", "level": "", "num_look": 284906, "num_comment": 7, "author": "kirazhou", "tags": ["资讯"], "text": "最近，谷歌发布的紧急安全补丁程序中修复了两个严重的零日漏洞，而其中一个（CVE-2019-13720）已经被黑客利用，向用户发起攻击。"}
{"title": "TA2101黑客组织攻击分析", "url": "https://www.freebuf.com/articles/network/220448.html", "time": "2019-12-13", "level": "", "num_look": 78221, "num_comment": 2, "author": "Kriston", "tags": ["网络安全"], "text": "研究人员最近发现了新的黑客组织攻击活动，被命名为TA2101，其目标是在德国公司和组织安装后门恶意软件。"}
{"title": "月光再临：MoonLight组织针对中东地区的最新攻击活动剖析", "url": "https://www.freebuf.com/articles/system/221351.html", "time": "2019-12-13", "level": "", "num_look": 72957, "num_comment": 2, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "自2019年4月以来，奇安信APT实验室与奇安信威胁情报中心在日常威胁狩猎过程中监测到一批针对巴勒斯坦及加沙地区的有组织的、持续性的网络攻击行为，攻击面广、受害范围大，产生了严重的网络安全威胁，对此我们时刻…"}
{"title": "ACLU起诉美国国土安全局，又双叒叕是电话监听？", "url": "https://www.freebuf.com/news/222772.html", "time": "2019-12-13", "level": "", "num_look": 65558, "num_comment": 2, "author": "kirazhou", "tags": ["资讯"], "text": "该诉讼要求美国国土安全局两个机构公布他们使用手机监控工具的细节信息。据了解，这些设备伪装成一个手机信号塔来获取数据。"}
{"title": "Python代码审计实战案例总结之SQL和ORM注入", "url": "https://www.freebuf.com/vuls/221548.html", "time": "2019-12-13", "level": "现金奖励", "num_look": 156295, "num_comment": 5, "author": "米怀特", "tags": ["WEB安全", "漏洞"], "text": "Python代码审计方法多种多样，但是总而言之是根据前人思路的迁移融合扩展而形成。目前Python代码审计思路，呈现分散和多样的趋势。"}
{"title": "FreeBuf早报 | Elasticsearch 27亿数据泄露；一种新的勒索软件针对欧洲和美国的公司；网络钓鱼活动使用恶意Office 365应用", "url": "https://www.freebuf.com/news/222795.html", "time": "2019-12-13", "level": "", "num_look": 65217, "num_comment": 65217, "author": "shidongqi", "tags": ["资讯"], "text": "新一轮的数据泄露事件便再度发生。这次，研究人员在不安全的云存储桶中，总共发现了 27 亿个电子邮件地址、10 亿个电子邮件账户密码，以及一个装载了近 80 万份出生证明副本的应用程序。"}
{"title": "APP应用的安全保护指南", "url": "https://www.freebuf.com/articles/neopoints/221779.html", "time": "2019-12-13", "level": "", "num_look": 80362, "num_comment": 2, "author": "战争贩子", "tags": ["观点"], "text": "随着移动应用使用率的大幅增长，其被攻击的风险也在增加。根据Gartner的一项研究，“75%的移动应用程序将无法通过基本的安全测试”。大多数企业主认为移动应用不容易受到网络攻击。"}
{"title": "勒索软件Snatch利用安全模式绕过杀毒软件", "url": "https://www.freebuf.com/articles/network/222680.html", "time": "2019-12-12", "level": "", "num_look": 117884, "num_comment": 2, "author": "Kriston", "tags": ["网络安全"], "text": "研究人员发现勒索软件Snatch可使Windows重新启动到安全模式来绕过安全保护。"}
{"title": "精彩大事件 | 2020上半年FreeBuf活动&报告计划新鲜出炉", "url": "https://www.freebuf.com/fevents/222730.html", "time": "2019-12-12", "level": "红色标题", "num_look": 55682, "num_comment": 2, "author": "FB独家", "tags": ["活动"], "text": "FreeBuf 2020上半年的活动&报告计划已新鲜出炉~"}
{"title": "APT33同时利用多个僵尸网络攻击目标", "url": "https://www.freebuf.com/articles/network/220300.html", "time": "2019-12-12", "level": "", "num_look": 86585, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "APT33常以石油和航空业为攻击目标，最近的调查结果显示，该组织一直在使用大约12台经过多重混淆的C&C服务器来攻击特定目标。"}
{"title": "阿里云安全招聘云平台安全专家", "url": "https://www.freebuf.com/jobs/222557.html", "time": "2019-12-12", "level": "", "num_look": 90759, "num_comment": 1, "author": "阿里云安全", "tags": ["安全招聘"], "text": "自2009年阿里云成立的第一天起，安全就是头等大事。经过10年的积累，阿里云安全在为国家重大活动以及天猫、淘宝、支付宝的护航过程中沉淀了强大的工程化能力和大项目护航能力。"}
{"title": "Google OpenTitan，硬件安全的泰坦之箭？", "url": "https://www.freebuf.com/vuls/221401.html", "time": "2019-12-12", "level": "", "num_look": 241444, "num_comment": 2, "author": "腾讯安全平台部", "tags": ["安全管理", "漏洞"], "text": "从Windows 98的CIH病毒，到2011年的BMW木马，再到2018年的APT-28攻击，底层安全威胁此起彼伏。企业信息基础设施是否值得信任，已成为服务提供商需要回应的关键问题。"}
{"title": "SELinux系统安全策略及其配置分析", "url": "https://www.freebuf.com/articles/system/222712.html", "time": "2019-12-12", "level": "现金奖励", "num_look": 95718, "num_comment": 2, "author": "c9t9h5", "tags": ["系统安全"], "text": "本文档详细介绍了传统Linux的安全性，SELinux的诞生及技术背景，并结合大量实践，使一个没有接触过SELinux的Linux爱好者能够在看完本篇文档之后，迅速掌握基本的SELinux知识。"}
{"title": "漫谈大数据平台架构", "url": "https://www.freebuf.com/articles/database/221147.html", "time": "2019-12-12", "level": "红色标题", "num_look": 183782, "num_comment": 3, "author": "superhuawei", "tags": ["数据安全"], "text": "近年来，互联网公司中大数据平台的建设和安全一直是热点。笔者计划发两篇文章参与一下讨论，一篇架构+一篇安全。本文不依托于任何一家大厂的平台架构，用通俗的语言介绍一下大数据平台的整体架构。"}
{"title": "威胁情报的私有化生产和级联：威胁狩猎及情报共享", "url": "https://www.freebuf.com/articles/es/222359.html", "time": "2019-12-12", "level": "", "num_look": 112464, "num_comment": 3, "author": "狴犴安全团队", "tags": ["企业安全"], "text": "随着互联网特别是移动互联网的发展，网络环境愈发复杂，不同的攻击行为更具产业化、团伙化，入侵手法也愈发多样化与复杂化。"}
{"title": "等保2.0标准个人解读（五）：安全物理环境", "url": "https://www.freebuf.com/articles/es/222523.html", "time": "2019-12-12", "level": "", "num_look": 155952, "num_comment": 3, "author": "宇宸de研究室", "tags": ["企业安全", "标准与合规"], "text": "从等保2.0标准的要求项来看，和旧标准基本没有区别，可以完全参照等保1.0来做。"}
{"title": "FreeBuf早报｜YouTube希望FTC放宽儿童在线隐私保护法的限制；伊朗计划推进局域网计划；印度提出类似 GDPR 的公民数据访问规定", "url": "https://www.freebuf.com/news/222671.html", "time": "2019-12-12", "level": "", "num_look": 59296, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "现在，YouTube希望美国政府放宽儿童在线隐私保护法（COPPA）对其平台的约束。"}
{"title": "KVMSEC：一个Linux内核虚拟机的安全扩展", "url": "https://www.freebuf.com/articles/system/222197.html", "time": "2019-12-11", "level": "金币+20", "num_look": 89311, "num_comment": 1, "author": "c9t9h5", "tags": ["系统安全"], "text": "以虚拟化PC为应用的数据中心服务器群增长很快。本文介绍的这个架构，优点是增加全局系统安全。"}
{"title": "网络战之打飞机：无人机渗透测试框架DroneSploit面世", "url": "https://www.freebuf.com/articles/terminal/222633.html", "time": "2019-12-11", "level": "红色标题", "num_look": 419866, "num_comment": 6, "author": "黑鸟", "tags": ["极客", "终端安全"], "text": "曾经有一本书《怎样打飞机》，开创了步枪击落飞机的教育先河，14发子弹击落美军战斗机，堪称牛逼。"}
{"title": "2019年全球重大网络攻击及数据泄露事件回顾", "url": "https://www.freebuf.com/articles/network/222565.html", "time": "2019-12-11", "level": "", "num_look": 311703, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "近年来，不断有数据泄露事件发生，包括医疗信息、账户凭证、公司电子邮件和企业内部敏感数据泄露。下面，我们来回顾一下2019年发生的数据泄露和网络攻击事件。"}
{"title": "老赵说安全系列：浅谈数据安全和隐私保护", "url": "https://www.freebuf.com/articles/database/221056.html", "time": "2019-12-11", "level": "现金奖励", "num_look": 626365, "num_comment": 9, "author": "xiaoguazh", "tags": ["数据安全"], "text": "这次的话题是“浅谈数据安全和隐私保护”。这是一个看似离我们很远，但又时刻发生在大伙身边的问题。每一年都有各种数据泄漏的大事件。其中包括一些互联网巨头， 涉及到百万，千万级的数据。"}
{"title": "新浪安全工程师招聘", "url": "https://www.freebuf.com/jobs/222466.html", "time": "2019-12-11", "level": "", "num_look": 62440, "num_comment": 4, "author": "-吗_啡-", "tags": ["安全招聘"], "text": "新浪公司是一家服务于中国及全球华人社群的网络媒体公司。新浪通过门户网站新浪网(SINA.com)、移动门户手机新浪网(SINA.cn)和社交网络服务及微博客服务新浪微博(Weibo.com)组成的数字媒体网络。"}
{"title": "McAfee考虑和NortonLifeLock合并消费业务", "url": "https://www.freebuf.com/news/222480.html", "time": "2019-12-11", "level": "", "num_look": 41922, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "据知情人士透露，目前拥有160亿美元资产的消费软件公司NortonLifeLock已引起了少数几家公司的合作兴趣，其中包括竞争对手英特尔旗下的杀毒软件公司McAfee。"}
{"title": "警惕会“说话”的新型迷宫勒索病毒", "url": "https://www.freebuf.com/articles/terminal/221517.html", "time": "2019-12-11", "level": "", "num_look": 76255, "num_comment": 5, "author": "亚信安全", "tags": ["终端安全"], "text": "近日，亚信安全截获新型迷宫（Maze）勒索病毒变种文件，该病毒与众不同的是，其完成加密数据后会循环播放文件被加密的录音，多种渠道通知受害者已经感染勒索病毒。亚信安全将其命名为 Ransom.Win32.MAZE.E。"}
{"title": "新发现的Mac恶意软件使用“无文件”感染保持隐身状态", "url": "https://www.freebuf.com/news/222356.html", "time": "2019-12-11", "level": "", "num_look": 68457, "num_comment": 2, "author": "kirazhou", "tags": ["资讯"], "text": "最近，安全研究人员发现朝鲜黑客团伙在利用Mac恶意软件加强其攻击活动，该恶意软件使用内存中执行来保持隐身。"}
{"title": "FreeBuf早报｜GitHub 计划在中国设立子公司；印度武装部队遭受钓鱼攻击；谷歌开源的路径缺陷检测工具", "url": "https://www.freebuf.com/news/222566.html", "time": "2019-12-11", "level": "", "num_look": 67722, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": "在新德里，武装部队在周五深夜受到攻击者的袭击后，三军网络部门向所有国防人员发出紧急警告，禁止其访问带有附件的标题为“通知”的邮件。"}
{"title": "Cacti：一套完整的网络图形化解决方案", "url": "https://www.freebuf.com/articles/network/221608.html", "time": "2019-12-10", "level": "", "num_look": 102148, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "Cacti是一款功能完整的网络图形化解决方案，旨在利用RRDtool的数据存储以及图形化功能来给广大安全研究人员提供以下功能性帮助。"}
{"title": "uTorrent被多个杀软拦截，疑似捆绑推广行为导致", "url": "https://www.freebuf.com/news/222454.html", "time": "2019-12-10", "level": "红色标题", "num_look": 72328, "num_comment": 7, "author": "Allen别bb", "tags": ["资讯"], "text": "知名 torrent 下载客户端uTorrent近期发现遭到多个杀毒软件的封杀，包括Windows defender在内的一系列杀毒软件均将其标记为威胁，警告用户停止使用。"}
{"title": "Platinum黑客组织攻击分析", "url": "https://www.freebuf.com/articles/network/219741.html", "time": "2019-12-10", "level": "", "num_look": 100759, "num_comment": 5, "author": "Kriston", "tags": ["网络安全"], "text": "Platinum黑客组织是亚太地区技术最先进的APT之一。在最近的分析中发现Platinum使用了一种新的后门，我们称之为Titanium。Titanium分为多个阶段，通过模仿常见软件将每一步都隐藏起来。"}
{"title": "泄漏在搜索引擎中的敏感信息", "url": "https://www.freebuf.com/articles/database/220814.html", "time": "2019-12-10", "level": "现金奖励", "num_look": 228772, "num_comment": 3, "author": "晴雯晴雯晴雯", "tags": ["数据安全"], "text": "很多个人、公司和机构把一些敏感信息暴露在了互联网上而不自知。一些Hacker就利用搜索引擎来获取这些敏感信息，从而进行一些攻击。"}
{"title": "代码分析引擎 CodeQL 初体验", "url": "https://www.freebuf.com/articles/network/220497.html", "time": "2019-12-10", "level": "", "num_look": 119811, "num_comment": 2, "author": "Knownsec知道创宇", "tags": ["网络安全"], "text": "QL是一种查询语言，支持对C++，C#，Java，JavaScript，Python，go等多种语言进行分析，可用于分析代码，查找代码中控制流等信息。"}
{"title": "FreeBuf早报 | 4400万个微软帐户使用泄露的密码；工信部组织BAT等开座谈会，强化企业防治诈骗主体责任；日本安保机构因担心机密泄露计划停止购买和使用中国制造无人机", "url": "https://www.freebuf.com/news/222421.html", "time": "2019-12-10", "level": "", "num_look": 62663, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "据日本经济新闻报道，日本海上保安厅计划从明年起停止购买和使用中国无人机。该机构认为继续使用中国制造无人机将有机密信息泄露的危险。"}
{"title": "DSMM之数据处理安全", "url": "https://www.freebuf.com/articles/database/220653.html", "time": "2019-12-10", "level": "现金奖励", "num_look": 147179, "num_comment": 4, "author": "LJ_Monica", "tags": ["数据安全"], "text": "有人想看数据安全能力成熟度模型（DSMM，以下简称DSMM）的数据处理安全部分，今天它来了……"}
{"title": "导弹级ABB发电信息管理系统漏洞曝光，或成网电作战致命武器", "url": "https://www.freebuf.com/articles/system/220827.html", "time": "2019-12-10", "level": "", "num_look": 88047, "num_comment": 3, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "ABB在中国拥有研发、制造、销售和工程服务等全方位的业务活动，44家本地企业，近2万名员工遍布于130余个城市，线上和线下渠道覆盖全国约700个城市。"}
{"title": "2019第三季度网络威胁分析", "url": "https://www.freebuf.com/articles/network/221640.html", "time": "2019-12-09", "level": "", "num_look": 95858, "num_comment": 2, "author": "Kriston", "tags": ["网络安全"], "text": "卡巴斯基第三季度阻止了来自全球203个国家的发起的989432403次攻击。"}
{"title": "浅谈安全行业的岗位抉择", "url": "https://www.freebuf.com/articles/neopoints/214857.html", "time": "2019-12-09", "level": "现金奖励", "num_look": 453851, "num_comment": 35, "author": "绿帽子技术分享", "tags": ["观点"], "text": "在电话沟通的过程中，一个个没见过面的大“基”佬，通常我们会沟通的非常愉快，从交流的过程中，我们能了解到，目前大多数安全公司所需要的岗位人员及技能要求。"}
{"title": "挖洞经验 | 利用简单暴力枚举绕过目标系统2FA验证机制", "url": "https://www.freebuf.com/vuls/219813.html", "time": "2019-12-09", "level": "", "num_look": 131754, "num_comment": 18, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "今天分享的这篇Writeup是作者在参与漏洞众测中，针对目标系统的动态口令OTP (One Time Password)，通过利用简单的暴力枚举方法，实现了对目标系统双因素验证机制2FA (Two-Factor Authentication)的绕过或破解。"}
{"title": "利用IQY（Excel Web Query）文件分发，Buran勒索病毒又出新变种", "url": "https://www.freebuf.com/articles/system/220725.html", "time": "2019-12-09", "level": "", "num_look": 101811, "num_comment": 3, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "一项新的垃圾邮件活动用来传播Buran勒索病毒，其通过传播IQY（Microsoft Excel Web Query）附件，诱导用户打开附件，该附件通过请求网上数据执行powershell，用来进行病毒母体的下载。"}
{"title": "深入浅出理解操作系统安全", "url": "https://www.freebuf.com/articles/system/220576.html", "time": "2019-12-09", "level": "金币+15", "num_look": 135608, "num_comment": 4, "author": "c9t9h5", "tags": ["系统安全"], "text": "操作系统安全在计算机信息系统的整体安全性中具有至关重要的作用，没有操作系统提供的安全性，计算机业务系统的安全性是没有基础的。"}
{"title": "FreeBuf早报｜宝马和现代公司被越南黑客入侵；《中国体育》APP遭受黑客攻击的情况说明；VMware解决了在天府杯黑客大赛中披露的ESXi问题", "url": "https://www.freebuf.com/news/222277.html", "time": "2019-12-09", "level": "", "num_look": 102199, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "12月7日晚间，《中国体育》zhibo.tv服务器遭受境外黑客恶意攻击，短时间内出现连续向用户推送非法网站广告的情况。《中国体育》zhibo.tv技术团队紧急排查修复，同时，第一时间向公安机关报案。"}
{"title": "警惕SODINOKIBI勒索病毒再变种，勒索巨额赎金", "url": "https://www.freebuf.com/articles/terminal/221845.html", "time": "2019-12-09", "level": "", "num_look": 77774, "num_comment": 77774, "author": "亚信安全", "tags": ["终端安全"], "text": "近日，亚信安全截获SODINOKIBI勒索病毒最新变种文件，与以往不同的是，本次截获的勒索病毒的payload是一个DLL文件（以往样本是EXE可执行文件），通过进程注入方式加载，从而逃避检测。"}
{"title": "Sfone蠕虫分析之看片需谨慎", "url": "https://www.freebuf.com/articles/system/221420.html", "time": "2019-12-08", "level": "现金奖励", "num_look": 105541, "num_comment": 2, "author": "JustPlay", "tags": ["系统安全"], "text": "当我在搜索这个网站时，我还发现了一些其他的类似的“学习网站”，强大的好奇心再次驱使我“学习”。作为一名下载党，点击了页面上的一些按钮。"}
{"title": "如何使用ADSI接口和反射型DLL枚举活动目录", "url": "https://www.freebuf.com/articles/system/218855.html", "time": "2019-12-08", "level": "", "num_look": 69135, "num_comment": 69135, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "在这篇文章中，我们将告诉大家如何使用活动目录服务接口（ADSI）并结合C/C++来实现Cobalt Strike的活动目录枚举。"}
{"title": "2019年全球十大流行勒索病毒", "url": "https://www.freebuf.com/articles/system/222029.html", "time": "2019-12-08", "level": "红色标题", "num_look": 262596, "num_comment": 4, "author": "熊猫正正", "tags": ["系统安全"], "text": "2019年应该是勒索病毒针对企业攻击爆发的一年，这一年全球各地仿佛都在被“勒索”，每天全球各地都有不同的政府、企业、组织机构被勒索病毒攻击的新闻被曝光，勒索病毒已经成为了网络安全最大的威胁。"}
{"title": "企业感染恶意软件的处理建议", "url": "https://www.freebuf.com/articles/security-management/220758.html", "time": "2019-12-08", "level": "金币+15", "num_look": 251247, "num_comment": 251247, "author": "xu5eii", "tags": ["安全管理"], "text": "企业网络感染恶意软件可能会造成关键信息系统或数据的破坏，直接威胁正常业务的运行。"}
{"title": "冰蝎动态二进制加密WebShell基于流量侧检测方案", "url": "https://www.freebuf.com/articles/web/221241.html", "time": "2019-12-08", "level": "红色标题", "num_look": 172069, "num_comment": 9, "author": "chujian0", "tags": ["WEB安全"], "text": "冰蝎是一款新型动态二进制加密网站工具。目前已经有6个版本。对于webshell的网络流量侧检测，主要有三个思路。"}
{"title": "深入分析一个Pwn2Own的优质Webkit漏洞", "url": "https://www.freebuf.com/vuls/221577.html", "time": "2019-12-07", "level": "", "num_look": 109325, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["漏洞", "系统安全"], "text": "今年的Pwn2Own比赛刚刚结束，在Pwn2Own温哥华站的比赛中，Fluoroacetate团队所使用的一个WebKit漏洞成功吸引了我的注意。"}
{"title": "挖洞经验 | 从Avast杀毒软件发现价值5000美金的反射型XSS", "url": "https://www.freebuf.com/vuls/219686.html", "time": "2019-12-07", "level": "", "num_look": 128414, "num_comment": 5, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文讲述作者从Avast桌面版杀毒软件中发现反射型XSS漏洞（CVE-2019–18653 & CVE-2019–18654）。"}
{"title": "捍卫信任共探未来，2019京麒国际安全峰会精华回顾", "url": "https://www.freebuf.com/fevents/222133.html", "time": "2019-12-07", "level": "红色标题", "num_look": 58936, "num_comment": 2, "author": "Akane", "tags": ["活动"], "text": "一旦“可信”网络中的某个主机被攻陷，那么攻击者很快就能以此为跳板完成入侵。网络安全的信任边界到底在哪里？我们又应该如何捍卫信任呢？"}
{"title": "英国核发电厂遭受网络攻击，疑似法国电力公司受影响", "url": "https://www.freebuf.com/articles/system/221713.html", "time": "2019-12-07", "level": "", "num_look": 76363, "num_comment": 76363, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "英国，以美国为首的“五眼联盟”成员之一，近年来在网络安全攻防方面投入了大量资源，但近日却被爆出其核工业设施被外部势力执行了网络攻击。"}
{"title": "BUF大事件丨100款App违法采集个人信息被整改下架；等级保护 2.0 标准正式实施；iPhone 11 Pro收集用户位置数据", "url": "https://www.freebuf.com/news/222110.html", "time": "2019-12-07", "level": "红色标题", "num_look": 117851, "num_comment": 117851, "author": "Darry端", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，100款App违法采集个人信息被整改下架；12 月 1 日，等级保护 2.0 标准正式实施；微信暗藏代收验证码服务：被用作App虚假注册、诈骗。"}
{"title": "Apache Axis 1.4远程命令执行诡异探索之路", "url": "https://www.freebuf.com/vuls/220034.html", "time": "2019-12-07", "level": "现金奖励", "num_look": 135174, "num_comment": 135174, "author": "1u0hun", "tags": ["WEB安全", "漏洞"], "text": "axis 全称Apache EXtensible Interaction System 即Apache可扩展交互系统。axis 为创建服务器端、客户端和网关SOAP等操作提供基本框架。"}
{"title": "俄罗斯Evil Corp犯罪组织被指控窃取超过1亿美元", "url": "https://www.freebuf.com/news/222194.html", "time": "2019-12-06", "level": "", "num_look": 72896, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "美国司法部（DoJ）指控俄罗斯公民Maksim V. Yakubets和Igor Turashev部署了Dridex恶意软件（又名Bugat和Cridex），并参与了国际银行欺诈和计算机黑客计划。"}
{"title": "安全小游戏：寻找漏洞", "url": "https://www.freebuf.com/articles/web/221415.html", "time": "2019-12-06", "level": "", "num_look": 121511, "num_comment": 4, "author": "晴雯晴雯晴雯", "tags": ["WEB安全"], "text": "YouTube上的一个视频，分享给大家。这里存在一个Bug，你能找到Ta吗？"}
{"title": "【FreeBuf字幕组】Web安全漏洞系列：2019 Google CTF题型讲解", "url": "https://www.freebuf.com/video/216237.html", "time": "2019-12-06", "level": "红色标题", "num_look": 96171, "num_comment": 2, "author": "Darry端", "tags": ["视频"], "text": "本课程围绕2019 Google CTF中的Pastetastic一题展开学习。通过本期视频，我们将会了解dom的破坏、chrome的xss审计程序的丢失以及iframe如何应用相同的源代码。"}
{"title": "期待下一个十年｜CIS 2019温馨回顾（附PPT下载）", "url": "https://www.freebuf.com/fevents/222236.html", "time": "2019-12-06", "level": "红色标题", "num_look": 202590, "num_comment": 7, "author": "shidongqi", "tags": ["活动"], "text": "从Excel表格中多达六百多项的预设计划表到感恩节的圆满谢幕，对于所有参会的朋友而言可能只是短短两天，但对于我们所有准备这场大会的小伙伴来说，这是一场在去年FIT 2019结束之后就已经开始的持久战。"}
{"title": "关于2020年的安全预测", "url": "https://www.freebuf.com/articles/network/220732.html", "time": "2019-12-06", "level": "", "num_look": 104975, "num_comment": 3, "author": "Kriston", "tags": ["网络安全"], "text": "没有什么比做预测更难的了，研究人员根据过去12个月所发生的事情，安全领域专家的知识和对APT攻击的观察研究，对未来做出如下预测。"}
{"title": "CrySiS勒索病毒最新变种来袭，加密后缀为kharma", "url": "https://www.freebuf.com/articles/system/221128.html", "time": "2019-12-06", "level": "", "num_look": 82674, "num_comment": 2, "author": "熊猫正正", "tags": ["系统安全"], "text": "近日国外安全研究人员发现这款勒索病毒的最新的变种，与以往变种不一样，这款最新的变种使用NET语言进行编写，加密后的文件后缀为kharma，之所以采用NET语言进行编写，可能也是为了逃避杀毒软件的检测。"}
{"title": "工控安全入门之攻与防", "url": "https://www.freebuf.com/articles/ics-articles/220302.html", "time": "2019-12-06", "level": "现金奖励", "num_look": 491985, "num_comment": 13, "author": "Parad0x", "tags": ["工控安全"], "text": "2010 年 6 月，一个名为 Stuxnet 处于休眠状态的病毒潜伏在伊朗的铀浓缩设施网络中，Stuxnet 在位于纳坦兹的离心机中被激活，控制了30%的纳坦兹设施的计算机，致使伊朗暂时关闭了核设施和核电厂。"}
{"title": "FreeBuf早报 | 百余款App因违法采集信息下架整改？部分App仍可搜索、下载；隔空盗刷又升级，警方发现“嗅探伪基站”；收集售卖儿童用户信息，抖音母公司字节跳动遭到起诉", "url": "https://www.freebuf.com/news/222075.html", "time": "2019-12-06", "level": "", "num_look": 124362, "num_comment": 124362, "author": "Sandra1432", "tags": ["资讯"], "text": "12月5日，据国外媒体The Verge报道，抖音短视频的母公司字节跳动因为收集未成年人的用户信息，涉嫌违反儿童隐私权法而遭到起诉。"}
{"title": "零信任+：边界信任模型，零信任模型与零信任+浅谈", "url": "https://www.freebuf.com/articles/es/220633.html", "time": "2019-12-06", "level": "", "num_look": 186460, "num_comment": 14, "author": "派拉软件", "tags": ["企业安全"], "text": "所谓边界信任就是明确什么是可信任的设备或网络环境，什么是不可信任的设备或网络环境，并在这两者之间建立“城墙”。"}
{"title": "HAL：一款功能强大的硬件安全分析工具", "url": "https://www.freebuf.com/articles/terminal/221644.html", "time": "2019-12-05", "level": "", "num_look": 96516, "num_comment": 96516, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "HAL是一款针对网关级网络设备列表的完整的逆向工程分析套件以及操作框架，该工具专注于提升网络安全人员的效率、可扩展性和可移植性。HAL附带了成熟的插件系统，允许安全研究人员在内核中引入任意功能。"}
{"title": "史上被复制最多的StackOverflow Java代码段中包含一个Bug", "url": "https://www.freebuf.com/news/222093.html", "time": "2019-12-05", "level": "", "num_look": 85594, "num_comment": 4, "author": "kirazhou", "tags": ["资讯"], "text": "一直以来，被复制使用最多的StackOverflow Java代码段中暗藏一个bug。该代码的作者，Palantir的Java开发人员Andreas Lundblad亲自承认了这件事。"}
{"title": "如何绕过PowerShell访问限制并实现PowerShell代码执行", "url": "https://www.freebuf.com/articles/system/218883.html", "time": "2019-12-05", "level": "", "num_look": 94338, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "如果你是一名专业的渗透测试人员，那你可能真的离不开PowerShell，但是如果目标系统中的某个策略组织我们访问PowerShel.exe，那我们该怎么办呢？没错，这个问题经常会困扰我们，而且网上也有很多的应对方法。"}
{"title": "新东方教育科技集团招聘信息安全人才", "url": "https://www.freebuf.com/jobs/222049.html", "time": "2019-12-05", "level": "", "num_look": 90648, "num_comment": 10, "author": "xdf", "tags": ["安全招聘"], "text": "新东方教育科技集团由1993年11月16日成立的北京新东方学校发展壮大而来，集团以培训为核心，拥有满天星幼儿园、泡泡少儿教育、大学英语及考研培训、出国考试培训、多语种培训等多个培训体系。"}
{"title": "十年回顾：2010年以来重大网络安全事件盘点", "url": "https://www.freebuf.com/articles/network/221984.html", "time": "2019-12-05", "level": "红色标题", "num_look": 249396, "num_comment": 5, "author": "Sandra1432", "tags": ["网络安全"], "text": "二十一世纪的第二个十年即将过去，在过去十年里发生了哪些重要网络安全事件，小编带大家一起来回顾一下。"}
{"title": "KB22871997是否真的能防御PTH攻击？", "url": "https://www.freebuf.com/articles/system/220473.html", "time": "2019-12-05", "level": "", "num_look": 103819, "num_comment": 3, "author": "云影实验室", "tags": ["系统安全"], "text": "在内网渗渗透时，当我们通过GPP漏洞等方式获取到凭据后，将会使用这组凭据进行横向移动，进行权限提升。"}
{"title": "将MITRE ATT＆CK模型应用于网络设备", "url": "https://www.freebuf.com/articles/es/220628.html", "time": "2019-12-05", "level": "红色标题", "num_look": 128370, "num_comment": 3, "author": "makaisghr", "tags": ["企业安全"], "text": "信息安全社区经常忽视作为端点的网络设备。大多数人专注于保护系统和检测Windows域环境中的威胁，也包括检测运行MacOS和Linux系统的端点上的威胁。"}
{"title": "FreeBuf早报｜首部互联网司法白皮书发布；欧洲刑警组织在全球执法中关闭了超过30500个售假网站；报告称即使禁用定位服务 iPhone 11 Pro仍会继续收集用户的位置数据", "url": "https://www.freebuf.com/news/222018.html", "time": "2019-12-05", "level": "", "num_look": 61070, "num_comment": 2, "author": "kirazhou", "tags": ["资讯"], "text": "互联网司法制度总体框架已初步搭建完成，最高法将推动立法机关制定专门的“电子诉讼法”。"}
{"title": "工控网络安全学习路线", "url": "https://www.freebuf.com/articles/ics-articles/220172.html", "time": "2019-12-05", "level": "", "num_look": 227998, "num_comment": 6, "author": "xxcy235", "tags": ["工控安全"], "text": "对于我国而言，工业控制系统安全所面临的重要问题是自主可控的问题，我国在工控领域对国外设备和技术的依赖程度强。"}
{"title": "Strandhogg漏洞：Android系统上的维京海盗", "url": "https://www.freebuf.com/news/221933.html", "time": "2019-12-04", "level": "", "num_look": 150712, "num_comment": 1, "author": "0day情报局", "tags": ["漏洞", "资讯"], "text": "挪威一家安全公司披露了一个Android应用漏洞，并用描述维京海盗突袭战术的单词StrandHogg对其命名。值得庆幸的是，谷歌已采取措施解决该漏洞，并暂停了受影响的应用程序。"}
{"title": "“A.I.type”虚拟键盘的风险提示", "url": "https://www.freebuf.com/articles/terminal/220920.html", "time": "2019-12-04", "level": "", "num_look": 78123, "num_comment": 1, "author": "暗影安全实验室", "tags": ["终端安全"], "text": "A.I.type虚拟键盘是由ai.type公司开发的一款可定制的移动设备屏幕键盘应用程序，允许终端用户根据个人喜好定制键盘。"}
{"title": "揭秘美国网络安全体系架构", "url": "https://www.freebuf.com/articles/network/221852.html", "time": "2019-12-04", "level": "红色标题", "num_look": 221652, "num_comment": 3, "author": "kirazhou", "tags": ["网络安全"], "text": "美国的网络安全体系架构是怎么样的？其如何贯穿在美国的网络安全计划中、落实到具体机构的？和笔者一起揭秘美国的网络安全体系架构。"}
{"title": "针对Steam平台的攻击分析", "url": "https://www.freebuf.com/articles/network/218771.html", "time": "2019-12-04", "level": "", "num_look": 134955, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "数字游戏平台服务不仅简化了游戏本身的销售，还为开发商提供了额外的盈利手段。"}
{"title": "不传之密：杀毒软件开发，原理、设计、编程实战", "url": "https://www.freebuf.com/articles/system/220061.html", "time": "2019-12-04", "level": "现金奖励", "num_look": 206964, "num_comment": 12, "author": "w2sfoot", "tags": ["系统安全"], "text": "本文将向各位读者展示如何开发杀毒软件。"}
{"title": "绿盟科技2020（工程线）招聘简章", "url": "https://www.freebuf.com/jobs/221337.html", "time": "2019-12-04", "level": "", "num_look": 108174, "num_comment": 9, "author": "wangchuanzhen", "tags": ["安全招聘"], "text": "绿盟科技（NSFOCUS）成立于2000年，并于2014年1月29日马年新春来临之际成功上市！"}
{"title": "Windows与Linux双平台无文件攻击：PowerGhost挖矿病毒最新变种感染多省份", "url": "https://www.freebuf.com/articles/system/219715.html", "time": "2019-12-04", "level": "", "num_look": 125840, "num_comment": 3, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "PowerGhost是从2018年被发现使用powershell无文件方式进行攻击感染的挖矿以及DDOS病毒。"}
{"title": "FreeBuf早报｜普京签署了强制性预装应用的法律；北约举行大规模网络军演；Android 漏洞 StrandHogg 正被利用", "url": "https://www.freebuf.com/news/221912.html", "time": "2019-12-04", "level": "", "num_look": 67673, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "定于12月2至6日举行的‘网络联盟’演习由29个北约国家中的27个成员、欧盟以及包括日本、阿尔及利亚、奥地利、芬兰、爱尔兰和瑞典在内的6个北约伙伴国参加。"}
{"title": "APP隐私保护之二：用户端隐私保护实践（上）", "url": "https://www.freebuf.com/articles/database/220083.html", "time": "2019-12-04", "level": "现金奖励", "num_look": 212023, "num_comment": 2, "author": "Alkaid13", "tags": ["数据安全"], "text": "本文重点介绍APP用户端的要求和设计方案。"}
{"title": "无孔不入： NextCry勒索病毒利用PHP最新漏洞攻击传播", "url": "https://www.freebuf.com/articles/system/220742.html", "time": "2019-12-03", "level": "", "num_look": 108859, "num_comment": 3, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "近日，奇安信病毒响应中心在日常样本监控过程中发现NextCry Ransomware的新进入渠道，其正在利用PHP-fpm远程代码执行漏洞（CVE-2019-11043）针对Linux服务器发起攻击尝试入侵。"}
{"title": "等保2.0正式实施，这些重点帮你划好了", "url": "https://www.freebuf.com/articles/es/221788.html", "time": "2019-12-03", "level": "现金奖励", "num_look": 858126, "num_comment": 14, "author": "宇宸de研究室", "tags": ["企业安全", "标准与合规"], "text": "12 月 1 日，等级保护 2.0 标准正式实施，大多数企业等级测评工作已经完成，所以重头戏应该在明年。那么，在这个空档期，来和大家聊聊等级保护 2.0 测评时有哪些需要关心的重点吧。"}
{"title": "挖洞经验 | 绕过GitHub的OAuth授权验证机制（$25000）", "url": "https://www.freebuf.com/vuls/219682.html", "time": "2019-12-03", "level": "", "num_look": 179645, "num_comment": 9, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "今年，我想看看自己是否是全职漏洞赏金猎人的料，所以就从6月份开始每天抽出几个小时的时间去测试GitHub的安全漏洞。"}
{"title": "Hack the box靶机实战：Haystack", "url": "https://www.freebuf.com/articles/web/219163.html", "time": "2019-12-03", "level": "", "num_look": 136966, "num_comment": 3, "author": "dongne", "tags": ["WEB安全"], "text": "HayStack 在 HTB 里面的难度评级是简单，但其实它一点都不简单。"}
{"title": "FreeBuf早报 | 工信部新规实施：12月1日起办卡需“人脸识别”；阿里巴巴投入24.4亿元拟与数据港合作建设数据中心；FBI警告：智能电视存隐私泄露风险，长期被忽视", "url": "https://www.freebuf.com/news/221692.html", "time": "2019-12-03", "level": "", "num_look": 79023, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "12月2日下午消息，上海数据港股份有限公司今日发布公告称，公司收到阿里巴巴采购部的《数据中心需求意向函》。阿里巴巴拟与公司在未来一定时间合作建设数据中心。"}
{"title": "一文解密所有WebLogic密文", "url": "https://www.freebuf.com/articles/web/220147.html", "time": "2019-12-03", "level": "现金奖励", "num_look": 374853, "num_comment": 3, "author": "Tide重剑无锋", "tags": ["WEB安全"], "text": "经过多次试用发现并不能“通杀”式的解决所有weblogic密文，于是在查阅大量资料后整理了7种解密weblogic的方法。"}
{"title": "互联网企业如何有效落地SDL", "url": "https://www.freebuf.com/articles/es/220410.html", "time": "2019-12-03", "level": "红色标题", "num_look": 501052, "num_comment": 13, "author": "hackeryeah", "tags": ["企业安全"], "text": "笔者在实施SDL方面有多年的经验，实施过微软厚重的SDL，实施过互联网企业粗糙的SDL，目前在落地标准化自动化的SDL，在此将我的经验分享出来。"}
{"title": "追溯朝鲜APT组织Lazarus的攻击历程", "url": "https://www.freebuf.com/articles/system/221008.html", "time": "2019-12-02", "level": "", "num_look": 135545, "num_comment": 2, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "最近，朝鲜声名狼藉的APT组织Lazarus又开始活跃起来，先是入侵印度核电站，导致其紧急关闭一座反应堆，然后又向韩国、意大利等国发送大量钓鱼邮件进行攻击。"}
{"title": "自己动手制作一个恶意流量检测系统（附源码）", "url": "https://www.freebuf.com/articles/system/220565.html", "time": "2019-12-02", "level": "现金奖励", "num_look": 729706, "num_comment": 20, "author": "huoji120", "tags": ["系统安全"], "text": "一个星期前突发奇想想做一个威胁流量检测系统.于是就有了今天这篇文章。"}
{"title": "双旦将至，快来参与银联USRC周年庆，领取你的双旦礼物！", "url": "https://www.freebuf.com/fevents/221680.html", "time": "2019-12-02", "level": "红色标题", "num_look": 51127, "num_comment": 2, "author": "漏洞盒子", "tags": ["活动"], "text": "12.1-12.31，银联安全应急响应中心周年庆啦，赶紧来USRC领取你的双旦礼物！"}
{"title": "无题大鹅模拟游戏（Untitled Goose Game）存在代码可执行漏洞", "url": "https://www.freebuf.com/vuls/218690.html", "time": "2019-12-02", "level": "", "num_look": 120264, "num_comment": 4, "author": "clouds", "tags": ["漏洞", "终端安全"], "text": "经作者发现，Untitled Goose Game由于在其游戏存档加载器（Save Game Loader）中存在不安全的反序列化机制从而可导致代码执行漏洞。"}
{"title": "黑五半价？2100万Mixcloud用户数据暗网售价2000美元", "url": "https://www.freebuf.com/news/221626.html", "time": "2019-12-02", "level": "", "num_look": 85286, "num_comment": 1, "author": "Allen别bb", "tags": ["资讯"], "text": "本月初，一名黑客入侵了英国在线音乐流媒体服务Mixclouud，窃取了超过2100万个用户账户。这些数据目前在暗网上出售，从最开始的4000美金降价到2000美金。"}
{"title": "挖矿处置手册：安全研究员的套路都在这儿了", "url": "https://www.freebuf.com/articles/system/220132.html", "time": "2019-12-02", "level": "", "num_look": 183347, "num_comment": 5, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "攻击者通过各种手段将挖矿程序植入受害者的计算机中，在受害者不知情的情况下利用其计算机的云算力进行挖矿，从而获取利益。"}
{"title": "被动扫描器之插件篇", "url": "https://www.freebuf.com/articles/web/219818.html", "time": "2019-12-02", "level": "现金奖励", "num_look": 166760, "num_comment": 7, "author": "dongne", "tags": ["WEB安全"], "text": "最近被动扫描器的话题如火如荼，好多公司都在做自己的被动扫描器。而获取质量高的流量是被动扫描器起作用的关键。"}
{"title": "FreeBuf早报｜暗网上出售了2100万Mixcloud用户的数据；欧盟正在调查 Google 的数据收集；Sodinokibi勒索病毒最新变种", "url": "https://www.freebuf.com/news/221610.html", "time": "2019-12-02", "level": "", "num_look": 83465, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "欧盟反垄断监管机构正在调查 Google 的数据收集，显示在创纪录罚款之后搜索巨人仍然是欧盟的关注对象。美国和欧盟的反垄断监管机构都在调查 Google 如何收集和货币化数据。"}
{"title": "Buran勒索开始利用IQY文件传播", "url": "https://www.freebuf.com/articles/system/220594.html", "time": "2019-12-01", "level": "", "num_look": 88403, "num_comment": 2, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "日前勒索病毒猖獗，勒索病毒种类层出不穷，奇安信病毒响应中心在持续监测勒索病毒中发现了Buran勒索利用.IQY文件下发PayLoad的新变种。IQY文件允许从一个.ASP网页检索并导入到Microsoft Excel中。"}
{"title": "如何防止恶意的第三方DLL注入到进程", "url": "https://www.freebuf.com/articles/system/219198.html", "time": "2019-12-01", "level": "", "num_look": 117572, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "虽然Windows系统的安全机制是不允许任何微软签名的代码注入到进程之中的，但是网络犯罪分子仍然会有很多方法来绕过这种安全机制，比如说通过执行用户态钩子向正在运行的进程注入DLL等等。"}
{"title": "HFish蜜罐使用心得", "url": "https://www.freebuf.com/vuls/220646.html", "time": "2019-12-01", "level": "现金奖励", "num_look": 238165, "num_comment": 5, "author": "cyker", "tags": ["企业安全", "漏洞"], "text": "最近搭建各种蜜罐测试，这篇文章主要分享 HFish V0.4 使用过程中的一些心得。"}
{"title": "一键伪装成Win 10，Kali Linux 2019年最终版重磅功能预览", "url": "https://www.freebuf.com/news/221582.html", "time": "2019-11-30", "level": "红色标题", "num_look": 343775, "num_comment": 14, "author": "shidongqi", "tags": ["资讯"], "text": "11月26日，Kali Linux官网宣布了2019年第四个也是最后一个版本。相比之前有较大的变动，引起了很多安全爱好者的关注，例如全新的桌面环境Xfce、Kali Undercover模式、NetHunter Kex 。"}
{"title": "DFIRTriage：针对Windows的事件应急响应数字取证工具", "url": "https://www.freebuf.com/articles/system/220240.html", "time": "2019-11-30", "level": "", "num_look": 99693, "num_comment": 99693, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "DFIRTriage这款工具旨在为安全事件应急响应人员快速提供目标主机的相关数据。"}
{"title": "CVE-2019-16759：vBulletin预认证远程代码执行漏洞分析", "url": "https://www.freebuf.com/vuls/218880.html", "time": "2019-11-30", "level": "", "num_look": 141409, "num_comment": 141409, "author": "Alpha_h4ck", "tags": ["漏洞", "网络安全"], "text": "在这篇文章中，我们会对这个漏洞的成因进行分析，并给出PoC演示代码以及其他关于该漏洞的详细信息。"}
{"title": "披露报告：流氓家族窃取用户浏览隐私活动", "url": "https://www.freebuf.com/articles/system/220670.html", "time": "2019-11-30", "level": "", "num_look": 103335, "num_comment": 1, "author": "安全豹", "tags": ["系统安全"], "text": "近期毒霸安全团队通过“捕风”威胁感知系统监控到一起大规模窃取用户浏览器隐私的流氓病毒活动。"}
{"title": "BUF大事件丨CIS 2019网络安全创新大会在上海举办；某儿童手表泄露5000多儿童信息；电信巨头T-Mobile遭网络攻击", "url": "https://www.freebuf.com/news/221462.html", "time": "2019-11-30", "level": "红色标题", "num_look": 98140, "num_comment": 98140, "author": "Darry端", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，CIS 2019网络安全创新大会在上海举办；某儿童手表泄露5000多儿童信息 还能假扮父母打电话；电信巨头T-Mobile遭网络攻击 客户信息被泄露。"}
{"title": "代码审计之php.ini配置详解", "url": "https://www.freebuf.com/articles/web/220084.html", "time": "2019-11-30", "level": "", "num_look": 117122, "num_comment": 2, "author": "qianxing", "tags": ["WEB安全"], "text": "apache在启动时php.ini被读取。对于服务器模块版本的php，仅在web服务器启动时读取一次。对于CGI和CLI版本，每次调用都会被读取"}
{"title": "WitAwards 2019获奖项目点评", "url": "https://www.freebuf.com/fevents/221491.html", "time": "2019-11-29", "level": "红色标题", "num_look": 87889, "num_comment": 87889, "author": "kirazhou", "tags": ["活动"], "text": "历时近3个月，86天，累计百余个项目申报及提名，经由大众投票、甲方投票、专家投票及现场投票的公平、完善的评审，WitAwards 2019五项年度大奖全部揭晓！"}
{"title": "安全的“剑与盾”｜CIS 2019攻防演练研讨专场回顾", "url": "https://www.freebuf.com/fevents/221455.html", "time": "2019-11-29", "level": "红色标题", "num_look": 136887, "num_comment": 2, "author": "Akane", "tags": ["活动"], "text": "11月28日，CIS 2019网络安全创新大会攻防演练论坛邀请到360集团攻防产品事业部总经理张锦章和信息产业信息安全测评中心副主任刘健共同担任出品人，与大家深入探讨最新的攻防技术、最佳的实战案例。"}
{"title": "AI安全的探索与实践，CIS 2019人工智能安全前沿论坛精彩盘点", "url": "https://www.freebuf.com/fevents/221454.html", "time": "2019-11-29", "level": "红色标题", "num_look": 74055, "num_comment": 74055, "author": "Sandra1432", "tags": ["活动"], "text": "人工智能与安全，融合是大势所趋，对抗永恒存在。网络安全方兴未艾，当碰到人工智能，注定要擦除不一样的火花。"}
{"title": "Sgx-Step：一款针对Intel SGX平台的渗透测试攻击框架", "url": "https://www.freebuf.com/articles/system/220234.html", "time": "2019-11-29", "level": "", "num_look": 88329, "num_comment": 88329, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "本文所介绍的SGX-Step是一款针对Intel SGX平台的开源测信道攻击研究框架。"}
{"title": "即将正式实施！CIS 2019等保2.0研讨专场精华分享", "url": "https://www.freebuf.com/fevents/221526.html", "time": "2019-11-29", "level": "红色标题", "num_look": 79974, "num_comment": 79974, "author": "shidongqi", "tags": ["活动"], "text": "离12月1日等保2.0的正式实施只有最后几天了，对比此前的版本，等保2.0在保护范围、法律效率、技术标准、安全体系、定制流程以及定制指导方面均发生了很大的变化，这也因此引发了大多数企业的重点关注。"}
{"title": "代码审计入门之Jeeplus代码审计", "url": "https://www.freebuf.com/articles/web/220066.html", "time": "2019-11-29", "level": "现金奖励", "num_look": 156483, "num_comment": 8, "author": "freedom", "tags": ["WEB安全"], "text": "JeePlus是一款基于代码生成器的javaEE快速开发平台，可以帮助解决java项目中绝大部分的的重复工作，让开发者更多关注业务逻辑。"}
{"title": "CVE-2019-17671：如何查看WordPress未授权文章", "url": "https://www.freebuf.com/vuls/218876.html", "time": "2019-11-29", "level": "", "num_look": 116408, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["漏洞", "网络安全"], "text": "近期，WordPress发布了最新的v5.2.4版本，并修复了很多安全漏洞。在这篇文章中，我们将对其中的一个漏洞CVE-2019-17671进行分析。"}
{"title": "针对虚拟货币交易平台的定向攻击：以客服色诱为诱饵", "url": "https://www.freebuf.com/articles/system/220176.html", "time": "2019-11-29", "level": "", "num_look": 99732, "num_comment": 2, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "这是一起针对区块链虚拟货币交易平台的定向攻击，鉴于诱饵极具诱惑性，攻击手法已经升级，因此我们对此进行了分析，并披露了此次攻击。"}
{"title": "FreeBuf早报 | 某儿童手表泄露5000多儿童信息，还能假扮父母打电话；全球加密货币犯罪大幅上升，前9个月造成44亿美元损失；Ryuk勒索软件迫使西班牙安全公司关闭网络", "url": "https://www.freebuf.com/news/221407.html", "time": "2019-11-29", "level": "", "num_look": 73777, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "近日，测试机构AV-TEST的物联网测试部门发布报告称，他们发现一款国产智能儿童手表存在严重安全隐患，其中有5000多名儿童及其父母的个人详细信息和位置信息被曝光。"}
{"title": "攻防演练对抗赛之初识文件钓鱼", "url": "https://www.freebuf.com/articles/network/219999.html", "time": "2019-11-29", "level": "现金奖励", "num_look": 242479, "num_comment": 3, "author": "诺言", "tags": ["网络安全"], "text": "今年参加了几次攻防演练对抗赛，其它队伍依靠社工结合文件钓鱼得了不少分，自己之前并没有相关知识的积累，因此在这个方面吃了一些亏。"}
{"title": "一文解析企业实网攻防新思路", "url": "https://www.freebuf.com/fevents/221569.html", "time": "2019-11-29", "level": "", "num_look": 37077, "num_comment": 37077, "author": "360安全", "tags": ["活动"], "text": "自2016年美国大选“黑天鹅”事件出现以来，各国高度重视网络安全防护工作。迄今为止，美国已举行6次“网络风暴”大规模网络安全演习。"}
{"title": "CIS 2019金融科技安全专场爆场落幕：全议程精彩再现！", "url": "https://www.freebuf.com/fevents/221383.html", "time": "2019-11-28", "level": "红色标题", "num_look": 54546, "num_comment": 1, "author": "kirazhou", "tags": ["活动"], "text": "近几年，不谈点金融科技安全似乎都有些“落伍”了。如果说钱在哪里，攻击就在哪里，那么最有钱的不外乎金融了。"}
{"title": "智能车联安全同行，CIS 2019车联网安全技术论坛集锦", "url": "https://www.freebuf.com/fevents/221339.html", "time": "2019-11-28", "level": "红色标题", "num_look": 63721, "num_comment": 1, "author": "Sandra1432", "tags": ["活动"], "text": "智能网联汽车是汽车与信息、通信等产业跨界融合的典型应用，被认为是全球创新热点和未来产业发展制高点。"}
{"title": "《数据爬取治理》报告首发！智慧城市数据安全治理专场精华汇总", "url": "https://www.freebuf.com/fevents/221375.html", "time": "2019-11-28", "level": "红色标题", "num_look": 64185, "num_comment": 1, "author": "shidongqi", "tags": ["活动"], "text": "《数据爬取治理》研究报告总共包括数据爬取概述、数据爬取的现实法律风险、数据爬取的治理困境及难点，数据爬取的治理原则和建议，数据爬取相关争端案例六个部分。"}
{"title": "年度技术盛宴，CIS 2019 X-Tech技术派对议题回顾", "url": "https://www.freebuf.com/fevents/221327.html", "time": "2019-11-28", "level": "红色标题", "num_look": 48213, "num_comment": 1, "author": "Akane", "tags": ["活动"], "text": "这是一场真正的属于安全人的年度盛会，了不起的研究者们和“黑科技”成果交相辉映、第一代黑客前辈与新生代白帽子同台畅谈。"}
{"title": "Windows系统安全事件日志取证工具：LogonTracer", "url": "https://www.freebuf.com/sectool/219786.html", "time": "2019-11-28", "level": "", "num_look": 264897, "num_comment": 7, "author": "yongsec", "tags": ["工具"], "text": "LogonTracer这款工具是基于Python编写的，并使用Neo4j作为其数据库，是一款用于分析Windows安全事件登录日志的可视化工具。"}
{"title": "使用Peach进行模糊测试从入门到放弃", "url": "https://www.freebuf.com/articles/ics-articles/219996.html", "time": "2019-11-28", "level": "现金奖励", "num_look": 620862, "num_comment": 4, "author": "Tide重剑无锋", "tags": ["工控安全"], "text": "本文对模糊测试技术进行了综述分析，介绍了开源模糊测试框架Peach的结构、原理及pit文件编写方法，旨在帮助对模糊测试感兴趣的小伙伴能快速入门peach。"}
{"title": "挖洞经验 | 看我如何用一美分购买VPS服务和网站空间", "url": "https://www.freebuf.com/vuls/220623.html", "time": "2019-11-28", "level": "", "num_look": 157843, "num_comment": 7, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "今天分享的Writeup是作者发现VPS和建站托管服务商的支付漏洞，通过一美分（$0.01）交易实现购买VPS和网站空间服务。"}
{"title": "吉林祥云招聘安全人才", "url": "https://www.freebuf.com/jobs/221160.html", "time": "2019-11-28", "level": "", "num_look": 91851, "num_comment": 11, "author": "KivuSec", "tags": ["安全招聘"], "text": "吉林省吉林祥云信息技术有限公司成立于2018年，是响应吉林省人民政府号召发起成立的，由吉林省政务服务和数字化建设管理局进行管理的国有控股的大数据公司。"}
{"title": "钓鱼邮件分发Emotet银行木马", "url": "https://www.freebuf.com/articles/network/220305.html", "time": "2019-11-28", "level": "", "num_look": 123712, "num_comment": 1, "author": "东巽科技2046Lab", "tags": ["网络安全"], "text": "安全运维人员日前在进行系统安全检查时，在沙箱中捕获到一个高危恶意样本。"}
{"title": "FreeBuf早报｜Upbit加密货币交易所遭黑客入侵，价值4850万美元的ETH被盗；超过12,000名Google用户受到政府黑客攻击；Magecart组织在其攻击中混用网络钓鱼和MiTM", "url": "https://www.freebuf.com/news/221308.html", "time": "2019-11-28", "level": "", "num_look": 56559, "num_comment": 56559, "author": "kirazhou", "tags": ["资讯"], "text": "韩国加密货币交易所Upbit披露了一项安全漏洞，并声称黑客已从其热钱包中窃取了4850万美元的加密货币。"}
{"title": "用于绕过安全电子邮件网关的特制ZIP文件", "url": "https://www.freebuf.com/articles/network/219559.html", "time": "2019-11-28", "level": "", "num_look": 125555, "num_comment": 2, "author": "Alluka", "tags": ["网络安全"], "text": "一个新的网络钓鱼活动利用了特制的ZIP文件，该文件旨在绕过安全的电子邮件网关来分发NanoCore RAT。"}
{"title": "loT安全威胁与应对之道，CIS 2019物联网&工业互联网安全专场回顾", "url": "https://www.freebuf.com/fevents/221263.html", "time": "2019-11-27", "level": "红色标题", "num_look": 65866, "num_comment": 1, "author": "kirazhou", "tags": ["活动"], "text": "万物互联不是未来的事情，而是正在发生的事。"}
{"title": "明日精彩继续｜CIS 2019主论坛首日全程回顾", "url": "https://www.freebuf.com/fevents/221287.html", "time": "2019-11-27", "level": "红色标题", "num_look": 92848, "num_comment": 2, "author": "shidongqi", "tags": ["活动"], "text": "这几天魔都的天气骤降十几度，一秒入冬，但这似乎丝毫没有影响到从全国各地远道而来的信息安全爱好者的热情，如果你在CIS 2019的现场，必定也会被这样浓烈的氛围感染。"}
{"title": "Threat_Note：一款功能强大的IoC数据检索与记录工具", "url": "https://www.freebuf.com/articles/terminal/219842.html", "time": "2019-11-27", "level": "", "num_look": 81258, "num_comment": 81258, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "Threat_Note是一款一个轻量级的调查笔记，它允许安全研究人员注册和检索他们所需要的 入侵威胁指标IoC数据。"}
{"title": "基于无线路由器僵尸网络攻击游戏服务器", "url": "https://www.freebuf.com/articles/network/219171.html", "time": "2019-11-27", "level": "", "num_look": 141104, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "在2019年9月，研究人员在对IoT威胁搜寻过程中发现了的Gafgyt变种。 特别是针对Zyxel，Huawei和Realtek等知名商业品牌的小型办公室/家庭无线路由器。"}
{"title": "年终盛会 | CIS 2019网络安全创新大会在上海盛大开幕", "url": "https://www.freebuf.com/fevents/221216.html", "time": "2019-11-27", "level": "红色标题", "num_look": 72090, "num_comment": 2, "author": "FB客服", "tags": ["活动"], "text": "2019年11月27日，由国内领先的网络安全新媒体FreeBuf、赛博研究院、上海市信息安全行业协会联合主办的CIS 2019网络安全创新大会在上海宝华万豪酒店盛大开幕。"}
{"title": "好未来教育集团招聘安全人才", "url": "https://www.freebuf.com/jobs/221142.html", "time": "2019-11-27", "level": "", "num_look": 83587, "num_comment": 1, "author": "100tal", "tags": ["安全招聘"], "text": "好未来（NYSE：TAL），是一家中国领先的K12教育科技企业，以科技驱动、人才亲密、品质领先为发展的核心目标。"}
{"title": "盘点近几年勒索病毒使用过的工具和漏洞", "url": "https://www.freebuf.com/articles/system/219837.html", "time": "2019-11-27", "level": "", "num_look": 175046, "num_comment": 2, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "加密数字货币和Tor网络对勒索病毒的基础性支撑不再赘述，今天，我们回归技术，从另外一个角度，看勒索病毒为何会如此猖獗。"}
{"title": "论企业如何快速建立SDL流程", "url": "https://www.freebuf.com/articles/es/219918.html", "time": "2019-11-27", "level": "现金奖励", "num_look": 214731, "num_comment": 6, "author": "黑客小平哥", "tags": ["企业安全"], "text": "今天这篇文章就旨在讨论一下企业SDL如何快速落地问题，题主落地SDL时间并不是很长，一两年时间而已，但是一样是从零开始，过程艰难，不论成功与否，一样有所得，写出来大家讨论一下。"}
{"title": "Kali Linux下配置PM3运行环境", "url": "https://www.freebuf.com/sectool/219971.html", "time": "2019-11-27", "level": "", "num_look": 140147, "num_comment": 2, "author": "YaphetSzz", "tags": ["工具"], "text": "在今年的早些时候入手了Proxmark3rdv4，看了下相关的资料发现还是有点少，尤其是关于环境配置方面。"}
{"title": "FreeBuf早报｜欧洲RIPE NCC宣布已散尽全球最后一批IPv4地址；Facebook、Twitter数百用户因登录第三方应用个人信息泄露；2019年有超过3800万的医疗保健记录泄露", "url": "https://www.freebuf.com/news/221206.html", "time": "2019-11-27", "level": "", "num_look": 70564, "num_comment": 70564, "author": "shidongqi", "tags": ["资讯"], "text": "Facebook和Twitter近日表示，数百名用户的个人数据可能在他们使用自己的账号登录从谷歌Play商店下载的某些Android应用时泄露。"}
{"title": "子域名枚举的艺术深度剖析", "url": "https://www.freebuf.com/articles/web/220344.html", "time": "2019-11-27", "level": "现金奖励", "num_look": 163978, "num_comment": 5, "author": "markzh", "tags": ["WEB安全"], "text": "子域名枚举是信息收集中关键的一步，细节很大程度决定战果。本文参考The Art of Subdomain Enumeration，加上实践运用进行总结。"}
{"title": "Pigat：一款被动信息收集聚合工具", "url": "https://www.freebuf.com/sectool/219681.html", "time": "2019-11-26", "level": "", "num_look": 161934, "num_comment": 6, "author": "TeamsSix", "tags": ["工具"], "text": "Pigat即Passive Intelligence Gathering Aggregation Tool，翻译过来就是被动信息收集聚合工具，既然叫聚合工具，也就是说该工具将多款被动信息收集工具结合在了一起，进而提高了平时信息收集的效率。"}
{"title": "精心构造的PS1文件名导致Powershell命令执行", "url": "https://www.freebuf.com/vuls/220227.html", "time": "2019-11-26", "level": "现金奖励", "num_look": 144628, "num_comment": 8, "author": "freexploit", "tags": ["漏洞", "系统安全"], "text": "Windows PowerShell是专门为系统管理员设计的Windows命令行外壳程序。PowerShell包括可独立使用或组合使用的交互式提示和脚本环境。"}
{"title": "终于等到你，明天早上不见不散！| CIS 2019参会指南", "url": "https://www.freebuf.com/fevents/221052.html", "time": "2019-11-26", "level": "红色标题", "num_look": 126990, "num_comment": 3, "author": "FB独家", "tags": ["活动"], "text": "一年一度的CIS 2019网络安全创新大会明天就要开始啦~明日不见不散噢~"}
{"title": "反间谍之旅：反虚拟机检测", "url": "https://www.freebuf.com/articles/terminal/219885.html", "time": "2019-11-26", "level": "", "num_look": 120895, "num_comment": 3, "author": "暗影安全实验室", "tags": ["终端安全"], "text": "最近在日常检测中发现了一款伪装插件FlashPlayer的间谍软件，该款软件不仅通过检测模拟器以防止沙箱对其进行分析，还通过检测安装在移动设备上的杀毒软件。"}
{"title": "FreeBuf早报 | 支付宝晒隐私保护成绩单： 设首席隐私官，区块链技术保障数据安全；在4种流行的开源VNC软件中发现数十种严重漏洞；专项治理行动见成效，App这些越线行为现在管得更严了", "url": "https://www.freebuf.com/news/221112.html", "time": "2019-11-26", "level": "", "num_look": 69099, "num_comment": 69099, "author": "Sandra1432", "tags": ["资讯"], "text": "11月23日，在杭州召开的2019互联网法律大会上，蚂蚁金服发布了《隐私保护和数据安全白皮书》。"}
{"title": "简单又可怕！基于JavaScript（JS）的DDOS攻击！", "url": "https://www.freebuf.com/articles/web/219792.html", "time": "2019-11-26", "level": "", "num_look": 176992, "num_comment": 3, "author": "w2sfoot", "tags": ["WEB安全"], "text": "最近几年DDoS攻击技术不断推陈出新：攻击者用一种新型且很有趣的方式欺骗用户参与到攻击活动中：使用恶意的JavaScript欺骗用户参与DDoS攻击。"}
{"title": "人工智能的网络安全攻防战 | CIS 2019议题前瞻", "url": "https://www.freebuf.com/fevents/220766.html", "time": "2019-11-25", "level": "红色标题", "num_look": 55452, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "11月28日，在CIS 2019网络安全创新大会上，百度安全高级架构师兜哥、蚂蚁金服安全专家杜培将带来AI攻防相关的议题分享。"}
{"title": "GCPBucketBrute：一款Google Storage Bucket安全枚举脚本", "url": "https://www.freebuf.com/articles/network/219712.html", "time": "2019-11-25", "level": "", "num_look": 117651, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "GCPBucketBrute是一款能够枚举Google Storage Bucket的强大脚本，该脚本能够帮助你识别目标Bucket的访问权限，并判断是否能够在目标上实现提权。"}
{"title": "个人隐私保护之一：隐私政策解析", "url": "https://www.freebuf.com/articles/database/219564.html", "time": "2019-11-25", "level": "现金奖励", "num_look": 549717, "num_comment": 10, "author": "Alkaid13", "tags": ["数据安全"], "text": "2019年初，中央网信办、工信部、公安部及市场监管总局四部门联合发布了《关于开展App违法违规收集使用个人信息专项治理的公告》，预示着我国在APP隐私层面的治理进入了一个新的高度。"}
{"title": "企业组织易受勒索软件攻击的10大原因", "url": "https://www.freebuf.com/articles/network/217677.html", "time": "2019-11-25", "level": "", "num_look": 123239, "num_comment": 3, "author": "Kriston", "tags": ["网络安全"], "text": "勒索软件攻击并没有假期，攻击者无时无刻不在尝试突破目标防护。勒索软件的威胁不断增加，在2019年第一季度，研究人员注意到勒索软件种类增加了118%。"}
{"title": "零氪张坤：大数据医疗，网络安全亦是关键配方", "url": "https://www.freebuf.com/articles/people/216499.html", "time": "2019-11-25", "level": "红色标题", "num_look": 241777, "num_comment": 1, "author": "shidongqi", "tags": ["人物志"], "text": "曾经，衡量安全工作的价值是漏洞修复率、攻击识别和抵抗率，安全事件数量、监管通报、甚至黑市相关信息价格的浮动。除了这些，他觉得还有重要的行业值得奉献自己的价值。"}
{"title": "华泰证券信息安全中心诚招网络安全人才", "url": "https://www.freebuf.com/jobs/198501.html", "time": "2019-11-25", "level": "", "num_look": 208918, "num_comment": 10, "author": "FB客服", "tags": ["安全招聘"], "text": "华泰证券股份有限公司是一家中国领先的综合性证券集团，具有庞大的客户基础、领先的互联网平台和敏捷协同的全业务链体系。"}
{"title": "紫狐木马升级新版本，警惕MSSQL被爆破", "url": "https://www.freebuf.com/articles/system/218817.html", "time": "2019-11-25", "level": "", "num_look": 123250, "num_comment": 2, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "“紫狐”木马最早出现于2018年3月，通过与游戏外挂、第三方安装程序捆绑传播，该木马如同其名字一样具有狐狸般的狡猾，应用了极强的反检测能力。"}
{"title": "记一次开源工具某模块的基础二次开发", "url": "https://www.freebuf.com/sectool/219920.html", "time": "2019-11-25", "level": "现金奖励", "num_look": 580813, "num_comment": 2, "author": "煜阳yuyang", "tags": ["企业安全", "工具"], "text": "很多人对于写工具类文章都是蜻蜓点水，写搭建，写基础使用，但是基础的开源工具在生产环境上的使用其实是比较困难的。"}
{"title": "针对File Thingie从XSS到文件上传再到RCE的渗透测试报告", "url": "https://www.freebuf.com/vuls/219462.html", "time": "2019-11-25", "level": "现金奖励", "num_look": 139748, "num_comment": 5, "author": "Neroqi", "tags": ["WEB安全", "漏洞"], "text": "File Thingie是一个由PHP编写的基于Web的文件管理工具，它的好处在于体型小、功能全、易于操作。"}
{"title": "强化安全意识，牢筑安全防线 | 对话WIT 2019评委主席王强", "url": "https://www.freebuf.com/articles/people/220556.html", "time": "2019-11-25", "level": "红色标题", "num_look": 170802, "num_comment": 1, "author": "Sandra1432", "tags": ["人物志", "活动"], "text": "本期专访邀请到上海市信息安全行业协会秘书长，王强，谈谈在未来网络安全中人们的安全意识培养和安全知识教育的重要性。"}
{"title": "FreeBuf早报 | 谷歌云服务器上发现未受保护数据库 12亿人信息泄露；一加公布个人信息安全漏洞并向受影响客户致歉；电商巨头T-Mobile遭网络攻击，客户信息被泄露", "url": "https://www.freebuf.com/news/221003.html", "time": "2019-11-25", "level": "", "num_look": 66949, "num_comment": 66949, "author": "Sandra1432", "tags": ["资讯"], "text": "上周六，一加安全团队通过 OnePlus 社区论坛公布了自家智能机上的一个“个人信息安全漏洞”。"}
{"title": "HomePwn：一款专用于物联网设备渗透测试的“瑞士军刀”", "url": "https://www.freebuf.com/articles/terminal/218726.html", "time": "2019-11-24", "level": "", "num_look": 140319, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "HomePwn是一款功能强大的物联网渗透测试框架，它可谓是该领域的一把“瑞士军刀”。"}
{"title": "ATM恶意软件家族Dtrack", "url": "https://www.freebuf.com/articles/network/215831.html", "time": "2019-11-24", "level": "", "num_look": 112860, "num_comment": 112860, "author": "Kriston", "tags": ["网络安全"], "text": "2018年夏末，发现了一款针对印度银行的atm恶意软件，进一步的分析表明，该恶意软件被设计用于植入目标的自动柜员机，可以读取和存储插入机器的卡中数据。"}
{"title": "比特币价格回暖，Satan勒索再次变种袭击我国", "url": "https://www.freebuf.com/news/219615.html", "time": "2019-11-24", "level": "", "num_look": 88276, "num_comment": 3, "author": "深信服千里目安全实验室", "tags": ["资讯"], "text": "勒索圈有个任性的病毒家族Satan，无论比特币价格如何波动，解密要价都是1 BTC。此次，趁着比特币价格回暖，Satan勒索病毒推出了最新的变种，通过勒索提示信息，可以发现该变种实现了更完整的国产化。"}
{"title": "Peach原理简介与实战：以Fuzz Web API为例", "url": "https://www.freebuf.com/sectool/219584.html", "time": "2019-11-24", "level": "现金奖励", "num_look": 157795, "num_comment": 6, "author": "榕树下的少年", "tags": ["工具"], "text": "Fuzz即模糊测试，是一种使用大量的随机数据测试系统安全的方法，Peach就是一种这样的工具。"}
{"title": "白帽LIVE：代码能力的真实价值 VS 难以打破的安全系统 | CIS 2019议题前瞻", "url": "https://www.freebuf.com/fevents/220756.html", "time": "2019-11-23", "level": "红色标题", "num_look": 52006, "num_comment": 3, "author": "FB独家", "tags": ["活动"], "text": "11月28日，在CIS 2019网络安全创新大会上，御风维安科技CEO王骕，36W白帽大佬CplusHua将带来精彩的白帽LIVE，不见不散！"}
{"title": "Sniffle: 蓝牙5和4.x LE嗅探器", "url": "https://www.freebuf.com/sectool/219041.html", "time": "2019-11-23", "level": "", "num_look": 133194, "num_comment": 133194, "author": "secist", "tags": ["工具"], "text": "Sniffle是一个基于使用TI CC1352/CC26x2硬件的蓝牙5和4.x LE嗅探器。"}
{"title": "iOS端的堆溢出以及内核溢出漏洞分析", "url": "https://www.freebuf.com/vuls/217181.html", "time": "2019-11-23", "level": "", "num_look": 107369, "num_comment": 107369, "author": "Alpha_h4ck", "tags": ["漏洞", "终端安全"], "text": "据了解，Google的威胁分析团队（TAG）在2019年2月份发现了有攻击者正在使用这些iOS漏洞利用链来实施攻击，本人此前也对其中的第一条漏洞利用链进行过分析。"}
{"title": "Unit42发布powershell自动反混淆工具", "url": "https://www.freebuf.com/sectool/219057.html", "time": "2019-11-23", "level": "", "num_look": 129954, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["工具"], "text": "近日，Unit42安全团队在Github上公开了自己研发的powershell自动反混淆工具，Star数几日之间就突破了300，接下来，就来了解下这款神器的用法及原理。"}
{"title": "BUF大事件丨安卓被曝严重漏洞：恶意应用能秘密录制视频、监听通话；7家科技公司盗取身份信息， 4.68亿个人信息泄露", "url": "https://www.freebuf.com/news/220912.html", "time": "2019-11-23", "level": "红色标题", "num_look": 112373, "num_comment": 112373, "author": "Darry端", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，安卓被曝严重漏洞：恶意应用能秘密录制视频、监听通话；关于《网络安全威胁信息发布管理办法（征求意见稿）》公开征求意见的通知。"}
{"title": "2020年三大网络安全预测：企业将通过并购活动收集数据并将其武器化", "url": "https://www.freebuf.com/articles/others-articles/219767.html", "time": "2019-11-23", "level": "", "num_look": 60212, "num_comment": 1, "author": "kirazhou", "tags": ["其他"], "text": "2020年及以后，安全和风险专业人士将发现，网络安全决策会具备前所未有的社会影响力。"}
{"title": "新形势下的企业安全体系建设实践 | CIS 2019议题前瞻", "url": "https://www.freebuf.com/fevents/220765.html", "time": "2019-11-22", "level": "红色标题", "num_look": 57731, "num_comment": 57731, "author": "FB独家", "tags": ["活动"], "text": "11月27日，腾讯安全平台部总监胡珀将在CIS 2019网络安全创新大会前沿创新技术对话中带来《新形势下的企业安全体系建设实践》的议题分享。"}
{"title": "【FreeBuf字幕组】CTF难题挑战：逆向工程和识别错误（一）", "url": "https://www.freebuf.com/video/218174.html", "time": "2019-11-22", "level": "红色标题", "num_look": 97354, "num_comment": 1, "author": "Darry端", "tags": ["视频"], "text": "CTF难题挑战主要聚焦于各种CTF比赛中的难题讲解。本期视频讲师围绕Boston Key Party CTF 2016 cookbook一题展开讲解。主要内容为逆向工程和识别错误。"}
{"title": "网络钓鱼工具Modlishka的细节分析", "url": "https://www.freebuf.com/articles/network/217091.html", "time": "2019-11-22", "level": "", "num_look": 142529, "num_comment": 142529, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "钓鱼网站的目标之一就是通过使用电子邮件、短信、社交媒体和即时通信App来诱导目标用户提供他们的个人敏感数据，例如个人身份信息、***数据和密码等等。"}
{"title": "智慧城市数据安全治理 ，合规与落地并行 | CIS 2019议题前瞻", "url": "https://www.freebuf.com/fevents/220551.html", "time": "2019-11-22", "level": "红色标题", "num_look": 54708, "num_comment": 2, "author": "FB独家", "tags": ["活动"], "text": "海量的数据背后，隐藏着的不仅仅是越来越高的价值还有无数的安全威胁。11月28日，在CIS 2019网络安全创新大会上聆听数据安全治理之道。"}
{"title": "挖洞经验 | 发现任意Facebook非公开私密群组成员信息", "url": "https://www.freebuf.com/vuls/218694.html", "time": "2019-11-22", "level": "", "num_look": 147729, "num_comment": 6, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "经作者测试发现，针对任意私密群组，非私密群组成员一样可以查看其中的群组成员信息。"}
{"title": "从永恒之蓝看后渗透", "url": "https://www.freebuf.com/articles/system/219200.html", "time": "2019-11-22", "level": "现金奖励", "num_look": 215395, "num_comment": 13, "author": "rabbitmask", "tags": ["系统安全"], "text": "从永恒之蓝开始，讲述如何在内网中如何悄无声息的完成一次内网渗透。"}
{"title": "美陆军审查抖音海外版TikTok 担忧用户数据安全", "url": "https://www.freebuf.com/news/220889.html", "time": "2019-11-22", "level": "红色标题", "num_look": 76768, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "美国陆军部长McCarthy周四表示，继民主党议员提出抖音海外版对用户数据的处理会影响国家安全的问题后，美国陆军正在对中国社交媒体抖音的海外版TikTok进行安全评估。"}
{"title": "等保2.0研讨专场：等保2.0测评要点分析 | CIS 2019议题前瞻", "url": "https://www.freebuf.com/fevents/220796.html", "time": "2019-11-22", "level": "红色标题", "num_look": 16395, "num_comment": 16395, "author": "kirazhou", "tags": ["活动"], "text": "11月28日，在CIS 2019网络安全创新大会上，杭州默安科技高级安全研究员宇宸将带来主题分享《等保2.0测评要点分析》。"}
{"title": "WebLogic EJBTaglibDescriptor XXE漏洞(CVE-2019-2888)分析", "url": "https://www.freebuf.com/vuls/218565.html", "time": "2019-11-22", "level": "", "num_look": 123222, "num_comment": 2, "author": "Knownsec知道创宇", "tags": ["漏洞"], "text": "我和@Badcode师傅反编译了WebLogic所有的Jar包，根据之前几个XXE漏洞的特征进行了搜索匹配到了这个EJBTaglibDescriptor类。"}
{"title": "FreeBuf早报｜伊朗断网已超过一百小时；微软否认：Microsoft Teams被用于勒索软件攻击；Google Play上的热门应用存在已知漏洞", "url": "https://www.freebuf.com/news/220845.html", "time": "2019-11-22", "level": "", "num_look": 87786, "num_comment": 2, "author": "kirazhou", "tags": ["资讯"], "text": "自 11 月 17 日以来，伊朗的网络流量已经降至了正常水平的 5%。伊朗的有线和移动网络基本被切断。"}
{"title": "浅谈威胁狩猎（Threat Hunting）", "url": "https://www.freebuf.com/articles/neopoints/219164.html", "time": "2019-11-22", "level": "", "num_look": 114459, "num_comment": 4, "author": "Sampson", "tags": ["观点"], "text": "威胁狩猎，顾名思义，就是在网络安全的世界中寻找威胁，威胁每天都在变化。因此，开发新技术来防御和检测各种类型的威胁和攻击是我们的责任。"}
{"title": "车联网信息安全攻防实践 | CIS 2019议题前瞻", "url": "https://www.freebuf.com/fevents/220624.html", "time": "2019-11-21", "level": "红色标题", "num_look": 48314, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "11月28日，腾讯科恩实验室车联网安全技术专家张康将在CIS 2019网络安全创新大会车联网安全技术论坛带来《车联网信息安全攻防实践》的议题分享。"}
{"title": "新型银行木马Mispadu利用虚假麦当劳广告窃取用户信息", "url": "https://www.freebuf.com/news/220759.html", "time": "2019-11-21", "level": "", "num_look": 70105, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "ESET研究人员发现一种新型银行木马正试图窃取一名拉美客户的财务信息，该木马是通过使用假麦当劳优惠券进行诱骗和恶意垃圾邮件活动传播的。"}
{"title": "Sparrow-WiFi：一款Linux平台下的图形化WiFi及蓝牙分析工具", "url": "https://www.freebuf.com/sectool/219581.html", "time": "2019-11-21", "level": "", "num_look": 362740, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具", "无线安全"], "text": "Sparrow-wifi本质上一款针对下一代2.4GHz和5GHz的WiFi频谱感知工具。"}
{"title": "X-Tech技术派对：RedTeam 视角下的二进制攻防研究 | CIS 2019议题前瞻", "url": "https://www.freebuf.com/fevents/220396.html", "time": "2019-11-21", "level": "红色标题", "num_look": 57246, "num_comment": 2, "author": "FB独家", "tags": ["活动"], "text": "11月28日，在CIS 2019网络安全创新大会的X-Tech技术派对上，极光无限漏洞研究负责人仙果将带来主题分享《RedTeam 视角下的二进制攻防研究》，从二进制选手的角度出发，看到不一样的攻防优化。"}
{"title": "网络犯罪工具在暗网市场中的价格竟暴涨？", "url": "https://www.freebuf.com/news/217220.html", "time": "2019-11-21", "level": "", "num_look": 119816, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["网络安全", "资讯"], "text": "研究人员的一份报告让我们都震惊了！报告显示，目前暗网市场中的网络犯罪工具售价竟然暴涨，而且为网络犯罪分子提供用户数据和攻击服务的价格也越来越贵了。"}
{"title": "百度智能云安全产品研发工程师招聘", "url": "https://www.freebuf.com/jobs/220460.html", "time": "2019-11-21", "level": "", "num_look": 54338, "num_comment": 54338, "author": "helloliuxm", "tags": ["安全招聘"], "text": "百度智能云是百度提供的公有云平台，于2015年正式开放运营。百度智能云秉承“用科技力量推动社会创新”的愿景，不断将百度在云计算、大数据、人工智能的技术能力向社会输出。"}
{"title": "Anubis银行木马仿冒抖音国际版攻击活动披露", "url": "https://www.freebuf.com/articles/terminal/219069.html", "time": "2019-11-21", "level": "", "num_look": 108472, "num_comment": 1, "author": "奇安信威胁情报中心", "tags": ["终端安全"], "text": "Anubis(阿努比斯)是一种主要活动在欧美等地的Android银行木马，其攻击手法主要通过伪装成金融应用、聊天应用、手机游戏、购物应用、软件更新、邮件应用、浏览器应用等一些主流的APP及用户较多的APP进行植入。"}
{"title": "Apache Flink任意Jar包上传漏洞复现", "url": "https://www.freebuf.com/vuls/220252.html", "time": "2019-11-21", "level": "", "num_look": 192950, "num_comment": 17, "author": "ShShroudroud", "tags": ["漏洞"], "text": "周三的时候，安全网站上看到有一个新爆出的关于Aapche Flink的JAR包上传导致任意代码执行的漏洞。周四在看的时候已经出了一部分POC和抓取相关漏洞机器的代码，放在编译器里跑了一下好像不行。"}
{"title": "前端加密后的一次安全测试", "url": "https://www.freebuf.com/articles/web/219410.html", "time": "2019-11-21", "level": "现金奖励", "num_look": 213702, "num_comment": 19, "author": "wlfsky", "tags": ["WEB安全"], "text": "在做一次渗透测试项目中，发现使用BurpSuite抓到的包都是经过加密的，加密后的字符串类似base64编码方式，遂采用base64尝试解码……"}
{"title": "Web登录认证类漏洞分析防御总结和安全验证机制设计探讨", "url": "https://www.freebuf.com/articles/web/217052.html", "time": "2019-11-21", "level": "现金奖励", "num_look": 159446, "num_comment": 10, "author": "少帅力", "tags": ["WEB安全"], "text": "做渗透测试有一段时间了，发现登录方面的问题特别多，想做个比较全面点的总结。"}
{"title": "FreeBuf早报｜印度政府：法律允许政府机构监控公民设备；PayMyTab数据库泄露，暴露用户个人信息及财务细节；报告称约170万BTC可能永久丢失", "url": "https://www.freebuf.com/news/220706.html", "time": "2019-11-21", "level": "", "num_look": 66332, "num_comment": 1, "author": "kirazhou", "tags": ["资讯"], "text": "印度内政部部长G. Kishan Reddy称，为了国家安全或跟外国保持友好关系，政府有权拦截、监控或解密公民设备上生成、传输、接收或存储的任何数字通信。"}
{"title": "Chrome最新0day漏洞分析", "url": "https://www.freebuf.com/articles/network/218899.html", "time": "2019-11-21", "level": "", "num_look": 136306, "num_comment": 136306, "author": "Kriston", "tags": ["网络安全"], "text": "最近，卡巴斯基研究团队发现了谷歌Chrome浏览器的一个新的未知漏洞，并立即向谷歌Chrome安全团队报告了这一情况。谷歌确认存在零日漏洞，并分配编号CVE-2019-13720。"}
{"title": "X-Tech技术派对：再谈伪协议 | CIS 2019议题前瞻", "url": "https://www.freebuf.com/fevents/220384.html", "time": "2019-11-20", "level": "红色标题", "num_look": 48409, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "11月28日，在CIS 2019网络安全创新大会的X-Tech技术派对上，成都无糖信息技术有限公司联合创始人兼CTO gainover 将带来主题分享《再谈伪协议》。"}
{"title": "流量夹带(HTTP Request Smuggling) 检测方案的实现", "url": "https://www.freebuf.com/news/231050.html", "time": "2019-11-20", "level": "", "num_look": 11040, "num_comment": 11040, "author": "斗象智能安全平台", "tags": ["资讯"], "text": ""}
{"title": "谷歌三星安卓摄像头应用含高危漏洞变身监控器，影响数亿设备（PoC）", "url": "https://www.freebuf.com/vuls/220644.html", "time": "2019-11-20", "level": "红色标题", "num_look": 160328, "num_comment": 4, "author": "奇安信代码卫士", "tags": ["漏洞"], "text": "Checkmarx安全研究团队的研究人员表示，任何应用程序在不具备具体权限的情况下均可控制谷歌的安卓摄像头 app 并强制其拍照和/或录视频，即使手机锁定且屏幕关闭的情况也不例外。"}
{"title": "Applepie：一款整合了WHVP和Bochs的模糊测试工具", "url": "https://www.freebuf.com/sectool/214263.html", "time": "2019-11-20", "level": "", "num_look": 113998, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Applepie这款工具是一个专门用于模糊测试、内部安全审查和寻找漏洞的工具，从本质上来说，它是一款使用了Windows虚拟机管理程序平台API的管理程序。"}
{"title": "FreeBuf独家 |《网络安全威胁信息发布管理办法》解读", "url": "https://www.freebuf.com/articles/others-articles/220643.html", "time": "2019-11-20", "level": "红色标题", "num_look": 659532, "num_comment": 38, "author": "FreeBuf咨询", "tags": ["其他", "观点"], "text": "本文通过重点解读《网络安全威胁信息发布管理办法》，希望帮助安全从业人员梳理威胁情报发布的标准，从而建立起更好的威胁信息共享体系。"}
{"title": "各国家地区信息采集数据统计", "url": "https://www.freebuf.com/articles/network/218068.html", "time": "2019-11-20", "level": "", "num_look": 129348, "num_comment": 3, "author": "Kriston", "tags": ["网络安全"], "text": "随着互联网占据了我们日常生活的大部分，接收、收集和分析数据变得越来越容易和快捷，普通用户甚至无法想象在他们身上收集了多少数据。"}
{"title": "巩固万物智联安全建设，推动工业互联安全先行 | CIS 2019议题前瞻", "url": "https://www.freebuf.com/fevents/220518.html", "time": "2019-11-20", "level": "红色标题", "num_look": 30034, "num_comment": 30034, "author": "FB独家", "tags": ["活动"], "text": "11月28日，在CIS 2019网络安全创新大会上，上海工业控制系统安全创新功能型平台首席技术官刘虹、360安全研究院研究员，独角兽团队成员郝经利将带来物联网和工业互联网相关的议题分享。"}
{"title": "警惕来自节假日的祝福：APT攻击组织黑格莎（Higaisa）攻击活动披露", "url": "https://www.freebuf.com/news/219001.html", "time": "2019-11-20", "level": "", "num_look": 86310, "num_comment": 4, "author": "腾讯电脑管家", "tags": ["资讯"], "text": "根据对该组织活动中所使用的攻击技术、被攻击人员背景等分析研判，我们认为该攻击组织为来自朝鲜半岛的一个具有政府背景的APT攻击组织。"}
{"title": "印度非政府组织“伪造”265个在线新闻网站，虚假报道反巴基斯坦新闻", "url": "https://www.freebuf.com/news/220022.html", "time": "2019-11-20", "level": "", "num_look": 69944, "num_comment": 4, "author": "kirazhou", "tags": ["资讯"], "text": "这些虚假新闻网站还试图通过提供可链接的新闻材料来推进反巴基斯坦活动，以此增强反巴基斯坦非政府组织的合法性。"}
{"title": "Suricata + Lua实现本地情报对接", "url": "https://www.freebuf.com/sectool/218951.html", "time": "2019-11-20", "level": "现金奖励", "num_look": 179805, "num_comment": 2, "author": "Shell.", "tags": ["工具"], "text": "由于近期网站遭受恶意攻击, 通过对于登录接口的审计与分析, 现已确定了一批可疑账号。"}
{"title": "FreeBuf早报｜白俄罗斯屏蔽 ProtonMail；美国东德克萨斯州学区遭勒索病毒攻击；微信超过QQ成网络诈骗使用最频繁作案工具", "url": "https://www.freebuf.com/news/220568.html", "time": "2019-11-20", "level": "", "num_look": 80402, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "2018年，微信超过QQ成为网络诈骗犯罪中使用最为频繁的犯罪工具，超半数网络诈骗案件中均有涉及应用微信实施诈骗的犯罪情节。"}
{"title": "PHP序列化和反序列化语法差异问题", "url": "https://www.freebuf.com/articles/web/219062.html", "time": "2019-11-20", "level": "", "num_look": 130978, "num_comment": 2, "author": "米怀特", "tags": ["WEB安全"], "text": "简单说序列化是对象转化字符串的过程，反序列化是字符串还原对象的过程。"}
{"title": "Emotet银行木马攻击利用技术分析", "url": "https://www.freebuf.com/articles/system/219562.html", "time": "2019-11-20", "level": "", "num_look": 81290, "num_comment": 1, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "Emotet是一种通过邮件传播的银行木马，诱骗用户点击执行恶意代码，最早被发现于2014年并持续活动至今，在国内也有一定的影响面，其积极的杀软对抗策略使之成为一个难缠的对手。"}
{"title": "APT组织“拍拍熊”对巴勒斯坦政府攻击事件报告", "url": "https://www.freebuf.com/articles/es/220388.html", "time": "2019-11-20", "level": "", "num_look": 85759, "num_comment": 85759, "author": "瑞星", "tags": ["企业安全"], "text": "近日，瑞星威胁情报中心捕获到两起针对巴勒斯坦大选的APT攻击事件，通过对攻击手法的分析来看，发现这两起攻击均与APT组织“APT-C-37”（又称“拍拍熊”）有关。"}
{"title": "高净值客群场景下的个人信息保护实践 | CIS 2019议题前瞻", "url": "https://www.freebuf.com/fevents/220307.html", "time": "2019-11-19", "level": "红色标题", "num_look": 35328, "num_comment": 2, "author": "FB独家", "tags": ["活动"], "text": "11月27日，诺亚控股业务安全中心高级总监孔一童将在CIS 2019网络安全创新大会首席信息安全官闭门高峰论坛带来《高净值客群场景下的个人信息保护实践》的议题分享。"}
{"title": "警惕RSA SecurID标题的诱饵文档传播Maze(迷宫)勒索病毒", "url": "https://www.freebuf.com/articles/system/220259.html", "time": "2019-11-19", "level": "", "num_look": 103033, "num_comment": 3, "author": "熊猫正正", "tags": ["系统安全"], "text": "Maze勒索病毒，又称Chacha勒索病毒，是今年5月份由Malwarebytes安全研究员首次发现。"}
{"title": "AutoMacTC：一款针对macOS环境的自动化取证分类采集器", "url": "https://www.freebuf.com/sectool/218812.html", "time": "2019-11-19", "level": "", "num_look": 94782, "num_comment": 94782, "author": "Alpha_h4ck", "tags": ["工具"], "text": "AutoMacTC是一个针对macOS环境的模块化自动取证分类收集框架，AutoMacTC旨在帮助研究人员轻松访问macOS环境中的各种取证信息以及数据文件。"}
{"title": "金融行业安全业务系统的优化与编排 | CIS 2019议题前瞻", "url": "https://www.freebuf.com/news/220057.html", "time": "2019-11-19", "level": "红色标题", "num_look": 43267, "num_comment": 1, "author": "FB独家", "tags": ["资讯"], "text": "11月28日，在CIS 2019网络安全创新大会上，F5资深安全架构师陈玉奇将带来《金融行业安全业务系统的优化与编排》主题分享，通过深入探讨业务安全系统的优化方式，为金融科技企业在提升业务整体安全方面提供一些思路…"}
{"title": "不就是个短信登录API嘛", "url": "https://www.freebuf.com/articles/web/219304.html", "time": "2019-11-19", "level": "红色标题", "num_look": 183598, "num_comment": 15, "author": "shineforyou", "tags": ["WEB安全"], "text": "对登录功能做升级改造，在原来只支持用户名密码登录模式的基础上，新增手机号和短信验证码登录。"}
{"title": "美国路易斯安那州政府系统遭勒索软件袭击", "url": "https://www.freebuf.com/news/220472.html", "time": "2019-11-19", "level": "", "num_look": 48811, "num_comment": 48811, "author": "Sandra1432", "tags": ["资讯"], "text": "昨日，美国路易斯安那州政府受到勒索软件攻击，此次事件波及了车辆管理局、卫生部、运输部等众多州服务部门。"}
{"title": "如何识别并分析反恶意软件扫描接口(AMSI)组件", "url": "https://www.freebuf.com/articles/terminal/216921.html", "time": "2019-11-19", "level": "", "num_look": 85862, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "AMSI为终端安全供应商提供了丰富的接口以帮助他们更好地对目标组件进行内存缓冲区安全扫描"}
{"title": "一加科技安全团队招聘", "url": "https://www.freebuf.com/jobs/220306.html", "time": "2019-11-19", "level": "", "num_look": 87323, "num_comment": 3, "author": "xztop0", "tags": ["安全招聘"], "text": "一加科技（OnePlus，深圳市万普拉斯科技有限公司），由创始人刘作虎带领一群热爱科技和产品的年轻人于2013 年 12 月 17 日创立，初衷是希望通过互联网的方式、与世界分享品质科技。"}
{"title": "梦想v1.4 CMS平台XSS漏洞分析", "url": "https://www.freebuf.com/vuls/218838.html", "time": "2019-11-19", "level": "", "num_look": 128598, "num_comment": 5, "author": "jj2056", "tags": ["漏洞"], "text": "梦想cms以下简称“lmxcms”，是由“10年”（网名）开发的一套简单实用的网站管理系统（cms）。它是完全免费和开源的。"}
{"title": "甲方视角：SHIRO-721临时修复方案", "url": "https://www.freebuf.com/vuls/220143.html", "time": "2019-11-19", "level": "红色标题", "num_look": 138272, "num_comment": 5, "author": "Venscor", "tags": ["漏洞"], "text": "14日晚上，发现了一个公开的Shiro的RCE漏洞，作为在甲方工作了挺久的人，一听Shiro立马虎躯一震，来不及分析poc，立马先得确认公司业务是否受到影响。"}
{"title": "给需要关心安全的技术人员的一些建议", "url": "https://www.freebuf.com/articles/neopoints/218991.html", "time": "2019-11-19", "level": "", "num_look": 102930, "num_comment": 4, "author": "RIodian", "tags": ["观点"], "text": "网络安全事件频发，安全事故的危害越来越大，互联网从业者需要越来越注重安全问题。这里分享一些心得给刚刚接触网络安全的开发者们。"}
{"title": "FreeBuf早报 | 微软在欧盟调查之际更新数据隐私条款；中国互联网金融协会：正牵头开展金融App实名备案工作；Linux 市场估值将超 70 亿美元，主要原因是安全与开源需求", "url": "https://www.freebuf.com/news/220407.html", "time": "2019-11-19", "level": "", "num_look": 73606, "num_comment": 73606, "author": "Sandra1432", "tags": ["资讯"], "text": "微软周一表示，将更新其商业云合约中的隐私条款。此前，欧洲监管机构发现，微软与欧盟机构达成的协议未能按照欧盟法律保护数据。"}
{"title": "流量暗刷木马新秀：IECode", "url": "https://www.freebuf.com/articles/system/218737.html", "time": "2019-11-18", "level": "", "num_look": 126157, "num_comment": 4, "author": "安全豹", "tags": ["系统安全"], "text": "某视频网站上的一部热播电视剧，播放总量达160亿，要达到如此高的播放量，平均地球上的人要看2集才能勉强达到，这种动辄上百亿夸张的数据背后，都来自于网络黑产的杰作——流量暗刷。"}
{"title": "Attack Surface | 描绘机场信息系统攻击面", "url": "https://www.freebuf.com/articles/terminal/217342.html", "time": "2019-11-18", "level": "", "num_look": 99901, "num_comment": 2, "author": "clouds", "tags": ["终端安全"], "text": "航空安全是一个复杂问题，我对航空电子安全的兴趣源于乘机客户的评论，几年前媒体曾报道了美国国土安全部（DHS）测试波音 757 的电子攻击问题，那个时候就有好多人担心受「感染」的飞机可能会对机场造成新的攻击面…"}
{"title": "基于大数据企业网络威胁发现模型实践", "url": "https://www.freebuf.com/articles/es/219373.html", "time": "2019-11-18", "level": "现金奖励", "num_look": 621292, "num_comment": 3, "author": "糖果L5Q", "tags": ["企业安全"], "text": "关于企业安全威胁数据收集分析是一个系统工程，每天在我们网络环境中，都会产生各种形式的威胁数据。"}
{"title": "全议程公布！CIS 2019下周见", "url": "https://www.freebuf.com/fevents/220304.html", "time": "2019-11-18", "level": "红色标题", "num_look": 73725, "num_comment": 2, "author": "FB独家", "tags": ["活动"], "text": "大会详细议程公布！11月27-28日，上海，期待与你们在CIS 2019大会再次相遇呀～"}
{"title": "黑客利用区块链新币传播为契机构造诱饵", "url": "https://www.freebuf.com/articles/system/218802.html", "time": "2019-11-18", "level": "", "num_look": 92421, "num_comment": 4, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "越来越多的黑产团伙将区块链相关的内容作为诱饵，诱导想要了解或者学习相关概念的用户点击，一旦打开文档则会看触发漏洞程序，下载间谍软件，窃取用户信息。"}
{"title": "FreeBuf早报｜Google Chrome 实验功能导致浏览器标签崩溃；在黑客论坛上已经有成千上万的被盗Disney+帐户；洛杉矶DA无故发布公共USB充电座可能感染恶意软件的警告", "url": "https://www.freebuf.com/news/220290.html", "time": "2019-11-18", "level": "", "num_look": 80146, "num_comment": 2, "author": "kirazhou", "tags": ["资讯"], "text": "Google Chrome 的一项实验功能导致浏览器标签发生崩溃，全世界有大量企业受波及。"}
{"title": "中小企业运维中容易被低估的日志", "url": "https://www.freebuf.com/articles/network/219372.html", "time": "2019-11-18", "level": "", "num_look": 112796, "num_comment": 3, "author": "secisland", "tags": ["网络安全"], "text": "日志在很多中小企业运维中被严重低估，直到磁盘空间不足的时候才想到，磁盘里有个大的日志文件要把他删了，这样可以节省空间。"}
{"title": "GitHub 推出“安全实验室”和漏洞奖励计划，提升开源生态系统安全", "url": "https://www.freebuf.com/news/220283.html", "time": "2019-11-17", "level": "", "num_look": 77741, "num_comment": 2, "author": "奇安信代码卫士", "tags": ["资讯"], "text": "GitHub 在全球开发者大会上宣布推出新的社区计划“安全实验室 (Security Lab)”，汇聚各行各业的安全研究员查找并修复开源项目中的漏洞问题。"}
{"title": "PowerShell静态分析（Part I）", "url": "https://www.freebuf.com/articles/network/218399.html", "time": "2019-11-17", "level": "", "num_look": 92263, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "本文主要介绍了一种实用的powershell脚本静态分析方法，并基于独立于平台python脚本来执行此任务。"}
{"title": "Sednit组织最新研发的恶意软件组件", "url": "https://www.freebuf.com/articles/network/216434.html", "time": "2019-11-17", "level": "", "num_look": 89693, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "Sednit组织，也被称为APT28、Fancy Bear、Sofacy或STRONTIUM，从2004年起该组织一直活跃至今，而且只要该组织参与的网络攻击活动一般都会上报纸头条。"}
{"title": "RDP远程漏洞（CVE-2019-0708）被发现野外利用来挖矿", "url": "https://www.freebuf.com/articles/system/218963.html", "time": "2019-11-17", "level": "", "num_look": 141544, "num_comment": 1, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "2019年05月15日，微软公布了5月的补丁更新列表，在其中存在一个被标记为严重的RDP（远程桌面服务）远程代码执行漏洞。"}
{"title": "存储型XSS的攻防：不想做开发的黑客不是好黑客", "url": "https://www.freebuf.com/vuls/217092.html", "time": "2019-11-17", "level": "金币+15", "num_look": 234312, "num_comment": 17, "author": "ABKing", "tags": ["WEB安全", "漏洞"], "text": "存储型XSS是通过对网页注入可执行代码且成功地被浏览器执行，达到攻击的目的，一般是注入一段javascript脚本。"}
{"title": "挖洞经验 | PayPal未配置恰当的爬虫索引（robots）规则导致的用户敏感信息泄露漏洞", "url": "https://www.freebuf.com/vuls/217007.html", "time": "2019-11-16", "level": "", "num_look": 163624, "num_comment": 5, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文Writeup讲述了作者通过简单Google Dork查询发现的PayPal信息泄露漏洞。每天，世界各地大量PayPal用户在发生转账交易时，都使用了安全的GET方式HTTP传输请求，这本身没有任何问题。"}
{"title": "牢筑金融安全防线，做好安全运营与风险监测 | CIS 2019议题前瞻", "url": "https://www.freebuf.com/fevents/219903.html", "time": "2019-11-16", "level": "红色标题", "num_look": 29460, "num_comment": 29460, "author": "FB独家", "tags": ["活动"], "text": "随着金融科技的不断发展，如何有效管控金融科技安全风险，做好安全运营已经成为各类金融科技企业的重点课题。"}
{"title": "Graboid蠕虫分析", "url": "https://www.freebuf.com/articles/network/217100.html", "time": "2019-11-16", "level": "", "num_look": 82967, "num_comment": 82967, "author": "Kriston", "tags": ["网络安全"], "text": "研究人员发现了名为Graboid的新型加密劫持蠕虫，该蠕虫已传播到2,000多个不安全的Docker主机。"}
{"title": "追踪影响数百万用户的Android广告软件开发人员", "url": "https://www.freebuf.com/articles/terminal/219404.html", "time": "2019-11-16", "level": "", "num_look": 82176, "num_comment": 82176, "author": "Sandra1432", "tags": ["终端安全"], "text": "ESET研究人员在Google Play上发现了活跃了一年的广告软件运营商。所涉及的应用程序已安装了800万次，背后的运营商使用了一些技巧来隐藏。"}
{"title": "疑似Lazarus针对双平台的攻击活动披露", "url": "https://www.freebuf.com/articles/system/218901.html", "time": "2019-11-16", "level": "", "num_look": 86414, "num_comment": 86414, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "近期，奇安信威胁情报中心红雨滴团队在日常的APT样本追踪中，捕获一例利用心理测验为诱饵的Lazarus攻击样本。"}
{"title": "BUF大事件丨双11狂欢结束，你收到过骚扰短信、恶意弹窗么？腾讯QQ新增隐私保护指引，公开详细权限使用规则", "url": "https://www.freebuf.com/news/220072.html", "time": "2019-11-16", "level": "红色标题", "num_look": 80047, "num_comment": 80047, "author": "Darry端", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，美陆军用TikTok宣传征兵 国会议员又提国安问题；腾讯QQ新增隐私保护指引，公开详细权限使用规则；双11促销短信密集“轰炸”消费者 律师：涉嫌违法。"}
{"title": "盘点2019年勒索病毒灾难事件", "url": "https://www.freebuf.com/news/218683.html", "time": "2019-11-16", "level": "", "num_look": 134109, "num_comment": 1, "author": "0day情报局", "tags": ["资讯"], "text": "网络攻击千千万，勒索病毒占一半。今天我们就来盘一盘，2019年那些令人窒息的勒索病毒攻击。"}
{"title": "锤炼新形势下实网攻防的“剑与盾” | CIS 2019议题前瞻", "url": "https://www.freebuf.com/fevents/219691.html", "time": "2019-11-15", "level": "红色标题", "num_look": 71394, "num_comment": 71394, "author": "FB独家", "tags": ["活动"], "text": "11月28日，360集团攻防产品事业部总经理张锦章将在CIS 2019网络安全创新大会攻防演练研讨专场带来《锤炼新形势下实网攻防的“剑与盾”》议题分享！"}
{"title": "Winnti黑客组织MSSQL后门分析", "url": "https://www.freebuf.com/articles/network/218648.html", "time": "2019-11-15", "level": "", "num_look": 105799, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "最近，发现了一个以前未经记录的后门，其目标是Microsoft SQL（MSSQL）。这个后门与PortReuse后门有多处相似之处。"}
{"title": "【FreeBuf字幕组】Hacker101白帽黑客进阶之路-跨站脚本漏洞（XSS）", "url": "https://www.freebuf.com/video/220106.html", "time": "2019-11-15", "level": "红色标题", "num_look": 90580, "num_comment": 1, "author": "willhuang", "tags": ["视频"], "text": "本节课程，我们先来了解非常普遍的跨站脚本漏洞（XSS），通过对不同类型XSS的分析，明白其基本的触发原理、利用方式和缓解防护措施。"}
{"title": "看我如何绕过像PRO这样的XSS过滤器（XSS高级方法）", "url": "https://www.freebuf.com/vuls/216900.html", "time": "2019-11-15", "level": "", "num_look": 118234, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["漏洞", "网络安全"], "text": "JavaScript代码中如果存在代码注入漏洞的话，那确实是一个令人头疼的问题...由于这个项目并不是我们为企业环境做的渗透测试项目，因此我们可以直接将技术细节公布给大家。"}
{"title": "核心工业系统陷入危机？印度核电厂遭受网络攻击事件梳理与分析", "url": "https://www.freebuf.com/articles/system/218622.html", "time": "2019-11-15", "level": "", "num_look": 103781, "num_comment": 1, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "2019年10月29日，有Twitter用户声称印度Kudankulam核电厂遭到网络攻击，奇安信威胁情报中心结合公开情报将主要事件时间线整理如下。"}
{"title": "在VMware虚拟机下搭建kvm靶机", "url": "https://www.freebuf.com/articles/others-articles/219556.html", "time": "2019-11-15", "level": "", "num_look": 112929, "num_comment": 3, "author": "xianling", "tags": ["其他"], "text": "大家搭建kvm靶机时可以直接选择iso镜像搭建，这个一般不会出问题。故此就说下kvm中搭建的镜像，若是选择qcow2的镜像该如何搭建。"}
{"title": "Apache中.htaccess文件利用的总结与新思路拓展", "url": "https://www.freebuf.com/vuls/218495.html", "time": "2019-11-15", "level": "现金奖励", "num_look": 170950, "num_comment": 6, "author": "xuing", "tags": ["WEB安全", "漏洞"], "text": "在普遍使用的LAMP架构中，Apache与PHP之间的交互，有三种常见的方式。"}
{"title": "FreeBuf早报｜伊朗黑客组织建立了自己的VPN网络；高通漏洞暴露三星、LG手机上的关键数据；WebAssembly生态将完善网络安全性", "url": "https://www.freebuf.com/news/220148.html", "time": "2019-11-15", "level": "", "num_look": 70710, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "近日 Mozilla、Fastly、Intel 与 Red Hat 宣布成立联合组织 Bytecode Alliance，该联盟旨在通过协作实施标准和提出新标准，以完善 WebAssembly 在浏览器之外的生态。"}
{"title": "猫鼠游戏: 持续渗透中的高级命令混淆对抗 | CIS 2019议题前瞻", "url": "https://www.freebuf.com/fevents/219126.html", "time": "2019-11-15", "level": "", "num_look": 42428, "num_comment": 42428, "author": "FB独家", "tags": ["活动"], "text": "11月28日，腾讯刀锋安全团队（Tencent Blade Team）高级研究员张尧 / 曾智洋将在CIS 2019网络安全创新大会攻防演练研讨专场带来《猫鼠游戏: 持续渗透中的高级命令混淆对抗》议题分享。"}
{"title": "自己动手制作一个过保护调试器", "url": "https://www.freebuf.com/articles/system/218884.html", "time": "2019-11-15", "level": "现金奖励", "num_look": 238352, "num_comment": 4, "author": "huoji120", "tags": ["极客", "系统安全"], "text": "本人是新手第一次接触驱动开发的小白,事情是这样的，一个星期前突发奇想想做一个调试器保护程序用于调试游戏，既然要调试驱动保护的程序,自然也要深入驱动底层，所以就有了今天这篇文章。"}
{"title": "5G降级、设备位置跟踪等漏洞被发现，或可用于网络通信军事打击", "url": "https://www.freebuf.com/articles/system/220119.html", "time": "2019-11-15", "level": "", "num_look": 94252, "num_comment": 94252, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "来自普渡大学（Purdue University）和爱荷华大学（University of Iowa）的安全研究人员发现了11个5G漏洞。"}
{"title": "Chronicle准备倒闭，罪魁祸首真的是Google吗?", "url": "https://www.freebuf.com/news/219558.html", "time": "2019-11-14", "level": "", "num_look": 96496, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "众所周知，Chronicle是Google家的兄弟公司，而这家网络安全初创公司按理来说本应该彻底改变整个安全行业的，但现在却正在走向“倒闭”的边缘。"}
{"title": "记一次编写域账号弱口令审计工具", "url": "https://www.freebuf.com/sectool/219636.html", "time": "2019-11-14", "level": "红色标题", "num_look": 209351, "num_comment": 19, "author": "jerrybird", "tags": ["工具"], "text": "作为一名刚从事信息安全的人员，尝试在本身拥有的权限以内，在不影响其他员工日常工作、不影响服务器正常运行的情况下，审计出使用弱密码作为登录口令的员工。"}
{"title": "看我如何将WhatsApp中的双重释放漏洞变成RCE漏洞", "url": "https://www.freebuf.com/articles/network/217078.html", "time": "2019-11-14", "level": "", "num_look": 113417, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "在这篇文章中，我将跟大家讨论我在WhatsApp Android端应用程序中找到的一个双重释放漏洞（CVE-2019-11932），并且我会将该漏洞转变成一个远程代码执行漏洞。"}
{"title": "平安集团银河实验室招聘", "url": "https://www.freebuf.com/jobs/213730.html", "time": "2019-11-14", "level": "", "num_look": 185775, "num_comment": 10, "author": "银河实验室", "tags": ["安全招聘"], "text": "银河实验室（Galaxy Lab）是由多位资深安全专家组成的一支专注于金融科技安全领域研究团队，有丰富的安全攻防对抗经验和安全研究实践。"}
{"title": "疑似Group123 （APT37）针对中韩外贸人士的攻击活动分析", "url": "https://www.freebuf.com/news/218260.html", "time": "2019-11-14", "level": "", "num_look": 77735, "num_comment": 1, "author": "腾讯电脑管家", "tags": ["资讯"], "text": "在2019年8月底到9月中旬，检测到一批针对疑似中韩贸易等相关人士的钓鱼攻击活动。经过分析溯源发现，疑似是Group123攻击组织的最新攻击活动。"}
{"title": "标准解读：关于1730-2008工信部风险评估实施指南不得不说的二三事", "url": "https://www.freebuf.com/articles/security-management/215749.html", "time": "2019-11-14", "level": "金币+15", "num_look": 206988, "num_comment": 4, "author": "咸味奶黄豆沙包", "tags": ["安全管理"], "text": "要做风险评估，首先要懂流程怎么走；要写风险评估报告，得懂实施指南。"}
{"title": "FreeBuf早报｜俄罗斯男子因经营在线犯罪网站被引渡；TA505网络犯罪团伙正在针对系统集成商；谷歌回应数据滥用质疑：未将个人医疗数据用于AI研究", "url": "https://www.freebuf.com/news/219951.html", "time": "2019-11-14", "level": "", "num_look": 67816, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "Aleksei Burkov是俄罗斯人，他被指控经营在线犯罪网站Cardplanet，参与超过2,000万美元的信用卡欺诈活动。"}
{"title": "JWT介绍及其安全性分析", "url": "https://www.freebuf.com/vuls/219056.html", "time": "2019-11-14", "level": "", "num_look": 220821, "num_comment": 5, "author": "不瘦二十斤不改名", "tags": ["WEB安全", "漏洞"], "text": "JWT（JSON Web令牌）是REST API中经常使用的一种机制，可以在流行的标准（例如OpenID Connect）中找到它，但是有时也会使用OAuth2遇到它。"}
{"title": "NTA在企业安全体系中的用途与实战 | CIS 2019议题前瞻", "url": "https://www.freebuf.com/fevents/219856.html", "time": "2019-11-13", "level": "红色标题", "num_look": 49771, "num_comment": 49771, "author": "FB独家", "tags": ["活动"], "text": "11月27日，斗象科技技术副总裁徐钟豪将在CIS 2019网络安全创新大会首席信息安全官闭门高峰论坛带来《NTA在企业安全体系中的用途与实战》的议题分享。"}
{"title": "挖洞经验 | 从安全的文件共享服务中获取用户私钥信息", "url": "https://www.freebuf.com/vuls/218700.html", "time": "2019-11-13", "level": "", "num_look": 95734, "num_comment": 95734, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "虽然该加密服务网站声称它们提供的服务绝对安全可靠，但我觉得任何人都会犯错，所以我决定深入测试分析一下。"}
{"title": "2019第三季度DDoS报告", "url": "https://www.freebuf.com/articles/network/219711.html", "time": "2019-11-13", "level": "", "num_look": 138704, "num_comment": 2, "author": "Kriston", "tags": ["网络安全"], "text": "上个季度发现攻击者利用Memcached协议进行攻击，正如推测的那样，攻击者试图使用相当奇特的协议来放大DDoS攻击。"}
{"title": "CVE-2019-6333：HP触摸终端漏洞分析", "url": "https://www.freebuf.com/vuls/216760.html", "time": "2019-11-13", "level": "", "num_look": 187711, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["漏洞", "终端安全"], "text": "近期，SafeBreach Labs的安全研究人员在惠普的HP Touchpoint Analytics软件中发现了一个新型的安全漏洞，该漏洞将导致攻击者在目标设备上实现非法提权。"}
{"title": "TransparentTribe APT组织最新样本分析报告", "url": "https://www.freebuf.com/articles/system/218264.html", "time": "2019-11-13", "level": "", "num_look": 112153, "num_comment": 3, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近期获取到一例TransparentTribe APT组织的最新变种样本。"}
{"title": "攻防演练：二维码的另一面，利用人性的漏洞 | CIS 2019议题前瞻", "url": "https://www.freebuf.com/fevents/219397.html", "time": "2019-11-13", "level": "红色标题", "num_look": 67734, "num_comment": 6, "author": "FB独家", "tags": ["活动"], "text": "11月28日，联想全球安全实验室信息安全研究员Ivan将在CIS 2019网络安全创新大会上，首次公开分享《二维码的另一面，利用人性的漏洞》。"}
{"title": "FreeBuf早报｜美国退伍军人可以获得免费的网络安全培训；台湾中华电信数据机顶盒存在RCE漏洞；McAfee防病毒软件受代码执行漏洞影响", "url": "https://www.freebuf.com/news/219843.html", "time": "2019-11-13", "level": "", "num_look": 78677, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "Palo Alto Networks今天启动了一项名为Second Watch的新的免费网络安全培训和认证计划，以帮助美国退伍军人在服完兵役后在网络安全领域找到新的职业。"}
{"title": "2019年臭名昭著的勒索软件，网络钓鱼和僵尸网络", "url": "https://www.freebuf.com/news/219105.html", "time": "2019-11-13", "level": "红色标题", "num_look": 110721, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "从攻击次数最多的勒索软件和加密挖矿，到破坏最大的网络钓鱼攻击，显然，全球网络威胁正在变得更为先进且难以预测。"}
{"title": "DVWA开启渗透测试之旅与代码分析（二）", "url": "https://www.freebuf.com/articles/web/218170.html", "time": "2019-11-13", "level": "", "num_look": 103469, "num_comment": 103469, "author": "cmdgaga", "tags": ["WEB安全"], "text": "之前本地搭建环境以及配合代码分析说了一下暴力破解、文件上传、文件包含、命令注入，这次还是以代码分析为主，实验为辅助说一下SQL注入、XSS跨站脚本漏洞等漏洞。"}
{"title": "ThreatIngestor：一款功能强大的威胁情报提取和聚合工具", "url": "https://www.freebuf.com/sectool/218725.html", "time": "2019-11-12", "level": "", "num_look": 163277, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["工具"], "text": "该工具整合了ThreatKB和MISP，并且可以利用SQS、Beanstalk和自定义插件来跟很多现有的工作流实现无缝接入。"}
{"title": "看我如何通过参数污染绕过IDOR", "url": "https://www.freebuf.com/vuls/216774.html", "time": "2019-11-12", "level": "", "num_look": 157114, "num_comment": 9, "author": "Alpha_h4ck", "tags": ["漏洞", "网络安全"], "text": "在一次渗透测试过程中，我偶然间发现了一个有趣的IDOR（不安全的直接对象引用）漏洞，通过使用参数污染技术（利用一个被忽略的测试用例），攻击者将能够成功地在目标站点上实现IDOR绕过。"}
{"title": "途虎养车招聘资深安全工程师", "url": "https://www.freebuf.com/jobs/219670.html", "time": "2019-11-12", "level": "", "num_look": 88705, "num_comment": 1, "author": "SixSixSix", "tags": ["安全招聘"], "text": "途虎养车，2011年创立于上海，隶属于上海阑途信息技术有限公司，提供在线汽车保养服务。"}
{"title": "CheckPoint旗下安全公司ZoneAlarm论坛数据泄露", "url": "https://www.freebuf.com/news/219719.html", "time": "2019-11-12", "level": "", "num_look": 64097, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "以色列网络安全公司Check Point 软件技术有限公司旗下的互联网安全软件公司ZoneAlarm遭遇信息泄露，泄露了近4500名论坛用户数据。"}
{"title": "硬件学习之通过树莓派操控jtag", "url": "https://www.freebuf.com/articles/others-articles/218033.html", "time": "2019-11-12", "level": "", "num_look": 104520, "num_comment": 2, "author": "Knownsec知道创宇", "tags": ["其他", "极客"], "text": "最近在搞路由器的时候，不小心把CFE给刷挂了，然后发现能通过jtag进行救砖，所以就对jtag进行了一波研究。"}
{"title": "手把手教你打造超级CTF平台", "url": "https://www.freebuf.com/sectool/219255.html", "time": "2019-11-12", "level": "现金奖励", "num_look": 1060463, "num_comment": 57, "author": "独立团孙德胜", "tags": ["工具"], "text": "CTF，是最近大火的一个IP，随之而来的是大批CTF训练平台和CTF比赛的到来。"}
{"title": "VulnHub-DC-1靶机渗透测试", "url": "https://www.freebuf.com/articles/network/218073.html", "time": "2019-11-12", "level": "金币+8", "num_look": 122052, "num_comment": 6, "author": "MzHeader", "tags": ["网络安全"], "text": "在开始之前我们需要先配置一下环境，因不知道DC-1靶机的IP，所有我们需要将靶机和kali放在同一个局域网里面，我这里是桥接。"}
{"title": "FreeBuf早报 | 澳大利亚政府机构ACSC警告Emotet和BlueKeep攻击；以色列安全软件公司ZoneAlarm论坛网站遭遇数据泄露；工信部印发《携号转网服务管理规定》", "url": "https://www.freebuf.com/news/219698.html", "time": "2019-11-12", "level": "", "num_look": 86636, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "研究人员最新发现一种垃圾邮件传播活动，其伪装成WebEx的会议邀请，并使用思科开放的重定向漏洞将远程访问木马推送给收件人。WebEx 是思科的子公司，为各种规模的公司创建所需软件解决方案。"}
{"title": "供应链污染几时休 ？记一次排查后门病毒发现的行业乱象", "url": "https://www.freebuf.com/articles/network/218395.html", "time": "2019-11-12", "level": "", "num_look": 69060, "num_comment": 2, "author": "火绒安全", "tags": ["网络安全"], "text": "近期，“火绒威胁情报系统”截获到一款名为HellohaoOCR_V3.1的图像识别程序携带后门病毒Gh0st，推测正通过供应链污染的方式进行传播。"}
{"title": "数据库安全能力：安全威胁TOP5", "url": "https://www.freebuf.com/articles/database/218512.html", "time": "2019-11-12", "level": "金币+8", "num_look": 119718, "num_comment": 4, "author": "两块", "tags": ["数据安全"], "text": "让我们一起来关注在数据库安全能力建设中识别数据库的安全威胁。"}
{"title": "Hakbit勒索病毒突袭国内，奇安信首发解密工具", "url": "https://www.freebuf.com/articles/system/219673.html", "time": "2019-11-12", "level": "", "num_look": 89713, "num_comment": 6, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "近日，奇安信病毒响应中心在日常样本监控过程中发现Hakbit勒索在国内有扩散趋势，经过分析，奇安信已经将其破解，并公布了解密器和解密思路。"}
{"title": "备战双十一？网络欺诈者正在为账户接管攻击做大量测试", "url": "https://www.freebuf.com/articles/paper/219649.html", "time": "2019-11-11", "level": "", "num_look": 105193, "num_comment": 3, "author": "kirazhou", "tags": ["安全报告"], "text": "根据Arkose实验室的数据，2019年第三季度欺诈案总体增长了30%，并且由于网络犯罪分子在假期销售旺季之前测试了窃取的凭据，导致由机器人驱动的帐户注册欺诈上升了70％。"}
{"title": "Docem：向docx odt pptx等文件中嵌入XXE或XSS Payload", "url": "https://www.freebuf.com/sectool/217539.html", "time": "2019-11-11", "level": "", "num_look": 157052, "num_comment": 3, "author": "secist", "tags": ["工具"], "text": "docem是一个用于向docx，odt，pptx等（任意包含大量xml文件的zip）文件中嵌入XXE/XSS Payload的工具。许多常见的文档格式（例如doc，docx，odt等）都只是一个zip文件，其中包含了一些xml文件。"}
{"title": "最后一个登录框引起的血案", "url": "https://www.freebuf.com/vuls/219210.html", "time": "2019-11-11", "level": "现金奖励", "num_look": 682956, "num_comment": 61, "author": "丶楼兰", "tags": ["WEB安全", "漏洞"], "text": "登录框系列最后一篇，半年的准全职赏金猎人的生涯，算是水到渠成的一篇，这一篇每一个类型都将配一个这半年来我所发现的漏洞当作案例。"}
{"title": "看我如何利用LXD实现权限提升", "url": "https://www.freebuf.com/articles/system/216803.html", "time": "2019-11-11", "level": "", "num_look": 102751, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "我们将跟大家介绍如何通过利用LXD的漏洞，实现目标设备lxd组用户的提权。"}
{"title": "反诈骗之旅：仿冒公安政务", "url": "https://www.freebuf.com/articles/terminal/217910.html", "time": "2019-11-11", "level": "", "num_look": 140553, "num_comment": 3, "author": "暗影安全实验室", "tags": ["终端安全"], "text": "暗影移动安全实验室在日常监测中，发现了一批冒充“公安部”、“网上安全认证”、“公安局智能警务系统”等应用程序名称的诈骗类APP，研究人员分析发现，这批诈骗APP的目的是窃取用户个人信息。"}
{"title": "双“11”抢免单 ｜CIS 2019大会部分精彩议题抢先看", "url": "https://www.freebuf.com/fevents/219459.html", "time": "2019-11-11", "level": "红色标题", "num_look": 73774, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "11月11日当天购票就有机会抢5个免单机会！"}
{"title": "一个人的攻防演练：聊聊企业安全策略", "url": "https://www.freebuf.com/articles/es/219302.html", "time": "2019-11-11", "level": "现金奖励", "num_look": 668428, "num_comment": 11, "author": "LinuxSelf", "tags": ["企业安全"], "text": "首先交代下背景，本次攻防演练防守方的客户是一个金融企业，基础安全做了近3年，基本上就要迎接高大上的深度探索阶段，然后本次演练客户不是主要目标，属于大型目标下的小目标，也就是说供应链的一块。"}
{"title": "FreeBuf早报｜美国政府要求用户警惕假日欺诈和恶意软件；微软Defender杀毒软件将发布Linux版；10款APP被点名", "url": "https://www.freebuf.com/news/219610.html", "time": "2019-11-11", "level": "", "num_look": 71143, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": "微软宣布其杀毒软件 Microsoft Defender 明年将发布 Linux 版本。微软今年初将其安全软件 Windows Defender 重命名为 Microsoft Defender，代表它不仅仅在 Windows 平台释出，它已经发布了 Mac 版本。"}
{"title": "基于图数据的云上Bot团伙深度感知 | CIS 2019议题前瞻", "url": "https://www.freebuf.com/fevents/219125.html", "time": "2019-11-11", "level": "", "num_look": 33535, "num_comment": 33535, "author": "FB独家", "tags": ["活动"], "text": "11月28日，阿里云智能高级安全工程师郭伟博将在CIS 2019网络安全创新大会前沿创新技术对话中带来《基于图数据的云上Bot团伙深度感知》议题分享。"}
{"title": "众多游戏软件暗含后门，云控用户设备进行恶意刷量", "url": "https://www.freebuf.com/articles/terminal/219475.html", "time": "2019-11-11", "level": "", "num_look": 97135, "num_comment": 97135, "author": "腾讯手机管家", "tags": ["终端安全"], "text": "近日，腾讯安全分析师在应用商店过审的样本中发现，影视类、天气预报、游戏类等软件中存在后门，黑产开发者通过后门云控下发恶意子包到用户设备，进行视频、广告刷量等恶意行为。一旦被感染用户就是黑产的一只“肉鸡…"}
{"title": "Facebook堕入史上最大危机近7000页机密文件走漏", "url": "https://www.freebuf.com/news/219604.html", "time": "2019-11-10", "level": "", "num_look": 78777, "num_comment": 4, "author": "Sandra1432", "tags": ["资讯"], "text": "Facebook正在面对史无前例的危机：近7000页内部机密文件被走漏，曝光了Facebook怎么将用户数据作为商洽筹码，怎么操控竞赛对手，甚至在孵化前杀死竞赛对手。"}
{"title": "AuthCov：开源Web应用程序授权爬行和扫描工具", "url": "https://www.freebuf.com/sectool/217214.html", "time": "2019-11-10", "level": "", "num_look": 121663, "num_comment": 2, "author": "周大涛", "tags": ["工具"], "text": "AuthCov是一款用于Web应用扫描工具，AuthCov使用Chrome浏览器拦截并记录API请求以及在加载阶段的页面。然后，它以不同的帐户登录，并尝试访问先前发现的每个API请求或页面。"}
{"title": "分析银行木马的恶意快捷方式及混淆的Powershell", "url": "https://www.freebuf.com/articles/network/215898.html", "time": "2019-11-10", "level": "", "num_look": 111573, "num_comment": 3, "author": "周大涛", "tags": ["网络安全"], "text": "在本文中，将分析一款银行恶意软件，分为两个阶段。第一阶段是Windows快捷方式文件，第二阶段为Powershell脚本。"}
{"title": "最全Linux应急响应技巧", "url": "https://www.freebuf.com/articles/system/218407.html", "time": "2019-11-10", "level": "", "num_look": 312045, "num_comment": 10, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "这篇文章将会对Linux环境下的应急响应流程进行讲解，并且提供每一个环节中所用到的shell命令。"}
{"title": "CVE-2016-3116 Dropbear注入漏洞分析", "url": "https://www.freebuf.com/vuls/217933.html", "time": "2019-11-10", "level": "金币+15", "num_look": 111822, "num_comment": 1, "author": "1s1and", "tags": ["漏洞"], "text": "Dropbear是一个相对较小的SSH服务器和客户端。开源，在无线路由器等嵌入式linux系统中使用较多。"}
{"title": "EAPHammer：一款针对WPA2企业网络环境的Evil Twin攻击测试工具", "url": "https://www.freebuf.com/sectool/217218.html", "time": "2019-11-09", "level": "", "num_look": 311100, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具", "无线安全"], "text": "EAPHammer可以针对WPA2-Enterprise企业网络执行Evil Twin攻击测试，广大研究人员可以将其用于全范围的无线网络安全评估以及红队安全研究。"}
{"title": "白帽LIVE：iOS非越狱环境下的小程序破解 | CIS 2019议题前瞻", "url": "https://www.freebuf.com/fevents/219005.html", "time": "2019-11-09", "level": "", "num_look": 43100, "num_comment": 43100, "author": "FB独家", "tags": ["活动"], "text": "11月28日，移动安全研究员张舟将在白帽LIVE专场上带来《iOS非越狱环境下的小程序破解》主题分享，谈谈“非越狱”的那些事。"}
{"title": "PKPLUG黑客组织分析", "url": "https://www.freebuf.com/articles/network/215892.html", "time": "2019-11-09", "level": "", "num_look": 85792, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "三年来，研究人员发现并追踪了一组遍布亚洲的网络间谍攻击活动，攻击中同时使用了公开和自定义恶意软件，研究人员将该黑客组织命名为PKPLUG"}
{"title": "TA505黑产团伙更新诱饵：使用进度条迷惑受害者", "url": "https://www.freebuf.com/articles/system/217908.html", "time": "2019-11-09", "level": "", "num_look": 89416, "num_comment": 1, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "奇安信威胁情报中心在日常样本监测中发现了TA505新的一轮攻击活动……"}
{"title": "BUF大事件丨“卧底”软件非法监听跟踪，全国6万多人隐私被窃案告破；趋势科技员工将68000名客户信息出售给犯罪分子", "url": "https://www.freebuf.com/news/219421.html", "time": "2019-11-09", "level": "红色标题", "num_look": 110244, "num_comment": 110244, "author": "Darry端", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，商家收“美团短信”被骗财，公安部刑侦局提示慎点；“卧底”软件非法监听跟踪，全国6万多人隐私被窃案告破；趋势科技员工将68000名客户信息出售给犯罪分子。"}
{"title": "Brain fuck-pwnable.kr三种思路详解", "url": "https://www.freebuf.com/vuls/216749.html", "time": "2019-11-09", "level": "金币+15", "num_look": 93070, "num_comment": 1, "author": "skye231", "tags": ["其他", "漏洞"], "text": "本文主要针对brain fuck-pwnable.kr三种思路进行详解。"}
{"title": "RITA：一款功能强大的真实情报威胁分析工具", "url": "https://www.freebuf.com/sectool/217216.html", "time": "2019-11-08", "level": "", "num_look": 124487, "num_comment": 124487, "author": "Alpha_h4ck", "tags": ["工具"], "text": "RITA是一款专门针对网络流量分析与测试人员的开源框架，广大研究人员可以利用RITA来对收集到的安全威胁情报进行深度分析。"}
{"title": "【FreeBuf字幕组】Hacker101白帽黑客进阶之路-The Web In Depth", "url": "https://www.freebuf.com/video/219513.html", "time": "2019-11-08", "level": "红色标题", "num_look": 74026, "num_comment": 2, "author": "willhuang", "tags": ["视频"], "text": "本节课程中，我们将了解到Web工作机制和其涉及到的一些基本知识，围绕Web方面的协议、策略和编码入手，通过对它们的理解分析，探究其中可能存在的安全问题。"}
{"title": "美台首次演练网络攻防战，实为美国意图固化网络霸权梦", "url": "https://www.freebuf.com/articles/network/219407.html", "time": "2019-11-08", "level": "", "num_look": 116941, "num_comment": 3, "author": "奇安信威胁情报中心", "tags": ["网络安全"], "text": "2019年11月4日开始，台湾与美国首度联合举行为期5天的大规模网络攻防演练，即Cyber Offensive and Defensive Exercises，简称CODE，主要研究如何应对来自朝鲜等外敌的网络威胁。"}
{"title": "机场安全性分析", "url": "https://www.freebuf.com/articles/security-management/217041.html", "time": "2019-11-08", "level": "", "num_look": 194541, "num_comment": 2, "author": "Kriston", "tags": ["安全管理"], "text": "航空安全是一个很复杂的环境。 几年前媒体报道DHS针对一架波音757攻击，担心一架“被黑”的飞机可能会成为针对机场新的攻击手段。"}
{"title": "蚂蚁金服招聘应用和区块链等安全人才", "url": "https://www.freebuf.com/jobs/218975.html", "time": "2019-11-08", "level": "", "num_look": 83404, "num_comment": 83404, "author": "billzone", "tags": ["安全招聘"], "text": "蚂蚁金服是一家旨在为世界带来普惠金融服务的科技企业。"}
{"title": "当年奥运会背后的网络暗战和幕后网军真相", "url": "https://www.freebuf.com/articles/others-articles/217710.html", "time": "2019-11-08", "level": "", "num_look": 70116, "num_comment": 2, "author": "奇安信威胁情报中心", "tags": ["其他"], "text": "平昌冬奥会，于2018年在韩国举行，在举办前夕，12月6日消息，国际奥委会禁止俄罗斯以国家名义参加平昌冬奥会，而举行期间丑闻不断。"}
{"title": "快讯｜华为将推出新的漏洞赏金计划，涵盖鸿蒙OS", "url": "https://www.freebuf.com/news/219430.html", "time": "2019-11-08", "level": "红色标题", "num_look": 62978, "num_comment": 6, "author": "百里不守约", "tags": ["资讯"], "text": "根据外媒TechCrunch的消息，华为将在本月16号在慕尼黑举行一次秘密会议，邀请了来自世界各地顶尖的移动领域黑客。"}
{"title": "利用关联网络防控信用卡养卡套现", "url": "https://www.freebuf.com/articles/security-management/218158.html", "time": "2019-11-08", "level": "", "num_look": 210096, "num_comment": 3, "author": "blackhole666", "tags": ["企业安全", "安全管理"], "text": "相对于额度小规矩多的信用卡取现，信用卡套现最吸引欺诈用户。"}
{"title": "FreeBuf早报 | 趋势科技员工将客户信息出售给“技术支持”骗子；谷歌联合三家安全公司共同打击Android恶意软件；两名前推特员工为沙特阿拉伯政府监视推特用户", "url": "https://www.freebuf.com/news/219427.html", "time": "2019-11-08", "level": "", "num_look": 65514, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "据外媒报道，一份泄露的Facebook文件缓存曝光了公司首席执行官马克·扎克伯格将用户数据作为讨价还价的筹码，巩固公司在社交网络的地位并压制竞争对手。"}
{"title": "DVWA渗透测试之旅与代码分析", "url": "https://www.freebuf.com/articles/web/217899.html", "time": "2019-11-08", "level": "金币+8", "num_look": 156462, "num_comment": 2, "author": "cmdgaga", "tags": ["WEB安全"], "text": "前几天小白有幸的为学校的信科的学生进行前期的培训，说实在的这次的培训有点不成功，状况百出，反正整个过程下来也是没有头绪。培训的时候一般都是用dvwa来讲解top10的漏洞，再加上代码分析来亲身体现处漏洞的危害…"}
{"title": "本地差分隐私技术在联邦学习中的实践 | CIS 2019议题前瞻", "url": "https://www.freebuf.com/fevents/219059.html", "time": "2019-11-07", "level": "红色标题", "num_look": 49500, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "11月28日，vivo千镜安全实验室安全研究员张栋将在CIS 2019网络安全创新大会人工智能安全前沿论坛带来《本地差分隐私技术在联邦学习中的实践》议题分享！"}
{"title": "Gobuster：一款基于Go开发的目录文件、DNS和VHost爆破工具", "url": "https://www.freebuf.com/articles/network/217194.html", "time": "2019-11-07", "level": "", "num_look": 177638, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "Gobuster这款工具基于Go编程语言开发，广大研究人员可使用该工具来对目录、文件、DNS和VHost等对象进行暴力破解攻击。目前，该工具刚刚发布了最新的Gobuster v3.0.1版本。"}
{"title": "俄罗斯大规模“断网”测试，网络安全乌托邦真的存在吗？", "url": "https://www.freebuf.com/news/219267.html", "time": "2019-11-07", "level": "红色标题", "num_look": 228950, "num_comment": 9, "author": "kirazhou", "tags": ["资讯"], "text": "11月1日起，俄罗斯进行“RuNet”测试，验证该国网络在“与世隔绝”下的运作能力。"}
{"title": "IoT恶意软件报告", "url": "https://www.freebuf.com/articles/network/217054.html", "time": "2019-11-07", "level": "", "num_look": 89376, "num_comment": 3, "author": "Kriston", "tags": ["网络安全"], "text": "物联网/嵌入式设备的主要问题在于，它们根本无法安装任何类型的安全软件。 我们该如何处理？"}
{"title": "自己动手，DIY一台硬件WAF！", "url": "https://www.freebuf.com/articles/es/218263.html", "time": "2019-11-07", "level": "金币+8", "num_look": 192771, "num_comment": 16, "author": "w2sfoot", "tags": ["企业安全"], "text": "硬件WAF，好像是很高端，很神密的样子，而且很贵。今天向大家展示如何自己动手，DIY一台硬件WAF！"}
{"title": "勒索病毒新玩法：加密锁屏改密码，私密文件公开化", "url": "https://www.freebuf.com/articles/system/219313.html", "time": "2019-11-07", "level": "", "num_look": 98020, "num_comment": 2, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近期，深信服安全团队通过对海外第三方数据样本的监测，捕获到勒索病毒Megacortex新型变种。该家族样本最早出现在今年1月份，并对国外多个行业发起勒索攻击行为。"}
{"title": "APT组织“响尾蛇”对巴基斯坦攻击事件报告", "url": "https://www.freebuf.com/articles/es/218416.html", "time": "2019-11-07", "level": "", "num_look": 104272, "num_comment": 1, "author": "瑞星", "tags": ["企业安全"], "text": "“响尾蛇”组织之前几次针对中国的攻击，都是利用了Office远程代码执行漏洞，通过钓鱼邮件等方式投放带有恶意软件的诱饵文档。"}
{"title": "CVE-2019-7609 Kibana远程代码执行漏洞攻击方法和漏洞原理分析", "url": "https://www.freebuf.com/vuls/217816.html", "time": "2019-11-07", "level": "现金奖励", "num_look": 175627, "num_comment": 2, "author": "wangtua", "tags": ["漏洞"], "text": "本漏洞的exp放出来快一星期了，目前网上的分析文章也出了几篇，但是大都集中于通过容器简单复现攻击过程，没有深入的分析产生原因和exp的构造原理。"}
{"title": "FreeBuf早报｜中国警方对感染超过20万的DDoS僵尸网络进行打击；TikTok致信美国国会：再次强调美用户数据存在美国；台“金管会”：6券商遭黑客攻击，无投资人受影响", "url": "https://www.freebuf.com/news/219296.html", "time": "2019-11-07", "level": "", "num_look": 156096, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "中国警方破获并逮捕了一个犯罪集团，该集团经营着一个感染了20多万个网站的僵尸网络，用来发起DDoS攻击。"}
{"title": "工控安全EthernetIP协议分析", "url": "https://www.freebuf.com/articles/ics-articles/218674.html", "time": "2019-11-07", "level": "现金奖励", "num_look": 227592, "num_comment": 2, "author": "zhangshuo", "tags": ["工控安全"], "text": "Ethernet/IP协议是由控制网国际有限公司于二十世纪九十年代构建的，相较于Modbus协议它是一个很年轻的协议"}
{"title": "企业安全建设从一人到一众 | CIS 2019议题前瞻", "url": "https://www.freebuf.com/fevents/219180.html", "time": "2019-11-06", "level": "红色标题", "num_look": 56588, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "11月27日，易宝支付信息安全负责人廖威将在CIS 2019网络安全创新大会首席信息安全官闭门高峰论坛带来《企业安全建设从一人到一众》的议题分享，进一步讲述企业安全负责人的工作痛点和方法！"}
{"title": "模糊测试工具WinAFL使用指南", "url": "https://www.freebuf.com/articles/system/216437.html", "time": "2019-11-06", "level": "现金奖励", "num_look": 181880, "num_comment": 9, "author": "护花使者cxy", "tags": ["系统安全"], "text": "WinAFL 是一款流行的基于 Windows 平台下的半自动二进制文件格式模糊测试工具，属于 AFL 大家族中的一员。"}
{"title": "黑客利用最新的Firefox漏洞诱导用户寻求“技术支持”", "url": "https://www.freebuf.com/news/219216.html", "time": "2019-11-06", "level": "", "num_look": 58069, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "近期，黑客正热衷于利用Firefox中的漏洞进行诈骗，该漏洞会导致浏览器锁定，同时显示警告消息，提示计算机运行的是Windows盗版。"}
{"title": "90后白帽子：做点更有意义的事情吧！", "url": "https://www.freebuf.com/articles/people/219079.html", "time": "2019-11-06", "level": "红色标题", "num_look": 319536, "num_comment": 21, "author": "kirazhou", "tags": ["人物志"], "text": "2007年，17岁的朱鹏认识了张瑞冬，一群年轻、对网络安全满怀热忱的年轻人成立了对抗网络犯罪的白帽子团队PKER，也就是后来圈内广为人知的PKAV。"}
{"title": "看我如何绕过macOS的隐私控制", "url": "https://www.freebuf.com/vuls/216313.html", "time": "2019-11-06", "level": "", "num_look": 99419, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["漏洞", "系统安全"], "text": "在这篇文章中，我们将给大家介绍一种绕过macOS隐私控制以及其他保护访问限制（例如Keychain等）的技术。"}
{"title": "斯诺登：在巨额罚单下达之前，GDPR只是一只纸老虎", "url": "https://www.freebuf.com/news/219159.html", "time": "2019-11-06", "level": "", "num_look": 57597, "num_comment": 3, "author": "百里不守约", "tags": ["资讯"], "text": "斯诺登认为，欧洲的数据保护立法没有抓住重点，在互联网巨头受到巨额罚款之前，欧洲的数据保护立法仍将是一只“纸老虎”。"}
{"title": "百度安全招聘安全人才", "url": "https://www.freebuf.com/jobs/218962.html", "time": "2019-11-06", "level": "", "num_look": 55761, "num_comment": 2, "author": "百度安全实验室", "tags": ["安全招聘"], "text": "百度安全以技术开源、专利共享、标准驱动为理念，联合互联网公司、安全厂商、终端制造商、 高校及科研机构， 推动AI时代的安全生态建设，让全行业享受更安全的AI所来带来的变革。"}
{"title": "DorkBot僵尸网络近期活跃情况报告", "url": "https://www.freebuf.com/articles/paper/218090.html", "time": "2019-11-06", "level": "", "num_look": 85520, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["安全报告"], "text": "DorkBot是一个臭名昭著的僵尸网络，使用的攻击手段包括后门植入，密码窃取等恶意行为。传播方式也各式各样，包括移动U盘、即时通讯软件、社交网络、电子邮件等。"}
{"title": "漫谈HASH传递（PTH）", "url": "https://www.freebuf.com/articles/system/217681.html", "time": "2019-11-06", "level": "现金奖励", "num_look": 160083, "num_comment": 10, "author": "rabbitmask", "tags": ["系统安全"], "text": "PTH，即Pass-The-Hash，首先我们来说下为什么要使用HASH传递，一是再目标机>=win server 2012时，lsass.exe进程中是抓不到明文密码的，二是随着信息安全意识的提高，弱口令情况逐渐降低。"}
{"title": "FreeBuf早报｜伊拉克再次切断互联网；加拿大Nunavut政府系统被勒索软件瘫痪；布鲁克林医院在勒索软件攻击中丢失患者数据", "url": "https://www.freebuf.com/news/219166.html", "time": "2019-11-06", "level": "红色标题", "num_look": 61478, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "愈演愈烈的抗议促使伊拉克政府再次切断了互联网。巴格达当地时间 11 月 5 日 00:00，伊拉克大部分地区的互联网连通率降至了 19%，断网影响到了半自治库尔德人地区之外的大部分伊拉克领土。"}
{"title": "五分之一的中小型企业遭受勒索软件的攻击", "url": "https://www.freebuf.com/articles/network/217437.html", "time": "2019-11-06", "level": "", "num_look": 72930, "num_comment": 2, "author": "Sandra1432", "tags": ["网络安全"], "text": "根据Datto对1400多名管理中小型企业（SMB）IT系统的MSP（托管服务供应商）决策者的调查，勒索软件仍然是中小型企业最常见的网络威胁。"}
{"title": "金融科技安全：蚂蚁安全科技在数据安全和隐私保护方向上的实践 | CIS 2019议题前瞻", "url": "https://www.freebuf.com/fevents/218364.html", "time": "2019-11-05", "level": "红色标题", "num_look": 56348, "num_comment": 2, "author": "FB独家", "tags": ["活动"], "text": "10亿+金融客户的数据和隐私保护的背后。11月28日，蚂蚁金服高级算法专家薛峰将在CIS 2019网络安全创新大会金融科技安全专场带来《TED ENGINE：蚂蚁安全科技在数据安全和隐私保护方向上的实践》的主题演讲。"}
{"title": "冒充安恒信息对看雪论坛的一次定向钓鱼攻击", "url": "https://www.freebuf.com/news/219142.html", "time": "2019-11-05", "level": "金币+8", "num_look": 182339, "num_comment": 5, "author": "熊猫正正", "tags": ["资讯"], "text": "钓鱼攻击是网络犯罪团伙常用的一种手段，很多勒索病毒都曾使用邮件钓鱼的方式欺骗受害者打开相应的附件，运行恶意样本，导致受害者被勒索加密。"}
{"title": "Lockdoor Framework：一套自带大量网络安全资源的渗透测试框架", "url": "https://www.freebuf.com/articles/network/216511.html", "time": "2019-11-05", "level": "", "num_look": 137685, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "该项目目前仍处于v1.0 BETA测试版本开发阶段，因此使用过程中可能会出现bug，广大用户可以直接将问题反馈到项目的GitHub主页。"}
{"title": "暗网上发现2100万个五百强企业的登录凭证", "url": "https://www.freebuf.com/news/218697.html", "time": "2019-11-05", "level": "金币+6", "num_look": 91514, "num_comment": 5, "author": "Alluka", "tags": ["资讯"], "text": "在暗网上的各个地方都发现了从世界500强公司盗取的大约2100万个登录凭证，其中许多凭证已经被破解并以明文形式提供。"}
{"title": "安全市场走向“合规与效果”并重 | 对话WIT 2019评委主席仙儿", "url": "https://www.freebuf.com/articles/people/215964.html", "time": "2019-11-05", "level": "红色标题", "num_look": 236928, "num_comment": 3, "author": "Sandra1432", "tags": ["人物志", "活动"], "text": "本期专访邀请到数说安全创办人/独立行业研究员，仙儿，来谈谈国内网络安全市场形势。"}
{"title": "红蓝对抗之如何利用Shellcode来躲避安全检测", "url": "https://www.freebuf.com/articles/system/216742.html", "time": "2019-11-05", "level": "", "num_look": 127611, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "在这篇文章中，我们将跟大家介绍FireEye Mandiant红队研究人员如何通过构造特殊Payload来绕过现代EDR产品，并获取到目标系统的完整命令控制访问权。"}
{"title": "PHP远程代码执行漏洞预警（CVE-2019-11043）", "url": "https://www.freebuf.com/articles/web/217836.html", "time": "2019-11-05", "level": "", "num_look": 199758, "num_comment": 6, "author": "深信服千里目安全实验室", "tags": ["WEB安全"], "text": "PHP官方发布了一则漏洞公告，此次漏洞公告中官方披露了一个远程代码执行漏洞"}
{"title": "大型互联网公司数据安全实践", "url": "https://www.freebuf.com/articles/database/218691.html", "time": "2019-11-05", "level": "红色标题", "num_look": 185128, "num_comment": 4, "author": "美团点评安全应急响应中心", "tags": ["企业安全", "数据安全"], "text": "相信很多企业都面临数据泄漏的问题，例如用户投诉注册后收到了很多骚扰电话，内部员工频繁接到到猎头电话骚扰，业务上的竞争对手准确地掌握了公司的经营数据动态等。"}
{"title": "FreeBuf早报 | 美国代码托管网站GitLab拒绝为中国和俄罗斯人提供offer；信通院评测了13万个金融类App，70%存高危漏洞；QSnatch恶意软件已经感染了数千台QNAP NAS设备", "url": "https://www.freebuf.com/news/219031.html", "time": "2019-11-05", "level": "红色标题", "num_look": 75423, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "近日，中国信息通信研究院发布《2019年金融行业移动App安全观测报告》（简称《报告》）。《报告》对133327款金融类App进行了测评。"}
{"title": "PHP-fpm远程代码执行漏洞(CVE-2019-11043)分析", "url": "https://www.freebuf.com/vuls/218132.html", "time": "2019-11-05", "level": "", "num_look": 164131, "num_comment": 2, "author": "Knownsec知道创宇", "tags": ["漏洞"], "text": "国外安全研究员 Andrew Danau在解决一道 CTF 题目时发现，向目标服务器 URL 发送 %0a 符号时，服务返回异常，疑似存在漏洞。"}
{"title": "等保2.0标准个人解读（四）：安全计算环境", "url": "https://www.freebuf.com/articles/es/218259.html", "time": "2019-11-05", "level": "现金奖励", "num_look": 323857, "num_comment": 4, "author": "宇宸de研究室", "tags": ["企业安全", "标准与合规"], "text": "本控制项主要关注主机和应用安全，但更多的是侧重应用安全，属于三重防护之一。可以说是融合了主机安全、应用安全和备份恢复的内容，原文中要求较多。"}
{"title": "ATT&CK中的进程注入三部曲", "url": "https://www.freebuf.com/articles/web/218232.html", "time": "2019-11-05", "level": "", "num_look": 88667, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["WEB安全"], "text": "详细介绍分析了Mitre ATT&CK矩阵中的三种进程注入手法：经典的进程注入、Process Hollowing和Process Doppelgänging。"}
{"title": "揭密无文件勒索病毒攻击，思考网络安全新威胁", "url": "https://www.freebuf.com/articles/system/218885.html", "time": "2019-11-04", "level": "金币+6", "num_look": 97376, "num_comment": 3, "author": "熊猫正正", "tags": ["系统安全"], "text": "最近几年基于无文件攻击的网络犯罪活动越来越多，一些网络犯罪团伙开发了各种基于无文件攻击的恶意软件攻击套件，这些恶意软件攻击套件可用于勒索病毒、挖矿病毒、RAT远控、僵尸网络等恶意软件。"}
{"title": "DECAF：一款基于QEMU的二进制代码分析平台", "url": "https://www.freebuf.com/sectool/216773.html", "time": "2019-11-04", "level": "", "num_look": 118059, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具"], "text": "DECAF，英文全称为Dynamic Executable Code Analysis Framework，即动态可执行文件代码分析框架。"}
{"title": "Think CMF X任意内容包含漏洞分析复现", "url": "https://www.freebuf.com/vuls/218105.html", "time": "2019-11-04", "level": "现金奖励", "num_look": 172043, "num_comment": 10, "author": "_Mask", "tags": ["漏洞"], "text": "ThinkCMF是一款基于PHP+MYSQL开发的中文内容管理框架，底层采用ThinkPHP3.2.3构建。ThinkCMF提出灵活的应用机制，框架自身提供基础的管理功能，而开发者可以根据自身的需求以应用的形式进行扩展。"}
{"title": "ATM恶意软件家族Dtrack", "url": "https://www.freebuf.com/articles/network/215830.html", "time": "2019-11-04", "level": "", "num_look": 87939, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "2018年夏末，发现了一款针对印度银行的atm恶意软件，进一步的分析表明，该恶意软件被设计用于植入目标的自动柜员机，可以读取和存储插入机器的卡中数据，在之后又发现了180多个恶意软件样本，现称之为DTrack。"}
{"title": "蚂蚁金服招聘安全人才", "url": "https://www.freebuf.com/jobs/218612.html", "time": "2019-11-04", "level": "", "num_look": 115921, "num_comment": 13, "author": "GaoJianli", "tags": ["安全招聘"], "text": "蚂蚁金服是一家旨在为世界带来普惠金融服务的科技企业。蚂蚁金服起步于 2004 年成立的支付宝。2014 年 10 月，蚂蚁金服正式成立。"}
{"title": "导致一个自动化设备生产商全球的系统宕机一周的罪魁祸首", "url": "https://www.freebuf.com/articles/system/217852.html", "time": "2019-11-04", "level": "", "num_look": 96360, "num_comment": 1, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "从2019年10月13日起，由于受到了BitPaymer勒索病毒的攻击，该公司在全球范围内的所有服务器和PC工作站，包括通信设施，都受到了影响。"}
{"title": "FreeBuf早报｜脸书产品新漏洞，至少20国官员手机被黑客控制；受思科防火墙漏洞影响，美国电厂遭网络攻击；俄罗斯互联网新法生效", "url": "https://www.freebuf.com/news/218886.html", "time": "2019-11-04", "level": "红色标题", "num_look": 78507, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "近日，卡巴斯基曝光了一起利用Chrome漏洞(CVE-2019-13720)进行水坑攻击的活动，该攻击行动被命名为WizardOpium。"}
{"title": "浅谈安全攻防场景下的安全检测", "url": "https://www.freebuf.com/articles/es/217831.html", "time": "2019-11-04", "level": "现金奖励", "num_look": 183587, "num_comment": 5, "author": "si1ence", "tags": ["企业安全"], "text": "安全本质是人与人之间的对抗，攻防技术的更新迭代促进了行业的发展。"}
{"title": "Penta：一款开源的多合一自动化渗透测试命令行工具", "url": "https://www.freebuf.com/sectool/216062.html", "time": "2019-11-03", "level": "", "num_look": 187243, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Penta，即渗透测试Pentest与自动化实现Automation。Penta是一个开源项目，并且整合了多种功能，来帮助研究人员自动化实现渗透测试任务。"}
{"title": "分析多款D-Link路由器中未经授权的RCE漏洞", "url": "https://www.freebuf.com/vuls/216142.html", "time": "2019-11-03", "level": "", "num_look": 109712, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["漏洞"], "text": "在2019年的九月份，网络安全公司Fortinet旗下的FortiGuard Labs发现并报告了D-Link产品中一个未经认证的命令注入漏洞（FG-VD-19-117/CVE-2019-16920），而攻击者一旦成功利用该漏洞，那么他们将能够在目标设备上实…"}
{"title": "CVE-2019-14287（Linux sudo漏洞）分析", "url": "https://www.freebuf.com/vuls/217557.html", "time": "2019-11-03", "level": "", "num_look": 131426, "num_comment": 3, "author": "Knownsec知道创宇", "tags": ["漏洞"], "text": "近日 sudo 被爆光一个漏洞，非授权的特权用户可以绕过限制获得特权。官方的修复公告请见：https://www.sudo.ws/alerts/minus_1_uid.html。"}
{"title": "OpenRASP梳理总结", "url": "https://www.freebuf.com/articles/web/217421.html", "time": "2019-11-03", "level": "金币+8", "num_look": 125402, "num_comment": 3, "author": "贝斯柯德伯爵", "tags": ["WEB安全"], "text": "RASP英文为 Runtime application self-protection，即运行时应用程序自我保护。"}
{"title": "uniFuzzer：一款基于Unicorn和LibFuzzer的闭源模糊测试工具", "url": "https://www.freebuf.com/sectool/216771.html", "time": "2019-11-02", "level": "", "num_look": 115987, "num_comment": 115987, "author": "Alpha_h4ck", "tags": ["工具", "终端安全"], "text": "uniFuzzer是一款基于Unicorn和LibFuzzer的闭源模糊测试工具，该工具当前支持对ARM/MIPS架构的32位LSB ELF文件进行模糊测试，而这样的系统架构和平台一般常见于物联网设备上。"}
{"title": "APT35研究白皮书（二）", "url": "https://www.freebuf.com/articles/network/216557.html", "time": "2019-11-02", "level": "", "num_look": 113839, "num_comment": 3, "author": "Kriston", "tags": ["网络安全"], "text": "APT35又被成为‘Charming Kitten’，是归属于伊朗的黑客组织。"}
{"title": "受思科防火墙漏洞影响，美国电厂遭网络攻击", "url": "https://www.freebuf.com/news/218865.html", "time": "2019-11-02", "level": "", "num_look": 86086, "num_comment": 1, "author": "你要的白不是黑", "tags": ["资讯"], "text": "美国国家能源技术实验室的OE-417电力紧急情况和干扰报告（2019年第一季度）描述了一起网络事件导致的“电力系统运行中断”。"}
{"title": "使用Ghidra分析phpStudy后门", "url": "https://www.freebuf.com/sectool/217560.html", "time": "2019-11-02", "level": "", "num_look": 105501, "num_comment": 2, "author": "Knownsec知道创宇", "tags": ["工具"], "text": "虽然网上有很多厂商及组织发表了分析文章，但记载分析过程的不多，我只是想正儿八经用 Ghidra 从头到尾分析下。"}
{"title": "BUF大事件丨Adobe暴露了750万在线的Creative Cloud用户记录；全能车App被查：交一份钱骑多款车 单车企业称亏3亿；《中华人民共和国密码法》正式通过。", "url": "https://www.freebuf.com/news/218641.html", "time": "2019-11-02", "level": "红色标题", "num_look": 87318, "num_comment": 1, "author": "Darry端", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，Adobe暴露了750万在线的Creative Cloud用户记录；全能车App被查：交一份钱骑多款车 单车企业称亏3亿；《中华人民共和国密码法》正式通过。"}
{"title": "流量加密又怎样？ 多种姿势检测“冰蝎”", "url": "https://www.freebuf.com/articles/web/216133.html", "time": "2019-11-02", "level": "", "num_look": 910252, "num_comment": 15, "author": "山东星维九州安全技术有限公司", "tags": ["WEB安全"], "text": "冰蝎是当下最流行的WebShell客户端，它可以在HTTP明文协议中建立了加密隧道,以躲避安全设备的检测。"}
{"title": "中国工程院倪光南院士：网络安全与自主可控 | CIS 2019议题前瞻", "url": "https://www.freebuf.com/fevents/218608.html", "time": "2019-11-01", "level": "红色标题", "num_look": 52132, "num_comment": 3, "author": "FB独家", "tags": ["活动"], "text": "“关键核心技术是要不来、买不来、讨不来的。大国重器一定要掌握在自己手里。”11月27日，倪光南院士将出席CIS 2019网络安全创新大会，带来《网络安全与自主可控 》主题演讲。"}
{"title": "确认！印度核电站网络上发现朝鲜恶意软件", "url": "https://www.freebuf.com/news/218685.html", "time": "2019-11-01", "level": "", "num_look": 72096, "num_comment": 2, "author": "kirazhou", "tags": ["资讯"], "text": "KNPP事件看起来更像是意外感染，而不是一次精心计划的攻击行动。"}
{"title": "Fenrir：一款功能强大的BASH IoC扫描器", "url": "https://www.freebuf.com/sectool/216061.html", "time": "2019-11-01", "level": "", "num_look": 89452, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "很多安全研究人员都会面临这样一个问题，那就是如何在不安装代理或软件包的情况下，检查100多个不同的Linux系统是否匹配某些入侵威胁指标IoC。因此，Fenrir就应运而生了。"}
{"title": "共建数据安全 | CIS 2019「数据安全与数据治理专场」议题征集", "url": "https://www.freebuf.com/fevents/218809.html", "time": "2019-11-01", "level": "", "num_look": 47246, "num_comment": 47246, "author": "FB独家", "tags": ["活动"], "text": "数据安全治理是数据安全中的 “风暴之眼”，这里分享最新的数据安全技术、数据安全管理实践，总结归纳数据安全建设系统化建设思路。"}
{"title": "Apache Solr最新RCE漏洞分析", "url": "https://www.freebuf.com/vuls/218730.html", "time": "2019-11-01", "level": "红色标题", "num_look": 233411, "num_comment": 3, "author": "平安银行应用安全团队", "tags": ["WEB安全", "漏洞"], "text": "Apache Solr爆出RCE 0day漏洞（漏洞编号未给出），这里简单的复现了对象，对整个RCE的流程做了一下分析，供各位看官参考。"}
{"title": "知名Web域名注册商披露数据泄露事件", "url": "https://www.freebuf.com/news/218772.html", "time": "2019-11-01", "level": "", "num_look": 72075, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "又一次大规模的数据泄露事件发生。这一次的主角是一家知名的领头网络技术公司及其两家子公司，全球数百万客户从这里购买了网站的域名。"}
{"title": "Dlink路由器RCE漏洞复现", "url": "https://www.freebuf.com/articles/network/216209.html", "time": "2019-11-01", "level": "", "num_look": 111901, "num_comment": 111901, "author": "Kriston", "tags": ["网络安全"], "text": "近期研究人员发现Dlink路由器可以绕过认证进行远程代码执行，CVE编号：CVE-2019-16920。"}
{"title": "下载器又惹祸：独狼病毒再度寄生传播", "url": "https://www.freebuf.com/articles/system/218191.html", "time": "2019-11-01", "level": "", "num_look": 134678, "num_comment": 1, "author": "安全豹", "tags": ["系统安全"], "text": "本次传播被迅速捕获，目前还处于铺量阶段，但是通过其内部访问的统计页显示日感染量已接近1万。"}
{"title": "FreeBuf早报 | 格鲁吉亚遭遇大规模网络攻击；知名的Web域名注册商披露数据泄露；美国勒索Uber、LinkedIn的两名黑客认罪", "url": "https://www.freebuf.com/news/218693.html", "time": "2019-11-01", "level": "", "num_look": 67691, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "格鲁吉亚遭遇了大规模网络攻击，包括国家电视台在内的 2000 多个网站受到攻击，大部分网站的主页遭到纂改，替换了前总统 Mikheil Saakashvili 的肖像，以及“我将会回来”的文字。"}
{"title": "关于在大公司建立红队的说明", "url": "https://www.freebuf.com/articles/neopoints/217217.html", "time": "2019-11-01", "level": "", "num_look": 154053, "num_comment": 7, "author": "周大涛", "tags": ["观点"], "text": "本文是分享就如何建立和运营红队提供实用建议以及我的经验。实际上，我指的是一群人应该执行的日常活动，才能被视为有效的安全团队。"}
{"title": "探究if条件语句引发的两个Web漏洞", "url": "https://www.freebuf.com/vuls/217359.html", "time": "2019-11-01", "level": "现金奖励", "num_look": 129225, "num_comment": 3, "author": "Neroqi", "tags": ["WEB安全", "漏洞"], "text": "在编写代码时，常常需要为不同的判断执行不同的动作，if 条件判断语句可以用来实现此功能。然而这么一个再平常不过的条件判断语句，如果使用不当，也可能成为漏洞的产生点。"}
{"title": "中国科学院何积丰院士：可信人工智能的理论及应用 | CIS 2019议题前瞻", "url": "https://www.freebuf.com/fevents/218618.html", "time": "2019-10-31", "level": "红色标题", "num_look": 66567, "num_comment": 2, "author": "FB独家", "tags": ["活动"], "text": "2019年11月27日，在CIS 2019网络安全创新大会现场，有幸邀请到何积丰院士为大会带来主旨演讲《安全可信人工智能》，深入探讨可信人工智能理论及应用。"}
{"title": "PEpper：一款针对可执行程序的开源恶意软件静态分析工具", "url": "https://www.freebuf.com/sectool/214265.html", "time": "2019-10-31", "level": "", "num_look": 89601, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫PEpper的工具，这是一款开源的脚本工具，广大研究人员可以利用该工具来对可执行程序进行恶意软件静态分析。"}
{"title": "【FreeBuf字幕组】CTF难题挑战：pwnable.kr精选4题讲解", "url": "https://www.freebuf.com/video/217777.html", "time": "2019-10-31", "level": "红色标题", "num_look": 52554, "num_comment": 2, "author": "Darry端", "tags": ["视频"], "text": "CTF难题挑战主要聚焦于各种CTF比赛中的难题讲解.本期视频是围绕pwnable.kr网站上的4个小挑战展开讲解，分别是fd、 collisions、 bof和 flag。"}
{"title": "CVE-2019-1257：如何通过BDC反序列化在Microsoft SharePoint上执行任意代码", "url": "https://www.freebuf.com/vuls/216266.html", "time": "2019-10-31", "level": "", "num_look": 94524, "num_comment": 94524, "author": "Alpha_h4ck", "tags": ["漏洞"], "text": "目前，所有版本的SharePoint都会受到该漏洞的影响，微软方面也将该漏洞的可利用等级评估为最高等级，这也就意味着在不久的将来，会有很多网络犯罪分子利用该漏洞实施攻击。"}
{"title": "wav音乐里面竟然有病毒？这谁受得了啊！", "url": "https://www.freebuf.com/news/217215.html", "time": "2019-10-31", "level": "红色标题", "num_look": 225400, "num_comment": 11, "author": "0day情报局", "tags": ["资讯"], "text": "我原本认为，在听音乐这件事上，最不需要的就是提心吊胆了。"}
{"title": "我分析了2018-2020年青年安全圈450个活跃技术博客和博主", "url": "https://www.freebuf.com/geek/218569.html", "time": "2019-10-31", "level": "金币+20", "num_look": 192182, "num_comment": 7, "author": "404notfound", "tags": ["极客"], "text": "安全技术博客的优点是：博客内容较Twitter等更完整且详实，阅读与吸收知识门槛较低；博客可以一定程度上刻画博主。"}
{"title": "Kibana RCE漏洞详细分析", "url": "https://www.freebuf.com/vuls/217443.html", "time": "2019-10-31", "level": "现金奖励", "num_look": 141883, "num_comment": 3, "author": "NotFound", "tags": ["WEB安全", "漏洞"], "text": "Elasticsearch Kibana是荷兰Elasticsearch公司的一套开源的、基于浏览器的分析和搜索Elasticsearch仪表板工具。"}
{"title": "FreeBuf早报｜GSA报告：全球5G网络商用数量已达46个；Facebook起诉以色列NSO间谍软件公司入侵WhatsApp用户；网络平台泄露用户信息500条以上可入罪", "url": "https://www.freebuf.com/news/218502.html", "time": "2019-10-31", "level": "", "num_look": 59380, "num_comment": 2, "author": "kirazhou", "tags": ["资讯"], "text": "截至2019年10月，全球有321家运营商正在103个国家进行5G投资，其中46家已经推出商用服务。"}
{"title": "反间谍之旅：模拟订阅高级服务", "url": "https://www.freebuf.com/articles/terminal/215594.html", "time": "2019-10-31", "level": "", "num_look": 83510, "num_comment": 1, "author": "暗影安全实验室", "tags": ["终端安全"], "text": "这期我们分析的间谍软件较上期分析间谍软件RBMusic有较大不同，恶意程序并不是根据控制端发送的不同指令执行不同窃取用户隐私数据的操作，而是从服务端获取代码进行动态加载。"}
{"title": "先睹为快 | CIS 2019大会议程持续更新中，文末有福利", "url": "https://www.freebuf.com/fevents/218473.html", "time": "2019-10-30", "level": "", "num_look": 43398, "num_comment": 5, "author": "FB独家", "tags": ["活动"], "text": "更多议程持续更新中，可移步官网查看详细内容。"}
{"title": "聚焦实践与落地 | CIS 2019首席信息安全官闭门高峰论坛「议题征集」", "url": "https://www.freebuf.com/fevents/218444.html", "time": "2019-10-30", "level": "", "num_look": 28526, "num_comment": 28526, "author": "FB独家", "tags": ["活动"], "text": "「首席信息安全官闭门高峰论坛」将于2019年11月27日（周三）下午13:00-17:00，在上海宝华万豪酒店举行。诚邀各界CSO、企业信息安全负责人、信息安全专家报名参会！"}
{"title": "Mitaka：针对开源情报收集任务的浏览器扩展", "url": "https://www.freebuf.com/sectool/215921.html", "time": "2019-10-30", "level": "", "num_look": 225517, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["安全管理", "工具"], "text": "今天给大家介绍的是一款针对开源情报收集任务的浏览器扩展，这款扩展名叫Mitaka，希望该工具可以给广大研究人员的OSINT搜索研究提供帮助。"}
{"title": "高危！我国多个重要单位被境外APT黑客组织Bitter攻陷", "url": "https://www.freebuf.com/articles/network/218446.html", "time": "2019-10-30", "level": "红色标题", "num_look": 216232, "num_comment": 8, "author": "Threatbook", "tags": ["网络安全"], "text": "2019年10月29日，微步在线监测到有研究者在Twitter上披露了某木马的C2控制后台，其中包括部分目前正在被控的IP。"}
{"title": "恶意软件分析：分析一款针对Linux系统的新型Golang勒索软件", "url": "https://www.freebuf.com/articles/network/216235.html", "time": "2019-10-30", "level": "", "num_look": 89990, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "我们将对一款新发现的针对Linux系统的Golang勒索软件进行分析。"}
{"title": "某国产浏览器中间人漏洞Bettercap安全测试", "url": "https://www.freebuf.com/vuls/216058.html", "time": "2019-10-30", "level": "现金奖励", "num_look": 356608, "num_comment": 4, "author": "APU", "tags": ["无线安全", "漏洞"], "text": "国产浏览器往往基于Chrome浏览器开发，在带来新功能的情况下也带来了新的安全威胁。本文将披露某国产浏览器的中间人信息泄漏漏洞以及科普bettercap攻击脚本的编写方法。"}
{"title": "微软称Fancy Bear在东京奥运会之前将目标对准体育组织", "url": "https://www.freebuf.com/news/218307.html", "time": "2019-10-30", "level": "", "num_look": 62392, "num_comment": 2, "author": "kirazhou", "tags": ["资讯"], "text": "在2020年东京奥运会前夕，一群知名的俄罗斯政府黑客已经盯住了至少16个国家和国际体育及反兴奋剂组织。"}
{"title": "FreeBuf早报 ｜ 美国最早明年出台强制移除华为中兴设备法令；英特尔芯片安全问题将会存在很长时间；无法删除的恶意软件xHelper持续感染大量安卓设备", "url": "https://www.freebuf.com/news/218400.html", "time": "2019-10-30", "level": "", "num_look": 68185, "num_comment": 68185, "author": "shidongqi", "tags": ["资讯"], "text": "过去几个月来，一些安卓用户被一款名为 xHelper 的恶意软件持续困扰，它的自动重新安装机制令人们束手无策。xHelper最早发现于 3 月。到 8 月，它逐渐感染了 32,000 多台设备。"}
{"title": "Struts2基于OGNL的RCE漏洞全解析", "url": "https://www.freebuf.com/vuls/217482.html", "time": "2019-10-30", "level": "现金奖励", "num_look": 249379, "num_comment": 4, "author": "平安银行应用安全团队", "tags": ["WEB安全", "漏洞"], "text": "最近两年ST2-OGNL方面的漏洞已经渐渐淡出大家的视线，但我觉得作为曾经红极一时的经典系列RCE漏洞，对于ST2和OGNL有一个深入的认知对于代码审计和漏洞挖掘者是十分重要的。"}
{"title": "突发 | 某国网军执行APT攻击的后台架构曝光", "url": "https://www.freebuf.com/articles/system/218409.html", "time": "2019-10-30", "level": "", "num_look": 141961, "num_comment": 8, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "在日常的APT组织跟踪过程中发现，国外推特一用户曝光了一张截图，上面显示了疑似木马控制后台的主机信息界面。"}
{"title": "文件上传漏洞靶机Writeup", "url": "https://www.freebuf.com/articles/web/216119.html", "time": "2019-10-30", "level": "金币+20", "num_look": 145032, "num_comment": 1, "author": "cmdgaga", "tags": ["WEB安全"], "text": "最近小白一直在学习代码审计，对于我这个没有代码审计的菜鸟来说确实是一件无比艰难的事情。但是今天不是说代码审计的事情，而是文件上传的东东。"}
{"title": "由恶意GIF文件引发的RCE漏洞，超过40000个应用受影响", "url": "https://www.freebuf.com/news/218375.html", "time": "2019-10-29", "level": "红色标题", "num_look": 136415, "num_comment": 2, "author": "百里不守约", "tags": ["资讯"], "text": "本月初，新加坡安全研究员@Awakened披露了关于WhatsApp（2.19.244之前版本）存在的RCE漏洞（CVE-2019-11932）利用的文章，该漏洞由Android-gif-Drawable开源库中double-free错误触发。"}
{"title": "助力等保2.0 | CIS 2019「等保2.0专场研讨会」议题征集", "url": "https://www.freebuf.com/fevents/218046.html", "time": "2019-10-29", "level": "红色标题", "num_look": 44516, "num_comment": 44516, "author": "FB独家", "tags": ["活动"], "text": "与企业面对面分享与交流，以不同行业、不同企业特征为基础，助力企业等保落地、安全环境构建，推动我国网络安全保障体系建设。"}
{"title": "入侵威胁分析专家Manati使用攻略", "url": "https://www.freebuf.com/sectool/216060.html", "time": "2019-10-29", "level": "", "num_look": 108781, "num_comment": 108781, "author": "Alpha_h4ck", "tags": ["工具", "网络安全"], "text": "ManaTI是一款基于机器学习的入侵威胁分析工具，ManaTI项目的目标就是通过研发高精尖的机器学习技术来辅助研究人员对入侵威胁进行分析，并快速发现新的安全问题。"}
{"title": "视频直播类黑色产业链专项分析", "url": "https://www.freebuf.com/articles/terminal/216252.html", "time": "2019-10-29", "level": "红色标题", "num_look": 250986, "num_comment": 14, "author": "暗影安全实验室", "tags": ["终端安全"], "text": "2019年9月16日，网络安全宣传周在天津开幕，本次宣传周以\"网络安全为人民，网络安全靠人民\"为主题。当前，我国网络空间安全问题异常严峻，个人隐私保护，网络诈骗，网络钓鱼，网络漏洞，恶意代码等问题突出。"}
{"title": "APT35研究白皮书（一）", "url": "https://www.freebuf.com/articles/network/216388.html", "time": "2019-10-29", "level": "", "num_look": 118704, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "APT35又被成为“Charming Kitten”，是归属于伊朗的黑客组织。该组织自2014年活动以来，其目标为伊朗专家、人权活动人士和媒体人员。大多数受害者在中东、美国和英国。"}
{"title": "UniCredit称300万客户的个人数据遭到泄露", "url": "https://www.freebuf.com/news/218311.html", "time": "2019-10-29", "level": "", "num_look": 59587, "num_comment": 59587, "author": "Sandra1432", "tags": ["资讯"], "text": "意大利全球银行和金融服务巨头UniCredit宣布其网络安全团队发现一起“数据事件”，该事件导致其300万客户的个人数据遭到泄露。"}
{"title": "聚焦云端数据安全「京东云」| WitAwards 2019“年度优秀网络安全解决方案”参评巡礼", "url": "https://www.freebuf.com/fevents/217766.html", "time": "2019-10-29", "level": "", "num_look": 78226, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "近年来云计算市场规模持续增长，但数据泄漏事件频发不断，给国家和人民造成了巨大的经济损失。"}
{"title": "Phobos勒索软件变种分析报告", "url": "https://www.freebuf.com/articles/network/217129.html", "time": "2019-10-29", "level": "", "num_look": 97057, "num_comment": 2, "author": "antiylab", "tags": ["网络安全"], "text": "近日，安天CERT在梳理网络安全事件时发现Phobos勒索软件家族新变种，该勒索软件家族于2019年初被发现，并不断更新病毒变种。此变种最早于2019年9月末被发现，其传播方式主要为RDP暴力破解和钓鱼邮件。"}
{"title": "FreeBuf早报 | 美国会议员要求调查TikTok“对美国家安全威胁风险”；勒索软件、移动恶意程序攻击将在2020年激增；万能解锁App被查：交一份钱骑多款车，单车企业称亏3亿", "url": "https://www.freebuf.com/news/218221.html", "time": "2019-10-29", "level": "", "num_look": 71231, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "美国参议院民主党领袖Chuck Schumer和共和党参议员Tom Cotton宣布，已经致信给美国国家情报部门执行责任人Joseph Maguire，要求正式对TikTok进行国家安全风险评估。"}
{"title": "开源情报之美国关键基础设施全方位调研", "url": "https://www.freebuf.com/articles/ics-articles/217459.html", "time": "2019-10-29", "level": "金币+8", "num_look": 239224, "num_comment": 3, "author": "scu-igroup", "tags": ["工控安全"], "text": "本文主要介绍了如何将开源情报应用于关键基础设施的侦察，如发电厂、污水厂或化学和工业设施。这项研究一共侦查了美国大约26000个暴露在外的设备。"}
{"title": "金融安全生命线 | CIS 2019「金融科技安全专场」议题征集", "url": "https://www.freebuf.com/fevents/217987.html", "time": "2019-10-28", "level": "红色标题", "num_look": 50118, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "怎样把握科技创新与金融安全的平衡？金融机构在寻求转型过程中如何应对新的安全风险？"}
{"title": "DNS-Rebinding-Tool：一款针对DNS绑定攻击的自定义脚本", "url": "https://www.freebuf.com/articles/network/216438.html", "time": "2019-10-28", "level": "", "num_look": 107271, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "DNS-Rebinding-Tool是一款带有自定义脚本的DNS重绑定工具，该项目集成了多种功能，可以用来测试DNS重绑定攻击。"}
{"title": "基于开源蜜罐的实践与功能扩展", "url": "https://www.freebuf.com/sectool/217256.html", "time": "2019-10-28", "level": "现金奖励", "num_look": 937813, "num_comment": 18, "author": "糖果L5Q", "tags": ["工具"], "text": "具有一定规模的公司都会有自己的机房，当网络规模和硬件系统到达一定程度，就需要跟进各种安全预警防护手段，而蜜罐系统就是一种常见的防护手段之一。"}
{"title": "漏洞CVE-2019-8697：如何通过macOS的磁盘管理工具实现系统提权", "url": "https://www.freebuf.com/vuls/216211.html", "time": "2019-10-28", "level": "", "num_look": 104015, "num_comment": 104015, "author": "Alpha_h4ck", "tags": ["漏洞", "系统安全"], "text": "近期，ZDI的研究人员“ccpwd”在一个名叫“diskmanagementd”的macOS守护进程中，发现了一个基于堆的缓冲区溢出漏洞。"}
{"title": "贝壳找房招聘安全人才", "url": "https://www.freebuf.com/jobs/217441.html", "time": "2019-10-28", "level": "", "num_look": 114265, "num_comment": 5, "author": "myh0st", "tags": ["安全招聘"], "text": "贝壳找房创立于 2018 年初，定位于技术驱动的品质居住服务平台。贝壳找房致力于聚合和赋能全行业的优质服务者，打造开放合作的行业生态，为消费者提供包括二手房、新房、租赁和家装等全方位的居住服务。"}
{"title": "Adobe漏洞泄露了750万Creative Cloud用户数据", "url": "https://www.freebuf.com/news/218107.html", "time": "2019-10-28", "level": "", "num_look": 74918, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "美国计算机软件公司Adobe在本月初发现了严重的安全漏洞，该漏洞泄露了Creative Cloud服务用户信息记录的数据库。尽管所包含的详细信息不是很敏感，但可以针对数据泄露的用户精心设计一场网络钓鱼活动。"}
{"title": "哈鱼矿工攻击事件分析", "url": "https://www.freebuf.com/articles/terminal/217193.html", "time": "2019-10-28", "level": "现金奖励", "num_look": 160236, "num_comment": 3, "author": "Sampson", "tags": ["终端安全"], "text": "近期观测到，Linux下挖矿攻击事件，攻击者通过SSH爆破获得权限后，下载哈鱼矿工进行挖矿，对该样本进行深入分析。"}
{"title": "FreeBuf早报 | 南非约翰内斯堡再次遭到勒索软件攻击；《中华人民共和国密码法》正式通过；Adobe暴露了750万在线的Creative Cloud用户记录", "url": "https://www.freebuf.com/news/218077.html", "time": "2019-10-28", "level": "", "num_look": 88513, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "南非最大城市约翰内斯堡今年 7 月因勒索软件攻击而导致部分居民失去电力供应，现在它又一次成为勒索软件攻击的目标。"}
{"title": "Joomla-3.4.6远程代码执行漏洞原理分析和Poc构造", "url": "https://www.freebuf.com/vuls/216130.html", "time": "2019-10-28", "level": "现金奖励", "num_look": 452827, "num_comment": 8, "author": "木子", "tags": ["WEB安全", "漏洞"], "text": "上周，意大利安全公司 Hacktive Security的研究员 AlessandroGroppo 公开了影响 Joomla 内容管理系统老旧版本 3.0.0 至 3.4.6 （在2012年9月末至2015年12月中旬发布）的0day 详情。"}
{"title": "Tarnish：一款针对Chrome扩展的静态安全分析平台", "url": "https://www.freebuf.com/articles/web/216063.html", "time": "2019-10-27", "level": "", "num_look": 87046, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "Tarnish是一个Chrome扩展静态分析工具，可帮助研究人员对Chrome扩展的安全情况进行审计。"}
{"title": "2019第三季度APT分析报告", "url": "https://www.freebuf.com/articles/network/217990.html", "time": "2019-10-27", "level": "", "num_look": 119556, "num_comment": 3, "author": "Kriston", "tags": ["网络安全"], "text": "卡巴斯基一直在研究高级持久性威胁（APT）活动并发布研究报告，旨在帮助大家发现重大安全事件并进行防护，以下是在2019年第三季度观察到的apt活动(内容较长分为两个部分)。"}
{"title": "挖洞经验 | Jira服务工作台路径遍历导致的敏感信息泄露漏洞（CVE-2019-14994）", "url": "https://www.freebuf.com/vuls/216267.html", "time": "2019-10-27", "level": "", "num_look": 141964, "num_comment": 2, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "通过对JIRA Servcie Desk应用下普通用户和管理员账户的权限测试，发现可以普通用户身份访问获取到管理员账户关键路径下的一些敏感信息，这些信息会对协同团队项目造成严重安全影响，最终漏洞获得了厂商$11,000的奖…"}
{"title": "Java代码审计入门：WebGoat8（再会）", "url": "https://www.freebuf.com/vuls/216457.html", "time": "2019-10-27", "level": "", "num_look": 132018, "num_comment": 4, "author": "DSO观星市场部", "tags": ["WEB安全", "漏洞"], "text": "再会篇为Java代码审计入门:WebGoat8系列的第二篇，意为与WebGoat8再次相会。本篇我们将一起看看WebGoat8中的Authentication Bypasses和JWT相关安全问题。"}
{"title": "反间谍之旅：针对伊朗的网络之战", "url": "https://www.freebuf.com/articles/terminal/216699.html", "time": "2019-10-27", "level": "红色标题", "num_look": 133539, "num_comment": 3, "author": "暗影安全实验室", "tags": ["终端安全"], "text": "近期，暗影移动安全实验室在日常监测中，发现了一款中文名叫“费雷顿·莫希里”的间谍木马软件。"}
{"title": "「阿里云」WAF·AI驱动的智能防御体系 | WitAwards 2019“年度技术变革”参评巡礼", "url": "https://www.freebuf.com/fevents/216470.html", "time": "2019-10-26", "level": "", "num_look": 76281, "num_comment": 4, "author": "FB独家", "tags": ["活动"], "text": "本期WitAwards 2019“年度技术变革”参评巡礼想来看看阿里云WAF智能防御体系-AI内核是如何突破安全领域面临的通用问题的。"}
{"title": "B2R2：一套针对二进制代码分析的实用算法、函数以及工具集", "url": "https://www.freebuf.com/articles/system/216110.html", "time": "2019-10-26", "level": "", "num_look": 93108, "num_comment": 93108, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "B2R2是一套针对二进制代码分析的实用算法、函数以及工具集。"}
{"title": "虚假应用潜入TOP100：论恶意软件如何逃过检测", "url": "https://www.freebuf.com/articles/network/215689.html", "time": "2019-10-26", "level": "", "num_look": 79933, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "最近，我们发现了隐藏在应用商店合法产品中的恶意应用程序，这些应用诱骗不知情的用户下载赌博应用。"}
{"title": "“商贸信”类木马来袭：利用漏洞文档传播AgentTesla窃取用户凭证", "url": "https://www.freebuf.com/articles/system/216797.html", "time": "2019-10-26", "level": "", "num_look": 80219, "num_comment": 1, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "从用户登陆机制出现的那一刻起，凭证窃取类木马便源源不断的出现，就常见的Agentesla便是其中一种。"}
{"title": "BUF大事件丨漏洞盒子重磅发布《2019中国白帽子调查报告》；三星两款手机被曝高危漏洞，又一场电池门风暴？", "url": "https://www.freebuf.com/news/217922.html", "time": "2019-10-26", "level": "红色标题", "num_look": 72151, "num_comment": 1, "author": "Darry端", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，漏洞盒子重磅发布《2019中国白帽子调查报告》；极客的专属嘉年华——GeekPwn2019于上海成功举办；三星两款手机被曝高危漏洞。"}
{"title": "中小企业网络安全十大战术建议", "url": "https://www.freebuf.com/articles/es/216953.html", "time": "2019-10-26", "level": "现金奖励", "num_look": 111594, "num_comment": 3, "author": "安数君", "tags": ["企业安全"], "text": "你的业务可能很小，但对企业所有者是意义重大的。任何不重视你的服务或技术提供商，都不应该为你服务。"}
{"title": "「百度安全」MesaTEE通用安全计算 | WitAwards 2019“年度开源项目”参评巡礼", "url": "https://www.freebuf.com/fevents/216691.html", "time": "2019-10-25", "level": "", "num_look": 66532, "num_comment": 66532, "author": "FB独家", "tags": ["活动"], "text": "百度安全MesaTEE通过提供完整的“通用安全计算”软件栈（Universal Secure Computing, USC），帮助大数据和AI产业提供下一代数据隐私和安全解决方案。"}
{"title": "xHunt：针对科威特的网络攻击分析", "url": "https://www.freebuf.com/articles/network/215593.html", "time": "2019-10-25", "level": "", "num_look": 90773, "num_comment": 2, "author": "Kriston", "tags": ["网络安全"], "text": "在2019年5月至6月期间，发现有以前未知的工具被用于针对科威特的运输和航运组织。"}
{"title": "用漏洞和代码说话 | CIS 2019「白帽LIVE」议题征集", "url": "https://www.freebuf.com/fevents/217846.html", "time": "2019-10-25", "level": "红色标题", "num_look": 64954, "num_comment": 2, "author": "FB客服", "tags": ["活动"], "text": "CIS 2019大会独立分设「白帽LIVE」分论坛，与来自全球的安全从业者、优秀技术专家、白帽安全专家等共同展开演讲与探讨。"}
{"title": "渗透测试专家注册考试（CISP-PTS）三大考点揭密", "url": "https://www.freebuf.com/articles/others-articles/216942.html", "time": "2019-10-25", "level": "红色标题", "num_look": 205129, "num_comment": 11, "author": "奇安信安全服务", "tags": ["其他"], "text": "作为国内目前渗透测试方向最高级别的国家级注册考试，CISP-PTS一经推出便受到了整个信息安全产业的广泛关注。"}
{"title": "在苹果应用商店的17个应用程序中发现iOS Clicker Trojan恶意代码", "url": "https://www.freebuf.com/news/217985.html", "time": "2019-10-25", "level": "", "num_look": 71134, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "Wandera Threat Labs研究人员发现有十多个iOS应用程序感染了Clicker Trojan（点击木马）恶意代码并在苹果的应用商店传播。其使用和安卓广告欺诈活动相似的命令和控制服务器，暗自进行广告欺诈活动。"}
{"title": "利用原生库和JNI（Java原生接口）实现H2数据库漏洞利用", "url": "https://www.freebuf.com/articles/database/214838.html", "time": "2019-10-25", "level": "", "num_look": 118417, "num_comment": 118417, "author": "secist", "tags": ["数据安全"], "text": "在H2数据库引擎中获取代码执行权限的技术早已是众所周知，但有个要求就是H2能够动态编译Java代码。"}
{"title": "极光无限 高薪热招 | 无上限预算 待遇全部现金", "url": "https://www.freebuf.com/jobs/217907.html", "time": "2019-10-25", "level": "", "num_look": 152338, "num_comment": 16, "author": "极光无限SZ", "tags": ["安全招聘"], "text": "极光无限，依托最前沿的图神经网络理论，致力于打造国际一流的AI自动化漏洞挖掘及APT自动攻防产品；将重点组建全球顶级的红蓝对抗及漏洞挖掘研究团队，以辅助和完善AI自动化安全产品研发。"}
{"title": "漏洞盒子重磅发布《2019中国白帽子调查报告》", "url": "https://www.freebuf.com/articles/paper/217649.html", "time": "2019-10-25", "level": "红色标题", "num_look": 1267213, "num_comment": 23, "author": "漏洞盒子", "tags": ["安全报告"], "text": "“黑客”是大众给他们贴的标签，而“白帽子”才是他们真正的名字。这群网络世界的侠客，在现实生活中到底什么样？他们是跟谢耳朵一样的技术宅，还是如韩商言一般外冷内热的大帅哥？"}
{"title": "对lucker勒索病毒简单分析", "url": "https://www.freebuf.com/articles/network/217888.html", "time": "2019-10-25", "level": "", "num_look": 129918, "num_comment": 4, "author": "漏洞盒子", "tags": ["网络安全"], "text": "由于绝大多数勒索软件均无法通过技术手段解密，必须拿到对应的解密私钥才行，所以能不能解密的问题在于是否能获取到加密的密钥，但这个样本的独特之处在于，它的构造逻辑不复杂，使用了计算机的随机数生成。"}
{"title": "NDAY漏洞CVE-2017-11882新变异样本分析", "url": "https://www.freebuf.com/vuls/216526.html", "time": "2019-10-25", "level": "现金奖励", "num_look": 95722, "num_comment": 2, "author": "cgf99", "tags": ["漏洞", "网络安全"], "text": "近截获一个QUOTATION.doc文档，重新命名为virus.doc，其实际为RTF文档。"}
{"title": "FreeBuf早报｜得克萨斯州男子因入侵洛杉矶高等法院被判入狱145个月；被指控开发间谍工具监控员工活动，谷歌否认；感染了数百万计Android设备的广告软件背后是一个越南学生", "url": "https://www.freebuf.com/news/217924.html", "time": "2019-10-25", "level": "", "num_look": 67994, "num_comment": 1, "author": "kirazhou", "tags": ["资讯"], "text": "得克萨斯州一名男子入侵洛杉矶高等法院（LASC）计算机系统，并滥用该系统发送大约200万个网络钓鱼消息。"}
{"title": "记一次由追踪溯源发现的不安全解压GetShell", "url": "https://www.freebuf.com/articles/web/216937.html", "time": "2019-10-25", "level": "", "num_look": 127286, "num_comment": 1, "author": "安全狗海青实验室", "tags": ["WEB安全"], "text": "近日我们帮助某客户追踪溯源一例入侵事件时，发现黑客在获取服务器权限之前利用网站的「ZIP 解压功能」上传了 Webshell。由于此次的漏送利用方式在「攻击载荷的构造」与「实际解压路径」方面较有代表性，并且业界对…"}
{"title": "安全产品呈现“服务化”趋势 | 对话WIT 2019评委主席金湘宇（NUKE）", "url": "https://www.freebuf.com/articles/people/215970.html", "time": "2019-10-24", "level": "红色标题", "num_look": 181083, "num_comment": 1, "author": "Sandra1432", "tags": ["人物志", "活动"], "text": "本期专访邀请到Sec-UN网站创始人金湘宇，NUKE。说起“金将军”，又一次在WIT评委中看到了他的身影，他曾出任WIT 2017的评委专家。"}
{"title": "黄健翔变身伊万卡还顺便实现了隐身梦？GeekPwn 2019现场速报", "url": "https://www.freebuf.com/fevents/217796.html", "time": "2019-10-24", "level": "", "num_look": 82089, "num_comment": 4, "author": "Akane", "tags": ["活动"], "text": "前年破解iPhone、去年GAN掉马赛克，在这场一年一度的极客盛宴上，今年他们又要玩出什么花活？"}
{"title": "绿盟智能安全运营平台 | WitAwards2019“年度创新产品”参评巡礼", "url": "https://www.freebuf.com/fevents/216850.html", "time": "2019-10-24", "level": "", "num_look": 48233, "num_comment": 3, "author": "FB独家", "tags": ["活动"], "text": "在网络安全态势洞察下，绿盟科技选择全面推进智慧安全2.0战略，帮助企业整体运行升级，给传统网络安全公司提出了下一代的生存方式。"}
{"title": "无损检测Fastjson DoS漏洞以及盲区分Fastjson与Jackson组件", "url": "https://www.freebuf.com/news/231028.html", "time": "2019-10-24", "level": "", "num_look": 9003, "num_comment": 9003, "author": "斗象智能安全平台", "tags": ["资讯"], "text": ""}
{"title": "goDoH：一款使用了DNS-over-HTTPS作为传输端口的C2框架", "url": "https://www.freebuf.com/articles/network/214268.html", "time": "2019-10-24", "level": "", "num_look": 103159, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "今天给大家介绍的是一款名叫goDoH的工具，该工具基于DNS-over-HTTPS实现，是一款远程命令控制框架，并且可以将DNS-over-HTTPS作为传输端口来使用。"}
{"title": "Hack CIS｜10·24程序员节专属福利活动正式开启啦！", "url": "https://www.freebuf.com/fevents/217850.html", "time": "2019-10-24", "level": "红色标题", "num_look": 49564, "num_comment": 5, "author": "FB独家", "tags": ["活动"], "text": "10·24程序员节专属福利活动正式开启啦！"}
{"title": "黑客利用缓存中毒攻击将目标锁定CDN保护网站", "url": "https://www.freebuf.com/news/217870.html", "time": "2019-10-24", "level": "", "num_look": 95087, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "德国网络安全研究人员发现了一种新型Web缓存系统中毒攻击，攻击者可以利用这个使目标网站向大多数访问者传递错误页面或者不法内容。"}
{"title": "挖洞经验 | 利用竞争条件（Race Condition）对目标Web应用实现RCE", "url": "https://www.freebuf.com/vuls/215553.html", "time": "2019-10-24", "level": "", "num_look": 137145, "num_comment": 3, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "在本文中着重从竞争条件（Race Condition）的触发机制说起，和大家分享。"}
{"title": "安全界“天府”盛会，Insec World不是中国版black hat", "url": "https://www.freebuf.com/fevents/218333.html", "time": "2019-10-24", "level": "", "num_look": 50303, "num_comment": 50303, "author": "shidongqi", "tags": ["活动"], "text": "中国不需要又一个 Black Hat，这是我从成都回来之后的感受。"}
{"title": "从一个色情样本披露色情黑产产业链一角", "url": "https://www.freebuf.com/articles/system/216985.html", "time": "2019-10-24", "level": "", "num_look": 162430, "num_comment": 4, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "我们根据相关线索，进行溯源分析后，发现这起攻击事件背后实际上是一个趋于成熟的色情产业链。"}
{"title": "应急响应系列之无文件攻击分析", "url": "https://www.freebuf.com/articles/network/216918.html", "time": "2019-10-24", "level": "现金奖励", "num_look": 239541, "num_comment": 16, "author": "feiniao", "tags": ["网络安全"], "text": "前段时间遇到一起案例，主要是通过powershell进行挖矿的，使用该技术来进行挖矿的案例非常之多。"}
{"title": "记一次简单的黑页安全事件 | FreeBuf x 破壳学院训练营", "url": "https://www.freebuf.com/fevents/216997.html", "time": "2019-10-24", "level": "", "num_look": 78489, "num_comment": 4, "author": "FB客服", "tags": ["活动"], "text": "收到某单位通报通知，发现该单位的主页被挂载了恶意网页，影响恶劣。并于第一时间前往现场进行漏洞修复工作以及溯源查询。"}
{"title": "FreeBuf早报｜马斯克卫星项目为美国军机测试加密上网服务；FTC首次关闭销售“追踪者软件”的公司；专家认为：MG5可能与Carbanak APT相关", "url": "https://www.freebuf.com/news/217817.html", "time": "2019-10-24", "level": "", "num_look": 64811, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "美国空军正在使用SpaceX刚起步的卫星网络来测试许多军用飞机的加密互联网服务。"}
{"title": "Joomla3.4.6 RCE漏洞深度分析", "url": "https://www.freebuf.com/vuls/216512.html", "time": "2019-10-24", "level": "现金奖励", "num_look": 165505, "num_comment": 5, "author": "Qftmer", "tags": ["漏洞"], "text": "10月9号国内几家安全媒体公布了Joomla RCE的漏洞预警，并且网上已公布漏洞利用EXP，影响版本包括Joomla 3.0.0 - 3.4.6。"}
{"title": "攻防兼备 | CIS 2019「攻防演练研讨专场」议题征集", "url": "https://www.freebuf.com/fevents/217239.html", "time": "2019-10-23", "level": "", "num_look": 41179, "num_comment": 41179, "author": "FB独家", "tags": ["活动"], "text": "网络安全的本质在于持续对抗，这场以安全为赌注，白帽子和黑帽子的网络空间战注定没有硝烟，永不停止。"}
{"title": "史无前例：微软SQL Server被黑客组织安上了后门skip-2.0", "url": "https://www.freebuf.com/news/217738.html", "time": "2019-10-23", "level": "", "num_look": 131128, "num_comment": 10, "author": "奇安信代码卫士", "tags": ["资讯"], "text": "安全公司ESET发布报告，说明了微软SQL Server (MSSQL)被黑客组织Winnti Group安后门的研究结果。"}
{"title": "LetsMapYourNetwork：一款物理网络可视化工具", "url": "https://www.freebuf.com/sectool/215127.html", "time": "2019-10-23", "level": "", "num_look": 167493, "num_comment": 167493, "author": "secist", "tags": ["工具"], "text": "对于任何一个安全工程师来说，在确保网络安全之前首先了解他们的网络是至关重要的，但这并不是一项轻松的任务且耗时耗力。"}
{"title": "网络安全能力成熟度模型：D2-网络文化与社会（四）", "url": "https://www.freebuf.com/articles/paper/216554.html", "time": "2019-10-23", "level": "金币+10", "num_look": 106671, "num_comment": 1, "author": "宇宸de研究室", "tags": ["安全报告"], "text": "本章节为网络文化和社会维度的第四及第五部分，上报机制和媒体与社交网络。"}
{"title": "闭门议题前瞻 | ATT&CK矩阵企业攻防场景解读", "url": "https://www.freebuf.com/fevents/217722.html", "time": "2019-10-23", "level": "", "num_look": 42636, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "10月26日，来自斗象科技北京技术中心的总监孙维伯先生，将为我们带来《ATT&CK矩阵企业攻防场景解读》的议题分享"}
{"title": "美国联邦委员发布Retina-X应用禁令严厉打击“跟踪软件”", "url": "https://www.freebuf.com/news/217716.html", "time": "2019-10-23", "level": "", "num_look": 44998, "num_comment": 44998, "author": "Sandra1432", "tags": ["资讯"], "text": "美国联邦贸易委员会（FTC）禁止三个“跟踪软件”销售，除非开发人员可以证明其合法使用。该案是FTC首次打击“跟踪软件”的举措，这类软件安装在设备上可以跟踪设备所有者的位置、活动等。"}
{"title": "【FreeBuf字幕组】Web安全漏洞系列：2019 Google CTF-XXE", "url": "https://www.freebuf.com/video/216156.html", "time": "2019-10-23", "level": "红色标题", "num_look": 62611, "num_comment": 1, "author": "Darry端", "tags": ["视频"], "text": "本课程主要围绕2019 Google CTF中的BNV一题展开关于XXE的学习。XXE，全称就为XML外部实体注入漏洞。通过外部实体SYSTEM请求本地文件uri，通过某种方式返回本地文件内容就导致了XXE漏洞。"}
{"title": "针对USB外设的命令注入渗透", "url": "https://www.freebuf.com/articles/terminal/214431.html", "time": "2019-10-23", "level": "", "num_look": 115421, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "现在很多设备都允许用户使用USB设备，然后自动执行某些操作，但这种自动化特性对于USB设备未免太过于信任了。"}
{"title": "T3出行信息安全中心诚招网络安全人才", "url": "https://www.freebuf.com/jobs/217751.html", "time": "2019-10-23", "level": "", "num_look": 107761, "num_comment": 3, "author": "Sandra1432", "tags": ["安全招聘"], "text": "T3出行是南京领行科技股份有限公司打造的智慧出行生态平台。"}
{"title": "安全基线，让合规更直观", "url": "https://www.freebuf.com/articles/es/216758.html", "time": "2019-10-23", "level": "金币+10", "num_look": 133126, "num_comment": 2, "author": "cihack", "tags": ["企业安全"], "text": "随着企业国际化发展，信息安全合规管理将成为常态化，所有企事业单位网络安全建设都需要满足来自于国家或监管单位的“安全标准”。"}
{"title": "Spring Security OAuth 2.3 Open Redirection（CVE-2019–3778 ）分析复现篇", "url": "https://www.freebuf.com/vuls/216582.html", "time": "2019-10-23", "level": "金币+10", "num_look": 115306, "num_comment": 4, "author": "Bman", "tags": ["漏洞"], "text": "在cve上的spring相关漏洞列表里，一眼就看到了这个漏洞——Spring Security OAuth 2.3 Open Redirection(CVE-2019–3778)，既然如此凑巧，那博主就决定研究一下。"}
{"title": "FreeBuf早报｜世界各地银行关闭三星 S10/Note10指纹登录功能；DNC黑客APT29入侵欧盟多国外交机构；Maxthon中发现的恶意软件授予管理员权限的漏洞", "url": "https://www.freebuf.com/news/217684.html", "time": "2019-10-23", "level": "", "num_look": 64943, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "APT29近期恢复并重建了大部分工具，并正在使用加密通信方式，来规避安全公司检测。不完全分析，该组织已经入侵了三个欧洲国家的外交部以及一个欧盟成员国的美国使馆。"}
{"title": "安全趣闻 | 五分之一的IT安全专家担心他们的联网厕所被黑客攻击", "url": "https://www.freebuf.com/articles/others-articles/216995.html", "time": "2019-10-23", "level": "", "num_look": 58559, "num_comment": 3, "author": "kirazhou", "tags": ["其他"], "text": "试想一下，黑客在互联网连接的世界里如鱼得水。"}
{"title": "「腾讯安全」DDoS防护（大禹） | WitAwards2019“年度创新产品”参评巡礼", "url": "https://www.freebuf.com/fevents/216645.html", "time": "2019-10-22", "level": "", "num_look": 53138, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "互联网大潮的冲击之下，人工智能、云计算、大数据、物联网等新技术愈发成熟，社会及企业数字化转型进入关键阶段，网络空间安全面临的威胁也在不断变化升级。"}
{"title": "基于MITRE ATT&CK的Red Teaming行动实践", "url": "https://www.freebuf.com/articles/network/217584.html", "time": "2019-10-22", "level": "金币+10", "num_look": 120956, "num_comment": 3, "author": "安全小飞侠", "tags": ["网络安全"], "text": "如果要评选最近一年内国内信息安全圈最火的一个安全新名词，那一定是“MITRE ATT&CK”了。"}
{"title": "Firmware Slap：通过混合分析和功能聚类发现固件中的漏洞", "url": "https://www.freebuf.com/articles/terminal/214271.html", "time": "2019-10-22", "level": "", "num_look": 83838, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "Firmware Slap是一系列功能库的合集，而且可以直接将安全扫描信息导出为pickle或JSON格式数据，以便与其他工具进行整合。"}
{"title": "大厂的安全之道，Insec World CSO论坛精华回顾", "url": "https://www.freebuf.com/fevents/217646.html", "time": "2019-10-22", "level": "", "num_look": 82090, "num_comment": 2, "author": "kirazhou", "tags": ["活动"], "text": "在当天下午CSO论坛，几位业内CSO以及安全负责人亲自上阵，传授大厂的安全之道。更有意思的是，在圆桌论坛环节，谭晓生还试图引出那些不会出现在PPT上的秘密。"}
{"title": "ThinkCMF框架上的任意内容包含漏洞", "url": "https://www.freebuf.com/vuls/217586.html", "time": "2019-10-22", "level": "", "num_look": 266926, "num_comment": 2, "author": "斗象智能安全平台", "tags": ["漏洞"], "text": "ThinkCMF是一款基于PHP+MYSQL开发的中文内容管理框架，底层采用ThinkPHP3.2.3构建。"}
{"title": "企业安全无间道之抓内鬼", "url": "https://www.freebuf.com/articles/database/217055.html", "time": "2019-10-22", "level": "现金奖励", "num_look": 302014, "num_comment": 7, "author": "mcvoodoo", "tags": ["企业安全", "数据安全"], "text": "本文要和大家说的就是：怎么抓内部威胁。暂不涉及美人计，想了解美人计的私聊。"}
{"title": "再见密码：围绕使用身份和访问管理（IAM）解决方案讨论", "url": "https://www.freebuf.com/articles/neopoints/215685.html", "time": "2019-10-22", "level": "", "num_look": 86047, "num_comment": 86047, "author": "Alpha_h4ck", "tags": ["观点"], "text": "“密码”这个原本用来保护我们隐私的东西，现在俨然已经变成了我们的“累赘”。"}
{"title": "虚假“短信通道商”黑产活动", "url": "https://www.freebuf.com/articles/terminal/216644.html", "time": "2019-10-22", "level": "", "num_look": 126058, "num_comment": 3, "author": "奇安信威胁情报中心", "tags": ["终端安全"], "text": "黑客推广在推广行业是一种隐秘的存在，他们宣称能推广任意内容的短信，包括贷款、黑五类等内容。"}
{"title": "人脸、指纹、声音均可被模仿，生物识别真的安全吗？", "url": "https://www.freebuf.com/articles/network/217573.html", "time": "2019-10-22", "level": "", "num_look": 108569, "num_comment": 3, "author": "玄武实验室", "tags": ["网络安全"], "text": "随着产业互联网时代的来临，这些当时看来异想天开的高科技，在23年后的今天已经被广泛应用，藏在每个人的手机里。"}
{"title": "FreeBuf早报 | 谷歌将在未来几个月内修正Pixel 4闭眼依然能够人脸解锁的问题；51信用卡遭警方调查，委托外包催收公司冒充国家机关；微软通过漏洞赏金解决选举安全问题", "url": "https://www.freebuf.com/news/217512.html", "time": "2019-10-22", "level": "", "num_look": 77015, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "近日，有英国媒体和韩国本地媒体报道称，三星盖乐世S10和Note10两款手机搭载的超声波指纹识别存在安全漏洞。"}
{"title": "UAC绕过初探", "url": "https://www.freebuf.com/articles/system/216337.html", "time": "2019-10-22", "level": "金币+8", "num_look": 122357, "num_comment": 7, "author": "sssvvf", "tags": ["系统安全"], "text": "笔者最近在学习UAC 绕过的技术，通过对其他师傅的文章进行总结，成功利用DLL劫持绕过了UAC，并且可以以High Mandatory Level来启动进程。"}
{"title": "安全同行 | CIS 2019「车联网安全研讨高峰会」议题征集", "url": "https://www.freebuf.com/fevents/216629.html", "time": "2019-10-21", "level": "", "num_look": 45678, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "在这个车联网概念盛行的时代，汽车网络信息安全成为汽车安全的「新战场」。我们召集那些关注并推动车联网安全发展的人，听听他们的“鲜”见之明。"}
{"title": "Truegaze：一款针对Android、iOS应用源码的静态分析工具", "url": "https://www.freebuf.com/articles/terminal/214270.html", "time": "2019-10-21", "level": "", "num_look": 95190, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "Truegaze是一款专门针对Android和iOS应用程序的静态分析工具，该工具主要针对的是应用程序源代码之外的资源安全问题。"}
{"title": "网络战O2O进一步升级？伊朗阿巴丹炼油厂疑似遭受网络攻击导致火灾", "url": "https://www.freebuf.com/news/217448.html", "time": "2019-10-21", "level": "", "num_look": 75644, "num_comment": 4, "author": "奇安信威胁情报中心", "tags": ["资讯"], "text": "当地时间2019年10月20日下午，一则关于伊朗阿巴丹炼油厂（Abadan Refinary）发生火灾一事出现于国外媒体报道中，其中提到火势已经受到控制。"}
{"title": "企业邮件安全防护实践", "url": "https://www.freebuf.com/articles/es/216622.html", "time": "2019-10-21", "level": "现金奖励", "num_look": 318742, "num_comment": 9, "author": "haiczh", "tags": ["企业安全"], "text": "本文从作者从企业建设和个人日常邮件使用两个层面，既为企业邮件安全建设提出建议，也为个人日常邮件使用提供一些技巧，帮助企业减少邮件方面所面临的困扰。"}
{"title": "Flare-On逆向挑战赛（二）", "url": "https://www.freebuf.com/articles/others-articles/215428.html", "time": "2019-10-21", "level": "金币+8", "num_look": 53669, "num_comment": 2, "author": "Kriston", "tags": ["其他"], "text": "这也是Flare-On历史上的第一次比赛中出现NES ROM的题目。 该比赛是仅有的以Windows为中心的CTF竞赛之一。"}
{"title": "移动端漏洞频发，部分呈现军火化趋势", "url": "https://www.freebuf.com/articles/terminal/216538.html", "time": "2019-10-21", "level": "", "num_look": 103118, "num_comment": 4, "author": "奇安信威胁情报中心", "tags": ["终端安全"], "text": "2019年下半年以来，移动端各类高危漏洞频繁曝光，包括两个号称“核弹级”的SIM卡漏洞以及多个Android和iOS漏洞。"}
{"title": "FreeBuf早报 | 俄安全局长称美国最近向俄罗斯提供了涉恐情报；华为希望打消美安全担忧，欲邀美官员审查软件；Facebook或将面临350亿美元集体诉讼", "url": "https://www.freebuf.com/news/217393.html", "time": "2019-10-21", "level": "", "num_look": 79015, "num_comment": 2, "author": "kirazhou", "tags": ["资讯"], "text": "“最近，美国人向我们提供了情报，涉及在我国发动袭击的具体人员和计划。”"}
{"title": "IAST原理分析以及在SDL中的应用", "url": "https://www.freebuf.com/articles/web/216185.html", "time": "2019-10-21", "level": "金币+8", "num_look": 235870, "num_comment": 9, "author": "hackeryeah", "tags": ["WEB安全"], "text": "最近在实施SDL项目想改进下自动化扫描的方式提高扫描的准确性，鉴于已经有相对成型的IAST产品于是就想分析下IAST的原理。"}
{"title": "Fwanalyzer：文件系统镜像分析工具", "url": "https://www.freebuf.com/sectool/213739.html", "time": "2019-10-20", "level": "", "num_look": 112363, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "FwAnalyzer是一个使用一组可配置规则分析（ext2/3/4），FAT/VFat，SquashFS，UBIFS文件系统镜像和目录内容的工具。"}
{"title": "Flare-On逆向挑战赛（一）", "url": "https://www.freebuf.com/articles/others-articles/215422.html", "time": "2019-10-20", "level": "金币+8", "num_look": 72455, "num_comment": 4, "author": "Kriston", "tags": ["其他"], "text": "从2013年开始举办的Flare-On逆向挑战赛今年已经是第6届。今年的比赛共有12道题目，涉及Windows，.NET，Linux和Android上x86的各种架构。"}
{"title": "MYEC团伙新增敛财利器，无文件勒索已趋大势", "url": "https://www.freebuf.com/articles/system/216248.html", "time": "2019-10-20", "level": "", "num_look": 127084, "num_comment": 6, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "MYEC团伙新增了敛财利器，开始朝着基于无文件落地型的勒索软件方向发展，通过伪装成马来西亚税务局的诱饵Word文档执行宏代码。"}
{"title": "从宽字节注入认识PDO的原理和正确使用", "url": "https://www.freebuf.com/articles/web/216336.html", "time": "2019-10-20", "level": "金币+8", "num_look": 173124, "num_comment": 1, "author": "Anylike", "tags": ["WEB安全"], "text": "随着数据库参数化查询的方式越来越普遍，SQL注入漏洞较之于以前也大大减少，而PDO作为php中最典型的预编译查询方式，使用越来越广泛。"}
{"title": "Expandpass：用于解密你有点记不清的密码的工具", "url": "https://www.freebuf.com/sectool/215212.html", "time": "2019-10-19", "level": "", "num_look": 115854, "num_comment": 115854, "author": "secist", "tags": ["工具"], "text": "expandpass是一个简单的字符串扩展器，主要用于帮助你破解那些你有点记不清的密码。"}
{"title": "挖洞经验 | 利用两个僵尸账户实现对任意Instagram账户的远程崩溃", "url": "https://www.freebuf.com/vuls/214864.html", "time": "2019-10-19", "level": "", "num_look": 121377, "num_comment": 3, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文中，作者通过对Instagram的安全研究，结合Instagram在构造用户名时遵循的规律机制，发现了Instagram后端数据库中存在的两个僵尸账户。"}
{"title": "Sim卡及移动端核弹漏洞密集爆发：近期网络战顶级数字武器解析", "url": "https://www.freebuf.com/articles/terminal/216295.html", "time": "2019-10-19", "level": "", "num_look": 124713, "num_comment": 1, "author": "奇安信威胁情报中心", "tags": ["终端安全"], "text": "网络战争将携移动设备武器，针对随身携带设备对目标进行监听和攻击。"}
{"title": "BUF大事件丨中缅边界QQ微信被封：打击电信诈骗；丰巢下线人脸开锁取件功能；购买修改朋友圈定位服务存在安全隐患", "url": "https://www.freebuf.com/news/217172.html", "time": "2019-10-19", "level": "红色标题", "num_look": 106868, "num_comment": 1, "author": "Darry端", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，国家网信办举报中心：切勿购买修改朋友圈定位服务；小学生发现刷脸取件bug，丰巢紧急下线人脸开锁功能。"}
{"title": "关于容器、微服务、docker的十大问题", "url": "https://www.freebuf.com/articles/security-management/215567.html", "time": "2019-10-19", "level": "", "num_look": 502481, "num_comment": 1, "author": "青藤云安全", "tags": ["安全管理", "容器安全"], "text": "容器的运行无法简单参考虚拟机的实践经验。例如，几乎任何工作负载都可以立即虚拟化，但是有些工作负载适合容器化部署，有的则不适合。"}
{"title": "【单个漏洞奖励可达8W】漏洞马拉松即将起飞！全员福利项目即刻申请", "url": "https://www.freebuf.com/fevents/217307.html", "time": "2019-10-18", "level": "", "num_look": 96093, "num_comment": 96093, "author": "漏洞盒子", "tags": ["活动"], "text": "本届马拉松分为线上赛和线下赛。比赛采用积分制模式，根据挖掘出来漏洞高低等级累计积分排行。"}
{"title": "ScoutSuite：一款针对云集群环境的安全审计工具", "url": "https://www.freebuf.com/sectool/215134.html", "time": "2019-10-18", "level": "", "num_look": 113781, "num_comment": 113781, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Scout Suite是一款针对云集群环境的开源安全审计工具，主要针对的是云端环境的安全状况。"}
{"title": "挖洞经验 | 利用文件上传功能构造实现针对后端验证机制的RCE漏洞", "url": "https://www.freebuf.com/vuls/214626.html", "time": "2019-10-18", "level": "", "num_look": 147309, "num_comment": 12, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "一起来看看作者的测试分享和上报思路。"}
{"title": "你的Docker容器可能充满了Graboid加密蠕虫", "url": "https://www.freebuf.com/news/217163.html", "time": "2019-10-18", "level": "", "num_look": 99784, "num_comment": 9, "author": "Threatbook", "tags": ["容器安全", "资讯"], "text": "Docker成为了加密劫持蠕虫Graboid目标，该蠕虫是刚刚被发现并命名的。"}
{"title": "Privacy Program Management隐私项目管理", "url": "https://www.freebuf.com/articles/neopoints/215832.html", "time": "2019-10-18", "level": "金币+8", "num_look": 76093, "num_comment": 4, "author": "當春日漸暖", "tags": ["观点"], "text": "笔者参考IAPP《Privacy Program Management --Tools for Managing Privacy Within Your Organization》的主旨内容，将主要内容通过xmind图片的形式进行展现，供各位同仁参考查阅。"}
{"title": "新手段：身份识别揭露网络犯罪", "url": "https://www.freebuf.com/articles/network/216334.html", "time": "2019-10-18", "level": "", "num_look": 124792, "num_comment": 1, "author": "Sandra1432", "tags": ["网络安全", "观点"], "text": "随着世界逐步数字化，有组织犯罪也日益复杂，犯罪分子利用更先进的技术和更复杂的网络结构模型在全球范围内活动，严重影响了世界范围的公司企业和消费者。"}
{"title": "FreeBuf早报 | 德国网络安全机构认为Firefox是最安全的浏览器；卡巴斯基发布《2019 年三季度 APT 趋势报告》；5亿多UC浏览器Android用户再次面临MiTM攻击威胁", "url": "https://www.freebuf.com/news/217222.html", "time": "2019-10-18", "level": "", "num_look": 95479, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "研究人员发现，只要入侵 20 名最有影响力的包维护者帐号就可能危及半数 NPM 生态系统。"}
{"title": "小白代码审计开山篇", "url": "https://www.freebuf.com/articles/web/216186.html", "time": "2019-10-18", "level": "金币+15", "num_look": 184769, "num_comment": 9, "author": "cmdgaga", "tags": ["WEB安全"], "text": "最近小白一直在学习代码审计，对于我这个没有代码审计的菜鸟来说确实是一件无比艰难的事情。但是着恰恰应了一句老话：万事开头难。"}
{"title": "守护IoT&ICS | CIS 2019「物联网&工业互联网安全专场」议题征集", "url": "https://www.freebuf.com/fevents/216630.html", "time": "2019-10-17", "level": "红色标题", "num_look": 53954, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "万物互联时代，安全问题已经渗透到生活、工作、生产的方方面面。在这里，与行业专家、先驱企业论道物联网与工业互联网安全。"}
{"title": "域渗透中的ACL访问控制和组策略利用方法", "url": "https://www.freebuf.com/news/231037.html", "time": "2019-10-17", "level": "", "num_look": 10487, "num_comment": 10487, "author": "斗象智能安全平台", "tags": ["资讯"], "text": ""}
{"title": "让用户发言 | WitAwards 2019「甲方投票」进行时", "url": "https://www.freebuf.com/fevents/217167.html", "time": "2019-10-17", "level": "红色标题", "num_look": 61195, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "WitAwards 2019 「甲方投票」已经启动！"}
{"title": "CVE-2019-14287：sudo权限绕过漏洞分析与复现", "url": "https://www.freebuf.com/vuls/217089.html", "time": "2019-10-17", "level": "", "num_look": 228162, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["漏洞", "系统安全"], "text": "有的用户可能知道，如果将sudo配置为允许用户通过Runas规范中定义的ALL关键字来以任意用户身份运行命令的话，那么攻击者将有可能通过制定用户ID -1或4294967295来以root权限执行恶意命令。"}
{"title": "使用Docker和WSL体验信息安全工具", "url": "https://www.freebuf.com/sectool/214893.html", "time": "2019-10-17", "level": "", "num_look": 132797, "num_comment": 5, "author": "secist", "tags": ["容器安全", "工具"], "text": "多年以来，每当我在一些会议、用户组和客户演示会上发言时，我都会谈到一些关于帮助我们学习信息安全工具和技术的“新方法”。"}
{"title": "全套黑客工具横行内网，新型勒索病毒DEADMIN LOCKER盯上国内企业", "url": "https://www.freebuf.com/news/217057.html", "time": "2019-10-17", "level": "", "num_look": 568317, "num_comment": 11, "author": "深信服千里目安全实验室", "tags": ["网络安全", "资讯"], "text": "近日，深信服安全团队捕获到针对国内企业的新型勒索病毒攻击事件，攻击者通过爆破获得跳板机权限后，利用全套黑客工具包对内网主机进行渗透，人工投放勒索病毒进行加密。"}
{"title": "Linux恶意软件SkidMap分析", "url": "https://www.freebuf.com/articles/network/214638.html", "time": "2019-10-17", "level": "", "num_look": 95699, "num_comment": 3, "author": "Kriston", "tags": ["网络安全"], "text": "挖掘加密货币恶意软件仍然是一个普遍的威胁。网络罪犯也越来越多地探索新的平台和方法来进一步利用挖矿恶意软件——从移动设备、Unix和类Unix系统到服务器和云环境。"}
{"title": "闭门议题前瞻 | 红蓝对抗，甲方的矛与盾", "url": "https://www.freebuf.com/fevents/217118.html", "time": "2019-10-17", "level": "", "num_look": 50253, "num_comment": 2, "author": "FB独家", "tags": ["活动"], "text": "10月26日，来自世界500强企业中国区信息安全和风险负责人赵锐先生，将为我们带来《红蓝对抗，甲方的矛与盾》的议题分享"}
{"title": "来自TransparentTribe APT组织的窃密", "url": "https://www.freebuf.com/articles/network/215818.html", "time": "2019-10-17", "level": "", "num_look": 94082, "num_comment": 3, "author": "深信服千里目安全实验室", "tags": ["网络安全"], "text": "近期，深信服安全团队通过对海外第三方数据样本的监控，捕获到疑似TransparentTribe APT组织变种样本（当前在国内尚未发现该病毒活动迹象）。"}
{"title": "FreeBuf早报 | CyberCX挖走了澳大利亚的两名网络重量级人物；美国陆军与通用合作提升汽车网络安全；小学生发现刷脸取件bug，丰巢紧急下线人脸开锁功能", "url": "https://www.freebuf.com/news/217083.html", "time": "2019-10-17", "level": "", "num_look": 99312, "num_comment": 4, "author": "kirazhou", "tags": ["资讯"], "text": "美国陆军战斗能力发展司令部地面车辆系统中心（GVSC）与通用汽车宣布了一项新型合作研发协议（CRADA），在未来两年内，双方将合作提升汽车网络安全方面的专业能力。"}
{"title": "菜鸡的渗透学习之路：DVWA暴力破解", "url": "https://www.freebuf.com/articles/others-articles/214882.html", "time": "2019-10-17", "level": "金币+15", "num_look": 138705, "num_comment": 13, "author": "Mario丶ml", "tags": ["其他"], "text": "暴力破解是指使用穷举法，举出所有的可能的结果，然后逐一验证是否正确！"}
{"title": "phpStudy远程RCE漏洞复现以及沦陷主机入侵溯源分析", "url": "https://www.freebuf.com/articles/web/215823.html", "time": "2019-10-17", "level": "现金奖励", "num_look": 273147, "num_comment": 11, "author": "艾登——皮尔斯", "tags": ["WEB安全"], "text": "北京时间9月20日“杭州公安”官微发布了“杭州警方通报打击涉网违法犯罪暨'净网2019'专项行动战果”推文，该“后门”无法被杀毒软件扫描删除，并且藏匿于软件某功能性代码中，极难被发现具有免杀性质。"}
{"title": "Botb：容器分析和漏洞利用工具", "url": "https://www.freebuf.com/sectool/214914.html", "time": "2019-10-16", "level": "", "num_look": 247854, "num_comment": 2, "author": "secist", "tags": ["容器安全", "工具"], "text": "BOtB（Break out the Box）是一款容器分析和漏洞利用工具，其主要是为渗透测试人员和工程师所设计的。"}
{"title": "【FreeBuf字幕组】CTF难题挑战：EFF-CTF 2016-Level 0-4(Enigma会议)", "url": "https://www.freebuf.com/video/213681.html", "time": "2019-10-16", "level": "红色标题", "num_look": 62140, "num_comment": 3, "author": "Darry端", "tags": ["视频"], "text": "CTF难题挑战主要聚焦于各种CTF比赛中的难题讲解。本期视频主要围绕2016年Electronic Frontier Foundation在Enigma举办的CTF比赛中Level 0-4的题目展开讲解。"}
{"title": "挖洞经验 | 看我如何获取到200万份Verizon用户的月付账单信息", "url": "https://www.freebuf.com/vuls/215172.html", "time": "2019-10-16", "level": "", "num_look": 260633, "num_comment": 2, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文讲述了作者通过一个简单的安全漏洞，最终可以访问获取到Verizon无线公司将近200万份的用户月支付账单，账单中包含了用户姓名、家庭地址、手机号码、移动设备型号序列号以及用户签名等敏感信息。"}
{"title": "蓝屏死机又回来了，赛门铁克修复IPS错误代码", "url": "https://www.freebuf.com/news/216970.html", "time": "2019-10-16", "level": "", "num_look": 190391, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "当Windows用户在运行赛门铁克Endpoint Protection Client软件时，出现蓝屏死机的状况，从Windows 7到Windows 10的用户都受到影响。随后，赛门铁克及时修复了这一问题。"}
{"title": "Win32Angryel病毒分析报告", "url": "https://www.freebuf.com/articles/network/215285.html", "time": "2019-10-16", "level": "", "num_look": 221867, "num_comment": 8, "author": "江民安全实验室", "tags": ["网络安全"], "text": "这是一个感染型的病毒，该病毒会感染计算机上的exe文件，并且会注入系统进程，并且尝试访问指定网址。"}
{"title": "新型Masked勒索病毒袭击工控行业", "url": "https://www.freebuf.com/articles/system/216777.html", "time": "2019-10-16", "level": "金币+10", "num_look": 244713, "num_comment": 3, "author": "熊猫正正", "tags": ["系统安全"], "text": "勒索软件仍然是网络安全最大的威胁，成为作案范围最广、造成经济损失最严重的网络犯罪形式。"}
{"title": "震网事件的九年再复盘与思考", "url": "https://www.freebuf.com/vuls/215817.html", "time": "2019-10-16", "level": "", "num_look": 324290, "num_comment": 3, "author": "antiylab", "tags": ["漏洞", "网络安全"], "text": "2010年7月，“震网”蠕虫攻击事件浮出水面，引发了国际主流安全厂商和安全研究者的全面关注，多家安全厂商以及多国的应急组织和研究机构，都投入到了全面的分析接力中。"}
{"title": "FreeBuf早报 | 默克尔干预，德国或绿灯允华为参5G；苹果回应网址发给腾讯质疑；Imperva解释黑客如何窃取AWS API密钥并访问客户数据", "url": "https://www.freebuf.com/news/216925.html", "time": "2019-10-16", "level": "", "num_look": 208490, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "近日，有媒体报道“10元可改微信朋友圈定位”，对此，国家网信办举报中心提醒广大网民，切勿购买修改朋友圈定位服务，同时，不要轻易把账号密码泄露给他人。"}
{"title": "Jenkins脏牛漏洞FRP内网提权", "url": "https://www.freebuf.com/articles/web/215183.html", "time": "2019-10-16", "level": "现金奖励", "num_look": 279988, "num_comment": 17, "author": "砂川诚", "tags": ["WEB安全"], "text": "Jenkins是一款由Java编写的开源的持续集成工具。"}
{"title": "融合还是对抗 | CIS 2019「人工智能安全高峰会」等你共论", "url": "https://www.freebuf.com/fevents/215987.html", "time": "2019-10-15", "level": "红色标题", "num_look": 179968, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "这是一份来自百度兜哥和赛博研究院惠志斌博士共同发出的邀请函"}
{"title": "闭门议题前瞻 | NTA在蓝军中的用途与实战分享", "url": "https://www.freebuf.com/fevents/216854.html", "time": "2019-10-15", "level": "", "num_look": 158991, "num_comment": 158991, "author": "FB独家", "tags": ["活动"], "text": "10月26日，在「红蓝军演练与全流量威胁分析研讨会」上，斗象科技技术副总裁徐钟豪将带来《NTA在蓝军中的用途与实战分享》的议题分享。"}
{"title": "29个国家使用的SIM卡容易受到Simjacker攻击", "url": "https://www.freebuf.com/news/216783.html", "time": "2019-10-15", "level": "红色标题", "num_look": 186522, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "Adaptive Mobile的研究人员（SimJacker的发现者）对外公布了一份地区名单，这份名单中所有国家的移动运营商所使用的SIM卡均会受到SimJacker攻击的影响。"}
{"title": "一分钟了解漏洞盒子「闪测」服务", "url": "https://www.freebuf.com/fevents/215738.html", "time": "2019-10-15", "level": "", "num_look": 240678, "num_comment": 1, "author": "漏洞盒子", "tags": ["活动"], "text": "漏洞盒子闪测服务是针对企业用户推出的轻量、便捷的测试服务。企业用户即时申请，授权后即可免费体验「闪测」服务，快速检测企业业务系统漏洞，帮助企业节约大量时间与人力成本。"}
{"title": "Linux Sudo被曝漏洞，可导致用户以root权限运行命令", "url": "https://www.freebuf.com/news/216821.html", "time": "2019-10-15", "level": "红色标题", "num_look": 315507, "num_comment": 13, "author": "奇安信代码卫士", "tags": ["资讯"], "text": "几乎所有基于 UNIX 和 Linux 的操作系统上安装的核心命令，也是最重要、最强大也最常用的工具 Sudo中被曝存在一个漏洞。"}
{"title": "Aswan轻量级风控静态规则引擎 | WitAwards2019“年度开源项目”参评巡礼", "url": "https://www.freebuf.com/fevents/216516.html", "time": "2019-10-15", "level": "红色标题", "num_look": 198145, "num_comment": 3, "author": "FB独家", "tags": ["活动"], "text": "在高速发展的互联网环境中，企业业务开展面临的不仅是激烈的行业竞争，还有日益猖獗的互联网黑色产业带来的风险挑战……"}
{"title": "六小时处置挖矿蠕虫的内网大规模感染事件", "url": "https://www.freebuf.com/vuls/215434.html", "time": "2019-10-15", "level": "红色标题", "num_look": 159807, "num_comment": 7, "author": "antiylab", "tags": ["漏洞", "网络安全"], "text": "2019年5月，安天接到某重要单位的求助，其内网中执行任务的上百台主机频繁出现死机、重启、蓝屏等现象，用户原部署使用的某款杀毒软件能查出病毒告警，但显示成功清除后，病毒很快会重新出现。"}
{"title": "生存还是毁灭？一文读懂挖矿木马的战略战术", "url": "https://www.freebuf.com/articles/system/216666.html", "time": "2019-10-15", "level": "", "num_look": 122421, "num_comment": 8, "author": "阿里云安全", "tags": ["系统安全"], "text": "比特币等虚拟货币在2019年迎来了久违的大幅上涨，从最低3000美元上涨至7月份的14000美元，涨幅达300%，巨大的金钱诱惑使得更多的黑产团伙加入了恶意挖矿的行列。"}
{"title": "如何审计一个智能合约", "url": "https://www.freebuf.com/articles/blockchain-articles/215847.html", "time": "2019-10-15", "level": "金币+8", "num_look": 202231, "num_comment": 1, "author": "TimYeung", "tags": ["区块链安全"], "text": "在这篇文章中我们将透彻的展示多种针对能合约应用的攻击和为确保智能合约安全性所必须要进行的审计过程，保持最新的开发方式以及讨论从各种可靠的源中得到的灵感。"}
{"title": "FreeBuf早报 | 英国安全公司Sophos接受38亿美元收购要约；Safari浏览器欺诈网站警告功能引发用户隐私担忧；《未成年人保护法》将增加网络保护内容", "url": "https://www.freebuf.com/news/216775.html", "time": "2019-10-15", "level": "", "num_look": 66680, "num_comment": 4, "author": "Sandra1432", "tags": ["资讯"], "text": "英国网络安全公司Sophos同意以为38亿美元（31亿英镑）的价格被美国私募股权集团Thoma Bravo以全现金方式收。"}
{"title": "奇博CMS全局密钥可枚举漏洞分析", "url": "https://www.freebuf.com/vuls/214042.html", "time": "2019-10-15", "level": "金币+8", "num_look": 108015, "num_comment": 2, "author": "小飞要做白帽子", "tags": ["WEB安全", "漏洞"], "text": "由于PHP函数mt_rand()具有伪随机数漏洞，其原理为在种子已知的情况下，则可推测其产生的随机数。"}
{"title": "使用Frida绕过Android App的SSL Pinning", "url": "https://www.freebuf.com/articles/terminal/214540.html", "time": "2019-10-15", "level": "", "num_look": 191596, "num_comment": 3, "author": "secist", "tags": ["终端安全"], "text": "本文我将详细为大家解释如何使用frida框架，绕过Android应用程序的SSL pinning。"}
{"title": "WitAwards 2019中国网络安全创新年度评选「评委主席团」首次曝光", "url": "https://www.freebuf.com/fevents/216711.html", "time": "2019-10-14", "level": "红色标题", "num_look": 44660, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "为期三个月的WitAwards 2019中国网络安全创新年度评选已全面启动。自今年起，WIT专家评委团升级为评委主席制。"}
{"title": "VyAPI：基于云的易受攻击Hybrid Android App", "url": "https://www.freebuf.com/sectool/214939.html", "time": "2019-10-14", "level": "", "num_look": 84707, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "VyAPI是一个基于云的易受攻击的Hybrid App（混合模式移动应用）。之所以称其为VyAPI，是因为它的缺陷无处不在。它不仅通过IPC调用进行通信，它还会通过API调用进行通信。"}
{"title": "挖洞经验 | Telegram消息撤回功能存在BUG可导致用户隐私泄露(€2,500)", "url": "https://www.freebuf.com/vuls/214665.html", "time": "2019-10-14", "level": "", "num_look": 194141, "num_comment": 7, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "Telegram具备强大的聊天记录删除（撤回）功能，可撤回一对一或一对多（群组）聊天中在任意时间发送或分享的任意消息。"}
{"title": "TeamViewer可以安全使用，官方发布澄清说明", "url": "https://www.freebuf.com/news/216674.html", "time": "2019-10-14", "level": "红色标题", "num_look": 227200, "num_comment": 7, "author": "Allen别bb", "tags": ["资讯"], "text": "迟迟不到的官方声明也让很多人产生了各种猜测。在本周末，TeamViewer终于再官方社区发布了该事件的说明。"}
{"title": "美国中央情报局网络武器库分析与披露", "url": "https://www.freebuf.com/articles/system/215746.html", "time": "2019-10-14", "level": "", "num_look": 180245, "num_comment": 2, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "2017年3月7日，维基解密首次在其网站对外曝光了美国中央情报局（CIA）相关资料，并且代号为Vault7[参考链接: 5]，并且从当月直至9月7日每周都会对外披露其中一个项目的相关资料内容[4]。"}
{"title": "FreeBuf早报 | 大麻信息平台Leafly遭受数据泄露；土耳其南部地区屏蔽Twitter、Facebook等社交和消息平台；部分用户升级macOS Catalina 10.15.0致Apple Mail数据丢失", "url": "https://www.freebuf.com/news/216615.html", "time": "2019-10-14", "level": "", "num_look": 69497, "num_comment": 4, "author": "kirazhou", "tags": ["资讯"], "text": "土耳其主要 ISP TTNet 屏蔽了 Twitter、Facebook、WhatsApp 和 Instagram，此举被认为旨在防止军事行动泄密。"}
{"title": "一款可自定义多用途PLC设备的可用性分析", "url": "https://www.freebuf.com/articles/ics-articles/213018.html", "time": "2019-10-14", "level": "现金奖励", "num_look": 258943, "num_comment": 10, "author": "yy0308", "tags": ["工控安全"], "text": "OpenPLC是一个基于易于使用软件的开源可编程逻辑控制器。"}
{"title": "DSMM之数据存储安全", "url": "https://www.freebuf.com/articles/database/215914.html", "time": "2019-10-14", "level": "现金奖励", "num_look": 241807, "num_comment": 10, "author": "LJ_Monica", "tags": ["数据安全"], "text": "前段时间整理了DSMM的一系列内容，已经介绍和分享了三个部分，分别为DSMM开篇的总结与交流、数据采集安全、数据传输安全。"}
{"title": "2019跟踪软件情况报告", "url": "https://www.freebuf.com/articles/paper/216059.html", "time": "2019-10-13", "level": "", "num_look": 67459, "num_comment": 2, "author": "Kriston", "tags": ["安全报告"], "text": "六个月前，在用户手机上研究人员发现商业间谍软件（跟踪软件）。本报告深入调查了2019年前8个月跟踪软件的使用情况以及受此软件影响的用户数量。"}
{"title": "ArmourBird CSF：一款针对容器实例服务的安全框架", "url": "https://www.freebuf.com/sectool/215106.html", "time": "2019-10-13", "level": "", "num_look": 89803, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "ArmourBird CSF是一款针对容器实例服务的安全框架，ArmourBird CSF基于模块化实现，并且具有高度可扩展的特性，支持API自定义开发。"}
{"title": "Glupteba恶意软件变种分析", "url": "https://www.freebuf.com/articles/network/214260.html", "time": "2019-10-13", "level": "", "num_look": 88122, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "最近发现了恶意软件glupteba的网络攻击行为。它是一个旧的恶意软件，曾在名为“windigo”的行动中出现过，并通过漏洞传播给windows用户。"}
{"title": "全球TOP恶意软件分析：HawkEye最新变种", "url": "https://www.freebuf.com/articles/system/216436.html", "time": "2019-10-13", "level": "金币+10", "num_look": 132412, "num_comment": 1, "author": "熊猫正正", "tags": ["系统安全"], "text": "Hawkeye Keylogger是一款窃取信息的恶意软件，在地下黑客市场出售，此恶意软件曾在2016年的一次大规模网络攻击活动中被广泛使用。"}
{"title": "史上最全Windows安全工具锦集", "url": "https://www.freebuf.com/sectool/215644.html", "time": "2019-10-13", "level": "红色标题", "num_look": 438907, "num_comment": 26, "author": "深信服千里目安全实验室", "tags": ["工具"], "text": "近日，深信服安全团队整理了一些常见的PE工具、调试反汇编工具、应急工具、流量分析工具和WebShell查杀工具，希望可以帮助到一些安全行业的初学者。"}
{"title": "ZZCMS v8.2 代码审计", "url": "https://www.freebuf.com/vuls/215484.html", "time": "2019-10-13", "level": "现金奖励", "num_look": 165836, "num_comment": 6, "author": "Kn0sky", "tags": ["WEB安全", "漏洞"], "text": "这次在代码审计前，我了解到要学会追踪数据的流向，这有助于更好的理解漏洞形成的原理。"}
{"title": "以技服人 | CIS 2019「X-Tech技术派对」议题征集", "url": "https://www.freebuf.com/fevents/216468.html", "time": "2019-10-12", "level": "红色标题", "num_look": 59535, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "这是一场真正属于极客的分享会，这里将让你看到了不起的安全研究者和那些“黑科技”技术成果，传奇黑客、技术大拿与新生代们碰撞、传承，以及分享他们的方法论。"}
{"title": "Pfsense：免费开源的应用层防火墙", "url": "https://www.freebuf.com/sectool/214820.html", "time": "2019-10-12", "level": "金币+10", "num_look": 215366, "num_comment": 16, "author": "寂静尘埃", "tags": ["工具"], "text": "纵深防护体系的第一道就是下一代防火墙，关于下一代防火墙的简单配置介绍……"}
{"title": "TeamViewer据称“被入侵”事件的研判及结论", "url": "https://www.freebuf.com/articles/system/216444.html", "time": "2019-10-12", "level": "红色标题", "num_look": 522951, "num_comment": 13, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "2019年10月11日，火眼举办的FireEyeSummit大会上，几张演讲的PPT拍照被公开到网上，其中一张提及到一款非常流行的远程控制软件TeamViewer曾经疑似被黑客组织入侵。"}
{"title": "挖洞经验 | 看我如何通过Uber API接口劫持任意Uber注册账户", "url": "https://www.freebuf.com/vuls/214425.html", "time": "2019-10-12", "level": "", "num_look": 134131, "num_comment": 5, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文涉及的漏洞为Uber的任意账户劫持漏洞，漏洞影响Uber的司机、打车乘客(Rider)、第三方合作伙伴以及餐饮外送(Eats)注册账户。"}
{"title": "Javascript原型链攻击与防御", "url": "https://www.freebuf.com/articles/web/216373.html", "time": "2019-10-12", "level": "", "num_look": 113272, "num_comment": 2, "author": "平安银行应用安全团队", "tags": ["WEB安全"], "text": "与其他的语言不同的是，Js在Es6之前是没有class的，他更多的是一个原型语言，在Js里有一句话很有名——“一切皆对象”。"}
{"title": "Magecart第五小组开始使用KPOT开展窃密活动", "url": "https://www.freebuf.com/vuls/215541.html", "time": "2019-10-12", "level": "", "num_look": 95321, "num_comment": 1, "author": "antiylab", "tags": ["漏洞", "网络安全"], "text": "2019年8月，安天CERT监测到了多起利用KPOT木马进行窃密的事件。"}
{"title": "应急通告 | 利用PRS产品排查内网TeamViewer受影响资产", "url": "https://www.freebuf.com/news/216572.html", "time": "2019-10-12", "level": "", "num_look": 54162, "num_comment": 3, "author": "斗象智能安全平台", "tags": ["资讯"], "text": "近日，有消息指出目前知名远程办公工具 TeamViewer 已经被境外黑客组织攻破所有防护体，并取得有相关数据权限，危险等级非常高，提醒企业组织做好防护措施。"}
{"title": "FreeBuf早报 | 29个易受Simjacker攻击的国家；苹果更新Windows版iTunes修补了勒索软件攻击漏洞；谷歌开始提供数据配合德州反垄断调查", "url": "https://www.freebuf.com/news/216440.html", "time": "2019-10-12", "level": "", "num_look": 62483, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": "根据未来的欧盟规则，欧洲一些运营商与全球大型供应商之间的5G设备协议可能不得不被撕毁，它不会支持任何严重依赖单一供应商的5G网络。"}
{"title": "BUF大事件丨WhatsApp被曝漏洞：一张GIF动图黑客便可接管账户；最新《中老年人反欺诈白皮书》发布：70后网民成受骗重灾区", "url": "https://www.freebuf.com/news/216260.html", "time": "2019-10-12", "level": "红色标题", "num_look": 96924, "num_comment": 3, "author": "Darry端", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，WhatsApp被曝漏洞：一张GIF动图黑客便可接管账户；Android 0day 漏洞影响 Google、小米和华为等品牌手机。"}
{"title": "Windows服务器主机加固分享", "url": "https://www.freebuf.com/articles/system/215787.html", "time": "2019-10-12", "level": "现金奖励", "num_look": 195837, "num_comment": 12, "author": "jaie86", "tags": ["系统安全"], "text": "谈谈Windows服务器主机加固9大技巧。"}
{"title": "【闭门议题前瞻】全视角捕获APT网络攻击行为：AI模型应用之道", "url": "https://www.freebuf.com/fevents/216296.html", "time": "2019-10-11", "level": "", "num_look": 52399, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "0月26日，由斗象科技主办的「红蓝军演练与全流量威胁分析研讨会」即将在上海拉开帷幕，我们诚挚的邀请广大甲方企业安全人员一起分享红蓝军演练实战案例经验、全流量威胁分析解决之道。"}
{"title": "邮箱账号反查电话号码可行性研究", "url": "https://www.freebuf.com/articles/others-articles/215097.html", "time": "2019-10-11", "level": "现金奖励", "num_look": 304453, "num_comment": 26, "author": "scu-igroup", "tags": ["其他"], "text": "前段时间国外的开源信息工作者分享了一篇技术贴，通过邮箱反查手机号，我们也在知识星球（开源网络空间情报）上第一时间分享了这个技术。"}
{"title": "调查研究显示：大多数美国人对网络安全问题不够了解", "url": "https://www.freebuf.com/news/216368.html", "time": "2019-10-11", "level": "", "num_look": 54152, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "当提及双重认证和隐私网页浏览时，大多数美国人并不知道从2FA中获取HTTPS来提高个人账户保护。"}
{"title": "如何在Windows和Linux上搜索可利用的二进制文件或exe文件", "url": "https://www.freebuf.com/sectool/214286.html", "time": "2019-10-11", "level": "", "num_look": 125711, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["工具", "终端安全"], "text": "Gtfo这款工具采用Python3开发，在Gtfo的帮助下，广大研究人员可以直接在命令行终端窗口中搜索GTFOBins和LOLBAS代码文件。"}
{"title": "Vulhub漏洞系列：ActiveMQ任意文件写入漏洞分析", "url": "https://www.freebuf.com/vuls/213760.html", "time": "2019-10-11", "level": "金币+8", "num_look": 126804, "num_comment": 6, "author": "xssle", "tags": ["漏洞"], "text": "Apache ActiveMQ是Apache软件基金会所研发的开放源代码消息中间件。"}
{"title": "斗象科技秋季招聘", "url": "https://www.freebuf.com/jobs/215929.html", "time": "2019-10-11", "level": "", "num_look": 79051, "num_comment": 3, "author": "FB客服", "tags": ["安全招聘"], "text": "斗象科技成立至今，凭借在信息安全与企业安全市场的专业性见解和强大技术实力，建立了长远的战略目标、和良好的客户口碑。"}
{"title": "俄罗斯APT攻击组织Gamaredon最新攻击样本", "url": "https://www.freebuf.com/articles/system/215126.html", "time": "2019-10-11", "level": "", "num_look": 123437, "num_comment": 3, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "最近国外安全研究人员，又发布了一个Gamaredon组织的攻击样本，利用恶意程序对乌克兰进行攻击，伪装成行政诉讼。"}
{"title": "垃圾邮件传播新型FTCode无文件勒索病毒", "url": "https://www.freebuf.com/articles/system/215888.html", "time": "2019-10-11", "level": "金币+8", "num_look": 90842, "num_comment": 5, "author": "熊猫正正", "tags": ["系统安全"], "text": "近期国外安全研究人员发现了一款基于PowerShell脚本的勒索病毒FTCode，此勒索病毒主要通过垃圾邮件进行传播。"}
{"title": "FreeBuf早报 | 国际刑警组织报告：勒索软件仍是网络安全最大威胁；Mac终端利器iTerm2被曝严重的RCE漏洞，至少已存在7年；文旅部拟出手 OTA大数据杀熟能否戴上“紧箍咒”", "url": "https://www.freebuf.com/news/216320.html", "time": "2019-10-11", "level": "", "num_look": 66682, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "近日，文旅部发布通知就《在线旅游经营服务管理暂行规定（征求意见稿）》（简称《征求意见稿》）公开征求意见，其中拟明令禁止大数据“杀熟”行为。"}
{"title": "基于mitmproxy的被动扫描代理", "url": "https://www.freebuf.com/articles/web/216301.html", "time": "2019-10-10", "level": "", "num_look": 308701, "num_comment": 1, "author": "斗象智能安全平台", "tags": ["WEB安全"], "text": "mitmproxy是Python编写的一款功能完善的代理工具，mitmproxy是一款支持拦截HTTP和HTTPS请求和响应并即时修改它们的交互式中间人代理工具。"}
{"title": "Mac终端利器iTerm2被曝严重的RCE漏洞，至少已存在7年", "url": "https://www.freebuf.com/news/216278.html", "time": "2019-10-10", "level": "红色标题", "num_look": 120872, "num_comment": 1, "author": "奇安信代码卫士", "tags": ["资讯"], "text": "iTerm 2 中存在一个严重的远程代码执行 (RCE) 漏洞，且至少已存在7年。"}
{"title": "Btlejack：操作低功耗蓝牙设备的百宝工具箱", "url": "https://www.freebuf.com/sectool/214427.html", "time": "2019-10-10", "level": "", "num_look": 109149, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "Btlejack可以为你提供嗅探、干扰和劫持低功耗蓝牙设备所需的一切。它依赖于一个或多个BBC Micro:Bit。运行专用固件的设备。你可能还想使用Adafruit的Bluefruit LE嗅探器或nRF51822评估套件，我们增加了对这些设备的…"}
{"title": "专访瑞数信息吴剑刚：River Security，用变化应对未知", "url": "https://www.freebuf.com/articles/people/215986.html", "time": "2019-10-10", "level": "", "num_look": 211045, "num_comment": 6, "author": "kirazhou", "tags": ["人物志"], "text": "“冷兵器时代”的盾，如何挡得住炮火全开的自动化枪械？应对未知，就是要不断求变……"}
{"title": "CNNVD关于微软多个安全漏洞的通报", "url": "https://www.freebuf.com/news/216213.html", "time": "2019-10-10", "level": "", "num_look": 76426, "num_comment": 2, "author": "CNNVD", "tags": ["资讯"], "text": "近日，微软官方发布了多个安全漏洞的公告，包括Windows远程桌面客户端远程代码执行漏洞（CNNVD-201910-454、CVE-2019-1333）等多个漏洞。"}
{"title": "从入门到入土？网安创业2000亿产值在这里", "url": "https://www.freebuf.com/articles/neopoints/216048.html", "time": "2019-10-10", "level": "红色标题", "num_look": 551909, "num_comment": 13, "author": "Knownsec知道创宇", "tags": ["观点"], "text": "工信部《促进网络安全产业征求意见稿》一出来，未来5年推动网安行业2000亿产值，振奋人心，不少朋友问我，机会在哪里？都摩拳擦掌要进入这个行业，这里来帮大家分析下未来的格局，顺势而为牛都能吹来飞起来。"}
{"title": "在AWS中建立网络分割案例", "url": "https://www.freebuf.com/articles/network/214292.html", "time": "2019-10-10", "level": "", "num_look": 73171, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "网络分割最简单的示例是使用防火墙分离应用程序和基础结构组件。这个概念现在是构建数据中心和应用程序架构中提出的。但如果没有合适的网络分割模型，几乎不可能找到企业案例。"}
{"title": "新华三安全产品线诚招网络安全人才", "url": "https://www.freebuf.com/jobs/215991.html", "time": "2019-10-10", "level": "", "num_look": 75556, "num_comment": 75556, "author": "H3CSecurity", "tags": ["安全招聘"], "text": "新华三集团（简称新华三）是业界领先的数字化解决方案领导者，致力于成为帮助客户业务创新、数字化转型最可信赖的合作伙伴。"}
{"title": "马丁·赫尔曼：那个带给我们“安全感“的男人", "url": "https://www.freebuf.com/articles/people/216090.html", "time": "2019-10-10", "level": "", "num_look": 233811, "num_comment": 3, "author": "shidongqi", "tags": ["人物志"], "text": "不知道大家有没有这样的体会，每次打开网页，看到这个小绿锁，就感觉心里会踏实一点。"}
{"title": "新网络冷战时代：俄罗斯入侵美国FBI通信系统传闻解析", "url": "https://www.freebuf.com/news/215149.html", "time": "2019-10-10", "level": "", "num_look": 87687, "num_comment": 11, "author": "奇安信威胁情报中心", "tags": ["资讯"], "text": "日渐严峻的国家对抗，诸如霸权主义的制裁以及被制裁方的反制，在现如今网络技术决定国家命脉的年代，网络战争将会是军事打击的最为有力的武器，同时也是制裁和反制的利器。"}
{"title": "FreeBuf早报 | Twitter“无意”将出于安全目的收集来的客户数据，用于了广告目的；德国程序员遭比特币勒索软件攻击后，向黑客发起了报复；NSA 的逆向工程框架Ghidra中曝出代码执行漏洞", "url": "https://www.freebuf.com/news/216176.html", "time": "2019-10-10", "level": "", "num_look": 73570, "num_comment": 1, "author": "kirazhou", "tags": ["资讯"], "text": "Twitter承认“出于疏忽”，使用了一些客户的电子邮件地址和电话号码，而这些信息原本是出于账号安全目的而收集的。"}
{"title": "APT28恶意软件Zebrocy新组件分析", "url": "https://www.freebuf.com/articles/network/215358.html", "time": "2019-10-10", "level": "", "num_look": 87829, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "虽然处于暑期，但sednit组织一直在为zebrocy恶意软件开发新的组件。sednit组织从2004年开始运营，近年来频频登上各大新闻头条。"}
{"title": "浅谈ATT&CK：让“攻击手法”拥有通用语言", "url": "https://www.freebuf.com/articles/others-articles/216137.html", "time": "2019-10-09", "level": "红色标题", "num_look": 177260, "num_comment": 4, "author": "kirazhou", "tags": ["其他"], "text": "那么，ATT&CK是什么？"}
{"title": "DrSemu：基于动态行为的恶意软件检测与分类工具", "url": "https://www.freebuf.com/sectool/214277.html", "time": "2019-10-09", "level": "", "num_look": 109401, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Dr.Semu能够在一个隔离环境中运行目标可执行程序，并监控相关进程的各种行为。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列：Alex Chapman", "url": "https://www.freebuf.com/video/215984.html", "time": "2019-10-09", "level": "红色标题", "num_look": 94248, "num_comment": 3, "author": "willhuang", "tags": ["视频"], "text": "Alex Chapman（@ajxchapman）是一名有着快13年经验的资深安全专家，主要技术方向为逆向分析、漏洞研究和红队安全测试。经历了Deloitte LLP、Context、Yahoo和HackerOne等多家安全公司"}
{"title": "泛微OA E-cology远程代码执行漏洞原理分析", "url": "https://www.freebuf.com/vuls/215218.html", "time": "2019-10-09", "level": "现金奖励", "num_look": 1356140, "num_comment": 8, "author": "木子", "tags": ["WEB安全", "漏洞"], "text": "最近曝光了很多漏洞，后续将对这些有代表性的漏洞进行分析审分析，今天有空先审计分析泛微 OA RCE漏洞。"}
{"title": "渗透测试第二阶段：信息收集方法原理经验心得", "url": "https://www.freebuf.com/articles/web/215182.html", "time": "2019-10-09", "level": "现金奖励", "num_look": 377141, "num_comment": 23, "author": "ZhouDaxian", "tags": ["WEB安全"], "text": "信息收集是渗透测试中第二阶段的工作，也是非常重要的一项。所收集到的情报信息，能直接影响下一阶段的工作及效果。"}
{"title": "使用Burp拦截Flutter App与其后端的通信", "url": "https://www.freebuf.com/articles/terminal/213346.html", "time": "2019-10-09", "level": "", "num_look": 153007, "num_comment": 153007, "author": "secist", "tags": ["终端安全"], "text": "Flutter是谷歌的移动UI框架，可以快速在iOS和Android上构建高质量的原生用户界面。"}
{"title": "闭门会议 | 「红蓝军演练与全流量威胁分析研讨会」报名开启", "url": "https://www.freebuf.com/fevents/216032.html", "time": "2019-10-09", "level": "", "num_look": 92519, "num_comment": 1, "author": "斗象科技官方", "tags": ["活动"], "text": "借助红蓝对抗演习与全流量威胁分析等手段，企业从传统安全的重防御，逐步转变为建设“预测、防御、检测、分析”的安全能力。"}
{"title": "流量e魔病毒分析报告", "url": "https://www.freebuf.com/articles/terminal/215168.html", "time": "2019-10-09", "level": "", "num_look": 494785, "num_comment": 1, "author": "腾讯手机管家", "tags": ["终端安全"], "text": "近期，腾讯安全实验室捕获一款在用户设备上有异常流量访问应用，此木马在用户设备上存在私自获取设备信息，用户行为隐私数据。"}
{"title": "FreeBuf早报 | 俄罗斯黑客修改Chrome和Firefox浏览器安装程序以追踪用户；哈里王子告两家报刊侵犯隐私；美国部分医院遭受Ryuk勒索软件攻击", "url": "https://www.freebuf.com/news/216044.html", "time": "2019-10-09", "level": "", "num_look": 63639, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": "来自俄罗斯一个特别臭名昭著的团体将计就计，他们在用户安装Web浏览器同时，即时修改这些Web浏览器，为加密流量添加所谓“指纹”功能，以实时跟踪用户和其使用的电脑。"}
{"title": "对S-CMS的一次全面审计", "url": "https://www.freebuf.com/vuls/214998.html", "time": "2019-10-09", "level": "", "num_look": 763071, "num_comment": 3, "author": "安全狗海青实验室", "tags": ["极客", "漏洞"], "text": "近来，海青的某小哥对S-CMS这套较为小型的CMS进行了代码审计，接着从中发现了多个SQL注入、2个XXE以及1个Getshell，后来，小哥在一个月黑风高的夜晚将它们整理成这篇推文。"}
{"title": "【公告】关于WitAwards2019评选个别参评项目刷票行为的处理通知", "url": "https://www.freebuf.com/fevents/215988.html", "time": "2019-10-08", "level": "", "num_look": 50215, "num_comment": 4, "author": "FB独家", "tags": ["活动"], "text": "敬请各参评项目严格遵守评选活动规则，公平竞争，也请大家继续关注本届评选活动并进行监督。"}
{"title": "Cotopaxi：使用指定IoT网络协议对IoT设备进行安全测试", "url": "https://www.freebuf.com/sectool/213347.html", "time": "2019-10-08", "level": "", "num_look": 112127, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "cotopaxi，是用于IoT设备安全测试的工具集。"}
{"title": "挖洞经验 | 综合利用SlickQuiz两个0-Day漏洞接管Uber的WordPress网站", "url": "https://www.freebuf.com/vuls/214933.html", "time": "2019-10-08", "level": "", "num_look": 153121, "num_comment": 4, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文讲述作者在参加HackerOne的H1-4420比赛中，针对厂商Uber的某WordPress博客网站为目标，发现其内置问卷调查插件SlickQuiz两个漏洞。"}
{"title": "DNS隧道流量分析", "url": "https://www.freebuf.com/articles/network/214923.html", "time": "2019-10-08", "level": "现金奖励", "num_look": 258935, "num_comment": 4, "author": "johylodog", "tags": ["安全管理", "网络安全"], "text": "DNS协议又称域名系统是互联网的基础设施，只要上网就会用到,因而DNS协议是提供网络服务的重要协议，在黑客进入内网后会使用DNS,ICMP,HTTP等协议隧道隐藏通信流量。"}
{"title": "揭密某款在暗网上售卖的勒索病毒", "url": "https://www.freebuf.com/articles/system/214670.html", "time": "2019-10-08", "level": "金币+10", "num_look": 219545, "num_comment": 8, "author": "熊猫正正", "tags": ["系统安全"], "text": "暗网和地下黑客论坛一直是恶意软件推广和销售的地方，一些恶意软件的开发者会利用暗网来发布和销售自己的恶意软件。"}
{"title": "FreeBuf早报 | 加州隐私法明年生效，硅谷公司面临550亿美元合规成本；Android 0day漏洞影响 Google、小米和华为等品牌手机；俄罗斯联邦储蓄银行调查信用卡数据泄露", "url": "https://www.freebuf.com/news/215906.html", "time": "2019-10-08", "level": "", "num_look": 65083, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "俄罗斯最大的储蓄银行（Sberbank）正在调查一起疑似信用卡数据泄露事件，称雇员的“犯罪行为”可能是泄露的主要原因。"}
{"title": "网络安全能力成熟度模型：D2-网络文化与社会（三）", "url": "https://www.freebuf.com/articles/paper/215313.html", "time": "2019-10-08", "level": "金币+10", "num_look": 98597, "num_comment": 98597, "author": "宇宸de研究室", "tags": ["安全报告"], "text": "从本维度开始，从国家层面来探讨网络文化和社会的安全能力建设，并从战略和政策的高度来逐步执行。"}
{"title": "你没看错！SQLMap v1.3.10正式发布！", "url": "https://www.freebuf.com/sectool/215897.html", "time": "2019-10-07", "level": "", "num_look": 239126, "num_comment": 9, "author": "Alpha_h4ck", "tags": ["工具"], "text": "SQLMap又更新啦，此次更新的版本是v1.3.10，我们一起来看一看这一次更新又增加了哪些新的特性吧！"}
{"title": "ehtools：一款WiFi渗透框架", "url": "https://www.freebuf.com/sectool/214258.html", "time": "2019-10-07", "level": "", "num_look": 173034, "num_comment": 173034, "author": "secist", "tags": ["工具"], "text": "如今，Wi-Fi工具变得越来越易于使用，且新手也可以轻松驾驭。Ehtools Framework就是这样一款功能强大且简单易用的无线渗透测试框架。Ehtools可以在短短的几秒钟内完成，从新扩展的安装到WPA握手包的抓取任务。"}
{"title": "macOS用户威胁总结", "url": "https://www.freebuf.com/articles/network/214432.html", "time": "2019-10-07", "level": "", "num_look": 94443, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "人们一直认为MacOS操作系统没有威胁（或者至少没有严重威胁）。然而，造成这种情况的主要原因是潜在受害者的数量不同。"}
{"title": "GlobeImposter2.0再出新变种，疑似利用PsExec内网传播", "url": "https://www.freebuf.com/articles/system/214849.html", "time": "2019-10-07", "level": "", "num_look": 129458, "num_comment": 129458, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近日，深信服安全团队发现了GlobeImposter2.0勒索病毒新变种，该变种疑似利用微软官网工具PsExec进行内网传播并使用了新的勒索界面。"}
{"title": "Hack the box靶机实战：Bastion", "url": "https://www.freebuf.com/articles/web/213911.html", "time": "2019-10-07", "level": "金币+10", "num_look": 160917, "num_comment": 6, "author": "dongne", "tags": ["WEB安全"], "text": "Bastion 其实并不是一个特别简单的机器。如果使用 windows 可以更方便地解决这台靶机。"}
{"title": "Yar：用于侦察Github上存储库用户和组织的工具", "url": "https://www.freebuf.com/sectool/214149.html", "time": "2019-10-06", "level": "", "num_look": 90229, "num_comment": 90229, "author": "secist", "tags": ["工具"], "text": "yar是一款OSINT工具，主要用于侦察Github上的存储库、用户和组织。Yar会克隆给定的用户/组织的存储库，并按照提交时间顺序遍历整个提交历史，搜索密钥、令牌及密码等。"}
{"title": "如何PWN掉西门子工控设备", "url": "https://www.freebuf.com/articles/network/213897.html", "time": "2019-10-06", "level": "", "num_look": 114104, "num_comment": 2, "author": "Kriston", "tags": ["网络安全"], "text": "在对船舶控制系统进行测试时，我们注意到控制系统对西门子Scalance工业以太网交换机的严重依赖，因此为对其进行了深入研究。"}
{"title": "信息安全从业者考试认证大全", "url": "https://www.freebuf.com/articles/security-management/213938.html", "time": "2019-10-06", "level": "金币+15", "num_look": 380148, "num_comment": 13, "author": "522952110", "tags": ["安全管理"], "text": "证书是IT从业者知识水平能力的一个体现，考证同时也是拓展自身知识的一个方法。近年来，安全行业风生水起，各种认证层出不穷，眼花缭乱。"}
{"title": "基于网络启动和系统服务劫持的渗透技术研究", "url": "https://www.freebuf.com/articles/network/214837.html", "time": "2019-10-06", "level": "现金奖励", "num_look": 111365, "num_comment": 2, "author": "gaearrow", "tags": ["网络安全"], "text": "笔者受光盘启动WinPE系统修复主机原系统启发，设计并开展了以网络启动传输定制操作系统，实施自动化文件替换，劫持关键系统服务的渗透技术方案研究，实现了在内网环境下预置攻击程序的自主启动。"}
{"title": "反间谍之旅：首款安卓远控木马工具分析", "url": "https://www.freebuf.com/articles/terminal/214201.html", "time": "2019-10-06", "level": "红色标题", "num_look": 262407, "num_comment": 5, "author": "暗影安全实验室", "tags": ["终端安全"], "text": "近日研究员在Google Play上发现了首款基于AhMyth（安卓远控木马工具）的间谍软件。这款恶意软件名为RB Music，是一款为Balouchi音乐爱好者提供流媒体广播的应用程序。"}
{"title": "安卓被曝已遭利用的新0day，影响多数安卓设备", "url": "https://www.freebuf.com/vuls/215866.html", "time": "2019-10-05", "level": "", "num_look": 152736, "num_comment": 1, "author": "奇安信代码卫士", "tags": ["漏洞"], "text": "谷歌发现一个未修复的安卓0day已遭利用。该0day存在于安卓操作系统的内核代码中，可被攻击者用于获取设备的根权限。"}
{"title": "Sudomy：子域名枚举与分析工具", "url": "https://www.freebuf.com/sectool/214299.html", "time": "2019-10-05", "level": "", "num_look": 148658, "num_comment": 148658, "author": "secist", "tags": ["工具"], "text": "Sudomy是一个使用bash脚本创建的子域枚举工具，用于快速全面地分析域和收集子域。"}
{"title": "利用基于AngularJS的XSS实现提权", "url": "https://www.freebuf.com/articles/web/213783.html", "time": "2019-10-05", "level": "", "num_look": 104643, "num_comment": 2, "author": "secist", "tags": ["WEB安全"], "text": "大家好，我是Shawar Khan。自我上次写作以来已经时隔好几个月了，这段时间我一直忙于不同的测试目标。最近我在某个目标中发现了一个有趣的XSS漏洞，通过该漏洞我可以将我的权限提升为管理员用户。"}
{"title": "Emotet家族僵尸网络活动激增，谨慎打开来源不明邮件", "url": "https://www.freebuf.com/articles/system/215014.html", "time": "2019-10-05", "level": "", "num_look": 89194, "num_comment": 89194, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "Emotet在今年6月份时曾经销声匿迹，C&C活动骤减，经过几个月的休整后现又卷土重来。"}
{"title": "解锁FaceBook隐藏好友和朋友圈", "url": "https://www.freebuf.com/articles/others-articles/214911.html", "time": "2019-10-05", "level": "金币+15", "num_look": 89793, "num_comment": 2, "author": "scu-igroup", "tags": ["其他"], "text": "最近，国外的开源情报(OSINT)爱好者分享了一篇帖子，查找朋友不可见的facebook用户的朋友圈，这篇帖子也在我们的知识星球（开源网络空间情报）中第一时间分享。"}
{"title": "Swiftshield：SwiftOBJ-C 代码混淆工具", "url": "https://www.freebuf.com/sectool/213922.html", "time": "2019-10-04", "level": "", "num_look": 100042, "num_comment": 100042, "author": "secist", "tags": ["工具"], "text": "SwiftShield是一个用于为你的iOS项目对象生成不可逆加密名称的工具，其目的是保护你的iOS apps不被一些逆向工具所破解（如class-dump和Cycript）。"}
{"title": "在Linux平台开发C++时用PVS-Studio静态分析代码", "url": "https://www.freebuf.com/sectool/214008.html", "time": "2019-10-04", "level": "", "num_look": 76296, "num_comment": 76296, "author": "secist", "tags": ["工具"], "text": "PVS-Studio支持分析用C， C++，C#和Java开发的项目。你可以在Windows，Linux和macOS下使用它。本文将为大家简单演示，如何在Linux环境下使用PVS-Studio来分析C和C++代码。"}
{"title": "无文件加密挖矿软件GhostMiner", "url": "https://www.freebuf.com/articles/network/214938.html", "time": "2019-10-04", "level": "", "num_look": 97108, "num_comment": 97108, "author": "Kriston", "tags": ["网络安全"], "text": "网络罪犯利用加密挖矿恶意软件盗用计算资源牟利。早在2017年，已经观察到他们如何应用无文件技术使检测和监测更加困难。"}
{"title": "Iris：一款可执行常见Windows漏洞利用检测的WinDbg扩展", "url": "https://www.freebuf.com/sectool/214276.html", "time": "2019-10-03", "level": "", "num_look": 97750, "num_comment": 97750, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Iris是一款WinDbg扩展，它可以针对常见的Windows进程缓解进行安全检测，并给研究人员提供详细的检测数据。"}
{"title": "挖洞经验 | 通过Shodan发现目标应用Marathon服务的RCE漏洞", "url": "https://www.freebuf.com/vuls/213855.html", "time": "2019-10-03", "level": "", "num_look": 151740, "num_comment": 2, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "今天要和大家分享的是，作者在Shodan搜索中发现某应用系统Marathon服务的无需密码验证bug，进一步提权形成RCE漏洞。"}
{"title": "某通信工具收费表情安全性研究", "url": "https://www.freebuf.com/sectool/214098.html", "time": "2019-10-03", "level": "现金奖励", "num_look": 185020, "num_comment": 11, "author": "ab6326795", "tags": ["工具", "终端安全"], "text": "看见某大佬连发了好几个“乖巧**6” 的表情，我问他是不是买的表情。他说“NO”，这些是他使用frida提取出来的表情。我就比较好奇，frida是什么？以及他是如何提取这些表情的？"}
{"title": "Emotet银行木马家族新变种再度来袭", "url": "https://www.freebuf.com/articles/terminal/214881.html", "time": "2019-10-03", "level": "", "num_look": 88802, "num_comment": 88802, "author": "亚信安全", "tags": ["终端安全"], "text": "近日，亚信安全截获新型的EMOTET银行木马新变种，其主要通过垃圾邮件的方式进行传播，是一款比较著名且复杂的银行木马。"}
{"title": "Adwind家族恶意软件", "url": "https://www.freebuf.com/articles/network/214863.html", "time": "2019-10-03", "level": "", "num_look": 84336, "num_comment": 84336, "author": "Kriston", "tags": ["网络安全"], "text": "2012年初，开发人员开始销售Adwind家族的第一个基于Java的远程访问工具（RAT），称为“Frutas”。"}
{"title": "LDAPDomainDump：一款通过LDAP实现的活动目录信息收集工具", "url": "https://www.freebuf.com/sectool/213712.html", "time": "2019-10-02", "level": "", "num_look": 110189, "num_comment": 110189, "author": "Alpha_h4ck", "tags": ["工具", "系统安全"], "text": "LDAPDomainDump是一款通过LDAP实现的活动目录信息收集工具。在一个活动目录域中，任何一名认证用户都可以通过LDAP来获取大量有趣的信息。"}
{"title": "Eyeballer：卷积神经网络在Pentest截图分析中的应用", "url": "https://www.freebuf.com/articles/system/214280.html", "time": "2019-10-02", "level": "", "num_look": 88201, "num_comment": 88201, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "Eyeballer这款强大的工具基于卷积神经网络实现，可利用卷积神经网络来帮助研究人员对获取到的屏幕截图进行渗透测试与安全分析，并给研究人员提供目标截图的快速概览。"}
{"title": "殃及池鱼！老漏洞不修复内网资产危害大", "url": "https://www.freebuf.com/articles/system/214942.html", "time": "2019-10-02", "level": "", "num_look": 109925, "num_comment": 109925, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近日，深信服安全团队接到安全感知报警提示内网某Linux核心Web服务器对内网其他服务器发起永恒之蓝和Struts2漏洞攻击等，报警主机被标记为已失陷。"}
{"title": "AuthCov：一款功能强大的开源Web应用程序授权爬行和扫描工具", "url": "https://www.freebuf.com/sectool/213683.html", "time": "2019-10-01", "level": "", "num_look": 99860, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具"], "text": "AuthCov是一款功能强大的开源Web应用程序授权爬行和扫描工具，可以使用一个Chrome无头浏览器来爬取你的目标Web应用程序（以预定义的用户身份登录）。"}
{"title": "一些适用于各种体系结构的初学者的Linux二进制漏洞利用开发任务", "url": "https://www.freebuf.com/articles/system/213641.html", "time": "2019-10-01", "level": "", "num_look": 101172, "num_comment": 101172, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "这是一套针对初学者的Linux二进制漏洞利用开发任务，目前这一套学习内容主要针对的是堆栈缓冲区溢出问题。"}
{"title": "窃取加密货币的新型木马：InnfiRAT", "url": "https://www.freebuf.com/articles/system/214678.html", "time": "2019-10-01", "level": "", "num_look": 89229, "num_comment": 89229, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近日，国外安全研究人员曝光了一种名为InnfiRAT的新型木马，该木马使用.NET编写，具有窃取用户信息、抓取浏览器Cookie用于窃取密码、屏幕截取、下载执行其他恶意文件等行为。"}
{"title": "PowerShell若干问题的研究", "url": "https://www.freebuf.com/articles/network/214975.html", "time": "2019-10-01", "level": "金币+15", "num_look": 102362, "num_comment": 102362, "author": "DigApis", "tags": ["网络安全"], "text": "PowerShell是一种基于任务的命令行shell和脚本语言，构建于.NET之上，通常用于管理基于Microsoft Windows的操作系统的技术（Linux和MacOS也可以使用）。"}
{"title": "价值x参考丨WitAwards 2019年度优秀网络安全解决方案评选「报名进行中」", "url": "https://www.freebuf.com/fevents/215160.html", "time": "2019-09-30", "level": "", "num_look": 45630, "num_comment": 45630, "author": "FB独家", "tags": ["活动"], "text": "随着网络安全呈现出与不同场景深度融合发展的显著趋势，企业对技术如何实践与落地高度重视，安全行业正面临全新的机遇与挑战。"}
{"title": "SharPersist：一款渗透测试中实现Windows系统常驻的套件", "url": "https://www.freebuf.com/sectool/214013.html", "time": "2019-09-30", "level": "", "num_look": 115179, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "PowerShell在过去的几年里在Offensive安全社区被广泛使用。但随着防御性安全行业的推进，正致使攻击性工具包从PowerShell迁移到反射C#以逃避现代安全产品的检测。"}
{"title": "喜迎祖国70华诞，斗象安全保障在一线", "url": "https://www.freebuf.com/news/215774.html", "time": "2019-09-30", "level": "红色标题", "num_look": 70820, "num_comment": 5, "author": "斗象智能安全平台", "tags": ["资讯"], "text": "在举国同庆共和国70华诞之际，确保节日期间的网络安全问题至关重要。"}
{"title": "Stealth Falcon黑客组织无文件后门分析", "url": "https://www.freebuf.com/articles/network/214014.html", "time": "2019-09-30", "level": "", "num_look": 105942, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "Stealth Falcon黑客组织，自2012年以来一直活跃，其主要目标是中东的政治活动家和记者。citizen lab机构在2016年发表了一份针对某一网络攻击的分析报告。"}
{"title": "数千台Linux主机被勒索，该如何打好防御战？", "url": "https://www.freebuf.com/articles/system/214395.html", "time": "2019-09-30", "level": "", "num_look": 114303, "num_comment": 3, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近日，国外安全媒体先后报道了一款名为Lilocked的Linux勒索病毒，该勒索病毒目前为止已感染了6000+台Linux主机，加密后缀为.lilocked。"}
{"title": "“硬核”评选 | WitAwards 2019「大众投票」即日启动！", "url": "https://www.freebuf.com/fevents/215721.html", "time": "2019-09-30", "level": "红色标题", "num_look": 31218, "num_comment": 31218, "author": "FB独家", "tags": ["活动"], "text": "冲鸭！投票啦～"}
{"title": "FreeBuf早报｜—黑客窃取了Zynga超过2.18亿的Words with Friends玩家数据；一系列网络攻击袭击了国防承包商Rheinmetall AG和加拿大国防建设部；SIM卡又出现新漏送 可盗取用户短信和电话位置信息", "url": "https://www.freebuf.com/news/215700.html", "time": "2019-09-30", "level": "", "num_look": 109915, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "一名巴基斯坦黑客窃取了手游公司Zynga旗下流行游戏Words with Friends的玩家数据，此前，他曾因出售近45个热门在线服务的近10亿条用户记录而广为人知。"}
{"title": "创新成就产品丨WitAwards 2019年度创新产品评选「报名进行中」", "url": "https://www.freebuf.com/news/214706.html", "time": "2019-09-29", "level": "红色标题", "num_look": 47381, "num_comment": 4, "author": "FB独家", "tags": ["资讯"], "text": "创新永远是安全产品的灵魂，是企业兴旺发达的不竭动力，更是国家网络安全前行的动力。"}
{"title": "微软Internet Explorer浏览器Jscript.Dll组件远程代码执行漏洞", "url": "https://www.freebuf.com/vuls/215436.html", "time": "2019-09-29", "level": "", "num_look": 163994, "num_comment": 3, "author": "antiylab", "tags": ["漏洞", "网络安全"], "text": "2019年09月23日，微软发布了针对 Internet Explorer浏览器组件 jscript.dll 的漏洞修复补丁，该漏洞由Google威胁分析小组的安全研究员ClémentLecigne发现，成功利用此漏洞会破坏内存。"}
{"title": "AuthCov：Web认证覆盖扫描工具", "url": "https://www.freebuf.com/sectool/212788.html", "time": "2019-09-29", "level": "", "num_look": 104550, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "AuthCov是一个基于JavaScript的Web认证覆盖扫描工具。"}
{"title": "刷屏的iPhone硬件漏洞，Checkm8对普通用户似乎并没什么影响", "url": "https://www.freebuf.com/news/215649.html", "time": "2019-09-29", "level": "红色标题", "num_look": 120301, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "周五早晨，黑客axi0mX在推特上发布了“ Checkm8”漏洞，该漏洞使得iPhone4s到iPhone X可实现永久越狱。而事实上该漏洞对用户们来说却没有什么实际的影响。这是为什么呢？"}
{"title": "利用PHP的字符串解析特性Bypass", "url": "https://www.freebuf.com/articles/web/213359.html", "time": "2019-09-29", "level": "", "num_look": 224109, "num_comment": 9, "author": "周大涛", "tags": ["WEB安全"], "text": "我们知道PHP将查询字符串（在URL或正文中）转换为内部$_GET或的关联数组$_POST。"}
{"title": "利用虚假简历进行攻击，疑似MuddyWater再次活跃", "url": "https://www.freebuf.com/articles/system/214428.html", "time": "2019-09-29", "level": "", "num_look": 94630, "num_comment": 3, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近日，深信服安全团队获取到一例MuddyWater组织的样本，与该组织过去常用的方法一样，该样本仍然是通过恶意WORD文档进行攻击。"}
{"title": "FreeBuf早报｜不可修补的iOS漏洞可能导致iPhone 4s到iPhone X永久越狱；Phpstudy联合各大安全厂商为用户提供免费的安全检测服务", "url": "https://www.freebuf.com/news/215598.html", "time": "2019-09-29", "level": "", "num_look": 65892, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "一名安全研究人员发布了据称是iPhone 4s直至iPhone X永久性，不可修补的bootrom漏洞，这可能导致永久越狱。Twitter用户axi0mX今天分享了这个漏洞，并且命名为“ checkm8”。"}
{"title": "Java代码审计入门篇：WebGoat 8（初见）", "url": "https://www.freebuf.com/vuls/214039.html", "time": "2019-09-29", "level": "", "num_look": 202135, "num_comment": 3, "author": "DSO观星市场部", "tags": ["WEB安全", "漏洞"], "text": "该程序演示了常见的服务器端应用程序缺陷。本文将简要分析WebGoat8的登陆模块，注册模块，作为热身，随后对SQL注入课程进行代码审计。"}
{"title": "2019上半年移动安全报告", "url": "https://www.freebuf.com/articles/network/213648.html", "time": "2019-09-28", "level": "", "num_look": 134429, "num_comment": 2, "author": "Kriston", "tags": ["网络安全"], "text": "移动安全在保护家庭和企业用户的信息资产方面发挥着越来越重要的作用。随着物联网的出现以及由移动应用程序控制的数以千计的非传统设备，我们手机的安全性对于保护它们所连接的设备变得越来越重要。"}
{"title": "挖洞经验 | Facebook系统HTML转PDF文档可能引起的RCE漏洞", "url": "https://www.freebuf.com/vuls/213714.html", "time": "2019-09-28", "level": "", "num_look": 115897, "num_comment": 2, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "该漏洞能让攻击者在Facebook的tapprd.legal.thefacebook.com服务端（Server-Side）执行HTML代码，如此实现远程代码执行（RCE）。"}
{"title": "Gorgon APT黑客组织觊觎虚拟货币钱包", "url": "https://www.freebuf.com/articles/system/214547.html", "time": "2019-09-28", "level": "", "num_look": 84616, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近日，深信服安全团队发现了Gorgon APT组织最新变种样本，此样本释放了一个盗取受害者虚拟币钱包的木马。"}
{"title": "基于辅助功能的镜像劫持攻击原理", "url": "https://www.freebuf.com/articles/es/214551.html", "time": "2019-09-28", "level": "", "num_look": 127879, "num_comment": 3, "author": "杭州美创科技", "tags": ["企业安全"], "text": "本篇文章将为大家剖析基于辅助功能的镜像劫持攻击原理，向大家展现还原这种攻击所带来的巨大危害以及防御手段。"}
{"title": "BUF大事件丨百度网盘3天使用51次位置；航旅纵横回应新功能泄露用户隐私；iOS 13出现严重漏洞：添加信用卡后显示陌生人信息", "url": "https://www.freebuf.com/news/215552.html", "time": "2019-09-28", "level": "红色标题", "num_look": 109177, "num_comment": 3, "author": "Darry端", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，百度网盘3天使用51次位置;航旅纵横回应新功能泄露用户隐私;iOS 13出现严重漏洞：添加信用卡后显示陌生人信息。"}
{"title": "工信部：力争到2025年网络安全产业规模超过2000亿", "url": "https://www.freebuf.com/news/215550.html", "time": "2019-09-27", "level": "红色标题", "num_look": 72750, "num_comment": 8, "author": "Sandra1432", "tags": ["资讯"], "text": "9月27日，工信部就《关于促进网络安全产业发展的指导意见》公开征求意见。到2025年，培育形成一批年营收超过20亿的网络安全企业，形成若干具有国际竞争力的网络安全骨干企业，网络安全产业规模超过2000亿。"}
{"title": "Pyshark：使用了WirdShark的Python数据包解析工具（Tshark）", "url": "https://www.freebuf.com/sectool/213642.html", "time": "2019-09-27", "level": "", "num_look": 186806, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具", "网络安全"], "text": "Pyshark是一款针对tshark的Python封装器，在Pyshark的帮助下，广大研究人员可以使用wireshark的解析器来进行Python数据包解析。"}
{"title": "诚征主演 | CIS 2019「Hack Demo」议题征集", "url": "https://www.freebuf.com/fevents/215416.html", "time": "2019-09-27", "level": "红色标题", "num_look": 43671, "num_comment": 43671, "author": "FB独家", "tags": ["活动"], "text": "让我们再次见证不可思议！"}
{"title": "如何知道你的网络安全工具是否有效运行", "url": "https://www.freebuf.com/articles/network/213072.html", "time": "2019-09-27", "level": "", "num_look": 103038, "num_comment": 2, "author": "Kriston", "tags": ["网络安全"], "text": "现在许多企业或组织已投资了数十种网络安全工具。 但不确定他们是否按预期工作。例如，如果安全信息和事件管理（SIEM）工具报告的成功阻止攻击的百分比是虚假报告，那么其中实际发生的阻止攻击占比又是多少？"}
{"title": "【勒索预警】放假之前，EvaRichter勒索病毒来袭", "url": "https://www.freebuf.com/articles/system/215483.html", "time": "2019-09-27", "level": "金币+15", "num_look": 94826, "num_comment": 1, "author": "熊猫正正", "tags": ["系统安全"], "text": "目前勒索病毒仍然是全球最大的威胁，最近一年针对企业的勒索病毒攻击越来越多，大部分勒索病毒是无法解密的，并且不断有新型的勒索病毒出现，各企业一定要保持高度的重视，马上放假了，一款新型勒索病毒来袭。"}
{"title": "DDG挖矿僵尸网络病毒最新变种4004来袭", "url": "https://www.freebuf.com/articles/system/214398.html", "time": "2019-09-27", "level": "", "num_look": 106278, "num_comment": 106278, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "某虚拟平台大量机器CPU占用非常高，怀疑中了挖矿病毒。经过安全专家排查，发现还存在ssh爆破行为。进一步分析后，判断其为DDG挖矿病毒。"}
{"title": "WordPress插件中的XSS漏洞的复现分析与利用", "url": "https://www.freebuf.com/vuls/214534.html", "time": "2019-09-27", "level": "现金奖励", "num_look": 175306, "num_comment": 14, "author": "Neroqi", "tags": ["WEB安全", "漏洞"], "text": "它使用PHP语言和MySQL数据库开发而成，用户可以在支持相应版本的PHP 和 MySQL数据库的服务器上方便快捷地搭建自己的博客或者网站。"}
{"title": "BlueKeep漏洞利用分析", "url": "https://www.freebuf.com/vuls/214775.html", "time": "2019-09-27", "level": "", "num_look": 117252, "num_comment": 5, "author": "Knownsec知道创宇", "tags": ["漏洞"], "text": "通道的数据包定义在MCS Connect Inittial PDU with GCC Conference Create Request中。"}
{"title": "FreeBuf早报 | Deepfake视频鉴别战：谷歌发数据集，脸书斥资千万办比赛；12月1日起实体渠道办理电话入网将实施人像比对技术；思科警告：这些运行IOS的路由器具有9.9 / 10严重安全漏洞", "url": "https://www.freebuf.com/news/215486.html", "time": "2019-09-27", "level": "", "num_look": 73312, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "近期工业和信息化部办公厅印发了《关于进一步做好电话用户实名登记管理有关工作的通知》，指导电信企业开展电话用户实名登记工作。"}
{"title": "微软IE浏览器JScript脚本引擎远程代码执行漏洞通告", "url": "https://www.freebuf.com/articles/system/215326.html", "time": "2019-09-27", "level": "", "num_look": 93761, "num_comment": 2, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "攻击者可能利用此漏洞通过诱使用户访问恶意网页触发漏洞从而获得对用户系统的控制。"}
{"title": "WitAwards 2019年度最受欢迎安全雇主评选「报名进行中」", "url": "https://www.freebuf.com/fevents/215156.html", "time": "2019-09-26", "level": "红色标题", "num_look": 41092, "num_comment": 3, "author": "FB独家", "tags": ["活动"], "text": "2018年我国网络安全市场规模为393.25亿元，同比增长率约为17.8%，预计未来三年产业整体市场依然会保持20%左右的高速增长。"}
{"title": "Covenant：针对红队设计的.NET命令行控制框架", "url": "https://www.freebuf.com/articles/system/213672.html", "time": "2019-09-26", "level": "", "num_look": 109210, "num_comment": 8, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "Covenant是一个.NET命令和控制框架，旨在突出.NET的攻击面，在Covenant的帮助下，研究人员可以更加轻松地去利用.NET的攻击面，而且它还可以作为红队研究人员的协作命令和控制平台。"}
{"title": "phpStudy后门简要分析", "url": "https://www.freebuf.com/articles/others-articles/215406.html", "time": "2019-09-26", "level": "红色标题", "num_look": 245978, "num_comment": 12, "author": "漏洞盒子", "tags": ["其他"], "text": "本文从问题概要、环境准备、参考、总结几个方面对phpStudy后门作简要分析。"}
{"title": "分享一次应急响应简述", "url": "https://www.freebuf.com/articles/system/214353.html", "time": "2019-09-26", "level": "现金奖励", "num_look": 313191, "num_comment": 31, "author": "bbbbbbig", "tags": ["系统安全"], "text": "该系统已处于瘫痪状态、系统属于内网未对互联网开发端口、操作系统为Windows server 2008、已做断网处理。"}
{"title": "挖洞经验 | HTTP请求夹带攻击技术（Request Smuggling ）的具体原理和应用实例", "url": "https://www.freebuf.com/articles/web/213360.html", "time": "2019-09-26", "level": "", "num_look": 219064, "num_comment": 11, "author": "clouds", "tags": ["WEB安全"], "text": "本文我们就来探讨请求夹带攻击（漏洞）的具体原理，结合近期的一些测试实例，加深对其了解认识。"}
{"title": "农夫山泉招聘高级信息安全工程师/安全专家", "url": "https://www.freebuf.com/jobs/213942.html", "time": "2019-09-26", "level": "", "num_look": 98518, "num_comment": 12, "author": "UnAmico", "tags": ["安全招聘"], "text": "农夫山泉为养生堂集团旗下全资子公司，养生堂集团业务范围广泛，盈利能力非常强。"}
{"title": "斗象科技荣获麦当劳中国第一届Data&Technology供应商大会「最佳极客奖」", "url": "https://www.freebuf.com/fevents/215393.html", "time": "2019-09-26", "level": "", "num_look": 41851, "num_comment": 41851, "author": "斗象科技官方", "tags": ["活动"], "text": "2019年麦当劳中国第一届 Data&Technology 供应商大会上，作为麦当劳中国重要安全合作伙伴的斗象科技荣获“最佳极客奖”。"}
{"title": "复盘网络战：乌克兰二次断电事件分析", "url": "https://www.freebuf.com/articles/system/214591.html", "time": "2019-09-26", "level": "", "num_look": 139723, "num_comment": 1, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "乌克兰，位于欧洲东部，东接俄罗斯，西欧洲诸国相连。从地缘政治角度来看，这个“桥梁国家”，不断受到俄罗斯与欧洲之间的权力争夺。"}
{"title": "FreeBuf早报 | 黑客创建虚假退伍军人招聘网站，用恶意软件感染受害者的电脑；参与涉约亿人信息黑客案，一俄籍男子认罪；互联网流量跟踪分析公司Comscore以500万美元和解欺诈指控", "url": "https://www.freebuf.com/news/215341.html", "time": "2019-09-26", "level": "", "num_look": 79377, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "最近，GandCrab恶意软件在德克萨斯州的22个城市和全国各地的牙医诊所中广泛传播。背后的团队称为Gold Garden，尽管他们声称自己已经金盆洗手，但通过技术又重新利用REvile / Sodinokibi勒索软件进行活动。"}
{"title": "OpenVPN服务被利用于UDP反射放大DDoS攻击", "url": "https://www.freebuf.com/vuls/215171.html", "time": "2019-09-26", "level": "现金奖励", "num_look": 220909, "num_comment": 4, "author": "null001", "tags": ["漏洞"], "text": "2019年09月10日， 华为AntiDDoS8000设备某荷兰数据中心局点捕获新型UDP反射放大攻击，反射源端口为1194。"}
{"title": "CIS 2019大会官网上线，特惠早鸟票同步开售！", "url": "https://www.freebuf.com/fevents/215295.html", "time": "2019-09-25", "level": "红色标题", "num_look": 1772384, "num_comment": 29, "author": "FB独家", "tags": ["活动"], "text": "CIS 2019网络安全创新大会官网(cis.freebuf.com)现已正式上线，购票渠道同步全面开通！"}
{"title": "AutoRecon：多线程网络侦察工具", "url": "https://www.freebuf.com/sectool/213521.html", "time": "2019-09-25", "level": "", "num_look": 118549, "num_comment": 3, "author": "secist", "tags": ["工具"], "text": "AutoRecon是一个多线程的网络侦察工具，可自动化的执行服务枚举任务。其旨在减少任务的执行时间，非常适用于CTF和某些渗透环境（例如OSCP）。"}
{"title": "台湾省参演美国攻防演练“网络风暴”，官方回应全警实战，正逢其时！", "url": "https://www.freebuf.com/news/215263.html", "time": "2019-09-25", "level": "红色标题", "num_look": 114254, "num_comment": 8, "author": "kirazhou", "tags": ["资讯"], "text": "今年11月，美国将首次与台湾省共同举行“网络攻防演练”，并集合至少15个国家及地区，共同演练应对来自北韩的网络攻击和针对金融系统的黑客活动等问题。"}
{"title": "2019年第二季度的垃圾邮件和网络钓鱼数据统计", "url": "https://www.freebuf.com/articles/network/212957.html", "time": "2019-09-25", "level": "", "num_look": 113059, "num_comment": 2, "author": "Kriston", "tags": ["网络安全"], "text": "本文主要统计了2019年第二季度垃圾邮件和网络钓鱼邮件类型种类、时间数量、国家分布、主要目标、恶意附件等信息。"}
{"title": "微店（杭州）招聘安全工程师", "url": "https://www.freebuf.com/jobs/214854.html", "time": "2019-09-25", "level": "", "num_look": 67681, "num_comment": 67681, "author": "weidian", "tags": ["安全招聘"], "text": "微店 | 口袋购物公司，于2011年5月成立，是一家致力移动互联网购物领域的公司，于2014年完成了3.5亿美金的C轮融资。"}
{"title": "一个手机厂商的安全觉悟", "url": "https://www.freebuf.com/fevents/215241.html", "time": "2019-09-25", "level": "", "num_look": 69557, "num_comment": 3, "author": "shidongqi", "tags": ["活动"], "text": "99.9%的安卓手机都存在漏洞，这并不是什么耸人听闻的说法，这是前不久国内某大型安全公司发布的最新一期关于安卓系统安全性报告所给出的实际数据。"}
{"title": "2019年中期安全总结", "url": "https://www.freebuf.com/articles/network/213356.html", "time": "2019-09-25", "level": "", "num_look": 137003, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "2019的前六个月处理了众多网络安全威胁，年中安全综述突出了上半年处理的网络安全威胁，并提供安全解决方案建议，帮助用户和组织确定正确解决方案和防御策略。"}
{"title": "MITRE发布2019 CWE Top 25最危险的软件错误榜单草案", "url": "https://www.freebuf.com/news/214746.html", "time": "2019-09-25", "level": "金币+8", "num_look": 88674, "num_comment": 1, "author": "偶然路过的围观群众", "tags": ["资讯"], "text": "今年9月份，MITRE在其官网发布了2019 CWE Top 25最危险的软件错误榜单（2019 CWE Top 25 Most Dangerous Software Errors）草案。"}
{"title": "FreeBuf早报｜日本拟用AI技术预测网络袭击；DDoS攻击使南非ISP整日瘫痪；任正非谈美国国家安全局黑进华为网络：可能是好奇吧", "url": "https://www.freebuf.com/news/215213.html", "time": "2019-09-25", "level": "", "num_look": 78473, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "任正非表示内部网络只防范恶性竞争对手，不防范西方竞争对手，也不防范所有政府，包括美国政府、中国政府。至于美国当时进来看看，可能也不是因为我们强大，可能是好奇吧。"}
{"title": "Usbrip：用于跟踪USB设备固件的简单CLI取证工具", "url": "https://www.freebuf.com/sectool/210305.html", "time": "2019-09-24", "level": "金币+8", "num_look": 94585, "num_comment": 1, "author": "线性代数lzh", "tags": ["工具"], "text": "Usbrip（源自“USB Ripper”，而不是“USB RIP”惊人）是一个开源取证工具，带有CLI界面，可让您跟踪USB设备工件（即USB事件历史记录，“已连接”和“已断开连接”事件） Linux机器。"}
{"title": "Jenkins插件漏洞分析", "url": "https://www.freebuf.com/vuls/213085.html", "time": "2019-09-24", "level": "", "num_look": 123848, "num_comment": 2, "author": "Kriston", "tags": ["漏洞", "网络安全"], "text": "Jenkins是一个广泛使用的开源自动化服务器，它允许DevOps开发人员高效、可靠地构建、测试和部署软件。"}
{"title": "国庆重保之临时抱佛脚攻略", "url": "https://www.freebuf.com/articles/security-management/214261.html", "time": "2019-09-24", "level": "金币+8", "num_look": 743877, "num_comment": 18, "author": "雨水", "tags": ["安全管理"], "text": "中秋佳节过后，马上又有国庆小长假，各行各业享受假期的同时，安全从业者却不敢放松。今年是建国70周年，重保的压力比以往国庆保障要大很多。"}
{"title": "微众银行信息安全部诚聘安全后台开发岗", "url": "https://www.freebuf.com/jobs/214530.html", "time": "2019-09-24", "level": "", "num_look": 71202, "num_comment": 1, "author": "微众银行sec", "tags": ["安全招聘"], "text": "微众银行是国内首家开业的民营银行，由腾讯、百业源和立业等多家知名企业发起设立。"}
{"title": "Metasploit BlueKeep漏洞利用模块简要分析", "url": "https://www.freebuf.com/vuls/214067.html", "time": "2019-09-24", "level": "金币+8", "num_look": 149007, "num_comment": 3, "author": "cradel", "tags": ["漏洞"], "text": "9月7日，Metasploit发布了BlueKeep远程桌面命令执行漏洞利用模块和分析博客，本文将结合rdp相关实现对利用模块进行简要分析。"}
{"title": "FreeBuf早报｜大量的帐户劫持浪潮打击了YouTube创作者；TortoiseShell黑客组织针对IT供应商的供应链攻击；第一批活在云端的“数字人”即将诞生，信息安全隐患更应引起重视", "url": "https://www.freebuf.com/news/215047.html", "time": "2019-09-24", "level": "", "num_look": 76582, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "来自汽车评论社区的YouTube创作者遭受的攻击似乎是最为严重的,YouTube创作者汽车社区的几个关注度比较高的账户已经成为账号劫持攻击的受害者。"}
{"title": "第五空间比赛P4F Writeup", "url": "https://www.freebuf.com/articles/others-articles/213340.html", "time": "2019-09-24", "level": "", "num_look": 93191, "num_comment": 5, "author": "Snowleopardbin", "tags": ["其他"], "text": "在第五空间比赛中总共做出10道pwn和3道web，官方没给出writeup，在此交流思路，请大佬勿喷。吐槽一下比赛环境，感受到被500支配的恐惧，理论题做了两次，浪费了很多时间。"}
{"title": "Social_Attacker：自动化社交媒体钓鱼框架", "url": "https://www.freebuf.com/sectool/213766.html", "time": "2019-09-23", "level": "", "num_look": 99683, "num_comment": 4, "author": "secist", "tags": ["工具"], "text": "Social Attacker是第一个开源的多站点自动化社交媒体钓鱼框架。它允许你通过处理目标的连接和消息，在大规模范围内自动化钓鱼社交媒体用户。"}
{"title": "拥抱开源丨WitAwards 2019年度最佳安全开源项目评选「报名进行中」", "url": "https://www.freebuf.com/fevents/214751.html", "time": "2019-09-23", "level": "红色标题", "num_look": 49524, "num_comment": 4, "author": "FB独家", "tags": ["活动"], "text": "《软件和信息技术服务业发展规划（2016－2020年）》中明确提出：\"发挥开源社区对创新的支撑促进作用，强化开源技术成果在创新中的应用\"。"}
{"title": "有关RouterOS的后渗透研究", "url": "https://www.freebuf.com/articles/system/212959.html", "time": "2019-09-23", "level": "", "num_look": 134814, "num_comment": 1, "author": "secist", "tags": ["系统安全"], "text": "此次DEF CON的讨论介绍了RouterOS过去和现在的后期利用技术。"}
{"title": "制作HackCube中的坎坎坷坷", "url": "https://www.freebuf.com/articles/others-articles/214283.html", "time": "2019-09-23", "level": "现金奖励", "num_look": 710734, "num_comment": 8, "author": "LEdge1", "tags": ["其他", "极客"], "text": "由于对无线电方面的信息安全的热爱，在中秋放假之前自己按照360无线电无线电研究院的帖子DIY了一个hack cube。"}
{"title": "30万台杂牌手机被预装木马，组庞大猫池提供黑产服务", "url": "https://www.freebuf.com/news/214959.html", "time": "2019-09-23", "level": "", "num_look": 122574, "num_comment": 2, "author": "百里不守约", "tags": ["资讯"], "text": "日前，一场30万台杂牌手机预装木马程序的案件浮出水面，该木马并非窃取信息或者挖矿，而是接收短信验证码以注册各种网络账号，形成庞大的手机“猫池”。"}
{"title": "汽车之家诚招安全人才", "url": "https://www.freebuf.com/jobs/214150.html", "time": "2019-09-23", "level": "", "num_look": 78787, "num_comment": 2, "author": "cn_H5", "tags": ["安全招聘"], "text": "汽车之家（NYSE：ATHM）成立于2005年，为消费者提供优质的汽车消费和汽车生活服务，助力中国汽车产业蓬勃发展。"}
{"title": "利用深度学习检测恶意PowerShell", "url": "https://www.freebuf.com/articles/network/213619.html", "time": "2019-09-23", "level": "", "num_look": 107184, "num_comment": 6, "author": "Kriston", "tags": ["网络安全"], "text": "深度学习（deep learning）是机器学习大框架下的一类算法，在图像和文本分类等任务上，深度学习方法明显优于传统方法。随着发展，利用深度学习建立新的威胁检测方法具有很大的潜力。"}
{"title": "FreeBuf早报｜伊朗否认其石油部门基础设施被袭；美国FBI逮捕两名骗子 涉嫌以PC技术支持为由进行诈骗；惠普收购Bromium：增强终端设备安全能力", "url": "https://www.freebuf.com/news/214926.html", "time": "2019-09-23", "level": "", "num_look": 66690, "num_comment": 2, "author": "kirazhou", "tags": ["资讯"], "text": "一些西方媒体报道了针对伊朗石油部门基础设施的破坏性网络攻击，但伊朗予以否认。"}
{"title": "网络安全能力成熟度模型：D2-网络文化与社会（二）", "url": "https://www.freebuf.com/articles/paper/214097.html", "time": "2019-09-23", "level": "", "num_look": 125035, "num_comment": 8, "author": "宇宸de研究室", "tags": ["安全报告"], "text": "从本维度开始，从国家层面来探讨网络文化和社会的安全能力建设，并从战略和政策的高度来逐步执行。"}
{"title": "数十万PhpStudy用户被植入后门，快来检测你是否已沦为“肉鸡”！", "url": "https://www.freebuf.com/news/topnews/214912.html", "time": "2019-09-22", "level": "红色标题", "num_look": 648707, "num_comment": 12, "author": "360安全", "tags": ["其他", "头条"], "text": "杭州公安发布《杭州警方通报打击涉网违法犯罪暨‘净网2019’专项行动战果》一文，文章曝光了国内知名PHP调试环境程序集成包“PhpStudy软件”遭到黑客篡改并植入“后门”。"}
{"title": "Mondoo：Cloud-Native安全和漏洞风险管理系统", "url": "https://www.freebuf.com/sectool/213651.html", "time": "2019-09-22", "level": "", "num_look": 85539, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "Mondoo是一个Cloud-Native安全和漏洞风险管理系统且开箱即用。"}
{"title": "卡巴斯基2018年事件响应报告", "url": "https://www.freebuf.com/articles/network/213352.html", "time": "2019-09-22", "level": "", "num_look": 91891, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "本报告涵盖了卡巴斯基2018年的事件响应实践，而使用的数据来自卡巴斯基团队提供的各种事件调查服务。"}
{"title": "瞒天过海：某APT组织利用鱼叉邮件渗透多个行业窃取敏感数据", "url": "https://www.freebuf.com/articles/system/213652.html", "time": "2019-09-22", "level": "", "num_look": 112265, "num_comment": 5, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "该组织通过鱼叉式钓鱼邮件，在最近的三个月里面持续对国内至少60余个目标发起针对性的攻击。"}
{"title": "Bitter盗取巴基斯坦警察部门签名进行攻击活动分析", "url": "https://www.freebuf.com/articles/paper/214232.html", "time": "2019-09-22", "level": "现金奖励", "num_look": 76153, "num_comment": 1, "author": "fuckgod", "tags": ["安全报告"], "text": "Bitter团伙是一个长期针对中国、巴基斯坦等国家进行攻击活动的APT组织，该组织主要针对政府、军工业、电力、核等单位进行攻击，窃取敏感资料，具有强烈的政治背景。"}
{"title": "CVE-2018-6924：解析FreeBSD ELF 头导致内核内存泄露", "url": "https://www.freebuf.com/vuls/213345.html", "time": "2019-09-21", "level": "", "num_look": 90931, "num_comment": 90931, "author": "Alpha_h4ck", "tags": ["漏洞"], "text": "在FreeBSD-SA-18:12这份安全公告中，FreeBSD修复了一个内核内存泄漏漏洞，该漏洞会影响相关操作系统的所有版本。"}
{"title": "使用NLP生成个性化的Wordlist用于密码猜测爆破", "url": "https://www.freebuf.com/sectool/213354.html", "time": "2019-09-21", "level": "", "num_look": 158780, "num_comment": 158780, "author": "secist", "tags": ["工具", "数据安全"], "text": "我编写了一个名为Rhodiola的工具，该工具可以分析目标数据（例如目标的tweets），并检测其中最常用的主题，以此来构建一个用于密码猜测/暴破的个性化的Wordlist。"}
{"title": "污水攻击MuddyC3开源代码分析", "url": "https://www.freebuf.com/articles/web/213834.html", "time": "2019-09-21", "level": "", "num_look": 110165, "num_comment": 110165, "author": "DigApis", "tags": ["WEB安全"], "text": "MuddyWater是一个伊朗威胁组织，主要针对中东、欧洲和北美国家。该组织针对的目标主要是电信，政府（IT服务）和石油部门。"}
{"title": "BUF大事件丨拍照比“剪刀手”会泄露指纹信息；美国司法部指控斯诺登新书违反保密合同；iOS 13再曝漏洞：iPhone锁屏也会被窃取信息", "url": "https://www.freebuf.com/news/214749.html", "time": "2019-09-21", "level": "红色标题", "num_look": 101812, "num_comment": 101812, "author": "Darry端", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，网络安全专家称拍照比“剪刀手”会泄露指纹信息；iOS 13再曝漏洞：iPhone锁屏也会被窃取信息。"}
{"title": "使用Xray反连平台挖掘和验证SSRF", "url": "https://www.freebuf.com/sectool/213767.html", "time": "2019-09-21", "level": "现金奖励", "num_look": 275060, "num_comment": 4, "author": "virusdefender", "tags": ["工具"], "text": "SSRF，Server-Side Request Forgery，服务端请求伪造，是一种由攻击者构造形成由服务器端发起请求的一个漏洞。"}
{"title": "Web标准安全性研究：对某数字货币服务的授权渗透", "url": "https://www.freebuf.com/articles/web/213103.html", "time": "2019-09-20", "level": "", "num_look": 107604, "num_comment": 2, "author": "secist", "tags": ["WEB安全"], "text": "表面下，现代Web只有通过不断增长的技术标准才能实现。Web标准是最广泛采用和快速发展的标准之一，其变化也经常引起浏览器供应商，Web开发人员和用户之间的激烈争论。"}
{"title": "手把手教你编写抖音自动评论脚本", "url": "https://www.freebuf.com/geek/213050.html", "time": "2019-09-20", "level": "现金奖励", "num_look": 592177, "num_comment": 13, "author": "冰海", "tags": ["极客"], "text": "我的TodoList增加了一项，Appium | Airtest 抖音自动评论、创意评论（所有评论/前一百评论男女占比 | 所有评论词云），记录了当时的一个想法。"}
{"title": "Fortify SCA检测Java程序问题及解决方法", "url": "https://www.freebuf.com/vuls/212021.html", "time": "2019-09-20", "level": "现金奖励", "num_look": 142239, "num_comment": 4, "author": "Mr一凡先生", "tags": ["安全报告", "漏洞"], "text": "本文是本公司软件进行安全评测的结果经验分享，纯属个人经验，如有问题请及时反馈~"}
{"title": "FreeBuf早报｜诺基亚员工意外泄露了俄罗斯电信运营商SORM监控设备的秘密；MITRE发布CWE Top 25榜单；Harbor任意管理员注册漏洞", "url": "https://www.freebuf.com/news/214841.html", "time": "2019-09-20", "level": "", "num_look": 79164, "num_comment": 4, "author": "shidongqi", "tags": ["资讯"], "text": "外媒刚刚揭示了俄罗斯电信运营商机房中神秘的 SORM 监控设备，据说它们被安插在各个城市的带锁房间，并且直连该国某些大型电信运营商的电话和互联网络。"}
{"title": "冰蝎动态二进制加密WebShell特征分析", "url": "https://www.freebuf.com/articles/web/213905.html", "time": "2019-09-20", "level": "", "num_look": 313390, "num_comment": 10, "author": "lowliness", "tags": ["WEB安全"], "text": "冰蝎一款新型加密网站管理客户端，在实际的渗透测试过程中有非常不错的效果。"}
{"title": "DNSlivery：通过DNS发送文件和payload的工具", "url": "https://www.freebuf.com/sectool/212930.html", "time": "2019-09-20", "level": "", "num_look": 98405, "num_comment": 2, "author": "周大涛", "tags": ["工具"], "text": "DNSlivery是一款使用DNS作为传输协议将文件传递到目标的工具。"}
{"title": "精品公开课 | XSS从0到1 | WEB安全基础课程", "url": "https://www.freebuf.com/open/214777.html", "time": "2019-09-19", "level": "", "num_look": 121520, "num_comment": 2, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "本期FreeBuf公开课从浏览器特性开始说起，详细讲解浏览器对URL JS HTML 的解析规则以及基于这些规则去绕过某些拦截。"}
{"title": "漏洞预警 | Harbor任意管理员注册漏洞", "url": "https://www.freebuf.com/vuls/214767.html", "time": "2019-09-19", "level": "", "num_look": 201253, "num_comment": 8, "author": "斗象智能安全平台", "tags": ["漏洞"], "text": "近日Harbor曝出一个垂直越权漏洞，因注册模块对参数校验不严格，可导致任意管理员注册。"}
{"title": "他来了，他来了！CIS 2019「议题征集」启动啦", "url": "https://www.freebuf.com/fevents/214491.html", "time": "2019-09-19", "level": "红色标题", "num_look": 168713, "num_comment": 3, "author": "FB独家", "tags": ["活动"], "text": "CIS 2019网络安全创新大会筹备现已全面启动，即日起，大会议题征集正式开启。"}
{"title": "用Windows打造自己精简便捷的渗透工具集", "url": "https://www.freebuf.com/sectool/213459.html", "time": "2019-09-19", "level": "现金奖励", "num_look": 411181, "num_comment": 37, "author": "少帅力", "tags": ["工具"], "text": "每次打开kali虚拟机这个占用20G磁盘4G内存的重量级工具，就用其中两三款用完再关，磁盘IO要反应老半天，重新打开又要老半天，于是我想到把常用的工具搬到win下来。"}
{"title": "在满补丁的Win10域主机上绕过图形接口依赖实现本地提权", "url": "https://www.freebuf.com/articles/system/213036.html", "time": "2019-09-19", "level": "", "num_look": 118415, "num_comment": 118415, "author": "secist", "tags": ["系统安全"], "text": "本文的目的是向大家展示，如何在打满补丁的Win10域主机上绕过图形接口依赖实现本地提权。"}
{"title": "Gartner 2019年人工智能成熟度曲线的超前趋势", "url": "https://www.freebuf.com/articles/security-management/214692.html", "time": "2019-09-19", "level": "", "num_look": 201167, "num_comment": 4, "author": "宇宸de研究室", "tags": ["企业安全", "安全管理"], "text": "根据Gartner对2019年的CIO议程调查，2018年至2019年间，部署人工智能(AI)的组织从4%增长到了14%。"}
{"title": "Donot APT组织（肚脑虫）伪装克什米尔新闻APP的攻击活动分析", "url": "https://www.freebuf.com/articles/terminal/213962.html", "time": "2019-09-19", "level": "", "num_look": 100043, "num_comment": 2, "author": "奇安信威胁情报中心", "tags": ["终端安全"], "text": "Donot“肚脑虫”（APT-C-35）是疑似具有南亚背景的APT组织，由奇安信威胁情报中心红雨滴团队（@RedDrip7）持续跟踪发现并命名，其主要针对巴基斯坦等南亚地区国家进行网络间谍活动。"}
{"title": "FreeBuf早报 | Microsoft网络钓鱼页面利用JavaScript发送虚假登录；沙特IT企业供应链可能成为Tortoiseshell集团的攻击目标；爬虫技术公司被查引行业反思，消费金融平台风控再造", "url": "https://www.freebuf.com/news/214672.html", "time": "2019-09-19", "level": "", "num_look": 64096, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "近日，已发现Microsoft帐户网络钓鱼诈骗的新登录页面，该网页利用SmtpJS服务通过电子邮件将窃取的凭据发送给攻击者。"}
{"title": "一个邮箱账号的展开式", "url": "https://www.freebuf.com/articles/others-articles/213744.html", "time": "2019-09-19", "level": "", "num_look": 146979, "num_comment": 2, "author": "scu-igroup", "tags": ["其他"], "text": "开源情报收集往往都是通过一个邮箱账号展开，那么仅通过一个邮箱账号，能查询到哪些信息呢。本文中，拟介绍一些专业的开源情报收集工具以及最新的开源情报方面的研究成果。"}
{"title": "网络犯罪分子采取新策略，勒索软件增长超118％", "url": "https://www.freebuf.com/news/213578.html", "time": "2019-09-19", "level": "", "num_look": 54327, "num_comment": 2, "author": "kirazhou", "tags": ["资讯"], "text": "犯罪分子正在采取新的策略和代码创新，导致勒索软件不断复苏……"}
{"title": "Seth：执行MitM攻击并从RDP连接中提取明文凭证", "url": "https://www.freebuf.com/sectool/212918.html", "time": "2019-09-19", "level": "", "num_look": 93247, "num_comment": 1, "author": "周大涛", "tags": ["工具"], "text": "Seth是一个用Python编写，试图降级RDP连接来提取明文凭据的工具。"}
{"title": "新型盗刷手段并不新，现在丢钱都不敢丢手机了", "url": "https://www.freebuf.com/articles/neopoints/214647.html", "time": "2019-09-18", "level": "", "num_look": 113823, "num_comment": 6, "author": "Allen别bb", "tags": ["观点"], "text": "如果你问我，一万块钱丢了和一部5000块用了一两年的智能手机被偷，比较能接受哪一个？我肯定愿意丢钱。"}
{"title": "HRShell：Flask构建的HTTPSHTTP反向Shell", "url": "https://www.freebuf.com/sectool/212678.html", "time": "2019-09-18", "level": "", "num_look": 101501, "num_comment": 101501, "author": "secist", "tags": ["工具"], "text": "HRShell是一个使用Flask构建的高级HTTP(S)反向Shell，其兼容python 2.x/3.x并已在以下操作系统成功测试。"}
{"title": "巴尔干半岛上的双重网络攻击分析", "url": "https://www.freebuf.com/articles/network/212571.html", "time": "2019-09-18", "level": "", "num_look": 88944, "num_comment": 3, "author": "Kriston", "tags": ["网络安全"], "text": "近期在巴尔干地区发现了正在进行网络攻击行动，攻击中使用了两个具有相似目的的工具：一个后门和一个木马我们分别命名为BalkanDoor和BalkanRAT。"}
{"title": "携程旅行网招聘高级资深渗透测试工程师/安全攻防专家", "url": "https://www.freebuf.com/jobs/214463.html", "time": "2019-09-18", "level": "", "num_look": 91941, "num_comment": 9, "author": "SixSixSix", "tags": ["安全招聘"], "text": "携程旅行网创立于1999年，总部设在中国上海，员工30000余人，作为中国领先的综合性旅行服务公司，携程成功整合了高科技产业与传统旅行业。"}
{"title": "一种基于欺骗防御的入侵检测技术研究", "url": "https://www.freebuf.com/articles/es/213630.html", "time": "2019-09-18", "level": "", "num_look": 125023, "num_comment": 1, "author": "青藤云安全", "tags": ["企业安全"], "text": "欺骗防御（Deception）是防守者得以观察攻击者行为的新兴网络防御战术，通过诱骗攻击者和恶意应用暴露自身，以便研究人员能够设计出有效防护措施。"}
{"title": "等级保护主机安全：CentOS入侵防范（二）", "url": "https://www.freebuf.com/articles/terminal/213480.html", "time": "2019-09-18", "level": "金币+20", "num_look": 122472, "num_comment": 8, "author": "起于凡而非于凡", "tags": ["终端安全"], "text": "这篇文章主要说一说等保2.0中，入侵防范中和主机有关的两个测评项。"}
{"title": "FreeBuf早报｜美国NIST发布隐私框架草案；McAfee 团队发布网络威胁季度总结报告；InnfiRat恶意软件窃取数字货币以及数字钱包信息", "url": "https://www.freebuf.com/news/214536.html", "time": "2019-09-18", "level": "", "num_look": 60296, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "McAfee发布2019年第一季度总结，报告显示勒索软件攻击增长了118％，PowerShell的使用量显著增加了460％。大多数勒索软件攻击者不再使用群发活动，而是尝试利用远程桌面服务的漏洞或弱口令入侵攻击。"}
{"title": "国之重器 | WitAwards 2019年度保障力量评选「报名进行中」", "url": "https://www.freebuf.com/fevents/214462.html", "time": "2019-09-17", "level": "红色标题", "num_look": 37865, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "维护国家网络信息安全是光荣与荣耀，更是义不容辞的责任与使命。今年，支撑国家网络空间信息安全的年度保障力量将花落谁家？让我们拭目以待！"}
{"title": "EMAGNET：从Pastebin上传的泄漏数据库中捕获电子邮件地址和密码", "url": "https://www.freebuf.com/sectool/213048.html", "time": "2019-09-17", "level": "", "num_look": 157569, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "Emagnet是一款非常强大的工具，其主要目的是从pastebin上传的泄漏数据库中捕获电子邮件地址和密码。当密码在pastebin.com上不在列表中时，几乎不可能找到泄露的密码。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列：Tom Hudson", "url": "https://www.freebuf.com/video/214000.html", "time": "2019-09-17", "level": "", "num_look": 80183, "num_comment": 80183, "author": "willhuang", "tags": ["视频"], "text": "Tom Hudson，英国 Sky Betting & Gaming 天空博彩公司高级技术研究员，目前以224个有效漏洞提交量名列HackerOne白帽榜第40名。"}
{"title": "记一次内部系统渗透测试：小漏洞组合拳", "url": "https://www.freebuf.com/articles/web/213675.html", "time": "2019-09-17", "level": "现金奖励", "num_look": 334456, "num_comment": 50, "author": "jin16879", "tags": ["WEB安全"], "text": "这篇文章主要说的是我在这次内部测试的任务中，如何一步步获取应用系统最高权限，总的来说，是各种小漏洞的组合拳。"}
{"title": "新注册域名恶意行为分析", "url": "https://www.freebuf.com/articles/network/212792.html", "time": "2019-09-17", "level": "", "num_look": 100723, "num_comment": 2, "author": "Kriston", "tags": ["网络安全"], "text": "新注册的域名（NRD）受到攻击者者的青睐，可以用来发起恶意活动。学术和行业研究报告显示，统计数据表明，NRD是有风险的，可用于包括钓鱼、恶意软件和诈骗在内的恶意活动。"}
{"title": "黑客购买新型WSH RAT最新变种样本，攻击银行客户", "url": "https://www.freebuf.com/articles/system/214269.html", "time": "2019-09-17", "level": "", "num_look": 92994, "num_comment": 2, "author": "熊猫正正", "tags": ["系统安全"], "text": "WSH RAT是今年6月2日发布的一款新型的RAT恶意软件，是基于VBS的Houdini蠕虫(H-Worm)的最新变种。"}
{"title": "通过“热补丁”执行恶意代码实例分析", "url": "https://www.freebuf.com/articles/others-articles/213520.html", "time": "2019-09-17", "level": "现金奖励", "num_look": 91196, "num_comment": 6, "author": "DD黃藥師BB", "tags": ["其他", "系统安全"], "text": "前两天在“蜂鸟”图标的社交网站看到一个高危样本，便下载审查一番。文件是一个压缩包，压缩包中有两个普通图片、一个EXE和一个DLL文件（wwlib.dll）。"}
{"title": "FreeBuf早报 | 台湾民众党官网遭黑客入侵？党员注册系统瘫痪；美国政府要求苹果、谷歌提交万名枪支相关APP用户数据；App违规收集个人信息举报平台建立，收到举报信息近八千条", "url": "https://www.freebuf.com/news/214405.html", "time": "2019-09-17", "level": "", "num_look": 85253, "num_comment": 2, "author": "kirazhou", "tags": ["资讯"], "text": "台北市长柯文哲日前成立台湾民众党，强调招收党员采云端作业，15日官网才刚刚上线，16日凌晨便遭到黑客入侵。"}
{"title": "FIT大会全面升级！CIS 2019网络安全创新大会11月上海开幕", "url": "https://www.freebuf.com/fevents/214388.html", "time": "2019-09-16", "level": "", "num_look": 85014, "num_comment": 4, "author": "FB独家", "tags": ["活动"], "text": "「CIS 2019网络安全创新大会」是原「FIT互联网安全创新大会」的全面升级，由国内领先的网络安全新媒体FreeBuf、赛博研究院、上海市信息安全行业协会联合主办。"}
{"title": "Sampler：Shell命令执行可视化和告警工具", "url": "https://www.freebuf.com/sectool/212820.html", "time": "2019-09-16", "level": "", "num_look": 119003, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "Sampler是一个用于shell命令执行，可视化和告警的工具。其配置使用的是一个简单的YAML文件。"}
{"title": "SUDO_KILLER可以帮助你识别并利用错误的Sudo规则与配置", "url": "https://www.freebuf.com/sectool/212615.html", "time": "2019-09-16", "level": "", "num_look": 90063, "num_comment": 90063, "author": "Alpha_h4ck", "tags": ["工具", "系统安全"], "text": "SUDO_KILLER这款工具可以帮助我们通过多种渠道利用SUDO来在Linux环境下实现提权。"}
{"title": "习近平论网络安全十大金句", "url": "https://www.freebuf.com/news/214304.html", "time": "2019-09-16", "level": "红色标题", "num_look": 181656, "num_comment": 12, "author": "Sandra1432", "tags": ["网络安全", "资讯"], "text": "2019年国家网络安全宣传周于9月16日至22日举行。关于网络安全，习近平一向高度重视，多次发表重要讲话。如何保障网络安全？网络安全工作有何新进展？"}
{"title": "Centos7离线安装metasploit详细教程", "url": "https://www.freebuf.com/sectool/213555.html", "time": "2019-09-16", "level": "", "num_look": 168347, "num_comment": 10, "author": "Tommg唐", "tags": ["工具"], "text": "建议在能访问互联网的环境里先按照步骤安装一遍，即能熟悉安装过程又能下载所需的软件包和各种依赖包。"}
{"title": "抽象语法树分析寻找FastJSON的Gadgets", "url": "https://www.freebuf.com/articles/web/213327.html", "time": "2019-09-16", "level": "现金奖励", "num_look": 636128, "num_comment": 9, "author": "淡蓝色de忧伤", "tags": ["WEB安全"], "text": "本文简单构建了一个判断模型，去尝试寻找FastJSON 的gadgets。"}
{"title": "DSMM之数据传输安全", "url": "https://www.freebuf.com/articles/database/213614.html", "time": "2019-09-16", "level": "现金奖励", "num_look": 598320, "num_comment": 14, "author": "LJ_Monica", "tags": ["数据安全"], "text": "前段时间整理了DSMM的相关内容，分成了数据安全能力成熟度模型总结与交流、数据采集安全两部分。今天介绍DSMM另一阶段的具体内容——数据传输安全。"}
{"title": "玩转Ysoserial-CommonsCollection的七种利用方式分析", "url": "https://www.freebuf.com/articles/web/214096.html", "time": "2019-09-16", "level": "现金奖励", "num_look": 235153, "num_comment": 4, "author": "平安银行应用安全团队", "tags": ["WEB安全"], "text": "CommonsCollection在java反序列化的源流中已经存在了4年多了，本文旨在整合分析一下ysoserial中CommonsCollection反序列化漏洞的多种利用手段。"}
{"title": "FreeBuf早报 | 网络安全专家称拍照比“剪刀手”会泄露指纹信息；美国制裁WannaCry和Sony Hack背后的朝鲜黑客；新研究暗示2016年乌克兰停电事件背后的潜在原因", "url": "https://www.freebuf.com/news/214294.html", "time": "2019-09-16", "level": "", "num_look": 65788, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "近来有一款名为“安全防护”的软件冒充北京警方的官方App。该App一般与“冒充公检法”的电话捆绑出现，迷惑市民输入银行卡信息。"}
{"title": "Slackor：Go语言写的一款C&C服务器", "url": "https://www.freebuf.com/sectool/212690.html", "time": "2019-09-15", "level": "", "num_look": 142771, "num_comment": 3, "author": "周大涛", "tags": ["工具"], "text": "Slackor是一款通过Go语言编写的C&C服务器，该项目的灵感来自Gcat和Twittor。"}
{"title": "渗透经验 | 我们是如何发现对欧洲政府的攻击的", "url": "https://www.freebuf.com/articles/network/212648.html", "time": "2019-09-15", "level": "", "num_look": 122098, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "寻找新型以及危险的网络威胁是PT ESC安全中心的主要工作之一，2019年中旬，PT ESC的分析人员发现了一起针对克罗地亚政府的网络攻击。"}
{"title": "从赎金角度看勒索病毒的演变", "url": "https://www.freebuf.com/news/212952.html", "time": "2019-09-15", "level": "", "num_look": 171760, "num_comment": 5, "author": "深信服千里目安全实验室", "tags": ["网络安全", "资讯"], "text": "自2017年一场全球性互联网灾难——Wannaycry爆发，勒索病毒正式进入人们的视野，如同打开了潘多拉的盒子。近年来，勒索病毒无论是传播方式，还是代码结构，都一直在“进化”。"}
{"title": "OT安全的定义及特点", "url": "https://www.freebuf.com/articles/ics-articles/213474.html", "time": "2019-09-15", "level": "", "num_look": 204666, "num_comment": 5, "author": "xu5eii", "tags": ["工控安全"], "text": "OT安全用于监测、测量和保护工业自动化、工业过程控制和相关系统的识别、感知和/或控制物理基础设施状态变化，还作为IT安全的补充，以保护IoT的安全为目标。"}
{"title": "一款漏洞验证框架的构思", "url": "https://www.freebuf.com/sectool/212700.html", "time": "2019-09-14", "level": "", "num_look": 133654, "num_comment": 5, "author": "＇ 0nise", "tags": ["工具"], "text": "本文章主要讲解一款漏洞验证框架的构思，并未详解内部的实现细节。"}
{"title": "挖洞经验 | 利用Device ID实现对任意Instagram账户的再次劫持", "url": "https://www.freebuf.com/vuls/212631.html", "time": "2019-09-14", "level": "", "num_look": 114861, "num_comment": 2, "author": "clouds", "tags": ["漏洞"], "text": "作者通过对设备号（Device ID）的利用，用同一用户移动端设备发起暴力猜解，再次实现对任意Instagram账户的劫持。"}
{"title": "远程进程Shellcode注入调试技巧", "url": "https://www.freebuf.com/articles/system/212248.html", "time": "2019-09-14", "level": "", "num_look": 134867, "num_comment": 134867, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "在病毒分析的过程中，时常会遇到很多病毒为了躲避杀软的检测，使用进程注入的方式，将shellcode注入到系统进程中执行，本文将介绍一些在遇到shellcode注入进程时所使用的调试技巧。"}
{"title": "BUF大事件丨「什么值得买」服务器遭受大面积攻击致罢工数小时;“钢铁侠”Instagram 账号被盗,黑客声称要送福利", "url": "https://www.freebuf.com/news/214213.html", "time": "2019-09-14", "level": "红色标题", "num_look": 102369, "num_comment": 102369, "author": "Darry端", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，「什么值得买」服务器遭受大面积攻击致罢工数小时，“钢铁侠”Instagram 账号被盗，黑客声称要送手机。"}
{"title": "渗透测试之我是如何做信息收集", "url": "https://www.freebuf.com/sectool/213371.html", "time": "2019-09-14", "level": "金币+10", "num_look": 227452, "num_comment": 10, "author": "yuegui_2004", "tags": ["工具"], "text": "今天主要介绍一下我在做信息收集的时候用到的一些工具和自己写的一些脚本，帮助在渗透过程中更加方便地做好这一步。"}
{"title": "对APT34泄露工具的分析：HighShell和HyperShell", "url": "https://www.freebuf.com/sectool/210860.html", "time": "2019-09-13", "level": "", "num_look": 110140, "num_comment": 3, "author": "辛木容是天才", "tags": ["工具"], "text": "前段时间APT34的6款工具被泄露，本文仅在技术角度对其中的HighShell和HyperShell进行分析。"}
{"title": "间谍软件潜入Google Play", "url": "https://www.freebuf.com/articles/network/212668.html", "time": "2019-09-13", "level": "", "num_look": 87656, "num_comment": 87656, "author": "Kriston", "tags": ["网络安全"], "text": "研究人员发现了第一个已知的间谍软件，它建立在Ahmyth开源恶意软件的基础上，并绕过了谷歌的应用审查过程。这个恶意的应用程序叫做RadioBalouch，又称RBMusic。"}
{"title": "钓鱼攻击姿势老套，不明真相还是上当", "url": "https://www.freebuf.com/articles/system/212565.html", "time": "2019-09-13", "level": "", "num_look": 101533, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近日，深信服安全团队捕获到一起高度个性化的钓鱼攻击事件，攻击者针对用户企业伪造了多份带有专业内容的攻击文档，通过邮件发送到目标邮箱，企图诱导用户打开附件中的文档。"}
{"title": "玩转摩尔斯电码：自制摩尔斯电码音频解析器", "url": "https://www.freebuf.com/articles/wireless/212819.html", "time": "2019-09-13", "level": "现金奖励", "num_look": 418192, "num_comment": 23, "author": "xutiejun", "tags": ["无线安全"], "text": "本文的主要目的是想设计一套系统，帮助听报员解放双耳，实现对音频的莫尔斯电码自动解码。"}
{"title": "谁是安全行业最 IN 黑客，霸占谷歌热搜15年？", "url": "https://www.freebuf.com/articles/paper/214212.html", "time": "2019-09-12", "level": "", "num_look": 101549, "num_comment": 1, "author": "奇安信代码卫士", "tags": ["安全报告"], "text": "威胁检测管理、事件响应和渗透测试专业公司 Redscan 发布《热搜中的网络安全》报告，该报告是基于从2004年到2019年15年间的谷歌趋势(Google Trend) 数据。"}
{"title": "当SQL注入遇到诡异的编码问题", "url": "https://www.freebuf.com/articles/web/213142.html", "time": "2019-09-12", "level": "现金奖励", "num_look": 180752, "num_comment": 22, "author": "r0yanx", "tags": ["WEB安全"], "text": "最近给甲方爸爸做渗透测试时发现了一个诡异的SQL注入，之所以说诡异，是因为该系统数据库连接编码与实际的数据库编码不一致，并且数据库表字段名使用了中文的字段名，导致通过正常手段无法获取到数据库数据。"}
{"title": "印巴战争阴影下的网络战：近期印巴APT组织攻击活动汇总", "url": "https://www.freebuf.com/articles/paper/213930.html", "time": "2019-09-12", "level": "", "num_look": 130224, "num_comment": 130224, "author": "腾讯电脑管家", "tags": ["安全报告"], "text": "印度和巴基斯坦同属于南亚地区的两个国家，但是由于一些历史原因，两国关系一直不大和睦，冲突不断。"}
{"title": "四分之一数据泄露背后是人为原因", "url": "https://www.freebuf.com/articles/database/212624.html", "time": "2019-09-12", "level": "", "num_look": 146226, "num_comment": 146226, "author": "Alpha_h4ck", "tags": ["数据安全"], "text": "根据Ponemon研究机构的最新调查数据，去年所发生的四分之一的数据泄露事件都是人为原因所导致的，而且同期的全部数据泄露事件所带来的平均经济损失约为392万美元，跟去年同期相比增长了1.5个百分点。"}
{"title": "继续聊聊梦里的那点事儿（下）", "url": "https://www.freebuf.com/articles/web/214076.html", "time": "2019-09-12", "level": "红色标题", "num_look": 202125, "num_comment": 22, "author": "Pannet", "tags": ["WEB安全"], "text": "经验告诉我，此类网站的管理员往往缺乏安全防护意识。比较容易下手的一般是职能比较偏僻、群众一般不会接触到，但确实存在的网站。"}
{"title": "2019上半年企业安全总结", "url": "https://www.freebuf.com/articles/es/211633.html", "time": "2019-09-12", "level": "", "num_look": 160659, "num_comment": 3, "author": "腾讯电脑管家", "tags": ["企业安全"], "text": "2019年6月，多家媒体报道，美国总统特朗普允许网络司令部对伊朗的火箭及导弹发射系统发起攻击。有报道称该攻击使伊朗这一武器系统“瘫痪”。"}
{"title": "FreeBuf早报 | 什么值得买网站、App无法访问：疑似服务器宕机；贝索斯等50多位CEO签联名信，呼吁国会制定数据隐私法；英特尔和NEC助力，东京奥运会将首次启用人脸识别系统", "url": "https://www.freebuf.com/news/214138.html", "time": "2019-09-12", "level": "", "num_look": 74446, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "美国、英国、澳大利亚等60多所大学被Colbalt Dickens黑客组织攻击，试图窃取研究和知识产权。攻击的目的是窃取知识产权，知识产权既可以被剥削，也可以出售以获取利润。"}
{"title": "等级保护主机安全：CentOS入侵防范（一）", "url": "https://www.freebuf.com/articles/terminal/212915.html", "time": "2019-09-12", "level": "现金奖励", "num_look": 155973, "num_comment": 6, "author": "起于凡而非于凡", "tags": ["终端安全"], "text": "本篇文章主要想说一说我对入侵防范中前3个测评项的理解（对于centos系统而言），如果大家有其他的看法或者思路也可以在回复中提出，我也跟着学习学习。"}
{"title": "macOS平台的一款Mach-O混淆工具", "url": "https://www.freebuf.com/sectool/212692.html", "time": "2019-09-12", "level": "", "num_look": 81934, "num_comment": 2, "author": "周大涛", "tags": ["工具"], "text": "MachObfuscator是一种与编程语言无关的Mach-O应用程序混淆器（适用于Apple平台）。"}
{"title": "否认删库跑路剧情，「什么值得买」服务器遭受大面积攻击致罢工数小时", "url": "https://www.freebuf.com/news/214144.html", "time": "2019-09-12", "level": "红色标题", "num_look": 157346, "num_comment": 8, "author": "shidongqi", "tags": ["资讯"], "text": "知名电商导购品牌什么值得买网站及APP突然出现故障，持续数小时无法访问的状态。删库跑路的剧本无不充斥着各大论坛、社交平台……"}
{"title": "Exploit自动生成引擎：Rex", "url": "https://www.freebuf.com/articles/system/197392.html", "time": "2019-09-11", "level": "", "num_look": 146502, "num_comment": 2, "author": "xiaohan0x00", "tags": ["系统安全"], "text": "来自 UCSB 的团队 Shellphish，为参加 DARPA 举办的 CGC 竞赛，设计并实现了 CRS（Cyber Reasoning System）Mechaphish。"}
{"title": "OSCP（Offensive Security Certified Professional）认证经验分享", "url": "https://www.freebuf.com/articles/others-articles/207347.html", "time": "2019-09-11", "level": "现金奖励", "num_look": 307498, "num_comment": 23, "author": "daxin09", "tags": ["其他"], "text": "四月份通过了OSCP的考试，把自己的经历和经验分享给大家，希望可以帮助到有需要的朋友多走些捷径，少走些弯路。"}
{"title": "完美世界信息安全部招聘——就等你啦！", "url": "https://www.freebuf.com/jobs/213450.html", "time": "2019-09-11", "level": "", "num_look": 85778, "num_comment": 7, "author": "pwrd", "tags": ["安全招聘"], "text": "长期以来，完美世界控股集团旗下产品遍布美、欧、亚等全球100多个国家和地区；在北京、香港、上海、重庆、成都、珠海，以及美国、荷兰、韩国、日本等地区设有20多个分支机构。"}
{"title": "钢铁侠Instagram账号被盗，黑客声称要送手机", "url": "https://www.freebuf.com/news/214031.html", "time": "2019-09-11", "level": "", "num_look": 90169, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "近日，Robert Downey Jr.的Instagram 账号遭到黑客入侵。所幸黑客并没有发布什么具有攻击性的信息，只是企图利用苹果手机虚假赠品以引诱粉丝点击来获利。"}
{"title": "MongoDB未授权访问漏洞分析及整改建议", "url": "https://www.freebuf.com/vuls/212799.html", "time": "2019-09-11", "level": "现金奖励", "num_look": 285337, "num_comment": 1, "author": "Shad0wpf_", "tags": ["数据安全", "漏洞"], "text": "对外开放的MongoDB服务，未配置访问认证授权，无需认证连接数据库后对数据库进行任意操作（增、删、改、查高危动作），存在严重的数据泄露风险。"}
{"title": "黑客利用商业基础设施犯罪的6种方式", "url": "https://www.freebuf.com/articles/network/212823.html", "time": "2019-09-11", "level": "", "num_look": 90638, "num_comment": 1, "author": "Sandra1432", "tags": ["网络安全"], "text": "当谈到网络犯罪基础设施时，当属暗网高光时刻，秘密的犯罪市场、非法洗钱交易和僵尸网络服务等。然而，不仅仅是暗网，那些网络犯罪分子从合法的商业基础设施中也可以获得他们所需要的东西。"}
{"title": "FreeBuf早报 | 卡巴斯基为电子竞技比赛推出反作弊解决方案；欧洲警方逮捕了暗网假钞交易商；美国网络司令部近期在VT上提交了11个和Lazarus组织相关的样本", "url": "https://www.freebuf.com/news/214009.html", "time": "2019-09-11", "level": "", "num_look": 76949, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "据福布斯杂志网站报道，最近，美国政府希望苹果和谷歌提交使用枪支相关应用的用户数据，包括姓名、电话号码和其他身份识别数据。涉及的用户数量至少有1万名。"}
{"title": "境外APT 组织“响尾蛇”对我国发起攻击事件报告", "url": "https://www.freebuf.com/articles/paper/213799.html", "time": "2019-09-11", "level": "", "num_look": 153431, "num_comment": 1, "author": "瑞星", "tags": ["安全报告"], "text": "近日，瑞星安全研究院捕获到两起针对中国的APT攻击事件，一起是针对各国驻华大使馆，另一起是针对某科技有限公司驻外代表处。"}
{"title": "针对MySQL数据库的勒索病毒预警", "url": "https://www.freebuf.com/articles/system/213975.html", "time": "2019-09-10", "level": "", "num_look": 170496, "num_comment": 2, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近期，深信服安全团队追踪到国内出现了针对MySQL数据库的勒索攻击行为，截至目前已监测到的攻击行为主要体现为对数据库进行篡改与窃取。"}
{"title": "ModSecurity：一款优秀的开源WAF", "url": "https://www.freebuf.com/sectool/211354.html", "time": "2019-09-10", "level": "", "num_look": 271754, "num_comment": 17, "author": "owensky", "tags": ["工具"], "text": "ModSecurity是一个开源的跨平台Web应用程序防火墙（WAF）引擎，用于Apache，IIS和Nginx，由Trustwave的SpiderLabs开发。"}
{"title": "如何开展电力行业的安全检查评估", "url": "https://www.freebuf.com/articles/ics-articles/212503.html", "time": "2019-09-10", "level": "红色标题", "num_look": 280336, "num_comment": 8, "author": "云火安全实验室", "tags": ["工控安全"], "text": "电力关键信息基础设施网络安全直接影响金融、能源、通信、交通等其他国家关键基础设施安全，关系国家安全、经济发展和国计民生，历来都是网络战和网络攻击的首选目标。"}
{"title": "HTTP被动扫描代理的那些事", "url": "https://www.freebuf.com/articles/web/212382.html", "time": "2019-09-10", "level": "现金奖励", "num_look": 285964, "num_comment": 15, "author": "koalrx", "tags": ["WEB安全"], "text": "HTTP 代理这个名词对于安全从业人员应该都是熟知的，我们常用的抓包工具 burp 就是通过配置 HTTP 代理来实现请求的截获修改等。然而国内对这一功能的原理类文章很少，有的甚至有错误。"}
{"title": "挖洞经验 | 谷歌peering.google.com中的本地文件包含（LFI）漏洞", "url": "https://www.freebuf.com/vuls/212222.html", "time": "2019-09-10", "level": "", "num_look": 146962, "num_comment": 3, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本地文件包含漏洞（LFI）可以造成信息泄露甚至入侵系统，即使其中的包含代码不具备执行权限，但攻击者也可以从中获取一些深入渗透目标系统的有价值信息。"}
{"title": "京东云招聘安全产品研发岗", "url": "https://www.freebuf.com/jobs/212134.html", "time": "2019-09-10", "level": "", "num_look": 75324, "num_comment": 2, "author": "freiger0216", "tags": ["安全招聘"], "text": "京东云是京东集团旗下的云计算综合服务提供商，拥有全球领先的云计算技术和完整的服务平台。"}
{"title": "CTF工控信息安全赛分析思路探讨（一）", "url": "https://www.freebuf.com/articles/ics-articles/212376.html", "time": "2019-09-10", "level": "", "num_look": 224759, "num_comment": 1, "author": "云火安全实验室", "tags": ["工控安全"], "text": "最近参加了2019工业信息安全技能大赛，发现一些有意思的题目，故把解题思路写出来，抛砖引玉，与大家一起交流，共同进步。"}
{"title": "移动基带安全研究系列之一 ：概念和系统篇", "url": "https://www.freebuf.com/articles/terminal/213807.html", "time": "2019-09-10", "level": "", "num_look": 128808, "num_comment": 7, "author": "阿里安全", "tags": ["终端安全"], "text": "随着5G大浪潮的推进，未来万物互联将会有极大的井喷爆发的可能，而移动基带系统作为连接世界的桥梁，必将成为未来非常重要的基础设施，而基础设施的技术自主能力已经上升到非常重要的国家层面上的战略意义。"}
{"title": "FreeBuf早报 | APT3能够修改被盗的NSA网络武器；美国起诉一名中国教授协助华为窃取技术；英网络部队迎来女掌门：聚集精英黑客，攻击敌国", "url": "https://www.freebuf.com/news/213895.html", "time": "2019-09-10", "level": "", "num_look": 95413, "num_comment": 2, "author": "kirazhou", "tags": ["资讯"], "text": "外媒报道称，APT3从美国国家安全局窃取了网络武器，并对其进行反向解析以建立其武器库。"}
{"title": "揭秘地下黑客论坛最流行的恶意软件和黑客工具", "url": "https://www.freebuf.com/articles/system/213765.html", "time": "2019-09-09", "level": "", "num_look": 214622, "num_comment": 5, "author": "熊猫正正", "tags": ["系统安全"], "text": "通过对Recorded Future平台索引的所有地下黑客论坛分析2018年5月至2019年5月期间超过390万个帖子，Insikt Group确定了地下黑客论坛中引用的顶级恶意软件变种。"}
{"title": "官宣｜WitAwards 2019评选规则正式发布", "url": "https://www.freebuf.com/fevents/213307.html", "time": "2019-09-09", "level": "", "num_look": 62949, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "WITAwards中国网络安全年度创新评选，致力于最专业的角度和最公正的态度，发掘优秀行业标杆，推进网络安全产业不断创新前行。"}
{"title": "梦里参加攻防演习活动的过程分享（上）", "url": "https://www.freebuf.com/vuls/212909.html", "time": "2019-09-09", "level": "现金奖励", "num_look": 983507, "num_comment": 37, "author": "Pannet", "tags": ["WEB安全", "漏洞"], "text": "随着国家对网络安全的进一步重视，攻防演练活动变得越来越重要，规模也更大。高强度的演习让无论是蓝方还是红方都变得精疲力竭，借用朋友圈里一位大佬的一句话：结束的这一天，安全圈的氛围像过年了一样。"}
{"title": "挖洞经验 | 通过购物车参数篡改实现低价免费购买商品", "url": "https://www.freebuf.com/vuls/212089.html", "time": "2019-09-09", "level": "", "num_look": 169936, "num_comment": 11, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文分享的Writeup是某流行电子商务购物网站的一个参数篡改漏洞（Parameter Tampering），作者利用该漏洞可以更改购物车中商品数量为负数，通过最终的正负支付金额平衡，实现以最低价格甚至是免费方式购物。"}
{"title": "斗牛APP招聘安全测试工程师", "url": "https://www.freebuf.com/jobs/213122.html", "time": "2019-09-09", "level": "", "num_look": 65516, "num_comment": 65516, "author": "SixSixSix", "tags": ["安全招聘"], "text": "斗牛APP一直不断满足着潮流爱好者、Sneakerhead的需求，连续推出真伪鉴定、率先预售、即时转售以及共享仓等球鞋交易模块，致力于建立拥有全球资源的一站式球鞋交易平台，让更多年轻人驻足于此，让球鞋交易变得便捷…"}
{"title": "摩诃草团伙利用公用平台分发C&C配置攻击活动揭露", "url": "https://www.freebuf.com/articles/system/212584.html", "time": "2019-09-09", "level": "", "num_look": 104941, "num_comment": 2, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "近期，奇安信威胁情报中心红雨滴团队利用公开情报发现一个摩诃草团伙的XLSM诱饵文档样本，经过分析发现其载荷主要通过 Github 和 Feed43获取加密的 C&C 配置。"}
{"title": "网络安全能力成熟度模型：D2-网络文化与社会（一）", "url": "https://www.freebuf.com/articles/paper/212774.html", "time": "2019-09-09", "level": "", "num_look": 91246, "num_comment": 5, "author": "宇宸de研究室", "tags": ["安全报告"], "text": "从本维度开始，从国家层面来探讨网络文化和社会的安全能力建设，并从战略和政策的高度来逐步执行。本章节为网络文化和社会维度的第一部分，网络安全思维。"}
{"title": "等保测评主机安全：centos访问控制（续）", "url": "https://www.freebuf.com/articles/system/212650.html", "time": "2019-09-09", "level": "现金奖励", "num_look": 123921, "num_comment": 2, "author": "起于凡而非于凡", "tags": ["系统安全"], "text": "权限控制在等保测评里仅仅说了要求，但是怎么落地却基本没写。所以，我觉得还是有必要了解一下centos系统大概有什么方法可以实现对用户的权限控制，不至于测评的时候完全不知道怎么测。"}
{"title": "FreeBuf早报 | 维基百科遭到DDoS网络攻击宕机；两家PE开价160亿美元收购赛门铁克消费业务；成千上万的服务器感染了Lilocked Ransomware", "url": "https://www.freebuf.com/news/213771.html", "time": "2019-09-09", "level": "", "num_look": 88881, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "美国国土安全部计划扩大针对签证申请者、移民、避难者和难民的社交媒体账号收集范围。"}
{"title": "TWINT：一款Twitter信息爬取工具", "url": "https://www.freebuf.com/sectool/212601.html", "time": "2019-09-08", "level": "", "num_look": 258350, "num_comment": 7, "author": "周大涛", "tags": ["工具"], "text": "Twint是一个用Python写的Twitter抓取工具，允许从Twitter配置文件中抓取推文，不使用Twitter的API。"}
{"title": "挖洞经验 | 从Youtube的视频ID和频道ID中发现漏洞", "url": "https://www.freebuf.com/vuls/211973.html", "time": "2019-09-08", "level": "", "num_look": 158600, "num_comment": 3, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "大家好，今天分享这篇Writeup是关于Youtube的两个漏洞，确切来说，是Youtube Studio平台（https://studio.youtube.com/）漏洞。"}
{"title": "关于个人信息保护的一点想法", "url": "https://www.freebuf.com/articles/neopoints/213046.html", "time": "2019-09-08", "level": "", "num_look": 99356, "num_comment": 10, "author": "當春日漸暖", "tags": ["观点"], "text": "个人信息保护无疑是最近几年安全圈最为火热的词之一。好像自从2016年欧盟GDPR审议通过之后，每次业界交流都必谈个人信息保护，甚至对个人信息保护、信息安全毫无概念的行政同事都能跟你侃上两句。"}
{"title": "五大网络威胁检测和响应的挑战", "url": "https://www.freebuf.com/articles/network/212533.html", "time": "2019-09-08", "level": "", "num_look": 89253, "num_comment": 2, "author": "Sandra1432", "tags": ["网络安全"], "text": "从网络安全到数据泄露关键一步，即威胁的检测和响应。如果跳过了这一步，那么企业将为数据泄露付出巨大代价。"}
{"title": "钓鱼邮件中的Remcos RAT变种分析", "url": "https://www.freebuf.com/articles/network/212400.html", "time": "2019-09-07", "level": "", "num_look": 135778, "num_comment": 135778, "author": "Kriston", "tags": ["网络安全"], "text": "7月份，我们发现了一个伪装成新订单通知的钓鱼邮件，里面带有一个恶意附件，会导致Remcos RAT（被Trend Micro检测为BKDR_SOCMER.SM）这一恶意软件的执行。"}
{"title": "威胁预警 | 蠕虫级漏洞BlueKeep(CVE-2019-0708) EXP被公布", "url": "https://www.freebuf.com/vuls/213745.html", "time": "2019-09-07", "level": "红色标题", "num_look": 410934, "num_comment": 11, "author": "斗象智能安全平台", "tags": ["漏洞"], "text": "9月7日上午，睁开眼，连续多雨的上海终于放晴了，朋友圈却下起了“暴雨”——那个号称wannacry级别的漏洞 BlueKeep（CVE-2019-0708）漏洞利用发布了。"}
{"title": "一例信息窃取木马分析报告", "url": "https://www.freebuf.com/articles/network/211875.html", "time": "2019-09-07", "level": "", "num_look": 115521, "num_comment": 4, "author": "ZInsight团队", "tags": ["网络安全"], "text": "近日，中兴通讯高级邮件防御系统捕获一例病毒样本。通过分析发现，该样本会通过进程替换等方式释放，并在傀儡进程中运行AgentTesla木马以达到信息窃取的目的。"}
{"title": "攻击代码被公布，Windows远程桌面服务代码执行漏洞（CVE-2019-0708）预警", "url": "https://www.freebuf.com/vuls/213754.html", "time": "2019-09-07", "level": "", "num_look": 208508, "num_comment": 208508, "author": "深信服千里目安全实验室", "tags": ["漏洞"], "text": "2019年9月7日凌晨，深信服安全团队监测到关于CVE-2019-0708相关情报，该情报披露CVE-2019-0708漏洞利用代码，该EXP可以通过RDP协议进行远程代码执行攻击。"}
{"title": "漏洞扫描技巧之Web漏洞扫描器研究", "url": "https://www.freebuf.com/articles/web/212015.html", "time": "2019-09-07", "level": "", "num_look": 180025, "num_comment": 3, "author": "小米安全中心", "tags": ["WEB安全"], "text": "之前我们简单介绍了一下扫描器中爬虫的部分，接下来将继续介绍一下扫描器中一些我们认为比较有趣的技巧。"}
{"title": "BUF大事件丨工信部就“ZAO”App网络数据安全问题约谈；中国互联网发展状况报告发布；WitAwards 2019报名开启", "url": "https://www.freebuf.com/news/213725.html", "time": "2019-09-07", "level": "红色标题", "num_look": 76110, "num_comment": 76110, "author": "willhuang", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，工信部就“ZAO”App网络数据安全问题开展问询约谈；中国互联网发展状况报告发布；WitAwards 2019报名开启。"}
{"title": "开源软件的供应链安全吗？黑客正在利用源代码传播恶意软件", "url": "https://www.freebuf.com/articles/network/212434.html", "time": "2019-09-07", "level": "", "num_look": 104641, "num_comment": 104641, "author": "kirazhou", "tags": ["网络安全"], "text": "过去一年里，发生了一连串开源软件遭受供应链攻击的事件，并且态势愈演愈烈。就在最近，甚至发现2个独立的后门漏洞进入了数十万服务器管理员下载的库中。"}
{"title": "用Golang打造一款便携式网络拓扑可视化的工具", "url": "https://www.freebuf.com/sectool/212374.html", "time": "2019-09-06", "level": "现金奖励", "num_look": 159862, "num_comment": 5, "author": "releasel0ck", "tags": ["工具"], "text": "之前做内网渗透测试的时候，一直想要有一款能够格式化存储收集到的信息，并且可以方便的查找出重要信息的工具。前段时间看到了Leprechaun 这个工具，给了我一些想法。"}
{"title": "科创安全第一股安博通上市，市值高点突破100亿元", "url": "https://www.freebuf.com/news/213679.html", "time": "2019-09-06", "level": "", "num_look": 73680, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "科创安全第一股安博通SH688168成功上市，市值高点达到107.5亿元，截止上午收盘时，股价为181.05元，对应市值92.66亿元。"}
{"title": "自古逢秋悲寂寥：浅谈瑞华的“分手季”", "url": "https://www.freebuf.com/news/213476.html", "time": "2019-09-06", "level": "红色标题", "num_look": 126452, "num_comment": 5, "author": "kirazhou", "tags": ["观点", "资讯"], "text": "“老牌、多金、有实力。”但是，为啥安全圈的大佬们不爱瑞华了？"}
{"title": "挖洞经验 | 绕过WAF限制利用php:方法实现OOB-XXE漏洞利用", "url": "https://www.freebuf.com/vuls/211822.html", "time": "2019-09-06", "level": "", "num_look": 155725, "num_comment": 1, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "作者在某个OOB-XXE漏洞测试中遇到过这样一种场景：目标应用后端系统WAF防火墙阻挡了包含DNS解析在内的所有出站请求（Outgoing Request），通过利用php://filter//的封装协议，作者成功实现了OOB-XXE漏洞测试。"}
{"title": "跟谁学（美股上市公司）招聘各类安全工程师", "url": "https://www.freebuf.com/jobs/212778.html", "time": "2019-09-06", "level": "", "num_look": 92571, "num_comment": 1, "author": "我要吸得你喵喵叫", "tags": ["安全招聘"], "text": "百家互联是一家中国领先的互联网教育科技公司，2014年6月由陈向东带领创建， 团队成员主要由来自新东方等著名教育培训机构及百度、阿里、腾讯等互联网公司的精英组成。"}
{"title": "Separ木马分析报告案例分析", "url": "https://www.freebuf.com/articles/network/211691.html", "time": "2019-09-06", "level": "", "num_look": 93711, "num_comment": 2, "author": "ZInsight团队", "tags": ["网络安全"], "text": "日前，中兴通讯部署的高级邮件防御系统捕获了一批可疑邮件，通过安全人员分析，发现是一轮Separ木马攻击。"}
{"title": "Adobe ColdFusion RCE(CVE-2019-7839) 漏洞分析", "url": "https://www.freebuf.com/vuls/210386.html", "time": "2019-09-06", "level": "", "num_look": 103685, "num_comment": 1, "author": "Knownsec知道创宇", "tags": ["漏洞"], "text": "Adobe ColdFusion 是一个商用的快速开发平台。它可以作为一个开发平台使用，也可以提供Flash远程服务或者作为 Adobe Flex应用的后台服务器。"}
{"title": "FreeBuf早报 | 教育部将发起教育 App 专项清理行动；Facebook 数亿用户电话号码泄漏；Google因违反儿童隐私保护法被罚1.7亿美元", "url": "https://www.freebuf.com/news/213643.html", "time": "2019-09-06", "level": "", "num_look": 61648, "num_comment": 4, "author": "shidongqi", "tags": ["资讯"], "text": "联邦贸易委员会 (FTC)宣布，Google/YouTube 因违反儿童在线隐私保护法被罚 1.7 亿美元。这是 FTC 至今开出的最大民事罚单。"}
{"title": "2019可信访问报告：限制登录位置最受企业青睐", "url": "https://www.freebuf.com/articles/others-articles/212608.html", "time": "2019-09-06", "level": "红色标题", "num_look": 76617, "num_comment": 3, "author": "kirazhou", "tags": ["其他"], "text": "这份涵盖了来自2400万台设备，100万个应用和服务以及数十亿个身份验证数据的报告，所揭示的先进技术、网络安全和认证趋势。"}
{"title": "漏洞预警 | Fastjson远程拒绝服务漏洞", "url": "https://www.freebuf.com/vuls/213609.html", "time": "2019-09-05", "level": "", "num_look": 302468, "num_comment": 16, "author": "斗象智能安全平台", "tags": ["漏洞"], "text": "Fastjson是阿里巴巴的开源JSON解析库，它可以解析JSON格式的字符串，支持将Java Bean序列化为JSON字符串，也可以从JSON字符串反序列化到JavaBean。"}
{"title": "Dwarf：一款基于Pyqt5和Frida的逆向分析调试工具", "url": "https://www.freebuf.com/sectool/212123.html", "time": "2019-09-05", "level": "", "num_look": 131657, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Dwarf本质上是一款调试器，这个项目起初知识想使用PyQt来给Frida增加一个有好的UI界面，并且主要用于Android端。但是通过开发人员的努力之后，该工具已经支持iOS端了。"}
{"title": "三步构造零信任安全网络", "url": "https://www.freebuf.com/articles/network/211475.html", "time": "2019-09-05", "level": "", "num_look": 123763, "num_comment": 2, "author": "Kriston", "tags": ["网络安全"], "text": "随着移动设备涌入企业，物联网（IoT）的扩张，以及网络罪犯数量和复杂程度的增长，许多安全专家认为零信任是抵御不断变化网络和数据安全威胁的最好方法。"}
{"title": "浅谈ARP欺骗的实现与防御", "url": "https://www.freebuf.com/articles/network/210852.html", "time": "2019-09-05", "level": "现金奖励", "num_look": 215061, "num_comment": 6, "author": "原来是小名啊", "tags": ["网络安全"], "text": "在以太网协议中规定，同一局域网中的一台主机要和另一台主机进行直接通信，必须要知道目标主机的MAC地址。而在TCP/IP协议中，网络层和传输层只关心目标主机的IP地址。"}
{"title": "i云保诚招安全渗透扫描工程师", "url": "https://www.freebuf.com/jobs/212655.html", "time": "2019-09-05", "level": "", "num_look": 59811, "num_comment": 5, "author": "longhuayiyuan", "tags": ["安全招聘"], "text": "i云保作为第三方互联网保险平台，为会员提供丰富的互联网推广工具，以及强大的技术服务支持，帮助会员建立全流程全方位的独立触客推广服务能力。"}
{"title": "日活百万级病毒“DropperNecro”分析报告", "url": "https://www.freebuf.com/articles/terminal/213324.html", "time": "2019-09-05", "level": "", "num_look": 121056, "num_comment": 2, "author": "腾讯手机管家", "tags": ["终端安全"], "text": "近期腾讯安全便发现一款恶意病毒“DropperNecro”，该病毒通过母包中的AdHub SDK代码加载解密恶意子包，恶意子包会链接C&C服务器下载恶意代码块感染用户手机设备，在用户手机中植入后门程序。"}
{"title": "Macro_Pack中的宏代码混淆方法分析", "url": "https://www.freebuf.com/sectool/211592.html", "time": "2019-09-05", "level": "", "num_look": 82390, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["工具"], "text": "Macro_Pack是一个用于自动化混淆及生成Office文档、VB脚本、快捷方式等文件的工具，其主要用于渗透测试、demo以及社会工程学评估。"}
{"title": "利用吃灰的钓鱼利器（esp8266）做一个手机远程遥控小车", "url": "https://www.freebuf.com/articles/others-articles/210044.html", "time": "2019-09-05", "level": "现金奖励", "num_look": 158656, "num_comment": 8, "author": "中华隐士家族", "tags": ["其他"], "text": "本着“废物”利用的原则，今天来打造一个手机遥控的玩具小车，使用WiFi接入，当设备和手机在同一个局域网中，为局域网通信，其余情况，使用MQTT远程通信。"}
{"title": "FreeBuf早报 | 诈骗者利用深度伪造模仿CEO声音，借此转账骗走24.3万美元；中国互联网发展状况报告：境内约 2.6 万网站被植入后门；三星、华为、LG和索尼手机容易受到流氓“供应”信息的攻击", "url": "https://www.freebuf.com/news/213513.html", "time": "2019-09-05", "level": "", "num_look": 73459, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "现在已经很难区分出来利用深度伪造技术制作的假文本、假视频。现在，这种情况似乎又延伸到了假语音。"}
{"title": "教你如何搭建威胁情报库", "url": "https://www.freebuf.com/articles/network/210451.html", "time": "2019-09-05", "level": "", "num_look": 173907, "num_comment": 7, "author": "mikewho", "tags": ["网络安全"], "text": "威胁情报是一种基于数据的，对组织即将面临的攻击进行预测的行动。预测（基于数据）将要来临的的攻击。"}
{"title": "从习总书记讲话看中国网络空间安全发展趋势", "url": "https://www.freebuf.com/articles/network/213433.html", "time": "2019-09-05", "level": "", "num_look": 111721, "num_comment": 1, "author": "爱加密123", "tags": ["网络安全"], "text": "物联网、工业互联网形成的万物互联成为未来的主流，由此信息安全成为数字化社会发展的重要底层架构和基石。"}
{"title": "利用Redis未授权访问漏洞进行门罗币（XMR）挖矿事件分析", "url": "https://www.freebuf.com/vuls/213484.html", "time": "2019-09-04", "level": "红色标题", "num_look": 197040, "num_comment": 2, "author": "安洵信息", "tags": ["漏洞", "网络安全"], "text": "2019年8月30日，安洵信息星际实验室蜜网捕获到利用Redis未授权访问漏洞的攻击行为。Redis因配置不当可以导致未授权访问，被攻击者恶意利用。"}
{"title": "分享十个最佳的免费密码管理器", "url": "https://www.freebuf.com/sectool/211709.html", "time": "2019-09-04", "level": "红色标题", "num_look": 277359, "num_comment": 14, "author": "线性代数lzh", "tags": ["工具"], "text": "密码管理器始终有助于制作强密码，以保护您的设备，在线银行帐户和其他数据源免受未经授权的访问。在本文中，我们重点介绍适用于Android，Mac 和 iPhone 的最佳开源密码管理器。"}
{"title": "Android 0day收购价高达250万美金，首次反超iOS", "url": "https://www.freebuf.com/news/213405.html", "time": "2019-09-04", "level": "红色标题", "num_look": 125901, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "近日，漏洞收购商Zerodium更新了安卓和iOS的0day漏洞收购价，发现自2015年公司成立以来，安卓0day漏洞价格首次高于iOS漏洞价格。"}
{"title": "挖洞经验 | 从谷歌防灾地图服务发现Google.org的XSS和Clickjacking漏洞", "url": "https://www.freebuf.com/vuls/211517.html", "time": "2019-09-04", "level": "", "num_look": 123058, "num_comment": 4, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "除了谷歌地图之外，可能很少有人知道谷歌的在线防灾地图（Google Crisis Map），它创建于2012年，Web架构更新缓慢，网站访问量相对较少。"}
{"title": "京东数科招聘安全合规工程师", "url": "https://www.freebuf.com/jobs/212752.html", "time": "2019-09-04", "level": "", "num_look": 75640, "num_comment": 5, "author": "woshiyieryi", "tags": ["安全招聘"], "text": "京东数字科技集团创立于京东集团内部，公司以大数据、人工智能、物联网、区块链等时代前沿技术为基础，建立起核心的数字化风险管理能力、用户运营能力、产业理解能力和B2B2C模式的企业服务能力。"}
{"title": "如何发挥黑客技术赚到百万美元？来认识一下六位百万美元黑客", "url": "https://www.freebuf.com/articles/people/213339.html", "time": "2019-09-04", "level": "", "num_look": 272951, "num_comment": 6, "author": "clouds", "tags": ["人物志"], "text": "你想成为百万美元黑客吗？对于大多数起步从事网络安全行业的人来说，他们认为要在黑客这个行当赚取百万美元，可能需要冒着被抓坐牢的风险才行。"}
{"title": "首例微信支付赎金勒索病毒案宣判，这名“95后”获刑6年半", "url": "https://www.freebuf.com/news/213362.html", "time": "2019-09-04", "level": "", "num_look": 137121, "num_comment": 17, "author": "百里不守约", "tags": ["资讯"], "text": "9月3日，东莞市第三人民法院对国内首例微信支付赎金的勒索病毒案作出一审判决，以犯破坏计算机信息系统罪判处制作该病毒的“95后”男子罗某有期徒刑六年六个月。"}
{"title": "安全运维工作中的机器学习应用", "url": "https://www.freebuf.com/articles/es/211990.html", "time": "2019-09-04", "level": "", "num_look": 138259, "num_comment": 2, "author": "wangyiyunyidun", "tags": ["企业安全"], "text": "除了对外的沟通和业务对接相关工作，大部分安全运维的日常工作相对固定，如漏洞审核、安全产品运维、日志审计和应急响应等工作。"}
{"title": "西门子S7通信过程及重放攻击分析", "url": "https://www.freebuf.com/articles/ics-articles/212283.html", "time": "2019-09-04", "level": "红色标题", "num_look": 255762, "num_comment": 3, "author": "leoyyx", "tags": ["工控安全"], "text": "根据之前多位大神S7协议相关的分析，决定自己动手实操一下，通过payload重放实现对PLC的启停及DO数据的读写，实验过程记录下来跟大家分享一下。"}
{"title": "用数字揭穿5个网络安全误区", "url": "https://www.freebuf.com/articles/network/212237.html", "time": "2019-09-04", "level": "", "num_look": 99017, "num_comment": 3, "author": "Sandra1432", "tags": ["网络安全"], "text": "了解最大的网络风险及防御方法对于企业安全来说至关重要。关于网络安全的很多说法往往夸大其词，而人们也深信不疑。本文将用真实的统计数据来揭穿以下5个网络安全误区。"}
{"title": "FreeBuf早报 | 朝鲜扩充网安院系；首例微信支付赎金勒索病毒案宣判；Android漏洞利用的价值首次超过iOS漏洞", "url": "https://www.freebuf.com/news/213348.html", "time": "2019-09-04", "level": "", "num_look": 59681, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "东莞市第三人民法院对国内首例微信支付赎金的勒索病毒案作出一审判决，以犯破坏计算机信息系统罪判处制作该病毒的“95后”男子罗某有期徒刑六年六个月。"}
{"title": "Gorgon APT组织再做文章：DropBox到NJRat的曲折历程", "url": "https://www.freebuf.com/articles/system/213082.html", "time": "2019-09-04", "level": "", "num_look": 87922, "num_comment": 87922, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "近日，奇安信威胁情报中心发布了《Gorgon黑客组织再显新招：通过在线网盘发起“三重奏”攻击》的分析报告。"}
{"title": "抢占年度安全C位！WitAwards 2019中国网络安全创新年度评选报名开启", "url": "https://www.freebuf.com/fevents/212311.html", "time": "2019-09-03", "level": "红色标题", "num_look": 77413, "num_comment": 2, "author": "FB独家", "tags": ["活动"], "text": "WitAwards 2019中国网络安全创新年度评选即日起正式启动！"}
{"title": "HiddenEye：带有高级功能的现代钓鱼工具", "url": "https://www.freebuf.com/sectool/212130.html", "time": "2019-09-03", "level": "", "num_look": 139899, "num_comment": 9, "author": "Alpha_h4ck", "tags": ["工具"], "text": "HiddenEye是一款带有高级功能的现代网络钓鱼工具，目前该工具仅支持Android平台，广大研究人员可以使用该工具来进行网络钓鱼测试。"}
{"title": "为协助破案，FBI要求谷歌提供劫案现场100英尺内Google用户数据", "url": "https://www.freebuf.com/news/213684.html", "time": "2019-09-03", "level": "", "num_look": 18872, "num_comment": 18872, "author": "百里不守约", "tags": ["资讯"], "text": "类似Google、苹果这种超级科技巨头，所掌握的用户信息越来越庞大，经常会被执法机构要求提供特定数据来协助破案。近期一起银行劫案困扰了FBI很久，于是他们找到了Google求助……"}
{"title": "【FreeBuf字幕组】Hacker101白帽黑客进阶之路", "url": "https://www.freebuf.com/video/213279.html", "time": "2019-09-03", "level": "红色标题", "num_look": 171078, "num_comment": 4, "author": "willhuang", "tags": ["视频"], "text": "课程以“LEARN HOW TO HACK”为主旨，包含了相关的视频、资源和动手实验，目的在于教授Hacking思维和知识，入门Bug Bounty Hunter（漏洞赏金猎人）。"}
{"title": "默安科技云舒：十五年后，重谈安全开发体系", "url": "https://www.freebuf.com/articles/es/213118.html", "time": "2019-09-03", "level": "红色标题", "num_look": 472017, "num_comment": 19, "author": "默安科技_影武者实验室", "tags": ["企业安全"], "text": "前些时候我讲了点“欺骗防御”的事情，并且预言了它的发展趋势。没想到，突如其来的一场全国范围的攻防演练让它爆红。在攻防博弈中，防御方第一次抢到了一点先机，给攻击者带来了一些不确定性。"}
{"title": "电子邮件安全问题分析（二）", "url": "https://www.freebuf.com/articles/network/212273.html", "time": "2019-09-03", "level": "", "num_look": 145005, "num_comment": 2, "author": "Kriston", "tags": ["网络安全"], "text": "火眼2019年第二季度进行了邮件安全调查，对人们最关心的5个问题进行了探讨。"}
{"title": "微众银行渗透安全工程师招聘", "url": "https://www.freebuf.com/jobs/212402.html", "time": "2019-09-03", "level": "", "num_look": 80407, "num_comment": 1, "author": "k2016", "tags": ["安全招聘"], "text": "微众银行是国内首家开业的民营银行，由腾讯、百业源和立业等多家知名企业发起设立，于2014年12月获得由深圳银监局颁发的金融许可证。"}
{"title": "谷歌提醒iPhone用户注意数据窃取恶意软件攻击", "url": "https://www.freebuf.com/articles/database/213201.html", "time": "2019-09-03", "level": "", "num_look": 109652, "num_comment": 3, "author": "Sandra1432", "tags": ["数据安全"], "text": "今年年初谷歌的威胁分析小组（TAG）和Project Zero团队发现了5条提权在野漏洞利用链。这些漏洞链来源不明，且会危害用户的iOS设备。"}
{"title": "WannaMine挖矿木马再活跃，14万台linux系统受攻击广东省为重灾区", "url": "https://www.freebuf.com/articles/network/212166.html", "time": "2019-09-03", "level": "", "num_look": 123660, "num_comment": 3, "author": "腾讯电脑管家", "tags": ["网络安全"], "text": "这是一起针对SSH服务器弱口令爆破攻击事件，由于发现及时，工程师及时协助客户进行隔离及杀毒，并未造成损失。"}
{"title": "FreeBuf早报 | 犯罪团伙给网吧电脑装木马远程挖矿被查获，涉案金额上亿元；华为高管：禁止华为不会让澳大利亚的网络更安全；前苏联遗留水电站吸引大量比特币采矿企业", "url": "https://www.freebuf.com/news/213160.html", "time": "2019-09-03", "level": "", "num_look": 86666, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "最近，湖南衡阳市公安机关对外发布了一起特大非法控制计算机“挖矿”的案件。据初步统计，涉案金额过亿元。"}
{"title": "钓鱼邮件故事一则与处理方法分享", "url": "https://www.freebuf.com/articles/es/211692.html", "time": "2019-09-03", "level": "", "num_look": 155077, "num_comment": 2, "author": "ZInsight团队", "tags": ["企业安全"], "text": "在一个风和日丽的早晨，员工小B正在为即将参加的新加坡RSA会议作准备，他与RSA会方联系，需要邮寄邀请函已办理签证，约定好使用SF到付。"}
{"title": "浅谈电子数字取证技术", "url": "https://www.freebuf.com/articles/network/211643.html", "time": "2019-09-03", "level": "", "num_look": 199796, "num_comment": 4, "author": "Qftmer", "tags": ["网络安全"], "text": "近几年来，电子数字取证技术在网络攻击窃密、反欺诈调查、内部审计、失泄密痕迹发现、恶意网站查处等案件中发挥着举足轻重的作用。"}
{"title": "福昕阅读器账户数据泄露，国内用户基本不受影响", "url": "https://www.freebuf.com/news/213172.html", "time": "2019-09-02", "level": "", "num_look": 54483, "num_comment": 4, "author": "百里不守约", "tags": ["资讯"], "text": "未经授权的黑客访问了其系统中My Account账户数据，可能泄露的信息包括用户名、邮件地址、公司名称、密码及IP地址。"}
{"title": "安恒信息刘博：谈人工智能和高级威胁检测", "url": "https://www.freebuf.com/articles/people/213138.html", "time": "2019-09-02", "level": "", "num_look": 186455, "num_comment": 6, "author": "kirazhou", "tags": ["人物志", "活动"], "text": "刘博说：安全就像人一样，不能等到病灶爆发了才去治疗，而是需要持续关注个人健康。所以，系统的安全运营一定要常态化，安全监测也要常态化。"}
{"title": "GitGot：一款可从GitHub公开数据中搜索敏感信息的半自动化快速搜索工具", "url": "https://www.freebuf.com/sectool/212124.html", "time": "2019-09-02", "level": "", "num_look": 138369, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具"], "text": "给大家介绍的是一款名叫GitGot的半自动信息收集工具，在GitGot的帮助下，广大研究人员可以轻松从GitHub公开数据中搜索敏感信息。"}
{"title": "斗象智能安全，AI利剑出鞘", "url": "https://www.freebuf.com/news/topnews/213178.html", "time": "2019-09-02", "level": "", "num_look": 70977, "num_comment": 2, "author": "斗象科技官方", "tags": ["头条"], "text": "斗象智能安全平台，是斗象科技以人工智能、大数据技术为核心，结合漏洞盒子海量攻防沉淀，研发构建的全新一代智能安全检测与数据分析产品体系。"}
{"title": "等保2.0标准个人解读（三）：安全区域边界", "url": "https://www.freebuf.com/articles/es/211964.html", "time": "2019-09-02", "level": "红色标题", "num_look": 416047, "num_comment": 4, "author": "宇宸de研究室", "tags": ["企业安全", "标准与合规"], "text": "本控制项也是等保 2.0 标准的新增内容，主要关注网络环境安全，相比旧标准除了可信验证要求外，其他部分和网络安全相似，同属三重防护之一。"}
{"title": "电子邮件安全问题分析（一）", "url": "https://www.freebuf.com/articles/network/212241.html", "time": "2019-09-02", "level": "", "num_look": 144531, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "无论是全新的网络攻击还是抵御攻击的问题，电子邮件安全是一个永远是我们最先讨论的话题。因为每个人都在使用它，而且电子邮件潜在威胁巨大。"}
{"title": "WebLogic漏洞深入渗透利用及防范思路", "url": "https://www.freebuf.com/articles/network/212858.html", "time": "2019-09-02", "level": "金币+15", "num_look": 394841, "num_comment": 4, "author": "Kriston", "tags": ["网络安全"], "text": "在《关于WebLogic安全性探讨》和《WebLogic XMLDecoder 漏洞分析》等文章中都很详细的讲解了Weblogic存在的漏洞、利用方法以及修补措施，但是也只是停留在漏洞利用的角度来对其进行了分析。"}
{"title": "FreeBuf早报 | 安全性遭质疑 ZAO换脸App被微信屏蔽；推特CEO多尔西的推特账号被黑客入侵；索赔高达21亿元：吉利起诉威马侵害商业秘密", "url": "https://www.freebuf.com/news/213061.html", "time": "2019-09-02", "level": "", "num_look": 63025, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "近日有一个名为ZAO的换脸应用一夜之间爆火，但是换脸技术背后涉及的远非好玩这么简单，面部识别是一项非常重要的安全认证技术，一旦被滥用，后果很严重。"}
{"title": "Echidna：功能强大的以太坊模糊测试框架", "url": "https://www.freebuf.com/articles/blockchain-articles/211940.html", "time": "2019-09-01", "level": "", "num_look": 189006, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["区块链安全"], "text": "Echidna是一款针对以太坊虚拟机EVM代码的模糊测试框架，该工具基于Haskell代码库实现，并支持相对复杂的基于语法的模糊测试任务。"}
{"title": "三款恶意软件同时目标锁定路由器", "url": "https://www.freebuf.com/articles/terminal/211572.html", "time": "2019-09-01", "level": "", "num_look": 122828, "num_comment": 1, "author": "Kriston", "tags": ["终端安全"], "text": "近期发现了3款恶意软件变种——Neko，Mirai和Bashlite。列出的这些恶意软件变种可以将路由器感染为僵尸网络中的设备，能够发起分布式拒绝服务（DDoS）攻击。"}
{"title": "四个行业遭受网络攻击后的成本研究", "url": "https://www.freebuf.com/articles/network/212312.html", "time": "2019-09-01", "level": "", "num_look": 107614, "num_comment": 3, "author": "Sandra1432", "tags": ["网络安全"], "text": "网络攻击在不同领域会导致额外成本的增加，除了经济成本的增加，比如影响生产或者是网络安全防御投入，还有一些看不见的成本，比如客户信任和公司荣誉。"}
{"title": "台风过境后的狼籍：医疗卫生行业网络安全勒索攻击案例集", "url": "https://www.freebuf.com/articles/system/211881.html", "time": "2019-09-01", "level": "", "num_look": 106716, "num_comment": 3, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "医疗卫生行业令人尊敬，它是患者寄托生死大任的职业，而一些恶魔，却将犯罪之手伸向了这片圣洁之地。"}
{"title": "Findomain：一款基于透明日志来搜索子域名的跨平台工具", "url": "https://www.freebuf.com/sectool/211870.html", "time": "2019-08-31", "level": "", "num_look": 124515, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Findomain的工具，这是一款能够帮助我们快速枚举/搜索子域名的跨平台工具。"}
{"title": "云服务已成为新的攻击热点", "url": "https://www.freebuf.com/articles/network/211298.html", "time": "2019-08-31", "level": "", "num_look": 94724, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "公共云越来越受欢迎，2018年报告的云基础设施总开支增长了45.6%。亚马逊AWS保持领先地位，在云服务提供商市场占有31.3%的份额，其次是微软Azure和谷歌云平台。"}
{"title": "移动勒索软件“又双叒叕”来了", "url": "https://www.freebuf.com/articles/terminal/210081.html", "time": "2019-08-31", "level": "", "num_look": 124742, "num_comment": 3, "author": "暗影安全实验室", "tags": ["终端安全"], "text": "近期，暗影移动安全实验室截获一批全新的勒索家族病毒，影响42个国家，该批勒索软件与以往的勒索软件有所不同，它没有采用常规的悬浮窗全屏置顶，Activity劫持、屏蔽虚拟按键、强制PIN码等技术，而是“全面发力，多…"}
{"title": "每个网络安全从业者应该知道的12件事", "url": "https://www.freebuf.com/articles/network/211525.html", "time": "2019-08-31", "level": "", "num_look": 107127, "num_comment": 107127, "author": "Sandra1432", "tags": ["网络安全"], "text": "即使再复杂的职业也无法跟上IT安全的变化速度。据统计，相关从业人员每年平均会遇到5000至7000个新型软件漏洞。去年的数据甚至达到了16555，让人为之惊叹。"}
{"title": "BUF大事件丨太空盗窃银行账户，女宇航员犯首例太空犯罪；国家网信办发布《儿童个人信息网络保护规定》", "url": "https://www.freebuf.com/news/213014.html", "time": "2019-08-31", "level": "红色标题", "num_look": 80531, "num_comment": 80531, "author": "willhuang", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，太空盗窃银行账户，女宇航员犯首例太空犯罪；国家网信办发布《儿童个人信息网络保护规定》"}
{"title": "AWSL，这是什么硬核议题！| FreeTalk北京站议题前瞻", "url": "https://www.freebuf.com/fevents/213009.html", "time": "2019-08-30", "level": "", "num_look": 159882, "num_comment": 159882, "author": "漏洞盒子", "tags": ["活动"], "text": "错过了本次的议题，你可能会错过一次提升技术的机会、一次改变你挖洞思路的机会、一次结识大牛的机会..."}
{"title": "Commando VM v2.0：第一个全功能的基于Windows的渗透测试虚拟机系统发行版", "url": "https://www.freebuf.com/sectool/211867.html", "time": "2019-08-30", "level": "", "num_look": 242709, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["工具", "网络安全"], "text": "今天给大家介绍的是一款名叫Commando VM的渗透测试虚拟机，这是一款基于Windows的高度可定制的渗透测试虚拟机环境，目前该产品已发布了正式的发行版，可用于渗透测试和红队研究中。"}
{"title": "GlobeImposter勒索病毒“十二主神”全新升级，国内已有多个感染案例", "url": "https://www.freebuf.com/articles/system/213029.html", "time": "2019-08-30", "level": "", "num_look": 187818, "num_comment": 187818, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近日，深信服安全团队全球独家追踪到GlobeImposter勒索病毒“十二主神”出现全新升级，出现了Hermes865、Hades865、Apollon865等加密后缀的变种，深信服将其命名为GlobeImposter勒索病毒“十二主神”2.0版本。"}
{"title": "百万级漏洞猎人，HackerOne又有5名白帽达此成就", "url": "https://www.freebuf.com/news/212971.html", "time": "2019-08-30", "level": "红色标题", "num_look": 117186, "num_comment": 9, "author": "Sandra1432", "tags": ["资讯"], "text": "据HackerOne数据显示，在漏洞协调和赏金平台披露安全漏洞之后，又出现五名黑客成为了百万富翁。"}
{"title": "挖洞经验 | Medium博客平台从Stored XSS到账号劫持", "url": "https://www.freebuf.com/vuls/211253.html", "time": "2019-08-30", "level": "", "num_look": 147636, "num_comment": 3, "author": "clouds", "tags": ["漏洞"], "text": "本文分享的是作者在博客平台Medium上编写文章时，偶然发现一个Stored XSS漏洞，在此基础上深入分析又发现了Account Takeover账号劫持漏洞，完美实现赏金从$100到$1000的提升。"}
{"title": "Buhtrap CVE-2019-1132攻击事件相关漏洞样本分析", "url": "https://www.freebuf.com/vuls/210782.html", "time": "2019-08-30", "level": "", "num_look": 148708, "num_comment": 2, "author": "奇安信威胁情报中心", "tags": ["漏洞"], "text": "本文针对该漏洞及buhtrap攻击使用的样本进行分析，以便于大众了解buhtrap这个在国内鲜为人知的APT团伙。"}
{"title": "使用Google进行批量SQL注入扫描", "url": "https://www.freebuf.com/articles/web/210651.html", "time": "2019-08-30", "level": "金币+20", "num_look": 311046, "num_comment": 14, "author": "SkyAnakin", "tags": ["WEB安全"], "text": "在使用GoogleHack进行SQL注入点查询时，手工的方法一般为通过谷歌语法的inurl判断是否存在动态查询参数，然后对查询的网站url进行手工判断是否存在SQL注入漏洞，如or 1=1 , or 1=2, 加单引号等方式。"}
{"title": "FreeBuf早报 | 美国对伊朗发动网络攻击削弱其袭击油轮的能力；攻击者使用Orcus攻击政府和金融组织；勒索软件袭击了美国数百家牙医诊所", "url": "https://www.freebuf.com/news/212911.html", "time": "2019-08-30", "level": "", "num_look": 220801, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": "美国在 6 月份对伊朗发动了网络攻击，抹掉了伊朗准军事武装用于秘密计划袭击波斯湾油轮的数据库和计算机系统，短暂削弱了其能力。"}
{"title": "勒索病毒防范措施与应急响应指南", "url": "https://www.freebuf.com/articles/terminal/212001.html", "time": "2019-08-30", "level": "", "num_look": 625337, "num_comment": 5, "author": "熊猫正正", "tags": ["企业安全", "终端安全"], "text": "这篇我将重点讲解一下，作为一名安全应急响应人员，该如何去处理勒索病毒，可以给客户提供哪些勒索病毒防范措施和应急响应指导等。"}
{"title": "Objection：一款运行时移动设备漏洞利用工具", "url": "https://www.freebuf.com/sectool/211869.html", "time": "2019-08-29", "level": "", "num_look": 164770, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具", "终端安全"], "text": "Objection是一款移动设备运行时漏洞利用工具，该工具由Frida驱动，可以帮助研究人员访问移动端应用程序。"}
{"title": "实战某游戏厂商FPS游戏CRC检测的对抗与防护", "url": "https://www.freebuf.com/articles/system/210304.html", "time": "2019-08-29", "level": "红色标题", "num_look": 209154, "num_comment": 12, "author": "小迪xiaodi", "tags": ["游戏安全", "系统安全"], "text": "随着时代的发展，游戏产业在近几年的互联网潮流中越来越扮演者重要的地位，与之而来的不仅有网络游戏公司的春天，还有游戏灰色产业的暗流涌动。一大批所谓的“外x挂”开发人员，他们不断的利用游戏的漏洞……"}
{"title": "挖洞经验 | 发现Outlook安卓版本APP跨站漏洞CVE-2019-1105", "url": "https://www.freebuf.com/vuls/211091.html", "time": "2019-08-29", "level": "", "num_look": 165993, "num_comment": 5, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "Outlook可能算是目前比较流行的邮箱APP之一了，近期，CyberArk公司研究团队就发现了Outlook安卓版本APP的一个跨站漏洞（XSS）- CVE-2019-1105，利用该漏洞可以在E-mail电子邮件中实现任意 JavaScript 代码执行。"}
{"title": "BlueCMS审计学习笔记", "url": "https://www.freebuf.com/articles/web/210587.html", "time": "2019-08-29", "level": "", "num_look": 152610, "num_comment": 2, "author": "Aerial", "tags": ["WEB安全"], "text": "bluecms是我第一次审计的CMS，所以参考了不少前辈们的经验，算是一个记录了我的学习心得，学习的过程的文章。"}
{"title": "FreeBuf早报 | 下载量超过一亿的流行应用被发现含有恶意模块；前Uber工程师Levandowski被指控盗窃谷歌商业机密；滴滴升级网约车安全产品保护醉酒乘客，测试叫醒服务", "url": "https://www.freebuf.com/news/212777.html", "time": "2019-08-29", "level": "", "num_look": 80290, "num_comment": 2, "author": "kirazhou", "tags": ["资讯"], "text": "滴滴宣布正在逐步升级网约车醉酒场景的安全产品，新增三项醉酒乘客服务功能，包括邀请乘客主动报备酒后乘车、乘客报备醉酒后的“叫醒服务”，以及酒后乘客添加临时联系人功能。"}
{"title": "挖洞经验 | 发现美国海军网站的敏感信息泄露和SQL注入漏洞", "url": "https://www.freebuf.com/vuls/212727.html", "time": "2019-08-28", "level": "", "num_look": 189640, "num_comment": 8, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "最近，作者通过HackerOne的美国国防部漏洞众测项目，发现了美国海军某网站的敏感信息泄露和SQL注入两个高危严重漏洞，漏洞非常容易发现且安全风险极高，以下是相关分享。"}
{"title": "Re2Pcap：由原始http请求响应创建pcap数据包", "url": "https://www.freebuf.com/sectool/211277.html", "time": "2019-08-28", "level": "", "num_look": 120660, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "Re2Pcap是英文单词Request2Pcap和Response2Pcap的缩写。Community版的用户可以使用Re2Pcap快速的创建PCAP文件，并根据Snort规则对其进行测试。"}
{"title": "开源蜜罐测评报告", "url": "https://www.freebuf.com/articles/paper/207739.html", "time": "2019-08-28", "level": "现金奖励", "num_look": 388738, "num_comment": 21, "author": "陌度", "tags": ["安全报告"], "text": "被人问到各种蜜罐的测评然后就想写一下各种开源蜜罐的测评报告，各种开源蜜罐地址可以在下面找到我也将按照里面的模板进行测评。"}
{"title": "在网络端口扫描期间寻找速度和准确度之间的平衡点", "url": "https://www.freebuf.com/articles/system/210913.html", "time": "2019-08-28", "level": "", "num_look": 131301, "num_comment": 5, "author": "secist", "tags": ["系统安全"], "text": "侦察是每个bug bounty或渗透测试中最为重要的阶段之一。侦察工作做得到不到位，可能会对最终的结果产生直接影响。侦察可以分为两类：即主动和被动侦察。在主动侦察中端口扫描是最常用的方法之一。"}
{"title": "FreeTalk北京站开放报名，集齐10个回忆杀可领取华为P30 Pro！", "url": "https://www.freebuf.com/fevents/211545.html", "time": "2019-08-28", "level": "", "num_look": 103815, "num_comment": 9, "author": "FB客服", "tags": ["活动"], "text": "9月7日快来FreeTalk北京站领取你的礼品吧！"}
{"title": "ARP欺骗常见姿势及多机ARP欺骗", "url": "https://www.freebuf.com/articles/network/207238.html", "time": "2019-08-28", "level": "现金奖励", "num_look": 163932, "num_comment": 4, "author": "ERFZE", "tags": ["网络安全"], "text": "本文总结了ARP欺骗原理、常见姿势以及实现多机ARP欺骗。"}
{"title": "使用Apache mod_rewrite模拟实现CIA Hive流量分发", "url": "https://www.freebuf.com/articles/network/209250.html", "time": "2019-08-28", "level": "", "num_look": 74052, "num_comment": 2, "author": "mumufeng06", "tags": ["网络安全"], "text": "本文的复现场景源于2017年11月维基解密Vault 8文件曝光的CIA网络武器库之CIA Hive工具"}
{"title": "FreeBuf早报 | 荷兰称Windows 10远程收集用户数据；IBM突破量子加密算法；江苏丹阳半马报名首日遭黑客入侵", "url": "https://www.freebuf.com/news/212679.html", "time": "2019-08-28", "level": "", "num_look": 84429, "num_comment": 5, "author": "shidongqi", "tags": ["资讯"], "text": "美国国防部正在鼓励“爱国投资者”为美国的小型无人机发展献一份力，而理由还是“中国威胁论”的老调重弹，认为目前中国小型无人机已经占领市场，而这些无人机会向中国发回信息。"}
{"title": "MIG：一款功能强大的高速分布式实时数据取证工具", "url": "https://www.freebuf.com/sectool/208933.html", "time": "2019-08-27", "level": "", "num_look": 109827, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具"], "text": "MIG，全称为Mozilla InvestiGator，它是一款基于Mozilla平台的高速分布式实时数据取证工具，广大研究人员可以利用MIG来对远程终端进行安全诊断和取证分析。"}
{"title": "挖洞经验 | Facebook的Gmail验证机制存在的CSRF漏洞", "url": "https://www.freebuf.com/vuls/210837.html", "time": "2019-08-27", "level": "", "num_look": 182346, "num_comment": 7, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文分享的是一个Facebook CSRF漏洞，用Gmail或G-Suite账户来验证新创建Facebook账户时存在的CSRF令牌验证机制漏洞，攻击者利用该漏洞。"}
{"title": "ATT&CK之后门持久化", "url": "https://www.freebuf.com/articles/system/210910.html", "time": "2019-08-27", "level": "现金奖励", "num_look": 193743, "num_comment": 8, "author": "alphalab", "tags": ["系统安全"], "text": "在网络安全的世界里，白帽子与黑帽子之间无时无刻都在进行着正与邪的对抗，似乎永无休止。正所谓，道高一尺魔高一丈，巨大的利益驱使着个人或组织利用技术进行不法行为，花样层出不穷，令人防不胜防。"}
{"title": "记一则勒索病毒的攻防案例", "url": "https://www.freebuf.com/articles/es/210180.html", "time": "2019-08-27", "level": "现金奖励", "num_look": 1056136, "num_comment": 32, "author": "fish1983", "tags": ["企业安全"], "text": "中勒索病毒了，电脑里除了系统文件，无一例外被加了Tiger4444的后缀。明明之前做了很多的防守动作，为什么还是中招了？"}
{"title": "FreeBuf早报 | 英国网络安全机构督促开发者淘汰 Python 2；微软为Chromium Edge推出除虫赏金项目；数据泄露后 Web托管服务商Hostinger重置1400万用户密码", "url": "https://www.freebuf.com/news/212501.html", "time": "2019-08-27", "level": "", "num_look": 74158, "num_comment": 5, "author": "kirazhou", "tags": ["资讯"], "text": "在发生了包含 1400 万用户信息的数据库被“未经授权的第三方”访问的事件之后，Web 主机托管服务商 Hostinger 决定采取“预防措施”—— 重置所有客户的密码。"}
{"title": "警惕垃圾邮件，伪造法院传真传播Sodinokibi勒索病毒", "url": "https://www.freebuf.com/articles/terminal/212683.html", "time": "2019-08-26", "level": "", "num_look": 77959, "num_comment": 77959, "author": "熊猫正正", "tags": ["终端安全"], "text": "Sodinokibi勒索病毒在国内首次被发现于2019年4月份，被称为GandCrab勒索病毒的接班人，在GandCrab勒索病毒运营团队停止更新之后，就马上接管了之前GandCrab的传播渠道。"}
{"title": "用于监控USB设备连接事件的取证工具", "url": "https://www.freebuf.com/sectool/210862.html", "time": "2019-08-26", "level": "", "num_look": 115938, "num_comment": 4, "author": "secist", "tags": ["工具"], "text": "usbrip是一个带有CLI接口的开源取证工具，可用于跟踪/监控Linux机器上的USB设备连接事件。"}
{"title": "云顶之役 |《2019年上半年云安全趋势报告》正式发布", "url": "https://www.freebuf.com/articles/paper/211311.html", "time": "2019-08-26", "level": "红色标题", "num_look": 259086, "num_comment": 10, "author": "FreeBuf咨询", "tags": ["安全报告"], "text": "《2019年上半年云安全趋势报告》基于互联网、产业互联网及相关领域在上云过程当中面临的安全态势、风险趋势、应对力量以及监管状态等进行了梳理，以期为行业提供阶段性的总结和建议。"}
{"title": "Hickory智能门锁存在的多个漏洞", "url": "https://www.freebuf.com/vuls/211095.html", "time": "2019-08-26", "level": "", "num_look": 126022, "num_comment": 3, "author": "clouds", "tags": ["漏洞"], "text": "近期，Rapid7安全研究团队发现了Hickory蓝牙智能系列BlueTooth Enabled Deadbolt款式门锁存在多个安全漏洞，漏洞涉及其移动端APP应用和云托管的Web服务和MQTT协议。"}
{"title": "大型互联网组织安全产品研发与落地的一些方法与思考", "url": "https://www.freebuf.com/articles/neopoints/211400.html", "time": "2019-08-26", "level": "红色标题", "num_look": 525056, "num_comment": 6, "author": "legwindy", "tags": ["企业安全", "观点"], "text": "工作几年的时间里一直在从事技术相关的工作，自己闲暇之余和工作经历经常会有脉脉上所说的工作如同拧螺丝一样的工作。"}
{"title": "“暗度陈仓”病毒分析报告", "url": "https://www.freebuf.com/articles/network/210551.html", "time": "2019-08-26", "level": "", "num_look": 185847, "num_comment": 4, "author": "暗影安全实验室", "tags": ["网络安全"], "text": "近期，暗影实验室监测到与“暗度陈仓”的典故极其类似的一个病毒，样本名为“换机精灵”，伪装成正常样本进而欺骗用户，并在用户不知情的情况下执行各项恶意操作。"}
{"title": "FreeBuf早报 | NASA女航天员在太空盗窃前任银行账户；乌克兰核电站雇员擅自偷电挖比特币；国家网信办发布规定，保护儿童个人信息安全", "url": "https://www.freebuf.com/news/212385.html", "time": "2019-08-26", "level": "", "num_look": 134097, "num_comment": 10, "author": "kirazhou", "tags": ["资讯"], "text": "从太空黑进前任的账户，这可能是有史以来第一位。有一天Summer Worden注意到她的银行账户被未经许可访问了。访问她的电脑用的是NASA相关的网络。"}
{"title": "一个任意文件上传漏洞的复现、分析、利用与防御建议", "url": "https://www.freebuf.com/vuls/210928.html", "time": "2019-08-26", "level": "现金奖励", "num_look": 346317, "num_comment": 5, "author": "Neroqi", "tags": ["WEB安全", "漏洞"], "text": "本文详细讨论CMSMS中的另一个漏洞，也是Web安全中较为常见的一种漏洞类型。ShowTime2是CMSMS中比较常用的模块，主要用于上传水印图片。"}
{"title": "五大ATM安全漏洞", "url": "https://www.freebuf.com/vuls/211155.html", "time": "2019-08-25", "level": "", "num_look": 176452, "num_comment": 9, "author": "Kriston", "tags": ["漏洞", "终端安全"], "text": "2018年各种攻击造成的损失超过3600万欧元（4050万美元），比2017年增加了16％。 据估计，到2020年，全球将有超过350万台自动柜员机在使用，意味着犯罪分子的机会变得更多。"}
{"title": "Sodinokibi勒索病毒运营团伙猖獗，针对国内用户大肆敛财", "url": "https://www.freebuf.com/articles/system/211602.html", "time": "2019-08-25", "level": "", "num_look": 82911, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近日，全国多省大中型企业持续遭到勒索病毒攻击，经深信服安全团队分析排查，均为一款名为“Sodinokibi”的勒索病毒作祟。"}
{"title": "CVE-2018-0798：Microsoft office 公式编辑器 Matrix record 栈溢出漏洞分析", "url": "https://www.freebuf.com/vuls/210945.html", "time": "2019-08-25", "level": "现金奖励", "num_look": 133158, "num_comment": 2, "author": "护花使者cxy", "tags": ["漏洞"], "text": "漏洞原理比较简单，是由于多次循环复制导致的栈溢出，幸运的是循环的次数和复制的数据都可以进行精确的控制，从而给漏洞利用带来了便利。"}
{"title": "Exim邮件服务中的严重漏洞分析", "url": "https://www.freebuf.com/vuls/209680.html", "time": "2019-08-25", "level": "", "num_look": 118073, "num_comment": 1, "author": "freexploit", "tags": ["漏洞"], "text": "在对Exim邮件服务器的最新更改进行代码审查期间，我们发现了一个RCE漏洞，版本4.87至4.91（含）"}
{"title": "IPv6teal：使用IPV6 covert channel进行隐蔽的数据渗透", "url": "https://www.freebuf.com/sectool/210842.html", "time": "2019-08-24", "level": "", "num_look": 110907, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "IPv6teal是一款由Python 3编写的工具，它可以使用构建在IPv6报头流标签字段之上的隐蔽信道，隐蔽的从内部网络中泄露数据。"}
{"title": "委内瑞拉军方遭受Machete组织攻击", "url": "https://www.freebuf.com/articles/network/210650.html", "time": "2019-08-24", "level": "", "num_look": 96812, "num_comment": 96812, "author": "Kriston", "tags": ["网络安全"], "text": "Machete是一个由西班牙语组织开发的网络间谍工具集，自2010年以来一直处于活动之中。该组织持续为其恶意软件开发新功能。他们长期攻击的重点在拉丁美洲国家，多年来一直收集目标国家情报并改进他们的攻击策略。"}
{"title": "利用Python脚本实现漏洞情报监控与通知的经验分享", "url": "https://www.freebuf.com/articles/es/209417.html", "time": "2019-08-24", "level": "现金奖励", "num_look": 192298, "num_comment": 12, "author": "biubiugo", "tags": ["企业安全"], "text": "本文主要介绍了笔者利用一个简单的Python脚本实现漏洞情报的监控以及自动通报的相关经验。"}
{"title": "说说Windows安全应急响应", "url": "https://www.freebuf.com/articles/es/210315.html", "time": "2019-08-24", "level": "现金奖励", "num_look": 194126, "num_comment": 3, "author": "cmdgaga", "tags": ["企业安全"], "text": "数据经济时代，数据越来越走向利益化的边缘。在互联网高速发展的时代，我们应该如何保护个人信息不被窃取、不被不法分子当作利益的筹码，当我们遇到入侵事件的时候，我们应该怎么办？"}
{"title": "BUF大事件丨12万人数据被泄露？雪球：网传图片为不实信息；黑客制作免费游戏诈骗网站窃取Steam账号；腾讯QQ升级程序存在漏洞", "url": "https://www.freebuf.com/news/212320.html", "time": "2019-08-24", "level": "红色标题", "num_look": 97140, "num_comment": 97140, "author": "willhuang", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，12万人数据被泄露？雪球回应：网传图片为不实信息；腾讯QQ升级程序存在漏洞；黑客制作免费游戏诈骗网站窃取Steam账号"}
{"title": "Amazon Inspector：基于云的漏洞评估工具", "url": "https://www.freebuf.com/sectool/210586.html", "time": "2019-08-23", "level": "", "num_look": 175609, "num_comment": 3, "author": "secist", "tags": ["工具"], "text": "基于云的服务提供商（如AWS），只需点击几下就可以轻松灵活地创建一个基础架构，但如果你因此而忽略了某些安全检查点，则它可能会为恶意攻击者提供许多的机会。"}
{"title": "全程带阻：记一次授权网络攻防演练（下）", "url": "https://www.freebuf.com/vuls/211847.html", "time": "2019-08-23", "level": "现金奖励", "num_look": 755848, "num_comment": 109, "author": "yangyangwithgnu", "tags": ["WEB安全", "漏洞"], "text": "完整攻击链大概包括七步，虽然这个站点只经历了前四步，但也具有较强的代表性，组合利用漏洞形成攻击连，拿下管理权限。"}
{"title": "【FreeBuf字幕组】CTF难题挑战：堆叠非常小的ROP(teufel)", "url": "https://www.freebuf.com/video/212194.html", "time": "2019-08-23", "level": "红色标题", "num_look": 63393, "num_comment": 2, "author": "Darry端", "tags": ["视频"], "text": "CTF难题挑战主要聚焦于各种CTF比赛中的难题讲解。本期视频主要围绕32C3CTF中的teufel一题展开讲述，这题是一个比较明显的栈溢出。"}
{"title": "在Virtualbox中练习Solaris 10 x86漏洞的配置修补与利用", "url": "https://www.freebuf.com/articles/system/210700.html", "time": "2019-08-23", "level": "", "num_look": 86794, "num_comment": 2, "author": "secist", "tags": ["系统安全"], "text": "本文是一篇完整的关于环境安装和设置的指南。你将学习到如何在Virtualbox中练习Solaris 10 x86漏洞的配置修补与利用。"}
{"title": "《关键信息基础设施保护条例》已上报国务院，有望年内出台​", "url": "https://www.freebuf.com/news/212257.html", "time": "2019-08-23", "level": "", "num_look": 142057, "num_comment": 3, "author": "kirazhou", "tags": ["网络安全", "资讯"], "text": "2019北京网络安全大会8月21日在北京国家会议中心开幕，在大会上了解到由中央网信办和公安部共同制定的《关键信息基础设施保护条例》已上报国务院，有望年内正式出台。"}
{"title": "seacms 9.92全局变量覆盖从越权到RCE", "url": "https://www.freebuf.com/articles/web/210902.html", "time": "2019-08-23", "level": "现金奖励", "num_look": 124709, "num_comment": 7, "author": "路上路人路过", "tags": ["WEB安全"], "text": "海洋cms是为解决站长核心需求而设计的内容管理系统，一套程序自适应电脑、手机、平板、APP多个终端入口，无任何加密代码、安全有保障，是最佳的建站工具。"}
{"title": "FreeBuf早报 | GitHub现在支持安全密钥和生物识别选项进行身份验证；BBB发警告：语音助手提供的客服联系方式存在被诈骗风险；微软谷歌红帽等企业加入保密计算联盟，致力开源与云安全", "url": "https://www.freebuf.com/news/212245.html", "time": "2019-08-23", "level": "", "num_look": 64056, "num_comment": 2, "author": "Sandra1432", "tags": ["资讯"], "text": "微软的承包商利用Cortana语音控制功能监听Xbox用户。根据该报道，在2016年引入Cortana之前，来自Kinect系统的语音命令中的语音数据也在被收集监听之列。"}
{"title": "一种新的分词方法在机器学习中的应用", "url": "https://www.freebuf.com/articles/web/210449.html", "time": "2019-08-23", "level": "", "num_look": 110242, "num_comment": 2, "author": "littlegrass", "tags": ["WEB安全"], "text": "两年前，从兜哥的《Web安全机器学习入门》这本书开始与机器学习结缘，慢慢了解了什么是贝叶斯、HMM、SVM，以及它们应用的场景。"}
{"title": "互联时代万物皆凶？Bruce Schneier畅谈网络空间安全的抉择与未来", "url": "https://www.freebuf.com/articles/network/212154.html", "time": "2019-08-22", "level": "", "num_look": 84001, "num_comment": 1, "author": "Akane", "tags": ["活动", "网络安全"], "text": "全球最著名的密码学家、知名作者Bruce Schneier以《网络空间安全的抉择与未来》为题，为我们带来了一场精彩分享和思想碰撞——当现代生活令人习以为常，你“忠诚”的电子设备们会背叛主人吗？"}
{"title": "Project-Black：渗透中进行Scope控制或扫描和进度追踪的工具", "url": "https://www.freebuf.com/sectool/208942.html", "time": "2019-08-22", "level": "", "num_look": 96831, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "该项目旨在鼓励在渗透测试或bugbounty，进度跟踪，常规扫描方面可以更有条理的进行工作。"}
{"title": "CISSP认证介绍及学习历程分享", "url": "https://www.freebuf.com/articles/others-articles/211580.html", "time": "2019-08-22", "level": "现金奖励", "num_look": 242026, "num_comment": 14, "author": "两块", "tags": ["其他"], "text": "CISSP是“(ISC)²注册信息系统安全专家”，是由(ISC)²组织和管理，是目前全球范围内最权威、最专业、最系统的信息安全认证。"}
{"title": "Trickbot银行木马变种分析", "url": "https://www.freebuf.com/articles/network/210709.html", "time": "2019-08-22", "level": "", "num_look": 97214, "num_comment": 2, "author": "Kriston", "tags": ["网络安全"], "text": "我们一直在跟踪Trickbot银行木马活动，最近在垃圾邮件中发现了一个Trickbot变种（TrojanSpy.Win32.TRICKBOT.TIGOCDC），其中包含带启用宏的Microsoft Word文档。"}
{"title": "中国邮政集团公司软件开发中心招聘信息安全工程师", "url": "https://www.freebuf.com/jobs/210514.html", "time": "2019-08-22", "level": "", "num_look": 152330, "num_comment": 7, "author": "中邮科技123", "tags": ["安全招聘"], "text": "2015年8月13日，中国邮政集团公司软件开发中心正式成立。立足邮政、服务邮政，中心着力于建立一支精通各类邮政业务、掌握核心技术、自主的邮政应用软件开发团队和邮政信息化创新团队。"}
{"title": "论Nmap中一些常用的NSE脚本", "url": "https://www.freebuf.com/sectool/210694.html", "time": "2019-08-22", "level": "", "num_look": 188211, "num_comment": 2, "author": "线性代数lzh", "tags": ["工具"], "text": "我们将研究最著名的渗透工具之一 Nmap 一款标志性的跨平台扫描器。"}
{"title": "37岁老牌安全公司赛门铁克卖身，尚能饭否？", "url": "https://www.freebuf.com/articles/neopoints/211332.html", "time": "2019-08-22", "level": "红色标题", "num_look": 155470, "num_comment": 5, "author": "kirazhou", "tags": ["观点"], "text": "107亿的卖身费，让赛门铁克这个老牌安全公司被送上了热议。今天就想和大家聊一聊赛门铁克走过的这些路以及被收购的原因，希望对其他安全企业有一定启示。"}
{"title": "FreeBuf早报 | 11个Ruby库被植入挖矿后门代码，删除前已被下载3584次；大多数IT专业人员发现红队练习比蓝队测试更有效；企业微信通过SOC2Type2审计", "url": "https://www.freebuf.com/news/212074.html", "time": "2019-08-22", "level": "", "num_look": 78252, "num_comment": 3, "author": "kirazhou", "tags": ["资讯"], "text": "Exabeam的一项研究显示，超过三分之一的防守蓝队都未能抓住进攻型红队。该调查还显示，68％的人发现红队的练习比蓝队测试更有效。"}
{"title": "如何实现等保2.0合规的跨网文件安全交换？", "url": "https://www.freebuf.com/articles/security-management/209429.html", "time": "2019-08-22", "level": "红色标题", "num_look": 167643, "num_comment": 8, "author": "Ftrans飞驰传输", "tags": ["安全管理"], "text": "在等保2.0的新要求下，如何完成跨网安全文件交换的合规性建设呢？我们主要面向等保三级、四级的要求，从网络、通信、边界等相关角度，探讨一下我们的理解。"}
{"title": "第一届BCS北京网络安全大会全程直播", "url": "https://www.freebuf.com/fevents/211512.html", "time": "2019-08-21", "level": "红色标题", "num_look": 139439, "num_comment": 7, "author": "Akane", "tags": ["活动"], "text": "作为奇安信公司主办的首届网络安全大会，以“全球网络安全，倾听北京声音”为主题的BCS 2019无论是在嘉宾阵容、议题专业度还是话题性上都令人期待满满。"}
{"title": "BCS 2019上的齐向东，与老周一条战线上的分歧者", "url": "https://www.freebuf.com/articles/people/212100.html", "time": "2019-08-21", "level": "红色标题", "num_look": 154845, "num_comment": 6, "author": "百里不守约", "tags": ["人物志"], "text": "从周鸿祎的主场到齐向东的主场，只过了一个晚上的时间。至少在2019年，当你面对着齐向东，你很难不想到周鸿祎。老周在那边分析“网络战”形势、讲安全大脑，你肯定也会好奇，这时候老齐心里在想什么？"}
{"title": "VulnX：一款针对CMS的漏洞检测工具和自动Shell注入工具", "url": "https://www.freebuf.com/sectool/206008.html", "time": "2019-08-21", "level": "", "num_look": 242524, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["工具"], "text": "VulnX是一款自动化Shell注入工具，支持多种类型的内容管理系统，广大研究人员可以使用VulnX来检测这些CMS系统中的安全问题。"}
{"title": "全程带阻：记一次授权网络攻防演练（上）", "url": "https://www.freebuf.com/vuls/211842.html", "time": "2019-08-21", "level": "现金奖励", "num_look": 2493568, "num_comment": 100, "author": "yangyangwithgnu", "tags": ["WEB安全", "漏洞"], "text": "完整攻击链大概包括信息搜集、漏洞利用、建立据点、权限提升、权限维持、横向移动、痕迹清除等七步，虽然这个站点只经历了前四步，但也具有较强的代表性，组合利用漏洞形成攻击链，拿下管理权限。"}
{"title": "访问iCloud的安全性问题的深入探讨", "url": "https://www.freebuf.com/articles/database/210446.html", "time": "2019-08-21", "level": "", "num_look": 138999, "num_comment": 3, "author": "secist", "tags": ["数据安全"], "text": "苹果没有存储其用户数据的服务器（或更确切地说是服务）。iCloud备份，照片，消息甚至密码都被保存在了亚马逊，微软，谷歌，AT&T等第三方服务器上（适用于居住在中国大陆的用户）。"}
{"title": "周鸿祎的“中东取经”", "url": "https://www.freebuf.com/articles/neopoints/212026.html", "time": "2019-08-21", "level": "红色标题", "num_look": 313567, "num_comment": 9, "author": "shidongqi", "tags": ["观点"], "text": "稍微了解下以色列的历史，无人不惊叹这个神奇而又顽强的国度。而对于安全圈的而言，其最大的神秘之处在于，全国人口仅相当于北京城人数的1/3，却让这个弹丸之国成为仅次于美国的全球第二网络安全强国。"}
{"title": "DJI大疆创新诚聘各类信息安全岗位", "url": "https://www.freebuf.com/jobs/211675.html", "time": "2019-08-21", "level": "", "num_look": 94116, "num_comment": 9, "author": "DJI大疆创新recruiter", "tags": ["安全招聘"], "text": "深圳市大疆创新科技有限公司（简称“DJI 大疆创新”），总部位于中国深圳，在北京、上海、西安设有专业研发中心。"}
{"title": "精彩回顾 | FreeBuf首次联合举办第一届泰康安全高峰论坛", "url": "https://www.freebuf.com/fevents/211985.html", "time": "2019-08-21", "level": "", "num_look": 47263, "num_comment": 2, "author": "FB独家", "tags": ["活动"], "text": "2019年8月8日，FreeBuf联合泰康保险集团举办的第一届泰康安全高峰论坛在北京圆满落下帷幕，值得一提的是，此次会议是FreeBuf 首次联合甲方企业共同举办的安全会议。"}
{"title": "Weblogic任意文件读取和任意文件上传", "url": "https://www.freebuf.com/vuls/209858.html", "time": "2019-08-21", "level": "现金奖励", "num_look": 217213, "num_comment": 8, "author": "陌上花开樱如雪", "tags": ["漏洞"], "text": "weblogic中两个CVE漏洞比较有意思，所以复现一下，该两个漏洞需要在poc中加入用户名和密码（cookie）才能实现。"}
{"title": "FreeBuf早报 | iOS 12.4系统遭黑客破解，漏洞危及数百万用户；360与以色列合作共建中以网络安全科技创新中心；YouTube起诉利用DMCA敲诈勒索其他用户的版权巨魔", "url": "https://www.freebuf.com/news/212002.html", "time": "2019-08-21", "level": "", "num_look": 72281, "num_comment": 1, "author": "Sandra1432", "tags": ["资讯"], "text": "在最近的一次iOS 12.4系统更新中，苹果公司无意中恢复了在先前版本中修复过的一个漏洞，从而使得当前iOS 12.4版本系统遭到了黑客的破解。"}
{"title": "PC微信逆向：发送与接收消息的分析与代码实现", "url": "https://www.freebuf.com/articles/others-articles/210289.html", "time": "2019-08-21", "level": "", "num_look": 171068, "num_comment": 6, "author": "TonyChen", "tags": ["其他"], "text": "微信机器人的实操，发送与接收消息的分析与代码实现。"}
{"title": "浅谈渗透测试与漏洞扫描", "url": "https://www.freebuf.com/articles/web/210284.html", "time": "2019-08-21", "level": "红色标题", "num_look": 309592, "num_comment": 18, "author": "cmdgaga", "tags": ["WEB安全", "企业安全"], "text": "渗透测试与漏洞扫描有什么区别？说实话对于一个刚入门的小白来说，这两者之间的区别可能其中的一二三，那么，我们来浅谈一下这两者的区别。"}
{"title": "Youzer：一款针对活动目录环境的伪造用户生成器", "url": "https://www.freebuf.com/sectool/209093.html", "time": "2019-08-20", "level": "", "num_look": 101916, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Youzer是一款针对活动目录环境的伪造用户生成器，目标就是创建一个包含大量信息的活动目录环境，该工具使用了Python3代码库“faker”来生成随机账号。"}
{"title": "浅谈内网端口转发", "url": "https://www.freebuf.com/articles/network/210653.html", "time": "2019-08-20", "level": "现金奖励", "num_look": 330734, "num_comment": 8, "author": "cmdgaga", "tags": ["网络安全"], "text": "在渗透测试过程中，我们经常会用到端口转发，利用代理脚本将内网的流量代理到本地进行访问，这样极大的方便了我们对内网进行横向渗透。"}
{"title": "Rocke黑客组织活动分析", "url": "https://www.freebuf.com/articles/network/210435.html", "time": "2019-08-20", "level": "", "num_look": 95669, "num_comment": 2, "author": "Kriston", "tags": ["网络安全"], "text": "网络犯罪集团Rocke，主要针对目标为云服务。"}
{"title": "新华三安全产品线攻防团队诚聘安全人才", "url": "https://www.freebuf.com/jobs/211615.html", "time": "2019-08-20", "level": "", "num_look": 77172, "num_comment": 4, "author": "新华三攻防团队", "tags": ["安全招聘"], "text": "新华三集团（简称新华三）是业界领先的数字化解决方案领导者。新华三拥有计算、存储、网络、安全等完整的数字化基础设施提供能力。"}
{"title": "勒索病毒新姿势：伪装SpyHunter安全软件", "url": "https://www.freebuf.com/articles/system/210287.html", "time": "2019-08-20", "level": "", "num_look": 101061, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近日，国外安全研究人员曝光了一款伪装成安全软件SpyHunter的勒索病毒，其开发人员使用了SpyHunter的标识作为勒索软件的图标，同时将文件命名为“SpyHunters.exe”，通过钓鱼邮件附件进行传播。"}
{"title": "等保测评2.0之Centos安全审计", "url": "https://www.freebuf.com/articles/security-management/210391.html", "time": "2019-08-20", "level": "现金奖励", "num_look": 220966, "num_comment": 14, "author": "起于凡而非于凡", "tags": ["安全管理"], "text": "在进行等级保护测评时，需要检查主机的安全审计功能，这里就以等级保护2.0来说一说centos6在这方面的检测"}
{"title": "FreeBuf早报 | Galaxy S10：美国国防部可以使用的第一款5G手机；黑客制作免费游戏诈骗网站窃取 Steam 账号；周鸿祎：安全战是秘密战，360将重返企业安全领域", "url": "https://www.freebuf.com/news/211836.html", "time": "2019-08-20", "level": "", "num_look": 83374, "num_comment": 2, "author": "kirazhou", "tags": ["资讯"], "text": "这是一个精心设计的诈骗。玩家看似进入的是一个免费游戏网站，实际上黑客将会盗取他们的 Steam 帐户，然后利用此帐号再去攻击新的玩家。"}
{"title": "ISC 2019与周鸿祎聊“网络战”和企业安全", "url": "https://www.freebuf.com/articles/people/211723.html", "time": "2019-08-19", "level": "红色标题", "num_look": 1297906, "num_comment": 18, "author": "Akane", "tags": ["人物志", "活动"], "text": "老周说，未来360一定是一个很奇葩、很不一样的安全公司。货也不卖了，未来的路该怎么走呢？"}
{"title": "evil-winrm：Windows远程管理（WinRM）Shell终极版", "url": "https://www.freebuf.com/sectool/210479.html", "time": "2019-08-19", "level": "", "num_look": 184958, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "Windows远程管理是“WS 管理协议的 Microsoft 实施，该协议是基于标准 SOAP、不受防火墙影响的协议，允许不同供应商的硬件和操作系统相互操作。"}
{"title": "利用ICMP进行命令控制和隧道传输", "url": "https://www.freebuf.com/sectool/210450.html", "time": "2019-08-19", "level": "", "num_look": 175337, "num_comment": 3, "author": "Kriston", "tags": ["工具"], "text": "在这篇文章中，你会了解到通过ICMP命令控制和ICMP隧道进行数据窃取的RED TEAM行动，使用这两种方法在网络中产生的畸形流量，有助于规避防火墙规则。"}
{"title": "浅谈企业安全：安全规划建设运营和职业发展", "url": "https://www.freebuf.com/articles/es/210925.html", "time": "2019-08-19", "level": "现金奖励", "num_look": 409742, "num_comment": 15, "author": "LinuxSelf", "tags": ["企业安全"], "text": "进入了安全行业，选择了企业安全，从此就在这个区域不断的扎根生长，也想梳理一下这些年对于安全的思想和变化……"}
{"title": "利用CobaltStrike捆绑后门的艺术", "url": "https://www.freebuf.com/sectool/210416.html", "time": "2019-08-19", "level": "", "num_look": 161799, "num_comment": 5, "author": "深信服千里目安全实验室", "tags": ["工具"], "text": "CobaltStrike（以下全部简称为CS）是渗透测试中常用的一个后渗透工具，它可以快速地生成后门并通过其控制目标主机。"}
{"title": "第七届互联网安全大会北京开幕，全球专家共议大安全", "url": "https://www.freebuf.com/fevents/211886.html", "time": "2019-08-19", "level": "", "num_look": 41362, "num_comment": 41362, "author": "你要的白不是黑", "tags": ["活动"], "text": "8月19日，主题为“应对网络战、共建大生态、同筑大安全”的第七届互联网安全大会在北京雁栖湖国际会展中心隆重开幕，来自国内外的百余位专家共同讨论全球网络安全的最新形势，探讨网络战时代的安全挑战与应对之道。"}
{"title": "等保2.0标准个人解读（二）：安全通信网络", "url": "https://www.freebuf.com/articles/network/209588.html", "time": "2019-08-19", "level": "红色标题", "num_look": 300480, "num_comment": 9, "author": "宇宸de研究室", "tags": ["标准与合规", "网络安全"], "text": "本控制项和旧标准中的网络安全类似，主要关注网络架构通信传输及可信验证，相比较而言简化了一些，属于三重防护之一。"}
{"title": "FreeBuf早报 | 特朗普政府仍希望延长NSA的电话监听项目;谷歌Play商城已移除85款携带恶意广告程序的APP;新攻击:利用蓝牙弱点可以拦截敏感数据", "url": "https://www.freebuf.com/news/211727.html", "time": "2019-08-19", "level": "", "num_look": 57312, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "研究人员已证明蓝牙无线标准存在严重缺陷，可能允许黑客拦截数十亿设备发送的击键、地址簿和其他敏感数据。"}
{"title": "挖洞经验 | 劫持任意Paypal企业账户子账户实现未授权转账操作（$10K）", "url": "https://www.freebuf.com/vuls/210669.html", "time": "2019-08-18", "level": "", "num_look": 124691, "num_comment": 4, "author": "clouds", "tags": ["漏洞"], "text": "分享我近期发现的一个Paypal越权漏洞（IDOR）"}
{"title": "Shade活跃，中国将成为下一个受害者？", "url": "https://www.freebuf.com/articles/system/210577.html", "time": "2019-08-18", "level": "", "num_look": 95249, "num_comment": 2, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "2014年底，国外安全人员首次发现Shado勒索软件，其目标主要是俄罗斯，但近期，这个历史悠久的勒索软件已经开始“光顾”俄罗斯以外的国家，这表明，开发商正在增加其受害者集的广度。"}
{"title": "以某家用摄像头测评入手谈物联网智能家居安全", "url": "https://www.freebuf.com/articles/terminal/207584.html", "time": "2019-08-18", "level": "现金奖励", "num_look": 151399, "num_comment": 7, "author": "弹指江山", "tags": ["终端安全"], "text": "智能摄像头作为身份认证和安防等重要环节，在智能家居、汽车、无人机、机器人、AR 等已有广泛使用。同时，有不法分子利用一些智能摄像头存在的安全漏洞，窥视他人家庭隐私生活，录制后在网上公开贩卖。"}
{"title": "CORS-Vulnerable-Lab：与COSR配置错误相关的漏洞代码靶场", "url": "https://www.freebuf.com/sectool/209605.html", "time": "2019-08-17", "level": "", "num_look": 95969, "num_comment": 95969, "author": "secist", "tags": ["工具"], "text": "此存储库包含与CORS配置错误相关的易受攻击代码。你可以在本地机器上配置易受攻击的代码，以实际利用与CORS相关的错误配置问题。"}
{"title": "非常逼真的Office 365钓鱼工具包分析", "url": "https://www.freebuf.com/sectool/209583.html", "time": "2019-08-17", "level": "", "num_look": 141413, "num_comment": 141413, "author": "secist", "tags": ["工具"], "text": "本文我们将探讨如何在Office 365大量使用的环境中，通过利用这些功能来帮助我们的红队参与。"}
{"title": "你还在用“加了料”的系统还原工具么？", "url": "https://www.freebuf.com/articles/paper/210685.html", "time": "2019-08-17", "level": "", "num_look": 140682, "num_comment": 1, "author": "火绒安全", "tags": ["安全报告"], "text": "利用激活软件、系统盘等工具传播病毒和流氓软件已是屡见不鲜的一大乱象，由于此类工具通常都是装机后首先安装的软件，盘踞在上面的病毒和流氓软件便利用介入时机更早的优势各种作恶，捆绑安装、劫持首页甚至与安全…"}
{"title": "基于DNS隐蔽信道的攻击与检测", "url": "https://www.freebuf.com/articles/database/210250.html", "time": "2019-08-17", "level": "", "num_look": 250165, "num_comment": 1, "author": "DigApis", "tags": ["数据安全"], "text": "企业防火墙通常配置为允许UDP端口53（由DNS使用）上的所有数据包，即DNS流量通常允许通过企业防火墙而无需深度检查或状态维护。从攻击者的角度来看，这使得DNS协议成为数据泄露地隐蔽通信通道。"}
{"title": "BUF大事件丨开挂一时爽，隐私数据火葬场；佳能单反相机被曝存在漏洞，可远程安装勒索软件；微软8月补丁修复了95个安全漏洞", "url": "https://www.freebuf.com/news/211638.html", "time": "2019-08-17", "level": "红色标题", "num_look": 102793, "num_comment": 1, "author": "willhuang", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，开挂一时爽，隐私数据火葬场；佳能单反相机被曝存在漏洞，可远程安装勒索软件；微软8月补丁修复了95个安全漏洞"}
{"title": "白帽2天成功渗透F-15战机系统，美军网络安全漏洞百出", "url": "https://www.freebuf.com/news/211664.html", "time": "2019-08-16", "level": "红色标题", "num_look": 153599, "num_comment": 5, "author": "你要的白不是黑", "tags": ["资讯"], "text": "长期以来注重网络攻击能力的美军，在“以己矛攻己盾”时终于暴露出美军网络安全防御其实“千疮百孔”。美国《星条旗报》14日披露称，“白帽子”黑客轻易入侵美军F-15战机的关键系统。"}
{"title": "PivotSuite：使用被攻克的系统在网络内部移动", "url": "https://www.freebuf.com/sectool/208966.html", "time": "2019-08-16", "level": "", "num_look": 97496, "num_comment": 97496, "author": "secist", "tags": ["工具"], "text": "PivotSuite是一个可移植，独立于平台且功能强大的网络pivoting工具包，可帮助红队/渗透测试人员使用受损的系统在网络内部横向移动。"}
{"title": "如何通过Linux xxd命令进行提权", "url": "https://www.freebuf.com/articles/system/209638.html", "time": "2019-08-16", "level": "", "num_look": 181223, "num_comment": 4, "author": "secist", "tags": ["系统安全"], "text": "本文将为大家介绍另一个可用于提权的Linux命令，即“xxd”。"}
{"title": "微软RDP远程代码执行漏洞（CVE-2019-0708）分析集锦", "url": "https://www.freebuf.com/vuls/205380.html", "time": "2019-08-16", "level": "", "num_look": 553532, "num_comment": 10, "author": "LSA", "tags": ["漏洞", "系统安全"], "text": "20190514，微软发布补丁，修复了一个严重的漏洞-rdp远程代码执行。该漏洞无需身份认证和用户交互，可能形成蠕虫爆发，影响堪比wannycry。"}
{"title": "看我如何突破JFinal黑名单机制实现任意文件上传", "url": "https://www.freebuf.com/vuls/211327.html", "time": "2019-08-16", "level": "", "num_look": 181869, "num_comment": 8, "author": "平安银行应用安全团队", "tags": ["WEB安全", "漏洞"], "text": "JFinal是国产优秀的web框架，短小精悍强大,易于使用。近期团队内一名小伙伴（LuoKe）在安全测试的时候报了一个很玄学的任意文件上传，笔者去跟进了一下问题代码。"}
{"title": "FreeBuf早报丨美设立新任务小组以应对俄罗斯对2020年大选的干预问题；安全漏洞导致Suprema Biostar 2百万人指纹数据曝光；卡巴斯基杀毒软件会泄漏用户ID", "url": "https://www.freebuf.com/news/211566.html", "time": "2019-08-16", "level": "", "num_look": 74932, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "美设立新任务小组以应对俄罗斯对2020年大选的干预问题；安全漏洞导致Suprema Biostar 2百万人指纹数据曝光；卡巴斯基杀毒软件会泄漏用户ID。"}
{"title": "Ogg音频格式文件的样本构造(CVE-2018-5146)", "url": "https://www.freebuf.com/vuls/210040.html", "time": "2019-08-16", "level": "现金奖励", "num_look": 113286, "num_comment": 2, "author": "Obiit", "tags": ["漏洞"], "text": "这是一个firefox的漏洞，位于libvorbis库中，在音频合成过程的深层次位置，想要触发它只能由具有residue 1结构的音频文件。"}
{"title": "CTF工业信息安全大赛实践与分析", "url": "https://www.freebuf.com/articles/ics-articles/210687.html", "time": "2019-08-16", "level": "", "num_look": 390850, "num_comment": 5, "author": "yy0308", "tags": ["工控安全"], "text": "结合作者工控信息安全及工控网络攻防平台CTF赛题编制等工作经验，首先对上周团队参与的2019工业信息安全大赛CTF线上比赛部分题目进行解析，接着介绍CTF相关知识及平台，最后收集相关资源并分享。"}
{"title": "Dockernymous：一款基于Docker容器的Whonix网关工作站安全环境搭建工具", "url": "https://www.freebuf.com/sectool/209607.html", "time": "2019-08-15", "level": "", "num_look": 101049, "num_comment": 101049, "author": "Alpha_h4ck", "tags": ["工具"], "text": "介绍一款名叫Dockernymous的脚本，广大研究人员可以利用Dockernymous在Docker容器中创建一个类似Whonix的网关/工作站环境。"}
{"title": "【FreeBuf字幕组】HackerOne黑客马拉松大赛之新加坡H1-65", "url": "https://www.freebuf.com/video/211375.html", "time": "2019-08-15", "level": "红色标题", "num_look": 67783, "num_comment": 3, "author": "Darry端", "tags": ["视频"], "text": "H1-65，HackerOne黑客马拉松大赛的第一次东亚之行便选择了新加坡，与此在新加坡同时举行的还有Black Hat Asia大会。作为亚洲经济“四小龙”之一，新加坡以华丽奢华在全球闻名遐迩。"}
{"title": "警惕新型Android勒索软件", "url": "https://www.freebuf.com/articles/terminal/209895.html", "time": "2019-08-15", "level": "", "num_look": 116427, "num_comment": 116427, "author": "Kriston", "tags": ["终端安全"], "text": "在Android勒索软件两年的衰败后，一个新的勒索软件家庭出现了。ESET Mobile Security检测到Android / Filecoder.C勒索软件正通过各种在线论坛传播。"}
{"title": "网络攻击瞄准个人银行，谈谈5个典型攻击手段", "url": "https://www.freebuf.com/articles/network/211150.html", "time": "2019-08-15", "level": "红色标题", "num_look": 150340, "num_comment": 4, "author": "kirazhou", "tags": ["网络安全"], "text": "银行和金融服务公司为了提高竞争力，往往为客户提供了在线管理资金的便捷功能。但不幸的是，大多数银行平台都缺失安全设计，这导致黑客一直在利用这些潜在的隐患发动攻击……"}
{"title": "京东云诚聘安全技术人才", "url": "https://www.freebuf.com/jobs/211168.html", "time": "2019-08-15", "level": "", "num_look": 100459, "num_comment": 6, "author": "lucifer_0", "tags": ["安全招聘"], "text": "京东云是京东集团旗下的云计算综合服务提供商，拥有全球领先的云计算技术和完整的服务平台。"}
{"title": "2019上半年网络安全应急响应分析报告", "url": "https://www.freebuf.com/articles/paper/210447.html", "time": "2019-08-15", "level": "", "num_look": 157030, "num_comment": 3, "author": "奇安信威胁情报中心", "tags": ["安全报告"], "text": "网络安全应急响应工作应成为政府机构、大中型企业日常管理的一部分。网络安全应急响应需要政府机构、安全厂商、企业加强合作、取长补短，必要时进行跨国协作。"}
{"title": "FreeBuf早报 | 诺基亚未如期交网，致Sprint 5G商用服务推迟；FTC主席：如有需要会对大型科技公司进行分拆；HTTPS 证书有效期被提议缩短至 13 个月", "url": "https://www.freebuf.com/news/211291.html", "time": "2019-08-15", "level": "", "num_look": 55270, "num_comment": 2, "author": "kirazhou", "tags": ["资讯"], "text": "由 Web 浏览器制造商、软件开发人员和安全证书颁发机构组成的行业团体 CA/Browser Forum，正在考虑将 HTTPS 证书的有效期从 27 个月缩短到 13 个月。"}
{"title": "数据库安全能力：安全准入控制矩阵模型构建与实践", "url": "https://www.freebuf.com/articles/database/210467.html", "time": "2019-08-15", "level": "", "num_look": 167247, "num_comment": 2, "author": "两块", "tags": ["数据安全"], "text": "随着企业组织自然生长，业务规模不断扩大，信息化建设和网络安全性工作的复杂性越来越高，安全部门工作范围涉及更广，安全保障必须及时匹配以支撑业务的发展。"}
{"title": "内网攻防备忘录", "url": "https://www.freebuf.com/articles/network/210298.html", "time": "2019-08-15", "level": "现金奖励", "num_look": 252983, "num_comment": 7, "author": "cck", "tags": ["网络安全"], "text": "渗透是一门艺术，外练一口气，内练筋骨皮，时常巩固自己的知识体系，才能站在渗透的一线。"}
{"title": "云端工控安全保卫战", "url": "https://www.freebuf.com/articles/ics-articles/211300.html", "time": "2019-08-15", "level": "", "num_look": 152878, "num_comment": 2, "author": "Sandra1432", "tags": ["工控安全"], "text": "经过短期的快速发展，对于一个IT企业发展成熟衡量的标准已经转变成是否将数据中心转移到云端。越来越多的IT基础设备日益虚拟化，因其具有极大的优势，专用的实体数据中心也日益成为过去。"}
{"title": "重磅 | 千万家庭的安全如何守护？「智能门锁安全分析报告」正式发布", "url": "https://www.freebuf.com/articles/paper/198703.html", "time": "2019-08-14", "level": "红色标题", "num_look": 825871, "num_comment": 18, "author": "FreeBuf咨询", "tags": ["安全报告"], "text": "FreeBuf研究院联合斗象科技能力中心、漏洞盒子平台推出了《智能门锁安全分析报告》，回归到锁具的本质属性，重点关注物联网时代智能门锁的安全能力，进一步延申到物联网的安全问题。"}
{"title": "漏洞预警 | Windows远程桌面服务远程命令执行漏洞（CVE-2019-1181/1182）", "url": "https://www.freebuf.com/vuls/211328.html", "time": "2019-08-14", "level": "", "num_look": 313908, "num_comment": 11, "author": "斗象智能安全平台", "tags": ["漏洞"], "text": "北京时间8月14日，微软发布了一套针对远程桌面服务的修复程序，其中包括两个关键的远程执行代码（RCE）漏洞CVE-2019-1181和CVE-2019-1182。"}
{"title": "数字货币行业APT一瞥: Coinbase应对Firefox在野0day攻击详情分析", "url": "https://www.freebuf.com/articles/blockchain-articles/211069.html", "time": "2019-08-14", "level": "", "num_look": 188587, "num_comment": 188587, "author": "lianfeng", "tags": ["区块链安全"], "text": "这只上次针对数字货币行业利用 Firefox 0day 进行 APT 攻击的一个缩影。"}
{"title": "警惕Elasticsearch沦为僵尸网络", "url": "https://www.freebuf.com/articles/network/209564.html", "time": "2019-08-14", "level": "", "num_look": 99415, "num_comment": 99415, "author": "Kriston", "tags": ["网络安全"], "text": "Elasticsearch对于网络犯罪集团而言并不陌生，它经常成为黑客们利用的工具。"}
{"title": "平安银行应用安全团队岗位招聘 | 上海", "url": "https://www.freebuf.com/jobs/211098.html", "time": "2019-08-14", "level": "", "num_look": 71923, "num_comment": 1, "author": "平安银行应用安全团队", "tags": ["安全招聘"], "text": "平安银行股份有限公司是总部设在深圳的全国性股份制商业银行，近年来，本行业务发展和经营特色深受权威机构好评，在金融时报社主办的“2018中国金融机构金牌榜·金龙奖”评选中，荣获“年度最佳上市银行”。"}
{"title": "新型JSNEMUCOD病毒样本分析报告", "url": "https://www.freebuf.com/articles/terminal/209769.html", "time": "2019-08-14", "level": "", "num_look": 122356, "num_comment": 1, "author": "亚信安全", "tags": ["终端安全"], "text": "亚信安全截获新型脚本病毒JS/NEMUCOD，该病毒通过混淆以及加密的方式躲避杀毒软件检测，通过网络共享磁盘及可移动磁盘进行传播"}
{"title": "BUF大事件番外篇丨你的密码绝对不安全！！！", "url": "https://www.freebuf.com/video/210671.html", "time": "2019-08-14", "level": "红色标题", "num_look": 127710, "num_comment": 9, "author": "Darry端", "tags": ["视频"], "text": "密码在保护您在网络上的身份方面起着极其重要的作用。密码是你的授权凭证，它可以防止未经授权的用户侵入您的在线帐户并窃取您的个人信息，以用于他们的恶意目的。"}
{"title": "金融服务机构和客户的头号威胁：94％的攻击都来源于这四种", "url": "https://www.freebuf.com/news/210509.html", "time": "2019-08-14", "level": "", "num_look": 53043, "num_comment": 2, "author": "kirazhou", "tags": ["资讯"], "text": "94％观察到的金融服务攻击来自四种方法之一：SQL注入（SQLi），本地文件包含（LFI），跨站点脚本执行（XSS）和OGNL Java注入。"}
{"title": "FreeBuf早报 | 研究人员称电子设备能被修改产生危险的声音；海莲花组织使用新手法攻击柬埔寨政府；中信银行因重大故障等原因未上报，被罚 2190 万元", "url": "https://www.freebuf.com/news/211279.html", "time": "2019-08-14", "level": "", "num_look": 114203, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "中国银行保险监督管理委员会发布《行政处罚信息公开表》显示，中信银行因涉及13项违法违规事实，没收违法所得33.6677万元，罚款2190万元，合计2223.6677万元。"}
{"title": "浅谈MSF渗透测试", "url": "https://www.freebuf.com/news/210292.html", "time": "2019-08-14", "level": "金币+20", "num_look": 356404, "num_comment": 8, "author": "cmdgaga", "tags": ["工具", "系统安全"], "text": "在渗透过程中，MSF漏洞利用神器是不可或缺的。更何况它是一个免费的、可下载的框架，通过它可以很容易地获取、开发并对计算机软件漏洞实施攻击。它本身附带数百个已知软件漏洞的专业级漏洞攻击工具。"}
{"title": "红雨滴团队Black Hat和DEF CON会议随笔", "url": "https://www.freebuf.com/news/211288.html", "time": "2019-08-14", "level": "", "num_look": 119137, "num_comment": 119137, "author": "奇安信威胁情报中心", "tags": ["资讯"], "text": "一年一度的Black Hat USA和DEF CON又如约而至。8月初的美国拉斯维加斯气温高达42摄氏度，但也无法抵挡全球各地的安全研究者、厂商、政府代表等，参加这个安全界最负盛名的两个会议。"}
{"title": "JShielder：一款自动化Linux服务器安全增强工具", "url": "https://www.freebuf.com/sectool/209603.html", "time": "2019-08-13", "level": "", "num_look": 117314, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具"], "text": "JSHielder是一款开源的Bash脚本，旨在帮助系统管理员和开发人员增强Linux服务器的安全性，以更好地开发任何Web应用程序或在线服务。"}
{"title": "佳能单反相机被曝存在漏洞，可远程安装勒索软件", "url": "https://www.freebuf.com/news/211171.html", "time": "2019-08-13", "level": "", "num_look": 321657, "num_comment": 4, "author": "Sandra1432", "tags": ["无线安全", "资讯"], "text": "来自Check Point的安全研究员EyalItkin分析了佳能EOS 80D数码单反相机中的图片传输协议（PTP），并发现了可能被用于多次攻击的六个漏洞。攻击者可以利用该漏洞破坏设备并在相机上安装勒索软件。"}
{"title": "送书福利 | 加赠十本！《零信任网络：在不可信网络中构建安全系统》", "url": "https://www.freebuf.com/fevents/210973.html", "time": "2019-08-13", "level": "红色标题", "num_look": 464732, "num_comment": 181, "author": "FB客服", "tags": ["活动"], "text": "在评论区留言你对零信任架构的认识……挑选11位“有缘人”将获得这本《零信任网络：在不可信网络中构建安全系统》，千万别忘记登陆哦，不然客服小姐姐就找不到你了。"}
{"title": "新坑开放：等保2.0标准个人解读（一）", "url": "https://www.freebuf.com/articles/security-management/209569.html", "time": "2019-08-13", "level": "现金奖励", "num_look": 357625, "num_comment": 14, "author": "宇宸de研究室", "tags": ["安全管理", "标准与合规"], "text": "标准的东西其实不是硬性规定，其具备灵活性，同样一条标准可以通过不同方式来实现，完全可以结合企业自身环境特点来应对。"}
{"title": "手机App竟然能让头发拉直器起火？", "url": "https://www.freebuf.com/articles/terminal/209604.html", "time": "2019-08-13", "level": "", "num_look": 135431, "num_comment": 2, "author": "secist", "tags": ["终端安全"], "text": "多年来，我们一直专注于物联网（IoT）方面的安全研究，并试图找出它们的漏洞来hack这些联网设备。"}
{"title": "招商银行招聘安全技术相关岗位", "url": "https://www.freebuf.com/jobs/210894.html", "time": "2019-08-13", "level": "", "num_look": 171898, "num_comment": 5, "author": "xysky", "tags": ["安全招聘"], "text": "商银行聚焦移动优先策略，拥抱金融科技(Fintech)，率先推 出闪电贷、刷脸取款、“一闪通”支付等创新服务，招商银行手机银行、掌上生活两大App已成行业翘楚，月活量均稳居金 融行业前十。"}
{"title": "Invoice钓鱼邮件姿势多，进出口企业机密信息易泄漏", "url": "https://www.freebuf.com/articles/system/210012.html", "time": "2019-08-13", "level": "", "num_look": 99360, "num_comment": 2, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近日，深信服安全团队接到某大型进出口企业反馈，根据安全感知平台提示，内网部分邮箱遭受到恶意邮件的攻击。"}
{"title": "网络安全重大事件判定指南", "url": "https://www.freebuf.com/articles/network/211133.html", "time": "2019-08-13", "level": "", "num_look": 125732, "num_comment": 3, "author": "kirazhou", "tags": ["网络安全"], "text": "通过这些判定标准我们可以相对量化的去判定哪些属于网络安全重大事件。"}
{"title": "FreeBuf早报丨为方便解锁Model 3，美女黑客提取特斯拉钥匙卡RFID芯片并植入手臂；“螺丝刀”揭开严重安全漏洞，多厂商驱动程序及固件现提权问题；最新安全报告：单反相机已成为勒索软件攻击目标", "url": "https://www.freebuf.com/news/210997.html", "time": "2019-08-13", "level": "", "num_look": 86182, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "为方便解锁Model 3，美女黑客提取特斯拉钥匙卡RFID芯片并植入手臂；“螺丝刀”揭开严重安全漏洞，多厂商驱动程序及固件现提权问题。"}
{"title": "ARP欺骗绕过Android TV BOX分析", "url": "https://www.freebuf.com/articles/network/209780.html", "time": "2019-08-13", "level": "现金奖励", "num_look": 228856, "num_comment": 1, "author": "test890", "tags": ["网络安全"], "text": "无聊的时候 bypass了家里电视盒子禁止安装第三方 app的限制，希望这篇文章能让和我一样的安全萌新能了解到 arp污染在内网中的巨大作用。"}
{"title": "Disk Pulse Eneterprise Window应用程序漏洞分析", "url": "https://www.freebuf.com/vuls/210897.html", "time": "2019-08-13", "level": "金币+15", "num_look": 74083, "num_comment": 1, "author": "freebuff111", "tags": ["漏洞"], "text": "Disk Pulse Eneterprise是一款监视磁盘变化的软件，它可以通过一个管理端口9120或者web管理窗口80对软件进行连接管理，从而监视磁盘的变化情况。"}
{"title": "Pown-Duct：一款功能强大的盲注攻击检测工具", "url": "https://www.freebuf.com/sectool/209584.html", "time": "2019-08-12", "level": "", "num_look": 121116, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "一款名叫Pown-Duct的工具，该工具基于DNS测信道实现其功能，广大研究人员可以利用Pown-Duct来有效检测盲注攻击向量。"}
{"title": "WatchBog新型变种分析", "url": "https://www.freebuf.com/articles/network/209956.html", "time": "2019-08-12", "level": "", "num_look": 113865, "num_comment": 4, "author": "Kriston", "tags": ["网络安全"], "text": "在新的Linux漏洞利用中，该版本WatchBog实现了BlueKeep RDP协议漏洞扫描模块，这表明WatchBog正在记录所有有漏洞的系统ip，以便将来进行攻击或出售给第三方获取利润。"}
{"title": "携程信息安全部诚聘安全相关高级人才", "url": "https://www.freebuf.com/jobs/210884.html", "time": "2019-08-12", "level": "", "num_look": 128597, "num_comment": 7, "author": "携程信息安全部", "tags": ["安全招聘"], "text": "携程一直重视互联网用户的安全，2014年5月16日建立携程安全应急响应中心（CSRC），隶属于 携程信息安全部 ，致力于解决携程各产品及业务的安全问题，并逐步完善、提高携程的信息安全水平。"}
{"title": "企业安全建设与态势感知", "url": "https://www.freebuf.com/articles/es/210071.html", "time": "2019-08-12", "level": "现金奖励", "num_look": 1185322, "num_comment": 16, "author": "insight", "tags": ["企业安全"], "text": "虽然有很多文章讲如何构建安全态势感知系统，但遗憾的是偏理论的多，能落地的少，大多数时候态势感知等于安全可视化，沦为了一个观赏性的玩具……"}
{"title": "Gozi银行木马再现，针对高新制造业、进出口企业的“鱼叉式攻击”", "url": "https://www.freebuf.com/articles/system/209854.html", "time": "2019-08-12", "level": "", "num_look": 97311, "num_comment": 4, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近日，深信服安全团队监测到针对进出口贸易企业、国内大型高新制造业的鱼叉式网络钓鱼攻击活动再次开始活跃。"}
{"title": "等保测评主机安全：CentOS访问控制", "url": "https://www.freebuf.com/articles/terminal/208657.html", "time": "2019-08-12", "level": "现金奖励", "num_look": 1391813, "num_comment": 9, "author": "起于凡而非于凡", "tags": ["终端安全"], "text": "罗列了关于权限控制的方法，供大家参考"}
{"title": "FreeBuf早报 | 新西兰航空遭受钓鱼攻击，客户信息被泄露；美国联邦通信委员会称5G是安全的；黑客组织APT41被发现以游戏公司为目标", "url": "https://www.freebuf.com/news/210947.html", "time": "2019-08-12", "level": "", "num_look": 81115, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": "美国安全公司 FireEye 发布了对中国黑客组织 APT41 的研究报告（PDF），称其攻击范围极为广泛，除了使用现有的工具外，还有自己开发的独有工具，还会用窃取的证书给恶意程序签名。"}
{"title": "红雨滴团队Blackhat、Defcon参会项目介绍（附大会部分议题PPT）", "url": "https://www.freebuf.com/news/211108.html", "time": "2019-08-12", "level": "", "num_look": 77327, "num_comment": 77327, "author": "奇安信威胁情报中心", "tags": ["资讯"], "text": "今年北美最大安全盛会Blackhat2019和Defcon 27已经结束，奇安信威胁情报中心红雨滴团队也在Blackhat Arsenal和Defcon Demo Labs亮相，并展示了相关工具和Demo。"}
{"title": "Rock-ON：一款多功能合一的网络侦察工具", "url": "https://www.freebuf.com/articles/network/208923.html", "time": "2019-08-11", "level": "", "num_look": 136036, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "只需要给Rock-ON提供一个域名地址，剩下的工作就可以交给它来完成啦！"}
{"title": "无密码身份认证即将来临", "url": "https://www.freebuf.com/articles/security-management/209642.html", "time": "2019-08-11", "level": "", "num_look": 179478, "num_comment": 5, "author": "Kriston", "tags": ["安全管理"], "text": "在设计和实施身份管理方面，所有人对于自己选择的认证方式都有充足的理由。虽然大多数组织仍然依赖用户名和密码方案进行身份验证，但他们意识到了其中的不足并设计了无密码的方案。"}
{"title": "通过可写入的etcpasswd文件实现Linux提权", "url": "https://www.freebuf.com/articles/system/210425.html", "time": "2019-08-11", "level": "", "num_look": 122402, "num_comment": 10, "author": "secist", "tags": ["系统安全"], "text": "在红队评估期间，队员们往往会面临许多不同的场景，最为常见的场景比如只有一个普通或低级别的shell。在Windows环境中，管理员或管理员组的成员会具有较高的权限，而这些高权限用户也是攻击者的主要目标。"}
{"title": "PHP反序列化漏洞简介及相关技巧小结", "url": "https://www.freebuf.com/articles/web/209975.html", "time": "2019-08-11", "level": "现金奖励", "num_look": 251946, "num_comment": 13, "author": "xiaopan233", "tags": ["WEB安全"], "text": "php程序为了保存和转储对象，提供了序列化的方法，php序列化是为了在程序运行的过程中对对象进行转储而产生的。序列化可以将对象转换成字符串，但仅保留对象里的成员变量，不保留函数方法。"}
{"title": "Whonix v15：想要隐私？试试这个功能强大的热门匿名操作系统", "url": "https://www.freebuf.com/articles/network/208924.html", "time": "2019-08-10", "level": "", "num_look": 124943, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "Whonix是一款免费的开源桌面操作系统，该系统基于Tor和Debian GNU/Linux实现，并且引入了隔离功能来进一步提升安全性。"}
{"title": "HTTPS劫持研究", "url": "https://www.freebuf.com/articles/network/210027.html", "time": "2019-08-10", "level": "", "num_look": 214894, "num_comment": 7, "author": "Kriston", "tags": ["网络安全"], "text": "哈萨克斯坦政府最近开始使用一个假的根证书颁发机构，对包括Facebook，Twitter和Google等网站在内的HTTPS连接进行中间人攻击。"}
{"title": "商贸信病毒针对某精密仪器公司的APT攻击", "url": "https://www.freebuf.com/articles/es/210109.html", "time": "2019-08-10", "level": "", "num_look": 190548, "num_comment": 10, "author": "腾讯安全", "tags": ["企业安全"], "text": "近期，腾讯安全御见威胁情报中监测到有黑客组织利用“商贸信”病毒针对外贸行业的APT攻击再次活跃。"}
{"title": "聊一聊FireEye在国内迅速崛起带来的启示", "url": "https://www.freebuf.com/articles/neopoints/210072.html", "time": "2019-08-10", "level": "", "num_look": 313288, "num_comment": 9, "author": "lifeisaloop", "tags": ["观点"], "text": "聊一聊FireEye的成长故事，因为这一块就很有看头，值得关注和思考。"}
{"title": "BUF大事件丨电信网络诈骗中90后被骗概率最高，男性受害者占63%；百度回应泄露信息报道：未开展此类业务；多闪回应窃取通讯录事件", "url": "https://www.freebuf.com/news/210901.html", "time": "2019-08-10", "level": "红色标题", "num_look": 86142, "num_comment": 2, "author": "willhuang", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，电信网络诈骗中男性受害者占63%，90后被骗概率最高；百度回应泄露信息报道：未开展此类业务；多闪回应窃取通讯录事件。"}
{"title": "斥资107亿美元，博通收购赛门铁克旗下的企业安全业务", "url": "https://www.freebuf.com/news/210865.html", "time": "2019-08-09", "level": "红色标题", "num_look": 79387, "num_comment": 4, "author": "kirazhou", "tags": ["资讯"], "text": "8月8日，博通（纳斯达克证券代码：AVGO）正式宣布，公司将以107亿美元的现金收购杀毒软件厂商赛门铁克旗下企业安全业务。"}
{"title": "VxWorks面临严重RCE攻击风险", "url": "https://www.freebuf.com/vuls/210241.html", "time": "2019-08-09", "level": "", "num_look": 135170, "num_comment": 2, "author": "Kriston", "tags": ["漏洞", "网络安全"], "text": "Armis研究团队在VxWorks中发现了11个零日漏洞，VxWorks可能是使用的最广泛的操作系统。 VxWorks被超过20亿台设备使用，包括关键的工业，医疗和企业设备。"}
{"title": "亚信安全招聘安全工程师", "url": "https://www.freebuf.com/jobs/210513.html", "time": "2019-08-09", "level": "", "num_look": 145688, "num_comment": 1, "author": "niexinming", "tags": ["安全招聘"], "text": "亚信安全是中国网络安全产业领跑者，于2000年发力安全业务，在云安全、身份安全、终端安全、态势感知、高级威胁治理，以及威胁情报领域等拥有多项全球领先技术，在核心技术领域持续领跑。"}
{"title": "PoshAdvisor后门更新迭代：疑似TA555针对乌克兰国家边防卫队的最新攻击活动分析", "url": "https://www.freebuf.com/articles/system/210022.html", "time": "2019-08-09", "level": "", "num_look": 97931, "num_comment": 6, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "近日，奇安信威胁情报中心红雨滴团队在日常的样本监测过程中，捕获一例针对乌克兰国家边防卫队伊斯梅尔支队的攻击样本。"}
{"title": "Globelmposter勒索病毒变种家族史，看这篇就够了", "url": "https://www.freebuf.com/articles/terminal/210641.html", "time": "2019-08-09", "level": "红色标题", "num_look": 205790, "num_comment": 6, "author": "熊猫正正", "tags": ["终端安全"], "text": "Globelmposter勒索病毒首次出现是在2017年5月份，主要通过钓鱼邮件进行传播，2018年2月国内各大医院爆发Globelmposter变种样本2.0版本，通过溯源分析发现此勒索病毒可能是通过RDP爆破、社会工程等方式进行传播。"}
{"title": "FreeBuf早报丨App收集个人信息将有“国标”：用户不同意就不得对外共享；波音泄漏代码暴露787安全漏洞；只需发送一条短信，黑客就能成功入侵你的iPhone", "url": "https://www.freebuf.com/news/210840.html", "time": "2019-08-09", "level": "", "num_look": 75914, "num_comment": 2, "author": "Karunesh91", "tags": ["资讯"], "text": "App收集个人信息将有“国标”：用户不同意就不得对外共享；波音泄漏代码暴露787安全漏洞；只需发送一条短信，黑客就能成功入侵你的iPhone。"}
{"title": "什么是内核级木马？", "url": "https://www.freebuf.com/articles/system/209735.html", "time": "2019-08-09", "level": "红色标题", "num_look": 180121, "num_comment": 9, "author": "丝路安全团队", "tags": ["系统安全"], "text": "内核级木马一个无进程、无DLL、无启动项的、集多种Rootkit技术特征的独立功能远程控制后门程序。"}
{"title": "等保测评：SQLServer操作超时", "url": "https://www.freebuf.com/articles/database/209505.html", "time": "2019-08-09", "level": "现金奖励", "num_look": 196397, "num_comment": 4, "author": "起于凡而非于凡", "tags": ["数据安全"], "text": "本文说的是等级保护1.0中SQLServer数据库操作超时的内容，实际在SQLServer中有很多种超时选项，很容易将其混为一谈，而本文则尽力将之说清楚。"}
{"title": "Shadow-box：一个基于虚拟化技术实现的轻量级Linux系统监控框架", "url": "https://www.freebuf.com/sectool/208900.html", "time": "2019-08-09", "level": "", "num_look": 99230, "num_comment": 99230, "author": "secist", "tags": ["工具"], "text": "关于Shadow-box的一些介绍"}
{"title": "Rifiuti2：一款针对Windows回收站的文件分析工具", "url": "https://www.freebuf.com/sectool/208929.html", "time": "2019-08-08", "level": "", "num_look": 112195, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Rifiuti2是一款专门用于分析Windows回收站文件-INFO2格式文件的分析工具。在Windows环境下的设备取证分析工作中，经常需要涉及到针对Windows回收站文件的分析工作。"}
{"title": "360政企安全集团招聘渗透测试工程师专家", "url": "https://www.freebuf.com/jobs/210472.html", "time": "2019-08-08", "level": "", "num_look": 165985, "num_comment": 13, "author": "Staruo", "tags": ["安全招聘"], "text": "隶属于360政企安全集团，核心成员曾从业于阿里巴巴、腾讯、美团、京东、启明星辰、知道创宇、安恒信息、长亭科技等业界知名甲乙方安全团队负责各细分领域的安全工作。团队紧贴客户致力于解决客户实际安全需求，为To…"}
{"title": "关于《火焰纹章：晓之女神》的乱数生成规律的初步研究", "url": "https://www.freebuf.com/articles/others-articles/209943.html", "time": "2019-08-08", "level": "现金奖励", "num_look": 639736, "num_comment": 9, "author": "minjiang2011", "tags": ["其他"], "text": "当我体验了苍炎之后，发现同一个即时存档升级的时候点数总是一定的，也萌生了找到苍/晓的升级算法，并写一款可以预测升级点数工具的想法。"}
{"title": "思科交换机的新漏洞恐引起新一轮全球扫描", "url": "https://www.freebuf.com/news/210286.html", "time": "2019-08-08", "level": "", "num_look": 110339, "num_comment": 4, "author": "辛木容是天才", "tags": ["资讯"], "text": "近期，思科修复了旗下明星产品——Cisco Small Business 220系列智能交换机上的三个高危漏洞。"}
{"title": "Wi-Fi安全的未来：评估WPA3中的漏洞", "url": "https://www.freebuf.com/vuls/209596.html", "time": "2019-08-08", "level": "", "num_look": 102874, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["漏洞"], "text": "近期，安全研究专家Matty Vanhoef和Eyal Ronen对WPA3 Wi-Fi标准进行了一次安全分析研究，并成功从中发现了五个安全漏洞。"}
{"title": "FreeBuf早报丨苹果深度参与教师编程学院的建设；谷歌高级保护计划可帮用户阻止Chrome下载危险文件；电信网络诈骗中男性受害者占63%，比女性更容易上当", "url": "https://www.freebuf.com/news/210696.html", "time": "2019-08-08", "level": "", "num_look": 61546, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "苹果深度参与教师编程学院的建设；谷歌高级保护计划可帮用户阻止Chrome下载危险文件；电信网络诈骗中男性受害者占63%，比女性更容易上当。"}
{"title": "CVE-2017-11826：Office Open XML wwlib模块解析混淆漏洞分析", "url": "https://www.freebuf.com/vuls/209778.html", "time": "2019-08-08", "level": "", "num_look": 122838, "num_comment": 122838, "author": "护花使者cxy", "tags": ["漏洞"], "text": "CVE-2017-11826 据说是 360 在 2017 年 9 月底发现的一个关于 XML 格式解析的一个漏洞，之后微软在 10 月份发布了关于 CVE-2017-11826 的补丁"}
{"title": "APT15组织研究白皮书", "url": "https://www.freebuf.com/articles/network/209524.html", "time": "2019-08-08", "level": "", "num_look": 136323, "num_comment": 2, "author": "Kriston", "tags": ["网络安全"], "text": "Ke3chang组织也被称为APT15,该组织的攻击行为于2012年第一次被曝光，当时利用远程后门攻击全世界的高价值目标。我们一直在跟踪与该组织相关的恶意攻击行为，并有很多有价值的发现。"}
{"title": "Spyse.Py：一款Python API封装器以及Spyse.com命令行客户端", "url": "https://www.freebuf.com/sectool/209001.html", "time": "2019-08-07", "level": "", "num_look": 98956, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "推荐一款名叫Spyse.Py的工具，是一个Python API封装器和命令行客户端，专为托管在spyse.com上的工具而设计。"}
{"title": "【硬核课程】“勒索软件终结者”开发者分享反勒索软件编程实战", "url": "https://www.freebuf.com/open/210627.html", "time": "2019-08-07", "level": "红色标题", "num_look": 129799, "num_comment": 11, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "网络安全开发领域硬核课程，购课即送一套【勒索软件终结者】源码。"}
{"title": "关于安全体系中WAF的探讨", "url": "https://www.freebuf.com/articles/es/209756.html", "time": "2019-08-07", "level": "现金奖励", "num_look": 946856, "num_comment": 25, "author": "煜阳yuyang", "tags": ["企业安全"], "text": "WAF存在的意义到底是什么？"}
{"title": "在KVM加速的Qemu中运行Android Oreo", "url": "https://www.freebuf.com/articles/terminal/209406.html", "time": "2019-08-07", "level": "", "num_look": 175547, "num_comment": 1, "author": "secist", "tags": ["终端安全"], "text": "本文你将学习到如何在KVM加速的Qemu中运行Android Oreo (8.1.0) 系统，并通过我们的Linux x86_64主机上运行的Burp Suite，转发所有来自Android的流量。"}
{"title": "群魔乱舞：五大国产病毒家族的末日收割", "url": "https://www.freebuf.com/articles/system/209855.html", "time": "2019-08-07", "level": "", "num_look": 160836, "num_comment": 2, "author": "安全豹", "tags": ["系统安全"], "text": "近期毒霸安全团队通过“捕风”威胁感知系统再次监控到一起大规模病毒传播活动，监控数据显示本次的病毒传播源头为“GX下载器”。"}
{"title": "零信任安全体系架构和实践", "url": "https://www.freebuf.com/articles/security-management/209821.html", "time": "2019-08-07", "level": "", "num_look": 338109, "num_comment": 4, "author": "杭州美创科技", "tags": ["安全管理"], "text": "在万物互联时代，全球数据量与日俱增，人们在探究数据价值的同时也打开了数据安全这个潘多拉魔盒。"}
{"title": "FreeBuf早报 | 俄罗斯政府黑客利用物联网入侵网络；为寻找iOS漏洞 苹果将给安全人员提供特别版iPhone；研究员将在Black Hat 2019上展示5G伪基站技术", "url": "https://www.freebuf.com/news/210583.html", "time": "2019-08-07", "level": "", "num_look": 102106, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "苹果公司将为安全研究人员提供特别版iPhone，这些iPhone将被赠送给“仅限邀请”参与苹果公司漏洞奖励计划的安全研究人员，研究人员可以通过向苹果披露iOS漏洞而获得奖励。"}
{"title": "数据库安全能力：数据泄露途径及防护措施", "url": "https://www.freebuf.com/articles/database/210426.html", "time": "2019-08-06", "level": "金币+20", "num_look": 171810, "num_comment": 5, "author": "两块", "tags": ["数据安全"], "text": "2018-2019年，全球各地深受数据泄露事件的困扰，已造成数以万计损失。据《数据泄露损失研究》评估显示，遭遇数据泄露事件的公司企业平均要损失386万美元，同比去年增加了6.4%。"}
{"title": "工控资产嗅探与分析实践", "url": "https://www.freebuf.com/articles/ics-articles/209786.html", "time": "2019-08-06", "level": "", "num_look": 221667, "num_comment": 4, "author": "yy0308", "tags": ["工控安全"], "text": "本文章结合作者在平时工作中经历,对工控资产嗅探所使用的工具进行简单分析与验证"}
{"title": "【议题前瞻】全球网络安全与技术趋势分析、应用安全体系建设实践与互联网安全威胁对抗实践 | 泰康安全高峰论坛", "url": "https://www.freebuf.com/fevents/210452.html", "time": "2019-08-06", "level": "", "num_look": 48286, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "德勤中国的网络和数字风险首席战略官Puneet KUKREJA、中国农业银行研发中心信息安全与风险管理部的总经理刘志丹，腾讯安全的副总经理邓振波将在本次「泰康安全高峰论坛」上为大家带来精彩议题分享。"}
{"title": "HFish：企业安全测试主动攻击型蜜罐钓鱼框架系统", "url": "https://www.freebuf.com/sectool/210318.html", "time": "2019-08-06", "level": "红色标题", "num_look": 366140, "num_comment": 31, "author": "天才小三斤", "tags": ["工具"], "text": "HFish是一款基于 Golang 开发的跨平台多功能主动攻击型蜜罐钓鱼平台框架系统，为了企业安全防护测试做出了精心的打造。"}
{"title": "MyDoom蠕虫病毒势头不减", "url": "https://www.freebuf.com/articles/network/209777.html", "time": "2019-08-06", "level": "", "num_look": 110457, "num_comment": 1, "author": "Kriston", "tags": ["网络安全"], "text": "本文记录了该病毒最近几年的活动，并详细记录了2019年前六个月的趋势。"}
{"title": "2019年上半年网络安全态势报告", "url": "https://www.freebuf.com/articles/paper/210122.html", "time": "2019-08-06", "level": "", "num_look": 385009, "num_comment": 8, "author": "深信服千里目安全实验室", "tags": ["安全报告"], "text": "2019年上半年，网络攻击数量总体呈上升趋势，网站态势依然严峻，教育行业的网站漏洞数量发现最多。"}
{"title": "PoD-Tiny：实现零信任交易的最简协议", "url": "https://www.freebuf.com/articles/blockchain-articles/209267.html", "time": "2019-08-06", "level": "", "num_look": 179600, "num_comment": 2, "author": "安比实验室SECBIT", "tags": ["区块链安全"], "text": "本文面向有一定密码学基础，或者对密码学感兴趣的读者。文中虽有大量数学公式出现，但都比较简单不难理解。"}
{"title": "FreeBuf早报 | 1亿银行用户信息失窃之谜；100万张支付卡详细信息在网上销售，韩国发布违规警报；5 万多个 WordPress 站点或被攻陷，背后疑似僵尸网络黑产团伙搞鬼", "url": "https://www.freebuf.com/news/210439.html", "time": "2019-08-06", "level": "", "num_look": 57359, "num_comment": 1, "author": "kirazhou", "tags": ["资讯"], "text": "上周，美国银行第一资本金融公司宣布，公司系统遭到入侵，导致逾1亿用户信息泄露。这是史上规模最大的银行数据失窃案之一，成功取得这一“成就”的女子似乎利用了云系统中的一个漏洞。"}
{"title": "等级保护2.0之操作超时", "url": "https://www.freebuf.com/articles/security-management/209196.html", "time": "2019-08-06", "level": "现金奖励", "num_look": 211341, "num_comment": 7, "author": "起于凡而非于凡", "tags": ["企业安全", "安全管理"], "text": "最近在对比等级保护1.0和2.0的不同之处时，产生了些须疑惑：就是到底还要不要测操作超时（主机、应用层面）？"}
{"title": "2019年上半年DDoS攻击态势报告", "url": "https://www.freebuf.com/articles/network/208399.html", "time": "2019-08-05", "level": "", "num_look": 142248, "num_comment": 1, "author": "阿里云安全", "tags": ["网络安全"], "text": "阿里云安全团队基于2019年上半年云上的DDoS攻击数据，从DDoS攻击事件、僵尸网络中控、DDoS肉鸡、攻击事件情况等多个维度做了统计分析，希望为政府和企业客户提供参考。"}
{"title": "利用Linux文本操作命令ed进行提权", "url": "https://www.freebuf.com/sectool/209494.html", "time": "2019-08-05", "level": "", "num_look": 154456, "num_comment": 8, "author": "secist", "tags": ["工具"], "text": "为大家介绍一个面向行的文本编辑器命令“ed”，它主要用于生成，显示，更改和操作文本文件"}
{"title": "等保2.0高风险项判定汇总", "url": "https://www.freebuf.com/articles/es/209997.html", "time": "2019-08-05", "level": "现金奖励", "num_look": 742782, "num_comment": 12, "author": "宇宸de研究室", "tags": ["企业安全", "标准与合规"], "text": "所谓高风险项，就是等保测评时可以一票否决的整改项，如果不改，无论你多少分都会被定为不合格。"}
{"title": "警惕新型勒索病毒来袭，勒索提示信息使用德语！", "url": "https://www.freebuf.com/articles/terminal/210316.html", "time": "2019-08-05", "level": "", "num_look": 133977, "num_comment": 8, "author": "熊猫正正", "tags": ["终端安全"], "text": "近日国外某独立安全研究员(专门从事恶意样本分析工作)，发现了一款新型的勒索病毒，这款勒索病毒使用了高强度代码混淆手段，会修改桌面背景，这种手法与之前的GandCrab和Sodinokibi两款勒索病毒非常类似。"}
{"title": "企业安全体系架构分析：开发安全架构之可用性架构深入讲解", "url": "https://www.freebuf.com/articles/es/207831.html", "time": "2019-08-05", "level": "现金奖励", "num_look": 137022, "num_comment": 3, "author": "煜阳yuyang", "tags": ["企业安全"], "text": "之前发布了一篇文章《企业安全体系架构分析：开发安全架构之可用性架构》，其中粗略的讲解了一下可用性架构的设计理念，应读者要求，这篇文章将深入讲解什么是可用性架构。"}
{"title": "百度智能云招聘安全人才", "url": "https://www.freebuf.com/jobs/210129.html", "time": "2019-08-05", "level": "", "num_look": 65843, "num_comment": 4, "author": "helloliuxm", "tags": ["安全招聘"], "text": "百度智能云是百度提供的公有云平台，于2015年正式开放运营。百度智能云秉承“用科技力量推动社会创新”的愿景，不断将百度在云计算、大数据、人工智能的技术能力向社会输出。"}
{"title": "一个工控漏洞引发的思考（续）", "url": "https://www.freebuf.com/vuls/208779.html", "time": "2019-08-05", "level": "现金奖励", "num_look": 407967, "num_comment": 2, "author": "ww5466064", "tags": ["漏洞"], "text": "阿基米德曾经说过：给我一个支点，我就能撬起地球。”那么，在漏洞挖掘的过程中，如果给你一个支点（pivot），能否快速发掘更多漏洞呢？"}
{"title": "FreeBuf早报 | 亚马逊提供 Alexa 录音的非人工审听选项；网站漏洞导致超过2000名参与报道E3的记者个人信息泄漏；GitHub公布了托管平台与美国贸易管制的相关细节", "url": "https://www.freebuf.com/news/210320.html", "time": "2019-08-05", "level": "", "num_look": 62162, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "从国家互联网应急中心天津分中心获悉，为有效控制计算机恶意程序感染主机引发的危害，2018年，国家互联网应急中心组织基础电信企业、域名服务机构等成功关闭772个控制规模较大的僵尸网络。"}
{"title": "挖洞经验 | 开裂的挡风玻璃让我获得了特斯拉$10,000的漏洞赏金", "url": "https://www.freebuf.com/vuls/208920.html", "time": "2019-08-04", "level": "", "num_look": 177859, "num_comment": 13, "author": "clouds", "tags": ["漏洞"], "text": "说白了，它就是一台在飞驰车轮之上的联网计算机。"}
{"title": "QCSuper：在高通手机猫上捕获无线2G/3G/4G数据包", "url": "https://www.freebuf.com/sectool/209039.html", "time": "2019-08-04", "level": "", "num_look": 120595, "num_comment": 120595, "author": "secist", "tags": ["工具"], "text": "QCSuper是一种基于高通（Qualcomm）手机和调制解调器（俗称“猫”）通信的工具，可以捕获原始的2G/3G/4G无线电帧等数据内容。"}
{"title": "BUF大事件丨Siri也被曝出“窃听”用户，三大智能语音助手全军覆没；谷歌公布6个重大iOS漏洞：可通过iMessage发动攻击", "url": "https://www.freebuf.com/news/210268.html", "time": "2019-08-04", "level": "红色标题", "num_look": 100491, "num_comment": 3, "author": "willhuang", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，Siri也被曝出“窃听”用户，三大智能语音助手全军覆没；谷歌公布6个重大iOS漏洞：可通过iMessage发动攻击"}
{"title": "前端加密之使用Firefox来解密", "url": "https://www.freebuf.com/articles/web/209558.html", "time": "2019-08-04", "level": "现金奖励", "num_look": 177994, "num_comment": 8, "author": "NotFound", "tags": ["WEB安全"], "text": "随着等保2.0的实施，传输过程中加密变的必要了，很多APP或者手机浏览器端逐步加密了一些加密的措施来解决这个问题。"}
{"title": "CHM木马的分析与利用", "url": "https://www.freebuf.com/articles/network/208897.html", "time": "2019-08-04", "level": "现金奖励", "num_look": 128014, "num_comment": 23, "author": "strawberry", "tags": ["网络安全"], "text": "偶然获得了一个过X60启动的CHM木马，进行一番学习，并通过木马所带来的启发再创造。"}
{"title": "SneakyEXE：一款嵌入式UAC绕过工具", "url": "https://www.freebuf.com/sectool/209097.html", "time": "2019-08-03", "level": "", "num_look": 100123, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["工具"], "text": "一款能够帮助我们在自定义Win32 Payload中嵌入UAC绕过功能的强大工具"}
{"title": "如何在VirtualBox中运行macOS Catalina Beta版本", "url": "https://www.freebuf.com/articles/system/208917.html", "time": "2019-08-03", "level": "", "num_look": 106656, "num_comment": 4, "author": "secist", "tags": ["系统安全"], "text": "本内容是关于如何在Linux上的VirtualBox中运行macOS Catalina Beta版的简短指南。"}
{"title": "基于某异性交友APP的小数据分析", "url": "https://www.freebuf.com/articles/others-articles/209459.html", "time": "2019-08-03", "level": "红色标题", "num_look": 5400377, "num_comment": 34, "author": "꧁", "tags": ["其他"], "text": "对妹子进行大数据分析一波，分析出妹子的需求……"}
{"title": "从两道题剖析Largebin Attack", "url": "https://www.freebuf.com/articles/system/209096.html", "time": "2019-08-03", "level": "", "num_look": 114575, "num_comment": 1, "author": "Snowleopardbin", "tags": ["系统安全"], "text": "我将通过这两道题目对largebin attack进行深入研究，从源码分析到动态调试，将largebin attack的整个流程都过了一遍，整理一下largebin attack的利用过程，希望对大家有帮助。"}
{"title": "网络安全法律法规知多少", "url": "https://www.freebuf.com/news/209387.html", "time": "2019-08-03", "level": "", "num_look": 118388, "num_comment": 2, "author": "Karunesh91", "tags": ["资讯"], "text": "随着全球各行业数字化的进程不断加速，各类新型信息通信技术快速发展，万物互联正一步步向我们走来。因此，各行各业对于数据的安全需求也日益递增。而且，这其中有相当一部分是保障民生的重要行业。"}
{"title": "【漏洞预警】Django JSONField，HStoreField SQL注入漏洞", "url": "https://www.freebuf.com/vuls/210257.html", "time": "2019-08-02", "level": "", "num_look": 134587, "num_comment": 2, "author": "斗象智能安全平台", "tags": ["漏洞"], "text": "Django是一个开放源代码的Web应用框架，由Python写成。采用了MTV的框架模式，即模型M，视图V和模版T。"}
{"title": "本田汽车云端数据库未保护，CEO及全球员工大量资料险遭泄露", "url": "https://www.freebuf.com/news/210249.html", "time": "2019-08-02", "level": "", "num_look": 87044, "num_comment": 1, "author": "Allen别bb", "tags": ["资讯"], "text": "研究人员发现日本汽车大厂本田汽车一个云端数据库，内含超过1亿份文件，包含员工电脑主机名称、IP、使用哪套安全软件等信息。"}
{"title": "Slackor：如何将Slack当作你的命令控制服务器", "url": "https://www.freebuf.com/articles/network/209252.html", "time": "2019-08-02", "level": "", "num_look": 94595, "num_comment": 94595, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "Slackor是一款Golang植入，它可以将Slack作为你的命令控制服务器。"}
{"title": "【FreeBuf字幕组】CTF难题挑战：滥用异常处理程序以泄漏flag（32C3CTF）", "url": "https://www.freebuf.com/video/210007.html", "time": "2019-08-02", "level": "红色标题", "num_look": 69169, "num_comment": 69169, "author": "Darry端", "tags": ["视频"], "text": "本期视频主要讲述了32C3-CTF比赛中的pwnable 200滥用异常处理程序泄漏flag的问题，此外还有二进制文件缓入内存当中、Vagrant虚拟VM包装器、Hopper等演示操作。"}
{"title": "AWD攻防赛之各类漏洞FIX方案", "url": "https://www.freebuf.com/articles/web/208778.html", "time": "2019-08-02", "level": "现金奖励", "num_look": 274491, "num_comment": 16, "author": "Qftmer", "tags": ["WEB安全"], "text": "CTF中的线下赛又被称为AWD（Attack With Defence）。AWD对于选手的攻击能力，防御能力以及团队合作能力都有着很高的考验。"}
{"title": "看我如何用SHerlock跨社交网络查找你的用户名", "url": "https://www.freebuf.com/articles/network/209254.html", "time": "2019-08-02", "level": "", "num_look": 147145, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "今天给大家介绍的就是这个名叫Sherlock的半社工工具，在它的帮助下，我们可以跨社交网络来查找目标用户的用户名。"}
{"title": "百度智能云招聘安全人才", "url": "https://www.freebuf.com/jobs/203981.html", "time": "2019-08-02", "level": "", "num_look": 102735, "num_comment": 3, "author": "innobit", "tags": ["安全招聘"], "text": "百度智能云是百度旗下面向企业及开发者的智能云计算服务平台。百度智能云致力于为各行业提供以ABC(人工智能 AI、大数据Big Data、云计算Cloud Computing)技术为一体的平台服务。"}
{"title": "灰色产业链成病毒传播最大渠道，流量生意或迎来最后的疯狂", "url": "https://www.freebuf.com/articles/database/208658.html", "time": "2019-08-02", "level": "", "num_look": 308640, "num_comment": 6, "author": "火绒安全", "tags": ["安全报告", "数据安全"], "text": "劫持浏览器、刷取流量等行为是流氓软件常见行为，而随着安全厂商持续打击、普通用户的安全意识提升，让病毒团伙、流氓软件厂商的获利空间被逐渐压缩。"}
{"title": "Black hat USA 2019 武器库前瞻", "url": "https://www.freebuf.com/news/209988.html", "time": "2019-08-02", "level": "", "num_look": 130050, "num_comment": 1, "author": "kirazhou", "tags": ["活动", "资讯"], "text": "随着攻击手段层出不穷，在安防这场日渐艰苦的战斗中，安全人员需要对武器库有更多的掌握，及时了解武器库发展前沿、工具更新，才能在网络安全维护中再添一份保障。"}
{"title": "基于Bert-NER构建特定领域的中文信息抽取框架（上）", "url": "https://www.freebuf.com/articles/others-articles/209197.html", "time": "2019-08-02", "level": "", "num_look": 225974, "num_comment": 225974, "author": "逸立学院", "tags": ["其他"], "text": "本文通过多个实验的对比发现，结合Bert-NER和特定的分词、词性标注等中文语言处理方式，获得更高的准确率和更好的效果，能在特定领域的中文信息抽取任务中取得优异的效果。"}
{"title": "FreeBuf早报丨爱德华·斯诺登将在今年晚些时候发行回忆录《永久记录》；麻省剑桥市将禁止政府使用面部识别；苹果AirDrop和Wi-Fi密码共享功能潜藏个人信息外泄威胁", "url": "https://www.freebuf.com/news/210132.html", "time": "2019-08-02", "level": "", "num_look": 280511, "num_comment": 3, "author": "Karunesh91", "tags": ["资讯"], "text": "爱德华·斯诺登将在今年晚些时候发行回忆录《永久记录》；麻省剑桥市将禁止政府使用面部识别；苹果AirDrop和Wi-Fi密码共享功能潜藏个人信息外泄威胁。"}
{"title": "APT之迂回渗透", "url": "https://www.freebuf.com/articles/network/202497.html", "time": "2019-08-02", "level": "", "num_look": 203302, "num_comment": 11, "author": "08sec团队", "tags": ["网络安全"], "text": "众所周知，现在的安全产品和设备以及对网络安全的重视，让我们用常规手段对目标渗透测试的成功率大大降低……"}
{"title": "腾讯安全方斌：一体化安全，为政企数字化转型护航", "url": "https://www.freebuf.com/fevents/210230.html", "time": "2019-08-02", "level": "", "num_look": 62450, "num_comment": 62450, "author": "shidongqi", "tags": ["活动"], "text": "自产业互联网的概念出现以来，引发了诸多互联网巨头的重视，腾讯也是其中之一。在互联网+、数字化转型的浪潮下，产业升级已经成了必然趋势，与此同时安全升维也成了今年CSS 峰会核心主题。"}
{"title": "Sodinokibi勒索病毒利用Flash漏洞强势来袭", "url": "https://www.freebuf.com/articles/system/209047.html", "time": "2019-08-02", "level": "", "num_look": 92695, "num_comment": 92695, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "勒索病毒攻击事件并没有随着GandCrab的退出而减少，Sodinokibi勒索已经成为了现在全球最流行的勒索病毒之一，也叫称为GandCrab的”接班人”。"}
{"title": "大咖云集丨第一届泰康安全高峰论坛议题公布", "url": "https://www.freebuf.com/fevents/210119.html", "time": "2019-08-01", "level": "", "num_look": 40404, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "泰康保险集团携手FreeBuf举办的「泰康安全高峰论坛」，于2019年8月8日在北京举办。"}
{"title": "iPhone蓝牙流量被指在某些情况下泄露用户电话号码", "url": "https://www.freebuf.com/news/210097.html", "time": "2019-08-01", "level": "", "num_look": 54373, "num_comment": 2, "author": "奇安信代码卫士", "tags": ["资讯"], "text": "安全研究员表示他们能够在某些操作中从iPhone 智能手机的蓝牙流量中提取用户的手机号码。"}
{"title": "NetSet：一款功能强大的自动化网络流量安全增强工具", "url": "https://www.freebuf.com/sectool/209098.html", "time": "2019-08-01", "level": "", "num_look": 130465, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具"], "text": "NetSet是一款自动化安全增强工具，该工具的主要目的就是将很多复杂的操作以自动化的方式实现，并帮助用户保证网络流量的安全性。"}
{"title": "脑机接口新进展，生物黑客的狂欢？“黑客帝国”仍是遥远的疆界", "url": "https://www.freebuf.com/geek/209263.html", "time": "2019-08-01", "level": "红色标题", "num_look": 4941497, "num_comment": 13, "author": "kirazhou", "tags": ["极客", "观点"], "text": "7月17日，马斯克宣布：已经找到了高效实现脑机接口的方法……"}
{"title": "WES-NG可以给你的Windows漏洞利用提供有效建议", "url": "https://www.freebuf.com/articles/system/209251.html", "time": "2019-08-01", "level": "", "num_look": 92528, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "该工具的适用系统范围从Windows XP到Windows 10，还包括Windows Server等服务器/工作站版本。"}
{"title": "Gorgon黑客组织再显新招：通过在线网盘发起“三重奏”攻击", "url": "https://www.freebuf.com/articles/terminal/209404.html", "time": "2019-08-01", "level": "", "num_look": 108604, "num_comment": 1, "author": "奇安信威胁情报中心", "tags": ["终端安全"], "text": "近日，奇安信威胁情报中心红雨滴团队在日常的样本监控过程中，发现了一个以微软名称命名的攻击文档，并在随后的关联分析中发现，此次攻击活动疑似来自一个名为Gorgon的攻击组织……"}
{"title": "FreeBuf早报 | 思科应向美国政府出售带漏洞的软件而遭罚款；微软进一步推进Microsoft Defender品牌重塑工作；SanDisk SSD仪表盘软件漏洞可导致数据丢失", "url": "https://www.freebuf.com/news/210032.html", "time": "2019-08-01", "level": "", "num_look": 84722, "num_comment": 2, "author": "Freddy", "tags": ["资讯"], "text": "思科今天同意支付860万美元来解决一家前承包商提起的法律诉讼，该承包商指责该公司未能解决多个安全漏洞并继续向美国政府机构销售易受攻击的视频监控软件。"}
{"title": "Golang蠕虫泛滥？让我们揪出其始作俑者", "url": "https://www.freebuf.com/articles/system/208777.html", "time": "2019-08-01", "level": "", "num_look": 128151, "num_comment": 3, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "一款Go语言恶意软件正大量感染Linux服务器，其使用了多达6种传播感染方式，包含4个远程执行漏洞（ThinkPHP、THinkPHP2、Dural、Confluence），2个弱密码爆破攻击（SSH、Redis）。"}
{"title": "GitMAD：用于发现Github上的敏感信息和数据泄漏的工具", "url": "https://www.freebuf.com/sectool/208934.html", "time": "2019-07-31", "level": "", "num_look": 149527, "num_comment": 3, "author": "secist", "tags": ["工具"], "text": "通过给定关键字或域，GitMAD便会搜索Github上托管的代码，以查找是否存在匹配项。一旦找到了匹配项，GitMAD将克隆存储库并在文件中搜索一系列可配置的正则表达式。"}
{"title": "使用反向Shell控制摄像头", "url": "https://www.freebuf.com/articles/system/209261.html", "time": "2019-07-31", "level": "", "num_look": 212195, "num_comment": 4, "author": "secist", "tags": ["系统安全"], "text": "这些你素未谋面人又是如何远程连接到你的机器并监视你的呢？"}
{"title": "安全视角下的木马免杀技术讨论", "url": "https://www.freebuf.com/articles/system/209652.html", "time": "2019-07-31", "level": "红色标题", "num_look": 606494, "num_comment": 13, "author": "默安科技_影武者实验室", "tags": ["系统安全"], "text": "钓鱼成功与否一方面和钓鱼文案的诱人程度以及木马的免杀是否到位有着密切的关系，本文介绍下常见的一些免杀技巧。"}
{"title": "唯品会招聘安全人才", "url": "https://www.freebuf.com/jobs/209658.html", "time": "2019-07-31", "level": "", "num_look": 98892, "num_comment": 4, "author": "唯品会安全应急响应中心", "tags": ["安全招聘"], "text": "唯品会成立于2008年 ，在中国开创了“名牌折扣+限时抢购+正品保障”的创新电商模式  ，并持续深化为“精选品牌+深度折扣+限时抢购”的正品时尚特卖模式。"}
{"title": "漏洞预警 | FasterXML jackson-databind远程代码执行漏洞", "url": "https://www.freebuf.com/vuls/209949.html", "time": "2019-07-31", "level": "", "num_look": 278087, "num_comment": 4, "author": "斗象智能安全平台", "tags": ["漏洞"], "text": "FasterXMLjackson-databind是一个简单基于Java应用库，Jackson可以轻松的将Java对象转换成json对象和xml文档，同样也可以将json、xml转换成Java对象。"}
{"title": "Imagemagick邂逅Getimagesize的那点事儿", "url": "https://www.freebuf.com/articles/network/209198.html", "time": "2019-07-31", "level": "现金奖励", "num_look": 471851, "num_comment": 5, "author": "phithon", "tags": ["网络安全"], "text": "imagemagick和ghostscript的漏洞层出不穷，也在侧面辅助了黑盒渗透与PHP代码审计，待下一次0day爆发，也可以利用这个技巧进行盲测。"}
{"title": "全球高级持续性威胁（APT）2019年上半年研究报告", "url": "https://www.freebuf.com/articles/paper/208811.html", "time": "2019-07-31", "level": "", "num_look": 157455, "num_comment": 2, "author": "腾讯电脑管家", "tags": ["安全报告"], "text": "整个2019年上半年，网络攻击频发，全球的网络安全形势不容乐观。"}
{"title": "Raspberry Pi Zero W USB SSH连接与WiFi配置", "url": "https://www.freebuf.com/geek/209255.html", "time": "2019-07-31", "level": "金币+20", "num_look": 312135, "num_comment": 4, "author": "NeptLiang", "tags": ["极客"], "text": "谷歌+百度了几十个教程、查了几十个疑难杂症，最后到学校图书馆借了本《树莓派用户指南》才配置好，现在记录一下。"}
{"title": "FreeBuf早报 | 个人信息保护合规评估工具发布上线；谷歌公布6个重大iOS漏洞：可通过iMessage发动攻击；LAPD数据泄露致2500名警官个人信息被盗", "url": "https://www.freebuf.com/news/209938.html", "time": "2019-07-31", "level": "", "num_look": 79085, "num_comment": 4, "author": "shidongqi", "tags": ["资讯"], "text": "由中国电子技术标准化研究院开发的个人信息保护合规评估工具30日正式发布上线。据了解，这一工具将为企业免费提供App隐私条款评估、个人信息保护合规自查等在线服务。"}
{"title": "解读《2019上半年科技金融安全报告》：P2P风险降低，非法集资金额翻倍，风控压力达千万量级", "url": "https://www.freebuf.com/articles/paper/209996.html", "time": "2019-07-31", "level": "", "num_look": 56659, "num_comment": 56659, "author": "腾讯安全平台部", "tags": ["安全报告"], "text": "腾讯安全联合第一财经发布了《2019上半年科技金融安全报告》，通过科技金融安全大数据的分析发现，在金融监管、金融风控和金融基础安全建设层面，都面临数字化转型的安全挑战。"}
{"title": "2019 CSS互联网安全领袖峰会首日纪实", "url": "https://www.freebuf.com/fevents/209783.html", "time": "2019-07-30", "level": "红色标题", "num_look": 137463, "num_comment": 137463, "author": "Akane", "tags": ["活动"], "text": "随着大数据、云计算等基础能力的完善，AI技术正在走出实验室，承担台前幕后的各项工作，赋能安全乃至反哺业务。往年热议的话题一步步落地夯实，今年的CSS又将带给我们怎样的惊喜呢？"}
{"title": "Black hat USA 2019议题前瞻", "url": "https://www.freebuf.com/news/209537.html", "time": "2019-07-30", "level": "红色标题", "num_look": 118128, "num_comment": 8, "author": "kirazhou", "tags": ["活动", "资讯"], "text": "Black Hat USA 2019大会于8月3日到8月8日期间在曼德勒海湾/拉斯维加斯举行。"}
{"title": "挖洞经验 | 漏洞就在那里，在那显眼之处", "url": "https://www.freebuf.com/vuls/208915.html", "time": "2019-07-30", "level": "", "num_look": 271148, "num_comment": 8, "author": "clouds", "tags": ["漏洞"], "text": "在参与众测过程中我们经常会遇到瓶颈，即使再怎么努力也无所发现，陷入窘境，如何来破？"}
{"title": "浅谈跨域威胁与安全", "url": "https://www.freebuf.com/articles/web/208672.html", "time": "2019-07-30", "level": "现金奖励", "num_look": 242228, "num_comment": 10, "author": "1u0hun", "tags": ["WEB安全"], "text": "WEB前端中最常见的两种安全风险，XSS与CSRF，XSS，即跨站脚本攻击、CSRF即跨站请求伪造,两者属于跨域安全攻击，对于常见的XSS以及CSRF在此不多谈论，仅谈论一些不太常见的跨域技术以及安全威胁。"}
{"title": "北京好活科技招聘信息安全工程师", "url": "https://www.freebuf.com/jobs/209727.html", "time": "2019-07-30", "level": "", "num_look": 81305, "num_comment": 3, "author": "SixSixSix", "tags": ["安全招聘"], "text": "好活公司成立于2015年底，2018年好活完成人才能力共享平台搭建。同年6月，好活获得昆山高新集团3000万元A轮融资，2018年7月，好活与中国建设银行签订认股选择协议，是政府大力扶持的共享经济新业态。"}
{"title": "进口勒索“美杜莎” 作祟，盯上国内政企用户", "url": "https://www.freebuf.com/articles/system/208806.html", "time": "2019-07-30", "level": "红色标题", "num_look": 128744, "num_comment": 6, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "出现一起勒索病毒入侵事件反馈，经分析，该勒索病毒名为Medusa Ransom，最早于2018年在国外活动，加密后会修改桌面背景为古希腊神话中蛇发女妖“美杜莎”的图片。"}
{"title": "FreeBuf早报丨No More Ransom项目使勒索软件犯罪团队利润至少减少1.08亿美元；BT客户端BitLord被发现捆绑间谍软件苹果合同工定期监听 Siri 录音", "url": "https://www.freebuf.com/news/209796.html", "time": "2019-07-30", "level": "", "num_look": 61255, "num_comment": 4, "author": "Karunesh91", "tags": ["资讯"], "text": "No More Ransom项目使勒索软件犯罪团队利润至少减少1.08亿美元；BT客户端BitLord被发现捆绑间谍软件苹果合同工定期监听 Siri 录音。"}
{"title": "绕过Android域名白名单校验的方法", "url": "https://www.freebuf.com/articles/web/208868.html", "time": "2019-07-30", "level": "", "num_look": 133620, "num_comment": 6, "author": "小米安全中心", "tags": ["WEB安全"], "text": "列举几种常见的 Android 域名白名单校验写法，并深入源码指出其中存在的风险和绕过方法"}
{"title": "CNCERT发布《2018年中国互联网网络安全报告》", "url": "https://www.freebuf.com/articles/paper/209985.html", "time": "2019-07-30", "level": "", "num_look": 98742, "num_comment": 98742, "author": "CNCERT", "tags": ["安全报告"], "text": "《报告》汇总分析了CNCERT自有网络安全监测数据和CNCERT网络安全应急服务支撑单位报送的数据，内容涵盖我国互联网网络安全态势分析、网络安全监测数据分析、网络安全事件案例详解等多个方面。"}
{"title": "Riposte：使用Python编写的交互式Shell工具", "url": "https://www.freebuf.com/sectool/209282.html", "time": "2019-07-29", "level": "", "num_look": 137664, "num_comment": 3, "author": "secist", "tags": ["工具"], "text": "Riposte是一个基于Python的交互式Shell工具。"}
{"title": "在Kubernetes中创建与部署蜜罐", "url": "https://www.freebuf.com/articles/network/208895.html", "time": "2019-07-29", "level": "", "num_look": 118852, "num_comment": 5, "author": "secist", "tags": ["网络安全"], "text": "向你展示如何在Kubernetes集群中创建，配置和部署一个蜜罐诱饵。"}
{"title": "有关网络安全漏洞披露管理的现状分析与建议", "url": "https://www.freebuf.com/articles/neopoints/209224.html", "time": "2019-07-29", "level": "现金奖励", "num_look": 229919, "num_comment": 13, "author": "偶然路过的围观群众", "tags": ["观点"], "text": "本文将从目前常见的网络安全漏洞披露类型、国内网络安全漏洞报送和披露渠道、中美关于网络安全漏洞披露管理方面的法律法规进行探讨，分析当前网络安全漏洞披露管理面临的挑战，并给出相关对策建议。"}
{"title": "【议题前瞻】构建等保体系的核心成员对等保2.0解读及行业合规落地建议 | 泰康安全高峰论坛", "url": "https://www.freebuf.com/fevents/209418.html", "time": "2019-07-29", "level": "", "num_look": 52372, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "2019年8月8日，泰康保险集团携手FreeBuf举办的「泰康安全高峰论坛」邀请公安部信息安全等级保护评估中心测评部副主任张振峰带来议题分享。"}
{"title": "企业安全体系架构分析：开发架构之开源WAF延申", "url": "https://www.freebuf.com/articles/es/208108.html", "time": "2019-07-29", "level": "现金奖励", "num_look": 284565, "num_comment": 16, "author": "煜阳yuyang", "tags": ["企业安全"], "text": "网上开源WAF有很多，搭建方式比较简单，但只限于搭建，而没有分析调整的后续，这其实是实际使用中大家最关心也是最迫切需要的，下面就分享一下我的开源WAF构建与使用。"}
{"title": "等保测评：Centos超时退出详解", "url": "https://www.freebuf.com/articles/terminal/208480.html", "time": "2019-07-29", "level": "现金奖励", "num_look": 184614, "num_comment": 10, "author": "起于凡而非于凡", "tags": ["终端安全"], "text": "等保测评主机测评中需要查询主机的超时退出配置，具体在Centos中的话，主要有两种方式可以实现超时退出的功能。所以本文的目的之一就是把那些问题说清楚。"}
{"title": "FreeBuf早报丨美国路易斯安那州宣布进入紧急状态，多个学区遭到网络攻击；暗网交易平台丝绸之路负责人被判刑；北京5G信号将先覆盖五环内", "url": "https://www.freebuf.com/news/209614.html", "time": "2019-07-29", "level": "", "num_look": 106427, "num_comment": 5, "author": "kirazhou", "tags": ["资讯"], "text": "继2018年2月受到SamSam勒索软件攻击，导致科罗拉多州交通局被迫关闭运营之后，最近路易斯安那州的多个学区遭受了严重的网络攻击"}
{"title": "反混淆神器！CyberChef助你秒解混淆脚本", "url": "https://www.freebuf.com/sectool/209290.html", "time": "2019-07-28", "level": "", "num_look": 270320, "num_comment": 6, "author": "深信服千里目安全实验室", "tags": ["工具"], "text": "CyberChef是一款强大的编码转换器简单易懂易上手，它集成了多种编码转换的功能，如：base64加解密、hex转换、char转换、正则表达式等，能辅助大家方便快捷地解密出恶意的脚本。"}
{"title": "挖洞经验丨敏感信息泄露+IDOR+密码确认绕过=账户劫持", "url": "https://www.freebuf.com/vuls/209227.html", "time": "2019-07-28", "level": "", "num_look": 194870, "num_comment": 5, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "网站存在不安全的访问控制措施，可以利用其导致的敏感信息泄露(auth_token) +密码重置限制绕过，以越权（IDOR）方式，实现网站任意账户劫持（Takeover）。"}
{"title": "内网全局代理工具及特征分析", "url": "https://www.freebuf.com/articles/network/208221.html", "time": "2019-07-28", "level": "", "num_look": 211682, "num_comment": 7, "author": "kczwa1", "tags": ["网络安全"], "text": "针对大型企业，现在几乎都是CDN，负载均衡等设备，所以个人认为现在反向代理更常见于渗透攻击中。"}
{"title": "Discuz!ML 3.x任意代码执行漏洞之大佬分析之后我分析", "url": "https://www.freebuf.com/vuls/208457.html", "time": "2019-07-28", "level": "", "num_look": 193733, "num_comment": 9, "author": "水木逸轩con", "tags": ["漏洞"], "text": "首先附上米斯特安全大佬们文章的链接，刚开始有些东西我没看的太懂，于是我就再添了点东西，希望像我一样的小白也能看懂。"}
{"title": "在DigitalOcean的服务器上用官方Kali镜像构建系统", "url": "https://www.freebuf.com/articles/system/209099.html", "time": "2019-07-27", "level": "", "num_look": 103705, "num_comment": 1, "author": "secist", "tags": ["系统安全"], "text": "DigitalOcean添加了一项非常有特色的功能，即对自定义镜像的支持允许用户导入虚拟机磁盘并将其作为“droplets”来使用。这意味着我们可以在他们的云中用官方Kali镜像构建我们自己的系统。"}
{"title": "将对未来工作产生影响的五大新兴技术", "url": "https://www.freebuf.com/news/209303.html", "time": "2019-07-27", "level": "", "num_look": 100372, "num_comment": 4, "author": "晶颜123", "tags": ["资讯"], "text": "你能想象到10年后自己的工作场所会变成什么样子吗？由于快速发展的技术正在改变工作性质、劳动模式以及工作场所等概念，因此，它可能会与今天我们所看到的一切截然不同。"}
{"title": "Trickbot银行木马下发Ryuk勒索病毒企业损失惨重", "url": "https://www.freebuf.com/articles/system/208537.html", "time": "2019-07-27", "level": "", "num_look": 112024, "num_comment": 2, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "一起利用Trickbot下发Ryuk勒索病毒的攻击事件……"}
{"title": "BUF大事件丨人民日报：《未成年人网络保护条例》有望今年出台；YouTube违反儿童在线隐私保护法案或罚款100万美元；蓝牙现新漏洞，微软及苹果产品“中招”", "url": "https://www.freebuf.com/news/209579.html", "time": "2019-07-27", "level": "红色标题", "num_look": 119523, "num_comment": 1, "author": "willhuang", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，人民日报：《未成年人网络保护条例》有望今年出台；YouTube违反儿童在线隐私保护法案或罚款100万美元；蓝牙现新漏洞，微软及苹果产品“中招”"}
{"title": "未授权访问漏洞总结", "url": "https://www.freebuf.com/articles/web/207877.html", "time": "2019-07-27", "level": "", "num_look": 387887, "num_comment": 2, "author": "karlbrain", "tags": ["WEB安全"], "text": "未授权访问漏洞可以理解为需要安全配置或权限认证的地址、授权页面存在缺陷导致其他用户可以直接访问从而引发重要权限可被操作、数据库或网站目录等敏感信息泄露。"}
{"title": "PTF：一款多模块渗透测试框架", "url": "https://www.freebuf.com/sectool/209091.html", "time": "2019-07-26", "level": "", "num_look": 157957, "num_comment": 157957, "author": "Alpha_h4ck", "tags": ["工具"], "text": "PTF会尝试安装所有你需要的渗透测试工具（最新版本），对这些项目进行编译和构建，并使它们成为在任何设备上都可以安装、更新和分发的工具。"}
{"title": "当偶像剧遇上CTF……", "url": "https://www.freebuf.com/video/209393.html", "time": "2019-07-26", "level": "红色标题", "num_look": 225244, "num_comment": 38, "author": "willhuang", "tags": ["视频"], "text": "近来一部关于网络安全大赛的青春偶像剧《亲爱的、热爱的》刷爆社交网络，频频登顶微博热搜，同时也在安全圈带来不少的话题，引来圈内网络安全从业者热烈讨（tǔ）论（cáo）。"}
{"title": "挖洞经验丨看我如何突破速率限制拿下任意Instagram账户", "url": "https://www.freebuf.com/vuls/208369.html", "time": "2019-07-26", "level": "", "num_look": 209053, "num_comment": 11, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "该Writeup是关于Instagram平台的任意账户劫持漏洞，作者通过构造出突破速率限制（Rate Limiting）的方法，可暴力猜解出任意Instagram账户的密码重置确认码，以此实现Instagram账户劫持。"}
{"title": "跟谁学（美股上市公司）招聘各类安全人才", "url": "https://www.freebuf.com/jobs/209297.html", "time": "2019-07-26", "level": "", "num_look": 151499, "num_comment": 4, "author": "我要吸得你喵喵叫", "tags": ["安全招聘"], "text": "百家互联旗下目前有跟谁学、高途课堂、成蹊商学院、金囿学堂等品牌。秉承“科技让教育更美好”使命，通过大数据、人工智能与在线教育结合， 在中小学文化课、实用英语、瑜伽、职场、留学、四六级、考研、家庭教育等领…"}
{"title": "微软RDP服务高危UAF漏洞分析（CVE-2019-0708）", "url": "https://www.freebuf.com/vuls/207969.html", "time": "2019-07-26", "level": "金币+20", "num_look": 198413, "num_comment": 7, "author": "alphalab", "tags": ["漏洞"], "text": "CVE-2019-0708经微软披露已经有一个多月了，本文将主要围绕几个方面介绍该漏洞。"}
{"title": "中国电子科技集团成为绿盟科技第一大股东", "url": "https://www.freebuf.com/news/209501.html", "time": "2019-07-26", "level": "", "num_look": 142689, "num_comment": 9, "author": "Freddy", "tags": ["资讯"], "text": "本次权益变动后，绿盟科技人员独立性、资产完整性和财务独立性不因本次权益变动而发生变化，绿盟科技仍将具有独立经营能力，拥有独立法人地位。"}
{"title": "APT34组织持续曝光", "url": "https://www.freebuf.com/articles/network/208335.html", "time": "2019-07-26", "level": "现金奖励", "num_look": 191578, "num_comment": 9, "author": "Kriston", "tags": ["网络安全"], "text": "今年以来，名为“Lab Dookhtegan”的用户在Telegram上持续对该伊朗APT组织使用工具、攻击目标、内部成员等信息进行曝光。"}
{"title": "FreeBuf早报丨FTC起诉已经破产的剑桥分析公司，并限制前CEO商业活动；苹果收购英特尔的智能手机调制解调器业务；报告显示2019年上半年已有超过2300万张信用卡信息在暗网上出售", "url": "https://www.freebuf.com/news/209492.html", "time": "2019-07-26", "level": "", "num_look": 73246, "num_comment": 2, "author": "Karunesh91", "tags": ["资讯"], "text": "FTC起诉已经破产的剑桥分析公司，并限制前CEO商业活动；苹果收购英特尔的智能手机调制解调器业务；报告显示2019年上半年已有超过2300万张信用卡信息在暗网上出售。"}
{"title": "你的PoC和EXP可能得改改了", "url": "https://www.freebuf.com/articles/web/207998.html", "time": "2019-07-26", "level": "", "num_look": 149281, "num_comment": 1, "author": "麒麟安全实验室", "tags": ["WEB安全"], "text": "在MySQL 5.7.5之前的所有主版本存在一个BUG，该可能导致影响POC/EXP需要重新编写或修正的问题。"}
{"title": "漏洞预警丨Xstream远程代码执行漏洞", "url": "https://www.freebuf.com/vuls/209449.html", "time": "2019-07-25", "level": "", "num_look": 203813, "num_comment": 1, "author": "斗象智能安全平台", "tags": ["漏洞"], "text": "Xstream 1.4.10版本存在反序列化漏洞CVE-2013-7285补丁绕过。"}
{"title": "CVE-2019-12384漏洞分析及复现", "url": "https://www.freebuf.com/vuls/209394.html", "time": "2019-07-25", "level": "", "num_look": 446777, "num_comment": 3, "author": "平安银行应用安全团队", "tags": ["WEB安全", "漏洞"], "text": "近期关于Jackson的RCE漏洞CVE-2019-12384爆出，关于漏洞的复现以及依赖，这里已经给出，笔者这边使用java的环境重新复现了一下，权当给各位看官当个翻译，也让在java上进行漏洞复现的兄弟们少走点弯路。"}
{"title": "利用DNS隧道构建隐蔽C&C信道", "url": "https://www.freebuf.com/articles/network/208242.html", "time": "2019-07-25", "level": "现金奖励", "num_look": 297816, "num_comment": 9, "author": "mumufeng06", "tags": ["网络安全"], "text": "你了解哪些技术可以被恶意利用到构建隐蔽的C&C信道？知己知彼，在相应应对策略上才能取得先机。"}
{"title": "导致企业端点安全问题的5大原因分析", "url": "https://www.freebuf.com/articles/es/209237.html", "time": "2019-07-25", "level": "", "num_look": 105933, "num_comment": 5, "author": "晶颜123", "tags": ["企业安全"], "text": "如今，网络安全继续从优先预防向强调检测能力方向转移。因此，网络安全专家也倾向于弱化端点安全在企业整体网络安全中的重要性；相反地，他们开始宣扬身份管理和安全分析的重要性。"}
{"title": "Hi，北京的白帽子想认识你！| FreeTalk 2019 北京站议题征集", "url": "https://www.freebuf.com/fevents/209358.html", "time": "2019-07-25", "level": "", "num_look": 55595, "num_comment": 1, "author": "FB客服", "tags": ["活动"], "text": "FreeTalk 2019 北京站议题招募中。只要你的议题和安全技术相关，只要议题的内容足够吸引人，统统抛过来，FreeTalk的舞台属于你。"}
{"title": "挖洞经验丨有上传文件的文件名处发现的时间延迟注入漏洞", "url": "https://www.freebuf.com/vuls/208362.html", "time": "2019-07-25", "level": "", "num_look": 202096, "num_comment": 8, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "在上传文件的文件名处的一个时间延迟盲注漏洞，这种姿势相对少见，分享在此希望能对大家起到借鉴学习作用。"}
{"title": "云雾数据诚聘安全大牛！欢迎您来撩！", "url": "https://www.freebuf.com/jobs/209222.html", "time": "2019-07-25", "level": "", "num_look": 71401, "num_comment": 6, "author": "云雾数据data", "tags": ["安全招聘"], "text": "深圳市云雾数据科技有限公司，是一家主要为网络空间安全、大数据安全、可信计算服务、物联网搜索等领域服务的科技型公司，聚集了一大批来自知名科研院校的科研骨干。"}
{"title": "感染数万设备！警惕ZombieBoy挖矿木马“丧尸式”传播", "url": "https://www.freebuf.com/articles/system/208049.html", "time": "2019-07-25", "level": "", "num_look": 109278, "num_comment": 5, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近日，深信服安全团队监测到一款名为ZombieBoy的木马悄然感染了国内外各个行业的用户主机。"}
{"title": "Buhtrap黑客组织最新0day漏洞分析", "url": "https://www.freebuf.com/vuls/208179.html", "time": "2019-07-25", "level": "", "num_look": 141724, "num_comment": 2, "author": "Kriston", "tags": ["漏洞", "网络安全"], "text": "一直以针对俄罗斯的金融机构和企业而闻的Buhtrap组织，已变为网络犯罪组织，在跟踪过程中，我们发现并分析了该组织的主要后门以及其他工具……"}
{"title": "FreeBuf早报 | 四分之一数据泄露事件的原因是人为错误；NSA计划筹建网络安全理事会，以便与国土安全部和FBI更好地协作；VLC开发人员表示VLC不受此前公布的漏洞影响", "url": "https://www.freebuf.com/news/209372.html", "time": "2019-07-25", "level": "", "num_look": 66279, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "去年所有数据泄露事件中有四分之一是人为错误引起的。同期所有违规行为的平均成本为392万美元，比前一年增加1.5％。"}
{"title": "【精彩回顾】等级保护2.0研讨专场 | 企业安全俱乐部「北京站」", "url": "https://www.freebuf.com/fevents/209295.html", "time": "2019-07-24", "level": "", "num_look": 79908, "num_comment": 2, "author": "FB独家", "tags": ["活动"], "text": "「等级保护2.0研讨专场」北京站已圆满落幕，快让我们一起来回顾一下今天的热门看点吧。"}
{"title": "将任意文本隐藏在音频视频图片和文本中的多种方式", "url": "https://www.freebuf.com/sectool/208781.html", "time": "2019-07-24", "level": "", "num_look": 177945, "num_comment": 4, "author": "secist", "tags": ["工具"], "text": "我们使用了一种被称之为“隐写术（Steganography）”的方法。"}
{"title": "企业安全体系架构分析：开发安全架构之综合架构", "url": "https://www.freebuf.com/articles/es/207328.html", "time": "2019-07-24", "level": "现金奖励", "num_look": 182743, "num_comment": 10, "author": "煜阳yuyang", "tags": ["企业安全"], "text": "实际上一个综合架构的设计不可能只考虑或者过分的考虑安全性，业务架构与安全架构的综合分析才是一个综合架构应该考虑的事情。那么如何做到鱼与熊掌兼得？"}
{"title": "【FreeBuf字幕组】Web安全漏洞系列：XML外部实体注入攻击（XXE）", "url": "https://www.freebuf.com/video/209186.html", "time": "2019-07-24", "level": "红色标题", "num_look": 90147, "num_comment": 4, "author": "willhuang", "tags": ["视频"], "text": "本课程围绕XML基本结构、实体（Entity）类型、实体调用、文档类型定义（DTD）和外部DTD调用等关键内容，深入浅出地阐述了外部实体注入攻击（XXE）和的现实场景。"}
{"title": "【议题前瞻】健康医疗数据安全国家标准研制与实践 | 泰康安全高峰论坛", "url": "https://www.freebuf.com/fevents/208990.html", "time": "2019-07-24", "level": "", "num_look": 47401, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "泰康保险集团携手FreeBuf举办的「泰康安全高峰论坛」邀请ISO/IEC-JTC1/SC27国际标准注册专家，清华大学软件学院特别研究员金涛博士，为我们带来《健康医疗数据安全国家标准研制与实践》议题分享。"}
{"title": "如何使用Windows Sandbox保持保障自身安全", "url": "https://www.freebuf.com/articles/system/208149.html", "time": "2019-07-24", "level": "", "num_look": 119597, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "对于那些安全意识非常强，但又不想安装专用虚拟机软件（例如VirtualBox、Hyper-V或VMWare等）的用户来说，Windows沙盒就是一个非常理想的替代方案了。"}
{"title": "MailEnable漏洞预警（CVE-2019-12923~CVE-2019-12927）", "url": "https://www.freebuf.com/vuls/207942.html", "time": "2019-07-24", "level": "", "num_look": 134559, "num_comment": 2, "author": "深信服千里目安全实验室", "tags": ["漏洞"], "text": "近日，邮件服务器MailEnable爆出了一组漏洞，第一时间进行跟踪以及分析预警。经研究发现，利用该组漏洞，攻击者可以实现用户数据增删改查、文件读取以及部分越权操作。"}
{"title": "FreeBuf早报 | 美国和俄国的网络威胁主要集中在民用基础设施；委内瑞拉再次遭遇大范围停电；Palo Alto Networks VPN漏洞曝光", "url": "https://www.freebuf.com/news/209256.html", "time": "2019-07-24", "level": "", "num_look": 85411, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "当地时间7月22日，委内瑞拉又一次遭遇大范围停电，23个州中有一半以上受到了停电影响。委内瑞拉新闻和通信部长豪尔赫·罗德里格斯表示，此次停电的原因是“电磁攻击”，并称相关部门正在重新恢复电力供应。"}
{"title": "攻击组织代号Cold River：通过NTA对恶意程序的深度分析", "url": "https://www.freebuf.com/articles/web/208726.html", "time": "2019-07-24", "level": "", "num_look": 106800, "num_comment": 1, "author": "kirazhou", "tags": ["WEB安全"], "text": "Cold River，一个恶意使用DNS隧道进行指挥和控制活动的攻击组织"}
{"title": "看我如何发现Bol.com网站的XXE漏洞并成功利用", "url": "https://www.freebuf.com/articles/web/208718.html", "time": "2019-07-23", "level": "", "num_look": 190183, "num_comment": 6, "author": "secist", "tags": ["WEB安全"], "text": "在之前的报告中，我们学到了许多有关在访问者的浏览器中执行代码的知识；反射型XSS和存储型XSS。此外，我们还快速查看了错误配置的服务器设置和Open Redirect（开放式重定向）。"}
{"title": "重磅 | 启明星辰联合FreeBuf发布《2018-2019年网络安全态势观察报告》", "url": "https://www.freebuf.com/articles/paper/208385.html", "time": "2019-07-23", "level": "红色标题", "num_look": 259964, "num_comment": 20, "author": "启明星辰", "tags": ["安全报告"], "text": "启明星辰集团联合FreeBuf正式发布《2018~2019网络安全态势观察报告》，对过去一年多的网络安全事件进行了研究、分析，也对网络安全的发展进行总结和思考。"}
{"title": "挖洞经验 | 影响400多万Mac系统的Zoom视频会议软件漏洞", "url": "https://www.freebuf.com/vuls/208158.html", "time": "2019-07-23", "level": "", "num_look": 147381, "num_comment": 1, "author": "clouds", "tags": ["漏洞"], "text": "本文中，作者描述了如何发现ZOOM for Mac客户端程序的两个漏洞和一个缺陷，安装有ZOOM客户端的Mac系统用户可能会受到RCE攻击，可被攻击者远程未授权开启本机摄像头。"}
{"title": "极光无限招聘安全人才，高薪不是问题！", "url": "https://www.freebuf.com/jobs/203957.html", "time": "2019-07-23", "level": "", "num_look": 209540, "num_comment": 44, "author": "极光无限SZ", "tags": ["安全招聘"], "text": "公司致力于建设华东地区技术实力强劲的信息安全研究实验室，目标建成国内专业、技术领先的标杆性安全公司。"}
{"title": "2019上半年挖矿木马报告：日均新增6万个木马样本", "url": "https://www.freebuf.com/articles/paper/208181.html", "time": "2019-07-23", "level": "", "num_look": 115214, "num_comment": 4, "author": "腾讯安全", "tags": ["安全报告"], "text": "随着比特币的飙升，推动整个数字加密货币价格回升，与币市密切相关的挖矿木马开始新一轮活跃。"}
{"title": "CARTA：持续自适应风险与信任评估", "url": "https://www.freebuf.com/articles/es/208206.html", "time": "2019-07-23", "level": "现金奖励", "num_look": 237089, "num_comment": 9, "author": "宇宸de研究室", "tags": ["企业安全"], "text": "安全和风险管理者可以使用CARTA战略方法来拥抱数字业务的机遇以及应对管理的风险。"}
{"title": "FreeBuf早报丨微软将支付2530万美元罚款以了结美国反贿赂指控；安全研究人员发现中国网贷App漏洞泄露大量个人信息；蓝牙现新漏洞，微软及苹果产品“中招”", "url": "https://www.freebuf.com/news/209100.html", "time": "2019-07-23", "level": "", "num_look": 96093, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "微软将支付2530万美元罚款以了结美国反贿赂指控；安全研究人员发现中国网贷App漏洞泄露大量个人信息；蓝牙现新漏洞，微软及苹果产品“中招”。"}
{"title": "等保测评：CentOS登录失败参数详解和双因素认证", "url": "https://www.freebuf.com/articles/terminal/208176.html", "time": "2019-07-23", "level": "现金奖励", "num_look": 161446, "num_comment": 19, "author": "起于凡而非于凡", "tags": ["终端安全"], "text": "在测评时，设计登录失败处理功能，就少不了要使用pam_tally2（centos6和之后的版本），那么就有必要明白这个模块各个参数（选项）的意义。"}
{"title": "央视网黄乐：媒体行业风险管理体系设计与实现", "url": "https://www.freebuf.com/articles/people/208819.html", "time": "2019-07-23", "level": "红色标题", "num_look": 545962, "num_comment": 26, "author": "huangle0914", "tags": ["人物志"], "text": "本文将先从风险的三个基本要素（资产、脆弱性和威胁）分别展开管理思路，最后再将这三要素整合到一起。"}
{"title": "0xsp-Mongoose：Linux提权枚举工具包", "url": "https://www.freebuf.com/sectool/208809.html", "time": "2019-07-23", "level": "", "num_look": 138261, "num_comment": 4, "author": "secist", "tags": ["工具"], "text": "帮助你针对特定的目标系统执行任何可能的提权攻击，从信息收集阶段到报告通过0xsp Web Application API。"}
{"title": "挖掘暗藏ThinkPHP中的反序列利用链", "url": "https://www.freebuf.com/news/231025.html", "time": "2019-07-22", "level": "", "num_look": 3862, "num_comment": 3862, "author": "斗象智能安全平台", "tags": ["资讯"], "text": ""}
{"title": "挖掘移动端APP漏洞：移动APP安全入门 | 精品公开课", "url": "https://www.freebuf.com/open/209069.html", "time": "2019-07-22", "level": "", "num_look": 116272, "num_comment": 2, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "2019年移动端欺诈攻击同期增长近三倍，金融恶意软件的欺诈攻击增长56％。因此，加强对移动安全领域的关注，提升移动终端的安全等级是很有必要的。"}
{"title": "CVE-2019-11815：Linux内核竞争条件漏洞导致远程代码执行", "url": "https://www.freebuf.com/vuls/208256.html", "time": "2019-07-22", "level": "", "num_look": 147405, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["漏洞"], "text": "运行了Linux发行版的计算机设备，如果内核版本小于5.0.8的话，将有可能受到一个内核竞争条件漏洞的影响，并导致系统无法抵御远程网络攻击。"}
{"title": "企业安全体系架构分析：开发安全架构之防CC攻击脚本编写", "url": "https://www.freebuf.com/articles/web/207491.html", "time": "2019-07-22", "level": "现金奖励", "num_look": 471628, "num_comment": 22, "author": "煜阳yuyang", "tags": ["WEB安全"], "text": "今天想分享一下安全脚本的编写，以防CC脚本举个例子。"}
{"title": "销售易招聘安全运维工程师", "url": "https://www.freebuf.com/jobs/208530.html", "time": "2019-07-22", "level": "", "num_look": 107507, "num_comment": 8, "author": "DearLi", "tags": ["安全招聘"], "text": "销售易隶属于北京仁科互动网络技术有限公司，是融合新型互联网技术的全新一代连接企业内外的客户关系管理软件（CRM） 服务商。"}
{"title": "Linux平台ibus蠕虫C&C模块源码分析", "url": "https://www.freebuf.com/articles/system/208374.html", "time": "2019-07-22", "level": "", "num_look": 95299, "num_comment": 2, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近期，在排查问题时，遇到一台主机不断访问恶意域名linuxsrv134.xp3.biz，尝试与之通信，通过对问题主机的排查和域名的威胁情报分析，关联到了一个2019年新型Linux蠕虫——ibus。"}
{"title": "「畅谈安全 同创共建」 | 第一届泰康安全高峰论坛报名开启！", "url": "https://www.freebuf.com/fevents/208561.html", "time": "2019-07-22", "level": "", "num_look": 84529, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "2019年8月8日，泰康保险集团将携手FreeBuf在北京共同举办以「畅谈安全 同创共建」为主题的第一届泰康安全高峰论坛。"}
{"title": "FreeBuf早报丨上海破获一起假冒招考热线网站非法获取公民信息案；黑客利用Ellucian Banner Web漏洞攻击62所美国大学；黑客攻入俄罗斯联邦安全局承包商服务器 窃取7.5TB的数据", "url": "https://www.freebuf.com/news/208937.html", "time": "2019-07-22", "level": "", "num_look": 94662, "num_comment": 2, "author": "Freddy", "tags": ["资讯"], "text": "2019年7月8日，上海市公安局破获一起假冒“上海招考热线”网站非法获取公民信息案，抓获犯罪嫌疑人徐某某。"}
{"title": "挖洞经验丨看我如何玩转SUPRA智能云电视", "url": "https://www.freebuf.com/vuls/208520.html", "time": "2019-07-21", "level": "", "num_look": 120876, "num_comment": 1, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "SUPRA智能云电视存在播放可劫持漏洞，与SUPRA电视处于同一无线网络环境中的攻击者，可向电视设备伪造播放请求，插播任意视频内容或虚假广播消息。"}
{"title": "使用Cutter和Radare2对APT32恶意程序流程图进行反混淆处理", "url": "https://www.freebuf.com/articles/network/208019.html", "time": "2019-07-21", "level": "", "num_look": 118722, "num_comment": 118722, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "Ocean Lotus Group，也被称之为APT32，这个黑客组织此前主要的攻击目标以越南、老挝和菲律宾等东亚国家为主。"}
{"title": "记一次Linux木马清除过程", "url": "https://www.freebuf.com/articles/system/208804.html", "time": "2019-07-21", "level": "现金奖励", "num_look": 253855, "num_comment": 13, "author": "xyl870612", "tags": ["系统安全"], "text": "前段时间公司发生了一起服务器入侵事件，在此分享给大家也顺便理顺下linux入侵应急响应思路。"}
{"title": "思科DCNM多个漏洞细节分析", "url": "https://www.freebuf.com/vuls/207880.html", "time": "2019-07-21", "level": "", "num_look": 111637, "num_comment": 111637, "author": "Kriston", "tags": ["漏洞"], "text": "DCNM 11.1及以下受4个漏洞影响：绕过身份验证、任意文件上传（导致远程代码执行）、任意文件下载和通过日志下载敏感信息。"}
{"title": "老裁缝、独狼病毒家族再度活跃，唯心木马很违心", "url": "https://www.freebuf.com/articles/system/208186.html", "time": "2019-07-21", "level": "", "num_look": 134542, "num_comment": 2, "author": "安全豹", "tags": ["系统安全"], "text": "近期，“独狼”病毒家族的感染量呈现出上升的趋势，结合数据来看，发现其是从一个名为InstExe_02XX的程序释放而来，在后续的进一步分析中，我们发现多款流氓软件近期同时都在推送该文件。"}
{"title": "Cloud-Security-Audit：一款基于Go的AWS命令行安全审计工具", "url": "https://www.freebuf.com/sectool/208370.html", "time": "2019-07-20", "level": "", "num_look": 95039, "num_comment": 95039, "author": "secist", "tags": ["工具"], "text": "cloud-security-audit是一款适用于AWS的命令行安全审计工具。它可以帮助你扫描AWS账户中的漏洞，你将能够快速识别基础架构中不安全的部分，并执行对AWS账户的审计工作。"}
{"title": "世界上最著名也最危险的APT恶意软件清单", "url": "https://www.freebuf.com/articles/network/208449.html", "time": "2019-07-20", "level": "红色标题", "num_look": 252505, "num_comment": 14, "author": "kirazhou", "tags": ["网络安全"], "text": "本文尝试列举出由各国军事情报处的网络安全部门开发的最危险、最有效也是最闻名的恶意软件清单，其中有些可以说早已盛名在外，另一些可能你还没听过……然而这正是它最危险之处。"}
{"title": "Mac Zoom漏洞细节分析", "url": "https://www.freebuf.com/vuls/208177.html", "time": "2019-07-20", "level": "", "num_look": 129870, "num_comment": 129870, "author": "Kriston", "tags": ["漏洞"], "text": "Mac Zoom客户端中存在漏洞，允许任何恶意网站在未经许可的情况下启用摄像头。这一漏洞可能会暴露出世界上多达75万家使用ZOOM进行日常业务的公司。"}
{"title": "BUF大事件丨QQ盗号太鸡贼，官方域名都没法信；Apple Watch对讲机APP曝出窃听漏洞；工信部互联网信息服务投诉平台正式上线", "url": "https://www.freebuf.com/news/208859.html", "time": "2019-07-20", "level": "红色标题", "num_look": 125538, "num_comment": 125538, "author": "willhuang", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，QQ盗号太鸡贼，官方域名都没法信；Apple Watch对讲机APP曝出窃听漏洞；工信部互联网信息服务投诉平台正式上线"}
{"title": "浅谈安全运维优化", "url": "https://www.freebuf.com/articles/security-management/208249.html", "time": "2019-07-19", "level": "", "num_look": 184704, "num_comment": 13, "author": "dawner", "tags": ["安全管理"], "text": "近期由乙方安服实验室，转入了甲方的业务安全部门。在接触了一部分业务安全的运维工作后，也做了些对于自身工作的优化方向的思考。"}
{"title": "春秋航空招聘信息安全工程师", "url": "https://www.freebuf.com/jobs/208534.html", "time": "2019-07-19", "level": "", "num_look": 155118, "num_comment": 14, "author": "SixSixSix", "tags": ["安全招聘"], "text": "春秋航空股份有限公司作为中国首批民营航空公司之一，于2005年7月18日开航，是国内第一家，也是国内最大的低成本航空公司，现拥有84架飞机（78架空客A320飞机、6架波音737）。"}
{"title": "你真的了解病毒分析吗？反病毒专家为你深度揭密", "url": "https://www.freebuf.com/articles/database/208786.html", "time": "2019-07-19", "level": "现金奖励", "num_look": 1209809, "num_comment": 12, "author": "熊猫正正", "tags": ["企业安全", "数据安全"], "text": "在当前企业安全的环境下，做恶意样本分析到底有什么作用？因为只有知道它有用，你才会花时间去学习。"}
{"title": "关于远控木马你应该了解的知识点", "url": "https://www.freebuf.com/articles/system/207643.html", "time": "2019-07-19", "level": "", "num_look": 246884, "num_comment": 9, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "传统的远控木马在攻击中已经不够隐蔽了，因而现在衍生出很多新的木马技术，更有针对性，甚至可能不进行交互，数据传输频率极低等，已演变成混合型木马。"}
{"title": "FreeBuf早报丨谷歌上调Chrome漏洞赏金额度，最高达30000美元；首例比特币财产侵权纠纷案在杭州互联网法院开庭宣判；保加利亚遭黑客入侵，500万民众信息外泄", "url": "https://www.freebuf.com/news/208782.html", "time": "2019-07-19", "level": "", "num_look": 74183, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "谷歌上调Chrome漏洞赏金额度，最高达30000美元；首例比特币财产侵权纠纷案在杭州互联网法院开庭宣判；保加利亚遭黑客入侵，500万民众信息外泄"}
{"title": "利用SSH隧道加密、隐蔽C&C通信流量", "url": "https://www.freebuf.com/articles/network/207850.html", "time": "2019-07-19", "level": "现金奖励", "num_look": 220152, "num_comment": 4, "author": "mumufeng06", "tags": ["网络安全"], "text": "在网络攻防博弈中，网络流量特征分析类安全防御措施得到了广泛应用。众多厂商和企业对网络流量进行恶意流量分析检测，从而针对性的采取防御措施。"}
{"title": "TOD赤橙黄绿青蓝紫队系列：COM之恶", "url": "https://www.freebuf.com/articles/system/207966.html", "time": "2019-07-19", "level": "现金奖励", "num_look": 108233, "num_comment": 2, "author": "kczwa1", "tags": ["系统安全"], "text": "渗透测试人员、红队以及恶意软件都在攻击中使用COM对象，遂参考多方资料对COM的恶意应用作一个小总结。"}
{"title": "内行客户评估欺骗防御方案会问供应商的11个问题", "url": "https://www.freebuf.com/articles/network/208174.html", "time": "2019-07-18", "level": "", "num_look": 95234, "num_comment": 4, "author": "柚子", "tags": ["网络安全"], "text": "现在市场上不缺欺骗防御类产品，本文介绍能够对不同的欺骗防御方案作出初步评估和筛选的11个问题，避免用户在眼花缭乱的营销手段下，花大价钱买回了效果微乎其微的东西。"}
{"title": "借助树莓派上演“窃听风云”", "url": "https://www.freebuf.com/articles/wireless/206029.html", "time": "2019-07-18", "level": "现金奖励", "num_look": 575293, "num_comment": 31, "author": "xutiejun", "tags": ["无线安全", "极客"], "text": "在N年前看《窃听风云》时，里面的窃听环节就深深吸引着我，让我记忆深刻。在N年前对于普通的我们想要实现远程窃听技术需要购买昂贵的设备才能实现。"}
{"title": "挖洞经验 | 看我如何发现微软Outlook for Android移动应用的XSS漏洞", "url": "https://www.freebuf.com/vuls/208038.html", "time": "2019-07-18", "level": "", "num_look": 107067, "num_comment": 5, "author": "clouds", "tags": ["漏洞"], "text": "今天分享的Writeup是关于Outlook for Andriod的存储型XSS漏洞，作者通过朋友发来的技术邮件偶然发现了该漏洞，历经长达几个月的复现构造，最终微软承认了该漏洞（CVE-2019-1105）。"}
{"title": "Android出现新漏洞，可在无权限的情况下利用传感器获取语音信息", "url": "https://www.freebuf.com/news/208700.html", "time": "2019-07-18", "level": "", "num_look": 93238, "num_comment": 5, "author": "Karunesh91", "tags": ["资讯"], "text": "近日，网络安全团队发现了一种全新的旁路攻击，可以通过恶意程序窃听手机扬声器发出的声音，并且无需任何设备许可。"}
{"title": "重磅丨斗象科技连续三届荣获CNCERT网络安全应急服务支撑单位证书（省级）", "url": "https://www.freebuf.com/news/208687.html", "time": "2019-07-18", "level": "", "num_look": 99138, "num_comment": 6, "author": "斗象科技官方", "tags": ["资讯"], "text": "斗象科技凭借着强烈的责任心、专业的技术能力和丰富的服务经验，连续三届荣获网络安全应急服务支撑单位证书（省级）。"}
{"title": "漏洞预警丨Palo Alto GlobalProtect SSL VPN远程代码执行漏洞", "url": "https://www.freebuf.com/vuls/208673.html", "time": "2019-07-18", "level": "", "num_look": 159335, "num_comment": 1, "author": "斗象智能安全平台", "tags": ["漏洞"], "text": "Palo Alto GlobalProtect SSL VPN是企业常用的SSLVPN产品，近期公开了一个远程代码执行漏洞。"}
{"title": "2019上半年Web应用安全报告：90%以上攻击流量来源于扫描器", "url": "https://www.freebuf.com/articles/web/208400.html", "time": "2019-07-18", "level": "", "num_look": 129097, "num_comment": 2, "author": "阿里云安全", "tags": ["WEB安全"], "text": "Web应用是互联网安全的最大威胁来源之一，除了传统的网页和APP，API和各种小程序也作为新的流量入口快速崛起，更多的流量入口和更易用的调用方式在提高web应用开发效率的同时也带来了更多和更复杂的安全问题。"}
{"title": "基于DoH的隐蔽通信的机理与防御", "url": "https://www.freebuf.com/articles/database/207891.html", "time": "2019-07-18", "level": "", "num_look": 179325, "num_comment": 179325, "author": "DigApis", "tags": ["数据安全"], "text": "和HTTP通信类似，DNS请求环节也应该被加密以保护用户的隐私，即由DNS+HTTPS升级为DoH+HTTPS，这样用户的上网行为得到了全程的加密保护。"}
{"title": "FreeBuf早报丨继联想之后，技嘉旗下产品也受到固件漏洞影响；贷款应用可暴露数百万国人的位置；五角大楼希望加强网络安全队伍 为2020美国总统大选护航", "url": "https://www.freebuf.com/news/208661.html", "time": "2019-07-18", "level": "", "num_look": 69304, "num_comment": 2, "author": "Freddy", "tags": ["资讯"], "text": "在申请贷款时，国人使用的100多个移动贷款相关应用程序将高度敏感的信息添加到可公开访问的数据库中。"}
{"title": "由Arduino Leonardo初识BadUsb", "url": "https://www.freebuf.com/articles/terminal/207356.html", "time": "2019-07-18", "level": "现金奖励", "num_look": 183652, "num_comment": 6, "author": "Parad0x", "tags": ["终端安全"], "text": "回想起攻防演习中的神操作，如从树莓派+8187L网卡魔改无人机及带着味道的钻下水道操作，仍值得回味。"}
{"title": "网络流量分析（NTA）解决方案市场规模将于2026年达到53亿美元", "url": "https://www.freebuf.com/news/208572.html", "time": "2019-07-17", "level": "", "num_look": 176992, "num_comment": 5, "author": "Karunesh91", "tags": ["网络安全", "资讯"], "text": "不久前，Transparency Market Research针对2018-2026年内的全球网络流量分析市场进行了调研和展望，并发布了相关报告。"}
{"title": "伊朗网络攻击！？曼哈顿大规模停电事故官方回复", "url": "https://www.freebuf.com/news/208555.html", "time": "2019-07-17", "level": "红色标题", "num_look": 268639, "num_comment": 11, "author": "晶颜123", "tags": ["网络安全", "资讯"], "text": "上周六（7月13日）晚7点左右，曼哈顿西区发生了大范围停电事故，东起第五大道，西至哈德逊河畔，南起西43街，北至上西区71街均无电可用，断电用户数量最高时达到7.3万户。"}
{"title": "索尼BRAVIA智能电视存在漏洞", "url": "https://www.freebuf.com/vuls/207968.html", "time": "2019-07-17", "level": "", "num_look": 116884, "num_comment": 6, "author": "Kriston", "tags": ["漏洞"], "text": "XEN1THLabs在Sony产品中发现了两个漏洞，并与索尼披露了这些安全缺陷。索尼Bravia智能电视中被发现存在安全性问题，但是索尼没有公布受影响型号的列表。"}
{"title": "【议题前瞻】等级保护2.0标准条款实践案例 | 企业安全俱乐部", "url": "https://www.freebuf.com/fevents/208548.html", "time": "2019-07-17", "level": "", "num_look": 51438, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "7月24日，「FreeBuf 企业安全俱乐部」北京站系列沙龙活动「等级保护2.0研讨专场」上，张娜将为大家分享《云计算环境下的等保2.0应用实践》。"}
{"title": "勒索病毒知识库：Cypren勒索病毒", "url": "https://www.freebuf.com/articles/system/207577.html", "time": "2019-07-17", "level": "", "num_look": 140212, "num_comment": 4, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "本文将经过详细的分析对Cypren勒索病毒进行讲解。"}
{"title": "Scavenger：在不同的paste网站上搜索泄漏的凭据", "url": "https://www.freebuf.com/sectool/207746.html", "time": "2019-07-17", "level": "", "num_look": 130717, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "Scavenger是一款可在多个paste网站上搜索泄漏的凭据的工具。"}
{"title": "浅谈Fastjson RCE漏洞的绕过史", "url": "https://www.freebuf.com/vuls/208339.html", "time": "2019-07-17", "level": "红色标题", "num_look": 490278, "num_comment": 8, "author": "平安银行应用安全团队", "tags": ["漏洞"], "text": "关于fastjson的缝缝补补，瞻仰并总结一下大佬们和安全开发人员的斗智斗勇"}
{"title": "DSMM之数据采集过程安全", "url": "https://www.freebuf.com/articles/database/207702.html", "time": "2019-07-17", "level": "现金奖励", "num_look": 1407460, "num_comment": 12, "author": "LJ_Monica", "tags": ["数据安全"], "text": "上个月投稿了DSMM数据安全能力成熟度模型总结与交流，主要简单地介绍了DSMM的内容以及个人的思考，作为DSMM的开篇交流。今天是从数据安全的生命周期阶段介绍DSMM的具体内容。"}
{"title": "FreeBuf早报丨联想NAS产品固件漏洞可泄露存储的数据；黑客窃取数百万保加利亚人个人数据并发送给媒体；Zoom Mac版漏洞波及范围扩大，影响另外两款软件", "url": "https://www.freebuf.com/news/208523.html", "time": "2019-07-17", "level": "", "num_look": 64483, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "研究人员发现，超过5100个包含数TB数据的联想NAS设备面临网络攻击风险，原因在于产品存在固件及漏洞。"}
{"title": "深入分析macOS漏洞CVE-2019-8507", "url": "https://www.freebuf.com/vuls/208148.html", "time": "2019-07-17", "level": "", "num_look": 89956, "num_comment": 89956, "author": "Alpha_h4ck", "tags": ["漏洞"], "text": "在这篇文章中，我们将对macOS中的漏洞CVE-2019-8507进行详细分析。"}
{"title": "GeForce ExperienceOS命令注入漏洞CVE-2019-5678", "url": "https://www.freebuf.com/vuls/207750.html", "time": "2019-07-16", "level": "", "num_look": 122956, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["漏洞"], "text": "攻击者可以通过诱骗目标用户访问钓鱼网站来利用该漏洞。"}
{"title": "一封钓鱼邮件带来的乐趣", "url": "https://www.freebuf.com/articles/system/207759.html", "time": "2019-07-16", "level": "现金奖励", "num_look": 393291, "num_comment": 19, "author": "yangyangwithgnu", "tags": ["系统安全"], "text": "整个六月你我都很忙，你忙着钓鱼、我忙着封锁 IP，一份邮件把我从紧张的氛围中拉了出来。"}
{"title": "Instagram曝出漏洞，10分钟破解任意账户", "url": "https://www.freebuf.com/news/208408.html", "time": "2019-07-16", "level": "", "num_look": 174738, "num_comment": 3, "author": "Karunesh91", "tags": ["资讯"], "text": "知名社交软件Instagram近日被曝出一个漏洞，号称可以在不与用户发生任何互动的情况下窃取对方ins账户。"}
{"title": "卡巴斯基2019年Q1垃圾邮件与钓鱼攻击统计分析", "url": "https://www.freebuf.com/articles/network/207749.html", "time": "2019-07-16", "level": "", "num_look": 105110, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "2019年第1季度，垃圾邮件在全球邮件流量中的平均占比上升了0.06 p.p.，提升至了55.97%，反钓鱼网站系统成功阻止了超过111832308次重定向至钓鱼网站的攻击活动。"}
{"title": "中国东方航空诚聘高级安全人才", "url": "https://www.freebuf.com/jobs/208282.html", "time": "2019-07-16", "level": "", "num_look": 175199, "num_comment": 9, "author": "SixSixSix", "tags": ["安全招聘"], "text": "中国东方航空股份有限公司（ChinaEastern Airlines），是一家总部位于中国上海的国有控股航空公司，是中国三大国有大型骨干航空企业之一。"}
{"title": "小师妹对IT服务安全的思考", "url": "https://www.freebuf.com/articles/neopoints/207562.html", "time": "2019-07-16", "level": "现金奖励", "num_look": 192930, "num_comment": 12, "author": "xxx幸xxx", "tags": ["观点"], "text": "写这篇文章的目的一是分享我自己对服务安全的思考，二是想听听各位在IT服务项目上积累了多年实践经验的前辈们对这个问题的看法以及分析。"}
{"title": "2019上半年勒索病毒专题报告", "url": "https://www.freebuf.com/articles/paper/207660.html", "time": "2019-07-16", "level": "", "num_look": 221991, "num_comment": 2, "author": "腾讯电脑管家", "tags": ["安全报告"], "text": "全球范围内的交通、能源、医疗等社会基础服务设施，成为勒索病毒攻击的目标。"}
{"title": "FreeBuf早报丨Facebook：在监管顾虑解决前不会推出天秤币；2020年起韩国政府部门开始采用“安全邮箱”系统；重点互联网企业签订防范治理电信网络诈骗责任书", "url": "https://www.freebuf.com/news/208371.html", "time": "2019-07-16", "level": "", "num_look": 57759, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "Facebook：在监管顾虑解决前不会推出天秤币；2020年起韩国政府部门开始采用“安全邮箱”系统；重点互联网企业签订防范治理电信网络诈骗责任书。"}
{"title": "Atlassian JIRA模板注入漏洞预警", "url": "https://www.freebuf.com/vuls/208365.html", "time": "2019-07-15", "level": "", "num_look": 122697, "num_comment": 1, "author": "斗象智能安全平台", "tags": ["漏洞"], "text": "JIRA是Atlassian公司出品的项目与事务跟踪工具，是目前比较流行的基于JAVA架构的管理系统。被广泛应用于缺陷跟踪、客户服务、需求收集、流程审批、任务跟踪、项目跟踪和敏捷管理等工作领域。"}
{"title": "Trivy：针对容器的漏洞扫描器", "url": "https://www.freebuf.com/sectool/207757.html", "time": "2019-07-15", "level": "", "num_look": 208221, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "trivy是一款针对容器适用于CI的漏洞扫描器。"}
{"title": "重磅 | 黑镜调查：深渊背后的真相之「金融反欺诈调查报告」完整版发布", "url": "https://www.freebuf.com/articles/paper/206718.html", "time": "2019-07-15", "level": "红色标题", "num_look": 1320366, "num_comment": 15, "author": "FreeBuf咨询", "tags": ["安全报告"], "text": "基于新技术和新场景的诈骗手段不断升级，犯罪分子欺诈能力不断提升，欺诈方式更具专业化、智能化，欺诈手段迅速翻新。在此背景下，反欺诈成为了金融系统中必不可少的一环。"}
{"title": "教你如何使用QBDI动态二进制检测框架", "url": "https://www.freebuf.com/sectool/207898.html", "time": "2019-07-15", "level": "", "num_look": 94665, "num_comment": 94665, "author": "Alpha_h4ck", "tags": ["工具"], "text": "QBDI 全名为 QuarkslaB Dynamicbinary Instrumentation，它是一个模块化的跨平台以及跨架构的 DBI 框架。"}
{"title": "企业安全体系架构分析：开发安全架构之安全性架构", "url": "https://www.freebuf.com/articles/es/206860.html", "time": "2019-07-15", "level": "现金奖励", "num_look": 383734, "num_comment": 19, "author": "煜阳yuyang", "tags": ["企业安全"], "text": "上一期讲述了安全架构的可用性架构，这一期想与大家分享的是安全性架构。"}
{"title": "中国电力科学研究院有限公司信通所招聘安全工程师", "url": "https://www.freebuf.com/jobs/208223.html", "time": "2019-07-15", "level": "", "num_look": 116065, "num_comment": 3, "author": "Freddy", "tags": ["安全招聘"], "text": "中国电力科学研究院有限公司（简称中国电科院）成立于1951年，是国家电网公司直属科研单位，是中国电力行业多学科、综合性的科研机构。"}
{"title": "FreeBuf早报丨德国黑森州禁止学校使用微软Office 365；美向“脸书”开50亿美元罚单，遭批约束效力有限；工信部互联网信息服务投诉平台正式上线", "url": "https://www.freebuf.com/news/208260.html", "time": "2019-07-15", "level": "", "num_look": 81942, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "德国黑森州禁止学校使用微软Office 365；美向“脸书”开50亿美元罚单，遭批约束效力有限；工信部互联网信息服务投诉平台正式上线。"}
{"title": "等保2.0安全管理中心要求解读", "url": "https://www.freebuf.com/articles/security-management/207861.html", "time": "2019-07-15", "level": "红色标题", "num_look": 447842, "num_comment": 15, "author": "默安科技宇宸", "tags": ["安全管理"], "text": "本文主要针对“一个中心，三重防护”中的中心，聊聊这个概念以及相应的要求。"}
{"title": "Miteru：实验性网络钓鱼工具包检测工具", "url": "https://www.freebuf.com/sectool/207561.html", "time": "2019-07-14", "level": "", "num_look": 112148, "num_comment": 112148, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Miteru是一款实验性网络钓鱼检测工具，广大研究人员可以使用这款工具来进行网络钓鱼工具的感染检测。"}
{"title": "挖洞经验 | Panda反病毒软件本地提权漏洞分析（CVE-2019-12042）", "url": "https://www.freebuf.com/vuls/207765.html", "time": "2019-07-14", "level": "", "num_look": 91070, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["漏洞"], "text": "这篇文章讨论一个在Panda反病毒产品中发现的一个安全漏洞（CVE-2019-12042），该漏洞将允许攻击者在目标设备上将非特权账户提权至SYSTEM。"}
{"title": "Globelmposter勒索病毒最新变种预警：从“十二生肖”到“十二主神”", "url": "https://www.freebuf.com/articles/system/207884.html", "time": "2019-07-14", "level": "", "num_look": 131781, "num_comment": 3, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近日，深信服安全团队观察到Globelmposter勒索病毒又出现最新变种，加密后缀有Ares666、Zeus666、Aphrodite666、Apollon666等，目前国内已有多家大型医院率先发现感染案例！"}
{"title": "全球高级持续性威胁（APT）2019年中报告", "url": "https://www.freebuf.com/articles/system/207605.html", "time": "2019-07-14", "level": "", "num_look": 159467, "num_comment": 4, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "本报告主要总结在APT威胁来源的地域特征下主要活跃的APT组织以及近半年重要的全球高级持续性威胁事件，对整体威胁态势的总结。"}
{"title": "Awake Security Platform：一款用NTA实现恶意行为检测的工具", "url": "https://www.freebuf.com/articles/terminal/206224.html", "time": "2019-07-13", "level": "", "num_look": 142983, "num_comment": 142983, "author": "Karunesh91", "tags": ["终端安全", "网络安全"], "text": "传统的网络取证工具和网络流量分析（NTA）工具，两种技术相结合来解决网络安全问题，会怎么样？"}
{"title": "Sniffglue：一款多线程数据包安全嗅探工具", "url": "https://www.freebuf.com/sectool/207434.html", "time": "2019-07-13", "level": "", "num_look": 111298, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Sniffglue是一款使用Rust开发的网络嗅探工具，该工具使用了线程池来利用所有的CPU核心并对多个网络数据包同时进行解析处理。"}
{"title": "BUF大事件丨罗技被曝出四个硬件漏洞；万豪因数据泄露被罚款1.24亿美元；智联回应简历泄露：积极协助调查", "url": "https://www.freebuf.com/news/208211.html", "time": "2019-07-13", "level": "红色标题", "num_look": 85383, "num_comment": 1, "author": "willhuang", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，罗技被曝出四个硬件漏洞；万豪因数据泄露被罚款1.24亿美元；智联回应简历泄露：积极协助调查"}
{"title": "2019上半年恶意挖矿趋势报告", "url": "https://www.freebuf.com/articles/paper/208175.html", "time": "2019-07-13", "level": "", "num_look": 159755, "num_comment": 159755, "author": "深信服千里目安全实验室", "tags": ["安全报告"], "text": "本期深信服安全团队对另一流行病毒类型——挖矿木马进行深入分析，给大家揭秘2019上半年挖矿木马的所作所为。"}
{"title": "Windows 10中的DHCP安全性：分析关键漏洞CVE-2019-0726", "url": "https://www.freebuf.com/articles/system/207742.html", "time": "2019-07-13", "level": "", "num_look": 111917, "num_comment": 111917, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "为了更好地检测针对DHCP漏洞的攻击以及相关的漏洞，需要深入了解所有的细节。"}
{"title": "结合CVE-2019-1040漏洞的两种域提权深度利用分析", "url": "https://www.freebuf.com/vuls/207399.html", "time": "2019-07-13", "level": "", "num_look": 242506, "num_comment": 1, "author": "alphalab", "tags": ["漏洞"], "text": "攻击者可以通过中间人攻击，绕过NTLM MIC（消息完整性检查）保护，将身份验证流量中继到目标服务器。"}
{"title": "Blind XXE详解与Google CTF一道题分析", "url": "https://www.freebuf.com/vuls/207639.html", "time": "2019-07-13", "level": "", "num_look": 208485, "num_comment": 1, "author": "JrXnm233", "tags": ["漏洞"], "text": "这篇文章将详细分析两种Blind XXE的原理和为啥需要引入外部DTD文件，最后也发现一些情况不用引入外部DTD文件也能直接做的情况（今年google ctf 就可以）。"}
{"title": "【议题前瞻】等级保护2.0标准条款实践案例 | 企业安全俱乐部", "url": "https://www.freebuf.com/fevents/208139.html", "time": "2019-07-12", "level": "", "num_look": 52579, "num_comment": 52579, "author": "FB独家", "tags": ["活动"], "text": "7月24日「FreeBuf 企业安全俱乐部」北京站系列沙龙活动「等级保护2.0研讨专场」上，刘健将为大家分享《等级保护2.0标准条款实践案例》。"}
{"title": "凭本事「挖洞」,七夕不孤单 | 白帽脱单秘籍", "url": "https://www.freebuf.com/fevents/208159.html", "time": "2019-07-12", "level": "", "num_look": 149388, "num_comment": 7, "author": "漏洞盒子", "tags": ["活动"], "text": "七夕节又到了，不想再被孤单伤害，请访问vulbox.com，凭本事挖洞，七夕不孤单"}
{"title": "MuddyWater APT组织使用的多阶段后门POWERSTATS V3", "url": "https://www.freebuf.com/articles/network/207758.html", "time": "2019-07-12", "level": "", "num_look": 92280, "num_comment": 92280, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "本文将对MuddyWater APT所使用的新型多阶段后门和Android恶意软件变种等攻击组件进行分析。"}
{"title": "Beef-XSS+Sunny-Ngrok实现内网穿透", "url": "https://www.freebuf.com/articles/web/207259.html", "time": "2019-07-12", "level": "现金奖励", "num_look": 235808, "num_comment": 18, "author": "kaliking", "tags": ["WEB安全"], "text": "Beef-XSS框架无疑是当今最强大的浏览器攻击框架，但要实现完整效果则是有一定难度的。于是便有了今天的文章，希望对大家有所帮助。"}
{"title": "FreeBuf早报 | 美国市长会议决定不再向黑客支付赎金；第一款青少年搜索引擎“花漾搜索“APP正式上线；苹果临时禁用 Apple Watch 对讲机功能，有窃听风险", "url": "https://www.freebuf.com/news/208150.html", "time": "2019-07-12", "level": "", "num_look": 77082, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": "由新华社中国搜索研发的首款面向青少年的搜索引擎“花漾搜索“APP今日正式上线，花漾搜索APP图标是一只小小猫头鹰。花漾搜索是中国第一款专为青少年定制的搜索引擎，旨在为孩子打造一个由围墙的花园。"}
{"title": "2018年广州网络安全十大典型案例（个人篇+企业篇）", "url": "https://www.freebuf.com/news/207300.html", "time": "2019-07-12", "level": "", "num_look": 114407, "num_comment": 4, "author": "安数君", "tags": ["资讯"], "text": "为了使公众进一步了解网络安全，我们整理了2018年十大典型网络安全案事件，都是与您的生活、工作密切相关的。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列：Lordache Cosmin", "url": "https://www.freebuf.com/video/208011.html", "time": "2019-07-12", "level": "红色标题", "num_look": 72229, "num_comment": 4, "author": "willhuang", "tags": ["视频"], "text": "Iordache Cosmin，罗马尼亚人。2017年开始做漏洞众测，并于去年转向全职Bug Hunter，他曾于2017年发现了Atlassian Bamboo 5.x版本的高危RCE漏洞（CVE-2017-8907 ）"}
{"title": "CNNVD关于微软多个安全漏洞的通报", "url": "https://www.freebuf.com/vuls/208157.html", "time": "2019-07-12", "level": "", "num_look": 88078, "num_comment": 2, "author": "CNNVD", "tags": ["漏洞"], "text": "近日，微软官方发布了多个安全漏洞的公告，包括 Windows DHCP 服务器远程代码执行漏洞、 Windows 远程桌面服务远程代码执行漏洞、Microsoft Excel 远程代码执行漏洞等多个漏洞。"}
{"title": "Linux内核TCP MSS机制详细分析", "url": "https://www.freebuf.com/vuls/207292.html", "time": "2019-07-12", "level": "", "num_look": 81284, "num_comment": 1, "author": "Knownsec知道创宇", "tags": ["漏洞"], "text": "本文将通过Linux内核源码对TCP的MSS机制进行详细分析。"}
{"title": "Kali Linux安全入门，教你玩转各种渗透测试工具 | 精品公开课", "url": "https://www.freebuf.com/open/208051.html", "time": "2019-07-11", "level": "", "num_look": 154402, "num_comment": 5, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "本期公开课从入门Kali Linu出发，为大家讲解在实际环境中的渗透测试，玩转Kali Linux各种工具！"}
{"title": "实战出尖兵，人才培养成网络安全军备竞赛关键", "url": "https://www.freebuf.com/fevents/208128.html", "time": "2019-07-11", "level": "", "num_look": 116616, "num_comment": 3, "author": "shidongqi", "tags": ["活动"], "text": "2019年7月，一场声势浩大的网络安全实战演习——WCTF在北京开启。360Vulcan邀请了来自美国、日本、俄罗斯、德国等全球多个国家的战队，还有三支中国网络安全顶尖战队作为东道主身份出战。"}
{"title": "【议题前瞻】等保2.0下的身份安全 | 企业安全俱乐部", "url": "https://www.freebuf.com/fevents/208123.html", "time": "2019-07-11", "level": "", "num_look": 35123, "num_comment": 35123, "author": "FB独家", "tags": ["活动"], "text": "7月24日， 「FreeBuf 企业安全俱乐部」北京站系列沙龙活动「等级保护2.0研讨专场」 上，来自上海派拉软件股份有限公司的CEO谭翔 将为大家分享《等保2.0下的身份安全》。"}
{"title": "首例发生在巴西的仿冒WannaCry恶意软件", "url": "https://www.freebuf.com/articles/terminal/207486.html", "time": "2019-07-11", "level": "红色标题", "num_look": 115976, "num_comment": 3, "author": "奇安信威胁情报中心", "tags": ["终端安全"], "text": "随着WannaCry的爆发，许多勒索软件也借着WannaCry的热度与余威，通过各种仿冒WannaCry对用户进行勒索，其中也不乏移动端WannaCry仿冒软件。"}
{"title": "利用x509数字证书实现数据渗透", "url": "https://www.freebuf.com/articles/system/207770.html", "time": "2019-07-11", "level": "", "num_look": 120499, "num_comment": 1, "author": "secist", "tags": ["系统安全"], "text": "数据泄露可能是内部人员和黑客的主要目标。因此，你就需要思考如何发送这些数据。"}
{"title": "漏洞预警丨Fastjson远程代码执行漏洞", "url": "https://www.freebuf.com/vuls/208074.html", "time": "2019-07-11", "level": "", "num_look": 595544, "num_comment": 595544, "author": "斗象智能安全平台", "tags": ["数据安全", "漏洞"], "text": "Fastjson是阿里巴巴的开源JSON解析库，它可以解析JSON格式的字符串，支持将Java Bean序列化为JSON字符串，也可以从JSON字符串反序列化到JavaBean。"}
{"title": "FreeBuf早报 | 员工使用的移动设备对金融企业造成了严重风险；华裔前员工承认上传特斯拉Autopilot源代码，但否认窃密；浏览器Pale Moon开发商称黑客在老版本安装包中植入了恶意软件", "url": "https://www.freebuf.com/news/208041.html", "time": "2019-07-11", "level": "", "num_look": 67170, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "根据一份最新的报告，金融服务组织面临来自移动设备的网络钓鱼和中间人（MiTM）攻击的频次高于其他行业，并且技术的发展趋势使问题变得更加复杂。"}
{"title": "两起僵尸网络Mirai样本分析", "url": "https://www.freebuf.com/articles/terminal/207348.html", "time": "2019-07-11", "level": "现金奖励", "num_look": 121551, "num_comment": 3, "author": "Sampson", "tags": ["终端安全"], "text": "2019年6月26日蜜罐系统监控到两起Mirai的物联网蠕虫活动情况，自2017年11月23日Check Point研究人员发现华为家用路由器HG532存在0day漏洞。"}
{"title": "APT34核心组件Glimpse：远控复现与流量分析", "url": "https://www.freebuf.com/articles/database/207469.html", "time": "2019-07-11", "level": "红色标题", "num_look": 209681, "num_comment": 5, "author": "DigApis", "tags": ["数据安全"], "text": "本文将对APT34远控组件Glimpse新版木马进行技术分析。"}
{"title": "Kubolt ：可用于扫描开放Kubernetes集群的实用工具", "url": "https://www.freebuf.com/sectool/207442.html", "time": "2019-07-11", "level": "", "num_look": 75160, "num_comment": 75160, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Kubolt的实用工具，广大研究人员可以使用Kubolt轻松对公共Kubernetes集群执行安全扫描任务。"}
{"title": "【会员活动】企业安全俱乐部甲方私享会精彩放送", "url": "https://www.freebuf.com/fevents/208050.html", "time": "2019-07-11", "level": "", "num_look": 29799, "num_comment": 29799, "author": "FB独家", "tags": ["活动"], "text": "现在加入FreeBuf甲方会员体系即可享受更多福利内容。"}
{"title": "医疗行业不太平，麻醉也能通过网络操作了", "url": "https://www.freebuf.com/news/207999.html", "time": "2019-07-10", "level": "", "num_look": 90465, "num_comment": 1, "author": "Karunesh91", "tags": ["终端安全", "资讯"], "text": "当黑客能威胁到人到健康安危时，你还能淡定吗～"}
{"title": "防追踪溯源识别联网工控设备的方法", "url": "https://www.freebuf.com/articles/ics-articles/206856.html", "time": "2019-07-10", "level": "现金奖励", "num_look": 325338, "num_comment": 7, "author": "yy0308", "tags": ["工控安全"], "text": "伴随中国智能制造2025、两化融合以及工业互联网等背景下，越来越多的工业控制系统暴露在网络空间里，为了掌握互联网上有多少工控设备，以及这些工控设备的型号和存在的风险。"}
{"title": "autoPwn ：一款功能强大的模糊测试重复执行自动化任务框架", "url": "https://www.freebuf.com/sectool/207484.html", "time": "2019-07-10", "level": "", "num_look": 118499, "num_comment": 118499, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫autoPwn的强大工具，广大研究人员可以利用这款工具来自动化完成一些需要重复执行的模糊测试任务。"}
{"title": "物理黑客上线，罗技被曝出四个硬件漏洞", "url": "https://www.freebuf.com/news/207981.html", "time": "2019-07-10", "level": "", "num_look": 120200, "num_comment": 2, "author": "Karunesh91", "tags": ["资讯"], "text": "近日，有研究人员表示发现了罗技的Unifying USB接收器存在4个新的安全漏洞。这个接收器可将六个不同的设备连接到同一个计算机。"}
{"title": "一次CMS源码审计与漏洞发现", "url": "https://www.freebuf.com/vuls/206888.html", "time": "2019-07-10", "level": "现金奖励", "num_look": 179270, "num_comment": 7, "author": "Kriston", "tags": ["漏洞"], "text": "最近一直在学习《[红日安全]代码审计》系列中关于php代码中存在的问题，从中受益匪浅。从中选取了一个DM企业建站的cms用作练习。"}
{"title": "推荐五款具有超级隐私保护性的匿名浏览器", "url": "https://www.freebuf.com/articles/web/207566.html", "time": "2019-07-10", "level": "", "num_look": 807746, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "普通的浏览器都有Cookie、个性化广告和浏览记录跟踪等功能，在这种情况下，人们的隐私就无法得到保障。"}
{"title": "2019斗象科技诚招安全服务人才", "url": "https://www.freebuf.com/jobs/207735.html", "time": "2019-07-10", "level": "", "num_look": 55159, "num_comment": 1, "author": "FB客服", "tags": ["安全招聘"], "text": "斗象科技旗下坐拥FreeBuf、漏洞盒子、网藤智能安全平台三大品牌，凭借在信息安全与企业安全市场的专业性见解和强大技术实力，建立了长远的战略目标和良好的客户口碑。"}
{"title": "快讯丨万豪因泄漏3.83亿名客户信息被英国罚款1.24亿美元", "url": "https://www.freebuf.com/news/207972.html", "time": "2019-07-10", "level": "", "num_look": 58309, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "去年，国际知名连锁酒店喜达屋旗下万豪集团发生严重的数据泄露事件，这一桩史上留名的安全事故至今日或许终于有了结果。"}
{"title": "Donot团伙（APT-C-35）移动端新攻击框架工具分析", "url": "https://www.freebuf.com/articles/system/207490.html", "time": "2019-07-10", "level": "", "num_look": 86384, "num_comment": 86384, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "该组织主要针对政府机构等领域进行攻击，其中以窃取敏感信息为主。"}
{"title": "FreeBuf早报 | 意大利Swascan宣称“检出鸿蒙多项漏洞”；大使文件泄露破坏美英关系，英国考虑指责俄罗斯黑客；严禁公布成绩排名,彰显未成年人隐私权", "url": "https://www.freebuf.com/news/207949.html", "time": "2019-07-10", "level": "", "num_look": 98920, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "意大利网络资安研究公司Swascan当地时间7月8日宣称，他们已经在华为自主研发的操作系统“鸿蒙”发现有三项容易遭受黑客入侵的漏洞，黑客能够利用这些漏洞轻易取得国家机密资讯。"}
{"title": "Leprechaun：渗透测试过程中用来将网络拓扑可视化的工具", "url": "https://www.freebuf.com/sectool/207447.html", "time": "2019-07-09", "level": "", "num_look": 148187, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "在获取组织网络的提升权限后，接下来你想要做什么？在本文中我想讨论Leprechaun，一款用于协助后渗透利用的新工具 。"}
{"title": "Black Hat USA 2019 | 网络安全的七大关注热点", "url": "https://www.freebuf.com/news/207907.html", "time": "2019-07-09", "level": "红色标题", "num_look": 105794, "num_comment": 4, "author": "Freddy", "tags": ["资讯"], "text": "在这一届大会上，与会者将关注和讨论那些热点问题与趋势？"}
{"title": "如何在AIX和Power架构上运行Metasploit Framework", "url": "https://www.freebuf.com/articles/web/207408.html", "time": "2019-07-09", "level": "", "num_look": 88008, "num_comment": 1, "author": "secist", "tags": ["WEB安全"], "text": "本文将向大家介绍如何在AIX和Power架构上运行Metasploit框架，这对于那些想要尝试在这些架构上运行Metasploit的人可能会有所帮助（至少目前我还没有在网上发现关于这方面的教程内容）。"}
{"title": "应急响应团队建设：云上威胁响应周期模型", "url": "https://www.freebuf.com/vuls/207319.html", "time": "2019-07-09", "level": "现金奖励", "num_look": 1488016, "num_comment": 26, "author": "达芬奇Davinci", "tags": ["企业安全", "漏洞"], "text": "笔者在最近的安全沙龙上，想通过真实案例来讲一下应急响应周期建设，以起到抛砖引玉之效，给大佬们的工作带来参考价值。"}
{"title": "太平金科招聘信息安全工程师", "url": "https://www.freebuf.com/jobs/207730.html", "time": "2019-07-09", "level": "", "num_look": 76476, "num_comment": 2, "author": "FB客服", "tags": ["安全招聘"], "text": "太平金科是上海第一家面向保险企业提供金融服务的创新型金融服务公司，为中国太平及下属专业公司提供信息化服务及运营服务。"}
{"title": "【议题公布】企业安全俱乐部等级保护2.0研讨大会「北京站」", "url": "https://www.freebuf.com/fevents/207881.html", "time": "2019-07-09", "level": "", "num_look": 94444, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "7月24日，「FreeBuf 企业安全俱乐部」系列沙龙活动「等级保护2.0研讨专场」即将登陆北京。"}
{"title": "一起双网卡服务器被黑‌引发的勒索事件", "url": "https://www.freebuf.com/articles/system/207427.html", "time": "2019-07-09", "level": "", "num_look": 146458, "num_comment": 6, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "在六月一个风和日丽的早上，突然接到了客户紧急反馈，数据库突然连接不上，业务中断，怀疑遭到了黑客攻击。介入排查后发现，数据库启动失败的原因是数据库组件丢失，系统找不到指定的文件。"}
{"title": "《个人信息出境安全评估办法（征求意见稿）》相关思考和合规建议", "url": "https://www.freebuf.com/articles/security-management/207266.html", "time": "2019-07-09", "level": "现金奖励", "num_look": 169056, "num_comment": 3, "author": "15161636391", "tags": ["安全管理"], "text": "毫无疑问，该评估办法出台后，涉及数据出境场景的各行各业的企业的合规成本毫无疑问会提高，尤其是在华经营的外资企业以及业务范围扩展到海外的国内企业。"}
{"title": "FreeBuf早报 | 不惧美国网络攻击威胁，伊朗展示国产通信系统；国家工业信息安全漏洞库上线；微软警告Astaroth恶意软件活动", "url": "https://www.freebuf.com/news/207872.html", "time": "2019-07-09", "level": "", "num_look": 91458, "num_comment": 91458, "author": "shidongqi", "tags": ["资讯"], "text": "2019年中国工业信息安全大会日前召开，会上，国家工业信息安全漏洞库正式上线，加快对工业信息安全监测、态势感知、检查评估、攻防演练等一批核心技术攻关。"}
{"title": "Pown-CDB：用于自动化执行Chrome调试协议任务的工具", "url": "https://www.freebuf.com/sectool/207571.html", "time": "2019-07-08", "level": "", "num_look": 88663, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "Pown CDB是一个Chrome调试协议实用程序。该工具的主要目标是将一些常见任务自动化的执行，以帮助从命令行调试Web应用，并主动监视和拦截HTTP请求和响应。"}
{"title": "关于ATM渗透与欺诈的知识点Part 1", "url": "https://www.freebuf.com/articles/terminal/207651.html", "time": "2019-07-08", "level": "", "num_look": 100589, "num_comment": 1, "author": "secist", "tags": ["终端安全"], "text": "普通的ATM用户无法抵御这种对银行的攻击。但只要保持警惕，就能帮助警方将罪犯绳之以法。"}
{"title": "企业安全体系架构分析：开发安全架构之可用性架构", "url": "https://www.freebuf.com/articles/es/206356.html", "time": "2019-07-08", "level": "现金奖励", "num_look": 482565, "num_comment": 8, "author": "煜阳yuyang", "tags": ["企业安全"], "text": "上期大概讲述了安全体系架构的概述以及管理层面的安全体系架构，这一期来讲讲业务在设计时制定安全架构的落地实施。"}
{"title": "星巴克邀您一起共创安全未来", "url": "https://www.freebuf.com/jobs/207724.html", "time": "2019-07-08", "level": "", "num_look": 117852, "num_comment": 9, "author": "FB客服", "tags": ["安全招聘"], "text": "星巴克秉承“激发并孕育人文精神——每人、每杯、每个社区”的公司使命，致力于发展成为一家与众不同的公司。诚邀各位有志之士参与共建安全未来。"}
{"title": "安全扫描调度系统实践", "url": "https://www.freebuf.com/articles/es/206855.html", "time": "2019-07-08", "level": "现金奖励", "num_look": 703789, "num_comment": 5, "author": "糖果L5Q", "tags": ["企业安全"], "text": "AWVS 本身提供了方便的 REST API 对外服务，如何通过设计封装，让 AWVS 执行的高效简单，这篇要完成的一个任务。"}
{"title": "CVE-2019-9041: 从CSRF到Getshell漏洞分析", "url": "https://www.freebuf.com/vuls/207029.html", "time": "2019-07-08", "level": "现金奖励", "num_look": 159005, "num_comment": 2, "author": "cck", "tags": ["漏洞"], "text": "无意中看到vulnhub新放了一个Csrf大礼包，集合多个最新的csrf to getshell的cve，所以拿这个系统做一个系列关于Csrf的代码审计之路。"}
{"title": "FreeBuf早报丨英国互联网服务提供商协会反对Mozilla为Firefox提供DNS隐私功能；Tor将修复一个用于DDoS攻击的Bug；点开网页瞬间被窃取隐私，访客手机号码被卖1元1条", "url": "https://www.freebuf.com/news/207769.html", "time": "2019-07-08", "level": "", "num_look": 81413, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "英国互联网服务提供商协会反对Mozilla为Firefox提供DNS隐私功能；Tor将修复一个用于DDoS攻击的Bug；点开网页瞬间被窃取隐私，访客手机号码被卖1元1条。"}
{"title": "JWT Tool：针对 JSON Web Tokens 的测试工具", "url": "https://www.freebuf.com/sectool/207498.html", "time": "2019-07-07", "level": "", "num_look": 179270, "num_comment": 179270, "author": "Alpha_h4ck", "tags": ["工具"], "text": "众望所归，大家期待已久的JWT渗透测试工具终于出炉啦！没错，今天给大家介绍的这款名叫JWT Tool的工具，就可以针对JSON Web Tokens进行渗透测试。"}
{"title": "担心声誉？怕被报复？企业向执法机构隐瞒网络犯罪行为的原因分析", "url": "https://www.freebuf.com/articles/security-management/207387.html", "time": "2019-07-07", "level": "", "num_look": 117079, "num_comment": 3, "author": "晶颜123", "tags": ["安全管理"], "text": "执法机构估计，企业未上报的网络犯罪数量可能高达数百万起。"}
{"title": "树莓派ZeroW：一根数据线轻松玩转苹果的HomeBridge", "url": "https://www.freebuf.com/articles/wireless/205704.html", "time": "2019-07-07", "level": "", "num_look": 372868, "num_comment": 372868, "author": "mrzcpo", "tags": ["无线安全", "极客"], "text": "最近入手了Zero W，非常小巧，打算整个homebridge玩，于是结合其他的文章写了这篇只需要一根数据线一个SD卡就可以轻松完成homebridge安装的文章。"}
{"title": "BUF大事件丨《2019年「金融反欺诈」调查报告》即将发布；《国家网络安全产业园区发展规划》正式发布；“宝贝回家”寻子公益论坛遭黑客攻击", "url": "https://www.freebuf.com/news/207718.html", "time": "2019-07-07", "level": "红色标题", "num_look": 72804, "num_comment": 72804, "author": "willhuang", "tags": ["视频", "资讯"], "text": "《2019年「金融反欺诈」调查报告》即将发布；《国家网络安全产业园区发展规划》正式发布；“宝贝回家”寻子公益论坛遭黑客攻击"}
{"title": "网络爬虫暗藏杀机：在Scrapy中利用Telnet服务LPE", "url": "https://www.freebuf.com/articles/web/207209.html", "time": "2019-07-07", "level": "现金奖励", "num_look": 109319, "num_comment": 3, "author": "TouchFishBoy", "tags": ["WEB安全"], "text": "信息安全的本质是信任问题，当我们使用了框架就代表我们信任了这个框架，如果框架的安全性不对其进行检测，那么所带来的是毁灭性的结果。"}
{"title": "Carbon：交互式反汇编工具", "url": "https://www.freebuf.com/sectool/207350.html", "time": "2019-07-06", "level": "", "num_look": 100738, "num_comment": 100738, "author": "secist", "tags": ["工具"], "text": "Cerbero Suite是为x86/x64设计的一款交互式反汇编工具。最初的目的是为了让我们的用户能够检查内存转储中的代码以及shellcode。"}
{"title": "使用Adidnsdump转储Active Directory DNS", "url": "https://www.freebuf.com/articles/network/206897.html", "time": "2019-07-06", "level": "", "num_look": 79075, "num_comment": 79075, "author": "周大涛", "tags": ["网络安全"], "text": "DNS域传送漏洞是在黑客常用的一种漏洞攻击手段。要实现域传送漏洞，就需要一个不安全配置的DNS服务器，允许匿名用户传输所有记录并收集有关网络中主机的信息。"}
{"title": "记对OpenSNS的一次代码审计", "url": "https://www.freebuf.com/articles/web/207208.html", "time": "2019-07-06", "level": "现金奖励", "num_look": 152968, "num_comment": 10, "author": "chenchuan", "tags": ["WEB安全"], "text": "平静下急功近利的心，耐得住漏洞挖掘中的乏味，不断去磨练自己的意志，增长自己的经验，相信自己，你是醉棒的，你也可以成为别人眼中的大佬！"}
{"title": "浅谈字体反爬虫的一些思路", "url": "https://www.freebuf.com/articles/web/206966.html", "time": "2019-07-06", "level": "", "num_look": 140039, "num_comment": 3, "author": "安百科技", "tags": ["WEB安全"], "text": "反爬虫和爬虫之间的较量已经争斗多年，不管是攻还是守，已经持续N年，这是一个没有硝烟的战场，大家都知道爬虫和反爬之家的道高一尺魔高一丈的关系。"}
{"title": "数据说话：GDPR实施首年产生的影响", "url": "https://www.freebuf.com/articles/paper/207220.html", "time": "2019-07-05", "level": "", "num_look": 72235, "num_comment": 2, "author": "晶颜123", "tags": ["安全报告"], "text": "距离2018年5月25日欧盟《通用数据保护条例》（GDPR）正式生效，已经过去了一年的时间，这一具有里程碑意义的隐私和网络安全监管法规已经在全球范围内产生了深远影响。"}
{"title": "等保测评结论改为“优、良、中、差”", "url": "https://www.freebuf.com/news/207646.html", "time": "2019-07-05", "level": "红色标题", "num_look": 109708, "num_comment": 5, "author": "Freddy", "tags": ["资讯"], "text": "等保2.0相关标准已经发布有一段时间，离标准正式实施还有几个月的时间，之前关于等保2.0中测评结论的判定目前也已经尘埃落定。"}
{"title": "勒索软件Sodinokibi运营组织的关联分析", "url": "https://www.freebuf.com/articles/network/207116.html", "time": "2019-07-05", "level": "", "num_look": 135683, "num_comment": 1, "author": "antiylab", "tags": ["网络安全"], "text": "2019年5月，安天CERT监测到了多起利用钓鱼邮件传播Sodinokibi勒索软件的事件。"}
{"title": "关于CMSMS中SQL注入漏洞的复现与分析与利用", "url": "https://www.freebuf.com/vuls/207026.html", "time": "2019-07-05", "level": "现金奖励", "num_look": 174359, "num_comment": 10, "author": "Neroqi", "tags": ["漏洞"], "text": "CMS Made Simple(CMSMS)是一个简单且便捷的内容管理系统，它使用PHP、MySQL和Smarty模板引擎开发，具有基于角色的权限管理系统。"}
{"title": "FreeBuf早报丨这些网站和App在偷偷收集你的个人信息；手机淘宝“扫一扫”新增智能识别垃圾功能；用于比特币挖矿的耗电量超过了瑞士全国用电量", "url": "https://www.freebuf.com/news/207640.html", "time": "2019-07-05", "level": "", "num_look": 60163, "num_comment": 60163, "author": "Karunesh91", "tags": ["资讯"], "text": "这些网站和App在偷偷收集你的个人信息；手机淘宝“扫一扫”新增智能识别垃圾功能；用于比特币挖矿的耗电量超过了瑞士全国用电量"}
{"title": "投递恶意lnk使用JwsclTerminalServer实现远程控制和信息获取", "url": "https://www.freebuf.com/articles/system/207109.html", "time": "2019-07-05", "level": "现金奖励", "num_look": 133433, "num_comment": 2, "author": "xencounter", "tags": ["系统安全"], "text": "最近捕获到一枚恶意lnk，双击之后会触发后续的攻击链。"}
{"title": "无文件挖矿应急响应处置报告", "url": "https://www.freebuf.com/articles/system/206611.html", "time": "2019-07-05", "level": "现金奖励", "num_look": 341451, "num_comment": 13, "author": "竹林再遇北极熊", "tags": ["区块链安全", "安全报告"], "text": "该挖矿程序会下载恶意程序至WMI中，实现无文件挖矿和内网渗透，并下载DDOS攻击程序和通过任务计划每隔20分钟自动生成版本校验恶意程序。"}
{"title": "欺骗技术入门：13款开源工具分享", "url": "https://www.freebuf.com/sectool/207121.html", "time": "2019-07-05", "level": "", "num_look": 179267, "num_comment": 1, "author": "柚子", "tags": ["工具"], "text": "防守方靠什么扳倒在战役开始前就已“占尽先机”的攻击方？"}
{"title": "Sonar.js：内网主机扫描和利用的网页框架", "url": "https://www.freebuf.com/sectool/206488.html", "time": "2019-07-04", "level": "", "num_look": 114816, "num_comment": 114816, "author": "Zzzxbug", "tags": ["工具"], "text": "最近，WebRTC作为一种使用常规网页扫描内部网络的方式出现在新闻中。我们已经看到了这种功能的一些有趣的应用，比如《纽约时报》扫描你的内部网络来检测机器人。"}
{"title": "【FreeBuf字幕组】Web安全漏洞系列：Electron框架漏洞", "url": "https://www.freebuf.com/video/207509.html", "time": "2019-07-04", "level": "红色标题", "num_look": 74290, "num_comment": 2, "author": "willhuang", "tags": ["视频"], "text": "Electron是GitHub开发且基于Chromium和Node.js的开源框架，使用JavaScript、HTML和CSS构建跨平台桌面应用，以Chromium为前端显示，以Node.js为后端支撑。"}
{"title": "绕过防火墙过滤规则传输ICMP", "url": "https://www.freebuf.com/articles/system/206920.html", "time": "2019-07-04", "level": "", "num_look": 154670, "num_comment": 3, "author": "周大涛", "tags": ["系统安全"], "text": "ICMP和ICMPv6是Internet的主要协议。这些协议设计用于在数据包未到达目的地时进行连接测试和错误信令。接收ICMP消息让应用程序了解故障原因：数据包太大，没有可用路由等。"}
{"title": "再议Wannacry的比特币钱包", "url": "https://www.freebuf.com/articles/blockchain-articles/205705.html", "time": "2019-07-04", "level": "现金奖励", "num_look": 212505, "num_comment": 3, "author": "追影人", "tags": ["区块链安全"], "text": "文章从比特币基本特性、交易数据采集、交易记录分析、资金流可视化等多个方面介绍了Wannacry事件所涉及的三个比特币账户。"}
{"title": "奇安信安全能力中心（北京、上海、珠海）招聘安全人才", "url": "https://www.freebuf.com/jobs/207495.html", "time": "2019-07-04", "level": "", "num_look": 137268, "num_comment": 9, "author": "奇安信-华南基地", "tags": ["安全招聘"], "text": "2019年1月，奇安信集团成立了安全能力中心。安全能力中心承担着集团基础安全能力的建设工作，向各产品线及业务部门提供安全能力输出，提高各产品的安全技术水平与安全效果。"}
{"title": "伪装成补丁安装程序的下载器木马病毒预警", "url": "https://www.freebuf.com/articles/terminal/207030.html", "time": "2019-07-04", "level": "", "num_look": 118784, "num_comment": 1, "author": "亚信安全", "tags": ["终端安全"], "text": "近日截获一款伪装成补丁安装程序的下载器木马病毒，该病毒运行后会弹出补丁安装成功的消息框，用来迷惑用户。"}
{"title": "FreeBuf早报 | 彭博社：博通正在与赛门铁克洽谈收购事宜；国内智能家居解决方案供应商Orvibo云平台泄露数十亿条日志；俄罗斯黑客从孟加拉国银行窃取300万美元", "url": "https://www.freebuf.com/news/207567.html", "time": "2019-07-04", "level": "", "num_look": 72815, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "对数据库的分析显示，包含超过20亿条数据日志，例如用户名、电子邮件地址、密码以及在某些情况下设备的位置。"}
{"title": "基于E-Mail的隐蔽控制：机理与防御", "url": "https://www.freebuf.com/articles/network/207379.html", "time": "2019-07-04", "level": "", "num_look": 148920, "num_comment": 148920, "author": "DigApis", "tags": ["网络安全"], "text": "命令与控制（command andcontrol），是远程控制的一种表现形式，更是目前网络攻击常用手段中不可或缺的一环。"}
{"title": "公安三所对网络安全等级保护2.0要求解读 | 企业安全俱乐部议题前瞻", "url": "https://www.freebuf.com/fevents/207507.html", "time": "2019-07-03", "level": "", "num_look": 95363, "num_comment": 2, "author": "FB独家", "tags": ["活动"], "text": "7月24日，「FreeBuf 企业安全俱乐部」北京站上，参与等保2.0标准起草的公安部第三研究所的公安部信息安全等级保护评估中心安全咨询部陈广勇主任将为大家分享《网络安全等级保护2.0要求解读》。"}
{"title": "Dota Campaign：分析一款挖矿与后门并存的木马", "url": "https://www.freebuf.com/articles/web/206621.html", "time": "2019-07-03", "level": "", "num_look": 107547, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "就在前不久，我自己部署的一个蜜罐受到了一次特别严重的攻击，其中涉及到了两个远程访问工具和一个加密货币恶意挖矿文件。"}
{"title": "挖洞经验丨印尼电商平台Tokopedia的反射型XSS漏洞", "url": "https://www.freebuf.com/vuls/207025.html", "time": "2019-07-03", "level": "", "num_look": 139347, "num_comment": 6, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文分享的是关于印尼电商平台Tokopedia的火车票票务系统反射型XSS漏洞，作者通过参数分离构造绕过了系统的XSS过滤防护机制，实现了反射型XSS，获得了三百万印尼盾的赏金。"}
{"title": "快手安全团队诚邀有识之士加入", "url": "https://www.freebuf.com/jobs/207310.html", "time": "2019-07-03", "level": "", "num_look": 97856, "num_comment": 11, "author": "xxlegend", "tags": ["安全招聘"], "text": "快手安全团队诚邀有识之士加入，共同维护快手安全。快手内部非常重视安全，安全体系正快速建设中，快砸简历来吧！"}
{"title": "缓冲区溢出实战教程系列（五）：覆盖返回地址实现计算器调用", "url": "https://www.freebuf.com/articles/system/206647.html", "time": "2019-07-03", "level": "现金奖励", "num_look": 109360, "num_comment": 3, "author": "kaliking", "tags": ["系统安全"], "text": "之前已经大致讲了一个简单程序运行的全过程，今天就给大家展示一下利用缓冲区溢出是如何达到调用系统程序的效果的。"}
{"title": "SSH浅析与蜜罐搭建", "url": "https://www.freebuf.com/articles/database/206880.html", "time": "2019-07-03", "level": "现金奖励", "num_look": 215964, "num_comment": 6, "author": "星空111", "tags": ["数据安全"], "text": "各位小伙伴，好久不见，甚是想念啊！最近由于各种事，差点耽搁之前给自己立的flag了——每月至少提交一篇稿子。这次算是抓住了6月的尾巴写的。"}
{"title": "FreeBuf早报 | 传黑客计划对美企发动网攻或涉间谍活动；微软 Teams 曝0day，可用于下载并运行恶意包；新加坡政府悬赏邀白帽黑客找出网络安全漏洞", "url": "https://www.freebuf.com/news/207449.html", "time": "2019-07-03", "level": "", "num_look": 97422, "num_comment": 97422, "author": "shidongqi", "tags": ["资讯"], "text": "日前，工信部发布了2019年第一季度电信服务有关情况的通告。通告称，有18家互联网企业存在未经用户同意收集个人信息等问题，其中包括贝贝、小红书、网易考拉等电商平台的运营主体公司。"}
{"title": "人才短缺、压力过大？网络安全行业一点都不轻松", "url": "https://www.freebuf.com/news/207424.html", "time": "2019-07-02", "level": "红色标题", "num_look": 131762, "num_comment": 11, "author": "Karunesh91", "tags": ["资讯"], "text": "近日，赛门铁克发布一项调查称，法国、英国和德国三个国家中近一半（48%）的网络安全行业领导者们认为他们的安全团队在与黑客、网络罪犯们的竞争中处于严重落后状态，马上就凉的那种。"}
{"title": "恶意软件加载器通过“天堂之门”技术规避安全检测", "url": "https://www.freebuf.com/news/207403.html", "time": "2019-07-02", "level": "", "num_look": 92391, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "安全研究人员近日发现了经过特殊设计的恶意软件加载器，可在受感染的设备上通过注入内存来释放恶意负载，规避防病毒软件和其他安全工具的检测。"}
{"title": "Vxscan：一款实用综合扫描工具", "url": "https://www.freebuf.com/sectool/205447.html", "time": "2019-07-02", "level": "", "num_look": 310678, "num_comment": 7, "author": "al0ne_", "tags": ["工具", "网络安全"], "text": "Vxscan是用python3写的综合扫描工具，主要用来敏感文件探测，WAF/CDN识别，端口扫描，指纹/服务识别，操作系统识别，弱口令探测，POC扫描，SQL注入，绕过CDN，查询旁站等功能。"}
{"title": "如何在类Unix系统上使用ZIP命令进行本地提权", "url": "https://www.freebuf.com/articles/system/206007.html", "time": "2019-07-02", "level": "", "num_look": 152294, "num_comment": 4, "author": "secist", "tags": ["系统安全"], "text": "本文我将告诉大家如何使用Zip命令进行本地提权。Zip是一个简单的基于平台的文件打包和压缩实用程序，适用于类Unix系统，如Linux，Windows等。"}
{"title": "齐治科技邀您一起共创未来", "url": "https://www.freebuf.com/jobs/206892.html", "time": "2019-07-02", "level": "", "num_look": 75743, "num_comment": 5, "author": "Iceyzhong", "tags": ["安全招聘"], "text": "浙江齐治科技股份有限公司（简称：齐治科技）成立于 2005 年，是国内第一家聚焦于数据中心运维安全领域的高科技企业，公司总部位于杭州，在北上广深等多地设有分支机构。"}
{"title": "利用Cobra实现自动化代码审计的经验分享", "url": "https://www.freebuf.com/articles/es/206989.html", "time": "2019-07-02", "level": "现金奖励", "num_look": 722440, "num_comment": 22, "author": "biubiugo", "tags": ["企业安全"], "text": "本文介绍了笔者通过一个简单的方法利用Cobra工具来实现自动化代码审计的经验，以及对Cobra工具代码的一些定制改动。"}
{"title": "利用ElasticSearch Groovy漏洞进行门罗币挖矿事件分析", "url": "https://www.freebuf.com/vuls/206874.html", "time": "2019-07-02", "level": "", "num_look": 122047, "num_comment": 122047, "author": "antiylab", "tags": ["漏洞"], "text": "2019年6月13日，安天蜜网捕获到利用CVE-2015-1427(ElasticSearch Groovy)远程命令执行漏洞的攻击行为。"}
{"title": "FreeBuf早报丨量子计算研究人员成功将数据传送到钻石内；全球首份5G接入网排名报告出炉，华为全面领先；支付宝发布安全报告：交易风险率低至千万分之一", "url": "https://www.freebuf.com/news/207351.html", "time": "2019-07-02", "level": "", "num_look": 68137, "num_comment": 68137, "author": "Karunesh91", "tags": ["资讯"], "text": "量子计算研究人员成功将数据传送到钻石内；全球首份5G接入网排名报告出炉，华为全面领先；支付宝发布安全报告：交易风险率低至千万分之一。"}
{"title": "“宝贝回家”寻子公益论坛遭黑客攻击，得各方安全力量相助终于恢复", "url": "https://www.freebuf.com/news/207275.html", "time": "2019-07-01", "level": "红色标题", "num_look": 259116, "num_comment": 22, "author": "Allen别bb", "tags": ["资讯"], "text": "2019年6月30日，一个名为“宝贝回家”的民间志愿者寻子公益网站的官方论坛无法正常访问。官方公告称，遭受黑客攻击导致部分数据丢失，无法正常访问。"}
{"title": "检测工控设备SNMP漏洞工具：SNMP Fuzzer", "url": "https://www.freebuf.com/sectool/206417.html", "time": "2019-07-01", "level": "", "num_look": 130344, "num_comment": 130344, "author": "zoucl123", "tags": ["工具"], "text": "snmpfuzzer是一款用于对目标设备snmp可写oid节点数据进行fuzz测试的小工具。"}
{"title": "企业安全体系架构分析：安全体系架构概述", "url": "https://www.freebuf.com/articles/es/205919.html", "time": "2019-07-01", "level": "现金奖励", "num_look": 1878812, "num_comment": 25, "author": "煜阳yuyang", "tags": ["企业安全"], "text": "最近都在谈论安全体系架构，我也有一些观点想与诸位分享，主题围绕着如何搭建企业级安全体系架构来进行。"}
{"title": "挖洞经验 | 谷歌票据上传系统中的Blind XSS漏洞", "url": "https://www.freebuf.com/vuls/206515.html", "time": "2019-07-01", "level": "", "num_look": 113022, "num_comment": 113022, "author": "clouds", "tags": ["漏洞"], "text": "今天的Writeup讲述了作者在谷歌供应商发票上传系统中，发现了其上传功能存在上传文件类型可更改缺陷，最终利用该缺陷在谷歌内部系统googleplex.com中实现了Bind XSS执行。"}
{"title": "利用Firefox 0day漏洞攻击事件的关联分析", "url": "https://www.freebuf.com/articles/system/206712.html", "time": "2019-07-01", "level": "", "num_look": 703135, "num_comment": 1, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "近期的 Firefox漏洞CVE-2019-11707最早是 Google Project Zero的Samuel Groß在4月15号提交的，不过他发现的0day只能导致代码执行，却无法进行Firefox的沙盒逃逸。"}
{"title": "2019上半年勒索病毒家族概览", "url": "https://www.freebuf.com/articles/paper/206777.html", "time": "2019-07-01", "level": "", "num_look": 296637, "num_comment": 2, "author": "深信服千里目安全实验室", "tags": ["安全报告"], "text": "截至2019年6月，勒索病毒的活跃度依旧高居不下，相对于刚进入大众视野时的“蠕虫式”爆发，如今的勒索病毒攻击活动越发具有目标性、隐蔽性，攻击者通常会破坏入侵过程留下的证据，使得溯源排查难以进行。"}
{"title": "用苹果登录VS用谷歌登录：巨头竞争下的隐私保护能否落到实处？", "url": "https://www.freebuf.com/articles/neopoints/205935.html", "time": "2019-07-01", "level": "", "num_look": 142861, "num_comment": 142861, "author": "AdlerI", "tags": ["观点"], "text": "“我们相信，隐私是公民的一项基本权利。但我们也认识到，在这一问题上，并不是所有人都与我们意见一致。”2018 年在布鲁塞尔的一场会议中，苹果公司 CEO 蒂姆·库克曾如此发声。"}
{"title": "FreeBuf早报丨中国发布信息技术十大前沿热点问题，自动驾驶等入选；美官方解释解禁华为一事，即将生效但有限制条件；AMD霄龙安全加密虚拟化曝漏洞：已修复", "url": "https://www.freebuf.com/news/207210.html", "time": "2019-07-01", "level": "", "num_look": 55309, "num_comment": 55309, "author": "Karunesh91", "tags": ["资讯"], "text": "中国发布信息技术十大前沿热点问题，自动驾驶等入选；美官方解释解禁华为一事，即将生效但有限制条件；AMD霄龙安全加密虚拟化曝漏洞：已修复"}
{"title": "快讯｜《国家网络安全产业园区发展规划》正式发布", "url": "https://www.freebuf.com/news/207176.html", "time": "2019-06-30", "level": "", "num_look": 69803, "num_comment": 4, "author": "shidongqi", "tags": ["资讯"], "text": "6月30日，在中国软件产业发展情况新闻发布会上，《国家网络安全产业园区发展规划》正式发布，工业和信息化部与北京市人民政府决定建设国家网络安全产业园区。"}
{"title": "Graffiti：一款专为渗透测试人员设计的混淆代码One Liner", "url": "https://www.freebuf.com/sectool/206565.html", "time": "2019-06-30", "level": "", "num_look": 99831, "num_comment": 99831, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的这款工具名叫Graffiti，各位研究人员可以利用这款工具来生成经过混淆处理的One Liner，并将其用于渗透测试研究中的各种测试场景。"}
{"title": "挖洞经验 | 利用周六休息日狂赚两万欧的漏洞发现", "url": "https://www.freebuf.com/vuls/206406.html", "time": "2019-06-30", "level": "", "num_look": 350081, "num_comment": 8, "author": "clouds", "tags": ["漏洞"], "text": "近期，众测平台Intigriti组织了一场漏洞测试比赛，作者和朋友共同努力在周六休息日，发现了目标系统的两个IDOR防护机制绕过漏洞，收获了€20,000的漏洞赏金。"}
{"title": "Matlab加上VBA编程，表格就能画画了", "url": "https://www.freebuf.com/geek/206650.html", "time": "2019-06-30", "level": "红色标题", "num_look": 783305, "num_comment": 5, "author": "LEdge1", "tags": ["极客"], "text": "之前学习Matlab是为了参加一个数学建模的比赛，但是在慢慢的学习当中发现了matlab这款软件是真的有趣，真的非常有用，大家没事也可以去学习一下使用matlab。"}
{"title": "一起XMR门罗币挖矿变种分析", "url": "https://www.freebuf.com/articles/terminal/206170.html", "time": "2019-06-30", "level": "现金奖励", "num_look": 148857, "num_comment": 2, "author": "Sampson", "tags": ["终端安全"], "text": "近期观测到，Linux下DDG变种挖矿病毒又在全国范围内大规模爆发，该样本通过SSH爆破进行攻击，执行恶意程序，下 载伪装成图片的门罗币挖矿木马，设置为开机启动并在后台运行。"}
{"title": "Functrace：使用DynamoRIO追踪函数调用", "url": "https://www.freebuf.com/sectool/205989.html", "time": "2019-06-29", "level": "", "num_look": 94011, "num_comment": 94011, "author": "secist", "tags": ["工具"], "text": "Functrace是一款使用DynamoRIO（http://dynamorio.org/）通过动态检测分析二进制文件的工具。"}
{"title": "挖洞经验 | 利用Blind XSS发现目标系统内部票据管理和防火墙登录页面", "url": "https://www.freebuf.com/vuls/206272.html", "time": "2019-06-29", "level": "", "num_look": 95837, "num_comment": 2, "author": "clouds", "tags": ["漏洞"], "text": "今天分享的Writeup是作者通过对某电子商务网站的Blind XSS测试，发现了系统内部的票据管理系统和FortiGate防火墙管理系统，获得了厂商 $1,250的奖励。"}
{"title": "“寄生兽”（DarkHotel）针对中国外贸人士的最新攻击活动披露", "url": "https://www.freebuf.com/articles/system/206743.html", "time": "2019-06-29", "level": "", "num_look": 134496, "num_comment": 1, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "腾讯御见威胁情报中心近期再次检测到该攻击组织的最新攻击活动，依然针对跟半岛地区相关的外贸企业高管进行的攻击活动。"}
{"title": "入门Web需要了解的PHP反序列化漏洞", "url": "https://www.freebuf.com/articles/web/206249.html", "time": "2019-06-29", "level": "", "num_look": 192303, "num_comment": 5, "author": "P2hm1n", "tags": ["WEB安全"], "text": "最近才开始学习安全，虽然练习过南邮CTF和Bugku的CTF，但是打各种线上CTF经常不尽人意，因为最近的比赛都有着一个新手入门CTF不常遇到的考点—————反序列化。"}
{"title": "BUF大事件丨工信部发布《网络安全漏洞管理规定（征求意见稿）》；中国拟立密码法；加密货币价格上涨，比特币诈骗复苏", "url": "https://www.freebuf.com/news/207101.html", "time": "2019-06-29", "level": "红色标题", "num_look": 72049, "num_comment": 72049, "author": "willhuang", "tags": ["视频", "资讯"], "text": "工信部发布《网络安全漏洞管理规定（征求意见稿）》，引发业内人士广泛关注与讨论；山西省招考中心：考生切勿用搜索引擎搜索填报志愿网页；加密货币价格上涨，比特币诈骗复苏。"}
{"title": "Wpbullet：一款针对WordPress（PHP）的静态代码分析工具", "url": "https://www.freebuf.com/sectool/205923.html", "time": "2019-06-28", "level": "", "num_look": 82152, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Wpbullet的工具，广大安全研究人员可以使用这款工具来对WordPress、插件、主题以及其他PHP项目进行静态代码分析。"}
{"title": "Locked勒索病毒出山，大肆攻击国内企业", "url": "https://www.freebuf.com/articles/network/206961.html", "time": "2019-06-28", "level": "", "num_look": 122077, "num_comment": 2, "author": "360安全", "tags": ["网络安全"], "text": "近日，360安全大脑监测到一个使用Go语言编写的勒索病毒正在攻击国内企业。该勒索病毒会通过“永恒之蓝”漏洞传播自身，同时加密计算机中的重要文件，将文件后缀修改为“.locked”。"}
{"title": "等保测评主机安全：CentOS密码修改周期与登录失败处理", "url": "https://www.freebuf.com/articles/terminal/206959.html", "time": "2019-06-28", "level": "现金奖励", "num_look": 360842, "num_comment": 11, "author": "起于凡而非于凡", "tags": ["终端安全"], "text": "本文和等保联系不是很密切，还是说一了些linux里细节一些的东西，所以有可能会浪费你生命中的好几分钟，同时我使用的是centos6。"}
{"title": "星剑招聘网络安全人才", "url": "https://www.freebuf.com/jobs/206344.html", "time": "2019-06-28", "level": "", "num_look": 76941, "num_comment": 4, "author": "上海星剑信息安全有限公司", "tags": ["安全招聘"], "text": "星剑主要从事信息安全类产品（防火墙，灾备，堡垒机等），以及安全渗透 等保服务等信息安全类服务。"}
{"title": "黑吃黑：揭秘零零狗团伙利用裸贷照片等诱惑性手段的攻击活动", "url": "https://www.freebuf.com/articles/system/207053.html", "time": "2019-06-28", "level": "红色标题", "num_look": 314212, "num_comment": 5, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "近日，奇安信威胁情报中心红雨滴团队捕获了一起严重侵犯公民隐私的攻击，使用涉及裸贷等黄赌毒方面的图片和文档作为压缩包内容，并将木马混于其中，手段恶劣。"}
{"title": "CVE-2019-1040 Windows NTLM篡改漏洞分析", "url": "https://www.freebuf.com/vuls/206169.html", "time": "2019-06-28", "level": "", "num_look": 174643, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["漏洞"], "text": "2019年6月11日，Microsoft发布了六月份安全补丁更新，在该安全更新补丁中，对CVE-2019-1040漏洞进行了修复 。"}
{"title": "顺丰的“武林大会”，齐聚各路高手共论安全心法", "url": "https://www.freebuf.com/fevents/207073.html", "time": "2019-06-28", "level": "", "num_look": 48149, "num_comment": 2, "author": "shidongqi", "tags": ["活动"], "text": "2019年6月27日，第三届顺丰信息安全峰会以全新的形式拉开帷幕。整个场地从入口石碑、战旗、及主会场的擂台等所有主题元素都充满着武侠风，荡气回肠的开场音乐瞬间就让人进入一个风雨欲来的江湖世界。"}
{"title": "缓冲区溢出实战教程系列（四）：程序执行真正的压栈与弹栈", "url": "https://www.freebuf.com/articles/system/206525.html", "time": "2019-06-28", "level": "现金奖励", "num_look": 109413, "num_comment": 1, "author": "kaliking", "tags": ["系统安全"], "text": "上篇文章我们讲了OD的基本运用，与函数执行前的内存的准备流程，这篇就真正接触到缓冲区溢出的核心内容-压栈与弹栈。"}
{"title": "FreeBuf早报丨苹果安全主管将出席黑帽大会，详解iOS 13和macOS安全性；伊朗当局查抄1000台比特币矿机：称其导致用电量激增；搜狗联合北京互联网法院发全球首个AI虚拟法官", "url": "https://www.freebuf.com/news/207042.html", "time": "2019-06-28", "level": "", "num_look": 51883, "num_comment": 51883, "author": "Karunesh91", "tags": ["资讯"], "text": "苹果安全主管将出席黑帽大会，详解iOS 13和macOS安全性；伊朗当局查抄1000台比特币矿机：称其导致用电量激增；搜狗联合北京互联网法院发全球首个AI虚拟法官。"}
{"title": "Intensio-Obfuscator：一款专业Python代码混淆处理工具", "url": "https://www.freebuf.com/sectool/205926.html", "time": "2019-06-27", "level": "", "num_look": 251342, "num_comment": 251342, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Intensio-Obfuscator的专业代码混淆处理工具，广大Python开发人员以及安全专家可以使用这款工具来对v2.x以及v3.x版本的Python代码进行混淆处理。"}
{"title": "漏洞预警 | 致远OA任意文件写入漏洞", "url": "https://www.freebuf.com/vuls/206992.html", "time": "2019-06-27", "level": "红色标题", "num_look": 384552, "num_comment": 3, "author": "斗象智能安全平台", "tags": ["漏洞"], "text": "致远OA系统由北京致远互联软件股份有限公司开发，是一款基于互联网的高效协同工作平台的协同管理软件，在各企业机构中被广泛使用。近期致远OA系统被爆出存在任意文件写入漏洞，已经被发现在野外利用。"}
{"title": "ATtiny85漏洞利用框架HID测试分析", "url": "https://www.freebuf.com/articles/system/206024.html", "time": "2019-06-27", "level": "", "num_look": 80024, "num_comment": 80024, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "今天的主角就是这款名叫Flashsploit的工具，它是一款基于ATtiny85的HID攻击的漏洞利用框架，广大研究人员可以在它的帮助下，可以对各类设备进行HID渗透攻击测试。"}
{"title": "工控安全标准溯源与入坑指引", "url": "https://www.freebuf.com/articles/ics-articles/205653.html", "time": "2019-06-27", "level": "现金奖励", "num_look": 509359, "num_comment": 3, "author": "redhatd", "tags": ["工控安全"], "text": "2018年中因为新等保的意见稿和报批稿的内容，我当时才注意到工控安全的相关。所以利用琐碎时间去了解相关的知识，工控安全行业不仅仅是“蓝海” 还是个“深坑”。"}
{"title": "华米科技招聘高级安全工程师", "url": "https://www.freebuf.com/jobs/206441.html", "time": "2019-06-27", "level": "", "num_look": 72300, "num_comment": 1, "author": "huamisec", "tags": ["安全招聘"], "text": "华米科技创立于2013年是一家全球领先的智能可穿戴创新公司，希望通过“云健康云服务+端可穿戴终端+芯芯片”的布局以科技的力量推动全球每个人享有更好的运动、健康及医疗服务。"}
{"title": "海莲花组织使用新技术手段攻击越南某环保组织", "url": "https://www.freebuf.com/articles/system/206467.html", "time": "2019-06-27", "level": "", "num_look": 456771, "num_comment": 3, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "海莲花，是一个据称越南背景的APT组织。最早于2015年5月被揭露并命名，攻击活动最早可追溯到2012年4月，持续活跃至今。"}
{"title": "谈谈Json格式下的CSRF攻击", "url": "https://www.freebuf.com/articles/web/206407.html", "time": "2019-06-27", "level": "现金奖励", "num_look": 213676, "num_comment": 1, "author": "shystartree", "tags": ["WEB安全"], "text": "浏览器Cookie有效期间，攻击者发送构造好的csrf脚本或包含csrf脚本的链接，可能会执行一些用户不想做的功能（比如是添加账号等）。"}
{"title": "FreeBuf早报 | 百度回应关于考生切勿用搜索引擎搜索填报志愿网页；工信部同意中国互联网络信息中心设立域名根服务器；美国对伊朗发动网络攻击", "url": "https://www.freebuf.com/news/206962.html", "time": "2019-06-27", "level": "", "num_look": 59161, "num_comment": 2, "author": "Karunesh91", "tags": ["资讯"], "text": "百度回应关于考生切勿用搜索引擎搜索填报志愿网页；工信部同意中国互联网络信息中心设立域名根服务器；美国对伊朗发动网络攻击。"}
{"title": "ExtAnalysis：浏览器扩展分析和扫描框架", "url": "https://www.freebuf.com/sectool/206006.html", "time": "2019-06-26", "level": "", "num_look": 91543, "num_comment": 91543, "author": "secist", "tags": ["工具"], "text": "ExtAnalysis是一个浏览器扩展分析框架，用于分析和扫描Chrome和firefox扩展以查找其可能存在的漏洞。"}
{"title": "企业威胁情报平台建设之暗网监控", "url": "https://www.freebuf.com/articles/es/206408.html", "time": "2019-06-26", "level": "现金奖励", "num_look": 680398, "num_comment": 9, "author": "shystartree", "tags": ["企业安全"], "text": "相信大家对暗网这个概念并不陌生，众所周知，暗网藏着一个暗黑版的交易市场，违法工具、色情交易、毒品交易、枪械信息比比皆是，俨然一个网络犯罪分子聚集的“虎狼之穴”。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列：Jesse Kinser", "url": "https://www.freebuf.com/video/206861.html", "time": "2019-06-26", "level": "红色标题", "num_look": 76220, "num_comment": 2, "author": "willhuang", "tags": ["视频"], "text": "Jesse Kinser，曾任职美国国防部情报机构，现任职于美国精密医疗创业公司LifeOmic产品安全经理，有超过10多年的安全工作经验。"}
{"title": "针对越南APT攻击样本深度分析", "url": "https://www.freebuf.com/articles/network/206042.html", "time": "2019-06-26", "level": "", "num_look": 158074, "num_comment": 7, "author": "光通天下", "tags": ["网络安全"], "text": "我们侦测到一些恶意邮件发送到属于越南政府的邮箱，这封邮件可能是来源于越南政府内部，不排除是有人把这封邮件投送到安全部门。"}
{"title": "平安银行总行零售信息安全岗位招聘", "url": "https://www.freebuf.com/jobs/206238.html", "time": "2019-06-26", "level": "", "num_look": 74415, "num_comment": 74415, "author": "平安银行应用安全团队", "tags": ["安全招聘"], "text": "平安银行股份有限公司是总部设在深圳的全国性股份制商业银行（深圳证券交易所简称：平安银行，证券代码000001）。"}
{"title": "FreeBuf早报 | 山西招考中心建议考生勿用搜索引擎搜索填报志愿网页；华为向印度政府提议签“无后门”协议；大疆致信美参议院回应无人机数据安全风险质疑", "url": "https://www.freebuf.com/news/206868.html", "time": "2019-06-26", "level": "", "num_look": 67277, "num_comment": 67277, "author": "shidongqi", "tags": ["资讯"], "text": "山西省招生考试管理中心日前发布提醒，切记不要使用搜索引擎来搜索网上填报志愿系统网页，否则可能误入其他网站，使自己填报的志愿信息无效，并造成考生密码等个人信息泄露的不良后果。"}
{"title": "Mybb 18.20从存储型XSS到RCE分析", "url": "https://www.freebuf.com/vuls/206064.html", "time": "2019-06-26", "level": "", "num_look": 94308, "num_comment": 2, "author": "Knownsec知道创宇", "tags": ["漏洞", "网络安全"], "text": "其实漏洞本身来说，毕竟是需要通过XSS来触发的，哪怕是储存型XSS可以通过私信等方式隐藏，但漏洞的影响再怎么严重也有限，但漏洞点却意外的精巧，下面就让我们一起来详细聊聊看。"}
{"title": "加密货币价格上涨，比特币诈骗复苏", "url": "https://www.freebuf.com/news/206844.html", "time": "2019-06-25", "level": "", "num_look": 69269, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "不久前，Facebook宣布要发布一种新型加密货币，随即加密货币的价格便迎来了一波上涨。同时，一种旧的骗局正在复苏，或许有人还记得：在网上冒充名人并向用户赠送比特币。"}
{"title": "FreeBuf街采 | APP，别乱动我们的个人信息", "url": "https://www.freebuf.com/video/206476.html", "time": "2019-06-25", "level": "红色标题", "num_look": 125577, "num_comment": 11, "author": "willhuang", "tags": ["视频"], "text": "你有没有遇到过这种情况，刚说了想吃什么，手机就蹦出了它的推荐；刚说了要买什么，就出现了广告。刚在购房App上浏览完毕，贷款电话就打了进来……"}
{"title": "影响数千网站的第三方JavaScript库文件漏洞分析", "url": "https://www.freebuf.com/vuls/206271.html", "time": "2019-06-25", "level": "", "num_look": 151371, "num_comment": 1, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "很多网站都会使用第三方特定JavaScript库的方式来增强网站的显示应用功能，通常情况下，这种嵌入到网站中的库可以方便直接地从第三方服务提供商的域中加载，实现对当前网站的优化和功能增强。"}
{"title": "中国拟立密码法，明确任何组织或个人不得窃取他人加密信息", "url": "https://www.freebuf.com/news/206837.html", "time": "2019-06-25", "level": "", "num_look": 95345, "num_comment": 1, "author": "Allen别bb", "tags": ["资讯"], "text": "草案明确，任何组织或者个人不得窃取他人的加密信息，不得非法侵入他人的密码保障系统，不得利用密码从事危害国家安全、社会公共利益、他人合法权益的活动或者其他违法犯罪活动。"}
{"title": "创新安全丨2019斗象科技人才招聘", "url": "https://www.freebuf.com/jobs/206827.html", "time": "2019-06-25", "level": "", "num_look": 91131, "num_comment": 4, "author": "FB客服", "tags": ["安全招聘"], "text": "斗象科技旗下坐拥FreeBuf、漏洞盒子、网藤智能安全平台三大品牌，凭借在信息安全与企业安全市场的专业性见解和强大技术实力，建立了长远的战略目标和良好的客户口碑。"}
{"title": "浅谈精准提取日志中的URL", "url": "https://www.freebuf.com/articles/web/206244.html", "time": "2019-06-25", "level": "", "num_look": 207710, "num_comment": 4, "author": "littlegrass", "tags": ["WEB安全"], "text": "在分析日志的时候发现有些日志中参数中包含其他的URL，这边文章就对提取URL做一个演示。"}
{"title": "Web攻击检测机器学习深度实践", "url": "https://www.freebuf.com/articles/web/205760.html", "time": "2019-06-25", "level": "现金奖励", "num_look": 350562, "num_comment": 22, "author": "月亮与六便士", "tags": ["WEB安全"], "text": "传统的WAF，依赖规则和黑白名单的方式来进行Web攻击检测。该方式存在一定的局限性，过分依赖另一方面即使是已知的攻击类型，由于正则表达式天生的局限性，因此天生存在一系列误拦问题，拖累了整体性能。"}
{"title": "FreeBuf 早报 | WeTransfer发生安全事件，文件通过电子邮件发送给错误的人；恶意软件滥用Android调试和SSH功能来传播挖矿应用", "url": "https://www.freebuf.com/news/206785.html", "time": "2019-06-25", "level": "", "num_look": 73643, "num_comment": 73643, "author": "Freddy", "tags": ["资讯"], "text": "WeTransfer发布公告称，部分通过电子邮件通道传输的文件于6月16日和17日被发送到非预期的电子邮件地址。"}
{"title": "加入FreeBuf公开课讲师团队，让技术更有价值！", "url": "https://www.freebuf.com/open/206798.html", "time": "2019-06-25", "level": "", "num_look": 77597, "num_comment": 77597, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "请停止挥霍自己的年华，请不要埋没自己的优秀，加入FreeBuf公开课讲师团队，让你的知识技术更有价值！"}
{"title": "一个工控漏洞引发的思考", "url": "https://www.freebuf.com/vuls/205987.html", "time": "2019-06-25", "level": "现金奖励", "num_look": 230311, "num_comment": 2, "author": "ww5466064", "tags": ["漏洞"], "text": "AdvantechWebAccess软件一直是漏洞挖掘者的最爱，ZDI的一篇报告中指出曾经一天内收到100个关于AdvantechWebAccess软件漏洞的上报，ICS-CERT中亦有大量相关漏洞纰漏。"}
{"title": "Donut：将.NET程序集注入Windows进程", "url": "https://www.freebuf.com/sectool/206154.html", "time": "2019-06-25", "level": "", "num_look": 97870, "num_comment": 97870, "author": "secist", "tags": ["工具"], "text": "Donut是一个shellcode生成工具，它可以从.NET程序集中创建与位置无关的shellcode payloads。"}
{"title": "DSMM数据安全能力成熟度模型试点评估实践体会", "url": "https://www.freebuf.com/articles/database/206419.html", "time": "2019-06-24", "level": "现金奖励", "num_look": 284107, "num_comment": 8, "author": "Rainbow2019", "tags": ["数据安全"], "text": "DSMM 标准为企业的数据生命周期的安全提供了比较好的实践要求，但是目前 DSMM 标准报批稿也存在着一些小问题，如部分评估项晦涩难懂或者冗长或者描述不清晰，目前的评估指南与 DSMM 评估标准也存在差距。"}
{"title": "TrackRay：打造一款自己的渗透测试框架", "url": "https://www.freebuf.com/sectool/204457.html", "time": "2019-06-24", "level": "", "num_look": 217627, "num_comment": 13, "author": "安百科技", "tags": ["工具"], "text": "溯光，英文名“TrackRay”，意为逆光而行，追溯光源。同时致敬安全圈前辈开发的“溯雪”，“流光”。"}
{"title": "记一次被DDoS敲诈的历程", "url": "https://www.freebuf.com/articles/es/205934.html", "time": "2019-06-24", "level": "现金奖励", "num_look": 419797, "num_comment": 23, "author": "糖果L5Q", "tags": ["企业安全"], "text": "一个朋友网站业务被攻击了，先是威胁要钱，然后成提供DDOS攻击服务，然后又变成了DDOS培训，又变成了卖DDOS软件，最后又变成了DDOS高防护攻击测试提供者。"}
{"title": "如何使用机器学习创建恶意软件检测系统", "url": "https://www.freebuf.com/articles/system/205444.html", "time": "2019-06-24", "level": "", "num_look": 140641, "num_comment": 3, "author": "Avenger", "tags": ["系统安全"], "text": "Ergo是一个我与chiconara共同创建的自动机器学习模型创建、数据编码、GPU训练、基准测试和大规模部署的框架。"}
{"title": "佛山欧神诺公司招聘安全人才", "url": "https://www.freebuf.com/jobs/206618.html", "time": "2019-06-24", "level": "", "num_look": 72084, "num_comment": 9, "author": "FB客服", "tags": ["安全招聘"], "text": "欧神诺陶瓷公司将依托“欧神诺在线”云商平台和全国近1000多家线下体验服务中心，致力于打造成为以消费者为中心的“瓷砖整体解决方案”营运服务商。"}
{"title": "STRIDE威胁建模方法讨论", "url": "https://www.freebuf.com/articles/es/205984.html", "time": "2019-06-24", "level": "现金奖励", "num_look": 347887, "num_comment": 4, "author": "yoursshun", "tags": ["企业安全"], "text": "简单的来说，威胁建模就是通过结构化的方法，系统的识别、评估产品的安全风险和威胁，并针对这些风险、威胁制定消减措施的一个过程。"}
{"title": "《网络安全法》落地两周年回顾", "url": "https://www.freebuf.com/articles/neopoints/206049.html", "time": "2019-06-24", "level": "红色标题", "num_look": 341201, "num_comment": 4, "author": "Freddy", "tags": ["观点"], "text": "在《中华人民共和国网络安全法》出台前，我国专门用于规范互联网安全的法律仅有三部，而与网络安全相关的法律更多地散见于其他法律、行政法规、部门规章、司法解释、规范性文件或政策性文件之中。"}
{"title": "FreeBuf早报｜戴尔预装软件曝出安全漏洞；泄露文档称微软“不鼓励”员工使用Slack、卡巴斯基甚至是GitHub；网络钓鱼活动冒充国土安全部警报", "url": "https://www.freebuf.com/news/206662.html", "time": "2019-06-24", "level": "", "num_look": 63863, "num_comment": 63863, "author": "shidongqi", "tags": ["资讯"], "text": "此前，一架美国军用无人机被伊朗军队击落后，两国本已紧张的关系立即进一步恶化。据Reddit论坛的网友反映，伊朗和叙利亚的玩家目前已无法登录《英雄联盟》，而原因可能是美国政府方面的封锁。"}
{"title": "PC-Doctor组件存在提权漏洞，海量设备面临网络攻击风险", "url": "https://www.freebuf.com/news/206666.html", "time": "2019-06-24", "level": "", "num_look": 68672, "num_comment": 68672, "author": "Freddy", "tags": ["资讯"], "text": "很多计算机设备生产厂商基于PC-Doctor组件构建了自己的计算机管理软件，并预装进设备获得了大量分发，因此本次发现的漏洞将影响全球范围内数以亿计的计算机设备。"}
{"title": "NASA自曝遭入侵，黑客利用树莓派窃取500MB火星任务数据", "url": "https://www.freebuf.com/news/206651.html", "time": "2019-06-23", "level": "红色标题", "num_look": 108937, "num_comment": 8, "author": "Allen别bb", "tags": ["资讯"], "text": "2018年4月，有黑客攻击了NASA网络并盗走了约500M与火星任务相关的数据。攻入的切点则是一台连着NASA喷气推进实验室(JPL) IT网络的树莓派电脑。"}
{"title": "Kippo：一款强大的SSH蜜罐工具", "url": "https://www.freebuf.com/sectool/206140.html", "time": "2019-06-23", "level": "", "num_look": 245439, "num_comment": 3, "author": "Jaleni", "tags": ["工具"], "text": "Kippo是一款强大的SSH蜜罐工具，它具有很强的互动性，当攻击者拿到了蜜罐的SSH口令后可以登录到蜜罐服务器执行一些常见的Linux命令。"}
{"title": "逆向分析Spotify.app并hook其功能获取数据", "url": "https://www.freebuf.com/articles/database/205918.html", "time": "2019-06-23", "level": "", "num_look": 117697, "num_comment": 117697, "author": "secist", "tags": ["数据安全"], "text": "在开始本文的正式内容之前我想先来吐槽下。大多数的软件开发人员可能都有着这样一个烦恼，就是由于工作和其他责任，不得不搁置自己的一些个人项目甚至是最终完全的遗忘和埋没。"}
{"title": "Bluehero挖矿蠕虫变种空降", "url": "https://www.freebuf.com/articles/system/206036.html", "time": "2019-06-23", "level": "", "num_look": 111928, "num_comment": 4, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近日，深信服安全团队捕获到Bluehero挖矿蠕虫最新变种，该挖矿蠕虫集多种功能为一体。"}
{"title": "记一次BGP事件：欧洲流量通过中国电信错误传输2小时", "url": "https://www.freebuf.com/articles/network/205851.html", "time": "2019-06-23", "level": "", "num_look": 139081, "num_comment": 3, "author": "安数君", "tags": ["网络安全"], "text": "上周四，BGP路由泄漏导致大部分欧洲移动流量通过中国电信的网络路由持续2小时。"}
{"title": "一款ChromeHTTP请求重放插件", "url": "https://www.freebuf.com/sectool/205729.html", "time": "2019-06-22", "level": "金币+8", "num_look": 147304, "num_comment": 2, "author": "howintre", "tags": ["工具"], "text": "一款用于chrome下的HTTP包重放工具HTTP请求记录又2种模式，一种为记录全部标签页的请求，另一种为记录当前devtool所在标签页的请求。"}
{"title": "如何使用LES对Linux进行渗透测试研究", "url": "https://www.freebuf.com/articles/system/205920.html", "time": "2019-06-22", "level": "", "num_look": 94092, "num_comment": 94092, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "LES安全工具由Z-Labs开发并负责维护，可帮助安全测试人员以及安全分析专家在对Linux设备进行红队测试/渗透测试的过程中寻找关键漏洞。"}
{"title": "PHAR反序列化拓展操作总结", "url": "https://www.freebuf.com/articles/web/205943.html", "time": "2019-06-22", "level": "现金奖励", "num_look": 320394, "num_comment": 3, "author": "cck", "tags": ["WEB安全"], "text": "近些阵子反序列化漏洞横行，看了几篇文章，整个漏洞发现过程是非常有意思的，所以希望总结下来，分享给大家一起研究讨论，如有不足还请多多指正。"}
{"title": "一道题入门逆向分析", "url": "https://www.freebuf.com/articles/database/205986.html", "time": "2019-06-22", "level": "金币+8", "num_look": 129683, "num_comment": 2, "author": "Boringrole", "tags": ["数据安全"], "text": "将自己学习逆向破解的知识总结一下，主要是逆向的入门知识以及自己的学习感悟，包括逆向时的一些思路和补丁，注册机，保护壳等方面的一些知识。"}
{"title": "年中干货：Gartner 2019十大安全项目前瞻", "url": "https://www.freebuf.com/articles/network/206449.html", "time": "2019-06-21", "level": "现金奖励", "num_look": 332428, "num_comment": 332428, "author": "宇宸de研究室", "tags": ["企业安全", "网络安全"], "text": "看来是到了年中甩干货的时候了，不久前刚刚发布网络安全漏洞管理规定，随后Gartner又抛出十大安全项目，感觉信息量有点大起来了。"}
{"title": "如何使用Yaazhini扫描Android APKAPI中的安全漏洞", "url": "https://www.freebuf.com/articles/terminal/205932.html", "time": "2019-06-21", "level": "", "num_look": 160657, "num_comment": 160657, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "Yaazhini是一款针对Android APK和API的免费漏洞扫描工具，这款工具提供了用户友好的操作界面。"}
{"title": "应急响应系列之OA被入侵挖矿分析报告", "url": "https://www.freebuf.com/articles/network/205387.html", "time": "2019-06-21", "level": "现金奖励", "num_look": 372198, "num_comment": 14, "author": "feiniao", "tags": ["网络安全"], "text": "此事件是去年应急处置时完成的报告，距今有半年时间了。一直存在电脑里，最近准备完善应急响应中遇到的各类安全事件，这篇文章作为这一系列的开端。"}
{"title": "CVE-2019-11477：Linux内核中TCP协议栈整数溢出漏洞详细分析", "url": "https://www.freebuf.com/vuls/206553.html", "time": "2019-06-21", "level": "", "num_look": 177973, "num_comment": 4, "author": "奇安信代码卫士", "tags": ["漏洞", "系统安全"], "text": "RedHat官网发布CVE编号为CVE-2019-11477的漏洞，此漏洞是一个底层协议栈的整数溢出漏洞，理论上可以造成远程拒绝服务漏洞。"}
{"title": "招聘丨度小满金融安全部等待着你的到来", "url": "https://www.freebuf.com/jobs/206511.html", "time": "2019-06-21", "level": "", "num_look": 85880, "num_comment": 4, "author": "度小满安全应急响应中心", "tags": ["安全招聘"], "text": "度小满金融，致力于用科技为更多人提供值得信赖的金融服务。2018年4月28日，百度旗下金融服务事业群组完成拆分融资，启用全新品牌“度小满金融” 。"}
{"title": "捆绑激活工具的恶意插件预警", "url": "https://www.freebuf.com/articles/terminal/205856.html", "time": "2019-06-21", "level": "", "num_look": 107157, "num_comment": 1, "author": "亚信安全", "tags": ["终端安全"], "text": "近日，亚信安全截获一款恶意插件的安装包程序，该安装包程序通常与激活工具、绿色软件等捆绑在一起。"}
{"title": "深入了解SQLMAP API", "url": "https://www.freebuf.com/articles/web/204875.html", "time": "2019-06-21", "level": "现金奖励", "num_look": 324701, "num_comment": 13, "author": "看不尽的尘埃", "tags": ["WEB安全"], "text": "我去网上搜了搜相关的资料，发现关于这方面的资料确实挺少的，于是参观了一下SQLMAP的源码，大致摸清楚了如何调用api接口。"}
{"title": "Ryuk勒索病毒更新，俄罗斯黑客团伙幕后开发运营", "url": "https://www.freebuf.com/articles/terminal/206533.html", "time": "2019-06-21", "level": "金币+8", "num_look": 125409, "num_comment": 125409, "author": "熊猫正正", "tags": ["终端安全"], "text": "相关报道指出Ryuk的代码与Hermes勒索病毒代码非常相似，而Hermes恶意软件则与臭名昭着的朝鲜LazarusAPT网络犯罪组织有关。"}
{"title": "FreeBuf早报 | 十年间，美国因数据泄露事件损失超过1.5万亿美元；内容审核员控诉Facebook是美国的血汗工厂；美国俄勒冈州人力资源服务部门发生数据泄露", "url": "https://www.freebuf.com/news/206528.html", "time": "2019-06-21", "level": "", "num_look": 83408, "num_comment": 83408, "author": "Freddy", "tags": ["资讯"], "text": "由于经常接触暴力画面和儿童剥削，Facebook的许多内容审核员被诊断患有创伤后应激障碍和相关疾病。"}
{"title": "Xposed开发浅谈探寻篇", "url": "https://www.freebuf.com/sectool/205528.html", "time": "2019-06-21", "level": "金币+8", "num_look": 95419, "num_comment": 1, "author": "cck", "tags": ["工具"], "text": "Xposed作为一个著名的Hook框架，早已经在移动安全行业家喻户晓。"}
{"title": "针对《网络安全漏洞管理规定（征求意见稿）》的一些看法：利大于弊", "url": "https://www.freebuf.com/articles/neopoints/206477.html", "time": "2019-06-20", "level": "红色标题", "num_look": 220395, "num_comment": 24, "author": "百里不守约", "tags": ["观点"], "text": "距离意见征集的截止时间还有差不多一个月的时间，期望广大安全工作者为构建一个健全、完善的漏洞管理机制而积极反馈意见，也欢迎朋友们在评论区发表自己的观点。"}
{"title": "又出幺蛾子了，特斯拉两款车存在重大安全隐患", "url": "https://www.freebuf.com/news/206519.html", "time": "2019-06-20", "level": "", "num_look": 303958, "num_comment": 1, "author": "Karunesh91", "tags": ["无线安全", "资讯"], "text": "近日，Regulus Cyber公布了一项研究，发现特斯拉的两款车Model 3和Model S存在一些“问题”，容易受到针对导航系统的网络攻击。"}
{"title": "【议题征集】等级保护2.0研讨大会「北京站」| 企业安全俱乐部", "url": "https://www.freebuf.com/fevents/206443.html", "time": "2019-06-20", "level": "", "num_look": 224307, "num_comment": 4, "author": "FB独家", "tags": ["活动"], "text": "FreeBuf企业安全俱乐部「等级保护2.0研讨专场」继在深圳成功举办后，将于7月24日来到北京，与北京的企业进行面对面的分享与交流。"}
{"title": "看我如何自制安全的远程控制工具", "url": "https://www.freebuf.com/geek/205267.html", "time": "2019-06-20", "level": "红色标题", "num_look": 931408, "num_comment": 11, "author": "知道创宇KCSC", "tags": ["极客"], "text": "今天我就延续上次的思路，围绕树莓派来讲如何通过它来进行远程控制。"}
{"title": "WordPress插件IEAC漏洞分析及组合利用尝试", "url": "https://www.freebuf.com/vuls/205735.html", "time": "2019-06-20", "level": "现金奖励", "num_look": 91988, "num_comment": 91988, "author": "Kriston", "tags": ["漏洞"], "text": "最近WordPress的另一个插件（真的是插件多如牛毛）insert or embed articulate content爆出远程代码执行漏洞，在登陆网站后可通过zip压缩文件上传php后门。"}
{"title": "GoldBrute僵尸网络横空出世，百万台RDP服务器瑟瑟发抖", "url": "https://www.freebuf.com/news/205631.html", "time": "2019-06-20", "level": "", "num_look": 100667, "num_comment": 7, "author": "深信服千里目安全实验室", "tags": ["资讯"], "text": "一个僵尸网络病毒突然横空出世，对全球1,500,000+个设备进行扫描。该病毒名为GoldBrute，通过传统的RDP爆破方式进行传播。"}
{"title": "Exim远程“命令”执行漏洞细节", "url": "https://www.freebuf.com/vuls/205563.html", "time": "2019-06-20", "level": "金币+8", "num_look": 124849, "num_comment": 124849, "author": "Kriston", "tags": ["漏洞"], "text": "在对Exim邮件服务器最新版本变化进行代码审计时，我们发现了一个RCE漏洞，在这个漏洞中，RCE指的是远程命令执行，并不是传统意义上的远程代码执行。"}
{"title": "Versionscan：一款专为白帽子设计的PHP漏洞扫描报告工具", "url": "https://www.freebuf.com/sectool/206015.html", "time": "2019-06-20", "level": "", "num_look": 112814, "num_comment": 112814, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Versionscan是一款可以帮助安全研究人员评估PHP项目安全性的漏洞扫描及安全报告工具，它可以检测已知的CVE漏洞，并报告目标站点的潜在安全问题。"}
{"title": "FreeBuf早报 | 谷歌发布面向计算隐私的开源工具；美国佛罗里达州向勒索软件运营者支付60万美元赎金；广告公司泄露美国退伍军人受伤数据", "url": "https://www.freebuf.com/news/206411.html", "time": "2019-06-20", "level": "", "num_look": 75003, "num_comment": 2, "author": "Freddy", "tags": ["资讯"], "text": "谷歌发布了一款全新的开源加密工具，旨在提高敏感数据集的隐私性。"}
{"title": "快讯 | 俄犯罪分子窃取反病毒公司源代码并在线销售", "url": "https://www.freebuf.com/news/206005.html", "time": "2019-06-20", "level": "", "num_look": 90945, "num_comment": 90945, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "根据安全研究人员的发现，近期一个名叫 Fxsmsp 的网络犯罪组织正在网上在线销售主流反病毒软件的源代码，而且售价金额高达30 万美元。"}
{"title": "从CVE-2019-2725绕过谈Weblogic XML RCE的绕过史", "url": "https://www.freebuf.com/vuls/206374.html", "time": "2019-06-19", "level": "", "num_look": 301487, "num_comment": 8, "author": "平安银行应用安全团队", "tags": ["WEB安全", "漏洞"], "text": "从 CVE-2017-3506 为起点至今，weblogic 接二连三的吧爆出了大量的反序列化漏洞，而这些反序列化漏洞的很大一部分，都是围绕着 XMLDecoder 的补丁与补丁的绕过展开的。"}
{"title": "谈谈《网络安全漏洞管理规定（征求意见稿）》释放的信息", "url": "https://www.freebuf.com/articles/network/206313.html", "time": "2019-06-19", "level": "现金奖励", "num_look": 508144, "num_comment": 24, "author": "宇宸de研究室", "tags": ["标准与合规", "网络安全"], "text": "当各位还在期盼自己618快递状态的时候，工信部发布了这样一部网络安全漏洞管理规定，也是给了一个惊喜。"}
{"title": "Python-Iocextract：高级入侵威胁标识符IoC提取工具", "url": "https://www.freebuf.com/sectool/205961.html", "time": "2019-06-19", "level": "", "num_look": 106121, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Python-Iocextract是一款高级入侵威胁标识符IoC提取工具，它可以从文本语料库提取URL、IP地址、MD5/SHA哈希、电子邮件地址和YARA规则，其中还包括某些已编码或已被“破坏”的入侵威胁标识符。"}
{"title": "我是怎么把研发安全做“没”了的", "url": "https://www.freebuf.com/articles/system/205835.html", "time": "2019-06-19", "level": "红色标题", "num_look": 438880, "num_comment": 19, "author": "默安科技", "tags": ["系统安全"], "text": "我叫王大锤，万万没想到，我成了马栏山不省心集团的研发安全工程师。。。这一定是对我的终极考验，相信用不了多久我就会升职加薪，当上总经理，出任CEO,迎娶白富美，走向人生巅峰。想想，还有点小激动。"}
{"title": "使用Homograph的复杂鱼叉渗透分析", "url": "https://www.freebuf.com/articles/web/205289.html", "time": "2019-06-19", "level": "", "num_look": 120986, "num_comment": 120986, "author": "secist", "tags": ["WEB安全"], "text": "我们正在研究一个相当古老的安全话题：Punycode域和IDN同形异义词攻击。"}
{"title": "中文首发丨OSCE（Offensive Security Certified Expert）考证全攻略", "url": "https://www.freebuf.com/news/206041.html", "time": "2019-06-19", "level": "现金奖励", "num_look": 494119, "num_comment": 9, "author": "安全圈套的套哥", "tags": ["网络安全", "资讯"], "text": "在OSCP认证之后又拿下来OSCE认证，在整个申请考试和备考过程中遇到不少问题，通过与小伙伴交流和自己的摸索终于通关。"}
{"title": "招人啦！小米安全中心欢迎你的加入！", "url": "https://www.freebuf.com/jobs/206163.html", "time": "2019-06-19", "level": "", "num_look": 105469, "num_comment": 8, "author": "小米安全中心", "tags": ["安全招聘"], "text": "小米的安全边界无限广阔，同时也充满挑战！我们拥有手机、电视、笔记本、路由器、空调等成数百种智能硬件，又涵盖电商、金服、视频、游戏等众多的业务线……我们期待你成为抵御外来威胁的中流砥柱！"}
{"title": "TP-LINK Wi-Fi中继器出现漏洞，可用于远程代码执行", "url": "https://www.freebuf.com/news/206346.html", "time": "2019-06-19", "level": "", "num_look": 396467, "num_comment": 2, "author": "Karunesh91", "tags": ["无线安全", "资讯"], "text": "一些TP-Link的Wi-Fi中继器设备存在严重的远程代码执行漏洞，漏洞可导致外来攻击者获取设备权限并执行任意命令。"}
{"title": "“方程式组织”攻击中东SWIFT服务商事件复盘分析报告", "url": "https://www.freebuf.com/articles/paper/205080.html", "time": "2019-06-19", "level": "", "num_look": 132294, "num_comment": 6, "author": "antiylab", "tags": ["安全报告"], "text": "网空威胁行为体是网络空间攻击活动的来源，它们有不同的目的和动机，其能力也存在明显的层级差异。根据作业动机、攻击能力、掌控资源等角度，能够将网空威胁行为体划分为七个层级。"}
{"title": "FreeBuf早报 | 工信部发布《网络安全漏洞管理规定 (征求意见稿) 》公开征求意见；Linux 和 FreeBSD 被曝多个 DoS 漏洞；谷歌日历出现故障，持续数小时后才恢复", "url": "https://www.freebuf.com/news/206284.html", "time": "2019-06-19", "level": "", "num_look": 118801, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "伊朗宣布摧毁一个大型美国CIA黑客间谍网络；TP-Link Wi-Fi扩展器中存在严重的远程执行漏洞；BitDefender发布GandCrab V5.2勒索病毒解密工具。"}
{"title": "不可忽视的打印机漏洞研究", "url": "https://www.freebuf.com/articles/web/205636.html", "time": "2019-06-19", "level": "现金奖励", "num_look": 353402, "num_comment": 2, "author": "VoltCary", "tags": ["WEB安全"], "text": "经过最近一段时间测试，发现企业内网打印机存在多种漏洞，同时也经常被大家所忽略，因此才有本文的研究。当一台打印机连接网络，可以进行端口扫描、读写上传恶意文件、反弹shell，相当于一台服务器。"}
{"title": "工信部：《网络安全漏洞管理规定 (征求意见稿) 》公开征求意见", "url": "https://www.freebuf.com/news/206275.html", "time": "2019-06-18", "level": "红色标题", "num_look": 159927, "num_comment": 3, "author": "FB客服", "tags": ["资讯"], "text": "为规范网络安全漏洞报告和信息发布等行为，保证网络产品、服务、系统的漏洞得到及时修补，提高网络安全防护水平，制定本规定。"}
{"title": "pymetasploit3：一个Python编写的Metasploit自动化库", "url": "https://www.freebuf.com/sectool/205529.html", "time": "2019-06-18", "level": "", "num_look": 176907, "num_comment": 3, "author": "secist", "tags": ["工具"], "text": "Pymetasploit3是一个Python编写的成熟的Metasploit自动化库。它可以通过msfrpcd或msfconsole中的msgrpc插件与Metasploit进行交互。"}
{"title": "企业中了勒索病毒该怎么办？可以解密吗？", "url": "https://www.freebuf.com/articles/es/206199.html", "time": "2019-06-18", "level": "现金奖励", "num_look": 216701, "num_comment": 3, "author": "熊猫正正", "tags": ["企业安全"], "text": "勒索病毒席卷全球，给全球各大小政企业都带来了巨大的损失，勒索病毒重点在于防，可是黑客无孔不入，再强大的系统都有可能存在漏洞，万一企业被攻击，已经中了勒索病毒，那该怎么办呢？"}
{"title": "【FreeBuf字幕组】Web安全漏洞系列：Open Redirect（开放式重定向跳转）", "url": "https://www.freebuf.com/vuls/206087.html", "time": "2019-06-18", "level": "红色标题", "num_look": 144761, "num_comment": 2, "author": "willhuang", "tags": ["漏洞", "视频"], "text": "Open Redirect（开放式重定向跳转），利用这种重定向功能，Web应用能够引导用户访问同一应用程序的不同网页或其它的外部站点。"}
{"title": "堡垒机哲学史：从哪里来？到哪里去？是什么？", "url": "https://www.freebuf.com/sectool/205821.html", "time": "2019-06-18", "level": "红色标题", "num_look": 223864, "num_comment": 9, "author": "qizhitech", "tags": ["企业安全", "工具"], "text": "聚焦下一个十年里，数据中心客户面临着更大的问题，寻找时代的技术最优解，是今天我们的挑战。"}
{"title": "趣头条招聘安全人才", "url": "https://www.freebuf.com/jobs/206082.html", "time": "2019-06-18", "level": "", "num_look": 95358, "num_comment": 7, "author": "rampage", "tags": ["安全招聘"], "text": "趣头条是中国领先的专注于新兴市场的移动内容资讯平台，以娱乐、生活资讯为主体内容，依托于强大的智能化数据分析系统，为新兴市场受众提供精准的内容分发服务。"}
{"title": "污水（MuddyWater）近期针对塔吉克斯坦、土耳其等地的攻击活动汇总", "url": "https://www.freebuf.com/articles/network/205621.html", "time": "2019-06-18", "level": "", "num_look": 105365, "num_comment": 3, "author": "腾讯电脑管家", "tags": ["网络安全"], "text": "污水APT组织是一个疑似来自伊朗的攻击组织，该组织主要针对中东地区、前苏联国家、土耳其等中亚国家的政府部门进行攻击。"}
{"title": "BUF早报丨三星为其智能电视添加恶意软件扫描程序；黑客组织瞄准美国电网；平安保险利用AI鉴定客户", "url": "https://www.freebuf.com/news/206098.html", "time": "2019-06-18", "level": "", "num_look": 127547, "num_comment": 2, "author": "Karunesh91", "tags": ["资讯"], "text": "FreeBuf早餐铺改版啦，新内容新形式，快来感受一下吧~"}
{"title": "揭密全球最大勒索病毒GandCrab的接班人", "url": "https://www.freebuf.com/articles/terminal/205981.html", "time": "2019-06-18", "level": "金币+8", "num_look": 204245, "num_comment": 2, "author": "熊猫正正", "tags": ["终端安全"], "text": "GandCrab停止运营之后，有一款跟GandCrab使用相同的传播渠道的勒索病毒在最近一段时间非常活跃，那就是Sodinokibi。"}
{"title": "从WhatsApp的备份数据库中提取消息", "url": "https://www.freebuf.com/articles/database/205784.html", "time": "2019-06-17", "level": "", "num_look": 129206, "num_comment": 1, "author": "secist", "tags": ["数据安全"], "text": "本文我将为大家介绍如何使用Python从WhatsApp恢复消息。并且我会着重解释如何从WhatsApp的sqlite数据库中查找和提取对话，并解析那里的字段和数据。"}
{"title": "企业安全建设的体系思考与落地实践", "url": "https://www.freebuf.com/articles/es/205805.html", "time": "2019-06-17", "level": "金币+8", "num_look": 271339, "num_comment": 7, "author": "安全小飞侠", "tags": ["企业安全"], "text": "企业安全建设是一个老生常谈的问题，由于每个人的工作经验和心得体会的不同，因此看法和实践通常也不一样。"}
{"title": "记一次应急中发现的诡异事件", "url": "https://www.freebuf.com/articles/system/205497.html", "time": "2019-06-17", "level": "现金奖励", "num_look": 530676, "num_comment": 17, "author": "小司马WHY", "tags": ["企业安全", "系统安全"], "text": "在一次应急响应中，无意发现来自不同地区和人员的攻击，两种留后门的方法，截然不同的操作，不同的技术手法。"}
{"title": "CNNVD 关于Oracle WebLogic Server远程代码执行漏洞的通报", "url": "https://www.freebuf.com/vuls/206033.html", "time": "2019-06-17", "level": "", "num_look": 152180, "num_comment": 2, "author": "CNNVD", "tags": ["漏洞"], "text": "攻击者可利用该漏洞在未授权的情况下发送攻击数据，实现任意代码执行。该漏洞是由于Oracle WebLogic Server一个历史漏洞（CNNVD-201904-961）修补不完善导致。"}
{"title": "Linux应急响应之工具篇", "url": "https://www.freebuf.com/sectool/205288.html", "time": "2019-06-17", "level": "金币+8", "num_look": 240909, "num_comment": 14, "author": "菜鸟的菜", "tags": ["工具"], "text": "当企业被攻击者入侵，系统被挂暗链、内容遭到恶意篡改，服务器出现异常链接、卡顿等情况时，需要进行紧急处理，使系统在最短时间内恢复正常。"}
{"title": "BUF早餐铺 | 西甲官方应用因非法监听用户被罚 25 万欧元；美军网络司令部已在俄罗斯电网植入恶意软件；Avast 和 AVG 导致 Firefox 用户无法使用保存的密码", "url": "https://www.freebuf.com/news/206001.html", "time": "2019-06-17", "level": "", "num_look": 117001, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "西班牙足球甲级联赛官方 Android 应用因非法监听用户被罚 25 万欧元。去年西甲承认它的 Android 应用访问手机的麦克风和 GPS，但它辩护称此举旨在通过匹配音频数据和手机位置，跟踪播放比赛的非法场所。"}
{"title": "2019强网杯Final Writeup", "url": "https://www.freebuf.com/articles/network/205147.html", "time": "2019-06-17", "level": "", "num_look": 148764, "num_comment": 2, "author": "Knownsec知道创宇", "tags": ["网络安全"], "text": "上周有幸去南京参加了强网杯拟态挑战赛，运气比较好拿了第二名，只是可惜是最后8分钟被爆了，差一点儿真是有点儿可惜。"}
{"title": "fatt：从pcap或实时网络流量中提取元数据和指纹", "url": "https://www.freebuf.com/sectool/205208.html", "time": "2019-06-16", "level": "", "num_look": 154893, "num_comment": 154893, "author": "secist", "tags": ["工具"], "text": "fatt是一个用于从pcap或实时网络流量中提取元数据和指纹（如JA3和HASSH）的python脚本。"}
{"title": "漏洞预警 | Oracle WebLogic XMLDecoder反序列化漏洞(CVE-2019-2725绕过)", "url": "https://www.freebuf.com/vuls/205990.html", "time": "2019-06-16", "level": "红色标题", "num_look": 189324, "num_comment": 2, "author": "斗象智能安全平台", "tags": ["漏洞"], "text": "Oracle Fusion Middleware是美国甲骨文公司的一套面向企业和云环境的业务创新平台。该平台提供了中间件、软件集合等功能。Oracle WebLogic Server是其中的一个适用于云环境和传统环境的应用服务器组件。"}
{"title": "FakeMsdMiner挖矿病毒分析报告", "url": "https://www.freebuf.com/articles/terminal/205356.html", "time": "2019-06-16", "level": "", "num_look": 148276, "num_comment": 2, "author": "亚信安全", "tags": ["终端安全"], "text": "近日，亚信安全截获新型挖矿病毒FakeMsdMiner，该病毒利用永恒之蓝，永恒浪漫等NSA漏洞进行攻击传播。"}
{"title": "2019强网杯Web部分Writeup", "url": "https://www.freebuf.com/articles/web/205690.html", "time": "2019-06-16", "level": "金币+8", "num_look": 230693, "num_comment": 12, "author": "cck", "tags": ["WEB安全"], "text": "2019年的强网杯web题目出的都不错，所以对题目进行分析一下。"}
{"title": "Bandit：一款Python代码安全漏洞检测工具", "url": "https://www.freebuf.com/sectool/204995.html", "time": "2019-06-15", "level": "", "num_look": 164969, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Bandit这款工具可以用来搜索Python代码中常见的安全问题，在检测过程中，Bandit会对每一份Python代码文件进行处理，并构建AST，然后针对每一个AST节点运行相应的检测插件。"}
{"title": "搭建一个Drupal Core RCE（CVE-2019–6340 ）漏洞的蜜罐", "url": "https://www.freebuf.com/articles/web/205381.html", "time": "2019-06-15", "level": "", "num_look": 138515, "num_comment": 138515, "author": "secist", "tags": ["WEB安全"], "text": "不久前，我开始了一个管理真实网络蜜罐的项目。"}
{"title": "黑客利用SSH弱密码攻击控制Linux服务器，潜在目标约十万IP天", "url": "https://www.freebuf.com/articles/system/205384.html", "time": "2019-06-15", "level": "", "num_look": 172931, "num_comment": 4, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "攻击者利用SSH弱口令爆破成功后会植入SSH后门以及IRCbot后门程序，并通过SSH弱口令在内网横向传播，受害机器接收远程指令安装（包括但不限于）挖矿、DDoS攻击模块。"}
{"title": "BUF大事件丨印象笔记扩展被曝严重漏洞；微软删除世界最大公开人脸识别数据库；蔡徐坤1亿转发量幕后推手被捕", "url": "https://www.freebuf.com/news/205965.html", "time": "2019-06-15", "level": "红色标题", "num_look": 104202, "num_comment": 2, "author": "willhuang", "tags": ["视频", "资讯"], "text": "印象笔记扩展被曝严重漏洞，可泄露数百万用户的敏感信息；微软删除世界最大公开人脸识别数据库；蔡徐坤1亿转发量幕后推手#星援app被查；「FreeBuf+ 小程序」内测上线，把安全装进口袋。"}
{"title": "从Charles破解历程了解Javassist使用", "url": "https://www.freebuf.com/sectool/205520.html", "time": "2019-06-15", "level": "现金奖励", "num_look": 140436, "num_comment": 3, "author": "cck", "tags": ["工具"], "text": "看文章看到javassist可以直接修改java字节码，之前没有尝试过，因为charles是用java写的跨平台抓包工具，之前我也用过，所以拿来进行测试！"}
{"title": "Scavenger：可在不同Paste站点爬取用户泄露凭证的实用工具", "url": "https://www.freebuf.com/sectool/204992.html", "time": "2019-06-14", "level": "", "num_look": 90431, "num_comment": 90431, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的这款功能强大的开源工具名叫Scavenger，在该工具的帮助下，广大安全研究人员可以在不同的Paste站点上使用爬虫（Bot）来搜索用户泄露的凭证信息。"}
{"title": "挖洞经验 | 利用Slack应用程序窃取Slack用户的下载文件", "url": "https://www.freebuf.com/vuls/205074.html", "time": "2019-06-14", "level": "", "num_look": 116640, "num_comment": 116640, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "Tenable安全团队研究员David Wells分享了Windows版本Slack终端应用程序的一个漏洞，通过对Slack下载功能的利用，可以操控Slack受害者的下载文件存储设置，间接隐秘窃取Slack受害者的下载文件。"}
{"title": "基于VIM漏洞CVE-2019-12735的VIM宏后门病毒详解", "url": "https://www.freebuf.com/vuls/205516.html", "time": "2019-06-14", "level": "红色标题", "num_look": 145842, "num_comment": 17, "author": "360安全忍者", "tags": ["漏洞"], "text": "作为一个vim多年使用者，前两天得知爆出个VIM的RCE漏洞搞的我有点害怕，因此特意对这个漏洞的利用进行了一些研究。"}
{"title": "国家网信办就《个人信息出境安全评估办法》公开征求意见", "url": "https://www.freebuf.com/news/205897.html", "time": "2019-06-14", "level": "", "num_look": 96861, "num_comment": 7, "author": "Freddy", "tags": ["资讯"], "text": "对违反规定向境外提供个人信息的行为，任何个人和组织有权向省级以上网信部门或者相关部门举报。"}
{"title": "等保测评主机安全之centos之密码长度", "url": "https://www.freebuf.com/articles/terminal/205077.html", "time": "2019-06-14", "level": "现金奖励", "num_look": 222491, "num_comment": 13, "author": "起于凡而非于凡", "tags": ["终端安全"], "text": "密码长度，作为等级保护主机测评项里中密码复杂度要求之一，是必须要查的。在《等级测评师初级教程》里，对于密码长度的设置指向了/etc/login.defs里的PASS_MIN_LEN字段。"}
{"title": "对不起，我累了：Have I Been Pwned 挂牌出售", "url": "https://www.freebuf.com/news/205888.html", "time": "2019-06-14", "level": "", "num_look": 106626, "num_comment": 2, "author": "奇安信代码卫士", "tags": ["资讯"], "text": "热门安全网站 Hava I Been Pwned (HIBP) 的创始人兼运营 Troy Hunt 正在挂牌出售该服务。"}
{"title": "IPv6对网络安全的影响性分析", "url": "https://www.freebuf.com/articles/network/204999.html", "time": "2019-06-14", "level": "", "num_look": 163331, "num_comment": 3, "author": "狴犴安全团队", "tags": ["网络安全"], "text": "本文整理并总结了IPv6可能存在的安全威胁，从IPv4安全威胁延续、IPv6相关附属协议和相关机制可能带来的安全威胁。"}
{"title": "Android静态分析之初级篇（二）", "url": "https://www.freebuf.com/news/205045.html", "time": "2019-06-14", "level": "金币+8", "num_look": 68883, "num_comment": 2, "author": "梦里不知哪儿是哪儿", "tags": [], "text": "接着《Android静态分析之初级篇 》来，这次来看看如何在反编译后的apk包中添加一个页面，类似植入广告~"}
{"title": "超范围收集个人信息等问题成为网民举报热点", "url": "https://www.freebuf.com/news/205895.html", "time": "2019-06-14", "level": "", "num_look": 67284, "num_comment": 3, "author": "FB客服", "tags": ["资讯"], "text": "近日，记者专访了App专项治理工作组负责人，了解App违法违规收集使用个人信息专项治理相关工作进展情况。"}
{"title": "BUF早餐铺 | 印象笔记扩展被曝严重漏洞，可泄露数百万用户的敏感信息；Telegram服务器遭DDoS攻击，服务中断；Have I Been Pwned正在寻找买家", "url": "https://www.freebuf.com/news/205800.html", "time": "2019-06-14", "level": "", "num_look": 72823, "num_comment": 2, "author": "Freddy", "tags": ["资讯"], "text": "印象笔记Web Clipper Chrome扩展中被曝存在一个严重缺陷，可导致潜在攻击者访问用户存储在第三方网络服务中的敏感信息。"}
{"title": "专家表示自动驾驶汽车可能成为新的监控手段", "url": "https://www.freebuf.com/news/205939.html", "time": "2019-06-13", "level": "", "num_look": 304253, "num_comment": 304253, "author": "Karunesh91", "tags": ["无线安全", "资讯"], "text": "随意跳上一辆车，说出想去的地方，然后静静等待到达目的地。在这个过程中，你可以办公，可以聊天，可以玩游戏，可以看电影——就是不用操控汽车。"}
{"title": "Project iKy：一款功能强大的图形化邮件信息收集与分析工具", "url": "https://www.freebuf.com/articles/database/204996.html", "time": "2019-06-13", "level": "", "num_look": 122144, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["数据安全"], "text": "今天给大家介绍的是一款名叫Project iKy的开源工具，广大研究人员可以利用该工具来从电子邮件中收集信息，该工具将会以数据图表的形式将分析结果反馈给用户。"}
{"title": "反洗钱不力，银行遭遇央行15亿天价罚单", "url": "https://www.freebuf.com/articles/database/205386.html", "time": "2019-06-13", "level": "红色标题", "num_look": 237635, "num_comment": 12, "author": "GEETEST极验", "tags": ["数据安全"], "text": "说到洗钱你会想到什么呢？是加密货币洗钱、各路电商博彩、亦或是传统的拍卖......"}
{"title": "挖洞经验 | Facebook CDN系统中的文件下载漏洞", "url": "https://www.freebuf.com/vuls/204965.html", "time": "2019-06-13", "level": "", "num_look": 125757, "num_comment": 3, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "Facebook平台中被选中下载的文件在被执行某种加密算法之后，会以一个加密字符串进行代替。我可以decode这种加密算法并对其生成的加密串进行修改，以指向任意我想下载的文件。"}
{"title": "Evernote扩展被曝严重漏洞，可泄露数百万用户的敏感信息", "url": "https://www.freebuf.com/news/205790.html", "time": "2019-06-13", "level": "红色标题", "num_look": 116331, "num_comment": 4, "author": "奇安信代码卫士", "tags": ["资讯"], "text": "Evernote Web Clipper Chrome 扩展中被曝存在一个严重缺陷，可导致潜在攻击者访问用户存储在第三方网络服务中的敏感信息。"}
{"title": "Android平台战场：2019年上半年安全事件总结分析", "url": "https://www.freebuf.com/articles/terminal/205274.html", "time": "2019-06-13", "level": "", "num_look": 161084, "num_comment": 2, "author": "奇安信威胁情报中心", "tags": ["终端安全"], "text": "Android作为目前世界上最大的移动应用平台，必然成为恶意代码获取其犯罪收益、窃取敏感信息的重灾区。"}
{"title": "WordPress插件Form Maker SQL注入漏洞分析", "url": "https://www.freebuf.com/vuls/205290.html", "time": "2019-06-13", "level": "现金奖励", "num_look": 146065, "num_comment": 1, "author": "Kriston", "tags": ["WEB安全", "漏洞"], "text": "最近WordPress的插件出现各种姿势漏洞（都是插件，不知何时能有核心漏洞出现），Easy WP SMTP、\tSocial Warfare、Form Maker等等，其中Form Maker1.13.3之前版本存在sql注入漏洞（CVE-2019-10866）。"}
{"title": "GandCrab后继有人？Sodinoki勒索软件接管战场", "url": "https://www.freebuf.com/articles/system/205237.html", "time": "2019-06-13", "level": "", "num_look": 102933, "num_comment": 2, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "近日，奇安信威胁情报中心红雨滴安全研究团队(RedDrip)监测到了针对中国用户 投递的且带有中文诱饵的压缩包样本，经分析后确认压缩包内为Sodinokibi勒索病毒。"}
{"title": "BUF早餐铺 | 美国海关证实黑客窃取赴美游客照片、车牌等信息；微软修复了五个SandboxEscaper零日漏洞中的四个；iOS 12.4成功越狱", "url": "https://www.freebuf.com/news/205741.html", "time": "2019-06-13", "level": "", "num_look": 60403, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "近日，美国海关和边境保护局证实，在一次数据泄露事件中，黑客窃取了赴美游客照片和车辆牌照等信息。CBP发言人在一封电子邮件称，这些照片被转移到一家分包商的网络上，后来遭“恶意网络攻击”而被窃取。"}
{"title": "硬核议题+Android应用安全白皮书首发，TenSec2019圆满收官", "url": "https://www.freebuf.com/fevents/205771.html", "time": "2019-06-12", "level": "", "num_look": 69562, "num_comment": 4, "author": "Freddy", "tags": ["活动"], "text": "高深而不失趣味的会场让笔者看到了很多有趣的灵魂和腾讯安全开放的态度，而两天四场的抽奖环节（奖品为iPhone X 256GB版本）更是让几位幸运儿满载而归。"}
{"title": "Machinae：一款信息收集自动化工具", "url": "https://www.freebuf.com/sectool/204779.html", "time": "2019-06-12", "level": "", "num_look": 181068, "num_comment": 181068, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Machinae这款开源工具可以帮助广大研究人员从各个开放网站/feed收集跟网络安全有关的数据，例如IP地址、域名、URL、电子邮件地址、文件哈希和SSL指纹等等。"}
{"title": "做安全有什么用，价值何在？", "url": "https://www.freebuf.com/articles/database/205727.html", "time": "2019-06-12", "level": "现金奖励", "num_look": 672419, "num_comment": 27, "author": "熊猫正正", "tags": ["企业安全", "数据安全"], "text": "这篇文章，我想谈谈，做安全有什么用，价值何在？怎么样才能让安全从业者体现自己的价值，如何才能体现安全从业者的价值？"}
{"title": "新华三集团诚招渗透测试工程师（欢迎应届生报名）", "url": "https://www.freebuf.com/jobs/205287.html", "time": "2019-06-12", "level": "", "num_look": 124241, "num_comment": 12, "author": "H3CSecurity", "tags": ["安全招聘"], "text": "新华三集团（简称新华三）是业界领先的数字化解决方案领导者，致力于成为帮助客户业务创新、数字化转型最可信赖的合作伙伴。"}
{"title": "开源僵尸网络平台LiteHttp源码分析", "url": "https://www.freebuf.com/articles/system/205146.html", "time": "2019-06-12", "level": "", "num_look": 120133, "num_comment": 3, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "前不久，一起针对巴基斯坦的APT攻击中，发现黑客所使用的攻击样本是通过开源僵尸网络病毒LiteHttp改造而来的。"}
{"title": "对称加密与攻击案例分析", "url": "https://www.freebuf.com/articles/web/205092.html", "time": "2019-06-12", "level": "现金奖励", "num_look": 403757, "num_comment": 8, "author": "有价值炮灰", "tags": ["WEB安全"], "text": "本文主要介绍常见的对称加密算法和它们的原理，然后分析一些实际存在的密码学攻击案例，包括流加密密钥重用漏洞、ECB块重排攻击以及CBC的Padding Oracle攻击等。"}
{"title": "SandboxEscaper披露漏洞POC研究报告", "url": "https://www.freebuf.com/vuls/204945.html", "time": "2019-06-12", "level": "", "num_look": 121220, "num_comment": 3, "author": "木星安全实验室", "tags": ["漏洞"], "text": "近日，安全研究人员SandboxEscaper在GitHub上发布了针对Windows 10的5个零日漏洞的演示利用代码。"}
{"title": "详解MBR篡改技术", "url": "https://www.freebuf.com/articles/terminal/204868.html", "time": "2019-06-12", "level": "现金奖励", "num_look": 160319, "num_comment": 7, "author": "追影人", "tags": ["终端安全"], "text": "如果我们破坏了MBR会发生什么？"}
{"title": "快讯丨乐队被黑，母带被盗，他们选择这样回应", "url": "https://www.freebuf.com/news/205765.html", "time": "2019-06-12", "level": "", "num_look": 96920, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "英国一摇滚乐队Radiohead收到了来自黑客的威胁，称盗窃了他们专辑的母带，他们却如此应对～"}
{"title": "BUF早餐铺 | 手机APP应用权限规范发布；中国遭受的网络攻击主要来自美国；微软删除世界最大公开人脸识别数据库；国泰航空曾遭遇两次入侵", "url": "https://www.freebuf.com/news/205684.html", "time": "2019-06-12", "level": "", "num_look": 115472, "num_comment": 115472, "author": "AngelaY", "tags": ["资讯"], "text": "游戏网站Emuparadise的数百万会员账号再遭泄露；黑客利用WordPress聊天插件漏洞注入文本、窃取日志。"}
{"title": "中央网信办等四部委联合开展互联网网站安全专项整治，将处罚并曝光违法违规网站", "url": "https://www.freebuf.com/news/205698.html", "time": "2019-06-11", "level": "", "num_look": 55518, "num_comment": 55518, "author": "FB客服", "tags": ["资讯"], "text": "中央网信办等四部联合开展全国范围的互联网网站安全专项整治工作，对未备案或备案信息不准确的网站进行清理，对攻击网站的违法犯罪行为进行严厉打击，对违法违规网站进行处罚和公开曝光。"}
{"title": "多领域前沿研究齐发，TenSec 2019首日一览", "url": "https://www.freebuf.com/fevents/205677.html", "time": "2019-06-11", "level": "红色标题", "num_look": 81061, "num_comment": 4, "author": "Freddy", "tags": ["活动"], "text": "本届TenSec汇集了海内外顶级安全专家以及独立信息安全研究者，围绕云计算、AI应用、IoT、虚拟化、大数据、OS等多个领域安全的最新研究成果展开探讨与交流。"}
{"title": "Python安全工具源码分析：wydomain", "url": "https://www.freebuf.com/sectool/205207.html", "time": "2019-06-11", "level": "金币+8", "num_look": 188910, "num_comment": 6, "author": "c01d", "tags": ["工具"], "text": "wydomain是猪猪侠开发的一款子域名信息搜集工具，因其枚举速度快，结果准确，成为不少白帽居家旅行的必备神器。"}
{"title": "江苏瑞声科技招聘信息安全人才", "url": "https://www.freebuf.com/jobs/205594.html", "time": "2019-06-11", "level": "", "num_look": 83174, "num_comment": 8, "author": "FB客服", "tags": ["安全招聘"], "text": "瑞声科技以仿真技术为基础，利用强大的研发团队与先进的制造技术，结合大数据管理，持续为移动终端、机器人、无人驾驶汽车等智能设备提供硬件、软件高度结合的技术解决方案。"}
{"title": "关于海莲花组织针对移动设备攻击的分析报告", "url": "https://www.freebuf.com/articles/network/204867.html", "time": "2019-06-11", "level": "", "num_look": 206004, "num_comment": 5, "author": "AVLTeam", "tags": ["安全报告", "网络安全"], "text": "\"海莲花\"被认为是来自中南半岛某国的APT攻击组织，一直针对中国的敏感目标进行攻击活动，是近几年来最活跃的APT攻击组织之一。"}
{"title": "DEX保护之指令抽取", "url": "https://www.freebuf.com/articles/terminal/205079.html", "time": "2019-06-11", "level": "现金奖励", "num_look": 112352, "num_comment": 112352, "author": "xiongchaochao", "tags": ["终端安全"], "text": "本文只是一种对类方法的一种隐藏，如果你对dex文件有一定了解的话还可以做到对类字段、静态字段隐藏、类方法的重复定义。"}
{"title": "BUF早餐铺丨只有5.5%的被发现漏洞曾遭到利用；SandboxEscaper又发布了一个微软0day危急漏洞；Google认为禁止华为使用Android会危及到美国国家安全；微软发布Office漏洞攻击预警", "url": "https://www.freebuf.com/news/205574.html", "time": "2019-06-11", "level": "", "num_look": 69538, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "只有5.5%的被发现漏洞曾遭到利用；Google认为禁止华为使用Android会危及到美国国家安全；微软发布Office漏洞攻击预警。"}
{"title": "深入分析LAZARUS APT针对MAC用户使用的恶意word文档", "url": "https://www.freebuf.com/articles/network/204993.html", "time": "2019-06-11", "level": "", "num_look": 93072, "num_comment": 93072, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "在这篇文章中，我们将主要对Lazarus在攻击macOS和Windows系统时所使用的攻击逻辑以及恶意Word文档进行分析。"}
{"title": "GitHacker：Git源码泄漏检测工具可恢复整个Git Repo", "url": "https://www.freebuf.com/sectool/203542.html", "time": "2019-06-10", "level": "", "num_look": 151730, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "GitHacker是一个多线程工具，用于检测站点是否存在git源码泄漏，并能够将网站源代码下载到本地。值得一提的是，这个工具会将整个git repo恢复到本地，而不是像[githack]那样，只是简单的恢复到最新版本。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列-Cecillia", "url": "https://www.freebuf.com/video/205336.html", "time": "2019-06-10", "level": "红色标题", "num_look": 93836, "num_comment": 4, "author": "Darry端", "tags": ["视频"], "text": "Cecillia，一名来自Bishop Fox公司的安全分析师。早期从事项目管理，因为在工作中经常接触到一些优秀白帽和安全团队，所以激起了她投身安全行业的兴趣。"}
{"title": "基于OSQuery安全资产信息监控实践", "url": "https://www.freebuf.com/sectool/204818.html", "time": "2019-06-10", "level": "现金奖励", "num_look": 314843, "num_comment": 5, "author": "糖果L5Q", "tags": ["企业安全", "工具"], "text": "在生产环境中有重要的安全设备和关键服务设备，这些设备都在关键的结位置，依赖影响了很多服务。一旦设备出现问题对生产环境的影响是显而易见的。所以平是对这些设备和监控是很重要。"}
{"title": "看我如何在目标设备上启用远程桌面服务", "url": "https://www.freebuf.com/articles/network/203862.html", "time": "2019-06-10", "level": "", "num_look": 143267, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "今天给大家介绍的是一款名叫PeekABoo的工具，该工具适用于内部渗透测试。"}
{"title": "红蓝对抗：浅谈Red Team服务对防护能力的提升", "url": "https://www.freebuf.com/articles/es/205024.html", "time": "2019-06-10", "level": "", "num_look": 198819, "num_comment": 4, "author": "安全狗safedog", "tags": ["企业安全"], "text": "最近很多文章都在强调Red Team服务攻击能力的重要性，由于我本人长年从事安全防护技术研究和设计工作，所以本文将从Red Team服务促进安全体系改进提升的角度进行探讨。"}
{"title": "2019年第一季度DDoS攻击报告", "url": "https://www.freebuf.com/articles/paper/205060.html", "time": "2019-06-10", "level": "", "num_look": 167706, "num_comment": 4, "author": "青松Qssec", "tags": ["安全报告"], "text": "在前三个季度，我们看到几个排名前十的国家出现了一些意想不到的新情况——这些国家并没有成为DDoS威胁的主要来源。"}
{"title": "DSMM数据安全能力成熟度模型总结与交流", "url": "https://www.freebuf.com/articles/es/204844.html", "time": "2019-06-10", "level": "现金奖励", "num_look": 351204, "num_comment": 6, "author": "LJ_Monica", "tags": ["企业安全"], "text": "DSMM是对数据全生命周期进行安全防护，提高数据安全保护能力，如果能很好地落地，那么对企业数据安全能力将是极大地提升。"}
{"title": "BUF早餐铺 | 全新的RCE漏洞影响了近一半电子邮件服务器；思科修复多款工业和企业软件中的高危漏洞；iOS 13与macOS 10.15不再支持SHA-1证书", "url": "https://www.freebuf.com/news/205438.html", "time": "2019-06-10", "level": "", "num_look": 85312, "num_comment": 2, "author": "Freddy", "tags": ["资讯"], "text": "一个关键的远程命令执行（RCE）安全漏洞影响了超过一半的互联网电子邮件服务器。"}
{"title": "Anevicon：一款基于UDP的负载生成器", "url": "https://www.freebuf.com/sectool/203908.html", "time": "2019-06-09", "level": "", "num_look": 107863, "num_comment": 107863, "author": "周大涛", "tags": ["工具"], "text": "Anevicon是一款向服务器发送大量UDP数据包，模拟黑客可能产生活动的工具。"}
{"title": "挖洞经验丨看我如何发现谷歌某生产系统中的LFI漏洞（$13,337）", "url": "https://www.freebuf.com/vuls/204648.html", "time": "2019-06-09", "level": "", "num_look": 159905, "num_comment": 4, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文分享的writeup是关于谷歌某生产系统的一个LFI漏洞，作者通过Redirect重定向组合构造方式发现了该漏洞，最终可以远程在目标服务器上实现本地系统命令运行，获取到系统敏感运行信息，最终获得了谷歌官方奖励的$13…"}
{"title": "国家网络安全能力成熟度模型（六）", "url": "https://www.freebuf.com/articles/paper/205023.html", "time": "2019-06-09", "level": "金币+8", "num_look": 112671, "num_comment": 3, "author": "宇宸de研究室", "tags": ["安全报告"], "text": "本部分介绍通讯冗余能力建设。是政策和战略维度最后一个章节，个人的研究也就到这里为止了。"}
{"title": "FINS协议格式及功能码简介", "url": "https://www.freebuf.com/articles/ics-articles/204513.html", "time": "2019-06-09", "level": "", "num_look": 212837, "num_comment": 212837, "author": "工控安全123", "tags": ["工控安全"], "text": "使用FINS指令可实现各种网络间的无缝通信，包括用于信息网络的Ethernet（以太网），用于控制网络的ControllerLink和SYSMAC LINK。"}
{"title": "BUF大事件丨谷歌多项服务全球大规模宕机；猎头泄露了数以百万计简历信息；Android发布6月安全补丁，修复22处安全漏洞", "url": "https://www.freebuf.com/news/205460.html", "time": "2019-06-09", "level": "红色标题", "num_look": 78594, "num_comment": 78594, "author": "willhuang", "tags": ["视频", "资讯"], "text": "谷歌多项服务全球大规模宕机：涵盖YouTube、Gmail等；猎头企业泄露了数以百万计的简历，客户私人数据；Android发布6月安全补丁：共修复22处安全漏洞；羊城通乘车码造恶意攻击 官方：已修复并报案。"}
{"title": "CoreHook：基于.NET Core运行时实现的Windows HOOK库", "url": "https://www.freebuf.com/sectool/203922.html", "time": "2019-06-08", "level": "", "num_look": 125243, "num_comment": 125243, "author": "周大涛", "tags": ["工具"], "text": "CoreHook是一个基于.NET Core运行时实现的Windows HOOK库。"}
{"title": "Apache Tika命令注入漏洞挖掘", "url": "https://www.freebuf.com/vuls/203907.html", "time": "2019-06-08", "level": "", "num_look": 153663, "num_comment": 1, "author": "周大涛", "tags": ["漏洞", "系统安全"], "text": "这篇文章将从一个Apache tika服务器的命令注入漏洞到完全利用的步骤。CVE是https://nvd.nist.gov/vuln/detail/CVE-2018-1335。"}
{"title": "安全从业者，该凭什么赢得你的尊严？", "url": "https://www.freebuf.com/articles/neopoints/205501.html", "time": "2019-06-08", "level": "金币+8", "num_look": 506309, "num_comment": 41, "author": "熊猫正正", "tags": ["观点"], "text": "很多人问我，到底是什么原因让我坚持做安全，一直坚守着自己的信念，其实在上一篇文章的最后，我已经埋下了伏笔，GandCrab的故事结束了，安全的故事其实才刚刚开始，趁端午节有空，我写了这篇文章……"}
{"title": "浅谈摄像头有关的安全问题", "url": "https://www.freebuf.com/articles/network/204989.html", "time": "2019-06-08", "level": "", "num_look": 182323, "num_comment": 182323, "author": "深信服千里目安全实验室", "tags": ["网络安全"], "text": "随着物联网进程加快，作为家庭安防设备的智能摄像头正走进千家万户。网上出现公开贩卖破解智能摄像头的教程和软件。同时，有不法分子利用一些智能摄像头存在的安全漏洞，窥视他人家庭隐私生活，录制后在网上公开贩…"}
{"title": "WachtdogsMiner挖矿蠕虫最新变种分析", "url": "https://www.freebuf.com/articles/terminal/204687.html", "time": "2019-06-08", "level": "现金奖励", "num_look": 141223, "num_comment": 2, "author": "Sampson", "tags": ["终端安全"], "text": "2019年5月27日清晨，捕获到一起挖矿木马行为，通过分析，定性为针对“门罗币”的WatchdogsMiner变种挖矿木马入侵事件。"}
{"title": "Osmedeus：用于侦察和漏洞扫描的全自动安全工具", "url": "https://www.freebuf.com/sectool/203904.html", "time": "2019-06-07", "level": "", "num_look": 197128, "num_comment": 5, "author": "周大涛", "tags": ["工具"], "text": "Osmedeus允许您自动运行一系列令人敬畏的工具，以针对目标进行侦察和漏洞扫描。"}
{"title": "如何在域环境中安装并测试 Empire PowerShell 渗透测试框架", "url": "https://www.freebuf.com/articles/system/203764.html", "time": "2019-06-07", "level": "", "num_look": 100463, "num_comment": 1, "author": "周大涛", "tags": ["系统安全"], "text": "以下文章将介绍一个名为Empire的流行框架，其中包含3000多颗星，以及如何在安装了AV的典型工作站上使用它。"}
{"title": "JSWorm勒索病毒变种通过垃圾邮件传播，该勒索病毒已可被解密", "url": "https://www.freebuf.com/articles/es/204475.html", "time": "2019-06-07", "level": "", "num_look": 97995, "num_comment": 1, "author": "腾讯安全", "tags": ["企业安全"], "text": "近日，腾讯安全御见威胁情报中心监测到，JSWORM勒索病毒JURASIK变种版本在国内有所传播。JSWORM勒索病毒首次出现于2019年1月，目前已知通过垃圾邮件传播。"}
{"title": "对于TPCMF框架的一次代码审计", "url": "https://www.freebuf.com/vuls/203990.html", "time": "2019-06-07", "level": "金币+8", "num_look": 144420, "num_comment": 5, "author": "chenchuan", "tags": ["WEB安全", "漏洞"], "text": "希望在可以为奋斗在网络安全路上的小伙伴们提供一些新奇小思路，其实挖洞并不难，也希望大家能把分享的精神发扬光大。"}
{"title": "送定制背包 |「FreeBuf+ 小程序」内测上线，把安全装进口袋", "url": "https://www.freebuf.com/news/topnews/202132.html", "time": "2019-06-06", "level": "红色标题", "num_look": 705469, "num_comment": 50, "author": "FB客服", "tags": ["头条", "活动"], "text": "我们想为广大用户提供更直观、便捷、有价值的干货，帮助热爱信息安全的小伙伴们更有效地利用碎片时间，「FreeBuf+小程序」应运而生。（文末送福利）"}
{"title": "SharpClipHistory：MWR Labs开源的一款Windows剪切板历史监控工具", "url": "https://www.freebuf.com/sectool/203905.html", "time": "2019-06-06", "level": "", "num_look": 100364, "num_comment": 100364, "author": "周大涛", "tags": ["工具"], "text": "用户有时会复制密码或用户名到剪贴板。所以收集剪贴板历史对攻击者有价值，以便执行诸如横向移动之类的后期开发活动。"}
{"title": "文本编辑器VimNeovim被曝任意代码执行漏洞", "url": "https://www.freebuf.com/vuls/205382.html", "time": "2019-06-06", "level": "金币+8", "num_look": 229125, "num_comment": 8, "author": "木子", "tags": ["漏洞"], "text": "6月4日，名为Arminius的安全研究员在twitter曝光现Vim/Neovim的本地代码执行漏洞，并且还被披露了PoC。作为Linux的上古神器级的文本编辑器使用量还是比较大的，建议用户立刻更新最新补丁。"}
{"title": "渗透测试信息收集心得分享", "url": "https://www.freebuf.com/articles/web/204883.html", "time": "2019-06-06", "level": "现金奖励", "num_look": 802188, "num_comment": 42, "author": "Hackhy", "tags": ["WEB安全"], "text": "对一个网站挖掘的深浅来说就得看你收集的如何，这说明信息收集在漏洞挖掘中是非常的重要的。"}
{"title": "如何在Windows和Linux服务器中检测混淆命令", "url": "https://www.freebuf.com/articles/system/203861.html", "time": "2019-06-06", "level": "", "num_look": 108632, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "在目前的无文件恶意软件或网络犯罪领域中，命令行混淆已经是很常见的了。"}
{"title": "白帽的六一打开方式｜FreeTalk 2019深圳站精彩回顾（附PPT下载）", "url": "https://www.freebuf.com/fevents/205362.html", "time": "2019-06-06", "level": "", "num_look": 435464, "num_comment": 2, "author": "漏洞盒子", "tags": ["活动"], "text": "今年的六一似乎和往年不太一样，FreeTalk来到了深圳，和白帽子们过了一个特别的六一节，快来看看现场有哪些彩蛋吧~"}
{"title": "【干货回顾】等级保护2.0研讨专场 | 企业安全俱乐部「深圳站」", "url": "https://www.freebuf.com/fevents/205388.html", "time": "2019-06-06", "level": "红色标题", "num_look": 189060, "num_comment": 2, "author": "FB独家", "tags": ["活动"], "text": "6月5日，「FreeBuf 企业安全俱乐部」系列沙龙活动「等级保护2.0研讨专场」在深圳盛大开幕。"}
{"title": "新型勒索病毒Attention感染医疗与半导体行业", "url": "https://www.freebuf.com/articles/system/204740.html", "time": "2019-06-06", "level": "", "num_look": 111080, "num_comment": 2, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近日，深信服安全团队检测到一种新的勒索病毒正在活跃，攻击者针对制造行业、医疗行业等目标，通过社会工程、RDP远程爆破等方式手动投放勒索病毒。"}
{"title": "一起僵尸网络进行大规模DDoS攻击的样本分析", "url": "https://www.freebuf.com/articles/terminal/204444.html", "time": "2019-06-06", "level": "现金奖励", "num_look": 130376, "num_comment": 5, "author": "Sampson", "tags": ["终端安全"], "text": "最近突然发现服务器出现流量异常，十分卡顿，通过top命令查看内存使用情况，发现一些可疑的进程。"}
{"title": "国家网络安全能力成熟度模型（五）", "url": "https://www.freebuf.com/articles/network/205020.html", "time": "2019-06-06", "level": "金币+8", "num_look": 190460, "num_comment": 3, "author": "宇宸de研究室", "tags": ["网络安全"], "text": "本部分介绍网络防御能力搭建。同样的，部分内容一般企业不会涉及，作为参考，学习一下。"}
{"title": "比特币交易追踪溯源技术介绍", "url": "https://www.freebuf.com/articles/blockchain-articles/203127.html", "time": "2019-06-06", "level": "", "num_look": 367713, "num_comment": 1, "author": "北京链安安全实验室", "tags": ["区块链安全"], "text": "大量交易所每天都在被黑客定向渗透，交易所被盗币后的比特币资金流向，暗网、洗钱等非法比特币交易的比特币去向追溯等类似问题亟待解决。"}
{"title": "BUF早餐铺 | 苹果限制儿童类别的广告和跟踪；Firefox 默认启用跟踪保护；黑客可劫持远程桌面会话，绕过Windows锁屏", "url": "https://www.freebuf.com/news/205363.html", "time": "2019-06-06", "level": "", "num_look": 99441, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "2019年6月Android补丁发布：共计修复22处安全漏洞；Google 解释周日宕机事故原因；公司信息遭泄露后，特斯拉禁止员工使用匿名聊天应用程序。"}
{"title": "CORS（跨域资源共享）错误配置漏洞的高级利用", "url": "https://www.freebuf.com/articles/web/204023.html", "time": "2019-06-05", "level": "", "num_look": 254494, "num_comment": 4, "author": "secist", "tags": ["WEB安全"], "text": "本文我将为大家介绍两种CORS错误配置漏洞利用的情况：第一种情况是基于XSS，第二种情况是基于高级的CORS利用技术。"}
{"title": "欧洲黑客组织通过已签名的垃圾邮件来实现多阶段恶意软件加载", "url": "https://www.freebuf.com/articles/system/204021.html", "time": "2019-06-05", "level": "", "num_look": 129123, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "在这些攻击活动中，攻击者使用了一种多阶段恶意软件加载器来传播GootKit银行木马，而这个新出现的恶意软件名叫JasperLoader。"}
{"title": "Hermit（隐士）活动续：继续针对朝鲜半岛进行的APT攻击活动", "url": "https://www.freebuf.com/articles/network/204556.html", "time": "2019-06-05", "level": "", "num_look": 124726, "num_comment": 1, "author": "腾讯电脑管家", "tags": ["网络安全"], "text": "近期，腾讯安全御见威胁情报中心再次监测到该组织的新活动。通过分析和溯源，我们发现该攻击活动主要针对区块链、数字货币、金融目标等，但是我们也发现了同样针对外交实体的一些攻击活动。"}
{"title": "那些陷入数据泄露门的公司，最后怎么样了？", "url": "https://www.freebuf.com/articles/paper/204239.html", "time": "2019-06-05", "level": "", "num_look": 166618, "num_comment": 4, "author": "安数君", "tags": ["安全报告"], "text": "下文通过研究过去三年中美国发生的上市公司、私企的数据泄露事件揭示了数据泄露的一些关键数字、损失程度和趋势。"}
{"title": "安全杂谈丨5G离我们还有多远？", "url": "https://www.freebuf.com/articles/network/202742.html", "time": "2019-06-05", "level": "", "num_look": 102187, "num_comment": 2, "author": "Karunesh91", "tags": ["网络安全"], "text": "5G自出现起，热度可谓是一波又一波，到底是何方神圣引起了如此巨大的关注？"}
{"title": "BUF早餐铺 | 苹果公司推出新隐私功能；伊朗国家黑客 APT34 的全新工具 Jason曝光；工信部公布101个网络安全技术应用试点示范项目", "url": "https://www.freebuf.com/news/205254.html", "time": "2019-06-05", "level": "", "num_look": 114270, "num_comment": 114270, "author": "shidongqi", "tags": ["资讯"], "text": "据工业和信息化部消息，为贯彻落实《网络安全法》，促进网络安全技术创新应用，组织开展了网络安全技术应用试点示范项目推荐工作。最终工信部确定了101个网络安全技术应用试点示范项目。"}
{"title": "ExtAnalysis：一款浏览器插件安全分析框架", "url": "https://www.freebuf.com/sectool/203900.html", "time": "2019-06-04", "level": "", "num_look": 112801, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "ExtAnalysis是一款功能强大的浏览器插件安全分析框架。"}
{"title": "这款疑似来自朝鲜的新型恶意软件为何要收集蓝牙数据？", "url": "https://www.freebuf.com/articles/database/205000.html", "time": "2019-06-04", "level": "", "num_look": 109627, "num_comment": 109627, "author": "Alpha_h4ck", "tags": ["数据安全"], "text": "外媒称一个由朝鲜政府资助的网络犯罪组织开发并部署了一种新型的恶意软件，而这种恶意软件可以直接从那些跟Windows操作系统连接了的蓝牙设备中收集用户数据。"}
{"title": "拒绝网络暴力！动手开发基于深度学习的网络欺凌检测模型", "url": "https://www.freebuf.com/articles/others-articles/204523.html", "time": "2019-06-04", "level": "现金奖励", "num_look": 284493, "num_comment": 25, "author": "mscb", "tags": ["其他"], "text": "网络暴力，或者说网络欺凌，在互联网上实在太普遍。如果你没有受到过网络暴力，那你很有可能不是一个有多年网络使用经验的人。"}
{"title": "陆金所招聘安全人才", "url": "https://www.freebuf.com/jobs/205155.html", "time": "2019-06-04", "level": "", "num_look": 150890, "num_comment": 4, "author": "FB客服", "tags": ["安全招聘"], "text": "陆金所致力于通过优质服务及不断的交易品种与交易组织模式创新，成为中国领先并具有重要国际影响力的金融资产交易服务平台。"}
{"title": "浅谈IPv6的入侵与防御", "url": "https://www.freebuf.com/articles/web/202901.html", "time": "2019-06-04", "level": "现金奖励", "num_look": 363859, "num_comment": 8, "author": "绿帽子技术分享", "tags": ["WEB安全"], "text": "最近的客户，从前年开始进行ipv4到ipv6的过渡，到目前为止，大部分设备处于双栈或者部分系统没有进行过渡更新。"}
{"title": "GDPR颁布一周年之际，移动应用权限现状调查", "url": "https://www.freebuf.com/articles/terminal/204771.html", "time": "2019-06-04", "level": "", "num_look": 90451, "num_comment": 2, "author": "Karunesh91", "tags": ["终端安全"], "text": "随着GDPR颁布一周年，Airship公布了其近一年的调查结果：在政策实施一年内针对全球范围内近7亿人的移动应用用户权限使用情况调查。"}
{"title": "反欺诈场景剖析丨虚假账号的产生和流转", "url": "https://www.freebuf.com/articles/network/204751.html", "time": "2019-06-04", "level": "", "num_look": 103280, "num_comment": 1, "author": "永安在线", "tags": ["网络安全"], "text": "此篇主要介绍反欺诈场景中虚假账号的产生和流转规模化的背后，以及如何对黑灰产做恶的关键节点的监控来实现对企业自身虚假账号风险的管控。"}
{"title": "BUF早餐铺丨Eric S认为SaaS的危险甚于私有软件；美国开始要求签证申请者提供社交媒体信息；在俄罗斯通过暗网黑市购买个人数据已变得非常容易", "url": "https://www.freebuf.com/news/205163.html", "time": "2019-06-04", "level": "", "num_look": 57860, "num_comment": 57860, "author": "Karunesh91", "tags": ["资讯"], "text": "Eric S认为SaaS的危险甚于私有软件；美国开始要求签证申请者提供社交媒体信息；在俄罗斯通过暗网黑市购买个人数据已变得非常容易。"}
{"title": "精品公开课 | IoT物联网设备漏洞挖掘思路与技巧", "url": "https://www.freebuf.com/open/205177.html", "time": "2019-06-03", "level": "", "num_look": 128273, "num_comment": 128273, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "一名优秀的网络安全工程师应当具备Web安全、内网安全等综合能力，而未来的网络安全局势，也需要每一名黑客对物联网安全有所了解。"}
{"title": "快讯 | 谷歌云服务宕机，无法使用YouTube等服务", "url": "https://www.freebuf.com/news/205100.html", "time": "2019-06-03", "level": "金币+8", "num_look": 106595, "num_comment": 4, "author": "直觉动物", "tags": ["资讯"], "text": "6月3日消息，据The Verge报道，美国当地时间周日，YouTube、Snapchat、Gmail、Nest、Discord以及其他大量网络服务陷入无法访问状态，根本原因似乎是谷歌云计算服务出现了问题。"}
{"title": "iCULeak ：一款从手机配置文件中提取用户账号凭证的强大工具", "url": "https://www.freebuf.com/sectool/203867.html", "time": "2019-06-03", "level": "", "num_look": 84079, "num_comment": 84079, "author": "Alpha_h4ck", "tags": ["工具"], "text": "该工具可以从思科CUCM管理环境中的手机配置文件内搜索并提取用户的凭证数据。"}
{"title": "阿里钉钉张作裕：由内而外，以数据安全赋能业务", "url": "https://www.freebuf.com/articles/people/204711.html", "time": "2019-06-03", "level": "红色标题", "num_look": 306288, "num_comment": 5, "author": "Freddy", "tags": ["人物志"], "text": "安全上保证数据的使用规范，保证数据的归属权，控制好数据的使用权，是一条难走又必须走的路，安全人的工作已经和数年前的防御者不同，已经走向前台，走进业务。"}
{"title": "看我如何利用Drupal漏洞并通过恶意图片实现一键RCE", "url": "https://www.freebuf.com/articles/web/203573.html", "time": "2019-06-03", "level": "", "num_look": 157057, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "Drupal发布了两个针对7.x和8.x版本的关键漏洞修复补丁，攻击者可以利用这两个漏洞来实现远程代码执行。"}
{"title": "基于EVE-NG平台上构建企业内网攻防环境", "url": "https://www.freebuf.com/sectool/204652.html", "time": "2019-06-03", "level": "现金奖励", "num_look": 275683, "num_comment": 5, "author": "jiansiting", "tags": ["工具"], "text": "理论上，只要能将虚拟机的虚拟磁盘格式转换为qcow2都可以在EVE-NG上运行。所以，EVE-NG可以算打造成最佳的网络安全攻防虚拟环境。"}
{"title": "某中国开发社交App被指泄漏美国用户信息", "url": "https://www.freebuf.com/news/205175.html", "time": "2019-06-03", "level": "", "num_look": 103898, "num_comment": 103898, "author": "Karunesh91", "tags": ["资讯"], "text": "近日，安全研究人员发现了与某“社交”App关联的数据库存在安全问题，使其中数据暴露无遗。"}
{"title": "警惕利用Office漏洞传播商业间谍软件AgentTesla", "url": "https://www.freebuf.com/articles/system/204550.html", "time": "2019-06-03", "level": "", "num_look": 132087, "num_comment": 132087, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "AgentTesla现已成为一个商业化的间谍软件，可通过控制端生成满足功能需求的木马程序。"}
{"title": "Nmap配合Masscan实现高效率扫描资产", "url": "https://www.freebuf.com/sectool/204578.html", "time": "2019-06-03", "level": "金币+8", "num_look": 338414, "num_comment": 18, "author": "轩辕踏月留香", "tags": ["工具"], "text": "之前看过不少大佬的文章，提到nmap扫描准确，并且显示信息详细，但是速度太慢；masscan扫描快但是不会显示端口服务的相关信息，二者结合起来使用会有很不错的效果。于是想着自己以后有空也弄一版尝试一下。"}
{"title": "BUF早餐铺丨iOS应用在你睡觉时出卖了你的数据；MacBook Pro起火视频在网络流传，可能电池故障引发；连锁酒店85GB的安全日志暴露于公网", "url": "https://www.freebuf.com/news/205027.html", "time": "2019-06-03", "level": "", "num_look": 117309, "num_comment": 117309, "author": "Karunesh91", "tags": ["资讯"], "text": "6月到了，准备好迎接如火的夏日了吗～～"}
{"title": "Trigmap：一款专用于渗透测试的Nmap封装工具", "url": "https://www.freebuf.com/sectool/204022.html", "time": "2019-06-02", "level": "", "num_look": 136795, "num_comment": 136795, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Trigmap是一款针对Nmap的封装工具，它可以帮助研究人员简化Nmap扫描操作，并通过将扫描到的数据有组织地存储到目录结构中来帮助研究人员对数据进行归类和分析。"}
{"title": "看我如何使用Windows域绕过防火墙获取持卡人数据的访问权限", "url": "https://www.freebuf.com/articles/database/203552.html", "time": "2019-06-02", "level": "", "num_look": 126526, "num_comment": 126526, "author": "Alpha_h4ck", "tags": ["数据安全"], "text": "在这篇文章中，我们将介绍如何绕过防火墙系统，并获取到持卡人数据环境(CDE)的访问权。最终目标：提取目标用户的信用卡数据。"}
{"title": "关于海莲花组织针对移动设备攻击的分析报告", "url": "https://www.freebuf.com/articles/terminal/204573.html", "time": "2019-06-02", "level": "", "num_look": 137370, "num_comment": 4, "author": "antiylab", "tags": ["安全报告", "终端安全"], "text": "\"海莲花\"被认为是来自中南半岛某国的APT攻击组织，自2012年以来，一直针对中国的敏感目标进行攻击活动，是近几年来针对中国大陆进行攻击活动的最活跃的APT攻击组织之一。"}
{"title": "面向新手的CTF实战教学（一）", "url": "https://www.freebuf.com/articles/network/203992.html", "time": "2019-06-02", "level": "金币+8", "num_look": 228273, "num_comment": 7, "author": "张召忠", "tags": ["网络安全"], "text": "参加CTF是提高网络安全技术水平的一种有效途径，其解题模式中主要提供了逆向、漏洞挖掘与利用、Web渗透等题目，这不失为一种锻炼自己思路的好方法。"}
{"title": "PacBot：一款功能强大的云平台自动化安全监控工具", "url": "https://www.freebuf.com/sectool/203860.html", "time": "2019-06-01", "level": "", "num_look": 113628, "num_comment": 113628, "author": "Alpha_h4ck", "tags": ["工具"], "text": "PacBot，全名为“Policy as Code Bot”，它是一款针对云环境的持续性安全监控平台。"}
{"title": "Metasploit Payload在Linux平台的免杀", "url": "https://www.freebuf.com/articles/system/203451.html", "time": "2019-06-01", "level": "", "num_look": 135228, "num_comment": 135228, "author": "secist", "tags": ["系统安全"], "text": "本文的目的并不是为了推广某个产品，而是希望通过实例测试将其作为红队练习的一部分进行学习，并了解什么会被标记或是通过（Metasploit/Meterpreter/Mettle）。"}
{"title": "网络安全大潮来临，如何解决安全人才短缺问题？", "url": "https://www.freebuf.com/news/204636.html", "time": "2019-06-01", "level": "红色标题", "num_look": 193557, "num_comment": 15, "author": "Karunesh91", "tags": ["观点", "资讯"], "text": "任何一个行业的人才缺口过大，都不是一个好的现象。现在来说，网络安全行业就是这么个情况。"}
{"title": "MS08-067漏洞原理及详尽分析过程", "url": "https://www.freebuf.com/vuls/203881.html", "time": "2019-06-01", "level": "金币+8", "num_look": 355585, "num_comment": 5, "author": "Dhakkan", "tags": ["漏洞", "系统安全"], "text": "在《Metasploit渗透测试魔鬼训练营》中讲过MS08-067的漏洞原理，不过内容十分晦涩难懂难以消化，我反复阅读钻研了几遍并通过实践分析，对该部分的内容用通俗易懂的语言重新组织一遍。"}
{"title": "BUF大事件丨易到用车遭遇黑客攻击；Office 365出现网络钓鱼；FreeBuf《2019企业安全威胁统一应对指南》PDF完整版发布", "url": "https://www.freebuf.com/news/205068.html", "time": "2019-06-01", "level": "红色标题", "num_look": 76888, "num_comment": 1, "author": "willhuang", "tags": ["视频", "资讯"], "text": "易到回应黑客攻击：完全恢复需要时间；Office 365出现网络钓鱼，用户需多加注意；2345网址导航回应“浏览器主页劫持”；FreeBuf《2019企业安全威胁统一应对指南》PDF完整版发布。"}
{"title": "FinalRecon：一款多功能网络侦查OSINT工具", "url": "https://www.freebuf.com/sectool/203863.html", "time": "2019-05-31", "level": "", "num_look": 119523, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫FinalRecon的开源情报收集工具，这是一款多合一的多功能网络侦查工具。"}
{"title": "跟我一起学习玩转二维码", "url": "https://www.freebuf.com/geek/204516.html", "time": "2019-05-31", "level": "金币+8", "num_look": 527236, "num_comment": 15, "author": "LEdge1", "tags": ["极客"], "text": "有些时候二维码被严重破坏导致无法扫描，促使我去学习了一波关于二维码的知识。"}
{"title": "利用SMB共享来绕过php远程文件包含的限制", "url": "https://www.freebuf.com/articles/web/203577.html", "time": "2019-05-31", "level": "金币+8", "num_look": 155781, "num_comment": 6, "author": "secist", "tags": ["WEB安全"], "text": "在这篇博文中，我将为大家演示如何利用PHP应用中的远程文件包含漏洞的技术。"}
{"title": "【FreeBuf字幕组】Web安全漏洞系列：跨站请求伪造", "url": "https://www.freebuf.com/video/204952.html", "time": "2019-05-31", "level": "红色标题", "num_look": 96902, "num_comment": 2, "author": "Darry端", "tags": ["视频"], "text": "跨站请求伪造（CSRF）是一种常见的Web攻击方式，但很多开发人员对它却很陌生，甚至有些安全工程师都对它的利用条件和危害知悉较少。"}
{"title": "MOSEC 2019 完美收官：茅台镇场，BaiJiuCon再成经典", "url": "https://www.freebuf.com/fevents/205025.html", "time": "2019-05-31", "level": "", "num_look": 95336, "num_comment": 1, "author": "shidongqi", "tags": ["活动"], "text": "经历一晚上的休整，MOSEC 2019迎来最后一天的议程。昨天结束时，我提前得到消息，在今天最后环节的BaiJiuCon上，有一位韩国小姐姐会作为首位演讲嘉宾喝茅台演讲。是不是有点小期待～"}
{"title": "应急响应处置流程Windows篇", "url": "https://www.freebuf.com/articles/network/203494.html", "time": "2019-05-31", "level": "现金奖励", "num_look": 488159, "num_comment": 7, "author": "PinkWolf", "tags": ["网络安全"], "text": "先把应急响应流程步骤（乙方视角）和windows拆出来，在进行应急响应事件处置时需严格遵守公司的应急响应制度。"}
{"title": "【议题前瞻】深圳网安对等保2.0标准合规之路分享 | 企业安全俱乐部", "url": "https://www.freebuf.com/fevents/204827.html", "time": "2019-05-31", "level": "", "num_look": 55341, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "6月5日企业安全俱乐部深圳站，来自深圳网安的测评部总监洪跃腾将为大家分享《等保2.0标准合规之路》。"}
{"title": "奇安信华南基地（珠海）急招热招岗位等你来", "url": "https://www.freebuf.com/jobs/204781.html", "time": "2019-05-31", "level": "", "num_look": 104509, "num_comment": 7, "author": "奇安信-华南基地", "tags": ["安全招聘"], "text": "奇安信华南基地坐落在美丽的海滨城市珠海，粤港澳大湾区核心，环境优美，交通便利，欢迎各位大神的加盟。"}
{"title": "警惕Bizarro Sundown（GreenFlash）漏洞利用工具包传播Seon勒索病毒", "url": "https://www.freebuf.com/articles/system/204159.html", "time": "2019-05-31", "level": "", "num_look": 78365, "num_comment": 78365, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近日，国外安全研究人员捕获到一款名为Seon的勒索病毒，并且发现攻击者通过Bizarro Sundown(GreenFlash)漏洞利用工具包进行传播。"}
{"title": "Android静态分析之初级篇", "url": "https://www.freebuf.com/articles/terminal/204504.html", "time": "2019-05-31", "level": "", "num_look": 109393, "num_comment": 1, "author": "梦里不知哪儿是哪儿", "tags": ["终端安全"], "text": "最近瞅着测APP的空档，翻了翻之前买的一本讲Android安全的书，书快要翻完了，但是里面还有实际操作的部分，书里面提到的工具跟目前用到的有一些出入。"}
{"title": "YouTube出现“比特币生成器”，实则是木马传播程序", "url": "https://www.freebuf.com/news/205010.html", "time": "2019-05-31", "level": "", "num_look": 102659, "num_comment": 102659, "author": "Karunesh91", "tags": ["数据安全", "网络安全"], "text": "近日油管上出现大量关于“比特币生成器”的广告宣传视频，号称该工具可为用户免费生成比特币，实际上却是一个散布Qulab信息窃取和剪贴板劫持木马的恶意行为。"}
{"title": "BUF早餐铺 | 未修复的漏洞将影响所有Docker版本；YouTube上出现大量与加密货币有关的视频，实为加速木马传播", "url": "https://www.freebuf.com/news/204931.html", "time": "2019-05-31", "level": "", "num_look": 65422, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "所有版本的Docker目前都容易受到“竞态条件”的攻击，这种攻击手段可使攻击者对主机系统上的任何文件都具有读写访问权限，概念验证代码已经发布。"}
{"title": "MOSEC 2019首日精彩回顾：移动安全技术护航", "url": "https://www.freebuf.com/fevents/204967.html", "time": "2019-05-30", "level": "", "num_look": 81204, "num_comment": 1, "author": "shidongqi", "tags": ["活动"], "text": "2015年到2019年，MOSEC走到了第五个年头，盘古团队作为主办方之一，大家对它的期待也从越狱工具逐渐传递到MOSEC上。FreeBuf见证了每一届MOSEC的盛况，这一次，我们又在现场了。"}
{"title": "AutoSource：整合SonarQube的自动化源代码审计框架", "url": "https://www.freebuf.com/sectool/203303.html", "time": "2019-05-30", "level": "", "num_look": 117513, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的这款开源工具名叫AutoSource，它是一款整合了SonarQube的自动化源代码审计框架。"}
{"title": "代码审计入门之BlueCMS v1.6 sp1", "url": "https://www.freebuf.com/articles/web/203795.html", "time": "2019-05-30", "level": "现金奖励", "num_look": 267443, "num_comment": 14, "author": "ZKAQ聂风", "tags": ["WEB安全"], "text": "BlueCMS v1.6 sp1一直以来就是PHP代码审计入门的最佳良品。这次我们就选择这一个案例进行学习。"}
{"title": "【议题前瞻】人工加智能，助力新等保 | 企业安全俱乐部", "url": "https://www.freebuf.com/fevents/204918.html", "time": "2019-05-30", "level": "红色标题", "num_look": 46686, "num_comment": 1, "author": "FB客服", "tags": ["活动"], "text": "6月5日，在「FreeBuf 企业安全俱乐部」系列沙龙活动「等级保护2.0研讨专场」上，来自斗象科技高级安全研究专家张志鹏将为大家分享《人工加智能，助力新等保》。"}
{"title": "基于MicroPython的自动网络时间校准器", "url": "https://www.freebuf.com/geek/204211.html", "time": "2019-05-30", "level": "现金奖励", "num_look": 137711, "num_comment": 5, "author": "linsensen", "tags": ["极客"], "text": "最近，接触到了DS3231时钟模块，结合OLED显示屏，做了一个简单的时钟。"}
{"title": "国家网络安全能力成熟度模型（四）", "url": "https://www.freebuf.com/articles/paper/204453.html", "time": "2019-05-30", "level": "金币+8", "num_look": 88510, "num_comment": 3, "author": "宇宸de研究室", "tags": ["安全报告"], "text": "本部分主要是介绍国家危机管理工作。这部分内容一般企业是不会涉及的，只有超大型公司或跨国公司，关键政府机构才会用到，所以可以作为参考，学习一下。"}
{"title": "隐私浏览器DuckDuckGo爆出漏洞，可导致URL欺骗攻击", "url": "https://www.freebuf.com/news/204833.html", "time": "2019-05-30", "level": "", "num_look": 110637, "num_comment": 5, "author": "Karunesh91", "tags": ["数据安全", "资讯"], "text": "Android 5.26.0系统中，开源的DuckDuckGo浏览器被发现存在漏洞可导致攻击，攻击者可通过该漏洞利用URL欺骗的方式发动攻击。"}
{"title": "超过50000台MS-SQL和PHPMyAdmin服务器遭到黑客攻击，代号Nansh0u", "url": "https://www.freebuf.com/news/204904.html", "time": "2019-05-30", "level": "", "num_look": 97780, "num_comment": 1, "author": "Karunesh91", "tags": ["网络安全", "资讯"], "text": "Guardicore Labs团队称发现大量MS-SQL和PHPMyAdmin服务器遭到中国黑客的攻击并用于挖掘乌龟币（TurtleCoin），总数超过50000台，代号“Nansh0u”。"}
{"title": "BUF早餐铺 | Office 365出现网络钓鱼；GDPR实施一周年，开出5600万欧元罚单；Flipboard公告称内部系统遭黑客攻击", "url": "https://www.freebuf.com/news/204862.html", "time": "2019-05-30", "level": "", "num_look": 67591, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "谷歌、苹果、微软、Twitter、WhatsApp、Instagram、Uber、领英等多家企业都因数据或隐私保护问题而遭遇投诉、调查或处罚。"}
{"title": "使用Elasticsearch与TheHive构建开源安全应急响应平台", "url": "https://www.freebuf.com/articles/es/203538.html", "time": "2019-05-30", "level": "", "num_look": 263289, "num_comment": 3, "author": "Avenger", "tags": ["企业安全"], "text": "通过开源软件可以构建一个安全应急响应平台，该平台可以进行日志整合、告警生成、IoC 丰富与事件管理。"}
{"title": "GDPR实施一周年：下个周年，会是什么样？", "url": "https://www.freebuf.com/articles/neopoints/204850.html", "time": "2019-05-29", "level": "红色标题", "num_look": 183572, "num_comment": 3, "author": "AngelaY", "tags": ["企业安全", "观点"], "text": "2019年5月25日，GDPR实施一周年，数据保护相关的案例与公开事件数量攀升。同时，全球多个国家或地区也以GDPR为参考，制定或补充了不同的数据保护细则。"}
{"title": "Superl-url：一款开源关键词URL采集工具", "url": "https://www.freebuf.com/sectool/203724.html", "time": "2019-05-29", "level": "金币+8", "num_look": 200631, "num_comment": 5, "author": "superl", "tags": ["工具"], "text": "superl-url是一款开源的，并且功能强大的关键词URL采集工具，可以根据关键词，对搜索引擎内容检索结果的网址内容进行采集。"}
{"title": "快讯丨Office 365出现网络钓鱼，用户需多加注意", "url": "https://www.freebuf.com/news/204813.html", "time": "2019-05-29", "level": "", "num_look": 60889, "num_comment": 3, "author": "Karunesh91", "tags": ["资讯"], "text": "近日，一种新形式的钓鱼活动出现在网络中，攻击者会将钓鱼内容伪装成Office 365点警告邮件，并告知用户他们的账户中出现异常数量的文件删除。"}
{"title": "专访DigiCert首席营收官Rob Hoblit：万物互联时代正在走来", "url": "https://www.freebuf.com/articles/people/204706.html", "time": "2019-05-29", "level": "红色标题", "num_look": 124515, "num_comment": 3, "author": "Freddy", "tags": ["人物志"], "text": "\"与物联网领域的客户谈合作时，最大的挑战是物联网设备带来的体量，一方面是优势，能为为我们带来很多收入，\" Rob如是说。"}
{"title": "等保2.0时代，云等保安全合规要求解读", "url": "https://www.freebuf.com/articles/network/204085.html", "time": "2019-05-29", "level": "", "num_look": 183996, "num_comment": 1, "author": "青藤云安全", "tags": ["网络安全"], "text": "伴随着《网络安全法》出台，等级保护制度上升到法律层面。在此背景下孕育出来等保2.0相比之前的等保要求，在等级保护的对象、保护的内容、保护的体系都大不相同。"}
{"title": "准备交赎金？当心Phobos勒索病毒二次加密！", "url": "https://www.freebuf.com/articles/system/204323.html", "time": "2019-05-29", "level": "", "num_look": 185102, "num_comment": 3, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近日，深信服安全团队接到多家企业反馈，服务器遭到勒索病毒攻击，重要数据被加密。经安全团队专家排查，该病毒近期较为活跃，通常通过RDP暴力破解+人工投放的方式进行攻击。"}
{"title": "国外黑客组织利用RIGEK传播新型勒索病毒GETCRYPT（附解密工具）", "url": "https://www.freebuf.com/articles/terminal/204312.html", "time": "2019-05-29", "level": "现金奖励", "num_look": 122056, "num_comment": 1, "author": "熊猫正正", "tags": ["终端安全"], "text": "国外安全研究员在5月21日在网上爆光了一款利用RIGEK漏洞利用工具包传播的新型勒索病毒。"}
{"title": "BUF早餐铺 | 2345网址导航回应浏览器主页劫持；21家网络视频平台上线青少年防沉迷系统；爱尔兰数据保护机构发起19项调查，11项都是Facebook", "url": "https://www.freebuf.com/news/204718.html", "time": "2019-05-29", "level": "", "num_look": 61896, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "“浏览器主页被2345劫持怎么解决？”“如何解决浏览器被2345主页劫持的问题？”……在网民吐槽中，2345网址导航被频频点名。"}
{"title": "使用ee-outliers和Elasticsearch检测可疑子进程", "url": "https://www.freebuf.com/sectool/203247.html", "time": "2019-05-29", "level": "", "num_look": 85294, "num_comment": 85294, "author": "Avenger", "tags": ["工具"], "text": "通过 ee-outliers 检测可疑子进程也是检测端点恶意活动一种非常有效的方法。"}
{"title": "重磅 | FreeBuf《2019企业安全威胁统一应对指南》PDF完整版发布", "url": "https://www.freebuf.com/news/topnews/200972.html", "time": "2019-05-28", "level": "红色标题", "num_look": 1479097, "num_comment": 40, "author": "FreeBuf咨询", "tags": ["企业安全", "头条"], "text": "企业安全需要基于信息安全大环境，结合企业所处行业、IT投入、业务需求等实际情况，参考可靠的安全架构体系，自上而下地建立能在企业内部落地的安全策略与安全流程。"}
{"title": "挖洞经验 | 从XSS漏洞到四步CSRF利用实现账户劫持", "url": "https://www.freebuf.com/vuls/203257.html", "time": "2019-05-28", "level": "", "num_look": 204627, "num_comment": 3, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "作者由一个XSS漏洞入手，发现了上传功能中存在的四步CSRF漏洞隐患，最终经过构造实现了目标应用的管理员账户劫持。"}
{"title": "从设备看风险，医疗已成为网络安全的关键领域", "url": "https://www.freebuf.com/news/204283.html", "time": "2019-05-28", "level": "", "num_look": 349044, "num_comment": 349044, "author": "Karunesh91", "tags": ["无线安全", "资讯"], "text": "随着互联网技术的发展，IT、物联网和OT等技术融入到了传统行业中，尤其医疗行业数字化极大的提高了日常的工作、看病效率。"}
{"title": "2019年4月网络安全状况分析报告", "url": "https://www.freebuf.com/vuls/204138.html", "time": "2019-05-28", "level": "", "num_look": 191089, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["漏洞", "网络安全"], "text": "2019年4月，互联网网络安全状况整体指标平稳，但各类安全事件依然时有发生。"}
{"title": "权威调查：100款常用App申请收集使用个人信息权限情况", "url": "https://www.freebuf.com/news/204575.html", "time": "2019-05-28", "level": "", "num_look": 160965, "num_comment": 2, "author": "Allen别bb", "tags": ["资讯"], "text": "近期网信办公布《百款常用App申请收集使用个人信息权限情况》报告，涉及微信、支付宝等大量常用APP的权限索要情况。"}
{"title": "BUF早餐铺丨Windows 10最新增量更新或导致沙箱功能失效；网信办通报百款常用App申请收集个人信息权限情况", "url": "https://www.freebuf.com/news/204651.html", "time": "2019-05-28", "level": "", "num_look": 62250, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "Windows 10最新增量更新或导致沙箱功能失效；网信办通报百款常用App申请收集个人信息权限情况。"}
{"title": "议题前瞻 | 2019 FreeTalk深圳站干货提前看！", "url": "https://www.freebuf.com/fevents/204657.html", "time": "2019-05-27", "level": "", "num_look": 60567, "num_comment": 60567, "author": "漏洞盒子", "tags": ["活动"], "text": "隐私合规测试、SDL建设、SRC漏洞挖掘、应用安全风险...2019 FreeTalk深圳站要你好看~"}
{"title": "MalConfScan：从已知的恶意软件家族中提取配置信息", "url": "https://www.freebuf.com/sectool/203732.html", "time": "2019-05-27", "level": "", "num_look": 88739, "num_comment": 88739, "author": "secist", "tags": ["工具"], "text": "MalConfScan是一个Volatility插件，可从已知的恶意软件家族中提取配置信息。"}
{"title": "在没有源代码的情况下对Linux二进制代码进行模糊测试", "url": "https://www.freebuf.com/articles/system/203302.html", "time": "2019-05-27", "level": "", "num_look": 125524, "num_comment": 125524, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "AFL配合DynamoRIO，没错，就是drAFL。在drAFL的帮助下，我们就可以在没有源代码的情况下对LInux二进制代码进行模糊测试了。"}
{"title": "某HR业务网站逻辑漏洞挖掘案例以及POC编写思路分享", "url": "https://www.freebuf.com/articles/web/201438.html", "time": "2019-05-27", "level": "现金奖励", "num_look": 533239, "num_comment": 47, "author": "艾登——皮尔斯", "tags": ["WEB安全"], "text": "各位Buffer你们好，我们许久不见胜似想念，今天鄙人我给大家带来的“干货”是逻辑漏洞挖掘的案例和使用Python3编写漏洞POC。"}
{"title": "【报名中】等级保护2.0研讨大会（深圳站） | 企业安全俱乐部", "url": "https://www.freebuf.com/fevents/202934.html", "time": "2019-05-27", "level": "", "num_look": 118881, "num_comment": 4, "author": "FB独家", "tags": ["活动"], "text": "6月5日，「FreeBuf 企业安全俱乐部」系列沙龙活动「等级保护2.0研讨专场」将在深圳盛大开幕。"}
{"title": "揭开病毒的面纱：恶意代码自解密技术", "url": "https://www.freebuf.com/news/204069.html", "time": "2019-05-27", "level": "", "num_look": 96097, "num_comment": 4, "author": "深信服千里目安全实验室", "tags": [], "text": "攻击者采用自定义的加密方法后，在样本运行时实现自解密并执行真正的恶意操作，所以看到的只是样本还没解密的样子，分析不出恶意代码的逻辑，本文揭秘之。"}
{"title": "安全趣闻 | 身中21世纪六大病毒，这台旧电脑拍卖价高达830万元", "url": "https://www.freebuf.com/news/204536.html", "time": "2019-05-27", "level": "红色标题", "num_look": 110019, "num_comment": 5, "author": "Allen别bb", "tags": ["资讯"], "text": "最近一台身中WannaCry、MyDoom等六种病毒的旧电脑，拍卖价已经接近830万元。要知道，Apple I 最近一台在佳士得拍卖行最终成交价也不过47.1万美元（约人民币325万元）。"}
{"title": "IBM报告称全球活跃黑客攻击数量下降，安全团队需关注更紧迫的威胁", "url": "https://www.freebuf.com/news/204169.html", "time": "2019-05-27", "level": "", "num_look": 70447, "num_comment": 70447, "author": "AdlerI", "tags": ["资讯"], "text": "IBM近日发布一份针对活跃黑客攻击的报告，报告显示，自2015年以来，造成可量化损害的黑客行为攻击数量下降了95％。"}
{"title": "左右互搏术的自我修养", "url": "https://www.freebuf.com/articles/web/204303.html", "time": "2019-05-27", "level": "现金奖励", "num_look": 132779, "num_comment": 3, "author": "罹♛殇", "tags": ["WEB安全"], "text": "本文没有太多的技术含量，主要是描述了一个安全从业人员在面对困惑的时候肉体上的菜鸡和思想上的菜鸡的交流。"}
{"title": "BUF早餐铺丨易到用车服务器遭连续攻击：攻击者索要巨额比特币；安全人员发现macOS Gatekeeper认证漏洞，可获取系统shell", "url": "https://www.freebuf.com/news/204546.html", "time": "2019-05-27", "level": "", "num_look": 88969, "num_comment": 88969, "author": "AngelaY", "tags": ["资讯"], "text": "易到用车服务器遭连续攻击：攻击者索要巨额比特币；安全人员发现macOS Gatekeeper认证漏洞，可获取系统shell。"}
{"title": "易到用车遭遇勒索攻击，周鸿祎隔空声援", "url": "https://www.freebuf.com/news/204528.html", "time": "2019-05-26", "level": "红色标题", "num_look": 103435, "num_comment": 4, "author": "Allen别bb", "tags": ["资讯"], "text": "5月26日中午，易到用车微博发布消息称，服务器连续遭到攻击，导致核心数据被加密、服务器宕机，攻击者还要求支付巨额比特币，截止笔者发稿之时易到官网、手机APP仍然处于故障中。"}
{"title": "Reverie：一款针对Parrot Linux的自动化渗透测试工具", "url": "https://www.freebuf.com/sectool/203539.html", "time": "2019-05-26", "level": "", "num_look": 127005, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的这款工具名叫reverie，它是一款专门针对Parrot Linux的自动化渗透测试工具。"}
{"title": "二维码扫码登录“克星”QRLJacker攻击向量分析及演示", "url": "https://www.freebuf.com/vuls/202192.html", "time": "2019-05-26", "level": "", "num_look": 141089, "num_comment": 141089, "author": "Alpha_h4ck", "tags": ["WEB安全", "漏洞"], "text": "QRLJacker，是一种简单但功能强大的攻击向量，本身是为了提升用户账号安全性来设计的，但攻击者可以通过劫持用户会话来破坏这种安全功能。"}
{"title": "某工控4G路由器存在大量弱口令", "url": "https://www.freebuf.com/articles/ics-articles/203802.html", "time": "2019-05-26", "level": "现金奖励", "num_look": 301091, "num_comment": 16, "author": "Kriston", "tags": ["工控安全"], "text": "近日研究发现，在国产某某工控4G路由器中存在大量弱口令，对于用户在进行设备安装维护时没用对初始密码进行修改，导致大量暴露在公网上的设备全部处于危险状态。"}
{"title": "关于Metasploit 5中测试模块的移植与验证", "url": "https://www.freebuf.com/articles/system/203541.html", "time": "2019-05-26", "level": "金币+8", "num_look": 102194, "num_comment": 2, "author": "Neroqi", "tags": ["系统安全"], "text": "本文探讨如何将现有的渗透模块移植成为与Metasploit框架相兼容的模块，移植成功之后，不仅能够实现原有模块的功能，还可以利用Metasploit框架提供的各种丰富而又强大的工具来处理例行任务。"}
{"title": "从一道CTF题零基础学V8漏洞利用", "url": "https://www.freebuf.com/vuls/203721.html", "time": "2019-05-26", "level": "现金奖励", "num_look": 266711, "num_comment": 11, "author": "walkerfuz", "tags": ["漏洞"], "text": "第一次接触浏览器的漏洞利用，听了ne0大佬的精彩授课，受益匪浅。这篇文章主要是从入门角度，一步步复现今年starctf2019中的浏览器漏洞题目—oob。"}
{"title": "Flightsim：看我如何生成并分析恶意网络流量", "url": "https://www.freebuf.com/sectool/203534.html", "time": "2019-05-25", "level": "", "num_look": 90529, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍一款名叫Flightsim的实用工具，该工具可以帮大家生成恶意网络流量，并以此来评估自身的网络安全控制策略。"}
{"title": "通过ee-outliers与Elasticsearch检测TLS beaconing", "url": "https://www.freebuf.com/sectool/202735.html", "time": "2019-05-25", "level": "", "num_look": 68423, "num_comment": 68423, "author": "Avenger", "tags": ["工具"], "text": "这篇文章中将展示如何使用 ee-outliers 检测存储在 Elasticsearch 中的安全事件中的 TLS beaconing 连接。"}
{"title": "小众CMS vaeThink v1.0.1 代码执行漏洞挖掘分析", "url": "https://www.freebuf.com/vuls/203562.html", "time": "2019-05-25", "level": "金币+8", "num_look": 131429, "num_comment": 5, "author": "yunsle", "tags": ["漏洞"], "text": "本文是对一个小众CMS（vaeThink v1.0.1）进行分析、代码执行漏洞挖掘和审计过程的记录，该CMS基于ThinkPHP5开发。"}
{"title": "BUF大事件丨Win10 0day漏洞被黑客恶意公开；新指纹识别技术漏洞可跟踪Android和iOS设备；近5000万Instagram用户信息泄露", "url": "https://www.freebuf.com/news/204480.html", "time": "2019-05-25", "level": "红色标题", "num_look": 111445, "num_comment": 1, "author": "willhuang", "tags": ["视频", "资讯"], "text": "“中国无人机威胁论”，大疆回应称数据完全由用户掌握；Win10 0day漏洞被黑客恶意公开； 新指纹识别技术漏洞曝光：可跟踪Android和iOS设备；近5000万Instagram用户信息遭泄露"}
{"title": "【议题前瞻】等保2.0下企业信息安全防护体系建设 | 企业安全俱乐部", "url": "https://www.freebuf.com/fevents/204380.html", "time": "2019-05-24", "level": "", "num_look": 58683, "num_comment": 58683, "author": "FB独家", "tags": ["活动"], "text": "6月5日，来自上海市信息安全测评认证中心高级等级测评师何勇亮在「企业安全俱乐部深圳站」将为大家分享《等保2.0下企业信息安全防护体系建设》。"}
{"title": "SilkETW：一款针对Windows事件追踪的自定义C#封装工具", "url": "https://www.freebuf.com/sectool/203531.html", "time": "2019-05-24", "level": "", "num_look": 91532, "num_comment": 91532, "author": "Alpha_h4ck", "tags": ["工具"], "text": "SilkETW是一款针对ETW（Event Tracing for Windows）的自定义C#封装工具，该工具可以通过抽象化的方式简化ETW的复杂性。"}
{"title": "重庆网安部门侦破系列涉外网络黑客案，涉案金额高达2千余万元", "url": "https://www.freebuf.com/news/204427.html", "time": "2019-05-24", "level": "红色标题", "num_look": 629889, "num_comment": 19, "author": "shidongqi", "tags": ["资讯"], "text": "2018年3月，荣昌警方接上级公安机关线索：荣昌籍黑客许某涉嫌在国外通过网络入侵我国境内网站服务器，以获取服务器权限并出售获利。"}
{"title": "挖洞经验 | 获取Facebook Marketplace卖家精确地理位置信息", "url": "https://www.freebuf.com/vuls/202820.html", "time": "2019-05-24", "level": "", "num_look": 140927, "num_comment": 6, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文分享的writeup是与Facebook Marketplace销售系统相关的用户信息泄露漏洞，通过该漏洞可以获取到发布商品卖家的精确到经纬度和邮编等具体地理位置信息。"}
{"title": "整理网络安全措施的5个小技巧", "url": "https://www.freebuf.com/news/203807.html", "time": "2019-05-24", "level": "", "num_look": 174814, "num_comment": 1, "author": "Karunesh91", "tags": ["系统安全", "资讯"], "text": "网络需要定期清洁，就像人们的住所、汽车一样。为什么？答案很简单，安全条件差便会留下安全隐患。如果不定期检查使用的网络，那么其潜在的弱点和漏洞都可能会增加。"}
{"title": "国家互联网信息办公室关于《网络安全审查办法（征求意见稿）》公开征求意见的通知", "url": "https://www.freebuf.com/news/204426.html", "time": "2019-05-24", "level": "", "num_look": 53923, "num_comment": 2, "author": "Freddy", "tags": ["资讯"], "text": "为提高关键信息基础设施安全可控水平，维护国家安全，《网络安全审查办法（征求意见稿）》现向社会公开征求意见。"}
{"title": "原来Java反序列化远程执行漏洞这么简单", "url": "https://www.freebuf.com/articles/database/203727.html", "time": "2019-05-24", "level": "金币+8", "num_look": 153322, "num_comment": 8, "author": "yafeile", "tags": ["数据安全"], "text": "在这里我们对Java中反序列化问题引发的远程代码执行漏洞的原理进行介绍。为了简化说明,在不引入第3方库的前提下进行操作，希望能起到抛砖引玉的效果。"}
{"title": "国家网络安全能力成熟度模型（三）", "url": "https://www.freebuf.com/articles/paper/203944.html", "time": "2019-05-24", "level": "金币+8", "num_look": 100121, "num_comment": 3, "author": "宇宸de研究室", "tags": ["安全报告"], "text": "本部分主要是介绍针对关键基础设施的保护工作如何开展。其中也介绍了国外的CI是如何分类和定义的，以及一些现行的实践案例。"}
{"title": "针对国内IP发起攻击的DDoS样本分析", "url": "https://www.freebuf.com/articles/network/203796.html", "time": "2019-05-24", "level": "", "num_look": 146428, "num_comment": 9, "author": "光通天下", "tags": ["网络安全"], "text": "近期捕获到名为stianke_trojan.bak的恶意样本，经过样本初步分析确认该病毒类型Linux.Trojan.Generic.DDos。"}
{"title": "BUF早餐铺 | GitHub ID为SandboxEscaper的用户再次上传2个零日漏洞；新型纹识别技术存在漏洞，可导致Android和iOS设备被跟踪；欧盟监管机构对谷歌发起数据隐私相关调查", "url": "https://www.freebuf.com/news/204346.html", "time": "2019-05-24", "level": "", "num_look": 61886, "num_comment": 61886, "author": "Freddy", "tags": ["资讯"], "text": "加上这次上传的两个零日漏洞，过去十个月里该名用户已经累计上传7个了，还有多少存货？"}
{"title": "骚扰电话何时休，中国电信因管控不力被工信部约谈", "url": "https://www.freebuf.com/news/204393.html", "time": "2019-05-23", "level": "红色标题", "num_look": 98453, "num_comment": 6, "author": "Allen别bb", "tags": ["资讯"], "text": "我希望有一天，24小时都没接到一个陌生电话的时候，不是因为手机欠费……"}
{"title": "NovaLoader：一款针对巴西银行的恶意软件家族", "url": "https://www.freebuf.com/articles/web/203540.html", "time": "2019-05-23", "level": "", "num_look": 77751, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "近期检测到了一个非常有趣的针对巴西银行的恶意软件活动，名叫NovaLoader，采用Delphi开发，并且使用了VBS脚本语言来扩展其他功能。"}
{"title": "Windows 10出现新0day，任务计划进程可用于攻击", "url": "https://www.freebuf.com/news/204354.html", "time": "2019-05-23", "level": "", "num_look": 127247, "num_comment": 3, "author": "Karunesh91", "tags": ["系统安全", "资讯"], "text": "Windows系统出现新漏洞，外部攻击者可获取本地权限以及允许访客用户取得SYSTEM和TrustInstaller等全权限用户的文件。"}
{"title": "打造一款伪基站防御利器（一）", "url": "https://www.freebuf.com/articles/wireless/202232.html", "time": "2019-05-23", "level": "红色标题", "num_look": 449840, "num_comment": 9, "author": "超雪团队2019", "tags": ["无线安全"], "text": "目前国内伪基站相比于前几年来说已经少了很多，但还是有少量流动的，比较难办。 基于这种现状，2017年开始跟某地运营商开始研发有防御伪基站功能的设备。"}
{"title": "关于DNS隧道技术的滥用调查", "url": "https://www.freebuf.com/articles/web/202548.html", "time": "2019-05-23", "level": "", "num_look": 175136, "num_comment": 2, "author": "周大涛", "tags": ["WEB安全"], "text": "在本报告中，我们将介绍基于DNS的数据过滤和渗透的类型，方法，并提供了一些防御机制。"}
{"title": "CVE-2018-4990漏洞调试分析记录", "url": "https://www.freebuf.com/articles/system/201205.html", "time": "2019-05-23", "level": "金币+8", "num_look": 106905, "num_comment": 3, "author": "kn1f4", "tags": ["系统安全"], "text": "Adobe 官方安全公告说这是一个 Double Free 漏洞, 内存相关的问题, 我们打开页堆后运行 Reader, 用 Windbg 附加, 打开 POC 后崩溃。"}
{"title": "EOS REX 安全系列之从源码开始玩转 REX（二）", "url": "https://www.freebuf.com/articles/blockchain-articles/203387.html", "time": "2019-05-23", "level": "", "num_look": 171280, "num_comment": 2, "author": "SlowMist慢雾科技", "tags": ["区块链安全"], "text": "上一篇文章粗略分析了整个买卖 rex 的流程，由于篇幅的原因，剩下有一些细节没有分析到位。所以，这篇文章将在上一篇文章的基础上对一些细节进行深入的分析。"}
{"title": "BUF早餐铺 | 福布斯全球2000强企业HCL泄露大量员工和商业信息；数千万条Instagram名人信息泄露；Win10计划任务程序0-day漏洞攻击代码发布", "url": "https://www.freebuf.com/news/204313.html", "time": "2019-05-23", "level": "", "num_look": 55243, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "Instagram位于AWS存储桶上的一个大型数据库保护不当，可被任意没有访问权限的人访问。该数据库包含4900多万条Instagram账户的联系信息。"}
{"title": "4900万条Instagram数据曝光，影响人数达数百万", "url": "https://www.freebuf.com/news/204360.html", "time": "2019-05-22", "level": "", "num_look": 85267, "num_comment": 85267, "author": "Karunesh91", "tags": ["数据安全", "资讯"], "text": "近日，一个包含大量Instagram用户数据的数据库被发现，影响人数达到数百万，其中包括众多用户以及品牌商信息。"}
{"title": "一张图带你读懂FreeBuf安全厂商版会员体系", "url": "https://www.freebuf.com/fevents/204288.html", "time": "2019-05-22", "level": "", "num_look": 65225, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "FreeBuf 安全厂商版会员体系正式上线，点击查看完整会员权益。"}
{"title": "CyberScan：用于数据包取证的渗透工具", "url": "https://www.freebuf.com/sectool/203306.html", "time": "2019-05-22", "level": "", "num_look": 115305, "num_comment": 115305, "author": "secist", "tags": ["工具"], "text": "CyberScan是一个开源的数据包取证渗透工具，可用于数据包的分析，解码，扫描端口，pinging以及获取IP的地理定位包括（纬度，经度，地区，国家等）。"}
{"title": "福布斯全球2000强企业HCL大量员工和商业信息公开暴露", "url": "https://www.freebuf.com/news/204276.html", "time": "2019-05-22", "level": "", "num_look": 54945, "num_comment": 54945, "author": "AdlerI", "tags": ["资讯"], "text": "位列福布斯全球2000强的IT服务和咨询公司Hindustan计算机有限公司（HCL）在多个子域上托管了可公开访问的页面和Web界面，导致大量员工和商业信息公开暴露。"}
{"title": "rsGen：一款基于Windows BAT和JS混编实现的通用反弹shell命令生成器", "url": "https://www.freebuf.com/sectool/203304.html", "time": "2019-05-22", "level": "金币+8", "num_look": 109689, "num_comment": 109689, "author": "Flyfish", "tags": ["工具"], "text": "rsGen是一款基于Widows BAT&JS混编实现的多功能反弹shell命令生成器。不仅支持生成原生反弹shell命令，还支持生成“命令中转”形式的一句话反弹shell命令。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列-Corben Leo", "url": "https://www.freebuf.com/video/204253.html", "time": "2019-05-22", "level": "红色标题", "num_look": 67334, "num_comment": 2, "author": "Darry端", "tags": ["视频"], "text": "Corben Leo，19岁，南达科塔州州立大学计算机系在读，信息安全咨询分析师，专注于Web安全，熟悉Go、C、Python、Bash、PHP、JS等前端编程语言。"}
{"title": "戴尔电脑自带系统软件SupportAssist存在RCE漏洞", "url": "https://www.freebuf.com/vuls/202768.html", "time": "2019-05-22", "level": "", "num_look": 156246, "num_comment": 3, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "当我们谈论远程代码执行漏洞（RCE）时，可能大多数人会认为它和操作系统漏洞相关，但是有没有人考虑到预装到电脑系统中的第三方软件这一攻击可能呢？"}
{"title": "CatFish CMS V4.8.75最新版XSS漏洞审计", "url": "https://www.freebuf.com/vuls/203232.html", "time": "2019-05-22", "level": "金币+8", "num_look": 155796, "num_comment": 8, "author": "丶SoulMate", "tags": ["WEB安全", "漏洞"], "text": "前台做的还是不错的，可能程序员也觉得后台的洞太鸡肋就没加固，后台功能点很多，基本上都没做防护，可以类似这样慢慢测试。"}
{"title": "披荆斩棘：论百万级服务器反入侵场景的混沌工程实践", "url": "https://www.freebuf.com/articles/database/203605.html", "time": "2019-05-22", "level": "", "num_look": 172531, "num_comment": 6, "author": "腾讯安全平台部", "tags": ["数据安全"], "text": "在繁杂的业务和网络环境下，在公司百万级服务器面前，要做到入侵发生时的及时检测，那么反入侵系统的有效性，即系统质量，是至关重要的。"}
{"title": "一文看懂Python沙箱逃逸", "url": "https://www.freebuf.com/articles/system/203208.html", "time": "2019-05-22", "level": "现金奖励", "num_look": 252938, "num_comment": 3, "author": "Macr0phag3", "tags": ["系统安全"], "text": "沙箱经常会禁用一些敏感的函数，例如 os，研究怎么逃逸、防护这类沙箱还是蛮有意思的。"}
{"title": "2.5折门票限时优惠中！2019看雪安全开发者峰会，这个暑假清凉来袭！", "url": "https://www.freebuf.com/fevents/204287.html", "time": "2019-05-22", "level": "", "num_look": 27410, "num_comment": 27410, "author": "FB客服", "tags": ["活动"], "text": ""}
{"title": "BUF早餐铺 | 大疆回应美国土安全部数据质疑，安全性经全球验证；John the Ripper 支持 FPGA 破解密码；尼泊尔禁止境内用微信支付和支付宝", "url": "https://www.freebuf.com/news/204215.html", "time": "2019-05-22", "level": "", "num_look": 67260, "num_comment": 67260, "author": "shidongqi", "tags": ["资讯"], "text": "谷歌与加利福尼亚大学圣地亚哥分校的研究人员上周公布的研究显示， 大多数网上提供的黑客雇用服务都是诈骗或者无效的。"}
{"title": "美国再生“中国无人机威胁论”，大疆回应称数据完全由用户掌握", "url": "https://www.freebuf.com/news/204163.html", "time": "2019-05-21", "level": "红色标题", "num_look": 76596, "num_comment": 76596, "author": "Allen别bb", "tags": ["资讯"], "text": "恰逢贸易战升级，华为被美国政府列入所谓的“实体清单”，大疆无人机威胁论再起，下一个又会是谁？"}
{"title": "ffuf：Go语言编写的高速Web Fuzzer", "url": "https://www.freebuf.com/sectool/203316.html", "time": "2019-05-21", "level": "", "num_look": 147228, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "ffuf是一款Go语言编写的高速Web Fuzzer工具，该项目深受大型项目gobuster和wfuzz的启发。"}
{"title": "实战介绍Windows下的PC客户端常见漏洞挖掘", "url": "https://www.freebuf.com/vuls/203227.html", "time": "2019-05-21", "level": "金币+8", "num_look": 227613, "num_comment": 10, "author": "LapterGrsd", "tags": ["漏洞"], "text": "对于PC客户端漏洞发掘，因为涉及到了一些计算机和操作系统底层的知识，很多人都不敢去碰，而实际上PC客户端的漏洞比大家想象中要容易的多。"}
{"title": "挖洞经验 | 从Twitter的XSS漏洞构造出Twitter XSS Worm", "url": "https://www.freebuf.com/vuls/203052.html", "time": "2019-05-21", "level": "", "num_look": 138733, "num_comment": 4, "author": "clouds", "tags": ["漏洞"], "text": "该漏洞位于Twitter的犄角旮旯之处，一般人很难发现。重点在于这个存储型XSS漏洞可以被进一步构造形成一个稳定的XSS worm！"}
{"title": "完美世界信息安全部招新", "url": "https://www.freebuf.com/jobs/203942.html", "time": "2019-05-21", "level": "", "num_look": 99666, "num_comment": 1, "author": "pwrd", "tags": ["安全招聘"], "text": "完美世界控股集团是全球领先的文化娱乐产业集团。长期以来，完美世界控股集团旗下产品遍布美、欧、亚等全球100多个国家和地区。"}
{"title": "如何利用开源风控系统（星云）防止撞库？", "url": "https://www.freebuf.com/news/203389.html", "time": "2019-05-21", "level": "", "num_look": 136054, "num_comment": 4, "author": "永安在线", "tags": ["工具", "资讯"], "text": "“撞库”是非常常见的一种黑产攻击事件。在常见的安全防护中，安全团队通常会在登陆接口设置安全策略来应对攻击。可是，一旦黑产更换攻击规则，就会导致策略失效。"}
{"title": "超过一百个漏洞将三万门禁数据暴露给黑客", "url": "https://www.freebuf.com/articles/wireless/203551.html", "time": "2019-05-21", "level": "", "num_look": 356152, "num_comment": 2, "author": "安数君", "tags": ["无线安全"], "text": "研究人员在四家楼宇管理与访问控制系统供应商的产品中发现了100多个漏洞。攻击者可以利用这些漏洞完全控制被入侵的产品，并操纵与其关联的系统。"}
{"title": "2019年第一季度电子邮件安全趋势简报", "url": "https://www.freebuf.com/articles/paper/203464.html", "time": "2019-05-21", "level": "", "num_look": 124194, "num_comment": 124194, "author": "softnext守内安", "tags": ["安全报告"], "text": "2019 年第一季度，邮件服务器攻击活动统计显示，占比最高的是“以不存在的域名任意尝试发送邮件”。"}
{"title": "BUF早餐铺丨Linux内核曝出RDS漏洞，影响Red Hat，Ubuntu，Debiand与SuSE；微软确认Windows 10安装最近更新后实施部分操作会出现系统崩溃", "url": "https://www.freebuf.com/news/204130.html", "time": "2019-05-21", "level": "", "num_look": 73195, "num_comment": 73195, "author": "Karunesh91", "tags": ["资讯"], "text": "Linux内核曝出RDS漏洞，影响Red Hat，Ubuntu，Debiand与SuSE；微软确认Windows 10安装最近更新后实施部分操作会出现系统崩溃。"}
{"title": "WebLogic CVE-2019-2647~2650 XXE漏洞分析", "url": "https://www.freebuf.com/vuls/202790.html", "time": "2019-05-20", "level": "", "num_look": 141119, "num_comment": 141119, "author": "Knownsec知道创宇", "tags": ["漏洞"], "text": "本文中的分析我尽量描述自己思考以及PoC构造过程，新手真的会踩很多莫名其妙的坑。"}
{"title": "智能摄像头安全分析及案例参考", "url": "https://www.freebuf.com/articles/terminal/203311.html", "time": "2019-05-20", "level": "现金奖励", "num_look": 590060, "num_comment": 6, "author": "Tide重剑无锋", "tags": ["终端安全"], "text": "本文通过对智能摄像头的网络结构和设备特性进行分析，总结了智能摄像头常见的几类攻击方式，并结合实际案例进行全面的安全分析。"}
{"title": "网络安全等级保护在移动安全中的应用 | 企业安全俱乐部议题前瞻", "url": "https://www.freebuf.com/fevents/203801.html", "time": "2019-05-20", "level": "", "num_look": 71186, "num_comment": 71186, "author": "FB独家", "tags": ["活动"], "text": "6月5日，企业安全俱乐部深圳站「等级保护2.0研讨专场」上，来自北京智游网安科技有限公司「爱加密」安全服务总监韩云将为大家分享《网络安全等级保护在移动安全中的应用》。"}
{"title": "WDScanner：一款分布式Web漏洞扫描平台", "url": "https://www.freebuf.com/sectool/203772.html", "time": "2019-05-20", "level": "金币+8", "num_look": 280729, "num_comment": 15, "author": "Tide重剑无锋", "tags": ["工具"], "text": "为了能在漏洞爆发后快速形成漏洞检测能力，同时能对网站或主机进行全面快速的安全检测，开发了一套简单易用的分布式 web 漏洞检测系统 WDScanner。"}
{"title": "弃Windows转Linux，韩国政府能成么？", "url": "https://www.freebuf.com/news/204054.html", "time": "2019-05-20", "level": "红色标题", "num_look": 93312, "num_comment": 5, "author": "shidongqi", "tags": ["资讯"], "text": "还有半年多的时间，Windows 7 就会终止支持（2020年1月14日），微软建议所有的个人、企业或者政府机构升级到Win 10。而韩国政府出于长期成本及安全性考虑，计划在Windows 7终止支持之前迁移到Linux系统上。"}
{"title": "品牌假冒侵权数据报告", "url": "https://www.freebuf.com/articles/paper/203358.html", "time": "2019-05-20", "level": "", "num_look": 99606, "num_comment": 1, "author": "腾讯安全", "tags": ["安全报告"], "text": "随着品牌网络市场规模的增长，各行业品牌的头号公敌——仿冒侵权衍生出了更多新形态。为更好地帮助品牌企业防范品牌侵权、造假等恶意行为，《品牌假冒侵权数据报告》正式发布。"}
{"title": "轻松筹韩晋：解构SDL落地的关键点", "url": "https://www.freebuf.com/articles/people/202562.html", "time": "2019-05-20", "level": "红色标题", "num_look": 587556, "num_comment": 9, "author": "Freddy", "tags": ["人物志"], "text": "本期安全大咖专访笔者连线韩晋，来解构一下他是如何以业务为导向，安全为基石，有重点、有选择、有顺序地推动SDL再轻松筹的落地。"}
{"title": "国家网络安全能力成熟度模型（二）", "url": "https://www.freebuf.com/articles/paper/203409.html", "time": "2019-05-20", "level": "金币+8", "num_look": 134454, "num_comment": 1, "author": "宇宸de研究室", "tags": ["安全报告"], "text": "第一部分主要是将国家安全战略，1.1是概述，报告原文并为进行展开，只是列了一些步骤。重点是1.2，描述国家级应急响应工作如何来做，怎样落地。"}
{"title": "挖洞经验 | 看我如何让你和你的Twitter粉丝无法刷新朋友圈", "url": "https://www.freebuf.com/vuls/200127.html", "time": "2019-05-20", "level": "", "num_look": 109044, "num_comment": 2, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "大家好，今天分享的这个writeup是关于Twitter的一个Dos漏洞，利用该漏洞，只需发送一条推特朋友圈，就可以触发Twitter后端服务器解析错误，导致你和你的粉丝账户无法刷新推特朋友圈。"}
{"title": "BUF早餐铺 | Stack Overflow遭遇黑客攻击；FBI指控网络犯罪头目试图从全球44000台电脑中窃取1亿美元；2016年TeamViewer曾被黑客组织入侵事件曝光", "url": "https://www.freebuf.com/news/204017.html", "time": "2019-05-20", "level": "", "num_look": 70512, "num_comment": 70512, "author": "shidongqi", "tags": ["资讯"], "text": "来自 IBM X-Force 的新数据，也佐证了黑客攻击现象的彻底崩溃。在一份新报告中，IBM 指出：自 2015 年以来，由黑客组织活动引发的安全事件一直在下降。"}
{"title": "一款针对Profinet协议漏洞渗透的工具", "url": "https://www.freebuf.com/sectool/203104.html", "time": "2019-05-19", "level": "金币+8", "num_look": 95886, "num_comment": 2, "author": "zoucl123", "tags": ["工具"], "text": "PROFINET由IP国际组织推出，是新一代基于工业以太网技术自动化总线标准，PROFINET-DCP是发现和基本配置协议，用于标识与查询有无指定IP地址节点，然后配置IP地址、默认网关、子网掩码。"}
{"title": "完美替身？让我们一起看一看骗子绕过反欺诈保护的最新方法", "url": "https://www.freebuf.com/articles/network/203146.html", "time": "2019-05-19", "level": "", "num_look": 98869, "num_comment": 98869, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "根据Juniper研究人员的最新研究报告，网络犯罪分子已经开发出了大量绕过反欺诈安全保护机制的攻击工具。"}
{"title": "警惕x3m勒索病毒：CryptON", "url": "https://www.freebuf.com/articles/system/203496.html", "time": "2019-05-19", "level": "", "num_look": 113114, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "CryptON勒索病毒最早出现在2017年2月份左右，曾有多家企业遭到攻击，最近出现了变种，又有大量企业中招。"}
{"title": "RFI绕过URL包含限制Getshell", "url": "https://www.freebuf.com/articles/web/203442.html", "time": "2019-05-19", "level": "现金奖励", "num_look": 152907, "num_comment": 23, "author": "cck", "tags": ["WEB安全"], "text": "我在浏览Twitter时，发现关于远程文件包含RFI的一个奇淫技巧！值得记录一下，思路也很新奇！因为它打破我之前以为RFI已死的观点:)"}
{"title": "BUF大事件丨优衣库遭到黑客攻击，超过46万用户数据泄漏；CVE-2019-0708，又一个“WannaCry”级漏洞？", "url": "https://www.freebuf.com/news/203923.html", "time": "2019-05-19", "level": "红色标题", "num_look": 123697, "num_comment": 2, "author": "willhuang", "tags": ["视频", "资讯"], "text": "Windows再曝“WannaCry”级漏洞 CVE-2019-0708 ；英特尔新漏洞影响2011年以来几乎所有产品； 优衣库遭到黑客攻击，超过46万用户数据泄漏。想要了解详情，来看本周的BUF大事件吧！"}
{"title": "绕过杀软！SQL Server Transact-SQL 的无文件攻击姿势", "url": "https://www.freebuf.com/articles/system/202871.html", "time": "2019-05-19", "level": "", "num_look": 98394, "num_comment": 3, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近日，深信服安全团队捕获到一起绕过杀毒软件的无文件攻击事件，被入侵的主机或服务器会被安装Mykings、Mirai、暗云等多种僵尸网络木马及挖矿程序，并且难以彻底清除。"}
{"title": "GodOfWar：可嵌入恶意Payload的JavaWAR构建工具", "url": "https://www.freebuf.com/sectool/202228.html", "time": "2019-05-18", "level": "", "num_look": 64554, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫GodOfWar的开源Java WAR构建工具，在该工具的帮助下，研究人员可以轻松向Java WAR包中嵌入恶意Payload。"}
{"title": "为IDA命令行模式增加宏支持功能的插件", "url": "https://www.freebuf.com/sectool/202485.html", "time": "2019-05-18", "level": "", "num_look": 76528, "num_comment": 76528, "author": "周大涛", "tags": ["工具"], "text": "CLI宏是一种生产力工具，可让您在IDA的命令行界面（Python，IDC，WinDbg，BochDbg，Gdb等）中定义和使用静态或动态宏。"}
{"title": "DVWA 1.10 High等级的CSRF另类通关法", "url": "https://www.freebuf.com/articles/web/203301.html", "time": "2019-05-18", "level": "现金奖励", "num_look": 133166, "num_comment": 8, "author": "F1tz", "tags": ["WEB安全"], "text": "网上有很多关于CSRF High等级的通关记录，但是都有一个缺陷，没有做到自动触发修改密码。这里记录了我在解题时的思路，顺便分享出来抛砖引玉，希望大佬们不吝赐教哈 ;-)"}
{"title": "解读数据出境如何“安检”", "url": "https://www.freebuf.com/articles/database/203298.html", "time": "2019-05-18", "level": "", "num_look": 183472, "num_comment": 183472, "author": "安数君", "tags": ["数据安全"], "text": ""}
{"title": "乖乖支付赎金，勒索软件最佳解决方案？", "url": "https://www.freebuf.com/articles/neopoints/203945.html", "time": "2019-05-17", "level": "红色标题", "num_look": 101196, "num_comment": 1, "author": "Allen别bb", "tags": ["观点"], "text": "当遭遇勒索软件，是否支付赎金以便恢复数据？看起来简单，但其实也是一个比较难以选择的问题。"}
{"title": "记一次Windows日志分析：LogParse", "url": "https://www.freebuf.com/articles/network/201334.html", "time": "2019-05-17", "level": "现金奖励", "num_look": 236286, "num_comment": 13, "author": "星空111", "tags": ["网络安全"], "text": "如今单身的我，现在有大把的时间来修炼我的技术，就像圈内的小伙伴们说：「要女朋友有什么用？这不是影响我写代码吗？」希望我未来能达到「重剑无锋，大巧不工」的境界。"}
{"title": "挖洞经验 | 通过GitHub上泄露的dotfile文件获得Zendesk代码项目和网络资产访问权限", "url": "https://www.freebuf.com/articles/web/201871.html", "time": "2019-05-17", "level": "", "num_look": 113523, "num_comment": 113523, "author": "clouds", "tags": ["WEB安全"], "text": "Assetnote发现了厂商Zendesk公司泄露在GitHub上的信息，该信息包含可远程访问Zendesk网络资产的相关密码凭据，可以访问Zendesk公司的大量代码项目和网络资产。"}
{"title": "利用session.upload_progress进行文件包含和反序列化渗透", "url": "https://www.freebuf.com/vuls/202819.html", "time": "2019-05-17", "level": "金币+8", "num_look": 153157, "num_comment": 1, "author": "17851220695", "tags": ["其他", "漏洞"], "text": "本文主要是利用PHP中的session.upload_progress功能作为跳板，从而进行文件包含和反序列化漏洞利用。"}
{"title": "浅谈RASP技术攻防之实战（环境配置与代码实现）", "url": "https://www.freebuf.com/articles/web/202806.html", "time": "2019-05-17", "level": "红色标题", "num_look": 318609, "num_comment": 2, "author": "安百科技", "tags": ["WEB安全"], "text": "如需在Java中实现RASP技术，笔者建议好好了解一下ASM，这样对以后JAVA的运行机制也会有一定的了解，方便以后调试以及写代码。"}
{"title": "反虚拟机和沙箱检测的一些小技巧", "url": "https://www.freebuf.com/articles/system/202717.html", "time": "2019-05-17", "level": "现金奖励", "num_look": 401572, "num_comment": 4, "author": "nekoyansu", "tags": ["系统安全"], "text": "各类恶意软件层出不穷，反病毒软件也更新了各种检测方案以提高检测率。比如动态沙箱检测技术，即通过在沙箱中运行程序并观察程序行为来判断程序是否为恶意程序。"}
{"title": "海莲花团伙对中南半岛国家攻击活动的总结：目标、手法及技术演进", "url": "https://www.freebuf.com/articles/system/203157.html", "time": "2019-05-17", "level": "", "num_look": 190942, "num_comment": 6, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "海莲花（OceanLotus）是一个据称越南背景的APT组织。该组织最早于2015年5月被天眼实验室所揭露并命名。"}
{"title": "BUF早餐铺 | 俄罗斯政府网站泄露225万用户护照和个人信息；Facebook未来20年将受美国政府隐私保护监督；美国联邦通信委员进一步打击自动骚扰电话", "url": "https://www.freebuf.com/news/203756.html", "time": "2019-05-17", "level": "", "num_look": 117820, "num_comment": 117820, "author": "Freddy", "tags": ["资讯"], "text": "多个俄罗斯政府网站泄露了超过225万公民、府雇员和政治家的个人和护照信息，任何人都可以下载。"}
{"title": "PocSuite3：一款开源远程漏洞测试框架", "url": "https://www.freebuf.com/sectool/202210.html", "time": "2019-05-16", "level": "", "num_look": 195660, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫PocSuite3的开源漏洞测试框架，该工具由著名的Knownsec 404安全研究团队开发，广大安全人员可以利用该工具进行远程漏洞测试。"}
{"title": "挖洞经验 | 绕过Tumblr用户注册过程中的reCAPTCHA验证", "url": "https://www.freebuf.com/vuls/202444.html", "time": "2019-05-16", "level": "", "num_look": 131461, "num_comment": 2, "author": "clouds", "tags": ["漏洞"], "text": "本文分享的writeup是作者通过在Tumblr用户注册过程中，发现Tumblr的“人机身份验证”机制（reCAPTCHA）存在缺陷，可被轻松绕过。"}
{"title": "优衣库遭到黑客攻击，超过46万用户数据泄漏", "url": "https://www.freebuf.com/news/203741.html", "time": "2019-05-16", "level": "红色标题", "num_look": 107940, "num_comment": 7, "author": "Karunesh91", "tags": ["资讯"], "text": "听闻优衣库被黑，作为忠实用户，惊出一身冷汗。"}
{"title": "影响所有苹果设备的无线漏洞，可被强行接入恶意热点", "url": "https://www.freebuf.com/vuls/203484.html", "time": "2019-05-16", "level": "现金奖励", "num_look": 211971, "num_comment": 2, "author": "qingxp9", "tags": ["漏洞"], "text": "苹果设备在PEAP认证上存在缺陷，攻击者可强迫苹果设备接入恶意热点。该缺陷影响2019年3月25前的iOS、macOS、tvOS版本，包含MacBook、iPhone、iPad、Apple TV等多种苹果设备。"}
{"title": "DGG挖矿僵尸网络最新变种分析", "url": "https://www.freebuf.com/articles/terminal/202311.html", "time": "2019-05-16", "level": "现金奖励", "num_look": 144430, "num_comment": 4, "author": "Sampson", "tags": ["终端安全"], "text": "近期通过蜜罐监测到DGG挖矿僵尸网络的最新网络活动，发现该僵尸网络病毒程序已升级到4000版本。"}
{"title": "浏览器安全学习笔记（一）", "url": "https://www.freebuf.com/vuls/202413.html", "time": "2019-05-16", "level": "现金奖励", "num_look": 220893, "num_comment": 4, "author": "conusys", "tags": ["漏洞"], "text": "在国际pwn大赛上，浏览器安全一直是重头戏，特别是神奇的沙盒穿越更是难上加难，本文开始分享学习浏览器安全的点点滴滴。"}
{"title": "Cisco RV320、RV325未授权远程代码执行漏洞分析及建议", "url": "https://www.freebuf.com/vuls/202814.html", "time": "2019-05-16", "level": "", "num_look": 123009, "num_comment": 1, "author": "antiylab", "tags": ["漏洞", "网络安全"], "text": "该组漏洞主要对Cisco RV320和RV325两款双千兆WAN VPN路由器造成影响，两个漏洞结合利用可以达到允许未经身份授权的远程攻击者执行任意命令的目的。"}
{"title": "BUF早餐铺 | 旧金山禁止政府使用面部识别技术；微软发布安全补丁修复高危漏洞；英特尔处理器曝新漏洞 ZombieLoad", "url": "https://www.freebuf.com/news/203709.html", "time": "2019-05-16", "level": "", "num_look": 64172, "num_comment": 3, "author": "AngelaY", "tags": ["资讯"], "text": "Intel八代、九代酷睿爆出MDS漏洞；为解决隐私问题争议，谷歌扩大欧洲科技中心规模；华为表示愿意与各国政府签署无监控协议。"}
{"title": "公安三所对网络安全等级保护2.0要求解读  | 企业安全俱乐部议题前瞻前瞻", "url": "https://www.freebuf.com/fevents/203593.html", "time": "2019-05-15", "level": "", "num_look": 95450, "num_comment": 3, "author": "FB独家", "tags": ["活动"], "text": "6月5日，于企业安全俱乐部系列沙龙活动“等级保护2.0研讨专场”上，来自公安部第三研究所的大数据安全测评实验室主任宋好好将为大家分享《网络安全等级保护2.0要求解读》"}
{"title": "Beagle：一款功能强大的图形化事件响应与数字取证安全分析工具", "url": "https://www.freebuf.com/sectool/202346.html", "time": "2019-05-15", "level": "", "num_look": 118274, "num_comment": 118274, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Beagle的开源工具，Beagle是一款事件响应与数字取证工具，它可以将安全日志与分析数据以图形化的形式呈现。"}
{"title": "企业安全之内部代码管理平台Gitlab下载及权限审计", "url": "https://www.freebuf.com/articles/es/202997.html", "time": "2019-05-15", "level": "现金奖励", "num_look": 924458, "num_comment": 8, "author": "胡说", "tags": ["企业安全"], "text": "企业通常会使用Gitlab作为内部代码管理平台，但仍不能保证私有仓库中的代码不被泄露到外部，于是对gitlab的权限审计以及下载审计就变得尤为重要。"}
{"title": "英特尔再曝漏洞，影响2011年以来几乎所有产品", "url": "https://www.freebuf.com/news/203597.html", "time": "2019-05-15", "level": "红色标题", "num_look": 135550, "num_comment": 1, "author": "AdlerI", "tags": ["资讯"], "text": "这些攻击方法在PC端和云环境中都能生效，导致不同的应用程序、操作系统虚拟机和可信执行环境泄露敏感信息，包括密码、网站内容、磁盘加密密钥和浏览器历史记录等。"}
{"title": "Windows再曝“WannaCry”级漏洞 CVE-2019-0708，专治 XP、Win7", "url": "https://www.freebuf.com/news/203584.html", "time": "2019-05-15", "level": "红色标题", "num_look": 1351676, "num_comment": 14, "author": "FB客服", "tags": ["漏洞", "资讯"], "text": "在WannaCry两周年之际，Windows再次被曝出存在高危远程漏洞。5月15日，微软官方发布了5月安全更新补丁共修复了82个漏洞，其中包含针对远程桌面（RDP）服务远程代码执行漏洞CVE-2019-0708。"}
{"title": "挖洞经验 | 用绕过姿势形成SSRF获取印度最大股票经纪公司AWS密码凭据", "url": "https://www.freebuf.com/vuls/202379.html", "time": "2019-05-15", "level": "", "num_look": 138900, "num_comment": 2, "author": "clouds", "tags": ["漏洞"], "text": "今天分享的writeup是作者在针对印度最大的股票经纪公司进行安全测试时，通过不同层面的绕过技巧（Bypass），最终获取到该公司AWS密码凭据的过程。"}
{"title": "【FreeBuf字幕组】Web安全漏洞系列：HTTP参数污染的相关原理和利用构造", "url": "https://www.freebuf.com/video/203522.html", "time": "2019-05-15", "level": "红色标题", "num_look": 87559, "num_comment": 2, "author": "willhuang", "tags": ["视频"], "text": "本课程翻译自Youtube精选系列教程，对WEB应用技术相关的各种典型安全漏洞进行了贴近实战和深入浅出的介绍，喜欢的点一波关注。"}
{"title": "5月表白季默安科技招聘：I WANT YOU！", "url": "https://www.freebuf.com/jobs/203368.html", "time": "2019-05-15", "level": "", "num_look": 92154, "num_comment": 1, "author": "默安科技", "tags": ["安全招聘"], "text": "无论你是研发、产品经理、安全研究员、项目经理、销售经理、实习生，都请收下小默的表白。"}
{"title": "后Coinhive时代的挖矿攻击", "url": "https://www.freebuf.com/news/202947.html", "time": "2019-05-15", "level": "", "num_look": 107225, "num_comment": 107225, "author": "AngelaY", "tags": ["资讯"], "text": "本文是Malwarebytes实验室在Coinhive关闭之后针对Web挖矿情况的分析结果。"}
{"title": "WebLogic RCE（CVE-2019-2725）漏洞之旅", "url": "https://www.freebuf.com/vuls/202800.html", "time": "2019-05-15", "level": "", "num_look": 209033, "num_comment": 209033, "author": "Knownsec知道创宇", "tags": ["漏洞"], "text": "Web Logic WAR包在反序列化处理输入信息时存在缺陷，攻击者可以发送精心构造的恶意 HTTP 请求，获得目标服务器的权限，在未授权的情况下远程执行命令。"}
{"title": "2019 FreeTalk深圳站开放报名 | 6月1日，过来玩点不一样的！", "url": "https://www.freebuf.com/fevents/203553.html", "time": "2019-05-15", "level": "红色标题", "num_look": 60354, "num_comment": 2, "author": "漏洞盒子", "tags": ["活动"], "text": "6月1日，FreeTalk深圳站，OPPOSRC展台、神秘小酒馆、互动抽奖、稀有盒子项目入场券...一站式满足你的所有愿望~"}
{"title": "半壁江山被端！全球暗网市场面临洗牌", "url": "https://www.freebuf.com/news/202991.html", "time": "2019-05-15", "level": "", "num_look": 858631, "num_comment": 3, "author": "GEETEST极验", "tags": ["资讯"], "text": "5月3日，华尔街市场(简称WSM)全球第二大暗网黑市也走上了被查封的老路：三名网站管理者被抓，网站被关停。一时间满城风雨，议论纷纷。"}
{"title": "W12Scan：一款功能强大的网络安全资产扫描引擎", "url": "https://www.freebuf.com/sectool/202375.html", "time": "2019-05-15", "level": "", "num_look": 1346801, "num_comment": 12, "author": "Alpha_h4ck", "tags": ["工具"], "text": "W12是一款功能强大的网络安全资产扫描引擎，它可以自动收集关于分析目标的相关资产信息，以供研究人员分析和使用。"}
{"title": "响尾蛇APT组织针对巴基斯坦的定向攻击事件分析", "url": "https://www.freebuf.com/articles/paper/203059.html", "time": "2019-05-15", "level": "", "num_look": 98154, "num_comment": 98154, "author": "antiylab", "tags": ["安全报告"], "text": "2019年4月23日，安天CERT发现响尾蛇（SideWinder）APT组织针对巴基斯坦进行的鱼叉式钓鱼邮件攻击事件。"}
{"title": "BUF早餐铺 | 优衣库称日本购物网站46万账户遭黑客攻击；Facebook未来20年将受美国政府隐私保护监督；SQLite 再被曝 RCE 漏洞", "url": "https://www.freebuf.com/news/203513.html", "time": "2019-05-15", "level": "", "num_look": 61777, "num_comment": 61777, "author": "shidongqi", "tags": ["资讯"], "text": "亚洲最大的零售商迅销表示，黑客可能已经获取了旗下优衣库和GU品牌电子商务门户网站大约50万用户的个人信息。"}
{"title": "利用HTML5标签进行DDoS攻击的新方法揭秘", "url": "https://www.freebuf.com/articles/web/202390.html", "time": "2019-05-14", "level": "", "num_look": 170193, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "近期，来自Imperva Vitaly Simonovich和Dima Bekerman的安全研究专家发现了一种基于HTML5超链接审计功能（Ping标签）的大规模DDoS攻击。"}
{"title": "Web指纹识别技术研究与优化实现", "url": "https://www.freebuf.com/articles/web/202560.html", "time": "2019-05-14", "level": "现金奖励", "num_look": 639566, "num_comment": 13, "author": "Tide重剑无锋", "tags": ["WEB安全"], "text": "本文通过分析web指纹的检测对象、检测方法、检测原理及常用工具，设计了一个简易的指纹搜集脚本来协助发现新指纹。"}
{"title": "微软再出状况：Exchange存在潜藏多年的后门", "url": "https://www.freebuf.com/news/203055.html", "time": "2019-05-14", "level": "", "num_look": 103409, "num_comment": 6, "author": "Karunesh91", "tags": ["资讯"], "text": "近日，安全专家在微软的Exchange中发现了一个非常隐蔽的后门，该后门的存在，可导致攻击者通过邮件感染服务器，完成修改或阻止以及撰写新邮件的操作。"}
{"title": "对付黑客，这些国家用了哪些奇招？", "url": "https://www.freebuf.com/news/203013.html", "time": "2019-05-14", "level": "红色标题", "num_look": 186055, "num_comment": 3, "author": "安数君", "tags": ["资讯"], "text": "2019 年5月5日， 以色列国防军（IDF） 表示，他们成功阻止了巴勒斯坦军事情报组织哈马斯（Hamas）上周末发起的网络攻击。这也是IDF首次通过物理攻击方式来打击网络攻击。"}
{"title": "EOS REX安全系列之从源码开始玩转REX(一)", "url": "https://www.freebuf.com/articles/blockchain-articles/202952.html", "time": "2019-05-14", "level": "", "num_look": 192489, "num_comment": 1, "author": "SlowMist慢雾科技", "tags": ["区块链安全"], "text": "REX 究竟是什么呢？REX 又有什么用？本系列基于 rex1.6.0-rc2 源码进行分析，给出相关的细节及答案。"}
{"title": "国家网络安全能力成熟度模型（一）", "url": "https://www.freebuf.com/articles/es/202351.html", "time": "2019-05-14", "level": "金币+10", "num_look": 309219, "num_comment": 1, "author": "宇宸de研究室", "tags": ["企业安全"], "text": "这是作为课题研究的一个学术报告，发现有很多地方可以拿来借鉴和学习，从比较高的角度去看待网络安全，并且给出了一定的实践指南。"}
{"title": "BUF早餐铺丨比特币24小时大涨12%，时隔10个月价格重返8000美元；德国网络安全局警告卡巴斯基杀毒软件存在安全缺陷", "url": "https://www.freebuf.com/news/203447.html", "time": "2019-05-14", "level": "", "num_look": 87510, "num_comment": 87510, "author": "Karunesh91", "tags": ["资讯"], "text": "比特币24小时大涨12%，时隔10个月价格重返8000美元；德国网络安全局警告卡巴斯基杀毒软件存在安全缺陷；开源组件漏洞影响多个CMS系统。"}
{"title": "快讯 | “等保2.0”正式发布，12月1日正式实施", "url": "https://www.freebuf.com/news/203140.html", "time": "2019-05-13", "level": "红色标题", "num_look": 509934, "num_comment": 3, "author": "Freddy", "tags": ["资讯"], "text": "2019年5月9日，2019工业安全大会（ISSC2019）上，有嘉宾透露《网络安全等级保护技术》2.0版本将于今年5月13日正式发布。"}
{"title": "吕毅：浅析金融组织IT和安全战略（导论）", "url": "https://www.freebuf.com/articles/security-management/202980.html", "time": "2019-05-13", "level": "金币+10", "num_look": 232161, "num_comment": 8, "author": "仙人掌情报站", "tags": ["安全管理"], "text": "习近平总书记在419讲话中提到“从社会发展史看，人类经历了农业革命、工业革命，正在经历信息革命”。安全的发展史也是如此，从农业社会的人身安全，工业社会的生产安全到信息化社会的网络安全，逐步演进。"}
{"title": "逆向分析“海莲花” APT木马的花指令反混淆工具", "url": "https://www.freebuf.com/articles/neopoints/202056.html", "time": "2019-05-13", "level": "", "num_look": 134543, "num_comment": 1, "author": "clouds", "tags": ["观点"], "text": "本文中，CheckPoint研究人员基于对“海莲花” 木马程序的分析，编写了一段绕过其混淆技术的反混淆工具-APT32GraphDeobfuscator.py。"}
{"title": "悬镜安全招聘安全服务工程师", "url": "https://www.freebuf.com/jobs/203042.html", "time": "2019-05-13", "level": "", "num_look": 72650, "num_comment": 72650, "author": "悬镜安全实验室", "tags": ["安全招聘"], "text": "悬镜安全，创立于2014年9月，北京安普诺信息技术有限公司旗下AI安全品牌，由北京大学白帽黑客团队“Xmirror”主导创立。"}
{"title": "关于国家信息安全漏洞库（CNNVD）正式启动2019年兼容性服务申请工作的通知", "url": "https://www.freebuf.com/news/203333.html", "time": "2019-05-13", "level": "", "num_look": 79205, "num_comment": 79205, "author": "CNNVD", "tags": ["资讯"], "text": "2019年度CNNVD兼容性服务申请工作将于近期开展。"}
{"title": "你真的懂“抓包”吗？", "url": "https://www.freebuf.com/articles/web/202579.html", "time": "2019-05-13", "level": "现金奖励", "num_look": 264307, "num_comment": 9, "author": "Yale1024", "tags": ["WEB安全"], "text": "在平时和其他大佬交流时，总会出现这么些话，“抓个包看看就知道哪出问题了”，“抓流量啊，payload都在里面”，“这数据流怎么这么奇怪”。这里出现的名词，都是差不多的意思吗？"}
{"title": "fireELF：无文件Linux恶意代码框架", "url": "https://www.freebuf.com/sectool/202312.html", "time": "2019-05-13", "level": "", "num_look": 124888, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "fireELF是一个开源的跨平台无文件Linux恶意代码框架，它允许用户轻松的创建和管理payloads。"}
{"title": "Easy WP SMTP（v1.3.9）0 day漏洞被攻击的过程和复现", "url": "https://www.freebuf.com/vuls/201588.html", "time": "2019-05-13", "level": "金币+8", "num_look": 137830, "num_comment": 137830, "author": "timneh", "tags": ["WEB安全", "漏洞"], "text": "自己博客网站用wordpres托管着，上个月发现了一些异常，收到了100多封关于网站被爆破的通知邮件。于是就有了这篇文章。"}
{"title": "BUF早餐铺丨错误更新导致荷兰数百名嫌犯佩戴的监控踝带短暂失联；杠上美国反病毒公司：俄罗斯黑客要卖它们的源代码", "url": "https://www.freebuf.com/news/203312.html", "time": "2019-05-13", "level": "", "num_look": 51911, "num_comment": 51911, "author": "Karunesh91", "tags": ["资讯"], "text": "错误更新导致荷兰数百名嫌犯佩戴的监控踝带短暂失联；杠上美国反病毒公司：俄罗斯黑客要卖它们的源代码；英特尔固件引导验证绕过攻击。"}
{"title": "抵御无文件型恶意软件攻击的那些事儿", "url": "https://www.freebuf.com/articles/es/202405.html", "time": "2019-05-12", "level": "", "num_look": 128854, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["企业安全"], "text": "目前，针对企业环境的无文件型恶意软件威胁正在日趋增长。"}
{"title": "揭秘如何使用跨平台的EvilClippy创建恶意MS Office文档", "url": "https://www.freebuf.com/articles/terminal/202408.html", "time": "2019-05-12", "level": "", "num_look": 105101, "num_comment": 105101, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "今天给大家介绍的是一款名叫EvilClippy的开源工具，它是一款专用于创建恶意MS Office测试文档的跨平台安全工具。"}
{"title": "关于Metasploit5中的后渗透模块的编写与测试", "url": "https://www.freebuf.com/articles/system/202508.html", "time": "2019-05-12", "level": "现金奖励", "num_look": 132473, "num_comment": 132473, "author": "Neroqi", "tags": ["系统安全"], "text": "后渗透模块，顾名思义是在成功渗透目标主机之后进行操作的模块，这类模块可以达到某种或某些特定的目的。"}
{"title": "时下流行的9种恶意软件，你都了解吗？", "url": "https://www.freebuf.com/news/202711.html", "time": "2019-05-12", "level": "", "num_look": 126911, "num_comment": 5, "author": "Karunesh91", "tags": ["资讯"], "text": "想要愉快的网上冲浪，对各种恶意软件的了解不能少～"}
{"title": "Kubebot：一款Google云平台下的Slackbot安全测试工具", "url": "https://www.freebuf.com/articles/network/202483.html", "time": "2019-05-11", "level": "", "num_look": 92404, "num_comment": 92404, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "今天给大家介绍的是一款名叫Kubebot的安全测试Slackbot，该工具基于Google 云平台搭建，并且提供了Kubernetes后端。"}
{"title": "揭秘使用Confluence未授权RCE漏洞在6小时内渗透50+公司", "url": "https://www.freebuf.com/articles/web/202492.html", "time": "2019-05-11", "level": "", "num_look": 155266, "num_comment": 2, "author": "secist", "tags": ["WEB安全"], "text": "长话短说，其实早在2016年我就创建了我的Hackerone/Bugcrowd profiles，但我从未在那里报告过任何的漏洞。这是第一个让我觉得值得报告的漏洞，也打破了我多年来零报告的记录。"}
{"title": "Anubis Android银行木马技术分析及新近活动总结", "url": "https://www.freebuf.com/articles/terminal/202787.html", "time": "2019-05-11", "level": "", "num_look": 178222, "num_comment": 178222, "author": "奇安信威胁情报中心", "tags": ["终端安全"], "text": "Anubis是一种Android银行恶意软件，自2017年以来已经为全球100多个国家，300多家金融机构带来了相当大的麻烦。到目前为止，爆发地主要为欧洲国家，国内暂未发现该银行木马。"}
{"title": "【BUF大事件】等级保护2.0发布时间确定；币安遭黑客洗劫7000比特币，价值约4100万美金", "url": "https://www.freebuf.com/news/203268.html", "time": "2019-05-11", "level": "红色标题", "num_look": 76955, "num_comment": 76955, "author": "willhuang", "tags": ["视频", "资讯"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，币安遭黑客洗劫7000比特币，价值约4100万美金 ；“等保2.0”将于今年5月13日正式发布；Lucky蠕虫病毒利用魔兽地图大肆传播。"}
{"title": "新的DDoS攻击手法来袭：TCP反射攻击技术分析", "url": "https://www.freebuf.com/articles/database/202401.html", "time": "2019-05-11", "level": "", "num_look": 189443, "num_comment": 7, "author": "腾讯安全平台部", "tags": ["数据安全"], "text": "现网的DDoS对抗中，基于TCP协议的反射攻击手法已经悄然兴起，而且出现了多次手法变种，对DDoS防护方带来严峻的挑战。"}
{"title": "八年等待，中国移动进入美国市场遭拒", "url": "https://www.freebuf.com/news/203252.html", "time": "2019-05-10", "level": "", "num_look": 85589, "num_comment": 7, "author": "Allen别bb", "tags": ["资讯"], "text": "本周四，FCC委员会的五名成员一致投票否决了该申请，也让中国移动等待了八年的希望彻底破灭。"}
{"title": "双尾蝎（APT-C-23）团伙利用带有政治主题的Android恶意软件针对巴勒斯坦的攻击分析", "url": "https://www.freebuf.com/articles/terminal/203152.html", "time": "2019-05-10", "level": "", "num_look": 118010, "num_comment": 118010, "author": "奇安信威胁情报中心", "tags": ["终端安全"], "text": "2016年5月起至今，双尾蝎组织（APT-C-23）对巴勒斯坦教育机构、军事机构等重要领域展开了有组织、有计划、有针对性的长时间不间断攻击。"}
{"title": "如何使用Okadminfinder3来搜索管理员面板与管理员登陆页面", "url": "https://www.freebuf.com/sectool/202410.html", "time": "2019-05-10", "level": "", "num_look": 113660, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Okadminfinder3的工具，广大研究人员可以在渗透测试的过程中，利用它来查找目标程序的管理员面板接口或管理员账户登录地址。"}
{"title": "在“天眼”看到弑母案嫌疑人之前，我们付出了什么？", "url": "https://www.freebuf.com/articles/network/202340.html", "time": "2019-05-10", "level": "红色标题", "num_look": 256022, "num_comment": 20, "author": "GEETEST极验", "tags": ["网络安全"], "text": "不光在公安公共交通放方面，目前人脸识别技术应用场景越来越多，但在我们享受科技带来便利的同时，也有不少风险和担忧的声音"}
{"title": "极光无限安全团队集结令（苏州）", "url": "https://www.freebuf.com/jobs/202747.html", "time": "2019-05-10", "level": "", "num_look": 228664, "num_comment": 20, "author": "极光无限SZ", "tags": ["安全招聘"], "text": "极光无限是由全球金融领域TOP 50的金融科技巨头全资控投的一家信息安全科技公司，主要由中国安全领域数位资深专家领携，建设华东地区技术实力强劲的信息安全研究实验室。"}
{"title": "警惕“侠盗”团伙利用新型漏洞传播GandCrab勒索“蓝屏”变种", "url": "https://www.freebuf.com/articles/system/202317.html", "time": "2019-05-10", "level": "", "num_look": 92784, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近日，深信服安全团队捕获到利用Confluence新型漏洞传播勒索病毒的事件，已有政企机构受到攻击。"}
{"title": "TLS握手：回顾1.2、迎接1.3", "url": "https://www.freebuf.com/articles/network/202504.html", "time": "2019-05-10", "level": "现金奖励", "num_look": 143224, "num_comment": 3, "author": "novsec", "tags": ["网络安全"], "text": "TLS 1.3 2018年发布了，在看1.3的变动前有必要盘点下1.2的主要原理。主要是关于RSA和DH两种密钥协商协议所产生的一些细节上的区别。"}
{"title": "DDoS黑吃黑：流氓软件“钱蜜”的悲催", "url": "https://www.freebuf.com/articles/system/202785.html", "time": "2019-05-10", "level": "", "num_look": 120764, "num_comment": 1, "author": "安全豹", "tags": ["系统安全"], "text": "近期监测到一款DDOS木马的感染量呈现出上升趋势，而同时呈现出相同增长趋势的，还有部分流氓软件。"}
{"title": "netmap.js：基于浏览器的网络发现工具", "url": "https://www.freebuf.com/sectool/202500.html", "time": "2019-05-10", "level": "", "num_look": 104682, "num_comment": 104682, "author": "secist", "tags": ["工具", "网络安全"], "text": "netmap.js是一款基于浏览器，用于提供主机发现和端口扫描功能的网络发现工具。"}
{"title": "BUF早餐铺 | 不安全的MongoDB数据库暴露了超过2.75亿条印度公民记录；Alpine Linux Docker镜像一直存在没有密码的root帐户；某医院未履行等级保护制度被罚款1万", "url": "https://www.freebuf.com/news/203112.html", "time": "2019-05-10", "level": "", "num_look": 88842, "num_comment": 3, "author": "Freddy", "tags": ["资讯"], "text": "不安全的MongoDB数据库暴露了超过2.75亿条印度公民记录，暴露的数据包括姓名、性别、出生日期、电子邮件、手机号码、教育详情、专业信息（雇主、工作经历、技能、职能范围）和当前薪水等信息。"}
{"title": "在多GPU系统上使用hashcat进行密码破解", "url": "https://www.freebuf.com/articles/system/202537.html", "time": "2019-05-09", "level": "", "num_look": 191107, "num_comment": 7, "author": "secist", "tags": ["系统安全"], "text": "我设法获取其中一个服务器上的shell并通过使用privesc内核漏洞来取得root权限，然后我就能够完全的控制这台服务器。"}
{"title": "犯罪分子竟使用签名Rootkit窃取登录和付款信息", "url": "https://www.freebuf.com/articles/web/202874.html", "time": "2019-05-09", "level": "", "num_look": 113491, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "研究人员发现有网络犯罪分子正在大规模的恶意活动中使用数字签名的Rootkit来窃取目标用户的登录凭证、支付信息以及浏览器历史记录，并进行网络诈骗以及恶意广告传播。"}
{"title": "卫星安全研究有关的基础知识", "url": "https://www.freebuf.com/articles/wireless/202493.html", "time": "2019-05-09", "level": "现金奖励", "num_look": 671857, "num_comment": 31, "author": "OpenATS", "tags": ["无线安全"], "text": "其实跟卫星相关的知识多并且复杂，需要很多方面都要涉及。"}
{"title": "PHPCMS v9.6.0 wap模块SQL注入 | FreeBuf × 破壳学院训练营", "url": "https://www.freebuf.com/articles/web/202914.html", "time": "2019-05-09", "level": "", "num_look": 139543, "num_comment": 3, "author": "FB客服", "tags": ["WEB安全", "活动"], "text": "2019年4月24日，在线课程《WEB安全入门急速训练营》进驻FREEBUF平台正式第五期招生，课程共计7章57节751分钟教学，将在60天内系统化的让你入门WEB安全。"}
{"title": "农夫山泉招聘安全工程师", "url": "https://www.freebuf.com/jobs/202781.html", "time": "2019-05-09", "level": "", "num_look": 137310, "num_comment": 18, "author": "UnAmico", "tags": ["安全招聘"], "text": "彩虹鱼科技是隶属于养生堂集团/农夫山泉的子公司，专注于信息化科技产业，是一家独立的信息化产业公司。"}
{"title": "如何打造自己的PoC框架Pocsuite3（使用篇）", "url": "https://www.freebuf.com/vuls/202001.html", "time": "2019-05-09", "level": "", "num_look": 150476, "num_comment": 2, "author": "Knownsec知道创宇", "tags": ["漏洞"], "text": "相比于无聊的用法介绍，我更想说一下Pocsuite3为什么会有这些功能以及是如何实现的。如果你也想制造一款类似的工具，Pocsuite3的一些思想或许能够帮助到你。"}
{"title": "用家里旧的红外遥控器控制树莓派小车", "url": "https://www.freebuf.com/geek/202231.html", "time": "2019-05-09", "level": "金币+8", "num_look": 166228, "num_comment": 10, "author": "xutiejun", "tags": ["极客"], "text": "本文尝试使用红外控制方案对树莓派小车进行控制。"}
{"title": "豪华出境游 | 漏洞盒子TOP白帽塞班游记第二弹，内含106s.AVI", "url": "https://www.freebuf.com/fevents/203016.html", "time": "2019-05-09", "level": "红色标题", "num_look": 55659, "num_comment": 4, "author": "漏洞盒子", "tags": ["活动"], "text": "你们想要的TOP白帽子の真颜+脸美腿美の盒子小姐姐都在这里！"}
{"title": "年度最大病毒团伙现形记", "url": "https://www.freebuf.com/articles/network/202352.html", "time": "2019-05-09", "level": "", "num_look": 153162, "num_comment": 4, "author": "腾讯电脑管家", "tags": ["网络安全"], "text": "2018年至今，国内先后有多家安全厂商发现多个病毒木马家族，这些木马在用户电脑上安装Rootkit后门，通过多种流行的黑色产业变现牟利。"}
{"title": "Recorded Future撞库攻击报告 | 泄露信息过亿，利润高达20倍", "url": "https://www.freebuf.com/news/202341.html", "time": "2019-05-09", "level": "", "num_look": 104514, "num_comment": 1, "author": "AngelaY", "tags": ["安全报告", "资讯"], "text": "按照百分之一的成功率计算，撞库攻击的利润比成本高出至少20倍。"}
{"title": "BUF早餐铺 | 币安称4000万美元比特币被盗；谷歌强调用户隐私：尽可能把数据留在手机本地；Facebook关闭更多与俄罗斯有关的虚假账户", "url": "https://www.freebuf.com/news/203077.html", "time": "2019-05-09", "level": "", "num_look": 75411, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "间谍组织在Shadow Brokers泄密之前就使用方程式组织的工具;研究人员发现隐藏在Microsoft exchange中的后门；美中情局分享暗网加密链接。"}
{"title": "Freddy：一款基于活动被动扫描方式的Java&.NET应用程序漏洞扫描工具", "url": "https://www.freebuf.com/sectool/202421.html", "time": "2019-05-08", "level": "", "num_look": 124849, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Freddy的开源工具，该工具的功能基于主动/被动式扫描，在Freddy的帮助下，研究人员可以快速查找Java和.NET应用程序中的反序列化安全问题。"}
{"title": "币安遭黑客洗劫7000比特币，价值约4100万美金", "url": "https://www.freebuf.com/news/203024.html", "time": "2019-05-08", "level": "红色标题", "num_look": 134398, "num_comment": 2, "author": "Allen别bb", "tags": ["资讯"], "text": "能真正玩得转加密货币的人都是聪明人，而能从这一堆聪明人中卷走一笔巨款而还能全身而退的，大概只有黑客了，这次他们又从币安提走了7000比特币，价值近4100万美元。"}
{"title": "2019 FreeTalk深圳站，舞台交给你 | 议题征集ing", "url": "https://www.freebuf.com/fevents/201424.html", "time": "2019-05-08", "level": "", "num_look": 96765, "num_comment": 4, "author": "FB客服", "tags": ["活动"], "text": "2019 FreeTalk深圳站，想听什么，你说了算！"}
{"title": "P4wnP1 USB与赛门铁克反病毒绕过", "url": "https://www.freebuf.com/articles/system/202060.html", "time": "2019-05-08", "level": "", "num_look": 128389, "num_comment": 1, "author": "secist", "tags": ["系统安全"], "text": "最近，我使用P4wnP1 image把我手头的Raspberry Pi Zero W转换成了一个bad USB。"}
{"title": "丁香园招聘安全工程师", "url": "https://www.freebuf.com/jobs/202837.html", "time": "2019-05-08", "level": "", "num_look": 115288, "num_comment": 5, "author": "SixSixSix", "tags": ["安全招聘"], "text": "丁香园是中国领先的医疗领域连接者以及数字化领域专业服务供应商。为中国医生提供在线交流平台、优质的医学信息数据库和高效便捷工具是丁香园创立至今不变的理念。"}
{"title": "最新Linux挖矿程序kworkerds分析", "url": "https://www.freebuf.com/articles/system/201402.html", "time": "2019-05-08", "level": "现金奖励", "num_look": 189823, "num_comment": 9, "author": "runmoke", "tags": ["系统安全"], "text": "近日，同伴的一台Linux服务器中了kworkerds挖矿程序，随即对挖矿程序进行了处理与分析。"}
{"title": "二维码劫持原理及恶意行为分析", "url": "https://www.freebuf.com/articles/web/199057.html", "time": "2019-05-08", "level": "现金奖励", "num_look": 210927, "num_comment": 3, "author": "VoltCary", "tags": ["WEB安全"], "text": "之前看过其他的二维码登陆劫持漏洞，为了照顾更多入门新手，以本人的理解重新总结一遍，二维码登陆原理不是这里的主题，不过有必要熟悉一下流程。"}
{"title": "BUF早餐铺 | NSA 黑客工具在泄露前已被 APT 组织使用；计算机科学家设计无法被黑的芯片；国内首家5G安全协同创新中心成立", "url": "https://www.freebuf.com/news/202966.html", "time": "2019-05-08", "level": "", "num_look": 75635, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": "密歇根大学的计算机科学家设计出一种新的处理器架构，能主动抵御未来威胁，事实上让现有的 bug 和补丁安全模式过时。"}
{"title": "“魔兽”玩家小心啦！ Lucky蠕虫病毒利用魔兽地图大肆传播", "url": "https://www.freebuf.com/articles/network/202926.html", "time": "2019-05-07", "level": "", "num_look": 126965, "num_comment": 3, "author": "360安全", "tags": ["网络安全"], "text": "刚刚过去的“五一”小长假里，各大景区“汹涌”的人山人海，想必让很多选择留在家中打游戏的玩家都庆幸自己躲过了一劫。"}
{"title": "全国移动APP安全性研究报告：约70%的APP都存在安全漏洞", "url": "https://www.freebuf.com/articles/paper/202843.html", "time": "2019-05-07", "level": "", "num_look": 168288, "num_comment": 6, "author": "爱加密123", "tags": ["安全报告"], "text": "据统计，每年至少新增150万种移动恶意软件，至少造成超过1600 万件的移动恶意软件攻击事件。移动应用安全平台扫描了 270 多万个 APP，其中，有漏洞的 APP 约 183 万个，占监测总数的 67.77%。"}
{"title": "“预建未来”聚焦5G安全，2019 C3安全峰会精华回顾", "url": "https://www.freebuf.com/fevents/202847.html", "time": "2019-05-07", "level": "红色标题", "num_look": 78200, "num_comment": 3, "author": "Akane", "tags": ["活动"], "text": "5G时代冰与火的对抗，无论谁将最终突围，都已将其安全性视为了重中之重。正如亚信集团董事长田溯宁所言，“没有安全就没有5G云网，就没有未来”。"}
{"title": "基于Python的BS远控Ares实战", "url": "https://www.freebuf.com/articles/system/202419.html", "time": "2019-05-07", "level": "", "num_look": 185907, "num_comment": 8, "author": "secist", "tags": ["系统安全"], "text": "Ares是一个基于Python的B/S远控工具，Server端使用Flask进行开发，整体在浏览器就可以轻易操作。"}
{"title": "一次SQL注入与WAF绕过思路分享", "url": "https://www.freebuf.com/articles/web/201790.html", "time": "2019-05-07", "level": "现金奖励", "num_look": 468231, "num_comment": 16, "author": "VoltCary", "tags": ["WEB安全"], "text": "这个注入是之前做测试时发现的，但是测试的时候发现有防护，但是想想这么个小网站都绕不过，实在不应该啊。"}
{"title": "代理蜜罐的开发与应用实战", "url": "https://www.freebuf.com/articles/network/202310.html", "time": "2019-05-07", "level": "现金奖励", "num_look": 217740, "num_comment": 6, "author": "netxfly", "tags": ["网络安全"], "text": "我们的代理蜜罐是基于goproxy包开发的，该套系统的代码及思路为双刃剑，仅供用于正途，请勿用于非法用途，否则产生的一切后果请自行承担。"}
{"title": "全球能源互联网研究院信息通信研究所（南京）诚招网络安全人才", "url": "https://www.freebuf.com/jobs/197937.html", "time": "2019-05-07", "level": "", "num_look": 200254, "num_comment": 13, "author": "longhuayiyuan", "tags": ["安全招聘"], "text": "全球能源互联网研究院有限公司是国家电网公司直属科研单位，国内首家专业从事全球能源互联网关键技术和设备开发的高端研发机构。"}
{"title": "浅谈入侵溯源过程中的一些常见姿势", "url": "https://www.freebuf.com/articles/network/202168.html", "time": "2019-05-07", "level": "现金奖励", "num_look": 363404, "num_comment": 9, "author": "si1ence", "tags": ["网络安全"], "text": "被黑了就要知道为什么被黑了怎么被黑的，不能这么不明不白。"}
{"title": "BUF早餐铺丨安全研究人员玩上怀旧梗：“邪恶大眼夹”可帮助隐性感染Office文档；中消协等发智能锁试验报告：半数存指纹识别安全风险", "url": "https://www.freebuf.com/news/202832.html", "time": "2019-05-07", "level": "", "num_look": 67841, "num_comment": 2, "author": "Karunesh91", "tags": ["资讯"], "text": "安全研究人员玩上怀旧梗：“邪恶大眼夹”可帮助隐性感染Office文档；中消协等发智能锁试验报告：半数存指纹识别安全风险。"}
{"title": "绕过域账户认证失败锁定次数限制的技巧", "url": "https://www.freebuf.com/articles/system/202019.html", "time": "2019-05-07", "level": "", "num_look": 110128, "num_comment": 1, "author": "周大涛", "tags": ["系统安全"], "text": "核心思路是，用户想要爆破身份验证，他们就可以运行“net use \\\\％computername％/ u：％username％”命令，该命令可以重新要求身份验证并重置锁定计数。"}
{"title": "基于统计分析的ICMP隧道检测方法与实现", "url": "https://www.freebuf.com/articles/network/202634.html", "time": "2019-05-06", "level": "红色标题", "num_look": 864939, "num_comment": 12, "author": "斗象智能安全平台", "tags": ["网络安全"], "text": "在企业内网环境中，ICMP协议是必不可少的网络通信协议之一，被用于检测网络连通状态，通常情况下，防火墙会默认放此协议。本文将为大家介绍一种简单而有效的icmp隧道检测技术。"}
{"title": "通过无法检测到的网络（Covert Channel）从目标主机获取数据", "url": "https://www.freebuf.com/articles/system/202185.html", "time": "2019-05-06", "level": "", "num_look": 144683, "num_comment": 3, "author": "secist", "tags": ["系统安全"], "text": "在本文中，你将学习如何通过不可检测的网络从目标主机窃取数据。"}
{"title": "“等保2.0”新版本变化分析", "url": "https://www.freebuf.com/articles/es/202435.html", "time": "2019-05-06", "level": "现金奖励", "num_look": 1073315, "num_comment": 12, "author": "宇宸de研究室", "tags": ["企业安全", "标准与合规"], "text": "突然发现等保2.0最新报批稿的结构又进行了较大改动，和之前的送审稿终板存在较大差异，这里补充说明一下具体变化的情况。"}
{"title": "如何绕过2FA执行钓鱼攻击？", "url": "https://www.freebuf.com/articles/web/201868.html", "time": "2019-05-06", "level": "", "num_look": 162882, "num_comment": 1, "author": "secist", "tags": ["WEB安全"], "text": "几个礼拜前，我突然对网络钓鱼活动以及它们是如何执行的产生了浓厚的兴趣，在本文中我将这个故事分成了多个部分来进行。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列-André Baptista", "url": "https://www.freebuf.com/video/202235.html", "time": "2019-05-06", "level": "红色标题", "num_look": 101617, "num_comment": 6, "author": "willhuang", "tags": ["视频"], "text": "André Baptista，葡萄牙人，波尔图大学信息安全系特邀教授，波尔图电脑与系统工程研究院高级研究员，波尔图大学CTF战队ExtremeSTF队长，业余漏洞赏金猎人，喜欢二进制漏洞利用和逆向工程。"}
{"title": "小师妹浅谈NIST SP 800-35《信息技术安全服务》", "url": "https://www.freebuf.com/articles/network/201849.html", "time": "2019-05-06", "level": "金币+10", "num_look": 149840, "num_comment": 6, "author": "xxx幸xxx", "tags": ["网络安全"], "text": "这篇信息安全指南是去年翻译学习的，是我学习NIST SP 800系列出版物的第一篇文章，时隔半年，今天准备和大家聊聊具体内容。"}
{"title": "BUF早餐铺 | 几大Git平台仓库被劫，黑客欲勒索比特币；黑客窃取美国和加拿大201家校园在线商店的数据；安全专家轻松接管29个僵尸网络，只因黑客太菜；", "url": "https://www.freebuf.com/news/202554.html", "time": "2019-05-06", "level": "", "num_look": 89377, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "数百名开发人员的 Git 仓库被黑客删除，取而代之的是赎金要求。攻击于5月3日开始，包括 GitHub、Bitbucket 和 GitLab在内的代码托管平台都受到了影响。"}
{"title": "Proxy_Pool自动化代理搜集+评估+存储+展示工具", "url": "https://www.freebuf.com/sectool/202063.html", "time": "2019-05-05", "level": "金币+10", "num_look": 260234, "num_comment": 6, "author": "Tide重剑无锋", "tags": ["工具"], "text": "Proxy_Pool代理资源池，一个小巧的代理ip抓取+评估+存储+展示的一体化的工具，可自动化的搜集检测可用代理并进行评分，并添加了web展示和接口。"}
{"title": "豪华出境游 | 漏洞盒子TOP白帽塞班游记第一弹", "url": "https://www.freebuf.com/fevents/202611.html", "time": "2019-05-05", "level": "", "num_look": 71767, "num_comment": 2, "author": "漏洞盒子", "tags": ["活动"], "text": "跟着漏洞盒子年度白帽梦想旅游团去看看美丽的塞班~"}
{"title": "通过暴露的docker.sock文件接管容器", "url": "https://www.freebuf.com/articles/system/201793.html", "time": "2019-05-05", "level": "", "num_look": 164708, "num_comment": 1, "author": "secist", "tags": ["系统安全"], "text": "本地或远程暴露/var/run/docker.sock的Docker容器很有可能会被恶意攻击者完全的接管。"}
{"title": "纯技术上来说，《看门狗》里的各种骇客技术有可能实现吗？", "url": "https://www.freebuf.com/articles/network/201605.html", "time": "2019-05-05", "level": "红色标题", "num_look": 521230, "num_comment": 12, "author": "知道创宇KCSC", "tags": ["网络安全"], "text": "日后随着5G和物联网的发展，游戏《看门狗》和《看门狗2》中的黑客攻击情景是否有可能发生？"}
{"title": "PPmoney万惠集团招聘网络安全工程师", "url": "https://www.freebuf.com/jobs/202233.html", "time": "2019-05-05", "level": "", "num_look": 124338, "num_comment": 2, "author": "Smilechan111", "tags": ["安全招聘"], "text": "PPmoney是中国互联网金融行业中专注于消费金融的网络借贷信息中介平台，现因业务需要招聘安全人才~"}
{"title": "聊聊安全测试中如何快速搞定Webshell", "url": "https://www.freebuf.com/articles/web/201421.html", "time": "2019-05-05", "level": "现金奖励", "num_look": 372251, "num_comment": 10, "author": "DYBOY", "tags": ["WEB安全"], "text": "最近在代码审计某项目的时候发现了一个文件上传漏洞，但是在生产环境测试的过程中，各种各样的“狗”和“盾”都给拦截了，徒有漏洞，没法儿利用。"}
{"title": "企业内部安全之员工安全培训二三事", "url": "https://www.freebuf.com/articles/neopoints/201341.html", "time": "2019-05-05", "level": "", "num_look": 527113, "num_comment": 5, "author": "AngelaY", "tags": ["企业安全", "观点"], "text": "企业安全中，人往往是最薄弱的环节，员工的无心之失或恶意之举都可能导致企业丢失大量数据，陷入风险。"}
{"title": "BUF早餐铺 | 戴尔软件漏洞允许远程劫持计算机；警方查封全球第二大暗网黑市；日本正研发世界首个应对网络攻击的计算机病毒", "url": "https://www.freebuf.com/news/202517.html", "time": "2019-05-05", "level": "", "num_look": 90440, "num_comment": 90440, "author": "shidongqi", "tags": ["资讯"], "text": "日本目前正在开发一种有助于打击网络攻击的计算机病毒。据消息人士称，日本研发部门希望恶意软件能够突破计算机系统，并起到阻止网络攻击的作用。"}
{"title": "pepe：从Pastebin收集邮件地址的信息", "url": "https://www.freebuf.com/sectool/202184.html", "time": "2019-05-04", "level": "", "num_look": 226263, "num_comment": 226263, "author": "secist", "tags": ["工具"], "text": "pepe是一个基于python的用于从Pastebin收集有关泄露电子邮件地址信息的脚本工具。"}
{"title": "挖洞经验 | 利用Dell Kace K1000 的RCE漏洞接管Dropbox所有客户管理系统", "url": "https://www.freebuf.com/vuls/201673.html", "time": "2019-05-04", "level": "", "num_look": 121140, "num_comment": 1, "author": "clouds", "tags": ["漏洞"], "text": "凭借该漏洞，作者获得了H1-3120大赛的“最具价值黑客”荣誉（MVH），并囊获了一笔不菲赏金。"}
{"title": "中国缺口更大！特朗普下令弥补30万网络安全人才短缺", "url": "https://www.freebuf.com/news/202521.html", "time": "2019-05-04", "level": "", "num_look": 183923, "num_comment": 26, "author": "Allen别bb", "tags": ["资讯"], "text": "此前有数据显示，在2017年我国网络安全领域人才缺口就已经达到了70万，2020年预计将翻倍增至140万。网络安全是全球性问题，不仅仅是在中国，美国也同样面临同样困境。"}
{"title": "联手制约华为？全球安全官员讨论统一5G准则", "url": "https://www.freebuf.com/news/202530.html", "time": "2019-05-04", "level": "红色标题", "num_look": 80989, "num_comment": 80989, "author": "shidongqi", "tags": ["资讯"], "text": "在各国准备推出下一代电信设备之际，全球网络官员周四在布拉格讨论如何确保5G网络安全。俄罗斯、中国以及华为公司没有受到邀请，但是一些与会者表示并没有专门排斥哪一个国家。"}
{"title": "零杀软检出，我国遭到“海莲花”新手法攻击", "url": "https://www.freebuf.com/articles/network/201836.html", "time": "2019-05-04", "level": "", "num_look": 195590, "num_comment": 5, "author": "Threatbook", "tags": ["网络安全"], "text": "“海莲花”，又名APT32和OceanLotus，是越南背景的黑客组织。该组织长期针对中国能源相关行业、海事机构等多个机构进行网络攻击。"}
{"title": "海豚链漏洞分析 [DC-01] RPC请求因For-loop导致OOM", "url": "https://www.freebuf.com/vuls/201933.html", "time": "2019-05-04", "level": "", "num_look": 226411, "num_comment": 226411, "author": "BUGX", "tags": ["区块链安全", "漏洞"], "text": "本次我们开始第一期漏洞的分析。"}
{"title": "分享两个利用sudo token实现提权的技巧", "url": "https://www.freebuf.com/articles/system/201559.html", "time": "2019-05-03", "level": "", "num_look": 126442, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "我们在进行技术研究的过程中，发现有些时候sudo并不会要求我们输入密码，因为它“记得”我们。"}
{"title": "DDoS反射放大攻击全球探测分析", "url": "https://www.freebuf.com/articles/database/201804.html", "time": "2019-05-03", "level": "", "num_look": 195312, "num_comment": 2, "author": "知道创宇KCSC", "tags": ["安全报告", "数据安全"], "text": "DDos攻击是一种耗尽资源的网络攻击方式，攻击者通过大流量攻击，有针对性的漏洞攻击等耗尽目标主机的资源来达到拒绝服务的目的。"}
{"title": "谨防“神秘人”勒索病毒X_Mister偷袭", "url": "https://www.freebuf.com/articles/system/201997.html", "time": "2019-05-03", "level": "", "num_look": 106436, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近期，国外某安全论坛公布了一款类似Globelmposter的新型勒索病毒，此勒索病毒的某些行为与Globelmposter类似。"}
{"title": "ISeeYou：一款基于Bash和Javascript开发的社会工程学&网络钓鱼工具", "url": "https://www.freebuf.com/sectool/202175.html", "time": "2019-05-02", "level": "", "num_look": 134696, "num_comment": 7, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫ISeeYou的强大社工工具，该工具基于Bash和JavaScript开发，可帮助研究人员在进行社工技术测试或网络钓鱼培训过程中快速定位目标用户的确切地理位置。"}
{"title": "挖洞经验 | Uber服务端响应中的API调用缺陷导致的账户劫持", "url": "https://www.freebuf.com/vuls/201432.html", "time": "2019-05-02", "level": "", "num_look": 122219, "num_comment": 1, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "今天分享的writeup是香港白帽Ron Chan (@ngalongc)发现的一个关于Uber网站的漏洞。"}
{"title": "利用Confluence最新漏洞传播的Linux挖矿病毒seasame", "url": "https://www.freebuf.com/articles/system/201853.html", "time": "2019-05-02", "level": "", "num_look": 139426, "num_comment": 4, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近日，深信服EDR产品率先检测到一款新型Linux挖矿木马，经深信服安全专家分析，该病毒利用Confluence漏洞传播，通过定时下载对病毒体进行保活。"}
{"title": "新型蠕虫病毒攻击服务器，政企电脑变矿机", "url": "https://www.freebuf.com/articles/database/201525.html", "time": "2019-05-02", "level": "", "num_look": 148058, "num_comment": 2, "author": "火绒安全", "tags": ["数据安全", "网络安全"], "text": "蠕虫病毒“MinerGuard”出现新变种，严重威胁企业用户。该病毒可跨平台（Windows、linux）交叉感染。"}
{"title": "Fracker：PHP函数调用追踪与分析工具", "url": "https://www.freebuf.com/sectool/201867.html", "time": "2019-05-01", "level": "", "num_look": 109349, "num_comment": 109349, "author": "secist", "tags": ["工具"], "text": "Fracker是一套PHP函数调用追踪与分析的工具，其目标是在PHP应用程序的手动安全评估期间协助安全研究人员。"}
{"title": "挖洞经验丨客户支持聊天系统中的IDOR漏洞（$5,000）", "url": "https://www.freebuf.com/vuls/201276.html", "time": "2019-05-01", "level": "", "num_look": 190827, "num_comment": 3, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "今天分享一个关于客户支持系统的IDOR漏洞，该漏洞可以导致目标系统的访问控制功能失效，实现客户支持平台内的任意消息读取和发送。"}
{"title": "防代码泄漏的监控系统架构与实践", "url": "https://www.freebuf.com/articles/es/201845.html", "time": "2019-05-01", "level": "现金奖励", "num_look": 275156, "num_comment": 33, "author": "糖果L5Q", "tags": ["企业安全"], "text": "本文在此之外提出了一种对内监控的方案，以SVN监控为例。从相关人员从内部系统下载时就行一定成度的监控审计，对下载者的下载量和行为进行分析，这个出发点建立一个监控系统。"}
{"title": "Microsoft Edge和IE浏览器同源策略绕过漏洞分析", "url": "https://www.freebuf.com/vuls/200131.html", "time": "2019-05-01", "level": "", "num_look": 110416, "num_comment": 110416, "author": "alphalab", "tags": ["漏洞", "网络安全"], "text": "最近爆出了IE浏览器和Edge浏览器跨域获取敏感信息的漏洞（绕过同源策略），不过并未被微软承认，于是通过一系列深度测试，看看此漏洞是否真实严重。"}
{"title": "还在随便下载软件？CNCERT公布116个高危恶意程序", "url": "https://www.freebuf.com/news/201981.html", "time": "2019-05-01", "level": "", "num_look": 99718, "num_comment": 4, "author": "安数君", "tags": ["资讯"], "text": "2019年2月期间，国家互联网应急中心（简称“CNCERT”）在全国范围内继续开展计算机恶意程序传播渠道安全监测工作，本月对外发布了结果。"}
{"title": "PTAA：一款功能强大的紫队自动化渗透测试工具", "url": "https://www.freebuf.com/articles/system/201578.html", "time": "2019-04-30", "level": "", "num_look": 144929, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "通过研究，我们设计出了MITRE ATT&CK™ TTPs，并以Metasploit Framework的模块形式呈现-post模块。"}
{"title": "针对Memcached缓存服务器的渗透测试方法介绍", "url": "https://www.freebuf.com/articles/web/201086.html", "time": "2019-04-30", "level": "", "num_look": 138131, "num_comment": 8, "author": "secist", "tags": ["WEB安全"], "text": "本文我们将学习多种利用Memcached Server的方法。"}
{"title": "腾讯招聘安全工程师", "url": "https://www.freebuf.com/jobs/202052.html", "time": "2019-04-30", "level": "", "num_look": 172392, "num_comment": 2, "author": "longhuayiyuan", "tags": ["安全招聘"], "text": "腾讯（www.tencent.com）成立于1998年11月，是目前中国领先的互联网增值服务提供商之一现因业务需要招聘安全人才。"}
{"title": "缓冲区溢出实战教程系列（三）：利用OllyDbg了解程序运行机制", "url": "https://www.freebuf.com/articles/system/198149.html", "time": "2019-04-30", "level": "现金奖励", "num_look": 137116, "num_comment": 5, "author": "kaliking", "tags": ["系统安全"], "text": "想要进行缓冲区溢出的分析与利用，当然就要懂得程序运行的机制。今天我们就用动态分析神器ollydbg来了解一下在windows下程序是如何运行的。"}
{"title": "浅析某针对乌克兰国防和经济部门的大规模钓鱼事件", "url": "https://www.freebuf.com/articles/network/201788.html", "time": "2019-04-30", "level": "", "num_look": 125286, "num_comment": 4, "author": "小河西村安全研究所", "tags": ["网络安全"], "text": "此前，检测到多起针对乌克兰国防和经济部门的攻击事件。在短暂的分析之后，发现这是一起持续且大规模的网络间谍活动，乌克兰是主要的受害国。"}
{"title": "BUF早餐铺丨GoDaddy宣布移除1.5万个涉嫌销售假冒产品的欺诈子域名；贾跃亭和乐视网涉嫌信息披露违法违规等行为，证监会立案调查", "url": "https://www.freebuf.com/news/202414.html", "time": "2019-04-30", "level": "", "num_look": 191361, "num_comment": 191361, "author": "Karunesh91", "tags": ["资讯"], "text": "GoDaddy宣布移除1.5万个涉嫌销售假冒产品的欺诈子域名；贾跃亭和乐视网涉嫌信息披露违法违规等行为，证监会立案调查"}
{"title": "Dirmap：一款高级Web目录文件扫描工具", "url": "https://www.freebuf.com/sectool/200890.html", "time": "2019-04-29", "level": "金币+10", "num_look": 860169, "num_comment": 62, "author": "H4ckForJob", "tags": ["工具", "网络安全"], "text": "本人是一名立志安全开发的大学生，有时刷src的时候，要检查所有target的web业务系统是否泄露敏感目录、文件，于是Dirmap诞生了~"}
{"title": "后渗透工具Koadic实战", "url": "https://www.freebuf.com/sectool/200904.html", "time": "2019-04-29", "level": "", "num_look": 154382, "num_comment": 4, "author": "secist", "tags": ["工具"], "text": "Koadic是发布于DEFCON上的一个后渗透工具，它可用于以上列举的最后两个阶段，即权限维持和数据渗漏。"}
{"title": "等保2.0将至，解读新标准的变化", "url": "https://www.freebuf.com/articles/es/201918.html", "time": "2019-04-29", "level": "现金奖励", "num_look": 788488, "num_comment": 22, "author": "宇宸de研究室", "tags": ["企业安全", "标准与合规"], "text": "本文从《网络安全法》角度介绍关键信息基础设施和等级保护安全工作的核心，同时对“等保 2.0”通用安全部分的变化进行分析和解读。"}
{"title": "国票信息招聘安全工程师", "url": "https://www.freebuf.com/jobs/201915.html", "time": "2019-04-29", "level": "", "num_look": 119548, "num_comment": 3, "author": "canyezhizi", "tags": ["安全招聘"], "text": "国票信息承载着推进国家税务信息化建设，提升全社会财税体系运转效率的重任，帮助成千上万企业优化财税业务处理流程，降低管理成本，提升管理效率，已成为全国一流的税务信息化解决方案服务商。"}
{"title": "提高全员安全意识的6个方向", "url": "https://www.freebuf.com/articles/es/201837.html", "time": "2019-04-29", "level": "", "num_look": 180212, "num_comment": 4, "author": "Freddy", "tags": ["企业安全"], "text": "要建好“人民防线”，离不开良好的人员操作机制和安全意识提升计划。通过制定周密的安全意识提升项目，员工能够主动担负起责任，更好地保护企业数字资产和识产权。"}
{"title": "一文看懂认证安全问题总结篇", "url": "https://www.freebuf.com/articles/web/201772.html", "time": "2019-04-29", "level": "现金奖励", "num_look": 446146, "num_comment": 2, "author": "littlepotato", "tags": ["WEB安全"], "text": "看认证相关的安全问题也有一段实践了，现对认证相关的安全问题做个总结。"}
{"title": "Weblogic反序列化远程代码执行漏洞（CVE-2019-2725）分析报告", "url": "https://www.freebuf.com/articles/web/202203.html", "time": "2019-04-29", "level": "", "num_look": 607386, "num_comment": 1, "author": "云影实验室", "tags": ["WEB安全"], "text": "4月17日，国家信息安全漏洞共享平台（CNVD）公开了Weblogic反序列化远程代码执行漏洞（CNVD-C-2019-48814）。"}
{"title": "BUF早餐铺丨iLnkP2P弱点暴露数百万物联网设备；美军切断最大军事基地电源以此来测试网络攻击下的真实反应；网信办等启动剑网2019专项整治", "url": "https://www.freebuf.com/news/202313.html", "time": "2019-04-29", "level": "", "num_look": 83204, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "iLnkP2P弱点暴露数百万物联网设备；美军切断最大军事基地电源以此来测试网络攻击下的真实反应；网信办等启动剑网2019专项整治。"}
{"title": "Flashmingo：SWF文件自动化分析工具", "url": "https://www.freebuf.com/sectool/201574.html", "time": "2019-04-29", "level": "", "num_look": 78412, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "flashmingo是FireEye最新发布的一个用于自动分析SWF文件的框架。它可以自动对可疑的Flash文件进行分类，并进一步的指导分析过程。Flashmingo可作为独立的工具，也可以作为库的一部分集成到分析工作流中。"}
{"title": "不再局限于源代码，老司机教你独家代码审计姿势", "url": "https://www.freebuf.com/fevents/202266.html", "time": "2019-04-28", "level": "", "num_look": 108182, "num_comment": 108182, "author": "FB客服", "tags": ["FreeBuf公开课", "活动"], "text": "以逆向思维模式进行代码审计，讲解web应用的代码审计思路及物联网设备固件的代码审计思路进行深入的剖析。"}
{"title": "因广告欺诈及滥用权限，百度子公司数十款应用被Google Play封杀", "url": "https://www.freebuf.com/news/202248.html", "time": "2019-04-28", "level": "红色标题", "num_look": 115398, "num_comment": 9, "author": "Allen别bb", "tags": ["资讯"], "text": "除了点击广告的欺诈手段之外，Do Global旗下部分软件还普遍存在权限滥用的问题，例如其中一个手电筒应用 AIO Flashlight 获取了31权限，其中7个属于危险权限。"}
{"title": "APT34泄密武器分析报告", "url": "https://www.freebuf.com/articles/database/202303.html", "time": "2019-04-28", "level": "", "num_look": 219350, "num_comment": 4, "author": "东巽科技", "tags": ["数据安全", "网络安全"], "text": "自2014年起，持续对中东及亚洲等地区发起APT攻击，涉猎行业主要包含政府、金融、能源、电信等。多年来，攻击武器库不断升级，攻击手法也不断推陈出新，并且攻击行为不会因为被曝光而终止。"}
{"title": "从攻击者角度重新思索inotity API的利用方式", "url": "https://www.freebuf.com/articles/system/200396.html", "time": "2019-04-28", "level": "金币+8", "num_look": 91342, "num_comment": 3, "author": "菲哥哥", "tags": ["系统安全"], "text": "我们以往在看”inotify API”的使用的时候，关注点都放在防护端，本文我们将重点放在攻击方，让你熟悉inotify API的猥琐使用方式：）"}
{"title": "深信服科技2019年安全招聘收尾一波", "url": "https://www.freebuf.com/jobs/201833.html", "time": "2019-04-28", "level": "", "num_look": 123154, "num_comment": 7, "author": "suifeng-刘军", "tags": ["安全招聘"], "text": "深信服科技股份有限公司是一家专注于企业级安全、云计算及基础架构的产品、服务和解决方案供应商。"}
{"title": "号称“十分在意用户隐私”的恶意软件罗宾汉是个啥？", "url": "https://www.freebuf.com/news/201080.html", "time": "2019-04-28", "level": "", "num_look": 131636, "num_comment": 2, "author": "Karunesh91", "tags": ["资讯"], "text": "一种新的恶意软件出现并开始广泛传播。该软件会自动加密它们访问到的计算机，随后会向用户索要一定数量的比特币作为赎金。"}
{"title": "聊聊AWD攻防赛流程及准备经验", "url": "https://www.freebuf.com/articles/network/201222.html", "time": "2019-04-28", "level": "金币+8", "num_look": 781448, "num_comment": 17, "author": "LiN3ver5ec", "tags": ["网络安全"], "text": "攻击别人的靶机可以获取 Flag 分数时，别人会被扣分，同时你也要保护自己的主机不被别人得分，以防扣分。"}
{"title": "真假文件夹？FakeFolder病毒再次捣乱企业内网", "url": "https://www.freebuf.com/articles/system/201656.html", "time": "2019-04-28", "level": "", "num_look": 129746, "num_comment": 6, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近期，深信服安全团队接到客户反馈，内网中出现了大量伪造成文件夹的可疑exe文件，删掉以后仍会反复。"}
{"title": "jQuery CVE-2019-11358原型污染漏洞分析和修复建议", "url": "https://www.freebuf.com/vuls/201762.html", "time": "2019-04-28", "level": "", "num_look": 152927, "num_comment": 1, "author": "奇安信代码卫士", "tags": ["漏洞"], "text": "jQuery官方于日前发布安全预警通告，通报了漏洞编号为 CVE-2019-11358的原型污染漏洞。"}
{"title": "BUF早餐铺 | 高通近40款芯片被曝出泄密漏洞，可窃取机密信息；Google 封杀中国应用开发商 DO Global；泄露公司源代码造成超百万损失，大疆前员工被罚20万、获刑半年", "url": "https://www.freebuf.com/news/202179.html", "time": "2019-04-28", "level": "", "num_look": 90214, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "Docker Hub 数据库遭未经授权访问；微软放弃了 60 天密码过期政策；新报告称微软Office平台已成网络攻击的一大受害者。"}
{"title": "IoT-Home-Guard：一款可检测物联网设备中恶意行为的工具", "url": "https://www.freebuf.com/articles/terminal/198163.html", "time": "2019-04-27", "level": "", "num_look": 160597, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "本文介绍一款名叫IoT-Home-Guard的安全检测工具，广大研究人员可使用该工具来检测物联网设备中的恶意行为。"}
{"title": "挖洞经验 | 通过密码重置功能构造HTTP Leak实现任意账户劫持", "url": "https://www.freebuf.com/vuls/200748.html", "time": "2019-04-27", "level": "", "num_look": 149881, "num_comment": 5, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文分享的是，作者在参与某次漏洞邀请测试项目中，发现目标应用服务的密码重置请求存在HTML注入漏洞（HTML injection）。"}
{"title": "肚脑虫团伙利用新特种安卓木马StealJob的攻击分析", "url": "https://www.freebuf.com/articles/terminal/201246.html", "time": "2019-04-27", "level": "", "num_look": 128522, "num_comment": 2, "author": "奇安信威胁情报中心", "tags": ["终端安全"], "text": "肚脑虫(APT-C-35)，主要针对巴基斯坦等南亚地区国家进行网络间谍活动的组织。针对政府机构等领域进行攻击，以窃取敏感信息为主要目的。"}
{"title": "【BUF大事件】B站后台源码泄露，GitHub公开DMCA删除通知；作案7年之久的盗号天团浮出水面；新型赌博黑产攻击肆虐网吧", "url": "https://www.freebuf.com/video/202136.html", "time": "2019-04-27", "level": "红色标题", "num_look": 164969, "num_comment": 1, "author": "willhuang", "tags": ["视频"], "text": "B站后台源码“被开源”，GitHub公开DMCA删除通知；作案7年之久的盗号天团浮出水面；新型赌博黑产攻击肆虐网吧，引流盗号一条龙；FreeBuf《2019企业安全威胁统一应对指南》即将发布。"}
{"title": "DDoS攻击新趋势：海量移动设备成为新一代肉鸡", "url": "https://www.freebuf.com/articles/network/201615.html", "time": "2019-04-27", "level": "", "num_look": 155858, "num_comment": 8, "author": "阿里云安全", "tags": ["网络安全"], "text": "近期，阿里云安全团队观察到数十起大规模的应用层资源耗尽式DDoS攻击（应用层CC攻击），这类攻击存在一些共同的特征。"}
{"title": "LAPSToolkit：一款功能强大的LAPS环境安全审计与渗透测试工具", "url": "https://www.freebuf.com/sectool/200880.html", "time": "2019-04-26", "level": "", "num_look": 107081, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫LAPSToolkit的工具，广大研究人员可以利用该工具来对LAPS环境进行安全审计或渗透测试。"}
{"title": "从源码层面看一款精致的病毒软件应具备哪些特质", "url": "https://www.freebuf.com/articles/system/200923.html", "time": "2019-04-26", "level": "现金奖励", "num_look": 343258, "num_comment": 21, "author": "F_F", "tags": ["系统安全"], "text": "故事起源于去年11月份，我搭建了一个dvwa的靶场环境，用于web漏洞的测试，不经意的发现access log日志增长迅速，查看之后吓出一身冷汗。"}
{"title": "挖洞经验 | 利用CSRF漏洞劫持Youtube用户的通知消息", "url": "https://www.freebuf.com/vuls/200711.html", "time": "2019-04-26", "level": "", "num_look": 140392, "num_comment": 4, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "今天分享的writeup是关于YouTube通知服务（Notification）的CSRF漏洞，作者利用该漏洞可以劫持其他YouTube用户（受害者）的通知服务。"}
{"title": "美菜安全团队快速筹建中，各大岗位等你来", "url": "https://www.freebuf.com/jobs/201967.html", "time": "2019-04-26", "level": "", "num_look": 113454, "num_comment": 6, "author": "FB客服", "tags": ["安全招聘"], "text": "作为中国餐饮供应链杰出服务商，美菜一直致力于用前卫的理念和先进的科技改变落后的中国农业市场，“买菜卖菜上美菜”深入人心。"}
{"title": "等级保护2.0研讨大会| 企业安全俱乐部「深圳站」议题征集", "url": "https://www.freebuf.com/fevents/202008.html", "time": "2019-04-26", "level": "", "num_look": 74693, "num_comment": 2, "author": "FB独家", "tags": ["活动"], "text": "5月30日，「FreeBuf 企业安全俱乐部」系列沙龙活动「等级保护2.0研讨专场」将在深圳盛大开幕。挚邀请您参与到本次等级保护2.0研讨大会议题征集活动中。"}
{"title": "威胁情报在态势感知系统中的一种落地尝试", "url": "https://www.freebuf.com/articles/security-management/200882.html", "time": "2019-04-26", "level": "金币+8", "num_look": 216069, "num_comment": 7, "author": "yisoso", "tags": ["安全管理"], "text": "在态势感知火热、威胁情报赚足眼球的今天，这两个信息安全领域当红小生发生碰撞，会产生怎样的火花呢？下面我根据手头上的项目，介绍一种威胁情报在态势感知系统中的落地方案，为大家提供一种思路。"}
{"title": "《权力的游戏》相关的网络钓鱼及避免方法", "url": "https://www.freebuf.com/articles/network/201591.html", "time": "2019-04-26", "level": "红色标题", "num_look": 111832, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "网络犯罪分子已经开始利用大家对《权利的游戏》的热情，进行网络钓鱼诈骗了！"}
{"title": "冲突的公链！来自P2P协议的异形攻击漏洞", "url": "https://www.freebuf.com/vuls/201373.html", "time": "2019-04-26", "level": "", "num_look": 223659, "num_comment": 2, "author": "SlowMist慢雾科技", "tags": ["区块链安全", "漏洞"], "text": "当我们谈论区块链时，总是离不开这些技术：分布式存储、P2P网络和共识机制，本次我们要谈的问题就是出现在P2P对等网络协议上。"}
{"title": "海莲花APT组织2019年第一季度针对中国的攻击活动技术揭秘", "url": "https://www.freebuf.com/articles/network/201940.html", "time": "2019-04-26", "level": "", "num_look": 271806, "num_comment": 1, "author": "腾讯电脑管家", "tags": ["网络安全"], "text": "在2019年第一季度，腾讯御见威胁情报中心持续的检测到该组织针对中国大陆的政府、海事机构、商务部门、研究机构的攻击活动。"}
{"title": "BUF早餐铺 | 安全漏洞可以让攻击者可以从高通芯片中恢复私钥；Facebook可能因数据滥用而面临50亿美元的FTC罚款；Oracle WebLogic爆出零日漏洞", "url": "https://www.freebuf.com/news/201880.html", "time": "2019-04-26", "level": "", "num_look": 68384, "num_comment": 68384, "author": "Freddy", "tags": ["资讯"], "text": "联邦贸易委员会（FTC）对Facebook发起的长达一年的数据安全调查已接近尾声，Facebook可能面临高达50亿美元的罚款。"}
{"title": "【学习笔记】记一次服务器入侵溯源 | FreeBuf × 破壳学院训练营", "url": "https://www.freebuf.com/fevents/201963.html", "time": "2019-04-25", "level": "", "num_look": 131062, "num_comment": 5, "author": "FB客服", "tags": ["活动"], "text": "2019年4月24日，在线课程《WEB安全入门急速训练营》进驻FREEBUF平台正式第五期招生，课程共计7章57节751分钟教学，将在60天内系统化的让你入门WEB安全。"}
{"title": "Mad-Metasploit：一款多功能Metasploit自定义模块、插件&资源脚本套件", "url": "https://www.freebuf.com/sectool/200172.html", "time": "2019-04-25", "level": "", "num_look": 144340, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Mad-Metasploit是一款针对Metasploit的多功能框架，该框架提供了多种自定义模块、插件和资源脚本。"}
{"title": "挖洞经验 | 与Yahoo和Paypal相关的两个独特漏洞（$5k+$3.2k）", "url": "https://www.freebuf.com/vuls/200317.html", "time": "2019-04-25", "level": "", "num_look": 127911, "num_comment": 4, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文分享的是与Yahoo和Paypal相关的两个独特漏洞，一个为Yahoo的IDOR漏洞（不安全的直接对象引用），另一个为Paypal的DoS漏洞。"}
{"title": "奇安信代码卫士急招热招岗位等你来", "url": "https://www.freebuf.com/jobs/200566.html", "time": "2019-04-25", "level": "", "num_look": 121569, "num_comment": 1, "author": "奇安信代码卫士", "tags": ["安全招聘"], "text": "「奇安信代码卫士」是奇安信旗下专注于软件源代码安全的产品线，能力涵盖了源代码缺陷检测、源代码合规检测、源代码溯源检测三大方向。"}
{"title": "赛门铁克2019年互联网安全威胁报告：数据篇", "url": "https://www.freebuf.com/news/201265.html", "time": "2019-04-25", "level": "", "num_look": 178641, "num_comment": 1, "author": "Karunesh91", "tags": ["安全报告", "资讯"], "text": "上一篇介绍了大致的威胁来源，本篇将针对威胁具体案例的分析结果进行详细解析。"}
{"title": "新型赌博黑产攻击肆虐网吧：LOL博彩引流&棋牌盗号", "url": "https://www.freebuf.com/articles/system/201459.html", "time": "2019-04-25", "level": "", "num_look": 140987, "num_comment": 1, "author": "安全豹", "tags": ["系统安全"], "text": "黑产利用QQ空间来进行群发广告进行导流的情况，想必大家都已见过，但对于单纯的发布引流广告带来的收益，他们似乎并不满足。"}
{"title": "BUF早餐铺 | GitHub公开Bilibili寄来的DMCA删除通知；FBI发布2018年《互联网犯罪报告》；火眼研究人员公开Carbanak的源代码", "url": "https://www.freebuf.com/news/201859.html", "time": "2019-04-25", "level": "", "num_look": 94727, "num_comment": 3, "author": "AngelaY", "tags": ["资讯"], "text": "扎克伯格因Facebook在隐私问题上所犯的错误而受到抨击；ShadowHammer 攻击针对多个公司，华硕只是其中之一；新 Microsoft Edge 会冒充其它浏览器。"}
{"title": "数据治理与安全运营 | 企业安全俱乐部「上海站」看点回顾", "url": "https://www.freebuf.com/fevents/201874.html", "time": "2019-04-25", "level": "", "num_look": 154727, "num_comment": 154727, "author": "FB独家", "tags": ["活动"], "text": "2019年4月24日，《复仇者联盟4：终局之战》上映（并不）「FreeBuf 企业安全俱乐部」系列沙龙活动「数据治理与安全运营」在上海证大美爵酒店木兰厅盛大开幕。"}
{"title": "Arjun v1.3：一款功能强大的HTTP参数挖掘套件", "url": "https://www.freebuf.com/sectool/200175.html", "time": "2019-04-24", "level": "", "num_look": 125807, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Arjun的开源工具，广大研究人员可以利用该工具来对HTTP参数进行提取和分析。"}
{"title": "三种对CORS错误配置的利用方法", "url": "https://www.freebuf.com/articles/web/200350.html", "time": "2019-04-24", "level": "", "num_look": 170535, "num_comment": 1, "author": "secist", "tags": ["WEB安全"], "text": "作为安全分析师/工程师，了解如何利用错误配置的CORS标头非常重要。这也将有助于你在灾难发生之前更好地对其进行补救。"}
{"title": "恶意SDK无感刷百度广告，数千款APP植入影响千万用户", "url": "https://www.freebuf.com/articles/terminal/201714.html", "time": "2019-04-24", "level": "", "num_look": 207209, "num_comment": 4, "author": "腾讯手机管家", "tags": ["终端安全"], "text": "腾讯安全反诈骗实验室追踪到暴风影音、天天看、塔读文学等众多应用中集成的某SDK存在下载恶意子包，通过webview配合js脚本在用户无感知的情况下刷百度广告的恶意操作。"}
{"title": "因Edge文件权限与IE发生冲突可导致XXE攻击", "url": "https://www.freebuf.com/news/201370.html", "time": "2019-04-24", "level": "", "num_look": 125914, "num_comment": 2, "author": "Karunesh91", "tags": ["网络安全", "资讯"], "text": "安全研究员John Page在3月27日向发现了微软的一个XXE漏洞并向其报告了具体情况，随后于4月10日发布了漏洞详情。"}
{"title": "带外通道技术（OOB）总结", "url": "https://www.freebuf.com/articles/web/201013.html", "time": "2019-04-24", "level": "金币+8", "num_look": 217715, "num_comment": 5, "author": "罹♛殇", "tags": ["WEB安全"], "text": "一次OOB攻击能够成功逃避监控，绕过防火墙且能更好的隐藏自己。"}
{"title": "BUF早餐铺 | 全国首宗“爬虫”软件案在深审结；全球大使馆遭 Excel 鱼叉式钓鱼攻击；FTC发布报告呼吁民众警惕巴黎圣母院慈善骗子", "url": "https://www.freebuf.com/news/201774.html", "time": "2019-04-24", "level": "", "num_look": 95159, "num_comment": 95159, "author": "shidongqi", "tags": ["资讯"], "text": "深圳中级人民法院发布了2018年度深圳法院知识产权司法保护状况白皮书和2018年度深圳法院知识产权十大典型案例，其中包括了全国首宗“爬虫”软件案。"}
{"title": "小心了！ “盗号天团”盯上了你的LOL帐号！", "url": "https://www.freebuf.com/articles/database/201713.html", "time": "2019-04-23", "level": "", "num_look": 165803, "num_comment": 7, "author": "360安全中心", "tags": ["数据安全", "网络安全"], "text": "近日，一个作案时间长达7年之久的盗号团伙被发现，该团伙捆绑了多种游戏外挂软件植入盗号木马，并通过倒卖这些账户最终获利。"}
{"title": "Just-Metadata：帮你自动化收集和分析IP地址元数据的强大工具", "url": "https://www.freebuf.com/sectool/200885.html", "time": "2019-04-23", "level": "", "num_look": 119861, "num_comment": 119861, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Just-Metadata的工具，该工具可以帮助研究人员收集和分析IP地址元数据，并通过大量数据集寻找目标网络系统之间的层级关系。"}
{"title": "一文彻底搞懂安卓WebView白名单校验", "url": "https://www.freebuf.com/articles/terminal/201407.html", "time": "2019-04-23", "level": "现金奖励", "num_look": 336338, "num_comment": 16, "author": "rebeyond", "tags": ["终端安全"], "text": "本人结合产品中容易出现问题的地方，用实例的方式来总结一下如何正确使用WebView白名单，给开发的兄弟们作为参考。"}
{"title": "看我如何绕过WAF的XSS检测机制", "url": "https://www.freebuf.com/articles/web/200180.html", "time": "2019-04-23", "level": "", "num_look": 239848, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "本文提出了一种绕过XSS安全机制的新型方法，这种技术由三个阶段组成：确定Payload结构、探测和混淆处理。"}
{"title": "内网穿透Windows（SMB）自认证的利用", "url": "https://www.freebuf.com/vuls/201094.html", "time": "2019-04-23", "level": "红色标题", "num_look": 342731, "num_comment": 15, "author": "꧁", "tags": ["漏洞", "网络安全"], "text": "SMB又名网络文件共享文件，顾名思义其作用是用于用户与服务端之间的文件交互。默认端口为139，445。"}
{"title": "新浪安全2019年招聘计划", "url": "https://www.freebuf.com/jobs/201452.html", "time": "2019-04-23", "level": "", "num_look": 117908, "num_comment": 7, "author": "-吗_啡-", "tags": ["安全招聘"], "text": "新浪安全2019年人才招聘计划推出，诚聘 如下岗位，欢迎大家推荐自荐！"}
{"title": "等保到底是个啥（七）：系统运维管理部分", "url": "https://www.freebuf.com/articles/es/200879.html", "time": "2019-04-23", "level": "现金奖励", "num_look": 510939, "num_comment": 6, "author": "宇宸de研究室", "tags": ["企业安全", "标准与合规"], "text": "文中内容都是个人观点，如有不对的地方欢迎纠正。文章以等保三级系统为基础，从合规角度解读要求。"}
{"title": "数据治理与安全运营 | FreeBuf企业安全俱乐部（上海站）明日开启", "url": "https://www.freebuf.com/fevents/198897.html", "time": "2019-04-23", "level": "", "num_look": 141054, "num_comment": 4, "author": "FB独家", "tags": ["企业资讯", "活动"], "text": "4月24日，「FreeBuf企业安全俱乐部」在魔力之都上海开幕，主题关注数据智理与安全运营，聚焦金融数据泄露等年度热点话题，立足企业数据安全层面，深入探讨企业信息安全技术与实践应用。"}
{"title": "BUF早餐铺丨搜Wi-Fi热点Android应用数据泄露：涉200多万WiFi密码；B站网站后台工程源码疑似泄露，内含部分用户名密码；NCSC发布最常被黑客入侵的密码列表", "url": "https://www.freebuf.com/news/201677.html", "time": "2019-04-23", "level": "", "num_look": 96020, "num_comment": 3, "author": "Karunesh91", "tags": ["资讯"], "text": "搜Wi-Fi热点Android应用数据泄露：涉200多万WiFi密码；B站网站后台工程源码疑似泄露，内含部分用户名密码；NCSC发布最常被黑客入侵的密码列表。"}
{"title": "B站后台疑似“被开源”数小时，官方回应内容两次秒删", "url": "https://www.freebuf.com/news/201655.html", "time": "2019-04-22", "level": "红色标题", "num_look": 271985, "num_comment": 12, "author": "Allen别bb", "tags": ["资讯"], "text": "4月22日下午，哔哩哔哩后台源码在GitHub上“被开源”，引发了很多用户关注，而在暴露长达数小时之后，该项目悉数被屏蔽，包括大量用户Fork的部分也无法访问。"}
{"title": "FFM：功能强大的开源渗透测试工具，帮你开启自由攻击模式的“新大陆“", "url": "https://www.freebuf.com/sectool/200884.html", "time": "2019-04-22", "level": "", "num_look": 201704, "num_comment": 201704, "author": "Alpha_h4ck", "tags": ["工具"], "text": "FFM是一款采用Python开发的开源渗透测试工具，广大研究人员可以将FFM用于红队任务的后渗透测试阶段。"}
{"title": "看我如何揪出远控背后的幕后黑手", "url": "https://www.freebuf.com/vuls/200895.html", "time": "2019-04-22", "level": "现金奖励", "num_look": 1371534, "num_comment": 49, "author": "日理万鸡", "tags": ["漏洞", "网络安全"], "text": "写这篇文章时，这次的渗透已经完成一周多了，当时也没有想到会要写文章出来，所以有一部截图是后来补上的，为了我的人身安全，有涉及到的敏感信息，我都会打码，请多多包涵。"}
{"title": "挖洞经验丨看我如何获取Facebook用户的隐私好友列表", "url": "https://www.freebuf.com/vuls/199858.html", "time": "2019-04-22", "level": "", "num_look": 186767, "num_comment": 8, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "当拥有个人信息的组织机构发生数据失窃或遭受未授权访问行为时，就可能发生用户信息泄露事件。"}
{"title": "送书福利 | 君哥的十年陈酿，金融行业安全建设指南", "url": "https://www.freebuf.com/fevents/200750.html", "time": "2019-04-22", "level": "红色标题", "num_look": 1451686, "num_comment": 50, "author": "Freddy", "tags": ["活动"], "text": "本书是金融行业资深信安专家十余年实战经验的结晶，全方位介绍如何打造企业安全管理机制和安全技术架构。"}
{"title": "DNS劫持欺骗病毒“自杀”", "url": "https://www.freebuf.com/articles/system/201032.html", "time": "2019-04-22", "level": "现金奖励", "num_look": 241805, "num_comment": 21, "author": "云絮", "tags": ["系统安全"], "text": "某天忽然发现公司上百台机器中了变种的挖矿病毒DTLMiner，该病毒传播方式有多种，主要利用永恒之蓝漏洞、弱口令、mimikatz抓取域密码，数据库弱口令等方式传播，中毒后的机器会沦为挖矿机。"}
{"title": "聊聊风险评估的由来和相关标准、运营商符合性评测", "url": "https://www.freebuf.com/articles/security-management/200425.html", "time": "2019-04-22", "level": "现金奖励", "num_look": 195912, "num_comment": 4, "author": "redhatd", "tags": ["安全管理"], "text": "本文重点讲解风险评估相关标准、符合性评测，让大家对风险评估标准和运营商安全服务有个基本了解。"}
{"title": "杭州萤石网络招聘安全工程师", "url": "https://www.freebuf.com/jobs/201386.html", "time": "2019-04-22", "level": "", "num_look": 68950, "num_comment": 2, "author": "SixSixSix", "tags": ["安全招聘"], "text": "萤石，是安全智能生活主流品牌，是海康威视旗下消费者业务实体，利用智能硬件、互联网云服务、人工智能（AI）和机器人等技术，努力为用户打造一个智能化的工作、生活和学习环境。"}
{"title": "BUF早餐铺 | WannaCry救星承认开发、传播银行木马Kronos；美国天气频道遭勒索软件攻击，停止直播1个多小时；法国政府发布它开发的端对端加密消息应用", "url": "https://www.freebuf.com/news/201552.html", "time": "2019-04-22", "level": "", "num_look": 93417, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "Marcus Hutchins，2017 年因发现 WannaCry 的关闭开关阻止了该勒索软件的进一步传播而被视为一位安全领域的英雄，本周 Hutchins 承认他开发了银行木马。"}
{"title": "Oracle WebLogic远程命令执行漏洞预警", "url": "https://www.freebuf.com/vuls/201542.html", "time": "2019-04-22", "level": "", "num_look": 208679, "num_comment": 1, "author": "Knownsec知道创宇", "tags": ["漏洞"], "text": "国家信息安全漏洞共享平台（CNVD）官方发布安全公告，称Oracle WebLogic wls9-async组件存在反序列化远程命令执行漏洞。"}
{"title": "Spring Cloud Config目录遍历漏洞（CVE-2019-3799）预警", "url": "https://www.freebuf.com/vuls/201400.html", "time": "2019-04-22", "level": "", "num_look": 177792, "num_comment": 177792, "author": "深信服千里目安全实验室", "tags": ["漏洞"], "text": "Spring Cloud Config目录遍历漏洞本质是允许应用程序通过spring-cloud-config-server模块获取任意配置文件，攻击者可以构造恶意URL实现目录遍历漏洞的利用。"}
{"title": "一款IP区间合并工具及如何使用Python实现相同功能", "url": "https://www.freebuf.com/sectool/199622.html", "time": "2019-04-21", "level": "现金奖励", "num_look": 969914, "num_comment": 10, "author": "ERFZE", "tags": ["工具"], "text": "现在将工具分享出来，希望能帮到大家，特别是需要处理大批量IP段或者内网时。"}
{"title": "如何发现Web App Yummy Days的安全漏洞？", "url": "https://www.freebuf.com/articles/web/200215.html", "time": "2019-04-21", "level": "", "num_look": 97492, "num_comment": 3, "author": "secist", "tags": ["WEB安全"], "text": "在本文中，我将向你展示我是如何发现Web App Yummy Days的安全漏洞的，以及如何构建一个简单的自动客户端，让我获得Yummy Days促销的奖品。"}
{"title": "安全：赋能数字新时代丨西湖论剑·网络安全大会day1实录", "url": "https://www.freebuf.com/news/201537.html", "time": "2019-04-21", "level": "红色标题", "num_look": 93698, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "西湖论剑·网络安全大会day1，带你领略主论坛的精彩丰呈。"}
{"title": "威胁情报的现在与未来：赋能、深入、全面应用", "url": "https://www.freebuf.com/articles/network/201190.html", "time": "2019-04-21", "level": "", "num_look": 145432, "num_comment": 2, "author": "Threatbook", "tags": ["网络安全"], "text": "今年将是威胁情报落地应用更加深入的一年。"}
{"title": "【BUF大事件】国家网信办整治违法聊天APP，你用的软件上榜了么？研究员披露一组Wi-Fi WPA3漏洞", "url": "https://www.freebuf.com/video/201522.html", "time": "2019-04-21", "level": "红色标题", "num_look": 129587, "num_comment": 1, "author": "willhuang", "tags": ["视频"], "text": "近期，国家网信办启动即时通信工具专项整治工作，针对即时通信工具传播违法违规信息、匿名注册、欺诈诱骗等行业乱象进行深入巡查和测试。"}
{"title": "ThinkPHP 5.1框架结合RCE漏洞的深入分析", "url": "https://www.freebuf.com/vuls/200585.html", "time": "2019-04-21", "level": "", "num_look": 222522, "num_comment": 3, "author": "alphalab", "tags": ["漏洞"], "text": "在前几个月，Thinkphp连续爆发了多个严重漏洞。由于框架应用的广泛性，漏洞影响非常大。为了之后更好地防御和应对此框架漏洞，国内安全实验室对Thinkphp框架进行了详细地分析，并在此分享给大家共同学习。"}
{"title": "mXtract：一款功能强大的内存数据提取&分析工具", "url": "https://www.freebuf.com/sectool/200886.html", "time": "2019-04-20", "level": "", "num_look": 149395, "num_comment": 149395, "author": "Alpha_h4ck", "tags": ["工具"], "text": "mXtract是一款开源的Linux安全工具，该工具可从目标系统的内存中提取并分析数据。"}
{"title": "挖洞经验 |  一次INSERT查询的无逗号SQL注入漏洞构造利用（$10k）", "url": "https://www.freebuf.com/vuls/200201.html", "time": "2019-04-20", "level": "", "num_look": 238563, "num_comment": 5, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文分享的是作者在一次众测中的SQL报错型注入漏洞发现过程。"}
{"title": "你被“侠盗”的蟹钳夹伤了吗？漫谈GANDCRAB", "url": "https://www.freebuf.com/articles/network/200760.html", "time": "2019-04-20", "level": "", "num_look": 96503, "num_comment": 96503, "author": "softnext守内安", "tags": ["网络安全"], "text": "GandCrab 第一次被大众关注是在 2018 年 1 月，由罗马尼亚的安全公司 Bitdefender、罗马尼亚警政署、欧洲刑警组织连手揭露了这个恶意勒索软件。"}
{"title": "WPA3已沦陷？解读Dragonblood Vulnerabilities", "url": "https://www.freebuf.com/articles/wireless/200876.html", "time": "2019-04-20", "level": "现金奖励", "num_look": 432355, "num_comment": 3, "author": "星空111", "tags": ["无线安全"], "text": "WPA3可提供个人和企业版本，将逐步取代WPA2，但它可能需要几年时间才能被广泛采用，没想到时隔不到1年，WPA3这么快就沦陷了。"}
{"title": "黑客泄露APT 34组织工具、成员信息，扬言更多秘密将持续曝光", "url": "https://www.freebuf.com/news/201501.html", "time": "2019-04-19", "level": "红色标题", "num_look": 188275, "num_comment": 12, "author": "shidongqi", "tags": ["资讯"], "text": "匿名黑客开始泄露伊朗间谍组织APT 34 所使用的黑客工具，甚至还包括团队成员及受害者数据信息等等。虽然目前来看所泄露的工具并没有永恒之蓝如此复杂，但依然引发了大量安全研究者的持续关注。"}
{"title": "ZMap扫描机制剖析", "url": "https://www.freebuf.com/sectool/200048.html", "time": "2019-04-19", "level": "现金奖励", "num_look": 184417, "num_comment": 3, "author": "Murkfox", "tags": ["工具"], "text": "本文主要通过分析 ZMap 的工作机制以及发包机制来探讨如何构造全网级快速端口扫描器。"}
{"title": "【FreeBuf字幕组】Web安全漏洞系列：不安全的直接对象引用漏洞IDOR", "url": "https://www.freebuf.com/video/201277.html", "time": "2019-04-19", "level": "红色标题", "num_look": 96638, "num_comment": 3, "author": "willhuang", "tags": ["视频"], "text": "本课程翻译自Youtube精选系列教程，对WEB应用技术相关的各种典型安全漏洞进行了贴近实战和深入浅出的介绍，喜欢的点一波关注。"}
{"title": "新型Anatova恶意软件分析", "url": "https://www.freebuf.com/articles/database/199895.html", "time": "2019-04-19", "level": "", "num_look": 107608, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["数据安全"], "text": "近期，我们发现了一种新型的勒索软件家族-Anatova。Anatova发现于一个私人的点对点（p2p）网络中，目前我们已经确保客户得到了有效的安全保护，并打算在这篇文章中公开我们的研究成果。"}
{"title": "端口扫描系统实践心得", "url": "https://www.freebuf.com/articles/es/201210.html", "time": "2019-04-19", "level": "现金奖励", "num_look": 230840, "num_comment": 13, "author": "Humou0", "tags": ["企业安全"], "text": "在网络上找相关资料时没有发现太多相关的文章，于是想写下这篇文章和大家分享一下代码，顺便讨教一下主机存活判断和指纹识别的问题，欢迎大佬们批评和指正。"}
{"title": "招人啦！2019小米安全团队招聘季启动！", "url": "https://www.freebuf.com/jobs/201243.html", "time": "2019-04-19", "level": "", "num_look": 99543, "num_comment": 6, "author": "小米安全中心", "tags": ["安全招聘"], "text": "小米的安全边界无限广阔，同时也充满挑战！我们涵盖电商、金服、视频、游戏等众多的业务线……我们期待你成为抵御外来威胁的中流砥柱！"}
{"title": "以数据为中心的安全体系建设 | 企业安全俱乐部「上海站」议题前瞻", "url": "https://www.freebuf.com/fevents/201409.html", "time": "2019-04-19", "level": "", "num_look": 64559, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "2019年4月24日，即将在上海举办的「FreeBuf企业安全俱乐部」上，来自阿里巴巴高级安全专家马建坤将为大家分享《以数据为中心的安全体系建设》 ，多维度助力企业构建完善的数据安全体系。"}
{"title": "挖矿木马“DTLMiner” 中毒后仿佛闻到了烧显卡的味道", "url": "https://www.freebuf.com/articles/network/199516.html", "time": "2019-04-19", "level": "", "num_look": 185762, "num_comment": 2, "author": "瑞星", "tags": ["网络安全"], "text": "近日，专家监测到挖矿木马病毒“DTLMiner”最新变种，目前，已有数千用户感染该挖矿病毒。"}
{"title": "门罗币挖矿&远控木马样本分析", "url": "https://www.freebuf.com/articles/system/200875.html", "time": "2019-04-19", "level": "", "num_look": 151988, "num_comment": 2, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "发现一起门罗币挖矿+木马的双功能样本。该样本回在执行挖矿的同时，可到指定站点下载具有远控功能的样本，获取受害主机信息，并进一步控制受害主机。"}
{"title": "BUF早餐铺 | 美国联邦通信委员会将以安全问题为由阻止中国移动进入美国市场；伊朗网络间谍工具源代码在Telegram泄露；超过1亿JustDial用户的数据发生泄露", "url": "https://www.freebuf.com/news/201318.html", "time": "2019-04-19", "level": "", "num_look": 102787, "num_comment": 2, "author": "Freddy", "tags": ["资讯"], "text": "中国移动告诉联邦通信委员会它并不打算在美国提供自己的电话服务，只是将现有服务扩展到更多地方。"}
{"title": "Lynis 2.7.3：一款针对Unix和Linux系统的多功能安全审计工具", "url": "https://www.freebuf.com/articles/system/200869.html", "time": "2019-04-18", "level": "", "num_look": 135354, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "Lynis是一款开源安全审计工具，广大系统管理员、安全专家和审计人员都可以利用该工具来对Linux以及类Unix系统进行安全审计。"}
{"title": "CNCERT发布《2018年我国互联网网络安全态势报告》", "url": "https://www.freebuf.com/articles/network/201280.html", "time": "2019-04-18", "level": "", "num_look": 237748, "num_comment": 237748, "author": "CNCERT", "tags": ["安全报告", "网络安全"], "text": "2018年，在中央网络安全和信息化委员会的统一领导下，我国进一步加强网络安全和信息化管理工作，各行业主管部门协同推进网络安全治理。"}
{"title": "车联网安全之给你的豪车来一套渗透测试", "url": "https://www.freebuf.com/articles/others-articles/199720.html", "time": "2019-04-18", "level": "", "num_look": 154716, "num_comment": 7, "author": "Alpha_h4ck", "tags": ["其他"], "text": "我们的各项研究表明，在装配了这些警报器之后，你的汽车将会变得更加不安全。"}
{"title": "云舒：欺骗防御未来已来", "url": "https://www.freebuf.com/articles/es/201020.html", "time": "2019-04-18", "level": "红色标题", "num_look": 659555, "num_comment": 32, "author": "默安科技_影武者实验室", "tags": ["企业安全"], "text": "近日拜读了了思睿嘉得CEO DJ的《真真假假的创新——RSAC2019之三》，写得非常好，也很佩服，是读完DJ的文章之后，兴起了写点文字的想法。"}
{"title": "Linux挖矿病毒DDG改造后重出江湖，蔓延Windows平台", "url": "https://www.freebuf.com/articles/system/200679.html", "time": "2019-04-18", "level": "", "num_look": 129693, "num_comment": 2, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "DDG挖矿病毒是一款在Linux系统下运行的恶意挖矿病毒，该病毒从去年一直活跃在现在，已经挖取了价值一千多万人民币的虚拟币货币。"}
{"title": "等保到底是个啥（六）：系统建设管理部分", "url": "https://www.freebuf.com/articles/security-management/200730.html", "time": "2019-04-18", "level": "现金奖励", "num_look": 279966, "num_comment": 3, "author": "宇宸de研究室", "tags": ["安全管理", "标准与合规"], "text": "本篇为管理要求中系统建设管理的部分，文中内容都是个人观点，如有不对的地方欢迎纠正。文章以等保三级系统为基础，从合规角度解读要求。本部分为人员安全和安全管理机构部分。"}
{"title": "通过Thinkphp框架漏洞所发现的安全问题", "url": "https://www.freebuf.com/articles/web/199894.html", "time": "2019-04-18", "level": "现金奖励", "num_look": 404086, "num_comment": 12, "author": "xianling", "tags": ["WEB安全"], "text": "在一次偶然的机会发现公司某个网站存在thinkphp的远程命令执行漏洞，自此对这个漏洞爱不释手。这究竟是为什么呢？"}
{"title": "给DNS划重点：分析ISC BIND必知必会", "url": "https://www.freebuf.com/vuls/200828.html", "time": "2019-04-18", "level": "金币+6", "num_look": 151699, "num_comment": 3, "author": "Yale1024", "tags": ["漏洞", "网络安全"], "text": "最近一直在分析dns协议的漏洞，分析过程中明显感到对所分析协议的理解程度不到位。"}
{"title": ".NET高级代码审计（第十一课） LosFormatter反序列化漏洞", "url": "https://www.freebuf.com/articles/web/201317.html", "time": "2019-04-18", "level": "", "num_look": 133825, "num_comment": 1, "author": "云影实验室", "tags": ["WEB安全"], "text": "如果要把ViewState 通过数据库或其他持久化设备来维持，需要采用特定的LosFormatter 类来序列化/反序列化。"}
{"title": "BUF早餐铺 | Scranos rootkit从中国扩散到全世界；厄瓜多尔政府和机构网站遭到4千万次攻击；国家网信办启动小众即时通信工具专项整治", "url": "https://www.freebuf.com/news/201305.html", "time": "2019-04-18", "level": "", "num_look": 75127, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "DuckDuckGo联手23家科技企业支持加州消费者隐私保护修正案；EA修复Origin客户端漏洞；国家互联网应急中心发布《2018年我国互联网网络安全态势综述》。"}
{"title": "Metasploit之文件解析远程代码执行（NAT穿透+IIS发布）", "url": "https://www.freebuf.com/articles/web/200519.html", "time": "2019-04-18", "level": "金币+6", "num_look": 129999, "num_comment": 10, "author": "星空111", "tags": ["WEB安全"], "text": "前几天确实太忙了，今天刚一得空，晚上熬夜写一篇，做任何事情都要坚持，不是吗？！"}
{"title": "Imago-Forensics：Python实现的图像数字取证工具", "url": "https://www.freebuf.com/sectool/200845.html", "time": "2019-04-17", "level": "", "num_look": 137096, "num_comment": 137096, "author": "secist", "tags": ["工具", "网络安全"], "text": "Imago是一个由python编写的图像数字取证工具，它可以从图像中递归提取数字证据。在整个数字取证调查中，这款工具非常有用。"}
{"title": "挖洞经验 | 下载Livestream网站中用户未公开或定期排播视频", "url": "https://www.freebuf.com/vuls/199750.html", "time": "2019-04-17", "level": "", "num_look": 119439, "num_comment": 1, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "最近，我发现了一个关于Livestream网站的漏洞，利用该漏洞可以获取其上任意注册用户的未公开或定期排播流视频内容。"}
{"title": "国汽智能网联汽车研究院招聘渗透测试工程师", "url": "https://www.freebuf.com/jobs/200651.html", "time": "2019-04-17", "level": "", "num_look": 105677, "num_comment": 8, "author": "betterlady", "tags": ["安全招聘"], "text": "国汽智联由中国智能网联汽车产业创新联盟发起，由中国汽车工业协会、中国汽车工程学会牵头，整合智能网联汽车行业核心创新资源共同组建。"}
{"title": "“速浪”家族构建VPN暗刷网络，百万用户遭遇安全危机", "url": "https://www.freebuf.com/articles/system/200930.html", "time": "2019-04-17", "level": "", "num_look": 129532, "num_comment": 2, "author": "安全豹", "tags": ["系统安全"], "text": "“速浪”家族从2014年开始一直是国内活跃流氓软件的佼佼者，该系列家族除了强锁主页、静默推广、强制弹窗等常见流氓行为外，核心恶意功能还包括构建流量暗刷僵尸网络。"}
{"title": "Miniupnpc Miniwget缓冲区溢出漏洞再分析", "url": "https://www.freebuf.com/vuls/200658.html", "time": "2019-04-17", "level": "现金奖励", "num_look": 96797, "num_comment": 1, "author": "j0hnShi", "tags": ["漏洞"], "text": "由于最近在挖掘一款程序漏洞, 看到此程序调用了 miniupnpc.dll 1.6.xxx, 发现存在几处安全漏洞本篇我们重点分析如何发现和如何验证的一些方法。"}
{"title": "浅析基于人格特征的内部高风险用户识别方法", "url": "https://www.freebuf.com/articles/network/200564.html", "time": "2019-04-17", "level": "现金奖励", "num_look": 125791, "num_comment": 5, "author": "木千之", "tags": ["网络安全"], "text": "随着信息化深入到各行各业关键业务流程 ，内部风险管控已经排上了甲方们安全管理部门优先处理事项的Top List，本文今天就向大家介绍一种基于人格特征的内部高风险用户识别方法"}
{"title": "BUF早餐铺 | 黑客Gnosticplayers兜售第五批数据；印度外包巨头遭入侵；国家网信办启动小众即时通信工具专项整治", "url": "https://www.freebuf.com/news/201191.html", "time": "2019-04-17", "level": "", "num_look": 66895, "num_comment": 66895, "author": "shidongqi", "tags": ["资讯"], "text": "国家网信办近日启动即时通信工具专项整治工作，首批清理关停“比邻”“聊聊”“密语”等9款传播淫秽色情信息，或为招嫖卖淫、售卖淫秽色情音视频等提供推广和平台服务的即时通信工具。"}
{"title": ".NET高级代码审计（第十课） ObjectStateFormatter反序列化漏洞", "url": "https://www.freebuf.com/articles/web/200957.html", "time": "2019-04-17", "level": "", "num_look": 95947, "num_comment": 95947, "author": "云影实验室", "tags": ["WEB安全"], "text": "使用反序列化不受信任的二进制文件会导致反序列化漏洞从而实现远程RCE攻击，本文笔者从原理和代码审计的视角做了相关介绍和复现。"}
{"title": "《中央企业负责人经营业绩考核办法》发布，首提网络安全考核要求", "url": "https://www.freebuf.com/news/201198.html", "time": "2019-04-16", "level": "", "num_look": 76175, "num_comment": 76175, "author": "FB客服", "tags": ["资讯"], "text": "2019年3月7日，国务院国有资产监督管理委员会发布了新版《中央企业负责人经营业绩考核办法》，该办法将于自2019年4月1日起施行。与旧版的考核办法不同的是，新的考核办法中增加了对网络安全事件的考核要求。"}
{"title": "告别复杂晦涩，一节课带你入坑侧信道", "url": "https://www.freebuf.com/fevents/200444.html", "time": "2019-04-16", "level": "", "num_look": 112539, "num_comment": 1, "author": "FB客服", "tags": ["FreeBuf公开课", "活动"], "text": "以一个普通安全研究者的视角出发，探索侧信道攻击的本质，通过侧信道攻击的事例使大家认识侧信道，了解侧信道，会用侧信道。"}
{"title": "Gartner：加速隐私监管首度成为企业头号安全需求", "url": "https://www.freebuf.com/news/201145.html", "time": "2019-04-16", "level": "", "num_look": 65383, "num_comment": 65383, "author": "Karunesh91", "tags": ["资讯"], "text": "Gartner的一项调查显示，在网络安全方面，“加速隐私监管”的优先级已经超过了“人才短缺”，成为了2019年第一季度的风险监测调查中的最新风险。"}
{"title": "送书福利 | 管理者必读经典，圈内大佬亲笔签名的企业安全建设指南", "url": "https://www.freebuf.com/fevents/200824.html", "time": "2019-04-16", "level": "红色标题", "num_look": 466428, "num_comment": 47, "author": "shidongqi", "tags": ["活动"], "text": "FreeBuf 猪年第一波送书活动献给了刚刚诞生的「FreeBuf企业安全」服务号！免费送五本《互联网企业安全高级指南》，详见活动细则！"}
{"title": "GoMet：Go编写的多平台Agent和控制器", "url": "https://www.freebuf.com/sectool/200887.html", "time": "2019-04-16", "level": "", "num_look": 136269, "num_comment": 3, "author": "secist", "tags": ["工具"], "text": "GoMet是一个Go编写的多平台Agent和控制器。Agent通过TLS隧道与其控制器通信。"}
{"title": "Adblock Plus订阅列表机制存在漏洞，可用于运行恶意代码", "url": "https://www.freebuf.com/news/201130.html", "time": "2019-04-16", "level": "", "num_look": 97087, "num_comment": 2, "author": "Freddy", "tags": ["资讯"], "text": "Adblock Plus、AdBlock和uBlocker浏览器扩展的广告拦截过滤器列表存在漏洞，攻击者可以利用该漏洞运行恶意代码，可窃取用户的cookie、登录凭据、进行页面重定向或其他恶意行为。"}
{"title": "Avira VPN的两处提权漏洞分析", "url": "https://www.freebuf.com/vuls/199737.html", "time": "2019-04-16", "level": "", "num_look": 126198, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["漏洞", "系统安全"], "text": "AviraPhantom VPN服务平台在检查更新时会进行大量的检测，在更新的过程中，就容易被人替换下载的程序。"}
{"title": "乙方视角下的攻防演练实践 | 企业安全俱乐部议题前瞻", "url": "https://www.freebuf.com/fevents/201105.html", "time": "2019-04-16", "level": "", "num_look": 75552, "num_comment": 75552, "author": "FB独家", "tags": ["活动"], "text": "2019年4月24日，来自斗象科技的资深安全服务专家曾裕智将为大家分享《乙方视角下的攻防演练实践》 ，为更多企业部署安全攻防实战演练建设提供思路和建议，更多精彩议题敬请期待。"}
{"title": "个人PWN入坑常见方法总结", "url": "https://www.freebuf.com/news/200207.html", "time": "2019-04-16", "level": "金币+8", "num_look": 231374, "num_comment": 2, "author": "freebuf01", "tags": [], "text": "本文介绍个人学习pwn过程中的一些总结，包括常用方法，网上诸多教程虽然有提供完整的exp，但并未解释exp为什么是这样的。"}
{"title": "深入理解JavaScript Prototype污染攻击", "url": "https://www.freebuf.com/articles/web/200406.html", "time": "2019-04-16", "level": "现金奖励", "num_look": 203741, "num_comment": 5, "author": "phithon", "tags": ["WEB安全"], "text": "JavaScript是一门非常灵活的语言，我感觉在某些方面可能比PHP更加灵活。所以，除了传统的SQL注入、代码执行等注入型漏洞外，也会有一些独有的安全问题，比如今天要说这个prototype污染。"}
{"title": "BUF早餐铺丨微软自打脸：黑客确实触及了部分电子邮件账户的详细内容；WPA3标准被曝“超大”WiFi安全漏洞；9年感染全球40多万台电脑，罗马尼亚一黑客组织被判刑", "url": "https://www.freebuf.com/news/201085.html", "time": "2019-04-16", "level": "", "num_look": 94363, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "微软自打脸：黑客确实触及了部分电子邮件账户的详细内容；WPA3标准被曝“超大”WiFi安全漏洞；9年感染全球40多万台电脑，罗马尼亚一黑客组织被判刑。"}
{"title": "Web弱口令通用检测方法探究", "url": "https://www.freebuf.com/sectool/200345.html", "time": "2019-04-16", "level": "金币+8", "num_look": 329075, "num_comment": 12, "author": "Tide重剑无锋", "tags": ["工具"], "text": "通用的web弱口令破解脚本，旨在批量检测那些没有验证码的管理后台。"}
{"title": "FuzzScanner：信息搜集开源小工具", "url": "https://www.freebuf.com/sectool/200344.html", "time": "2019-04-15", "level": "金币+8", "num_look": 410885, "num_comment": 11, "author": "Tide重剑无锋", "tags": ["工具"], "text": "fuzzScanner可用于批量快速的搜集网站信息，比别人更快一步的发现其他端口的应用或者网站管理后台等，也适合src漏洞挖掘的前期信息搜集。"}
{"title": "数据分析与可视化：谁是安全圈的吃鸡第一人", "url": "https://www.freebuf.com/articles/web/199925.html", "time": "2019-04-15", "level": "现金奖励", "num_look": 699184, "num_comment": 53, "author": "Omegogogo", "tags": ["WEB安全"], "text": "安全圈的黑阔大佬们，在不开挂的情况下，谁会是他们之中技术最好的呢？带着这样的疑问，作者试着从数据分析的角度来看看谁会是安全圈的吃鸡第一人。"}
{"title": ".NET高级代码审计（第九课） BinaryFormatter反序列化漏洞", "url": "https://www.freebuf.com/articles/web/200914.html", "time": "2019-04-15", "level": "", "num_look": 95969, "num_comment": 95969, "author": "云影实验室", "tags": ["WEB安全"], "text": "BinaryFormatter位于命名空间 System.Runtime.Serialization.Formatters.Binary它是直接用二进制方式把对象进行序列化，优点是速度较快，在不同版本的.NET平台里都可以兼容。"}
{"title": "终端安全产品存在远程命令注入风险，看我如何测试", "url": "https://www.freebuf.com/articles/terminal/199702.html", "time": "2019-04-15", "level": "", "num_look": 120147, "num_comment": 120147, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "近期，我们在一款热门的终端安全产品（Heimdal Thor）中发现了一个命令注入漏洞，通过利用该漏洞，将导致产品以及客户PC暴露在安全风险之中。"}
{"title": "瓜子二手车招聘安全专家", "url": "https://www.freebuf.com/jobs/200308.html", "time": "2019-04-15", "level": "", "num_look": 94332, "num_comment": 1, "author": "SixSixSix", "tags": ["安全招聘"], "text": "车好多集团是国内汽车创新零售服务的领航者，旗下拥有瓜子二手车直卖网与毛豆新车网两大知名品牌。"}
{"title": ".NET高级代码审计（第八课）SoapFormatter反序列化漏洞", "url": "https://www.freebuf.com/articles/web/200903.html", "time": "2019-04-15", "level": "", "num_look": 136428, "num_comment": 136428, "author": "云影实验室", "tags": ["WEB安全"], "text": "在某些场景下读取了恶意的XML流就会造成反序列化漏洞，从而实现远程RCE攻击，本文笔者从原理和代码审计的视角做了相关介绍和复现。"}
{"title": "Linux挖矿病毒的清除与分析", "url": "https://www.freebuf.com/vuls/200289.html", "time": "2019-04-15", "level": "现金奖励", "num_look": 567821, "num_comment": 16, "author": "xuing", "tags": ["安全报告", "漏洞"], "text": "一个叫做sysupdate的进程占据了绝大部分的CPU资源。CPU使用率接近100%。"}
{"title": "第三方网络风险管理：想要成效不容易", "url": "https://www.freebuf.com/articles/neopoints/200481.html", "time": "2019-04-15", "level": "", "num_look": 108993, "num_comment": 2, "author": "AngelaY", "tags": ["观点"], "text": "报告显示，56%的企业数据泄露都源自第三方供应商；42%的企业都因为第三方供应商遭遇攻击而出现数据泄露。"}
{"title": "携程凌云 | 做正确的事，比正确地做事更重要", "url": "https://www.freebuf.com/articles/people/199648.html", "time": "2019-04-15", "level": "红色标题", "num_look": 594934, "num_comment": 6, "author": "AngelaY", "tags": ["人物志"], "text": "对企业安全来说，什么叫作做正确的事？就是保证整个大的规划不会有大的偏差。"}
{"title": "BUF早餐铺丨FBI网站被黑，黑客获取100万条联邦特工身份信息；维基解密创始人阿桑奇在伦敦被捕，很快出庭受审；IE 11浏览器被爆安全漏洞：可远程窃取本地PC文件", "url": "https://www.freebuf.com/news/200898.html", "time": "2019-04-15", "level": "", "num_look": 102227, "num_comment": 3, "author": "Karunesh91", "tags": ["资讯"], "text": "FBI网站被黑，黑客获取100万条联邦特工身份信息；维基解密创始人阿桑奇在伦敦被捕，很快出庭受审；IE 11浏览器被爆安全漏洞：可远程窃取本地PC文件"}
{"title": "挖洞经验 | 利用Semmle QL查询语言发现Facebook Fizz的DoS漏洞（$10k）", "url": "https://www.freebuf.com/vuls/199563.html", "time": "2019-04-14", "level": "", "num_look": 122079, "num_comment": 122079, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文讲述的是Semmle公司研究员通过Semmle QL查询语言发现的，关于Facebook Fizz项目的一个拒绝服务漏洞（DoS）。"}
{"title": "【BUF大事件】《权力的游戏》盗版资源挂马量全球最高；“维基揭秘”创始人阿桑奇被捕；CNCERT发现35个锁屏勒索恶意程序变种", "url": "https://www.freebuf.com/video/200804.html", "time": "2019-04-14", "level": "红色标题", "num_look": 98710, "num_comment": 98710, "author": "willhuang", "tags": ["视频"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，《权力的游戏》盗版资源挂马量全球最高；“维基揭秘”创始人阿桑奇被捕；CNCERT发现35个锁屏勒索恶意程序变种"}
{"title": "Armory：一款外部数据挖掘与分析工具", "url": "https://www.freebuf.com/sectool/200170.html", "time": "2019-04-13", "level": "", "num_look": 142472, "num_comment": 142472, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Armory可以从多款安全工具中检索和获取大量外部数据，然后将这些数据存储到数据库中，并对数据进行关联处理。"}
{"title": "齐向东与周鸿祎分道扬镳，江湖再无360企业安全", "url": "https://www.freebuf.com/news/200855.html", "time": "2019-04-13", "level": "红色标题", "num_look": 205591, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": "RSAC 2019后，谭晓生正式离开360。时隔一个月，很多人还在持续关注谭校长的下一站会在哪里，而昨晚的一个重磅消息吸引了大半个安全圈的目光：周鸿祎与齐向东正式分道扬镳，江湖上再无360企业安全。"}
{"title": "使用Sboxr实现DOM XSS漏洞的自动挖掘与利用", "url": "https://www.freebuf.com/articles/web/199510.html", "time": "2019-04-13", "level": "", "num_look": 152776, "num_comment": 152776, "author": "secist", "tags": ["WEB安全"], "text": "这一系列文章将为大家展示如何在单页或JavaScript富应用上，使用Sboxr实现DOM XSS漏洞的自动挖掘与利用。"}
{"title": "攻防对抗之蓝方技术分享总结", "url": "https://www.freebuf.com/articles/network/200391.html", "time": "2019-04-13", "level": "红色标题", "num_look": 328940, "num_comment": 13, "author": "08sec团队", "tags": ["网络安全"], "text": "本次为期7天的红蓝对抗，攻防网络环境相对复杂，准备时间仅有1天，完全模拟了真实的攻防环境，并对采用的开源cms程序成功挖掘了漏洞。"}
{"title": "Confluence未授权 RCE (CVE-2019-3396) 漏洞分析", "url": "https://www.freebuf.com/vuls/200477.html", "time": "2019-04-13", "level": "", "num_look": 226848, "num_comment": 3, "author": "Knownsec知道创宇", "tags": ["漏洞"], "text": "漏洞描述中指出Confluence Server与Confluence数据中心中的Widget连接器存在服务端模板注入漏洞，攻击者能利用此漏洞能够实现目录穿越与远程代码执行。"}
{"title": "NVIDIA任意文件写入命令执行（CVE-2019-5674）", "url": "https://www.freebuf.com/vuls/200652.html", "time": "2019-04-13", "level": "", "num_look": 157714, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["漏洞"], "text": "该漏洞使得攻击者将能够强制让应用程序以特权用户身份在目标系统中写入任意文件。"}
{"title": "Fwknop：单包授权与端口试探工具", "url": "https://www.freebuf.com/sectool/199620.html", "time": "2019-04-12", "level": "", "num_look": 154372, "num_comment": 154372, "author": "周大涛", "tags": ["工具"], "text": "fwknop实现了一种称为单包授权（SPA）的授权方案，用于隐藏服务。以便在传达到隐藏在防火墙后面的服务。"}
{"title": "中国蚁剑被曝 XSS 漏洞，可导致远程命令执行", "url": "https://www.freebuf.com/news/200765.html", "time": "2019-04-12", "level": "红色标题", "num_look": 213884, "num_comment": 8, "author": "Allen别bb", "tags": ["资讯"], "text": "中国蚁剑被发现存在XSS漏洞，借此可引起RCE。据悉，该漏洞是因为在webshell远程连接失败时，中国蚁剑会返回错误信息，但因为使用的是html解析，导致xss漏洞。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列-Joel Margolis", "url": "https://www.freebuf.com/video/200359.html", "time": "2019-04-12", "level": "红色标题", "num_look": 102947, "num_comment": 1, "author": "willhuang", "tags": ["视频"], "text": "Joel Margolis，纽约罗彻斯特理工学院网络安全系学生，曾经专注于移动安全研究，擅长逆向工程，喜欢CTF比赛，现在转向做Web安全研究。"}
{"title": "浅析PHP框架Laravel最新SQL注入漏洞", "url": "https://www.freebuf.com/vuls/199272.html", "time": "2019-04-12", "level": "", "num_look": 236828, "num_comment": 2, "author": "dawner", "tags": ["漏洞"], "text": "PHP知名开发框架Laravel，前几天在官方博客通报了一个高危SQL注入漏洞，这里简单分析下。"}
{"title": "2019年360独角兽夏令营，招募安全研究实习生", "url": "https://www.freebuf.com/jobs/200051.html", "time": "2019-04-12", "level": "", "num_look": 114468, "num_comment": 3, "author": "FB客服", "tags": ["安全招聘"], "text": "360独角兽夏令营是一个短期实习项目，在这里你可以接触最新最前沿的课题，实操最新最硬核的项目，学习最全最先进的知识，造就更强更博学的自己！"}
{"title": "Geth以太坊短地址攻击分析", "url": "https://www.freebuf.com/articles/blockchain-articles/199903.html", "time": "2019-04-12", "level": "现金奖励", "num_look": 161462, "num_comment": 4, "author": "18611588432", "tags": ["区块链安全"], "text": "从开始研究到复现，着实踩了不少坑，今天就把我复现期间的一些细节写出来，分享给大家。"}
{"title": "小师妹聊如何部署IDPS", "url": "https://www.freebuf.com/articles/network/200023.html", "time": "2019-04-12", "level": "现金奖励", "num_look": 195905, "num_comment": 11, "author": "xxx幸xxx", "tags": ["企业安全", "网络安全"], "text": "今天想和大家聊一聊如何有效的部署和操作IDPS。顾名思义，对于安全事态来说，IDPS是一种事前检测并主动防御的安全设备。"}
{"title": "手把手教你解密Planetary勒索病毒", "url": "https://www.freebuf.com/articles/system/200424.html", "time": "2019-04-12", "level": "", "num_look": 131635, "num_comment": 3, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "国外安全研究人员曝光了一种名为Planetary的勒索病毒家族，该勒索病毒重点攻击对象是使用英语的用户群体，但在中国和日本地区都发现了遭到攻击的用户。"}
{"title": "BUF早餐铺 | 研究人员披露WiFi WPA3标准中的“龙血”漏洞；25％的网络钓鱼攻击能够绕过Office 365内置的默认安全措施；IDC发布2019全球IT安全支出规模预测，中国增速惹眼", "url": "https://www.freebuf.com/news/200668.html", "time": "2019-04-12", "level": "", "num_look": 75043, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "IDC预测，2019年中国安全解决方案总体支出将达到69.5亿美元，2018-2022年预测期内的年复合增长率（CAGR）为25.6%，增速远高于全球平均水平。"}
{"title": "Xori：一款针对PE32和Shellcode的自动化反编译与静态分析库", "url": "https://www.freebuf.com/sectool/199629.html", "time": "2019-04-11", "level": "", "num_look": 107253, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Xori的自动化反编译与静态分析工具，广大研究人员可以利用该工具来对PE32、32+和Shellcode进行审计分析。"}
{"title": "“银行提款机”变种病毒分析报告", "url": "https://www.freebuf.com/articles/paper/200284.html", "time": "2019-04-11", "level": "", "num_look": 113160, "num_comment": 1, "author": "腾讯手机管家", "tags": ["安全报告"], "text": "移动平台的黑产威胁一直是我们的研究对象，2018年4月我们在《银行提款机惊现病毒：绕过杀毒软件达到牟利目的》报告中揭露病毒技术，运作流程及感染数百万用户情况。"}
{"title": "恶意软件分析资源集合", "url": "https://www.freebuf.com/articles/system/198702.html", "time": "2019-04-11", "level": "", "num_look": 184284, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "软件领域里的任何一个概念可能都与恶意软件分析有着某种关联。因为恶意软件，也是软件，恶意软件分析，最终都会归结到软件分析之上。"}
{"title": "外卖小哥、女装大佬、水泥匠工人，市井中的黑客大佬群像", "url": "https://www.freebuf.com/articles/network/199584.html", "time": "2019-04-11", "level": "现金奖励", "num_look": 495102, "num_comment": 32, "author": "GEETEST极验", "tags": ["网络安全"], "text": "提到黑客，我们脑海中出现的大多都是《黑客帝国》中的炫酷场景，但是真实生活中的黑客可能是一个手机码完十万代码引发万人“膜拜”，然后挥挥衣袖骑上小电驴送外卖的少年......"}
{"title": "云丁科技安全人才招聘", "url": "https://www.freebuf.com/jobs/199922.html", "time": "2019-04-11", "level": "", "num_look": 127459, "num_comment": 1, "author": "joeyxy83", "tags": ["安全招聘"], "text": "云丁科技致力于打造全球领先的居住安全产品和服务提供商，带给每个人科技缔造的安全感和舒适感，让居住更安全。"}
{"title": "自助安全扫描与代码审计系统架构实践", "url": "https://www.freebuf.com/articles/es/199741.html", "time": "2019-04-11", "level": "现金奖励", "num_look": 407059, "num_comment": 19, "author": "糖果L5Q", "tags": ["企业安全"], "text": "公司如果有不同的业务线，各业务系统上线发布之前要进行基本的安全检查。业务在国内的其它城市，机房位置不定，发布时间不定，这时候就需要设计一套自动化机制。"}
{"title": "MuddyWater新攻击活动样本分析", "url": "https://www.freebuf.com/articles/network/199967.html", "time": "2019-04-11", "level": "现金奖励", "num_look": 115822, "num_comment": 4, "author": "fuckgod", "tags": ["安全报告", "网络安全"], "text": "在近期的公开报告中显示，18年后，中东以外的地区也陆续出现了Muddywater的活动迹象，比如土耳其，巴基斯坦等地。"}
{"title": "小白帽从病毒视角聊企业安全建设", "url": "https://www.freebuf.com/vuls/199599.html", "time": "2019-04-11", "level": "现金奖励", "num_look": 147280, "num_comment": 4, "author": "si1ence", "tags": ["企业安全", "漏洞"], "text": "最近各类安全事件还是很流行的，以前只是批量抓鸡做DDOS现在伴随着虚拟货币的流行挖矿勒索逐步进入了大众的视野，仅以此文按照精力财力人力最小化的原则分析一些恶意行为与相对应的此类安全事件一些防范措施。"}
{"title": "BUF早餐铺 | 雅虎数据泄露案和解金额达1.175亿美元；Mirai新变种加入更多物联网设备；微软四月修复74个漏洞", "url": "https://www.freebuf.com/news/200637.html", "time": "2019-04-11", "level": "", "num_look": 61984, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "Firefox将会增加对网站指纹和加密货币挖矿脚本的保护；流行开发工具 bootstrap-sass 被修改植入后门；澳法案强制要求企业安装“后门” ，中国外交部称坚决维护网络安全。"}
{"title": ".NET高级代码审计（第七课） NetDataContractSerializer反序列化漏洞", "url": "https://www.freebuf.com/articles/web/200591.html", "time": "2019-04-11", "level": "", "num_look": 93505, "num_comment": 1, "author": "云影实验室", "tags": ["WEB安全"], "text": "NetDataContractSerializer和DataContractSerializer一样用于序列化和反序列化Windows Communication Foundation (WCF) 消息中发送的数据。"}
{"title": "【议题公布】数据治理与安全运营 | FreeBuf企业安全俱乐部「上海站」", "url": "https://www.freebuf.com/fevents/200285.html", "time": "2019-04-10", "level": "", "num_look": 115359, "num_comment": 3, "author": "FB独家", "tags": ["企业安全", "活动"], "text": "「FreeBuf 企业安全俱乐部」系列沙龙活动「数据治理与安全运营」，将于2019年4月24日在上海证大美爵酒店盛大开幕。来自阿里巴巴、携程、美团、斗象科技、中通等公司的安全技术工程师以及亚洲诚信CTO将共同对话企业…"}
{"title": "Reko：一款功能强大的通用代码反编译工具", "url": "https://www.freebuf.com/sectool/199606.html", "time": "2019-04-10", "level": "", "num_look": 237583, "num_comment": 237583, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Reko的开源反编译工具，该工具采用C#开发，广大研究人员可利用Reko来对机器码进行反编译处理。"}
{"title": "基于S/MIME可信企业安全邮件解决方案 | 企业安全俱乐部「上海站」议题前瞻", "url": "https://www.freebuf.com/news/200252.html", "time": "2019-04-10", "level": "", "num_look": 109203, "num_comment": 1, "author": "FB独家", "tags": ["企业资讯", "活动"], "text": "2019年4月24日，袁国成将为大家分享《基于S/MIME可信企业安全邮件解决方案》，共同探讨企业邮件安全的解决之道，更多精彩敬请期待。"}
{"title": "火眼推出Windows免费渗透测试套件，包含140多款工具", "url": "https://www.freebuf.com/sectool/200524.html", "time": "2019-04-10", "level": "红色标题", "num_look": 572795, "num_comment": 25, "author": "Freddy", "tags": ["工具"], "text": "火眼发布了一个包含超过140个开源Windows渗透工具包，红队渗透测试员和蓝队防御人员均拥有了顶级侦察与漏洞利用程序集。该工具集名为“CommandoVM”。"}
{"title": "奇淫技巧之Metasploit远程代码执行“冲击波”", "url": "https://www.freebuf.com/articles/web/200017.html", "time": "2019-04-10", "level": "现金奖励", "num_look": 385745, "num_comment": 26, "author": "星空111", "tags": ["WEB安全"], "text": "最近在整理各种漏洞的利用技巧，我在Freebuf上每天都能获取很多干货，为了回馈freebuf和各位小伙伴，希望我的文章能帮到大家。"}
{"title": "利用Windows one-liner获取反向Shell", "url": "https://www.freebuf.com/articles/system/199071.html", "time": "2019-04-10", "level": "", "num_look": 141686, "num_comment": 1, "author": "secist", "tags": ["系统安全"], "text": "今天我们将讨论“Windows One-Liner”，即使用PowerShell或rundll32等恶意命令来获取Windows系统的反向shell。"}
{"title": "百家互联招聘安全人才", "url": "https://www.freebuf.com/jobs/199467.html", "time": "2019-04-10", "level": "", "num_look": 61632, "num_comment": 1, "author": "Aug0st", "tags": ["安全招聘"], "text": "百家互联是一家中国领先的互联网教育科技公司，2014年6月由陈向东带领创建， 团队成员主要由来自新东方等著名教育培训机构及百度、阿里、腾讯等互联网公司的精英组成。"}
{"title": "近五年重大勒索软件攻击事件盘点", "url": "https://www.freebuf.com/news/200292.html", "time": "2019-04-10", "level": "", "num_look": 154540, "num_comment": 2, "author": "Karunesh91", "tags": ["数据安全", "资讯"], "text": "恶意软件已出现多年，经过长久的发展，勒索软件的影响力已十分巨大。本文将对近五年来发生过最著名的几次勒索软件攻击事件作出盘点。"}
{"title": "航空ACARS系统接收解码与其安全性", "url": "https://www.freebuf.com/geek/199596.html", "time": "2019-04-10", "level": "现金奖励", "num_look": 209412, "num_comment": 5, "author": "OpenATS", "tags": ["极客"], "text": "MH370 出事之后，伴随着这个航班的话题一直是热门，航空的安全问题也引起了全球人们的关注。"}
{"title": "国际黑产组织针对部分东亚国家金融从业者攻击活动的报告", "url": "https://www.freebuf.com/articles/paper/199664.html", "time": "2019-04-10", "level": "", "num_look": 96980, "num_comment": 96980, "author": "antiylab", "tags": ["安全报告"], "text": "2019年2月13日至3月7日期间发生数起大规模有组织的针对部分东亚国家钓鱼邮件攻击行为，攻击目的是投放远控木马养殖僵尸网络以获利。"}
{"title": "BUF早餐铺 | 间谍程序感染 iOS 和 Android 设备；百变语音等35个锁屏勒索类恶意程序变种被曝光；美国土安全部将部署移动网络安全和弹性基础设施", "url": "https://www.freebuf.com/news/200498.html", "time": "2019-04-10", "level": "", "num_look": 83005, "num_comment": 83005, "author": "shidongqi", "tags": ["资讯"], "text": "国家互联网应急中心近日发现35个锁屏勒索类的恶意程序变种，该类病毒通过对用户手机锁屏，勒索用户付费解锁，对用户财产安全造成了严重的威胁。"}
{"title": "等保到底是个啥（五）：制度与人员安全部分", "url": "https://www.freebuf.com/articles/security-management/199937.html", "time": "2019-04-09", "level": "现金奖励", "num_look": 304219, "num_comment": 2, "author": "宇宸de研究室", "tags": ["安全管理", "标准与合规"], "text": "文章以等保三级系统为基础，从合规角度解读要求。本部分为人员安全和安全管理机构部分。"}
{"title": "如何使用JavaScript混淆来躲避AV", "url": "https://www.freebuf.com/articles/web/199060.html", "time": "2019-04-09", "level": "", "num_look": 140043, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "前不久，Cybaze-Yoroi ZLAB的安全研究人员发现了一个值得深入研究的可疑JavaScript文件。"}
{"title": "渗透测试团队技术评级那些事儿", "url": "https://www.freebuf.com/news/199788.html", "time": "2019-04-09", "level": "现金奖励", "num_look": 1555737, "num_comment": 37, "author": "Tide重剑无锋", "tags": ["其他", "资讯"], "text": "首先声明，这绝不是招聘广告，我们目前暂时也没有招人计划。我们这篇文章的内容比较适合用来设计不同级别的渗透测试岗位招聘信息的。"}
{"title": "远景集团诚聘安全人才（上海）", "url": "https://www.freebuf.com/jobs/199500.html", "time": "2019-04-09", "level": "", "num_look": 136876, "num_comment": 136876, "author": "MingZeng", "tags": ["安全招聘"], "text": "以“为人类的可持续未来解决挑战”为使命，远景致力引领全球智慧能源革命。"}
{"title": "OSCP（Offensive Security Certified Professional）考证全攻略", "url": "https://www.freebuf.com/articles/network/200009.html", "time": "2019-04-09", "level": "现金奖励", "num_look": 895896, "num_comment": 35, "author": "安全圈套的套哥", "tags": ["网络安全"], "text": "现在网上对于OSCP认证的中文介绍很少，也没看到详细攻略，但在国内已经越来越受到企业的认可，参加考试的人也越来越多了。"}
{"title": "Metaforge：一款可根据用户需求过滤数据的OSINT元数据分析工具", "url": "https://www.freebuf.com/sectool/199636.html", "time": "2019-04-09", "level": "", "num_look": 76053, "num_comment": 76053, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Metaforge的OSINT元数据分析工具，在该工具的帮助下，研究人员可根据标签来过滤数据，并生成动态数据分析报告。"}
{"title": "识别使用随机后缀的勒索病毒Golden Axe", "url": "https://www.freebuf.com/articles/system/199751.html", "time": "2019-04-09", "level": "", "num_look": 122601, "num_comment": 5, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "安全研究员发现了一款名为Golden Axe的勒索病毒，用go语言编写，使用基于RSA公匙加密体系的邮件加密软件PGP开源代码对文件进行加密。"}
{"title": "BUF早餐铺丨计算机科学家发布不会被黑的加密代码；百变语音等35个锁屏勒索类恶意程序变种被曝光；国家发改委将虚拟货币", "url": "https://www.freebuf.com/news/200346.html", "time": "2019-04-09", "level": "", "num_look": 87056, "num_comment": 87056, "author": "Karunesh91", "tags": ["资讯"], "text": "各位早上好，近日气温多变，小心预防感冒~"}
{"title": "「FreeBuf 企业安全」服务号来了 | 企业安全深度内容分享平台", "url": "https://www.freebuf.com/fevents/199232.html", "time": "2019-04-08", "level": "红色标题", "num_look": 351463, "num_comment": 2, "author": "FB客服", "tags": ["活动", "特别企划"], "text": "作为一家扎根于信息安全行业的垂直媒体，我们想要拨开泛滥成灾的信息云雾，将更加精准的内容直接传达给热爱甲方安全的你，「FreeBuf 企业安全」服务号应运而生。"}
{"title": "PFQ：一款针对多核心架构的功能性网络框架", "url": "https://www.freebuf.com/sectool/199638.html", "time": "2019-04-08", "level": "", "num_look": 103370, "num_comment": 103370, "author": "Alpha_h4ck", "tags": ["工具"], "text": "PFQ是一款针对Linux操作系统的功能性框架，可帮助研究人员捕捉网络传输数据包（10G、40G及以上），内核功能处理，内核绕过，以及获取多节点间的套接字/数据包。"}
{"title": "赵彦的CISO闪电战｜两年甲方安全修炼之路", "url": "https://www.freebuf.com/articles/es/200024.html", "time": "2019-04-08", "level": "现金奖励", "num_look": 604167, "num_comment": 59, "author": "ayazero", "tags": ["企业安全"], "text": "两年时间在企业安全上能做什么，笔者尝试挑战了一下这个问题。"}
{"title": "挖洞经验 | 谷歌图书服务的XS-Search漏洞", "url": "https://www.freebuf.com/vuls/199150.html", "time": "2019-04-08", "level": "", "num_look": 131325, "num_comment": 4, "author": "clouds", "tags": ["漏洞"], "text": "作者在最近参与的一些漏洞众测项目中，着重关注了跨站搜索攻击漏洞，也可称之为XS-Search，最终发现了谷歌图书服务漏洞，获得了谷歌奖励的$1337美金。"}
{"title": "微众银行信息安全部诚聘渗透、红蓝对抗方向人才", "url": "https://www.freebuf.com/jobs/199736.html", "time": "2019-04-08", "level": "", "num_look": 109666, "num_comment": 109666, "author": "微众银行sec", "tags": ["安全招聘"], "text": "微众银行是国内首家开业的民营银行，由腾讯、百业源和立业等多家知名企业发起设立，致力于为普罗大众、微小企业提供差异化、有特色、优质便捷的金融服务。"}
{"title": "GandCrab5.2勒索病毒伪装国家机关发送钓鱼邮件进行攻击", "url": "https://www.freebuf.com/articles/system/200070.html", "time": "2019-04-08", "level": "", "num_look": 128850, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近日，深信服安全团队接到包括金融行业在内的多家企业反馈，其内部员工收到可疑邮件。邮件发件人显示为“National Tax Service”（译为“国家税务局”）。"}
{"title": "探究卫星有关的安全问题", "url": "https://www.freebuf.com/articles/wireless/194142.html", "time": "2019-04-08", "level": "现金奖励", "num_look": 598211, "num_comment": 21, "author": "OpenATS", "tags": ["无线安全"], "text": "可能大家察觉到了，卫星技术渐渐开始平民化。民营航天企业暂露头角，科技企业也排队发射自己的“小卫星”。基于卫星的安全的问题，也值得我们去深入探究一下。"}
{"title": "从Android锁屏病毒探讨smali语法", "url": "https://www.freebuf.com/articles/others-articles/199515.html", "time": "2019-04-08", "level": "现金奖励", "num_look": 90491, "num_comment": 2, "author": "xiongchaochao", "tags": ["其他"], "text": "本次分析的样本是一款比较简单的android锁屏病毒，通过设备管理器来进行锁屏功能。我们主要是从者一款比较简单的病毒中熟悉一下smali语法。"}
{"title": "Nmap在VMware NAT网络下探测主机存活误报的分析", "url": "https://www.freebuf.com/articles/terminal/199711.html", "time": "2019-04-08", "level": "现金奖励", "num_look": 200953, "num_comment": 9, "author": "Shad0wpf_", "tags": ["终端安全"], "text": "昨天，在某安全交流群，看到关于Nmap扫描的讨论，对一个段做主机存活扫描，发现主机全部存活。"}
{"title": "BUF早餐铺丨研究人员发现中国企业简历信息泄露：涉5.9亿份简历；黑客滥用Google Cloud攻击D-Link路由器；流行Ruby库曝出恶意后门代码，始作俑者未知", "url": "https://www.freebuf.com/news/200217.html", "time": "2019-04-08", "level": "", "num_look": 73404, "num_comment": 73404, "author": "Karunesh91", "tags": ["资讯"], "text": "研究人员发现中国企业简历信息泄露：涉5.9亿份简历；黑客滥用Google Cloud攻击D-Link路由器；流行 Ruby 库曝出恶意后门代码，始作俑者未知"}
{"title": "H2T：一款扫描网站安全并给出安全实践建议的工具", "url": "https://www.freebuf.com/sectool/199607.html", "time": "2019-04-07", "level": "", "num_look": 151846, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫h2t的开源工具，广大研究人员可以利用这款工具来对目标站点进行安全扫描，并获取专业的安全实践建议。"}
{"title": "奇思妙想之用JS给图片加口令", "url": "https://www.freebuf.com/articles/web/199559.html", "time": "2019-04-07", "level": "现金奖励", "num_look": 541252, "num_comment": 41, "author": "w2sfoot", "tags": ["WEB安全", "极客"], "text": "本文展示一种用JS给图片加口令的方法，可以将任意图片转化为html，输入正确的口令才能打开查看图片。"}
{"title": "从RCE到LDAP信息泄漏", "url": "https://www.freebuf.com/articles/web/199046.html", "time": "2019-04-07", "level": "", "num_look": 131997, "num_comment": 2, "author": "secist", "tags": ["WEB安全"], "text": "几个月前，我自愿对一家法国公司进行了安全审计。"}
{"title": "Ruby on Rails路径穿越与任意文件读取漏洞分析（CVE-2019-5418）", "url": "https://www.freebuf.com/vuls/199617.html", "time": "2019-04-07", "level": "现金奖励", "num_look": 188786, "num_comment": 2, "author": "LEdge1", "tags": ["漏洞"], "text": "Ruby on Rails是一个 Web 应用程序框架,是一个相对较新的 Web 应用程序框架，构建在 Ruby 语言之上，能够让 Web 开发方面的生活，变得更轻松。"}
{"title": "Pe-afl：一款支持对Windows二进制程序的afl fuzz工具", "url": "https://www.freebuf.com/sectool/199390.html", "time": "2019-04-06", "level": "", "num_look": 111956, "num_comment": 111956, "author": "周大涛", "tags": ["工具"], "text": "pe-afl是一款基于了PE二进制和WinAFL上的静态二进制检测的工具，可以用于fuzzWindows应用程序和内核模式驱动程序，而无需源代码或完整符号或硬件支持。"}
{"title": "如何为WinDbg编写ClrMD插件", "url": "https://www.freebuf.com/articles/network/198951.html", "time": "2019-04-06", "level": "", "num_look": 100702, "num_comment": 100702, "author": "周大涛", "tags": ["网络安全"], "text": "由于LLDB是Linux上.NET网络核心的通用调试器，因此我决定编写一个兼容层，以便能够在新环境中加载扩展。"}
{"title": "漏洞预警 | Confluence Server 远程代码执行漏洞", "url": "https://www.freebuf.com/news/200183.html", "time": "2019-04-06", "level": "红色标题", "num_look": 290624, "num_comment": 2, "author": "斗象智能安全平台", "tags": ["资讯"], "text": "Atlassian公司的Confluence Server和Data Center产品中使用的widgetconnecter组件(版本"}
{"title": "如何使用SQLMap脚本绕过Web应用防火墙", "url": "https://www.freebuf.com/sectool/198403.html", "time": "2019-04-06", "level": "", "num_look": 245574, "num_comment": 12, "author": "大学新生Bai", "tags": ["工具"], "text": "大多数（不是所有）的防火墙都可以被绕过，在这片文章中，我将会演示如何使用 SQLMap 的一些功能来绕过 WAF / IDS。"}
{"title": "【BUF大事件】“2345导航站”弹窗广告携带病毒，盗取QQ和多款热门游戏账号；多款网购类APP“过度索权”存在一定安全风险", "url": "https://www.freebuf.com/video/200135.html", "time": "2019-04-06", "level": "红色标题", "num_look": 125737, "num_comment": 1, "author": "willhuang", "tags": ["视频"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，火绒安全团队发出警报，称“2345导航站”弹窗广告携带病毒，盗取QQ和多款热门游戏账号；多款网购类APP“过度索权”存在一定安全风险。"}
{"title": "“商贸信”病毒装成商品图片，双击就被安装商业间谍软件", "url": "https://www.freebuf.com/articles/network/199906.html", "time": "2019-04-06", "level": "", "num_look": 96391, "num_comment": 4, "author": "腾讯电脑管家", "tags": ["网络安全"], "text": "近期检测到商贸信木马家族最新变种攻击。可附着在邮件中发动攻击。"}
{"title": "Chashell：基于DNS的反向Shell", "url": "https://www.freebuf.com/sectool/199406.html", "time": "2019-04-05", "level": "", "num_look": 131646, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "Chashell是一个由Go编写的基于DNS进行通信的反向shell。它可用于绕过防火墙或严格限制的网络。"}
{"title": "WordPress插件Easy WP SMTP反序列化漏洞分析", "url": "https://www.freebuf.com/vuls/198913.html", "time": "2019-04-05", "level": "现金奖励", "num_look": 115902, "num_comment": 1, "author": "dawner", "tags": ["漏洞"], "text": "Wordpress 插件 Easy WP SMTP 最近新出了个漏洞，以前有分析过。不过新的代码好像变化有点大，所以这里花了点时间简单看看。"}
{"title": "Windows 10 IoT Core远程命令执行漏洞验证及建议", "url": "https://www.freebuf.com/vuls/199292.html", "time": "2019-04-05", "level": "", "num_look": 117543, "num_comment": 1, "author": "antiylab", "tags": ["漏洞"], "text": "近日，安天微电子与嵌入式安全研发部（安天微嵌）针对SafeBreach公司披露的Windows IoT[2]操作系统的安全漏洞进行了详细分析和验证。"}
{"title": "2018全球网络安全图鉴", "url": "https://www.freebuf.com/articles/network/199133.html", "time": "2019-04-05", "level": "", "num_look": 159980, "num_comment": 3, "author": "安数君", "tags": ["网络安全"], "text": "国家、企业和个人面临的信息安全威胁日趋严峻，国际上围绕信息的获取、使用和控制的斗争愈演愈烈，网络空间成为各国捍卫国家安全的全新疆域，全球各国都投入了极大的人力、财力、物力以保障国家的网络安全。"}
{"title": "Turbinia：一款自动化云端并行数字取证工具", "url": "https://www.freebuf.com/sectool/199412.html", "time": "2019-04-04", "level": "", "num_look": 108848, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Turbinia是一款专门用于部署、管理和运行分布式取证任务流的开源框架。"}
{"title": "挖洞经验 | 通过WebPageTest服务0day漏洞实现Mozilla AWS环境远程代码执行", "url": "https://www.freebuf.com/vuls/198680.html", "time": "2019-04-04", "level": "", "num_look": 116874, "num_comment": 2, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "Assetnote CS安全团队在分析Mozilla AWS云服务网络环境攻击面时，发现了部署于其中的网络性能测试工具WebPageTest存在一个0day漏洞，利用该漏洞最终实现了对Mozilla AWS服务器的远程代码执行（RCE）。"}
{"title": "关于WordPress主题供应商Pipdig使用客户的网站对不同竞争对手发起DDoS攻击的事件总结", "url": "https://www.freebuf.com/articles/web/200028.html", "time": "2019-04-04", "level": "现金奖励", "num_look": 141946, "num_comment": 2, "author": "黑鸟", "tags": ["WEB安全", "数据安全"], "text": "WordPress主题供应商Pipdig被发现利用客户的服务器对竞争对手的网站发动DDoS攻击。安全研究人员jem分析了他们的代码后，找到了实锤进行了DDoS攻击的证据。"}
{"title": "涂鸦智能招聘IOT安全专家", "url": "https://www.freebuf.com/jobs/199598.html", "time": "2019-04-04", "level": "", "num_look": 76998, "num_comment": 76998, "author": "SixSixSix", "tags": ["安全招聘"], "text": "涂鸦是一个全球化智能平台，也是目前世界排名前列的语音AI交互平台，连接消费者、制造品牌、OEM厂商和零售连锁的智能化需。"}
{"title": "快讯丨一女子被指控非法携带恶意软件设备进入川普庄园", "url": "https://www.freebuf.com/news/200040.html", "time": "2019-04-04", "level": "", "num_look": 81882, "num_comment": 5, "author": "Karunesh91", "tags": ["资讯"], "text": "美称一名持有中国护照的女子在今年3月底进入美国总统特朗普在佛罗里达州的私人度假俱乐部海湖庄园，她还携带着装有恶意软件的电子设备。"}
{"title": "“盲眼鹰”新攻击活动：伪装为哥伦比亚司法部门", "url": "https://www.freebuf.com/articles/paper/199400.html", "time": "2019-04-04", "level": "金币+6", "num_look": 86790, "num_comment": 4, "author": "fuckgod", "tags": ["安全报告"], "text": "该组织自2018年，持续发起针对哥伦比亚的攻击活动，该组织通过伪装成与目标受害者业务相关的政府部门对受害者发送钓鱼邮件。"}
{"title": "当心穿VB马甲的新型勒索病毒Tater", "url": "https://www.freebuf.com/articles/system/199724.html", "time": "2019-04-04", "level": "", "num_look": 123608, "num_comment": 2, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "新型的勒索病毒除了豁免少数几个系统文件夹以外，其会对其他目录的所有后缀的文件进行无差别加密，同时该病毒还加了一层VB程序外壳进行伪装。"}
{"title": "记一次入侵应急响应分析", "url": "https://www.freebuf.com/vuls/199263.html", "time": "2019-04-04", "level": "现金奖励", "num_look": 601245, "num_comment": 40, "author": "TaoPro", "tags": ["WEB安全", "漏洞"], "text": "2018年12月06日，我司“云悉”互联网安全监测平台监测到某政府单位网站存在被植入恶意链接。"}
{"title": "BUF早餐铺 | 《权力的游戏》盗版资源挂马量全球最高；Google 修补多项 Android 高危漏洞；WordPress iOS应用程序泄露身份验证令牌", "url": "https://www.freebuf.com/news/200010.html", "time": "2019-04-04", "level": "", "num_look": 75051, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "Verizon移动端用户遭遇钓鱼攻击；Apache 漏洞让普通用户通过脚本获得Root访问权限；26000多个Kibana插件暴露Elasticsearch数据库。"}
{"title": "攻防对抗中数据安全的持续优化 | 企业安全俱乐部「上海站」议题前瞻", "url": "https://www.freebuf.com/news/199852.html", "time": "2019-04-03", "level": "红色标题", "num_look": 74323, "num_comment": 1, "author": "FB独家", "tags": ["企业资讯", "活动"], "text": "2019年4月29日，FreeBuf企业安全俱乐部「上海站」邀请携程资深安全工程师船长为大家解读《攻防对抗中数据安全的持续优化》。"}
{"title": "我发现了一个Edge浏览器漏洞，价值5000美金", "url": "https://www.freebuf.com/news/199393.html", "time": "2019-04-03", "level": "", "num_look": 98285, "num_comment": 4, "author": "奇安信代码卫士", "tags": ["资讯"], "text": "近期， 360 企业安全集团代码卫士团队安全研究人员发现微软公司 Windows10 操作系统自带的 Edge 浏览器存在安全漏洞 ( CVE-2019-0648 )，并第一时间向微软公司报告。"}
{"title": "从SSRF到最终获取AWS S3 Bucket访问权限的实际案例", "url": "https://www.freebuf.com/articles/web/198687.html", "time": "2019-04-03", "level": "", "num_look": 128288, "num_comment": 4, "author": "secist", "tags": ["WEB安全"], "text": "这是我最近发现的一系列安全漏洞当中的另一个漏洞，这个漏洞与印度最赚钱的电子商务公司的一个数据库有关。"}
{"title": "华中一线待遇：湖南御风维安招聘代码审计人才", "url": "https://www.freebuf.com/jobs/199341.html", "time": "2019-04-03", "level": "", "num_look": 98816, "num_comment": 8, "author": "crown丶prince", "tags": ["安全招聘"], "text": "“驾御疾风，维系安宁”，御风维安认为：“每一个值得被守护的人，都应当被守护。”今天的御风维安，正逐步成为湖南省乃至全国网络安全行业中的重要技术创新企业。"}
{"title": "新形势下的数据保护思考", "url": "https://www.freebuf.com/articles/database/199402.html", "time": "2019-04-03", "level": "现金奖励", "num_look": 541830, "num_comment": 2, "author": "haiczh", "tags": ["数据安全"], "text": "未来如何在满足业务发展的同时，满足监管要求，又能很好的保护住企业所收集和存储的海量数据，是摆在金融行业客户面前一大难题。笔者根据自身数据保护从业经验提出几点思考，供企业参考。"}
{"title": "KBuster：以伪造韩国银行APP的韩国黑产活动披露", "url": "https://www.freebuf.com/articles/terminal/199175.html", "time": "2019-04-03", "level": "", "num_look": 120077, "num_comment": 4, "author": "奇安信威胁情报中心", "tags": ["终端安全"], "text": "360威胁情报中心近期发现一例针对韩国手机银行用户的黑产活动，其最早活动可能从2018年12月22日起持续至今。"}
{"title": "Androwarn：一款针对Android端恶意软件的全功能静态代码分析工具", "url": "https://www.freebuf.com/sectool/199407.html", "time": "2019-04-03", "level": "", "num_look": 102784, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Androwarn是一款专为Android端应用程序设计的安全分析工具，该功能的主要功能是检测并提醒用户Android应用程序中潜在的恶意行为。"}
{"title": "【出国游双Buff】企业SRC来助力：漏洞奖金直接提升50%，更有双倍积分冲刺赛季", "url": "https://www.freebuf.com/fevents/199900.html", "time": "2019-04-03", "level": "", "num_look": 50934, "num_comment": 50934, "author": "漏洞盒子", "tags": ["活动"], "text": "漏洞盒子企业SRC齐力给出国游活动加Buff啦！"}
{"title": "BUF早餐铺 | 百度、搜狗、360因骚扰电话软件销售推广信息问题被约谈；“2345导航站”弹窗广告携带病毒，盗取QQ和多款热门游戏账号", "url": "https://www.freebuf.com/news/199885.html", "time": "2019-04-03", "level": "", "num_look": 113734, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "近日，北京市通信管理局针对互联网上发现的骚扰电话软件销售推广信息的问题，集中约谈了百度、奇虎360、搜狗等搜索服务提供商。"}
{"title": "“2345导航站”弹窗广告携带病毒，盗取QQ和多款热门游戏账号", "url": "https://www.freebuf.com/articles/network/199639.html", "time": "2019-04-02", "level": "", "num_look": 183760, "num_comment": 8, "author": "火绒安全", "tags": ["网络安全"], "text": "4月1日凌晨，部分“2345导航站”首页的弹窗广告携带盗号木马，该病毒会偷取QQ、游戏平台、知名游戏（地下城与勇士、英雄联盟、穿越火线）的账号。"}
{"title": "Black Hat Asia 2019 | 十周年，规模与意义不断变迁", "url": "https://www.freebuf.com/news/199839.html", "time": "2019-04-02", "level": "红色标题", "num_look": 170525, "num_comment": 4, "author": "AdlerI", "tags": ["资讯"], "text": "未来将会怎样？下一届会议也许会有答案。"}
{"title": "等保到底是个啥（四）：应用与数据安全部分", "url": "https://www.freebuf.com/articles/network/199120.html", "time": "2019-04-02", "level": "金币+8", "num_look": 683794, "num_comment": 13, "author": "宇宸de研究室", "tags": ["安全管理", "标准与合规"], "text": "本篇将会介绍等保中应用和数据层面的安全要求，文中内容将通过个人观点，以等保三级系统为基础，从合规角度解读要求。"}
{"title": "关于CVE-2019-9766缓冲区溢出漏洞的渗透模块编写与测试", "url": "https://www.freebuf.com/vuls/199191.html", "time": "2019-04-02", "level": "现金奖励", "num_look": 261288, "num_comment": 14, "author": "Neroqi", "tags": ["漏洞"], "text": "本文详细描述了该漏洞的验证方法，渗透模块的编写及测试过程。"}
{"title": "挖洞经验 | SharePoint邮件通知服务中的XSS漏洞", "url": "https://www.freebuf.com/vuls/198530.html", "time": "2019-04-02", "level": "", "num_look": 135442, "num_comment": 4, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "跨站脚本漏洞（XSS）近年来一直是 OWASP的Top 10 经典攻击方式，能在野外发现XSS漏洞也是相当不错的了，尤其是在一些知名的网络产品中。"}
{"title": "平安银行总行零售信息安全岗位招聘", "url": "https://www.freebuf.com/jobs/199264.html", "time": "2019-04-02", "level": "", "num_look": 72577, "num_comment": 1, "author": "平安银行应用安全团队", "tags": ["安全招聘"], "text": "平安银行股份有限公司是总部设在深圳的全国性股份制商业银行（深圳证券交易所简称：平安银行，证券代码000001），因业务需求招聘安全人才~"}
{"title": ".NET高级代码审计（第六课） DataContractSerializer反序列化漏洞", "url": "https://www.freebuf.com/articles/web/199740.html", "time": "2019-04-02", "level": "", "num_look": 96564, "num_comment": 96564, "author": "云影实验室", "tags": ["WEB安全"], "text": "某些场景下开发者使用DataContractSerializer.ReadObject读取了恶意的XML数据就会造成反序列化漏洞，从而实现远程RCE攻击，本文笔者从原理和代码审计的视角做了相关介绍和复现。"}
{"title": "AFLSmart工具简单分析及使用介绍", "url": "https://www.freebuf.com/sectool/199010.html", "time": "2019-04-02", "level": "金币+6", "num_look": 111976, "num_comment": 111976, "author": "红玫瑰与黑玫瑰", "tags": ["工具"], "text": "AFLSmart 是一个在 AFL 基础上，结合了 Peach 的结构化输入组件的灰盒 smart fuzz 工具。"}
{"title": "企业安全架构体系的现状和解决：应用型企业安全架构体系", "url": "https://www.freebuf.com/articles/es/199334.html", "time": "2019-04-02", "level": "红色标题", "num_look": 245692, "num_comment": 2, "author": "Karunesh91", "tags": ["企业安全"], "text": "从2016年底开始随着网络安全事件的爆发和国家层面对网络安全的重视程度，让网络空间已经成为领土、领海、领空和太空之外的第五空间。"}
{"title": "PHP内核层解析反序列化漏洞", "url": "https://www.freebuf.com/vuls/199241.html", "time": "2019-04-02", "level": "", "num_look": 113608, "num_comment": 2, "author": "alphalab", "tags": ["漏洞"], "text": "在学习PHP的过程中发现有些PHP特性的东西不好理解，如PHP中的00截断，MD5缺陷，反序列化绕过__wakeup等等。本人不想拘泥于表面现象的理解，想探究PHP内核到底是怎样做到的。"}
{"title": "BUF早餐铺 | 丰田发生数据泄露事件，数百万日本用户受影响；“Bitter”蔓灵花团伙持续对我国发起定向攻击", "url": "https://www.freebuf.com/news/199691.html", "time": "2019-04-02", "level": "", "num_look": 77147, "num_comment": 77147, "author": "Freddy", "tags": ["资讯"], "text": "丰田泄露的信息包括姓名、地址、出生日期、职业和其他信息，好消息是事件中没有暴露财务数据。"}
{"title": "FDsploit：文件包含路径回溯漏洞的挖掘枚举和利用", "url": "https://www.freebuf.com/sectool/198956.html", "time": "2019-04-01", "level": "", "num_look": 129740, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "FDsploit是一个件包含/路径回溯漏洞的挖掘枚举和利用工具。"}
{"title": "从零开讲企业怎么选WAF", "url": "https://www.freebuf.com/articles/web/199243.html", "time": "2019-04-01", "level": "现金奖励", "num_look": 369837, "num_comment": 29, "author": "w2sfoot", "tags": ["WEB安全"], "text": "WAF，即：Web Application FireWall。可以通俗的理解为：用于保护网站，防黑客、防网络攻击的安全防护系统；是最有效、最直接的Web安全防护产品。"}
{"title": "挖洞经验 | Outlook.com邮箱环境在iOS浏览器下的Stored XSS漏洞", "url": "https://www.freebuf.com/vuls/198384.html", "time": "2019-04-01", "level": "", "num_look": 171480, "num_comment": 4, "author": "clouds", "tags": ["漏洞"], "text": "今天分享的writeup是关于outlook.live.com邮箱环境在iOS浏览器下的存储型XSS漏洞（Stored XSS）。"}
{"title": "号召海内外白帽来挖洞，小米SRC与HackerOne牵手合作", "url": "https://www.freebuf.com/news/199760.html", "time": "2019-04-01", "level": "", "num_look": 58258, "num_comment": 2, "author": "Allen别bb", "tags": ["资讯"], "text": "4月1日，小米安全团队宣布，与国际漏洞协调与赏金平台HackerOne达成战略合作，海外白帽子可以将发现的安全漏洞、威胁情报在HackerOne平台提交至MiSRC，我们会根据提交的危害等级给予相应的悬赏。"}
{"title": "斑马网络招聘网络安全人才", "url": "https://www.freebuf.com/jobs/199481.html", "time": "2019-04-01", "level": "", "num_look": 102785, "num_comment": 6, "author": "SixSixSix", "tags": ["安全招聘"], "text": "斑马网络，成立于2015年，是全球最大的互联网汽车平台。因业务需求招聘安全人才~"}
{"title": "卡巴斯基2018年金融行业网络威胁报告", "url": "https://www.freebuf.com/articles/paper/199093.html", "time": "2019-04-01", "level": "", "num_look": 110962, "num_comment": 2, "author": "青松Qssec", "tags": ["安全报告"], "text": "这份报告概述了近年来金融威胁状况的演变。它涵盖了用户遇到的常见钓鱼威胁，以及基于windows和android的金融恶意软件。"}
{"title": "以攻促防：企业蓝军建设思考", "url": "https://www.freebuf.com/articles/es/199166.html", "time": "2019-04-01", "level": "红色标题", "num_look": 183755, "num_comment": 5, "author": "腾讯安全平台部", "tags": ["企业安全"], "text": "2017年4月，黑客组织公布一批美国国家安全局（NSA）的网络漏洞军火库。其中就包含Windows永恒之蓝漏洞利用工具。"}
{"title": "伊拉克电信公司遭到MuddyWater组织定向攻击", "url": "https://www.freebuf.com/articles/network/199008.html", "time": "2019-04-01", "level": "", "num_look": 91895, "num_comment": 2, "author": "Threatbook", "tags": ["网络安全"], "text": "MuddyWater被怀疑是来自伊朗的黑客组织，该组织自2017年9月开始活跃，主要针对中东地区的政府、电信及能源企业进行攻击。"}
{"title": "BUF早餐铺丨沙特政府从亚马逊CEO贝索斯手机获取到个人数据；新发现的HTTPS漏洞可能会使您的数据暴露在外；9款APP涉嫌过度获取权限", "url": "https://www.freebuf.com/news/199640.html", "time": "2019-04-01", "level": "", "num_look": 78425, "num_comment": 78425, "author": "Karunesh91", "tags": ["资讯"], "text": "四月第一天，各位工作愉快～"}
{"title": "Vuls：针对LinuxFreeBSD的无代理端型漏洞扫描工具", "url": "https://www.freebuf.com/sectool/198694.html", "time": "2019-03-31", "level": "红色标题", "num_look": 100219, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Vuls的漏洞扫描工具，该工具采用Go语言编写，可帮助研究人员在无需安装任何代理工具的情况下实现对Linux/FreeBSD的漏洞扫描。"}
{"title": "利用SSRF泄漏云环境中的Metadata数据进一步实现RCE", "url": "https://www.freebuf.com/articles/web/198425.html", "time": "2019-03-31", "level": "", "num_look": 138847, "num_comment": 2, "author": "secist", "tags": ["WEB安全"], "text": "本文我将向大家分享一个新的非常有意思的漏洞。利用该漏洞可以为我们泄漏云环境中的Metadata数据，并进一步的实现远程代码执行（RCE ）。"}
{"title": "探究PHP中的Mkdir函数", "url": "https://www.freebuf.com/vuls/198700.html", "time": "2019-03-31", "level": "红色标题", "num_look": 97815, "num_comment": 2, "author": "alphalab", "tags": ["漏洞"], "text": "在复现分析Wordpress-5.0.0 RCE 的时候，我要在写目标图片前，必须还要再写一个辅助图片。其实这个辅助图片不是很重要，而重要的是这个辅助图片的目录创建。"}
{"title": "海莲花组织针对中国APT攻击的最新样本分析", "url": "https://www.freebuf.com/articles/network/199052.html", "time": "2019-03-31", "level": "", "num_look": 233400, "num_comment": 7, "author": "antiylab", "tags": ["安全管理", "网络安全"], "text": "2018年12月至今，已捕获多例针对中国的恶意宏文档样本。这些恶意文档通过在模糊的文字背景上伪装出杀毒软件的安全检测结果，诱导受害者。"}
{"title": "【BUF大事件】震惊！UC浏览器被曝中间人攻击漏洞，官方紧急修复；春招高峰期，你的简历或许已被卖到数据黑产链", "url": "https://www.freebuf.com/video/199610.html", "time": "2019-03-30", "level": "红色标题", "num_look": 105261, "num_comment": 1, "author": "willhuang", "tags": ["视频"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，说到UC浏览器，我想早期的智能机用户一定不会陌生，但是最近UC浏览器被曝中间人攻击漏洞。"}
{"title": "DNS-Shell：一款通过DNS信道来实现交互式Shell的强大工具", "url": "https://www.freebuf.com/sectool/198686.html", "time": "2019-03-30", "level": "红色标题", "num_look": 171743, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫DNS-Shell的交互工具，在该工具的帮助下，研究人员可通过DNS信道来实现交互式Shell。"}
{"title": "Bash实现快速端口识别与服务监控", "url": "https://www.freebuf.com/articles/system/198767.html", "time": "2019-03-30", "level": "现金奖励", "num_look": 153675, "num_comment": 4, "author": "xyl870612", "tags": ["系统安全"], "text": "关于端口识别与服务监控问题，早有大牛提供过masscan扫端口+nmap扫服务思路。但最致命的问题是nmap扫描速度太慢，导致无法接受这个扫描时长。"}
{"title": "挖洞经验 | 利用跨站WebSocket劫持（CSWH）实现账户劫持", "url": "https://www.freebuf.com/vuls/198234.html", "time": "2019-03-30", "level": "", "num_look": 141038, "num_comment": 3, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文分享的是作者在某次漏洞测试中，由于目标应用使用了WebSocket协议，经测试后，存在跨站WebSocket劫持漏洞。"}
{"title": "高龄病毒“熊猫烧香”还没退休？", "url": "https://www.freebuf.com/articles/system/199141.html", "time": "2019-03-30", "level": "", "num_look": 140824, "num_comment": 3, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "该病毒为“熊猫烧香”病毒变种，虽然该病毒已有十余年历史，但由于其具有很强的感染及传播性，依然很容易在缺少防护的企业内网中传播开来。"}
{"title": "给CSO的三句话企业风险自评框架", "url": "https://www.freebuf.com/articles/es/199404.html", "time": "2019-03-29", "level": "金币+15", "num_look": 199711, "num_comment": 8, "author": "haiczh", "tags": ["企业安全"], "text": "企业开始关注信息化的可持续发展，其中信息安全和绿色IT等理念已经成为企业关注的重点，信息安全正在成为企业发展的核心竞争力和决定在数字化竞争中生死存亡的决定性因素之一。"}
{"title": "如何使用模块化的Hostintel收集恶意主机的情报信息", "url": "https://www.freebuf.com/articles/network/198153.html", "time": "2019-03-29", "level": "金币+15", "num_look": 86425, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "今天给大家介绍的是一款模块化的Python应用程序，广大研究人员可使用这款工具来收集关于恶意主机的情报信息。"}
{"title": "众安保险招聘信息安全工程师", "url": "https://www.freebuf.com/jobs/198862.html", "time": "2019-03-29", "level": "", "num_look": 73558, "num_comment": 2, "author": "ladymin123", "tags": ["安全招聘"], "text": "众安保险非常重视个人信息的保密和安全，并一直致力于依法保护客户的个人信息。"}
{"title": "金诚卡算法分析及自制硬件测试设备", "url": "https://www.freebuf.com/geek/198151.html", "time": "2019-03-29", "level": "金币+15", "num_look": 184828, "num_comment": 6, "author": "包子no", "tags": ["极客"], "text": "金诚卡这个东西说熟悉的人很熟悉，说不熟悉的人压根就没见过，国内有很多高校都用这款水卡。"}
{"title": "一则数据泄露案例教你做好安全基线的重要性", "url": "https://www.freebuf.com/articles/es/199043.html", "time": "2019-03-29", "level": "金币+15", "num_look": 141996, "num_comment": 3, "author": "heymind", "tags": ["企业安全"], "text": "做好常易被人忽视的日常安全运营之安全基线工作即能轻松预防和避免部分数据泄露事件的发生。"}
{"title": "BUF早餐铺 | 思科释出大量补丁，修复IOS XE和小型企业路由漏洞；专家警告雷克萨斯、丰田、福特和保时捷无钥匙汽车系统面临严重安全风险", "url": "https://www.freebuf.com/news/199415.html", "time": "2019-03-29", "level": "", "num_look": 67396, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "周三，思科系统公司发布了26个补丁，包括其IOS XE操作系统和两个小型企业RV320和RV325路由器中的漏洞修复。"}
{"title": "Black Hat Asia 2019 | 议题前瞻", "url": "https://www.freebuf.com/news/199523.html", "time": "2019-03-29", "level": "", "num_look": 114199, "num_comment": 3, "author": "AdlerI", "tags": ["活动", "资讯"], "text": "BlackHat Asia 2019 大会于3月26日到3月29日期间在新加坡滨海湾金沙酒店举行。"}
{"title": "Legion：一款易于使用且功能强大的半自动化网络渗透工具", "url": "https://www.freebuf.com/sectool/198113.html", "time": "2019-03-28", "level": "", "num_look": 189754, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具"], "text": "这是一款半自动化的网络渗透测试工具，可帮助研究人员发现、侦察和利用目标信息系统中的安全漏洞。"}
{"title": "个人总结的漏洞管理流程分享", "url": "https://www.freebuf.com/articles/es/198324.html", "time": "2019-03-28", "level": "现金奖励", "num_look": 623150, "num_comment": 18, "author": "白河·愁", "tags": ["企业安全"], "text": "合适的漏洞响应可以尽快减少易受攻击的产品实例的数量，并减少针对易受攻击系统的攻击。"}
{"title": "挖洞经验 | 一次对GitHub Wiki页面的把玩测试", "url": "https://www.freebuf.com/vuls/198016.html", "time": "2019-03-28", "level": "", "num_look": 138115, "num_comment": 3, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文中，作者就针对GitHub Repository Wiki Pages页面做了一次类似的综合分析，综合形成了漏洞隐患进行了上报。"}
{"title": "“天堂”竟然伸出恶魔之手？Paradise勒索病毒再度席卷", "url": "https://www.freebuf.com/articles/system/198942.html", "time": "2019-03-28", "level": "", "num_look": 133718, "num_comment": 6, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近日，深信服安全团队接到客户反馈，主机被加密勒索，经过跟踪分析，拿到了相应的样本，确认样本为Paradise勒索病毒的变种版本。"}
{"title": "BUF早餐铺 | UC浏览器存在中间人攻击漏洞，影响十多亿设备；华硕发布补丁应对ShadowHammer攻击；巧达科技将8亿份简历转手卖到数据黑产链", "url": "https://www.freebuf.com/news/199391.html", "time": "2019-03-28", "level": "", "num_look": 77126, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "暗网市场 Dream Market 将于下月底关闭；WordPress 插件漏洞被利用 近20万站点还没打补丁；Elsevier 数据库泄漏用户密码和电邮。"}
{"title": "UC浏览器（国际版）被爆中间人攻击漏洞，官方回应已修复、国内版本不受影响", "url": "https://www.freebuf.com/news/199358.html", "time": "2019-03-27", "level": "", "num_look": 150937, "num_comment": 4, "author": "shidongqi", "tags": ["资讯"], "text": "UC方面回应称，海外媒体报道UC浏览器海外版本的潜在漏洞，已在第一时间得到修复。UC浏览器国内版本不存在文章提及的更新功能潜在漏洞，UC浏览器更新功能完全符合国内各大应用商店的监测要求和安全标准。"}
{"title": "华硕软件更新服务器遭黑客劫持，自动更新向用户下发恶意程序", "url": "https://www.freebuf.com/news/199315.html", "time": "2019-03-27", "level": "红色标题", "num_look": 88356, "num_comment": 6, "author": "深信服千里目安全实验室", "tags": ["资讯"], "text": "卡巴斯基实验室(Kaspersky Lab)于3月25日曝光华硕（ASUS）的软件更新服务器曾在去年遭到黑客入侵，并以更新的名义在用户的电脑上植入一个恶意程序。"}
{"title": "Sublert：自动化监控子域名变化的工具", "url": "https://www.freebuf.com/sectool/198396.html", "time": "2019-03-27", "level": "", "num_look": 156970, "num_comment": 156970, "author": "secist", "tags": ["工具"], "text": "这款工具可以自动化的监控特定组织的子域，并在找到新内容时向你发送通知。"}
{"title": "小师妹聊安全标准（二）", "url": "https://www.freebuf.com/articles/es/199084.html", "time": "2019-03-27", "level": "现金奖励", "num_look": 597666, "num_comment": 17, "author": "xxx幸xxx", "tags": ["企业安全"], "text": "上一篇聊的是关于风险评估实施的安全标准，看到有人留言怀疑我冒充小师妹，我觉得并没有冒充的必要，反倒我希望各位圈友把我当成兄弟，不吝赐教。"}
{"title": "羡慕盒子TOP白帽出国梦想趴，努力一个月你也可以！", "url": "https://www.freebuf.com/fevents/199330.html", "time": "2019-03-27", "level": "红色标题", "num_look": 170953, "num_comment": 2, "author": "漏洞盒子", "tags": ["活动"], "text": "2019年，我们要去塞班，等一个你！"}
{"title": "该如何利用威胁情报进行更智能的风险评估", "url": "https://www.freebuf.com/articles/es/198070.html", "time": "2019-03-27", "level": "", "num_look": 123841, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["企业安全"], "text": "风险模型不仅给我们提供了一种评估当前风险的客观评价方法，而且还可以给企业的网络安全投资提供清晰且可量化的结果。"}
{"title": "每日优鲜安全岗位招聘人才", "url": "https://www.freebuf.com/jobs/199099.html", "time": "2019-03-27", "level": "", "num_look": 88606, "num_comment": 5, "author": "每日优鲜安全部", "tags": ["安全招聘"], "text": "每日优鲜安全部成立不久，诚邀各位加入，部门氛围融洽，结果导向。加入我们，可以参与到一个体量还算可以，高速发展的互联网公司安全建设过程中来~"}
{"title": "漏洞预警丨WordPress Social Warfare Plugin远程代码执行漏洞", "url": "https://www.freebuf.com/vuls/199278.html", "time": "2019-03-27", "level": "", "num_look": 102499, "num_comment": 102499, "author": "深信服千里目安全实验室", "tags": ["漏洞"], "text": "2019年3月25日，国外安全研究人员在大量攻击数据中发现了一个WordPress plugins Social Warfare远程代码执行漏洞。"}
{"title": "快讯丨云集被质疑泄露个人信息，千名消费者惨遭电话诈骗", "url": "https://www.freebuf.com/news/199288.html", "time": "2019-03-27", "level": "", "num_look": 76867, "num_comment": 3, "author": "Karunesh91", "tags": ["资讯"], "text": "据悉，从去年至今，在云集平台上，众多购买了商品的消费者接到了诈骗电话，涉及全国各地上千名消费者。记者了解到，消费者被骗金额从几千元至数万元，损失惨重。"}
{"title": "疑似MuddyWater APT组织针对伊拉克运营商的攻击活动分析", "url": "https://www.freebuf.com/articles/system/198940.html", "time": "2019-03-27", "level": "", "num_look": 98904, "num_comment": 2, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "近期， 360 威胁情报中心截获到一个针对伊拉克移动运营商 （ Korek Telecom）的定向攻击样本。"}
{"title": "良心开发者，微软安全防护套件Windows Defender ATP将登陆Mac OS平台", "url": "https://www.freebuf.com/news/199117.html", "time": "2019-03-27", "level": "", "num_look": 54963, "num_comment": 2, "author": "Allen别bb", "tags": ["资讯"], "text": "微软似乎从来不介意为其竞争对手开发优质软件，因此经常会被冠以良心开发者的名号。这一次，微软又将自家的安全防护套件Windows Defender ATP带到了MacOS平台。"}
{"title": "BUF早餐铺 | 多款应用点分享至微信会跳转至深航App？腾讯回应称被劫持；微软洪小文称“对用户来说，方便和隐私互相冲突”", "url": "https://www.freebuf.com/news/199279.html", "time": "2019-03-27", "level": "", "num_look": 62516, "num_comment": 62516, "author": "shidongqi", "tags": ["资讯"], "text": "据澎湃新闻报道，日前有多名iPhone用户发现多个应用出现bug，在点击分享到朋友圈或微信好友时均跳转深圳航空应用，微信回复称是因深航劫持微信跳转，已和对方沟通修复。"}
{"title": "如何构建快速高效的智能黑链检测模型", "url": "https://www.freebuf.com/articles/network/198343.html", "time": "2019-03-27", "level": "金币+6", "num_look": 148746, "num_comment": 148746, "author": "wzwzwz", "tags": ["安全管理", "网络安全"], "text": "黑链，是指看不见、摸不到，但却被搜索引擎计算权重的外链，也叫隐链、暗链。"}
{"title": "Pown Recon：基于图论的目标侦察框架", "url": "https://www.freebuf.com/sectool/198156.html", "time": "2019-03-26", "level": "", "num_look": 113988, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "Pown Recon是一个基于图论的目标侦察框架，使用图论代替flat table的好处是更容易找到不同类型信息之间的关系。"}
{"title": "浅谈初入甲方的企业安全建设规划", "url": "https://www.freebuf.com/articles/es/198597.html", "time": "2019-03-26", "level": "现金奖励", "num_look": 882629, "num_comment": 58, "author": "LJ_Monica", "tags": ["企业安全"], "text": "一年一度的跳槽季又到了，很多圈内的朋友之前是在安全公司这样的乙方工作，随着年龄的增加，手速变慢，头发变少，身体感觉被掏空。"}
{"title": "Windows内核扩展机制研究", "url": "https://www.freebuf.com/articles/system/197734.html", "time": "2019-03-26", "level": "", "num_look": 97661, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "近期，我自己写了一个内核模式驱动器，跟我平时写的很多代码一样，这个驱动器也存在Bug。 确切来说，这个驱动器可以防止其他驱动器正常加载，并导致系统崩溃。"}
{"title": "江苏力驰招聘网络安全人才", "url": "https://www.freebuf.com/jobs/199212.html", "time": "2019-03-26", "level": "", "num_look": 103147, "num_comment": 2, "author": "Freddy", "tags": ["安全招聘"], "text": "江苏力驰网络科技股份有限公司 ，成立于2017年，位于江苏省南京市江东北路。是一家专注于互联网安全相关工作的公司。主要从事互联网安全软硬件产品开发，网络安全测试服务。"}
{"title": ".NET高级代码审计（第五课）.NET Remoting反序列化漏洞", "url": "https://www.freebuf.com/articles/web/199147.html", "time": "2019-03-26", "level": "", "num_look": 126065, "num_comment": 4, "author": "云影实验室", "tags": ["WEB安全"], "text": "最近几天国外安全研究员Soroush Dalili(@irsdl)公布了.NET Remoting应用程序可能存在反序列化安全风险。"}
{"title": "等保到底是个啥（三）：主机安全部分", "url": "https://www.freebuf.com/articles/security-management/198517.html", "time": "2019-03-26", "level": "现金奖励", "num_look": 391605, "num_comment": 7, "author": "宇宸de研究室", "tags": ["安全管理", "标准与合规"], "text": "本篇将会介绍等保中对主机层面的安全要求，文中内容全是本人个人观点，如有不对的地方欢迎纠正。文章以等保三级系统为基础，从合规角度解读要求。"}
{"title": "疑似APT-C-27利用WinRAR漏洞的定向攻击活动分析", "url": "https://www.freebuf.com/articles/system/198695.html", "time": "2019-03-26", "level": "", "num_look": 109862, "num_comment": 4, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "该恶意ACE压缩包内包含一个以恐怖袭击事件为诱饵的Office Word文档，诱使受害者解压文件，当受害者在本地计算机上通过WinRAR解压该文件后便会触发漏洞。"}
{"title": "企业安全建设之HIDS（二）：入侵检测&应急响应", "url": "https://www.freebuf.com/articles/es/197337.html", "time": "2019-03-26", "level": "现金奖励", "num_look": 202835, "num_comment": 5, "author": "罹♛殇", "tags": ["企业安全"], "text": "关于HIDS入侵检测的内容比较多，这里根据自己的经验总结通用的应急流程，应急响应是个体力活，但是很有意思，攻防对抗中，谁更了解这个系统，谁就拥有主动权。"}
{"title": "BUF早餐铺丨AT&T的“假5G”网络实际速率被发现低于现有4G网络；盗30万条个人信息叫价1比特币 “网偷”被警方抓获；《文明6》竟暗中收集玩家数据，发行商2K作出解释", "url": "https://www.freebuf.com/news/199187.html", "time": "2019-03-26", "level": "", "num_look": 74259, "num_comment": 3, "author": "Karunesh91", "tags": ["资讯"], "text": "AT&T的“假5G”网络实际速率被发现低于现有4G网络；盗30万条个人信息叫价1比特币 “网偷”被警方抓获；《文明6》竟暗中收集玩家数据，发行商2K作出解释."}
{"title": "SharPyShell：用于C# Web应用程序的小型混淆版WebShell", "url": "https://www.freebuf.com/sectool/198286.html", "time": "2019-03-25", "level": "", "num_look": 112029, "num_comment": 112029, "author": "secist", "tags": ["工具"], "text": "SharPyShell是一个用于C＃Web应用程序的小型混淆版ASP.NET webshell，执行由加密信道接收的命令，并在运行时将它们编译到内存中。"}
{"title": "等保百亿市场属于谁？", "url": "https://www.freebuf.com/articles/network/199081.html", "time": "2019-03-25", "level": "红色标题", "num_look": 192676, "num_comment": 9, "author": "Allen别bb", "tags": ["网络安全"], "text": "等保即将进入2.0时代，将推动信息安全行业需求集中爆发。从产品端和服务端进行测算，新增市场需求超过百亿，行业迎来明显边际改善，利好全产品线的行业领先公司。"}
{"title": "挖洞经验 | 看我如何发现Vimeo的SSRF漏洞（$5000）", "url": "https://www.freebuf.com/vuls/197912.html", "time": "2019-03-25", "level": "", "num_look": 151157, "num_comment": 2, "author": "clouds", "tags": ["漏洞"], "text": "本文分享的是一个关于视频网站Vimeo的SSRF漏洞（服务端请求伪造），可以利用开放重定向和谷歌云实例token获取两种方法，实现Vimeo服务端代码执行，危害严重。"}
{"title": "南瑞集团公司（国家电网电力科学研究院）诚招网络安全开发人才", "url": "https://www.freebuf.com/jobs/198864.html", "time": "2019-03-25", "level": "", "num_look": 143573, "num_comment": 8, "author": "GKINON", "tags": ["安全招聘"], "text": "南瑞集团有限公司（国网电力科学研究院有限公司）是国家电网有限公司直属科研产业单位，是我国能源电力及工业控制领域卓越的IT企业。"}
{"title": "旧树开新花：再谈GitHub监控", "url": "https://www.freebuf.com/articles/web/198721.html", "time": "2019-03-25", "level": "红色标题", "num_look": 226476, "num_comment": 9, "author": "腾讯安全平台部", "tags": ["WEB安全"], "text": "本文不涉及常见的基于代码关键字匹配的GitHub监控。而是从GitHub的账户出发，通过人的关系来获得一些代码搜索不具有的优势。"}
{"title": "那些年挖过的SRC之我是捡漏王", "url": "https://www.freebuf.com/vuls/198327.html", "time": "2019-03-25", "level": "现金奖励", "num_look": 445397, "num_comment": 22, "author": "绿帽子技术分享", "tags": ["WEB安全", "漏洞"], "text": "输出这篇文章的目的也是为了好多人在挖洞时，看到别的大佬钱拿的不要不要的时候，只能在我们自己自己电脑面前一筹莫展，这篇文章也是为了带大家打开新的思路。"}
{"title": "关于黑网贷平台对用户进行信用行为分析", "url": "https://www.freebuf.com/articles/database/198390.html", "time": "2019-03-25", "level": "现金奖励", "num_look": 190407, "num_comment": 7, "author": "mxwx2018", "tags": ["数据安全", "观点"], "text": "对于违反法律顶风作案的黑网贷来说，轻则榨取别人钱财，重则让人倾家荡产、跳楼自尽。他们必须受到法律严惩。"}
{"title": "黑产大数据：短视频及直播行业的暗流涌动", "url": "https://www.freebuf.com/news/198966.html", "time": "2019-03-25", "level": "", "num_look": 193760, "num_comment": 4, "author": "威胁猎人", "tags": ["网络安全", "观点"], "text": "目前短视频及直播行业虚假流量已占黑产流量大头，整篇报告会从行业发展、黑产变现模式、行业黑产数据以及黑产流量预警等几个方面进行探讨。"}
{"title": "BUF早餐铺 | Facebook 数亿用户密码被发现在内部数据库明文保存；勒索软件 PewCrypt 旨在为 PewDiePie 涨粉；特斯拉借黑客大赛找漏洞，Model 3作为奖品被送出", "url": "https://www.freebuf.com/news/199061.html", "time": "2019-03-25", "level": "", "num_look": 74649, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "一个黑客团队在一场黑客大赛中成功入侵了一辆特斯拉的Model 3汽车，而特斯拉则因为他们发现的漏洞奖励了他们一辆汽车。今年年初的时候，特斯拉成为首个参与Pwn2Own黑客大赛的汽车制造商。"}
{"title": "WinRAR漏洞CVE-2018-20250攻击样本分析", "url": "https://www.freebuf.com/articles/system/198858.html", "time": "2019-03-24", "level": "金币+6", "num_look": 151136, "num_comment": 2, "author": "cgf99", "tags": ["系统安全"], "text": "近期截获一例利用最新公布WinRAR漏洞（CVE-2018-20250）的攻击样本，文件名为Meeting summary.rar。"}
{"title": "Simdjson：一个超高速的JSON解析工具", "url": "https://www.freebuf.com/sectool/198277.html", "time": "2019-03-24", "level": "", "num_look": 169785, "num_comment": 5, "author": "周大涛", "tags": ["工具"], "text": "JSON文档在Internet上无处不在，服务器花费大量时间来解析这些文档。我们希望在进行完全验证（包括字符编码）时尽可能使用常用的SIMD指令来加速JSON本身的解析。"}
{"title": "2019年网络犯罪和恶意软件预测", "url": "https://www.freebuf.com/news/197732.html", "time": "2019-03-24", "level": "", "num_look": 93581, "num_comment": 93581, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "本文简要整合并总结了各大安全机构发布的2019年网络犯罪和恶意软件预测报告。"}
{"title": "ECShop 4.0反射型XSS漏洞分析", "url": "https://www.freebuf.com/vuls/198140.html", "time": "2019-03-24", "level": "现金奖励", "num_look": 123792, "num_comment": 8, "author": "Cyc1ing", "tags": ["漏洞"], "text": "Ecshop是国内的一款开源的电商框架，在国内应用较为广泛，当前最新版本为4.0.0，最近对其代码进行了简单的分析，发现可以绕过其filter触发XSS。"}
{"title": "WordPress-5.1.1-CSRF-To-RCE安全事件详析", "url": "https://www.freebuf.com/vuls/198346.html", "time": "2019-03-24", "level": "", "num_look": 85905, "num_comment": 85905, "author": "alphalab", "tags": ["漏洞"], "text": "2019 年 3 月 13 号，RIPS 又放了一个 WordPress 的 CSRF，与此同时 WordPress 官方也提交相应的 Commit，算是一个比较新的洞。"}
{"title": "【BUF大事件】隔屏有耳，美团饿了么是否在“偷听”？不安全数据库泄露中国3300万份简历；三星商城被黑客攻击", "url": "https://www.freebuf.com/video/199053.html", "time": "2019-03-24", "level": "红色标题", "num_look": 112166, "num_comment": 3, "author": "willhuang", "tags": ["视频"], "text": "有用户怀疑外卖App“偷听”自己说话，记者耗时3个月测试调查；不安全数据库泄露中国3300万份简历；三星商城被黑客攻击，Galaxy S10订购页面出现Bug价格遭疯抢。"}
{"title": "挖洞经验 | Facebook Messenger网页版ImageMagick漏洞（$10K）", "url": "https://www.freebuf.com/vuls/197685.html", "time": "2019-03-23", "level": "", "num_look": 145233, "num_comment": 2, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文分享的是Facebook Messenger网页版本的ImageMagick漏洞（CVE-2017–15277），虽然是一个老洞，但也仍然存在于Facebook平台中。"}
{"title": "LibreOffice套件远程代码执行漏洞分析", "url": "https://www.freebuf.com/vuls/197718.html", "time": "2019-03-23", "level": "", "num_look": 91913, "num_comment": 91913, "author": "周大涛", "tags": ["漏洞"], "text": "如今，许多攻击技术都在使用Microsoft Office文档来分发恶意软件。近年来，文档漏洞利用工具包构建器已经有了很多发展，更不用说红色绕过安全解决方案的技巧。"}
{"title": "传奇私服暗藏杀机，亡灵病毒肆虐江湖", "url": "https://www.freebuf.com/articles/system/198869.html", "time": "2019-03-23", "level": "红色标题", "num_look": 167746, "num_comment": 5, "author": "安全豹", "tags": ["系统安全"], "text": "私服客户端一直都是顽固病毒家族繁殖传播的沉疴宿疾。为了对抗竞争者、外挂和安全厂商，私服客户端经常捆绑各类Rootkit/Bootkit类顽固病毒。"}
{"title": "Kerberos协议探索系列之委派篇", "url": "https://www.freebuf.com/articles/system/198381.html", "time": "2019-03-23", "level": "", "num_look": 158091, "num_comment": 1, "author": "云影实验室", "tags": ["系统安全"], "text": "本文主要说明一下在kerberos体系中关于委派的利用方式，委派在域环境中其实是一个很常见的功能，一旦利用也会有很大的危害。"}
{"title": "VRVNAC软件携带恶意程序，公安等行业可能受影响", "url": "https://www.freebuf.com/articles/paper/198032.html", "time": "2019-03-23", "level": "", "num_look": 97144, "num_comment": 2, "author": "火绒安全", "tags": ["安全报告"], "text": "经分析，该产品所使用的功能组件（AdvancedAll.dll）遭Ramnit病毒感染，恶意代码被包含在文件的资源数据中。"}
{"title": "Facebook破例为开源TLS库Fizz漏洞奖赏1万美元", "url": "https://www.freebuf.com/articles/network/198964.html", "time": "2019-03-22", "level": "", "num_look": 92383, "num_comment": 92383, "author": "奇安信代码卫士", "tags": ["网络安全"], "text": "因该漏洞严重程度高，因此Facebook破例为原本不再奖励范围内的漏洞颁发1万美元的奖励。"}
{"title": "AutoRDPwn v4.8：一款功能强大的隐蔽型渗透框架", "url": "https://www.freebuf.com/sectool/198684.html", "time": "2019-03-22", "level": "", "num_look": 134476, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫AutoRDPwn的隐蔽型攻击框架，实际上AutoRDPwn是一个PowerShell脚本，它可以实现对Windows设备的自动化攻击。"}
{"title": "Cat-Nip：专用于Kali Linux的自动化基础渗透测试工具", "url": "https://www.freebuf.com/sectool/198150.html", "time": "2019-03-22", "level": "", "num_look": 147008, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Cat-Nip的开源渗透测试工具，该工具针对Kali Linux开发，可帮助研究人员自动化完成基础的渗透测试。"}
{"title": "企业数字风险管理优化四部曲（基础框架版）", "url": "https://www.freebuf.com/articles/es/198240.html", "time": "2019-03-22", "level": "红色标题", "num_look": 125950, "num_comment": 3, "author": "AngelaY", "tags": ["企业安全"], "text": "要想真正有效地利用威胁情报来缓解风险，管理者必须能合理地评估并管理企业组织中的风险、梳理清楚需要保护的资产、了解联网系统的弱点所在以及可能会被攻击者入侵的环节。"}
{"title": "利用msbuild.exe绕过应用程序白名单安全机制的多种姿势", "url": "https://www.freebuf.com/articles/network/197706.html", "time": "2019-03-22", "level": "红色标题", "num_look": 139436, "num_comment": 6, "author": "周大涛", "tags": ["网络安全"], "text": "Visual Studio使用MSBuild，但它不依赖于Visual Studio。通过 在项目或解决方案文件上调用  msbuild.exe，您可以在未安装Visual Studio的环境中组织和构建产品。"}
{"title": "WannaMine升级到V4.0版本，警惕中招！", "url": "https://www.freebuf.com/articles/terminal/198891.html", "time": "2019-03-22", "level": "", "num_look": 197732, "num_comment": 4, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "多个企业反馈大量主机和服务存在卡顿和蓝屏现象，深信服安全团队研究发现，该企业用户中的是最新型的WannaMine变种。"}
{"title": "赛门铁克2019年互联网安全威胁报告", "url": "https://www.freebuf.com/news/198355.html", "time": "2019-03-22", "level": "", "num_look": 133404, "num_comment": 5, "author": "Karunesh91", "tags": ["资讯"], "text": "如同蜂蝶追花逐蜜一样，网络不法分子总是青睐最新的漏洞利用，企图以最小的付出快速赚到大钱。"}
{"title": "浅谈MFC类CrackMe中消息处理函数查找方法", "url": "https://www.freebuf.com/news/197755.html", "time": "2019-03-22", "level": "", "num_look": 74635, "num_comment": 4, "author": "kdsj", "tags": [], "text": "近一个学姐发给我了一份CrackMe希望我解一下，其中涉及到了MFC的消息函数查找的问题，就顺便以此为例谈一下自己使用的消息函数查找的方法。"}
{"title": "BUF早餐铺 | ISACA发布针对区块链、CASB和GDPR的全新审计程序；谷歌白帽子发现Windows系统全新漏洞门类；谷歌开源内部沙箱安全策略Sandboxed API", "url": "https://www.freebuf.com/news/198863.html", "time": "2019-03-22", "level": "", "num_look": 73698, "num_comment": 2, "author": "Freddy", "tags": ["资讯"], "text": "谷歌宣布称将开源 Sandboxed API 以促使软件开发人员更容易地创建安全的产品。"}
{"title": "Sality感染蠕虫复活来袭，传播“剪切板幽灵”病毒窃取比特币", "url": "https://www.freebuf.com/articles/system/198651.html", "time": "2019-03-22", "level": "", "num_look": 124187, "num_comment": 124187, "author": "安全豹", "tags": ["系统安全"], "text": "近期，金山毒霸安全实验室“捕风”系统捕获到一批异常活跃的样本，该样本会监控剪切板，将比特币和以太坊的钱包地址，替换成自己的钱包地址。"}
{"title": "Faraday：一款多功能协同式渗透测试工具&漏洞管理平台", "url": "https://www.freebuf.com/articles/web/198112.html", "time": "2019-03-21", "level": "", "num_look": 205107, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "今天给大家介绍的是一款名叫Fareday的工具，它是一款协同式多功能渗透测试及漏洞管理平台。"}
{"title": "利用ADIDNS绕过GQBL限制并解析WPAD域名", "url": "https://www.freebuf.com/vuls/197735.html", "time": "2019-03-21", "level": "", "num_look": 109166, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["漏洞", "网络安全"], "text": "几个月前，作者曾写过一篇关于攻击ADIDNS的文章。这篇文章中主要讨论ADIDNS攻击端和防御端的额外技术。"}
{"title": "小师妹聊安全标准", "url": "https://www.freebuf.com/articles/es/197825.html", "time": "2019-03-21", "level": "红色标题", "num_look": 536841, "num_comment": 34, "author": "xxx幸xxx", "tags": ["企业安全"], "text": "作为公司信息安全咨询岗上的小师妹儿，我对自己以后的安全路非常焦灼，到底该往哪个方向去发展？"}
{"title": "东方航空招聘高级安全人才", "url": "https://www.freebuf.com/jobs/179412.html", "time": "2019-03-21", "level": "", "num_look": 335946, "num_comment": 20, "author": "SixSixSix", "tags": ["安全招聘"], "text": "中国东方航空股份有限公司（ChinaEastern Airlines），是一家总部位于中国上海的国有控股航空公司，在原中国东方航空集团公司的基础上，兼并中国西北航空公司，联合中国云南航空公司重组而成。"}
{"title": "逆向分析流氓软件自我复制以及防御思路", "url": "https://www.freebuf.com/articles/system/198023.html", "time": "2019-03-21", "level": "现金奖励", "num_look": 152154, "num_comment": 13, "author": "星空111", "tags": ["系统安全"], "text": "好长时间没有投稿了，之前被发布的稿件，也收到了Freebuf的现金奖励，同时陆陆续续收到好多圈类人士的夸奖，备受鼓舞，就再来了一篇~"}
{"title": "2019年2月热门恶意软件调查结果出炉", "url": "https://www.freebuf.com/news/198107.html", "time": "2019-03-21", "level": "", "num_look": 117385, "num_comment": 3, "author": "Karunesh91", "tags": ["数据安全", "资讯"], "text": "2019年2月Check Point恶意软件调查榜单出炉。尽管Coinhive已经在2019年3月8日关闭，但是在Check Point的全球威胁指数调查中，它的威胁仍旧居高不下。"}
{"title": "Tar解压漏洞的验证方法及其临时修复方案", "url": "https://www.freebuf.com/vuls/197716.html", "time": "2019-03-21", "level": "现金奖励", "num_look": 474647, "num_comment": 10, "author": "LEdge1", "tags": ["漏洞"], "text": "之前WinRAR出现的漏洞，没几天网上就出现了各种利用这种漏洞的攻击了，想到这，我突然想起来Linux下也有这么一款解压软件也是有漏洞的。今天给大家说一说吧 ！"}
{"title": "BUF早餐铺 | DDoS服务类攻击规模降低85%；欧盟政府网站使用来自Google等公司的跟踪器；微软升级病毒库导致Windows 7/8.1端Defender无法正常工作", "url": "https://www.freebuf.com/news/198835.html", "time": "2019-03-21", "level": "", "num_look": 63707, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "春分雨脚落声微~"}
{"title": "EOS新型攻击手法之hard_fail状态攻击", "url": "https://www.freebuf.com/vuls/197973.html", "time": "2019-03-21", "level": "", "num_look": 154070, "num_comment": 154070, "author": "SlowMist慢雾科技", "tags": ["区块链安全", "漏洞"], "text": "本次攻击手法之前没有相同的案例，但可以归为假充值类别中的一种。对此慢雾安全团队进行了深入的分析。"}
{"title": "个人蜜罐Cowrie的运营分析", "url": "https://www.freebuf.com/articles/network/197714.html", "time": "2019-03-20", "level": "现金奖励", "num_look": 212279, "num_comment": 5, "author": "si1ence", "tags": ["网络安全"], "text": "最近运营了一下蜜罐的效果感觉收获还是挺多的，恰好Pandazhengzheng也有空说要手把手教我走向逆向大佬之路。"}
{"title": "一次命中可疑威胁情报的分析探索", "url": "https://www.freebuf.com/articles/web/198278.html", "time": "2019-03-20", "level": "", "num_look": 425531, "num_comment": 6, "author": "si1ence", "tags": ["WEB安全"], "text": "由于最近一段时间里”驱动人生”这个病毒还挺热门，最近发现通过一些安全厂商的设备发现内网里面有大量的主机都中了这个病毒瞬间吓哭了。"}
{"title": "Buhtrap新动向：针对俄罗斯、白俄罗斯金融机构的攻击活动", "url": "https://www.freebuf.com/articles/network/198688.html", "time": "2019-03-20", "level": "", "num_look": 160202, "num_comment": 160202, "author": "腾讯电脑管家", "tags": ["网络安全"], "text": "该家族的木马主要针对俄罗斯、乌克兰等地的金融目标进行攻击，根据Group-IB和ESET的研究结果来看，该恶意文件至少从2014年就开始活跃。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列-Tanner", "url": "https://www.freebuf.com/video/198779.html", "time": "2019-03-20", "level": "红色标题", "num_look": 79673, "num_comment": 2, "author": "willhuang", "tags": ["视频"], "text": "Tanner，@itscachemoney，来自旧金山的安全工程师，在工作之余积极参与漏洞众测，目前在HackerOne提交的有效漏洞为357个，在实时榜单上排名第36位。"}
{"title": "IoT-Implant-Toolkit：一款针对IoT设备的木马测试工具", "url": "https://www.freebuf.com/sectool/198174.html", "time": "2019-03-20", "level": "", "num_look": 176374, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具", "终端安全"], "text": "这款工具专门针对物联网设备而设计，可直接向目标IoT设备植入木马，广大研究人员可利用这款工具来测试IoT设备的安全性。"}
{"title": "信息安全走进校园：「漏洞盒子高校V计划」首站精彩回顾", "url": "https://www.freebuf.com/fevents/198735.html", "time": "2019-03-20", "level": "红色标题", "num_look": 69177, "num_comment": 3, "author": "漏洞盒子", "tags": ["活动"], "text": "2019年3月12日，「漏洞盒子高校V计划」登陆电子科技大学~"}
{"title": "被CrazyCrypt2.1勒索病毒加密了？已有一键解密工具！", "url": "https://www.freebuf.com/articles/terminal/198100.html", "time": "2019-03-20", "level": "", "num_look": 132366, "num_comment": 3, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "国外分析人员报出CrazyCrypt 2.1勒索病毒，该勒索病毒集加解密模块于一体，通过AES加密算法对文件进行加密。"}
{"title": "如何检测Pass-the-Hash攻击？", "url": "https://www.freebuf.com/articles/system/197660.html", "time": "2019-03-20", "level": "", "num_look": 131064, "num_comment": 1, "author": "secist", "tags": ["系统安全"], "text": "本文将教大家如何使用本机Windows事件日志检测pass-the-hash，以及一些关于如何实现的实用建议。"}
{"title": "中汽中心智能网联汽车安全研究团队招聘", "url": "https://www.freebuf.com/jobs/198309.html", "time": "2019-03-20", "level": "", "num_look": 74034, "num_comment": 1, "author": "数据资源中心", "tags": ["安全招聘"], "text": "中国汽车技术研究中心有限公司是1985年根据国家对汽车行业管理的需要，经国家科委批准成立的科研院所，是中国唯一的汽车行业技术归口单位和国家政府主管部门的技术支撑机构。"}
{"title": "AFL漏洞挖掘技术漫谈（二）：Fuzz结果分析和代码覆盖率", "url": "https://www.freebuf.com/articles/system/197678.html", "time": "2019-03-20", "level": "", "num_look": 187203, "num_comment": 187203, "author": "alphalab", "tags": ["系统安全"], "text": "因为afl-fuzz永远不会停止，所以何时停止测试很多时候就是依靠afl-fuzz提供的状态来决定的。"}
{"title": "Facebook数据造假，竟涉及多家中国公司", "url": "https://www.freebuf.com/news/197969.html", "time": "2019-03-20", "level": "红色标题", "num_look": 115169, "num_comment": 9, "author": "GEETEST极验", "tags": ["资讯"], "text": "一个创立十五年的社交网站，全球用户量超过20亿。但是却屡屡遭遇隐私问题争议，最近还出现相关报告发布称其20亿用户或超半数都为“虚假账户”......"}
{"title": "BUF早餐铺 | 欧盟政府网站被发现使用来自 Google 等公司的跟踪器；记者耗时3个月测试，美团饿了么是否在“偷听”；9款违规App曝光，涉及恶意扣费、隐私窃取、赌博", "url": "https://www.freebuf.com/news/198675.html", "time": "2019-03-20", "level": "", "num_look": 65839, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "你遇到过这样的情况吗？刚说了想吃什么，手机就蹦出了它的推荐；刚说了要买什么，就出现了广告。可是，手机怎么知道你刚刚说了什么呢？"}
{"title": "探针盒子？不用怕！手把手教你打造专属隐私保护工具", "url": "https://www.freebuf.com/sectool/198525.html", "time": "2019-03-19", "level": "红色标题", "num_look": 348582, "num_comment": 25, "author": "知道创宇KCSC", "tags": ["工具"], "text": "大概是 6 年前，一次酒店数据泄露事件使得我的个人隐私被彻底曝光。那次数据泄露在业内造成了很大的轰动，当时在网上也有很多网友对此展开了激烈的讨论。"}
{"title": "用来组流的网络数据包嗅探器：Streamdump", "url": "https://www.freebuf.com/sectool/197915.html", "time": "2019-03-19", "level": "金币+6", "num_look": 139018, "num_comment": 2, "author": "scu-igroup", "tags": ["工具"], "text": "在平时需要对数据包进行分析和统计，亦或是进行抓包时，通常会使用 Wireshark 或者 tcpdump 等工具。今天介绍一款名叫Streamdump工具~"}
{"title": "SIEM中心日志节点WEF搭建说明", "url": "https://www.freebuf.com/articles/es/197812.html", "time": "2019-03-19", "level": "现金奖励", "num_look": 122553, "num_comment": 4, "author": "mr.anderson", "tags": ["企业安全"], "text": "本文将介绍如何通过 WEF(Windows Event Forwarding) 将windows 主机日志汇总到一台中心节点，并输入到ElasticSearch ，最后通过Kibana 的展示。"}
{"title": "委内瑞拉大规模停电事件的初步分析与思考启示", "url": "https://www.freebuf.com/articles/paper/198406.html", "time": "2019-03-19", "level": "红色标题", "num_look": 351472, "num_comment": 3, "author": "antiylab", "tags": ["安全报告"], "text": "2019年3月7日傍晚（当地时间）开始，委内瑞拉国内包括首都加拉加斯在内的大部分地区停电超过24小时，在委内瑞拉23个州中，一度有20个州全面停电。"}
{"title": "修改Empire绕过Windows Defender", "url": "https://www.freebuf.com/articles/system/197558.html", "time": "2019-03-19", "level": "", "num_look": 125475, "num_comment": 1, "author": "secist", "tags": ["系统安全"], "text": "Empire是一款后渗透利用代理工具，其中包含各种工具。"}
{"title": ".NET高级代码审计（第四课）JavaScriptSerializer反序列化漏洞", "url": "https://www.freebuf.com/articles/web/198617.html", "time": "2019-03-19", "level": "", "num_look": 115308, "num_comment": 115308, "author": "云影实验室", "tags": ["WEB安全"], "text": "本文笔者从原理和代码审计的视角对 JavaScriptSerializer反序列化漏洞做了相关介绍和复现。"}
{"title": "【议题征集】数据治理与安全运营 | FreeBuf企业安全俱乐部「上海站」", "url": "https://www.freebuf.com/fevents/198219.html", "time": "2019-03-19", "level": "红色标题", "num_look": 60545, "num_comment": 60545, "author": "FB独家", "tags": ["企业资讯", "活动"], "text": "4月24日，「FreeBuf 企业安全俱乐部」系列沙龙活动「2019年企业安全数据治理专场」在上海盛大开幕。"}
{"title": "Kthrotlds挖矿病毒详细分析报告", "url": "https://www.freebuf.com/articles/system/197136.html", "time": "2019-03-19", "level": "", "num_look": 186581, "num_comment": 3, "author": "默安科技_影武者实验室", "tags": ["系统安全"], "text": "该病毒为之前的watchdogs的变种，通过Redis未授权访问漏洞及ssh弱口令进行突破植入，随后释放挖矿木马进行挖矿操作，并对内外网主机进行redis漏洞攻击及ssh暴力破解攻击。"}
{"title": "Selenium初探之自动备份设备配置文件及上传", "url": "https://www.freebuf.com/sectool/197756.html", "time": "2019-03-19", "level": "现金奖励", "num_look": 94045, "num_comment": 1, "author": "hackerbaba", "tags": ["工具"], "text": "在传统的网络安全架构中，难免会有一些重要的安全设备或是软件配置需要定期备份，统一归档。一是为了满足合规，二是在设备变更出现问题的时候，能够快速回滚。"}
{"title": "等保到底是个啥（二）：网络安全部分", "url": "https://www.freebuf.com/articles/security-management/197357.html", "time": "2019-03-19", "level": "现金奖励", "num_look": 698815, "num_comment": 8, "author": "宇宸de研究室", "tags": ["安全管理", "标准与合规"], "text": "本篇将会重点讨论一下等保中对网络安全的要求。文章已等保三级系统为基础，从合规角度解读要求。"}
{"title": "BUF早餐铺丨一家健康科技公司正在泄露大量医疗记录和处方；18岁日本少年被控窃取13万美元数字货币；以色列总理候选人遭伊朗网络间谍攻击，个人数据泄露", "url": "https://www.freebuf.com/news/198567.html", "time": "2019-03-19", "level": "", "num_look": 71209, "num_comment": 2, "author": "Karunesh91", "tags": ["资讯"], "text": "刚说想吃“日料”马上首位推荐 外卖App在“偷听”你说话吗？一家健康科技公司正在泄露大量医疗记录和处方；18岁日本少年被控窃取13万美元数字货币"}
{"title": "EOS假充值（hard_fail 状态攻击）红色预警细节披露与修复方案", "url": "https://www.freebuf.com/vuls/198213.html", "time": "2019-03-18", "level": "", "num_look": 109497, "num_comment": 1, "author": "SlowMist慢雾科技", "tags": ["区块链安全", "漏洞"], "text": "2019 年 3 月 10 日，我们捕获了 EOS DApp 上的一种新型攻击手法。"}
{"title": "RSA 2019 | 网络安全可视化在云环境下何去何从", "url": "https://www.freebuf.com/articles/network/198208.html", "time": "2019-03-18", "level": "", "num_look": 103880, "num_comment": 103880, "author": "abtnetworks2018", "tags": ["网络安全"], "text": "云安全超过网络安全和数据安全跃居第一位。网络安全可视化产品与技术，自然少不了在云环境下的发力，已然在云环境下开始了一轮新的比拼。"}
{"title": "【BUF大事件】网络安全3·15视频专题", "url": "https://www.freebuf.com/video/198509.html", "time": "2019-03-18", "level": "红色标题", "num_look": 87745, "num_comment": 87745, "author": "willhuang", "tags": ["视频"], "text": "自诞生起，315晚会一共报道11起“个人信息安全”事件。本期网络安全315专题就带你看看最近又有哪些消费者信息安全问题。"}
{"title": "Kunpeng：一次跨语言跨平台漏洞检测框架使用体验和实践", "url": "https://www.freebuf.com/sectool/197736.html", "time": "2019-03-18", "level": "现金奖励", "num_look": 158917, "num_comment": 2, "author": "wstart", "tags": ["工具"], "text": "最近在玩漏洞检测的工具时候发现一个比较有意思的漏洞检测框架，Kunpeng，它的构造理念是写一次POC，不分语言，不分系统，不分平台的可以运行。"}
{"title": "从生产安全体系视角看数据安全", "url": "https://www.freebuf.com/articles/database/197933.html", "time": "2019-03-18", "level": "金币+6", "num_look": 160904, "num_comment": 2, "author": "QZ123321", "tags": ["数据安全"], "text": "对于很多新型的网络安全问题，信息安全体系已有局限，我们如何来去思考未来的网络空间的体系呢？"}
{"title": "挖洞经验 | SAML漏洞的发现与利用", "url": "https://www.freebuf.com/vuls/197976.html", "time": "2019-03-18", "level": "", "num_look": 99907, "num_comment": 99907, "author": "Alpha_h4ck", "tags": ["漏洞"], "text": "在这篇文章中，我们将跟大家演示如何利用该这些不安全的配置并结合有效的钓鱼攻击，来帮助攻击者远程访问那些可能包含敏感信息的安全页面。"}
{"title": "当美国总统，这大概是黑客的最高段位吧", "url": "https://www.freebuf.com/news/198479.html", "time": "2019-03-18", "level": "红色标题", "num_look": 235738, "num_comment": 4, "author": "shidongqi", "tags": ["资讯"], "text": "身在安全圈的你，也许遇到过很多黑客，除了黑客的标签之外，同样还背着其他身份，可能是公司高管、网红、漏洞猎人……而最近，一个黑客出身的人正式宣布将参加2020年美国总统竞选。"}
{"title": "瑞星首家发现Hybrid Analysis网站数据被“驱动人生木马”污染", "url": "https://www.freebuf.com/news/197653.html", "time": "2019-03-18", "level": "", "num_look": 97952, "num_comment": 3, "author": "瑞星", "tags": ["资讯"], "text": "近日，瑞星安全专家在追踪病毒线索时，发现知名沙盒Hybrid Analysis网站数据被“驱动人生木马”污染，导致大量的检测结果均显示恶意。"}
{"title": "网络安全漫谈及实战摘要", "url": "https://www.freebuf.com/news/183694.html", "time": "2019-03-18", "level": "", "num_look": 324274, "num_comment": 2, "author": "星空111", "tags": [], "text": "关于信息安全基础方面，以下是总结出来的一些算是经验之谈，希望能帮到大家。"}
{"title": "活动回顾 | 直击菜鸟SRC x 漏洞盒子白帽子城市沙龙「成都站」现场", "url": "https://www.freebuf.com/fevents/198456.html", "time": "2019-03-18", "level": "", "num_look": 254241, "num_comment": 1, "author": "FB客服", "tags": ["活动"], "text": "菜鸟SRC x 漏洞盒子白帽子城市沙龙「成都站」活动现场一睹为快~"}
{"title": "浅谈RASP技术攻防之基础篇", "url": "https://www.freebuf.com/articles/web/197823.html", "time": "2019-03-18", "level": "", "num_look": 339244, "num_comment": 1, "author": "安百科技", "tags": ["WEB安全"], "text": "本文就笔者研究RASP的过程进行了一些概述，技术干货略少，偏向于普及RASP技术。可以让大家更好的了解一些关于web应用程序安全防护的技术。"}
{"title": "从零开始聊一聊态势感知", "url": "https://www.freebuf.com/articles/es/197268.html", "time": "2019-03-18", "level": "现金奖励", "num_look": 501838, "num_comment": 4, "author": "Yale1024", "tags": ["企业安全"], "text": "在15年阿里的安全峰会上道哥提到态势感知，国人才开始了解到态势感知，直至习大大在“4.19”上正式谈到，国内的乙方的对态势感知这一块才下了大投入进行研发。"}
{"title": "BUF早餐铺 | 工信部要求应用商店全面下架“社保掌上通”APP；不安全数据库泄露中国3300万份简历；WinRAR bug被用于安装恶意程序", "url": "https://www.freebuf.com/news/198434.html", "time": "2019-03-18", "level": "", "num_look": 84864, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "英美在线商店数千名用户的支付数据被窃取 ；环球易购旗下跨境电商网站Gearbest泄露数百万用户信息和订单；三星商城被黑客攻击：Galaxy S10订购页面出现Bug价格遭疯抢"}
{"title": "Ponce：一键即可实现符号执行（IDA插件）", "url": "https://www.freebuf.com/sectool/197708.html", "time": "2019-03-17", "level": "", "num_look": 131608, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Ponce是一款IDA Pro插件，该工具采用C/C++开发，它可以帮助用户以一种快速简洁的方式对目标代码进行污点测试以及符号执行。"}
{"title": "挖洞经验 | 通过一个网页识别Facebook用户当前登录状态", "url": "https://www.freebuf.com/vuls/197578.html", "time": "2019-03-17", "level": "红色标题", "num_look": 145753, "num_comment": 3, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文分享的是一个关于Facebook的漏洞，漏洞机制是可以通过一个网页，输入Facebook用户ID，来识别其对应的Facebook用户在当前时间内，是否处于Facebook登录状态。"}
{"title": "BankThief：针对波兰和捷克的新型银行钓鱼攻击", "url": "https://www.freebuf.com/articles/paper/197523.html", "time": "2019-03-17", "level": "", "num_look": 109562, "num_comment": 2, "author": "ADLab", "tags": ["安全报告"], "text": "该木马将自身伪装成“Google Play”应用，利用系统辅助服务功能监控感染设备，以便在合法的银行APP运行时，启用对应的伪造好的银行钓鱼界面将其覆盖掉，来窃取受害用户的银行登录凭证。"}
{"title": "在被窝就能打卡？虚拟定位“神器”了解一下", "url": "https://www.freebuf.com/sectool/197552.html", "time": "2019-03-17", "level": "", "num_look": 356704, "num_comment": 12, "author": "GEETEST极验", "tags": ["工具"], "text": "最近天气迟迟不转晴，导致我和被子的感情越来越深，看看上个月的考勤表……"}
{"title": "TransparentTribe 2019年针对印度的攻击活动报告", "url": "https://www.freebuf.com/articles/network/197398.html", "time": "2019-03-17", "level": "", "num_look": 187473, "num_comment": 1, "author": "腾讯电脑管家", "tags": ["网络安全"], "text": "TransparentTribe APT组织，又称ProjectM、C-Major，是一个来自巴基斯坦的APT攻击组织，主要目标是针对印度政府、军事目标等。"}
{"title": "DCOMrade：一款枚举DCOM应用漏洞的PowerSHell脚本", "url": "https://www.freebuf.com/sectool/197710.html", "time": "2019-03-16", "level": "", "num_look": 80436, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫DCOMrade的工具（PowerShell脚本），各位研究人员可利用该工具来枚举存在漏洞的DCOM应用程序。"}
{"title": "澳大利亚议会网络攻击活动相关的恶意程序分析", "url": "https://www.freebuf.com/articles/network/197390.html", "time": "2019-03-16", "level": "", "num_look": 94338, "num_comment": 1, "author": "clouds", "tags": ["网络安全"], "text": "2月初，澳大利亚议会遭遇了一场有针对性的网络攻击。澳总理声称：黑客曾试图入侵澳大利亚议会网络系统。"}
{"title": "3·15曝光台 | Wi-Fi 探针——潜伏在你身边的“信息窃贼”", "url": "https://www.freebuf.com/news/198385.html", "time": "2019-03-16", "level": "红色标题", "num_look": 407787, "num_comment": 19, "author": "shidongqi", "tags": ["资讯"], "text": "今年的3·15晚会，又一次让普通用户见识到了黑产的套路，只能言不由衷的感叹一句：防不胜防啊……"}
{"title": "解析Axonius为什么能获得2019 RSAC创新大奖？", "url": "https://www.freebuf.com/news/197855.html", "time": "2019-03-16", "level": "金币+6", "num_look": 85736, "num_comment": 1, "author": "wzwzwz", "tags": ["资讯"], "text": "Axonius能够从2019年的众多初创企业中脱颖而出，并且在最后10个企业的决赛中拔得头筹实属不易。"}
{"title": "聚焦3.15 | 虚假保健品泛滥，保健品行业安全态势报告", "url": "https://www.freebuf.com/articles/paper/198375.html", "time": "2019-03-15", "level": "", "num_look": 101558, "num_comment": 1, "author": "AdlerI", "tags": ["安全报告"], "text": "本报告综合分析保健品行业经营行为特征，结合正负面舆情自动聚合和用户投诉举报数据，生成了以下报告，以供读者了解保健品行业的真相 。"}
{"title": "恰逢3·15，网信办联合市场监管总局出招治理APP隐私乱象", "url": "https://www.freebuf.com/news/198360.html", "time": "2019-03-15", "level": "", "num_look": 75406, "num_comment": 1, "author": "Allen别bb", "tags": ["资讯"], "text": "恰逢“3·15”，市场监管总局联合中央网信办，为规范移动互联网应用程序收集、使用用户信息特别是个人信息的行为，加强个人信息安全保护，决定开展App安全认证工作。"}
{"title": "Fibratus：一款功能强大的Windows内核漏洞利用和跟踪工具", "url": "https://www.freebuf.com/sectool/197709.html", "time": "2019-03-15", "level": "", "num_look": 120373, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Fibratus的开源工具，广大研究人员可以使用这款功能强大的工具来进行Windows内核漏洞利用、挖掘与跟踪。"}
{"title": "快讯 | 环球易购旗下跨境电商网站Gearbest泄露数百万用户信息和订单", "url": "https://www.freebuf.com/news/198331.html", "time": "2019-03-15", "level": "", "num_look": 110186, "num_comment": 2, "author": "AdlerI", "tags": ["资讯"], "text": "目前，研究人员已经联系了Gearbest ，但是Gearbest既没有关闭数据库保护数据也没有任何回应。"}
{"title": "窃听Telegram Bot的恶意软件", "url": "https://www.freebuf.com/articles/network/197124.html", "time": "2019-03-15", "level": "", "num_look": 138163, "num_comment": 4, "author": "周大涛", "tags": ["网络安全"], "text": "Telegram处理通过其Bot API发送的消息的方式存在重大缺陷。由于Bot API的工作原理，可以为对手提供目标机器人发送或接收的所有消息的完整历史记录。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列-Ariel Garcia", "url": "https://www.freebuf.com/video/198251.html", "time": "2019-03-15", "level": "红色标题", "num_look": 100508, "num_comment": 3, "author": "willhuang", "tags": ["视频"], "text": "Ariel Garcia来自阿根廷的30岁白帽。他算是才入门漏洞众测不久的白帽，只参与了一场HackerOne实时赛事和几个邀请项目。他鼓励新手白帽们，别放弃别抛弃，坚持总会有所回报。"}
{"title": "CNNVD关于微软多个安全漏洞的通报", "url": "https://www.freebuf.com/news/198187.html", "time": "2019-03-15", "level": "", "num_look": 123243, "num_comment": 1, "author": "CNNVD", "tags": ["漏洞", "资讯"], "text": "近日，微软官方发布了多个安全漏洞的公告，包括Windows ActiveX远程代码执行漏洞、Internet Explorer 内存损坏漏洞、Chakra脚本引擎内存损坏漏洞等多个漏洞。"}
{"title": "Windows DHCPServer远程代码执行漏洞分析（CVE-2019-0626）", "url": "https://www.freebuf.com/vuls/197309.html", "time": "2019-03-15", "level": "", "num_look": 164811, "num_comment": 5, "author": "ADLab", "tags": ["安全报告", "漏洞"], "text": "2月12日，微软发布2月份月度例行安全公告，修复了多个高危漏洞，其中包括Windows DHCP Server远程代码执行漏洞CVE-2019-0626。"}
{"title": "2018年度回顾：挖矿木马为什么会成为病毒木马黑产的中坚力量", "url": "https://www.freebuf.com/articles/paper/197024.html", "time": "2019-03-15", "level": "红色标题", "num_look": 160667, "num_comment": 3, "author": "腾讯电脑管家", "tags": ["安全报告"], "text": "2018年挖矿木马样本月产生数量在百万级别，且上半年呈现快速增长趋势，下半年上涨趋势有所减缓。"}
{"title": "浅谈从IT治理的角度看企业建设", "url": "https://www.freebuf.com/articles/security-management/197695.html", "time": "2019-03-15", "level": "现金奖励", "num_look": 178785, "num_comment": 3, "author": "宇宸de研究室", "tags": ["安全管理"], "text": "管理层面的理论更偏向于宏观层面，考虑的更为广泛和细致，看到国外的新知识发现思维和我们确实不太一样，有时候要一改之前的思考方式，换角度看问题。"}
{"title": "BUF早餐铺 | Microsoft发布2019年3月安全更新；Wordpress 5.1.1修复可导致网站被接管的XSS漏洞；虚拟化和软件供应商思杰称其内网遭黑客入侵", "url": "https://www.freebuf.com/news/198166.html", "time": "2019-03-15", "level": "", "num_look": 75521, "num_comment": 4, "author": "Freddy", "tags": ["资讯"], "text": "今天是3.15，你关注哪些热点呢？"}
{"title": "两款浏览器扩展插件劫持漏洞分析", "url": "https://www.freebuf.com/vuls/196622.html", "time": "2019-03-15", "level": "金币+6", "num_look": 125913, "num_comment": 1, "author": "tonyxx", "tags": ["漏洞"], "text": "当通过 tarnish 扫描大量 Chrome 扩展程序时，我发现了两款流行的 Chrome 扩展程序在浏览器的操作页中存在 XSS 漏洞。"}
{"title": "RSAC 2019三大趋势：当我们谈论信任的时候我们在谈论什么", "url": "https://www.freebuf.com/news/198263.html", "time": "2019-03-14", "level": "", "num_look": 102425, "num_comment": 1, "author": "Hillstone", "tags": ["数据安全", "资讯"], "text": "计算机和AI技术的发展深刻改变了人类的生活，然而糟糕的是，我们投入了太多的精力在虚拟的网络世界中，信任的建立看起来仍然遥不可及。"}
{"title": "铃铃铃，FIT 2019企业安全俱乐部喊你上课了", "url": "https://www.freebuf.com/news/198104.html", "time": "2019-03-14", "level": "", "num_look": 71134, "num_comment": 71134, "author": "FB客服", "tags": ["资讯"], "text": "企业安全俱乐部第三堂课开课啦，各位关注企业安全的朋友们，走起～"}
{"title": "WinRAR目录穿越漏洞浅析及复现（CVE-2018-20250）", "url": "https://www.freebuf.com/vuls/197745.html", "time": "2019-03-14", "level": "现金奖励", "num_look": 202931, "num_comment": 9, "author": "ERFZE", "tags": ["漏洞"], "text": "我是于2月21号看见各大安全网站都发布了\"WINRAR曝出严重漏洞，影响全球5亿用户\"的文章，才了解到这个漏洞。等到真正去研究它，是backlion师傅已经将exp发出来之后了。"}
{"title": "Sh00t：一个渗透测试管理工具", "url": "https://www.freebuf.com/sectool/197395.html", "time": "2019-03-14", "level": "", "num_look": 187469, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "Sh00t是一个高可定制的渗透测试管理工具，它强调让测试人员手动进行安全测试，并让你专注于执行安全测试任务的本身。"}
{"title": "对印度某电子商务公司从LFI到数据库获取的渗透测试过程", "url": "https://www.freebuf.com/articles/web/197131.html", "time": "2019-03-14", "level": "红色标题", "num_look": 150472, "num_comment": 6, "author": "clouds", "tags": ["WEB安全"], "text": "本文分享的是作者在渗透测试过程中，通过不同漏洞的组合利用，最终拿下印度某大型电子商务公司数据库权限的一个复现。"}
{"title": "斗象科技（FreeBuf、漏洞盒子、网藤智能安全）招聘啦！", "url": "https://www.freebuf.com/jobs/198013.html", "time": "2019-03-14", "level": "", "num_look": 173762, "num_comment": 5, "author": "FB客服", "tags": ["安全招聘"], "text": "斗象科技团队来自阿里巴巴、百度、华为、Checkpoint等顶级互联网及 IT 公司，以创始团队为核心，已聚集了一支全球化最具专业性的服务团队，超过 70% 的成员是网络安全、大数据、人工智能等领域的资深专家。"}
{"title": "回忆杀！CS 1.6服务器已成为恶意软件的传播渠道", "url": "https://www.freebuf.com/news/198159.html", "time": "2019-03-14", "level": "", "num_look": 99532, "num_comment": 4, "author": "Freddy", "tags": ["资讯"], "text": "Counter-Strike 1.6（CS1.6）已经廉颇老矣，没想到“CS 1.6”这个名词再次出现眼前是因为俄罗斯杀毒软件厂商Dr.Web的一份恶意软件报告。"}
{"title": "Adobe ColdFusion反序列化RCE漏洞分析(CVE-2019-7091)", "url": "https://www.freebuf.com/vuls/196935.html", "time": "2019-03-14", "level": "", "num_look": 121336, "num_comment": 1, "author": "ADLab", "tags": ["漏洞"], "text": "2019年2月12日，Adobe官方发布了针对Adobe ColdFusion的安全更新补丁，编号为APSB19-10。"}
{"title": "2019 RSAC | 青梅煮酒论未来：PM眼中的智能安全分析发展趋势", "url": "https://www.freebuf.com/news/198093.html", "time": "2019-03-14", "level": "", "num_look": 53197, "num_comment": 53197, "author": "瀚思科技", "tags": ["资讯"], "text": "RSAC也是个很好的平台，可以和国内外智能安全分析领域（SIEM/UEBA/XDR/NTA/EDR）知名厂商的产品经理，以及分析师、全球客户、合作伙伴进行深度交流，畅谈这一领域的现状和未来。"}
{"title": "绿盟2018 DDoS攻击态势报告", "url": "https://www.freebuf.com/articles/paper/197236.html", "time": "2019-03-14", "level": "", "num_look": 173889, "num_comment": 3, "author": "NSFOCUS", "tags": ["安全报告"], "text": "2018年，得益于互联网的快速发展，变革的触角伸向了网络空间和现实世界的各个角落。在技术高速革新的背景下，网络空间面临的威胁，也在随之改变和升级。"}
{"title": "白话物联网安全（四）：泛在电力物联网", "url": "https://www.freebuf.com/articles/wireless/197575.html", "time": "2019-03-14", "level": "现金奖励", "num_look": 380810, "num_comment": 9, "author": "大胖", "tags": ["无线安全"], "text": "为什么突然在白话系列提出泛在物联网，主要是因为国家电网2019年1月13日发布的2019年1号文件中，排在年度重点工作首位的就是：推动电网与互联网深度融合，着力构建能源互联网。"}
{"title": "BUF早餐铺 | 朝鲜黑客窃取5.17亿美元加密货币；默克尔称德国会自主制定5G安全标准；GoDaddy、苹果和Google错误签发一百多万63位序列号证书", "url": "https://www.freebuf.com/news/198138.html", "time": "2019-03-14", "level": "", "num_look": 82809, "num_comment": 3, "author": "AngelaY", "tags": ["资讯"], "text": "Google Chrome 73稳定版发布：支持Dark模式 修复60处安全漏洞；Android安全App大调查：大多无法有效保护用户。"}
{"title": "SSRFmap：一款功能强大的自动化SSRF模糊测试&漏洞利用工具", "url": "https://www.freebuf.com/sectool/197353.html", "time": "2019-03-13", "level": "", "num_look": 207154, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具"], "text": "SSRF，即服务器端请求伪造，很多网络犯罪分子都会利用SSRF来攻击或入侵网络服务。今天我们给大家介绍的这款工具名叫SSRFmap，它可以寻找并利用目标网络服务中的SSRF漏洞。"}
{"title": "总结回望丨2018年十大Web黑客技术榜单", "url": "https://www.freebuf.com/articles/web/197276.html", "time": "2019-03-13", "level": "", "num_look": 234450, "num_comment": 5, "author": "clouds", "tags": ["WEB安全"], "text": "2018年过去了，在这一年中，随着Web功能应用的越加广泛化，针对Web层面的攻击也越加多样化和精细化。最近，由Portswigger公司发起的“2018年十大WEB黑客技术”出炉了！"}
{"title": "新华三安全产品线攻防团队诚聘安全人才", "url": "https://www.freebuf.com/jobs/197797.html", "time": "2019-03-13", "level": "", "num_look": 103180, "num_comment": 4, "author": "新华三攻防团队", "tags": ["安全招聘"], "text": "新华三集团（简称新华三）是业界领先的数字化解决方案领导者。新华三拥有计算、存储、网络、安全等完整的数字化基础设施提供能力。"}
{"title": ".NET高级代码审计（第三课）Fastjson反序列化漏洞", "url": "https://www.freebuf.com/articles/web/197913.html", "time": "2019-03-13", "level": "", "num_look": 232012, "num_comment": 232012, "author": "云影实验室", "tags": ["WEB安全"], "text": "在某些场景下开发者使用JSON.ToObject方法序列化不安全的数据时候会造成反序列化漏洞从而实现远程RCE攻击，本文笔者从原理和代码审计的视角做了相关介绍和复现。"}
{"title": "缓冲区溢出实战教程系列（二）：dev c++编译汇编代码", "url": "https://www.freebuf.com/articles/system/197116.html", "time": "2019-03-13", "level": "现金奖励", "num_look": 147431, "num_comment": 14, "author": "kaliking", "tags": ["系统安全"], "text": "上篇文章我列举了一个缓冲区溢出的小例子，并提到了dev c++、ollydbg、IDA Freeware这三款软件，并介绍了dev c++的基本用法。今天会补充一下Dev c++的用法。"}
{"title": "RSAC 2019 | 2049年，世界会更好吗？", "url": "https://www.freebuf.com/articles/neopoints/197698.html", "time": "2019-03-13", "level": "", "num_look": 126076, "num_comment": 2, "author": "AngelaY", "tags": ["观点"], "text": "Never trust, always verify."}
{"title": "CVE-2018-18955：较新Linux内核的提权神洞分析", "url": "https://www.freebuf.com/vuls/197122.html", "time": "2019-03-13", "level": "现金奖励", "num_look": 613414, "num_comment": 17, "author": "0x4d69", "tags": ["漏洞"], "text": "鉴于目前还没有针对这个漏洞的详细分析，原作者的advisory对新手来说也很不友好，我就写了这篇文章。"}
{"title": "Java代码审计之SpEL表达式注入", "url": "https://www.freebuf.com/vuls/197008.html", "time": "2019-03-13", "level": "现金奖励", "num_look": 215011, "num_comment": 1, "author": "Lateink", "tags": ["漏洞"], "text": "Spring Expression Language 是一种功能强大的表达式语言、用于在运行时查询和操作对象图；语法上类似于 Unified EL，但提供了更多的特性，特别是方法调用和基本字符串模板函数。"}
{"title": "那些年走过的信安面试路续：我的甲方应聘之旅", "url": "https://www.freebuf.com/articles/database/197272.html", "time": "2019-03-13", "level": "现金奖励", "num_look": 581170, "num_comment": 22, "author": "绿帽子技术分享", "tags": ["数据安全", "观点"], "text": "写文章的主要目的是为了分享面试的经验，让green hand少一点弯路，多一点套路，顺便骗一点稿费。 俗话说得好，“自古深情留不住，唯有套路得人心。”"}
{"title": "BUF早餐铺 | 美国因华为威胁切断与德国情报共享；俄罗斯阻止ProtonMail加密邮件服务；斗象科技完成B+轮亿元级别融资", "url": "https://www.freebuf.com/news/198034.html", "time": "2019-03-13", "level": "", "num_look": 97728, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "美国警告德国 ，如果柏林方面允许华为参与建设其超高速的 5G 移动网络，其将缩减与德国间谍机构间的情报共享。"}
{"title": "Kaboom：一款功能强大的自动化渗透测试工具", "url": "https://www.freebuf.com/sectool/197348.html", "time": "2019-03-12", "level": "", "num_look": 247739, "num_comment": 247739, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天，我们给大家介绍的是一款名叫Kaboom的自动化渗透测试工具，广大研究人员可以使用这款功能强大的工具来完成日常的渗透测试任务。"}
{"title": "Pompem ：一款功能强大的漏洞利用&挖洞工具", "url": "https://www.freebuf.com/sectool/197478.html", "time": "2019-03-12", "level": "", "num_look": 219730, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Pompem的开源工具，该工具可以在当前最热门或最重要的漏洞数据库中搜索漏洞以及相应的漏洞利用代码。"}
{"title": "「斗象科技」完成B+轮亿元级别融资，专注漏洞检测与威胁分析，把产品服务“做好、做精”", "url": "https://www.freebuf.com/news/198024.html", "time": "2019-03-12", "level": "红色标题", "num_look": 60726, "num_comment": 1, "author": "FB独家", "tags": ["资讯"], "text": "斗象科技（FreeBuf 所属公司）新一轮融资将加大人工智能技术应用于威胁分析方面的投入，针对行业特性和业务场景提供更深度的产品服务。"}
{"title": "RSAC 2019 | 聚变的前夜——流量安全产品观察", "url": "https://www.freebuf.com/articles/network/197932.html", "time": "2019-03-12", "level": "", "num_look": 121047, "num_comment": 1, "author": "abtnetworks2018", "tags": ["网络安全", "观点"], "text": "从方案的分层来看，流量安全产品位于底层，除了直接处置安全问题外，还负责为SIEM、UEBA等高层安全方案提供原始信息。"}
{"title": "挖洞经验 | 看我如何综合利用Self-XSS和OAuth错误配置实现Stored-XSS", "url": "https://www.freebuf.com/vuls/196972.html", "time": "2019-03-12", "level": "", "num_look": 118339, "num_comment": 118339, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文分享的作者是对Self-XSS和OAuth错误配置两个低危漏洞的组合利用，形成Stored XSS的一个梳理过程，仅当思路拓展。"}
{"title": "当社交媒体成为黑客“赚钱”的工具", "url": "https://www.freebuf.com/news/197102.html", "time": "2019-03-12", "level": "红色标题", "num_look": 153649, "num_comment": 1, "author": "Karunesh91", "tags": ["数据安全", "资讯"], "text": "不久前，美国一所大学的研究表明，现在的黑客，通过社交媒体网络犯罪每年在全球范围内创造的收入至少达到了325亿美元。"}
{"title": "RSAC 2019 | 从Comcast看DevSecOps实践", "url": "https://www.freebuf.com/articles/neopoints/197770.html", "time": "2019-03-12", "level": "", "num_look": 105384, "num_comment": 1, "author": "AngelaY", "tags": ["观点"], "text": "组委会以Comcast公司的DevSecOps实践为例，分析了DevSecOps发展过程中的难题，并给出一些参考建议。"}
{"title": "Ghidra：这个来自NSA的软件逆向工程工具终于来啦！", "url": "https://www.freebuf.com/sectool/197922.html", "time": "2019-03-12", "level": "", "num_look": 290351, "num_comment": 7, "author": "Alpha_h4ck", "tags": ["工具"], "text": "是的，大家没有看错！Ghidra完全出自NSA之手，它是一款软件逆向工程（SRE）框架，由美国国家安全局研究理事会负责开发、升级和维护。"}
{"title": "威胁在外，压力在内 | CISO职场生存现状", "url": "https://www.freebuf.com/articles/neopoints/197271.html", "time": "2019-03-12", "level": "红色标题", "num_look": 113259, "num_comment": 6, "author": "AngelaY", "tags": ["观点"], "text": "少了“你”，世界都会不安。"}
{"title": "ThinkPHP5核心类Request远程代码漏洞分析", "url": "https://www.freebuf.com/vuls/196934.html", "time": "2019-03-12", "level": "", "num_look": 159049, "num_comment": 1, "author": "ADLab", "tags": ["WEB安全", "漏洞"], "text": "2019年1月11日，ThinkPHP团队发布了一个补丁更新，修复了一处由于不安全的动态函数调用导致的远程代码执行漏洞。该漏洞危害程度非常高，默认条件下即可执行远程代码。"}
{"title": "软件供应链安全威胁：从“奥创纪元”到“无限战争”", "url": "https://www.freebuf.com/articles/network/197574.html", "time": "2019-03-12", "level": "", "num_look": 114691, "num_comment": 1, "author": "alibaba", "tags": ["网络安全"], "text": "根据近期的一些历史事件，也做了一些深挖和联想，考虑恶意的上游开发者，如何巧妙（或者说，处心积虑）地将问题引入，并在当前的软件供应链生态体系中，造成远比表面上看起来要深远得多的影响。"}
{"title": "BUF早餐铺丨携程疑再现“大数据杀熟” ，机票重搜贵了近1500元；Citrix收FBI警告：6TB至10TB敏感数据被窃；日本警方指控分享无限循环弹出窗代码的13岁女孩", "url": "https://www.freebuf.com/news/197924.html", "time": "2019-03-12", "level": "", "num_look": 65291, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "携程疑再现“大数据杀熟” ，机票重搜贵了近1500元；Citrix收FBI警告：6TB至10TB敏感数据被窃；日本警方指控分享无限循环弹出窗代码的13岁女孩"}
{"title": "漏洞盒子×瓜子SRC火热上线，赶紧来赚买车钱", "url": "https://www.freebuf.com/fevents/197883.html", "time": "2019-03-11", "level": "红色标题", "num_look": 94279, "num_comment": 2, "author": "漏洞盒子", "tags": ["活动"], "text": "二手车行业领军者——瓜子入驻漏洞盒子企业自助SRC，带你来赚买车钱。"}
{"title": "【BUF大事件】支付宝APP被质疑默默收集用户图片；英特尔CPU再现高危漏洞；RSA 2019在美国旧金山举行，安全让世界更美好", "url": "https://www.freebuf.com/video/197844.html", "time": "2019-03-11", "level": "红色标题", "num_look": 122494, "num_comment": 122494, "author": "willhuang", "tags": ["视频"], "text": "支付宝APP被质疑默默收集用户图片，官方人员现身回应；RSA 2019大会在旧金山完美谢幕，起于安全，不止于安全；英特尔CPU再现高危漏洞 得到官方证实可泄露私密数据。"}
{"title": "TrackRay：一个开源的微服务渗透测试框架", "url": "https://www.freebuf.com/sectool/195467.html", "time": "2019-03-11", "level": "金币+8", "num_look": 165979, "num_comment": 1, "author": "浅蓝", "tags": ["工具"], "text": "自更新 2.0 版本后，项目数据库采用嵌入式数据库hsqldb，使用 SpringBoot 框架开发，用maven管理依赖，使开发和使用更为简单方便。"}
{"title": "阿里云安全肖力：从RSAC 2019看安全技术发展的十个机遇", "url": "https://www.freebuf.com/articles/neopoints/197818.html", "time": "2019-03-11", "level": "红色标题", "num_look": 121957, "num_comment": 1, "author": "AdlerI", "tags": ["观点"], "text": "今年的主题是“Better“ ，也寓含全球整个安全市场的爆发和安全产品技术的成熟，大家一起 to get better。"}
{"title": "挖洞经验 | Uber第三方应用的开发者密钥等敏感信息泄露漏洞", "url": "https://www.freebuf.com/vuls/196814.html", "time": "2019-03-11", "level": "", "num_look": 123478, "num_comment": 3, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "文分享的漏洞涉及Uber第三方集成服务应用，通过Uber的开放接口，可以泄露第三方集成服务开发者的客户端密钥和Server token信息。"}
{"title": "从委内瑞拉大范围停电一事来看美国的攻击手段", "url": "https://www.freebuf.com/news/197766.html", "time": "2019-03-11", "level": "红色标题", "num_look": 267245, "num_comment": 9, "author": "黑鸟", "tags": ["资讯"], "text": "委内瑞拉总统马杜罗9日在首都加拉加斯表示，委电力系统当天再次遭受攻击，电力供应恢复受到极大影响。"}
{"title": ".NET高级代码审计（第二课） Json.Net反序列化漏洞", "url": "https://www.freebuf.com/articles/web/197713.html", "time": "2019-03-11", "level": "", "num_look": 133183, "num_comment": 133183, "author": "云影实验室", "tags": ["WEB安全"], "text": "在某些场景下开发者使用DeserializeObject方法序列化不安全的数据，就会造成反序列化漏洞从而实现远程RCE攻击，本文笔者从原理和代码审计的视角做了相关介绍和复现。"}
{"title": "快讯 | TLS 1.3遇上麻烦了", "url": "https://www.freebuf.com/news/197733.html", "time": "2019-03-11", "level": "", "num_look": 107946, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "近期，研究人员发现了一种新型的Bleichenbacher攻击变种，而这种新型的加密攻击可以破坏加密的TLS流量。"}
{"title": "WinRAR远程代码执行漏洞结合Metasploit+Ngrok实现远程上线", "url": "https://www.freebuf.com/articles/network/197025.html", "time": "2019-03-11", "level": "现金奖励", "num_look": 354377, "num_comment": 54, "author": "艾登——皮尔斯", "tags": ["网络安全"], "text": "最近WinRAR漏洞影响时长长达十余年之久，本篇文章鄙人会使用图文+视频的教程来给各位不知道利用的小粉们讲一下，视频教程在文末尾处。"}
{"title": "键盘拦截器制作与测试", "url": "https://www.freebuf.com/geek/196409.html", "time": "2019-03-11", "level": "现金奖励", "num_look": 195148, "num_comment": 23, "author": "LEdge1", "tags": ["极客"], "text": "我在freebuf上面看过有人使用arduino制作键盘记录的设备但是，说真的，他们都没有实战过，今天我给大家带来一下实战！"}
{"title": "由一个萌妹子引发的CTF Writeup", "url": "https://www.freebuf.com/articles/others-articles/197241.html", "time": "2019-03-11", "level": "", "num_look": 115112, "num_comment": 3, "author": "京东安全", "tags": ["其他"], "text": "前几天在刷CTF题的时候遇到一个比较有意思的题，题目本身难度一般，但是涉及到的几个点还是值得记录一下的，于是便有了此文。"}
{"title": "2019年唠嗑企业安全之堡垒机（二）", "url": "https://www.freebuf.com/articles/es/197394.html", "time": "2019-03-11", "level": "现金奖励", "num_look": 161125, "num_comment": 2, "author": "Mark2019", "tags": ["企业安全"], "text": "虽然做安全的大家对这个设备再熟悉不过，这里mark还是唠叨两句，堡垒机俗称跳板机，安全届的同仁也捧其为小4A。"}
{"title": "BUF早餐铺 | App收集使用个人信息必须有法律依据；拼多多被指支持刷单；思科推送补丁修复Nexus交换机多个漏洞", "url": "https://www.freebuf.com/news/197662.html", "time": "2019-03-11", "level": "", "num_look": 68748, "num_comment": 3, "author": "Freddy", "tags": ["资讯"], "text": "中央网信办等四部门决定自2019年1月至12月，在全国范围组织开展App违法违规收集使用个人信息专项治理。"}
{"title": "Goscan：一款功能强大的交互式网络扫描工具", "url": "https://www.freebuf.com/sectool/196849.html", "time": "2019-03-10", "level": "", "num_look": 218534, "num_comment": 218534, "author": "Alpha_h4ck", "tags": ["工具"], "text": "GoScan是一款交互式网络扫描客户端，可用来执行主机扫描、端口扫描和服务枚举等任务。"}
{"title": "挖洞经验 | 看我如何绕过Slack后端的SSRF防护机制", "url": "https://www.freebuf.com/vuls/196619.html", "time": "2019-03-10", "level": "", "num_look": 108837, "num_comment": 108837, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文分享了一个存在于Slack接口api.slack.com中的缺陷，通过利用Slack内置的斜线命令功能，可以绕过Slack后端的SSRF防护措施，在Slack接口上形成两个服务端请求伪造漏洞。"}
{"title": "“匿影”挖矿病毒：借助公共网盘和图床隐匿自身", "url": "https://www.freebuf.com/articles/system/196895.html", "time": "2019-03-10", "level": "", "num_look": 160787, "num_comment": 3, "author": "安全豹", "tags": ["系统安全"], "text": "近期，一款挖矿病毒在内网中传播，该病毒打包了方程式攻击工具包，在内网中利用永恒之蓝（Eternalblue）和双脉冲星（DoublePulsar）进行横向传播，被感染的电脑首先会解析特定URL上的内容，然后进行挖矿（门罗币、B…"}
{"title": "2018年工业控制网络安全态势白皮书", "url": "https://www.freebuf.com/articles/ics-articles/196647.html", "time": "2019-03-10", "level": "", "num_look": 427799, "num_comment": 2, "author": "东北大学谛听网络安全团队", "tags": ["工控安全"], "text": "东北大学“谛听”网络安全团队发布2018年工业控制网络安全态势白皮书，读者可以通过报告了解2018年典型工控安全标准、法规分析及典型工控安全事件分析，同时报告对工控系统漏洞、工控系统攻击、联网工控设备进行了阐…"}
{"title": "Process Hacker：多功能系统监控软件，支持检测恶意软件", "url": "https://www.freebuf.com/sectool/196830.html", "time": "2019-03-09", "level": "", "num_look": 145140, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款免费且强大的多功能工具，广大研究人员可以利用该工具来监控自己的系统资源，调试软件或检测恶意软件。"}
{"title": "挖洞经验 | Facebook全平台聊天应用中的用户发送附件泄露漏洞（$15,000）", "url": "https://www.freebuf.com/vuls/196502.html", "time": "2019-03-09", "level": "", "num_look": 130725, "num_comment": 4, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "在Facebook视频聊天设备Portal的官网中，通过测试其中的客户支持聊天机器人（Support Bot），利用其附件上传功能，发现了一个存在于Facebook 聊天架构中，影响Messenger、Portal和Workplace等Facebook全平台聊天应…"}
{"title": "Kerberos协议探索系列之票据篇", "url": "https://www.freebuf.com/articles/system/197160.html", "time": "2019-03-09", "level": "", "num_look": 230978, "num_comment": 1, "author": "云影实验室", "tags": ["系统安全"], "text": "本章具体说一下Kerberos曾经爆出的一个经典的漏洞MS14068和金银票据的原理和利用方式。"}
{"title": "SQLMAP深度解析及使用手册", "url": "https://www.freebuf.com/news/196755.html", "time": "2019-03-09", "level": "金币+8", "num_look": 294304, "num_comment": 5, "author": "scanner", "tags": ["网络安全", "资讯"], "text": "写这篇技术文有两个诱因，一是从国外买了一篇二十美刀的XSS文章，做了翻译，自古XSS和sql注入是倚天屠龙的对立统一关系，所以有朋友说想看一看sql注入的文章。"}
{"title": "代码审计之Empire CMS v7.5个人空间伪造任意用户留言", "url": "https://www.freebuf.com/vuls/196666.html", "time": "2019-03-09", "level": "现金奖励", "num_look": 136476, "num_comment": 8, "author": "q601333824", "tags": ["漏洞"], "text": "帝国CMS简称Empire CMS，当前的最新版本为7.5，个人空间可以匿名留言和登录留言，由于权限控制不当，可以伪造任意用户登录留言，自己无聊挖着玩的东西，喜欢的可以自己复现玩玩。"}
{"title": "2019年七大安全和风险管理趋势一览", "url": "https://www.freebuf.com/articles/es/197683.html", "time": "2019-03-08", "level": "", "num_look": 162520, "num_comment": 2, "author": "Freddy", "tags": ["企业安全"], "text": "这些趋势将长期影响安全、隐私和风险管理者和安全运营中心在威胁检测和响应、安全投资、无密码认证和云安全领域的行动，适合安全管理者食用~"}
{"title": "CANalyzat0r ：一款可以对专用汽车协议进行安全分析的强大工具", "url": "https://www.freebuf.com/sectool/196778.html", "time": "2019-03-08", "level": "", "num_look": 115651, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家推荐的这款工具名叫CANalyzat0r，各位研究人员可以利用该工具对专用汽车协议进行安全分析。"}
{"title": "研究人员发现4G和5G通信网络中的新型通话拦截和位置追踪漏洞", "url": "https://www.freebuf.com/articles/web/196650.html", "time": "2019-03-08", "level": "", "num_look": 159021, "num_comment": 4, "author": "clouds", "tags": ["WEB安全"], "text": "近期，普渡大学研究人员发现了同时存在于4G和5G通信网络中的三个新型安全漏洞。"}
{"title": "Linux内核本地提权漏洞预警分析（CVE-2019-8912）", "url": "https://www.freebuf.com/vuls/196687.html", "time": "2019-03-08", "level": "", "num_look": 193758, "num_comment": 3, "author": "ADLab", "tags": ["漏洞"], "text": "根据git中的commit信息可知，该漏洞出现在内核'crypto/af_alg.c'中的af_alg_release函数中，可以通过sockfs_setattr函数触发，漏洞类型是use after free，可以导致本地代码执行进行权限提升。"}
{"title": "代码审计实战思路之浅析PHPCMS", "url": "https://www.freebuf.com/articles/web/195737.html", "time": "2019-03-08", "level": "现金奖励", "num_look": 183623, "num_comment": 11, "author": "wnltc0", "tags": ["WEB安全"], "text": "经过一番摸索，终于从小白进阶到菜鸟，于是想着写几篇带完整过程的代码审计文章。"}
{"title": "PHP7和PHP5在安全上的区别", "url": "https://www.freebuf.com/articles/web/197013.html", "time": "2019-03-08", "level": "现金奖励", "num_look": 272848, "num_comment": 6, "author": "温酒", "tags": ["WEB安全"], "text": "之前测试的时候发现很多菜刀的马都不能用了，大马也几乎3/4不能正常在php7运行。网上百度也没有找到太多相关性的文章，就自己总结测试了一下关于安全性上的区别。"}
{"title": "BUF早餐铺 | 华为起诉美国政府销售限制法案违宪；思科呼吁Nexus交换机用户关闭POAP功能以提高安全性；所有Intel处理器面临的新攻击Spoiler确认在软件层面无解", "url": "https://www.freebuf.com/news/197567.html", "time": "2019-03-08", "level": "", "num_look": 81614, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "昨天，华为宣布针对美国《2019财年国防授权法》第889条的合宪性向美国联邦法院提起诉讼，请求法院判定这一针对华为的销售限制条款违宪，并判令永久禁止该限制条款的实施。"}
{"title": "WordPress 5.0 RCE详细分析", "url": "https://www.freebuf.com/vuls/196514.html", "time": "2019-03-08", "level": "", "num_look": 143080, "num_comment": 143080, "author": "Knownsec知道创宇", "tags": ["漏洞", "系统安全"], "text": "文章中主要提到在author权限账号下，可以通过修改Post Meta变量覆盖、目录穿越写文件、模板包含3个漏洞构成一个RCE漏洞。"}
{"title": "开课啦丨FIT 2019企业安全俱乐部公开课第二波上线", "url": "https://www.freebuf.com/news/197354.html", "time": "2019-03-07", "level": "", "num_look": 344972, "num_comment": 4, "author": "FB客服", "tags": ["活动", "特别企划"], "text": "企业安全公开课更新啦，走过路过不要错过～"}
{"title": "新鲜出炉丨一文看懂2019年FreeBuf活动规划", "url": "https://www.freebuf.com/news/197488.html", "time": "2019-03-07", "level": "", "num_look": 403982, "num_comment": 1, "author": "FB客服", "tags": ["活动", "特别企划"], "text": "2019年FreeBuf各色活动出炉，请各位先睹为快。还等什么，赶快行动起来吧～"}
{"title": "美国政府涉嫌入侵华为服务器，华为没证据但斯诺登可能有", "url": "https://www.freebuf.com/news/197607.html", "time": "2019-03-07", "level": "红色标题", "num_look": 363669, "num_comment": 11, "author": "shidongqi", "tags": ["资讯"], "text": "美国政府入侵华为服务器的这件事，华为没有证据，但有一个人可能有——斯诺登。"}
{"title": "16位NE程序逆向调试：CrackMe012全破", "url": "https://www.freebuf.com/articles/others-articles/197129.html", "time": "2019-03-07", "level": "红色标题", "num_look": 86074, "num_comment": 1, "author": "huluwa007", "tags": ["其他"], "text": "文章分为两部分，前部分先说环境的搭建和如何调试这个16位NE程序，以及反汇编代码研究算法，后部分是独稿，来解决这个一直悬而未决很多年的Crackme012。"}
{"title": "kubernetes集群渗透测试", "url": "https://www.freebuf.com/vuls/196993.html", "time": "2019-03-07", "level": "", "num_look": 340412, "num_comment": 6, "author": "斗象智能安全平台", "tags": ["漏洞"], "text": "在DevOps、微服务等云原生应用的开发过程中，kubernetes技术提供了极大的便利，经过近几年的发展，显示了强大的优势。"}
{"title": "挖洞经验 | 谷歌云服务平台的组织资源名称可修改漏洞（$7500）", "url": "https://www.freebuf.com/vuls/196339.html", "time": "2019-03-07", "level": "", "num_look": 104346, "num_comment": 1, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "谷歌云服务中组织资源名称存在可修改漏洞，可利用这种可修改特性，结合谷歌云服务中的分享和依赖关系，可假冒组织资源，对GCP用户实现欺骗。"}
{"title": "价值1250美元的ERPNext模版注入漏洞", "url": "https://www.freebuf.com/articles/web/196075.html", "time": "2019-03-07", "level": "", "num_look": 92170, "num_comment": 2, "author": "secist", "tags": ["WEB安全"], "text": "几个月前，我专注于电子医疗记录web应用程序中的漏洞研究。在研究过程当中，我发现ERPNext是由FrappéTechnologiesPvt开发的企业资源规划软件。"}
{"title": "科大讯飞集团诚聘各类安全人才", "url": "https://www.freebuf.com/jobs/197305.html", "time": "2019-03-07", "level": "", "num_look": 113667, "num_comment": 10, "author": "东二门陈冠希", "tags": ["安全招聘"], "text": "科大讯飞股份有限公司，成立于1999年，在语音合成、语音识别、口语评测、语言翻译、声纹识别、人脸识别、自然语言处理等智能语音与人工智能核心技术上代表国际先进水平。"}
{"title": "快讯 | 华为宣布将起诉美国政府：涉嫌入侵华为服务器", "url": "https://www.freebuf.com/news/197549.html", "time": "2019-03-07", "level": "红色标题", "num_look": 115895, "num_comment": 4, "author": "shidongqi", "tags": ["资讯"], "text": "华为在深圳总部的发布会上，宣布将起诉美国政府，而且还透露有证据表明美国政府涉嫌入侵华为服务器。"}
{"title": ".NET高级代码审计之XmlSerializer反序列化漏洞", "url": "https://www.freebuf.com/articles/web/197400.html", "time": "2019-03-07", "level": "", "num_look": 149738, "num_comment": 8, "author": "云影实验室", "tags": ["WEB安全"], "text": "本文笔者从原理和代码审计的视角做了XmlSerializer反序列化漏洞相关脑图介绍和复现。"}
{"title": "从RSA2019创新沙盒冠军，说说网络资产管理踩过的那些坑（1）", "url": "https://www.freebuf.com/articles/network/197466.html", "time": "2019-03-07", "level": "金币+6", "num_look": 111302, "num_comment": 2, "author": "WebRAY", "tags": ["网络安全"], "text": "昨天， RSAC2019创新沙盒大赛结果揭晓，很意外地评出了主打网络安全资产管理的公司——Axonius为本届冠军，让国内各种竞猜活动的参与者们大跌眼镜，连呼没想到。"}
{"title": "大数据安全体系介绍之背景篇", "url": "https://www.freebuf.com/articles/database/195548.html", "time": "2019-03-07", "level": "现金奖励", "num_look": 162712, "num_comment": 1, "author": "smoonsoso", "tags": ["数据安全"], "text": "数据安全状况目前呈现三大趋势，首先，随着大数据行业的快速发展，数据尤其是高价值的数据向大数据节点汇集，同时也带来了严重的安全隐患，往往出现海量敏感数据的泄露的事件。"}
{"title": "网银撞库安全问题简析", "url": "https://www.freebuf.com/articles/es/196513.html", "time": "2019-03-07", "level": "金币+6", "num_look": 100508, "num_comment": 2, "author": "一只耗子", "tags": ["企业安全"], "text": "单纯的从业务安全角度去看这个问题，可能没有什么意义，就算能够成功登录进去，最多也就是获取一些用户信息，但从用户的角度来分析危害性很大。"}
{"title": "简析认证加授权如何使API更安全", "url": "https://www.freebuf.com/articles/web/195044.html", "time": "2019-03-07", "level": "现金奖励", "num_look": 116808, "num_comment": 1, "author": "yuegui_2004", "tags": ["WEB安全"], "text": "随着业务开放性的发展趋势，为了应对快速发展的业务及灵活多变的程序需求，API（Application Programming Interface）在程序中的应用显得愈发重要，API为外部业务对接、系统间的调用提供了灵活性和创新性。"}
{"title": "三步学会爬动态网站", "url": "https://www.freebuf.com/geek/196361.html", "time": "2019-03-07", "level": "现金奖励", "num_look": 143074, "num_comment": 2, "author": "qingxp9", "tags": ["极客"], "text": "在写爬虫程序时，难免会碰到一些动态加载的网页，为获取数据制造了困难。本篇文章将尝试用非常简短的篇幅来教大家如何应对动态加载的网页。以Ruby语言为例，可以在Linux、Mac、Windows等平台上进行实验。"}
{"title": "BUF早餐铺 | NSA 公布逆向工程框架 Ghidra；沙特智能电话本应用Dalil泄露500多万用户信息；英特尔处理器面临新的 Spoiler 攻击", "url": "https://www.freebuf.com/news/197518.html", "time": "2019-03-07", "level": "", "num_look": 72943, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "2018年移动软件攻击数量近乎翻倍；微软安全报告显示去年网络钓鱼攻击有所增加"}
{"title": "RSA 2019丨NSA内部开源反汇编工具集Ghidra", "url": "https://www.freebuf.com/news/197482.html", "time": "2019-03-06", "level": "", "num_look": 200007, "num_comment": 2, "author": "奇安信代码卫士", "tags": ["网络安全", "资讯"], "text": "NSA发布了内部开源逆向工程工具Ghidra，可用于从应用程序中搜查安全漏洞和其它问题。并且NSA保证并未在其中安装任何后门。"}
{"title": "2019“两会时间”，信息安全圈有哪些声音？", "url": "https://www.freebuf.com/news/197455.html", "time": "2019-03-06", "level": "红色标题", "num_look": 158620, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "在2019年政府工作任务这一部分内容中，李克强总理三提“信息”，涉及到信息技术发展、信息基础设施建设和个人信息保护，反映出在新的一年里国家保障新兴产业加快发展的目标和信心。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列-Santiago Lopez", "url": "https://www.freebuf.com/video/197452.html", "time": "2019-03-06", "level": "红色标题", "num_look": 122368, "num_comment": 1, "author": "willhuang", "tags": ["视频"], "text": "Santiago Lopez，阿根廷的19岁白帽。3月1日，HackerOne宣布，Santiago成为HackerOne平台上第一位漏洞赏金超过100万美元的白帽黑客，他创造了历史！"}
{"title": "在Office文档的嵌入式视频中插入恶意URL的感染流程分析", "url": "https://www.freebuf.com/articles/system/196068.html", "time": "2019-03-06", "level": "", "num_look": 88849, "num_comment": 3, "author": "周大涛", "tags": ["系统安全"], "text": "10月底，Cymulate的安全研究人员公布了利用office在线视频特征逻辑漏洞来传播恶意软件的POC。最近，研究人员发现一款利用该漏洞传播URSNIF信息窃取器的在野样本。"}
{"title": "腾讯安平招人啦！谁是下一个光荣的守夜人？", "url": "https://www.freebuf.com/jobs/197201.html", "time": "2019-03-06", "level": "", "num_look": 120975, "num_comment": 2, "author": "腾讯安全平台部", "tags": ["安全招聘"], "text": "腾讯安全平台部成立于2005年，发展至今，安全平台部对自身安全能力规划为业务安全、应用运维安全两大体系，服务于腾讯全线业务，守护十亿用户的安全，更依托腾讯云和“互联网+”将安全能力输出到各个行业。"}
{"title": "安全趣闻 | “ji32k7au4a83”竟然是一个典型弱密码", "url": "https://www.freebuf.com/news/197414.html", "time": "2019-03-06", "level": "红色标题", "num_look": 373265, "num_comment": 20, "author": "shidongqi", "tags": ["资讯"], "text": "很多人会绞尽脑汁设置一个看起来安全的密码，但有一些秘密可能并没有它看起来那么安全，比如下面这个……"}
{"title": "RSAC 2019 首日概览 | 起于安全，不止于安全（含PPT分享）", "url": "https://www.freebuf.com/articles/neopoints/197404.html", "time": "2019-03-06", "level": "", "num_look": 114414, "num_comment": 1, "author": "AngelaY", "tags": ["活动", "观点"], "text": "首日议题涵盖人才、安全威胁、安全基础架构、隐私与人类行为、家庭安全培训以及女性议题等，“DevSecOps Day”也是一大亮点。"}
{"title": "VB反汇编特点汇总：秒破Crackme8-10", "url": "https://www.freebuf.com/news/195917.html", "time": "2019-03-06", "level": "现金奖励", "num_look": 129702, "num_comment": 5, "author": "huluwa007", "tags": [], "text": "本文通过VB自写自逆，搞清楚VB逆向特点、p-code、native-coed、变量结构特点、默认浮点、epb-0x34法则等，不仅秒破Crackme8-10，以后遇到VB就不会头晕眼花了。"}
{"title": "从零编写一个自己的蜜罐系统", "url": "https://www.freebuf.com/articles/system/196525.html", "time": "2019-03-06", "level": "现金奖励", "num_look": 307059, "num_comment": 4, "author": "lonely_wind", "tags": ["企业安全", "系统安全"], "text": "如果对蜜罐程序的交互性要求不高，自己来模拟实现一套蜜罐程序是比较理想的方式。"}
{"title": "Linux内核CVE-2017-11176漏洞分析与复现", "url": "https://www.freebuf.com/vuls/196673.html", "time": "2019-03-06", "level": "", "num_look": 157875, "num_comment": 1, "author": "ADLab", "tags": ["漏洞", "系统安全"], "text": "Linux内核中的POSIX 消息队列实现中存在一个UAF漏洞CVE-2017-11176。本文将从漏洞成因、补丁分析以及漏洞复现等多个角度对该漏洞进行详细分析。"}
{"title": "警惕！WinRAR漏洞利用升级：社工、加密、无文件后门", "url": "https://www.freebuf.com/articles/system/196834.html", "time": "2019-03-06", "level": "", "num_look": 164046, "num_comment": 6, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "在截获了首个利用WinRAR漏洞（CVE-2018-20250）传播木马程序的恶意ACE文件。后续又出现了多个使用WinRAR漏洞传播恶意程序的样本，并且还出现多个利用此漏洞进行的APT攻击活动。"}
{"title": "BUF早餐铺 | Android TV曝出bug 或导致用户私人照片泄露；W3C批准WebAuthn成为无密码登录的Web标准；Axonius获得RSA 2019创新沙盒冠军", "url": "https://www.freebuf.com/news/197368.html", "time": "2019-03-06", "level": "", "num_look": 56509, "num_comment": 56509, "author": "shidongqi", "tags": ["资讯"], "text": "万维网联盟（W3C）近期宣布，Web身份验证API（WebAuthn）现在已成为官方Web标准。 WebAuthn于2015年11月由W3C和Fido联盟宣布，现已成为网上无密码登录的开放标准。"}
{"title": "分析用Golang编写的新恶意软件", "url": "https://www.freebuf.com/articles/network/196498.html", "time": "2019-03-06", "level": "", "num_look": 164781, "num_comment": 164781, "author": "周大涛", "tags": ["网络安全"], "text": "Golang (Go)是一种相对较新的编程语言，发现其编写的恶意软件并不常见。 然而，用Go编写的新变种正在慢慢出现，这给恶意软件分析人员带来了挑战。"}
{"title": "谭晓生正式辞去360公司副总经理职务", "url": "https://www.freebuf.com/news/197382.html", "time": "2019-03-05", "level": "", "num_look": 117579, "num_comment": 4, "author": "shidongqi", "tags": ["资讯"], "text": "三六零安全科技股份有限公司发布公告称，董事会于近日收到公司副总经理谭晓生先生递交的书面辞职报告。谭晓生先生因个人原因辞去公司副总经理职务。"}
{"title": "RSAC 2019 | Axonius 凭什么在创新沙盒大赛上力拔头筹", "url": "https://www.freebuf.com/news/197331.html", "time": "2019-03-05", "level": "", "num_look": 98982, "num_comment": 1, "author": "NSFOCUS", "tags": ["资讯"], "text": "Axonius被评为RSAC  2019 创新沙盒“最具创新能力创业公司”。"}
{"title": "支付宝APP被质疑默默收集用户图片，官方人员现身回应", "url": "https://www.freebuf.com/news/197332.html", "time": "2019-03-05", "level": "红色标题", "num_look": 221680, "num_comment": 10, "author": "Allen别bb", "tags": ["资讯"], "text": "前段时间京东金融APP陷入搜集客户隐私的风波，用户对于手机APP权限问题还处于敏感期，今天同样被曝出支付宝APP 疑似存在悄悄复制用户手机图片的问题……"}
{"title": "DNSlivery：利用DNS协议投递文件和Payload", "url": "https://www.freebuf.com/sectool/196532.html", "time": "2019-03-05", "level": "", "num_look": 126160, "num_comment": 126160, "author": "secist", "tags": ["工具"], "text": "DNSlivery项目允许通过DNS协议将文件和Payload投递到目标上。该项目最初的灵感来自于PowerDNS和Joff Thyer发布在Paul每周安全播客#590的技术片段。"}
{"title": "从小众blueCMS入坑代码审计", "url": "https://www.freebuf.com/vuls/196190.html", "time": "2019-03-05", "level": "现金奖励", "num_look": 206302, "num_comment": 20, "author": "13324074893", "tags": ["WEB安全", "漏洞"], "text": "终于决定要入坑“代码审计”，之前也陆陆续续试着做一些，但总是浅尝而止，并没有坚持下来。作为一个菜鸟，在之前也看了许多大牛的文章，学习了一些新的思路。"}
{"title": "分析CVE-2018-8581：如何在MicrosoftExchange上冒充用户", "url": "https://www.freebuf.com/vuls/196072.html", "time": "2019-03-05", "level": "", "num_look": 95739, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["漏洞", "网络安全"], "text": "今天，我们一起看一看攻击者（未经身份验证的用户）如何利用这个Exchange漏洞来在Exchange服务器上冒充合法用户并进行恶意操作。"}
{"title": "冒用有效签名：Clop勒索病毒这股”韩流“已入侵国内企业", "url": "https://www.freebuf.com/articles/terminal/196604.html", "time": "2019-03-05", "level": "", "num_look": 121104, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "毒是一款2019年最新出现的勒索病毒家族，主要活跃地区在韩国，并出现向国内传播的趋势。"}
{"title": "你在哪里？ | 腾讯招人啦，邀你共护云安全", "url": "https://www.freebuf.com/jobs/197096.html", "time": "2019-03-05", "level": "", "num_look": 69900, "num_comment": 2, "author": "腾讯云安全", "tags": ["安全招聘"], "text": "腾讯安全云鼎实验室专注于云领域前沿安全技术研究与创新、安全漏洞研究和处置、云架构和解决方案规划设计、云标准化和合规体系建设等工作，拥有国内先进的研究环境和技术储备。"}
{"title": "RSAC 2019 | Axonius获得创新沙盒冠军", "url": "https://www.freebuf.com/news/197286.html", "time": "2019-03-05", "level": "", "num_look": 76022, "num_comment": 76022, "author": "AdlerI", "tags": ["资讯"], "text": "据最新消息显示，主打网络资产管理的Axonius公司在十个入围项目中表现突出，获得了创新沙盒的冠军。"}
{"title": "Kerberos协议探索系列之扫描与爆破篇", "url": "https://www.freebuf.com/articles/system/196434.html", "time": "2019-03-05", "level": "", "num_look": 244148, "num_comment": 8, "author": "云影实验室", "tags": ["系统安全"], "text": "Kerberos 是一种由 MIT（麻省理工大学）提出的一种网络身份验证协议。它旨在通过使用密钥加密技术为客户端/服务器应用程序提供强身份验证。"}
{"title": "等保到底是个啥（一）：物理安全部分", "url": "https://www.freebuf.com/articles/database/196754.html", "time": "2019-03-05", "level": "现金奖励", "num_look": 644431, "num_comment": 32, "author": "宇宸de研究室", "tags": ["安全管理", "数据安全"], "text": "自从接触安全类工作后就开始听到等保这个词，最初接触是在刚进入省测评中心的时候，刚刚进入安全这个圈子，经过各种项目和领导的折磨后，终于知道什么叫等保。"}
{"title": "威胁预警 | Nexus Repository Manager三个新漏洞已被用于挖矿木马传播", "url": "https://www.freebuf.com/vuls/197200.html", "time": "2019-03-05", "level": "", "num_look": 136908, "num_comment": 136908, "author": "阿里云安全", "tags": ["漏洞"], "text": "近日，阿里云安全监测到watchbog挖矿木马使用新曝光的Nexus Repository Manager 3远程代码执行漏洞(CVE-2019-7238)进行攻击并挖矿的事件。"}
{"title": "BUF早餐铺丨安全专家授权调查曾被朝鲜黑客组织使用的命令服务器；19 岁白帽子通过bug悬赏赚到一百万美元；Chrome被曝0day漏洞，可让黑客获取用户数据", "url": "https://www.freebuf.com/news/197278.html", "time": "2019-03-05", "level": "", "num_look": 72074, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "安全专家授权调查曾被朝鲜黑客组织使用的命令服务器；19 岁白帽子通过bug悬赏赚到一百万美元；Chrome被曝0day漏洞，可让黑客获取用户数据。"}
{"title": "2019 HackerOne黑客报告：白帽收入最高竟是普通程序员的40倍", "url": "https://www.freebuf.com/articles/paper/197233.html", "time": "2019-03-04", "level": "红色标题", "num_look": 312209, "num_comment": 14, "author": "奇安信代码卫士", "tags": ["安全报告"], "text": "HackerOne 平台发布年报，内容主要包括：黑客从哪里来？为何挖漏洞？最喜欢的黑客目标和工具是什么？从哪里学习？为何要和他人协作等等。"}
{"title": "威胁预警 | ProtonMiner挖矿蠕虫扩大攻击面加速传播", "url": "https://www.freebuf.com/vuls/197202.html", "time": "2019-03-04", "level": "", "num_look": 102017, "num_comment": 102017, "author": "阿里云安全", "tags": ["漏洞"], "text": "日，阿里云安全监测到一种挖矿蠕虫，正在互联网上加速传播。阿里云安全根据它使用ProtonMail邮箱地址作为矿池用户名的行为，将其命名为ProtonMiner。"}
{"title": "对五家主流网站托管服务商进行的一次渗透测试", "url": "https://www.freebuf.com/vuls/196133.html", "time": "2019-03-04", "level": "红色标题", "num_look": 205834, "num_comment": 10, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "最近，我们在对Bluehost、Dreamhost、HostGator、OVH和iPage5家流行的网站托管服务商（进行安全测试，目的在于发现这些网站托管平台是否存在一些可导致被入侵的漏洞。"}
{"title": "mpDNS：Python实现的多功能DNS服务器", "url": "https://www.freebuf.com/sectool/196069.html", "time": "2019-03-04", "level": "", "num_look": 119810, "num_comment": 5, "author": "周大涛", "tags": ["工具"], "text": "简单、可配置的“ clone和run ”DNS服务器，具有多种有用的功能。"}
{"title": "以太坊链审计报告之Clef审计报告", "url": "https://www.freebuf.com/articles/blockchain-articles/196822.html", "time": "2019-03-04", "level": "", "num_look": 84732, "num_comment": 84732, "author": "BUGX", "tags": ["区块链安全"], "text": "近期，以太坊go-ethereum公开了两份审计报告，玄猫安全团队第一时间对其进行了翻译工作。此为第二篇《Ethereum Clef Review》，此审计报告完成时间为2018年9月14日。"}
{"title": "MAKE A BEETER RSAC2019 | 我们真的变好了吗？", "url": "https://www.freebuf.com/news/197178.html", "time": "2019-03-04", "level": "红色标题", "num_look": 46680, "num_comment": 2, "author": "绿盟科技", "tags": ["资讯"], "text": "这个世界是否变得更好？可以是一个哲学问题、一个经济学问题或者一个社会学问题，但在Cyber world我们也可以这样来发问：我们的世界真的变得更好了么？"}
{"title": "2018年中国手机安全状况报告", "url": "https://www.freebuf.com/articles/paper/196664.html", "time": "2019-03-04", "level": "", "num_look": 175128, "num_comment": 175128, "author": "360安全", "tags": ["安全报告"], "text": "2018 年全年，截获移动端新增恶意程序样本约 434.2 万个，平均每天新增约 1.2 万。全年相比 2017 年（757.3 万）下降了约 42.7%。自 2015 年起，恶意程序新增样本量呈逐年下降趋势。"}
{"title": "委员交作业 | 政协委员周鸿祎的3个网络安全提案", "url": "https://www.freebuf.com/news/197312.html", "time": "2019-03-04", "level": "", "num_look": 59638, "num_comment": 2, "author": "360企业安全", "tags": ["资讯"], "text": "2019全国“两会”已经开幕。全国政协委员、360集团董事长兼CEO周鸿祎今年带来了三份提案，涉及国家级网络安全大脑建设、智能汽车网络安全、人工智能安全风险等安全热点话题。"}
{"title": "Trojan.Miner.gbq挖矿病毒分析报告", "url": "https://www.freebuf.com/articles/network/196594.html", "time": "2019-03-04", "level": "", "num_look": 211047, "num_comment": 1, "author": "江民安全实验室", "tags": ["网络安全"], "text": "2018年12月一款通过驱动人生升级通道下发传播的木马爆发，该木马同时利用了永恒之蓝高危漏洞进行传播，最终导致了仅2个小时受攻击的用户就高达10万，造成了严重的危害。"}
{"title": "你可能没见过的流量取证", "url": "https://www.freebuf.com/articles/network/196374.html", "time": "2019-03-04", "level": "现金奖励", "num_look": 824079, "num_comment": 11, "author": "Yale1024", "tags": ["网络安全"], "text": "还有半年就毕业了，这段时间看自己的小本本，整理出之前练习过的一些经典的CTF题目，希望现在的萌新能通过练习这些题目事半功倍，更好地提升技术水平。"}
{"title": "BUF早餐铺 | 脸书、谷歌等或因有害信息面临英政府数十亿美元罚款；漏洞暴露数千台恶意软件C＆C服务器的位置；泰国通过备受争议的网络安全法案", "url": "https://www.freebuf.com/news/197103.html", "time": "2019-03-04", "level": "", "num_look": 74838, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "道琼斯出漏洞：服务器配置错误致高风险客户数据公开；漏洞暴露数千台恶意软件C＆C服务器的位置"}
{"title": "bonesi ：在实验环境下模拟DDoS攻击流量的工具", "url": "https://www.freebuf.com/sectool/196070.html", "time": "2019-03-03", "level": "", "num_look": 199934, "num_comment": 2, "author": "周大涛", "tags": ["工具"], "text": "BoNeSi，DDoS僵尸网络模拟器是一种测试平台环境中模拟僵尸网络流量的工具。它旨在研究DDoS攻击的影响。"}
{"title": "Ubuntu Linux中的特权提升漏洞Dirty Sock分析（含PoC）", "url": "https://www.freebuf.com/articles/system/195903.html", "time": "2019-03-03", "level": "", "num_look": 165700, "num_comment": 3, "author": "Covfefe", "tags": ["系统安全"], "text": "2019年1月，由于默认安装的服务snapd API中的一个bug，通过默认安装的Ubuntu Linux被发现存在特权提升漏洞，任何本地用户都可以利用此漏洞直接获取root权限。"}
{"title": "【漏洞盒子高校V计划】青春有你，以盒之名——信息安全人才培育计划正式启动", "url": "https://www.freebuf.com/news/197079.html", "time": "2019-03-03", "level": "红色标题", "num_look": 125446, "num_comment": 20, "author": "FB客服", "tags": ["活动", "资讯"], "text": "漏洞盒子高校V计划来成都啦！"}
{"title": "以太坊链审计报告之go-ethereum安全审计", "url": "https://www.freebuf.com/articles/blockchain-articles/196209.html", "time": "2019-03-03", "level": "", "num_look": 102425, "num_comment": 102425, "author": "BUGX", "tags": ["区块链安全"], "text": "此为第一篇《Go Ethereum Security Review》即2017-04-25_Geth-audit_Truesec，此审计报告完成时间为2017年4月25日。"}
{"title": "任意URL跳转漏洞修复与JDK中getHost()方法之间的坑", "url": "https://www.freebuf.com/articles/web/196165.html", "time": "2019-03-03", "level": "现金奖励", "num_look": 229453, "num_comment": 5, "author": "ChangeS", "tags": ["WEB安全"], "text": "服务端未对传入的跳转url变量进行检查和控制，导致可恶意构造任意一个恶意地址，诱导用户跳转到恶意网站。"}
{"title": "Pftriage：如何在恶意软件传播过程中对恶意文件进行分析", "url": "https://www.freebuf.com/sectool/196074.html", "time": "2019-03-02", "level": "", "num_look": 89548, "num_comment": 89548, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款可以在恶意软件传播过程中帮助研究人员分析和追踪恶意文件的强大工具。"}
{"title": "漏洞分析：对CVE-2018-8587（Microsoft Outlook）漏洞的深入分析", "url": "https://www.freebuf.com/vuls/195902.html", "time": "2019-03-02", "level": "", "num_look": 137321, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["漏洞", "系统安全"], "text": "近期，研究人员在Outlook 2010至Outlook 2019版本以及Office 365 ProPlus中发现了一个堆崩溃漏洞，Windows平台下的32/64版本均会受到该漏洞影响。"}
{"title": "WI-FI渗透利器Pineapple Nano初探", "url": "https://www.freebuf.com/sectool/196358.html", "time": "2019-03-02", "level": "", "num_look": 655648, "num_comment": 5, "author": "安百科技", "tags": ["工具", "无线安全"], "text": "本文是作为一个新手接触这款产品时使用的一些记录和理解，由于入手时在网上找到的资料有限，翻译成为中文的文档也更是少之又少，没有找到较好的指导文档（也可能姿势不对）。"}
{"title": "【BUF大事件】「改版回归」:WinRAR 被曝存在遗留19年的漏洞，影响全球多达5亿用户；近五十万印度德里居民信息泄露", "url": "https://www.freebuf.com/video/197055.html", "time": "2019-03-02", "level": "红色标题", "num_look": 110917, "num_comment": 110917, "author": "willhuang", "tags": ["视频"], "text": "新版的BUF大事件还是为大家带来了新鲜有趣的安全新闻，WinRAR 被曝存在遗留19年的漏洞，影响全球多达5亿用户；近五十万印度德里居民信息泄露；成人网站用户的恶意软件在2018年大量增长。"}
{"title": "记一次有趣的密码重置", "url": "https://www.freebuf.com/vuls/196382.html", "time": "2019-03-02", "level": "金币+8", "num_look": 181352, "num_comment": 8, "author": "Strjziny", "tags": ["WEB安全", "漏洞"], "text": "最近被客户日的头晕晕，不但要搞定客户，还要搞定他们的开发，在熬掉14根头发后发现了这个漏洞，觉得比较有意思。"}
{"title": "开源软件没你想象中那么安全，Java 开发者尤其要警惕", "url": "https://www.freebuf.com/articles/paper/197074.html", "time": "2019-03-01", "level": "", "num_look": 100873, "num_comment": 100873, "author": "shidongqi", "tags": ["安全报告"], "text": "为了更好地了解开源领域的安全现状，以及我们该如何让开源世界的安全性变得更好，Snyk 公司通过对大量的数据进行统计和分析，得到了2019年开源安全现状调查报告。"}
{"title": "Turbo Intruder：BurpSuite高速 Intruder 插件介绍", "url": "https://www.freebuf.com/sectool/195912.html", "time": "2019-03-01", "level": "", "num_look": 174295, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "Turbo Intruder是一个从头开始构建的并充分考虑其执行速度的研究级开源Burp Suite扩展。此外我还讨论了有关基础HTTP滥用的例子在启用Turbo Intruder后其速度得到了显著的提升。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列-Sébastien Morin", "url": "https://www.freebuf.com/video/196988.html", "time": "2019-03-01", "level": "红色标题", "num_look": 76023, "num_comment": 2, "author": "willhuang", "tags": ["视频"], "text": "Sébastien积极利用自身技术参与漏洞众测，目前在HackerOne上的有效漏洞提交量为176个，并获得了2018年H1-415大赛的第二名。"}
{"title": "drupal8系列框架和漏洞动态调试深入分析", "url": "https://www.freebuf.com/vuls/196389.html", "time": "2019-03-01", "level": "", "num_look": 90302, "num_comment": 90302, "author": "alphalab", "tags": ["漏洞"], "text": "在drupal框架中，比较经典又离我们最近的莫过于18年的CVE-2018-7600这个漏洞了。"}
{"title": "知道创宇2018年度网络安全（云安全）态势报告", "url": "https://www.freebuf.com/articles/paper/196002.html", "time": "2019-03-01", "level": "", "num_look": 118963, "num_comment": 2, "author": "Knownsec知道创宇", "tags": ["安全报告"], "text": "2018年，网络安全领域暗流涌动，攻击趋势不断攀升，T级DDoS攻击多次爆发、数据泄露事件层出不穷、勒索软件大行其道。"}
{"title": "静态分析提取 WachtdogsMiner 木马中的矿机程序", "url": "https://www.freebuf.com/articles/system/196649.html", "time": "2019-03-01", "level": "金币+8", "num_look": 126563, "num_comment": 2, "author": "甲鱼", "tags": ["系统安全"], "text": "这周末爆发的新型 Linux 挖矿木马 WatchdogsMiner，有两家厂商分析的挺详细，尤其是腾讯云鼎实验室的分析，全面而深入。看完他们的的分析很有收获，也才发现这个 WatchdogsMiner 比之前想象的复杂一些。"}
{"title": "使用本地DTD文件来利用XXE漏洞实现任意结果输出", "url": "https://www.freebuf.com/articles/web/195899.html", "time": "2019-03-01", "level": "", "num_look": 179592, "num_comment": 2, "author": "secist", "tags": ["WEB安全"], "text": "本文我要向大家分享一个小技巧，即使用本地DTD文件来利用XXE漏洞从而实现任意结果的输出。"}
{"title": "PF_RING FT许可证初始化漏洞利用", "url": "https://www.freebuf.com/vuls/195887.html", "time": "2019-03-01", "level": "金币+6", "num_look": 83200, "num_comment": 2, "author": "小2黑hei", "tags": ["漏洞"], "text": "PF_RING是一个Linux内核模块和用户空间框架，可以高速率处理网络数据包，同时为处理数据包的应用程序提供一套API。"}
{"title": "百度百科、搜狗百科外链跳转色情网站，过期域名被黑产利用", "url": "https://www.freebuf.com/news/197015.html", "time": "2019-03-01", "level": "红色标题", "num_look": 251582, "num_comment": 5, "author": "Allen别bb", "tags": ["资讯"], "text": "百度百科外链竟被指向羞羞网站，在笔者一番查询之后发现，中招的不只是百度百科，连搜狗百科也同样未能幸免。"}
{"title": "如何使用未Root的Android手机扫描网站漏洞", "url": "https://www.freebuf.com/sectool/196167.html", "time": "2019-03-01", "level": "金币+6", "num_look": 178858, "num_comment": 2, "author": "crazyprobe", "tags": ["工具", "终端安全"], "text": "RapidScan在漏洞扫描器和网站审计软件的自动化部署上做的非常出色。它支持很多效果不错的工具，使用这些工具可以容易地探测常见的网站漏洞。"}
{"title": "类型混淆漏洞实例浅析", "url": "https://www.freebuf.com/vuls/196276.html", "time": "2019-03-01", "level": "", "num_look": 136114, "num_comment": 1, "author": "四维创智4DOGS", "tags": ["数据安全", "漏洞"], "text": "类型混淆漏洞一般是将数据类型A当做数据类型B来解析引用，这就可能导致非法访问数据从而执行任意代码。 本文通过IE类型混淆漏洞实例和Word类型混淆漏洞实例进行分析，来学习理解类型混淆漏洞原理。"}
{"title": "极验2018交互安全行业研究报告", "url": "https://www.freebuf.com/articles/paper/196652.html", "time": "2019-03-01", "level": "", "num_look": 100529, "num_comment": 2, "author": "GEETEST极验", "tags": ["安全报告"], "text": "报告主要聚焦于 OSI 第七层的业务层，通过2018年全年对全国近万个域名、数千亿次的交互数据展开分析，尽可能真实还原2018年国内互联网机器流量状况。"}
{"title": "BUF早餐铺 | 臭名昭著的挖矿服务网站Coinhive将于三月初关闭；英特尔开源HBFA固件安全测试工具；违规收集儿童隐私，“抖音国际版”TikTok 在美受重罚", "url": "https://www.freebuf.com/news/196921.html", "time": "2019-03-01", "level": "", "num_look": 78786, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "在2月26日的博客文章中Coinhive团队宣布，其加密货币采矿服务即将关闭，据报道该项目在经济上已无法支持运营。"}
{"title": "木马分析：分析针对意大利的Ursnif银行木马", "url": "https://www.freebuf.com/vuls/195909.html", "time": "2019-02-28", "level": "", "num_look": 117084, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["漏洞", "网络安全"], "text": "Ursnif是目前活动最为频繁的银行木马，它也被称为GOZI。实际上，它是Gozi-ISFB银行木马的一个变种版本，自从该木马在2014年泄露了其源代码之后，攻击者这些年来一直都在升级和更新Gozi的功能。"}
{"title": "微信PC端技术研究：如何找到消息发送接口", "url": "https://www.freebuf.com/geek/196261.html", "time": "2019-02-28", "level": "金币+6", "num_look": 193268, "num_comment": 3, "author": "anhkgg", "tags": ["极客"], "text": "这篇继续使用CE和OD来研究一下微信的消息发送接口。"}
{"title": "那些年走过的信安面试路", "url": "https://www.freebuf.com/articles/neopoints/196337.html", "time": "2019-02-28", "level": "现金奖励", "num_look": 328045, "num_comment": 18, "author": "绿帽子技术分享", "tags": ["观点"], "text": "公司一个银行外包项目，通知我明天跨省去面试，低调混了这么久，正好拿出时间分享下一些常规经验吧。"}
{"title": "对恶意树莓派设备的取证分析", "url": "https://www.freebuf.com/articles/terminal/196085.html", "time": "2019-02-28", "level": "", "num_look": 164693, "num_comment": 5, "author": "周大涛", "tags": ["终端安全"], "text": "一次关于恶意树莓派的取证分析，一个非常有趣的挑战。"}
{"title": "违规收集儿童隐私，“抖音国际版”TikTok在美受重罚", "url": "https://www.freebuf.com/news/196900.html", "time": "2019-02-28", "level": "红色标题", "num_look": 149111, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": "近期抖音海外版 TikTok 安装量刚刚突破10亿，这绝对是个惊人的数字。紧随而来的还有一张巨额罚单——570万美元，约合人民币3800万元。"}
{"title": "春暖三月 | 菜鸟SRC×漏洞盒子白帽城市沙龙成都站免费报名啦", "url": "https://www.freebuf.com/news/196606.html", "time": "2019-02-28", "level": "红色标题", "num_look": 146313, "num_comment": 1, "author": "FB客服", "tags": ["活动", "资讯"], "text": "“物流因我更安全”菜鸟安全响应中心白帽子城市沙龙来成都啦"}
{"title": "盲眼鹰（APT-C-36）：持续针对哥伦比亚政企机构的攻击活动揭露", "url": "https://www.freebuf.com/articles/system/196110.html", "time": "2019-02-28", "level": "", "num_look": 104404, "num_comment": 104404, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "从2018年4月起至今，一个疑似来自南美洲的APT组织盲眼鹰（APT-C-36）针对哥伦比亚政府机构和大型公司等重要领域展开了有组织、有计划、针对性的长期不间断攻击。"}
{"title": "FIT 2019企业安全俱乐部精品公开课上线", "url": "https://www.freebuf.com/news/196219.html", "time": "2019-02-28", "level": "", "num_look": 57237, "num_comment": 1, "author": "FB客服", "tags": ["资讯"], "text": "广受关注的企业安全俱乐部现将面向广大FreeBuf会员开启网络精品公开课，机不可失，失不再来~"}
{"title": "拒绝超长函数，从两个curl远程漏洞说起", "url": "https://www.freebuf.com/vuls/196088.html", "time": "2019-02-28", "level": "", "num_look": 152899, "num_comment": 152899, "author": "腾讯安全平台部", "tags": ["漏洞", "网络安全"], "text": "Tencent Blade Team在代码审计过程中发现了curl中存在两个可以通过NTLM远程触发的漏洞。这两个漏洞存在于curl在处理Type-2和Type-3消息的逻辑中。"}
{"title": "盘一盘2018年那些难缠的顽固病毒木马", "url": "https://www.freebuf.com/articles/paper/196613.html", "time": "2019-02-28", "level": "", "num_look": 137891, "num_comment": 137891, "author": "腾讯电脑管家", "tags": ["安全报告"], "text": "本文主要从Bootkit/Rootkit病毒活跃家族、传播渠道、对抗技术、典型案例四个方面盘点2018年病毒的主要态势及变化。"}
{"title": "BUF早餐铺 | Thunderclap攻击出现；社交媒体平台成为恶意软件分发中心；CentOS 6和Red Hat Enterprise Linux 6内核安全更新", "url": "https://www.freebuf.com/news/196876.html", "time": "2019-02-28", "level": "", "num_look": 54585, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "英伟达修复GPU显示驱动中的漏洞；研究发现人们担心隐私但并不愿意采取行动。"}
{"title": "RSA 2019创新沙盒 | WireWheel：基于SaaS的企业数据隐私协同保护平台", "url": "https://www.freebuf.com/articles/neopoints/196845.html", "time": "2019-02-27", "level": "", "num_look": 94524, "num_comment": 1, "author": "绿盟科技", "tags": ["观点"], "text": "WireWheel成立于2016年，总部位于华盛顿，该公司致力于降低数据隐私保护合规能力建设的难度，帮助企业来应对复杂、严厉的法案、条例规定。"}
{"title": "ThunderShell：PythonPowerShell实现的HTTP通信的远程控制软件", "url": "https://www.freebuf.com/sectool/195900.html", "time": "2019-02-27", "level": "", "num_look": 153682, "num_comment": 153682, "author": "secist", "tags": ["工具"], "text": "ThunderShell是一个通过HTTP请求进行通信的C# RAT。所有网络流量都使用第二层RC4进行加密，以躲避SSL拦截及其目标系统上的网络检测。"}
{"title": "【企业公开课】免费入门企业安全数据分析与实践", "url": "https://www.freebuf.com/fevents/196791.html", "time": "2019-02-27", "level": "红色标题", "num_look": 106452, "num_comment": 2, "author": "FB客服", "tags": ["FreeBuf公开课", "活动"], "text": "本期公开课将结合威胁检测实践来讨论数据分析在企业安全建设中的形态、价值以及方法论，旨在对传统攻防研究人员和企业安全建设者提供入门指引。"}
{"title": "缓冲区溢出实战教程系列（一）：第一个缓冲区溢出小程序", "url": "https://www.freebuf.com/articles/system/195614.html", "time": "2019-02-27", "level": "现金奖励", "num_look": 278413, "num_comment": 13, "author": "kaliking", "tags": ["系统安全"], "text": "在安全圈里我们会经常听到或用到一些0day漏洞，在印象里我们都觉的只有真正的大神才能挖掘到这样的漏洞，事实也的确如此。"}
{"title": "探讨后渗透测试工具SILENTTRINITY的工作原理与检测技巧", "url": "https://www.freebuf.com/articles/system/195913.html", "time": "2019-02-27", "level": "", "num_look": 110730, "num_comment": 1, "author": "周大涛", "tags": ["系统安全"], "text": "SILENTTRINITY 是最近发布的一款基于IronPython和c#的工具。这篇文章将深入探讨它的工作原理和检测技术。"}
{"title": "好未来教育集团招聘高级安全工程师", "url": "https://www.freebuf.com/jobs/196275.html", "time": "2019-02-27", "level": "", "num_look": 102776, "num_comment": 11, "author": "100tal", "tags": ["安全招聘"], "text": "好未来安全应急响应中心致力于维护互联网健康生态环境，保障好未来产品和业务线的信息安全，促进安全专家的合作与交流，而建立的漏洞收集及应急响应平台。"}
{"title": "响尾蛇（SideWinder）APT组织针对南亚国家的攻击活动披露", "url": "https://www.freebuf.com/articles/network/196788.html", "time": "2019-02-27", "level": "", "num_look": 1385709, "num_comment": 6, "author": "腾讯电脑管家", "tags": ["网络安全"], "text": "从 2017 年底到 2019 年初，腾讯御见威胁情报中心发现一个疑似来自印度的 APT 攻击组织持续针对巴基斯坦等南亚国家的军事目标进行了定向攻击。"}
{"title": "当算法觉得你想死……", "url": "https://www.freebuf.com/articles/neopoints/196715.html", "time": "2019-02-27", "level": "红色标题", "num_look": 579738, "num_comment": 4, "author": "Allen别bb", "tags": ["观点"], "text": "我始终坚持，技术无罪。但当算法认为你想死的时候，我们又该怎么办？"}
{"title": "HTTP的同源策略与跨域资源共享（CORS）机制", "url": "https://www.freebuf.com/articles/web/195925.html", "time": "2019-02-27", "level": "现金奖励", "num_look": 272147, "num_comment": 2, "author": "x565178035", "tags": ["WEB安全"], "text": "跨域资源共享是一种解决跨域请求的方案，其机制是使用一组额外响应头和预检请求来使浏览器有权使用非同源资源，大部分的现代浏览器符合该标准。"}
{"title": "注入型勒索病毒Ryuk，伸向x64系统的魔爪", "url": "https://www.freebuf.com/articles/terminal/196279.html", "time": "2019-02-27", "level": "", "num_look": 129597, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "Ryuk是一款通过垃圾邮件和漏洞利用工具包传播的勒索病毒，最早在2018年8月由国外某安全公司报道，其代码结构与HERMES勒索病毒十分相似。"}
{"title": "BUF早餐铺 | 沃达丰CEO警告：禁止华为将致欧洲5G部署推迟2年；新版Android已支持FIDO2标准，免密登录应用或网站；首个完整利用WinRAR漏洞传播的恶意样本出现", "url": "https://www.freebuf.com/news/196761.html", "time": "2019-02-27", "level": "", "num_look": 66554, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": "全球第二大移动运营商沃达丰CEO尼克·瑞德（Nick Read）今日警告说，将华为排除在欧洲5G网络之外，可能会对国家基础设施和消费者造成“巨大破坏”。"}
{"title": "RSA 2019创新沙盒 | DisruptOps：面向敏捷开发的多云管理平台", "url": "https://www.freebuf.com/articles/neopoints/196669.html", "time": "2019-02-26", "level": "", "num_look": 85811, "num_comment": 1, "author": "绿盟科技", "tags": ["观点"], "text": "DisruptOps Inc.成立于2014年，位于密苏里州堪萨斯城，该公司致力于通过为多云基础设施提供自动化的防护来提升云操作的安全性，实现对云基础设施的持续检测和控制。"}
{"title": "RSA 2019创新沙盒 | CloudKnox：用于混合云环境中的身份授权管理平台", "url": "https://www.freebuf.com/articles/neopoints/196676.html", "time": "2019-02-26", "level": "", "num_look": 74872, "num_comment": 2, "author": "绿盟科技", "tags": ["观点"], "text": "CloudKnox是一家位于美国加利福尼亚州森尼韦尔的初创高科技公司，成立于2015年9月。公司已经完成A轮融资，累计融资1075万美元。"}
{"title": "网络安全人才短缺加剧，企业如何不拘一格降人才？", "url": "https://www.freebuf.com/articles/neopoints/196017.html", "time": "2019-02-26", "level": "红色标题", "num_look": 342246, "num_comment": 31, "author": "AngelaY", "tags": ["观点"], "text": "网络安全企业在人才建设过程中，除了单纯的招聘与团队扩充，也可以考虑利用多种方式激发内部员工潜能，或让其他行业有潜力的人才开启网络安全职业生涯，为未来发展开辟更多道路。"}
{"title": "Watch Dogs挖矿病毒分析", "url": "https://www.freebuf.com/articles/system/196515.html", "time": "2019-02-26", "level": "", "num_look": 186478, "num_comment": 4, "author": "默安科技_影武者实验室", "tags": ["系统安全"], "text": "之前看到了网上释出了watchdogs挖矿病毒分析的文章，有几个部分，比如如何找到钱包地址以及针对挖矿程序ksoftirqds的分析没有详细说明，我来补充一下~"}
{"title": "RSA 2019 创新沙盒| Duality: 基于同态加密的数据分析和隐私保护方案", "url": "https://www.freebuf.com/articles/database/196827.html", "time": "2019-02-26", "level": "", "num_look": 117660, "num_comment": 117660, "author": "AngelaY", "tags": ["数据安全", "观点"], "text": "Duality Technologies成立于2016年，公司致力于研究大数据/云环境下的数据安全与隐私保护技术，为企业组织提供了一个安全的数字协作平台。"}
{"title": "基于ONVIF协议的物联网设备参与DDoS反射攻击", "url": "https://www.freebuf.com/articles/system/196186.html", "time": "2019-02-26", "level": "", "num_look": 123141, "num_comment": 123141, "author": "百度安全实验室", "tags": ["系统安全"], "text": "本次攻击利用了物联网大量使用UDP协议的特点发起的反射放大的DDoS攻击。"}
{"title": "UEFI Firmware Parser：可解析BIOSIntel MEUEFI固件结构", "url": "https://www.freebuf.com/sectool/195873.html", "time": "2019-02-26", "level": "", "num_look": 124968, "num_comment": 124968, "author": "Alpha_h4ck", "tags": ["工具"], "text": "UEFI Firmware Parser，即UEFI固件解析器，它是一个简单的脚本模块集合。它可以解析、提取并重建UEFI固件卷宗。其中包括针对BIOS、OptionROM、Intel ME和其他格式的解析模块。"}
{"title": "测试Android应用程序的逆向方法和寻找攻击面的技巧", "url": "https://www.freebuf.com/articles/terminal/195840.html", "time": "2019-02-26", "level": "红色标题", "num_look": 148363, "num_comment": 3, "author": "secist", "tags": ["终端安全"], "text": "在研究和阅读了相关的技术文档后，我决定自己写一篇教程。这是我人生中的第一篇与移动相关的教程文章，因此它可能并不全面。但我相信分享即是关怀，所以如果你有任何的意见或建议，可以随时与我取得联系。"}
{"title": "加入VIPKID安全中心，一起守护希望的未来！", "url": "https://www.freebuf.com/jobs/196334.html", "time": "2019-02-26", "level": "", "num_look": 87713, "num_comment": 6, "author": "VIPKID安全团队", "tags": ["安全招聘"], "text": "本次招聘涉及数据安全、运维安全、IT安全、业务安全、安全开发方向。"}
{"title": "常见的几种Windows后门持久化方式", "url": "https://www.freebuf.com/vuls/195906.html", "time": "2019-02-26", "level": "现金奖励", "num_look": 348049, "num_comment": 9, "author": "si1ence", "tags": ["漏洞", "系统安全"], "text": "持久化后门是指当入侵者通过某种手段拿到服务器的控制权之后，通过在服务器上放置一些后门（脚本、进程、连接之类），来方便以后持久性的入侵。"}
{"title": "使用x64dbg分析微信并获取所有联系人信息", "url": "https://www.freebuf.com/articles/terminal/195774.html", "time": "2019-02-26", "level": "现金奖励", "num_look": 232859, "num_comment": 9, "author": "lant1e", "tags": ["终端安全"], "text": "上回我们完成了微信中对发信息的自动调用，这次我们接着分析微信的联系人信息，完成对联系人、群信息的获取。"}
{"title": "RSA 2019创新沙盒十强：解决安全问题的内核不变", "url": "https://www.freebuf.com/news/196414.html", "time": "2019-02-26", "level": "红色标题", "num_look": 107165, "num_comment": 107165, "author": "AngelaY", "tags": ["资讯"], "text": "仅在过去的五年中，RSA创新沙盒的企业已经筹集了超过20亿美元的投资资金。"}
{"title": "BUF早餐铺丨软件故障导致Lime电动滑板车锁定；北京一警察倒卖公民犯罪记录5万余条，获利32万被判4年；研究人员发现4G/5G漏洞，可拦截通话追踪用户位置；疑似国内某天气APP上传用户所有WiFi账号和网络信息", "url": "https://www.freebuf.com/news/196651.html", "time": "2019-02-26", "level": "", "num_look": 61251, "num_comment": 2, "author": "Karunesh91", "tags": ["资讯"], "text": "ICANN呼吁全面推进部署DNSSEC 有效阻止“中间人”域名攻击；软件故障导致 Lime 电动滑板车锁定；北京一警察倒卖公民犯罪记录5万余条，获利32万被判4年；"}
{"title": "WatchDogsMiner挖矿蠕虫大量感染Linux服务器", "url": "https://www.freebuf.com/articles/terminal/196504.html", "time": "2019-02-26", "level": "", "num_look": 169322, "num_comment": 169322, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "近日，公有云上及外部Linux服务器存在大量被入侵，表现为/tmp临时目录存在watchdogs文件，出现了crontab任务异常、网络异常、系统文件被删除、CPU异常卡顿等情况，严重影响用户业务。"}
{"title": "Drupal SA-CORE-2019-003远程命令执行分析", "url": "https://www.freebuf.com/vuls/196372.html", "time": "2019-02-25", "level": "", "num_look": 126313, "num_comment": 126313, "author": "云鼎实验室", "tags": ["漏洞"], "text": "2月20日Drupal官方披露了一个Drupal的远程命令执行漏洞，漏洞的触发条件不高，但一旦该漏洞被利用，攻击者则可以直接在Web服务器上执行任意PHP代码，造成服务器被入侵、用户信息泄露等后果。"}
{"title": "Linux watchdogs感染性隐藏挖矿病毒入侵还原录", "url": "https://www.freebuf.com/articles/system/196510.html", "time": "2019-02-25", "level": "现金奖励", "num_look": 114041, "num_comment": 114041, "author": "云鼎实验室", "tags": ["系统安全"], "text": "近日，部分云上及外部用户机器存在安全漏洞被入侵，同时植入watchdogs挖矿病毒，出现crontab任务异常、系统文件被删除、CPU 异常等情况，并且会自动感染更多机器。"}
{"title": "暴力破解及其流行工具研究", "url": "https://www.freebuf.com/sectool/195910.html", "time": "2019-02-25", "level": "金币+6", "num_look": 331143, "num_comment": 10, "author": "大学新生Bai", "tags": ["工具", "网络安全"], "text": "暴力破解攻击是最流行的密码破解方法之一，然而，它不仅仅是密码破解。暴力攻击还可用于发现Web应用程序中的隐藏页面和内容，在你成功之前，这种攻击基本上是“攻击一次尝试一次”。"}
{"title": "RSA 2019 | 专访副主席Sandra Toms：RSA大会的引力所在", "url": "https://www.freebuf.com/fevents/196449.html", "time": "2019-02-25", "level": "", "num_look": 62236, "num_comment": 62236, "author": "AngelaY", "tags": ["活动"], "text": "本文为外媒HelpNetSecurity对RSA大会副主席及负责人Sandra Toms的专访，涉及RSA大会的准备及未来展望。"}
{"title": "微信PC端技术研究：截获语音消息", "url": "https://www.freebuf.com/articles/database/195504.html", "time": "2019-02-25", "level": "金币+6", "num_look": 385061, "num_comment": 3, "author": "anhkgg", "tags": ["数据安全", "极客"], "text": "总结一下CE用法的核心思路：通过各种技巧搜索找到内存中关键数据，然后结合动态调试找到操作数据的函数。"}
{"title": "简记网络犯罪分子是如何对目标下手的", "url": "https://www.freebuf.com/articles/neopoints/195845.html", "time": "2019-02-25", "level": "", "num_look": 100717, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["观点"], "text": "在这篇文章中，我们将介绍攻击者在入侵企业网络时会采取的一些初始攻击方法。"}
{"title": "新华三安全产品线诚聘安全人才", "url": "https://www.freebuf.com/jobs/196082.html", "time": "2019-02-25", "level": "", "num_look": 124478, "num_comment": 9, "author": "H3CSecurity", "tags": ["安全招聘"], "text": "新华三集团（简称新华三）是业界领先的数字化解决方案领导者，现因业务需求招聘安全人才~"}
{"title": "对勒索病毒GandCrab5.1的一次成功应急响应（附解密工具+加密样本）", "url": "https://www.freebuf.com/articles/es/196278.html", "time": "2019-02-25", "level": "现金奖励", "num_look": 468839, "num_comment": 12, "author": "redwand", "tags": ["企业安全"], "text": "正月十五元晚上，在家刚吃完元宵接到电话，朋友公司遭受勒索病毒攻击，数据库文件被加密，黑客通过暗网勒索 15000 美金赎金。"}
{"title": "对恶意软件Dridex的流量分析", "url": "https://www.freebuf.com/articles/es/195832.html", "time": "2019-02-25", "level": "现金奖励", "num_look": 125386, "num_comment": 125386, "author": "arr0w1", "tags": ["企业安全"], "text": "流量分析需要我们有扎实的网络知识为基础，同时需要具备实际操作的能力和经验。通过写本篇文章，记录下练习流量分析的过程。以便提高从流量上确定感染情况，以及分析溯源等能力。"}
{"title": "高价收购私人微信号的局中局", "url": "https://www.freebuf.com/articles/terminal/196172.html", "time": "2019-02-25", "level": "", "num_look": 474249, "num_comment": 2, "author": "GEETEST极验", "tags": ["终端安全"], "text": "QQ、微信、支付宝，网络世界我们有太多的账号，百年之后这些网络资产该怎么处理？"}
{"title": "BUF早餐铺 | 成人网站用户的恶意软件在2018年大量增长；微软称Windows Sever容易受到DoS攻击；近五十万印度德里居民信息泄露", "url": "https://www.freebuf.com/news/196487.html", "time": "2019-02-25", "level": "", "num_look": 67945, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "Google 研究人员称光靠软件不能完全避开 Spectre 漏洞；苹果为Safari 12.1更新智能追踪防护功能 。"}
{"title": "WordPress“Simple Social Buttons”漏洞分析", "url": "https://www.freebuf.com/vuls/195705.html", "time": "2019-02-25", "level": "金币+8", "num_look": 80209, "num_comment": 7, "author": "帕克飞走了", "tags": ["漏洞"], "text": "WordPress “Simple Social Buttons”插件是一个流行的免费和付费插件，可以在侧边栏，内嵌，帖子内容的上方和下方等位置添加社交媒体共享按钮。根据供应商所述，该插件在WordPress插件库有超过500,000次下载，有超过…"}
{"title": "Justniffer：一款功能强大的TCP数据包嗅探工具", "url": "https://www.freebuf.com/sectool/195860.html", "time": "2019-02-24", "level": "", "num_look": 196935, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Freddy"}
{"title": "DuckDuckGo的研究声称谷歌“匿名模式”并非真正的匿名", "url": "https://www.freebuf.com/articles/web/195817.html", "time": "2019-02-24", "level": "", "num_look": 116540, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "Google可以给用户提供定制化的搜索结果，即使在匿名模式下也是一样。但DuckDuckGo的研究人员表示，Google的搜索结果不仅基于用户的地理位置数据以及之前搜索过的内容，而且还会根据用户的登录状态或匿名浏览模式来…"}
{"title": "十三款流行无线黑客工具介绍", "url": "https://www.freebuf.com/sectool/195898.html", "time": "2019-02-24", "level": "金币+8", "num_look": 267836, "num_comment": 3, "author": "大学新生Bai", "tags": ["工具"], "text": "在本文中，我将讨论无线网络的安全和最佳的WiFi密码破解或恢复工具，解释无线网络使用的加密类型以及这些工具如何破解网络以获取访问权限。"}
{"title": "CMS代码审计之emlog 6.0", "url": "https://www.freebuf.com/vuls/195351.html", "time": "2019-02-24", "level": "金币+8", "num_look": 191504, "num_comment": 8, "author": "fishyyh", "tags": ["WEB安全", "漏洞"], "text": "本小菜也是刚开始玩代码审计，最近发现个比较有趣的cms跟大家分享一波。"}
{"title": "DFIRTrack：一款功能强大的事件应急响应跟踪软件", "url": "https://www.freebuf.com/sectool/195850.html", "time": "2019-02-23", "level": "", "num_look": 112145, "num_comment": 112145, "author": "Alpha_h4ck", "tags": ["工具"], "text": "DFIRTrack，即数字取证和事件响应跟踪应用程序。它是一款开源的Web应用程序，基于Django开发，后端数据库为PostgreSQL数据库。"}
{"title": "全球性的DNS劫持活动：大规模DNS记录操控", "url": "https://www.freebuf.com/articles/network/195791.html", "time": "2019-02-23", "level": "", "num_look": 124700, "num_comment": 124700, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "FireEye的Mandiant应急响应和情报团队识别出了一波DNS劫持攻击，这波攻击影响了大量域名，其中包括中东、北非、欧洲和南美地区的政府机构、通信部门以及互联网基础设施。"}
{"title": "Windows ADS在渗透测试中的妙用", "url": "https://www.freebuf.com/articles/terminal/195721.html", "time": "2019-02-23", "level": "现金奖励", "num_look": 265707, "num_comment": 4, "author": "3unshine", "tags": ["系统安全", "终端安全"], "text": "利用ADS数据流，我们可以做很多有趣的事情，同时对于企业安全来说这类问题也隐藏着巨大的风险。本文主要讨论利用方式以及如何防御这类攻击。"}
{"title": "人脸识别系统联网打击号贩子，限制其乘坐高铁、贷款", "url": "https://www.freebuf.com/news/196479.html", "time": "2019-02-23", "level": "", "num_look": 111959, "num_comment": 5, "author": "Allen别bb", "tags": ["资讯"], "text": "央视新闻报道称，北京市已经将2100多名号贩子的信息录入北京各大医院人脸识别系统，一旦号贩子进入医院，系统就能立刻监控到，对其行动进行密切关注。"}
{"title": "逻辑漏洞挖掘初步总结篇", "url": "https://www.freebuf.com/articles/web/195837.html", "time": "2019-02-23", "level": "现金奖励", "num_look": 417543, "num_comment": 19, "author": "scpkun", "tags": ["WEB安全"], "text": "我将所有逻辑漏洞的问题分为前端和后端两个部分，总体思路都是先测试前端再测试后端。"}
{"title": "分布式Web漏洞扫描平台WDScanner", "url": "https://www.freebuf.com/sectool/195642.html", "time": "2019-02-22", "level": "", "num_look": 307253, "num_comment": 16, "author": "TideSec", "tags": ["工具"], "text": "为了能在漏洞爆发后快速形成漏洞检测能力，同时能对网站或主机进行全面快速的安全检测，Tide 安全团队（www.tidesec.net）开发了一套简单易用的分布式 web 漏洞检测系统 WDScanner。"}
{"title": "RSA 2019议题前瞻——安全让世界更美好", "url": "https://www.freebuf.com/fevents/196369.html", "time": "2019-02-22", "level": "红色标题", "num_look": 100572, "num_comment": 2, "author": "AngelaY", "tags": ["活动"], "text": "今年RSA 2019 USA大会的主题是“Better”，简短的一个词折射出信息安全领域逐渐转向踏实化以及不断发展提升、越来越好的愿景。"}
{"title": "挖洞经验 | 绕过Facebook CSRF防护机制实现账户劫持", "url": "https://www.freebuf.com/vuls/195814.html", "time": "2019-02-22", "level": "", "num_look": 148117, "num_comment": 1, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "今天分享的这个漏洞是Facebook的CSRF防护机制绕过漏洞，攻击者利用这个漏洞可以发送带有CSRF token的请求至任意Facebook产品服务端用户，实现账户劫持。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列-Fredrik Alexandersson", "url": "https://www.freebuf.com/video/196319.html", "time": "2019-02-22", "level": "红色标题", "num_look": 76749, "num_comment": 76749, "author": "willhuang", "tags": ["视频"], "text": "Fredrik Alexandersson，也称stok，来自瑞典哥德堡。作为有多年工作经验的IT专家，stok对Windows NT架构、Active Directory、云计算、混合系统规划和数据中心建设等领域都有很深的研究"}
{"title": "东鹏智业招聘信息安全工程师（成都）", "url": "https://www.freebuf.com/jobs/195895.html", "time": "2019-02-22", "level": "", "num_look": 116531, "num_comment": 6, "author": "s3curi7y", "tags": ["安全招聘"], "text": "四川东鹏智业科技有限公司是一家民营高新技术企业，是中国领先的智能化弱电服务商家，集团以做\"技术领先型\"企业为定位，坚持高清化、智能化、行业化、集成化的发展方向。"}
{"title": "一句话木马的套路", "url": "https://www.freebuf.com/articles/web/195304.html", "time": "2019-02-22", "level": "", "num_look": 380969, "num_comment": 1, "author": "404SEC", "tags": ["WEB安全"], "text": "尽最大努力在一文中让大家掌握一些有用的 WEBSHELL 免杀技巧。"}
{"title": "大数据安全体系介绍之技术体系篇", "url": "https://www.freebuf.com/articles/database/195790.html", "time": "2019-02-22", "level": "金币+6", "num_look": 303951, "num_comment": 3, "author": "smoonsoso", "tags": ["数据安全"], "text": "信息是有价值的数据，随着海量、异构、实时、低价值的数据从世界的各个角落，各个方位扑面而来，人类被这股强大的数据洪流迅速的裹挟进入了第五个时期，也就是目前所处的数据安全时代。"}
{"title": "Web中间件常见漏洞总结", "url": "https://www.freebuf.com/articles/web/192063.html", "time": "2019-02-22", "level": "现金奖励", "num_look": 809547, "num_comment": 10, "author": "ningjing", "tags": ["WEB安全"], "text": "常本文包含见web中间件及其漏洞概述，适合收藏食用~"}
{"title": "BUF早餐铺 | WinRAR 被曝存在遗留19年的漏洞；WordPress 5.0.0远程代码执行漏洞预警；1.8万款APP被指违反谷歌策略跟踪用户；万事达联合GCA推出小型企业网络安全工具包", "url": "https://www.freebuf.com/news/196309.html", "time": "2019-02-22", "level": "", "num_look": 81760, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "Winrar的问题是因UNACEV2.dll代码库中的一个深藏已久的漏洞引起的，而且该代码库从2005年以来就一直没有被主动使用过。"}
{"title": "赛门铁克：表单劫持“力拔头筹”，成为2018年头号威胁", "url": "https://www.freebuf.com/news/196341.html", "time": "2019-02-21", "level": "", "num_look": 90318, "num_comment": 90318, "author": "Freddy", "tags": ["资讯"], "text": "近日，赛门铁克发布了2019《互联网安全威胁报告》，回顾2018年的网络安全形势，作为供应链攻击链条中“关键一环“的表单劫持攻击已成为2018年的头号网络威胁。"}
{"title": "SSHazam：如何利用SSH隧道实现隐蔽C2通信", "url": "https://www.freebuf.com/articles/system/195810.html", "time": "2019-02-21", "level": "", "num_look": 146876, "num_comment": 146876, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "SSHazam这种技术可以帮助你将任何C2工具的通信流量隐藏在标准SSH通信信道中以躲避网络监测。"}
{"title": "仿真靶场搭建：个人版PENTESTIT", "url": "https://www.freebuf.com/sectool/195632.html", "time": "2019-02-21", "level": "现金奖励", "num_look": 200927, "num_comment": 8, "author": "wnltc0", "tags": ["工具"], "text": "过年前，发现了一款名为 pentestit 的在线靶场，看着挺有意思，但 vpn 死活连不上，于是萌生出再本地搭建的念头。"}
{"title": "微步在线急聘：木马分析师！病毒分析师！情报分析师！", "url": "https://www.freebuf.com/jobs/196151.html", "time": "2019-02-21", "level": "", "num_look": 172416, "num_comment": 7, "author": "Threatbook", "tags": ["安全招聘"], "text": "微步在线成立于2015年7月，是国内专注于提供威胁情报能力输出的安全创新型企业，现已成长为国内威胁情报领军品牌，提供专业的威胁检测产品与服务。"}
{"title": "快讯 | WinRAR 被曝存在遗留19年的漏洞，影响全球多达5亿用户", "url": "https://www.freebuf.com/news/196281.html", "time": "2019-02-21", "level": "红色标题", "num_look": 224724, "num_comment": 20, "author": "shidongqi", "tags": ["资讯"], "text": "近期，WinRAR被发现存在严重的代码执行漏洞，允许安全研究人员将恶意文件直接放到Windows启动文件夹中，该漏洞可能已经存在了长达19年的时间。"}
{"title": "2018年第四季度DDoS攻击报告", "url": "https://www.freebuf.com/articles/paper/195643.html", "time": "2019-02-21", "level": "", "num_look": 142165, "num_comment": 2, "author": "青松Qssec", "tags": ["安全报告"], "text": "中国仍然是DDoS攻击数量最多的国家，但所占份额大幅下降，全球排名前十的国家变动较大，可能是因为各国严厉打击僵尸网络等举措的结果。"}
{"title": "薅资本主义羊毛：使用Google的免费GPU破解哈希", "url": "https://www.freebuf.com/geek/195453.html", "time": "2019-02-21", "level": "现金奖励", "num_look": 283551, "num_comment": 11, "author": "r0yanx", "tags": ["极客"], "text": "Google Colab提供了免费的GPU Tesla K80为开发者提供免费的GPU来学习开发深度学习应用，尝试在上面安装hashcat测试哈希爆破，效果还可以。"}
{"title": "国内某金融公司现“内鬼”，单价最低2毛钱出售数百万条个人信息", "url": "https://www.freebuf.com/news/196247.html", "time": "2019-02-21", "level": "红色标题", "num_look": 129383, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "可能是因为“内鬼”获取数据太容易，你永远想象不到一直小心翼翼保护的信息是如何被贱卖的。"}
{"title": "GSM Sniffing嗅探设备组装之短信嗅探", "url": "https://www.freebuf.com/articles/wireless/195630.html", "time": "2019-02-21", "level": "", "num_look": 973996, "num_comment": 20, "author": "安百科技", "tags": ["无线安全"], "text": "GSM嗅探不算什么最新技术，但是是一个无线安全的必经之路，该文章单为记录操作过程，方便以后观看，设备也是花了不少时间才做完。"}
{"title": "BUF早餐铺 | 部分用户路由器被黑客攻击，或造成访问延迟或失败；流行的密码管理器中发现重大安全漏洞；GitHub扩大BUG悬赏项目规模 且不再设置赏金上限", "url": "https://www.freebuf.com/news/196257.html", "time": "2019-02-21", "level": "", "num_look": 98023, "num_comment": 4, "author": "shidongqi", "tags": ["资讯"], "text": "近日，部分网友反馈路由器信号不好、网速不快。DNSPod发布公告称，近日监控到多起客户在全国各地各运营商流量被调度到江苏电信的问题，经过与第三方的合作分析排查确认，这是一起大规模的黑产攻击事件。"}
{"title": "只需要不到20分钟，报告显示俄罗斯黑客是全球最快的入侵者", "url": "https://www.freebuf.com/news/196230.html", "time": "2019-02-20", "level": "红色标题", "num_look": 207018, "num_comment": 10, "author": "shidongqi", "tags": ["资讯"], "text": "2019年2月19日，美国网络安全技术公司 CrowdStrike 发布了《2019年全球网络安全威胁报告》，其中重点提到了一个关键概念——突破时间（Breakout Time），是指入侵者发起攻击到成功获得系统权限的时间。"}
{"title": "M Tools：移动端rfid校验计算工具", "url": "https://www.freebuf.com/articles/wireless/195515.html", "time": "2019-02-20", "level": "", "num_look": 226597, "num_comment": 7, "author": "devil0x", "tags": ["无线安全"], "text": "Mifare Classic card 提供 1k-4k 的容量，我们经常见到的是 Mifare Classic 1k(S50)，也就是所谓的 M1 卡。"}
{"title": "丰田便携式汽车安全测试台即将上线GitHub", "url": "https://www.freebuf.com/news/196096.html", "time": "2019-02-20", "level": "", "num_look": 96603, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "丰田PASTA首次进入大众视野是在去年BLACK HAT EUROPE 2018大会上，近日丰田宣布最早在下个月通过GitHub提供PASTA工具。"}
{"title": "看我如何通过DNS历史记录绕过防火墙", "url": "https://www.freebuf.com/articles/web/195819.html", "time": "2019-02-20", "level": "", "num_look": 235670, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "今天给大家介绍的是一款帮助大家利用DNS历史记录来实现防火墙绕过的脚本工具，该脚本能够搜索DNS的A记录（历史记录），并判断服务器是否能够响应该域名。对于广大漏洞Hunter来说这绝对是一款非常实用的工具。"}
{"title": "泛终端的精细化智能防御体系建设", "url": "https://www.freebuf.com/articles/terminal/192911.html", "time": "2019-02-20", "level": "现金奖励", "num_look": 2391599, "num_comment": 5, "author": "good1205", "tags": ["终端安全"], "text": "本文探讨如何实现针对网络终端设备的身份明确化、风险度量化、分析智能化和管理可视化的目标。"}
{"title": "平安银行总行零售信息安全岗位招聘", "url": "https://www.freebuf.com/jobs/195869.html", "time": "2019-02-20", "level": "", "num_look": 97090, "num_comment": 7, "author": "平安银行应用安全团队", "tags": ["安全招聘"], "text": "平安银行股份有限公司是总部设在深圳的全国性股份制商业银行，因业务需要招聘安全人才~"}
{"title": "通过RDP隧道绕过网络限制", "url": "https://www.freebuf.com/articles/system/195692.html", "time": "2019-02-20", "level": "金币+6", "num_look": 226235, "num_comment": 1, "author": "tahf", "tags": ["系统安全"], "text": "远程桌面服务是Windows的一个组件，各种公司都使用它来为系统管理员，运维人员和远程员工提供便利。另一方面，远程桌面服务，特别是远程桌面协议（RDP），也同样为网络攻击者提供了便利。"}
{"title": "技术讨论 | 三星Galaxy App商店漏洞导致中间人攻击实现远程代码执行", "url": "https://www.freebuf.com/articles/terminal/195484.html", "time": "2019-02-20", "level": "红色标题", "num_look": 587782, "num_comment": 2, "author": "柏浮锋", "tags": ["终端安全"], "text": "由于商店应用初始更新检查使用HTTP，攻击者在控制网络流量（例如，在网络上实施中间人攻击）的前提下，可以更改用于负载平衡的URL并修改对镜像的请求至用户所控制的域名。"}
{"title": "BUF早餐铺 | 打开这个链接，你的 Facebook 账户就被黑了；网站可检测Chrome用户是否启用了隐私浏览模式；国家计算机病毒应急处理中心公布十款违法移动应用", "url": "https://www.freebuf.com/news/196097.html", "time": "2019-02-20", "level": "", "num_look": 66549, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "国家计算机病毒应急处理中心近期通过互联网监测发现，十款违法有害移动应用存在于移动应用发布平台中，其主要危害涉及隐私窃取、诱骗欺诈、流氓行为和赌博四类。"}
{"title": "Radare2：一款类Unix命令行逆向安全框架", "url": "https://www.freebuf.com/sectool/195703.html", "time": "2019-02-19", "level": "", "num_look": 135535, "num_comment": 135535, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Radare2基于Radare开发，并支持第三方二进制文件以提供更多的实用功能。"}
{"title": "成为物理黑客吧！利用树莓派实现P4wnP1项目进行渗透测试", "url": "https://www.freebuf.com/geek/195631.html", "time": "2019-02-19", "level": "现金奖励", "num_look": 1507643, "num_comment": 15, "author": "Milu。", "tags": ["极客"], "text": "在电影中看到过一个大黑阔从手里掏出了一个U盘，然后噼里啪啦的操作一番，某大BOSS电脑就被打开了。在电脑被破解的那一刻，大家是否也想过，总有一天我能不能也能这样呢？"}
{"title": "快速推进DevOps流程时的安全问题探讨", "url": "https://www.freebuf.com/articles/terminal/195694.html", "time": "2019-02-19", "level": "", "num_look": 132462, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "容器环境从中心化到数字化的转变，正在迅速成为主流。为了快速实现安全性，企业必须加快自身的容器安全策略以及实施的成熟度。"}
{"title": "CNN+BLSTM+CTC的验证码识别从训练到部署", "url": "https://www.freebuf.com/articles/web/195469.html", "time": "2019-02-19", "level": "现金奖励", "num_look": 2690334, "num_comment": 8, "author": "kerlomz", "tags": ["WEB安全"], "text": "验证码是网络安全的一个重要组成部分，提高了暴力尝试破解的成本，而验证码识别是其反面，本文将带领大家看看如何使用深度学习进行验证码的识别。"}
{"title": "滥用ThinkPHP漏洞的僵尸网络Hakai和Yowai", "url": "https://www.freebuf.com/articles/terminal/195498.html", "time": "2019-02-19", "level": "金币+6", "num_look": 112545, "num_comment": 112545, "author": "fengbin8606", "tags": ["终端安全"], "text": "网络犯罪分子正在利用一个在2018年12月被发现和已修补的ThinkPHP漏洞传播Yowai（Mirai变种）和Hakai（Gafgyt变种）两种僵尸网络病毒。"}
{"title": "BUF早餐铺 | 网友微信/支付宝/百度云盘等账号集体被盗，支付宝官方回应；谷歌地图曝光台湾爱国者导弹基地，官方：会与谷歌协商处理；500px千万用户信息泄露", "url": "https://www.freebuf.com/news/196076.html", "time": "2019-02-19", "level": "", "num_look": 126557, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "网友微信/支付宝/百度云盘等账号集体被盗，支付宝官方回应；谷歌地图曝光台湾爱国者导弹基地，官方：会与谷歌协商处理；500px千万用户信息泄露"}
{"title": "Malcom：一款功能强大的图形化恶意软件通信分析工具", "url": "https://www.freebuf.com/sectool/195704.html", "time": "2019-02-18", "level": "", "num_look": 135681, "num_comment": 135681, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Malcom这款工具可分析系统内的网络通信流量，并以图形化的形式将流量分析情况提供给用户，分析结果中将包含已知的恶意软件源，而这些信息将有助于安全研究专家对特定的恶意软件进行分析。"}
{"title": "通过Webshell远程导出域控ntds.dit的方法", "url": "https://www.freebuf.com/articles/web/195709.html", "time": "2019-02-18", "level": "", "num_look": 157460, "num_comment": 4, "author": "secist", "tags": ["WEB安全"], "text": "嗨，大家好！这次我想分享一些与“Windows Active Directory（AD）”环境相关的内容。我将使用Web shell向大家演示“如何转储Windows Active Directory用户数据库”。"}
{"title": "上海擎智信息科技组建安全团队广纳贤才", "url": "https://www.freebuf.com/jobs/195875.html", "time": "2019-02-18", "level": "", "num_look": 117060, "num_comment": 4, "author": "longhuayiyuan", "tags": ["安全招聘"], "text": "公司负责人有着10多年第一线的渗透经验，在各行各业累积了大量的稀缺资源。因为热爱这个行业，想组建一个纯粹简单的安全团队，结合各类资源，至少做出能让自己满意的成绩。"}
{"title": "撕开黑产遮羞布，扼住中国电影发展的岂止一个盗版！", "url": "https://www.freebuf.com/articles/database/195711.html", "time": "2019-02-18", "level": "红色标题", "num_look": 213889, "num_comment": 7, "author": "GEETEST极验", "tags": ["数据安全"], "text": "中国第一部“硬核科幻大片”《流浪地球》上映不到半个月，票房已经超过26亿元，但是近几天，伴随高票房而来的，还有盗版片源、豆瓣评分争议等多起相关事件......."}
{"title": "R3Con1Z3R代码及功能分析", "url": "https://www.freebuf.com/sectool/195496.html", "time": "2019-02-18", "level": "现金奖励", "num_look": 162175, "num_comment": 3, "author": "ERFZE", "tags": ["工具"], "text": "之前Alpha_h4ck分享了一个工具R3Con1Z3R，觉得很不错，虽然代码很简短，但是功能很强大，所以想从代码的角度去解读这个工具，并将它每一部分的功能分析一下。"}
{"title": "2019年唠嗑企业安全（一）", "url": "https://www.freebuf.com/articles/es/195621.html", "time": "2019-02-18", "level": "金币+6", "num_look": 231736, "num_comment": 27, "author": "Mark2019", "tags": ["企业安全"], "text": "如何做好企业安全？笔者最近刚好看了两本不错的书，结合这两本书聊聊自己对企业安全的思路。"}
{"title": "3.83亿人数据泄露中有你的么？万豪国际推出在线查询通道", "url": "https://www.freebuf.com/news/195922.html", "time": "2019-02-18", "level": "", "num_look": 139592, "num_comment": 6, "author": "shidongqi", "tags": ["资讯"], "text": "万豪国际与安全公司OneTrust合作推出了一个信息查询通道，用户需要根据要求填写信息，从而查询自己的信息是否在这次数据泄露中受到影响。"}
{"title": "BUF早餐铺 | 英国议员称Facebook蓄意违反英国隐私法规；京东金融就侵犯隐私致歉；白帽黑客展示了内置Wi-Fi芯片的恶意Lightning数据线", "url": "https://www.freebuf.com/news/195929.html", "time": "2019-02-18", "level": "", "num_look": 74959, "num_comment": 74959, "author": "Karunesh91", "tags": ["资讯"], "text": ""}
{"title": "系统安全之SSH入侵的检测与响应", "url": "https://www.freebuf.com/articles/system/194775.html", "time": "2019-02-17", "level": "现金奖励", "num_look": 300975, "num_comment": 11, "author": "gncao", "tags": ["企业安全", "系统安全"], "text": "之前笔者有一篇介绍了攻防系统的整个环境和搭建方法，这篇文章应该是可以把整个环境搭建完毕的，在这篇文章中还介绍到了课程大纲包含主机安全、web安全、后门/木马等等。"}
{"title": "为Nginx加入一个使用深度学习的软WAF", "url": "https://www.freebuf.com/articles/web/195563.html", "time": "2019-02-17", "level": "金币+6", "num_look": 282182, "num_comment": 11, "author": "rochek", "tags": ["WEB安全"], "text": "本文介绍如何向Nginx增加了一个使用Tensorflow C库的软WAF模块，模块主体基于Naxsi。"}
{"title": "浅谈CSV注入漏洞", "url": "https://www.freebuf.com/vuls/195656.html", "time": "2019-02-17", "level": "现金奖励", "num_look": 280324, "num_comment": 2, "author": "3unshine", "tags": ["漏洞"], "text": "某天在逛expdb时候看到了CSV Injection的exp，在渗透测试的过程中也偶尔会遇到类似的情况，这一漏洞很早之前就出现过。"}
{"title": "蠕虫病毒“RoseKernel”迅速蔓延，政企单位网络易被攻击", "url": "https://www.freebuf.com/articles/paper/195466.html", "time": "2019-02-16", "level": "", "num_look": 146197, "num_comment": 1, "author": "火绒安全", "tags": ["安全报告"], "text": "该病毒可通过远程暴力破解密码等多种手段全网传播。病毒入侵电脑后，会同时执行\"挖矿\"（门罗币）、破坏Windows签名校验机制、传播后门病毒等系列恶意行为。"}
{"title": "Rex：栈溢出之Exploit自动生成", "url": "https://www.freebuf.com/vuls/195514.html", "time": "2019-02-16", "level": "现金奖励", "num_look": 127867, "num_comment": 127867, "author": "xiaohan0x00", "tags": ["漏洞", "系统安全"], "text": "Rex 是由 Shellphish 开发的自动化漏洞利用引擎，设计初衷在于参加 Cyber Grand Challenge。本文以栈溢出为例，展示 Rex 自动生成 Exploit 的能力。"}
{"title": "“暗流II”再次席卷：多玩旗下“游戏盒子”疑遭供应链攻击", "url": "https://www.freebuf.com/articles/paper/195669.html", "time": "2019-02-16", "level": "", "num_look": 105978, "num_comment": 105978, "author": "安全豹", "tags": ["安全报告"], "text": "“暗流”家族作为国内活跃僵尸网络中的佼佼者，专注于流量暗刷攻击，曾经在国内某知名软件公司的“正规”外衣保护下寄生藏身多年。"}
{"title": "超过256万国人数据库“裸奔”半年多，包含人脸识别信息", "url": "https://www.freebuf.com/news/195851.html", "time": "2019-02-15", "level": "红色标题", "num_look": 338798, "num_comment": 5, "author": "shidongqi", "tags": ["资讯"], "text": "日前，GDI基金会荷兰安全研究员Victor Gevers在推特上公布一条消息称，国内一家面部识别公司的数据库暴露在网上，且无密码保护，其中包含超过256万人的重要信息，包括人脸数据。"}
{"title": "AlienVault-OTX及OTX Endpoint Security使用及介绍", "url": "https://www.freebuf.com/news/195452.html", "time": "2019-02-15", "level": "金币+8", "num_look": 148792, "num_comment": 148792, "author": "scanner", "tags": ["网络安全", "资讯"], "text": "AlienVault开放威胁交换(OTX)是全球权威的开放威胁信息共享和分析网络。OTX提供了一个由威胁研究人员和安全专业人员组成的全球社区。"}
{"title": "如何使用DNS和SQLi从数据库中获取数据样本", "url": "https://www.freebuf.com/articles/database/195470.html", "time": "2019-02-15", "level": "", "num_look": 121249, "num_comment": 121249, "author": "secist", "tags": ["数据安全"], "text": "本文我将为大家介绍一些利用SQL盲注从DB服务器枚举和泄露数据的技术。"}
{"title": "你的微信账号“多少钱一斤”？", "url": "https://www.freebuf.com/news/195830.html", "time": "2019-02-15", "level": "", "num_look": 71854, "num_comment": 71854, "author": "Karunesh91", "tags": ["资讯"], "text": "多年以前，买卖QQ账号算得上是一件路人皆知的事情。在黑产日益猖獗的今天，微信号也难逃“黑手”。"}
{"title": "挖洞经验丨看我如何挖到多个D-LINK高危漏洞", "url": "https://www.freebuf.com/vuls/195309.html", "time": "2019-02-15", "level": "", "num_look": 208278, "num_comment": 3, "author": "奇安信代码卫士", "tags": ["漏洞", "终端安全"], "text": "近期，安全研究人员发现友讯(D-LINK)公司旗下产品系列DIR-619、DIR-605系列路由器的两个高危安全漏洞，并第一时间向友讯(D-LINK)公司汇报，协助其修复漏洞。"}
{"title": "小米M365电动滑板车面临黑客攻击和远程控制风险", "url": "https://www.freebuf.com/news/195635.html", "time": "2019-02-15", "level": "", "num_look": 182500, "num_comment": 6, "author": "Freddy", "tags": ["资讯"], "text": "来自国外的研究人员日前透露，小米M365电动滑板车存在严重设计缺陷，黑客能够在100米的距离内接管其刹车和加速功能。"}
{"title": "坚持不懈：历时一年的Cissp备考之路", "url": "https://www.freebuf.com/articles/others-articles/195497.html", "time": "2019-02-15", "level": "金币+8", "num_look": 482658, "num_comment": 21, "author": "Myhawk", "tags": ["其他"], "text": "我在准备了一年左右的时间后，2019年1月末，飞行2000公里，从银川到上海参加了Cissp认证考试。经过将近6个小时的高强度考试后，考官将打印的成绩递给我:“恭喜，xxxx”，一次性通过！"}
{"title": "BUF早餐铺 | UbuntuSnap软件包存在漏洞，允许攻击者获得系统Root权限；联想Watch X智能手表存在安全隐患；美国炸弹威胁恶作剧导致数百所学校撤离，两名涉事黑客遭指控", "url": "https://www.freebuf.com/news/195719.html", "time": "2019-02-15", "level": "", "num_look": 77808, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "安全研究员Chris Moberly在Canonical的REST API中发现了一个漏洞，snapd守护程序可允许攻击者获取Linux系统的root访问权限。"}
{"title": "LightBulb：一个用于审计web应用程序防火墙的开源框架", "url": "https://www.freebuf.com/sectool/195421.html", "time": "2019-02-14", "level": "", "num_look": 117241, "num_comment": 117241, "author": "secist", "tags": ["工具"], "text": "LightBulb是一个基于python的，用于审计web应用程序防火墙和过滤器的开源框架。"}
{"title": "沙特利用APP监控女性出境，苹果、谷歌被指为帮凶", "url": "https://www.freebuf.com/news/195762.html", "time": "2019-02-14", "level": "红色标题", "num_look": 143520, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "一名十八岁的沙特少女 Rahaf Mohammed 声称遭受家人虐待而逃离到了泰国，这件事引发了全球多方的关注，甚至连谷歌、苹果也受到外界抨击。"}
{"title": "Silence组织使用恶意CHM文档攻击俄罗斯银行", "url": "https://www.freebuf.com/articles/network/195373.html", "time": "2019-02-14", "level": "", "num_look": 120477, "num_comment": 120477, "author": "周大涛", "tags": ["网络安全"], "text": "在2018年11月，我们跟进了一条推文，提到在CHM中传播的潜在恶意代码（Microsoft Compiled HTML Help），引起了我们的威胁分析和情报团队的注意。"}
{"title": "百度云招聘安全人才", "url": "https://www.freebuf.com/jobs/194343.html", "time": "2019-02-14", "level": "", "num_look": 190555, "num_comment": 10, "author": "helloliuxm", "tags": ["安全招聘"], "text": "百度云秉承“用科技力量推动社会创新”的愿景，不断将百度在云计算、大数据、人工智能的技术能力向社会输出。"}
{"title": "同一团伙还是栽赃嫁祸？丨“驱动人生”劫持事件与Mykings家族活动的关联分析", "url": "https://www.freebuf.com/articles/system/195337.html", "time": "2019-02-14", "level": "红色标题", "num_look": 127548, "num_comment": 2, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "近期劫持“驱动人生”的挖矿蠕虫再次活跃，在分析团伙的新活动时还发现了一些涉及到Mykings家族活动的现象。"}
{"title": "Angr AEG：堆溢出之Exploit自动生成", "url": "https://www.freebuf.com/vuls/194619.html", "time": "2019-02-14", "level": "现金奖励", "num_look": 169543, "num_comment": 4, "author": "xiaohan0x00", "tags": ["漏洞", "系统安全"], "text": "本文主要介绍如何基于 Angr 进行漏洞挖掘，并自动生成 Exploit。"}
{"title": "某疑似针对中东地区的APT攻击事件分析", "url": "https://www.freebuf.com/articles/web/195481.html", "time": "2019-02-14", "level": "", "num_look": 145124, "num_comment": 1, "author": "小河西村安全研究所", "tags": ["WEB安全"], "text": "该样本文档显示的内容是一份海事卫星设备(Inmarsat IsatPhone)清单。样本触发漏洞后，连接远程服务器获取下发指令。"}
{"title": "BUF早餐铺 | 微软产品七成漏洞是内存安全问题；瑞士电子投票系统邀请黑客来寻找漏洞，总奖金达到15万美元", "url": "https://www.freebuf.com/news/195688.html", "time": "2019-02-14", "level": "", "num_look": 54612, "num_comment": 54612, "author": "shidongqi", "tags": ["资讯"], "text": "值此情人佳节，愿天下有情人都不是兄妹。"}
{"title": "CNNVD关于微软多个安全漏洞的通报", "url": "https://www.freebuf.com/news/195666.html", "time": "2019-02-13", "level": "", "num_look": 102717, "num_comment": 102717, "author": "CNNVD", "tags": ["资讯"], "text": "近日，微软官方发布了多个安全漏洞的公告，包括Microsoft Office 安全功能绕过漏洞、Windows 脚本引擎内存损坏漏洞、Microsoft SharePoint 远程执行代码漏洞等多个漏洞。"}
{"title": "记一次微信数据库解密过程", "url": "https://www.freebuf.com/articles/terminal/195107.html", "time": "2019-02-13", "level": "现金奖励", "num_look": 839498, "num_comment": 25, "author": "西红柿炒鸡蛋bb", "tags": ["终端安全"], "text": "本文主要记录手动解密微信数据库的过程，思路仅供参考~"}
{"title": "2018年ASRC邮件安全年度分析", "url": "https://www.freebuf.com/articles/paper/195180.html", "time": "2019-02-13", "level": "", "num_look": 100941, "num_comment": 100941, "author": "softnext守内安", "tags": ["安全报告"], "text": "我们将针对2018年邮件安全相关事件与统计，进行重点回顾。"}
{"title": "威胁快报 | 首爆新型ibus蠕虫利用热门漏洞疯狂挖矿牟利", "url": "https://www.freebuf.com/vuls/195489.html", "time": "2019-02-13", "level": "", "num_look": 183906, "num_comment": 3, "author": "阿里云安全", "tags": ["漏洞"], "text": "近日阿里云安全团队发现了一起利用多个流行漏洞传播的蠕虫事件，涉及的漏洞除了ThinkPHP远程命令执行漏洞，还有JBoss、Weblogic、Redis等产品的漏洞。"}
{"title": "全流程信息收集方法总结", "url": "https://www.freebuf.com/articles/database/195169.html", "time": "2019-02-13", "level": "现金奖励", "num_look": 692647, "num_comment": 7, "author": "Jokong", "tags": ["数据安全", "网络安全"], "text": "信息收集是指通过各种方式获取所需要的信息，以便我们在后续的渗透过程更好的进行。最简单的比如说目标站点的IP、中间件、脚本语言、端口、邮箱等等。"}
{"title": "在Linux下烧录51单片机", "url": "https://www.freebuf.com/geek/194965.html", "time": "2019-02-13", "level": "现金奖励", "num_look": 211760, "num_comment": 7, "author": "LEdge1", "tags": ["极客"], "text": "我一直在学习Linux 系统，但是最近还要学习51单片机，所以在Linux下给51单片机烧录程序那是非常必要的。"}
{"title": "BUF早餐铺 | 俄罗斯测试脱离国际互联网；WordPress曝出插件漏洞，允许任何用户接管网站；黑客正在测试感染Mac的新方法", "url": "https://www.freebuf.com/news/195580.html", "time": "2019-02-13", "level": "", "num_look": 64626, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "俄罗斯议会去年 12 月引入了一项法律草案，要求该国 ISP 必须确保俄罗斯网际空间的独立性，以防万一外国侵略导致俄罗斯的网络与其它互联网分离。"}
{"title": "rtfraptor：从恶意RTF文件中提取OLEv1对象的工具", "url": "https://www.freebuf.com/sectool/194589.html", "time": "2019-02-12", "level": "", "num_look": 95848, "num_comment": 95848, "author": "周大涛", "tags": ["工具"], "text": "rtfraptor是一个简单的工具，通过提取OLEv1对象分析恶意RTF文件。它的工作原理是运行Word并拦截对OLEv1函数的调用。"}
{"title": "16家国外网站近6.2亿用户信息被挂暗网出售", "url": "https://www.freebuf.com/news/195568.html", "time": "2019-02-12", "level": "红色标题", "num_look": 171430, "num_comment": 3, "author": "Freddy", "tags": ["资讯"], "text": "近日，一个名为Dream Market暗网市场上挂出了6.2亿用户信息，交易通过比特币转账进行，打包售价不高于2万美元，该卖家宣称这些数据来自16个被攻击的网站。"}
{"title": "华福证券有限责任公司安全技术岗招聘", "url": "https://www.freebuf.com/jobs/195551.html", "time": "2019-02-12", "level": "", "num_look": 86346, "num_comment": 5, "author": "longhuayiyuan", "tags": ["安全招聘"], "text": "华福证券前身为福建省华福证券公司，成立于1988年6月，是我国首批成立的证券公司之一。"}
{"title": "我所了解的物联网设备渗透测试手段（硬件篇）", "url": "https://www.freebuf.com/articles/wireless/195129.html", "time": "2019-02-12", "level": "现金奖励", "num_look": 370345, "num_comment": 2, "author": "Yale1024", "tags": ["无线安全", "网络安全"], "text": "物联网关键的在于“网”这个字，万物互联，靠的就是“网”，至于这个“网”，实现的方式多种多样，这也是前些年的物联网的“碎片化“问题的一部分原因。"}
{"title": "简记野生应急捕获到的siteserver远程模板下载Getshell漏洞", "url": "https://www.freebuf.com/articles/web/195105.html", "time": "2019-02-12", "level": "现金奖励", "num_look": 258236, "num_comment": 10, "author": "1u0hun", "tags": ["WEB安全"], "text": "小明同学在某个神清气朗的周六接到来自上级的应急任务，本次任务详情为对某个网站黑链安全攻击事件进行溯源，找到攻击路径，找出幕后真凶，然而，一场意外的事情才刚刚开始……"}
{"title": "2018年Windows漏洞年度盘点丨老漏洞经久不衰，新0day层出不穷", "url": "https://www.freebuf.com/news/195195.html", "time": "2019-02-12", "level": "", "num_look": 207895, "num_comment": 1, "author": "腾讯电脑管家", "tags": ["网络安全", "资讯"], "text": "漏洞是影响网络安全的重要因素，而漏洞攻击作为恶意攻击的最常用手段，更是有着目标行业化、手段多样化的趋势，不论是个人还是企业，都面临着严峻的漏洞威胁。"}
{"title": "由一张小票引起的联想", "url": "https://www.freebuf.com/articles/web/195414.html", "time": "2019-02-12", "level": "现金奖励", "num_look": 552061, "num_comment": 20, "author": "delectate", "tags": ["WEB安全"], "text": "日前逛煎蛋网，看到站长抱怨他买的东西，小票上的电子发票竟然没有二维码，而是一个URL明文，因此就有了一些想法。"}
{"title": "2018年信息安全大事件一览", "url": "https://www.freebuf.com/news/195216.html", "time": "2019-02-11", "level": "", "num_look": 482048, "num_comment": 3, "author": "知道创宇", "tags": ["资讯"], "text": "在网络安全环境和形势的持续变化中，如何切实有效的制定安全策略，构建出由内而外的安全生态体系，形成各环节协同高效的主动防护能力，变得至关重要。"}
{"title": "2018年云上挖矿分析报告", "url": "https://www.freebuf.com/articles/paper/195175.html", "time": "2019-02-11", "level": "", "num_look": 97714, "num_comment": 97714, "author": "阿里云安全", "tags": ["安全报告"], "text": "报告以阿里云2018年的攻防数据为基础，对恶意挖矿态势进行了分析，并为个人和企业提出了合理的安全防护建议。"}
{"title": "ES文件浏览器CVE-2019-6447漏洞分析", "url": "https://www.freebuf.com/vuls/195069.html", "time": "2019-02-10", "level": "金币+8", "num_look": 166388, "num_comment": 3, "author": "xcy_merlin", "tags": ["漏洞"], "text": "ES文件浏览器在启动时创建了一个HTTP服务器，在本地打开了59777端口。攻击者通过构造指定的payload可以获取用户手机文件，安装apk等操作。"}
{"title": "暗云III v3.0 、Mykings、Mirai多个病毒家族结伴来袭的实战分析", "url": "https://www.freebuf.com/vuls/194515.html", "time": "2019-02-10", "level": "金币+8", "num_look": 180681, "num_comment": 5, "author": "xuchen16", "tags": ["漏洞", "系统安全"], "text": "MyKings是一个大规模多重僵尸网络，并安装门罗币挖矿机，利用服务器资源挖矿。"}
{"title": "疑似DarkHydrus APT组织针对中东地区的定向攻击活动分析", "url": "https://www.freebuf.com/articles/system/194556.html", "time": "2019-02-09", "level": "", "num_look": 98957, "num_comment": 1, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "该后门程序利用了复杂的DNS隧道技术与C2进行通信并执行指令，且通过GoogleDrive API实现文件的上传下载。"}
{"title": "“三英战吕布”，看我如何抓出那些流氓APP", "url": "https://www.freebuf.com/articles/terminal/194708.html", "time": "2019-02-09", "level": "", "num_look": 141048, "num_comment": 7, "author": "TopSec123", "tags": ["数据安全", "终端安全"], "text": "忽然之间，APP获取隐私成为了热门，究竟我们常用的APP需要申请了多少权限？哪家的APP申请的权限更多？对此我们准备做一下调查，让大家真正的了解谁才是恶人。"}
{"title": "从PowerShell内存转储中提取执行的脚本内容", "url": "https://www.freebuf.com/articles/system/195334.html", "time": "2019-02-08", "level": "", "num_look": 120216, "num_comment": 1, "author": "周大涛", "tags": ["系统安全"], "text": "是否可以从PowerShell流程转储中提取已执行的脚本（来自磁盘）的内容，即使这些文件未被捕获？"}
{"title": "Java Web安全之代码审计", "url": "https://www.freebuf.com/articles/web/194836.html", "time": "2019-02-08", "level": "", "num_look": 380128, "num_comment": 5, "author": "安百科技", "tags": ["WEB安全"], "text": "信息安全的75%发生在Web应用而非网络层。本文内容主要以Java Web安全-代码审计为中心展开。"}
{"title": "从Linux到Windows的PowerShell远程处理", "url": "https://www.freebuf.com/articles/system/195166.html", "time": "2019-02-07", "level": "", "num_look": 167043, "num_comment": 2, "author": "周大涛", "tags": ["系统安全"], "text": "本文将逐步介绍如何从Linux客户端到Windows目标建立远程PowerShell会话。"}
{"title": "利用Python开发Burp Suite插件（三）", "url": "https://www.freebuf.com/articles/web/196083.html", "time": "2019-02-07", "level": "", "num_look": 98501, "num_comment": 98501, "author": "锋之刃安全团队", "tags": ["WEB安全"], "text": "上一篇我们实现了在每一个参数后面添加单引号，这次会在每个参数后面插入大量 sql 注入检测参数，并且通过接口类获取发送的请求数据和接收响应数据，根据响应数据判断 sql 注入漏洞是否存在。"}
{"title": "suricata下的挖矿行为检测", "url": "https://www.freebuf.com/articles/network/195171.html", "time": "2019-02-07", "level": "现金奖励", "num_look": 235966, "num_comment": 2, "author": "charm1y", "tags": ["网络安全"], "text": "随着加密货币的出现以及带来的实际收益，挖矿木马成为黑产团伙的主要获利方式之一，也成为了企业内部安全的主要威胁之一。"}
{"title": "他山之石 | 对 XSS 的一次深入分析认识", "url": "https://www.freebuf.com/articles/web/195507.html", "time": "2019-02-06", "level": "", "num_look": 216901, "num_comment": 2, "author": "clouds", "tags": ["WEB安全"], "text": "长期以来，XSS漏洞算是非常常见的安全问题，以至于对大多数人来说，即使一个新的XSS漏洞被披露，但从内心来说，早已习已为常。"}
{"title": "挖洞经验 | 看我如何通过ASP Secrets读取获得了1.7万美金的漏洞奖励", "url": "https://www.freebuf.com/vuls/194997.html", "time": "2019-02-06", "level": "", "num_look": 117392, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["WEB安全", "漏洞"], "text": "在这篇文章中，我将跟大家介绍我如何利用LFD来渗透一个应用程序，并最终拿到了1.7万美金的漏洞奖励。"}
{"title": "小学数学破解滑动拼图验证码", "url": "https://www.freebuf.com/articles/web/194628.html", "time": "2019-02-06", "level": "", "num_look": 544434, "num_comment": 10, "author": "山东星维九州安全技术有限公司", "tags": ["WEB安全"], "text": "近几年出现了很多新型验证码，在用户体验上完爆传统的字符图片验证码，而滑动验证码又是最常用的新型验证码之一，那么它的安全性如何呢？"}
{"title": "Windows-Kernel-Explorer : 免费但功能强大的Windows内核研究工具", "url": "https://www.freebuf.com/sectool/194767.html", "time": "2019-02-05", "level": "", "num_look": 185180, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Windows Kernel Explorer（你可以称其为“WKE”）是一款免费但功能强大的Windows内核研究工具。"}
{"title": "大年初一，红包外挂装好了吗？", "url": "https://www.freebuf.com/articles/database/195363.html", "time": "2019-02-05", "level": "", "num_look": 156491, "num_comment": 8, "author": "GEETEST极验", "tags": ["数据安全"], "text": "他们说像我手气这么差应该赶紧找个“红包外挂”加持。可是，这玩意真的有用吗？"}
{"title": "如何使用免费的威胁情报源建设SIEM", "url": "https://www.freebuf.com/articles/web/194806.html", "time": "2019-02-04", "level": "", "num_look": 153411, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "全世界的安全研究专家们经常都需要对恶意软件来进行逆向工程分析，这样才能更加清楚地了解到网络攻击者的攻击方式以及真正意图。"}
{"title": "电信、百度客户端源码疑遭泄漏，驱魔家族窃取隐私再起波澜", "url": "https://www.freebuf.com/articles/system/195274.html", "time": "2019-02-04", "level": "现金奖励", "num_look": 128073, "num_comment": 3, "author": "安全豹", "tags": ["系统安全"], "text": "“驱魔”家族被曝光披露以后，其幕后团队并没有停止传播和病毒功能的迭代，近期再次监控到其推送”电商暗刷模块”的更新变种。"}
{"title": "挖洞经验 | 印度餐饮点评网Zomato的Reflected XSS漏洞", "url": "https://www.freebuf.com/vuls/194791.html", "time": "2019-02-03", "level": "", "num_look": 119773, "num_comment": 119773, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "今天要分享的是印度美食搜索点评网站Zomato的一个反射型XSS漏洞（$250），文中作者详细描述了具体的漏洞发现过程。"}
{"title": "百度开源项目OpenRASP快速上手指南", "url": "https://www.freebuf.com/articles/web/195300.html", "time": "2019-02-03", "level": "金币+8", "num_look": 162628, "num_comment": 3, "author": "陆仁甲", "tags": ["WEB安全"], "text": "这是一篇关于Openrasp的快速上手指南，既然是快速，相信大家看完之后在1个小时之内就能安装部署到位。"}
{"title": "挖洞经验 | GitHub Desktop 在OSX系统下的RCE漏洞", "url": "https://www.freebuf.com/vuls/194579.html", "time": "2019-02-02", "level": "", "num_look": 117500, "num_comment": 117500, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "我发现了GitHub Desktop程序在OSX系统下的一个远程代码执行（RCE）漏洞，但却被认定为超出测试范围！但最终，我也获得了GitHub官方的不菲赏金。"}
{"title": "创新不止，安全同行 | 斗象科技2018年度大事记", "url": "https://www.freebuf.com/news/195296.html", "time": "2019-02-02", "level": "", "num_look": 51401, "num_comment": 1, "author": "FB独家", "tags": ["企业资讯", "资讯"], "text": "一张图回顾斗象科技（FreeBuf所属公司）不平凡的2018"}
{"title": "FaceBook被曝公然付费购买用户信息，流量面前还有隐私吗？", "url": "https://www.freebuf.com/news/195381.html", "time": "2019-02-02", "level": "", "num_look": 104466, "num_comment": 3, "author": "AngelaY", "tags": ["数据安全", "资讯"], "text": "自2016年以来，FaceBook每月秘密付费给用户，要求用户安装名为“FaceBook Research”的VPN，以便搜集用户在手机或网页上的活动，获取隐私信息。"}
{"title": "asnlookup.py：用于搜索特定组织的 ASN 和拥有的 IP 地址工具", "url": "https://www.freebuf.com/sectool/194590.html", "time": "2019-02-01", "level": "", "num_look": 126678, "num_comment": 1, "author": "周大涛", "tags": ["工具"], "text": "ASN是由互联网号码分配机构（IANA）分配给自治系统（AS）的唯一号码。 AS由IP地址块组成，这些IP地址具有明确定义的用于访问外部网络的策略。"}
{"title": "挖洞经验 | 如何利用postMessage窃取编辑用户的Cookie信息", "url": "https://www.freebuf.com/vuls/194714.html", "time": "2019-02-01", "level": "", "num_look": 175349, "num_comment": 175349, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "某天，当我在做某个项目的漏洞测试时，在登录的一些HTTP请求记录中，我发现了一种利用postMessage方式窃取和编辑用户Cookie的方法。"}
{"title": "2019中通SRC诚招各类安全人才", "url": "https://www.freebuf.com/jobs/195375.html", "time": "2019-02-01", "level": "", "num_look": 74514, "num_comment": 1, "author": "ZTO_Misaki", "tags": ["安全招聘"], "text": "中通快递信息安全部以保障上亿客户以及合作伙伴的利益为前提，通过长期的信息安全管理建设，已经搭建起一整套的信息安全管理基础、制度与人才体系。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列-Rachel Tobac", "url": "https://www.freebuf.com/video/195473.html", "time": "2019-02-01", "level": "红色标题", "num_look": 71043, "num_comment": 71043, "author": "willhuang", "tags": ["视频"], "text": "Rachel Tobac，用户体验研究者和社工黑客，曾是社会工程安全测试公司SocialProof Security联合创始人兼CEO，现为公益团队“信息安全和隐私界妇女组织”负责人和在线教育平台Course Hero高级用户体验专家"}
{"title": "DDG僵尸挖矿样本v3016技术分析", "url": "https://www.freebuf.com/articles/network/194845.html", "time": "2019-02-01", "level": "现金奖励", "num_look": 97530, "num_comment": 1, "author": "云影实验室", "tags": ["网络安全"], "text": "与其上一版本相比，3016采用了新的分布式框架Memberlist来构建僵尸网络。基于该框架，DDG僵尸网络可以更稳定的实现C2去中心化，以及更灵活的管理和扩展集群。"}
{"title": "图文详解Google缘何遭“5000万欧元罚单滑铁卢”", "url": "https://www.freebuf.com/news/195072.html", "time": "2019-02-01", "level": "金币+8", "num_look": 102284, "num_comment": 102284, "author": "普华永道赛博星人", "tags": ["数据安全", "资讯"], "text": "业界都在密切关注Google因违反GDPR遭法国CNIL重罚的新闻，然而，Google遭重罚的深层原因究竟是什么？如何从法律、监管机构、以及市场等多个角度分析CNIL此次行为的原因？大型跨国企业如何避免类似处罚？"}
{"title": "活活将黑产搞崩溃的教务系统，你的母校可能在列", "url": "https://www.freebuf.com/articles/system/195181.html", "time": "2019-02-01", "level": "", "num_look": 191653, "num_comment": 15, "author": "GEETEST极验", "tags": ["系统安全"], "text": "院校政府网站一直是黑产眼中的金矿，但作为高校教务系统重要一环，选课系统却鲜有黑产惦记。这背后到底有哪些鲜为人知的故事呢？"}
{"title": "BUF早餐铺 | 谷歌违规收集用户数据；iCloud曾出现隐私泄露漏洞，但被苹果隐瞒；Ubuntu 18.04 修复 Linux 内核的 11 个漏洞", "url": "https://www.freebuf.com/news/195460.html", "time": "2019-02-01", "level": "", "num_look": 75024, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "二月，你好！"}
{"title": "微软Exchange爆出0day漏洞，来看POC和技术细节", "url": "https://www.freebuf.com/vuls/195162.html", "time": "2019-01-31", "level": "", "num_look": 193219, "num_comment": 1, "author": "奇安信代码卫士", "tags": ["漏洞", "系统安全"], "text": "微软Exchange似乎易受权限提升攻击影响，任何用户，只要有邮箱，就能变身为Domain Admin。"}
{"title": "研究人员发现了一种读取加密数据的新型侧信道攻击", "url": "https://www.freebuf.com/articles/system/194972.html", "time": "2019-01-31", "level": "", "num_look": 100058, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "研究人员发现一种能够读取加密数据的新型侧信道攻击技术，针对的是操作系统，而不是芯片，而且这种技术将有可能成为网络犯罪分子获取目标公司加密技术的关键。"}
{"title": "2019年深信服安服业务大规模招兵买马", "url": "https://www.freebuf.com/jobs/194866.html", "time": "2019-01-31", "level": "", "num_look": 129408, "num_comment": 6, "author": "suifeng-刘军", "tags": ["安全招聘"], "text": "深信服是国内最大的企业级安全厂商之一，致力于提供创新的网络安全建设解决方案"}
{"title": "快讯丨LinkedIn出现重大数据泄露事件，1.59亿用户数据遭窃", "url": "https://www.freebuf.com/news/195406.html", "time": "2019-01-31", "level": "红色标题", "num_look": 175517, "num_comment": 6, "author": "Karunesh91", "tags": ["数据安全", "资讯"], "text": "LinkedIn出现重大数据泄露事件，涉及用户1.59亿。"}
{"title": "瑞星2018年中国网络安全报告", "url": "https://www.freebuf.com/articles/paper/194644.html", "time": "2019-01-31", "level": "", "num_look": 148788, "num_comment": 2, "author": "瑞星", "tags": ["安全报告"], "text": "由于利益的驱使，更多领域的犯罪分子投入到了挖矿病毒与勒索病毒领域，同时，病毒与杀毒软件的对抗越来越激烈，攻击者持续更新迭代病毒，导致病毒有了极大的增长。"}
{"title": "君哥谈企业安全“最后一公里”｜FreeBuf壹元公益课", "url": "https://www.freebuf.com/fevents/195353.html", "time": "2019-01-31", "level": "红色标题", "num_look": 114719, "num_comment": 2, "author": "FB客服", "tags": ["FreeBuf公开课", "活动"], "text": "FreeBuf公开课年终重磅课程，“君哥的体历”壹元公开课公益分享企业安全“最后一公里”"}
{"title": "安卓手机NFC模拟门禁卡（设置UID）的一种方法", "url": "https://www.freebuf.com/geek/195112.html", "time": "2019-01-31", "level": "现金奖励", "num_look": 1137597, "num_comment": 6, "author": "新希望鲜牛奶", "tags": ["极客"], "text": "本文通过对Android源码中NFC部分的简单分析，实现了另外一种设置UID的方式，可用于部分场景下的门禁卡模拟。"}
{"title": "“如果可以，我愿意用隐私换一张回家的车票……”", "url": "https://www.freebuf.com/articles/neopoints/195395.html", "time": "2019-01-31", "level": "红色标题", "num_look": 689467, "num_comment": 10, "author": "shidongqi", "tags": ["观点"], "text": "有时候并非花钱去购买那1%的可能性，更多的买的是心里的安慰，一种期待回家过年的渴望。至于隐私，等先过完年再说吧……"}
{"title": "鑫哥木马劫持超60家网吧及9所大学的电脑", "url": "https://www.freebuf.com/articles/network/195140.html", "time": "2019-01-31", "level": "", "num_look": 149769, "num_comment": 5, "author": "360安全", "tags": ["网络安全"], "text": "一款会利用篡改网络设置、劫持客户端网络数据、监控QQ聊天等方式窃取用户的隐私的木马最近在国内传播。"}
{"title": "BUF早餐铺 | FaceBook每月付费收集用户隐私信息；2018年黑客窃取加密货币价值达17亿美元；警方关闭网络犯罪市场xDedic", "url": "https://www.freebuf.com/news/195388.html", "time": "2019-01-31", "level": "", "num_look": 59642, "num_comment": 59642, "author": "AngelaY", "tags": ["资讯"], "text": "取缔全球最大DDoS服务网站后，Europol开始向151000名注册用户追责；AV-TEST公布最新Windows 10安全软件产品排名"}
{"title": "Sitadel：一款功能强大的Web应用扫描器", "url": "https://www.freebuf.com/sectool/194769.html", "time": "2019-01-30", "level": "", "num_look": 184290, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Sitadel实际上是WAScan的升级版，不过是Python版本（>= 3.4）的，这样有助于研究人员根据自己的需要去进行自定义开发，并引入新的功能模块。"}
{"title": "年末将至，Mirai挖矿致使机器不休假", "url": "https://www.freebuf.com/articles/terminal/194818.html", "time": "2019-01-30", "level": "", "num_look": 94503, "num_comment": 94503, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "近日，深信服安全团队基于SIP产品在国内发现一种新型的Mirai变种，该变种会进行门罗币挖矿并且通过SSH爆破来实现传播。"}
{"title": "到底是谁泄露了我炒币的信息？", "url": "https://www.freebuf.com/articles/database/194921.html", "time": "2019-01-30", "level": "", "num_look": 145133, "num_comment": 4, "author": "BUGX", "tags": ["区块链安全", "数据安全"], "text": "炒币频频泄露身份信息，这究竟是人性的扭曲，还是道德的沦丧？"}
{"title": "GDPR重点条例分析", "url": "https://www.freebuf.com/articles/network/194850.html", "time": "2019-01-30", "level": "现金奖励", "num_look": 313413, "num_comment": 313413, "author": "LJ_Monica", "tags": ["安全管理", "网络安全"], "text": "GDPR实施后，引起了轩然大波，一些科技巨头公司纷纷被控诉举报违反GDPR，遭到罚款处罚。本文主要是结合条例和日常工作，做一个简单的分析总结。"}
{"title": "FourAndSix2.01靶机渗透", "url": "https://www.freebuf.com/articles/web/194783.html", "time": "2019-01-30", "level": "", "num_look": 191194, "num_comment": 4, "author": "周大涛", "tags": ["WEB安全"], "text": "最近在乡下，网太慢了，只能玩玩靶机。在此献上一篇靶机渗透教程。"}
{"title": "BUF早餐铺 | 日本政府授权工作人员未经授权登录物联网设备；德国电信警告：禁止华为将阻碍欧洲5G发展；暴雪导致堪萨斯谷歌光纤服务断网两周", "url": "https://www.freebuf.com/news/195347.html", "time": "2019-01-30", "level": "", "num_look": 60179, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "德国电信的高管警告称，如果将华为从5G网络供应商中排除的话，将会导致该技术的发展至少延误两年。"}
{"title": "苹果曝出FaceTime电话窃听漏洞，本周将修复", "url": "https://www.freebuf.com/news/195316.html", "time": "2019-01-29", "level": "", "num_look": 67088, "num_comment": 67088, "author": "AngelaY", "tags": ["资讯"], "text": "苹果FaceTime存在一个重大漏洞，如果通过FaceTime打电话给别人，可利用这个漏洞，在对方接听或拒绝来电之前，立即通过手机监听对方。"}
{"title": "dive：一款按层分析docker镜像的工具", "url": "https://www.freebuf.com/sectool/191596.html", "time": "2019-01-29", "level": "", "num_look": 148065, "num_comment": 148065, "author": "周大涛", "tags": ["工具"], "text": "这是一款用于分析docker镜像、图层内容以及探索缩小Docker镜像大小的方法的工具。"}
{"title": "Tool-X：在AndroidUbuntu平台安装Kali的各种小工具", "url": "https://www.freebuf.com/sectool/194584.html", "time": "2019-01-29", "level": "", "num_look": 245931, "num_comment": 7, "author": "secist", "tags": ["工具"], "text": "Tool-X是一个由python编写的用于安装kali linux黑客工具的安装程序。"}
{"title": "企业安全建设之HIDS", "url": "https://www.freebuf.com/articles/es/194510.html", "time": "2019-01-29", "level": "现金奖励", "num_look": 481574, "num_comment": 7, "author": "罹♛殇", "tags": ["企业安全"], "text": "我们要坚持每天学习， 慢慢的熬，熬到大佬们都退了休，都转了行，我们就是独当一面的扛把子，一个二十年不够，那就再来一个二十年 ~~~"}
{"title": "全球能源互联网研究院有限公司诚招网络安全人才", "url": "https://www.freebuf.com/jobs/194779.html", "time": "2019-01-29", "level": "", "num_look": 179596, "num_comment": 8, "author": "secsgri", "tags": ["安全招聘"], "text": "全球能源互联网研究院有限公司是国家电网公司直属科研单位，国内首家专业从事全球能源互联网关键技术和设备开发的高端研发机构。"}
{"title": "保障IDC安全：分布式HIDS集群架构设计", "url": "https://www.freebuf.com/articles/terminal/194807.html", "time": "2019-01-29", "level": "", "num_look": 151764, "num_comment": 4, "author": "美团技术团队", "tags": ["终端安全"], "text": "在HIDS面对几十万台甚至上百万台规模的IDC环境时，系统架构该如何设计呢？复杂的服务器环境，网络环境，巨大的数据量给我们带来了哪些技术挑战呢？"}
{"title": "Web渗透实验：基于Weblogic的一系列漏洞", "url": "https://www.freebuf.com/vuls/194811.html", "time": "2019-01-29", "level": "现金奖励", "num_look": 876555, "num_comment": 16, "author": "绿帽子技术分享", "tags": ["WEB安全", "漏洞"], "text": "双休刚刚过去，利用假期2天时间成功上了个王者，变成了好友第一，美滋滋，什么时候能成为渗透技术第一就好了。"}
{"title": "微信多平台低版本漏洞之MMTLS绕过PC也能抢红包", "url": "https://www.freebuf.com/vuls/193984.html", "time": "2019-01-29", "level": "现金奖励", "num_look": 277194, "num_comment": 5, "author": "C位金龟儿子", "tags": ["漏洞", "终端安全"], "text": "在游戏领域这个漏洞的现象属实是属于BUG，但开发人员在完善自身产品的同时也要像那些大厂来学习，于是有了本文的研究。"}
{"title": "BUF早餐铺丨安全机构abuse.ch公布近10万个恶意网站；日本政府计划“入侵”公民的物联网设备；PEAR PHP成为最新的供应链攻击受害者", "url": "https://www.freebuf.com/news/195246.html", "time": "2019-01-29", "level": "", "num_look": 64868, "num_comment": 3, "author": "Karunesh91", "tags": ["资讯"], "text": "新年将近，回家的票都买好了吗~"}
{"title": "警惕！GandCrab 5.1来袭", "url": "https://www.freebuf.com/articles/terminal/194995.html", "time": "2019-01-29", "level": "", "num_look": 159112, "num_comment": 159112, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "近日，深信服EDR安全团队收到客户反馈，其中一台服务器中了勒索病毒，服务器文件被加密。经过分析排查发现，该勒索病毒家族为GandCrab。"}
{"title": "什么？和盒子聊天就有新春礼物！更有商城限定福袋大抢兑~", "url": "https://www.freebuf.com/fevents/195097.html", "time": "2019-01-28", "level": "", "num_look": 72923, "num_comment": 1, "author": "漏洞盒子", "tags": ["活动"], "text": "叮！ 有一份来自漏洞盒子的新春礼物"}
{"title": "Ethr：一款TCP、UDP和HTTP网络性能测量工具", "url": "https://www.freebuf.com/sectool/194554.html", "time": "2019-01-28", "level": "", "num_look": 209931, "num_comment": 1, "author": "周大涛", "tags": ["工具"], "text": "Ethr是一个用golang编写的跨平台网络性能测量工具。该项目的目标是提供本机工具，用于跨多种协议。"}
{"title": "Telegram中文圈现状", "url": "https://www.freebuf.com/articles/network/194822.html", "time": "2019-01-28", "level": "现金奖励", "num_look": 1239508, "num_comment": 32, "author": "一个匿名小号", "tags": ["网络安全", "观点"], "text": "Telegram这个中文圈子的情况越来越复杂，加上很多萌新尚未熟悉Telegram圈子的内幕，鄙人特意写了一下关于Telegram中文圈现状的文章。"}
{"title": "2019年最大的网络威胁：电子商务网络攻击的崛起", "url": "https://www.freebuf.com/articles/web/194973.html", "time": "2019-01-28", "level": "", "num_look": 170396, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "由于目前的电子商务和网络销售因为技术方面存在安全缺陷，导致用户的信息（例如信用卡数据、借记卡数据以及个人敏感信息）面临着非常严重的网络威胁"}
{"title": "挖洞带给我快乐，也带我财富 | 全球顶尖漏洞猎人Pranav Hivarekar专访", "url": "https://www.freebuf.com/articles/people/194357.html", "time": "2019-01-28", "level": "", "num_look": 159730, "num_comment": 5, "author": "Freddy", "tags": ["人物志", "活动"], "text": "我叫他小哥，一是在与他打交道的时候感到他很有亲和力，二是因为他是踩着94年的尾巴出生的，实打实的24岁，但成就已经斐然。"}
{"title": "小学生都会挖掘的JSON Hijacking实战利用", "url": "https://www.freebuf.com/articles/web/194698.html", "time": "2019-01-28", "level": "金币+10", "num_look": 225777, "num_comment": 21, "author": "绿帽子技术分享", "tags": ["WEB安全"], "text": "JSON Hijacking漏洞的详细利用，有点类似与CSRF，不过原理利用方式不同，在这边文章我着重讲解json跨域劫持的利用环境搭建与方式。"}
{"title": "Numpy反序列化命令执行(CVE-2019-6446)浅析", "url": "https://www.freebuf.com/vuls/194540.html", "time": "2019-01-28", "level": "现金奖励", "num_look": 130205, "num_comment": 1, "author": "nancyy", "tags": ["漏洞"], "text": "NumPy是一个功能强大的Python库，主要用于对多维数组执行计算。NumPy提供了大量的库函数和操作，可以帮助程序员轻松地进行数值计算。"}
{"title": "BUF早餐铺 |  谷歌因违反GDPR接受瑞典调查；谷歌浏览器将屏蔽恶意软件自动下载功能；四部委联合开展“App违法违规收集使用个人信息专项治理”", "url": "https://www.freebuf.com/news/195100.html", "time": "2019-01-28", "level": "", "num_look": 62514, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "恶意代码隐藏在广告图形文件中攻击Mac电脑用户；  GitHub 2018年收到 112 次用户信息披露请求"}
{"title": "如何利用ICMP建立C2会话？", "url": "https://www.freebuf.com/sectool/194598.html", "time": "2019-01-27", "level": "", "num_look": 104881, "num_comment": 104881, "author": "secist", "tags": ["工具"], "text": "本文我将为大家介绍另一种获取C2会话的方法，即利用ICMP来建立C2会话。"}
{"title": "在标准SSH隧道中隐藏C&C流量", "url": "https://www.freebuf.com/articles/system/194630.html", "time": "2019-01-27", "level": "", "num_look": 119623, "num_comment": 1, "author": "secist", "tags": ["系统安全"], "text": "SHazam是一种在标准SSH隧道中隐藏C&C流量从而躲避网络检测的技术。"}
{"title": "Matrix勒索病毒PRCP变种侵入政企单位", "url": "https://www.freebuf.com/articles/terminal/194592.html", "time": "2019-01-27", "level": "", "num_look": 132157, "num_comment": 132157, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "Matrix勒索病毒PRCP变种出现，目前已有政企单位感染案例，该勒索变种采用RSA+AES高强度加密算法。"}
{"title": "Windows环境中使用Responder获取NTLMv2哈希并利用", "url": "https://www.freebuf.com/articles/system/194549.html", "time": "2019-01-26", "level": "", "num_look": 158520, "num_comment": 1, "author": "周大涛", "tags": ["系统安全"], "text": "假设我们已连接到Windows Active Directory环境，当网络上的设备尝试用LLMNR和NBT-NS请求来解析目标机器时，Responder就会伪装成目标机器。"}
{"title": "渗透测试中PHP Stream Wrappers的利用技巧", "url": "https://www.freebuf.com/articles/web/193849.html", "time": "2019-01-26", "level": "", "num_look": 114238, "num_comment": 114238, "author": "secist", "tags": ["WEB安全"], "text": "在本文中，我将为大家介绍一些PHP Stream Wrappers在渗透测试中的利用技巧。"}
{"title": "一次病毒通过445端口自我横向蔓延的艳遇", "url": "https://www.freebuf.com/articles/system/194546.html", "time": "2019-01-26", "level": "金币+8", "num_look": 248211, "num_comment": 6, "author": "Qianng", "tags": ["系统安全"], "text": "有一天发现内网一台主机不停的向所在网段的445端口发SYN, 此主机的行为主动而特别恶劣，遂探究了一番。"}
{"title": "匿名者黑客组织放话挑衅，这可能又是一场闹剧", "url": "https://www.freebuf.com/news/195136.html", "time": "2019-01-25", "level": "红色标题", "num_look": 246208, "num_comment": 6, "author": "shidongqi", "tags": ["资讯"], "text": "匿名者，这个传说中的黑客组织，已经成为了是个人都能戴的帽子。即便是你现在上Twitter注册个账号，挂上匿名者的头像，发布消息称2019年2月31日，要让白宫瘫痪，最后别忘了配上一段匿名者的宣言。"}
{"title": "XXE萌新进阶全攻略", "url": "https://www.freebuf.com/vuls/194112.html", "time": "2019-01-25", "level": "现金奖励", "num_look": 306193, "num_comment": 5, "author": "rabbitmask", "tags": ["WEB安全", "漏洞"], "text": "首先声明下本文为萌新向，旨在让刚接触XXE基本概念的小伙伴们可以熟练运用高阶的XXE攻击。"}
{"title": "Apache Spark RPC协议中的反序列化漏洞分析", "url": "https://www.freebuf.com/vuls/194532.html", "time": "2019-01-25", "level": "", "num_look": 135745, "num_comment": 135745, "author": "斗象智能安全平台", "tags": ["漏洞"], "text": "在前一阵，Spark官方发布了标题为《CVE-2018-17190: Unsecured Apache Spark standalone executes user code》的安全公告。"}
{"title": "云安全专家（CCSP）认证Pearson VUE香港考试攻略", "url": "https://www.freebuf.com/articles/others-articles/194023.html", "time": "2019-01-25", "level": "现金奖励", "num_look": 219349, "num_comment": 11, "author": "heymind", "tags": ["其他"], "text": "2018年底笔者在香港的Pearson VUE全球授权考试中心，通过了云安全专家(CCSP)认证考试，现将基本准备和复习考试过程简要归纳如下，供需要的朋友们参考。"}
{"title": "谷歌创建网络钓鱼在线测试，看看你能过几关？", "url": "https://www.freebuf.com/news/195039.html", "time": "2019-01-25", "level": "红色标题", "num_look": 260918, "num_comment": 15, "author": "shidongqi", "tags": ["资讯"], "text": "谷歌的子公司Jigsaw推出了一个免费的在线网络钓鱼测试，利用一些比较常见的网络钓鱼手段来测试用户的发现恶意电子邮件的能力"}
{"title": "PHP一句话木马研究", "url": "https://www.freebuf.com/articles/web/194243.html", "time": "2019-01-25", "level": "现金奖励", "num_look": 365636, "num_comment": 5, "author": "Gxian", "tags": ["WEB安全"], "text": "最近在研究PHP一句话后门，查阅了很多大佬的博客，并从中衍生出了一些可用的方法，在这里供大家参考。"}
{"title": "BUF早餐铺丨运营商人士透露必应搜索预计今明陆续恢复正常；新型勒索软件Anatova开始爆发；美国多家大银行泄露大量贷款文件", "url": "https://www.freebuf.com/news/195073.html", "time": "2019-01-25", "level": "", "num_look": 85678, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "美国多家大银行泄露大量贷款文件：数量有2400多万份；津巴布韦切断互联网访问后 “匿名者”对其政府网站发起DDoS攻击；法国国防部长：网络战争已经开始，先下手为强。"}
{"title": "高中生一年从0到0day的秘密", "url": "https://www.freebuf.com/vuls/194519.html", "time": "2019-01-24", "level": "", "num_look": 279064, "num_comment": 7, "author": "奇安信代码卫士", "tags": ["漏洞"], "text": "今年上大一的 Jonathan Jacobi 讲述了自己如何从安全基础几乎为零的情况下，用了一年多点的时间在 Edge 浏览器中找到了自己的首个 0day 漏洞。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列-Rhynorater", "url": "https://www.freebuf.com/video/195004.html", "time": "2019-01-24", "level": "红色标题", "num_look": 110344, "num_comment": 2, "author": "willhuang", "tags": ["视频"], "text": "Rhynorater，渗透测试者，OCSP，Python爱好者，供职于美国Synercomm网络安全公司。经常混迹于Bugcrowd和HackerOne的白帽人员，他算是不断成长的Web漏洞挖掘白帽人员。"}
{"title": "命令注入新玩法：巧借环境渗透测试目标", "url": "https://www.freebuf.com/articles/web/194574.html", "time": "2019-01-24", "level": "现金奖励", "num_look": 266528, "num_comment": 5, "author": "yangyangwithgnu", "tags": ["WEB安全"], "text": "在一次漏洞赏金活动中，挖掘到一个不是命令注入但又像似命令注入的漏洞，与你分享背后的故事~"}
{"title": "阿里安全招聘红蓝对抗安全专家", "url": "https://www.freebuf.com/jobs/194837.html", "time": "2019-01-24", "level": "", "num_look": 193325, "num_comment": 5, "author": "阿里安全", "tags": ["安全招聘"], "text": "阿里巴巴招聘资深安全工程师、安全专家及高级安全专家，提供极具行业竞争力的待遇。"}
{"title": "9012年，你会选哪些安全测试工具？", "url": "https://www.freebuf.com/sectool/194269.html", "time": "2019-01-24", "level": "红色标题", "num_look": 298236, "num_comment": 15, "author": "AngelaY", "tags": ["工具"], "text": "在 2018 年安全工具盘点的基础上，我们今年再增加一些免费或开源工具，供读者参考。"}
{"title": "新年送书 | 安全开发好书推荐", "url": "https://www.freebuf.com/fevents/194976.html", "time": "2019-01-24", "level": "红色标题", "num_look": 229311, "num_comment": 62, "author": "FB客服", "tags": ["活动"], "text": "很长一段时间没给大家送过福利了， 时值新春佳节， FreeBuf来给大家推（zeng）荐（song）好书啦，本次共送出14本《Windows黑客编程技术详解》，带着满满干货回家过年吧！"}
{"title": "基于Docker的CVE-2018-15473漏洞复现", "url": "https://www.freebuf.com/vuls/193988.html", "time": "2019-01-24", "level": "金币+6", "num_look": 297597, "num_comment": 14, "author": "522952110", "tags": ["漏洞"], "text": "这篇文章为原创，非英文论坛翻译版本，看分析请看另一篇翻译文章，他一定没有复现，因为我试过poc，其中某个参数是错误的！！！！"}
{"title": "ThinkPHP 5.0命令执行漏洞分析及复现", "url": "https://www.freebuf.com/vuls/194127.html", "time": "2019-01-24", "level": "现金奖励", "num_look": 466513, "num_comment": 9, "author": "小纨绔", "tags": ["漏洞"], "text": "该漏洞主要是：表单请求类型伪装 + filter参数 = 覆盖变量filter；变量覆盖filter + debug模式 + 执行filter = 命令执行。"}
{"title": "从Blind XXE漏洞到读取Root文件的系统提权", "url": "https://www.freebuf.com/vuls/194489.html", "time": "2019-01-24", "level": "", "num_look": 160495, "num_comment": 1, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "在最近的漏洞众测过程中，作者测试XXE漏洞时，遇到了一个有意思的XML服务端。"}
{"title": "2018年Windows漏洞年度盘点", "url": "https://www.freebuf.com/articles/paper/194868.html", "time": "2019-01-24", "level": "", "num_look": 2583039, "num_comment": 2583039, "author": "腾讯电脑管家", "tags": ["安全报告"], "text": "本报告主要重点分析2018年Windows平台的漏洞攻击态势，并给个人和企业合理化的漏洞防护建议。"}
{"title": "BUF早餐铺 | Adobe修复Experience Manager的XSS漏洞；Linux APT包管理器修复严重漏洞；约三分之二的 DDoS 攻击指向通信服务提供商", "url": "https://www.freebuf.com/news/194960.html", "time": "2019-01-24", "level": "", "num_look": 62573, "num_comment": 62573, "author": "AngelaY", "tags": ["资讯"], "text": "旧软件会导致PC用户暴露在安全风险中；Google在Jigsaw提供测验栏目 测试用户发现网络钓鱼诈骗的能力；欧洲国家聚焦网络安全和隐私保护问题"}
{"title": "美国大批博彩网站信息泄露，数据量多达1.08亿条", "url": "https://www.freebuf.com/news/194879.html", "time": "2019-01-23", "level": "", "num_look": 88214, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "小赌怡情，大赌伤身。这年头，赢了也可能“破财”。"}
{"title": "挖洞经验 | 看我如何发现Pinterest任意账号劫持漏洞", "url": "https://www.freebuf.com/vuls/194345.html", "time": "2019-01-23", "level": "", "num_look": 171286, "num_comment": 171286, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "Pinterest是美国热门的图片社交网站，Pinterest堪称图片版Twitter，网民可以将感兴趣的图片在Pinterest保存，其他网友可以关注，也可以转发图片。"}
{"title": "Exchange CVE-2018-8581 提权漏洞预警", "url": "https://www.freebuf.com/vuls/194857.html", "time": "2019-01-23", "level": "红色标题", "num_look": 174895, "num_comment": 3, "author": "漏洞盒子", "tags": ["漏洞"], "text": "昨天，国外安全研究员 dirkjanm 通过博客文章公布了 Exchange 服务器上的一个提权漏洞的利用详情，漏洞编号为 CVE-2018-8581。"}
{"title": "挖洞经验 | 从存储型XSS到RCE的Steam客户端漏洞", "url": "https://www.freebuf.com/articles/web/194273.html", "time": "2019-01-23", "level": "红色标题", "num_look": 200007, "num_comment": 2, "author": "clouds", "tags": ["WEB安全"], "text": "最近众测社区披露的一个Steam客户端漏洞，就能让攻击者在Steam用户的电脑系统上实现从存储型XSS到远程代码执行（RCE）的攻击，可导致个人信息和进一步的系统控制。"}
{"title": "物联网软件专题 | 开源软件源代码安全缺陷分析报告", "url": "https://www.freebuf.com/articles/paper/194382.html", "time": "2019-01-23", "level": "", "num_look": 96236, "num_comment": 96236, "author": "奇安信代码卫士", "tags": ["安全报告"], "text": "本期报告选取全球20款知名物联网软件进行源代码安全缺陷分析，结合缺陷分析工具和人工审计的结果，评估项目的安全性。"}
{"title": "疑似MuddyWater最新攻击活动分析", "url": "https://www.freebuf.com/articles/paper/194310.html", "time": "2019-01-23", "level": "现金奖励", "num_look": 120943, "num_comment": 9, "author": "fuckgod", "tags": ["安全报告"], "text": "MuddyWater是疑似来自伊朗的APT组织，主要攻击目标为中东地区政府机构，但在近期的公开报告中显示，18年后，中东以外的地区也陆续出现了Muddywater的活动迹象。"}
{"title": "网络安全等级保护之关键活动建设", "url": "https://www.freebuf.com/articles/network/194113.html", "time": "2019-01-23", "level": "现金奖励", "num_look": 652843, "num_comment": 12, "author": "jin16879", "tags": ["企业安全", "网络安全"], "text": "关键活动，就是在一系列活动中最为重要的且必须要完成的活动，在等级保护工作中，关键活动是安全防护工作的重中之重，是确保等级保护是否顺利通过的关键之处。"}
{"title": "BUF早餐铺 | 研究人员发现iOS 12.1.2新漏洞；李开复：隐私保护不完全非黑即白；400多万条青年学生组织AIESEC申请者信息泄露", "url": "https://www.freebuf.com/news/194824.html", "time": "2019-01-23", "level": "", "num_look": 89651, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "李开复表示，对欧洲的政策制定者心存敬意，但不认为隐私保护完全是一个非白即黑的问题，重要的是找到界线。"}
{"title": "挖洞经验 | 通过SPRING ENGINE SSTI导致的雅虎RCE", "url": "https://www.freebuf.com/vuls/194128.html", "time": "2019-01-22", "level": "金币+8", "num_look": 145613, "num_comment": 3, "author": "生如夏花", "tags": ["WEB安全", "漏洞"], "text": "在测试Web应用程序的安全性时，信息收集是查找可能存在漏洞的Web资产的重要组成部分，因为可以发现可能会增加攻击面的子域，目录和其他资产。"}
{"title": "病毒利用安全产品模块劫持流量攻击安全软件", "url": "https://www.freebuf.com/articles/paper/194511.html", "time": "2019-01-22", "level": "", "num_look": 98771, "num_comment": 3, "author": "火绒安全", "tags": ["安全报告"], "text": "火绒安全团队发现，病毒团伙正利用\"远景\"论坛的系统镜像文件传播后门病毒\"WenkPico\"。"}
{"title": "2019年软件安全趋势前瞻", "url": "https://www.freebuf.com/articles/neopoints/193993.html", "time": "2019-01-22", "level": "", "num_look": 91773, "num_comment": 91773, "author": "SIGChina", "tags": ["观点"], "text": "过去一年，从Facebook数据泄露事件、币圈频发的网络攻击，到知名酒店集团的信息泄露，让越来越多的企业意识到他们在防范潜在威胁和新型攻击媒介方面的投资还远远不够。"}
{"title": "腾讯《无限法则》疑似收集用户SS配置信息，游戏隐私问题引争议", "url": "https://www.freebuf.com/news/194724.html", "time": "2019-01-22", "level": "红色标题", "num_look": 650133, "num_comment": 6, "author": "Allen别bb", "tags": ["资讯"], "text": "在过去一年的时间里，隐私成为了最热门的关键词之一，但似乎我们很少去关注游戏的隐私问题。近期用户 @Hackl0us 一条微博，让腾讯游戏安全中心陷入了一场关于隐私的风波……"}
{"title": "知道创宇2018年网络空间安全报告", "url": "https://www.freebuf.com/vuls/194201.html", "time": "2019-01-22", "level": "", "num_look": 227279, "num_comment": 3, "author": "Knownsec知道创宇", "tags": ["安全报告", "漏洞"], "text": "如果说⼤型漏洞爆发后的安全应急是和时间赛跑，那么 2018 年这种赛跑已经进⼊了⽩热化的阶段。"}
{"title": "攻防系统之攻防环境介绍&搭建", "url": "https://www.freebuf.com/articles/system/193557.html", "time": "2019-01-22", "level": "现金奖励", "num_look": 435318, "num_comment": 19, "author": "gncao", "tags": ["企业安全", "系统安全"], "text": "为什么要搞这个东西呢，因为自己希望能够通过这个“课题”提高自己的渗透技术、提高自己的应急响应能力，同时提升监测平台的有效检测率。"}
{"title": "BUF早餐铺丨菲律宾金融服务公司数据泄露，影响90万客户；美国多个赌博网站泄露1.08亿条信息，包括支付卡资料；俄罗斯对Facebook和Twitter发起民事诉讼，违反数据法", "url": "https://www.freebuf.com/news/194774.html", "time": "2019-01-22", "level": "", "num_look": 88828, "num_comment": 88828, "author": "Karunesh91", "tags": ["资讯"], "text": "新年将近，各位buffer还是要多注意安全呐~"}
{"title": "大厂也难逃GDPR，谷歌、亚马逊再遭投诉", "url": "https://www.freebuf.com/news/194732.html", "time": "2019-01-21", "level": "", "num_look": 80955, "num_comment": 2, "author": "Karunesh91", "tags": ["资讯"], "text": "谷歌、亚马逊等知名企业再度遭到GDPR投诉。"}
{"title": "ES文件管理器现严重漏洞，建议用户及时更新", "url": "https://www.freebuf.com/news/194646.html", "time": "2019-01-21", "level": "红色标题", "num_look": 115666, "num_comment": 8, "author": "shidongqi", "tags": ["资讯"], "text": "近日，一款知名软件 ES 文件管理器被曝出有重大漏洞，能够导致用户手机上的文件泄漏给同一网络下的所有用户。据悉ES文件管理器在Google Play上的下载次数已经超过1亿次，用户量非常惊人。"}
{"title": "技术分享 | 多种测试HTTP身份验证的方法", "url": "https://www.freebuf.com/news/193649.html", "time": "2019-01-21", "level": "", "num_look": 110463, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "在这篇文章中，我们会告诉大家如何保护Apache Web服务器免受未经身份验证的用户非法访问，以及如何隐藏关键核心信息不被非法用户查看到。"}
{"title": "威胁猎人招聘：我们寻找神一般的新伙伴", "url": "https://www.freebuf.com/jobs/194403.html", "time": "2019-01-21", "level": "", "num_look": 157993, "num_comment": 10, "author": "永安在线", "tags": ["安全招聘"], "text": "威胁猎人是一家以业务安全情报能力见长的创新性安全企业。自成立始，公司投入大量资源，打造了一整套国内领先的业务安全情报监控与预警体系。"}
{"title": "层层监管下玩出花样，34亿赌资是如何进入赌博幕后人口袋的？", "url": "https://www.freebuf.com/articles/database/194219.html", "time": "2019-01-21", "level": "红色标题", "num_look": 255044, "num_comment": 6, "author": "GEETEST极验", "tags": ["数据安全"], "text": "网络赌博这个黑色产业却仍然月入上千亿，这么大规模的资金究竟是如何“名正言顺”的进入赌博幕后操纵者的口袋的呢？"}
{"title": "也许有一天，HTTP网站不再能访问了 | 专访Digicert产品与标准副总裁Dean.J. Coclin", "url": "https://www.freebuf.com/video/194423.html", "time": "2019-01-21", "level": "", "num_look": 123214, "num_comment": 1, "author": "AngelaY", "tags": ["人物志", "视频"], "text": "数字证书在不断进步，当然我们还需要继续努力。"}
{"title": "黑灰产一出手就是200多亿，这次遭殃的是拼多多", "url": "https://www.freebuf.com/news/194607.html", "time": "2019-01-21", "level": "红色标题", "num_look": 336729, "num_comment": 20, "author": "Karunesh91", "tags": ["资讯"], "text": "“羊毛党”再出江湖，这回中招的是拼多多。"}
{"title": "U盘钓鱼的实现和防范", "url": "https://www.freebuf.com/articles/database/194167.html", "time": "2019-01-21", "level": "现金奖励", "num_look": 188028, "num_comment": 7, "author": "ChuanFile", "tags": ["数据安全", "网络安全"], "text": "入侵者在u盘中植入病毒，利用拾到者想偷窥、想知道使用人后归还等好奇心理，诱导拾到者插入并打开u盘中的文件，进而触发病毒，可以说是APT入侵利器。"}
{"title": "利用Thinkphp漏洞传播的Mirari新变种分析", "url": "https://www.freebuf.com/articles/system/194157.html", "time": "2019-01-21", "level": "现金奖励", "num_look": 133050, "num_comment": 8, "author": "kczwa1", "tags": ["系统安全"], "text": "此前，通过攻击日志发现攻击IP使用了于2018年12月12日爆出的ThinkPHP远程代码执行漏洞（CNVD-2018-24942），攻击者利用该漏洞，可在未授权的情况下远程执行代码。"}
{"title": "BUF早餐铺 | Google Play 里的恶意应用利用手机运动传感器隐藏自己；国家计算机病毒应急处理中心公布10款违法有害App；美国议员称华为太阳能设备可能威胁美国电网", "url": "https://www.freebuf.com/news/194575.html", "time": "2019-01-21", "level": "", "num_look": 83271, "num_comment": 83271, "author": "shidongqi", "tags": ["资讯"], "text": "美国两党多名议员表示，华为在美销售的太阳能设备可能遭到入侵，让第三方减慢甚至中断美国的电力供应。"}
{"title": "如何以更实际的方式推进零信任框架落地", "url": "https://www.freebuf.com/articles/network/194338.html", "time": "2019-01-20", "level": "", "num_look": 127775, "num_comment": 127775, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "零信任框架模型是由Forrester公司设计出来并应用于Google的BeyondCorp计划中。这些以“信任”为核心的方法可以将基于网络拓扑的访问决策移交给授权用户以及授权设备上。"}
{"title": "让我们一起看一看日益脆弱的软件供应链", "url": "https://www.freebuf.com/articles/system/193643.html", "time": "2019-01-20", "level": "", "num_look": 111258, "num_comment": 111258, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "从伊朗到俄罗斯，各个国家都在把软件供应链作为攻击工具，来危害和扰乱敌对国的基础设施以及商业前景。"}
{"title": "面对黑客入侵，要有主动安全的新思维", "url": "https://www.freebuf.com/articles/wireless/194074.html", "time": "2019-01-20", "level": "", "num_look": 191831, "num_comment": 2, "author": "softnext守内安", "tags": ["无线安全", "观点"], "text": "上世纪末，欧洲车商的市场竞争，Volvo沃尔沃因为发明了安全带，汽车钢板较厚，在定位上被视为是较为安全的汽车品牌，深受年长消费者喜欢。"}
{"title": "云上挖矿大数据：黑客最钟爱门罗币", "url": "https://www.freebuf.com/articles/paper/194422.html", "time": "2019-01-20", "level": "", "num_look": 134553, "num_comment": 3, "author": "云鼎实验室", "tags": ["安全报告"], "text": "区块链项目在这一年上演着冰与火之歌，除了巨大的市场波动之外，区块链领域本身的安全问题也逐渐凸显，与之相关的社会化问题不断显现。"}
{"title": "钓鱼恶意软件AVE_MARIA的技术分析", "url": "https://www.freebuf.com/articles/es/194253.html", "time": "2019-01-19", "level": "", "num_look": 116971, "num_comment": 1, "author": "柚子", "tags": ["企业安全"], "text": "Ave Maria恶意软件在2018年12月底对意大利某能源企业发起网络钓鱼攻击。该恶意邮件以供应商销售部的名义发出发票与装运订单确认函。"}
{"title": "Web应用渗透实验策略与方法论研究", "url": "https://www.freebuf.com/articles/web/193647.html", "time": "2019-01-19", "level": "", "num_look": 136508, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "Web安全测试的范围非常广，其中涉及到多种安全测试过程，从识别整个Web应用程序开始，再到对多个阶段的测试进行监控，它是一个系统化的操作流程。"}
{"title": "详细讲解 | 利用python开发Burp Suite插件（二）", "url": "https://www.freebuf.com/articles/web/193950.html", "time": "2019-01-19", "level": "", "num_look": 149850, "num_comment": 149850, "author": "锋之刃安全团队", "tags": ["WEB安全"], "text": "今天将利用python实战写一个简单的sql注入插件（实现每个参数后面加入单引号）"}
{"title": "2018年Windows服务器挖矿木马总结报告", "url": "https://www.freebuf.com/articles/network/194145.html", "time": "2019-01-19", "level": "", "num_look": 193318, "num_comment": 193318, "author": "360安全", "tags": ["网络安全"], "text": "2019年，挖矿木马攻击将继续保持平稳，但黑产家族间的合作将更加普遍，“闷声发大财”可能是新一年挖矿木马的主要目标。"}
{"title": "色情勒索病毒和信息窃取木马的新套路", "url": "https://www.freebuf.com/articles/web/194133.html", "time": "2019-01-18", "level": "", "num_look": 167262, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "对于网络犯罪分子来说，色情邮件诈骗已经成为了一种搜刮钱财的绝佳途径，而近期的一个新型色情邮件诈骗活动又将此类攻击提升到了一个新的高度。"}
{"title": "利用分块传输吊打所有WAF", "url": "https://www.freebuf.com/articles/web/194351.html", "time": "2019-01-18", "level": "金币+10", "num_look": 394027, "num_comment": 25, "author": "落叶纷飞", "tags": ["WEB安全"], "text": "在看了bypassword的《在HTTP协议层面绕过WAF》之后，想起了之前做过的一些研究，所以写个简单的短文来补充一下文章里“分块传输”部分没提到的两个技巧。"}
{"title": "针对意大利的DanabotPayload分析", "url": "https://www.freebuf.com/news/193653.html", "time": "2019-01-18", "level": "", "num_look": 55582, "num_comment": 55582, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "就在几天前，Danabot（一个臭名昭著的僵尸网络）的新型变种席卷了意大利境内的联网设备。在此之前，Proofpoint和Eset等多家安全公司都对相同威胁的其他样本进行过分析。"}
{"title": "易宝支付招聘安全工程师", "url": "https://www.freebuf.com/jobs/194289.html", "time": "2019-01-18", "level": "", "num_look": 99646, "num_comment": 6, "author": "Yeepay", "tags": ["安全招聘"], "text": "易宝于2003年8月成立，总部位于北京，在北京、上海、广东、天津、四川、山东、江苏、浙江、福建、陕西等设有32家分公司。"}
{"title": "FreeBuf专访Fortinet亚太区首席顾问Anthony Lim | 协同合作共筑安全发展之道", "url": "https://www.freebuf.com/articles/people/193697.html", "time": "2019-01-18", "level": "红色标题", "num_look": 103809, "num_comment": 103809, "author": "AngelaY", "tags": ["人物志", "活动"], "text": "“改变”、“自适应”、“协同”、“合作”，是Anthony在演讲和采访中强调的关键词。"}
{"title": "2018企业网络安全年度报告 | 勒索病毒、挖矿木马是企业安全两大核心威胁", "url": "https://www.freebuf.com/articles/paper/194182.html", "time": "2019-01-18", "level": "", "num_look": 120925, "num_comment": 120925, "author": "腾讯电脑管家", "tags": ["安全报告"], "text": "2018年，数字加密币已彻底改变了病毒木马黑色产业，使勒索病毒和挖矿木马成为影响企业网络安全的两大核心威胁。"}
{"title": "警惕GarrantyDecrypt勒索病毒最新变种NOSTRO", "url": "https://www.freebuf.com/articles/network/194372.html", "time": "2019-01-18", "level": "", "num_look": 120059, "num_comment": 120059, "author": "360安全", "tags": ["网络安全"], "text": "一款GarrantyDecrypt勒索病毒的新变种近日开始在国内传播。该病毒是我们见到的最丧心病狂的勒索病毒之一：不区分文件类型，加密几乎所有类型的文件。"}
{"title": "国内网站内容篡改现状调查", "url": "https://www.freebuf.com/articles/neopoints/194000.html", "time": "2019-01-18", "level": "", "num_look": 144439, "num_comment": 2, "author": "深信服千里目安全实验室", "tags": ["观点"], "text": "本文分析国内网站内容篡改现状，知己知彼，方能百战不怠。"}
{"title": "BUF早餐铺 | Amadeus航班预订系统存在严重漏洞，141家航空公司受到影响；人脸识别解锁能用照片绕过？华为、三星、小米、HTC等均上榜", "url": "https://www.freebuf.com/news/194449.html", "time": "2019-01-18", "level": "", "num_look": 90028, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "荷兰消协表示，在过去的一年里，他们对上百款智能手机配备的人脸识别功能的安全性进行了测试，在用来测试的110部智能手机中，有42部可以通过用户的照片来解锁。"}
{"title": "过年不屯点干货吗，Windows平台高效Shellcode编程技术实战｜精品公开课", "url": "https://www.freebuf.com/fevents/194308.html", "time": "2019-01-17", "level": "红色标题", "num_look": 174504, "num_comment": 5, "author": "FB客服", "tags": ["FreeBuf公开课", "活动"], "text": "如何实现Windows平台下自己的Shellcode生成器~"}
{"title": "号称“人脉暗网”，马桶MT可不可以不要我的通讯录？", "url": "https://www.freebuf.com/special/194368.html", "time": "2019-01-17", "level": "红色标题", "num_look": 588450, "num_comment": 17, "author": "Allen别bb", "tags": ["特别企划"], "text": "快播、王欣，这两个词可能是让“马桶MT”还没正式发布就一夜爆火主要原因之一。其结果就是：“马桶”被挤爆了……"}
{"title": "iOS取证技巧：在无损的情况下完整导出SQLite数据库", "url": "https://www.freebuf.com/news/193684.html", "time": "2019-01-17", "level": "", "num_look": 110307, "num_comment": 110307, "author": "secist", "tags": ["资讯"], "text": "本文介绍通过利用iOS DeveloperImage的一些特性来提取SQLite数据库，该方案需要屏幕解锁和可信USB连接。"}
{"title": "中国网安三零卫士木星安全实验室招聘安全研究员", "url": "https://www.freebuf.com/jobs/194130.html", "time": "2019-01-17", "level": "", "num_look": 183973, "num_comment": 32, "author": "30weishi", "tags": ["安全招聘"], "text": "木星安全实验室，由中国网安·广州三零卫士成立，汇聚国内多名安全专家和反间谍专家组建而成."}
{"title": "Web应用程序防火墙（WAF）bypass技术（三）", "url": "https://www.freebuf.com/articles/web/193858.html", "time": "2019-01-17", "level": "金币+6", "num_look": 162951, "num_comment": 162951, "author": "生如夏花", "tags": ["WEB安全"], "text": "本文探讨了如何使用未初始化的bash变量来绕过基于正则表达式过滤器和模式匹配的WAF，现在让我们看看它如何在CloudFlare WAF和ModSecurity OWASP CRS3上完成的。"}
{"title": "敏捷开发模式下金融机构开源软件引入风险及管控举措", "url": "https://www.freebuf.com/articles/database/193877.html", "time": "2019-01-17", "level": "现金奖励", "num_look": 323362, "num_comment": 323362, "author": "haiczh", "tags": ["安全管理", "数据安全"], "text": "据Gartner调查显示，99%的组织在其IT系统中使用了开源软件，同时开源软件在服务器操作系统、云计算领域、Web领域都有比较广泛的应用。"}
{"title": "技术讨论 | 在HTTP协议层面绕过WAF", "url": "https://www.freebuf.com/news/193659.html", "time": "2019-01-17", "level": "现金奖励", "num_look": 406832, "num_comment": 23, "author": "bypassword", "tags": ["WEB安全", "资讯"], "text": "本次从协议层面绕过waf实验用sql注入演示，但不限于实际应用时测试sql注入（命令执行，代码执行，文件上传等测试都通用）。"}
{"title": "公链安全之比特币任意盗币漏洞浅析(CVE-2010-5141)", "url": "https://www.freebuf.com/vuls/194052.html", "time": "2019-01-17", "level": "", "num_look": 123196, "num_comment": 2, "author": "BCSEC实验室", "tags": ["区块链安全", "漏洞"], "text": "本期DVP漏洞专题是比特币漏洞CVE-2010-5141，这个漏洞可以导致攻击者盗取任何人的比特币，危害十分严重。"}
{"title": "一款注入型勒索病毒Ryuk，拉开2019年勒索病毒攻击的序幕", "url": "https://www.freebuf.com/articles/terminal/194060.html", "time": "2019-01-17", "level": "", "num_look": 212071, "num_comment": 212071, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "Ryuk的感染和传播过程都是由攻击者手动执行的，被加密的文件以.RYK后缀结尾。"}
{"title": "威胁预警 | 约400家交易所存在高危漏洞", "url": "https://www.freebuf.com/vuls/194373.html", "time": "2019-01-17", "level": "", "num_look": 119032, "num_comment": 119032, "author": "BUGX", "tags": ["区块链安全", "漏洞"], "text": "近日区块链安全生态BUGX收取到来自平台白帽（Xenc@米斯特安全）提交的安全漏洞，随后平台进行分析与监控，该漏洞为交易所通用高危漏洞。"}
{"title": "BUF早餐铺 | WordPress对运行过期PHP版本的网站发出警告；Secure Copy Protocol曝出有36年历史的漏洞；美国SEC数据库遭入侵", "url": "https://www.freebuf.com/news/194375.html", "time": "2019-01-17", "level": "", "num_look": 62897, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "纽约隐私法案强制企业披露消费者数据使用情况；建筑工地上的大型机械设备容易被黑客控制；vCard处理进程存在漏洞，微软表示4月份将修复。"}
{"title": "Jira错误配置问题导致NASA内部敏感信息泄露", "url": "https://www.freebuf.com/articles/web/194169.html", "time": "2019-01-16", "level": "", "num_look": 119386, "num_comment": 1, "author": "clouds", "tags": ["WEB安全"], "text": "今天在这分享两个关于NASA网站JIRA应用的漏洞，漏洞在于JIRA的错误配置，最终导致了NASA大量内部敏感信息泄露"}
{"title": "Kali Linux中的VEIL Framework绕过防病毒软件实验", "url": "https://www.freebuf.com/articles/system/193240.html", "time": "2019-01-16", "level": "", "num_look": 163547, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "我们将跟大家如何绕过目前市面上大部分的免费反病毒产品。"}
{"title": "关于海底捞不雅视频，谈谈三个被大家忽略的细节", "url": "https://www.freebuf.com/articles/wireless/194199.html", "time": "2019-01-16", "level": "红色标题", "num_look": 335421, "num_comment": 10, "author": "GEETEST极验", "tags": ["无线安全"], "text": "新年的第一个周末，武汉这家海底捞挑战\"新高度\"，吃着火锅还放起了小电影......"}
{"title": "纽约制造商OXO美国官网用户信息疑泄露", "url": "https://www.freebuf.com/news/193966.html", "time": "2019-01-16", "level": "", "num_look": 95273, "num_comment": 95273, "author": "知道创宇云安全", "tags": ["数据安全", "资讯"], "text": "据Security Week报道，总部位于纽约的制造商OXO International在近日透露，在过去的几年里，黑客曾多次试图窃取其客户的支付卡数据。"}
{"title": "如何禁用RocketMQ TLSv1.0？", "url": "https://www.freebuf.com/articles/web/193730.html", "time": "2019-01-16", "level": "现金奖励", "num_look": 126420, "num_comment": 126420, "author": "whwofei", "tags": ["WEB安全"], "text": "前几天同事找到我，话说他们的系统，被扫描到仍在使用低版本TLSv1.0，要求禁用掉，本来以为很简单的事情，结果他们折腾好几个月了，最后还是我出马解决了。。。"}
{"title": "BUF早餐铺 | 特斯拉高调悬赏：成功", "url": "https://www.freebuf.com/news/194327.html", "time": "2019-01-16", "level": "", "num_look": 74180, "num_comment": 4, "author": "shidongqi", "tags": ["资讯"], "text": "特斯拉是首个参加Pwn2Own黑客活动的汽车制造商，该活动由Trend Micro下属的Zero Day Initiative (ZDI)团队运营。特斯拉承诺，此次黑客大赛的获胜者将获赠Model 3。"}
{"title": "CNNVD关于ThinkPHP远程代码执行漏洞情况的通报", "url": "https://www.freebuf.com/news/194265.html", "time": "2019-01-15", "level": "", "num_look": 133941, "num_comment": 133941, "author": "CNNVD", "tags": ["漏洞", "资讯"], "text": "国家信息安全漏洞库收到关于ThinkPHP 5.0远程代码执行漏洞（CNNVD-201901-445）情况的报送。成功利用此漏洞的攻击者可以对目标系统进行远程代码执行攻击。ThinkPHP 5.0.x–5.0.23等多个版本均受此漏洞影响。"}
{"title": "欧盟启动15个免费开源软件项目的漏洞奖励计划", "url": "https://www.freebuf.com/news/194214.html", "time": "2019-01-15", "level": "红色标题", "num_look": 94281, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "从2019年1月份开始，欧盟委员会正式启动了15个免费开源软件项目的漏洞奖励计划，而这些开源软件都是欧盟机构目前正在使用的软件。"}
{"title": "挖洞经验 | OAuth授权不当导致的Twitter私信读取漏洞（$2,940）", "url": "https://www.freebuf.com/vuls/192668.html", "time": "2019-01-15", "level": "", "num_look": 138076, "num_comment": 3, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "Twitter应用在授权登录之后，其会进行和不会执行的操作提示。在其不会执行的操作中，清楚地列出了：不会读取用户的推特私信。真是这样的吗？"}
{"title": "浅谈php表单安全中Token的实际应用", "url": "https://www.freebuf.com/vuls/193844.html", "time": "2019-01-15", "level": "金币+8", "num_look": 203062, "num_comment": 4, "author": "si1ence", "tags": ["漏洞"], "text": "以前做等级保护的时候漏扫经常扫描出来一些网站有CSRF的漏洞，由于一般扫描器提示为中风险必须要解决经常和开发人员扯皮要怎么改怎么改，每次都描述的不清楚经常感觉心累。"}
{"title": "Flask-admin Reflected XSS引发的思考", "url": "https://www.freebuf.com/vuls/194179.html", "time": "2019-01-15", "level": "", "num_look": 140914, "num_comment": 140914, "author": "斗象智能安全平台", "tags": ["漏洞"], "text": "Flask-Admin是一个功能齐全、简单易用的Flask扩展，让你可以为Flask应用程序增加管理界面。"}
{"title": "Microsoft Exchange任意用户伪造漏洞（CVE-2018-8581）分析", "url": "https://www.freebuf.com/vuls/194083.html", "time": "2019-01-15", "level": "", "num_look": 246371, "num_comment": 13, "author": "alphalab", "tags": ["WEB安全", "漏洞"], "text": "近日，Microsoft 公告中披露了一则关于 Exchange Server 的任意用户伪造漏洞，天融信阿尔法实验室对此漏洞进行了复现及分析。"}
{"title": "通过破解来学习怎样更好的保护应用软件License", "url": "https://www.freebuf.com/articles/terminal/191605.html", "time": "2019-01-15", "level": "现金奖励", "num_look": 192365, "num_comment": 4, "author": "xiaoguazh", "tags": ["数据安全", "终端安全"], "text": "此文的主要目的是回顾多年前破解JUDE Pro(以及用友财务)软件的一些经历，总结怎样更好的保护应用软件的License。"}
{"title": "BUF早餐铺丨利比里亚ISP指控竞争对手雇黑客攻击其网络；波兰考虑限制政府机构使用华为产品；比特币在2010年曾遭遇历史上最大的黑客攻击", "url": "https://www.freebuf.com/news/194248.html", "time": "2019-01-15", "level": "", "num_look": 70621, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "利比里亚ISP指控竞争对手雇黑客攻击其网络；波兰考虑限制政府机构使用华为产品；比特币在2010年曾遭遇历史上最大的黑客攻击。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列-Sean Melia", "url": "https://www.freebuf.com/video/194046.html", "time": "2019-01-14", "level": "红色标题", "num_look": 148787, "num_comment": 148787, "author": "willhuang", "tags": ["视频"], "text": "Sean Melia 是Web漏洞挖掘领域的超级大牛，作为安全公司渗透测试方面资深专家，业余时间里，也是一名出色的漏洞赏金猎人。"}
{"title": "Springboot之actuator配置不当的漏洞利用", "url": "https://www.freebuf.com/news/193509.html", "time": "2019-01-14", "level": "现金奖励", "num_look": 791397, "num_comment": 13, "author": "T-T", "tags": ["WEB安全", "资讯"], "text": "Actuator 是 springboot 提供的用来对应用系统进行自省和监控的功能模块，借助于 Actuator 开发者可以很方便地对应用系统某些监控指标进行查看、统计等。"}
{"title": "Linux中create_elf_tables函数整型溢出漏洞分析（CVE-2018-14634）", "url": "https://www.freebuf.com/vuls/192659.html", "time": "2019-01-14", "level": "", "num_look": 119318, "num_comment": 119318, "author": "Alpha_h4ck", "tags": ["漏洞", "系统安全"], "text": "在这篇文章中，我们将跟大家分析Linux平台中create_elf_tables函数的一个整型溢出漏洞（CVE-2018-14634）。"}
{"title": "ARM汇编之堆栈溢出实战分析三（GDB）", "url": "https://www.freebuf.com/articles/system/193664.html", "time": "2019-01-14", "level": "现金奖励", "num_look": 103210, "num_comment": 103210, "author": "xiongchaochao", "tags": ["系统安全"], "text": "从最开始的堆栈溢出的学习到后面三个ELF二进制可进制文件的实战，每一次的调试、下断点、查看内存数据、查看汇编代码、EXP的植入，都让我对堆栈溢出这块的知识更加牢固，那么继续星辰大海的征途。"}
{"title": "重磅 | FreeBuf 2018金融行业应用安全态势报告", "url": "https://www.freebuf.com/articles/paper/190442.html", "time": "2019-01-14", "level": "红色标题", "num_look": 1057578, "num_comment": 14, "author": "FreeBuf咨询", "tags": ["安全报告"], "text": "FreeBuf安全研究院期望与合作伙伴一起，通过大量调研与分析，借由《金融行业应用安全态势报告》来反映该行业在应用安全方面的年度真实现状与趋势。"}
{"title": "简单高效的模糊测试——Fuzzing", "url": "https://www.freebuf.com/news/193602.html", "time": "2019-01-14", "level": "", "num_look": 225268, "num_comment": 4, "author": "DigApis", "tags": ["资讯"], "text": "本文介绍了一种简单高效的漏洞挖掘方法，即fuzzing。旨在帮助读者深入了解fuzzing测试方法，虽简单高效。但实则也蕴藏玄机。"}
{"title": "Web应用程序防火墙（WAF）bypass技术（二）", "url": "https://www.freebuf.com/articles/web/193827.html", "time": "2019-01-14", "level": "金币+6", "num_look": 144813, "num_comment": 3, "author": "生如夏花", "tags": ["WEB安全"], "text": "显然，还有很多其他方法可以绕过WAF规则集，我认为每次攻击都有其特定的规避技术。"}
{"title": "一大波含“税”APP来袭，就等你上钩", "url": "https://www.freebuf.com/news/193852.html", "time": "2019-01-14", "level": "", "num_look": 89145, "num_comment": 2, "author": "GEETEST极验", "tags": ["资讯"], "text": "隐私泄露、木马病毒、“被就业”......看来在热点下，黑产也在伺机而动，有流量的地方就有利益。而这也不例外，那么黑产们制造如此多的山寨APP，看中的或许远不只有隐私......"}
{"title": "BUF早餐铺丨GoDaddy被发现其在托管的网站的所有网页嵌入了一个脚本；英国法律将要求所有色情网站在4月份开始验证用户年龄；幽灵病毒hAnt肆虐矿场", "url": "https://www.freebuf.com/news/194137.html", "time": "2019-01-14", "level": "", "num_look": 79079, "num_comment": 79079, "author": "Karunesh91", "tags": ["资讯"], "text": "GoDaddy被发现其在托管的网站的所有网页嵌入了一个脚本；英国法律将要求所有色情网站在4月份开始验证用户年龄；幽灵病毒hAnt肆虐矿场，矿工每小时损失2000元。"}
{"title": "挖洞经验 | 看我如何发现谷歌电子表格、谷歌云盘和谷歌相册的3个漏洞（$4133.7）", "url": "https://www.freebuf.com/vuls/192342.html", "time": "2019-01-13", "level": "", "num_look": 190715, "num_comment": 3, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "作为一名新手Bug Hunter来说，信息安全真的是一门高深而广泛的学问，要发现漏洞，需要具备专业的知识、无比的耐心和一点点的运气。"}
{"title": "CVE-2018-13024复现及一次简单的内网渗透", "url": "https://www.freebuf.com/news/193748.html", "time": "2019-01-13", "level": "现金奖励", "num_look": 356223, "num_comment": 14, "author": "twosmi1e", "tags": ["系统安全", "资讯"], "text": "Metinfo 6.0.0版本中存在安全漏洞。远程攻击者可通过向admin/column/save.php文件发送‘module’参数利用该漏洞向.php文件写入代码并执行该代码。"}
{"title": "详细讲解 | 利用python开发Burp Suite插件（一）", "url": "https://www.freebuf.com/news/193657.html", "time": "2019-01-13", "level": "", "num_look": 225770, "num_comment": 2, "author": "锋之刃安全团队", "tags": ["资讯"], "text": "Burp Suite支持Java,Python,Ruby编写他的插件，在这里我们选用Python作为我们插件的开发语言，Python分很多种，常见的比如Jython，Cython等等。"}
{"title": "SCAT：信令收集和分析工具", "url": "https://www.freebuf.com/news/193561.html", "time": "2019-01-12", "level": "", "num_look": 71173, "num_comment": 1, "author": "secist", "tags": ["资讯"], "text": "SCAT是一个由python编写的信令收集和分析工具，它会通过USB解析Qualcomm和Samsung基带的诊断信息，并生成包含蜂窝控制平面消息的GSMTAP数据包流。"}
{"title": "挖洞经验 | 通过读取ASP.NET应用泄露的secrets获得bug赏金17000美刀", "url": "https://www.freebuf.com/articles/web/192415.html", "time": "2019-01-12", "level": "金币+6", "num_look": 119062, "num_comment": 1, "author": "生如夏花", "tags": ["WEB安全"], "text": "ASP.NET应用程序中比较常见的漏洞有本地文件泄露（LDF）。如果读者之前未接触过ASP.NET开发，那么LFD对于你来说可能很困惑并且会没啥思路。"}
{"title": "Windows 0day任意文件覆盖漏洞分析与验证", "url": "https://www.freebuf.com/news/193655.html", "time": "2019-01-12", "level": "现金奖励", "num_look": 123528, "num_comment": 5, "author": "markyu", "tags": ["系统安全", "资讯"], "text": "安全研究员SandboxEscaper近日披露了Windows操作系统中第四个0-day漏洞的漏洞利用代码，利用该漏洞可以覆盖任意Windows10文件，甚至包括通常无法访问的基本文件。"}
{"title": "两个月开上法拉利，薅走的羊毛都去了哪里？", "url": "https://www.freebuf.com/news/193807.html", "time": "2019-01-12", "level": "红色标题", "num_look": 195322, "num_comment": 7, "author": "GEETEST极验", "tags": ["资讯"], "text": "新时代的年轻人，最大梦想——一夜暴富。而最近，有羊毛党告诉我“一起薅羊毛，两个月开上法拉利”......"}
{"title": "漏洞预警 | ThinkPHP5远程命令执行漏洞", "url": "https://www.freebuf.com/vuls/194105.html", "time": "2019-01-12", "level": "红色标题", "num_look": 355435, "num_comment": 7, "author": "斗象智能安全平台", "tags": ["漏洞"], "text": "2019年1月11日ThinkPHP团队发布了版本更新，本次更新包含了一个可能GetShell的安全更新，具体内容为改进Request类的method方法。"}
{"title": "海底捞不雅视频事件告破，公共场所WI-FI安全问题严重", "url": "https://www.freebuf.com/news/194064.html", "time": "2019-01-11", "level": "红色标题", "num_look": 131949, "num_comment": 3, "author": "Allen别bb", "tags": ["资讯"], "text": "前几天热议的海底捞不雅视频事件终于水落石出，江汉区公安分局发布通报称，系一名28岁男子破解了WI-FI密码后投屏到海底捞大屏播放淫秽视频所致，目前该男子已经被依法刑事拘留。"}
{"title": "zBang：可检测潜在特权帐户威胁的风险评估工具", "url": "https://www.freebuf.com/sectool/193504.html", "time": "2019-01-11", "level": "", "num_look": 118867, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "zBang是一个用于检测扫描网络中潜在特权帐户威胁的风险评估工具，组织或红队可利用zBang来识别潜在的攻击向量改善网络的安全状况，并可通过图形界面或查看原始输出文件来分析结果。"}
{"title": "挖洞经验 | 从Self XSS到有趣的存储型XSS", "url": "https://www.freebuf.com/articles/web/192318.html", "time": "2019-01-11", "level": "金币+6", "num_look": 205107, "num_comment": 11, "author": "生如夏花", "tags": ["WEB安全"], "text": "我在Hackerone的一个程序中找到了这个XSS，关于这个存储型XSS的有趣之处在于它反映了我找到了从self XSS升级到存储型XSS的方式。此外，我不能透露出漏洞程序名称，因为他们要求不能泄露。"}
{"title": "CNNVD关于微软多个安全漏洞的通报", "url": "https://www.freebuf.com/news/193902.html", "time": "2019-01-11", "level": "", "num_look": 137610, "num_comment": 137610, "author": "CNNVD", "tags": ["漏洞", "资讯"], "text": "近日，微软官方发布了多个安全漏洞的公告，包括Microsoft Windows权限提升等多个漏洞。成功利用上述漏洞的攻击者可以在目标系统上执行任意代码。"}
{"title": "Globelmposter4.0最新变种，2018年最后一发！", "url": "https://www.freebuf.com/articles/terminal/193895.html", "time": "2019-01-11", "level": "", "num_look": 223137, "num_comment": 223137, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "Globelmposter家族首次出现在2017年5月份，2018年2月全国各大医院受Globelmposter2.0勒索病毒攻击，导致医院系统被加密，严重影响了医院的正常业务。"}
{"title": "GDPR实践 | 隐私成熟度模型PM2（一）", "url": "https://www.freebuf.com/articles/database/193658.html", "time": "2019-01-11", "level": "现金奖励", "num_look": 251713, "num_comment": 6, "author": "阿宽kevin", "tags": ["企业安全", "数据安全"], "text": "安全合规的经验告诉我隔壁老王一定有现成的隐私框架：隐私专员国际协会（IAPP，类似于安全的ISC2）推出的隐私成熟度框架！（ISC2、NIST、GAPP也有各自的隐私框架）。"}
{"title": "Pwntools之DynELF原理探究", "url": "https://www.freebuf.com/articles/system/193646.html", "time": "2019-01-11", "level": "现金奖励", "num_look": 200914, "num_comment": 4, "author": "xmwanth", "tags": ["系统安全"], "text": "DynELF是pwntools中专门用来应对没有libc情况的漏洞利用模块，在提供一个目标程序任意地址内存泄漏函数的情况下，可以解析任意加载库的任意符号地址。"}
{"title": "年终来临，关于个人所得税App你需要知道这些事儿", "url": "https://www.freebuf.com/news/193927.html", "time": "2019-01-11", "level": "红色标题", "num_look": 446032, "num_comment": 5, "author": "Karunesh91", "tags": ["数据安全", "资讯"], "text": "“个人所得税”App，你下载了吗？使用了吗？遇到问题了吗？"}
{"title": "Web应用程序防火墙（WAF）bypass技术讨论（一）", "url": "https://www.freebuf.com/news/193627.html", "time": "2019-01-11", "level": "金币+6", "num_look": 159927, "num_comment": 159927, "author": "生如夏花", "tags": ["资讯"], "text": "所有现代Web应用程序防火墙都能够拦截（甚至阻止）RCE，但是当发生在Linux系统时，我们也有很多方法可以bypass WAF的规则集。"}
{"title": "BUF早餐铺丨美运营商被指将手机位置信息出售给第三方：4.95美元/个；航班信息被泄露！海口免税店员工盗用旅客身份证信息买免税商品", "url": "https://www.freebuf.com/news/194030.html", "time": "2019-01-11", "level": "", "num_look": 52429, "num_comment": 52429, "author": "Karunesh91", "tags": ["资讯"], "text": "美运营商被指将手机位置信息出售给第三方：4.95美元/个；航班信息被泄露！海口免税店员工盗用旅客身份证信息买免税商品；发给卡巴斯基实验室的Twitter消息帮助NSA进行数据泄露事件调查"}
{"title": "ThinkPHP 5.0.* 远程命令执行漏洞预警", "url": "https://www.freebuf.com/vuls/194093.html", "time": "2019-01-11", "level": "红色标题", "num_look": 164026, "num_comment": 164026, "author": "360安全", "tags": ["漏洞"], "text": "2019 年 1 月 11 日，360CERT 发现某安全社区出现关于 ThinkPHP5 RCE 漏洞的威胁情报，不久之后 ThinkPHP5 官方与 GitHub 发布更新。该更新修复了一处严重漏洞，该漏洞可导致远程命令代码执行。"}
{"title": "网信办发布区块链信息服务管理规定", "url": "https://www.freebuf.com/news/194008.html", "time": "2019-01-10", "level": "", "num_look": 67677, "num_comment": 1, "author": "AdlerI", "tags": ["资讯"], "text": "国家互联网信息办公室2019年1月10日发布《区块链信息服务管理规定》,自2019年2月15日起施行。"}
{"title": "漏洞预警丨某通用交易所框架组合型严重漏洞", "url": "https://www.freebuf.com/vuls/193960.html", "time": "2019-01-10", "level": "", "num_look": 164520, "num_comment": 7, "author": "BUGX", "tags": ["区块链安全", "漏洞"], "text": "近日出现一个基于POSCMS开发的交易所高危漏洞。此漏洞利用XSS+CSRF组合型通用漏洞，漏洞可把普通会员提升为交易所管理员权限，登录管理后台进行敏感操作。"}
{"title": "Android取证：使用ADB和DD对文件系统做镜像", "url": "https://www.freebuf.com/articles/terminal/193354.html", "time": "2019-01-10", "level": "", "num_look": 178477, "num_comment": 6, "author": "secist", "tags": ["终端安全"], "text": "在这篇文章中，我将为大家分享一些关于我对Android设备镜像采集的想法。"}
{"title": "保护企业免受使用公司WiFi进行未经授权访问的最佳做法", "url": "https://www.freebuf.com/articles/network/192231.html", "time": "2019-01-10", "level": "", "num_look": 117866, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "如果你想保护企业的关键数据，那么企业环境下的WiFi网络安全绝对是你不能忽略的威胁因素。"}
{"title": "Burpsuite Collaborato模块详解", "url": "https://www.freebuf.com/news/193447.html", "time": "2019-01-10", "level": "金币+6", "num_look": 456907, "num_comment": 3, "author": "s1riu5", "tags": ["资讯"], "text": "Burp suite Pro自从v1.6.15版本开始引入了一种名为Burp Collaborator的模块，该模块的作用简单的说就是集合了DNS log, http_https log和smtp_smtps log的记录器，有点类似国内的Ceye平台。"}
{"title": "商业银行数据安全保护体系建设思路", "url": "https://www.freebuf.com/articles/es/193733.html", "time": "2019-01-10", "level": "现金奖励", "num_look": 296214, "num_comment": 4, "author": "haiczh", "tags": ["企业安全"], "text": "近年来，随着商业银行信息化的发展，信息系统越来越多的使用于日常工作，成为不可或缺的工具和手段。"}
{"title": "路由器抓包分析之SMB篇", "url": "https://www.freebuf.com/news/193340.html", "time": "2019-01-10", "level": "金币+6", "num_look": 361553, "num_comment": 5, "author": "꧁", "tags": ["资讯"], "text": "近期路由器等边界设备漏洞频发，正好过来蹭一波热度。边界设备作为网络中必不可少的一部分，但其安全性却一直没有受到大家的重视。"}
{"title": "我们应该了解的JNDI数据源配置", "url": "https://www.freebuf.com/news/193304.html", "time": "2019-01-10", "level": "", "num_look": 112252, "num_comment": 112252, "author": "漏洞盒子", "tags": ["资讯"], "text": "文章主要介绍了JNDI数据源配置和找回密码的方法，只叹范围太大只能写下冰山一角，如有错误还请指出。"}
{"title": "BUF早餐铺 | 泄露德国政客信息的黑客被捕；美国四大主要运营商仍在出卖用户位置数据；“花总”信息泄露案处罚结果公布", "url": "https://www.freebuf.com/news/193922.html", "time": "2019-01-10", "level": "", "num_look": 71835, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "微软再发补丁，提醒用户及时自查更新"}
{"title": "Sodium：一个提供加密、解密、签名等功能的软件库", "url": "https://www.freebuf.com/sectool/193398.html", "time": "2019-01-09", "level": "", "num_look": 224089, "num_comment": 224089, "author": "secist", "tags": ["工具", "数据安全"], "text": "Sodium一个易于使用的可为我们提供加密、解密、签名，密码哈希等功能的软件库。目标是提供构建更高级别加密工具所需的所有核心操作。"}
{"title": "挖洞经验 | Facebook CDN服务器的XSS漏洞", "url": "https://www.freebuf.com/vuls/191898.html", "time": "2019-01-09", "level": "", "num_look": 175918, "num_comment": 5, "author": "clouds", "tags": ["漏洞"], "text": "本文中作者分享的是一个针对Facebook CDN服务器的XSS漏洞，利用该漏洞可以绕过链接中的校验机制，任意执行JS代码。"}
{"title": "CTF中区块链入门教程", "url": "https://www.freebuf.com/articles/blockchain-articles/193357.html", "time": "2019-01-09", "level": "金币+6", "num_look": 274012, "num_comment": 7, "author": "gwenchill", "tags": ["区块链安全"], "text": "近来多个CTF比赛均出现区块链题目，区块链应用越来越成为热门应用，了解和掌握区块链合约漏洞利用实操知识对于萌新来说也是有必要的。"}
{"title": "全球高级持续性威胁（APT）2018年总结报告", "url": "https://www.freebuf.com/articles/paper/193553.html", "time": "2019-01-09", "level": "", "num_look": 243889, "num_comment": 4, "author": "奇安信威胁情报中心", "tags": ["安全报告"], "text": "Threat Actor（即威胁行为体），在威胁情报中用于描述实施网络攻击威胁的个人、团伙或组织以达到其恶意的动机和意图。"}
{"title": "FilesLocker2.1圣诞特别版勒索病毒与早期版本解密工具", "url": "https://www.freebuf.com/sectool/193554.html", "time": "2019-01-09", "level": "红色标题", "num_look": 245124, "num_comment": 6, "author": "深信服千里目安全实验室", "tags": ["工具"], "text": "FilesLocker勒索病毒最新版本的已更新到了FilesLocker2.1，这是一个专门为了庆祝圣诞节而设计命名的版本，中招客户除了系统被加密破坏之外，还有来自勒索作者的节日问候。"}
{"title": "2018网络安全大事件盘点 | 数据泄露史无前例，勒索软件改行挖矿", "url": "https://www.freebuf.com/news/193765.html", "time": "2019-01-09", "level": "", "num_look": 120807, "num_comment": 120807, "author": "Freddy", "tags": ["资讯"], "text": "纵观去年的网络安全整体态势，数据泄露事件最为触目惊心，全年的漏洞采集数量也达到历年的高峰，勒索软件也大有向挖矿的转型之势。"}
{"title": "BUF早餐铺 | Ethereum Classic 疑遭双花攻击；NSA宣布开源GHIDRA逆向工程工具；广东发布净网战报：缴获公民个人信息7.3亿余条", "url": "https://www.freebuf.com/news/193833.html", "time": "2019-01-09", "level": "", "num_look": 70742, "num_comment": 4, "author": "shidongqi", "tags": ["资讯"], "text": "广东省公安厅召开“净网安网2018”专项行动发布会，记者从会上获悉，在此次专项行动中，共侦破网络犯罪案件5000余起，抓获犯罪嫌疑人2.1万余名，缴获公民个人信息7.3亿余条，保证了广大网民上网的安全。"}
{"title": "tknk_scanner：基于社区的集成恶意软件识别系统", "url": "https://www.freebuf.com/sectool/193165.html", "time": "2019-01-08", "level": "", "num_look": 115951, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "tknk_scanner是一个基于社区的集成恶意软件识别系统 ，其旨在通过集成的基于社区的开源工具和软件来自动化的识别恶意软件家族。"}
{"title": "针对密币交易所gate.io的供应链攻击技术分析", "url": "https://www.freebuf.com/articles/web/191959.html", "time": "2019-01-08", "level": "", "num_look": 109620, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "就在前不久，有一个网络犯罪组织成功入侵了StatCounter。StatCounter是一家业界领先的Web分析平台，很多Web管理员都会使用这个服务来收集自家站点的统计数据。"}
{"title": "GDPR实施半年多，你感觉到它的存在了吗？", "url": "https://www.freebuf.com/news/193214.html", "time": "2019-01-08", "level": "", "num_look": 173881, "num_comment": 3, "author": "Karunesh91", "tags": ["网络安全", "资讯"], "text": "可以确定的是，作为史上最为严厉、最为翔实的一部保护数据安全法规，对当前愈演愈烈的信息安全问题来说无异于一剂猛药。"}
{"title": "T-Pot18.11的安装与使用", "url": "https://www.freebuf.com/news/193347.html", "time": "2019-01-08", "level": "现金奖励", "num_look": 532456, "num_comment": 60, "author": "rabbitmask", "tags": ["工具", "资讯"], "text": "之所以把这个蜜罐平台的搭建教程写出来，是因为关于这个平台全网教程实在少之又少，几乎都是相互转载摘抄，甚至还带来了些许误导。"}
{"title": "Java反序列化：基于CommonsCollections4的Gadget分析", "url": "https://www.freebuf.com/articles/others-articles/193445.html", "time": "2019-01-08", "level": "", "num_look": 121398, "num_comment": 2, "author": "京东安全", "tags": ["其他"], "text": "本文主要分为两方面，其一是基于PriorityQueue类的序列化对象的构造，另一方面是PriorityQueue对象在反序列化过程中恶意代码的触发原理。"}
{"title": "安全建设之平台搭建", "url": "https://www.freebuf.com/articles/es/193143.html", "time": "2019-01-08", "level": "现金奖励", "num_look": 349718, "num_comment": 22, "author": "野火", "tags": ["企业安全"], "text": "基础信息搜集包括ip，域名，端口，框架，组件信息。Ip、域名甲方可通过运维同事获取，其他获取方式仁者见仁智者见智。"}
{"title": "BUF早餐铺 | 万豪表示，受漏洞影响的客人不到3.83亿，而不是5亿；热门游戏”塞勒姆小镇“发生数据泄露，760万玩家受到影响；Dark Overlord组织放出第一批650份机密级9/11事件文件的解密密钥", "url": "https://www.freebuf.com/news/193691.html", "time": "2019-01-08", "level": "", "num_look": 134171, "num_comment": 2, "author": "Freddy", "tags": ["资讯"], "text": "虽然泄露的数据数量没有之前预计得多，但万豪也发布了一些坏消息，证实黑客手中有大约525万个未加密的护照号码。"}
{"title": "Tcpreplay：一款用于*NIX和Windows的Pcap编辑和重放的强大工具", "url": "https://www.freebuf.com/sectool/193217.html", "time": "2019-01-07", "level": "", "num_look": 200112, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Tcpreplay的工具，广大研究人员可以利用该工具来在*NIX和Windows平台下实现Pcap的编辑和重放。"}
{"title": "看我如何绕过AMSI并执行任意Powershell代码", "url": "https://www.freebuf.com/articles/system/191753.html", "time": "2019-01-07", "level": "", "num_look": 168771, "num_comment": 2, "author": "Covfefe", "tags": ["系统安全"], "text": "众所周知，AMSI会对获取shell造成麻烦，这篇文章将介绍如何在早期解决此类问题。"}
{"title": "数说2018，FreeBuf年度“网红”都有谁？", "url": "https://www.freebuf.com/news/193574.html", "time": "2019-01-07", "level": "红色标题", "num_look": 979157, "num_comment": 17, "author": "FB客服", "tags": ["资讯"], "text": "再舍不得，2018年已经过去了。在365天里，谁最终成为最勤奋的作者、谁的大作最受Buffer欢迎？谁又成为最活跃“评论家”？还有年度表情包又是哪一张……"}
{"title": "安全运营视角 | 安全思维模型解读谷歌零信任安全架构", "url": "https://www.freebuf.com/articles/network/193197.html", "time": "2019-01-07", "level": "红色标题", "num_look": 228305, "num_comment": 4, "author": "夏石科技", "tags": ["网络安全"], "text": "Google公司BeyondCorp项目迁移部署过程，整个工作大概分为认同与沟通，项目团队组建，切确定迁移策略，业务和访问数据的收集，自动化迁移以及特殊用户场景的处理。"}
{"title": "前端打包编译时代来临对漏洞挖掘的影响", "url": "https://www.freebuf.com/articles/web/193230.html", "time": "2019-01-07", "level": "现金奖励", "num_look": 211415, "num_comment": 2, "author": "傻傻傻傻傻子", "tags": ["WEB安全"], "text": "关注javascript技术的同学一定知道，在CommonJS和ES6中，为了支持模块化，而引入了export/require/import这类东西，模块化可以降低开发的复杂度，用于支撑前端的复杂功能。"}
{"title": "Electrum轻钱包钓鱼事件简析", "url": "https://www.freebuf.com/vuls/193231.html", "time": "2019-01-07", "level": "", "num_look": 190120, "num_comment": 2, "author": "北京链安安全实验室", "tags": ["区块链安全", "漏洞"], "text": "近期比特币轻钱包electrum的部分用户遭到了定向的钓鱼弹窗攻击，用户在使用electrum轻钱包转账的时候提示转账失败。"}
{"title": "BUF早餐铺 | 网络犯罪组织声称掌握9.11事件中的机密理赔信息；USB-C 接口将可加入认证协定，对抗恶意 USB 设备；国家漏洞库月报：2018年12月采集漏洞1275个", "url": "https://www.freebuf.com/news/193563.html", "time": "2019-01-07", "level": "", "num_look": 54757, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "网络犯罪组织DarkOverlord表示，只要相关公司愿意提供比特币赎金，他们可以按照要求删除其中的一些条目。"}
{"title": "前Mt.Gox CEO被诉10年监禁，区块链世界安全还需要多少「门头沟事件」？", "url": "https://www.freebuf.com/news/193628.html", "time": "2019-01-07", "level": "", "num_look": 77769, "num_comment": 77769, "author": "BUGX", "tags": ["资讯"], "text": "2018年末，时隔5年，门头沟事件再重新被人提起，是日本检方要求对门头沟交易所（Mt.Gox ）前CEO马克.卡佩勒斯 判处10年刑期。"}
{"title": "R3Con1Z3R：一款功能强大的轻量级Web信息收集工具", "url": "https://www.freebuf.com/sectool/193222.html", "time": "2019-01-06", "level": "", "num_look": 186764, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫R3con1z3r的轻量级Web信息收集工具，它提供了一个功能强大的基于开源情报（OSINT）指纹的数据收集环境，并可以进行快速且完整的信息收集任务。"}
{"title": "漏洞分析：解析Windows XP版永恒之蓝中的一个Bug", "url": "https://www.freebuf.com/vuls/192236.html", "time": "2019-01-06", "level": "", "num_look": 190075, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["漏洞", "系统安全"], "text": "本次打算重新回顾一下那个针对Windows XP永恒之蓝漏洞的漏洞利用代码，因为FuzzBunch有太多没有被挖掘出来的“潜力”了。"}
{"title": "CVE-2018-19518：PHP imap_open函数任意命令执行漏洞复现", "url": "https://www.freebuf.com/vuls/192712.html", "time": "2019-01-06", "level": "现金奖励", "num_look": 266719, "num_comment": 1, "author": "不分手的恋爱", "tags": ["WEB安全", "漏洞"], "text": "PHP 的imap_open函数中的漏洞可能允许经过身份验证的远程攻击者在目标系统上执行任意命令。"}
{"title": "多功能Kasidet家族病毒解剖", "url": "https://www.freebuf.com/articles/terminal/192987.html", "time": "2019-01-06", "level": "", "num_look": 117168, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "深信服安全团队在云查记录中捕获到一款高度活跃的病毒，对其进行深入分析后确定该病毒为Kasidet家族。"}
{"title": "Windows Sandbox：轻量级桌面环境专为安全运行应用程序而设计", "url": "https://www.freebuf.com/sectool/193164.html", "time": "2019-01-05", "level": "", "num_look": 165610, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Windows Sandbox的特点：Windows系统的默认组件、纯净版、一次性使用、安全和高效。"}
{"title": "AI和网络安全工作的未来", "url": "https://www.freebuf.com/articles/neopoints/192391.html", "time": "2019-01-05", "level": "", "num_look": 135222, "num_comment": 15, "author": "Alpha_h4ck", "tags": ["观点"], "text": "在超级人工智能的世界里，我们人类又应该扮演怎样的角色？"}
{"title": "【重磅】新年免费入驻！漏洞盒子企业SRC服务全面升级", "url": "https://www.freebuf.com/fevents/193452.html", "time": "2019-01-05", "level": "红色标题", "num_look": 167820, "num_comment": 167820, "author": "漏洞盒子", "tags": ["活动"], "text": "漏洞盒子企业SRC服务全面升级~弹性配置&专业服务，全面构建企业级SRC~"}
{"title": "Struts2-005远程代码执行漏洞分析", "url": "https://www.freebuf.com/vuls/193078.html", "time": "2019-01-05", "level": "现金奖励", "num_look": 176831, "num_comment": 1, "author": "水清云影", "tags": ["漏洞"], "text": "S2-005和S2-003的原理是类似的，因为官方在修补S2-003不全面，导致用户可以绕过官方的安全配置（禁止静态方法调用和类方法执行），再次造成的漏洞，可以说是升级版的S2-005是升级版的S2-003。"}
{"title": "2018年IoT那些事儿", "url": "https://www.freebuf.com/articles/terminal/193303.html", "time": "2019-01-05", "level": "现金奖励", "num_look": 217682, "num_comment": 217682, "author": "云鼎实验室", "tags": ["终端安全", "网络安全"], "text": "2018年，是IoT高速发展的一年，从空调到电灯，从打印机到智能电视，从路由器到监控摄像头统统都开始上网。与此同时，IoT的安全问题也慢慢显露了出来。"}
{"title": "数百德国政客个人数据泄露，包括总理默克尔", "url": "https://www.freebuf.com/news/193634.html", "time": "2019-01-04", "level": "", "num_look": 97089, "num_comment": 2, "author": "Karunesh91", "tags": ["资讯"], "text": "再次遭到黑客攻击。德国：为什么受伤的总是我~"}
{"title": "FortiAppMonitor：用于监控macOS上的系统活动的强大工具", "url": "https://www.freebuf.com/sectool/193258.html", "time": "2019-01-04", "level": "金币+8", "num_look": 158928, "num_comment": 2, "author": "倒念", "tags": ["工具", "系统安全"], "text": "FortiAppMonitor是Fortinet开发和发布的一款免费软件，旨在监控macOS上程序的行为。它使用户能够了解恶意软件功能并快速分析针对macOS的恶意软件的恶意行为。"}
{"title": "利用PNG像素隐藏PE代码：分析PNG Dropper新样本", "url": "https://www.freebuf.com/articles/system/191833.html", "time": "2019-01-04", "level": "", "num_look": 143439, "num_comment": 143439, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "在这篇文章中，我们将跟大家介绍Turla组织研发和使用的PNG Dropper恶意软件。"}
{"title": "2018年全球十大APT攻击事件盘点", "url": "https://www.freebuf.com/articles/system/193393.html", "time": "2019-01-04", "level": "红色标题", "num_look": 482946, "num_comment": 3, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "APT攻击（Advanced Persistent Threat，高级持续性威胁）是利用先进的攻击手段对特定目标进行长期持续性网络攻击的攻击形式。"}
{"title": "密码学幼稚园丨密码朋克的社会实验（二）", "url": "https://www.freebuf.com/news/193206.html", "time": "2019-01-04", "level": "", "num_look": 135949, "num_comment": 5, "author": "云鼎实验室", "tags": [], "text": "密码学远不是一篇文章可以聊清楚，大概连当目录都不够。因此，我的目标仅仅是，写一篇小学生也能懂的密码学入门。"}
{"title": "利用Telegram通信的勒索病毒Vendetta，你有见过吗？", "url": "https://www.freebuf.com/articles/terminal/193148.html", "time": "2019-01-04", "level": "", "num_look": 145682, "num_comment": 2, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "Vendetta是一款使用.NET框架开发的勒索病毒样本，会加密主机系统中大部分文件后缀名的文件，加密后缀为.vendetta，并且具有Telegram通信功能。"}
{"title": "EOS回滚攻击手法分析之重放篇", "url": "https://www.freebuf.com/vuls/193236.html", "time": "2019-01-04", "level": "现金奖励", "num_look": 153767, "num_comment": 1, "author": "SlowMist慢雾科技", "tags": ["区块链安全", "漏洞"], "text": "今日凌晨，攻击 BetDice、ToBet 等游戏的黑客团伙再次对 LuckyMe、GameBet 发动攻击，造成数千 EOS 的损失。经过分析，此次黑客采用的手法有别于上一次的攻击。"}
{"title": "BUF早餐铺 | 华为一号文件：网络安全和隐私保护是最高纲领；知名云服务托管商DataResolution.net遭到Ryuk勒索软件攻击；微软推出全新的Microsoft 365安全性和合规性软件包", "url": "https://www.freebuf.com/news/193518.html", "time": "2019-01-04", "level": "", "num_look": 73062, "num_comment": 73062, "author": "Freddy", "tags": ["资讯"], "text": "日前，任正非签发华为2019年一号文件，任正非在文中指出，华为已经明确将网络安全和隐私保护作为工作的最高纲领。"}
{"title": "开放+公益 | 初探国内首个浏览器根证书计划", "url": "https://www.freebuf.com/fevents/193491.html", "time": "2019-01-03", "level": "", "num_look": 151931, "num_comment": 8, "author": "Freddy", "tags": ["活动"], "text": "终于，在全球浏览器根证书这一领域，我们拥有了自己的话语权，同时在保障我国用户网络事务的安全处理方面，具备了自己能够掌握的力量。"}
{"title": "思路决定成败：F12给了我黑色的眼睛我却用它来挖洞", "url": "https://www.freebuf.com/vuls/193146.html", "time": "2019-01-03", "level": "现金奖励", "num_look": 475503, "num_comment": 27, "author": "evil7", "tags": ["WEB安全", "漏洞"], "text": "坐山吃山指哪儿打哪儿，今天就来说说F12除了挂自慰黑页，如何帮助你完成手工审计吧。"}
{"title": "挖洞经验 | Oculus CDN服务器的XSS漏洞", "url": "https://www.freebuf.com/vuls/191905.html", "time": "2019-01-03", "level": "", "num_look": 137339, "num_comment": 4, "author": "clouds", "tags": ["漏洞"], "text": "我来分享一个Facebook旗下公司Oculus网站存在的类似XSS漏洞，该漏洞最终获得了Facebook官方$1500美金的奖励。"}
{"title": "华为一号文件：网络安全和隐私保护是最高纲领", "url": "https://www.freebuf.com/news/193484.html", "time": "2019-01-03", "level": "", "num_look": 111874, "num_comment": 8, "author": "Freddy", "tags": ["资讯"], "text": "日前，任正非签发华为2019年一号文件，任正非在文中指出，华为已经明确将网络安全和隐私保护作为工作的最高纲领。"}
{"title": "腾讯安全2018年高级持续性威胁（APT）研究报告", "url": "https://www.freebuf.com/articles/network/193420.html", "time": "2019-01-03", "level": "", "num_look": 254270, "num_comment": 3, "author": "腾讯电脑管家", "tags": ["安全报告", "网络安全"], "text": "高级可持续性攻击，又称APT攻击，通常由国家背景的相关攻击组织进行攻击的活动。APT攻击常用于国家间的网络攻击行动。"}
{"title": "伪装成“发票到期”电子邮件，传播Neutrino僵尸网络", "url": "https://www.freebuf.com/articles/terminal/192981.html", "time": "2019-01-03", "level": "", "num_look": 164011, "num_comment": 164011, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "深信服安全团队捕获到一个新型垃圾邮件，其中包含受密码保护的Word文档，分析发现是同样类型的Neutrino最新版本僵尸程序。"}
{"title": "甲方企业安全痛点之漏洞管理", "url": "https://www.freebuf.com/articles/es/193261.html", "time": "2019-01-03", "level": "现金奖励", "num_look": 340564, "num_comment": 17, "author": "bigface", "tags": ["企业安全"], "text": "安全不是让业务更高效的事情，而是让业务更复杂的一个事情。"}
{"title": "盘点 | 2018年数据泄露事故Top10", "url": "https://www.freebuf.com/news/193172.html", "time": "2019-01-03", "level": "", "num_look": 169283, "num_comment": 4, "author": "世平信息SPINFO", "tags": ["资讯"], "text": "天下熙熙皆为利来，天下攘攘皆为利往。没有破不了的盾，数据永远不会安全。"}
{"title": "BUF早餐铺 | 欧盟启动15个免费开源软件项目的漏洞奖励计划；FaceBook通过安卓应用追踪用户数据；携程因“泄露用户信息”被罚", "url": "https://www.freebuf.com/news/193480.html", "time": "2019-01-03", "level": "", "num_look": 69472, "num_comment": 3, "author": "AngelaY", "tags": ["资讯"], "text": "越南网络安全新法生效，责令互联网公司删除“有毒”内容；Twitter对推广内容监管不力，让假PayPal账号大肆行骗"}
{"title": "如何多视角发现安全问题，“淘”到不一样的漏洞 ｜FreeBuf 精品公开课", "url": "https://www.freebuf.com/fevents/193228.html", "time": "2019-01-02", "level": "", "num_look": 137233, "num_comment": 137233, "author": "FB客服", "tags": ["FreeBuf公开课", "活动"], "text": "从多维度多视角中发现更多的安全问题，“淘”到不一样的漏洞"}
{"title": "菜鸟学代码审计：Xnuca2018-hardphp详细分析", "url": "https://www.freebuf.com/news/193118.html", "time": "2019-01-02", "level": "金币+8", "num_look": 127335, "num_comment": 5, "author": "leeswi", "tags": [], "text": "代码审计考察面比较广，也比较适合新手练手，涉及到这个题目主要是php mvc框架、session机制以及反序列化的问题。"}
{"title": "What？研究者竟然可以利用智能灯泡渗透和传输敏感数据", "url": "https://www.freebuf.com/articles/wireless/191927.html", "time": "2019-01-02", "level": "金币+8", "num_look": 237867, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["无线安全"], "text": "近期的一项安全研究表明，攻击者可以将智能灯泡的灯光作为通信信道，然后利用这条通信信道来窃取被入侵设备中的敏感数据。"}
{"title": "技术讨论 | Crazyradio获取罗技无线鼠标权限重放攻击实验", "url": "https://www.freebuf.com/articles/wireless/192670.html", "time": "2019-01-02", "level": "现金奖励", "num_look": 243319, "num_comment": 7, "author": "janw3n", "tags": ["无线安全", "极客"], "text": "Mousejack是专门针对无线键鼠的劫持攻击，2016年一家美国物联网安全创业公司Bastille发布了一个关于无线鼠标的漏洞披露报告，称多厂商生产的无线鼠标和无线键盘存在安全漏洞。"}
{"title": "起底游戏、会员代充背后的洗钱之术，你可能是“帮凶”", "url": "https://www.freebuf.com/articles/database/193052.html", "time": "2019-01-02", "level": "红色标题", "num_look": 492431, "num_comment": 10, "author": "GEETEST极验", "tags": ["数据安全"], "text": "通过两起案件，可以一窥黑产利益链网络，各方势力盘根错节，利益环环相扣，令人唏嘘。"}
{"title": "Windows 0day任意文件读取漏洞POC分析", "url": "https://www.freebuf.com/vuls/192876.html", "time": "2019-01-02", "level": "现金奖励", "num_look": 357452, "num_comment": 5, "author": "markyu", "tags": ["漏洞"], "text": "12月20日，国外安全研究员 SandboxEscaper又一次在推特上公布了新的Windows 0 day漏洞细节及PoC，点击查看详情。"}
{"title": "Phantom-Evasion：可以生成绕过大多数反病毒软件的后门程序", "url": "https://www.freebuf.com/sectool/192711.html", "time": "2019-01-02", "level": "金币+8", "num_look": 498442, "num_comment": 14, "author": "不分手的恋爱", "tags": ["工具"], "text": "Phantom-Evasion是一个用python编写的交互式防病毒逃避工具，即使使用最常见的32位msfvenom有效负载（64位有效负载的较低检测率），也能生成（几乎）FUD可执行文件。"}
{"title": "EOS回滚攻击手法分析之黑名单篇", "url": "https://www.freebuf.com/vuls/192935.html", "time": "2019-01-02", "level": "", "num_look": 153157, "num_comment": 153157, "author": "SlowMist慢雾科技", "tags": ["区块链安全", "漏洞"], "text": "2018 年 12 月 19 日，众多游戏类 DApp 遭遇交易回滚攻击，其中包括 BetDice，EOSMax，ToBet 等。按当时 18 元人民币的价格计算，损失超过 500 万人民币。"}
{"title": "BUF早餐铺 | 贩卖470余万条12306用户数据的嫌疑人被刑拘；新的Windows 10 bug可导致任意文件被覆写；个人所得税App存在62例木马为误传", "url": "https://www.freebuf.com/news/193389.html", "time": "2019-01-02", "level": "", "num_look": 85149, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "2019年，祝各位一切都好。"}
{"title": "深入Linux | 如何在任意进程中修改内存保护（含PoC）", "url": "https://www.freebuf.com/articles/system/191865.html", "time": "2019-01-01", "level": "", "num_look": 159224, "num_comment": 1, "author": "Covfefe", "tags": ["系统安全"], "text": "最近，我们遇到一个非常具体的问题：改变任意进程的内存区域的保护标志。解决问题的过程中也学到了关于Linux机制和内核开发相关的东西。"}
{"title": "带外通道（OOB）Bind XML外部实体注入漏洞：PayPal案例研究", "url": "https://www.freebuf.com/articles/web/192887.html", "time": "2019-01-01", "level": "金币+8", "num_look": 119962, "num_comment": 119962, "author": "生如夏花", "tags": ["WEB安全"], "text": "应用程序如果存在解析XML的功能可能会存在XML外部实体注入漏洞，当输入包含对外部实体引用的XML而由不安全配置的XML解析器处理时，会造成漏洞。"}
{"title": "使用HackCube-Special分析胎压传感器信号", "url": "https://www.freebuf.com/vuls/192949.html", "time": "2019-01-01", "level": "金币+8", "num_look": 200465, "num_comment": 200465, "author": "mobier", "tags": ["无线安全", "漏洞"], "text": "通常在户外对胎压系统做安全检测实在不方便，并且一套无线电设备也不是一般入门小白能消费的起的，所以这也是为什么我想打造这样一套低成本便携性无线电攻防设备的原因。"}
{"title": "不平凡的2018，但愿2019能平凡一点", "url": "https://www.freebuf.com/news/193363.html", "time": "2018-12-31", "level": "", "num_look": 91636, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "2018年是不平凡的一年，我想这句话最适合今天说。"}
{"title": "QMKhuehuebr：QMK键盘固件后门", "url": "https://www.freebuf.com/sectool/192064.html", "time": "2018-12-31", "level": "", "num_look": 244358, "num_comment": 2, "author": "周大涛", "tags": ["工具"], "text": "这个文章将教你如何使用qmk固件在键盘上创建一个“后门”。"}
{"title": "使用radare2逆向iOS Swift应用程序", "url": "https://www.freebuf.com/articles/terminal/191595.html", "time": "2018-12-31", "level": "", "num_look": 176664, "num_comment": 176664, "author": "周大涛", "tags": ["终端安全"], "text": "使用 radare2 逆向 iOS Swift 应用程序,我们将使用iGoat应用程序。我们的目标是反编译iOS Swift应用程序的外观。"}
{"title": "应急响应的整体思路和基本流程", "url": "https://www.freebuf.com/articles/terminal/192859.html", "time": "2018-12-31", "level": "", "num_look": 497511, "num_comment": 13, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "不管是普通的企业，还是专业的安全厂商，都不可避免的需要掌握和运用好信息安全的知识、技能，以便在需要的时候，能够御敌千里。"}
{"title": "PHP mt_rand安全杂谈及应用场景详解", "url": "https://www.freebuf.com/vuls/192012.html", "time": "2018-12-31", "level": "现金奖励", "num_look": 207499, "num_comment": 207499, "author": "路过你身边topcoder", "tags": ["数据安全", "漏洞"], "text": "PHP的mt_rand函数作为一个随机数生成工具在程序中被广泛使用，但不能应用于生成安全令牌、核心加解密key等等，所以出现过很多安全问题。"}
{"title": "恶意文档执行命令提取工具：CMD Watcher", "url": "https://www.freebuf.com/sectool/192065.html", "time": "2018-12-30", "level": "", "num_look": 142719, "num_comment": 3, "author": "周大涛", "tags": ["工具"], "text": "在花了大量时间分析各种maldoc之后，我意识到它们有一个共同点。"}
{"title": "MS08-067漏洞的十年回顾", "url": "https://www.freebuf.com/articles/network/191787.html", "time": "2018-12-30", "level": "红色标题", "num_look": 473663, "num_comment": 3, "author": "clouds", "tags": ["网络安全"], "text": "时光荏苒，距离MS08-067漏洞的出现已经过去十年了，与其它安全事件不同，MS08-067漏洞经历了辉煌的一页，具有里程碑意义。"}
{"title": "HTTPS劫匪木马卷土重来，盯上新闻娱乐购物网站", "url": "https://www.freebuf.com/articles/database/192774.html", "time": "2018-12-30", "level": "", "num_look": 200993, "num_comment": 6, "author": "360安全", "tags": ["数据安全", "网络安全"], "text": "近年来，国内各大网站逐渐升级为HTTPS加密连接，在很大程度上提升了网站的安全性。但一向被认为“安全可靠”的HTTPS安全传输协议也无法保证万无一失。"}
{"title": "萌新学逆向：Crackme入门之基础操作分析", "url": "https://www.freebuf.com/articles/system/192831.html", "time": "2018-12-30", "level": "现金奖励", "num_look": 219566, "num_comment": 2, "author": "mintancy", "tags": ["系统安全"], "text": "萌新第一次学习逆向，针对crackme的基础操作分析，在这里也算总结和记录，如有错误之处还请指出。"}
{"title": "WepAttack：一款功能强大的WLAN 802.11 WEP密钥测试工具", "url": "https://www.freebuf.com/sectool/191758.html", "time": "2018-12-29", "level": "", "num_look": 132432, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天，给大家介绍的是一款名叫WepAttack的开源工具。这是一款基于Linux平台的开源WEP密钥破解工具，它主要针对的是WLAN无线安全领域，可利用基于字典攻击的方式破解802.11 WEP密钥。"}
{"title": "千万级下载量的Event-Stream被植入可获取比特币的恶意代码", "url": "https://www.freebuf.com/articles/database/191518.html", "time": "2018-12-29", "level": "", "num_look": 235614, "num_comment": 235614, "author": "clouds", "tags": ["数据安全"], "text": "开源项目event-stream的维护者将恶意代码注入到了依赖项flatmap-stream中，目的为定向窃取使用比特币项目Copay的用户密码私钥等信息以间接盗取比特币，本文我们就来梳理一下。"}
{"title": "企业GDPR安全隐私合规性指南", "url": "https://www.freebuf.com/articles/security-management/192842.html", "time": "2018-12-29", "level": "现金奖励", "num_look": 375253, "num_comment": 6, "author": "zhengliang", "tags": ["企业安全", "安全管理"], "text": "2016年4月27日，欧盟议会通过《一般数据保护条例》》（简称GDPR）,法律条例并已在2018年5月25日生效。"}
{"title": "ARM汇编之内存损坏：堆栈溢出", "url": "https://www.freebuf.com/vuls/192709.html", "time": "2018-12-29", "level": "现金奖励", "num_look": 151523, "num_comment": 4, "author": "xiongchaochao", "tags": ["漏洞"], "text": "本篇文章适用于想要学习ARM汇编在漏洞方面的骚年们。特别是对那些对ARM平台上的漏洞利用写作感兴趣的人。"}
{"title": "浅谈读取USB键盘流量的隐藏数据技巧", "url": "https://www.freebuf.com/articles/network/191815.html", "time": "2018-12-29", "level": "金币+8", "num_look": 128996, "num_comment": 1, "author": "ohhatmy", "tags": ["网络安全"], "text": "wireshark是一款可以用来抓取流量的工具，可以用来发现黑客所做的记录和改动，对分析被攻击情况和进行防御有很大的帮助。"}
{"title": "BUF早餐铺 | 研究人员放出Microsoft Edge内存漏洞利用代码；法国VirusTotal捕获Shamoon 3新变种，使用过期的百度证书签发；澳洲西悉尼大学推出网络安全与行为学位", "url": "https://www.freebuf.com/news/193168.html", "time": "2018-12-29", "level": "", "num_look": 82896, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "寒潮来袭，注意保暖。预祝各位元旦快乐！~"}
{"title": "【中国铁路官方已辟谣】网传超过400万12306用户数据现身暗网", "url": "https://www.freebuf.com/news/193213.html", "time": "2018-12-28", "level": "红色标题", "num_look": 598636, "num_comment": 16, "author": "shidongqi", "tags": ["资讯"], "text": "今天下午圈内又在传一张疑似12306泄露数据暗交易的图，春运抢票高峰还没到，黑产分子就已经出手了。"}
{"title": "F-Secure：针对法国工控行业的一波网络钓鱼攻击", "url": "https://www.freebuf.com/articles/paper/192187.html", "time": "2018-12-28", "level": "", "num_look": 97953, "num_comment": 2, "author": "clouds", "tags": ["安全报告"], "text": "近期，F-Secure监测到了一波针对法国工控行业的网络钓鱼攻击活动，攻击目标涉及法国的化学制造、航空、汽车、银行、工业软件提供商和IT服务提供商等多个行业专门机构。"}
{"title": "挖洞经验 | 用跨站搜索（XS-Search）在谷歌问题跟踪平台实现敏感信息获取", "url": "https://www.freebuf.com/articles/web/191336.html", "time": "2018-12-28", "level": "", "num_look": 154311, "num_comment": 2, "author": "clouds", "tags": ["WEB安全"], "text": "文中，作者详细介绍了在谷歌的Monorail问题跟踪平台（https://bugs.chromium.org/）上 ，实现跨站搜索攻击（XS-Search attack）。"}
{"title": "Elasticsearch核心插件Kibana本地文件包含漏洞分析（CVE-2018-17246）", "url": "https://www.freebuf.com/vuls/192401.html", "time": "2018-12-28", "level": "", "num_look": 276370, "num_comment": 276370, "author": "云影实验室", "tags": ["WEB安全", "漏洞"], "text": "笔者对Elasticsearch 核心插件Kibana本地文件包含漏洞的背景、攻击原理和行为进行分析和复现。"}
{"title": "技术讨论 | 记一次XSS蠕虫渗透实验", "url": "https://www.freebuf.com/vuls/191274.html", "time": "2018-12-28", "level": "现金奖励", "num_look": 323907, "num_comment": 12, "author": "莫妮卡k37", "tags": ["漏洞", "网络安全"], "text": "本文是一次针对XSS+CSRF构造蠕虫的渗透测试。"}
{"title": "ThinkPHP5 RCE漏洞重现及分析", "url": "https://www.freebuf.com/vuls/191847.html", "time": "2018-12-28", "level": "金币+8", "num_look": 742287, "num_comment": 8, "author": "LSA", "tags": ["WEB安全", "漏洞"], "text": "thinkphp发布了安全更新，修复一个可getshell的rce漏洞，由于没有有效过滤$controller，导致攻击者可以利用命名空间的方式调用任意类的方法，进而getshell。"}
{"title": "BUF早餐铺 | 苹果隐私表现不及特斯拉、微软，Facebook垫底；网络犯罪分子通过谷歌云托管用于攻击英美银行的恶意负载；新的Google Chrome攻击可能会让Windows 10设备发生假死", "url": "https://www.freebuf.com/news/193101.html", "time": "2018-12-28", "level": "", "num_look": 107902, "num_comment": 4, "author": "Freddy", "tags": ["资讯"], "text": "在数据研究公司Toluna进行的一项用户个人信息隐私调查中，与苹果相比，特斯拉、微软更受用户信任，毫不意外的是，用户最不信任的科技公司是Facebook。"}
{"title": "深入Exchange Server在网络渗透下的利用方法", "url": "https://www.freebuf.com/articles/web/193132.html", "time": "2018-12-27", "level": "红色标题", "num_look": 435091, "num_comment": 5, "author": "斗象智能安全平台", "tags": ["WEB安全", "企业安全"], "text": "本文将围绕Exchange展开，介绍在渗透测试中对Exchange服务器的攻击利用。"}
{"title": "Sn1per v6.0：一款专为安全专家设计的自动化渗透测试框架", "url": "https://www.freebuf.com/sectool/191767.html", "time": "2018-12-27", "level": "", "num_look": 219049, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Sn1per社区版是一款自动化扫描工具，可在渗透测试过程中帮助研究人员完成漏洞的枚举和扫描任务，而Sn1per专业版作为Xero Security的额外报告插件。"}
{"title": "实际场景下如何在POC中检测Empire的攻击流量", "url": "https://www.freebuf.com/articles/network/191352.html", "time": "2018-12-27", "level": "金币+8", "num_look": 127424, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "近期，我们在对一份来自大型银行客户的PoC进行研究，研究了几天之后，我们在同一台设备上发现了多个安全威胁，其中包括渗透测试过程中常见的威胁。"}
{"title": "胡侃 | 漫漫漏洞扫描之路", "url": "https://www.freebuf.com/articles/network/192905.html", "time": "2018-12-27", "level": "现金奖励", "num_look": 334801, "num_comment": 21, "author": "dawner", "tags": ["网络安全"], "text": "研究漏扫这块儿有段时间了，虽然都是业余自己玩，但平素跟公司漏扫产品线打交道比较多，稍微有些心得，因此在这里简单分享下。"}
{"title": "Flash 0Day: CVE-2018-15982 Exploit复现", "url": "https://www.freebuf.com/vuls/192013.html", "time": "2018-12-27", "level": "现金奖励", "num_look": 204391, "num_comment": 2, "author": "elli0tn0phacker", "tags": ["漏洞", "系统安全"], "text": "2018年12月5日，360发表博客《“毒针”行动 - 针对“俄罗斯总统办所属医疗机构”发起的0day攻击》披露了其在2018年11月29日捕获到的使用Flash 0day：CVE-2018-15982漏洞配合微软Office Word文档发起的APT攻击事件。"}
{"title": "SamSam作者又出来浪了", "url": "https://www.freebuf.com/articles/terminal/192284.html", "time": "2018-12-27", "level": "", "num_look": 161504, "num_comment": 161504, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "最近我们发现SamSam勒索病毒的最新变种样本，编译时间较新，加密后的文件后缀名与之前发现的一款变种一样，同样以.weapologize结尾，加密后的文件无法解密。"}
{"title": "HTTPS网络流量解密方法探索系列（一）", "url": "https://www.freebuf.com/articles/network/192330.html", "time": "2018-12-27", "level": "现金奖励", "num_look": 232986, "num_comment": 12, "author": "scu-igroup", "tags": ["网络安全"], "text": "分析网络流量总是绕不开HTTPS，因其广泛使用甚至是强制使用逐渐被大众熟知，在保证其安全的同时也提高了对流量进行研究的难度。"}
{"title": "BUF早餐铺 | 微软发布IE补丁导致部分联想笔记本电脑无法启动；WannaCry仍在潜伏；网信办发布《金融信息服务管理规定》", "url": "https://www.freebuf.com/news/193070.html", "time": "2018-12-27", "level": "", "num_look": 68313, "num_comment": 68313, "author": "AngelaY", "tags": ["资讯"], "text": "圣诞节前后，谨防钓鱼攻击……"}
{"title": "Nuxeo认证绕过和RCE漏洞（CVE-2018-16341) 分析", "url": "https://www.freebuf.com/vuls/193000.html", "time": "2018-12-26", "level": "红色标题", "num_look": 140713, "num_comment": 1, "author": "斗象智能安全平台", "tags": ["漏洞"], "text": "本文介绍的两个漏洞由笔者发现并提交给官方，CVE编号为：CVE-2018-16341。有趣的是在官方10.3版本的发布日志中并没有提及该漏洞(CVE-2018-16341)，但实际已被修复。"}
{"title": "来年再约，重温 FIT 2019 精彩花絮（附全议题 PPT 下载）", "url": "https://www.freebuf.com/fevents/192956.html", "time": "2018-12-26", "level": "红色标题", "num_look": 155249, "num_comment": 5, "author": "shidongqi", "tags": ["活动"], "text": "人声渐稀，FIT 2019散场了。但身在安全圈的我们会一直坚守，说好了，FIT 2020 我们再约一程，向所有热爱网络安全的人致敬。"}
{"title": "【安全大咖说】思科全球产品管理高级总监Kevin Skahill | FIT2019独家专访", "url": "https://www.freebuf.com/articles/people/192936.html", "time": "2018-12-26", "level": "红色标题", "num_look": 117701, "num_comment": 2, "author": "Freddy", "tags": ["人物志", "活动"], "text": "在FIT 2019大会的间隙，小编对这位来自思科的安全专家进行了专访，聊了聊他对网络安全行业态势、技术的看法和思科的安全业务情况。"}
{"title": "MCExtractor：一款功能强大的微代码分析工具", "url": "https://www.freebuf.com/sectool/191761.html", "time": "2018-12-26", "level": "", "num_look": 118907, "num_comment": 118907, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫MCExtractor的微代码分析工具，大家可以用它来对Intel、AMD、VIA和Freescale的微代码分析。"}
{"title": "挖洞经验 | 看我如何下载了Ebay日本（www.ebay.co.jp）的网站源码", "url": "https://www.freebuf.com/articles/web/191238.html", "time": "2018-12-26", "level": "", "num_look": 208724, "num_comment": 12, "author": "clouds", "tags": ["WEB安全"], "text": "本文要讲述的是我如何利用网站错误配置漏洞，下载了整个Ebay日本（www.ebay.co.jp ）的网站源码。"}
{"title": "商业公司以制作病毒为主业，已有数十万台电脑被感染", "url": "https://www.freebuf.com/articles/paper/192395.html", "time": "2018-12-26", "level": "", "num_look": 146919, "num_comment": 9, "author": "火绒安全", "tags": ["安全报告"], "text": "火绒安全团队发现某商业公司制作的流量劫持病毒\"FakeExtent\"（产品名为\"天馨气象\"），正通过\"WIN7之家\"等下载站中的多款激活工具大范围传播。"}
{"title": "一个Hancitor恶意邮件活动Word文档样本的分析", "url": "https://www.freebuf.com/articles/system/191772.html", "time": "2018-12-26", "level": "现金奖励", "num_look": 220201, "num_comment": 9, "author": "cgf99", "tags": ["系统安全"], "text": "最近，基于word文档的电子邮件攻击愈发猛烈。邮箱收到一封电子邮件，包含如下的WORD附件。文档打开后，内容就是一幅图片，提示要查看具体的传真内容要求用户启动宏。"}
{"title": "观察 | 从几起热点事件看2018年的暗网趋势", "url": "https://www.freebuf.com/articles/paper/192772.html", "time": "2018-12-26", "level": "", "num_look": 177779, "num_comment": 7, "author": "云鼎实验室", "tags": ["安全报告"], "text": "“暗网”， 一个原本局限在IT行业和部分不法群体中的名词，却在2018年不断刷新大众的认知。"}
{"title": "最烂密码、神级密码和逆天改命密码，我已经跪下叫爸爸了！", "url": "https://www.freebuf.com/articles/database/192738.html", "time": "2018-12-26", "level": "红色标题", "num_look": 1345132, "num_comment": 25, "author": "GEETEST极验", "tags": ["数据安全"], "text": "马上就要年终了，在这辞旧迎新的时刻，让我们一起回望2018，展望2019，看看今年的“最烂密码榜单”，这次你上榜了吗？"}
{"title": "BUF早餐铺 | 印度将允许执法与情报机构监控境内电脑上的任何信息；Chrome OS 将在锁屏时禁止 USB 访问；德国威步信息被曝多个漏洞", "url": "https://www.freebuf.com/news/192899.html", "time": "2018-12-26", "level": "", "num_look": 71846, "num_comment": 71846, "author": "shidongqi", "tags": ["资讯"], "text": "印度内政部下属的网络及信息安全部门在上周发布了一项命令，将允许印度的10个执法与情报机构可拦截、监控及解密境内任何电脑上所储存或接收的信息。"}
{"title": "直面企业安全痛点，FIT 2019企业安全俱乐部全议题回顾（附PPT下载）", "url": "https://www.freebuf.com/fevents/192855.html", "time": "2018-12-25", "level": "", "num_look": 147346, "num_comment": 3, "author": "FB客服", "tags": ["活动"], "text": "网络安全已经是全球所有企业都面临的问题，在即将过去的2018年，有多少企业为此付出了严重的代价。2019年，网络安全形势更加严峻，我们该如何应战？"}
{"title": "Scannerl：模块化分布式指纹识别引擎", "url": "https://www.freebuf.com/sectool/191607.html", "time": "2018-12-25", "level": "", "num_look": 123088, "num_comment": 123088, "author": "secist", "tags": ["工具"], "text": "Scannerl是由Kudelski Securit开发的模块化分布式指纹识别引擎，它可以在单个主机上识别数以千计的目标指纹，也可以在多个主机上分布执行分布式的指纹识别。"}
{"title": "又诞生了一个新的更Powerful的挖矿木马", "url": "https://www.freebuf.com/news/191380.html", "time": "2018-12-25", "level": "", "num_look": 103851, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "没错，现在市面上又诞生了一种功能更强大的恶意挖矿软件，利用Windows Server CPU的全部算力来挖矿。值得一提的是，它的攻击频率越来越高了，但是检测率却越来越低…"}
{"title": "一次被防火墙拦截的挖矿病毒应急处置经历", "url": "https://www.freebuf.com/articles/es/192381.html", "time": "2018-12-25", "level": "现金奖励", "num_look": 1595752, "num_comment": 21, "author": "littt0", "tags": ["企业安全"], "text": "在应急响应的过程中，客户反馈服务器僵尸网络警告，服务器试图解析恶意域名msupdate.info。于是客户使用360，火绒剑等杀毒软件均没有发现异常现象。于是求助我，遂有此文章。"}
{"title": "WordPress Plugin AutoSuggest插件SQL注入复现与分析", "url": "https://www.freebuf.com/vuls/191869.html", "time": "2018-12-25", "level": "金币+6", "num_look": 148949, "num_comment": 1, "author": "看不尽的尘埃", "tags": ["漏洞"], "text": "由于笔者有个习惯，每天都会去exploit-db网站上去逛逛。最近就看到了一个WordPress插件问题导致的SQL注入漏洞，抱着好奇的心，我就开始这个漏洞的复现与分析。"}
{"title": "引导舆论导向？伊朗组织通过伪造虚假新闻网站进行宣传和洗脑", "url": "https://www.freebuf.com/articles/network/192255.html", "time": "2018-12-25", "level": "金币+6", "num_look": 127806, "num_comment": 5, "author": "黑鸟", "tags": ["网络安全"], "text": "为了引导民众舆论，通常会采取媒体管控，主流资讯软件管控封禁等方式进行操作。这类手段已经司空见惯了，而近期披露的伊朗组织在这方面的操作却比较与众不同。"}
{"title": "蔓灵花（BITTER）APT组织针对中国境内军工、核能、政府等敏感机构的最新攻击活动报告", "url": "https://www.freebuf.com/articles/database/192726.html", "time": "2018-12-25", "level": "", "num_look": 327256, "num_comment": 6, "author": "腾讯电脑管家", "tags": ["安全报告", "数据安全"], "text": "蔓灵花（T-APT-17、BITTER）APT组织是一个长期针对中国、巴基斯坦等国家进行攻击活动的APT组织，该APT组织为目前活跃的针对境内目标进行攻击的境外APT组织之一。"}
{"title": "5行代码实现AI图像识别，拥有初步内容安全能力", "url": "https://www.freebuf.com/articles/others-articles/191725.html", "time": "2018-12-25", "level": "", "num_look": 111662, "num_comment": 8, "author": "wangyiyunyidun", "tags": ["其他"], "text": "在这篇文章中，我们将简要介绍人工智能领域，特别是计算机视觉领域中遇到的挑战，这些挑战的现有解决方法以及如何快捷地使用这些方法。"}
{"title": "BUF早餐铺 | 全球汽车行业网络安全报告发布；俄罗斯电信监管机构将加强封锁Telegram和其他平台；Apple手机iOS更新，影响信息发送及上网等功能；", "url": "https://www.freebuf.com/news/192815.html", "time": "2018-12-25", "level": "", "num_look": 57237, "num_comment": 57237, "author": "Karunesh91", "tags": ["资讯"], "text": "Merry Christmas。"}
{"title": "专访蚂蚁金服赵闻飙：安全就像长跑，要“又猛又持久”", "url": "https://www.freebuf.com/articles/people/192745.html", "time": "2018-12-24", "level": "红色标题", "num_look": 193193, "num_comment": 2, "author": "Akane", "tags": ["人物志", "活动"], "text": "两年前的8月份，徐玉玉永远地离开了我们，因她而起的轰动事件，仿佛也被时间冲淡了。她长什么样？爱不爱笑？似乎这一切都与我们无关，但在有些人的心里，永远不会遗忘。"}
{"title": "快报！欧盟的外交电报竟然被黑客窃听了？", "url": "https://www.freebuf.com/news/192710.html", "time": "2018-12-24", "level": "", "num_look": 69226, "num_comment": 69226, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "近日，《纽约时报》刊登了一份据称是被黑客窃取来的欧盟外交电报摘录。很显然，这份数据报告是由某家网络安全公司专门“泄露”给记者同志们的。"}
{"title": "Vthunting：通过VT api来自动搜索恶意软件报告的工具", "url": "https://www.freebuf.com/sectool/191594.html", "time": "2018-12-24", "level": "", "num_look": 154329, "num_comment": 2, "author": "周大涛", "tags": ["工具"], "text": "Virus Total Hunting是一个基于VT api版本3的小工具，可以每天，每周或每月搜索有关恶意软件的报告。报告可以通过电子邮件，Slack渠道或Telegram发送。"}
{"title": "利用XSStrike Fuzzing XSS漏洞", "url": "https://www.freebuf.com/articles/web/191003.html", "time": "2018-12-24", "level": "金币+10", "num_look": 361664, "num_comment": 8, "author": "看不尽的尘埃", "tags": ["WEB安全"], "text": "关于XSStrike这款工具虽有前人写过相关资料，但是已经历经一年之久了，这款工具已经发生重大的改变（如从仅支持python2.7 改变为python 3.6），因此还是有必要再次写一下的。"}
{"title": "智慧城市安全体系实例——智能门锁安全吗？", "url": "https://www.freebuf.com/articles/network/191193.html", "time": "2018-12-24", "level": "", "num_look": 172340, "num_comment": 10, "author": "jiweianquan", "tags": ["网络安全"], "text": "当前，智慧城市建设成为全球热点，当前全球已启动或在建的智慧城市数量超过1000个，中国以500个试点城市居于首位，成为了全球最大的智慧城市实施国。"}
{"title": "使用HackCube-Special分析滚动码信号", "url": "https://www.freebuf.com/vuls/192356.html", "time": "2018-12-24", "level": "金币+10", "num_look": 279985, "num_comment": 3, "author": "mobier", "tags": ["无线安全", "漏洞"], "text": "滚动码相比于固定码较为安全一些，因此被广泛部署到需要更强的安全性的设备上，例如汽车、车库。"}
{"title": "我的信息搜集之道", "url": "https://www.freebuf.com/articles/web/190403.html", "time": "2018-12-24", "level": "金币+10", "num_look": 485154, "num_comment": 6, "author": "看不尽的尘埃", "tags": ["WEB安全"], "text": "《Kali Linux 渗透测试的艺术》书中第四章信息搜集那部分有些内容不能适应有些内容不能适用国内，这勾起了我想总结一下国内信息搜集的欲望，于是就有了这篇文章。"}
{"title": "揭秘“驱魔”家族：全国最大的暗刷僵尸网络上线了", "url": "https://www.freebuf.com/articles/system/192275.html", "time": "2018-12-24", "level": "红色标题", "num_look": 239556, "num_comment": 1, "author": "安全豹", "tags": ["系统安全"], "text": "近期，我们通过“捕风”威胁感知系统监控，发现一个以“流量暗刷与劫持”为主要攻击目的的老牌僵尸家族，开始进入活跃期。"}
{"title": "BUF早餐铺 | 研究人员发现新的Windows零日漏洞；Facebook被曝从第三方App收集数据：涉及位置信息；外交部发言人就美在网络安全问题上的错误言行发表谈话", "url": "https://www.freebuf.com/news/192688.html", "time": "2018-12-24", "level": "", "num_look": 87333, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "近日，推特名为 SandboxEscaper 的研究人员披露了一个新的 Windows 0-day 漏洞的 POC，这是他几个月内披露的第三 Windows 0-day 漏洞。"}
{"title": "SNDBOX：结合人工智能与机器学习的恶意软件分析平台", "url": "https://www.freebuf.com/news/191431.html", "time": "2018-12-23", "level": "", "num_look": 129643, "num_comment": 4, "author": "Karunesh91", "tags": ["系统安全", "资讯"], "text": "这是又一款来自以色列的安全平台~"}
{"title": "如何在Azure VMs中大规模运行PowerShell？", "url": "https://www.freebuf.com/articles/system/191155.html", "time": "2018-12-23", "level": "", "num_look": 105948, "num_comment": 1, "author": "secist", "tags": ["系统安全"], "text": "你可以使用Azure Automation（自动化）在Azure VM上运行命令，但是本文我们将重点关注Invoke-AzureRmVMRunComman命令（AzureRM模块的一部分）。"}
{"title": "OWASP Benchmark的搭建和使用", "url": "https://www.freebuf.com/sectool/192351.html", "time": "2018-12-23", "level": "金币+10", "num_look": 245767, "num_comment": 3, "author": "fengchenzxc", "tags": ["工具", "数据安全"], "text": "OWASP benchmark是OWASP组织下的一个开源项目，是免费且开放的测试套件。可以用来评估那些自动化安全扫描工具的速度、覆盖范围和准确性。"}
{"title": "简单实现MySQL数据库的日志审计", "url": "https://www.freebuf.com/articles/es/192062.html", "time": "2018-12-23", "level": "金币+10", "num_look": 248466, "num_comment": 6, "author": "si1ence", "tags": ["企业安全"], "text": "通过收集数据库的日志到企业SOC平台便于安全事件的溯源与故障分析，配合目前的UEBA技术能够轻松发现很多恶意事件。"}
{"title": "CISSP 认证8个知识域的整体观", "url": "https://www.freebuf.com/articles/security-management/192250.html", "time": "2018-12-23", "level": "", "num_look": 252508, "num_comment": 2, "author": "夏石科技", "tags": ["安全管理"], "text": "CISSP的CBK在14年的时候，进了一个比较大的一个变化，从以前的十个知识域变成了八个知识域，把原来的知识点重新进行了组合，比方说把BCP的需求的那一部分搬到安全与风险管理这一个章节。"}
{"title": "BabySploit：一个针对初学者的渗透测试框架", "url": "https://www.freebuf.com/sectool/191272.html", "time": "2018-12-22", "level": "", "num_look": 168188, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "BabySploit是一款由Python编写的渗透测试框架。该框架旨在帮助初学者轻松的学习并掌握其它更为复杂强大的渗透测试框架，如Metasploit。"}
{"title": "挖洞经验 | Facebook Ads广告业务API接口的源代码泄露漏洞", "url": "https://www.freebuf.com/articles/web/191054.html", "time": "2018-12-22", "level": "", "num_look": 201381, "num_comment": 2, "author": "clouds", "tags": ["WEB安全"], "text": "一个多月后，我就发现了存在Facebook Ads广告业务系统API中的一个漏洞。存在漏洞的API是一个图片处理接口，它用于Facebook商户账户上传广告图片。"}
{"title": "记一次对Tomcat网页靶机提权实录", "url": "https://www.freebuf.com/articles/web/192352.html", "time": "2018-12-22", "level": "金币+6", "num_look": 191937, "num_comment": 18, "author": "ivanmolly", "tags": ["WEB安全"], "text": "Apache Tomcat，是世界上最广泛使用的Java Web服务器之一。它是一个应用，允许管理员启动、停止、添加和删除服务器中的应用。"}
{"title": "警惕！你下载的软件可能携带STOP勒索病毒变种", "url": "https://www.freebuf.com/articles/terminal/192059.html", "time": "2018-12-22", "level": "", "num_look": 155385, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "近日，我们的安全团队捕获到一起通过捆绑软件运行勒索病毒的事件。勒索病毒与正常的应用软件捆绑在一起运行，捆绑的勒索病毒为STOP勒索病毒的变种，加密后缀为.djvu。"}
{"title": "新型诈骗花样多，使用多种混淆方法绕过安全检测", "url": "https://www.freebuf.com/articles/network/192648.html", "time": "2018-12-21", "level": "", "num_look": 108741, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "虽然目前大多数反病毒产品都能够检测到技术支持诈骗（TSS）攻击类型，但网络攻击者现在又开始采用各种新的技术来绕过这种安全检测了。"}
{"title": "Vba2Graph：一款通过VBA代码分析恶意软件的强大工具（带GUI）", "url": "https://www.freebuf.com/sectool/191430.html", "time": "2018-12-21", "level": "", "num_look": 144737, "num_comment": 144737, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Vba2Graph的恶意软件分析工具，这款工具可以根据VBA代码来生成调用图，以帮助研究人员更方便地分析恶意文档。"}
{"title": "无需sendmail：巧用LD_PRELOAD突破disable_functions", "url": "https://www.freebuf.com/articles/web/192052.html", "time": "2018-12-21", "level": "现金奖励", "num_look": 541731, "num_comment": 39, "author": "yangyangwithgnu", "tags": ["WEB安全"], "text": "千辛万苦拿到的 webshell 居然无法执行系统命令，怀疑服务端 disable_functions 禁用了命令执行函数，通过环境变量 LD_PRELOAD 劫持系统函数，却又发现目标根本没安装 sendmail。"}
{"title": "技术剖析 | 不可检测的C#、C++反向Shell", "url": "https://www.freebuf.com/articles/network/191147.html", "time": "2018-12-21", "level": "", "num_look": 134994, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "在这篇文章中，我将跟大家分享如何利用C#和C++来开发反病毒产品无法检测到的反向Shell。"}
{"title": "华丽收官 | WitAwards 2018互联网安全年度评选结果公布", "url": "https://www.freebuf.com/news/192644.html", "time": "2018-12-21", "level": "", "num_look": 96493, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "WitAwards 2018评选全程历时54天，累计613项申报及提名，经WIT组委会严格审核，共预录取104席入围项目。让我们共同见证八项大奖的诞生。"}
{"title": "Discuz x3.4前台SSRF漏洞分析", "url": "https://www.freebuf.com/vuls/191698.html", "time": "2018-12-21", "level": "", "num_look": 335445, "num_comment": 1, "author": "Knownsec知道创宇", "tags": ["漏洞"], "text": "近日一个Discuz x3.4前台SSRF漏洞被公开，在和小伙伴复现过程中发现漏洞本身依赖多个特性，导致可利用环境各种缩减和部分条件的强依赖关系大大减小了该漏洞的危害。"}
{"title": "还在用工具激活系统？小心被当做矿机！", "url": "https://www.freebuf.com/articles/terminal/192379.html", "time": "2018-12-21", "level": "红色标题", "num_look": 228292, "num_comment": 14, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "近日，深信服EDR安全团队捕获到一个伪装成激活软件WindowsLoader的病毒样本。经分析，该样本并没有激活功能，其主要功能是安装广告软件以及挖矿程序。"}
{"title": "BUF早餐铺 | 华硕、技嘉多款硬件驱动被爆代码执行漏洞；商业公司以制作病毒为主业；微软发布KB4483235/4483234等更新修复IE浏览器漏洞", "url": "https://www.freebuf.com/news/192402.html", "time": "2018-12-21", "level": "", "num_look": 104799, "num_comment": 104799, "author": "Freddy", "tags": ["资讯"], "text": "华硕和技嘉科技公司的四款硬件驱动程序中被曝存在多个漏洞，可被攻击者用于获取更高的系统权限并执行任意代码。"}
{"title": "Smart Greybox Fuzzing：一种功能更强效率更高的Fuzzer模型", "url": "https://www.freebuf.com/sectool/191395.html", "time": "2018-12-20", "level": "", "num_look": 139388, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["工具"], "text": "近期，有一群研究人员设计出了一种智能灰盒模糊测试模型，他们声称这种Fuzzer模型在搜寻代码库（解析复杂文件）漏洞方面跟现有Fuzzer相比，新模型的漏洞挖掘效率会更高。"}
{"title": "密码朋克的社会实验（一）：开灯看暗网", "url": "https://www.freebuf.com/news/192080.html", "time": "2018-12-20", "level": "红色标题", "num_look": 429716, "num_comment": 7, "author": "云鼎实验室", "tags": [], "text": "与「暗网」关系最密切的另一个词，则非「黑客」莫属。「黑」与「暗」的组合，意味着高超的匿名和隐身技巧，令人忍不住想揭开它精巧的面纱。"}
{"title": "如何成为一名恶意软件逆向与分析专家", "url": "https://www.freebuf.com/articles/neopoints/190889.html", "time": "2018-12-20", "level": "", "num_look": 157065, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["观点"], "text": "到底我们怎样才能成为一名恶意软件研究专家呢？在这篇文章中，我将跟大家分享一下我的独特观点。"}
{"title": "揭秘勒索界“海王”是如何横扫中国的", "url": "https://www.freebuf.com/articles/terminal/191868.html", "time": "2018-12-20", "level": "", "num_look": 161933, "num_comment": 3, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "2018年是一个勒索病毒高发的年度，勒索家族变种、传播方式层出不穷，所谓你方唱罢我登台，明年估计形势会更不乐观。但大家是否会好奇，勒索病毒这么多，到底哪一家“强”呢？"}
{"title": "杀妻骗保案，网络色情产业或许是其中推手", "url": "https://www.freebuf.com/articles/database/191838.html", "time": "2018-12-20", "level": "红色标题", "num_look": 1591387, "num_comment": 9, "author": "GEETEST极验", "tags": ["数据安全"], "text": "故事中“骗保”、“杀妻”等关键词十分刺眼，但是其中牵出的另一个产业或许是你暂时没有注意到的..."}
{"title": "BUF早餐铺 | 微软发布 Windows Sandbox；新型恶意软件可从 Twitter 表情包隐藏的代码中获取指令；捷克认为华为设备对国家安全构成威胁；华为未来五年将投资20亿美元强化网络安全", "url": "https://www.freebuf.com/news/192388.html", "time": "2018-12-20", "level": "", "num_look": 79518, "num_comment": 79518, "author": "AngelaY", "tags": ["资讯"], "text": "AV-TEST给出了适用于Android的最佳安全应用程序名单；大规模伪装成Apple Store 付款收据的 Apple ID 钓鱼攻击出现"}
{"title": "CNNVD关于微软多个安全漏洞的通报", "url": "https://www.freebuf.com/news/191802.html", "time": "2018-12-20", "level": "", "num_look": 110241, "num_comment": 110241, "author": "CNNVD", "tags": ["资讯"], "text": "近日，微软官方发布了多个安全漏洞的公告，包括Microsoft Internet Explorer 安全漏洞、Microsoft Excel安全漏洞等多个漏洞，成功利用上述漏洞可以在目标系统上执行任意代码。"}
{"title": "QQ二十年沉浮起落，黑产从未缺席", "url": "https://www.freebuf.com/articles/security-management/192298.html", "time": "2018-12-19", "level": "红色标题", "num_look": 226266, "num_comment": 7, "author": "GEETEST极验", "tags": ["安全管理"], "text": "20年，QQ发展高潮迭起，一路高歌猛进，打开了即时社交的大门。但与此同时，黑产也嗅着利益的味道向我们走来，在这场网络社交变革的浪潮里，他们迅速的成长壮大起来。"}
{"title": "tRat：一种出现在多起垃圾电子邮件活动中的新型模块化RAT", "url": "https://www.freebuf.com/articles/terminal/191004.html", "time": "2018-12-19", "level": "", "num_look": 124686, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "tRat是一款采用Delphi开发的模块化RAT，这款RAT在今年9月份和10月份的恶意活动中首次出现。"}
{"title": "技术探讨 | 利用Windows系统字体来创建恶意软件", "url": "https://www.freebuf.com/articles/system/190740.html", "time": "2018-12-19", "level": "", "num_look": 113132, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "攻击者无需通过嵌入代码或Payload来传递外部文件，因为所有需要用到的执行载体在目标主机上都已经准备好了。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列-Kevin Roh", "url": "https://www.freebuf.com/video/192299.html", "time": "2018-12-19", "level": "红色标题", "num_look": 182279, "num_comment": 1, "author": "willhuang", "tags": ["视频"], "text": "Kevin Roh，推特名@rohk_infosec，美籍韩裔人，现任职旧金山湾区Okta公司应用安全工程师。主要承担了Web漏洞挖掘、分析验证和渗透测试工作，并积极参与了HackerOne的各种线下赛和邀请赛。"}
{"title": "Linux.Omni IoT恶意软件分析", "url": "https://www.freebuf.com/articles/ics-articles/192066.html", "time": "2018-12-19", "level": "", "num_look": 267169, "num_comment": 5, "author": "周大涛", "tags": ["工控安全"], "text": "本文将研究最近在我们的蜜罐中检测到的恶意软件Linux.Omni僵尸网络。"}
{"title": "Donot（APT-C-35）组织对在华巴基斯坦商务人士的定向攻击活动分析", "url": "https://www.freebuf.com/articles/system/191859.html", "time": "2018-12-19", "level": "", "num_look": 118625, "num_comment": 3, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "近期，国内安全团队协助用户处理了多起非常有针对性的邮件钓鱼攻击事件，被攻击目标包括中国境内的巴基斯坦重要商务人士。"}
{"title": "CVE-2018-1111复现环境搭建与dhcp命令注入", "url": "https://www.freebuf.com/articles/web/191884.html", "time": "2018-12-19", "level": "现金奖励", "num_look": 221715, "num_comment": 16, "author": "m0nshaw", "tags": ["WEB安全"], "text": "最近留意到CVE-2018-1111这个洞，关于dhcp命令注入，便想复现一波。"}
{"title": "BUF早餐铺 | 谷歌在“蜻蜓计划”遭抗议后宣布暂停该数据收集项目；比特币生成器诈骗网站已获利0.8枚BTC；北京首次打掉撞库诈骗产业链团伙", "url": "https://www.freebuf.com/news/192307.html", "time": "2018-12-19", "level": "", "num_look": 101780, "num_comment": 6, "author": "shidongqi", "tags": ["资讯"], "text": "近日，北京市公安局海淀分局通过发挥专业优势，不断深化网络犯罪打击深度和广度，破获北京首例通过撞库盗号实施诈骗的产业链条，3名犯罪嫌疑人被刑事拘留。"}
{"title": "kbd-audio：通过麦克风来捕获和分析键盘输入的工具", "url": "https://www.freebuf.com/sectool/191015.html", "time": "2018-12-18", "level": "", "num_look": 142175, "num_comment": 3, "author": "secist", "tags": ["工具"], "text": "kbd-audio项目是一系列用于捕获和分析音频数据的命令行和GUI工具的集合，有一款工具叫keytap，它可以通过麦克风来捕获和分析键盘的输入，从而猜测出按键内容。"}
{"title": "技术分析 | 浅析无文件攻击", "url": "https://www.freebuf.com/articles/system/190693.html", "time": "2018-12-18", "level": "", "num_look": 238614, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "在信息安全领域中，“无文件攻击”属于一种影响力非常大的安全威胁。攻击者在利用这种技术实施攻击时，不会在目标主机的磁盘上写入任何的恶意文件，因此而得名“无文件攻击”。"}
{"title": "安全思维模型解读谷歌零信任安全架构（安全设计视角）", "url": "https://www.freebuf.com/articles/network/191017.html", "time": "2018-12-18", "level": "红色标题", "num_look": 458776, "num_comment": 12, "author": "夏石科技", "tags": ["网络安全"], "text": "本篇是安全思维模型解读谷歌零信任安全架构系列文章。BeyondCorp实际上是抛弃了对本地内网的信任，进而提出了一个新的方案，取代基于网络边界构筑安全体系的传统做法。"}
{"title": "使用钓鱼lnk针对英国、瑞士金融、贸易公司的定向攻击活动", "url": "https://www.freebuf.com/articles/database/191900.html", "time": "2018-12-18", "level": "", "num_look": 248966, "num_comment": 4, "author": "腾讯电脑管家", "tags": ["数据安全", "网络安全"], "text": "文中这些lnk构造巧妙，全程无PE文件落地（Fileless攻击），并且把解密key和C2存放在了twitter、youtube等社交站点上。"}
{"title": "白话物联网安全（三）：IoT设备的安全防御", "url": "https://www.freebuf.com/articles/wireless/192086.html", "time": "2018-12-18", "level": "现金奖励", "num_look": 324278, "num_comment": 1, "author": "大胖", "tags": ["无线安全"], "text": "我们这次先说IoT设备的安全，谈IoT设备安全防御，这次谈IoT的设备安全，咱们先要涉及到IoT的协议，现在IoT的协议非常多，主要设计这些，蓝牙，Zigbee，Z－Wave，6LowPAN，线程，WiFi等等。"}
{"title": "一场精心策划的针对驱动人生公司的定向攻击活动分析", "url": "https://www.freebuf.com/articles/system/192194.html", "time": "2018-12-18", "level": "", "num_look": 390662, "num_comment": 20, "author": "腾讯电脑管家", "tags": ["数据安全", "系统安全"], "text": "“驱动人生”系列软件升级通道传播的木马突然爆发，仅2个小时受攻击用户就高达10万。该病毒会通过云控下发恶意代码，包括收集用户信息、挖矿等，同时利用“永恒之蓝”高危漏洞进行扩散。"}
{"title": "BUF早餐铺丨罗技Options被曝漏洞可招致按键注入攻击；SQLite被曝存在漏洞，所有Chromium浏览器受影响；", "url": "https://www.freebuf.com/news/192240.html", "time": "2018-12-18", "level": "", "num_look": 81147, "num_comment": 2, "author": "Karunesh91", "tags": ["资讯"], "text": "年关将至，新闻也是五花八门。让我们看看这两天发生了什么有意思的事。"}
{"title": "FBI 数万名特工信息遭披露，英美法多国情报机构均受影响", "url": "https://www.freebuf.com/news/192180.html", "time": "2018-12-17", "level": "红色标题", "num_look": 164467, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "FBI 两万多名警员数据被泄露出来了。看到“FBI”的字眼，惺忪一上午的睡眼立马亮起来了，顺着他提供的一些线索，我发现不只是FBI，连英国、法国的情报机构也受到影响……"}
{"title": "UPnProxy：一种利用路由器UPnP漏洞的恶意代理系统", "url": "https://www.freebuf.com/articles/terminal/191013.html", "time": "2018-12-17", "level": "", "num_look": 170131, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "全球大约有350多万台设备部署了UPnP，其中大概有28万台设备存在安全问题。研究人员表示，现在已经有接近5万台设备受到了UpNp NAT注入攻击活动的入侵。"}
{"title": "挖洞经验 | 价值$7500的Google MyAccount服务端点击劫持漏洞（Clickjacking）", "url": "https://www.freebuf.com/vuls/190709.html", "time": "2018-12-17", "level": "", "num_look": 187814, "num_comment": 8, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "最近，我发现了Google My Account（myaccount.google.com）的一个点击劫持漏洞（Clickjacking），并最终收获了$ 7,500的赏金。"}
{"title": "聚焦企业安全，助推生态建设丨FIT 2019中国首席信息安全官高峰论坛议题回顾", "url": "https://www.freebuf.com/news/191933.html", "time": "2018-12-17", "level": "红色标题", "num_look": 84353, "num_comment": 2, "author": "Karunesh91", "tags": ["资讯"], "text": "今年「智慧赋能·安全变革」为主题，聚焦企业安全建设、物联网安全、人工智能安全、网络安全法等年度热点话题，深入探讨企业信息安全技术与实践应用。"}
{"title": "CVE-2018-17612：没想到吧？买个耳机也能遭遇中间人攻击", "url": "https://www.freebuf.com/articles/network/191906.html", "time": "2018-12-17", "level": "", "num_look": 207418, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "当用户在安装森海塞尔的HeadSetup软件时，软件还会在“受信任的根证书颁发机构存储库”中安装一个根证书以及一个加密版本的证书私钥，这是一种非常不安全的行为。"}
{"title": "使用HackCube-Special分析固定码信号", "url": "https://www.freebuf.com/articles/wireless/191534.html", "time": "2018-12-17", "level": "金币+10", "num_look": 303344, "num_comment": 7, "author": "mobier", "tags": ["无线安全"], "text": "HackCube-Special 是一款低成本，便携式，可工作在多个无线射频频段的无线电安全审计平台。我们会给 HackCube-Special 提供丰富的案例，方便初学者能够更好的了解无线电安全领域。"}
{"title": "AFL漏洞挖掘技术漫谈（一）：用AFL开始你的第一次Fuzzing", "url": "https://www.freebuf.com/articles/system/191543.html", "time": "2018-12-17", "level": "", "num_look": 459996, "num_comment": 5, "author": "alphalab", "tags": ["系统安全"], "text": "模糊测试（Fuzzing）技术作为漏洞挖掘最有效的手段之一，近年来一直是众多安全研究人员发现漏洞的首选技术。AFL、LibFuzzer、honggfuzz等操作简单友好的工具相继出现，也极大地降低了模糊测试的门槛。"}
{"title": "疑似国内某知名团伙的最新挖矿脚本分析", "url": "https://www.freebuf.com/articles/web/191867.html", "time": "2018-12-17", "level": "现金奖励", "num_look": 262975, "num_comment": 6, "author": "si1ence", "tags": ["WEB安全"], "text": "这是一个做工精良的挖矿脚本套装，后续跟踪发现可能与国内某知名的挖矿团伙有关系，遂有此文。"}
{"title": "10亿公民指纹泄漏、亚马逊人脸跟踪系统上线，2018隐私保护告急", "url": "https://www.freebuf.com/articles/database/191738.html", "time": "2018-12-17", "level": "红色标题", "num_look": 186528, "num_comment": 3, "author": "GEETEST极验", "tags": ["数据安全"], "text": "这些比你的身份证还全面、精确的数据，若被别有用心的人加以利用，后果极为严重。在这样的一个大数据时代，我们的数据与隐私该何去何从呢。"}
{"title": "BUF早餐铺 | Twitter 公布今年上半年透明度报告；伊朗相关黑客利用网络钓鱼攻击活动人士和美国官员；这些严重漏洞让4亿微软账户险遭暴露", "url": "https://www.freebuf.com/news/192071.html", "time": "2018-12-17", "level": "", "num_look": 73420, "num_comment": 73420, "author": "shidongqi", "tags": ["资讯"], "text": "Twitter 公布了今年上半年的透明度报告，称它从政府收到的信息披露请求增长了 10%，这是 2015 年以来最高的增长比例。"}
{"title": "SubDomainizer：用于查找页面Javascript文件中隐藏子域的工具", "url": "https://www.freebuf.com/sectool/190891.html", "time": "2018-12-16", "level": "", "num_look": 132386, "num_comment": 3, "author": "secist", "tags": ["工具"], "text": "SubDomainizer是一款用于查找隐藏在页面的内联和引用Javascript文件中子域的工具。除此之外，它还可以为我们从这些JS文件中检索到S3 bucket，云端URL等等。"}
{"title": "挖洞经验 | Google服务端Referer信息泄露漏洞", "url": "https://www.freebuf.com/vuls/190605.html", "time": "2018-12-16", "level": "", "num_look": 180607, "num_comment": 9, "author": "clouds", "tags": ["漏洞"], "text": "该漏洞原因在于，Google服务端发生网页请求时，HTTP Referer报文头中泄露了用户隐私和token信息，依葫芦画瓢，我发现Google的4个服务端存在该漏洞，最终收获了共$4633.7美金的赏金。"}
{"title": "GhostPetya骷髅头勒索病毒袭卷半导体行业，深信服率先推出解决方案", "url": "https://www.freebuf.com/articles/terminal/191592.html", "time": "2018-12-16", "level": "", "num_look": 125629, "num_comment": 125629, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "近日，国内半导体行业爆发勒索病毒，造成业务大面积瘫痪，发现其攻击手段与早期Petya勒索病毒有相似之处，但又有很大不同。"}
{"title": "威胁预警 | ThinkPHP v5新漏洞攻击案例首曝光", "url": "https://www.freebuf.com/vuls/191785.html", "time": "2018-12-16", "level": "", "num_look": 1466543, "num_comment": 1, "author": "阿里云安全", "tags": ["漏洞"], "text": "此次漏洞由ThinkPHP v5框架代码问题引起，其覆盖面广，且可直接远程执行任何代码和命令。电子商务行业、金融服务行业、互联网游戏行业等网站使用该ThinkPHP框架比较多，需要格外关注。"}
{"title": "GOSINT：开源智能（OSINT）方面较新的一款工具", "url": "https://www.freebuf.com/sectool/190996.html", "time": "2018-12-15", "level": "", "num_look": 158290, "num_comment": 158290, "author": "secist", "tags": ["工具"], "text": "gOSINT是一款使用Go语言编写的开源智能信息收集工具。由于该工具刚推出不久，因此目前仍处在开发之中。"}
{"title": "技术讨论 | 如何利用虚假浏览器更新渗透MikroTik路由器实验", "url": "https://www.freebuf.com/articles/terminal/190406.html", "time": "2018-12-15", "level": "", "num_look": 125479, "num_comment": 1, "author": "周大涛", "tags": ["终端安全"], "text": "去年夏天，SpiderLabs的研究人员通过被黑客入侵的MikroTik设备发现了可能是最大的恶意Coinhive活动，现在已经演变成一个更广泛的问题。"}
{"title": "“驱动人生”利用高危漏洞传播病毒，12月14日半天感染数万台电脑", "url": "https://www.freebuf.com/vuls/192014.html", "time": "2018-12-15", "level": "红色标题", "num_look": 320650, "num_comment": 14, "author": "火绒安全", "tags": ["安全报告", "漏洞"], "text": "12月14日，火绒安全团队发现\"驱动人生\"旗下多款软件携带后门病毒DTStealer，仅半天时间感染了数万台电脑。"}
{"title": "2019年五大网络威胁走势预测", "url": "https://www.freebuf.com/news/191299.html", "time": "2018-12-15", "level": "红色标题", "num_look": 123359, "num_comment": 2, "author": "Karunesh91", "tags": ["资讯"], "text": "科技是把双刃剑，改善生活的同时，也带来了不少烦恼。"}
{"title": "区块链RPC攻击借“链”还魂，小蚁币持有者警惕盗币风险", "url": "https://www.freebuf.com/articles/blockchain-articles/191776.html", "time": "2018-12-15", "level": "", "num_look": 137523, "num_comment": 137523, "author": "腾讯安全", "tags": ["区块链安全"], "text": "腾讯安全湛泸实验室监测到著名区块链项目NEO存在远程盗币风险。该攻击场景与今年年初被广泛披露的以太坊RPC攻击极为相似，严重危害了NEO用户的数字资产安全。"}
{"title": "CNNVD关于ThinkPHP远程代码执行漏洞情况的通报", "url": "https://www.freebuf.com/vuls/191800.html", "time": "2018-12-14", "level": "", "num_look": 146040, "num_comment": 2, "author": "CNNVD", "tags": ["漏洞"], "text": "国家信息安全漏洞库（CNNVD）收到关于ThinkPHP远程代码执行漏洞（CNNVD-201812-617）情况的报送。成功利用此漏洞的攻击者可以对目标系统进行远程代码执行攻击。"}
{"title": "2018弱密码TOP 100出炉：123456再次卫冕", "url": "https://www.freebuf.com/news/191961.html", "time": "2018-12-14", "level": "红色标题", "num_look": 206126, "num_comment": 9, "author": "shidongqi", "tags": ["资讯"], "text": "2018年眼看着就要结束了，SplashData 一年一度的弱密码TOP 100榜单也终于公布了。今年，网红弱密码“123456”再次卫冕。"}
{"title": "Armor：一款功能强大的macOS Payload加密工具，可绕过大部分AV", "url": "https://www.freebuf.com/sectool/190620.html", "time": "2018-12-14", "level": "", "num_look": 125602, "num_comment": 125602, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Armor的macOS Payload加密工具，Armor是一个功能强大的Bash脚本，通过它来创建的加密macOS Payload能够绕过反病毒扫描工具。"}
{"title": "Mac上的加密货币价格追踪应用CoinTicker后门分析", "url": "https://www.freebuf.com/articles/blockchain-articles/190408.html", "time": "2018-12-14", "level": "", "num_look": 115277, "num_comment": 115277, "author": "周大涛", "tags": ["区块链安全"], "text": "CoinTicker应用程序似乎是一个合法的应用程序，可能对投资加密货币的人有用。但实际上这款应用不仅秘密地安装了后门，而且还安装了两个不同的后门。"}
{"title": "合规就代表安全了吗？那可不一定", "url": "https://www.freebuf.com/news/191548.html", "time": "2018-12-14", "level": "红色标题", "num_look": 132073, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "全球范围内围绕网络安全、数据保护等重要制度立法、执法和司法活动都在积极推动。但是一部分企业在合规过程中往往被一叶障目，以为合规了数据就安全了，真的是这样吗？"}
{"title": "具备多病毒功能！MiraiXMiner物联网僵尸网络攻击来袭", "url": "https://www.freebuf.com/articles/terminal/191303.html", "time": "2018-12-14", "level": "", "num_look": 214797, "num_comment": 4, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "近日出现一种新型的物联网僵尸网络，其融合了多种已知病毒家族的特点，包括Mirai物联网僵尸网络病毒、MyKings僵尸网络病毒等，传播方式非常多样化。"}
{"title": "FIT 2019收官日主论坛全记录，明年见！", "url": "https://www.freebuf.com/fevents/191885.html", "time": "2018-12-13", "level": "红色标题", "num_look": 657002, "num_comment": 9, "author": "Freddy", "tags": ["活动"], "text": "今天的大会主论坛包含「WIT2018现场最受欢迎奖颁奖」和「前沿安全神盾局」两大主题，与来自全球的安全从业者、优秀技术专家、企业安全建设者、白帽专家、研究机构等同展开演讲与探讨。"}
{"title": "Evilginx2：一款用于网络钓鱼窃取凭证及cookie的中间人攻击框架", "url": "https://www.freebuf.com/sectool/190646.html", "time": "2018-12-13", "level": "", "num_look": 143642, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "Evilginx2是一个可窃取登陆凭证及cookie，并可绕过双因素身份验证的中间人网络钓鱼攻击框架。"}
{"title": "搭建自己的硬件植入工具", "url": "https://www.freebuf.com/articles/terminal/190409.html", "time": "2018-12-13", "level": "", "num_look": 135987, "num_comment": 1, "author": "周大涛", "tags": ["终端安全"], "text": "智能平台管理接口（IPMI）是一组计算机接口规范，用于自主计算机子系统，提供独立于主机系统的CPU，固件（BIOS或UEFI）和操作系统的管理和监视功能。"}
{"title": "来年再见 | FIT 2019 互联网安全创新大会图文直播", "url": "https://www.freebuf.com/fevents/191692.html", "time": "2018-12-13", "level": "红色标题", "num_look": 828426, "num_comment": 16, "author": "FB客服", "tags": ["活动"], "text": "恰逢双十二，由FreeBuf主办的FIT 2019大会将正式来开帷幕。在为期两天的时间里，我们将同来自全球各地的合作伙伴、白帽子等汇聚一堂，经历一场烧脑而又充满趣味的年度大趴。"}
{"title": "Hacking-Lab top 10系列教程", "url": "https://www.freebuf.com/news/191194.html", "time": "2018-12-13", "level": "金币+8", "num_look": 155235, "num_comment": 3, "author": "Rogerd", "tags": [], "text": "以下报告按照官网的要求写的，每一份报告需要三个部分，解释安全问题、解释你的攻击、解释缓解。"}
{"title": "快讯 | “黑客教父”原是无业男，涉嫌非法利用信息网络罪被刑拘", "url": "https://www.freebuf.com/news/191850.html", "time": "2018-12-13", "level": "红色标题", "num_look": 277742, "num_comment": 33, "author": "shidongqi", "tags": ["资讯"], "text": "“马云一个亿聘请被拒绝”“中国最年轻黑客教父”，这一个个响亮的称号被放在了一名无业的青年男子郭某身上。"}
{"title": "Adobe再出漏洞，一个Word文档就能控制电脑", "url": "https://www.freebuf.com/news/191533.html", "time": "2018-12-13", "level": "", "num_look": 162691, "num_comment": 3, "author": "Karunesh91", "tags": ["系统安全", "资讯"], "text": "一个小小的word文档就能获得系统控制权，这届黑客会玩~"}
{"title": "BUF早餐铺 | FIT 2019 特制版", "url": "https://www.freebuf.com/news/191842.html", "time": "2018-12-13", "level": "", "num_look": 85999, "num_comment": 85999, "author": "AngelaY", "tags": ["资讯"], "text": "FIT 2019 大会第二天，不见不散"}
{"title": "安全圈年终大趴，FIT 2019首日盛况全程回顾", "url": "https://www.freebuf.com/news/191817.html", "time": "2018-12-12", "level": "红色标题", "num_look": 169154, "num_comment": 14, "author": "shidongqi", "tags": ["资讯"], "text": "近半年的时间精心筹备，只为了不辜负大家的期待。如果说去年我们做的还不够好，那今年FIT 2019从开场、议题质量、Hack Demo展示等环节，到场外趣味设施、厂商展台安排，一定能够给各位一个满意的答复。"}
{"title": "德国数据监管机构将调查摩拜单车是否违反欧盟数据保护法，摩拜回应称尚未接到问询", "url": "https://www.freebuf.com/news/191810.html", "time": "2018-12-12", "level": "", "num_look": 70745, "num_comment": 1, "author": "AdlerI", "tags": ["资讯"], "text": "据英国《金融时报》报道，柏林的数据保护监管机构表示，将调查摩拜单车的数据和隐私政策，原因是怀疑其违反欧盟数据保护法。"}
{"title": "Movil Secure：Google Play上的虚假银行App分析", "url": "https://www.freebuf.com/articles/terminal/190390.html", "time": "2018-12-12", "level": "", "num_look": 110227, "num_comment": 110227, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "随着金融技术的不断发展，用户会不断在特定的银行App中寻找某些特殊服务，这也给网络犯罪分子提供了可乘之机。"}
{"title": "挖洞经验 | 看我如何发现影响20多个Uber子域名的XSS漏洞", "url": "https://www.freebuf.com/vuls/190464.html", "time": "2018-12-12", "level": "", "num_look": 181394, "num_comment": 3, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "大家好，今天我要分享的是一个影响20多个Uber子域名的XSS漏洞，该漏洞存在于uberinternal.com身份验证时向uber.onelogin.com的跳转过程中，漏洞最终获得了Uber官方$2500美金奖励。"}
{"title": "Mint木马变种泛滥，伪装“抖音电脑版”肆虐网络", "url": "https://www.freebuf.com/news/191461.html", "time": "2018-12-12", "level": "", "num_look": 114201, "num_comment": 4, "author": "安全豹", "tags": ["资讯"], "text": "近期，国内安全实验室通过“捕风”威胁感知系统的数据监控，发现一款名为“西瓜看图”的恶意软件。该软件主要通过“荒野行动电脑版”、“抖音电脑版”等虚假下载器进行传播。"}
{"title": "BlueMushroom组织最新动向及近年攻击活动揭露", "url": "https://www.freebuf.com/articles/paper/190951.html", "time": "2018-12-12", "level": "", "num_look": 116165, "num_comment": 116165, "author": "Threatbook", "tags": ["安全报告"], "text": "BlueMushroom又名“蓝宝菇”，具备地缘政治背景，自2011年开始活跃，长期针对我国政府、教育、海洋、贸易、军工、科研和金融等重点单位和部门开展持续的网络间谍活动。"}
{"title": "Google网页快照对抗小技巧", "url": "https://www.freebuf.com/articles/web/190890.html", "time": "2018-12-12", "level": "金币+8", "num_look": 346012, "num_comment": 7, "author": "toptop", "tags": ["WEB安全"], "text": "我们有没有办法和Google对抗一下，让我的网站不能被网页快照收录？办法肯定是有的。"}
{"title": "致热爱网络安全的你 |  FIT 2019 参会指南", "url": "https://www.freebuf.com/fevents/191661.html", "time": "2018-12-12", "level": "红色标题", "num_look": 120751, "num_comment": 4, "author": "FB客服", "tags": ["活动"], "text": "如果你刚好错过了魔都2018年的第一场雪，无需遗憾，毕竟这应该不是最后一场；而一年一度的FIT 2019 互联网安全盛会，错过了却只有期盼来年。"}
{"title": "CMSScan：一款适用于WordPress、Drupal、Joomla、vBulletin的安全扫描工具", "url": "https://www.freebuf.com/sectool/190361.html", "time": "2018-12-11", "level": "", "num_look": 201066, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫CMSScan的针对内容管理系统的安全扫描工具，各位安全研究人员可以使用CMSScan来检测WordPress、Drupal、Joomla和vBulletin网站的安全问题。"}
{"title": "瑞星2018勒索病毒全面分析报告", "url": "https://www.freebuf.com/articles/paper/190482.html", "time": "2018-12-11", "level": "", "num_look": 187783, "num_comment": 15, "author": "瑞星", "tags": ["安全报告"], "text": "勒索病毒是黑客通过锁屏、加密等方式劫持用户设备或文件，并以此敲诈用户钱财的恶意软件。若不支付，则被锁文件将无法恢复。"}
{"title": "一篇文章带你领悟Frida的精髓（基于安卓8.1）", "url": "https://www.freebuf.com/articles/system/190565.html", "time": "2018-12-11", "level": "金币+5", "num_look": 532168, "num_comment": 12, "author": "Roy_Chen", "tags": ["系统安全"], "text": "现在frida非常火热，该框架从Java层hook到Native层hook无所不能，虽然持久化还是要依靠Xposed和hookzz等开发框架，但是frida的动态和灵活对逆向以及自动化逆向的帮助非常巨大。"}
{"title": "热门WordPress插件中的0day漏洞将允许攻击者接管目标网站", "url": "https://www.freebuf.com/articles/network/190399.html", "time": "2018-12-11", "level": "", "num_look": 173580, "num_comment": 173580, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "研究人员表示，网络犯罪分子目前正在利用一个热门WordPress插件中的安全漏洞来在目标站点中植入后门，并拿到网站的完整控制权。"}
{"title": "SQL注入常规Fuzz全记录", "url": "https://www.freebuf.com/articles/web/190019.html", "time": "2018-12-11", "level": "金币+5", "num_look": 638404, "num_comment": 20, "author": "Conan", "tags": ["WEB安全"], "text": "本篇文章是在做ctf bugku的一道sql 盲注的题（题目地址:注入题目）中运用了fuzz的思路，完整记录整个fuzz的过程，给师傅们当点心，方便大家加深对web sql注入 fuzz的理解。"}
{"title": "老瓶装新酒：认识IBM符号链接攻击及防御手段", "url": "https://www.freebuf.com/articles/database/190970.html", "time": "2018-12-11", "level": "现金奖励", "num_look": 141909, "num_comment": 141909, "author": "yolandamo", "tags": ["数据安全"], "text": "IBM下有两款大型关系型数据库，分别是Informix和DB2。早在2001年和2003年两款数据库就被爆出存在符号链攻击提权的问题。"}
{"title": "机器学习入门之像使用Print一样使用算法检测WebShell", "url": "https://www.freebuf.com/news/190953.html", "time": "2018-12-11", "level": "现金奖励", "num_look": 182898, "num_comment": 6, "author": "littt0", "tags": [], "text": "近日，由于工作需要（不饱和）想开发一款linux下运行的webshell检测的工具，于是想到了使用机器学习算法来实现这一需求，于是翻了兜哥的著作《web安全之深度学习实战》。"}
{"title": "BUF早餐铺 | 卡巴斯基曝光DarkVishnya银行内网攻击案件细节；Google 被指责将合规网站和程序误标记为恶意；Google Play里的22款应用发现含有后门", "url": "https://www.freebuf.com/news/191723.html", "time": "2018-12-11", "level": "", "num_look": 100301, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "FIT 2019大会盛大开幕~~"}
{"title": "Process Hacker：一款用于调试和排除软件故障的强大工具", "url": "https://www.freebuf.com/sectool/190391.html", "time": "2018-12-10", "level": "", "num_look": 325432, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Process Hacker是一款针对高级用户的安全分析工具，它可以帮助研究人员检测和解决软件或进程在特定操作系统环境下遇到的问题。"}
{"title": "一则有趣的XSS WAF规则探测与绕过", "url": "https://www.freebuf.com/articles/web/190995.html", "time": "2018-12-10", "level": "现金奖励", "num_look": 497038, "num_comment": 17, "author": "Conan", "tags": ["WEB安全"], "text": "本文是以B站一个有趣的XSS(已修复)为引子(为什么说有趣后面再解释)，作为实例分析其WAF的规则，方便大家加深对XSS WAF探测以及针对性bypass的理解。"}
{"title": "技术分享 | 如何利用COM绕过AppLocker CLM", "url": "https://www.freebuf.com/articles/system/190067.html", "time": "2018-12-10", "level": "", "num_look": 106786, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "受限语言模式是PowerShell限制用户访问高级功能的一种方式这个功能本质上是一种安全控制措施，很多防御者可以利用这种功能来阻止类似“Invoke-Mimikatz”这样的工具。"}
{"title": "360代码卫士团队招人啦", "url": "https://www.freebuf.com/jobs/189977.html", "time": "2018-12-10", "level": "", "num_look": 198653, "num_comment": 4, "author": "奇安信代码卫士", "tags": ["安全招聘"], "text": "“360代码卫士”是360企业安全集团旗下专注于软件源代码安全的产品线，能力涵盖了源代码缺陷检测、源代码合规检测、源代码溯源检测三大方向，现因业务需要招聘安全人才。"}
{"title": "升级版TrickBot将支持获取信用卡储蓄卡数据的功能", "url": "https://www.freebuf.com/articles/terminal/191558.html", "time": "2018-12-10", "level": "", "num_look": 128988, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "TrickBot的更新版本将能够针对自助提款服务以及POS机设备来发动攻击，并窃取目标用户的储蓄卡及信用卡支付数据。"}
{"title": "理解DNS记录以及在渗透测试中的简单应用", "url": "https://www.freebuf.com/articles/web/190947.html", "time": "2018-12-10", "level": "金币+5", "num_look": 371580, "num_comment": 6, "author": "小呆瓜", "tags": ["WEB安全"], "text": "DNS可以在侦查过程中提供有价值的数据，DNS的基本功能是将域名转换为IP地址。现在已经有许多出色的工具和方法可以助我们从域名服务器提取我们需要的数据以便用于渗透测试。"}
{"title": "仿冒签名攻击频现，针对外贸行业精准钓鱼", "url": "https://www.freebuf.com/articles/network/191257.html", "time": "2018-12-10", "level": "", "num_look": 122701, "num_comment": 122701, "author": "360安全", "tags": ["网络安全"], "text": "近期，国内安全团队监测到一类针对外贸行业人员进行攻击的木马正在传播，该类木马被包含在钓鱼邮件附件的PPT文档中，所携带的数字签名仿冒了知名公司“通达信”的签名。"}
{"title": "WORD宏病毒老而弥坚花样百出", "url": "https://www.freebuf.com/articles/system/190926.html", "time": "2018-12-10", "level": "现金奖励", "num_look": 239092, "num_comment": 1, "author": "cgf99", "tags": ["系统安全"], "text": "基于宏的 word 恶意攻击文件是社交工程类攻击的一个重要手段，虽说此类攻击技术很简单，也很老旧，在大多数安全技术人员看来有点 low 甚至对其不屑一顾，但是不可否认，由于宏脚本制作简单、受 Office 和 windows …"}
{"title": "BUF早餐铺 | B社承认《辐射76》页面出现安全问题，用户信息遭泄露；研究发现全球有41.5万多台路由器受到秘密挖矿软件感染；Mozilla Firefox包含一个存在了11年的“验证对话框”", "url": "https://www.freebuf.com/news/191620.html", "time": "2018-12-10", "level": "", "num_look": 79040, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "距离FIT大会仅剩2天，各位准备好了吗~"}
{"title": "WebCobra：深入分析这款新型挖矿恶意软件", "url": "https://www.freebuf.com/articles/terminal/190228.html", "time": "2018-12-09", "level": "", "num_look": 129085, "num_comment": 129085, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "近期，McAfee Lab的研究人员发现了一款新型的俄罗斯恶意软件，这款恶意软件名叫“WebCobra”，它可以利用目标设备的计算能力来挖加密货币。"}
{"title": "手把手教你如何在Atmail上构建XSS蠕虫", "url": "https://www.freebuf.com/articles/network/190392.html", "time": "2018-12-09", "level": "", "num_look": 126004, "num_comment": 126004, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "在这篇文章中，我将会给大家演示如何构建一个可以通过目标用户联系人来进行自我传播的XSS Payload。"}
{"title": "浅谈HTTP隐蔽隧道下的RDP暴力破解测试", "url": "https://www.freebuf.com/articles/web/191375.html", "time": "2018-12-09", "level": "现金奖励", "num_look": 280922, "num_comment": 12, "author": "si1ence", "tags": ["WEB安全"], "text": "HTTP隧道用于在受限网络连接的条件下在两台计算机之间创建网络链接，用于绕过IDS、Firewall一类的安全设备限制实现基于HTTP协议的通信，由于工作需要就简单的做了一下研究与分析，个人愚见大佬勿喷。"}
{"title": "D-Link DIR-850L路由器存在漏洞，可绕过加密", "url": "https://www.freebuf.com/vuls/190956.html", "time": "2018-12-09", "level": "", "num_look": 155062, "num_comment": 155062, "author": "SIGChina", "tags": ["漏洞"], "text": "D-Link DIR-850L无线AC路由器（硬件修订版本A）存在漏洞，该漏洞使攻击者无需提供凭据即可完全访问无线网络。"}
{"title": "Ghostscript：基于漏洞CVE-2018-17961的-dSAFER沙盒逃逸技术", "url": "https://www.freebuf.com/vuls/190323.html", "time": "2018-12-08", "level": "", "num_look": 128840, "num_comment": 128840, "author": "Alpha_h4ck", "tags": ["漏洞"], "text": "今天给大家分析的是一种新型的ghostscript-dSAFER沙盒逃逸技术，目前这项技术仍然适用于当前正在使用的所有ghostscript版本。"}
{"title": "作为白帽的你应该拥有的10个小工具", "url": "https://www.freebuf.com/sectool/191404.html", "time": "2018-12-08", "level": "红色标题", "num_look": 346414, "num_comment": 8, "author": "secist", "tags": ["工具"], "text": "10个作为白帽子的你最值得拥有的小工具。这些工具非常适合作为你无聊时的调剂品，或是作为生日圣诞礼物送给你的白帽朋友。"}
{"title": "技术分享丨如何利用临时目录绕过AppLockerCLM", "url": "https://www.freebuf.com/articles/network/190269.html", "time": "2018-12-08", "level": "", "num_look": 80134, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "当我在研究AppLocker以及PowerShell受限语言模式绕过方面的东西时发现了一种新的技术。"}
{"title": "TrickBot银行木马最新的POS相关模块psfin32分析", "url": "https://www.freebuf.com/articles/terminal/191227.html", "time": "2018-12-08", "level": "金币+8", "num_look": 135065, "num_comment": 135065, "author": "fengbin8606", "tags": ["终端安全"], "text": "TrickBot通过不断增加窃取用户凭证的新模块而不断进化。最近，我们又发现了一个新的POS相关的恶意模块，使得该银行木马更加危险。"}
{"title": "Zebrocy新组件渗透过程详细解析", "url": "https://www.freebuf.com/articles/network/190749.html", "time": "2018-12-08", "level": "金币+8", "num_look": 129190, "num_comment": 1, "author": "fengbin8606", "tags": ["网络安全"], "text": "2018年8月，Sednit的运营者部署了两个新的Zebrocy组件，从那时起我们看到Zebrocy部署的增长，它的目标是中亚以及中欧和东欧国家。"}
{"title": "FIT 2019议题前瞻：中小银行互联网安全防护的一些新姿势丨CSO高峰论坛", "url": "https://www.freebuf.com/news/191515.html", "time": "2018-12-07", "level": "红色标题", "num_look": 142715, "num_comment": 3, "author": "FB客服", "tags": ["资讯"], "text": "随着金融行业“互联网+”战略的快速发展，信息安全早已经和业务融合在一起，日益复杂的网络安全态势也对金融行业的各个企业提出高的要求，尤其是在安全防护能力上。"}
{"title": "SSH-Auditor：扫描你的网络上SSH弱密码的最佳途径", "url": "https://www.freebuf.com/articles/network/190075.html", "time": "2018-12-07", "level": "", "num_look": 163280, "num_comment": 7, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "今天给大家介绍的是一款名叫SSH-Auditor的工具，这款工具可以帮助广大研究人员扫描自己网络上存在的SSH弱密码。还等什么，赶紧检查一下自己的网络环境吧！"}
{"title": "白宫网络安全顾问：听说日本网安部长没用过电脑，不知道USB是什么，你们以为我就懂网络安全了？", "url": "https://www.freebuf.com/news/191521.html", "time": "2018-12-07", "level": "金币+8", "num_look": 184633, "num_comment": 3, "author": "lifeisaloop", "tags": ["资讯"], "text": "根据国际知名科技站点贴出来的一则小故事，看得出特朗普的网络安全顾问其实也不怎么懂网络安全。"}
{"title": "区块链技术真的能提升大选投票系统的安全性吗？", "url": "https://www.freebuf.com/news/190267.html", "time": "2018-12-07", "level": "", "num_look": 103603, "num_comment": 103603, "author": "Alpha_h4ck", "tags": ["区块链安全", "资讯"], "text": "欧洲能源部门的委员Maroš Šefčovič公开赞扬了区块链技术，并且指出这项技术在未来选举进程中的重要性。"}
{"title": "购物季？网购狂欢背后的渔夫和水坑", "url": "https://www.freebuf.com/news/191078.html", "time": "2018-12-07", "level": "红色标题", "num_look": 146286, "num_comment": 146286, "author": "Freddy", "tags": ["资讯"], "text": "在这篇文章里，国内网络购物的安全情况就不再赘述了，主要聊聊美国购物季上网络黑手的两大套路，帮助伙伴们在跨洋消费时规避网络安全风险。"}
{"title": "Lucky双平台勒索者样本技术分析", "url": "https://www.freebuf.com/articles/system/190651.html", "time": "2018-12-07", "level": "", "num_look": 182736, "num_comment": 1, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "lucky是一款具备超强传播能力的勒索者，同时支持Windows和Linux两种操作系统平台，加密算法采用高强度的RSA+AES算法。同时该样本还会进行挖矿木马的种植。"}
{"title": "T-Pot多蜜罐平台使用心法", "url": "https://www.freebuf.com/sectool/190840.html", "time": "2018-12-07", "level": "现金奖励", "num_look": 387775, "num_comment": 7, "author": "R00to1", "tags": ["工具"], "text": "最近看到大佬发了几篇tpot蜜罐的文章，都是介绍安装的，那我就来写个看看怎么使用的文章，抛砖引玉，共同进步。"}
{"title": "Aurora/Zorro：勒索软件之换皮重出江湖", "url": "https://www.freebuf.com/news/190363.html", "time": "2018-12-07", "level": "", "num_look": 147963, "num_comment": 147963, "author": "Karunesh91", "tags": ["系统安全", "网络安全"], "text": "近年来，恶意勒索软件出现了爆发性的增长，一个又一个的恶意软件犹如老树抽新秧，改头换面再次活跃于网络世界中。"}
{"title": "BUF早餐铺 | Instagram出现漏洞：广州出现“隔空盗刷”案：芯片卡小额免密，被伪装POS机隔包盗刷；苹果发布iOS 12.1.1更新，修复了密码绕过漏洞、RCE漏洞等问题；澳大利亚的加密新规引发科技公司担忧", "url": "https://www.freebuf.com/news/191386.html", "time": "2018-12-07", "level": "", "num_look": 227677, "num_comment": 227677, "author": "Freddy", "tags": ["资讯"], "text": "今天是农历大雪节气，各位出门要注意保暖哦~"}
{"title": "微信支付勒索病毒愈演愈烈，边勒索边窃取支付宝密码", "url": "https://www.freebuf.com/articles/paper/191154.html", "time": "2018-12-06", "level": "", "num_look": 206030, "num_comment": 6, "author": "火绒安全", "tags": ["安全报告"], "text": "12月1日爆发的\"微信支付\"勒索病毒正在快速传播，感染的电脑数量越来越多。病毒团伙入侵并利用豆瓣的C&C服务器，除了锁死受害者文件勒索赎金，还大肆偷窃支付宝等密码。"}
{"title": "Flash 0day+Hacking Team远控：利用最新Flash 0day漏洞的攻击活动与关联分析", "url": "https://www.freebuf.com/articles/system/191382.html", "time": "2018-12-06", "level": "", "num_look": 169225, "num_comment": 169225, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "攻击者将包含Flash 0day漏洞的Word诱饵文档发送给目标，一旦用户打开该Word文档便会触发漏洞并执行后续的木马程序，从而导致电脑被控制。"}
{"title": "Pacu：一款功能强大的AWS漏洞利用框架", "url": "https://www.freebuf.com/sectool/190074.html", "time": "2018-12-06", "level": "", "num_look": 156958, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Pacu的开源AWS漏洞利用框架，该工具可以帮助广大开发人员检测AWS云环境的安全状况。"}
{"title": "调研丨世界各地的大部分ATM都可以在30分钟内被黑客攻击", "url": "https://www.freebuf.com/articles/paper/190148.html", "time": "2018-12-06", "level": "", "num_look": 160147, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["安全报告"], "text": "研究表明，全球范围内绝大多数的ATM自助提款机都存在安全隐患，攻击者可在30分钟之内成功入侵这些ATM机并直接提现。"}
{"title": "HADOOP安全基础篇", "url": "https://www.freebuf.com/articles/database/190734.html", "time": "2018-12-06", "level": "金币+8", "num_look": 227464, "num_comment": 2, "author": "superhuawei", "tags": ["数据安全"], "text": "说起hadoop这个单词，在大数据领域可谓是十分知名。由于工作的需求，最近对hadoop整体架构和安全进行了一些了解，一些浅薄的理解分享给大家。"}
{"title": "微信支付勒索病毒样本分析", "url": "https://www.freebuf.com/articles/terminal/191002.html", "time": "2018-12-06", "level": "红色标题", "num_look": 1289817, "num_comment": 6, "author": "火绒安全", "tags": ["终端安全"], "text": "该勒索病毒开始勒索前，会在本地生成加密、解密相关数据，国内安全团队根据这些数据成功提取到了密钥，并放出了解密工具。"}
{"title": "SQL注入测试技巧TIP：再从Mysql注入绕过过滤说起", "url": "https://www.freebuf.com/articles/web/190266.html", "time": "2018-12-06", "level": "现金奖励", "num_look": 286612, "num_comment": 7, "author": "Zzzxbug", "tags": ["WEB安全"], "text": "对于mysql的注入，基本上是每一名web安全从业者入门的基本功，这里不多废话，结合本人无聊时在mysql上的测试，来谈一谈mysql在过滤某些特殊字符情况下的注入，因为是想到哪写到哪，文章比较散，各位大佬请绕过，和…"}
{"title": "GandCrab传播新动向：五毒俱全的蠕虫病毒技术分析", "url": "https://www.freebuf.com/articles/system/191020.html", "time": "2018-12-06", "level": "", "num_look": 155388, "num_comment": 1, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "和以往相比本次GandCrab传播量有了明显的波动，我们分析了背后原因，发现此次波动是由一种近年较常见的蠕虫病毒引起的。"}
{"title": "BUF早餐铺 | 国家级网络攻击行动利用Adobe Flash 0day漏洞；英国电信将剥离华为4G设备并禁止其竞标核心5G设备；工信部发布2018年第三季度网络安全威胁态势分析与工作综述", "url": "https://www.freebuf.com/news/191358.html", "time": "2018-12-06", "level": "", "num_look": 158030, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "360发现一起APT攻击行动，通过一份俄文内容的医院员工问卷文档，携带最新的Flash 0day漏洞和具有自毁功能的专属木马程序，目标直指俄罗斯联邦总统事务管理局专属的医疗机构。"}
{"title": "Kali Linux字典生成工具Cewl使用全指南", "url": "https://www.freebuf.com/articles/network/190128.html", "time": "2018-12-05", "level": "", "num_look": 319530, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "Cewl是一款采用Ruby开发的应用程序，可以给它的爬虫指定URL地址和爬取深度，还可以添额外的外部链接。"}
{"title": "FIT 2019议题前瞻：浅谈企业入侵应对就绪丨CSO高峰论坛", "url": "https://www.freebuf.com/fevents/191239.html", "time": "2018-12-05", "level": "红色标题", "num_look": 79865, "num_comment": 3, "author": "FB客服", "tags": ["活动"], "text": "思科的前CEO钱伯斯先生曾经讲过，这个世界上有两种公司：一种是曾经被黑客攻击过，另外一种是他并不知道自己被别人攻击过。"}
{"title": "挖洞经验 | Vine用户隐私信息泄露漏洞（$7560）", "url": "https://www.freebuf.com/vuls/190129.html", "time": "2018-12-05", "level": "", "num_look": 166775, "num_comment": 8, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "免费移动应用Vine出现用户隐私泄露漏洞，漏洞原因在于不安全的直接对象引用，攻击者可利用该漏洞获取任何Vine的IP地址、手机号码和注册邮箱等个人敏感信息。"}
{"title": "斩草除根，360终结首个“微信支付”勒索木马", "url": "https://www.freebuf.com/news/191281.html", "time": "2018-12-05", "level": "", "num_look": 249639, "num_comment": 12, "author": "360安全", "tags": ["数据安全", "终端安全"], "text": "UNNAMED1989“微信支付”勒索病毒让不少用户过了一个不平静的周末，文件无法正常打开，重要数据被加密。但病毒从何而来，以后又该如何预防呢？"}
{"title": "蔓灵花（BITTER）APT组织使用InPage软件漏洞针对巴基斯坦的攻击及团伙关联分析", "url": "https://www.freebuf.com/vuls/190784.html", "time": "2018-12-05", "level": "", "num_look": 271950, "num_comment": 1, "author": "奇安信威胁情报中心", "tags": ["漏洞", "系统安全"], "text": "InPage是一个专门针对乌尔都语使用者（巴基斯坦国语）设计的文字处理软件，卡巴斯基曾在2016年11月首次曝光了利用该软件漏洞进行定向攻击的案例。"}
{"title": "我是如何走进黑客世界的？", "url": "https://www.freebuf.com/articles/neopoints/190895.html", "time": "2018-12-05", "level": "现金奖励", "num_look": 1568441, "num_comment": 56, "author": "MyselfExplorer", "tags": ["观点"], "text": "我想给你这把钥匙，打开它的大门，你要做的只是静静的聆听一下这些故事。"}
{"title": "区块链中“鸡肋”的RPC漏洞", "url": "https://www.freebuf.com/articles/blockchain-articles/191086.html", "time": "2018-12-05", "level": "现金奖励", "num_look": 146693, "num_comment": 1, "author": "kmsrussian", "tags": ["区块链安全"], "text": "古老的如微软的一些RPC漏洞，通过畸形的RPC请求，触发C/C++的字符串拷贝连接之类的问题，造成内存覆盖，引发安全漏洞。至今，RPC漏洞仍然活跃在网络中。"}
{"title": "白话物联网安全（二）：物联网的安全检测", "url": "https://www.freebuf.com/articles/wireless/191065.html", "time": "2018-12-05", "level": "现金奖励", "num_look": 341596, "num_comment": 8, "author": "大胖", "tags": ["无线安全"], "text": "第一章“什么是物联网的信息安全”，我们讲了什么物联网，包含了哪几方面的东西，物联网的信息安全会涉及到什么，第二章我们从一个IOT漏洞自动化利用工具AutoSploit讲起。"}
{"title": "BUF早餐铺 | 微信支付回应勒索病毒事件：已封禁涉事账户；英国秘密情报处负责人称华为构成安全威胁；美国国土安全部调查加密货币交易", "url": "https://www.freebuf.com/news/191264.html", "time": "2018-12-05", "level": "", "num_look": 94261, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "针对近期爆发的“微信支付”勒索病毒事件，微信支付方面回应称，微信已第一时间对所涉勒索病毒作者账户进行封禁、收款二维码予以紧急冻结。"}
{"title": "FIT 2019议题前瞻：佛系区块链世界观与以太坊态势感知丨前沿安全神盾局", "url": "https://www.freebuf.com/fevents/189963.html", "time": "2018-12-04", "level": "红色标题", "num_look": 81624, "num_comment": 1, "author": "FB客服", "tags": ["活动"], "text": "人工智能和区块链，仿佛绝代双骄，成为了时下最火热的两个概念。我们无法断言哪一项技术会对人类生活、社会科技带来更大的影响。"}
{"title": "HASSH : 一种新型网络指纹识别标准，可用于识别特定的客户端和服务器SSH", "url": "https://www.freebuf.com/sectool/190076.html", "time": "2018-12-04", "level": "", "num_look": 128003, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫“HASSH”的工具。实际上，“HASSH”更像是一种新型的网络指纹识别标准，因为它可以用来识别特定的客户端或服务器端SSH的实现方式。"}
{"title": "快讯 | 海外版“知乎”Quora 遭黑客入侵，近一亿用户信息泄露", "url": "https://www.freebuf.com/news/191176.html", "time": "2018-12-04", "level": "红色标题", "num_look": 233931, "num_comment": 4, "author": "shidongqi", "tags": ["资讯"], "text": "万豪酒店数据泄露的事情还没平息，又有一位难兄难弟来分散焦点。12月4日早上，国外知名问答社区 Quora 在其博客上发布安全公告称，某个系统遭遇第三方入侵，近一亿用户重要信息可能已经泄露。"}
{"title": "在设备上生成反向Shell的多种方法", "url": "https://www.freebuf.com/articles/system/190092.html", "time": "2018-12-04", "level": "", "num_look": 169993, "num_comment": 2, "author": "secist", "tags": ["系统安全"], "text": "在去年底的时候，我曾写过一篇关于直接在内存中执行PowerShell脚本获取反向shell的文章。当时，这些脚本几乎躲过了所有主流AV的检测。"}
{"title": "FIT 2019议题前瞻：智慧运营-纵深监测与响应丨CSO高峰论坛", "url": "https://www.freebuf.com/fevents/191185.html", "time": "2018-12-04", "level": "红色标题", "num_look": 94736, "num_comment": 4, "author": "FB客服", "tags": ["活动"], "text": "面对网络安全建设对于企业运营的掣肘时，企业该如何实现安全能力创新、解决安全痛点，通过安全赋能业务？看看《智慧运营-纵深监测与响应》议题是怎么说的~"}
{"title": "Lucky病毒，一款针对Linux服务器并实现跨平台的勒索病毒", "url": "https://www.freebuf.com/articles/terminal/190769.html", "time": "2018-12-04", "level": "", "num_look": 312706, "num_comment": 2, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "新出现一种针对Linux服务器的勒索病毒，该病毒加密后缀为.lucky，是新的勒索病毒变种，其传播模块复用了Satan的传播方式，实现了Linux下的自动化传播。"}
{"title": "2019年应当认真对待的6大移动安全威胁", "url": "https://www.freebuf.com/news/190108.html", "time": "2018-12-04", "level": "红色标题", "num_look": 174958, "num_comment": 7, "author": "Karunesh91", "tags": ["资讯"], "text": "移动端的恶意软件，在近年来愈发频繁的出现在了网络世界中，随着安全威胁的升级，越来越多的企业或组织也开始重点关注这些问题。"}
{"title": "Web安全之Openfire的插件脚本上传漏洞复现", "url": "https://www.freebuf.com/articles/web/190586.html", "time": "2018-12-04", "level": "现金奖励", "num_look": 168700, "num_comment": 3, "author": "si1ence", "tags": ["WEB安全"], "text": "一次偶然的机会发现某台Web服务器被黑了之后被植入了挖矿病毒，然后忙活了好久清理完病毒之后就开始思考思考到底是怎么被黑的，俗话说的好死要死得明白。"}
{"title": "万豪数据泄漏门再敲警钟，酒店集团7步安全建议", "url": "https://www.freebuf.com/news/191048.html", "time": "2018-12-04", "level": "红色标题", "num_look": 160108, "num_comment": 9, "author": "阿里云安全", "tags": ["资讯"], "text": "酒店管理系统比较复杂，很容易出现第三方支持人员或者内部人员利用系统漏洞取得数据库访问权限，该如何以数据安全生命周期进行安全管控，请看这篇文章。"}
{"title": "BUF早餐铺 | 苹果终向印度政府妥协，同意安装防骚扰App；国产勒索病毒爆发，腾讯连夜发布解密工具；特朗普上台后，中国网络间谍活动再次飙升", "url": "https://www.freebuf.com/news/191158.html", "time": "2018-12-04", "level": "", "num_look": 103833, "num_comment": 103833, "author": "Karunesh91", "tags": ["资讯"], "text": "临近年底，网络又不太平了~"}
{"title": "FIT 2019议题前瞻：来去无踪，似新非新的“无文件攻击”丨白帽Live", "url": "https://www.freebuf.com/news/191029.html", "time": "2018-12-03", "level": "红色标题", "num_look": 140641, "num_comment": 3, "author": "FB客服", "tags": ["资讯"], "text": "无文件攻击，也被称作非恶意软件攻击。利用受害者使用的受信任软件或系统工具来躲避检测，具有相当高的成功率和威胁性。如何防范，已成为当前安全领域的一大重点。"}
{"title": "IMSI-catcher：可发现附近手机敏感信息的工具", "url": "https://www.freebuf.com/sectool/189949.html", "time": "2018-12-03", "level": "", "num_look": 284322, "num_comment": 6, "author": "secist", "tags": ["工具"], "text": "IMSI-catcher是一个可以帮助你发现附近手机的IMSI号码，国家，品牌和运营商等信息的工具。"}
{"title": "PHP利用PCRE回溯次数限制绕过某些安全限制", "url": "https://www.freebuf.com/articles/web/190794.html", "time": "2018-12-03", "level": "金币+15", "num_look": 259112, "num_comment": 10, "author": "phithon", "tags": ["WEB安全"], "text": "这次 Code-Breaking Puzzles 中我出了一道看似很简单的题目pcrewaf，大意是判断一下用户输入的内容有没有 PHP 代码，如果没有，则写入文件。"}
{"title": "拦截流量注入广告：针对macOS的SearchPageInstaller恶意软件分析", "url": "https://www.freebuf.com/articles/network/189868.html", "time": "2018-12-03", "level": "", "num_look": 115281, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "近期，研究人员又发现了一种针对macOS用户的新型攻击技术，接下来我们一起打开虚拟机，看看这一次攻击者又想出了什么高招！"}
{"title": "湖北灰科信息招聘信息安全人才", "url": "https://www.freebuf.com/jobs/190906.html", "time": "2018-12-03", "level": "", "num_look": 139998, "num_comment": 10, "author": "湖北灰科信息技术有限公司", "tags": ["安全招聘"], "text": "湖北灰科信息技术有限公司，一家专业从事于为公检法等机关单位提供网络信息安全软件产品开发及相关技术服务的高科技公司，现因业务需求招聘安全人才~"}
{"title": "关于Cobalt Strike的Malleable-C2-Profiles浅析", "url": "https://www.freebuf.com/news/189948.html", "time": "2018-12-03", "level": "现金奖励", "num_look": 183632, "num_comment": 183632, "author": "charm1y", "tags": [], "text": "本文主要浅略地分析Cobalt Strike利用Malleable-C2-Profiles来进行伪装流量，实现通信隐匿的效果。"}
{"title": "从插件入手：挖掘WordPress站点的“后入式BUG”", "url": "https://www.freebuf.com/articles/web/190356.html", "time": "2018-12-03", "level": "金币+15", "num_look": 449582, "num_comment": 18, "author": "evil7", "tags": ["WEB安全"], "text": "越是扫不出的地方，越有可能发现有趣的点。而最容易出现非官方，有bug的地方就是插件、自定义插件、第三方功能了。"}
{"title": "FIT 2019议题前瞻：分布式拒绝服务攻击预警研究 | 企业安全俱乐部", "url": "https://www.freebuf.com/fevents/189748.html", "time": "2018-12-02", "level": "红色标题", "num_look": 68736, "num_comment": 68736, "author": "FB客服", "tags": ["活动"], "text": "DDoS 攻击流量峰值每年都不断地被超越，上半年的一起 Memcached DDoS 攻击，其峰值1.7 Tbps 达到了一个新的高度。"}
{"title": "WordPress插件WooCommerce任意文件删除漏洞分析", "url": "https://www.freebuf.com/articles/network/189826.html", "time": "2018-12-02", "level": "", "num_look": 144901, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "近期，研究人员在WordPress的权限处理机制中发现了一个安全漏洞，而这个漏洞将允许WordPress插件实现提权。"}
{"title": "看我如何分析并渗透WebSocket和Socket.io", "url": "https://www.freebuf.com/articles/web/189994.html", "time": "2018-12-02", "level": "", "num_look": 337671, "num_comment": 6, "author": "Covfefe", "tags": ["WEB安全"], "text": "WebSocket是一种允许浏览器和服务器建立单个TCP连接然后进行全双工异步通信的技术。由于它允许实时更新，而浏览器也无需向后台发送新的HTTP请求，因此WebSocket非常流行。"}
{"title": "针对马拉维(MALAWI)国民银行的网络攻击样本分析报告", "url": "https://www.freebuf.com/articles/network/190689.html", "time": "2018-12-02", "level": "", "num_look": 149600, "num_comment": 149600, "author": "antiylab", "tags": ["网络安全"], "text": "通过对攻击样本和关联线索的综合分析，发现这是一系列以金融机构电子邮件为突破口，通过邮件进行交叉渗透的定向攻击事件。"}
{"title": "一个CVE-2017-11882漏洞新变异样本的调试与分析", "url": "https://www.freebuf.com/vuls/190397.html", "time": "2018-12-02", "level": "现金奖励", "num_look": 305700, "num_comment": 6, "author": "cgf99", "tags": ["漏洞"], "text": "近日收获一个后缀名为doc的word文档，查看后其实是rtf格式文档。在测试环境打开后发现有网络连接和执行程序的动作，确定该样本是恶意文档。"}
{"title": "看我如何下载印度最大电信服务商的源代码", "url": "https://www.freebuf.com/articles/database/189808.html", "time": "2018-12-01", "level": "红色标题", "num_look": 219736, "num_comment": 7, "author": "Alpha_h4ck", "tags": ["数据安全"], "text": "近期，Snapchat曾发生过一次源代码泄漏事件，在此次事件中攻击者从Snapchat网站上下载了完整的网站源码，并将其上传到了GitHub上。"}
{"title": "挖洞经验 | HackerOne平台ImageMagick漏洞导致服务器内存信息泄露", "url": "https://www.freebuf.com/vuls/189776.html", "time": "2018-12-01", "level": "", "num_look": 208165, "num_comment": 1, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "今天我要分享的是关于HackerOne平台GIF图像处理的ImageMagick漏洞（CVE-2017–15277），漏洞很简单，最终也获得了HackerOne官方奖励的$500美金。"}
{"title": "Windows VBScript引擎远程执行代码漏洞之CVE-2018-8373分析与复现", "url": "https://www.freebuf.com/vuls/190601.html", "time": "2018-12-01", "level": "", "num_look": 160551, "num_comment": 2, "author": "四维创智4DOGS", "tags": ["漏洞"], "text": "VBScript引擎处理内存中对象的方式中存在一个远程执行代码漏洞，该漏洞可能以一种攻击者可以在当前用户的上下文中执行任意代码的方式来破坏内存。"}
{"title": "Hackerone的一场CTF Writeup", "url": "https://www.freebuf.com/articles/web/190465.html", "time": "2018-12-01", "level": "", "num_look": 207385, "num_comment": 6, "author": "AngieQ", "tags": ["WEB安全"], "text": "我们从HackerOne的推特中得知这场CTF竞赛，并立即行动了起来。这场CTF竞赛从推特上一张包含二维码的图片开始。"}
{"title": "波及近5亿用户，万豪酒店集团遭遇超大规模数据泄露", "url": "https://www.freebuf.com/news/190984.html", "time": "2018-11-30", "level": "红色标题", "num_look": 286708, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": "继上一次大规模数据泄漏事件爆发之后，又有一家酒店集团公司被证实发生数据库被入侵的消息，可能波及近5亿用户的信息安全，不同的是，这一次酒店自己公示了这一消息。"}
{"title": "「智慧赋能·安全变革」企业安全新风向丨FIT 2019中国首席信息安全官高峰论坛议题抢先看", "url": "https://www.freebuf.com/news/190563.html", "time": "2018-11-30", "level": "红色标题", "num_look": 94013, "num_comment": 94013, "author": "FB客服", "tags": ["资讯"], "text": "FIT 2019中国首席信息安全官（CSO）高峰论坛将于2018年12月13日（周四）下午举行，我们诚挚的邀请广大企业的信息安全负责人参与交流，共同探讨企业信息安全的现状与未来！"}
{"title": "赛门铁克Altiris权限提升漏洞分析（CVE-2018-5240）", "url": "https://www.freebuf.com/vuls/189685.html", "time": "2018-11-30", "level": "", "num_look": 130944, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["漏洞"], "text": "在近期的一项渗透测试实践中，我们在最新版本赛门铁克Management Agent（Altiris）中发现了一个安全漏洞，而这个安全漏洞将允许攻击者实现提权。"}
{"title": "网络安全文化建设的六大方法论 | 解读《2018网络安全文化报告》", "url": "https://www.freebuf.com/news/190912.html", "time": "2018-11-30", "level": "", "num_look": 134731, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "在当今严峻的网络安全形势下，相信各类企事业机关对与网络安全重要性的认识已经不用多说了，但是网络安全文化构建还极度缺失。"}
{"title": "FIT 2019议题前瞻：有AI，更安全 | 全球高峰会", "url": "https://www.freebuf.com/fevents/190673.html", "time": "2018-11-30", "level": "红色标题", "num_look": 91585, "num_comment": 1, "author": "Freddy", "tags": ["活动"], "text": "面对全新的安全场景与机会，如何运用AI做安全、实现更安全的AI产品是企业把握未来发展的重要抓手。"}
{"title": "挖洞经验 | Facebook商务平台商家管理员账户添加漏洞（ $27,500）", "url": "https://www.freebuf.com/vuls/189872.html", "time": "2018-11-30", "level": "", "num_look": 226273, "num_comment": 8, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "Facebook商务管理平台（Facebook Business）是一个免费的 Facebook 平台，旨在帮助广告主集成业务的全部 Facebook 营销活动和外部合作伙伴。"}
{"title": "路由器漏洞频发，Mirai新变种来袭", "url": "https://www.freebuf.com/articles/terminal/190554.html", "time": "2018-11-30", "level": "", "num_look": 209228, "num_comment": 1, "author": "云鼎实验室", "tags": ["终端安全"], "text": "此款蠕虫是 mirai 病毒的新变种，和之前的 mirai 病毒不同，该蠕虫不仅仅通过初代 mirai 使用的 telnent 爆破进行攻击，更多通过路由器漏洞进行攻击传播。"}
{"title": "WordPress Plugin Ninja Forms 3.3.17 XSS复现与分析", "url": "https://www.freebuf.com/vuls/190411.html", "time": "2018-11-30", "level": "", "num_look": 612555, "num_comment": 3, "author": "看不尽的尘埃", "tags": ["WEB安全", "漏洞"], "text": "Ninja Forms是WordPress的终极免费表单创建工具。使用简单但功能强大的拖放式表单创建器在几分钟内构建表单。"}
{"title": "BUF早餐铺 | 戴尔为所有Dell.com用户重置密码；平台Atrium Health泄露265万患者记录；全新的工业间谍活动利用基于AutoCAD的恶意软件", "url": "https://www.freebuf.com/news/190789.html", "time": "2018-11-30", "level": "", "num_look": 176270, "num_comment": 2, "author": "Freddy", "tags": ["资讯"], "text": "戴尔披露了11月初发生的一次网络攻击，并重置了所有客户的密码，作为事件发生后的预防措施。"}
{"title": "安全运维之日志追踪", "url": "https://www.freebuf.com/news/190396.html", "time": "2018-11-30", "level": "金币+10", "num_look": 416541, "num_comment": 16, "author": "Qtlsec", "tags": [], "text": "日志在分析安全事件上很重要的一个参考依据，同样希望能够看到这篇文章的运维人员能重视起日志来。"}
{"title": "如何使用Firewalld配置Linux主机？", "url": "https://www.freebuf.com/articles/system/189680.html", "time": "2018-11-29", "level": "", "num_look": 156832, "num_comment": 3, "author": "secist", "tags": ["系统安全"], "text": "在之前的文章中我介绍了Linux防火墙的基本配置，并在最后简单提及了下firewalld。本文我将详细为大家介绍如何使用firewalld配置Linux防火墙。"}
{"title": "看我如何通使用Lambda函数对AWS帐户进行攻击测试", "url": "https://www.freebuf.com/articles/network/189688.html", "time": "2018-11-29", "level": "", "num_look": 115720, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "小伙伴打算让我通过Lambda函数来攻击他的AWS账号，并最终实现Shell命令的运行。听起来确实值得一试，毕竟现在很难有人愿意把自己的账号给别人去免费“蹂躏”了！"}
{"title": "FIT 2019议题前瞻：Bugbounty到网络空间，如何成长为顶尖漏洞猎人丨X-Tech技术派对", "url": "https://www.freebuf.com/fevents/190708.html", "time": "2018-11-29", "level": "红色标题", "num_look": 105155, "num_comment": 1, "author": "FB客服", "tags": ["活动"], "text": "网络态势日益复杂，漏洞威胁屡禁不止，机遇和挑战并存的时代，互联网安全顶端的大佬们会有怎样的应对手段？"}
{"title": "不满国内监管，谷歌回归中国计划再遭抗议", "url": "https://www.freebuf.com/news/190760.html", "time": "2018-11-29", "level": "红色标题", "num_look": 324800, "num_comment": 18, "author": "shidongqi", "tags": ["资讯"], "text": "自从2010年退出中国市场开始，谷歌回归中国的呼声一直此起彼伏地没有消停过，却一直没有如愿过。而与国内很多用户不同的是，有一群人却不希望谷歌重回中国，而这些人正是谷歌自己的雇员。"}
{"title": "探究绝地求生玩家被“误封”的真相", "url": "https://www.freebuf.com/articles/paper/190357.html", "time": "2018-11-29", "level": "红色标题", "num_look": 242801, "num_comment": 6, "author": "安全豹", "tags": ["安全报告"], "text": "19世纪末，意大利的经济学家发现了一个重要的二八定律，即：“在任何一组东西中，最重要的只占其中一小部分，约20%，其余80%尽管是多数，但却是次要的。”"}
{"title": "Oracle数据库勒索病毒自检工具", "url": "https://www.freebuf.com/sectool/189847.html", "time": "2018-11-29", "level": "", "num_look": 150897, "num_comment": 150897, "author": "深信服千里目安全实验室", "tags": ["工具"], "text": "近日，Oracle数据库勒索病毒又活跃了，无需恐慌，只要不要乱下载PL/SQL破解版工具就不会中招！本文提供自检工具。"}
{"title": "BUF早餐铺 | 优步因2016年黑客事件被英国和荷兰处以100多万美元罚款；普通消费者可付费解锁苹果iOS设备；超九成App涉嫌过度收集用户个人信息", "url": "https://www.freebuf.com/news/190756.html", "time": "2018-11-29", "level": "", "num_look": 230233, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "FaceBook 14年就知晓隐私漏洞？英议员1周内将公布秘密文档；上海消保委测试18款App，猎豹、触宝等自动开隐私权限。"}
{"title": "志愿者招募令！FIT 2019互联网安全创新大会等你加入", "url": "https://www.freebuf.com/fevents/190018.html", "time": "2018-11-28", "level": "", "num_look": 100247, "num_comment": 4, "author": "FB独家", "tags": ["活动"], "text": "英雄请留步！听说可以免费参加FIT2019大会？"}
{"title": "FIT 2019不见不散！大会详细议程公布", "url": "https://www.freebuf.com/fevents/190670.html", "time": "2018-11-28", "level": "红色标题", "num_look": 93626, "num_comment": 93626, "author": "FB客服", "tags": ["活动"], "text": "行业专家、政府权威、顶级白帽，一齐深入前沿安全，共同探索安全与创新。"}
{"title": "PHPCMS2008 type.php代码注入高危漏洞预警", "url": "https://www.freebuf.com/vuls/190631.html", "time": "2018-11-28", "level": "", "num_look": 205808, "num_comment": 2, "author": "阿里云安全", "tags": ["漏洞"], "text": "国内安全团队首次捕获PHPCMS 2008版本的/type.php远程GetShell 0day利用攻击，攻击者可以利用该漏洞远程植入webshell，导致文件篡改、数据泄漏、服务器被远程控制等一系列严重问题。"}
{"title": "Kamerka：利用Shodan构建交互式摄像头地图", "url": "https://www.freebuf.com/sectool/189558.html", "time": "2018-11-28", "level": "", "num_look": 232552, "num_comment": 4, "author": "secist", "tags": ["工具", "终端安全"], "text": "ꓘamerka是一个用于构建交互式摄像头地图的python脚本。其原理是调用Shodan API来查找摄像头，再使用Geopy进行定位和测距，并最终通过Folium来将这些内容绘制成图。"}
{"title": "细思极恐！美国网络空间攻击与主动防御能力解析（概述篇）", "url": "https://www.freebuf.com/articles/network/190647.html", "time": "2018-11-28", "level": "红色标题", "num_look": 326096, "num_comment": 4, "author": "shidongqi", "tags": ["网络安全"], "text": "随着网络空间重要性的日益提升，世界各国纷纷大力建设兼具防御和威慑能力的网络空间安全体系，组建网络部队，以求在网络空间的较量中获得优势。在这方面，美国走在了世界前列。"}
{"title": "挖洞经验 | 看我如何反复获取到HackerOne的漏洞测试邀请", "url": "https://www.freebuf.com/vuls/189623.html", "time": "2018-11-28", "level": "", "num_look": 175963, "num_comment": 3, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "利用HackerOne平台的漏洞报告邮件转发（Security@email forwarding）和项目退出功能（Leave Program），无需与厂商的任何用户交互行为，即可实现反复对HackerOne平台私密项目邀请消息的获取。"}
{"title": "2019年九大网络安全发展趋势预测", "url": "https://www.freebuf.com/news/189972.html", "time": "2018-11-28", "level": "", "num_look": 257480, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "要预测未来一年的网络威胁发展趋势很难，国外安全媒体、还是试着对明年的网络安全态势做出了九大预测，我们来看一看他们是怎么说的。"}
{"title": "攻防骚对抗 | 黑产挖矿的路子居然这么野了？", "url": "https://www.freebuf.com/articles/network/190562.html", "time": "2018-11-28", "level": "红色标题", "num_look": 218962, "num_comment": 4, "author": "安恒风暴中心", "tags": ["网络安全"], "text": "虚拟货币自诞生以来，就与黑产有着说不清道不明的关系，从一开始充当地下交易的介质，到成为逃避追踪的勒索病毒的钱包，利益之所向，必是黑产之跟随。"}
{"title": "域内配置ACL后门及检测清理", "url": "https://www.freebuf.com/articles/system/189942.html", "time": "2018-11-28", "level": "现金奖励", "num_look": 186412, "num_comment": 186412, "author": "R1ngk3y", "tags": ["系统安全"], "text": "在域环境中配置ACL后门，隐蔽性较强，不容易被发现，适合域环境维持权限，本文介绍常用的三种。"}
{"title": "捕获一起恶意入侵事件的攻击溯源", "url": "https://www.freebuf.com/articles/terminal/190375.html", "time": "2018-11-28", "level": "", "num_look": 215157, "num_comment": 5, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "多方面的分析发现，客户本地存在较多的恶意脚本与病毒文件根据现象情况梳理与日志分析、结合对一些进程内存的分析等多方面检测定义为多次恶意入侵的安全事件。"}
{"title": "BUF早餐铺 | 国家计算机病毒应急处理中心监测发现九款违法移动应用；黑客向热门JavaScript库注入恶意代码；Windows 10杀软10月测试Defender与Avast并列第三", "url": "https://www.freebuf.com/news/190623.html", "time": "2018-11-28", "level": "", "num_look": 180469, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "国家计算机病毒应急处理中心近期在净网行动中通过互联网监测发现，九款违法有害移动应用存在于移动应用发布平台中，其主要危害涉及恶意扣费、隐私窃取、恶意传播、资费消耗和流氓行为五类。"}
{"title": "FIT 2019议题前瞻：企业数字化转型中的网络安全建设 | 企业安全俱乐部", "url": "https://www.freebuf.com/fevents/190445.html", "time": "2018-11-27", "level": "红色标题", "num_look": 85309, "num_comment": 2, "author": "FB客服", "tags": ["活动"], "text": "企业数字化转型并不是靠碰运气取胜的游戏，它要求在不确定性中做出高瞻远瞩和大胆的决定，以此重塑公司，而不仅仅是改善现状。"}
{"title": "一起围观以色列安全公司Cynet的安管平台", "url": "https://www.freebuf.com/news/189555.html", "time": "2018-11-27", "level": "", "num_look": 156251, "num_comment": 2, "author": "柚子", "tags": ["资讯"], "text": "Cynet是一家成立于2015年、研发中心位于以色列的安全初创企业，今天我们一起来围观一下他们研发的安管平台如何。"}
{"title": "智能合约逆向心法34C3_CTF题分析（案例篇·二）", "url": "https://www.freebuf.com/articles/blockchain-articles/190113.html", "time": "2018-11-27", "level": "", "num_look": 107277, "num_comment": 107277, "author": "BUGX", "tags": ["区块链安全"], "text": "上次34C3_CTF的文章分析得到了很好的反响，这篇文章跟大家分享主要关于该题从零到有的思路，顺带解释一些solidity的特性与语法。"}
{"title": "利用Docker容器的不安全部署获取宿主机权限", "url": "https://www.freebuf.com/articles/system/189419.html", "time": "2018-11-27", "level": "红色标题", "num_look": 232063, "num_comment": 3, "author": "secist", "tags": ["系统安全"], "text": "滥用容器（ container）及逃逸的方法有多种，本文将讨论最基本的一种，即滥用docker socket来逃逸容器并在宿主机上以root身份执行代码。"}
{"title": "富友金融招聘安全工程师", "url": "https://www.freebuf.com/jobs/186811.html", "time": "2018-11-27", "level": "", "num_look": 170942, "num_comment": 3, "author": "Warden", "tags": ["安全招聘"], "text": "上海富友金融服务集团股份有限公司是一家具有高新技术企业资质的大型金融综合服务集团公司。"}
{"title": "攻防演练丨Coinhive网页挖矿详解", "url": "https://www.freebuf.com/articles/terminal/189871.html", "time": "2018-11-27", "level": "", "num_look": 191019, "num_comment": 5, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "网页挖矿是一种利用网站前端javascript进行挖矿的一种行为，目前主要利用CoinHive和JSEcoin这两个手段进行网页挖矿，除此之外还有Webmine，Cryptoloot等工具。"}
{"title": "窃听风云：扒掉你的最后一条“胖次”", "url": "https://www.freebuf.com/vuls/190340.html", "time": "2018-11-27", "level": "现金奖励", "num_look": 341249, "num_comment": 12, "author": "GhostSec", "tags": ["漏洞", "终端安全"], "text": "“每个人的手机都是一部窃听器，不管你开不开机，都能被窃听。”"}
{"title": "为什么说不要用VLAN、VPC解决东西向隔离问题", "url": "https://www.freebuf.com/articles/network/189879.html", "time": "2018-11-27", "level": "金币+8", "num_look": 263966, "num_comment": 8, "author": "pearwith", "tags": ["网络安全"], "text": "基于我们多年来的运维经验及实际的客户走访，基于VLAN/VPC的内部隔离方式基本上已经不再适用于解决虚拟数据中心/私有云（包括含有私有云的混合云）环境下的东西向隔离问题。"}
{"title": "BUF早餐铺 | 新型Linux脚本病毒现身，代码冗长结构复杂；2018年77％的组织遭受DNS攻击；开黑客论坛收费注册，两人被拘；北京首起“盗挖虚拟货币”案告破：前员工入侵公司数百台电脑“挖矿”赚钱；", "url": "https://www.freebuf.com/news/190447.html", "time": "2018-11-27", "level": "", "num_look": 186737, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "年底了，又到了黑客们冲业绩的时候了，大家多多小心~"}
{"title": "FIT 2019 议题前瞻：AI+安全，是机遇亦是挑战 | 前沿安全神盾局", "url": "https://www.freebuf.com/fevents/190495.html", "time": "2018-11-26", "level": "红色标题", "num_look": 176895, "num_comment": 1, "author": "FB客服", "tags": ["活动"], "text": "从“互联网+”到“AI+”，信息化时代向新的阶段进化。2018年，人工智能的发展逐渐落到实处，少了许多浮夸和空谈。网络安全战略意义的升级，“网络安全+AI”已经成为了必然的趋势。"}
{"title": "Hackertarget：一款帮助组织发现攻击面的强大工具", "url": "https://www.freebuf.com/sectool/189413.html", "time": "2018-11-26", "level": "", "num_look": 171015, "num_comment": 8, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫HackerTarget ToolKit的工具，这款工具实际上是一款网络情报工具，它可以帮助组织快速地发现自家网络系统中存在的攻击面。"}
{"title": "攻击者可通过侧通道攻击暴露Facebook、XBox用户账户", "url": "https://www.freebuf.com/articles/database/189412.html", "time": "2018-11-26", "level": "", "num_look": 132125, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["数据安全"], "text": "近期，安全研究专家发现了一种利用社交媒体或其他网站用户屏蔽功能的新方法，本文就来揭晓一下。"}
{"title": "外媒调查：政府官员需要完成基本的网络安全培训吗？", "url": "https://www.freebuf.com/articles/neopoints/190103.html", "time": "2018-11-26", "level": "红色标题", "num_look": 210234, "num_comment": 8, "author": "Allen别bb", "tags": ["观点"], "text": "前段时间 FreeBuf 报道了一则关于日本网络安全部长从没使用过电脑的消息？虽然大部分人觉得有点讽刺意思，但确实也存在一定的探讨价值。"}
{"title": "“乱世”木马家族分析报告", "url": "https://www.freebuf.com/articles/terminal/190077.html", "time": "2018-11-26", "level": "", "num_look": 165170, "num_comment": 2, "author": "360安全", "tags": ["终端安全"], "text": "“乱世”木马家族的命名来源于木马母体程序包含的“乱世英雄”、“乱世权限”等特殊关键字，该家族的木马形态变化多端、作案手法专业娴熟，从今年起开始大肆地在国内传播。"}
{"title": "Look Mom, I dont use Shellcode议题Exploit复现", "url": "https://www.freebuf.com/vuls/189887.html", "time": "2018-11-26", "level": "现金奖励", "num_look": 138324, "num_comment": 2, "author": "elli0tn0phacker", "tags": ["漏洞"], "text": "Look Mom, I don't use Shellcode是2016 HITB GSEC上的一个议题。介绍了在64位Windows10上利用IE11的漏洞实现RCE，并进一步绕过EPM和EMET5.5等一系列Mitigation的技术细节。"}
{"title": "学霸搞黑产惊动教育圈，涉案金额高达6个亿", "url": "https://www.freebuf.com/articles/database/189850.html", "time": "2018-11-26", "level": "红色标题", "num_look": 299501, "num_comment": 10, "author": "GEETEST极验", "tags": ["数据安全"], "text": "学霸来搞黑产，听说一次就捞了6个亿，咱一起瞧瞧去~"}
{"title": "BUF早餐铺 | 警惕Rotexy移动木马，三个月内已发起超过70000次攻击；Aurora勒索软件的最新变种Zorro日趋活跃；25个欧盟成员国将开展电子作战领域合作", "url": "https://www.freebuf.com/news/190312.html", "time": "2018-11-26", "level": "", "num_look": 161429, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "Rotexy移动木马同时具备窃取感染设备上银行卡信息和发送假冒勒索软件加密页面进行敲诈的能力，在短短三个月的时间内就感染了超过7万台设备。"}
{"title": "Cynet：全方位一体化安全防护工具", "url": "https://www.freebuf.com/articles/terminal/189439.html", "time": "2018-11-25", "level": "", "num_look": 193967, "num_comment": 7, "author": "Karunesh91", "tags": ["终端安全", "网络安全"], "text": "最近发现了个新玩意儿，一个全方位的安全平台，看起来很厉害的样子。"}
{"title": "技术分享 | 如何通过PowerShell DSC进行横向渗透", "url": "https://www.freebuf.com/articles/network/188995.html", "time": "2018-11-25", "level": "", "num_look": 135984, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "PowerShell期望状态配置（DSC）允许需要执行的资源直接使用WMI，在DSC WMI类的帮助下，我们可以通过滥用内置脚本资源来实现PowerShell代码的远程执行。"}
{"title": "WordPress Plugin Quizlord 2.0 XSS漏洞复现与分析", "url": "https://www.freebuf.com/vuls/189814.html", "time": "2018-11-25", "level": "", "num_look": 172734, "num_comment": 4, "author": "看不尽的尘埃", "tags": ["WEB安全", "漏洞"], "text": "WordPress是使用PHP语言开发的博客平台，用户可以在支持PHP和MySQL数据库的服务器上架设属于自己的网站。也可以把 WordPress当作一个内容管理系统（CMS）来使用。"}
{"title": "来自卡巴斯基的黑五安全购物指南", "url": "https://www.freebuf.com/news/189870.html", "time": "2018-11-25", "level": "", "num_look": 169007, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "双十一刚过，准备好迎接下一波黑五了吗？"}
{"title": "一个关于Facebook用户个人和好友隐私信息泄露的漏洞", "url": "https://www.freebuf.com/vuls/189456.html", "time": "2018-11-24", "level": "", "num_look": 201315, "num_comment": 2, "author": "clouds", "tags": ["漏洞"], "text": "该漏洞暴露了Facebook受害者用户及其朋友的兴趣和活动相关信息，即使Facebook受害者用户在其隐私设置中，设置此类信息只有自己或朋友可见，这种攻击仍然有效。"}
{"title": "技术分享 | 看我如何使用TheFatRat黑掉你的Android手机", "url": "https://www.freebuf.com/articles/terminal/188986.html", "time": "2018-11-24", "level": "", "num_look": 436749, "num_comment": 12, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "在这篇文章中，我们将教大家如何使用TheFatRat这款工具。这款工具可以帮大家构建后门程序以及执行后渗透利用攻击等。"}
{"title": "恶意挖矿攻击的现状、检测及处置", "url": "https://www.freebuf.com/articles/system/189454.html", "time": "2018-11-24", "level": "", "num_look": 187761, "num_comment": 187761, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "对于企业机构和广大网民来说，除了面对勒索病毒这一类威胁以外，其往往面临的另一类广泛的网络威胁类型就是感染恶意挖矿程序。"}
{"title": "关于移动终端的短信安全分析", "url": "https://www.freebuf.com/articles/terminal/189453.html", "time": "2018-11-24", "level": "现金奖励", "num_look": 173674, "num_comment": 1, "author": "白帽子111", "tags": ["终端安全"], "text": "短信是公众接收信息的重要途径，也是网站登录页面识别用户本人的一个有效手段。网站通过用户手机号及对应手机号接收到的短信验证码，来识别一个有效用户，用户则通过官方短信验证码登录进网站。"}
{"title": "FIT 2019议题前瞻：三重奏，网络安全建设的方法论 | 企业安全俱乐部", "url": "https://www.freebuf.com/fevents/190140.html", "time": "2018-11-23", "level": "", "num_look": 92183, "num_comment": 1, "author": "FB客服", "tags": ["活动"], "text": "企业管理者应当充分认识到“互联网+”环境下企业安全管理的现状以及存在的安全威胁，树立全面安全管理意识，保障企业信息安全。FIT2019邀请多位重磅嘉宾带来干货议题分享，从多个多维讨论如何保障企业安全。"}
{"title": "拒绝噱头，能落地的才是好产品 | 对话WitAdwards 2018专家评委阿里巴巴高级安全专家张迅迪", "url": "https://www.freebuf.com/articles/people/190193.html", "time": "2018-11-23", "level": "红色标题", "num_look": 188181, "num_comment": 1, "author": "Akane", "tags": ["人物志", "活动"], "text": "聊到近年来不少新的安全概念，雷声大雨点小，往往在企业内部也难以落地，张迅迪对此也感慨颇深。"}
{"title": "安全调查 | 全球网络安全行业岗位缺口已上升至300万", "url": "https://www.freebuf.com/news/189389.html", "time": "2018-11-23", "level": "", "num_look": 118980, "num_comment": 12, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "岗位空缺加上高薪酬，目前仍然不足以吸引人才进入网络安全领域。根据最新的调查数据，全球网络安全行业岗位缺口已上升到了300万…"}
{"title": "网上谍影：境外间谍情报机关通过互联网窃取机密", "url": "https://www.freebuf.com/news/190302.html", "time": "2018-11-23", "level": "", "num_look": 113259, "num_comment": 4, "author": "shidongqi", "tags": ["资讯"], "text": "一家有着涉密邮件管理系统建设资质的公司，却发生了一起规模庞大的网络窃密事件，近千家单位的地理位置、邮件系统账号密码和网管人员的联系方式被窃取。"}
{"title": "从某电商钓鱼事件探索黑客“一站式服务”", "url": "https://www.freebuf.com/articles/terminal/189726.html", "time": "2018-11-23", "level": "红色标题", "num_look": 475007, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "现在的黑客，攻击手段包括但不限于钓鱼邮件、漏洞利用、挖矿病毒、勒索病毒、无文件攻击、远控木马、键盘记录器、密码破解等，是一次完整而全套的“服务”。"}
{"title": "如何通过Nmap Xml文件进行自动化渗透测试", "url": "https://www.freebuf.com/sectool/189341.html", "time": "2018-11-23", "level": "", "num_look": 181471, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Pentest-Machine是一款自动化渗透测试辅助工具，分析命令执行完成后，它会将对应的输出结果打印到终端上，同时将结果分别存储到对应的output-by-service/和output-by-host/目录中。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列-Miguel", "url": "https://www.freebuf.com/video/190217.html", "time": "2018-11-23", "level": "红色标题", "num_look": 485651, "num_comment": 485651, "author": "willhuang", "tags": ["视频"], "text": "来自葡萄牙的Miguel，早前主要开展一些安全研究，在各大平台提交的漏洞不算多，就连在HackerOne上提交的公开漏洞也才15个，他可谓一名Bug Hunter新手。"}
{"title": "一波盗取俄罗斯用户银行卡资金的定向攻击样本分析", "url": "https://www.freebuf.com/articles/system/189791.html", "time": "2018-11-23", "level": "", "num_look": 115618, "num_comment": 115618, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "近日出现一种木马，会不断监控用户的系统剪切板，如发现具有银行账号或者yandex账号的特征，就会把剪切板里的银行账号替换为攻击者的银行卡账号。"}
{"title": "BUF早餐铺 | 工信部开展网络安全技术应用试点示范项目推荐工作；美国邮政服务网站漏洞可暴露6000万用户数据；Facebook大幅提升漏洞赏金计划金额", "url": "https://www.freebuf.com/news/190112.html", "time": "2018-11-23", "level": "", "num_look": 82413, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "11月21日，工信部办公厅印发关于开展网络安全技术应用试点示范项目推荐工作的通知，打开早餐铺查看详情！"}
{"title": "一个基于AutoIT制作生成的欺骗性邮件木马样本分析", "url": "https://www.freebuf.com/articles/network/189505.html", "time": "2018-11-23", "level": "现金奖励", "num_look": 321510, "num_comment": 10, "author": "cgf99", "tags": ["网络安全"], "text": "最近收到一个名为ACH-Payment.zip的压缩文档的附件，打开后发现内容其实为一个exe的邮件欺诈木马，顺手分析一番。"}
{"title": "WannaMine升级到V3.0版本，警惕中招！", "url": "https://www.freebuf.com/articles/terminal/190093.html", "time": "2018-11-22", "level": "", "num_look": 256214, "num_comment": 256214, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "WannaMine病毒出现变种。是基于WannaMine改造，加入了一些免杀技术，传播机制与WannaCry勒索病毒一致（可在局域网内，通过SMB快速横向扩散）。"}
{"title": "抓住IoT+AI，把握企业未来 | 对话WitAdwards 2018专家评委京东安全首席架构师程岩", "url": "https://www.freebuf.com/articles/people/190010.html", "time": "2018-11-22", "level": "红色标题", "num_look": 124280, "num_comment": 124280, "author": "FB客服", "tags": ["人物志", "活动"], "text": "IoT毫无疑问是这两年的热点，而IoT安全话题往往围绕着智能设备或者工业应用场景展开，鲜有人讨论IoT在企业自身的应用以及相关安全体系问题。"}
{"title": "60W奖金、专属AJ鞋、S级挖洞技术分享、顶尖白帽面基盛宴 | FIT 2019神仙白帽趴全攻略", "url": "https://www.freebuf.com/fevents/189894.html", "time": "2018-11-22", "level": "", "num_look": 128451, "num_comment": 12, "author": "FB客服", "tags": ["活动"], "text": "安排！FIT2019的参会盒子白帽竟然可以这么幸福~"}
{"title": "BOTCHAIN：第一个基于比特币协议的功能齐全的僵尸网络（含PoC视频）", "url": "https://www.freebuf.com/articles/blockchain-articles/189175.html", "time": "2018-11-22", "level": "", "num_look": 132422, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["区块链安全"], "text": "国外安全专家介绍了一款名叫BOTCHAIN的僵尸网络，它是世界上第一款基于比特币协议构建的全功能僵尸网络。"}
{"title": "FIT 2019议题前瞻：万物互联，IoT 安全如何先行？| 前沿安全神盾局", "url": "https://www.freebuf.com/fevents/190159.html", "time": "2018-11-22", "level": "红色标题", "num_look": 79567, "num_comment": 79567, "author": "FB独家", "tags": ["活动"], "text": "物联网安全、人工智能安全、区块链安全、车联网……前沿安全科技在2018年引起一波又一波的话题热潮，在FIT 2019前沿安全神盾局，我们将汇聚国内外顶级专家学者，共议行业最前沿。"}
{"title": "如何使用Metasploit进行汽车安全性测试？", "url": "https://www.freebuf.com/articles/system/189293.html", "time": "2018-11-22", "level": "", "num_look": 158443, "num_comment": 3, "author": "secist", "tags": ["系统安全"], "text": "作为汽车黑客快速发展的一部分，我最喜欢的黑客工具之一Metasploit也开发了连接汽车的功能和模块。"}
{"title": "赌博无法提款自学成“才”，攻击境外博彩网站日进万元", "url": "https://www.freebuf.com/news/190122.html", "time": "2018-11-22", "level": "红色标题", "num_look": 290579, "num_comment": 22, "author": "Freddy", "tags": ["资讯"], "text": "赌博无法提款自学成黑客，攻击境外博彩网站日进万元，徐某及其团伙因涉嫌非法控制计算机信息系统罪被捕。"}
{"title": "大连暗泉信息科技有限公司招聘", "url": "https://www.freebuf.com/jobs/189465.html", "time": "2018-11-22", "level": "", "num_look": 170593, "num_comment": 4, "author": "sunny12", "tags": ["安全招聘"], "text": "暗泉信息位于大连地标星海湾广场，是以国内十年以上资深信息安全从业人员为核心的、在新的信息安全形势下专业从事网络信息安全技术的自主创新型企业。"}
{"title": "自己动手打造Github代码泄露监控工具之改进篇", "url": "https://www.freebuf.com/sectool/188102.html", "time": "2018-11-22", "level": "红色标题", "num_look": 313760, "num_comment": 13, "author": "ztencmcp", "tags": ["工具"], "text": "自从小弟上次发布了《自己动手打造Github代码泄露监控工具》一文后，承蒙各位客官老爷捧场，阅读量已经好几十万了，Github也受到了一些大佬的关注。"}
{"title": "CoinMiner挖矿病毒分析", "url": "https://www.freebuf.com/articles/terminal/189660.html", "time": "2018-11-22", "level": "现金奖励", "num_look": 288088, "num_comment": 288088, "author": "findream", "tags": ["终端安全"], "text": "想到之前分析的多为勒索类病毒，对于挖矿类病毒研究较少，故斗胆尝试小小分析一次，为大家带来CoinMiner挖矿病毒分析。"}
{"title": "美国邮政服务网站漏洞可暴露6000万用户数据，现已修复", "url": "https://www.freebuf.com/news/190085.html", "time": "2018-11-22", "level": "", "num_look": 116941, "num_comment": 116941, "author": "Freddy", "tags": ["资讯"], "text": "美国邮政服务系统刚刚修复了一个严重的网站漏洞，该漏洞使得拥有usps.com帐户的任何人都可查看和修改约6000万用户的账户详情。"}
{"title": "2018上半年日韩支付类病毒变化趋势研究报告", "url": "https://www.freebuf.com/articles/paper/189780.html", "time": "2018-11-22", "level": "", "num_look": 115796, "num_comment": 115796, "author": "腾讯手机管家", "tags": ["安全报告"], "text": "病毒木马伪装成韩国CJ 대한통운택배“DJ“快递，日本佐川急便“急便”快递等方式诱导受害者进行安装，通过隐藏图标潜伏在用户手机，对受害人的手机远程控制。"}
{"title": "BUF早餐铺 | 俄罗斯黑客工具“Cannon”隐蔽攻击欧美国家；工信部开展网络安全技术应用试点示范项目推荐工作；中消协调查：85.2%受访者曾遭遇APP个人信息泄露", "url": "https://www.freebuf.com/news/190078.html", "time": "2018-11-22", "level": "", "num_look": 88503, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "遭遇信息泄露的近九成受访者表示曾接到过推销电话或短信骚扰，约75%的受访者接到过诈骗电话，约63.4%的受访者收到过垃圾邮件。"}
{"title": "智能合约逆向心法34C3_CTF题分析（案例篇·一）", "url": "https://www.freebuf.com/articles/blockchain-articles/190109.html", "time": "2018-11-22", "level": "", "num_look": 103942, "num_comment": 103942, "author": "BUGX", "tags": ["区块链安全"], "text": "最近笔者Tri0nes@玄猫安全想研究了一下智能合约逆向，顺便入门一下逆向的知识，所以打算边学边写，不足之处请多指正。本篇我们就从一个题目开始看起。"}
{"title": "FIT 2019议题前瞻：探究物联网系统中的安全威胁 | 全球高峰会", "url": "https://www.freebuf.com/fevents/189875.html", "time": "2018-11-21", "level": "红色标题", "num_look": 91431, "num_comment": 91431, "author": "Akane", "tags": ["活动"], "text": "曾有专家预测，到了2020年，全球物联网市场规模将达17000亿美元，大约会有204亿台左右的物联网设备供人们使用。"}
{"title": "勒索软件最喜欢的接入点：远程桌面协议", "url": "https://www.freebuf.com/articles/network/189164.html", "time": "2018-11-21", "level": "", "num_look": 154795, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "从2018年开始，大家几乎每天都能听到关于勒索软件的消息。除此之外，勒索软件的更新和升级也从未停止过，比如说Dharma和SamSam这种杀伤力巨大的勒索软件，变种版本层出不穷。"}
{"title": "挖洞经验 | 价值$6500美金的Instagram发贴文字说明添加漏洞", "url": "https://www.freebuf.com/vuls/188993.html", "time": "2018-11-21", "level": "", "num_look": 171128, "num_comment": 7, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "今天我要和大家分享的是一个关于Instagram的漏洞，这个漏洞很有意思，我可以利用它来在其它Instagram用户的发贴中添加描述，最终也获得了Instagram官方$6500美金的奖励。"}
{"title": "快讯丨被恶意软件盯上，以安全性著称的iOS也不再安全", "url": "https://www.freebuf.com/news/189957.html", "time": "2018-11-21", "level": "", "num_look": 132108, "num_comment": 132108, "author": "Karunesh91", "tags": ["终端安全", "资讯"], "text": "恶意软件以假乱真，安全威胁不得不防~"}
{"title": "某行小程序投标测试的思路和坑", "url": "https://www.freebuf.com/articles/web/189684.html", "time": "2018-11-21", "level": "现金奖励", "num_look": 254557, "num_comment": 7, "author": "一只耗子", "tags": ["WEB安全"], "text": "最近看FB里面的文章，大体上往底层概念越来越多，各种挖矿木马的，还有各种难理解的概念，都没有勇气点开看，所以本文说点简单的。"}
{"title": "Gmail也出漏洞，邮件潜在的安全风险不得不防", "url": "https://www.freebuf.com/news/189607.html", "time": "2018-11-21", "level": "", "num_look": 133539, "num_comment": 133539, "author": "Karunesh91", "tags": ["资讯"], "text": "Gmail被曝出漏洞，修改发件人字段可能导致恶意攻击。"}
{"title": "百度杀毒已死，曾承诺“不骚扰、不窃取、不胁迫”", "url": "https://www.freebuf.com/articles/neopoints/189996.html", "time": "2018-11-21", "level": "红色标题", "num_look": 220459, "num_comment": 11, "author": "shidongqi", "tags": ["观点"], "text": "百度杀毒承诺“不骚扰、不窃取、不胁迫”，但在捆绑推广的拖累下，这款杀软除了背上“流氓”的名声，似乎就没有人去关心它是不是真的纯净了。"}
{"title": "新手不要再被误导！这是一篇最新的Xposed模块编写教程", "url": "https://www.freebuf.com/articles/terminal/189021.html", "time": "2018-11-21", "level": "现金奖励", "num_look": 504579, "num_comment": 11, "author": "张召忠", "tags": ["终端安全"], "text": "笔者近日收到过朋友初学Xposed模块编写时的求助，萌生了写一篇关于在最新AndriodStudio 开发环境下实现Xposed模块开发入门的文章。"}
{"title": "BUF早餐铺 | 男子4个月出售千万条个人信息获利5万；印度学生攻击游戏服务器窃取虚拟货币；EA Origin客户端中的漏洞会暴露游戏玩家的数据", "url": "https://www.freebuf.com/news/189906.html", "time": "2018-11-21", "level": "", "num_look": 97159, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "近日，磐安警方破获一起侵犯公民个人信息案，抓获犯罪嫌疑人8名，查获各类公民个人信息100余万条。犯罪嫌疑人添加了多个QQ群，并在群里不定期发布售卖信息。"}
{"title": "2018广受关注的20家国际网络安全公司", "url": "https://www.freebuf.com/news/189883.html", "time": "2018-11-20", "level": "红色标题", "num_look": 119909, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "本文列出20家不同体量的企业，主要从投资、并购、融资或战略等维度获得了业内的热点关注。"}
{"title": "赛门铁克发现朝鲜APT组织Lazarus攻击金融机构的关键性工具", "url": "https://www.freebuf.com/articles/network/189239.html", "time": "2018-11-20", "level": "", "num_look": 177982, "num_comment": 177982, "author": "clouds", "tags": ["网络安全"], "text": "10月8日，安全公司赛门铁克（Symantc）发表报告声称，已经发现了Lazarus组织用于“FASTCash”攻击的关键性工具。"}
{"title": "挖洞经验 |  HackerOne的双因素认证和上报者黑名单绕过漏洞（$10,000）", "url": "https://www.freebuf.com/vuls/189029.html", "time": "2018-11-20", "level": "", "num_look": 159301, "num_comment": 9, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "今天我要和大家分享的是一个HackerOne相关的漏洞，利用该漏洞，我可以绕过HackerOne漏洞提交时的双因素认证机制（2FA）和赏金项目中（Bug Bounty Program）的上报者黑名单限制。"}
{"title": "平安银行总行零售信息安全岗位招聘", "url": "https://www.freebuf.com/jobs/189440.html", "time": "2018-11-20", "level": "", "num_look": 116221, "num_comment": 6, "author": "平安银行应用安全团队", "tags": ["安全招聘"], "text": "平安银行股份有限公司是总部设在深圳的全国性股份制商业银行（深圳证券交易所简称：平安银行，证券代码000001）。近年来,平安银行多次荣膺各类重要奖项。"}
{"title": "物联网改变生活？现在这么说还太早", "url": "https://www.freebuf.com/news/188441.html", "time": "2018-11-20", "level": "", "num_look": 139425, "num_comment": 4, "author": "Karunesh91", "tags": ["系统安全", "网络安全"], "text": "物联网啊，安全还是不安全呢..."}
{"title": "快讯 | 疑似30万玖融网用户数据被挂暗网，仅售1个比特币", "url": "https://www.freebuf.com/news/189841.html", "time": "2018-11-20", "level": "红色标题", "num_look": 207979, "num_comment": 13, "author": "Freddy", "tags": ["资讯"], "text": "黑客称，他已获得该平台上30万的用户数据，并以一个比特币（现价值人民币3.5万元）的价格出售。"}
{"title": "从pwnable.tw-calc看数组越界造成的任意地址读写", "url": "https://www.freebuf.com/articles/system/189636.html", "time": "2018-11-20", "level": "现金奖励", "num_look": 119814, "num_comment": 2, "author": "Lkerenl", "tags": ["系统安全"], "text": "数组越界访问是c程序常见的错误之一，由于c语言并不向Java等语言对数组下标有严格的检查，一旦出现越界，就有可能造成严重的后果。"}
{"title": "自杀式“埋雷”，微信埋雷专家病毒分析", "url": "https://www.freebuf.com/articles/terminal/189568.html", "time": "2018-11-20", "level": "红色标题", "num_look": 236234, "num_comment": 7, "author": "暗影安全实验室", "tags": ["终端安全"], "text": "近日，平台监测到一种新型病毒，安装名称为\"微信埋雷专家\"，经过安全人员分析研究，发现该病毒伪装成可以操控微信红包埋雷的外挂软件，诱骗用户安装并开启危险权限。"}
{"title": "BUF早餐铺 | Instagram出现漏洞：用户密码可能泄露；谷歌安卓应用防护增强：号称一个应用也不漏过；蓝牙再出漏洞，数百万辆汽车受影响", "url": "https://www.freebuf.com/news/189772.html", "time": "2018-11-20", "level": "", "num_look": 82279, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "Instagram出现漏洞：用户密码可能泄露；谷歌安卓应用防护增强：号称一个应用也不漏过；蓝牙再出漏洞，数百万辆汽车受影响。"}
{"title": "如何在PowerShell CLM模式下枚举域信息？", "url": "https://www.freebuf.com/articles/system/188982.html", "time": "2018-11-19", "level": "", "num_look": 112150, "num_comment": 112150, "author": "secist", "tags": ["系统安全"], "text": "如何在没有获取RSAT和管理权限的情况下，使用Micorosft的PowerShell ActiveDirectory模块？"}
{"title": "中奖绝缘体？可能不是你体质原因，而是抽奖系统问题", "url": "https://www.freebuf.com/articles/security-management/189297.html", "time": "2018-11-19", "level": "红色标题", "num_look": 413348, "num_comment": 15, "author": "GEETEST极验", "tags": ["安全管理"], "text": "这股抽奖的“圆梦”之风越刮越大，广大网民每次都在嘴上说我是“中奖绝缘体”，但身体很诚实必定会转发参加。"}
{"title": "FIT 2019议题前瞻：网络安全法案例总结与企业合规价值 | 企业安全俱乐部", "url": "https://www.freebuf.com/fevents/189601.html", "time": "2018-11-19", "level": "红色标题", "num_look": 103032, "num_comment": 1, "author": "FB客服", "tags": ["活动"], "text": "我国《网络安全法》正式实施已经一年了，围绕网络主权、网络犯罪等重要制度立法、执法和司法活动都在积极推动。"}
{"title": "挖洞经验 | HackerOne安全团队内部处理附件导出漏洞（$12,500）", "url": "https://www.freebuf.com/vuls/189115.html", "time": "2018-11-19", "level": "", "num_look": 196329, "num_comment": 11, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "今天我要和大家分享的是一个和HackerOne平台相关的漏洞，该漏洞在于可以利用HackerOne平台的“Export as.zip”功能，把HackerOne安全团队后台的漏洞处理图片附件导出。"}
{"title": "参会报名 |「智慧赋能·安全变革」FIT 2019中国首席信息安全官高峰论坛", "url": "https://www.freebuf.com/news/188927.html", "time": "2018-11-19", "level": "", "num_look": 101672, "num_comment": 101672, "author": "FB独家", "tags": ["活动", "资讯"], "text": "FIT 2019中国首席信息安全官高峰论坛报名中～"}
{"title": "快讯 | 谁干的？暗网最大网络托管商被黑，6500个网站遭彻底删除", "url": "https://www.freebuf.com/news/189693.html", "time": "2018-11-19", "level": "红色标题", "num_look": 217991, "num_comment": 2, "author": "Freddy", "tags": ["资讯"], "text": "11月15日星期四（UTC），黑客对Daniel's Hosting下手，删除了6500多个网站数据。"}
{"title": "你可曾想过在iOS上跑Linux？", "url": "https://www.freebuf.com/news/189464.html", "time": "2018-11-19", "level": "", "num_look": 210744, "num_comment": 4, "author": "Karunesh91", "tags": ["资讯"], "text": "以安全性著称的IOS能运行Linux了，这事是好是坏？"}
{"title": "Metinfo6.0.0-6.1.2前台注入漏洞生命线", "url": "https://www.freebuf.com/vuls/188864.html", "time": "2018-11-19", "level": "现金奖励", "num_look": 207773, "num_comment": 5, "author": "Mochazz", "tags": ["WEB安全", "漏洞"], "text": "这个前台注入漏洞存在已久，从MetInfo发布的6.0版本就存在，且后来官方的修复代码，也可以直接绕过。该漏洞直到6.1.3版本才被修复。"}
{"title": "恶性木马下载器“幽虫”分析", "url": "https://www.freebuf.com/articles/web/189357.html", "time": "2018-11-19", "level": "", "num_look": 170615, "num_comment": 4, "author": "360安全", "tags": ["WEB安全"], "text": "2018年下半年开始，360互联网安全中心监控到一批恶性木马下载器一直在更新传播，初步统计，中招机器超过40万台。"}
{"title": "BUF早餐铺 | Gmail出现漏洞导致用户表单可被修改；全球网络安全行业岗位缺口达300万；《具有舆论属性或社会动员能力的互联网信息服务安全评估规定》11 月30日起施行", "url": "https://www.freebuf.com/news/189687.html", "time": "2018-11-19", "level": "", "num_look": 84496, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "台积电第三季度财报显示，8月3日电脑病毒感染事件约造成25.96亿新台币（约人民币5.84亿元）损失。"}
{"title": "Slither：第一款针对Solidity的静态分析框架", "url": "https://www.freebuf.com/sectool/189015.html", "time": "2018-11-18", "level": "", "num_look": 133135, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Slither是第一个开源的针对Solidity语言的静态分析框架。Slither速度非常快，准确性也非常高，它能够在不需要用户交互的情况下，在几秒钟之内找到真正的漏洞。"}
{"title": "BYOB：我的天！又一个僵尸网络开源了BYOB僵尸网络开源代码", "url": "https://www.freebuf.com/sectool/188996.html", "time": "2018-11-18", "level": "", "num_look": 222737, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["工具"], "text": "大家没看错！现在，又有一个僵尸网络开源了自己的，这个僵尸网络就是BYOB！"}
{"title": "KoiMiner挖矿木马变种入侵，超5000台SQL Server服务器被控制", "url": "https://www.freebuf.com/articles/network/189501.html", "time": "2018-11-18", "level": "", "num_look": 178532, "num_comment": 2, "author": "腾讯电脑管家", "tags": ["网络安全"], "text": "近期发现KoiMiner挖矿木马变种，该变种的挖矿木马已升级到6.0版本，目前已入侵控制超过5000台SQL Server服务器，对企业数据安全构成重大威胁。"}
{"title": "2018年10月十大恶意软件，挖矿类仍然占据头牌", "url": "https://www.freebuf.com/news/189387.html", "time": "2018-11-18", "level": "", "num_look": 164260, "num_comment": 3, "author": "Karunesh91", "tags": ["网络安全", "资讯"], "text": "Check Point最新的全球安全威胁指数，对全球10月恶意软件进行了统计，这些你都了解吗？"}
{"title": "SniffAir：无线渗透测试框架", "url": "https://www.freebuf.com/sectool/188908.html", "time": "2018-11-17", "level": "", "num_look": 182159, "num_comment": 3, "author": "secist", "tags": ["工具"], "text": "SniffAir是一个开源的无线安全框架，可帮助你轻松解析被动收集的无线数据并发起复杂的无线攻击。此外，它还可以处理大型的或多个pcap文件，执行交叉检查和流量分析，以寻找潜在的安全漏洞。"}
{"title": "威胁清单 | 全球500强企业弃用的Web应用存在安全隐患", "url": "https://www.freebuf.com/news/188837.html", "time": "2018-11-17", "level": "", "num_look": 91982, "num_comment": 91982, "author": "米雪儿", "tags": ["资讯"], "text": "一些已被弃用很久的企业Web应用程序仍然会经常影响着企业安全，因为它们可能存在可利用的漏洞和缺陷。"}
{"title": "Funny的多媒体文件隐写题", "url": "https://www.freebuf.com/articles/database/189161.html", "time": "2018-11-17", "level": "红色标题", "num_look": 157073, "num_comment": 7, "author": "zsg045", "tags": ["数据安全"], "text": "前不久参加某网络安全竞赛，其中有一道misc类型的题目被我钻研了很久，于是在比赛结束的当晚我继续钻研本题，最终找到了隐藏的flag。"}
{"title": "StackOverFlow之Ret2libc详解", "url": "https://www.freebuf.com/news/182894.html", "time": "2018-11-17", "level": "现金奖励", "num_look": 259510, "num_comment": 6, "author": "h1mmel", "tags": [], "text": "我的上一篇文章《StackOverFlow之Ret2ShellCode详解》 谈到的栈溢出攻击方法是 ret2shellcode，本文通过示例演示如何利用 ret2libc 的攻击方式实现任意代码执行 。"}
{"title": "送书福利 | 我有书，你有故事吗？来自安全老兵的实战宝典", "url": "https://www.freebuf.com/fevents/189570.html", "time": "2018-11-16", "level": "红色标题", "num_look": 339610, "num_comment": 106, "author": "shidongqi", "tags": ["活动"], "text": "安全圈从来不缺少好的故事，发生的故事多了，在安全这条路上也便走的更顺了。我有书，拿故事来换可好？"}
{"title": "BlobRunner：一款功能强大的恶意软件Shellcode调试与分析工具", "url": "https://www.freebuf.com/sectool/188770.html", "time": "2018-11-16", "level": "", "num_look": 203718, "num_comment": 203718, "author": "Alpha_h4ck", "tags": ["工具", "数据安全"], "text": "今天给大家介绍的是一款名叫BlobRunner的安全分析工具，广大研究人员可以在恶意软件的分析过程中使用BlobRunner快速提取和调试恶意软件中的shellcode。"}
{"title": "构造优质上传漏洞Fuzz字典", "url": "https://www.freebuf.com/articles/web/188464.html", "time": "2018-11-16", "level": "现金奖励", "num_look": 420151, "num_comment": 26, "author": "gv·残亦", "tags": ["WEB安全"], "text": "上传漏洞的利用姿势很多，同时也会因为语言，中间件，操作系统的不同，利用也不同。当遇到一个上传点，如何全面的利用以上姿势测试一遍，并快速发现可以成功上传webshell的姿势？"}
{"title": "绑定金融账号的Apple ID有风险，外媒也来支招", "url": "https://www.freebuf.com/news/189350.html", "time": "2018-11-16", "level": "", "num_look": 85628, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "根据Bloomberg的最新报道，近期发生了一系列针对国内用户的网络攻击，网络犯罪分子利用窃取来的Apple ID来入侵用户的账号，并从中窃取大量金钱。"}
{"title": "利用Drupal漏洞进行传播的挖矿僵尸病毒分析", "url": "https://www.freebuf.com/articles/network/188939.html", "time": "2018-11-16", "level": "现金奖励", "num_look": 258387, "num_comment": 4, "author": "cgf99", "tags": ["网络安全"], "text": "在对服务器进行例行性检查的时候，在一台ngix服务器的日志文件access.log里面发现了一些奇怪的访问记录，于是就对其进行了一些分析。"}
{"title": "Pwn2Own Tokyo 2018：iPhone X、三星S9、小米6被逐个攻破", "url": "https://www.freebuf.com/news/189490.html", "time": "2018-11-16", "level": "红色标题", "num_look": 396803, "num_comment": 10, "author": "shidongqi", "tags": ["资讯"], "text": "在刚刚结束的Pwn2Own Tokyo 2018 上，一群黑客相继对不同的手机发起了猛攻，最终，小米6 五次挑战中均被攻破，此外iPhone X 和三星 S9也未能幸免于黑客攻击。"}
{"title": "智能合约迁移的工作原理", "url": "https://www.freebuf.com/articles/blockchain-articles/188938.html", "time": "2018-11-16", "level": "", "num_look": 98688, "num_comment": 98688, "author": "猎豹区块链安全实验室", "tags": ["区块链安全"], "text": "智能合约是很容易受到攻击的——合约上存在的bug、用户的钱包的漏洞、或者设置上的疏忽，都会导致被攻击。"}
{"title": "BUF早餐铺 | Pwn2Own：Galaxy S9、iPhone X和小米Mi6成为赚取奖金的对象；Facebook再曝漏洞，可使私人信息泄露；西门子修复防火墙漏洞，确保运营商安全", "url": "https://www.freebuf.com/news/189424.html", "time": "2018-11-16", "level": "", "num_look": 100859, "num_comment": 2, "author": "Freddy", "tags": ["资讯"], "text": "Pwn2Own共报了11项挑战：三星S9有2项，全部破解成功；iPhoneX有4项，成功2项；小米6有5项，全部破解成功；主办方还设置了华为P20Pro和Pixel2的破解目标，无人报名。"}
{"title": "日本网络安全部长从来没用过电脑，甚至不知道USB是什么", "url": "https://www.freebuf.com/news/189546.html", "time": "2018-11-15", "level": "红色标题", "num_look": 210389, "num_comment": 19, "author": "shidongqi", "tags": ["资讯"], "text": "我们经常说“专业的人做专业的事”，而日本一个表示没用过电脑，甚至不知道USB是什么的人却已经成为了网络安全部长，并且他将负责2020年东京奥运会网络安全的准备工作。"}
{"title": "FIT 2019议题前瞻：零信任（BeyondCorp）架构里的资产安全管理 | 企业安全俱乐部", "url": "https://www.freebuf.com/fevents/189405.html", "time": "2018-11-15", "level": "红色标题", "num_look": 98935, "num_comment": 98935, "author": "FB客服", "tags": ["活动"], "text": "所谓的零信任（BeyondCorp）就是一种默认任何东西都不可信的安全理念，无论网络流量是发生在公司的安全边界内部还是外部，都必须经过验证才能访问任何内容。"}
{"title": "CNNVD关于微软多个安全漏洞的通报", "url": "https://www.freebuf.com/articles/paper/189410.html", "time": "2018-11-15", "level": "", "num_look": 132414, "num_comment": 3, "author": "CNNVD", "tags": ["安全报告"], "text": "微软官方发布了多个安全漏洞的公告，成功利用这些安全漏洞的攻击者可以在目标系统上执行任意代码。"}
{"title": "黑客段子手们，要喝FreeBuf定制“冰阔落”嘛？", "url": "https://www.freebuf.com/fevents/189364.html", "time": "2018-11-15", "level": "红色标题", "num_look": 396112, "num_comment": 131, "author": "FB客服", "tags": ["活动"], "text": "大佬，要喝冰阔落嘛？FreeBuf 定制的那种？"}
{"title": "基于Bushido的DDoS服务只需要几美元就能打垮一个网站", "url": "https://www.freebuf.com/news/189016.html", "time": "2018-11-15", "level": "", "num_look": 124316, "num_comment": 7, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "来自FortiGuard实验室的安全研究专家发现了一个名叫“0x-booter”的DDoS即服务平台，这个平台虽然代码架构不优秀，但是功能却非常强大，而且还提供了易于使用的用户接口。"}
{"title": "小米被质疑做虚假抢购，目的为了收集用户信息……", "url": "https://www.freebuf.com/news/189452.html", "time": "2018-11-15", "level": "", "num_look": 161203, "num_comment": 12, "author": "Karunesh91", "tags": ["资讯"], "text": "朋友，GDPR了解一下？"}
{"title": "WitAwards 2018互联网安全年度评选「专家评委团」曝光", "url": "https://www.freebuf.com/fevents/189333.html", "time": "2018-11-15", "level": "红色标题", "num_look": 390220, "num_comment": 1, "author": "FB客服", "tags": ["活动"], "text": "WitAwards 2018专家评委团首次曝光，阵容强大，你准备好了吗？"}
{"title": "如何在Android APK中植入Meterpreter", "url": "https://www.freebuf.com/articles/terminal/188585.html", "time": "2018-11-15", "level": "", "num_look": 189404, "num_comment": 1, "author": "周大涛", "tags": ["终端安全"], "text": "随着移动设备的快速发展，我们日常生活中的许多应用程序正在迁移到云部署，从JavaScript浏览器框架到支持移动设备的前端，例如Apple iOS上的Objective-C，或基于Android的Java。"}
{"title": "iTutorGroup安全团队招聘", "url": "https://www.freebuf.com/jobs/189244.html", "time": "2018-11-15", "level": "", "num_look": 121715, "num_comment": 3, "author": "TutorABC", "tags": ["安全招聘"], "text": "iTutorGroup是由姚明代言的全球在线教育“独角兽”公司，2015年11月，iTutorGroup获得GIC、中俄基金、高盛、银翎资本等世界级投资方近两亿美元C轮融资。"}
{"title": "谷歌网络服务宕机，中国电信背锅", "url": "https://www.freebuf.com/news/189313.html", "time": "2018-11-15", "level": "红色标题", "num_look": 222853, "num_comment": 8, "author": "Freddy", "tags": ["资讯"], "text": "虽然这次事件为中国电信带来了“宝贵”的谷歌流量，但是黑锅我们真的不背。"}
{"title": "Linux Restricted Shell绕过技巧总结", "url": "https://www.freebuf.com/articles/system/188989.html", "time": "2018-11-15", "level": "现金奖励", "num_look": 238667, "num_comment": 8, "author": "zusheng", "tags": ["系统安全"], "text": "如今网络安全行业越来越规范，我们还想直接获取到未限制的shell是件很困难的事情，系统运维人员一般都会给Linux shell加上一些限制来防止入侵，通常会阻止运行某些特定的命令。"}
{"title": "Microsoft SQL Server漏洞浅析", "url": "https://www.freebuf.com/vuls/188922.html", "time": "2018-11-15", "level": "", "num_look": 206816, "num_comment": 206816, "author": "深信服千里目安全实验室", "tags": ["漏洞"], "text": "近几年Microsoft SQL Server数据库爆发的漏洞数量与其它类型数据库相比，所暴露出来的漏洞相对较少。本文挑选两个可利用性高，且具有代表性的漏洞进行分析。"}
{"title": "一次编码WebShell bypass D盾的分析尝试", "url": "https://www.freebuf.com/articles/web/189097.html", "time": "2018-11-15", "level": "现金奖励", "num_look": 215687, "num_comment": 11, "author": "si1ence", "tags": ["WEB安全"], "text": "最近偶然间捕获到了一个webshell的样本经过了4次编码来绕过检测感觉功能还挺强大的，于是就简单分析一下然后再简单的优化了一下发现更nice。"}
{"title": "BUF早餐铺 | 微软发布11月安全更新；谷歌发布全球首份安卓生态安全报告；10万僵尸网络滥用家用路由器发送垃圾邮件", "url": "https://www.freebuf.com/news/189415.html", "time": "2018-11-15", "level": "", "num_look": 99031, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "北京市公安局网络安全保卫总队猎网平台发布《网购安全生态报告》。报告显示：假冒购物软件和专业电商购物平台成为网络黑客的新目标。"}
{"title": "SlackExtract：用于提取slack用户所有文件的PowerShell脚本", "url": "https://www.freebuf.com/sectool/188399.html", "time": "2018-11-14", "level": "", "num_look": 106482, "num_comment": 106482, "author": "secist", "tags": ["工具"], "text": "SlackExtract是一个用于从用户slack帐户中提取所有文件，消息和用户配置文件的PowerShell脚本。或者，你也可以指定channels频道（最多为默认限制）来提取这些数据。"}
{"title": "技术讨论 | 看我如何使用Isip拦截、分析和修改网络数据包", "url": "https://www.freebuf.com/articles/network/188766.html", "time": "2018-11-14", "level": "", "num_look": 132715, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "今天给大家介绍的是一款名叫Isip的模拟工具，该工具套装可用于数据包修改、嗅探、模拟中间人攻击、模糊测试和模拟DoS攻击等等。"}
{"title": "勒索病毒GlobeImposter攻防演练", "url": "https://www.freebuf.com/articles/terminal/189054.html", "time": "2018-11-14", "level": "", "num_look": 143943, "num_comment": 143943, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "勒索病毒GlobeImposter频频在行业专网肆虐，究竟是如何入侵、如何传播？我们的AF\\SIP\\EDR又是如何防御？效果如何？本文将详细解读~"}
{"title": "跨越次元的攻击？连虚拟机都不安全了", "url": "https://www.freebuf.com/news/188898.html", "time": "2018-11-14", "level": "", "num_look": 490273, "num_comment": 1, "author": "Karunesh91", "tags": ["系统安全", "资讯"], "text": "VirtualBox出了个0day，原因居然是惹得黑客不高兴了。"}
{"title": "浅谈大型互联网企业入侵检测及防护策略", "url": "https://www.freebuf.com/articles/es/188913.html", "time": "2018-11-14", "level": "红色标题", "num_look": 433840, "num_comment": 9, "author": "美团技术团队", "tags": ["企业安全"], "text": "如何知道自己所在的企业是否被入侵了？是没人来“黑”，还是因自身感知能力不足，暂时还无法发现？其实，入侵检测是每一个大型互联网企业都要面对的严峻挑战。"}
{"title": "因为看见，所以发现：QBotVariant谢绝落幕", "url": "https://www.freebuf.com/articles/network/188980.html", "time": "2018-11-14", "level": "", "num_look": 198981, "num_comment": 1, "author": "阿里云安全", "tags": ["网络安全"], "text": "国内安全团队从今年5月份监测到一BOT家族，其样本改写自互联网公开渠道源码，在互联网上广泛传播，造成了极大的危害，该类样本命名为QBotVariant。"}
{"title": "纯静态分析俄罗斯银行木马", "url": "https://www.freebuf.com/articles/others-articles/188994.html", "time": "2018-11-14", "level": "现金奖励", "num_look": 101702, "num_comment": 4, "author": "DD黃藥師BB", "tags": ["其他"], "text": "一切开始于拿到俄语《Лабораторная работа 5.doc》文档，上传virustotal检测发现是利用了CVE-2017-11882便开始了接下来的一系列操作。"}
{"title": "BUF早餐铺 | Bug猎手发现Steam严重漏洞，V社对其进行2万美元奖励；安装了iOS 12.1的iPhone XS Max已证实被越狱；北美数十万人遭比特币“网络钓鱼”邮件威胁", "url": "https://www.freebuf.com/news/189265.html", "time": "2018-11-14", "level": "", "num_look": 119375, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "来自世界各地50个国家和超150多家科技公司签署了一项名为《Paris call for trust and security in cyberspace》的承诺以表它们致力于打击网络犯罪行为的决心。"}
{"title": "2019年1月1日起执行：网络安全竞赛活动不得过度商业化", "url": "https://www.freebuf.com/news/189245.html", "time": "2018-11-13", "level": "", "num_look": 218679, "num_comment": 7, "author": "Akane", "tags": ["资讯"], "text": "近年来国内多支战队在各项CTF比赛中取得优异成绩，近日监管机构也对国内网络安全竞赛活动提出了具体的监管需求。"}
{"title": "CaptfEncoder：一款跨平台网络安全工具套件", "url": "https://www.freebuf.com/sectool/188397.html", "time": "2018-11-13", "level": "金币+5", "num_look": 211286, "num_comment": 4, "author": "guyoung", "tags": ["工具"], "text": "CaptfEncoder是一款跨平台网络安全工具套件，提供网络安全相关编码转换、古典密码、密码学、特殊编码等工具，并聚合各类在线工具。"}
{"title": "FIT 2019议题前瞻：黑客如何用荧光棒给你打Call | Hack Demo", "url": "https://www.freebuf.com/fevents/189061.html", "time": "2018-11-13", "level": "红色标题", "num_look": 81161, "num_comment": 2, "author": "FB客服", "tags": ["活动"], "text": "虽然现在因为网络的发展，黑客也逐渐多元化起来，但是我就看个爱豆听个歌，回忆一下青春追赶一下潮流，也能被黑客盯上？"}
{"title": "我是如何找到Donald Daters应用数据库漏洞的", "url": "https://www.freebuf.com/articles/database/188810.html", "time": "2018-11-13", "level": "", "num_look": 129429, "num_comment": 1, "author": "secist", "tags": ["数据安全"], "text": "有人为特朗普的支持者开发了一个名为“唐纳德约会者”（Donald Daters）的软件，并配以“让美国人再次约会”的响亮口号！这顿时激起了我的斗志，我决定拿它来练练手~"}
{"title": "剁手结束，快递背后的黑产狂欢才刚开始", "url": "https://www.freebuf.com/articles/network/189068.html", "time": "2018-11-13", "level": "红色标题", "num_look": 631563, "num_comment": 7, "author": "GEETEST极验", "tags": ["网络安全"], "text": "昨天双十一，想必大家都是彻夜备战，在11日凌晨0点02分05秒，2018天猫双十一全球狂欢节成交额就突破了100亿元人民币。我们手剁完了坐等快递来，但是黑产的狂欢似乎才刚刚开始。"}
{"title": "深信服招聘安全高端人才", "url": "https://www.freebuf.com/jobs/188950.html", "time": "2018-11-13", "level": "", "num_look": 119603, "num_comment": 4, "author": "suifeng-刘军", "tags": ["安全招聘"], "text": "深信服是国内最大的企业级安全厂商之一，致力于提供创新的网络安全建设解决方案，推出的众多产品中，安全系列产品在中国市场占有率居前列。"}
{"title": "青藤万相·主机自适应安全平台 | WitAwards 2018“年度热门产品及服务”参评巡礼", "url": "https://www.freebuf.com/fevents/189191.html", "time": "2018-11-13", "level": "红色标题", "num_look": 66531, "num_comment": 66531, "author": "shidongqi", "tags": ["活动"], "text": "安全总是落后攻击一步，这是我们目前所面临的困境。很大程度上因为我们面临的威胁始终是无法预估的。新时代需要一种更先进的理论框架来应对日益严峻的挑战，自适应安全就此诞生了。"}
{"title": "疑似Group 123 APT团伙利用HWP软件未公开漏洞的定向攻击分析", "url": "https://www.freebuf.com/vuls/188846.html", "time": "2018-11-13", "level": "", "num_look": 146123, "num_comment": 146123, "author": "奇安信威胁情报中心", "tags": ["漏洞", "系统安全"], "text": "2018年9月20日，360威胁情报中心在日常样本分析与跟踪过程中发现了一例针对韩国文字处理软件Hancom Office设计的漏洞攻击样本。"}
{"title": "深入理解Double Free：CVE-2015-2419 Exploit分析", "url": "https://www.freebuf.com/vuls/188558.html", "time": "2018-11-13", "level": "现金奖励", "num_look": 183698, "num_comment": 183698, "author": "elli0tn0phacker", "tags": ["漏洞"], "text": "CVE-2015-2419是IE11中jscript9.dll的一个Double Free漏洞。虽然从发现在野攻击样本到今天已有三年多，但是目前依然被一些著名的漏洞利用工具包使用，可见其漏洞利用的稳定。"}
{"title": "利用nRF Sniffer对蓝牙BLE通信数据进行嗅探和分析", "url": "https://www.freebuf.com/sectool/188819.html", "time": "2018-11-13", "level": "现金奖励", "num_look": 322931, "num_comment": 3, "author": "barcating", "tags": ["工具"], "text": "本文主要介绍 Nordic 的nRF51 Dongle (PCA10031)工具的安装和配置，以及使用该工具配合Wireshark软件，针对蓝牙BLE通信数据进行抓包合协议分析。"}
{"title": "BUF早餐铺 | 黑客在Windows安装文件中隐藏加密货币挖掘恶意软件；美国军方公开了俄罗斯政府的恶意程序 ；臭名昭著的Derptrolling对DDoS攻击表示愧疚", "url": "https://www.freebuf.com/news/189102.html", "time": "2018-11-13", "level": "", "num_look": 99329, "num_comment": 2, "author": "Karunesh91", "tags": ["资讯"], "text": "黑客在Windows安装文件中隐藏加密货币挖掘恶意软件；美国军方公开了俄罗斯政府的恶意程序 ；臭名昭著的Derptrolling对DDoS攻击表示愧疚。"}
{"title": "Jndiat：通过T3协议测试Weblogic服务器安全性", "url": "https://www.freebuf.com/sectool/188697.html", "time": "2018-11-12", "level": "", "num_look": 144464, "num_comment": 144464, "author": "secist", "tags": ["工具"], "text": "JNDIAT（JNDI攻击工具）是一款开源的通过T3协议测试Weblogic server安全性的工具。"}
{"title": "一则邮件攻击样本分析分享", "url": "https://www.freebuf.com/articles/network/188527.html", "time": "2018-11-12", "level": "红色标题", "num_look": 287879, "num_comment": 9, "author": "ZInsight团队", "tags": ["网络安全"], "text": "通过邮件投递病毒文件是网络攻击常用的一种方式，因此防御邮件攻击是每个安全团队都需要重点考虑的内容。"}
{"title": "漏洞预警 | 知名交易所gate.io受JS代码劫持", "url": "https://www.freebuf.com/articles/blockchain-articles/188856.html", "time": "2018-11-12", "level": "", "num_look": 731358, "num_comment": 1, "author": "BUGX", "tags": ["区块链安全"], "text": "近期，网络分析平台 StatCounter 被黑客攻击，其服务代码被植入恶意脚本，加密货币交易所 gate.io 因使用此代码而受到恶意劫持。"}
{"title": "使用presentationhost.exe绕过AppLocker白名单限制", "url": "https://www.freebuf.com/articles/system/188699.html", "time": "2018-11-12", "level": "", "num_look": 114366, "num_comment": 114366, "author": "secist", "tags": ["系统安全"], "text": "Presentationhost.exe是一个内置的Windows可执行文件，用于运行XAML浏览器应用程序。在多个AppLocker白名单绕过列表中，Presentationhost.exe都位列其中。"}
{"title": "工控安全 | 西门子通信协议S7COMM（Part 2）", "url": "https://www.freebuf.com/articles/ics-articles/188606.html", "time": "2018-11-12", "level": "现金奖励", "num_look": 353136, "num_comment": 1, "author": "LiukerTeam", "tags": ["工控安全"], "text": "本文上一篇文章《工控安全 | 西门子通信协议S7COMM（Part 1）》的S7Comm协议章节继续开展，没看过上一篇的小伙伴需要补补课哦，不然会不知所云~"}
{"title": "印象笔记Windows客户端6.15本地文件读取和远程命令执行漏洞(CVE-2018-18524)分析", "url": "https://www.freebuf.com/vuls/188679.html", "time": "2018-11-12", "level": "", "num_look": 159683, "num_comment": 3, "author": "Knownsec知道创宇", "tags": ["漏洞"], "text": "我当时的同事@sebao告诉我印象笔记修复了他的XSS漏洞并登上了名人堂，碰巧国庆的时候考古过几个客户端 XSS 导致命令执行的案例，就想在印象笔记客户端也寻找一下类似的问题。"}
{"title": "从MySQL出发的反击之路", "url": "https://www.freebuf.com/vuls/188910.html", "time": "2018-11-12", "level": "红色标题", "num_look": 283849, "num_comment": 4, "author": "美丽联合安全MLSRC", "tags": ["WEB安全", "漏洞"], "text": "某天看到 lightless 师傅的文章 Read MySQL Client's File，觉得这个「漏洞」真的非常神奇，小小研究了一下具体的利用。"}
{"title": "BUF早餐铺 | 大疆身份识别系统漏洞允许攻击者将无人机变成间谍工具；央视：个人信息保护已经列入立法规划；工信部将百度、三大运营商纳入电信业务经营不良名单", "url": "https://www.freebuf.com/news/188967.html", "time": "2018-11-12", "level": "", "num_look": 98917, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "从近期举行的世界互联网大会“大数据时代的个人信息保护”分论坛上了解到，目前我国个人信息保护法已经列入立法规划，我国将进一步加大对个人信息保护。"}
{"title": "Frida-Wshook：一款基于Frida.re的脚本分析工具", "url": "https://www.freebuf.com/sectool/188726.html", "time": "2018-11-11", "level": "", "num_look": 131735, "num_comment": 131735, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Frida-Wshook的脚本分析工具，这款工具基于Frida.re开发，并且通过挂钩恶意脚本文件(WScript/ CScript)的常用函数来对脚本命令进行分析。"}
{"title": "使用VENOM工具绕过反病毒检测", "url": "https://www.freebuf.com/articles/network/188515.html", "time": "2018-11-11", "level": "", "num_look": 148500, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "我们要学习是如何使用VENOM来生成经过加密的Payload，权当为加固安全保护措施抛砖引玉，未来或许会再出一篇文章来讲一讲如何堵住这个方法。"}
{"title": "BlackHeart勒索病毒再度来袭", "url": "https://www.freebuf.com/articles/terminal/188692.html", "time": "2018-11-11", "level": "", "num_look": 142868, "num_comment": 3, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "BlackHeart(黑心)勒索病毒家族是一款使用NET语言进行编写的勒索病毒，此次发现的是它的一个家族的最新的变种，加密后的文件无法还原。"}
{"title": "市面上多种流行的固态硬盘产品存在硬盘加密机制绕过漏洞", "url": "https://www.freebuf.com/articles/terminal/188656.html", "time": "2018-11-11", "level": "", "num_look": 198527, "num_comment": 198527, "author": "clouds", "tags": ["终端安全"], "text": "近期，荷兰奈梅亨拉德堡德大学研究人员发现，市面上多种流行的固态硬盘（ SSD drive）存在加密机制可绕过漏洞，无需密码即可绕过硬盘加密措施，从而获取到硬盘中的数据内容。"}
{"title": "双十一将近，黑产压境电商平台应该何去何从", "url": "https://www.freebuf.com/articles/security-management/188812.html", "time": "2018-11-10", "level": "红色标题", "num_look": 204609, "num_comment": 204609, "author": "GEETEST极验", "tags": ["安全管理"], "text": "打开各大电商APP，emmmmmmm……这些不都是中文吗，为什么我有点看不懂？规则越来越复杂，商家看不懂，买家看不懂，万万没想到“厉害”的羊毛党还能从中“爽”到……"}
{"title": "PcapXray：一款功能强大的带有GUI的网络取证工具", "url": "https://www.freebuf.com/sectool/188508.html", "time": "2018-11-10", "level": "", "num_look": 199323, "num_comment": 199323, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天我们给大家介绍的正是这样的一种工具。该工具名叫PcapXray，它带有非常强大的GUI界面，并且能够帮助我们离线分析捕获到的数据包。"}
{"title": "FIT 2019议题前瞻：黑掉Facebook还能赚钱可太酷了 | X-Tech技术派对", "url": "https://www.freebuf.com/news/188473.html", "time": "2018-11-10", "level": "红色标题", "num_look": 142304, "num_comment": 3, "author": "FB独家", "tags": ["资讯"], "text": "来自印度的顶级白帽演讲嘉宾Pranav，将分享议题《黑掉Facebook还能赚钱可太酷了》，为我们介绍一种简单的方法，能用来检测Facebook Graph API中存在的高危漏洞。"}
{"title": "漏洞预警 | 交易所10086coin存在多处严重漏洞，可致用户大量敏感信息泄露", "url": "https://www.freebuf.com/vuls/188823.html", "time": "2018-11-10", "level": "", "num_look": 139812, "num_comment": 1, "author": "BUGX", "tags": ["区块链安全", "漏洞"], "text": "从今年9月17日开始，就有多个白帽在BUGX.IO平台上提交了关于10086coin交易所的漏洞，其中不乏严重漏洞，能够造成大量的敏感信息泄露漏洞，用户需谨慎交易！"}
{"title": "看我如何利用发现的漏洞接管D-Link路由器", "url": "https://www.freebuf.com/vuls/188474.html", "time": "2018-11-10", "level": "", "num_look": 164726, "num_comment": 3, "author": "clouds", "tags": ["漏洞"], "text": "今天我要分享的是我最近发现的D-Link路由器的三个漏洞，综合利用这三个漏洞，可以获取D-Link路由器管理权限，实现对其成功接管。"}
{"title": "Gartner六大安全趋势 | 数据安全是关乎企业生死存亡的核心要素", "url": "https://www.freebuf.com/news/188596.html", "time": "2018-11-10", "level": "", "num_look": 129676, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "严守数据安全是企业的底线，云端系统安全、机器学习、AI和日益增长的网络威胁也是Gartner认为在2019年要着重关注的安全发展趋势。"}
{"title": "美国运通印度分公司数据库曝光，致70万人信息泄露", "url": "https://www.freebuf.com/news/188959.html", "time": "2018-11-09", "level": "", "num_look": 146866, "num_comment": 146866, "author": "Karunesh91", "tags": ["数据安全", "资讯"], "text": "10月23日，Mongo数据库曝出漏洞，通过这个漏洞，任何人都能对数据库进行查看、编辑操作。"}
{"title": "Linux系统在互联网中面临的安全威胁分析报告", "url": "https://www.freebuf.com/articles/system/188857.html", "time": "2018-11-09", "level": "", "num_look": 169936, "num_comment": 169936, "author": "安恒风暴中心", "tags": ["安全报告", "系统安全"], "text": "Linux系统作为主流5大操作系统之一，目前在服务器市场占有率超过80%。随着云计算与IoT的发展，Linux作为物联网领域的主流底层操作系统，所涉及的应用场景将呈几何级增加。"}
{"title": "Parator：基于python的多线程爆破小工具", "url": "https://www.freebuf.com/sectool/183443.html", "time": "2018-11-09", "level": "金币+10", "num_look": 247305, "num_comment": 3, "author": "si1ence", "tags": ["工具", "数据安全"], "text": "Patator是出于对使用Hydra,Medusa,Ncrack,Metasploit模块和Nmap NSE脚本进行密码猜测而感到失望后，选择不同的方法编写另一个暴力破解工具。"}
{"title": "《缺陷周话》第8期：路径遍历", "url": "https://www.freebuf.com/news/188469.html", "time": "2018-11-09", "level": "", "num_look": 117286, "num_comment": 1, "author": "奇安信代码卫士", "tags": [], "text": "本文以JAVA 语言源代码为例，分析路径遍历缺陷及该缺陷产生的原因及修复方法。"}
{"title": "记一次挖矿病毒分析", "url": "https://www.freebuf.com/articles/network/188108.html", "time": "2018-11-09", "level": "现金奖励", "num_look": 260447, "num_comment": 19, "author": "lostCooky", "tags": ["网络安全"], "text": "接到同事通知，有客户中了挖矿病毒，所以通过 ssh 登陆服务器检查，简单记录后遂有此文。"}
{"title": "坚守在反网络犯罪最前线「阿斯巴甜攻防实验室」| WitAwards 2018 “年度安全团队”参评巡礼", "url": "https://www.freebuf.com/fevents/188919.html", "time": "2018-11-09", "level": "", "num_look": 98027, "num_comment": 98027, "author": "shidongqi", "tags": ["活动"], "text": "为遏制网络犯罪而生，为终结网络犯罪而战。一个年轻的团队，吹响了反网络犯罪的最响亮号角。"}
{"title": "Java反序列化漏洞：在受限环境中从漏洞发现到获取反向Shell", "url": "https://www.freebuf.com/vuls/188569.html", "time": "2018-11-09", "level": "", "num_look": 149394, "num_comment": 149394, "author": "secist", "tags": ["漏洞"], "text": "本文我将以WebGoat 8中的反序列化挑战（部署在Docker上）为例，向大家展示完成该挑战并进一步获取目标反向shell的完整过程。"}
{"title": "FreeBuf精品公开课·双11学习狂欢节 | 给努力的你打打气", "url": "https://www.freebuf.com/fevents/188851.html", "time": "2018-11-09", "level": "红色标题", "num_look": 116724, "num_comment": 1, "author": "FB客服", "tags": ["FreeBuf公开课", "活动"], "text": "双十一到了，大家的手还好吗？"}
{"title": "十张图看懂Windows平台挖矿木马攻击趋势", "url": "https://www.freebuf.com/articles/others-articles/188633.html", "time": "2018-11-09", "level": "", "num_look": 122340, "num_comment": 2, "author": "360安全", "tags": ["其他"], "text": "挖矿木马在2018年上半年依旧保持迅猛的发展速度，我们将通过监控数据展示挖矿木马在2018年下半年的攻击趋势。"}
{"title": "初探伪装在Office宏里的反弹Shell", "url": "https://www.freebuf.com/vuls/188398.html", "time": "2018-11-09", "level": "现金奖励", "num_look": 198541, "num_comment": 6, "author": "si1ence", "tags": ["漏洞", "系统安全"], "text": "通常的钓鱼邮件场景中office的安全问题一直都受到关注，恶意宏文档制作简单，兼容性强，并且攻击成本较小，所以整体占比较大。"}
{"title": "SQLMap Insert注入踩坑记", "url": "https://www.freebuf.com/articles/web/188402.html", "time": "2018-11-09", "level": "现金奖励", "num_look": 326994, "num_comment": 10, "author": "Conan", "tags": ["WEB安全"], "text": "本篇文章是在做ctf bugku的一道sql insert盲注的题（题目地址:insert盲注）中踩到的坑，觉得还挺有趣的，于是便有了今天的文章，如有纰漏还望大佬们多多指正。"}
{"title": "BUF早餐铺 | 近70万名美国运通的印度客户个人详细信息发生泄露；VirtualBox零日漏洞细节和利用代码惊现网上；谷歌发布11月Android安全补丁", "url": "https://www.freebuf.com/news/188840.html", "time": "2018-11-09", "level": "", "num_look": 103828, "num_comment": 103828, "author": "Freddy", "tags": ["资讯"], "text": "三周前，国外一家网络安全公司发现了美国运通暴露在外的服务器，其中689,272条记录以明文形式存储，任何偶然发现数据库的人都可以访问。"}
{"title": "骚操作 | 操控大楼灯光打游戏", "url": "https://www.freebuf.com/articles/ics-articles/187821.html", "time": "2018-11-08", "level": "现金奖励", "num_look": 442447, "num_comment": 22, "author": "volcanohatred", "tags": ["工控安全"], "text": "黑入电控系统然后操纵大楼灯光打游戏是很多黑客电影所有的桥段，有人觉得现实中不可能实现。其实，要想操纵电力，无非是操纵智能电控系统然后控制电力而已。"}
{"title": "LogonTracer：可视化事件日志识别被攻击账户", "url": "https://www.freebuf.com/sectool/180895.html", "time": "2018-11-08", "level": "金币+5", "num_look": 196247, "num_comment": 2, "author": "PikuYoake", "tags": ["工具"], "text": "JPCERT开发并发布了一个支持此类事件日志分析的工具“LogonTracer”。本文介绍了它的工作原理以及如何使用。"}
{"title": "如何通过中间人攻击嗅探SIM卡的流量通信", "url": "https://www.freebuf.com/articles/wireless/188383.html", "time": "2018-11-08", "level": "", "num_look": 293940, "num_comment": 1, "author": "周大涛", "tags": ["无线安全"], "text": "这篇文章我将介绍如何制作中间人（MitM）设置来嗅探SIM卡和后端服务器之间的流量。"}
{"title": "众安保险招聘信息安全工程师", "url": "https://www.freebuf.com/jobs/188701.html", "time": "2018-11-08", "level": "", "num_look": 96971, "num_comment": 3, "author": "ZHONGJUEYU", "tags": ["安全招聘"], "text": "以“让金融生活更温暖”为使命，秉承“简单、快速、突破、共赢”的价值观，众安连续三年稳居毕马威（KPMG）评选的全球金融科技百强的前五名。"}
{"title": "研究人员欲公布微软Edge浏览器0-day沙盒逃逸漏洞", "url": "https://www.freebuf.com/articles/web/188610.html", "time": "2018-11-08", "level": "", "num_look": 139168, "num_comment": 2, "author": "clouds", "tags": ["WEB安全"], "text": "最近几天，据Twitter昵称为@Yux1xi的安全研究人员透露，他计划公布一个关于微软浏览器的0-day漏洞，该漏洞可以实现针对Edge浏览器的远程代码执行。"}
{"title": "后量子密码学指南", "url": "https://www.freebuf.com/articles/others-articles/188456.html", "time": "2018-11-08", "level": "", "num_look": 177609, "num_comment": 5, "author": "猎豹区块链安全实验室", "tags": ["其他", "数据安全"], "text": "对于如TLS流量、医疗数据库、区块链等等许多需要高度保障安全的应用方向，前向保密绝对必不可少，但仅仅防止黑客快速解密敏感信息是远远不够的。"}
{"title": "​FIT 2019互联网安全创新大会分论坛-白帽LIVE「议题征集」启动", "url": "https://www.freebuf.com/fevents/188635.html", "time": "2018-11-08", "level": "", "num_look": 81978, "num_comment": 7, "author": "FB客服", "tags": ["活动"], "text": "有趣有料的顶尖白帽，用每一枚漏洞，每一行代码，每一段神奇经历，将创新思维当做「信仰」去践行。"}
{"title": "KrakenCryptor2.0.7勒索变种来袭", "url": "https://www.freebuf.com/articles/terminal/188308.html", "time": "2018-11-08", "level": "", "num_look": 128476, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "最近国内出现了一个新的勒索家族KrakenCryptor，发现版本为KrakenCryptor2.0.7。该勒索软件最新版本使用RSA+AES加密算法，加密后缀也随机生成。"}
{"title": "邮件伪造技术与检测", "url": "https://www.freebuf.com/articles/database/188313.html", "time": "2018-11-08", "level": "", "num_look": 296003, "num_comment": 5, "author": "深信服千里目安全实验室", "tags": ["数据安全"], "text": ""}
{"title": "BUF早餐铺 | 汇丰银行部分用户数据泄露；GPU 存在边信道攻击漏洞；英特尔起草新数据隐私法", "url": "https://www.freebuf.com/news/188805.html", "time": "2018-11-08", "level": "", "num_look": 95844, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "天气转凉，注意保暖。"}
{"title": "智慧赋能·安全变革 | FIT 2019中国首席信息安全官高峰论坛「议题征集」", "url": "https://www.freebuf.com/news/187877.html", "time": "2018-11-07", "level": "", "num_look": 73819, "num_comment": 73819, "author": "FB独家", "tags": ["活动", "资讯"], "text": "「赋能新时代，安全话未来」第二届FIT 中国首席信息安全官高峰论坛"}
{"title": "CIA通讯系统存在漏洞，疑似被伊朗政府入侵", "url": "https://www.freebuf.com/news/188731.html", "time": "2018-11-07", "level": "", "num_look": 107967, "num_comment": 3, "author": "clouds", "tags": ["资讯"], "text": "根据国外信息安全和电子取证专家透露，CIA这个用于海外特工和当地国家线人通讯的加密系统，也已可能曾被伊朗政府成功入侵渗透过。"}
{"title": "大安全时代的领航者「360」丨WitAwards 2018 “年度国家力量”参评巡礼", "url": "https://www.freebuf.com/fevents/188577.html", "time": "2018-11-07", "level": "红色标题", "num_look": 80586, "num_comment": 3, "author": "Karunesh91", "tags": ["活动"], "text": "现在，物联网、车联网、工业互联网、人工智能等新兴技术的普及，已经让我们的现实世界和网络世界深度连接，网络空间的攻击将会穿透虚拟空间，直接映射到现实世界的安全。"}
{"title": "PHP-Casbin: 支持ACL、RBAC、ABAC多种模型的PHP权限管理框架", "url": "https://www.freebuf.com/sectool/188189.html", "time": "2018-11-07", "level": "金币+5", "num_look": 118606, "num_comment": 118606, "author": "hsluoyz", "tags": ["工具"], "text": "HP -Casbin 采用了元模型的设计思想，支持多种经典的访问控制方案，如基于角色的访问控制 RBAC、基于属性的访问控制 ABAC 等。"}
{"title": "安全大脑，承载着周鸿祎和 360 的家国情怀", "url": "https://www.freebuf.com/articles/neopoints/188790.html", "time": "2018-11-07", "level": "", "num_look": 149402, "num_comment": 5, "author": "shidongqi", "tags": ["观点"], "text": "周鸿祎是360的“大脑”，一定程度上也将个人鲜明的性格特征带给了360，也包括自己的家国情怀。而安全大脑，则是周鸿祎和360实现自己家国理想的精髓。"}
{"title": "百度搜索打击下载站流氓套路，没想到自家兄弟拖了后腿", "url": "https://www.freebuf.com/articles/neopoints/188548.html", "time": "2018-11-07", "level": "红色标题", "num_look": 315141, "num_comment": 16, "author": "Allen别bb", "tags": ["观点"], "text": "可能在黑客、极客的圈子里，很难理解那么多下载站还能活的那么滋润，而且下载软件过程中的流氓行为从来只会是变本加厉。终于百度要自己出手了，毕竟大部分下载站都比较依赖百度搜索这个“金字招牌”。"}
{"title": "使用MySQL位函数和运算符进行基于时间的高效SQL盲注", "url": "https://www.freebuf.com/articles/web/188029.html", "time": "2018-11-07", "level": "", "num_look": 186077, "num_comment": 7, "author": "secist", "tags": ["WEB安全"], "text": "很多数据库大都易受到基于时间的SQL盲注攻击。但由于各种限制措施，想要利用它们并不容易。"}
{"title": "Windows VBScript引擎远程执行代码漏洞 CVE-2018-8174分析与利用", "url": "https://www.freebuf.com/vuls/188618.html", "time": "2018-11-07", "level": "", "num_look": 148392, "num_comment": 1, "author": "四维创智4DOGS", "tags": ["漏洞"], "text": "VBScript引擎处理内存中对象的方式中存在一个远程执行代码漏洞。该漏洞可能以一种攻击者可以在当前用户的上下文中执行任意代码的方式来破坏内存。"}
{"title": "卡巴斯基2018 Q3全球DDoS攻击分析报告", "url": "https://www.freebuf.com/articles/network/188212.html", "time": "2018-11-07", "level": "金币+5", "num_look": 139867, "num_comment": 1, "author": "bingbingxiaohu", "tags": ["网络安全"], "text": "在DDoS攻击方面，2018年第三季度相对平静。没有出现高级别或者连续的DDoS攻击。然而，犯罪分子攻击能力日趋增强，而攻击的总数却丝毫没有显示出下降的迹象。"}
{"title": "2018年上半年物联网恶意活动&僵尸网络数据摘要", "url": "https://www.freebuf.com/news/188339.html", "time": "2018-11-07", "level": "", "num_look": 123723, "num_comment": 2, "author": "Freddy", "tags": ["资讯"], "text": "F5实验室最新发布的物联网安全报告中，分析了2018年1月至6月期间全球物联网（IoT）设备受攻击的数据，涵盖物联网设备使用的主流服务和20个端口的分析数据。"}
{"title": "Linux下的Rootkit驻留技术分析", "url": "https://www.freebuf.com/articles/system/188211.html", "time": "2018-11-07", "level": "", "num_look": 156393, "num_comment": 156393, "author": "alphalab", "tags": ["系统安全"], "text": "针对Linux设备的恶意软件（以下称为rootkit）通常需要长期驻留于目标操作系统以达到获利目的，所以如何实现驻留也是Linux rootkit作者的重点考虑内容之一"}
{"title": "BUF早餐铺 | 欧洲知名电影公司Twitter账户被黑，冒充马斯克诈骗；斯诺登作证一份有关 NSA 大规模监视的报告是真实的", "url": "https://www.freebuf.com/news/188661.html", "time": "2018-11-07", "level": "", "num_look": 96634, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": "印度少年因为比特币被盗，威胁要炸毁迈阿密机场；不安全的中情局 Web 系统导致其间谍被杀；英睿达/三星部分SSD存固件漏洞；研究人员实现在指纹里编码秘密信息。"}
{"title": "Twitter有马斯克、微博有王思聪，骗子们都喜欢冒充土豪", "url": "https://www.freebuf.com/news/188605.html", "time": "2018-11-06", "level": "红色标题", "num_look": 114131, "num_comment": 5, "author": "shidongqi", "tags": ["资讯"], "text": "Twitter有马斯克，微博有王思聪，这是目前两大中外社交平台骗子们最喜欢冒充的主儿。"}
{"title": "bscan：信息收集和服务枚举工具", "url": "https://www.freebuf.com/sectool/188149.html", "time": "2018-11-06", "level": "", "num_look": 147806, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "bscan是一个主动信息收集和服务枚举工具。其核心是异步spawn扫描实用程序进程，重利用控制台高亮输出显示的扫描结果和定义的目录结构。"}
{"title": "如何使用Magisk解锁Bootloader以及RootGoogle Pixel 3？", "url": "https://www.freebuf.com/articles/terminal/188296.html", "time": "2018-11-06", "level": "", "num_look": 413818, "num_comment": 4, "author": "secist", "tags": ["终端安全"], "text": "随着root神器Magisk的更新，root Pixel 3和Pixel 3 XL早已成为可能，使用Magisk解锁Pixel 3系列的Bootloader只需短短的几秒钟时间。"}
{"title": "银行木马Trickbot新模块：密码抓取器分析", "url": "https://www.freebuf.com/vuls/188295.html", "time": "2018-11-06", "level": "金币+5", "num_look": 154211, "num_comment": 4, "author": "bingbingxiaohu", "tags": ["漏洞", "网络安全"], "text": "Trickbot曾经是一个简单的银行木马，已经走过了漫长的道路。随着时间的推移，我们已经看到网络犯罪分子如何继续为此恶意软件添加更多功能。"}
{"title": "Gartner：2018年10大安全项目详解", "url": "https://www.freebuf.com/articles/paper/188284.html", "time": "2018-11-06", "level": "红色标题", "num_look": 387066, "num_comment": 3, "author": "Freddy", "tags": ["安全报告"], "text": "2018年6月份，一年一度的Gartner安全与风险管理峰会上，知名分析师Neil Mcdonald发布了2018年度的十大安全项目（Top 10 Security Projects）。"}
{"title": "工控安全 | 西门子通信协议S7COMM（Part 1）", "url": "https://www.freebuf.com/articles/ics-articles/188159.html", "time": "2018-11-06", "level": "现金奖励", "num_look": 485034, "num_comment": 7, "author": "LiukerTeam", "tags": ["工控安全"], "text": "随着网络强国、工业4.0，工控安全市场今年明显有相当大的改善，无论从政策还是客户需求，都在逐步扩大中。但是，搞工控安全研究的人员却寥寥无几。"}
{"title": "【评论点赞送贵宾票】11天超长特惠！FIT 2019大会门票双十一低折不限量", "url": "https://www.freebuf.com/fevents/188362.html", "time": "2018-11-06", "level": "红色标题", "num_look": 121386, "num_comment": 18, "author": "FB客服", "tags": ["活动"], "text": "打折优惠我们是认真的！"}
{"title": "T级攻击态势下解析DDOS高防IP系统架构", "url": "https://www.freebuf.com/articles/network/188199.html", "time": "2018-11-06", "level": "", "num_look": 150017, "num_comment": 150017, "author": "阿里云安全", "tags": ["网络安全"], "text": "DDoS主要通过大量合法的请求占用大量网络资源，从而使合法用户无法得到服务的响应，是目前最强大、最难防御的网络攻击之一。"}
{"title": "BUF早餐铺 | 安全专家发现Edge零日漏洞：可远程执行代码；安全漏洞使得在线广播电台面临风险；Twitter删除了10000多个可能影响美国中期选举的账户", "url": "https://www.freebuf.com/news/188511.html", "time": "2018-11-06", "level": "", "num_look": 69535, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "安全专家发现Edge零日漏洞：可远程执行代码；安全漏洞使得在线广播电台面临风险；Twitter删除了10000多个可能影响美国中期选举的账户。"}
{"title": "“神盾局”邀你加入 | FIT 2019前沿安全议题征集【双十一特惠】", "url": "https://www.freebuf.com/news/187303.html", "time": "2018-11-05", "level": "红色标题", "num_look": 110662, "num_comment": 2, "author": "FB独家", "tags": ["活动", "资讯"], "text": "The world is full of evil and lies and pain and death,and you can't hide from it…you can only face it."}
{"title": "如何检测并移除WMI持久化后门？", "url": "https://www.freebuf.com/articles/system/187792.html", "time": "2018-11-05", "level": "", "num_look": 187139, "num_comment": 1, "author": "secist", "tags": ["系统安全"], "text": "本文回顾了一些用于查看和移除WMI事件订阅的PowerShell命令，这些命令在实际测试当中都非常的有用，与君分享~"}
{"title": "从流量侧浅谈WebLogic远程代码执行漏洞（CVE-2018-3191）", "url": "https://www.freebuf.com/vuls/187674.html", "time": "2018-11-05", "level": "金币+10", "num_look": 314020, "num_comment": 10, "author": "yaonagebai", "tags": ["漏洞"], "text": "在不久前Oracle官方发布的10月重要补丁更新公告中发布了五个基于T3协议的WebLogic远程高危漏洞，本文将针对其中影响较大的CVE-2018-3191进行复现与分析，并在流量端进行追溯。"}
{"title": "威胁情报的上下文、标示及能够执行的建议", "url": "https://www.freebuf.com/articles/neopoints/188175.html", "time": "2018-11-05", "level": "", "num_look": 136294, "num_comment": 136294, "author": "奇安信威胁情报中心", "tags": ["观点"], "text": "本文我们从Gartner对威胁情报的定义出发，探讨其中涉及到的几个组成要素：上下文、标示、能够执行的建议。"}
{"title": "如何使用类型混淆（CVE-2018-12794）在Adobe Reader执行代码", "url": "https://www.freebuf.com/vuls/187823.html", "time": "2018-11-05", "level": "", "num_look": 136148, "num_comment": 136148, "author": "周大涛", "tags": ["漏洞"], "text": "攻击者通过构造XML数据包(XDP)模板并在XML Forms Architecture (XFA)对象上执行特定的JavaScript操作，可以迫使Reader跳出模板对象的范围来引用数据。"}
{"title": "Maltego4.0.11中文汉化版", "url": "https://www.freebuf.com/sectool/187831.html", "time": "2018-11-05", "level": "金币+10", "num_look": 445671, "num_comment": 15, "author": "toorkit", "tags": ["工具"], "text": "Maltego想必大家都听说过，至于他的威力，不再赘述，本文简单分享一下maltego二次开发的一些特性。"}
{"title": "MacOS再次出现漏洞，号称牢不可破的系统也有弱点", "url": "https://www.freebuf.com/news/188168.html", "time": "2018-11-05", "level": "", "num_look": 195687, "num_comment": 3, "author": "Karunesh91", "tags": ["终端安全", "资讯"], "text": "本文讲述了我在苹果的macOS系统内核中发现的几个堆栈和缓冲区溢出漏洞，苹果官方将这几个漏洞归类为内核中的远程代码执行漏洞，因此这些漏洞的威胁级别非常高。"}
{"title": "聚焦云安全时代的守护者「知道创宇」 | WitAwards 2018“年度品牌影响力”参评巡礼", "url": "https://www.freebuf.com/fevents/188173.html", "time": "2018-11-05", "level": "红色标题", "num_look": 84969, "num_comment": 1, "author": "Akane", "tags": ["活动"], "text": "随着互联网在全世界范围内的高速发展，特别是移动互联网时代的到来，云计算成为一种随时、随地的公共服务，而这些服务的网络质量、安全状况成为保障云计算持续运行的决定性因素。"}
{"title": "开源Botnet框架Byob分析", "url": "https://www.freebuf.com/sectool/187819.html", "time": "2018-11-05", "level": "现金奖励", "num_look": 197473, "num_comment": 4, "author": "傻傻傻傻傻子", "tags": ["工具"], "text": "Byob是一个开源的僵尸网络框架，在Github上有2k的star了，最近抽时间看了代码，分析一下。"}
{"title": "信息安全等级保护三级要求，安全管理机构多年测评经验分享", "url": "https://www.freebuf.com/articles/security-management/186403.html", "time": "2018-11-05", "level": "现金奖励", "num_look": 536427, "num_comment": 18, "author": "jin16879", "tags": ["安全管理"], "text": "企业信息安全建设工作可以从多个方面来建设与完善，我在这里就介绍信息安全等级保护的基本要求加上自己从事多年的安全工作经验，与各位共勉，干货在里面。"}
{"title": "BUF早餐铺 |  丽笙集团顾客数据被一锅端；英特尔超线程CPU出现新漏洞；土耳其警方拘留盗窃8万美元BTC的11名黑客；法国核电站敏感数据因黑客攻击泄露", "url": "https://www.freebuf.com/news/188422.html", "time": "2018-11-05", "level": "", "num_look": 72507, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "进博会开幕，各位Buffer在工作还是在休息？"}
{"title": "实力碾压一切，这场黑客竞赛总冠军争夺战的真实写照", "url": "https://www.freebuf.com/news/188404.html", "time": "2018-11-04", "level": "", "num_look": 206569, "num_comment": 5, "author": "shidongqi", "tags": ["资讯"], "text": "“实力碾压一切”，这是在XCTF总决赛结束后诸葛建伟对 r3kapig 获得冠军时的评价。"}
{"title": "EE 4GEE Mini本地提权漏洞（CVE-2018-14327）分析", "url": "https://www.freebuf.com/vuls/187824.html", "time": "2018-11-04", "level": "", "num_look": 119405, "num_comment": 2, "author": "周大涛", "tags": ["漏洞"], "text": "我在前段时间从买了一个4G调制解调器，在查看用于故障排除的服务时发现了一个提权漏洞，本文带了一个简单的分析。"}
{"title": "Firefox信息泄漏漏洞的技术分析（CVE-2018-12387）", "url": "https://www.freebuf.com/vuls/187834.html", "time": "2018-11-04", "level": "", "num_look": 140076, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["漏洞"], "text": "研究发现，JavaScript JIT编辑器中的Array.prototype.push有多个存在安全问题的参数，而这些参数共同导致了这个信息泄漏漏洞的出现。"}
{"title": "Blackout勒索病毒再度来袭", "url": "https://www.freebuf.com/articles/terminal/188046.html", "time": "2018-11-04", "level": "", "num_look": 142853, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "Blackout勒索病毒家族是一款使用.NET语言编写的勒索病毒，它会将原文件名加密为BASE64格式的加密后的文件名。"}
{"title": "Safari信息泄露漏洞分析", "url": "https://www.freebuf.com/articles/web/187756.html", "time": "2018-11-03", "level": "红色标题", "num_look": 133330, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "从某种程度上来说，这个安全问题跟lokihardt在2017年报告的一个 旧漏洞有些相似，只不过利用方式不同。"}
{"title": "在Splunk上安装自定义应用反弹Shell的方法", "url": "https://www.freebuf.com/articles/database/187483.html", "time": "2018-11-03", "level": "", "num_look": 147038, "num_comment": 4, "author": "secist", "tags": ["数据安全"], "text": "有一个技巧我相信很多人都不知道，就是使用Splunk app来执行python代码。TBG Security团队开发了一款可用于渗透测试的Splunk app。"}
{"title": "交易所漏洞之薅羊毛分析", "url": "https://www.freebuf.com/articles/blockchain-articles/188030.html", "time": "2018-11-03", "level": "金币+5", "num_look": 153263, "num_comment": 3, "author": "Hukybo", "tags": ["区块链安全"], "text": "近几年，基于区块链技术和密码学的数字货币行业，迎来爆发式增长。作为数字货币产业链中最重要的环节之⼀，区块链资产交易所无疑拥有举⾜轻重的地位。"}
{"title": "安全报告 | 2018年游戏行业安全监测报告及五大攻击趋势", "url": "https://www.freebuf.com/articles/paper/188153.html", "time": "2018-11-03", "level": "金币+5", "num_look": 131764, "num_comment": 1, "author": "云鼎实验室", "tags": ["安全报告"], "text": "8102年都快过去了，游戏黑客在攻击什么？他们从哪里来？哪些公司受害最严重？"}
{"title": "警惕GandCrabV5.0.4勒索病毒，医疗行业已有中招案例", "url": "https://www.freebuf.com/articles/terminal/187841.html", "time": "2018-11-03", "level": "", "num_look": 197525, "num_comment": 4, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "GandCrab5.0.3升级版本GandCrab5.0.4在国内有呈现爆发的趋势，已造成国内部分医疗行业出现业务瘫痪，影响医院正常看病治疗。"}
{"title": "clrinject：向CLR Runtimes和AppDomain中注入代码的工具", "url": "https://www.freebuf.com/sectool/187541.html", "time": "2018-11-02", "level": "", "num_look": 117079, "num_comment": 117079, "author": "secist", "tags": ["工具"], "text": "clrinject是一款可将C＃，EXE或DLL程序集，注入另一个进程CLR Runtimes和AppDomain的工具。"}
{"title": "物联网设备固件分析之小试牛刀", "url": "https://www.freebuf.com/articles/terminal/187668.html", "time": "2018-11-02", "level": "现金奖励", "num_look": 331474, "num_comment": 8, "author": "scu-igroup", "tags": ["系统安全", "终端安全"], "text": "在上一篇中，我们讨论了用脚本控制小米设备，这主要是从流量层面入手来进行的安全分析；在这一篇，主要从固件入手，分析固件的脆弱性。"}
{"title": "使用Burpsuite扩展Hackvertor绕过WAF并解密XOR", "url": "https://www.freebuf.com/sectool/187274.html", "time": "2018-11-02", "level": "", "num_look": 135119, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "最近，我一直在忙于开发自己的一个Burp扩展Hackvertor。这是一个具有基于标签转换功能的编码器，相比起Burp内置的解码器它的功能要强大的多。"}
{"title": "威马汽车招聘网络安全工程师", "url": "https://www.freebuf.com/news/187341.html", "time": "2018-11-02", "level": "", "num_look": 137119, "num_comment": 8, "author": "FB客服", "tags": ["安全招聘", "资讯"], "text": "威马汽车（WM Motor）成立于2015年1月（ 前身为三电系统研发企业，成立于2012年），是国内新兴的新能源汽车企业及出行方案提供商。"}
{"title": "《缺陷周话》第7期：缓冲区上溢", "url": "https://www.freebuf.com/news/187891.html", "time": "2018-11-02", "level": "", "num_look": 106618, "num_comment": 2, "author": "奇安信代码卫士", "tags": [], "text": "缓冲区溢出是指向缓冲区填充数据时溢出了缓冲区的边界导致覆盖相邻的内存而导致的安全问题。造成缓冲区溢出的原因有很多，本文分享一些原因和解释。"}
{"title": "Linux应急故事之四两拨千斤：黑客一个小小玩法，如何看瞎双眼", "url": "https://www.freebuf.com/articles/terminal/187842.html", "time": "2018-11-02", "level": "红色标题", "num_look": 251229, "num_comment": 18, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "一位办事处拥有多年应急经验的老手，像往常一样忙碌而娴熟的处理所在区域的各种安全应急事件。突然，某客户求助，称安全感知产品检测到了异常威胁，需要协助分析处置。"}
{"title": "X.Org Server软件包存在提权漏洞，影响主流Linux发行版", "url": "https://www.freebuf.com/vuls/187892.html", "time": "2018-11-02", "level": "", "num_look": 115226, "num_comment": 115226, "author": "Freddy", "tags": ["漏洞"], "text": "印度安全研究员在X.Org Server软件包中发现了一个非常关键的提权漏洞（CVE-2018-14665），主流Linux发行版均受到影响，包括OpenBSD、Debian、Ubuntu、CentOS、Red Hat和Fedora。"}
{"title": "BUF早餐铺 | 谷歌发布新安全功能，若禁用浏览器JS无法登录；《公安机关互联网安全监督检查规定》11月1日起正式施行；丽笙酒店集团用户数据泄露", "url": "https://www.freebuf.com/news/188262.html", "time": "2018-11-02", "level": "", "num_look": 79769, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "当地时间 10 月 30 日，Radisson 发布声明称，此次数据泄露事件仅影响其约 10% 的会员账户，无任何用户信用卡信息或密码信息被泄露。"}
{"title": "苹果旗下WebKit产品多个高危漏洞预警", "url": "https://www.freebuf.com/news/188151.html", "time": "2018-11-01", "level": "", "num_look": 76024, "num_comment": 76024, "author": "奇安信代码卫士", "tags": ["资讯"], "text": "国内安全团队发现苹果公司旗下产品 WebKit 的两个高危安全漏洞（ CVE-2018-4392和CVE-2018-4378 ），第一时间向苹果公司报告，协助其修复漏洞。"}
{"title": "记一次对WebScan的Bypass", "url": "https://www.freebuf.com/articles/web/187537.html", "time": "2018-11-01", "level": "现金奖励", "num_look": 350627, "num_comment": 26, "author": "GGyao6", "tags": ["WEB安全"], "text": "今天测试了一个网站，发现存在360webscan的拦截，于是便开始了一波“bypass”。"}
{"title": "老树开新花 | 利用Excel 4.0宏躲避杀软检测的攻击技术分析", "url": "https://www.freebuf.com/articles/system/187968.html", "time": "2018-11-01", "level": "", "num_look": 126939, "num_comment": 1, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "本文详细分析如何使用一些技巧隐藏Excel 4.0宏并配合执行一些经过特殊处理的ShellCode后，可以完美的躲避几乎所有杀毒软件的静态和动态查杀并执行任意恶意代码。"}
{"title": "大多数路由器都存在固件缺陷使用户面临风险", "url": "https://www.freebuf.com/articles/terminal/187396.html", "time": "2018-11-01", "level": "", "num_look": 169299, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "如果你有一台无线路由器，那你就得小心了。因为这台路由器可能到处都是安全漏洞，而这些漏洞很可能会让你的一切陷入安全风险之中。"}
{"title": "每日优鲜安全岗位招聘人才", "url": "https://www.freebuf.com/jobs/188040.html", "time": "2018-11-01", "level": "", "num_look": 113192, "num_comment": 9, "author": "每日优鲜安全部", "tags": ["安全招聘"], "text": "每日优鲜是一个围绕着老百姓餐桌的生鲜O2O电商平台，为用户提供全球生鲜产品 “2 小时送货上门” 的极速达冷链配送服务。"}
{"title": "CNNVD关于macOS和iOS内核漏洞情况的通报", "url": "https://www.freebuf.com/news/188140.html", "time": "2018-11-01", "level": "", "num_look": 96880, "num_comment": 96880, "author": "CNNVD", "tags": ["资讯"], "text": "国家信息安全漏洞库（CNNVD）收到关于macOS和iOS内核漏洞（CNNVD编号：CNNVD-201810-1510、CVE编号：CVE-2018-4407）情况的报送，点击查看详细内容。"}
{"title": "自动化反弹Shell防御技术", "url": "https://www.freebuf.com/articles/system/187584.html", "time": "2018-11-01", "level": "现金奖励", "num_look": 412548, "num_comment": 26, "author": "zhanghaoyil", "tags": ["系统安全"], "text": "反弹Shell一般是外网渗透的最后一步，也是内网渗透的第一步。反弹Shell对服务器安全乃至内网安全的危害不必多说。"}
{"title": "【FIT早鸟票抢购】当“科幻”照进现实！「HACK DEMO」主角招募中", "url": "https://www.freebuf.com/news/188091.html", "time": "2018-11-01", "level": "红色标题", "num_look": 65960, "num_comment": 65960, "author": "FB独家", "tags": ["活动", "资讯"], "text": "现场展示最新锐的安全技术和产品，解密“黑科技”背后不一样的思路与方法。"}
{"title": "《缺陷周话》第6期：命令注入", "url": "https://www.freebuf.com/news/187316.html", "time": "2018-11-01", "level": "", "num_look": 131594, "num_comment": 8, "author": "奇安信代码卫士", "tags": [], "text": "代码审计是使用静态分析发现源代码中安全缺陷的方法，能够辅助开发或测试人员在软件上线前较为全面地了解其安全问题，防患于未然。"}
{"title": "BUF早餐铺 | 苹果发布iOS 12.1软件更新；新的iPhone密码绕过漏洞出现；微软将印度客户银行数据分享给美国情报机构；我国出台《国际刑事司法协助法》回应美国Cloud Act", "url": "https://www.freebuf.com/news/188058.html", "time": "2018-11-01", "level": "", "num_look": 82160, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "iOS 12.1还修复了多个重大安全漏洞，其中iOS 12.1修复了多个FaceTime漏洞，macOS High Sierra更新修复了同一Wi-Fi网络内恶意数据包导致苹果设备崩溃和重启的漏洞"}
{"title": "自动加人、模拟定位，微商躺着赚钱？", "url": "https://www.freebuf.com/articles/database/187548.html", "time": "2018-11-01", "level": "", "num_look": 190329, "num_comment": 2, "author": "GEETEST极验", "tags": ["数据安全"], "text": "黑产永无止境，身为消费者需时刻保持警惕心~"}
{"title": "传奇黑客、极客徽章、AI“认猫”，HITB 中国首秀亮点颇多", "url": "https://www.freebuf.com/news/188141.html", "time": "2018-11-01", "level": "", "num_look": 134890, "num_comment": 134890, "author": "shidongqi", "tags": ["资讯"], "text": "继Defcon、CanSecWest相继落地中国之后，在京东安全的推动下，又一大世界顶级安全峰会 HITB（Hack In The Box） 也来到了中国。"}
{"title": "低功耗蓝牙（BLE）攻击分析", "url": "https://www.freebuf.com/articles/wireless/187843.html", "time": "2018-11-01", "level": "", "num_look": 324255, "num_comment": 1, "author": "secist", "tags": ["无线安全"], "text": "如果随机数生成器无法生成“足够强壮”的随机数，那么即使最强的加密协议也可能被破解，这同样也适用于BLE。"}
{"title": "「芯盾时代」聚焦以人为核心的业务安全 | WitAwards 2018“年度技术变革”参评巡礼", "url": "https://www.freebuf.com/news/188062.html", "time": "2018-10-31", "level": "红色标题", "num_look": 89538, "num_comment": 2, "author": "Karunesh91", "tags": ["资讯"], "text": "身份验证是个老生常谈的话题，在如今复杂的互联网环境中，该如何证明“你是你自己”？芯盾时代告诉你答案。"}
{"title": "缓冲区溢出漏洞（CVE-2018-4407）可导致内核崩溃，苹果多款操作系统均受影响", "url": "https://www.freebuf.com/vuls/188052.html", "time": "2018-10-31", "level": "", "num_look": 326243, "num_comment": 10, "author": "Freddy", "tags": ["漏洞"], "text": "国外大神Kevin Backhouse刚刚放出了一篇博文，对苹果操作系统内核中发现的堆缓冲区溢出漏洞（CVE-2018-4407）进行了一番解构。"}
{"title": "如何使用serviceFu这款功能强大的远程收集服务帐户凭据工具", "url": "https://www.freebuf.com/sectool/187241.html", "time": "2018-10-31", "level": "", "num_look": 110536, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具"], "text": "在近期所进行的安全审计活动中，我们的团队设计出了一种新的安全工具，并希望能跟整个社区一起分享。"}
{"title": "一种新型的Web缓存欺骗攻击技术", "url": "https://www.freebuf.com/articles/web/187538.html", "time": "2018-10-31", "level": "红色标题", "num_look": 248600, "num_comment": 19, "author": "lex1993", "tags": ["WEB安全"], "text": "为了减少WEB响应时延并减小WEB服务器负担，现在WEB缓存技术已经用的非常普遍了，这里介绍一种WEB缓存欺骗攻击技术，针对Paypal有奇效。"}
{"title": "一键安装藏隐患，phpStudy批量入侵的分析与溯源", "url": "https://www.freebuf.com/articles/system/187653.html", "time": "2018-10-31", "level": "红色标题", "num_look": 221594, "num_comment": 11, "author": "云鼎实验室", "tags": ["系统安全"], "text": "Windows 的帐号名称后带着“$”符号时，不会在 net user 命令中显示出帐号信息，是攻击者常用的一种隐藏帐号的方法，一般开发者不会添加这种类型的帐号。"}
{"title": "双11成流氓软件狂欢节，侵权推广频次暴增200倍", "url": "https://www.freebuf.com/news/187661.html", "time": "2018-10-31", "level": "", "num_look": 139770, "num_comment": 6, "author": "火绒安全", "tags": ["资讯"], "text": "临近双十一，流氓软件开启一波推广高潮。用户只要安装\"2345好压\"、\"2345看图\"、\"2345拼音\"、\"2345浏览器\"等2345家族软件，都会被静默推广双十一快捷方式。"}
{"title": "操控国际足联，干预金球奖，埃及黑产势力一战成名", "url": "https://www.freebuf.com/articles/network/187482.html", "time": "2018-10-31", "level": "", "num_look": 114188, "num_comment": 1, "author": "GEETEST极验", "tags": ["网络安全"], "text": "10月12日，法国《队报》旗下杂志《法国足球》在其官网发布声明，因遭到恶意软件刷票，将被迫关闭2018年金球奖（Ballon d'Or）网络投票入口。"}
{"title": "BUF早餐铺 | 物联网设备已成为网络犯罪的头号目标；阿里安全专家预警智能电池存隐患；Windows 10 Bug允许UWP应用程获得对系统文件的完整访问权限", "url": "https://www.freebuf.com/news/187980.html", "time": "2018-10-31", "level": "", "num_look": 76763, "num_comment": 2, "author": "Freddy", "tags": ["资讯"], "text": "本次F5发布的报告扩大了涵盖的攻击数据的范围，包括物联网设备经常使用的服务，进入文章查看分析结果摘要。"}
{"title": "基于Vue开发的以太坊开源HD钱包Vuethwallet源码分析", "url": "https://www.freebuf.com/articles/blockchain-articles/187966.html", "time": "2018-10-30", "level": "", "num_look": 130668, "num_comment": 1, "author": "BUGX", "tags": ["区块链安全"], "text": "数字钱包的发展历程是从最初比特币的非确定性钱包，到确定性钱包，一直到我们现在最广为使用HD分层确定性钱包，而今天要分析的钱包就是现在最为流行的HD分层确定性钱包。"}
{"title": "美国国防部邀请三家众测平台共同参与「攻破五角大楼」计划", "url": "https://www.freebuf.com/news/187991.html", "time": "2018-10-30", "level": "", "num_look": 119795, "num_comment": 3, "author": "Karunesh91", "tags": ["网络安全", "资讯"], "text": "2016年3月，美国国防部宣布了一则震惊世界消息：邀请数千名黑客进攻五角大楼，史称“Hack the Pentagon”。"}
{"title": "「安全狗」云垒·私有云一体化安全管理利器 | WitAwards 2018“年度技术变革”参评巡礼", "url": "https://www.freebuf.com/fevents/186448.html", "time": "2018-10-30", "level": "红色标题", "num_look": 72381, "num_comment": 72381, "author": "Freddy", "tags": ["活动"], "text": "老牌企业和新兴的创企，无不越来越关注云平台建设。但无论是部署公共云、私有云还是混合云，企业用户总是面临着安全问题的快速迭代。"}
{"title": "Sandsifter：一款专门针对X86处理器的模糊测试工具", "url": "https://www.freebuf.com/sectool/187237.html", "time": "2018-10-30", "level": "", "num_look": 127530, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Sandsifter的x86处理器模糊测试工具，通过系统生成的机器码来搜索处理器指令集，监控异常数据来审计x86处理器中的隐藏指令和硬件漏洞。"}
{"title": "GitHub关键字扫描开源工具推荐", "url": "https://www.freebuf.com/articles/es/187669.html", "time": "2018-10-30", "level": "红色标题", "num_look": 512149, "num_comment": 11, "author": "胡说", "tags": ["企业安全"], "text": "网络上多次爆出的GitHub泄露企业敏感信息事件，我用了一些事件针对不同类型的GitHub扫描开源产品作了一些测试调研，与君分享。"}
{"title": "十种进程注入技术介绍：常见注入技术及趋势调查", "url": "https://www.freebuf.com/articles/system/187239.html", "time": "2018-10-30", "level": "", "num_look": 302141, "num_comment": 1, "author": "Covfefe", "tags": ["系统安全"], "text": "在这篇文章中，我将会介绍十种在野发现的，在另一个程序的地址空间执行恶意代码的进程注入技术，并提供这些技术应用的截图，以便于逆向工程和恶意软件分析。"}
{"title": "美丽联合集团招聘安全工程师", "url": "https://www.freebuf.com/jobs/187726.html", "time": "2018-10-30", "level": "", "num_look": 96845, "num_comment": 3, "author": "美丽联合安全MLSRC", "tags": ["安全招聘"], "text": "美丽联合集团是时尚和生活方式目的地，集团通过形式多样的时尚内容，种类丰富的时尚商品，让人们在分享和发现流行趋势的同时，尽情享受优质的购物体验。"}
{"title": "诲人不倦还是毁人不倦？学习APP里的黑产正在蚕食孩子们", "url": "https://www.freebuf.com/articles/network/187337.html", "time": "2018-10-30", "level": "红色标题", "num_look": 479073, "num_comment": 12, "author": "GEETEST极验", "tags": ["网络安全"], "text": "如今，青少年的生长环境越来越恶劣了，没想到有一天学习工具也会变成娱乐游戏色情中心……"}
{"title": "机器学习与威胁情报的融合：一种基于AI检测恶意域名的方法", "url": "https://www.freebuf.com/articles/es/187451.html", "time": "2018-10-30", "level": "", "num_look": 405133, "num_comment": 5, "author": "山东星维九州安全技术有限公司", "tags": ["企业安全"], "text": "黑客在攻击过程中或者对目标网络实施控制时经常使用域名。我们在做流量分析时不仅要通过流量的指纹特征识别威胁，也可以通过检测是否解析了恶意域名来判断网络中是否存在肉鸡。"}
{"title": "收到“来自自己”的敲诈邮件，请不要惊慌", "url": "https://www.freebuf.com/articles/network/187522.html", "time": "2018-10-30", "level": "", "num_look": 804566, "num_comment": 7, "author": "antiylab", "tags": ["网络安全"], "text": "近期，安天CERT（安全研究与应急处理中心）接收到来自客户反映的收到自己邮件地址发送给自己的恐吓邮件，勒索比特币的事件，经分析发现这是自10月份以来新的诈骗手法。"}
{"title": "PHP代码审计实战思路浅析", "url": "https://www.freebuf.com/articles/web/187244.html", "time": "2018-10-30", "level": "现金奖励", "num_look": 367224, "num_comment": 10, "author": "wnltc0", "tags": ["WEB安全"], "text": "对于面向过程写法的程序来说，最快的审计方法可能时直接丢seay审计系统里，但对于基于mvc模式的程序来说，你直接丢seay审计系统的话，那不是给自己找麻烦吗？"}
{"title": "BUF早餐铺 | 2018网购欺诈洞察报告出炉：钓鱼网站数量增加297%；研究人员提出一种用视频缩略图将office武器化的攻击方式；X.Org出现bug导致linux和BSD系统可被获取root权限", "url": "https://www.freebuf.com/news/187876.html", "time": "2018-10-30", "level": "", "num_look": 65275, "num_comment": 65275, "author": "Karunesh91", "tags": ["资讯"], "text": "天气转冷，各位Buffer注意保暖~"}
{"title": "提前30天放范围！「60W奖金池」FIT漏洞马拉松今晚8点发枪！", "url": "https://www.freebuf.com/fevents/187901.html", "time": "2018-10-29", "level": "红色标题", "num_look": 120003, "num_comment": 9, "author": "FB客服", "tags": ["活动"], "text": "漏洞盒子漏洞马拉松3.0版重磅发布！本次漏洞马拉松FIT站将由线上赛程和线下赛程组成，历时整整45天，超长时间的赛程，让你体验真正的马拉松~"}
{"title": "PwnedOrNot：用于查找邮件账户密码是否被泄漏的Python脚本", "url": "https://www.freebuf.com/sectool/187253.html", "time": "2018-10-29", "level": "", "num_look": 125833, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "PwnedOrNot是一个使用haveibeenpwned v2 api来测试电子邮件帐户，并尝试在Pastebin Dumps中查找其密码的Python脚本。"}
{"title": "ZombieboyMiner（僵尸男孩矿工）控制7万台电脑挖门罗币", "url": "https://www.freebuf.com/articles/paper/187556.html", "time": "2018-10-29", "level": "", "num_look": 176548, "num_comment": 2, "author": "腾讯电脑管家", "tags": ["安全报告"], "text": "近期出现利用ZombieboyTools传播的挖矿木马家族最新活动。木马对公开的黑客工具ZombieboyTools进行修改，对公网以及内网IP进行攻击。"}
{"title": "投资理财的那些坑，你踩过几个？", "url": "https://www.freebuf.com/news/187382.html", "time": "2018-10-29", "level": "", "num_look": 95462, "num_comment": 4, "author": "安全豹", "tags": ["资讯"], "text": "从1万到1亿可能需要一辈子，但从1亿到1万有时却只需要一瞬间。然而现实生活中大部分的投资者只看到收益而忽略了风险，特别是对老年投资者来说更是如此。"}
{"title": "探寻Metasploit Payload模式背后的秘密", "url": "https://www.freebuf.com/articles/system/187312.html", "time": "2018-10-29", "level": "现金奖励", "num_look": 236932, "num_comment": 4, "author": "你会忘了我", "tags": ["系统安全"], "text": "我第一次学习metasploit的时候，试用08067的漏洞来攻击一台windows xp获取一个meterpreter shell。那个时候几乎没怎么变过的使用reverse_tcp连接，这篇文章，我想和大家聊聊metasploit payload模式背后的秘密。"}
{"title": "BUF早餐铺 | 库克忧心用户隐私呼吁制定联邦隐私法；UWP API曝安全漏洞：可窃取任意数据；大多数安全专家对AI攻击表示担心", "url": "https://www.freebuf.com/news/187680.html", "time": "2018-10-29", "level": "", "num_look": 88101, "num_comment": 1, "author": "Akane", "tags": ["资讯"], "text": "库克在国际数据保护和隐私委员会会议上发表讲话称，苹果将支持美国隐私法，并且还宣称苹果公司保护用户数据和隐私的承诺。"}
{"title": "一把双刃剑？网络安全中AI该如何立足", "url": "https://www.freebuf.com/news/187767.html", "time": "2018-10-29", "level": "", "num_look": 125197, "num_comment": 125197, "author": "Karunesh91", "tags": ["终端安全", "资讯"], "text": "人工智能技术，究竟是敌是友？"}
{"title": "USBStealer：一款用于获取Windows应用密码的工具", "url": "https://www.freebuf.com/sectool/187182.html", "time": "2018-10-28", "level": "", "num_look": 152763, "num_comment": 4, "author": "secist", "tags": ["工具"], "text": "USBStealer是一款用于窃取Windows应用密码的工具，可以为我们从基于Windows的应用程序中提取密码，例如Chrome Password，FireFox Password，NetPassword，Windows管理员密码等。"}
{"title": "调查 | 黑客将Python作为攻击编码语言的首选", "url": "https://www.freebuf.com/sectool/187152.html", "time": "2018-10-28", "level": "", "num_look": 163059, "num_comment": 7, "author": "Alpha_h4ck", "tags": ["工具"], "text": "调查数据表明，目前的GitHub代码库中，有超过20%的网络攻击工具或PoC代码都是采用Python编写的。"}
{"title": "保护SSH端口安全性的多种技巧介绍", "url": "https://www.freebuf.com/articles/network/185956.html", "time": "2018-10-28", "level": "", "num_look": 237858, "num_comment": 6, "author": "secist", "tags": ["网络安全"], "text": "SSH端口也是攻击者必扫的端口之一。本文将就SSH端口的安全性展开讨论，并为大家提供多种保护SSH端口安全性的建议和方法。"}
{"title": "打开JBoss的潘多拉魔盒：JBoss高危漏洞分析", "url": "https://www.freebuf.com/vuls/186948.html", "time": "2018-10-28", "level": "", "num_look": 5793555, "num_comment": 3, "author": "深信服千里目安全实验室", "tags": ["漏洞"], "text": "在J2EE应用服务器领域，JBoss是发展最为迅速的应用服务器。由于JBoss遵循商业友好的LGPL授权分发，并且由开源社区开发，这使得JBoss广为流行。"}
{"title": "Windows Java Usage Tracker本地提权漏洞分析（CVE-2018-3211）", "url": "https://www.freebuf.com/vuls/187018.html", "time": "2018-10-28", "level": "", "num_look": 195572, "num_comment": 1, "author": "eridanus96", "tags": ["漏洞"], "text": "近期，我们发现了一个Java Usage Tracker中的设计缺陷，可导致攻击者创建任意文件，注入指定参数，并实现本地权限提升。"}
{"title": "现实版的黑客大战，这可能是中国黑客做过最燃的事情了", "url": "https://www.freebuf.com/articles/database/187549.html", "time": "2018-10-28", "level": "红色标题", "num_look": 1518523, "num_comment": 6, "author": "GEETEST极验", "tags": ["数据安全"], "text": "由一场撞击事件引发的黑客大战，80000人参与、被攻击网站超4000多个……这场看似没有硝烟的战争当时是何情景？让我们梦回2001，一起看看吧。"}
{"title": "Swap Digger：一款功能强大的自动提取并寻找Linux用户凭证的工具", "url": "https://www.freebuf.com/sectool/187105.html", "time": "2018-10-27", "level": "", "num_look": 136522, "num_comment": 136522, "author": "Alpha_h4ck", "tags": ["工具", "数据安全"], "text": "今天给大家介绍的是一款名叫Swap Digger的工具，大家可以利用这款工具自动化搜索并提取Linux用户凭证、Web表单凭证、Web表单邮件、HTTP认证数据、WiFi SSID和密钥等等。"}
{"title": "使用DLL注入绕过Windows 10受控文件夹访问保护", "url": "https://www.freebuf.com/news/187234.html", "time": "2018-10-27", "level": "", "num_look": 183318, "num_comment": 6, "author": "secist", "tags": ["资讯"], "text": "在Windows 10中，微软新增了一项名为“受控文件夹访问”的功能，该功能可用于防止未知程序修改受保护文件夹中的文件。"}
{"title": "赛门铁克邮件网关身份验证绕过漏洞（CVE-2018-12242）分析", "url": "https://www.freebuf.com/vuls/187052.html", "time": "2018-10-27", "level": "", "num_look": 128217, "num_comment": 128217, "author": "clouds", "tags": ["漏洞"], "text": "本文分享的赛门铁克（Symantec）邮件网关授权绕过漏洞（CVE-2018-12242）的简单分析，这个漏洞利用的前提是，需要赛门铁克邮件网关开启了密码重置功能。"}
{"title": "对不起，我们来晚了", "url": "https://www.freebuf.com/news/187795.html", "time": "2018-10-27", "level": "红色标题", "num_look": 188070, "num_comment": 28, "author": "FB客服", "tags": ["资讯"], "text": "对不起，我们来晚了，迟到的HTTPS小绿锁。"}
{"title": "记一次远程命令执行漏洞的挖掘过程", "url": "https://www.freebuf.com/vuls/185380.html", "time": "2018-10-27", "level": "现金奖励", "num_look": 390266, "num_comment": 11, "author": "r0yanx", "tags": ["漏洞"], "text": "最近为甲方做渗透测试发现了一个远程命令执行漏洞，可以通过恶意参数传递执行bash命令，本文回顾一下漏洞的挖掘过程。"}
{"title": "ANDRAX：最新的Android智能手机上的渗透测试平台", "url": "https://www.freebuf.com/sectool/187100.html", "time": "2018-10-26", "level": "金币+11", "num_look": 639718, "num_comment": 10, "author": "Alpha_h4ck", "tags": ["工具", "系统安全"], "text": "今天给大家介绍一款专为Android智能手机设计的渗透测试平台，该工具名叫ANDRAX，它可以直接在原生Android系统上运行，它不仅能够跟常用Linux发行版相媲美，而且它的功能甚至比常见Linux发行版更加强大。"}
{"title": "GAN掉马赛克、变脸、戏弄AI，这场GeekPwn黑客趴还有老司机带路", "url": "https://www.freebuf.com/fevents/187676.html", "time": "2018-10-26", "level": "红色标题", "num_look": 169672, "num_comment": 5, "author": "shidongqi", "tags": ["活动"], "text": "GeekPwn虽然是一场黑客趴，但也非常适合普通用户来参与，尤其在蒋昌建老师这位老司机带路的情况下。10月24日，草榴节……呸！程序员节，一群黑客汇聚魔都，这场为期两天的黑客趴GeekPwn 便正式拉开帷幕。"}
{"title": "2018双十一前夕电商行业黑灰产研究报告", "url": "https://www.freebuf.com/articles/es/187600.html", "time": "2018-10-26", "level": "", "num_look": 248481, "num_comment": 248481, "author": "永安在线", "tags": ["企业安全"], "text": "2018年双十一活动，黑灰产已经厉兵秣马，开始做准备工作。威胁猎人也将对黑灰产业链上中下游逐层进行剖析，揭开双十一前夕黑灰产的准备工作。"}
{"title": "挖洞经验 | 一个价值$3133.7美金的Google漏洞", "url": "https://www.freebuf.com/articles/web/186950.html", "time": "2018-10-26", "level": "", "num_look": 213285, "num_comment": 8, "author": "clouds", "tags": ["WEB安全"], "text": "在对Google的安全研究中，由于其云服务平台“cloud.google.com” 具备多种功能，感觉有点意思，所以某天我决定来深入测试一下它。"}
{"title": "通杀绝⼤多数交易平台的Tradingview Dom XSS漏洞分析", "url": "https://www.freebuf.com/vuls/186638.html", "time": "2018-10-26", "level": "现金奖励", "num_look": 241740, "num_comment": 4, "author": "Arrowzzzzzz", "tags": ["WEB安全", "漏洞"], "text": "根据慢雾区匿名情报，通用 K 线展示 JS 库 TradingView 存在 XSS 0day 漏洞，可绕过 Cloudflare 等防御机制。该漏洞被利用会导致用户帐号权限被盗、恶意操作等造成资产损失。"}
{"title": "如何使用Windows Library文件进行持久化", "url": "https://www.freebuf.com/articles/system/187021.html", "time": "2018-10-26", "level": "", "num_look": 169248, "num_comment": 169248, "author": "eridanus96", "tags": ["系统安全"], "text": "本文将主要分析如何使用库文件来实现持久化，以及在搜索过程中需要查找的内容。"}
{"title": "还原最新勒索病毒GandCrabV5.0.3的完整攻击场景", "url": "https://www.freebuf.com/articles/terminal/187155.html", "time": "2018-10-26", "level": "", "num_look": 292239, "num_comment": 3, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "此次勒索事件，深信服安全专家捕获到了完整的攻击链和一整套的入侵工具，并制定了相应的防护措施。"}
{"title": "WannaMine僵而不死：假装被美国土安全局查封", "url": "https://www.freebuf.com/articles/paper/187295.html", "time": "2018-10-26", "level": "", "num_look": 185534, "num_comment": 1, "author": "Threatbook", "tags": ["安全报告"], "text": "WannaMine是一个以挖取门罗币为目的的僵尸网络，最早于2017年10月被国外网络安全厂 商曝光，因同样使用永恒之蓝(EternalBlue)漏洞进行扩散(与Wannacry相似)而得名。"}
{"title": "BUF早餐铺 | 国泰航空数据泄露，940万乘客受影响 ；新型Mac恶意软件拦截加密网络流量以注入广告；FireEye：俄罗斯研究实验室协助TRITON工业恶意软件的开发", "url": "https://www.freebuf.com/news/187552.html", "time": "2018-10-26", "level": "", "num_look": 117780, "num_comment": 3, "author": "Freddy", "tags": ["资讯"], "text": "国泰航空公司于前天深夜发布“信息安全事件”通告，表示一个包含多达940万乘客数据的系统遭到网络攻击。"}
{"title": "「白山云」融合数据孤岛的数聚蜂巢丨WitAwards 2018“年度创新产品”参评巡礼", "url": "https://www.freebuf.com/fevents/187500.html", "time": "2018-10-25", "level": "红色标题", "num_look": 132092, "num_comment": 1, "author": "Karunesh91", "tags": ["活动"], "text": "随着互联网+时代的到来，信息化建设已逐渐成为各大行业发展中不可分割的一部分，互联网影响的领域已深入到了日常生活的方方面面，网络正在成为一切社会生活的根基。"}
{"title": "Udp2raw-Tunnel：一款功能强大的UDP隧道工具", "url": "https://www.freebuf.com/sectool/187069.html", "time": "2018-10-25", "level": "", "num_look": 542115, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款功能强大的UDP隧道工具，该工具可以利用原始套接字并通过伪造的TCP/UDP/ICMP流量来帮助研究人员绕过UDP防火墙（或不稳定的UDP环境）。"}
{"title": "看我如何在Weblogic里捡一个XXE（CVE-2018-3246）", "url": "https://www.freebuf.com/vuls/186862.html", "time": "2018-10-25", "level": "现金奖励", "num_look": 624726, "num_comment": 11, "author": "黑客小平哥", "tags": ["WEB安全", "漏洞"], "text": "本次的重点是复现，上传webshell，环境是内部一个测试环境，当我使用其中一个上传页面的时候，脑子突然热了一下，把文件后缀改成了.xml，结果就很6了。"}
{"title": "安全研究 | 传真机的攻击面研究报告", "url": "https://www.freebuf.com/articles/paper/186769.html", "time": "2018-10-25", "level": "", "num_look": 147489, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["安全报告"], "text": "大家一听到“传真机”这三个字，肯定觉得这种设备离自己非常远。但实际上，现在很多办公室里仍然存在着这种“远古”设备，而且在商业和法律通信等领域内仍处于广泛使用中。"}
{"title": "OPPO互联网安全团队招聘安全人才", "url": "https://www.freebuf.com/jobs/187066.html", "time": "2018-10-25", "level": "", "num_look": 189596, "num_comment": 2, "author": "px1005", "tags": ["安全招聘"], "text": "OPPO互联网安全团队致力于保障OPPO用户、业务和产品等安全，主要负责OPPO互联网安全体系建设。"}
{"title": "Java传输器之无招胜有招", "url": "https://www.freebuf.com/articles/system/186643.html", "time": "2018-10-25", "level": "", "num_look": 134045, "num_comment": 134045, "author": "l0stTemple", "tags": ["系统安全"], "text": "前段时间在网上读了一篇有关java传输器的博客Java Stager without the Stager。该文讲述了利用java的jjs组件和Nashorn引擎下载并执行payload。"}
{"title": "快讯 | 国泰航空数据泄露，940万乘客受影响", "url": "https://www.freebuf.com/news/187543.html", "time": "2018-10-25", "level": "红色标题", "num_look": 287741, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "国泰航空公司于昨夜发布“信息安全事件”通知，表示一个包含多达940万乘客数据的系统遭到网络攻击。"}
{"title": "《缺陷周话》第5期：越界访问", "url": "https://www.freebuf.com/news/186749.html", "time": "2018-10-25", "level": "", "num_look": 125425, "num_comment": 125425, "author": "奇安信代码卫士", "tags": [], "text": "越界访问简单的说就是预先申请了一块内存，但在使用这块内存的时候超出了申请的范围从而引发越界。"}
{"title": "SIEM中基于多层网络分析引擎的安全威胁预警研究", "url": "https://www.freebuf.com/articles/network/186617.html", "time": "2018-10-25", "level": "现金奖励", "num_look": 224989, "num_comment": 5, "author": "kczwa1", "tags": ["企业安全", "网络安全"], "text": "过多的安全事件日志将无法人工地进行分析和处理，如何从中过滤出真正的渗透攻击者，供安全运维人员和响应人员进行处理，是现有所有类SIEM设备所共同面临的挑战。"}
{"title": "BUF早餐铺 | 部分安卓应用发现广告骗局，窃取金额达数亿美元 ；雅虎向2亿用户赔偿3.5亿元；日本官方责令 FaceBook 提升安全性", "url": "https://www.freebuf.com/news/187521.html", "time": "2018-10-25", "level": "", "num_look": 126144, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "只要代码写得好，天天都是程序员节~"}
{"title": "寻找活动目录中使用可逆加密存储密码的账户", "url": "https://www.freebuf.com/articles/system/186864.html", "time": "2018-10-24", "level": "", "num_look": 166716, "num_comment": 166716, "author": "secist", "tags": ["系统安全"], "text": "密码安全问题一直都受到个人和企业的关注。对于个人而言，或许仅仅只是个人隐私的被公开，而对于企业而言则可能会是灾难性的。"}
{"title": "室友靠打游戏拿30万offer，秘密竟然是……", "url": "https://www.freebuf.com/news/186871.html", "time": "2018-10-24", "level": "红色标题", "num_look": 582831, "num_comment": 8, "author": "网络安全通", "tags": ["资讯"], "text": "玩游戏也能拿offer？此游戏非彼游戏，你可听过“功能性游戏”？"}
{"title": "Kodi恶意插件可在Windows和Linux下安装挖矿木马", "url": "https://www.freebuf.com/articles/system/186629.html", "time": "2018-10-24", "level": "", "num_look": 148663, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "近期，研究人员在某些非官方的Kodi开源多媒体代码库中发现了自定义修改后的恶意插件，而这些恶意插件将会在Windows和Linux平台中下载恶意挖矿软件。"}
{"title": "拉勾网诚聘高级安全开发工程师", "url": "https://www.freebuf.com/jobs/187284.html", "time": "2018-10-24", "level": "", "num_look": 132213, "num_comment": 10, "author": "myh0st", "tags": ["安全招聘"], "text": "拉勾网，是一家专为拥有3至10年工作经验的资深互联网从业者，提供工作机会的招聘网站。"}
{"title": "WebLogic Server远程高危漏洞预警", "url": "https://www.freebuf.com/vuls/187013.html", "time": "2018-10-24", "level": "", "num_look": 231401, "num_comment": 5, "author": "奇安信代码卫士", "tags": ["漏洞"], "text": "近期，360企业安全集团代码卫士团队安全研究人员发现Oracle公司旗下产品Oracle WebLogic Server的多个高危安全漏洞。"}
{"title": "快讯 | 史上最大安全漏洞案和解，雅虎向2亿用户赔偿3.5亿元", "url": "https://www.freebuf.com/news/187485.html", "time": "2018-10-24", "level": "", "num_look": 128546, "num_comment": 2, "author": "Freddy", "tags": ["资讯"], "text": "据NBC News报道，雅虎已经同意向2亿用户支付5000万美元(约合3.47亿元人民币)赔偿金，并为他们提供为期两年的免费信用监控服务。"}
{"title": "又是一年1024，今天不加班，加鸡腿！", "url": "https://www.freebuf.com/fevents/178377.html", "time": "2018-10-24", "level": "红色标题", "num_look": 290587, "num_comment": 18, "author": "FB客服", "tags": ["活动"], "text": "请关爱这个多金又找不到对象的群体"}
{"title": "安全报告 | 从恶意流量看2018十大互联网安全趋势", "url": "https://www.freebuf.com/articles/network/187065.html", "time": "2018-10-24", "level": "", "num_look": 224176, "num_comment": 1, "author": "云鼎实验室", "tags": ["安全报告", "网络安全"], "text": "「天下熙熙，皆为利来；天下攘攘，皆为利往。」太史公一语道尽众生之奔忙。在虚拟的世界，同样有着海量的「众生」，它们默默无闻，它们不知疲倦，它们无穷无尽，同样为了「利」之一字一往无前。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列-Ron Chan", "url": "https://www.freebuf.com/video/187463.html", "time": "2018-10-24", "level": "红色标题", "num_look": 189378, "num_comment": 189378, "author": "willhuang", "tags": ["视频"], "text": "Ron Chan，中国香港人，现专职网络安全顾问和漏洞挖掘专家。目前以308个漏洞的上报量排名HackerOne榜单第25位，是为数不多的华人Bug Hunter之一。"}
{"title": "远控木马盗用网易官方签名", "url": "https://www.freebuf.com/articles/network/186951.html", "time": "2018-10-24", "level": "", "num_look": 181521, "num_comment": 1, "author": "360安全", "tags": ["网络安全"], "text": "每逢节假日，各种木马病毒都习惯性蹭热点刷存在感。在临近国庆假期之际，木马病毒的传播又活跃起来了，有款远控木马试图借用 “网易”官方签名躲避查杀大肆传播。"}
{"title": "BUF早餐铺 | MPlayer 和 VLC 使用的一个库曝出高危漏洞；沙特年度投资会议网站被黑，悬挂卡舒吉被害图像；亚马逊和超微要求彭博社撤回间谍芯片报道", "url": "https://www.freebuf.com/news/187474.html", "time": "2018-10-24", "level": "", "num_look": 106385, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "1024程序员节，愿天下没有单身狗～"}
{"title": "NSA新型APT框架曝光：DarkPulsar", "url": "https://www.freebuf.com/articles/network/187424.html", "time": "2018-10-23", "level": "", "num_look": 247168, "num_comment": 4, "author": "Freddy", "tags": ["网络安全"], "text": "ImplantConfig是一个Fuzzbunch可调用的工具包，包含一个名为DarkPulsar的管理模块，用于管理受控设备的插件，用于控制名为“sipauth32.tsp”的远程控制后门。"}
{"title": "深入分析MikroTik RouterOS CVE-2018-14847 & Get bash shell", "url": "https://www.freebuf.com/vuls/187272.html", "time": "2018-10-23", "level": "", "num_look": 286993, "num_comment": 286993, "author": "云影实验室", "tags": ["漏洞", "系统安全"], "text": "MikroTik路由器在4月份被发现存在目录遍历漏洞CVE-2018-14847，危险程度为中。Tenable Research的专家于10月7日在DerbyCon上发表的演讲，介绍了这项新技术，就是利用该漏洞。"}
{"title": "Scrounger：一款功能强大的移动端应用程序安全测试套件", "url": "https://www.freebuf.com/sectool/186624.html", "time": "2018-10-23", "level": "", "num_look": 179215, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Scrounger 的工具，广大研究人员可以使用这款工具来对移动端应用程序的安全性进行测试。"}
{"title": "8个成人网站暴露大量用户隐私，快检查下你的收藏夹", "url": "https://www.freebuf.com/news/187439.html", "time": "2018-10-23", "level": "红色标题", "num_look": 1966566, "num_comment": 25, "author": "shidongqi", "tags": ["资讯"], "text": "有多达8个成人网站的暴露了98MB文件，其中包含用户IP、加密密码、名称以及120万个邮件地址，鉴于成人网站的特殊性，还不能确定有多少是真实用户。"}
{"title": "黑客窃取有无线解锁功能的汽车的7种姿势", "url": "https://www.freebuf.com/news/186703.html", "time": "2018-10-23", "level": "", "num_look": 243945, "num_comment": 243945, "author": "secist", "tags": ["无线安全", "资讯"], "text": "大多数的汽车都支持无线解锁功能，这为我们提供了极大的便利。但任何事情都是有代价的，便利的背后是厂商和车主都需要面对的安全风险。随着无线解锁汽车的流行，一种新的犯罪也正悄然发生 - 钥匙扣黑客！"}
{"title": "Google Play上发现的银行木马可窃取受害者的银行账户", "url": "https://www.freebuf.com/articles/system/187236.html", "time": "2018-10-23", "level": "", "num_look": 119523, "num_comment": 119523, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "根据捷克警方近日发布的官方声明，捷克共和国已经有5名用户成为了这款恶意软件的受害者，并且攻击者已经成功从他们的账户上偷走了78000多欧元了。"}
{"title": "DarkHotel（黑店）APT组织针对朝鲜半岛的精确打击行动", "url": "https://www.freebuf.com/articles/network/187067.html", "time": "2018-10-23", "level": "红色标题", "num_look": 361086, "num_comment": 2, "author": "腾讯电脑管家", "tags": ["网络安全"], "text": "后门程序SYSCON/SANNY是专门针对朝鲜半岛相关的政治目标进行攻击的恶意文件，其主要攻击目标为朝鲜半岛相关的重要政治人物或者要害部门，偶尔也会针对东南亚等国进行攻击。"}
{"title": "这五款工具被全球黑客广泛使用，中国菜刀入榜", "url": "https://www.freebuf.com/news/186589.html", "time": "2018-10-23", "level": "红色标题", "num_look": 603731, "num_comment": 12, "author": "shidongqi", "tags": ["资讯"], "text": "近期，五眼联盟(Five Eyes)发布了一份报告，该报告针对全球发生的网络安全事件进行研究之后发现有五款公开的黑客工具被恶意利用地最频繁，并同时给企业和国家发出警告，提醒做好防范措施。"}
{"title": "安全应急响应 | 如何从内核中直接获取隐藏的进程信息", "url": "https://www.freebuf.com/articles/system/186012.html", "time": "2018-10-23", "level": "现金奖励", "num_look": 220214, "num_comment": 2, "author": "ForrestX386", "tags": ["系统安全"], "text": "本文介绍一个方法，直接从内核模块中获取最原始的进程信息，从而使得隐藏技巧失效，进而找到异常进程信息。"}
{"title": "BUF早餐铺 | 亚马逊智能家居曝出漏洞；Facebook有意收购网络安全公司；“Satan”勒索病毒新变种在国内传播；jQuery文件上传漏洞存在8年", "url": "https://www.freebuf.com/news/187318.html", "time": "2018-10-23", "level": "", "num_look": 122346, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "天冷了，各位Buffer注意保暖啊~"}
{"title": "Kris远控木马的简单分析", "url": "https://www.freebuf.com/articles/system/186462.html", "time": "2018-10-23", "level": "", "num_look": 173795, "num_comment": 2, "author": "navyofficer", "tags": ["系统安全"], "text": "本文分析一个远程控制木马，它的众多恶意行为之一是操作注册表，实现开机自启动，在注册表中程序为自己命名为Kris。"}
{"title": "谁在你心目中“最skr”？WitAwards 2018「大众投票」即日启动！", "url": "https://www.freebuf.com/news/186636.html", "time": "2018-10-22", "level": "红色标题", "num_look": 100095, "num_comment": 1, "author": "FB独家", "tags": ["活动", "资讯"], "text": "FreeBuf现邀请每一位安全领域从业者、爱好者，共同选出安全领域Top Icon，一起见证年度安全盛誉的诞生，为数万名从业者和数百款安全产品的努力与创新喝彩！"}
{"title": "技术讨论 | 看我如何破解一台自动售货机", "url": "https://www.freebuf.com/articles/terminal/186804.html", "time": "2018-10-22", "level": "", "num_look": 305995, "num_comment": 8, "author": "clouds", "tags": ["终端安全"], "text": "毫无疑问，自动售货机是非常受欢迎的东西，我们总会从中购买获取一些小零食。早几年前，自动售货机只接受离线的硬币支付，之后，也慢慢采用了普及的NFC技术功能。"}
{"title": "守护业务安全时代的「威胁猎人」解决方案 | WitAwards 2018“年度创新产品”参评巡礼", "url": "https://www.freebuf.com/fevents/186867.html", "time": "2018-10-22", "level": "红色标题", "num_look": 116085, "num_comment": 1, "author": "Freddy", "tags": ["活动"], "text": "FreeBuf一直以来都非常关注业务安全领域的发展，本届WitAward 2018组委会收到“年度创新产品”评选申请中，也有来自业务安全领域的新力量——威胁猎人。"}
{"title": "2017年十大Web黑客技术榜单", "url": "https://www.freebuf.com/articles/web/186739.html", "time": "2018-10-22", "level": "", "num_look": 2924883, "num_comment": 5, "author": "clouds", "tags": ["WEB安全"], "text": "此次评选活动的目的在于，在安全社区中宣传这些技术，让行业提高对安全的重视，同时也能让这些技术能受到认可和铭记。"}
{"title": "Wi-Fi 新标准 WPA3 蜻蜓 (Dragonfly) 密钥交换协议分析", "url": "https://www.freebuf.com/articles/wireless/187245.html", "time": "2018-10-22", "level": "", "num_look": 289872, "num_comment": 3, "author": "阿里安全技术", "tags": ["无线安全"], "text": "由于WPA3还尚未普及，想来目前无论公众还是相关研究人员对WPA3的协议的实施细节所知应该并不多，所以笔者在仔细阅读RFC7664文档后，在此文中将做详细的分析讨论。"}
{"title": "短网址安全浅谈", "url": "https://www.freebuf.com/vuls/186837.html", "time": "2018-10-22", "level": "红色标题", "num_look": 377587, "num_comment": 6, "author": "腾讯安全平台部", "tags": ["WEB安全", "漏洞"], "text": "短网址的初衷是在微博这种限制字数的公共平台使用，也就是说它基本是公开的，但是后续在个人短信和邮件之中，其实有部分已经是私密的。 这直接引发了短网址第一个比较大的潜在风险。"}
{"title": "BUF早餐铺 | 研究人员曝光Windows RID漏洞，提交10个月微软未修复；加密货币交易所两年内因黑客攻击损失了8.82亿美元；控制器固件漏洞可允许攻击者操纵船用柴油发动机", "url": "https://www.freebuf.com/news/187083.html", "time": "2018-10-22", "level": "", "num_look": 164537, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "安全公司已将该漏洞命名为Windows RID劫持，由于劫持Windows RID并未调用外部恶意程序所以不会引发系统拦截或安全软件拦截因此用户很难发现攻击。"}
{"title": "彪悍的中国大妈写进了《华尔街日报》，但这次她们可能要折戟区块链", "url": "https://www.freebuf.com/articles/network/186774.html", "time": "2018-10-22", "level": "红色标题", "num_look": 266132, "num_comment": 2, "author": "GEETEST极验", "tags": ["网络安全"], "text": "最近，看到有市民宋大妈深陷区块链Vpay，自己投资十几万还要拉亲友入坑，子女心机如焚。没想到无独有偶，在微博上也有网友在爆料亲人注册Vpay并且到处拉人。"}
{"title": "广撒网，多捞鱼：当黑客们也不再“安于本分”", "url": "https://www.freebuf.com/news/186393.html", "time": "2018-10-21", "level": "", "num_look": 426632, "num_comment": 426632, "author": "Karunesh91", "tags": ["资讯"], "text": "这年头，连黑客都不老实了"}
{"title": "逃避沙箱并滥用WMI：新型勒索软件PyLocky分析", "url": "https://www.freebuf.com/articles/system/186626.html", "time": "2018-10-21", "level": "", "num_look": 158882, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "在2018年上半年勒索软件的活动有所增加，并且相关勒索软件还通过各种升级更新来尝试避开现有的安全解决方案。"}
{"title": "AI与安全的恩怨情仇五部曲「1」：Misuse AI", "url": "https://www.freebuf.com/articles/network/186634.html", "time": "2018-10-21", "level": "现金奖励", "num_look": 169425, "num_comment": 2, "author": "薇拉vera", "tags": ["网络安全"], "text": "随着AI军备战进入白热化状态，越来越多的行业开始被AI带来的浪潮所影响，甚至颠覆。安全作为和众多行业交叉的一个领域，同样无法避免这样的浪潮。"}
{"title": "安全杂谈 | 是什么绑架了你的手机？", "url": "https://www.freebuf.com/news/185868.html", "time": "2018-10-21", "level": "", "num_look": 907057, "num_comment": 3, "author": "网络安全通", "tags": ["资讯"], "text": "伪基站这个东西很老了，但是最近又有一些不法分子利用它谋取钱财的时间进入了公众的视野。"}
{"title": "前端安全系列（二）：如何防止CSRF攻击？", "url": "https://www.freebuf.com/articles/web/186880.html", "time": "2018-10-21", "level": "", "num_look": 366852, "num_comment": 8, "author": "美团技术团队", "tags": ["WEB安全"], "text": "随着互联网的高速发展，信息安全问题已经成为企业最为关注的焦点之一，而前端又是引发企业安全问题的高危据点。在移动互联网时代，前端人员除了传统的 XSS、CSRF 等安全问题之外，又时常遭遇网络劫持、非法调用 Hyb…"}
{"title": "挖洞经验 | 价值3133.7美金的谷歌（Google）存储型XSS漏洞", "url": "https://www.freebuf.com/articles/web/186463.html", "time": "2018-10-20", "level": "", "num_look": 259910, "num_comment": 5, "author": "clouds", "tags": ["WEB安全"], "text": "如果能发现谷歌公司的漏洞或进入其名人堂致谢榜，就已经非常不错的了。今天我要分享的这个漏洞，是迄今为止我上报漏洞中最简单容易的一个。"}
{"title": "ct-exposer：通过搜索CT日志发现子域", "url": "https://www.freebuf.com/sectool/185928.html", "time": "2018-10-20", "level": "", "num_look": 164502, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "证书透明度（Certificate Transparency）是谷歌力推的一项拟在确保证书系统安全的透明审查技术。其目标是提供一个开放的审计和监控系统，可以让任何域名的所有者，确定CA证书是否被错误签发或恶意使用。"}
{"title": "XMR恶意挖矿案例简析", "url": "https://www.freebuf.com/articles/system/186743.html", "time": "2018-10-20", "level": "现金奖励", "num_look": 272456, "num_comment": 3, "author": "colinhe", "tags": ["系统安全"], "text": "本文简析通过蜜罐获取的XMR恶意挖矿事件：攻击者通过爆破SSH获取系统权限，配置root用户免密登录,并下载及执行XMR 挖矿程序及XMR 网页挖矿程序。"}
{"title": "某开源博客系统最新版源码审计记录TIPS", "url": "https://www.freebuf.com/vuls/186574.html", "time": "2018-10-20", "level": "现金奖励", "num_look": 177127, "num_comment": 1, "author": "davichi8282", "tags": ["漏洞", "网络安全"], "text": "近期审计一个JAVA开源博客系统mblog2.5最新版，漏洞较少，传统的问题像XSS系统使用全局过滤的方式进行实体化处理，本次审计主要在于发现安全问题。"}
{"title": "中消协就Apple ID盗刷事件向苹果施压，但我想给苹果洗地……", "url": "https://www.freebuf.com/news/187160.html", "time": "2018-10-19", "level": "红色标题", "num_look": 209272, "num_comment": 6, "author": "shidongqi", "tags": ["资讯"], "text": "唯一好奇的是，盗刷事件原本只是偶尔出现，这次却突然形成一波小爆发，难不成又是哪位大佬家发生了严重的数据泄露？"}
{"title": "BEC诈骗横行，被黑账户可卖150美元到5000美元不等", "url": "https://www.freebuf.com/news/186434.html", "time": "2018-10-19", "level": "", "num_look": 141268, "num_comment": 141268, "author": "softnext守内安", "tags": ["资讯"], "text": "Digital Shadows 的信息安全专家进行了一项有趣的研究，探讨诈骗份子采用的技术渗透公司电子邮件，即所谓的BEC诈骗。"}
{"title": "小型互联网企业安全建设的管窥之见", "url": "https://www.freebuf.com/articles/es/186771.html", "time": "2018-10-19", "level": "现金奖励", "num_look": 577067, "num_comment": 11, "author": "si1ence", "tags": ["企业安全"], "text": "最近发现大家都在讨论一个人的安全部这个话题，两年前在某A轮互联网公司（80人左右的研发团队）做过一段一个人的安全部的经验就简单分享自己的经验。"}
{"title": "如何通过Kibana、Wazuh和Bro IDS提高中小企业的威胁检测能力？", "url": "https://www.freebuf.com/articles/es/185952.html", "time": "2018-10-19", "level": "", "num_look": 286470, "num_comment": 1, "author": "secist", "tags": ["企业安全"], "text": "在本文中，我们将手把手的教大家通过Kibana、Wazuh和Bro IDS来提高自身企业的威胁检测能力。"}
{"title": "Cookie篡改与命令注入", "url": "https://www.freebuf.com/vuls/181368.html", "time": "2018-10-19", "level": "现金奖励", "num_look": 616767, "num_comment": 11, "author": "Aohanh", "tags": ["WEB安全", "漏洞"], "text": "cookie 篡改 (cookie poisoning) 是一项主要以获取模拟和隐私权泄密著称的技术，通过维护客户（或终端用户）身份的会话信息操纵来实现的。"}
{"title": "非对称算法之RSA的签名剖析", "url": "https://www.freebuf.com/articles/database/185594.html", "time": "2018-10-19", "level": "现金奖励", "num_look": 228263, "num_comment": 1, "author": "liang亮", "tags": ["数据安全"], "text": "数字签名，就是只有信息的发送者才能产生的别人无法伪造的一段数字串，这段数字串同时也是对信息的发送者发送信息真实性的一个有效证明。 本文主要来讲签名值具体是怎么计算出来的~"}
{"title": "BUF早餐铺 | 全球网络安全人才缺口达到293万；苹果公司上线隐私权网站；加密劫持软件成为企业和消费者的头号威胁", "url": "https://www.freebuf.com/news/187001.html", "time": "2018-10-19", "level": "", "num_look": 133411, "num_comment": 133411, "author": "Akane", "tags": ["资讯"], "text": "根据2018年网络安全劳动力研究表明，北美、拉丁美洲、亚太地区以及欧洲、中东和非洲的全球网络安全人才缺口已扩大至近300万。"}
{"title": "挖洞经验 | 看我如何在短时间内对Shopify五万多个子域名进行劫持", "url": "https://www.freebuf.com/articles/web/186411.html", "time": "2018-10-18", "level": "", "num_look": 272812, "num_comment": 8, "author": "clouds", "tags": ["WEB安全"], "text": "今天我要分享的是5万多个Shopify平台子域名劫持漏洞的发现过程。该漏洞不仅只存在于Shopify平台系统，还存在其它几个云服务平台系统中。"}
{"title": "我是如何绕过Uber的CSP防御成功XSS的？", "url": "https://www.freebuf.com/articles/web/185939.html", "time": "2018-10-18", "level": "", "num_look": 238603, "num_comment": 6, "author": "secist", "tags": ["WEB安全"], "text": "我打算在Uber的子域上挖掘一些“开放重定向”漏洞。如果能与其它漏洞联系起来，也许能导致帐户接管或其它什么更严重的安全问题呢？"}
{"title": "新浪安全2018年Q4招聘计划", "url": "https://www.freebuf.com/jobs/186670.html", "time": "2018-10-18", "level": "", "num_look": 184680, "num_comment": 2, "author": "糖果L5Q", "tags": ["安全招聘"], "text": "新浪2018人才招聘计划已推出，诚聘高级安全人才，薪资可谈！欢迎大家推荐自荐！"}
{"title": "PHP两版本大限将至，全球近七成网站需紧急更新", "url": "https://www.freebuf.com/news/186794.html", "time": "2018-10-18", "level": "", "num_look": 201876, "num_comment": 4, "author": "shidongqi", "tags": ["资讯"], "text": "2019年1月1日开始，PHP 5 最后一个版本 5.6 将不再受支持，与此同时，PHP 7 第一个版本 PHP 7.0 也将在2018年 12月 3 日不再更新。"}
{"title": "运维安全 | 等保视角下的SSH加固之旅", "url": "https://www.freebuf.com/articles/system/185846.html", "time": "2018-10-18", "level": "现金奖励", "num_look": 353398, "num_comment": 2, "author": "ForrestX386", "tags": ["系统安全"], "text": "前段时间在搞等保，根据等保的安全要求，需要对公司的服务器进行安全加固，其中就涉及到对SSH Server的加固。正好最近有空，笔者将加固过程的一些经验，总结分享一下，于是有了本文。"}
{"title": "企业安全问题层出不穷：移动设备也需重视", "url": "https://www.freebuf.com/articles/es/186396.html", "time": "2018-10-18", "level": "", "num_look": 186725, "num_comment": 1, "author": "Karunesh91", "tags": ["企业安全"], "text": "企业信息安全之路，任重而道远。"}
{"title": "给我一个无线切入点，我就可以操控你的物理隔离网络", "url": "https://www.freebuf.com/articles/es/186565.html", "time": "2018-10-18", "level": "", "num_look": 317289, "num_comment": 3, "author": "sunshiner", "tags": ["企业安全"], "text": "企业的物理隔离被认为是非常安全的一种措施，然而在物理隔离网络中U盘等硬件设备就是一种具有可操作性的攻击方式。"}
{"title": "APT32“海莲花”近期多平台攻击活动：熟悉的手段，全新的IOC", "url": "https://www.freebuf.com/articles/network/186493.html", "time": "2018-10-18", "level": "", "num_look": 257564, "num_comment": 257564, "author": "Threatbook", "tags": ["网络安全"], "text": "“海莲花”，又名APT32和OceanLotus，是越南背景的黑客组织。该组织至少自2012年开始活跃，长期针对中国能源相关行业、海事机构、海域建设部门、科研院所和航运企业等进行网络攻击。"}
{"title": "BUF早餐铺 | 苹果就 Apple ID被盗刷一事道歉；一名俄罗斯男子因非法入侵政府服务器挖矿而被起诉；“请勿跟踪”功能几乎无人遵守", "url": "https://www.freebuf.com/news/186981.html", "time": "2018-10-18", "level": "", "num_look": 152038, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "苹果就中国用户 Apple ID被盗刷一事发表声明，表示深感歉意，它建议用户启用双重认证。苹果表示，它在调查后发现少量用户的账户在尚未开启双重认证的情况下遭遇钓鱼诈骗。"}
{"title": "CNNVD关于Oracle WebLogic Server远程代码执行漏洞的通报", "url": "https://www.freebuf.com/news/186954.html", "time": "2018-10-17", "level": "", "num_look": 278754, "num_comment": 2, "author": "CNNVD", "tags": ["漏洞", "资讯"], "text": "国家信息安全漏洞库（CNNVD）收到Oracle WebLogic Server远程代码执行漏洞（CNNVD-201810-781、CVE-2018-3245）情况的报送。攻击者可利用该漏洞在未授权的情况下发送攻击数据，通过T3协议在WebLogic Server中执行反…"}
{"title": "技术讨论 | 看我如何通过邮箱获取IP定位", "url": "https://www.freebuf.com/articles/database/185954.html", "time": "2018-10-17", "level": "现金奖励", "num_look": 1192061, "num_comment": 34, "author": "dxkite", "tags": ["数据安全"], "text": "还记得那些年，邮箱钓鱼盛行，各种广告邮件钓鱼邮件层出不穷，经过邮箱防水墙能拦截一部分以外，你是否注意到了正常邮箱可能被有心人利用的姿势？本文将用一个比较难以察觉的方式获取目标的 IP。"}
{"title": "Vdex Extractor：从Vdex文件反编译和提取Android Dex字节码的工具", "url": "https://www.freebuf.com/sectool/185881.html", "time": "2018-10-17", "level": "", "num_look": 318175, "num_comment": 2, "author": "周大涛", "tags": ["工具"], "text": "一款命令行工具，用于从Vdex文件反编译和提取Android Dex字节码的工具。"}
{"title": "一次入侵应急响应分析", "url": "https://www.freebuf.com/articles/network/186071.html", "time": "2018-10-17", "level": "红色标题", "num_look": 831000, "num_comment": 34, "author": "feiniao", "tags": ["网络安全"], "text": "笔者发现用户的服务器被多波不同利益的黑客入侵，里面有一些比较有意思的内容，所以特意分析总结了一下。"}
{"title": "技术讨论 | 四种绕过iOS SSL验证和证书固定的方法", "url": "https://www.freebuf.com/articles/terminal/185983.html", "time": "2018-10-17", "level": "", "num_look": 261393, "num_comment": 261393, "author": "secist", "tags": ["终端安全"], "text": "本文假设读者对iOS，Xcode，设置手机和在iOS使用Burp拦截HTTP流量有基本的了解，为大家介绍四种绕过iOS中的SSL验证和证书固定的方法。"}
{"title": "钉钉招聘安全人才", "url": "https://www.freebuf.com/jobs/186826.html", "time": "2018-10-17", "level": "", "num_look": 150156, "num_comment": 4, "author": "SixSixSix", "tags": ["安全招聘"], "text": "钉钉（DingTalk）是阿里巴巴集团专为中国企业打造的免费沟通和协同的多端平台 ，提供PC版，Web版和手机版，支持手机和电脑间文件互传。"}
{"title": "开源软件源代码安全缺陷分析报告——人工智能类开源软件专题", "url": "https://www.freebuf.com/articles/paper/186281.html", "time": "2018-10-17", "level": "红色标题", "num_look": 342118, "num_comment": 1, "author": "奇安信代码卫士", "tags": ["安全报告"], "text": "近日，CNCERT发布了《开源软件代码安全缺陷分析报告——人工智能类开源软件专题》。本期报告聚焦国内外知名机器学习、人工智能类开源软件安全开发现状。"}
{"title": "负载恶意软件HawkEye的VB Inject样本分析", "url": "https://www.freebuf.com/articles/terminal/186050.html", "time": "2018-10-17", "level": "现金奖励", "num_look": 188980, "num_comment": 2, "author": "Macc", "tags": ["安全报告", "终端安全"], "text": "恶意软件HawkEye的利用大多都是通过钓鱼邮件分发，利用office直接启动HawkEye主体或者一些经过加密的程序，本文中的VB Inject属于后者，也把重心放在了调试这个VB程序上。"}
{"title": "网络安全威胁信息格式规范正式发布，国内威胁情报发展迎来新阶段", "url": "https://www.freebuf.com/news/186490.html", "time": "2018-10-17", "level": "", "num_look": 218955, "num_comment": 218955, "author": "AdlerI", "tags": ["资讯"], "text": "2018 年 10 月 10 日，我国正式发布威胁情报的国家标准——《信息安全技术网络安全威胁信息格式规范》(GB/T 36643-2018)。"}
{"title": "BUF早餐铺 | 黑客挟持罗马尼亚市政厅电脑并要求比特币赎金；PHP 5版年底终止安全更新，6成网站恐面临风险；索尼表示已修复PS4漏洞 官方给出解决方法", "url": "https://www.freebuf.com/news/186841.html", "time": "2018-10-17", "level": "", "num_look": 129239, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "一名份不明的黑客已经封锁了罗马尼亚最富有的布加勒斯特第一区市政厅的所有计算机，并要求当局支付比特币的赎金以解锁网络。该区市长 Dan Tudorache表示，袭击者要求比特币支付大笔款项。"}
{"title": "【今日开课】【精品公开课】斩获CVE的三步修炼法（首节课程仅售1元）", "url": "https://www.freebuf.com/fevents/186708.html", "time": "2018-10-16", "level": "红色标题", "num_look": 170450, "num_comment": 5, "author": "FB客服", "tags": ["FreeBuf公开课", "活动"], "text": "“有个CVE编号还是很有逼格的”、“找工作亮出来，高人一等，快人一步”、“实力与技术的证明”、“吹吹牛也是美滋滋”……"}
{"title": "技术讨论 | 一种基于软件捆绑方式Bypass AV的思路", "url": "https://www.freebuf.com/articles/system/186168.html", "time": "2018-10-16", "level": "现金奖励", "num_look": 563597, "num_comment": 7, "author": "si1ence", "tags": ["系统安全"], "text": "最近尝试了一种猥琐方式通过捆绑安装的方式将 Powshell 后门植入到软件安装包的方式绕过杀毒软件检测的方法。"}
{"title": "新型鼠标光标劫持攻击将允许攻击者劫持GoogleChrome会话", "url": "https://www.freebuf.com/articles/web/185853.html", "time": "2018-10-16", "level": "", "num_look": 187043, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "一种典型的技术支持诈骗技术就是 Partnerstroka，而这种技术近期又引入了一种劫持浏览器会话的新方法。"}
{"title": "TIDoS-Framework：Web应用渗透测试框架", "url": "https://www.freebuf.com/sectool/185459.html", "time": "2018-10-16", "level": "", "num_look": 240551, "num_comment": 11, "author": "secist", "tags": ["工具"], "text": "TIDoS-Framework是一个基于python的攻击性Web应用渗透测试框架，其涵盖了从侦察到漏洞分析的所有内容。"}
{"title": "使用DLL注入方式绕过Windows 10勒索软件保护机制", "url": "https://www.freebuf.com/news/186264.html", "time": "2018-10-16", "level": "", "num_look": 468427, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "在上周举行的DerbyCon安全大会上，安全专家展示了一种利用DLL注入方式来绕过Windows 10勒索软件保护功能的方式。"}
{"title": "BUF早餐铺 | 黑客盗取虚拟币后全数退回，网站反奖黑客5000美元；假冒Google Photos应用现身微软商店；中国比特币挖矿业中心化或对比特币网络构成威胁", "url": "https://www.freebuf.com/news/186700.html", "time": "2018-10-16", "level": "", "num_look": 148204, "num_comment": 148204, "author": "Karunesh91", "tags": ["资讯"], "text": "虚拟货币很长时间仍然会是黑客攻击的重头~"}
{"title": "黑客攻击成人网站窃取165枚ETH，归还后获奖5000美元", "url": "https://www.freebuf.com/news/186702.html", "time": "2018-10-15", "level": "", "num_look": 275152, "num_comment": 8, "author": "shidongqi", "tags": ["资讯"], "text": "发动攻击的黑客与被攻击的网站之间的关系一般来说都是水火不容的，而这次事故里，黑客发起攻击后窃取 3.2 万美金的加密货币后却全数归还，网站方也给予 5000 美元作为奖励，连发起攻击的成本也得到了补偿……"}
{"title": "Danger-zone ：一款可将域、IP和email地址关联并可视化输出的工具", "url": "https://www.freebuf.com/sectool/185771.html", "time": "2018-10-15", "level": "", "num_look": 239790, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "Danger-zone是一款可将域、IP 和email地址之间的数据关联，并可视化输出存储到Elasticsearch和JSON文件中。"}
{"title": "无字母数字Webshell之提高篇", "url": "https://www.freebuf.com/articles/web/186298.html", "time": "2018-10-15", "level": "现金奖励", "num_look": 545396, "num_comment": 15, "author": "phithon", "tags": ["WEB安全"], "text": "难点呼之欲出了，我前面文章中给出的所有方法，都用到了PHP中的变量，需要对变量进行变形、异或、取反等操作，最后动态执行函数。但现在，因为$不能使用了，所以我们无法构造PHP中的变量。"}
{"title": "使用Digispark和Duck2Spark打造一个廉价USB橡皮鸭", "url": "https://www.freebuf.com/articles/system/185293.html", "time": "2018-10-15", "level": "", "num_look": 301872, "num_comment": 4, "author": "secist", "tags": ["系统安全"], "text": "市面上有很多优秀的硬件黑客工具，但缺点是这些工具的价格往往非常的高昂。因此，许多黑客更愿意自己动手打造更为廉价的专属版本。"}
{"title": "Testin云测招聘安全人才", "url": "https://www.freebuf.com/jobs/186464.html", "time": "2018-10-15", "level": "", "num_look": 110156, "num_comment": 110156, "author": "麦片与老干妈", "tags": ["安全招聘"], "text": "Testin是一家致力于为移动互联网应用提供质量服务的创新型企业。是全球第一家也是最大一家针对移动端软件提供方位质量保障服务的企业。"}
{"title": "早鸟特惠最低仅需10.24元，FIT 2019 大会门票即日起售", "url": "https://www.freebuf.com/news/186415.html", "time": "2018-10-15", "level": "红色标题", "num_look": 169176, "num_comment": 6, "author": "FB独家", "tags": ["活动", "资讯"], "text": "超低价体验门票，快来抢购鸭～"}
{"title": "2018年上半年全球数据泄露事件严重程度指数一览", "url": "https://www.freebuf.com/news/186310.html", "time": "2018-10-15", "level": "", "num_look": 309476, "num_comment": 309476, "author": "Freddy", "tags": ["资讯"], "text": "近日，金雅拓（Gemalto）发布了全球范围内公共数据泄露事件严重程度指数，共涵盖945次事件，导致45亿条信息泄露。"}
{"title": "顺藤摸瓜，炒股交流群里的黑产陷阱", "url": "https://www.freebuf.com/articles/network/186525.html", "time": "2018-10-15", "level": "红色标题", "num_look": 435775, "num_comment": 12, "author": "GEETEST极验", "tags": ["网络安全"], "text": "最近，有网友爆料男子轻信“讲师荐股”被骗了144万，这种屡见不鲜的炒股交流群到底如何盈利呢？"}
{"title": "从远程桌面服务到获取Empire Shell", "url": "https://www.freebuf.com/articles/system/185653.html", "time": "2018-10-14", "level": "", "num_look": 203976, "num_comment": 1, "author": "secist", "tags": ["系统安全"], "text": "本文将为大家详细介绍如何在只能访问远程桌面服务，且有 AppLocker 保护 PowerShell 处于语言约束模式下获取目标机器 Empire shell。"}
{"title": "IKEA.com本地文件包含漏洞之PDF解析的巧妙利用", "url": "https://www.freebuf.com/articles/web/185321.html", "time": "2018-10-14", "level": "", "num_look": 218920, "num_comment": 1, "author": "secist", "tags": ["WEB安全"], "text": "本地文件包含（LFI）漏洞是一种危害性较大的漏洞类型。一旦出现攻击者将可能利用其，读取文件源码或敏感信息，包含恶意文件，执行任意代码，甚至控制服务器等。"}
{"title": "安卓手机搭建渗透环境（无需Root）", "url": "https://www.freebuf.com/sectool/186251.html", "time": "2018-10-14", "level": "现金奖励", "num_look": 726912, "num_comment": 11, "author": "ChuanFile", "tags": ["工具"], "text": "有些地方使用笔记本做渗透测试太招摇，本文介绍了如何使用手机搭建网络渗透环境，并且无需Root。"}
{"title": "利用帕斯卡三角和谢尔宾斯基三角的加密算法", "url": "https://www.freebuf.com/articles/database/186240.html", "time": "2018-10-14", "level": "", "num_look": 205132, "num_comment": 3, "author": "NaTsUk0", "tags": ["数据安全"], "text": "本文中，我们开发出了一款新的加密算法，它利用了帕斯卡三角和谢尔宾斯基三角相关的概念。要论述的做法是利用帕斯卡三角做替换和利用谢尔宾斯基三角做置换。"}
{"title": "谍影重现 | APT28对美网络钓鱼攻击的线索分析", "url": "https://www.freebuf.com/articles/paper/185686.html", "time": "2018-10-13", "level": "", "num_look": 216338, "num_comment": 2, "author": "clouds", "tags": ["安全报告"], "text": "在即将到来的美国中期选举前夕，谍影重现。9月中旬，微软方面采取行动阻止了一项由俄罗斯APT组织Fancy Bear（APT28）发起的网络钓鱼攻击。"}
{"title": "如何使用基于整数的手动SQL注入技术", "url": "https://www.freebuf.com/articles/web/185274.html", "time": "2018-10-13", "level": "", "num_look": 271168, "num_comment": 13, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "今天，我将教大家如何使用基于整型的手动SQL注入技术来对MySQL数据库进行渗透测试。提醒一下，这是一篇写给newbee的文章。话不多说，我们直奔主题！"}
{"title": "Foxit Reader多个UAF漏洞解析", "url": "https://www.freebuf.com/vuls/186273.html", "time": "2018-10-13", "level": "现金奖励", "num_look": 182107, "num_comment": 182107, "author": "云影实验室", "tags": ["漏洞", "系统安全"], "text": "9月28号著名PDF阅读器厂商福昕针对Foxit Reader和Foxit PhantomPDF发布了例行安全更新，在其安全公告上涉及了其中一个包含较多CVE编号的修补。"}
{"title": "我的个人信息还好吗？浅谈个人信息保护法制建设", "url": "https://www.freebuf.com/articles/neopoints/186102.html", "time": "2018-10-13", "level": "", "num_look": 261945, "num_comment": 2, "author": "Freddy", "tags": ["观点"], "text": "以个人信息/隐私为中心，这个时代为每个参与信息交互的个体编织了一张逃不开的大网，网络上的每个节点构成了我们的生活。"}
{"title": "快讯 | 微软 Edge 浏览器爆高危漏洞，受控电脑可执行任意命令", "url": "https://www.freebuf.com/news/186609.html", "time": "2018-10-12", "level": "红色标题", "num_look": 165690, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "Windows 10内置的Microsoft Edge出现漏洞，攻击者可以使用该代码通过Microsoft Edge浏览器在远程计算机上运行恶意代码。"}
{"title": "使用Python CGIHTTPServer绕过注入时的CSRF Token防御", "url": "https://www.freebuf.com/articles/web/185545.html", "time": "2018-10-12", "level": "", "num_look": 205732, "num_comment": 205732, "author": "secist", "tags": ["WEB安全"], "text": "CSRF tokens值具有随机性，一次性，并且是基于服务器端的前一个请求生成的，因此黑客几乎不可能伪造它。"}
{"title": "开源SSH双因素登陆认证系统JXOTP了解一下（续）", "url": "https://www.freebuf.com/sectool/185850.html", "time": "2018-10-12", "level": "", "num_look": 192226, "num_comment": 2, "author": "chenjc", "tags": ["工具"], "text": "这次发布的版本适合企业使用，兼容堡垒机、LDAP等，目前只支持linux，适用于云服务器等场景，部署及使用简单方便。"}
{"title": "iOS 12 安全更新 | 一个月内安装率超 50%，越狱和漏洞一个也没少", "url": "https://www.freebuf.com/news/186533.html", "time": "2018-10-12", "level": "", "num_look": 211154, "num_comment": 3, "author": "AngelaY", "tags": ["观点", "资讯"], "text": "新版系统在运行速度、便捷性、互动等性能层面都有所更新，也让人们对其隐私安全性能有了更高期待。"}
{"title": "大规模DDoS攻击的物联网僵尸网络：2018年第二季度威胁报告", "url": "https://www.freebuf.com/articles/paper/185479.html", "time": "2018-10-12", "level": "", "num_look": 197592, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["安全报告"], "text": "对于任何一个组织或企业来说，DDoS攻击绝对是杀伤力巨大的一种威胁类型。"}
{"title": "APT组织ZooPark V3版移动样本分析", "url": "https://www.freebuf.com/articles/terminal/185500.html", "time": "2018-10-12", "level": "现金奖励", "num_look": 194601, "num_comment": 2, "author": "xiongchaochao", "tags": ["终端安全"], "text": "ZooPark是一个针对中东的APT组织，截至2017年，已经发展到了4.0版本，本次分析是第三个版本"}
{"title": "DNS后门及其检测", "url": "https://www.freebuf.com/articles/network/185324.html", "time": "2018-10-12", "level": "现金奖励", "num_look": 428583, "num_comment": 11, "author": "rotgrass", "tags": ["网络安全"], "text": "使用DNS隧道技术可以有效地进行数据交换，当然，也可以使用DNS隧道技术进行后门的制作。"}
{"title": "Google的社交梦，因隐私问题而覆灭", "url": "https://www.freebuf.com/articles/neopoints/186502.html", "time": "2018-10-12", "level": "", "num_look": 187622, "num_comment": 2, "author": "shidongqi", "tags": ["观点"], "text": "Google+从设想的第一天开始就考虑到隐私问题，而同样是隐私安全问题，加速了这个曾经全球第二大社交网络平台的覆灭。"}
{"title": "技术讨论 | 基于基站定位APP开发实录", "url": "https://www.freebuf.com/geek/180198.html", "time": "2018-10-12", "level": "现金奖励", "num_look": 319469, "num_comment": 5, "author": "xutiejun", "tags": ["极客"], "text": "决定自己开发一款定位用APP为父母保驾护航。考虑到耗电问题，放弃GPS定位，研究了下基站定位技术，虽然定位精度不及GPS，但对于我的需求是足够的。"}
{"title": "通过代码审计找出网站中的XSS漏洞实战", "url": "https://www.freebuf.com/articles/web/186163.html", "time": "2018-10-12", "level": "", "num_look": 224820, "num_comment": 224820, "author": "我是daxia", "tags": ["WEB安全"], "text": "本文主要记录通过代码审计的方式进行XSS漏洞挖掘，分为找出关键位置，正向审计，反向审计三个部分，审计的系统为permeate渗透测试系统。"}
{"title": "BUF早餐铺 | 900万台国产视频监控设备被指存在漏洞；Gallmaker网络犯罪集团崛起；关于微软多个安全漏洞的通报；暗网黑市管理员落网", "url": "https://www.freebuf.com/news/186433.html", "time": "2018-10-12", "level": "", "num_look": 136261, "num_comment": 136261, "author": "Freddy", "tags": ["资讯"], "text": "安全研究人员发现的漏洞包括默认管理员密码（即无密码，初始设置没有强制设置密码）、“默认”帐户的不安全凭据、多个未加密信道、薄弱的更新机制和未签名的固件等。"}
{"title": "安全开发 | 如何让Django框架中的CSRF_Token的值每次请求都不一样", "url": "https://www.freebuf.com/articles/web/185980.html", "time": "2018-10-12", "level": "现金奖励", "num_look": 190414, "num_comment": 190414, "author": "ForrestX386", "tags": ["WEB安全"], "text": "本文介绍一种不用修改CsrfViewMiddleware中间件源码的方式，实现基于请求的csrf_token更新方式。"}
{"title": "新型XBash恶意软件融合了勒索病毒、挖矿、僵尸网络和蠕虫的功能", "url": "https://www.freebuf.com/articles/network/185457.html", "time": "2018-10-11", "level": "", "num_look": 184387, "num_comment": 184387, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "近期，Palo Alto Network的研究人员发现了一款名叫XBash的新型恶意软件，而这款恶意软件不仅是一个勒索软件，而且它还融合了挖矿、僵尸网络和蠕虫等功能。"}
{"title": "美国GAO武器系统安全报告：先进武器装备多存在安全漏洞", "url": "https://www.freebuf.com/news/186414.html", "time": "2018-10-11", "level": "", "num_look": 310952, "num_comment": 310952, "author": "ang010ela", "tags": ["工控安全", "资讯"], "text": "美国政府问责局（GovernmentAccountabilityOffice，GAO）日前发布报告称，美国国防部开发的武器系统都存在安全漏洞，攻击者可以控制这些武器系统，甚至破坏其功能。"}
{"title": "西部数据My Cloud存储设备被曝可提权认证绕过漏洞", "url": "https://www.freebuf.com/articles/terminal/185367.html", "time": "2018-10-11", "level": "", "num_look": 153574, "num_comment": 1, "author": "clouds", "tags": ["终端安全"], "text": "西部数据My Cloud网络存储设备存在认证绕过漏洞，未授权的远程或本地攻击者可利用该漏洞，无需密码就能提权成admin管理员身份，获取对My Cloud设备的完全控制权。"}
{"title": "《缺陷周话》第四期：XML外部实体注入", "url": "https://www.freebuf.com/vuls/186054.html", "time": "2018-10-11", "level": "", "num_look": 200729, "num_comment": 5, "author": "奇安信代码卫士", "tags": ["漏洞"], "text": "代码审计是使用静态分析发现源代码中安全缺陷的方法，能够辅助开发或测试人员在软件上线前较为全面地了解其安全问题，防患于未然。"}
{"title": "“C位”出道 | FIT 2019互联网安全创新大会「议题征集」启动", "url": "https://www.freebuf.com/news/184360.html", "time": "2018-10-11", "level": "红色标题", "num_look": 135459, "num_comment": 135459, "author": "FB独家", "tags": ["头条", "活动"], "text": "FIT 2019大会会期为2018年12月12日～13日，会议将在上海宝华万豪酒店举行。FreeBuf诚挚邀请你到FIT 2019大会议题征集活动中！"}
{"title": "知己知彼之新型勒索Viro Botnet Ransomware的功能分析", "url": "https://www.freebuf.com/articles/terminal/185735.html", "time": "2018-10-11", "level": "现金奖励", "num_look": 166724, "num_comment": 5, "author": "si1ence", "tags": ["终端安全"], "text": "最近发现一个伪装成Office Update的勒索软件差一点手抖就双击点击运行了，上网一查发现还是个新的样本叫VIBOROT，就简单的看了一下相关介绍与功能。"}
{"title": "华夏银行技术处长编写病毒程序取款700余万占为己有，现已受审", "url": "https://www.freebuf.com/news/186335.html", "time": "2018-10-11", "level": "红色标题", "num_look": 290003, "num_comment": 9, "author": "AdlerI", "tags": ["资讯"], "text": "华夏银行技术处长利用职务便利，在华夏银行总行核心系统内植入计算机病毒程序，使跨行 ATM 机取款交易不能计入账户，之后成功取款 717.9 万元非法占为己有。"}
{"title": "医疗互联网服务敏感数据泄露风险调查报告", "url": "https://www.freebuf.com/vuls/186160.html", "time": "2018-10-11", "level": "", "num_look": 228527, "num_comment": 228527, "author": "腾讯电脑管家", "tags": ["安全报告", "漏洞"], "text": "随着互联网、大数据、云计算技术的快速发展，我国医疗机构的信息化程度越来越高，逐步向数字化医疗、智慧医疗发展。新型技术的使用必然会带来新的安全风险。"}
{"title": "研究报告 | 撞库攻击的成本： 亚太地区", "url": "https://www.freebuf.com/articles/paper/186183.html", "time": "2018-10-11", "level": "", "num_look": 228852, "num_comment": 2, "author": "FB客服", "tags": ["安全报告"], "text": "Akamai 发布“亚太地区撞库攻击成本”研究报告及相关解读"}
{"title": "BUF早餐铺 | 华夏银行技术处长编病毒植入程序盗取700余万；支付宝检测到部分苹果用户ID被盗；微软十月修复49个漏洞", "url": "https://www.freebuf.com/news/186325.html", "time": "2018-10-11", "level": "", "num_look": 125387, "num_comment": 125387, "author": "AngelaY", "tags": ["资讯"], "text": "2018 年上半年全球共泄露 45 亿条数据；美国武器库系统安全性低，技术不高的攻击者也可实现入侵"}
{"title": "走近2018腾讯安全国际技术峰会，一起感受国际范儿", "url": "https://www.freebuf.com/fevents/186315.html", "time": "2018-10-11", "level": "红色标题", "num_look": 181364, "num_comment": 1, "author": "Akane", "tags": ["活动"], "text": "所谓国际范儿，自然少不了来自大洋彼岸的国际友人们。腾讯、高通、ARM、MWR、趋势科技等国内外知名大厂的顶级大咖们悉数到场，为我们带来了一场精彩的安全盛宴。"}
{"title": "BitCracker：BitLocker密码破解工具", "url": "https://www.freebuf.com/sectool/185006.html", "time": "2018-10-10", "level": "", "num_look": 1272677, "num_comment": 9, "author": "secist", "tags": ["工具"], "text": "BitCracker是第一个开源的用于破解使用BitLocker加密存储设备（如硬盘，USB Pendrive，SD卡等）的工具。"}
{"title": "昨天，我的手机收到了一条霸占全屏的匿名“信息”", "url": "https://www.freebuf.com/articles/network/186022.html", "time": "2018-10-10", "level": "红色标题", "num_look": 737211, "num_comment": 18, "author": "GEETEST极验", "tags": ["网络安全"], "text": "手机上收到了这样一个霸占全屏的“消息”，没有进行任何操作，信息内容就直接显示在屏幕上，关闭后发现没有记录，也无从得知发件人是谁。"}
{"title": "12种公开资源情报（OSINT）信息收集技巧分享", "url": "https://www.freebuf.com/articles/web/184820.html", "time": "2018-10-10", "level": "", "num_look": 418722, "num_comment": 1, "author": "secist", "tags": ["WEB安全"], "text": "公开资源情报计划（Open source intelligence ），简称OSINT，是美国中央情报局（CIA）的一种情报搜集手段，从各种公开的信息资源中寻找和获取有价值的情报。"}
{"title": "中国平安人寿招聘安全人才", "url": "https://www.freebuf.com/jobs/185904.html", "time": "2018-10-10", "level": "", "num_look": 164474, "num_comment": 2, "author": "风若新", "tags": ["安全招聘"], "text": "中国平安人寿保险股份有限公司成立于2002年，是中国平安保险（集团）股份有限公司旗下的重要成员。"}
{"title": "分享Burp Suite遇到的各种坑", "url": "https://www.freebuf.com/sectool/186020.html", "time": "2018-10-10", "level": "红色标题", "num_look": 497996, "num_comment": 15, "author": "mazekey", "tags": ["工具"], "text": "上篇文章《HTTP协议调试工具汇总，你心目中应该是什么样的？》介绍了近40款抓包工具，本篇将单独吐槽一下Burp Suite使用中经常遇到问题，及设想如何改进。"}
{"title": "家用路由器的安全性几何？", "url": "https://www.freebuf.com/news/186029.html", "time": "2018-10-10", "level": "", "num_look": 191847, "num_comment": 3, "author": "Freddy", "tags": ["资讯"], "text": "很多低成本物联网（IoT）设备缺乏足够的安全措施，很容易成为黑客攻击的目标"}
{"title": "浅析区块链隐私保护技术之门罗币", "url": "https://www.freebuf.com/articles/blockchain-articles/185999.html", "time": "2018-10-10", "level": "", "num_look": 197348, "num_comment": 3, "author": "bubbleszz", "tags": ["区块链安全"], "text": "今天我们还是从技术的角度来看看区块链上的匿名与隐私，这篇应该算是开篇，所以前面会有一些简单的介绍。"}
{"title": "BUF早餐铺 | 谷歌意识到泄漏近50万用户数据，将永久关闭Google+；公安部进一步扩大网络安全法规；程序员非法出售VPN被判刑三年，罚款10000元", "url": "https://www.freebuf.com/news/186199.html", "time": "2018-10-10", "level": "", "num_look": 175870, "num_comment": 8, "author": "shidongqi", "tags": ["资讯"], "text": "因 API 设计缺陷问题，Google 泄露了近 50 万 Google+ 用户的隐私数据，但却选择不报告该失误，部分原因是担心披露后会引发监管审查和声誉受损。"}
{"title": "事件分析 | 门罗币挖矿新家族「罗生门」", "url": "https://www.freebuf.com/articles/network/186208.html", "time": "2018-10-09", "level": "", "num_look": 211866, "num_comment": 4, "author": "云鼎实验室", "tags": ["网络安全"], "text": "腾讯安全云鼎实验室通过部署的威胁感知系统捕获了一批挖矿样本（具有同源性），是一批可挖取门罗币(xmr)的挖矿病毒。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列-Johnny Nipper", "url": "https://www.freebuf.com/video/186204.html", "time": "2018-10-09", "level": "红色标题", "num_look": 135555, "num_comment": 1, "author": "willhuang", "tags": ["视频"], "text": "Johnny Nipper因着迷于技术从而进入安全行业，成为了一名业余白帽黑客。目前，他以188个有效漏洞的上报量和4303分声望值排名HackerOne排行榜第88名。"}
{"title": "Wildpwn：Unix通配符攻击工具", "url": "https://www.freebuf.com/sectool/185276.html", "time": "2018-10-09", "level": "", "num_look": 157960, "num_comment": 4, "author": "secist", "tags": ["工具"], "text": "Wildpwn是一个Python编写的UNIX通配符攻击工具。在一些后渗透场景中，我们可以利用通配符来劫持文件所有者，执行任意命令，提升权限等。"}
{"title": "技术讨论 | 一种在隔离环境中实现隐蔽后门传输的技术 GhostTunnel", "url": "https://www.freebuf.com/sectool/184596.html", "time": "2018-10-09", "level": "", "num_look": 234779, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具", "无线安全"], "text": "今天给大家介绍一种在隔离环境中实现隐蔽后门数据传输的方法，这里需要使用到的是一款名叫GhostTunnel的工具。"}
{"title": "巨人网络诚聘安全精英", "url": "https://www.freebuf.com/jobs/185845.html", "time": "2018-10-09", "level": "", "num_look": 136201, "num_comment": 5, "author": "longhuayiyuan", "tags": ["安全招聘"], "text": "巨人网络集团有限公司成立于2004年11月18日，是一家以网络游戏为发展起点，集研发、运营、销售为一体的综合性互动娱乐企业。"}
{"title": "Android数据存储安全实践", "url": "https://www.freebuf.com/articles/terminal/185320.html", "time": "2018-10-09", "level": "红色标题", "num_look": 469118, "num_comment": 7, "author": "root001", "tags": ["终端安全"], "text": "日益繁荣的移动互联网应用也是基于用户数据和应用程序构成，如何保护这些用户数据安全性是应用发展的基石。随着人们对数据安全重视，如何更好地保护用户数据成为移动应用开发者的一大挑战。"}
{"title": "前端安全系列（一）：如何防止XSS攻击？", "url": "https://www.freebuf.com/articles/web/185654.html", "time": "2018-10-09", "level": "红色标题", "num_look": 1408499, "num_comment": 18, "author": "美团技术团队", "tags": ["WEB安全"], "text": "在移动互联网时代，前端人员除了传统的 XSS、CSRF 等安全问题之外，又时常遭遇网络劫持、非法调用 Hybrid API 等新型安全问题。"}
{"title": "BSidesTLV 2018 CTF WriteUp（附CTF环境）", "url": "https://www.freebuf.com/articles/web/185695.html", "time": "2018-10-09", "level": "", "num_look": 362962, "num_comment": 7, "author": "zusheng", "tags": ["WEB安全"], "text": "BSidesTLV 2018 CTF是2018年6月19日的一次CTF比赛，本来这个WriteUp早就想写了，但是比赛结束没环境复现，直到最近发现官方居然放出了比赛环境。"}
{"title": "使用Docker构建安全的虚拟空间", "url": "https://www.freebuf.com/news/185860.html", "time": "2018-10-09", "level": "现金奖励", "num_look": 158302, "num_comment": 3, "author": "Li4n06", "tags": [], "text": "最近上的某水课的作业是出 ctf web题目，我打算把自己的 vps 分成虚拟空间给大家用，使用 docker 来构建安全的虚拟空间，其间遇到了不少问题。"}
{"title": "极客DIY | 如何用无线键盘控制树莓派小车", "url": "https://www.freebuf.com/geek/179458.html", "time": "2018-10-09", "level": "现金奖励", "num_look": 224752, "num_comment": 2, "author": "xutiejun", "tags": ["极客"], "text": "网上有很多介绍树莓派小车的控制方案，但是搜索了一圈却发现没有无线键盘的控制方案。挑战未知，才更有趣。"}
{"title": "BUF早餐铺 | Git中的远程代码执行漏洞已被修复，多个工具受影响；美国国土安全部警告称网络安全将威胁农业产业；Facebook泄露用户信息曾被以数字货币形式在暗网出售", "url": "https://www.freebuf.com/news/186068.html", "time": "2018-10-09", "level": "", "num_look": 162527, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "朋友们，醒醒，假期结束，该上班了。"}
{"title": "使用Metasploit绕过UAC的多种方法", "url": "https://www.freebuf.com/articles/system/185311.html", "time": "2018-10-08", "level": "", "num_look": 247695, "num_comment": 1, "author": "secist", "tags": ["系统安全"], "text": "通过本文你将了解用户帐户控制（UAC）是如何保护你免受恶意软件侵害的，以及忽略UAC提示将可能给你系统带来的麻烦。"}
{"title": "CVE-2018-0952：Windows Standard Collector服务中的特权提升漏洞分析", "url": "https://www.freebuf.com/vuls/184609.html", "time": "2018-10-08", "level": "", "num_look": 183217, "num_comment": 2, "author": "Covfefe", "tags": ["漏洞", "系统安全"], "text": "如果你对寻找bug的过程不感兴趣，或者是“太长不看”那种，那么ATREDIS-2018-0004是个不错的选择，而且这里还有一个概念性证明（PoC）。"}
{"title": "挂号黄牛——贩卖希望的人", "url": "https://www.freebuf.com/articles/database/185553.html", "time": "2018-10-08", "level": "红色标题", "num_look": 410230, "num_comment": 14, "author": "GEETEST极验", "tags": ["数据安全"], "text": "如果说春节抢票黄牛是伺机敛财，那么挂号黄牛就是在我们遭遇病魔时大发灾难财。生命的希望谁不是迫切渴望呢？别说300，更多也有人趋之若鹜。若是真能挂上，还要送上一声谢谢…."}
{"title": "蓝盾股份广州佛山招聘信息安全工程师", "url": "https://www.freebuf.com/jobs/185825.html", "time": "2018-10-08", "level": "", "num_look": 131458, "num_comment": 9, "author": "Bluedon", "tags": ["安全招聘"], "text": "蓝盾股份是中国信息安全行业的领军企业，现因业务需要招聘安全人才~"}
{"title": "安全风向标 | WitAwards 2018年度热门产品及服务评选「报名进行中」", "url": "https://www.freebuf.com/fevents/183872.html", "time": "2018-10-08", "level": "", "num_look": 46550, "num_comment": 46550, "author": "FB独家", "tags": ["活动"], "text": "WitAwards 2018 新设“年度热门产品及服务”奖项，借以梳理市场现状，鼓励用心的产品和服务，也为业内需求者提供参考。"}
{"title": "类Linux环境下支持多协议的DDoS病毒分析", "url": "https://www.freebuf.com/articles/network/185740.html", "time": "2018-10-08", "level": "现金奖励", "num_look": 367749, "num_comment": 2, "author": "cgf99", "tags": ["网络安全"], "text": "近期，在蜜罐平台发现了几个可疑的URL链接，在写稿期间（9月28日）还可以正常访问。"}
{"title": "记一次安全培训中对Yii框架数据库操作层若干接口安全性分析的总结", "url": "https://www.freebuf.com/articles/web/185508.html", "time": "2018-10-08", "level": "现金奖励", "num_look": 1262655, "num_comment": 2, "author": "ForrestX386", "tags": ["WEB安全"], "text": "本人曾粗浅的分析过Yii框架中常见SQL操作方法源码实现，以此向开发同学们阐述哪些SQL方法是安全的，哪些是不安全，使其在开发中编写更安全的代码，也曾取得不错的效果。"}
{"title": "BUF早餐铺国庆特辑 | 七天黄金周，看看安全圈都发生了什么？", "url": "https://www.freebuf.com/news/186000.html", "time": "2018-10-08", "level": "", "num_look": 131021, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "一片祥和的氛围下丝毫没有影响到安全圈的风云涌动。这一期的早餐铺，就带大家回顾一下这一周里又闹出了哪些事情。"}
{"title": "【本月强推】精品公开课|空调WIFI西瓜，高危自动到家｜自炼神兵之自动化批量刷SRC", "url": "https://www.freebuf.com/fevents/185655.html", "time": "2018-10-07", "level": "红色标题", "num_look": 241937, "num_comment": 5, "author": "FB客服", "tags": ["FreeBuf公开课", "活动"], "text": "具有多年安全工具开发经验的讲师w8ay教你将渗透经验转化为工具，打造自己的神兵利器~"}
{"title": "血淋淋的事实告诉你：你为什么不应该在JS文件中保存敏感信息", "url": "https://www.freebuf.com/articles/web/185278.html", "time": "2018-10-07", "level": "", "num_look": 312213, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "在JavaScript文件中存储敏感数据，不仅是一种错误的实践方式，而且还是一种非常危险的行为，长期以来大家都知道这一点。"}
{"title": "挖洞经验 | 看我如何发现Facebook安卓APP的$8500美金Webview漏洞", "url": "https://www.freebuf.com/articles/terminal/184500.html", "time": "2018-10-07", "level": "红色标题", "num_look": 267612, "num_comment": 1, "author": "clouds", "tags": ["终端安全"], "text": "2018年6月，我在参与Facebook漏洞众测项目期间，发现了Facebook安卓APP应用中的两个Webview组件漏洞。"}
{"title": "一枚“野生”UEFI rootkit的分析报告", "url": "https://www.freebuf.com/news/185828.html", "time": "2018-10-07", "level": "", "num_look": 216397, "num_comment": 216397, "author": "Freddy", "tags": ["资讯"], "text": "UEFI rootkit该允许黑客在目标计算机上植入长期存在的恶意软件，即使用户对硬盘驱动器全盘格式化后依然不能解决问题。"}
{"title": "一种无需用户交互捕获哈希的方法", "url": "https://www.freebuf.com/articles/system/185865.html", "time": "2018-10-07", "level": "", "num_look": 179483, "num_comment": 2, "author": "secist", "tags": ["系统安全"], "text": "有一种无交互式抓取哈希值的技巧。使用.URL文件访问环境变量，用户无需任何用户交互即可连接到攻击者的文件共享。"}
{"title": "如何利用Microsoft.Workflow.Comiler.exe执行未签名的任意代码", "url": "https://www.freebuf.com/articles/system/182501.html", "time": "2018-10-06", "level": "", "num_look": 153066, "num_comment": 153066, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "Microsoft.Workflow.Comiler.exe是.NET Framework默认自带的一个工具，能够以XOML工作流文件的形式提供一个序列化工作流来执行任意未签名的代码。"}
{"title": "如何在kali Linux上创建一个用于隐藏文件的加密容器？", "url": "https://www.freebuf.com/articles/database/184683.html", "time": "2018-10-06", "level": "", "num_look": 245571, "num_comment": 2, "author": "secist", "tags": ["数据安全"], "text": "本文我将教大家在Kali Linux上创建一个简易但非常安全的，用于隐藏文件的加密容器（container ）。"}
{"title": "Ubuntu下RsaCtfTool的安装及使用", "url": "https://www.freebuf.com/sectool/185468.html", "time": "2018-10-06", "level": "", "num_look": 318323, "num_comment": 3, "author": "Cosmop01itaN", "tags": ["工具"], "text": "在CTF比赛中，往往会涉及到RSA解密类的题目，有了这个工具(基于python2.x)做起来就得心应手了。"}
{"title": "Vulnhub靶机Wakanda渗透测试攻略", "url": "https://www.freebuf.com/articles/network/185023.html", "time": "2018-10-06", "level": "", "num_look": 428086, "num_comment": 2, "author": "laffray", "tags": ["网络安全"], "text": "Wakanda是一个新的交易市场网站，很快会上线了。你的目标是通过黑客技术找到“振金”的确切位置。"}
{"title": "日益增加的移动诈骗攻击分析简报", "url": "https://www.freebuf.com/news/185254.html", "time": "2018-10-05", "level": "", "num_look": 223980, "num_comment": 223980, "author": "Alpha_h4ck", "tags": ["终端安全", "资讯"], "text": "移动设备，早就已经成为了攻击者的主要目标，目前大约58%的数字交易活动是通过移动端设备发起的，而网络攻击活动中有1/3也是针对移动端设备的。"}
{"title": "漏洞分析：OpenSSH用户枚举漏洞（CVE-2018-15473）分析", "url": "https://www.freebuf.com/vuls/184583.html", "time": "2018-10-05", "level": "", "num_look": 771952, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["漏洞", "网络安全"], "text": "在这篇文章中，我们将对CVE-2018-15473漏洞进行深入分析，并提供一些可行的缓解方案。"}
{"title": "彭博社曝光的“间谍芯片”，我在淘宝1块钱就能买一个", "url": "https://www.freebuf.com/news/185968.html", "time": "2018-10-05", "level": "红色标题", "num_look": 374596, "num_comment": 7, "author": "Karunesh91", "tags": ["企业安全", "资讯"], "text": "封面程度，疑点重重。"}
{"title": "事件分析 | 一起攻击者利用Redis未授权访问漏洞进行新型入侵挖矿事件", "url": "https://www.freebuf.com/articles/system/185678.html", "time": "2018-10-05", "level": "现金奖励", "num_look": 219689, "num_comment": 3, "author": "云鼎实验室", "tags": ["系统安全"], "text": "近日，腾讯安全云鼎实验室发现一起针对云上服务器利用 Redis 未授权访问漏洞的入侵挖矿事件。"}
{"title": "微软IIS中的IP限制企业实践", "url": "https://www.freebuf.com/news/184793.html", "time": "2018-10-05", "level": "", "num_look": 136297, "num_comment": 1, "author": "ymmy", "tags": [], "text": "企业日常实践当中，当我们开设网站需要对某些黑名单IP端里面启用白名单。"}
{"title": "看我如何利用Java Stager在内存中下载、编译和执行Java文件", "url": "https://www.freebuf.com/sectool/184356.html", "time": "2018-10-04", "level": "", "num_look": 143636, "num_comment": 143636, "author": "Alpha_h4ck", "tags": ["工具", "系统安全"], "text": "今天给大家介绍的是一款名叫Java-Stager的工具，在该工具的帮助下，我们可以轻松地在内存中下载、编译和执行Java文件（代码）。"}
{"title": "技术讨论 | 如何在Chrome中使用即时支付功能", "url": "https://www.freebuf.com/articles/web/184581.html", "time": "2018-10-04", "level": "", "num_look": 177329, "num_comment": 177329, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "我在研究Chrome支付处理API的时候，发现了下面这句话：Chrome还支持一个非标准功能，我们将其命名为’及时安装功能’（JIT）。这名字一听起来就感觉像存在bug"}
{"title": "微软漏洞CVE-2017-11885分析与利用", "url": "https://www.freebuf.com/vuls/185701.html", "time": "2018-10-04", "level": "", "num_look": 351682, "num_comment": 3, "author": "深信服千里目安全实验室", "tags": ["漏洞", "网络安全"], "text": "根据微软官网对CVE-2017-11885的描述，该漏洞几乎可以通杀微软的全版本操作系统，有关该漏洞的POC在exploit-db上于2018年5月份被披露，该POC仅仅针对windows server 2003进行了测试。"}
{"title": "卡巴斯基：2018上半年物联网威胁新趋势", "url": "https://www.freebuf.com/articles/paper/185045.html", "time": "2018-10-04", "level": "", "num_look": 170525, "num_comment": 170525, "author": "vitaminsecurity", "tags": ["安全报告"], "text": "网络犯罪分子对物联网设备的兴趣一直在增长：在 2018 上半年，我们观察到的 IoT 恶意软件样本的数量是 2017 年全年的三倍。这一趋势对于未来而言不容乐观。"}
{"title": "捉迷藏 | 追踪NSO间谍软件Pegasus在45个国家的活动情况", "url": "https://www.freebuf.com/articles/paper/185152.html", "time": "2018-10-03", "level": "", "num_look": 151076, "num_comment": 2, "author": "clouds", "tags": ["安全报告"], "text": "加拿大公民实验室通过开发新型扫描匹配技术，识别出以色列监控公司NSO的知名间谍软件Pegasus，被多个攻击组织广泛用于全球45个国家的网络入侵活动，本文为详细分析。"}
{"title": "绕过CloudFlare WAF和ModSecurity OWASP CRS3核心规则集的技巧介绍", "url": "https://www.freebuf.com/articles/web/184414.html", "time": "2018-10-03", "level": "", "num_look": 259450, "num_comment": 259450, "author": "secist", "tags": ["WEB安全"], "text": "本文将以CloudFlare WAF和ModSecurity OWASP CRS3为例，为大家进行演示如何使用未初始化的Bash变量，来绕过基于WAF正则表达式的过滤器和模式匹配。"}
{"title": "技术讨论 | 自动化Web渗透Payload提取技术", "url": "https://www.freebuf.com/articles/web/185312.html", "time": "2018-10-03", "level": "现金奖励", "num_look": 381176, "num_comment": 7, "author": "zhanghaoyil", "tags": ["WEB安全"], "text": "做Web安全已经三四年了，从最初的小白到今天的初探门路，小鲜肉已经熬成了油腻大叔。Web安全是一个日新月异的朝阳领域，每天的互联网上都在发生着从未暴露的0 Day和N Day攻击。"}
{"title": "Facebook任意JS代码执行漏洞原理与利用分析", "url": "https://www.freebuf.com/vuls/185076.html", "time": "2018-10-03", "level": "", "num_look": 195726, "num_comment": 195726, "author": "Tasfa", "tags": ["漏洞"], "text": "最近FB Android应用爆出了一个任意JS代码执行的漏洞,着手分析了一下，也挺有趣，分享学习一下,有不当之处还请包涵，欢迎讨论学习。"}
{"title": "值得关注的五大云原生技术", "url": "https://www.freebuf.com/articles/network/184836.html", "time": "2018-10-02", "level": "", "num_look": 196562, "num_comment": 196562, "author": "米雪儿", "tags": ["网络安全"], "text": "云原生（Cloud-Native）是一种文化，更是一种潮流，它是云计算的一个必然导向，是让云成为云化战略成功的基石。"}
{"title": "看专家解释攻击者如何通过苹果移动设备管理协议（MDM）攻击企业中的Mac", "url": "https://www.freebuf.com/articles/system/184319.html", "time": "2018-10-02", "level": "", "num_look": 159361, "num_comment": 159361, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "来自Fleetsmith公司（一家macOS管理公司）的CPO兼CSO-Jesse Endahl向外界演示了技术高超的攻击者如何通过DMD来入侵企业环境中的苹果Mac电脑。"}
{"title": "命令执行WAF绕过技巧总结", "url": "https://www.freebuf.com/articles/web/185158.html", "time": "2018-10-02", "level": "现金奖励", "num_look": 376110, "num_comment": 3, "author": "zusheng", "tags": ["WEB安全"], "text": "WAF并不是想象中毫无破绽，本文我们主要利用了bash的通配符、连接符、未初始化的变量三个特性来绕过WAF规则。"}
{"title": "罕见！驱动护体的挖矿病毒ProtectionX", "url": "https://www.freebuf.com/articles/terminal/185478.html", "time": "2018-10-02", "level": "", "num_look": 208833, "num_comment": 4, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "近日，深信服安全团队追踪到一新型的挖矿病毒，该病毒与普通挖矿病毒有很大差异，普通挖矿没有特殊防护，而该病毒采用了驱动进行防护，十分罕见。"}
{"title": "CrackMapExec：一款针对大型Windows活动目录(AD)的后渗透工具", "url": "https://www.freebuf.com/sectool/184573.html", "time": "2018-10-01", "level": "", "num_look": 309257, "num_comment": 309257, "author": "secist", "tags": ["工具"], "text": "CrackMapExec（CME）是一款后渗透利用工具，可帮助自动化大型活动目录(AD)网络安全评估任务。"}
{"title": "浅谈PHP安全规范", "url": "https://www.freebuf.com/articles/web/184567.html", "time": "2018-10-01", "level": "现金奖励", "num_look": 424466, "num_comment": 1, "author": "littlepotato", "tags": ["WEB安全"], "text": "这篇文章从配置文件和代码编写角度出发，总结记录php相关安全问题和对应措施。新手上路，向前辈致敬。"}
{"title": "Windows内核漏洞利用提权教程", "url": "https://www.freebuf.com/articles/system/184289.html", "time": "2018-10-01", "level": "", "num_look": 336796, "num_comment": 2, "author": "secist", "tags": ["系统安全"], "text": "通过本文的学习，你将了解Windows系统的哪些部分可被利用，并匹配最佳可利用模块进一步的提升权限。"}
{"title": "【FB TV】一周「BUF大事件」:Facebook遭遇网络攻击，5000 万用户数据泄露；青果摄像头被曝直播用户日常，涉嫌侵犯用户隐私", "url": "https://www.freebuf.com/video/185914.html", "time": "2018-10-01", "level": "红色标题", "num_look": 231755, "num_comment": 231755, "author": "willhuang", "tags": ["视频"], "text": "Facebook遭遇网络攻击，5000 万用户数据泄露；乌克兰军方系统安全问题被曝光，系统服务器为弱密码；青果摄像头被曝直播用户日常，涉嫌侵犯用户隐私。"}
{"title": "ThinkPHP 5.1.x SQL注入漏洞分析", "url": "https://www.freebuf.com/vuls/185420.html", "time": "2018-10-01", "level": "", "num_look": 418356, "num_comment": 4, "author": "alphalab", "tags": ["WEB安全", "漏洞"], "text": "ThinkPHP是一个快速、简单的基于MVC和面向对象的轻量级PHP开发框架，遵循Apache2开源协议发布。ThinkPHP从诞生以来一直秉承简洁实用的设计原则，在保持出色的性能和至简的代码的同时，也注重开发体验和易用性，为WE…"}
{"title": "ExchangeRelayX：一款功能强大的针对EWS终端的NTLM中继工具", "url": "https://www.freebuf.com/news/184594.html", "time": "2018-09-30", "level": "", "num_look": 195742, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["工具", "资讯"], "text": "今天给大家介绍的是一款名叫ExchangeRelayX的工具，这是一款NTLM中继工具，适用于EWS节点和On-Premise微软邮件交换服务器。"}
{"title": "国外安全研究者爆料中国黑客组织针对柬埔寨发起的APT攻击恶意文档", "url": "https://www.freebuf.com/articles/network/184189.html", "time": "2018-09-30", "level": "", "num_look": 279653, "num_comment": 10, "author": "clouds", "tags": ["网络安全", "观点"], "text": "法国声称中国黑客组织Goblin Panda曾针对柬埔寨和韩国发起了APT攻击。在这篇文章中披露了Goblin Panda针对柬埔寨APT攻击中所所使用的恶意文档。"}
{"title": "应急响应中分析64位恶意dll的小故事", "url": "https://www.freebuf.com/articles/system/184136.html", "time": "2018-09-30", "level": "现金奖励", "num_look": 349210, "num_comment": 13, "author": "tahf", "tags": ["系统安全"], "text": "作为一名沉迷于安全技术的小白，近期在对公司一台Win7客户主机进行安全应急响应时，捕获到一个64位dll形式的恶意程序，于是对其展开分析，收获很多。"}
{"title": "众安保险招聘安全人才", "url": "https://www.freebuf.com/jobs/185596.html", "time": "2018-09-30", "level": "", "num_look": 137644, "num_comment": 5, "author": "ladymin123", "tags": ["安全招聘"], "text": "众安在线财产保险股份有限公司（以下简称“众安”）是中国首家互联网保险公司，于2013年11月6日揭牌开业，总部位于上海，不设任何分支机构，完全通过互联网进行在线承保与理赔服务。"}
{"title": "代码自动化扫描系统的建设（下）", "url": "https://www.freebuf.com/articles/web/185148.html", "time": "2018-09-30", "level": "", "num_look": 220862, "num_comment": 5, "author": "MyKings", "tags": ["WEB安全"], "text": "上一篇文章《代码自动化扫描系统的建设(上)》 主要介绍了自动扫描系统的背景和要实现的目标，这篇里我们将会详细介绍各个层与模块的设计。"}
{"title": "智能合约自动化审计技术浅析", "url": "https://www.freebuf.com/articles/blockchain-articles/184083.html", "time": "2018-09-30", "level": "", "num_look": 173361, "num_comment": 1, "author": "猎豹区块链安全实验室", "tags": ["区块链安全"], "text": "本文根据猎豹区块链安全专家杨文玉9月5日在星球日报P.O.D大会上的分享录音整理而成，浅析当前智能合约的发展现状，以及智能合约自动化检测的一些方法。"}
{"title": "Xbash勒索挖矿样本分析", "url": "https://www.freebuf.com/articles/terminal/185106.html", "time": "2018-09-30", "level": "", "num_look": 192353, "num_comment": 4, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "Xbash拥有勒索软件和核心功能，同时它还具备自我传播的功能，主要通过攻击弱密码和未修补的漏洞进行传播。"}
{"title": "BUF早餐铺 | Facebook披露了影响5000万用户帐户的网络漏洞；中华遗嘱库用区块链技术保障遗嘱安全有效；蔚来ES8行驶中系统死机", "url": "https://www.freebuf.com/news/185852.html", "time": "2018-09-30", "level": "", "num_look": 132908, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "站好最后一班岗，提前祝大家国庆七天乐～"}
{"title": "R0Ak：一款针对Windows 10的内核模式代码读取、写入和执行的测试工具", "url": "https://www.freebuf.com/sectool/184591.html", "time": "2018-09-29", "level": "", "num_look": 240733, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["工具"], "text": "对于研究人员来说，今天介绍的工具就相当于“瑞士军刀”，因为这款名叫R0ak的命令行工具可以帮助研究人员在Windows 10操作系统上读取、写入和执行任意代码。"}
{"title": "安全事件应急响应 | Linux系统BillGates botnet component查杀", "url": "https://www.freebuf.com/articles/es/184613.html", "time": "2018-09-29", "level": "现金奖励", "num_look": 1858264, "num_comment": 11, "author": "橙子xx001", "tags": ["企业安全"], "text": "BillGates恶意软件针对运行中的linux服务器，其主要目的是感染服务器，将它们连接在一个通过中央 C & C服务器控制的僵尸网络中，指示机器人在目标上发起 DDoS 攻击。"}
{"title": "揭秘网络犯罪分子如何利用区块链隐藏自己", "url": "https://www.freebuf.com/articles/web/183993.html", "time": "2018-09-29", "level": "", "num_look": 182012, "num_comment": 182012, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "恐惧和不信任的氛围正在趋驱使网络犯罪社区采用更加先进的技术来提高自己的安全性，并努力让他们在网上所进行的非法交易处于保密状态，其中的一项技术就是区块链。"}
{"title": "科技巨头公司深陷隐私保护漩涡 | FaceBook 5000万用户信息泄露；推特忙修漏洞；谷歌面临审查", "url": "https://www.freebuf.com/news/185779.html", "time": "2018-09-29", "level": "", "num_look": 125035, "num_comment": 125035, "author": "AngelaY", "tags": ["资讯"], "text": "每发生一起数据泄露事件，就有一群用户的神经被绷断……"}
{"title": "中国大地保险招聘安全管理岗（上海）", "url": "https://www.freebuf.com/jobs/185763.html", "time": "2018-09-29", "level": "", "num_look": 109633, "num_comment": 1, "author": "FB客服", "tags": ["安全招聘"], "text": "中国大地财产保险股份有限公司于2003年10月15日在上海成立，是经国务院同意，中国保监会批准成立的全国性财产保险公司，是中国再保险 （集团）股份有限公司（股票代码：01508.HK）旗下唯一的财险直保公司。"}
{"title": "HTTP协议调试工具汇总，你心目中应该是什么样的？", "url": "https://www.freebuf.com/sectool/184366.html", "time": "2018-09-29", "level": "", "num_look": 1698698, "num_comment": 4, "author": "mazekey", "tags": ["工具"], "text": "本文收集了大量抓包工具，近40款，涵盖了各种开发语言和各类前端，请大家赏析。"}
{"title": "网页挂马常见漏洞分析与检测", "url": "https://www.freebuf.com/vuls/185104.html", "time": "2018-09-29", "level": "", "num_look": 468098, "num_comment": 2, "author": "深信服千里目安全实验室", "tags": ["WEB安全", "漏洞"], "text": "趋势科技披露了他们发现的一起浏览器漏洞攻击事件。在检测到的攻击流量中，攻击者使用了cve-2018-8373这个漏洞来攻击IE浏览器，访问存在该漏洞的页面可能导致远程代码执行。"}
{"title": "《缺陷周话》第三期：内存泄漏", "url": "https://www.freebuf.com/news/185356.html", "time": "2018-09-29", "level": "", "num_look": 134283, "num_comment": 2, "author": "奇安信代码卫士", "tags": [], "text": "代码审计是使用静态分析发现源代码中安全缺陷的方法，能够辅助开发或测试人员在软件上线前较为全面地了解其安全问题。"}
{"title": "Android进程保护研究分析报告", "url": "https://www.freebuf.com/articles/paper/185466.html", "time": "2018-09-29", "level": "", "num_look": 181402, "num_comment": 181402, "author": "腾讯手机管家", "tags": ["安全报告"], "text": "恶意开发者会利用 Android 的进程保护机制滋生很多流氓应用，破坏系统文件，资费受损，隐私泄露，推送恶意广告，导致设备资源浪费，破坏系统生态平衡。"}
{"title": "BUF早餐铺 | 盘古团队攻破iOS 12越狱成功；首个被利用的UEFI rootkit案例曝光；美国圣地亚哥港遭黑客勒索比特币", "url": "https://www.freebuf.com/news/185671.html", "time": "2018-09-29", "level": "", "num_look": 186011, "num_comment": 4, "author": "Akane", "tags": ["资讯"], "text": "最新款iPhone XS的iOS 12越狱成功，中国黑客团队盘古回来了！"}
{"title": "WINSpect：基于Powershell的Windows安全审计工具", "url": "https://www.freebuf.com/sectool/184600.html", "time": "2018-09-28", "level": "", "num_look": 233363, "num_comment": 7, "author": "secist", "tags": ["工具"], "text": "WINSpect是一款基于Powershell的Windows安全审计工具，可用于枚举和识别Windows平台的安全漏洞，以进一步的优化和加固平台的安全防护策略。"}
{"title": "用户名“admin”、密码“123456”，乌克兰军方系统安全问题被曝光", "url": "https://www.freebuf.com/news/185614.html", "time": "2018-09-28", "level": "红色标题", "num_look": 290665, "num_comment": 6, "author": "shidongqi", "tags": ["资讯"], "text": "“123456、admin”在2017年弱密码TOP 100中，分别位列第一位和第十一位。大多数账户系统在注册时基本禁止使用这种“网红弱密码”，你很难想象这竟然会成为一个国家军方系统的用户名和密码。"}
{"title": "挖洞经验 | 看我如何发现雅虎邮箱APP的存储型XSS漏洞", "url": "https://www.freebuf.com/articles/terminal/184041.html", "time": "2018-09-28", "level": "", "num_look": 212749, "num_comment": 2, "author": "clouds", "tags": ["终端安全"], "text": "今天要分享的是参与雅虎（Yahoo!）漏洞众测项目发现的一个关于雅虎邮箱 iOS应用的漏洞，最终，凭借该漏洞，我进入了雅虎安全名人堂并获得了$3500美金奖励。"}
{"title": "VIPKID安全部招人啦，诚邀你的加入！", "url": "https://www.freebuf.com/jobs/185565.html", "time": "2018-09-28", "level": "", "num_look": 123941, "num_comment": 4, "author": "VIPKID安全团队", "tags": ["安全招聘"], "text": "这里是“爱孩子，懂教育”的VIPKID，是成长迅速、频频获得顶级资本青睐的VIPKID，更是重视信息安全、对用户和合作伙伴负责的VIPKID。"}
{"title": "新Njrat木马（Bladabindi）的新功能源码分析", "url": "https://www.freebuf.com/articles/terminal/184930.html", "time": "2018-09-28", "level": "现金奖励", "num_look": 228094, "num_comment": 3, "author": "si1ence", "tags": ["终端安全"], "text": "Njrat，又称Bladabindi，使用.NET框架编写，是典型的RAT类程序，通过控制端可以操作受控端的各项内容。"}
{"title": "“绿斑”行动——持续多年的攻击", "url": "https://www.freebuf.com/vuls/185139.html", "time": "2018-09-28", "level": "红色标题", "num_look": 337080, "num_comment": 5, "author": "antiylab", "tags": ["漏洞", "网络安全"], "text": "本报告分析了“绿斑”组织在2015年前的攻击活动，其攻击以互联网暴露目标和资产为攻击入口，采用社工邮件结合漏洞进行攻击，其活跃周期可能长达十年以上。"}
{"title": "BUF早餐铺 | Linux内核漏洞可为攻击者提供Root访问权限；非官方渠道下载的软件潜藏恶意挖矿代码；Google Play商店发现木马应用，窃取客户欧元", "url": "https://www.freebuf.com/news/185581.html", "time": "2018-09-28", "level": "", "num_look": 125575, "num_comment": 125575, "author": "Freddy", "tags": ["资讯"], "text": "所有版本的Red Hat Enterprise Linux和CentOS都容易受到该整数溢出漏洞（CVE-2018-14634）的影响。它为攻击者提供了一种获取系统完整root访问权限的方法。"}
{"title": "2018上半年仿冒公检法趋势研究报告", "url": "https://www.freebuf.com/articles/paper/185346.html", "time": "2018-09-28", "level": "", "num_look": 144032, "num_comment": 4, "author": "腾讯手机管家", "tags": ["安全报告"], "text": "名义上是保险公司，实际上是诈骗电话。仿冒公检法诈骗仍旧热门。"}
{"title": "SMBetray：一款SMB中间人攻击工具分享", "url": "https://www.freebuf.com/sectool/184595.html", "time": "2018-09-27", "level": "", "num_look": 259339, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫SMBetray的工具，这是一款SMB中间人攻击工具，该工具可以通过文件内容交换、lnk交换和明文数据入侵来对目标客户端实施攻击。"}
{"title": "一种绕过UAC的技术介绍", "url": "https://www.freebuf.com/articles/system/184140.html", "time": "2018-09-27", "level": "", "num_look": 244357, "num_comment": 7, "author": "secist", "tags": ["系统安全"], "text": "最近，我发现了一种非常有趣的可用来绕过UAC，并以High Mandatory Level启动进程的方法。下面，让我来重现这个过程。"}
{"title": "一个人的安全部之大话企业数据安全保护", "url": "https://www.freebuf.com/articles/database/185288.html", "time": "2018-09-27", "level": "现金奖励", "num_look": 1185768, "num_comment": 61, "author": "liong03", "tags": ["企业安全", "安全管理"], "text": "近期看到一些朋友问数据安全保护怎么弄，刚好为某企业简单规划过，很多前辈大佬都有介绍过数据安全，突然想用一种不一样的姿势来分享，通过一些文字条框再结合一些故事案例来思考。"}
{"title": "毒云藤（APT-C-01）军政情报刺探者揭露", "url": "https://www.freebuf.com/articles/system/185155.html", "time": "2018-09-27", "level": "红色标题", "num_look": 369184, "num_comment": 20, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "从2007年开始至今，360追日团队发现毒云藤组织对中国国防、政府、科技、教育以及海事机构等重点单位和部门进行了长达11年的网络间谍活动。"}
{"title": "安全难寻一隅之地，飞上天照样能黑你", "url": "https://www.freebuf.com/news/185132.html", "time": "2018-09-27", "level": "", "num_look": 170655, "num_comment": 1, "author": "Karunesh91", "tags": ["数据安全", "网络安全"], "text": "玩游戏有VR了，购物不用现金了，汽车可以充电了，出门在外只要有手机就什么都不用带了。但是你的资料真是自己在用吗？"}
{"title": "blockwell.ai KYC Casper Token “牛皮癣广告” 事件分析", "url": "https://www.freebuf.com/articles/blockchain-articles/184975.html", "time": "2018-09-27", "level": "红色标题", "num_look": 213641, "num_comment": 2, "author": "Knownsec知道创宇", "tags": ["区块链安全"], "text": "2018年9月7日早上1点左右，许多以太坊钱包账户都收到了一种名为blockwell.ai KYC Casper Token代币转进/出账消息……"}
{"title": "BUF早餐铺 | 比特币核心团队修复钱包严重漏洞；80多款思科产品受漏洞影响；谷歌承认在隐私问题上犯过错；青果摄像头直播用户日常，或侵犯隐私", "url": "https://www.freebuf.com/news/185503.html", "time": "2018-09-27", "level": "", "num_look": 139272, "num_comment": 5, "author": "AngelaY", "tags": ["资讯"], "text": "Mozilla 发布新的数据泄露通知服务 Firefox Monitor；SHEIN 数据泄露影响 642 万用户"}
{"title": "【报名即可学习 | 精品公开课】信息安全入门必修课 | 美女讲师教你从零开始密码学", "url": "https://www.freebuf.com/fevents/184956.html", "time": "2018-09-27", "level": "红色标题", "num_look": 241131, "num_comment": 11, "author": "FB客服", "tags": ["FreeBuf公开课", "活动"], "text": "特邀信息安全美女讲师EVA深入浅出讲解密码学与密码破译工具~"}
{"title": "革故 · 鼎新丨WitAwards 2018年度技术变革评选「报名进行中」", "url": "https://www.freebuf.com/news/185052.html", "time": "2018-09-26", "level": "", "num_look": 112152, "num_comment": 112152, "author": "FB独家", "tags": ["资讯"], "text": "安全行业总与技术创新息息相关，在这个IT技术大发展大变革的时代，安全行业又将迎来一场怎样的“革命”？"}
{"title": "【火热报名中】“神经中枢”安全态势感知的实践 | FreeBuf企业精品公开课 × IBM", "url": "https://www.freebuf.com/open/184619.html", "time": "2018-09-26", "level": "", "num_look": 154327, "num_comment": 1, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "在互联网安全的世界中，为了领先于威胁，企业需要能够‘感知’到恶意行为，就像人能够通过看，听，闻，触觉来感知到危险一样。"}
{"title": "Beebug：一款用于检查bug可利用性的工具", "url": "https://www.freebuf.com/sectool/184137.html", "time": "2018-09-26", "level": "", "num_look": 181168, "num_comment": 181168, "author": "secist", "tags": ["工具"], "text": "beebug是一款用于检查bug可利用性的工具。"}
{"title": "美国投票系统早已千疮百孔，十分钟内竟被11岁少年攻破", "url": "https://www.freebuf.com/articles/neopoints/184108.html", "time": "2018-09-26", "level": "", "num_look": 203913, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["观点"], "text": "如果美国想要保证投票系统的安全性，那么对于他们来说，直接拿纸和笔记录投票数肯定是最安全的了…"}
{"title": "跨越速运集团招聘信息安全工程师", "url": "https://www.freebuf.com/jobs/184002.html", "time": "2018-09-26", "level": "", "num_look": 229504, "num_comment": 34, "author": "kye-hr", "tags": ["安全招聘"], "text": "跨越速运集团有限公司成立于2007年8月13日，是一家主营“国内限时”快递的大型现代化综合物流企业,也是国家4A物流企业。"}
{"title": "ZooPark：Android逆向之静态分析", "url": "https://www.freebuf.com/articles/system/184286.html", "time": "2018-09-26", "level": "现金奖励", "num_look": 179565, "num_comment": 179565, "author": "xiongchaochao", "tags": ["系统安全"], "text": "ZooPark是一个针对中东的APT组织，截至2017年，已经发展到了4.0版本，本次分析的版本主要是V1-V3。"}
{"title": "医疗行业安全指数报告（2018年8月）", "url": "https://www.freebuf.com/articles/es/185085.html", "time": "2018-09-26", "level": "", "num_look": 240491, "num_comment": 2, "author": "腾讯电脑管家", "tags": ["企业安全"], "text": "近年来，针对医院的勒索、挖矿、医疗信息泄露等医疗行业的信息安全事件层出不穷，医院信息系统已经成为了不法黑客的重点攻击对象之一。"}
{"title": "中秋国庆的火车票，你抢到了吗？揭露黄牛背后那些事", "url": "https://www.freebuf.com/articles/database/185337.html", "time": "2018-09-26", "level": "红色标题", "num_look": 325239, "num_comment": 12, "author": "GEETEST极验", "tags": ["数据安全"], "text": "国庆小长假马上来了，你还在为买不到票而烦恼？回想每年一度的春运，身在外地的同胞们也是有苦说不出，黄牛党、抢票软件到底是如何抢票的，你了解吗？"}
{"title": "BUF早餐铺 | 价值8.54亿美元的加密货币被盗；腾讯安全工程师利用酒店WiFi漏洞访问内部服务器被罚5000美元；浙江超70%网民个人信息被泄漏", "url": "https://www.freebuf.com/news/185414.html", "time": "2018-09-26", "level": "", "num_look": 144836, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "联合国意外泄露密码和敏感信息；研究人员发现 0-day 漏洞影响所有版本的 Windows；苹果 MacOS Mojave 0-day 漏洞可以绕过隐私认证访问用户的联系人。"}
{"title": "Polymorph：支持几乎所有现有协议的实时网络数据包操作框架", "url": "https://www.freebuf.com/sectool/183897.html", "time": "2018-09-25", "level": "", "num_look": 239837, "num_comment": 16, "author": "Covfefe", "tags": ["工具"], "text": "Polymorph是一个用Python3编写的框架，其允许实时修改网络数据包，为用户提供对数据包内容的最大化控制。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列-Tom Hudson", "url": "https://www.freebuf.com/video/185394.html", "time": "2018-09-25", "level": "红色标题", "num_look": 159265, "num_comment": 1, "author": "willhuang", "tags": ["视频"], "text": "Tom Hudson，自2011年就任职天空博彩公司，业余爱好是参与漏洞众测，目前以239个有效漏洞和8717分的声望值排名HackerOne第30名。"}
{"title": "多种使用SMB端口远程连接PC的方法介绍", "url": "https://www.freebuf.com/articles/system/183670.html", "time": "2018-09-25", "level": "", "num_look": 401651, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "当你收集到了目标PC的用户名和密码之后，如何通过SMB端口445来与目标用户的设备建立连接呢？在这篇文章中，我们将帮助大家解开这个疑惑。"}
{"title": "系统出现重大漏洞，Windows用户要小心了", "url": "https://www.freebuf.com/news/184511.html", "time": "2018-09-25", "level": "", "num_look": 289803, "num_comment": 2, "author": "Karunesh91", "tags": ["终端安全", "资讯"], "text": "少年，冷启动攻击，侬晓得伐？"}
{"title": "谷歌承认允许第三方开发者收集Gmail数据，隐私混战中谁能独善其身？", "url": "https://www.freebuf.com/news/185216.html", "time": "2018-09-25", "level": "", "num_look": 282938, "num_comment": 2, "author": "AngelaY", "tags": ["观点", "资讯"], "text": "谷歌在给美国参议院的回信中承认允许第三方应用开发者扫描并收集 Gmail 数据，还将面临美国商务委员会的听证会审查。"}
{"title": "伪造电子邮件以及制造电子邮件炸弹的攻防探讨", "url": "https://www.freebuf.com/sectool/184555.html", "time": "2018-09-25", "level": "现金奖励", "num_look": 552410, "num_comment": 9, "author": "Macr0phag3", "tags": ["工具", "网络安全"], "text": "想必熟悉 kali 或者接触过 smtp 相关分析的人都听说过 Swaks 这个工具，我用 Python 自己写了一个类似的工具，加上了邮件炸弹的功能，顺带分析一波原理。"}
{"title": "BUF早餐铺 | 我国掌握超晶格密码新技术；联想回答有关后门的提问；黎曼猜想或被证明，互联网加密算法面临挑战", "url": "https://www.freebuf.com/news/185245.html", "time": "2018-09-25", "level": "", "num_look": 140655, "num_comment": 3, "author": "Karunesh91", "tags": ["资讯"], "text": "中秋节刚过，来一波早餐找找工作的感觉吧~"}
{"title": "LAME：通过SSL加密通信进行横向渗透的新技术", "url": "https://www.freebuf.com/articles/system/183666.html", "time": "2018-09-24", "level": "", "num_look": 170369, "num_comment": 1, "author": "secist", "tags": ["系统安全"], "text": "本文主要讨论一项用于红队的被称之为“LAME”的新横向渗透技术及其缓解措施。"}
{"title": "Windows任务计划程序被曝存在0 day漏洞", "url": "https://www.freebuf.com/news/183952.html", "time": "2018-09-24", "level": "", "num_look": 208336, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "研究人员在Windows任务计划程序的一个API中发现了安全漏洞，这个漏洞是由于API函数没有对请求权限进行检验所导致的，而该漏洞将允许任何一名本地攻击者实现提权。"}
{"title": "技术讨论 | 如何对经前端加密后的数据进行爆破", "url": "https://www.freebuf.com/articles/web/184455.html", "time": "2018-09-24", "level": "现金奖励", "num_look": 240210, "num_comment": 3, "author": "为了逆袭", "tags": ["WEB安全"], "text": "最近遇到两个个案例，经过一番倒腾，发现其登录功能均可撞库。但是都存在登录数据本地加密，有空了放一起总结记录一下。"}
{"title": "还记得BlueBorne吗？一年过去了，仍有20亿蓝牙设备的漏洞没有修复", "url": "https://www.freebuf.com/news/184470.html", "time": "2018-09-24", "level": "", "num_look": 143333, "num_comment": 5, "author": "Freddy", "tags": ["资讯"], "text": "Armis估算BlueBorne蓝牙漏洞披露一后年后，仍有超过20亿的设备仍然暴露在风险之中，它们没有进行更新，或者压根就接收不到更新补丁。"}
{"title": "当心跳能被他人控制，我们拿什么来谈医疗安全？", "url": "https://www.freebuf.com/articles/neopoints/184794.html", "time": "2018-09-24", "level": "", "num_look": 170563, "num_comment": 3, "author": "AngelaY", "tags": ["观点"], "text": "每一次医疗系统的漏洞都意味着大量患者信息泄露以及部分不幸患者面临的生命威胁。"}
{"title": "厉害了！Python竟然可以做智能家居温湿度报警系统", "url": "https://www.freebuf.com/geek/183560.html", "time": "2018-09-24", "level": "现金奖励", "num_look": 235050, "num_comment": 7, "author": "小柠檬Emm", "tags": ["极客"], "text": "下面带大家用Python通过HTTP协议做一个廉价的温湿度报警系统。"}
{"title": "一起枪击案引发的代码规范之谈", "url": "https://www.freebuf.com/news/185296.html", "time": "2018-09-23", "level": "红色标题", "num_look": 173754, "num_comment": 2, "author": "AdlerI", "tags": ["资讯"], "text": "代码不规范不一定会引起枪击，但肯定会造成很多问题，甚至带来一些安全漏洞。"}
{"title": "Invoke-TheHash：PowerShell实现的哈希传递攻击套件", "url": "https://www.freebuf.com/sectool/183634.html", "time": "2018-09-23", "level": "", "num_look": 170027, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "Invoke-TheHash项目是一个基于.Net TCPClient，通过把NTLM hash传递给NTLMv2身份验证协议来进行身份验证的攻击套件，且执行时客户端不需要本地管理员权限。"}
{"title": "孩子存在学校的个人信息真的安全吗？", "url": "https://www.freebuf.com/articles/network/183693.html", "time": "2018-09-23", "level": "", "num_look": 169273, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "很多家长考虑的都是孩子的考试成绩以及他们在学校的表现，而大多数学生考虑的都是家庭作业和考试怎么样能完成得更好，但有多少家长想过信息安全问题？"}
{"title": "从工具的代码角度学安全：Sublist3r子域名枚举神器源码阅读", "url": "https://www.freebuf.com/sectool/183959.html", "time": "2018-09-23", "level": "现金奖励", "num_look": 208884, "num_comment": 2, "author": "mscb", "tags": ["工具"], "text": "Sublist3r是一款简单易用的子域名枚举利器。但是今天我不打算讲解它的使用教程，而是深入一层，从它的代码中窥探原理。"}
{"title": "15行CSS&HTML代码就能让iPhone重启和Mac假死", "url": "https://www.freebuf.com/news/184663.html", "time": "2018-09-23", "level": "", "num_look": 182122, "num_comment": 2, "author": "Freddy", "tags": ["资讯"], "text": "来自Wire团队的的安全研究员Sabri Haddouche设计了一种全新的CSS攻击方式，可导致iPhone重启或Mac假死。"}
{"title": "又想骗我搞安全？它说信息安全专业工资、竞争力都是No.1", "url": "https://www.freebuf.com/news/185255.html", "time": "2018-09-22", "level": "红色标题", "num_look": 390898, "num_comment": 11, "author": "shidongqi", "tags": ["资讯"], "text": "哪\r\n个行业最赚钱？哪个行业最有前景？这确实是一个决定我未来租房还是买房、开BBA还是开五菱神车的大事……"}
{"title": "技术讨论 | Meterpreter在Windows 445端口实施远程NTLM中继攻击测试", "url": "https://www.freebuf.com/articles/system/183700.html", "time": "2018-09-22", "level": "", "num_look": 217492, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "劫持445端口来执行中继攻击或Hash-Capturing攻击已经是一种经常会出现的攻击方式了，当你使用meterpreter感染目标设备时，你如何监听445端口呢？"}
{"title": "HackerOne漏洞案例 | 子域名劫持漏洞的挖掘指南", "url": "https://www.freebuf.com/articles/web/183254.html", "time": "2018-09-22", "level": "", "num_look": 295500, "num_comment": 1, "author": "clouds", "tags": ["WEB安全"], "text": "在HackerOne实时更新的公开漏洞推送Hacktivity消息中，我们可以发现，其中的子域名劫持漏洞（Subdomain Takeover）占比不少。"}
{"title": "【FB TV】一周「BUF大事件」：2018年网络安全宣传周；上海警方通报，华住集团信息泄露嫌疑人被抓获；新蛋网用户信用卡数据泄漏", "url": "https://www.freebuf.com/video/185200.html", "time": "2018-09-22", "level": "红色标题", "num_look": 221810, "num_comment": 221810, "author": "willhuang", "tags": ["视频"], "text": "2018年网络安全宣传周在全国范围内举行，网络安全为人民，网络安全靠人民；上海警方通报，华住集团信息泄露嫌疑人被抓获；新蛋网用户信用卡数据泄漏。"}
{"title": "Moloch: 网络流量收集与分析", "url": "https://www.freebuf.com/sectool/183984.html", "time": "2018-09-22", "level": "现金奖励", "num_look": 316965, "num_comment": 1, "author": "Shell.", "tags": ["工具"], "text": "本篇文章主要介绍Moloch溯源平台的部署以及配合Suricata实现对网络流量的监控与检测, 提取IOC的网络行为。"}
{"title": "竟态攻击：Hyper-V安全问题分析", "url": "https://www.freebuf.com/articles/system/183133.html", "time": "2018-09-22", "level": "现金奖励", "num_look": 164402, "num_comment": 2, "author": "Murkfox", "tags": ["系统安全"], "text": "今年的Blackhat大会中有议题对Hyper-V的安全问题展开了讨论，本文将对其从安全角度上进行深度的分析。"}
{"title": "快讯 | 超1000万条快递信息被非法窃取，各大高校为重灾区", "url": "https://www.freebuf.com/news/185180.html", "time": "2018-09-21", "level": "红色标题", "num_look": 169693, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "快递的隐私问题一直是制约这个行业健康发展的主要障碍之一，即便可以抵御黑客攻击、采用加密面单，却怎料是“家贼难防”……"}
{"title": "加密货币诈骗取代勒索软件成为攻击者的最爱", "url": "https://www.freebuf.com/news/183695.html", "time": "2018-09-21", "level": "", "num_look": 117204, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "2018年，网络安全领域最抢眼的莫过于加密货币劫持挖矿软件和无文件型恶意软件，这两类恶意软件的数量在2018年增长得非常快。"}
{"title": "代码自动化扫描系统的建设（上）", "url": "https://www.freebuf.com/sectool/182779.html", "time": "2018-09-21", "level": "红色标题", "num_look": 261271, "num_comment": 3, "author": "MyKings", "tags": ["WEB安全", "工具"], "text": "代码审计一直是企业白盒测试的重要一环，面对市场上众多商业与开源的审计工具，你是否想过集众家之所长来搭建一套自动化的扫描系统呢？"}
{"title": "《缺陷周话》第二期：SQL注入", "url": "https://www.freebuf.com/news/184732.html", "time": "2018-09-21", "level": "", "num_look": 180002, "num_comment": 180002, "author": "奇安信代码卫士", "tags": ["网络安全", "资讯"], "text": "代码审计是使用静态分析发现源代码中安全缺陷的方法，能够辅助开发或测试人员在软件上线前较为全面地了解其安全问题，防患于未然"}
{"title": "基于Python实现的Koadic恶意软件分析Part 1", "url": "https://www.freebuf.com/articles/network/182868.html", "time": "2018-09-21", "level": "", "num_look": 149921, "num_comment": 2, "author": "周大涛", "tags": ["网络安全"], "text": "我在一次偶然的机会中了解了Koadic这款工具，于是我决定制作一个“javascript rundll32 exploit”的关键字组合，看看会出现什么。"}
{"title": "2018撞库攻击现状：不到一年出现数百亿登录尝试；金融行业首当其冲", "url": "https://www.freebuf.com/news/185110.html", "time": "2018-09-21", "level": "", "num_look": 176474, "num_comment": 176474, "author": "AngelaY", "tags": ["网络安全", "资讯"], "text": "报告显示从 2017 年 11 月到 2018 年 6 月短短不到一年的时间内，就出现了超过 300 亿次的恶意登录尝试。"}
{"title": "互联网安全现状：企业对安全仍不够重视", "url": "https://www.freebuf.com/news/184274.html", "time": "2018-09-21", "level": "", "num_look": 182803, "num_comment": 3, "author": "Karunesh91", "tags": ["企业安全", "资讯"], "text": "企业安全没有捷径"}
{"title": "BUF早餐铺 | 新蛋网用户信用卡数据泄漏；西数NAS出现严重安全漏洞，攻击者可获得完整访问权限；超过3000个网站的访问权限在俄罗斯黑市上出售", "url": "https://www.freebuf.com/news/185033.html", "time": "2018-09-21", "level": "", "num_look": 111210, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "今天的早餐铺有：新蛋网用户信用卡数据泄漏，恶意代码存在约1个月；西数NAS出现严重安全漏洞，攻击者可获得完整访问权限；超过3000个网站的访问权限在俄罗斯黑市上出售等内容。"}
{"title": "服务器遭黑客潜伏一个多月，这家公司原本打算赴美上市的", "url": "https://www.freebuf.com/news/185058.html", "time": "2018-09-20", "level": "红色标题", "num_look": 225086, "num_comment": 5, "author": "shidongqi", "tags": ["资讯"], "text": "上市前遭遇大负面，想必这是所有公司最不想看到的。而一周前放出消息准备赴美上市的新蛋网，却被曝出服务器被注入恶意代码已经长达一个月，很可能已经影响数百万付费用户的信用卡信息。"}
{"title": "技术讨论 | Apostille：让假证书以假乱真的证书伪造工具", "url": "https://www.freebuf.com/sectool/183701.html", "time": "2018-09-20", "level": "", "num_look": 242968, "num_comment": 242968, "author": "secist", "tags": ["工具"], "text": "Apostille是一款证书窃取（克隆/伪造）工具，本文介绍了其具体的技术。"}
{"title": "Scarab勒索病毒最新变种，希特勒“冠名”", "url": "https://www.freebuf.com/articles/terminal/184525.html", "time": "2018-09-20", "level": "", "num_look": 171381, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "深信服EDR安全团队跟踪了Scarab勒索病毒的最新变种，该变种文件加密后缀为.hitler，有趣的是，希特勒对应的英文就是hitler，算是莫名躺枪了。"}
{"title": "快讯 | 华住集团信息泄露嫌疑人被抓获，数据交易未成功", "url": "https://www.freebuf.com/news/185011.html", "time": "2018-09-20", "level": "红色标题", "num_look": 560464, "num_comment": 7, "author": "Allen别bb", "tags": ["资讯"], "text": "经查，犯罪嫌疑人利用黑客手段窃取华住集团旗下酒店数据并在境外网站兜售,但未交易成功。目前，案件还在进一步查证中。"}
{"title": "Webshell入侵检测初探（一）", "url": "https://www.freebuf.com/articles/web/183520.html", "time": "2018-09-20", "level": "", "num_look": 1024801, "num_comment": 2, "author": "罹♛殇", "tags": ["WEB安全"], "text": "攻击者在入侵企业网站时，通常要通过各种方式获取webshell从而获得企业网站的控制权，然后方便进行之后的入侵行为。"}
{"title": "致锤子：情怀怕是弥补不了安全", "url": "https://www.freebuf.com/articles/neopoints/184440.html", "time": "2018-09-20", "level": "红色标题", "num_look": 709327, "num_comment": 10, "author": "shidongqi", "tags": ["观点"], "text": "有时候想想，或许只有老罗这样个性鲜明的人才能给手机行业带来一些刺激，让原本那么另类、那么不起眼的锤子手机获得超高的关注度，其中也包括国内外的黑客团队。"}
{"title": "运维安全 | 如何限制指定账户不能SSH只能SFTP在指定目录", "url": "https://www.freebuf.com/articles/system/183983.html", "time": "2018-09-20", "level": "现金奖励", "num_look": 218273, "num_comment": 2, "author": "ForrestX386", "tags": ["系统安全", "网络安全"], "text": "我司线上搞了一台文件中转服务器，用于sftp上传下载一些文件（包括测试日志之类），可以限制特定组内的用户只能sftp 连接上去至指定目录，ssh 连接就提示只接受sftp 连接。"}
{"title": "技术讨论 | Windows全版本提权之Win10系列解析", "url": "https://www.freebuf.com/vuls/184090.html", "time": "2018-09-20", "level": "现金奖励", "num_look": 448878, "num_comment": 20, "author": "alphalab", "tags": ["漏洞", "系统安全"], "text": "本文将以Windows 10 X64系统平台为基础，详细介绍Win 10 某个提权漏洞及其利用方法，同时附带利用该漏洞实现的提权工具及源码，仅用于技术探讨。"}
{"title": "BUF早餐铺 | MongoDB数据库泄露1100万份邮件记录；Facebook为提交第三方应用或网站漏洞的用户发放奖金；央行将进一步探索构建行业共享的金融网络安全防护平台", "url": "https://www.freebuf.com/news/184998.html", "time": "2018-09-20", "level": "", "num_look": 138681, "num_comment": 138681, "author": "AngelaY", "tags": ["资讯"], "text": "Pegasus 间谍软件已经渗透到 45 个国家和地区；2018 年第二季度针对web网站的攻击数量有所上升；GovPayNet凭证系统存在漏洞，1400万交易记录被曝光"}
{"title": "品质×成就×创新丨WitAwards 2018年度品牌影响力评选「报名进行中」", "url": "https://www.freebuf.com/news/183742.html", "time": "2018-09-19", "level": "红色标题", "num_look": 115552, "num_comment": 115552, "author": "FB独家", "tags": ["资讯"], "text": "信息技术的飞速发展带来网络安全风险和挑战不断增大，如何围绕安全产品与服务，将品牌核心价值深入传达至用户观念中，成为赢得挑战的重要因素。"}
{"title": "鼻子解锁手机、充电宝窃取数据，这是一堂生动的网络安全课", "url": "https://www.freebuf.com/fevents/184957.html", "time": "2018-09-19", "level": "", "num_look": 135779, "num_comment": 2, "author": "shidongqi", "tags": ["活动"], "text": "大学本身是一种浓缩型的社会形态，好处在于大学生活有很高的容错率，可能还会有重新再来的机会。但对于现如今的学生来说，有一个无形的世界是没有办法提前实习的——网络安全。"}
{"title": "曝光！NSA曾成功入侵渗透某些“高价值”目标机构加密VPN网络", "url": "https://www.freebuf.com/articles/network/184928.html", "time": "2018-09-19", "level": "红色标题", "num_look": 233174, "num_comment": 5, "author": "clouds", "tags": ["网络安全"], "text": "近期，TheIntercept披露了一份记载于2006年的NSA机密级文档，据文档反映信息可知，NSA此前曾成功渗透入侵了一系列“高价值”目标的加密虚拟专用网络。"}
{"title": "一款伪装成Windows激活工具的在野恶意软件分析", "url": "https://www.freebuf.com/articles/system/183697.html", "time": "2018-09-19", "level": "", "num_look": 164594, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "近期，研究人员发现了一款通过外部网络设备传播的新型勒索软件，这一勒索软件活动从8月7号开始一直持续到现在，并且一直伪装成Windows激活工具来进行恶意活动。"}
{"title": "我下载了20几款App，发现了这些坑", "url": "https://www.freebuf.com/news/184218.html", "time": "2018-09-19", "level": "红色标题", "num_look": 298911, "num_comment": 10, "author": "GEETEST极验", "tags": ["资讯"], "text": "在苹果商店里面，我们可以看到玲琅满目的社交软件，其中打着同城交友、激情社交旗号的软件异常火爆。今天，妮美就帮广大的单身朋友们去鉴定一下这些交友app。"}
{"title": "爆破Tomcat服务器，GandCrab 4.3勒索病毒成功入侵企业内网", "url": "https://www.freebuf.com/articles/es/184424.html", "time": "2018-09-19", "level": "", "num_look": 272729, "num_comment": 3, "author": "腾讯电脑管家", "tags": ["企业安全"], "text": "近日，腾讯御见威胁情报中心拦截到专攻企业局域网的勒索病毒GandCrab，这个臭名昭著的勒索病毒版本号已升级到4.3。"}
{"title": "使用PoolTag识别主机指纹", "url": "https://www.freebuf.com/articles/terminal/182286.html", "time": "2018-09-19", "level": "", "num_look": 154137, "num_comment": 2, "author": "周大涛", "tags": ["终端安全"], "text": "恶意软件会对它所在的主机进行指纹识别，以便发现更多的信息。在本文中，我们将介绍一种被恶意软件滥用的主机进行指纹识别的方法。"}
{"title": "OPPO互联网安全团队招聘", "url": "https://www.freebuf.com/jobs/183941.html", "time": "2018-09-19", "level": "", "num_look": 158732, "num_comment": 12, "author": "px1005", "tags": ["安全招聘"], "text": "OPPO是广东欧珀移动通信有限公司旗下品牌，成立于2004年，是一家全球性的智能终端和移动互联网公司。"}
{"title": "Gartner 2018 年WAF魔力象限报告：云WAF持续增长，Bot管理与API安全拥有未来", "url": "https://www.freebuf.com/articles/paper/184903.html", "time": "2018-09-19", "level": "", "num_look": 727009, "num_comment": 4, "author": "AngelaY", "tags": ["安全报告"], "text": "报告中照例描述了全球 WAF 市场整体状况，并对主要 WAF 厂商进行了详细的优缺点分析。今年 Gartner 的评判标准有所提高，并对未来 WAF 市场的趋势做出了新的预测。"}
{"title": "技术讨论 | 利用SET和Ettercap实现内网钓鱼获取帐号密码", "url": "https://www.freebuf.com/articles/network/183692.html", "time": "2018-09-19", "level": "现金奖励", "num_look": 212599, "num_comment": 3, "author": "kenmick", "tags": ["网络安全"], "text": "本文主要是面向刚刚接触Web安全的新手，通过实验展示了，如何通过SET和Ettercap实现内网钓鱼窃取帐号密码。"}
{"title": "GraphQL安全指北", "url": "https://www.freebuf.com/articles/web/184040.html", "time": "2018-09-19", "level": "", "num_look": 250692, "num_comment": 1, "author": "TASS008", "tags": ["WEB安全"], "text": "最近学习并尝试了GraphQL这个还没完全火起来但又有很多大厂使用的Web API技术，和好基友一起做了一些简单的讨论。"}
{"title": "BUF早餐铺 | 浙江三大运营商签署《个人信息保护倡议书》；谷歌团队在霍尼韦尔安卓设备中发现高危漏洞；黑客利用Xbash恶意软件进行挖矿、勒索", "url": "https://www.freebuf.com/news/184858.html", "time": "2018-09-19", "level": "", "num_look": 110523, "num_comment": 110523, "author": "shidongqi", "tags": ["资讯"], "text": "《个人信息保护倡议书》指出：“公开透明处理用户信息、保障用户信息控制权益、强化企业自我约束、建立用户信息安全屏障、开展最佳落地实践、接受社会监督”六项倡议。"}
{"title": "iOS 12完美越狱来了！漫谈iOS 12缓解机制", "url": "https://www.freebuf.com/articles/terminal/184877.html", "time": "2018-09-18", "level": "", "num_look": 1213108, "num_comment": 13, "author": "阿里安全技术", "tags": ["终端安全"], "text": "每年iOS系统大版本升级，对于安全研究人员都是一次新的挑战。在大版本中，除了修补一些未经公开的漏洞外，苹果还会增加新的缓解机制，大大提高了整个越狱的难度。"}
{"title": "互联网黑灰产工具软件，2018半年报告", "url": "https://www.freebuf.com/articles/network/184833.html", "time": "2018-09-18", "level": "", "num_look": 541040, "num_comment": 5, "author": "永安在线", "tags": ["安全报告", "网络安全"], "text": "如果说手机号、帐号、IP、设备等，是黑产从业者的弹药，那么工具软件就是将这些弹药威力发挥到最大的武器。而对于工具软件的分析和研究，是黑产研究的重要组成部分。"}
{"title": "基于机器学习的WEB攻击分类检测模型", "url": "https://www.freebuf.com/news/184687.html", "time": "2018-09-18", "level": "现金奖励", "num_look": 461475, "num_comment": 12, "author": "SS莱斯", "tags": ["WEB安全", "资讯"], "text": "基于机器学习的新一代WEB攻击检测技术有望弥补传统规则集方法的不足，为WEB对抗的防守端带来新的发展和突破。"}
{"title": "解析漏洞管理的五个阶段", "url": "https://www.freebuf.com/articles/security-management/183647.html", "time": "2018-09-18", "level": "", "num_look": 400663, "num_comment": 1, "author": "米雪儿", "tags": ["安全管理"], "text": "本文将概述基于能力成熟度模型（CMM）的五个成熟阶段，让你了解如何使组织更上一层楼，达到下一个成熟度阶段。"}
{"title": "安全预警 | 疑似方正集团子公司签名泄露，遭黑客利用盗取Steam账号", "url": "https://www.freebuf.com/news/184400.html", "time": "2018-09-18", "level": "红色标题", "num_look": 145231, "num_comment": 4, "author": "火绒安全", "tags": ["资讯"], "text": "日前，火绒安全团队发出警报，火绒工程师截获下载器病毒Apametheus，该病毒入侵电脑后会下载多个病毒模块，病毒模块运行后，将盗取steam账号。"}
{"title": "22行代码的JS脚本导致英国航空公司38万乘客数据泄露", "url": "https://www.freebuf.com/articles/web/184685.html", "time": "2018-09-18", "level": "", "num_look": 367769, "num_comment": 3, "author": "clouds", "tags": ["WEB安全"], "text": "英航指出，经初步调查，约有38万乘客数据在此交数据泄露事件中受到影响，这些被盗数据信息包括个人基本信息和付款记录，但不包括个人护照信息。"}
{"title": "微店（杭州）招聘安全工程师", "url": "https://www.freebuf.com/jobs/184538.html", "time": "2018-09-18", "level": "", "num_look": 87581, "num_comment": 2, "author": "weidian", "tags": ["安全招聘"], "text": "微店 | 口袋购物公司，于2011年5月成立，是一家致力移动互联网购物领域的公司，于2014年完成了3.5亿美金的C轮融资，坚持低调稳妥企业战略，专注于移动电子商务。"}
{"title": "行业守望者 | WitAwards 2018年度安全人物评选「报名进行中」", "url": "https://www.freebuf.com/news/183568.html", "time": "2018-09-18", "level": "红色标题", "num_look": 102617, "num_comment": 1, "author": "FB独家", "tags": ["资讯"], "text": "WitAwards 2018盘点本年度安全行业风云人物，为他们台前幕后的不懈努力，为他们对网络安全做出的杰出贡献喝彩。"}
{"title": "ZZCMS v8.3二阶注入之一次小心的试探", "url": "https://www.freebuf.com/vuls/183360.html", "time": "2018-09-18", "level": "现金奖励", "num_look": 252215, "num_comment": 3, "author": "丶楼兰", "tags": ["WEB安全", "漏洞"], "text": "萌新入坑PHP代码审计中╭(°A°`)╮选了这个易上手CMS，费尽心思审计出了一个有趣的二阶注入，满意的睡了，第二天打算写文档的时候，竟然发现……"}
{"title": "疑似“海莲花”组织早期针对国内高校的攻击活动分析", "url": "https://www.freebuf.com/articles/system/184120.html", "time": "2018-09-18", "level": "", "num_look": 182606, "num_comment": 5, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "本文将详细分析“海莲花”组织新的攻击活动中利用的攻击技术细节，并披露其在2017年5月实施的攻击行动详情，以及其中的关联性。"}
{"title": "工业互联网安全 | 台积电之后，下一个“中毒”的会是谁？", "url": "https://www.freebuf.com/articles/neopoints/184129.html", "time": "2018-09-18", "level": "", "num_look": 284665, "num_comment": 1, "author": "AdlerI", "tags": ["观点"], "text": "多年过去，工业互联网的安全防线依然较弱，这与整个行业本身的特点有关，也表明工业互联网的安全建设并不容易。"}
{"title": "lynis插件编写：从入门到放弃", "url": "https://www.freebuf.com/sectool/183977.html", "time": "2018-09-18", "level": "现金奖励", "num_look": 188623, "num_comment": 188623, "author": "nancce", "tags": ["工具", "系统安全"], "text": "lynis是一款采用shell脚本编写，适用于Linux，macOS和基于UNIX的系统的安全审核工具，网上关于lynis插件编写的文章却很少，本文就来讨论下lynis的插件编写。"}
{"title": "BUF早餐铺 | 亚马逊调查员工就泄露数据接受调查；国家网络安全宣传周，苹果呼吁用户开启账户双重认证；DDoS攻击频率持续增加，涨幅已至40%", "url": "https://www.freebuf.com/news/184743.html", "time": "2018-09-18", "level": "", "num_look": 98084, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "国家网络安全周，要注意信息安全哦~"}
{"title": "Fbot：一款Satori相关的、基于区块链DNS的蠕虫", "url": "https://www.freebuf.com/articles/blockchain-articles/184574.html", "time": "2018-09-17", "level": "", "num_look": 146969, "num_comment": 146969, "author": "360Netlab", "tags": ["区块链安全"], "text": "从2018-09-13 11:30 UTC开始，我们首次注意到一个新的蠕虫正在清理 com.ufo.miner。在完成了清理动作后，该蠕虫会等待来自C2的下一步指令。"}
{"title": "【报名即可学习 | 精品公开课】信息安全领域中机器学习入门", "url": "https://www.freebuf.com/fevents/184387.html", "time": "2018-09-17", "level": "红色标题", "num_look": 161183, "num_comment": 161183, "author": "FB客服", "tags": ["FreeBuf公开课", "活动"], "text": "算法平台、图像识别、自然语言处理、无人驾驶、智能安防、智慧医疗......AI安全的基础与进阶知识大剖析~"}
{"title": "浅析智能助手真正的价值和风险", "url": "https://www.freebuf.com/articles/network/183645.html", "time": "2018-09-17", "level": "", "num_look": 161814, "num_comment": 1, "author": "米雪儿", "tags": ["网络安全"], "text": "下面就让我们一起了解一下，智能助手所能提供的真正价值及其可能招致的安全风险。"}
{"title": "国外安全研究者爆料中国黑客组织针对越南政府的APT攻击样本", "url": "https://www.freebuf.com/articles/network/183631.html", "time": "2018-09-17", "level": "", "num_look": 395397, "num_comment": 4, "author": "clouds", "tags": ["网络安全"], "text": "近日，法国安全研究者兼BotConf和FastIR公司创始人Sebastien Larinier，针对RTF文档相关的CVE-2017–11882漏洞利用专门制作了一条YARA规则，来捕获攻击线索。"}
{"title": "一个人的安全部之企业信息安全建设规划", "url": "https://www.freebuf.com/articles/es/184078.html", "time": "2018-09-17", "level": "现金奖励", "num_look": 1470876, "num_comment": 101, "author": "liong03", "tags": ["企业安全"], "text": "近期给某企业做了一份信息安全建设规划方案，但已经用不上了，因此突然想如果就这样了了，还不如拿出来分享……"}
{"title": "关于使用Tshark提取IP字段", "url": "https://www.freebuf.com/sectool/182748.html", "time": "2018-09-17", "level": "", "num_look": 173690, "num_comment": 2, "author": "周大涛", "tags": ["工具"], "text": "在这篇文章中，我将讨论如何使用tshark显示特定的字段。并且我还将深入探讨如何提取和操纵这些字段。我们就从下面的图片开始吧！"}
{"title": "本地化差分隐私：如何面对非可信的世界", "url": "https://www.freebuf.com/articles/database/183532.html", "time": "2018-09-17", "level": "现金奖励", "num_look": 299404, "num_comment": 3, "author": "pingch", "tags": ["数据安全"], "text": "有研究者提出了差分隐私技术（Differential Privacy），它作为一种隐私模型，严格定义了隐私保护的强度，即任意一条记录的添加或删除，都不会影响最终的查询结果。"}
{"title": "有钱就能为所欲为？揭秘竞价排名背后的黑色产业链", "url": "https://www.freebuf.com/articles/web/183987.html", "time": "2018-09-17", "level": "", "num_look": 219714, "num_comment": 9, "author": "GEETEST极验", "tags": ["WEB安全"], "text": "万事不懂都有搜索引擎。在现代生活中搜索引擎成为了比百科全书更为全面的存在。但我们不了解的是，每一条搜索结果背后，或许都是黑产上演的“真实表演”。"}
{"title": "BUF早餐铺 | Mozilla创始人投诉谷歌违反GDPR法规；勒索病毒GandCrab升级到4.3版本；通过Safari浏览器漏洞进行的URL欺骗攻击", "url": "https://www.freebuf.com/news/184425.html", "time": "2018-09-17", "level": "", "num_look": 132050, "num_comment": 132050, "author": "Akane", "tags": ["资讯"], "text": "GDPR于今年5月正式生效。该法规旨在赋予欧盟居民对个人数据有更多的控制权。如果一家公司不遵守这项条例，将面临最高相当于其全球年度营业额4%或2000万欧元(约合2340万美元)的罚款。"}
{"title": "SSH-Auditor：一款SSH弱密码探测工具", "url": "https://www.freebuf.com/sectool/183178.html", "time": "2018-09-16", "level": "", "num_look": 288041, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "ssh-auditor是一款可帮助你探测所在网络中ssh弱密码的工具。"}
{"title": "Windows进程注入技术：额外窗口字节能做很多事情", "url": "https://www.freebuf.com/articles/system/182498.html", "time": "2018-09-16", "level": "", "num_look": 195731, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "Windows 进程注入技术这种针对窗口对象的进程注入技术通常会被归类为“Shatter”攻击，最新版本的Windows 10操作系统仍然无法抵御这种类型的攻击。"}
{"title": "一处代码执行引发的思考", "url": "https://www.freebuf.com/vuls/183658.html", "time": "2018-09-16", "level": "现金奖励", "num_look": 219093, "num_comment": 12, "author": "sjy93812", "tags": ["WEB安全", "漏洞"], "text": "最近偶然间在互联网上看到了一个关于YCCMS代码执行的漏洞，详情并没有公开。我比较感兴趣，就下载了代码看了看。因为这个cms比较小众影响并不会大，所以这里直接把漏洞详情就写出来了。"}
{"title": "白名单绕过UAC方法原理介绍", "url": "https://www.freebuf.com/vuls/183914.html", "time": "2018-09-16", "level": "", "num_look": 449148, "num_comment": 2, "author": "alphalab", "tags": ["漏洞", "系统安全"], "text": "网上有很多关于UAC绕过的技术讨论，天融信阿尔法实验室研究员针对UAC绕过的方法进行了研究和整理。"}
{"title": "Munin：依据文件Hash从各种在线恶意软件扫描服务提取信息的工具", "url": "https://www.freebuf.com/sectool/182863.html", "time": "2018-09-15", "level": "", "num_look": 170716, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "munin是一个依据文件Hash，从各种在线恶意软件扫描服务提取信息的工具。"}
{"title": "技术讨论 | 使用CredSniper获取双因素认证令牌", "url": "https://www.freebuf.com/sectool/182774.html", "time": "2018-09-15", "level": "", "num_look": 136556, "num_comment": 136556, "author": "secist", "tags": ["工具"], "text": "越来越多的企业开始对GSuite和OWA等外部服务，推出强制性的2FA验证。本文主要讨论如何使用CredSniper来窃取2AF令牌 。"}
{"title": "数字货币交易平台面临着哪些安全威胁？", "url": "https://www.freebuf.com/articles/blockchain-articles/184092.html", "time": "2018-09-15", "level": "", "num_look": 224458, "num_comment": 2, "author": "猎豹区块链安全实验室", "tags": ["区块链安全"], "text": "从逻辑上说，任何主观行为都是有目的的，黑客攻击行为的目的，不乏有为了炫耀技术或者表达政治诉求之类的情况，但是占比最大的还是为了获得经济回报。"}
{"title": "【FB TV】一周「BUF大事件」：美国指控朝鲜黑客为WannaCry事件幕后黑手；英国航空公司数据泄露，38万人受影响；微软9月安全更新", "url": "https://www.freebuf.com/video/184537.html", "time": "2018-09-15", "level": "红色标题", "num_look": 199715, "num_comment": 1, "author": "willhuang", "tags": ["视频"], "text": "本周美国公开指控朝鲜黑客是WannaCry和索尼影视攻击事件幕后黑手；英国航空公司数据泄露，38万人受影响；微软9月安全更新，修复61个漏洞。"}
{"title": "利用了Office公式编辑器特殊处理逻辑的最新免杀技术分析（CVE-2017-11882）", "url": "https://www.freebuf.com/vuls/183734.html", "time": "2018-09-15", "level": "", "num_look": 200559, "num_comment": 1, "author": "奇安信威胁情报中心", "tags": ["漏洞", "系统安全"], "text": "在本文中专门针对CVE-2017-11882漏洞样本使用的特殊免杀技术进行详细分析，并提醒各杀毒软件厂商做好针对该利用方式的检测。"}
{"title": "技术讨论 | 信息外带漏洞(OOB)利用技巧", "url": "https://www.freebuf.com/articles/database/183997.html", "time": "2018-09-14", "level": "", "num_look": 219660, "num_comment": 1, "author": "secist", "tags": ["数据安全"], "text": "本文也将重点介绍有关DNS泄露数据的技巧。"}
{"title": "再谈 Wannacry，安全狗 CEO 陈奋道出网络安全新时代三大特征", "url": "https://www.freebuf.com/news/184477.html", "time": "2018-09-14", "level": "", "num_look": 181078, "num_comment": 4, "author": "shidongqi", "tags": ["资讯"], "text": "Wannacry 成为网络安全产业的重要里程碑，虽然造成了很大损失，但很大程度上唤醒了企业、个人的安全意识，也许我们应该庆幸它来的早一些。"}
{"title": "比CMD更强大的命令行：WMIC后渗透利用（系统命令）", "url": "https://www.freebuf.com/articles/system/182531.html", "time": "2018-09-14", "level": "金币+12", "num_look": 446772, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "在这篇文章中，我们将讨论如何在攻击的后渗透利用阶段使用WMIC（Windows Management InstrumentationCommand Line）。"}
{"title": "孩子王招聘安全人才", "url": "https://www.freebuf.com/jobs/184229.html", "time": "2018-09-14", "level": "", "num_look": 147419, "num_comment": 6, "author": "ClarenceHu", "tags": ["安全招聘"], "text": "孩子王是一家数据驱动的，基于用户关系经营的创新型新家庭全渠道服务商，是中国母婴童商品零售与增值服务的品牌。"}
{"title": "安全测试辅助之如何快速找出元素绑定的事件函数代码", "url": "https://www.freebuf.com/articles/web/182859.html", "time": "2018-09-14", "level": "现金奖励", "num_look": 201226, "num_comment": 11, "author": "ForrestX386", "tags": ["WEB安全"], "text": "在过往的安全审计中，我经常会遇到一些网站，其前端发送至后端的数据被加密处理。"}
{"title": "《缺陷周话》第一期：空指针解引用", "url": "https://www.freebuf.com/news/183889.html", "time": "2018-09-14", "level": "", "num_look": 199001, "num_comment": 2, "author": "奇安信代码卫士", "tags": [], "text": "360代码卫士团队推出《缺陷周话》系列栏目，每周针对 CWE、OWASP 等标准中的一类缺陷，结合实例和工具使用进行详细介绍，旨在为广大开发和安全人员提供代码审计的基础性标准化教程。"}
{"title": "仗剑江湖，安全同行 | WitAwards 2018年度安全团队「报名进行中」", "url": "https://www.freebuf.com/news/183673.html", "time": "2018-09-14", "level": "红色标题", "num_look": 118413, "num_comment": 1, "author": "FB独家", "tags": ["资讯"], "text": "在安全攻防的战场，个人的力量总是渺小的，要在激烈的网络攻防中胜出，要靠团队的力量。有人在前线突击，有人在后方钻研，取长补短，果断迅速，才能创造出精彩的成果。"}
{"title": "针对工控恶意代码TRISIS的技术分析", "url": "https://www.freebuf.com/articles/ics-articles/184128.html", "time": "2018-09-14", "level": "", "num_look": 294042, "num_comment": 1, "author": "antiylab", "tags": ["工控安全"], "text": "安天CERT针对“海渊”恶意代码的攻击原理及样本展开了技术分析，它将有可能对工业生产设备、工厂人身安全造成巨大危害，对关键信息基础设施安全、社会安全造成巨大影响。"}
{"title": "智能合约安全性问题CheckList", "url": "https://www.freebuf.com/vuls/183357.html", "time": "2018-09-14", "level": "", "num_look": 206184, "num_comment": 2, "author": "x565178035", "tags": ["区块链安全", "漏洞"], "text": "智能合约引发的安全问题以成为区块链自身机制安全性的主要问题，本文就目前文献中提到的主流安全性问题做出总结，并列出目前的相关研究。"}
{"title": "BUF早餐铺 | 黑客利用脚本技术攻击Feedify窃取用户信息；苹果、谷歌等将出席美国会听证会，解释隐私保护事宜；中国互联网安全标准被国际接纳", "url": "https://www.freebuf.com/news/184315.html", "time": "2018-09-14", "level": "", "num_look": 117215, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "黑客组织利用脚本技术攻击Feedify窃取用户信息；苹果、谷歌等将出席美国会听证会，解释隐私保护事宜；中国互联网安全标准被国际接纳，取得重大进展。"}
{"title": "SonarSnoop：一种将智能手机转变为迷你声纳系统窃取用户手机解锁图案的新技术", "url": "https://www.freebuf.com/news/183361.html", "time": "2018-09-13", "level": "", "num_look": 168284, "num_comment": 1, "author": "secist", "tags": ["终端安全", "资讯"], "text": "最近，出现了一项被称之为SonarSnoop的新技术。通过该技术可以将将智能手机的内置扬声器和麦克风，转化为迷你声纳系统，从而窃取Android设备的手机解锁模式。"}
{"title": "给你一次重来的机会，你会选择安全行业吗？", "url": "https://www.freebuf.com/articles/neopoints/184205.html", "time": "2018-09-13", "level": "", "num_look": 248721, "num_comment": 20, "author": "Karunesh91", "tags": ["观点"], "text": "你愿意当一名安全从业者吗？"}
{"title": "只要600美元就能通过克隆遥控钥匙来窃取特斯拉Model S", "url": "https://www.freebuf.com/news/184007.html", "time": "2018-09-13", "level": "红色标题", "num_look": 179298, "num_comment": 4, "author": "Freddy", "tags": ["资讯"], "text": "据外媒报道，国外的一个研究团队发现特斯拉Model S正暴露在更直接的风险之下，他们能够在几秒内成功克隆特斯拉汽车的遥控钥匙，然后就可以开车走人。"}
{"title": "Windows平台下实现提权的新姿势", "url": "https://www.freebuf.com/articles/system/182479.html", "time": "2018-09-13", "level": "", "num_look": 319032, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "在渗透测试的过程中，当我们以本地用户身份生成命令Shell时，我们是无法检查受限文件或目录的，因此我们才需要拿到管理员访问权。"}
{"title": "Sysmon占用CPU及内存过高问题分析与解决", "url": "https://www.freebuf.com/articles/system/183747.html", "time": "2018-09-13", "level": "红色标题", "num_look": 569277, "num_comment": 7, "author": "京东安全", "tags": ["系统安全"], "text": "最近有个项目用到了sysinternals出品的监控工具：sysmon.exe。但是有反馈，sysmon.exe进程在某一特定条件下，持续占用cpu，一般为会跑满cpu的一个逻辑核。"}
{"title": "使用Golang打造一款自己的手工盲注辅助工具", "url": "https://www.freebuf.com/sectool/183646.html", "time": "2018-09-13", "level": "现金奖励", "num_look": 275181, "num_comment": 10, "author": "releasel0ck", "tags": ["工具"], "text": "前段时间又遇到了一个更奇葩的注入，数据库是PostgreSQL，存在防火墙，能绕过，但绕过的方式不固定，刚好最近在学习golang,就想着用golang来打造这么一款小工具。"}
{"title": "BUF早餐铺 | 微软与Adobe发布安全更新；谷歌发布Chrome安全更新；Edge与Safari浏览器存在安全风险；江苏一高校2000多学生信息遭泄露", "url": "https://www.freebuf.com/news/184184.html", "time": "2018-09-13", "level": "", "num_look": 154575, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "瑞士数据管理公司 Veeam 泄露 4.45 亿条用户数据；僵尸网络 Mirai 和Gafgyt 最新变种目标瞄准企业网络"}
{"title": "通过SSTI漏洞获取服务器远程Shell", "url": "https://www.freebuf.com/articles/web/183188.html", "time": "2018-09-12", "level": "", "num_look": 310357, "num_comment": 5, "author": "secist", "tags": ["WEB安全"], "text": "本文我将为大家演示，如何利用服务器端模板注入（SSTI）漏洞，来获取应用托管服务器上的shell。"}
{"title": "创业耗费百万，为何DDoS如此要命Part 1", "url": "https://www.freebuf.com/articles/network/183182.html", "time": "2018-09-12", "level": "现金奖励", "num_look": 900273, "num_comment": 27, "author": "罗永浩的迷弟", "tags": ["网络安全"], "text": "第一次和DDoS攻击打交道，那是06年的冬天，第一份工作是为一家网络广告联盟公司做服务器运维。"}
{"title": "卡巴斯基2017年企业信息系统的安全评估报告", "url": "https://www.freebuf.com/articles/es/182554.html", "time": "2018-09-12", "level": "", "num_look": 186782, "num_comment": 3, "author": "vitaminsecurity", "tags": ["企业安全"], "text": "在本文中，我们提供了卡巴斯基实验室2017年开展的企业信息系统网络安全评估的总体概述和统计数据。"}
{"title": "揭秘仿冒应用的神秘面纱", "url": "https://www.freebuf.com/articles/terminal/183250.html", "time": "2018-09-12", "level": "", "num_look": 257911, "num_comment": 3, "author": "暗影安全实验室", "tags": ["终端安全"], "text": "现在，越来越多的仿冒应用混杂在市场中，给用户群体造成了巨大的损失。"}
{"title": "中文点选验证码之自动识别", "url": "https://www.freebuf.com/articles/web/182975.html", "time": "2018-09-12", "level": "红色标题", "num_look": 474266, "num_comment": 4, "author": "TASS008", "tags": ["WEB安全"], "text": "某次测试中遇到了汉字点选的验证码，看着很简单，尝试了一下发现有两种简单的识别方法，终于有空给重新整理一下，分享出来。"}
{"title": "一个10年陈酿的安全管理员：终端安全运营的实践和思考", "url": "https://www.freebuf.com/articles/terminal/183998.html", "time": "2018-09-12", "level": "", "num_look": 322086, "num_comment": 2, "author": "仙人掌情报站", "tags": ["终端安全"], "text": "本文将结合项目经验，采用问题场景复盘的模式，探讨政府单位或大型企业内部终端的安全运营实践。"}
{"title": "“隐匿者”病毒团伙技术升级传播病毒，暴力入侵电脑威胁全网用户", "url": "https://www.freebuf.com/vuls/183518.html", "time": "2018-09-12", "level": "", "num_look": 202937, "num_comment": 2, "author": "火绒安全", "tags": ["漏洞", "终端安全"], "text": "火绒安全团队发现病毒团伙\"隐匿者\"进行了新的技术升级，正在传播病毒\"Voluminer\"。该病毒会在用户电脑中留下后门，用来挖取门罗币。"}
{"title": "Android Smart Linkify API背后的机器学习", "url": "https://www.freebuf.com/news/183637.html", "time": "2018-09-12", "level": "", "num_look": 106171, "num_comment": 106171, "author": "米雪儿", "tags": ["资讯"], "text": "2018年8月初，谷歌正式发布了代号为“Pie”的Android 9，Android正在推出一系列由人工智能提供支持的新功能，Android Smart Linkify就是其中最重要的新AI功能之一。"}
{"title": "BUF 早餐铺 | 越来越多的iOS应用收集用户信息出售获利；特斯拉门锁存在安全漏洞，黑客盗取汽车只需数秒钟；两部门：关闭顺风车平台社交功能，屏蔽乘客信息；", "url": "https://www.freebuf.com/news/184071.html", "time": "2018-09-12", "level": "", "num_look": 133020, "num_comment": 133020, "author": "shidongqi", "tags": ["资讯"], "text": "交通运输部、公安部10日发出通知，要加强乘客信息保护，关闭顺风车平台社交功能，屏蔽乘客信息，防止泄露个人隐私。"}
{"title": "国之重器 | WitAwards 2018 年度国家力量评选「报名进行中」", "url": "https://www.freebuf.com/fevents/183592.html", "time": "2018-09-11", "level": "红色标题", "num_look": 128322, "num_comment": 3, "author": "FB独家", "tags": ["活动"], "text": "网络空间已经成为国家“无形疆域”，维护国家网络信息安全是光荣与荣耀，更是义不容辞的责任与使命。2018，谁是支撑国家网络空间信息安全的强大力量？"}
{"title": "Office文档嵌入对象点击执行的社工技巧", "url": "https://www.freebuf.com/articles/system/182900.html", "time": "2018-09-11", "level": "", "num_look": 206636, "num_comment": 3, "author": "secist", "tags": ["系统安全"], "text": "Microsoft Office相信大家都用过。除了带来日常工作的便利，Office也存在可以被攻击者利用的漏洞。"}
{"title": "被指向中国发送数据，Mac App Store下架排名第一的付费安全软件", "url": "https://www.freebuf.com/news/183878.html", "time": "2018-09-11", "level": "", "num_look": 218824, "num_comment": 5, "author": "Freddy", "tags": ["资讯"], "text": "近日有外媒报道，Mac App Store中付费安全软件中排名第一的Adware Doctor被研究人员发现在未经用户同意的情况下收集浏览历史，并将数据发送至位于中国的服务器，之后被Mac App Store下架。"}
{"title": "新手科普 | 如何脱离Metasploit进行渗透测试", "url": "https://www.freebuf.com/news/182633.html", "time": "2018-09-11", "level": "", "num_look": 578163, "num_comment": 3, "author": "Covfefe", "tags": [], "text": "如果你是个新手或正在为OSCP认证而学习，那么，请了解一下这篇文章。"}
{"title": "一次安全测试引发的对Django框架文件上传安全机制的初步分析", "url": "https://www.freebuf.com/articles/web/183125.html", "time": "2018-09-11", "level": "现金奖励", "num_look": 297112, "num_comment": 8, "author": "ForrestX386", "tags": ["WEB安全"], "text": "在对堡垒机的文件上传接口进行安全审计的时候发现，其对上传文件名没有过滤处理，然后直接写入磁盘，于是进行了一系列测试。"}
{"title": "预警 | 删库跑路加勒索，Redis勒索事件爆发", "url": "https://www.freebuf.com/vuls/183992.html", "time": "2018-09-11", "level": "", "num_look": 252241, "num_comment": 252241, "author": "阿里云安全", "tags": ["漏洞", "网络安全"], "text": "9月10日下午15:06开始，阿里云官方首次发现一起规模化利用Redis 未授权访问漏洞进行加密货币勒索的事件，阿里云上防御系统在攻击开始的10s内就已开启全网拦截。"}
{"title": "远控工具Njrat实现一键加密与解密测试", "url": "https://www.freebuf.com/vuls/183398.html", "time": "2018-09-11", "level": "", "num_look": 328804, "num_comment": 8, "author": "si1ence", "tags": ["漏洞", "终端安全"], "text": "njRAT自2013年以来一直存在，是最流行的恶意软件系列之一。该软件内置于.NET Framework中，可为攻击者提供对受感染系统的远程控制。"}
{"title": "Ecshop2.x代码执行漏洞动态调试分析", "url": "https://www.freebuf.com/vuls/183219.html", "time": "2018-09-11", "level": "", "num_look": 179535, "num_comment": 1, "author": "alphalab", "tags": ["WEB安全", "漏洞"], "text": "号称国内最大的开源网店系统，可以直接远程写入webshell。"}
{"title": "传统白加黑远控木马分析", "url": "https://www.freebuf.com/articles/system/182846.html", "time": "2018-09-11", "level": "红色标题", "num_look": 769930, "num_comment": 11, "author": "dsb2468", "tags": ["系统安全"], "text": "病毒伪装成一个DLL文件，QQ游戏启动的同时，DLL也会被加载启动。之后会在内存中释放出远控模块，能够绕过某些安软的网络拦截，从而控制目标计算机。"}
{"title": "漏洞预警 | 思科产品曝多个高危安全漏洞（附详细技术分析）", "url": "https://www.freebuf.com/vuls/183885.html", "time": "2018-09-11", "level": "", "num_look": 200530, "num_comment": 200530, "author": "奇安信代码卫士", "tags": ["漏洞", "终端安全"], "text": "360企业安全集团代码卫士团队安全研究人员发现了思科公司网络设备的多个高危安全漏洞，并第一时间向思科公司报告，协助其修复漏洞。"}
{"title": "滴滴风波余热未散，为了安全你会选择牺牲隐私吗？", "url": "https://www.freebuf.com/articles/neopoints/183298.html", "time": "2018-09-11", "level": "", "num_look": 213576, "num_comment": 2, "author": "Allen别bb", "tags": ["观点"], "text": "随着凶手落网、判刑，乐清滴滴顺风车事件终于渐渐从舆论中心淡去。这次事件引发了全国范围内的广泛关注，不过让人没想到的是，在随后的一段时间里，全国多地有人被刑拘，原因也基本相同。"}
{"title": "BUF早餐铺 | 部分旧恶意软件已被重新设计以窃取数字货币；安全研究员发现39万个网站因公开的.git repo处于危险中；macOS应用被指偷窃和上传浏览记录", "url": "https://www.freebuf.com/news/183950.html", "time": "2018-09-11", "level": "", "num_look": 93569, "num_comment": 93569, "author": "Karunesh91", "tags": ["资讯"], "text": "部分旧恶意软件已被重新设计以窃取数字货币；安全研究员发现39万个网站因公开的.git repo处于危险中；macOS应用被指偷窃和上传浏览记录"}
{"title": "【报名即可学习 | 精品公开课】渗透测试常用提权心法，总有一招用得上", "url": "https://www.freebuf.com/fevents/183212.html", "time": "2018-09-10", "level": "红色标题", "num_look": 251202, "num_comment": 9, "author": "FB客服", "tags": ["FreeBuf公开课", "活动"], "text": "404再也无法阻止我的脚步，提权原来可以这么简单~"}
{"title": "基于时延的盲道研究：受限环境下的内容回传信道", "url": "https://www.freebuf.com/vuls/183636.html", "time": "2018-09-10", "level": "现金奖励", "num_look": 387396, "num_comment": 24, "author": "yangyangwithgnu", "tags": ["WEB安全", "漏洞"], "text": "在一次漏洞赏金活动中，挖到个命令注入的洞，我先以时延作为证明向厂商提交该漏洞，厂商以国内网络环境差为由（的确得翻墙）拒收，几次沟通，告知若我能取回指定文件 secret.txt 才认可。"}
{"title": "【火热报名中】网络安全架构体系设计 | FreeBuf企业精品公开课 × Fortinet", "url": "https://www.freebuf.com/open/183469.html", "time": "2018-09-10", "level": "", "num_look": 147989, "num_comment": 2, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "数字化转型是当前被探讨的最热话题之一，在这个过程中企业安全面临的挑战也一再被放大，企业的网络安全部署与实践必将进行安全转型。"}
{"title": "如何绕过电子邮件格式过滤进行SQL注入", "url": "https://www.freebuf.com/articles/web/183516.html", "time": "2018-09-10", "level": "", "num_look": 264170, "num_comment": 5, "author": "secist", "tags": ["WEB安全"], "text": "忘记密码功能中意外找到的BUG"}
{"title": "黑你没商量！只需一根USB充电线就能在你的PC上植入恶意程序", "url": "https://www.freebuf.com/news/182271.html", "time": "2018-09-10", "level": "", "num_look": 206455, "num_comment": 206455, "author": "secist", "tags": ["资讯"], "text": "近日，有安全研究人员对外展示了一个可以执行BadUSB攻击的USB充电线装置USBHarpoon。"}
{"title": "轻松获取你的手机号，这个“潘多拉魔盒”正在全国热销", "url": "https://www.freebuf.com/articles/terminal/183179.html", "time": "2018-09-10", "level": "现金奖励", "num_look": 841419, "num_comment": 44, "author": "GEETEST极验", "tags": ["终端安全"], "text": "如果有一个盒子，只要你在它百米之内，就能直接获取你的手机号，你害不害怕？"}
{"title": "小米安全2018秋招正式启动", "url": "https://www.freebuf.com/jobs/183576.html", "time": "2018-09-10", "level": "", "num_look": 132497, "num_comment": 2, "author": "小米安全中心", "tags": ["安全招聘"], "text": "小米安全团队成立于2013年11月，在这里你可以接触学习到各种黑客技术，在这里你可以第一手测试好玩的智能硬件，在这里你可以和众多大牛在安全技术前沿一起探索。"}
{"title": "WannaMiner挖矿木马不光擅长黑吃黑，最新变种还会过河拆桥", "url": "https://www.freebuf.com/articles/network/183423.html", "time": "2018-09-10", "level": "", "num_look": 217014, "num_comment": 3, "author": "腾讯电脑管家", "tags": ["企业安全", "网络安全"], "text": "WannaMiner出现新变种，该木马在挖取XMR同时会下载远控木马，但这个最新变种会查杀其他挖矿木马，保证自己独享系统资源。"}
{"title": "差分隐私保护：从入门到脱坑", "url": "https://www.freebuf.com/articles/database/182906.html", "time": "2018-09-10", "level": "现金奖励", "num_look": 655275, "num_comment": 3, "author": "pingch", "tags": ["数据安全"], "text": "差分隐私（Differential Privacy）是密码学中的一种手段，旨在提供一种当从统计数据库查询时，最大化数据查询的准确性，同时最大限度减少识别其记录的机会。"}
{"title": "BUF早餐铺 | 苹果将为执法机构提供数据提取工具；隐匿者病毒团伙技术升级传播病毒；思科修复多个安全漏洞", "url": "https://www.freebuf.com/news/183561.html", "time": "2018-09-10", "level": "", "num_look": 90276, "num_comment": 90276, "author": "Freddy", "tags": ["资讯"], "text": "苹果公司发送给美国参议员的信件中透露，该公司计划为执法机构打造一款在线工具，以回应那些对其用户数据的正式索要请求。同时苹果还将组建团队以培训执法人员了解使用该工具可以获取哪些技术。"}
{"title": "攻击索尼影业、发动Wannacry勒索软件攻击、窃取孟加拉央行的背后真凶找到了！", "url": "https://www.freebuf.com/news/183635.html", "time": "2018-09-09", "level": "", "num_look": 226655, "num_comment": 7, "author": "米雪儿", "tags": ["资讯"], "text": "本周四，美国司法部起诉了一名朝鲜黑客，指控他近年来主导的多宗网络攻击罪行，包括攻击索尼影业、发动“WannaCry”勒索软件攻击、窃取孟加拉央行8000万美元，甚至是入侵韩国部署的萨德导弹防御系统等。"}
{"title": "Scrounger：iOS和Android移动应用程序渗透测试框架", "url": "https://www.freebuf.com/sectool/182888.html", "time": "2018-09-09", "level": "", "num_look": 195352, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "Scrounger是一个模块化的移动应用程序渗透测试框架工具。它将Android和iOS这两个主流的移动操作系统整合到了一个框架中，极大的方便和满足了日常任务的需求。"}
{"title": "挖洞经验 | 看我如何发现Facebook的$5000美金漏洞", "url": "https://www.freebuf.com/articles/web/182500.html", "time": "2018-09-09", "level": "", "num_look": 225576, "num_comment": 2, "author": "clouds", "tags": ["WEB安全"], "text": "最近，我在参与一些漏洞众测项目，本文中我就来分享一个我发现的Facebook某服务器漏洞，该漏洞获得Facebook官方$5000美金奖励。"}
{"title": "安全开发 | Python Subprocess库在使用中可能存在的安全风险总结", "url": "https://www.freebuf.com/articles/web/183078.html", "time": "2018-09-09", "level": "现金奖励", "num_look": 251319, "num_comment": 2, "author": "ForrestX386", "tags": ["WEB安全"], "text": "在各大热门语言排行榜中，Python语言多次名列前茅，其高效的开发效率和优雅的编程风格吸引不少开发人员的青睐，不少公司将技术栈切换至Python。"}
{"title": "精通NSA十八般兵器的NSAFtpMiner矿工来了，已有3万台电脑中招", "url": "https://www.freebuf.com/articles/es/183365.html", "time": "2018-09-09", "level": "", "num_look": 260563, "num_comment": 1, "author": "腾讯电脑管家", "tags": ["企业安全"], "text": "近期发现黑客通过1433端口爆破入侵SQL Server服务器，再植入远程控制木马并安装为系统服务，然后利用远程控制木马进一步加载挖矿木马进行挖矿。"}
{"title": "利用Office文档结合社会工程学手段欺骗用户执行恶意代码", "url": "https://www.freebuf.com/articles/system/182877.html", "time": "2018-09-08", "level": "", "num_look": 206623, "num_comment": 2, "author": "周大涛", "tags": ["系统安全"], "text": "Microsoft Office文档为攻击者提供了各种欺骗受害者运行任意代码的方法。当然，攻击者可能会尝试直接利用Office漏洞，但更常见的情况是向受害者发送包含恶意代码的文档。"}
{"title": "如何通过恶意宏劫持桌面快捷方式提供后门", "url": "https://www.freebuf.com/articles/system/182507.html", "time": "2018-09-08", "level": "", "num_look": 159779, "num_comment": 159779, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "今天分享的东西就是两个小技巧，一个是之前说过的钓鱼工具结合社工的邮件伪造进行模拟攻击一次steam账户。第二个是怎么拿到对方ip然后通过互联网ip定位接口进行定位的过程。"}
{"title": "周鸿祎要卖360辣椒水，还把“安全大脑”充公了", "url": "https://www.freebuf.com/articles/neopoints/183583.html", "time": "2018-09-08", "level": "红色标题", "num_look": 633672, "num_comment": 6, "author": "AngelaY", "tags": ["观点"], "text": "也许未来，有了“安全大脑”的辣椒水和甩棍可以普及，并受到安检的认可……"}
{"title": "【FB TV】一周「BUF大事件」：2018 ISC互联网安全大会北京举行；《「DDoS威胁与黑灰产业调查」报告》完整版发布", "url": "https://www.freebuf.com/video/183605.html", "time": "2018-09-08", "level": "红色标题", "num_look": 261890, "num_comment": 261890, "author": "willhuang", "tags": ["视频"], "text": "本周2018 ISC互联网安全大会在北京国家会议中心举行；《「DDoS威胁与黑灰产业调查」报告》完整版发布；恶意病毒伪装系统激活工具入侵用户电脑。"}
{"title": "Frida在爆破Windows程序中的应用", "url": "https://www.freebuf.com/articles/system/182112.html", "time": "2018-09-08", "level": "现金奖励", "num_look": 309782, "num_comment": 2, "author": "geek痕", "tags": ["系统安全"], "text": "谈到爆破，相信大部分网络安全从业者都并不陌生。在进行web的爆破时，我们通常会使用brupsuite等工具，那么，如果是二进制程序中的爆破呢？"}
{"title": "Pacu：一款全面的AWS渗透测试框架", "url": "https://www.freebuf.com/sectool/182928.html", "time": "2018-09-07", "level": "金币+12", "num_look": 310200, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "亚马逊AWS云服务平台是全球最受欢迎的云平台之一。由于其成本低、灵活性强、速度快等优势，吸引了大量的企业客户，越来越多的企业开始将其技术资产转移到了云端。"}
{"title": "Android App渗透测试工具分享", "url": "https://www.freebuf.com/sectool/182152.html", "time": "2018-09-07", "level": "红色标题", "num_look": 992605, "num_comment": 24, "author": "Brucetg", "tags": ["工具"], "text": "这段时间因为某些原因接触了Android App渗透测试，发现了几个不错的App渗透测试工具。"}
{"title": "安全没有边界 | ISC 2018互联网安全大会Day 3报道", "url": "https://www.freebuf.com/news/183527.html", "time": "2018-09-07", "level": "红色标题", "num_look": 148941, "num_comment": 2, "author": "Freddy", "tags": ["资讯"], "text": "9月6日，ISC 2018互联网安全大会技术峰会在国家会议中心召开。重磅嘉宾纷纷上台发表演讲，从技术的角度为人们分析网络安全技术的复杂与应用，共同探讨未来安全技术研发方向思路，推动技术的革新与发展。"}
{"title": "安全运维之如何找到隐匿于last和w命令中的ssh登录痕迹", "url": "https://www.freebuf.com/articles/system/182860.html", "time": "2018-09-07", "level": "现金奖励", "num_look": 570548, "num_comment": 5, "author": "ForrestX386", "tags": ["系统安全"], "text": "在我最近的一些安全应急响应经历中，遇到了入侵者利用一些小的有意思tricks——将自己的ssh登录痕迹隐匿于w和last命令中。"}
{"title": "CVE-2018-11776：如何通过Semmle QL找到Apache Struts的远程执行代码漏洞", "url": "https://www.freebuf.com/vuls/182337.html", "time": "2018-09-07", "level": "", "num_look": 162230, "num_comment": 162230, "author": "Covfefe", "tags": ["漏洞"], "text": "2018年4月，一个新的Apache Struts远程代码执行漏洞被报告。在Struts特定配置下，访问特制的URL可以触发该漏洞。漏洞编号为CVE-2018-11776（S2-057）。本文将介绍发现漏洞的过程。"}
{"title": "iTutorGroup招聘安全人才", "url": "https://www.freebuf.com/jobs/183046.html", "time": "2018-09-07", "level": "", "num_look": 119091, "num_comment": 119091, "author": "TutorABC", "tags": ["安全招聘"], "text": "iTutorGroup在全球开创了24/7/365全年无休的真人在线教育模式，拥有20,000多位外籍顾问，服务人次超过1.8亿。"}
{"title": "ShadowMiner：传说中的闷声发大财？", "url": "https://www.freebuf.com/articles/terminal/183108.html", "time": "2018-09-07", "level": "", "num_look": 173773, "num_comment": 5, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "发现新型挖矿病毒，此病毒构造复杂，善于伪装，像影子般依附到系统环境。"}
{"title": "Fake System木马惊现新变种，百万Android设备沦为肉鸡", "url": "https://www.freebuf.com/articles/terminal/183221.html", "time": "2018-09-07", "level": "", "num_look": 222395, "num_comment": 4, "author": "腾讯手机管家", "tags": ["终端安全"], "text": "TRP-AI反病毒引擎捕获到一批大肆传播的Android后门木马病毒样本，此木马在用户设备上存在私自获取设备信息、后台频繁安装应用、后台发送短信等行为。"}
{"title": "BUF早餐铺 | 思科发布16个严重漏洞安全预警；为满足科研需求谷歌发布数据集搜索服务；空姐事件后续：滴滴捐助打捞队100万元", "url": "https://www.freebuf.com/news/183402.html", "time": "2018-09-07", "level": "", "num_look": 156373, "num_comment": 2, "author": "Akane", "tags": ["资讯"], "text": "谷歌的目标是对全世界的信息进行组织和管理。该公司最初瞄准了商业网络，而目前谷歌想要用新的数据集搜索引擎，为科学界提供服务。这个名为“数据集搜索”的新服务于今天推出，将成为谷歌学术搜索服务的伴侣服务。"}
{"title": "ECShop 2.x 3.0代码执行漏洞分析", "url": "https://www.freebuf.com/vuls/183294.html", "time": "2018-09-06", "level": "", "num_look": 248216, "num_comment": 3, "author": "斗象智能安全平台", "tags": ["数据安全", "漏洞"], "text": "ECShop是一款B2C独立网店系统，适合企业及个人快速构建个性化网上商店。2.x版本跟3.0版本存在代码执行漏洞。"}
{"title": "imaginaryC2：帮助安全研究人员分析恶意软件网络行为的模拟C2托管HTTP服务器", "url": "https://www.freebuf.com/sectool/182634.html", "time": "2018-09-06", "level": "", "num_look": 184418, "num_comment": 184418, "author": "secist", "tags": ["工具", "系统安全"], "text": "Imaginary C2是一款python工具，可帮助安全研究人员分析恶意软件（网络）行为。"}
{"title": "PHP WebShell代码后门的一次检查", "url": "https://www.freebuf.com/articles/web/182156.html", "time": "2018-09-06", "level": "现金奖励", "num_look": 525812, "num_comment": 18, "author": "facebook001", "tags": ["WEB安全"], "text": "小明是一名Web小白，今天他突然心血来潮，对自己常用的大马代码查看一下，竟然发现还是有一些后门没有清除干净，不由得心里为之一颤抖，这个江湖果然是险恶重生，黑吃黑的事情经常发生。"}
{"title": "写给金融首席安全官的一封信：请随时准备好，大规模网络攻击随时到来", "url": "https://www.freebuf.com/articles/terminal/182555.html", "time": "2018-09-06", "level": "", "num_look": 153017, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["终端安全", "网络安全"], "text": "我们需要一套完整的机制来处理网络攻击或数字欺诈。虽然无法完全阻止网络犯罪事件的发生，但是可以增加自己的“存活几率”。"}
{"title": "产业协同是关键 | ISC 2018互联网安全大会Day 2直击", "url": "https://www.freebuf.com/news/183389.html", "time": "2018-09-06", "level": "红色标题", "num_look": 349204, "num_comment": 5, "author": "Freddy", "tags": ["资讯"], "text": "9月5日，ISC 2018互联网安全大会产业峰会在北京国家会议中心主会场举行。来自不同领域重磅嘉宾从多个维度展开，探讨了网络安全产业发展、扩容与升级。"}
{"title": "KSN安全报告：勒索软件和恶意矿工的威胁景观（2016～2018）", "url": "https://www.freebuf.com/articles/paper/182691.html", "time": "2018-09-06", "level": "", "num_look": 121083, "num_comment": 1, "author": "vitaminsecurity", "tags": ["安全报告"], "text": "勒索软件不是一个陌生的威胁。在过去的几年里，它一直在影响网络安全世界，感染设备和文件并阻止用户访问，如果用户想要重新获得其设备和文件的访问权，就必须要支付一笔赎金。"}
{"title": "FreeBuf 专访中新网安沈传宝 | 网络安全新时代，不忘初心，脚踏实地", "url": "https://www.freebuf.com/articles/people/183272.html", "time": "2018-09-06", "level": "红色标题", "num_look": 442386, "num_comment": 7, "author": "AngelaY", "tags": ["人物志"], "text": "网络安全行业的发展终究离不开政府的主导。如今我们处在发展的好时代，希望大家都能不辜负时代，踏实做一些对行业、对社会和国家有用的事情。"}
{"title": "安全·匠心 | WitAwards 2018年度创新产品评选「报名进行中」", "url": "https://www.freebuf.com/news/183057.html", "time": "2018-09-06", "level": "红色标题", "num_look": 128697, "num_comment": 2, "author": "FB独家", "tags": ["资讯"], "text": "WitAwards 2018盘点本年度安全行业最具创新力的安全产品，为创新精神喝彩，鼓励更多的企业、人才投入到安全创新中去。"}
{"title": "火绒安全警报：病毒伪装成激活工具强制安装360、2345浏览器", "url": "https://www.freebuf.com/articles/paper/182775.html", "time": "2018-09-06", "level": "", "num_look": 196215, "num_comment": 7, "author": "火绒安全", "tags": ["安全报告"], "text": "8月30日，火绒安全团队截获病毒\"FakeKMS\"。该病毒伪装成\"小马激活\"、\"KMS\"等知名激活工具，通过激活工具下载站点进行传播。"}
{"title": "技术讨论 | 如何利用Microsoft Edge漏洞获取本地文件？", "url": "https://www.freebuf.com/news/180039.html", "time": "2018-09-06", "level": "", "num_look": 161840, "num_comment": 4, "author": "Hydralab", "tags": ["资讯"], "text": "在2015年，微软发布了Edge浏览器。当它最初被开发时，它被命名为Project Spartan。安全性增强的同时，也带来了新的隐患。"}
{"title": "BUF早餐铺 | Chrome浏览器69发布，增强安全性；7500台MikroTik路由器被植入挖矿代码和流量转发；Python程序包安装时可能触发恶意代码", "url": "https://www.freebuf.com/news/183196.html", "time": "2018-09-06", "level": "", "num_look": 353312, "num_comment": 1, "author": "Akane", "tags": ["资讯"], "text": "Chrome浏览器于2008年9月2日正式发布，距今已经整整10年了。作为10周年庆祝活动的一部分，谷歌发布了面向桌面级、Android和iOS系统的的Chrome 69。"}
{"title": "Web安全实战系列：文件包含漏洞", "url": "https://www.freebuf.com/articles/web/182280.html", "time": "2018-09-05", "level": "红色标题", "num_look": 2836365, "num_comment": 25, "author": "山东安云", "tags": ["WEB安全"], "text": "《Web安全实战》系列集合了WEB类常见的各种漏洞，希望对WEB安全工作者、WEB安全学习者能有所帮助，减少获取知识的时间成本。"}
{"title": "加拿大航空手机App用户数据被黑客窃取", "url": "https://www.freebuf.com/news/182680.html", "time": "2018-09-05", "level": "", "num_look": 157816, "num_comment": 3, "author": "Freddy", "tags": ["资讯"], "text": "加航App用户数据遭到泄露，加拿大航空公司需要客户重置App密码。"}
{"title": "安全防护场景与安全报警的：“点、线、面”", "url": "https://www.freebuf.com/articles/network/182424.html", "time": "2018-09-05", "level": "现金奖励", "num_look": 364397, "num_comment": 25, "author": "xsecurity", "tags": ["网络安全"], "text": "在威胁行为的不同场景阶段，一般要使用不同基础防御系统防护。我们把攻击阶段简单的分类：渗透、入侵、破坏、灭迹、逃逸。在不同的阶段使用不同的防护产品与其对位。"}
{"title": "DEFCON 26 | 利用传真功能漏洞渗透进入企业内网（Faxploit）", "url": "https://www.freebuf.com/vuls/182869.html", "time": "2018-09-05", "level": "", "num_look": 192049, "num_comment": 3, "author": "clouds", "tags": ["漏洞", "终端安全"], "text": "从飞鸽传书到邮政快递，写信人与收信人之间的消息传递方式逐渐在演变发展，传真技术的出现，从某种程度上说，帮助人们走出了信件传递的黑暗时代。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列-Shubham Shah", "url": "https://www.freebuf.com/video/183082.html", "time": "2018-09-05", "level": "红色标题", "num_look": 162664, "num_comment": 2, "author": "willhuang", "tags": ["视频"], "text": "Shubham Shah，昵称notnaffy，澳大利亚人。在16岁的他就发现了Google、Facebook、Yahoo和LinkedIn等多家知名网络公司的双因素（2FA）绕过漏洞，目前以260漏洞发现量排名HackerOne 第36位。"}
{"title": "我的遗愿是：清空我所有的社交网络账号", "url": "https://www.freebuf.com/articles/neopoints/182992.html", "time": "2018-09-05", "level": "红色标题", "num_look": 368527, "num_comment": 3, "author": "shidongqi", "tags": ["观点"], "text": "生在这个数字时代，许多人对于自己的死亡，担心的已经不再是财产能不能得到妥善处理，而是自己的那些照片、资料、网络账号这些包含了太多个人隐私的东西……"}
{"title": "SMTP用户枚举原理简介及相关工具", "url": "https://www.freebuf.com/articles/web/182746.html", "time": "2018-09-05", "level": "现金奖励", "num_look": 242744, "num_comment": 242744, "author": "lemurhhh", "tags": ["WEB安全"], "text": "SMTP是安全测试中比较常见的服务类型，其不安全的配置（未禁用某些命令）会导致用户枚举的问题，这主要是通过SMTP命令进行的。本文将介绍SMTP用户枚举原理以及相关工具。"}
{"title": "重磅 | 黑镜调查：深渊背后的真相之「DDoS威胁与黑灰产业」调查报告", "url": "https://www.freebuf.com/news/topnews/178990.html", "time": "2018-09-05", "level": "红色标题", "num_look": 644292, "num_comment": 12, "author": "FreeBuf咨询", "tags": ["头条", "安全报告"], "text": "DDoS攻击经过近二十年的演变沿用至今，以其成本较低、效果显著、影响深远为攻击者所青睐。2018上半年的一起Memcached DDoS攻击，峰值高达1.7 Tbps，更是创造了全新的历史记录。"}
{"title": "Android系统广播机制存在漏洞，恶意软件可绕过安全机制跟踪用户", "url": "https://www.freebuf.com/news/182795.html", "time": "2018-09-05", "level": "", "num_look": 143124, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "。Android系统的内部广播机制会暴露敏感的用户和设备信息，手机上安装的应用可在用户不知情或未经许可的情况下访问获取这些信息。"}
{"title": "Vba2Graph：生成VBA调用图并高亮显示潜在恶意关键字的工具", "url": "https://www.freebuf.com/sectool/182473.html", "time": "2018-09-05", "level": "", "num_look": 104038, "num_comment": 104038, "author": "secist", "tags": ["工具"], "text": "Vba2Graph是一款用于生成VBA调用图，并高亮显示潜在恶意关键字的工具。该工具旨在使安全研究人员能够快速的分析恶意宏，并更加直观的理解其执行流程。"}
{"title": "技术讨论 | 简谈渗透测试各阶段我常用的那些“神器”", "url": "https://www.freebuf.com/sectool/182476.html", "time": "2018-09-05", "level": "现金奖励", "num_look": 1268668, "num_comment": 74, "author": "flagellantX", "tags": ["工具", "网络安全"], "text": "笔者为大家打包了多款好用的入侵渗透工具，并附上了说明和下载地址~本文为了需要的朋友而写，另疏漏之处欢迎有心的道友下方补充帮助更多的朋友们。"}
{"title": "BUF 早餐铺 | Github造假产业链曝光，花钱就能买Star；滴滴出行9月8日至15日暂停深夜服务，推全程录音功能；美情报机构希望科技企业透露加密信息，称隐私并非绝对", "url": "https://www.freebuf.com/news/183134.html", "time": "2018-09-05", "level": "", "num_look": 128847, "num_comment": 128847, "author": "shidongqi", "tags": ["资讯"], "text": "最近知乎上出现了一篇《中国内地 GitHub 造假呈指数级增长，其背后是……》的文章，将 Github 上伪造 Star 数量的现象推到风口浪尖。"}
{"title": "安全从0开始 | 2018 ISC互联网安全大会首日追踪", "url": "https://www.freebuf.com/news/183135.html", "time": "2018-09-04", "level": "", "num_look": 147941, "num_comment": 3, "author": "Freddy", "tags": ["资讯"], "text": "小编全程参与了9月4日上午举行的战略峰会，从国内外嘉宾们的发言我看到了他们深厚的技术背景，同时也因他们怀抱着的家国情怀感受到了内心的激荡。"}
{"title": "GoldenEye：一款功能强大的 Layer7DoS 安全测试工具", "url": "https://www.freebuf.com/sectool/182499.html", "time": "2018-09-04", "level": "", "num_look": 213478, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍一款名叫GoldenEye的安全测试工具，广大研究人员可利用该工具来对目标系统进行DoS攻击测试。"}
{"title": "Atlas Quantum平台用户信息遭窃，快去查一查账户信息有无泄露", "url": "https://www.freebuf.com/news/182655.html", "time": "2018-09-04", "level": "", "num_look": 111790, "num_comment": 111790, "author": "Freddy", "tags": ["资讯"], "text": "加密货币平台Atlas Quantum遭遇安全漏洞，超过26万条用户信息被黑客窃取，数据包含客户姓名、电话号码、电子邮件地址以及帐户余额。"}
{"title": "恶意软件DNSMESSENGER分析", "url": "https://www.freebuf.com/articles/network/182439.html", "time": "2018-09-04", "level": "", "num_look": 141787, "num_comment": 141787, "author": "周大涛", "tags": ["网络安全"], "text": "在这篇文章中，我将给大家介绍一种通过分析DNSMessenger恶意软件提取的方法，通过这个例子结果，你们可以讨论我使用的方法，并思考每个步骤的过程。"}
{"title": "通过邮件大规模传播窃密木马的事件分析", "url": "https://www.freebuf.com/vuls/182647.html", "time": "2018-09-04", "level": "", "num_look": 203155, "num_comment": 4, "author": "兰云科技银河实验室", "tags": ["安全报告", "漏洞"], "text": "最近，发现一大批通过恶意邮件进行传播的PasswordStealer木马，木马采用.net 编写，传播初期可以绕开绝大多数传统杀毒软件的检测，危害极大。"}
{"title": "划重点！WitAwards 2018 新设现场奖与评选规则解读", "url": "https://www.freebuf.com/news/182905.html", "time": "2018-09-04", "level": "", "num_look": 89197, "num_comment": 89197, "author": "FB独家", "tags": ["活动", "资讯"], "text": "一分钟了解WitAwards 现场最受欢迎奖项与计票规则~"}
{"title": "BUF 早餐铺 | Android API breaking漏洞曝光；手机过热可能是遭到恶意挖矿软件攻击；飞利浦发布报告称其设备存在9个安全漏洞", "url": "https://www.freebuf.com/news/183009.html", "time": "2018-09-04", "level": "", "num_look": 92737, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "移动端安全问题日益严重~"}
{"title": "ASWCrypter：该工具生成的Payload可以绕过目前所有的反病毒产品", "url": "https://www.freebuf.com/sectool/182483.html", "time": "2018-09-03", "level": "", "num_look": 285000, "num_comment": 8, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫ASWCrypter的Bash&Python脚本，该工具所生成的Payload可以绕过目前所有的反病毒产品。"}
{"title": "十年前，有人黑进了耶鲁大学的服务器", "url": "https://www.freebuf.com/news/182560.html", "time": "2018-09-03", "level": "", "num_look": 182048, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "十年前，有人成功入侵了耶鲁大学的服务器，但是由于这件事情发生在十年之前，因此我们无法得知关于此次事件的详细信息以及发生的前后经过。"}
{"title": "自己动手打造工具系列之自动刷新简历", "url": "https://www.freebuf.com/articles/others-articles/182389.html", "time": "2018-09-03", "level": "金币+10", "num_look": 238579, "num_comment": 6, "author": "ztencmcp", "tags": ["其他", "极客"], "text": "今天带来自己动手打造工具系列之自动刷新简历。本文主要是针对喜欢写工具的童鞋提供一些思路，并一步一步地分析思路和方法，起一个抛砖引玉的作用吧。"}
{"title": "样本分析 | Osiris中使用的Process Doppelgänging和Process Hollowing技术", "url": "https://www.freebuf.com/articles/system/181971.html", "time": "2018-09-03", "level": "", "num_look": 139230, "num_comment": 1, "author": "Covfefe", "tags": ["系统安全"], "text": "模仿合法进程通常是恶意软件作者最喜欢使用的技术，多年来，这个话题也被研究者和工程师津津乐道，因为其对于Windows API的使用也非常有创意。"}
{"title": "平安科技集团信息安全运营中心招聘", "url": "https://www.freebuf.com/jobs/181715.html", "time": "2018-09-03", "level": "", "num_look": 188930, "num_comment": 1, "author": "银河实验室", "tags": ["安全招聘"], "text": "平安科技受托于平安集团，是唯一向集团公司和集团所有下属子公司提供IT规划、开发和运营服务的IT服务提供商。"}
{"title": "漏洞预警 | ECShop全系列版本远程代码执行高危漏洞", "url": "https://www.freebuf.com/vuls/182899.html", "time": "2018-09-03", "level": "", "num_look": 1186119, "num_comment": 5, "author": "阿里云安全", "tags": ["漏洞", "网络安全"], "text": "近日利用ECShop全系列版本的远程代码执行漏洞进行批量化攻击量呈上升趋势。该漏洞利用简单且危害较大，黑客可通过WEB攻击直接获得服务器权限。"}
{"title": "基于深度学习的恶意样本行为检测（含源码）", "url": "https://www.freebuf.com/articles/system/182566.html", "time": "2018-09-03", "level": "", "num_look": 459289, "num_comment": 20, "author": "云影实验室", "tags": ["系统安全"], "text": "本文采用CNN深度学习算法对Cuckoo沙箱的动态行为日志进行检测和分类尝试，分别测试了二分类和多分类方法，效果还有不小提升空间，希望共同交流。"}
{"title": "延禧攻略大结局，黑产利用盗版收割红利，上亿版权巨制5块钱就能拥有", "url": "https://www.freebuf.com/news/182480.html", "time": "2018-09-03", "level": "", "num_look": 444281, "num_comment": 9, "author": "GEETEST极验", "tags": ["网络安全", "资讯"], "text": "几亿元版权费的《延禧攻略》仅需几十元就可拥有全集资源！VIP账号共享风险大、“教育优惠”也暗藏猫腻......黑产助力盗版野蛮生长，侵权行为为何屡禁不止？"}
{"title": "BUF 早餐铺 | 日本考虑禁止华为中兴的通信设备；Windows 10被曝漏洞：受害者电脑沦为“肉鸡”；Mozilla Firefox将默认阻止所有跟踪器", "url": "https://www.freebuf.com/news/182831.html", "time": "2018-09-03", "level": "", "num_look": 137249, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "日本政府计划禁止中国两家通信公司华为和中兴参与建设信息系统的投标，原因是基于“安全保障”考虑，美国和澳大利亚均把这两家中企视为“问题公司”。"}
{"title": "CVE-2018-8412：通过MS Office for Mac的Legacy Package进行提权", "url": "https://www.freebuf.com/articles/system/182339.html", "time": "2018-09-02", "level": "", "num_look": 154381, "num_comment": 1, "author": "secist", "tags": ["系统安全"], "text": "MS Office for Mac存在漏洞，可通过Legacy Package进行提权。"}
{"title": "Shellcode与加密流量之间的那些事儿", "url": "https://www.freebuf.com/articles/database/182160.html", "time": "2018-09-02", "level": "", "num_look": 192216, "num_comment": 192216, "author": "Alpha_h4ck", "tags": ["数据安全"], "text": "在这篇文章中，我们将简单介绍如何在通过TCP通信的位置无关代码（PIC）中实现数据加密。"}
{"title": "DarkHydrus使用Phishery在中东地区窃取凭证", "url": "https://www.freebuf.com/articles/network/180255.html", "time": "2018-09-02", "level": "", "num_look": 136659, "num_comment": 3, "author": "Hydralab", "tags": ["网络安全"], "text": "在上周，Unit 42发表了一个篇关于介绍一个名为DarkHydrus的新威胁组织的博文，我们观察到该组织的目标是位于中东地区的政府实体。"}
{"title": "2018年上半年无文件/PowerShell恶意活动飙升至新高度", "url": "https://www.freebuf.com/news/182502.html", "time": "2018-09-02", "level": "", "num_look": 152220, "num_comment": 2, "author": "Freddy", "tags": ["资讯"], "text": "2018年上半年，勒索软件的传播态势依然十分严峻，同时无文件和PowerShell的攻击数量激增，已成为今年要重点关注的领域。"}
{"title": "Aws_Public_Ips：获取AWS账户关联的所有IP地址(IPv4IPv6)的工具", "url": "https://www.freebuf.com/sectool/182484.html", "time": "2018-09-01", "level": "", "num_look": 153509, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "Aws_Public_Ips是一个可帮助你获取与AWS账户关联的，所有IP地址(IPv4/IPv6) 的工具。"}
{"title": "技术讨论 | 通过Password Vault的XSS漏洞获取用户密码测试", "url": "https://www.freebuf.com/articles/database/182205.html", "time": "2018-09-01", "level": "红色标题", "num_look": 207350, "num_comment": 3, "author": "secist", "tags": ["数据安全"], "text": "今天，我想和大伙分享一些非常有意思的内容。为了存储及管理的方便，相信大家可能都会选择使用一些密码管理器来存储不同网站的密码（例如Facebook，Gmail等其他帐户）。"}
{"title": "【FB TV】一周「BUF大事件」：Windows任务管理器发现0-day漏洞；Fortnite安卓应用被曝存在高风险安全漏洞", "url": "https://www.freebuf.com/video/182847.html", "time": "2018-09-01", "level": "红色标题", "num_look": 201877, "num_comment": 201877, "author": "willhuang", "tags": ["视频"], "text": "Windows任务管理器出现0-day漏洞；WitAwards 2018互联网安全年度评选正式启动；Fortnite安卓应用被曝存在高风险安全漏洞。"}
{"title": "主机应急响应与电子取证的经验分享", "url": "https://www.freebuf.com/vuls/182220.html", "time": "2018-09-01", "level": "现金奖励", "num_look": 243336, "num_comment": 6, "author": "si1ence", "tags": ["漏洞", "终端安全"], "text": "随着主机安全的问题日渐突显，仅仅依靠传统的安全工具不能完全查杀出相关恶意程序。安全事件需要从多个方面去检查与清除，抛砖引玉提出以下思路供参考。"}
{"title": "PHP phar：协议对象注入技术介绍", "url": "https://www.freebuf.com/articles/web/182231.html", "time": "2018-08-31", "level": "", "num_look": 211856, "num_comment": 2, "author": "周大涛", "tags": ["WEB安全"], "text": "在之前的BlackHat 2018大会上公布了一款针对PHP应用程序的全新攻击技术。我们将通过这篇文章简单介绍下。"}
{"title": "技术分享 | 一种针对PHP对象注入漏洞的新型利用方法", "url": "https://www.freebuf.com/articles/system/182197.html", "time": "2018-08-31", "level": "", "num_look": 195726, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "就在前段时间的BlackHat黑客大会上，来自Secarma的安全研究专家Sam Thomas介绍了一种可导致严重PHP对象注入漏洞出现的新型漏洞利用技术。"}
{"title": "God.Game漏洞复盘：跑路还是黑客攻击？", "url": "https://www.freebuf.com/articles/blockchain-articles/182024.html", "time": "2018-08-31", "level": "", "num_look": 161136, "num_comment": 161136, "author": "安比实验室SECBIT", "tags": ["区块链安全"], "text": "8 月 22 日，一个名不见经传的游戏God.Game发出通告，声称遭遇黑客攻击，游戏内的以太币被黑客全部转走。"}
{"title": "这下好了，家里的智能灯泡都会泄露数据了", "url": "https://www.freebuf.com/news/182364.html", "time": "2018-08-31", "level": "红色标题", "num_look": 336018, "num_comment": 3, "author": "Freddy", "tags": ["资讯"], "text": "近日，来自国外的研究人员提出了一种新的技术，可以从智能灯泡获取用户的数据。举个例子，研究人员能够从远处记录智能灯泡的亮度模式来获取用户的偏好。"}
{"title": "利用基础数据对某IDC大量网站被黑进行关联分析", "url": "https://www.freebuf.com/articles/web/182117.html", "time": "2018-08-31", "level": "现金奖励", "num_look": 235560, "num_comment": 7, "author": "feiniao", "tags": ["WEB安全"], "text": "近日，“云悉”互联网安全监测平台监测到大量企事业单位及高中专院校大量出现博彩类信息，大量网站其页面被植入博彩信息。笔者对这些被攻击的网站以及手法进行了一番探究。"}
{"title": "子弹短信跑太快，隐私泄露涉黄，谁之过", "url": "https://www.freebuf.com/articles/neopoints/182728.html", "time": "2018-08-31", "level": "红色标题", "num_look": 622154, "num_comment": 13, "author": "GEETEST极验", "tags": ["观点"], "text": "老罗仍然用一贯“改变世界”的口吻向世界宣布，子弹短信上线仅7天完成第一轮1.5亿元融资。但是近日产品爆出“信息泄露”、“涉黄社交”等安全隐患，想要冲破微信、短信原有的社交生态，初生的子弹短信究竟能走多远？"}
{"title": "BUF 早餐铺 | 超八成受访者因泄露隐私遭遇推销骚扰；加拿大航空手机App用户数据被黑客窃取；FBI 否认有证据显示中国黑客入侵了希拉里电邮", "url": "https://www.freebuf.com/news/182695.html", "time": "2018-08-31", "level": "", "num_look": 143710, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "中国消费者协会发布的《APP个人信息泄露情况调查报告》显示，超八成受访者曾遭遇个人信息泄露问题，其中常见情形为推销电话、短信骚扰、诈骗电话、垃圾邮件。"}
{"title": "XPwn 2018探索未来安全盛会，万物互联时代可以玩出哪些花活？", "url": "https://www.freebuf.com/fevents/182720.html", "time": "2018-08-31", "level": "红色标题", "num_look": 268341, "num_comment": 1, "author": "Akane", "tags": ["活动"], "text": "“黑客”这个词在中文里有点儿吃亏，因为“黑”这个字拖了后腿……不过回到本意Hacker，就没有任何的黑白之分了：他们的目标是为了探索世界，并努力让她变得更加美好。"}
{"title": "快讯 | 知名OCR软件被曝泄露超过20万份客户文件", "url": "https://www.freebuf.com/news/182371.html", "time": "2018-08-30", "level": "", "num_look": 139577, "num_comment": 139577, "author": "Freddy", "tags": ["资讯"], "text": "知名OCR软件ABBYY FineReader软件开发商的MongoDB服务器因配置错误导致超过20万份客户文件泄露。"}
{"title": "GitMiner：用于Github的高级敏感内容挖掘工具", "url": "https://www.freebuf.com/sectool/181986.html", "time": "2018-08-30", "level": "", "num_look": 379698, "num_comment": 9, "author": "secist", "tags": ["工具"], "text": "GitMiner是一款自动化的高级敏感内容挖掘工具。此工具旨在通过代码或代码片段在github搜索页面进行挖掘，并以此来证明公共存储库的脆弱性。"}
{"title": "代码审计 | DedeCMS v 5.7 sp2 RemoveXSS bypass", "url": "https://www.freebuf.com/vuls/181783.html", "time": "2018-08-30", "level": "现金奖励", "num_look": 262765, "num_comment": 4, "author": "q601333824", "tags": ["WEB安全", "漏洞"], "text": "DedeCMS 简称“织梦CMS”，当前最新版为 5.7 sp2,最近又去挖了挖这个CMS,发现过滤XSS的RemoveXSS函数存在缺陷导致可以被绕过。"}
{"title": "谈谈我所了解的WEB代理", "url": "https://www.freebuf.com/articles/web/181723.html", "time": "2018-08-30", "level": "现金奖励", "num_look": 347598, "num_comment": 7, "author": "somesomes", "tags": ["WEB安全", "网络安全"], "text": "在这里，和大家聊聊我自己所知道的一些关于Web代理的知识。"}
{"title": "McAfee针对GandCrab勒索软件的分析", "url": "https://www.freebuf.com/articles/system/181708.html", "time": "2018-08-30", "level": "", "num_look": 163043, "num_comment": 163043, "author": "周大涛", "tags": ["系统安全"], "text": "GandCrab勒索软件于1月首次出现，并在其短时间中迅速发展。现已由反恶意软件公司发布了其解密软件。"}
{"title": "Gartner 2018年中趋势汇总：我们真的能跟上趋势的发展吗？", "url": "https://www.freebuf.com/articles/security-management/181923.html", "time": "2018-08-30", "level": "金币+8", "num_look": 304772, "num_comment": 2, "author": "宇宸de研究室", "tags": ["企业安全", "安全管理"], "text": "Gartner每年都会发布一份“新兴技术炒作周期”报告，这已成为Gartner公司的一个惯例，为我们揭示了新兴技术趋势所遵循的模式。"}
{"title": "年度安全盛誉 | WitAwards 2018互联网安全年度评选（报名通道开启）", "url": "https://www.freebuf.com/news/topnews/182023.html", "time": "2018-08-30", "level": "红色标题", "num_look": 105911, "num_comment": 3, "author": "FB独家", "tags": ["头条"], "text": "FreeBuf将以最专业的角度和最公正的态度，发掘优秀行业案例，树立年度标杆，为数万名从业者和数百款安全产品的努力与创新喝彩。"}
{"title": "关于Ghostscript SAFER沙箱绕过漏洞的分析", "url": "https://www.freebuf.com/vuls/182095.html", "time": "2018-08-30", "level": "", "num_look": 192577, "num_comment": 3, "author": "alphalab", "tags": ["漏洞"], "text": "8月21日，Google安全研究员Tavis Ormandy披露了多个GhostScript的漏洞，通过在图片中构造恶意PostScript脚本，可以绕过SAFER安全沙箱，从而造成命令执行、文件读取、文件删除等漏洞。本文对该漏洞进行了解析。"}
{"title": "如何解密出被混淆的PowerShell脚本？", "url": "https://www.freebuf.com/articles/system/181697.html", "time": "2018-08-30", "level": "现金奖励", "num_look": 284613, "num_comment": 5, "author": "aWe18s", "tags": ["系统安全"], "text": "本文基于笔者在分析PowerShell病毒过程中的经验，总结了解密被混淆过的PowerShell脚本的一些方法。"}
{"title": "BUF早餐铺 | 研究人员在Windows任务管理器中发现零日漏洞；雅虎邮箱被爆大规模扫描用户邮件，将数据出售给广告商；网络安全行业平均月薪上万", "url": "https://www.freebuf.com/news/182586.html", "time": "2018-08-30", "level": "", "num_look": 160580, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "网络安全人才不论在政企机构，还是在安全企业，平均月薪皆过万，且实际薪资普遍高于预期，实现幸福“倒挂”。"}
{"title": "【公开课剧透社】零基础到百万年薪，漫漫白帽从业路 | 知识点提前看！", "url": "https://www.freebuf.com/fevents/181158.html", "time": "2018-08-29", "level": "红色标题", "num_look": 359964, "num_comment": 8, "author": "FB客服", "tags": ["FreeBuf公开课", "活动"], "text": "安全圈实战精英白帽、倾囊相授战斗在第一线多年经验。只为渴求知识的你"}
{"title": "【报名即可学习 | 精品公开课】实战白帽倾囊相授，渗透测试入门指南", "url": "https://www.freebuf.com/fevents/181895.html", "time": "2018-08-29", "level": "红色标题", "num_look": 748938, "num_comment": 22, "author": "FB客服", "tags": ["FreeBuf公开课", "活动"], "text": "再也不用羡慕王多鱼的暴富人生了（特别提示：本系列为安全入门课程）"}
{"title": "JoomScan：一款开源的OWASP Joomla漏洞扫描器", "url": "https://www.freebuf.com/sectool/181440.html", "time": "2018-08-29", "level": "", "num_look": 291518, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具", "系统安全"], "text": "漏洞扫描器（JoomScan）是一个开源项目，其主要目的是实现漏洞检测的自动化，以增强Joomla CMS开发的安全性。"}
{"title": "来自11家OEM厂商的智能手机容易遭到隐藏AT指令攻击", "url": "https://www.freebuf.com/news/182216.html", "time": "2018-08-29", "level": "", "num_look": 130178, "num_comment": 4, "author": "Freddy", "tags": ["资讯"], "text": "国外的安全研究人员发现，来自11家智能手机OEM厂商的数百万台移动设备容易遭到隐藏AT命令攻击。"}
{"title": "你的“苹果”可能有毒！变身“搭讪”利器，被“黑化”的AirDrop", "url": "https://www.freebuf.com/articles/terminal/182126.html", "time": "2018-08-29", "level": "红色标题", "num_look": 337467, "num_comment": 16, "author": "GEETEST极验", "tags": ["终端安全"], "text": "人们越来越依赖苹果产品所带来便利的同时，频发的安全、骚扰事件，让我们手中的“苹果”变成了定时炸弹......"}
{"title": "研究人员新发现，发送传真即可入侵网络", "url": "https://www.freebuf.com/news/181617.html", "time": "2018-08-29", "level": "", "num_look": 159388, "num_comment": 3, "author": "Covfefe", "tags": ["资讯"], "text": "黑客入侵网络所需要的仅仅是一个传真号码，而在企业网站中可以轻易获取传真号码，实在不行也可以直接询问。"}
{"title": "“心跳助手”暗藏玄机，”双生花”暗刷木马家族“借尸还魂”", "url": "https://www.freebuf.com/articles/paper/182108.html", "time": "2018-08-29", "level": "", "num_look": 180587, "num_comment": 2, "author": "安全豹", "tags": ["安全报告"], "text": "近期，金山毒霸安全实验室通过“捕风”威胁感知系统的监控数据，追踪发现一款名为“心跳助手”的安卓手游模拟器软件暗藏流量暗刷类病毒。"}
{"title": "CVE-2018-8414：SettingContent-ms文件任意代码执行漏洞及在野攻击分析", "url": "https://www.freebuf.com/vuls/182005.html", "time": "2018-08-29", "level": "", "num_look": 221161, "num_comment": 2, "author": "奇安信威胁情报中心", "tags": ["漏洞"], "text": "2018年8月14日，微软发布了针对该缺陷的系统补丁，对应的漏洞编号为：CVE-2018-8414。360威胁情报中心在该攻击技术公开的第一时间便密切跟踪相关的在野攻击样本。"}
{"title": "小米智能家居设备流量分析及脚本控制", "url": "https://www.freebuf.com/articles/terminal/181846.html", "time": "2018-08-29", "level": "现金奖励", "num_look": 357592, "num_comment": 10, "author": "scu-igroup", "tags": ["终端安全"], "text": "小米智能家居设备使用相当方便，下载米家APP，手机上就能操控。那它到底是怎么实现的操控呢，既然，我们是搞流量分析的，那就先从流量开始吧。"}
{"title": "BUF早餐铺 | Atlas Quantum数字货币投资平台数据泄露；黑客劫持埃隆·马斯克推特账号，发帖称提供免费加密货币", "url": "https://www.freebuf.com/news/182410.html", "time": "2018-08-29", "level": "", "num_look": 108167, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "个人信息安全，不容忽视。"}
{"title": "第四届CSS峰会Day 2，一起听腾讯大佬聊DDoS攻防", "url": "https://www.freebuf.com/fevents/182437.html", "time": "2018-08-29", "level": "红色标题", "num_look": 251128, "num_comment": 4, "author": "Akane", "tags": ["活动"], "text": "有这么一种攻击技术，最早可追溯到1996年，基本可以算是互联网黑产界的活化石了。这种古老的攻击方式经过近二十年的演变沿用至今，成本低、效果好，甚至在今年年初刷新了攻击流量记录……"}
{"title": "PowerGhost：一款在野的多功能挖矿恶意软件分析", "url": "https://www.freebuf.com/articles/network/181441.html", "time": "2018-08-28", "level": "", "num_look": 209547, "num_comment": 209547, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "近期卡巴斯基实验室的检测雷达发现了一款恶意挖矿软件，名叫PowerGhost，感染了目标主机之后不仅可以在后台挖矿，还能够感染企业大型网络内的其他主机。"}
{"title": "商业云服务平台正在成为黑客对用户下手的渠道", "url": "https://www.freebuf.com/news/181900.html", "time": "2018-08-28", "level": "", "num_look": 142292, "num_comment": 142292, "author": "Freddy", "tags": ["资讯"], "text": "来自国外的Threat Stack网络安全团队的研究人员表示黑客利用正在利用商业云服务平台的特性对目标用户发起恶意活动，并隐藏自己的行踪。"}
{"title": "三个Android蓝牙组件漏洞详情", "url": "https://www.freebuf.com/articles/terminal/181421.html", "time": "2018-08-28", "level": "", "num_look": 363779, "num_comment": 363779, "author": "周大涛", "tags": ["终端安全"], "text": "2018年3月，Quarkslab向Google报告了Android蓝牙协议栈中的漏洞，我们来详细分析一下。"}
{"title": "黑产，彼之蜜糖，滴滴之砒霜", "url": "https://www.freebuf.com/articles/network/182208.html", "time": "2018-08-28", "level": "红色标题", "num_look": 609493, "num_comment": 20, "author": "GEETEST极验", "tags": ["网络安全"], "text": "谣言，世界最古老的传媒。顺风车出事之后，各种猜测就没停止过。实际上黑产一直都在，并不以我们的关注高低而转移。"}
{"title": "CSS2018安全领袖峰会：首创AE50网络安全产学研合作协同育人联席会，产学研结合共建人才培养新体系", "url": "https://www.freebuf.com/fevents/182571.html", "time": "2018-08-28", "level": "", "num_look": 63825, "num_comment": 63825, "author": "shidongqi", "tags": ["活动"], "text": "以“安全强驱动，数字新生态”为主题的第四届互联网安全领袖峰会上，由教育部信息安全教指委指导，腾讯安全与绿盟科技联合主办的“AE50安全产学研论坛”于8月28日在北京召开。"}
{"title": "招商银行招聘安全分析与渗透测试岗位", "url": "https://www.freebuf.com/jobs/182201.html", "time": "2018-08-28", "level": "", "num_look": 241158, "num_comment": 15, "author": "xysky", "tags": ["安全招聘"], "text": "外部网络世界还不是很太平，内部也可能存在着个别有“想法”的员工，所以持续的对抗外部网络攻击和发现内部用户异常行为是我们永恒的职责。"}
{"title": "关于Apache Struts2 S2-057远程代码执行漏洞分析", "url": "https://www.freebuf.com/vuls/182101.html", "time": "2018-08-28", "level": "", "num_look": 455643, "num_comment": 5, "author": "alphalab", "tags": ["漏洞"], "text": "Struts框架是Jakarta工程的一部分，由Apache软件基金会管理。天融信阿尔法实验室将为你带来Apache Struts2 S2-057远程代码执行漏洞分析~"}
{"title": "Fomo3D千万大奖获得者“特殊攻击技巧”最全揭露", "url": "https://www.freebuf.com/articles/blockchain-articles/181879.html", "time": "2018-08-28", "level": "", "num_look": 156038, "num_comment": 156038, "author": "安比实验室SECBIT", "tags": ["区块链安全"], "text": "安比（SECBIT）实验室昨日首个发现 Fomo3D 大奖获得者采取一些“特殊攻击技巧”，使得游戏临近结束时，矿工打包入区块内的交易数量骤减（涉及连续多个区块），从而起到加速游戏结束和提高胜率的作用。"}
{"title": "打造一款自己的勒索软件预警系统", "url": "https://www.freebuf.com/sectool/182037.html", "time": "2018-08-28", "level": "现金奖励", "num_look": 200724, "num_comment": 10, "author": "刀郎", "tags": ["工具", "系统安全"], "text": "最近勒索软件比较火啊，一波接一波，在一些防护软件看来它是正常的，怎么判断是正常软件对文档进行编辑还是勒索软件是一个大问题。"}
{"title": "BUF早餐铺 | 智能手机遭到隐藏AT指令攻击；边信道攻击方式使用麦克风来读取屏幕内容；超过200万T-Mobile用户数据泄露", "url": "https://www.freebuf.com/news/182237.html", "time": "2018-08-28", "level": "", "num_look": 104737, "num_comment": 104737, "author": "Freddy", "tags": ["资讯"], "text": "“滴滴”顺风车也因存在重大安全隐患在全国范围内下线。这距离郑州空姐遇害案仅仅过了3个月。如何避免此类悲剧重演？"}
{"title": "安全驱动下的数字新生活，第四届CSS互联网安全领袖峰会随笔", "url": "https://www.freebuf.com/fevents/182297.html", "time": "2018-08-28", "level": "红色标题", "num_look": 329567, "num_comment": 4, "author": "Akane", "tags": ["活动"], "text": "短短10年时间就能改变一代人乃至整个社会的生活习惯，2050年咱球该有多发达啊！很多科幻片儿的概念，可能正在慢慢变成现实……"}
{"title": "Pure Blood v2.0：白帽子、Bug猎人专用的开源渗透测试框架", "url": "https://www.freebuf.com/sectool/180626.html", "time": "2018-08-27", "level": "", "num_look": 298003, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["工具", "数据安全"], "text": "一款名叫Pure Blood的渗透测试框架，专为白帽子、渗透测试人员和Bug猎人设计，可实现多种渗透测试及信息收集功能。"}
{"title": "狂砸百亿美金，黑产半路截胡，视频三巨头被迫上演“抢钱大战”", "url": "https://www.freebuf.com/articles/network/181737.html", "time": "2018-08-27", "level": "红色标题", "num_look": 358974, "num_comment": 13, "author": "GEETEST极验", "tags": ["网络安全"], "text": "一边是，美报告：中国电视节目支出全球第二，万亿市场未来可期；另一边，视频三大巨头且“亏”且行，难念“盈利经”……"}
{"title": "利用Marap downloader收集系统信息，TA505要搞大事情？", "url": "https://www.freebuf.com/news/181714.html", "time": "2018-08-27", "level": "", "num_look": 113756, "num_comment": 1, "author": "Hydralab", "tags": ["资讯"], "text": "Proofpoint的研究人员最近在一场大型的垃圾电子邮件活动（有数百万封电子邮件被分发）中发现了一种新的downloader，主要针对金融机构。"}
{"title": "通过APACHE ACCESS LOG来利用LFI漏洞", "url": "https://www.freebuf.com/articles/web/181263.html", "time": "2018-08-27", "level": "", "num_look": 188217, "num_comment": 4, "author": "secist", "tags": ["WEB安全"], "text": "本文带你了解如何通过本地文件包含来获取服务器上的浏览器shell。"}
{"title": "【限时特价|精品公开课】前乌云版主独家秘籍，那些年我蹲过的点之APT渗透测试经验分享", "url": "https://www.freebuf.com/fevents/181487.html", "time": "2018-08-27", "level": "红色标题", "num_look": 395672, "num_comment": 24, "author": "FB客服", "tags": ["FreeBuf公开课", "活动"], "text": "前乌云多板块版主、现御风维安科技CEO王骕，受邀分享独门秘籍——APT渗透测试经验。"}
{"title": "《CSS视角下的2018年全球网络安全十大议题》重磅首发，洞悉发展风向聚产业合力", "url": "https://www.freebuf.com/fevents/182564.html", "time": "2018-08-27", "level": "", "num_look": 51668, "num_comment": 51668, "author": "shidongqi", "tags": ["活动"], "text": "腾讯安全联合实验室负责人吴宇重磅发布《CSS视角下的2018年全球网络安全十大议题》，涵盖关键基础设施安全，数字金融安全，以及前沿科技安全等内容。"}
{"title": "多省多家大型企业遭遇GlobeImposter勒索病毒袭击，文件被加密为.WALKER扩展名", "url": "https://www.freebuf.com/articles/es/182207.html", "time": "2018-08-27", "level": "", "num_look": 230742, "num_comment": 230742, "author": "腾讯电脑管家", "tags": ["企业安全"], "text": "国内某重要通信企业多地子公司发生GlobeImposter勒索病毒攻击事件，其加密后将文件后缀名改为“WALKER”。"}
{"title": "大疆创新信息安全部招聘", "url": "https://www.freebuf.com/jobs/182038.html", "time": "2018-08-27", "level": "", "num_look": 153003, "num_comment": 9, "author": "大djii1", "tags": ["安全招聘"], "text": "技术创新是大疆的立足之本。从飞行控制系统起家，大疆凭借稳定高效的消费级和专业级的航拍飞行平台为人熟知，并将技术移植到地面增稳设备，实现“天地一体”的拍摄解决方案。"}
{"title": "CSS2018腾讯丁珂：两大路径，“一横一纵”构建数字安全新生态", "url": "https://www.freebuf.com/fevents/182574.html", "time": "2018-08-27", "level": "", "num_look": 60149, "num_comment": 60149, "author": "shidongqi", "tags": ["活动"], "text": "在上午的开幕式致辞中，腾讯高级副总裁丁珂围绕四个关键词：行业共建、生态共治、政府监管和企业自律，对数字经济时代的安全趋势做了研判和解读。"}
{"title": "Struts2-057 两个版本RCE漏洞分析（含EXP）", "url": "https://www.freebuf.com/vuls/182097.html", "time": "2018-08-27", "level": "", "num_look": 316239, "num_comment": 2, "author": "云影实验室", "tags": ["WEB安全", "漏洞"], "text": "Apache Strust2发布最新安全公告，Apache Struts2存在远程代码执行的高危漏洞（S2-057/CVE-2018-11776）"}
{"title": "互联网金融企业数据安全建设启示", "url": "https://www.freebuf.com/articles/database/181470.html", "time": "2018-08-27", "level": "", "num_look": 180929, "num_comment": 1, "author": "安华金和", "tags": ["数据安全"], "text": "当今互联网已经延伸出一系列新兴的金融服务模式，云计算、大数据、人工智能等新技术的应用在深刻改变金融服务的同时，也会带来系统风险等安全问题。"}
{"title": "MetInfo任意文件读取漏洞的修复与绕过", "url": "https://www.freebuf.com/vuls/181698.html", "time": "2018-08-27", "level": "", "num_look": 327133, "num_comment": 2, "author": "Knownsec知道创宇", "tags": ["漏洞", "系统安全"], "text": "404实验室内部的WAM监控到MetInfo版本更新，应该是修复了一个任意文件读取漏洞，但是还可以被绕过，本文就是记录这个漏洞的修复与绕过的过程。"}
{"title": "希望我还能保存一点那些叫做“隐私”的东西", "url": "https://www.freebuf.com/articles/neopoints/181853.html", "time": "2018-08-27", "level": "", "num_look": 168855, "num_comment": 2, "author": "shidongqi", "tags": ["观点"], "text": "隐私泄露就像是一根细到几乎不存在的银针，没扎你一次你却几乎感觉不到痛，等你真正发觉之时，谁也说不清你究竟已经被扎过多少次，细思极恐……"}
{"title": "BUF早餐铺 | 苹果强制下架Facebook VPN；新安卓间谍软件框架 Triout 出现；侵犯公民个人信息形成黑灰产业链，警方两年查获超1400亿条", "url": "https://www.freebuf.com/news/182118.html", "time": "2018-08-27", "level": "", "num_look": 128027, "num_comment": 128027, "author": "AngelaY", "tags": ["资讯"], "text": "警方的统计数据显示，两年多来，各地查获的公民个人信息超过1400亿条，平均全国每个人有100多条信息泄露。"}
{"title": "Struts2-057（CVE-2018-11776）漏洞分析", "url": "https://www.freebuf.com/vuls/182006.html", "time": "2018-08-26", "level": "金币+8", "num_look": 279621, "num_comment": 2, "author": "路上路人路过", "tags": ["漏洞"], "text": "Struts2-057,2018/8/22刚爆发的一个struts2的远程代码执行漏洞，网上已经有很多复现的文章了，这里并不打算对漏洞做复现，只是在代码层面研究漏洞。"}
{"title": "PhishPoint网络钓鱼攻击：一种绕过Microsoft Office 365保护的新技术", "url": "https://www.freebuf.com/news/182155.html", "time": "2018-08-26", "level": "金币+8", "num_look": 126200, "num_comment": 126200, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "近期，来自云安全公司Avanan的安全研究专家发现了一种名叫PhishPoint的新型攻击技术，而这种攻击技术将允许攻击者绕过Microsoft Office365的保护机制。"}
{"title": "OWTF：一款功能强大的攻击型Web测试框架", "url": "https://www.freebuf.com/sectool/181438.html", "time": "2018-08-26", "level": "", "num_look": 201355, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍一款名叫OWTF（Offensive Web Testing Framework-攻击型Web测试框架），该框架整合了多种优秀的工具，可以有效提升渗透测试的效率。"}
{"title": "通过内存转储打破Linux全盘加密保护", "url": "https://www.freebuf.com/articles/database/181010.html", "time": "2018-08-26", "level": "", "num_look": 199871, "num_comment": 199871, "author": "secist", "tags": ["数据安全"], "text": "如何在主机上成为root用户获取全盘加密运行虚拟机中数据的访问权限？这是我们在Appsecco内部讨论的一个问题，我们需要一个合理而可能的解决方案。"}
{"title": "你知道吗？图形验证码可能导致服务器崩溃", "url": "https://www.freebuf.com/vuls/181399.html", "time": "2018-08-26", "level": "金币+8", "num_look": 297694, "num_comment": 12, "author": "1wuxin1", "tags": ["WEB安全", "漏洞"], "text": "图片验证码是为了防止恶意破解密码、刷票、论坛灌水等才出现的，但是你有没有想过，你的图形验证码竟然可能导致服务器的崩溃？"}
{"title": "搭建dvwa环境学习从MySql注入到GetShell", "url": "https://www.freebuf.com/vuls/181537.html", "time": "2018-08-26", "level": "金币+8", "num_look": 456101, "num_comment": 18, "author": "zhengpengfei", "tags": ["WEB安全", "漏洞"], "text": "通过查资料，总结出了这篇文章，把自己心路历程写出来分享给初学者也希望能得到大牛的指正，希望入门级玩家能共勉，自己多创建学习的环境，多思考。"}
{"title": "sRDI：一款通过Shellcode实现反射型DLL注入的强大工具", "url": "https://www.freebuf.com/sectool/181426.html", "time": "2018-08-25", "level": "", "num_look": 256601, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫sRDI的注入工具，它可以基于Shellcode实现反射型DLL注入，并能够将DLL转换成独立的Shellcode。"}
{"title": "关于地下比特币ATM恶意软件的调查", "url": "https://www.freebuf.com/articles/blockchain-articles/181003.html", "time": "2018-08-25", "level": "", "num_look": 121165, "num_comment": 121165, "author": "周大涛", "tags": ["区块链安全"], "text": "比特币ATM并不是传统意义上的ATM，而是更像是一个允许用户连接到交换机的终端。"}
{"title": "【FB TV】一周「BUF大事件」：红芯浏览器的“创新内核”；谷歌被指非法追踪用户位置信息；微软8月安全更新修复60个漏洞", "url": "https://www.freebuf.com/video/182098.html", "time": "2018-08-25", "level": "红色标题", "num_look": 126091, "num_comment": 1, "author": "willhuang", "tags": ["视频"], "text": "国产红芯浏览器被指作假，实为Chrome换壳产品；谷歌被指非法追踪用户位置信息；微软8月安全更新修复60个漏洞。"}
{"title": "分析一个用于传播Hancitor恶意软件的Word文档（第一部分）", "url": "https://www.freebuf.com/articles/system/181023.html", "time": "2018-08-25", "level": "", "num_look": 132370, "num_comment": 132370, "author": "Hydralab", "tags": ["系统安全"], "text": "由于Hancitor通常被用于下载Pony和ZeusPanda恶意软件，因此我决定对这个文档进行分析，以了解程序流程和功能。"}
{"title": "利用CVE-2018-8373 0day漏洞的攻击与Darkhotel团伙相关的分析", "url": "https://www.freebuf.com/articles/system/181482.html", "time": "2018-08-25", "level": "", "num_look": 235160, "num_comment": 1, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "CVE-2018-8373其实是今年以来被发现的影响Windows VBScript Engine的第三个漏洞，通过分析可确认与DarkHotelAPT组织存在关联。"}
{"title": "渗透测试神器Burp Suite现已推出2.0测试版", "url": "https://www.freebuf.com/sectool/182028.html", "time": "2018-08-24", "level": "", "num_look": 368489, "num_comment": 9, "author": "Freddy", "tags": ["工具"], "text": "Burp Suite是进行Web应用安全测试的一个集成平台，无缝融合各种安全工具并提供全面的接口适配，支持完整的Web应用测试流程。"}
{"title": "CloudMapper：一款帮助你分析Amazon Web Services环境安全性的强大工具", "url": "https://www.freebuf.com/sectool/181141.html", "time": "2018-08-24", "level": "", "num_look": 160543, "num_comment": 160543, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫CloudMapper的开源工具，该工具由Duo Security公司开发，主要针对的是Amazon Web Service（AWS）云环境。"}
{"title": "你说安全就安全？对红芯浏览器的一次安全测试", "url": "https://www.freebuf.com/articles/web/181502.html", "time": "2018-08-24", "level": "红色标题", "num_look": 1004649, "num_comment": 31, "author": "山东星维九州安全技术有限公司", "tags": ["WEB安全"], "text": "红芯浏览器被官方标榜为“安全、稳定、可控的企业浏览器”，但其质量饱受质疑，不知被官方放在第一项进行宣传的“安全”是否属实呢？"}
{"title": "看我如何hack BlackHat：使用BCard API枚举注册与会者", "url": "https://www.freebuf.com/vuls/181743.html", "time": "2018-08-24", "level": "金币+8", "num_look": 131683, "num_comment": 131683, "author": "生如夏花", "tags": ["漏洞", "终端安全"], "text": "今年在 BlackHat 的培训期间，展会的NFC标签引起了我的兴趣"}
{"title": "隐藏在证书文件中的PowerShell（一）", "url": "https://www.freebuf.com/articles/terminal/180790.html", "time": "2018-08-24", "level": "", "num_look": 152766, "num_comment": 152766, "author": "clouds", "tags": ["终端安全"], "text": "NVISO实验室开发了某种YARA规则，利用它发现了多种恶意证书文件，这些文件是恶意PowerShell脚本，本文我们一起探讨如何制作这种规则。"}
{"title": "大数据时代下的隐私保护（三）", "url": "https://www.freebuf.com/articles/database/181307.html", "time": "2018-08-24", "level": "", "num_look": 658703, "num_comment": 2, "author": "百度安全实验室", "tags": ["数据安全"], "text": "在大数据时代，数据带来了巨大价值的同时，也带来了隐私保护方面的难题，如何在开发应用的过程中保护用户隐私和防止敏感信息泄露成为新的挑战。"}
{"title": "Last Winner的最后赢家：智能合约超大规模黑客攻击手法曝光", "url": "https://www.freebuf.com/vuls/181486.html", "time": "2018-08-24", "level": "", "num_look": 215198, "num_comment": 215198, "author": "安比实验室SECBIT", "tags": ["区块链安全", "漏洞"], "text": "Last Winner（类 Fomo3D）游戏大火，导致以太坊异常拥堵，Gas 费用暴涨，大量以太币资金入场。"}
{"title": "勒索病毒（CrySiS家族）最新变种分析", "url": "https://www.freebuf.com/articles/system/181498.html", "time": "2018-08-24", "level": "", "num_look": 273748, "num_comment": 273748, "author": "alphalab", "tags": ["系统安全"], "text": "近期，天融信阿尔法实验室捕获到了一款最新的勒索病毒软件，经过分析确定该样本是CrySiS家族的变种。"}
{"title": "BUF早餐铺 | Chrome隐身模式仍可能泄露个人隐私；研究显示多数企业打补丁时效滞后一个月；GDPR施行三个月欧洲网站cookies使用量下降了22%", "url": "https://www.freebuf.com/news/181904.html", "time": "2018-08-24", "level": "", "num_look": 110324, "num_comment": 2, "author": "Akane", "tags": ["资讯"], "text": "一则专注于Web应用程序攻击趋势的最新报告显示，多数公司及组织需要一个多月才能修补其系统中存在的关键漏洞。"}
{"title": "一个FreeBSD下的内核级文件隐藏程序", "url": "https://www.freebuf.com/articles/system/180712.html", "time": "2018-08-23", "level": "金币+8", "num_look": 166247, "num_comment": 2, "author": "rochek", "tags": ["系统安全"], "text": "这是一个在内核里hook来隐藏文件的程序，可以在FreeBSD 11上使用。"}
{"title": "剖析CLDAP协议 Reflection DDoS", "url": "https://www.freebuf.com/articles/network/181884.html", "time": "2018-08-23", "level": "", "num_look": 225169, "num_comment": 2, "author": "斗象智能安全平台", "tags": ["网络安全"], "text": "2018年上半年，得益于Memcache近5万的反射放大倍数，DDoS的峰值流量已经达到了一个前所未有的新高度—1.7Tbps，这也使得Memcache ReDDoS成为目前DDoS的中坚力量。"}
{"title": "Neto：一款分析浏览器插件的专业安全工具", "url": "https://www.freebuf.com/sectool/180905.html", "time": "2018-08-23", "level": "", "num_look": 153084, "num_comment": 153084, "author": "Alpha_h4ck", "tags": ["工具", "网络安全"], "text": "Neto项目采用Python 3开发，可用于寻找和分析热门浏览器（例如Firefox和Chrome）插件及扩展的隐藏特性。"}
{"title": "开学在即，面对黑产磨刀霍霍，大家真的准备好了吗", "url": "https://www.freebuf.com/news/181266.html", "time": "2018-08-23", "level": "红色标题", "num_look": 337133, "num_comment": 14, "author": "GEETEST极验", "tags": ["资讯"], "text": "还有不到两周的时间，就要迎来开学的日子了。与此同时，黑产贪婪的魔爪，早已饥渴难耐，张开獠牙，静候即将登场的“金九银十”。"}
{"title": "左手便利，右手危险 | 盘点物联网安全的七个薄弱点", "url": "https://www.freebuf.com/news/181756.html", "time": "2018-08-23", "level": "", "num_look": 121220, "num_comment": 121220, "author": "Freddy", "tags": ["资讯"], "text": "诸如智能家居等形式的物联网设备正在深入人们的生活，在企业环境中物联网设备早已无处不在。因此物联网安全的重要性也越来越高，本文罗列了7个物联网应用的薄弱点供大家参考。"}
{"title": "董祎铖：建立企业安全应急响应“急救箱”", "url": "https://www.freebuf.com/articles/es/181260.html", "time": "2018-08-23", "level": "", "num_look": 217692, "num_comment": 1, "author": "仙人掌情报站", "tags": ["企业安全"], "text": "攻防对抗是企业安全治理工作中的常态。一方面，安全团队在实际攻击场景中不断提升技术水平和对抗能力；另一方面，红蓝对抗、攻防演练可以有效检验安全工作成果，验证安全机制有效性，找出差距。"}
{"title": "技术讨论 | 看我如何重置海康威视IP摄像机的管理员密码", "url": "https://www.freebuf.com/vuls/179892.html", "time": "2018-08-23", "level": "", "num_look": 996296, "num_comment": 5, "author": "周大涛", "tags": ["漏洞", "终端安全"], "text": "大多数制造商并不会强制用户设置安全密码，通常可以使用默认密码直接登录。但海康威视有些与众不同。"}
{"title": "CNNVD关于Apache Struts2 S2-057安全漏洞情况的通报", "url": "https://www.freebuf.com/vuls/181861.html", "time": "2018-08-23", "level": "", "num_look": 175886, "num_comment": 2, "author": "CNNVD", "tags": ["漏洞"], "text": "近日，国家信息安全漏洞库（CNNVD）收到关于Apache Struts2 S2-057安全漏洞（CNNVD-201808-740、CVE-2018-11776）情况的报送。"}
{"title": "悬镜安全招人了，各个岗位看过来！", "url": "https://www.freebuf.com/jobs/181739.html", "time": "2018-08-23", "level": "", "num_look": 128260, "num_comment": 3, "author": "悬镜安全实验室", "tags": ["安全招聘"], "text": "北京安普诺，由北京大学白帽黑客团队“Xmirror”主导创立，专注于动态数据中心和云计算租户侧的高级定向攻击防护。"}
{"title": "2018年上半年短视频行业黑灰产研究报告", "url": "https://www.freebuf.com/articles/paper/181757.html", "time": "2018-08-23", "level": "", "num_look": 392322, "num_comment": 2, "author": "永安在线", "tags": ["安全报告"], "text": "威胁猎人为您带来了《2018年上半年短视频行业黑灰产研究报告》与相关解读~"}
{"title": "深入了解Json Web Token之实战篇", "url": "https://www.freebuf.com/articles/web/181261.html", "time": "2018-08-23", "level": "金币+10", "num_look": 297183, "num_comment": 1, "author": "NinthDevilHunster", "tags": ["WEB安全"], "text": "在上一篇文章中，我介绍了 Json Web Token 的相关概念。在这篇文章中，我主要介绍JWT的相关攻击，并引用了一些CTF题目。"}
{"title": "幽灵间谍：TrickBot新变种运用“无文件”技术发起攻击", "url": "https://www.freebuf.com/articles/security-management/181500.html", "time": "2018-08-23", "level": "", "num_look": 226344, "num_comment": 226344, "author": "360安全", "tags": ["安全管理"], "text": "相比较过去出现过的“TrickBot”银行木马，该新变种攻击过程中无任何文件落地，包括载荷下载、窃密、屏幕截图在内的所用功能都由一段PowerShell命令完成。"}
{"title": "天融信资深培训讲师贾宝东专访：零基础到百万年薪，漫漫白帽从业路", "url": "https://www.freebuf.com/fevents/181720.html", "time": "2018-08-23", "level": "红色标题", "num_look": 236881, "num_comment": 12, "author": "FB客服", "tags": ["FreeBuf公开课", "活动"], "text": "延禧攻略放完了不要方~第一期FreeBuf公开课讲师有约来啦~"}
{"title": "BUF早餐铺 | 微软称俄罗斯黑客干扰美国国会选举；Android所收集用户数据是iOS的近10倍；飞利浦多款心血管医疗设备出现漏洞", "url": "https://www.freebuf.com/news/181832.html", "time": "2018-08-23", "level": "", "num_look": 218197, "num_comment": 3, "author": "AngelaY", "tags": ["资讯"], "text": "继Android位置追踪丑闻后，又有一份研究报告称，闲置的Android设备向谷歌公司发送的数据是iOS设备向苹果公司服务器所发送数据的近10倍。"}
{"title": "UEditor编辑器两个版本任意文件上传漏洞分析", "url": "https://www.freebuf.com/vuls/181814.html", "time": "2018-08-22", "level": "", "num_look": 1250540, "num_comment": 9, "author": "云影实验室", "tags": ["WEB安全", "漏洞"], "text": "UEditor是一款所见即所得的开源富文本编辑器，具有轻量、可定制、用户体验优秀等特点，被广大WEB应用程序所使用。本次爆出的高危漏洞属于.NET版本。"}
{"title": "Hussarini：一个正将菲律宾作为攻击目标的后门", "url": "https://www.freebuf.com/articles/terminal/180896.html", "time": "2018-08-22", "level": "", "num_look": 148104, "num_comment": 148104, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "FortiGuard安全实验室发现了名为“Draft PH-US Dialogueon Cyber Security.doc”的可疑文件，这个恶意文档利用了漏洞CVE-2017-11882。"}
{"title": "记一次从《延禧攻略》扯出的微信灰色产业链事件", "url": "https://www.freebuf.com/articles/terminal/181644.html", "time": "2018-08-22", "level": "红色标题", "num_look": 371873, "num_comment": 14, "author": "暗影安全实验室", "tags": ["终端安全"], "text": "“消失流言最好的办法就是把事情闹大，让众人知道真相”，这是最近大火的一部剧《延禧攻略》里的一句台词。"}
{"title": "技术分享 | 如何使用BtleJuice黑入BLE智能电灯泡", "url": "https://www.freebuf.com/articles/wireless/180716.html", "time": "2018-08-22", "level": "", "num_look": 233035, "num_comment": 4, "author": "secist", "tags": ["无线安全"], "text": "在这篇文章中，我们将讨论如何使用BtleJuice通过执行中间人（MiTM）攻击来利用一个蓝牙低能耗（BLE）智能灯泡。本文中探讨的技术，也同样适用于其他基于BLE的智能设备。"}
{"title": "深信服创新研究院招聘安全人才", "url": "https://www.freebuf.com/jobs/181221.html", "time": "2018-08-22", "level": "", "num_look": 155217, "num_comment": 6, "author": "suifeng-刘军", "tags": ["安全招聘"], "text": "创新研究院作为深信服研发的最核心机构，肩负构建深信服安全能力、创新能力的使命。现因业务发展需要招聘安全工程师~"}
{"title": "Windows下反反调试技术汇总", "url": "https://www.freebuf.com/articles/others-articles/181085.html", "time": "2018-08-22", "level": "", "num_look": 287600, "num_comment": 4, "author": "alphalab", "tags": ["其他"], "text": "对于安全研究人员来说，调试过程中经常会碰到反调试技术，原因很简单：调试可以窥视程序的运行“秘密”，而程序作者想要通过反调试手段隐藏他们的“秘密”。"}
{"title": "批量勒索挖矿常用漏洞利用工具Jexboss的简单分析", "url": "https://www.freebuf.com/sectool/181466.html", "time": "2018-08-22", "level": "金币+10", "num_look": 228182, "num_comment": 3, "author": "si1ence", "tags": ["工具", "漏洞"], "text": "jexboss是一个使用Python编写的Jboss漏洞检测利用工具，多种漏洞并且可以直接获得shell，杀人越货勒索挖矿必备神器。"}
{"title": "卡巴斯基实验室：2018 Q2 IT威胁演变的统计分析", "url": "https://www.freebuf.com/articles/paper/180949.html", "time": "2018-08-22", "level": "金币+10", "num_look": 138546, "num_comment": 138546, "author": "vitaminsecurity", "tags": ["安全报告"], "text": "对于每个国家/地区，我们计算了在报告期间触发了计算机文件防病毒组件的卡巴斯基实验室产品用户的百分比。这些统计数据反映了不同国家的个人计算机感染程度。"}
{"title": "BUF早餐铺 | 黑客欲使用数字货币支付保释金被拒；特朗普在网络安全上的态度偏进攻型；谷歌遭起诉：被指非法追踪iPhone和Android用户位置", "url": "https://www.freebuf.com/news/181610.html", "time": "2018-08-22", "level": "", "num_look": 128267, "num_comment": 128267, "author": "shidongqi", "tags": ["资讯"], "text": "谷歌在一桩最新的法律诉讼中被指非法追踪成百上千万iPhone和Android智能手机用户的活动，哪怕用户试图利用隐私权设置来避免被追踪也不例外。"}
{"title": "技术讨论 | 用ESP8266无线模块进行钓鱼渗透测试", "url": "https://www.freebuf.com/vuls/180698.html", "time": "2018-08-21", "level": "现金奖励", "num_look": 791962, "num_comment": 35, "author": "一个神秘的人", "tags": ["无线安全", "漏洞"], "text": "至于无线网络安全方面大家都了解 802.11W 这个协议漏洞吧？黑客们经常利用这个漏洞对 wifi 用户发动 deauth 攻击来解除合法 wifi 用户的无线认证关系，从而使 wifi 用户无法连接到自己家的 wifi。"}
{"title": "浅谈GDPR技术措施中的五个关键场景", "url": "https://www.freebuf.com/articles/database/181670.html", "time": "2018-08-21", "level": "", "num_look": 227888, "num_comment": 7, "author": "Akane", "tags": ["数据安全"], "text": "在今年的5月25日，GDPR在欧盟地区正式全面实施，尽管只是一部只在欧盟区域内部实行的法律，却也在国际范围内引起了广泛的关注。"}
{"title": "FreeBuf安全专访 | 以动制敌，总会需要那么一群人来打破传统", "url": "https://www.freebuf.com/special/181641.html", "time": "2018-08-21", "level": "", "num_look": 481521, "num_comment": 8, "author": "shidongqi", "tags": ["特别企划"], "text": "武侠世界中，「以不变应万变」在高手眼中都是出奇制胜的绝招，但在白帽子、安全公司与黑客攻击的对抗之中，这显然不适用。"}
{"title": "Raccoon：用于侦察和漏洞扫描的高性能攻击性安全工具", "url": "https://www.freebuf.com/sectool/180707.html", "time": "2018-08-21", "level": "", "num_look": 246466, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "Raccoon是一款用于侦察和漏洞扫描的高性能攻击性安全工具。"}
{"title": "信息安全从运维向运营的进化", "url": "https://www.freebuf.com/articles/es/181264.html", "time": "2018-08-21", "level": "", "num_look": 423480, "num_comment": 1, "author": "仙人掌情报站", "tags": ["企业安全"], "text": "ABC（AI,Big Data,Cloud）技术发展迅猛，信息安全意识不断提高，安全已成为数据中心的标配。从一个人的安全，到几千人的团队，存在皆合理。"}
{"title": "如何绕过Duo的双因素身份验证", "url": "https://www.freebuf.com/articles/web/180486.html", "time": "2018-08-21", "level": "", "num_look": 161692, "num_comment": 161692, "author": "周大涛", "tags": ["WEB安全"], "text": "本文介绍如何通过远程桌面协议（RDP）连接到系统进行渗透测试。"}
{"title": "字节跳动安全中心招聘数据安全工程师", "url": "https://www.freebuf.com/jobs/181231.html", "time": "2018-08-21", "level": "", "num_look": 178389, "num_comment": 2, "author": "bytedance", "tags": ["安全招聘"], "text": "随着大众用户的阅读行为广泛向移动设备迁移，字节跳动帮助内容创造者们更方便的进行内容的分发，助力各类媒体更好地适应移动互联网时代。现因业务需要招聘安全工程师。"}
{"title": "一起来看看Cobaltstrike和Armitage联动能达到什么效果", "url": "https://www.freebuf.com/sectool/180395.html", "time": "2018-08-21", "level": "现金奖励", "num_look": 303866, "num_comment": 2, "author": "fengzihk", "tags": ["工具"], "text": "在使用Cobaltstrike的时候发现他在大型或者比较复杂的内网环境中，作为内网拓展以及红队工具使用时拓展能力有些不足。"}
{"title": "防御Mimikatz攻击的方法介绍", "url": "https://www.freebuf.com/articles/network/180869.html", "time": "2018-08-21", "level": "金币+5", "num_look": 215453, "num_comment": 215453, "author": "sysver", "tags": ["网络安全"], "text": "众所周知，攻击者在他们的渗透中大量使用 Mimikatz，尽管微软推出了安全补丁，但是在较旧的操作系统中 Mimikatz 仍然有效，所以在很多情况下它可能导致横向移动和域权限提升。"}
{"title": "BUF早餐铺 | 全球信息安全支出连年上涨；陕西西安破获一起网络黑客盗窃虚拟货币案；阿里AI鉴黄师上线", "url": "https://www.freebuf.com/news/181504.html", "time": "2018-08-21", "level": "", "num_look": 157656, "num_comment": 2, "author": "Karunesh91", "tags": ["资讯"], "text": "全球信息安全支出连年上涨；陕西西安破获一起网络黑客盗窃虚拟货币案；阿里AI鉴黄师上线"}
{"title": "DEF CON 2018 | 腾讯刀锋团队演示如何破解亚马逊Echo来窃听用户", "url": "https://www.freebuf.com/news/181289.html", "time": "2018-08-20", "level": "", "num_look": 166189, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["终端安全", "资讯"], "text": "在今年的DEF CON黑客大会上，两名来自腾讯刀锋团队的研究专家演示了如何利用一台经过特殊制作的Echo来入侵同一网络下的另一台Echo，并实现窃听目标用户的目的。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列-Ben Sadeghipour", "url": "https://www.freebuf.com/video/181517.html", "time": "2018-08-20", "level": "红色标题", "num_look": 121500, "num_comment": 121500, "author": "willhuang", "tags": ["视频"], "text": "Ben Sadeghipour美国加州人，现为HackerOne公司的白帽运营主管。曾发现Nokia、Google、Github、eBay、Apple等知名公司网站和应用高危漏洞，获得多家公司漏洞名人堂致谢。"}
{"title": "EvilOSX：一款功能强大的macOS远程管理工具（RAT）", "url": "https://www.freebuf.com/sectool/180668.html", "time": "2018-08-20", "level": "", "num_look": 243588, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍一款怎对macOS/OS X的远程管理工具（RAT），研究人员可利用该工具来对macOS系统进行渗透测试。"}
{"title": "BlackHat 2018 | 看Orange Tsai如何利用四个Bug实现亚马逊协同平台的RCE漏洞", "url": "https://www.freebuf.com/vuls/181389.html", "time": "2018-08-20", "level": "", "num_look": 363432, "num_comment": 3, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "台湾白帽Orange Tsai（蔡政达）受邀前往本届  Black Hat USA  和 DEFCON 26发表议题演讲，他综合利用4个功能性Bug，实现对亚马逊（Amazon）协同平台系统的远程代码执行。"}
{"title": "用一首歌曲来谱写RTMP协议分析", "url": "https://www.freebuf.com/vuls/180317.html", "time": "2018-08-20", "level": "现金奖励", "num_look": 406402, "num_comment": 9, "author": "星空111", "tags": ["漏洞", "网络安全"], "text": "为了让我这篇技术稿更加有情趣，打算用一首歌曲的结构来命名我整篇文章的脉络。"}
{"title": "如何开始对Android应用的逆向分析？", "url": "https://www.freebuf.com/articles/terminal/180505.html", "time": "2018-08-20", "level": "", "num_look": 219863, "num_comment": 3, "author": "secist", "tags": ["终端安全"], "text": "本文是我的关于如何开始Android逆向系列文章的第一部分。在文末提供了一个文档，你可以根据该文档说明部署同我一样的实验环境。"}
{"title": "陌陌科技诚聘安全各方面高级人才", "url": "https://www.freebuf.com/jobs/181207.html", "time": "2018-08-20", "level": "", "num_look": 113935, "num_comment": 5, "author": "andy110", "tags": ["安全招聘"], "text": "MOMO是陌陌（NASDAQ：MOMO）推出的一款基于地理位置的开放式移动视频社交应用，是目前中国最大的泛社交泛娱乐平台。现因业务需要招聘安全工程师~"}
{"title": "肚脑虫组织（APT-C-35）移动端攻击活动揭露", "url": "https://www.freebuf.com/articles/terminal/181049.html", "time": "2018-08-20", "level": "", "num_look": 158461, "num_comment": 158461, "author": "奇安信威胁情报中心", "tags": ["终端安全"], "text": "近期，360烽火实验室发现肚脑虫组织（APT-C-35）的攻击已把移动端也加入到其攻击目标中了。"}
{"title": "全球人口不足一部剧点击量，刷量黑色产业链了解一下", "url": "https://www.freebuf.com/articles/network/181017.html", "time": "2018-08-20", "level": "红色标题", "num_look": 491415, "num_comment": 13, "author": "GEETEST极验", "tags": ["网络安全"], "text": "电视剧动辄几百亿的播放量，究竟从何而来？"}
{"title": "BlackHat 2018 | 55款大会软件工具盘点", "url": "https://www.freebuf.com/news/181143.html", "time": "2018-08-20", "level": "", "num_look": 319842, "num_comment": 4, "author": "Freddy", "tags": ["资讯"], "text": "小编为你盘点一下在大会上发布或重要议题涉及到的55款软件工具，某些还有配套的硬件。这些工具涉及到多个领域，快进来挑几个自己喜欢的吧~"}
{"title": "BUF早餐铺 | 苹果回应服务器被入侵事件：无个人数据被盗；谷歌更新帮助页面：位置记录关闭后不会追踪用户；流行 Firefox 扩展被发现收集用户浏览历史", "url": "https://www.freebuf.com/news/181433.html", "time": "2018-08-20", "level": "", "num_look": 115625, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "七夕周末刚过，大家表白都成功了吗？没有的话，赶紧参与首页轮播图的七夕活动，FreeBuf大礼包等你来拿～"}
{"title": "Htrace.sh：用于调试Http/Https请求的简单Shell脚本", "url": "https://www.freebuf.com/sectool/180498.html", "time": "2018-08-19", "level": "", "num_look": 202132, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "htrace.sh是一个用于调试http/https流量跟踪，响应头和mixed-content（混合内容）和检查域名的简单shell脚本。"}
{"title": "技术讨论 | 看黑客如何在5分钟内在笔记本上安装一个固件后门", "url": "https://www.freebuf.com/news/179359.html", "time": "2018-08-19", "level": "", "num_look": 259633, "num_comment": 4, "author": "secist", "tags": ["资讯"], "text": "这个演示将表明“Evil Maid（邪恶女仆）攻击”是多么的容易，它并不像你想象的那样复杂。"}
{"title": "无线干扰及检测技术", "url": "https://www.freebuf.com/articles/wireless/181008.html", "time": "2018-08-19", "level": "金币+10", "num_look": 397616, "num_comment": 1, "author": "thr0cyte", "tags": ["无线安全"], "text": "这里我们讨论一下基本的无线干扰，通过控制未加密的管理帧实现。"}
{"title": "后渗透阶段的权限维持（Windows篇）", "url": "https://www.freebuf.com/articles/web/180581.html", "time": "2018-08-19", "level": "金币+10", "num_look": 477380, "num_comment": 6, "author": "Hiton1", "tags": ["WEB安全"], "text": "当我们在渗透过程中通过漏洞获取到目标主机权限后，往往会因为服务器管理员发现和修补漏洞而导致对服务器权限的丢失，所以权限维持就显得很重要了。"}
{"title": "记一次新型CC通信木马反查杀的姿势研究", "url": "https://www.freebuf.com/articles/terminal/181353.html", "time": "2018-08-18", "level": "", "num_look": 219232, "num_comment": 7, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "最新接到客户反馈内网某终端 PC 出现大量与国外站点通信的流量被深信服安全感知系统（SIP）识别，各大杀毒软件均无法查杀干净。"}
{"title": "50个应用实例让你窥见区块链将如何接管世界", "url": "https://www.freebuf.com/articles/neopoints/180426.html", "time": "2018-08-18", "level": "", "num_look": 265634, "num_comment": 1, "author": "clouds", "tags": ["观点"], "text": "区块链的应用已经在各行业中悄然发生。"}
{"title": "技术讨论 | 如何绕过并利用Bucket的上传策略和URL签名", "url": "https://www.freebuf.com/articles/web/180318.html", "time": "2018-08-18", "level": "", "num_look": 180620, "num_comment": 180620, "author": "Hydralab", "tags": ["WEB安全"], "text": "通过上传策略中的规则以及与访问某些文件的相关逻辑，我们将展示如何拿到完整的Bucket对象列表，同时能够修改或删除Bucket中的现有文件。"}
{"title": "浏览器攻击框架BeEF Part 6：对用户与浏览器的攻击测试", "url": "https://www.freebuf.com/sectool/178512.html", "time": "2018-08-18", "level": "现金奖励", "num_look": 327587, "num_comment": 8, "author": "NT00", "tags": ["WEB安全", "工具"], "text": "这一章介绍如何使用BeEF来攻击用户和浏览器，攻击用户和浏览器的效果相对于上一章来说比较简单，效果也直接有效。"}
{"title": "七夕特辑 | 不会表白的程序员，就继续凭本事单身吧（送惊喜FreeBuf大礼包）", "url": "https://www.freebuf.com/special/181327.html", "time": "2018-08-18", "level": "红色标题", "num_look": 1142751, "num_comment": 67, "author": "shidongqi", "tags": ["特别企划"], "text": "不好意思，来的有些晚了，不过只要是对的人，每一天都是七夕。参与活动，送三份FreeBuf惊喜大礼包！！！！"}
{"title": "CoinHive智能网页挖矿的二三事", "url": "https://www.freebuf.com/vuls/181267.html", "time": "2018-08-18", "level": "金币+10", "num_look": 244703, "num_comment": 1, "author": "si1ence", "tags": ["WEB安全", "漏洞"], "text": "网站被挂马后存在网页挖矿，区别于常规病毒操作系统中挖矿行为，网页主要在网站上挂上恶意的JS脚本，访问该网站即触发挖矿动作。"}
{"title": "【报名即可学习|精品公开课】CISSP一次通过内功心法 | 成为CSO的第一步", "url": "https://www.freebuf.com/fevents/180346.html", "time": "2018-08-18", "level": "红色标题", "num_look": 207887, "num_comment": 207887, "author": "FB客服", "tags": ["FreeBuf公开课", "活动"], "text": "少年我看你骨骼惊奇，想不想知道如何踏上成为CSO的第一步？这本CISSP一次通过内功心法，独门秘籍不要错skr~"}
{"title": "Ridrelay：一款用于在内网中快速查找域用户名的工具", "url": "https://www.freebuf.com/sectool/180907.html", "time": "2018-08-17", "level": "", "num_look": 198429, "num_comment": 198429, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍一款名叫Ridrelay的工具，可以在只有低等级权限的情况下，利用该工具枚举出内部网络中的域用户名信息。"}
{"title": "99%的人都不知道的秘密：世上竟有如此酷炫的钓鱼系统！", "url": "https://www.freebuf.com/sectool/180868.html", "time": "2018-08-17", "level": "现金奖励", "num_look": 495408, "num_comment": 45, "author": "flagellantX", "tags": ["WEB安全", "工具"], "text": "钓鱼作为从远古时期出现的手段，到现在的风靡在各种成功的攻击案例中几乎成为一个高级hacker必不可少的技能。"}
{"title": "通过BGP劫持修改网络支付系统DNS记录", "url": "https://www.freebuf.com/articles/paper/180167.html", "time": "2018-08-17", "level": "", "num_look": 173408, "num_comment": 173408, "author": "周大涛", "tags": ["安全报告"], "text": "在过去一个月里，Oracle观察到了对权威DNS服务器实施BGP劫持的另外几起事件。与亚马逊案例一样，最近的这几次BGP劫持使得假冒的DNS服务器能够返回伪造的DNS响应，将不知情的用户导向至恶意网站。"}
{"title": "映客招聘安全人才", "url": "https://www.freebuf.com/jobs/181137.html", "time": "2018-08-17", "level": "", "num_look": 133649, "num_comment": 1, "author": "inkezhibo", "tags": ["安全招聘"], "text": "映客是中国领先的移动端直播平台，现因业务需要招聘安全人才~"}
{"title": "微软Cortana出现漏洞，即使系统锁定也能使用浏览功能", "url": "https://www.freebuf.com/news/181256.html", "time": "2018-08-17", "level": "红色标题", "num_look": 168944, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["漏洞", "系统安全"], "text": "近日，安全研究专家对外表示，如果你的Windows电脑开启了锁屏启动微软Cortana数字助手的话，那你可能就危险了。"}
{"title": "超100家交易所发现高危漏洞，50亿数字资产受威胁", "url": "https://www.freebuf.com/vuls/180552.html", "time": "2018-08-17", "level": "", "num_look": 218915, "num_comment": 8, "author": "Punisher安全团队", "tags": ["漏洞"], "text": "近日，Punisher安全团队联合HELM区块链安全实验室根据蜜罐捕捉到了一枚交易所的0day。据分析，此0day是由于某开发方代码于地下黑市源码泄露而导致的一些漏洞被发掘。"}
{"title": "浅谈APK安全及自动化审计", "url": "https://www.freebuf.com/articles/terminal/180637.html", "time": "2018-08-17", "level": "红色标题", "num_look": 493800, "num_comment": 11, "author": "默安科技_影武者实验室", "tags": ["终端安全"], "text": "我们需要关注的是数据包在传输的过程中是否有进行必要的加密，服务端是否有对用户的操作权限进行控制，服务端的一些业务逻辑处理是否存在缺陷等等"}
{"title": "Zip Slip任意文件覆盖漏洞分析", "url": "https://www.freebuf.com/vuls/180383.html", "time": "2018-08-17", "level": "现金奖励", "num_look": 216620, "num_comment": 216620, "author": "路上路人路过", "tags": ["数据安全", "漏洞"], "text": "Zip Slip是一个广泛存在的任意文件覆盖漏洞，通常会导致远程命令执行。"}
{"title": "深入了解Json Web Token之概念篇", "url": "https://www.freebuf.com/articles/web/180874.html", "time": "2018-08-17", "level": "金币+8", "num_look": 387407, "num_comment": 3, "author": "NinthDevilHunster", "tags": ["WEB安全"], "text": "对于JWE 的内容，网络上鲜有见闻。下文是我读了json web token handle book后，用自己的理解写下的，如有疑问，欢迎评论。"}
{"title": "BUF早餐铺 | 报告称多数国人“一套密码走天下”；微软8月更新Windows和IE 2个0day漏洞；国产红芯浏览器被指作假，实为Chrome换壳产品", "url": "https://www.freebuf.com/news/181126.html", "time": "2018-08-17", "level": "", "num_look": 129473, "num_comment": 2, "author": "Akane", "tags": ["资讯"], "text": "基本可以断定，红芯浏览器与众多国产浏览器一样，仅是一款Chrome的套壳浏览器，与其宣传中宣称的自主内核相差甚远。"}
{"title": "BlackHat 2018 | 现代智能手机基带破解", "url": "https://www.freebuf.com/vuls/181115.html", "time": "2018-08-16", "level": "", "num_look": 251192, "num_comment": 3, "author": "腾讯安全科恩实验室", "tags": ["其他", "漏洞"], "text": "本议题将讨论现代智能手机基带设计以及安全对策。"}
{"title": "基于机器学习的WebShell检测方法与实现（上）", "url": "https://www.freebuf.com/articles/web/181169.html", "time": "2018-08-16", "level": "红色标题", "num_look": 516050, "num_comment": 11, "author": "斗象智能安全平台", "tags": ["WEB安全", "系统安全"], "text": "Webshell是攻击者使用的恶意脚本，其目的是升级和维护对已经受到攻击的WEB应用程序的持久访问。"}
{"title": "万物互联的未来：能有多少梦幻，就会有多少危险", "url": "https://www.freebuf.com/articles/neopoints/181164.html", "time": "2018-08-16", "level": "", "num_look": 148616, "num_comment": 148616, "author": "shidongqi", "tags": ["观点"], "text": "如《海底两万里》中的潜艇、《星球大战》中的3D全息投影以及科幻电影中最受欢迎的题材人工智能也已经正在变成现实。而从物联网到万物互联，意味着又一幕科幻场景逐渐照进现实……"}
{"title": "WAScan：一款功能强大的Web应用程序扫描工具", "url": "https://www.freebuf.com/sectool/180647.html", "time": "2018-08-16", "level": "", "num_look": 394302, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["工具"], "text": "WAScan是一款开源工具，该工具采用的是基于黑盒的漏洞挖掘方法，这也就意味着研究人员无需对Web应用程序的源代码进行研究。"}
{"title": "StackOverFlow之Ret2ShellCode详解", "url": "https://www.freebuf.com/vuls/179724.html", "time": "2018-08-16", "level": "现金奖励", "num_look": 321988, "num_comment": 10, "author": "h1mmel", "tags": ["漏洞"], "text": "本文记录栈溢出中的简单ret2shellcode利用和最基础的栈知识，用例为pwnable.tw中的第一道题start。"}
{"title": "如何使用Photon高效率提取网站数据", "url": "https://www.freebuf.com/sectool/179967.html", "time": "2018-08-16", "level": "", "num_look": 187639, "num_comment": 1, "author": "Covfefe", "tags": ["工具"], "text": "Photon是一种高效率的的网络爬虫，可从目标中提取URL，文件以及各类情报。其通过多线程大大加快数据提取进程。"}
{"title": "平安集团安全平台部招聘高级安全系统运营工程师", "url": "https://www.freebuf.com/jobs/180627.html", "time": "2018-08-16", "level": "", "num_look": 102611, "num_comment": 1, "author": "dulai0103", "tags": ["安全招聘"], "text": "平安科技是平安集团旗下的全资子公司，是平安集团的高科技内核。现因业务需要招聘高级安全系统运营工程师。"}
{"title": "山寨APP的神操作，“订阅号助手”一夜变成高考刷题平台", "url": "https://www.freebuf.com/articles/terminal/180717.html", "time": "2018-08-16", "level": "红色标题", "num_look": 572389, "num_comment": 9, "author": "GEETEST极验", "tags": ["终端安全"], "text": "那些年，我们躲过了“粤利粤”，分清了“营养抉线”，能认出“康帅傅”、“脉劫”、“王老古”， 却没逃过山寨APP的毒害……"}
{"title": "针对CVE-2018-8120 Windows提权工具兼容性BUG定位及修复", "url": "https://www.freebuf.com/vuls/180227.html", "time": "2018-08-16", "level": "", "num_look": 203753, "num_comment": 1, "author": "alphalab", "tags": ["漏洞"], "text": "2018年5月微软发布了针对Windows操作系统内核组件漏洞（CVE-2018-8210）的补丁，该漏洞影响多个版本的操作系统，成功利用漏洞可使得普通应用程序以内核权限执行任意代码。"}
{"title": "利用Intel Pin和IDA实现代码跟踪", "url": "https://www.freebuf.com/sectool/180072.html", "time": "2018-08-16", "level": "现金奖励", "num_look": 212375, "num_comment": 2, "author": "无。", "tags": ["工具"], "text": "Pin是一个动态的二进制插桩工具。动态意味着它的插桩在运行时执行，而不需要程序的源码，这一点是十分契合逆向工程或是漏洞挖掘的要求的。"}
{"title": "蠕虫病毒利用”永恒之蓝“漏洞传播，单位局域网受威胁最大", "url": "https://www.freebuf.com/vuls/180331.html", "time": "2018-08-16", "level": "", "num_look": 248785, "num_comment": 4, "author": "火绒安全", "tags": ["漏洞", "网络安全"], "text": "火绒安全团队通过\"火绒威胁情报系统\"发现蠕虫病毒\"Worm/Sharp\"正在全网传播，在政府、企业、学校、医院等单位的局域网具有非常强的传播能力。"}
{"title": "BUF 早餐铺 | 俄罗斯采购中国产品破解加密消息应用；号称“不可破解”的Bitfi钱包不到一周即破防；黑客可以伪造患者的生命体征", "url": "https://www.freebuf.com/news/181077.html", "time": "2018-08-16", "level": "", "num_look": 176490, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "McAfee的创始人John McAfee曾经表示，这款数字钱包（其实就是基于Android系统的迷你平板电脑）将能抵挡住任何形式的黑客攻击，甚至还放言““谁要是攻破了BitFi钱包，奖励10万美元。”"}
{"title": "Emotet银行木马分析报告", "url": "https://www.freebuf.com/articles/terminal/180390.html", "time": "2018-08-15", "level": "", "num_look": 382791, "num_comment": 4, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "最近一段时间国外安全研究人员在相关安全社交网站上公布了多个Emotet银行木马最新的变种样本，深信服EDR安全团队对此事进行了相关跟进，获取到了相应的样本，并对其中一个最新的变种样本进行了详细分析。"}
{"title": "文件上传限制绕过技巧", "url": "https://www.freebuf.com/articles/web/179954.html", "time": "2018-08-15", "level": "", "num_look": 550976, "num_comment": 5, "author": "secist", "tags": ["WEB安全"], "text": "通过本文的学习你将了解到Web应用中文件上传的处理和验证发送流程，以及我们该如何绕过这些验证。"}
{"title": "猎豹移动招聘安全人才", "url": "https://www.freebuf.com/jobs/180757.html", "time": "2018-08-15", "level": "", "num_look": 131641, "num_comment": 5, "author": "lion_00", "tags": ["安全招聘"], "text": "猎豹移动(NYSE: CMCM),全球领先的移动互联网公司,中国移动互联网公司出海领军者;致力于用AI+大数据为全球用户提供卓越的移动互联网产品,现扩大安全团队，招聘安全人才。"}
{"title": "技术讨论 | 通过SSRF漏洞攻击Docker远程API获取服务器Root权限", "url": "https://www.freebuf.com/articles/web/179910.html", "time": "2018-08-15", "level": "现金奖励", "num_look": 258999, "num_comment": 5, "author": "差池其羽", "tags": ["WEB安全"], "text": "从一个安全爱好者的角度出发，是否可以利用Docker的远程API来实现提权等一系列的操作？笔者探索到了一条通过SSRF漏洞来攻击Docker远程API，从而获得远程主机的root权限的攻击思路。"}
{"title": "Docker从入门到放弃", "url": "https://www.freebuf.com/articles/system/180142.html", "time": "2018-08-15", "level": "现金奖励", "num_look": 1458939, "num_comment": 8, "author": "haya", "tags": ["系统安全"], "text": "本文将以比较简单的的方式让大家理解docker，以平时常用到的测试环境为主，从用开始，慢慢理解docker。"}
{"title": "技术分享 | 无需四次握手包破解WPA&WPA2密码", "url": "https://www.freebuf.com/articles/wireless/179953.html", "time": "2018-08-15", "level": "现金奖励", "num_look": 1444325, "num_comment": 8, "author": "Shad0wpf_", "tags": ["无线安全"], "text": "知名密码破解软件Hashcat在2018年8月2日发布了4.2版本，这次版本更新的主要内容是增加了4个新的密码算法支持。"}
{"title": "技术讨论 | 记一次Node.Js反序列化攻击测试", "url": "https://www.freebuf.com/news/180882.html", "time": "2018-08-15", "level": "", "num_look": 176093, "num_comment": 3, "author": "Hydralab", "tags": ["资讯"], "text": "Node.js是一个Javascript运行时环境。它封装了GoogleV8引擎，该引擎可以高效地执行Javascript。"}
{"title": "BUF早餐铺 | 谷歌记录用户位置信息；英特尔处理器曝出新漏洞；TLS 1.3作为正式标准发布；工信部组织开展电信和互联网行业网络安全检查", "url": "https://www.freebuf.com/news/180926.html", "time": "2018-08-15", "level": "", "num_look": 120928, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "Faxploit 漏洞可能让数百万惠普办公喷墨打印机遭入侵；Oracle 提醒用户修复数据库产品中的严重漏洞；流行安卓 APP 易遭受 Man-in-the-Disk 攻击。"}
{"title": "DEF CON 2018 | 社会工程学专家的炫技时刻", "url": "https://www.freebuf.com/news/180952.html", "time": "2018-08-14", "level": "", "num_look": 178387, "num_comment": 5, "author": "Freddy", "tags": ["资讯"], "text": "社会工程学专家们在拉斯维加斯举行的DEF CON 2018大会上扮演了一把“欺诈专家”，分享了如何操纵受害者以及各种“社工”技能，这可是很难得的一次了解相关信息的机会。"}
{"title": "Hero RAT：一种基于Telegram的Android恶意软件", "url": "https://www.freebuf.com/articles/terminal/179842.html", "time": "2018-08-14", "level": "", "num_look": 192758, "num_comment": 192758, "author": "Hydralab", "tags": ["终端安全"], "text": "在今年6月份，安全公司ESET的研究人员发现了一种名为Hero RAT的新型Android远程访问木马（RAT），它利用Telegram BOT API与攻击者进行通信。"}
{"title": "BlackHat 2018 | 解锁上帝模式：威盛X86 CPU中的硬件后门", "url": "https://www.freebuf.com/news/180912.html", "time": "2018-08-14", "level": "红色标题", "num_look": 224056, "num_comment": 5, "author": "Freddy", "tags": ["资讯"], "text": "在Black Hat 2018大会上，著名的硬件安全专家Christopher Domas展示了他如何找到多款不同型号CPU中可能存在的后门。"}
{"title": "Xori：一款来自BlackHat 2018的二进制反汇编和静态分析工具", "url": "https://www.freebuf.com/sectool/180679.html", "time": "2018-08-14", "level": "", "num_look": 166057, "num_comment": 166057, "author": "周大涛", "tags": ["工具"], "text": "Xori是一个自动化的反汇编和静态分析库，它使用shellcode或PE二进制文件并提供分类分析数据。"}
{"title": "用BETTERCAP和RASPBERRY PI ZERO W制作迷你WiFi干扰器", "url": "https://www.freebuf.com/articles/wireless/179821.html", "time": "2018-08-14", "level": "", "num_look": 312876, "num_comment": 2, "author": "secist", "tags": ["无线安全"], "text": "我并不是一个特别勤快的人，几天前我终于开始将我几周以来的一些想法付诸于实践，即使用Raspberry Pi Zero W制作一个可随身携带的迷你WiFi干扰器。"}
{"title": "申通快递招聘安全工程师", "url": "https://www.freebuf.com/jobs/180628.html", "time": "2018-08-14", "level": "", "num_look": 117884, "num_comment": 2, "author": "sto", "tags": ["安全招聘"], "text": "申通快递品牌初创于1993年，公司致力于民族品牌的建设和发展，以专业的服务和严格的质量管理推动中国快递行业的发展，公司因业务需要现招聘安全工程师。"}
{"title": "服务器入侵溯源小技巧整理", "url": "https://www.freebuf.com/news/179638.html", "time": "2018-08-14", "level": "金币+20", "num_look": 524055, "num_comment": 11, "author": "和蔼的杨小二", "tags": [], "text": "最近某司网站主页被篡改了，找师傅帮忙看看怎么回事，师傅没有空就交给我了……我自己这方面没有了解很多。事情结束后，又找师傅问了问关于溯源的技巧经验，于是就有了这篇小结。"}
{"title": "从车联网安全到BLE安全（二）", "url": "https://www.freebuf.com/articles/terminal/167078.html", "time": "2018-08-14", "level": "现金奖励", "num_look": 191128, "num_comment": 1, "author": "麦片与老干妈", "tags": ["终端安全"], "text": "此文着重从BLE（低功耗蓝牙）方向对智能设备的安全进行分析。"}
{"title": "当微信遇上社会工程学，明枪易躲暗箭难防", "url": "https://www.freebuf.com/articles/neopoints/180186.html", "time": "2018-08-14", "level": "红色标题", "num_look": 783338, "num_comment": 6, "author": "AdlerI", "tags": ["特别企划", "观点"], "text": "当社会工程学遇到了当今人们几乎离不开的微信，碰撞出的各种新骗术更是防不胜防。"}
{"title": "深入解析新型加密货币挖矿恶意软件ZombieBoy", "url": "https://www.freebuf.com/articles/blockchain-articles/179961.html", "time": "2018-08-14", "level": "", "num_look": 142721, "num_comment": 142721, "author": "Hydralab", "tags": ["区块链安全"], "text": "延续了2018年加密货币挖矿恶意软件的趋势，我发现了另一种类似于5月初发现的“MassMine”的挖矿恶意软件。我把这个家族称为ZombieBoy，因为它使用了一个名为ZombieBoyTools的工具来释放第一个dll。"}
{"title": "利用PMKID破解PSK的实际测试与影响评估", "url": "https://www.freebuf.com/articles/system/180837.html", "time": "2018-08-14", "level": "现金奖励", "num_look": 371662, "num_comment": 3, "author": "qingxp9", "tags": ["系统安全"], "text": "2018年8月4日，一位研究员发现了一个针对WPA/WPA2协议密码破解的新方法，使用PMKID来破解无线密码。实际的影响范围如何呢，于是有了本文。"}
{"title": "BUF早餐铺丨虚拟货币等成新型网络诈骗手段；11岁女孩在黑客大会上改变了佛罗里达总统投票的结果；移动POS存在漏洞 个人信息有暴露风险", "url": "https://www.freebuf.com/news/180743.html", "time": "2018-08-14", "level": "", "num_look": 109252, "num_comment": 2, "author": "Karunesh91", "tags": ["资讯"], "text": "虚拟货币等成新型网络诈骗手段；11岁女孩在黑客大会上改变了佛罗里达总统投票的结果；移动POS存在漏洞 个人信息有暴露风险。"}
{"title": "三大基地停产，78亿损失！制造业安全建设刻不容缓", "url": "https://www.freebuf.com/articles/neopoints/180382.html", "time": "2018-08-13", "level": "", "num_look": 158878, "num_comment": 158878, "author": "深信服千里目安全实验室", "tags": ["观点"], "text": "8月3日，台湾一知名芯片代工厂三大核心基地遭遇勒索病毒攻击，导致生产线全线停摆，预估损失78亿元，损失极其惨重，一时间震惊整个制造业！"}
{"title": "BlackHat 2018 | 将亮相的10款网络终端安全产品", "url": "https://www.freebuf.com/news/180605.html", "time": "2018-08-13", "level": "", "num_look": 189978, "num_comment": 189978, "author": "Alpha_h4ck", "tags": ["终端安全", "网络安全"], "text": "一起看一看在今年的大会上，各大网络安全厂商为了应对可疑流量、0 day攻击和高级持续威胁都做出了哪些努力。"}
{"title": "BlackHat 2018 | 卫星通信系统存在漏洞，飞机网络有被远程攻击的风险", "url": "https://www.freebuf.com/news/180762.html", "time": "2018-08-13", "level": "", "num_look": 231595, "num_comment": 4, "author": "Freddy", "tags": ["无线安全", "资讯"], "text": "先不要慌，这里针对飞机的远程攻击目前理论上仅限于禁用机上Wi-Fi和影响非安全卫星通信，无法对飞机的控制系统造成任何实质性的破坏。"}
{"title": "DEF CON 2018 | macOS零日漏洞可模拟鼠标点击以加载内核扩展", "url": "https://www.freebuf.com/news/180746.html", "time": "2018-08-13", "level": "", "num_look": 99028, "num_comment": 99028, "author": "Freddy", "tags": ["资讯"], "text": "在上周举行的DEF CON 2018大会上，来自Digita Security的研究人员披露了一个macOS中存在的零日漏洞，使得攻击者能够通过模拟鼠标点击绕过系统安全机制，加载系统内核扩展。"}
{"title": "基于Bro的应用层数据包识别工具", "url": "https://www.freebuf.com/sectool/179757.html", "time": "2018-08-13", "level": "", "num_look": 274416, "num_comment": 274416, "author": "secist", "tags": ["工具"], "text": "Bro是一款被动的开源流量分析器。它主要用于对链路上所有深层次的可疑行为流量进行一个安全监控。"}
{"title": "挖洞经验 | 看我如何发现雅虎XSSi漏洞实现用户信息窃取", "url": "https://www.freebuf.com/articles/web/179851.html", "time": "2018-08-13", "level": "", "num_look": 216607, "num_comment": 6, "author": "clouds", "tags": ["WEB安全"], "text": "发现某种特定类别漏洞由两个关键部分组成，那就是对漏洞的认知以及挖掘的难易程度。"}
{"title": "平安科技银河安全实验室招聘", "url": "https://www.freebuf.com/jobs/180340.html", "time": "2018-08-13", "level": "", "num_look": 112894, "num_comment": 2, "author": "银河实验室", "tags": ["安全招聘"], "text": "银河实验室是平安集团信息安全部下的一个相对独立的分组，主要从事安全技术研究和安全测试工作。团队内现在覆盖逆向，物联网，web，android，ios，云平台等多个安全方向。"}
{"title": "“撬锁”实战：绕过云锁提权某游戏私服", "url": "https://www.freebuf.com/articles/web/179761.html", "time": "2018-08-13", "level": "", "num_look": 381202, "num_comment": 22, "author": "道恩先生666", "tags": ["WEB安全"], "text": ""}
{"title": "你下载的TeamViewer13破解版可能有毒", "url": "https://www.freebuf.com/vuls/175689.html", "time": "2018-08-13", "level": "红色标题", "num_look": 571347, "num_comment": 16, "author": "si1ence", "tags": ["漏洞", "终端安全"], "text": "最近有个远程管理一下某内网服（tiao）务（ban）器（ji）的需求，思来想去之后还是觉得老老实实装个Teamviewer最靠谱，于是随意下载一个破解版准备开始操作。"}
{"title": "BUGX.IO即将上线公测 | 白帽们，该出场了！", "url": "https://www.freebuf.com/fevents/180174.html", "time": "2018-08-13", "level": "红色标题", "num_look": 145101, "num_comment": 3, "author": "BUGX", "tags": ["活动"], "text": "区块链领域自起源到如今，经历了9年的发展沉浮，头条新闻除了层出不穷的新币和应用， 还有一起起令人揪心的安全事故，动辄数千万美元的损失令人唏嘘。"}
{"title": "BUF早餐铺 | 黑客可让卫星过度充电令其损害；美国PGA遭遇勒索软件攻击；15岁少年声称攻破BitFi虚拟加密币硬件钱包", "url": "https://www.freebuf.com/news/180520.html", "time": "2018-08-13", "level": "", "num_look": 123840, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "跟我一起念：玄道X卫星！"}
{"title": "Seeker：一款可获取高精度地理和设备信息的工具分析", "url": "https://www.freebuf.com/sectool/179641.html", "time": "2018-08-12", "level": "", "num_look": 288150, "num_comment": 10, "author": "secist", "tags": ["工具"], "text": "Seeker是一款可以获取高精度地理和设备信息的工具。其利用HTML5，Javascript，JQuery和PHP来抓取设备信息，以及Geolocation接口实现对设备高精度地理位置的获取。"}
{"title": "对暗网上俄罗斯黑客论坛的深入调查", "url": "https://www.freebuf.com/news/179735.html", "time": "2018-08-12", "level": "", "num_look": 380215, "num_comment": 4, "author": "secist", "tags": ["资讯"], "text": "我花了大约三周的时间来研究和翻译FreeHacks，这是一个俄罗斯黑客论坛，旨在集体收集其资源，以最大限度地提高效率和知识分散。"}
{"title": "2018年上半年中国网络安全报告", "url": "https://www.freebuf.com/articles/paper/180015.html", "time": "2018-08-12", "level": "", "num_look": 549652, "num_comment": 2, "author": "瑞星", "tags": ["安全报告"], "text": "2018年上半年中国网络安全报告新鲜出炉，瑞星安全团队为您解读~"}
{"title": "2018上半年区块链安全报告", "url": "https://www.freebuf.com/articles/paper/179901.html", "time": "2018-08-12", "level": "", "num_look": 260232, "num_comment": 1, "author": "腾讯电脑管家", "tags": ["安全报告"], "text": "2018年，是公认的区块链大年。与区块链有关的讨论不仅遍存在于中关村的创业咖啡，更是存在于街头巷尾、地铁公交、微博微信，几乎无处不在。"}
{"title": "新Underminer EK使用加密TCP隧道交付Bootkit和挖矿软件", "url": "https://www.freebuf.com/news/178974.html", "time": "2018-08-12", "level": "", "num_look": 151712, "num_comment": 151712, "author": "Hydralab", "tags": ["网络安全", "资讯"], "text": "趋势科技在本周发表的一篇博文中指出，其研究人员已经发现了一个新的漏洞利用工具包（Exploit Kit），并将其命名为Underminer。"}
{"title": "Hindsight：Google ChromeChromium历史访问记录取证工具", "url": "https://www.freebuf.com/sectool/179734.html", "time": "2018-08-11", "level": "", "num_look": 156585, "num_comment": 156585, "author": "secist", "tags": ["工具"], "text": "hindsight是一款Google Chrome/Chromium历史访问记录取证工具。它支持解析许多不同类型的web工件。"}
{"title": "大家一起看一看新的Android P将引入哪些安全性改进", "url": "https://www.freebuf.com/news/180639.html", "time": "2018-08-11", "level": "红色标题", "num_look": 149761, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "根据Google的Android开发团队发布的新版本Android系统概述，下一个Android版本（Android P或Android 9.0）大家应该很快就可以“吃”上了。"}
{"title": "蠕虫病毒利用永恒之蓝漏洞传播，单位局域网受威胁最大", "url": "https://www.freebuf.com/vuls/180397.html", "time": "2018-08-11", "level": "", "num_look": 276240, "num_comment": 2, "author": "火绒安全", "tags": ["安全报告", "漏洞"], "text": "近日，火绒安全团队通过\"火绒威胁情报系统\"发现蠕虫病毒\"Worm/Sharp\"正在全网传播，在政府、企业、学校、医院等单位的局域网具有非常强的传播能力。"}
{"title": "【FB TV】一周「BUF大事件」：BlackHat2018拉斯维加斯举办；台积电三大工厂遭病毒感染；MongoDB数据库泄漏200万医疗保健数据", "url": "https://www.freebuf.com/video/180648.html", "time": "2018-08-11", "level": "红色标题", "num_look": 143017, "num_comment": 143017, "author": "willhuang", "tags": ["视频"], "text": "BlackHat2018拉斯维加斯举办；台积电三大工厂遭病毒感染；MongoDB数据库泄漏200万医疗保健数据"}
{"title": "给树莓派小车控制系统加上装甲", "url": "https://www.freebuf.com/geek/179643.html", "time": "2018-08-11", "level": "现金奖励", "num_look": 198522, "num_comment": 1, "author": "xutiejun", "tags": ["极客"], "text": "本篇从攻防的角度对树莓派小车控制系统进行升级，给小车装上一层层可靠的“装甲”。"}
{"title": "深入解析由黑客组织DarkHydrus使用的Powershell恶意软件", "url": "https://www.freebuf.com/news/179902.html", "time": "2018-08-11", "level": "", "num_look": 200128, "num_comment": 200128, "author": "Hydralab", "tags": ["WEB安全", "数据安全"], "text": "有组织使用定制的恶意软件攻击了中东组织，这个组织被Unit 42命名为DarkHydrus。这篇博文中，我分析了恶意的VBA宏和高度混淆的PowerShell代码。"}
{"title": "DDG挖矿最新变种分析报告", "url": "https://www.freebuf.com/articles/system/180385.html", "time": "2018-08-10", "level": "", "num_look": 580308, "num_comment": 580308, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "DDG挖矿病毒是一款在Linux系统下运行的恶意挖矿病毒，该病毒从去年一直活跃在现在，已经挖取了价值一千多万人民币的虚拟币货币。"}
{"title": "BlackHat 2018 | 云服务安全功能比较：亚马逊vs谷歌vs微软", "url": "https://www.freebuf.com/news/180561.html", "time": "2018-08-10", "level": "", "num_look": 155778, "num_comment": 155778, "author": "Freddy", "tags": ["网络安全", "资讯"], "text": "亚马逊、谷歌和微软的云平台提供了哪些差异化服务，又是如何保障云安全的？研究人员在Black Hat 2018大会上发表了对这三家主流云平台安全功能的研究，并就优缺点进行了讨论。"}
{"title": "BlackHat 2018 | 对特斯拉汽车全方位的渗透测试", "url": "https://www.freebuf.com/news/180594.html", "time": "2018-08-10", "level": "红色标题", "num_look": 219984, "num_comment": 4, "author": "腾讯安全科恩实验室", "tags": ["漏洞", "资讯"], "text": "在本届Black Hat USA 2018大会上，腾讯科恩实验室带来了去年对特斯拉具备的先进OTA功能相关的安全研究成果。"}
{"title": "BlackHat 2018 | 黑帽大会对加密货币安全问题的讨论", "url": "https://www.freebuf.com/news/180554.html", "time": "2018-08-10", "level": "红色标题", "num_look": 137155, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "随着区块链技术的不断发展，互联网上各种加密货币也如雨后春笋般冒了出来，而加密货币的“兴起”也给很多网络犯罪分子提供了更多的机会。"}
{"title": "Gosec：Go语言源码安全分析工具", "url": "https://www.freebuf.com/sectool/179549.html", "time": "2018-08-10", "level": "", "num_look": 295722, "num_comment": 295722, "author": "secist", "tags": ["工具"], "text": "gosec是一个Go语言源码安全分析工具，其通过扫描Go AST（抽象语法树）来检查源代码是否存在安全问题。"}
{"title": "女朋友遭遇网购诈骗，实名制下依然很无奈", "url": "https://www.freebuf.com/special/179930.html", "time": "2018-08-10", "level": "红色标题", "num_look": 966675, "num_comment": 23, "author": "shidongqi", "tags": ["特别企划"], "text": "正当我一脸懵逼的时候，女朋友发来一条语音，说她现在在派出所。我顿时一惊，怎么会在派出所，下意识的看了一下时间，晚上22:31，这个时间点会发生什么，才有必要去派出所。"}
{"title": "技术讨论 | 后门混淆和反检测技术", "url": "https://www.freebuf.com/articles/web/180263.html", "time": "2018-08-10", "level": "", "num_look": 199366, "num_comment": 2, "author": "周大涛", "tags": ["WEB安全"], "text": "在这篇文章中，我们将讨论一些逃避后门检测的方法，并展示在我们的数据中发现的真实后门案例。"}
{"title": "快讯 | Drupal网站管理员们请注意：Symfony漏洞会让你的网站沦陷！", "url": "https://www.freebuf.com/news/180556.html", "time": "2018-08-10", "level": "", "num_look": 165779, "num_comment": 165779, "author": "Alpha_h4ck", "tags": ["漏洞", "资讯"], "text": "Drupal项目组目前已经发布了一个更新补丁来修复其软件中的一个安全绕过漏洞，而这个漏洞将允许远程攻击者拿到目标站点的完整控制权。"}
{"title": "新加坡新保集团（SingHealth）网络攻击事件的可疑线索分析", "url": "https://www.freebuf.com/articles/paper/179233.html", "time": "2018-08-10", "level": "", "num_look": 129630, "num_comment": 1, "author": "clouds", "tags": ["安全报告"], "text": "安全公司 Trustwave 旗下 SpiderLabs 实验室发现了可能与新加坡新保集团（SingHealth）网络攻击相关的一些信息线索，在这篇文章中，他们进行了详细分析。"}
{"title": "【报名即可学习】黑产技术剖析 | 从黑产视界挖掘技术真相【精品公开课】", "url": "https://www.freebuf.com/fevents/179449.html", "time": "2018-08-10", "level": "红色标题", "num_look": 232374, "num_comment": 3, "author": "FB客服", "tags": ["FreeBuf公开课", "活动"], "text": "移动互联网黑产技术剖析，给你一个了解黑产世界的机会~"}
{"title": "平安好房招聘安全专家", "url": "https://www.freebuf.com/jobs/180185.html", "time": "2018-08-10", "level": "", "num_look": 87984, "num_comment": 3, "author": "SixSixSix", "tags": ["安全招聘"], "text": "平安好房，致力于为房地产生态圈全产业链提供最优的智能化科技解决方案。"}
{"title": "聚·变 | 零距离接触顺丰第二届信息安全峰会", "url": "https://www.freebuf.com/news/180389.html", "time": "2018-08-10", "level": "", "num_look": 121732, "num_comment": 121732, "author": "Karunesh91", "tags": ["活动", "资讯"], "text": "本次大会以“聚·变”为主题，邀请众多不同行业、领域的安全大牛前来，旨在传达无论政府、个人、企业、厂商，都能够聚力赋能，融通变革的主题。"}
{"title": "打造基于Nginx的敏感信息泄露检测系统", "url": "https://www.freebuf.com/articles/web/179848.html", "time": "2018-08-10", "level": "现金奖励", "num_look": 226484, "num_comment": 7, "author": "f4ckbaidu", "tags": ["WEB安全"], "text": "开发总是不把应用/数据库的详细错误信息隐藏，要是哪天出个error-based sqli岂不是倒霉了？如何主动检测敏感信息泄露然后拿去使劲怼开发呢？"}
{"title": "网络入侵溯源跟踪：Redis反弹Shell篇", "url": "https://www.freebuf.com/articles/web/179526.html", "time": "2018-08-10", "level": "现金奖励", "num_look": 289047, "num_comment": 15, "author": "6265113", "tags": ["WEB安全"], "text": "近期客服的妹子来找我说，客户服务器被恶意上传了大量的非法页面，客户要求三天内必须确认漏洞并提出修复方案，赶紧去洗了一把脸开始干活拉，理一理思路先。"}
{"title": "CVE-2018-3639最新边信道攻击详细分析", "url": "https://www.freebuf.com/vuls/179739.html", "time": "2018-08-10", "level": "金币+8", "num_look": 205334, "num_comment": 3, "author": "创世之枪", "tags": ["漏洞"], "text": "出于对CPU相关漏洞的兴趣，我深入研究了下CVE-2018-3639（Spectre4，幽灵4），有不正确的地方欢迎指正。"}
{"title": "BUF早餐铺 | Snapchat源代码被黑客泄露发布到GitHub；三名区块链安全研究员入围2018 Pwnie Awards；美官员称移动漏洞威胁数百万美国用户", "url": "https://www.freebuf.com/news/180335.html", "time": "2018-08-10", "level": "", "num_look": 116716, "num_comment": 1, "author": "Akane", "tags": ["资讯"], "text": "近日，流行社交媒体Snapchat的源代码被黑客泄露，并将其发布在GitHub上。"}
{"title": "BlackHat 2018 | 华硕和华擎产品的固件更新机制存在漏洞，可被植入恶意代码", "url": "https://www.freebuf.com/news/180371.html", "time": "2018-08-09", "level": "", "num_look": 126151, "num_comment": 1, "author": "Freddy", "tags": ["资讯"], "text": "研究人员表示在华硕和华擎的固件中发现了缓冲区溢出漏洞，该漏洞的源头在于UEFI固件更新功能，使得黑客能够远程发起中间人攻击。"}
{"title": "BlackHat 2018 | iOS越狱细节揭秘：危险的用户态只读内存", "url": "https://www.freebuf.com/articles/terminal/180490.html", "time": "2018-08-09", "level": "红色标题", "num_look": 169080, "num_comment": 169080, "author": "腾讯安全科恩实验室", "tags": ["终端安全"], "text": "现代操作系统基本都已经在硬件级别（MMU）支持了用户态只读内存，只读内存映射在保证了跨进程间通信、用户态与内核间通信高效性的同时，也保证了其安全性。"}
{"title": "腾讯云网站管家WAF体验：聊聊AI作为WAF市场转折的趋势", "url": "https://www.freebuf.com/news/180345.html", "time": "2018-08-09", "level": "", "num_look": 442015, "num_comment": 3, "author": "FreeBuf咨询", "tags": ["WEB安全", "系统安全"], "text": "WAF仍然是很多企业用户部署的必选项，但随着传统WAF设备销售的滑坡，WAF市场正面临转折。"}
{"title": "BlackHat 2018 | 混合信号无线芯片面临边信道攻击威胁", "url": "https://www.freebuf.com/news/180336.html", "time": "2018-08-09", "level": "红色标题", "num_look": 104747, "num_comment": 104747, "author": "Freddy", "tags": ["资讯"], "text": "在采用混合设计的无线芯片中，CPU会发生信号泄漏，被基于模拟电路的射频发射模块捕获而一起广播出来，这就为边信道攻击提供了可趁之机。"}
{"title": "BlackHat 2018 | 研究员演示轻松突破绕过macOS防火墙", "url": "https://www.freebuf.com/news/180361.html", "time": "2018-08-09", "level": "红色标题", "num_look": 138064, "num_comment": 138064, "author": "Freddy", "tags": ["系统安全", "资讯"], "text": "在Black Hat 2018大会上，研究人员展示了要突破绕macOS防火墙是多么容易，期望推动苹果以及第三方安全公司加强保护措施。"}
{"title": "GDPR对中国企业风险管理的挑战 | FreeBuf企业精品公开课 × IBM", "url": "https://www.freebuf.com/news/180302.html", "time": "2018-08-09", "level": "", "num_look": 86775, "num_comment": 86775, "author": "FB客服", "tags": ["资讯"], "text": "8月10日， FreeBuf 联合在GDPR方面有着丰富经验的IBM大中华区信息安全顾问高爽先生，为我们分享GDPR对中国企业风险管理的挑战。"}
{"title": "BlackHat 2018 | 谷歌“安全女王”Parisa：维护网络安全还需通力合作", "url": "https://www.freebuf.com/news/180402.html", "time": "2018-08-09", "level": "红色标题", "num_look": 102375, "num_comment": 102375, "author": "Freddy", "tags": ["资讯"], "text": "来自谷歌的“安全女王”Parisa Tabriz的议题——如何进行长远的思考以及建立开放的合作政策，在越来越复杂的网络安全领域中团结各方力量共同打击网络犯罪。"}
{"title": "SqlMap 1.2.7.20 Tamper详解及使用指南", "url": "https://www.freebuf.com/sectool/179035.html", "time": "2018-08-09", "level": "金币+8", "num_look": 784722, "num_comment": 14, "author": "xiaohong0", "tags": ["工具", "数据安全"], "text": "sqlmap/tamper是官方给出的一些绕过脚本，可以配合渗透测试人员完成更高效更高质量的测试。"}
{"title": "向PE文件植入后门代码技术讨论", "url": "https://www.freebuf.com/articles/system/179664.html", "time": "2018-08-09", "level": "", "num_look": 183014, "num_comment": 5, "author": "周大涛", "tags": ["系统安全"], "text": "这篇文章将介绍使用codecaves对PE文件植入后门代码。比如BackdoorFactory和Shelter将完成相同的工作，甚至绕过一些静态分析几个防病毒。"}
{"title": "搭建安全认证的ELK日志系统", "url": "https://www.freebuf.com/articles/security-management/179736.html", "time": "2018-08-09", "level": "现金奖励", "num_look": 420977, "num_comment": 9, "author": "chuanwei", "tags": ["安全管理"], "text": "笔者使用ELK日志系统搭建了日志系统，由于ELK日志系统默认是没有认证功能，日志存储安全无法保证，ELK自身的漏洞也可能增加风险。"}
{"title": "技术讨论 | 利用XXE漏洞获取NetNTLM Hash并通过SMB Relay取得权限", "url": "https://www.freebuf.com/articles/system/179032.html", "time": "2018-08-09", "level": "", "num_look": 159062, "num_comment": 159062, "author": "secist", "tags": ["系统安全"], "text": "XXE漏洞对于企业内部网络来说破坏性不可小觑，特别是在满足所有条件的情况下（解析外部XML实体+SMB消息未签名）。"}
{"title": "《2018企业安全威胁统一应对指南》企业安全产品名录征集开启", "url": "https://www.freebuf.com/fevents/180041.html", "time": "2018-08-09", "level": "红色标题", "num_look": 211225, "num_comment": 1, "author": "FreeBuf咨询", "tags": ["活动"], "text": "在《2018 企业安全威胁统一应对指南》的初期阶段，FreeBuf 研究院制作了一份产品自荐表单，用于更加深入地了解厂商的代表产品及服务，以便后期的分析与评分。"}
{"title": "SHAREit招聘安全工程师", "url": "https://www.freebuf.com/jobs/180161.html", "time": "2018-08-09", "level": "", "num_look": 103626, "num_comment": 1, "author": "SixSixSix", "tags": ["安全招聘"], "text": "北京快乐茄信息技术有限公司成立于2015年4月，是一家全球化科技公司。产品面向全球互联网市场，享誉世界，荣登多国家榜首，为全球用户提供优质的产品服务。"}
{"title": "俄罗斯400多家工业企业遭遇网络钓鱼攻击", "url": "https://www.freebuf.com/news/179729.html", "time": "2018-08-09", "level": "", "num_look": 128521, "num_comment": 128521, "author": "Hydralab", "tags": ["资讯"], "text": "卡巴斯基实验室（Kaspersky Lab）ICS CERT发现了一系列带有恶意附件的网络钓鱼电子邮件，主要针对的是与工业生产相关的企业和机构。"}
{"title": "BUF早餐铺 | Linux 内核出现漏洞可触发远程DoS攻击；谷歌要求安卓9.0设备加入防回滚机制；顺丰上线下单“隐址件”，收寄双方均看不到对方信息", "url": "https://www.freebuf.com/news/180231.html", "time": "2018-08-09", "level": "", "num_look": 138566, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "墨西哥 200 万人的医疗保健数据在线上曝光；Let's Encrypt Root 获得了所有主要机构的信任；发改委：“双公示”要保护个人隐私 防止信息泄露。"}
{"title": "BlackHat 2018 | 10大网络安全热点趋势", "url": "https://www.freebuf.com/news/180191.html", "time": "2018-08-08", "level": "红色标题", "num_look": 199268, "num_comment": 1, "author": "Freddy", "tags": ["观点", "资讯"], "text": "从产品互操作性、第三方漏洞、数据丢失到预防到关键基础设施的威胁，本文罗列是行业领导者在今年Black Hat大会上关注的重点网络安全发展趋势。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列-Brett Buerhaus", "url": "https://www.freebuf.com/video/180233.html", "time": "2018-08-08", "level": "红色标题", "num_look": 160593, "num_comment": 3, "author": "willhuang", "tags": ["视频"], "text": "Brett Buerhaus，美国人，昵称@ziot，曾是Ebay、Yahoo、Twitter、Facebook等多家知名公司网站高危漏洞上报者，其中，最让人印象深刻的是发现了Google某网站的双重认证（2FA）绕过漏洞。"}
{"title": "Memtriage：一款Windows内存取证工具", "url": "https://www.freebuf.com/sectool/179516.html", "time": "2018-08-08", "level": "", "num_look": 247127, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "memtriage是一款Windows内存取证工具。该工具使用Winpmem来抓取内存dump，并使用Volatility进行分析。"}
{"title": "风云再起，签名冒用引发信任危机", "url": "https://www.freebuf.com/articles/security-management/179726.html", "time": "2018-08-08", "level": "", "num_look": 252794, "num_comment": 1, "author": "360安全", "tags": ["安全管理"], "text": "360核心安全团队独家监测到“签名冒用”的新动向，颁发机构除了之前披露的Go Daddy和Starfield Secure两家，知名的老牌CA厂商赛门铁克、Verisign和DigiCert也相继沦陷。"}
{"title": "使用MDM软件的iPhone黑客攻击活动比以前更为广泛", "url": "https://www.freebuf.com/news/178964.html", "time": "2018-08-08", "level": "", "num_look": 99255, "num_comment": 99255, "author": "抗生素1209", "tags": ["资讯"], "text": "两周前 首次亮相的印度高度针对性的移动恶意软件广告系列已被发现是针对多种平台的广泛广告系列的一部分，包括Windows设备，也可能是Android。"}
{"title": "Google Play上的AndroidFoulGoal.A间谍软件分析", "url": "https://www.freebuf.com/articles/terminal/179030.html", "time": "2018-08-08", "level": "", "num_look": 113511, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "世界杯的余热还未散去，但近期安全专家却发现了一个针对世界杯足球球迷的间谍软件活动。"}
{"title": "拍拍贷诚招信息安全人才", "url": "https://www.freebuf.com/jobs/180107.html", "time": "2018-08-08", "level": "", "num_look": 106230, "num_comment": 5, "author": "ppdai", "tags": ["安全招聘"], "text": "拍拍贷成立于2007年6月，公司全称为“上海拍拍贷金融信息服务有限公司”，总部位于国际金融中心的上海， 是中国首批网络信息借贷平台。"}
{"title": "快讯 | MongoDB数据库意外暴露超过200万墨西哥公民的医疗健康数据", "url": "https://www.freebuf.com/news/180103.html", "time": "2018-08-08", "level": "", "num_look": 158757, "num_comment": 158757, "author": "Hydralab", "tags": ["数据安全", "资讯"], "text": "最近，一个MongoDB数据库被发现可以通过互联网公开访问，其中包含了超过200万（2,373,764）墨西哥公民的医疗健康数据。"}
{"title": "从一个实践场景谈“从资产发现到风险监测”模式解决方案的应用", "url": "https://www.freebuf.com/articles/neopoints/179907.html", "time": "2018-08-08", "level": "金币+5", "num_look": 130664, "num_comment": 1, "author": "shiftf2", "tags": ["观点"], "text": "所谓“从资产发现到风险监测”模式的解决方案，是在广义的Web安全领域而言，指蕴含了“通过资产发现过程后，再基于资产数据做风险监测”这样一个基本过程的各种解决方案。"}
{"title": "黑产拿“伪基站”强势转账，我是手机我现在慌得一批", "url": "https://www.freebuf.com/articles/terminal/179820.html", "time": "2018-08-08", "level": "红色标题", "num_look": 596662, "num_comment": 29, "author": "GEETEST极验", "tags": ["数据安全", "终端安全"], "text": "豆瓣的一篇盗刷帖，整得人心惶惶。深夜手机里莫名发起转账，一觉醒来，发现被洗劫一空。“伪基站”再次刷屏。"}
{"title": "缝缝补补的WebLogic：绕过的艺术", "url": "https://www.freebuf.com/vuls/179579.html", "time": "2018-08-08", "level": "", "num_look": 394842, "num_comment": 394842, "author": "深信服千里目安全实验室", "tags": ["WEB安全", "漏洞"], "text": "本文主要介绍了近五年爆发的Weblogic反序列化的高危漏洞，一次又一次的修补，一次又一次的绕过，漏洞挖掘者和漏洞防御者之间的博弈从未停止过，而且这种博弈在今后的生活中也将会愈演愈烈。"}
{"title": "天融信关于VLC Media Player 2.2.8 Use After Free漏洞分析", "url": "https://www.freebuf.com/vuls/179469.html", "time": "2018-08-08", "level": "", "num_look": 139175, "num_comment": 139175, "author": "alphalab", "tags": ["漏洞"], "text": "VLC 是一款自由、开源的跨平台多媒体播放器及框架。它支持众多音频与视频解码器及文件格式和各类流式协议，也能作为流式服务器在 IPv4 或 IPv6 的高速网络连接下使用。"}
{"title": "BUF早餐铺 | 五角大楼禁止工作人员使用健身手环等设备；台积电总裁：病毒是“永恒之蓝”变种，主计算机系统未受影响；2018年8月Android安全补丁发布，共计修复43处漏洞", "url": "https://www.freebuf.com/news/179987.html", "time": "2018-08-08", "level": "", "num_look": 121319, "num_comment": 121319, "author": "shidongqi", "tags": ["资讯"], "text": "此前Freebuf曾报道，台积电遭受病毒感染，导致三大工厂全线停摆，甚至可能影响今年9月份iPhone新品出货时间。而近期确定，其所遭受的病毒正式wannacry变种。"}
{"title": "BlackHat 2018 | 热点议题前瞻，今年的猛料都在这儿！", "url": "https://www.freebuf.com/news/180120.html", "time": "2018-08-07", "level": "红色标题", "num_look": 157541, "num_comment": 157541, "author": "Freddy", "tags": ["资讯"], "text": "Black Hat会议经过二十年的发展，已然成为信息安全人员展示才华的圣地，这里与会者能够看到针对设备、系统和关键基础设施的最新研究、发现的漏洞和黑客技术。"}
{"title": "修改PHP扩展作为持久后门", "url": "https://www.freebuf.com/articles/web/179713.html", "time": "2018-08-07", "level": "", "num_look": 237353, "num_comment": 1, "author": "周大涛", "tags": ["WEB安全"], "text": "在我们作为红队的运营中，我们研究不同的持久后门方法，因为每种技术都有他的优缺点。选择通常基于不同情况，因此对于位于外围的服务器，PHP扩展是一个很棒的选择。"}
{"title": "域渗透分析工具BloodHound 1.5.2入门实战", "url": "https://www.freebuf.com/sectool/179002.html", "time": "2018-08-07", "level": "金币+5", "num_look": 545288, "num_comment": 5, "author": "Dm2333", "tags": ["工具"], "text": "关于BloodHound的相关专业解释，在国内相关博客和原作者github上都有了，为了方便新人，写点从基本安装到相关项目实战脱敏后的讲解。"}
{"title": "实战为王 | FreeBuf精品公开课改版上线", "url": "https://www.freebuf.com/open/179656.html", "time": "2018-08-07", "level": "红色标题", "num_look": 193763, "num_comment": 1, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "大佬授课经验多，观看流畅笑呵呵。增加试听不吃亏，预购8折享优惠。粉丝群里沟通便，后续改版你来定。具体细节看下文，总而言之开心Skr人！"}
{"title": "看Hidden Bee如何利用新型漏洞进行传播", "url": "https://www.freebuf.com/vuls/179653.html", "time": "2018-08-07", "level": "", "num_look": 149603, "num_comment": 3, "author": "周大涛", "tags": ["区块链安全", "漏洞"], "text": "最近我们发现了一个试图利用CVE-2018-4878（Flash Player中的漏洞）漏洞的攻击，其序列与我们当前发现的任何漏洞利用工具都不一样。"}
{"title": "金钱难寐，大盗独行 | 以太坊JSON-RPC接口多种盗币手法大揭秘", "url": "https://www.freebuf.com/vuls/179487.html", "time": "2018-08-07", "level": "", "num_look": 207906, "num_comment": 3, "author": "Knownsec知道创宇", "tags": ["区块链安全", "漏洞"], "text": "古人的盗亦有道，在虚拟货币领域也有着它独特的定义。只有对区块链技术足够了解，才能在这场盛宴中获取足够多的金钱。他们似那黑暗中独行的狼，无论是否得手都会在被发现前抽身而去。"}
{"title": "说出你的信安故事，免费赢取安全大牛渗透测试实战指南", "url": "https://www.freebuf.com/fevents/179221.html", "time": "2018-08-07", "level": "红色标题", "num_look": 351142, "num_comment": 68, "author": "shidongqi", "tags": ["活动"], "text": "在FreeBuf主站本文评论区写出“你为什么走上信息安全这条‘不归路’？” ，小编会在参与评论的同学中抽出10名幸运同学，免费赠送作者亲笔签名的《Web安全攻防：渗透测试实战指南》。‍‍"}
{"title": "恶意PDF文档分析以及payload提取方法", "url": "https://www.freebuf.com/articles/system/178920.html", "time": "2018-08-07", "level": "", "num_look": 256222, "num_comment": 1, "author": "secist", "tags": ["系统安全"], "text": "本文中将向大家展示创建恶意PDF文档，触发并利用漏洞的完整过程，同时深入分析恶意PDF文档，了解payload的存储方式以及提取方法。"}
{"title": "专访网易云易盾卓辉：为什么说外挂是游戏行业的第一大敌？", "url": "https://www.freebuf.com/articles/people/179437.html", "time": "2018-08-07", "level": "红色标题", "num_look": 608752, "num_comment": 5, "author": "Akane", "tags": ["人物志", "特别企划"], "text": "众所周知，各类游戏外挂多如牛毛，手游也不例外。如今市面上充斥着各种XX助手、XX精灵，往往还美其名曰“辅助”……"}
{"title": "伪造Kugou dll木马的一次分析", "url": "https://www.freebuf.com/articles/system/179242.html", "time": "2018-08-07", "level": "现金奖励", "num_look": 215924, "num_comment": 12, "author": "索马里的海盗", "tags": ["系统安全"], "text": "近几天，在XX任务中发现存在异常诡异的流量最终通过端口定位到该程序，便是故事的开始。"}
{"title": "挖洞姿势 | 深度聊聊PHP下的“截断”问题", "url": "https://www.freebuf.com/articles/web/179401.html", "time": "2018-08-07", "level": "现金奖励", "num_look": 261993, "num_comment": 261993, "author": "Sukaralin", "tags": ["WEB安全"], "text": "学弟有天在群里说起上传的%00截断的一些问题，就想起之前自己在这个问题踩过坑，想起了自己曾经的flag说要写文章，一直没写，现在来填坑了。"}
{"title": "全球高级持续性威胁（APT）2018年中报告", "url": "https://www.freebuf.com/articles/system/179460.html", "time": "2018-08-07", "level": "", "num_look": 345947, "num_comment": 345947, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "本报告是360威胁情报中心结合公开的威胁情报和内部情报数据，针对2018年上半年高级威胁事件相关的分析和总结，并对近半年的APT攻击活动所呈现的态势进行分析。"}
{"title": "看我如何回怼手机黑客？黑回去！", "url": "https://www.freebuf.com/articles/terminal/179758.html", "time": "2018-08-07", "level": "", "num_look": 210992, "num_comment": 6, "author": "clouds", "tags": ["终端安全"], "text": "本文中，以色列研究者通过反编译恶意APK应用GlanceLove，向攻击者服务器上传了webshell，实现了Hack Back（黑回去）。"}
{"title": "BUF早餐铺 |  英国政府投资一亿英镑推动数字化警力建设；Apple Watch越狱工具发布；通用汽车推出漏洞悬赏计划", "url": "https://www.freebuf.com/news/179893.html", "time": "2018-08-07", "level": "", "num_look": 107891, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "英国政府投资一亿英镑推动数字化警力建设；Apple Watch越狱工具发布；通用汽车推出漏洞悬赏计划"}
{"title": "BlackHat 2018 | 关注三个热点领域：加密数字货币、医疗设备和机器学习", "url": "https://www.freebuf.com/news/179850.html", "time": "2018-08-06", "level": "", "num_look": 175542, "num_comment": 2, "author": "Freddy", "tags": ["观点", "资讯"], "text": "BlackHat USA是一个很好的机会，让我们一睹最新的攻击手段和相关的防范技术。今年的BlackHat USA大会上，有三个热点领域值得大家关注。"}
{"title": "安全资产管理的“智胜法宝”｜资产识别篇", "url": "https://www.freebuf.com/articles/es/179867.html", "time": "2018-08-06", "level": "红色标题", "num_look": 261185, "num_comment": 2, "author": "斗象智能安全平台", "tags": ["企业安全"], "text": "在企业安全运营体系中，资产安全是所有安全的基础，也是核心的工作。有效的做好资产识别是企业资产安全建设的基石。"}
{"title": "通过USB调试攻击固件安装后门以实现“邪恶女佣”攻击", "url": "https://www.freebuf.com/vuls/178917.html", "time": "2018-08-06", "level": "", "num_look": 237177, "num_comment": 2, "author": "周大涛", "tags": ["漏洞", "终端安全"], "text": "通过USB进行的调试可以访问在UEFI固件和运行时SMM固件中安装持久的rootkit，这种漏洞将允许具有设备物理访问权限的攻击者可以执行“Evil Maid”攻击。"}
{"title": "DorkBot变种俘获大量肉鸡，U盘拷贝需谨慎", "url": "https://www.freebuf.com/articles/terminal/179314.html", "time": "2018-08-06", "level": "", "num_look": 225598, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "DorkBot病毒变种属于蠕虫病毒，被感染的所有主机都会沦为黑客的肉鸡，不定期对外网主机进行DDoS攻击。"}
{"title": "“退改签”诈骗背后，到底谁为黑产大开方便之门？", "url": "https://www.freebuf.com/articles/network/179387.html", "time": "2018-08-06", "level": "现金奖励", "num_look": 394861, "num_comment": 23, "author": "GEETEST极验", "tags": ["网络安全"], "text": "上次说完航空公司信息泄露后，没想到清华计算机教授也惨遭此难。在评论区有小伙伴透露说航空公司只是在背锅，那么在这迷雾重重的背后到底是在给谁背锅呢？又是谁给黑产打开了大门呢？"}
{"title": "经验分享 | 防范数据窃取从了解其手法做起", "url": "https://www.freebuf.com/articles/database/178821.html", "time": "2018-08-06", "level": "", "num_look": 175182, "num_comment": 175182, "author": "secist", "tags": ["数据安全"], "text": "数据窃取是针对组织攻击链中的最后一个阶段。攻击者窃取数据的技术可谓花样百出，网上也有大量关于数据窃取方面的技术文档以及工具。"}
{"title": "Ghost Tunnel复现", "url": "https://www.freebuf.com/articles/wireless/178925.html", "time": "2018-08-06", "level": "金币+8", "num_look": 612900, "num_comment": 3, "author": "网络安全通", "tags": ["数据安全", "无线安全"], "text": "之前很早就已经看到360关于Ghosttunnel的研究，当时也一时兴起进行复现。在mac和Windows上都做了一系列尝试，证明了理论可行。"}
{"title": "BUF早餐铺 |  20多万MikroTik路由器被劫持挖矿；Edge浏览器漏洞可被黑客利用窃取本地文件；500万条乘客航班信息泄露链条曝光", "url": "https://www.freebuf.com/news/179675.html", "time": "2018-08-06", "level": "", "num_look": 135300, "num_comment": 135300, "author": "AngelaY", "tags": ["资讯"], "text": "新一轮钓鱼活动针对400 多家工业组织发起攻击； 新版 CCleaner 增加数据监控和数据收集功能且无法关闭。"}
{"title": "超过1万个基于WordPress的网站被黑客攻击", "url": "https://www.freebuf.com/articles/179391.html", "time": "2018-08-05", "level": "", "num_look": 252814, "num_comment": 2, "author": "Freddy", "tags": ["WEB安全", "文章"], "text": "近日，网络安全公司Check Point披露了一场大规模恶意广告攻击行动。攻击者通过购买披着合法外衣的”加料“网站广告位，劫持用户流量来获取黑色利益。"}
{"title": "台积电三大工厂接连遭病毒感染，敲响工控安全的警钟", "url": "https://www.freebuf.com/news/179766.html", "time": "2018-08-05", "level": "", "num_look": 236112, "num_comment": 6, "author": "shidongqi", "tags": ["资讯"], "text": "8月3日晚，台积电部分生产设备相继遭到病毒感染，导致台积电台湾三大生产基地相继停摆。官方承认病毒感染，但并非黑客攻击。"}
{"title": "挖洞经验 | 看我如何发现微软Microsoft Translator Hub服务高危漏洞", "url": "https://www.freebuf.com/articles/web/178766.html", "time": "2018-08-05", "level": "", "num_look": 546547, "num_comment": 4, "author": "clouds", "tags": ["WEB安全"], "text": "因为微软公司部署有很多在线网站和服务，对漏洞挖掘者来说具备较广的攻击测试面，发现漏洞入选微软致谢榜的难度相对不大，所以我就把大把时间耗在了微软漏洞发现上。"}
{"title": "经验分享｜谈谈渗透测试中的信息搜集", "url": "https://www.freebuf.com/articles/web/179043.html", "time": "2018-08-05", "level": "金币+8", "num_look": 572863, "num_comment": 13, "author": "crhua", "tags": ["WEB安全"], "text": "渗透测试的第一步是信息搜集，那么你的信息搜集完整性决定了你渗透测试的结果，\"知己知彼，百战不殆\"。"}
{"title": "一个FreeBSD下的通信协议监控程序", "url": "https://www.freebuf.com/geek/179036.html", "time": "2018-08-05", "level": "金币+12", "num_look": 175861, "num_comment": 2, "author": "rochek", "tags": ["极客"], "text": "这是一个简易的通信协议的hook，可以在FreeBSD11上使用。"}
{"title": "“短信验证码”早已不安全，睡梦之中就能被盗刷", "url": "https://www.freebuf.com/news/179743.html", "time": "2018-08-04", "level": "红色标题", "num_look": 437042, "num_comment": 11, "author": "AdlerI", "tags": ["资讯"], "text": "近日，国内各地都陆续发生了一些利用短信验证码冒用身份、窃取银行账户、金融类 APP 财产的案件，受害者甚至莫名其妙“被网贷”，进而遭遇较大经济损失。"}
{"title": "Scout2：一款针对AWS环境的安全审计工具", "url": "https://www.freebuf.com/sectool/179029.html", "time": "2018-08-04", "level": "", "num_look": 180715, "num_comment": 180715, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Scout2的安全审计工具，广大安全研究人员可以用它来对AWS环境的安全性进行检测。"}
{"title": "白帽采访 | 对话香港HackerOne白帽Ron Chan", "url": "https://www.freebuf.com/articles/people/178671.html", "time": "2018-08-04", "level": "", "num_look": 393751, "num_comment": 8, "author": "clouds", "tags": ["人物志"], "text": "Ron Chan，中国香港人，专职网络安全顾问和漏洞挖掘专家。目前以277个漏洞的上报量排名HackerOne榜单第26位，是为数不多的华人Bug Hunter。"}
{"title": "【FB TV】一周「BUF大事件」：工信部联合各国家部门集中整治个人信息安全问题；央视批苹果App Store：审核不严，系统存漏洞", "url": "https://www.freebuf.com/video/179592.html", "time": "2018-08-04", "level": "红色标题", "num_look": 148577, "num_comment": 148577, "author": "willhuang", "tags": ["视频"], "text": "工信部联合各国家部门集中整治个人信息泄漏、骚扰电话等问题；央视批苹果App Store：审核不严，系统存漏洞；Google Play商店封杀挖矿APP，下架多款违规应用。"}
{"title": "Emotet的演变：从银行木马到网络威胁分销商", "url": "https://www.freebuf.com/news/178863.html", "time": "2018-08-04", "level": "", "num_look": 234814, "num_comment": 234814, "author": "Hydralab", "tags": ["网络安全", "资讯"], "text": "有证据表明，Emotet背后的运营团队Mealybug已经从维护自己的自定义银行木马发展成为了其他组织的恶意软件的分销商。"}
{"title": "Camelishing：成熟的社会工程学工具技术分享", "url": "https://www.freebuf.com/sectool/178516.html", "time": "2018-08-03", "level": "", "num_look": 262860, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "Camelishing是一款成熟的社会工程学工具，通过分析其安装与使用，可以找到合适的应对方法。"}
{"title": "20多万台MikroTik路由器被黑，用户被迫扛起锄头挖矿", "url": "https://www.freebuf.com/news/179669.html", "time": "2018-08-03", "level": "红色标题", "num_look": 284347, "num_comment": 284347, "author": "Freddy", "tags": ["资讯"], "text": "研究人员发现20 多万台MikroTik路由器被黑客接管，让用户不知不觉中为他们挖矿。"}
{"title": "私钥丢失也能找回以太币？", "url": "https://www.freebuf.com/articles/blockchain-articles/179662.html", "time": "2018-08-03", "level": "", "num_look": 193437, "num_comment": 1, "author": "BUGX", "tags": ["区块链安全"], "text": "今天给大家介绍的无私钥以太币(keyless Ether)则是将以太币放置到一个隐蔽的地址上，即使私钥丢失，你可以找回你的以太币，保证相对\"安全\"。"}
{"title": "Oracle Enterprise Manager Grid Control JSP代码执行漏洞(CVE-2010-3600)", "url": "https://www.freebuf.com/vuls/179276.html", "time": "2018-08-03", "level": "现金奖励", "num_look": 279119, "num_comment": 4, "author": "一只胖麻瓜biu", "tags": ["漏洞"], "text": "Oracle Enterprise Manager Grid Control是可以监控和管理网格中的Oracle数据库软件的工具。"}
{"title": "远程定位追踪联网车辆以及利用思路分析", "url": "https://www.freebuf.com/vuls/178604.html", "time": "2018-08-03", "level": "现金奖励", "num_look": 414338, "num_comment": 14, "author": "星空111", "tags": ["无线安全", "漏洞"], "text": "整整花了一周时间在网上查了相关驾考整个通信系统的相关技术文章。"}
{"title": "恶意软件分析虚拟机OALabs安装教程", "url": "https://www.freebuf.com/articles/system/178331.html", "time": "2018-08-03", "level": "", "num_look": 175764, "num_comment": 175764, "author": "secist", "tags": ["系统安全"], "text": "本教程是有关如何使用OAlabs-VM installer安装和配置一个FREE Windows 7 VM的详细说明。"}
{"title": "贪狼Rootkit僵尸家族再度活跃：挖矿+DDOS+劫持+暗刷", "url": "https://www.freebuf.com/articles/paper/178927.html", "time": "2018-08-03", "level": "", "num_look": 253789, "num_comment": 9, "author": "安全豹", "tags": ["安全报告"], "text": "“贪狼”家族开始再度活跃，除了Http(s)劫持模块不断加强外，开始顺应黑产潮流加入“门罗币”挖矿功能模块，下发DDOS木马插件，其威胁度和攻击性正在不断加强。"}
{"title": "工控安全现场实施经验谈之工控系统如何加强主机防护", "url": "https://www.freebuf.com/articles/network/178251.html", "time": "2018-08-03", "level": "现金奖励", "num_look": 366130, "num_comment": 1, "author": "liujianshuai", "tags": ["工控安全", "网络安全"], "text": "17年某能源企业大面积感染勒索病毒更是加快了行业内工控安全整体建设的步伐，如何对主机终端的进行更好的安全防护一直是我们思考的问题。"}
{"title": "基于Docker的蜜罐平台搭建：T-Pot 17.10", "url": "https://www.freebuf.com/sectool/178998.html", "time": "2018-08-03", "level": "现金奖励", "num_look": 685289, "num_comment": 26, "author": "枫夜丶", "tags": ["工具"], "text": "本文对T-Pot17.10进行简要介绍，并讲讲我在安装该平台时遇到的坑和坑和坑，希望对大家有帮助。"}
{"title": "BUF早餐铺 | Steam上出现假冒游戏的挖矿软件；Telegram被曝新的身份验证程序加密方式易受攻击；浙江省1000万学籍数据正在暗网售卖", "url": "https://www.freebuf.com/news/179537.html", "time": "2018-08-03", "level": "", "num_look": 143437, "num_comment": 143437, "author": "Akane", "tags": ["资讯"], "text": "虽然审核机制比较完善，但目前最大的PC端游戏平台Steam上的还是会存在一些非法游戏。"}
{"title": "Go语言逆向去符号信息还原", "url": "https://www.freebuf.com/articles/others-articles/176803.html", "time": "2018-08-02", "level": "金币+6", "num_look": 303978, "num_comment": 2, "author": "Mworld", "tags": ["其他"], "text": "很多朋友都觉得golang的逆向分析很难，其实不然，和其他编程语言相比，go语言的函数太多。"}
{"title": "Satori变种利用开放的ADB端口在Android设备中传播", "url": "https://www.freebuf.com/vuls/178914.html", "time": "2018-08-02", "level": "", "num_look": 169557, "num_comment": 1, "author": "周大涛", "tags": ["漏洞", "终端安全"], "text": "对于许多物联网用户来说，利用设备上的开放端口一直是一个持续存在的问题。特别是TCP端口5555在过去遇到过问题，因为这是产品制造商在出厂之前将其打开，所以这可能会使用户暴露给攻击者。"}
{"title": "对自助提卡系统的一次代码审计", "url": "https://www.freebuf.com/vuls/178744.html", "time": "2018-08-02", "level": "现金奖励", "num_look": 630295, "num_comment": 22, "author": "FK_T", "tags": ["WEB安全", "漏洞"], "text": "自助提卡系统相信大家已经不在陌生了。很多违法网站通过这种平台方式提卡密，相当于购买邀请码。简单的做一次代码审计。"}
{"title": "Libemu：x86模拟和shellcode检测库的安装及使用", "url": "https://www.freebuf.com/sectool/178518.html", "time": "2018-08-02", "level": "", "num_look": 152237, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "总的来说Libemu的安装还是非常简单的。因此，我想把我的安装过程分享给大家以供大家参考。"}
{"title": "传媒和信息技术在西方国家选举中的影响方式", "url": "https://www.freebuf.com/articles/neopoints/179052.html", "time": "2018-08-02", "level": "", "num_look": 113291, "num_comment": 1, "author": "clouds", "tags": ["观点"], "text": "当今，传媒和信息技术在国家政治事件中发挥着重要作用，同样在社会中也扮演着关键角色。我们以国家选举过程为例，阐述传媒和信息技术在其中的重要性。"}
{"title": "2FA双因素认证之Authy", "url": "https://www.freebuf.com/articles/web/179034.html", "time": "2018-08-02", "level": "金币+6", "num_look": 200425, "num_comment": 200425, "author": "yuegui_2004", "tags": ["WEB安全"], "text": "今天我们要介绍的 Authy 双因素认证，是一种更强大更方便的解决方案，并且能够很好的兼容所有使用 Google Authenticator 的网站。"}
{"title": "如何开始学习逆向以及分析恶意软件？", "url": "https://www.freebuf.com/news/178382.html", "time": "2018-08-02", "level": "", "num_look": 243037, "num_comment": 2, "author": "secist", "tags": [], "text": "在本文中我将为初学者提供一些关于逆向和恶意软件分析的学习经验以及一些实用的链接资源。"}
{"title": "QQ三国盗号木马分析报告", "url": "https://www.freebuf.com/articles/system/179046.html", "time": "2018-08-02", "level": "现金奖励", "num_look": 291022, "num_comment": 6, "author": "RNGorgeous", "tags": ["安全报告", "系统安全"], "text": "近年来网络游戏越来越火，人们充值大量金钱玩一个心爱的游戏已成常态，所以有些游戏账号非常值钱，特别是QQ三国这种每次更新都要氪金的游戏"}
{"title": "统一的RDP弱密码有多危险？CrySiS勒索分分钟搞瘫大片业务", "url": "https://www.freebuf.com/articles/terminal/179004.html", "time": "2018-08-02", "level": "", "num_look": 171572, "num_comment": 171572, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "多个行业的业务系统大面积瘫痪，主要是统一的RDP弱密码造成的，遭遇的勒索家族为CrySiS，目前仍然是比较活跃的勒索家族之一。"}
{"title": "警惕！EOS恶意合约可吞噬用户RAM漏洞分析", "url": "https://www.freebuf.com/vuls/179515.html", "time": "2018-08-02", "level": "", "num_look": 199290, "num_comment": 1, "author": "美图安全应急响应中心", "tags": ["区块链安全", "漏洞"], "text": "2018年7月23日，美图区块链实验室发现EOS恶意合约可吞噬用户RAM的安全漏洞。 经过反复调试确认后，于7月24日将问题提交EOSIO官方，并就漏洞细节与官方团队进行了充分沟通。"}
{"title": "2018年上半年中国互联网安全报告", "url": "https://www.freebuf.com/articles/paper/179295.html", "time": "2018-08-02", "level": "", "num_look": 312431, "num_comment": 2, "author": "360安全", "tags": ["安全报告"], "text": "具有一定的上网能力，上网时间较长，同时又缺乏足够社会经验的年轻人是网络诈骗的主要对象和主要受害人群。"}
{"title": "BUF早餐铺 | 央视批App Store审核不严，系统存漏洞；Dixons Carphone数据泄露影响一千多万用户；SamSam获取赎金约600万美元", "url": "https://www.freebuf.com/news/179429.html", "time": "2018-08-02", "level": "", "num_look": 116177, "num_comment": 4, "author": "AngelaY", "tags": ["资讯"], "text": "Google Play下架 100 多款带有恶意 Windows 程序的安卓应用；惠普发布 1 万美元奖金悬赏打印机漏洞；涉及账户信息安全，两家第三方支付机构被重罚"}
{"title": "对恶意Android应用Bangle Android App Packer的分析", "url": "https://www.freebuf.com/vuls/178919.html", "time": "2018-08-01", "level": "", "num_look": 145301, "num_comment": 1, "author": "周大涛", "tags": ["漏洞"], "text": "近日Trustlook Labs发现了一个恶意安卓应用程序，它使用社会工程手法诱骗用户安装。这个应用程序使用Bangle packer打包。"}
{"title": "FACT：一款固件类比分析测试平台", "url": "https://www.freebuf.com/sectool/179056.html", "time": "2018-08-01", "level": "金币+6", "num_look": 203788, "num_comment": 203788, "author": "Murkfox", "tags": ["工具"], "text": "FACT 全称 Firmware Analysis and Comparison Tool 是一个拥有WEB端的自动化固件测试平台。"}
{"title": "KillerBee：一款针对IEEE 802.15.4ZigBee的安全研究工具套件", "url": "https://www.freebuf.com/sectool/178330.html", "time": "2018-08-01", "level": "", "num_look": 177044, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫KillerBee的工具，研究人员可以利用该工具对ZigBee及IEEE 802.15.4网络进行安全分析。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列-Filedescriptor", "url": "https://www.freebuf.com/video/179427.html", "time": "2018-08-01", "level": "红色标题", "num_look": 202889, "num_comment": 9, "author": "willhuang", "tags": ["视频"], "text": "Filedescriptor，一名来自香港的HackerOne白帽黑客。目前以108个漏洞上报量和4655分的声誉值占据Twitter致谢榜首位，是Twitter官方和众多著名白帽眼中的 “Twitter安全专家”。"}
{"title": "以威胁情报分析视角看新加坡新保集团数据泄露事件", "url": "https://www.freebuf.com/articles/neopoints/179144.html", "time": "2018-08-01", "level": "", "num_look": 172657, "num_comment": 1, "author": "clouds", "tags": ["观点"], "text": "最近，新加坡国内最大的健康服务机构-新保集团（SingHealth）遭受网络攻击，导致大量数据泄露。"}
{"title": "挖洞经验 | 看我如何发现Google生产网络SSRF漏洞获取$13337赏金", "url": "https://www.freebuf.com/articles/web/178514.html", "time": "2018-08-01", "level": "", "num_look": 254321, "num_comment": 8, "author": "clouds", "tags": ["WEB安全"], "text": "今年3月份时，我曾上报过Google的任意html/javascript网页在线嵌入工具Caja的一个XSS漏洞，到5月份时，这个漏洞才被修复。"}
{"title": "2018上半年暗网现状 | 逐渐成为威胁情报来源，与加密货币互相影响", "url": "https://www.freebuf.com/articles/neopoints/179189.html", "time": "2018-08-01", "level": "红色标题", "num_look": 819062, "num_comment": 4, "author": "AngelaY", "tags": ["特别企划", "观点"], "text": "在安全研究者眼中，关于暗网有哪些常见误解？当前的暗网情况如何？加密货币与暗网如何相互影响？企业又将如何应对来自暗网的威胁呢？"}
{"title": "记一次Format String的利用（格式化字符串不在栈上）", "url": "https://www.freebuf.com/vuls/179051.html", "time": "2018-08-01", "level": "金币+8", "num_look": 242877, "num_comment": 5, "author": "bin2415", "tags": ["其他", "漏洞"], "text": "记录一道关于format string漏洞的利用方法。"}
{"title": "浅析煤炭企业如何进行工控安全建设", "url": "https://www.freebuf.com/articles/ics-articles/178822.html", "time": "2018-08-01", "level": "现金奖励", "num_look": 364502, "num_comment": 6, "author": "liujianshuai", "tags": ["工控安全"], "text": "煤炭工业控制系统是整个煤炭企业安全生产监控系统信息的集成，它需要一个快速、安全、可靠的网络平台为大量的信息流动提供支撑。"}
{"title": "威胁预警 | SamSam勒索病毒最新变种来袭", "url": "https://www.freebuf.com/articles/terminal/179085.html", "time": "2018-08-01", "level": "", "num_look": 170251, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["终端安全", "网络安全"], "text": "近日SamSam勒索病毒再度以最新的变种样本出现，加密的流程与之前发现的SamSam的变种基本一致。"}
{"title": "多个疑似“摩诃草”团伙来源定向攻击的关联分析", "url": "https://www.freebuf.com/articles/system/178986.html", "time": "2018-08-01", "level": "", "num_look": 171513, "num_comment": 171513, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "CiscoTalos研究团队在近期披露了一例针对印度iOS用户的定向攻击活动[1]，但原文并没有明确攻击组织相关背景。"}
{"title": "探索基于.NET下妙用DLL处理映射实现后渗透权限维持", "url": "https://www.freebuf.com/articles/web/179240.html", "time": "2018-08-01", "level": "", "num_look": 203702, "num_comment": 6, "author": "云影实验室", "tags": ["WEB安全"], "text": "笔者从攻防的视角总结出.NET下妙用DLL作为后门帮助后渗透阶段权限维持的一些姿势。"}
{"title": "Metasploit开发指北", "url": "https://www.freebuf.com/articles/system/179134.html", "time": "2018-08-01", "level": "现金奖励", "num_look": 523260, "num_comment": 3, "author": "Green_m", "tags": ["系统安全"], "text": "本文将通过一些简单的例子说明如何开始学习对 Metasploit Framework 进行开发。"}
{"title": "BUF早餐铺 | 工信部就", "url": "https://www.freebuf.com/news/179288.html", "time": "2018-08-01", "level": "红色标题", "num_look": 138828, "num_comment": 4, "author": "shidongqi", "tags": ["资讯"], "text": "工信部就近期关于\"调取摄像头权限\"的报道，对携程、腾讯、爱奇艺等多家公司进行问询，要求上述企业按照《网络安全法》等有关网络数据和用户个人信息保护要求，进一步完善内部管理制度和技术保障措施。"}
{"title": "腾讯安全2018上半年互联网黑产研究报告", "url": "https://www.freebuf.com/articles/paper/179308.html", "time": "2018-07-31", "level": "", "num_look": 255829, "num_comment": 4, "author": "腾讯手机管家", "tags": ["安全报告"], "text": "病毒木马的演变史，就是一部互联网黑产演变史。病毒木马从最初的以炫技为目的，逐步过渡到与利益相关：哪里有流量，哪里能够获利，哪里便会有黑产聚集。"}
{"title": "MaiInt：基于某应用的公司雇员信息收集测试工具", "url": "https://www.freebuf.com/sectool/178089.html", "time": "2018-07-31", "level": "", "num_look": 254503, "num_comment": 3, "author": "clouds", "tags": ["WEB安全", "工具"], "text": "本文将介绍一款由埃森哲安全实验室Vincent Yiu开发的，针对中国某职场社交应用的开源信息自动化收集测试工具-MaiInt。"}
{"title": "网络摄像头登录绕过及多个RCE漏洞及数据分析报告", "url": "https://www.freebuf.com/vuls/179155.html", "time": "2018-07-31", "level": "", "num_look": 431517, "num_comment": 431517, "author": "Knownsec知道创宇", "tags": ["漏洞"], "text": "从酷视官方发布更新版固件到本文发布约一年的时间里，大部分设备依然没有安装更新版固件。这意味着还有很大数量的目标设备处于风险之中。"}
{"title": "父母朋友圈里的“养生伪科学”爆款文，竟然养活了一条黑色产业链", "url": "https://www.freebuf.com/articles/network/179074.html", "time": "2018-07-31", "level": "金币+10", "num_look": 561258, "num_comment": 16, "author": "GEETEST极验", "tags": ["网络安全"], "text": "我们希望这篇文章，能够帮助父母，逃出大家设置的微信黑名单……"}
{"title": "IntSights研究表明：暗网和加密聊天室情报将有助于预测黑客行为", "url": "https://www.freebuf.com/news/178341.html", "time": "2018-07-31", "level": "", "num_look": 164352, "num_comment": 164352, "author": "Alpha_h4ck", "tags": ["观点", "资讯"], "text": "那些大规模数据泄露事件往往都是通过精心策划来执行和实现的，而策划这样的攻击活动多多少少都会在网上留下痕迹。"}
{"title": "小红书诚招信息安全人才", "url": "https://www.freebuf.com/jobs/179084.html", "time": "2018-07-31", "level": "", "num_look": 154601, "num_comment": 3, "author": "longhuayiyuan", "tags": ["安全招聘"], "text": "小红书的办公室位于小红书的上海办公室位于核心CBD，地处繁华的新天地商圈。 附近交通便利, 多条地铁线可达，不用为租房或离家远而担心，可选范围非常广泛。"}
{"title": "如何在只有Bash反弹Shell的情况下上传文件", "url": "https://www.freebuf.com/articles/system/178515.html", "time": "2018-07-31", "level": "现金奖励", "num_look": 306249, "num_comment": 11, "author": "Zzzxbug", "tags": ["系统安全"], "text": "在本文中，我将介绍一款自己编写的小工具NcPutter，并用它来实现在只有bash反弹shell情况下的文件上传。"}
{"title": "如何“爆破检测”加密密码字段和存在验证码的Web系统", "url": "https://www.freebuf.com/articles/web/177814.html", "time": "2018-07-31", "level": "现金奖励", "num_look": 380914, "num_comment": 13, "author": "shystartree", "tags": ["WEB安全"], "text": "一直想对本人公司所在的某管理平台（下文简称为A平台）进行一下弱口令检测，但是该平台做了设置验证码（做了一定的干扰效果）和密码加密等防御措施而无法使用一些常规的爆破工具进行攻击。"}
{"title": "利用SACL审核文件操作思路分享", "url": "https://www.freebuf.com/articles/system/178102.html", "time": "2018-07-31", "level": "现金奖励", "num_look": 184729, "num_comment": 1, "author": "无。", "tags": ["系统安全"], "text": "利用SACL，我们可以记录系统中对特定安全对象的访问细节，如访问时间、访问类型和访问进程等信息。本文将以文件为例，阐述该如何利用SACL实现对安全对象的访问审核。"}
{"title": "BUF早餐铺 | Telegram发布个人身份验证工具；三星智能家居平台SmartThings Hub出现大量漏洞；工信部等13部门联合：整治骚扰电话专项行动", "url": "https://www.freebuf.com/news/179140.html", "time": "2018-07-31", "level": "", "num_look": 128263, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "Telegram发布个人身份验证工具；三星智能家居平台SmartThings Hub出现大量漏洞；工信部等13部门联合：整治骚扰电话专项行动"}
{"title": "Windows系统监听键盘通过UDP协议控制树莓派小车", "url": "https://www.freebuf.com/geek/178552.html", "time": "2018-07-30", "level": "金币+10", "num_look": 224852, "num_comment": 17, "author": "xutiejun", "tags": ["极客"], "text": "我的小车控制系统在开发的过程中遇到了很多小问题，都被我一一修正了，将开发经验与大家分享，希望后来人能少走些弯路。"}
{"title": "以太坊智能合约中随机数预测", "url": "https://www.freebuf.com/vuls/179173.html", "time": "2018-07-30", "level": "红色标题", "num_look": 299169, "num_comment": 2, "author": "BUGX", "tags": ["区块链安全", "漏洞"], "text": "作为首次币发行（ICO）的平台，以太坊已经获得了极大的普及。 但是，它不仅仅用于 ERC20 通证，轮盘，彩票和纸牌游戏都可以使用以太坊区块链实现。"}
{"title": "Ph0neutria：一款从野外采集恶意软件样本的工具", "url": "https://www.freebuf.com/sectool/178155.html", "time": "2018-07-30", "level": "", "num_look": 280986, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "ph0neutria是一个直接从野外采集恶意软件样本的工具。并且其所有采集的内容都将被存储在Viper中，以便于访问和管理。"}
{"title": "在Web服务器防止Host头攻击", "url": "https://www.freebuf.com/articles/web/178315.html", "time": "2018-07-30", "level": "金币+10", "num_look": 1274996, "num_comment": 7, "author": "非凡安全广州分部", "tags": ["WEB安全"], "text": "本文给出几种常见服务器防止 Host 头攻击的参考修复方法，其中如有错误或不妥的地方欢迎指正。"}
{"title": "使用lodine建立DNS隧道", "url": "https://www.freebuf.com/articles/system/178214.html", "time": "2018-07-30", "level": "", "num_look": 274634, "num_comment": 2, "author": "secist", "tags": ["系统安全"], "text": "最近我在我的一个VPS上设置了DNS隧道。这项技术对于绕过captive portals（强制登录门户），过滤器等非常有用。"}
{"title": "当Struts2遇到防火墙，你的思路够骚吗？", "url": "https://www.freebuf.com/articles/web/178650.html", "time": "2018-07-30", "level": "现金奖励", "num_look": 468678, "num_comment": 37, "author": "道恩先生666", "tags": ["WEB安全"], "text": "偶然碰到一个小站存在st2-046代码远程执行漏洞，心里美滋滋。"}
{"title": "威胁快报 | 首个Spark REST API未授权漏洞利用分析", "url": "https://www.freebuf.com/vuls/179092.html", "time": "2018-07-30", "level": "", "num_look": 231690, "num_comment": 1, "author": "阿里云安全", "tags": ["WEB安全", "漏洞"], "text": "2018年7月7日，阿里云安全首次捕获Spark REST API的未授权RCE漏洞进行攻击的真实样本。7月9号起，阿里云平台已能默认防御此漏洞的大规模利用。"}
{"title": "富途网络招聘安全人才", "url": "https://www.freebuf.com/jobs/178923.html", "time": "2018-07-30", "level": "", "num_look": 121379, "num_comment": 121379, "author": "futujobs", "tags": ["安全招聘"], "text": "富途成立于2012年4月，创始人为前腾讯第18号员工，是互联网券商领导者，提供一站式港美股投资服务。"}
{"title": "APT-C-35组织（肚脑虫）的最新攻击活动分析", "url": "https://www.freebuf.com/articles/system/178840.html", "time": "2018-07-30", "level": "", "num_look": 233304, "num_comment": 2, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "APT-C-35主要针对巴基斯坦等南亚地区国家进行网络间谍活动，该组织主要针对政府机构等领域进行攻击，其中以窃取敏感信息为主。"}
{"title": "盗版软件也疯狂之六耳猕猴显神通", "url": "https://www.freebuf.com/articles/terminal/178866.html", "time": "2018-07-30", "level": "红色标题", "num_look": 232650, "num_comment": 7, "author": "暗影安全实验室", "tags": ["终端安全"], "text": "近日，笔者闲暇时光下载了一个小游戏进行玩耍，游戏结束后没再管它，当下次点亮手机时，惊奇的发现在手机主界面中心有一应用推荐轮播的悬浮窗。"}
{"title": "又一个登陆框引起的血案", "url": "https://www.freebuf.com/articles/web/178687.html", "time": "2018-07-30", "level": "现金奖励", "num_look": 490160, "num_comment": 21, "author": "丶楼兰", "tags": ["WEB安全"], "text": "继上次登陆框引起的血案这个文章之后，时隔一个月笔者又写了续集，呃 ... 升华版 =="}
{"title": "BUF早餐铺 | 亚马逊面部识别误将国会议员识别为罪犯；推特下架超过14万违反隐私政策的APP；在押囚犯利用平板漏洞窃取22.5万美元数字资产", "url": "https://www.freebuf.com/news/178949.html", "time": "2018-07-30", "level": "", "num_look": 286697, "num_comment": 1, "author": "Akane", "tags": ["资讯"], "text": "美国公民自由联盟（ACLU）测试了亚马逊的面部识别系统，结果并不好，竟然将国会议员识别成了罪犯，令人哭笑不得。"}
{"title": "XXE漏洞利用技巧：从XML到远程代码执行", "url": "https://www.freebuf.com/articles/web/177979.html", "time": "2018-07-29", "level": "", "num_look": 1441217, "num_comment": 4, "author": "secist", "tags": ["WEB安全"], "text": "XXE是一种非常常见的漏洞类型，我们几乎每天都会碰到它。在去年的几次web应用渗透中，我们就成功的利用了好几回。"}
{"title": "如何设置自己的Dionaea蜜罐来收集恶意软件样本", "url": "https://www.freebuf.com/articles/system/177577.html", "time": "2018-07-29", "level": "", "num_look": 226816, "num_comment": 226816, "author": "secist", "tags": ["系统安全"], "text": "许多安全人员都热衷于恶意软件的逆向工程。在本文中我将教大家设置一个自己的Dionaea蜜罐，来协助我们恶意软件样本的收集工作。"}
{"title": "浏览器攻击框架BeEF Part 5：Web应用及网络攻击测试", "url": "https://www.freebuf.com/articles/web/176912.html", "time": "2018-07-29", "level": "金币+10", "num_look": 279217, "num_comment": 1, "author": "NT00", "tags": ["WEB安全"], "text": "本章探讨如何在不违反SOP情况下，通过勾连浏览器攻击Web应用与攻击网络。其中有一些攻击技术就用到了Tunneling Proxy的技术。"}
{"title": "利用Winrm.vbs绕过白名单限制执行任意代码", "url": "https://www.freebuf.com/articles/system/178035.html", "time": "2018-07-29", "level": "", "num_look": 195156, "num_comment": 3, "author": "无。", "tags": ["系统安全"], "text": ""}
{"title": "一款通过寻找和串联Gadget来构建ROP漏洞利用的工具", "url": "https://www.freebuf.com/sectool/177847.html", "time": "2018-07-28", "level": "", "num_look": 258611, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具", "漏洞"], "text": "今天给大家介绍的是一款名叫ROPGenerator的ROP漏洞利用开发工具，它能够自动寻找gadget，并构建ROP漏洞利用链，该工具当前版本支持x86和x64源码。"}
{"title": "初识Linux渗透：从枚举到内核利用", "url": "https://www.freebuf.com/articles/system/177938.html", "time": "2018-07-28", "level": "", "num_look": 337166, "num_comment": 337166, "author": "secist", "tags": ["系统安全"], "text": "虽然Linux加载了强大的安全机制，但仍可能受到来自各方面带来的安全威胁。"}
{"title": "WebLogic两处任意文件上传漏洞动态分析（CVE-2018-2894）", "url": "https://www.freebuf.com/vuls/178510.html", "time": "2018-07-28", "level": "", "num_look": 486233, "num_comment": 5, "author": "云影实验室", "tags": ["WEB安全", "漏洞"], "text": "CNCERT发公告称发现Oracle公司出品的基于JavaEE结构的中间件WebLogic产品存在远程上传漏洞，并得到了厂商的确认，危害程度评分高达9.8分。"}
{"title": "【FB TV】一周「BUF大事件」：“疫苗门”涉事公司官网被黑：不搞你，对不起祖国的花朵；；广东重庆多家三甲医院服务器遭暴力入侵享挖矿资源", "url": "https://www.freebuf.com/video/179005.html", "time": "2018-07-28", "level": "红色标题", "num_look": 214230, "num_comment": 4, "author": "willhuang", "tags": ["视频"], "text": "“疫苗门”涉事公司长春长生官网被黑：不搞你，对不起祖国的花朵；广东重庆多家三甲医院服务器遭暴力入侵，黑客独享挖矿资源；恶意EOS合约存在吞噬用户RAM的安全风险。"}
{"title": "基于Golang打造开源的WAF网关", "url": "https://www.freebuf.com/articles/web/178308.html", "time": "2018-07-28", "level": "金币+10", "num_look": 298128, "num_comment": 6, "author": "janusec", "tags": ["WEB安全"], "text": "在互联网行业，Google将安全做到基础设施里面，素来是各大公司学习的榜样，在Web方面，通过GFE统一对外发布，业务只需要在GFE登记，GFE就会调取正确的证书，保障用户到GFE的TLS连接安全。"}
{"title": "区块链安全技术总结", "url": "https://www.freebuf.com/vuls/178587.html", "time": "2018-07-27", "level": "现金奖励", "num_look": 415933, "num_comment": 2, "author": "Carry your system", "tags": ["区块链安全", "漏洞"], "text": "区块链的安全需求越来越多，下面就将这些需求一一拆分，看看区块链安全需求到底是个什么样子。"}
{"title": "2018年上半年国内公有云云上资产合规现状报告", "url": "https://www.freebuf.com/articles/database/179010.html", "time": "2018-07-27", "level": "", "num_look": 245537, "num_comment": 245537, "author": "永安在线", "tags": ["安全报告", "数据安全"], "text": "自2005年亚马逊发布AWS伊始，云计算历经十数年的发展，已被广泛应用于各个领域，时至今日已形成了一个新兴的、高达数千亿美元的全球市场。"}
{"title": "Jenkins任意文件读取漏洞分析", "url": "https://www.freebuf.com/vuls/178808.html", "time": "2018-07-27", "level": "", "num_look": 428972, "num_comment": 4, "author": "云鼎实验室", "tags": ["漏洞"], "text": "Jenkins 7 月 18 日的安全通告修复了多个漏洞，其中 SECURITY-914 是由 Orange （博客链接：http://blog.orange.tw/）挖出的 Jenkins 未授权任意文件读取漏洞。"}
{"title": "Java代码审计丨某开源系统源码审计", "url": "https://www.freebuf.com/vuls/178045.html", "time": "2018-07-27", "level": "现金奖励", "num_look": 771168, "num_comment": 17, "author": "黑客小平哥", "tags": ["WEB安全", "漏洞"], "text": "java源代码审计相关资料一直比较少，今天抽空给大家写一篇简单的开源代码审计。"}
{"title": "ibombshell：一款功能强大的动态远程Shell工具", "url": "https://www.freebuf.com/sectool/177758.html", "time": "2018-07-27", "level": "", "num_look": 249122, "num_comment": 249122, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫ibombshell的动态远程Shell工具，该工具基于Powershell开发，可在后渗透利用阶段发挥其作用。"}
{"title": "大量蓝牙设备和系统将受加密漏洞CVE-2018-5383 影响", "url": "https://www.freebuf.com/news/178833.html", "time": "2018-07-27", "level": "", "num_look": 268775, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["漏洞", "资讯"], "text": "近期，安全研究专家在某些蓝牙设备中发现了一个高危加密漏洞，未经验证的攻击者在物理接近目标设备后，这个漏洞将允许他们拦截、监控或篡改设备的网络数据。"}
{"title": "使用Winrm.vbs绕过应用白名单执行任意未签名代码的分析", "url": "https://www.freebuf.com/articles/system/178339.html", "time": "2018-07-27", "level": "", "num_look": 182309, "num_comment": 182309, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "winrm.vbs（System31中的一个Windows签名脚本）能够执行攻击者控制的XSL，它不会受到相关脚本主机的限制，并实现任意无符号代码执行。"}
{"title": "国家信息技术安全研究中心招聘安全人才", "url": "https://www.freebuf.com/jobs/178850.html", "time": "2018-07-27", "level": "", "num_look": 435370, "num_comment": 19, "author": "FB客服", "tags": ["安全招聘"], "text": "国家信息技术安全研究中心，是经中央编制委员会批准成立的从事信息安全核心技术研究、为国家信息安全保障服务的国家事业单位，所属中央网信办。"}
{"title": "探索基于.NET下实现一句话木马之SVC篇", "url": "https://www.freebuf.com/articles/web/178509.html", "time": "2018-07-27", "level": "", "num_look": 327974, "num_comment": 2, "author": "云影实验室", "tags": ["WEB安全"], "text": "本文是探索.NET三驾马车实现一句话木马的完结篇，如果前两篇没有看的同学可以浏览FreeBuf 地址，至于这三篇文章包含的代码片段已经同步到笔者的 github上，如果有需求请自取。 那么闲话少叙，回归正题。"}
{"title": "Linux下几种反弹Shell方法的总结与理解", "url": "https://www.freebuf.com/articles/system/178150.html", "time": "2018-07-27", "level": "现金奖励", "num_look": 981056, "num_comment": 5, "author": "LlawLiet", "tags": ["系统安全"], "text": "所谓的反弹shell，指我们在自己的机器上开启监听，然后在被攻击者的机器上发送连接请求去连接我们的机器，将被攻击者的shell反弹到我们的机器上。"}
{"title": "Hongcms 3.0.0后台SQL注入漏洞分析", "url": "https://www.freebuf.com/vuls/178316.html", "time": "2018-07-27", "level": "现金奖励", "num_look": 525815, "num_comment": 3, "author": "BlackWater", "tags": ["WEB安全", "漏洞"], "text": "HongCMS是一个轻量级的中英文企业网站系统，访问速度极快，使用简单，程序代码简洁严谨，功能强大，完全免费开源，可用于建设各种类型的中英文网站，同时它是一个小型开发框架。"}
{"title": "BUF早餐铺 | 成功黑掉Bitfi数字钱包的人迈克菲将奖励10万美元；因频繁杀后台VLC播放器将华为机型列入黑名单；新型Kronos银行木马被发现", "url": "https://www.freebuf.com/news/178868.html", "time": "2018-07-27", "level": "", "num_look": 147829, "num_comment": 4, "author": "Karunesh91", "tags": ["资讯"], "text": "成功黑掉Bitfi数字钱包的人迈克菲将奖励10万美元；因频繁杀后台VLC播放器将华为机型列入黑名单；新型Kronos银行木马被发现。"}
{"title": "一例IRC Bot针对Cuckoo沙箱的猥琐对抗分析", "url": "https://www.freebuf.com/articles/terminal/178067.html", "time": "2018-07-26", "level": "", "num_look": 194321, "num_comment": 4, "author": "云影实验室", "tags": ["终端安全"], "text": "最近我们通过蜜罐捕获到通过IRC服务器和C2进行通讯的一种IRC Bot恶意样本。这种C2通讯方式的恶意程序已经屡见不鲜，但这次这个样本的特别之处在于它包含了非常猥琐的沙箱对抗机制。"}
{"title": "Kronos银行木马被发现，疑似新版Osiris木马", "url": "https://www.freebuf.com/news/178738.html", "time": "2018-07-26", "level": "", "num_look": 200088, "num_comment": 1, "author": "抗生素1209", "tags": ["网络安全", "资讯"], "text": "根据Proofpoint安全研究人员的说法，新版本的Kronos银行木马正蠢蠢欲动，研究人员证实，最近三次宣传这个旧木马的翻新版本在2014年经历了鼎盛时期。"}
{"title": "Apache已修复Apache Tomcat中的高危漏洞", "url": "https://www.freebuf.com/news/178838.html", "time": "2018-07-26", "level": "", "num_look": 417726, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["漏洞", "资讯"], "text": "近日，Apache软件基金会为Tomcat应用程序服务器推送了最新的安全更新，并修复了多个安全漏洞，其中包括一个DoS漏洞和一个信息泄露漏洞。"}
{"title": "VulnWhisperer：数据可被ElasticSearch索引的漏洞数据及报告整合工具", "url": "https://www.freebuf.com/sectool/177189.html", "time": "2018-07-26", "level": "", "num_look": 216087, "num_comment": 216087, "author": "secist", "tags": ["工具"], "text": "VulnWhisperer会提取所有报告并创建具有唯一文件名的文件，然后发送给logstash。Logstash则会从文件名中提取数据标记报告中的所有信息。"}
{"title": "走进职业键盘侠的世界，乘风破浪没有谁能阻挡的黑产江湖", "url": "https://www.freebuf.com/articles/network/178669.html", "time": "2018-07-26", "level": "红色标题", "num_look": 617391, "num_comment": 27, "author": "GEETEST极验", "tags": ["网络安全"], "text": "随着互联网由web1.0发展到web2.0，互联网第一批黑色产业链就诞生，今天让我们走进网络水军的世界，乘风破浪没有谁能阻挡的黑产江湖......"}
{"title": "修饰器（modifier）相关漏洞分析", "url": "https://www.freebuf.com/vuls/178726.html", "time": "2018-07-26", "level": "", "num_look": 168010, "num_comment": 4, "author": "BUGX", "tags": ["区块链安全", "漏洞"], "text": "修饰器(modifier)可以改变函数的行为，例如作为前置的检测条件。同时修饰器具有可继承属性，可以由派生合约中的定义覆盖。本次BUGX.IO区块链安全课堂给大家进行修饰器的相关漏洞分析。"}
{"title": "福建通汇集团高薪招聘网络安全渗透工程师", "url": "https://www.freebuf.com/jobs/178388.html", "time": "2018-07-26", "level": "", "num_look": 180676, "num_comment": 11, "author": "冰河洗剑", "tags": ["安全招聘"], "text": "2016年9月，通汇集团成立。注册资金高达1亿，专注于移动互联网支付、无卡快捷、O2O、互联网+的综合型公司。公司总部位于福建省，选择市场潜力巨大的东亚文化之都泉州，作为直属运营中心。"}
{"title": "Mirai和Gafgyt僵尸网络新变种近期十分活跃", "url": "https://www.freebuf.com/news/178824.html", "time": "2018-07-26", "level": "", "num_look": 219298, "num_comment": 219298, "author": "Alpha_h4ck", "tags": ["网络安全", "资讯"], "text": "安全专家警告称，广大用户近期应该小心Mirai和Gafgyt僵尸网络了，因为这两个臭名昭著的物联网僵尸网络又开始活跃了起来。"}
{"title": "TPYBoard之DIY一个无线装甲小车", "url": "https://www.freebuf.com/geek/178005.html", "time": "2018-07-26", "level": "", "num_look": 183215, "num_comment": 2, "author": "_橙子 ゝ", "tags": ["极客"], "text": "本次蓝牙小车的设计在于探索蓝牙智能小车的设计理念及设计方法，学习一下PWM控制电机差速来控制小车的方向，下面就动手搞起来吧！"}
{"title": "开源SSH双因素登陆认证系统JXOTP了解一下", "url": "https://www.freebuf.com/sectool/178161.html", "time": "2018-07-26", "level": "", "num_look": 250631, "num_comment": 250631, "author": "chenjc", "tags": ["工具"], "text": "SSH双因素认证的开源方案有挺多的，这就是个新的轮子，技术上没有大的创新，只是更好用一些。"}
{"title": "详细分析 | 全新“撒旦”Satan勒索病毒来袭", "url": "https://www.freebuf.com/articles/system/178171.html", "time": "2018-07-26", "level": "", "num_look": 467089, "num_comment": 12, "author": "瑞星", "tags": ["系统安全", "网络安全"], "text": "据瑞星安全研究人员介绍，该病毒运行后会加密受害者计算机文件，加密完成后会用中英韩三国语言索取1个比特币作为赎金。"}
{"title": "BUF早餐铺 | 加密漏洞影响大量蓝牙设备；电子邮件攻击急剧上升，邮件安全风险增大；APP 注销难引官媒关注，人民日报点评称要保障信息安全", "url": "https://www.freebuf.com/news/178730.html", "time": "2018-07-26", "level": "", "num_look": 160429, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "严重加密漏洞 CVE-2018-5383 影响苹果、博通、英特尔、高通等多家硬件厂商的蓝牙实现和操作系统驱动。"}
{"title": "警惕 | 恶意EOS合约存在吞噬用户RAM的安全风险", "url": "https://www.freebuf.com/vuls/178812.html", "time": "2018-07-25", "level": "红色标题", "num_look": 191680, "num_comment": 5, "author": "美图安全应急响应中心", "tags": ["区块链安全", "漏洞"], "text": "本次发现的漏洞，恰好会导致用户账户内的RAM可能被恶意消耗，引发直接财产损失。"}
{"title": "蓝宝菇(APT-C-12)最新攻击样本及C&C机制分析", "url": "https://www.freebuf.com/articles/system/178422.html", "time": "2018-07-25", "level": "", "num_look": 225310, "num_comment": 4, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "继360公司披露了蓝宝菇(APT-C-12)攻击组织的相关背景以及针对性攻击技术细节后，360威胁情报中心近期又监测到该组织实施的新的攻击活动。"}
{"title": "精彩速递 | 聚焦终端响应 智慧安全运营，2018 SOC&EDR 应用建设高峰论坛", "url": "https://www.freebuf.com/news/178680.html", "time": "2018-07-25", "level": "红色标题", "num_look": 210862, "num_comment": 210862, "author": "FB独家", "tags": ["企业安全", "活动"], "text": "FreeBuf企业安全俱乐部活动首次来到深圳～"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列-Alyssa Herrera", "url": "https://www.freebuf.com/video/178627.html", "time": "2018-07-25", "level": "红色标题", "num_look": 232178, "num_comment": 6, "author": "willhuang", "tags": ["视频"], "text": "Alyssa Herrera，自从16岁接触到漏洞众测之后，就爱上了这个行业。作为众测社区为数不多的女性白帽，Alyssa Herrera的漏洞发现成就极具代表性。"}
{"title": "MSDAT：一款专门针对Microsoft SQL数据库的渗透测试工具", "url": "https://www.freebuf.com/sectool/177187.html", "time": "2018-07-25", "level": "", "num_look": 286736, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫MSDAT（Microsoft SQL Database Attacking Tool）的工具，MSDAT是一款开源的渗透测试工具，研究人员可利用MSDAT来对Microsoft SQL数据库的安全性进行远程测试。"}
{"title": "构造函数缺失漏洞分析", "url": "https://www.freebuf.com/vuls/178574.html", "time": "2018-07-25", "level": "", "num_look": 194409, "num_comment": 4, "author": "BUGX", "tags": ["区块链安全", "漏洞"], "text": "构造函数缺失漏洞自智能合约产生以来就一直出现，归根到底是由于新进开发者对 solidity 代码结构不熟悉造成的。"}
{"title": "以百度贴吧为典型的社交网络隐私主动泄露分析", "url": "https://www.freebuf.com/articles/neopoints/178013.html", "time": "2018-07-25", "level": "现金奖励", "num_look": 645703, "num_comment": 26, "author": "不朽三不朽三不朽三", "tags": ["观点"], "text": "本文主要以百度贴吧和微博为例，分析探讨社交网络上的隐私主动泄露现象。"}
{"title": "导出域密码哈希值的多种方法介绍", "url": "https://www.freebuf.com/articles/system/177764.html", "time": "2018-07-25", "level": "", "num_look": 319704, "num_comment": 1, "author": "secist", "tags": ["系统安全"], "text": "在域内HASH是存在NTDS.DIT中的， NTDS.DIT是一个二进制文件，里面包含的不只是Username和HASH，还有OU、Group等信息。"}
{"title": "天融信关于CVE-2018-2893 WebLogic反序列化漏洞分析", "url": "https://www.freebuf.com/vuls/178105.html", "time": "2018-07-25", "level": "", "num_look": 370327, "num_comment": 1, "author": "alphalab", "tags": ["WEB安全", "漏洞"], "text": "WebLogic是美国Oracle公司出品的一个Application Server，确切的说是一个基于JAVA EE架构的中间件, WebLogic是用于开发、集成、部署和管理大型分布式Web应用、网络应用和数据库应用的Java应用服务器。"}
{"title": "探索基于.NET下实现一句话木马之Asmx篇", "url": "https://www.freebuf.com/articles/web/178010.html", "time": "2018-07-25", "level": "", "num_look": 258929, "num_comment": 2, "author": "云影实验室", "tags": ["WEB安全"], "text": "上篇介绍了一般处理程序（ashx）的工作原理以及实现一句话木马的过程，今天接着介绍Web Service程序（asmx）下的工作原理和如何实现一句话木马。"}
{"title": "从司法角度看互联网黑产", "url": "https://www.freebuf.com/articles/network/178114.html", "time": "2018-07-25", "level": "", "num_look": 290739, "num_comment": 290739, "author": "boshit", "tags": ["网络安全"], "text": "《白皮书》根据海淀检察院2016年9月以来受理的450起网络犯罪案件，从司法的角度,结合具体案例，总结了我国近几年来互联网黑产行业的现状。"}
{"title": "BUF早餐铺 | Chrome 68正式向所有不安全的HTTP网站开炮；安卓银行木马 Exobot 的源代码遭泄露；Windows 7/8.1更新调整被吐槽；", "url": "https://www.freebuf.com/news/178566.html", "time": "2018-07-25", "level": "", "num_look": 158183, "num_comment": 4, "author": "shidongqi", "tags": ["资讯"], "text": "我国医疗机构开放远程登录服务（端口号：22）的比例高达50%，这意味着有一半的服务器可能遭遇相同的攻击。"}
{"title": "CNCERT：我国DDoS攻击资源月度及2018年上半年治理情况分析报告", "url": "https://www.freebuf.com/articles/paper/178568.html", "time": "2018-07-24", "level": "", "num_look": 279133, "num_comment": 1, "author": "CNCERT", "tags": ["安全报告"], "text": "围绕互联网环境威胁治理问题，基于CNCERT监测的DDoS攻击事件数据进行抽样分析，重点对“DDoS攻击是从哪些网络资源上发起的”这个问题进行分析。"}
{"title": "广东重庆多家三甲医院服务器遭暴力入侵，黑客赶走50余款挖矿木马独享挖矿资源", "url": "https://www.freebuf.com/articles/system/178529.html", "time": "2018-07-24", "level": "红色标题", "num_look": 798050, "num_comment": 29, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "广东、重庆多家三甲医院服务器被黑客入侵，攻击者暴力破解医院服务器的远程登录服务，之后利用有道笔记的分享文件功能下载多种挖矿木马。"}
{"title": "Dirhunt：一款无需进行暴力破解攻击即可枚举Web服务器目录的工具", "url": "https://www.freebuf.com/sectool/177672.html", "time": "2018-07-24", "level": "", "num_look": 416847, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Dirhunt的工具，它无需进行暴力破解即可帮助你枚举出目标Web服务器的目录。"}
{"title": "ERC20不一致性检查（新增balnaces不一致检查漏洞）", "url": "https://www.freebuf.com/vuls/178547.html", "time": "2018-07-24", "level": "", "num_look": 158378, "num_comment": 158378, "author": "BUGX", "tags": ["区块链安全", "漏洞"], "text": "部分合约中的transferFrom中，不仅存在 `allowed[_from][msg.sender]` 的检查不一致漏洞，还存在 `balances[msg.sender]` 语句的漏洞。"}
{"title": "【参会指南】聚焦终端响应，智慧安全运营 | 2018 SOC & EDR应用建设高峰论坛", "url": "https://www.freebuf.com/fevents/177989.html", "time": "2018-07-24", "level": "红色标题", "num_look": 199912, "num_comment": 2, "author": "FB客服", "tags": ["企业安全", "活动"], "text": "7月25日（下周三）上午9:30，由FreeBuf 主办的「聚焦终端响应 智慧安全运营 2018 SOC & EDR应用建设高峰论坛」将在深圳东方银座美爵酒店盛大召开。"}
{"title": "HackerOne漏洞赏金计划在2017年总共支付了1100万美元", "url": "https://www.freebuf.com/news/178337.html", "time": "2018-07-24", "level": "", "num_look": 248180, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["安全管理", "资讯"], "text": "根据HackerOne发布的2018年HackerOne安全报告显示，去年在HackerOne上提交过漏洞的白帽黑客们总共已经挣了超过1100万美元了。"}
{"title": "CNNVD关于福昕阅读器多个安全漏洞的通报", "url": "https://www.freebuf.com/vuls/178610.html", "time": "2018-07-24", "level": "", "num_look": 181779, "num_comment": 2, "author": "CNNVD", "tags": ["漏洞", "终端安全"], "text": "近日，福昕阅读器官方网站发布安全漏洞公告，涉及FoxitReader exportAsFDF远程代码执行漏洞、Foxit Reader 缓冲区错误漏洞等83个安全漏洞。其中高危漏洞2个，中危漏洞77个，低危漏洞4个。"}
{"title": "蓝盾公司（广州）招聘安全人才", "url": "https://www.freebuf.com/jobs/178162.html", "time": "2018-07-24", "level": "", "num_look": 271787, "num_comment": 18, "author": "Bluedon", "tags": ["安全招聘"], "text": "蓝盾始终以自主创新为发展源动力，以技术研发领先优势抢占市场，经过十多年的探索和积累，已掌握了信息安全领域内的主要核心技术，并实现了全线安全产品的人工智能化。"}
{"title": "直布罗陀区块链交易所RKT存在上溢漏洞", "url": "https://www.freebuf.com/vuls/178496.html", "time": "2018-07-24", "level": "", "num_look": 165319, "num_comment": 165319, "author": "BUGX", "tags": ["区块链安全", "漏洞"], "text": "Rock (RKT) 合约存在可以上溢的漏洞，通过此漏洞，合约管理员masterContractAddress 可以恶意销毁个人的 token。"}
{"title": "威胁电脑安全的元凶就是它！360发现首个跨界APT攻击", "url": "https://www.freebuf.com/articles/network/178036.html", "time": "2018-07-24", "level": "", "num_look": 201727, "num_comment": 5, "author": "360安全", "tags": ["网络安全"], "text": "当移动端手机作为移动存储介质存在时，存在有一定的安全隐患，极有可能被不法分子利用，通过手机端的伪装攻击文件向PC端发起APT攻击。"}
{"title": "看网络犯罪分子如何通过手机游戏洗钱", "url": "https://www.freebuf.com/news/178332.html", "time": "2018-07-24", "level": "红色标题", "num_look": 294187, "num_comment": 294187, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "在整个洗钱环节中，网络犯罪分子使用了伪造的苹果账号和游戏账号来进行盗刷信用卡交易，并在各大在线论坛和游戏社区中出售这些游戏账号。"}
{"title": "网络安全新常态下Android应用供应链安全探秘", "url": "https://www.freebuf.com/articles/network/178011.html", "time": "2018-07-24", "level": "", "num_look": 219373, "num_comment": 219373, "author": "腾讯手机管家", "tags": ["网络安全"], "text": "时至2018年，移动互联网的发展已走过十年历程，智能设备已深入人们生活的方方面面，其安全问题也时刻牵动着人们的神经。"}
{"title": "医疗系统被黑，连新加坡总理的个人隐私都被泄露？", "url": "https://www.freebuf.com/news/178464.html", "time": "2018-07-24", "level": "红色标题", "num_look": 250700, "num_comment": 1, "author": "Karunesh91", "tags": ["网络安全", "资讯"], "text": "新加坡卫生部（MOH）今日透露，其医疗系统的网络遭到了黑客的破坏，被窃取了约150万公民的个人健康数据，其中也包括新加坡国家总理李显龙的医疗信息。"}
{"title": "BUF早餐铺丨微软Edeg浏览器XSS过滤器被破坏；大约五亿台物联网设备容易遭受 DNS 重绑定攻击；山东警方成功破获“tIMiner”挖矿木马案件", "url": "https://www.freebuf.com/news/178444.html", "time": "2018-07-24", "level": "", "num_look": 159206, "num_comment": 2, "author": "Karunesh91", "tags": ["资讯"], "text": "微软Edeg浏览器XSS过滤器被破坏；大约五亿台物联网设备容易遭受 DNS 重绑定攻击；山东警方成功破获“tIMiner”挖矿木马案件。"}
{"title": "Game-of-Thrones-CTF-1靶机完全攻略", "url": "https://www.freebuf.com/articles/web/177562.html", "time": "2018-07-23", "level": "金币+6", "num_look": 310235, "num_comment": 11, "author": "ksufer", "tags": ["WEB安全"], "text": "这个靶机的难度较高，过程并不是一气呵成，所以经过了多次更换网络和IP的过程，ip略有混乱，请见谅。"}
{"title": "威胁预警 | TrickBot银行木马归来袭击全球金融机构", "url": "https://www.freebuf.com/articles/web/178160.html", "time": "2018-07-23", "level": "", "num_look": 300198, "num_comment": 2, "author": "深信服千里目安全实验室", "tags": ["WEB安全", "网络安全"], "text": "最近国外安全研究人员发现TrickBot银行木马最新的样本，对样本进行了详细分析后，确认此样本为TrickBot银行盗号木马的最新变种样本"}
{"title": "快讯 | “疫苗门”涉事公司官网被黑：不搞你，对不起祖国的花朵", "url": "https://www.freebuf.com/news/178387.html", "time": "2018-07-23", "level": "红色标题", "num_look": 795159, "num_comment": 33, "author": "shidongqi", "tags": ["资讯"], "text": "今天早上，涉事公司之一的长生生物科技有限公司官网（http://china.cs-vaccine.com/）被黑客攻击，并配文表示：不搞你，对不起祖国的花朵。"}
{"title": "TCP SYN Flood如何实现（含原理和工具）", "url": "https://www.freebuf.com/articles/network/177673.html", "time": "2018-07-23", "level": "", "num_look": 494567, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "从1970年出现直到今天都依然在作祟，并给全球范围内的各大组织带来了不可估量的损失。在这篇文章中，我们将跟大家介绍一种特定的DoS攻击，即TCP SYN Flood攻击，并介绍一款名叫Synner的工具。"}
{"title": "有你的设备吗？约五亿物联网设备仍受DNS重绑定攻击影响", "url": "https://www.freebuf.com/news/178434.html", "time": "2018-07-23", "level": "", "num_look": 221046, "num_comment": 3, "author": "Covfefe", "tags": ["终端安全", "资讯"], "text": "网络安全公司Aemis在去年发现蓝牙协议漏洞“BlueBorne”之后，于近日再次发出警告，称大约五亿的智能设备如今仍受DNS重绑定这种老式攻击的影响。"}
{"title": "讲师招募中 | FreeBuf精品公开课“隐侠”虚位以待", "url": "https://www.freebuf.com/fevents/177893.html", "time": "2018-07-23", "level": "红色标题", "num_look": 186941, "num_comment": 1, "author": "FB客服", "tags": ["活动"], "text": "技术变现价值，知识分享未来。"}
{"title": "比特币黑客攻击手段全揭秘", "url": "https://www.freebuf.com/articles/blockchain-articles/178074.html", "time": "2018-07-23", "level": "", "num_look": 242544, "num_comment": 242544, "author": "战争贩子", "tags": ["区块链安全"], "text": "最近一段时间，比特币彻底火了。无论是新闻媒体、行业龙头还是资本市场都对其反映敏锐，可以看出比特币正站在风口浪尖，受到各方高度关注。"}
{"title": "Orbit：一款能够可视化查看加密货币钱包之间交易关系的工具", "url": "https://www.freebuf.com/sectool/177671.html", "time": "2018-07-23", "level": "", "num_look": 185092, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Orbit的工具，Orbit采用递归爬取策略实现，大家可以使用该工具以可视化的方式查看加密货币钱包之间的交易关系。"}
{"title": "微众银行信息安全部诚聘主机安全人才", "url": "https://www.freebuf.com/jobs/178075.html", "time": "2018-07-23", "level": "", "num_look": 141612, "num_comment": 2, "author": "微众银行sec", "tags": ["安全招聘"], "text": "​微众银行是国内首家开业的民营银行，由腾讯、百业源和立业等多家知名企业发起设立；于2014年12月获得由深圳银监局颁发的金融许可证，注册资本为人民币30亿元。"}
{"title": "打造刀郎安全PHP系统", "url": "https://www.freebuf.com/articles/web/178199.html", "time": "2018-07-23", "level": "现金奖励", "num_look": 323938, "num_comment": 15, "author": "刀郎", "tags": ["WEB安全"], "text": "Web安全防不胜防，那么我们怎么尽可能的做到安全？"}
{"title": "这帮人黑了13台iPhone，计划败露甩锅俄罗斯黑客……", "url": "https://www.freebuf.com/articles/terminal/177849.html", "time": "2018-07-23", "level": "红色标题", "num_look": 423832, "num_comment": 15, "author": "GEETEST极验", "tags": ["终端安全"], "text": "有关这件事情，相信很多人会跟Magiccc想的一样，到底是咖喱不好吃还是摩托车不好玩，费劲心思黑掉13台iPhone的印度黑客，到底想干嘛？这个问题，苹果公司也很想知道……"}
{"title": "Apache Shiro 1.2.4反序列化漏洞分析", "url": "https://www.freebuf.com/vuls/178014.html", "time": "2018-07-23", "level": "", "num_look": 918872, "num_comment": 1, "author": "美丽联合安全MLSRC", "tags": ["漏洞"], "text": "这个组件的漏洞很久之前就爆出来了，但是最近工作中又遇到了，刚好最近也在看Java反序列化的东西，所以决定拿出来再分析一下，期间也遇到了一些奇怪的问题。"}
{"title": "技术讨论 | 3步以内利用中间人MitM攻击从RDP连接中获得密码", "url": "https://www.freebuf.com/sectool/178146.html", "time": "2018-07-23", "level": "现金奖励", "num_look": 282388, "num_comment": 7, "author": "2cat", "tags": ["工具"], "text": "今天和大家分享个小技术，简单几步通过执行MitM攻击同时从RDP连接中提取明文凭据。"}
{"title": "BUF早餐铺丨黑客入侵俄罗斯银行窃取100万美元；百度搜狗等搜索引擎搜出假物流；美国零售业数据泄露率持续创下新高", "url": "https://www.freebuf.com/news/178169.html", "time": "2018-07-23", "level": "", "num_look": 147498, "num_comment": 1, "author": "Akane", "tags": ["资讯"], "text": "今天份的BUF早餐内容主要有：黑客入侵俄罗斯银行窃取100万美元；百度搜狗等搜索引擎搜出假物流；美国零售业数据泄露率持续创下新高。"}
{"title": "数据泄露红色警报 | 一百多家汽车厂商机密数据曝光，特斯拉通用大众丰田都中招", "url": "https://www.freebuf.com/news/178343.html", "time": "2018-07-22", "level": "红色标题", "num_look": 601708, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "汽车供应商 Level One 数据库泄露 47000 份文件，特斯拉、通用、大众、丰田等数百家汽车制造厂商都受影响。"}
{"title": "THRecon：功能强大的网络威胁追踪侦察工具套件", "url": "https://www.freebuf.com/sectool/177401.html", "time": "2018-07-22", "level": "", "num_look": 244131, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫THRecon的工具，该工具可以收集终端信息，而这些信息可以用来进行事件响应分类、威胁追踪和现场取证。"}
{"title": "挖洞经验 | 看我如何发现比特币赌博网站漏洞并收获$12000赏金", "url": "https://www.freebuf.com/articles/web/177581.html", "time": "2018-07-22", "level": "", "num_look": 357154, "num_comment": 7, "author": "clouds", "tags": ["WEB安全"], "text": "Web渗透测试中比较难的就是测试那些交互较少的应用了，当你尝试了各种漏洞利用方法而无效之后，很可能就会放弃了。"}
{"title": "某入群题之命令执行字符限制绕过（WEB100）", "url": "https://www.freebuf.com/articles/web/177545.html", "time": "2018-07-22", "level": "金币+6", "num_look": 364752, "num_comment": 13, "author": "yulige", "tags": ["WEB安全"], "text": "由于之前刚好做了下hitcon的两个命令执行绕过，这篇文章就记录一下。"}
{"title": "代码审计 | Empire CMS v7.5前台XSS漏洞", "url": "https://www.freebuf.com/vuls/177969.html", "time": "2018-07-22", "level": "现金奖励", "num_look": 381725, "num_comment": 6, "author": "q601333824", "tags": ["漏洞"], "text": "帝国CMS简称Empire CMS，当前的最新版本为7.5，前几天挖过一个该CMS的后台漏洞，最近也去挖了前台XSS，发现前台有一处过滤不完整导致的XSS漏洞。"}
{"title": "HITB 2015加密类300分题详细解析", "url": "https://www.freebuf.com/articles/database/177819.html", "time": "2018-07-21", "level": "金币+6", "num_look": 159415, "num_comment": 159415, "author": "mv371634", "tags": ["数据安全"], "text": "加密类300分这道题是有关于RSA生成的质数p和q。mail.msg是RSA加密过的邮件，hitbctf.crt是含有公钥的证书文件， gen_rsa.py是产生RSA参数的源码。"}
{"title": "Rakhni：你的电脑适合挖矿还是感染恶意软件？由它来决定", "url": "https://www.freebuf.com/news/177301.html", "time": "2018-07-21", "level": "", "num_look": 246266, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["终端安全", "资讯"], "text": "近期，安全研究专家发现了一款非常有意思的恶意软件，它会根据目标用户的电脑配置来决定到底用哪个方案来从用户身上牟利。"}
{"title": "使用VirtualBox，INetSim和Burp建立自己的恶意软件分析实验环境", "url": "https://www.freebuf.com/articles/system/177601.html", "time": "2018-07-21", "level": "", "num_look": 323595, "num_comment": 1, "author": "secist", "tags": ["系统安全"], "text": "在这篇文章中，我将使用VirtualBox，INetSim和Burp建立一个恶意软件分析实验环境。该环境将与与主机操作系统和Internet隔离，成为一个独立的虚拟网络。"}
{"title": "从一道CTF题看智能合约的安全问题", "url": "https://www.freebuf.com/vuls/177603.html", "time": "2018-07-21", "level": "金币+6", "num_look": 283207, "num_comment": 4, "author": "FrogSec", "tags": ["区块链安全", "漏洞"], "text": "belluminarbank 是俄罗斯战队在 WCTF 上出的一道 EVM 题目，其中用到了很多 ETH 中经典的漏洞。"}
{"title": "【FB TV】一周「BUF大事件」：SOC & EDR应用建设高峰论坛深圳召开；一起来看看世界杯幕后的安全隐患；快压官网回应后续进展", "url": "https://www.freebuf.com/video/178267.html", "time": "2018-07-21", "level": "红色标题", "num_look": 230671, "num_comment": 2, "author": "willhuang", "tags": ["视频"], "text": "下周三，由FreeBuf主办的2018 SOC & EDR应用建设高峰论坛将在深圳召开，你要来么？世界杯结束，带你看看幕后的安全隐患；快压官网发文回应，跟踪事件后续进展。"}
{"title": "Fastjson 1.2.24反序列化漏洞分析", "url": "https://www.freebuf.com/vuls/178012.html", "time": "2018-07-21", "level": "", "num_look": 815760, "num_comment": 815760, "author": "美丽联合安全MLSRC", "tags": ["漏洞"], "text": "fastjson是一个非常流行的库，可以将数据在JSON和Java Object之间互相转换，但是在2017年官方主动爆出了fastjson的反序列化漏洞以及升级公告，这次我们就学习一下这个漏洞。"}
{"title": "快讯 | 又来？微软爆料俄罗斯黑客对美国中期选举候选人发起攻击", "url": "https://www.freebuf.com/news/178238.html", "time": "2018-07-20", "level": "", "num_look": 210289, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["网络安全", "资讯"], "text": "他们发现俄罗斯黑客正在尝试对至少三名即将参与美国2018年国会中期选举的候选人进行攻击，但微软成功发现并帮助美国政府阻止了俄罗斯黑客的攻击行动。"}
{"title": "PTFuzzer：一个基于硬件加速的二进制程序Fuzz工具", "url": "https://www.freebuf.com/sectool/177578.html", "time": "2018-07-20", "level": "", "num_look": 396412, "num_comment": 14, "author": "hunterx", "tags": ["工具"], "text": "PTFuzzer是基于AFL框架实现的一款开源fuzz工具，采用了Intel Processor Trace硬件部件来收集程序执行的路径信息。"}
{"title": "2018上半年互联网恶意爬虫分析：从全景视角看爬虫与反爬虫", "url": "https://www.freebuf.com/articles/paper/178119.html", "time": "2018-07-20", "level": "红色标题", "num_look": 734050, "num_comment": 4, "author": "云鼎实验室", "tags": ["安全报告"], "text": "互联网最激烈的对抗战场，除了安全专家和黑客之间，大概就是爬虫和反爬虫领域了。"}
{"title": "挖洞经验 | 连接多个漏洞获取管理员访问权限", "url": "https://www.freebuf.com/articles/web/177461.html", "time": "2018-07-20", "level": "", "num_look": 233723, "num_comment": 2, "author": "secist", "tags": ["WEB安全"], "text": "有幸被邀请参加了HackerOne上的一个私人项目，本文我会最大限度的分享我从普通用户升级为管理用户的详细过程。"}
{"title": "车和家诚邀安全人才", "url": "https://www.freebuf.com/jobs/177852.html", "time": "2018-07-20", "level": "", "num_look": 133207, "num_comment": 8, "author": "The_Joker", "tags": ["安全招聘"], "text": "车和家是原汽车之家创始人李想第三次创业。致力于以便捷的能源网络，创新的产品形态，颠覆的服务生态为未来城市交通打造全新的能源、产品、服务。我们不是互联网造车，我们是新生代的汽车企业。"}
{"title": "Parity多重签名合约Delegatecall漏洞回顾", "url": "https://www.freebuf.com/vuls/177886.html", "time": "2018-07-20", "level": "", "num_look": 179495, "num_comment": 179495, "author": "BUGX", "tags": ["区块链安全", "漏洞"], "text": "2017年7月19日，Parity Multisig 电子钱包合约被爆出漏洞，攻击者从三个高安全的多重签名合约中窃取到超过15万以太坊（约3000万美元）。"}
{"title": "gpSystem：一种可私自注册Google账号的病毒", "url": "https://www.freebuf.com/articles/terminal/177856.html", "time": "2018-07-20", "level": "", "num_look": 439245, "num_comment": 439245, "author": "AVLTeam", "tags": ["安全报告", "终端安全"], "text": "该病毒植入在应用程序private，程序运行后便隐藏图标，进行下载提权相关文件、联网获取数据模拟点击注册google账号、上传用户账号、固件等信息等一系列恶意行为。"}
{"title": "WebGoat 8.0 M21失传几关的答案在这里", "url": "https://www.freebuf.com/vuls/177923.html", "time": "2018-07-20", "level": "现金奖励", "num_look": 292638, "num_comment": 5, "author": "BreezeC", "tags": ["漏洞"], "text": "最近在研究OWASP WebGoat8.0，鲜鲜实验室有一篇文章特别好，从安装到攻略都有，但其中有几关这位大佬没有做出答案。"}
{"title": "BUF早餐铺丨 “黑客导师”带大学生徒弟攻击300家网站，双双入狱；美国最大血液检测实验室LabCorp遭遇安全漏洞；谷歌因Android垄断将被欧盟罚款50亿美元创下纪录", "url": "https://www.freebuf.com/news/178087.html", "time": "2018-07-20", "level": "", "num_look": 197823, "num_comment": 197823, "author": "Karunesh91", "tags": ["资讯"], "text": "“黑客导师”带大学生徒弟攻击300家网站，双双入狱；美国最大血液检测实验室LabCorp遭遇安全漏洞；谷歌因Android垄断将被欧盟罚款50亿美元创下纪录。"}
{"title": "CertiK：一款智能合约的代码审计平台", "url": "https://www.freebuf.com/articles/blockchain-articles/177087.html", "time": "2018-07-19", "level": "", "num_look": 360737, "num_comment": 2, "author": "2benben", "tags": ["区块链安全"], "text": "这几天跟wlj聊区块链上挖洞的问题，天天被我骚扰的wlj推荐了这个，据说是zf当年导师搞得，作为大牛们的学生，搜了点资料，记了点笔记，见花献佛。"}
{"title": "快讯 | 美国最大的血液检测实验室LabCorp被黑", "url": "https://www.freebuf.com/news/178038.html", "time": "2018-07-19", "level": "", "num_look": 182937, "num_comment": 182937, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "LabCorp是美国最大的血液检测实验室，而LabCorp在近日发表声明称，他们遭到了黑客的非法入侵，而这一事件将会让数百万的美国公民陷入安全风险之中。"}
{"title": "入侵300家网站权当练手，半个月出师的“黑客”流下了悔恨的泪水……", "url": "https://www.freebuf.com/news/178018.html", "time": "2018-07-19", "level": "红色标题", "num_look": 745522, "num_comment": 21, "author": "shidongqi", "tags": ["资讯"], "text": "作为一名黑客的确可以很酷，指尖在键盘跳跃就能操控世界，但这大多只是电影里的情节。"}
{"title": "如何建设一个安全运营中心（SOC）？", "url": "https://www.freebuf.com/articles/es/177919.html", "time": "2018-07-19", "level": "金币+12", "num_look": 968063, "num_comment": 8, "author": "Caesar0", "tags": ["企业安全"], "text": "本文全面分析了SOC的定位、主要功能、技术难点以及发展趋势，并探讨了SOC存在的主要问题，希望帮助人们全面理解SOC，更好地推动这一新生事务的发展。"}
{"title": "使用Cycript绕过应用程序的PIN保护", "url": "https://www.freebuf.com/articles/system/177296.html", "time": "2018-07-19", "level": "", "num_look": 167543, "num_comment": 167543, "author": "secist", "tags": ["系统安全"], "text": "本文我将为大家演示，如何在运行时使用cycript从app中提取信息，并允许攻击访问app的PIN。"}
{"title": "老题新招 | 再解Vxworks加密漏洞", "url": "https://www.freebuf.com/vuls/177036.html", "time": "2018-07-19", "level": "", "num_look": 345178, "num_comment": 2, "author": "scu-igroup", "tags": ["工控安全", "漏洞"], "text": "工控固件逆向题，有时会在vxworks上做文章。笔者通过编写程序，计算出了hash为固定值cQwwddSRxS所使用key的解。"}
{"title": "2018 Q2季度APT趋势报告", "url": "https://www.freebuf.com/news/177560.html", "time": "2018-07-19", "level": "金币+12", "num_look": 300273, "num_comment": 1, "author": "arain", "tags": ["数据安全", "资讯"], "text": "近日卡巴斯基实验室对外发布了第二季度APT趋势报告，看看近几个月那些著名的APT组织都干了些什么？"}
{"title": "从罗克韦尔工控设备曝多项严重漏洞事件浅谈如何保护工业现场工控设备", "url": "https://www.freebuf.com/articles/ics-articles/177552.html", "time": "2018-07-19", "level": "金币+6", "num_look": 299721, "num_comment": 299721, "author": "liujianshuai", "tags": ["工控安全"], "text": "随着“中国制造2025”以及工业4.0的快速发展，工业化与信息化的融合趋势愈发明显，工控系统也利用网络技术来提高集成、互联以及信息化管理水平。"}
{"title": "Parity多重签名函数库自杀漏洞", "url": "https://www.freebuf.com/vuls/177805.html", "time": "2018-07-19", "level": "", "num_look": 241784, "num_comment": 2, "author": "BUGX", "tags": ["区块链安全", "漏洞"], "text": "一名叫做 devops199 的开发者能够让自己成为函数库合约的 owner，然后有调用自杀功能，使得合约所有功能、通证均失效。之后，devops199 在 github 提交了 issue，说出了一句经典的话 I accidentally killed it."}
{"title": "BUF早餐铺 | 微软取代Facebook成为网络钓鱼者伪装的首选公司；iOS 12 beta 4：解锁才能使用USB配件；美女因窃取瑟琳娜戈麦斯账户信息被指控", "url": "https://www.freebuf.com/news/177860.html", "time": "2018-07-19", "level": "", "num_look": 149617, "num_comment": 2, "author": "Akane", "tags": ["资讯"], "text": "微软取代Facebook成为网络钓鱼者伪装的首选公司；iOS 12 beta 4：解锁才能使用USB配件；美女因窃取瑟琳娜戈麦斯账户信息被指控。"}
{"title": "CNNVD关于Oracle WebLogic Server WLS核心组件远程代码执行漏洞的通报", "url": "https://www.freebuf.com/vuls/177939.html", "time": "2018-07-18", "level": "", "num_look": 279038, "num_comment": 3, "author": "CNNVD", "tags": ["漏洞", "网络安全"], "text": "近日，国家信息安全漏洞库（CNNVD）收到Oracle WebLogic Server WLS核心组件远程代码执行漏洞（CNNVD-201807-1276、CVE-2018-2893）情况的报送。"}
{"title": "分享一款用于创建DNS重绑定攻击的前端JavaScript工具包", "url": "https://www.freebuf.com/sectool/177299.html", "time": "2018-07-18", "level": "", "num_look": 236826, "num_comment": 236826, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫DNS Rebind Toolkit的工具包，这是一款前段JavaScript工具包，渗透测试人员可利用该工具来创建DNS重绑定攻击。"}
{"title": "GDPR施行现状：只有20%的企业合规", "url": "https://www.freebuf.com/news/177776.html", "time": "2018-07-18", "level": "", "num_look": 212352, "num_comment": 212352, "author": "Karunesh91", "tags": ["企业安全", "资讯"], "text": "Dimensional调查组织的一项调研发现，在所有受访公司中，只有20%的企业完全符合GDPR标准，53%正处于实施阶段，27%尚未开始实施。"}
{"title": "建立和保持数据完整性的六个步骤", "url": "https://www.freebuf.com/articles/es/177399.html", "time": "2018-07-18", "level": "", "num_look": 268753, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["企业安全"], "text": "如果企业想为自身创建一套安全的数字化“资料馆”，数据完整性将不可或缺。它需要维护文件的完整性，以及系统的完整性。"}
{"title": "漏洞预警 | WebLogic WLS核心组件反序列化漏洞(CVE-2018-2893)", "url": "https://www.freebuf.com/vuls/177868.html", "time": "2018-07-18", "level": "", "num_look": 370186, "num_comment": 2, "author": "漏洞盒子", "tags": ["漏洞"], "text": "Oracle官方发布了4月份的关键补丁更新CPU（Critical PatchUpdate），其中包含一个高危的Weblogic反序列化漏洞(CVE-2018-2628)，该漏洞修补不善导致被绕过。"}
{"title": "Go代码审计：Gitea远程命令执行漏洞链", "url": "https://www.freebuf.com/articles/network/177699.html", "time": "2018-07-18", "level": "金币+6", "num_look": 336511, "num_comment": 4, "author": "phithon", "tags": ["网络安全"], "text": "这是一个非常漂亮的漏洞链，也是少见的Go web代码审计，很久没见过这种漏洞了。我按原漏洞发现者的意思写了一个详解与复现。"}
{"title": "旷视科技诚招安全人才", "url": "https://www.freebuf.com/jobs/177747.html", "time": "2018-07-18", "level": "", "num_look": 272212, "num_comment": 15, "author": "megvii", "tags": ["安全招聘"], "text": "旷视科技是由人工智能驱动的行业物联网构建者，也是世界最早一批用深度学习技术实现人脸识别产品商用的人工智能企业，旗下拥有全球最大的人脸识别开放平台 Face++ 和第三方人脸身份验证平台 FaceID。"}
{"title": "Vulnhub实战靶场IMF教程", "url": "https://www.freebuf.com/articles/system/177116.html", "time": "2018-07-18", "level": "现金奖励", "num_look": 365447, "num_comment": 3, "author": "saltafiso", "tags": ["系统安全"], "text": "Vulnhub 是一个面向公众开放的靶机平台，主旨是让任何人获得信息安全相关的的实战经验。里面有很多练习靶机镜像，每个镜像都有多个flag。"}
{"title": "高级加密标准（AES）分析", "url": "https://www.freebuf.com/articles/database/176794.html", "time": "2018-07-18", "level": "现金奖励", "num_look": 317479, "num_comment": 1, "author": "淼淼兮与怀", "tags": ["数据安全"], "text": "今天我们将要来详细认识一下在密码学中占据重要位置的AES加密标准，在密码学中又称为Rijindael加密法。"}
{"title": "老题新招 | 再解工控CTF流量分析题", "url": "https://www.freebuf.com/articles/ics-articles/176868.html", "time": "2018-07-18", "level": "金币+6", "num_look": 400270, "num_comment": 7, "author": "scu-igroup", "tags": ["工控安全"], "text": "最近有个工控安全大赛，老板让我们参加。虽然参赛的经验少，但谁叫我们是研究流量分析的呢，硬着头皮也得上。于是乎开始找题刷，然而互联网上工控CTF的题不多，只能是有一道就狠劲儿地啃一道。"}
{"title": "BUF早餐铺 | 俄罗斯在世界杯期间遭受了近2500万次网络攻击；成千上万Mega网盘账户登陆信息遭泄露；LuminosityLink RAT作者认罪", "url": "https://www.freebuf.com/news/177797.html", "time": "2018-07-18", "level": "", "num_look": 162787, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "一直以来，一旦全球范围内发生较大的网络攻击事件，西方媒体第一怀疑的就是俄罗斯黑客。而在本届世界杯上，俄罗斯作为主场遭受了近2500次网络攻击，谁又是幕后黑手呢？"}
{"title": "【议题前瞻】EDR与企业安全落地的实践与思考 | 2018 SOC&EDR应用建设高峰论坛", "url": "https://www.freebuf.com/fevents/177698.html", "time": "2018-07-17", "level": "红色标题", "num_look": 246789, "num_comment": 246789, "author": "FB客服", "tags": ["企业安全", "活动"], "text": "面对安全市场上琳琅满目的EDR产品，企业该如何选择？国内外的EDR产品有哪些异同？"}
{"title": "Autocrack：一款强大的自动化Hash破解工具", "url": "https://www.freebuf.com/sectool/177298.html", "time": "2018-07-17", "level": "", "num_look": 334086, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Autocrack不仅是一个Python脚本，它是一个Hashcat封装器，它能够帮助渗透测试人员自动化执行Hash破解任务。这个脚本提供了多种功能来帮助测试人员选择字典集和破解规则，而且还能够进行暴力破解攻击。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列-Edwin Foudil", "url": "https://www.freebuf.com/video/177783.html", "time": "2018-07-17", "level": "红色标题", "num_look": 209499, "num_comment": 1, "author": "willhuang", "tags": ["视频"], "text": "Edwin Foudil目前在瑞士苏黎世联邦理工学院 (ETH Zurich)计算机系本科就读，兼职作为HackerOne的安全分析师。"}
{"title": "如何通过滥用SSL TLS绕过Web应用程序防火墙", "url": "https://www.freebuf.com/articles/web/177190.html", "time": "2018-07-17", "level": "", "num_look": 282713, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["WEB安全", "网络安全"], "text": "Web安全已经变成了IT领域里非常重要的部分。除了设计新Web标准，企业对Web应用安全需求也在变化。这篇文章将介绍一种针对防火墙的新型绕过技术。"}
{"title": "会晤前又出事？12名俄罗斯情报官员被控入侵美国民主党的基础设施", "url": "https://www.freebuf.com/news/177757.html", "time": "2018-07-17", "level": "", "num_look": 140972, "num_comment": 140972, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "本周，美国大陪审团（Grand Jury）起诉了十二名俄罗斯情报官员。值得一提的是，此次起诉提起于“特普会”前三天。"}
{"title": "微信仓促更新，黑产加速圈钱，“微信号”黑市规模接近40亿", "url": "https://www.freebuf.com/articles/network/177191.html", "time": "2018-07-17", "level": "红色标题", "num_look": 835104, "num_comment": 33, "author": "GEETEST极验", "tags": ["网络安全"], "text": "在这次微信的更新中，长按公众号文章会出现“未完成的功能”字样，此次改版在还“未完成”状态仓促上马。而就在张小龙眼皮底下，有那么一群人寄生在微信平台上，创造了一个规模近40个亿的黑色产业链......"}
{"title": "LightCoin合约非一致性检查漏洞分析", "url": "https://www.freebuf.com/vuls/177565.html", "time": "2018-07-17", "level": "", "num_look": 241137, "num_comment": 2, "author": "BYSECIO", "tags": ["区块链安全", "数据安全"], "text": "LIGHT (光链) 是世界上第一个双层区块链（父链与子链），突破性地解决了当今数字货币在交易时处理速度严重滞后问题，实现瞬时完成实时交易。"}
{"title": "当心，成人网站上可能有你的视频", "url": "https://www.freebuf.com/news/177433.html", "time": "2018-07-17", "level": "", "num_look": 1024254, "num_comment": 13, "author": "Karunesh91", "tags": ["终端安全", "网络安全"], "text": "一种新型的诈骗方式正在网络蔓延。诈骗者会向用户发送电子邮件，宣称通过摄像头拍摄了用户的视频，上传到了成人网站。"}
{"title": "运营商互联网业务暴露面安全", "url": "https://www.freebuf.com/articles/web/175095.html", "time": "2018-07-17", "level": "现金奖励", "num_look": 357765, "num_comment": 7, "author": "雨水", "tags": ["WEB安全", "企业安全"], "text": "对于一个士兵来说，最大的梦想就是能上战场真刀实枪的干上一战，同样对于一名安全人员来说，自己设计、建设的经过层层防护的系统，如果没有经历过一次攻击，不免有点索然无味。"}
{"title": "蓝宝菇（APT-C-12）针对性攻击技术细节揭秘", "url": "https://www.freebuf.com/articles/terminal/177384.html", "time": "2018-07-17", "level": "", "num_look": 315480, "num_comment": 5, "author": "奇安信威胁情报中心", "tags": ["终端安全"], "text": "本文作为前期组织揭露报告的补充，详述蓝宝菇组织在近期攻击活动的技术细节，希望安全业界了解其攻击手法共同完善拼图。"}
{"title": "BUF早餐铺丨美国指控12名俄罗斯情报人员攻击DNC；数据堂涉倒卖公民信息；男子因拒绝为警察解锁iPhone而被监禁", "url": "https://www.freebuf.com/news/177697.html", "time": "2018-07-17", "level": "", "num_look": 159202, "num_comment": 2, "author": "Karunesh91", "tags": ["资讯"], "text": "美国指控12名俄罗斯情报人员攻击DNC；数据堂涉倒卖公民信息；一男子因拒绝为警察解锁iPhone而被判处180天监禁"}
{"title": "闲聊Windows系统日志", "url": "https://www.freebuf.com/vuls/175560.html", "time": "2018-07-16", "level": "现金奖励", "num_look": 1087418, "num_comment": 34, "author": "TomKing", "tags": ["漏洞", "系统安全"], "text": "最近遇到不少应急都提出一个需求，能不能溯源啊？这个事还真不好干，你把证据，犯案时间都确定的时候，要求翻看监控(日志)对应犯罪嫌疑人时，突然说监控(日志)没有记录。"}
{"title": "VPNFilter恶意软件突袭了乌克兰的关键基础设施", "url": "https://www.freebuf.com/news/177669.html", "time": "2018-07-16", "level": "红色标题", "num_look": 208487, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["网络安全", "资讯"], "text": "就在今天，乌克兰安全局（SBU）对外声称，乌克兰境内的关键基础设施遭到了VPNFilter恶意软件的攻击，而这款恶意软件据说来源于俄罗斯情报机构。"}
{"title": "Halcyon：专门用于开发Nmap脚本的IDE", "url": "https://www.freebuf.com/sectool/177300.html", "time": "2018-07-16", "level": "", "num_look": 251885, "num_comment": 3, "author": "secist", "tags": ["工具"], "text": "Halcyon是一个开源的专门设计用于开发Nmap脚本的IDE。通过Halcyon你可以开发从侦察到利用的各类Nmap高级扫描脚本。如果你想为该项目做出贡献或有任何的改进建议，请访问我们的contribute页面。"}
{"title": "Thermanator攻击竟能够通过键盘上手指的余温窃取密码？", "url": "https://www.freebuf.com/news/177188.html", "time": "2018-07-16", "level": "", "num_look": 162522, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "近期，美国加州大学欧文/尔湾分校（UCI）的三位安全研究专家发现，他人可利用热感摄像机来测量用户手指在键盘上留下的余热，并根据热量信息来推算出用户在键盘上输入的文本信息，然后以此来窃取用户密码。"}
{"title": "【议题前瞻】基于EDR和MDR技术的新一代应急响应体系 | 2018 SOC&EDR应用建设高峰论坛", "url": "https://www.freebuf.com/fevents/177521.html", "time": "2018-07-16", "level": "红色标题", "num_look": 259592, "num_comment": 2, "author": "FB客服", "tags": ["企业安全", "活动"], "text": "EDR产品架构是如何设计的？与传统安全产品相比，新一代的安全解决方案有何优势？在实践中，MDR是如何为企业提供有效的帮助？"}
{"title": "基于卷积神经网络的SQL注入检测", "url": "https://www.freebuf.com/articles/web/176709.html", "time": "2018-07-16", "level": "现金奖励", "num_look": 873687, "num_comment": 38, "author": "fishyyh", "tags": ["WEB安全"], "text": "本文结合自然语言处理技术，采用卷积神经网络算法训练SQL注入检测模型，主要包括文本处理、提取文本向量和训练检测模型三个部分。"}
{"title": "黑产军团控制四百万肉鸡集群，掘金区块链数字货币", "url": "https://www.freebuf.com/articles/blockchain-articles/177168.html", "time": "2018-07-16", "level": "", "num_look": 414332, "num_comment": 5, "author": "守护者观察", "tags": ["区块链安全"], "text": "随着区块链技术的火爆，比特币、以太币、瑞波币等数字货币被持续热炒，交易市值和价格一路走高，许多人看好数字货币的发展，纷纷加入“挖矿”大军。"}
{"title": "新型银行木马病毒MysteryBot Android深度分析", "url": "https://www.freebuf.com/articles/terminal/176925.html", "time": "2018-07-16", "level": "", "num_look": 251329, "num_comment": 3, "author": "通付盾移动安全实验室", "tags": ["终端安全"], "text": "近日，国外某安全公司发现一种新型银行木马病毒MySteryBot Android，该病毒为银行木马LokiBot  Android的变种。"}
{"title": "中国特供版Flash：死刑将至，何以再掀波澜", "url": "https://www.freebuf.com/articles/neopoints/177377.html", "time": "2018-07-16", "level": "红色标题", "num_look": 771284, "num_comment": 14, "author": "shidongqi", "tags": ["观点"], "text": "Adobe 近期与国内一家公司达成合作，为国内用户提供特供版Flash，并且在其隐私声明中明确表示可能会收集用户信息，有意思的是在媒体曝光之后，很快该公司又重新修改了隐私声明。"}
{"title": "BUF早餐铺 | 菲律宾英雄联盟：劫持服务期“挖矿软件”已移除；种子网站海盗湾再次利用用户CPU挖掘门罗币；FireEye称中国黑客干预柬埔寨选举", "url": "https://www.freebuf.com/news/177467.html", "time": "2018-07-16", "level": "", "num_look": 156189, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "快压回应火绒所曝光的传播流氓软件、恶意软件一事，称火绒所分析的是2016年被感染的病毒文件。在回应之余还感慨了一番，国内免费软件生存不易，只能依靠弹窗广告一个收入来源，而这也是被无数用户所厌恶的……"}
{"title": "绕过SQL Server的登录触发器限制", "url": "https://www.freebuf.com/articles/database/177088.html", "time": "2018-07-15", "level": "", "num_look": 218567, "num_comment": 218567, "author": "secist", "tags": ["数据安全"], "text": "本文，我将向大家展示如何利用连接字符串属性欺骗主机名和应用程序名称来绕过SQL Server数据库的限制。示例中将会包括SSMS和PowerUpSQL。"}
{"title": "利用蓝牙功能两秒内攻击解锁Tapplock智能挂锁", "url": "https://www.freebuf.com/articles/terminal/176961.html", "time": "2018-07-15", "level": "", "num_look": 297105, "num_comment": 2, "author": "clouds", "tags": ["终端安全"], "text": "我对 Tapplock 进行了一番研究，最终我实现了2秒之内对Tapplock的解锁。"}
{"title": "收集各类安全设备、Nginx日志实现日志统一管理及告警", "url": "https://www.freebuf.com/articles/es/176953.html", "time": "2018-07-15", "level": "现金奖励", "num_look": 454365, "num_comment": 10, "author": "hackerbaba", "tags": ["企业安全"], "text": "近来安全测试项目较少,想着把安全设备、nginx日志收集起来并告警, 话不多说,直接说重点。"}
{"title": "漏洞奖励计划初见成效：微软发现“幽灵”变体", "url": "https://www.freebuf.com/news/177351.html", "time": "2018-07-15", "level": "", "num_look": 299752, "num_comment": 3, "author": "Karunesh91", "tags": ["数据安全", "网络安全"], "text": "近日，英特尔向两位安全研究人员支付了10万美元作为漏洞奖励计划的奖金。两人发现了著名的幽灵漏洞的新变体Spectre1.0和2.0"}
{"title": "如何在Windows中使用netsh命令进行端口转发", "url": "https://www.freebuf.com/articles/system/176889.html", "time": "2018-07-14", "level": "", "num_look": 1153450, "num_comment": 4, "author": "secist", "tags": ["系统安全"], "text": "自Windows XP开始，Windows中就内置网络端口转发的功能。任何传入到本地端口的TCP连接（IPv4或IPv6）都可以被重定向到另一个本地端口，或远程计算机上的端口，并且系统不需要有一个专门用于侦听该端口的服务。"}
{"title": "Microsoft Access Macro (.MAM) 快捷方式钓鱼测试", "url": "https://www.freebuf.com/articles/database/176739.html", "time": "2018-07-14", "level": "", "num_look": 209742, "num_comment": 2, "author": "secist", "tags": ["数据安全"], "text": "本文将为大家引入一种新的钓鱼方案Microsoft Access Macro“MAM”快捷方式钓鱼，MAM文件是一个直接链接到Microsoft Access Macro的快捷方式（从Office 97开始）。"}
{"title": "灰熊矿业？BearMiner的创业之路", "url": "https://www.freebuf.com/articles/terminal/176936.html", "time": "2018-07-14", "level": "", "num_look": 213225, "num_comment": 4, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "深信服EDR安全团队收到用户反馈，称其内网主机存在卡顿现象。经过我们跟踪分析，发现这是一种新型的挖矿病毒，我们已将其命名为BearMiner，中文代号“灰熊矿业”。"}
{"title": "【FB TV】一周「BUF大事件」：Adobe中国特供版Flash默认搜集用户隐私；压缩软件", "url": "https://www.freebuf.com/video/177535.html", "time": "2018-07-14", "level": "红色标题", "num_look": 230529, "num_comment": 3, "author": "willhuang", "tags": ["视频"], "text": "Adobe中国特供版Flash默认搜集用户隐私，将死之鸟，何以再掀波澜；压缩软件\"快压\"传播病毒和多款流氓软件；微软发布2018年7月安全补丁更新。"}
{"title": "基于不同视角的安全管理", "url": "https://www.freebuf.com/articles/security-management/176930.html", "time": "2018-07-14", "level": "金币+8", "num_look": 331112, "num_comment": 6, "author": "good1205", "tags": ["安全管理"], "text": "为什么国内很少听到真正CSO、CISO的职位与人员？如何做好一个企业的安全负责人？一个企业安全负责人应该具备什么样的能力要素？"}
{"title": "SSH 暴力破解趋势：从云平台向物联网设备迁移 | 云鼎实验室出品", "url": "https://www.freebuf.com/articles/paper/177473.html", "time": "2018-07-13", "level": "", "num_look": 344073, "num_comment": 2, "author": "云鼎实验室", "tags": ["安全报告"], "text": "腾讯云发布2018上半年安全专题系列研究报告，该系列围绕用户最常遭遇的安全威胁展开，用数据统计揭露攻击现状，提供可靠的安全指南。"}
{"title": "研究人员公开新CPU漏洞Spectre 1.1和Spectre 1.2", "url": "https://www.freebuf.com/news/177359.html", "time": "2018-07-13", "level": "红色标题", "num_look": 224319, "num_comment": 1, "author": "米雪儿", "tags": ["漏洞", "资讯"], "text": "Meltdown熔断、Spectre幽灵两大安全漏洞被发现之后，Intel处理器身上的漏洞开始源源不断地出现，尤其以“幽灵”漏洞变种居多。"}
{"title": "CMSeeK：CMS漏洞检测和利用套件", "url": "https://www.freebuf.com/sectool/176510.html", "time": "2018-07-13", "level": "", "num_look": 411680, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "CMSeeK是一个CMS的漏洞检测和利用套件。"}
{"title": "九种姿势运行Mimikatz", "url": "https://www.freebuf.com/articles/web/176796.html", "time": "2018-07-13", "level": "现金奖励", "num_look": 1206676, "num_comment": 15, "author": "R1ngk3y", "tags": ["WEB安全"], "text": "平时收集的一些姿势,用户绕过杀软执行mimikatz，这里以360为例进行bypass 测试。"}
{"title": "从NTDS.dit获取密码hash的三种方法", "url": "https://www.freebuf.com/sectool/176876.html", "time": "2018-07-13", "level": "", "num_look": 348314, "num_comment": 348314, "author": "secist", "tags": ["工具"], "text": "当你提取到了大量的主机内部文件时，你可会发现其中包含如NTDS.dit和系统hive，那么你将可能需要用到下面的这些工具，来帮助你提取其中的用户信息。"}
{"title": "【报名中】聚焦终端响应，智慧安全运营 | 2018 SOC&EDR应用建设高峰论坛", "url": "https://www.freebuf.com/fevents/175718.html", "time": "2018-07-13", "level": "红色标题", "num_look": 1134074, "num_comment": 6, "author": "FB客服", "tags": ["企业安全", "活动"], "text": "市场中已经有众多EDR产品，企业该如何选择采购？应对端点和网络安全威胁，企业需要做哪些工作？SOC究竟该如何搭建和运营？未来企业对SOC的投入重点应该放在什么地方？"}
{"title": "360捕获持续8年针对我国的网络间谍组织", "url": "https://www.freebuf.com/articles/network/176777.html", "time": "2018-07-13", "level": "红色标题", "num_look": 447872, "num_comment": 11, "author": "360企业安全", "tags": ["网络安全"], "text": "近日，360追日团队（Helios Team）、360安全监测与响应中心与360威胁情报中心发布《蓝宝菇（APT-C-12）核危机行动揭露》报告，首次披露了其捕获的持续8年攻击中国大陆地区的网络间谍组织——蓝宝菇。"}
{"title": "违规软件再添新业务，秒变直播僵尸粉刷量造假", "url": "https://www.freebuf.com/articles/system/176959.html", "time": "2018-07-13", "level": "", "num_look": 225484, "num_comment": 3, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "腾讯御见威胁情报中心监测发现速浪系列软件突然异常活跃，异常联网行为明显增加，监控数据表明，受该软件家族影响的电脑约50万台。"}
{"title": "功能软件的社交之殇", "url": "https://www.freebuf.com/news/177249.html", "time": "2018-07-13", "level": "", "num_look": 302403, "num_comment": 302403, "author": "Karunesh91", "tags": ["周边", "资讯"], "text": "如今很多app似乎都患上了一种“不做社交不舒服”的病。"}
{"title": "厉害吧！Python都能做指纹识别播报了", "url": "https://www.freebuf.com/articles/ics-articles/176990.html", "time": "2018-07-13", "level": "金币+8", "num_look": 558897, "num_comment": 6, "author": "_橙子 ゝ", "tags": ["工控安全"], "text": "指纹识别技术是目前最成熟且价格便宜的生物特征识别技术。每个人皮肤纹路在图案、断点和交叉点上各不相同，是唯一的，依靠这种唯一性和稳定性，我们才能创造指纹识别技术。"}
{"title": "Buf早餐铺丨苹果前雇员因窃取商业机密被捕；中兴签署协议，即将在美国解禁；电商雇“黑客” 袭击竞争对手网站，12人被警方控制", "url": "https://www.freebuf.com/news/177319.html", "time": "2018-07-13", "level": "", "num_look": 141836, "num_comment": 2, "author": "Karunesh91", "tags": ["资讯"], "text": "苹果前雇员因窃取商业机密被捕；中兴签署协议，即将在美国解禁；电商雇“黑客” 袭击竞争对手网站12人被警方控制。"}
{"title": "方程式组织DanderSpritz工具测试环境研究", "url": "https://www.freebuf.com/sectool/176004.html", "time": "2018-07-12", "level": "", "num_look": 313390, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "DanderSpritz是NSA泄露的一款著名的界面化远控工具，由于其功能强大因此也成为了许多安全人员争相研究的对象。"}
{"title": "D-Link数字签名证书遭窃，反倒成了黑客的“通行证”", "url": "https://www.freebuf.com/news/177118.html", "time": "2018-07-12", "level": "", "num_look": 248761, "num_comment": 1, "author": "Karunesh91", "tags": ["数据安全", "终端安全"], "text": "数字签名的出现，曾大大加强了计算机应用使用的安全性，其复杂、独特的加密方式也使得证书成为了软件的“防伪标志”，并迅速普及。"}
{"title": "数据安全分析思想探索", "url": "https://www.freebuf.com/articles/database/176913.html", "time": "2018-07-12", "level": "现金奖励", "num_look": 881161, "num_comment": 19, "author": "倚剑醉酒笑红尘", "tags": ["企业安全", "数据安全"], "text": "日志分析在入侵检测中的应用越来越广泛，合适的使用日志，使日志产生巨大的价值，本文旨在探讨如何让日志的价值在安全领域发挥作用。"}
{"title": "挖洞经验 | 看我如何发现GitHub提权漏洞获得$10000赏金", "url": "https://www.freebuf.com/articles/web/176872.html", "time": "2018-07-12", "level": "", "num_look": 286044, "num_comment": 2, "author": "clouds", "tags": ["WEB安全"], "text": "经过努力，我发现了Github Organization的一个高危提权漏洞，可以利用 GitHub 应用，实现从Organization成员（Member）到所有者（Owner）的权限提升。"}
{"title": "VisualThreat招聘汽车数据信息安全工程师", "url": "https://www.freebuf.com/jobs/176670.html", "time": "2018-07-12", "level": "", "num_look": 115634, "num_comment": 115634, "author": "tofreebug", "tags": ["安全招聘"], "text": "VisualThreat公司招聘汽车数据信息安全工程师，开发百度apollo无人驾驶平台相关新安全应用。"}
{"title": "浏览器攻击框架BeEF Part 4：绕过同源策略与浏览器代理", "url": "https://www.freebuf.com/articles/web/176873.html", "time": "2018-07-12", "level": "现金奖励", "num_look": 354179, "num_comment": 4, "author": "NT00", "tags": ["WEB安全"], "text": "从这一章开始，正式进入了攻击阶段。这一章要介绍如何绕过同源策略，还会介绍BeEF的一个强大的功能Tunneling Proxy。"}
{"title": "微软对外披露两个0day漏洞详情", "url": "https://www.freebuf.com/vuls/176703.html", "time": "2018-07-12", "level": "金币+8", "num_look": 351347, "num_comment": 3, "author": "arain", "tags": ["安全报告", "漏洞"], "text": "微软近日对外披露了两个0day漏洞详情，其中一个漏洞存在Adobe阅读器中，可被利用导致任意代码执行；另一个漏洞则允许任意代码在Windows kernel内存中提权执行。"}
{"title": "蓝宝菇（APT-C-12）：核危机行动揭露", "url": "https://www.freebuf.com/articles/system/176678.html", "time": "2018-07-12", "level": "", "num_look": 401160, "num_comment": 5, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "从2011年开始持续至今，高级攻击组织蓝宝菇（APT-C-12）对我国政府、军工、科研、金融等重点单位和部门进行了持续的网络间谍活动。360追日团队捕获的首个蓝宝菇组织专用木马出现在2011年3月左右。"}
{"title": "BUF早餐铺 | 微软7月补丁修复15个产品的53个漏洞；幽灵安全漏洞Spectre 1.1新变种曝光；京东回应斐讯事件严禁0元购宣传推广", "url": "https://www.freebuf.com/news/177204.html", "time": "2018-07-12", "level": "", "num_look": 122798, "num_comment": 122798, "author": "Akane", "tags": ["资讯"], "text": "微软7月补丁修复15个产品的53个漏洞；幽灵安全漏洞Spectre 1.1新变种曝光；京东回应斐讯事件严禁0元购宣传推广；全网超3万网站内置挖矿代码。"}
{"title": "以太坊智能合约OPCODE逆向之理论基础篇", "url": "https://www.freebuf.com/articles/blockchain-articles/177260.html", "time": "2018-07-11", "level": "", "num_look": 225088, "num_comment": 225088, "author": "Knownsec知道创宇", "tags": ["区块链安全"], "text": "在我们对etherscan等平台上合约进行安全审查时，常常会遇到没有公布Solidity源代码的合约，所以一个反编译器对审计无源码的智能合约起到了非常重要的作用。"}
{"title": "浅析AMR智能合约批量转账溢出漏洞", "url": "https://www.freebuf.com/vuls/177217.html", "time": "2018-07-11", "level": "", "num_look": 228172, "num_comment": 228172, "author": "BUGX", "tags": ["区块链安全", "数据安全"], "text": "日前，互联网爆出AMR合约存在高危安全风险的交易，通过研究发现，AMR合约存在批量转账溢出漏洞。"}
{"title": "Mquery：一款带有Web前端的YARA恶意软件查询加速器", "url": "https://www.freebuf.com/sectool/176481.html", "time": "2018-07-11", "level": "", "num_look": 179527, "num_comment": 179527, "author": "Alpha_h4ck", "tags": ["工具"], "text": "搜索特定恶意软件样本很困难？不用怕，今天给大家介绍一款名叫Mquery的工具，它带有友好的Web前端界面，可帮助大家迅速寻找到自己想要的恶意软件样本。"}
{"title": "巴以冲突再升级，这次导火索竟然是一款交（yue）友（pao）APP", "url": "https://www.freebuf.com/articles/terminal/176928.html", "time": "2018-07-11", "level": "红色标题", "num_look": 529258, "num_comment": 24, "author": "GEETEST极验", "tags": ["终端安全"], "text": "7月6日，以色列网络安全公司 ClearSky Security 发布报告称，哈马斯试图通过世界杯和约会类APP诱骗以色列国防军安装受恶意软件感染的间谍软件......"}
{"title": "挖洞经验 | 看我如何发现苹果公司官网Apple.com的无限制文件上传漏洞", "url": "https://www.freebuf.com/articles/web/176704.html", "time": "2018-07-11", "level": "", "num_look": 272866, "num_comment": 1, "author": "clouds", "tags": ["WEB安全"], "text": "在前几篇文章中，我分享了亚马逊网站XSS漏洞和Bol.com的开放重定向漏洞，今天我再和大家聊聊不安全的服务器配置问题"}
{"title": "完美世界诚聘信息安全、开发专家、实习生", "url": "https://www.freebuf.com/jobs/176818.html", "time": "2018-07-11", "level": "", "num_look": 160314, "num_comment": 9, "author": "pwrdtest", "tags": ["安全招聘"], "text": "完美世界自2011年至2017年，6次位列中国文化企业30强，并获评2011-2012年度、2013-2014年度、2015-2016年度、2017-2018年度国家文化出口重点企业。"}
{"title": "浏览器攻击框架BeEF Part 3：持续控制", "url": "https://www.freebuf.com/articles/web/176550.html", "time": "2018-07-11", "level": "现金奖励", "num_look": 271910, "num_comment": 1, "author": "NT00", "tags": ["WEB安全"], "text": "前两章分别对BeEF框架做了初步介绍以及讲解了初始化控制。接下来就是介绍如何让BeEF持续控制僵尸们了。"}
{"title": "安全管理 | 浅谈信息安全管理体系建设", "url": "https://www.freebuf.com/articles/security-management/176599.html", "time": "2018-07-11", "level": "金币+10", "num_look": 426630, "num_comment": 6, "author": "oumeixi2", "tags": ["安全管理"], "text": "信息安全管理体系（ISMS)是组织在整体或特定范围内建立的信息安全方针和目标，以及完成这些目标所用的方法和体系。"}
{"title": "BUF早餐铺 | iOS 11.4.1想防止被美警方破解，却留下了新漏洞；以色列一交易所遭攻击，1350万美元虚拟货币被盗；GoDaddy所属托管公司Domainfactory遭到攻击", "url": "https://www.freebuf.com/news/177119.html", "time": "2018-07-11", "level": "", "num_look": 126055, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "以太坊代币“假充值”漏洞涉及多家交易所；被盗的D-link数字证书可用于签署间谍恶意软件。"}
{"title": "HeroRAT：一款全新的基于Telegram的安卓远程访问木马", "url": "https://www.freebuf.com/articles/terminal/175450.html", "time": "2018-07-10", "level": "", "num_look": 299135, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "ESET的恶意软件研究专家近期发现了一种新型的AndroidRAT，并将其命名为HeroRat，这款恶意软件利用了Telegram协议来实现远程命令控制以及数据提取。"}
{"title": "Apache Struts2高危漏洞致企业服务器被入侵安装KoiMiner挖矿木马", "url": "https://www.freebuf.com/vuls/176847.html", "time": "2018-07-10", "level": "", "num_look": 282795, "num_comment": 282795, "author": "腾讯电脑管家", "tags": ["漏洞", "网络安全"], "text": "许多企业的网站使用Apache的开源项目搭建http服务器，其中又有很大部分使用了Apache子项目Struts。但由于Apache Struts2产品代码存在较多隐患，从2007年开始Struts2就频频爆出多个高危漏洞。"}
{"title": "如何利用Ptrace拦截和模拟Linux系统调用", "url": "https://www.freebuf.com/articles/system/176509.html", "time": "2018-07-10", "level": "", "num_look": 226216, "num_comment": 226216, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "ptrace(2)这个系统调用一般都跟调试离不开关系，它不仅是类Unix系统中本地调试器监控实现的主要机制，而且它还是strace系统调用常用的实现方法。"}
{"title": "北京玖富集团诚聘高级安全工程师", "url": "https://www.freebuf.com/jobs/177002.html", "time": "2018-07-10", "level": "", "num_look": 150881, "num_comment": 6, "author": "9FHR", "tags": ["安全招聘"], "text": "玖富（9fbank.com）是中国领先的移动互联网金融综合服务平台，成立于2006年，注册资金2亿元人民币，中国互联网金融协会常务理事单位。"}
{"title": "Windows SMB请求重放攻击分析", "url": "https://www.freebuf.com/articles/system/176206.html", "time": "2018-07-10", "level": "现金奖励", "num_look": 317747, "num_comment": 3, "author": "R1ngk3y", "tags": ["系统安全"], "text": "smb中继或叫smb请求重放攻击，B是一个smb服务器，A来进行认证，B将A的认证信息转发到C上，如果A的凭证在C上认证成功就能进行下一步操作，如创建服务执行命令。"}
{"title": "空手套白狼？USDT 假充值逻辑缺陷漏洞利用分析", "url": "https://www.freebuf.com/articles/blockchain-articles/176668.html", "time": "2018-07-10", "level": "现金奖励", "num_look": 339127, "num_comment": 1, "author": "umiiii", "tags": ["区块链安全"], "text": "6月28日，慢雾科技发布了一条针对 USDT 的预警和漏洞分析，提醒各大交易所尽快暂停 USDT 充值功能，并自查代码是否存在该逻辑缺陷。"}
{"title": "APT攻击演练之捕鱼人的构想", "url": "https://www.freebuf.com/sectool/176504.html", "time": "2018-07-10", "level": "金币+10", "num_look": 551365, "num_comment": 13, "author": "flagellantX", "tags": ["工具", "终端安全"], "text": "通篇是一个模拟的思路架构，以及一些演示，朋友们有了点以后肯定能耍的比我⑥~"}
{"title": "Django开发与攻防测试（入门篇）", "url": "https://www.freebuf.com/vuls/176505.html", "time": "2018-07-10", "level": "金币+10", "num_look": 308488, "num_comment": 7, "author": "Yokeen", "tags": ["WEB安全", "漏洞"], "text": "最近在培训包括在一些比赛中，python框架方面的攻防需求出现的越来越频繁。"}
{"title": "BUF早餐铺丨数字货币交易所Bitconnec被诉庞氏骗局；Google发布2018年7月Android补丁；日本一男子因使用恶意挖矿软件而被判刑", "url": "https://www.freebuf.com/news/176937.html", "time": "2018-07-10", "level": "", "num_look": 117355, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "今天是7月10日星期二，今天早餐铺的主要内容有：数字货币交易所Bitconnec被诉庞氏骗局；蚂蚁金服将在核心业务中实现区块链技术；Google发布2018年7月Android补丁。"}
{"title": "EDU&BAI任意转走账户Token事件回顾", "url": "https://www.freebuf.com/vuls/176759.html", "time": "2018-07-09", "level": "", "num_look": 167642, "num_comment": 2, "author": "BUGX", "tags": ["区块链安全", "漏洞"], "text": "EDU 智能合约出现重大漏洞，可转走任意账户的 EDU Token。目前发现有大量洗劫行为，攻击者不需要私钥即可转走你账户里所有的 EDU。"}
{"title": "JRE8u20反序列化漏洞分析", "url": "https://www.freebuf.com/vuls/176672.html", "time": "2018-07-09", "level": "", "num_look": 241787, "num_comment": 1, "author": "美丽联合安全MLSRC", "tags": ["WEB安全", "漏洞"], "text": "之前在第一篇文章中我们简单的讲了一下Java的序列化机制，即通过ObjectOutputStream和ObjectInputStream来实现序列化和反序列化，但是内部的机制和原理一并跳过了。"}
{"title": "Amass：一款深度子域名枚举工具", "url": "https://www.freebuf.com/sectool/176471.html", "time": "2018-07-09", "level": "", "num_look": 320516, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天介绍的是一款名叫Amass的深度子域名枚举工具，该工具采用Go语言开发，它可以通过遍历等形式爬取数据源和Web文档，或利用IP地址来搜索相关的网块和ASN，并利用所有收集到的信息来构建目标网络拓扑。"}
{"title": "浏览器攻击框架BeEF Part 2：初始化控制", "url": "https://www.freebuf.com/articles/web/176139.html", "time": "2018-07-09", "level": "金币+10", "num_look": 401684, "num_comment": 11, "author": "NT00", "tags": ["WEB安全"], "text": "在上一章，笔者已经介绍了BeEF框架。在这一章，笔者将介绍攻击浏览器技术的第一步：初始控制。"}
{"title": "1药网诚招安全工程师", "url": "https://www.freebuf.com/jobs/176729.html", "time": "2018-07-09", "level": "", "num_look": 146708, "num_comment": 6, "author": "longhuayiyuan", "tags": ["安全招聘"], "text": "1药网成立于2010年7月，是海量用户正在使用的医药平台，为用户提供足不出户的一站式 “医+药”的便捷体验。"}
{"title": "没有大冷门也不用上天台，这是一场专属于黑客的世界杯", "url": "https://www.freebuf.com/news/176933.html", "time": "2018-07-09", "level": "红色标题", "num_look": 306308, "num_comment": 13, "author": "shidongqi", "tags": ["资讯"], "text": "WCTF 2018（世界黑客大师赛），一场号称黑客世界杯的赛场上，没有观众、没有进球的欢呼、也没有大冷门，但却总能让这么一群人热血沸腾……"}
{"title": "技术讨论 | 微信支付SDK 0元购Hack思路分享", "url": "https://www.freebuf.com/vuls/176667.html", "time": "2018-07-09", "level": "现金奖励", "num_look": 288386, "num_comment": 8, "author": "zjie2O71", "tags": ["企业安全", "漏洞"], "text": "之前有网友分享了微信支付SDK的XXE漏洞，语言版本为JAVA，有很多朋友问我0元购的hack思路，我查阅了一下微信支付的官方文档，配合简单的XXE做了一些攻击演示。"}
{"title": "甲方安全中心建设：代码审计系统", "url": "https://www.freebuf.com/sectool/176414.html", "time": "2018-07-09", "level": "现金奖励", "num_look": 607151, "num_comment": 26, "author": "陌度", "tags": ["工具"], "text": "纵观甲方的安全体系建设，最开始和最重要的那一部分就是代码安全。"}
{"title": "AMR智能合约漏洞分析", "url": "https://www.freebuf.com/vuls/176917.html", "time": "2018-07-09", "level": "", "num_look": 179998, "num_comment": 1, "author": "BYSECIO", "tags": ["漏洞"], "text": "Ammbr主要目标是打造具有高度弹性且易于连接的分布式宽带接入平台，同时降低上网相关成本。"}
{"title": "做巨头生意也囤洗发水，黑产江湖你不知道的那些事", "url": "https://www.freebuf.com/articles/network/176263.html", "time": "2018-07-09", "level": "红色标题", "num_look": 285336, "num_comment": 9, "author": "GEETEST极验", "tags": ["网络安全"], "text": "在世界经济论坛发布的《The Global Risks Report 2018》中，网络安全已经成为除自然灾害以外，最大的风险所在。据统计，2017 年黑产从业人员超 150 万，市场规模更是达到了千亿级别……"}
{"title": "VIVO NEX魔性摄像头，不仅能拍照还能排雷？", "url": "https://www.freebuf.com/news/176555.html", "time": "2018-07-09", "level": "", "num_look": 274855, "num_comment": 5, "author": "Karunesh91", "tags": ["数据安全", "终端安全"], "text": "VIVO NEX手机的出现，意外的成为了流氓软件的鉴定神器。"}
{"title": "BUF早餐铺 |迅雷发布区块链文件系统TCFS；福布斯2017世界Top5企业均引入区块链技术；新型病毒可判断计算机用于勒索或挖矿", "url": "https://www.freebuf.com/news/176825.html", "time": "2018-07-09", "level": "", "num_look": 121868, "num_comment": 1, "author": "Karunesh91", "tags": ["资讯"], "text": "今天是7月9日星期一，今天早餐铺的主要内容有：迅雷发布区块链文件系统TCFS；2017世界Top5企业均引入区块链技术；新型病毒可判断计算机用于勒索或挖矿"}
{"title": "恶意软件“剪贴板劫持者”正监控230万个比特币地址", "url": "https://www.freebuf.com/news/176441.html", "time": "2018-07-08", "level": "", "num_look": 166172, "num_comment": 166172, "author": "米雪儿", "tags": ["资讯"], "text": "自2017年以来，加密货币技术已经逐渐变得更加有价值。少量的代币能以法定货币标价出售，且价格不菲。"}
{"title": "研究人员：去年每一次的ICO平均有五个漏洞", "url": "https://www.freebuf.com/news/176355.html", "time": "2018-07-08", "level": "", "num_look": 127785, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "在去年每一次的加密货币ICO（首次币发行）都平均包含五个安全漏洞，其中只有一次ICO不包含任何严重的安全漏洞。"}
{"title": "从最近的微信支付看XXE漏洞", "url": "https://www.freebuf.com/vuls/176837.html", "time": "2018-07-08", "level": "现金奖励", "num_look": 2672845, "num_comment": 5, "author": "路上路人路过", "tags": ["WEB安全", "漏洞"], "text": "先说下写这篇文章的初衷吧，最近微信支付java_sdk刚爆发了一次xxe漏洞，然后领导赶快用自家的静态代码审计工具做了审计。"}
{"title": "刷SRC经验之批量化扫描实践", "url": "https://www.freebuf.com/sectool/176562.html", "time": "2018-07-08", "level": "现金奖励", "num_look": 619622, "num_comment": 12, "author": "w8ay", "tags": ["工具"], "text": "分享批量刷SRC的东西，本意是想做一种全自动化的扫描器，只需要填入url就可以扫描出漏洞信息。虽然现在也没有做成功过....但相信看了本篇文章能让你刷SRC的时候事半功倍~"}
{"title": "一款新型的Linux挖矿木马来袭", "url": "https://www.freebuf.com/articles/terminal/176370.html", "time": "2018-07-08", "level": "", "num_look": 539335, "num_comment": 8, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "最近接到客户反馈，发现Linux机器卡顿，CPU使用量超标高达90%以上，怀疑被挖矿，深信服EDR安全团队第一时间进行了应急处理，并发现该挖矿木马为一款新型的Linux挖矿木马，并对此样本进行了深入的研究分析。"}
{"title": "LaserCrack：一款可扩展的暴力破解框架", "url": "https://www.freebuf.com/sectool/176203.html", "time": "2018-07-07", "level": "金币+6", "num_look": 236066, "num_comment": 236066, "author": "六翼", "tags": ["工具"], "text": "lasercrack是一款爆力破解工具，现如今市面上常见的暴力工具如hydra，medusa都有着不错的破解效率，不过我还没有找到ruby写的，一方面是想从原理上理解下暴力破解漏洞，另一方面练习一下ruby语言。"}
{"title": "企业与云VPN组网自动化实践", "url": "https://www.freebuf.com/articles/security-management/176696.html", "time": "2018-07-07", "level": "金币+6", "num_look": 260198, "num_comment": 4, "author": "accesshub", "tags": ["安全管理"], "text": "伴随着不断出现的外部，内部挑战，我们将业务向公有云迁移。随着时间的推移，逐渐形成了混合云架构。"}
{"title": "花钱买罪受？SIEM的五大常见问题", "url": "https://www.freebuf.com/articles/security-management/175663.html", "time": "2018-07-07", "level": "", "num_look": 277286, "num_comment": 277286, "author": "柚子", "tags": ["安全管理"], "text": "我认为SIEM是现有的、最强大的检测解决方案之一。但是，“最强大”并不一定意味着“最好”。虽然我也希望SIEM能够解决我们所有的问题，但事实并非如此。"}
{"title": "【FB TV】一周「BUF大事件」：微信惊现支付漏洞，国外白帽先联系了360？Vivo NEX检测出百度手机输入法后台录音；三星手机Messages漏洞", "url": "https://www.freebuf.com/video/176859.html", "time": "2018-07-07", "level": "红色标题", "num_look": 298444, "num_comment": 1, "author": "willhuang", "tags": ["视频"], "text": "微信惊现支付漏洞，国外白帽子竟然先联系了360？百度手机输入法被Vivo NEX检测出后台录音；三星手机自动发相册照片给联系人，这是什么情况？"}
{"title": "PHP使用流包装器实现WebShell", "url": "https://www.freebuf.com/articles/web/176571.html", "time": "2018-07-07", "level": "现金奖励", "num_look": 412064, "num_comment": 11, "author": "dxkite", "tags": ["WEB安全"], "text": "在Web安全领域WebShell的构造与查杀是永不停息的话题，这几天发现了一种新型方式生成WebShell，隐蔽度高。"}
{"title": "法律合规视角下的等级保护条例", "url": "https://www.freebuf.com/articles/security-management/176208.html", "time": "2018-07-07", "level": "现金奖励", "num_look": 268004, "num_comment": 3, "author": "acstar", "tags": ["安全管理"], "text": "在执法方式上，除了传统的处罚手段，还新增了约谈制度，公安部门、保密管理部门、密码管理管理可以直接约谈企业的法定代表人。目前来看，约谈也是使用频率最高的执法措施。"}
{"title": "威胁预警 | GandCrabV4.0勒索病毒来袭", "url": "https://www.freebuf.com/articles/terminal/176598.html", "time": "2018-07-06", "level": "", "num_look": 234973, "num_comment": 5, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "最近国外安全研究人员发现了GandCrab勒索病毒的V4.0最新版变种，深信服EDR安全团队马上对此事进行了相关跟进。"}
{"title": "PwnAdventure3：一款专为黑客而开发易受攻击的MMORPG游戏", "url": "https://www.freebuf.com/sectool/175866.html", "time": "2018-07-06", "level": "", "num_look": 261398, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "Pwn Adventure 3是一款专为黑客而开发的，易受攻击的第一人称MMORPG游戏，其目的旨在提升游戏开发人员的安全编码能力。"}
{"title": "如何利用DCOM实现横向渗透", "url": "https://www.freebuf.com/articles/system/175707.html", "time": "2018-07-06", "level": "", "num_look": 227913, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "这篇文章主要讨论的是DCOM横向渗透以及Payload执行方法，当目标系统的\\\\target\\admin$\\system32\\中不包含mobsync.exe时，本文所介绍的方法才可行。"}
{"title": "京东商城诚聘安全研究员", "url": "https://www.freebuf.com/jobs/176264.html", "time": "2018-07-06", "level": "", "num_look": 158308, "num_comment": 5, "author": "nanshihui", "tags": ["安全招聘"], "text": "中国自营式电商企业，创始人刘强东担任京东集团CEO。旗下设有京东商城、京东金融、拍拍网、京东智能、O2O及海外事业部等。2013年正式获得虚拟运营商牌照。"}
{"title": "代码审计 | Empire CMS v7.5后台XSS漏洞", "url": "https://www.freebuf.com/vuls/176313.html", "time": "2018-07-06", "level": "现金奖励", "num_look": 461603, "num_comment": 6, "author": "q601333824", "tags": ["漏洞"], "text": "由于最近渗透测试客户网站碰到了使用这个CMS的站点，于是就去官方下载了这个CMS审计看看，有一处代码的过滤方式并不严格，用的是htmlspecialchars进行实体编码过滤。"}
{"title": "TestService间谍病毒的七年之痒", "url": "https://www.freebuf.com/articles/terminal/176398.html", "time": "2018-07-06", "level": "", "num_look": 159778, "num_comment": 159778, "author": "AVLTeam", "tags": ["终端安全"], "text": "近期安天移动安全和猎豹移动联合捕获到间谍家族Trojan/Android.testServiceSpy的一些新的病毒样本。"}
{"title": "初窥卡巴斯基ARK读取MBR", "url": "https://www.freebuf.com/articles/system/176472.html", "time": "2018-07-06", "level": "现金奖励", "num_look": 402952, "num_comment": 1, "author": "wrmsr", "tags": ["系统安全"], "text": "LONG LONG LONG AGO就发现通过Hook磁盘端口驱动程序中的IRP_MJ_SCSI派遣函数方式过不了KB了，最近又遇到这个问题就想借此机会分析一下，看看万能的KB是如何绕过Hook读取MBR的。"}
{"title": "BUF早餐铺 |  Facebook持续受到美国联邦机构调查； 思科曝出新型银行木马专门窃取用户敏感信息；首期50名毕业生入职360，人才培养绵阳模式初战告捷", "url": "https://www.freebuf.com/news/176761.html", "time": "2018-07-06", "level": "", "num_look": 137186, "num_comment": 2, "author": "Karunesh91", "tags": ["资讯"], "text": "Facebook持续受到美国联邦机构调查； 思科曝出新型银行木马专门窃取用户敏感信息；攻击者借数字货币讨论攻击MacOS用户。"}
{"title": "CNNVD 关于微信支付官方SDK XXE漏洞情况的通报", "url": "https://www.freebuf.com/vuls/176758.html", "time": "2018-07-05", "level": "", "num_look": 315980, "num_comment": 2, "author": "CNNVD", "tags": ["漏洞", "终端安全"], "text": "近日，国家信息安全漏洞库（CNNVD）收到关于微信支付SDK XXE（XML External Entity）漏洞（CNNVD-201807-083）情况的报送。"}
{"title": "基于Casbin的Docker权限管理访问控制插件", "url": "https://www.freebuf.com/sectool/176239.html", "time": "2018-07-05", "level": "金币+6", "num_look": 189195, "num_comment": 189195, "author": "hsluoyz", "tags": ["工具"], "text": "Docker是目前主流的一种容器技术。为了解决多用户同时访问Docker时产生的安全问题，Docker设计了访问控制插件这一机制，通过对Docker请求进行过滤，来实现对Docker的权限管理。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列-Frans Rosén", "url": "https://www.freebuf.com/video/176614.html", "time": "2018-07-05", "level": "红色标题", "num_look": 188190, "num_comment": 3, "author": "willhuang", "tags": ["视频"], "text": "Frans Rosén 算是目前漏洞众测社区内相对活跃的大牛之一了，不管从漏洞产出还是技术分享，Frans Rosén 总力求做到最好。目前，在HackerOne平台，Frans Rosén以 586 个有效漏洞发现量排名第7。"}
{"title": "藏匿在邮件里的“坏小子”", "url": "https://www.freebuf.com/articles/system/176238.html", "time": "2018-07-05", "level": "现金奖励", "num_look": 324101, "num_comment": 5, "author": "JustPlay", "tags": ["系统安全"], "text": "不知从什么时候开始，我的垃圾邮件开始暴增，而且主题千奇百怪，有“再也不用去澳门赌博”、“免保人、免抵押”……"}
{"title": "利用通配符进行Linux本地提权", "url": "https://www.freebuf.com/articles/system/176255.html", "time": "2018-07-05", "level": "", "num_look": 673653, "num_comment": 4, "author": "secist", "tags": ["系统安全"], "text": ""}
{"title": "VIPKID诚聘信息安全人才", "url": "https://www.freebuf.com/jobs/176582.html", "time": "2018-07-05", "level": "", "num_look": 185245, "num_comment": 6, "author": "VIPKID安全团队", "tags": ["安全招聘"], "text": "爱就像蓝天白云晴空万里，我们在VIPKID安全部等你！这里是“爱孩子 懂教育”的VIPKID，这里是成长迅速、备受投资者青睐的VIPKID。"}
{"title": "新手科普 | CTF PWN堆溢出总结", "url": "https://www.freebuf.com/articles/system/171261.html", "time": "2018-07-05", "level": "金币+6", "num_look": 532797, "num_comment": 2, "author": "暴龙兽", "tags": ["系统安全"], "text": "PWN学习之路进入加速度，下面是八周学习的总结，基本上是按照how2heap路线走的。由于八周内容全写，篇幅太长，这里只讲述每道PWN题所用到的一个知识点。"}
{"title": "恶意广告软件RottenSys深度分析报告", "url": "https://www.freebuf.com/articles/terminal/165715.html", "time": "2018-07-05", "level": "", "num_look": 291331, "num_comment": 2, "author": "AVLTeam", "tags": ["安全报告", "终端安全"], "text": "2018年3月14日，国外安全厂商Checkpoint发布报告，声称自2016年来近500万手机设备感染了名为RottenSys的恶意代码。"}
{"title": "这条灰色产业链曾让苹果公司损失10亿美元！", "url": "https://www.freebuf.com/news/176310.html", "time": "2018-07-05", "level": "金币+6", "num_look": 183987, "num_comment": 5, "author": "灰产圈", "tags": ["资讯"], "text": "有光的地方就有阴影，手游行业越发繁荣，但同时也伴随着越来越多的灰色技术和灰色玩法。"}
{"title": "BUF早餐铺 | 谷歌对第三方应用访问用户Gmail作出回应；台湾民进党官网遭黑客入侵留挑衅文字；Linux设备受到挖矿劫持攻击增加", "url": "https://www.freebuf.com/news/176577.html", "time": "2018-07-05", "level": "", "num_look": 114950, "num_comment": 3, "author": "Akane", "tags": ["资讯"], "text": "谷歌对第三方应用访问用户Gmail作出回应；台湾民进党官网遭黑客入侵留挑衅文字；Linux设备受到挖矿劫持攻击增加；Syscoin漏洞或与币安异常交易有关。"}
{"title": "第三方开发者可以访问Gmail邮件？Google回应", "url": "https://www.freebuf.com/news/176576.html", "time": "2018-07-04", "level": "", "num_look": 171231, "num_comment": 1, "author": "Covfefe", "tags": ["资讯"], "text": "据报道，Google已允许第三方开发者访问Gmail邮件，并引起了隐私方面的担忧。"}
{"title": "币安交易所疑似被盗币，被盗数额超过7000BTC？", "url": "https://www.freebuf.com/news/176604.html", "time": "2018-07-04", "level": "红色标题", "num_look": 238428, "num_comment": 8, "author": "BUGX", "tags": ["资讯"], "text": "7月4日，比特币交易所币安通过微博、twitter、telegram群及官网等多渠道发布多条公告，涉及系统临时维护以及部分API交易异常重置。"}
{"title": "VOOKI：一款免费的Web应用漏洞扫描工具", "url": "https://www.freebuf.com/sectool/176104.html", "time": "2018-07-04", "level": "", "num_look": 609674, "num_comment": 33, "author": "secist", "tags": ["工具"], "text": "Vooki是一款免费且用户界面友好的Web应用漏扫工具，它可以轻松地为你扫描任何Web应用并查找漏洞。"}
{"title": "快讯 | 台湾民进党官网遭黑客入侵，被挂表情包和挑逗性文字", "url": "https://www.freebuf.com/news/176541.html", "time": "2018-07-04", "level": "红色标题", "num_look": 423737, "num_comment": 9, "author": "shidongqi", "tags": ["资讯"], "text": "台湾民进党官网遭到黑客入侵，并挂上表情包以及简体文字，直呼“蔡小英一定要连任”。由于出现简体字，多数矛头都被指向大陆黑客所为，部分台湾网友怀疑是该事故只是民进党自导自演的一次闹剧。"}
{"title": "任意用户密码重置（七）：Token可预测", "url": "https://www.freebuf.com/articles/web/176211.html", "time": "2018-07-04", "level": "现金奖励", "num_look": 465661, "num_comment": 15, "author": "yangyangwithgnu", "tags": ["WEB安全"], "text": "在逻辑漏洞中，任意用户密码重置最为常见，可能出现在新用户注册页面，也可能是用户登录后重置密码的页面，或者用户忘记密码时的密码找回页面，其中，密码找回功能是重灾区。"}
{"title": "云储币Siacoin交易管理系统Siaberry的几个漏洞", "url": "https://www.freebuf.com/articles/blockchain-articles/175545.html", "time": "2018-07-04", "level": "", "num_look": 144116, "num_comment": 144116, "author": "clouds", "tags": ["区块链安全"], "text": "今天，我要给大家分享关于云储币（Siacoin）开源挖矿系统Siaberry相关的几个漏洞。"}
{"title": "HDwiki二次注入案例分享", "url": "https://www.freebuf.com/vuls/175911.html", "time": "2018-07-04", "level": "金币+8", "num_look": 247466, "num_comment": 6, "author": "davichi8282", "tags": ["漏洞"], "text": "近期看到网上公布较多hdwiki最新版的安全漏洞，这里以我自己发现的二次注入漏洞进行分享。"}
{"title": "什么仇什么怨！为什么美国频频在国家安全上为难中国？", "url": "https://www.freebuf.com/news/176408.html", "time": "2018-07-04", "level": "红色标题", "num_look": 629781, "num_comment": 20, "author": "Karunesh91", "tags": ["资讯"], "text": "有一则来自大洋彼岸的消息，特朗普政府正式拒绝了中国移动于2011年提交进入美国电信市场的申请，称此举将威胁到国家安全。"}
{"title": "PowerShell恶意利用攻击频繁，企业须做好安全防范", "url": "https://www.freebuf.com/articles/system/176267.html", "time": "2018-07-04", "level": "", "num_look": 506794, "num_comment": 7, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "近期，腾讯御见威胁情报中心监控到利用PowerShell执行恶意代码的攻击频繁发生。此类型攻击利用受害者系统受信任程序的特点，达到系统应用白进程执行恶意代码，从而使受害者难以发现。"}
{"title": "浏览器攻击框架BeEF Part 1", "url": "https://www.freebuf.com/articles/web/175755.html", "time": "2018-07-04", "level": "现金奖励", "num_look": 782607, "num_comment": 6, "author": "NT00", "tags": ["WEB安全"], "text": "笔者发现国内很少有系统介绍BeEF框架的文章，所以笔者决定写一个系列。"}
{"title": "BUF早餐铺 | 美政府拒绝中移动进入美国市场，称威胁国家安全；微信支付SDK被曝XXE漏洞，可窃取商家密钥伪造订单；Facebook承认与61家公司共享用户数据", "url": "https://www.freebuf.com/news/176400.html", "time": "2018-07-04", "level": "", "num_look": 144675, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "继华为、中兴等国内企业遭受美国“威胁论”之后，中国移动也被美国政府以“威胁国家安全”的名义拒绝进入美国市场……"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列-Inti De Ceukelaire", "url": "https://www.freebuf.com/video/176451.html", "time": "2018-07-03", "level": "红色标题", "num_look": 243740, "num_comment": 2, "author": "willhuang", "tags": ["视频"], "text": "作为业余白帽来说，Inti绝对算得上一个鬼才黑客，他思路偏奇，曾发现了多个微软、谷歌、Facebook、Metallica和雅虎的高危漏洞。在今年3月HackerOne主办的h1-202黑客马拉松大赛上，Inti勇夺头名。"}
{"title": "适用于渗透测试不同阶段的工具收集整理", "url": "https://www.freebuf.com/sectool/175767.html", "time": "2018-07-03", "level": "", "num_look": 667523, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "该资源清单列表涵盖了一系列，适用于渗透测试不同阶段的开源/商业工具。如果你想为此列表添加贡献，欢迎你向我发送pull request。"}
{"title": "从OpenVPN配置文件中创建反弹Shell实现用户系统控制", "url": "https://www.freebuf.com/articles/terminal/175862.html", "time": "2018-07-03", "level": "", "num_look": 307252, "num_comment": 307252, "author": "clouds", "tags": ["终端安全"], "text": "本文中，作者通过对OpenVPN的ovpn配置文件进行修改，构建出一个连接到远程控制端的反弹shell，悄无声息地实现对OpenVPN用户系统的控制管理。"}
{"title": "蔚来招聘安全渗透测试专家", "url": "https://www.freebuf.com/jobs/175341.html", "time": "2018-07-03", "level": "", "num_look": 184502, "num_comment": 7, "author": "Imayday", "tags": ["安全招聘"], "text": "蔚来是立足全球的初创品牌，已在圣何塞、慕尼黑、伦敦、上海等13地设立了研发、设计、生产和商务机构，汇聚了数千名世界顶级的汽车、软件和用户体验的行业人才。手上有个安全渗透测试专家的岗位。"}
{"title": "快讯 | 发现微信支付的重大漏洞，国外白帽子竟然先联系了360？", "url": "https://www.freebuf.com/news/176407.html", "time": "2018-07-03", "level": "红色标题", "num_look": 431173, "num_comment": 10, "author": "shidongqi", "tags": ["资讯"], "text": "白帽子发现了微信支付的漏洞，但却不知道如何联系微信安全的人员，竟然在Twitter上@360NetLab。在360安全人员转达漏洞之后，微信安全团队已经及时跟进处理这个问题。"}
{"title": "MicroPython实战：DIY一台会思考的避障车", "url": "https://www.freebuf.com/geek/175732.html", "time": "2018-07-03", "level": "金币+8", "num_look": 206042, "num_comment": 4, "author": "bodasister", "tags": ["极客"], "text": "在日常生活中，大家会经常见到各种各样的遥控车，它需要我们人为的操作，控制它的前进、后退和转弯。今天就带大家认识一个不一样的新朋友——会思考的避障车。"}
{"title": "当“宿主”披上QQ盗号的外衣", "url": "https://www.freebuf.com/articles/terminal/175923.html", "time": "2018-07-03", "level": "红色标题", "num_look": 366340, "num_comment": 9, "author": "暗影安全实验室", "tags": ["终端安全"], "text": "生物学病毒侵入细胞的过程是吸附—植入—复制—分裂—然后不停的复制，那么互联网上的病毒又是如何进行侵入和增殖传播的呢？"}
{"title": "关于phpMyAdmin 4.8.x LFI to RCE的一些分享", "url": "https://www.freebuf.com/vuls/176064.html", "time": "2018-07-03", "level": "", "num_look": 246311, "num_comment": 6, "author": "alphalab", "tags": ["漏洞"], "text": "这篇文章的出发点是在做渗透的过程中，如果遇到phpMyAdmin4.8.x，不需要再像常规那样有file权限才能RCE，这里只要结合后台本地文件包含和insert权限或select权限就可以RCE。"}
{"title": "BUF早餐铺 | 黑客发布索尼PSV固件破解：3.68版本告破；LTE标准存在安全问题，黑客可劫持用户流量数据；百度手机输入法被Vivo NEX检测出后台录音", "url": "https://www.freebuf.com/news/176270.html", "time": "2018-07-03", "level": "", "num_look": 218098, "num_comment": 5, "author": "Akane", "tags": ["资讯"], "text": "黑客发布索尼PSV固件破解：3.68版本告破；LTE标准存在安全问题，黑客可劫持用户流量数据；主流的在线调查平台Typeform遭遇数据泄露。"}
{"title": "博彩巨头BetVictor泄露了自己内部系统的密码列表", "url": "https://www.freebuf.com/news/176056.html", "time": "2018-07-03", "level": "", "num_look": 247408, "num_comment": 1, "author": "米雪儿", "tags": ["数据安全", "资讯"], "text": "近日，据外媒报道称，一个受欢迎的博彩平台在其网站上泄露了内部系统的密码列表，可供任何人查看。"}
{"title": "黑客连卫星都抢，美国国安局慌得一比", "url": "https://www.freebuf.com/news/176146.html", "time": "2018-07-02", "level": "红色标题", "num_look": 496273, "num_comment": 12, "author": "Karunesh91", "tags": ["数据安全", "网络安全"], "text": "随着科技的高速发展，互联网早已遍布我们生活中大大小小各个角落。伴随着网络而生的便是各种安全问题，看似无所不能的黑客时时刻刻通过各种案例提醒我们要注重自身数据安全。"}
{"title": "挖洞经验 | 看我如何发现亚马逊网站的反射型XSS漏洞", "url": "https://www.freebuf.com/articles/web/175606.html", "time": "2018-07-02", "level": "", "num_look": 406554, "num_comment": 5, "author": "clouds", "tags": ["WEB安全"], "text": "我发现了亚马逊的某个反射型XSS漏洞，来和大家作个分享。"}
{"title": "新病毒威胁单位局域网用户，伪装正常软件很难清除", "url": "https://www.freebuf.com/articles/system/175984.html", "time": "2018-07-02", "level": "", "num_look": 266186, "num_comment": 266186, "author": "火绒安全", "tags": ["数据安全", "系统安全"], "text": "近日，火绒安全团队截获新蠕虫病毒\"SyncMiner\" ，该病毒在政府、企业、学校、医院等单位的局域网中具有很强的传播能力。"}
{"title": "登录框之另类思考：来自客户端的欺骗", "url": "https://www.freebuf.com/vuls/175884.html", "time": "2018-07-02", "level": "现金奖励", "num_look": 423902, "num_comment": 7, "author": "TopScrew", "tags": ["WEB安全", "漏洞"], "text": "前几天刚见人发了一个登录框引发的血案，而常规的爆破有风控和各种变态验证码，或者大型的电商都会用SSO实现登录，密码找回逻辑看似天衣无缝，又或者采用第三方的Oauth授权。"}
{"title": "抽丝剥茧：Agent Telsa最新变种脱壳分析", "url": "https://www.freebuf.com/articles/system/175716.html", "time": "2018-07-02", "level": "现金奖励", "num_look": 212064, "num_comment": 212064, "author": "Voraka", "tags": ["系统安全"], "text": "近日，我们检测到大量经过相同加壳混淆过的.NET 恶意木马文件，经过进一步深入分析发现，该木马是带隐私窃取功能的后门木马 Agent Tesla。"}
{"title": "四两拨千斤：Ubuntu kernel eBPF 0day分析", "url": "https://www.freebuf.com/vuls/176094.html", "time": "2018-07-02", "level": "", "num_look": 216983, "num_comment": 2, "author": "腾讯安全平台部", "tags": ["漏洞", "网络安全"], "text": "中国武术博大精深，其中太极作为不以拙力胜人的功夫备受推崇。同样如果从攻击的角度窥视漏洞领域，也不难看出攻防之间的博弈不乏“太极”的身影。"}
{"title": "BUF 早餐铺 | Facebook再曝数据丑闻：1.2亿用户数据面临泄露风险；自2012年以来，所有Android设备都受到RAMpage漏洞的影响；Gentoo GitHub镜像被黑客攻击", "url": "https://www.freebuf.com/news/176156.html", "time": "2018-07-02", "level": "", "num_look": 151635, "num_comment": 4, "author": "Sphinx", "tags": ["资讯"], "text": "浙江破获新型网络犯罪：嫌疑人控数十万网吧电脑挖矿；雄安新区与360集团签署合作，共建大安全生态。"}
{"title": "CNCERT 2018年中国网络安全年会征文通知", "url": "https://www.freebuf.com/fevents/176002.html", "time": "2018-07-02", "level": "", "num_look": 116252, "num_comment": 116252, "author": "CNCERT", "tags": ["活动"], "text": "2018年中国网络安全年会拟于8月14日至16日在北京国家会议中心举办。为更好地交流网络安全领域的新发展、新技术、新应用，现面向全国征集会议论文。"}
{"title": "高级CORS利用技术分享", "url": "https://www.freebuf.com/articles/terminal/175609.html", "time": "2018-07-01", "level": "", "num_look": 290610, "num_comment": 1, "author": "secist", "tags": ["终端安全"], "text": "在正式开始分享我的内容前，我要极力推荐大家去看下Linus Särud和Bo0oM发表的两篇，关于Safari特殊字符处理被滥用，导致XSS或Cookie注入的研究文章。"}
{"title": "如何使用Tokenvator和Windows Tokens实现提权", "url": "https://www.freebuf.com/sectool/175551.html", "time": "2018-07-01", "level": "", "num_look": 221356, "num_comment": 221356, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Tokenvator的工具，该工具采用.NET开发，可用于在Windows系统中提权。"}
{"title": "利用TurniBit开发板DIY一套自动窗帘模拟系统", "url": "https://www.freebuf.com/geek/175649.html", "time": "2018-07-01", "level": "金币+8", "num_look": 239467, "num_comment": 8, "author": "bodasister", "tags": ["极客"], "text": "之前的教程一直都是使用拖拽可视化编程，这种方式可以快速让零基础小伙伴入门，但是在实际项目或工作中，还是要直接敲代码的。"}
{"title": "Subfinder：一个子域名发现工具，可以为任何目标枚举海量的有效子域名", "url": "https://www.freebuf.com/sectool/175556.html", "time": "2018-06-30", "level": "", "num_look": 335031, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "SubFinder是一个子域发现工具，可以为任何目标枚举海量的有效子域名。它已成为sublist3r项目的继承者。"}
{"title": "通过可写文件获取Root权限的多种方式", "url": "https://www.freebuf.com/articles/system/175086.html", "time": "2018-06-30", "level": "", "num_look": 245759, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "在Linux系统中，任何东西都是以文件形式存在的，包括目录和设备在内，它们都拥有读取、写入和执行权限（需配置）。当管理员在设置文件权限时，必须根据Linux用户的具体情况来进行设置。"}
{"title": "Fredi的无线婴儿监控存在漏洞可被利用为间谍摄像机", "url": "https://www.freebuf.com/news/175820.html", "time": "2018-06-30", "level": "", "num_look": 135167, "num_comment": 135167, "author": "Karunesh91", "tags": ["资讯"], "text": "Fredi公司的无线监控被发现存在漏洞，可以被未经身份验证的攻击者入侵并用来监控他人。"}
{"title": "【FB TV】一周「BUF大事件」：2018MOSEC移动安全技术峰会上海举行；WiFi联盟发布新一代WPA3安全标准", "url": "https://www.freebuf.com/video/176189.html", "time": "2018-06-30", "level": "红色标题", "num_look": 188871, "num_comment": 1, "author": "willhuang", "tags": ["视频"], "text": "2018MOSEC移动安全技术峰会如期举行，来自全球的优秀互联网专家齐聚上海；江苏检方依法逮捕山寨微信案件嫌疑人；WiFi联盟发布新一代WPA3安全标准。"}
{"title": "MicroPython开发实例之自制小型家庭气象站", "url": "https://www.freebuf.com/geek/175548.html", "time": "2018-06-30", "level": "金币+6", "num_look": 245011, "num_comment": 2, "author": "bodasister", "tags": ["极客"], "text": "众所周知，iPhone6/6Plus内置气压传感器，不过大家对于气压传感器还是很陌生。跟字面的意思一样，气压传感器就是用来测量气压的，但测量气压对于普通的手机用户来说又有什么作用呢?"}
{"title": "阿迪达斯69周年免费送2500双鞋？背后的真相究竟是什么？", "url": "https://www.freebuf.com/articles/web/175460.html", "time": "2018-06-29", "level": "", "num_look": 247851, "num_comment": 7, "author": "secist", "tags": ["WEB安全"], "text": "自今年年初以来，你可能在WhatsApp上收到过联系人向你发送的，关于阿迪达斯运动鞋免费送的活动消息。"}
{"title": "别让你的手机成为恶意软件的温床", "url": "https://www.freebuf.com/articles/terminal/175719.html", "time": "2018-06-29", "level": "红色标题", "num_look": 529101, "num_comment": 3, "author": "暗影安全实验室", "tags": ["终端安全"], "text": "手机早已成为人们生活中不可或缺的一部分，在娱乐，移动支付，社交等方面都起到举足轻重的作用，可以说在当今社会手机就是人们重要的“生存”工具之一。"}
{"title": "从以太坊MorphToken事件看智能合约构造函数大小写编码错误漏洞", "url": "https://www.freebuf.com/vuls/175904.html", "time": "2018-06-29", "level": "", "num_look": 186258, "num_comment": 1, "author": "Knownsec知道创宇", "tags": ["漏洞"], "text": "以太坊智能合约的含义就是一组代码（函数）和数据（合约的状态），它们位于以太坊区块链的一个特定地址上。智能合约一般使用solidity语言编写。"}
{"title": "智能语音应用Mycroft AI的远程代码执行漏洞分析", "url": "https://www.freebuf.com/articles/web/175128.html", "time": "2018-06-29", "level": "", "num_look": 174326, "num_comment": 174326, "author": "clouds", "tags": ["WEB安全"], "text": "当我在Arch Linux社区开源软件包的开发贡献过程中，发现了一个很有意思的项目-麦考夫Mycroft AI，它是一款开源且基于人工智能（AI）的语音助理应用。"}
{"title": "威胁猎人招聘安全人才", "url": "https://www.freebuf.com/jobs/176013.html", "time": "2018-06-29", "level": "", "num_look": 154650, "num_comment": 4, "author": "永安在线", "tags": ["安全招聘"], "text": "威胁猎人是国内专业的业务安全威胁情报服务商，专注于为互联网业务安全领域的游戏、电商、消费金融、政企、O2O等诸多互联网细分市场。"}
{"title": "敛财百万的挖矿蠕虫HSMiner活动分析", "url": "https://www.freebuf.com/articles/system/175922.html", "time": "2018-06-29", "level": "", "num_look": 434980, "num_comment": 3, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "永恒之蓝漏洞自从2017年4月NSA黑客工具公布之后，越来越多被用于非法网络活动。从勒索病毒WannaCry、NotPetya，到挖矿病毒Powershell Miner、NrsMiner无不利用这一工具大肆活动。"}
{"title": "浅谈XML实体注入漏洞", "url": "https://www.freebuf.com/vuls/175451.html", "time": "2018-06-29", "level": "现金奖励", "num_look": 731183, "num_comment": 9, "author": "Hu3sky", "tags": ["WEB安全", "漏洞"], "text": "学习了XXE漏洞,自己来总结一下,如果有什么写的不到位，不够好的地方，还请师傅们指出。"}
{"title": "【议题征集】2018 SOC & EDR 应用建设高峰论坛·深圳站", "url": "https://www.freebuf.com/fevents/174767.html", "time": "2018-06-29", "level": "红色标题", "num_look": 268553, "num_comment": 5, "author": "FB客服", "tags": ["企业安全", "活动"], "text": "FreeBuf诚挚邀请您参与到2018 SOC & EDR 应用建设高峰论坛议题征集活动中，只要您在SOC&EDR方面拥有丰富的实践经验、创新的案例、精品的内容干货，并乐于与人分享成果，我们都欢迎您前来参加。"}
{"title": "WannaMine再升级，摇身一变成为军火商？", "url": "https://www.freebuf.com/articles/web/175626.html", "time": "2018-06-29", "level": "", "num_look": 271177, "num_comment": 271177, "author": "360安全", "tags": ["WEB安全"], "text": "WannaMine是个“无文件”僵尸网络，在入侵过程中无任何文件落地，仅仅依靠WMI类属性存储ShellCode，并通过“永恒之蓝”漏洞攻击武器以及“Mimikatz+WMIExec”攻击组件进行横向渗透。"}
{"title": "BUF早餐铺 | 老人机自带“李鬼”微信，竟是黑客为厂家定制；两名黑客因劫持700,000个账号被捕；博彩网站BetVictor被曝密码泄露；Bithumb被盗或因驻外员工电脑被黑客攻击", "url": "https://www.freebuf.com/news/176051.html", "time": "2018-06-29", "level": "", "num_look": 133853, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "近期微信对于打击盗版以及破解力度加大，不少人被封号，建议大家尽可能从官方渠道下载，避免盗版、破解版微信。"}
{"title": "黑客瞄准老人机群体，预装山寨版微信频繁推送骚扰广告", "url": "https://www.freebuf.com/news/176059.html", "time": "2018-06-28", "level": "红色标题", "num_look": 384965, "num_comment": 9, "author": "shidongqi", "tags": ["资讯"], "text": "随着电话、短信功能被弱化，微信已经成为大多数人主要沟通方式之一。为了跟子女联系，中老年群体也表现出了对微信的刚需。没想到却让黑客钻了空子，大量老人机被曝安装黑客破解版微信，频繁推送骚扰广告。"}
{"title": "Impacket网络协议工具包介绍", "url": "https://www.freebuf.com/sectool/175208.html", "time": "2018-06-28", "level": "", "num_look": 456370, "num_comment": 4, "author": "secist", "tags": ["工具"], "text": "Impacket是一个Python类库，用于对SMB1-3或IPv4 / IPv6 上的TCP、UDP、ICMP、IGMP，ARP，IPv4，IPv6，SMB等协议进行低级编程访问。"}
{"title": "以太坊蜜罐智能合约分析", "url": "https://www.freebuf.com/articles/blockchain-articles/175915.html", "time": "2018-06-28", "level": "", "num_look": 201725, "num_comment": 201725, "author": "Knownsec知道创宇", "tags": ["区块链安全"], "text": "在学习区块链相关知识的过程中，拜读过一篇很好的文章，作者详细分析了他遇到的三种蜜罐智能合约，并将相关智能合约整理收集到Github项目smart-contract-honeypots。"}
{"title": "技术分享 | 如何使用Cron Jobs实现Linux提权", "url": "https://www.freebuf.com/articles/system/175453.html", "time": "2018-06-28", "level": "", "num_look": 230332, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "今天给各位渗透测试同行们提供一种Linux提权方法，在这篇文章中，我们将介绍如何使用Cron Jobs来实现Linux下的权限提升，并获取远程主机的root访问权。"}
{"title": "WiFi联盟发布新一代WPA3安全标准", "url": "https://www.freebuf.com/news/175925.html", "time": "2018-06-28", "level": "", "num_look": 269152, "num_comment": 3, "author": "Karunesh91", "tags": ["无线安全", "资讯"], "text": "近日wifi联盟宣布推出WPA3安全标准，该标准旨在改善WPA2遗留的漏洞以及进一步增加wifi安全性。"}
{"title": "Catch Me If You Can靶机实战演练", "url": "https://www.freebuf.com/articles/web/175543.html", "time": "2018-06-28", "level": "金币+6", "num_look": 250162, "num_comment": 5, "author": "小鸟", "tags": ["WEB安全"], "text": "电影《Catch Me If You Can》的中译名是《猫鼠游戏》，《猫鼠游戏》是一部好莱坞罕见的犯罪传记题材影片，其以独特的视角重新演绎了社会工程学诈骗的诸多手段令人称赞。"}
{"title": "Pwn2Own华为某漏洞原理与利用分析", "url": "https://www.freebuf.com/vuls/175256.html", "time": "2018-06-28", "level": "现金奖励", "num_look": 443585, "num_comment": 2, "author": "Tasfa", "tags": ["漏洞", "终端安全"], "text": "这部分漏洞分析属于之前MWR InfoSecurity的研究员报告中的第三部分,同样该报告仅有漏洞的简单描述，具体的PoC也未详细给出。"}
{"title": "浅谈SQL盲注测试方法解析与技巧", "url": "https://www.freebuf.com/articles/web/175049.html", "time": "2018-06-28", "level": "现金奖励", "num_look": 609876, "num_comment": 7, "author": "AKarmA", "tags": ["WEB安全"], "text": "本文所有实战盲注例子，均来自Joomla! 3.7.0 - 'com_fields' SQL Injection。"}
{"title": "天台人满为患，不如来看下这个Ramnit蠕虫分析", "url": "https://www.freebuf.com/vuls/175542.html", "time": "2018-06-28", "level": "金币+6", "num_look": 280255, "num_comment": 7, "author": "gechengyu", "tags": ["漏洞", "系统安全"], "text": "今年的世界杯越来越看不懂，想去天台吹吹风都不一定有位置……心凉了，事儿还得做，先从网上抓个可疑样本压压惊！上手分析才发现并没有我想得那么简单。"}
{"title": "BUF早餐铺 | 中小企业将钓鱼列为首要攻击威胁；Wi-Fi联盟宣布新WPA3安全标准；WordPress被曝未修复的漏洞；Windows 10快捷方式功能可被利用执行恶意代码；特制汽车可在500米外入侵手机", "url": "https://www.freebuf.com/news/175986.html", "time": "2018-06-28", "level": "", "num_look": 143269, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "高温来袭，注意防暑降温，不要着凉哦~"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列-James Kettle", "url": "https://www.freebuf.com/video/175905.html", "time": "2018-06-27", "level": "红色标题", "num_look": 209138, "num_comment": 209138, "author": "willhuang", "tags": ["视频"], "text": "James Kettle，作为业界大名鼎鼎的BurpSuite公司 PortSwigger Web Security 首席研究员，有深厚的渗透技术和漏洞挖掘能力"}
{"title": "SamSam：一款难以追踪的分布式控制软件", "url": "https://www.freebuf.com/articles/terminal/175454.html", "time": "2018-06-27", "level": "", "num_look": 200654, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "自其出现以来，SamSam经历了大量的改进，并增加了很多额外功能，虽然这些功能并没有让SamSam变得更加危险，但它们增加了SamSam的检测难度。"}
{"title": "JDK7u21反序列化漏洞分析", "url": "https://www.freebuf.com/vuls/175754.html", "time": "2018-06-27", "level": "", "num_look": 276317, "num_comment": 1, "author": "美丽联合安全MLSRC", "tags": ["WEB安全", "漏洞"], "text": "在上一次研究ApacheCommonsCollections的时候，由于本地的JRE环境是1.8，导致无法复现网上各位大佬提供的payload，但是在查找资料的过程中发现了ysoserial这个项目。"}
{"title": "看看印尼黑客如何利用电影大片进行网络攻击", "url": "https://www.freebuf.com/articles/web/175702.html", "time": "2018-06-27", "level": "", "num_look": 214175, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "网络犯罪分子每天都在想尽各种办法来进行攻击，这对于信息安全从业者来说再正常不过了，而这一次印尼网络犯罪组织开始利用电影大片来欺骗目标用户访问已受感染的网站。"}
{"title": "iPhone密码可被暴力破解？苹果回应：测试有误", "url": "https://www.freebuf.com/news/175773.html", "time": "2018-06-27", "level": "", "num_look": 159133, "num_comment": 3, "author": "Karunesh91", "tags": ["终端安全", "资讯"], "text": "Hacker House专家称发现苹果设备存在漏洞，可以通过枚举的方式暴力破解iPhone或iPad的密码，并且通过视频验证了漏洞的存在。"}
{"title": "从交友和色播乱象说起：起底当代中国情色产业链", "url": "https://www.freebuf.com/articles/neopoints/175639.html", "time": "2018-06-27", "level": "金币+8", "num_look": 510690, "num_comment": 7, "author": "灰产圈", "tags": ["观点"], "text": "色情产业从来都是刚需 ，它不仅是很多人活跃在网络上的理由之一，更是推动了互联网技术的发展：在线支付、在线视频、宽带网络、网络聊天、硬盘产业。"}
{"title": "区块链黑幕 | 我们不生产“白皮书”，我们只是“白皮书”的搬运工！", "url": "https://www.freebuf.com/articles/blockchain-articles/175448.html", "time": "2018-06-27", "level": "金币+8", "num_look": 287582, "num_comment": 3, "author": "灰产圈", "tags": ["区块链安全"], "text": "当大家一窝蜂的投身区块链掘金渴望一夜暴富的时候，新的行业又促生了另一批新职业。他们离开风险中心，靠代写ICO的白皮书赚的盆满钵满。"}
{"title": "2018 Gartner安全与风险管理峰会 | 安全管理者要注意的一些问题", "url": "https://www.freebuf.com/articles/neopoints/175619.html", "time": "2018-06-27", "level": "", "num_look": 420064, "num_comment": 1, "author": "AngelaY", "tags": ["观点"], "text": "每年六月，Gartner 都会在华盛顿附近召开 Gartner 安全与风险管理峰会，为 CISO、首席风险官、建筑师、IAM 和网络安全领导等高级 IT 和安全专业人员提供指导。"}
{"title": "BUF早餐铺 | 去年平均每个ICO都有五个安全漏洞；智能手机电池也能泄露用户活动数据；《网络安全等级保护条例》拟将于本周发布", "url": "https://www.freebuf.com/news/175772.html", "time": "2018-06-27", "level": "", "num_look": 105079, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "手机电池都能泄露信息，还有什么是黑客做不到的。"}
{"title": "开源软件源代码安全缺陷分析报告：框架类软件专题", "url": "https://www.freebuf.com/articles/network/174854.html", "time": "2018-06-26", "level": "", "num_look": 187157, "num_comment": 187157, "author": "奇安信代码卫士", "tags": ["网络安全"], "text": "近日，CNCERT发布了《开源软件代码安全缺陷分析报告——框架类软件专题》。本期报告聚焦国内外知名框架类开源软件安全开发现状。"}
{"title": "一款针对WordPress网站的渗透测试框架", "url": "https://www.freebuf.com/sectool/175094.html", "time": "2018-06-26", "level": "", "num_look": 247779, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Wordpress Exploit Framework的Ruby框架，研究人员可利用该框架来研发或使用其自带某开来对由WordPress驱动的网站或系统进行渗透测试。"}
{"title": "一起利用“永恒之蓝”系列漏洞传播的黑产木马事件揭秘", "url": "https://www.freebuf.com/articles/system/175613.html", "time": "2018-06-26", "level": "", "num_look": 328588, "num_comment": 5, "author": "任子行", "tags": ["系统安全"], "text": "近期监测到一起利用“永恒之蓝”系列漏洞传播恶意软件的事件，通过对事件与样本的分析，该事件可以定性为一起攻击者通过购买恶意软件。"}
{"title": "记一次服务器被入侵的调查取证", "url": "https://www.freebuf.com/articles/system/175370.html", "time": "2018-06-26", "level": "现金奖励", "num_look": 911258, "num_comment": 27, "author": "fish1983", "tags": ["系统安全"], "text": "一天，小Z接到运维同事的反映，一台tomcat 的web服务器虽然安装了杀软，但是还是三天两头会出现杀软病毒报警，希望他能查下原因。"}
{"title": "技术讨论 | 一次详细的Kerberoast攻击演示", "url": "https://www.freebuf.com/articles/system/174967.html", "time": "2018-06-26", "level": "", "num_look": 250187, "num_comment": 250187, "author": "secist", "tags": ["系统安全"], "text": "简单直白的说Kerberoast攻击，就是攻击者为了获取目标服务的访问权限，而设法破解Kerberos服务票据并重写它们的过程。"}
{"title": "刷量神器藏漏洞攻击陷阱，数十万自媒体电脑沦为肉鸡", "url": "https://www.freebuf.com/articles/system/175316.html", "time": "2018-06-26", "level": "", "num_look": 267052, "num_comment": 5, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "一款名为“流量宝流量版”的软件，在运行时会自动请求带有CVE-2018-8174漏洞（浏览器高危漏洞）的URL。"}
{"title": "【FB字幕组】道德黑客课程CEH-入门到精通（更新啦）", "url": "http://open.freebuf.com/category/subtitle", "time": "2018-06-26", "level": "红色标题", "num_look": 27160, "num_comment": 27160, "author": "willhuang", "tags": ["视频"], "text": "【FB字幕组】道德黑客课程CEH-入门到精通，本课程翻译自Youtube关注量百万的精选系列教程，喜欢的点一波关注（每周更新）！"}
{"title": "Solidity中存储方式错误使用所导致的变量覆盖", "url": "https://www.freebuf.com/articles/blockchain-articles/175237.html", "time": "2018-06-26", "level": "现金奖励", "num_look": 265177, "num_comment": 1, "author": "bubbleszz", "tags": ["区块链安全"], "text": "说起来这次的分析过程还是源于一位老哥给我分享的一份合约，写法很有意思也确实存在着很多的问题，我们等会再来谈谈它。"}
{"title": "一次Linux遭入侵，挖矿进程被隐藏案例分析", "url": "https://www.freebuf.com/vuls/175709.html", "time": "2018-06-26", "level": "红色标题", "num_look": 530562, "num_comment": 6, "author": "云鼎实验室", "tags": ["漏洞", "系统安全"], "text": "我们发现黑客开始不断使用一些隐藏手段去隐藏挖矿程序而使它获得更久存活，今天分析的内容是我们过去一个月内捕获的一起入侵挖矿事件。"}
{"title": "曾经的造富神话，如今的韭菜基地：虚拟货币还能走多远？", "url": "https://www.freebuf.com/articles/neopoints/175236.html", "time": "2018-06-26", "level": "现金奖励", "num_look": 203009, "num_comment": 1, "author": "灰产圈", "tags": ["观点"], "text": "自比特币诞生以来，市场上出现了大量的虚拟货币，它们将“去中心化”“区块链技术”等作为吸引消费者投资的“噱头”，利用互联网技术进行广泛传播，严重扰乱了货币市场。"}
{"title": "BUF 早餐铺 | WebAssembly的修改会使得Meltdown和Spectre补丁失效；英国税务局记录了510万英国人的声音；苹果回应iPhone密码被暴力破解：测试是错误的", "url": "https://www.freebuf.com/news/175665.html", "time": "2018-06-26", "level": "", "num_look": 134703, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "58同城回应招聘陷阱：将联合警方打击“网络黑产”；拒不履行网络安全管理义务，宿豫一网络公司被罚10万。"}
{"title": "BadMod V2.0：一款用于扫描网站并自动执行渗透的工具", "url": "https://www.freebuf.com/sectool/175088.html", "time": "2018-06-25", "level": "", "num_look": 353325, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫BadMod的工具，大家可以利用该工具来扫描CMS网站并对目标站点进行自动渗透测试。"}
{"title": "挖洞经验 | 看我如何挖掘并成功利用印度Popular Sports公司网站主机头的SQL注入漏洞", "url": "https://www.freebuf.com/articles/web/174869.html", "time": "2018-06-25", "level": "", "num_look": 235717, "num_comment": 4, "author": "secist", "tags": ["WEB安全"], "text": "本文是关于“我如何利用主机头找出SQL注入漏洞，以及使用sqlmap tamper脚本绕过规则并dump目标数据库”的完整过程。"}
{"title": "“3Q”从大战四年到互相致谢，有些事值得放下恩怨", "url": "https://www.freebuf.com/articles/neopoints/175600.html", "time": "2018-06-25", "level": "红色标题", "num_look": 376814, "num_comment": 4, "author": "Allen别bb", "tags": ["观点"], "text": "在安全问题面前，所有企业都无法独善其身，其唯一且共同的敌人就是黑客。近年来，国家也高度关注网络安全，积极推进企业在安全问题上建立统一战线，360和腾讯的这次握手也算是开了一个好头。"}
{"title": "永生之火：相对持久的绕过方法和一点想法", "url": "https://www.freebuf.com/articles/network/175097.html", "time": "2018-06-25", "level": "现金奖励", "num_look": 932295, "num_comment": 17, "author": "flagellantX", "tags": ["网络安全"], "text": "最近团队的web突破口老跟我求后门玩钓鱼，就来写这么一篇文章。"}
{"title": "快讯 | 黑龙江高考查分官网瘫痪，查询入口被微信封锁", "url": "https://www.freebuf.com/news/175564.html", "time": "2018-06-25", "level": "红色标题", "num_look": 272930, "num_comment": 7, "author": "Sphinx", "tags": ["资讯"], "text": "原本高考查分就是一件让众多考生忐忑不安的事，而似乎还有黑客在给这群可爱的考生们添堵。"}
{"title": "Micropython之DIY循迹智能小车", "url": "https://www.freebuf.com/geek/175152.html", "time": "2018-06-25", "level": "现金奖励", "num_look": 219482, "num_comment": 3, "author": "_橙子 ゝ", "tags": ["极客"], "text": "AI作为现代社会发展的主流，也是未来发展的方向，它可以按照预先设定的模式在一个特定的环境里自动的运作，无需人为管理，便可以完成预期所要达到的或是更高的目标。"}
{"title": "持枪“劫持”域名，可能他心中有个黑客梦", "url": "https://www.freebuf.com/news/175431.html", "time": "2018-06-25", "level": "红色标题", "num_look": 383294, "num_comment": 10, "author": "shidongqi", "tags": ["资讯"], "text": "劫持域名，这种操作想必大多数人都有所了解。但是你见过持枪劫持域名的么？？？"}
{"title": "BUF 早餐铺 | 使用Kardon Loader构建恶意软件分发网络非常简单；思科安全更新修复NX-OS软件中的5个严重漏洞；谷歌将让Android P的生物识别认证机制变得更加安全", "url": "https://www.freebuf.com/news/175522.html", "time": "2018-06-25", "level": "", "num_look": 104656, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "使用Kardon Loader构建恶意软件分发网络非常简单；思科安全更新修复NX-OS软件中的5个严重漏洞；谷歌将让Android P的生物识别认证机制变得更加安全。"}
{"title": "CNCERT 2018年网络安全创新产品（技术）评选活动通知", "url": "https://www.freebuf.com/fevents/175456.html", "time": "2018-06-24", "level": "", "num_look": 117800, "num_comment": 117800, "author": "CNCERT", "tags": ["活动"], "text": "以公平、公正、客观、权威的原则，公开征集评选我国网络安全领域2018年的创新产品和创新技术成果，并颁发奖励证书。"}
{"title": "微软智能助手Cortana易被利用，可解锁计算机", "url": "https://www.freebuf.com/news/174978.html", "time": "2018-06-24", "level": "", "num_look": 140383, "num_comment": 140383, "author": "Covfefe", "tags": ["资讯"], "text": "Cortana是微软在Windows 10中内置的人工智能助手，但最近其被发现可以帮助攻击者解锁你的电脑。"}
{"title": "任意代码保护与内核代码注入的那些事儿", "url": "https://www.freebuf.com/articles/system/174699.html", "time": "2018-06-24", "level": "", "num_look": 198056, "num_comment": 198056, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "在这篇文章中，我们将详细介绍Arbitrary Code Guard的工作机制，并利用内核代码注入攻击来测试这项缓解技术的有效性。"}
{"title": "后门病毒通过下载站传播，全面劫持各大主流浏览器", "url": "https://www.freebuf.com/articles/paper/175358.html", "time": "2018-06-24", "level": "", "num_look": 272039, "num_comment": 2, "author": "火绒安全", "tags": ["安全报告"], "text": "日前，火绒安全团队截获后门病毒\"Humpler\"。该病毒伪装成多款小工具（如：老板键、屏幕亮度调节等），正通过2345软件大全等多个知名下载站进行传播。"}
{"title": "高能预警！警惕EnMiner挖矿大开杀戒", "url": "https://www.freebuf.com/vuls/175246.html", "time": "2018-06-24", "level": "", "num_look": 250571, "num_comment": 2, "author": "深信服千里目安全实验室", "tags": ["漏洞", "终端安全"], "text": "近日，一种具有高强度病毒对抗行为的新型的挖矿病毒出现，其病毒机制与常规挖矿相差较大，一旦感染上，清理难度极大。"}
{"title": "MOSEC 2018大会速描 | 每年一度的“越狱秀”以及移动安全之远望", "url": "https://www.freebuf.com/news/175550.html", "time": "2018-06-23", "level": "红色标题", "num_look": 148415, "num_comment": 2, "author": "AngelaY", "tags": ["活动", "资讯"], "text": "今年份的 MOSEC，了解一下？"}
{"title": "EncryptFiles.ps1：一款使用PowerShell和证书来加密文件的工具", "url": "https://www.freebuf.com/sectool/174868.html", "time": "2018-06-23", "level": "", "num_look": 182953, "num_comment": 3, "author": "secist", "tags": ["工具"], "text": "今天我将为你们提供一个文件加密工具，来自动化的帮我们完成这些过程。关于证书问题，大家也不必担心。该工具会询问你是否有证书，如果没有它将会被自动创建。"}
{"title": "苹果的代码签名漏洞将允许恶意软件绕过多款Mac安全产品", "url": "https://www.freebuf.com/news/174743.html", "time": "2018-06-23", "level": "", "num_look": 139199, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "近期，来自安全公司Okta Rex的研究专家Josh Pitts在macOS的代码签名机制中发现了一个可以利用的安全漏洞。这个漏洞潜伏了一年之久，它允许攻击者将恶意的不受信任的代码伪装成受信任的合法代码，并绕过多款macOS安…"}
{"title": "Game-of-Thrones-CTF-1.0靶机实战演练", "url": "https://www.freebuf.com/articles/web/175048.html", "time": "2018-06-23", "level": "现金奖励", "num_look": 436319, "num_comment": 36, "author": "小鸟", "tags": ["WEB安全"], "text": "这个靶机的主题是“权利的游戏”，难度在中高水平。"}
{"title": "【FB TV】一周「BUF大事件」：苹果一招封杀多数iPhone解锁神器；欧洲议会禁用卡巴斯基产品；OpenBSD计划禁用对Intel CPU超线程的支持", "url": "https://www.freebuf.com/video/175518.html", "time": "2018-06-23", "level": "红色标题", "num_look": 181706, "num_comment": 181706, "author": "willhuang", "tags": ["视频"], "text": "苹果一招封杀多数iPhone解锁神器，美国警方无奈；继美国、荷兰之后，欧洲议会禁用卡巴斯基产品；OpenBSD计划禁用对Intel CPU超线程的支持。"}
{"title": "追踪Satan勒索病毒家族", "url": "https://www.freebuf.com/articles/system/175248.html", "time": "2018-06-23", "level": "", "num_look": 268973, "num_comment": 268973, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "撒旦(Satan)病毒是一款恶意勒索程序，首次出现2017年1月份。Satan病毒的开发者通过网站允许用户生成自己的Satan变种，并且提供CHM和带宏脚本Word文档的下载器生成脚本进行传播。"}
{"title": "挖洞经验 | 看我如何发现Paypal内部信息泄露漏洞", "url": "https://www.freebuf.com/articles/web/174962.html", "time": "2018-06-22", "level": "", "num_look": 231389, "num_comment": 2, "author": "clouds", "tags": ["WEB安全"], "text": "本文我要分享的是，在Paypal网站manager.paypal.com上的某个页面存在“表达式注入“漏洞（Expression Language Injection）"}
{"title": "快讯 | macOS的快速浏览缓存可能会泄露加密数据", "url": "https://www.freebuf.com/news/175445.html", "time": "2018-06-22", "level": "", "num_look": 114074, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "macOS的快速浏览机制允许用户在不需要实际打开文件的情况下查看文件的内容，这个功能很可能泄露缓存文件的信息，即使文件存储在加密驱动器或文件已被删除也无法保证数据的安全。"}
{"title": "DIY一个专属HID注入设备吧", "url": "https://www.freebuf.com/sectool/175050.html", "time": "2018-06-22", "level": "现金奖励", "num_look": 407245, "num_comment": 4, "author": "kincaid", "tags": ["工具", "极客"], "text": "BadUSB是指通过模拟键盘自动输入指令，实现信息窃取和恶意程序执行的HID攻击方法，最早由SRLabs在2014年美国黑帽大会上提出。起初BadUSB设备是通过更改U盘中的控制器固件实现的，支持的设备型号较少。"}
{"title": "Apache-Commons-Collections反序列化漏洞分析", "url": "https://www.freebuf.com/vuls/175252.html", "time": "2018-06-22", "level": "", "num_look": 314114, "num_comment": 314114, "author": "美丽联合安全MLSRC", "tags": ["WEB安全", "漏洞"], "text": "本次分析的漏洞是2015年出现的Apache-commons-collections组件出现的反序列化问题，这个包为Java提供了很多基础常用且强大的数据结构，方便开发。"}
{"title": "Axis摄像头存在安全缺陷，三个漏洞即可接管", "url": "https://www.freebuf.com/news/175224.html", "time": "2018-06-22", "level": "", "num_look": 158588, "num_comment": 158588, "author": "Covfefe", "tags": ["资讯"], "text": "网络安全公司VDOO的研究人员近期发现了几个漏洞，这些漏洞影响Axis近400台安全摄像机。"}
{"title": "浅析“威胁猎人”如何在现代安全环境中运作", "url": "https://www.freebuf.com/articles/network/174733.html", "time": "2018-06-22", "level": "", "num_look": 183565, "num_comment": 2, "author": "米雪儿", "tags": ["网络安全"], "text": "每年，互联网上都会出现数百万种新型恶意软件，威胁猎人必须随时候命，将识别和打击恶意软件列为优先事项，以确保组织能够保持安全，并且免受各种网络威胁的侵害。"}
{"title": "捆绑了多个最新Office漏洞利用的虚拟币钱包木马分析", "url": "https://www.freebuf.com/articles/system/175015.html", "time": "2018-06-22", "level": "红色标题", "num_look": 290806, "num_comment": 1, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "近日，360威胁情报中心捕获了一批功能强大的远控木马，其不仅能盗取用户的邮箱、即时通讯软件、浏览器等等的相关隐私信息"}
{"title": "JIS-CTF_VulnUpload靶机攻略", "url": "https://www.freebuf.com/vuls/175057.html", "time": "2018-06-22", "level": "金币+8", "num_look": 404061, "num_comment": 5, "author": "yangyangwithgnu", "tags": ["WEB安全", "漏洞"], "text": "vulnhub 是我喜爱的游乐场之一，上面的每个靶机都是很酷的一个游戏。完整找出所有 flag 只是基本任务，实现提权才是终极目标。"}
{"title": "BUF早餐铺 | 微软Edge浏览器可能泄露来自其他站点的信息；航班信息追踪公司Flightradar24遭遇数据泄露；黑客窃取韩国交易平台3100万美元的加密货币", "url": "https://www.freebuf.com/news/175300.html", "time": "2018-06-22", "level": "", "num_look": 166256, "num_comment": 1, "author": "Akane", "tags": ["资讯"], "text": "白日放歌须纵酒，青春作伴好还乡。又逢周五放风日，漫卷诗书喜欲狂。"}
{"title": "一份有关车辆安全和汽车黑客的资源清单列表", "url": "https://www.freebuf.com/sectool/175282.html", "time": "2018-06-21", "level": "", "num_look": 550332, "num_comment": 6, "author": "secist", "tags": ["工具", "工控安全"], "text": "本文是一系列关于车辆安全和汽车黑客的资源清单列表，其中包括技术文章，书籍，软硬件，应用程序等。"}
{"title": "Hash-Buster v2.0：一款能够调用多个API来进行hash查询的工具", "url": "https://www.freebuf.com/sectool/175087.html", "time": "2018-06-21", "level": "", "num_look": 228339, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Hash Buster的工具，大家可以利用这款工具提供的API服务来进行hash查询。"}
{"title": "简单搜索与那些“纯净版”应用们", "url": "https://www.freebuf.com/articles/neopoints/175040.html", "time": "2018-06-21", "level": "红色标题", "num_look": 661975, "num_comment": 11, "author": "高傲的蝴蝶酥", "tags": ["观点"], "text": "“简单搜索，永远没有广告”。"}
{"title": "FLASH零日漏洞CVE-2018-5002在中东地区的定向网络攻击利用", "url": "https://www.freebuf.com/articles/paper/175230.html", "time": "2018-06-21", "level": "", "num_look": 189606, "num_comment": 3, "author": "clouds", "tags": ["安全报告"], "text": "攻击者利用该漏洞构造的恶意Flash对象，可以在目标受害者电脑上执行代码，实现后续渗透的一系列Payload和恶意代码运行。"}
{"title": "暗崟虫：潜藏多年的软件后门分析", "url": "https://www.freebuf.com/articles/paper/175274.html", "time": "2018-06-21", "level": "红色标题", "num_look": 254173, "num_comment": 6, "author": "360安全", "tags": ["安全报告"], "text": "近期，360核心安全团队接到用户举报多款流氓软件，包括屏幕亮度调节器、超级老板键等软件采取同一手法植入恶意代码并通过各大下载站传播，在用户电脑上偷偷执行远程代码，严重影响用户的信息安全。"}
{"title": "将“窃取隐私的贼”扼杀在襁褓中", "url": "https://www.freebuf.com/articles/database/175134.html", "time": "2018-06-21", "level": "", "num_look": 391766, "num_comment": 3, "author": "暗影安全实验室", "tags": ["数据安全"], "text": "事物发展的两面性同时带给我们一些防不胜防的问题，层出不穷的隐私安全事件更是与我们的利益息息相关。互联网时代，我们大多数人都在“裸奔”。"}
{"title": "加密货币2018大事记 | 你来偷，他来抢，币圈是否真的无宁日？", "url": "https://www.freebuf.com/special/175052.html", "time": "2018-06-21", "level": "红色标题", "num_look": 985014, "num_comment": 985014, "author": "AngelaY", "tags": ["特别企划"], "text": "如果有矿机，他们就去挖；如果没有，他们就通过各种手段去窃取；如果偷不到，他们还能通过传播恶意软件，入侵他人设备，利用别人设备的算力来为自己挖矿谋利。"}
{"title": "BUF早餐铺 | 部分Windows 7旧设备已无法获取更新和安全补丁；OpenBSD出于安全考虑禁用Intel CPU超线程；以太坊线重大漏洞，或将导致Token供应量增发", "url": "https://www.freebuf.com/news/175241.html", "time": "2018-06-21", "level": "", "num_look": 104180, "num_comment": 104180, "author": "shidongqi", "tags": ["资讯"], "text": "微软已经开始淘汰一些旧设备，无法进行安全更新，眼看着win7服役时间就要满了，不知道win10能否承载Windows的未来。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列-Thomas DeVoss", "url": "https://www.freebuf.com/video/175166.html", "time": "2018-06-20", "level": "红色标题", "num_look": 198172, "num_comment": 3, "author": "willhuang", "tags": ["视频"], "text": "Thomas DeVoss，昵称dawgyg，现为Development Operations Security（DoS）专职渗透测试安全工程师！"}
{"title": "挖洞经验 | 看我如何发现Chrome浏览器阅读辅助插件SOP绕过漏洞", "url": "https://www.freebuf.com/articles/web/174400.html", "time": "2018-06-20", "level": "", "num_look": 199363, "num_comment": 199363, "author": "clouds", "tags": ["WEB安全"], "text": "本文讲述的是作者发现谷歌浏览器Chrome阅读辅助插件（Read&Write Chrome extension）1.8.0.139版本同源策略（SOP）绕过漏洞的过程。"}
{"title": "在Linux中使用环境变量进行提权", "url": "https://www.freebuf.com/articles/system/173903.html", "time": "2018-06-20", "level": "", "num_look": 381775, "num_comment": 6, "author": "secist", "tags": ["系统安全"], "text": "在这篇文章中，我将会为大家介绍一些使用环境变量进行Linux提权的方法，包括在CTF challenges中使用到一些的技术。话不多说，让我们进入正题！"}
{"title": "InvisiMole：潜伏已久的间谍", "url": "https://www.freebuf.com/articles/system/174701.html", "time": "2018-06-20", "level": "金币+5", "num_look": 162647, "num_comment": 162647, "author": "JustPlay", "tags": ["系统安全"], "text": "今天为大家介绍InvisiMole的两款恶意组件的操作方式。 他们会将受影响的计算机变成摄像机，让攻击者可以得知受害者的办公室发生的事情或者获取设备的位置。"}
{"title": "2亿苹果用户的魔咒，博彩短信背后的黑产王国", "url": "https://www.freebuf.com/articles/network/175062.html", "time": "2018-06-20", "level": "现金奖励", "num_look": 654952, "num_comment": 23, "author": "GEETEST极验", "tags": ["网络安全"], "text": "“澳门威尼斯赌场、在家斗地主月赚100万不是梦、日本女优成人直播网、准到没庄家......”这些内容，大家一定都不会陌生，比如，部门小姐姐们就表示深受其扰......"}
{"title": "威胁预警 | KillDisk最新变种袭击银行系统", "url": "https://www.freebuf.com/articles/terminal/174871.html", "time": "2018-06-20", "level": "", "num_look": 158343, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["终端安全"], "text": "国外某安全厂商捕获到了一例KillDisk最新的变种样本，此样本已经感染了国外某家银行系统，数千台电脑及服务器系统被破坏，导致银行的SWIFT转帐系统无法正常使用。"}
{"title": "剪贴板幽灵瞄准虚拟货币，出师不利1个月亏损4000万？", "url": "https://www.freebuf.com/articles/web/174828.html", "time": "2018-06-20", "level": "", "num_look": 157769, "num_comment": 1, "author": "360安全", "tags": ["WEB安全"], "text": "360安全中心近期监控到一类虚拟货币类木马非常活跃，该木马不断监控用户的剪贴板内容，判断是否为比特币、以太坊等虚拟货币地址，然后在用户交易的时候将目标地址修改成自己的地址。"}
{"title": "BUF早餐铺 | 黑客试图利用Fortnite虚假安卓应用诱骗用户；广东摧毁全国首例“呼死你”黑灰产业团伙；前CIA雇员被指控向维基解密泄露黑客攻击工具", "url": "https://www.freebuf.com/news/175123.html", "time": "2018-06-20", "level": "", "num_look": 211037, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": "Fortnite风靡全球，而安卓客户端迟迟没有发布，也让众多黑客瞄准了这个点企图用虚假APP诱骗用户，如之前《绝地求生》官方手游上线之前……"}
{"title": "WPScan使用完整攻略：如何对Wordpress站点进行安全测试", "url": "https://www.freebuf.com/sectool/174663.html", "time": "2018-06-19", "level": "", "num_look": 875252, "num_comment": 10, "author": "Alpha_h4ck", "tags": ["工具"], "text": "WPScan是Kali Linux默认自带的一款漏洞扫描工具，它采用PHP编写，能够扫描WordPress网站中的多种安全漏洞，其中包括主题漏洞、插件漏洞和WordPress本身的漏洞。"}
{"title": "奇淫巧技之“换个姿势”看直播", "url": "https://www.freebuf.com/articles/network/174411.html", "time": "2018-06-19", "level": "现金奖励", "num_look": 822367, "num_comment": 20, "author": "scu-igroup", "tags": ["网络安全"], "text": "近几年网络直播很火，各种漂亮的网红小姐姐层出不穷，看网络直播也成为年轻人的生活常态。而我们屋年轻的师弟们根本没有抵抗力，平时穿插于各类网络直播平台，献上了他们宝贵的茶余饭后的时间。"}
{"title": "挖洞经验 | 看我如何发现价值$3000美金的Facebook视频缩略图信息泄露漏洞", "url": "https://www.freebuf.com/articles/web/174181.html", "time": "2018-06-19", "level": "", "num_look": 221860, "num_comment": 4, "author": "clouds", "tags": ["WEB安全"], "text": "在我决定对Facebook网站进行安全测试之后，我熟读了很多相关的漏洞发现writeup，发现Facebook对有效漏洞的赏金程度还算可观。"}
{"title": "小米安全诚邀优秀的你加入", "url": "https://www.freebuf.com/jobs/174914.html", "time": "2018-06-19", "level": "", "num_look": 242915, "num_comment": 9, "author": "小米安全中心", "tags": ["安全招聘"], "text": "小米安全团队成立于2013年11月，在这里你可以接触学习到各种黑客技术，在这里你可以第一手测试好玩的智能硬件，在这里你可以和众多大牛在安全技术前沿一起探索。"}
{"title": "工业控制系统（ICS）安全专家必备的测试工具和安全资源", "url": "https://www.freebuf.com/sectool/174567.html", "time": "2018-06-19", "level": "", "num_look": 778338, "num_comment": 5, "author": "物联网安全实验室", "tags": ["工具", "工控安全"], "text": "工业控制系统(ICS)通常被安全行业用来测试网络和应用中的漏洞。在这里，您可以找到综合工业控制系统(ICS)工具列表，其中包括在所有企业环境中执行渗透测试操作。"}
{"title": "技术讨论 | NjRAT通过base64编码加密混淆Code免杀绕过360杀毒实验", "url": "https://www.freebuf.com/articles/system/174776.html", "time": "2018-06-19", "level": "现金奖励", "num_look": 568387, "num_comment": 23, "author": "艾登——皮尔斯", "tags": ["系统安全"], "text": "这篇文章鄙人我主要是教大家如何加密免杀国外NjRAT生成的客户端，以达到逃避360杀软检测目的，希望各位Freebuf小粉喜欢。"}
{"title": "WAF开发之自学习模式开发实战", "url": "https://www.freebuf.com/articles/web/174462.html", "time": "2018-06-19", "level": "金币+5", "num_look": 221378, "num_comment": 7, "author": "chenjc", "tags": ["WEB安全"], "text": "因为现在市面上关于自学习功能的公开资料比较少，加之没有碰过相应的设备，只能自己瞎想来构思功能实现，码完功能后发现效果还不错，特此分享。"}
{"title": "APP漏洞赏金项目之安卓APP应用程序测试（一）", "url": "https://www.freebuf.com/articles/terminal/174483.html", "time": "2018-06-18", "level": "", "num_look": 243752, "num_comment": 1, "author": "clouds", "tags": ["终端安全"], "text": "两个月以前，我在ITsec公司开始了我大学最后一年的实习生涯。ITsec是一家全方位的信息安全评估公司，我的实习工作就是开发一个以供公司内部使用的安卓APP。"}
{"title": "继美国、荷兰之后，欧洲议会决定禁用卡巴斯基产品", "url": "https://www.freebuf.com/news/175000.html", "time": "2018-06-18", "level": "红色标题", "num_look": 192508, "num_comment": 192508, "author": "米雪儿", "tags": ["资讯"], "text": "近日，欧洲议会以476票赞成和151票反对通过了网络防御动议，呼吁欧盟审查其机构使用的软件、IT和通信设备以及基础设施，以排除潜在的危险程序和设备，并禁用那些已被确认为恶意的程序和设备。"}
{"title": "SPN服务主体名称发现详解", "url": "https://www.freebuf.com/articles/system/174229.html", "time": "2018-06-18", "level": "", "num_look": 284881, "num_comment": 284881, "author": "secist", "tags": ["系统安全"], "text": "Kerberos是一种支持票证身份验证的安全协议。如果客户端计算机身份验证请求包含有效的用户凭据和服务主体名称 (SPN)，则 Kerberos 身份验证服务器将授予一个票证以响应该请求。"}
{"title": "一次与缓冲区溢出的亲密接触", "url": "https://www.freebuf.com/vuls/174702.html", "time": "2018-06-18", "level": "现金奖励", "num_look": 207238, "num_comment": 3, "author": "Mr极品混混", "tags": ["漏洞"], "text": "这是一个简单的缓冲区溢出的漏洞，今天没事，来分析一下看看他溢出的原因，最后通过平衡堆栈的方式，让目标程序执行shellcode使程序不crash。只是用来研究和学习。"}
{"title": "在Linux上通过可写文件获取root权限的多种方式", "url": "https://www.freebuf.com/articles/system/174482.html", "time": "2018-06-17", "level": "", "num_look": 317960, "num_comment": 4, "author": "secist", "tags": ["系统安全"], "text": "在Linux中，一切都可以看做文件，包括所有允许/禁止读写执行权限的目录和设备。当管理员为任何文件设置权限时，都应清楚并合理为每个Linux用户分配应有的读写执行权限。"}
{"title": "Zip Slip漏洞影响大量项目，多个生态系统受牵连", "url": "https://www.freebuf.com/news/174228.html", "time": "2018-06-17", "level": "", "num_look": 170322, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "近期，来自Synk的安全研究专家公布了一个高危漏洞的技术细节信息，而这个漏洞将影响多个负责处理压缩文档文件的开源代码库。"}
{"title": "威胁预警 | Scarab勒索病毒变种来袭", "url": "https://www.freebuf.com/vuls/174870.html", "time": "2018-06-17", "level": "", "num_look": 248069, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["漏洞", "终端安全"], "text": "最近接到应急响应客户被勒索病毒攻击，深信服EDR安全团队捕获到相应的恶意样本，经分析确认此样本为Scarab勒索病毒变种样本。"}
{"title": "神器分享：物联网安全测试工具包", "url": "https://www.freebuf.com/sectool/174234.html", "time": "2018-06-17", "level": "金币+10", "num_look": 448810, "num_comment": 4, "author": "ning1022", "tags": ["工具"], "text": "今天，我将在BSides San Francisco做一个题为“物联网安全测试工具包”的演讲。我会准备一个幻灯片并且发布一篇博客去参加这个演讲，如果有我演讲的视频链接，我也将会把这个视频链接放到这个博客里。"}
{"title": "通过MySQL-Proxy实现MySQL数据库的认证、授权与审计", "url": "https://www.freebuf.com/articles/database/174712.html", "time": "2018-06-17", "level": "金币+10", "num_look": 287888, "num_comment": 1, "author": "SixSixSix", "tags": ["数据安全"], "text": "年初的时候从猪厂圆满毕业，入职了一家小公司组建“一个人的信息安全部”。"}
{"title": "影子IT（shadow IT）：彼之砒霜，我之蜜糖", "url": "https://www.freebuf.com/articles/security-management/174781.html", "time": "2018-06-16", "level": "", "num_look": 295866, "num_comment": 1, "author": "米雪儿", "tags": ["安全管理"], "text": "“影子IT”应该是具有负面含义的事物，它不免让人联想到黑暗、秘密、偷偷摸摸等字，但事实上，它真的如此糟糕吗？在本文中，我们将探讨影子IT的一些优缺点，尤其是与基于云的内联网相关的优缺点。"}
{"title": "针对使用Github作为C&C服务的JavaScript后门分析", "url": "https://www.freebuf.com/articles/system/173901.html", "time": "2018-06-16", "level": "", "num_look": 189858, "num_comment": 1, "author": "secist", "tags": ["系统安全"], "text": "在做恶意软的件检测时我们发现了一个LNK文件。该文件利用Github作为其C&C服务器，并使用了一个新的基于JavaScript的Bot，来在系统上执行恶意活动。"}
{"title": "【FB TV】一周「BUF大事件」：弹幕网站Acfun遭遇黑客攻击；航路纵横被爆泄露用户隐私信息；英特尔披露漏洞新变体", "url": "https://www.freebuf.com/video/175030.html", "time": "2018-06-16", "level": "红色标题", "num_look": 213921, "num_comment": 1, "author": "willhuang", "tags": ["视频"], "text": "本周弹幕社区网站Acfun遭遇黑客攻击，剧情峰回路转；航路纵横被爆泄露用户隐私信息，官方紧急调整；英特尔披露了Spectre漏洞的新变体。"}
{"title": "护卫神主机大师提权漏洞利用分析", "url": "https://www.freebuf.com/articles/web/173947.html", "time": "2018-06-16", "level": "现金奖励", "num_look": 306946, "num_comment": 13, "author": "freedom", "tags": ["WEB安全"], "text": "护卫神·主机大师支持一键安装网站运行环境（IIS+ASP+ASP.net+PHP5.2-5.6+MySQL+FTP+伪静态+PhpMyAdmin），并可在线开设主机、SQL Server和MySQL；Web方式管理，拥有独立前台和后台面板。"}
{"title": "隐藏在ARM处理器深处的神秘力量", "url": "https://www.freebuf.com/articles/system/174801.html", "time": "2018-06-16", "level": "", "num_look": 266675, "num_comment": 266675, "author": "阿里安全技术", "tags": ["极客", "系统安全"], "text": "ARM处理器的某些特殊硬件特性能够打破内核保护，使得普通程序在用户态能够直接访问内核空间，直接打破内核空间与用户空间的隔离，修改内核代码，开启上帝模式。"}
{"title": "2018年俄罗斯世界杯：俄罗斯网络间谍可能会破坏游客的移动设备", "url": "https://www.freebuf.com/news/174993.html", "time": "2018-06-15", "level": "", "num_look": 191281, "num_comment": 2, "author": "米雪儿", "tags": ["资讯"], "text": "如今，为期一个月的盛大足球赛事正在如火如荼的进行中。但是，要知道，这一切的发生实属来之不易。"}
{"title": "奇技淫巧 | 上传web.config文件获取远程代码执行权限", "url": "https://www.freebuf.com/articles/web/173831.html", "time": "2018-06-15", "level": "", "num_look": 344597, "num_comment": 5, "author": "clouds", "tags": ["WEB安全"], "text": ""}
{"title": "【活动已结束】FreeBuf传你「Web安全之深度学习实战」宝典", "url": "https://www.freebuf.com/fevents/174975.html", "time": "2018-06-15", "level": "红色标题", "num_look": 223010, "num_comment": 21, "author": "FB客服", "tags": ["活动"], "text": "江湖上失传已久的Web安全宝典了解一下~"}
{"title": "新兴的5G技术将基于SIM卡的IoT设备置于更大的威胁之中", "url": "https://www.freebuf.com/articles/wireless/174413.html", "time": "2018-06-15", "level": "", "num_look": 243379, "num_comment": 243379, "author": "米雪儿", "tags": ["无线安全"], "text": "眨眼下载一部高清电影，是大家对5G网络最普遍的认知，但这只是5G时代的冰山一角。"}
{"title": "东方财富安全管理部招安全人才", "url": "https://www.freebuf.com/jobs/174583.html", "time": "2018-06-15", "level": "", "num_look": 148236, "num_comment": 3, "author": "东方财富安全应急响应中心", "tags": ["安全招聘"], "text": "东方财富网创办于2004年,始终坚持“用户为王”的经营理念，为全国广大投资者提供专业、及时、全面的金融信息服务。"}
{"title": "苹果一招封杀多数iPhone解锁神器，美国警方无奈", "url": "https://www.freebuf.com/news/174920.html", "time": "2018-06-15", "level": "", "num_look": 465126, "num_comment": 7, "author": "shidongqi", "tags": ["资讯"], "text": "自从美国FBI和苹果公司就“解锁iPhone”的问题发生分歧之后，双方便开始了暗自较劲。美国警方寻找技术公司作为外援，已经掌握了多个破解iPhone的工具，而苹果现在只需一招就可以废掉所有的破解工具……"}
{"title": "一个登陆框引起的血案", "url": "https://www.freebuf.com/articles/web/174408.html", "time": "2018-06-15", "level": "现金奖励", "num_look": 1119345, "num_comment": 23, "author": "丶楼兰", "tags": ["WEB安全"], "text": "客户给的测试范围，或者挖众测时，很多时候都只有一个简单的登陆框，想起当初的苦逼的我，只能去测测爆破弱口令，而且还是指定用户名爆破密码这种，当真是苦不堪言。"}
{"title": "“隐蜂”来袭：金山毒霸截获全球首例Bootkit级挖矿僵尸网络  (下篇)", "url": "https://www.freebuf.com/articles/system/174575.html", "time": "2018-06-15", "level": "", "num_look": 396595, "num_comment": 7, "author": "安全豹", "tags": ["安全报告", "系统安全"], "text": "在上篇的分析中，我们分析了“隐蜂”挖矿木马的“Boot劫持”和“内核Rootkit”前两个关键部分，本篇中主要针对Ring3层的挖矿模块工作机制展开剖析。"}
{"title": "SOC日志收集实践：企业邮件服务日志收集", "url": "https://www.freebuf.com/articles/es/174281.html", "time": "2018-06-15", "level": "现金奖励", "num_look": 354236, "num_comment": 3, "author": "xsecurity", "tags": ["企业安全"], "text": "这次我们举个接近实际生产的例子，来说明开源SOC系统如何采集数据，如果之前介绍系统是抽象的，现在就是实例具象的。"}
{"title": "BUF早餐铺 | 英特尔公布Spectre漏洞新变体Lazy State；苹果将修复iPhone漏洞引起美警方不满；黑客宣布无条件删除A站泄露数据库", "url": "https://www.freebuf.com/news/174878.html", "time": "2018-06-15", "level": "", "num_look": 161224, "num_comment": 161224, "author": "Akane", "tags": ["资讯"], "text": "白日放歌须纵酒，青春作伴好还乡。又逢周五放风日，漫卷诗书喜欲狂。"}
{"title": "10款你应该了解的开源安全工具", "url": "https://www.freebuf.com/sectool/174573.html", "time": "2018-06-14", "level": "", "num_look": 486920, "num_comment": 8, "author": "secist", "tags": ["工具"], "text": "无论是学习，试验，还是在生产基础上进行部署，安全专业人员长期以来都将开源软件视为其工具包的重要组成部分。"}
{"title": "使用SCCM和Viewfinity进行提权实验", "url": "https://www.freebuf.com/articles/system/174405.html", "time": "2018-06-14", "level": "", "num_look": 237144, "num_comment": 237144, "author": "secist", "tags": ["系统安全"], "text": "如今越来越多的公司开始限制用户以本地管理员的身份来运行软件，随之带来的问题是，如何允许用户执行某些管理行为，例如安装已批准的软件。"}
{"title": "关于CVE-2018-8120的最新Windows提权漏洞分析", "url": "https://www.freebuf.com/vuls/174183.html", "time": "2018-06-14", "level": "现金奖励", "num_look": 1023226, "num_comment": 5, "author": "alphalab", "tags": ["漏洞"], "text": "天融信阿尔法实验室将以Windows Server 2003 32位系统为目标，详细介绍该漏洞成因、如何触发漏洞、以及如何使用该漏洞制作“本地应用程序权限提升”工具。"}
{"title": "2018世界杯即将开幕 | 你有一份安全观球指南待领取", "url": "https://www.freebuf.com/articles/neopoints/174559.html", "time": "2018-06-14", "level": "红色标题", "num_look": 696951, "num_comment": 3, "author": "AngelaY", "tags": ["特别企划", "观点"], "text": "每一场比赛除了是球迷狂欢的大 party，也为恶意攻击者搜集信息、实施诈骗或者发动其他攻击提供了好机会。"}
{"title": "Memcached DRDoS攻击趋势分析", "url": "https://www.freebuf.com/articles/network/174180.html", "time": "2018-06-14", "level": "", "num_look": 194340, "num_comment": 4, "author": "百度安全实验室", "tags": ["网络安全"], "text": "基于Memcached服务的反射攻击，由于其 5万倍的反射比例，从一开始出现就成为DDoS攻击界的“新宠”。 2018年2月28日 , GitHub遭受了1.35T 的Memcached DRDoS攻击。"}
{"title": "最新海莲花组织攻击事件分析", "url": "https://www.freebuf.com/articles/paper/174328.html", "time": "2018-06-14", "level": "", "num_look": 463033, "num_comment": 5, "author": "金睛", "tags": ["安全报告"], "text": "海莲花是一个具有越南背景的黑客组织。该组织最早被发现于 2012 年 4月，主要使用鱼叉和水坑攻击方式，配合社工手段，利用特种木马进行符合越南国家利益的针对性窃密活动。"}
{"title": "BUF早餐铺 | 微软6月修复50个漏洞；谷歌将移除远程网站安装Chrome插件的功能；Mac的代码签名机制出漏洞；AcFun泄露数千万条用户数据", "url": "https://www.freebuf.com/news/174788.html", "time": "2018-06-14", "level": "", "num_look": 121385, "num_comment": 121385, "author": "AngelaY", "tags": ["资讯"], "text": "微软 6 月修复 50 个漏洞，其中 11 个为高危；Google 计划移除使用远程网站安装 Chrome 插件的功能；Mac 的代码签名机制出漏洞，可被利用导致风险。"}
{"title": "CNCERT 2018年5月我国DDoS攻击资源分析报告", "url": "https://www.freebuf.com/articles/paper/174610.html", "time": "2018-06-13", "level": "", "num_look": 231911, "num_comment": 231911, "author": "CNCERT", "tags": ["安全报告"], "text": "本报告为 2018 年 5 月份的 DDoS 攻击资源月度分析报告。围绕互联网环境威胁治理问题，基于 CNCERT 监测的 DDoS攻击事件数据进行抽样分析。"}
{"title": "Hacking Team卷土重来？CVE-2018-5002 Flash 0day漏洞APT攻击分析与关联", "url": "https://www.freebuf.com/vuls/174246.html", "time": "2018-06-13", "level": "", "num_look": 276220, "num_comment": 11, "author": "奇安信威胁情报中心", "tags": ["漏洞", "系统安全"], "text": "360企业安全威胁情报中心近期捕获到了一例使用Flash 0day漏洞配合微软Office文档发起的APT攻击案例，攻击使用的样本首次使用了无Flash文件内置技术。"}
{"title": "CNCERT钓鱼邮件攻击防范指南", "url": "https://www.freebuf.com/articles/others-articles/174617.html", "time": "2018-06-13", "level": "", "num_look": 199107, "num_comment": 199107, "author": "CNCERT", "tags": ["其他"], "text": "钓鱼邮件是指黑客伪装成用户信任的人，通过发送电子邮件的方式，诱使用户回复邮件、点击嵌入邮件正文的恶意链接或者打开邮件附件以植入木马或间谍程序，进而实施网络攻击活动的邮件。"}
{"title": "思科设备存在硬编码密码，安全更新第四次删除后门账户", "url": "https://www.freebuf.com/news/174630.html", "time": "2018-06-13", "level": "", "num_look": 184004, "num_comment": 4, "author": "Covfefe", "tags": ["资讯"], "text": "近几个月，思科已经第四次删除了存在于其产品中的硬编码密码，攻击者可以使用这些证书来获取设备的访问权限，并存在于用户网络中。"}
{"title": "更新 | AcFun泄露数千万条用户信息，GitHub已公布数据和密码", "url": "https://www.freebuf.com/news/174703.html", "time": "2018-06-13", "level": "红色标题", "num_look": 1251991, "num_comment": 44, "author": "AngelaY", "tags": ["资讯"], "text": "北京时间 6 月 13  日凌晨，AcFun 发布公告称网站遭遇黑客攻击，近千万条用户数据外泄。"}
{"title": "云图信安（成都）科技有限公司招聘", "url": "https://www.freebuf.com/jobs/174587.html", "time": "2018-06-13", "level": "", "num_look": 131051, "num_comment": 5, "author": "云图信安人事", "tags": ["安全招聘"], "text": "云图信安（成都）科技有限公司是一家以互联网平台运营、WEB应用开发、软件开发、大数据分析、移动互联网通讯技术、云计算、营销推广、技术培训等技术为核心的科技公司。"}
{"title": "鹅厂帮忙卖片背后，到底发生了什么？", "url": "https://www.freebuf.com/articles/network/174614.html", "time": "2018-06-13", "level": "金币+10", "num_look": 455720, "num_comment": 7, "author": "GEETEST极验", "tags": ["网络安全"], "text": "6月8日12点29分，鹅厂旗下明星产品“QQ空间”发出一条“卖片”说说。就在说说发布第二天，微视超越抖音，首次登顶中国App Store免费榜。"}
{"title": "另辟蹊径：Kuzzle木马伪装万能驱动钓鱼", "url": "https://www.freebuf.com/articles/system/174299.html", "time": "2018-06-13", "level": "", "num_look": 191048, "num_comment": 2, "author": "360安全", "tags": ["系统安全"], "text": "近期，360核心安全团队监测到钓鱼网站大量传播主页劫持木马，诱导用户下载安装“万能驱动”软件后，偷偷在用户电脑上释放高隐蔽性的木马模块。"}
{"title": "经验分享 | 关于“入侵检测”的一些想法", "url": "https://www.freebuf.com/articles/network/174169.html", "time": "2018-06-13", "level": "现金奖励", "num_look": 296887, "num_comment": 16, "author": "PgHook", "tags": ["网络安全"], "text": "目前市面上的商业产品和开源产品实际上都是对“攻击行为的检测”，入侵行为日志往往淹没在攻击行为日志里面去了，实在是有些鸡肋。"}
{"title": "沾上社交圈的坑，航旅纵横也在数据隐私上跌了一跤", "url": "https://www.freebuf.com/special/174622.html", "time": "2018-06-13", "level": "红色标题", "num_look": 462706, "num_comment": 462706, "author": "shidongqi", "tags": ["特别企划"], "text": "我宁愿支付宝永远只是一个单纯的支付工具，航旅纵横永远只是一个单纯的航班管理工具，超级课程表永远只是一个单纯的能够查看大学课表、查看成绩的APP，但似乎总是事与愿违……"}
{"title": "BUF早餐铺 | 大量安卓设备调试端口暴露；以太坊再爆安全漏洞；一加 6 系统存在重大漏洞；北京检方发布《网络安全刑事司法保护白皮书》", "url": "https://www.freebuf.com/news/174600.html", "time": "2018-06-13", "level": "", "num_look": 133477, "num_comment": 133477, "author": "AngelaY", "tags": ["资讯"], "text": "五月榴花妖艳烘，绿杨带雨垂垂重。五色新丝缠角粽~"}
{"title": "一加6手机的Bootloader漏洞可让攻击者控制设备", "url": "https://www.freebuf.com/news/174584.html", "time": "2018-06-12", "level": "红色标题", "num_look": 265424, "num_comment": 5, "author": "secist", "tags": ["系统安全", "资讯"], "text": "你近期是否购买了一加6手机，或正计划购买一部呢？看完这篇报告性的文章，你可能会望而却步。最近安全研究人员披露在OnePlus 6 bootloader中，存在严重的安全漏洞。"}
{"title": "Web应用安全测试前期情报收集方法与工具的介绍", "url": "https://www.freebuf.com/sectool/174417.html", "time": "2018-06-12", "level": "", "num_look": 316286, "num_comment": 4, "author": "secist", "tags": ["工具"], "text": "这是一篇关于我在Web应用安全测试前期，进行情报收集的方法与使用工具的详细介绍文章。"}
{"title": "CNCERT 2018年第一季度我国联网智能设备安全情况报告", "url": "https://www.freebuf.com/articles/paper/174618.html", "time": "2018-06-12", "level": "", "num_look": 184341, "num_comment": 184341, "author": "CNCERT", "tags": ["安全报告"], "text": "2018 年第一季度，CNCERT 继续对联网智能设备安全情况开展跟踪监测和数据分析。"}
{"title": "以太坊去中心化应用dApp的渗透测试姿势浅析", "url": "https://www.freebuf.com/articles/blockchain-articles/174050.html", "time": "2018-06-12", "level": "", "num_look": 253206, "num_comment": 1, "author": "clouds", "tags": ["区块链安全"], "text": "以太坊去中心化APP（dApp）是基于一致性协议（consensus protocol）的应用，dApp最常用的应用情景就是一个常规的Web应用与一个或多个智能合约进行交互。"}
{"title": "高清无码｜一条色情资源链竟由某博、某宝、某云盘无缝衔接", "url": "https://www.freebuf.com/special/174473.html", "time": "2018-06-12", "level": "金币+10", "num_look": 1651252, "num_comment": 32, "author": "刘开水", "tags": ["特别企划"], "text": "昨日笔者无意间发现了一个地址，不弱于草榴，qiang都甭翻。不过为了不引发各大厂的公关战，于是把过程中名字文明打码，过程如下……"}
{"title": "蓝盾公司安全人才招聘进行中", "url": "https://www.freebuf.com/jobs/174481.html", "time": "2018-06-12", "level": "", "num_look": 181534, "num_comment": 16, "author": "Bluedon", "tags": ["安全招聘"], "text": "蓝盾股份是中国信息安全行业的领军企业，公司成立于1999年，公司构建了以安全产品为基础，覆盖安全方案、安全服务、安全运营的完整业务生态，为各大行业客户提供一站式的信息安全整体解决方案。"}
{"title": "CVE-2018-8174：从UAF到任意地址读写", "url": "https://www.freebuf.com/vuls/172983.html", "time": "2018-06-12", "level": "现金奖励", "num_look": 343319, "num_comment": 1, "author": "elli0tn0phacker", "tags": ["漏洞"], "text": "2018年5月9日，360发表Blog “Analysis of CVE-2018-8174 VBScript 0day and APT actor related toOffice targeted attack” 揭露了利用“双杀”0day发起的APT攻击，其中使用的漏洞就是IE vbscript 0day。"}
{"title": "借你一双慧眼，鸟瞰二进制世界的秘密", "url": "https://www.freebuf.com/sectool/174136.html", "time": "2018-06-12", "level": "现金奖励", "num_look": 318168, "num_comment": 7, "author": "androiddongjian", "tags": ["工具", "终端安全"], "text": "本文介绍了一款用以提升逆向效率的，可在真机上查看二进制代码运行逻辑信息的小工具。"}
{"title": "共享软件中恶意代码插入技术研究", "url": "https://www.freebuf.com/sectool/174238.html", "time": "2018-06-12", "level": "", "num_look": 234321, "num_comment": 6, "author": "alphalab", "tags": ["工具", "系统安全"], "text": "过去的Windows系统，漏洞百出，防不胜防，因此第三方杀毒软件几乎是装机必备。随着windows系统的不断更新，其安全防护措施也不断加强。"}
{"title": "BUF早餐铺 | FBI提出对Marcus Hutchins的新指控；思科四个月第四次删除后门账号；韩国一交易所遭黑客攻击：比特币创近三个月最大跌幅；F-Secure修复杀毒软件中的严重漏洞", "url": "https://www.freebuf.com/news/174494.html", "time": "2018-06-12", "level": "", "num_look": 111188, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "FBI提出对Marcus Hutchins的新指控；思科四个月第四次删除后门账号；F-Secure修复杀毒软件中的严重漏洞；湖北90后黑客攻击某购物平台 “一元购”买走800万金饰。"}
{"title": "腾讯安全云鼎实验室：2018上半年互联网 DDoS 攻击趋势分析", "url": "https://www.freebuf.com/articles/paper/174478.html", "time": "2018-06-11", "level": "", "num_look": 376718, "num_comment": 3, "author": "云鼎实验室", "tags": ["安全报告"], "text": "DDoS 这一互联网公敌，在各种防御设备围追堵截的情况下，攻击者夜以继日地钻研对抗方法、研究新的攻击方式；而且往平台化、自动化的方向发展，不断增强攻击能力。"}
{"title": "EKFiddle：基于Fiddler研究恶意流量的框架", "url": "https://www.freebuf.com/sectool/173367.html", "time": "2018-06-11", "level": "", "num_look": 186025, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "EKFiddle是一个基于Fiddler web debugger的，用于研究漏洞利用套件、恶意软件和恶意流量的框架。"}
{"title": "VPNFilter受感染设备型号增加，华硕、华为、中兴皆在列", "url": "https://www.freebuf.com/news/174190.html", "time": "2018-06-11", "level": "", "num_look": 169663, "num_comment": 1, "author": "Covfefe", "tags": ["资讯"], "text": "在过去几个月，感染了遍布54个国家的超过500,000台路由器和NAS设备的VPNFilter恶意软件所造成的影响要比想象中的严重得多。"}
{"title": "DIY一个自己喜欢的瓦力吧！", "url": "https://www.freebuf.com/articles/others-articles/173827.html", "time": "2018-06-11", "level": "现金奖励", "num_look": 421637, "num_comment": 26, "author": "_橙子 ゝ", "tags": ["其他", "极客"], "text": "随着科学技术的快速发展，AI技术已经越来越接近人们的日常生活，人们对智能车的研究有增无减，智能小车已然成为以后科学技术发展的新思路和新方向。"}
{"title": "联想安全实验室诚招安全人才", "url": "https://www.freebuf.com/jobs/174168.html", "time": "2018-06-11", "level": "", "num_look": 171202, "num_comment": 7, "author": "LenovoSecLab", "tags": ["安全招聘"], "text": "联想安全实验室，以控制产品安全质量为核心，研究主流安全技术，构筑产品安全生态。"}
{"title": "NetHunter和花生壳实现SSH远程访问内网安卓手机", "url": "https://www.freebuf.com/geek/173915.html", "time": "2018-06-11", "level": "现金奖励", "num_look": 354888, "num_comment": 19, "author": "2benben", "tags": ["极客"], "text": "怎样通过SSH连上让没有公网地址的家庭设备，实现远程访问呢？"}
{"title": "2018年中国网络安全年会演讲嘉宾持续招募中", "url": "https://www.freebuf.com/fevents/174441.html", "time": "2018-06-11", "level": "", "num_look": 129781, "num_comment": 1, "author": "CNCERT", "tags": ["活动"], "text": "2018年中国网络安全年会将于8月14日至16日在北京国家会议中心举办，国家计算机网络应急技术协调处理中心已成功举办14届中国网络安全年会。会议旨在交流国内外网络安全工作新趋势、新问题、新思路。"}
{"title": "Telegram困境反思：绝对隐私，相对自由", "url": "https://www.freebuf.com/articles/neopoints/173840.html", "time": "2018-06-11", "level": "", "num_look": 769013, "num_comment": 6, "author": "AngelaY", "tags": ["特别企划", "观点"], "text": "被誉为“全球最安全”的加密聊天工具 Telegram，面临的形势越来越严峻。"}
{"title": "BUF早餐铺 | 微信开始整治“对骂群”、“互喷群”，严重者封号封群；VPNFilter 恶意程序能降级 HTTPS；今年有11亿美元加密货币被盗", "url": "https://www.freebuf.com/news/174276.html", "time": "2018-06-11", "level": "", "num_look": 138251, "num_comment": 138251, "author": "shidongqi", "tags": ["资讯"], "text": "一朝被蛇咬，十年怕井绳。自从Facebook数据泄露事件之后，一举一动都备受关注……"}
{"title": "14亿邮箱泄露密码明文信息查询网站惊现网络", "url": "https://www.freebuf.com/news/174410.html", "time": "2018-06-10", "level": "红色标题", "num_look": 2519232, "num_comment": 30, "author": "clouds", "tags": ["数据安全", "资讯"], "text": "近期，网络上出现了一个14亿邮箱密码泄露信息查询网站，访问网站后，可以按照用户名或邮箱地址来查询特定邮箱是否存在密码泄露，查询结果全为明文状态的泄露密码信息。"}
{"title": "挖洞经验 | 记我的一次账号劫持和BLIND XSS漏洞发现过程", "url": "https://www.freebuf.com/articles/web/173940.html", "time": "2018-06-10", "level": "", "num_look": 219788, "num_comment": 1, "author": "clouds", "tags": ["WEB安全"], "text": "本文我要分享的是我参与Hackerone某邀请项目，通过目标测试网站的高级功能模块（PRO features）实现了更多攻击面测试，并发现了两个严重漏洞。"}
{"title": "Windows系统的JScript组件被曝存在一个0day RCE", "url": "https://www.freebuf.com/articles/system/174187.html", "time": "2018-06-10", "level": "", "num_look": 221975, "num_comment": 221975, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "Telspace Systems公司的安全研究专家Dmitri Kaslov在Windows操作系统的JScript组件中发现了一个严重的安全漏洞，而这个漏洞将允许攻击者在目标主机上执行恶意代码。"}
{"title": "黑客利用病毒挖门罗币，已获利60余万", "url": "https://www.freebuf.com/vuls/174023.html", "time": "2018-06-10", "level": "", "num_look": 247235, "num_comment": 1, "author": "火绒安全", "tags": ["漏洞", "网络安全"], "text": "近日，火绒安全团队截获一批蠕虫病毒。这些病毒通过U盘、移动硬盘等移动介质及网络驱动器传播，入侵电脑后，会远程下载各类病毒模块。"}
{"title": "GyoiThon：基于机器学习的渗透测试工具", "url": "https://www.freebuf.com/sectool/173476.html", "time": "2018-06-09", "level": "", "num_look": 1079077, "num_comment": 6, "author": "secist", "tags": ["工具"], "text": "GyoiThon根据学习数据识别安装在Web服务器上的软件。之后，GyoiThon为已识别的软件执行有效的攻击。最终，GyoiThon会自动生成扫描结果报告。上述处理均由GyoiThon自动执行。"}
{"title": "使用带外数据（OOB）从电子表格获取数据", "url": "https://www.freebuf.com/articles/database/173991.html", "time": "2018-06-09", "level": "", "num_look": 187034, "num_comment": 187034, "author": "secist", "tags": ["数据安全"], "text": "我们对使用带外数据（OOB）从电子表格窃取数据的方法颇感兴趣。在本文中我们假设，我们对电子表格有一定的控制权限（虽然有限），而对整个文档或客户端（目标）系统几乎没有任何的访问权限。"}
{"title": "腾讯御见捕获Flash 0day漏洞（CVE-2018-5002）野外攻击", "url": "https://www.freebuf.com/vuls/174185.html", "time": "2018-06-09", "level": "", "num_look": 352130, "num_comment": 5, "author": "腾讯电脑管家", "tags": ["漏洞", "系统安全"], "text": "腾讯御见威胁情报中心近日监控到一例使用Adobe Flash 0day漏洞（CVE-2018-5002）的APT攻击，攻击者疑通过即时聊天工具和邮箱等把恶意Excel文档发送给目标人员，诱骗目标人员打开文档。"}
{"title": "【FB TV】一周「BUF大事件」：以“码”会友、以“技术”争锋，AsiaSecWest香港举办；Facebook被爆与厂商共享用户数据", "url": "https://www.freebuf.com/video/174298.html", "time": "2018-06-09", "level": "红色标题", "num_look": 233595, "num_comment": 233595, "author": "willhuang", "tags": ["视频"], "text": "全球顶级信息安全峰会AsiaSecWest在中国香港举办，以“码”会友、以“技术”争锋；Facebook又出事了，被爆与厂商共享用户数据；苹果更新系统，推出隐私功能。"}
{"title": "CVE-2018-8174 “双杀”0day漏洞复现", "url": "https://www.freebuf.com/vuls/173727.html", "time": "2018-06-09", "level": "金币+5", "num_look": 813379, "num_comment": 34, "author": "lr3800_", "tags": ["漏洞"], "text": "最近360核心安全事业部高级威胁应对团队在全球范围内率先监控到了一例使用0day漏洞的APT攻击，捕获到了全球首例利用浏览器0day漏洞的新型Office文档攻击。"}
{"title": "我和黑客有个约会之梦圆香江", "url": "https://www.freebuf.com/fevents/174253.html", "time": "2018-06-09", "level": "", "num_look": 101968, "num_comment": 101968, "author": "shidongqi", "tags": ["活动"], "text": "那时年少懵懂，看了《我和僵尸有个约会》就觉得被僵尸咬了就能长生不老，看了《黑客帝国》就以为黑客都能慢动作躲子弹……"}
{"title": "360追日团队边亮：上可逐日追凶，下可乘风破浪", "url": "https://www.freebuf.com/articles/people/174027.html", "time": "2018-06-08", "level": "红色标题", "num_look": 331479, "num_comment": 6, "author": "AngelaY", "tags": ["人物志"], "text": "这个“追”、“日”并不是那个“追日”，但是这个“追日”和那个追日一样，道阻且长，但依然有勇往直前的坚持。"}
{"title": "Hijacker：一款具有图形化功能的Android无线渗透工具", "url": "https://www.freebuf.com/sectool/173274.html", "time": "2018-06-08", "level": "", "num_look": 421354, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款转为Android平台设计的图形化无线渗透测试工具，该工具名叫Hijacker。"}
{"title": "【课程文章已出】如何利用碎片时间挖到高危漏洞 | Web漏洞挖掘“奇淫技巧”总结", "url": "https://www.freebuf.com/open/173905.html", "time": "2018-06-08", "level": "红色标题", "num_look": 696517, "num_comment": 8, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "仅仅2周挖到SRC第一，这位少侠一定有过人之处"}
{"title": "足迹地图刷屏朋友圈，国人的隐私看起来如此廉价", "url": "https://www.freebuf.com/special/173986.html", "time": "2018-06-08", "level": "红色标题", "num_look": 781558, "num_comment": 13, "author": "Allen别bb", "tags": ["特别企划"], "text": "“如果你告诉我你的一个秘密，我就给你一颗糖”，面对这样的交易，你竟然欣然同意，或者你根本没意识到这是一场交易。西瓜足迹一夜之间刷便朋友圈，差不多也是类似的道理。"}
{"title": "技术讨论 | 构建一个小巧的来电显示迷惑工具", "url": "https://www.freebuf.com/sectool/173730.html", "time": "2018-06-08", "level": "", "num_look": 183997, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "经过两周左右的折腾，我学到了许多关于调制解调器的安全测试技术，以及电话和Asterisk的知识。"}
{"title": "Web模糊测试：WFuzz的坑和快速入门", "url": "https://www.freebuf.com/sectool/173746.html", "time": "2018-06-08", "level": "", "num_look": 340907, "num_comment": 4, "author": "一只耗子", "tags": ["工具"], "text": "最开始做fuzz我是自己写个脚本配合一些常用工具来测，后来看见这款工具因为是比较简单吧，学习成本比较低，而且主要返回结果效果不错，给大家推荐下。"}
{"title": "常见社工破解WPA2密码方法及防范措施", "url": "https://www.freebuf.com/articles/wireless/173776.html", "time": "2018-06-08", "level": "金币+8", "num_look": 490219, "num_comment": 9, "author": "thr0cyte", "tags": ["无线安全"], "text": "何为社工？社工是一种通过利用受害者心理弱点，如本能反应、好奇心、同情心、信任、贪婪等进行诸如欺骗、盗取、控制等非法手段的一种攻击方式。在无线安全中也可以利用社工做到许多非法操作。"}
{"title": "Pwn2Own华为HiApp漏洞原理与利用分析（下）", "url": "https://www.freebuf.com/vuls/173921.html", "time": "2018-06-08", "level": "现金奖励", "num_look": 299023, "num_comment": 3, "author": "Tasfa", "tags": ["漏洞", "终端安全"], "text": ""}
{"title": "BUF早餐铺 | 世界杯期间Wi-Fi热点可能带来安全风险；Chrome曝出新高危漏洞，需尽快更新修复；VPNFilter导致更多厂商中招；网售志愿填报卡大数据成卖点，相关部门否认有数据合作", "url": "https://www.freebuf.com/news/174200.html", "time": "2018-06-08", "level": "", "num_look": 129764, "num_comment": 3, "author": "AngelaY", "tags": ["资讯"], "text": "高考第二天，早餐丰盛点儿~"}
{"title": "2018年第二波Flash零日漏洞（CVE-2018-5002）在野攻击分析预警", "url": "https://www.freebuf.com/vuls/174206.html", "time": "2018-06-07", "level": "", "num_look": 229256, "num_comment": 7, "author": "360安全", "tags": ["WEB安全", "漏洞"], "text": "2018年6月1日，360核心安全高级威胁应对团队在全球范围内率先捕获了新的一起使用Flash 零日漏洞的在野攻击。"}
{"title": "福利 | HITB安全峰会（新加坡）门票免费送啦", "url": "https://www.freebuf.com/fevents/174131.html", "time": "2018-06-07", "level": "红色标题", "num_look": 231006, "num_comment": 1, "author": "FB客服", "tags": ["活动"], "text": "去新加坡参加国际安全大会如何？"}
{"title": "XSSer：自动化XSS漏洞检测及利用工具", "url": "https://www.freebuf.com/sectool/173228.html", "time": "2018-06-07", "level": "", "num_look": 1347557, "num_comment": 7, "author": "secist", "tags": ["工具"], "text": "跨站点“Scripter”（又名XSSer）是一个自动化框架，用于检测、利用以及报告基于Web应用程序中的XSS漏洞。"}
{"title": "CIO调查 | 2018年企业信息安全状况概观", "url": "https://www.freebuf.com/articles/paper/173783.html", "time": "2018-06-07", "level": "", "num_look": 237108, "num_comment": 237108, "author": "clouds", "tags": ["安全报告"], "text": "每年，首席信息官（CIO）官网都会发起名为“State of the CIO”的CIO现状调查，今年的调查报告已经出炉，这些调查数据将帮助你窥悉CIO角色在今天商业环境中的演变趋势。"}
{"title": "高考来了 | 要是能重来，你们还会选李白吗？", "url": "https://www.freebuf.com/fevents/174077.html", "time": "2018-06-07", "level": "红色标题", "num_look": 597145, "num_comment": 37, "author": "AngelaY", "tags": ["活动", "特别企划"], "text": "要是能重来，你会选李白还是选杜甫？欢迎评论留言说出你的故事。反正我选安全~"}
{"title": "技术讨论 | Windows 10进程镂空技术（木马免杀）", "url": "https://www.freebuf.com/articles/system/173532.html", "time": "2018-06-07", "level": "", "num_look": 346435, "num_comment": 16, "author": "河马安全网", "tags": ["系统安全"], "text": "在Win10 x64环境下替换正常的进程，是一个比较高超的技术。使用该技术，可以内存执行病毒、木马。在文件层面实现免杀。可以把一个木马使用DES加密，放在资源里。"}
{"title": "CVE-2018-8120在Windows 7 x64环境下的漏洞利用分析", "url": "https://www.freebuf.com/vuls/173798.html", "time": "2018-06-07", "level": "", "num_look": 349884, "num_comment": 6, "author": "奇安信威胁情报中心", "tags": ["漏洞"], "text": "有安全研究人员在GitHub上上传了针对Windows 7 64位环境下CVE-2018-8120的漏洞利用代码，经验证分析该漏洞利用代码真实可用。"}
{"title": "AsiaSecWest 2018首日纪实，黑客与极客界的最强大脑", "url": "https://www.freebuf.com/fevents/174019.html", "time": "2018-06-07", "level": "红色标题", "num_look": 376648, "num_comment": 17, "author": "Akane", "tags": ["活动"], "text": "中外信息安全界两大教父级人物，TK和CanSecWest创始人Dragos率领中外顶尖高手，进行一场国际级的黑客大比拼，简单的说，这就是一场黑客与极客界的最强大脑。"}
{"title": "代码审计之Fiyo CMS案例分享", "url": "https://www.freebuf.com/vuls/173581.html", "time": "2018-06-07", "level": "现金奖励", "num_look": 287261, "num_comment": 10, "author": "Mochazz", "tags": ["WEB安全", "漏洞"], "text": "Fiyo CMS是小型的商务电话服务及移动合作工具，由一名前职业学校学生首次开发和创建的，后者当时在RPL的SMK 10三宝垄学习。 那时他的名字不是Fiyo CMS，而是Sirion，它是Site Administration的首字母缩写。"}
{"title": "BUF早餐铺 | MyHeritage族谱网站9200万账号信息泄露；Sigrun勒索软件免费解密俄罗斯受害者文件；Zip Slip漏洞影响大量项目，范围横跨多个生态系统；两个月后超过11万个Drupal网站仍然可以被Drupalgeddon 2攻击", "url": "https://www.freebuf.com/news/173996.html", "time": "2018-06-07", "level": "", "num_look": 117049, "num_comment": 2, "author": "Sphinx", "tags": ["资讯"], "text": "MyHeritage族谱网站9200万账号信息泄露；Sigrun勒索软件免费解密俄罗斯受害者文件；Zip Slip漏洞影响大量项目，范围横跨多个生态系统。"}
{"title": "Facebook又出事：纽约时报称Facebook与厂商共享用户数据", "url": "https://www.freebuf.com/news/173941.html", "time": "2018-06-06", "level": "", "num_look": 156974, "num_comment": 156974, "author": "Covfefe", "tags": ["资讯"], "text": "在Cambridge Analytica丑闻后，Facebbook又迎来了新的问题。近日，其被指控与60多家设备制造商共享用户数据。"}
{"title": "PowerView：一个可以帮助你躲避检测的内网信息收集脚本", "url": "https://www.freebuf.com/sectool/173366.html", "time": "2018-06-06", "level": "", "num_look": 380276, "num_comment": 3, "author": "secist", "tags": ["工具"], "text": "为了避免被管理人员和监控系统发现，我们可以使用其它的方法。例如可以使用PowerShell和WMI，来进行态势感知躲避检测。"}
{"title": "快讯 | FaceBook承认与华为等中国公司共享数据，表示将终止合作", "url": "https://www.freebuf.com/news/174021.html", "time": "2018-06-06", "level": "", "num_look": 160052, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "外媒路透社发文报道称 FaceBook 承认与至少四家中国科技公司有数据共享协议，美国情报机构认为这会构成国家安全威胁，FaceBook 已经接受相关审查。"}
{"title": "技术分享 | 看我如何编写一个验证码识别程序", "url": "https://www.freebuf.com/articles/web/173752.html", "time": "2018-06-06", "level": "", "num_look": 427560, "num_comment": 3, "author": "secist", "tags": ["WEB安全"], "text": "在此之前我收到了一些读者对我的反馈，他们希望我能够在文中解释相关解析器的开发流程。为了满足大家的需求，我决定和你们分享一个我非常重要的项目的完整实施过程。"}
{"title": "自己动手打造Github代码泄露监控工具", "url": "https://www.freebuf.com/articles/web/173479.html", "time": "2018-06-06", "level": "金币+10", "num_look": 601607, "num_comment": 17, "author": "ztencmcp", "tags": ["WEB安全"], "text": "众说周知，Github这块肥肉很受安全人员和黑客关注。因为很多新进程序猿和老手不经意就会把他们的劳动成果分享出来，而往往这种开源精神，奉献精神会对企业带来一定的安全风险。"}
{"title": "中国进出口企业遭遇“商贸信”攻击，企业机密被窃取", "url": "https://www.freebuf.com/articles/es/173777.html", "time": "2018-06-06", "level": "", "num_look": 250075, "num_comment": 4, "author": "腾讯电脑管家", "tags": ["企业安全"], "text": "最新的拦截数据表明，此类定向投放到中国进出口企业的攻击邮件每天有上千封之多，病毒变种也层出不穷。腾讯安全专家建议中国进出口相关企业务必高度警惕，采用必要的防御措施防止企业机密信息泄露。"}
{"title": "【已结束】AsiaSecWest 2018图文直播，见证极客本色", "url": "https://www.freebuf.com/fevents/173769.html", "time": "2018-06-06", "level": "红色标题", "num_look": 120456, "num_comment": 3, "author": "shidongqi", "tags": ["活动"], "text": "AsiaSecWest是CanSecWest专为亚太地区开设的全新分会，将于2018年6月6日和7日在香港举办，一起来和全球最大牌的极客大咖们嗨起来！"}
{"title": "大五职业性格与安服项目管理", "url": "https://www.freebuf.com/articles/security-management/173740.html", "time": "2018-06-06", "level": "金币+10", "num_look": 223607, "num_comment": 3, "author": "雨水", "tags": ["安全管理"], "text": "大的安服项目，实施团队里会有咨询、渗透等领域的高手，也会被领导塞进一堆实习生。了解团队成员的性格特点，是项目实施重要的环节。"}
{"title": "旧手机的隐私顽疾：砸了浪费，卖了受罪", "url": "https://www.freebuf.com/articles/neopoints/173574.html", "time": "2018-06-06", "level": "红色标题", "num_look": 281657, "num_comment": 4, "author": "Allen别bb", "tags": ["观点"], "text": "即便是将手机所有数据删除，恢复出厂设置，花几十块钱就能够恢复所有数据，包括通讯录、相册等重要隐私信息。"}
{"title": "BUF早餐铺 | 苹果推出安全新功能；Facebook API被设备制造商利用获取用户数据；本田印度泄露超过五万名用户隐私；央行称金融业务更要高度重视网络和信息安全", "url": "https://www.freebuf.com/news/173964.html", "time": "2018-06-06", "level": "", "num_look": 172662, "num_comment": 172662, "author": "AngelaY", "tags": ["资讯"], "text": "芒种有三候：一候螳螂生；二候鹏始鸣；三候反舌无声"}
{"title": "详解Linux开源安全审计和渗透测试工具Lynis", "url": "https://www.freebuf.com/sectool/173491.html", "time": "2018-06-05", "level": "", "num_look": 360222, "num_comment": 6, "author": "secist", "tags": ["工具"], "text": "Lynis是一款Unix系统的安全审计以及加固工具，能够进行深层次的安全扫描，其目的是检测潜在的时间并对未来的系统加固提供建议。"}
{"title": "滴滴顺风车二次整改，隐私与安全的平衡点何在？", "url": "https://www.freebuf.com/articles/neopoints/173693.html", "time": "2018-06-05", "level": "红色标题", "num_look": 558102, "num_comment": 10, "author": "Allen别bb", "tags": ["特别企划", "观点"], "text": "在还没有Uber、滴滴的时候，出租车司机永远不知道下一个上车的是一个小姐姐还是一个老大爷。"}
{"title": "Kali下的蓝牙设备侦察方法介绍", "url": "https://www.freebuf.com/sectool/173589.html", "time": "2018-06-05", "level": "", "num_look": 344455, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "如今的手机和平板电脑几乎都已具备了蓝牙的功能。但在为我们带来极大方便的同时，蓝牙也成正成为一个泄露我们隐私数据的切入口！"}
{"title": "深信服终端安全产品线急招产品运营专家（EDR产品方向）", "url": "https://www.freebuf.com/jobs/162703.html", "time": "2018-06-05", "level": "", "num_look": 194422, "num_comment": 9, "author": "suifeng-刘军", "tags": ["安全招聘"], "text": "终端安全产品线作为深信服新成立的产品线之一，主要承载下一代终端安全产品的开发，同时构建深信服整体安全解决方案的端点响应闭环能力。"}
{"title": "快讯 | 苹果推出新操作系统的隐私功能，屏蔽部分网站cookie", "url": "https://www.freebuf.com/news/173923.html", "time": "2018-06-05", "level": "", "num_look": 109211, "num_comment": 109211, "author": "Sphinx", "tags": ["资讯"], "text": "苹果在WWDC 2018表示，iOS和macOS的新操作系统将包含新的隐私功能。"}
{"title": "beSTORM之网络协议Fuzz入门教程", "url": "https://www.freebuf.com/sectool/173617.html", "time": "2018-06-05", "level": "", "num_look": 297142, "num_comment": 1, "author": "dolphin", "tags": ["工具"], "text": "本文将以SNMP协议为例，介绍如何使用beSTORM进行网络协议Fuzz。"}
{"title": "AssassinGo： 基于Go的高并发可拓展式Web渗透框架", "url": "https://www.freebuf.com/sectool/173156.html", "time": "2018-06-05", "level": "金币+10", "num_look": 270022, "num_comment": 13, "author": "Amyang", "tags": ["工具"], "text": "AssassinGo是一款使用Golang开发，集成了信息收集、基础攻击探测、Google-Hacking域名搜索和PoC批量检测等功能的Web渗透框架。"}
{"title": "不包含数字字母的WebShell", "url": "https://www.freebuf.com/articles/web/173579.html", "time": "2018-06-05", "level": "金币+5", "num_look": 372687, "num_comment": 6, "author": "Mochazz", "tags": ["WEB安全"], "text": "前一整子SUCTF没时间玩，只能偷偷关注群消息，然后看到 Wfox 师傅FUZZ出来的一个webshell挺好玩的，于是偷偷记下。今天有空，就查阅了一些资料，整理一番。"}
{"title": "BUF早餐铺 | 用户发现有史以来最古怪的Android故障之一；Ticketflix网站被入侵，黑客还盗取了客户的数据；令人惊叹的CSS漏洞攻击Firefox和Chrome中枪；工信部发布《一季度网络威胁态势分析》先敌防御构筑安全", "url": "https://www.freebuf.com/news/173834.html", "time": "2018-06-05", "level": "", "num_look": 131733, "num_comment": 2, "author": "Sphinx", "tags": ["资讯"], "text": "用户发现有史以来最古怪的Android故障之一；Ticketflix网站被入侵，黑客还盗取了客户的数据；令人惊叹的CSS漏洞攻击 Firefox 和 Chrome 中枪。"}
{"title": "威胁预警 | Linux.BackDoor.Xnote.1最新变种来袭", "url": "https://www.freebuf.com/vuls/173731.html", "time": "2018-06-04", "level": "", "num_look": 251121, "num_comment": 5, "author": "深信服千里目安全实验室", "tags": ["漏洞", "系统安全"], "text": "某Linux服务器经常出现apache的conf文件被篡改后出现挂黑链的情况，并且偶尔出现大规模的DDOS外发现象恶意进程删除后会自动重启，无法彻底删除。"}
{"title": "EOS节点远程代码执行漏洞：EOS智能合约WASM函数表数组越界分析", "url": "https://www.freebuf.com/vuls/173794.html", "time": "2018-06-04", "level": "", "num_look": 246945, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["区块链安全", "漏洞"], "text": "近日，360安全专家发现EOS区块链系统在解析WASM文件时，会出现缓冲区溢出的问题，而攻击者将能够利用这个缓冲区溢出漏洞对EOS系统实施攻击。"}
{"title": "一篇小黄文牵出国内最大黑产，你被“上”过吗？", "url": "https://www.freebuf.com/articles/network/173408.html", "time": "2018-06-04", "level": "红色标题", "num_look": 1031381, "num_comment": 24, "author": "GEETEST极验", "tags": ["网络安全"], "text": "如今这年头，没被运营商“上”过（劫持）都不好意思说自己是中国网民！这还是乌云在2016年2月一句吐槽的话。"}
{"title": "谷歌应用现怪异Bug：搜索特定词条会暴露短信", "url": "https://www.freebuf.com/news/173786.html", "time": "2018-06-04", "level": "红色标题", "num_look": 150861, "num_comment": 3, "author": "Covfefe", "tags": ["资讯"], "text": "当用户在搜索一些特定词条时，设备会暴露用户个人的短信息。不过这个bug只会在使用Google Search，Google Assistant以及Pixel Launcher这些谷歌应用时才会触发。"}
{"title": "天融信诚招有志信息安全人士", "url": "https://www.freebuf.com/jobs/173398.html", "time": "2018-06-04", "level": "", "num_look": 166818, "num_comment": 8, "author": "jintian", "tags": ["安全招聘"], "text": "作为中国信息安全行业领导企业，近二十年来天融信人凭借着高度民族使命感和责任感，秉承“融天下英才、筑可信网络”的人才理念，成功打造出中国信息安全产业领先品牌TOPSEC。"}
{"title": "挖矿木马借“XX的秘密”等小黄书疯传，中毒后会劫持比特币交易", "url": "https://www.freebuf.com/articles/system/173594.html", "time": "2018-06-04", "level": "", "num_look": 233531, "num_comment": 3, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "病毒使用执行远程脚本的方法，并结合白利用，代码混淆，无文件内存装载等技术来躲避安全厂商的查杀，受害者一旦打开这些chm格式的电子书，病毒便会隐藏进用户机器中。"}
{"title": "尼日利亚黑客团伙SWEED攻击手法揭秘", "url": "https://www.freebuf.com/articles/system/173236.html", "time": "2018-06-04", "level": "", "num_look": 234713, "num_comment": 3, "author": "Threatbook", "tags": ["系统安全"], "text": "近日，我们发现了一个长期利用窃密木马（AgentTesla等）对制造业、航运、能源以及部分政府部门发起定向攻击，通过窃取被攻击目标用户和单位敏感信息进行CEO诈骗（BEC）攻击的黑客团伙。"}
{"title": "开源SOC的设计与实践", "url": "https://www.freebuf.com/articles/network/173282.html", "time": "2018-06-04", "level": "现金奖励", "num_look": 310330, "num_comment": 2, "author": "xsecurity", "tags": ["网络安全"], "text": "开源日志系统分析很常见， 现在基于开源中间件可以很有效的搭建日志中心，处理各种数据的收集与分析。"}
{"title": "BUF早餐铺 | 美国法院驳回卡巴斯基上诉；5G技术兼容SIM也带来安全风险；Windows JScript组件被曝RCE漏洞；二手手机信息泄露情况严重", "url": "https://www.freebuf.com/news/173640.html", "time": "2018-06-04", "level": "", "num_look": 125248, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "鲜鲫银丝脍，香芹碧涧羹。"}
{"title": "Galileo：一款开源Web应用审计框架", "url": "https://www.freebuf.com/sectool/173219.html", "time": "2018-06-03", "level": "", "num_look": 208601, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "Galileo是一款针对Web应用程序的开源渗透测试工具，可帮助开发和渗透测试人员识别并利用其Web应用程序中的漏洞。"}
{"title": "利用HTTP参数污染方式绕过谷歌reCAPTCHA验证机制", "url": "https://www.freebuf.com/articles/web/173435.html", "time": "2018-06-03", "level": "红色标题", "num_look": 405310, "num_comment": 4, "author": "clouds", "tags": ["WEB安全"], "text": "reCAPTCHA是谷歌提供的一项免费验证服务，可以方便Web应用开发者把验证码认证（CAPTCHA）机制添加到一些需要进行人机身份验证或其它形式验证的网站中。"}
{"title": "CTF挑战130分 | Rickdiculously 1.0", "url": "https://www.freebuf.com/news/173249.html", "time": "2018-06-03", "level": "金币+5", "num_look": 266772, "num_comment": 9, "author": "Setup", "tags": [], "text": "Vulnhub是一个提供各种漏洞环境的靶场平台，供安全爱好者学习渗透使用。"}
{"title": "Hadoop Yarn REST API未授权漏洞利用挖矿分析", "url": "https://www.freebuf.com/vuls/173638.html", "time": "2018-06-03", "level": "", "num_look": 501416, "num_comment": 1, "author": "云鼎实验室", "tags": ["安全报告", "漏洞"], "text": "我们曾多次捕获相关的攻击案例，其中就包含利用该问题进行挖矿，我们针对其中一个案例进行分析并提供响应的安全建议和解决方案。"}
{"title": "SUpraudit：一款MacOS上的日志审计工具", "url": "https://www.freebuf.com/sectool/173220.html", "time": "2018-06-02", "level": "", "num_look": 184689, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "你可能对BSM审计有所了解，也可能完全没有听说过。这是Solaris OS遗留下来的产物，它存在于FreeBSD，Linux，当然还包括MacOS上。"}
{"title": "MindshaRE：如何利用IDA Python浏览WINDOWS内核", "url": "https://www.freebuf.com/articles/system/173269.html", "time": "2018-06-02", "level": "红色标题", "num_look": 217784, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "当我去参加安全会议时，我总喜欢跟大神们讨论关于逆向工程方面的东西。"}
{"title": "Windows漏洞利用开发教程Part 5：返回导向编程(ROP)", "url": "https://www.freebuf.com/articles/system/173654.html", "time": "2018-06-02", "level": "现金奖励", "num_look": 224730, "num_comment": 11, "author": "zusheng", "tags": ["系统安全"], "text": "本文主要介绍的是Windows软件漏洞的利用开发教程。我花了大量的时间来研究了计算机安全领域Windows漏洞利用开发，希望能和大家分享一下。"}
{"title": "GPON Home Router家庭光纤网关设备漏洞技术分析", "url": "https://www.freebuf.com/articles/terminal/173259.html", "time": "2018-06-02", "level": "", "num_look": 226998, "num_comment": 7, "author": "腾讯WiFi管家", "tags": ["终端安全"], "text": "什么是GPON终端？PON终端，俗称“ 光猫”，作用类似于大家所熟悉的ADSL Modem，是光纤到户家庭需备的网络设备。"}
{"title": "精彩速览 | 2018威胁情报&APT攻击技术与趋势高峰论坛（附PPT下载）", "url": "https://www.freebuf.com/fevents/173601.html", "time": "2018-06-01", "level": "红色标题", "num_look": 567133, "num_comment": 2, "author": "FB客服", "tags": ["活动"], "text": "天下情报，快字当先 ，FreeBuf企业俱乐部上海站回顾新鲜出炉，还有演讲嘉宾PPT下载，赶紧来看看吧。"}
{"title": "贾跃亭等失信人员名单被公示，身份信息遭严重泄露", "url": "https://www.freebuf.com/news/173648.html", "time": "2018-06-01", "level": "", "num_look": 474521, "num_comment": 10, "author": "Akane", "tags": ["资讯"], "text": "六一儿童节本该喜喜庆庆，但今天贾跃亭的心情想必会有点糟糕。老贾今天又被点名了，说好的回国造车计划又双叒叕要泡汤了？"}
{"title": "人民日报海外版：保护个人信息还需加把劲", "url": "https://www.freebuf.com/news/173600.html", "time": "2018-06-01", "level": "", "num_look": 152402, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "个人信息被泄露似乎已是见怪不怪，无可奈何。为何一直在跟进的相关治理措施效果不明显？如何才能阻止个人信息“被卖”，让人们享受安宁清心的正常生活？"}
{"title": "Spring-data-commons(CVE-2018-1273)漏洞分析", "url": "https://www.freebuf.com/vuls/172984.html", "time": "2018-06-01", "level": "", "num_look": 1631302, "num_comment": 1, "author": "Moonlightos", "tags": ["WEB安全", "漏洞"], "text": "CVE-2018-1273 是 Spring-data-commons近期爆出的一个可远程执行代码的漏洞，本文将从漏洞的成因，漏洞的判定以及漏洞的利用三个方面来进行详细说明。"}
{"title": "技术分享 | 劫持DNS通过流量植入木马实验", "url": "https://www.freebuf.com/articles/web/172921.html", "time": "2018-06-01", "level": "现金奖励", "num_look": 465890, "num_comment": 19, "author": "R1ngk3y", "tags": ["WEB安全"], "text": "很多时候对目标进行渗透时一般会从web、网络设备、针对性钓鱼这三个方向入手。假设我们控制了目标网络中的一台网络设备，如路由器，内网用户流量会从这个地方经过我们怎么获取其权限呢 ？"}
{"title": "新款zANTI卷土重来：高级移动渗透和安全分析工具包", "url": "https://www.freebuf.com/articles/network/173283.html", "time": "2018-06-01", "level": "", "num_look": 332995, "num_comment": 10, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "zANTI是一款使用起来非常方便的移动端渗透测试工具和安全分析工具。"}
{"title": "360阿尔法团队诚聘安全研究员", "url": "https://www.freebuf.com/jobs/173432.html", "time": "2018-06-01", "level": "", "num_look": 201914, "num_comment": 4, "author": "diigu", "tags": ["安全招聘"], "text": "360阿尔法团队（Alpha Team）隶属于奇虎360公司核心安全事业部，由多名资深安全专家组成，是一只安全研究支持和成果转化的研究团队，致力于Android系统漏洞以及移动浏览器漏洞等方向的挖掘与利用。"}
{"title": "CVE-2018-4990 Adobe Reader代码执行漏洞利用分析", "url": "https://www.freebuf.com/articles/system/173095.html", "time": "2018-06-01", "level": "", "num_look": 244091, "num_comment": 6, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "CVE-2018-4990为Adobe PDF阅读器的代码执行漏洞，而CVE-2018-8120则是Windows操作系统Win32k的内核提权漏洞。"}
{"title": "甲方安全之企业安全自动化工具SeMF分享", "url": "https://www.freebuf.com/sectool/173052.html", "time": "2018-06-01", "level": "现金奖励", "num_look": 700476, "num_comment": 26, "author": "FallenAngels", "tags": ["企业安全", "工具"], "text": "上一篇文章《“传说中”的甲方安全》发布已经半年的时间，文章结尾说开源自建的安全管理平台，但是一直跳票。我澄清一下，跟领导PK败了，所以原始版本是不让开源的，用了半年时间新写了一套企业安全管理框架。"}
{"title": "Glupteba恶意代理木马利用“永恒之蓝”漏洞传播，感染量激增", "url": "https://www.freebuf.com/articles/system/172929.html", "time": "2018-06-01", "level": "", "num_look": 387997, "num_comment": 4, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "近日腾讯御见威胁情报中心监测到大量下载Glupteba恶意代理木马。"}
{"title": "BUF 早餐铺 | Windows JScript组件存在远程代码执行漏洞；本田印度在AWS S3服务器上暴露50,000个客户的详细信息；恶意的Git存储库可能导致远程系统上的代码执行", "url": "https://www.freebuf.com/news/173533.html", "time": "2018-06-01", "level": "", "num_look": 131513, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "FreeBuf祝大家儿童节快乐！"}
{"title": "XorDDoS家族最新变种来袭", "url": "https://www.freebuf.com/articles/system/172987.html", "time": "2018-05-31", "level": "", "num_look": 249645, "num_comment": 2, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "最近接到某客户反馈Linux服务器存在异常流量和可疑进程，深信服EDR安全团队迅速出击，捕获到了相应的恶意样本。"}
{"title": "PwnAuth：OAuth滥用攻击检测和响应平台", "url": "https://www.freebuf.com/articles/network/173054.html", "time": "2018-05-31", "level": "", "num_look": 157165, "num_comment": 1, "author": "secist", "tags": ["网络安全"], "text": "鱼叉式网络钓鱼攻击被视为企业最大的网络威胁之一。只需一名员工大意的输入了他的凭据，或运行了一些未知的恶意软件，就可能会使整个企业网络掌控于攻击者，甚至瘫痪。"}
{"title": "文能挑起外交争端，武能击落无人机 | 神秘的“声波攻击”到底是什么？", "url": "https://www.freebuf.com/special/173509.html", "time": "2018-05-31", "level": "红色标题", "num_look": 420354, "num_comment": 2, "author": "AngelaY", "tags": ["特别企划"], "text": "美国国务卿蓬佩奥发言表示，美国驻华大使馆工作人员出现的身体不适与此前美国驻古巴大使馆遭遇“声波攻击”的工作人员的医学表征基本相同，暗指中方发起声波攻击。"}
{"title": "新手上路 | 上传Word文件形成存储型XSS路径", "url": "https://www.freebuf.com/articles/web/173250.html", "time": "2018-05-31", "level": "", "num_look": 331527, "num_comment": 8, "author": "clouds", "tags": ["WEB安全"], "text": "在渗透测试过程中，每当看到目标测试网站存在上传功能时，总会激起我的好奇心。"}
{"title": "区块链智能合约漏洞，想说补你不容易", "url": "https://www.freebuf.com/articles/blockchain-articles/173481.html", "time": "2018-05-31", "level": "红色标题", "num_look": 363084, "num_comment": 2, "author": "360企业安全", "tags": ["区块链安全"], "text": "最近几天，区块链平台EOS智能合约漏洞事件再次把区块链安全推上了风口浪尖。360Vulcan（伏尔甘）团队发现了区块链平台 EOS 的一系列高危安全漏洞。"}
{"title": "最新恶意软件VPNFilter事件回溯及解析", "url": "https://www.freebuf.com/articles/network/173101.html", "time": "2018-05-31", "level": "", "num_look": 186996, "num_comment": 1, "author": "阿里聚安全", "tags": ["网络安全"], "text": "近日，思科Talos团队公开了一个新的恶意软件及系统“VPNFilter”。"}
{"title": "六一专题 | 警惕新型儿童游戏木马，守护孩子们的天空", "url": "https://www.freebuf.com/articles/terminal/173104.html", "time": "2018-05-31", "level": "红色标题", "num_look": 231386, "num_comment": 5, "author": "腾讯手机管家", "tags": ["终端安全"], "text": "近期，腾讯安全反诈骗实验室自研的TRP-AI反病毒引擎捕获到儿童游戏-宝宝**、儿童游戏-宝宝** 等“儿童游戏”系列应用在用户设备上有流量异常行为，且存在频繁动态加载dex文件、执行命令、私自提权等可疑操作。"}
{"title": "代码审计之任意文件下载漏洞案例分享", "url": "https://www.freebuf.com/vuls/172949.html", "time": "2018-05-31", "level": "现金奖励", "num_look": 335924, "num_comment": 10, "author": "davichi8282", "tags": ["漏洞"], "text": "继上次审计HDWiki之后，最近拿到一套新的源码Ear_Music_20180510_UTF8最新版进行审计，感觉这套CMS还是比较安全的，直到我发现了这个漏洞。"}
{"title": "BUF早餐铺 | 美政府发布警告 称朝鲜可能发起新一轮网络攻击；Google Chrome 67稳定版发布：共计修复34处安全漏洞；欧洲刑警成立暗网调查小组；FBI告诫用户重启路由器以暂时中断恶意软件", "url": "https://www.freebuf.com/news/173414.html", "time": "2018-05-31", "level": "", "num_look": 122584, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "Windows 10杀软最新评测结果：小红伞第一、Defender仍欠火候；美政府发布警告 称朝鲜可能发起新一轮网络攻击；“隐蜂”来袭：全球首例Bootkit级挖矿僵尸网络。"}
{"title": "参会指南 | 2018威胁情报&APT攻击技术与趋势高峰论坛", "url": "https://www.freebuf.com/fevents/173417.html", "time": "2018-05-30", "level": "红色标题", "num_look": 201719, "num_comment": 1, "author": "FB客服", "tags": ["企业安全", "活动"], "text": "全面探讨威胁情报&APT分析检测在企业中的落地"}
{"title": "“隐蜂”来袭：金山毒霸截获全球首例Bootkit级挖矿僵尸网络（上篇）", "url": "https://www.freebuf.com/articles/network/173400.html", "time": "2018-05-30", "level": "", "num_look": 480176, "num_comment": 19, "author": "安全豹", "tags": ["网络安全"], "text": "近期监测发现部分用户系统存在疑似挖矿木马活动的威胁线索，经过逐层溯源分析，一个已经成型并走向活跃的Bootkit级挖矿僵尸网络被揭开神秘面纱，Bootkit与挖矿木马的融合也将碰撞出一些不一样的火花。"}
{"title": "1400美元门票免费送！直通香港AsiaSecWest与全球顶级极客约会", "url": "https://www.freebuf.com/fevents/173304.html", "time": "2018-05-30", "level": "红色标题", "num_look": 362875, "num_comment": 41, "author": "FB客服", "tags": ["活动"], "text": "FreeBuf 特送出一张价值1400美元的参会门票，快来留言讲讲你与香港的不解之缘吧（现编的也行）！与全球黑客大牛齐聚“东方之珠”香港，领略维多利亚港的迷人夜景。"}
{"title": "利用“进程注入”实现无文件复活 WebShell", "url": "https://www.freebuf.com/articles/web/172753.html", "time": "2018-05-30", "level": "现金奖励", "num_look": 417650, "num_comment": 31, "author": "rebeyond", "tags": ["WEB安全"], "text": "我之前一直有个通过“进程注入”来实现内存webshell的想法，于是就趁这个机会以Java为例做了个内存webshell出来。"}
{"title": "白帽专访 | 对话近期多个DoD漏洞发现者Alyssa Herrera", "url": "https://www.freebuf.com/articles/people/172982.html", "time": "2018-05-30", "level": "红色标题", "num_look": 174497, "num_comment": 3, "author": "clouds", "tags": ["人物志"], "text": "自从16岁接触到漏洞众测之后，Alyssa Herrera从此就热爱上了这个行业。作为众测社区为数不多的女性白帽，Alyssa Herrera的漏洞发现成就极具代表性。"}
{"title": "福建通汇集团高薪招聘网络安全渗透工程师", "url": "https://www.freebuf.com/jobs/172989.html", "time": "2018-05-30", "level": "", "num_look": 138755, "num_comment": 5, "author": "冰河洗剑", "tags": ["安全招聘"], "text": "2016年9月，通汇集团成立。这是一家注册资金高达1亿，专注于移动互联网支付、无卡快捷、O2O、互联网+的综合型公司。"}
{"title": "启明星辰集团联合FreeBuf重磅发布《2017网络安全态势观察报告》", "url": "https://www.freebuf.com/articles/paper/173377.html", "time": "2018-05-30", "level": "红色标题", "num_look": 372699, "num_comment": 11, "author": "启明星辰", "tags": ["安全报告"], "text": "启明星辰集团联合FreeBuf正式发布《2017网络安全态势观察报告》。报告主要针对中国 2017 年（部分安全事件发生于 2018 年初）的网络安全状况进行统计、研究和分析。"}
{"title": "Pwn2Own华为HiApp漏洞原理与利用分析（上）", "url": "https://www.freebuf.com/articles/terminal/172780.html", "time": "2018-05-30", "level": "现金奖励", "num_look": 295154, "num_comment": 4, "author": "Tasfa", "tags": ["终端安全"], "text": "本文从攻击者的角度来分析如何发现Pwn2Own华为手机漏洞，但不代表与漏洞发现者的思路相同，仅供参考。"}
{"title": "LogonTracer：用于可视化分析Windows安全事件日志寻找恶意登录的工具", "url": "https://www.freebuf.com/sectool/172623.html", "time": "2018-05-30", "level": "", "num_look": 238329, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "LogonTracer是一款用于可视化分析Windows安全事件日志寻找恶意登录的工具。它会将登录相关事件中的主机名（或IP地址）和帐户名称关联起来，并以图形化的方式展现。"}
{"title": "黑客是如何利用你的浏览器进行挖矿的？", "url": "https://www.freebuf.com/articles/web/172560.html", "time": "2018-05-30", "level": "", "num_look": 623576, "num_comment": 6, "author": "深信服千里目安全实验室", "tags": ["WEB安全"], "text": "千里目安全实验室监测到了一大批网站系统被恶意植入了网页挖矿木马，只要访问者通过浏览器浏览被恶意植入了网页挖矿木马站点，浏览器会即刻执行挖矿指令，从而沦为僵尸矿机。"}
{"title": "SideWinder“响尾蛇”APT组织（T-APT-04）：针对南亚的定向攻击威胁", "url": "https://www.freebuf.com/articles/paper/172628.html", "time": "2018-05-30", "level": "", "num_look": 295621, "num_comment": 6, "author": "腾讯电脑管家", "tags": ["安全报告"], "text": "SideWinder“响尾蛇” APT组织的一个最新攻击样本，该APT组织疑似来自印度，最早活跃可追溯到2012年。主要针对巴基斯坦等南亚国家的军事目标进行定向攻击。"}
{"title": "浅谈最近流行的三起区块链51%算力攻击", "url": "https://www.freebuf.com/articles/blockchain-articles/173022.html", "time": "2018-05-30", "level": "现金奖励", "num_look": 515455, "num_comment": 4, "author": "umiiii", "tags": ["区块链安全"], "text": "很多人可能早就听说过 51% 算力攻击，但更多的可能源于各种媒体渠道中“比特币的缺陷”文章之流。实际上，这个说法并不准确，根据比特币百科上所描述，这种攻击被称为多数人的攻击（Majority attack）。"}
{"title": "BUF早餐铺 | 区块链被曝存在史诗级漏洞，可完全控制虚拟货币交易；苹果承认交出用户数据，涉及敏感隐私；加拿大两大银行遭黑客攻击 近9万名客户数据被窃", "url": "https://www.freebuf.com/news/173235.html", "time": "2018-05-30", "level": "", "num_look": 135093, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "币圈无宁日，前有山寨博鳌亚洲论坛，后有重大安全漏洞，何时才能步入正轨？这是个问题。"}
{"title": "快讯 | 苹果公布政府请求透明度报告", "url": "https://www.freebuf.com/news/173286.html", "time": "2018-05-29", "level": "", "num_look": 107919, "num_comment": 107919, "author": "Sphinx", "tags": ["资讯"], "text": "苹果近日公布了 2017 年 7 月 1 日到 12 月 31 日的透明度报告（PDF），公布的政府请求主要包括：设备信息请求，金融交易识别码请求，账户信息请求等。"}
{"title": "新型 VPNFilter 恶意软件影响全球至少50万台网络设备", "url": "https://www.freebuf.com/articles/network/173276.html", "time": "2018-05-29", "level": "", "num_look": 189192, "num_comment": 189192, "author": "思科Talos", "tags": ["网络安全"], "text": "VPNFilter 恶意软件是一个多阶段的模块化平台，具有多种功能，可支持情报收集和破坏性的网络攻击操作。"}
{"title": "Airbash：符合POSIX标准的全自动WPA PSK握手捕获脚本", "url": "https://www.freebuf.com/articles/wireless/172513.html", "time": "2018-05-29", "level": "", "num_look": 210147, "num_comment": 1, "author": "secist", "tags": ["无线安全"], "text": "Airbash是针对渗透测试的符合POSIX标准的全自动WPA PSK握手捕获脚本。它与Bash和Android Shell兼容，并使用aircrack-ng扫描当前连接到接入点（AP）的客户端。"}
{"title": "如何在Electra越狱的设备上使用LLDB调试应用程序", "url": "https://www.freebuf.com/articles/terminal/173218.html", "time": "2018-05-29", "level": "", "num_look": 146880, "num_comment": 1, "author": "secist", "tags": ["终端安全"], "text": "在3月18日的时候，我就曾发表过一篇关于在Electra越狱的设备上使用LLDB调试应用程序的文章。本文我将在此基础上，做进一步的更新优化。"}
{"title": "观点 | 浅谈信息安全建设与ISO27001体系的结合", "url": "https://www.freebuf.com/articles/security-management/172911.html", "time": "2018-05-29", "level": "金币+10", "num_look": 484730, "num_comment": 17, "author": "gakusen", "tags": ["企业安全", "安全管理"], "text": "公司安全部门成立的较晚（目前就我一个人负责），高层领导也对信息安全没有什么认识，甚至连安全策略和针对性的法律法规文件都没有。"}
{"title": "从Windows 10 SSH-Agent中提取SSH私钥", "url": "https://www.freebuf.com/articles/system/172624.html", "time": "2018-05-29", "level": "", "num_look": 241770, "num_comment": 3, "author": "secist", "tags": ["系统安全"], "text": "周末我安装了Windows 10 Spring Update，最令我期待的就是它的内置OpenSSH工具，这意味着Windows管理员不再需要使用Putty和PPK格式的密钥了。"}
{"title": "孝道科技高薪诚聘安全人员（杭州）", "url": "https://www.freebuf.com/jobs/172738.html", "time": "2018-05-29", "level": "", "num_look": 137404, "num_comment": 1, "author": "hz_qiufang", "tags": ["安全招聘"], "text": "杭州孝道科技有限公司（简称：孝道科技），公司创立于2014年，坐落于美丽的杭州西子湖畔，位于中国（杭州）智慧信息产业园。"}
{"title": "一起涉及多个DDoS僵尸网络样本的攻击事件追踪", "url": "https://www.freebuf.com/articles/terminal/172840.html", "time": "2018-05-29", "level": "", "num_look": 257961, "num_comment": 3, "author": "任子行", "tags": ["终端安全"], "text": "近期任子行蜜网系统监测到一起涉及利用多个僵尸木马传播进行DDoS攻击的安全事件。"}
{"title": "Android辅助类病毒研究报告", "url": "https://www.freebuf.com/articles/terminal/172767.html", "time": "2018-05-29", "level": "", "num_look": 209071, "num_comment": 1, "author": "腾讯手机管家", "tags": ["终端安全"], "text": "近期，腾讯反诈骗实验通过AI引擎聚类关联发现，恶意利用Android辅助功能，究其原因是，从市场反馈来看，由于没有足够的安全意识，导致辅助功能被恶意使用。"}
{"title": "ZipperDown漏洞，炒作还是一触即发？", "url": "https://www.freebuf.com/articles/terminal/172627.html", "time": "2018-05-29", "level": "", "num_look": 196655, "num_comment": 2, "author": "AVLTeam", "tags": ["终端安全"], "text": "近期，ZipperDown漏洞被披露，该漏洞影响Android和iOS两大平台，其中iOS应用市场多达10%的应用存在该漏洞。"}
{"title": "BUF 早餐铺 | 在90多个国家的141台低成本android设备中发现了预装恶意软件；研究人员绕过AMD的SEV虚拟机加密；可口可乐的数据泄露已经影响到大约8000名员工；第二届“红帽杯”网络安全攻防大赛圆满结束", "url": "https://www.freebuf.com/news/173118.html", "time": "2018-05-29", "level": "", "num_look": 134013, "num_comment": 134013, "author": "Sphinx", "tags": ["资讯"], "text": "在90多个国家的141台低成本android设备中发现了预装恶意软件；研究人员绕过AMD的SEV虚拟机加密；可口可乐的数据泄露已经影响到大约8000名员工。"}
{"title": "现场拿Offer | FreeBuf安全招聘线下双选会回顾", "url": "https://www.freebuf.com/news/173106.html", "time": "2018-05-28", "level": "红色标题", "num_look": 118015, "num_comment": 3, "author": "FB招聘小助手", "tags": ["活动", "资讯"], "text": "FreeBuf招聘站线下双选会回顾，参会企业职位持续开放中~"}
{"title": "挖洞经验 | 看我如何发现价值3万6千美金的谷歌RCE漏洞", "url": "https://www.freebuf.com/articles/web/172724.html", "time": "2018-05-28", "level": "", "num_look": 335220, "num_comment": 5, "author": "clouds", "tags": ["WEB安全"], "text": "本文讲述了乌拉圭公立大学18岁学生 Ezequiel Pereira 发现谷歌（Google）最高级别RCE漏洞的相关过程。"}
{"title": "为什么要禁止除GET和POST之外的HTTP方法？", "url": "https://www.freebuf.com/articles/web/172695.html", "time": "2018-05-28", "level": "红色标题", "num_look": 760908, "num_comment": 21, "author": "进击的大熊2018", "tags": ["WEB安全"], "text": "最近老是听朋友说，被上级单位通报HTTP不安全方法漏洞，本来是低危漏洞，也没怎么注意它，最近升为中危漏洞，每天催着去整改，闹得人心惶惶。"}
{"title": "快讯 | 可口可乐的数据泄露已经影响到大约8000名工人", "url": "https://www.freebuf.com/news/173082.html", "time": "2018-05-28", "level": "", "num_look": 138631, "num_comment": 2, "author": "Sphinx", "tags": ["资讯"], "text": "可口可乐在9月份发现了安全泄露问题，执法人员通知可口可乐，公司子公司的一名前员工拿走了包含员工信息的硬盘。"}
{"title": "海航科技集团安全人才招聘", "url": "https://www.freebuf.com/jobs/172571.html", "time": "2018-05-28", "level": "", "num_look": 139766, "num_comment": 4, "author": "neway", "tags": ["安全招聘"], "text": "海航科技集团成立于 2016 年 12 月，是世界500强企业海航集团面向未来战略布局的大型产业控股集团，总部设立在中国上海。"}
{"title": "快速进击的挖矿僵尸网络：单日攻击破10万次", "url": "https://www.freebuf.com/articles/paper/172797.html", "time": "2018-05-28", "level": "", "num_look": 243507, "num_comment": 3, "author": "360安全", "tags": ["安全报告"], "text": "近日，360互联网安全中心又发现了一批使用msSQL进行传播的挖矿木马的新型变种。此次木马攻击主要利用“白利用”这一通常出现在远控或盗号木马上的隐藏手段。"}
{"title": "漫谈攻击链：从WebShell到域控的奇妙之旅", "url": "https://www.freebuf.com/articles/network/172578.html", "time": "2018-05-28", "level": "现金奖励", "num_look": 708788, "num_comment": 48, "author": "TimeS0ng", "tags": ["网络安全"], "text": "做渗透测试时遇到的域环境经常就是要么太复杂我们搞不定，要么太简单进去就拿到域控没啥意思，这些显然都无法满足我们实践已掌握知识的刚需。"}
{"title": "攻破黑市之拿下吃鸡DNF等游戏钓鱼站群", "url": "https://www.freebuf.com/articles/web/172330.html", "time": "2018-05-28", "level": "红色标题", "num_look": 444946, "num_comment": 9, "author": "风在指尖", "tags": ["WEB安全"], "text": "前段时间有个网友给我发了个网址，说找到个专门做钓鱼网站的连接，让我看看，然后就引出了一系列事件。"}
{"title": "BUF 早餐铺 | 亚马逊Alexa录制对话并未经用户许可就发给用户联系人；FBI已经控制了VPNFilter僵尸网络；Mac设备遭遇新门罗币挖矿软件入侵；报告显示我国工业信息安全产业发展进入“快车道”", "url": "https://www.freebuf.com/news/172953.html", "time": "2018-05-28", "level": "", "num_look": 115993, "num_comment": 3, "author": "Sphinx", "tags": ["资讯"], "text": "亚马逊Alexa录制对话并未经用户许可就发给用户联系人；FBI已经控制了VPNFilter僵尸网络；报告显示我国工业信息安全产业发展进入“快车道”。"}
{"title": "Roaming Mantis：通过Wi-Fi路由器感染智能手机", "url": "https://www.freebuf.com/articles/terminal/172538.html", "time": "2018-05-27", "level": "", "num_look": 189097, "num_comment": 2, "author": "Backspaces", "tags": ["终端安全"], "text": "前段时间，我们的专家调查了一款他们称为Roaming Mantis的恶意软件。当时，受影响的人主要来自日本，韩国，中国，印度和孟加拉国的用户，所以我们没有在其他地区讨论恶意软件，这似乎是一个针对威胁。"}
{"title": "使用CMSTP绕过AppLocker的方法介绍", "url": "https://www.freebuf.com/articles/system/172515.html", "time": "2018-05-27", "level": "", "num_look": 227796, "num_comment": 227796, "author": "secist", "tags": ["系统安全"], "text": "CMSTP是一个与Microsoft连接管理器配置文件安装程序关联的二进制文件。它接受INF文件，这些文件可以通过恶意命令武器化，以脚本（SCT）和DLL的形式执行任意代码。"}
{"title": "有个黑客女朋友，应该会是一件很酷的事情吧", "url": "https://www.freebuf.com/fevents/173023.html", "time": "2018-05-27", "level": "红色标题", "num_look": 370697, "num_comment": 16, "author": "shidongqi", "tags": ["活动"], "text": "自从写出黑客情人节段子的程序员火了之后，很多女生梦想有一个黑客男友；但其实在男生的角度来看，能有一个黑客女朋友，也应该是一件非常酷的事情吧，这也是在我亲临TCTF现场观赛之后的心声。"}
{"title": "从一道CTF题学习PHP反序列化漏洞", "url": "https://www.freebuf.com/news/172507.html", "time": "2018-05-27", "level": "", "num_look": 493775, "num_comment": 493775, "author": "进击的大熊2018", "tags": ["资讯"], "text": "前阵子，参加了一个CTF比赛，其中有一条道题蛮有意思的，所以写出来分享一下。"}
{"title": "史上最严数据保护条例GDPR今日生效，对你我而言意味着什么？", "url": "https://www.freebuf.com/articles/neopoints/172895.html", "time": "2018-05-27", "level": "红色标题", "num_look": 480109, "num_comment": 10, "author": "AngelaY", "tags": ["特别企划", "观点"], "text": "GDPR 规定，企业一旦违反这一条例，最高可面临全球营业额 4% 的罚款，因此被冠以“史上最严数据保护条例”的称号。"}
{"title": "WMAMiner挖矿蠕虫分析", "url": "https://www.freebuf.com/articles/system/172307.html", "time": "2018-05-27", "level": "", "num_look": 374129, "num_comment": 1, "author": "兰云科技银河实验室", "tags": ["系统安全"], "text": "近日，兰云科技银河实验室在多个监测点用“兰眼下一代威胁感知系统”检测到多起同类未知威胁事件，杀毒软件检测率非常低。"}
{"title": "微软将在Office 365中屏蔽Flash", "url": "https://www.freebuf.com/news/172725.html", "time": "2018-05-26", "level": "金币+10", "num_look": 141808, "num_comment": 141808, "author": "Monica16323", "tags": ["资讯"], "text": "微软公司上周宣布了一项政策更新，其内容是限制Flash，Shockwave和Silverlight等控件在Office 365中的激活和使用。"}
{"title": "【FB TV】一周「BUF大事件」：思科公司发布安全预警，VPNFilter大规模来袭；2018威胁情报&APT攻击技术与趋势高峰论坛月末于上海举办", "url": "https://www.freebuf.com/video/172975.html", "time": "2018-05-26", "level": "红色标题", "num_look": 192374, "num_comment": 192374, "author": "willhuang", "tags": ["视频"], "text": "本周思科公司发布安全预警，VPNFilter 大规模来袭；超过2亿套日本人的个人身份信息在地下黑市售卖。2018威胁情报&APT攻击技术与趋势高峰论坛月末于上海举办。"}
{"title": "高效IT灾难恢复计划应该涵盖的7大要素", "url": "https://www.freebuf.com/articles/security-management/172397.html", "time": "2018-05-26", "level": "", "num_look": 253528, "num_comment": 253528, "author": "米雪儿", "tags": ["安全管理"], "text": "由于自然和人为灾害，企业网络和数据访问可能会毫无征兆地被中断。当然，您可能无法阻止所有这一切的发生，但是如果有一个好的灾难恢复计划，您就可以更好地应对这些意外事件。"}
{"title": "IIS深入浅出之短文件漏洞知多少", "url": "https://www.freebuf.com/articles/web/172561.html", "time": "2018-05-26", "level": "", "num_look": 667857, "num_comment": 3, "author": "深信服千里目安全实验室", "tags": ["WEB安全"], "text": "根据Netcraft在2017年2月的数据显示，IIS在“百万最繁忙网站”中的市场份额为10.19％，成为全球第三大网络服务器。"}
{"title": "2018 Q1威胁态势报告：58%的僵尸网络攻击持续不超过一天", "url": "https://www.freebuf.com/news/172707.html", "time": "2018-05-26", "level": "", "num_look": 147612, "num_comment": 147612, "author": "AngelaY", "tags": ["资讯"], "text": "Fortinet 上周发布《2018年第一季度威胁态势报告》。报告称绝大多数僵尸网络恶意软件攻击持续不到一天。"}
{"title": "在腾讯云+未来安全论坛，听赵伟、TK、Killer讲段子是什么体验？", "url": "https://www.freebuf.com/fevents/172813.html", "time": "2018-05-25", "level": "红色标题", "num_look": 609274, "num_comment": 8, "author": "Akane", "tags": ["活动"], "text": "又到一年一度的腾讯云+未来峰会，笔者有幸受邀参加安全论坛，来广州听赵伟、TK、Killer等顶尖大佬同场PK。都说羊城热情似火，本人作证此言非虚，一下飞机就被35°的“热情”给包围了。"}
{"title": "数字货币钱包安全白皮书", "url": "https://www.freebuf.com/articles/paper/172937.html", "time": "2018-05-25", "level": "", "num_look": 229660, "num_comment": 2, "author": "AdlerI", "tags": ["安全报告"], "text": "近期，我们对应用市场上流通的热钱包以及冷钱包进行了相关安全审核评估，发现了很多安全问题。"}
{"title": "互联网企业：如何建设数据安全体系？", "url": "https://www.freebuf.com/articles/database/172933.html", "time": "2018-05-25", "level": "", "num_look": 208338, "num_comment": 2, "author": "AngelaY", "tags": ["数据安全"], "text": "在安全领域中，数据安全这个子领域也重新被提到了一个新的高度，所以笔者就借机来说一下数据安全建设。"}
{"title": "震惊！男男女女聚众通宵钻洞，居然还有钱拿？| 漏洞马拉松·北京站", "url": "https://www.freebuf.com/fevents/174758.html", "time": "2018-05-25", "level": "", "num_look": 53414, "num_comment": 53414, "author": "FB客服", "tags": ["活动"], "text": "内含.avi动作大片，更有精彩Q&A~"}
{"title": "腾讯云副总裁黎巍：“云管端”协同引领智慧安全未来", "url": "https://www.freebuf.com/articles/network/174262.html", "time": "2018-05-25", "level": "", "num_look": 79875, "num_comment": 79875, "author": "腾讯云安全", "tags": ["网络安全"], "text": "5月23日至24日，腾讯“云+未来”峰会在广州召开。腾讯云副总裁黎巍发表了以《智慧安全引领未来》为主题的演讲，分享了云安全的发展现状与挑战，以及新时代环境下腾讯云基于云管端实现的全场景智慧安全方案。"}
{"title": "案例会说话︱全景解析腾讯云安全：从八大领域输出全链路智慧安全能力", "url": "https://www.freebuf.com/articles/network/174258.html", "time": "2018-05-25", "level": "", "num_look": 95163, "num_comment": 95163, "author": "腾讯云安全", "tags": ["网络安全"], "text": "近日，在广州举办的2018腾讯“云+未来”峰会圆满落幕。这场聚焦云计算行业的盛会吸引了众多业界重量级嘉宾，多场论坛探讨就云计算的发展现状、技术突破、安全未来等话题展开了热议。"}
{"title": "干货集锦（下）︱云+未来峰会：如何保护企业数据，建立安全壁垒？", "url": "https://www.freebuf.com/fevents/174256.html", "time": "2018-05-25", "level": "", "num_look": 52496, "num_comment": 52496, "author": "AngelaY", "tags": ["活动"], "text": "5月23日、24日，2018腾讯“云+未来”峰会在广州举行。伴随着数字经济与现实社会不断深度融合，网络安全的价值也在持续引发业内外人士讨论。在24日的安全专场上，腾讯四位安全专家就“以网络安全之能，造国之重器”展开…"}
{"title": "干货集锦（上）︱云+未来峰会：智慧安全护航企业数字化转型", "url": "https://www.freebuf.com/fevents/174268.html", "time": "2018-05-25", "level": "", "num_look": 59660, "num_comment": 59660, "author": "AngelaY", "tags": ["活动"], "text": "5月23日-24日，2018腾讯“云+未来”峰会在广州举行。在24日的安全专场，腾讯云携手多位业内专家探讨了云计算、AI、量子计算等前沿领域与网络安全的融合。"}
{"title": "Sandmap：使用大规模Nmap引擎支持网络和系统侦察的工具", "url": "https://www.freebuf.com/sectool/172516.html", "time": "2018-05-25", "level": "", "num_look": 192419, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "Sandmap是一个支持使用大规模Nmap引擎进行网络和系统侦察的工具。它提供了一个非常友好的用户界面，自动化和加速扫描，并允许你轻松地使用各种高级的扫描技术。"}
{"title": "“围观”一个有趣的钓鱼样本", "url": "https://www.freebuf.com/articles/web/172514.html", "time": "2018-05-25", "level": "", "num_look": 252604, "num_comment": 1, "author": "secist", "tags": ["WEB安全", "网络安全"], "text": "网络钓鱼可以说是一个老生常谈的话题了，但时至今日它仍受到许多攻击者的欢迎。比如一封邮件，一个附件，一个链接地址，再配上一段美丽陷阱的谎言。"}
{"title": "挖矿恶意程序纪实分析之 Windows 篇", "url": "https://www.freebuf.com/articles/system/172655.html", "time": "2018-05-25", "level": "现金奖励", "num_look": 267535, "num_comment": 11, "author": "cgf99", "tags": ["系统安全"], "text": "近期接到客户反馈，其网络中有部分window系统终端机器异常，安全团队经过分析，发现其仍旧是一起网络挖矿事件。"}
{"title": "自建环境绕过App参数签名", "url": "https://www.freebuf.com/articles/terminal/172016.html", "time": "2018-05-25", "level": "现金奖励", "num_look": 202490, "num_comment": 5, "author": "海带头", "tags": ["终端安全"], "text": "App在设计开发阶段，需要根据业务场景考虑多种安全策略。比如在数据传输方面，很多app为保证数据的机密性和完整性，会对发送的请求数据做加密和签名处理。"}
{"title": "DarkHotel APT团伙新近活动的样本分析", "url": "https://www.freebuf.com/articles/system/171049.html", "time": "2018-05-25", "level": "", "num_look": 234402, "num_comment": 4, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "Darkhotel（APT-C-06）是一个长期针对企业高管、国防工业、电子工业等重要机构实施网络间谍攻击活动的APT组织。"}
{"title": "基于区块链域名的僵尸网络病毒分析", "url": "https://www.freebuf.com/articles/blockchain-articles/172559.html", "time": "2018-05-25", "level": "", "num_look": 217477, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["区块链安全"], "text": "深信服安全云脑病毒流量分析团队捕获了一批病毒样本，这些样本结合了区块链。"}
{"title": "BUF 早餐铺 | VPNFilter 大规模来袭，感染几十个国家 50 万台路由器和存储设备；Turla APT组织利用Metasploit 框架发动攻击；国家工信安全中心主任：工业信息安全形势日趋严峻", "url": "https://www.freebuf.com/news/172778.html", "time": "2018-05-25", "level": "", "num_look": 140546, "num_comment": 140546, "author": "Sphinx", "tags": ["资讯"], "text": "VPNFilter 大规模来袭，感染几十个国家 50 万台路由器和存储设备；Turla APT组织利用Metasploit 框架发动攻击；国家工信安全中心主任：工业信息安全形势日趋严峻。"}
{"title": "美国薪资最高的7个网络安全职位", "url": "https://www.freebuf.com/articles/neopoints/172331.html", "time": "2018-05-24", "level": "红色标题", "num_look": 339489, "num_comment": 12, "author": "柚子", "tags": ["观点"], "text": "对于想找工作的网络安全专业人才来说，未来仍会是一片光明的“卖方市场”。"}
{"title": "FreeTalk 2018 北京站精彩回顾（附PPT下载）", "url": "https://www.freebuf.com/fevents/172743.html", "time": "2018-05-24", "level": "", "num_look": 251556, "num_comment": 5, "author": "FB客服", "tags": ["活动"], "text": "2018年5月20日，FreeTalk 2018北京站在中关村优客工场顺利举办。20日当天虽有蒙蒙细雨，但也抵挡不住在场的FB铁粉和安全从业人员的热情！"}
{"title": "更新 | FBI控制感染几十个国家 50 万台路由器和存储设备的VPNFilter，确认攻击者为APT28", "url": "https://www.freebuf.com/news/172729.html", "time": "2018-05-24", "level": "红色标题", "num_look": 275544, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "思科公司发布安全预警称，俄罗斯黑客利用恶意软件，已感染几十个国家的至少50万台路由器和存储设备。"}
{"title": "恶意程序详细分析：不仅仅是利比亚天蝎", "url": "https://www.freebuf.com/articles/security-management/172247.html", "time": "2018-05-24", "level": "", "num_look": 228045, "num_comment": 4, "author": "AVLTeam", "tags": ["安全管理"], "text": "2016年9月，安全厂商Cyberkov发布了名为利比亚天蝎的安全报告，报告中指出，一批恶意软件通过社交程序Telegram广泛传播，主要针对有影响力的社会名流和政治人士。"}
{"title": "FreeBuf APT &威胁情报征文大赛 | 有才的小哥哥，我可以撩你吗？", "url": "https://www.freebuf.com/fevents/172648.html", "time": "2018-05-24", "level": "红色标题", "num_look": 252810, "num_comment": 1, "author": "FB客服", "tags": ["活动"], "text": "FreeBuf首届有奖征文大赛正式开启!小哥哥们这么有才，不如来投个稿啊~"}
{"title": "Micropython之萝卜狗远程门禁控制系统", "url": "https://www.freebuf.com/articles/wireless/171406.html", "time": "2018-05-24", "level": "现金奖励", "num_look": 423731, "num_comment": 13, "author": "_橙子 ゝ", "tags": ["无线安全", "极客"], "text": "当代社会，我们进公司需要门禁卡，出入小区需要门禁卡，门禁系统又称出入管理控制系统(ACCESS CONTROL SYSTEM)， 是一种管理人员进出的智能化管理系统，它集微机自动识别技术和现代安全管理措施为一体。"}
{"title": "CISO元素周期表", "url": "https://www.freebuf.com/articles/neopoints/172361.html", "time": "2018-05-24", "level": "", "num_look": 177447, "num_comment": 2, "author": "青藤云安全Q", "tags": ["观点"], "text": "接下来要说到的CISO元素周期表，里面提到了诸多CISO需要关注的重点。我将其翻译了过来，再加上自己的理解，写成这篇文章，供大家娱乐和拍砖。"}
{"title": "BUF早餐铺 | 新美国法案欲建立国家网络防御小组；微软将在 Office 365 中屏蔽Flash；宝马修复部分车型中的漏洞；工信部称底层硬件漏洞波及广", "url": "https://www.freebuf.com/news/172686.html", "time": "2018-05-24", "level": "", "num_look": 112984, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "五月的天，梦开始要鲜艳；前方蜿蜒，一长串的心愿~"}
{"title": "【已结束】聚焦2018腾讯云+未来峰会安全专场，围观大咖论道", "url": "https://www.freebuf.com/fevents/172385.html", "time": "2018-05-23", "level": "红色标题", "num_look": 157752, "num_comment": 2, "author": "shidongqi", "tags": ["活动"], "text": "2018腾讯云+未来峰会安全专场齐聚腾讯多个安全团队的顶尖专家TK、Killer等以及业内重磅合作伙伴；将首次揭晓腾讯企业安全云管端全景布局；更有抗量子、加密算法与安全相结合的前沿技术分享。"}
{"title": "CNNVD 关于手机程序第三方解压缩库输入验证安全漏洞情况的通报", "url": "https://www.freebuf.com/articles/terminal/172562.html", "time": "2018-05-23", "level": "", "num_look": 144789, "num_comment": 1, "author": "CNNVD", "tags": ["终端安全"], "text": "国家信息安全漏洞库（CNNVD）收到关于手机程序第三方解压缩库输入验证安全漏洞（CNNVD-201805-440）情况的报送。"}
{"title": "DDG挖矿僵尸网络瞄准数据库服务器：收益已达近800万", "url": "https://www.freebuf.com/articles/system/172509.html", "time": "2018-05-23", "level": "", "num_look": 272316, "num_comment": 2, "author": "360安全", "tags": ["系统安全"], "text": "DDG 挖矿僵尸网络累积挖取的门罗币数目较大，到2018年2月，能够确认该僵尸网络累积挖取的已经超过 3,395枚门罗币，折合人民币超过580万元 。"}
{"title": "【议题前瞻】生产网络中的情报价值与应用 | 2018威胁情报&APT攻击技术与趋势高峰论坛", "url": "https://www.freebuf.com/fevents/172633.html", "time": "2018-05-23", "level": "红色标题", "num_look": 127460, "num_comment": 127460, "author": "FB客服", "tags": ["企业安全", "活动"], "text": "对企业而言，已经在生产网络中部署了各种安全设备和防护系统，为什么还需要威胁情报？威胁情报在生产网络中的价值如何体现？在实际生产中如何应用呢？"}
{"title": "事件应急响应管理的5条建议", "url": "https://www.freebuf.com/articles/neopoints/172377.html", "time": "2018-05-23", "level": "", "num_look": 196433, "num_comment": 3, "author": "米雪儿", "tags": ["企业安全", "观点"], "text": "通常来说，应急响应泛指安全技术人员在遇到突发事件后所采取的措施和行为。而突发事件则是指影响一个系统正常工作的情况。"}
{"title": "被黑的Drupal网站被用来挖矿，传播远控，发送诈骗邮件", "url": "https://www.freebuf.com/articles/web/172563.html", "time": "2018-05-23", "level": "", "num_look": 160751, "num_comment": 1, "author": "Sphinx", "tags": ["WEB安全"], "text": "黑客正在利用最近Drupal CMS中的已知漏洞，例如Drupalgeddon2和Drupalgeddon3来传播挖矿软件、远程管理工具（RAT）以及诈骗邮件。"}
{"title": "挖洞经验 | 看我如何免费获取价值€120的会员资格", "url": "https://www.freebuf.com/articles/web/172438.html", "time": "2018-05-23", "level": "", "num_look": 318730, "num_comment": 3, "author": "clouds", "tags": ["WEB安全"], "text": "出于挖洞者的好奇之心，我决定来看看WeTransfer的这种账户管理机制是否存在漏洞。"}
{"title": "新的Mirai僵尸网络至少利用了三个全新漏洞", "url": "https://www.freebuf.com/news/172337.html", "time": "2018-05-23", "level": "", "num_look": 208694, "num_comment": 1, "author": "shidongqi", "tags": ["终端安全", "资讯"], "text": "Fortinet的安全专家发现了一种新的变体Mirai僵尸网络，称为“Wicked Mirai”，它包括新的漏洞同时传播一个新的僵尸程序。"}
{"title": "Linux系统之Redis扩散病毒继续分析", "url": "https://www.freebuf.com/articles/system/171458.html", "time": "2018-05-23", "level": "现金奖励", "num_look": 320793, "num_comment": 2, "author": "cgf99", "tags": ["系统安全"], "text": "现在只要听到客户报告其主机系统出现异常，我们的第一反应就是，是不是又是“挖矿”啊？还真的是，到了现场一看，确实，恭喜“亲”，你又成为辛勤奉献、任劳任怨的苦力小矿工了。"}
{"title": "“海莲花”团伙近期利用Office漏洞发起高频攻击", "url": "https://www.freebuf.com/articles/paper/172222.html", "time": "2018-05-23", "level": "", "num_look": 238710, "num_comment": 4, "author": "Threatbook", "tags": ["安全报告"], "text": "“海莲花”是越南背景的黑客组织。该组织至少自2012年开始活跃，长期针对中国能源相关企业、海事机构、海域建设部门、科研院所和航运企业等进行网络攻击。"}
{"title": "激活工具带毒感染量近60万，刻意避开北京等四城用户", "url": "https://www.freebuf.com/articles/system/172266.html", "time": "2018-05-23", "level": "红色标题", "num_look": 315967, "num_comment": 7, "author": "火绒安全", "tags": ["系统安全"], "text": "近日，火绒安全团队发现，用户在知名下载站\"系统之家\"下载安装\"小马激活\"及\"OFFICE2016\"两款激活工具时，会被植入病毒\"Justler\"，该病毒会劫持用户浏览器首页。"}
{"title": "BUF早餐铺 | 谷歌被指控收集 440 万英国 iPhone 用户数据；英特尔、微软公布芯片漏洞新变体；被黑的 Drupal 用于挖矿，传播 RAT 以及欺诈；黑客因使用 FD改价工具谋利6万元被判刑5年", "url": "https://www.freebuf.com/news/172591.html", "time": "2018-05-23", "level": "", "num_look": 116565, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "自在飞花轻似梦，无边丝雨细如愁。"}
{"title": "SURFSRC | 一个针对“比特票”挖矿木马样本的分析", "url": "https://www.freebuf.com/articles/system/172579.html", "time": "2018-05-22", "level": "", "num_look": 170670, "num_comment": 170670, "author": "任子行", "tags": ["安全报告", "系统安全"], "text": "新的挖矿木马复用了大量开源代码，用于对BTV（“比特票”，一种基于比特币的分支币种）进行挖矿。"}
{"title": "Telegrab恶意软件可以获取Telegram的密码、cookie及密钥文件", "url": "https://www.freebuf.com/news/172255.html", "time": "2018-05-22", "level": "", "num_look": 178908, "num_comment": 2, "author": "Sphinx", "tags": ["资讯"], "text": "思科Talos研究人员发现了名为Telegrab的病毒，这个病毒会从telegram桌面版中窃取信息。"}
{"title": "美团金融招聘高级安全人才（北京、上海)", "url": "https://www.freebuf.com/jobs/172276.html", "time": "2018-05-22", "level": "", "num_look": 162270, "num_comment": 2, "author": "f-offsec", "tags": ["安全招聘"], "text": "作为美团点评战略重点业务之一，金融服务平台致力为用户及商家提供全面、高效、稳定、极致的金融服务，为用户和商家提供智能实效的金融服务，形成美团生态链完美闭环。"}
{"title": "支撑国家网信安全，FreeBuf「政府专区」正式上线", "url": "https://www.freebuf.com/news/172444.html", "time": "2018-05-22", "level": "", "num_look": 146231, "num_comment": 7, "author": "FB客服", "tags": ["资讯"], "text": "「政府专区」是FreeBuf 为国家网络信息安全相关政府机构独立开设的特别栏目，发布权威资讯、政策与观点，为国家网信安全提供坚实媒体支撑。"}
{"title": "从Cloud Foundry谈企业PaaS环境的安全风险与评估", "url": "https://www.freebuf.com/articles/es/172154.html", "time": "2018-05-22", "level": "现金奖励", "num_look": 179032, "num_comment": 2, "author": "ipenox", "tags": ["企业安全"], "text": "PaaS作为应用的运行平台，提供一个操作系统级的容器，在该容器中安装应用运行时所需要的所有依赖，使得开发者可以更加专注于开发任务本身。"}
{"title": "恶意软件的小伎俩，伪装成Cloudflare页面默默挖矿", "url": "https://www.freebuf.com/news/172140.html", "time": "2018-05-22", "level": "", "num_look": 150326, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "FileTour是一种广告软件，通常作为游戏和其他软件的破解或欺骗手段传播。这个软件包是界定于广告软件和PUP以及更危险的计算机感染类型之间，也因此而臭名昭著"}
{"title": "“古惑仔”械斗上演：看Satori僵尸网络如何争夺百万路由器江湖", "url": "https://www.freebuf.com/vuls/172225.html", "time": "2018-05-22", "level": "", "num_look": 172115, "num_comment": 1, "author": "360安全", "tags": ["漏洞"], "text": "可影响百万GPON家用光纤路由器的漏洞（CVE-2018-10561，CVE-2018-10562）曝光,10天内已经有至少5个僵尸网络家族在积极利用该漏洞构建其僵尸军团。"}
{"title": "BUF早餐铺 | 账号被劫？用户微博被曝自动点赞淫秽内容；Facebook安卓应用请求ROOT权限，用户表示很担心；超过2亿套日本人的个人身份信息在地下黑市售卖", "url": "https://www.freebuf.com/news/172412.html", "time": "2018-05-22", "level": "", "num_look": 140351, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "522是16进制的1314，黑客情人节，各位想做点啥？"}
{"title": "CNCERT 2018年第一季度国内操作系统及浏览器占比情况分析", "url": "https://www.freebuf.com/articles/paper/172436.html", "time": "2018-05-21", "level": "", "num_look": 334859, "num_comment": 5, "author": "CNCERT", "tags": ["安全报告"], "text": "国家互联网应急中心对2018年第一季度国内网络访问情况进行了抽样分析，重点针对操作系统及浏览器占比情况进行统计。"}
{"title": "谈谈安全服务“外包”运营之殇", "url": "https://www.freebuf.com/articles/neopoints/172329.html", "time": "2018-05-21", "level": "现金奖励", "num_look": 263934, "num_comment": 8, "author": "雨水", "tags": ["企业安全", "观点"], "text": "随着时代的发展，IT行业的体量在不断扩展，从一开始只有门户网站、办公、协同系统等单一的业务应用，到现在的移动办公、虚拟化、云计算等越来越复杂的IT环境，需要外包的服务类型也越来越多。"}
{"title": "采购端点检测和响应（EDR）工具前必须了解的10个问题", "url": "https://www.freebuf.com/articles/terminal/171042.html", "time": "2018-05-21", "level": "", "num_look": 220260, "num_comment": 220260, "author": "米雪儿", "tags": ["终端安全"], "text": "端点检测和响应（EDR）产品为IT人员提供端点可视性，以检测恶意行为，分析数据以及提供适当的应急响应。"}
{"title": "快讯 | 超过2亿套日本人的个人身份信息（PII）在地下黑市售卖", "url": "https://www.freebuf.com/news/172371.html", "time": "2018-05-21", "level": "", "num_look": 258687, "num_comment": 6, "author": "AngelaY", "tags": ["资讯"], "text": "一份 FireEye iSIGHT Intelligence 报告显示一名疑似来自中国的黑客在地下黑市中兜售超过 2 亿名日本用户的个人身份信息（Personal Identifiable Information, PII）。"}
{"title": "好未来教育集团招聘高级安全渗透工程师", "url": "https://www.freebuf.com/jobs/171815.html", "time": "2018-05-21", "level": "", "num_look": 211456, "num_comment": 36, "author": "100tal", "tags": ["安全招聘"], "text": "好未来是一家中国领先的K12教育科技企业，以科技驱动、人才亲密、品质领先为发展的核心目标。"}
{"title": "Crunch工具的注意点以及与Cupp Cewl的对比", "url": "https://www.freebuf.com/sectool/171843.html", "time": "2018-05-21", "level": "", "num_look": 205222, "num_comment": 1, "author": "一只耗子", "tags": ["工具"], "text": "虽然已经有大佬发布过Crunch工具的基础介绍，不过本文主要介绍Crunch工具使用过程中一些需要注意的问题，并将其与 Cupp Cewl 对比分析。"}
{"title": "技术分析 | 我们来“劫持”个GitHub自定义域名玩吧！", "url": "https://www.freebuf.com/articles/web/171952.html", "time": "2018-05-21", "level": "现金奖励", "num_look": 562138, "num_comment": 6, "author": "evil7", "tags": ["WEB安全"], "text": "作为一个国内外项目都不怎么挖的我，比较喜欢拿自己正在使用的服务入手挖洞，毕竟拥有需求又了解业务才能长期跟进，更好的去发现各种流程上出现的毛病。"}
{"title": "最强后门刷榜病毒，“隐流者”家族盯上70%的国内应用市场", "url": "https://www.freebuf.com/articles/paper/171964.html", "time": "2018-05-21", "level": "", "num_look": 269150, "num_comment": 3, "author": "腾讯手机管家", "tags": ["安全报告"], "text": "名为 “隐流者”的应用刷单病毒将自身隐藏于支付插件中，然后利用SDK混淆,关键信息加密,核心代码剥离，恶意代码分多次下载等技术手段来绕过传统病毒引擎查杀策略。"}
{"title": "老牌黑客Zoz：一百种销毁数据的方法，不如一个有安全意识的你自己", "url": "https://www.freebuf.com/articles/people/172008.html", "time": "2018-05-21", "level": "", "num_look": 272375, "num_comment": 3, "author": "AngelaY", "tags": ["人物志"], "text": "本篇回顾将带大家了解一下那位留着莫西干发型、热情健谈，而且想法和行动都很不拘一格的老牌黑客 Zoz 以及他在大会上的演讲议题：《爆炸：一分钟内销毁存储设备》。"}
{"title": "BUF早餐铺 | SWIFT黑客窃取墨西哥银行约2千万美元资金；Chrome将移除HTTPS页面安全标记；Voice squatting攻击智能助手；顺丰11名员工出售用户信息获刑", "url": "https://www.freebuf.com/news/172287.html", "time": "2018-05-21", "level": "", "num_look": 181200, "num_comment": 3, "author": "AngelaY", "tags": ["资讯"], "text": "一候苦菜秀；二候靡草死；三候麦秋至。"}
{"title": "Huntpad： 一款专为渗透测试人员设计的Notepad应用程序", "url": "https://www.freebuf.com/sectool/171593.html", "time": "2018-05-20", "level": "", "num_look": 374506, "num_comment": 7, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家推荐的是一款名叫Huntpad的Notepad应用程序，Huntpad由Syhunt公司开发，这是一款专为渗透测试人员以及漏洞hunter们提供的实用程序。"}
{"title": "观点|谈谈身份与访问管理（IAM）的12大趋势", "url": "https://www.freebuf.com/articles/neopoints/172184.html", "time": "2018-05-20", "level": "", "num_look": 291446, "num_comment": 291446, "author": "米雪儿", "tags": ["企业安全", "观点"], "text": "在刚结束不久的RSA大会上大量讨论围绕“身份”展开，而且很多公司也开始将自己的产品贴上“身份与访问管理（IAM）”的标签。"}
{"title": "利用OAM加密缺陷漏洞构造任意用户身份测试", "url": "https://www.freebuf.com/vuls/171618.html", "time": "2018-05-20", "level": "", "num_look": 209539, "num_comment": 1, "author": "clouds", "tags": ["漏洞"], "text": "SEC Consult 团队发现了 Oracle Access Manager (OAM) 上的一种有意思的加密格式，本文中，我们将演示如何用这种加密方式的微小特性改变来对实际产品的安全性产生影响。"}
{"title": "Zeus Panda Banker银行木马变种分析", "url": "https://www.freebuf.com/articles/system/171820.html", "time": "2018-05-20", "level": "现金奖励", "num_look": 291848, "num_comment": 1, "author": "neverstop", "tags": ["安全报告", "系统安全"], "text": "新变种病毒Zeus Panda Banker使用了更高强度的代码加密技术，更灵活更强大的恶意插件分发，盗取用户的银行账户、窃取受害者信息，攫取钱财。"}
{"title": "【已结束】2018 FreeTalk北京站开放报名 | 5.20，技术奇境等你来嗨", "url": "https://www.freebuf.com/fevents/169024.html", "time": "2018-05-20", "level": "红色标题", "num_look": 1036815, "num_comment": 18, "author": "FB客服", "tags": ["活动"], "text": "FREE TALK•北京站活动不收取任何费用，免费报名，凭电子票入场。5.20，都是爱你的形状~"}
{"title": "初探Android逆向：通过游戏APP破解引发的安全思考", "url": "https://www.freebuf.com/articles/terminal/172049.html", "time": "2018-05-20", "level": "", "num_look": 347521, "num_comment": 5, "author": "沧海一粟", "tags": ["终端安全"], "text": "如今移动互联网已经完全融入到我们的生活中，各类APP也是层出不穷，因此对于安卓APP安全的研究也尤为重要。"}
{"title": "找出Linux服务器上不该存在恶意或后门文件", "url": "https://www.freebuf.com/articles/system/171580.html", "time": "2018-05-20", "level": "", "num_look": 206684, "num_comment": 206684, "author": "secist", "tags": ["系统安全"], "text": "这篇文章主要是向大家介绍一些有关检查Linux系统恶意软件的技巧和方法。"}
{"title": "罗技智能家居管理系统（Logitech Harmony Hub）漏洞分析", "url": "https://www.freebuf.com/articles/wireless/171257.html", "time": "2018-05-19", "level": "", "num_look": 305345, "num_comment": 305345, "author": "clouds", "tags": ["无线安全"], "text": "近期，火眼公司Mandiant Red Team团队发现，罗技智能物联网家居管理系统Logitech Harmony Hub存在多个可利用漏洞。"}
{"title": "13年前的安全配置缺陷仍影响着目前多数SAP系统", "url": "https://www.freebuf.com/articles/system/171668.html", "time": "2018-05-19", "level": "", "num_look": 246369, "num_comment": 246369, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "根据Onapsis的最新调查发现，当初2005年被发现的一个安全配置漏洞现在仍影响着当前绝大多数的SAP系统。"}
{"title": "Burp XXE Scanner 插件开发（附下载）", "url": "https://www.freebuf.com/sectool/171123.html", "time": "2018-05-19", "level": "", "num_look": 410480, "num_comment": 14, "author": "lufei", "tags": ["工具"], "text": "Burp没有自带检测XXE漏洞功能，也没有插件。于是自己开始动手撸一个XXE Scanner插件出来。"}
{"title": "【已结束】2018漏洞盒子 | 漏洞马拉松线下赛图文直播", "url": "https://www.freebuf.com/fevents/172076.html", "time": "2018-05-19", "level": "红色标题", "num_look": 366922, "num_comment": 10, "author": "AngelaY", "tags": ["活动"], "text": "2018年漏洞马拉松线下邀请赛于 5 月 19 日 8:30 到 5 月 20 日 13：00 在北京·优客工场举行。"}
{"title": "现实版天眼系统，一个漏洞让小白都能追踪上亿美国人实时定位", "url": "https://www.freebuf.com/news/172265.html", "time": "2018-05-18", "level": "红色标题", "num_look": 368225, "num_comment": 6, "author": "shidongqi", "tags": ["资讯"], "text": "一家收集北美多达2亿手机用户的实时定位数据的公司，网站上出现了一个漏洞，任何人都可以在未经同意的情况下查看一个人的定位，并且使用门槛极低，堪称简化版天眼系统。"}
{"title": "看我如何获取Chef服务器的Meterpreter Shell", "url": "https://www.freebuf.com/articles/es/171602.html", "time": "2018-05-18", "level": "", "num_look": 268559, "num_comment": 1, "author": "secist", "tags": ["企业安全"], "text": "这篇文章主要是想警告使用Chef的朋友，你们的管理员账户很可能早已在Chef web interface中泄露。管理员通常无法设置默认管理凭据。在这种情况下，Chef server主页将为你提供。"}
{"title": "一项有趣的实验：装了杀软的主机真的安全吗？", "url": "https://www.freebuf.com/articles/system/171987.html", "time": "2018-05-18", "level": "现金奖励", "num_look": 581605, "num_comment": 27, "author": "scu-igroup", "tags": ["系统安全", "观点"], "text": "大部分人都是采用重打包后的镜像来安装的盗版系统；用的不知从哪儿下回来的工具激活的系统；平常在网上下载的工具奉行的都是能用就行的原则。这样的主机真的安全吗？"}
{"title": "DLINK DCS-5020L无线云摄像机远程代码执行漏洞分析", "url": "https://www.freebuf.com/articles/network/170821.html", "time": "2018-05-18", "level": "", "num_look": 317319, "num_comment": 2, "author": "secist", "tags": ["网络安全"], "text": "本文主要是向大家演示，如何找到物联网（IOT）设备中的漏洞。"}
{"title": "360信息安全部招聘安全人才", "url": "https://www.freebuf.com/jobs/171661.html", "time": "2018-05-18", "level": "", "num_look": 335632, "num_comment": 4, "author": "360HR77喵", "tags": ["安全招聘"], "text": "360信息安全部成立于2007年，十年来，随着公司业务的不断扩大，信息安全部被赋予了更多的责任。"}
{"title": "VulnHub渗透测试实战靶场Breach 1.0", "url": "https://www.freebuf.com/articles/system/171318.html", "time": "2018-05-18", "level": "现金奖励", "num_look": 679692, "num_comment": 5, "author": "Setup", "tags": ["系统安全"], "text": "Vulnhub是一个提供各种漏洞环境的靶场平台，供安全爱好者学习渗透使用，大部分环境是做好的虚拟机镜像文件。"}
{"title": "Burpsuit结合SQLMapAPI产生的批量注入插件（X10）", "url": "https://www.freebuf.com/articles/web/171622.html", "time": "2018-05-18", "level": "红色标题", "num_look": 352227, "num_comment": 9, "author": "Chris_D", "tags": ["WEB安全"], "text": "为了做一点连续性事情，所以尝试着不段完善这个插件并优化其中的设置。"}
{"title": "漏洞预警 | Linux内核出现多个漏洞", "url": "https://www.freebuf.com/vuls/172004.html", "time": "2018-05-18", "level": "", "num_look": 377168, "num_comment": 1, "author": "奇安信代码卫士", "tags": ["漏洞"], "text": "Linux是一种开源电脑操作系统内核。它是一个用C语言写成，符合POSIX标准的类Unix操作系统。漏洞发生在 Linux 内核中，可造成越界访问或释放后再使用的安全问题。"}
{"title": "Bondat蠕虫难挡利益诱惑，锁主页挖矿勒索危害逐步升级", "url": "https://www.freebuf.com/news/172070.html", "time": "2018-05-18", "level": "", "num_look": 250110, "num_comment": 250110, "author": "腾讯电脑管家", "tags": ["资讯"], "text": "借助U盘、移动硬盘传播的Bondat蠕虫病毒呈活跃趋势。该蠕虫构建的僵尸网络不仅通过浏览器执行JS挖矿木马，还会传播GandCrab3勒索病毒。"}
{"title": "BUF早餐铺 | ZipperDown漏洞影响10% iOS软件；谷歌修复导致数百万网页游戏崩溃的Chrome漏洞；美国参议院投票支持保留《网络中立法》", "url": "https://www.freebuf.com/news/172077.html", "time": "2018-05-18", "level": "", "num_look": 183316, "num_comment": 3, "author": "Akane", "tags": ["资讯"], "text": "白日放歌须纵酒，青春作伴好还乡。又逢周五放风日，漫卷诗书喜欲狂。"}
{"title": "24小时「漏洞饥饿游戏」激情与奖金全都有！", "url": "https://www.freebuf.com/fevents/172155.html", "time": "2018-05-17", "level": "", "num_look": 195162, "num_comment": 2, "author": "FB客服", "tags": ["活动"], "text": "2018年漏洞马拉松线下邀请赛要开始了！好胆你就来~"}
{"title": "如何利用Struts2漏洞绕过防火墙获取Root权限", "url": "https://www.freebuf.com/articles/web/170792.html", "time": "2018-05-17", "level": "红色标题", "num_look": 479107, "num_comment": 11, "author": "clouds", "tags": ["WEB安全"], "text": "本文我要分享的是关于Apache struts2 CVE-2013–2251漏洞的，由于该漏洞可以导致远程代码执行，曾一度被广泛滥用。"}
{"title": "前方告急 | FreeBuf招聘站200余家厂商简历持续接收中", "url": "https://www.freebuf.com/fevents/172110.html", "time": "2018-05-17", "level": "", "num_look": 153659, "num_comment": 1, "author": "FB招聘小助手", "tags": ["活动"], "text": "FreeBuf招聘站简历攻略tips了解一下~"}
{"title": "HeapViewer：一款专注于漏洞利用开发的IDA Pro插件", "url": "https://www.freebuf.com/sectool/171632.html", "time": "2018-05-17", "level": "", "num_look": 305441, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫 HeapViewer 的 IDA Pro 插件，它是一款专注于漏洞利用开发的工具，可用于对 glibc 堆进行测试。"}
{"title": "人人车招聘安全工程师", "url": "https://www.freebuf.com/jobs/171584.html", "time": "2018-05-17", "level": "", "num_look": 202092, "num_comment": 14, "author": "喵喵", "tags": ["安全招聘"], "text": "人人车二手车致力于打造全新的个人二手车交易模式，帮助人人车用户买车、卖车、二手车评估、二手车检测。"}
{"title": "Totel Meltdown（CVE-2018-1038 ）漏洞利用", "url": "https://www.freebuf.com/vuls/171592.html", "time": "2018-05-17", "level": "金币+5", "num_look": 291156, "num_comment": 4, "author": "无。", "tags": ["漏洞"], "text": "微软发布了一个补丁来修复之前爆出的「Meltdown」漏洞，然后这个补丁却不经意导致了新的问题，让任意进程可以读取和修改页表项目。"}
{"title": "Janus签名漏洞(CVE-2017-13156)原理与利用分析", "url": "https://www.freebuf.com/articles/terminal/171835.html", "time": "2018-05-17", "level": "现金奖励", "num_look": 617177, "num_comment": 5, "author": "Tasfa", "tags": ["终端安全"], "text": "Janus签名漏洞可以让攻击者绕过安卓系统的signature scheme V1签名机制，进而直接对App进行篡改。而且由于安卓系统的其他安全机制也是建立在签名和校验基础之上，该漏洞相当于绕过了安卓系统的整个安全机制。"}
{"title": "端口转发流量操控工具总结", "url": "https://www.freebuf.com/articles/web/171589.html", "time": "2018-05-17", "level": "", "num_look": 494908, "num_comment": 2, "author": "tdcoming", "tags": ["WEB安全"], "text": "在 Web 安全渗透测试经常会面临的一个问题，同时也是 Web 服务器加固方面一个很重要的部分，那就是 Web 服务器对外只开放一个 80 端口。"}
{"title": "LG智能手机爆出两个远程代码执行漏洞", "url": "https://www.freebuf.com/articles/terminal/171642.html", "time": "2018-05-17", "level": "金币+5", "num_look": 245217, "num_comment": 2, "author": "JingleCats", "tags": ["终端安全"], "text": "Check Point 的研究员发现了 LG（也称为 LGEIME）智能手机的两个漏洞，这些漏洞都存在于默认的键盘上，而且是 LG 设备独有的。"}
{"title": "BUF早餐铺 | 扎克伯格拒绝参加英国听证会，恐有被捕风险;黑客无意泄露两个0-day，被研究人员抓个正着；DDoS攻击利用UPnP协议绕过防御;荷兰政府将逐步弃用卡巴斯基", "url": "https://www.freebuf.com/news/171983.html", "time": "2018-05-17", "level": "", "num_look": 184937, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "盛夏将至，愿每日的BUF早餐铺能给你带来一丝舒爽。PS：萌系配图内附高清原图下载"}
{"title": "iOS ZipperDown 漏洞来袭，我们该如何应对？", "url": "https://www.freebuf.com/articles/neopoints/172058.html", "time": "2018-05-16", "level": "", "num_look": 199596, "num_comment": 1, "author": "360NirvanTeam", "tags": ["观点"], "text": "目前官方没有公开 ZipperDown 的详细信息，这里跟大家分享、探讨一下针对 iOS 应用的防守策略以及针对具体功能点的防守方法。"}
{"title": "DDoS放大攻击新手段：利用UPnP协议绕过防御", "url": "https://www.freebuf.com/news/171992.html", "time": "2018-05-16", "level": "", "num_look": 297513, "num_comment": 297513, "author": "Sphinx", "tags": ["资讯"], "text": "研究人员发现，黑客现在采用新的手段来对抗反DDoS方案。黑客会使用通用即插即用（UPnP）协议来掩盖网络数据包的源端口。"}
{"title": "【议题前瞻】企业内网“反APT实践” | 2018威胁情报&APT攻击技术与趋势高峰论坛", "url": "https://www.freebuf.com/fevents/172001.html", "time": "2018-05-16", "level": "红色标题", "num_look": 261540, "num_comment": 2, "author": "FB客服", "tags": ["企业安全", "活动"], "text": "2018年5月31日，京东安全战略官吉贻俊先生将带来主题为「内网反APT实践」演讲，为大家分享京东在检测防御APT攻击行为方面的措施和实践经验。"}
{"title": "挖洞经验 | 看我如何在前期踩点过程中发现价值$4500的漏洞", "url": "https://www.freebuf.com/articles/network/171219.html", "time": "2018-05-16", "level": "", "num_look": 345830, "num_comment": 3, "author": "clouds", "tags": ["网络安全"], "text": "本文中我描述了在某漏洞赏金邀请项目中，在前期侦察踩点阶段就发现Uber子域名劫持漏洞的一个案例，漏洞原因由于Uber在暂停AWS服务后，未及时删除CNAME域名记录所致。"}
{"title": "Kuik：一款简单但是烦人的Adware", "url": "https://www.freebuf.com/articles/system/171441.html", "time": "2018-05-16", "level": "", "num_look": 382903, "num_comment": 382903, "author": "secist", "tags": ["系统安全"], "text": "某些恶意软件虽然非常简单，但一旦被感染上之后我们往往需要耗费很大的精力才能将其清除，尤其是当它们开始干扰你系统配置时。"}
{"title": "内网渗透之端口转发与代理工具总结", "url": "https://www.freebuf.com/articles/web/170970.html", "time": "2018-05-16", "level": "现金奖励", "num_look": 1581582, "num_comment": 17, "author": "Brucetg", "tags": ["WEB安全"], "text": "理论上，任何接入互联网的计算机都是可访问的，但是如果目标主机处于内网，而我们又想和该目标主机进行通信的话，就需要借助一些端口转发工具来达到我们的目的。"}
{"title": "亚信安全解读“网络空间恢复补救能力”：安全产业未来战略新动向", "url": "https://www.freebuf.com/articles/network/171758.html", "time": "2018-05-16", "level": "", "num_look": 195315, "num_comment": 4, "author": "shidongqi", "tags": ["网络安全"], "text": "现如今的网络安全更多的是强调如何防御，如人的健康状况一样，所有人都希望在疾病到来之前做好保护。而当真正面临恶意攻击，我们在应对灾难以及灾难发生后的状况却显得非常脆弱。"}
{"title": "诺亚控股诚聘安全技术经理", "url": "https://www.freebuf.com/jobs/171704.html", "time": "2018-05-16", "level": "", "num_look": 179089, "num_comment": 13, "author": "noahwmIS", "tags": ["安全招聘"], "text": "公司定位于新一代综合金融服务提供商，业务范围涵盖财富管理、资产管理、互联网金融和全球开放性平台等，是拥有资产管理能力的、领先的独立财富管理机构。"}
{"title": "邮件形同裸奔，PGP 与 S/MIME 加密协议被曝严重漏洞", "url": "https://www.freebuf.com/news/171834.html", "time": "2018-05-16", "level": "", "num_look": 190639, "num_comment": 190639, "author": "shidongqi", "tags": ["资讯"], "text": "由9名学者组成的团队向全世界发出警告，OpenPGP和S / MIME电子邮件加密工具中的严重漏洞。"}
{"title": "黑客也乌龙 | 上传恶意文件时无意泄露两个0-day，被研究人员抓个正着", "url": "https://www.freebuf.com/news/171954.html", "time": "2018-05-16", "level": "红色标题", "num_look": 326984, "num_comment": 14, "author": "AngelaY", "tags": ["资讯"], "text": "一个未知的黑客组织在向公开恶意软件扫描引擎上传一个用于攻击的 PDF 文件时，无意间泄露了两个 0-day 漏洞。漏洞被研究人员捕获，并及时上报给厂商修复。"}
{"title": "利用LLMNR结合PDF文件获取PC Hashes", "url": "https://www.freebuf.com/articles/network/171634.html", "time": "2018-05-16", "level": "金币+5", "num_look": 182410, "num_comment": 3, "author": "biock", "tags": ["网络安全"], "text": "LLMNR（Link-Local Multicast Name Resolution，链路本地多播名称解析）协议是一种基于DNS包格式的协议。它可以将主机名解析为IPv4和IPv6的IP地址。"}
{"title": "威胁预警 | 通过知名远程桌面工具传播的BlackRouter勒索病毒", "url": "https://www.freebuf.com/articles/system/171233.html", "time": "2018-05-16", "level": "", "num_look": 262104, "num_comment": 2, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "最近国外某安全公司发现新的勒索病毒样本，新发现的BlackRouter勒索软件通过与知名的远程桌面工具AnyDesk捆绑进行传播。"}
{"title": "GPON Home Gateway远程命令执行漏洞分析", "url": "https://www.freebuf.com/vuls/171457.html", "time": "2018-05-16", "level": "", "num_look": 319904, "num_comment": 1, "author": "Knownsec知道创宇", "tags": ["漏洞"], "text": "2018/04/30，vpnMentor 公布了 GPON 路由器的高危漏洞：验证绕过漏洞 (CVE-2018-10561) 和命令注入漏洞 (CVE-2018-10562)。"}
{"title": "BUF早餐铺 | 加密协议PGP 与 S/MIME被曝明文漏洞；Adobe修复近50个漏洞；Nigelthorn恶意软件感染10万多个系统；国民老公隐私信息泄露", "url": "https://www.freebuf.com/news/171844.html", "time": "2018-05-16", "level": "", "num_look": 161389, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "四月樱桃红满市，雪片鲥鱼刀。"}
{"title": "安卓、iOS双平台现重大安全漏洞，微博、网易云音乐等大型应用均受影响", "url": "https://www.freebuf.com/news/171914.html", "time": "2018-05-15", "level": "红色标题", "num_look": 529668, "num_comment": 6, "author": "shidongqi", "tags": ["资讯"], "text": "在iOS 应用安全审计中发现一类通用安全漏洞，在不安全的WIFI环境下载使用微博，攻击者可以获取微博中任意代码执行能力，并且在安卓平台发现了类似漏洞。"}
{"title": "黑客公布Signal通讯软件中的代码注入攻击", "url": "https://www.freebuf.com/news/171824.html", "time": "2018-05-15", "level": "", "num_look": 236148, "num_comment": 236148, "author": "Sphinx", "tags": ["资讯"], "text": "继eFail攻击细节泄露之后，加密通讯软件Signal的代码注入漏洞也被公开。"}
{"title": "Z3Py在CTF逆向中的运用", "url": "https://www.freebuf.com/articles/database/170814.html", "time": "2018-05-15", "level": "金币+3", "num_look": 365138, "num_comment": 9, "author": "foyjog", "tags": ["数据安全"], "text": "Z3是Microsoft Research开发的高性能定理证明器。"}
{"title": "VulnHub渗透实战Billu_b0x", "url": "https://www.freebuf.com/sectool/170713.html", "time": "2018-05-15", "level": "金币+3", "num_look": 518145, "num_comment": 14, "author": "Setup", "tags": ["工具"], "text": "VulnHub是一个面向所有人开放的安全靶场，里面有好多安全环境，只要下载相关镜像，在相关虚拟机上面运行就可以练习相关靶场了。"}
{"title": "Linux下的字典生成工具Crunch，创造自己的专属字典", "url": "https://www.freebuf.com/sectool/170817.html", "time": "2018-05-15", "level": "金币+3", "num_look": 556267, "num_comment": 3, "author": "romantickiller", "tags": ["工具"], "text": "Crunch是一种创建密码字典工具，按照指定的规则生成密码字典，可以灵活的制定自己的字典文件。使用Crunch工具生成的密码可以输出到屏幕，保存到文件、或另一个程序。"}
{"title": "360 Marvel Team招聘安全人员", "url": "https://www.freebuf.com/jobs/171462.html", "time": "2018-05-15", "level": "", "num_look": 173978, "num_comment": 6, "author": "360HR77喵", "tags": ["安全招聘"], "text": "360 Marvel Team是一支专门致力于云安全领域虚拟化平台攻防技术、脆弱性安全风险发现和防护能力的研究团队。"}
{"title": "ATBroker.exe：一个被病毒利用的微软进程", "url": "https://www.freebuf.com/articles/system/171437.html", "time": "2018-05-15", "level": "现金奖励", "num_look": 821539, "num_comment": 31, "author": "ozczzzz", "tags": ["系统安全"], "text": "一般情况下，病毒会利用添加启动项、计划任务、服务的方式来实现开机启动，达到留存和活跃的目的。然而，利用atbroker.exe系统进程，实现病毒开机启动的方式并不常见。"}
{"title": "GPON漏洞的在野利用（一）：Muhstik僵尸网络", "url": "https://www.freebuf.com/articles/network/171491.html", "time": "2018-05-15", "level": "", "num_look": 204159, "num_comment": 1, "author": "360安全", "tags": ["网络安全"], "text": "自从本次 GPON 漏洞公布以来，10 天内已经有至少 5 个僵尸网络家族在积极利用该漏洞构建其僵尸军团，包括 mettle、muhstik、mirai、hajime、satori。"}
{"title": "某工业组态软件整数溢出漏洞（CVE-2018-7471）分析", "url": "https://www.freebuf.com/vuls/169814.html", "time": "2018-05-15", "level": "金币+3", "num_look": 202167, "num_comment": 1, "author": "flypuma", "tags": ["漏洞"], "text": "某公司工业组态软件存在整数溢出漏洞，该漏洞是由于stgopenstorage读取失败，返回的错误代码超出int在32位系统中的范围，攻击者可利用该漏洞执行任意代码。"}
{"title": "BUF早餐铺 | 近400个政企网站感染Coinhive恶意软件，秘密挖掘加密货币；Ubuntu Snap商店中发现恶意软件；恶意应用只需通过更改其名称即可重新上架Play商店", "url": "https://www.freebuf.com/news/171679.html", "time": "2018-05-15", "level": "", "num_look": 137469, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "安全漏洞影响基于Electron的应用；网络安全应急保障体系建设论坛在三亚举行。"}
{"title": "又见卡死图，竟然一个“小黑点”就能干掉QQ？", "url": "https://www.freebuf.com/articles/system/171435.html", "time": "2018-05-14", "level": "现金奖励", "num_look": 707994, "num_comment": 13, "author": "十页书", "tags": ["系统安全"], "text": "前一阵子QQ群里流行了一个东西，一段话加上一个黑点（表情）。点击之后QQ就会卡死。"}
{"title": "FreeTalk超强彩蛋 | FreeBuf招聘站首期线下双选会【北京站预约报名】", "url": "https://www.freebuf.com/fevents/170934.html", "time": "2018-05-14", "level": "红色标题", "num_look": 281085, "num_comment": 5, "author": "FB招聘小助手", "tags": ["活动"], "text": "首期FB招聘站线下双选会，现场交流名企技术大佬与HR"}
{"title": "CTF实战 | Kioptrix（#3）靶机渗透测试", "url": "https://www.freebuf.com/news/170656.html", "time": "2018-05-14", "level": "金币+3", "num_look": 525350, "num_comment": 7, "author": "D3ck", "tags": [], "text": "本文主要分享 Kioptrix level 3 层面的靶机渗透测试。"}
{"title": "Ubuntu Snap商店中被发现恶意软件", "url": "https://www.freebuf.com/news/171656.html", "time": "2018-05-14", "level": "", "num_look": 220277, "num_comment": 2, "author": "Sphinx", "tags": ["资讯"], "text": "Chrome、Android、iOS，应用商店纷纷沦陷，这下轮到了Ubuntu。"}
{"title": "简单分析SQL注入语义分析库Libinjection", "url": "https://www.freebuf.com/articles/web/170930.html", "time": "2018-05-14", "level": "金币+5", "num_look": 394347, "num_comment": 2, "author": "chenjc", "tags": ["WEB安全"], "text": "这次主要讲开源SQL注入语义分析库libinjection，如果有发现其他开源SQL语义分析库的欢迎告知。"}
{"title": "近400个政企网站感染Coinhive恶意软件，秘密挖掘加密货币", "url": "https://www.freebuf.com/news/171639.html", "time": "2018-05-14", "level": "红色标题", "num_look": 177697, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "Coinhive 恶意软件感染近 400 个网站，其中包括美国政府、联想和洛杉矶分校的网站。"}
{"title": "墨云科技高薪招聘应届安全大牛", "url": "https://www.freebuf.com/jobs/171403.html", "time": "2018-05-14", "level": "", "num_look": 195382, "num_comment": 2, "author": "Moyun墨云科技", "tags": ["安全招聘"], "text": "“墨云科技”是全球首家研发出“模拟黑客机器人Vackbot”，并致力于打造人工智能网络攻击和网络安全验证服务体系相结合的高科技网络安全公司。"}
{"title": "【议题公布】全面探讨威胁情报&APT分析检测在企业中的落地 | FreeBuf企业安全俱乐部", "url": "https://www.freebuf.com/fevents/171328.html", "time": "2018-05-14", "level": "红色标题", "num_look": 320801, "num_comment": 320801, "author": "FB客服", "tags": ["企业安全", "活动"], "text": "2018威胁情报&APT攻击技术与趋势高峰论坛议题公布 ！"}
{"title": "伪造微软等企业签名，恶性病毒窃取比特币疯狂挖矿", "url": "https://www.freebuf.com/articles/web/171128.html", "time": "2018-05-14", "level": "", "num_look": 272164, "num_comment": 2, "author": "火绒安全", "tags": ["WEB安全", "安全报告"], "text": "病毒破坏性极强，入侵用户电脑后会执行多种病毒模块，以窃取用户比特币、门罗币等主流虚拟货币的数据信息，同时利用用户电脑疯狂挖矿。"}
{"title": "CNCERT发布2017年我国互联网网络安全态势报告", "url": "https://www.freebuf.com/articles/paper/171706.html", "time": "2018-05-14", "level": "", "num_look": 220974, "num_comment": 220974, "author": "CNCERT", "tags": ["安全报告"], "text": "2018年4月25日，国家互联网应急中心在京发布《2017年我国互联网网络安全态势报告》，该报告基于CNCERT监测统计数据，结合日常应急处置工作实践编撰而成。"}
{"title": "CVE-2018-2628补丁绕过分析与修复建议", "url": "https://www.freebuf.com/articles/system/171195.html", "time": "2018-05-14", "level": "现金奖励", "num_look": 365019, "num_comment": 2, "author": "sunyz2", "tags": ["系统安全"], "text": "Oracle官方发布了关键补丁更新，其中包含了OracleWebLogic Server的一个高危反序列化漏洞，通过该漏洞，攻击者可以在未授权的情况下远程执行代码。"}
{"title": "挖矿僵尸网络现形记，已感染至少2万台服务器", "url": "https://www.freebuf.com/articles/network/171031.html", "time": "2018-05-14", "level": "现金奖励", "num_look": 309334, "num_comment": 4, "author": "ziluobu", "tags": ["网络安全"], "text": "向心力安全团队通过流量监控设备发现某台服务器被入侵，服务器存在恶意文件，一直在向外请求数据包。"}
{"title": "BUF早餐铺 | 央视曝光170号段手机号加价50元就可不实名；Google Chrome 66稳定版更新：修复四大严重安全漏洞；26％的公司忽略安全漏洞，借口是没有时间去修复", "url": "https://www.freebuf.com/news/171531.html", "time": "2018-05-14", "level": "", "num_look": 173423, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "每天关注BUF早餐铺，你会发现，看似风平浪静的安全圈，其实一直都暗流涌动。"}
{"title": "如何将威胁情报整合到安全意识项目中？", "url": "https://www.freebuf.com/articles/neopoints/171063.html", "time": "2018-05-13", "level": "", "num_look": 246178, "num_comment": 246178, "author": "米雪儿", "tags": ["观点"], "text": "网络威胁情报（Cyber threat intelligence，简称CTI）以及作为其立足根基的安全运营正在更为广泛的业务体系中快速增长。"}
{"title": "一记组合拳，批量SSH弱密码爆破检测工具分享", "url": "https://www.freebuf.com/sectool/170779.html", "time": "2018-05-13", "level": "金币+5", "num_look": 925804, "num_comment": 11, "author": "scu-igroup", "tags": ["工具"], "text": "SSH登录密码的破解工具已然有许多，但偶尔还是存在不能满足任务需求的情况。比如，批量地对IP列表里的IP地址进行SSH登录破解，现有的工具直接使用起来总觉得不方便。"}
{"title": "信安入门神级书单了解一下？", "url": "https://www.freebuf.com/news/171101.html", "time": "2018-05-13", "level": "红色标题", "num_look": 830696, "num_comment": 14, "author": "网络安全通", "tags": [], "text": "学习信息安全，却又苦于入门不得法？也许，你需要这份神级书单带领你走向人生巅峰！"}
{"title": "Windows漏洞利用开发教程 Part 4：SEH", "url": "https://www.freebuf.com/articles/system/170703.html", "time": "2018-05-13", "level": "现金奖励", "num_look": 356948, "num_comment": 10, "author": "zusheng", "tags": ["系统安全"], "text": "我花了大量的时间来研究了计算机安全领域Windows漏洞利用开发，希望能和大家分享一下，能帮助到对这方面感兴趣的朋友，如有不足，还请见谅。"}
{"title": "我在大会现场开锁成功，感觉自己的黑客梦还能抢救一下", "url": "https://www.freebuf.com/fevents/171597.html", "time": "2018-05-13", "level": "红色标题", "num_look": 318914, "num_comment": 5, "author": "AngelaY", "tags": ["活动"], "text": "国外对于安全与黑客的定义很广泛，在互联网之外，依然有很多可以破解的事物。DEFCON 的众多议题和 Village，也倡导大家追求探索与创造的精神。"}
{"title": "2018年一季度移动应用安全态势报告", "url": "https://www.freebuf.com/articles/paper/170719.html", "time": "2018-05-12", "level": "", "num_look": 293143, "num_comment": 2, "author": "通付盾", "tags": ["安全报告"], "text": "通付盾移动安全实验室最新发布《2018年一季度移动应用安全态势报告》,从移动应用数据安全出发，以“隐私数据保护之殇”为主题，揭示2018年一季度移动安全整体态势。"}
{"title": "迅速崛起的智慧城市及其相关风险", "url": "https://www.freebuf.com/articles/neopoints/171251.html", "time": "2018-05-12", "level": "", "num_look": 209005, "num_comment": 1, "author": "米雪儿", "tags": ["观点"], "text": "所谓智慧城市，就是运用信息和通信技术手段感测、分析、整合城市运行核心系统的各项关键信息，从而对包括民生、环保、公共安全在内的各种需求做出智能响应。"}
{"title": "【FB TV】一周「BUF大事件」：全球顶级安全会议DEF CON CHINA在京召开；英特尔处理器再现严重漏洞，官方回应紧急修复", "url": "https://www.freebuf.com/video/171497.html", "time": "2018-05-12", "level": "红色标题", "num_look": 249699, "num_comment": 4, "author": "willhuang", "tags": ["视频"], "text": "本周全球安全领域顶级会议DEF CON CHINA于北京举行，大牛云集，盛况空前；英特尔处理器再现严重漏洞，官方回应紧急修复。"}
{"title": "暗网儿童个人信息数据增长182%，儿童身份盗用成为获利新手段", "url": "https://www.freebuf.com/news/171383.html", "time": "2018-05-12", "level": "", "num_look": 234107, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "4iQ是一家身份威胁情报公司，负责监控互联网上的数据泄露情况。最新的4iQ身份盗用报告显示，2016年至2017年期间，其团队发现泄露的身份信息增加了182％。"}
{"title": "Burp Xss Scanner插件开发思路分享（附下载）", "url": "https://www.freebuf.com/articles/web/170884.html", "time": "2018-05-12", "level": "现金奖励", "num_look": 333890, "num_comment": 5, "author": "lufei", "tags": ["WEB安全"], "text": "Burp虽然自带xss检测，但是Pyload与数量都不是自己能掌控的。所以自己写一款Xss检测插件，对一个参数进行测试的时候，要求只能发送一次Payload，而且能够对Dom Xss进行检测。"}
{"title": "DEFCON CHINA首日纪实 | 好奇心与探索，追求极客精神的本质", "url": "https://www.freebuf.com/news/171575.html", "time": "2018-05-12", "level": "红色标题", "num_look": 260591, "num_comment": 4, "author": "AngelaY", "tags": ["活动", "资讯"], "text": "我认为DEFCON应该专注于挖掘人、探索人。我们想要帮助大家来发掘新的东西、发现新的东西，大家一块来发掘，相互来学习。"}
{"title": "TreasureHunter PoS恶意软件的源代码泄露", "url": "https://www.freebuf.com/news/171492.html", "time": "2018-05-12", "level": "", "num_look": 262970, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "Flashpoint的安全专家确认，TreasureHunter PoS恶意软件源代码的确从三月份开始就被泄露在网上。"}
{"title": "APT-C-06组织在全球范围内首例使用“双杀”0day漏洞(CVE-2018-8174)发起的APT攻击分析及溯源", "url": "https://www.freebuf.com/articles/paper/171254.html", "time": "2018-05-12", "level": "", "num_look": 470394, "num_comment": 5, "author": "360安全", "tags": ["安全报告"], "text": "360安全团队在全球范围内率先监控到了一例使用0day漏洞的APT攻击，捕获到了全球首例利用浏览器0day漏洞的新型Office文档攻击，并将其命名为“双杀”漏洞。"}
{"title": "26％的公司忽略安全漏洞，借口是没有时间去修复", "url": "https://www.freebuf.com/news/171459.html", "time": "2018-05-11", "level": "红色标题", "num_look": 270715, "num_comment": 5, "author": "shidongqi", "tags": ["资讯"], "text": "调查显示，并非所有公司都使用补丁。大约26％的受访者表示，他们的公司忽视了一个严重的安全漏洞，因为他们没有时间去修复它。"}
{"title": "GhostMiner解析：无文件挖矿的新姿势", "url": "https://www.freebuf.com/articles/blockchain-articles/170807.html", "time": "2018-05-11", "level": "", "num_look": 393524, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["区块链安全"], "text": "近期，Minerva的研究团队又发现了一种新的挖矿攻击-GhostMiner，这种新型的恶意挖矿软件主要挖的是门罗币，它使用了高级无文件技术，并能够在全球范围内悄无声息地传播。"}
{"title": "改机工具在黑灰产中的应用", "url": "https://www.freebuf.com/articles/terminal/171414.html", "time": "2018-05-11", "level": "", "num_look": 469949, "num_comment": 1, "author": "永安在线", "tags": ["终端安全"], "text": "在网约车入局者为市场拼死战斗的同时，另一群人兴奋了——网约车黑灰产从业者。巨大的流量和资金补贴强有力的吸引着黑产的目光。"}
{"title": "局域网中使用Http透明代理替换文件下载", "url": "https://www.freebuf.com/articles/network/170806.html", "time": "2018-05-11", "level": "金币+20", "num_look": 391175, "num_comment": 5, "author": "SmilingCat", "tags": ["网络安全"], "text": "假想我们在局域网内有一台机器,然后通过Http透明代理做些事情吧......"}
{"title": "挖洞经验 | 看我如何发现雅虎网站的3个RCE漏洞", "url": "https://www.freebuf.com/articles/web/170855.html", "time": "2018-05-11", "level": "", "num_look": 479676, "num_comment": 3, "author": "clouds", "tags": ["WEB安全"], "text": "今天我要分享的是，我参与雅虎漏洞赏金项目发现的3个RCE漏洞。雅虎漏洞测试范围中涉及了很多服务应用，而我发现的漏洞就与雅虎的BrightRoll应用和中小企业服务相关。"}
{"title": "钉钉招聘安全相关领域专家", "url": "https://www.freebuf.com/jobs/170940.html", "time": "2018-05-11", "level": "", "num_look": 205515, "num_comment": 2, "author": "wyl091256", "tags": ["安全招聘"], "text": "钉钉（DingTalk）是中国领先的智能移动办公平台，由阿里巴巴集团开发，免费提供给所有中国企业，用于商务沟通和工作协同。"}
{"title": "WannaCry蠕虫一周年，勒索病毒狼烟四起", "url": "https://www.freebuf.com/articles/system/171448.html", "time": "2018-05-11", "level": "", "num_look": 379529, "num_comment": 3, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "去年5月12日，WannaCry蠕虫在全球范围大爆发，引爆互联网行业的“生化危机”。借助“永恒之蓝”高危漏洞传播的WannaCry在数小时内影响近150个国家。"}
{"title": "95行代码破解极验？可能还不够", "url": "https://www.freebuf.com/articles/web/171440.html", "time": "2018-05-11", "level": "红色标题", "num_look": 386217, "num_comment": 12, "author": "GEETEST极验", "tags": ["WEB安全"], "text": "作为全国市场占有率第一的交互安全服务商，有关方面针对极验旗下“行为验证”产品的研究工作从未停止。"}
{"title": "PentesterLab新手教程（四）：文件包含", "url": "https://www.freebuf.com/news/170802.html", "time": "2018-05-11", "level": "金币+3", "num_look": 334501, "num_comment": 2, "author": "婷儿小跟班✧", "tags": [], "text": "Web for pentester 是国外安全研究者开发的的一款渗透测试平台。"}
{"title": "普通用户借助Docker容器提权思路分享", "url": "https://www.freebuf.com/articles/system/170783.html", "time": "2018-05-11", "level": "金币+3", "num_look": 343660, "num_comment": 9, "author": "lxzh123", "tags": ["系统安全"], "text": ""}
{"title": "浅析同源方式执行（SOME）攻击", "url": "https://www.freebuf.com/articles/web/169873.html", "time": "2018-05-11", "level": "金币+3", "num_look": 299135, "num_comment": 5, "author": "Str3am", "tags": ["WEB安全"], "text": "SOME（Same Origin Method Execution），同源方式执行，不同于 XSS 盗取用户 cookie 为目的，直接劫持 cookie 经行操作，和 CSRF 攻击很类似。"}
{"title": "心灵侦探：针对潜在内部攻击者的心理侧写方法", "url": "https://www.freebuf.com/articles/neopoints/170784.html", "time": "2018-05-11", "level": "现金奖励", "num_look": 182876, "num_comment": 182876, "author": "木千之", "tags": ["观点"], "text": "今天我将为FreeBuf的同仁们介绍几种运用最新的心里侧写技术提早发现内部攻击者的检测方法，囿于学力，不足之处请各位大大们不吝赐教。"}
{"title": "BUF早餐铺 | 开发者误读芯片厂商调试文档导致出现新内核漏洞；报告称伊朗可能针对制裁发动网络攻击；西安警方破获假借区块链之名进行网络传销案件", "url": "https://www.freebuf.com/news/171333.html", "time": "2018-05-11", "level": "", "num_look": 134751, "num_comment": 1, "author": "Akane", "tags": ["资讯"], "text": "白日放歌须纵酒，青春作伴好还乡。又逢周五放风日，漫卷诗书喜欲狂。"}
{"title": "CNNVD 关于Windows远程代码执行漏洞及Microsoft Excel远程代码执行漏洞的通报", "url": "https://www.freebuf.com/articles/system/171432.html", "time": "2018-05-10", "level": "", "num_look": 206091, "num_comment": 206091, "author": "CNNVD", "tags": ["系统安全"], "text": "近日，微软官方发布了Windows远程代码执行漏洞及Microsoft Excel远程代码执行漏洞的公告。"}
{"title": "Cloudfront劫持技术分析与介绍", "url": "https://www.freebuf.com/articles/web/170923.html", "time": "2018-05-10", "level": "", "num_look": 278134, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "近期，我一直在研究CloudFront域名劫持相关的问题。虽然这并不是一种新出现的安全问题，但其重要性显而易见。"}
{"title": "24小时「漏洞饥饿游戏」| 见证各路Dalao角逐巅峰，更有神秘众测项目等你挑战", "url": "https://www.freebuf.com/fevents/171360.html", "time": "2018-05-10", "level": "红色标题", "num_look": 180961, "num_comment": 4, "author": "漏洞盒子", "tags": ["活动"], "text": "大佬，搞钱吗？通宵挖漏洞现场给钱的那种！"}
{"title": "开发者误读芯片厂商调试文档，导致Windows、macOS和Linux等主要操作系统出现新内核漏洞", "url": "https://www.freebuf.com/news/171357.html", "time": "2018-05-10", "level": "", "num_look": 236951, "num_comment": 10, "author": "AngelaY", "tags": ["资讯"], "text": "美国计算机安全应急响应中心日前发布公告称，Windows、macOS、Red Hat、Ubuntu、VMware、等系统都可能受到重大安全漏洞（ CVE-2018-8897）的影响。"}
{"title": "快讯 | Python官方库软件包SSH-Decorator被植入后门", "url": "https://www.freebuf.com/news/171361.html", "time": "2018-05-10", "level": "红色标题", "num_look": 514448, "num_comment": 4, "author": "clouds", "tags": ["资讯"], "text": "据 Reddit 用户报告，在 Python 库的SSH-Decorator 软件包中发现了窃取用户 SSH 私钥及帐号密码的后门，目前该库已被Python官方移除。"}
{"title": "软WAF的另一种思路：基于Openresty+Naxsi的WAF实现", "url": "https://www.freebuf.com/articles/web/170781.html", "time": "2018-05-10", "level": "现金奖励", "num_look": 500483, "num_comment": 5, "author": "erwinlic", "tags": ["WEB安全"], "text": "目前软WAF的开发，大部分都采用Nginx+Lua基于openresty的方式，安全防护策略如果是基于lua正则匹配http请求内容的话，在加载了大量的防护规则后，nginx的性能会大大降低。"}
{"title": "挖洞经验 | 看我如何绕过某订阅端点的验证码", "url": "https://www.freebuf.com/articles/web/170637.html", "time": "2018-05-10", "level": "", "num_look": 311146, "num_comment": 5, "author": "secist", "tags": ["WEB安全"], "text": "关注我的朋友都知道，我已经有一段时间没有写过文章了，作为补偿我决定向大家分享一个我在私人项目中的有趣经历。"}
{"title": "看我如何通过XSS获取经纬度", "url": "https://www.freebuf.com/articles/web/169874.html", "time": "2018-05-10", "level": "现金奖励", "num_look": 378763, "num_comment": 13, "author": "Str3am", "tags": ["WEB安全"], "text": "Let's do something interesting with XSS!"}
{"title": "盛付通招聘安全工程师", "url": "https://www.freebuf.com/jobs/170712.html", "time": "2018-05-10", "level": "", "num_look": 148433, "num_comment": 10, "author": "野火", "tags": ["安全招聘"], "text": "上海盛付通电子商务有限公司（简称“盛付通”）是国内领先的独立第三方支付平台，由盛大集团创办，致力于为互联网用户和商户提供“安全、便捷、稳定”的支付服务。"}
{"title": "腾讯反病毒实验室对GandCrab勒索病毒家族的总结分析", "url": "https://www.freebuf.com/articles/paper/171110.html", "time": "2018-05-10", "level": "", "num_look": 386963, "num_comment": 1, "author": "腾讯电脑管家", "tags": ["安全报告"], "text": "GandCrab勒索病毒堪称2018年勒索病毒界的“新星”，该勒索家族于2018年01月面世，短短几个月的时间，历经三大版本更迭。"}
{"title": "设备管理器权限遭恶意利用，衍生多种病毒攻击用户手机", "url": "https://www.freebuf.com/articles/terminal/170921.html", "time": "2018-05-10", "level": "", "num_look": 200955, "num_comment": 1, "author": "腾讯手机管家", "tags": ["终端安全"], "text": "Google在Android2.2 新增了名为DevicePolicyManager的接口，可以帮助用户实现对手机安全管理和远程操作，如锁定屏幕、恢复出厂设置、清空手机上所有数据、远程修改屏幕密码等操作。"}
{"title": "手把手教你无限“印”BEC币（BEC合约整数溢出漏洞还原与分析）", "url": "https://www.freebuf.com/vuls/170791.html", "time": "2018-05-10", "level": "现金奖励", "num_look": 270710, "num_comment": 3, "author": "进击的大熊2018", "tags": ["漏洞"], "text": "前不久，币圈又出大事啦。BEC智能合约被爆出整数溢出漏洞，导致黑客能无限印币，在一次交易中，也就那么几秒钟的事情"}
{"title": "BUF 早餐铺 | 新物联网病毒在设备重启的情况下依然有效；Office 365中的0day漏洞baseStriker出现在野利用实例；Twitter正在测试端到端加密的私信", "url": "https://www.freebuf.com/news/171253.html", "time": "2018-05-10", "level": "", "num_look": 136156, "num_comment": 2, "author": "Sphinx", "tags": ["资讯"], "text": "微软2018年5月补丁修复67个漏洞，包括IE零日漏洞；百度软件中心版putty被曝恶意捆绑软件。"}
{"title": "聚焦全球前沿技术 2018 C3安全峰会助力网络强国建设", "url": "https://www.freebuf.com/news/171298.html", "time": "2018-05-10", "level": "", "num_look": 123405, "num_comment": 123405, "author": "shidongqi", "tags": ["资讯"], "text": "2018 C3安全峰会主题为“联动·聚力”，本次大会就量子计算、云安全、物联网安全、人工智能等当下热门话题展开深度交流与讨论。"}
{"title": "快讯 | Office 365中的0-day漏洞baseStriker出现在野利用实例", "url": "https://www.freebuf.com/news/171238.html", "time": "2018-05-09", "level": "", "num_look": 214894, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "5 月 1 日，Avanan 的研究人员发现 Office 365 中出现了一个名为 baseStriker 的 0-day 漏洞。攻击者可利用这个漏洞发送恶意邮件，绕过 Office 365 的账户安全机制。"}
{"title": "警惕AGENTTESLA商业键盘记录器新型变种", "url": "https://www.freebuf.com/articles/system/170876.html", "time": "2018-05-09", "level": "", "num_look": 221878, "num_comment": 1, "author": "antiylab", "tags": ["系统安全"], "text": "近日，安天CERT（安全研究与应急处理中心）发现了Agent Tesla商业键盘记录器的新型变种。Agent Tesla原本只是个简单的键盘记录器，记录用户的按键并回传至攻击者服务器。"}
{"title": "调查暗网中的钓鱼工具包", "url": "https://www.freebuf.com/sectool/170663.html", "time": "2018-05-09", "level": "", "num_look": 398636, "num_comment": 4, "author": "secist", "tags": ["工具"], "text": "近日，Check Point 和 CyberInt 公司的研究人员在暗网上发现下一代网络钓鱼工具包，可供菜鸟级别的黑客发起网络攻击。"}
{"title": "百度软件中心版putty被曝恶意捆绑软件", "url": "https://www.freebuf.com/news/171211.html", "time": "2018-05-09", "level": "红色标题", "num_look": 480999, "num_comment": 13, "author": "Sphinx", "tags": ["资讯"], "text": "你以为选择“普通下载”就行了吗？图样！"}
{"title": "百度云招聘高级安全工程师（渗透测试方向）", "url": "https://www.freebuf.com/jobs/170662.html", "time": "2018-05-09", "level": "", "num_look": 281684, "num_comment": 8, "author": "helloliuxm", "tags": ["安全招聘"], "text": "百度云（Baidu Cloud），是百度推出的一项个人云存储服务，覆盖中国大陆各大主流电脑和手机操作系统，包含Web版、Windows版、Mac版、Android版和iPhone版。"}
{"title": "Ghost Tunnel：适用于隔离网络的WiFi隐蔽传输通道", "url": "https://www.freebuf.com/articles/wireless/171108.html", "time": "2018-05-09", "level": "金币+10", "num_look": 484924, "num_comment": 10, "author": "qingxp9", "tags": ["无线安全"], "text": "在4月的HITB阿姆斯特丹站上，我们（PegasusTeam）分享了一个关于隔离网攻击的议题——\"Ghost Tunnel :Covert Data Exfiltration Channel to Circumvent Air Gapping\"。"}
{"title": "【报名开启】2018威胁情报&APT攻击技术与趋势高峰论坛 | FreeBuf企业安全俱乐部", "url": "https://www.freebuf.com/fevents/170474.html", "time": "2018-05-09", "level": "红色标题", "num_look": 484238, "num_comment": 6, "author": "FB客服", "tags": ["企业安全", "活动"], "text": "企业安全闭门论坛，专注分享和探讨威胁情报与APT分析检测如何在企业中落地。"}
{"title": "栈溢出之ret2dlresolve学习", "url": "https://www.freebuf.com/articles/system/170661.html", "time": "2018-05-09", "level": "现金奖励", "num_look": 339031, "num_comment": 6, "author": "jamzy", "tags": ["系统安全"], "text": "因为程序分为静态链接跟动态链接，因为好多库函数在程序中并不一定都用到，所以在处理动态链接程序的时候，elf文件会采取一种叫做延迟绑定（lazy binding）的技术。"}
{"title": "高收益的笨办法：暴破在Windows提权中的应用", "url": "https://www.freebuf.com/articles/system/170709.html", "time": "2018-05-09", "level": "现金奖励", "num_look": 725977, "num_comment": 14, "author": "yangyangwithgnu", "tags": ["系统安全"], "text": "千辛万苦拿下的 webshell 不是 www-data 用户就是 networkservice 权限，要想拓展攻击面、扩大战果，提权，是必经之路，也是后渗透阶段成功的关键。"}
{"title": "BUF早餐铺 | SynAck勒索软件利用多种高级技术躲避检测；联想修复安全启动问题和任意代码执行漏洞；73％ 的 ICS 工控系统易受黑客攻击；征信查询APP可能泄露用户信息", "url": "https://www.freebuf.com/news/171122.html", "time": "2018-05-09", "level": "", "num_look": 170274, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "梨花淡白柳深青，柳絮飞时花满城。"}
{"title": "快讯 | 联想修复旗下产品任意代码执行漏洞", "url": "https://www.freebuf.com/articles/system/171087.html", "time": "2018-05-08", "level": "", "num_look": 202330, "num_comment": 202330, "author": "Sphinx", "tags": ["系统安全"], "text": "联想在周五发布了两则安全公告，分别针对ThinkPad产品线和System x服务器。一个漏洞与安全引导过程中的身份验证环节有关；另一个漏洞会被用来任意代码执行。"}
{"title": "多种手机APP称可“直连央行征信”，用户面临安全风险", "url": "https://www.freebuf.com/news/171088.html", "time": "2018-05-08", "level": "", "num_look": 178110, "num_comment": 178110, "author": "AdlerI", "tags": ["资讯"], "text": "中国人民银行发布《关于进一步加强征信信息安全管理的通知》，通知指出，运行机构和接入机构要健全征信信息查询管理，严格授权查询机制，未经授权严禁查询征信报告，严禁未经授权认可的APP接入征信系统。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列-Mathias Karlsson", "url": "https://www.freebuf.com/video/170889.html", "time": "2018-05-08", "level": "红色标题", "num_look": 235540, "num_comment": 4, "author": "willhuang", "tags": ["视频"], "text": "Mathias Karlsson，瑞士人，从13岁就加入白帽行业，先后在BeEF平台、Detectify、Sentor等公司任职安全研究，目前为独立的渗透测试和漏洞挖掘者，活跃在多个知名众测社区。"}
{"title": "Whonow：一款可实时执行DNS重绑定测试的DNS服务器", "url": "https://www.freebuf.com/sectool/170740.html", "time": "2018-05-08", "level": "", "num_look": 277487, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款能够帮助渗透测试人员实时执行DNS重绑定（Rebinding）测试的DNS服务器。"}
{"title": "利用.NET反序列化漏洞获取NTLM Hashes", "url": "https://www.freebuf.com/articles/system/170640.html", "time": "2018-05-08", "level": "", "num_look": 228830, "num_comment": 1, "author": "secist", "tags": ["系统安全"], "text": "在最近的一次渗透测试中，我们遇到了一个用来获取管理员凭据的有趣技术（当然，NTLM散列已被破解）。"}
{"title": "微众银行信息安全部诚聘高级安全人才", "url": "https://www.freebuf.com/jobs/170560.html", "time": "2018-05-08", "level": "", "num_look": 226486, "num_comment": 4, "author": "微众银行sec", "tags": ["安全招聘"], "text": "微众银行是国内首家开业的民营银行，由腾讯、百业源和立业等多家知名企业发起设立。"}
{"title": "病毒伪装成“汇丰银行”邮件获取用户账号", "url": "https://www.freebuf.com/articles/network/170230.html", "time": "2018-05-08", "level": "", "num_look": 307255, "num_comment": 2, "author": "火绒安全", "tags": ["网络安全"], "text": "近日，火绒安全团队发现名为“TrickBot”的后门病毒正在全球范围内通过仿冒邮件发起新一轮网络攻击，世界范围内多家银行和比特币交易平台的使用者都在此次被攻击范围之内。"}
{"title": "内鬼泄密猛于黑客，如何保护好防火墙内的世界？", "url": "https://www.freebuf.com/articles/neopoints/171034.html", "time": "2018-05-08", "level": "红色标题", "num_look": 521871, "num_comment": 9, "author": "AngelaY", "tags": ["特别企划", "观点"], "text": "如果你的敌人来自内部，那么你筑起的墙就形同虚设。与内部敌人的斗争是一场没有硝烟但依然严峻的战争。"}
{"title": "Termux高级终端安装使用配置教程", "url": "https://www.freebuf.com/geek/170510.html", "time": "2018-05-08", "level": "现金奖励", "num_look": 2684361, "num_comment": 49, "author": "国光", "tags": ["极客"], "text": "Termux是一个Android下一个高级的终端模拟器，开源且不需要root，支持apt管理软件包，十分方便安装软件包。"}
{"title": "美国国防部发布禁令，军方禁用华为、中兴手机", "url": "https://www.freebuf.com/news/170841.html", "time": "2018-05-08", "level": "", "num_look": 330736, "num_comment": 7, "author": "shidongqi", "tags": ["资讯"], "text": "出于安全性的考虑，五角大楼正在命令美国军事基地零售商店停止出售华为和中兴产品。"}
{"title": "BUF早餐铺 | 美国军方禁用华为、中兴智能手机；天天P图回应前世青年照收集隐私问题；网络安全公司发现门罗币挖矿的新型病毒“Kitty”；Android P将修复监控网络活动安全漏洞", "url": "https://www.freebuf.com/news/170873.html", "time": "2018-05-08", "level": "", "num_look": 221511, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "今天的 BUF 早餐内容主要有：美国军方禁用华为、中兴智能手机；天天P图回应前世青年照收集隐私问题。"}
{"title": "卡巴斯基详细介绍针对Android用户的ZooPark APT攻击", "url": "https://www.freebuf.com/news/170905.html", "time": "2018-05-07", "level": "", "num_look": 210769, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "卡巴斯基实验室的安全研究人员昨天发布了一份报告，详细介绍了过去三年来在中东地区活跃的一个新的黑客组织。"}
{"title": "Macro_Pack：一款用于自动化混淆和生成Office文档等文件格式的工具", "url": "https://www.freebuf.com/sectool/170695.html", "time": "2018-05-07", "level": "", "num_look": 344371, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "macro_pack是一个用于自动生成混淆过的MS Office文档、VB脚本等其他格式的工具，其主要目的是用于渗透测试、demo以及社会工程学的评估。"}
{"title": "为什么区块链并不总是问题的答案？", "url": "https://www.freebuf.com/articles/blockchain-articles/170723.html", "time": "2018-05-07", "level": "", "num_look": 584433, "num_comment": 5, "author": "米雪儿", "tags": ["区块链安全"], "text": "人们总是喜欢谈论一些相同的东西，谈多了也就成了所谓的“热门”、“流行语”，当然，安全行业也不例外。"}
{"title": "苏州冠辰招募渗透测试工程师", "url": "https://www.freebuf.com/jobs/170489.html", "time": "2018-05-07", "level": "", "num_look": 166479, "num_comment": 10, "author": "gogogo", "tags": ["安全招聘"], "text": "苏州冠辰计算机信息技术有限公司系苏州柯利达集团控股子公司，主要从事信息安全产品研发、渗透测试、风险评估、信息安全集成、系统集成、智慧城市、大数据平台建设等业务。"}
{"title": "马老师聊安全 | 弱密码的防御与检测", "url": "https://www.freebuf.com/articles/database/170301.html", "time": "2018-05-07", "level": "", "num_look": 331503, "num_comment": 5, "author": "ChuanFile", "tags": ["数据安全"], "text": "弱密码一直是广大安全人员的痛。web管理页面、公网服务连接密码（如邮件、sql等）、内网终端、服务器登录等都是弱密码的重灾区。一旦被人利用成功，损失巨大。"}
{"title": "记录一次利用业务设计缺陷漏洞的精彩实战测试", "url": "https://www.freebuf.com/articles/web/170023.html", "time": "2018-05-07", "level": "红色标题", "num_look": 418169, "num_comment": 19, "author": "Ka1ier", "tags": ["WEB安全"], "text": "本篇文章主要讲述我在zzcms8.2中挖掘到的漏洞，我既然写了，那么肯定是与别人的文章有所不同，漏洞也不同，攻击方法也不同。"}
{"title": "一个Linux平台的门罗币挖矿木马的查杀与分析", "url": "https://www.freebuf.com/articles/system/170211.html", "time": "2018-05-07", "level": "", "num_look": 493538, "num_comment": 14, "author": "任子行", "tags": ["系统安全"], "text": "近期接到客户反映，其机房有一台redhat服务器很卡，导致很多服务响应速度很慢的情况。通过远程到客户机器，发现一个进程占据700%多CPU的使用率。"}
{"title": "源码审计之缓冲区溢出漏洞", "url": "https://www.freebuf.com/vuls/170323.html", "time": "2018-05-07", "level": "金币+5", "num_look": 293665, "num_comment": 4, "author": "freezing", "tags": ["漏洞"], "text": "缓冲区溢出算是安全界常见的漏洞，也是一种最初级的漏洞，但是这种漏洞时至今日依旧层出不穷。"}
{"title": "BUF早餐铺 | 推特提醒3.3亿用户修改密码；英特尔处理器再现严重漏洞；快递新规正式实施，泄露用户信息可罚十万元", "url": "https://www.freebuf.com/news/170741.html", "time": "2018-05-07", "level": "", "num_look": 189722, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "绿阴铺野换新光，薰风初昼长。 夏天，你好。"}
{"title": "解码Gh0st RAT变种中的网络数据", "url": "https://www.freebuf.com/articles/network/170636.html", "time": "2018-05-06", "level": "", "num_look": 369778, "num_comment": 2, "author": "secist", "tags": ["网络安全"], "text": "在今年3月份的一次取证调查中，我们找回了一些文件。经过我们初步的判定，这些文件极有可能与一个知名组织Iron Tiger有关。"}
{"title": "代码审计 | HDWiki v6.0最新版referer注入漏洞", "url": "https://www.freebuf.com/vuls/170337.html", "time": "2018-05-06", "level": "现金奖励", "num_look": 461951, "num_comment": 17, "author": "davichi8282", "tags": ["漏洞"], "text": "近期在审计HDWiki 6.0最新版cms的时候发现由referer导致的sql注入问题。SQL注入我们知道是由于代码与数据没有严格区别限制分离而导致的问题，OWASP TOP 10常年把SQL注入放在TOP 1的位置。"}
{"title": "朝鲜自研杀毒软件外泄，被发现采用十年前趋势科技的盗版引擎", "url": "https://www.freebuf.com/news/170561.html", "time": "2018-05-06", "level": "", "num_look": 402584, "num_comment": 14, "author": "shidongqi", "tags": ["资讯"], "text": "由一封神秘邮件解开了朝鲜自主研发杀毒软件的神秘面纱，却发现其采用的竟是十年前趋势科技的杀毒引擎。"}
{"title": "Katana Framework武士刀操作指南", "url": "https://www.freebuf.com/sectool/169457.html", "time": "2018-05-05", "level": "现金奖励", "num_look": 519641, "num_comment": 7, "author": "Backspaces", "tags": ["工具"], "text": "Katana Framework是用Python语言写的渗透框架，但我更觉得它像是一个工具箱。"}
{"title": "研究人员在大众和奥迪汽车中发现远程利用漏洞", "url": "https://www.freebuf.com/news/170647.html", "time": "2018-05-05", "level": "", "num_look": 297568, "num_comment": 3, "author": "米雪儿", "tags": ["资讯"], "text": "近日，安全研究人员发现，大众和奥迪汽车中存在多处安全漏洞，这些漏洞可能允许攻击者发起远程攻击行为。"}
{"title": "APT追踪 | 尼日利亚黑客组织再起花式攻击", "url": "https://www.freebuf.com/articles/network/170428.html", "time": "2018-05-05", "level": "金币+5", "num_look": 538546, "num_comment": 8, "author": "dongxun", "tags": ["安全报告", "网络安全"], "text": "研究人员检测到一起源自非洲的黑客组织攻击事件,攻击者利用自己的PC进行木马测试后，未删除遗留的数据和屏幕截图，这次的遗留数据多达6G，同时包含明确的受害者信息。"}
{"title": "微软正致力于解决Win 10中Meltdown补丁绕过的问题", "url": "https://www.freebuf.com/news/170534.html", "time": "2018-05-05", "level": "", "num_look": 261117, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "网络安全公司Crowdstrike的安全研究员Alex Ionescu表示，微软针对Meltdown漏洞的补丁存在漏洞。"}
{"title": "Twitter不慎以纯文本形式泄漏用户密码", "url": "https://www.freebuf.com/articles/database/170679.html", "time": "2018-05-04", "level": "", "num_look": 386374, "num_comment": 4, "author": "Sphinx", "tags": ["数据安全"], "text": "经过内部审计之后，Twitter今天承认，他们的密码存储机制存在错误，导致内部日志中记录了一些用户的密码。"}
{"title": "CNNVD 关于PHP输入验证安全漏洞的通报", "url": "https://www.freebuf.com/news/170715.html", "time": "2018-05-04", "level": "", "num_look": 403807, "num_comment": 3, "author": "CNNVD", "tags": ["漏洞", "资讯"], "text": "PHP存在输入验证安全漏洞（CNNVD-201805-054、CVE-2018-10547 ），成功利用漏洞的攻击者，可在用户不知情的情况下，在该用户浏览器中执行任意代码。"}
{"title": "挖洞经验 | 看我如何发现OpenDrive云存储平台的会话机制漏洞", "url": "https://www.freebuf.com/vuls/169982.html", "time": "2018-05-04", "level": "", "num_look": 351130, "num_comment": 4, "author": "clouds", "tags": ["漏洞"], "text": "除了传统的云存储功能外，OpenDrive还以软件客户端和移动APP的应用形式，为使用客户提供存储备份和内容管理解决方案。"}
{"title": "漏洞导致Windows系统崩溃，硬件专家公布PoC利用码", "url": "https://www.freebuf.com/news/170287.html", "time": "2018-05-04", "level": "红色标题", "num_look": 340789, "num_comment": 8, "author": "AngelaY", "tags": ["资讯"], "text": "Bitdefender 公司的研究员 Marius Tivadar 在 GitHub 上发布了一段 PoC 代码，即便在计算机被锁的情况下也能在几秒内导致 Windows 计算机崩溃。"}
{"title": "PentesterLab 新手教程（三） ：LDAP攻击", "url": "https://www.freebuf.com/news/170322.html", "time": "2018-05-04", "level": "金币+5", "num_look": 394201, "num_comment": 1, "author": "婷儿小跟班✧", "tags": [], "text": "web for pentester是国外安全研究者开发的的一款渗透测试平台,包含一些主要的漏洞。这篇文章将要介绍的是LDAP attacks，听起来是不是感觉很新奇？"}
{"title": "商汤科技招聘安全实习生", "url": "https://www.freebuf.com/jobs/170229.html", "time": "2018-05-04", "level": "", "num_look": 248816, "num_comment": 11, "author": "mmc", "tags": ["安全招聘"], "text": "相信大家对商汤科技并不陌生，作为一个麾下拥有钻研人类最前沿技术的科学家团队的公司，我们相信大家在这里的实习收获将是无可预估~"}
{"title": "FreeBuf招聘站全新内推攻略", "url": "https://www.freebuf.com/fevents/170472.html", "time": "2018-05-04", "level": "", "num_look": 174596, "num_comment": 2, "author": "FB招聘小助手", "tags": ["活动"], "text": "攻略在手，内推我有~"}
{"title": "黑客是如何监视你的手机的？", "url": "https://www.freebuf.com/news/170203.html", "time": "2018-05-04", "level": "现金奖励", "num_look": 639143, "num_comment": 10, "author": "烟波渺渺正愁予", "tags": ["数据安全", "资讯"], "text": "最近收到比较多的垃圾信息，想起了恶意软件这种东西可能泄露信息，于是便写下此文。"}
{"title": "XiaoBa勒索病毒变种分析简报", "url": "https://www.freebuf.com/articles/network/169750.html", "time": "2018-05-04", "level": "金币+8", "num_look": 418883, "num_comment": 10, "author": "JustPlay", "tags": ["网络安全"], "text": "XiaoBa勒索病毒，是一种新型电脑病毒，是一款国产化水平极高的勒索病毒，主要以邮件，程序木马，网页挂马的形式进行传播。"}
{"title": "Java反序列化漏洞的原理分析", "url": "https://www.freebuf.com/vuls/170344.html", "time": "2018-05-04", "level": "现金奖励", "num_look": 1361094, "num_comment": 5, "author": "Moonlightos", "tags": ["漏洞"], "text": "Java反序列化漏洞是近一段时间里一直被重点关注的漏洞，自从 Apache Commons-collections 爆出第一个漏洞开始，围绕着Java反序列化漏洞的事件就层出不穷。"}
{"title": "BUF早餐铺 | 澳大利亚联邦银行遗失1200万用户数据；微软解决Win 10中Meltdown补丁绕过问题；Chrome开始对无记录SSL证书弹出警告", "url": "https://www.freebuf.com/news/170469.html", "time": "2018-05-04", "level": "", "num_look": 160043, "num_comment": 1, "author": "Akane", "tags": ["资讯"], "text": "干了这碗红油抄手，下辈子还做成都人！"}
{"title": "全球最大DDoS市场被关闭，欧洲DDoS下降了60％", "url": "https://www.freebuf.com/news/170462.html", "time": "2018-05-03", "level": "", "num_look": 399129, "num_comment": 4, "author": "shidongqi", "tags": ["网络安全", "资讯"], "text": "DDoS防护公司 Link11 表示，随着全球最大的DDoS市场WebStresser被关闭，整个欧洲的DDoS攻击频率下降了60％。"}
{"title": "挖洞经验 | 看我如何挖掘成人网站YouPorn的XSS并成功利用", "url": "https://www.freebuf.com/articles/web/169918.html", "time": "2018-05-03", "level": "红色标题", "num_look": 922046, "num_comment": 19, "author": "secist", "tags": ["WEB安全"], "text": "就在上个月的一个傍晚，当我们连接到我们的工作Jabber server时，我的同事告诉我告诉我成人网站YouPorn也已在HackerOne上，启动了他们的bug奖励计划。"}
{"title": "江苏常州神州网云安全人才招聘", "url": "https://www.freebuf.com/jobs/170174.html", "time": "2018-05-03", "level": "", "num_look": 204379, "num_comment": 9, "author": "江苏SZWY", "tags": ["安全招聘"], "text": "神州网云信息技术（江苏）有限公司是目前国内领先的从事高级威胁检测和威胁情报技术应用的网络安全公司。公司核心团队具有10年以上的高级威胁监测领域经验。"}
{"title": "FacexWorm通过Facebook Messenger和恶意Chrome扩展传播", "url": "https://www.freebuf.com/news/170387.html", "time": "2018-05-03", "level": "", "num_look": 168869, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "Facebook和Chrome用户要注意了，最近有一款名叫FacexWorm的病毒，可以窃取密码，窃取加密货币，或者向Facebook用户发送垃圾邮件。"}
{"title": "DEFCON China：不用办签证出国，在国内就能参加的全球知名黑客大Party是什么体验？", "url": "https://www.freebuf.com/articles/neopoints/170454.html", "time": "2018-05-03", "level": "红色标题", "num_look": 645821, "num_comment": 6, "author": "AngelaY", "tags": ["活动", "观点"], "text": "阳光明媚的午后，我正认真看着安全相关的新闻，突然，手机叮咚一响，收到了一条消息：“小姐姐，你去 DEFCON China 吗？”"}
{"title": "“寄生兽”的极地行动：最新APT组织“寄生兽”活动披露", "url": "https://www.freebuf.com/articles/paper/169444.html", "time": "2018-05-03", "level": "", "num_look": 330950, "num_comment": 3, "author": "腾讯电脑管家", "tags": ["安全报告"], "text": "“寄生兽”APT组织（T-APT-02）是腾讯御见威胁情报中心2017年捕获并开始追踪的高级APT组织。该组织具有众多特点。"}
{"title": "Avast发布CCleaner APT事件调查新进展", "url": "https://www.freebuf.com/articles/paper/170403.html", "time": "2018-05-03", "level": "", "num_look": 544779, "num_comment": 1, "author": "AngelaY", "tags": ["安全报告"], "text": "企业并购尽职调查不能只局限于法律和财务问题，还要高度关注网络安全，关注供应链安全。"}
{"title": "BUF 早餐铺 | 苹果iPhone X iOS 11.3.1被腾讯Keenlab团队成功越狱;WhatsApp联合创始人Jan Koum因隐私问题离开Facebook；GitHub无意中在其内部日志中记录了一些明文密码；微信回应提取被删聊天记录：利用司法取证技术可提取", "url": "https://www.freebuf.com/news/170380.html", "time": "2018-05-03", "level": "", "num_look": 273630, "num_comment": 8, "author": "shidongqi", "tags": ["资讯"], "text": "iOS 11.3.1发布近一周的时间就被破解，不过现在还热衷与越狱的应该只有这些黑客、白帽子了。"}
{"title": "【火热报名中】鸡肋漏洞的深思：CORS、XSS、CSRF的组合 | FreeBuf精品公开课漏洞挖掘系列", "url": "https://www.freebuf.com/fevents/170446.html", "time": "2018-05-03", "level": "红色标题", "num_look": 421819, "num_comment": 4, "author": "FB客服", "tags": ["FreeBuf公开课", "活动"], "text": "5月23日周三20:00，FreeBuf精品公开课讲师王骕将从如上漏洞的本质原理、实际案例分析、思路拓展三个角度，为大家带来《鸡肋漏洞的深思：CORS、XSS、CSRF的组合》 。"}
{"title": "挖洞经验 | 看我如何绕过某托管公司域上的强大XSS过滤器", "url": "https://www.freebuf.com/vuls/169732.html", "time": "2018-05-02", "level": "", "num_look": 463472, "num_comment": 10, "author": "secist", "tags": ["漏洞"], "text": "本文为大家分享的是最近一次绕过某托管公司域上的XSS过滤器的经历。"}
{"title": "开源软件创建SOC的一份清单", "url": "https://www.freebuf.com/articles/network/169632.html", "time": "2018-05-02", "level": "现金奖励", "num_look": 651359, "num_comment": 10, "author": "xsecurity", "tags": ["企业安全", "网络安全"], "text": "开源和自己构建的系统可以高度的定制化，但与商业产品不能有机的结合，就没办法发挥最大效用。"}
{"title": "Burpsuit结合SQLMapAPI产生的批量注入插件", "url": "https://www.freebuf.com/articles/web/169727.html", "time": "2018-05-02", "level": "金币+5", "num_look": 443371, "num_comment": 10, "author": "Chris_D", "tags": ["WEB安全"], "text": "一个网站是由多个开发人员协同工作完成的，他们遵循一定的命名规范（模块+动词+名称）等。在对一个网站进行测试的时候，你检查了A0001-A0050接口时，发现过滤很完整。"}
{"title": "海航科技集团安全人才招聘", "url": "https://www.freebuf.com/jobs/170231.html", "time": "2018-05-02", "level": "", "num_look": 218862, "num_comment": 15, "author": "neway", "tags": ["安全招聘"], "text": "海航科技集团成立于 2016 年 12 月 ，是世界500强企业海航集团面向未来战略布局的大型产业控股集团，总部设立在中国上海。"}
{"title": "退订无门，垃圾短信猖獗谁能治得了？", "url": "https://www.freebuf.com/special/169600.html", "time": "2018-05-02", "level": "红色标题", "num_look": 518944, "num_comment": 9, "author": "shidongqi", "tags": ["特别企划"], "text": "回复退订的套路则是更加让人无语，敢情博大精深的汉字文化用在了碾压我的智商上了呗？"}
{"title": "海莲花APT组织最新攻击样本分析", "url": "https://www.freebuf.com/articles/network/170074.html", "time": "2018-05-02", "level": "", "num_look": 479778, "num_comment": 2, "author": "腾讯电脑管家", "tags": ["网络安全"], "text": "海莲花（OceanLotus）也叫APT32或APT-C-00，是一个长期针对中国及其他东亚国家（地区）政府、科研机构、海运企业等领域进行攻击的APT组织。"}
{"title": "PHP中通过bypass disable functions执行系统命令的几种方式", "url": "https://www.freebuf.com/articles/web/169156.html", "time": "2018-05-02", "level": "现金奖励", "num_look": 478179, "num_comment": 5, "author": "我是大王123", "tags": ["WEB安全"], "text": "攻与防是对立的，也是互相补充的，既然有对函数的禁用措施，就会有人想方设法的去突破这层限制，我们只有在掌握突破方式以及原理的基础之上，才能更好的去防范这类攻击。"}
{"title": "神话传奇：一款通过卖号在微信群传播的远控木马", "url": "https://www.freebuf.com/articles/system/170196.html", "time": "2018-05-02", "level": "", "num_look": 329717, "num_comment": 2, "author": "360安全", "tags": ["系统安全"], "text": "近期，360安全卫士监测到了一批通过微信群传播的远控木马，木马针对在网上倒卖微信号的人群定向投放。"}
{"title": "BUF早餐铺 | 大型垃圾邮件僵尸网络 Necurs 使用新技术躲避检测；西部数据云存储设备泄露用户数据；PDF 文件可被用于盗取 Windows 凭证", "url": "https://www.freebuf.com/news/170207.html", "time": "2018-05-02", "level": "", "num_look": 158301, "num_comment": 2, "author": "Sphinx", "tags": ["资讯"], "text": "五一来了，十一还会远吗？"}
{"title": "EU GDPR：金融机构需注意的GDPR要点分析", "url": "https://www.freebuf.com/articles/neopoints/170027.html", "time": "2018-05-01", "level": "", "num_look": 308584, "num_comment": 3, "author": "阳阳金融安全", "tags": ["企业安全", "观点"], "text": "GPDR正式实施期限是2018年5月25日，任何一个未能满足新法规的组织将面临高达前一年全球收入4%的罚款，或者是2000万欧元。"}
{"title": "杀毒软件之死：RSA 2018终端厂商及产品趋势解读", "url": "https://www.freebuf.com/articles/neopoints/170286.html", "time": "2018-05-01", "level": "", "num_look": 334418, "num_comment": 1, "author": "青藤云安全Q", "tags": ["观点"], "text": "笔者有幸参加了RSA2018年大会，大会最重要的就是各种厂商的展销会。"}
{"title": "分享一款基于Pocsuite的漏洞扫描系统", "url": "https://www.freebuf.com/sectool/169766.html", "time": "2018-05-01", "level": "金币+5", "num_look": 658205, "num_comment": 11, "author": "jeffzh3ng", "tags": ["工具"], "text": "本项目是一款基于 Flask 应用框架的在线漏洞扫描系统，同时集成了渗透测试常用的端口扫描、子域名爆破等功能，后端漏洞扫描采用的是知道创宇安全团队的开源漏洞测试框架 Pocsuite。"}
{"title": "内网漫游：通过RDP劫持向远程系统执行任意代码", "url": "https://www.freebuf.com/sectool/170024.html", "time": "2018-05-01", "level": "红色标题", "num_look": 414518, "num_comment": 6, "author": "secist", "tags": ["工具"], "text": "RDP在为我们带来方便的同时，也为虎视眈眈的攻击者打开了一扇窗，攻击者常会利用该协议肆意的在内部网络中漫游。"}
{"title": "CNCERT 2018年4月我国DDoS攻击资源分析报告", "url": "https://www.freebuf.com/articles/paper/171721.html", "time": "2018-05-01", "level": "", "num_look": 108576, "num_comment": 108576, "author": "CNCERT", "tags": ["安全报告"], "text": "本报告为2018年4月份的DDoS攻击资源月度分析报告。"}
{"title": "黑客可利用PDF文件获取Windows凭据", "url": "https://www.freebuf.com/articles/system/170206.html", "time": "2018-05-01", "level": "", "num_look": 292853, "num_comment": 4, "author": "shidongqi", "tags": ["系统安全"], "text": "Check Point安全研究员Assaf Baharav透露，PDF文件可以被恶意行为者武装化，以窃取Windows凭证而无需任何用户交互，只需打开一个文件即可。"}
{"title": "JIS-CTF靶机+Kioptrix靶机渗透", "url": "https://www.freebuf.com/news/168868.html", "time": "2018-04-30", "level": "金币+12", "num_look": 515932, "num_comment": 15, "author": "D3ck", "tags": [], "text": "JIS靶机以拿到5个flag为止；本文攻击的靶机为kioptrix level1 以拿到root权限为止。"}
{"title": "一系列用于Fuzzing学习的资源汇总", "url": "https://www.freebuf.com/news/169413.html", "time": "2018-04-30", "level": "", "num_look": 518159, "num_comment": 5, "author": "secist", "tags": [], "text": "本文主要是向大家推荐一系列，用于fuzzing和Exploit开发初始阶段学习的资源合集，其中将包括相关的书籍，课程 - 免费或收费的，视频，工具，教程。"}
{"title": "维权入门之Windows Rid劫持技术", "url": "https://www.freebuf.com/articles/system/169925.html", "time": "2018-04-30", "level": "金币+12", "num_look": 320128, "num_comment": 6, "author": "5ecurity", "tags": ["系统安全"], "text": "大家好，今天给大家分享的是一个Msf框架中关于后渗透阶段的模块，这个模块有趣的地方在于，它在某种程度上来说是完全隐形的。开发者把这种技术叫做Windows Rid劫持。"}
{"title": "APT团伙（APT-C-01）新利用漏洞样本分析及关联挖掘", "url": "https://www.freebuf.com/articles/network/169855.html", "time": "2018-04-30", "level": "", "num_look": 354070, "num_comment": 5, "author": "奇安信威胁情报中心", "tags": ["网络安全"], "text": "APT-C-01组织是一个长期针对国内国防、政府、科技和教育领域的重要机构实施网络间谍攻击活动的APT团伙，其最早的攻击活动可以追溯到2007年。"}
{"title": "WebLogic CVE-2018-2628漏洞验证", "url": "https://www.freebuf.com/vuls/169322.html", "time": "2018-04-29", "level": "金币+12", "num_look": 632483, "num_comment": 7, "author": "kaixin3000", "tags": ["漏洞"], "text": "Oracle官方发布了4月份的关键补丁更新CPU（CriticalPatchUpdate），其中包含一个高危的Weblogic反序列化漏洞(CVE-2018-2628)，通过该漏洞，攻击者可以在未授权的情况下远程执行代码。"}
{"title": "DomLink：一款自动化的域发现工具", "url": "https://www.freebuf.com/sectool/169734.html", "time": "2018-04-29", "level": "", "num_look": 403673, "num_comment": 7, "author": "secist", "tags": ["工具"], "text": "DomLink是一个自动化的域发现工具。用户只需向其提供一个域名，它就会帮助我们查找与之相关联的组织和电子邮件记录。"}
{"title": "【FB TV】一周「BUF大事件」：币圈新闻不断，各平台漏洞频出；思科修复WebEx高危漏洞", "url": "https://www.freebuf.com/video/170256.html", "time": "2018-04-29", "level": "红色标题", "num_look": 282703, "num_comment": 1, "author": "willhuang", "tags": ["视频"], "text": "近期币圈可谓是新闻不断，先是美蜜BEC遭遇黑客毁灭性攻击，损失惨重；再就是Myetherwallet的DNS劫持和火币Pro的漏洞问题，稍有风吹草动便是头条。"}
{"title": "记某次从控件漏洞挖掘到成功利用", "url": "https://www.freebuf.com/articles/web/169295.html", "time": "2018-04-29", "level": "", "num_look": 350938, "num_comment": 4, "author": "深信服千里目安全实验室", "tags": ["WEB安全"], "text": "之前对某ActiveX控件进行漏洞挖掘的时候发现了一个栈溢出漏洞，最近一时兴起写下了这篇针对该漏洞的从挖掘到成功利用的分享文章。"}
{"title": "企业未修复Apache Struts 2漏洞致Web服务器被批量入侵", "url": "https://www.freebuf.com/vuls/170068.html", "time": "2018-04-29", "level": "", "num_look": 486715, "num_comment": 5, "author": "腾讯电脑管家", "tags": ["漏洞"], "text": "安全人员分析发现被攻击网站服务器多存在Apache Struts 2 Jakarta Multipart Parser远程代码执行（RCE）漏洞(S2-045,CVE-2017-5638)，该漏洞在2017年3月被报出。"}
{"title": "攻击预警|GreenFlashSundown Exploit Kit攻击国内多家大型站点", "url": "https://www.freebuf.com/articles/web/170197.html", "time": "2018-04-28", "level": "", "num_look": 326499, "num_comment": 2, "author": "360安全", "tags": ["WEB安全"], "text": "有攻击团伙向国内知名下载站点52pk.com页面中插入CVE-2018-4878漏洞的flash对象进行攻击。后续监控发现知名IT技术网站51CTO.com和医护学习交流平台cmechina.net也遭到挂马攻击。"}
{"title": "海莲花APT组织使用最新MacOS后门程序发动攻击", "url": "https://www.freebuf.com/articles/network/170245.html", "time": "2018-04-28", "level": "", "num_look": 337639, "num_comment": 337639, "author": "亚信安全", "tags": ["网络安全"], "text": "海莲花APT组织是一个高度组织化的、专业化的境外黑客组织，该APT组织主要针对人权组织，媒体，研究机构和海事建筑公司等进行高级持续性攻击。"}
{"title": "挖洞经验 | 看我如何利用一条扫描命令发现价值$2500漏洞", "url": "https://www.freebuf.com/articles/web/169592.html", "time": "2018-04-28", "level": "红色标题", "num_look": 508850, "num_comment": 16, "author": "clouds", "tags": ["WEB安全"], "text": "在最近Memcache服务被利用发动反射型DDoS攻击事件之后，我想到了之前我发现的一例Memcache相关的赏金漏洞，这是一个价值$2500美金的Pornhub网站Memcache漏洞。"}
{"title": "西数My Cloud EX2默认配置存在泄漏文件风险", "url": "https://www.freebuf.com/news/170190.html", "time": "2018-04-28", "level": "", "num_look": 237193, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "西数My Cloud EX2 存储设备的默认配置，允许局域网内的所有用户通过HTTP请求检索文件。"}
{"title": "GPG Reaper：一款可以从Gpg-Agent缓存内存中获取或恢复GPG私钥的工具", "url": "https://www.freebuf.com/sectool/169581.html", "time": "2018-04-28", "level": "", "num_look": 309781, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "此POC演示了从Windows下的gpg-agent内存中获取GPG私钥的方法。通常这应该在10分钟内完成。"}
{"title": "又是朝鲜？！疑似与朝鲜相关的黑客盗取17个国家的数据", "url": "https://www.freebuf.com/news/170082.html", "time": "2018-04-28", "level": "", "num_look": 277189, "num_comment": 6, "author": "AngelaY", "tags": ["资讯"], "text": "McAfee 高级威胁研究团队发布的一份新的报告指出，一项名为 Operation GhostSecret 的大型黑客活动疑似与朝鲜政府支持的黑客组织 Lazarus有关，因为攻击中使用了与该组织有关的各种工具和恶意程序。"}
{"title": "路由器漏洞分析第七弹：CVE-2018-8941 远程代码执行", "url": "https://www.freebuf.com/articles/wireless/168870.html", "time": "2018-04-28", "level": "金币+12", "num_look": 522561, "num_comment": 7, "author": "kczwa1", "tags": ["无线安全"], "text": "这次分析一个mips下栈溢出用到ROP的情况."}
{"title": "机器学习之垃圾信息过滤", "url": "https://www.freebuf.com/articles/network/168850.html", "time": "2018-04-28", "level": "现金奖励", "num_look": 509845, "num_comment": 14, "author": "WindsonYang", "tags": ["网络安全"], "text": "在实际业务中，面对不同的数据集，必须了解算法的原理，实现以及懂得对结果进行分析，才能达到高准确率。"}
{"title": "源码审计之空指针引用漏洞", "url": "https://www.freebuf.com/vuls/169415.html", "time": "2018-04-28", "level": "现金奖励", "num_look": 352344, "num_comment": 11, "author": "freezing", "tags": ["漏洞"], "text": "最近在网上加入了一个安全团队，里面有人问我如何做代码审计。只能说先能看得懂代码，了解各种漏洞的形成原因。然后多进行审计和调试练习。"}
{"title": "ThinkPHP 框架SQL注入技术分析", "url": "https://www.freebuf.com/articles/web/169406.html", "time": "2018-04-28", "level": "", "num_look": 352343, "num_comment": 1, "author": "奇安信代码卫士", "tags": ["WEB安全"], "text": "4月12号，ThinkPHP官方团队发布“ThinkPHP5.0.17&5.1.9版本发布——包含安全更新”通知，提醒用户第一时间更新框架版本，在这次更新中，包含了一个高危安全漏洞的修复。"}
{"title": "2018年RSA创新安全产品“全球20强”榜单揭晓", "url": "https://www.freebuf.com/articles/neopoints/170192.html", "time": "2018-04-28", "level": "", "num_look": 209650, "num_comment": 209650, "author": "柚子", "tags": ["观点"], "text": "2018年4月下旬，美国著名IT杂志CRN评选出今年RSA会议上发布的20个最新最热门的安全产品。"}
{"title": "MongoDB服务器暴露加密货币用户的详细信息", "url": "https://www.freebuf.com/news/170073.html", "time": "2018-04-28", "level": "", "num_look": 171248, "num_comment": 171248, "author": "Sphinx", "tags": ["资讯"], "text": "安全研究人员偶然发现了一个MongoDB数据库，其中包含超过25,000名投资、接收Bezop（一种加密货币）用户的个人信息。"}
{"title": "BUF 早餐铺 | Ubuntu 18.04 正式版发布，针对安全性优化;Win10被指非法收集数据，微软恐面临287万美金罚款；谷歌帐户获得新的验证功能 以防止网络钓鱼攻击;疑似与朝鲜相关的黑客盗取17个国家的数据", "url": "https://www.freebuf.com/news/170052.html", "time": "2018-04-28", "level": "", "num_look": 238244, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "四月最后一份早餐铺奉上，提前祝大家五一假期快乐~"}
{"title": "病毒预警 | GandCrab最新变种来袭", "url": "https://www.freebuf.com/articles/system/169920.html", "time": "2018-04-28", "level": "", "num_look": 282468, "num_comment": 2, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "GandCrab勒索病毒首次发现是2018年2月份，也是首例向受害者勒索达世币的勒索病毒，此次发现的最新样本，可以让受害者使用比特币和达世币进行赎金支付。"}
{"title": "新时代，新力量 | 2018西湖论剑 · 网络安全大会精彩回顾", "url": "https://www.freebuf.com/news/170078.html", "time": "2018-04-28", "level": "红色标题", "num_look": 226059, "num_comment": 226059, "author": "Akane", "tags": ["活动", "资讯"], "text": "所谓侠之大者，为国为民。一群顶尖的网络安全高手在一起切磋技艺、共商大事是什么体验？"}
{"title": "CNNVD关于 Drupal Core远程代码执行漏洞情况的通报", "url": "https://www.freebuf.com/vuls/170100.html", "time": "2018-04-27", "level": "", "num_look": 320687, "num_comment": 320687, "author": "CNNVD", "tags": ["漏洞"], "text": "近日，国家信息安全漏洞库（CNNVD）收到关于Drupal Core远程代码执行漏洞（CNNVD-201804-1490、CVE-2018-7602）情况的报送。成功利用此漏洞的攻击者可以对目标系统进行远程代码执行攻击。"}
{"title": "第五届“首都网络安全日”参展厂商巡礼", "url": "https://www.freebuf.com/news/170037.html", "time": "2018-04-27", "level": "红色标题", "num_look": 183921, "num_comment": 5, "author": "Sphinx", "tags": ["资讯"], "text": "27日上午，2017年第四届首都网络安全日在北京展览馆正式拉开帷幕。本届首都网络安全日活动依旧以“网络安全同担，网络生活共享”为主题，于4月26日至28日为期三天，在北京展览举行。"}
{"title": "Windows 服务器下勒索木马的防护与对抗", "url": "https://www.freebuf.com/articles/paper/170016.html", "time": "2018-04-27", "level": "", "num_look": 281892, "num_comment": 1, "author": "360安全", "tags": ["安全报告"], "text": "从去年下半年开始，勒索病毒在国内的攻击重点开始转向了各类服务器，尤其以windows服务器为甚。"}
{"title": "CTF经验 | Off-By-One相关知识点浅析", "url": "https://www.freebuf.com/news/168064.html", "time": "2018-04-27", "level": "", "num_look": 322395, "num_comment": 1, "author": "moonAgirl", "tags": [], "text": "在ctf中经常能遇到off-by-one知识点的题型，想不到出现在了真实软件中，有点惊讶。就此机会，总结一些off-by-one的有关知识点。"}
{"title": "一次真实的Linux服务器挖矿程序排查案例，顺道干掉一个DDoS后门", "url": "https://www.freebuf.com/articles/system/169572.html", "time": "2018-04-27", "level": "金币+10", "num_look": 555816, "num_comment": 7, "author": "弹指江山", "tags": ["系统安全"], "text": "上周有朋友反映一台服务器流量超标， 怀疑中木马，请求帮忙处理。"}
{"title": "Android应用程序逆向入门详解", "url": "https://www.freebuf.com/articles/terminal/169110.html", "time": "2018-04-27", "level": "金币+10", "num_look": 464857, "num_comment": 2, "author": "ning1022", "tags": ["终端安全"], "text": "逆向Android APP可以用一个（相对）简单而有趣的方式来进行讲解，这就是为什么我决定写这篇博客文章，我将尝试解释基础知识，并给大家一些我的“技巧”来让大家更快，更有效的逆向APP。"}
{"title": "巴西检方起诉Win10非法收集数据，微软恐面临287万美金罚款", "url": "https://www.freebuf.com/news/170044.html", "time": "2018-04-27", "level": "", "num_look": 248117, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": "巴西联邦检察官星期三要求法院强制微软更改其Windows 10的默认安装过程，称其违反当地法律，未经“明确同意”收集用户数据。"}
{"title": "黑客发现酒店钥匙卡系统漏洞，可生成任意房门钥匙", "url": "https://www.freebuf.com/news/169983.html", "time": "2018-04-27", "level": "", "num_look": 453877, "num_comment": 6, "author": "shidongqi", "tags": ["资讯"], "text": "来自F-Secure的两名安全研究人员开发了一种设备，可以读取任何有效甚至过期的酒店钥匙卡，并生成一个可打开任何房间门或授予攻击者进入安全酒店区域的主钥匙。"}
{"title": "Google Hacking信息刺探的攻与防", "url": "https://www.freebuf.com/articles/network/169601.html", "time": "2018-04-27", "level": "现金奖励", "num_look": 1326964, "num_comment": 12, "author": "K0rz3n", "tags": ["网络安全"], "text": "现在就让我带领各位读者重新认识一下Google———你军火库中的“大咖” 。"}
{"title": "BUF 早餐铺 | 葡萄牙成为第21个加入北约网络防御中心的国家；欧洲警方联合捣毁全球最大的DDoS交易网站；亚马逊Echo音箱可被黑客入侵变成窃听器", "url": "https://www.freebuf.com/news/169950.html", "time": "2018-04-27", "level": "", "num_look": 287201, "num_comment": 287201, "author": "Sphinx", "tags": ["资讯"], "text": "Drupal 发布新补丁，但黑客已经在用户更新之前利用漏洞；联通疑似屏蔽工信部投诉网站，域名被解析至本地 。"}
{"title": "【豪华出境游】4.28，漏洞盒子精英白帽团出发喽 | 白帽梦想趴", "url": "https://www.freebuf.com/fevents/169972.html", "time": "2018-04-26", "level": "", "num_look": 464675, "num_comment": 8, "author": "漏洞盒子", "tags": ["活动"], "text": "五一不要宅在家，盒子带你立刻出发——关于漏洞盒子2017年度白帽子的表彰"}
{"title": "快讯 | 联通疑似屏蔽工信部投诉网站，域名被指向127.0.0.1", "url": "https://www.freebuf.com/news/169952.html", "time": "2018-04-26", "level": "红色标题", "num_look": 408373, "num_comment": 11, "author": "shidongqi", "tags": ["资讯"], "text": "部分地区的联通用户无法正常访问工信部投诉网站，经过查证之后发现该地区联通用户在访问工信部投诉网站时IP地址竟然被解析到了“127.0.0.1”这个地址。"}
{"title": "CNCERT 2018年网络安全威胁治理峰会在京召开", "url": "https://www.freebuf.com/news/170430.html", "time": "2018-04-26", "level": "", "num_look": 114297, "num_comment": 114297, "author": "CNCERT", "tags": ["资讯"], "text": "2018年4月25日，“2018年网络安全威胁治理峰会暨2017年我国互联网网络安全态势报告发布会”在京召开。"}
{"title": "PentesterLab新手教程（二）：XML注入", "url": "https://www.freebuf.com/sectool/169122.html", "time": "2018-04-26", "level": "金币+3", "num_look": 728253, "num_comment": 1, "author": "婷儿小跟班✧", "tags": ["工具"], "text": ""}
{"title": "快讯 | 欧洲警方联合捣毁全球最大的 DDoS 交易网站", "url": "https://www.freebuf.com/news/169940.html", "time": "2018-04-26", "level": "", "num_look": 206999, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "据外媒报道，当地时间周三（4 月 25 日）上午，欧洲刑警组织宣布关闭了全球最大的 DDoS 交易网站 Webstresser.org。"}
{"title": "挖洞经验 | 利用密码重置功能实现账号劫持", "url": "https://www.freebuf.com/vuls/169753.html", "time": "2018-04-26", "level": "", "num_look": 356079, "num_comment": 4, "author": "clouds", "tags": ["漏洞"], "text": "最近，我参加了某平台邀请的漏洞测试项目，在其中发现了一个独特的账号劫持漏洞，整个漏洞发现过程非常意外也非常幸运。"}
{"title": "招商银行招聘安全管理岗位", "url": "https://www.freebuf.com/jobs/169695.html", "time": "2018-04-26", "level": "", "num_look": 237629, "num_comment": 9, "author": "xysky", "tags": ["安全招聘"], "text": "招商银行，是中国第一家完全由企业法人持股的股份制商业银行，由香港招商局集团有限公司创办，是中国内地规模第六大的银行。"}
{"title": "无文件攻击实例：基于注册表的Poweliks病毒分析", "url": "https://www.freebuf.com/articles/network/169296.html", "time": "2018-04-26", "level": "", "num_look": 312423, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["网络安全"], "text": "病毒与杀软的博弈持续进行着，双方的攻防技术也是日新月异，随着杀软杀毒能力的不断提升，病毒对抗也在持续加强。"}
{"title": "全国首例|Wmixml新型挖矿病毒预警，已有企业被成功渗透", "url": "https://www.freebuf.com/articles/system/169445.html", "time": "2018-04-26", "level": "红色标题", "num_look": 554637, "num_comment": 6, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "千里目安全实验室EDR安全团队接到某企业反馈，称其内网大量服务器存在挖矿问题，且难以清理干净。"}
{"title": "Windows漏洞利用开发教程Part 3：Egghunter", "url": "https://www.freebuf.com/articles/system/169167.html", "time": "2018-04-26", "level": "现金奖励", "num_look": 339943, "num_comment": 5, "author": "zusheng", "tags": ["系统安全"], "text": "我花了大量的时间来研究了计算机安全领域Windows漏洞利用开发，希望能和大家分享一下，能帮助到对这方面感兴趣的朋友，如有不足，还请见谅。"}
{"title": "海莲花APT团伙利用CVE-2017-8570漏洞的新样本及关联分析", "url": "https://www.freebuf.com/vuls/168829.html", "time": "2018-04-26", "level": "", "num_look": 347495, "num_comment": 347495, "author": "奇安信威胁情报中心", "tags": ["漏洞", "网络安全"], "text": "海莲花APT团伙是一个高度组织化的、专业化的境外国家级黑客组织。该组织至少自2012年4月起便针对中国政府、科研院所、海事机构、海域建设、航运企业等相关重要领域展开不间断攻击。"}
{"title": "BUF早餐铺 | 任天堂Switch破解漏洞已公开，可加载Linux玩模拟器；黑客劫持MyEtherWallet的DNS服务器窃取超130,00美元；非法获取上亿条数据信息4人被刑拘", "url": "https://www.freebuf.com/news/169795.html", "time": "2018-04-26", "level": "", "num_look": 222902, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": "币圈无宁日，最近热闹也多。不知道这场风口什么时候能够吹过去……"}
{"title": "WebLogic反序列化漏洞（CVE-2018-2628）漫谈", "url": "https://www.freebuf.com/articles/web/169770.html", "time": "2018-04-25", "level": "", "num_look": 1023883, "num_comment": 1, "author": "Knownsec知道创宇", "tags": ["WEB安全"], "text": "2018年4月18日，Oracle官方发布了4月份的安全补丁更新CPU（Critical Patch Update），更新中修复了一个高危的 WebLogic 反序列化漏洞CVE-2018-2628。"}
{"title": "Solidity合约中的整数安全问题——SMT BEC合约整数溢出解析", "url": "https://www.freebuf.com/vuls/169741.html", "time": "2018-04-25", "level": "", "num_look": 328726, "num_comment": 328726, "author": "360埃癸斯实验室", "tags": ["漏洞"], "text": "传统的桌面windows攻防对抗领域，除了浏览器中的UAF，弱类型语言存在的类型混淆，还零星剩下了一些整数类的漏洞。这次SMT BEC被盗就是因为合约中出现整数溢出漏洞。"}
{"title": "黑客两小时卷走13000美金，MyEtherWallet DNS劫持事件深度分析", "url": "https://www.freebuf.com/articles/blockchain-articles/169773.html", "time": "2018-04-25", "level": "红色标题", "num_look": 798450, "num_comment": 14, "author": "shidongqi", "tags": ["区块链安全"], "text": "4月24日发生的一连串事故，让很多用户在一脸懵逼中钱包被清空，两个小时的时间里，黑客狂捞至少13000美元。一度怀疑是平台遭黑客入侵，毕竟此前发生加密货币交易平台被黑客攻击的案例并不少见。"}
{"title": "漏洞预警 | SMT智能合约整型溢出漏洞", "url": "https://www.freebuf.com/vuls/169796.html", "time": "2018-04-25", "level": "", "num_look": 287583, "num_comment": 1, "author": "Sphinx", "tags": ["漏洞"], "text": "SmartMesh Token是基于Ethereum的合约代币，简称SMT。漏洞发生在转账操作中，攻击者可以在无实际支出的情况下获得大额转账。"}
{"title": "【已结束】构建和运行SOC的最佳实践 | FreeBuf企业精品公开课 × IBM", "url": "https://www.freebuf.com/fevents/168874.html", "time": "2018-04-25", "level": "红色标题", "num_look": 649277, "num_comment": 6, "author": "FB客服", "tags": ["FreeBuf公开课", "活动"], "text": "4月25日16:00， FreeBuf 特邀在SOC建设运营方面有着丰富经验的IBM大中华区安全事业部信息安全高级顾问吴斌先生，为我们分享智慧安全运营中心（SOC）的建设旅程。"}
{"title": "Switch遭重了！Tegra内核漏洞无法修复，越狱指日可待", "url": "https://www.freebuf.com/news/169752.html", "time": "2018-04-25", "level": "", "num_look": 341903, "num_comment": 1, "author": "Sphinx", "tags": ["漏洞", "资讯"], "text": "任天堂switch破解漏洞已公开：已可加载Linux玩模拟器。"}
{"title": "RSA 2018 | 网络安全没有银弹，最好的应对方式是抓住当下、脚踏实地", "url": "https://www.freebuf.com/articles/neopoints/169764.html", "time": "2018-04-25", "level": "红色标题", "num_look": 188970, "num_comment": 1, "author": "AdlerI", "tags": ["观点"], "text": "撇去新技术的泡沫、经历过 2017 年至今大大小小的安全事件之后，关于网络安全的探讨更加着眼于当下、更加脚踏实地。"}
{"title": "BadTouch：一个可编写脚本的网络身份验证破解程序", "url": "https://www.freebuf.com/sectool/168068.html", "time": "2018-04-25", "level": "", "num_look": 277357, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": ""}
{"title": "Invoke-Adversary：一款基于APT威胁程度评估安全产品和监控解决方案的工具", "url": "https://www.freebuf.com/sectool/169519.html", "time": "2018-04-25", "level": "", "num_look": 289714, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "在看到来自Florian Roth的APTSimulator优秀工具后，我的灵感来自写这个脚本。我编写这个脚本的灵感主要来自Florian Roth的APTSimulator工具集。"}
{"title": "360代码安全实验室寻人启事", "url": "https://www.freebuf.com/jobs/169472.html", "time": "2018-04-25", "level": "", "num_look": 270170, "num_comment": 10, "author": "奇安信代码卫士", "tags": ["安全招聘"], "text": "360 企业安全集团代码安全实验室是360企业安全旗下专门从事源代码、二进制漏洞挖掘和分析的研究团队。"}
{"title": "挖矿病毒通过Flash漏洞传播，小心电脑变矿机", "url": "https://www.freebuf.com/articles/system/169664.html", "time": "2018-04-25", "level": "", "num_look": 315298, "num_comment": 3, "author": "火绒安全", "tags": ["系统安全"], "text": "病毒团伙将挖矿程序植入到游戏下载站“52pk”中（www.52pk.com），当用户访问该网站，带毒页面展示后，无需任何操作，挖矿程序便会立即运行，利用用户电脑“挖矿”(门罗币)。"}
{"title": "银行拦截木马病毒有多恐怖？你的手机可能已经被监控了", "url": "https://www.freebuf.com/articles/terminal/169338.html", "time": "2018-04-25", "level": "红色标题", "num_look": 479711, "num_comment": 3, "author": "腾讯手机管家", "tags": ["终端安全"], "text": "“银行拦截木马”病毒是一种精准钓鱼，窃取用户银行账户的病毒木马，涉案金额过亿。"}
{"title": "WebLogic反序列化漏洞CVE-2018-2628复现与EXP构造", "url": "https://www.freebuf.com/vuls/169420.html", "time": "2018-04-25", "level": "现金奖励", "num_look": 1081299, "num_comment": 5, "author": "TopScrew", "tags": ["漏洞"], "text": "Oracle官方发布了4月份的关键补丁更新CPU（Critical Patch Update），其中包含Weblogic反序列化漏洞可导致远程代码执行漏洞，漏洞威胁等级为高危，对应的CVE编号为CVE-2018-2628。"}
{"title": "树莓派随身工具箱：中间人劫持获取控制权", "url": "https://www.freebuf.com/articles/wireless/168856.html", "time": "2018-04-25", "level": "现金奖励", "num_look": 921143, "num_comment": 29, "author": "Rc4x", "tags": ["无线安全", "极客"], "text": "上文讲解了树莓派随身工具箱的环境搭建，这段时间又对其进行了一些优化，主要是从便携美观上面改进。在实际使用中发现了一些问题，并做了小小的改动。"}
{"title": "BUF早餐铺 | Orangeworm组织攻击全球医疗机构；Health Stream医务人员信息可能泄露；谷歌被指侵犯安卓用户隐私；国内外卖平台用户信息被倒卖", "url": "https://www.freebuf.com/news/169705.html", "time": "2018-04-25", "level": "", "num_look": 275052, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "等闲识得东风面， 万紫千红总是春。"}
{"title": "路由器漏洞分析第六弹 ：CVE-2018-7445 MikroTik路由器系统缓冲区溢出漏洞", "url": "https://www.freebuf.com/articles/wireless/168063.html", "time": "2018-04-24", "level": "金币+5", "num_look": 762482, "num_comment": 18, "author": "kczwa1", "tags": ["无线安全"], "text": "前面几篇文章分析了mips,arm,这次挑一个开启了NX和ASLR保护的x86架构的路由器。"}
{"title": "人的大脑也可以被黑客入侵？这不是危言耸听", "url": "https://www.freebuf.com/news/169599.html", "time": "2018-04-24", "level": "", "num_look": 445903, "num_comment": 6, "author": "Sphinx", "tags": ["极客", "资讯"], "text": "黑客可以控制电脑，也可以控制人脑。"}
{"title": "SEA (原名Garena) 招聘安全技术负责人、高级资深安全工程师", "url": "https://www.freebuf.com/jobs/169434.html", "time": "2018-04-24", "level": "", "num_look": 323804, "num_comment": 27, "author": "happytree", "tags": ["安全招聘"], "text": "Sea是一家专注于东南亚地区的互联网公司，业务覆盖区域包括新加坡、马来西亚、台湾、泰国、越南、印度尼西亚和菲律宾。"}
{"title": "挖洞经验 | 看我如何利用漏洞更改Google搜索排名", "url": "https://www.freebuf.com/vuls/168589.html", "time": "2018-04-24", "level": "红色标题", "num_look": 843010, "num_comment": 33, "author": "clouds", "tags": ["漏洞"], "text": "只需12美元注册购买一个域名，我就能在Google搜索结果中实现与亚马逊、沃尔玛等高价值关键词相同的广告排名。"}
{"title": "PentesterLab新手教程（一）：代码注入", "url": "https://www.freebuf.com/sectool/168653.html", "time": "2018-04-24", "level": "金币+10", "num_look": 757721, "num_comment": 9, "author": "婷儿小跟班✧", "tags": ["工具"], "text": "Web for pentester 是国外安全研究者开发的的一款渗透测试平台。"}
{"title": "巡风风险扫描开源系统的一些演变", "url": "https://www.freebuf.com/sectool/168977.html", "time": "2018-04-24", "level": "现金奖励", "num_look": 590712, "num_comment": 4, "author": "无花无酒锄作田", "tags": ["工具"], "text": "同程SRC团队开源巡风资产风险控制系统也有一段时间了，我们临时用它作为一个简单的soc平台来使用，期间也做了一些定制化开发，此次分享，权当做个笔记吧。"}
{"title": "DNS安全威胁及未来发展趋势的研究", "url": "https://www.freebuf.com/articles/network/169175.html", "time": "2018-04-24", "level": "现金奖励", "num_look": 478819, "num_comment": 5, "author": "我是大王123", "tags": ["网络安全"], "text": "DNS 服务已经深入到互联网的各个角落，成为互联网上不可或缺的关键一环。"}
{"title": "静态分析一款锁首的RootKit样本", "url": "https://www.freebuf.com/articles/system/168650.html", "time": "2018-04-24", "level": "现金奖励", "num_look": 255439, "num_comment": 2, "author": "0zapt4toM", "tags": ["系统安全"], "text": "闲来无事，分析一个Rootkit(病毒驱动，样本来源于52pojie论坛。分析此样本的目的在于增加自己的逆向分析能力和加深对windows内核的认识。"}
{"title": "吃鸡辅助远控木马分析", "url": "https://www.freebuf.com/articles/paper/169504.html", "time": "2018-04-24", "level": "", "num_look": 333360, "num_comment": 3, "author": "360安全", "tags": ["安全报告"], "text": "近期，带木马的荒野求生辅助通过论坛、QQ、YY大量传播。木马运行后，黑客可以远程控制用户电脑，进行任意操作，并将中招电脑作为傀儡机，进行DDOS攻击。"}
{"title": "BUF 早餐铺 | 美国知名银行前员工或盗用150万客户信息，出售给犯罪组织；Twitter禁止卡巴斯基在其平台发布广告；微软宣布推出新的Windows平台安全技术", "url": "https://www.freebuf.com/news/169518.html", "time": "2018-04-24", "level": "", "num_look": 158306, "num_comment": 2, "author": "Sphinx", "tags": ["资讯"], "text": "微软为 Linux 子系统提供 Windows Defender 防火墙；多地中学生在京PK网络安全技术，展示编程、web安全实力。"}
{"title": "精品公开课“三箭齐发”之漏洞挖掘系列 | 一杯咖啡换一个成为大牛的机会", "url": "https://www.freebuf.com/news/167938.html", "time": "2018-04-24", "level": "红色标题", "num_look": 331381, "num_comment": 6, "author": "FB公开课小助手", "tags": ["FreeBuf公开课", "资讯"], "text": "精品公开课，三课齐发，三款精品课程，同步上线，现课程火热报名中！"}
{"title": "微软发布Windows Defender System Guard运行时认证技术，预期在平台安全方面取得进展", "url": "https://www.freebuf.com/news/169505.html", "time": "2018-04-23", "level": "", "num_look": 518589, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "上周，微软推出了一项新的 Windows 平台安全技术：Windows Defender System Guard 运行时认证。"}
{"title": "Hack the Pentagon | 利用JIRA漏洞访问美军非保密因特网协议路由器网（NIPRnet）", "url": "https://www.freebuf.com/vuls/168719.html", "time": "2018-04-23", "level": "", "num_look": 436352, "num_comment": 2, "author": "clouds", "tags": ["漏洞"], "text": "本文讲述了作者在参与美国国防部（DoD） Hack the Pentagon 漏洞众测项目中，利用JIRA漏洞CVE-2017-9506构造了SSRF攻击面，实现了对美军非保密因特网协议路由器网（NIPRnet）的访问。"}
{"title": "CVE-2017-16995 Ubuntu本地提权测试（任意地址读写利用）", "url": "https://www.freebuf.com/vuls/168980.html", "time": "2018-04-23", "level": "现金奖励", "num_look": 346889, "num_comment": 10, "author": "lxzh123", "tags": ["漏洞"], "text": "该漏洞存在于带有 eBPF bpf(2)系统（CONFIG_BPF_SYSCALL）编译支持的Linux内核中，是一个内存任意读写漏洞。"}
{"title": "美国知名银行前员工或盗用150万客户信息，出售给犯罪组织", "url": "https://www.freebuf.com/news/169458.html", "time": "2018-04-23", "level": "", "num_look": 191608, "num_comment": 191608, "author": "shidongqi", "tags": ["资讯"], "text": "SunTrust银行宣布发现一名前雇员可能试图下载近150万名客户的信息，并将其分享给一个犯罪组织。"}
{"title": "基于JXWAF快速搭建钓鱼网站", "url": "https://www.freebuf.com/articles/web/169129.html", "time": "2018-04-23", "level": "金币+10", "num_look": 434460, "num_comment": 14, "author": "chenjc", "tags": ["WEB安全"], "text": "前段时间为了加强内部安全意识，需要进行钓鱼邮件演练，于是通过JXWAF快速搭建了一个钓鱼网站，发现效果不错，特此分享。"}
{"title": "双枪2木马驱动分析报告", "url": "https://www.freebuf.com/articles/system/168789.html", "time": "2018-04-23", "level": "", "num_look": 300213, "num_comment": 2, "author": "360安全", "tags": ["系统安全"], "text": "前段时间360安全卫士发表了一篇对双枪2感染释放驱动行为的分析报告，相比于双枪一代，它增加了HIVE文件保护，新增了WFP网络功能拦截，还有保护了自身的系统回调不被修改。"}
{"title": "马老师聊内网安全：浅谈软件供应链攻击与内网防御", "url": "https://www.freebuf.com/articles/network/168983.html", "time": "2018-04-23", "level": "现金奖励", "num_look": 346650, "num_comment": 6, "author": "ChuanFile", "tags": ["网络安全"], "text": "随着软件供应链攻击的越来越多，相信大家已经对这种攻击方式有所了解了，修改软件下载源头的软件代码，植入恶意，诱导下载使用是这种攻击的主要特征。"}
{"title": "利用PRET控制远程打印机测试", "url": "https://www.freebuf.com/news/168168.html", "time": "2018-04-23", "level": "金币+3", "num_look": 207061, "num_comment": 5, "author": "qianye", "tags": ["资讯"], "text": "Pret是用来对打印机安全进行测试的工具。它通过网络或者USB连接到设备，并利用给定打印机的语言进行渗透。目前绝大多数的打印机都是使用PostScript,pjl和pcl。"}
{"title": "BUF早餐铺 | 思科修复WebEx软件漏洞；LocalBlox泄露千万份个人数据；LinkedIn信息自动填充功能存在漏洞；习近平出席全国网络安全和信息化工作会议并发表重要讲话", "url": "https://www.freebuf.com/news/169391.html", "time": "2018-04-23", "level": "", "num_look": 152808, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "世界读书日，看 PHP 好还是看 Java 好呢？"}
{"title": "宜信防火墙自动化运维之路", "url": "https://www.freebuf.com/articles/security-management/166895.html", "time": "2018-04-22", "level": "", "num_look": 426405, "num_comment": 11, "author": "宜信安全应急响应中心", "tags": ["企业安全", "安全管理"], "text": "在宜信的这些年工作了许久，经验也积攒了一些，不敢说干货多硬，只能算是近几年工作经验的沉淀，希望能给阅读者带来启示和帮助。更欢迎同行各位大佬给予斧正，共同交流经验和从业心得体会，在此谢过。"}
{"title": "ESI注入：利用缓存服务形成的SSRF和其它客户端形式渗透", "url": "https://www.freebuf.com/articles/web/168363.html", "time": "2018-04-22", "level": "", "num_look": 298534, "num_comment": 298534, "author": "clouds", "tags": ["WEB安全"], "text": "Edge Side Includes (ESI)标记语言主要用于各种流行的HTTP代理中（如反向代理、负载均衡、缓存服务器、代理服务器）解决网页缓存问题。"}
{"title": "利用Java反序列化漏洞在Windows上的挖矿实验", "url": "https://www.freebuf.com/articles/system/168067.html", "time": "2018-04-22", "level": "", "num_look": 352806, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "最近，安全社区中有很多人都在讨论如何利用Java反序列化漏洞来攻击类似Apache、SOLR和WebLogic之类的系统。"}
{"title": "实现一个简单的Burp验证码本地识别插件", "url": "https://www.freebuf.com/articles/web/168679.html", "time": "2018-04-22", "level": "现金奖励", "num_look": 607359, "num_comment": 13, "author": "releasel0ck", "tags": ["WEB安全"], "text": "虽然现在好多大网站都不用图片验证码了，但是仍然有一部分陈旧的web系统用着一些简单的图片验证码。"}
{"title": "国产病毒国外作恶 ，界面LOGO“撞衫”国内上市公司产品", "url": "https://www.freebuf.com/articles/paper/168737.html", "time": "2018-04-22", "level": "", "num_look": 301549, "num_comment": 3, "author": "火绒安全", "tags": ["安全报告"], "text": "近期有国内病毒团伙在国外传播后门病毒“Bandios”。该病毒侵入用户电脑后，可“挖矿”、偷偷劫持用户流量等，同时病毒作者还可随时通过远程操控进行其他破坏行为。"}
{"title": "ESP技巧：教你如何解包可执行文件", "url": "https://www.freebuf.com/articles/web/167983.html", "time": "2018-04-21", "level": "", "num_look": 363585, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "作为一名恶意软件分析人员来说，我们应该了解加壳机制，并清楚如何解包可执行文件。"}
{"title": "注意！Hashcat可轻松破解长度为256个字符的密码", "url": "https://www.freebuf.com/articles/database/168065.html", "time": "2018-04-21", "level": "红色标题", "num_look": 522904, "num_comment": 11, "author": "Alpha_h4ck", "tags": ["数据安全"], "text": "你还认为你12个字符长度的密码非常安全吗？别闹了，现在顶级的密码破解程序可以轻松破解长度高达256个字符的密码。"}
{"title": "大规模SMB爆破引发的十年之思", "url": "https://www.freebuf.com/articles/system/168608.html", "time": "2018-04-21", "level": "", "num_look": 395033, "num_comment": 3, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "近日，千里目安全实验室EDR安全团队持续收到大量企业用户反馈，称其内网很多服务器存在大规模SMB爆破现象，但一直查不到问题根因。"}
{"title": "借鉴开源框架自研日志收集系统", "url": "https://www.freebuf.com/sectool/168471.html", "time": "2018-04-21", "level": "", "num_look": 443362, "num_comment": 4, "author": "岂安科技", "tags": ["工具"], "text": "笔者先后使用logstash，flume等开源项目。并最终自研一套基于Java语言的日志收集系统 Bloodhound。以下从项目关注的角度对开源系统与自研进行分析。"}
{"title": "【FB TV】一周「BUF大事件」：34家科技公司组成行业联盟，保护用户信息；RSA2018旧金山举行；泰国最大4G移动运营商数据泄露", "url": "https://www.freebuf.com/video/169373.html", "time": "2018-04-21", "level": "红色标题", "num_look": 254211, "num_comment": 1, "author": "willhuang", "tags": ["视频"], "text": "34家科技公司组成行业联盟，保护用户信息；RSA2018旧金山举行；泰国最大4G移动运营商数据泄露"}
{"title": "RSA 2018 | 互联网需要更多正义，浅谈企业的社会责任", "url": "https://www.freebuf.com/articles/neopoints/169369.html", "time": "2018-04-20", "level": "", "num_look": 213552, "num_comment": 213552, "author": "Sphinx", "tags": ["观点"], "text": "作为安全大会，RSA关注的主要是信息安全领域的前沿技术和观点，但在今年的议题也关注到了企业责任和社会责任。"}
{"title": "美国数据公司LocalBlox泄露了4800万个人数据记录", "url": "https://www.freebuf.com/news/169334.html", "time": "2018-04-20", "level": "", "num_look": 217448, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "美国数据公司Localblox通过Facebook、LinkedIn、Twitter等社交网络收集和合并大量用户数据，构建了4800万人的个人资料，并一度将其公开泄露出来。"}
{"title": "Codiad在线IDE框架漏洞挖掘", "url": "https://www.freebuf.com/articles/web/167893.html", "time": "2018-04-20", "level": "", "num_look": 328053, "num_comment": 1, "author": "licong", "tags": ["WEB安全"], "text": "Codiad 是一个开源基于Web的IDE应用程序，用于在线编写和编辑代码。"}
{"title": "浅析加密DNS（附子域名爆破工具）", "url": "https://www.freebuf.com/sectool/168659.html", "time": "2018-04-20", "level": "", "num_look": 487388, "num_comment": 5, "author": "tocttou", "tags": ["WEB安全", "工具"], "text": "本文章简单介绍一下两种加密DNS协议：DNS over HTTPS 和 DNS over TLS。这两种协议主要为了解决DNS带来的隐私和中间人篡改问题。"}
{"title": "ERP安全|Oracle EBS渗透测试工具", "url": "https://www.freebuf.com/articles/es/168073.html", "time": "2018-04-20", "level": "", "num_look": 291895, "num_comment": 291895, "author": "secist", "tags": ["企业安全"], "text": "直到今天仍有许多的企业忽视了IT安全的重要性。随着网络的发展，网络犯罪也日益严重化和多样化，加上一些企业安全意识的淡薄，随时都有可能成为被攻击的对象."}
{"title": "用零宽度字符水印揭露泄密者身份", "url": "https://www.freebuf.com/articles/web/167903.html", "time": "2018-04-20", "level": "红色标题", "num_look": 506199, "num_comment": 11, "author": "clouds", "tags": ["WEB安全"], "text": "零宽度字符是隐藏不显示的，也是不可打印的，也就是说这种字符用大多数程序或编辑器是看不到的。"}
{"title": "新华社：区块链如何带来个人数据保护“革命”", "url": "https://www.freebuf.com/articles/blockchain-articles/169303.html", "time": "2018-04-20", "level": "", "num_look": 242840, "num_comment": 2, "author": "shidongqi", "tags": ["区块链安全"], "text": "大数据时代，个人的数据被认为是黄金般珍贵。个人数据泄漏令人担忧，但绝大部分人不可能因为害怕数据被收集而切断与互联网的联系。"}
{"title": "美国陆军利用AI技术实现“穿墙透视”，可识别人脸", "url": "https://www.freebuf.com/news/169133.html", "time": "2018-04-20", "level": "", "num_look": 178905, "num_comment": 178905, "author": "shidongqi", "tags": ["资讯"], "text": "依靠这样的技术，美国政府将能够直接从建筑物外拍摄人物，使用热成像仪可以在几乎完全黑暗中穿过墙壁拍摄照片，人工智能会识别出影像中的人物。"}
{"title": "“爱马仕”敲诈者：敲诈者中的奢侈品", "url": "https://www.freebuf.com/articles/system/168811.html", "time": "2018-04-20", "level": "", "num_look": 269668, "num_comment": 1, "author": "360安全", "tags": ["系统安全"], "text": "近期，一款名为”爱马仕”的勒索病毒又开始在国内传播，该勒索病毒此次的主要攻击目标是windows服务器。目前流行的服务器勒索病毒中，有超过九成是通过远程桌面进行传播的。"}
{"title": "现代版荆轲刺秦王：Struts2 REST插件漏洞（S2-052、S2-056）分析", "url": "https://www.freebuf.com/articles/web/168820.html", "time": "2018-04-20", "level": "现金奖励", "num_look": 533074, "num_comment": 6, "author": "进击的大熊2018", "tags": ["WEB安全", "系统安全"], "text": "风萧萧兮易水寒，壮士一去兮不复还。"}
{"title": "BUF早餐铺 | LG网络存储设备存在严重RCE漏洞；微软将反钓鱼机制移植到Chrome插件；俄罗斯针对Telegram封禁数千万IP", "url": "https://www.freebuf.com/news/169131.html", "time": "2018-04-20", "level": "", "num_look": 168849, "num_comment": 168849, "author": "Akane", "tags": ["资讯"], "text": "美国陆军正在开发一种机器学习方法，用于从热成像中识别人脸。依靠这样的技术可以在完全黑暗中穿墙拍摄，人工智能将会识别出影像中的人物。"}
{"title": "Metasploit+NetRipper获取Chrome等浏览器帐号密码测试", "url": "https://www.freebuf.com/articles/web/168664.html", "time": "2018-04-19", "level": "金币+5", "num_look": 372535, "num_comment": 5, "author": "艾登——皮尔斯", "tags": ["WEB安全"], "text": "本篇文章我将手把手教会各位Buffer如何使用Metasploit+NetRipper获取Chrome等浏览器内保存的帐号密码。"}
{"title": "RSA 2018 | 站在风口的BigID，他们凭什么在创新沙盒大赛上拔得头筹？", "url": "https://www.freebuf.com/articles/neopoints/169208.html", "time": "2018-04-19", "level": "", "num_look": 223476, "num_comment": 1, "author": "Sphinx", "tags": ["观点"], "text": "BigID被评为2018年RSA会议创新沙箱竞赛“最具创新能力初创企业”，这是一家什么公司呢？"}
{"title": "Weblogic反序列化远程代码执行漏洞检查复现", "url": "https://www.freebuf.com/vuls/169138.html", "time": "2018-04-19", "level": "金币+5", "num_look": 596627, "num_comment": 14, "author": "tdcoming", "tags": ["漏洞"], "text": "Oracle官方在2018年4月18日发布了4月关键补丁更新，其中包含了Oracle WebLogic Server的一个高危漏洞（CVE-2018-2628）。"}
{"title": "RSA 2018 | 通过iOS Trustjacking漏洞远程渗透iPhone", "url": "https://www.freebuf.com/news/169165.html", "time": "2018-04-19", "level": "", "num_look": 260144, "num_comment": 2, "author": "Sphinx", "tags": ["漏洞", "资讯"], "text": "赛门铁克研究人员发现了一个iPhone与Mac工作站和笔记本电脑配对的漏洞。他们表示，攻击者可以利用这个被称为Trustjacking的漏洞就能轻松接管设备。"}
{"title": "ThinkPHP 框架SQL注入技术分析", "url": "https://www.freebuf.com/articles/web/169098.html", "time": "2018-04-19", "level": "", "num_look": 320121, "num_comment": 1, "author": "360企业安全", "tags": ["WEB安全"], "text": "4月12号，ThinkPHP官方团队发布“ThinkPHP5.0.17&5.1.9版本发布——包含安全更新”通知，提醒用户第一时间更新框架版本。"}
{"title": "自用Linux版学习用品分享", "url": "https://www.freebuf.com/sectool/168278.html", "time": "2018-04-19", "level": "金币+5", "num_look": 426224, "num_comment": 16, "author": "fox-style", "tags": ["工具"], "text": "由于自己是个Linux Lover，自从用上了kali，就和windows下很多学习用品无缘了，所以只能用一些同功能的替代用品来丰富一下kali linux 系统自带。"}
{"title": "黑客入侵加密企业所有服务器，嚣张留言勒索9.5比特币", "url": "https://www.freebuf.com/articles/web/168407.html", "time": "2018-04-19", "level": "红色标题", "num_look": 679165, "num_comment": 21, "author": "腾讯电脑管家", "tags": ["WEB安全"], "text": "某公司反馈，公司里数台Windows服务器中了勒索病毒，电脑除了C盘，其他磁盘分区都被整个加密，公司业务已接近停摆。"}
{"title": "美国国家安全局NSA发布十大网络安全缓解战略", "url": "https://www.freebuf.com/articles/network/168550.html", "time": "2018-04-19", "level": "", "num_look": 267570, "num_comment": 267570, "author": "雨生大海", "tags": ["网络安全", "观点"], "text": "美国国家安全局的十大缓解战略反击了APT攻击者可能使用的各种技术手段。美国国家安全局的缓解措施为企业组织确定了优先事项，以尽量减少业务影响。"}
{"title": "内存取证：查找Metasploit的Meterpreter踪迹", "url": "https://www.freebuf.com/sectool/168218.html", "time": "2018-04-19", "level": "", "num_look": 319232, "num_comment": 5, "author": "secist", "tags": ["WEB安全", "工具"], "text": "本文将向你展示如何使用取证框架Volatility来找出Metasploit的蛛丝马迹。"}
{"title": "安信证券招聘高级安全工程师", "url": "https://www.freebuf.com/jobs/168683.html", "time": "2018-04-19", "level": "", "num_look": 174514, "num_comment": 2, "author": "Evilest", "tags": ["安全招聘"], "text": "安信证券股份有限公司是经中国证监会批准， 由中国证券投资者保护基金有限责任公司联合深圳市投资控股有限公司设立的股份制企业，2006年8月在深圳注册成立，注册资本15.1亿元。"}
{"title": "穿越云雾：国内公有云VPC隔离性初探", "url": "https://www.freebuf.com/articles/network/169013.html", "time": "2018-04-19", "level": "现金奖励", "num_look": 292337, "num_comment": 5, "author": "ipenox", "tags": ["网络安全"], "text": "在现实中，各云产商对于“隔离”的实现情况又是如何的呢？就让我们实地去试探一下吧！"}
{"title": "RSA 2018 | 务实将成为网络安全的未来之路", "url": "https://www.freebuf.com/articles/neopoints/169164.html", "time": "2018-04-19", "level": "", "num_look": 138385, "num_comment": 1, "author": "360企业安全", "tags": ["观点"], "text": "RSA 2018大会最精彩的两天已经过去了，透过大会纷繁绚烂的展示和纷至沓来的大咖主题演讲，已经呈现出了值得行业关注的趋势和方向，360企业安全副总裁左英男分享了他对于RSAC2018的观察和思考。"}
{"title": "记一次渗透测试过程中的Zabbix命令执行利用", "url": "https://www.freebuf.com/articles/web/168819.html", "time": "2018-04-19", "level": "", "num_look": 351284, "num_comment": 7, "author": "itlance_ouyang", "tags": ["WEB安全"], "text": "管理员在安装配置Zabbix过程中，使用了弱口令或默认的用户名与口令（Admin/zabbix），这样，Zabbix服务器的用户认证就形同虚设。"}
{"title": "谨防隐私泄露，一个链接就能了解你的一切", "url": "https://www.freebuf.com/articles/web/168682.html", "time": "2018-04-19", "level": "金币+5", "num_look": 520264, "num_comment": 12, "author": "CarlStar", "tags": ["WEB安全"], "text": "某日表哥丢过来一个链接，说可以查到手机号或者邮箱号下面注册过的账号，于是有了下面的分析。"}
{"title": "英特尔发布新技术，利用内置GPU扫描恶意程序", "url": "https://www.freebuf.com/news/169014.html", "time": "2018-04-19", "level": "", "num_look": 150809, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "英特尔昨天在RSA 2018安全会议上发布了几项新技术，其中一项功能是把病毒扫描嵌入了一些英特尔CPU的集成图形处理器上。"}
{"title": "BUF早餐铺 | 微软、Facebook等34家科技企业签署协议，不支持政府黑客行动；美国土安全部长称可以对资助网络攻击的国家发动网络攻击；因蓝屏概率提升，win10春季创意者更新推迟", "url": "https://www.freebuf.com/news/169012.html", "time": "2018-04-19", "level": "", "num_look": 140066, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "RSA 2018上微软、Facebook签署的协议表示不支持政府黑客行动，几乎同时美国国土安全部长表示会对资助网络攻击的国家发动网络攻击，这些难免尴尬情况出现。"}
{"title": "Bondat蠕虫再度来袭！控制PC构建挖矿僵尸网络", "url": "https://www.freebuf.com/articles/system/169034.html", "time": "2018-04-18", "level": "", "num_look": 300085, "num_comment": 2, "author": "360安全", "tags": ["系统安全"], "text": "360互联网安全中心监测到流行蠕虫家族Bondat的感染量出现一轮小爆发。"}
{"title": "Struts2著名RCE漏洞引发的十年之思", "url": "https://www.freebuf.com/vuls/168609.html", "time": "2018-04-18", "level": "", "num_look": 899800, "num_comment": 3, "author": "深信服千里目安全实验室", "tags": ["漏洞"], "text": "从2007年7月23日发布的第一个Struts2漏洞S2-001到2017年12月发布的最新漏洞S2-055，跨度足足有十年，而漏洞的个数也升至55个。"}
{"title": "RSA 2018 | 厂商纷纷宣布更新，数据、加密、AI、平台化、集成与创新成为关键词", "url": "https://www.freebuf.com/news/169057.html", "time": "2018-04-18", "level": "红色标题", "num_look": 289821, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "RSA 2018 大会首日，多家厂商在大会上发布了新技术或新业务，AI、机器学习、平台化、集成、创新成为关键词，在一定程度上体现了当前网络安全领域的重点或趋势。"}
{"title": "“寄生推”SDK云控作恶，300多款应用不幸躺枪", "url": "https://www.freebuf.com/articles/terminal/168984.html", "time": "2018-04-18", "level": "", "num_look": 394547, "num_comment": 8, "author": "腾讯手机管家", "tags": ["终端安全"], "text": "依托腾讯安全大数据，腾讯安全反诈骗实验室自研的TRP-AI反病毒引擎捕获到多款知名应用在用户设备上存在私自提权，静默植入应用等恶意操作。"}
{"title": "Deep Exploit：结合机器学习的全自动渗透测试工具", "url": "https://www.freebuf.com/sectool/167844.html", "time": "2018-04-18", "level": "", "num_look": 532646, "num_comment": 9, "author": "secist", "tags": ["工具"], "text": "Deep Exploit是一款可与Metasploit链接使用，且结合机器学习的全自动渗透测试工具。"}
{"title": "疑似巴基斯坦某组织近期攻击样本分析及溯源", "url": "https://www.freebuf.com/articles/paper/168528.html", "time": "2018-04-18", "level": "", "num_look": 287476, "num_comment": 10, "author": "小河西村安全研究所", "tags": ["安全报告"], "text": "该组织今年3-4月的攻击样本中，小编没有见到最近流行的CVE-2017-0199、CVE-2017-8570、CVE-2017-11882、CVE-2018-0802漏洞的使用，而是另辟思路在RTF文档中内嵌带宏的Excel文档展开攻击。"}
{"title": "利用DiskShadow服务实现免杀持久化控制以及活动目录数据库提取", "url": "https://www.freebuf.com/articles/system/168115.html", "time": "2018-04-18", "level": "", "num_look": 273106, "num_comment": 1, "author": "clouds", "tags": ["系统安全"], "text": "在这篇文章中，我会介绍DiskShadow服务现行的，用于免杀、持久化控制和数据提取的后渗透可利用性，以及一些具体的安全防护措施。"}
{"title": "漏洞预警 | WebLogic WLS核心组件反序列化漏洞（CVE-2018-2628）", "url": "https://www.freebuf.com/vuls/168993.html", "time": "2018-04-18", "level": "红色标题", "num_look": 409690, "num_comment": 12, "author": "漏洞盒子", "tags": ["漏洞"], "text": "北京时间4月18日凌晨，Oracle官方发布了4月份的关键补丁更新CPU（CriticalPatchUpdate）,其中包含一个高危的Weblogic反序列化漏洞(CVE-2018-2628)。"}
{"title": "RSA 2018 | 微软发布定制芯片和自制版本的Linux系统，保护IoT设备", "url": "https://www.freebuf.com/news/168992.html", "time": "2018-04-18", "level": "红色标题", "num_look": 178281, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "在 RSA 2018 大会首日，微软发布了一款新的安全产品 Azure Sphere，主要用于保护 IoT 设备。"}
{"title": "陌陌科技诚聘安全各方面高级人才", "url": "https://www.freebuf.com/jobs/168335.html", "time": "2018-04-18", "level": "", "num_look": 148848, "num_comment": 3, "author": "andy110", "tags": ["安全招聘"], "text": "MOMO是陌陌（NASDAQ：MOMO）推出的一款基于地理位置的开放式移动视频社交应用，是目前中国最大的泛社交泛娱乐平台。"}
{"title": "Pam-Python实现SSH的短信双因素认证", "url": "https://www.freebuf.com/articles/web/165139.html", "time": "2018-04-18", "level": "现金奖励", "num_look": 387162, "num_comment": 8, "author": "yuegui_2004", "tags": ["WEB安全"], "text": "谈及到双因子认证或多因子认证时，解决方案有很多，可能会想到短信验证码、RSA动态令牌、Google Authenticator或者Duo"}
{"title": "中兴惨遭英美两国封杀，再次敲响“自主可控”的警钟", "url": "https://www.freebuf.com/news/168888.html", "time": "2018-04-18", "level": "红色标题", "num_look": 388644, "num_comment": 10, "author": "Allen别bb", "tags": ["资讯"], "text": "此前美国限制华为设备一事顶多是影响华为在美国本土市场的发展，而这一次美国针对中兴的禁令却是要彻底断绝了中兴继续采购美国零部件的可能，期限更是长达七年。"}
{"title": "来自智能合约中的威胁：去中心化应用安全威胁Top10榜单", "url": "https://www.freebuf.com/news/168383.html", "time": "2018-04-18", "level": "", "num_look": 193393, "num_comment": 193393, "author": "Elaine_z", "tags": ["资讯"], "text": "NCC Group 发起了一个名为 2018 年去中心化应用安全威胁 Top10 的项目，包括递归调用漏洞、权限控制漏洞、算数问题、返回值问题、拒绝服务、伪随机等问题。"}
{"title": "研究人员：黑客可以通过电源线从计算机窃取数据", "url": "https://www.freebuf.com/news/168552.html", "time": "2018-04-18", "level": "", "num_look": 260682, "num_comment": 5, "author": "Sphinx", "tags": ["资讯"], "text": "来自以色列内盖夫本古里安大学的研究人员一直致力于通过旁路攻击从计算机窃取数据。最新的研究成果是通过电源线传播的电流波动隐蔽地窃取高度敏感的数据。"}
{"title": "x86环境病毒分析的反汇编基础知识", "url": "https://www.freebuf.com/articles/system/166220.html", "time": "2018-04-18", "level": "", "num_look": 218175, "num_comment": 3, "author": "kabeor", "tags": ["系统安全"], "text": "本文是一篇对x86环境下进行病毒分析所需的基础反汇编知识的简单总结，更深层的知识还需要实战经验。"}
{"title": "BUF早餐铺 | BigID 获得 RSA 2018创新沙盒冠军；俄罗斯封禁180万个IP以封杀Telegram；Moxa EDR-810工业路由器中存在大量严重漏洞；美国对中兴采取制裁措施", "url": "https://www.freebuf.com/news/168863.html", "time": "2018-04-18", "level": "", "num_look": 155199, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "画堂三月初三日，絮扑窗纱燕拂檐。莲子数杯尝冷酒， 柘枝一曲试春衫。"}
{"title": "奇葩！赌场可通过互联网连接鱼缸温度计获取数据", "url": "https://www.freebuf.com/news/168857.html", "time": "2018-04-17", "level": "", "num_look": 208504, "num_comment": 4, "author": "Sphinx", "tags": ["资讯"], "text": "最近网络安全公司Darktrace的CEO Nicole Eagan周四在伦敦举行的一次活动中告诉与会者，黑客通过赌场大厅鱼缸中联网的温度计入侵了赌场。"}
{"title": "【更新回播】从业务安全架构层面谈普惠金融安全建设之路 | FreeBuf企业精品公开课 × 宜信", "url": "https://www.freebuf.com/fevents/167905.html", "time": "2018-04-17", "level": "红色标题", "num_look": 755306, "num_comment": 15, "author": "FB客服", "tags": ["FreeBuf公开课", "活动"], "text": "4月17日 20:00 ，宜信安全部门负责人李建芳将为我们分享普惠金融科技安全的应对之道。18元限量优惠价，好的技术与经验值得你付费ヽ(ˋ▽ˊ)ノ"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列-Mark Litchfield", "url": "https://www.freebuf.com/video/168826.html", "time": "2018-04-17", "level": "红色标题", "num_look": 209615, "num_comment": 1, "author": "willhuang", "tags": ["视频"], "text": "Mark Litchfield是HackerOne上百分位93区段且排名前5的顶尖白帽，也是著名众测社区Bugbountyhq的创始人，让我们一起来聆听Mark Litchfield对挖洞经历和经验的分享。"}
{"title": "“瑞士军刀”Netcat使用方法总结", "url": "https://www.freebuf.com/sectool/168661.html", "time": "2018-04-17", "level": "", "num_look": 561759, "num_comment": 10, "author": "Fly鹏程万里", "tags": ["工具"], "text": "最近在做渗透测试的时候遇到了端口监听和shell的反弹问题，在这个过程中自己对Netcat这一款神器有了新的认识，现将一些Netcat的用法做一个小总结，希望对各位有帮助！"}
{"title": "从PNG tEXt到存储型XSS", "url": "https://www.freebuf.com/articles/web/167843.html", "time": "2018-04-17", "level": "", "num_look": 216961, "num_comment": 4, "author": "secist", "tags": ["WEB安全"], "text": "最近在对某客户的站点做测试时我遇到了一些麻烦。在对许多上传点测试后我发现这些上传点都有着非常严格的文件过滤机制只接受扩展名为.PNG的文件。"}
{"title": "利用蓝牙从FUZE获取信用卡数据测试", "url": "https://www.freebuf.com/articles/database/167925.html", "time": "2018-04-17", "level": "", "num_look": 252435, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["数据安全"], "text": "这篇文章主要讨论关于FUZE Card智能卡的安全问题，这是一种带有蓝牙功能的可编程信用卡，大小跟普通信用卡一样，但FUZE可以取代至少30张信用卡。"}
{"title": "华为招聘大数据安全分析工程师", "url": "https://www.freebuf.com/jobs/168156.html", "time": "2018-04-17", "level": "", "num_look": 209066, "num_comment": 5, "author": "Lakiro", "tags": ["安全招聘"], "text": "华为于1987年注册成立，业务范围涉及电信网络、企业网络、消费者和云计算。"}
{"title": "绕过Windows Control Flow Guard思路分享", "url": "https://www.freebuf.com/articles/system/167660.html", "time": "2018-04-17", "level": "", "num_look": 225914, "num_comment": 225914, "author": "jaguoooooo", "tags": ["系统安全"], "text": "论文中提出了一种新的绕过Windows CFG的方法，具有一定的灵活性，并且文章中提到在Windows系统中存在较多的可用gadget。"}
{"title": "某搜索引擎Self-XSS点击劫持案例分享", "url": "https://www.freebuf.com/articles/web/168367.html", "time": "2018-04-17", "level": "现金奖励", "num_look": 343557, "num_comment": 9, "author": "nancce", "tags": ["WEB安全"], "text": "在AI横飞的今天，网站页面不挂个聊天机器人都会觉得low，笔者在某搜索引擎的页面上就发现了这样一个聊天AI，无聊一试发现了一个xss。"}
{"title": "CVE申请的那些事", "url": "https://www.freebuf.com/news/168362.html", "time": "2018-04-17", "level": "现金奖励", "num_look": 956102, "num_comment": 34, "author": "安全圈套的套哥", "tags": [], "text": "面试的时候可以在简历中附上提交过的原创漏洞如CVE、CNVD编号等信息，以证明自己在漏洞挖掘方面的技术经验和能力。本文将和大家分享申请CVE的方法和技巧。"}
{"title": "记一次网站测试引发的注入“血案”", "url": "https://www.freebuf.com/articles/web/168468.html", "time": "2018-04-17", "level": "金币+5", "num_look": 420774, "num_comment": 13, "author": "tdcoming", "tags": ["WEB安全"], "text": "最近收到boss指令，对某网站进行安全评估测试，当然目前网站漏洞还是存在的，写一些工作记录，希望大佬踊跃发言指导。"}
{"title": "神秘方盒可破解任意iPhone，美国警察纷纷抢购这款破案神器", "url": "https://www.freebuf.com/news/168758.html", "time": "2018-04-17", "level": "", "num_look": 465675, "num_comment": 12, "author": "shidongqi", "tags": ["终端安全", "资讯"], "text": "自从2016年FBI求助苹果帮忙解锁恐怖分子的iPhone而惨遭拒绝之后，破解iPhone就已经不再只是黑客的目标，美国警察无不寻找各种破解iPhone的技术手段。"}
{"title": "BUF 早餐铺 | 泰国最大的4G移动运营商TrueMove H遭遇数据泄露；微软工程师在Reveton勒索软件案中被起诉；Intel SPI闪存漏洞让攻击者能够改变或删除BIOS/UEFI固件；微软工程师在Reveton勒索软件案中被起诉", "url": "https://www.freebuf.com/news/168753.html", "time": "2018-04-17", "level": "", "num_look": 195917, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "微博根据《网络安全法》等法律法规的要求，严格履行企业主体责任，现开展为期三个月的清理行动。"}
{"title": "暴风等知名软件广告页遭挂马攻击，十多万用户被病毒感染", "url": "https://www.freebuf.com/news/168636.html", "time": "2018-04-16", "level": "", "num_look": 252858, "num_comment": 11, "author": "火绒安全", "tags": ["资讯"], "text": "国内多家知名软件、网站的广告页面遭到病毒团伙的\"挂马攻击\"。用户访问该页面，即会触发浏览器漏洞，导致病毒代码被自动激活。"}
{"title": "RSA 2018 | 参展厂商云集；创新沙盒企业竞争激烈；热门观点抢先看（附议题PPT下载）", "url": "https://www.freebuf.com/news/168756.html", "time": "2018-04-16", "level": "", "num_look": 239841, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "RSA 大会中，主题演讲、采访对谈无疑是参会人员的关注重点，其中创新沙盒企业竞赛、现场展厅也是亮点。"}
{"title": "泰国最大的4G移动运营商TrueMove H遭遇数据泄露", "url": "https://www.freebuf.com/news/168708.html", "time": "2018-04-16", "level": "", "num_look": 233729, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "泰国最大的4G移动运营商TrueMove H遭遇数据泄露，AWS上46000人数据被直接曝光在网上，包括驾驶执照和护照等信息。"}
{"title": "浏览器的自动填充功能真的安全吗？我看未必！", "url": "https://www.freebuf.com/articles/web/166975.html", "time": "2018-04-16", "level": "", "num_look": 249091, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "在今天这个“芯片当道”的时代，信用卡数据被盗事件的发生概率也一直在上升，因为攻击者可以利用各种各样的方法来窃取信用卡数据。"}
{"title": "Veil-Evasion+PyJoiner捆绑两个EXE免杀思路分享", "url": "https://www.freebuf.com/sectool/164382.html", "time": "2018-04-16", "level": "", "num_look": 408535, "num_comment": 6, "author": "АιщаУδ ○Иι讠ηē", "tags": ["工具"], "text": "最近在学习 veil 的 Veil-Evasion 模块，发现一款能捆绑两个 exe 文件的 pyJoiner 工具，便拿来学习学习，小白视角，大牛绕过。"}
{"title": "开源工具 | 宜信漏洞管理平台“洞察”开源啦！", "url": "https://www.freebuf.com/sectool/168085.html", "time": "2018-04-16", "level": "红色标题", "num_look": 594894, "num_comment": 17, "author": "宜信安全应急响应中心", "tags": ["工具"], "text": "『洞察』是宜信安全部开发，集成应用系统资产管理、漏洞全生命周期管理、安全知识库管理三位一体的管理平台。"}
{"title": "保护你移动支付应用的10个技巧", "url": "https://www.freebuf.com/articles/wireless/167534.html", "time": "2018-04-16", "level": "", "num_look": 310020, "num_comment": 3, "author": "secist", "tags": ["无线安全", "观点"], "text": "如果你看过了这些统计数据，你就不可否认如今电子商务行业发展的迅猛势头。越来越多的人网上购物，不再仅仅面向的是互联网产品和服务，包括以前只能在实体店才能购买到的商品。"}
{"title": "新浪安全移动及应用安全专项招聘", "url": "https://www.freebuf.com/jobs/168300.html", "time": "2018-04-16", "level": "", "num_look": 148920, "num_comment": 2, "author": "-吗_啡-", "tags": ["安全招聘"], "text": "新浪通过门户网站新浪网、移动门户手机新浪网和社交网络服务及微博客服务新浪微博组成的数字媒体网络，帮助广大用户通过互联网和移动设备获得专业媒体和用户自生成的多媒体内容。"}
{"title": "Linux系统ETN挖矿病毒实例分析", "url": "https://www.freebuf.com/vuls/165348.html", "time": "2018-04-16", "level": "", "num_look": 381565, "num_comment": 5, "author": "cgf99", "tags": ["漏洞", "系统安全"], "text": "当前网络安全事件中黑客利用系统漏洞实施挖矿的事件频见报道，而本团队在实际工作中却头回遇见，因此对该样本实施了具体分析。"}
{"title": "Windows漏洞利用开发教程Part 2：Short Jump", "url": "https://www.freebuf.com/articles/system/167959.html", "time": "2018-04-16", "level": "现金奖励", "num_look": 305245, "num_comment": 12, "author": "zusheng", "tags": ["系统安全"], "text": "漏洞是在硬件、软件、协议的具体实现或系统安全策略上存在的缺陷，从而可以使攻击者能够在未授权的情况下访问或破坏系统。"}
{"title": "Metasploit的简单木马免杀技术及后渗透面临的问题", "url": "https://www.freebuf.com/sectool/166682.html", "time": "2018-04-16", "level": "现金奖励", "num_look": 538912, "num_comment": 19, "author": "cureall", "tags": ["工具"], "text": "内网穿透的必要性和原理就不用说了，直接说操作。首先到ngrok官网去注册一个号，国内也有一个sunny ngrok，但是我用了几次全失败了，所以推荐国外的。"}
{"title": "利用虚拟机绕过安卓原生加密方案", "url": "https://www.freebuf.com/articles/terminal/167591.html", "time": "2018-04-16", "level": "现金奖励", "num_look": 278613, "num_comment": 8, "author": "manwu91", "tags": ["终端安全"], "text": "去年破解了某安卓app的加密算法，在抓了将近一年后发现该app有强制更新，旧版协议已经无法使用。通过分析发现返回的数据仍是用aes加密的，但密钥却是通过原生代码还原的，拿不到密钥也就无法解密。"}
{"title": "BUF 早餐铺 | 安卓厂商隐藏的事实：安全补丁的更新部署并不真实完整；研究人员：黑客可以通过电源线从计算机窃取数据；Microsoft Outlook漏洞让黑客轻松盗取您的Windows密码", "url": "https://www.freebuf.com/news/168580.html", "time": "2018-04-16", "level": "", "num_look": 156085, "num_comment": 2, "author": "Sphinx", "tags": ["资讯"], "text": "65000多台路由器感染病毒成为僵尸；印度加密货币交易平台 coinsecure 遭攻击，损失达330万美元；第3届“香港—内地网络安全论坛”在港举行；福建实施五项清单管理制度拧紧网络安全阀。"}
{"title": "对一款不到2KB大小的JavaScript后门的深入分析", "url": "https://www.freebuf.com/articles/web/167702.html", "time": "2018-04-15", "level": "", "num_look": 476535, "num_comment": 6, "author": "secist", "tags": ["WEB安全"], "text": "在一台被入侵的服务器上，我们发现了一个攻击者遗留下来的脚本。该脚本是由JavaScript编写的，主要功能是作为Windows后门及C&C后端使用。"}
{"title": "如何在CTF中少走弯路（基础篇）", "url": "https://www.freebuf.com/news/166925.html", "time": "2018-04-15", "level": "现金奖励", "num_look": 1243166, "num_comment": 16, "author": "Yokeen", "tags": [], "text": "这篇文章是自己在CTF中对于杂项这块知识学习的小结，希望可以对初入CTF的同学有所帮助，在CTF中少走弯路从而更快的提升自己。"}
{"title": "Gh0st大灰狼RAT家族通讯协议分析", "url": "https://www.freebuf.com/articles/paper/167917.html", "time": "2018-04-15", "level": "", "num_look": 548486, "num_comment": 16, "author": "云影实验室", "tags": ["安全报告"], "text": "本报告主要分析Gh0st/大灰狼远控木马的通讯协议和其源代码中关于通讯协议实现的细节，以及对Gh0st/大灰狼通讯实现从自身安全性、实现的合理性上给出评价。"}
{"title": "2017金融科技安全分析报告", "url": "https://www.freebuf.com/articles/paper/167847.html", "time": "2018-04-15", "level": "红色标题", "num_look": 411365, "num_comment": 411365, "author": "平安金融安全研究院", "tags": ["企业安全", "安全报告"], "text": "依托云计算、大数据、人工智能、区块链等先进的计算机技术的发展，金融服务也趋于多样化、便利化、智能化。金融科技的出现频率正在高速增长，至今已经步入金融科技3.0 时代。"}
{"title": "有趣的闪存：通过实践分析意外内存泄漏", "url": "https://www.freebuf.com/articles/web/167360.html", "time": "2018-04-14", "level": "", "num_look": 319175, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["WEB安全", "无线安全"], "text": "在这篇文章中，我们将对闪存进行分析。在进行了深入研究之后，我可以通过修改设备闪存的读入操作并从未认证的Web接口获取目标Web服务器的内存数据。"}
{"title": "Ngrok和树莓派绕过企业防火墙并访问内网主机实验", "url": "https://www.freebuf.com/articles/es/166403.html", "time": "2018-04-14", "level": "", "num_look": 339235, "num_comment": 8, "author": "Alpha_h4ck", "tags": ["企业安全"], "text": "绝大多数安全研究人员所面临的一个常见问题，就是如何在目标网络部署了严格的企业级防火墙或路由器时，如何访问目标企业网络内的办公计算机或者本地设备。"}
{"title": "基于TaskKill命令防杀的进程保护", "url": "https://www.freebuf.com/articles/system/168094.html", "time": "2018-04-14", "level": "现金奖励", "num_look": 452986, "num_comment": 25, "author": "Satan Spenser", "tags": ["系统安全"], "text": "大家都知道任务管理器杀死进程的方法是TerminateProcess，对此类方法的进程保护可以采用全局hook TerminateProcess 以及 OpenProcess函数来实现，这里不多做介绍在以后的文章中会详细说明。"}
{"title": "【FB TV】一周「BUF大事件」：新型绝地求生勒索软件出现，需玩游戏解锁；女黑客破解任天堂Switch；人脸识别曝光行人违规信息", "url": "https://www.freebuf.com/video/168588.html", "time": "2018-04-14", "level": "红色标题", "num_look": 350429, "num_comment": 350429, "author": "willhuang", "tags": ["视频"], "text": "本周新型绝地求生勒索软件出现，你确定不是来搞笑的？女黑客破解任天堂Switch，出厂设备无法修复；人脸识别曝光行人违规信息，对此你怎么看？"}
{"title": "如何制造一个可以绕过摄像头监控的“隐身面具”？", "url": "https://www.freebuf.com/geek/168470.html", "time": "2018-04-14", "level": "红色标题", "num_look": 1562458, "num_comment": 22, "author": "AngelaY", "tags": ["极客"], "text": "如何避开摄像头的眼睛呢？有网友分享了一种方法，自己动手，在帽子上加一些高亮红外 LED 设备，就能成功“隐身”。"}
{"title": "HITB 2018 | 黑客利器HackCUBE全球首秀，360鲲鹏安全团队采访实录", "url": "https://www.freebuf.com/articles/people/168165.html", "time": "2018-04-13", "level": "红色标题", "num_look": 1196032, "num_comment": 12, "author": "shidongqi", "tags": ["人物志", "活动"], "text": "HackCUBE是一个自由度很高的攻防研究硬件平台，搭载各类IOT通信模块如WiFi、NFC、Bluetooth、RF等，安全研究员及爱好者皆可通过HackCUBE实现各种IOT相关安全研究以及DIY各类安全攻防程序。"}
{"title": "CNCERT网络安全信息与动态周报2018年第14期", "url": "https://www.freebuf.com/articles/paper/168583.html", "time": "2018-04-13", "level": "", "num_look": 235231, "num_comment": 235231, "author": "CNCERT", "tags": ["安全报告"], "text": "本周，互联网网络安全态势整体评价为良。我国互联网基础设施运行整体平稳，全国范围或省级行政区域内未发生造成重大影响的基础设施运行安全事件。"}
{"title": "RSA 2018 | 热点议题与CISO的关注重点", "url": "https://www.freebuf.com/news/168579.html", "time": "2018-04-13", "level": "", "num_look": 216957, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "今年 RSA 大会的主题是“Now Matters”，主页列出了将近 20 个主要议题。与 DEF CON 与 BlackHat 的纯技术议题相比，RSA 的议题更加多样化，受众范围也更广。"}
{"title": "记一次利用BLIND OOB XXE漏洞获取文件系统访问权限的测试", "url": "https://www.freebuf.com/vuls/167087.html", "time": "2018-04-13", "level": "", "num_look": 363397, "num_comment": 4, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "今天，我要和大家分享的是，我在某个邀请漏洞测试项目中，发现Bind OOB XXE漏洞的方法。"}
{"title": "HITB 2018 | 安卓厂商隐藏的事实：安全补丁的更新部署并不真实完整", "url": "https://www.freebuf.com/news/168530.html", "time": "2018-04-13", "level": "红色标题", "num_look": 257879, "num_comment": 2, "author": "Elaine_z", "tags": ["资讯"], "text": "Hack in the Box 安全会议上，研究人员 Karsten Nohl 和 Jakob Lell 详细展示了他们在过去两年中对数千部 Android 手机操作系统代码进行逆向工程的结果。"}
{"title": "CVE-2017-12542简单分析及复现", "url": "https://www.freebuf.com/vuls/167124.html", "time": "2018-04-13", "level": "", "num_look": 351721, "num_comment": 4, "author": "5ecurity", "tags": ["漏洞"], "text": "CVE-2017-12542是一个CVSS 9.8的高分漏洞，漏洞利用条件简单，危害较大。近十年来，iLO是几乎所有惠普服务器中都嵌入的服务器管理解决方案。"}
{"title": "渗透思路 | 加密货币矿工和信用卡信息泄露", "url": "https://www.freebuf.com/articles/blockchain-articles/167119.html", "time": "2018-04-13", "level": "", "num_look": 218932, "num_comment": 218932, "author": "secist", "tags": ["区块链安全"], "text": "在这篇文章中，我们将揭示与虚假 flash 更新攻击密切相关的一个非常热门的话题——加密货币和挖矿。"}
{"title": "阿里巴巴招聘红蓝对抗方向安全专家", "url": "https://www.freebuf.com/jobs/167816.html", "time": "2018-04-13", "level": "", "num_look": 506143, "num_comment": 12, "author": "AlibabaBlueteam", "tags": ["安全招聘"], "text": "阿里巴巴创建于1998年年底，总部设在杭州，并在海外设立美国硅谷、伦敦等分支机构。"}
{"title": "Sqlite联合注入辅助脚本", "url": "https://www.freebuf.com/articles/database/168012.html", "time": "2018-04-13", "level": "现金奖励", "num_look": 322357, "num_comment": 3, "author": "freebuf01", "tags": ["数据安全"], "text": "SQLite的，是一款轻型的数据库。sqlite存在一个叫SQLITE_MASTER的表，这与MySQL5.x的INFORMATION_SCHEMA表类似。"}
{"title": "看我花式绕过校园网计费认证", "url": "https://www.freebuf.com/geek/167641.html", "time": "2018-04-13", "level": "金币+10", "num_look": 2449110, "num_comment": 54, "author": "康康你秋裤穿反啦", "tags": ["极客"], "text": "看到标题你就想到渗透校园网计费系统，然后修改个账户什么的，免费用网到毕业？小旁友，你中毒太深咯。"}
{"title": "制作iOS内核调试线与调试内核", "url": "https://www.freebuf.com/articles/terminal/167899.html", "time": "2018-04-13", "level": "现金奖励", "num_look": 315557, "num_comment": 4, "author": "wooy0ung", "tags": ["极客", "终端安全"], "text": "早期A4处理器的机器是能直接调内核的，而且30pin的数据线并没有对内核信息加密，因此我们能够直接读到内核数据。"}
{"title": "DefineClass在Java反序列化当中的利用", "url": "https://www.freebuf.com/articles/others-articles/167932.html", "time": "2018-04-13", "level": "", "num_look": 323868, "num_comment": 2, "author": "阿里安全", "tags": ["其他"], "text": "本文分享一下defineClass在反序列化漏洞当中的使用场景，以及在exp构造过程中的一些使用技巧，马上进入正题。"}
{"title": "BUF早餐铺 | AMD发布针对Spectre v2漏洞的最新补丁；扎克伯格听证会承认数据被卖给第三方；主流Web浏览器将迎来全新标准", "url": "https://www.freebuf.com/news/168417.html", "time": "2018-04-13", "level": "", "num_look": 149986, "num_comment": 2, "author": "Akane", "tags": ["资讯"], "text": "AMD发布针对Spectre v2漏洞的最新补丁；扎克伯格听证会承认有数据被卖给恶意第三方；主流Web浏览器将迎来全新标准；上海某区块链峰会被紧急叫停。"}
{"title": "恶意广告掀起“412挂马风暴”，50余款知名软件受影响", "url": "https://www.freebuf.com/articles/paper/168513.html", "time": "2018-04-12", "level": "", "num_look": 332560, "num_comment": 12, "author": "腾讯电脑管家", "tags": ["安全报告"], "text": "今日，御见威胁情报中心监控到大量客户端的内嵌新闻页中被嵌入恶意代码。用户会在毫无知情的情况，被植入挖矿木马、银行木马、以及远控木马等。本波挂马波及到的客户端多达50多个，影响范围非常之广。"}
{"title": "变种入侵？keqiCryptomix勒索病毒最新变种预警", "url": "https://www.freebuf.com/articles/web/167083.html", "time": "2018-04-12", "level": "", "num_look": 207645, "num_comment": 1, "author": "深信服千里目安全实验室", "tags": ["WEB安全"], "text": "这次 Cryptomix 勒索病毒最新的变种采用 RSA1024 加密算法，将系统中的大部分文档文件加密为 .MOLE66 后缀的文件，然后对用户进行勒索。"}
{"title": "【FreeBuf字幕组】HackerOne优秀白帽黑客采访系列-Sean Melia", "url": "https://www.freebuf.com/video/168291.html", "time": "2018-04-12", "level": "红色标题", "num_look": 286320, "num_comment": 2, "author": "willhuang", "tags": ["FreeBuf公开课", "视频"], "text": "Sean Melia 算是Web漏洞挖掘领域的超级大牛了，作为安全公司渗透测试方面资深的技术奇才，在HackerOne上以14225分的声望值排名第2，曾在两年时间里通过漏洞赏金项目狂赚到了40多万美元。"}
{"title": "手把手教你接管基于BLE的IoT智能灯泡", "url": "https://www.freebuf.com/articles/network/167132.html", "time": "2018-04-12", "level": "", "num_look": 445251, "num_comment": 2, "author": "secist", "tags": ["工控安全", "网络安全"], "text": "在这篇文章中。我将手把手的教大家如何接管一个基于BLE的IoT智能灯泡。"}
{"title": "通过F5 BIG-IP LTM的会话Cookie获取Facebook服务器内网IP", "url": "https://www.freebuf.com/articles/web/167129.html", "time": "2018-04-12", "level": "", "num_look": 320627, "num_comment": 4, "author": "clouds", "tags": ["WEB安全"], "text": "本篇文章，我们就来讲述利用持久性cookie来实现会话保持的技巧，发现Facebook服务器内部IP信息。"}
{"title": "百度安全实验室安全人才招聘", "url": "https://www.freebuf.com/jobs/168131.html", "time": "2018-04-12", "level": "", "num_look": 352585, "num_comment": 8, "author": "百度安全实验室", "tags": ["安全招聘"], "text": "百度安全实验室（Baidu X-Lab）是百度安全的核心能力支撑部门，由中美资深安全专家组成，覆盖安全威胁情报、下一代移动安全技术、现代企业安全防护领域。"}
{"title": "提升安全性，主流浏览器将迎来新的Web认证标准", "url": "https://www.freebuf.com/news/168378.html", "time": "2018-04-12", "level": "", "num_look": 198807, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "谷歌，微软和Mozilla的网络浏览器很快将为用户提供由FIDO联盟和万维网联盟（W3C）构建的新的无密码认证标准，目前正处于最终审批阶段。"}
{"title": "Facebook事件后的思考：浅谈企业安全教育实践", "url": "https://www.freebuf.com/articles/neopoints/167413.html", "time": "2018-04-12", "level": "现金奖励", "num_look": 351078, "num_comment": 15, "author": "ChuanFile", "tags": ["企业安全", "观点"], "text": "最近Facebook事件弄得沸沸扬扬，作为一个搞安全的IT打工仔，想着怎么也应该借此机会教育下用户呀，尽量提高员工安全意识，其实也就是降低自己的工作量嘛。"}
{"title": "经验分享 | 记一次RSA破解", "url": "https://www.freebuf.com/articles/database/167597.html", "time": "2018-04-12", "level": "金币+5", "num_look": 344741, "num_comment": 10, "author": "白帽子马振华", "tags": ["数据安全"], "text": "我一直都认为比赛是最容易提升自己实力的一种途径，上次比赛也发现了自己的不足，今天看了一天的RSA算法……"}
{"title": "DELPHI黑客编程（三）：简单远控原理实现", "url": "https://www.freebuf.com/articles/system/166876.html", "time": "2018-04-12", "level": "现金奖励", "num_look": 311324, "num_comment": 7, "author": "5ecurity", "tags": ["系统安全"], "text": "本节将给大家带来简单界面的远控demo实现，正如大家知道的delphi做界面开发是很方便的，并且有很多好用又简单的控件可以使用，与之前两节相比可视化程度要高很多。"}
{"title": "从一次攻防平台搭建浅谈企业网络安全建设", "url": "https://www.freebuf.com/articles/network/167638.html", "time": "2018-04-12", "level": "现金奖励", "num_look": 721373, "num_comment": 21, "author": "康康你秋裤穿反啦", "tags": ["企业安全", "网络安全"], "text": "本文涉及的知识点：IDS/IPS/防火墙的区别与部署位置；镜像端口、堡垒机的位置和注意细节；ACL访问控制列表和端口安全、VLAN安全；靶场以及日志采集的实施细节。"}
{"title": "BUF早餐铺 | 超15亿条敏感数据遭泄露；国内勒索病毒疫情严重,每天十多万台电脑被感染;Facebook为报告数据滥用漏洞者提供赏金", "url": "https://www.freebuf.com/news/168260.html", "time": "2018-04-12", "level": "", "num_look": 179259, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "语音版BUF早餐铺首度上线，眼睛还没睁开的童鞋就竖起耳朵听吧~"}
{"title": "加勒比岛屿圣马丁岛政府遭黑客攻击，全部公共服务关停", "url": "https://www.freebuf.com/news/168249.html", "time": "2018-04-11", "level": "", "num_look": 192412, "num_comment": 2, "author": "Sphinx", "tags": ["资讯"], "text": "网络攻击关闭了加勒比岛屿圣马丁岛的整个政府基础设施，公共服务全部中断。"}
{"title": "走在路上能被识别人脸，该为高科技而喜还是为隐私而忧？", "url": "https://www.freebuf.com/articles/neopoints/168177.html", "time": "2018-04-11", "level": "红色标题", "num_look": 692903, "num_comment": 23, "author": "AdlerI", "tags": ["观点"], "text": "你永远找不到我们。但无论是受害人还是行凶者，只要你的号码被列出来，我们就会找到你。"}
{"title": "我们可以教机器学习隐私吗？", "url": "https://www.freebuf.com/articles/neopoints/167285.html", "time": "2018-04-11", "level": "", "num_look": 234991, "num_comment": 234991, "author": "Alpha_h4ck", "tags": ["观点"], "text": "我们是否能够把机器学习当作一种服务（机器学习即服务-MLaaS）来使用并保护我们的隐私呢？"}
{"title": "近年来APT组织使用的10大（类）安全漏洞", "url": "https://www.freebuf.com/articles/network/168121.html", "time": "2018-04-11", "level": "", "num_look": 344116, "num_comment": 6, "author": "奇安信威胁情报中心", "tags": ["网络安全"], "text": "APT攻击（Advanced Persistent Threat，高级持续性威胁）是利用先进的攻击手段对特定目标进行长期持续性网络攻击的攻击形式。"}
{"title": "由Three Hit聊聊二次注入", "url": "https://www.freebuf.com/articles/web/167089.html", "time": "2018-04-11", "level": "金币+6", "num_look": 383061, "num_comment": 6, "author": "tinyfisher", "tags": ["WEB安全"], "text": "上周末参加“强网杯”，学到了不少姿势，其中的web题three hit印象深刻，考的是二次注入的问题，这里对二次注入尝试做一个小结。"}
{"title": "AVCrypt：一款尝试卸载反病毒软件的勒索病毒", "url": "https://www.freebuf.com/articles/system/167100.html", "time": "2018-04-11", "level": "", "num_look": 228231, "num_comment": 4, "author": "江民安全实验室", "tags": ["系统安全"], "text": "近期国外发现一款名为AVCrypt的勒索软件，该勒索软件在执行文件加密操作前会尝试卸载已安装的反病毒软件，并且尝试移除大量与系统安全相关的服务，从而弱化系统的防御力。"}
{"title": "对不起，我是音乐人：探索音乐密码学", "url": "https://www.freebuf.com/articles/wireless/167093.html", "time": "2018-04-11", "level": "", "num_look": 302328, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["无线安全"], "text": "脑洞大开，把音符映射成字母，音乐人可以把秘密隐藏在旋律中。"}
{"title": "修复更新 | 微软4月修复66个漏洞；Adobe修复19个漏洞", "url": "https://www.freebuf.com/news/168236.html", "time": "2018-04-11", "level": "", "num_look": 219009, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "4 月 10 日是微软四月的修复日。此次微软一共发布了 66 个补丁，Adobe 也相应修复了 6 款产品中的 19 个漏洞。"}
{"title": "盘古运营服务有限公司诚聘安全人才", "url": "https://www.freebuf.com/jobs/167234.html", "time": "2018-04-11", "level": "", "num_look": 195686, "num_comment": 12, "author": "pioneerservice", "tags": ["安全招聘"], "text": "深圳市盘古运营服务有限公司（盘古运营）成立于2014年，总部位于深圳市龙岗区，在深圳、北京、上海、广州等多个城市设有服务实施中心；在深圳、广州设有研发中心。"}
{"title": "C0594组织恶意挖矿攻击，已攻陷数千个网站", "url": "https://www.freebuf.com/articles/web/167620.html", "time": "2018-04-11", "level": "", "num_look": 266632, "num_comment": 7, "author": "腾讯电脑管家", "tags": ["WEB安全"], "text": "腾讯御见威胁情报中心近期监测发现，包括传统企业、互联网公司、学校和政府机构等在内的多个网站网页被植入挖矿JS脚本。"}
{"title": "利用.MF后缀文件猥琐绕过火绒杀毒测试", "url": "https://www.freebuf.com/articles/system/167901.html", "time": "2018-04-11", "level": "现金奖励", "num_look": 459082, "num_comment": 15, "author": "Backspaces", "tags": ["系统安全"], "text": "最近在做测试，后门文件一直无法绕过火绒的主动防御，最后在Github找到个猥琐绕过火绒主防御的手法的手法，该手法亲测可以成功绕过火绒。"}
{"title": "DELPHI黑客编程（二）：反弹后门原理实现", "url": "https://www.freebuf.com/articles/web/166732.html", "time": "2018-04-11", "level": "现金奖励", "num_look": 236742, "num_comment": 4, "author": "5ecurity", "tags": ["WEB安全"], "text": "所谓“反弹后门”是指被控机会主动发起对控制机的连接，控制机会监听本地端口等待被控机的连接，然后发送控制指令对被控机实施控制。"}
{"title": "使用Nmap进行大规模的分布式漏洞检测", "url": "https://www.freebuf.com/articles/network/167596.html", "time": "2018-04-11", "level": "现金奖励", "num_look": 522614, "num_comment": 14, "author": "你会忘了我", "tags": ["网络安全"], "text": "nmap是一个采用GPL许可的开源扫描器，在最初的时候nmap只是一个网络扫描和嗅探工具包。"}
{"title": "任意密码重置的一个场景", "url": "https://www.freebuf.com/articles/database/167692.html", "time": "2018-04-11", "level": "现金奖励", "num_look": 431877, "num_comment": 31, "author": "三只小潴", "tags": ["数据安全"], "text": "做授权渗透的时候要求要写明文传输漏洞，导致很多没有上 HTTPS 的网站为了修这个明文传输的问题，用尽了各种做法，常见的是用 RSA 或是 AES 对传输的数据加密后传输。"}
{"title": "BUF早餐铺 | Sodexo 数据泄露；虚拟货币 Verge(XVG) 遭攻击；恶搞勒索软件PUBG瞄准吃鸡游戏；Linux系统的beep包存在漏洞", "url": "https://www.freebuf.com/news/168134.html", "time": "2018-04-11", "level": "", "num_look": 159757, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "你是人间四月天，早餐请你吃生煎~"}
{"title": "谷歌申请新专利，利用区块链技术保护用户数据安全", "url": "https://www.freebuf.com/news/168150.html", "time": "2018-04-10", "level": "", "num_look": 236416, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "谷歌前不久向美国专利和商标局申请了一项专利，旨在利用区块链技术保护用户数据的安全性。"}
{"title": "绝地求生勒索软件：通过玩游戏解锁文件", "url": "https://www.freebuf.com/news/168113.html", "time": "2018-04-10", "level": "", "num_look": 236551, "num_comment": 8, "author": "Sphinx", "tags": ["资讯"], "text": "大千世界无奇不有，最近，研究人员发现一款新的勒索软件，名为绝地求生勒索软件。软件的创新不在于牛X的感染途径，而是解密方式。"}
{"title": "【免费报名】极致你的SOC：建设智慧安全运营中心 | FreeBuf企业精品公开课 × IBM", "url": "https://www.freebuf.com/fevents/167794.html", "time": "2018-04-10", "level": "红色标题", "num_look": 204550, "num_comment": 2, "author": "FB客服", "tags": ["FreeBuf公开课", "活动"], "text": "4月25日16:00，FreeBuf 特邀IBM大中华区安全事业部信息安全高级顾问吴斌先生，为我们分享智慧安全运营中心（SOC）的建设与运营之路。"}
{"title": "警惕！新型RDP爆破蠕虫Morto来袭", "url": "https://www.freebuf.com/news/167365.html", "time": "2018-04-10", "level": "", "num_look": 451114, "num_comment": 2, "author": "深信服千里目安全实验室", "tags": ["网络安全", "资讯"], "text": "近期，千里目安全实验室EDR安全团队接到多个企业用户反馈，其企业内网近百台计算机在使用过程中会突然跳出到windows登录界面，且再次登录就提示远程桌面繁忙。"}
{"title": "CVE-2018-4878案例：针对香港某电信公司网站被入侵攻击的调查", "url": "https://www.freebuf.com/vuls/167159.html", "time": "2018-04-10", "level": "", "num_look": 466975, "num_comment": 1, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "3月21日，Morphisec实验室就此次网站攻击开展了调查，调查人员最终发现，该电信公司集团官网被黑客入侵后，在主页面home.php中嵌入了一个Flash exploit 的CVE-2018-4878漏洞利用文件。"}
{"title": "最通俗易懂的PHP反序列化原理分析", "url": "https://www.freebuf.com/articles/web/167721.html", "time": "2018-04-10", "level": "现金奖励", "num_look": 883026, "num_comment": 13, "author": "你会忘了我", "tags": ["WEB安全"], "text": "PHP反序列化漏洞虽然利用的条件比较苛刻，但是如果可以利用一般都会产生很严重的后果。"}
{"title": "区块链应用在网络安全的六个案例", "url": "https://www.freebuf.com/articles/blockchain-articles/167034.html", "time": "2018-04-10", "level": "", "num_look": 517325, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["区块链安全"], "text": "区块链技术可以帮助我们提升加密以及认证等保护机制的安全性，这对于物联网安全以及DDoS防御社区来说绝对是一条好消息！"}
{"title": "阿里安全归零实验室招聘安全人才", "url": "https://www.freebuf.com/jobs/167924.html", "time": "2018-04-10", "level": "", "num_look": 245426, "num_comment": 6, "author": "阿里安全", "tags": ["安全招聘"], "text": "阿里安全归零实验室重点研究业务安全和数据安全领域中黑灰产风险事件背后的产业链和手法，解决相关风险问题。"}
{"title": "任意用户密码重置（六）：应答中存在影响后续逻辑的状态参数", "url": "https://www.freebuf.com/articles/web/166667.html", "time": "2018-04-10", "level": "现金奖励", "num_look": 436662, "num_comment": 4, "author": "yangyangwithgnu", "tags": ["WEB安全", "数据安全"], "text": "我把日常渗透过程中遇到的案例作了漏洞成因分析，这次，关注因重置凭证可暴破导致的任意用户密码重置问题。"}
{"title": "挖矿木马藏身“装修视频”", "url": "https://www.freebuf.com/articles/paper/167615.html", "time": "2018-04-10", "level": "", "num_look": 242646, "num_comment": 3, "author": "腾讯电脑管家", "tags": ["安全报告"], "text": "挖矿木马潜伏技巧越来越高深，一些藏在外挂辅助、浏览器中，甚至可以藏在广告短链中……"}
{"title": "手把手教你DIY自己的专属相机", "url": "https://www.freebuf.com/geek/167092.html", "time": "2018-04-10", "level": "现金奖励", "num_look": 302255, "num_comment": 17, "author": "_橙子 ゝ", "tags": ["极客"], "text": "买个单反需要几千RMB，买个普通拍立得也得几百，有点浪费money，主要是贫穷，土豪随意，最近一直在学习MicroPython，正好手上有一块开发板，就自己瞎捣鼓，自己动手DIY了1个照相机。"}
{"title": "FreeBuf 2018年企业安全月报（三月刊）", "url": "https://www.freebuf.com/articles/es/167971.html", "time": "2018-04-10", "level": "", "num_look": 268772, "num_comment": 3, "author": "Sphinx", "tags": ["企业安全"], "text": "“人总是最佳突破口，绝大多数人都不难黑，只要你倾听他们、观察他们，人的漏洞就像钉在头顶的霓虹灯一样。”"}
{"title": "BUF 早餐铺 | Auth0身份验证出现漏洞，致使企业遭受攻击；专家发现新型ATM恶意软件ATMJackpot；用必应搜索“chrome download”出现的广告会跳转到恶意网站", "url": "https://www.freebuf.com/news/167904.html", "time": "2018-04-10", "level": "", "num_look": 145382, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "间谍软件Agent Tesla变种再现：通过特制Word文档诱导安装；腾讯携手西安电子科技大学共建智慧安全创新研究院；支付宝被央行罚款18万元 涉个人金融信息使用不当等。"}
{"title": "女黑客破解任天堂Switch，称硬件漏洞无法修复", "url": "https://www.freebuf.com/news/167857.html", "time": "2018-04-09", "level": "红色标题", "num_look": 376003, "num_comment": 7, "author": "shidongqi", "tags": ["资讯"], "text": "一位女性黑客正式宣布已经破解任天堂Switch，适用于目前所有系统版本的Switch，并表示这是由NVIDIA Tegra芯片中的漏洞导致，已出厂的Switch主机无法通过系统更新修复。"}
{"title": "Loki：一款简单强大的IOC和事件响应扫描器", "url": "https://www.freebuf.com/sectool/166610.html", "time": "2018-04-09", "level": "", "num_look": 392142, "num_comment": 5, "author": "secist", "tags": ["工具"], "text": "Loki是一款检测到APT 入侵痕迹、免费且简单的IOC(妥协指标)扫描仪，完全重写了APT扫描仪THOR的主要分析模块。"}
{"title": "看我如何挖掘到WordPress漏洞并最终拿下$1337的赏金", "url": "https://www.freebuf.com/articles/web/166819.html", "time": "2018-04-09", "level": "", "num_look": 473254, "num_comment": 6, "author": "secist", "tags": ["WEB安全"], "text": "本文的目的就是希望与你分享我自 2016 年起关于 WordPress 的一些研究成果，希望大家能仔细的阅读这篇文章。"}
{"title": "间谍软件Agent Tesla变种再现：通过特制Word文档诱导安装", "url": "https://www.freebuf.com/articles/system/167848.html", "time": "2018-04-09", "level": "", "num_look": 282770, "num_comment": 2, "author": "kylin1415", "tags": ["系统安全"], "text": "近期 Fortinet 研究专家发现臭名昭著的间谍软件 Agent Tesla 出现了全新的变种，而变种传播是通过特制的 Microsoft Word文件进行的。"}
{"title": "Windows漏洞利用开发教程Part 1", "url": "https://www.freebuf.com/articles/system/166500.html", "time": "2018-04-09", "level": "现金奖励", "num_look": 529033, "num_comment": 52, "author": "zusheng", "tags": ["系统安全"], "text": "本文主要介绍的是Windows软件漏洞的利用开发教程。"}
{"title": "一文读懂CPU漏洞“裂谷”TotalMeltdown", "url": "https://www.freebuf.com/vuls/167028.html", "time": "2018-04-09", "level": "", "num_look": 304945, "num_comment": 2, "author": "腾讯电脑管家", "tags": ["安全报告", "漏洞"], "text": "微软2018年1月和2月的Windows7 x64和Windows Server 2008 R2安全更新中发现了一个致命错误，导致任意进程可以对内核进行任意读写。"}
{"title": "传奇外挂携带恶意病毒Strkon，劫持用户主页及流量", "url": "https://www.freebuf.com/articles/web/167113.html", "time": "2018-04-09", "level": "金币+10", "num_look": 373665, "num_comment": 7, "author": "0zapt4toM", "tags": ["WEB安全"], "text": "近期，我们检测到一款名为“万千辅助”的传奇外挂，携带恶意病毒驱动，我们将该病毒命名为Strkon，该病毒通过劫持用户浏览器主页和各大网站流量，从而牟取暴利。"}
{"title": "Exim Off-by-One RCE漏洞（CVE-2018-6789）利用分析(附EXP)", "url": "https://www.freebuf.com/vuls/166519.html", "time": "2018-04-09", "level": "", "num_look": 510023, "num_comment": 11, "author": "华为未然实验室", "tags": ["漏洞"], "text": "安全研究员skysider基于Meh的思路在实验环境下成功利用Exim Off-by-One RCE漏洞(CVE-2018-6789)，实现远程命令执行。"}
{"title": "没事儿下个副本吧？逆向新手踩坑指南", "url": "https://www.freebuf.com/articles/network/167128.html", "time": "2018-04-09", "level": "现金奖励", "num_look": 343499, "num_comment": 7, "author": "antiuto", "tags": ["网络安全"], "text": "老规矩，坐下，打开电脑，最好能泡一杯茶，手边再放一个肉夹馍。。。由于上一次吃过没查壳的亏，所以这次要先看一看有没有壳，用PEiD打开看一看。"}
{"title": "一名代码审计新手的实战经历与感悟", "url": "https://www.freebuf.com/articles/web/166602.html", "time": "2018-04-09", "level": "现金奖励", "num_look": 1285890, "num_comment": 35, "author": "Ka1ier", "tags": ["WEB安全"], "text": "个人认为，作为一个要入门代码审计的人，审计流程应该从简单到困难，逐步提升。因此我建议大家的审计流程为——DVWA——blueCMS——其他小众CMS——框架。"}
{"title": "BUF早餐铺 | Facebook COO回应数据泄露：不排除其他数据滥用的情况 ；Telegram因拒绝向俄罗斯政府提供加密密钥而遭起诉；RSA将收购行为分析公司Fortscale", "url": "https://www.freebuf.com/news/167779.html", "time": "2018-04-09", "level": "", "num_look": 166659, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "Telegram因拒绝向俄罗斯政府提供加密密钥而遭起诉；因存在安全漏洞，intel主动下架远程键盘APP并建议停止使用。"}
{"title": "思科网络设备漏洞波及国内，中奖后屏幕竟会出现美国国旗", "url": "https://www.freebuf.com/news/167798.html", "time": "2018-04-08", "level": "红色标题", "num_look": 442430, "num_comment": 12, "author": "shidongqi", "tags": ["资讯"], "text": "在思科发布漏洞预警之时，全球受影响的设备高达850万，当然也包括国内。"}
{"title": "密室内的枪声！“双枪2”木马感染过程实录", "url": "https://www.freebuf.com/articles/web/167776.html", "time": "2018-04-08", "level": "", "num_look": 306359, "num_comment": 4, "author": "360安全", "tags": ["WEB安全"], "text": "去年7月，曾率先曝光国内首例连环感染MBR（磁盘主引导记录）和VBR（卷引导记录）的顽固木马——“双枪”。"}
{"title": "因存在安全漏洞，intel主动下架远程键盘APP并建议停止使用", "url": "https://www.freebuf.com/articles/terminal/167763.html", "time": "2018-04-08", "level": "", "num_look": 242797, "num_comment": 1, "author": "shidongqi", "tags": ["终端安全"], "text": "近期，英特尔在远程键盘APP中发现三个严重的安全漏洞之后，并没有决定修复这些漏洞，而是正式下架该应用，并且提醒用户停止使用。"}
{"title": "DELPHI黑客编程（一）：正向后门原理实现", "url": "https://www.freebuf.com/articles/web/166492.html", "time": "2018-04-08", "level": "现金奖励", "num_look": 400380, "num_comment": 23, "author": "5ecurity", "tags": ["WEB安全"], "text": "在渗透测试中经常用到远控、后门等辅助后渗透权限维持工具，有一款好用的自制后门可以在巩固渗透成果方面有很大的帮助。"}
{"title": "攻击者正在利用PHP Weathermap漏洞向Linux服务器传播恶意挖矿软件", "url": "https://www.freebuf.com/news/166599.html", "time": "2018-04-08", "level": "", "num_look": 286730, "num_comment": 286730, "author": "Alpha_h4ck", "tags": ["WEB安全", "资讯"], "text": "合法的大规模加密货币挖矿活动不仅需要使用特殊的硬件，而且还要耗费大量的电力资源，而币圈的暴利早就已经吸引到了网络犯罪分子的目光。"}
{"title": "RPO攻击方式的探究", "url": "https://www.freebuf.com/articles/web/166731.html", "time": "2018-04-08", "level": "金币+10", "num_look": 939835, "num_comment": 13, "author": "K0rz3n", "tags": ["WEB安全"], "text": "2018强网杯有一道web题目，看似简单实则暗藏玄机，很早就放出来但是直到比赛结束分数一直居高不下，考察的重点就是RPO漏洞的利用，你对RPO又了解多少？"}
{"title": "黑客利用GitHub将恶意软件推送至用户电脑以盗取凭据", "url": "https://www.freebuf.com/articles/web/166743.html", "time": "2018-04-08", "level": "", "num_look": 222528, "num_comment": 2, "author": "secist", "tags": ["WEB安全"], "text": "几个月前，我们曾发布了有关网络罪犯如何使用GitHub在被黑网站上加载各种加密货币矿工的报告文章。"}
{"title": "Facebook首席执行官回应数据泄露：不排除其他数据滥用的情况", "url": "https://www.freebuf.com/news/167730.html", "time": "2018-04-08", "level": "", "num_look": 167842, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "Facebook 的首席运营官雪莉·桑德伯格（Sheryl Sandberg）公开表态称，Facebook 其实在两年前就知道剑桥分析公司暗中获取用户数据，而且也不排除还存在其他数据滥用的情况。"}
{"title": "黑客如何“凌空点穴”，隔空搞数据？", "url": "https://www.freebuf.com/articles/database/167601.html", "time": "2018-04-08", "level": "红色标题", "num_look": 279355, "num_comment": 3, "author": "谢幺", "tags": ["数据安全"], "text": "至大成境界，距敌人丈外运气于指。指至，气亦凌空而至，顽敌立倒。若外加修子午流注之技，无论何种护身功夫，遇此技必气破中穴，死伤只在俄顷之间。"}
{"title": "深度解析工控网络流量特点", "url": "https://www.freebuf.com/articles/ics-articles/167079.html", "time": "2018-04-08", "level": "现金奖励", "num_look": 485787, "num_comment": 7, "author": "scu-igroup", "tags": ["工控安全"], "text": "工控安全关系着国家安全，从工控网络流量中发现威胁行为是保护工控系统的手段之一。"}
{"title": "DJI tello大疆无人机通信协议破解测试", "url": "https://www.freebuf.com/articles/wireless/166334.html", "time": "2018-04-08", "level": "现金奖励", "num_look": 786061, "num_comment": 8, "author": "question", "tags": ["无线安全", "极客"], "text": "玩了一圈，看到dji发布了一款可以编程的无人机TELLO，果断入手。无奈玩厌倦了，SDK只开放了起飞降落这些简单功能，秉着搞事不怕事大的原则开始了装逼的道路。"}
{"title": "如何用路由器改成WiFi Pineapple系统镜像网络流量", "url": "https://www.freebuf.com/articles/wireless/166709.html", "time": "2018-04-08", "level": "金币+10", "num_look": 683189, "num_comment": 4, "author": "Mr极品混混", "tags": ["无线安全", "极客"], "text": "本文主要介绍利用自己现有的设备，如何制作和使用WiFi Pineapple镜像网络流量，利用DWall模块分析用户数据，然后根据自己的需求，给DWall加入日志记录功能。"}
{"title": "BUF早餐铺 | 外媒称中国黑客攻击印国防部网站，中方否认；Android木马可窃取来自微信、微博等社交软件的数据；Chrome被发现会扫描用户计算机上的文件；Intel确认不会向部分老款处理器推送“幽灵”漏洞补丁", "url": "https://www.freebuf.com/news/167582.html", "time": "2018-04-08", "level": "", "num_look": 234628, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "三天的假期不够长，很多童鞋估计还没有收回躁动的心，查收这份早餐放松一下吧。"}
{"title": "影响所有Windows版本远程桌面（RDP）应用的CredSSP漏洞分析", "url": "https://www.freebuf.com/vuls/166537.html", "time": "2018-04-07", "level": "", "num_look": 544692, "num_comment": 6, "author": "clouds", "tags": ["漏洞"], "text": "CredSSP高危漏洞为逻辑远程代码执行（RCE）漏洞，几乎所有版本Windows操作系统都受其影响，它类似于经典的中继攻击，但其不同之处在于：它与RSA加密和质数相关，比较有意思。"}
{"title": "利用树莓派探索以太坊第一部分：环境搭建", "url": "https://www.freebuf.com/geek/167121.html", "time": "2018-04-07", "level": "", "num_look": 314689, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["区块链安全", "极客"], "text": "在本系列文章的第一部分中，我们将在一台树莓派Pi 3 Model B上安装并运行一个以太坊区块链客户端。"}
{"title": "浅谈企业虚拟化环境的安全风险与渗透测试方法", "url": "https://www.freebuf.com/articles/es/164792.html", "time": "2018-04-07", "level": "现金奖励", "num_look": 404086, "num_comment": 8, "author": "ipenox", "tags": ["企业安全"], "text": "随着虚拟化技术的大规模应用，企业数据中心的基础架构、运行维护、组织管理等都已经发生了大变化，所面临的安全风险也已不同于往日了。"}
{"title": "使用Django编写简易测试报告生成器", "url": "https://www.freebuf.com/sectool/166605.html", "time": "2018-04-07", "level": "现金奖励", "num_look": 440466, "num_comment": 24, "author": "海带头", "tags": ["工具"], "text": "安全测试人员在工作的时候，不单单需要发现问题，还需要花费精力去撰写安全测试报告来记录结果。为了方便，我利用django框架写了个简易的安全测试报告撰写系统。"}
{"title": "如何利用PowerBroker来防止横向渗透", "url": "https://www.freebuf.com/articles/web/166452.html", "time": "2018-04-06", "level": "", "num_look": 268826, "num_comment": 268826, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "攻击者可能已经盯上你很久了，并策划对你的组织发动一场有针对性的攻击，或者说他们也有可能通过社工技术或网络钓鱼攻击来以“广撒网”的形式来攻击你。"}
{"title": "Ledger Nano S加密钱包再爆严重漏洞，看我怎么“榨干”你的钱包", "url": "https://www.freebuf.com/vuls/166292.html", "time": "2018-04-06", "level": "", "num_look": 325968, "num_comment": 325968, "author": "Alpha_h4ck", "tags": ["漏洞"], "text": "英国少年SaleemRashid成功地在Ledger公司所生产的加密货币硬件钱包Ledger Nano S中发现了一个严重的安全漏洞，并发布POC。"}
{"title": "深圳网安计算机安全检测技术有限公司招聘信息安全技术工程师（安全分析方向）", "url": "https://www.freebuf.com/jobs/166930.html", "time": "2018-04-06", "level": "", "num_look": 212292, "num_comment": 7, "author": "Evilest", "tags": ["安全招聘"], "text": "深圳市网安计算机安全检测技术有限公司成立于2001年，是国家高新技术企业和深圳市双软企业，是华南地区最专业的网络安全应急处置和风险管理服务提供商。"}
{"title": "快讯 | Facebook 泄漏事件再升级，受影响用户从 5000 万增长到 8700 万", "url": "https://www.freebuf.com/news/167646.html", "time": "2018-04-06", "level": "", "num_look": 206074, "num_comment": 5, "author": "AngelaY", "tags": ["资讯"], "text": "Cambridge Analytica 从 Facebook 获取的用户信息高达 8,700 万，比之前的 5000 万多出不少。其中，超过 80% 的用户都是美国人。"}
{"title": "“白象”APT组织近期动态", "url": "https://www.freebuf.com/articles/paper/166995.html", "time": "2018-04-06", "level": "", "num_look": 349323, "num_comment": 3, "author": "金睛", "tags": ["安全报告"], "text": "“白象”又名“Patchwork”，“摩诃草”，疑似来自南亚某国，自2012年以来持续针对中国、巴基斯坦等国进行网络攻击，长期窃取目标国家的科研、军事资料。"}
{"title": "利用QRLJacking工具获取Whatsapp帐号权限", "url": "https://www.freebuf.com/sectool/166282.html", "time": "2018-04-06", "level": "现金奖励", "num_look": 371931, "num_comment": 2, "author": "艾登——皮尔斯", "tags": ["工具"], "text": "这篇文章将会教你如何用 QRLJacking 去获取别人 Whatsapp 帐号的权限。本文章只用于教育目的，且用于非法使用，违者后果自负。"}
{"title": "Harpoon：OSINT威胁情报工具", "url": "https://www.freebuf.com/sectool/163946.html", "time": "2018-04-05", "level": "", "num_look": 512564, "num_comment": 3, "author": "secist", "tags": ["工具"], "text": "Harpoon是一款自动化的用于从各种公开资源中收集威胁情报的工具。它是由Python 3编写的，并在其设计中体现了模块化思想，每个平台和任务都会有一个插件。"}
{"title": "小心电脑扬声器泄漏你的敏感数据", "url": "https://www.freebuf.com/articles/network/166305.html", "time": "2018-04-05", "level": "", "num_look": 307061, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "以色列本古里安大学的安全研究人员向外界演示了“Mosquito”（蚊子攻击）的攻击技术，允许攻击者通过扬声器或耳机从物理隔离（空气间隙）或联网计算机中提取数据。"}
{"title": "联想电脑管家产品开发团队招聘桌面安全攻防工程师", "url": "https://www.freebuf.com/jobs/167212.html", "time": "2018-04-05", "level": "", "num_look": 234746, "num_comment": 6, "author": "xiaohang1", "tags": ["安全招聘"], "text": "联想电脑管家是联想自主知识产权的联想电脑预装软件。为用户提供联想特有的功能，如硬件诊断，售后服务，驱动管理等；以及用户使用PC时的刚需功能，如杀毒和系统优化。"}
{"title": "关于Sql注入以及Burpsuite Intruders使用的一些浅浅的见解", "url": "https://www.freebuf.com/news/166495.html", "time": "2018-04-05", "level": "", "num_look": 429203, "num_comment": 20, "author": "白帽子马振华", "tags": ["资讯"], "text": "昨晚在看一篇sql注入的文章是遇到了一个新的问题就是利用bp 的intruder进行批量地猜解数据库中表的名字。"}
{"title": "路由器漏洞分析第五弹：CVE-2018-5767路由器远程代码执行", "url": "https://www.freebuf.com/articles/wireless/166869.html", "time": "2018-04-05", "level": "现金奖励", "num_look": 625059, "num_comment": 5, "author": "kczwa1", "tags": ["无线安全"], "text": "此前我们分析了四种路由器漏洞，现在终于写到 PWN 类的漏洞了。"}
{"title": "关于国家信息安全漏洞库（CNNVD）正式启动2018年兼容性服务申请工作的通知", "url": "https://www.freebuf.com/fevents/167611.html", "time": "2018-04-04", "level": "", "num_look": 283201, "num_comment": 4, "author": "CNNVD", "tags": ["活动"], "text": "国家信息安全漏洞库（CNNVD）是中国信息安全测评中心为切实履行漏洞分析和风险评估职能，负责建设运维的国家级信息安全漏洞数据管理平台，旨在为我国信息安全保障提供服务。"}
{"title": "同性交友应用Grindr与第三方分析公司共享用户健康数据", "url": "https://www.freebuf.com/news/167557.html", "time": "2018-04-04", "level": "", "num_look": 289807, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "挪威研究组织SINTEF进行的一项分析显示，流行的Grindr同性恋约会应用与另外两家公司分享其用户的艾滋状况。"}
{"title": "除了138个彩蛋，《头号玩家》竟然是一部信息安全教育片？", "url": "https://www.freebuf.com/special/167562.html", "time": "2018-04-04", "level": "红色标题", "num_look": 1313750, "num_comment": 19, "author": "shidongqi", "tags": ["特别企划"], "text": "除了这138个彩蛋之外，可能是职业病的原因，笔者也在这部科幻片中捕捉到一些信息，值得与身在安全圈的你们分享，也是给所有互联网用户的建议。"}
{"title": "安全专家警告：注重物联网安全，不要盲目发展5G", "url": "https://www.freebuf.com/articles/wireless/167387.html", "time": "2018-04-04", "level": "", "num_look": 377881, "num_comment": 377881, "author": "shidongqi", "tags": ["无线安全"], "text": "在部署5G网络技术上，中国算是比较积极的，近期国内首个5G电话打通，算是一个重大里程碑。不过欧盟IT安全机构表示，2G，3G和4G网络漏洞可能会在5G中重演。"}
{"title": "利用文本编辑器的插件在Unix机器上的实现提权", "url": "https://www.freebuf.com/articles/system/166121.html", "time": "2018-04-04", "level": "", "num_look": 296200, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "近期，SafeBreach的安全研究人员发现，攻击者可利用Unix环境下多款当前热门的文本编辑器插件来在目标系统上实现权限提升。"}
{"title": "懒人福利|一秒创建Xposed模版", "url": "https://www.freebuf.com/sectool/167274.html", "time": "2018-04-04", "level": "现金奖励", "num_look": 560244, "num_comment": 8, "author": "Tasfa", "tags": ["工具"], "text": "由于Xposed实现的方式，每次修改hook代码后，需要重启机器，这也是白白浪费了很多时间。基于以上两点，参考现有的方案，实现了一个Module,只需在AS中new一下即可解决问题。"}
{"title": "低成本打造一个高性能的外网Metasploit", "url": "https://www.freebuf.com/articles/network/166702.html", "time": "2018-04-04", "level": "金币+10", "num_look": 936084, "num_comment": 48, "author": "国光", "tags": ["网络安全"], "text": "经常用Metasploit反弹shell的小伙伴应该都知道在外网有 一台Metasploit是一件多么奢侈的事情~然而一台性能不错的云主机价格大都不菲，并且自己本地高性能的Metasploit用的那么顺手可惜就是没有外网IP。"}
{"title": "医疗行业网络入侵途径与全球安全现状", "url": "https://www.freebuf.com/articles/es/165993.html", "time": "2018-04-04", "level": "", "num_look": 387450, "num_comment": 2, "author": "柚子", "tags": ["企业安全"], "text": "患者信息泄露、医疗信息被篡改、医生误诊、遭勒索……医疗行业的网络安全末日是否已经到来？"}
{"title": "英特尔再遇困局：苹果计划弃用英特尔芯片，改用自主研发的定制化芯片", "url": "https://www.freebuf.com/news/167541.html", "time": "2018-04-04", "level": "", "num_look": 240918, "num_comment": 5, "author": "AngelaY", "tags": ["资讯"], "text": "据外媒 Bloomberg 报道，苹果计划最早从 2020 年开始彻底弃用英特尔芯片，全面在 Mac 电脑（包括台式电脑和笔记本电脑）中采用自主开发的定制化基于 ARM 的芯片。"}
{"title": "京东商城诚聘安全工程师", "url": "https://www.freebuf.com/jobs/166672.html", "time": "2018-04-04", "level": "", "num_look": 245259, "num_comment": 8, "author": "nanshihui", "tags": ["安全招聘"], "text": "中国自营式电商企业，创始人刘强东担任京东集团CEO。旗下设有京东商城、京东金融、拍拍网、京东智能、O2O及海外事业部等。"}
{"title": "另一种绕过限制下载论文的思路", "url": "https://www.freebuf.com/articles/web/167359.html", "time": "2018-04-04", "level": "现金奖励", "num_look": 434980, "num_comment": 6, "author": "过客匆匆打酱油", "tags": ["WEB安全"], "text": "看到首页上《一种绕过限制下载论文的思路》的文章，刚好笔者前几天给小学妹做了一个下载器，也凑热闹来讨论一下。"}
{"title": "银行提款机惊现病毒：绕过杀毒软件达到牟利目的", "url": "https://www.freebuf.com/articles/terminal/166910.html", "time": "2018-04-04", "level": "红色标题", "num_look": 369580, "num_comment": 5, "author": "腾讯手机管家", "tags": ["终端安全"], "text": "“银行节日提款机”木马特征：用户变种快速传播。经过分析后发现，木马程序采用分解流程来保护自身，黑客终端与web服务器、应用市场、sp服务提供商、终端智能手机相互协助形程完整的黑色链条。"}
{"title": "PHP弱类型引发的漏洞实例", "url": "https://www.freebuf.com/articles/web/166543.html", "time": "2018-04-04", "level": "现金奖励", "num_look": 505084, "num_comment": 5, "author": "补丁君", "tags": ["WEB安全"], "text": "我们知道PHP 是一门弱类型语言，不必向 PHP 声明该变量的数据类型，PHP 会根据变量的值，自动把变量的值转换为正确的数据类型，但在这个转换过程中就有可能引发一些安全问题。"}
{"title": "CVE-2017-11882新动态：利用AutoIT脚本释放DarkComet后门", "url": "https://www.freebuf.com/vuls/166744.html", "time": "2018-04-04", "level": "", "num_look": 309248, "num_comment": 1, "author": "腾讯电脑管家", "tags": ["安全报告", "漏洞"], "text": "腾讯御见威胁情报中心监测到一起利用邮件间接传播CVE-2017-11882漏洞文档以攻击商贸行业从业者的安全事件，此次攻击者使用的手法有所变化。"}
{"title": "BUF早餐铺 | 谷歌4月修复60多个漏洞；Cloudfare发布1.1.1.1公共DNS服务；HiddenMiner挖矿病毒可让手机变砖；深圳严格规定信息安全等级保护", "url": "https://www.freebuf.com/news/167424.html", "time": "2018-04-04", "level": "", "num_look": 189554, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "四月清和雨乍晴。无论天气如何，早餐还是要好好吃哦~"}
{"title": "金山云安珀实验室千里追踪75万台“肉鸡”控制源", "url": "https://www.freebuf.com/articles/paper/166554.html", "time": "2018-04-04", "level": "", "num_look": 301765, "num_comment": 5, "author": "CJ长剑111", "tags": ["安全报告"], "text": "不法分子利用掌握的75万台肉鸡，通过层层加密隐匿攻击源头，在幕后对企业、机构发动针对性的大规模DDoS攻击，进而谋取不正当利益。"}
{"title": "深圳市公安局：IDC、云平台信息安全等级保护不得低于三级", "url": "https://www.freebuf.com/news/167372.html", "time": "2018-04-03", "level": "", "num_look": 254258, "num_comment": 2, "author": "Sphinx", "tags": ["资讯"], "text": "深圳市公安局公共信息网络安全监察分局对互联网数据中心和云平台运营方发布了《关于落实网络安全等级保护制度要求的通知》的文件。"}
{"title": "黑客拒绝50万年薪，“入侵”选号系统倒卖车牌牟暴利", "url": "https://www.freebuf.com/news/167431.html", "time": "2018-04-03", "level": "红色标题", "num_look": 594165, "num_comment": 33, "author": "shidongqi", "tags": ["资讯"], "text": "拒绝国内知名网络公司50万年薪的工作，甘愿写软件谋生，这不是一个技术控的偏执，而是一个黑客入侵全国选号系统倒卖车牌号的犯罪故事。"}
{"title": "$_SERVER[SCRIPT_NAME]变量可值注入恶意代码", "url": "https://www.freebuf.com/articles/web/166263.html", "time": "2018-04-03", "level": "金币+5", "num_look": 312339, "num_comment": 6, "author": "飞檐哈哈哈", "tags": ["WEB安全"], "text": "$_SERVER['SCRIPT_NAME']变量在路由传参时，可引入恶意代码，从而导致xss以及恶意代码注入。"}
{"title": "PowerShell-RAT：一款基于Python的后门程序", "url": "https://www.freebuf.com/sectool/165789.html", "time": "2018-04-03", "level": "", "num_look": 449070, "num_comment": 7, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Powershell-RAT的Python后门，它可以利用Gmail邮件附件来从目标用户的设备中提取数据。"}
{"title": "用鱼竿、鱼钩、鱼饵和彩蛋模拟一次网络渗透", "url": "https://www.freebuf.com/articles/web/166597.html", "time": "2018-04-03", "level": "现金奖励", "num_look": 691573, "num_comment": 23, "author": "flagellantX", "tags": ["WEB安全"], "text": "写文章真的不容易，文章不够直观的话我会做视频教程。如果文章中有错误和不足可以直接指出，可喷可踩，但是有好的攻击思路和更好的利用模式以及匿名技巧等等这些都可以跟我交流。"}
{"title": "知道创宇2017年网络安全（云安全）态势报告", "url": "https://www.freebuf.com/articles/paper/166756.html", "time": "2018-04-03", "level": "", "num_look": 260775, "num_comment": 260775, "author": "ESTHERYOYOYO", "tags": ["安全报告"], "text": "云安全专家提醒，一方面，大流量攻击行为作为勒索及商业破坏行为时有发生，但同时也要高度关注隐藏在较低流量可能伴随着的渗透攻击行为，如防御不当，其对企业的商业信誉影响要比前者更为严重。"}
{"title": "在你的内网中获得域管理员权限的五种方法", "url": "https://www.freebuf.com/articles/network/165392.html", "time": "2018-04-03", "level": "", "num_look": 404984, "num_comment": 1, "author": "secist", "tags": ["网络安全"], "text": "早在2013年9月，蜘蛛实验室（ Spider Labs）就发表过一篇题为“SpiderLabs在你内网中获取域管的五大方式”的文章。这篇文章是我继该文的，应该说是非官方的“Part 2”部分。"}
{"title": "完美世界信息安全部诚聘安全专家（全职和实习岗）", "url": "https://www.freebuf.com/jobs/167331.html", "time": "2018-04-03", "level": "", "num_look": 192115, "num_comment": 4, "author": "pwrdtest", "tags": ["安全招聘"], "text": "完美世界控股集团是全球领先的文化娱乐产业集团。长期以来，完美世界控股集团旗下产品遍布美、欧、亚等全球100多个国家和地区。"}
{"title": "勒索病毒“GPGQwerty”的分析与复现", "url": "https://www.freebuf.com/articles/system/166284.html", "time": "2018-04-03", "level": "现金奖励", "num_look": 328237, "num_comment": 9, "author": "LiukerTeam", "tags": ["系统安全"], "text": "勒索软件“GPGQwerty”利用合法的软件 GnuPG 来加密受害者的文件、覆盖原始文件，并将 .qwerty 扩展名附加到被加密文件的文件名中。本文是对“GPGQwerty”的分析与复现。"}
{"title": "基于SYLK文件传播Orcus远控木马样本分析", "url": "https://www.freebuf.com/articles/system/167141.html", "time": "2018-04-03", "level": "", "num_look": 387448, "num_comment": 1, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "近日，腾讯反病毒实验室发现一例利用符号链接文件(SYLK文件)传播远控Orcus远控木马的攻击样本。"}
{"title": "RSA加密解密原理深度剖析（附CTF中RSA题型实战分析）", "url": "https://www.freebuf.com/articles/others-articles/166049.html", "time": "2018-04-03", "level": "现金奖励", "num_look": 1023497, "num_comment": 13, "author": "Fly鹏程万里", "tags": ["其他"], "text": "本文章就密码学中的RSA发展、RSA的数学基础理论、RSA的加密解密算法原理、CTF中的RSA题型剖析等多方面进行详细的分析讨论，希望对各位有所帮助。"}
{"title": "BUF早餐铺 | 思科产品出现严重漏洞，导致大量设备面临远程攻击风险；Django错误配置导致Secret API Key泄露、数据库密码泄露", "url": "https://www.freebuf.com/news/167282.html", "time": "2018-04-03", "level": "", "num_look": 188810, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "Airbnb与中国监管机构共享房东信息；360联手广州大学创新安全人才培养模式；中国电信营业厅App被指索要70多项权限。"}
{"title": "思科产品出现严重漏洞，导致大量设备面临远程攻击风险", "url": "https://www.freebuf.com/news/167200.html", "time": "2018-04-02", "level": "", "num_look": 299509, "num_comment": 6, "author": "Sphinx", "tags": ["资讯"], "text": "思科在其IOS软件中修补了30多个漏洞，其中包括一个严重的远程代码执行漏洞，该漏洞可以对数十万甚至数百万台设备暴露在网络上的设备发起的远程攻击。"}
{"title": "摩诃草APT组织针对我国敏感机构最新的网络攻击活动分析", "url": "https://www.freebuf.com/articles/paper/167191.html", "time": "2018-04-02", "level": "", "num_look": 296887, "num_comment": 5, "author": "奇安信威胁情报中心", "tags": ["安全报告"], "text": "摩诃草组织（APT-C-09），又称HangOver、VICEROY TIGER、The Dropping Elephant、Patchwork，是一个来自于南亚地区的境外APT组织，该组织已持续活跃了8年。"}
{"title": "一种绕过限制下载论文的思路", "url": "https://www.freebuf.com/articles/web/164516.html", "time": "2018-04-02", "level": "现金奖励", "num_look": 759946, "num_comment": 28, "author": "tammypi", "tags": ["WEB安全"], "text": "有时候要研究技术，我们也需要下载一些论文来看看的。一些论文站点，虽然提供预览功能，但是下载却是收费的。"}
{"title": "境外黑客组织“白象”3月上旬对国内发起攻击", "url": "https://www.freebuf.com/articles/network/167254.html", "time": "2018-04-02", "level": "", "num_look": 367293, "num_comment": 4, "author": "Threatbook", "tags": ["网络安全"], "text": "2017年12月下旬，国外网络安全公司趋势科技对其攻击活动曝光后，该团伙迅速停用了所有域名、IP等基础设施，进入“蛰伏期”。"}
{"title": "藏在短链接下的挖矿木马：NovelMiner", "url": "https://www.freebuf.com/articles/paper/166458.html", "time": "2018-04-02", "level": "", "num_look": 271531, "num_comment": 271531, "author": "腾讯电脑管家", "tags": ["安全报告"], "text": "一款名为NovelMiner的挖矿木马自2017年9月开始隐藏在广告短链接中进行传播，全球约有100多个国家超过1500万用户由于误点带毒广告页面而自动下载了这个木马。"}
{"title": "挖洞经验 | 看我如何构造DSPL语言包发现Google的存储型XSS和SSRF漏洞", "url": "https://www.freebuf.com/articles/web/165652.html", "time": "2018-04-02", "level": "", "num_look": 218449, "num_comment": 5, "author": "clouds", "tags": ["WEB安全"], "text": "本文讲述我通过精心制作Google数据集发布语言（DSPL）包，在请求www.google.com的环境中构造出存储型XSS漏洞，另外，利用DSPL的远程数据源功能实现了本地服务访问。"}
{"title": "用隐私换安全？Airbnb与监管机构共享房东信息", "url": "https://www.freebuf.com/news/167202.html", "time": "2018-04-02", "level": "红色标题", "num_look": 171910, "num_comment": 1, "author": "Allen别bb", "tags": ["资讯"], "text": "近期Airbnb对宣布，在有必要的条件下，将与监管机构共享房东信息，成为继苹果将数据转存云上贵州之后的又一例子。"}
{"title": "创业公司简单粗暴之路：高效利用Sentry追踪日志发现问题", "url": "https://www.freebuf.com/sectool/165604.html", "time": "2018-04-02", "level": "", "num_look": 328821, "num_comment": 1, "author": "岂安科技", "tags": ["企业安全", "工具"], "text": "程序运行的日志是一个必不可少的东西，可能是一些系统信息，比如 gc 的情况；可能是一些正常的模块处理信息，比如最近更新的配置；还可能是一些在程序运行中，我们不希望出现的错误所带来的信息。"}
{"title": "如何利用暴力破解攻击打进“敌人”内部", "url": "https://www.freebuf.com/articles/web/165501.html", "time": "2018-04-02", "level": "", "num_look": 271767, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "在很多现实的攻击案例中，大多数攻击者都是通过暴力破解的方式来入侵目标系统的，此时攻击者主要利用的是弱密码以及密码管理方面的安全问题。"}
{"title": "华为云安全攻防团队招聘渗透测试工程师", "url": "https://www.freebuf.com/jobs/166684.html", "time": "2018-04-02", "level": "", "num_look": 347417, "num_comment": 13, "author": "华为云安全攻防团队", "tags": ["安全招聘"], "text": "弹性工作、大型攻防环境——诚意招聘渗透测试工程师！"}
{"title": "Gartner权威发布：全球网络安全产业规模发展情况及趋势预测", "url": "https://www.freebuf.com/articles/paper/167137.html", "time": "2018-04-02", "level": "", "num_look": 584745, "num_comment": 584745, "author": "shidongqi", "tags": ["安全报告"], "text": "自从信息技术出现以来，对应的安全问题就受到广泛关注，网络安全产业的范畴也随着网络安全保障需求不断延伸而扩展。"}
{"title": "从车联网安全到BLE安全（一）", "url": "https://www.freebuf.com/articles/terminal/166398.html", "time": "2018-04-02", "level": "现金奖励", "num_look": 383913, "num_comment": 1, "author": "麦片与老干妈", "tags": ["终端安全"], "text": "很多的OBD设备（大于95%）设备与手机APP进行同步数据的过程当中采用了BLE（低功耗蓝牙），很大部分的OBD设备的蓝牙通信过程都存在安全隐患。"}
{"title": "新型渗透思路：两种密码重置之综合利用", "url": "https://www.freebuf.com/articles/network/166520.html", "time": "2018-04-02", "level": "现金奖励", "num_look": 402315, "num_comment": 17, "author": "风之传说", "tags": ["网络安全"], "text": "在逻辑漏洞中，任意用户密码重置最为常见，可能出现在新用户注册页面，也可能是用户登录后重置密码的页面，或者用户忘记密码时的密码找回页面，其中，密码找回功能是重灾区。"}
{"title": "国产吃鸡要凉？荒野行动加速器木马攻击已达10万+", "url": "https://www.freebuf.com/articles/system/166472.html", "time": "2018-04-02", "level": "", "num_look": 245489, "num_comment": 3, "author": "360安全", "tags": ["系统安全"], "text": "随着绝地求生、荒野行动等游戏大火，不少玩家会下载各种加速器用来加速游戏，而这些利用玩家求胜心理传播的加速器等外挂，却很快成了木马活跃的温床。"}
{"title": "BUF早餐铺 | 印度电力公司遭遇黑客攻击；Under Armour称1.5亿用户数据泄漏；微软发布Windows 7补丁；Apple发布安全更新：针对iOS、watchOS、tvOS和Xcode", "url": "https://www.freebuf.com/news/166945.html", "time": "2018-04-02", "level": "", "num_look": 180150, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "外媒研究发现：81％的ICO项目是诈骗；防漏洞、保安全：网络安全领域“白色产业链”正在兴起。"}
{"title": "Visual Basic GUI：一款在SSH客户端上注入击键的工具", "url": "https://www.freebuf.com/sectool/165338.html", "time": "2018-04-01", "level": "", "num_look": 282149, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款注入工具，该工具名叫Visual Basic GUI，它可以通过X11转发会话来向SSH客户端注入击键数据。"}
{"title": "了解针对“所有”版本Android的Cloak & Dagger攻击", "url": "https://www.freebuf.com/news/165343.html", "time": "2018-04-01", "level": "", "num_look": 282728, "num_comment": 282728, "author": "Alpha_h4ck", "tags": ["终端安全", "资讯"], "text": "Cloak&Dagger攻击是一种利用权限不匹配问题来访问Android设备的攻击方法，版本在7.1.2及以下的Android设备都会受到这种攻击的影响。"}
{"title": "CNCERT 2018年3月我国DDoS攻击资源分析报告", "url": "https://www.freebuf.com/articles/paper/171714.html", "time": "2018-04-01", "level": "", "num_look": 68721, "num_comment": 68721, "author": "CNCERT", "tags": ["安全报告"], "text": "本报告为2018年3月份的DDoS攻击资源月度分析报告。围绕互联网环境威胁治理问题，基于CNCERT监测的DDoS攻击事件数据进行抽样分析。"}
{"title": "以UPX漏洞为例介绍整数溢出（基础篇）", "url": "https://www.freebuf.com/vuls/165972.html", "time": "2018-04-01", "level": "现金奖励", "num_look": 264765, "num_comment": 6, "author": "tocttou", "tags": ["漏洞"], "text": "我发现Freebuf上没有整数溢出漏洞的基础介绍，所以这篇文章通过分析我刚刚发现的UPX源代码中的整数溢出漏洞，介绍一下C/C++整数溢出漏洞的原理、触发和修复方法。"}
{"title": "NSA对APT组织的透视", "url": "https://www.freebuf.com/articles/paper/166283.html", "time": "2018-04-01", "level": "金币+10", "num_look": 298651, "num_comment": 2, "author": "tempest", "tags": ["安全报告"], "text": "NSA在进行入侵行动的同时，也会在攻击目标上检测其他APT组织的痕迹，以避免多个黑客组织在同一攻击目标上互相争斗，最小化NSA行动泄漏的风险。"}
{"title": "买家秀与卖家秀 | 「网藤杯」智能安全机器人养成计划完结撒花", "url": "https://www.freebuf.com/fevents/167054.html", "time": "2018-03-31", "level": "红色标题", "num_look": 227782, "num_comment": 3, "author": "斗象智能安全平台", "tags": ["活动"], "text": "囍囍囍囍囍囍囍囍囍囍囍囍~"}
{"title": "ezXSS：一款功能强大的XSS盲测工具", "url": "https://www.freebuf.com/sectool/165289.html", "time": "2018-03-31", "level": "", "num_look": 579363, "num_comment": 10, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫ezXSS的漏洞测试工具，该工具可以轻松地帮助渗透测试人员完成Blind XSS漏洞的扫描任务。"}
{"title": "如何绕过安卓的网络安全配置功能", "url": "https://www.freebuf.com/articles/terminal/165671.html", "time": "2018-03-31", "level": "", "num_look": 380626, "num_comment": 3, "author": "Covfefe", "tags": ["终端安全"], "text": "随着Nougat（Android 7）的发布 ，一个名为“Network Security Configuration”的新安全功能也随之而来。"}
{"title": "一文了解安卓APP逆向分析与保护机制", "url": "https://www.freebuf.com/articles/terminal/165904.html", "time": "2018-03-31", "level": "", "num_look": 349773, "num_comment": 3, "author": "wangyiyunyidun", "tags": ["终端安全"], "text": "安卓APP安全包含很多内容，本次分享了混淆代码、整体Dex加固、拆分 Dex 加固、虚拟机加固等方面。事实上，这些内容也是国内近几年Android App安全保护的一种主要趋势。"}
{"title": "【FB TV】一周「BUF大事件」：李彦宏语出惊人，道出国内隐私安全现状；WannaCry勒索病毒卷土重来；iOS 11发现相机漏洞", "url": "https://www.freebuf.com/video/167045.html", "time": "2018-03-31", "level": "红色标题", "num_look": 301864, "num_comment": 301864, "author": "willhuang", "tags": ["视频"], "text": "本周百度CEO李彦宏语出惊人，道出国内隐私安全现状；WannaCry勒索病毒卷土重来，波音工厂中招；iOS 11发现可被利用的相机漏洞。"}
{"title": "QtWebKit爬虫与去重规则", "url": "https://www.freebuf.com/articles/web/165554.html", "time": "2018-03-31", "level": "现金奖励", "num_look": 331713, "num_comment": 6, "author": "0d9y", "tags": ["WEB安全"], "text": "一个漏扫程序想要检测更多的漏洞，那么他配备的爬虫一定得给力，能够爬取很多其他爬虫爬不到的链接，就有可能比其他漏扫程序检测出更多的漏洞。"}
{"title": "FreeBuf企业精品公开课 × 思科回顾 | 全球视角解读企业安全威胁态势", "url": "https://www.freebuf.com/open/166948.html", "time": "2018-03-30", "level": "红色标题", "num_look": 223670, "num_comment": 223670, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "攻击者策略不断演进，趋向于使用加密和合法互联网服务隐藏他们的活动，并破坏传统安全技术。每家企业都应该建立以高层主导设定的安全基调和企业安全文化，由上至下地树立安全意识。"}
{"title": "外媒研究发现：81％的ICO项目是诈骗", "url": "https://www.freebuf.com/news/166931.html", "time": "2018-03-30", "level": "", "num_look": 214840, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "根据ICO咨询公司Satis集团最近的一项研究，去年发生的五起ICO项目中有四次被列为诈骗。"}
{"title": "全球最大同性社交软件Grindr存在漏洞，泄露用户信息及位置", "url": "https://www.freebuf.com/news/166870.html", "time": "2018-03-30", "level": "红色标题", "num_look": 491018, "num_comment": 7, "author": "JingleCats", "tags": ["漏洞", "资讯"], "text": "根据ILGA 2016年的一份报告，在70多个国家，同性恋是非法的，其中13个国家实施了对同性恋行为的死刑。因此，在同性恋被定为犯罪的地方，利用用户位置数据会将同性恋者处于危险境地。"}
{"title": "KLara project：分布式YARA恶意软件扫描系统", "url": "https://www.freebuf.com/sectool/165188.html", "time": "2018-03-30", "level": "", "num_look": 276716, "num_comment": 276716, "author": "secist", "tags": ["工具"], "text": "Klara 项目旨在帮助威胁情报研究人员使用 Yara 搜索发现新的恶意软件。"}
{"title": "Reversing.kr题目之SimpleVM详解", "url": "https://www.freebuf.com/news/164664.html", "time": "2018-03-30", "level": "金币+10", "num_look": 201537, "num_comment": 201537, "author": "foyjog", "tags": ["资讯"], "text": "这里给出我在刷到SimpleVM这道题目的时候的一些心得和体会。"}
{"title": "思科Smart Install的远程代码执行漏洞（CVE-2018-0171）详细分析", "url": "https://www.freebuf.com/articles/network/166757.html", "time": "2018-03-30", "level": "", "num_look": 931711, "num_comment": 14, "author": "GeekPwn", "tags": ["网络安全"], "text": "2017 年 5 月，Embedi 安全公司研究员、俄罗斯白帽黑客 George Nosenko 在 GeekPwn 黑客大赛现场成功演示了一个思科交换机 Smart Install 的缓冲区堆栈溢出漏洞。"}
{"title": "【4月9日截止】议题征集中 | 2018 FREE TALK北京站 ，想听什么？你说了算！", "url": "https://www.freebuf.com/news/164745.html", "time": "2018-03-30", "level": "红色标题", "num_look": 448298, "num_comment": 11, "author": "FB客服", "tags": ["活动", "资讯"], "text": "2018 FREE TALK首站将登入北京，现议题火爆征集中，这次还可以钦点你想听的议题哦！"}
{"title": "看我如何利用Webhook绕过支付请求", "url": "https://www.freebuf.com/articles/web/165640.html", "time": "2018-03-30", "level": "", "num_look": 291792, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "毫无疑问，如果支付网站想要检测任何可疑的网络行为，那么验证支付Webhook请求绝对是要默认进行的。虽然有些支付提供商会给用户提供一些方法来防止这种攻击，但这仍然需要提供商和客户的共同努力。"}
{"title": "从Facebook、百度“隐私门”看企业对用户隐私保护的责任何在", "url": "https://www.freebuf.com/articles/neopoints/166899.html", "time": "2018-03-30", "level": "红色标题", "num_look": 550006, "num_comment": 5, "author": "高傲的蝴蝶酥", "tags": ["观点"], "text": "国内外互联网巨头同时面临侵犯隐私的指责时采取的态度却截然不同，这背后反映的是国内外互联网环境和公司们对于隐私意识的不同，甚至是发展阶段的不同。"}
{"title": "修改安卓源码：Art模式下的通用脱壳方法", "url": "https://www.freebuf.com/articles/terminal/166307.html", "time": "2018-03-30", "level": "现金奖励", "num_look": 468634, "num_comment": 9, "author": "x565178035", "tags": ["终端安全"], "text": "在dalvik时代有很多通用的脱壳方法，而现在的安卓版本早已不使用dalvik模式，很多方法便不再适用。"}
{"title": "那些年绕过的反爬手段", "url": "https://www.freebuf.com/articles/web/166125.html", "time": "2018-03-30", "level": "现金奖励", "num_look": 527812, "num_comment": 13, "author": "manwu91", "tags": ["WEB安全"], "text": "笔者第一份工作就是以java工程师的名义写爬虫，不得不说第一份工作很重要啊，现在除了爬虫不会干别的，到现在已经干了近5年了，期间经历了不少与反爬策略的斗争。"}
{"title": "强网杯WeChat题目设计思路", "url": "https://www.freebuf.com/news/166547.html", "time": "2018-03-30", "level": "", "num_look": 557452, "num_comment": 6, "author": "mutepig", "tags": [], "text": "“强网杯”比赛刚刚结束，本文对其中的题目进行解析。"}
{"title": "密码破解全能工具：Hashcat密码破解攻略", "url": "https://www.freebuf.com/sectool/164507.html", "time": "2018-03-30", "level": "现金奖励", "num_look": 2731238, "num_comment": 10, "author": "simeon", "tags": ["工具"], "text": "hashcat号称世界上最快的密码破解，世界上第一个和唯一的基于GPGPU规则引擎，免费多GPU，多哈希，多操作系统，多平台，多算法，资源利用率低，基于字典攻击，支持分布式破解等等。"}
{"title": "BUF早餐铺 | WannaCry勒索病毒卷土重来，波音工厂中招；门罗币代码存漏洞，很容易被追踪；Facebook推出一系列新隐私措施，赋予用户更大控制权;男子开发麻将APP聚赌获利", "url": "https://www.freebuf.com/news/166836.html", "time": "2018-03-30", "level": "", "num_look": 187302, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": "阳春三月眼看着就要结束了，周末将至，赶紧去抓住春天的尾巴~"}
{"title": "【更新官方声明】央视曝光偷密码的“万能钥匙”，9亿人个人信息存风险", "url": "https://www.freebuf.com/news/166791.html", "time": "2018-03-29", "level": "红色标题", "num_look": 510139, "num_comment": 24, "author": "Allen别bb", "tags": ["资讯"], "text": "在3月28日晚，央视财经频道《经济半小时》节目主题为偷密码的“万能钥匙”，曝光了WIFI万能钥匙和WIFI钥匙两款WIFI共享类软件，涉嫌窃取用户隐私及WIFI密码。"}
{"title": "Drupal现已修复内核高危远程代码执行漏洞", "url": "https://www.freebuf.com/vuls/166782.html", "time": "2018-03-29", "level": "", "num_look": 303741, "num_comment": 7, "author": "Sphinx", "tags": ["漏洞"], "text": "Drupal CMS团队修复了一个重要安全漏洞，黑客只需要访问URL就可以接管网站。"}
{"title": "Shellen：交互式shellcode开发环境", "url": "https://www.freebuf.com/sectool/164387.html", "time": "2018-03-29", "level": "", "num_look": 258842, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "如果你想拥有一个可以帮助你轻松方便的开发shellcode的环境，那么Shellen将会是你的首先。"}
{"title": "CNCERT 2018年2月我国DDoS攻击资源分析报告", "url": "https://www.freebuf.com/articles/paper/166601.html", "time": "2018-03-29", "level": "", "num_look": 216070, "num_comment": 216070, "author": "CNCERT", "tags": ["安全报告"], "text": "近日，利用memcached服务器实施反射DDoS攻击的事件大幅上升。CNCERT对三类重点反射攻击事件进行了集中监测和分析，本报告为2018年2月份的反射攻击资源专项分析报告。"}
{"title": "利用白文件打造超级渗透测试后门程序的思路分享", "url": "https://www.freebuf.com/news/165626.html", "time": "2018-03-29", "level": "红色标题", "num_look": 452711, "num_comment": 43, "author": "河马安全网", "tags": ["系统安全", "资讯"], "text": "计算机中的渗透测试后门程序，品种多样。有Telnet、IFEO 、WebShell、注册表、Radmin等。大部分后门都会在一段时间内被AV检测到，并清除。"}
{"title": "物联网渗透之“私闯民宅”的高端操作", "url": "https://www.freebuf.com/articles/terminal/165133.html", "time": "2018-03-29", "level": "", "num_look": 294143, "num_comment": 294143, "author": "柚子", "tags": ["终端安全"], "text": "在当代消费者的消费观念里，智能设备永远不嫌多。任何一个具备高级功能的联网设备都能大大提高我们生活的便利性。"}
{"title": "快讯 | 微软发布新工具，有助于在Windows 10上运行Linux系统", "url": "https://www.freebuf.com/news/166771.html", "time": "2018-03-29", "level": "", "num_look": 262104, "num_comment": 9, "author": "AngelaY", "tags": ["资讯"], "text": "微软周一发布了一款工具，有助于 Linux 爱好者将 Linux 发行版移植到一个 Windows 10 组件（Linux 子系统 WSL）中，进而在现行版的 Windows 10 PC 上装载 Linux 系统。"}
{"title": "你的VPN泄漏IP了吗：仍有20%的VPN服务商未解决WebRTC漏洞问题", "url": "https://www.freebuf.com/articles/web/166754.html", "time": "2018-03-29", "level": "", "num_look": 415352, "num_comment": 3, "author": "Elaine_z", "tags": ["WEB安全", "网络安全"], "text": "Tor，Edge和Internet Explorer之外，多数浏览器都是默认开启 WebRTC 的状态。VPN可能泄漏IP，记录日志？安全隐私问题仍然值得深思。"}
{"title": "默安科技安全招聘 | 如何让我遇见你，在这美好的四月天？", "url": "https://www.freebuf.com/jobs/166170.html", "time": "2018-03-29", "level": "", "num_look": 170825, "num_comment": 8, "author": "默安科技", "tags": ["安全招聘"], "text": "你好，我是默安，我知道你在悄悄关注着我，从朋友那里打听我的动向，聚会时会留意我的消息，还会不经意间偷偷瞥我几眼。你可能害羞吧，也一直没有主动找我……"}
{"title": "Mozilla发布新的Facebook扩展程序，专门用于隔离Facebook等网站收集隐私", "url": "https://www.freebuf.com/news/166635.html", "time": "2018-03-29", "level": "", "num_look": 146512, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "Mozilla基金会今天发布了一个Firefox插件，将Facebook网站及其所有域名隔离到一个单独的“容器”，有效阻止Facebook跟踪网络上其他网站的用户。"}
{"title": "2017年安天移动安全年报：起承转合间的方兴未艾与暗流涌动", "url": "https://www.freebuf.com/articles/paper/166105.html", "time": "2018-03-29", "level": "", "num_look": 175375, "num_comment": 175375, "author": "AVLTeam", "tags": ["安全报告"], "text": "在移动产业发展的巨大变革过程中，信息安全的“攻”与“守”之道往往也是共生并进的。2017年，移动安全和威胁对抗不断迈入新的阶段，而所谓“方兴未艾”与“暗流涌动”，也能够很好地体现于此。"}
{"title": "我们该从Facebook史上最大数据泄露事件中明白什么？", "url": "https://www.freebuf.com/articles/neopoints/166051.html", "time": "2018-03-29", "level": "红色标题", "num_look": 440448, "num_comment": 6, "author": "wangyiyunyidun", "tags": ["观点"], "text": "因多达5000万数据泄露并被政治广告公司利用，这几天的Facebook一直处于负面舆论旋涡中。"}
{"title": "锁屏病毒加密对抗衍变：强制锁屏并以支付解锁盗取钱财", "url": "https://www.freebuf.com/articles/terminal/166214.html", "time": "2018-03-29", "level": "", "num_look": 244840, "num_comment": 2, "author": "腾讯手机管家", "tags": ["终端安全"], "text": "置顶勒索病毒是指具有系统破坏及流氓行为，启动后强制将自身界面置于设备屏幕上方或者修改用户设备的锁屏密码，致使用户无法正常使用设备，并以支付解锁对用户进行勒索。"}
{"title": "BUF早餐铺 | 微软Meltdown补丁引发更大安全漏洞;研究人员发现新类Spectre分支预测攻击;iOS 11相机出现BUG;英雄链代投被某县公安以诈骗罪立案", "url": "https://www.freebuf.com/news/166723.html", "time": "2018-03-29", "level": "", "num_look": 179267, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "三月和风满上林。春光明媚，养生早餐了解一下？"}
{"title": "在Java EE Servers环境下利用Jolokia Agent漏洞", "url": "https://www.freebuf.com/vuls/166695.html", "time": "2018-03-28", "level": "", "num_look": 297515, "num_comment": 1, "author": "腾讯云安全", "tags": ["漏洞"], "text": "Jolokia 是一个通过 HTTP 的 JMX 连接器，提供了类 RESTful 的操作方式，可以通过 POST JSON 的方式访问和修改 JMX 属性、执行 JMX 操作、搜索 MBean、列出 MBean 的 Meta-data 等。"}
{"title": "Solveme.peng.kr平台Web题解", "url": "https://www.freebuf.com/articles/web/165537.html", "time": "2018-03-28", "level": "金币+5", "num_look": 418102, "num_comment": 9, "author": "一叶飘零", "tags": ["WEB安全"], "text": "最近发现了一个web练习平台:http://solveme.peng.kr/chall里面所有的web都是源码审计，感觉网上相关题解很少，于是抽空做了一下，写了一篇文章，欢迎大家和我多多交流！"}
{"title": "【已结束】全球视角解读企业安全威胁态势 | FreeBuf企业精品公开课 × 思科", "url": "https://www.freebuf.com/fevents/165301.html", "time": "2018-03-28", "level": "红色标题", "num_look": 417478, "num_comment": 6, "author": "FB客服", "tags": ["FreeBuf公开课", "活动"], "text": "徐洪涛先生将以《思科2018年度网络安全报告》切入，重点解读思科Talos威胁情报中得到的发现与洞察，以及在过去12-18个月内从威胁研究和6个技术合作伙伴中观察到的网络安全趋势。"}
{"title": "X Brute Forcer：一款小巧易用的CMS密码爆破工具", "url": "https://www.freebuf.com/sectool/165187.html", "time": "2018-03-28", "level": "", "num_look": 299119, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "X Brute Forcer是一款支持对多种常见CMS实施密码爆破攻击的工具。目前，X Brute Forcer所支持的CMS包括WordPress , Joomla , DruPal , OpenCart , Magento。"}
{"title": "安卓手机遭恶意攻击，揭秘RottenSys的花式“隐匿术”", "url": "https://www.freebuf.com/articles/terminal/166415.html", "time": "2018-03-28", "level": "", "num_look": 223217, "num_comment": 1, "author": "360安全", "tags": ["终端安全"], "text": "在大安全时代，用户所面临的移动威胁远不止此，诈骗电话、欺诈短信、钓鱼链接、木马病毒、勒索软件等，也是威胁用户移动安全的主要因素。"}
{"title": "关于SQL注入漏洞的4个误解", "url": "https://www.freebuf.com/articles/web/165234.html", "time": "2018-03-28", "level": "", "num_look": 378672, "num_comment": 8, "author": "secist", "tags": ["WEB安全"], "text": "本文我将着重说明人们对SQL注入常见的四个误解。安全无小事，任何人都不应对此抱有任何的幻想！"}
{"title": "盛大游戏安全实验室招聘安全工程师", "url": "https://www.freebuf.com/jobs/166528.html", "time": "2018-03-28", "level": "", "num_look": 233802, "num_comment": 27, "author": "biboro", "tags": ["安全招聘"], "text": "首先，这又是一篇招聘文章。这次，我可以给出工资范围，20K-30K（安全数据分析师）。如果面试给力的话，确定录取我会帮你争取更多。"}
{"title": "英特尔CPU漏洞再度袭来：全新旁路攻击方法BranchScope", "url": "https://www.freebuf.com/articles/system/166614.html", "time": "2018-03-28", "level": "", "num_look": 1216465, "num_comment": 16, "author": "Elaine_z", "tags": ["系统安全"], "text": "这种旁路攻击方法与今年年初的 Meltdown 和 Specter 漏洞利效果相似，但研究人员这次利用的是CPU推测执行功能中的一个新片段。"}
{"title": "iOS 11相机BUG，恐让用户误入恶意网站", "url": "https://www.freebuf.com/news/166622.html", "time": "2018-03-28", "level": "", "num_look": 173339, "num_comment": 4, "author": "shidongqi", "tags": ["资讯"], "text": "iOS 11相机存在可被黑客利用的漏洞，容易诱导用户进入恶意网站，尽管去年年底就已经有人报告，但至今依然没有修复。"}
{"title": "如何写一个开放WLAN下的嗅探测试工具？", "url": "https://www.freebuf.com/sectool/165806.html", "time": "2018-03-28", "level": "现金奖励", "num_look": 477549, "num_comment": 8, "author": "Macr0phag3", "tags": ["工具", "无线安全"], "text": "这个工具是用来嗅探测试开放WLAN下的数据包，具体嗅探的是含Cookie或者Method为Post的数据包。"}
{"title": "利用了多种Office OLE特性的免杀样本分析及溯源", "url": "https://www.freebuf.com/news/166056.html", "time": "2018-03-28", "level": "", "num_look": 229962, "num_comment": 5, "author": "奇安信威胁情报中心", "tags": ["资讯"], "text": "基于威胁情报中心的数据，我们捕获到了一批利用多个Office OLE特性绕过杀软检测并执行宏代码的样本。"}
{"title": "Empire 2.5：PowerShell渗透测试实战指南（上篇）", "url": "https://www.freebuf.com/articles/web/165925.html", "time": "2018-03-28", "level": "现金奖励", "num_look": 518321, "num_comment": 26, "author": "谦逊的阿狸先生", "tags": ["WEB安全"], "text": "Empire是一个纯粹的PowerShell 后开发代理，建立在密码安全通信和灵活的架构上。"}
{"title": "警惕SNMP默认团体名导致的网络入侵", "url": "https://www.freebuf.com/articles/network/165333.html", "time": "2018-03-28", "level": "现金奖励", "num_look": 377206, "num_comment": 6, "author": "ipenox", "tags": ["网络安全"], "text": "SNMP是基于TCP/IP协议族的网络管理标准，是一种在IP网络中管理网络节点（如服务器、工作站、路由器、交换机等）的标准协议,它通过UDP协议来操作，端口号是161/162。"}
{"title": "Buf早餐铺 | 俄罗斯网络犯罪集团Cobalt在西班牙遭警方逮捕；2017年有近五分之四的企业受到数据泄漏影响；前巴克莱银行CISO出任世界经济组织全球安全中心首脑", "url": "https://www.freebuf.com/news/166457.html", "time": "2018-03-28", "level": "", "num_look": 171279, "num_comment": 2, "author": "Elaine_z", "tags": ["资讯"], "text": "春日风光无限，不觉人生苦短，Buf早餐开启新一天的美好。"}
{"title": "最新水坑攻击样本仍然利用朝鲜黑客的Flash漏洞", "url": "https://www.freebuf.com/news/166512.html", "time": "2018-03-27", "level": "", "num_look": 220062, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "Morphisec警告称，有人利用香港电信公司网站进行攻击，攻击开始使用最近的Flash漏洞，该漏洞自2017年11月中旬以来一直被朝鲜利用。"}
{"title": "祸不单行，外媒爆料Facebook收集用户通话和短信数据多年", "url": "https://www.freebuf.com/news/166360.html", "time": "2018-03-27", "level": "", "num_look": 190300, "num_comment": 4, "author": "shidongqi", "tags": ["资讯"], "text": "5000万用户信息外泄，这绝对是Facebook面临的有史以来最大的困境，也让用户对Facebook尤其敏感。"}
{"title": "币圈用户请小心！WebInjects可以清空你的加密货币账户", "url": "https://www.freebuf.com/news/166387.html", "time": "2018-03-27", "level": "", "num_look": 175030, "num_comment": 175030, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "网络犯罪分子正在尝试各种各样的方法来将他们的“罪恶之手”伸向广大用户的加密货币钱包。"}
{"title": "一个都不放过！Zenis病毒诠释勒索加密最强等级", "url": "https://www.freebuf.com/articles/system/166254.html", "time": "2018-03-27", "level": "红色标题", "num_look": 376564, "num_comment": 12, "author": "360安全", "tags": ["系统安全"], "text": "近期，360安全中心监测到一款名为“Zenis”的勒索病毒，其命名源自病毒作者的名字。"}
{"title": "天网恢恢，疏而不漏：窃取银行近百亿人民币的Carbanak团伙头目落网", "url": "https://www.freebuf.com/news/166487.html", "time": "2018-03-27", "level": "", "num_look": 290619, "num_comment": 6, "author": "AngelaY", "tags": ["资讯"], "text": "如果你手上有一款恶意软件，可以让 ATM 机自动吐钱给你，数额高达近百亿人民币，你会不会去用？如果知道最终会被捕而且面临严惩，你还会不会去用呢？"}
{"title": "在Go中使用反向代理进行网络钓鱼测试", "url": "https://www.freebuf.com/articles/web/164067.html", "time": "2018-03-27", "level": "", "num_look": 249774, "num_comment": 3, "author": "secist", "tags": ["WEB安全"], "text": "对于一个攻击者来说，要想实施一次网络钓鱼攻击，往往需要做大量的准备工作。例如搭建钓鱼站点，引诱受害者上钩，捕获受害者的登录凭证等。为了避免这些繁杂的过程，本文我将教大家使用Go自动化这些过程。"}
{"title": "安全人才直升季一大波新增职位来袭，快快补票登机！", "url": "https://www.freebuf.com/fevents/166222.html", "time": "2018-03-27", "level": "红色标题", "num_look": 169746, "num_comment": 3, "author": "FB招聘小助手", "tags": ["活动"], "text": "喜大普奔！FreeBuf招聘站安全人才直升季第二波精选职位火热来袭～"}
{"title": "实例讲解False盲注基础原理", "url": "https://www.freebuf.com/articles/web/165650.html", "time": "2018-03-27", "level": "", "num_look": 301608, "num_comment": 7, "author": "ButterCat", "tags": ["WEB安全"], "text": "false盲注有些时候可以绕过一些WAF，也是容易被忽视的细节。本文的目的在于通过做CTF的同时来学习注入原理，同时也运用到自身的能力。"}
{"title": "跟心仪的妹子玩游戏误入博彩APP，顺手破了个案", "url": "https://www.freebuf.com/news/topnews/166142.html", "time": "2018-03-27", "level": "红色标题", "num_look": 2759668, "num_comment": 72, "author": "xiaotouming", "tags": ["其他", "头条"], "text": "过年回家饭局上碰到一个原来心仪的妹子，虽然已经4、5年没见面了，妹子见到我还是分外亲热，不仅主动挨着我坐着，居然还邀请我一起玩游戏，心中窃喜不已……"}
{"title": "ASLR on the Line：利用Cache Side Channel来反随机化ASLR", "url": "https://www.freebuf.com/sectool/165445.html", "time": "2018-03-27", "level": "现金奖励", "num_look": 261239, "num_comment": 261239, "author": "bin2415", "tags": ["工具"], "text": "ASLR是防御与内存有关安全漏洞的一个非常有用的措施，由于其overhead比较低，因此被广泛部署在现在的计算机系统中。"}
{"title": "对Kali进行网络配置并进行ARP欺骗", "url": "https://www.freebuf.com/sectool/166022.html", "time": "2018-03-27", "level": "现金奖励", "num_look": 700276, "num_comment": 33, "author": "kabeor", "tags": ["工具"], "text": "此文章所使用的配置方法是我经多次尝试，确定无误的步骤，但因为每个人的环境不同，所以仅供参考。"}
{"title": "BUF早餐铺 | 美国对九名参与国家性质活动的伊朗黑客实施制裁；外媒爆料Facebook收集用户通话和短信数据多年；百度李彦宏：中国人对隐私问题没那么敏感", "url": "https://www.freebuf.com/news/166391.html", "time": "2018-03-27", "level": "", "num_look": 171569, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "你愿意用隐私来交换便捷性或效率吗？"}
{"title": "IETF批准TLS 1.3为互联网标准", "url": "https://www.freebuf.com/news/166362.html", "time": "2018-03-26", "level": "", "num_look": 211052, "num_comment": 211052, "author": "Sphinx", "tags": ["资讯"], "text": "互联网工程任务组（IETF）已正式批准TLS 1.3作为传输层安全（TLS）协议的下一个主要版本，IETF组织是专门批准互联网标准和协议的组织。"}
{"title": "百度李彦宏：中国人对隐私问题没那么敏感", "url": "https://www.freebuf.com/news/166386.html", "time": "2018-03-26", "level": "红色标题", "num_look": 688875, "num_comment": 34, "author": "shidongqi", "tags": ["资讯"], "text": "百度以及李彦宏又成了网友口诛笔伐的对象，一是百度近几年几次重大负面事件造成的影响，另一种或许是对个人信息泄漏泛滥以及隐私保护无奈感的一种宣泄吧。"}
{"title": "剖析黑客常用的虚拟货币盗窃手段", "url": "https://www.freebuf.com/articles/neopoints/164965.html", "time": "2018-03-26", "level": "", "num_look": 243167, "num_comment": 243167, "author": "柚子", "tags": ["观点"], "text": "想在这个“滚雪球”的游戏中分利。但是不懂得游戏规则的人承担的风险显然高很多。"}
{"title": "Branca Token：一款经过认证加密的安全API令牌", "url": "https://www.freebuf.com/sectool/165804.html", "time": "2018-03-26", "level": "", "num_look": 239612, "num_comment": 239612, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Branca的加密令牌，Branca使用了现代密码学算法来对API令牌进行认证和加密，并可用于多种在线服务之中。"}
{"title": "基于Metasploit编写终端检测程序", "url": "https://www.freebuf.com/sectool/165992.html", "time": "2018-03-26", "level": "现金奖励", "num_look": 267686, "num_comment": 7, "author": "delay", "tags": ["工具"], "text": "2017年初的项目中，我发现某客户单位的员工办公终端未进行内/外网物理隔离，内网通过设置浏览器代理服务器访问公网，遂向客户提出风险。"}
{"title": "“网藤杯”智能安全机器人养成计划活动解密", "url": "https://www.freebuf.com/fevents/166329.html", "time": "2018-03-26", "level": "红色标题", "num_look": 173586, "num_comment": 2, "author": "斗象智能安全平台", "tags": ["活动"], "text": "收获暗链、webshell通信样本、恶意URL样本共计12357份。在活动期间，通过各模型的定期重训练和训练样本数量及质量提高，使网藤智能安全机器人的识别能力有了大幅提升。"}
{"title": "挖洞经验 | 看我如何发现Google云开发功能命令注入漏洞（$6000）", "url": "https://www.freebuf.com/articles/web/164920.html", "time": "2018-03-26", "level": "", "num_look": 261251, "num_comment": 3, "author": "clouds", "tags": ["WEB安全"], "text": "几个月之前我在Google的云平台开发应用Cloud Shell中发现了一个命令注入漏洞。"}
{"title": "挖洞新技能get√ | 挖金山云漏洞不仅有京东卡，更有万元奖励项目入场券", "url": "https://www.freebuf.com/fevents/166240.html", "time": "2018-03-26", "level": "红色标题", "num_look": 199201, "num_comment": 3, "author": "漏洞盒子", "tags": ["活动"], "text": "金山云SRC又来放大招啦，这次不仅送京东卡还有高级项目入场券等你来拿哦"}
{"title": "路由器漏洞复现分析第四弹：CVE-2018-7034", "url": "https://www.freebuf.com/articles/wireless/165716.html", "time": "2018-03-26", "level": "金币+12", "num_look": 550355, "num_comment": 11, "author": "kczwa1", "tags": ["无线安全"], "text": ""}
{"title": "七亿元学费，教你Unicode钓鱼", "url": "https://www.freebuf.com/articles/web/165975.html", "time": "2018-03-26", "level": "现金奖励", "num_look": 511664, "num_comment": 13, "author": "进击的大熊2018", "tags": ["WEB安全"], "text": "沸沸扬扬的币安被盗事件，背后竟然有  Unicode 钓鱼攻击做助攻。究竟怎么回事儿？"}
{"title": "Reddit关闭暗网社区，引发用户热议", "url": "https://www.freebuf.com/news/166138.html", "time": "2018-03-26", "level": "", "num_look": 240490, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "近日，Reddit 关闭了 /r/DarkNetMarkets 暗网社区，当时其订阅用户数量高达 18 万。"}
{"title": "WannaMine新动向：对Weblogic服务端发起大规模攻击", "url": "https://www.freebuf.com/articles/web/166066.html", "time": "2018-03-26", "level": "", "num_look": 283742, "num_comment": 4, "author": "360安全", "tags": ["WEB安全"], "text": "，360互联网安全中心监测到挖矿僵尸网络“WannaMine”进行了一次全面更新，目标直指使用Weblogic服务端组件的服务器。"}
{"title": "BUF早餐铺 | 斯诺登称公共账本是比特币最大缺陷；谷歌要构建自己的区块链技术；北京市首例比特币被盗案件;TLSv 1.3 网络安全标准通过", "url": "https://www.freebuf.com/news/166295.html", "time": "2018-03-26", "level": "", "num_look": 184971, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": "比特币、区块链依然是互联网最热门的关键词，谷歌也在探索自己的区块链技术，北京市首例比特币被盗案有了新的进展。"}
{"title": "如何对已损坏的SQLite数据库取证分析？", "url": "https://www.freebuf.com/articles/database/164644.html", "time": "2018-03-25", "level": "", "num_look": 315982, "num_comment": 1, "author": "secist", "tags": ["数据安全"], "text": "SQLite是当今最流行的数据库之一，许多移动应用台式计算机以及便携式笔记本上都用它来存储数据（例如桌面工具、浏览器以及社交媒体软件等）。"}
{"title": "挖洞经验 | 看我如何在Jive-n中发现了一个XXE漏洞 (CVE-2018-5758)", "url": "https://www.freebuf.com/articles/web/164861.html", "time": "2018-03-25", "level": "", "num_look": 286015, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "很多渗透测试人员会对各种各样不同的服务以及应用程序进行安全测试，但他们往往会忽略自己的产品和服务。在这种情况下，他们就可能成为攻击者的首要目标。"}
{"title": "CTF实战|USV-2017全题解", "url": "https://www.freebuf.com/articles/web/165346.html", "time": "2018-03-25", "level": "", "num_look": 418587, "num_comment": 11, "author": "D3ck", "tags": ["WEB安全"], "text": "最近在某平台上down了一个CTF靶机玩玩，感觉还挺有意思的，故写出我的解题思路。"}
{"title": "小白都能看懂的JSON反序列化远程命令执行", "url": "https://www.freebuf.com/sectool/165655.html", "time": "2018-03-25", "level": "现金奖励", "num_look": 531591, "num_comment": 19, "author": "TopScrew", "tags": ["工具"], "text": "Fastjson是一个由阿里巴巴维护的一个json库。它采用一种“假定有序快速匹配”的算法，是号称Java中最快的json库。"}
{"title": "挖洞经验 | 看我如何发现Facebook密码重置漏洞获得$15000赏金（附POC）", "url": "https://www.freebuf.com/vuls/164652.html", "time": "2018-03-24", "level": "", "num_look": 458925, "num_comment": 18, "author": "clouds", "tags": ["漏洞"], "text": "本文讲述了我在Facebook上发现的一个任意账户密码重置漏洞，利用该漏洞无需用户交互过程，就可以黑掉任何Facebook账户。"}
{"title": "Any.Run交互式恶意软件分析沙盒服务现向公众免费开放", "url": "https://www.freebuf.com/sectool/164638.html", "time": "2018-03-24", "level": "", "num_look": 315292, "num_comment": 7, "author": "secist", "tags": ["工具"], "text": "近日，名为Any.Run的交互式恶意软件分析沙盒服务宣布，其免费社区版本正式向公众开放。"}
{"title": "爬虫代理搭建与批量安装", "url": "https://www.freebuf.com/articles/web/165547.html", "time": "2018-03-24", "level": "金币+10", "num_look": 394346, "num_comment": 6, "author": "manwu91", "tags": ["WEB安全"], "text": "在网上找的免费代理可用性又太低，于是决定充分利用爬虫服务器的网络资源，在上面搭建自己的代理服务。"}
{"title": "【FB TV】一周「BUF大事件」：Facebook被爆5000万用户数据泄漏；500万台国产安卓手机被预装恶意软件变僵尸；AMD确认产品漏洞将发布补丁", "url": "https://www.freebuf.com/video/166253.html", "time": "2018-03-24", "level": "红色标题", "num_look": 319609, "num_comment": 2, "author": "willhuang", "tags": ["视频"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，Facebook被爆5000万用户数据泄漏，公司股价持续下跌；500万台国产安卓手机被预装恶意软件变僵尸。"}
{"title": "x64下利用LD_PRELOAD动态连接，给软件增加自己需要的功能", "url": "https://www.freebuf.com/sectool/165766.html", "time": "2018-03-24", "level": "金币+10", "num_look": 366838, "num_comment": 2, "author": "Mr极品混混", "tags": ["工具"], "text": "有一个以前用的软件，一直在用，非常稳定，现在由于业务需要，在显示结果后面，根据配置文件，在进行一次正则过滤。"}
{"title": "扎克伯格谈剑桥分析事件：我们犯了错", "url": "https://www.freebuf.com/news/166202.html", "time": "2018-03-23", "level": "", "num_look": 395591, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "Facebook首席执行官马克扎克伯格周三评论剑桥分析公司事件，他承认公司犯了错误。"}
{"title": "挖洞经验 | 看我如何绕过限制访问到Google内部管理系统（价值$13337）", "url": "https://www.freebuf.com/vuls/164831.html", "time": "2018-03-23", "level": "红色标题", "num_look": 937361, "num_comment": 20, "author": "clouds", "tags": ["漏洞"], "text": "大家好，我是印度一个电子工程专业大三学生和一名漏洞挖掘新手。最近，我发现了谷歌（Google）一个验证绕过漏洞，利用该漏洞可以直接访问到谷歌的Youtube 卫星直播和Youtube TV电视服务管理页面。"}
{"title": "使用x64dbg分析微信聊天函数并实现发信息", "url": "https://www.freebuf.com/sectool/164988.html", "time": "2018-03-23", "level": "现金奖励", "num_look": 639720, "num_comment": 19, "author": "lant1e", "tags": ["工具", "终端安全"], "text": "我们知道微信现在不光在手机上很常用，在电脑也是非常常用的，尤其是使用微信联系客户和维护群的人。"}
{"title": "Mac恶意软件的现状如何？", "url": "https://www.freebuf.com/news/164815.html", "time": "2018-03-23", "level": "", "num_look": 266389, "num_comment": 1, "author": "secist", "tags": ["系统安全", "资讯"], "text": "相对于Windows系统来说，Mac系统以其安全性而著称。因此，也有许多的Mac用户认为他们并不需要安全什么杀毒软件。但事实真的是如此吗？"}
{"title": "白帽子再迎喜讯：Netflix公开漏洞奖励项目，Dropbox修改漏洞披露政策", "url": "https://www.freebuf.com/news/166179.html", "time": "2018-03-23", "level": "红色标题", "num_look": 224239, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "本周三，Netflix 宣布在 Bugcrowd 平台公开其漏洞奖励项目，单个漏洞奖金高达 15000 美元。此外，Dropbox 也修改了其漏洞披露政策，承诺不会起诉漏洞研究员。"}
{"title": "谷歌为G-Suite服务部署全新反钓鱼和恶意软件检测功能", "url": "https://www.freebuf.com/news/166083.html", "time": "2018-03-23", "level": "", "num_look": 312133, "num_comment": 1, "author": "kylin1415", "tags": ["WEB安全", "资讯"], "text": "G Suite 管理员可以在G Suite 后端内部启用全新的 AI 安全支持功能。这个功能可以检测含有潜在恶意软件的电子邮件，并提醒用户潜在的威胁和钓鱼攻击。"}
{"title": "又出新玩法？微软公式编辑器系列漏洞新利用方式", "url": "https://www.freebuf.com/vuls/165846.html", "time": "2018-03-23", "level": "", "num_look": 334200, "num_comment": 10, "author": "金睛", "tags": ["漏洞"], "text": "微软发布的月度安全更新中修复了多个最新的Office漏洞(CVE-2017-11882，CVE-2018-0798和CVE-2018-0802)，现在这些漏洞出现了新的利用方式。"}
{"title": "研究人员指出利用文本编辑器插件提权的方法", "url": "https://www.freebuf.com/news/165696.html", "time": "2018-03-23", "level": "红色标题", "num_look": 347903, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": "文本编辑器已经成为程序员、设计师等专业人员的必备工具之一，如今却存在被黑客利用的风险。"}
{"title": "椭圆曲线算法（ECC）学习（二）之Secp256k1", "url": "https://www.freebuf.com/articles/database/165851.html", "time": "2018-03-23", "level": "现金奖励", "num_look": 809229, "num_comment": 7, "author": "淼淼兮与怀", "tags": ["数据安全"], "text": "Secp256k1是指比特币中使用的ECDSA(椭圆曲线数字签名算法)曲线的参数，并且在高效密码学标准中进行了定义。"}
{"title": "一小时的DDoS共计多少钱？暗网市场只需10美元", "url": "https://www.freebuf.com/news/165960.html", "time": "2018-03-23", "level": "", "num_look": 338912, "num_comment": 7, "author": "shidongqi", "tags": ["资讯"], "text": "在暗网上，人们可以以10美元/小时、200美元/天的价格或者500美元/ 12000美元的价格租用DDoS攻击。"}
{"title": "BUF早餐铺 | 美国国安局开发系统追踪比特币用户;苹果Siri被曝隐私漏洞：锁屏通知直接读取；G20将加密货币定义为资产而非货币；Reddit关闭暗网讨论版块", "url": "https://www.freebuf.com/news/166134.html", "time": "2018-03-23", "level": "", "num_look": 232353, "num_comment": 4, "author": "shidongqi", "tags": ["资讯"], "text": "国足0-6惨负威尔士，不知道多少人昨夜失眠。但生活还要继续，BUF早餐铺还是要看。"}
{"title": "苹果Siri被曝隐私漏洞：锁屏通知直接读取", "url": "https://www.freebuf.com/news/166090.html", "time": "2018-03-22", "level": "红色标题", "num_look": 494186, "num_comment": 6, "author": "Sphinx", "tags": ["资讯"], "text": "iOS 11中，苹果采用了一种新的方式保护用户隐私，用户通过iPhone的锁屏隐藏通知内容，直到用Touch ID或Face ID解锁设备。"}
{"title": "如何搭配USRP在安卓设备上搭建GNU Radio", "url": "https://www.freebuf.com/geek/164835.html", "time": "2018-03-22", "level": "", "num_look": 329103, "num_comment": 4, "author": "Covfefe", "tags": ["极客"], "text": "在这篇文章中，我们会使用安卓设备通过USB连接USRP。所以就需要USRP B2xx（B200, B210, 或者是 B200mini），这些都是经过全面测试的。"}
{"title": "福利 |「2018企业安全年度行动指南」限量免费获取", "url": "https://www.freebuf.com/fevents/166054.html", "time": "2018-03-22", "level": "红色标题", "num_look": 232220, "num_comment": 4, "author": "FB客服", "tags": ["活动"], "text": "《2018企业安全年度行动指南》，该指南旨在帮助企业安全负责人了解年度安全趋势、把握安全威胁、合理应对安全问题。"}
{"title": "美国政府再次指责俄罗斯黑客攻击其关键基础设施", "url": "https://www.freebuf.com/news/165860.html", "time": "2018-03-22", "level": "", "num_look": 349747, "num_comment": 6, "author": "JingleCats", "tags": ["工控安全", "资讯"], "text": "Cylance的研究员报道称网络攻击者在利用一个核心路由器针对一些基础设施进行攻击，美国指责这一攻击的实施者为俄罗斯。"}
{"title": "挖洞经验 | 看我如何在瑞士最大的托管服务提供商系统中发现了一个数据库泄漏漏洞", "url": "https://www.freebuf.com/vuls/164849.html", "time": "2018-03-22", "level": "", "num_look": 279805, "num_comment": 11, "author": "Alpha_h4ck", "tags": ["漏洞"], "text": "在研发我们最新的安全软件即服务（SaaS）过程中（该产品允许任何用户检测自己服务器的安全等级），我们对我们自己的网站进行了检测。"}
{"title": "网易信息安全部诚聘安全人才", "url": "https://www.freebuf.com/jobs/165910.html", "time": "2018-03-22", "level": "", "num_look": 354295, "num_comment": 17, "author": "NSRC", "tags": ["安全招聘"], "text": "网易安全应急响应中心（NSRC）安全工程师团队隶属于网易信息安全部，网易一直重视自身产品和业务的安全问题，始终坚持“安全第一，用户第一”。欢迎有意向的小伙伴加入我们，共同建设网易安全。"}
{"title": "快讯 | 中央网络安全和信息化领导小组改为委员会，将优化管理职责", "url": "https://www.freebuf.com/news/166059.html", "time": "2018-03-22", "level": "红色标题", "num_look": 243637, "num_comment": 4, "author": "AngelaY", "tags": ["资讯"], "text": "为维护国家网络空间安全和利益，将国家计算机网络与信息安全管理中心由工业和信息化部管理调整为由中央网络安全和信息化委员会办公室管理。"}
{"title": "开源软件源代码安全缺陷分析报告（第二期）", "url": "https://www.freebuf.com/articles/paper/165184.html", "time": "2018-03-22", "level": "", "num_look": 329550, "num_comment": 6, "author": "奇安信代码卫士", "tags": ["安全报告"], "text": "本期报告持续聚焦国内知名互联网公司的软件安全开发现状，通过检测公司旗下多款开源软件产品的安全缺陷，评估各公司的代码安全控制情况。"}
{"title": "通过JBoss反序列化（CVE-2017-12149）浅谈Java反序列化漏洞", "url": "https://www.freebuf.com/vuls/165060.html", "time": "2018-03-22", "level": "金币+8", "num_look": 674758, "num_comment": 16, "author": "哲哥哥丶", "tags": ["漏洞"], "text": "前段时间学校学习J2EE，用到了jboss，顺便看了下jboss的反序列化，再浅谈下反序列化漏洞。"}
{"title": "利用PPPOE认证获取路由器中宽带账号密码", "url": "https://www.freebuf.com/articles/wireless/164728.html", "time": "2018-03-22", "level": "现金奖励", "num_look": 854493, "num_comment": 16, "author": "婷儿小跟班✧", "tags": ["无线安全"], "text": "回家时买了一台极路由准备换掉家里老掉牙的阿里路由器，想进后台看一下宽带账号密码，咦？？？后台密码是什么来着？？？"}
{"title": "AMD确认产品存在漏洞，补丁即将发布", "url": "https://www.freebuf.com/articles/system/165977.html", "time": "2018-03-22", "level": "", "num_look": 181899, "num_comment": 1, "author": "Sphinx", "tags": ["系统安全"], "text": "AMD已经正式确认3月12日发布的RyzenFall，MasterKey，Fallout和Chimera漏洞的有效性，并表示将在“未来几周内发布补丁。”"}
{"title": "面向机器人的通讯机制安全研究与改进", "url": "https://www.freebuf.com/articles/wireless/165566.html", "time": "2018-03-22", "level": "金币+8", "num_look": 405669, "num_comment": 5, "author": "网络安全通", "tags": ["无线安全"], "text": "本文提出了一种基于SHA-1安全杂凑算法的简单、可靠、易于移植的点对点射频安全通讯机制，保障通讯过程中数据来源的正确性和数据的秘密性。"}
{"title": "BUF早餐铺 | AMD确认产品存在漏洞，将发布补丁；旅行网站Orbitz遭入侵，80多万支付卡信息泄露；黑客可利用Windows远程协助窃取信息；支付宝涉嫌非法搜集用户信息被起诉", "url": "https://www.freebuf.com/news/166025.html", "time": "2018-03-22", "level": "", "num_look": 201433, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "雨霁风光，春分天气。千花百卉争明媚。"}
{"title": "控制流程完整性：给大家介绍一种“另类”的Javascript反分析技术", "url": "https://www.freebuf.com/articles/web/164853.html", "time": "2018-03-21", "level": "", "num_look": 267170, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "理解恶意软件的真实代码对恶意软件分析人员来说是非常有优势的，因为这样才能够真正了解恶意软件所要做的事情。"}
{"title": "代码分享|用Python编写的多协议弱密码审计工具集", "url": "https://www.freebuf.com/sectool/163919.html", "time": "2018-03-21", "level": "现金奖励", "num_look": 542327, "num_comment": 11, "author": "ipenox", "tags": ["工具"], "text": "前几天与大家分享了我自己用C++实现的用于企业内部环境的ssh弱密码审计工具。在实际的工作中，我们还需要对多种常见的协议定期进行弱密码审计。"}
{"title": "安卓四大组件审计实验（drozer）", "url": "https://www.freebuf.com/articles/web/165466.html", "time": "2018-03-21", "level": "现金奖励", "num_look": 382294, "num_comment": 4, "author": "烟波渺渺正愁予", "tags": ["WEB安全"], "text": "四大组件是组成安卓应用的关键部分，每个应用都是由一个或者多个组件组成。主要有4个组件：Activity、Service、Content Providers、Broadcast Receivers。"}
{"title": "为什么说机器学习是我们预防网络威胁的最佳武器", "url": "https://www.freebuf.com/articles/network/164834.html", "time": "2018-03-21", "level": "", "num_look": 253919, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "现在唯一能帮我们对抗网络犯罪分子的盟友/武器，可能就是机器学习技术了。"}
{"title": "研究人员：每200个Google搜索建议中就有一个被污染", "url": "https://www.freebuf.com/news/165840.html", "time": "2018-03-21", "level": "", "num_look": 168681, "num_comment": 3, "author": "Sphinx", "tags": ["资讯"], "text": "来自美国三所大学的研究团队发现，每200个谷歌搜索自动补全建议中就有一个被污染，被用于误导用户到虚假网站或者推广恶意软件和其他恶意内容。"}
{"title": "CrySiS勒索病毒变种来袭，你中招了吗？", "url": "https://www.freebuf.com/articles/system/165801.html", "time": "2018-03-21", "level": "", "num_look": 428075, "num_comment": 2, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "最近接到客户举报，服务器文件被勒索软件加密，联系客户远程应急之后拿到相应的样本，判定该样本为CrySiS家族的最新变种样本。"}
{"title": "PHP反序列化与WordPress一些意外BUG的有趣结合", "url": "https://www.freebuf.com/articles/web/164075.html", "time": "2018-03-21", "level": "", "num_look": 235066, "num_comment": 1, "author": "5ecurity", "tags": ["WEB安全"], "text": "这个插件的问题在于发送明文HTTP请求，并且将该请求响应传递给了unserialize ()函数。"}
{"title": "关于CVE-2018-4901的研究", "url": "https://www.freebuf.com/vuls/164512.html", "time": "2018-03-21", "level": "现金奖励", "num_look": 447279, "num_comment": 7, "author": "TueurCalme", "tags": ["漏洞"], "text": "上个周末在 FreeBuf 上看到Adobe Acrobat Reader中存在远程代码执行漏洞 这篇文章后，决定自己尝试去复现一下这个漏洞，至少能弹个计算器吧，结果一些事情出乎意料，这里把自己的研究过程写下来。"}
{"title": "Buf早餐铺 | 俄罗斯黑客组织入侵美国关键基础设施；Facebook安全部门转向关注选举安全问题；离奇的“奥巴马照片”身份证开卡盗刷案件暴露支付卡安全风险", "url": "https://www.freebuf.com/news/165817.html", "time": "2018-03-21", "level": "", "num_look": 215911, "num_comment": 2, "author": "Elaine_z", "tags": ["资讯"], "text": "两只黄鹂鸣翠柳，一行白鹭上青天。"}
{"title": "Facebook丑闻反思 | 大数据环境下的隐形黑手", "url": "https://www.freebuf.com/articles/neopoints/165864.html", "time": "2018-03-20", "level": "红色标题", "num_look": 338914, "num_comment": 2, "author": "shidongqi", "tags": ["观点"], "text": "大数据在很多方面都能够发挥巨大价值，但这次Facebook风波则让更多人看到了大数据可怕的一面。"}
{"title": "DAFF：Android应用程序Fuzzing框架", "url": "https://www.freebuf.com/sectool/164794.html", "time": "2018-03-20", "level": "", "num_look": 303465, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "Droid应用程序Fuzz框架（DAFF）可以帮助你在android设备中，对Android浏览器和PDF阅读器进行模糊测试，以发现其中可能存在的内存损坏漏洞。"}
{"title": "熟悉的Str2-045，不一样的认识", "url": "https://www.freebuf.com/vuls/165488.html", "time": "2018-03-20", "level": "现金奖励", "num_look": 346207, "num_comment": 11, "author": "TopScrew", "tags": ["漏洞"], "text": "Struts2漏洞频发的Java主流框架，在利用大佬们的poc或者工具时，我们又是否知道这个漏洞到底谁怎么产生的，那么一大串的POC到底是什么意思？准备从漏洞的调用链，到Bypass安全管理器到POC的拆分理解。"}
{"title": "FB招聘站独家 | 2018安全人才直升季百万年薪岗位大揭秘", "url": "https://www.freebuf.com/jobs/165759.html", "time": "2018-03-20", "level": "红色标题", "num_look": 232817, "num_comment": 5, "author": "FB客服", "tags": ["安全招聘", "活动"], "text": "FreeBuf招聘站独家发布顶尖信息安全职位，百万年薪，只为最优秀的你。"}
{"title": "关于网络钓鱼的深入讨论", "url": "https://www.freebuf.com/articles/web/164870.html", "time": "2018-03-20", "level": "", "num_look": 365612, "num_comment": 7, "author": "secist", "tags": ["WEB安全"], "text": "网络钓鱼听起来很容易，但大规模的钓鱼活动策划并不简单。以下是关于内部钓鱼邮件的一些提示。"}
{"title": "网络安全商业模式分析", "url": "https://www.freebuf.com/articles/neopoints/165811.html", "time": "2018-03-20", "level": "", "num_look": 311453, "num_comment": 7, "author": "AngelaY", "tags": ["观点"], "text": "国内企业级网络安全市场延续了近二十年的“卖盒子”的商业模式没有太大改变。今天我们j就一起来探讨一下网络安全的商业模式。"}
{"title": "勒索软件“假面”系列——免流软件", "url": "https://www.freebuf.com/articles/terminal/165410.html", "time": "2018-03-20", "level": "", "num_look": 395544, "num_comment": 10, "author": "360安全", "tags": ["终端安全"], "text": "免流软件根据其核心功能所在的位置可以分为本地免流与云免流，本地免流软件的核心功能环节通常位于本地，而云免流的核心功能环节则主要在VPN中完成。"}
{"title": "没有Android基础都能学会的Xposed基础教程", "url": "https://www.freebuf.com/articles/terminal/164741.html", "time": "2018-03-20", "level": "金币+8", "num_look": 617607, "num_comment": 16, "author": "秃顶的邪念", "tags": ["终端安全"], "text": "随着手机使用者增多，手机智能化程度提高，各种app应运而生，这些app中不免有些恶意程序，时刻威胁着使用者，对用户的隐私等造成侵犯。"}
{"title": "重新认识被人遗忘的HTTP头注入", "url": "https://www.freebuf.com/articles/web/164817.html", "time": "2018-03-20", "level": "现金奖励", "num_look": 1013672, "num_comment": 40, "author": "TopScrew", "tags": ["WEB安全"], "text": "注入类漏洞经久不衰，多年保持在owasp Top 10的首位。今天就聊聊那些被人遗忘的http头注入。用简单的实际代码进行演示，让每个人更深刻的去认识该漏洞。"}
{"title": "医疗机构频遭黑客攻击，2018年还将面临五大安全威胁", "url": "https://www.freebuf.com/articles/es/165519.html", "time": "2018-03-20", "level": "", "num_look": 291700, "num_comment": 2, "author": "shidongqi", "tags": ["企业安全"], "text": "放眼全球，医疗保健机构依然是勒索软件、数据盗窃、网络钓鱼以及内部威胁的重点目标。"}
{"title": "BUF早餐铺 | 黑客试图在沙特石油化工厂引发爆炸；Facebook承认自家数据被用来进行大规模分析；Firefox主密码系统过去9年的安全性很差", "url": "https://www.freebuf.com/news/165768.html", "time": "2018-03-20", "level": "", "num_look": 166948, "num_comment": 2, "author": "Sphinx", "tags": ["资讯"], "text": "黑客新技能：利用文本编辑器插件提权；GitHub 2017年支付漏洞赏金100多万元，超出去年一倍多；Facebook承认自家数据被用来进行大规模分析。"}
{"title": "Password_Pwncheck：一款可以帮助企业提升密码安全性的工具", "url": "https://www.freebuf.com/sectool/164793.html", "time": "2018-03-19", "level": "", "num_look": 261857, "num_comment": 6, "author": "secist", "tags": ["工具"], "text": "password_pwncheck是一款用于帮助提升企业密码安全性的工具。它会通过大量公开的哈希数据源来匹配，你当前所使用的账户密码是否已被泄露。"}
{"title": "路由器漏洞复现分析第三弹：DVRF INTRO题目分析", "url": "https://www.freebuf.com/articles/wireless/163823.html", "time": "2018-03-19", "level": "现金奖励", "num_look": 423766, "num_comment": 1, "author": "kczwa1", "tags": ["无线安全"], "text": "这个项目的目的是来帮助人们学习X86_64之外其他架构环境，同时还帮助人们探索路由器固件里面的奥秘。"}
{"title": "从外部Active Directory获取域管理员", "url": "https://www.freebuf.com/articles/web/164515.html", "time": "2018-03-19", "level": "", "num_look": 267874, "num_comment": 6, "author": "secist", "tags": ["WEB安全"], "text": "我曾是一名Web开发人员，我对信息安全的兴趣也从 web 开始。从最初的兼职到如今的全职，活动目录（Active Directory）测试已成为我最喜欢的渗透测试类型。"}
{"title": "GitHub 2017年支付漏洞赏金100多万元，超出去年一倍多", "url": "https://www.freebuf.com/news/165692.html", "time": "2018-03-19", "level": "", "num_look": 521513, "num_comment": 5, "author": "AngelaY", "tags": ["资讯"], "text": "程序员最爱的 GitHub 的漏洞奖励计划到 2017 年已经是第四年。这四年间，累计发放的漏洞赏金约 35 万美元（按照 3 月 19 日汇率约2216095 元）。"}
{"title": "超详细SQLMap使用攻略及技巧分享", "url": "https://www.freebuf.com/sectool/164608.html", "time": "2018-03-19", "level": "金币+8", "num_look": 3394804, "num_comment": 15, "author": "simeon", "tags": ["工具"], "text": "sqlmap是一个开源的渗透测试工具，可以用来进行自动化检测，利用SQL注入漏洞，获取数据库服务器的权限。"}
{"title": "混在运维部的安全员说“端口与口令安全”", "url": "https://www.freebuf.com/articles/web/165340.html", "time": "2018-03-19", "level": "现金奖励", "num_look": 952512, "num_comment": 33, "author": "liong03", "tags": ["WEB安全"], "text": "端口信息的收集这是一个很重要的过程，因为渗透实战中对端口的渗透是常用手段。"}
{"title": "CVE-2017-0135漏洞分析：利用Edge浏览器的XSS过滤器绕过CSP", "url": "https://www.freebuf.com/articles/web/164871.html", "time": "2018-03-19", "level": "现金奖励", "num_look": 441886, "num_comment": 4, "author": "tocttou", "tags": ["WEB安全"], "text": "注意这个漏洞并不是在绕过XSS过滤器，而是利用它让一些本来没有XSS的页面，强行制造出可利用的XSS漏洞。"}
{"title": "如何自己动手制作一个靠谱的PM2.5检测仪", "url": "https://www.freebuf.com/geek/164192.html", "time": "2018-03-19", "level": "现金奖励", "num_look": 314208, "num_comment": 7, "author": "_橙子 ゝ", "tags": ["极客"], "text": "网上买一个PM2.5需要好几百，太贵了，贫穷限制了我的想象，刚好最近国内Micropython火的不行，我就自己动手做了一个简单的PM2.5检测仪，妈妈再也不用担心我的健康啦。"}
{"title": "BUF早餐铺 | 2017年亚洲受勒索软件攻击最多； 500万台安卓手机感染恶意软件构成僵尸网络；3款VPN泄露用户隐私；英特尔推出新芯片保护措施", "url": "https://www.freebuf.com/news/165578.html", "time": "2018-03-19", "level": "", "num_look": 223434, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "竹外桃花三两枝，春江水暖鸭先知。蒌蒿满地芦芽短，正是河豚欲上时。"}
{"title": "如何安全地存储密码货币", "url": "https://www.freebuf.com/articles/database/164588.html", "time": "2018-03-18", "level": "", "num_look": 327340, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["数据安全"], "text": "提醒大家一下，把加密货币存储在交易网站中其实是很不安全的。"}
{"title": "挖洞经验 | 看我如何发现Google云平台漏洞并获得$7500赏金", "url": "https://www.freebuf.com/vuls/164073.html", "time": "2018-03-18", "level": "", "num_look": 362447, "num_comment": 3, "author": "clouds", "tags": ["其他", "漏洞"], "text": "本文讲述了一名乌拉圭17岁高中生，因对信息安全感兴趣，通过学习研究，独立发现谷歌云平台漏洞并获得$7500美金。"}
{"title": "2017年Google Android安全报告：Android和iOS一样安全", "url": "https://www.freebuf.com/articles/terminal/165558.html", "time": "2018-03-18", "level": "", "num_look": 280771, "num_comment": 1, "author": "Sphinx", "tags": ["终端安全"], "text": "Google发布了Android安全报告，这份56页的报告是为了让你了解Android系统的安全性，让你知道Google竭尽所能阻止用户安装有害的应用。"}
{"title": "阻止WannaCry的英雄被FBI带走，未来路在何方？", "url": "https://www.freebuf.com/articles/others-articles/165068.html", "time": "2018-03-18", "level": "", "num_look": 389983, "num_comment": 8, "author": "GeekPwn", "tags": ["人物志", "其他"], "text": "马库斯·哈钦斯，阻止了一次堪称史上最危险网络攻击 WannaCry，三个月后被 FBI 逮捕。"}
{"title": "加热器除了温暖你的家，竟然还能挖矿？", "url": "https://www.freebuf.com/news/165280.html", "time": "2018-03-18", "level": "", "num_look": 243113, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["终端安全", "资讯"], "text": "Qarnot是一家法国加热器制造公司，而这家公司所设计的产品似乎给大家提供了一种新的加密货币使用途径。"}
{"title": "APTSimulator：一款功能强大的APT模拟攻击工具集", "url": "https://www.freebuf.com/sectool/164236.html", "time": "2018-03-17", "level": "金币+13", "num_look": 486580, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫ATPSimulator的攻击模拟工具集（Windows Batch脚本），这套工具集可以让一台计算机系统看起来像受到了APT攻击一样。"}
{"title": "【FB TV】一周「BUF大事件」：AMD处理器被披露13个严重漏洞；币安网对外发布全球通缉令缉拿黑客；Facebook、Google先后禁止加密货币广告", "url": "https://www.freebuf.com/video/165586.html", "time": "2018-03-17", "level": "红色标题", "num_look": 299585, "num_comment": 299585, "author": "willhuang", "tags": ["视频"], "text": "本周AMD处理器被披露13个严重漏洞，一波未平一波又起；币安网对外发布全球通缉令缉拿黑客；Facebook，Google先后禁止加密货币广告。"}
{"title": "CBC字节翻转攻击测试", "url": "https://www.freebuf.com/articles/system/163756.html", "time": "2018-03-17", "level": "现金奖励", "num_look": 504940, "num_comment": 6, "author": "Abyss0", "tags": ["系统安全"], "text": "刷题遇到CBC字节翻转攻击，就去查了资料，然后自己做了份整理，只是看原理有点枯燥，就写了点样例代码，顺便练习一下Python。"}
{"title": "打造一款属于自己的远程管理软件（三）", "url": "https://www.freebuf.com/sectool/164513.html", "time": "2018-03-17", "level": "", "num_look": 480994, "num_comment": 11, "author": "Mr极目楚天舒", "tags": ["工具"], "text": "相对于被控端而言，控制端主要涉及软件界面、命令发送、消息显示这三个方面。接下来我从这三方面入手向大家介绍。"}
{"title": "漏洞预警 | Ubuntu存在本地提权漏洞（附EXP及应对措施）", "url": "https://www.freebuf.com/news/165608.html", "time": "2018-03-16", "level": "红色标题", "num_look": 439238, "num_comment": 16, "author": "AngelaY", "tags": ["资讯"], "text": "ubuntu 最新版本（Ubuntu 16.04）存在本地提权漏洞。"}
{"title": "工具分享|GitHub的克隆工具Cl0neMast3r，轻松搞定各种测试", "url": "https://www.freebuf.com/sectool/164805.html", "time": "2018-03-16", "level": "金币+13", "num_look": 316156, "num_comment": 3, "author": "2cat", "tags": ["工具"], "text": "今天介绍一款让我们操作GitHub相关工作变的更简单的工具, GitHub的克隆工具，Cl0neMast3r。"}
{"title": "【已结束，更新回看地址】FB精品公开课 | HackPanda带你玩转无线遥控信号分析", "url": "https://www.freebuf.com/fevents/164699.html", "time": "2018-03-16", "level": "红色标题", "num_look": 807865, "num_comment": 21, "author": "FB客服", "tags": ["FreeBuf公开课", "活动"], "text": "本周五20:00，36W白帽大佬Cplushua强力推荐！带你玩转无线遥控信号！满满干货就等你来！"}
{"title": "分享一个好用的漏洞环境：Vulhub", "url": "https://www.freebuf.com/sectool/165062.html", "time": "2018-03-16", "level": "金币+13", "num_look": 966804, "num_comment": 16, "author": "秃顶的邪念", "tags": ["工具"], "text": "Vulhub是一个面向大众的开源漏洞靶场，无需docker知识，简单执行两条命令即可编译、运行一个完整的漏洞靶场镜像。"}
{"title": "为什么区块链最终可能会以侵蚀你的网络隐私而告终？", "url": "https://www.freebuf.com/articles/database/165417.html", "time": "2018-03-16", "level": "红色标题", "num_look": 423116, "num_comment": 11, "author": "Sphinx", "tags": ["区块链安全", "数据安全"], "text": "为什么区块链会最终侵蚀而不是保护你的隐私？问答社区Quora上哥伦比亚风险投资公司首席技术官Stan Hanks给出了答案。"}
{"title": "我真的需要第三方安全审计吗？", "url": "https://www.freebuf.com/articles/es/164330.html", "time": "2018-03-16", "level": "", "num_look": 386043, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["企业安全"], "text": "随着安全威胁以及数据泄露事件数量的不断增加，很多客户都希望通过增加额外的安全保护措施来让自己的机密信息得到更好的安全保障。"}
{"title": "PWN2OWN 2018黑客大赛第1天：Safari、VirtualBox、Edge破解成功", "url": "https://www.freebuf.com/news/165517.html", "time": "2018-03-16", "level": "", "num_look": 520329, "num_comment": 9, "author": "kylin1415", "tags": ["活动", "资讯"], "text": "主办方 Zero Day Initiative 已经为获奖者提供了金额为 162 000美元的奖金 和 16 点数奖励——参赛者进行了2次完全成功的破解尝试，共计获得3个苹果漏洞，2个 Oracle 漏洞和 2 个微软漏洞"}
{"title": "利用视觉模糊测试技术探索Z͌̈́̾a͊̈́l͊̿g̏̉͆o̾̚̚S̝̬ͅc̬r̯̼͇ͅi̼͖̜̭͔p̲̘̘̹͖t̠͖̟̹͓͇ͅ", "url": "https://www.freebuf.com/articles/web/165407.html", "time": "2018-03-16", "level": "", "num_look": 360962, "num_comment": 14, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "当Twitter宣布将推文字符限制从140提升到280之后，我就想弄清楚在这种新的字符限制下，如何使用Unicode字符来“搞事情”。"}
{"title": "一个小故事读懂Memcached漏洞", "url": "https://www.freebuf.com/vuls/164864.html", "time": "2018-03-16", "level": "现金奖励", "num_look": 725723, "num_comment": 20, "author": "进击的大熊2018", "tags": ["漏洞"], "text": "只要有人，就有恩怨，有恩怨，就有江湖。"}
{"title": "安全工具源码剖析之子域名收集", "url": "https://www.freebuf.com/sectool/163800.html", "time": "2018-03-16", "level": "现金奖励", "num_look": 273252, "num_comment": 7, "author": "cat01", "tags": ["工具"], "text": "俗话说的好，不会开发的白猫不是好白猫，想在安全界拿到高薪，掌握点开发技术那是必须滴。"}
{"title": "博通收购高通背后的中美信息安全博弈", "url": "https://www.freebuf.com/articles/neopoints/165359.html", "time": "2018-03-16", "level": "金币+15", "num_look": 456319, "num_comment": 6, "author": "高傲的蝴蝶酥", "tags": ["观点"], "text": "3月12日，博通收购高通案被美国总统特朗普叫停，世界上最大的科技公司收购就此终结。"}
{"title": "D-Link Service.Cgi远程命令执行漏洞从发现到入侵检测", "url": "https://www.freebuf.com/articles/terminal/164680.html", "time": "2018-03-16", "level": "现金奖励", "num_look": 393131, "num_comment": 7, "author": "cloud4986", "tags": ["终端安全"], "text": "本文以D-link 无线路由器615/645/815路由器service.cgi远程命令执行漏洞为例，给出了智能设备命令注入类漏洞的静态分析发现漏洞的方法。"}
{"title": "BUF早餐铺 | Pwn2Own黑客大赛：苹果Safari浏览器被破解入侵；Google将禁止与加密货币相关的所有广告内容；AMD官方回应Zen安全漏洞，怀疑故意泼脏水；Win10解除杀毒软件限制，不再影响系统更新", "url": "https://www.freebuf.com/news/165427.html", "time": "2018-03-16", "level": "", "num_look": 259964, "num_comment": 8, "author": "shidongqi", "tags": ["资讯"], "text": "这届315晚会没有太大的爆点，不过近期安全领域却又不少看点：AMD漏洞、黑客大赛……"}
{"title": "自古红蓝出CP，京东SRC出国游名额火热争夺中", "url": "https://www.freebuf.com/fevents/164377.html", "time": "2018-03-15", "level": "", "num_look": 380858, "num_comment": 6, "author": "漏洞盒子", "tags": ["活动"], "text": "内含几千元福利ヽ(ﾟ∀ﾟ)ﾒ(ﾟ∀ﾟ)ﾉ"}
{"title": "浅谈自动阅读新闻赚零用外挂", "url": "https://www.freebuf.com/articles/terminal/164291.html", "time": "2018-03-15", "level": "金币+15", "num_look": 424060, "num_comment": 7, "author": "Kawa103", "tags": ["终端安全"], "text": "有利益就会有需求，在这个薅羊毛盛行的时候怎会没有几个外挂呢？"}
{"title": "没钱谈挖漏洞有毛用？记我初次参与漏洞赏金项目赚大钱", "url": "https://www.freebuf.com/articles/others-articles/164027.html", "time": "2018-03-15", "level": "", "num_look": 598063, "num_comment": 12, "author": "clouds", "tags": ["其他"], "text": "在我初次参与到漏洞赏金项目的过程中，我就发现了10个漏洞，赚取了$19800美金，且听我慢慢说来。"}
{"title": "2017年Android恶意软件专题报告", "url": "https://www.freebuf.com/articles/paper/164398.html", "time": "2018-03-15", "level": "", "num_look": 317323, "num_comment": 2, "author": "360安全", "tags": ["安全报告"], "text": "本文为 360互联网安全中心和360烽火实验室出品的安全报告，聚焦并分析2017年 Android 恶意软件的详情。"}
{"title": "全面封杀：Google将禁止与加密货币相关的所有广告内容", "url": "https://www.freebuf.com/news/165352.html", "time": "2018-03-15", "level": "红色标题", "num_look": 233959, "num_comment": 10, "author": "kylin1415", "tags": ["资讯"], "text": "谷歌：我们每秒移除 100 个错误广告！Google 在 2017 年中阻止了 7900 万条恶意广告，移除超过 40 万个不安全的站点，删除了 6600 万个钓鱼广告……"}
{"title": "有人在偷窥？智能摄像头真的“聪明”吗？", "url": "https://www.freebuf.com/vuls/165335.html", "time": "2018-03-15", "level": "", "num_look": 335347, "num_comment": 335347, "author": "Alpha_h4ck", "tags": ["漏洞", "终端安全"], "text": "在这个物联网当道的时代，类似咖啡机、汽车、冰箱和灯泡这样的东西都开始接入互联网了，而且更加智能化了。而且很多城市甚至还出现了智能街道。智能摄像头其实早就已经出现了，比如说安全监控设备。"}
{"title": "追踪掠食者：地下灰产如何撸死创业公司？", "url": "https://www.freebuf.com/articles/neopoints/165013.html", "time": "2018-03-15", "level": "", "num_look": 386126, "num_comment": 7, "author": "wangyiyunyidun", "tags": ["观点"], "text": "互联网大公司周围，往往围着一群灰产从业者，他们是看不见的敌人，常常躲在暗处，伺机而动。"}
{"title": "315黑名单之夜，信息安全谁能逃过此劫？", "url": "https://www.freebuf.com/articles/neopoints/165270.html", "time": "2018-03-15", "level": "红色标题", "num_look": 601582, "num_comment": 11, "author": "shidongqi", "tags": ["特别企划", "观点"], "text": "iCloud隐私门、降频门，时隔五年，苹果会再度登上315黑榜吗？"}
{"title": "苹果监管不力，含挖矿插件的软件登录Mac App Store", "url": "https://www.freebuf.com/news/165153.html", "time": "2018-03-15", "level": "", "num_look": 164905, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "一款含有挖矿插件的软件，成功上架Mac App Store，不禁让人怀疑苹果的监管力度。"}
{"title": "BUF早餐铺 | 微软修复70多个漏洞；AMD出现13个严重漏洞；两会关注网络安全产业发展;上海警方集中打击侵犯公民个人信息，铲除网络“黑产”“黑市”", "url": "https://www.freebuf.com/news/165240.html", "time": "2018-03-15", "level": "", "num_look": 223192, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "东城渐觉风光好。縠皱波纹迎客棹。绿杨烟外晓寒轻，红杏枝头春意闹。"}
{"title": "WannaMine来了？警惕“永恒之蓝”挖矿长期潜伏", "url": "https://www.freebuf.com/articles/network/164869.html", "time": "2018-03-15", "level": "", "num_look": 705966, "num_comment": 7, "author": "深信服千里目安全实验室", "tags": ["网络安全"], "text": "近一段时间，大量用户反馈其内网很多主机存在蓝屏和卡顿现象。经过我们跟踪分析，发现这是利用“永恒之蓝”漏洞的新玩法，其最终目的不再是勒索，而是长期潜伏挖矿，默默赚外快。"}
{"title": "被人坑了？AMD处理器被“披露”13个严重漏洞，这波有猫腻", "url": "https://www.freebuf.com/news/165199.html", "time": "2018-03-14", "level": "红色标题", "num_look": 438559, "num_comment": 7, "author": "kylin1415", "tags": ["漏洞", "资讯"], "text": "发现这些漏洞的是来自以色列的安全实验室 CTS Labs ，他们在报告中描述了漏洞的细节信息，并直接发布了白皮书。AMD方面回应称，对这种传播方式他们表示担忧。"}
{"title": "Crashplan Windows客户端本地提权漏洞", "url": "https://www.freebuf.com/news/164257.html", "time": "2018-03-14", "level": "", "num_look": 198456, "num_comment": 1, "author": "secist", "tags": ["资讯"], "text": "本文是关于CrashPlan Windows客户端4.8.2.4版本，存在本地提权漏洞的相关通报及技术分析。"}
{"title": "如何在JSON端点上利用CSRF漏洞", "url": "https://www.freebuf.com/articles/web/164234.html", "time": "2018-03-14", "level": "", "num_look": 427503, "num_comment": 8, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "如果你想通过第三方攻击者控制的服务器在JSON端点利用一个CSRF漏洞的话，我给大家推荐一个名叫json-flash-csrf-poc的GitHub项目"}
{"title": "斑马网络技术有限公司招聘安全人才", "url": "https://www.freebuf.com/jobs/164726.html", "time": "2018-03-14", "level": "", "num_look": 217134, "num_comment": 6, "author": "sanwenkit", "tags": ["安全招聘"], "text": "斑马网络是阿里巴巴集团与上汽集团共同投资成立的合资公司，主要业务是为汽车全行业提供互联网汽车整体解决方案。"}
{"title": "基于Elastalert的安全告警剖析", "url": "https://www.freebuf.com/sectool/164591.html", "time": "2018-03-14", "level": "现金奖励", "num_look": 471456, "num_comment": 8, "author": "bigface", "tags": ["工具"], "text": "相信许多人都会使用ELK做日志收集系统，但是产生一个基于日志的“优秀”的安全告警确是一个难题。"}
{"title": "卡巴斯基研究员：平昌奥运会黑客甩锅给朝鲜", "url": "https://www.freebuf.com/news/164684.html", "time": "2018-03-14", "level": "", "num_look": 230987, "num_comment": 1, "author": "Sphinx", "tags": ["系统安全", "资讯"], "text": "或许研究人员们需要重新分析一下他们的溯源方法了。"}
{"title": "SpyNote V5.0图形化工具远程管理Android手机教程（图文教程+演示视频）", "url": "https://www.freebuf.com/sectool/164077.html", "time": "2018-03-14", "level": "现金奖励", "num_look": 1405299, "num_comment": 80, "author": "艾登——皮尔斯", "tags": ["工具"], "text": "这款工具因为其功能强大而闻名，且上线是比Metasploit生成的payload上线要稳定很多，还会自动弹出激活设备管理器窗口。"}
{"title": "Lazarus APT组织最新活动揭露", "url": "https://www.freebuf.com/articles/network/164511.html", "time": "2018-03-14", "level": "", "num_look": 412593, "num_comment": 3, "author": "腾讯电脑管家", "tags": ["网络安全"], "text": "Lazarus（T-APT-15）组织是来自朝鲜的APT组织，该组织长期对韩国、美国进行渗透攻击，此外还对全球的金融机构进行攻击，堪称全球金融机构的最大威胁。"}
{"title": "Buf早餐铺 | Mac应用商店发现挖矿应用，未经许可挖门罗币；中国黑客组织APT15利用新后门入侵英国政府服务提供商", "url": "https://www.freebuf.com/news/165071.html", "time": "2018-03-14", "level": "", "num_look": 202870, "num_comment": 1, "author": "Elaine_z", "tags": ["资讯"], "text": "律回岁晚冰霜少，春到人间草木知。便觉眼前生意满，东风吹水绿参差。"}
{"title": "近期“污水”（MuddyWater）APT组织攻击活动汇总", "url": "https://www.freebuf.com/articles/web/165061.html", "time": "2018-03-13", "level": "", "num_look": 463114, "num_comment": 6, "author": "腾讯电脑管家", "tags": ["WEB安全"], "text": "自2017年11月以来，国外APT组织“污水”发起了新的一轮网络攻击活动，此轮攻击活动的攻击目标扩展到塔吉克斯坦、巴基斯坦、土耳其等国，在这轮攻击活动中该APT组织对土耳其表现出强烈的关注。"}
{"title": "CNCERT 2017年我国联网智能设备安全情况报告", "url": "https://www.freebuf.com/articles/terminal/164866.html", "time": "2018-03-13", "level": "", "num_look": 321668, "num_comment": 4, "author": "CNCERT", "tags": ["终端安全"], "text": "近年来，联网智能设备安全事件时有发生，CNCERT对相关情况开展了持续的跟踪分析。"}
{"title": "大规模DDoS攻击现在针对谷歌，亚马逊和Pornhub", "url": "https://www.freebuf.com/news/164875.html", "time": "2018-03-13", "level": "红色标题", "num_look": 389455, "num_comment": 40, "author": "shidongqi", "tags": ["资讯"], "text": "在上周攻击Github 之后，这种新的增强型DDoS攻击又把目标瞄准了Google、亚马逊、Pornhub等主流网站。"}
{"title": "金山云2018实习岗位第一波，欢迎19届小鲜肉", "url": "https://www.freebuf.com/jobs/164526.html", "time": "2018-03-13", "level": "", "num_look": 232887, "num_comment": 8, "author": "爸爸的爸爸是爷爷", "tags": ["安全招聘"], "text": "金山云安珀实验室招人啦！研究员性质，接触各个方向，想要大牛带飞节奏的赶紧看过来！"}
{"title": "打造一款属于自己的远程管理软件（二）", "url": "https://www.freebuf.com/sectool/164385.html", "time": "2018-03-13", "level": "现金奖励", "num_look": 425428, "num_comment": 11, "author": "Mr极目楚天舒", "tags": ["工具"], "text": "前一篇文章介绍了软件的整体架构，接下来对被控端进行详细讲解，主要介绍被控端各个功能模块的关键技术以及开发过程中遇到的坑，希望对各位读者有借鉴作用。"}
{"title": "助考诈骗泛滥，黑客窃取4000万条个人信息成帮凶", "url": "https://www.freebuf.com/news/164769.html", "time": "2018-03-13", "level": "红色标题", "num_look": 405079, "num_comment": 4, "author": "shidongqi", "tags": ["数据安全", "资讯"], "text": "明明知道几乎不可能，但却总有不少人抱着一丝侥幸。正因如此，诈骗团伙才会持续盯着这个群体……"}
{"title": "病毒分析 | 一款史上最流氓的QQ营销病毒", "url": "https://www.freebuf.com/articles/terminal/164742.html", "time": "2018-03-13", "level": "现金奖励", "num_look": 483328, "num_comment": 17, "author": "安全豹", "tags": ["安全报告", "终端安全"], "text": "近日，金山毒霸安全实验室发现新型QQ营销病毒，感染到终端的网民无法退出QQ群，也无法举报群，遇到了堪称史上最为流氓的QQ营销病毒。"}
{"title": "网易云音乐PC客户端加密API逆向解析", "url": "https://www.freebuf.com/articles/web/164636.html", "time": "2018-03-13", "level": "现金奖励", "num_look": 693199, "num_comment": 14, "author": "Tan1993", "tags": ["WEB安全"], "text": "网上已经有大量的web端接口解析的方法了，但是对客户端的接口解析基本上找不到什么资料，本文主要分析网易云音乐PC客户端的API接口交互方式。"}
{"title": "BUF 早餐铺 | 黑客瞄准中东和非洲，利用路由器安装Slingshot间谍软件；土耳其网络服务商在流行软件中植入间谍软件和挖矿软件；大规模DDoS攻击现在针对谷歌，亚马逊和Pornhub", "url": "https://www.freebuf.com/news/164994.html", "time": "2018-03-13", "level": "", "num_look": 238405, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "大规模DDoS攻击现在针对谷歌，亚马逊和Pornhub；Avast 公开 CCleaner 黑客的新细节。"}
{"title": "BLEAH：一种用于“智能”设备的BLE扫描仪", "url": "https://www.freebuf.com/sectool/163012.html", "time": "2018-03-12", "level": "", "num_look": 307317, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["工具"], "text": "BLEAH的BLE扫描器专门针对的是智能设备，该工具基于Iah Harvey的bluepy代码库（Python）开发，并且易于使用。"}
{"title": "2018全国两会 | 加大网络安全产业投入，避免受制于人", "url": "https://www.freebuf.com/news/165225.html", "time": "2018-03-12", "level": "", "num_look": 458528, "num_comment": 458528, "author": "Akane", "tags": ["资讯"], "text": "新一届全国政协委员谈剑锋认为，全球进入智能科技时代，网络安全威胁复杂严峻，已经成为关系各国国家安全、经济发展和社会发展的重大战略性议题。"}
{"title": "2018全国两会 | 周鸿祎提案强化网络安全漏洞管理", "url": "https://www.freebuf.com/news/165250.html", "time": "2018-03-12", "level": "", "num_look": 161592, "num_comment": 2, "author": "Akane", "tags": ["资讯"], "text": "全国政协委员、360集团董事长兼CEO周鸿祎3月5日对外披露了2018全国“两会”提案，关注强化网络安全漏洞管理、完善网络安全人才培养体系和鼓励政企单位上报网络攻击事件。"}
{"title": "Nessus插件“武器化”教程", "url": "https://www.freebuf.com/vuls/164198.html", "time": "2018-03-12", "level": "", "num_look": 560281, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["漏洞"], "text": "在近期的一次内部渗透测试中，我们需要利用一个Java两级反序列化漏洞。在这篇文章中，我们将告诉大家如何改造Nessus插件。"}
{"title": "2018全国两会丨人大首次邀请第三方参与网络安全检查，1/4被检单位存在问题", "url": "https://www.freebuf.com/news/165218.html", "time": "2018-03-12", "level": "", "num_look": 111462, "num_comment": 1, "author": "Akane", "tags": ["资讯"], "text": "针对网络安全问题，十二届全国人大内司委委员郑功成表示，全国人大常委会高度重视网络安全的问题，首次尝试了邀请第三方有序地参与检查。"}
{"title": "安吉物流广招各类安全人才", "url": "https://www.freebuf.com/jobs/163987.html", "time": "2018-03-12", "level": "", "num_look": 158194, "num_comment": 5, "author": "jinjiang84", "tags": ["安全招聘"], "text": "安吉加加信息技术有限公司是上汽集团下属安吉汽车物流有限公司的信息化板块全资子公司，为集团数字化转型提供科技技术支撑。"}
{"title": "关于Memcached服务器反射攻击的情况通报（第2期）", "url": "https://www.freebuf.com/articles/system/164863.html", "time": "2018-03-12", "level": "", "num_look": 343605, "num_comment": 4, "author": "CNCERT", "tags": ["系统安全"], "text": "针对近期呈大幅上升趋势的Memcached服务器反射攻击事件，CNCERT已有序开展应急响应工作，并于3月3日向公众进行预警通报。"}
{"title": "任意用户密码重置（五）：重置凭证可暴破", "url": "https://www.freebuf.com/articles/web/164510.html", "time": "2018-03-12", "level": "现金奖励", "num_look": 640202, "num_comment": 8, "author": "yangyangwithgnu", "tags": ["WEB安全", "数据安全"], "text": "我把日常渗透过程中遇到的案例作了漏洞成因分析，这次，关注因重置凭证可暴破导致的任意用户密码重置问题。"}
{"title": "源码级剖析PHP 7.2.x GD拒绝服务漏洞", "url": "https://www.freebuf.com/vuls/163949.html", "time": "2018-03-12", "level": "现金奖励", "num_look": 376520, "num_comment": 4, "author": "chilau", "tags": ["漏洞"], "text": "导致这个问题的原因还是代码修改考虑不周全，引入了新的漏洞；没有对所有可能条件进行测试，所以从php 7.2.0一直到php 7.2.4都还存在问题。"}
{"title": "Hash拓展长度攻击原理剖析", "url": "https://www.freebuf.com/articles/database/164019.html", "time": "2018-03-12", "level": "现金奖励", "num_look": 498840, "num_comment": 2, "author": "婷儿小跟班✧", "tags": ["数据安全"], "text": "哈希长度扩展攻击(hash lengthextensionattacks)是指针对某些允许包含额外信息的加密散列函数的攻击手段。"}
{"title": "前端黑魔法之远程控制地址栏", "url": "https://www.freebuf.com/articles/web/164711.html", "time": "2018-03-12", "level": "现金奖励", "num_look": 544105, "num_comment": 14, "author": "phithon", "tags": ["WEB安全"], "text": "危险的target，一种有趣又危险的攻击方式，了解一下~"}
{"title": "Buf早餐铺 | 荷兰警方公布打击 Hansa 暗网的细节；McAfee收购vpn厂商TunnelBear；", "url": "https://www.freebuf.com/news/164648.html", "time": "2018-03-12", "level": "", "num_look": 219032, "num_comment": 1, "author": "Elaine_z", "tags": ["资讯"], "text": "春风暖，新气象"}
{"title": "快讯 | 币安网发全球通缉令，25万美元等值赏金追缉黑客", "url": "https://www.freebuf.com/news/164837.html", "time": "2018-03-11", "level": "红色标题", "num_look": 321639, "num_comment": 10, "author": "shidongqi", "tags": ["资讯"], "text": "2018年3月11日晚，币安网正式下发通缉令，25万美元等值赏金全球追缉黑客。"}
{"title": "知名软件ADSafe暗藏恶意代码，从众多网站劫持流量", "url": "https://www.freebuf.com/articles/paper/164822.html", "time": "2018-03-11", "level": "", "num_look": 472603, "num_comment": 26, "author": "火绒安全", "tags": ["安全报告"], "text": "日前，火绒安全团队发现\"ADSafe净网大师\"、\"清网卫士\"、 \"广告过滤大师\"等多款知名软件暗藏恶意代码，偷偷劫持用户流量。"}
{"title": "窃取SSH凭证的另一种方法", "url": "https://www.freebuf.com/articles/system/163016.html", "time": "2018-03-11", "level": "", "num_look": 328134, "num_comment": 3, "author": "secist", "tags": ["系统安全"], "text": "我将为大家介绍另外一种获取ssh密码的方法。这种方法是我在ChokePoint找到的。"}
{"title": "通过补丁比对分析发现HPE IMC系统代码执行漏洞（附Metasploit测试模块）", "url": "https://www.freebuf.com/articles/database/163196.html", "time": "2018-03-11", "level": "", "num_look": 302147, "num_comment": 2, "author": "clouds", "tags": ["数据安全"], "text": "今天，我们要来说的就是，通过身份验证绕过漏洞结合用户输入的表达式注入漏洞，形成对HP智能管理服务器（ HPE IMC）系统的远程代码执行。"}
{"title": "信息收集利器：ZoomEye", "url": "https://www.freebuf.com/sectool/163782.html", "time": "2018-03-11", "level": "金币+15", "num_look": 876135, "num_comment": 9, "author": "Fly鹏程万里", "tags": ["工具"], "text": "ZoomEye是一款针对网络空间的搜索引擎，收录了互联网空间中的设备、网站及其使用的服务或组件等信息。"}
{"title": "陌陌科技诚聘安全各方面高级人才", "url": "https://www.freebuf.com/jobs/164297.html", "time": "2018-03-11", "level": "", "num_look": 182707, "num_comment": 2, "author": "andy110", "tags": ["安全招聘"], "text": "MOMO是陌陌（NASDAQ：MOMO）推出的一款基于地理位置的开放式移动视频社交应用，是目前中国最大的泛社交泛娱乐平台。"}
{"title": "打造一款属于自己的远程管理软件（一）", "url": "https://www.freebuf.com/sectool/164028.html", "time": "2018-03-11", "level": "现金奖励", "num_look": 653868, "num_comment": 20, "author": "Mr极目楚天舒", "tags": ["工具"], "text": "鉴于网上下载的远程控制软件大多都被不同程度地植入后门，于是萌生了自己打造一款远控的想法。"}
{"title": "CSS-Keylogger：一个利用CSS实现的Chrome键盘记录插件", "url": "https://www.freebuf.com/sectool/163777.html", "time": "2018-03-10", "level": "", "num_look": 278634, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫CSS-Keylogger的键盘记录工具，其实严格来说，它应该是一款Chrome插件，工具的使用还需要搭配Express服务器。"}
{"title": "代码签名证书买卖黑市的真实情况", "url": "https://www.freebuf.com/news/163353.html", "time": "2018-03-10", "level": "", "num_look": 239282, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["WEB安全", "资讯"], "text": "目前地下网络犯罪市场买卖代码签名证书的情况越来越频繁了，而这些伪造的代码签名证书可以帮助攻击者让自己的恶意软件绕过安全防护产品的检测。"}
{"title": "以“威胁应对”为中心,看企业信息安全能力建设", "url": "https://www.freebuf.com/articles/es/164796.html", "time": "2018-03-10", "level": "", "num_look": 428804, "num_comment": 5, "author": "willhuang", "tags": ["企业安全"], "text": "笔者做了多年的安全服务，这几年集中精力在做安全分析类引擎或产品，关于大数据时代信息安全的三点个人看法，作为引言。"}
{"title": "菜鸟安全部诚聘人才", "url": "https://www.freebuf.com/jobs/164485.html", "time": "2018-03-10", "level": "", "num_look": 299475, "num_comment": 13, "author": "菜鸟安全应急响应中心", "tags": ["安全招聘"], "text": ""}
{"title": "详细分析使用Certutil解码的Office恶意软件", "url": "https://www.freebuf.com/articles/web/164242.html", "time": "2018-03-10", "level": "", "num_look": 225858, "num_comment": 2, "author": "兰云科技银河实验室", "tags": ["WEB安全"], "text": "使用certutil进行解码的office恶意软件通过OLE机制落地,通过BASE64编码，然后通过调用certutil来进行解码恶意软件，并通过宏来启动恶意软件。"}
{"title": "【FB TV】一周「BUF大事件」：比特币跳崖式暴跌，看黑客去中心化攻击；苹果技术顾问窃取用户信息并恐吓威胁；上百款吃鸡游戏辅助被植入挖矿木马", "url": "https://www.freebuf.com/video/164746.html", "time": "2018-03-10", "level": "红色标题", "num_look": 266624, "num_comment": 266624, "author": "willhuang", "tags": ["视频"], "text": "本周BUF大事件还是为大家带来了新鲜有趣的安全新闻，比特币跳崖式暴跌，看黑客去中心化攻击；苹果技术顾问窃取用户信息并恐吓威胁；上百款吃鸡游戏辅助被植入挖矿木马"}
{"title": "福利 | 获取HITB安全峰会门票的最全姿势（阿姆斯特丹）", "url": "https://www.freebuf.com/fevents/164778.html", "time": "2018-03-09", "level": "红色标题", "num_look": 232970, "num_comment": 26, "author": "FB客服", "tags": ["活动"], "text": "听说你们想要国际安全会议的门票？"}
{"title": "鸡肋CSRF和Self-XSS组合的变废为宝", "url": "https://www.freebuf.com/articles/web/164069.html", "time": "2018-03-09", "level": "现金奖励", "num_look": 843911, "num_comment": 31, "author": "三只小潴", "tags": ["WEB安全"], "text": "昨天同事问了我一个问题：登录页面的CSRF有用么？ 我也没怎么想，就回了句：没用。"}
{"title": "黑客竟然又更新了Windows Installer的利用方法", "url": "https://www.freebuf.com/articles/system/163830.html", "time": "2018-03-09", "level": "", "num_look": 327152, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "近期，我们发现又有攻击者开始利用漏洞CVE-2017-11882来实施攻击了，但这一次他们使用的是一种非常见的安装方法。"}
{"title": "思科产品中存在严重硬编码密码漏洞和Java反序列化漏洞", "url": "https://www.freebuf.com/news/164672.html", "time": "2018-03-09", "level": "", "num_look": 264905, "num_comment": 3, "author": "AngelaY", "tags": ["资讯"], "text": "昨天，思科发布了 22 条安全公告，其中包括两条重要的修复方案：修复一个硬编码密码漏洞（ CVE-2018-0141）和一个 Java 反序列化漏洞（CVE-2018-0147）。"}
{"title": "SQL注入 | 9种绕过Web应用程序防火墙的方式", "url": "https://www.freebuf.com/articles/web/163783.html", "time": "2018-03-09", "level": "红色标题", "num_look": 804770, "num_comment": 16, "author": "secist", "tags": ["WEB安全"], "text": "Web应用程序防火墙（WAF）的主要作用是过滤，监控和阻止各类进出Web应用程序的HTTP流量。"}
{"title": "平安集团银河安全实验室招聘小伙伴啦", "url": "https://www.freebuf.com/jobs/163465.html", "time": "2018-03-09", "level": "", "num_look": 213971, "num_comment": 1, "author": "银河实验室", "tags": ["安全招聘"], "text": "银河实验室是集团信息安全平台部下的一个研究团队，主要从事技术的研究和安全测试工作。"}
{"title": "挖洞思路 | 账号攻击的几种常见手法", "url": "https://www.freebuf.com/vuls/164066.html", "time": "2018-03-09", "level": "现金奖励", "num_look": 575476, "num_comment": 31, "author": "yangyangwithgnu", "tags": ["漏洞"], "text": "web 安全事件中，账号，通常是呈现给攻击者的第一接触点，与账号相关的功能若存在缺陷，攻击者可以此获取关键信息和重要功能。"}
{"title": "WAF开发之Cookie安全防护", "url": "https://www.freebuf.com/articles/web/164232.html", "time": "2018-03-09", "level": "金币+15", "num_look": 330952, "num_comment": 16, "author": "chenjc", "tags": ["WEB安全"], "text": "Cookie安全防护功能的核心在于，数据的加密解密都在WAF上进行，密钥无需存储在前端，在没有密钥的情况下，可以认为密文是无法破解的。"}
{"title": "别贪小便宜，40多款廉价安卓手机预装银行恶意软件", "url": "https://www.freebuf.com/news/164101.html", "time": "2018-03-09", "level": "红色标题", "num_look": 440010, "num_comment": 12, "author": "shidongqi", "tags": ["资讯"], "text": "研究人员发现，目前在售的超过40款廉价Android智能手机感染了Triada.231银行木马，并且公布了详细的手机型号清单。"}
{"title": "BUF早餐铺 | 苹果正式回应技术顾问入侵用户账户一事：不是临时工；币安网疑遭黑客入侵致使比特币大跌10%；谷歌72位量子计算机来了！比特币有可能被破解", "url": "https://www.freebuf.com/news/164613.html", "time": "2018-03-09", "level": "", "num_look": 200349, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "币安网一事闹得沸沸扬扬，而此前苹果技术顾问入侵用户iCloud账户一事也终于等到了官方回应，快来看看吧~"}
{"title": "两个Memcached DDoS攻击PoC发布", "url": "https://www.freebuf.com/news/164576.html", "time": "2018-03-08", "level": "", "num_look": 399511, "num_comment": 14, "author": "Sphinx", "tags": ["资讯"], "text": "Memcached DDoS攻击 - 全球最大的DDoS攻击达到1.7Tbps后几天，有人公布了两个针对Memcached放大攻击的PoC代码。"}
{"title": "比特币遭遇跳崖式暴跌，来看黑客导演的这场烧脑大片（全解读）", "url": "https://www.freebuf.com/news/164565.html", "time": "2018-03-08", "level": "红色标题", "num_look": 625335, "num_comment": 10, "author": "shidongqi", "tags": ["特别企划", "资讯"], "text": "想着今天早上起来，应该是关于3.8妇女节的各种文案刷屏，却又一次被比特币抢了头条……"}
{"title": "百度安全的OpenRASP项目，究竟是什么？", "url": "https://www.freebuf.com/articles/web/164413.html", "time": "2018-03-08", "level": "", "num_look": 607858, "num_comment": 17, "author": "谢幺", "tags": ["WEB安全"], "text": "OpenRASP，看到这个名字时，估计很多人也像我一样升腾起不明觉厉的感觉。"}
{"title": "HELK：一款具有高级分析功能的漏洞挖掘平台", "url": "https://www.freebuf.com/sectool/163286.html", "time": "2018-03-08", "level": "", "num_look": 384776, "num_comment": 11, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫HELK的工具，它是一款具有高级分析能力的Hunting ELK（Elasticsearch, Logstash, Kibana）。"}
{"title": "破解iPhone竟然是为了公众安全？", "url": "https://www.freebuf.com/news/164349.html", "time": "2018-03-08", "level": "红色标题", "num_look": 178619, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "破解iPhone是为了公众安全？想知道库克怎么看……"}
{"title": "物联网黑客：如何再次打破智能家居", "url": "https://www.freebuf.com/articles/terminal/163829.html", "time": "2018-03-08", "level": "", "num_look": 328079, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "随着科技的发展，越来越多的用户开始使用物联网设备了，而且用户在购买这些设备时，往往会选择功能更先进且更丰富的产品。"}
{"title": "谷歌72位量子计算机面世，比特币还安全吗？", "url": "https://www.freebuf.com/news/164536.html", "time": "2018-03-08", "level": "红色标题", "num_look": 310066, "num_comment": 3, "author": "AngelaY", "tags": ["资讯"], "text": "在今年于洛杉矶举办的美国物理学会年会上，谷歌放了一个大招，发布全球首个 72 位量子比特通用的量子计算机 Bristlecon。"}
{"title": "深信服深圳总部新攻防实验室急聘英才", "url": "https://www.freebuf.com/jobs/162699.html", "time": "2018-03-08", "level": "", "num_look": 190770, "num_comment": 9, "author": "suifeng-刘军", "tags": ["安全招聘"], "text": "深信服是国内最大的企业级安全厂商之一，致力于提供创新的网络安全建设解决方案。"}
{"title": "FreeBuf 2018年企业安全月报（二月刊）", "url": "https://www.freebuf.com/news/164457.html", "time": "2018-03-08", "level": "", "num_look": 295229, "num_comment": 1, "author": "Sphinx", "tags": ["企业安全", "资讯"], "text": "“20年建立起的声誉，几分钟的网络事件就可以完全毁掉。”"}
{"title": "基于MetaSploit内网穿透渗透测试", "url": "https://www.freebuf.com/news/163943.html", "time": "2018-03-08", "level": "金币+8", "num_look": 781003, "num_comment": 9, "author": "网络安全通", "tags": ["系统安全", "网络安全"], "text": "自己在无聊捣鼓windows渗透的时候想到以往都是基于内网渗透，想要更加自由地进行渗透就需要内网穿透实现可以任意控制网段主机，同时也将端口转发作为自己的跳板。"}
{"title": "DedeCMS V5.7 SP2后台存在代码执行漏洞", "url": "https://www.freebuf.com/vuls/164035.html", "time": "2018-03-08", "level": "金币+8", "num_look": 1049732, "num_comment": 20, "author": "风炫520", "tags": ["漏洞"], "text": "DedeCMS V5.7 SP2版本中tpl.php存在代码执行漏洞，攻击者可利用该漏洞在增加新的标签中上传木马，获取webshell。"}
{"title": "PaloAlto远程命令执行漏洞关键技术分析终篇（附POC ）", "url": "https://www.freebuf.com/vuls/164091.html", "time": "2018-03-08", "level": "现金奖励", "num_look": 361165, "num_comment": 8, "author": "xmwanth", "tags": ["漏洞"], "text": "对Palo Alto防火墙产品未授权远程代码执行漏洞（CVE-2017-15944 ）中SESSION设置、任意目录创建、命令执行漏洞的技术分析，之前对该漏洞认证绕过部分进行了介绍，这篇文章是该漏洞的后续部分。"}
{"title": "BUF早餐铺 | 谷歌3月修复安卓中大量漏洞；全球半数邮件服务器受漏洞影响；Nike网站出现漏洞；用户称苹果技术顾问窃取用户信息并敲诈勒索", "url": "https://www.freebuf.com/news/164472.html", "time": "2018-03-08", "level": "", "num_look": 211349, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "广大女性的节日，爱心早餐是个好礼物哦。女同胞们节日快乐！"}
{"title": "卡巴斯基实验室提高其漏洞奖励金额至100,000美元", "url": "https://www.freebuf.com/news/164397.html", "time": "2018-03-07", "level": "", "num_look": 231658, "num_comment": 3, "author": "Elaine_z", "tags": ["系统安全", "资讯"], "text": "卡巴斯基实验室本周宣布将延长其漏洞奖励计划，并为部分产品中严重级别的漏洞奖励金额提升至100,000美元。"}
{"title": "细思极恐！苹果技术顾问私自窃取用户信息并恐吓威胁", "url": "https://www.freebuf.com/articles/terminal/164447.html", "time": "2018-03-07", "level": "红色标题", "num_look": 522917, "num_comment": 9, "author": "shidongqi", "tags": ["特别企划", "终端安全"], "text": "拨打苹果公司客服热线咨询，竟然遭到苹果技术顾问侵入自己的iCloud账号，并窃取大量个人信息，以此对其威胁恐吓。"}
{"title": "ODAT：一款专门用于Oracle渗透的工具", "url": "https://www.freebuf.com/sectool/163627.html", "time": "2018-03-07", "level": "", "num_look": 316748, "num_comment": 316748, "author": "secist", "tags": ["工具"], "text": "ODAT（Oracle Database Attacking Tool）是一款开源的渗透测试工具，主要用于测试远端oracle数据库的安全性。"}
{"title": "经验分享 | JavaScript反调试技巧", "url": "https://www.freebuf.com/articles/system/163579.html", "time": "2018-03-07", "level": "", "num_look": 532533, "num_comment": 8, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "对于JavaScript来说，你只需要花一点时间进行调试和分析，你就能够了解到JavaScript代码段的功能逻辑。"}
{"title": "山东云天招聘渗透测试工程师", "url": "https://www.freebuf.com/jobs/163359.html", "time": "2018-03-07", "level": "", "num_look": 216741, "num_comment": 4, "author": "山东云天安全技术有限公司", "tags": ["安全招聘"], "text": "山东云天安全技术有限公司（简称云天安全），坐落于济南中央商务区。总公司设在山东济南，在北京、泰安设有大数据网络安全态势感知中心和研发中心，其中占地近百亩的云天安全学院正在建设中。"}
{"title": "DevSecOps现状：理论叫得响，实践待发展", "url": "https://www.freebuf.com/news/163838.html", "time": "2018-03-07", "level": "", "num_look": 270712, "num_comment": 3, "author": "AngelaY", "tags": ["观点", "资讯"], "text": "近年来，DevSecOps 的理念越叫越响，业内似乎对此都喜闻乐见，但是 DevSecOps 在具体实践上还有待发展。"}
{"title": "血族手游Lua脚本及资源文件解密", "url": "https://www.freebuf.com/articles/terminal/163765.html", "time": "2018-03-07", "level": "金币+8", "num_look": 402974, "num_comment": 2, "author": "网络安全通", "tags": ["终端安全"], "text": "之前一直和朋友在玩手游血族。有一天朋友问我能不能把里面某个角色的立绘拿下来。当时没多想就答应了，以为只要解压找到图片就行了。"}
{"title": "Web安全学习：如何自我定位与制定学习计划", "url": "https://www.freebuf.com/articles/web/163786.html", "time": "2018-03-07", "level": "金币+8", "num_look": 601265, "num_comment": 15, "author": "shellytear", "tags": ["WEB安全"], "text": "通过本篇文章，您可以了解一个web安全从业人员所具备的大致知识面，同时我也制定了一个循序渐进的学习计划，用以帮您找准自己的定位，并可以自己制定适合自己的学习计划。"}
{"title": "【安全大咖说】Code Blue安全峰会创始人篠田佳奈专访", "url": "https://www.freebuf.com/articles/people/164197.html", "time": "2018-03-07", "level": "红色标题", "num_look": 335676, "num_comment": 6, "author": "Elaine_z", "tags": ["人物志", "活动"], "text": "基于多年的行业经验和数次信息安全国际会议的组织经历，如 Black Hat Japan，APWG等等，她在日本创立了全新的国际化信息安全会议“Code Blue”。"}
{"title": "Buf早餐铺 | ComboJack木马替换剪贴板上的加密货币地址；Kali Linux在Win 10商店上架，但被系统检测为安全威胁；", "url": "https://www.freebuf.com/news/164247.html", "time": "2018-03-07", "level": "", "num_look": 183069, "num_comment": 6, "author": "Elaine_z", "tags": ["资讯"], "text": "加密货币勒索，数据泄露……来吃个唐纳滋压压惊！"}
{"title": "美大使馆遭遇声波攻击，浙大WitAwards获奖团队协助调查", "url": "https://www.freebuf.com/articles/wireless/164318.html", "time": "2018-03-06", "level": "红色标题", "num_look": 636583, "num_comment": 10, "author": "AngelaY", "tags": ["其他", "无线安全"], "text": "根据外媒报道，至少 24 名美国驻古巴大使馆工作人员在 2016 年 12 月到 2017 年 8 月期间听到过尖锐声音，并受声波影响而受伤。"}
{"title": "LSB-Steganography：教你如何使用最低有效位将文件隐写到图像中", "url": "https://www.freebuf.com/sectool/163352.html", "time": "2018-03-06", "level": "", "num_look": 535260, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["工具", "数据安全"], "text": "今天给大家介绍的是一个名叫LSB-Steganography的Python工具，该工具可以使用最低有效位技术来将文件隐写到图像之中。"}
{"title": "利用MySQL UDF进行的一次渗透测试", "url": "https://www.freebuf.com/articles/system/163144.html", "time": "2018-03-06", "level": "", "num_look": 682618, "num_comment": 14, "author": "secist", "tags": ["数据安全", "系统安全"], "text": "最近，我对某金融机构做渗透时发现他们拥有自己的内网，并且后端使用的是MySQL 5.7 64-bit。根据以往的经验，我的合作伙伴大多都使用的是MSSQL，因此在我看来这是一个非常罕见的场景。"}
{"title": "斗象科技2018诚招安全人才（上海、北京、深圳），了解一下", "url": "https://www.freebuf.com/jobs/163451.html", "time": "2018-03-06", "level": "", "num_look": 372743, "num_comment": 12, "author": "FB客服", "tags": ["安全招聘"], "text": "斗象科技成立于2014年，是国内领先的新一代互联网安全服务商，总部位于中国上海，在北京、深圳设有分支机构。旗下有FreeBuf、漏洞盒子、网藤智能安全三大业务品牌。"}
{"title": "思科2018年度安全报告", "url": "https://www.freebuf.com/articles/paper/164240.html", "time": "2018-03-06", "level": "", "num_look": 365980, "num_comment": 4, "author": "shidongqi", "tags": ["安全报告"], "text": "在2018年，网络攻击的守护者红队应该做好迎接新的、能够自我繁殖和传播的基于网络的威胁。"}
{"title": "任意用户密码重置（四）：重置凭证未校验", "url": "https://www.freebuf.com/articles/web/164090.html", "time": "2018-03-06", "level": "现金奖励", "num_look": 678264, "num_comment": 14, "author": "yangyangwithgnu", "tags": ["WEB安全", "数据安全"], "text": "我把日常渗透过程中遇到的案例作了漏洞成因分析，这次，关注因重置凭证未校验导致的任意用户密码重置问题。"}
{"title": "RSA史上最强剖析，从小白变大神，附常用工具使用方法及CTF中RSA典型例题", "url": "https://www.freebuf.com/sectool/163781.html", "time": "2018-03-06", "level": "现金奖励", "num_look": 737609, "num_comment": 10, "author": "婷儿小跟班✧", "tags": ["工具"], "text": "RSA加解密类题型是ctf题中常见题型，考点比较广泛，涉及各种攻击手法，以前在这栽了不少跟头，这里好好总结一下。包括RSA加密原理，RSA常用工具使用方法及下载地址，RSA典型例题。"}
{"title": "届届“招黑”的奥运会，黑客在也蠢蠢欲动", "url": "https://www.freebuf.com/articles/neopoints/164044.html", "time": "2018-03-06", "level": "金币+8", "num_look": 284608, "num_comment": 3, "author": "高傲的蝴蝶酥", "tags": ["观点"], "text": "为什么一直招黑？"}
{"title": "经验分享 | 一句话免杀编写思路", "url": "https://www.freebuf.com/articles/system/164076.html", "time": "2018-03-06", "level": "现金奖励", "num_look": 543102, "num_comment": 7, "author": "crhua", "tags": ["系统安全"], "text": "在渗透测试时，我们向网站服务器写入一句话webshell时，往往会被某狗，某锁，某卫士拦截，导致我们拿不下shell。"}
{"title": "BUF早餐铺 | EQUIFAX又增加了受害者名单；40多款廉价安卓手机预装银行恶意软件；研究人员发现4G LTE网络协议漏洞", "url": "https://www.freebuf.com/news/164172.html", "time": "2018-03-06", "level": "", "num_look": 176796, "num_comment": 2, "author": "Sphinx", "tags": ["资讯"], "text": "EQUIFAX又增加了受害者名单；40多款廉价安卓手机预装银行恶意软件；研究人员发现4G LTE网络协议漏洞；spectre 变种出现，可以从intel sgx中提取数据。"}
{"title": "2018奇虎360企业安全华南研发基地（珠海）新春诚聘", "url": "https://www.freebuf.com/jobs/163077.html", "time": "2018-03-06", "level": "", "num_look": 230955, "num_comment": 12, "author": "奇安信-华南基地", "tags": ["安全招聘"], "text": "360 企业安全集团中国企业级网络安全市场的领军者，是专注于为政府和企业提供新一代网络安全产品和服务的综合型集团公司。"}
{"title": "阳春三月 | 菜鸟SRC安全沙龙上海站免费报名啦", "url": "https://www.freebuf.com/fevents/164143.html", "time": "2018-03-05", "level": "", "num_look": 179781, "num_comment": 2, "author": "FB客服", "tags": ["活动"], "text": "CNSRC安全沙龙上海站本周六（3月10日）即将温暖上线。"}
{"title": "研究人员发现4G LTE网络协议漏洞", "url": "https://www.freebuf.com/news/164109.html", "time": "2018-03-05", "level": "", "num_look": 684165, "num_comment": 6, "author": "kylin1415", "tags": ["漏洞", "资讯"], "text": "四名美国大学的研究人员发现了 4G LTE 协议中的问题，利用这个漏洞可以进行虚假信息的编造，还可以监听用户和地址追踪。"}
{"title": "高清无码！比鬼片还刺激！且听“诡娃”远控的这首惊魂曲", "url": "https://www.freebuf.com/articles/system/163988.html", "time": "2018-03-05", "level": "红色标题", "num_look": 463123, "num_comment": 13, "author": "360安全", "tags": ["系统安全"], "text": "木马不好好盗号，出来吓人就过分了。内含重口味恐怖图片，胆小者慎入！！！"}
{"title": "CNCERT关于利用Memcached服务器实施反射DDoS攻击的情况通报", "url": "https://www.freebuf.com/articles/network/164144.html", "time": "2018-03-05", "level": "", "num_look": 316659, "num_comment": 8, "author": "CNCERT", "tags": ["网络安全"], "text": "近日，利用memcached服务器实施反射DDOS攻击的事件呈大幅上升趋势。针对这一情况，CNCERT第一时间开展跟踪分析。"}
{"title": "GlobeImposter勒索软件详细分析报告", "url": "https://www.freebuf.com/articles/paper/163921.html", "time": "2018-03-05", "level": "", "num_look": 335000, "num_comment": 2, "author": "江民安全实验室", "tags": ["安全报告"], "text": "近日勒索病毒GlobeImposter众多变种开始在国内进行传播，各个变种加密文件后修改的文件后缀名也各不相同，主要是通过垃圾邮件进行传播。"}
{"title": "看我如何使用Hashcat暴力破解Linux磁盘加密", "url": "https://www.freebuf.com/articles/database/163354.html", "time": "2018-03-05", "level": "", "num_look": 517966, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["数据安全"], "text": "在这篇文章中，我将跟大家介绍如何使用hashcat来暴力破解LUK卷，并告诉大家如何挂载一个LUK分区，以及如何在解密之后制作磁盘镜像。"}
{"title": "代码分享|使用Python和Tesseract来识别图形验证码", "url": "https://www.freebuf.com/sectool/163621.html", "time": "2018-03-05", "level": "现金奖励", "num_look": 964954, "num_comment": 12, "author": "ipenox", "tags": ["WEB安全", "工具"], "text": "各位在企业中做Web漏洞扫描或者渗透测试的朋友，可能会经常遇到需要对图形验证码进行程序识别的需求。"}
{"title": "Socks Proxy如何让你更安全的浏览互联网", "url": "https://www.freebuf.com/sectool/161848.html", "time": "2018-03-05", "level": "现金奖励", "num_look": 599396, "num_comment": 13, "author": "yuegui_2004", "tags": ["工具"], "text": "在不使用VPN的情况下如何保证在浏览网页数据的时候更安全更隐私呢？Socks proxy和SSH将会给你答案。"}
{"title": "BUF早餐铺 | 俄罗斯APT28侵入德国外交及内政部网络长达一年；AdBlock添加本地缓存JS库功能，可避免浏览跟踪；GitHub遭受有史以来最严重DDoS攻击", "url": "https://www.freebuf.com/news/163926.html", "time": "2018-03-05", "level": "", "num_look": 194663, "num_comment": 2, "author": "Elaine_z", "tags": ["资讯"], "text": "一大批数据泄漏事件正在袭来……"}
{"title": "Injectify：一款执行MiTM攻击的工具", "url": "https://www.freebuf.com/sectool/163291.html", "time": "2018-03-04", "level": "", "num_look": 328804, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍一款功能强大的高级中间人攻击工具，该工具名叫Injectify，而这款工具将可以帮助我们轻松地对目标网站进行渗透测试。"}
{"title": "使用Egressbuster测试防火墙出站规则", "url": "https://www.freebuf.com/sectool/163356.html", "time": "2018-03-04", "level": "", "num_look": 253407, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "我已经使用Egressbuster有段时间了。从我的使用体验来讲Egressbuster非常的实用，因此我想在这里把它介绍给大家。"}
{"title": "安全智能分析平台反黑产保护案例分享", "url": "https://www.freebuf.com/articles/paper/164016.html", "time": "2018-03-04", "level": "", "num_look": 151384, "num_comment": 151384, "author": "瀚思科技", "tags": ["安全报告"], "text": "当今时代互联网给人们生活带来了越来越多的便利，同时信息的数字化也给企业带来了巨大的机遇，但这其中也暗藏风险， 网络中的“黑金”产业也渗透在企业信息化的变革过程中。"}
{"title": "Pwnable.tw刷题之Silverbullet破解过程分享", "url": "https://www.freebuf.com/news/162929.html", "time": "2018-03-04", "level": "现金奖励", "num_look": 224988, "num_comment": 2, "author": "pu111p", "tags": [], "text": "之前加了学校的ctf社团之后开始学习binary方面的知识，跟着教程走完一遍之后学长推荐了pwnable来刷题，这篇文章就是pwnable上silverbullet的详细破解过程。"}
{"title": "为防止用户被假冒，Facebook正式部署人脸识别功能", "url": "https://www.freebuf.com/news/163633.html", "time": "2018-03-04", "level": "", "num_look": 184313, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "Facebook已经开始面向全球用户推出人脸识别功能，不过由于当地法律限制，欧盟和加拿大的用户将不包括在内。"}
{"title": "Winpayloads：不可检测的Windows Payload生成工具", "url": "https://www.freebuf.com/sectool/163013.html", "time": "2018-03-03", "level": "", "num_look": 227910, "num_comment": 7, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Winpayloads是一款Payload生成工具，它使用了metasploits meterpreter Shellcode。"}
{"title": "LuLu：一款macOS的开源防火墙", "url": "https://www.freebuf.com/sectool/162989.html", "time": "2018-03-03", "level": "", "num_look": 289939, "num_comment": 4, "author": "secist", "tags": ["工具"], "text": "LuLu是一款macOS下的免费且开源防火墙，其主要用于阻止未经授权的（传出）网络流量，除非用户明确允许。"}
{"title": "5分钟教程：如何通过UART获得root权限", "url": "https://www.freebuf.com/geek/163312.html", "time": "2018-03-03", "level": "", "num_look": 442288, "num_comment": 8, "author": "Alpha_h4ck", "tags": ["极客"], "text": "在这篇文章中，我们将讨论如何通过UART来与TP-Link WR841N (v9.0)进行连接，整个实际动手操作时间大约在五分钟左右。"}
{"title": "【FB TV】一周「BUF大事件」：国内两家医院连遭比特币勒索；史上首个核弹级DDoS攻击正在荼毒全球；中国内地iCloud服务转由“云上贵州”负责运营", "url": "https://www.freebuf.com/video/164051.html", "time": "2018-03-03", "level": "红色标题", "num_look": 333016, "num_comment": 4, "author": "willhuang", "tags": ["视频"], "text": "国内两家医院连遭比特币勒索；史上首个核弹级DDoS攻击正在荼毒全球；中国内地iCloud服务转由“云上贵州”负责运营"}
{"title": "微软联手英特尔，在Windows更新中推送Sepctre微代码升级", "url": "https://www.freebuf.com/news/163968.html", "time": "2018-03-03", "level": "", "num_look": 224222, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "微软今天表示，将采用英特尔的 CPU 微码更新，修复 Spectre v2 漏洞，并通过 Windows 更新包将这些微代码更新发送给用户。"}
{"title": "Adobe Acrobat Reader中存在远程代码执行漏洞", "url": "https://www.freebuf.com/news/163795.html", "time": "2018-03-03", "level": "", "num_look": 343451, "num_comment": 343451, "author": "kylin1415", "tags": ["漏洞", "资讯"], "text": "思科 Talos 研究员近期披露了在 Adobe Acrobat Reader DC 中的远程代码执行漏洞。"}
{"title": "漏洞盒子豪华出境游，我们又来啦！", "url": "https://www.freebuf.com/fevents/164037.html", "time": "2018-03-02", "level": "红色标题", "num_look": 206530, "num_comment": 14, "author": "FB客服", "tags": ["活动"], "text": "这个四月，我们与重磅SRC合作！这次出境游给最精英的白帽子比去年更优的出国体验！"}
{"title": "Github遭遇史上最大1.35 Tbps DDoS攻击", "url": "https://www.freebuf.com/news/164009.html", "time": "2018-03-02", "level": "红色标题", "num_look": 531749, "num_comment": 21, "author": "Sphinx", "tags": ["资讯"], "text": "最大代码分发平台Github在周三遭受了一系列大规模分布式拒绝服务（DDoS）攻击。"}
{"title": "战斗民族黑客入侵德国政府网络，并植入恶意软件", "url": "https://www.freebuf.com/news/163945.html", "time": "2018-03-02", "level": "", "num_look": 218237, "num_comment": 4, "author": "shidongqi", "tags": ["资讯"], "text": "德国政府证实，黑客侵入其计算机网络并植入了恶意软件。 德国新闻机构DPA报道称，APT28组织俄罗斯黑客侵入德国的外交和内政部的在线网络。"}
{"title": "安卓端渗透工具DVHMA：自带漏洞的混合模式APP", "url": "https://www.freebuf.com/news/163057.html", "time": "2018-03-02", "level": "", "num_look": 260331, "num_comment": 4, "author": "柚子", "tags": ["资讯"], "text": "DVHMA（Damn Vulnerable Hybrid Mobile App）是一个安卓端的混合模式APP，故意包含大量漏洞。其功能就是帮助安全研究员合法地对他们的工具或技术进行渗透测试。"}
{"title": "SikurPhone：内置“防黑客”加密货币钱包的手机", "url": "https://www.freebuf.com/articles/terminal/163839.html", "time": "2018-03-02", "level": "红色标题", "num_look": 349990, "num_comment": 6, "author": "Sphinx", "tags": ["终端安全"], "text": "如果你在最近的比特币风潮中幸运入场，那你需要一款SikurPhone手机。手机中的钱包应用能展示各种加密货币的当前价格。"}
{"title": "GlobeImposter勒索病毒技术分析报告", "url": "https://www.freebuf.com/articles/system/163792.html", "time": "2018-03-02", "level": "", "num_look": 502355, "num_comment": 4, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "通过跟进分析发现黑客使用的勒索病毒全部为GlobeImposter家族的勒索病毒，黑客在突破企业防护边界后释放并运行勒索病毒，最终导致系统破坏，影响正常工作秩序。"}
{"title": "安全人才去哪里？去哪儿网等着你", "url": "https://www.freebuf.com/jobs/163759.html", "time": "2018-03-02", "level": "", "num_look": 214894, "num_comment": 2, "author": "gyreg", "tags": ["安全招聘"], "text": "去哪儿网凭借其便捷、先进的智能搜索技术对互联网上的旅行信息进行整合，为用户提供实时、可靠、全面的旅游产品查询和信息比较服务。"}
{"title": "新手上路 | 记我在HackerOne上参与的一次漏洞众测邀请项目", "url": "https://www.freebuf.com/vuls/163404.html", "time": "2018-03-02", "level": "红色标题", "num_look": 752122, "num_comment": 11, "author": "clouds", "tags": ["漏洞"], "text": "这是一件关于我参与Hackerone平台某漏洞邀请项目的事。"}
{"title": "什么样的爬虫才是好爬虫：Robots协议探究", "url": "https://www.freebuf.com/articles/web/163574.html", "time": "2018-03-02", "level": "", "num_look": 566077, "num_comment": 6, "author": "岂安科技", "tags": ["WEB安全"], "text": "网站的管理者们通常会有这样一种心态：一方面期待百度、Google这样的搜索引擎来抓取网站的内容，另一方面又很厌恶其他来路不明的网络爬虫抓取自己的信息。"}
{"title": "Visa：芯片卡EMV大量推广后，信用卡伪造诈骗数量骤降70%", "url": "https://www.freebuf.com/news/163606.html", "time": "2018-03-02", "level": "", "num_look": 261643, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "Visa上周表示，在美国零售商开始部署可以读取基于芯片的信用卡和借记卡的终端的两年后，关于假冒卡欺诈案件的报道减少了70％。"}
{"title": "解密古老又通杀的路由器攻击手法：从嗅探PPPoE到隐蔽性后门", "url": "https://www.freebuf.com/articles/wireless/163480.html", "time": "2018-03-02", "level": "现金奖励", "num_look": 1260471, "num_comment": 21, "author": "qingxp9", "tags": ["无线安全"], "text": "随着宽带用户爆发性增长，PPPoE被带进了各家各户，而它的安全缺陷却一直没有受到足够关注，直至今日成为了一种低成本的通杀型路由器攻击手段。"}
{"title": "BUF早餐铺 | 胆小者注意，“诡娃”木马开始活跃；防黑客智能手机售价超5000元，旨在保护用户加密货币安全；谨防App Store与iTunes账单的钓鱼诈骗", "url": "https://www.freebuf.com/news/163804.html", "time": "2018-03-02", "level": "", "num_look": 192528, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": "元宵佳节，不知道大家早餐是不是吃的汤圆呢？"}
{"title": "亲历历史！史上首个核弹级DDoS攻击正在荼毒全球", "url": "https://www.freebuf.com/articles/network/163895.html", "time": "2018-03-01", "level": "", "num_look": 735163, "num_comment": 25, "author": "360安全", "tags": ["网络安全"], "text": "近期，一种利用Memcache作为DRDoS放大器进行放大的超大规模DDoS攻击，引发了安全圈广泛关注。"}
{"title": "MADLIRA：一款检测安卓端恶意软件的智能开源工具", "url": "https://www.freebuf.com/sectool/163104.html", "time": "2018-03-01", "level": "", "num_look": 279476, "num_comment": 2, "author": "柚子", "tags": ["工具"], "text": "MADLIRA是一个针对安卓系统的恶意软件检测工具，包含TFIDF组件和SVM学习组件两部分。"}
{"title": "如何科学合理薅FreeBuf活动“羊毛”", "url": "https://www.freebuf.com/articles/web/163572.html", "time": "2018-03-01", "level": "红色标题", "num_look": 281510, "num_comment": 11, "author": "斗笠君999", "tags": ["WEB安全", "活动"], "text": "这是一个上传数据拿奖品的活动，看着礼品还挺诱人的，作为薅羊毛专业户，我必须吐槽一把了……"}
{"title": "是什么原因让黑客向CoinDash返还了价值$2600万的以太坊？", "url": "https://www.freebuf.com/news/163725.html", "time": "2018-03-01", "level": "", "num_look": 235917, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "据了解，一名黑客已经向CoinDash归还了价值超过2620万美元的以太坊，这也是该公司从2017年7月份开始所筹到的融资金额。"}
{"title": "使用Facebook帐户接管Tinder帐户的漏洞复现", "url": "https://www.freebuf.com/vuls/163346.html", "time": "2018-03-01", "level": "", "num_look": 272929, "num_comment": 1, "author": "secist", "tags": ["漏洞"], "text": "Tinder应用程序中发现的一个账户接管漏洞，利用该漏洞攻击者可以访问受害者必须使用手机号码才能登录的的Tinder帐户。"}
{"title": "屏芯科技诚聘安全工程师", "url": "https://www.freebuf.com/jobs/163427.html", "time": "2018-03-01", "level": "", "num_look": 176291, "num_comment": 2, "author": "manchester", "tags": ["安全招聘"], "text": "以 “让餐饮经营更简单”为使命，为餐饮行业提供基于云端的智能化解决方案，建设餐饮信息高速网络，重构互联网时代的餐饮产业链。"}
{"title": "根据目标用户信息，Python生成WPA2密码字典", "url": "https://www.freebuf.com/articles/wireless/163710.html", "time": "2018-03-01", "level": "现金奖励", "num_look": 514033, "num_comment": 12, "author": "koerle", "tags": ["数据安全", "无线安全"], "text": "普通的字典大多是全覆盖的、总结性的，针对部分弱口令或许有用，不过1g的字典就算跑也要跑几个小时。那么如何利用已知目标wifi用户的信息生成一个不错的字典呢？"}
{"title": "Frida之Pin码破解实验", "url": "https://www.freebuf.com/articles/terminal/163297.html", "time": "2018-03-01", "level": "现金奖励", "num_look": 439313, "num_comment": 7, "author": "烟波渺渺正愁予", "tags": ["极客", "终端安全"], "text": "在网上搜了一些frida破解Pin码的文章，不动手写点代码总感觉理解不深入的念头又升起来了，于是决定找一个开源pin码，然后改一改再破解。"}
{"title": "币圈一日，人间十年：黑客想了三刻钟就笑了", "url": "https://www.freebuf.com/articles/neopoints/163671.html", "time": "2018-03-01", "level": "", "num_look": 577525, "num_comment": 10, "author": "GeekPwn", "tags": ["观点"], "text": "文中梳理了目前针对数字货币的十大安全威胁。在网络风险面前，人皆韭菜。毕竟，“比特币之父”中本聪的邮箱也曾被黑客光顾过。"}
{"title": "影响恶劣的GlobeImposter勒索攻击应如何防御？", "url": "https://www.freebuf.com/articles/es/163551.html", "time": "2018-03-01", "level": "", "num_look": 301864, "num_comment": 4, "author": "360企业安全", "tags": ["企业安全"], "text": "近日，国内某机构遭受 GlobeImposter勒索病毒攻击，导致业务相关文件被加密，对业务的连续性造成严重影响。"}
{"title": "BUF早餐铺 | 苹果联合创始人7枚比特币被骗走；新方法可破解任意iPhone设备；iBoot源代码再次泄露；中国内地iCloud数据正式转由云上贵州运营", "url": "https://www.freebuf.com/news/163719.html", "time": "2018-03-01", "level": "", "num_look": 255280, "num_comment": 7, "author": "AngelaY", "tags": ["资讯"], "text": "蛾儿雪柳黄金缕。笑语盈盈暗香去。丰盛早餐待元夕。"}
{"title": "新法新规3月施行：微博客平台须建立辟谣机制", "url": "https://www.freebuf.com/news/163669.html", "time": "2018-02-28", "level": "", "num_look": 203223, "num_comment": 5, "author": "vulture", "tags": ["资讯"], "text": "为了促进微博客信息服务健康有序发展,国家互联网信息办公室依据《中华人民共和国网络安全法》等相关法律法规制定了《微博客信息服务管理规定》。"}
{"title": "7个特性让ZAP成为应用安全测试中的重要工具", "url": "https://www.freebuf.com/sectool/162930.html", "time": "2018-02-28", "level": "", "num_look": 339978, "num_comment": 2, "author": "Ultracoder", "tags": ["工具"], "text": "The Zed Attack Proxy (ZAP) 是一个开源工具，由 Open Web Application Security Project (OWASP) 维护，拥有庞大的开发人员社区，可快速提供新模块或附加组件。"}
{"title": "剧透！FreeBuf 2018上半年度「企业安全」主题活动抢先看", "url": "https://www.freebuf.com/news/163601.html", "time": "2018-02-28", "level": "", "num_look": 198347, "num_comment": 4, "author": "FB客服", "tags": ["头条", "活动"], "text": "小编为你们提前“剧透”FreeBuf 2018上半年度「企业安全」主题活动！赶紧右键保存，收藏起来吧。"}
{"title": "iPhone X未能幸免 | 以色列取证企业发现解锁任意iPhone设备的方法", "url": "https://www.freebuf.com/news/163634.html", "time": "2018-02-28", "level": "红色标题", "num_look": 449688, "num_comment": 8, "author": "Elaine_z", "tags": ["资讯"], "text": "两年之前，FBI 与苹果之间有一起闹得沸沸扬扬的的解锁 iPhone 事件。而现在来看，美国联邦政府似乎再也不需要与苹果因“解锁iPhone”而展开苦恼的拉锯战了……"}
{"title": "通过逆向分析防御挖矿病毒", "url": "https://www.freebuf.com/articles/network/163233.html", "time": "2018-02-28", "level": "现金奖励", "num_look": 609074, "num_comment": 10, "author": "safecat", "tags": ["企业安全", "网络安全"], "text": "因为这次是从应急响应引出的，所以我将侧重点放在分析病毒本身的存储方式和传播途径，靠逆向分析出防护策略用于帮助后续的应急响应/系统加固/运维。"}
{"title": "停车服务公众号存安全隐患，可能泄漏你的用车行踪", "url": "https://www.freebuf.com/news/163526.html", "time": "2018-02-28", "level": "红色标题", "num_look": 254639, "num_comment": 6, "author": "shidongqi", "tags": ["资讯"], "text": "近期有网友称，某停车服务公众号可随意绑定车牌，可能导致车辆用车行踪泄漏。"}
{"title": "密码管理器1Password纳入新功能：无需透露密码即可检测密码是否泄漏", "url": "https://www.freebuf.com/news/163489.html", "time": "2018-02-28", "level": "", "num_look": 268567, "num_comment": 6, "author": "AngelaY", "tags": ["资讯"], "text": "广受用户欢迎的密码管理器 1Password 近期加入了新功能，可以不输入完整登陆凭证（不传输到服务器），就可以检查出用户的密码是否已经泄露。"}
{"title": "企业安全意识培训调查：哪种网络钓鱼邮件具有接近100％的点击率？", "url": "https://www.freebuf.com/articles/es/163239.html", "time": "2018-02-28", "level": "红色标题", "num_look": 895346, "num_comment": 15, "author": "Elaine_z", "tags": ["企业安全"], "text": "企业安全威胁中来自网络邮件的威胁在近几年不断增长，因此不少企业为雇员开展安全培训，希望他们能够及时识别钓鱼邮件，钓鱼短信及其他钓鱼内容。"}
{"title": "Buf早餐铺 | 恶意软件Nanocore RAT作者被判入狱33个月;黑客退还盗窃的$2600万价值以太币；PhishMe 以4亿美元市值被收购", "url": "https://www.freebuf.com/news/163514.html", "time": "2018-02-28", "level": "", "num_look": 189311, "num_comment": 1, "author": "Elaine_z", "tags": ["资讯"], "text": "大千世界，波涛汹涌，纷纷攘攘……早餐煎饼吃不吃？"}
{"title": "ReelPhish：一款实时双因素钓鱼软件", "url": "https://www.freebuf.com/sectool/162909.html", "time": "2018-02-27", "level": "", "num_look": 288742, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "社会工程学活动对于企业来说一直都是很大的威胁，因为这种攻击手段针对的是整个安全环节中最薄弱的一环：人。"}
{"title": "Paypal出现漏洞，可获取账户余额和近期交易数据", "url": "https://www.freebuf.com/news/163400.html", "time": "2018-02-27", "level": "红色标题", "num_look": 271241, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": "PayPal的bug允许通过逐一列举的方式获取付款方式的最后四位数字以及披露任何给定PayPal账户的账户余额和近期交易数据。"}
{"title": "揭秘Scarab勒索软件新变种、新手段", "url": "https://www.freebuf.com/news/163011.html", "time": "2018-02-27", "level": "", "num_look": 236978, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["系统安全", "资讯"], "text": "Scarab恶意软件最早发现于2017年6月份，从那时开始，便有大量新的Scarab变种不断被发现。"}
{"title": "中国移动苏州研发中心招聘安全研发工程师", "url": "https://www.freebuf.com/jobs/133375.html", "time": "2018-02-27", "level": "", "num_look": 220610, "num_comment": 2, "author": "secgeorge", "tags": ["安全招聘"], "text": "中移（苏州）软件技术有限公司是中国移动通信集团2014年注资成立的全资子公司，是中国移动推动战略转型、实现向移动互联网业务和信息消费拓展的重要布局。"}
{"title": "分享一个用于企业内部环境的SSH弱密码审计工具", "url": "https://www.freebuf.com/sectool/163343.html", "time": "2018-02-27", "level": "现金奖励", "num_look": 758990, "num_comment": 24, "author": "ipenox", "tags": ["企业安全", "工具"], "text": "为了能够每周都对全体设备做一次弱密码审计并定期输出扫描报告，我基于开源工具有针对性地编写了一些辅助工具(脚本)来做这件事情，取得了不错的效果。"}
{"title": "趋势科技（Trend Micro）加密邮件网关方案存在数个安全漏洞", "url": "https://www.freebuf.com/vuls/163369.html", "time": "2018-02-27", "level": "", "num_look": 332208, "num_comment": 332208, "author": "Elaine_z", "tags": ["漏洞"], "text": "Core Security安全研究员发现 Trend Micro 中存在数个邮件网关加密漏洞，其中包括风险级别为 critical 和 high 的漏洞。"}
{"title": "高效幂模算法探究：Montgomery算法解析", "url": "https://www.freebuf.com/articles/others-articles/162484.html", "time": "2018-02-27", "level": "现金奖励", "num_look": 457059, "num_comment": 9, "author": "GeekOnline", "tags": ["其他", "网络安全"], "text": "模运算渗透了人类生活的方方面面，因此如何在当下计算系统中更加高效的运用模运算也是一个十分关键的问题。"}
{"title": "全球网络战正在升温：为什么企业应该担心？", "url": "https://www.freebuf.com/articles/es/163157.html", "time": "2018-02-27", "level": "红色标题", "num_look": 280988, "num_comment": 2, "author": "shidongqi", "tags": ["企业安全"], "text": "从NotPetya的全球破坏到朝鲜数字化的金融机构掠夺，国家支持的网络攻击应该成为商界领袖的头等大事。"}
{"title": "基于SonarQube的自动化代码缺陷检测：WebGoat实战（一）", "url": "https://www.freebuf.com/news/162977.html", "time": "2018-02-27", "level": "金币+10", "num_look": 429684, "num_comment": 3, "author": "hjy103", "tags": ["WEB安全", "工具"], "text": "由于本次我们主要是做静态代码分析，而不是渗透测试，因此我们只需要将WebGoat 8的源代码下载下来， 并上传到“自动化安全代码检测平台”即可。"}
{"title": "BUF 早餐铺 | Paypal出现漏洞，可获取账户余额和近期交易数据；美国专家：俄罗斯入侵奥运会计算机；三星为S9增强了安全性能", "url": "https://www.freebuf.com/news/163471.html", "time": "2018-02-27", "level": "", "num_look": 211692, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "Paypal出现漏洞，可获取账户余额和近期交易数据；中国iCloud用户数据即将完成迁移，钥匙串一同转移。"}
{"title": "2017 中国高级持续性威胁（APT）研究报告", "url": "https://www.freebuf.com/articles/network/163435.html", "time": "2018-02-26", "level": "", "num_look": 824681, "num_comment": 2, "author": "奇安信威胁情报中心", "tags": ["安全报告", "网络安全"], "text": "在APT研究领域，美国在全世界都处于遥遥领先的地位。"}
{"title": "平安银行总行零售信息安全岗位招聘【深圳上海】", "url": "https://www.freebuf.com/jobs/163366.html", "time": "2018-02-26", "level": "", "num_look": 202691, "num_comment": 2, "author": "平安银行应用安全团队", "tags": ["安全招聘"], "text": "平安银行股份有限公司是总部设在深圳的全国性股份制商业银行。"}
{"title": "Archery：开源漏洞评估和管理工具", "url": "https://www.freebuf.com/sectool/162864.html", "time": "2018-02-26", "level": "红色标题", "num_look": 474370, "num_comment": 13, "author": "secist", "tags": ["工具"], "text": "Archery是一款开源的漏洞评估和管理工具，它可以帮助开发和渗透测试人员执行漏洞扫描及管理漏洞。"}
{"title": "青藤云安全完成2亿元人民币B轮融资，红杉中国领投", "url": "https://www.freebuf.com/news/163360.html", "time": "2018-02-26", "level": "", "num_look": 194553, "num_comment": 2, "author": "青藤云安全", "tags": ["资讯"], "text": "2018年2月26日，青藤云安全在北京宣布完成2亿人民币B轮融资。本轮融资由红杉资本中国基金领投，A轮投资人宽带资本，红点投资及天使投资人真格基金继续跟投，由弈秋资本担任独家财务顾问。"}
{"title": "物联网（IoT）无线电通信渗透测试Part1：数字通信基本原理", "url": "https://www.freebuf.com/articles/wireless/162866.html", "time": "2018-02-26", "level": "", "num_look": 469975, "num_comment": 12, "author": "clouds", "tags": ["无线安全"], "text": "在该节中，我们先来熟悉一下数字信号的基本原理和一些IoT基本知识。"}
{"title": "漏洞组合拳 | 重置dedecms管理员后台密码重现及分析", "url": "https://www.freebuf.com/vuls/163344.html", "time": "2018-02-26", "level": "", "num_look": 549109, "num_comment": 16, "author": "LSA", "tags": ["WEB安全", "漏洞"], "text": "网上爆出dedecms v5.7 sp2的前台任意用户密码重置和前台任意用户登录漏洞，加上一个管理员前台可修改其后台密码的安全问题，形成漏洞利用链，这招组合拳可以重置管理员后台密码。"}
{"title": "话题采访 | 白帽黑客们都把他们的漏洞赏金花在了哪？", "url": "https://www.freebuf.com/articles/others-articles/163003.html", "time": "2018-02-26", "level": "红色标题", "num_look": 375194, "num_comment": 17, "author": "secist", "tags": ["其他", "特别企划"], "text": "据统计，在HackerOne注册的白帽黑客数量最多的不是美国而是印度。在印度，一名顶级白帽的收入可达到软件工程师平均工资的 16 倍。"}
{"title": "BUF 早餐铺 | 湖南省儿童医院疑似遭受比特币勒索；SamSam勒索软件攻击科罗拉多交通部门", "url": "https://www.freebuf.com/news/163299.html", "time": "2018-02-26", "level": "", "num_look": 182447, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "湖南省儿童医院疑似遭受比特币勒索；安卓9.0将禁止后台应用调用摄像头和麦克风权限；腾讯推出TRP-AI反病毒引擎，网络安全步入AI+快车道。"}
{"title": "2018年我们将面临哪些云数据安全问题？", "url": "https://www.freebuf.com/news/163236.html", "time": "2018-02-26", "level": "", "num_look": 265237, "num_comment": 2, "author": "世平信息SPINFO", "tags": ["数据安全", "资讯"], "text": "对于数据安全问题，TierPoint也有自己的见解。2018年我们将面临哪些云数据安全问题？TierPoint提出了以下5种威胁。"}
{"title": "一秒找出用时间和随机数生成的上传文件名", "url": "https://www.freebuf.com/articles/web/163058.html", "time": "2018-02-26", "level": "现金奖励", "num_look": 517319, "num_comment": 8, "author": "golang", "tags": ["WEB安全"], "text": "在做渗透测试或者ctf比赛的时，常遇到一种任意文件上传漏洞，上传后的文件名，是使用时间加随机数生成的。"}
{"title": "保护隐私，安卓9.0将禁止后台应用调用摄像头和麦克风权限", "url": "https://www.freebuf.com/news/163240.html", "time": "2018-02-26", "level": "", "num_look": 330077, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "安卓操作系统的下一个版本Android P将阻止空闲（后台）应用程序访问智能手机的相机或麦克风。"}
{"title": "勒索未去挖矿又来，解读网络淘金热的黑暗面", "url": "https://www.freebuf.com/articles/paper/162045.html", "time": "2018-02-25", "level": "", "num_look": 274680, "num_comment": 274680, "author": "Covfefe", "tags": ["安全报告"], "text": "在过去的几个月里，Talos发现利用受害者机器进行挖矿的行为显著增加，最近加密货币和区块链一直是热点，所以攻击者难免会关注。"}
{"title": "分析CVE-2018-6376 – Joomla！二阶SQL注入", "url": "https://www.freebuf.com/articles/web/162822.html", "time": "2018-02-25", "level": "", "num_look": 493190, "num_comment": 4, "author": "secist", "tags": ["WEB安全"], "text": "最近，知名的内容管理系统Joomla！就被曝出了存在二阶SQL注入漏洞。"}
{"title": "【FB TV】一周「BUF大事件」：B站部分帐号可直接登录360快视频；新型病毒VanFraud大肆传播，日感染量10余万台；Intel发布稳定版本的Spectre 补丁", "url": "https://www.freebuf.com/video/163317.html", "time": "2018-02-25", "level": "红色标题", "num_look": 346947, "num_comment": 5, "author": "willhuang", "tags": ["视频"], "text": "新年的第一期BUF大事件还是为大家带来了新鲜有趣的新闻，B站部分帐号可直接登录360快视频，双方均对此做出回应。新型病毒VanFraud大肆传播，日感染量10余万台；Intel发布稳定版本的Spectre 补丁。"}
{"title": "CSRF（跨站点请求伪造）在Flash中的利用", "url": "https://www.freebuf.com/articles/web/155189.html", "time": "2018-02-25", "level": "", "num_look": 339830, "num_comment": 3, "author": "淼淼兮与怀", "tags": ["WEB安全"], "text": "CSRF（Cross-site request forgery）跨站请求伪造，也被称为“One Click Attack”或者Session Riding，通常缩写为CSRF或者XSRF，是一种对网站的恶意利用。"}
{"title": "警惕GLOBEIMPOSTER勒索软件", "url": "https://www.freebuf.com/articles/paper/162637.html", "time": "2018-02-25", "level": "", "num_look": 276882, "num_comment": 276882, "author": "antiylab", "tags": ["安全报告"], "text": "安天安全研究与应急处理中心（Antiy CERT）的工程师在近日接到用户反馈，其服务器被勒索软件加密。"}
{"title": "Altdns：运用置换扫描技术的子域发现工具", "url": "https://www.freebuf.com/sectool/162774.html", "time": "2018-02-24", "level": "", "num_look": 300632, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "Altdns是一款运用置换扫描技术的子域发现工具，它可以帮助我们查找与某些排列或替换匹配的子域。AltDNS接受可能存在于域下的子域中的单词（例如测试，开发，分期），以及获取你知道的子域列表。"}
{"title": "过完年黑客也开工了，国内两家医院连遭比特币勒索", "url": "https://www.freebuf.com/news/163284.html", "time": "2018-02-24", "level": "红色标题", "num_look": 758954, "num_comment": 22, "author": "shidongqi", "tags": ["资讯"], "text": "2月24日，湖南省儿童医院服务器疑似中了某种勒索病毒，所有数据文件被强行加密，导致系统瘫痪，患者一度无法正常就医。"}
{"title": "Flask jinja2模板注入思路总结", "url": "https://www.freebuf.com/vuls/162752.html", "time": "2018-02-24", "level": "", "num_look": 376461, "num_comment": 11, "author": "请叫我飞翔的翔", "tags": ["漏洞"], "text": "虽然这个漏洞已经出现很久了，不过偶尔还是能够看到。我找来找去也走了些弯路，小白们可以参考一下。如果有什么错误，欢迎各位指正。"}
{"title": "Microsoft Office内存损坏漏洞（CVE-2017-11882）实战", "url": "https://www.freebuf.com/vuls/161753.html", "time": "2018-02-24", "level": "", "num_look": 404939, "num_comment": 4, "author": "cloud4986", "tags": ["漏洞"], "text": "本文分析了CVE-2017-11882 poc样本的文件结构，在分析poc样本时介绍了rtf文件、Equation Native数据结构、MTEF流数据结构、FONT记录数据结构的基本知识。"}
{"title": "平安科技安全平台部招聘安全人才", "url": "https://www.freebuf.com/jobs/163186.html", "time": "2018-02-24", "level": "", "num_look": 255600, "num_comment": 1, "author": "dulai0103", "tags": ["安全招聘"], "text": "平安科技是平安集团旗下的全资子公司，是平安集团的高科技内核。"}
{"title": "网络钓鱼威胁增大，财富500强公司继续成为支付欺诈对象", "url": "https://www.freebuf.com/articles/es/163145.html", "time": "2018-02-24", "level": "", "num_look": 328164, "num_comment": 6, "author": "Elaine_z", "tags": ["企业安全"], "text": "网络犯罪份子通过入侵员工邮箱或身份伪造发起钓鱼，辅以社会工程技巧，频频实施作案。"}
{"title": "NrsMiner：一个构造精密的挖矿僵尸网络", "url": "https://www.freebuf.com/articles/system/162874.html", "time": "2018-02-24", "level": "", "num_look": 567905, "num_comment": 1, "author": "360安全", "tags": ["系统安全"], "text": "本文将对NrsMiner的结构进行详细分析，并梳理NrsMiner僵尸网络的发展过程。"}
{"title": "如何用一个废旧的笔记本打造一个家庭网络服务器？", "url": "https://www.freebuf.com/geek/162967.html", "time": "2018-02-24", "level": "现金奖励", "num_look": 1406550, "num_comment": 48, "author": "中华隐士家族", "tags": ["极客"], "text": "本来好好的笔记本的，可偏偏屏幕说烂就烂，那就干脆不要了，改造改造吧。"}
{"title": "2018安全行业发展遐想", "url": "https://www.freebuf.com/articles/neopoints/163007.html", "time": "2018-02-24", "level": "金币+5", "num_look": 271893, "num_comment": 2, "author": "兜哥", "tags": ["观点"], "text": "最近思考人生比较多，对行业的发展也有些自己的思考。"}
{"title": "BUF早餐铺 | 新加坡国防部付费邀请白帽子寻找漏洞；npm 更新导致 Linux 系统崩溃；Whatsapp联合创始人向Signal投资5000万美元", "url": "https://www.freebuf.com/news/163202.html", "time": "2018-02-24", "level": "", "num_look": 243754, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "正月新阳生翠琯，花苞柳线春犹浅。"}
{"title": "WhatsApp联合创始人向加密通信应用Signal投资5000万美元", "url": "https://www.freebuf.com/news/163173.html", "time": "2018-02-23", "level": "", "num_look": 275206, "num_comment": 6, "author": "Sphinx", "tags": ["资讯"], "text": "Open Whisper Systems是隐私信息应用程序Signal背后的组织，Open Whisper Systems宣布成立Signal Foundation，初始投资额为5000万美元。"}
{"title": "华硕路由器AsusWRT局域网内未授权远程代码执行漏洞", "url": "https://www.freebuf.com/articles/terminal/161809.html", "time": "2018-02-23", "level": "", "num_look": 454192, "num_comment": 5, "author": "clouds", "tags": ["终端安全"], "text": "近期，Agile安全研究员Pedro Ribeiro，发现了华硕路由器固件系统AsusWRT的一个局域网内未授权远程代码执行漏洞，我们一起来简单了解一下该漏洞的生成原因。"}
{"title": "斗象智能安全PRS2.0 |「场景化」智能安全，从概念到现实", "url": "https://www.freebuf.com/fevents/163180.html", "time": "2018-02-23", "level": "红色标题", "num_look": 869569, "num_comment": 3, "author": "斗象智能安全平台", "tags": ["活动"], "text": "斗象科技联合创始人兼CTO张天琪首先登台带来《大道至简：解锁「场景化」风险感知》的分享，受到与会观众的关注。"}
{"title": "安全开发之扫描器迭代记：W9Scan", "url": "https://www.freebuf.com/sectool/162120.html", "time": "2018-02-23", "level": "现金奖励", "num_look": 646634, "num_comment": 23, "author": "w8ay", "tags": ["工具"], "text": "w9scan是一款全能型的网站漏洞扫描器，借鉴了各位前辈的优秀代码。内置1200+插件可对网站进行一次规模的检测，功能包括但不限于web指纹检测、端口指纹检测等等，w9scan会自动生成精美HTML格式结果报告。"}
{"title": "利用修改后的NSA泄露工具通杀自Windows2000以来的所有Windows版本", "url": "https://www.freebuf.com/news/162757.html", "time": "2018-02-23", "level": "", "num_look": 509564, "num_comment": 11, "author": "secist", "tags": ["系统安全", "资讯"], "text": "黑客组织Shadow Brokers影子经纪人泄露的NSA工具中，最着名的可能要数EnternalBlue了，它催生了像WannaCry，Petya这样影响广泛的高危险性勒索病毒。"}
{"title": "AI安全风险白皮书", "url": "https://www.freebuf.com/articles/network/162875.html", "time": "2018-02-23", "level": "", "num_look": 549792, "num_comment": 2, "author": "360安全", "tags": ["网络安全"], "text": "随着一批深度学习应用逐渐开始变成现实，安全问题也渐渐显现出来。"}
{"title": "WireShark+Winhex：流量分析的好搭档", "url": "https://www.freebuf.com/sectool/161478.html", "time": "2018-02-23", "level": "现金奖励", "num_look": 667717, "num_comment": 16, "author": "康康你秋裤穿反啦", "tags": ["工具"], "text": "这里用最近的一道安恒杯有难度的流量分析题为例作为讲解，题目叫做“中国菜刀666”。"}
{"title": "如何减轻挖矿攻击给企业安全带来的威胁", "url": "https://www.freebuf.com/articles/neopoints/162377.html", "time": "2018-02-23", "level": "", "num_look": 270491, "num_comment": 3, "author": "Sphinx", "tags": ["观点"], "text": "比特币和其他加密货币越来越受欢迎，引发了安全专家的好奇和担忧。人们发现越来越多的挖矿病毒，这些病毒通常通过僵尸网络安装。作为公司，有必要知道这其中的风险和如何防范。"}
{"title": "2017年网络安全行业大事记（最全完整版）", "url": "https://www.freebuf.com/news/162542.html", "time": "2018-02-23", "level": "红色标题", "num_look": 1626245, "num_comment": 8, "author": "安胜网络", "tags": ["资讯"], "text": "2017年是平凡的一年，但是对于网络安全行业注定是不平凡的一年。"}
{"title": "BUF早餐铺 | Tesla云服务器遭黑客入侵，安装恶意挖矿软件；uTorrent客户端存在安全漏洞，可收集用户下载记录；工商总局今年将重点整治虚假、诱骗性互联网广告", "url": "https://www.freebuf.com/news/163071.html", "time": "2018-02-23", "level": "", "num_look": 229683, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "狗年第一份BUF早餐铺来得有些晚，让大家久等了，旺旺~"}
{"title": "自动化合规测试工具InSpec 2.0促进DevSecOps发展", "url": "https://www.freebuf.com/news/163103.html", "time": "2018-02-22", "level": "", "num_look": 336579, "num_comment": 3, "author": "AngelaY", "tags": ["工具", "资讯"], "text": "Chef 公司发布的 InSpec 2.0 工具可以将法律法规整合进开发部署阶段，甚至实现自动化操作，进而大大节省人力，促进 DevSecOps 的发展。"}
{"title": "挖洞经验 | 看我如何参加众测项目发现美国国防部网站的各类高危漏洞", "url": "https://www.freebuf.com/articles/others-articles/162579.html", "time": "2018-02-22", "level": "红色标题", "num_look": 409452, "num_comment": 4, "author": "clouds", "tags": ["其他", "观点"], "text": "本文目的在于，探讨一些类似漏洞众测项目中容易被采用的各种独特和通用型漏洞，同时也分享我参与该项目的一点经验。"}
{"title": "安全专家警告业界警惕AI技术滥用", "url": "https://www.freebuf.com/news/163078.html", "time": "2018-02-22", "level": "", "num_look": 220437, "num_comment": 3, "author": "Sphinx", "tags": ["资讯"], "text": "人工智能高速发展的今天，警惕的声音也从未间断。"}
{"title": "手把手教你如何用SMIME加密任意邮件", "url": "https://www.freebuf.com/articles/web/161465.html", "time": "2018-02-22", "level": "", "num_look": 390489, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "在此之前，我曾写过一篇关于邮件服务提供商安全问题的文章，你可以根据我的建议来选择一个比较合适的邮件提供商。"}
{"title": "中国网安集团旗下广州三零卫士2018年安全人才内推", "url": "https://www.freebuf.com/jobs/162871.html", "time": "2018-02-22", "level": "", "num_look": 433562, "num_comment": 25, "author": "30weishi", "tags": ["安全招聘"], "text": "广州三零卫士(“广州三零卫士信息安全有限公司”)，成立于2005年，是中央十二大军工集团——中国网安集团的旗下公司。"}
{"title": "快讯 | Spectre补丁稳定版来了：Intel发布针对Skylake、Kaby Lake、Coffee Lake处理器的微代码更新", "url": "https://www.freebuf.com/news/163019.html", "time": "2018-02-22", "level": "", "num_look": 420305, "num_comment": 3, "author": "Elaine_z", "tags": ["系统安全", "资讯"], "text": "稳定版本的Spectre 微代码更新姗姗来迟。"}
{"title": "论坛数据能帮你做什么 | 5分钟风控数据干货系列", "url": "https://www.freebuf.com/articles/neopoints/162020.html", "time": "2018-02-22", "level": "金币+10", "num_look": 409253, "num_comment": 2, "author": "sonext", "tags": ["观点"], "text": "本文的写作初衷是把如何运用论坛数据进行建模，服务于风控讲明白，希望给一直想用却不知道如何落地的机构一种思路和逻辑。"}
{"title": "国产App的隐私困局，由百度“监听电话”事件引发的思考", "url": "https://www.freebuf.com/articles/neopoints/162711.html", "time": "2018-02-22", "level": "红色标题", "num_look": 545723, "num_comment": 15, "author": "Philo Evius", "tags": ["观点"], "text": "2018年的新年可能对BAT三大巨头都并不好过。支付宝被爆出年度账单存在陷阱，微信忙着解释他们不看用户聊天记录，而百度则是涉嫌侵害消费者个人信息安全被起诉。"}
{"title": "2017年恶意Office文档攻击研究报告", "url": "https://www.freebuf.com/articles/system/162678.html", "time": "2018-02-22", "level": "", "num_look": 326850, "num_comment": 2, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "由于Office是人们电脑上最常用的办公软件，这种攻击手法不仅给个人用户带来巨大的风险，同时也严重威胁着政府和企业的安全，危害巨大。"}
{"title": "捡拾VBS应用层里的明珠", "url": "https://www.freebuf.com/sectool/161615.html", "time": "2018-02-22", "level": "现金奖励", "num_look": 272975, "num_comment": 7, "author": "lcx", "tags": ["工具"], "text": "袁哥以前提出了一个很有深度的观点，VBS脚本代码是本身没有指针概念的，不过指针的本质就是数组。"}
{"title": "Ledger硬件钱包存在漏洞，通过MITM可篡改钱包地址", "url": "https://www.freebuf.com/news/162751.html", "time": "2018-02-21", "level": "", "num_look": 317944, "num_comment": 317944, "author": "Covfefe", "tags": ["资讯"], "text": "加密货币硬件钱包“Ledger”被曝存在漏洞，且已经由匿名安全研究员确认，网络犯罪分子可利用该漏洞向Ledger使用者展示欺诈性钱包地址"}
{"title": "路由器漏洞复现分析第二弹：CNVD-2018-01084", "url": "https://www.freebuf.com/vuls/162627.html", "time": "2018-02-21", "level": "现金奖励", "num_look": 616586, "num_comment": 7, "author": "kczwa1", "tags": ["漏洞"], "text": "在上一篇文章里实际操作了一下用qemu system模式模拟路由器环境，那这一次再通过分析CNVD-2018-01084实际操作一下用qemu user 模式配合IDA对固件做调试。"}
{"title": "如何写一个你自己的Web集群式渗透系统", "url": "https://www.freebuf.com/articles/web/161845.html", "time": "2018-02-21", "level": "现金奖励", "num_look": 546067, "num_comment": 11, "author": "0d9y", "tags": ["WEB安全"], "text": "一个功能完善可以自定义的渗透系统可以帮助你省下很多的时间来思考目标站点的弱点，本文章就是教你怎么搭建一个Web入口的集群式渗透系统。"}
{"title": "如何利用NSE检测CVE漏洞", "url": "https://www.freebuf.com/sectool/161664.html", "time": "2018-02-21", "level": "现金奖励", "num_look": 721869, "num_comment": 7, "author": "yuegui_2004", "tags": ["工具"], "text": "NSE（Nmap Scripting Engine）作为Nmap的一部分，具有强大灵活的特性，允许使用者编写自己的脚本来完成各种各样的网络扫描任务。"}
{"title": "CTF中RSA题型解题思路及技巧，附小白福利", "url": "https://www.freebuf.com/articles/others-articles/161475.html", "time": "2018-02-20", "level": "现金奖励", "num_look": 1334483, "num_comment": 13, "author": "D001UM3", "tags": ["其他"], "text": "CTF中的RSA题目一般是将flag进行加密，然后把密文（即c）和其他一些你解题需要的信息一起给你，你需要克服重重难关，去解密密文c，得到flag（即m）"}
{"title": "利用CSS注入（无iFrames）窃取CSRF令牌", "url": "https://www.freebuf.com/articles/web/162687.html", "time": "2018-02-20", "level": "", "num_look": 484632, "num_comment": 484632, "author": "secist", "tags": ["WEB安全"], "text": "CSS相信大家不会陌生，在百度百科中它的解释是一种用来表现HTML（标准通用标记语言的一个应用）或XML（标准通用标记语言的一个子集）等文件样式的计算机语言。"}
{"title": "【2月20日晚间更新】部分B站帐号被发现可直接登录360快视频，B站回应系用户此前注册过", "url": "https://www.freebuf.com/news/162991.html", "time": "2018-02-20", "level": "红色标题", "num_look": 553722, "num_comment": 27, "author": "kylin1415", "tags": ["资讯"], "text": "新年第一个奇葩事件出现，360的快视频团队疑似拖了bilibili的裤子，并直接用在自己的用户注册信息上，细思极恐……"}
{"title": "2017年度移动应用安全态势报告", "url": "https://www.freebuf.com/articles/paper/162294.html", "time": "2018-02-20", "level": "", "num_look": 423101, "num_comment": 1, "author": "通付盾", "tags": ["安全报告"], "text": "截至2017年，移动互联网已走过十年历程，十年间网络边界日益模糊，网络安全日益受到重视。"}
{"title": "上汽集团招聘信息安全人才", "url": "https://www.freebuf.com/jobs/189517.html", "time": "2018-02-19", "level": "", "num_look": 135163, "num_comment": 1, "author": "SixSixSix", "tags": ["安全招聘"], "text": "海汽车集团股份有限公司（简称\"上汽集团\"，股票代码600104）是国内A股市场最大的汽车上市公司，现因业务需求招聘安全人才。"}
{"title": "技术解析 | Web缓存欺骗测试", "url": "https://www.freebuf.com/articles/web/161670.html", "time": "2018-02-19", "level": "现金奖励", "num_look": 390804, "num_comment": 2, "author": "m09046105", "tags": ["WEB安全"], "text": "Omer Gil在BlackHat USA 2017 和BSides Tel-Aviv 2017  上，对Web 缓存欺骗技术这种攻击技术进行了演示，在他发布的“Web  缓存欺骗技术白皮书”中也做了详细的介绍。"}
{"title": "SSH僵尸主机挖矿木马预警", "url": "https://www.freebuf.com/articles/network/161986.html", "time": "2018-02-19", "level": "", "num_look": 478673, "num_comment": 5, "author": "瀚思科技", "tags": ["网络安全"], "text": "XMR（门罗币）是目前比特币等电子货币的一种，以其匿名性，支持CPU挖矿，以及不菲的价格等特点，得到了“黑产”的青睐。"}
{"title": "Sickle：推荐一款优质ShellCode开发工具", "url": "https://www.freebuf.com/sectool/162332.html", "time": "2018-02-18", "level": "", "num_look": 391559, "num_comment": 3, "author": "secist", "tags": ["工具"], "text": "Sickle是一个shellcode开发工具，用于加速创建正常运行的shellcode所需的各个步骤。"}
{"title": "某租车系统JAVA代码审计", "url": "https://www.freebuf.com/articles/web/162910.html", "time": "2018-02-18", "level": "现金奖励", "num_look": 546074, "num_comment": 7, "author": "yinhongji", "tags": ["WEB安全"], "text": "由于开源的JAVA WEB项目不是很多，这里找到一个没有用struct2或是spring框架的cms，希望借此cms来帮助新手敲开JAVA代码审计的大门。"}
{"title": "保护Linux服务器的常用方法", "url": "https://www.freebuf.com/articles/web/162911.html", "time": "2018-02-18", "level": "", "num_look": 451577, "num_comment": 1, "author": "secist", "tags": ["WEB安全", "系统安全"], "text": "如果你担心的是更加高级的攻击者，并且需要防范可能的恶意代码或提权脚本被执行，那么在本文中你将学习到你想了解的知识。"}
{"title": "深入挖掘APP克隆实验", "url": "https://www.freebuf.com/articles/terminal/161277.html", "time": "2018-02-18", "level": "现金奖励", "num_look": 368556, "num_comment": 3, "author": "烟波渺渺正愁予", "tags": ["终端安全"], "text": "在上一篇文章中，对webview跨域访问进行了简单的实验，后续决定深入挖掘一下APP克隆，之前文章中讲过的这里也将不再赘述。"}
{"title": "Kaggle：一套完整的网站流量预测模型", "url": "https://www.freebuf.com/sectool/162282.html", "time": "2018-02-17", "level": "", "num_look": 410997, "num_comment": 410997, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家推荐的是一个名叫Kaggle的网站流量预测项目，本项目采用Python语言开发，可以给大家的流量预测建模提供一些思路。"}
{"title": "看我教你如何修改QQ安装包实现绕过QQ语音红包验证来领红包", "url": "https://www.freebuf.com/articles/terminal/162936.html", "time": "2018-02-17", "level": "现金奖励", "num_look": 1001418, "num_comment": 35, "author": "艾登——皮尔斯", "tags": ["终端安全"], "text": "这篇文章，俺会手把手教你当你遇到生僻字如何绕过QQ语音红包验证来领红包。"}
{"title": "Adobe Flash零日漏洞（CVE-2018-4878）在野攻击完全分析报告", "url": "https://www.freebuf.com/vuls/162629.html", "time": "2018-02-17", "level": "", "num_look": 497004, "num_comment": 497004, "author": "360安全", "tags": ["安全报告", "漏洞"], "text": "在CVE-2018-4878零日漏洞的补丁真空期，360安全卫士无需升级就能完美防御此次漏洞攻击。在此期间，360核心安全高级威胁应对团队迅速反应，率先截获了该漏洞的在野攻击并发布分析预警。"}
{"title": "在任意手机部署Nethunter", "url": "https://www.freebuf.com/sectool/162071.html", "time": "2018-02-17", "level": "现金奖励", "num_look": 969015, "num_comment": 34, "author": "xiyan", "tags": ["工具"], "text": "Kali Nethunter是一款用于安全研究的手机固件包，可以使Android设备增加“无线破解”、“HID攻击”、“伪造光驱”等的硬件功能以及metasploit等软件工具，目前官方只支持少量的Android手机。"}
{"title": "新病毒利用多家知名下载站疯狂传播，日感染量最高达十余万", "url": "https://www.freebuf.com/articles/system/162869.html", "time": "2018-02-16", "level": "", "num_look": 349578, "num_comment": 1, "author": "火绒安全", "tags": ["系统安全"], "text": "近日，火绒安全团队发现，新型病毒\"VanFraud\"正通过国内多家知名下载站的\"高速下载器\"大肆传播，日感染量最高可达10余万台。"}
{"title": "针对“DorkBot”的样本分析", "url": "https://www.freebuf.com/articles/network/162324.html", "time": "2018-02-16", "level": "", "num_look": 425774, "num_comment": 425774, "author": "三五年后", "tags": ["网络安全"], "text": "DorkBot是一种已知的恶意软件，最早可以追溯到2012年。它被认为通过社会媒体链接、即时消息应用程序或受感染的可移动设备等多种方式进行传播。"}
{"title": "中通快递诚招各类安全人才", "url": "https://www.freebuf.com/jobs/162816.html", "time": "2018-02-16", "level": "", "num_look": 276977, "num_comment": 6, "author": "ZTO_Misaki", "tags": ["安全招聘"], "text": "中通快递是一家集快递、物流及其他业务于一体的大型集团公司，作为中国最大的快递公司之一，一直致力于营造安全、快捷的快递服务。"}
{"title": "Redis未授权访问漏洞的重现与利用", "url": "https://www.freebuf.com/vuls/162035.html", "time": "2018-02-16", "level": "现金奖励", "num_look": 931124, "num_comment": 8, "author": "flurry", "tags": ["漏洞"], "text": "最近配置openvas的时候安装了redis，听说曾经曝出过一个未授权访问漏洞，便找了一下相关资料想自己动手复现一下漏洞的利用过程。"}
{"title": "如何通过Emond在macOS上实现持久化访问", "url": "https://www.freebuf.com/articles/system/161745.html", "time": "2018-02-16", "level": "", "num_look": 320236, "num_comment": 320236, "author": "Covfefe", "tags": ["系统安全"], "text": "在这篇文章中，我们会介绍如何通过emond在macOS上实现持久化访问。"}
{"title": "高效与争议并存：大规模自动化渗透工具AutoSploit", "url": "https://www.freebuf.com/sectool/161985.html", "time": "2018-02-15", "level": "", "num_look": 518361, "num_comment": 4, "author": "Covfefe", "tags": ["工具"], "text": "今天要介绍的工具是AutoSploit，顾名思义，这个工具的灵感就来源于“高效渗透”。"}
{"title": "携程信息安全部诚聘安全相关高级人才", "url": "https://www.freebuf.com/jobs/162824.html", "time": "2018-02-15", "level": "", "num_look": 190930, "num_comment": 2, "author": "携程信息安全部", "tags": ["安全招聘"], "text": ""}
{"title": "GDB调试CVE-2018-5711 PHP-GD拒绝服务漏洞", "url": "https://www.freebuf.com/vuls/162029.html", "time": "2018-02-15", "level": "现金奖励", "num_look": 332971, "num_comment": 3, "author": "xiaoyinglicai", "tags": ["漏洞", "系统安全"], "text": "从github的PHP-src克隆下含有漏洞的版本，最好采取7.0以上版本，编译时候会比较简单，本次选用PHP7.1.9。"}
{"title": "“奇幻熊”（APT28）组织最新攻击", "url": "https://www.freebuf.com/articles/network/162715.html", "time": "2018-02-15", "level": "", "num_look": 546194, "num_comment": 4, "author": "腾讯电脑管家", "tags": ["网络安全"], "text": "近日腾讯御见威胁情报中心在监测Fancy Bear“奇幻熊”组织的攻击活动过程中，发现了其使用的最新攻击样本。下文将详细披露该组织的攻击手法，和各企业一起共同抵御此类高级攻击。"}
{"title": "漏洞盒子联合10家SRC给您拜年啦！", "url": "https://www.freebuf.com/video/162807.html", "time": "2018-02-15", "level": "", "num_look": 282166, "num_comment": 5, "author": "漏洞盒子", "tags": ["特别企划", "视频"], "text": "拜年咯～"}
{"title": "将REMnux部署到云上，在云上完成恶意软件的逆向分析", "url": "https://www.freebuf.com/sectool/162048.html", "time": "2018-02-14", "level": "", "num_look": 281409, "num_comment": 281409, "author": "secist", "tags": ["工具"], "text": "REMnux是一个用于辅助逆向分析人员完成逆向分析任务的免费虚拟机镜像。其中包含了大量的逆向分析工具，可分析基于Web的恶意软件。"}
{"title": "爱加密诚聘安全相关人才", "url": "https://www.freebuf.com/jobs/162405.html", "time": "2018-02-14", "level": "", "num_look": 178546, "num_comment": 178546, "author": "guochao610", "tags": ["安全招聘"], "text": ""}
{"title": "Android应用测试速查表", "url": "https://www.freebuf.com/articles/terminal/161599.html", "time": "2018-02-14", "level": "", "num_look": 425914, "num_comment": 425914, "author": "walletong", "tags": ["终端安全"], "text": "最近研究了下Android应用测试，找了一些资料，觉得OWASP这篇写的还是比较系统的，所以翻译出来给大家分享下。"}
{"title": "新年大作战：抵制恶意推广，守护老爸的旧电脑", "url": "https://www.freebuf.com/special/162450.html", "time": "2018-02-14", "level": "红色标题", "num_look": 524672, "num_comment": 21, "author": "shidongqi", "tags": ["特别企划"], "text": "每年过年回家都给父母电脑重装系统的技术男，速速来报道。"}
{"title": "DEFCON携手百度安全落地中国，打造国际化网络安全交流平台", "url": "https://www.freebuf.com/news/162916.html", "time": "2018-02-13", "level": "", "num_look": 334635, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "2月12日，DEFCON与百度安全在北京召开签约发布会，共同宣布全球网络安全盛会DEFCON 将于今年正式登陆中国。"}
{"title": "CNCERT关于软件下载站传播计算机恶意程序情况的通报", "url": "https://www.freebuf.com/news/162826.html", "time": "2018-02-13", "level": "", "num_look": 282947, "num_comment": 6, "author": "CNCERT", "tags": ["资讯"], "text": "近期，CNCERT针对软件下载站展开计算机恶意程序监测行动，随机抽取了下载站的样本4424个，判定其中含有计算机恶意程序142个，涉及6家软件下载站。"}
{"title": "深信服研发安全岗位内部推荐", "url": "https://www.freebuf.com/news/162581.html", "time": "2018-02-13", "level": "", "num_look": 286547, "num_comment": 12, "author": "常运", "tags": ["资讯"], "text": "“中国卓越雇主”——深信服科技成立于2000年，是中国最大的新网络产品供应商，致力于提供基于创新网络的产品及解决方案，深信服业务涵盖两大领域：网络安全、虚拟化&云计算。"}
{"title": "ADB配置提权漏洞（CVE-2017-13212）原理与利用分析", "url": "https://www.freebuf.com/articles/terminal/161843.html", "time": "2018-02-13", "level": "现金奖励", "num_look": 428981, "num_comment": 4, "author": "Tasfa", "tags": ["终端安全"], "text": "adb由于拥有shell权限，因此仅在授权PC端后才可使用shell权限，而通过该漏洞，可以实现在移动端获取shell权限，以致于可随意删除应用、屏幕截图等等高权限操作。"}
{"title": "CVE-2018-4878 Flash 0day漏洞攻击样本解析", "url": "https://www.freebuf.com/vuls/162493.html", "time": "2018-02-13", "level": "", "num_look": 464710, "num_comment": 464710, "author": "奇安信威胁情报中心", "tags": ["漏洞"], "text": "2018年1月31日，韩国CERT发布公告称发现Flash 0day漏洞的野外利用，攻击者执行针对性的攻击。"}
{"title": "就一加手机支付漏洞讨论在线支付中的安全风险", "url": "https://www.freebuf.com/vuls/161449.html", "time": "2018-02-12", "level": "", "num_look": 382118, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["漏洞", "观点"], "text": "很多一加手机论坛用户表示他们在2017年11月份曾在OnePlus官网上进行过信用卡消费，而随后信用卡欺诈事件便发生在了这些用户的身上。"}
{"title": "CNCERT 2018年1月我国DDoS攻击资源分析报告", "url": "https://www.freebuf.com/articles/network/162825.html", "time": "2018-02-12", "level": "", "num_look": 492850, "num_comment": 2, "author": "CNCERT", "tags": ["网络安全"], "text": "本报告为2018年1月份的DDoS攻击资源月度分析报告。围绕互联网环境威胁治理问题，基于CNCERT监测的DDoS攻击事件数据进行抽样分析。"}
{"title": "58集团诚招安全人才", "url": "https://www.freebuf.com/news/162200.html", "time": "2018-02-12", "level": "", "num_look": 318018, "num_comment": 2, "author": "58ganji", "tags": ["资讯"], "text": "58同城从属于北京五八信息技术有限公司，成立于2005年12月，已成为中国最大的本地生活服务平台，业务覆盖招聘、房产、汽车、金融、二手及生活服务等各个领域。"}
{"title": "TinyShop缓存文件获取WebShell之0day", "url": "https://www.freebuf.com/vuls/161409.html", "time": "2018-02-12", "level": "现金奖励", "num_look": 457811, "num_comment": 9, "author": "simeon", "tags": ["漏洞"], "text": "TinyShop一款电子商务系统（网店系统），适合企业及个人快速构建个性化网上商店。系统是基于Tiny（自主研发）框架开发的，使系统更加的安全、快捷、稳定、高性能。"}
{"title": "Rapid勒索病毒分析与检测", "url": "https://www.freebuf.com/articles/network/162033.html", "time": "2018-02-12", "level": "", "num_look": 470297, "num_comment": 5, "author": "兰云科技银河实验室", "tags": ["网络安全"], "text": "勒索病毒一直是安全行业的一个热点，近期安全人员发现了一款名为rapid的勒索病毒，该勒索病毒使用了 RSA加AES对文件进行加密。"}
{"title": "2017年网络诈骗趋势研究报告", "url": "https://www.freebuf.com/articles/paper/161746.html", "time": "2018-02-11", "level": "", "num_look": 391552, "num_comment": 4, "author": "360安全", "tags": ["安全报告"], "text": "2017年猎网平台共收到全国用户提交的有效网络诈骗举报24260例，举报总金额3.50亿余元，人均损失14413.4元。与2016年相比，网络诈骗的举报数量增长了17.6%，人均损失却增长了52.2%。"}
{"title": "几维安全2018招聘人才", "url": "https://www.freebuf.com/jobs/161908.html", "time": "2018-02-11", "level": "", "num_look": 264934, "num_comment": 4, "author": "lpcdma", "tags": ["安全招聘"], "text": "几维安全(“成都盈海益讯科技有限公司”)，成立于2014年11月，是一家专注于移动安全的高新技术企业，总部位于成都。"}
{"title": "安全运维 | Perl oneline定位网站攻击源，通过iptables封禁", "url": "https://www.freebuf.com/articles/web/161790.html", "time": "2018-02-11", "level": "现金奖励", "num_look": 465487, "num_comment": 4, "author": "ijzmesec", "tags": ["WEB安全"], "text": "Web网站日常运维运营时候怎么发现攻击，怎们即时阻断未遂的攻击呢？除了高大上的IDS，IPS，其实个人通过简单一些命令小工具通过分析流量，分析访问日志就能发现这种企图。"}
{"title": "安全为什么会成为国家工业互联网三大体系之一？", "url": "https://www.freebuf.com/news/162081.html", "time": "2018-02-11", "level": "", "num_look": 354250, "num_comment": 3, "author": "360企业安全", "tags": ["观点", "资讯"], "text": "2 月 1 日，2018 工业互联网峰会在北京举行，这是工业互联网领域最高规格的会议，在整个峰会期间，安全被提到了前所未有的高度，与网络、平台并列成为工业互联网的三大功能体系。"}
{"title": "重磅 | FreeBuf与威胁猎人联手发布黑镜调查：深渊背后的真相之「短视频黑灰产业」报告", "url": "https://www.freebuf.com/news/topnews/162014.html", "time": "2018-02-10", "level": "红色标题", "num_look": 959938, "num_comment": 11, "author": "FreeBuf咨询", "tags": ["头条", "安全报告"], "text": "王思聪撒的币到底进了谁的口袋？复活码也促成了新的生意？巨大的网络流量最终何去何从？"}
{"title": "iOS 9关键组件iBoot源码泄漏到GitHub，目前已经紧急删除", "url": "https://www.freebuf.com/news/162639.html", "time": "2018-02-10", "level": "", "num_look": 419468, "num_comment": 10, "author": "shidongqi", "tags": ["资讯"], "text": "近期，以安全著称的苹果iOS系统被曝出iBoot源码泄漏，被发布到GitHub，这几乎是iOS系统有史以来遭遇到的最大的安全事故了。"}
{"title": "2017年ICS安全回顾：关键基础设施比人们预想的更脆弱", "url": "https://www.freebuf.com/articles/neopoints/162072.html", "time": "2018-02-10", "level": "", "num_look": 287521, "num_comment": 4, "author": "AngelaY", "tags": ["观点"], "text": "日益猛烈的网络攻击让人们普遍意识到网络安全的重要性。而 Stunx 震网病毒之后频繁发生的针对关键基础设施的网络攻击，让硬件以及数据相关的危险。"}
{"title": "年薪千万的“黄金矿工”：PC平台挖矿木马研究报告", "url": "https://www.freebuf.com/articles/paper/162404.html", "time": "2018-02-10", "level": "", "num_look": 459111, "num_comment": 1, "author": "360安全", "tags": ["安全报告"], "text": "2018年预计将是挖矿木马爆发的一年，将全面利用现有网络机制和系统平台存在安全漏洞，在更大范围，更多领域进行传播。"}
{"title": "南瑞信通公司招聘安全人才", "url": "https://www.freebuf.com/jobs/162331.html", "time": "2018-02-10", "level": "", "num_look": 366433, "num_comment": 4, "author": "nrxt258", "tags": ["安全招聘"], "text": "南瑞信息通信技术分公司（南瑞信通公司）是南瑞集团下属产业公司之一，是信息通信及网络安全板块的支柱企业。"}
{"title": "快讯 | 任天堂 Switch 遭 fail0verflow 黑客组织破解，已可运行 Linux 系统", "url": "https://www.freebuf.com/news/162756.html", "time": "2018-02-10", "level": "红色标题", "num_look": 517283, "num_comment": 2, "author": "Elaine_z", "tags": ["漏洞", "终端安全"], "text": "很好，你想不想也在Switch上也安装一下 Debian？当然黑客破解主机的用途不仅如此……"}
{"title": "FreeBuf 2018年企业安全月报（一月刊）", "url": "https://www.freebuf.com/news/162455.html", "time": "2018-02-10", "level": "", "num_look": 299564, "num_comment": 3, "author": "Sphinx", "tags": ["资讯"], "text": "自2018年1月起，我们将持续为大家提供关于企业安全方面的资讯。资讯以月报形式发出，帮助企业在防范安全漏洞的同时掌握安全市场的最新动态，让企业能够及时地做出应对措施。"}
{"title": "手把手教你修改旅行青蛙三叶草抽奖券数", "url": "https://www.freebuf.com/articles/web/162030.html", "time": "2018-02-10", "level": "现金奖励", "num_look": 1223186, "num_comment": 39, "author": "冰海", "tags": ["WEB安全", "终端安全"], "text": "2018年元旦过后，一款旅行青蛙（原名旅かえる）的放置类手游迅速受到广大有爱青年的热捧，朋友圈、微博、知乎等掀起了一场母爱泛滥的晒蛙风。"}
{"title": "通过Metasploit+Ngrok穿透内网长期维持访问外网Android设备", "url": "https://www.freebuf.com/sectool/162046.html", "time": "2018-02-10", "level": "现金奖励", "num_look": 815860, "num_comment": 23, "author": "艾登——皮尔斯", "tags": ["工具"], "text": "因为之前作为小白我不会在Kali Linux里面把IP映射出外网，卡在那个地方很久，后来解决了这个问题就写方法出来和大家分享分享。"}
{"title": "反编译分析吃鸡辅助器外挂：无外挂功能，疑诈骗钱财", "url": "https://www.freebuf.com/articles/terminal/162190.html", "time": "2018-02-10", "level": "", "num_look": 779575, "num_comment": 8, "author": "腾讯手机管家", "tags": ["游戏安全", "终端安全"], "text": "腾讯移动安全实验室发现一个吃鸡辅助器的欺诈样本，用户需支付一定金额开启外挂功能，但该样本本身并没有外挂功能。因涉及诈骗用户钱财，建议关注。"}
{"title": "BUF早餐铺 | 苹果iBoot源代码在GitHub上泄漏;加州选民数据库在此发生在线泄漏事件;Chrome浏览器7月开始会将所有http站点列为不安全", "url": "https://www.freebuf.com/news/162630.html", "time": "2018-02-10", "level": "", "num_look": 260321, "num_comment": 9, "author": "Elaine_z", "tags": ["资讯"], "text": "新年有什么新的目标呢，可以来告诉FB小编我呀？"}
{"title": "HTTPS时代到来 | 谷歌七月开始将会把所有HTTP站点标记为不安全", "url": "https://www.freebuf.com/news/162667.html", "time": "2018-02-09", "level": "", "num_look": 284288, "num_comment": 10, "author": "AngelaY", "tags": ["资讯"], "text": "谷歌近日宣布，2018 年 7 月计划发布 Google Chrome 68，自那时起，将把 Chrome 上所有 HTTP 站点都标记为“不安全”。"}
{"title": "CNCERT 2017年钓鱼网站分布趋势报告", "url": "https://www.freebuf.com/articles/paper/162341.html", "time": "2018-02-09", "level": "", "num_look": 239322, "num_comment": 1, "author": "CNCERT", "tags": ["安全报告"], "text": "2017年，CNCERT所处置的钓鱼网站IP地址绝大多数依然位于境外,占比达88.2%，针对境内目标的钓鱼网站IP地址持续向境外转移。"}
{"title": "Cloudflare.Solutions Keylogger回归：这次换了新的域名", "url": "https://www.freebuf.com/articles/web/161458.html", "time": "2018-02-09", "level": "", "num_look": 269419, "num_comment": 269419, "author": "secist", "tags": ["WEB安全"], "text": "几个月前，我们曾在我们发布的短文中介绍过两个来源于“cloudflare.solutions”域的恶意脚本。"}
{"title": "ADB.Miner：恶意代码正在利用开放了ADB接口的安卓设备挖矿", "url": "https://www.freebuf.com/articles/terminal/162096.html", "time": "2018-02-09", "level": "红色标题", "num_look": 351431, "num_comment": 2, "author": "360安全", "tags": ["终端安全"], "text": "从 2018-02-03 15:00 开始，一组恶意代码开始蠕虫式快速传播，360网络安全研究院分析了这个安全威胁。"}
{"title": "海航科技集团安全人才招聘", "url": "https://www.freebuf.com/jobs/162233.html", "time": "2018-02-09", "level": "", "num_look": 221396, "num_comment": 8, "author": "neway", "tags": ["安全招聘"], "text": "海航科技集团成立于 2016 年 12 月，是世界500强企业海航集团面向未来战略布局的大型产业控股集团，总部设立在中国上海。"}
{"title": "FreeBuf街采 | 新年第一弹！FB小姐姐的信息安全小调查", "url": "https://www.freebuf.com/news/162634.html", "time": "2018-02-09", "level": "红色标题", "num_look": 351077, "num_comment": 8, "author": "Akane", "tags": ["活动", "资讯"], "text": "岁末年初，FB TV 推出全新视频节目——FreeBuf 街采。关注安全点滴、寻找街头大神，跟着咱们的主播小茗一起去看看吧。"}
{"title": "Web黑盒渗透思路之猜想", "url": "https://www.freebuf.com/articles/web/161491.html", "time": "2018-02-09", "level": "现金奖励", "num_look": 592044, "num_comment": 17, "author": "心东", "tags": ["WEB安全"], "text": "后台爆破很多人都会选择最经典的模式，如字典爆破，挖掘未授权访问漏洞，挖掘验证码漏洞（未刷新，验证码识别）等方法。"}
{"title": "MySQL弱口令漏洞的重现和利用", "url": "https://www.freebuf.com/news/162036.html", "time": "2018-02-09", "level": "", "num_look": 912140, "num_comment": 10, "author": "flurry", "tags": [], "text": "本文详细介绍了如何在fedora26上部署mysql，以及如何利用hydra暴力破解mysql弱口令密码并利用mysql服务写入一句话木马连接菜刀。"}
{"title": "旧饭新炒之Intel AMT提权漏洞（CVE-2017-5689）后续利用", "url": "https://www.freebuf.com/vuls/161618.html", "time": "2018-02-09", "level": "", "num_look": 653214, "num_comment": 5, "author": "test124", "tags": ["漏洞"], "text": "之前的一篇Intel产品AMT本地及远程提权漏洞（CVE-2017-5689）复现，只是简单的复现了该漏洞，在文章最后提及到了如果进一步对该漏洞进行利用。但是有些大佬们看了一眼后觉得搞了几个并不知道如何利用。"}
{"title": "BUF早餐铺 | 银联云闪付APP邀请链接被曝泄漏手机号；Adobe推出紧急补丁修复朝鲜黑客利用的漏洞；思科再次发布补丁修复 CISCO ASA 中的严重漏洞；伪装名人骗取以太币，黑客一晚赚5000美元", "url": "https://www.freebuf.com/news/162597.html", "time": "2018-02-09", "level": "", "num_look": 289722, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "想必很多小伙伴已经踏上回家过年的路，还在公司上班的童鞋别灰心，还有小编的早餐铺陪你耍。"}
{"title": "Adobe推出紧急补丁修复朝鲜利用的CVE-2018-4878漏洞", "url": "https://www.freebuf.com/news/162556.html", "time": "2018-02-08", "level": "", "num_look": 224121, "num_comment": 4, "author": "Sphinx", "tags": ["资讯"], "text": "Adobe推出了一个紧急修补程序，修复了两个严重的远程执行漏洞，包括朝鲜利用的CVE-2018-4878漏洞。"}
{"title": "谷歌2017年漏洞奖励金额支出高达290万美元", "url": "https://www.freebuf.com/news/162492.html", "time": "2018-02-08", "level": "", "num_look": 211959, "num_comment": 211959, "author": "Elaine_z", "tags": ["资讯"], "text": "2018年已经来临，据说经历了辛苦挖洞的一年，白帽子们纷纷收获了一个“鼓鼓囊囊”的钱包了……"}
{"title": "创新 突破 成长 | 回顾2017年斗象科技成绩单", "url": "https://www.freebuf.com/special/162537.html", "time": "2018-02-08", "level": "红色标题", "num_look": 303419, "num_comment": 8, "author": "FB独家", "tags": ["特别企划"], "text": "一张图回顾斗象科技（FreeBuf所属公司）的2017年！"}
{"title": "数千知名国内网站被挂挖矿，原来竟是广告联盟监守自盗", "url": "https://www.freebuf.com/articles/web/162520.html", "time": "2018-02-08", "level": "", "num_look": 623424, "num_comment": 21, "author": "360安全", "tags": ["WEB安全"], "text": "日前，360云安全系统监测到，国内某DSP广告平台被嵌入了挖矿脚本，该脚本随广告平台投放的广告一起插入到了网页中，进而传播。"}
{"title": "CSS代码可能被用来收集敏感用户数据", "url": "https://www.freebuf.com/articles/web/162445.html", "time": "2018-02-08", "level": "", "num_look": 341055, "num_comment": 1, "author": "Sphinx", "tags": ["WEB安全"], "text": "CSS不仅在网页展现时强大，在追踪用户时也能发挥作用。它能够追踪网站用户，从网页中提取和窃取数据，收集表单域中输入的数据（包括密码），甚至让暗网用户暴露身份。"}
{"title": "央企Car Hacking Team诚招各路安全大咖", "url": "https://www.freebuf.com/jobs/162091.html", "time": "2018-02-08", "level": "", "num_look": 371306, "num_comment": 14, "author": "数据资源中心", "tags": ["安全招聘"], "text": "中国汽车技术研究中心-数据资源中心 Car Hacking Team 诚招各路大牛加入！"}
{"title": "任意用户密码重置（三）：用户混淆", "url": "https://www.freebuf.com/articles/web/162152.html", "time": "2018-02-08", "level": "现金奖励", "num_look": 743010, "num_comment": 35, "author": "yangyangwithgnu", "tags": ["WEB安全"], "text": "密码找回逻辑含有用户标识（用户名、用户 ID、cookie）、接收端（手机、邮箱）、凭证（验证码、token）、当前步骤等四个要素，"}
{"title": "远程代码执行漏洞如何利用微软CVE-2017-8570", "url": "https://www.freebuf.com/articles/system/161854.html", "time": "2018-02-08", "level": "", "num_look": 299662, "num_comment": 1, "author": "瀚思科技", "tags": ["系统安全"], "text": "CVE-2017-8570 这个漏洞影响office所有发行版本，攻击者会诱导用户点击打开利用了该漏洞的恶意office文件。"}
{"title": "思科、苹果、安联以及怡安联手推出面向企业的网络风险管理解决方案", "url": "https://www.freebuf.com/articles/es/162408.html", "time": "2018-02-08", "level": "红色标题", "num_look": 342452, "num_comment": 2, "author": "shidongqi", "tags": ["企业安全"], "text": "思科、苹果、怡安和安联集团今天宣布推出一项面向企业的网络风险管理解决方案。"}
{"title": "Flash 0Day漏洞（CVE-2018-4878）原理及利用代码分析", "url": "https://www.freebuf.com/vuls/162369.html", "time": "2018-02-08", "level": "", "num_look": 555391, "num_comment": 3, "author": "腾讯电脑管家", "tags": ["漏洞"], "text": "一个新的Flash 0Day漏洞（CVE-2018-4878）已经存在野外利用，可针对Windows用户发起定向攻击。"}
{"title": "BUF早餐铺 | 新安卓恶意挖矿软件正迅速传播;CSS 代码可能被用来收集敏感用户数据;微博“高仿号”冒充海外好友实施诈骗", "url": "https://www.freebuf.com/news/162473.html", "time": "2018-02-08", "level": "", "num_look": 188583, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "腊月今知晦，流年此夕除。拾樵供岁火，帖牖作春书。"}
{"title": "快讯 | 朋友圈被马斯克刷屏？社工骗子已经下手了", "url": "https://www.freebuf.com/news/162432.html", "time": "2018-02-07", "level": "红色标题", "num_look": 376881, "num_comment": 8, "author": "AngelaY", "tags": ["资讯"], "text": "今天，SpaceX “重型猎鹰”首飞成功，马斯克的推特聚满了粉丝。而社工骗子正是利用这个机会，赚了一笔。"}
{"title": "如何在2018年的网络世界里保护自己和家人的信息安全", "url": "https://www.freebuf.com/articles/database/161938.html", "time": "2018-02-07", "level": "", "num_look": 437240, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["数据安全"], "text": "随着科技的快速发展，2018年的世界可能是一个处处都接入了网络的世界，那我们怎么在这种新时代中保护自己和家人的个人数据安全呢？"}
{"title": "朝鲜又中枪，近期Adobe Flash 0-Day攻击幕后黑手竟然是他？", "url": "https://www.freebuf.com/news/162303.html", "time": "2018-02-07", "level": "", "num_look": 234814, "num_comment": 5, "author": "shidongqi", "tags": ["资讯"], "text": "据思科和FireEye的安全研究人员称，韩国黑客组织是最近发现Adobe Flash 0Day漏洞攻击的幕后黑手。"}
{"title": "新浪安全2018年招聘计划", "url": "https://www.freebuf.com/jobs/161936.html", "time": "2018-02-07", "level": "", "num_look": 232443, "num_comment": 7, "author": "-吗_啡-", "tags": ["安全招聘"], "text": "新浪公司是一家服务于中国及全球华人社群的网络媒体公司。"}
{"title": "流密码与RC4密码初认识", "url": "https://www.freebuf.com/news/160891.html", "time": "2018-02-07", "level": "", "num_look": 375429, "num_comment": 7, "author": "淼淼兮与怀", "tags": [], "text": "流密码是对称密码算法，是私钥密码系统中的一个分组。流密码的转换是随\"变换\"而变换的，像水流一样源源不断的产生，是对称密码算法，从明文输入流逐位或逐字节产生密文输出。"}
{"title": "ZZCMS v8.2 最新版SQL注入漏洞", "url": "https://www.freebuf.com/vuls/161888.html", "time": "2018-02-07", "level": "现金奖励", "num_look": 1013561, "num_comment": 18, "author": "vr_system", "tags": ["WEB安全", "漏洞"], "text": "近期一直在致力于审计CMS的漏洞，当审计遇到ZZCMS v8.2，发现SQL注入漏洞。"}
{"title": "别让互联网毁掉童年？浅析未成年人网络安全保护现状", "url": "https://www.freebuf.com/special/162059.html", "time": "2018-02-07", "level": "红色标题", "num_look": 985457, "num_comment": 20, "author": "shidongqi", "tags": ["特别企划"], "text": "在街上看到一群小学生围坐一起打《王者荣耀》，麦当劳里拿着手机边百度边填写作业等现象也频繁出现在我们日常生活中，互联网所传递的一些不良信息极易给孩子带来潜移默化的影响。"}
{"title": "2017年Android“间谍软件”年度总结报告", "url": "https://www.freebuf.com/articles/terminal/161839.html", "time": "2018-02-07", "level": "", "num_look": 425219, "num_comment": 425219, "author": "腾讯手机管家", "tags": ["终端安全"], "text": "随着移动互联网的飞速发展，智能手机已成为我们日常生活中不可或缺的工具。社交、娱乐、金融服务，智能手机在为我们提供便捷服务的同时也携带了大量的个人敏感数据。"}
{"title": "BUF早餐铺 | 朝鲜黑客组织是Adobe Flash 0day漏洞攻击的幕后黑手；上海某公立医院HIS系统被黑，勒索2亿", "url": "https://www.freebuf.com/news/162387.html", "time": "2018-02-07", "level": "红色标题", "num_look": 242941, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "江南腊月前溪上，照水野梅多少株。"}
{"title": "揭秘密码黑市，你所不知道的地下交易", "url": "https://www.freebuf.com/news/161842.html", "time": "2018-02-06", "level": "", "num_look": 704399, "num_comment": 8, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "在这篇文章中，我们将跟大家讨论有关电子商务网站、银行网站、以及热门在线服务中用户被盗凭证的一些故事。并且一起来看一看，攻击者如何通过窃取用户密码来发大财…"}
{"title": "中国信息安全从业人员现状调研报告（2017年度）正式发布", "url": "https://www.freebuf.com/articles/paper/162288.html", "time": "2018-02-06", "level": "", "num_look": 504321, "num_comment": 16, "author": "FB客服", "tags": ["安全报告"], "text": "网络安全已成为事关经济社会发展、国家长治久安和人民群众福祉的重大战略问题，建立一支规模宏大、结构优化、素质优良的网络安全人才队伍已成为维护国家网络安全和建设网络强国的核心需求。"}
{"title": "平安科技安全平台部招聘安全运营工程师", "url": "https://www.freebuf.com/jobs/162229.html", "time": "2018-02-06", "level": "", "num_look": 362292, "num_comment": 5, "author": "dulai0103", "tags": ["安全招聘"], "text": "平安科技是平安集团旗下的全资子公司，是平安集团的高科技内核。"}
{"title": "一个人的安全部之ELK接收Paloalto日志并用钉钉告警", "url": "https://www.freebuf.com/articles/others-articles/161905.html", "time": "2018-02-06", "level": "现金奖励", "num_look": 825243, "num_comment": 21, "author": "站着洗澡", "tags": ["其他", "观点"], "text": "通报漏洞后，开发未能及时修复漏洞，导致被攻击，领导说我发现被攻击的时间晚了，由于一个人安全部精力有限未能及时看IPS告警，于是做了个钉钉告警。"}
{"title": "CODESYS WebVisu产品出现严重漏洞，影响100多款ICS系统", "url": "https://www.freebuf.com/news/162123.html", "time": "2018-02-06", "level": "", "num_look": 242495, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "3S-Smart Software Solutions 的 CODESYS WebVisu 产品所使用的 Web 服务器组件存在基于堆栈的缓冲区溢出漏洞，116 款 ICS 系统都可能受到影响。"}
{"title": "技术分析 | 新型勒索病毒Mindlost", "url": "https://www.freebuf.com/articles/network/162080.html", "time": "2018-02-06", "level": "", "num_look": 521018, "num_comment": 7, "author": "阿里云安全", "tags": ["网络安全"], "text": "1月15日，安全研究组织MalwareHunter发现了Mindlost勒索软件的第一批样本。"}
{"title": "勒索之殇 | 从一个.NET病毒看透勒索三步曲", "url": "https://www.freebuf.com/articles/network/161744.html", "time": "2018-02-06", "level": "金币+5", "num_look": 359700, "num_comment": 4, "author": "0zapt4toM", "tags": ["网络安全"], "text": "近三年的病毒走势大致可以总结为，2016年\"流氓\"，2017\"勒索\"，2018年\"挖矿\"，这篇文章我们就通过分析一个.Net的勒索软件，看看一个勒索软件到底是如何工作的。"}
{"title": "BUF 早餐铺 | CODESYS WebVisu 产品出现严重漏洞，影响 100 多款 ICS 系统；俄罗斯暗网出现新勒索软件 GrandCrab；CoinCheck 遭攻击后，日本金融监管机构开始审计", "url": "https://www.freebuf.com/news/162252.html", "time": "2018-02-06", "level": "", "num_look": 287492, "num_comment": 2, "author": "Sphinx", "tags": ["资讯"], "text": "Firefox 59将添加新的隐私功能，从URL中删除敏感数据；监管升级 中国对境外虚拟货币交易所采取措施。"}
{"title": "谍中谍 | 荷兰情报机构掌握了俄对美大选网络攻击的关键证据！？", "url": "https://www.freebuf.com/news/161494.html", "time": "2018-02-05", "level": "", "num_look": 259878, "num_comment": 7, "author": "clouds", "tags": ["资讯"], "text": "近期，荷兰媒体报料称，荷兰国家情报局（AIVD）曾向美国联邦调查局（FBI）提供了关于俄罗斯政府黑客网络攻击美国大选的“可靠性”关键证据。"}
{"title": "中国铁虎APT又回来了，专门针对亚洲、美国政府及其它组织", "url": "https://www.freebuf.com/news/162088.html", "time": "2018-02-05", "level": "", "num_look": 356709, "num_comment": 6, "author": "shidongqi", "tags": ["资讯"], "text": "中国APT铁虎又回来了，被PZChao行动称为新的战役，针对亚洲和美国的政府，科技，教育以及电信组织。"}
{"title": "任意用户密码重置（二）：重置凭证接收端可篡改", "url": "https://www.freebuf.com/articles/database/161495.html", "time": "2018-02-05", "level": "现金奖励", "num_look": 818804, "num_comment": 25, "author": "yangyangwithgnu", "tags": ["数据安全"], "text": "在逻辑漏洞中，任意用户密码重置最为常见，可能出现在新用户注册页面，也可能是用户登录后重置密码的页面，或者用户忘记密码时的密码找回页面，其中，密码找回功能是重灾区。"}
{"title": "CVE-2017-8570首次公开的野外样本及漏洞分析", "url": "https://www.freebuf.com/vuls/161607.html", "time": "2018-02-05", "level": "红色标题", "num_look": 582380, "num_comment": 10, "author": "奇安信威胁情报中心", "tags": ["漏洞"], "text": "这批Exploit样本实际上是CVE-2017-0199的另外一种利用方式，在微软2017年4月份的补丁中已经针对CVE-2017-0199这种利用方式实行了修补。"}
{"title": "区块链安全技术：企业应用区块链技术时如何考量？", "url": "https://www.freebuf.com/articles/neopoints/160251.html", "time": "2018-02-05", "level": "红色标题", "num_look": 620263, "num_comment": 5, "author": "kylin1415", "tags": ["区块链安全", "特别企划"], "text": "“幻想”容易引起“泡沫”的堆积，让我们拨开云雾，看看应用区块链技术时可以考虑的安全防护问题……"}
{"title": "螳螂捕蝉黄雀在后，通过.onion域名转移支付的勒索比特币", "url": "https://www.freebuf.com/articles/web/161857.html", "time": "2018-02-05", "level": "", "num_look": 355769, "num_comment": 355769, "author": "JingleCats", "tags": ["WEB安全"], "text": "Proofpoint的研究人员对之前未曾报道过的一种威胁进行跟踪，发现代理运营者通过Tor代理onion[.]top盗取比特币。"}
{"title": "Buf 早餐铺 |  WannaMine：通过永恒之蓝传播的挖矿病毒；Smominru僵尸网络出现，影响 5万台Win设备;98.5%安卓APP获取用户隐私权限", "url": "https://www.freebuf.com/news/162005.html", "time": "2018-02-05", "level": "", "num_look": 247785, "num_comment": 247785, "author": "Elaine_z", "tags": ["资讯"], "text": "豆浆油条小笼包，冬日暖心好搭配，2月Buffer都要继续努力呀！"}
{"title": "Joy：一款用于捕获和分析网络内部流量数据的工具", "url": "https://www.freebuf.com/sectool/161431.html", "time": "2018-02-04", "level": "", "num_look": 555368, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Joy的工具，该工具能够捕捉并分析网络流数据以及系统内部流数据，研究人员可以利用这些数据以及分析结果来进行网络研究、取证以及安全监控等活动。"}
{"title": "Adobe Flash零日漏洞（cve-2018-4878）在野攻击预警分析", "url": "https://www.freebuf.com/vuls/162049.html", "time": "2018-02-04", "level": "红色标题", "num_look": 517644, "num_comment": 3, "author": "360安全", "tags": ["漏洞"], "text": "2月1日， Adobe官方发布了Adobe Flash Player系列产品的安全通告（APSA18-01），一个最新的Adobe Flash零日漏洞被发现针对韩国地区的人员发起攻击。"}
{"title": "PHP代码安全杂谈", "url": "https://www.freebuf.com/news/161474.html", "time": "2018-02-04", "level": "金币+15", "num_look": 634062, "num_comment": 8, "author": "国光", "tags": [], "text": "虽然PHP是世界上最好的语言,但是也有一些因为弱类型语言的安全性问题出现。"}
{"title": "2017年中国网络安全报告", "url": "https://www.freebuf.com/articles/paper/161600.html", "time": "2018-02-04", "level": "", "num_look": 617001, "num_comment": 6, "author": "瑞星", "tags": ["安全报告"], "text": "本报告涵盖恶意软件与恶意网址、移动安全、互联网安全、趋势展望等多个章节，从解各方面分析 2017 中国网络安全态势。"}
{"title": "2018年Google官方发布：2017年我们跟不良应用和恶意开发者都做了哪些斗争", "url": "https://www.freebuf.com/articles/security-management/162031.html", "time": "2018-02-03", "level": "", "num_look": 455515, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["安全管理"], "text": "硬件设备的灵魂就是应用程序，GooglePlay应用商店一直致力于为数十亿Android用户提供安全性强且体验度高的应用程序。"}
{"title": "Paperclip中的服务器端请求伪造（SSRF）漏洞分析", "url": "https://www.freebuf.com/news/161453.html", "time": "2018-02-03", "level": "", "num_look": 258802, "num_comment": 258802, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "可能有的同学已经收到了GitHub在2018年1月22日推送的CVE-2017-0899漏洞警告了。"}
{"title": "【FB TV】一周「BUF大事件」：百度外卖系统遭非法侵入；世界经济论坛宣布成立全球网络安全中心；漏洞盒子2017年燃血季后赛完美收官", "url": "https://www.freebuf.com/video/161988.html", "time": "2018-02-03", "level": "红色标题", "num_look": 443872, "num_comment": 1, "author": "willhuang", "tags": ["视频"], "text": "百度外卖系统遭非法侵入；世界经济论坛宣布成立全球网络安全中心；漏洞盒子2017年燃血季后赛完美收官"}
{"title": "疑似俄罗斯黑客报复，荷兰三大银行及税务机构遭DDoS攻击", "url": "https://www.freebuf.com/news/161754.html", "time": "2018-02-03", "level": "", "num_look": 279098, "num_comment": 279098, "author": "shidongqi", "tags": ["资讯"], "text": "本周初，大规模的DDoS攻击了针对三个荷兰银行ABN AMRO、ING银行、荷兰合作银行以及荷兰税务管理局。针对ABN AMRO银行系统的攻击从上周末就已经开始，而ING银行和荷兰合作银行在周一也遭受了同样的DDoS攻击。"}
{"title": "“捉迷藏”IoT僵尸网络，以自定义P2P形式进行传播感染的新型僵尸网络", "url": "https://www.freebuf.com/articles/network/161456.html", "time": "2018-02-02", "level": "", "num_look": 452016, "num_comment": 1, "author": "clouds", "tags": ["网络安全"], "text": "近日，Bitdefender安全研究人员通过蜜罐系统捕获了一种物联网（IoT）僵尸网络，该僵尸网络利用自定义P2P技术进行传播控制。"}
{"title": "火狐浏览器出现严重远程代码执行漏洞，现已修复", "url": "https://www.freebuf.com/news/161924.html", "time": "2018-02-02", "level": "", "num_look": 398679, "num_comment": 2, "author": "Sphinx", "tags": ["资讯"], "text": "Mozilla发布了Firefox浏览器的重要更新，修补了一个严重的漏洞，这个漏洞能让远程攻击者在受影响计算机上执行恶意代码。"}
{"title": "快讯 | 韩国发布新在野Flash 0day漏洞警告：朝鲜黑客正在利用", "url": "https://www.freebuf.com/vuls/161995.html", "time": "2018-02-02", "level": "红色标题", "num_look": 406371, "num_comment": 4, "author": "Elaine_z", "tags": ["漏洞"], "text": "朝鲜的黑客已经成功利用了这个0day 漏洞，他们其实自 2017 年 11 月中旬就开始实施攻击。"}
{"title": "Python无损音乐搜索引擎", "url": "https://www.freebuf.com/geek/161418.html", "time": "2018-02-02", "level": "金币+15", "num_look": 956017, "num_comment": 46, "author": "chinapython", "tags": ["极客"], "text": "研究了一段时间酷狗音乐的接口，完美破解了其vip音乐下载方式，想着能更好的追求开源，故写下此篇文章，本文仅供学习参考。"}
{"title": "在美国政府之前，英特尔提前告知中国巨头企业关于CPU漏洞的信息", "url": "https://www.freebuf.com/news/161598.html", "time": "2018-02-02", "level": "", "num_look": 288012, "num_comment": 288012, "author": "shidongqi", "tags": ["资讯"], "text": "在告知美国政府之前，英特尔曾警告中国企业有关臭名昭著的Meltdown和Spectre处理器漏洞问题。"}
{"title": "WEB访问日志自动化分析浅谈", "url": "https://www.freebuf.com/articles/security-management/161546.html", "time": "2018-02-02", "level": "现金奖励", "num_look": 784176, "num_comment": 14, "author": "0xExploit", "tags": ["安全管理"], "text": "最近经常需要分析WEB访问日志，从中发现非法请求，然后做相应安全检查，为了方便，所以写了一个日志分析平台，支持提交iis,apapche,tomcat,ngnix等日志格式，代码使用python语言。"}
{"title": "BUF早餐铺 | 利用Meltdown和Spectre漏洞的恶意程序开始出现；Windows Defender将主动清理恶意勒索软件软件；Firefox浏览器修复严重远程代码执行漏洞", "url": "https://www.freebuf.com/news/161913.html", "time": "2018-02-02", "level": "", "num_look": 276696, "num_comment": 276696, "author": "shidongqi", "tags": ["资讯"], "text": "春节（劫）将至，各位Buffer准备好了吗？"}
{"title": "CNCERT 2017年第四季度国内操作系统及浏览器占比情况分析", "url": "https://www.freebuf.com/articles/paper/161841.html", "time": "2018-02-01", "level": "红色标题", "num_look": 407097, "num_comment": 17, "author": "CNCERT", "tags": ["安全报告"], "text": "CNCERT对2017年第四季度国内网络访问情况进行了抽样分析，重点是对操作系统及浏览器占比情况进行了统计，发现一些特点。"}
{"title": "保护物联网安全的6条基本原则，你做到了几条？", "url": "https://www.freebuf.com/articles/system/161410.html", "time": "2018-02-01", "level": "", "num_look": 367603, "num_comment": 2, "author": "柚子", "tags": ["系统安全"], "text": "随着物联网深入普及，点进来看这篇文章的你肯定也听说过各种关于“物联网宿命”的预言。"}
{"title": "2018年美国各州网络犯罪形势预测", "url": "https://www.freebuf.com/news/161243.html", "time": "2018-02-01", "level": "", "num_look": 318405, "num_comment": 2, "author": "柚子", "tags": ["观点", "资讯"], "text": "网络犯罪是美国犯罪活动增长最快的类型，每年受害人数都在不断增加。"}
{"title": "点融招聘安全人才", "url": "https://www.freebuf.com/jobs/161276.html", "time": "2018-02-01", "level": "", "num_look": 267143, "num_comment": 9, "author": "与非门salome", "tags": ["安全招聘"], "text": "由纽交所上市公司Lending Club联合创始人苏海德先生（Soul Htite）与资深金融法律师郭宇航创办，公司致力于使用先进互联网技术和金融创新使投资与借贷更透明、更高效。"}
{"title": "潜伏在视频网站的垃圾营销", "url": "https://www.freebuf.com/articles/web/161655.html", "time": "2018-02-01", "level": "红色标题", "num_look": 390377, "num_comment": 4, "author": "任子行", "tags": ["WEB安全"], "text": "一些视频网站也凭借着流量开始加入各种垃圾营销广告，推广浏览器、色播软件、暗扣陷阱、赌博棋牌等应用。"}
{"title": "尼日利亚黑客发起的BEC攻击", "url": "https://www.freebuf.com/news/161675.html", "time": "2018-02-01", "level": "", "num_look": 459567, "num_comment": 6, "author": "亚信安全", "tags": ["企业安全", "资讯"], "text": "亚信安全发布的2018年安全威胁预测中曾提及，本年度，商业电子邮件攻击（BEC）事件会持续增长，并最终导致全球超过90亿美元的损失。BEC攻击主要依赖于社会工程学，向特定目标发送钓鱼邮件，达到攻击目的。"}
{"title": "代码审计“吃鸡”辅助外挂黑色产业链", "url": "https://www.freebuf.com/articles/system/161518.html", "time": "2018-02-01", "level": "现金奖励", "num_look": 1811920, "num_comment": 54, "author": "Draven", "tags": ["游戏安全", "系统安全"], "text": "为了吃鸡的我，决定只身探险，为大家揭秘这条黑色产业链（找个牛逼的外挂去“吃鸡”）。"}
{"title": "Android平台挖矿木马研究报告", "url": "https://www.freebuf.com/articles/paper/161741.html", "time": "2018-02-01", "level": "", "num_look": 377852, "num_comment": 5, "author": "360安全", "tags": ["安全报告"], "text": "手机挖矿木马就是在用户不知情的情况下利用其手机的计算能力来为攻击者获取电子加密货币的应用程序。"}
{"title": "BUF早餐铺 | 谷歌应用商店下架70多万恶意安卓应用；Facebook屏蔽加密货币和ICO 广告；荷兰银行机构遭DDoS攻击；骗子冒充漏洞平台诈骗白帽子", "url": "https://www.freebuf.com/news/161784.html", "time": "2018-02-01", "level": "", "num_look": 350774, "num_comment": 3, "author": "AngelaY", "tags": ["资讯"], "text": "昨夜月明人尽望，今朝几人吃早餐？"}
{"title": "世界上最大的垃圾邮件僵尸网络正在推广加密货币Swisscoin", "url": "https://www.freebuf.com/news/161197.html", "time": "2018-01-31", "level": "", "num_look": 231882, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "Necurs是目前世界上规模最大的垃圾邮件僵尸网络，而研究人员近期发现，Necurs现在正通过发送垃圾邮件的方法来推广一种名叫Swisscoin（瑞士币）的加密货币。"}
{"title": "CVE-2018-5711：一张GIF图片就能让服务器宕机的PHP漏洞", "url": "https://www.freebuf.com/vuls/161262.html", "time": "2018-01-31", "level": "", "num_look": 621547, "num_comment": 12, "author": "clouds", "tags": ["漏洞"], "text": "台湾 Web 漏洞挖掘大牛 Orange Tsai 发现了 PHP 的 CVE-2018-5711，它能用一张GIF图片就可导致服务器发生崩溃直至宕机，在现实中非常容易利用。本文简单地介绍了这个漏洞。"}
{"title": "确定的世界，不确定的你 | 卫达安全招聘安全人才", "url": "https://www.freebuf.com/jobs/161267.html", "time": "2018-01-31", "level": "", "num_look": 245050, "num_comment": 15, "author": "卫达安全", "tags": ["安全招聘"], "text": "我们正在寻找以下岗位的人才。"}
{"title": "湖湘杯2017 PWN 200格式化字符串漏洞详细WriteUp", "url": "https://www.freebuf.com/vuls/161116.html", "time": "2018-01-31", "level": "金币+10", "num_look": 482742, "num_comment": 9, "author": "Sakura_zero", "tags": ["漏洞"], "text": "pwn题中，有一些是格式化字符串漏洞。也许使用者的目的只是直接输出字符串，但是这段字符串来源于可控的输入，就造成了漏洞。"}
{"title": "企业壳的反调试及Hook检测分析", "url": "https://www.freebuf.com/articles/system/160656.html", "time": "2018-01-31", "level": "现金奖励", "num_look": 565150, "num_comment": 9, "author": "y0nLandroid", "tags": ["企业安全", "系统安全"], "text": "最近在学习梆梆壳，在调试的过程中遇到了反调试，很是苦恼，而且每次调试都会被中断，朋友发了篇帖子介绍了其中的一个反调，学习后收获颇多。"}
{"title": "你的CAD图纸被盗了吗？", "url": "https://www.freebuf.com/articles/database/161074.html", "time": "2018-01-31", "level": "红色标题", "num_look": 599167, "num_comment": 11, "author": "安全豹", "tags": ["数据安全"], "text": "本次分析的样本是CAD脚本动态生产的一种VBS蠕虫病毒，大概10多年前就已经开始通过E-Mail传播此样本，而如今这类病毒依旧活跃着，浮浮沉沉，生生不息。"}
{"title": "移动APP外挂攻防实战", "url": "https://www.freebuf.com/articles/terminal/161308.html", "time": "2018-01-31", "level": "", "num_look": 496065, "num_comment": 14, "author": "阿里聚安全", "tags": ["游戏安全", "终端安全"], "text": "近日，某某龙在2018年的一次会议上发表了一个演讲，4000多人聚集在现场玩“跳一跳”游戏。随着他们指尖的翻飞跳跃，大屏幕上的现场排名也在不断刷新。"}
{"title": "BUF早餐铺 | 联想指纹管理Pro软件中存在硬编码密码漏洞；Tor-to-Web 代理会替换勒索软件的比特币赎金地址；外交部回应中方未来将如何实施VPN方面的管控", "url": "https://www.freebuf.com/news/161606.html", "time": "2018-01-31", "level": "", "num_look": 302424, "num_comment": 5, "author": "Elaine_z", "tags": ["资讯"], "text": "绿蚁新醅酒，红泥小火炉……能饮一杯无？"}
{"title": "绕过安卓SSL验证证书的四种方式", "url": "https://www.freebuf.com/articles/terminal/161472.html", "time": "2018-01-30", "level": "", "num_look": 537442, "num_comment": 9, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "在此之前，移动端应用程序会直接忽略掉所有的SSL错误，并允许攻击者拦截和修改自己的通信流量。"}
{"title": "经验分享 | 树莓派超频全攻略", "url": "https://www.freebuf.com/geek/161452.html", "time": "2018-01-30", "level": "", "num_look": 540944, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["极客"], "text": "树莓派怎么超频？不管是树莓派3还是树莓派2，本文将告诉你怎么让树莓派设备最大化发挥自己的能量。"}
{"title": "金山云招聘安全实习生", "url": "https://www.freebuf.com/jobs/161158.html", "time": "2018-01-30", "level": "", "num_look": 323099, "num_comment": 11, "author": "爸爸的爸爸是爷爷", "tags": ["安全招聘"], "text": "金山云安珀实验室招人啦！研究员性质，接触各个方向，想要大牛带飞节奏的赶紧看过来！"}
{"title": "运动应用Strava公开十亿用户位置热力图，意外泄漏秘密军事基地等信息", "url": "https://www.freebuf.com/news/161499.html", "time": "2018-01-30", "level": "红色标题", "num_look": 501150, "num_comment": 5, "author": "Elaine_z", "tags": ["资讯"], "text": "51区、朝鲜、中国南海等地均存在运动数据，显然Strava热力图中还存在更多隐藏信息。本次事件可谓敲响了企业对于大规模匿名信息公开的警钟……"}
{"title": "遭遇史上最大加密货币被盗案，日本Coincheck将自己掏钱弥补", "url": "https://www.freebuf.com/news/161557.html", "time": "2018-01-30", "level": "", "num_look": 334444, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": "在遭遇黑客攻击后，Coincheck宣布将使用自己的资金补偿约4亿美元给26万客户。"}
{"title": "一款名为Rapid的勒索软件正在迅速传播", "url": "https://www.freebuf.com/articles/database/161299.html", "time": "2018-01-30", "level": "", "num_look": 429175, "num_comment": 8, "author": "JingleCats", "tags": ["数据安全"], "text": "近期安全人员发现，一款名为Rapid的勒索软件正在快速传播"}
{"title": "快讯 |“百度外卖”平台被非法侵入，4900万元额度被篡改", "url": "https://www.freebuf.com/news/161583.html", "time": "2018-01-30", "level": "红色标题", "num_look": 418714, "num_comment": 24, "author": "Akane", "tags": ["资讯"], "text": "“百度外卖”平台系统被非法侵入，4900余万元额度被篡改，直接消费损失30余万元。"}
{"title": "互联网金融黑中介指南", "url": "https://www.freebuf.com/articles/neopoints/161064.html", "time": "2018-01-30", "level": "现金奖励", "num_look": 698071, "num_comment": 22, "author": "mcvoodoo", "tags": ["观点"], "text": "什么是黑中介呢？中介是利用信息不对称来提供服务的一种职业，在中国这差不多是个贬义词。而黑中介则是非正规种渠道。"}
{"title": "BUF 早餐铺 | 运动应用Strava公开十亿用户位置热力图，意外泄漏秘密军事基地的信息；美国国防部长指责俄罗斯监视其关键基础设施情况；phpBB论坛两个包下载链接遭入侵；微软发布Windows紧急更新，禁用spectre补丁", "url": "https://www.freebuf.com/news/161524.html", "time": "2018-01-30", "level": "", "num_look": 258725, "num_comment": 3, "author": "Sphinx", "tags": ["资讯"], "text": "运动应用Strava公开十亿用户位置热力图，意外泄漏秘密军事基地的信息；美国国防部长指责俄罗斯监视其关键基础设施情况。"}
{"title": "漏洞盒子2017-18赛季收官战报 | 内含价值5万の夺冠秘籍", "url": "https://www.freebuf.com/fevents/161542.html", "time": "2018-01-29", "level": "红色标题", "num_look": 271654, "num_comment": 5, "author": "漏洞盒子", "tags": ["活动"], "text": "盒子2017-18赛季已经收官，并且冠军已经产生，现在就带大家进入冠军的世界"}
{"title": "One-Lin3r：懒人的福音，渗透测试单行化工具", "url": "https://www.freebuf.com/sectool/160413.html", "time": "2018-01-29", "level": "", "num_look": 524928, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍一款名叫One-Lin3r的渗透测试工具工具，这款工具可谓是“懒人”的福音，因为只需要输入一行命令，它就可以帮助我们完成渗透测试任务。"}
{"title": "经验分享 | 通过adbd配置漏洞在安卓设备上提升权限", "url": "https://www.freebuf.com/vuls/161150.html", "time": "2018-01-29", "level": "", "num_look": 461298, "num_comment": 2, "author": "Covfefe", "tags": ["漏洞", "终端安全"], "text": "近日，Android上的一个本地提权漏洞已被确认，该漏洞可通过设备上运行的Android Debug Bridge Daemon（adbd）被利用。"}
{"title": "好未来教育集团招聘高级安全渗透工程师", "url": "https://www.freebuf.com/jobs/161119.html", "time": "2018-01-29", "level": "", "num_look": 270816, "num_comment": 14, "author": "100tal", "tags": ["安全招聘"], "text": "好未来（NYSE：TAL），是一家中国领先的K12教育科技企业，以科技驱动、人才亲密、品质领先为核心价值。"}
{"title": "驻场工程师眼中的政务云安全", "url": "https://www.freebuf.com/articles/es/160919.html", "time": "2018-01-29", "level": "金币+15", "num_look": 528596, "num_comment": 15, "author": "雨水", "tags": ["企业安全"], "text": "驻场工程师属于拿着乙方的薪水，操着甲方的心，生在甲方的阵营，活在乙方的世界。在驻场工程师眼中，政务云的安全，包括甲方的运维，也包括乙方的服务。"}
{"title": "硬件黑客工具Packet Squirrel之三：Payload开发介绍", "url": "https://www.freebuf.com/sectool/161198.html", "time": "2018-01-29", "level": "现金奖励", "num_look": 519591, "num_comment": 3, "author": "ghostsnow", "tags": ["工具"], "text": "前两篇介绍了Packet Squirrel三个payloads的相关内容，还提到了Packet Squirrel支持自定义payload的开发，通过上传自己的payload，实现想要的功能。本篇文章主要介绍有关Packet Squirrel自主开发payload的内容。"}
{"title": "挖矿软件影响全球3千万系统，已成为不容忽视的大问题", "url": "https://www.freebuf.com/news/161420.html", "time": "2018-01-29", "level": "", "num_look": 356259, "num_comment": 3, "author": "Sphinx", "tags": ["资讯"], "text": "越来越多的恶意软件开始挖掘门罗币，这是一个非常恐怖的趋势，举例来说上周就有三起类似的事件。"}
{"title": "命令行下的“蒙面歌王”rundll32.exe", "url": "https://www.freebuf.com/sectool/160696.html", "time": "2018-01-29", "level": "现金奖励", "num_look": 692473, "num_comment": 15, "author": "lcx", "tags": ["工具"], "text": "在Windows系统中，为了节省内存和实现代码重用，微软在Windows操作系统中实现了一种共享函数库的方式——DLL（Dynamic Link Library）文件。"}
{"title": "BUF早餐铺 | 日本交易所Coincheck遭受史上最大加密货币损失案；黑客利用Youtube广告劫持用户电脑挖矿；Reddit为所有用户带来双重身份验证；受感染的Android游戏将广告软件传播给超过450万用户", "url": "https://www.freebuf.com/news/161473.html", "time": "2018-01-29", "level": "", "num_look": 289249, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "新的一周，各位Buffer早上好~ 两天的周末不知道大家过得是否愉悦，不过黑客活动貌似一直都没闲着。"}
{"title": "硬件黑客工具Packet Squirrel之二：实现openVPN远程访问", "url": "https://www.freebuf.com/articles/network/161073.html", "time": "2018-01-28", "level": "现金奖励", "num_look": 556930, "num_comment": 1, "author": "ghostsnow", "tags": ["网络安全"], "text": "上篇文章介绍了Packet Squirrel的两种payload使用方式，今天再讲一下利用openVPN实现远程访问Packet Squirrel。"}
{"title": "谷歌母公司Alphabet宣布成立新的独立信息安全公司Chronicle", "url": "https://www.freebuf.com/news/161338.html", "time": "2018-01-28", "level": "", "num_look": 274325, "num_comment": 274325, "author": "Sphinx", "tags": ["资讯"], "text": "周三，Google母公司Alphabet宣布成立一家独立公司专门从事网络安全。"}
{"title": "关于CPU漏洞Spectre的详细分析", "url": "https://www.freebuf.com/vuls/160161.html", "time": "2018-01-28", "level": "", "num_look": 391249, "num_comment": 1, "author": "alphalab", "tags": ["漏洞"], "text": "在本文中将详细分析POC中每个环节的关键点和漏洞的所有细节，包括漏洞形成的原因、漏洞攻击思路和方法、漏洞攻击流程，还有如何在浏览器中利用此漏洞，造成什么样的影响。"}
{"title": "【FB TV】一周「BUF大事件」：HackerOne发布《2018白帽黑客调查报告》；暴雪游戏被曝DNS重绑定漏洞；底层芯片漏洞修复受阻厂商建议暂停更新", "url": "https://www.freebuf.com/video/161434.html", "time": "2018-01-27", "level": "红色标题", "num_look": 499299, "num_comment": 3, "author": "willhuang", "tags": ["视频"], "text": "HackerOne发布《2018白帽黑客调查报告》；暴雪游戏被曝DNS重绑定漏洞；底层芯片漏洞修复受阻厂商建议暂停更新"}
{"title": "EvilURL v2.0一个生成用于钓鱼攻击的IDN域名的工具", "url": "https://www.freebuf.com/sectool/161077.html", "time": "2018-01-27", "level": "", "num_look": 424981, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "EvilURL v2.0是一个IDN同形异义字攻击（Homograph Attack ）的unicode恶意域名生成器。同时，它也可被用于检测这些域名的真实性。"}
{"title": "揭秘物联网僵尸网络GAFGYT家族与NETCORE 53413后门的背后故事", "url": "https://www.freebuf.com/articles/wireless/160664.html", "time": "2018-01-27", "level": "", "num_look": 573958, "num_comment": 573958, "author": "antiylab", "tags": ["安全报告", "无线安全"], "text": "近日，安天捕风蜜网系统监控并捕获到大量异常的UDP流量，通过对该流量的分析，发现存在僵尸网络控制节点（C2）位于美国的黑客组织正在对全球网络的NetCore 53413/UDP后门端口进行扫描攻击。"}
{"title": "15岁男孩假扮成CIA官员黑掉高度敏感的信息", "url": "https://www.freebuf.com/news/161011.html", "time": "2018-01-27", "level": "", "num_look": 353508, "num_comment": 5, "author": "shidongqi", "tags": ["资讯"], "text": "一个臭名昭著的亲巴勒斯坦黑客组织对美国情报官员进行了一系列尴尬的黑客攻击，并在2015年泄露了联邦调查局特工20,000人的信息，还有9000名国土安全部门官员以及一些美国司法部工作人员的个人详情。"}
{"title": "如何在Android Nougat中正确配置Burp Suite？", "url": "https://www.freebuf.com/articles/network/160900.html", "time": "2018-01-26", "level": "金币+12", "num_look": 481778, "num_comment": 3, "author": "secist", "tags": ["网络安全"], "text": "上周我测试一个新的Android app时，遇到了一些关于Burp Suite无法正常工作的问题。为了解决这个问题我花了整整一下午的时间，并决定将我的解决方案分享出来。"}
{"title": "MyKings：一个大规模多重僵尸网络", "url": "https://www.freebuf.com/articles/network/161286.html", "time": "2018-01-26", "level": "", "num_look": 532517, "num_comment": 4, "author": "360安全", "tags": ["网络安全"], "text": "MyKings 是一个由多个子僵尸网络构成的多重僵尸网络，2017 年 4 月底以来，该僵尸网络一直积极地扫描互联网上 1433 及其他多个端口。"}
{"title": "Micropython红外防坠落小车实验教程", "url": "https://www.freebuf.com/geek/160145.html", "time": "2018-01-26", "level": "现金奖励", "num_look": 372869, "num_comment": 2, "author": "bodasister", "tags": ["极客"], "text": "智能小车现在差不多是电子竞赛或者DIY中的主流了，寻迹，壁障，遥控什么的，相信大家也都见得很多了，这次就大家探讨一下防坠落小车的制作方法。"}
{"title": "上海平安壹钱包招聘安全人才", "url": "https://www.freebuf.com/jobs/161070.html", "time": "2018-01-26", "level": "", "num_look": 310709, "num_comment": 2, "author": "banish", "tags": ["安全招聘"], "text": "上海平安壹钱包招聘安全人才！"}
{"title": "2018世界经济论坛宣布建立全球网络安全中心，促进全球合作应对网络威胁", "url": "https://www.freebuf.com/news/161380.html", "time": "2018-01-26", "level": "", "num_look": 292243, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "在 2018 年第 48 届世界经济论坛（WEF）年会上，与会者探讨并达成一致意见，宣布成立新的全球网络安全中心，以便“建立一个安全可靠的全球网络空间”。"}
{"title": "一个伪装的Barlaiy病毒分析", "url": "https://www.freebuf.com/articles/others-articles/160796.html", "time": "2018-01-26", "level": "金币+12", "num_look": 313163, "num_comment": 3, "author": "0zapt4toM", "tags": ["其他"], "text": "对于一个病毒来说，\"Anti-AntiVirus\"是一个很重要的指标，如果不能做到很好的免杀效果，那么这个病毒存活的时间就必然不会很长。"}
{"title": "Satori变种正在通过替换钱包地址盗取ETH数字代币", "url": "https://www.freebuf.com/articles/web/160878.html", "time": "2018-01-26", "level": "", "num_look": 356552, "num_comment": 1, "author": "360安全", "tags": ["WEB安全"], "text": "Satori的新变种Satori.Coin.Robber开始渗透互联网上现存其他Claymore Miner挖矿设备，通过攻击其3333 管理端口，替换钱包地址，并最终攫取受害挖矿设备的算力和对应的 ETH 代币。"}
{"title": "为何广告竟然如此懂你？这锅不该Cookies来背", "url": "https://www.freebuf.com/articles/web/160931.html", "time": "2018-01-26", "level": "红色标题", "num_look": 1025344, "num_comment": 9, "author": "shidongqi", "tags": ["WEB安全", "特别企划"], "text": "现如今的互联网广告，除了不厌其烦的骚扰之外，还能够非常”巧合“地直击你的痛点，让人细思极恐。"}
{"title": "BUF早餐铺 | 世界达沃斯经济论坛上探讨建立全球网络安全中心；谷歌成立新的信息安全公司Chronicle；一款某网盘不限速插件疑含有挖矿脚本；Chrome 64发布新功能进一步阻止弹出广告并缓解 Spectre 问题", "url": "https://www.freebuf.com/news/161318.html", "time": "2018-01-26", "level": "", "num_look": 316567, "num_comment": 316567, "author": "shidongqi", "tags": ["资讯"], "text": "各位 Buffer 早上好，今天是 2018 年1 月 26日星期五。飘了一整天雪的魔都，感觉更冷了，小伙伴还是要注意保暖哈。"}
{"title": "国家信息安全漏洞库（CNNVD）发布2017年兼容性服务新增厂商及产品名单", "url": "https://www.freebuf.com/company-information/161304.html", "time": "2018-01-25", "level": "", "num_look": 433283, "num_comment": 433283, "author": "CNNVD", "tags": ["企业资讯"], "text": "受中国信息安全测评中心委托，国家信息安全漏洞库（CNNVD）运行管理中心于2017年8月至12月期间对18家单位的28款产品进行了兼容性服务能力审核，并于1月10日召开评审会对上述单位及产品进行评审。"}
{"title": "区块链跨域安全解决方案", "url": "https://www.freebuf.com/articles/others-articles/160885.html", "time": "2018-01-25", "level": "红色标题", "num_look": 1413931, "num_comment": 6, "author": "安全BaBiQ", "tags": ["其他", "区块链安全"], "text": "说区块链域安全之前，笔者介绍下区块链相关技术背景，现在很多人只识比特币，不识区块链。"}
{"title": "戴尔与惠普纷纷建议用户暂停spectre和meltdown相关更新", "url": "https://www.freebuf.com/news/161261.html", "time": "2018-01-25", "level": "", "num_look": 385279, "num_comment": 6, "author": "Sphinx", "tags": ["资讯"], "text": "Linus Torvalds刚说完CPU补丁是“完全的垃圾”，已经有厂商用实际行动表示了认同。"}
{"title": "钓鱼邮件传播勒索病毒再升级，不落地加大查杀难度", "url": "https://www.freebuf.com/articles/paper/160832.html", "time": "2018-01-25", "level": "", "num_look": 293045, "num_comment": 293045, "author": "腾讯电脑管家", "tags": ["安全报告"], "text": "钓鱼邮件通常在邮件正文利用“社工手段”诱使用户点击邮件附件，附件的文档内容诱使用户开启宏。用户一旦将宏开启，文档中所包含的恶意宏代码即自动运行，实施对用户电脑加密、勒索等行为。"}
{"title": "浙江大华招聘网络安全工程师", "url": "https://www.freebuf.com/jobs/153636.html", "time": "2018-01-25", "level": "", "num_look": 259323, "num_comment": 15, "author": "dhsec", "tags": ["安全招聘"], "text": "浙江大华技术股份有限公司诚邀安全人才,只为客户提供更安全放心的产品!"}
{"title": "D-Link service.cgi远程命令执行漏洞复现", "url": "https://www.freebuf.com/news/160716.html", "time": "2018-01-25", "level": "现金奖励", "num_look": 1746237, "num_comment": 7, "author": "阿哲学长", "tags": ["漏洞", "资讯"], "text": "1月17日，CNVD公开了D-LinkDIR 615/645/815 service.cgi远程命令执行漏洞（CNVD-2018-01084）。由于笔者近期对网络设备进行渗透技术略有研究，便复现了一下该漏洞。"}
{"title": "制作一个老旧C118的GSM便携式测试设备", "url": "https://www.freebuf.com/geek/160171.html", "time": "2018-01-25", "level": "现金奖励", "num_look": 827743, "num_comment": 17, "author": "iangzy", "tags": ["极客"], "text": "对于OsmocomBB也是被国内外大神玩得不亦乐乎。什么重定向攻击，中间人攻击。都是N年前的东西咯。"}
{"title": "思路分享 | 指纹考勤机实现远程打卡测试", "url": "https://www.freebuf.com/geek/160914.html", "time": "2018-01-25", "level": "现金奖励", "num_look": 1062295, "num_comment": 25, "author": "番茄test", "tags": ["极客", "网络安全"], "text": "文章中使用的指纹考勤机只针对某个厂商生产的考勤机，对于其他类型的机器未测"}
{"title": "硬件黑客工具Packet Squirrel之初识篇", "url": "https://www.freebuf.com/sectool/160887.html", "time": "2018-01-25", "level": "现金奖励", "num_look": 714477, "num_comment": 2, "author": "ghostsnow", "tags": ["工具"], "text": "继上次介绍过无线安全测试工具Wifipineapple（国产版）后，很多朋友后台私信、邮件我咨询设备在哪买的以及如何深入折腾的问题。"}
{"title": "BUF早餐铺 | 厂商建议暂停芯片漏洞相关更新;暴雪游戏出现DNS重绑定漏洞；Sonic游戏泄露用户信息；中国互联网协会成立个人信息保护工作委员会", "url": "https://www.freebuf.com/news/161271.html", "time": "2018-01-25", "level": "", "num_look": 204484, "num_comment": 204484, "author": "AngelaY", "tags": ["资讯"], "text": "冷空气大面积来袭，你那里下雪了吗？记得加衣保暖吃早餐哦。"}
{"title": "技术讨论 | 如何搭建山寨星巴克热点劫持用户电脑进行挖矿（内附完整代码和教程）", "url": "https://www.freebuf.com/articles/network/161236.html", "time": "2018-01-24", "level": "", "num_look": 620794, "num_comment": 11, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "本文的目的是为了给大家介绍如何利用中间人攻击（MitM）来向html页面中注入JavaScript代码，然后强制目标设备连接到恶意WiFi网络并为攻击者挖矿。"}
{"title": "挖洞经验 | 看我如何利用两个漏洞实现雅虎邮箱通讯录信息获取", "url": "https://www.freebuf.com/news/160917.html", "time": "2018-01-24", "level": "红色标题", "num_look": 453772, "num_comment": 7, "author": "clouds", "tags": ["漏洞", "资讯"], "text": "前段时间，我利用了XSS和CORS错误配置两个漏洞实现了对雅虎邮箱用户的通讯录信息窃取，这些相关信息包括：受害者姓名、电话号码和住址等。在此，我来详细说说整个过程。"}
{"title": "2017年著名安全软件榜单：全球尖端产品如何抵御最新的网络威胁？", "url": "https://www.freebuf.com/articles/neopoints/160875.html", "time": "2018-01-24", "level": "", "num_look": 329651, "num_comment": 3, "author": "柚子", "tags": ["观点"], "text": "安全威胁不断演变，和其它事物一样，它们也喜欢互相跟风。只要某种威胁类型非常成功、利润可观，网络犯罪分子们就会纷纷效仿。"}
{"title": "今日头条一大波安全职位来袭", "url": "https://www.freebuf.com/news/160918.html", "time": "2018-01-24", "level": "", "num_look": 358601, "num_comment": 26, "author": "bytedance", "tags": ["资讯"], "text": "“今日头条”致力于帮助用户在移动互联网上方便快捷地获取最有价值的信息，它会根据用户的兴趣为其推荐内容"}
{"title": "暴雪游戏存在DNS重绑定漏洞可导致玩家电脑被远程劫持", "url": "https://www.freebuf.com/news/161206.html", "time": "2018-01-24", "level": "红色标题", "num_look": 319410, "num_comment": 3, "author": "clouds", "tags": ["资讯"], "text": "谷歌安全研究员Tavis Ormandy发现暴雪游戏存在一个严重漏洞，攻击者利用该漏洞针对游戏玩家电脑可实现远程恶意代码执行。"}
{"title": "HackerOne 2018白帽黑客报告：高级白帽收入远超软件工程师平均薪资", "url": "https://www.freebuf.com/news/161014.html", "time": "2018-01-24", "level": "红色标题", "num_look": 804185, "num_comment": 30, "author": "AngelaY", "tags": ["安全报告", "资讯"], "text": "全球知名漏洞众测平台 HackerOne 近期发布了 2018 白帽黑客调查报告，针对 1698 白帽受访者展开调查，并得出了一些结论，报告结果显示：白帽黑客也许将迎来暖春。"}
{"title": "在阿里云环境下搭建基于SornaQube的自动化安全代码检测平台", "url": "https://www.freebuf.com/articles/security-management/160897.html", "time": "2018-01-24", "level": "金币+10", "num_look": 590697, "num_comment": 4, "author": "hjy103", "tags": ["安全管理"], "text": "近年来，随着新业务、新技术的快速发展，应用软件安全缺陷层出不穷。"}
{"title": "“人面马”（APT34）组织对中东地区进行攻击的最新动向通报", "url": "https://www.freebuf.com/articles/paper/160880.html", "time": "2018-01-24", "level": "", "num_look": 415786, "num_comment": 6, "author": "腾讯电脑管家", "tags": ["安全报告"], "text": "“人面马”组织（T-APT-05），又称APT34、Oilrig、Cobalt Gypsy，是一个来自于伊朗的APT组织。该组织自2014年开始活动，主要攻击目标在中东地区，对政府、金融、能源、电信等各行业都进行过攻击。"}
{"title": "技术讨论 | 一次尚未完成的薅羊毛行动", "url": "https://www.freebuf.com/articles/web/156737.html", "time": "2018-01-24", "level": "现金奖励", "num_look": 602997, "num_comment": 9, "author": "西毒若相惜", "tags": ["WEB安全"], "text": "XX眼镜，免费领取日抛5日装隐形眼镜活动，发现接收到的手机验证码为4位数字，看到4位验证码时就觉得有搞头。"}
{"title": "Buf早餐铺 | Linux之父评价Linux Spectre补丁是“彻底的垃圾”；中国白帽子获谷歌11.25万美元的奖励；中国迈进 “轻现金社会” 需破解金融信息安全难题", "url": "https://www.freebuf.com/news/161076.html", "time": "2018-01-24", "level": "", "num_look": 210442, "num_comment": 2, "author": "Elaine_z", "tags": ["资讯"], "text": "天寒地冻，多吃早饭！"}
{"title": "快讯 | 国内白帽子发现两个安卓漏洞，获得谷歌11.25万美元的奖励", "url": "https://www.freebuf.com/news/161087.html", "time": "2018-01-23", "level": "红色标题", "num_look": 358756, "num_comment": 19, "author": "shidongqi", "tags": ["资讯"], "text": "360公司Alpha团队白帽子发现了新的漏洞利用链，能够用来黑掉谷歌Pixel智能手机，为此，谷歌提供了112500美元的奖金。"}
{"title": "渗透测试自动化：使用NTLM中继和Deathstar获取域管理员权限", "url": "https://www.freebuf.com/sectool/160884.html", "time": "2018-01-23", "level": "", "num_look": 509740, "num_comment": 1, "author": "secist", "tags": ["工具"], "text": "当进行域渗透的时候，我们往往需要通过某种方式来获取NTLMv2的哈希。"}
{"title": "ARP协议分析&python编程实现ARP欺骗抓图片", "url": "https://www.freebuf.com/articles/web/160511.html", "time": "2018-01-23", "level": "现金奖励", "num_look": 708595, "num_comment": 7, "author": "LlawLiet", "tags": ["WEB安全"], "text": "这篇文章研究了arp协议，并且利用python编程实现一次简单的局域网arp攻击，抓取室友网上浏览的图片（滑稽脸）"}
{"title": "英特尔暂停发放CPU补丁， Linux之父怒批“Spectre补丁是彻底的垃圾”", "url": "https://www.freebuf.com/news/161086.html", "time": "2018-01-23", "level": "红色标题", "num_look": 829812, "num_comment": 12, "author": "Elaine_z", "tags": ["系统安全", "资讯"], "text": "英特尔还没有为CPU安全漏洞提供适当的修复，Linux Kernel 4.15版本推迟， Linus Torvalds 再次进入“骂人模式”……"}
{"title": "微步在线ThreatBook诚邀安全、技术大牛加入", "url": "https://www.freebuf.com/jobs/151803.html", "time": "2018-01-23", "level": "", "num_look": 238971, "num_comment": 2, "author": "Threatbook", "tags": ["安全招聘"], "text": "微步在线自成立就在一系列重大安全事件如XCodeGhost、DarkHotel、WannaCry中多次积极应对，现有分布在金融、能源、互联网行业和政府机关的客户数十家。"}
{"title": "Office漏洞袭来（CVE-2018-0802）详细分析", "url": "https://www.freebuf.com/vuls/160386.html", "time": "2018-01-23", "level": "", "num_look": 485663, "num_comment": 1, "author": "兰云科技银河实验室", "tags": ["漏洞"], "text": "在windows2017年 11月份发布补丁，修复了包括cve-2017-11882在内之后，在2018年又继续发布补丁，修复了包括CVE-2018-0802在内的多个漏洞。"}
{"title": "CVE-2017-8759漏洞新利用：Java Keylogger盗号木马分析", "url": "https://www.freebuf.com/articles/paper/160297.html", "time": "2018-01-23", "level": "", "num_look": 345096, "num_comment": 2, "author": "腾讯电脑管家", "tags": ["安全报告"], "text": "腾讯安全御见情报中心近期在监测CVE－2017－8759漏洞利用情况时，捕获到一款名为jLog（Java Keylogger）的盗号木马。在未修复此漏洞的机器上，用户一旦打开攻击者精心构造的恶意文档，就会触发漏洞，下载运行木马。"}
{"title": "微信偷看聊天记录？看完这篇你就不怕了", "url": "https://www.freebuf.com/sectool/160703.html", "time": "2018-01-23", "level": "红色标题", "num_look": 2840117, "num_comment": 45, "author": "Philo Evius", "tags": ["工具", "观点"], "text": "既然微信不看我们的聊天记录，也一定不在乎用户自己加密咯？"}
{"title": "拒绝成为免费劳动力：检测含有挖矿脚本的WiFi热点", "url": "https://www.freebuf.com/articles/web/161010.html", "time": "2018-01-23", "level": "金币+10", "num_look": 663493, "num_comment": 5, "author": "qingxp9", "tags": ["WEB安全", "无线安全"], "text": "一家星巴克店内无线网络被发现植入了恶意代码，劫持网络流量利用用户设备挖掘门罗币（XMR）。我打算应景的写一篇防御角度的文章，分析如何便捷的检测周围WiFi网络是否被植入了挖矿代码。"}
{"title": "BUF 早餐铺 | 15岁男孩假扮成CIA官员黑掉高度敏感的信息；HackerOne 2018 白帽黑客报告：高级白帽收入远超软件工程师平均薪资；研究人员发现政府支持的手机黑客组织", "url": "https://www.freebuf.com/news/161036.html", "time": "2018-01-23", "level": "", "num_look": 244928, "num_comment": 3, "author": "Sphinx", "tags": ["资讯"], "text": ""}
{"title": "Microsoft Office之DDE攻击", "url": "https://www.freebuf.com/articles/system/160797.html", "time": "2018-01-22", "level": "", "num_look": 423202, "num_comment": 7, "author": "secist", "tags": ["系统安全"], "text": "Microsoft Office可以说是使用最广泛的办公软件。然而就是因为这样，也使它成为了黑客的主要攻击目标之一，例如在网络安全对抗赛中红队会用它来窃取域哈希，甚至执行任意代码。"}
{"title": "漏洞暴露近一周才修复，某成人VR App可能泄露用户信息", "url": "https://www.freebuf.com/news/160920.html", "time": "2018-01-22", "level": "", "num_look": 345165, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "在供应商介入并修补安全漏洞之前，有关成人虚拟现实（VR）应用程序中两个漏洞的详细信息已经公布了五天。"}
{"title": "任意用户密码重置（一）：重置凭证泄漏", "url": "https://www.freebuf.com/articles/web/160883.html", "time": "2018-01-22", "level": "现金奖励", "num_look": 1083113, "num_comment": 30, "author": "yangyangwithgnu", "tags": ["WEB安全", "数据安全"], "text": "密码找回功能是重灾区。我把日常渗透过程中遇到的案例作了漏洞成因分析，这次，关注因重置凭证泄漏导致的任意用户密码重置问题。"}
{"title": "悬镜安全招聘安全人才", "url": "https://www.freebuf.com/jobs/160798.html", "time": "2018-01-22", "level": "", "num_look": 266288, "num_comment": 9, "author": "悬镜安全实验室", "tags": ["安全招聘"], "text": "安普诺（www.anpro-tech.com），是国内首家专注于[云+端]一站式安全加固解决方案的专业厂商，团队核心成员皆来自北京大学及国内顶级安全公司。"}
{"title": "Apache Solr远程代码执行漏洞（CVE-2017-12629）从利用到入侵检测", "url": "https://www.freebuf.com/sectool/159970.html", "time": "2018-01-22", "level": "现金奖励", "num_look": 741418, "num_comment": 8, "author": "cloud4986", "tags": ["工具", "系统安全"], "text": "Apache Solr 是Apache开发的一个开源的基于Lucene的全文搜索服务器。其集合的配置方法（config路径）可以增加和修改监听器，通过RunExecutableListener执行任意系统命令。"}
{"title": "毒眼系列报告之黄牛软件", "url": "https://www.freebuf.com/articles/paper/160726.html", "time": "2018-01-22", "level": "红色标题", "num_look": 582673, "num_comment": 19, "author": "阿里安全", "tags": ["安全报告"], "text": "天下熙熙，皆为利来；天下攘攘，皆为利往。有人的地方就有江湖，有江湖的地方就有利益纷争，就有勾心斗角，就有尔虞我诈，这个社会从来如此。"}
{"title": "从刷支付宝乘地铁谈起，浅议大数据时代的隐私安全", "url": "https://www.freebuf.com/articles/neopoints/160573.html", "time": "2018-01-22", "level": "红色标题", "num_look": 479613, "num_comment": 13, "author": "Elaine_z", "tags": ["观点"], "text": "信息时代用户留下的每一个字节，都会是构成隐私的血肉。"}
{"title": "一个二进制POC的诞生之旅CVE-2018-0802", "url": "https://www.freebuf.com/vuls/160115.html", "time": "2018-01-22", "level": "现金奖励", "num_look": 567848, "num_comment": 4, "author": "GeekOnline", "tags": ["漏洞"], "text": "微软将很难从源代码级别去排查这个程序是否还有其他漏洞，此次“噩梦公式”的姊妹篇CVE-2017-0802就在这一背景下被业界所发现。"}
{"title": "BUF早餐铺 | 超半数挪威居民医疗数据恐泄露；“文本炸弹”可使苹果iMessage App崩溃；安卓恶意软件窃取Facebook凭证；广东省破获多起网络犯罪案件", "url": "https://www.freebuf.com/news/160847.html", "time": "2018-01-22", "level": "", "num_look": 233268, "num_comment": 233268, "author": "AngelaY", "tags": ["资讯"], "text": "淮阳卧理有清风，腊月榴花带雪红。闭阁寂寥常对此，江湖心在数枝中。"}
{"title": "大数据安全保护思考", "url": "https://www.freebuf.com/articles/database/160564.html", "time": "2018-01-21", "level": "现金奖励", "num_look": 531388, "num_comment": 5, "author": "mcvoodoo", "tags": ["数据安全"], "text": "随着大数据时代的来临，企业数据开始激增，各种数据在云端、移动设备、关系型数据库、大数据库平台、pc端、采集器端等多个位置分散。"}
{"title": "Meltdown/Spectre最新进展：补丁影不影响性能？英特尔做了一场实验", "url": "https://www.freebuf.com/news/160854.html", "time": "2018-01-21", "level": "", "num_look": 335980, "num_comment": 2, "author": "Sphinx", "tags": ["资讯"], "text": "英特尔：Meltdown/Spectre补丁影响严重，可能导致异常重启。"}
{"title": "新手科普 | MySQL手工注入之基本注入流程", "url": "https://www.freebuf.com/articles/web/160352.html", "time": "2018-01-21", "level": "金币+10", "num_look": 946019, "num_comment": 12, "author": "国光", "tags": ["WEB安全"], "text": ""}
{"title": "远程RPC溢出EXP编写实战之MS06-040", "url": "https://www.freebuf.com/articles/system/160301.html", "time": "2018-01-21", "level": "现金奖励", "num_look": 431017, "num_comment": 8, "author": "wooy0ung", "tags": ["系统安全"], "text": "MS06-040算是个比较老的洞了，在当年影响十分之广，基本上Microsoft大部分操作系统都受到了影响，威力不亚于17年爆出的\"永恒之蓝\"漏洞。"}
{"title": "VirusTotal Graph增加新特性，查看各文件的相关性将更加容易", "url": "https://www.freebuf.com/sectool/160129.html", "time": "2018-01-20", "level": "", "num_look": 518380, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具", "网络安全"], "text": "VirusTotal发布了一个名叫Graph的新功能，该功能允许用户以可视化的方式查看自己所提交文件之间的相关性。"}
{"title": "WordPress插件YITH WooCommerce Wishlist SQL注入漏洞", "url": "https://www.freebuf.com/articles/web/160657.html", "time": "2018-01-20", "level": "", "num_look": 366517, "num_comment": 366517, "author": "secist", "tags": ["WEB安全"], "text": "作为我们对Sucuri防火墙定期研究审计的一部分，我们发现了一个愿望清单插件YITH WooCommerce Wishlist，存在SQL注入漏洞。据统计，该插件目前至少已被50000+的wordpress站点安装使用。"}
{"title": "【FB TV】一周「BUF大事件」：“撒币”游戏风靡，众辅助程序各显神通；腾讯2018守护者计划大会在北京召开；一加手机网站服务器疑似被入侵", "url": "https://www.freebuf.com/video/160850.html", "time": "2018-01-20", "level": "红色标题", "num_look": 399218, "num_comment": 1, "author": "willhuang", "tags": ["视频"], "text": "“撒币”游戏风靡，众辅助程序各显神通；腾讯2018守护者计划大会在北京召开；一加手机网站服务器疑似被入侵."}
{"title": "ElastAlert监控日志告警Web攻击行为", "url": "https://www.freebuf.com/articles/web/160254.html", "time": "2018-01-20", "level": "现金奖励", "num_look": 715098, "num_comment": 5, "author": "shystartree", "tags": ["WEB安全"], "text": "由于公司需要监控web攻击行为，而因某些原因搭不了waf，才不得不用ElastAlert进行告警，此为前提。"}
{"title": "Office公式编辑器漏洞二代的原理分析、利用与防护方案", "url": "https://www.freebuf.com/vuls/160409.html", "time": "2018-01-20", "level": "", "num_look": 385990, "num_comment": 385990, "author": "金睛", "tags": ["漏洞"], "text": "在上周二(2018年1月9日)的微软例行更新中，微软再一次对Office中的公式编辑器3.0产生的多个内存破坏漏洞进行了修补，并将这一系列漏洞归类于编号CVE-2018-0802。"}
{"title": "PhpSploit：一款隐蔽性极强的后渗透利用框架", "url": "https://www.freebuf.com/sectool/160132.html", "time": "2018-01-19", "level": "", "num_look": 481251, "num_comment": 8, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫PhpSploit的远程控制框架，该工具可以帮助攻击者在客户端与Web服务器端之间建立隐蔽性极强的交互式链接（类似Shell）。"}
{"title": "挖洞经验 | 看我如何发现“小火车托马斯”智能玩具APP聊天应用漏洞", "url": "https://www.freebuf.com/news/160316.html", "time": "2018-01-19", "level": "", "num_look": 457610, "num_comment": 3, "author": "clouds", "tags": ["漏洞", "资讯"], "text": "我向智能玩具厂商ToyTalk提交了两个APP相关的漏洞并获得了$1750美金奖励，目前，漏洞已被成功修复."}
{"title": "应用克隆，从支付宝自动领红包链接谈起", "url": "https://www.freebuf.com/articles/terminal/160544.html", "time": "2018-01-19", "level": "现金奖励", "num_look": 1486458, "num_comment": 24, "author": "rebeyond", "tags": ["终端安全"], "text": "这段时间支付宝的“天天领红包”活动进行的如火如荼，出现了通过点击一个链接就自动抢红包的薅羊毛方式。下面结合支付宝的自动领红包链接，对“应用克隆”漏洞从技术原理上作一下分析。"}
{"title": "基于DNS的数据挖掘与分析", "url": "https://www.freebuf.com/articles/web/160431.html", "time": "2018-01-19", "level": "现金奖励", "num_look": 747838, "num_comment": 19, "author": "feiniao", "tags": ["WEB安全"], "text": "此文是基于一次安全事件所引发的思考，在应急后进行的安全分析与挖掘。分析的数据基于DNS数据，这也是本人的一次尝试，各位大佬有好的思路或方法欢迎及时补充。"}
{"title": "研究人员称HTML5可以被用来追踪网民", "url": "https://www.freebuf.com/news/160692.html", "time": "2018-01-19", "level": "", "num_look": 405423, "num_comment": 2, "author": "Sphinx", "tags": ["资讯"], "text": "HTML5可能是现在最流行的网页制作手段，但小心哦，由于它的新特性，追踪网民变得非常容易。"}
{"title": "成名于手机执着于安全，黑莓推出Jarvis汽车安全产品", "url": "https://www.freebuf.com/articles/es/160569.html", "time": "2018-01-19", "level": "红色标题", "num_look": 391105, "num_comment": 2, "author": "shidongqi", "tags": ["企业安全"], "text": "现在说起黑莓手机，大多剩下的只有如诺基亚一般的情怀吧。连美国前总统奥巴马都爱不释手的黑莓手机，迫于形势放弃手机硬件制造后专注于软件开发，但依然执着于安全领域。"}
{"title": "美国一医院为Samsam勒索软件支付近6万美元赎金", "url": "https://www.freebuf.com/news/160577.html", "time": "2018-01-19", "level": "", "num_look": 281580, "num_comment": 2, "author": "Sphinx", "tags": ["资讯"], "text": "一家印第安纳医院向黑客支付了55,000美元的赎金试图恢复系统。"}
{"title": "NDAY漏洞CVE-2017-11882与0Day漏洞CVE-2018-0802漏洞组合传播远控木马的样本分析", "url": "https://www.freebuf.com/vuls/160252.html", "time": "2018-01-19", "level": "", "num_look": 630540, "num_comment": 9, "author": "腾讯电脑管家", "tags": ["漏洞"], "text": "该漏洞为Office内存破坏漏洞，影响目前流行的所有Office版本。攻击者可以利用漏洞以当前登录的用户的身份执行任意命令。"}
{"title": "BUF早餐铺 | RubyMiner挖矿程序24小时内影响全球30%的网络；黑客利用三个Office漏洞传播Zyklon病毒；因为勒索软件，OneDrive for Business将新增文件恢复功能；微信打击“假货、高仿”类小程序", "url": "https://www.freebuf.com/news/160727.html", "time": "2018-01-19", "level": "", "num_look": 303547, "num_comment": 303547, "author": "shidongqi", "tags": ["资讯"], "text": "又到周五，提前预祝大家有一个愉快的周末。今天的BUF早餐铺依然精彩，不要错过哦~"}
{"title": "首期战报！ “网藤杯” 智能安全机器人养成计划", "url": "https://www.freebuf.com/fevents/160676.html", "time": "2018-01-18", "level": "红色标题", "num_look": 375892, "num_comment": 16, "author": "斗象智能安全平台", "tags": ["活动"], "text": "何以解忧，唯有暴富～～"}
{"title": "FIT 2018精华回顾 | Hack Demo路由器宽带账号密码便携式获取实验", "url": "https://www.freebuf.com/articles/wireless/160697.html", "time": "2018-01-18", "level": "红色标题", "num_look": 1023389, "num_comment": 5, "author": "Akane", "tags": ["无线安全"], "text": "路由器是家庭网络的入口，在IoT浪潮下，路由器也起到了网络守护者的角色，掌管着家庭网络一切联网设备的安全性。"}
{"title": "MITM6：用IPv6攻陷IPv4网络的工具", "url": "https://www.freebuf.com/sectool/160164.html", "time": "2018-01-18", "level": "", "num_look": 443051, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "在本篇博文中，我将为大家介绍一种针对IPv6的攻击：即利用Windows网络中的默认IPv6配置，伪装DNS服务器来欺骗DNS reply，并将流量重定向到攻击者指定的端点。"}
{"title": "RubyMiner挖矿程序24小时内影响全球30%的网络", "url": "https://www.freebuf.com/news/160663.html", "time": "2018-01-18", "level": "红色标题", "num_look": 318149, "num_comment": 13, "author": "AngelaY", "tags": ["资讯"], "text": "RubyMiner 恶意软件家族针对全球的 web 服务器发起攻击，并试图利用这些服务器挖掘门罗币。24 小时内，全球 30% 的网络都受到影响。"}
{"title": "利用Microsoft Word中的图像链接进行UNC路径注入渗透", "url": "https://www.freebuf.com/articles/web/160215.html", "time": "2018-01-18", "level": "", "num_look": 354629, "num_comment": 2, "author": "secist", "tags": ["WEB安全"], "text": "在不久前，netbiosX曾在他的博客发布过一篇关于通过frameset抓取NetNTLM哈希的文章。本文的核心思路与该文是相同的，只是用了不同的一种方式：即通过一个链接插入图片。"}
{"title": "新手科普 | 渗透测试之信息收集", "url": "https://www.freebuf.com/articles/web/160001.html", "time": "2018-01-18", "level": "", "num_look": 763121, "num_comment": 4, "author": "m09046105", "tags": ["WEB安全"], "text": "关于渗透测试领域内的信息收集的重要性想必大家都意识到了，网上也有各种谈信息收集的文章，本文主要将笔者在实际渗透测试中，用到的一些技巧及感悟分享出来欢迎大家讨论。"}
{"title": "BadUSB橡皮鸭综合利用，使用橡皮鸭渗透电脑测试", "url": "https://www.freebuf.com/news/159942.html", "time": "2018-01-18", "level": "现金奖励", "num_look": 687989, "num_comment": 16, "author": "SeagullGR", "tags": ["极客", "系统安全"], "text": "USB RUBBER DUCKY（USB 橡皮鸭）是最早的按键注入工具。自2010年以来，USB橡皮鸭就一直深受黑客、渗透测试人员以及IT专家的欢迎。"}
{"title": "WebView域控不严格读取内部私有文件实验", "url": "https://www.freebuf.com/articles/terminal/160061.html", "time": "2018-01-18", "level": "现金奖励", "num_look": 583988, "num_comment": 20, "author": "烟波渺渺正愁予", "tags": ["终端安全"], "text": "A应用可以通过B应用导出的 Activity让B应用加载一个恶意的file协议的url来获取B应用的内部私有文件，从而带来数据泄露威胁。"}
{"title": "2018最新款渗透测试框架，Fsociety搞定各种姿势脚本", "url": "https://www.freebuf.com/sectool/160300.html", "time": "2018-01-18", "level": "现金奖励", "num_look": 881474, "num_comment": 31, "author": "2cat", "tags": ["WEB安全", "工具"], "text": "Fsociety是一款最新的渗透测试框架，可以帮助各位兄弟在安全测试过程中拥有变身成黑客所需要的各种姿势脚本。"}
{"title": "BUF早餐铺 | 强力安卓恶意软件Skygofree分析发布；恶意Chrome扩展程序影响50多万用户；女博士被电信诈骗85万；腾讯帮助警方逮捕绝地求生作弊工具开发者", "url": "https://www.freebuf.com/news/160638.html", "time": "2018-01-18", "level": "", "num_look": 239808, "num_comment": 3, "author": "AngelaY", "tags": ["资讯"], "text": "雪沫乳花浮午盏，蓼茸蒿笋试春盘。人间有味是清欢。"}
{"title": "利用SCF文件构建网络渗透", "url": "https://www.freebuf.com/articles/network/158416.html", "time": "2018-01-17", "level": "", "num_look": 573135, "num_comment": 8, "author": "liulang", "tags": ["网络安全"], "text": "SMB是一种广泛用于企业组织中文件共享目的的网络协议。在内部的渗透测试中，发现包含明文密码和数据库连接字符串等敏感信息的共享文件并不罕见。"}
{"title": "挖洞经验 | 看我如何发现D-Link 815N路由器的RCE 0-day漏洞", "url": "https://www.freebuf.com/vuls/160181.html", "time": "2018-01-17", "level": "", "num_look": 465693, "num_comment": 4, "author": "clouds", "tags": ["漏洞", "终端安全"], "text": "非常偶然，在试用D-Link 815N路由器过程中，我发现了其存在的一个远程代码执行（RCE）0-day漏洞。"}
{"title": "英特尔放出Linux微代码以修复Meltdown和Spectre漏洞", "url": "https://www.freebuf.com/articles/system/160418.html", "time": "2018-01-17", "level": "红色标题", "num_look": 409099, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "近日，Intel发布了最新版本的Linux处理器微代码数据文件，而这个补丁文件能够修复Intel CPU中的Spectre以及Meltdown漏洞。"}
{"title": "WAF绕过技巧浅谈", "url": "https://www.freebuf.com/articles/web/160175.html", "time": "2018-01-17", "level": "", "num_look": 768284, "num_comment": 14, "author": "secist", "tags": ["WEB安全"], "text": "远程命令执行漏洞是Web应用中常见的漏洞之一，在2017年发布的10项最严重的Web应用程序安全风险列表中”注入“毫不意外的被放在了第一位。"}
{"title": "Spectre & Meltdown漏洞补丁修复安全贴士", "url": "https://www.freebuf.com/vuls/160503.html", "time": "2018-01-17", "level": "", "num_look": 324289, "num_comment": 2, "author": "Sphinx", "tags": ["漏洞"], "text": "Spectre/Meltdown事件似乎已经进入了第二阶段——各厂商纷纷推出自己的修复方案。"}
{"title": "一加海外官网疑遭入侵，用户支付信息泄漏导致信用卡欺诈事件发生", "url": "https://www.freebuf.com/news/160440.html", "time": "2018-01-17", "level": "红色标题", "num_look": 275949, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": ""}
{"title": "通过CVE-2017-17215学习路由器漏洞分析，从入坑到放弃", "url": "https://www.freebuf.com/vuls/160040.html", "time": "2018-01-17", "level": "现金奖励", "num_look": 928534, "num_comment": 35, "author": "kczwa1", "tags": ["漏洞", "终端安全"], "text": "Check Point 软件技术部门报告了一个华为 HG532 产品的远程命令执行漏洞(CVE-2017-17215)，Mirai的升级版变种中已经使用该漏洞。"}
{"title": "“束发少年”EQNEDT32的陨落", "url": "https://www.freebuf.com/sectool/160289.html", "time": "2018-01-17", "level": "", "num_look": 413283, "num_comment": 9, "author": "安全豹", "tags": ["工具"], "text": "由非正经分析人员在非工作时间以非常规角度描述的非真实故事。"}
{"title": "2017年数字加密货币安全报告", "url": "https://www.freebuf.com/articles/paper/160331.html", "time": "2018-01-17", "level": "红色标题", "num_look": 353691, "num_comment": 7, "author": "腾讯电脑管家", "tags": ["安全报告"], "text": "数字加密货币（Digital Cryptocurrency）又称为加密货币，其特点在于利用密码学原理来确保交易安全及控制交易单位的创造，是数字货币（或称虚拟货币）中的一种。"}
{"title": "Buf早餐铺 | 加拿大起诉LeakedSource站长；一加网站支付系统遭入侵；盗取价值百万比特币；海淀一公司管理员被刑拘", "url": "https://www.freebuf.com/news/160420.html", "time": "2018-01-17", "level": "", "num_look": 163424, "num_comment": 1, "author": "Elaine_z", "tags": ["资讯"], "text": "加拿大警方起诉LeakedSource站长；一加网站支付系统遭入侵，支付卡凭证遭窃取；RubyMiner 恶意程序针对 Linux 和 Windows 服务器发起攻击。"}
{"title": "从理论层面谈Meltdown与Spectre攻击 | 核武按钮终被劫持？", "url": "https://www.freebuf.com/articles/terminal/160424.html", "time": "2018-01-16", "level": "", "num_look": 458088, "num_comment": 5, "author": "欧阳洋葱", "tags": ["终端安全"], "text": "地球上有没有一种安全漏洞，广泛存在于各种计算设备之中，并且难以被检测，难以被修复？在2018年的第一个月里，Meltdown 与 Spectre 两大处理器安全漏洞给出了这个问题的部分答案。"}
{"title": "记一次诈骗反制行动 | 电信诈骗犯偶遇白帽子，一顿操作惨遭反杀", "url": "https://www.freebuf.com/news/160483.html", "time": "2018-01-16", "level": "红色标题", "num_look": 505457, "num_comment": 20, "author": "Akane", "tags": ["资讯"], "text": "临近年底，随着买物置衣购票等年终消费在网上的提升，电信网络诈骗也趁机出现“抬头”趋势。"}
{"title": "新年大礼包 | 新型Emotet变种重现江湖", "url": "https://www.freebuf.com/news/160020.html", "time": "2018-01-16", "level": "", "num_look": 168166, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "近期，安全厂商Minerva发现了新型的Emotet变种活动，而这种以“圣诞快乐”（Emotet Grinch）为主题的Emotet变种正在酝酿新年里的第一波攻击。"}
{"title": "FIT 2018精华回顾 | Hack Demo智能外设入侵汽车网络", "url": "https://www.freebuf.com/video/160446.html", "time": "2018-01-16", "level": "红色标题", "num_look": 232637, "num_comment": 4, "author": "willhuang", "tags": ["视频"], "text": "智能外设本身可能出现哪些安全问题？用户在利用智能外设与汽车进行通信的过程中，会出现怎样的漏洞？"}
{"title": "卡巴斯基应急响应指南分享", "url": "https://www.freebuf.com/articles/es/159652.html", "time": "2018-01-16", "level": "", "num_look": 453532, "num_comment": 5, "author": "Byeol1", "tags": ["企业安全"], "text": "经大佬老板推荐，有幸参读了卡巴斯基的应急响应指南，让小白的我从中学到了值得借鉴的思路。虽然并无实践经验，但是希望可以将这些内容整理分享出来，供大家参考。"}
{"title": "机器学习对抗案例：愚弄Google图像识别算法", "url": "https://www.freebuf.com/articles/neopoints/158689.html", "time": "2018-01-16", "level": "红色标题", "num_look": 466494, "num_comment": 8, "author": "Elaine_z", "tags": ["观点"], "text": "我们在赋予算法相关执行和决策权力的同时，也赋予了算法与之相应重量的责任和信任。"}
{"title": "一次浏览器挖矿分析的意外发现", "url": "https://www.freebuf.com/articles/web/159410.html", "time": "2018-01-16", "level": "金币+15", "num_look": 667751, "num_comment": 12, "author": "fiysky", "tags": ["WEB安全"], "text": "在不少网站上，管理员接入了第三方应用，例如聊天、支付等等，但是这样安全吗？"}
{"title": "CVE-2017-8890漏洞分析与利用（Root Android 7.x）", "url": "https://www.freebuf.com/articles/terminal/160041.html", "time": "2018-01-16", "level": "现金奖励", "num_look": 824072, "num_comment": 34, "author": "SetRet", "tags": ["终端安全"], "text": "通过漏洞信息，可以知道这个漏洞影响范围非常广，包括Linux Kernel 4.10.15之前的所有内核版本。"}
{"title": "MIRAI OKIRU——历史上首个针对ARC CPU的Linux恶意软件", "url": "https://www.freebuf.com/news/160224.html", "time": "2018-01-16", "level": "", "num_look": 223917, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "2016年8月， 来自@ MalwareMustDie  团队的研究人员@ unixfreaxjp率先发现了可怕的僵尸网络Mirai，现在这位研究人员在恶意软件社区宣告了新的重大事件。"}
{"title": "一本万利的黑客“致富经”，挖矿木马横扫网吧怒赚百万", "url": "https://www.freebuf.com/news/160021.html", "time": "2018-01-16", "level": "红色标题", "num_look": 544803, "num_comment": 9, "author": "360安全", "tags": ["资讯"], "text": "多款网吧视频播放软件存在挖矿行为，这些软件占用网吧计算机资源挖取数字货币，不仅严重影响计算机的正常工作，造成机器性能下降，耗电增加，而且长时间挖矿还会缩短硬件使用寿命，极大增加网吧运营成本。"}
{"title": "BUF 早餐铺 | 英特尔固件更新后，Broadwell和Haswell CPU出现重启问题 ；联想发现并移除网络交换机中的后门；微信张小龙：微信不看聊天记录", "url": "https://www.freebuf.com/news/160350.html", "time": "2018-01-16", "level": "", "num_look": 251642, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "英特尔固件更新后，Broadwell和Haswell CPU出现重启问题；联想发现并移除网络交换机中的后门；艳照门第四名嫌犯落网；“微信之父”张小龙：微信不看聊天记录。"}
{"title": "英特尔固件更新后，Broadwell和Haswell CPU出现重启问题", "url": "https://www.freebuf.com/news/160253.html", "time": "2018-01-15", "level": "", "num_look": 346917, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "上周五，英特尔也承认其正在调查 Broadwell 和 Haswell CPU 的问题，因为客户在安装固件更新以修复 Spectre 漏洞时出很多系统重启的情况，这些系统主要包括家用电脑和数据中心服务器。"}
{"title": "西部数据NAS设备被曝存在硬编码后门和未授权文件上传高危漏洞", "url": "https://www.freebuf.com/news/160039.html", "time": "2018-01-15", "level": "", "num_look": 411837, "num_comment": 1, "author": "clouds", "tags": ["终端安全", "资讯"], "text": "GulfTech公司安全研究员James Bercegay发现，西部数据旗下多个MyCloud系列网络存储设备存在未限制文件上传、硬编码后门、CSRF、命令注入等多个高危漏洞。"}
{"title": "中国网络安全人才之“怪现状”", "url": "https://www.freebuf.com/articles/network/160054.html", "time": "2018-01-15", "level": "红色标题", "num_look": 888117, "num_comment": 30, "author": "阿里聚安全", "tags": ["网络安全"], "text": "随着网络空间成为第五空间、社会基础产业全面互联网化，网络安全（或称广义的信息安全）面临的威胁越来越大，对网络安全的人才需求也呈现出井喷趋势。"}
{"title": "来自后方世界的隐匿威胁：后门与持久代理（二）", "url": "https://www.freebuf.com/articles/system/150314.html", "time": "2018-01-15", "level": "红色标题", "num_look": 601875, "num_comment": 13, "author": "2cat", "tags": ["系统安全"], "text": "继上篇后门与代理内容后，我觉得应该继续写下去。考虑到第一篇内容发出后不少看官提出了质疑与不同看法，有人认为技术点过于老旧，甚至高级黑的后门手段都是购买而来。对此，身为圈内人，我只想笑而不语。"}
{"title": "Linux SSH密码暴力破解技术及攻防实战", "url": "https://www.freebuf.com/sectool/159488.html", "time": "2018-01-15", "level": "现金奖励", "num_look": 1998001, "num_comment": 24, "author": "simeon", "tags": ["工具"], "text": "对于Linux操作系统来说，一般通过VNC、Teamviewer和SSH等工具来进行远程管理，SSH是 Secure Shell的缩写，由IETF的网络小组所制定；SSH 为建立在应用层基础上的安全协议。"}
{"title": "近期网络安全APT攻击事件分析汇总", "url": "https://www.freebuf.com/articles/paper/159412.html", "time": "2018-01-15", "level": "金币+12", "num_look": 491780, "num_comment": 6, "author": "dadaozeikaka", "tags": ["安全报告"], "text": "今天分享给大家的，是一篇2017年末至2018年初的网络安全事件分析报告汇总，我将会结合我们的威胁情报分析平台，对这些安全事件进行一次汇总分析！"}
{"title": "安卓手机的NFC功能可截取非接触IC卡交互数据，用户需警惕", "url": "https://www.freebuf.com/articles/terminal/158805.html", "time": "2018-01-15", "level": "金币+12", "num_look": 548139, "num_comment": 12, "author": "xinmeow", "tags": ["终端安全"], "text": "借助CM9 rom 2012年2月版本，新增的nfc读写标签功能，实现软件卡模拟。"}
{"title": "Buf早餐铺 | Oracle WebLogic服务器上被黑客嵌入门罗币挖矿脚本；第一款Kotlin语言开发的安卓恶意软件出现；", "url": "https://www.freebuf.com/news/160134.html", "time": "2018-01-15", "level": "", "num_look": 240177, "num_comment": 240177, "author": "Elaine_z", "tags": ["资讯"], "text": "新的一周已经开始，新年的氛围也愈加强烈，你准备好了吗？"}
{"title": "做有责任的盗火者——“聚焦漏洞补完生态”记2018互联网安全责任峰会", "url": "https://www.freebuf.com/fevents/160144.html", "time": "2018-01-14", "level": "", "num_look": 126516, "num_comment": 126516, "author": "Elaine_z", "tags": ["活动"], "text": "为了应对更为广泛、链接更为密集的物联网、人工智能时代的到来，我们想要探寻互联网安全责任的边界和深度。"}
{"title": "Python工具分析风险数据", "url": "https://www.freebuf.com/sectool/159197.html", "time": "2018-01-14", "level": "", "num_look": 365211, "num_comment": 3, "author": "岂安科技", "tags": ["工具"], "text": "随着网络安全信息数据大规模的增长,应用数据分析技术进行网络安全分析成为业界研究热点，小安在这次小讲堂中带大家用Python工具对风险数据作简单分析。"}
{"title": "腾讯2018守护者计划大会：黑产对抗进行中", "url": "https://www.freebuf.com/fevents/160178.html", "time": "2018-01-14", "level": "", "num_look": 344022, "num_comment": 1, "author": "kylin1415", "tags": ["活动"], "text": "非法入侵计算机系统、窃取企业和个人用户信息、制作销售黑产工具以及从事电信网络诈骗……近年来黑色产业威胁愈演愈烈，各环节分工合作多元化、专业化、集团化。"}
{"title": "一步一步理解CPU芯片漏洞：Meltdown与Spectre", "url": "https://www.freebuf.com/articles/system/159811.html", "time": "2018-01-14", "level": "现金奖励", "num_look": 963922, "num_comment": 4, "author": "diting0x", "tags": ["系统安全"], "text": "Meltdown对应CVE-2017-5754（乱序执行缓存污染），Spectre对应CVE-2017-5753（边界检查绕过）与CVE-2017-5715（分支目标注入）。"}
{"title": "经验分享 | XSS手工利用方式", "url": "https://www.freebuf.com/sectool/159689.html", "time": "2018-01-14", "level": "金币+12", "num_look": 965415, "num_comment": 10, "author": "m09046105", "tags": ["工具"], "text": ""}
{"title": "APT新动向 | 揭秘黄金鼠组织的三次攻击行动", "url": "https://www.freebuf.com/news/159750.html", "time": "2018-01-14", "level": "", "num_look": 262152, "num_comment": 262152, "author": "360企业安全", "tags": ["资讯"], "text": ""}
{"title": "CoffeeMiner：劫持WiFi网络接入设备进行“挖矿”的框架", "url": "https://www.freebuf.com/articles/wireless/159688.html", "time": "2018-01-13", "level": "", "num_look": 724874, "num_comment": 8, "author": "clouds", "tags": ["无线安全"], "text": "本文中我们就来讨论，如何以MITM方式在html页面中注入javascript，让那些接入公共WIFI的电子设备成为黑客手中的“挖矿”矿工。"}
{"title": "择机行事 | 既然放假了，那就去钓鱼吧！", "url": "https://www.freebuf.com/news/159491.html", "time": "2018-01-13", "level": "", "num_look": 258477, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "根据赛门铁克的最新数据，在2017年，每131封电子邮件中就有一封是恶意邮件，而这也是近五年来频率最高的了。"}
{"title": "【FB TV】一周「BUF大事件」：英特尔芯片漏洞持续发酵厂商积极修复；支付宝被网信办约谈；WiFi联盟推出WPA3", "url": "https://www.freebuf.com/video/160093.html", "time": "2018-01-13", "level": "红色标题", "num_look": 354269, "num_comment": 354269, "author": "willhuang", "tags": ["视频"], "text": "英特尔芯片漏洞事件持续发酵，各大厂商积极修复；支付宝因年度账单事件被网信办约谈；WiFi联盟推出了新的无线认证标准WPA3。想要了解详情，请看本周的BUF大事件吧！"}
{"title": "年度盘点 | 2017 勒索软件威胁形势分析报告", "url": "https://www.freebuf.com/articles/paper/158875.html", "time": "2018-01-13", "level": "", "num_look": 428782, "num_comment": 2, "author": "360安全", "tags": ["安全报告"], "text": "勒索软件是近两年来影响最大，也最受关注的网络安全威胁形式之一。攻击者通过电子邮件、网络渗透、蠕虫病毒等多种形式，向受害者的电脑终端或服务器发起攻击，加密系统文件并勒索赎金。"}
{"title": "TurnipBit之DIY简易小水车", "url": "https://www.freebuf.com/geek/159392.html", "time": "2018-01-13", "level": "现金奖励", "num_look": 366955, "num_comment": 13, "author": "_橙子 ゝ", "tags": ["极客"], "text": "最近发现一个好玩的东西，名字叫TurnipBit，用micropython语言编辑，可以同时代码编辑跟拖拽，今天闲着无聊就带孩子一块做了个小水车，下面给大家上个成果图。"}
{"title": "冲顶大会辅助揭秘：王思聪撒的币，还是要靠技术来捡", "url": "https://www.freebuf.com/special/160050.html", "time": "2018-01-12", "level": "红色标题", "num_look": 780402, "num_comment": 12, "author": "shidongqi", "tags": ["特别企划"], "text": "继微信跳一跳小游戏之后，冲顶大会再次激起了无数程序员的激情，再加上民间高手的聪明才智，一夜之间涌现出了“冲顶秘籍”……"}
{"title": "快讯 | macOS漏洞导致本地管理员可以使用任何密码解锁App Store系统设置", "url": "https://www.freebuf.com/articles/system/159947.html", "time": "2018-01-12", "level": "", "num_look": 390860, "num_comment": 3, "author": "Sphinx", "tags": ["系统安全"], "text": "利用漏洞可以让本地管理员用任何用户名密码解锁App Store系统设置。也就是说如果你在办公室里离开时没有锁屏，别人就可以更改你的App Store设置。"}
{"title": "Buffer们的最爱都有啥？FreeBuf 2017年度数据盘点", "url": "https://www.freebuf.com/articles/others-articles/159997.html", "time": "2018-01-12", "level": "红色标题", "num_look": 601027, "num_comment": 31, "author": "FB客服", "tags": ["其他"], "text": "你知道除了默认头像外，Buffer们最喜欢的是哪个头像吗？你知道2017年哪些类型的文章最受青睐吗？"}
{"title": "挖洞经验 | 看我如何发现价值$10000美金的雅虎Cookie窃取漏洞", "url": "https://www.freebuf.com/vuls/159470.html", "time": "2018-01-12", "level": "", "num_look": 538580, "num_comment": 6, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "由于最近我在学习 Python ，所以我打算写点前期侦察脚本，来从大量雅虎子域名中过滤掉一些无效域名，以缩小有效的测试目标范围。"}
{"title": "2017全球僵尸网络DDOS攻击威胁态势报告", "url": "https://www.freebuf.com/articles/paper/159800.html", "time": "2018-01-12", "level": "", "num_look": 432784, "num_comment": 4, "author": "antiylab", "tags": ["安全报告"], "text": "本报告由安天捕风小组与电信云堤联合发布，本年度报告主要以安天捕风蜜网和电信云堤流量监测数据为基础，针对2017年发生的僵尸网络DDoS（分布式拒绝服务）攻击事件进行汇总分析。"}
{"title": "针对NFS的渗透测试", "url": "https://www.freebuf.com/articles/network/159468.html", "time": "2018-01-12", "level": "", "num_look": 775198, "num_comment": 7, "author": "secist", "tags": ["网络安全"], "text": "NFS（Network File System）即网络文件系统，是FreeBSD支持的文件系统中的一种，它允许网络中的计算机之间通过TCP/IP网络共享资源。"}
{"title": "病毒分析 | 一只“蜗牛”偷梁换柱，靠锁主页进行牟利", "url": "https://www.freebuf.com/articles/paper/159595.html", "time": "2018-01-12", "level": "金币+10", "num_look": 352124, "num_comment": 6, "author": "安全豹", "tags": ["安全报告"], "text": "众所周知，导航推广、淘宝客劫持可以给渠道商带来巨大的利益，使得木马病毒制造者纷纷变成推广渠道商。"}
{"title": "2017年IoT僵尸网络C&C服务器数量翻倍", "url": "https://www.freebuf.com/articles/wireless/159798.html", "time": "2018-01-12", "level": "", "num_look": 492300, "num_comment": 492300, "author": "shidongqi", "tags": ["无线安全"], "text": "2017年，用于管理物联网僵尸网络的命令和控制（C&C）服务器数量翻了一番多，从2016年的393个增长到2017年的943个。"}
{"title": "来自BlackHat的新姿势：Process Doppelgänging攻击技术与贴身防护", "url": "https://www.freebuf.com/articles/system/159628.html", "time": "2018-01-12", "level": "红色标题", "num_look": 412893, "num_comment": 2, "author": "360安全", "tags": ["系统安全"], "text": "2017欧洲黑帽大会（Blackhat EUROPE 2017）上，网络安全公司enSilo两名研究人员介绍了一种名为“Process Doppelgänging”的新型攻击。"}
{"title": "开源安全情报引擎Critical Stack使用入门", "url": "https://www.freebuf.com/sectool/159648.html", "time": "2018-01-12", "level": "金币+10", "num_look": 657940, "num_comment": 10, "author": "yysecurity", "tags": ["工具", "数据安全"], "text": "笔者曾参与恶意IP库（IP画像）建设工作，恶意IP库的建立和完善，在初期确实有效支援了安全运维工作，包括攻击流量黑名单，入侵检测与溯源等，但在中后期逐渐暴露了问题。"}
{"title": "BUF早餐铺 | Intel实测CPU漏洞补丁对性能影响不大；macOS再现严重漏洞；恶意软件LockPoS使用新的注入技术来避免检测；《绝地求生》国内外挂太多，国外玩家Steam刷屏求锁区", "url": "https://www.freebuf.com/news/159983.html", "time": "2018-01-12", "level": "", "num_look": 248975, "num_comment": 2, "author": "shidongqi", "tags": ["资讯"], "text": "又到周五，想必很多FreeBufer已经开启周末模式了，但也不能错过今天的早餐啦。"}
{"title": "芯片漏洞新进展：英特尔公布补丁对性能影响的测试结果；Meltdown的POC在Github上公开；NVIDIA更新GPU驱动以应对漏洞；IBM开始发放补丁；Ubuntu 16.04打补丁后出现boot问题", "url": "https://www.freebuf.com/news/159945.html", "time": "2018-01-11", "level": "红色标题", "num_look": 472065, "num_comment": 11, "author": "AngelaY", "tags": ["资讯"], "text": "Meltdown 和Spectre 漏洞事件仍在发酵，本文送上今天份的更新。更多内容可进入 FreeBuf 的“芯片底层漏洞”专题查看。"}
{"title": "Android恶意软件偷取Uber凭证", "url": "https://www.freebuf.com/articles/system/159447.html", "time": "2018-01-11", "level": "", "num_look": 352584, "num_comment": 1, "author": "secist", "tags": ["数据安全", "系统安全"], "text": "近期，一种新的Android恶意软件变种Android.Fakeapp被研究人员所披露，主要目标是窃取Uber用户的凭证信息，然后使用合法的Uber app的深层链接来隐瞒真相。"}
{"title": "旧版Windows打上CPU补丁后会出现性能下降", "url": "https://www.freebuf.com/news/159819.html", "time": "2018-01-11", "level": "", "num_look": 387578, "num_comment": 5, "author": "Sphinx", "tags": ["资讯"], "text": "微软已经确认，“熔毁”和“幽灵”补丁可能导致显着的性能下降。"}
{"title": "批量检测SQL注入", "url": "https://www.freebuf.com/articles/web/159264.html", "time": "2018-01-11", "level": "金币+10", "num_look": 895760, "num_comment": 19, "author": "muhe", "tags": ["WEB安全"], "text": "从一开始的手工一个网站一个网站去测，到之后的用google hacking的方法去找可疑链接，再到后面用sqlmap批量检测。也是经历了至少半年的时间。"}
{"title": "让我们一起看一看日益脆弱的软件供应链", "url": "https://www.freebuf.com/articles/paper/192641.html", "time": "2018-01-11", "level": "", "num_look": 31311, "num_comment": 31311, "author": "Alpha_h4ck", "tags": ["安全报告"], "text": "从伊朗到俄罗斯，各个国家都在把软件供应链作为攻击工具，来危害和扰乱敌对国的基础设施以及商业前景。"}
{"title": "芯片漏洞不只是修复那么简单：补丁对性能的影响已经显现；部分企业选择暂缓修复", "url": "https://www.freebuf.com/news/159737.html", "time": "2018-01-11", "level": "", "num_look": 409612, "num_comment": 6, "author": "AngelaY", "tags": ["观点", "资讯"], "text": "按理说打完补丁、升级更新就没事儿了。但显然事实没有这么简单，有些不幸的用户遇到了更多麻烦。"}
{"title": "ProxyChains实现自动添加代理逃避检测", "url": "https://www.freebuf.com/articles/network/159199.html", "time": "2018-01-11", "level": "现金奖励", "num_look": 1106354, "num_comment": 8, "author": "yuegui_2004", "tags": ["网络安全"], "text": "使用爬虫爬取网站或者使用扫描器扫描目标时经常会遇到扫描频率较为频繁导致IP被封或者限制访问的情况，这时候我们就需要考虑利用IP代理的方式不断的变换IP进行爬虫和扫描，从而逃避目标端的检测。"}
{"title": "经验分享 | 基于代理IP的挖掘与分析", "url": "https://www.freebuf.com/articles/web/159172.html", "time": "2018-01-11", "level": "现金奖励", "num_look": 1413932, "num_comment": 25, "author": "feiniao", "tags": ["WEB安全"], "text": "废话不多说，直入主题。关于代理IP的挖掘与分析，个人的一些分析与总结。"}
{"title": "Palo Alto防火墙远程代码执行漏洞关键技术分析", "url": "https://www.freebuf.com/articles/es/159119.html", "time": "2018-01-11", "level": "现金奖励", "num_look": 445020, "num_comment": 5, "author": "xmwanth", "tags": ["企业安全"], "text": "这篇文章是对Palo Alto防火墙产品未授权远程代码执行漏洞（CVE-2017-15944 ）中授权验证功能绕过漏洞的详细技术分析。"}
{"title": "BUF早餐铺 | 微软修复56个安全问题；Reddit 用户比特币被盗；支付宝因年度账单事件被约谈；中国内地iCloud服务将由国内公司负责", "url": "https://www.freebuf.com/news/159862.html", "time": "2018-01-11", "level": "", "num_look": 269231, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "天寒地冻，来份热腾腾的包子做早餐。暖胃又暖心！"}
{"title": "过年缺钱，缺女友？联想SRC这里全都有", "url": "https://www.freebuf.com/fevents/159878.html", "time": "2018-01-10", "level": "红色标题", "num_look": 412989, "num_comment": 12, "author": "漏洞盒子", "tags": ["活动"], "text": "这可能是今年（农历年）最后一波发财的机会了。"}
{"title": "简要指南 | 处理器Meltdown & Spectre漏洞修复", "url": "https://www.freebuf.com/vuls/159751.html", "time": "2018-01-10", "level": "", "num_look": 443448, "num_comment": 1, "author": "360安全", "tags": ["安全报告", "漏洞"], "text": "2018年1月4日，Jann Horn等安全研究者披露了\"Meltdown\"(CVE-2017-5754)和\"Spectre\"(CVE-2017-5753 & CVE-2017-5715)两组CPU特性漏洞。本文对其进行综述。"}
{"title": "“噩梦公式”二代 | 2018年微软修复的首个Office 0day漏洞（CVE-2018-0802）分析", "url": "https://www.freebuf.com/vuls/159789.html", "time": "2018-01-10", "level": "", "num_look": 1208166, "num_comment": 7, "author": "360安全", "tags": ["安全报告", "漏洞"], "text": "2018年1月的微软安全补丁中修复了360核心安全高级威胁应对团队捕获的office 0day漏洞。"}
{"title": "话题讨论 | 前任是网络安全从业者是什么体验？", "url": "https://www.freebuf.com/news/159710.html", "time": "2018-01-10", "level": "红色标题", "num_look": 426464, "num_comment": 31, "author": "FB客服", "tags": ["资讯"], "text": "北漂黑阔GB昨天（一个人）也去看了这部电影，用他的话说，是为了“祭奠逝去的爱情”。"}
{"title": "国内主流安卓APP被曝存在“应用克隆”风险", "url": "https://www.freebuf.com/articles/terminal/159792.html", "time": "2018-01-10", "level": "红色标题", "num_look": 583240, "num_comment": 7, "author": "shidongqi", "tags": ["终端安全"], "text": "1月9日，“应用克隆”这一移动攻击威胁模型正式对外披露。腾讯安全玄武实验室与知道创宇404实验室，在联合召开的技术研究成果发布会上公布并展示了这一重大研究成果。"}
{"title": "针对网络犯罪领域的机器学习", "url": "https://www.freebuf.com/news/158720.html", "time": "2018-01-10", "level": "", "num_look": 238051, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "近期的调查结果表明，网络犯罪分子已经开始在网络攻击活动中使用机器学习技术了，而结合了机器学习的网络攻击将会变得“更好，更快、更强”。"}
{"title": "经验分享 | 通往CISSP成功之路", "url": "https://www.freebuf.com/articles/others-articles/159094.html", "time": "2018-01-10", "level": "现金奖励", "num_look": 412805, "num_comment": 20, "author": "securitydark", "tags": ["其他"], "text": "十年之前，走出象牙塔还是葱葱少年。十年之后，面对体重秤上的数字俨然已成油腻中年男。十年间，见证了网络安全在国内的崛起与快速发展。面对过往，拿下CISSP也许是对自己从业十年最好的总结。"}
{"title": "关于Android平台WebView控件存在跨域高危漏洞的安全公告", "url": "https://www.freebuf.com/articles/terminal/159787.html", "time": "2018-01-10", "level": "", "num_look": 417390, "num_comment": 6, "author": "CNCERT", "tags": ["终端安全"], "text": "2017年12月7日，国家信息安全漏洞共享平台（CNVD）接收到腾讯玄武实验室报送的Android WebView存在跨域访问漏洞(CNVD-2017-36682)。"}
{"title": "从一道CTF题目看Gopher攻击MySql", "url": "https://www.freebuf.com/articles/web/159342.html", "time": "2018-01-10", "level": "金币+14", "num_look": 697834, "num_comment": 15, "author": "undef1ned", "tags": ["WEB安全", "数据安全"], "text": "虽然比赛过程中没做出来，结束后仔细研究了一下。感觉很有意思，分享给大家。再次体会到重要的不是结果，而是研究的过程。"}
{"title": "Micropython进阶 | 如何用单片机制作鞋码匹配仪", "url": "https://www.freebuf.com/sectool/159155.html", "time": "2018-01-10", "level": "金币+14", "num_look": 252707, "num_comment": 1, "author": "bodasister", "tags": ["工具"], "text": "非常简单的小制作，适合新手以及初学者 入门学习，也请各位大神多多指点。自己测了下稍微有些偏差，显示鞋码比我实际鞋码大了一号，各位大大有没有意见我改正下。"}
{"title": "去哪儿网招聘安全开发人才", "url": "https://www.freebuf.com/jobs/159278.html", "time": "2018-01-10", "level": "", "num_look": 243990, "num_comment": 3, "author": "gyreg", "tags": ["安全招聘"], "text": "去哪儿网凭借其便捷、先进的智能搜索技术对互联网上的旅行信息进行整合，为用户提供实时、可靠、全面的旅游产品查询和信息比较服务。"}
{"title": "死磕Meltdown和Spectre漏洞，应对方案汇总", "url": "https://www.freebuf.com/vuls/159642.html", "time": "2018-01-10", "level": "金币+10", "num_look": 628961, "num_comment": 6, "author": "2cat", "tags": ["漏洞", "观点"], "text": "最近几天被两个漏洞折磨的头晕脑胀，为了更好的给客户提供服务，翻遍了中外网站大部份相关热文，现整理出下面10多类应急方案，与各位一线兄弟共勉。"}
{"title": "修复KRACK漏洞，WPA3 WiFi标准即将到来", "url": "https://www.freebuf.com/news/159670.html", "time": "2018-01-10", "level": "", "num_look": 281451, "num_comment": 5, "author": "shidongqi", "tags": ["资讯"], "text": "几个月前，WPA2安全协议被曝存在高危漏洞，容易遭受KRACK攻击，这几乎影响了所有的WIFI设备。为了从根本上解决这一问题，也促使新的WIFI网络保护协议WPA3的诞生。"}
{"title": "白象APT组织已将CVE 2017-11882纳入攻击武器库", "url": "https://www.freebuf.com/articles/paper/159268.html", "time": "2018-01-10", "level": "", "num_look": 389116, "num_comment": 9, "author": "腾讯电脑管家", "tags": ["安全报告"], "text": "腾讯反病毒实验室捕获一例针对某国大使馆的钓鱼文档，该钓鱼文档利用CVE-2017-11882漏洞传播远控木马。经过分析，该样本属于白象APT组织的攻击样本。"}
{"title": "Buf早餐铺 |  玩具制造商伟易达被FTC处以65万美元罚款；黑莓手机网站感染了Coinhive加密货币挖矿脚本；苹果针对 Spectre CPU 发布安全更新", "url": "https://www.freebuf.com/news/159649.html", "time": "2018-01-10", "level": "", "num_look": 195748, "num_comment": 1, "author": "Elaine_z", "tags": ["资讯"], "text": "寒冷的冬天，有温暖的FB早餐陪伴你！"}
{"title": "关于通过一类仿冒网站实施网络诈骗的通报预警及情况分析", "url": "https://www.freebuf.com/articles/web/159596.html", "time": "2018-01-09", "level": "", "num_look": 324157, "num_comment": 6, "author": "CNCERT", "tags": ["WEB安全", "安全报告"], "text": "诈骗分子通过此类钓鱼网站，一方面可以诱骗受害者填写银行卡号、密码等信息诈骗钱财；另一方面可以在受害者计算机上安装木马恶意程序，窃取受害者计算机上的相关信息。"}
{"title": "快讯 | AMD安全处理器被发现存在栈溢出漏洞", "url": "https://www.freebuf.com/news/159555.html", "time": "2018-01-09", "level": "", "num_look": 286499, "num_comment": 3, "author": "shidongqi", "tags": ["资讯"], "text": "谷歌云安全团队的安全研究员Cfir Cohen披露了AMD的安全处理器（PSP）的可信平台模块TMP中一个栈溢出漏洞。"}
{"title": "2018年的安全市场，Gartner怎么看？", "url": "https://www.freebuf.com/news/159728.html", "time": "2018-01-09", "level": "红色标题", "num_look": 249261, "num_comment": 2, "author": "Sphinx", "tags": ["资讯"], "text": "本文例举Gartner预测的未来安全行业重要趋势，希望对大家有所参考。"}
{"title": "【最新进展】芯片漏洞后续：苹果发布Spectre漏洞修复补丁；微软补丁导致系统变砖已紧急撤回；英特尔惹上官司", "url": "https://www.freebuf.com/news/159681.html", "time": "2018-01-09", "level": "红色标题", "num_look": 381829, "num_comment": 4, "author": "AngelaY", "tags": ["资讯"], "text": "Meltdown 与 Spectre 漏洞曝出之后，各大厂商都在紧急响应。目前事态还在进展，本文送上今天份的更新。"}
{"title": "GRON：一款让使JSON可以Grep的工具", "url": "https://www.freebuf.com/sectool/159097.html", "time": "2018-01-09", "level": "", "num_look": 506956, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍一款名叫gron的JSON数据检索工具，gron不仅可以将目标JSON数据进行离散化拆分，并能够让用户更加轻松地使用grep来对数据进行搜索。"}
{"title": "带360壳分析Umeng协议", "url": "https://www.freebuf.com/articles/network/158772.html", "time": "2018-01-09", "level": "现金奖励", "num_look": 562161, "num_comment": 4, "author": "skyun1314", "tags": ["网络安全"], "text": "为什么要带壳分析umeng协议啊，因为嘬呗。直接打开charles手机设置好代理，过滤掉肯定无关的链接，从手机打开需要抓包的软件，发现只有2条网络请求。"}
{"title": "拼多多寻找互联网安全大牛", "url": "https://www.freebuf.com/jobs/159218.html", "time": "2018-01-09", "level": "", "num_look": 357689, "num_comment": 22, "author": "拼多多", "tags": ["安全招聘"], "text": "拼多多，国内成长最快的独角兽公司，电商行业的一匹黑马。逾90%的985/211名校生团队，用户体量超2亿。"}
{"title": "共享威胁情报，协同打击犯罪 | 专访Fortinet全球安全战略官Derek Manky", "url": "https://www.freebuf.com/articles/people/158962.html", "time": "2018-01-09", "level": "红色标题", "num_look": 292506, "num_comment": 2, "author": "Elaine_z", "tags": ["人物志", "活动"], "text": "打击犯罪，赢得这场对抗全球网络犯罪的战争。"}
{"title": "Intel CPU芯片漏洞分析及修复措施", "url": "https://www.freebuf.com/vuls/159345.html", "time": "2018-01-09", "level": "", "num_look": 532242, "num_comment": 9, "author": "任子行", "tags": ["漏洞", "系统安全"], "text": "2018年1月3号Google Project Zero 团队成员 Jann Horn 在博客中披露了英特尔等处理器芯片基础架构中存在一个非常严重的安全漏洞。该漏洞存在2种攻击方式Spectre 和 Meltdown。"}
{"title": "经验分享 | 如何做好基础安全设备运维", "url": "https://www.freebuf.com/articles/es/159265.html", "time": "2018-01-09", "level": "现金奖励", "num_look": 722507, "num_comment": 8, "author": "白河·愁", "tags": ["企业安全"], "text": "基础安全设备包含构造业务安全防御系统的常用安全设备，能够搭建深度防御体系的各种安全设备、安全软件。大型的互联网结构不太一样，主要为数据流量很大，传统安全厂家的设备很难满足需求。"}
{"title": "史上最大CPU漏洞Meltdown & Spectre 影响与修复指南", "url": "https://www.freebuf.com/articles/system/159577.html", "time": "2018-01-09", "level": "", "num_look": 471567, "num_comment": 3, "author": "任子行", "tags": ["系统安全"], "text": "对于2018年1月3日Intel CPU被Google Project Zero团队爆出的漏洞Spectre和Meltdown，影响Intel、AMD以及ARM等多个厂商的产品，受影响的操作系统平台有Windows、Linux、Android、IOS以及Mac OS等。"}
{"title": "摩诃草APT团伙新脚本类攻击样本分析", "url": "https://www.freebuf.com/articles/network/159059.html", "time": "2018-01-09", "level": "", "num_look": 554664, "num_comment": 8, "author": "奇安信威胁情报中心", "tags": ["安全报告", "网络安全"], "text": "“摩诃草”组织，又称Hangover、Viceroy Tiger、Patchwork、Dropping Elephant、MONSOON，国内其他安全厂商也称其为白象、丰收行动。"}
{"title": "年度盘点 | 2017移动应用十大高危漏洞", "url": "https://www.freebuf.com/articles/neopoints/159133.html", "time": "2018-01-09", "level": "", "num_look": 306524, "num_comment": 2, "author": "通付盾", "tags": ["安全报告", "观点"], "text": "从1月的一大波Android银行木马袭击，到3.15晚会公民信息泄露事件披露；从5月的“勒索病毒Wanncry”变种在移动端侵袭，到11月的手机变成挖矿机；2017年移动互联网安全事件一波未平一波又起。"}
{"title": "BUF 早餐铺 | 谷歌的“Spectre攻击”修补方案Retpoline，可避免性能影响 针对韩国平昌奥运会的钓鱼攻击已经出现； 百度涉嫌监听用户电话被起诉", "url": "https://www.freebuf.com/news/159584.html", "time": "2018-01-09", "level": "", "num_look": 346374, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "谷歌的“Spectre攻击”修补方案Retpoline，可避免性能影响；针对韩国平昌奥运会的钓鱼攻击已经出现；西数“My Cloud”存储设备中被爆出重要漏洞。"}
{"title": "年度盘点 | 安全测试者偏爱的安全测试工具", "url": "https://www.freebuf.com/sectool/159428.html", "time": "2018-01-08", "level": "红色标题", "num_look": 1664465, "num_comment": 31, "author": "AngelaY", "tags": ["工具", "特别企划"], "text": "国外网站 Concise Courses 分类推荐了一些好用的安全测试工具，本文摘录并列举一二，供安全从业者与爱好者参考。"}
{"title": "用Golang写的域名信息搜集工具", "url": "https://www.freebuf.com/sectool/159100.html", "time": "2018-01-08", "level": "", "num_look": 481817, "num_comment": 5, "author": "secist", "tags": ["工具"], "text": "blacksheepwall是一款由Go语言编写的域名信息搜集工具 ，你也可以在你的工具中将它作为一个独立软件包来使用。"}
{"title": "快讯 | 针对韩国平昌奥运会的钓鱼攻击已经出现", "url": "https://www.freebuf.com/news/159548.html", "time": "2018-01-08", "level": "红色标题", "num_look": 317445, "num_comment": 6, "author": "Sphinx", "tags": ["资讯"], "text": "再过一个月，平昌奥运会就要开始了，而黑客们已经针对平昌奥运会进行针对敏感信息和财务信息的鱼叉式网络钓鱼攻击。"}
{"title": "phpMyAdmin被曝存在严重CSRF漏洞可对数据库造成破坏", "url": "https://www.freebuf.com/news/159117.html", "time": "2018-01-08", "level": "", "num_look": 395296, "num_comment": 4, "author": "clouds", "tags": ["资讯"], "text": "近期，印度安全工程师Ashutosh Barot发现phpMyAdmin存在严重CSRF漏洞（跨站请求伪造），可以通过技巧欺骗管理员去点击构造链接。"}
{"title": "阿里云云平台安全招聘各类安全专家", "url": "https://www.freebuf.com/jobs/159033.html", "time": "2018-01-08", "level": "", "num_look": 362840, "num_comment": 5, "author": "woyigui", "tags": ["安全招聘"], "text": "阿里云创立于2009年，是全球领先的云计算及人工智能科技公司，为200多个国家和地区的企业、开发者和政府机构提供服务。"}
{"title": "谷歌的“Spectre攻击”修补方案Retpoline，可避免性能影响", "url": "https://www.freebuf.com/articles/system/159490.html", "time": "2018-01-08", "level": "红色标题", "num_look": 656650, "num_comment": 5, "author": "Elaine_z", "tags": ["系统安全"], "text": "这种方法据称对计算机性能的影响“微乎其微”，如果与其他补丁对CPU性能影响程度进行对比的话。"}
{"title": "Meltdown与Spectre：近期CPU特性漏洞安全公告", "url": "https://www.freebuf.com/vuls/159341.html", "time": "2018-01-08", "level": "", "num_look": 471056, "num_comment": 9, "author": "360安全", "tags": ["漏洞", "系统安全"], "text": "2018年1月4日，Jann Horn等安全研究者披露了\"Meltdown\"(CVE-2017-5754)和\"Spectre\"(CVE-2017-5753& CVE-2017-5715)两组CPU特性漏洞。"}
{"title": "2018年1月安卓安全公告，谷歌修复5个关键BUG和33个高危漏洞", "url": "https://www.freebuf.com/news/159472.html", "time": "2018-01-08", "level": "", "num_look": 262113, "num_comment": 1, "author": "shidongqi", "tags": ["漏洞", "资讯"], "text": "作为Android安全公告的一部分，谷歌在2018年1月修复了5个关键漏洞和33个严重缺陷。这家科技巨头解决了38个Android安全漏洞，其中20个是2018-01-01安全补丁的一部分以及18个2018-01-05的安全补丁。"}
{"title": "新时代下的网络安全新常态：2018中国网络安全十大趋势预测", "url": "https://www.freebuf.com/articles/network/159145.html", "time": "2018-01-08", "level": "", "num_look": 862153, "num_comment": 4, "author": "360企业安全", "tags": ["网络安全"], "text": "中国网络安全行业，不仅面临着全球网络空间共同的安全威胁，还有因为不同基础和不同发展阶段带来的个性问题挑战，以及因为不同的国家战略和政策法规下带来的监管环境的不同。"}
{"title": "反编译挖掘吃鸡（绝地求生）辅助外挂的老窝", "url": "https://www.freebuf.com/news/159170.html", "time": "2018-01-08", "level": "现金奖励", "num_look": 1083068, "num_comment": 26, "author": "野狗", "tags": ["资讯"], "text": "绝对求生感觉最近一直很火，当然作为一个程序员来说我是不怎么喜欢玩游戏的，特别是这种烧配置的游戏。最关键还是没钱。"}
{"title": "BUF 早餐铺 | 苹果确认Meltdown和Spectre漏洞影响所有Mac和iOS设备，现已发放部分补丁；微软紧急更新修复Meltdown和Spectre CPU漏洞；24万名DHS现任或前雇员遭遇数据泄漏问题", "url": "https://www.freebuf.com/news/159332.html", "time": "2018-01-08", "level": "", "num_look": 297369, "num_comment": 297369, "author": "Sphinx", "tags": ["资讯"], "text": "苹果确认Meltdown和Spectre漏洞影响所有Mac和iOS设备，现已发放部分补丁；微软紧急更新修复CPU漏洞；247000名 DHS现任或前雇员遭遇数据泄漏问题。"}
{"title": "研究人员公开披露macOS 0-day漏洞详情，利用该漏洞可完全接管系统", "url": "https://www.freebuf.com/news/158955.html", "time": "2018-01-07", "level": "", "num_look": 814452, "num_comment": 2, "author": "AngelaY", "tags": ["漏洞", "资讯"], "text": "2017 年 12 月 31 日，一名推特账号为 Siguza 的安全研究人员公布了 macOS 0-day 漏洞的详情。该漏洞是一个本地提权漏洞，影响到所有 macOS 版本。"}
{"title": "看我如何利用打印机窃取目标系统哈希值", "url": "https://www.freebuf.com/articles/system/158935.html", "time": "2018-01-07", "level": "", "num_look": 517992, "num_comment": 3, "author": "secist", "tags": ["系统安全"], "text": "这是我今年早些时候接手的一个渗透测试项目，我要做的是获取到目标系统的控制权限。但在后渗透测试阶段，我仅仅只发现了一台与目标内网无任何关联的计算机……"}
{"title": "穿透内网防线|USB自动渗透手法总结", "url": "https://www.freebuf.com/sectool/158784.html", "time": "2018-01-07", "level": "现金奖励", "num_look": 1076079, "num_comment": 10, "author": "GeekOnline", "tags": ["工具", "终端安全"], "text": "以下为了叙述方便我们便用USB或U盘指代采用USB接口标准的可移动存储介质来详细介绍常见的三种利用该类型设备的攻击手法。"}
{"title": "【FB TV】一周「BUF大事件」：英特尔芯片现巨大漏洞；绝地求生辅助程序暗藏挖矿木马；跳一跳刷分需谨慎", "url": "https://www.freebuf.com/video/158767.html", "time": "2018-01-07", "level": "红色标题", "num_look": 455160, "num_comment": 1, "author": "willhuang", "tags": ["视频"], "text": "英特尔芯片现巨大漏洞，修复后PC将普遍降速。绝地求生辅助程序暗藏挖矿木马，你的电脑变成矿机了么？跳一跳引爆微信，刷分需谨慎。想要了解详情，请看本周的BUF大事件吧！"}
{"title": "开源工具Zeus-Scanner宙斯扫描器", "url": "https://www.freebuf.com/sectool/158355.html", "time": "2018-01-07", "level": "金币+8", "num_look": 679267, "num_comment": 5, "author": "scu-igroup", "tags": ["工具"], "text": "Zeus-Scanner中文可以翻译为宙斯扫描器，是github上一款用python开发的开源工具"}
{"title": "华为路由器与僵尸网络不得不说的故事", "url": "https://www.freebuf.com/articles/terminal/158889.html", "time": "2018-01-06", "level": "", "num_look": 1140613, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "在过去的十年里，联网设备数量的增长已经超过了两百亿，智能化程度也更高了。虽然这些设备在便携性和实用性等方面得分非常高，但这些设备的安全得分还未能达到标准。"}
{"title": "奥巴马网络安全专员告诉你如何保护网上购物安全", "url": "https://www.freebuf.com/articles/web/158922.html", "time": "2018-01-06", "level": "", "num_look": 679300, "num_comment": 679300, "author": "Alpha_h4ck", "tags": ["WEB安全", "数据安全"], "text": "网购可谓是假期“必不可少”的一部分了，网络犯罪分子也发现，在某些重大节日里，人们在网购的时候或多或少都会放松警惕，而这也给犯罪分子们提供了可乘之机。"}
{"title": "Inndy的Hack Game攻略（WEB篇）", "url": "https://www.freebuf.com/articles/web/158885.html", "time": "2018-01-06", "level": "金币+8", "num_look": 1161010, "num_comment": 15, "author": "baymax1908", "tags": ["WEB安全"], "text": "先推荐一个很有意思适合初学者的CTF练习网站，网上关于这套题目的攻略很少，并且不全，那么就自己写一个攻略。"}
{"title": "利用Struts2漏洞突破360与云锁防护", "url": "https://www.freebuf.com/vuls/158774.html", "time": "2018-01-06", "level": "现金奖励", "num_look": 530214, "num_comment": 30, "author": "時光老人你可不可以走慢點", "tags": ["WEB安全", "漏洞"], "text": "这一次的上传可算是曲折不已。目标服务器上装有360和云锁防护软件。不过没关系一步步突破拿下的瞬间感觉到了满满的欢喜。话不多说，直接开搞。"}
{"title": "批量挖SRC漏洞的一种打开方式", "url": "https://www.freebuf.com/sectool/158882.html", "time": "2018-01-06", "level": "现金奖励", "num_look": 1518991, "num_comment": 23, "author": "Aderduo", "tags": ["WEB安全", "企业安全"], "text": "混迹在各大SRC平台的白帽子手里都握着很多法宝，或私藏或公开。而给大家介绍下基于cms的漏洞扫描，如何挖漏洞。"}
{"title": "春运抢票大作战：传说中的抢票神器真的存在吗？", "url": "https://www.freebuf.com/special/159327.html", "time": "2018-01-05", "level": "", "num_look": 1894952, "num_comment": 17, "author": "shidongqi", "tags": ["特别企划"], "text": "一到年底，除了去期待年终奖之外， 还有让很多人头疼的事情——春运抢票。无疑，2018年春运，我们依然没能逃脱“世史上最难抢票年”的魔咒。"}
{"title": "处理器安全漏洞Meltdown和Spectre爆发，老外精彩评论汇总", "url": "https://www.freebuf.com/news/159328.html", "time": "2018-01-05", "level": "红色标题", "num_look": 594304, "num_comment": 4, "author": "Elaine_z", "tags": ["资讯"], "text": "和过去每一场安全战役一样，这是艰苦且争分夺秒的战斗。但也有苦中作乐的一面。"}
{"title": "处理器A级漏洞Meltdown（熔毁）和Spectre（幽灵）分析报告", "url": "https://www.freebuf.com/vuls/159269.html", "time": "2018-01-05", "level": "红色标题", "num_look": 1179353, "num_comment": 10, "author": "antiylab", "tags": ["安全报告", "漏洞"], "text": "安天应急处理中心在2018年1月4日，针对Google公司的Project Zero等安全团队披露出的英特尔等处理器芯片存在非常严重的安全漏洞，发布了A级漏洞风险通告。"}
{"title": "声波攻击或导致硬盘数据损坏，电脑、监控系统和ATM等多种设备都需警惕", "url": "https://www.freebuf.com/news/158933.html", "time": "2018-01-05", "level": "", "num_look": 374178, "num_comment": 7, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "攻击者现可利用声波来干扰硬盘驱动器的正常工作了,会让目标设备暂时性或永久性的处于拒绝服务状态，并可用于攻击CCTV监控系统等处理关键任务的计算机系统。"}
{"title": "苹果确认Meltdown和Spectre漏洞影响所有Mac和iOS设备，现已发放部分补丁", "url": "https://www.freebuf.com/news/159314.html", "time": "2018-01-05", "level": "红色标题", "num_look": 443086, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "苹果也发布声明，确认所有 Mac 和 iOS 设备都受到 Meltdown 和 Spectre 漏洞影响。目前，苹果已经发布 iOS 11.2、macOS 10.13.2 和 tvOS 11.2 版本更新，以修复此漏洞。同时，Safari 的相关更新也会尽快发布。"}
{"title": "深度报告 | 揭秘朝鲜黑客组织Lazarus Group对加密货币的窃取手段", "url": "https://www.freebuf.com/articles/paper/158794.html", "time": "2018-01-05", "level": "", "num_look": 520469, "num_comment": 5, "author": "clouds", "tags": ["安全报告"], "text": "本报告中，我们着重对Lazarus Group从未被外界披露的一个加密货币攻击工具集进行分析，该工具集被Lazarus Group广泛用于全球加密货币组织、个人和相关机构的入侵攻击。"}
{"title": "Windows用户详细自查修复篇：微软紧急更新修复Meltdown和Spectre CPU漏洞", "url": "https://www.freebuf.com/vuls/159291.html", "time": "2018-01-05", "level": "红色标题", "num_look": 787127, "num_comment": 12, "author": "Elaine_z", "tags": ["漏洞", "系统安全"], "text": "恭喜！经过以上步骤，你终于成功在Windows系统级别修复了Meltdown和Spectre漏洞了。"}
{"title": "火币网招聘安全工程师", "url": "https://www.freebuf.com/jobs/159021.html", "time": "2018-01-05", "level": "", "num_look": 290470, "num_comment": 10, "author": "dahuobi", "tags": ["安全招聘"], "text": "火币网（HuoBi）由北京火币天下网络技术有限公司运营，是面向全球的数字货币交易平台之一。"}
{"title": "及时更新浏览器，Mozilla确认Meltdown和Spectre可通过Web进行漏洞利用", "url": "https://www.freebuf.com/articles/web/159274.html", "time": "2018-01-05", "level": "红色标题", "num_look": 578073, "num_comment": 4, "author": "Elaine_z", "tags": ["WEB安全", "系统安全"], "text": "Mozilla已经正式确认，最近披露的 Meltdown和Spectre CPU漏洞 —— 可能通过 Web 站点内容（比如JavaScript文件）进行漏洞利用"}
{"title": "Openload.co等网站绕过CoinHive，使用客户端浏览器算力挖取门罗币", "url": "https://www.freebuf.com/articles/paper/158798.html", "time": "2018-01-05", "level": "", "num_look": 410102, "num_comment": 4, "author": "360安全", "tags": ["安全报告"], "text": "从2017年12月24日，我们注意到一组网站正在滥用客户终端浏览器的算力在挖矿。攻击者在利用了 CoinHive 的浏览器端挖矿代码基础上，完全绕过 CoinHive 自己运营。"}
{"title": "“网动仪”竟能提前1天预警本次伊朗暴动？来看看是怎么做到的", "url": "https://www.freebuf.com/news/159056.html", "time": "2018-01-05", "level": "", "num_look": 199309, "num_comment": 199309, "author": "outerheaven", "tags": ["资讯"], "text": "伊朗当地时间2017年12月27日11时30分始，埃文科技通过自主研发的产品“网动仪（IP WAVE）”，成功监测到伊朗多个地区网络中断，这些地区至今尚未完全恢复网络通信。"}
{"title": "移动端C#病毒“东山再起”，利用知名应用通信实现远控隐私窃取", "url": "https://www.freebuf.com/articles/terminal/158503.html", "time": "2018-01-05", "level": "", "num_look": 508111, "num_comment": 3, "author": "AVLTeam", "tags": ["终端安全"], "text": "伴随着手机的全面普及和移动互联网的发展，以移动终端为平台的攻防对抗也愈演愈烈。针对日益升级的恶意代码检测技术，恶意攻击者的反查杀手段相应也在不断变化应对。"}
{"title": "震惊！原来羊毛党是这样套现京东、亚马逊礼品卡的", "url": "https://www.freebuf.com/articles/network/158047.html", "time": "2018-01-05", "level": "金币+8", "num_look": 939690, "num_comment": 31, "author": "loophole", "tags": ["网络安全"], "text": "举个例子，一张500元9折的购物卡，“套现族”以400元的价格收购，帮人代刷后收取450元的现金，一进一出就是50元的收益。"}
{"title": "经验分享 | 企业如何做好安全基线配置", "url": "https://www.freebuf.com/articles/es/158781.html", "time": "2018-01-05", "level": "现金奖励", "num_look": 862146, "num_comment": 10, "author": "白河·愁", "tags": ["企业安全"], "text": "一个组织在不同的时期部署了不同的业务系统，承载业务系统的是不同的操作系统和支持系统。业务系统在运行期间，基本上很少做操作系统的升级或变更。"}
{"title": "BUF早餐铺 | Intel芯片漏洞风波升级；支付宝深夜就年度账单道歉；PiKarma Python脚本可用于识别恶意WiFi网络；浏览器内置密码管理器漏洞被用于追踪用户", "url": "https://www.freebuf.com/news/159175.html", "time": "2018-01-05", "level": "", "num_look": 236106, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "2018年注定是不平凡的一年。除了如往年一样的例行刷屏之外，却也整出不少风波，也让今天的早餐铺足够丰盛。"}
{"title": "芯片级安全漏洞后续：谷歌表示不止Intel，每个1995年后的处理器都可能受影响", "url": "https://www.freebuf.com/news/159135.html", "time": "2018-01-04", "level": "红色标题", "num_look": 942137, "num_comment": 36, "author": "Elaine_z", "tags": ["系统安全", "资讯"], "text": "昨天不少外媒报道了 Intel 芯片级安全漏洞出现，可能导致 Linux 和 Windows 内核关键部分需要重新设计。"}
{"title": "PowerShell Empire实战入门篇", "url": "https://www.freebuf.com/sectool/158393.html", "time": "2018-01-04", "level": "现金奖励", "num_look": 1525275, "num_comment": 22, "author": "FK_T", "tags": ["WEB安全", "工具"], "text": "PowerShsell Empire中文简称 \"帝国\" ，可能大多数只听说过这款内网渗透神器，针对windows系统平台而打造的一款渗透工具。"}
{"title": "经验分享 | Burpsuite抓取非HTTP流量", "url": "https://www.freebuf.com/articles/network/158589.html", "time": "2018-01-04", "level": "现金奖励", "num_look": 1506997, "num_comment": 44, "author": "Shad0wpf_", "tags": ["网络安全"], "text": "使用Burp对安卓应用进行渗透测试的过程中，有时候会遇到某些流量无法拦截的情况，这些流量可能不是HTTP协议的，或者是“比较特殊”的HTTP协议(以下统称非HTTP流量)。"}
{"title": "全球十大上市网络安全企业与2018网络安全发展趋势", "url": "https://www.freebuf.com/articles/neopoints/158890.html", "time": "2018-01-04", "level": "金币+8", "num_look": 520835, "num_comment": 3, "author": "AdlerI", "tags": ["观点"], "text": "参考 Cybersecurity 500名单，以下列出全球 10 大上市网络安全企业，简介其安全业务，并结合 Gartner 等公司的报告，就 2018 年网络安全发展趋势与注意事项略作预测。"}
{"title": "用某品牌随身WiFi进行钓鱼测试", "url": "https://www.freebuf.com/articles/network/158806.html", "time": "2018-01-04", "level": "现金奖励", "num_look": 646342, "num_comment": 17, "author": "iloveacm", "tags": ["网络安全"], "text": "搭建钓鱼 WiFi 来盗取账号密码已经成为一种很平常的攻击手段了，我在信安之路的文章上面也看到作者 98 用 kali 搭建钓鱼 WiFi 进行测试的文章，因此决定测试一下，便于研究防范。"}
{"title": "“一个人”的互金企业安全建设总结", "url": "https://www.freebuf.com/articles/neopoints/158724.html", "time": "2018-01-04", "level": "现金奖励", "num_look": 784015, "num_comment": 26, "author": "pur0", "tags": ["观点"], "text": "我也分享下自己的经验，也就当对这2年多来的甲方经验的总结。感谢群里的小伙伴们，感谢安全圈的各路大牛们和小伙伴们的帮助，更感谢朝夕相处的同事们的帮助。"}
{"title": "两次前端绕过渗透小结", "url": "https://www.freebuf.com/articles/web/158508.html", "time": "2018-01-04", "level": "现金奖励", "num_look": 491276, "num_comment": 13, "author": "0d9y", "tags": ["WEB安全"], "text": "一直想发一些渗透过程的东西和大家分享，可是渗透成功呢要过很久才能发布，然后就忘记了，最近遇到了两次和前端JS对抗的渗透过程。虽然最终没有成功，不过蛮有意思的，和大家分享一下。"}
{"title": "DIY树莓派之随身工具箱", "url": "https://www.freebuf.com/geek/158588.html", "time": "2018-01-04", "level": "现金奖励", "num_look": 791116, "num_comment": 19, "author": "Rc4x", "tags": ["极客"], "text": "摆弄树莓派有一年多了，在这里把经验分享给大家，少走弯路。"}
{"title": "BUF早餐铺 | macOS 0-day漏洞详情披露；英特尔芯片出现底层设计漏洞；GPS 定位系统漏洞或泄露用户信息；phpMyadmin出现严重CSRF漏洞", "url": "https://www.freebuf.com/news/159062.html", "time": "2018-01-04", "level": "", "num_look": 262173, "num_comment": 3, "author": "AngelaY", "tags": ["资讯"], "text": "华为 IoT 设备CVE-2017–17215漏洞利用方法公开；卡巴斯基杀毒软件可成为强大间谍工具；Necurs僵尸网络2017年底活跃；微信隐私保护不能靠相信腾讯的“节操”；"}
{"title": "快讯 | 华为IoT设备CVE-2017-17215的漏洞利用方法被公开在Pastebin上", "url": "https://www.freebuf.com/news/159024.html", "time": "2018-01-03", "level": "", "num_look": 426503, "num_comment": 5, "author": "Sphinx", "tags": ["资讯"], "text": "Satori和Brickerbot攻击中被使用的华为路由器exp被圣诞老人公布在了Pastebin上。"}
{"title": "WebLogic WLS组件漏洞复现", "url": "https://www.freebuf.com/vuls/158247.html", "time": "2018-01-03", "level": "现金奖励", "num_look": 979579, "num_comment": 4, "author": "Halohalo", "tags": ["漏洞"], "text": "WebLogic WLS组件中存在CVE-2017-10271远程代码执行漏洞，可以构造请求对运行WebLogic中间件的主机进行攻击，近期发现此漏洞的利用方式为传播挖矿程序。"}
{"title": "《绝地求生》辅助程序暗藏挖矿木马，腾讯电脑管家协助破案", "url": "https://www.freebuf.com/articles/system/158892.html", "time": "2018-01-03", "level": "红色标题", "num_look": 899093, "num_comment": 45, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "近日捕获的HSR币挖矿木马，隐藏在“绝地求生”辅助程序中，而由于“绝地求生”对电脑性能要求较高，不法分子瞄准”绝地求生”玩家电脑，相当于找到了“绝佳”的挖矿机器。"}
{"title": "迈克菲实验室2018威胁报告：预测五大网络安全趋势", "url": "https://www.freebuf.com/articles/system/158535.html", "time": "2018-01-03", "level": "", "num_look": 419565, "num_comment": 3, "author": "Covfefe", "tags": ["系统安全"], "text": "在本报告中，我们会谈到包括机器学习，勒索软件，无服务器应用程序以及隐私问题。"}
{"title": "修不完的漏洞，微信跳一跳刷分泛滥成灾？", "url": "https://www.freebuf.com/news/158906.html", "time": "2018-01-03", "level": "红色标题", "num_look": 741456, "num_comment": 15, "author": "shidongqi", "tags": ["资讯"], "text": "元旦假期前，微信小游戏功能上线，一款名为“跳一跳”的小游戏迅速在朋友圈刷屏。无需下载直接在微信小程序就可以玩，玩法简单、以上瘾，还能与朋友PK。"}
{"title": "威胁预警 | Ursnif银行木马或将再度活跃", "url": "https://www.freebuf.com/articles/paper/158580.html", "time": "2018-01-03", "level": "", "num_look": 248580, "num_comment": 3, "author": "腾讯电脑管家", "tags": ["安全报告"], "text": "当你美滋滋地在屏幕前查询余额时，电脑中“TA”那双贪婪的眼睛可能也在美滋滋地看着你。“TA”就是金融行业臭名昭著的Ursnif银行木马。"}
{"title": "话题讨论 | 也谈安全运维工作", "url": "https://www.freebuf.com/articles/neopoints/158586.html", "time": "2018-01-03", "level": "现金奖励", "num_look": 561233, "num_comment": 19, "author": "白河·愁", "tags": ["观点"], "text": "我在甲方工作多年，对甲方运维工作做下总结，主要工作包以下几方面……"}
{"title": "基于Python库Face_Recognition动手DIY人脸识别", "url": "https://www.freebuf.com/articles/terminal/158484.html", "time": "2018-01-03", "level": "现金奖励", "num_look": 734907, "num_comment": 12, "author": "淼淼兮与怀", "tags": ["极客", "终端安全"], "text": "前段时间了解了一个Python的一个开元函数库，并对其进行了分析、学习和实践，那么今天我们就来讲解一下如何使用face_recognition这个库来实现简单的人脸识别。"}
{"title": "开源软件源代码安全缺陷分析报告，探秘国内知名互联网公司产品安全状况", "url": "https://www.freebuf.com/articles/paper/158699.html", "time": "2018-01-03", "level": "", "num_look": 293053, "num_comment": 3, "author": "奇安信代码卫士", "tags": ["安全报告"], "text": "本期报告聚焦国内知名互联网公司的软件安全开发现状，通过检测公司旗下多款开源软件产品的安全缺陷，评估各公司的代码安全控制情况。"}
{"title": "Buf早餐铺 | 俄罗斯Lurk黑客组织成员承认因情报部门要求开发了WannaCry；Forever 21美国POS系统存在漏洞，用户支付信息恐泄漏", "url": "https://www.freebuf.com/news/158816.html", "time": "2018-01-03", "level": "", "num_look": 220088, "num_comment": 2, "author": "Elaine_z", "tags": ["资讯"], "text": "全新的2018年，你有什么新年愿望呢？"}
{"title": "Python+树莓派+YOLO打造一款人工智能相机", "url": "https://www.freebuf.com/geek/158084.html", "time": "2018-01-02", "level": "", "num_look": 716179, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["极客"], "text": "虽然DeepLens还未正式上市，但智能摄像机的概念已经诞生了。"}
{"title": "2018年，供应商预计将面临新的网络安全威胁", "url": "https://www.freebuf.com/articles/es/158696.html", "time": "2018-01-02", "level": "", "num_look": 345276, "num_comment": 1, "author": "shidongqi", "tags": ["企业安全"], "text": "严峻的事实是，全球58％的企业承认在过去的12个月里至少遇到过一次数据泄露事件，而其中一半的企业表示，它们至少遭遇了一次内部事件。"}
{"title": "挖洞经验 | 看我如何绕过Yahoo！View的CORS限制策略", "url": "https://www.freebuf.com/articles/web/158529.html", "time": "2018-01-02", "level": "", "num_look": 486086, "num_comment": 4, "author": "clouds", "tags": ["WEB安全"], "text": "本文讲述了作者发现雅虎电视社区娱乐网Yahoo!View的漏洞，由于Yahoo!View存在不规范的CORS方式，允许远程攻击者绕过其中的同源策略。"}
{"title": "快讯 | 三星浏览器被爆高危同源策略绕过漏洞", "url": "https://www.freebuf.com/news/158777.html", "time": "2018-01-02", "level": "", "num_look": 264031, "num_comment": 4, "author": "banish", "tags": ["资讯"], "text": "近日，三星安卓浏览器被爆严重漏洞，该漏洞预装在数以亿计的三星安卓设备上，如受害者通过三星安卓浏览器访问黑客控制的网站，将被窃取私人敏感数据。"}
{"title": "摩诃草组织最新漏洞攻击样本分析及预警", "url": "https://www.freebuf.com/vuls/157694.html", "time": "2018-01-02", "level": "", "num_look": 471495, "num_comment": 2, "author": "360安全", "tags": ["安全报告", "漏洞"], "text": "摩诃草组织（APT-C-09），又称HangOver、VICEROY TIGER、The Dropping Elephant、Patchwork，是一个来自于南亚地区的境外APT组织，该组织已持续活跃了7年。"}
{"title": "记一道PWN题的解题思路", "url": "https://www.freebuf.com/news/158520.html", "time": "2018-01-02", "level": "", "num_look": 386758, "num_comment": 3, "author": "野火研习社1", "tags": [], "text": "一直以来都在搞逆向，没事破解点小程序，打打CTF。但是CTF上的逆向题也是越来越难了，各种套路让人防不胜防。都说漏洞利用是门艺术，于是就决定来学学pwn。"}
{"title": "水滴事件后，你的摄像头就安全了吗？", "url": "https://www.freebuf.com/articles/wireless/158605.html", "time": "2018-01-02", "level": "金币+12", "num_look": 807824, "num_comment": 11, "author": "outerheaven", "tags": ["无线安全"], "text": "一度引起关注的「360水滴」事件，最终以关闭直播平台作为事件的结束。至此公众归于平静。但随着智能物联网家用设备的飞速发展，「360水滴」事件后，你的网络摄像头就安全吗？"}
{"title": "某CMS注入分析及注入点总结", "url": "https://www.freebuf.com/articles/web/157827.html", "time": "2018-01-02", "level": "金币+12", "num_look": 468906, "num_comment": 9, "author": "sjy93812", "tags": ["WEB安全"], "text": "Bluecms是一个地方网站的开源的cms，在很多地方性的网站上应用还是不少的，今天在逛seebug的时候看到了一个漏洞的公告。"}
{"title": "病毒预警 | 安全博客网站内含病毒，利用用户电脑疯狂“挖矿”", "url": "https://www.freebuf.com/news/158547.html", "time": "2018-01-02", "level": "", "num_look": 279618, "num_comment": 11, "author": "火绒安全", "tags": ["资讯"], "text": "12月28日，火绒安全团队发出警报，一个名为“邪恶十六进制”的安全博客网站的网页携带病毒“Trojan/JS.CoinMiner.d”，所有访问该网站的用户电脑，都会被当作“肉鸡”用来挖矿。"}
{"title": "Buf早餐铺 | DHS：33款紧急app中18款存在安全漏洞;知名安全专家John McAfee的Twitter账户被黑", "url": "https://www.freebuf.com/news/158593.html", "time": "2018-01-02", "level": "", "num_look": 194836, "num_comment": 194836, "author": "Elaine_z", "tags": ["资讯"], "text": "2018 的第二天，FreeBuf 依然陪伴你!"}
{"title": "口袋Kali：GPD7 mini laptop上的Kali Linux", "url": "https://www.freebuf.com/articles/terminal/158390.html", "time": "2018-01-01", "level": "", "num_look": 671540, "num_comment": 13, "author": "Alpha_h4ck", "tags": ["极客", "终端安全"], "text": "大概在几天之前，我买了一台GPDPocket 7。这是一台便携式视频游戏终端，其大小跟一台迷你电脑差不多。"}
{"title": "Fortinet FortiClient的Windows系统提权登录漏洞（附PoC）", "url": "https://www.freebuf.com/articles/terminal/158417.html", "time": "2018-01-01", "level": "", "num_look": 382155, "num_comment": 7, "author": "clouds", "tags": ["终端安全"], "text": "近期，Fortinet（飞塔）主机终端安全防护软件FortiClient，被曝在Windows登录界面处存在权限提升漏洞（CVE-2017-7344 ），可被攻击者利用。"}
{"title": "网站后台“空降”了一个管理员", "url": "https://www.freebuf.com/vuls/158446.html", "time": "2018-01-01", "level": "现金奖励", "num_look": 481590, "num_comment": 14, "author": "sjy93812", "tags": ["漏洞", "系统安全"], "text": "新的一年开始了，发点小福利。无意间发现了一个影响phpcms最新版本的漏洞。"}
{"title": "新年新气象 | 2018来了，黑阔们的元旦怎么过？", "url": "https://www.freebuf.com/fevents/158628.html", "time": "2018-01-01", "level": "红色标题", "num_look": 844717, "num_comment": 44, "author": "FB客服", "tags": ["活动"], "text": "11点的太阳给北京的冬天带来了暖意，在昌平区回龙观的一栋公寓里，黑阔GB的一天才刚刚开始~"}
{"title": "快讯 | McAfee创始人John McAfee Twitter帐号被黑", "url": "https://www.freebuf.com/news/158670.html", "time": "2017-12-31", "level": "", "num_look": 329762, "num_comment": 1, "author": "banish", "tags": ["资讯"], "text": "John McAfee,著名杀毒软件迈克菲的创始人，又被黑了twitter帐号。"}
{"title": "年度盘点 | 2017年的数据泄露带给我们的经验与教训", "url": "https://www.freebuf.com/news/158587.html", "time": "2017-12-31", "level": "红色标题", "num_look": 341976, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "今年，我尽自己所能协助各大企业和组织处理了很多安全事件。就我个人的经验来看，我所观察到的东西跟2016年的情况几乎没有什么区别。"}
{"title": "CVE 2017-0199漏洞利用的新姿势", "url": "https://www.freebuf.com/vuls/158142.html", "time": "2017-12-31", "level": "现金奖励", "num_look": 528249, "num_comment": 8, "author": "kczwa1", "tags": ["漏洞", "系统安全"], "text": "近日从客户处捕获一枚邮件附件中的可疑word样本，经过分析后发现其中针对 CVE 2017-0199 漏洞利用的新方法。"}
{"title": "WiFi万能钥匙招聘安全工程师", "url": "https://www.freebuf.com/jobs/158575.html", "time": "2017-12-31", "level": "", "num_look": 363320, "num_comment": 17, "author": "半夏初晴。", "tags": ["安全招聘"], "text": "WiFi万能钥匙是全球最大的网络共享平台，基于共享经济的模式，通过云计算和大数据技术，利用热点主人分享的闲置WiFi资源。"}
{"title": "新手科普 | 通过DVWA学习XSS", "url": "https://www.freebuf.com/articles/web/157953.html", "time": "2017-12-31", "level": "现金奖励", "num_look": 1070107, "num_comment": 6, "author": "LlawLiet", "tags": ["WEB安全"], "text": "这篇文章通过 dvwa 简单研究了三种类型的 xss，并且讲述了如何利用 xss 获取目标网站用户的 cookie。"}
{"title": "权限后门系列之一：手动打造Wordpress权限后门", "url": "https://www.freebuf.com/news/158069.html", "time": "2017-12-31", "level": "", "num_look": 260826, "num_comment": 2, "author": "c0debreak", "tags": ["资讯"], "text": "权限后门是最容易被管理员忽视的环节，通常需要对系统进行全面检查才能发现。本文以Wordpress为例，介绍两种新型的后门方式。"}
{"title": "年度盘点 | 2017年安全事件的背后：比特币的隐秘江湖", "url": "https://www.freebuf.com/news/158454.html", "time": "2017-12-30", "level": "", "num_look": 395714, "num_comment": 2, "author": "vulture", "tags": ["特别企划", "资讯"], "text": "在2017年全年的安全事件中，有一条贯穿始终的隐藏线索，这条线索在12月份达到顶峰并广受关注，它就是比特币。"}
{"title": "如何使用Burp和Magisk在Android 7.0监测HTTPS流量", "url": "https://www.freebuf.com/articles/terminal/158492.html", "time": "2017-12-30", "level": "", "num_look": 524264, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["极客", "终端安全"], "text": "对于Android Nougat（Android 7），应用程序并不会轻易信任客户端证书，除非应用程序指定要使用这个证书。那么在这篇文章中，我们将跟大家介绍一个新的Magisk模块。"}
{"title": "知乎招聘安全人才", "url": "https://www.freebuf.com/jobs/158463.html", "time": "2017-12-30", "level": "", "num_look": 447262, "num_comment": 8, "author": "何子小姐姐怎么这么爱吃火锅呢", "tags": ["安全招聘"], "text": "hezi@zhihu.com"}
{"title": "挖洞经验 | 可以被XSS利用的HTML标签和一些手段技巧", "url": "https://www.freebuf.com/articles/web/157589.html", "time": "2017-12-30", "level": "现金奖励", "num_look": 749211, "num_comment": 9, "author": "0d9y", "tags": ["WEB安全"], "text": "XSS让我们在渗透中有无限的可能，只要你发挥你的想象。  引用一位前辈总结的很贴切的一句话——“XSS使整个WEB体系变得具有灵性” 。"}
{"title": "腾讯蜜罐系统捕获高危IoT蠕虫Okiru", "url": "https://www.freebuf.com/articles/paper/158464.html", "time": "2017-12-30", "level": "", "num_look": 486513, "num_comment": 3, "author": "腾讯电脑管家", "tags": ["安全报告"], "text": "近日大量名为Okiru(satori)的IoT蠕虫活跃，使用华为路由器0day漏洞进行大规模传播，无需获得密码就能够控制受害设备，然后从感染设备上发起第二轮的网络攻击。"}
{"title": "年度盘点 | 2017企业安全技术热词有哪些？", "url": "https://www.freebuf.com/news/158595.html", "time": "2017-12-29", "level": "", "num_look": 302333, "num_comment": 302333, "author": "kylin1415", "tags": ["资讯"], "text": "元旦将至，2017年企业在构建安全体系时主要考虑哪些问题呢？FreeBuf 带你回顾企业安全应对指南中所调查的 2017 企业年度安全关键词！"}
{"title": "快讯 | Github上出现PS4 4.05固件的内核利用，越狱指日可待", "url": "https://www.freebuf.com/news/158565.html", "time": "2017-12-29", "level": "红色标题", "num_look": 357754, "num_comment": 6, "author": "Sphinx", "tags": ["资讯"], "text": "圣诞节已经过了，但圣诞老人没闲着，他为全体PlayStation用户带来了一份特殊的礼物。"}
{"title": "经验分享 | Burpsuite插件的使用", "url": "https://www.freebuf.com/sectool/158005.html", "time": "2017-12-29", "level": "", "num_look": 938923, "num_comment": 13, "author": "Shad0wpf_", "tags": ["工具"], "text": "Burpsuite可以使用三种语言编写的扩展插件，Java、Python和Ruby。除Java外，其它两种需要的扩展插件需要配置运行环境。"}
{"title": "安全大咖说 | 巨头思科成长最快的安全业务，4年收购金额超40亿 ：FIT2018独家专访", "url": "https://www.freebuf.com/fevents/157723.html", "time": "2017-12-29", "level": "红色标题", "num_look": 587134, "num_comment": 2, "author": "Elaine_z", "tags": ["企业安全", "活动"], "text": "我们如约见到了来自思科的两位人物——全球安全事业部的产品高级副总裁 Jeff Reed 与思科大中华区副总裁、安全业务总经理庄敬贤，并与他们进行了访谈。"}
{"title": "腾讯安全平台部诚聘高级安全人才", "url": "https://www.freebuf.com/jobs/158423.html", "time": "2017-12-29", "level": "", "num_look": 374002, "num_comment": 9, "author": "腾讯安全平台部", "tags": ["安全招聘"], "text": "腾讯安全平台部成立于2005年，发展至今，安全平台部对自身安全能力规划为业务安全、应用运维安全两大体系。"}
{"title": "Janus高危漏洞深度分析", "url": "https://www.freebuf.com/articles/paper/158133.html", "time": "2017-12-29", "level": "", "num_look": 442691, "num_comment": 8, "author": "AVLTeam", "tags": ["安全报告"], "text": "Android平台被爆出“核弹级”漏洞Janus（CVE-2017-13156），该漏洞允许攻击者任意修改Android应用中的代码，而不会影响其签名。 众所周知，Android具有签名机制。"}
{"title": "吐槽 | 为何Uber的漏洞奖励计划让我一分钱没赚到？", "url": "https://www.freebuf.com/articles/web/158392.html", "time": "2017-12-29", "level": "", "num_look": 343431, "num_comment": 9, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "近些年来，我一直在给企业客户进行渗透测试培训，因此我准备尝试看看能否找到Uber的漏洞。"}
{"title": "年度盘点 | 2017年最严重的七大数据泄露事件", "url": "https://www.freebuf.com/articles/database/158465.html", "time": "2017-12-29", "level": "红色标题", "num_look": 659904, "num_comment": 2, "author": "shidongqi", "tags": ["数据安全"], "text": "如果新闻中经常出现“泄漏”、“泄露数据”和“漏洞”这些词，那就不仅仅是你自己了。重大数据泄露的频率正在增加,根据个人信息失窃资源中心统计，预计2017泄露事件将超过1500起。"}
{"title": "AI安全初探：利用深度学习检测DNS隐蔽通道", "url": "https://www.freebuf.com/articles/network/158163.html", "time": "2017-12-29", "level": "现金奖励", "num_look": 1186313, "num_comment": 18, "author": "bonelee", "tags": ["网络安全"], "text": "DNS隐蔽通道能够实现诸如远程控制、文件传输等操作，也经常在僵尸网络和APT攻击中扮演着重要的角色。"}
{"title": "BUF 早餐铺 | 迟到的圣诞礼物：Github上出现PS4 4.05固件的内核利用，越狱指日可待；加密货币交易所EtherDelta遭到DNS攻击；Thunderbird修复五个漏洞，包含严重漏洞", "url": "https://www.freebuf.com/news/158574.html", "time": "2017-12-29", "level": "", "num_look": 231815, "num_comment": 231815, "author": "Sphinx", "tags": ["资讯"], "text": "Github上出现PS4 4.05固件的内核利用，越狱指日可待；加密货币交易所EtherDelta遭到DNS攻击；Thunderbird修复五个漏洞，包含严重漏洞。"}
{"title": "准备好纸和笔，人肉计算比特币：每天0.67哈希值", "url": "https://www.freebuf.com/geek/158091.html", "time": "2017-12-28", "level": "", "num_look": 673133, "num_comment": 13, "author": "Alpha_h4ck", "tags": ["极客"], "text": "在这篇文章中，我们一起来看一看用纸和笔来人肉“挖”比特币的难度到底有多大。"}
{"title": "五次Shift就能破解俄罗斯银行ATM？", "url": "https://www.freebuf.com/news/158442.html", "time": "2017-12-28", "level": "", "num_look": 294141, "num_comment": 11, "author": "Sphinx", "tags": ["资讯"], "text": "最近俄罗斯博客平台Habrahabr的一名用户就发现，运行Windows XP的Sberbank银行ATM存在漏洞，而进行攻击的步骤却非常简单。"}
{"title": "游族网络招聘高级信息安全工程师", "url": "https://www.freebuf.com/jobs/158407.html", "time": "2017-12-28", "level": "", "num_look": 364041, "num_comment": 12, "author": "youzu", "tags": ["安全招聘"], "text": "游族网络股份有限公司（SZ.002174），成立于2009年，是全球领先的互动娱乐供应商。"}
{"title": "重磅 | FreeBuf《2017企业安全威胁统一应对指南》完整版发布", "url": "https://www.freebuf.com/news/topnews/155412.html", "time": "2017-12-28", "level": "红色标题", "num_look": 1371593, "num_comment": 26, "author": "FreeBuf咨询", "tags": ["头条", "安全报告"], "text": "了解年度行业动态、把握安全威胁、应用安全应对流程，掌握这三个要素，是企业保障业务安全、赢得用户信任、维持未来稳定增长的关键。"}
{"title": "GoAhead Web Server远程代码执行漏洞分析（附PoC）", "url": "https://www.freebuf.com/vuls/158089.html", "time": "2017-12-28", "level": "", "num_look": 514593, "num_comment": 2, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文是关于GoAhead web server远程代码执行漏洞（CVE-2017-17562）的分析，该漏洞源于在初始化CGI脚本环境时使用了不受信的HTTP请求参数，会对所有启用了动态链接可执行文件（CGI脚本）的用户造成影响。"}
{"title": "再见理想 | 2012年到2017年冬，信息安全渐行渐远", "url": "https://www.freebuf.com/articles/network/158301.html", "time": "2017-12-28", "level": "金币+18", "num_look": 711126, "num_comment": 35, "author": "hyc66", "tags": ["网络安全", "观点"], "text": "2012年,我记得正是“乌云网”、发展的火热朝天的那年，也是漏洞满天飞的那年，大家以挖洞为乐趣，积分越高，越是自豪啊....不是挖“飞机”，就是挖“地下”的。"}
{"title": "闪付卡（QuickPass）隐私泄露原理", "url": "https://www.freebuf.com/articles/wireless/158045.html", "time": "2017-12-28", "level": "现金奖励", "num_look": 855253, "num_comment": 22, "author": "安全之光", "tags": ["数据安全", "无线安全"], "text": "目前基于EMV卡的非接触式支付的实现有三个：VISA的payWave，MasterCard的PayPass以及银联的闪付QuickPass。目前从外观来看，银联发行的卡面有芯片的IC卡均支持闪付，部分银行支持VISA的payWave。"}
{"title": "DedeCmsV5.7小说插件二次注入漏洞", "url": "https://www.freebuf.com/articles/web/158098.html", "time": "2017-12-28", "level": "现金奖励", "num_look": 383581, "num_comment": 20, "author": "山东安云", "tags": ["WEB安全"], "text": ""}
{"title": "BUF早餐铺 | 亚马逊、谷歌等智能音箱可能窃听用户；“123456”依然是2017年最不安全的弱密码；连按五次 shift 键就能入侵 ATM 机", "url": "https://www.freebuf.com/news/158419.html", "time": "2017-12-28", "level": "", "num_look": 276687, "num_comment": 3, "author": "AngelaY", "tags": ["资讯"], "text": "比特币价格波动导致其在黑市交易中的地位受到影响；尼亚加拉 ROTC 项目培训人员专注于网络战争和软件开发；全国人大常委会组成人员热议个人信息保护工作。"}
{"title": "【已结束】揭秘生物识别验证的 AI 攻防 | AI安全嘉年华·公开课", "url": "https://www.freebuf.com/fevents/157931.html", "time": "2017-12-27", "level": "红色标题", "num_look": 416950, "num_comment": 2, "author": "FB客服", "tags": ["活动"], "text": "12月27日（周三）晚20：00，AI公开课第五节，极棒实验室总监王海兵，带来主题为《揭秘生物识别验证的 AI 攻防》的分享。"}
{"title": "2018年安全从业者需要掌握的8种技能", "url": "https://www.freebuf.com/news/158429.html", "time": "2017-12-27", "level": "", "num_look": 278672, "num_comment": 1, "author": "shidongqi", "tags": ["资讯"], "text": "随着CIO等职位招聘需求逐渐增多，明年需要的关键IT安全技能包括云安全架构技能、客户服务技能。"}
{"title": "Captcha插件后门分析和修复", "url": "https://www.freebuf.com/articles/web/158041.html", "time": "2017-12-27", "level": "", "num_look": 316250, "num_comment": 3, "author": "LSA", "tags": ["WEB安全"], "text": "近日看到网上爆出wordpress官方插件captcha出现后门，大惊，本人当初千辛万苦找验证码插件，在十几个插件中选了这款，感觉还挺好用，竟然爆后门。"}
{"title": "WitAwards 2017「年度安全人物」得主诸葛建伟：给年轻人最好的土壤", "url": "https://www.freebuf.com/news/155992.html", "time": "2017-12-27", "level": "红色标题", "num_look": 266624, "num_comment": 3, "author": "FB客服", "tags": ["活动", "资讯"], "text": "通过长达三个月的信息征集、大众投票与专家评选，本届「年度安全人物」花落清华大学网络科学与网络空间研究院、网络与信息安全实验室副研究员诸葛建伟博士。"}
{"title": "我是如何利用CSRF Get DedeCms Shell的", "url": "https://www.freebuf.com/articles/web/157976.html", "time": "2017-12-27", "level": "红色标题", "num_look": 872721, "num_comment": 24, "author": "山东安云", "tags": ["WEB安全"], "text": "说实话，有一两个月没有审计大厂了，然后随便看到群里有人问dede最新有没有漏洞，就下了一套最新的dede，结果我一看还真发现了。"}
{"title": "从*.BAT到银行钓鱼页面", "url": "https://www.freebuf.com/articles/web/158079.html", "time": "2017-12-27", "level": "", "num_look": 270034, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "如果你以为使用BAT文件来进行攻击有点过时了，那我得请你想好再说了。在监控我们的安全邮件网关云服务时，我们发现了多个针对巴西用户的可疑的垃圾邮件。"}
{"title": "爱加密诚聘安全相关人才", "url": "https://www.freebuf.com/jobs/158218.html", "time": "2017-12-27", "level": "", "num_look": 190677, "num_comment": 5, "author": "guochao610", "tags": ["安全招聘"], "text": "爱加密是全球专业的移动信息安全服务提供商,专注于移动应用安全、大数据及物联网安全。"}
{"title": "macOS平台最新恶意软件HiddenLotus分析", "url": "https://www.freebuf.com/articles/terminal/158063.html", "time": "2017-12-27", "level": "", "num_look": 265518, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "就在前几天，为了对付这个名叫 OSX.HiddenLotus.A 的 macOS 端恶意软件，苹果公司悄悄地给 macOS 的 XProtect 反恶意软件系统增加了一个恶意软件签名。"}
{"title": "Cobalt Strike实战技巧持久性权限控制姿势", "url": "https://www.freebuf.com/sectool/157952.html", "time": "2017-12-27", "level": "现金奖励", "num_look": 647367, "num_comment": 13, "author": "FK_T", "tags": ["工具"], "text": "CS已经成为我们在做后渗透、权限维持以及内网渗透中,少不了的利器，FreeBuf已有前辈发过几篇很棒的文章，让我们从文章中收获不少的知识点,介绍就不再多说了。"}
{"title": "看不见的攻击面：查看SQLite数据库就中招？", "url": "https://www.freebuf.com/articles/web/157598.html", "time": "2017-12-27", "level": "现金奖励", "num_look": 337721, "num_comment": 7, "author": "c0debreak", "tags": ["WEB安全"], "text": "Navicat 客户端存在一个XSS，在查看表字段时，没有对内容进行处理，导致一个XSS问题。利用这个漏洞可以读取敏感文件，比如 /Users/XXXX/.bash_history 。"}
{"title": "Buf早餐铺 | Fancy bear APT组织更新后门Xagent;Lizard Squad和PoodleCorp黑客组织成员认罪;GlobeImposter 勒索软件攻击进行中", "url": "https://www.freebuf.com/news/158294.html", "time": "2017-12-27", "level": "", "num_look": 217831, "num_comment": 1, "author": "Elaine_z", "tags": ["资讯"], "text": "圣诞假期已过，还有什么新闻值得一看？"}
{"title": "腾讯都认错了，我们还在忍受哪些诱导推广行为？", "url": "https://www.freebuf.com/news/158372.html", "time": "2017-12-26", "level": "红色标题", "num_look": 631571, "num_comment": 29, "author": "shidongqi", "tags": ["资讯"], "text": "在昨天火绒安全发出关于腾讯QQ推广腾讯电脑管家和QQ浏览器的过程存在欺骗、诱导推广以及类似病毒行为之后，在今天腾讯电脑管家和QQ浏览器正式发出了致歉公告，承认了这些行为违规。"}
{"title": "折翼的雏鹰，来自尼日利亚黑客组织的金融诈骗攻击", "url": "https://www.freebuf.com/articles/paper/157711.html", "time": "2017-12-26", "level": "现金奖励", "num_look": 343131, "num_comment": 6, "author": "dongxun", "tags": ["安全报告"], "text": "通过分析缴获到的工具、截图和残余数据，2046Lab确定这是一起具有典型APT攻击特点的金融欺诈类威胁事件，潜在受害者涉及140多个国家的外贸公司数万人。"}
{"title": "挖洞经验 | 看我如何发现Google的第三方应用服务漏洞", "url": "https://www.freebuf.com/articles/web/158141.html", "time": "2017-12-26", "level": "", "num_look": 415385, "num_comment": 6, "author": "clouds", "tags": ["WEB安全"], "text": "今年三月我参与了谷歌软件工程师的面试，没想到完全出于意外，我却发现了谷歌（Google）某个应用服务的漏洞，其也成为了我的第一个赏金漏洞。一切请听我细细道来。"}
{"title": "Splashdata发布2017年度最不安全密码报告，看看你的密码安全吗？", "url": "https://www.freebuf.com/news/158081.html", "time": "2017-12-26", "level": "红色标题", "num_look": 303389, "num_comment": 5, "author": "ang010ela", "tags": ["资讯"], "text": "SplashData发布了2017年度最常用的密码TOP100，“123456”连续四年登顶。“starwars”上榜，暴露出不少星战粉。"}
{"title": "年度盘点 | 2017年我国DDoS攻击资源分析报告", "url": "https://www.freebuf.com/articles/paper/158270.html", "time": "2017-12-26", "level": "", "num_look": 409221, "num_comment": 8, "author": "CNCERT", "tags": ["安全报告"], "text": "近期，CNCERT深度分析了我国大陆地区发生的数千起DDoS（分布式拒绝服务）攻击事件。本报告围绕互联网环境威胁治理问题，对“DDoS攻击是从哪些网络资源上发起的”这个问题进行分析。"}
{"title": "SMB共享之SCF文件攻击解析", "url": "https://www.freebuf.com/articles/network/158066.html", "time": "2017-12-26", "level": "", "num_look": 499717, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "SMB是各类组织中广泛使用的一种文件共享协议，而且在很多内部渗透测试过程中，研究人员可以利用这种协议来发现共享文件中包含的敏感信息。"}
{"title": "蓝洞：《绝地求生》99%外挂都来自中…… 腾讯：好的我知道了", "url": "https://www.freebuf.com/news/158289.html", "time": "2017-12-26", "level": "红色标题", "num_look": 710213, "num_comment": 26, "author": "Akane", "tags": ["游戏安全", "资讯"], "text": "刚听到这个消息的时候，其实我是拒绝的。“老外喜欢甩锅”这个传统印象在我心里留下了深深的烙印，毕竟Brendan Greene也没有公布任何数据和统计方法不是？"}
{"title": "360代码安全实验室招聘漏洞挖掘安全研究员", "url": "https://www.freebuf.com/jobs/158207.html", "time": "2017-12-26", "level": "", "num_look": 266728, "num_comment": 7, "author": "奇安信代码卫士", "tags": ["安全招聘"], "text": "360代码安全实验室是360企业安全旗下专门从事源代码、二进制漏洞挖掘和分析的研究团队。"}
{"title": "DowginCw病毒家族解析", "url": "https://www.freebuf.com/articles/terminal/157956.html", "time": "2017-12-26", "level": "", "num_look": 254247, "num_comment": 2, "author": "阿里聚安全", "tags": ["终端安全"], "text": "钱盾反诈实验室通过钱盾恶意代码智能监测引擎感知并捕获一批恶意应用。由于该批病毒会联网加载“CWAPI”插件，故将其命名为“DowginCw”病毒家族。"}
{"title": "年度盘点 | 2017临近尾声，你的年度“安全关键词”是什么？", "url": "https://www.freebuf.com/special/158034.html", "time": "2017-12-26", "level": "红色标题", "num_look": 434154, "num_comment": 8, "author": "AngelaY", "tags": ["特别企划"], "text": "你的 2017 安全关键词是什么呢？"}
{"title": "TurnipBit智能无线遥控小车", "url": "https://www.freebuf.com/geek/157935.html", "time": "2017-12-26", "level": "现金奖励", "num_look": 331991, "num_comment": 15, "author": "_橙子 ゝ", "tags": ["极客"], "text": "2块TurnipBit开发板，1块模拟体感器，用于采集人体的动作变化，并将这些信息发送给接收器；另1块当做接收器，用来接收模拟设备的数据，同时控制小车执行相应的动作。"}
{"title": "GoAhead远程代码执行漏洞（CVE-2017-17562）分析及实战", "url": "https://www.freebuf.com/articles/web/157846.html", "time": "2017-12-26", "level": "", "num_look": 499123, "num_comment": 6, "author": "伏宸安全实验室", "tags": ["WEB安全"], "text": "GoAhead Web Server 广泛应用于嵌入式设备中，最近其出现了一个高危漏洞，在开启CGI的情况下，可以远程代码执行，据此本文简要分析了该漏洞详情，并在某款路由器上成功复现，反弹shell。"}
{"title": "BUF早餐铺 | 僵尸网络Mirai变种Satori : 利用0day控制华为路由器；3年来我国取消网站许可备案、关停违法网站1.3万多家；火绒：QQ产品捆绑推广，马化腾：团队违规，已要求整改道歉", "url": "https://www.freebuf.com/news/158182.html", "time": "2017-12-26", "level": "", "num_look": 350356, "num_comment": 3, "author": "Sphinx", "tags": ["资讯"], "text": "僵尸网络Mirai变种Satori : 利用0day控制华为路由器；斯诺登团队推应用，把你的手机变成迷你监控站；国内新闻也同样精彩哦！"}
{"title": "快讯 | 美国男子以网络攻击要挟公司雇佣他，悲剧获刑三年", "url": "https://www.freebuf.com/news/158167.html", "time": "2017-12-25", "level": "", "num_look": 224252, "num_comment": 7, "author": "shidongqi", "tags": ["资讯"], "text": "美国北卡罗来纳州法官判处一名华盛顿男子37个月监禁，罪名是以网络攻击威胁一家公司炒掉一名员工然后雇佣他来代替。"}
{"title": "挖掘利器Andro Tickler：安卓应用渗透测试和审核工具箱", "url": "https://www.freebuf.com/sectool/157558.html", "time": "2017-12-25", "level": "", "num_look": 522083, "num_comment": 8, "author": "学霸么么哒", "tags": ["工具"], "text": "AndroTickler一款Java工具，可以帮助你更快，更轻松，更高效地测试Android应用程序。"}
{"title": "Detection Lab简介与使用指南", "url": "https://www.freebuf.com/sectool/157288.html", "time": "2017-12-25", "level": "", "num_look": 363174, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Detection Lab其实是一套Packer和Vagrant脚本的集合，它可以帮助你迅速上线一个Windows活动目录，并给你提供一系列完整的终端安全以及日志工具。"}
{"title": "僵尸网络Mirai最新变种Satori : 利用0day“绑架”华为家用路由器HG532", "url": "https://www.freebuf.com/news/158116.html", "time": "2017-12-25", "level": "红色标题", "num_look": 333952, "num_comment": 3, "author": "Elaine_z", "tags": ["资讯"], "text": "研究人员认为名为 “Nexus Zeta” 的黑客发动了这次的 Mirai 变种 Satori攻击，攻击利用了华为路由器的 0day 漏洞 ——CVE-2017-17215。"}
{"title": "一个比较好玩的WebShell上传检测绕过案例", "url": "https://www.freebuf.com/articles/web/157557.html", "time": "2017-12-25", "level": "现金奖励", "num_look": 451123, "num_comment": 14, "author": "a.tm.k", "tags": ["WEB安全"], "text": "在一次普通的 WEB 测试过程，遇到了一个上传点，可以上传固定图片格式，但是任意名字+任意后缀名的文件。利用这一点可以绕过上传检测。"}
{"title": "Palo Alto防火墙远程代码执行漏洞分析", "url": "https://www.freebuf.com/vuls/157319.html", "time": "2017-12-25", "level": "", "num_look": 474520, "num_comment": 10, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "近期，Palo Alto Networks多个防火墙产品被曝存在未授权远程代码执行漏洞，该漏洞可通过Web管理端对防火墙实现root身份的未授权远程代码执行攻击。"}
{"title": "闷声发大财年度之星：2017挖矿木马的疯狂敛财暗流", "url": "https://www.freebuf.com/articles/paper/157537.html", "time": "2017-12-25", "level": "", "num_look": 513021, "num_comment": 6, "author": "360安全", "tags": ["安全报告"], "text": "如果说勒索病毒是暴露在大众视野中的“恶魔”，那么挖矿木马就是潜藏在阴暗之处的“寄生虫”。"}
{"title": "老板说安全很重要，但是没钱咋办？", "url": "https://www.freebuf.com/sectool/157699.html", "time": "2017-12-25", "level": "现金奖励", "num_look": 928914, "num_comment": 37, "author": "戒了", "tags": ["企业安全", "工具"], "text": "本文主要讲述，在一个资（bu）金（xiang）匮（hua）乏（qian）的甲方安全人员，为同病相怜的同学们提供几个免费的替代方案。"}
{"title": "BUF早餐铺 | 朝鲜否认操纵WannaCry事件：美国刻意制造妖魔论；立陶宛禁止卡巴斯基软件作为“潜在”威胁", "url": "https://www.freebuf.com/news/157999.html", "time": "2017-12-25", "level": "", "num_look": 204081, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "今天是12月25日圣诞节，准备好迎接圣诞老人了吗？"}
{"title": "ISF：一款基于Python的工控系统漏洞利用框架", "url": "https://www.freebuf.com/sectool/157443.html", "time": "2017-12-24", "level": "", "num_look": 476052, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍一款名叫ISF的工具，它是一款针对工业控制系统的漏洞利用框架。该工具基于开源项目routersploit，采用Python语言开发，它跟MetaSploit框架有些相似，希望大家能够喜欢。"}
{"title": "DIY简易Python脚本调用AWVS扫描", "url": "https://www.freebuf.com/news/157045.html", "time": "2017-12-24", "level": "金币+15", "num_look": 391016, "num_comment": 10, "author": "d447059172", "tags": ["工具", "资讯"], "text": "最近写了一个小系统，需要调用AWVS扫描工具的API接口实现扫描，在网上只搜到添加任务和生成报告的功能实现代码."}
{"title": "快速自检电脑是否被黑客入侵过（Linux版）", "url": "https://www.freebuf.com/articles/system/157597.html", "time": "2017-12-24", "level": "现金奖励", "num_look": 597633, "num_comment": 5, "author": "有价值炮灰", "tags": ["系统安全"], "text": "之前写了一篇[快速自检电脑是否被黑客入侵过(Windows版)][windows], 这次就来写写Linux版本的。"}
{"title": "聊一聊万恶的锁首", "url": "https://www.freebuf.com/articles/system/157200.html", "time": "2017-12-24", "level": "现金奖励", "num_look": 424523, "num_comment": 11, "author": "SmilingCat", "tags": ["系统安全"], "text": "当手持8倍镜的98K都不能在使用程序时干掉万恶的锁首时,内心是十万头羊驼奔跑的场景。那我们就来聊一聊市面上常见的锁首方式."}
{"title": "美国空军“Hack the Air Force 2.0”漏洞奖励项目启动序幕", "url": "https://www.freebuf.com/news/158070.html", "time": "2017-12-23", "level": "", "num_look": 347347, "num_comment": 1, "author": "willhuang", "tags": ["资讯"], "text": "近日，白帽黑客与美国军事网络专家联合组织了长达9小时的黑客马拉松Bug赏金活动——最新的空军黑客入侵计划H1-212。任由HackerOne负责支撑这一活动，并从参与者中挑选出来自全球的50强。"}
{"title": "隔离网络环境下的数据渗漏：Meterpreter DNS隧道技术", "url": "https://www.freebuf.com/articles/web/157279.html", "time": "2017-12-23", "level": "", "num_look": 546829, "num_comment": 3, "author": "clouds", "tags": ["WEB安全"], "text": "对于渗透测试人员来说，Meterpreter是常用的Metasploit环境远程代理，其中内置的多级攻击载荷（payload）非常方便灵活，对管理控制已拿下的远程沦陷机器极为实用。"}
{"title": "无线安全审计工具FruityWifi初体验", "url": "https://www.freebuf.com/articles/wireless/157559.html", "time": "2017-12-23", "level": "金币+15", "num_look": 836052, "num_comment": 4, "author": "scu-igroup", "tags": ["无线安全", "极客"], "text": ""}
{"title": "Invoke-PSImage：将PS脚本隐藏进PNG像素中并用一行指令去执行它", "url": "https://www.freebuf.com/sectool/157514.html", "time": "2017-12-23", "level": "金币+13", "num_look": 385138, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一个名叫Invoke-PSImage的Power Shell脚本，而这个脚本可以将目标PS脚本嵌入到一个PNG图片文件的像素点钟，并允许我们使用一行指令来执行该脚本。"}
{"title": "FireEye报告：揭露新型工控系统恶意软件TRITON", "url": "https://www.freebuf.com/news/157639.html", "time": "2017-12-23", "level": "", "num_look": 350701, "num_comment": 350701, "author": "clouds", "tags": ["资讯"], "text": "攻击者利用TRITON攻击框架能与施耐德电气公司的Triconex安全仪表系统控制器（SIS）形成通信交互，我们肯定该攻击事件的幕后黑手为国家支持型黑客。"}
{"title": "漏洞预警 | WebLogic XMLDecoder反序列化漏洞（CVE-2017-10271）", "url": "https://www.freebuf.com/news/158007.html", "time": "2017-12-22", "level": "红色标题", "num_look": 1004354, "num_comment": 4, "author": "Sphinx", "tags": ["资讯"], "text": "Oracle Fusion Middleware（Oracle融合中间件）是美国甲骨文（Oracle）公司的一套面向企业和云环境的业务创新平台。该平台提供了中间件、软件集合等功能。"}
{"title": "GoAhead被爆远程代码执行漏洞", "url": "https://www.freebuf.com/articles/web/157673.html", "time": "2017-12-22", "level": "", "num_look": 391371, "num_comment": 1, "author": "学霸么么哒", "tags": ["WEB安全"], "text": "Embedthis公司的Web服务器 GoAhead爆出远程代码执行漏洞，CVEID为CVE-2017-17562。当与 glibc 动态链接器结合使用时, 可以利用特殊参数名称 ，如 LD_PRELOAD，就可以实施远程代码执行。"}
{"title": "解析网络犯罪行为的成本", "url": "https://www.freebuf.com/news/157489.html", "time": "2017-12-22", "level": "", "num_look": 292617, "num_comment": 1, "author": "米雪儿", "tags": ["资讯"], "text": "虽然有时候看起来想要成功地实施一场网络犯罪，其行为者必须是全才才行，但实际上，几乎任何一次犯罪行为都需要其他成员提供各种工具和服务才能够顺利实现。"}
{"title": "朝鲜否认操纵WannaCry事件，称美国刻意制造妖魔论", "url": "https://www.freebuf.com/news/157594.html", "time": "2017-12-22", "level": "红色标题", "num_look": 835909, "num_comment": 18, "author": "Elaine_z", "tags": ["资讯"], "text": "2017年12月22日，朝鲜外交部针对WannaCry 事件作出回应：“美国这一举动属于严重的政治挑衅，目的是妖魔化朝鲜，从而促使国际社会对朝鲜进行对抗。”"}
{"title": "物联网设备是如何被破解的？分析一种篡改IoT固件内容的攻击方式", "url": "https://www.freebuf.com/articles/terminal/157503.html", "time": "2017-12-22", "level": "", "num_look": 465302, "num_comment": 4, "author": "顶象技术", "tags": ["极客", "终端安全"], "text": "随着智能硬件进入到人们的生活，人们的生活质量开始有逐步的提高，人们与智能硬件之间的联系更加紧密。同时，智能硬件的安全问题也必须引起高度重视，因为其直接影响到人身安全、社会安全和国家安全。"}
{"title": "Linux下恶意文件大规模共性分析探讨", "url": "https://www.freebuf.com/articles/system/157102.html", "time": "2017-12-22", "level": "现金奖励", "num_look": 519394, "num_comment": 41, "author": "yysecurity", "tags": ["系统安全"], "text": "本文利用情报数据+自动化分析结合手段，为安全人员贡献大范围linux恶意文件的通用的，相似的行为特征，了解背后黑产的模式，为净化网络环境贡献自己的一分力量。"}
{"title": "星巴克的WiFi竟然会利用用户的电脑来挖矿？免费网络中暗藏消费陷阱", "url": "https://www.freebuf.com/news/157797.html", "time": "2017-12-22", "level": "", "num_look": 408639, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "就在几天之前，星巴克意外地发现他们的其中一位店内客户竟陷入了网络攻击者的加密货币挖矿活动之中……"}
{"title": "苹果手游代充灰色产业深度揭秘", "url": "https://www.freebuf.com/articles/paper/157719.html", "time": "2017-12-22", "level": "金币+13", "num_look": 519318, "num_comment": 10, "author": "灰产哥哥哥哥", "tags": ["安全报告"], "text": "游戏厂商损失惨重，苹果一直也没彻底打击掉这些乱象。本文从目前最新的库存系统说起，深度揭秘整个产业链。"}
{"title": "BUF早餐铺 | Amazon S3 泄露1.23亿美国家庭详细信息；Windows 10 人脸识别可被照片骗过；大规模暴力破解攻击导致 WordPress 网站感染门罗币挖矿程序；手机信息被盗一年损失近千亿", "url": "https://www.freebuf.com/news/157948.html", "time": "2017-12-22", "level": "", "num_look": 516829, "num_comment": 5, "author": "AngelaY", "tags": ["资讯"], "text": "；Chrome 将从 2018 年 2 月 15 日开始屏蔽侵入性广告；罗马尼亚警方逮捕 5 名散播 CTB-Locker 和 Cerber 勒索软件的嫌犯； KRACK攻击出现在野实例"}
{"title": "CryKeX：Linux内存加密密钥提取工具", "url": "https://www.freebuf.com/sectool/157285.html", "time": "2017-12-21", "level": "", "num_look": 331978, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫CryKeX的工具，大家可以使用该工具从任何基于Unix操作系统的运行内存中提取出加密密钥。"}
{"title": "快讯 | 一张低分辨率照片即可破解win10面部识别", "url": "https://www.freebuf.com/news/157843.html", "time": "2017-12-21", "level": "红色标题", "num_look": 350093, "num_comment": 5, "author": "shidongqi", "tags": ["资讯"], "text": "本月早些时候，微软发布了系统更新来修复win10 Hello中面部识别功能的漏洞，利用该漏洞一张使用者打印的照片即可骗过面部识别。"}
{"title": "新型Android恶意软件可对手机造成物理损坏", "url": "https://www.freebuf.com/news/157746.html", "time": "2017-12-21", "level": "", "num_look": 241373, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "由于最近加密货币价格大幅上涨，无论是黑客还是网站管理员都在越来越多地使用基于JavaScript的挖矿脚本，通过利用访客PC的CPU能力来挖掘比特币或其他加密货币。"}
{"title": "CTF逆向题中的编程技巧", "url": "https://www.freebuf.com/articles/web/156483.html", "time": "2017-12-21", "level": "金币+13", "num_look": 398155, "num_comment": 2, "author": "野火研习社1", "tags": ["WEB安全"], "text": "最近一直在学习逆向相关的东西，发现了一道好玩的题目。题目难度不高，但用到了各种编程姿势。很秀！先看看题目到底是什么样的吧，这是一道2017年的bsidessf-ctf中的一道题目。"}
{"title": "合众人寿招聘信息安全工程师", "url": "https://www.freebuf.com/news/157631.html", "time": "2017-12-21", "level": "", "num_look": 245160, "num_comment": 8, "author": "securityUlic", "tags": ["资讯"], "text": "合众人寿保险股份有限公司是经中国保险监督管理委员会批准的一家综合性人寿保险公司。"}
{"title": "JCOP31/JCOP41 v2.3.1模拟M1门禁卡", "url": "https://www.freebuf.com/articles/wireless/157267.html", "time": "2017-12-21", "level": "", "num_look": 773412, "num_comment": 30, "author": "阿尔赛斯.米奈希尔", "tags": ["无线安全"], "text": "模拟m1卡：模拟M1卡其实就是利用cpu卡模拟m1卡的结构，即将cpu卡存储区域模拟成m1卡的扇区结构，但是本质还是m1卡卡。"}
{"title": "搭建Redis&Minerd安全应急演练环境", "url": "https://www.freebuf.com/sectool/156904.html", "time": "2017-12-21", "level": "现金奖励", "num_look": 389011, "num_comment": 1, "author": "yuegui_2004", "tags": ["工具"], "text": "近期公司需要进行一次安全运维应急演练，需要部署一套应急演练环境。想到几个月前公司的一台服务器的redis未认证授权漏洞导致被人放了挖矿程序，于是决定部署redis&minerd相结合的演练环境。"}
{"title": "看我是如何把SQLMap里的功能移植到我的程序的", "url": "https://www.freebuf.com/articles/web/157321.html", "time": "2017-12-21", "level": "现金奖励", "num_look": 687837, "num_comment": 27, "author": "0d9y", "tags": ["WEB安全"], "text": "有时候有些开源工具的入口太沉重，而我们只需要其中的一部分功能并且加到我们自己的程序，所以怎么样把她们进行提炼成我们想要的呢？"}
{"title": "BUF早餐铺 | 白宫谴责朝鲜发起WannaCry攻击；韩国比特币交易所Youbit关停；新Android恶意软件物理损坏手机；南方周末网站被恶意植入挖矿脚本", "url": "https://www.freebuf.com/news/157780.html", "time": "2017-12-21", "level": "", "num_look": 203017, "num_comment": 203017, "author": "AngelaY", "tags": ["资讯"], "text": "Lexmark 打印机出现漏洞，最早联网的打印机设备安全堪忧；趋势科技安全产品 Smart Protection Server 出现多个漏洞；360永久关闭水滴直播，最后起作用的可能是监管部门。"}
{"title": "2017 FIT中国首席信息安全官高峰论坛精华回顾", "url": "https://www.freebuf.com/news/157565.html", "time": "2017-12-20", "level": "", "num_look": 317747, "num_comment": 1, "author": "FB客服", "tags": ["活动", "资讯"], "text": "2017年12月13日（周三）下午，FIT中国首席信息安全官高峰论坛在上海成功举行，本次论坛以「网络·全智慧 安全·新变革」为主题，深入探讨2017-18企业信息安全技术与实践应用。"}
{"title": "快讯 | 知名激活工具KMSpico内含挖矿病毒", "url": "https://www.freebuf.com/news/157721.html", "time": "2017-12-20", "level": "红色标题", "num_look": 1057719, "num_comment": 18, "author": "shidongqi", "tags": ["资讯"], "text": "12月19日，火绒安全发出警报称，当下最热门的激活工具之一KMSpico带有挖矿病毒“Trojan/Miner”。并且该工具的下载网站在各大搜索引擎中排名都相当靠前，容易造成较普遍的影响。"}
{"title": "现代勒索软件发展简史", "url": "https://www.freebuf.com/articles/neopoints/157328.html", "time": "2017-12-20", "level": "", "num_look": 287779, "num_comment": 2, "author": "柚子", "tags": ["安全报告", "观点"], "text": "本文主要介绍的是目前全球范围内勒索软件犯罪团伙中的“领头羊”，并分析了他们之所以如此成功的原因。"}
{"title": "Firefox新特性：所有HTTP页面将被标记为不安全", "url": "https://www.freebuf.com/news/157612.html", "time": "2017-12-20", "level": "", "num_look": 329755, "num_comment": 3, "author": "shidongqi", "tags": ["WEB安全", "资讯"], "text": "目前，越来越多的网站运营者都采用了HTTPS，这样很快就会导致浏览器将HTTP网页默认标记为不安全。"}
{"title": "挖洞经验 | 我是如何挖掘热门“约P软件”漏洞的", "url": "https://www.freebuf.com/articles/web/157391.html", "time": "2017-12-20", "level": "红色标题", "num_look": 646956, "num_comment": 17, "author": "Alpha_h4ck", "tags": ["WEB安全", "终端安全"], "text": "本文所涉及到的应用程序来源于一家创业公司，而且这家公司的经营状况也非常好。我出于教育目的编写了这篇文章，希望能够为安全社区贡献自己的绵薄之力。"}
{"title": "北京中科网航招聘安全人才", "url": "https://www.freebuf.com/jobs/157294.html", "time": "2017-12-20", "level": "", "num_look": 252542, "num_comment": 1, "author": "lovemyself", "tags": ["安全招聘"], "text": "北京中科网航安全技术有限公司成立于2003年，是国家高新技术企业。公司自成立起一直致力于信息安全相关技术的研究开发。"}
{"title": "Meterpreter免杀及对抗分析", "url": "https://www.freebuf.com/sectool/157122.html", "time": "2017-12-20", "level": "现金奖励", "num_look": 665878, "num_comment": 17, "author": "Green_m", "tags": ["工具", "系统安全"], "text": "本文就常见的一些杀毒软件检测方法及meterpreter远控对抗杀毒软件的思路进行了一些介绍。"}
{"title": "安天移动安全发布“大脏牛”漏洞分析报告（CVE-2017-1000405）", "url": "https://www.freebuf.com/articles/paper/157357.html", "time": "2017-12-20", "level": "", "num_look": 289054, "num_comment": 1, "author": "AVLTeam", "tags": ["安全报告"], "text": "脏牛漏洞(CVE-2016–5195)是公开后影响范围最广和最深的漏洞之一，这十年来的每一个Linux版本，包括Android、桌面版和服务器版都受到其影响。"}
{"title": "思路分享 | 看我如何给微信下钩子", "url": "https://www.freebuf.com/articles/web/156944.html", "time": "2017-12-20", "level": "现金奖励", "num_look": 674134, "num_comment": 4, "author": "manwu91", "tags": ["WEB安全"], "text": "本文将通过一个完整的实例取得会话列表里的全部联系人讲解如何给微信下钩子。"}
{"title": "Buf早餐铺 | 黑了空军漏洞奖励计划 2.0已经启动；英国军方表示，俄罗斯可能会入侵水下通信电缆；vBulletin Forum出现2个0day漏洞", "url": "https://www.freebuf.com/news/157566.html", "time": "2017-12-20", "level": "", "num_look": 228892, "num_comment": 228892, "author": "Elaine_z", "tags": ["资讯"], "text": "冬天需要多补充谷物和新鲜安全资讯。"}
{"title": "CVE-2015-8651漏洞原理再度分析", "url": "https://www.freebuf.com/vuls/157195.html", "time": "2017-12-19", "level": "现金奖励", "num_look": 383963, "num_comment": 2, "author": "elli0tn0phacker", "tags": ["漏洞"], "text": "之前在Freebuf看到一篇安天追影发表的文章：《暗黑客栈CVE-2015-8651漏洞原理分析》,文中有对CVE-2015-8651漏洞原理的详细分析。"}
{"title": "互联网安全年度盛会FIT 2018完美谢幕，参展安全厂商巡礼", "url": "https://www.freebuf.com/fevents/157441.html", "time": "2017-12-19", "level": "", "num_look": 377015, "num_comment": 2, "author": "shidongqi", "tags": ["活动"], "text": "2017年12月14日，FreeBuf 互联网创新大会（FIT 2018）在上海隆重开幕，大会以“智能引力”为主题，吸引来自国内外的安全厂商和行业精英前来赴会。"}
{"title": "好看好玩的都在这儿，FIT 2018花絮合集（附议题PPT下载）", "url": "https://www.freebuf.com/fevents/157577.html", "time": "2017-12-19", "level": "红色标题", "num_look": 401679, "num_comment": 14, "author": "Akane", "tags": ["活动"], "text": "主会场精彩纷呈，然而很多台前幕后的小插曲也同样不容错过。下面就带各位看官从不同的视角一览FIT 2018的花絮合集，好看好玩好喝的，一个都不能少~"}
{"title": "2018年恶意软件预测报告：勒索软件依然坚挺并正在不断演变", "url": "https://www.freebuf.com/news/157460.html", "time": "2017-12-19", "level": "", "num_look": 242069, "num_comment": 2, "author": "米雪儿", "tags": ["资讯"], "text": "近日，Sophos在最新发布的《2018年恶意软件预测》报告中明确指出，勒索软件对于企业而言仍然是一个巨大的问题，且不会消失。"}
{"title": "美团点评招聘逆向工程师技术专家", "url": "https://www.freebuf.com/jobs/157118.html", "time": "2017-12-19", "level": "", "num_look": 274468, "num_comment": 7, "author": "ilmloy", "tags": ["安全招聘"], "text": "美团点评是最大的本地服务电子商务平台，每年还保持高速增长！欢迎逆向方向的同学加入！"}
{"title": "美国电信运营商AT&T的 DirectTV WVB设备被爆出0day远程Root漏洞", "url": "https://www.freebuf.com/news/157184.html", "time": "2017-12-19", "level": "", "num_look": 261622, "num_comment": 261622, "author": "JingleCats", "tags": ["漏洞", "资讯"], "text": "AT&T DirecTV WVB设备组件中存在易于利用的 0day漏洞，黑客利用该漏洞可以获取root权限，从而完全控制该设备，数百万注册 DirecTV服务的用户将面临风险。"}
{"title": "逆向新手踩坑指南之爬爬山能锻炼身体", "url": "https://www.freebuf.com/articles/web/157276.html", "time": "2017-12-19", "level": "", "num_look": 397592, "num_comment": 3, "author": "antiuto", "tags": ["WEB安全"], "text": "七天过去了，做逆向真是打发时间的好帮手～"}
{"title": "利用分析利器Angr帮助更好的Exploit", "url": "https://www.freebuf.com/sectool/157108.html", "time": "2017-12-19", "level": "现金奖励", "num_look": 323257, "num_comment": 323257, "author": "bin2415", "tags": ["工具"], "text": "angr主要是一款进行动态符号执行的工具，利用它能够帮助我们更好的分析程序。最近发现了一个利用angr帮助进行exploit的例子。"}
{"title": "OWASP Hakcing Lab在线漏洞环境", "url": "https://www.freebuf.com/sectool/157072.html", "time": "2017-12-19", "level": "金币+10", "num_look": 552362, "num_comment": 16, "author": "Rogerd", "tags": ["工具"], "text": "OWASP hakcing-lab 是一个提供免费的远程安全（Web）挑战和 OWASP TOP 10，OWASP WebGoat，OWASP Hackademics ，和其他易受攻击的应用程序的网站。"}
{"title": "OPNsense防火墙搭建实验环境，MSF与SSH进行流量转发", "url": "https://www.freebuf.com/articles/network/157089.html", "time": "2017-12-19", "level": "现金奖励", "num_look": 569117, "num_comment": 6, "author": "molibird", "tags": ["网络安全"], "text": "介绍OPNsense防火墙的安装配置并搭建实验环境，利用msf的模块及ssh进行流量转发（LAN向DMZ方向），为内网渗透做好准备。"}
{"title": "BUF 早餐铺 | Windows 10 系统预装密码管理器，可能被利用获取用户密码；1900万加州选民数据被攻击者勒索；俄罗斯管道巨头Transneft感染门罗挖矿程序；Avast 开源其反编译器RetDec", "url": "https://www.freebuf.com/news/157458.html", "time": "2017-12-19", "level": "", "num_look": 252224, "num_comment": 252224, "author": "Sphinx", "tags": ["资讯"], "text": "Windows 10 系统预装密码管理器，可能被黑客利用获取用户密码；1900万加州选民数据被攻击者勒索；Avast 开源其反编译器RetDec；中国人工智能可在数秒内识别20亿人。"}
{"title": "2017年Mcafee中国地区网络犯罪调查报告", "url": "https://www.freebuf.com/articles/paper/157310.html", "time": "2017-12-18", "level": "", "num_look": 527895, "num_comment": 13, "author": "Alpha_h4ck", "tags": ["安全报告"], "text": "中国地下网络犯罪活动利润现已超过151亿美元（约合人民币1004亿元），并造成了超过138亿美元（约合人民币917亿元）的经济损失，其中涉及到数据泄露等网络犯罪。"}
{"title": "挖洞经验 | Facebook的手机扫码登录漏洞", "url": "https://www.freebuf.com/articles/terminal/157057.html", "time": "2017-12-18", "level": "", "num_look": 367466, "num_comment": 5, "author": "clouds", "tags": ["终端安全"], "text": "Facebook最近推出了忘记密码的手机登录功能，我发现该功能中的二维码扫描存在漏洞，可以利用其进行CSRF攻击，劫持其它Facebook账户。"}
{"title": "快讯 | Windows 10 系统预装密码管理器，可能被黑客利用获取用户密码", "url": "https://www.freebuf.com/news/157388.html", "time": "2017-12-18", "level": "", "num_look": 267471, "num_comment": 3, "author": "AngelaY", "tags": ["资讯"], "text": "日前，Google 白帽黑客 Tavis Ormandy 表示，某些 Windows 10 系统中预装了第三方密码管理器应用程序，可能被黑客利用，远程窃取用户凭据。"}
{"title": "火币集团招聘安全人才", "url": "https://www.freebuf.com/jobs/156752.html", "time": "2017-12-18", "level": "", "num_look": 328758, "num_comment": 20, "author": "dahuobi", "tags": ["安全招聘"], "text": "火币集团是具有全球竞争力与影响力的数字资产综合服务商，为超过130个国家百万级用户提供优质服务。"}
{"title": "话题讨论 | “传说中”的甲方安全", "url": "https://www.freebuf.com/articles/neopoints/156914.html", "time": "2017-12-18", "level": "现金奖励", "num_look": 1235642, "num_comment": 48, "author": "FallenAngels", "tags": ["企业安全", "观点"], "text": "之前有人跟我说甲方的安全技术人员不如乙方。但是事实上我了解的却是多数“技术高超” 的乙方人员无法胜任甲方的工作，先别急着反驳 ,我们先来看看技术人员对比。"}
{"title": "渗透网络投票系统解析投票骗局", "url": "https://www.freebuf.com/articles/web/156934.html", "time": "2017-12-18", "level": "金币+10", "num_look": 617614, "num_comment": 19, "author": "野狗", "tags": ["WEB安全"], "text": "晚上女朋友在研究投票，看了一眼感觉十有八九是骗局。自从上次研究投票后身边一大堆找刷票的，也尝试了几种系统，感觉大部分都有漏洞或是bug。"}
{"title": "新手福利 | Burpsuite你可能不知道的技巧", "url": "https://www.freebuf.com/news/156928.html", "time": "2017-12-18", "level": "金币+10", "num_look": 633558, "num_comment": 23, "author": "shadow4u", "tags": [], "text": "Burpsuite作为Web安全者必不可少的一件神器，其实有很多实用的技巧，本篇文章的目的是抛砖引玉，通过分享一些渣渣技巧，可能会帮助解决一些egg hurt的问题。"}
{"title": "BUF早餐铺 |Facebook 发布新的证书透明度工具；微软关闭 word 中的 DDE 功能；三名黑客承认参与制作传播 Mirai 僵尸网络；", "url": "https://www.freebuf.com/news/157345.html", "time": "2017-12-18", "level": "", "num_look": 188302, "num_comment": 188302, "author": "AngelaY", "tags": ["资讯"], "text": "新ATM 恶意软件 PRILEX 针对巴西展开攻击； Windows 10 系统预装的密码管理器不安全；工控系统恶意软件 Trition 可能危及人身安全；\"Zealot\" 攻击利用 NSA exploit 挖矿"}
{"title": "被微软忽略的Office DDE漏洞已经开始遭到利用（含POC）", "url": "https://www.freebuf.com/vuls/157264.html", "time": "2017-12-17", "level": "现金奖励", "num_look": 574181, "num_comment": 12, "author": "学霸么么哒", "tags": ["漏洞", "系统安全"], "text": "目前已经有众多黑客组织开始利用该问题向目标设备进行鱼叉式攻击。"}
{"title": "对利用CVE-2017-0199漏洞的病毒变种的监测与分析", "url": "https://www.freebuf.com/vuls/154468.html", "time": "2017-12-17", "level": "", "num_look": 324917, "num_comment": 6, "author": "antiylab", "tags": ["漏洞"], "text": "CVE-2017-0199漏洞是一个Office远程执行代码漏洞，该漏洞利用Office OLE对象链接技术，将伪装的恶意链接对象嵌在文档中，由Office调用URL Moniker（COM对象）将恶意链接指向的HTA文件下载到本地，通过识别响应头中c…"}
{"title": "攻击者可操作射频信号从工业网络中窃取数据", "url": "https://www.freebuf.com/articles/ics-articles/156733.html", "time": "2017-12-17", "level": "", "num_look": 486796, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工控安全"], "text": "近期，研究人员发现了一种新型的攻击方法，即攻击者可以通过控制可编程逻辑控制器（PLC）发射出的射频信号来从空气间隙工业网络（Air-Gapped IndustrialNetwork）中窃取数据。"}
{"title": "地下暗流系列 |“免费雇佣”数十万用户，TigerEyeing病毒云控推广上千应用", "url": "https://www.freebuf.com/articles/terminal/156877.html", "time": "2017-12-17", "level": "", "num_look": 362155, "num_comment": 19, "author": "腾讯手机管家", "tags": ["终端安全"], "text": "据腾讯反诈骗实验室和移动安全实验室安全专家分析发现，TigerEyeing病毒通过开源插件框架DroidPlugin来实现恶意插件动态下发，通过云端配置恶意插件列表来实现应用恶意推广、流氓广告等行为。"}
{"title": "新手上路 | 德国电信网站从LFI到命令执行漏洞", "url": "https://www.freebuf.com/articles/web/156950.html", "time": "2017-12-17", "level": "", "num_look": 420379, "num_comment": 4, "author": "clouds", "tags": ["WEB安全"], "text": ""}
{"title": "Vaultek蓝牙型枪支保险箱漏洞分析", "url": "https://www.freebuf.com/articles/wireless/156899.html", "time": "2017-12-16", "level": "", "num_look": 465885, "num_comment": 465885, "author": "clouds", "tags": ["无线安全"], "text": "本文中，我们将详细介绍针对著名枪支箱柜厂商Vaultek旗下手枪保险箱VT20i的三个漏洞利用。"}
{"title": "渗透测试平台Vulnreport介绍与使用", "url": "https://www.freebuf.com/sectool/156731.html", "time": "2017-12-16", "level": "红色标题", "num_look": 521787, "num_comment": 8, "author": "Alpha_h4ck", "tags": ["工具"], "text": "在这篇文章中，我们将跟大家讨论一些关于渗透测试方面的内容，并给大家介绍一款名叫Vulnreport的新型开源工具，而这款工具将能够让任何场景下的渗透测试任务变得更加简单。"}
{"title": "通付盾发布2017移动互联网勒索病毒研究报告：深度还原威胁场景", "url": "https://www.freebuf.com/articles/paper/156892.html", "time": "2017-12-16", "level": "", "num_look": 380172, "num_comment": 3, "author": "通付盾", "tags": ["安全报告"], "text": "对于类似勒索病毒这样级别的威胁攻击，移动应用安全管理不仅包括舆情监察和公开的威胁情报，还需要能够做到对威胁攻击场景的还原的移动互联网威胁信息管理平台。"}
{"title": "不慎泄露Dynamics 365 TLS证书及私钥，微软花了110天才修复这个漏洞", "url": "https://www.freebuf.com/news/156951.html", "time": "2017-12-16", "level": "", "num_look": 241848, "num_comment": 241848, "author": "shidongqi", "tags": ["资讯"], "text": "一旦出现漏洞，微软都会及时修复以免被不法分子利用造成更大的损失。而在今年8月中旬，一名软件工程师Gliwka提交的一个严重漏洞，微软过了近110天后才完成修复。"}
{"title": "智能引力引爆安全未来，借势创新探索全新篇章——FreeBuf 2018互联网安全创新大会(FIT 2018)次日纪实", "url": "https://www.freebuf.com/news/157232.html", "time": "2017-12-15", "level": "红色标题", "num_look": 402020, "num_comment": 6, "author": "AngelaY", "tags": ["活动", "资讯"], "text": "FIT 2018 大会围绕安全领域与人工智能的结合，探讨了多个方面的应用与发展，带给大家很多思考和启发。希望安全行业能借助智能引力的浪潮，不断创新，探索安全发展的新篇章。"}
{"title": "年度盛誉揭晓 | WitAwards 2017互联网安全年度评选结果公布", "url": "https://www.freebuf.com/fevents/157212.html", "time": "2017-12-15", "level": "红色标题", "num_look": 1009734, "num_comment": 1, "author": "FB客服", "tags": ["活动"], "text": "在2017年，国内互联网安全领域涌现出了大量精英团队和顶级技术专家，新老白帽激情碰撞迸发出耀眼的火花，极大的推动了国内安全产业的发展，也让WitAwards 2017互联网安全年度奖项的角逐变得空前激烈。"}
{"title": "如何检测删除你惠普笔记本中的键盘记录器？", "url": "https://www.freebuf.com/articles/system/156987.html", "time": "2017-12-15", "level": "", "num_look": 435926, "num_comment": 1, "author": "Sphinx", "tags": ["系统安全"], "text": "BleepingComputer提供了指导，帮助大家检测自己的笔记本有没有中招。"}
{"title": "“太极挂机”软件圈钱骗局：披着网赚外衣的“三合一”挖矿木马", "url": "https://www.freebuf.com/articles/system/156691.html", "time": "2017-12-15", "level": "", "num_look": 455028, "num_comment": 3, "author": "360安全", "tags": ["系统安全"], "text": "近期，网上兴起一种“太极挂机”软件，声称只需下载运行该软件无需任何操作就能轻松挂机赚钱。360安全中心经分析发现，所谓的挂机网赚只是木马病毒的幌子。"}
{"title": "微软发布12月安全更新，修复34项安全问题", "url": "https://www.freebuf.com/vuls/157052.html", "time": "2017-12-15", "level": "", "num_look": 298290, "num_comment": 1, "author": "Elaine_z", "tags": ["漏洞"], "text": "微软2017年12月发布的补丁星期二更新解决了30多个安全漏洞，其中包括19个影响Internet Explorer和Edge网页浏览器的严重漏洞。"}
{"title": "【明年见】FIT 2018 互联网安全创新大会图文+视频直播", "url": "https://www.freebuf.com/news/156654.html", "time": "2017-12-15", "level": "红色标题", "num_look": 762735, "num_comment": 85, "author": "AngelaY", "tags": ["活动", "资讯"], "text": "12 月 14 日到 12 月 15 日，FreeBuf 互联网安全创新大会（FIT 2018）将在上海世博园·加空间举行。FreeBuf 将为你带来现场图文直播和报道！"}
{"title": "全球金融科技安全监管那些事儿", "url": "https://www.freebuf.com/articles/neopoints/156649.html", "time": "2017-12-15", "level": "金币+8", "num_look": 296415, "num_comment": 296415, "author": "summer0917", "tags": ["观点"], "text": "金融科技（FinTech）一词最早起源于美国，通常被定义为金融和科技的融合，通过将科技应用到金融领域，通过技术工具的变革推动金融体系的创新。"}
{"title": "独家探寻阿里安全潘多拉实验室，完美越狱苹果iOS11.2.1", "url": "https://www.freebuf.com/articles/terminal/157174.html", "time": "2017-12-15", "level": "", "num_look": 429702, "num_comment": 6, "author": "阿里聚安全", "tags": ["终端安全"], "text": "小编第一时间深度探访阿里安全潘多拉实验室，采访了此次攻破苹果iOS11.2.1的重要成员之一龙磊，他本人就已向苹果报告了7个安全漏洞，并获得厂商的认可和致谢。"}
{"title": "资料分享 | XSS防御速查表", "url": "https://www.freebuf.com/articles/web/156622.html", "time": "2017-12-15", "level": "金币+8", "num_look": 572823, "num_comment": 5, "author": "walletong", "tags": ["WEB安全"], "text": "本文提供了一种通过使用输出转义/编码来防止XSS攻击的简单有效模型。尽管有着庞大数量的XSS攻击向量，依照下面这些简单的规则可以完全防止这种攻击。"}
{"title": "Windows Payload免杀方法实验", "url": "https://www.freebuf.com/articles/system/156710.html", "time": "2017-12-15", "level": "金币+8", "num_look": 460028, "num_comment": 7, "author": "马克不温", "tags": ["系统安全"], "text": "最近的在学习内网渗透过程中，遇到的一个问题就是如何静静的在目标机器执行Payload。网上姿势很多，最先想到的是PowerSploit，后来看到余弦的猥琐流打法影响深刻，于是动手实践，有些能被360监测到。"}
{"title": "BUF早餐铺 | FIT 2018互联网安全创新大会精彩继续", "url": "https://www.freebuf.com/news/157022.html", "time": "2017-12-15", "level": "红色标题", "num_look": 256293, "num_comment": 256293, "author": "AngelaY", "tags": ["活动", "资讯"], "text": "各位  Buffer 早上好，今天是 2017 年 12 月 15 日星期五，天气小雨，气温 7-9 度。天气湿冷，建议带好雨具及秋裤，我们接着看大会！昨天的精彩花絮也在这里哦~"}
{"title": "阿里安全潘多拉实验室完美越狱iOS 11.2", "url": "https://www.freebuf.com/news/157100.html", "time": "2017-12-15", "level": "", "num_look": 269185, "num_comment": 9, "author": "阿里聚安全", "tags": ["资讯"], "text": "为了适配iPhoneX和iPad Pro，苹果对iOS进行了一次有史以来最大跨度的升级。苹果官方对iOS 11的评价是“为iPhone带来巨大进步，让iPad实现里程碑式飞跃。”"}
{"title": "探索安全的终极之道：FreeBuf 2018互联网安全创新大会（FIT）首日精彩速递", "url": "https://www.freebuf.com/news/157129.html", "time": "2017-12-15", "level": "红色标题", "num_look": 309577, "num_comment": 5, "author": "Sphinx", "tags": ["资讯"], "text": "趁着人工智能的浪潮，让AI的磁场改变安全行业的未来，探索安全的新方向。"}
{"title": "对CVE-2017-11882漏洞利用样本的检测与防御", "url": "https://www.freebuf.com/vuls/156693.html", "time": "2017-12-14", "level": "", "num_look": 352310, "num_comment": 2, "author": "antiylab", "tags": ["漏洞"], "text": "近期，安天检测到多起利用CVE-2017-11882漏洞进行定向攻击的事件。该漏洞原理简单，利用稳定，并且可以做到无交互，无感知，可用于鱼叉式钓鱼攻击和水坑攻击中。"}
{"title": "慎点！来自反编译器的危险", "url": "https://www.freebuf.com/articles/others-articles/156625.html", "time": "2017-12-14", "level": "", "num_look": 419814, "num_comment": 7, "author": "生如夏花", "tags": ["其他", "极客"], "text": "只需要在编译过后的机器代码中使用反编译器的功能就可以把机器代码尝试恢复到近似于软件以前的源代码级别。"}
{"title": "经验分享 | Burpsuite中宏的使用", "url": "https://www.freebuf.com/articles/web/156735.html", "time": "2017-12-14", "level": "现金奖励", "num_look": 614152, "num_comment": 22, "author": "Shad0wpf_", "tags": ["WEB安全"], "text": "Brupsuite的宏（Macros），是一个预先定义好的HTTP请求序列，这个序列中可以包含一个或多个HTTP请求。在Burpsuite的会话管理规则（Session Handling Rules）中使用宏，可以完成多种任务。"}
{"title": "隐私泄露、恶意软件泛滥，揭开7.24亿手机网民背后移动应用风险现状", "url": "https://www.freebuf.com/articles/paper/156533.html", "time": "2017-12-14", "level": "", "num_look": 286572, "num_comment": 1, "author": "通付盾", "tags": ["安全报告"], "text": "移动网民的占比持续增加，移动化生活逐步渗透至人民的衣食住行等各领域，因此移动网民对移动应用的安全性和安全强度越来越高，将加速移动应用安全市场的发展。"}
{"title": "暗网出现史上最大数据库： 14亿份明文凭证暴露，个人与企业都可能遭殃", "url": "https://www.freebuf.com/news/156986.html", "time": "2017-12-14", "level": "", "num_look": 618425, "num_comment": 17, "author": "AngelaY", "tags": ["资讯"], "text": "日前，暗网监控公司 4iQ 发现暗网中出现了 高达 41 GB 的数据文件，其中包含 14 亿份以明文形式存储的账号邮箱和密码等登录凭证，这是迄今为止“在暗网中发现的最大数据库”。"}
{"title": "编码在网络安全中的应用和原理", "url": "https://www.freebuf.com/articles/network/156455.html", "time": "2017-12-14", "level": "现金奖励", "num_look": 548235, "num_comment": 7, "author": "0d9y", "tags": ["网络安全"], "text": "现在的网站架构复杂，大多都有多个应用互相配合，不同应用之间往往需要数据交互，应用之间的编码不统一，编码自身的特性等都很有可能会被利用来绕过或配合一些策略，造成一些重大的漏洞。"}
{"title": "FIT 2018大会直播通道将在明天早上8:00正式开启", "url": "https://www.freebuf.com/news/157071.html", "time": "2017-12-13", "level": "红色标题", "num_look": 229319, "num_comment": 229319, "author": "Elaine_z", "tags": ["资讯"], "text": "诸位读者，请大家务必确认大会地址：「上海世博 加空间」正式开场的时间： 12.14 （8:00-9：00 签到入场）-12.15"}
{"title": "对Gaza网络犯罪组织2018年新动向的分析", "url": "https://www.freebuf.com/articles/network/156740.html", "time": "2017-12-13", "level": "", "num_look": 521370, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "Gaza是一个以政治利益为主要目的的阿拉伯网络犯罪集团，该组织出现于2012年，其攻击目标主要集中在中东和北非地区。"}
{"title": "“别再盯着我们看了”引发智能摄像头是非之争：保护安全还是侵犯隐私？", "url": "https://www.freebuf.com/news/157059.html", "time": "2017-12-13", "level": "金币+14", "num_look": 374628, "num_comment": 10, "author": "AdlerI", "tags": ["观点", "资讯"], "text": "智能摄像头：不看你，你被欺负了没有证据；看你，我就变成了侵犯隐私的工具。我只是工具我也很绝望啊。都是你们人类的错。"}
{"title": "快讯 | Google Project Zero的白帽子发现利用内核内存崩溃漏洞可以实现苹果越狱", "url": "https://www.freebuf.com/news/157040.html", "time": "2017-12-13", "level": "红色标题", "num_look": 262827, "num_comment": 3, "author": "Sphinx", "tags": ["资讯"], "text": "Google Project Zero的研究员Ian Beer公开披露了一个漏洞，该漏洞几乎可以在所有运行iOS 11.1.2或更早版本的64位苹果设备上运行，可用于越狱iOS。"}
{"title": "基于神经网络的恶意软件检测分析", "url": "https://www.freebuf.com/articles/network/156739.html", "time": "2017-12-13", "level": "", "num_look": 543004, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "一次恶意软件感染事件将有可能给我们带来数百万美金的经济损失，而当前的反病毒产品以及恶意软件检测工具一般使用的是基于签名的检测技术，这种方法需要手动设置一系列规则来识别已知的不同类型的恶意软件。"}
{"title": "深信服急招病毒分析、逆向、攻防人才", "url": "https://www.freebuf.com/jobs/156584.html", "time": "2017-12-13", "level": "", "num_look": 304601, "num_comment": 18, "author": "suifeng-刘军", "tags": ["安全招聘"], "text": "“中国卓越雇主”深信服科技成立于2000年，是中国最大的新网络产品供应商，致力于提供基于创新网络的产品及解决方案，深信服业务涵盖两大领域：网络安全、虚拟化&云计算。"}
{"title": "Gartner报告：2018年全球安全支出将达到960亿美元", "url": "https://www.freebuf.com/news/156859.html", "time": "2017-12-13", "level": "", "num_look": 340441, "num_comment": 2, "author": "AngelaY", "tags": ["安全报告", "资讯"], "text": "Gartner 近期预测， 2018 年全球安全支出将达到 960 亿美元，将比 2017 年的 890 亿美元增长 8％。安全测试、IT 外包以及安全信息与事件管理（SIEM）将成为增长最快的部分。"}
{"title": "话题讨论 | 关于网页植入挖矿代码的探讨", "url": "https://www.freebuf.com/articles/web/156376.html", "time": "2017-12-13", "level": "金币+14", "num_look": 558160, "num_comment": 11, "author": "fiysky", "tags": ["WEB安全"], "text": "最近上网浏览网页的时候发现电脑CPU有升高，但是也在 70%以下，以为是后台运行一些更新程序什么的，结果没想到抓包一看是挖矿脚本！"}
{"title": "即便关闭GPS，手机应用依然能够跟踪用户", "url": "https://www.freebuf.com/news/156633.html", "time": "2017-12-13", "level": "", "num_look": 328326, "num_comment": 3, "author": "shidongqi", "tags": ["终端安全", "资讯"], "text": "近期，普林斯顿大学的研究员开发了一种新的概念型APP，该应用可以在不访问GPS权限的情况下记录用户行踪，即便用户已经确定关闭了手机GPS功能。"}
{"title": "通过DNS进行主机安全防护的一些分享", "url": "https://www.freebuf.com/articles/network/156084.html", "time": "2017-12-13", "level": "现金奖励", "num_look": 616345, "num_comment": 4, "author": "linken", "tags": ["网络安全"], "text": "牵扯到DNS的攻击五花八门，如劫持、恶意利用等，服务器和PC上DNS请求的种类和频率还是有区别的。"}
{"title": "Buf早餐铺 | MoneyTaker对美国、英国、俄罗斯金融和法律公司成功实施20多起金融欺诈攻击；BrickerBot恶意软件作者称自己即将退休，自2016年来已经冻结1000万IoT设备", "url": "https://www.freebuf.com/news/156953.html", "time": "2017-12-13", "level": "", "num_look": 167016, "num_comment": 167016, "author": "Elaine_z", "tags": ["资讯"], "text": "寒冷的冬季，90后都在喝桂圆红枣姜茶，安全圈的大家也要注意保暖养生噢！"}
{"title": "快讯 | 新加坡政府首开漏洞奖励计划，邀“白帽子”渗透军方网络系统", "url": "https://www.freebuf.com/news/156997.html", "time": "2017-12-12", "level": "", "num_look": 321473, "num_comment": 5, "author": "Akane", "tags": ["漏洞", "资讯"], "text": "12月12日消息，新加坡政府明年初将首次邀请来自全球约300名“白帽子”渗透国防部的电脑网络系统，以测试系统是否有漏洞。"}
{"title": "Hunting系统：简述如何通过智能分析异常来检测网络入侵行为", "url": "https://www.freebuf.com/news/156746.html", "time": "2017-12-12", "level": "", "num_look": 236728, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "当组织内发生数据泄露事件时，泄漏检测系统（BDS）能够给我们提供足够有效的提醒，但如果敏感等级设置的非常低的话，我们还需要考虑风险报告的假阳性问题。"}
{"title": "新型浏览器挖矿技术可在浏览器窗口关闭的情况下持续挖矿", "url": "https://www.freebuf.com/articles/web/156486.html", "time": "2017-12-12", "level": "红色标题", "num_look": 525333, "num_comment": 9, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "越来越多的攻击者开始使用臭名昭著的Coinhive服务来实施攻击了。与此同时，越来越多的服务器和 服务插件开始受到了挖矿型恶意软件的感染。"}
{"title": "云图信安（成都）科技有限公司招聘安卓安全工程师", "url": "https://www.freebuf.com/jobs/156033.html", "time": "2017-12-12", "level": "", "num_look": 271295, "num_comment": 14, "author": "云图信安人事", "tags": ["安全招聘"], "text": "云图信安（成都）科技有限公司是一家以互联网平台运营、WEB应用开发、软件开发、大数据分析、移动互联网通讯技术、云计算、营销推广、技术培训等技术为核心的 科技公司。"}
{"title": "独家分析：安卓“Janus”漏洞的产生原理及利用过程", "url": "https://www.freebuf.com/articles/terminal/156862.html", "time": "2017-12-12", "level": "红色标题", "num_look": 490194, "num_comment": 4, "author": "顶象技术", "tags": ["终端安全"], "text": "Google在12月发布的安卓系统安全公告中披露了一个名为“Janus”安卓漏洞（漏洞编号：CVE-2017-13156）。该漏洞可以让攻击者绕过安卓系统的signature scheme V1签名机制，进而直接对App进行篡改。"}
{"title": "Black Hat Europe 2017：安全专家发现5款最流行编程语言中的漏洞", "url": "https://www.freebuf.com/news/156761.html", "time": "2017-12-12", "level": "", "num_look": 421890, "num_comment": 5, "author": "Elaine_z", "tags": ["工具", "漏洞"], "text": "没有不漏的锅，如果底层的编程语言如果出现问题，顶层的应用程序还能幸免于难吗？"}
{"title": "认证云安全专家（CCSP）考试攻略", "url": "https://www.freebuf.com/articles/others-articles/156324.html", "time": "2017-12-12", "level": "现金奖励", "num_look": 1193214, "num_comment": 16, "author": "zhuzhibo0", "tags": ["其他"], "text": "2017年12月4我在日本福冈的考试中心，通过了(ISC)² CCSP认证云安全专家考试。本文简述CCSP考证相关问题，给需要的朋友参考。"}
{"title": "以CVE-2016-6516为例深入分析内核Double Fetch型漏洞利用方法", "url": "https://www.freebuf.com/articles/system/156485.html", "time": "2017-12-12", "level": "现金奖励", "num_look": 366125, "num_comment": 6, "author": "隔壁Wang叔叔", "tags": ["系统安全"], "text": "Double fetch型漏洞属于竞争类漏洞，能造成内核越界访问或缓冲区溢出，从而导致内核崩溃、提权、信息泄露等严重后果。"}
{"title": "BUF 早餐铺 | 担心被跟踪，印度要求部队从手机中卸载中国应用；NIST 发布第二版《网络安全框架 草案》；高危Android漏洞绕过签名检测机制，篡改替换App；惠普笔记本键盘驱动程序中被发现键盘记录程序", "url": "https://www.freebuf.com/news/156912.html", "time": "2017-12-12", "level": "", "num_look": 258227, "num_comment": 258227, "author": "Sphinx", "tags": ["资讯"], "text": "今天早餐铺的主要内容有：担心被跟踪，印度要求部队从手机中卸载中国应用；NIST 发布第二版《网络安全框架 草案》；高危Android漏洞绕过签名检测机制，篡改替换App。"}
{"title": "大吉大利，周四出击 | FIT 2018互联网安全创新大会“吃鸡指南”", "url": "https://www.freebuf.com/news/156537.html", "time": "2017-12-11", "level": "红色标题", "num_look": 364339, "num_comment": 8, "author": "FB客服", "tags": ["头条", "特别企划"], "text": "如何正确吃鸡？那就请收好这份FIT吃鸡指南，萌新也能快速上手。"}
{"title": "大数据时代下的隐私保护（二）", "url": "https://www.freebuf.com/articles/database/156677.html", "time": "2017-12-11", "level": "", "num_look": 743830, "num_comment": 6, "author": "百度安全实验室", "tags": ["数据安全"], "text": "在大数据的时代,越来越多的服务和产品是围绕用户数据(隐私)建立的。这样虽然带来了个性化的服务,提高了服务质量和精度,但是在数据收集、使用以及公布的过程中,用户隐私不可避免的暴露在外。"}
{"title": "漏洞预警 | 高危Android漏洞绕过签名检测机制，篡改替换App", "url": "https://www.freebuf.com/vuls/156821.html", "time": "2017-12-11", "level": "红色标题", "num_look": 462133, "num_comment": 4, "author": "Sphinx", "tags": ["漏洞", "终端安全"], "text": "Google 2017年12月的Android安全公告中提到了一个漏洞，该漏洞能让攻击者绕过应用程序签名验证并将恶意代码注入Android应用程序。"}
{"title": "快讯 | 担心被跟踪，印度要求部队从手机中卸载中国应用", "url": "https://www.freebuf.com/news/156780.html", "time": "2017-12-11", "level": "", "num_look": 326784, "num_comment": 15, "author": "shidongqi", "tags": ["资讯"], "text": "印度当局对边防部队军人发出警告，手机中中国的应用程序会将数据回传至中国的服务器，中国政府有可能利用这种服务来收集数据，确定军人在边界的位置。"}
{"title": "通过预测API窃取机器学习模型", "url": "https://www.freebuf.com/news/156313.html", "time": "2017-12-11", "level": "现金奖励", "num_look": 904425, "num_comment": 25, "author": "Terence", "tags": ["极客", "资讯"], "text": "越来越对机器学习服务提供商将机器学习作为一种服务部署在云上。笔者认为：这样部署机器学习即服务是存在安全隐患的，攻击者利用对模型的API可以窃取模型。"}
{"title": "RSA认证SDK中被曝两个严重漏洞", "url": "https://www.freebuf.com/news/156369.html", "time": "2017-12-11", "level": "", "num_look": 190785, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "如果你的代码中实现了RSA的认证SDK，那你的项目很可能已经成功“继承”了这两个安全漏洞！"}
{"title": "摩拜安全团队英雄召集令（北京）", "url": "https://www.freebuf.com/jobs/156599.html", "time": "2017-12-11", "level": "", "num_look": 331152, "num_comment": 16, "author": "mobiker", "tags": ["安全招聘"], "text": "摩拜单车创建了全球首个智能共享单车模式，其自主研发的专利智能锁集成了 GPS 和通讯模块，采用了新一代物联网技术，通过智能手机 app 让用户随时随地可以定位并使用最近的摩拜单车。"}
{"title": "椭圆曲线算法（ECC）学习（一）", "url": "https://www.freebuf.com/articles/database/155912.html", "time": "2017-12-11", "level": "现金奖励", "num_look": 1015988, "num_comment": 12, "author": "淼淼兮与怀", "tags": ["数据安全"], "text": "椭圆曲线加密算法(ECC) 是基于椭圆曲线数学的一种公钥加密的算法,随着分解大整数方法的进步以及完善、计算机计算速度的提高以及网络的发展，RSA的使用率越来越高.但是为了安全。"}
{"title": "如何DIY一个简单的反弹Shell脚本", "url": "https://www.freebuf.com/sectool/155754.html", "time": "2017-12-11", "level": "现金奖励", "num_look": 581118, "num_comment": 10, "author": "sjy93812", "tags": ["工具", "极客"], "text": "之前在一个服务器上做测试的时候需要从本地连到服务器上，但是服务器没有开ssh服务。"}
{"title": "下一代互联通信网络部署在即，IPv6安全防护准备好了吗？", "url": "https://www.freebuf.com/articles/network/156563.html", "time": "2017-12-11", "level": "红色标题", "num_look": 675357, "num_comment": 11, "author": "阿里聚安全", "tags": ["网络安全"], "text": "近日，中共中央办公厅、国务院办公厅印发了《推进互联网协议第六版（IPv6）规模部署行动计划》，加快推进IPv6规模部署，构建高速率、广普及、全覆盖、智能化的下一代互联网。"}
{"title": "BUF早餐铺 | NiceHash暂停运营，因黑客入侵造成支付系统中6400万美元比特币遭受损失；普林斯顿研究员发布POC：即便GPS是关闭的，App依旧可以定位用户的位置", "url": "https://www.freebuf.com/news/156623.html", "time": "2017-12-11", "level": "", "num_look": 248951, "num_comment": 248951, "author": "Elaine_z", "tags": ["资讯"], "text": "冬天里诸位读者都要好好吃早餐噢！"}
{"title": "Ubuntu安装Kali工具集：Katoolin", "url": "https://www.freebuf.com/sectool/156151.html", "time": "2017-12-10", "level": "", "num_look": 1022520, "num_comment": 16, "author": "stardusty", "tags": ["工具"], "text": ""}
{"title": "浅谈情报信息收集方式", "url": "https://www.freebuf.com/articles/security-management/156081.html", "time": "2017-12-10", "level": "", "num_look": 805639, "num_comment": 6, "author": "knightx", "tags": ["安全管理"], "text": "情报收集是情报机构获取可靠、高价值信息资源的一种重要方式。本文介绍情报信息收集的主要分类，重点介绍国外情报机构常用的第四方收集是什么及其细节描述。"}
{"title": "2017湖湘杯网络安全大赛Writeup", "url": "https://www.freebuf.com/articles/others-articles/155172.html", "time": "2017-12-10", "level": "金币+10", "num_look": 442875, "num_comment": 3, "author": "寻梦小生", "tags": ["其他"], "text": "中共湖南省委网络安全和信息化领导小组办公室决定在和国家有关部门的指导下，联合湖南省直相关部门共同举办 2017年 “湖湘杯” 网络安全技能大赛。"}
{"title": "浅析Windows下堆的结构", "url": "https://www.freebuf.com/articles/system/156174.html", "time": "2017-12-10", "level": "现金奖励", "num_look": 440517, "num_comment": 3, "author": "hellowuzekai", "tags": ["系统安全"], "text": "这篇文章主要分析了 Windows 下不同于 Linux 的堆的结构，而 Windows 下堆的申请回收类似于 Linux，详情可以查看我的 Dance In Heap 系列文章。"}
{"title": "平安银行总行零售信息安全岗位招聘", "url": "https://www.freebuf.com/jobs/156644.html", "time": "2017-12-09", "level": "", "num_look": 234815, "num_comment": 3, "author": "平安银行应用安全团队", "tags": ["安全招聘"], "text": "平安银行股份有限公司是总部设在深圳的全国性股份制商业银行（深圳证券交易所简称：平安银行，证券代码000001）。"}
{"title": "一起来围观国外厂商最新发布的7款信息安全产品", "url": "https://www.freebuf.com/articles/network/156228.html", "time": "2017-12-09", "level": "", "num_look": 482438, "num_comment": 2, "author": "柚子", "tags": ["网络安全"], "text": "本篇短译文旨在帮助各位同仁了解知名初创企业或大型厂商正在研究的产品方向和动向。"}
{"title": "利用开源工具TempestSDR实现屏显内容远程窃取", "url": "https://www.freebuf.com/sectool/156149.html", "time": "2017-12-09", "level": "", "num_look": 506201, "num_comment": 6, "author": "clouds", "tags": ["工具", "数据安全"], "text": "TEMPEST 是用来窃取远程视频信息的一种基于软件定义的无线电平台技术，可被当做间谍工具包使用。"}
{"title": "如何利用日志来监控和限制PowerShell攻击活动", "url": "https://www.freebuf.com/articles/system/155969.html", "time": "2017-12-09", "level": "金币+14", "num_look": 352047, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": ""}
{"title": "内核漏洞利用：通过WARBIRD在Windows 10上提升权限", "url": "https://www.freebuf.com/vuls/155972.html", "time": "2017-12-09", "level": "", "num_look": 292856, "num_comment": 292856, "author": "Covfefe", "tags": ["漏洞"], "text": "之所以没有使用像HackSys Extreme Vulnerable Windows Driver这样的东西，是因为想做点不同的事情。"}
{"title": "友盟SDK越权漏洞分析报告", "url": "https://www.freebuf.com/articles/system/156332.html", "time": "2017-12-09", "level": "", "num_look": 313431, "num_comment": 313431, "author": "360安全", "tags": ["系统安全"], "text": "360信息安全部的Vulpecker安全团队发现了国内消息推送厂商友盟的SDK存在可越权调用未导出组件的漏洞，并利用该漏洞实现了对使用了友盟SDK的APP的任意组件的恶意调用。"}
{"title": "详细议程公布！FIT 2018大会，下周见", "url": "https://www.freebuf.com/news/topnews/156682.html", "time": "2017-12-08", "level": "红色标题", "num_look": 245311, "num_comment": 3, "author": "FB客服", "tags": ["头条", "特别企划"], "text": "连接行业专家、顶级白帽、政府权威、前沿厂商，探索安全最前沿，共论安全X创新。"}
{"title": "Process Doppelgänging：绕过杀软检测的新技术", "url": "https://www.freebuf.com/news/156657.html", "time": "2017-12-08", "level": "", "num_look": 336105, "num_comment": 6, "author": "Sphinx", "tags": ["系统安全", "资讯"], "text": "今天在Black Hat欧洲2017大会上，两名来自enSilo公司的安全研究员介绍了一种新的代码注入技术，他们命名为“Process Doppelgänging”。"}
{"title": "AWS攻防 | 利用DNS技术突破AWS隔离网络限制进行数据渗漏", "url": "https://www.freebuf.com/articles/network/155973.html", "time": "2017-12-08", "level": "红色标题", "num_look": 422240, "num_comment": 1, "author": "clouds", "tags": ["网络安全"], "text": "AmazonProvidedDNS流量不会像标准用户流量那样能通过同一个网络环境链接流出，且不可被AWS安全组审核评估。"}
{"title": "饿了么招聘，从E开始创造无限可能", "url": "https://www.freebuf.com/jobs/156494.html", "time": "2017-12-08", "level": "", "num_look": 246191, "num_comment": 11, "author": "eleme_sec", "tags": ["安全招聘"], "text": "饿了么风险控制部成立于2015年，是负责饿了么所有业务及产品线整体风控及安全的专业团队"}
{"title": "浅谈爬虫及绕过网站反爬取机制", "url": "https://www.freebuf.com/articles/web/156204.html", "time": "2017-12-08", "level": "", "num_look": 647146, "num_comment": 9, "author": "野火研习社1", "tags": ["WEB安全"], "text": "爬虫用来自动获取源数据，至于更多的数据处理等等是后续的工作，这篇文章主要想谈谈爬虫获取数据的这一部分。"}
{"title": "PHP WebShell变形技术总结", "url": "https://www.freebuf.com/articles/web/155891.html", "time": "2017-12-08", "level": "现金奖励", "num_look": 900078, "num_comment": 14, "author": "默安科技_影武者实验室", "tags": ["WEB安全"], "text": "webshell的变形技术与各种防护软件的检测方法一直都在相互对抗，本篇文章就对目前常见的webshell的变形技术进行总结。"}
{"title": "AOP技术应用于安全防御与漏洞修复", "url": "https://www.freebuf.com/articles/network/156069.html", "time": "2017-12-08", "level": "金币+14", "num_look": 400594, "num_comment": 5, "author": "tony86", "tags": ["网络安全"], "text": "切面表示从业务逻辑分离出来的横切逻辑，比如性能监控、日志记录、权限控制，这些功能可从核心逻辑代码中抽离出去。也就是说AOP可以解决代码耦合问题，让职责更单一。"}
{"title": "某音乐类App评论相关API的分析及SQL注入尝试", "url": "https://www.freebuf.com/vuls/155962.html", "time": "2017-12-08", "level": "现金奖励", "num_look": 545309, "num_comment": 16, "author": "molibird", "tags": ["WEB安全", "漏洞"], "text": "记录分析某音乐类App评论相关API的过程，以及一些工具/包的基本使用（部分工具对最后尝试没有影响，但在其它场景或许有用），最后结合sqlmap进行注入尝试。"}
{"title": "关于Web应用和容器的指纹收集以及自动化软件的制作", "url": "https://www.freebuf.com/articles/web/155547.html", "time": "2017-12-08", "level": "现金奖励", "num_look": 287147, "num_comment": 5, "author": "0d9y", "tags": ["WEB安全"], "text": "一次对Web应用的渗透，九成都是从信息收集开始，所以信息收集就显得尤为重要。"}
{"title": "BUF 早餐铺 | 婚外情网站 Ashley Madison 泄露用户私密照片；近5500个wordpress 站点感染键盘记录脚本；新TeamViewer漏洞让攻击者劫持PC；英特尔修复的ME漏洞并不彻底", "url": "https://www.freebuf.com/news/156595.html", "time": "2017-12-08", "level": "", "num_look": 247834, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "婚外情网站 Ashley Madison 泄露用户私密照片；近5500个wordpress 站点受到带有键盘记录功能的恶意脚本感染。"}
{"title": "英特尔ME漏洞仍存在，Black Hat安全研究人员不淡定了", "url": "https://www.freebuf.com/news/156524.html", "time": "2017-12-07", "level": "", "num_look": 377664, "num_comment": 3, "author": "shidongqi", "tags": ["系统安全", "资讯"], "text": "两周以前，英特尔承认了包括ME、SPS等固件存在的多个严重安全漏洞，其中ME多个版本都存在缓冲区溢出漏洞，但貌似直到今天也并没有完全解决。"}
{"title": "MailSploit：30多种邮件客户端存在电邮身份伪造漏洞", "url": "https://www.freebuf.com/news/156501.html", "time": "2017-12-07", "level": "", "num_look": 342026, "num_comment": 3, "author": "clouds", "tags": ["资讯"], "text": "德国安全研究员 Sabri Haddouche发现30多种邮件客户端中存在漏洞，可以让任意用户伪造身份发送欺诈邮件并绕过反欺诈保护机制（如 DMARC 等）和多种垃圾邮件过滤器"}
{"title": "后渗透工具Koadic：你真的了解我吗？", "url": "https://www.freebuf.com/sectool/155755.html", "time": "2017-12-07", "level": "红色标题", "num_look": 479410, "num_comment": 16, "author": "baimaozi", "tags": ["工具"], "text": "在朋友的博客上看到推荐的一款工具Koadic，我接触了以后发现很不错这款工具的强大之处我觉得就是拿到shell后的各种模块功能，我就自己写出来发给大家看看吧。"}
{"title": "看我如何利用简单的配置错误“渗透”BBC新闻网", "url": "https://www.freebuf.com/news/155558.html", "time": "2017-12-07", "level": "", "num_look": 273658, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "在这篇文章中，我将跟大家分享我的一次挖洞经验，希望大家能够喜欢."}
{"title": "快讯 | 婚外情网站 Ashley Madison 泄露用户私密照片——偷情有风险，丢人丢钱丢性命", "url": "https://www.freebuf.com/news/156490.html", "time": "2017-12-07", "level": "红色标题", "num_look": 756286, "num_comment": 5, "author": "AngelaY", "tags": ["观点", "资讯"], "text": "有安全研究人员表示，知名婚外情网站 Ashley Madison 因其默认设置出现问题，导致用户私密照片泄露。"}
{"title": "携程信息安全部诚聘安全相关高级人才", "url": "https://www.freebuf.com/jobs/156428.html", "time": "2017-12-07", "level": "", "num_look": 197576, "num_comment": 8, "author": "携程信息安全部", "tags": ["安全招聘"], "text": "携程旅行网创立于1999年，总部设在中国上海，员工30000余人，作为中国领先的综合性旅行服务公司，携程成功整合了高科技产业与传统旅行业，向超过2.5亿会员提供服务。"}
{"title": "二进制之图论与威胁情报", "url": "https://www.freebuf.com/articles/network/155924.html", "time": "2017-12-07", "level": "现金奖励", "num_look": 418954, "num_comment": 4, "author": "GeekOnline", "tags": ["网络安全"], "text": "图论看起来离我们很远，但其实在网络安全中已经大量用于识别僵尸网络、风控、威胁情报等领域。本文就简单的介绍下怎么运用图论知识解决二进制的一些问题。"}
{"title": "深度剖析：手机指纹的马奇诺防线", "url": "https://www.freebuf.com/articles/network/156090.html", "time": "2017-12-07", "level": "", "num_look": 617683, "num_comment": 5, "author": "百度安全实验室", "tags": ["网络安全"], "text": "我们深入研究后发现，其实这些生物特征识别技术都存在传感器容易被欺骗的安全问题。应安全界朋友邀请，特以本文对手机指纹的安全问题做深入剖析。"}
{"title": "如何让你的服务屏蔽Shodan扫描", "url": "https://www.freebuf.com/news/155767.html", "time": "2017-12-07", "level": "现金奖励", "num_look": 327700, "num_comment": 9, "author": "MasonQAQ", "tags": ["资讯"], "text": "能否让类似shodan这些搜索引擎没法扫描到我，让我这个设备在shodan的搜索结果中不出现，但同时不影响正常用户的访问？"}
{"title": "2345联盟通过流氓软件推广挖矿工具， 众多用户电脑沦为“肉鸡”", "url": "https://www.freebuf.com/articles/terminal/155895.html", "time": "2017-12-07", "level": "", "num_look": 902091, "num_comment": 14, "author": "火绒安全", "tags": ["终端安全"], "text": "\"火绒安全实验室\"发出警报，一款名为\"云计算\"的软件，正通过各种流氓渠道大肆推广，该软件除了把用户电脑当\"肉鸡\"进行挖矿外，没有任何其他功能，是一种纯粹的挖矿工具。"}
{"title": "BUF早餐铺 | Mirai 变种 Satori 活跃；邮件地址解析存Mailsploit漏洞，影响33个邮件客户端；虚拟键盘 AI.type 收集并泄露 3100 万用户信息", "url": "https://www.freebuf.com/news/156432.html", "time": "2017-12-07", "level": "", "num_look": 253333, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "谷歌12月修复安卓中47个漏洞；WAGO PLC工控产品存在严重漏洞； ParseDroid漏洞影响安卓应用开发工具；北京警方破获非法获取个人信息大案：百万手机号泄露。"}
{"title": "【已结束】人工智能技术识别滥用数据的内部威胁 | AI安全嘉年华·公开课", "url": "https://www.freebuf.com/fevents/155734.html", "time": "2017-12-06", "level": "红色标题", "num_look": 373154, "num_comment": 8, "author": "FB客服", "tags": ["活动"], "text": "内部威胁区别于外部威胁，攻击者来自于内部用户，因此检测更加困难，危害性却更大。"}
{"title": "Satori（觉醒）新僵尸网络出现，在过去的12个小时内已经激活超过28万个不同的IP", "url": "https://www.freebuf.com/news/156394.html", "time": "2017-12-06", "level": "", "num_look": 286434, "num_comment": 4, "author": "Sphinx", "tags": ["资讯"], "text": "研究人员警示大家一个新的僵尸网络Satori，在过去的12个小时内已经激活超过28万个不同的IP。Satori这个名字来源于日语“觉醒”，这是之前Mirai IoT僵尸网络的变种。"}
{"title": "云服务首要威胁分析：用户如何保护自己的资产？", "url": "https://www.freebuf.com/articles/paper/155923.html", "time": "2017-12-06", "level": "", "num_look": 199367, "num_comment": 199367, "author": "腾讯电脑管家", "tags": ["安全报告"], "text": "腾讯安全旗下反病毒和云鼎实验室联合响应小组日前就发现了多起针对腾讯云Win主机的入侵和资源盗窃攻击。"}
{"title": "一条防火墙招标参数引发的讨论", "url": "https://www.freebuf.com/articles/es/156357.html", "time": "2017-12-06", "level": "红色标题", "num_look": 459768, "num_comment": 12, "author": "Akane", "tags": ["企业安全"], "text": "某天深夜1点多，某业界知名安全大厂的“防火墙产品吐槽群”里突然活跃起来……"}
{"title": "OSX.CpuMeaner：针对macOS平台的新型挖矿木马", "url": "https://www.freebuf.com/news/155757.html", "time": "2017-12-06", "level": "", "num_look": 259582, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "在这篇文章中，我们将给大家分析一种针对macOS的新型加密货币挖矿木马。这种恶意软件在感染了目标设备之后，会悄悄下载挖矿程序，并利用目标用户的硬件设备来挖门罗币。"}
{"title": "SQL注入的“冷门姿势”", "url": "https://www.freebuf.com/articles/web/155876.html", "time": "2017-12-06", "level": "现金奖励", "num_look": 761142, "num_comment": 10, "author": "m09046105", "tags": ["WEB安全"], "text": "SQL注入已经存在很多年了，其中的技巧也似乎被大家玩遍了，笔者分享几个渗透实战中遇到的一些SQL注入中的冷门知识。"}
{"title": "装载规划软件可被利用，或导致船舶失衡", "url": "https://www.freebuf.com/news/155915.html", "time": "2017-12-06", "level": "", "num_look": 154768, "num_comment": 2, "author": "Covfefe", "tags": ["资讯"], "text": "船舶及集装箱的载运规划其实是在没有安全消息系统的情况下创建的，不过在船只与航运公司，码头以及港务局之间却会有一些冗长的电子信息通信，容易被恶意利用。"}
{"title": "威胁预警 | Mirai变种Satori正在端口37215和52879上类似蠕虫式传播", "url": "https://www.freebuf.com/news/156301.html", "time": "2017-12-06", "level": "", "num_look": 214489, "num_comment": 3, "author": "360安全", "tags": ["资讯"], "text": "大约从2017-12-05 11:57 AM 开始，360网络安全研究院注意到Satori（一个mirai变种）的新版本正在端口37215和52869上非常快速的传播。"}
{"title": "工控安全 | 西门子S7安全知识讲解", "url": "https://www.freebuf.com/articles/ics-articles/155978.html", "time": "2017-12-06", "level": "金币+14", "num_look": 520997, "num_comment": 4, "author": "gongmo", "tags": ["工控安全"], "text": "本文主要对工控安全中西门子s7系列plc展开一个入门级全方位的讲解。继续抛砖引玉，欢迎各位工控大神来交流。"}
{"title": "解题思路 | 从一道Pwn题说起", "url": "https://www.freebuf.com/news/155971.html", "time": "2017-12-06", "level": "现金奖励", "num_look": 412917, "num_comment": 7, "author": "Reshahar", "tags": [], "text": "好久没有写文章了，最近在学习pwn，这次就分享pwnable.tw上的一道pwn的解题思路"}
{"title": "快讯 | 入侵监狱网站篡改记录帮朋友提前释放？结果自己也进去了", "url": "https://www.freebuf.com/news/156250.html", "time": "2017-12-06", "level": "红色标题", "num_look": 355861, "num_comment": 6, "author": "Sphinx", "tags": ["资讯"], "text": "上周一名密西根人因入侵Washtenaw县监狱被捕，原因竟然是他想修改监狱记录，好让朋友提前释放。"}
{"title": "Buf早餐铺 | 世界警察联合捣毁Andromeda僵尸网络；谷歌对收集用户信息的安卓应用展开“清理行动”；Paypal的TIO Networks企业数据泄漏", "url": "https://www.freebuf.com/news/156171.html", "time": "2017-12-06", "level": "", "num_look": 208918, "num_comment": 208918, "author": "Elaine_z", "tags": ["资讯"], "text": "Winter is coming! 来一份热腾腾的 FreeBuf 早餐吧！"}
{"title": "FIT 2018大会预告（十二）： 高并发开源软件WAF在企业安全实战中的探索 | 企业安全工坊", "url": "https://www.freebuf.com/news/156143.html", "time": "2017-12-05", "level": "红色标题", "num_look": 263329, "num_comment": 263329, "author": "FB客服", "tags": ["活动", "资讯"], "text": "如果 WAF 和开源结合起来会是什么样子？开源 WAF 产品的发展如何？好的开源 WAF产品有哪些？其优缺点是什么？它们在企业安全实战中有怎样的表现？"}
{"title": "谷歌严打APP滥用权限获取用户信息，而国内安卓自有妙招", "url": "https://www.freebuf.com/news/156212.html", "time": "2017-12-05", "level": "", "num_look": 413141, "num_comment": 5, "author": "shidongqi", "tags": ["终端安全", "资讯"], "text": "安卓手机系统上，通过App随意获取权限收集数据几乎已成常态，也就导致安卓手机权限泛滥而被人诟病。于是，谷歌进一步加强了限制措施。"}
{"title": "Recon.sh：一款用于记录和组织网络侦查信息的工具", "url": "https://www.freebuf.com/sectool/155477.html", "time": "2017-12-05", "level": "", "num_look": 300936, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具"], "text": "这款工具专为计算机黑客社区而设计，它所提供的框架功能可以帮助测试人员整理和收集网络侦查（recon）信息。"}
{"title": "海莲花（OceanLotus）团伙漏洞利用类攻击样本分析", "url": "https://www.freebuf.com/articles/web/155747.html", "time": "2017-12-05", "level": "红色标题", "num_look": 452098, "num_comment": 9, "author": "奇安信威胁情报中心", "tags": ["WEB安全"], "text": "360威胁情报中心自在2015年首次揭露海莲花（OceanLotus）APT团伙的活动以后，一直密切监控其活动，跟踪其攻击手法和目标的变化。"}
{"title": "如何使用Netcat将Android文件系统镜像直接转移到本地系统", "url": "https://www.freebuf.com/articles/terminal/155473.html", "time": "2017-12-05", "level": "", "num_look": 266609, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "Netcat提供了一种非常高效的网络分析方法（从后端到服务器），并且能够使用刚才所提到的协议在目标网络中建立新的连接。"}
{"title": "卡巴斯基发布安全公告：2018年威胁预测", "url": "https://www.freebuf.com/articles/paper/156155.html", "time": "2017-12-05", "level": "红色标题", "num_look": 307509, "num_comment": 1, "author": "阿里聚安全", "tags": ["安全报告"], "text": "卡巴斯基实验室的全球研究和分析团队追踪了超过100个APT的组织，发现有一些的攻击活动非常复杂，他们不仅拥有广泛的武器库，并将传统的黑客攻击复杂化去实现数据渗透的目的。"}
{"title": "从安全角度深入理解MySQL编码转换机制", "url": "https://www.freebuf.com/articles/web/154932.html", "time": "2017-12-05", "level": "现金奖励", "num_look": 450278, "num_comment": 5, "author": "shadow4u", "tags": ["WEB安全", "数据安全"], "text": "这篇文章主要从实例角度出发，以图说话，深入mysql编码转换机制。"}
{"title": "针对VBA宏勒索软件BLUFISH的检测分析与有效防护", "url": "https://www.freebuf.com/articles/web/155762.html", "time": "2017-12-05", "level": "", "num_look": 315282, "num_comment": 315282, "author": "antiylab", "tags": ["WEB安全"], "text": "完全使用VBA宏编写的文件加密勒索软件家族BluFish，加密文件时不会改变文件名称，亦不会修改文件结构。"}
{"title": "Typecho install.php存在的反序列化漏洞分析（含EXP）", "url": "https://www.freebuf.com/vuls/155753.html", "time": "2017-12-05", "level": "现金奖励", "num_look": 592518, "num_comment": 21, "author": "王三三", "tags": ["WEB安全", "漏洞"], "text": "很久没有在安全方面折腾，突然收到“爸爸云”的短信，“您的服务器xxx.xxx.xxx.xxx存在网站后门，为防止黑客进一步入侵，请登录进行查看和处理”。"}
{"title": "BUF 早餐铺 | 俄罗斯公布建立备用DNS系统的计划；英国政府禁止所有俄罗斯反病毒查杀软件；美国新泽一高中学生黑进学校教务系统递交大学申请", "url": "https://www.freebuf.com/news/156110.html", "time": "2017-12-05", "level": "", "num_look": 172921, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "俄罗斯公布建立备用DNS系统的计划，可供金砖国家使用；英国政府禁止所有俄罗斯反病毒查杀软件；美国新泽一高中学生黑进学校教务系统，修改GPA成绩递交大学申请。"}
{"title": "快讯 | PayPal子公司TIO Networks被曝数据泄露，约160万名用户受害", "url": "https://www.freebuf.com/news/156122.html", "time": "2017-12-04", "level": "", "num_look": 196795, "num_comment": 196795, "author": "shidongqi", "tags": ["资讯"], "text": "经证实，PayPal的一家加拿大子公司TIO Networks曝出严重安全漏洞，攻击者入侵了存储重要用户信息的服务器，受影响人数约160万人。"}
{"title": "FIT 2018大会预告（十一）：解构Hadoop安全攻防技术 | X-Tech技术派对", "url": "https://www.freebuf.com/news/155883.html", "time": "2017-12-04", "level": "红色标题", "num_look": 220559, "num_comment": 1, "author": "FB客服", "tags": ["活动", "资讯"], "text": "大数据时代下，Hadoop成为了各大企业处理数据的首选。然而，Hadoop没有成熟的安全机制，因此的安全性是饱受争议的话题"}
{"title": "卡巴斯基关于勒索软件的总结：2017年勒索软件的故事", "url": "https://www.freebuf.com/articles/neopoints/155731.html", "time": "2017-12-04", "level": "", "num_look": 347678, "num_comment": 2, "author": "knightx", "tags": ["观点"], "text": "欢迎来到属于勒索软件的2017年——这一年全球越来越多的企业及工业系统被添加到不断增长的受害者名单中，并且目标式攻击者也开始对这一目标产生浓厚的兴趣。"}
{"title": "披着狼皮的羊：HP打印机远程代码执行漏洞（RCE）是这样被发现的", "url": "https://www.freebuf.com/vuls/155144.html", "time": "2017-12-04", "level": "", "num_look": 580987, "num_comment": 2, "author": "clouds", "tags": ["漏洞", "终端安全"], "text": "打印机作为组织机构内部不可缺少的资产设备，近年来，随着各种打印固件漏洞百出，其安全性也备受关注，打印机安全与电脑安全同等重要。"}
{"title": "病毒分析 | 一款名为“老裁缝“的激活工具捆绑薅羊毛", "url": "https://www.freebuf.com/articles/paper/155702.html", "time": "2017-12-04", "level": "现金奖励", "num_look": 520262, "num_comment": 8, "author": "安全豹", "tags": ["安全报告"], "text": "一款名叫“老裁缝激活工具”，借助着”小马激活”的名字活跃在“系统之家”、”软件下载器”、“网盘”。"}
{"title": "挖洞经验 | 价值$10000美金的Facebook任意图片删除漏洞", "url": "https://www.freebuf.com/vuls/155582.html", "time": "2017-12-04", "level": "", "num_look": 427880, "num_comment": 15, "author": "clouds", "tags": ["漏洞"], "text": "近期，伊朗安全专家Pouya Darabi发现，Facebook新推出的某项投票询问功能存在漏洞，可以利用该功能，删除其他任何人上传分享至Facebook中的图片。"}
{"title": "网信集团安全部招聘启事", "url": "https://www.freebuf.com/jobs/155700.html", "time": "2017-12-04", "level": "", "num_look": 220601, "num_comment": 15, "author": "北北北北", "tags": ["安全招聘"], "text": ""}
{"title": "OWASP Juice Shop CTF环境搭建", "url": "https://www.freebuf.com/sectool/155650.html", "time": "2017-12-04", "level": "现金奖励", "num_look": 600303, "num_comment": 17, "author": "woaisdd", "tags": ["工具"], "text": "昨天看了表哥的《OWASP Juice Shop：专用于安全技能训练的OWASP靶场（含演示视频）》文章后,觉得单独做每一关不是很爽，做成CTF的模式感觉会更好一下。"}
{"title": "Wireless IP Camera (P2P) WIFICAM存在多个高危漏洞（附带PoC）", "url": "https://www.freebuf.com/vuls/155378.html", "time": "2017-12-04", "level": "金币+10", "num_look": 354147, "num_comment": 4, "author": "学霸么么哒", "tags": ["漏洞"], "text": "国家信息安全漏洞共享平台（CNVD）收录了名为Wireless IP Camera (P2P) WIFICAM摄像头产品存在的多处高危安全漏洞"}
{"title": "如何用Python编写信息收集之子域名收集脚本", "url": "https://www.freebuf.com/news/154930.html", "time": "2017-12-04", "level": "金币+10", "num_look": 484987, "num_comment": 10, "author": "淼淼兮与怀", "tags": ["工具", "资讯"], "text": "子域名是相对于网站的主域名的。如百度的主域名为：baidu.com，这是一个顶级域名，而在顶级域名前加上不同的字符，如zhidao.baidu.com，那么这就是一个二级域名。"}
{"title": "使用Shell脚本掩盖Linux服务器上的操作痕迹", "url": "https://www.freebuf.com/articles/system/155579.html", "time": "2017-12-04", "level": "金币+10", "num_look": 397390, "num_comment": 3, "author": "JingleCats", "tags": ["系统安全"], "text": "使用Shell脚本在Linux服务器上能够控制、毁坏或者获取任何东西，通过一些巧妙的攻击方法黑客可能会获取巨大的价值，但大多数攻击也留下踪迹。"}
{"title": "MySQL绕过WAF实战技巧", "url": "https://www.freebuf.com/articles/web/155570.html", "time": "2017-12-04", "level": "现金奖励", "num_look": 703206, "num_comment": 17, "author": "blacksunny", "tags": ["WEB安全"], "text": "这次主要是看到国外大牛对mysql注入测试的一些思路，然后自己整理下，分享下。对于只看宏观文章，没有实战的演练，无疑是很好的案例。"}
{"title": "BUF早餐铺 | 专家发现脏牛漏洞修复不完全；航运巨头 Clarkson 出现数据泄露；AWS 推出新网络安全服务；Chrome将阻止外部应用运行代码", "url": "https://www.freebuf.com/news/155897.html", "time": "2017-12-04", "level": "", "num_look": 168999, "num_comment": 168999, "author": "AngelaY", "tags": ["资讯"], "text": "Cobalt黑客在鱼叉式钓鱼中意外泄漏所有攻击目标；惠普暗中在用户电脑上安装“间谍”软件；欧盟将为开源跨平台多媒体播放器 VLC 开设漏洞奖励计划；扫码支付存在安全隐患。"}
{"title": "加密货币攻击之比特币：已成为可能？（含演示视频）", "url": "https://www.freebuf.com/news/155287.html", "time": "2017-12-03", "level": "", "num_look": 253406, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "考虑到网络路由攻击可能会对全球的比特币网络产生消极影响。因此，近期我们研究了网络路由攻击（例如BGP劫持）和恶意互联网服务提供商（ISP）对比特币所能产生的影响。"}
{"title": "挖洞经验 | 命令注入突破长度限制", "url": "https://www.freebuf.com/articles/web/154453.html", "time": "2017-12-03", "level": "现金奖励", "num_look": 537138, "num_comment": 14, "author": "shadow4u", "tags": ["WEB安全"], "text": "很多时候，在我们历经千辛万苦挖掘出一个漏洞或者找到一个利用点的时候，却因为一些egg hurt的限制，导致get shell或者send payload无法成功."}
{"title": "针对新型POS机恶意软件Trojan.Win32.Alinaos的分析", "url": "https://www.freebuf.com/news/155371.html", "time": "2017-12-03", "level": "", "num_look": 188595, "num_comment": 188595, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "由于需要处理成千上万条信用卡记录，这不仅使得POS机终端成为了一种十分关键和重要的系统，而且还让它成为了网络犯罪分子越来越喜欢的攻击目标。"}
{"title": "注意了，使用XSS平台的你可能被“偷窥”", "url": "https://www.freebuf.com/articles/web/155370.html", "time": "2017-12-03", "level": "现金奖励", "num_look": 555003, "num_comment": 7, "author": "九如", "tags": ["WEB安全"], "text": "故君子之治人也，即以其人之道，还治其人之身。"}
{"title": "从协议角度看企业攻防、USB Auto Hacking与SRC“混子”养成指南：WiFi万能钥匙SRC安全沙龙成都站议题回顾", "url": "https://www.freebuf.com/fevents/155925.html", "time": "2017-12-02", "level": "红色标题", "num_look": 345208, "num_comment": 6, "author": "Akane", "tags": ["活动"], "text": "蓉城今天气温适宜，天气预报说的小雨也没有下起来，相当巴适~本次活动召集了来自成都、重庆、西安、北京、上海的数百名安全专家到场，好不热闹。"}
{"title": "最好用的开源Web漏扫工具梳理", "url": "https://www.freebuf.com/articles/web/155209.html", "time": "2017-12-02", "level": "", "num_look": 1390056, "num_comment": 9, "author": "柚子", "tags": ["WEB安全"], "text": "赛门铁克2017年互联网安全威胁报告中提出在他们今年扫描的网站中，有76%都含有恶意软件。"}
{"title": "低成本制作基于OpenWRT的渗透工具", "url": "https://www.freebuf.com/sectool/155327.html", "time": "2017-12-02", "level": "红色标题", "num_look": 522793, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["工具", "极客"], "text": "Hak5的PACKETSQUIRREL上架已经有好几个星期了，而在这篇文章中，我将会对这个价值59美金的“小玩意儿”进行分析，并以低成本制作一个类似的工具。"}
{"title": "威胁情报的应用实例——首届安全分析与情报大会纪实（下）", "url": "https://www.freebuf.com/fevents/155846.html", "time": "2017-12-02", "level": "", "num_look": 399307, "num_comment": 3, "author": "AngelaY", "tags": ["活动"], "text": "本篇重点记录了大会上各安全从业者带来的威胁情报应用实例。"}
{"title": "论如何选购最重要的安全设备：下一代防火墙篇", "url": "https://www.freebuf.com/articles/network/155560.html", "time": "2017-12-02", "level": "现金奖励", "num_look": 755612, "num_comment": 17, "author": "华数数字电视传媒集团", "tags": ["网络安全"], "text": "市场上可提供防火墙产品的厂家，国内外知名大品牌就有几十家，品质肯定是良莠不齐的，今天我们就来讲讲如何选购质优价低的好东西。"}
{"title": "USDT发行方Tether遭受黑客攻击，3095万美元USDT代币被盗", "url": "https://www.freebuf.com/news/155146.html", "time": "2017-12-02", "level": "", "num_look": 247870, "num_comment": 11, "author": "米雪儿", "tags": ["资讯"], "text": "近日，USDT发行方Tether公司发表声明称其系统于本月19日遭到外部攻击者入侵，并从其Tether Treasury钱包中盗走了价值约3100万美元的USDT代币。"}
{"title": "威胁情报已经很火了，那它的现状和发展如何？——首届安全分析与情报大会纪实（上）", "url": "https://www.freebuf.com/fevents/155830.html", "time": "2017-12-01", "level": "红色标题", "num_look": 475829, "num_comment": 2, "author": "AngelaY", "tags": ["活动"], "text": "在专家学者和安全厂商眼中，威胁情报的现状与发展是什么样的？"}
{"title": "企业安全管理新智慧| FIT中国首席信息安全官高峰论坛议题抢先看", "url": "https://www.freebuf.com/news/155807.html", "time": "2017-12-01", "level": "红色标题", "num_look": 228937, "num_comment": 2, "author": "FB客服", "tags": ["活动", "资讯"], "text": "FIT 中国首席信息安全官高峰论坛将于2017年12月13日（周三）下午在上海举行，我们诚挚的邀请广大企业信息安全负责人参与交流，期待您的出席与精彩分享，共同探讨企业信息安全现状及未来！"}
{"title": "快讯 | 专家发现脏牛漏洞修复不完全", "url": "https://www.freebuf.com/news/155837.html", "time": "2017-12-01", "level": "", "num_look": 263142, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "研究人员发现，去年发现的脏牛漏洞(CVE-2016–5195)尚未被完全修复。"}
{"title": "血淋林的例子告诉你，为什么防“上传漏洞”要用白名单", "url": "https://www.freebuf.com/articles/web/155150.html", "time": "2017-12-01", "level": "红色标题", "num_look": 553152, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["WEB安全", "系统安全"], "text": "当我阅读了@Idionmarcil的【这篇文章】之后，我决定要深入了解一下当前热门的Web服务器是如何处理各种类型的扩展名的。"}
{"title": "Google无视用户隐私设置，暗中收集Android位置数据", "url": "https://www.freebuf.com/news/155139.html", "time": "2017-12-01", "level": "", "num_look": 396131, "num_comment": 3, "author": "Covfefe", "tags": ["终端安全", "资讯"], "text": "许多人都知道智能手机会追踪他们的位置，但是，在已经主动关闭了定位服务，且没有使用任何应用程序，甚至都没有插入运营商的SIM卡的情况下，你觉得手机还会被定位吗？"}
{"title": "利用Burp Suite挖掘暗网服务的真实IP", "url": "https://www.freebuf.com/articles/web/155254.html", "time": "2017-12-01", "level": "", "num_look": 656255, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "在这篇文章中，我将跟大家讨论一下如何通过向网站发送各种Payload来挖掘网站中可能存在的安全漏洞，并利用BurpSuite来发现Tor隐藏服务的真实IP地址。"}
{"title": "腾讯安全诚招算法工程师", "url": "https://www.freebuf.com/jobs/155507.html", "time": "2017-12-01", "level": "", "num_look": 233990, "num_comment": 4, "author": "RanDom", "tags": ["安全招聘"], "text": "深圳市腾讯计算机系统有限公司成立于1998年11月，由马化腾、张志东、许晨晔、陈一丹、曾李青五位创始人共同创立。 是中国最大的互联网综合服务提供商之一。"}
{"title": "渗透经验 | Windows下载远程Payload并执行代码的各种技巧", "url": "https://www.freebuf.com/articles/system/155147.html", "time": "2017-12-01", "level": "", "num_look": 685271, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "近期，攻击者使用DDE执行任意命令行工具并入侵系统的情况开始增加，而这似乎也成为了近期的一种趋势。"}
{"title": "浅谈一下mshta在CVE-2017-11882里的命令构造", "url": "https://www.freebuf.com/articles/web/155304.html", "time": "2017-12-01", "level": "现金奖励", "num_look": 675151, "num_comment": 20, "author": "lcx", "tags": ["WEB安全"], "text": "在这里我就浅谈一下如何构造mshta命令，另外提一下hta文件在安全方面的一个应用。"}
{"title": "解析U盘病毒传播之文件欺骗", "url": "https://www.freebuf.com/articles/terminal/155063.html", "time": "2017-12-01", "level": "现金奖励", "num_look": 534243, "num_comment": 11, "author": "scu-igroup", "tags": ["数据安全", "终端安全"], "text": "现如今，U盘作为便携的存储设备，方便人们的同时，也成为了黑客传播病毒的载体。"}
{"title": "揭秘2017网络黑产四大新趋势，威胁源全方位袭来", "url": "https://www.freebuf.com/news/155425.html", "time": "2017-12-01", "level": "", "num_look": 289763, "num_comment": 4, "author": "腾讯手机管家", "tags": ["资讯"], "text": "2017年，随着国内互联网金融、人工智能和大数据等产业继续深化发展，互联网为实体产业转型升级所提供的帮助越来越明显。"}
{"title": "BUF 早餐铺 | 雅虎2014信息泄漏案件的一名嫌犯遭逮捕；苹果紧急发布补丁修复High Sierra登陆漏洞；即便关闭浏览器，挖矿插件还是在继续运行", "url": "https://www.freebuf.com/news/155716.html", "time": "2017-12-01", "level": "", "num_look": 175688, "num_comment": 175688, "author": "Sphinx", "tags": ["资讯"], "text": "雅虎2014信息泄漏案件的一名嫌犯遭逮捕；苹果紧急发布补丁修复High Sierra登陆漏洞；即便关闭浏览器，挖矿插件还是在继续运行"}
{"title": "看我如何利用Atom编辑器的漏洞实现远程代码执行", "url": "https://www.freebuf.com/news/154899.html", "time": "2017-11-30", "level": "", "num_look": 358475, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["漏洞", "资讯"], "text": "前不久，我研究了一下GitHub的文本编辑器（Atom），并且在Atom中找到了好几个安全。经过了一段时间的分析和研究之后我发现，这些漏洞将允许攻击者在目标用户的设备上实现远程代码执行。"}
{"title": "OWASP Juice Shop题解（一）", "url": "https://www.freebuf.com/news/155019.html", "time": "2017-11-30", "level": "金币+12", "num_look": 254658, "num_comment": 5, "author": "administrat0r", "tags": ["资讯"], "text": "安装过程就不说了，网上很多攻略已经说的很详细了，直接进入正题。"}
{"title": "快讯 | 苹果紧急发布补丁修复High Sierra登陆漏洞", "url": "https://www.freebuf.com/news/155656.html", "time": "2017-11-30", "level": "红色标题", "num_look": 204576, "num_comment": 3, "author": "Sphinx", "tags": ["资讯"], "text": "周三的声明中，苹果表示承认出现了错误，“安全是每款苹果产品最为优先的要素，我们很遗憾在macOS中出现了这样的错误。”"}
{"title": "云环境面临的十二项安全问题", "url": "https://www.freebuf.com/articles/neopoints/155187.html", "time": "2017-11-30", "level": "", "num_look": 412282, "num_comment": 412282, "author": "1e1e1e", "tags": ["企业安全", "观点"], "text": "云环境下的安全问题值得仔细梳理，供大家参考参考CSA在RSA发布的云安全面临的十二大威胁。"}
{"title": "病毒分析 | Overlay攻击之完美伪装的移动银行木马", "url": "https://www.freebuf.com/articles/terminal/155365.html", "time": "2017-11-30", "level": "", "num_look": 374225, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["系统安全", "终端安全"], "text": "可能大家都知道，很多移动端银行木马都会竭尽所能地去伪装自己。绝大多数智能手机用户都会使用各种各样的App来丰富自己的生活，而移动应用开发人员也会根据用户的需求以及各种场景来开发不同的App。"}
{"title": "企业安全经验 | 应急响应的战争", "url": "https://www.freebuf.com/articles/web/155314.html", "time": "2017-11-30", "level": "现金奖励", "num_look": 383730, "num_comment": 13, "author": "nightmarelee", "tags": ["WEB安全", "企业安全"], "text": "下文将根据本人在资产收集中构建的漏洞一键排查系统谈谈漏洞的快速排查问题。"}
{"title": "“夭折”的供应链攻击：Defraggler被植入后门代码分析", "url": "https://www.freebuf.com/news/155380.html", "time": "2017-11-30", "level": "", "num_look": 224937, "num_comment": 224937, "author": "奇安信威胁情报中心", "tags": ["系统安全", "资讯"], "text": "近日，360威胁情报中心监控到的样本文件显示Piriform旗下开发的另外一款磁盘碎片整理工具Defraggler的某一个版本也曾被篡改并植入了恶意代码。"}
{"title": "有了人工智能，网络安全就能高枕无忧了吗？", "url": "https://www.freebuf.com/news/155074.html", "time": "2017-11-30", "level": "红色标题", "num_look": 354154, "num_comment": 4, "author": "AngelaY", "tags": ["观点", "资讯"], "text": "不管 AI 多么强大，网络安全也不能仅仅依靠 AI 技术就高枕无忧。AI 不会成为网络安全的银弹，攻防的猫鼠游戏永远不会停歇。"}
{"title": "BUF 早餐铺 | 本月第二次，美国陆军“智库”最高机密文件公开在AWS S3上；新的Mirai僵尸网络攻击阿根廷的ZyXEL设备；MacOS重大漏洞：反复按键即可创建root账号", "url": "https://www.freebuf.com/news/155586.html", "time": "2017-11-30", "level": "", "num_look": 173318, "num_comment": 3, "author": "Sphinx", "tags": ["资讯"], "text": "美国陆军“智库”最高机密文件公开在AWS S3上；新的Mirai僵尸网络攻击阿根廷的ZyXEL设备；MacOS重大漏洞：反复按键即可创建root账号。"}
{"title": "FIT 2018大会议题预告（十）：安全AlphaGo离我们有多远？| 全球高峰会", "url": "https://www.freebuf.com/news/155625.html", "time": "2017-11-29", "level": "红色标题", "num_look": 218490, "num_comment": 218490, "author": "FB客服", "tags": ["活动", "资讯"], "text": "未来，究竟是人类统治世界，还是AI机器人统治甚至干掉人类？"}
{"title": "AI 赋能、开放合作、安全探索——小米 IoT 战略走进新阶段（文末有彩蛋）", "url": "https://www.freebuf.com/news/155615.html", "time": "2017-11-29", "level": "红色标题", "num_look": 435604, "num_comment": 5, "author": "AngelaY", "tags": ["活动", "资讯"], "text": "在这样冷热不均的环境中，IoT 的未来发展如何？其安全之路又将如何。在 2017 MIDC 小米 IoT 开发者大会及其分论坛的安全峰会中，我们可能会找到答案。"}
{"title": "快讯 | MacOS重大漏洞：反复按键即可创建root账号", "url": "https://www.freebuf.com/news/155531.html", "time": "2017-11-29", "level": "红色标题", "num_look": 490823, "num_comment": 22, "author": "Sphinx", "tags": ["资讯"], "text": "macOS又被爆出漏洞，最新版本的macOS High Sierra能让用户创建一个空密码的root账号，创建方法非常简单，只需要反复按键。"}
{"title": "OWASP Juice Shop：专用于安全技能训练的OWASP靶场（含演示视频）", "url": "https://www.freebuf.com/sectool/154900.html", "time": "2017-11-29", "level": "", "num_look": 528168, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是OWASP Juice Shop，这是一款包含多种热门安全漏洞的Web应用程序，该应用完全基于JavaScript实现，它涵盖了OWASP Top10中的所有安全漏洞以及很多其他类型的严重漏洞。"}
{"title": "WitAwards 2017“年度技术变革”参评巡礼 | 国民认证科技统一身份解决方案", "url": "https://www.freebuf.com/news/154283.html", "time": "2017-11-29", "level": "红色标题", "num_look": 345306, "num_comment": 345306, "author": "Akane", "tags": ["资讯"], "text": "生物识别技术主要是指通过人类生物特征进行身份认证的一种技术。人类的生物特征通常具有唯一性、可以测量或可自动识别和验证、遗传性或终身不变等特点，因此生物识别认证技术较传统认证技术存在较大的优势。"}
{"title": "手把手教你如何利用Meterpreter渗透Windows系统", "url": "https://www.freebuf.com/sectool/154752.html", "time": "2017-11-29", "level": "", "num_look": 1065115, "num_comment": 11, "author": "Alpha_h4ck", "tags": ["工具"], "text": "我们将跟大家介绍如何使用Meterpreter来收集目标Windows系统中的信息，获取用户凭证，创建我们自己的账号，启用远程桌面，进行屏幕截图，以及获取用户键盘记录等。"}
{"title": "本月第二次，美国陆军“智库”最高机密文件公开在AWS S3上", "url": "https://www.freebuf.com/news/155528.html", "time": "2017-11-29", "level": "红色标题", "num_look": 701708, "num_comment": 6, "author": "Elaine_z", "tags": ["安全管理", "数据安全"], "text": "一周之前 FB 曾经报道过美国国防部意外泄漏全球18亿用户社交信息的新闻，然而后续泄漏信息仍在继续，美国陆军智库 INSCOM 似乎也遭遇了“意外”。"}
{"title": "Golden SAML：针对云应用认证机制的新型攻击技术", "url": "https://www.freebuf.com/articles/web/155323.html", "time": "2017-11-29", "level": "金币+8", "num_look": 204517, "num_comment": 1, "author": "JingleCats", "tags": ["WEB安全"], "text": "以SAML2.0协议作为SSO（单点登录）认证机制的任何服务都受此攻击方法影响，该技术允许黑客创建虚假的企业信息后伪造身份验证，从而窃取云应用资源。"}
{"title": "话题讨论 | 安全从业者在北京月薪多少才有安全感？", "url": "https://www.freebuf.com/fevents/155517.html", "time": "2017-11-29", "level": "红色标题", "num_look": 766448, "num_comment": 58, "author": "Akane", "tags": ["活动"], "text": "2017年11月18日，北京大兴区西红门镇新建二村的一场大火，似乎把这座老城打了个措手不及。两天后，全市展开安全隐患大排查。"}
{"title": "2017移动互联网勒索病毒专项研究报告", "url": "https://www.freebuf.com/articles/paper/154956.html", "time": "2017-11-29", "level": "现金奖励", "num_look": 241250, "num_comment": 1, "author": "琥珀", "tags": ["安全报告"], "text": "国内移动互联网已经成为新的主体，为了预防移动互联网勒索病毒大规模爆发，避免企业、个人遭受损失，同时也为行业监管机构出台政策法规提供移动互联网勒索病毒依据。"}
{"title": "在Linux上使用mojoqq来实现命令行QQ", "url": "https://www.freebuf.com/geek/155190.html", "time": "2017-11-29", "level": "金币+8", "num_look": 889309, "num_comment": 44, "author": "Akira", "tags": ["极客"], "text": "mojoqq是使用Perl语言编写的Smartqq客户端框架，基于Mojolicious，要求Perl版本5.10+，可通过插件提供基于HTTP协议的api接口供其他语言或系统调用。"}
{"title": "伪造安全公司博客钓鱼，攻击Mac又有“新姿势”", "url": "https://www.freebuf.com/news/155028.html", "time": "2017-11-29", "level": "金币+8", "num_look": 213147, "num_comment": 213147, "author": "ang010ela", "tags": ["WEB安全", "资讯"], "text": "安全研究人员@noarfromspace发现OSX.Proton恶意软件的新变种通过一种新的传播方式进行传播，即伪造安全公司Symantec的博客，诱使用户下载恶意软件。"}
{"title": "AI引擎助力揭秘百万地下暗流EvilJS隐匿者家族幕后", "url": "https://www.freebuf.com/articles/network/154966.html", "time": "2017-11-29", "level": "红色标题", "num_look": 443534, "num_comment": 4, "author": "腾讯手机管家", "tags": ["安全报告", "网络安全"], "text": "腾讯反诈骗实验室和移动安全实验室研发新一代的AI引擎TRP，从应用行为，网络行为等维度进行人工智能学习训练，并对检测能力泛化，最终在海量APK文件检出一款新型的流量盗刷应用。"}
{"title": "BUF 早餐铺 | 三名中国人涉嫌入侵三家企业在美遭起诉；Facebook漏洞可以让任何人删除你的照片；McAfee宣布收购云CASB企业Skyhigh Network", "url": "https://www.freebuf.com/news/155431.html", "time": "2017-11-29", "level": "", "num_look": 324063, "num_comment": 324063, "author": "Sphinx", "tags": ["资讯"], "text": "三名中国人涉嫌入侵三家企业在美遭起诉；Facebook漏洞可以让任何人删除你的照片；McAfee宣布收购云CASB企业Skyhigh Network，金额未公开。"}
{"title": "2017 OWASP Top10正式发布", "url": "https://www.freebuf.com/articles/web/155145.html", "time": "2017-11-28", "level": "", "num_look": 704942, "num_comment": 3, "author": "米雪儿", "tags": ["WEB安全"], "text": "日前，非营利性组织开放式Web应用安全项目（OWASP）正式发布了十大最关键的Web应用安全风险。"}
{"title": "亚马逊Key被曝存在安全漏洞，对不起我不会再给你家门钥匙了", "url": "https://www.freebuf.com/news/154808.html", "time": "2017-11-28", "level": "", "num_look": 215020, "num_comment": 2, "author": "米雪儿", "tags": ["资讯"], "text": "本月早些时候，亚马逊公司宣布对其Prime会员发布亚马逊Key。那么这个亚马逊Key究竟是什么呢？简单来说就是一套让亚马逊快递员直接进到你家送货、同时允许你通过网络摄像头监控的服务。"}
{"title": "WitAwards 2017“年度创新产品”参评巡礼 | 观数Hadoop安全防护产品BIG DAF", "url": "https://www.freebuf.com/fevents/154558.html", "time": "2017-11-28", "level": "红色标题", "num_look": 185530, "num_comment": 1, "author": "Elaine_z", "tags": ["活动"], "text": "目前，在 Hadoop 上也还没有出现统一的安全标准。另一方面，对企业而言，在开发大数据系统时安全很容易遭受忽略。"}
{"title": "如何像黑客军团主角那样将文件隐藏在音频中", "url": "https://www.freebuf.com/articles/system/154983.html", "time": "2017-11-28", "level": "", "num_look": 605728, "num_comment": 17, "author": "Covfefe", "tags": ["极客", "系统安全"], "text": "今天可不是来谈电视剧的，我们会讨论剧中使用的技术。随着黑客军团剧情的展开，Elliot对他周围的人（包括他自己）进行入侵和篡改，然后将所发现的信息存储在CD上。他经常会用一些经典乐队名来标注他们。"}
{"title": "快讯 | 安全研究还是黑客入侵？三名中国人涉嫌入侵三家企业在美遭起诉", "url": "https://www.freebuf.com/news/155388.html", "time": "2017-11-28", "level": "红色标题", "num_look": 370216, "num_comment": 8, "author": "Elaine_z", "tags": ["资讯"], "text": "根据一份由美国司法部DOJ披露的文件我们可以看到，当地办公室的官员对三名黑客的入侵行动提起诉讼，他们认为这些黑客在2011年至2017年期间对三家企业实施了攻击行动。"}
{"title": "微店（杭州）招聘安全工程师", "url": "https://www.freebuf.com/jobs/155237.html", "time": "2017-11-28", "level": "", "num_look": 271803, "num_comment": 7, "author": "weidian", "tags": ["安全招聘"], "text": "微店 | 口袋购物公司，于2011年5月成立，是一家致力移动互联网购物领域的公司，于2014年完成了3.5亿美金的C轮融资。"}
{"title": "揭开国外僵尸网络IPK的神秘面纱", "url": "https://www.freebuf.com/vuls/154975.html", "time": "2017-11-28", "level": "", "num_look": 373438, "num_comment": 2, "author": "antiylab", "tags": ["安全报告", "漏洞"], "text": "IPK僵尸家族是自2012年底就开始出现并长期持续活跃在境外的DDoS僵尸网络。"}
{"title": "工控协议 | 西门子S7协议学习分享", "url": "https://www.freebuf.com/articles/ics-articles/154898.html", "time": "2017-11-28", "level": "现金奖励", "num_look": 785025, "num_comment": 3, "author": "gongmo", "tags": ["工控安全"], "text": "由于工控安全的文章较少，所以写一篇工控协议的分析文章，抛砖引玉，欢迎各位大神共同交流，而且西门子的plc在工控行业也算是比较流行的设备了，所以这是一篇关于西门子的s7协议的分析文章。"}
{"title": "关于Intel ME SA-00086 漏洞，你应该知道的更多", "url": "https://www.freebuf.com/news/154925.html", "time": "2017-11-28", "level": "金币+10", "num_look": 534962, "num_comment": 4, "author": "直觉动物", "tags": ["漏洞", "资讯"], "text": "2017年11月20日，Intel官方发布了一则Intel多款固件安全更新公告(编号Intel-SA-00086)。"}
{"title": "危机四伏的Office高危漏洞CVE-2017-11882", "url": "https://www.freebuf.com/news/154968.html", "time": "2017-11-28", "level": "", "num_look": 594725, "num_comment": 4, "author": "腾讯电脑管家", "tags": ["漏洞", "资讯"], "text": "针对Office高危漏洞CVE-2017-11882，腾讯电脑管家第一时间发布预警通告，并对利用其进行攻击的样本进行严密监控，捕获拦截了大量野外攻击样本；"}
{"title": "Buf早餐铺 | Imgur在2014年遭受过黑客入侵及数据泄漏; Cobalt组织在野利用Office的CVE-2017-11882漏洞", "url": "https://www.freebuf.com/news/155278.html", "time": "2017-11-28", "level": "", "num_look": 210195, "num_comment": 210195, "author": "Elaine_z", "tags": ["资讯"], "text": "落叶将埋径，林寒欲刺天。"}
{"title": "FIT 2018大会预告篇（九）：路由器宽带账号密码便携式窃取攻防实验 | Hack Demo", "url": "https://www.freebuf.com/news/154701.html", "time": "2017-11-27", "level": "红色标题", "num_look": 312663, "num_comment": 5, "author": "FB客服", "tags": ["活动", "资讯"], "text": "现在主流的路由器攻击往往针对无线协议或者路由器的Web界面，忽略了另一个关键信息——路由器密码。过去由于攻击成本太高不易实施，这类攻击往往被忽略，但其中的安全隐患却不容小觑。"}
{"title": "CVE-2017-11882漏洞复现和利用", "url": "https://www.freebuf.com/vuls/154978.html", "time": "2017-11-27", "level": "金币+10", "num_look": 860060, "num_comment": 25, "author": "ls_wen", "tags": ["漏洞", "系统安全"], "text": "2017年11月14日微软发布了潜伏17年之久的office远程代码执行漏洞（cve-2017-11882）。该漏洞为office内存破坏漏洞，影响目前流行的office版本。"}
{"title": "强大的开源网络侦查工具：IVRE", "url": "https://www.freebuf.com/sectool/155140.html", "time": "2017-11-27", "level": "金币+10", "num_look": 635336, "num_comment": 9, "author": "Shad0wpf_", "tags": ["工具"], "text": "IVRE(又名DRUNK)是一款开源的网络侦查框架工具，IVRE使用Nmap、Zmap进行主动网络探测、使用Bro、P0f等进行网络流量被动分析，探测结果存入数据库中，方便数据的查询、分类汇总统计。"}
{"title": "WitAwards 2017 “年度安全团队”参评巡礼 | 安恒卫兵实验室：网络安全战场上的守望者", "url": "https://www.freebuf.com/fevents/154959.html", "time": "2017-11-27", "level": "红色标题", "num_look": 202661, "num_comment": 202661, "author": "AngelaY", "tags": ["活动"], "text": "将安全实验室取名为“卫兵”，除了字面寓意的安全守卫之外，这个团队其实还为自己的名称赋予了更多含义。"}
{"title": "美国指责伊朗资助黑客窃取 HBO 电视台未播出美剧的剧本，《权力的游戏》又火一把？", "url": "https://www.freebuf.com/news/155008.html", "time": "2017-11-27", "level": "", "num_look": 217066, "num_comment": 217066, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "美国联邦调查局和美国司法部在昨日对黑客Behzad Mesri正式提出了官方指控。Behzad Mesri是一名伊朗黑客，据说此前入侵HBO并泄露美剧《权力的游戏》剧本的就是他。"}
{"title": "快讯 | 知名图片分享网站Imgur承认2014年曾遭入侵，170万用户信息泄露", "url": "https://www.freebuf.com/news/155244.html", "time": "2017-11-27", "level": "红色标题", "num_look": 169188, "num_comment": 169188, "author": "AngelaY", "tags": ["资讯"], "text": "近日，Imgur 公开承认自家网站在 2014 年被黑，共泄露了约 170 万的用户信息。"}
{"title": "游戏行业的那些安全雷区 | FreeBuf企业安全俱乐部北京站看点回顾（附PPT下载）", "url": "https://www.freebuf.com/fevents/155109.html", "time": "2017-11-27", "level": "", "num_look": 218463, "num_comment": 3, "author": "Sphinx", "tags": ["活动"], "text": "吃鸡外挂为何屡禁不止？游戏公司如何防御DDoS攻击？游戏行业为何频遭攻击，成为俎上之肉？"}
{"title": "海莲花团伙利用MSBuild机制免杀样本分析", "url": "https://www.freebuf.com/articles/system/154947.html", "time": "2017-11-27", "level": "红色标题", "num_look": 447381, "num_comment": 1, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "进入2017年以来，360威胁情报中心监测到的海莲花APT团伙活动一直处于高度活跃状态，近期团伙又被发现在大半年内入侵了大量网站执行水坑式攻击。"}
{"title": "OpenATS续篇：搭建自己的卫星地球站", "url": "https://www.freebuf.com/articles/wireless/153793.html", "time": "2017-11-27", "level": "现金奖励", "num_look": 1556198, "num_comment": 60, "author": "OpenATS", "tags": ["其他", "无线安全"], "text": "现在我想继续抛砖引玉，用OpenATS来做一个属于自己的卫星地球站。"}
{"title": "Buf早餐铺 | Uber UK也遭受到数据泄漏事件的影响；接近1,500 网站加载的 LiveHelpNow 组件中存在挖矿脚本；Intel ME 问题影响扩大", "url": "https://www.freebuf.com/news/155047.html", "time": "2017-11-27", "level": "", "num_look": 195304, "num_comment": 3, "author": "Elaine_z", "tags": ["资讯"], "text": "新的一周，新的新闻，FreeBuf 依旧陪伴你。"}
{"title": "他山之石 | 渗透测试中的各种子域名枚举技术介绍", "url": "https://www.freebuf.com/articles/web/154809.html", "time": "2017-11-26", "level": "红色标题", "num_look": 468113, "num_comment": 5, "author": "clouds", "tags": ["WEB安全"], "text": "作为渗透测试人员或漏洞挖掘者，很多时候，当开始一个安全评估项目时，提供给我们的总是一个或一组域名。这样一来，我们就得开展大量前期侦查手段，去发现一些有用的资产信息，如服务器、Web应用、目标组织使用的其…"}
{"title": "兄弟牌网络打印机被曝存在远程DoS漏洞（附PoC）", "url": "https://www.freebuf.com/news/154684.html", "time": "2017-11-26", "level": "", "num_look": 285501, "num_comment": 285501, "author": "clouds", "tags": ["资讯"], "text": "Trustwave实验室发现兄弟牌（Brother）网络打印机存在漏洞，攻击者只需向目标打印机发送一个简单的HTTP POST畸形请求，就可对目标打印机形成远程DoS攻击。"}
{"title": "安卓漏洞导致攻击者可记录音频或屏幕", "url": "https://www.freebuf.com/articles/terminal/154556.html", "time": "2017-11-26", "level": "", "num_look": 373507, "num_comment": 373507, "author": "米雪儿", "tags": ["系统安全", "终端安全"], "text": "由于Android媒体播放功能存在漏洞，致使运行Lolipop，Marshmallow以及Nougat的Android智能手机很容易受到影响，从而导致用户手机屏幕被外人盗录而不自知。"}
{"title": "看我如何利用OSINT技术黑掉加密货币挖矿工具", "url": "https://www.freebuf.com/articles/system/154424.html", "time": "2017-11-26", "level": "", "num_look": 520000, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "在实施攻击之前，公开资源情报计划（OSINT）是我们收集信息的首选技术。在此之前，也有很多使用OSINT实现攻击的事例。"}
{"title": "MacWiFi：一款管理Mac系统WIFI的命令行工具（包含交互式Shell）", "url": "https://www.freebuf.com/sectool/154758.html", "time": "2017-11-25", "level": "", "num_look": 349665, "num_comment": 349665, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫mac-wifi的命令行工具，它可以管理macOS系统的无线网络，并且还提供了交互式Shell。"}
{"title": "Metasploit自动化Bypass Av脚本：Shecodject X Shellcode Injection", "url": "https://www.freebuf.com/sectool/154356.html", "time": "2017-11-25", "level": "金币+8", "num_look": 333275, "num_comment": 5, "author": "淼淼兮与怀", "tags": ["工具"], "text": "shecoject 是一个由 python3 编写的工具，可将特制 metasploit 生成的 raw 文件直接使用 pyinstaller 封装或是你也可使用本工具生成普通的raw文件再进行封装。"}
{"title": "FIT 2018大会预告片（七）：安全事件响应新突破 | 全球高峰会", "url": "https://www.freebuf.com/news/153563.html", "time": "2017-11-25", "level": "", "num_look": 198022, "num_comment": 198022, "author": "FB客服", "tags": ["活动", "资讯"], "text": "安全威胁在变得多样化的同时，安全事件的响应也对企业提高了要求。一家企业在遭遇安全事件之后，很多响应计划依然没有获得应有的重视。不少企业遭遇事件之后，会出现不了解情况、响应过慢等各种情况。"}
{"title": "如何绕过现代Process Hollowing检测机制", "url": "https://www.freebuf.com/articles/system/154421.html", "time": "2017-11-25", "level": "", "num_look": 382603, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": ""}
{"title": "谷歌称对于用户来说，网络钓鱼比键击记录器和密码复用更具威胁", "url": "https://www.freebuf.com/news/154404.html", "time": "2017-11-25", "level": "", "num_look": 179729, "num_comment": 179729, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "近期，Google与加州大学伯克利分校国际计算机科学研究院的研究人员联合主导了一项针对网络安全威胁的研究。"}
{"title": "安全威胁早期预警 | 新的Mirai僵尸网络变种正在端口23和2323上积极传播", "url": "https://www.freebuf.com/articles/network/155105.html", "time": "2017-11-24", "level": "红色标题", "num_look": 600386, "num_comment": 3, "author": "360安全", "tags": ["网络安全"], "text": "大约60个小时以前，从2017-11-2211:00开始，360网络安全研究院注意到在端口2323和23上的扫描流量有一个暴涨现象。"}
{"title": "苹果发布安全更新！现已修复macOS中的USB代码执行漏洞", "url": "https://www.freebuf.com/news/155012.html", "time": "2017-11-24", "level": "", "num_look": 222991, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["漏洞", "资讯"], "text": "苹果在其最新发布的macOS安全更新补丁中修复了一个任意代码执行漏洞，而这个漏洞将允许攻击者通过恶意USB设备来攻击macOS系统。"}
{"title": "Google Chrome安全新机制：阻止非预期的重定向", "url": "https://www.freebuf.com/news/153932.html", "time": "2017-11-24", "level": "", "num_look": 256797, "num_comment": 2, "author": "Covfefe", "tags": ["资讯"], "text": "众所周知，Google一直致力于改善其产品与服务，最近的一次是Google Chrome的更新，这次更新添加了防止用户被重定向到非预期页面的机制，从而防止用户看到不需要的内容。"}
{"title": "利用雅虎小型企业服务平台的目录遍历漏洞查看客户的信用卡信息", "url": "https://www.freebuf.com/articles/web/154222.html", "time": "2017-11-24", "level": "红色标题", "num_look": 298337, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["WEB安全", "其他"], "text": "在这篇文章中，我将跟大家介绍如何利用雅虎小型企业服务平台的目录遍历漏洞查看客户的信用卡信息。"}
{"title": "重庆无声信息招聘渗透测试工程师", "url": "https://www.freebuf.com/jobs/154650.html", "time": "2017-11-24", "level": "", "num_look": 419116, "num_comment": 50, "author": "Kiderroot", "tags": ["安全招聘"], "text": "无声信息成立于2000年，现有员工三百余名。十七年来专注于信息安全领域的产品研发和服务。"}
{"title": "快讯丨惠普企业打印机被曝含多种安全漏洞", "url": "https://www.freebuf.com/news/154965.html", "time": "2017-11-24", "level": "红色标题", "num_look": 297282, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "研究人员在某些型号的惠普企业打印机中发现了多个严重的安全漏洞（包括远程代码执行漏洞），厂商表示已经在着手开发相应的漏洞补丁，客户在本周即可获取到相应的更新补丁。"}
{"title": "著名开源网络取证工具Xplico远程未授权RCE漏洞", "url": "https://www.freebuf.com/sectool/154523.html", "time": "2017-11-24", "level": "", "num_look": 371257, "num_comment": 2, "author": "clouds", "tags": ["工具"], "text": "著名Linux开源网络取证工具Xplico可以捕获Internet网络应用层流量，通过流量解析，解析出网络包中的各种应用数据。"}
{"title": "基于统计学的Hashcat密码生成规则：Hob0Rules", "url": "https://www.freebuf.com/sectool/154586.html", "time": "2017-11-24", "level": "现金奖励", "num_look": 461032, "num_comment": 4, "author": "Shad0wpf_", "tags": ["工具"], "text": ""}
{"title": "Android Media Projection服务漏洞深度剖析", "url": "https://www.freebuf.com/articles/terminal/154704.html", "time": "2017-11-24", "level": "金币+12", "num_look": 273556, "num_comment": 273556, "author": "ang010ela", "tags": ["终端安全"], "text": "Android MediaProjection服务被滥用，攻击者可以录音、获取屏幕内容。影响Android5.0之后8.0以前的所有版本，google回应已在8.0版本对漏洞进行了修复。"}
{"title": "BUF早餐铺 | 超过400个流行站点记录用户的键击和鼠标移动情况；qkG 勒索软件加密 word 文件，利用宏传播", "url": "https://www.freebuf.com/news/154979.html", "time": "2017-11-24", "level": "", "num_look": 181934, "num_comment": 181934, "author": "Sphinx", "tags": ["资讯"], "text": "超过400个流行站点记录用户的键击和鼠标移动情况；qkG 勒索软件针对 word 文件加密，利用宏传播；Firefox新机制：用户浏览泄漏数据的站点时会出现提示。"}
{"title": "FIT 2018大会预告（八）：Web安全从入门到放弃 | 白帽LIVE", "url": "https://www.freebuf.com/news/154974.html", "time": "2017-11-23", "level": "红色标题", "num_look": 232134, "num_comment": 3, "author": "FB客服", "tags": ["活动", "资讯"], "text": "有趣有料的顶尖白帽，用每一枚漏洞，每一行代码，每一段神奇经历，将创新思维当做「信仰」去践行。最好的第一视角，就是坐在白帽对面，真正地听他们聊上一会。在这里，遇见这群人，成为这群人。"}
{"title": "卡巴斯基赶在“黑五”前的网络钓鱼分析报告", "url": "https://www.freebuf.com/articles/paper/154958.html", "time": "2017-11-23", "level": "红色标题", "num_look": 509607, "num_comment": 2, "author": "Carrie_spinfo", "tags": ["安全报告"], "text": "国内有双11、双12购物节，国外有11月下旬的感恩节、黑色星期五、Cyber Monday和12月份的圣诞节等购物狂欢日，这些节日特别是为美国、欧洲、亚太地区零售商们带来了巨额利润。"}
{"title": "腾讯反病毒实验室预警：CVE-2017-11882漏洞最新利用方法", "url": "https://www.freebuf.com/vuls/154913.html", "time": "2017-11-23", "level": "", "num_look": 423020, "num_comment": 10, "author": "腾讯电脑管家", "tags": ["漏洞"], "text": "腾讯反病毒实验室发现了针对CVE-2017-11882漏洞的最新利用方法，可以将可执行程序直接嵌入到钓鱼文档中，运行文档时会直接运行嵌入到文档中的恶意exe文件。"}
{"title": "深入分析 | 恶意软件如何使用合法工具隐藏恶意代码", "url": "https://www.freebuf.com/articles/system/154451.html", "time": "2017-11-23", "level": "", "num_look": 398400, "num_comment": 398400, "author": "Covfefe", "tags": ["系统安全"], "text": "恶意软件的作者通常会使用各种技术来规避防护机制，隐藏有害活动。其中有一种技术就是在可信进程中隐藏恶意代码。"}
{"title": "WitAwards 2017“年度品牌影响力”参评巡礼 | 卡巴斯基反针对性攻击平台产品解读", "url": "https://www.freebuf.com/news/154251.html", "time": "2017-11-23", "level": "红色标题", "num_look": 203021, "num_comment": 203021, "author": "Sphinx", "tags": ["活动", "资讯"], "text": "2017年对全球网络安全行业带了了巨大的冲击，WannaCry、NotPetya颠覆了人们的安全观，同样具备颠覆性的还有不断增加的针对性攻击。"}
{"title": "如何绕过Android网络安全配置", "url": "https://www.freebuf.com/articles/system/154420.html", "time": "2017-11-23", "level": "", "num_look": 353377, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "Android Nougat（Android 7）引入了一种名叫网络安全配置（Network Security Configuration）的新型安全功能。"}
{"title": "2017安卓应用第三方SDK威胁概况", "url": "https://www.freebuf.com/articles/paper/154703.html", "time": "2017-11-23", "level": "红色标题", "num_look": 255099, "num_comment": 1, "author": "360安全", "tags": ["安全报告"], "text": "美国媒体机构Zenith发布的最新研究报告预测，在2018年，全球智能手机用户数量将会继续增长。其中，中国智能手机用户数量将位居全球第一，达到 13亿。"}
{"title": "未来趋势 | 自学习网络或许会在2018年替代传统的僵尸网络", "url": "https://www.freebuf.com/news/154629.html", "time": "2017-11-23", "level": "", "num_look": 197098, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "在本周举办于法国尼斯的供应商国际媒体会议上，Fortinet的全球安全战略负责人Derek Manky表示，自学习网络（例如由Hivenet驱动的Swarmbot-一种智能集群网络）在2018年将会成为一种新的威胁趋势。"}
{"title": "Linux下一种rootkit的分析和检测", "url": "https://www.freebuf.com/articles/system/154039.html", "time": "2017-11-23", "level": "现金奖励", "num_look": 459219, "num_comment": 13, "author": "linken", "tags": ["系统安全"], "text": "前段时间在github上看到了一个开源的rootkit源码，代码量比较少，OS适配也比较容易。将分析的笔记整理成一篇小文，分享出来。水平有限，难免有疏漏和错误，敬请指教。"}
{"title": "BUF 早餐铺 | Uber 收买黑客以掩盖信息泄露事件；谷歌在安卓位置服务关闭的情况下收集位置信息；OWASP Top 10 更新", "url": "https://www.freebuf.com/news/154890.html", "time": "2017-11-23", "level": "", "num_look": 230381, "num_comment": 3, "author": "AngelaY", "tags": ["资讯"], "text": "美国指控伊朗黑客入侵 HBO；虚拟货币钱包Tether近 3100 万美元加密货币失窃；惠普企业打印机出现严重远程代码执行漏洞；IoT 设备不安全导致 2017 上半年 DDoS 攻击倍增"}
{"title": "验证码平台哪家强，六大验证码使用评测", "url": "https://www.freebuf.com/news/153983.html", "time": "2017-11-23", "level": "金币+8", "num_look": 482080, "num_comment": 3, "author": "blackhole666", "tags": ["资讯"], "text": "人工智能的发展让黑灰产也从中获益，传统的基于识别和知识的验证码在具有人工智能的机器面前已不能起到很好的防护作用了，新一代的验证码应运而生。"}
{"title": "【已结束】如何利用「人工智能技术」打造与业务紧密结合的安全 | AI安全嘉年华·公开课", "url": "https://www.freebuf.com/news/154231.html", "time": "2017-11-22", "level": "红色标题", "num_look": 872853, "num_comment": 1, "author": "FB客服", "tags": ["活动", "资讯"], "text": "11月22日（周三）晚20:00，第三节AI安全公开课准点来袭！"}
{"title": "敲黑板 | 一分钟读懂 WitAwards 评选规则", "url": "https://www.freebuf.com/news/154830.html", "time": "2017-11-22", "level": "", "num_look": 205435, "num_comment": 205435, "author": "FB客服", "tags": ["资讯"], "text": "WitAwards评选已举办三届，一直以来，都以最专业的角度和最公正的态度，发掘优秀行业案例，树立年度标杆。为此，我们在评选规则设定、环节设置、评委邀请等各方面都做出了大量研究和努力。"}
{"title": "打开文档变肉鸡：潜伏17年的“噩梦公式”Office漏洞攻击分析", "url": "https://www.freebuf.com/vuls/154858.html", "time": "2017-11-22", "level": "红色标题", "num_look": 580458, "num_comment": 19, "author": "360安全", "tags": ["漏洞"], "text": "微软的11月份的安全补丁包含了一个隐藏17年之久的Office远程代码执行漏洞（CVE-2017-11882），该漏洞影响目前所有流行的Office软件。"}
{"title": "借助树莓派模拟Wimonitor并实现WiFi窃听和嗅探", "url": "https://www.freebuf.com/articles/wireless/154427.html", "time": "2017-11-22", "level": "", "num_look": 760469, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["无线安全"], "text": "Wimonitor是一款非常优秀的黑客工具，它不仅可以帮渗透测试人员省去配置虚拟机和无线网卡等一系列麻烦事，而且它的Web接口配置起来也非常的方便。"}
{"title": "纸包得住火吗？向黑客支付10万美元“封口费”的Uber与5700万用户的泄漏信息", "url": "https://www.freebuf.com/news/154790.html", "time": "2017-11-22", "level": "红色标题", "num_look": 513396, "num_comment": 5, "author": "Elaine_z", "tags": ["企业安全", "数据安全"], "text": "这次Uber 所卷入的事件，不仅仅是一场涉及 5,700 万用户隐私信息的黑客入侵事件，还可能是一次企业违背信息披露的原则、向黑客支付赎金、掩盖事实的事件。"}
{"title": "Android勒索软件黑产研究：恶意软件一键生成器", "url": "https://www.freebuf.com/articles/paper/154079.html", "time": "2017-11-22", "level": "", "num_look": 250403, "num_comment": 5, "author": "360安全", "tags": ["安全报告"], "text": "2017年1月至9月，360烽火实验室共捕获手机勒索恶意软件50万余个，平均每月捕获手机勒索软件5.5万余个。语音识别、二维码和文件加密等新型勒索软件不断涌现。"}
{"title": "易宝支付招聘安全工程师", "url": "https://www.freebuf.com/jobs/154267.html", "time": "2017-11-22", "level": "", "num_look": 187782, "num_comment": 9, "author": "plane636", "tags": ["安全招聘"], "text": "自公司成立以来，易宝秉承诚信、尽责、激情、创新、分享的核心价值观，以交易服务改变生活为使命，致力成为世界一流的交易服务平台。"}
{"title": "英特尔承认其 ME、SPS、TXE等固件中存在漏洞", "url": "https://www.freebuf.com/news/154737.html", "time": "2017-11-22", "level": "", "num_look": 498043, "num_comment": 2, "author": "Sphinx", "tags": ["系统安全", "资讯"], "text": "英特尔今天承认旗下管理引擎(ME)、服务器平台服务(SPS)和信任执行引擎(TXE)存在多个安全漏洞。"}
{"title": "iPhone锁屏却锁不住个人信息，iOS安全性真的很高吗？", "url": "https://www.freebuf.com/vuls/153848.html", "time": "2017-11-22", "level": "现金奖励", "num_look": 432818, "num_comment": 12, "author": "网络安全通", "tags": ["漏洞", "终端安全"], "text": "听说你iOS安全性高？网络安全通成员用实验来发现你的漏洞。"}
{"title": "关于后渗透利器Koadic的思考", "url": "https://www.freebuf.com/articles/system/154256.html", "time": "2017-11-22", "level": "金币+8", "num_look": 350001, "num_comment": 4, "author": "Ha1g0", "tags": ["系统安全"], "text": "本着分享即学习的原则，我就把我最近玩koadic的新的想法写成一篇文章，如果文章有任何不准确的地方，请各位大佬斧正。"}
{"title": "深度分析 | Linux内核漏洞可能导致特权升级（CVE-2017-1000112）", "url": "https://www.freebuf.com/vuls/154300.html", "time": "2017-11-22", "level": "", "num_look": 481331, "num_comment": 3, "author": "淼淼兮与怀", "tags": ["漏洞", "系统安全"], "text": "Linux内核中的UDP碎片卸载(UFO)代码中的内存损坏问题可能导致本地特权的升级。在这篇文章中，我们将研究这个漏洞及其附带的漏洞。"}
{"title": "五角大楼AWS S3配置错误，意外在线暴露包含全球18亿用户的社交信息", "url": "https://www.freebuf.com/news/154528.html", "time": "2017-11-22", "level": "", "num_look": 335560, "num_comment": 2, "author": "米雪儿", "tags": ["资讯"], "text": "据外媒报道称，五角大楼意外地暴露了美国国防部（United States Department of Defense ，简称DoD）的分类数据库，其中包含美国当局在全球社交媒体平台中收集到的18亿用户的个人信息"}
{"title": "BUF早餐铺 | Wp-Vcd WordPress 恶意软件活动正在复苏；Terdot 银行木马威胁日益复杂；SSL证书提供商StartCom将在2020年结束业务", "url": "https://www.freebuf.com/news/154635.html", "time": "2017-11-22", "level": "", "num_look": 158182, "num_comment": 2, "author": "Elaine_z", "tags": ["资讯"], "text": "吃 FreeBuf 暖心早餐，完全不怕冷。"}
{"title": "「网络·全智慧 安全·新变革」FIT 中国首席信息安全官高峰论坛参会报名", "url": "https://www.freebuf.com/news/topnews/154665.html", "time": "2017-11-21", "level": "", "num_look": 163031, "num_comment": 163031, "author": "FB客服", "tags": ["头条", "活动"], "text": "2017年中国首席信息安全官高峰论坛以「网络·全智慧 安全·新变革」为主题，聚焦智慧网络、人工智能、网络安全法等热点话题，深入探讨企业信息安全技术与实践应用。"}
{"title": "不想感染银行木马Emotet？其实只需要创建三个空文件", "url": "https://www.freebuf.com/articles/system/154364.html", "time": "2017-11-21", "level": "", "num_look": 280432, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "Emotet是一款臭名昭著的银行木马，它不仅可以窃取银行信息和邮箱账号，而且还可以自动从目标用户的银行账号中窃取金钱。"}
{"title": "FIT 2018大会预告片（六）：深度学习的安全应用及隐患 | 产业创新俱乐部", "url": "https://www.freebuf.com/news/154538.html", "time": "2017-11-21", "level": "红色标题", "num_look": 174004, "num_comment": 1, "author": "FB客服", "tags": ["活动", "资讯"], "text": "目前公众对人工智能的关注，尤其是深度学习方面，缺少对安全的考虑。在推进人工智能应用的同时，我们迫切需要关注并解决这些安全问题。"}
{"title": "WitAwards 2017“年度技术变革”参评巡礼 | 浅析瑞数信息机器人防火墙", "url": "https://www.freebuf.com/fevents/153698.html", "time": "2017-11-21", "level": "红色标题", "num_look": 188790, "num_comment": 1, "author": "Akane", "tags": ["活动"], "text": "瑞数信息机器人防火墙Botgate以“动态安全防护”技术为核心，通过对服务器网页底层代码的持续动态变换，增加服务器行为的不可预测性。"}
{"title": "美方发布朝鲜Lazarus团伙黑客工具分析报告", "url": "https://www.freebuf.com/sectool/154259.html", "time": "2017-11-21", "level": "红色标题", "num_look": 500544, "num_comment": 2, "author": "Threatbook", "tags": ["安全报告", "工具"], "text": "2017年11月14日，美国计算机安全应急响应小组（US-CERT）发布了“Hidden Cobra”团伙（即Lazarus）常用工具FALLCHILL、Volgmer的分析报告，指出该团伙具有朝鲜政府背景。"}
{"title": "商业软件暗藏后门病毒，疯狂扒取阿里、微信上的注册企业信息", "url": "https://www.freebuf.com/news/154065.html", "time": "2017-11-21", "level": "", "num_look": 272316, "num_comment": 5, "author": "火绒安全", "tags": ["WEB安全", "资讯"], "text": "近日，火绒安全团队发现某商业企业旗下的多款软件携带后门病毒\"Backdoor/Jspider\"。该病毒会将被感染电脑当作\"肉鸡\"，用来扒取阿里巴巴、微信等平台上的企业相关信息"}
{"title": "AKULAKU招聘信息安全应用安全工程师", "url": "https://www.freebuf.com/jobs/153770.html", "time": "2017-11-21", "level": "", "num_look": 141313, "num_comment": 3, "author": "CeciliaMak♡", "tags": ["安全招聘"], "text": "岩心科技是一家创业公司。公司目前正运营一款基于移动购物场景的虚拟信用卡AKULAKU，已成为区域内第一家、规模最大、团队最成熟和发展速度最快的APP。"}
{"title": "卡巴斯基自证清白之路：安全领域将要“巴尔干化”了吗？", "url": "https://www.freebuf.com/news/154340.html", "time": "2017-11-21", "level": "", "num_look": 261133, "num_comment": 3, "author": "AngelaY", "tags": ["观点", "资讯"], "text": "自 7 月份美国总务管理局将卡巴斯基实验室及其旗下的安全公司从供应商名单中删除以来，卡巴斯基就开始了漫长的自证清白之路。"}
{"title": "揭秘微信分享背后的套路", "url": "https://www.freebuf.com/articles/web/153710.html", "time": "2017-11-21", "level": "现金奖励", "num_look": 659469, "num_comment": 16, "author": "网络安全通", "tags": ["WEB安全"], "text": "今早收到一个朋友分享的大润发二十周年庆海报，好奇心驱使我点了进去……"}
{"title": "WordPress(4.8.2及以下版本) SQL注入漏洞利用", "url": "https://www.freebuf.com/vuls/153959.html", "time": "2017-11-21", "level": "现金奖励", "num_look": 839943, "num_comment": 10, "author": "Ambulong", "tags": ["漏洞"], "text": "看过WordPress的SQL注入漏洞分析的同学应该可以发现该漏洞的利用除了需要编辑权限之外，还有一个关键步骤，需要将Payload作为_thumbnail_id的metavalue写入数据库。"}
{"title": "WikiLeaks公开资料解读系列之CIA Hive项目", "url": "https://www.freebuf.com/news/154182.html", "time": "2017-11-21", "level": "", "num_look": 383988, "num_comment": 3, "author": "奇安信威胁情报中心", "tags": ["网络安全", "资讯"], "text": "2017年11月9日WikiLeaks 开始公布Vault8系列资料，其中包括一个名为HIVE的CIA后门系统项目，输出了项目各版本的部分源代码，这是WikiLeaks公布CIA相关资料的历史上少见的包含源码的数据。"}
{"title": "BUF早餐铺 | AWS S3 配置错误导致美军秘密监控资料泄露；Amazon Key存在安全问题，可被攻击者关闭用户摄像头；大量安卓手机可被截屏和窃听", "url": "https://www.freebuf.com/news/154565.html", "time": "2017-11-21", "level": "", "num_look": 212404, "num_comment": 212404, "author": "Sphinx", "tags": ["资讯"], "text": "AWS S3 配置错误导致美军秘密监控资料泄露，社交媒体相关内容高达 TB 级；大量安卓手机存在漏洞，可被截屏和窃听；StartCom将宣布将停止数字证书业务。"}
{"title": "开源密码破解及分析工具Hashview", "url": "https://www.freebuf.com/articles/database/153628.html", "time": "2017-11-20", "level": "现金奖励", "num_look": 731777, "num_comment": 5, "author": "Shad0wpf_", "tags": ["数据安全"], "text": "Hashview是一款开源的密码破解及分析工具，其密码破解功能基于世界上最快的密码破解软件——hashcat。Hashview可以通过Web界面方便的进行密码破解任务建立、进度查询，密码破解后存储于数据库中，系统对破解出来的密…"}
{"title": "浅析重定向与反弹Shell命令", "url": "https://www.freebuf.com/articles/system/153986.html", "time": "2017-11-20", "level": "现金奖励", "num_look": 830091, "num_comment": 15, "author": "shadow4u", "tags": ["系统安全"], "text": "反弹shell在漏洞证明和利用的过程中都是一个直接有力的手段。由于安全工作或者学习的需要，我们或多或少都会接触到各种反弹shell的命令，于是就有了这个能稍微帮助初学者理解的文档"}
{"title": "隐藏17年的Office远程代码执行漏洞POC样本分析（CVE-2017-11882）", "url": "https://www.freebuf.com/vuls/154462.html", "time": "2017-11-20", "level": "", "num_look": 998864, "num_comment": 21, "author": "金睛", "tags": ["安全报告", "漏洞"], "text": "2017年11月14日，微软发布了11月份的安全补丁更新，其中比较引人关注的莫过于悄然修复了潜伏17年之久的Office远程代码执行漏洞（CVE-2017-11882）。"}
{"title": "美国US-CERT发布朝鲜黑客组织HIDDEN COBRA网络攻击架构中涉及中国IP地址", "url": "https://www.freebuf.com/news/154153.html", "time": "2017-11-20", "level": "", "num_look": 223321, "num_comment": 7, "author": "clouds", "tags": ["资讯"], "text": "美国计算机应急响应中心叕发布了DHS和FBI针对朝鲜政府黑客组织HIDDEN COBRA的联合技术分析预警，详细披露了用于网络渗透攻击的远控工具-FALLCHILL。"}
{"title": "挖洞经验 | 从PHP对象实例化到Blind XXE", "url": "https://www.freebuf.com/vuls/154415.html", "time": "2017-11-20", "level": "", "num_look": 384256, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["WEB安全", "漏洞"], "text": "Shopware是当前一款热门的电子商务软件，它基于PHP开发，并且还使用了类似Symfony 2、Doctrine以及Zend框架等多项技术。"}
{"title": "中交兴路信息科技招聘信息安全工程师", "url": "https://www.freebuf.com/jobs/153859.html", "time": "2017-11-20", "level": "", "num_look": 172793, "num_comment": 11, "author": "Sophone", "tags": ["安全招聘"], "text": "北京中交兴路车联网科技有限公司（简称“中交兴路车联网”）是一家专注于商用车车联网领域的车联网运营和服务商，致力为中国1400万辆营运货车及其背后4000万司机与车主提供工作和生活的全方位服务。"}
{"title": "「FB招聘站」来袭，你准备好简历了吗", "url": "https://www.freebuf.com/jobs/154377.html", "time": "2017-11-20", "level": "红色标题", "num_look": 328667, "num_comment": 8, "author": "FB客服", "tags": ["安全招聘"], "text": "秋招、校招，且来看看FreeBuf“年末大招”—— 「FB招聘」Beta公测版火爆上线啦！"}
{"title": "微软Office曝存在17年之久的“全版本影响”老洞，无需用户交互实现恶意程序远程植入", "url": "https://www.freebuf.com/vuls/154298.html", "time": "2017-11-20", "level": "", "num_look": 481490, "num_comment": 3, "author": "clouds", "tags": ["漏洞", "系统安全"], "text": "研究人员又发现了Office的另一个严重漏洞，攻击者可以利用该漏洞，无需受害者用户交互，远程向目标系统植入恶意软件。"}
{"title": "安全科普 | 从CTF中初认识RSA", "url": "https://www.freebuf.com/news/154183.html", "time": "2017-11-20", "level": "金币+12", "num_look": 415938, "num_comment": 6, "author": "淼淼兮与怀", "tags": [], "text": "在我们在做CTF的密码学解题时，我们经常能发现，题型无非就是对称密码、不对称密码这些老生常谈的考点，RSA更是出题人最喜欢的知识点。那么什么是RSA，让我们用浅显的语言和题目来初步认识吧！"}
{"title": "2017 MIAC移动安全赛第三场WEB300 PokeMongo", "url": "https://www.freebuf.com/articles/others-articles/153798.html", "time": "2017-11-20", "level": "金币+12", "num_look": 200820, "num_comment": 2, "author": "小石", "tags": ["其他"], "text": "WEB300 PokeMongo 这题主要考察的就是NoSQL的注入，附加上Bypass。"}
{"title": "特别企划 | 漏洞、假冒、劫持，Google应用市场为何事故频发？", "url": "https://www.freebuf.com/articles/terminal/153730.html", "time": "2017-11-20", "level": "红色标题", "num_look": 406321, "num_comment": 4, "author": "Sphinx", "tags": ["终端安全"], "text": "Google Play Store到底怎么了？"}
{"title": "BUF早餐铺 | 卡巴斯基公布NSA数据被盗事件的调查细节；马来警方找到之前大型数据泄露事件的幕后黑手", "url": "https://www.freebuf.com/news/154338.html", "time": "2017-11-20", "level": "", "num_look": 199542, "num_comment": 199542, "author": "Sphinx", "tags": ["资讯"], "text": "卡巴斯基公布NSA数据被盗事件的调查细节；马来警方找到大型数据泄露事件的幕后黑手；大疆网站私钥公开长达四年；又一款病毒成功绕过Google Play的检测。"}
{"title": "Palo Alto Networks：新型恶意软件家族Reaver与SunOrcal存在一定联系", "url": "https://www.freebuf.com/articles/system/154198.html", "time": "2017-11-19", "level": "", "num_look": 352409, "num_comment": 352409, "author": "米雪儿", "tags": ["系统安全", "网络安全"], "text": "Unit 42安全小组已经发现了一种新的恶意软件家族，并将其命名为“Reaver”。研究人员表示，这一新型恶意软件与在2016年针对中国台湾地区的黑客攻击活动中所使用的恶意软件SunOrcal存在一定的联系。"}
{"title": "观点 | 虽然Devops 可以提升效率，但也增加了IT攻击面", "url": "https://www.freebuf.com/news/153792.html", "time": "2017-11-19", "level": "", "num_look": 401534, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["企业安全", "观点"], "text": "我们不禁想问：“安全”跟“效率”到底谁更重要？"}
{"title": "震惊 | 美国国土安全部DHS竟黑掉了一架波音757", "url": "https://www.freebuf.com/news/154422.html", "time": "2017-11-19", "level": "红色标题", "num_look": 273173, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "当时的攻击场景中，这架波音757飞机上坐有飞行员，而研究人员则尝试在飞行员毫不知情的情况下对飞机实施入侵攻击。"}
{"title": "Masscan及Nmap实现对阿里云ECS的外网端口监控", "url": "https://www.freebuf.com/sectool/153156.html", "time": "2017-11-19", "level": "现金奖励", "num_look": 1041195, "num_comment": 24, "author": "yuegui_2004", "tags": ["工具", "网络安全"], "text": "如何解决大网段全端口扫描的场景呢？此时就需要用到Masscan，一个大网段全端口扫描神器。首先我们简单熟悉一下这款扫描神器。"}
{"title": "木马开启智能识别？深度解析新型变形恶意软件LokiBot", "url": "https://www.freebuf.com/articles/web/153469.html", "time": "2017-11-19", "level": "", "num_look": 273231, "num_comment": 273231, "author": "阿里聚安全", "tags": ["WEB安全"], "text": "近期，Client-SideDetection披露“LokiBot”木马，其前身是由“BankBot”演变而来。与其他银行劫持木马相比“LokiBot”具备其独特功能，可以根据不同目标环境发起相应攻击。"}
{"title": "黑产攻击途径升级，云服务成重灾区", "url": "https://www.freebuf.com/articles/network/153982.html", "time": "2017-11-18", "level": "", "num_look": 519993, "num_comment": 4, "author": "腾讯电脑管家", "tags": ["网络安全"], "text": "国内云服务中Gh0st远控新样本出现爆发式增长：使用大量低配置云服务器进行样本生成和分发；并被黑客利用漏洞进行渗透和传播病毒。"}
{"title": "维基解密：CIA竟然假扮卡巴斯基实验室来窃取目标数据？", "url": "https://www.freebuf.com/news/153804.html", "time": "2017-11-18", "level": "", "num_look": 188683, "num_comment": 188683, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "近期，维基解密恢复了他们之前针对CIA机密文件的“泄露任务”。现在，维基解密已开始对外公布CIA所开发的工具源代码以及其他相关文件。"}
{"title": "一加手机系统预装APP被曝存在后门", "url": "https://www.freebuf.com/news/154339.html", "time": "2017-11-17", "level": "", "num_look": 385637, "num_comment": 15, "author": "Alpha_h4ck", "tags": ["终端安全", "资讯"], "text": "某些一加手机的系统预装应用EngineerMode中存在后门，而他人或可利用这款应用来对手机进行root。"}
{"title": "物联网安全研究之二：IoT系统攻击面定义分析", "url": "https://www.freebuf.com/geek/154059.html", "time": "2017-11-17", "level": "红色标题", "num_look": 459309, "num_comment": 3, "author": "clouds", "tags": ["极客"], "text": "本文我将来说说IoT安全，在此过程中，我们会尝试定义一种新方法来理解IoT安全，同时也会创建一个结构化流程来方便认知IoT相关的攻击研究和渗透测试。"}
{"title": "IBM X-Force发现新型银行木马IcedID", "url": "https://www.freebuf.com/news/154179.html", "time": "2017-11-17", "level": "", "num_look": 187389, "num_comment": 1, "author": "米雪儿", "tags": ["资讯"], "text": "近日，IBM X-Force研究团队在一项针对最近一系列攻击美国金融机构的案例中发现了一款新型银行木马，并将其命名为“IcedID”，该银行木马目前似乎还正处于开发的初始阶段。"}
{"title": "通过CHM文件传播的Torchwood远控木马分析", "url": "https://www.freebuf.com/articles/system/153850.html", "time": "2017-11-17", "level": "红色标题", "num_look": 382869, "num_comment": 7, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "双十一网购期间，腾讯反病毒实验室拦截到大量的恶意CHM格式文件，该批CHM文件伪装成“商户注册资料”、“最新风控通知”，通过聊天工具，瞄准电商发动定向钓鱼攻击。"}
{"title": "全球能源互联网研究院诚招安全渗透工程师", "url": "https://www.freebuf.com/jobs/153278.html", "time": "2017-11-17", "level": "红色标题", "num_look": 443422, "num_comment": 45, "author": "sysadmin6666", "tags": ["安全招聘"], "text": "全球能源互联网研究院（以下简称“联研院”）是国家电网公司直属科研单位，国内首家专业从事全球能源互联网关键技术和设备开发的高端研发机构。"}
{"title": "使用恶意软件将隐藏代码注入已知进程的渗透研究", "url": "https://www.freebuf.com/articles/system/153795.html", "time": "2017-11-17", "level": "", "num_look": 250522, "num_comment": 3, "author": "生如夏花", "tags": ["系统安全"], "text": "对于恶意软件编写者来说，隐藏一个进程一直是一个挑战，他们对此发现了很多方法。我现在讲述的这个技巧是非常基本的，虽然写起来很简单，但是却不能一直工作下去。"}
{"title": "安全事件频发，亚马逊为其S3服务添加了新的安全加密功能", "url": "https://www.freebuf.com/news/153805.html", "time": "2017-11-17", "level": "", "num_look": 218009, "num_comment": 218009, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "因此亚马逊在本周正式宣布，他们将为旗下的S3（简单存储服务）服务增加五个新的安全和加密功能，其中包括给用户发送Bucket警报。"}
{"title": "色情网站的光棍节“福利”：加密式挂马玩转流氓推广", "url": "https://www.freebuf.com/articles/web/153809.html", "time": "2017-11-17", "level": "红色标题", "num_look": 732449, "num_comment": 9, "author": "360安全", "tags": ["WEB安全"], "text": "360安全中心监测到一起网站弹窗广告挂马事件，弹出的网络广告出现挂马，广告内容以同城交友等伪装色情诱惑信息为主。"}
{"title": "一个利用CVE-2017-11292的APT样本技术分析（二）", "url": "https://www.freebuf.com/articles/network/153813.html", "time": "2017-11-17", "level": "现金奖励", "num_look": 365627, "num_comment": 2, "author": "兰云科技银河实验室", "tags": ["网络安全"], "text": "CVE-2017-11292 是个较为复杂的类型混淆漏洞，目前尚未有公开的分析报告。本文试图对这个漏洞利用的细节进行深入分析。"}
{"title": "BUF早餐铺 | 美国零售商Forever 21泄露用户支付卡信息；西班牙电子ID卡也存在加密漏洞；一加手机原装应用又曝问题", "url": "https://www.freebuf.com/news/154226.html", "time": "2017-11-17", "level": "", "num_look": 179747, "num_comment": 179747, "author": "AngelaY", "tags": ["资讯"], "text": "BlueBorne漏洞仍旧影响数千万Amazon Echo与Google Home设备；Wordpress的Formidable Forms插件存在漏洞；Foscam C1网络摄像头存在多个远程代码执行漏洞"}
{"title": "FIT 2018大会预告篇（五）：人脸识别门禁漏洞挖掘详解 | HACK DEMO", "url": "https://www.freebuf.com/news/154209.html", "time": "2017-11-16", "level": "红色标题", "num_look": 258543, "num_comment": 11, "author": "FB客服", "tags": ["活动", "资讯"], "text": "利用人脸识别门禁设备本身存在的漏洞，修改设备中的人脸信息，从而实现用任意人脸欺骗门禁系统，颠覆“眼见为实”的认知。"}
{"title": "物联网安全研究之一：IoT架构介绍", "url": "https://www.freebuf.com/news/153580.html", "time": "2017-11-16", "level": "", "num_look": 448278, "num_comment": 2, "author": "clouds", "tags": ["资讯"], "text": "最近，很多人都向我咨询物联网（IoT）安全研究如何入门的问题，以此，我打算写一些物联网相关的安全加固、渗透测试和漏洞利用的文章，以供大家参考借鉴。"}
{"title": "潜伏的BadMedia木马家族，用户需谨慎下载破解应用", "url": "https://www.freebuf.com/articles/network/154029.html", "time": "2017-11-16", "level": "", "num_look": 540876, "num_comment": 6, "author": "腾讯手机管家", "tags": ["网络安全"], "text": "名为“BadMedia ”的木马家族能够长期保持高活跃主要有几个因素：利用游戏破解等刚需诱导用户安装,利用 CVE-2015-1805等内核漏洞强行ROOT用户设备，并将自身植入到系统目录阻止用户卸载，长期潜伏用户设备进行恶意推…"}
{"title": "维基解密现已发布Vault 7工具源码", "url": "https://www.freebuf.com/news/154076.html", "time": "2017-11-16", "level": "红色标题", "num_look": 307627, "num_comment": 4, "author": "Covfefe", "tags": ["资讯"], "text": "维基解密在上周四发布了Vault8系列的第一部分，其中包括从CIA泄露的黑客工具相关的源代码。"}
{"title": "网络犯罪活动猖獗的当下，互联网用户该如何保护自己？", "url": "https://www.freebuf.com/articles/neopoints/153040.html", "time": "2017-11-16", "level": "", "num_look": 198137, "num_comment": 198137, "author": "Alpha_h4ck", "tags": ["观点"], "text": "为了让大家更好地了解近期的网络犯罪活动，我们按照重要性对报告中的网络犯罪事件进行了排序。接下来，我们会跟大家详细介绍这些事件，并告诉大家如何才能更好地保护自己。"}
{"title": "腾讯安全诚招安全和数据分析方向人才", "url": "https://www.freebuf.com/jobs/126889.html", "time": "2017-11-16", "level": "", "num_look": 262226, "num_comment": 15, "author": "RanDom", "tags": ["安全招聘"], "text": "深圳市腾讯计算机系统有限公司成立于1998年11月，由马化腾、张志东、许晨晔、陈一丹、曾李青五位创始人共同创立。"}
{"title": "一款正在活跃的U盘感染型病毒分析", "url": "https://www.freebuf.com/articles/terminal/153428.html", "time": "2017-11-16", "level": "现金奖励", "num_look": 507834, "num_comment": 15, "author": "安全豹", "tags": ["终端安全"], "text": "近期，国内部分地区出现一批通过U盘传播的病毒样本。经分析发现，其背后操作者为境外(之前传出几百人打几千人球迷)某国黑产团伙，目前样本处于“积极传播”期。"}
{"title": "真实网站劫持案例分析", "url": "https://www.freebuf.com/articles/web/153788.html", "time": "2017-11-16", "level": "现金奖励", "num_look": 1275119, "num_comment": 28, "author": "feiniao", "tags": ["WEB安全"], "text": "上段时间一直忙于处理大会安全保障与应急，借助公司云悉情报平台，发现并处置几十起网站被劫持的情况。对黑客SEO技术颇有感觉。"}
{"title": "海莲花（OceanLotus）APT团伙新活动通告", "url": "https://www.freebuf.com/articles/others-articles/153666.html", "time": "2017-11-16", "level": "", "num_look": 368752, "num_comment": 6, "author": "奇安信威胁情报中心", "tags": ["其他"], "text": "2017年11月6日，国外安全公司Volexity发布了一篇关于疑似海莲花APT团伙新活动的报告，该报告指出攻击团伙攻击了与政府、军事、人权、媒体和国家石油勘探等有关的个人和组织的100多个网站。"}
{"title": "挖洞经验 | 看我如何发现DenyAll WAF未授权远程RCE漏洞", "url": "https://www.freebuf.com/articles/system/153388.html", "time": "2017-11-16", "level": "", "num_look": 309952, "num_comment": 3, "author": "clouds", "tags": ["系统安全"], "text": "在本文中，我要展示的是我们团队发现的DenyAll WAF未授权RCE远程漏洞一枚（CVE-2017-14706）。"}
{"title": "BUF 早餐铺 | 一加手机曝出后门；谷歌Browse-Secure扩展程序爬取用户社交信息；微软11月修复53个漏洞；Adobe 修复9款产品中的80个漏洞", "url": "https://www.freebuf.com/news/154157.html", "time": "2017-11-16", "level": "", "num_look": 186096, "num_comment": 186096, "author": "AngelaY", "tags": ["资讯"], "text": "新 IcedID 木马攻击北美；美政府公布朝鲜所使用的 FALLCHILL 恶意程序详情；11 月修复日 SAP 修复 22 个安全漏洞。"}
{"title": "FIT 2018大会预告篇（四）：智能外设入侵汽车网络解密 | HACK DEMO", "url": "https://www.freebuf.com/news/154064.html", "time": "2017-11-15", "level": "", "num_look": 210182, "num_comment": 210182, "author": "FB客服", "tags": ["活动", "资讯"], "text": "智能外设本身可能出现哪些安全问题？用户在利用智能外设与汽车进行通信的过程中，会出现怎样的漏洞？黑客是如何利用这些问题或漏洞入侵汽车网络的？厂商在设计、生产智能外设时需要注意哪些安全要素？"}
{"title": "利用CVE-2017-5123攻击提供全面保护的SMEP、SMAP和Chrome沙盒", "url": "https://www.freebuf.com/articles/system/153633.html", "time": "2017-11-15", "level": "", "num_look": 256897, "num_comment": 2, "author": "生如夏花", "tags": ["系统安全"], "text": "阅读本文需要的基础：c语言，操作系统，内核调用......（虽然没有，也是可以看的 。。偷笑）。"}
{"title": "WitAwards 2017“年度创新产品”参评巡礼 | 从思科AMP看端点威胁检测与响应市场", "url": "https://www.freebuf.com/articles/terminal/154078.html", "time": "2017-11-15", "level": "红色标题", "num_look": 388184, "num_comment": 388184, "author": "欧阳洋葱", "tags": ["活动", "终端安全"], "text": "我们这次期望借由这篇针对思科AMP for Endpoint的解读，来谈一谈EDR类别产品的实质，以及当代端点安全防护产品应该具备什么样的素质。"}
{"title": "送你一份API安全评估核查清单", "url": "https://www.freebuf.com/articles/web/153376.html", "time": "2017-11-15", "level": "", "num_look": 330219, "num_comment": 1, "author": "米雪儿", "tags": ["WEB安全"], "text": "此份清单对于参与API设计、测试和发布过程的相关安全评估人员而言非常重要，大家可以根据清单核查自身行为！"}
{"title": "BOSS直聘诚招高级安全人才", "url": "https://www.freebuf.com/jobs/153281.html", "time": "2017-11-15", "level": "", "num_look": 285235, "num_comment": 24, "author": "Hackerhope", "tags": ["安全招聘"], "text": "公司成立于2013年12月，包含Boss直聘、看准网、店长直聘等产品，主要以互联网形式为用户提供高效便捷的人力资源信息服务，现已Ｃ轮融资，有较强的市场竞争力和很好的发展前景。"}
{"title": "漏洞预警 | 微软Patch Tuesday修复三则重要漏洞", "url": "https://www.freebuf.com/news/154083.html", "time": "2017-11-15", "level": "红色标题", "num_look": 173021, "num_comment": 173021, "author": "Sphinx", "tags": ["资讯"], "text": "微软在Patch Tuesday中修复了三枚重要的漏洞，Windows EOT字体引擎信息泄露漏洞、Windows内核信息泄露漏洞，Microsoft Excel安全功能绕过漏洞。"}
{"title": "CompTIA Security+认证考试通过的9个秘诀", "url": "https://www.freebuf.com/articles/neopoints/153835.html", "time": "2017-11-15", "level": "", "num_look": 476080, "num_comment": 7, "author": "柚子", "tags": ["观点"], "text": "Security+ 认证是和CISSP、CISA等共同包含在内的国际IT业热门认证之一，和CISSP偏重信息安全管理相比，Security+认证更偏重信息安全技术和操作。"}
{"title": "如何使用MSFPC简化生成Payload的过程", "url": "https://www.freebuf.com/sectool/153801.html", "time": "2017-11-15", "level": "", "num_look": 356266, "num_comment": 2, "author": "Covfefe", "tags": ["工具"], "text": "如果你以前使用过MSFvenom，那么可能已经自行编写了一个简单的shell脚本来自动化频繁地生成Payload。即使这样，这个工具也绝对值得一试。"}
{"title": "2017年Office漏洞及漏洞攻击研究报告", "url": "https://www.freebuf.com/articles/paper/154040.html", "time": "2017-11-15", "level": "红色标题", "num_look": 455280, "num_comment": 6, "author": "腾讯电脑管家", "tags": ["安全报告"], "text": "腾讯电脑管家安全实验室对2017年Office漏洞以及漏洞攻击进行了深入的分析和整理，并向全社会输出此报告,希望各安全厂商能同心协力，一起为用户建设更加安全的网络环境。"}
{"title": "僵尸网络团伙利用MIRAI开源代码改造升级攻击装备", "url": "https://www.freebuf.com/articles/web/153689.html", "time": "2017-11-15", "level": "", "num_look": 401110, "num_comment": 4, "author": "antiylab", "tags": ["WEB安全"], "text": "安天捕风蜜网系统自动捕获到一批最新的Mirai变种被控端样本，根据多方面的分析，确认该批样本为Mirai家族衍生变种，且处于完善测试和拓展僵尸网络的阶段。"}
{"title": "某开源框架从注入到Getshell", "url": "https://www.freebuf.com/vuls/153668.html", "time": "2017-11-15", "level": "现金奖励", "num_look": 379273, "num_comment": 21, "author": "sjy93812", "tags": ["漏洞"], "text": "SemCms是一套开源外贸企业网站管理系统，主要用于外贸企业，兼容IE、Firefox 等主流浏览器。SemCms使用vbscript语言编写，结合iis运行。采用国际通用utf-8编码编写。"}
{"title": "早餐铺 | 安全企业 Bkav 研究出 iPhone X 人脸识别的破解方法；漏洞奖励计划和漏洞披露平台帮助五角大楼修复2,837漏洞", "url": "https://www.freebuf.com/news/153985.html", "time": "2017-11-15", "level": "", "num_look": 167417, "num_comment": 1, "author": "Elaine_z", "tags": ["资讯"], "text": "今天的早餐包括：安全企业 Bkav 研究出 iPhone X 人脸识别的破解方法；漏洞奖励计划和漏洞披露平台帮助五角大楼修复2,837漏洞；维基解密公开Vault 7工具源代码；CryptoMix 勒索软件变种 XZZX出现；"}
{"title": "快讯 | iPhone X的Face ID技术被成功绕过", "url": "https://www.freebuf.com/news/154043.html", "time": "2017-11-14", "level": "红色标题", "num_look": 422448, "num_comment": 8, "author": "clouds", "tags": ["资讯"], "text": "就在11月3日苹果发布全新iPhone X之后的一个星期，一黑客团体声称已经用低于150美元的面具成功破解了苹果的Face ID面部识别技术。"}
{"title": "W8scan：一款模仿Bugscan的漏洞扫描器", "url": "https://www.freebuf.com/sectool/153350.html", "time": "2017-11-14", "level": "金币+18", "num_look": 529532, "num_comment": 13, "author": "w8ay", "tags": ["工具"], "text": "bugscan的扫描模式是我所喜欢的，所以就做了个相仿的。模仿他的通信原理。网页端返回一段代码，本地python环境执行代码即可扫描。"}
{"title": "WitAwards 2017“年度创新产品”参评巡礼 | 指掌易移动DLP产品解读", "url": "https://www.freebuf.com/fevents/153851.html", "time": "2017-11-14", "level": "红色标题", "num_look": 222028, "num_comment": 1, "author": "AngelaY", "tags": ["活动", "特别企划"], "text": "在移动办公势不可挡的今天，如何保护企业业务应用与业务数据已成为安全厂商关注的重点。安全、轻量级、兼容性高、适配力强、用户体验佳等，都是移动安全产品的竞争要素。"}
{"title": "WPA/WPA2漏洞分析（第二部分）", "url": "https://www.freebuf.com/articles/wireless/153324.html", "time": "2017-11-14", "level": "金币+18", "num_look": 536010, "num_comment": 10, "author": "wangzi110044", "tags": ["无线安全"], "text": "这次介绍四种类型的握手攻击方法：仅接受加密信息重传设备的四次握手；Group Key 握手（即时密钥安装）；Group Key 握手（延时密钥安装）；BSS过渡（FT）握手"}
{"title": "大名鼎鼎的Mimikatz密码读取工具，险被俄罗斯黑客窃取", "url": "https://www.freebuf.com/articles/others-articles/153981.html", "time": "2017-11-14", "level": "", "num_look": 287030, "num_comment": 1, "author": "lr3800_", "tags": ["其他"], "text": "最近，Mimikatz 重新回到了人们的视线中，它成为了 NotPetya 和 BadRabbit的组成部分，而这两个勒索蠕虫已经击垮了乌克兰，并且蔓延到整个欧洲、俄罗斯和美国。"}
{"title": "京东诚聘安全人才", "url": "https://www.freebuf.com/jobs/153380.html", "time": "2017-11-14", "level": "", "num_look": 219510, "num_comment": 2, "author": "kylin1415", "tags": ["安全招聘"], "text": "未来，京东将更加重视技术的战略地位，发展云计算、大数据、智慧物流、人工智能、AR/VR、智能硬件等最新技术，以推动京东实现快速、可持续增长。"}
{"title": "Foosun DotNetCMS2.0登录绕过漏洞", "url": "https://www.freebuf.com/articles/web/153081.html", "time": "2017-11-14", "level": "现金奖励", "num_look": 365529, "num_comment": 8, "author": "tammypi", "tags": ["WEB安全"], "text": "在阅读Foosun DotNetCMS2.0代码时，我们发现了一处漏洞。"}
{"title": "使用LSTM检测DGA域名", "url": "https://www.freebuf.com/articles/network/153345.html", "time": "2017-11-14", "level": "金币+18", "num_look": 783204, "num_comment": 24, "author": "xbear", "tags": ["网络安全"], "text": "恶意软件定期使用DGA算法生成为随机域名，有效绕过黑名单检测，尝试连接，寻找C2中控。"}
{"title": "2017年上海大学生信息安全竞赛复旦基因瓢虫战队Writeup", "url": "https://www.freebuf.com/news/153290.html", "time": "2017-11-14", "level": "金币+18", "num_look": 344453, "num_comment": 3, "author": "robin7", "tags": [], "text": "这次比赛题目难度适中，我们有两道逆向题没有做，但复旦基因瓢虫战队最后还是取得预赛第四名的成绩。"}
{"title": "BUF早餐铺 | 穆斯林黑客攻击ISIS网站，泄露2万用户名单；DHS团队黑了一架波音757；第一款使用", "url": "https://www.freebuf.com/news/153924.html", "time": "2017-11-14", "level": "", "num_look": 226165, "num_comment": 2, "author": "Sphinx", "tags": ["资讯"], "text": "穆斯林黑客攻击ISIS网站，泄露20000用户名单；DHS团队黑了一架波音757；第一款使用\"Toast Overlay\"攻击的Android恶意软件出现；Avira发现新的Locky勒索软件。"}
{"title": "FIT 2018大会预告篇（三）：情报驱动下的安全闭环建设 | 企业安全工坊", "url": "https://www.freebuf.com/news/153887.html", "time": "2017-11-13", "level": "红色标题", "num_look": 213783, "num_comment": 1, "author": "FB客服", "tags": ["资讯"], "text": "要做到更有效的检测与更快速的响应，安全情报必不可少，让情报去引领安全建设，不断完善检测、分析、预测、防御的能力，成为被广泛接受的安全建设指导思路。"}
{"title": "WPA/WPA2漏洞分析(一)", "url": "https://www.freebuf.com/articles/wireless/153323.html", "time": "2017-11-13", "level": "现金奖励", "num_look": 791952, "num_comment": 6, "author": "wangzi110044", "tags": ["无线安全"], "text": "本文介绍的是我在阅读论文后的理解，期望达到让有一点计算机网络知识的人能看懂的程度。"}
{"title": "国内研究人员首次Wifi重大漏洞利用实现 | Krack攻击测试套件打包", "url": "https://www.freebuf.com/articles/wireless/153255.html", "time": "2017-11-13", "level": "金币+18", "num_look": 1216514, "num_comment": 91, "author": "NoahhhRyan", "tags": ["无线安全"], "text": "过程很简单，研究人员都可以看懂，不提倡恶意攻击者使用，所以就不写傻瓜tou式教程lan，在绝大用户都没更新的时候，还是希望这篇文章只是作为研究使用。"}
{"title": "蚂蚁金服诚聘资深安全工程师及安全专家", "url": "https://www.freebuf.com/jobs/152553.html", "time": "2017-11-13", "level": "", "num_look": 230240, "num_comment": 7, "author": "billzone", "tags": ["安全招聘"], "text": "诚聘各类安全人才加入，为世界微小而美好的改变而努力。"}
{"title": "如何使用Airgeddon搭建基于软件的WIFI干扰器", "url": "https://www.freebuf.com/sectool/153769.html", "time": "2017-11-13", "level": "红色标题", "num_look": 701001, "num_comment": 13, "author": "Covfefe", "tags": ["工具", "无线安全"], "text": "Airgeddon是一款能够进行Wi-Fi干扰的多Bash网络审计工具，它可以允许你在未加入目标网络的情况下设置目标，并且断开目标网络中的所有设备。"}
{"title": "研究人员发现新型勒索软件GIBON，今年5月份就出现在地下黑市", "url": "https://www.freebuf.com/news/153478.html", "time": "2017-11-13", "level": "", "num_look": 141678, "num_comment": 141678, "author": "AngelaY", "tags": ["资讯"], "text": "上周，有安全专家发现了一款新的 GIBON 勒索软件。但实际上，今年 5 月份地下黑市中就已经出现了这款勒索软件的身影。"}
{"title": "行业优秀案例大赏 | WitAwards 2017年度安全评选「入围榜单」发布", "url": "https://www.freebuf.com/news/topnews/153553.html", "time": "2017-11-13", "level": "红色标题", "num_look": 175694, "num_comment": 1, "author": "FB客服", "tags": ["头条"], "text": "让我们共同向安全行业的优秀项目、产品、人物以及团队致敬，感谢他们为守护网络安全所做出的不懈努力与贡献。"}
{"title": "浅谈Node.js Web的安全问题", "url": "https://www.freebuf.com/articles/web/152891.html", "time": "2017-11-13", "level": "金币+17", "num_look": 566959, "num_comment": 3, "author": "m09046105", "tags": ["WEB安全"], "text": "在2009年，Ryan正式推出了基于JavaScript语言和V8引擎的开源Web服务器项目，命名为Node.js，从此JavaScript也可以在后端服务器开发"}
{"title": "Nitol僵尸网络家族变种借“快猴网”套肉鸡", "url": "https://www.freebuf.com/articles/system/153108.html", "time": "2017-11-13", "level": "红色标题", "num_look": 380854, "num_comment": 5, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "腾讯安全反病毒实验室发现一个名叫快猴网（www.kuaihou.com）的下载站通过在一些游戏辅助工具包里置入lpk病毒，坐等“肉鸡”入坑。"}
{"title": "BUF早餐铺 | 维基解密 Vault 8 系列泄密；谷歌将发布 Chrome 安全新功能；Equifax 数据泄露导致其 Q3 直接损失 8750 万美元", "url": "https://www.freebuf.com/news/153722.html", "time": "2017-11-13", "level": "", "num_look": 172241, "num_comment": 172241, "author": "AngelaY", "tags": ["资讯"], "text": "双十一之后的你，需要一顿好早餐。"}
{"title": "PROPagate：一种新的代码注入技巧介绍", "url": "https://www.freebuf.com/news/153041.html", "time": "2017-11-12", "level": "金币+17", "num_look": 490379, "num_comment": 2, "author": "liulang", "tags": ["资讯"], "text": "我会在本文介绍一个一种新的代码注入技巧——PROPagate。"}
{"title": "EternalBlue（永恒之蓝）工具漏洞利用细节分析", "url": "https://www.freebuf.com/articles/terminal/153230.html", "time": "2017-11-12", "level": "红色标题", "num_look": 2004879, "num_comment": 3, "author": "奇安信威胁情报中心", "tags": ["终端安全"], "text": ""}
{"title": "为什么新兴的亚太市场未来是恶意软件的主要目标？", "url": "https://www.freebuf.com/articles/paper/153338.html", "time": "2017-11-12", "level": "", "num_look": 172805, "num_comment": 172805, "author": "Alpha_h4ck", "tags": ["安全报告"], "text": "Malwarebytes实验室的2017年恶意软件状态分析报告显示：绝大多数的网络犯罪分子仍然将他们的注意力主要集中在北美地区和欧洲地区，但是现在他们也逐渐开始将“魔掌”伸向了亚太地区。"}
{"title": "深信服诚聘安全类高端职位", "url": "https://www.freebuf.com/jobs/153093.html", "time": "2017-11-12", "level": "", "num_look": 198820, "num_comment": 2, "author": "suifeng-刘军", "tags": ["安全招聘"], "text": "“中国卓越雇主”–深信服科技成立于2000年，是中国最大的新网络产品供应商，致力于提供基于创新网络的产品及解决方案，深信服业务涵盖两大领域：网络安全、虚拟化&云计算"}
{"title": "第三届上海市大学生网络安全大赛彼岸花战队Writeup", "url": "https://www.freebuf.com/news/153078.html", "time": "2017-11-12", "level": "金币+17", "num_look": 359802, "num_comment": 12, "author": "幽夜寒香", "tags": [], "text": "我在等风也等你，一个半文艺少年~"}
{"title": "利用PowerShell Empire实现Word文档DDE攻击控制", "url": "https://www.freebuf.com/articles/system/153105.html", "time": "2017-11-12", "level": "", "num_look": 306462, "num_comment": 4, "author": "clouds", "tags": ["系统安全"], "text": "在这篇文章中，我将展示如何利用基于Empire的PowerShell来对Word文档进行“伪装”攻击，可能还有其它实现方法，我仅作个抛砖引玉。"}
{"title": "一个利用CVE-2017-11292的APT样本技术分析（一）", "url": "https://www.freebuf.com/vuls/153085.html", "time": "2017-11-11", "level": "", "num_look": 598284, "num_comment": 8, "author": "兰云科技银河实验室", "tags": ["漏洞"], "text": "最近沸沸扬扬的黑色绿洲(BlackOasis) APT 利用了Adobe Flash 的漏洞CVE-2017-11292。最近，我们发现除了黑色绿洲 APT 外，还有另外一个APT 攻击也利用了CVE-2017-11292这个漏洞。"}
{"title": "XSS过滤绕过速查表", "url": "https://www.freebuf.com/articles/web/153055.html", "time": "2017-11-11", "level": "金币+17", "num_look": 2305739, "num_comment": 31, "author": "walletong", "tags": ["WEB安全"], "text": "OWASP的这篇速查表虽然时间比较久了，但还在更新，所以还是翻译出来了。翻译完发现里面还是有一些值得借鉴的思路，用来涨知识还是可以的。"}
{"title": "苏州冠辰招募渗透测试工程师", "url": "https://www.freebuf.com/jobs/152772.html", "time": "2017-11-11", "level": "", "num_look": 182016, "num_comment": 9, "author": "gogogo", "tags": ["安全招聘"], "text": "苏州冠辰计算机信息技术有限公司主要从事信息安全产品研发、渗透测试、风险评估、信息安全集成、系统集成、智慧城市、大数据平台建设等业务。"}
{"title": "多家反病毒软件存在AVGater问题，恶意软件反可利用隔离区提权", "url": "https://www.freebuf.com/news/153761.html", "time": "2017-11-11", "level": "", "num_look": 174302, "num_comment": 1, "author": "Elaine_z", "tags": ["资讯"], "text": "几款常见的反病毒软件中曝出存在一种可让攻击者利用隔离区来提升恶意软件权限的问题，涉及的反病毒软件厂商具体有趋势科技、Emisoft、卡巴斯基，Malwarebytes, Check Point (ZoneAlarm) 以及Ikarus 的反病毒软件。"}
{"title": "如何使用runscripthelper.exe绕过应用的白名单机制", "url": "https://www.freebuf.com/articles/network/153034.html", "time": "2017-11-11", "level": "", "num_look": 358490, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "runscripthelper.exe执行PowerShell代码的方式也有相应的副作用，而我们就可以把它当作一种绕过受限语言模式的方法来使用了（例如绕过通用的应用程序白名单机制）。"}
{"title": "Equifax事件催生纽约数据保护立法，保护公民数据安全的同时对企业更友好", "url": "https://www.freebuf.com/news/153181.html", "time": "2017-11-11", "level": "", "num_look": 127656, "num_comment": 127656, "author": "AngelaY", "tags": ["资讯"], "text": "上周四，纽约检察长 Eric T. Schneiderman推出了新的立法，旨在保护纽约公民免受公司数据泄露事件的影响，以一种对企业友好的方式增加个人信息的安全性。"}
{"title": "游戏行业安全探讨 | FreeBuf企业安全俱乐部北京站参会报名", "url": "https://www.freebuf.com/fevents/153511.html", "time": "2017-11-10", "level": "", "num_look": 185600, "num_comment": 4, "author": "FB客服", "tags": ["活动"], "text": "游戏行业为何频遭攻击，成为俎上之肉？ 游戏行业该如何正确预防、处理黑客攻击事件？"}
{"title": "挖洞经验 | 看我如何发现谷歌漏洞跟踪管理平台漏洞获得$15600赏金", "url": "https://www.freebuf.com/articles/web/152893.html", "time": "2017-11-10", "level": "", "num_look": 636346, "num_comment": 9, "author": "clouds", "tags": ["WEB安全"], "text": "谷歌除了通常的邮件通知外，还采取了这个新的漏洞跟踪反馈处理机制，所以，我决定想办法来搞搞它。"}
{"title": "优惠预警｜FIT 2018大会门票“双十一” 限时秒杀", "url": "https://www.freebuf.com/fevents/153650.html", "time": "2017-11-10", "level": "红色标题", "num_look": 203400, "num_comment": 4, "author": "FB客服", "tags": ["活动"], "text": "双十一FIT大会门票打折啦～你买不了吃亏，买不了上当……限时秒杀即将开启，更有神秘送票活动，Shut up & Take my Money！"}
{"title": "Magiclamp广告病毒家族：寄生与应用市场的广告牛皮藓", "url": "https://www.freebuf.com/articles/terminal/153484.html", "time": "2017-11-10", "level": "红色标题", "num_look": 298073, "num_comment": 7, "author": "腾讯手机管家", "tags": ["终端安全"], "text": "一款名为Magiclamp的恶意广告家族将自己伪装成一些破解游戏和工具类软件，通过主流的应用市场和部分软件下载站进行传播。"}
{"title": "快讯 | 维基解密新一轮CIA网络武器曝光，Vault 8来了！", "url": "https://www.freebuf.com/news/153649.html", "time": "2017-11-10", "level": "红色标题", "num_look": 551173, "num_comment": 10, "author": "clouds", "tags": ["资讯"], "text": "在维基解密陆续曝光公布CIA网络军火库项目Vault7之后的两个月，11月9日，维基解密再次声称，将继续曝光公布名为Vault 8的新一系列CIA网络武器。"}
{"title": "黑客是如何对俄罗斯外贸银行实施APT攻击的？", "url": "https://www.freebuf.com/articles/network/153122.html", "time": "2017-11-10", "level": "", "num_look": 467157, "num_comment": 5, "author": "瑞星", "tags": ["网络安全"], "text": "APT攻击一直以来是企业关注的重点，通常以智能手机、平板电脑和USB等移动设备为目标入侵企业信息系统，其中恶意邮件是APT攻击最常用的攻击手段"}
{"title": "微梦创科网络科技有限公司招聘安全工程师", "url": "https://www.freebuf.com/jobs/152913.html", "time": "2017-11-10", "level": "", "num_look": 181683, "num_comment": 12, "author": "Akane", "tags": ["安全招聘"], "text": "全球最大的中文社交媒体平台，于2014年正式登陆美国纳斯达克，并逐渐发展成为全球最大的中文社交媒体。"}
{"title": "利用Freeradius和Django双因子认证，快速搭建统一认证平台指南", "url": "https://www.freebuf.com/articles/es/152236.html", "time": "2017-11-10", "level": "现金奖励", "num_look": 423854, "num_comment": 7, "author": "chengfangang", "tags": ["企业安全"], "text": "本文就利用freeradius和django的双因子认证简单的讲一下如何使用这两者搭建公司统一的认证平台（django主要是解决otp口令的问题，其它的框架也可以）。"}
{"title": "利用Thinkphp 5缓存漏洞实现前台Getshell", "url": "https://www.freebuf.com/articles/web/153286.html", "time": "2017-11-10", "level": "现金奖励", "num_look": 630022, "num_comment": 6, "author": "WindWing", "tags": ["WEB安全"], "text": "本文将会详细讲解：如何判断缓存漏洞存在的可能性、如何利用Thinkphp5的框架漏洞结合网站的一些配置实现前台getshell。"}
{"title": "CrackMe破解系列第一番Acid_burn", "url": "https://www.freebuf.com/articles/system/153075.html", "time": "2017-11-10", "level": "金币+15", "num_look": 450823, "num_comment": 8, "author": "gncao", "tags": ["系统安全"], "text": "身为搞技术的嘛，不懂就学，学不懂就再学，所以就在前些日子看了一些基础的汇编视频入了个门，然后在看汇编的时候又对逆向破解比较感兴趣（有成就感）。"}
{"title": "代码安全保障技术趋势前瞻", "url": "https://www.freebuf.com/articles/neopoints/153253.html", "time": "2017-11-10", "level": "", "num_look": 224333, "num_comment": 3, "author": "奇安信代码卫士", "tags": ["观点"], "text": "未来数年中，代码安全保障技术将会走向何方，以下是我们根据该领域现状分析归纳出的几项趋势和技术发展方向。"}
{"title": "BUF早餐铺 | Mayer解释雅虎被黑事件；Malwarebytes称每天阻止800万个挖矿请求；Amazon更新了AWS管理面板，帮助站主保护敏感信息", "url": "https://www.freebuf.com/news/153607.html", "time": "2017-11-10", "level": "", "num_look": 184044, "num_comment": 4, "author": "Sphinx", "tags": ["资讯"], "text": "Marissa Mayer解释雅虎被黑事件；黑客占领加拿大警察局官网，写着\"我爱ISIS\"；Malwarebytes称每天阻止800万个挖矿请求；Amazon更新了AWS管理面板，帮助站主保护敏感信息。"}
{"title": "17年10月30日360最新虚拟壳脱壳后完全修复详细解析", "url": "https://www.freebuf.com/articles/terminal/152617.html", "time": "2017-11-09", "level": "现金奖励", "num_look": 775752, "num_comment": 17, "author": "大王叫我来挖坟", "tags": ["终端安全"], "text": "早在2016年秋季，360就已经虚拟化oncreate函数的指令到so层去运行了，却没有关于如何完全修复的文章。"}
{"title": "PHP代码审计片段讲解（入门代码审计、CTF必备）", "url": "https://www.freebuf.com/news/152209.html", "time": "2017-11-09", "level": "现金奖励", "num_look": 654525, "num_comment": 25, "author": "bowu", "tags": [], "text": "跟着本项目先搞懂PHP中大多敏感函数与各类特性，再逐渐增加难度，直到可以吊打各类CMS~"}
{"title": "使用Osmocom软件以及UmTRX ，教你如何制作一个GSM基站", "url": "https://www.freebuf.com/geek/153026.html", "time": "2017-11-09", "level": "", "num_look": 447478, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["极客"], "text": "我认为使用开源软件来创建一个 GSM 网络实在是太酷了。"}
{"title": "2017年第三季度网络诈骗趋势研究报告", "url": "https://www.freebuf.com/articles/paper/153282.html", "time": "2017-11-09", "level": "红色标题", "num_look": 345684, "num_comment": 1, "author": "360安全", "tags": ["安全报告"], "text": "2017年第三季度猎网平台共接到来自全国各地的网络诈骗举报6172起，涉案总金额高达9102.4万元，人均损失14748元。"}
{"title": "海银金控集团诚聘信息安全专家", "url": "https://www.freebuf.com/jobs/153292.html", "time": "2017-11-09", "level": "", "num_look": 274324, "num_comment": 1, "author": "andyguan001", "tags": ["安全招聘"], "text": "海银金融控股集团有限公司（Hywin Financial Holding Group CO.,LTD）始创于1989年，是一家集资产管理、财富管理、保险、文化旅游、普惠金融等业务于一体的多元化、综合性的金融平台，总部位于上海。"}
{"title": "【购票折扣】FIT 2018大会预告篇（二）：强化学习在Web安全领域的应用探索", "url": "https://www.freebuf.com/news/153504.html", "time": "2017-11-09", "level": "红色标题", "num_look": 206652, "num_comment": 1, "author": "FB客服", "tags": ["活动", "资讯"], "text": "强化学习能够为信息安全带去怎样的变革？机器学习，特别是强化学习技术是否在安全领域已经有了实际应用？"}
{"title": "WitAwards 2017“年度创新产品”参评巡礼 | 从新思科技谈AST市场现状", "url": "https://www.freebuf.com/fevents/153351.html", "time": "2017-11-09", "level": "红色标题", "num_look": 400797, "num_comment": 1, "author": "欧阳洋葱", "tags": ["活动"], "text": "我们刚看到 Synopsys（新思科技）参评 WIT 时还是略感诧异的，因为 Synopsys 这家公司在 EDA（电子设计自动化）领域可算是全球的排头兵。"}
{"title": "智能家居设备存在漏洞，吸尘器秒变监视器", "url": "https://www.freebuf.com/articles/terminal/152761.html", "time": "2017-11-09", "level": "", "num_look": 294531, "num_comment": 3, "author": "Covfefe", "tags": ["终端安全"], "text": "Check Point研究人员的调查结果显示LG智能家居设备存在漏洞，黑客可以利用该漏洞完全控制一个用户账户，然后远程劫持LG SmartThinQ家用电器"}
{"title": "“工具党”是如何破解游戏反修改功能的", "url": "https://www.freebuf.com/articles/terminal/152963.html", "time": "2017-11-09", "level": "金币+8", "num_look": 566227, "num_comment": 17, "author": "justfwd", "tags": ["系统安全", "终端安全"], "text": "游戏修改器可以实现很多变态功能，像无敌、倍攻、秒杀等，但是现在很多游戏都使用了MTP手游保护，游戏修改器无法使用。"}
{"title": "MantisTek GK2键盘内置键盘记录器，数据被传到中国", "url": "https://www.freebuf.com/news/153398.html", "time": "2017-11-09", "level": "", "num_look": 464974, "num_comment": 8, "author": "Sphinx", "tags": ["资讯"], "text": "一款流行的104键Mantistek GK2机械游戏键盘，售价达49.66欧元，却被发现悄悄记录用户输入的内容，然后发送到中国的服务器。"}
{"title": "综合利用一个身份认证漏洞，通吃多款趋势安全软件", "url": "https://www.freebuf.com/articles/system/152993.html", "time": "2017-11-09", "level": "", "num_look": 346875, "num_comment": 3, "author": "clouds", "tags": ["系统安全"], "text": "本文中我会展示用一个RCE漏洞就可渗透多款趋势安全软件。"}
{"title": "BUF 早餐铺 | 谷歌11月修复多个漏洞；MantisTek GK2键盘内置键盘记录器；IEEE P1735 加密标准有缺陷", "url": "https://www.freebuf.com/news/153481.html", "time": "2017-11-09", "level": "", "num_look": 637925, "num_comment": 637925, "author": "AngelaY", "tags": ["资讯"], "text": "SowBug 间谍组织自 2015 年起就不断窃取外交机密；不知名用户触发 Parity 以太币钱包源代码漏洞；Linux 出现 USB 驱动安全问题。"}
{"title": "黑客大规模扫描使用ethOS的主机，通过默认SSH密码窃取以太币", "url": "https://www.freebuf.com/news/152855.html", "time": "2017-11-08", "level": "", "num_look": 775359, "num_comment": 3, "author": "Sphinx", "tags": ["资讯"], "text": "黑客正在大批量地扫描网络中运行着ethOS的以太币挖矿服务器，进而通过操作系统的默认ssh密码入侵主机。"}
{"title": "【已结束】斗象美女产品经理「智能引力突破安全视界」| AI安全嘉年华·公开课", "url": "https://www.freebuf.com/fevents/152674.html", "time": "2017-11-08", "level": "红色标题", "num_look": 829384, "num_comment": 3, "author": "FB客服", "tags": ["活动"], "text": "前方高能，斗象科技美女产品经理开课啦～"}
{"title": "SEO香波Web病毒处理过程实录", "url": "https://www.freebuf.com/articles/web/152667.html", "time": "2017-11-08", "level": "现金奖励", "num_look": 405896, "num_comment": 12, "author": "DingdangCat", "tags": ["WEB安全"], "text": "昨天早上在一个群里接到某网站主的帮助请求，表明百度其网站首页打开会跳转到一个博彩网站，浏览器直接访问首页不会跳转。"}
{"title": "【议题征集】FreeBuf企业安全俱乐部「北京站」之游戏行业安全探讨", "url": "https://www.freebuf.com/fevents/153385.html", "time": "2017-11-08", "level": "红色标题", "num_look": 167582, "num_comment": 3, "author": "FB客服", "tags": ["活动"], "text": "本次沙龙活动由FreeBuf 和网易云易盾联合主办，主题围绕「游戏安全」"}
{"title": "阿里安全诚招安全专家", "url": "https://www.freebuf.com/jobs/152407.html", "time": "2017-11-08", "level": "", "num_look": 306729, "num_comment": 9, "author": "阿里安全", "tags": ["安全招聘"], "text": "阿里巴巴招聘资深安全工程师、安全专家及高级安全专家，提供极具行业竞争力的待遇。"}
{"title": "如何通过API调用来分析恶意软件", "url": "https://www.freebuf.com/articles/web/152781.html", "time": "2017-11-08", "level": "", "num_look": 253165, "num_comment": 253165, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "越来越多的恶意软件开始使用各种加密、封装和加壳等保护技术来对恶意代码进行混淆处理，以防止系统或程序对其进行识别。"}
{"title": "调查显示：“天堂文件”泄露于外部黑客入侵", "url": "https://www.freebuf.com/news/153325.html", "time": "2017-11-08", "level": "", "num_look": 162958, "num_comment": 3, "author": "Sphinx", "tags": ["资讯"], "text": "大多数的天堂文件都来源于离岸法律公司Appleby，最近Appleby确认这些泄露文件来源于针对其网络的攻击，没有涉及内鬼。"}
{"title": "得到相机授权的iPhone APP可在你不知情的情况下偷偷拍照窃取隐私", "url": "https://www.freebuf.com/articles/terminal/152424.html", "time": "2017-11-08", "level": "", "num_look": 450606, "num_comment": 9, "author": "liki", "tags": ["终端安全"], "text": "近日，来自澳大利亚的谷歌工程师 Felix Krause 发现苹果手机 APP 中存在一个隐私问题，APP 开发者可以利用 APP 控制前后置摄像头偷偷为你拍照。"}
{"title": "内网安全系列|对后渗透中的探测入侵内网Web系统行为的检测（一）", "url": "https://www.freebuf.com/articles/web/152822.html", "time": "2017-11-08", "level": "现金奖励", "num_look": 640143, "num_comment": 8, "author": "ChuanFile", "tags": ["WEB安全", "网络安全"], "text": "如果黑客控制的恶意程序已经突破了这些防御措施进入了内网终端，他接下来会做什么就成了我们必须思考的问题——很自然我们就会想到：内网web这个重大突破点。"}
{"title": "如何把shellcode转换成exe文件分析", "url": "https://www.freebuf.com/articles/web/152879.html", "time": "2017-11-08", "level": "现金奖励", "num_look": 306502, "num_comment": 1, "author": "pwdme", "tags": ["WEB安全"], "text": "在分析shellcode时，静态分析或者使用scdbg模拟分析都不够准确，如果转换成exe文件那么就可以用debugger或者IDA分析，会方便很多。"}
{"title": "Buf早餐铺 | 因ROCA加密漏洞，爱沙尼亚政府目前决定取消760,000张电子身份证；勒索软件GIBON其实在今年5月就已经出现在地下黑市", "url": "https://www.freebuf.com/news/153289.html", "time": "2017-11-08", "level": "", "num_look": 211449, "num_comment": 211449, "author": "Elaine_z", "tags": ["资讯"], "text": "WE名人的私密照片遭黑客泄露；因ROCA加密漏洞，爱沙尼亚政府目前决定取消760,000张电子身份证；互联网中每天会发生近3万次远程 DoS 攻击；"}
{"title": "重磅 | FreeBuf 发布黑镜调查：深渊背后的真相之「薅羊毛产业」报告", "url": "https://www.freebuf.com/news/152525.html", "time": "2017-11-07", "level": "红色标题", "num_look": 1524991, "num_comment": 15, "author": "FreeBuf咨询", "tags": ["头条", "安全报告"], "text": "本报告依据大量风控数据以及深入调查内容，通过数据分析、调查问卷等方式，解读如今让商家避之不及的“羊毛党”团伙运作流程，并揭秘依托 QQ 群发展的羊毛党真实故事。"}
{"title": "如何安全地将你的文件和文件夹藏在图片中", "url": "https://www.freebuf.com/news/152330.html", "time": "2017-11-07", "level": "", "num_look": 846492, "num_comment": 18, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "想必大家已经知道了很多隐藏敏感信息的方法了，实际上，有的时候将敏感信息隐藏在最显眼的地方可能才是最安全的。比如说，我们的电脑中肯定存储了很多图片，你有没有考虑过把重要的数据存储在这些图片之中呢？"}
{"title": "FIN7 APT组织攻击最新活动分析", "url": "https://www.freebuf.com/news/153032.html", "time": "2017-11-07", "level": "", "num_look": 438861, "num_comment": 1, "author": "腾讯电脑管家", "tags": ["网络安全", "资讯"], "text": "FIN7组织的主要目标是国外金融机构，近期的攻击目标的也扩展到一些零售企业。该组织擅长使用非PE进行攻击，在攻击过程中很少有PE文件落地。"}
{"title": "D-Link系列路由器漏洞挖掘入门", "url": "https://www.freebuf.com/articles/terminal/153176.html", "time": "2017-11-07", "level": "", "num_look": 512253, "num_comment": 2, "author": "Knownsec知道创宇", "tags": ["极客", "终端安全"], "text": "前几天去上海参加了geekpwn，看着大神们一个个破解成功各种硬件，我只能在下面喊 6666，特别羡慕那些大神们。所以回来就决定好好研究一下路由器，争取跟上大神们的步伐。"}
{"title": "爱加密科技诚聘安全相关人才", "url": "https://www.freebuf.com/jobs/152470.html", "time": "2017-11-07", "level": "", "num_look": 169246, "num_comment": 3, "author": "guochao610", "tags": ["安全招聘"], "text": "爱加密是全球专业的移动信息安全服务提供商,专注于移动应用安全、大数据及物联网安全，坚持以用户需求为导向、持续不断的创新."}
{"title": "关于国外知名互联网公司开源软件代码安全缺陷的分析报告", "url": "https://www.freebuf.com/articles/paper/152755.html", "time": "2017-11-07", "level": "", "num_look": 246702, "num_comment": 2, "author": "奇安信代码卫士", "tags": ["安全报告"], "text": "360代码卫士与国家互联网应急中心CNCERT合作，对国外知名互联网公司开源软件代码的安全缺陷情况进行了分析，以下为报告全文。本文转自国家互联网应急中心CNCERT。"}
{"title": "记一次网络诈骗追踪过程", "url": "https://www.freebuf.com/articles/others-articles/153079.html", "time": "2017-11-07", "level": "现金奖励", "num_look": 898750, "num_comment": 36, "author": "CatchSoul", "tags": ["其他", "网络安全"], "text": "本文素材均来源于真实事件，有关细节因隐私问题暂时隐去。事件是近日的某天，一位朋友通过微信联系到我，当时我正沉浸在LOL被坑的苦恼中……"}
{"title": "Python3编写的CMS漏洞检测工具（含300POC）", "url": "https://www.freebuf.com/sectool/149883.html", "time": "2017-11-07", "level": "现金奖励", "num_look": 1548903, "num_comment": 46, "author": "六翼", "tags": ["工具"], "text": "最近几年cms在网络空间中占比越来越多黑客的攻击重心也从传统OWASP10导向通用系统漏洞挖掘。大学期间研究安全的时候接触到了bugscan所以也想打造一个自己的cms漏洞poc管理和检测工具。"}
{"title": "Linux内核Waitid系统调用本地提权漏洞（CVE-2017-5123）的分析与利用", "url": "https://www.freebuf.com/vuls/152412.html", "time": "2017-11-07", "level": "现金奖励", "num_look": 457879, "num_comment": 4, "author": "任子行", "tags": ["漏洞", "系统安全"], "text": "最近在整理Linux内核漏洞利用的一些场景，比如利用系统调用漏洞、利用一些比较容易fuzz的漏洞，通过对这类场景的总结可以帮助我们快速发现0day，积累漏洞挖掘的经验。"}
{"title": "BUF早餐铺 | Equifax 事件催生纽约数据保护立法；WhatsApp山寨版公然出现在Google Play；Tor修复泄露用户IP地址的漏洞", "url": "https://www.freebuf.com/news/153201.html", "time": "2017-11-07", "level": "", "num_look": 204528, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "Equifax 事件催生纽约数据保护立法；Google Play Store再爆问题，WhatsApp山寨版公然出现；热门动漫网站crunchyroll.com传播恶意软件；Tor修复泄露用户IP地址的漏洞。"}
{"title": "【购票折扣】FIT 2018大会预告篇（一）：AI+安全领域创投机会", "url": "https://www.freebuf.com/news/153091.html", "time": "2017-11-06", "level": "红色标题", "num_look": 176353, "num_comment": 2, "author": "FB客服", "tags": ["活动", "资讯"], "text": "在这挑战与机遇并存的市场下，哪些安全细分领域最值得关注？哪些安全业务有可能成为下一个风口？"}
{"title": "Passionfruit：iOS应用黑盒评估工具", "url": "https://www.freebuf.com/sectool/152046.html", "time": "2017-11-06", "level": "", "num_look": 883365, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫Passionfruit的iOS应用程序黑盒审计工具，该工具由frida.re和vuejs共同驱动。"}
{"title": "系统安全监控DIY：动手做Osquery Agent", "url": "https://www.freebuf.com/sectool/152402.html", "time": "2017-11-06", "level": "现金奖励", "num_look": 1046097, "num_comment": 3, "author": "j0hnShi", "tags": ["工具", "系统安全"], "text": "今天我们的主角是facebook开源的osquery，通过集成osquery来实现快速监控系统安全，通过编写简单的agent来做到分布式服务器监控。"}
{"title": "银基安全诚招高级信息安全人才", "url": "https://www.freebuf.com/jobs/152225.html", "time": "2017-11-06", "level": "", "num_look": 186560, "num_comment": 8, "author": "白菜1980", "tags": ["安全招聘"], "text": "银基安全成立于2002年，是一家立足上海、服务于全国的信息安全老牌公司。银基安全是一家为各行业提供信息安全咨询与服务以及完整的端到端解决方案的高科技企业。"}
{"title": "WitAwards 2017“年度创新产品”参评巡礼 | 兰天智能安全平台（基于SOAPA架构）解读", "url": "https://www.freebuf.com/fevents/152613.html", "time": "2017-11-06", "level": "红色标题", "num_look": 209238, "num_comment": 3, "author": "Elaine_z", "tags": ["活动"], "text": "兰天智能安全平台运用大数据技术基础，解决了安全分析中数据持续增长、类型复杂、来源多样等数据特性，同时使用用户及实体行为分析技术，能实现高级持续性恶意攻击以及内部违规行为等企业威胁有效检测。"}
{"title": "开源漏洞管理工具DefectDojo（二）使用指南：基本使用", "url": "https://www.freebuf.com/sectool/152409.html", "time": "2017-11-06", "level": "现金奖励", "num_look": 1010079, "num_comment": 13, "author": "Shad0wpf_", "tags": ["工具"], "text": "efectDojo正是一款解决漏洞管理之痛的开源工具，DefectDojo可将各种漏洞报告（Nessus、Nmap、Burp等）汇总分析，对漏洞的确认、复测进行跟踪，建立计划扫描任务，导出报告等。"}
{"title": "由iPhone X看人脸识别：科技与忧患共存", "url": "https://www.freebuf.com/news/152485.html", "time": "2017-11-06", "level": "红色标题", "num_look": 1199695, "num_comment": 8, "author": "hyde777", "tags": ["数据安全", "资讯"], "text": "苹果的面部识别技术使用户解锁他们的 iPhone X，在给用户带来新技术体验的同时也不经让人忧虑：面部识别技术会被不法分子利用吗？"}
{"title": "俄罗斯浮现新型银行木马Silence，或与Carbanak有关", "url": "https://www.freebuf.com/news/152785.html", "time": "2017-11-06", "level": "", "num_look": 212657, "num_comment": 3, "author": "liki", "tags": ["资讯"], "text": "近日，卡巴斯基实验室的研究人员发现了一种新的木马——Silence，犯罪组织利用它进行网络犯罪，对俄罗斯，马来西亚，亚美利亚的银行进行了网络抢劫。"}
{"title": "扎克伯格表示：社区安全支出比盈利更重要", "url": "https://www.freebuf.com/news/152811.html", "time": "2017-11-06", "level": "", "num_look": 173187, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["观点", "资讯"], "text": "社交媒体巨头Facebook的首席执行官扎克伯格在昨日表示，跟盈利最大化比起来，保护社区安全更加的重要。"}
{"title": "Buf早餐铺 | 澳大利亚48,270雇员信息从第三方泄漏；LeakTheAnalyst行动失败，宣称侵入FireEye的黑客被捕；西方科技巨头参加中国国际安全博览会", "url": "https://www.freebuf.com/news/152900.html", "time": "2017-11-06", "level": "", "num_look": 176785, "num_comment": 2, "author": "Elaine_z", "tags": ["资讯"], "text": "由于错误的Amazon S3配置，来自政府、银行等机构的48,270澳大利亚雇员的信息泄漏；发起LeakTheAnalyst行动宣称自己黑了FireEye的黑客目前被捕；1/4的企业使用的是仅靠密码的BYOD策略；"}
{"title": "如何使用树莓派自制网络监视器", "url": "https://www.freebuf.com/geek/152403.html", "time": "2017-11-05", "level": "", "num_look": 564840, "num_comment": 7, "author": "Alpha_h4ck", "tags": ["极客"], "text": "本文所介绍的工具适合家庭环境下的“黑盒测试”，它可以帮助你记录网络中发生的所有事情。你可以用它来检测网络威胁，或将数据提供给相关专家来进行网络取证分析。"}
{"title": "CVE-2017-11826漏洞利用程序的分析", "url": "https://www.freebuf.com/vuls/152428.html", "time": "2017-11-05", "level": "", "num_look": 401277, "num_comment": 3, "author": "sjy93812", "tags": ["漏洞"], "text": "СVE-2017-11826漏洞是一个非常严重的零日漏洞，攻击者可借此实施针对性攻击行动，所有版本的Microsoft Office软件都会受此漏洞影响。"}
{"title": "量化派安全团队高薪诚聘安全人才", "url": "https://www.freebuf.com/news/152249.html", "time": "2017-11-05", "level": "", "num_look": 698020, "num_comment": 2, "author": "quantgroup", "tags": ["资讯"], "text": "量化派是大数据驱动的消费金融科技公司，为消费者提供消费信用额度的同时，帮助消费场景实现流量变现，形成优质金融资产，帮助金融机构实现资本增值。"}
{"title": "2017 MIAC移动安全赛解题思路分享", "url": "https://www.freebuf.com/news/152059.html", "time": "2017-11-05", "level": "现金奖励", "num_look": 264353, "num_comment": 6, "author": "kn0ckteam", "tags": [], "text": "前几天打了MIAC移动安全赛第一阶段的初赛，经过队友的共同努力，差一题ak，官方没有给writeup，在此分享出我们队的writeup供大家参考。"}
{"title": "我们的漏洞Webug 3.0中级进阶攻略（上）", "url": "https://www.freebuf.com/articles/web/152211.html", "time": "2017-11-05", "level": "现金奖励", "num_look": 468548, "num_comment": 4, "author": "小石", "tags": ["WEB安全"], "text": "这次带来Webug3.0中级进阶上部分 借鉴了很多前辈的文章 有些关卡可能是本身环境配置的问题 无法复现漏洞 或者我姿势不对 如果有做出的大佬可以补充一下~"}
{"title": "【FB TV】一周「BUF大事件」：新型恶意软件Bad Rabbit闪击东欧；苹果升级修复WPA2协议中的KRACK漏洞；互联网域名管理办法正式施行", "url": "https://www.freebuf.com/video/153019.html", "time": "2017-11-04", "level": "红色标题", "num_look": 994545, "num_comment": 2, "author": "willhuang", "tags": ["视频"], "text": "新型的恶意软件Bad Rabbit闪击东欧，政府和商业机构都受到了攻击；苹果系统版本更新，修复WPA2协议中的KRACK漏洞；新《互联网域名管理办法》正式施行，域名须实名注册。"}
{"title": "对ShadowBrokers Envison Collision漏洞的利用分析", "url": "https://www.freebuf.com/vuls/152427.html", "time": "2017-11-04", "level": "", "num_look": 296946, "num_comment": 2, "author": "Covfefe", "tags": ["漏洞"], "text": "目前我们正在对ShadowBrokers公开的利用工具以及脚本等进行了全方位的分析和分类工作，所以写一篇关于Linux下“envisioncollision”漏洞利用的简单介绍是非常值得的。"}
{"title": "杭州弘际科技有限公司诚邀大牛加盟", "url": "https://www.freebuf.com/jobs/151484.html", "time": "2017-11-04", "level": "", "num_look": 188205, "num_comment": 1, "author": "杭州弘际科技", "tags": ["安全招聘"], "text": "杭州弘际科技有限公司是一家专业从事智慧城市、公共安全、信息安全、大数据挖掘、人工智能等领域软硬件研发销售的高新技术企业。"}
{"title": "机器学习在安全攻防场景的应用与分析", "url": "https://www.freebuf.com/articles/neopoints/152457.html", "time": "2017-11-04", "level": "现金奖励", "num_look": 911450, "num_comment": 6, "author": "狴犴安全团队", "tags": ["观点"], "text": "本文在整理机器学习在安全攻防场景应用的具体案例的基础上，阐述并分析了机器学习在现有安全领域的应用特点，问题转化时的难点，机器学习难以克服的盲点及可能受到的危害。"}
{"title": "Mobile Pwn2Own 2017落幕：发放奖金近50万美元；三星、苹果、华为都遭破解", "url": "https://www.freebuf.com/news/152939.html", "time": "2017-11-04", "level": "", "num_look": 217108, "num_comment": 3, "author": "AngelaY", "tags": ["资讯"], "text": "参加比赛的白帽子成功针对运行最新版本操作系统的主流智能手机进行攻击，累计获得 495000 美元的奖金。最终，腾讯科恩实验室获得比赛的总冠军。"}
{"title": "预告 | FreeBuf发布黑镜调查：深渊背后的真相之「薅羊毛产业」报告", "url": "https://www.freebuf.com/fevents/152960.html", "time": "2017-11-03", "level": "红色标题", "num_look": 379086, "num_comment": 10, "author": "FreeBuf咨询", "tags": ["安全报告", "活动"], "text": "FreeBuf 与同盾科技携手，针对涉及灰产和黑产的 “薅羊毛产业链” 进行深入调查和研究分析，形成了一份《「薅羊毛产业」报告》。"}
{"title": "Typecho漏洞利用工具首发，半分钟完成渗透测试", "url": "https://www.freebuf.com/sectool/152889.html", "time": "2017-11-03", "level": "现金奖励", "num_look": 1560689, "num_comment": 31, "author": "expsky", "tags": ["工具"], "text": "Typecho是一个使用较为广泛的轻量博客系统，前几天爆出了一个反序列化远程代码执行漏洞，我自己写了一个漏洞利用的工具，只有一个按钮，你可以什么都不需要懂，只需要点两下就完成了hack。"}
{"title": "FreeBuf会员福利 | 兜哥签名版《Web安全之机器学习入门》免费送", "url": "https://www.freebuf.com/fevents/152809.html", "time": "2017-11-03", "level": "红色标题", "num_look": 598214, "num_comment": 118, "author": "FB客服", "tags": ["活动"], "text": "鸟欲高飞先振翅，人求上进多读书！"}
{"title": "被忽视的攻击面：Python package钓鱼", "url": "https://www.freebuf.com/articles/system/152919.html", "time": "2017-11-03", "level": "", "num_look": 340566, "num_comment": 1, "author": "Knownsec知道创宇", "tags": ["系统安全"], "text": "相比于传统的钓鱼方式，上传恶意 Python 包，不通过邮件、网页等方式传播，用户很难有相关的防护意识。"}
{"title": "Discord成为暗网中最受欢迎的通讯APP", "url": "https://www.freebuf.com/sectool/152405.html", "time": "2017-11-03", "level": "", "num_look": 747581, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["工具"], "text": "即便不支持端到端加密，Discord服务仍然突破“重重包围”一举成为了暗网中网络犯罪分子们最喜爱的通讯应用。"}
{"title": "iOS最新更新修复了多个安全问题，包括KRACK漏洞", "url": "https://www.freebuf.com/news/152739.html", "time": "2017-11-03", "level": "", "num_look": 272380, "num_comment": 272380, "author": "Sphinx", "tags": ["资讯"], "text": "苹果最近发布了iOS 11.1和macOS High Sierra 10.13.1版本，修复了一些问题，并且对多个安全问题进行了修复。"}
{"title": "Webug 靶场3.0渗透教程（全16关）", "url": "https://www.freebuf.com/articles/web/151617.html", "time": "2017-11-03", "level": "", "num_look": 1323481, "num_comment": 18, "author": "小石", "tags": ["WEB安全"], "text": "WeBug名称定义为“我们的漏洞”靶场环境。基础环境是基于PHP/mysql制作搭建而成，中级环境与高级环境分别都是由互联网漏洞事件而收集的漏洞存在的操作环境。"}
{"title": "微软已修复可窃取Windows登录凭证的秘密漏洞", "url": "https://www.freebuf.com/news/152283.html", "time": "2017-11-03", "level": "金币+8", "num_look": 268235, "num_comment": 1, "author": "hyde777", "tags": ["WEB安全", "资讯"], "text": "该漏洞可使得攻击者在无需任何用户交互的情况下随意窃取 Windows NTLM 密码哈希，允许与受害者网络直接连接的攻击者升级对附近系统的访问。"}
{"title": "阿里巴巴在移动端生物识别技术实践分享", "url": "https://www.freebuf.com/articles/terminal/151619.html", "time": "2017-11-03", "level": "", "num_look": 319620, "num_comment": 6, "author": "阿里聚安全", "tags": ["终端安全"], "text": "利用生物识别技术进行身份认证、人机交互已经成为很多移动端产品的重要趋势。"}
{"title": "三分钟了解OWASP TOP 10 2017 RC2", "url": "https://www.freebuf.com/news/152207.html", "time": "2017-11-03", "level": "金币+8", "num_look": 614775, "num_comment": 614775, "author": "飞絮", "tags": ["WEB安全", "资讯"], "text": "2017年10月26日，OWASP中国公众号中发布了OWASP TOP 10 2017 RC2。OWASP（开放式Web应用程序安全项目）的工具、文档、论坛和全球各地分会都是开放的，对所有致力于改进应用程序安全的人士开放。"}
{"title": "BUF早餐铺 | 马来西亚发生大规模数据泄露；黑客用多种手段窃取加密货币；俄罗斯新型银行木马Silence或与Carbanak有关；微信朋友圈新型诈骗高发", "url": "https://www.freebuf.com/news/152870.html", "time": "2017-11-03", "level": "", "num_look": 257005, "num_comment": 257005, "author": "AngelaY", "tags": ["资讯"], "text": "Chrome 图片下载扩展程序存在恶意行为；安卓奥利奥系统新的自适应图标功能有 bug，导致用户无限重启；血管外科专家炮轰世纪佳缘"}
{"title": "马来西亚政府服务器及电信公司被黑：数百万名马居民资料遭失窃", "url": "https://www.freebuf.com/news/152779.html", "time": "2017-11-02", "level": "", "num_look": 227284, "num_comment": 7, "author": "hyde777", "tags": ["资讯"], "text": "黑客攻击了东南亚国家十几个电信公司的政府服务器和数据库，数百万名马来西亚人的个人资料遭失窃。"}
{"title": "Magniber剖析：一款只以韩国为攻击目标的勒索软件", "url": "https://www.freebuf.com/news/151786.html", "time": "2017-11-02", "level": "", "num_look": 305593, "num_comment": 3, "author": "Carrie_spinfo", "tags": ["工具", "资讯"], "text": "Magnitude攻击工具包在过去几个月里并没有出什么新的幺蛾子，除了以几个亚洲国家为攻击目标的Cerber勒索软件。奇怪的是，Magnitude EK（攻击工具包）在今年9月下旬突然消失。"}
{"title": "基于异常行为的未知勒索软件检测", "url": "https://www.freebuf.com/articles/system/152387.html", "time": "2017-11-02", "level": "现金奖励", "num_look": 255550, "num_comment": 5, "author": "GaoJianli", "tags": ["系统安全"], "text": "一个比较好的应用层的勒索软件检测方案：通过创建隐藏的诱饵文件，实时拦截对诱饵文件的加密操作，从而有效应对未知的勒索软件。"}
{"title": "企业如何有效收集公开来源的威胁情报", "url": "https://www.freebuf.com/sectool/152201.html", "time": "2017-11-02", "level": "现金奖励", "num_look": 501078, "num_comment": 10, "author": "scu-igroup", "tags": ["其他", "工具"], "text": "威胁情报作为信息安全领域一个正在茁壮成长的分支，在当下依旧处于混浊状态。即网络中存在着大量的所谓“情报”，它们的结构不同、关注方向不同、可信度不同、情报内容不同、情报的来源也是千奇百怪。"}
{"title": "如何使用Windows卷影拷贝服务恢复文件和文件夹", "url": "https://www.freebuf.com/articles/system/152354.html", "time": "2017-11-02", "level": "红色标题", "num_look": 310323, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "在这篇文章中，我将给大家介绍两种使用卷影拷贝服务来恢复文件的方法。"}
{"title": "挖洞经验 | 看我如何接管OLX的每一条广告", "url": "https://www.freebuf.com/vuls/152047.html", "time": "2017-11-02", "level": "", "num_look": 278834, "num_comment": 7, "author": "Alpha_h4ck", "tags": ["漏洞"], "text": "在这篇文章中，我将跟大家分享关于“不安全的直接对象引用”（IDOR）攻击的相关内容。没错，正如本文标题所写的那样，我在OLX所托管的网站上发现了一个IDOR漏洞，并将其披露在了HackerOne上，因此我觉得是时候写一篇W…"}
{"title": "如何使用Sysmon监视工具来寻找含有宏的恶意文档", "url": "https://www.freebuf.com/sectool/152065.html", "time": "2017-11-02", "level": "金币+10", "num_look": 308760, "num_comment": 2, "author": "liulang", "tags": ["工具"], "text": "之前的文章，我已经多次介绍过关于sysmon，简单来说Sysmon是一个能监视你系统的轻量级工具。"}
{"title": "特别企划 | 被关进监狱的黑客，还能继续作案吗？", "url": "https://www.freebuf.com/special/152112.html", "time": "2017-11-02", "level": "红色标题", "num_look": 564944, "num_comment": 12, "author": "liki", "tags": ["特别企划"], "text": "精通计算机技术的Johnston被判终身监禁，而马里昂的监狱改造计划正办的如火如荼，这给了Johnston机会，天花板怎么能藏电脑？利用其他犯人的身份信用卡开户？而这一切又是怎么在监管人员眼皮子底下做到的呢。"}
{"title": "BUF早餐铺 | FireEye在GitHub上开源密码破解工具；日本出现ONI勒索软件攻击；WordPress 出现 SQL注入漏洞", "url": "https://www.freebuf.com/news/152718.html", "time": "2017-11-02", "level": "", "num_look": 174434, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "FireEye在GitHub上开源密码破解工具；日本出现ONI勒索软件攻击；WordPress 出现 SQL注入漏洞；《互联网域名管理办法》开始施行，域名须实名注册。"}
{"title": "WitAwards 2017“年度云安全产品”参评巡礼 | 知道创宇抗D保产品解读", "url": "https://www.freebuf.com/articles/network/152567.html", "time": "2017-11-01", "level": "红色标题", "num_look": 433035, "num_comment": 433035, "author": "Sphinx", "tags": ["特别企划", "网络安全"], "text": "Mirai时代下，DDoS防御产品应该怎么做？"}
{"title": "记一次CVE漏洞的分析（CVE-2017-12628）", "url": "https://www.freebuf.com/vuls/152057.html", "time": "2017-11-01", "level": "", "num_look": 509117, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["漏洞"], "text": "就在前几天的一个早上，我发现了一条介绍“Apache James 3.0.1 JMX服务器反序列化漏洞”的推文，这个漏洞（CVE-2017-12628）成功引起了我的注意。"}
{"title": "快讯 | FireEye在GitHub上开源密码破解工具GoCrack", "url": "https://www.freebuf.com/news/152641.html", "time": "2017-11-01", "level": "红色标题", "num_look": 1086625, "num_comment": 11, "author": "liki", "tags": ["工具", "资讯"], "text": "近日，FireEye 开源了一款密码破解工具 GoCrack，可以在多机器上部署破解任务。"}
{"title": "Tomcat源代码调试：看不见的Shell第三式增强之无痕", "url": "https://www.freebuf.com/articles/system/151433.html", "time": "2017-11-01", "level": "金币+10", "num_look": 254136, "num_comment": 2, "author": "n1nty", "tags": ["系统安全"], "text": "上一篇文章写了一下如何在 Tomcat 环境下隐藏任意 Jsp 文件，可用于隐藏 Shell。文件虽然隐藏了，但是在访问 Shell 的时候依然会留下访问日志，本文说一下隐藏访问日志这件事。"}
{"title": "样本分析 | 当“网络冲突”中的诱饵文件被用于真实的攻击事件", "url": "https://www.freebuf.com/news/151939.html", "time": "2017-11-01", "level": "", "num_look": 289733, "num_comment": 1, "author": "Covfefe", "tags": ["终端安全", "资讯"], "text": "Cisco Talos最近发现了知名黑客组织74（又名Tsar Team，Sofacy，APT28，Fancy Bear...）的一种新型恶意行动，具有讽刺意味的是，这次行动中的使用的诱饵文件是一份有关美国网络冲突会议的Word文档。"}
{"title": "如何巧妙的从ntds.dit中提取Hash和域信息", "url": "https://www.freebuf.com/articles/system/151463.html", "time": "2017-11-01", "level": "金币+10", "num_look": 471778, "num_comment": 6, "author": "liulang", "tags": ["系统安全"], "text": "在渗透测试进入内网之后，首要目标就是得到域控权限，将域中所有用户的hash值全部跑出来，下载到本地。很多工具比如meterpreter中的smart_hashdump和Impacket中的secretsdump.py都可以做到。"}
{"title": "Office DDEAUTO技术分析报告", "url": "https://www.freebuf.com/articles/terminal/152064.html", "time": "2017-11-01", "level": "红色标题", "num_look": 379373, "num_comment": 6, "author": "腾讯电脑管家", "tags": ["终端安全"], "text": "近段时间来，使用Office DDEAUTO技术来传播恶意文件的方法已经越来越流行。该技术很快被FIN7组织、Necurs僵尸网络所采用，用来进行APT攻击，以及用来传播勒索病毒。"}
{"title": "请警惕新的黑产趋势：入侵网站并植入挖矿恶意代码", "url": "https://www.freebuf.com/articles/web/152021.html", "time": "2017-11-01", "level": "", "num_look": 412980, "num_comment": 4, "author": "百度安全实验室", "tags": ["WEB安全"], "text": "随着“炒币热”兴起，虚拟市场开始不断涌出的多种基于区块链技术的虚拟币，面对这些诱人的巨大利益，不法分子开始尝试“不同寻常”的挖矿之路。"}
{"title": "BUF早餐铺 | 谷歌reCAPTCHA再遭破解;Mozilla或将取消对荷兰CA证书的信任；获取摄像头授权的iPhone可秘密拍照甚至录像", "url": "https://www.freebuf.com/news/152579.html", "time": "2017-11-01", "level": "", "num_look": 184385, "num_comment": 184385, "author": "AngelaY", "tags": ["资讯"], "text": "新的一月，来份好早餐，精神一整天~"}
{"title": "「人工智能在信息安全领域的黑与白」课程视频回顾 | AI安全嘉年华", "url": "https://www.freebuf.com/fevents/152544.html", "time": "2017-10-31", "level": "红色标题", "num_look": 352366, "num_comment": 3, "author": "Akane", "tags": ["活动"], "text": "海量数据全面入侵、AlphaGo轻松战胜最强人类、自动驾驶技术日趋成熟……一系列事件标志着AI技术进入了一个高速发展的爆发期，「人工智能」也再次走进了大众视野。"}
{"title": "对话 WitAdwards 2017专家评委 | 君源创投管理合伙人金湘宇（Nuke）", "url": "https://www.freebuf.com/articles/people/152240.html", "time": "2017-10-31", "level": "红色标题", "num_look": 322633, "num_comment": 1, "author": "AngelaY", "tags": ["人物志", "活动"], "text": "WitAwards 2017 互联网安全年度评选专家评委风采： 君源创投管理合伙人金湘宇（NUKE）；知名安全投资人，威胁情报专家；安全界“金将军”。"}
{"title": "【预告】小手不能抖，专业必须有 | WitAwards 2017「公众投票」明日火爆开启", "url": "https://www.freebuf.com/news/topnews/152262.html", "time": "2017-10-31", "level": "红色标题", "num_look": 205372, "num_comment": 7, "author": "FB客服", "tags": ["头条", "活动"], "text": "11月1日00:00 ，WitAwards 2017互联网安全年度评选「公众投票」 将正式开启！"}
{"title": "ASLRay：一个可以绕过ASLR的工具", "url": "https://www.freebuf.com/sectool/151426.html", "time": "2017-10-31", "level": "", "num_look": 296532, "num_comment": 4, "author": "Covfefe", "tags": ["工具"], "text": "ASLR是指利用随机方式配置数据地址，一般现代系统中都加设这一机制，以防范恶意系统对已知地址进行攻击。不过目前已经有多种绕过ASLR的方式，今天介绍一个ASLR绕过工具。"}
{"title": "Tomcat源代码调试：看不见的Shell第二式之隐藏任意Jsp文件", "url": "https://www.freebuf.com/articles/system/151432.html", "time": "2017-10-31", "level": "金币+15", "num_look": 331721, "num_comment": 6, "author": "n1nty", "tags": ["系统安全"], "text": "这篇笔记我尽量少贴代码，有兴趣的可以自己去跟一下。"}
{"title": "奇虎360企业安全华南研发基地诚聘", "url": "https://www.freebuf.com/jobs/151559.html", "time": "2017-10-31", "level": "", "num_look": 378165, "num_comment": 27, "author": "奇安信-华南基地", "tags": ["安全招聘"], "text": "360公司作为中国领先的互联网络安全企业，汇聚了国内规模领先的高水平安全技术团队，360企业安全华南研发基地现诚聘英才。"}
{"title": "弱密码惹的祸！全球约三分之一大企业CEO的邮箱账户和密码遭曝光", "url": "https://www.freebuf.com/news/151986.html", "time": "2017-10-31", "level": "", "num_look": 576148, "num_comment": 1, "author": "hyde777", "tags": ["数据安全", "资讯"], "text": "由于在多个帐户中重复使用相同且较简单的密码，全球约三分之一的大型公司 CEO 的工作邮箱账户和密码被盗，连带其家庭住址、公司机密、私人邮件内容等私密信息均遭到曝光。"}
{"title": "补卡的糟糕经历引发的思考：一点黑客技术让我们不再泄露那么多数据", "url": "https://www.freebuf.com/articles/database/151028.html", "time": "2017-10-31", "level": "现金奖励", "num_look": 685666, "num_comment": 14, "author": "ChuanFile", "tags": ["数据安全", "观点"], "text": "作为搞安全的同学不得不多思考下这个经典的安全问题，移动为什么设置这个策略，他们是用什么逻辑证明这个关于我的问题：1、你是你 2、设备是你的3、你在用你的设备。"}
{"title": "逆向实践：批量验证微信号是否存在", "url": "https://www.freebuf.com/articles/terminal/151937.html", "time": "2017-10-31", "level": "现金奖励", "num_look": 442072, "num_comment": 11, "author": "siotb", "tags": ["终端安全"], "text": "xposed是一款安卓平台下强大的hook框架，我们可以用他来开发很多强大的插件，以此来帮助我们更方便地解决某些实际的问题。本文将尝试利用xposed来解决一个实际问题：如何批量地验证微信号是否存在。"}
{"title": "BUF早餐铺 | 研究人员研制出新的双因素认证；谷歌将关停 Chrome 对 PKP 的支持；部分 Bad Rabbit 受害者不用付赎金就可以恢复文件；比特币中国停止提现", "url": "https://www.freebuf.com/news/152390.html", "time": "2017-10-31", "level": "", "num_look": 206120, "num_comment": 206120, "author": "AngelaY", "tags": ["资讯"], "text": "10月的最后一天，也要好好吃早餐哦~"}
{"title": "快讯 | 部分Bad Rabbit受害者不用付赎金就可以恢复文件", "url": "https://www.freebuf.com/news/152248.html", "time": "2017-10-30", "level": "红色标题", "num_look": 341539, "num_comment": 1, "author": "liki", "tags": ["终端安全", "资讯"], "text": "今天，卡巴斯基发布了新的研究报告，他们发现 Bad Rabbit 中有两个明显的漏洞。一些“幸运”的 Bad Rabbit 受害者可以利用勒索软件中存在的小错误来绕过赎金。"}
{"title": "VirtualApp技术黑产利用研究报告", "url": "https://www.freebuf.com/articles/paper/152091.html", "time": "2017-10-30", "level": "红色标题", "num_look": 890495, "num_comment": 10, "author": "腾讯手机管家", "tags": ["安全报告"], "text": "VirtualApp（以下称VA）是一个App虚拟化引擎（简称VA）。VirtualApp创建了一个虚拟空间，你可以在虚拟空间内任意的安装、启动和卸载APK，这一切都与外部隔离，如同一个沙盒。"}
{"title": "开源漏洞管理工具DefectDojo（一）使用指南：安装配置", "url": "https://www.freebuf.com/sectool/151611.html", "time": "2017-10-30", "level": "现金奖励", "num_look": 571396, "num_comment": 11, "author": "Shad0wpf_", "tags": ["工具"], "text": "DefectDojo正是一款解决漏洞管理之痛的开源工具，DefectDojo可将各种漏洞报告（Nessus、Nmap、Burp等）汇总分析，对漏洞的确认、复测进行跟踪，建立计划扫描任务，导出报告等。"}
{"title": "Tomcat源代码调试：看不见的Shell第一式", "url": "https://www.freebuf.com/articles/web/151431.html", "time": "2017-10-30", "level": "金币+12", "num_look": 362383, "num_comment": 4, "author": "n1nty", "tags": ["WEB安全"], "text": "抱着隐藏 shell 的目的去调试的 tomcat 的代码。我调试了tomcat 从接收到一个socket 到解析socket 并封装成Request 转发至 Jsp/Servlet 的全过程，找到了两个较为容易实现的方法。"}
{"title": "浙江宇视科技诚聘高级安全人才", "url": "https://www.freebuf.com/jobs/152187.html", "time": "2017-10-30", "level": "", "num_look": 227262, "num_comment": 9, "author": "SixSixSix", "tags": ["安全招聘"], "text": "浙江宇视科技有限公司（简称“宇视科技”）是领先的专业视频监控产品及解决方案供应商，致力于面向全球各行业客户提供领先的监控产品与解决方案及专业优质服务。"}
{"title": "卡巴斯基揭秘 | NSA黑客工具是如何被泄露的？", "url": "https://www.freebuf.com/news/151973.html", "time": "2017-10-30", "level": "红色标题", "num_look": 566558, "num_comment": 9, "author": "Sphinx", "tags": ["资讯"], "text": "俄罗斯杀毒软件厂商卡巴斯基发布了一份报告，阐述了另一个版本的“卡巴斯基窃取美国政府文件”事件。"}
{"title": "软件安全构建成熟度模型演变与分析", "url": "https://www.freebuf.com/articles/es/151822.html", "time": "2017-10-30", "level": "", "num_look": 535885, "num_comment": 535885, "author": "奇安信代码卫士", "tags": ["企业安全"], "text": "本文介绍了BSIMM、SAMM、SDL优化模型、CMMI+SAFE等四款软件安全构建成熟度模型，分析了这些模型近年来的演变及其产生的原因。"}
{"title": "渗透测试思路 | Linux下自动化搭建FakeAP，劫持用户在Portal认证下的所有流量", "url": "https://www.freebuf.com/articles/wireless/151734.html", "time": "2017-10-30", "level": "现金奖励", "num_look": 862604, "num_comment": 10, "author": "koerle", "tags": ["无线安全", "网络安全"], "text": "如何在linux下搭建一个fakeap，使得portal认证下的用户无法发现连接你的假AP，并且能够正常上网。"}
{"title": "利用Burp Suite对OWASP Juice Shop进行渗透测试", "url": "https://www.freebuf.com/sectool/151920.html", "time": "2017-10-30", "level": "", "num_look": 493906, "num_comment": 11, "author": "兰云科技银河实验室", "tags": ["工具"], "text": "本文将展示如何利用著名的Web 渗透工具Burp Suite 来进行渗透测试。"}
{"title": "Buf早餐铺 | AI 轻易破解CAPTCHA验证码；卫星通讯系统SATCOM中发现后门账号和SQL注入问题；Amazon发布智能AmazonKey产品", "url": "https://www.freebuf.com/news/152090.html", "time": "2017-10-30", "level": "", "num_look": 243509, "num_comment": 243509, "author": "Elaine_z", "tags": ["资讯"], "text": "早起你需要来点咖啡吗？不，我在阅读FreeBuf早餐铺。"}
{"title": "过期链接劫持的利用方法探讨（附工具）", "url": "https://www.freebuf.com/articles/web/151836.html", "time": "2017-10-29", "level": "", "num_look": 417442, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "过期链接劫持（BLH）的情况一般发生在当一个目标链接指向过期域名或网站页面的时候。过期链接劫持主要有两种形式，即反射型和存储型。"}
{"title": "正则表达式基础库源码审计与漏洞分析", "url": "https://www.freebuf.com/vuls/151430.html", "time": "2017-10-29", "level": "", "num_look": 432896, "num_comment": 3, "author": "奇安信代码卫士", "tags": ["漏洞"], "text": "正则表达式是字符串处理的基本功能，它使用单个字符串来描述、匹配一系列符合某个句法规则的字符串，绝大部分语言库都提供了正则表达式的功能"}
{"title": "Dance In Heap（四）：一些堆利用的方法（下）", "url": "https://www.freebuf.com/articles/system/151435.html", "time": "2017-10-29", "level": "金币+12", "num_look": 305015, "num_comment": 305015, "author": "hellowuzekai", "tags": ["系统安全"], "text": "本篇文章是系列的最后一篇，主要分析一下House系列的几个典型漏洞，关于堆利用的后续学习，大家可以关注 shellphish 团队的 how2heap 项目."}
{"title": "基于Openresty实现透明部署动态口令功能", "url": "https://www.freebuf.com/articles/network/150959.html", "time": "2017-10-29", "level": "现金奖励", "num_look": 618050, "num_comment": 7, "author": "chenjc", "tags": ["网络安全"], "text": "今天来讲讲基于openresty来实现透明部署动态口令功能，动态口令的基础概念这里就不讲了，网上的介绍很多，下面直入正题。"}
{"title": "Mac系统的Proton恶意软件：卷！土！重！来！", "url": "https://www.freebuf.com/articles/system/151614.html", "time": "2017-10-28", "level": "", "num_look": 309024, "num_comment": 1, "author": "Carrie_spinfo", "tags": ["系统安全"], "text": "Mac恶意软件OSX.Proton强势回归，这次他们的袭击目标是Eliteima官网上发布的Elmedia Player应用程序副本。"}
{"title": "Google PDFium TIFF Image Flate解码器代码执行漏洞分析（CVE-2017-5133）", "url": "https://www.freebuf.com/vuls/151406.html", "time": "2017-10-28", "level": "", "num_look": 396612, "num_comment": 6, "author": "生如夏花", "tags": ["漏洞"], "text": "由Chrome浏览器使用的包含60.0.3112.101的Pdfium的TIFF图像解码器功能中的堆漏洞存在一个读取/写入漏洞。"}
{"title": "Typecho反序列化漏洞导致前台getshell", "url": "https://www.freebuf.com/vuls/152058.html", "time": "2017-10-28", "level": "现金奖励", "num_look": 725050, "num_comment": 25, "author": "VIPKID安全团队", "tags": ["漏洞"], "text": "最早知道这个漏洞是在一个微信群里，说是install.php文件里面有个后门，看到别人给的截图一看就知道是个PHP反序列化漏洞，赶紧上服务器看了看自己的博客，发现自己也中招了。"}
{"title": "Dance In Heap（三）：一些堆利用的方法（中）", "url": "https://www.freebuf.com/articles/system/151428.html", "time": "2017-10-28", "level": "现金奖励", "num_look": 279830, "num_comment": 1, "author": "hellowuzekai", "tags": ["系统安全"], "text": "在本篇中，我们主要讨论如何将对一个对一个chunk进行复用来进行某种攻击测试"}
{"title": "APT28又开始活跃了，然而并没有什么用", "url": "https://www.freebuf.com/news/151628.html", "time": "2017-10-28", "level": "", "num_look": 236039, "num_comment": 3, "author": "liki", "tags": ["资讯"], "text": "APT28 看来可以获得今年安全奥斯卡的史诗级失败奖了。因为他们对参加 CyCon 安全大会的专家们使用了鱼叉式钓鱼攻击。"}
{"title": "IoT_reaper : 一个正在快速扩张的新型IoT僵尸网络", "url": "https://www.freebuf.com/articles/terminal/151970.html", "time": "2017-10-27", "level": "", "num_look": 355912, "num_comment": 2, "author": "360安全", "tags": ["终端安全"], "text": "从2017-09-13 01:02:13开始，360网络安全研究院捕获到一个新的针对iot设备的恶意样本出现，在随后的这个一个多月时间里，这个新的IoT僵尸网络家族不断持续更新。"}
{"title": "对话WitAdwards 2017专家评委 | 默安科技联合创始人兼CTO云舒", "url": "https://www.freebuf.com/articles/people/152035.html", "time": "2017-10-27", "level": "红色标题", "num_look": 465993, "num_comment": 8, "author": "AngelaY", "tags": ["人物志", "活动"], "text": "WitAwards 2017 互联网安全年度评选专家评委风采：默安科技联合创始人兼CTO云舒，知名网络安全研究人员，知乎著名活跃用户，黄焖鸡米饭深度爱好者。"}
{"title": "如何恢复Linux下误删etc目录数据", "url": "https://www.freebuf.com/articles/database/151402.html", "time": "2017-10-27", "level": "金币+8", "num_look": 577445, "num_comment": 7, "author": "悬镜安全实验室", "tags": ["数据安全"], "text": "山重水复疑无路，误删文件能恢复！今天就给大家分享一个在误删/etc目录后，救命止损的数据恢复教程。"}
{"title": "快讯 | 继CoinHive后，JQuery官方博客也被黑了", "url": "https://www.freebuf.com/news/152068.html", "time": "2017-10-27", "level": "红色标题", "num_look": 285606, "num_comment": 5, "author": "liki", "tags": ["资讯"], "text": "FreeBuf 先前报道过，分发挖矿 javascript 的网站 CoinHive 被黑了，而且影响范围很广，今天，又有新闻爆出，前端领域经久不衰的老牌第三方库 jQuery 的官方博客也被黑了。"}
{"title": "Android新型勒索病毒：加密文件内容，锁定手机屏幕", "url": "https://www.freebuf.com/articles/terminal/151375.html", "time": "2017-10-27", "level": "", "num_look": 373566, "num_comment": 6, "author": "腾讯手机管家", "tags": ["终端安全"], "text": "DoubleLocker与今年6月份曝出的手机版WannaCry病毒相比，除了会通过加密用户数据（譬如手机相册）向受害人勒索钱财之外，还会锁定手机致使用户无法使用"}
{"title": "大疆创新互联网事业部招聘安全工程师", "url": "https://www.freebuf.com/jobs/151383.html", "time": "2017-10-27", "level": "", "num_look": 306345, "num_comment": 10, "author": "saberma", "tags": ["安全招聘"], "text": "DJI 大疆创新是世界上最热门的消费级无人机生产商，总部位于中国深圳，2015 年销售额破 10 亿美元，估值近 100 亿美元。"}
{"title": "走进科学 | Harioboy水坑攻击这点事", "url": "https://www.freebuf.com/articles/terminal/151456.html", "time": "2017-10-27", "level": "红色标题", "num_look": 585929, "num_comment": 7, "author": "腾讯电脑管家", "tags": ["终端安全"], "text": "一大波小黑，或许是为了免费体验Roblox游戏和Discord游戏聊天平台，虚心了学习 Harioboy（网络ID）上传至Youtube的破解视频，哼着小曲，玩着游戏……"}
{"title": "Dance In Heap（二）：一些堆利用的方法（上）", "url": "https://www.freebuf.com/articles/system/151407.html", "time": "2017-10-27", "level": "现金奖励", "num_look": 359649, "num_comment": 6, "author": "hellowuzekai", "tags": ["系统安全"], "text": "在这篇文章里，我们就结合上文提到的这些机制，以64位为例来看一看如何对堆进行攻击，本篇文章先稍微讲解了一下UAF漏洞。"}
{"title": "新型僵尸网络：Wonder Botnet深入分析", "url": "https://www.freebuf.com/news/151635.html", "time": "2017-10-27", "level": "金币+8", "num_look": 350318, "num_comment": 3, "author": "JingleCats", "tags": ["WEB安全", "资讯"], "text": "该恶意软件由Downloader和真正的Bot两部分组成，通过一些规避技术躲避检测分析，隐藏自己的恶意行为。"}
{"title": "伪谷歌应用窃取加密货币交易所的用户信息", "url": "https://www.freebuf.com/articles/terminal/151677.html", "time": "2017-10-27", "level": "金币+8", "num_look": 245120, "num_comment": 3, "author": "J1anCan", "tags": ["终端安全"], "text": "近日，研究人员在谷歌应用商店上发现了伪装成合法应用的两个恶意软件来窃取用户的登录凭据，其中，Poloniex  加密货币交易所的用户是这些伪应用的头号目标。"}
{"title": "BUF 早餐铺 | Bad Rabbit 或与 NotPetya 有关；“打包党”威胁愈加严重；黑客劫持了 CoinHive 的 DNS；Appleby承认泄露大量信息", "url": "https://www.freebuf.com/news/151972.html", "time": "2017-10-27", "level": "", "num_look": 179314, "num_comment": 1, "author": "liki", "tags": ["资讯"], "text": "Bad Rabbit 或与 NotPetya 有关；百慕大法律公司Appleby承认泄露大量富人信息；Google Play Protect 对安卓病毒的检测能力不佳；“打包党”威胁愈加严重，甚至可以操控用户手机。"}
{"title": "快讯 | 众多安全公司表示，这次的Bad Rabbit或与NotPetya有关", "url": "https://www.freebuf.com/news/151961.html", "time": "2017-10-26", "level": "红色标题", "num_look": 219041, "num_comment": 3, "author": "liki", "tags": ["资讯"], "text": "已经有很多安全公司确认，昨日 Bad Rabbit 勒索软件的大规模爆发和今年六月底的 NotPetya 有关联。"}
{"title": "FreeBuf企业安全俱乐部杭州站速描 | 智能时代的安全新思维", "url": "https://www.freebuf.com/news/151790.html", "time": "2017-10-26", "level": "", "num_look": 195824, "num_comment": 4, "author": "FB客服", "tags": ["活动", "资讯"], "text": "FreeBuf企业安全俱乐部品牌沙龙活动来到“人间天堂“杭州，本次活动吸引了50多位CSO、企业安全负责人、企业安全从业人员以及企业SRC。"}
{"title": "重建信任第一步：卡巴斯基将向第三方审查机构提供反病毒软件源代码", "url": "https://www.freebuf.com/news/151637.html", "time": "2017-10-26", "level": "", "num_look": 344622, "num_comment": 3, "author": "hyde777", "tags": ["系统安全", "资讯"], "text": "本月23日，俄罗斯的杀毒软件公司卡巴斯基以“ 全透明计划 ” 高调宣布回归，该计划允许独立的第三方审查机构审查其软件源代码及内部流程。"}
{"title": "Petya昨日重现：Bad Rabbit勒索病毒分析", "url": "https://www.freebuf.com/articles/terminal/151916.html", "time": "2017-10-26", "level": "", "num_look": 339834, "num_comment": 3, "author": "360安全", "tags": ["终端安全"], "text": "近日，360互联网安全中心检测到一款名为“Bad Rabbit”的新型敲诈者木马在东欧为主的各个国家和地区开始传播。"}
{"title": "国产网站恶意代码监测（网马监控）工具优化版", "url": "https://www.freebuf.com/sectool/150647.html", "time": "2017-10-26", "level": "红色标题", "num_look": 692945, "num_comment": 32, "author": "鬼魅羊羔", "tags": ["工具"], "text": "好久没写东西了，十九大要召开了，忙坏了我们这群做安全的小屌丝们~国庆也没放假，哎~说正题吧，很久之前发过一次这个工具，只不过有很多问题，监控效率也不高，这次优化了下。"}
{"title": "奇虎360核心安全事业部招聘安全优等生", "url": "https://www.freebuf.com/jobs/151377.html", "time": "2017-10-26", "level": "", "num_look": 321727, "num_comment": 11, "author": "360HR77喵", "tags": ["安全招聘"], "text": "360公司作为中国领先的互联网络安全企业，汇聚了国内规模领先的高水平安全技术团队，积累了接近万件原创技术和核心技术的专利"}
{"title": "继WPA2之后，新加密攻击DUHK曝出：可恢复加密密钥、获取通讯内容", "url": "https://www.freebuf.com/articles/database/151839.html", "time": "2017-10-26", "level": "", "num_look": 523547, "num_comment": 2, "author": "hyde777", "tags": ["数据安全", "网络安全"], "text": "本周研究员发现了一种名为 DUHK（Don't Use Hard-code Keys） 的新型加密攻击，影响到多家厂商。"}
{"title": "揭秘美国黑产，购物券欺诈对商业活动的危害", "url": "https://www.freebuf.com/articles/es/151807.html", "time": "2017-10-26", "level": "红色标题", "num_look": 465069, "num_comment": 5, "author": "顶象技术", "tags": ["企业安全"], "text": "业务风险并不是作为互联网、电商大国中国独有的问题，美国同行同样遭到众多专业黑产的侵袭。数量级虽不及中国之巨，却也足以对美国电商行业的发展造成重大危害。"}
{"title": "Dance In Heap（一）：浅析堆的申请释放及相应保护机制", "url": "https://www.freebuf.com/articles/system/151372.html", "time": "2017-10-26", "level": "现金奖励", "num_look": 449841, "num_comment": 6, "author": "hellowuzekai", "tags": ["系统安全"], "text": "在内存中，堆是一个很有趣的地方，因为它可以由用户去直接的进行分配与销毁，所以也产生了一些很有趣、奇思妙想的漏洞，像unlink漏洞、House系列漏洞等等。"}
{"title": "日益扩大的IoT僵尸网络威胁或将摧毁互联网", "url": "https://www.freebuf.com/news/151490.html", "time": "2017-10-26", "level": "", "num_look": 291015, "num_comment": 9, "author": "Sphinx", "tags": ["资讯"], "text": "一年前，最大的基于物联网的病毒Mirai通过发动大规模DDoS攻击造成网络中断。现在又有另一款基于IoT的僵尸网络浮出水面。"}
{"title": "全方位绕过软WAF攻略", "url": "https://www.freebuf.com/articles/network/150646.html", "time": "2017-10-26", "level": "现金奖励", "num_look": 944883, "num_comment": 32, "author": "Only_wait", "tags": ["网络安全"], "text": "现在软waf较为多，就在今年夏天苦逼挖洞的日子里经常遇到360主机卫士，安全狗，云锁之类的软waf进行拦截。"}
{"title": "BUF 早餐铺 | 新型恶意软件“Bad Rabbit”闪击东欧；继KRACK 加密攻击之后，DUHK又敲加密安全警钟；Google测试新功能隐藏DNS请求", "url": "https://www.freebuf.com/news/151905.html", "time": "2017-10-26", "level": "", "num_look": 188987, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "新型恶意软件“Bad Rabbit”闪击东欧；继KRACK 加密攻击之后，DUHK又敲加密安全警钟；入侵Netflix 的黑客表示他们入侵了英国医院，可以泄漏名人的整容前照片。"}
{"title": "新型勒索软件Bad Rabbit在东欧诸国爆发，已造成多家公司受害", "url": "https://www.freebuf.com/news/151827.html", "time": "2017-10-26", "level": "", "num_look": 153003, "num_comment": 153003, "author": "腾讯电脑管家", "tags": ["资讯"], "text": "腾讯反病毒实验室根据相关报道，基于自身的安全大数据获得此次攻击使用的勒索软件样本，在此对该事件做一些梳理及分析，与国内外安全厂商共享。"}
{"title": "快讯 | 新型恶意软件“Bad Rabbit”闪击东欧（文末附IOCs）", "url": "https://www.freebuf.com/news/151809.html", "time": "2017-10-25", "level": "红色标题", "num_look": 637043, "num_comment": 4, "author": "liki", "tags": ["资讯"], "text": "近日，一种新型的恶意软件“Bad Rabbit”在东欧国家引起了一阵不小的骚乱，政府和商业机构也遭到了冲击。"}
{"title": "对话WitAdwards 2017专家评委 | 探访普华永道高级经理刘广坤", "url": "https://www.freebuf.com/articles/people/151553.html", "time": "2017-10-25", "level": "红色标题", "num_look": 390496, "num_comment": 2, "author": "Elaine_z", "tags": ["人物志", "活动"], "text": "WitAdwards 评选中专业的评委在其中扮演了重要的角色，今天我们来介绍的是来自普华永道中国中区网络安全服务部门的高级经理刘广坤。"}
{"title": "如何绕过Intel Boot Guard", "url": "https://www.freebuf.com/articles/system/151317.html", "time": "2017-10-25", "level": "", "num_look": 481850, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "近些年来，安全社区中关注UEFI BIOS安全问题的人也越来越多了。因此也诞生出了很多用于保护UEFI BIOS免受非法篡改的先进技术。"}
{"title": "简易Python Selenium爬虫实现歌曲免费下载", "url": "https://www.freebuf.com/sectool/151282.html", "time": "2017-10-25", "level": "现金奖励", "num_look": 704342, "num_comment": 32, "author": "GreyyHawk", "tags": ["WEB安全", "工具"], "text": "最近发现越来越多的歌曲下载都需要缴费了，对维护正版是好事。但有的时候也想钻个空子，正好最近在学习python，随手写了一个建议爬虫，用来爬取某播放软件的在线音乐。"}
{"title": "联想集团诚聘安全专家", "url": "https://www.freebuf.com/jobs/150945.html", "time": "2017-10-25", "level": "", "num_look": 254468, "num_comment": 14, "author": "xiaohang1", "tags": ["安全招聘"], "text": "联想电脑管家，致力于为用户提供最纯净的，最“官方”的安全软件，堪称安全界的的一股清流。"}
{"title": "中国网民网络安全意识调研报告", "url": "https://www.freebuf.com/articles/paper/151673.html", "time": "2017-10-25", "level": "", "num_look": 350340, "num_comment": 7, "author": "360安全", "tags": ["安全报告"], "text": "约九成网民认为当前的网络环境是安全的。其中，49.1%的网民认为当前的网络环境比较安全；32.8%的网民认为一般安全；6.9%的网民认为非常安全。"}
{"title": "偏执的iOS逆向研究员：收集全版本的macOS iOS+越狱+内核调试", "url": "https://www.freebuf.com/articles/terminal/151326.html", "time": "2017-10-25", "level": "现金奖励", "num_look": 601263, "num_comment": 22, "author": "Roy_Chen", "tags": ["终端安全"], "text": "虽然“只有偏执狂才能够生存”这句话已经被假药停给毁了，但是作为一只有逼格的高大上的iOS逆向分析研究员，难道如果有现成的macOS/iOS全版本镜像可以下载并且无限“漫游”，难道你就不想来一套么？"}
{"title": "微软被曝在2013年曾遭遇过一次数据泄露事件", "url": "https://www.freebuf.com/news/151128.html", "time": "2017-10-25", "level": "", "num_look": 415510, "num_comment": 415510, "author": "Alpha_h4ck", "tags": ["数据安全", "资讯"], "text": "就在昨日，五名微软公司的前任员工在接受路透社的采访时表示，微软的漏洞报告数据在2013年时曾遭到过一次非法入侵，但这一事件在当时并没有被曝光出来。"}
{"title": "Padding oracle attack详细解析", "url": "https://www.freebuf.com/articles/database/151167.html", "time": "2017-10-25", "level": "现金奖励", "num_look": 540410, "num_comment": 5, "author": "flurry", "tags": ["数据安全"], "text": "前段时间遇到一个挺有意思的题目，用到了padding oracle attack的相关知识，于是恶补了一下padding oracle attack相关内容，发现有许多需要知道的预备知识。"}
{"title": "BUF 早餐铺 | 卡巴斯基将向第三方审查机构提供反病毒软件源代码以重建信任；Chrome 扩展程序中又现挖矿软件；中国黑客发现 iOS11 系统漏洞", "url": "https://www.freebuf.com/news/151743.html", "time": "2017-10-25", "level": "", "num_look": 202200, "num_comment": 202200, "author": "AngelaY", "tags": ["资讯"], "text": "俄罗斯 APT28 组织又开始活跃，这次却蠢头蠢脑；谷歌尝试为安卓系统添加 DNS over TLS 功能，提升 DNS 安全；Windows 10 抗勒索软件功能上线"}
{"title": "这帮人在GeekPwn 2017上“破解”了iPhone 8，还顺便调戏了一波“妲己”", "url": "https://www.freebuf.com/fevents/151737.html", "time": "2017-10-24", "level": "红色标题", "num_look": 574350, "num_comment": 14, "author": "Akane", "tags": ["活动"], "text": "10月24日，GeekPwn 2017上海站战火重燃，这里虽然没有硝烟味，但平时只有在科幻电影里才能见到大场面却在这儿频频上演。"}
{"title": "看我如何研究并发现了洛比机器人的漏洞", "url": "https://www.freebuf.com/geek/150924.html", "time": "2017-10-24", "level": "", "num_look": 282929, "num_comment": 4, "author": "Covfefe", "tags": ["极客"], "text": "上个月末，我们的实验室迎来了一个非常重要的“人”：Robi机器人（他有一个摄像头和一个扬声器！）。我们有幸组装了它，然后让它跳起了舞。"}
{"title": "世界的1024，你的1024｜FIT大会门票节日专享", "url": "https://www.freebuf.com/fevents/151625.html", "time": "2017-10-24", "level": "红色标题", "num_look": 485999, "num_comment": 61, "author": "FB客服", "tags": ["活动"], "text": "当我们谈论1024时，我们在谈论什么？"}
{"title": "思科修复云服务平台重大漏洞", "url": "https://www.freebuf.com/news/151472.html", "time": "2017-10-24", "level": "", "num_look": 272513, "num_comment": 1, "author": "liki", "tags": ["漏洞", "资讯"], "text": "近日，思科修复了云服务产品线上包括云服务平台（CSP），可扩展 Firepower 操作系统（FXOS），NX-OS软件以及一些小型企业 IP 电话上的高危漏洞。"}
{"title": "成都若逊信息技术招聘渗透测试工程师", "url": "https://www.freebuf.com/jobs/150970.html", "time": "2017-10-24", "level": "", "num_look": 264144, "num_comment": 7, "author": "liu12xin", "tags": ["安全招聘"], "text": "成都若逊信息技术是新成立的创业公司，定位于互联网行业项目的整体解决方案，致力于信息安全领域。"}
{"title": "国内四大抗DDoS服务分析评测", "url": "https://www.freebuf.com/articles/network/151095.html", "time": "2017-10-24", "level": "金币+15", "num_look": 941472, "num_comment": 13, "author": "ESTHERYOYOYO", "tags": ["网络安全", "观点"], "text": "在DDoS攻击越来越普遍的今天，应对DDoS 攻击的方式也越来越多，自然也涌出许多优秀的第三方的防护服务。"}
{"title": "分享一个近期遇到的逻辑漏洞案例", "url": "https://www.freebuf.com/vuls/151196.html", "time": "2017-10-24", "level": "现金奖励", "num_look": 686009, "num_comment": 19, "author": "小石", "tags": ["WEB安全", "漏洞"], "text": "做了一个近期遇到的逻辑漏洞思维导图，再拿几个案例跟大家分享交流一下。"}
{"title": "Google Play Store启动漏洞赏金计划保护Android应用", "url": "https://www.freebuf.com/news/151363.html", "time": "2017-10-24", "level": "", "num_look": 270221, "num_comment": 270221, "author": "Sphinx", "tags": ["资讯"], "text": "Google终于发布了Google Play Store的漏洞赏金计划，安全人员可以寻找或者报告Android应用中存在的漏洞。"}
{"title": "DLL注入新姿势：反射式DLL注入研究", "url": "https://www.freebuf.com/articles/system/151161.html", "time": "2017-10-24", "level": "现金奖励", "num_look": 596808, "num_comment": 17, "author": "无。", "tags": ["系统安全"], "text": "由于目前互联网上有关这个反射式DLL注入的分析并不多，也没有人分析其核心的ReflectiveLoader具体是怎么实现的，因此我就在这抛砖引玉了。"}
{"title": "【已结束】GeekPwn大赛七大看点曝光，现场盛况视频直播", "url": "https://www.freebuf.com/fevents/150721.html", "time": "2017-10-24", "level": "红色标题", "num_look": 258071, "num_comment": 3, "author": "Akane", "tags": ["活动"], "text": "机器人真的会肆无忌惮地“造反”吗？人类能躲过人工智能的威胁吗？到底谁会大胆站出来，保卫人类安全？10月24日早晨9:00开始，视频盛况视频直播，咱不见不散！"}
{"title": "Buf早餐铺 | APT组织又在针对关键基础设施企业实施攻击；Elmedia中发现Proton恶意软件；NetBSD与OpenBSD加入内核ASLR机制", "url": "https://www.freebuf.com/news/151477.html", "time": "2017-10-24", "level": "", "num_look": 178685, "num_comment": 1, "author": "Elaine_z", "tags": ["资讯"], "text": "秋风起，日渐凉，今天新闻有哪些？"}
{"title": "斗象智能安全平台正式开源漏洞检测框架Osprey「鱼鹰」", "url": "https://www.freebuf.com/news/151593.html", "time": "2017-10-23", "level": "红色标题", "num_look": 569225, "num_comment": 7, "author": "斗象智能安全平台", "tags": ["工具", "资讯"], "text": "网藤智能安全宣布正式开源鱼鹰漏洞检测框架工具。"}
{"title": "对话WitAwards 2017专家评委 | 独角兽安全团队创始人杨卿", "url": "https://www.freebuf.com/articles/people/150891.html", "time": "2017-10-23", "level": "红色标题", "num_look": 444775, "num_comment": 9, "author": "AngelaY", "tags": ["人物志", "活动"], "text": "WitAwards 2017 互联网安全年度评选专家评委杨卿：颜值高、技术硬的无线电攻防专家；360 独角兽团队创始人。"}
{"title": "Windows DNS API RCE漏洞分析及PoC构造", "url": "https://www.freebuf.com/vuls/151050.html", "time": "2017-10-23", "level": "金币+8", "num_look": 362887, "num_comment": 1, "author": "viccon", "tags": ["漏洞"], "text": "根据 Microsoft 2017 年 10 月安全通告，多个版本 Windows 中的 dnsapi.dll 在处理 DNS response 时可导致 SYSTEM 权限 RCE。"}
{"title": "PHP Collab中CVE-2017-6089和CVE-2017-6090漏洞的复现与简单分析", "url": "https://www.freebuf.com/vuls/150955.html", "time": "2017-10-23", "level": "金币+8", "num_look": 345286, "num_comment": 2, "author": "navyofficer", "tags": ["漏洞"], "text": "Phpcollab是一款开源的Web系统，可被多个组织用来通过互联网合作完成一个项目。有安全工作者发现其中存在SQL注入以及文件上传漏洞，下面作简要分析。"}
{"title": "爬虫采集去重优化浅谈", "url": "https://www.freebuf.com/articles/others-articles/151173.html", "time": "2017-10-23", "level": "现金奖励", "num_look": 481604, "num_comment": 14, "author": "dawner", "tags": ["其他"], "text": "以前在做漏洞Fuzz爬虫时，曾做过URL去重相关的工作，当时是参考了seay法师的文章以及网上零碎的一些资料，感觉做的很简单。近来又遇到相关问题，于是打算再次改进算法。"}
{"title": "宜人贷安全团队招聘", "url": "https://www.freebuf.com/jobs/150729.html", "time": "2017-10-23", "level": "", "num_look": 267906, "num_comment": 12, "author": "yirendai_sec", "tags": ["安全招聘"], "text": "宜人贷是一家潜力无限的金融科技公司！宜人安全team是一个和乐融融的团队！你知道的、你不知道的都在这里~"}
{"title": "WPA2密钥重装攻击原理分析", "url": "https://www.freebuf.com/news/150991.html", "time": "2017-10-23", "level": "金币+8", "num_look": 573346, "num_comment": 4, "author": "YoungC", "tags": ["网络安全", "资讯"], "text": "这两天最火爆的莫过 \"WPA2被破解\" 这一条大新闻了。我对其原理非常感兴趣，苦于没有找到的文献，所以就整理这么一篇，方便自己和大家理解。"}
{"title": "从反射链的构造看Java反序列漏洞", "url": "https://www.freebuf.com/news/150872.html", "time": "2017-10-23", "level": "现金奖励", "num_look": 558469, "num_comment": 8, "author": "zjie2O71", "tags": ["WEB安全", "漏洞"], "text": "今天我想从构造反射链的从无到有到被利用来谈谈java的反序列化漏洞，从反射的最开始到执行payload，一个从无到有的过程，首先我们介绍一下Transformer类。"}
{"title": "对深度学习的逃逸攻击：探究人工智能系统中的安全盲区", "url": "https://www.freebuf.com/articles/neopoints/151113.html", "time": "2017-10-23", "level": "", "num_look": 263873, "num_comment": 3, "author": "360安全", "tags": ["观点"], "text": "ISC 2017 中国互联网安全大会举办了人工智能安全论坛。 我们把论坛总结成为一系列文章，本文为系列中的第二篇。"}
{"title": "Buf早餐铺 | 挖矿程序在网页和游戏中日益泛滥；黑客大规模扫描SSH密钥；8款安卓应用中发现Sockbot恶意软件", "url": "https://www.freebuf.com/news/151346.html", "time": "2017-10-23", "level": "", "num_look": 187128, "num_comment": 187128, "author": "Elaine_z", "tags": ["资讯"], "text": "一场秋雨一场寒，记得要看早餐铺！"}
{"title": "Oracle Advanced Support系统SQL注入漏洞挖掘经验分享", "url": "https://www.freebuf.com/articles/system/150641.html", "time": "2017-10-22", "level": "金币+8", "num_look": 297869, "num_comment": 6, "author": "北其Gg", "tags": ["系统安全"], "text": "一年多前我在客户的一个外部环境中执行渗透测试，任何外部环境渗透测试的重要步骤之一就是挖掘出可访问的WEB服务。"}
{"title": "IE 11浏览器0day漏洞（CVE-2015-2425）UAF分析", "url": "https://www.freebuf.com/vuls/151019.html", "time": "2017-10-22", "level": "现金奖励", "num_look": 522492, "num_comment": 1, "author": "pwdme", "tags": ["漏洞"], "text": "CVE-2015-2425是Hacking team泄露出来的一个IE11的0day漏洞，影响了IE11及之前的版本。"}
{"title": "WiFi安全漏洞：WPA2安全协议遭破解的影响分析", "url": "https://www.freebuf.com/articles/wireless/150981.html", "time": "2017-10-22", "level": "", "num_look": 566413, "num_comment": 3, "author": "腾讯手机管家", "tags": ["无线安全"], "text": "10月16日研究员Mathy Vanhoef公布了对WPA2的秘钥重放重装攻击KRACK ，攻破了十几年没有安全问题的WPA2协议。"}
{"title": "相爱相杀：微软披露谷歌Chrome存在远程代码执行漏洞", "url": "https://www.freebuf.com/news/151215.html", "time": "2017-10-22", "level": "", "num_look": 364340, "num_comment": 2, "author": "JingleCats", "tags": ["漏洞", "资讯"], "text": "微软和谷歌的安全团队一直以“友好竞争”的关系互相曝料对方的产品漏洞。"}
{"title": "能从银行卡中读出身份证号码，你信吗？", "url": "https://www.freebuf.com/articles/terminal/150644.html", "time": "2017-10-21", "level": "金币+8", "num_look": 504189, "num_comment": 14, "author": "mulangaofeng", "tags": ["终端安全"], "text": "提到敏感信息大家首先会想到身份证号，如果身份证号泄露会发生哪些危害呢，违法分子用来办信用卡、挂失你的银行卡、中介骗婚等。这其中的危害真是让人防不胜防，今天和大家一起来完成从带芯片的银行卡中读取身份证…"}
{"title": "利用静态分析加固开源入侵检测系统（IDS）的最佳实践", "url": "https://www.freebuf.com/articles/web/150642.html", "time": "2017-10-21", "level": "金币+8", "num_look": 334500, "num_comment": 2, "author": "北其Gg", "tags": ["WEB安全"], "text": "入侵分析人员使用网络安全监控(NSM)的原理来保护计算机系统。NSM是“在对各种入侵进行检测和响应过程中，所涉及到的标识和警告环节的收集、分析和问题升级”。"}
{"title": "深入分析IE地址栏内容泄露漏洞", "url": "https://www.freebuf.com/articles/web/150640.html", "time": "2017-10-21", "level": "金币+8", "num_look": 303993, "num_comment": 4, "author": "北其Gg", "tags": ["WEB安全"], "text": "在本文中，我们探讨的对象是IE浏览器，尽管该浏览器略显老态，但是其用户还是很多的，所以不容忽视。我最近对MSRC感到很欣喜，因为他们正在将工作重心移至Edge浏览器、设计漏洞，甚至提高了漏洞赏金，这看起来确实…"}
{"title": "【FB TV】一周「BUF大事件」：WPA2惊现高危漏洞，你的WiFi还安全么？咨询巨头埃森哲被曝出安全问题；百度官方回应黄金眼事件", "url": "https://www.freebuf.com/video/151384.html", "time": "2017-10-21", "level": "红色标题", "num_look": 1183698, "num_comment": 2, "author": "willhuang", "tags": ["视频"], "text": "本周WPA2安全协议惊现高危漏洞，你的WiFi还安全么？咨询巨头埃森哲被曝出安全问题；百度官方回应黄金眼事件。"}
{"title": "多功能Python键盘记录工具：Radium", "url": "https://www.freebuf.com/sectool/150596.html", "time": "2017-10-20", "level": "", "num_look": 598827, "num_comment": 15, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的就是一款拥有多种功能的键盘记录工具-Radium，该工具采用Python语言编写。"}
{"title": "NSA事先到底知不知道KRACK漏洞？", "url": "https://www.freebuf.com/news/151220.html", "time": "2017-10-20", "level": "红色标题", "num_look": 273130, "num_comment": 3, "author": "Sphinx", "tags": ["资讯"], "text": "尽管美国国家安全局的信息保护署前几天发布了针对KRACK漏洞的警告，但发言人却拒绝评论。这是不是意味着NSA之前实现已经知道KRACK漏洞了？"}
{"title": "中东黑客组织使用Flash 0-day漏洞传播间谍软件FinFisher，Adobe紧急发布修复补丁", "url": "https://www.freebuf.com/news/150967.html", "time": "2017-10-20", "level": "", "num_look": 296077, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["漏洞", "资讯"], "text": "FinSpy 是一款臭名昭著的网络间谍工具，而现在它又一次卷土重来，但随之而来的还有一个新的 Adobe Flash 0 day 漏洞-CVE-2017-11292。"}
{"title": "湖北灰科信息诚邀安全、技术大牛加入", "url": "https://www.freebuf.com/jobs/150660.html", "time": "2017-10-20", "level": "", "num_look": 280452, "num_comment": 16, "author": "灰科信息技术", "tags": ["安全招聘"], "text": "湖北灰科信息技术有限公司一家专业从事于为公检法等机关单位提供网络信息安全软件产品开发及相关技术服务的高科技公司。"}
{"title": "恶意软件Cutlet Maker死灰复燃，可轻易破解ATM（含演示视频）", "url": "https://www.freebuf.com/articles/terminal/151055.html", "time": "2017-10-20", "level": "", "num_look": 369827, "num_comment": 4, "author": "liki", "tags": ["终端安全"], "text": "卡巴斯基实验室的研究人员在地下暗网论坛中发现了这个恶意软件的广告，售价为 5000 美元，软件名为 Cutlet Maker。"}
{"title": "热门游戏被病毒团伙利用，每天感染数十万台电脑", "url": "https://www.freebuf.com/articles/system/150823.html", "time": "2017-10-20", "level": "红色标题", "num_look": 458931, "num_comment": 11, "author": "火绒安全", "tags": ["系统安全"], "text": "病毒团伙正在利用多款热门游戏疯狂传播后门病毒，每天有数十万台电脑受到感染。病毒制作者可随时通过远程指令对电脑做出下载其他病毒程序、劫持流量在内的多种破坏行为。"}
{"title": "快讯 | 三千万公民信息在网上泄露，这是南非史上最大的数据泄露事件", "url": "https://www.freebuf.com/news/151182.html", "time": "2017-10-20", "level": "", "num_look": 219727, "num_comment": 219727, "author": "liki", "tags": ["资讯"], "text": "这次的数据泄露事件由知名安全专家 Troy Hunt披露，他发现了大量关于南非公民的敏感信息，包括身份证号，个人收入，年龄，就业经历，公司领导层，民族，婚姻情况，职业，雇主信息和前地址等。"}
{"title": "360天巡实验室：如何使用WIPS产品对抗KRACK漏洞", "url": "https://www.freebuf.com/vuls/151054.html", "time": "2017-10-20", "level": "红色标题", "num_look": 499653, "num_comment": 13, "author": "360安全", "tags": ["无线安全", "漏洞"], "text": "近日，有安全研究员披露 WPA2 协议层中存在逻辑缺陷，几乎所有支持 Wi-Fi 的设备都面临威胁，其传输的数据存在被嗅探、篡改的风险。"}
{"title": "BUF早餐铺 | 南非曝本国史上最大信息泄露事件；时隔十年，黑客之门重出江湖；浏览器内挖矿肆虐，网络环境日益变差；Oracle十月修复252个漏洞", "url": "https://www.freebuf.com/news/151227.html", "time": "2017-10-20", "level": "", "num_look": 236979, "num_comment": 2, "author": "liki", "tags": ["资讯"], "text": "周末即将到来，希望大家都有好心情哦。"}
{"title": "机器学习黄金时代下，业务安全攻与防：Qcon2017上海「直击黑产」专题回顾", "url": "https://www.freebuf.com/fevents/151169.html", "time": "2017-10-19", "level": "", "num_look": 560335, "num_comment": 3, "author": "Elaine_z", "tags": ["企业安全", "活动"], "text": "信息安全没有银弹，也许因为攻防之战永不停歇，安全从业者不可能也无法高估任何方法的应用。在与黑色产业的对抗中，安全从业者需要以客观的态度面对技术和问题，并不断学习和改进。"}
{"title": "符号执行：利用Angr进行简单CTF逆向分析", "url": "https://www.freebuf.com/articles/web/150296.html", "time": "2017-10-19", "level": "现金奖励", "num_look": 612103, "num_comment": 3, "author": "hellowuzekai", "tags": ["WEB安全"], "text": "Angr是一个利用python开发的二进制程序分析框架，我们可以利用这个工具尝试对一些CTF题目进行符号执行来找到正确的解答，即flag。"}
{"title": "AI学习与DNS防御、开源漏洞检测框架与传说中的“羊毛党”：FreeTalk深圳站看点回顾（附PPT下载）", "url": "https://www.freebuf.com/fevents/150894.html", "time": "2017-10-19", "level": "红色标题", "num_look": 347498, "num_comment": 4, "author": "Akane", "tags": ["活动"], "text": "9月23日， FreeTalk 2017深圳站在深圳市洛客邦德馆成功举办。鹏城当日天气大好，本次活动也聚集了500多名安全从业人员与FB铁粉，可称热闹非凡。"}
{"title": "联想集团诚招安全人才", "url": "https://www.freebuf.com/jobs/150691.html", "time": "2017-10-19", "level": "", "num_look": 282533, "num_comment": 9, "author": "LenovoSecLab", "tags": ["安全招聘"], "text": "联想是全球消费、商用以及企业级创新科技的领导者。联想为用户提供安全及高品质的产品组合和服务。"}
{"title": "为顶级安全团队喝彩 | WitAwards 2017年度安全团队评选「报名进行中」", "url": "https://www.freebuf.com/news/149467.html", "time": "2017-10-19", "level": "", "num_look": 159823, "num_comment": 159823, "author": "FB客服", "tags": ["资讯"], "text": "WitAwards2017互联网安全年度评选，让我们以「年度安全团队」之名，向本年度在行业内最具影响力的中国顶级安全团队致敬，为他们喝彩。"}
{"title": "地下暗流：揭秘控制百万肉鸡的GhostFramework", "url": "https://www.freebuf.com/articles/terminal/150360.html", "time": "2017-10-19", "level": "红色标题", "num_look": 698094, "num_comment": 13, "author": "腾讯手机管家", "tags": ["终端安全"], "text": "公司化幕后运作，通过线下渠道恶意安装后门程序，受影响的”肉鸡”高达200万+。"}
{"title": "深入分析一款简单的Github信息泄露爬虫", "url": "https://www.freebuf.com/articles/web/150638.html", "time": "2017-10-19", "level": "现金奖励", "num_look": 870205, "num_comment": 15, "author": "grt1stnull", "tags": ["WEB安全"], "text": "Github作为一个代码托管平台，有着海量的开源代码和许多开发者。在代码上传时，有些开发者缺乏安全意识，会在不经意间泄露自己的密码或者密钥。"}
{"title": "影响美国大选的“投票机”漏洞依然存在", "url": "https://www.freebuf.com/articles/terminal/150557.html", "time": "2017-10-19", "level": "", "num_look": 211053, "num_comment": 211053, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "就在前几天，一群安全研究专家表示，之前影响美国总统大选投票机的安全漏洞目前仍然有可能被网络犯罪分子再一次利用。"}
{"title": "Nmap插件编写之MySQL写库", "url": "https://www.freebuf.com/articles/network/150613.html", "time": "2017-10-19", "level": "现金奖励", "num_look": 583231, "num_comment": 8, "author": "010sec", "tags": ["网络安全"], "text": "Nmap是一款针对大型网络的端口扫描工具，尽管它也适用于单机扫描。在不同情况下，你可能需要隐藏扫描、越过防火墙扫描或者使用不同的协议进行扫描。"}
{"title": "BUF早餐铺 | 恶意软件Cutlet Maker轻松掏空ATM；疑似朝鲜Lazarus黑客组织银行入侵行为曝光；微软隐瞒2013年遭遇的数据泄露事件", "url": "https://www.freebuf.com/news/151112.html", "time": "2017-10-19", "level": "", "num_look": 163280, "num_comment": 163280, "author": "Sphinx", "tags": ["资讯"], "text": "恶意软件Cutlet Maker再次上线，轻易掏空ATM；疑似朝鲜Lazarus黑客组织利用Hermes 勒索软件掩藏最近的银行入侵行为；微软隐瞒2013年遭遇的数据泄露事件。"}
{"title": "【已结束】肖煌博士人工智能安全的黑与白 AI安全嘉年华·公开课", "url": "https://www.freebuf.com/fevents/150668.html", "time": "2017-10-18", "level": "红色标题", "num_look": 369175, "num_comment": 7, "author": "FB客服", "tags": ["活动"], "text": "人工智能在信息安全领域的黑与白，18号晚20:00，我们一起来聊聊AI在Security的常见应用，研究方向以及AI本身的安全问题。"}
{"title": "Poet：一款功能强大的后渗透工具", "url": "https://www.freebuf.com/sectool/150461.html", "time": "2017-10-18", "level": "", "num_look": 521026, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["工具"], "text": "客户端程序需要运行在目标系统中，并且需要配置一个IP地址以及频率来与服务器连接。如果当客户端尝试与服务器连接时服务器不在线的话，客户端会处于静默睡眠状态，并等待下一次时间间隔来尝试连接。"}
{"title": "斯巴鲁汽车被曝漏洞，可克隆钥匙开车门", "url": "https://www.freebuf.com/news/150583.html", "time": "2017-10-18", "level": "红色标题", "num_look": 236043, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "近期，荷兰电子工业设计师在多款斯巴鲁汽车的钥匙系统中发现了一个严重的安全设计缺陷，厂商目前还没有修复这个漏洞，而该漏洞将会导致斯巴鲁汽车被劫持。"}
{"title": "微汇金融招聘渗透测试工程师", "url": "https://www.freebuf.com/jobs/150958.html", "time": "2017-10-18", "level": "", "num_look": 198177, "num_comment": 1, "author": "security_weihui", "tags": ["安全招聘"], "text": ""}
{"title": "漏洞分析 | 如何利用OAuth错误配置接管Flickr账号", "url": "https://www.freebuf.com/articles/web/150550.html", "time": "2017-10-18", "level": "", "num_look": 324506, "num_comment": 2, "author": "Sphinx", "tags": ["WEB安全"], "text": "Flickr是雅虎旗下的一个图片视频分享网站，想必大家很熟悉。雅虎现在使用了OAuth验证模式替代之前的登陆方式。本文作者通过检查登陆流程发现了其中的漏洞。"}
{"title": "实战Teensy烧录渗透测试U盘", "url": "https://www.freebuf.com/sectool/150367.html", "time": "2017-10-18", "level": "现金奖励", "num_look": 896327, "num_comment": 16, "author": "lr3800_", "tags": ["工具", "极客"], "text": "在2014年美国黑帽大会上，柏林SRLabs的安全研究人员JakobLell和独立安全研究人员Karsten Nohl展示了他们称为“BadUSB”(按照BadBIOS命名)的攻击方法。"}
{"title": "细致分析Padding Oracle渗透测试全解析", "url": "https://www.freebuf.com/articles/database/150606.html", "time": "2017-10-18", "level": "现金奖励", "num_look": 516296, "num_comment": 1, "author": "Sherkey", "tags": ["数据安全"], "text": "最近在研究Padding Oracle攻击，发现网上没有详细讲原理的文章。因此自己整理了这样一篇，希望哪怕是没有密码学基础的朋友也能看完后完全理解攻击的原理。"}
{"title": "WebUSB：一个网页是如何从你的手机中盗窃数据的（含PoC）", "url": "https://www.freebuf.com/articles/web/150335.html", "time": "2017-10-18", "level": "", "num_look": 598419, "num_comment": 3, "author": "Covfefe", "tags": ["WEB安全", "终端安全"], "text": "这篇文章探寻WebUSB的功能，以深入了解其工作原理，攻击方法及隐私问题。"}
{"title": "BUF 早餐铺 | 谷歌发布Chrome安全新功能；黑客组织使用Flash 0-day漏洞传播间谍软件；英飞凌TPM芯片存在弱RSA密钥；百度回应黄金眼事件", "url": "https://www.freebuf.com/news/150976.html", "time": "2017-10-18", "level": "", "num_look": 180159, "num_comment": 3, "author": "AngelaY", "tags": ["资讯"], "text": "匆匆又到周中，漏洞依然有，攻击依然在；业内趋势悄然有了小变化。来看今天的早报吧。"}
{"title": "必胜客官网遭入侵，支付卡信息可能泄露", "url": "https://www.freebuf.com/news/150797.html", "time": "2017-10-17", "level": "金币+6", "num_look": 232685, "num_comment": 2, "author": "JingleCats", "tags": ["资讯"], "text": "过去的一周，美国必胜客通知顾客由于网站遭到临时入侵，他们的支付卡信息和联系信息可能被盗。"}
{"title": "WPA2 密钥重装攻击 KRACK Attacks 分析报告", "url": "https://www.freebuf.com/articles/wireless/150953.html", "time": "2017-10-17", "level": "红色标题", "num_look": 936796, "num_comment": 22, "author": "360安全", "tags": ["无线安全"], "text": "本次的WPA2“密钥重装攻击”，基本原理为利用WPA协议层中的逻辑缺陷，多次重传握手过程中的消息3从而导致重放随机数和重播计数器，为攻击者提供了利用条件。"}
{"title": "乌克兰警方警告，新NotPetya类型的大规模网络攻击可能发生", "url": "https://www.freebuf.com/news/150738.html", "time": "2017-10-17", "level": "", "num_look": 189856, "num_comment": 189856, "author": "Sphinx", "tags": ["资讯"], "text": "乌克兰政府发布了警告，希望国民可以警惕下一波NotPetya类型的大规模网络攻击。"}
{"title": "WPA2安全协议惊现高危漏洞，几乎涉及所有WiFi设备（附固件升级列表）", "url": "https://www.freebuf.com/news/150917.html", "time": "2017-10-17", "level": "红色标题", "num_look": 997066, "num_comment": 12, "author": "liki", "tags": ["无线安全", "资讯"], "text": "近日，鲁汶大学的研究人员 Mathy Vanhoef 在 WPA2 协议中发现了严重的安全漏洞，这对无线网络的安全造成了极大的考验。"}
{"title": "4G/5G网络与WiFi一样不安全，智慧城市岌岌可危?", "url": "https://www.freebuf.com/articles/wireless/150424.html", "time": "2017-10-17", "level": "", "num_look": 438067, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["无线安全"], "text": "安全公司Positive Technologies的研究人员警告称，4G/5G无线网络与目前的WiFi一样存在安全问题，而这些安全问题会让智慧城市的构想变得岌岌可危。"}
{"title": "iPhone X人脸识别技术是否安全？", "url": "https://www.freebuf.com/articles/terminal/150492.html", "time": "2017-10-17", "level": "", "num_look": 318908, "num_comment": 3, "author": "SIGChina", "tags": ["终端安全"], "text": "人脸识别是最常见的生物识别访问控制技术之一。与其它生物识别系统不同，人脸所提供的信息能有广泛的应用，例如人脸信息可以显示性别、种族、年龄甚至情绪状况。"}
{"title": "将算法融入安全，让 AI 落地到防御：阿里云正开辟一条新赛道", "url": "https://www.freebuf.com/fevents/150842.html", "time": "2017-10-17", "level": "红色标题", "num_look": 245970, "num_comment": 4, "author": "AngelaY", "tags": ["活动"], "text": "作为云集计算机前沿技术和互联网创新理念的云栖大会，安全自然也是必不可少的关注点。"}
{"title": "陌陌科技诚聘安全各方面高级人才", "url": "https://www.freebuf.com/jobs/150597.html", "time": "2017-10-17", "level": "", "num_look": 222459, "num_comment": 5, "author": "andy110", "tags": ["安全招聘"], "text": "MOMO是陌陌（NASDAQ：MOMO）推出的一款基于地理位置的开放式移动视频社交应用，是目前中国最大的泛社交泛娱乐平台。"}
{"title": "最新CVE-2017-11826漏洞利用样本分析", "url": "https://www.freebuf.com/vuls/150607.html", "time": "2017-10-17", "level": "金币+10", "num_look": 533976, "num_comment": 8, "author": "金睛", "tags": ["漏洞"], "text": "2017年10月10日，微软在例行的月度补丁中修复了一个漏洞编号为CVE-2017-11826的在野Microsoft Office 0day 漏洞。"}
{"title": "用TEB结构实现ShellCode的通用性", "url": "https://www.freebuf.com/articles/system/150474.html", "time": "2017-10-17", "level": "现金奖励", "num_look": 301962, "num_comment": 8, "author": "pwdme", "tags": ["系统安全"], "text": "为了动态定位函数地址，jneo和scz提出了可以使用TEB结构体在程序中定位动态链接库的地址进而获取函数地址的方法，本文进一步探究这种方法的原理，并挖掘更多的细节。"}
{"title": "密码锚定机制（Crypto Anchors）可能会终结Equifax一类的数据泄漏事件吗？", "url": "https://www.freebuf.com/articles/database/150334.html", "time": "2017-10-17", "level": "", "num_look": 425301, "num_comment": 4, "author": "Elaine_z", "tags": ["数据安全"], "text": "防火墙、入侵检测和加密措施无法阻止黑客的步伐，他们从各种渠道入侵各大企业，获取到大量用户机密数据，甚至有时还会给社会带来灾难性的影响"}
{"title": "BUF早餐铺 | WPA2安全协议惊现多个高危漏洞；瑞典运输管理局遭到DDoS攻击；思科研究人员发现linux提权漏洞", "url": "https://www.freebuf.com/news/150749.html", "time": "2017-10-17", "level": "", "num_look": 254307, "num_comment": 254307, "author": "liki", "tags": ["资讯"], "text": "瑞典运输管理局遭到DDoS攻击，IT系统无法使用、火车延误；暗网毒品市场遭到 DDoS 攻击；思科研究人员发现 linux 提权漏洞；Malwarebytes 研究人员发现新的 Anubi 勒索软件在野攻击。"}
{"title": "阿里巴巴移动安全应用加固能力养成记", "url": "https://www.freebuf.com/articles/terminal/150496.html", "time": "2017-10-16", "level": "", "num_look": 228152, "num_comment": 7, "author": "阿里聚安全", "tags": ["终端安全"], "text": "近些年来，移动APP数量呈现爆炸式的增长，黑产也从原来的PC端转移到了移动端，伴随而来的逆向攻击手段也越来越高明。"}
{"title": "年年被黑！凯悦酒店再曝数据泄露，中国18家店遭殃，开个房都不省心?", "url": "https://www.freebuf.com/news/150802.html", "time": "2017-10-16", "level": "红色标题", "num_look": 360911, "num_comment": 9, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "在这一次数据泄露事件中，全球11个国家总共41家凯悦酒店的支付系统遭到了网络犯罪分子的攻击，并泄露了大量酒店住客的信用卡数据。"}
{"title": "AI x 信息安全 = ？ | 首届AI安全嘉年华，零距离触摸行业最前沿", "url": "https://www.freebuf.com/fevents/150616.html", "time": "2017-10-16", "level": "红色标题", "num_look": 313147, "num_comment": 6, "author": "FB客服", "tags": ["活动"], "text": "围绕当下AI热点「深度学习、跨界融合、人机协同、智能操作」在信息安全中的应用，给你一次零距离“触摸”AI技术的机会，亲身感受AI安全的神秘魅力。"}
{"title": "iOS隐私安全之通过popup向用户索取Apple ID和密码", "url": "https://www.freebuf.com/articles/terminal/150429.html", "time": "2017-10-16", "level": "金币+10", "num_look": 392878, "num_comment": 4, "author": "ang010ela", "tags": ["终端安全"], "text": "你想知道用户的Apple ID和password吗？想访问用户的Apple帐号吗？或者在其他的web服务上使用Apple ID对应邮箱和密码？你只需要礼貌地问他们，他们可能就会告诉你哦。"}
{"title": "2018年美国RSA大会报名超详细攻略", "url": "https://www.freebuf.com/articles/others-articles/150345.html", "time": "2017-10-16", "level": "", "num_look": 233570, "num_comment": 3, "author": "Carrie_spinfo", "tags": ["其他"], "text": "2018年美国RSA大会报名已经开始，由于官网尚未公布详细日程，因此本文先分享与会议门票购买相关的基本信息和部分知识科普。详细日程敬请关注后续更新。"}
{"title": "基于Openresty实现业务安全防护", "url": "https://www.freebuf.com/vuls/150571.html", "time": "2017-10-16", "level": "现金奖励", "num_look": 764230, "num_comment": 25, "author": "chenjc", "tags": ["企业安全", "漏洞"], "text": "传统WAF一般来说，对业务逻辑漏洞的防护是束手无策的，今天就来讲讲基于openresty实现对业务逻辑漏洞的防护功能。"}
{"title": "宜信安全部渗透测试岗诚邀您的加入", "url": "https://www.freebuf.com/jobs/150413.html", "time": "2017-10-16", "level": "", "num_look": 197452, "num_comment": 5, "author": "aleenlee", "tags": ["安全招聘"], "text": "宜信公司创建于2006年，总部位于北京，是一家从事普惠金融和财富管理事业的金融科技企业。"}
{"title": "FIT 2018大会门票早鸟预售！168元抢购「会员票」，更有“早鸟”特惠", "url": "https://www.freebuf.com/news/150246.html", "time": "2017-10-16", "level": "红色标题", "num_look": 259216, "num_comment": 4, "author": "FB客服", "tags": ["活动", "资讯"], "text": "@FreeBuf 及 @漏洞盒子 会员贴心专享O(∩_∩)O~~"}
{"title": "Cameradar：一款可以渗透CCTV摄像头的工具", "url": "https://www.freebuf.com/sectool/150254.html", "time": "2017-10-16", "level": "", "num_look": 582984, "num_comment": 7, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍一款RTSP流数据访问工具-Cameradar，这是一款可以渗透CCTV摄像头的工具，并且自带了相关代码库。"}
{"title": "做源头上的安全：内建安全源码保障", "url": "https://www.freebuf.com/articles/es/150242.html", "time": "2017-10-16", "level": "", "num_look": 364689, "num_comment": 2, "author": "奇安信代码卫士", "tags": ["企业安全"], "text": "当今社会，信息技术已经成为人们生产生活中不可或缺的内容，世界大多数国家都把加快信息化建设作为发展战略。"}
{"title": "某开源投票框架无限投票漏洞", "url": "https://www.freebuf.com/vuls/150317.html", "time": "2017-10-16", "level": "现金奖励", "num_look": 414054, "num_comment": 20, "author": "sjy93812", "tags": ["漏洞"], "text": "织梦内容管理系统(DedeCms) 以简单、实用、开源而闻名，是国内最知名的PHP开源网站管理系统，也是使用用户最多的PHP类CMS系统。"}
{"title": "BUF 早餐铺 | Equifax 网站跳转到虚假 Flash 升级下载链接；利用安全漏洞克隆车钥匙，打开斯巴鲁汽车；中国建造数秒内识别任何公民的面部识别系统", "url": "https://www.freebuf.com/news/150569.html", "time": "2017-10-16", "level": "", "num_look": 234431, "num_comment": 2, "author": "Sphinx", "tags": ["资讯"], "text": "Equifax 网站跳转到虚假 Flash 升级下载链接；利用安全漏洞，克隆车钥匙，打开Subaru 汽车；中国正在建造能在数秒内识别任何公民的全国面部识别系统。"}
{"title": "Java反序列化漏洞从理解到实践", "url": "https://www.freebuf.com/articles/web/149931.html", "time": "2017-10-15", "level": "金币+10", "num_look": 666091, "num_comment": 5, "author": "北其Gg", "tags": ["WEB安全"], "text": "本文的主要内容包括以下两方面：1. 利用某个反序列化漏洞;2. 自己手动创建利用载荷。"}
{"title": "银行木马利用VMvare进行传播", "url": "https://www.freebuf.com/news/150393.html", "time": "2017-10-15", "level": "金币+10", "num_look": 209123, "num_comment": 3, "author": "ang010ela", "tags": ["资讯"], "text": "银行木马与每个人的日常生活息息相关，可能会对每个人造成直接的经济损失。思科的研究团队Talos近日发现一起针对对南美巴西的银行木马活动。"}
{"title": "勒索软件调查报告 | 2016年到2017年，勒索软件市场增长了2502%，且势头继续看涨", "url": "https://www.freebuf.com/articles/paper/150356.html", "time": "2017-10-15", "level": "", "num_look": 224604, "num_comment": 224604, "author": "liki", "tags": ["安全报告"], "text": "今天，美国安全公司 Carbon Black 发布了最新的勒索软件调查报告，和去年相比，暗网经济中勒索软件的市场规模猛增了2502%。"}
{"title": "腾讯安全反病毒实验室：捕获多起Ramnit僵尸网络家族的DDoS攻击", "url": "https://www.freebuf.com/articles/web/150220.html", "time": "2017-10-15", "level": "", "num_look": 423230, "num_comment": 6, "author": "腾讯电脑管家", "tags": ["WEB安全"], "text": "近期发生多起DDoS攻击事件，攻击目标为金融、婚恋、博彩等类型的网站。研究发现这些攻击来自同一僵尸网络，目前该僵尸网络已感染机器数达到数万台，而传播源就是Ramnit家族"}
{"title": "小而强大的恶意软件ATMii，能让Win 7和Vista系统的ATM机疯狂吐钞", "url": "https://www.freebuf.com/news/150561.html", "time": "2017-10-14", "level": "红色标题", "num_look": 373079, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["终端安全", "资讯"], "text": "安全研究人员发现了一种名叫ATMii的新型ATM恶意软件，这种恶意软件主要针对的是安装了Windows 7以及Windows Vista的ATM取款机。"}
{"title": "俄间谍利用卡巴斯基AV产品窃取美国国家安全局EXP，却反被以色列黑客抓个正着", "url": "https://www.freebuf.com/news/150460.html", "time": "2017-10-14", "level": "", "num_look": 344832, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "就在前不久，以色列黑客入侵了卡巴斯基的后台系统，但他们却发现俄罗斯间谍正在使用卡巴斯基反病毒产品来窃取美国国家安全局的漏洞利用工具。"}
{"title": "2017世安杯CTF writeup详解", "url": "https://www.freebuf.com/news/150129.html", "time": "2017-10-14", "level": "金币+10", "num_look": 775573, "num_comment": 4, "author": "Mochazz", "tags": [], "text": "国庆打了场CTF，在此分享出我们队的Writeup(很多表哥队都AK了，然而我们不会逆向，Writeup中的所有python程序基于python3，文章末尾附上题目链接，大家有兴趣可以自行练习。"}
{"title": "SGX侧信道攻击综述", "url": "https://www.freebuf.com/articles/system/149551.html", "time": "2017-10-14", "level": "", "num_look": 461156, "num_comment": 6, "author": "百度安全实验室", "tags": ["系统安全"], "text": "Intel SGX 技术是一种新的基于硬件的可信计算技术。该技术通过CPU的安全扩展，对用户空间运行环境（enclave）提供机密性和完整性保护。"}
{"title": "剖析SQLite内存破坏漏洞", "url": "https://www.freebuf.com/vuls/149521.html", "time": "2017-10-14", "level": "金币+10", "num_look": 333060, "num_comment": 1, "author": "杭州美创科技", "tags": ["漏洞"], "text": "这次与大家共赏一个国内安全厂商的议题《一石多鸟：利用单个SQLite漏洞破解多个软件》。"}
{"title": "无需开启宏即可渗透：在Office文档中利用DDE执行命令", "url": "https://www.freebuf.com/articles/terminal/150285.html", "time": "2017-10-14", "level": "", "num_look": 640264, "num_comment": 10, "author": "腾讯电脑管家", "tags": ["终端安全"], "text": "最近，国外的安全研究员发现了一种在文档中使用DynamicData Exchange (DDE)协议发起渗透的方法。使用该方法可以绕过MSWord和MSExcel宏限制，不需要使用MSWord和MSExcel的漏洞就可以执行命令。"}
{"title": "对话前沿 | FreeBuf x 安永安全+沙龙杭州站首次公开招募啦！", "url": "https://www.freebuf.com/news/150574.html", "time": "2017-10-13", "level": "红色标题", "num_look": 196523, "num_comment": 196523, "author": "FB客服", "tags": ["活动", "资讯"], "text": "为推动企业信息安全体系建设管理，促进企业安全交流合作，FreeBuf推出企业级品牌沙龙活动——「FreeBuf企业安全俱乐部」，为企业搭建专业的信息安全交流平台。"}
{"title": "阿里云肖力：云上，怎样才算把安全做到极致？", "url": "https://www.freebuf.com/news/150562.html", "time": "2017-10-13", "level": "", "num_look": 254852, "num_comment": 2, "author": "阿里云安全", "tags": ["资讯"], "text": "10月12日，杭州云栖大会上，阿里云安全事业部总经理肖力，对日前发布的企业云安全架构，逐层解构，并介绍了阿里云如何从平台、数据、服务三个维度，为云上客户，和未来所有上云企业，提供极致的安全。"}
{"title": "深度学习框架中的魔鬼：探究人工智能系统中的安全问题", "url": "https://www.freebuf.com/articles/neopoints/150247.html", "time": "2017-10-13", "level": "", "num_look": 411182, "num_comment": 2, "author": "360安全", "tags": ["观点"], "text": "深度学习引领着新一轮的人工智能浪潮，受到工业界以及全社会的广泛关注。 虽然大家对人工智能有很多美好的憧憬，但是现实是残酷的 -- 随着一批深度学习应用逐渐开始变成现实，安全问题也渐渐显现出来。"}
{"title": "独家首发 | CVE-2017-11816 GDI信息泄露漏洞分析", "url": "https://www.freebuf.com/vuls/150457.html", "time": "2017-10-13", "level": "现金奖励", "num_look": 556059, "num_comment": 14, "author": "比尔.盖茨", "tags": ["漏洞"], "text": "我的漏洞被别人先报了，所以就把这个漏洞的细节公布一下吧。写的不是很详细，有poc大家可以自己调一调。"}
{"title": "海洋CMS（SEACMS）新版本V6.55补丁仍可被绕过执行任意代码", "url": "https://www.freebuf.com/vuls/150303.html", "time": "2017-10-13", "level": "金币+15", "num_look": 564615, "num_comment": 25, "author": "天择实习生", "tags": ["漏洞"], "text": "前几天我们公布了海洋CMS（SEACMS）的一个0day漏洞，官方据称是在10月2日发布的V6.55版本中进行了修复，而实际上漏洞仍然存在任意代码执行的问题。"}
{"title": "京东商城招聘安全工程师", "url": "https://www.freebuf.com/jobs/150116.html", "time": "2017-10-13", "level": "", "num_look": 258160, "num_comment": 9, "author": "nanshihui", "tags": ["安全招聘"], "text": "智能家居安全、移动安全、云安全~~~，京东为你创造更好的机会来施展你的技能！"}
{"title": "记一次挖洞之旅所引发的撕X大战", "url": "https://www.freebuf.com/vuls/150095.html", "time": "2017-10-13", "level": "红色标题", "num_look": 527801, "num_comment": 21, "author": "Alpha_h4ck", "tags": ["WEB安全", "漏洞"], "text": "在对学校网站进行漏洞挖掘的过程中，我发现并上报了一个安全漏洞，这个漏洞还涉及到学校给学生所提供的电子邮箱。我将讨论漏洞的技术细节以及我个人对整个事件的看法。"}
{"title": "Nginx不安全配置可能导致的安全漏洞", "url": "https://www.freebuf.com/articles/web/149761.html", "time": "2017-10-13", "level": "金币+15", "num_look": 877204, "num_comment": 3, "author": "m09046105", "tags": ["WEB安全"], "text": "本文总结了一些可能引发安全问题的错误配置，并且推荐了github上一款用于检测nginx安全配置的工具。"}
{"title": "CVE-2017-12617-Tomcat远程代码执行漏洞复现测试", "url": "https://www.freebuf.com/vuls/150203.html", "time": "2017-10-13", "level": "现金奖励", "num_look": 1231964, "num_comment": 9, "author": "生如夏花", "tags": ["WEB安全", "漏洞"], "text": "Apache Tomcat团队10月3日宣布，如果配置了默认servlet，则在9.0.1（Beta），8.5.23,8.0.47和7.0.82之前的所有Tomcat版本都包含所有操作系统上的潜在危险的远程执行代码（RCE）漏洞。"}
{"title": "如何将自己的树莓派打造成“渗透测试神器”", "url": "https://www.freebuf.com/articles/wireless/149832.html", "time": "2017-10-13", "level": "现金奖励", "num_look": 1384434, "num_comment": 25, "author": "喵神2017", "tags": ["无线安全", "极客"], "text": "说起来有次某位小伙伴跟我说想要去购买hak5的Bash Bunny 网络劫持键盘注入二合一Badusb。话说看起来不错 可惜我这位小伙伴说要吃两个月泡面攒下来买一个！"}
{"title": "BUF早餐铺 | 俄罗斯垃圾邮件之王被引渡美国；Amazon S3再“立功”，15万美国人信息记录泄露；新型ATM恶意程序ATMii", "url": "https://www.freebuf.com/news/150381.html", "time": "2017-10-13", "level": "", "num_look": 275198, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "俄罗斯垃圾邮件之王被引渡美国；Amazon S3再“立功”，15万美国人信息记录泄露；新型ATM恶意程序：ATMii；勒索软件市场增长2502%。"}
{"title": "警惕出现下一个“WannaCry”，安天紧急发布CVE-2017-11780漏洞免疫工具", "url": "https://www.freebuf.com/news/150409.html", "time": "2017-10-12", "level": "红色标题", "num_look": 695282, "num_comment": 7, "author": "antiylab", "tags": ["漏洞", "资讯"], "text": "近日，国家信息安全漏洞共享平台（CNVD）收录了Microsoft WindowsSMB Server远程代码执行漏洞（CNVD-2017-29681，对应CVE-2017-11780）。"}
{"title": "【课程回播】你不能错过的「36W」白帽大佬挖洞秘笈分享课程上线啦", "url": "https://www.freebuf.com/open/150313.html", "time": "2017-10-12", "level": "红色标题", "num_look": 1095453, "num_comment": 22, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "「36W」白帽大佬挖洞秘笈分享：HTTP盲攻击的几种思路录播视频上线啦！"}
{"title": "新手科普|探索机器学习模型，保障账户安全", "url": "https://www.freebuf.com/news/150179.html", "time": "2017-10-12", "level": "", "num_look": 322902, "num_comment": 322902, "author": "vulture", "tags": [], "text": "如何保障账户安全往往是企业需要面临的难题，而随着攻击者的手段越来越高超，网站需要找到行之有效的方法保护账号安全。"}
{"title": "快讯 | 德勤之后，另一家咨询公司埃森哲也被曝出安全问题", "url": "https://www.freebuf.com/news/150338.html", "time": "2017-10-12", "level": "红色标题", "num_look": 321100, "num_comment": 6, "author": "Sphinx", "tags": ["资讯"], "text": "继上月末四大咨询公司之一的德勤被黑后，另一家咨询公司埃森哲也被爆出安全问题。"}
{"title": "微软十月Patch Tuesday：发放62个漏洞补丁，还修复了国内研究人员提交的0-day漏洞", "url": "https://www.freebuf.com/news/150233.html", "time": "2017-10-12", "level": "", "num_look": 348713, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "微软在本周二的 Patch Tuesday 上一口气发布了 62 个漏洞的补丁，其中包括一个已被利用的严重 Office 0-day 漏洞。"}
{"title": "美团点评集团安全部招聘安全人才", "url": "https://www.freebuf.com/jobs/150061.html", "time": "2017-10-12", "level": "", "num_look": 484374, "num_comment": 10, "author": "李发财", "tags": ["安全招聘"], "text": "美团点评公司是全球领先的一站式生活服务平台，为超过6亿消费者和和超过450万的优质商户提供一个连接线上线下的电子商务网络。"}
{"title": "Windows 7补丁慢慢修，微软推广Windows 10有套路", "url": "https://www.freebuf.com/news/150096.html", "time": "2017-10-12", "level": "红色标题", "num_look": 277981, "num_comment": 1, "author": "Sphinx", "tags": ["观点", "资讯"], "text": "微软默默修复Windows 10安全漏洞，并且往往不立即向Windows 7和8推出相同的更新，从而可能导致数亿台计算机遭入侵。"}
{"title": "基于Django的双因子认证实现", "url": "https://www.freebuf.com/articles/network/150071.html", "time": "2017-10-12", "level": "现金奖励", "num_look": 536771, "num_comment": 536771, "author": "chengfangang", "tags": ["网络安全"], "text": "双因子认证（2FA）是指结合密码以及实物（信用卡、SMS手机、令牌或指纹等生物标志）两种条件对用户进行认证的方法。"}
{"title": "守护国家网络安全的最强力量 | WitAwards 2017年度国家力量评选「报名进行中」", "url": "https://www.freebuf.com/news/149457.html", "time": "2017-10-12", "level": "", "num_look": 223517, "num_comment": 1, "author": "FB客服", "tags": ["活动", "资讯"], "text": "当下，网络世界迸发出前所未有的活力，而隐藏其下的风险也变得无比活跃。一组代码、一条短信、一页链接，可能导致个人倾家荡产、国家基础设施瘫痪。"}
{"title": "BUF 早餐铺 | 10月10日，又有省级运营商被最新的机顶盒蠕虫袭击；一加氧OS会跟踪用户的所有活动；Accenture敏感数据放在不安全的服务器上；俄罗斯或关停虚拟货币交易", "url": "https://www.freebuf.com/news/150253.html", "time": "2017-10-12", "level": "", "num_look": 331513, "num_comment": 1, "author": "liki", "tags": ["资讯"], "text": "10月10日，又有省级运营商被最新的机顶盒蠕虫袭击；一加的氧 OS 会跟踪用户的所有活动；Accenture 将敏感数据放在四台不安全的服务器上等。"}
{"title": "Hijacker：一款All-in-One型的Android端WiFi破解工具", "url": "https://www.freebuf.com/sectool/149812.html", "time": "2017-10-11", "level": "", "num_look": 844995, "num_comment": 10, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Hijacker是一款带有图形用户界面的渗透测试工具，该工具集成了多款著名的WiFi渗透工具，例如Aircrack-ng、Airodump-ng、MDK3和Reaver等等。"}
{"title": "卡巴斯基CEO：说我们和俄罗斯政府联手窃取NSA机密信息，你们在拍C级片吗？", "url": "https://www.freebuf.com/news/150209.html", "time": "2017-10-11", "level": "", "num_look": 376353, "num_comment": 3, "author": "欧阳洋葱", "tags": ["资讯"], "text": "等等，美国人不是整天这么说么？这次华尔街日报宣称终于有了这两个单位间存在直接关联的“首个证据”。"}
{"title": "中软泰和招聘高级渗透测试工程师", "url": "https://www.freebuf.com/jobs/150056.html", "time": "2017-10-11", "level": "", "num_look": 316977, "num_comment": 6, "author": "PandamQ", "tags": ["安全招聘"], "text": "五险一金、股权激励、不限调薪次数、提供午餐、弹性工作时间、共享型项目高额奖金分配、定期团建、过节只发钱不发礼物。"}
{"title": "HAY！FIT 2018互联网安全创新大会「议题征集」开车了", "url": "https://www.freebuf.com/news/148624.html", "time": "2017-10-11", "level": "红色标题", "num_look": 279124, "num_comment": 5, "author": "FB客服", "tags": ["头条", "活动"], "text": "FreeBuf诚挚邀请您参与到FIT 2018议题征集活动中！"}
{"title": "漏洞利用套件（Exploit Kit）简史", "url": "https://www.freebuf.com/articles/others-articles/149816.html", "time": "2017-10-11", "level": "", "num_look": 348283, "num_comment": 1, "author": "Covfefe", "tags": ["其他"], "text": "恶意软件以及其他不受欢迎的程序有很多种方式进入你的计算机，但在过去几年，最受欢迎的两种手段是电子邮件引诱和使用漏洞利用套件。"}
{"title": "一步一步彻底弄懂利用ActiveX控件绕过SafeS.E.H", "url": "https://www.freebuf.com/articles/web/149886.html", "time": "2017-10-11", "level": "现金奖励", "num_look": 465872, "num_comment": 2, "author": "wooy0ung", "tags": ["WEB安全"], "text": "这篇文参考自《0Day》, 因为\"利用Adobe Flash Player ActiveX控件绕过SafeS.E.H\" 这节有一些小坑, 不注意可能会实验失败, 所以写了这篇文来一步一步越过这些坑。"}
{"title": "Python编写的开源Struts2全版本漏洞检测工具", "url": "https://www.freebuf.com/sectool/149815.html", "time": "2017-10-11", "level": "金币+12", "num_look": 1117780, "num_comment": 39, "author": "六翼", "tags": ["工具"], "text": "由于struts2框架频繁爆出漏洞，为方便安全从业人员检测并及时修复，遂将struts历史版本payload整合在一起(ST2-005至ST2-048)。"}
{"title": "小心！黑客组织KovCoreG正在利用虚假的浏览器和Flash更新来传播恶意软件", "url": "https://www.freebuf.com/news/150170.html", "time": "2017-10-11", "level": "", "num_look": 257434, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "近期，安全研究人员发现了一个名叫KovCoreG的黑客组织正在利用伪造的浏览器及Flash更新来欺骗用户安装Kovter恶意软件。"}
{"title": "BUF 早餐铺 | 朝鲜黑客“全天候”攻击爱尔兰公司；新型攻击KnockKnock入侵大量Office 365系统帐户；山东警方破获特大网络侵犯公民个人信息案", "url": "https://www.freebuf.com/news/150196.html", "time": "2017-10-11", "level": "", "num_look": 274962, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "对斯佳品酬佳节，桂拂清风菊带霜。今天你入秋成功了嘛？快来好好吃早餐吧~"}
{"title": "SiteLock最新报告显示：针对网站的攻击激增，平均每天有63起", "url": "https://www.freebuf.com/news/150128.html", "time": "2017-10-10", "level": "", "num_look": 290312, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["安全报告", "资讯"], "text": "根据SiteLock于本周一发布的最新分析报告显示，在过去的几个月里，针对网站的攻击活动数量出现了大幅增加。"}
{"title": "代码安全的历史与发展现状", "url": "https://www.freebuf.com/articles/terminal/149569.html", "time": "2017-10-10", "level": "", "num_look": 479107, "num_comment": 2, "author": "奇安信代码卫士", "tags": ["终端安全"], "text": "随着计算机和通信技术的飞速发展，软件已经成为信息化建设的重要基础设施，无数事实证明软件中的安全漏洞是导致安全事件频繁发生的根本原因。"}
{"title": "在Mac Linux上如何快速判断一个文件是否是恶意程序？", "url": "https://www.freebuf.com/articles/system/149827.html", "time": "2017-10-10", "level": "现金奖励", "num_look": 594239, "num_comment": 8, "author": "GeekOnline", "tags": ["系统安全"], "text": "本文介绍几种小技巧，让你快速判断一个程序是否是恶意样本。"}
{"title": "Powershell最佳安全实践", "url": "https://www.freebuf.com/sectool/149835.html", "time": "2017-10-10", "level": "", "num_look": 707730, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具", "网络安全"], "text": "在这篇文章中，我们将跟大家讨论PowerShell的最佳实践方式，而本文的内容将能够帮助你对抗那些使用PowerShell来攻击你的人。"}
{"title": "微步在线ThreatBook诚邀安全、技术大牛加入", "url": "https://www.freebuf.com/jobs/149944.html", "time": "2017-10-10", "level": "", "num_look": 400906, "num_comment": 6, "author": "Threatbook", "tags": ["安全招聘"], "text": "微步在线自成立就在一系列重大安全事件如XCodeGhost、DarkHotel、WannaCry中多次积极应对，现有分布在金融、能源、互联网行业和政府机关的客户共20余家。"}
{"title": "逆天而行：我们如何在云中发掘僵尸网络", "url": "https://www.freebuf.com/articles/network/149560.html", "time": "2017-10-10", "level": "红色标题", "num_look": 801518, "num_comment": 14, "author": "百度安全实验室", "tags": ["网络安全"], "text": "远控既能用于正规用途比如远程协作软件 teamviewer 等,亦能用于非法活动比如 C&C 攻击。今天我们要谈的就是用于非(黑)法(产)活动的远控。"}
{"title": "网络犯罪分子今年都在搞什么飞机？来看欧洲刑警组织的最新评估报告", "url": "https://www.freebuf.com/news/149720.html", "time": "2017-10-10", "level": "", "num_look": 301964, "num_comment": 1, "author": "欧阳洋葱", "tags": ["资讯"], "text": "欧洲刑警组织（Europol）最近发布了《互联网组织犯罪威胁评估 2017（Internet Organised Crime Treat Assessment 2017）》报告。我们可以从中窥见一些全球网络犯罪的趋势。"}
{"title": "创新，或者消亡 | WitAwards 2017年度创新产品评选「报名进行中」", "url": "https://www.freebuf.com/news/149446.html", "time": "2017-10-10", "level": "红色标题", "num_look": 236026, "num_comment": 236026, "author": "FB客服", "tags": ["头条", "活动"], "text": "WitAwards 2017「年度创新产品」评选，盘点本年度安全行业最具创新力的产品，为创新精神喝彩，鼓励更多的企业、人才投入到安全创新中去。"}
{"title": "“锁大师”暗刷流量劫持主页，已影响百万用户", "url": "https://www.freebuf.com/articles/web/149801.html", "time": "2017-10-10", "level": "", "num_look": 425322, "num_comment": 9, "author": "安全豹", "tags": ["WEB安全"], "text": "近日，金山毒霸安全实验室监控到一款名为“锁大师”的流氓软件，该软件已开始大规模强制劫持用户浏览器主页，暗刷流量。"}
{"title": "Buf早餐铺 | 中国台湾远东银行遭黑客入侵；Google推出Advanced Protection Program项目；Disqus证实用户数据泄漏事件", "url": "https://www.freebuf.com/news/149945.html", "time": "2017-10-10", "level": "", "num_look": 309061, "num_comment": 1, "author": "Elaine_z", "tags": ["资讯"], "text": "中国台湾远东银行遭黑客入侵；Google推出Advanced Protection Program项目；Disqus证实用户数据泄漏事件等。"}
{"title": "漏洞预警 | 海洋CMS（SEACMS）0day漏洞预警", "url": "https://www.freebuf.com/vuls/150042.html", "time": "2017-10-09", "level": "金币+8", "num_look": 1442083, "num_comment": 17, "author": "天择实习生", "tags": ["漏洞"], "text": "最近我们的一名安全托管客户反应，其服务器遭受到攻击，被黑客上传了webshell并篡改网页内容。经过我们为客户安装云锁防护软件后，拦截到一个针对海洋CMS（SEACMS）的0day漏洞。"}
{"title": "Discuz!X 前台任意文件删除漏洞的复现实验", "url": "https://www.freebuf.com/articles/system/149810.html", "time": "2017-10-09", "level": "现金奖励", "num_look": 496530, "num_comment": 7, "author": "生如夏花", "tags": ["系统安全"], "text": "Discuz!X 社区软件，是一个采用PHP 和 MySQL 等其他多种数据库构建的性能优异、功能全面、安全稳定的社区论坛平台。本次实现在本地搭建环境，进行复现实验。\r\n\r\n2017年9月29日，Discuz!修复了一个安全问题用于加强…"}
{"title": "iOS设备WiFi芯片受高危漏洞威胁，逾9成iOS用户受影响", "url": "https://www.freebuf.com/articles/wireless/149760.html", "time": "2017-10-09", "level": "", "num_look": 607534, "num_comment": 4, "author": "百度安全实验室", "tags": ["无线安全", "系统安全"], "text": "本文对iOS设备WiFI芯片相关漏洞进行简要技术分析，然后根据iOS设备的系统版本统计出受影响的规模。截至9月27日，国内92.3%的iOS用户都受到相关高危漏洞的威胁。"}
{"title": "烽泰科技招聘信息安全渗透工程师", "url": "https://www.freebuf.com/jobs/149443.html", "time": "2017-10-09", "level": "", "num_look": 290907, "num_comment": 2, "author": "darkmicheal", "tags": ["安全招聘"], "text": "烽泰科技（北京）有限公司成立于2014年7月，拥有专业的研发设计团队，通过敏锐的视角，洞悉市场，放眼世界金融，专注设计兼容国内外操作习惯的交易平台。"}
{"title": "网络安全事件应急演练实操Step By Step", "url": "https://www.freebuf.com/articles/network/149590.html", "time": "2017-10-09", "level": "金币+8", "num_look": 1428960, "num_comment": 5, "author": "飞絮", "tags": ["企业安全", "安全管理"], "text": "第四届国家网络安全宣传周结束了，小编也将分享一些开展网络安全事件应急演练工作的理解与体会，希望能对近期计划进行网络安全事件应急演练的朋友有所帮助。"}
{"title": "“薅羊毛”漏洞分析 | 我是如何到处“混吃混喝”的", "url": "https://www.freebuf.com/vuls/149251.html", "time": "2017-10-09", "level": "现金奖励", "num_look": 669898, "num_comment": 21, "author": "小石", "tags": ["漏洞"], "text": "我最近利用负数漏洞等常见漏洞，获取一系列吃喝优惠，下面就跟大家分享交流一下经验。"}
{"title": "看片要当心了！色站不只掏空你，还可能掏空你的电脑", "url": "https://www.freebuf.com/articles/web/149483.html", "time": "2017-10-09", "level": "红色标题", "num_look": 1201402, "num_comment": 24, "author": "腾讯电脑管家", "tags": ["WEB安全"], "text": "近日，腾讯电脑管家发现有多个网站在其网页内嵌了挖矿JavaScript脚本，用户一旦进入此类网站，JS脚本就会自动执行，占用大量的机器资源以挖取门罗币，使电脑出现卡慢问题。"}
{"title": "一次误报引发的DNS检测方案的思考：DNS隧道检测平民解决方案", "url": "https://www.freebuf.com/articles/network/149328.html", "time": "2017-10-09", "level": "现金奖励", "num_look": 755354, "num_comment": 6, "author": "ChuanFile", "tags": ["网络安全"], "text": "大数据分析？够高大上！但落地成本高，复杂度也高，对于一般公司来说很难实施，为此笔者从dns隧道的原理和黑客的思路入手分析，提出一些简单的检测方案，仅供参考！"}
{"title": "来自后方世界的隐匿威胁：后门与持久代理(一）", "url": "https://www.freebuf.com/articles/system/149839.html", "time": "2017-10-08", "level": "现金奖励", "num_look": 606626, "num_comment": 13, "author": "2cat", "tags": ["系统安全"], "text": "干了十几年安全工作，发现一些同行只是把简单的工具扫描和渗透测试当成了全部工作，拿到需要的数据及测试结果既为完成工作。"}
{"title": "如何渗透联网智能灯泡——LIFX智能灯泡", "url": "https://www.freebuf.com/articles/terminal/149908.html", "time": "2017-10-08", "level": "", "num_look": 479552, "num_comment": 8, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "这篇文章的“主人公”，即LIFX智能灯泡。根据官方描述，这种灯泡配备了WiFi功能，可以进行多色调节，它是一种高效节能的LED灯泡，并且可以通过智能手机远程控制。"}
{"title": "快讯 | 首轮中美执法及网络安全对话成果清单：及时核实非法移民", "url": "https://www.freebuf.com/news/149924.html", "time": "2017-10-08", "level": "金币+8", "num_look": 269200, "num_comment": 2, "author": "kylin1415", "tags": ["资讯"], "text": "2017年10月4日，中国国务委员、公安部部长郭声琨和美国司法部部长杰夫·塞申斯、国土安全部代理部长伊莲·杜克共同主持了首轮中美执法及网络安全对话."}
{"title": "在64位系统中使用ROP+Return-to-dl-resolve来绕过ASLR+DEP", "url": "https://www.freebuf.com/articles/system/149364.html", "time": "2017-10-08", "level": "金币+8", "num_look": 438383, "num_comment": 438383, "author": "pwdme", "tags": ["系统安全"], "text": "前上一篇文章中，我们研究了在32位环境下的Return-to-dl-resolve技术，这篇就来讨论一下64位环境下的Return-to-dl-resolve技术，有些地方存在较大差异，仅供参考。"}
{"title": "开源软件安全现状分析报告", "url": "https://www.freebuf.com/articles/terminal/149575.html", "time": "2017-10-08", "level": "", "num_look": 495051, "num_comment": 1, "author": "奇安信代码卫士", "tags": ["终端安全"], "text": "开源软件在软件开发中扮演着越来越重要的角色，然而，开源软件中存在大量的安全隐患，企业在享受开源软件带来的便利的同时，也在承担着巨大的安全风险。"}
{"title": "黑帽SEO剖析之隐身篇", "url": "https://www.freebuf.com/articles/web/149440.html", "time": "2017-10-07", "level": "", "num_look": 488040, "num_comment": 2, "author": "nmask", "tags": ["WEB安全"], "text": "黑帽seo需要潜伏在服务器上一段时间，因为它主要靠引流来创造价值。那么如何做到不被服务器运维发现就至关重要了，也是黑帽seo行为是否能最终成功的关键。"}
{"title": "Discuz!X前台任意文件删除漏洞重现及分析", "url": "https://www.freebuf.com/vuls/149904.html", "time": "2017-10-07", "level": "金币+8", "num_look": 809548, "num_comment": 13, "author": "LSA", "tags": ["WEB安全", "漏洞"], "text": "9月29日，Discuz修复了一个前台任意文件删除的漏洞，相似的漏洞曾在2014年被提交给wooyun和discuz官方，但是修复不完全导致了这次的漏洞。"}
{"title": "一个冷门类型混淆漏洞CVE-2017-0213的技术分析", "url": "https://www.freebuf.com/vuls/149685.html", "time": "2017-10-07", "level": "", "num_look": 586258, "num_comment": 586258, "author": "兰云科技银河实验室", "tags": ["漏洞"], "text": "CVE-2017-0213 是一个比较冷门的COM 类型混淆 (Type Confusion)漏洞。巧妙的利用该漏洞，可以实现本地的提权。该漏洞由著名的Google Project zero 发现。"}
{"title": "360 Vulpecker Team：BlueBorne蓝牙漏洞深入分析与PoC", "url": "https://www.freebuf.com/articles/terminal/149568.html", "time": "2017-10-07", "level": "", "num_look": 475780, "num_comment": 2, "author": "360安全", "tags": ["终端安全"], "text": "前些天，armis爆出了一系列蓝牙的漏洞，基本上影响所有的蓝牙设备，危害不可估量。我来拾一波牙慧，把这几个漏洞再分析一下，然后把poc编写出来。"}
{"title": "黑帽SEO剖析之工具篇", "url": "https://www.freebuf.com/sectool/149427.html", "time": "2017-10-06", "level": "", "num_look": 709264, "num_comment": 9, "author": "nmask", "tags": ["WEB安全", "工具"], "text": "搞黑帽SEO往往都是批量操作，因此自动化工具不可或缺，也是整个黑产环中比较重要的一环，本篇将会介绍几款黑帽seo中常用的工具。"}
{"title": "最近发生了很多数据泄漏事件，如果GDPR实施的话Equifax会怎么样？", "url": "https://www.freebuf.com/articles/es/149613.html", "time": "2017-10-06", "level": "", "num_look": 880076, "num_comment": 1, "author": "liki", "tags": ["企业安全"], "text": "欧盟出台的通用数据保护法规（GDPR）将在明年5月正式实施，想象一下，Equifax 是在 GDPR 生效期间出的事，它的结果又将如何呢，或许，它的处境会更加艰难。"}
{"title": "反取证技术：内核模式下的进程隐蔽", "url": "https://www.freebuf.com/articles/web/148515.html", "time": "2017-10-06", "level": "红色标题", "num_look": 666010, "num_comment": 8, "author": "Covfefe", "tags": ["WEB安全"], "text": "本文是介绍恶意软件的持久性及传播性技术这一系列的第一次迭代，这些技术中大部分是研究人员几年前发现并披露的，在此介绍的目的是建立这些技术和取证方面的知识框架。"}
{"title": "黑帽SEO剖析之手法篇", "url": "https://www.freebuf.com/articles/web/149438.html", "time": "2017-10-05", "level": "金币+8", "num_look": 738965, "num_comment": 5, "author": "nmask", "tags": ["WEB安全"], "text": "此系统文章总共分为四篇，分别是手法篇、工具篇、隐藏篇、总结篇；本篇为黑帽SEO之手法篇，主要介绍黑帽seo的概念以及一些常用的手法。"}
{"title": "快讯 | 雅虎承认其30亿用户信息全部被黑", "url": "https://www.freebuf.com/news/149894.html", "time": "2017-10-05", "level": "红色标题", "num_look": 582735, "num_comment": 3, "author": "Akane", "tags": ["资讯"], "text": "近日，已被Verizon电信收购的雅虎公司宣布2013年8月发生的大规模数据泄露事件，影响范围包括所有雅虎用户，这意味着全球30亿雅虎账户无一幸免。"}
{"title": "IDS和IPS的部署细节科普", "url": "https://www.freebuf.com/news/149445.html", "time": "2017-10-05", "level": "", "num_look": 986680, "num_comment": 4, "author": "Alpha_h4ck", "tags": [], "text": "这篇文章主要介绍的是入侵检测系统（IDS）和入侵防御系统（IPS），而这两者均是保护我们网络安全的重要机制。"}
{"title": "“脏牛漏洞”恶意Root软件分析报告", "url": "https://www.freebuf.com/articles/terminal/149406.html", "time": "2017-10-05", "level": "", "num_look": 579925, "num_comment": 1, "author": "腾讯手机管家", "tags": ["安全报告", "终端安全"], "text": "9月25日，趋势科技的安全研究人员发布报告介绍了一款新恶意软件ZNIU，其使用“脏牛”获取设备的Root权限，并植入后门。"}
{"title": "无线网络嗅探中的Radiotap", "url": "https://www.freebuf.com/articles/wireless/130194.html", "time": "2017-10-04", "level": "金币+8", "num_look": 851849, "num_comment": 851849, "author": "addadd", "tags": ["无线安全"], "text": "在WLAN无线网络抓包的时候不管是用wireshark、tcpdump还是scapy都会出现Radiotap、LLC、SNAP协议层。"}
{"title": "挖洞经验 | 记一次有关参数指定型XSS的故事", "url": "https://www.freebuf.com/articles/web/149431.html", "time": "2017-10-04", "level": "红色标题", "num_look": 576730, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "各位信息安全大神们，大家好！我准备在这篇文章中跟大家分享一些我在最近一次挖洞过程中的发现，并与安全社区一同分享我的挖洞经验。"}
{"title": "针对巴西商业公司财务的攻击事件分析", "url": "https://www.freebuf.com/articles/web/149428.html", "time": "2017-10-04", "level": "", "num_look": 520361, "num_comment": 2, "author": "奇安信威胁情报中心", "tags": ["WEB安全"], "text": "9月14日到9月20日，研究人员发现一批具有相似特征的钓鱼邮件，语言均为葡萄牙语，投递目标为巴西的商业公司，使用的payload主要由powershell和AutoIt编写。"}
{"title": "大量最新苹果Mac仍可通过EFI固件漏洞入侵", "url": "https://www.freebuf.com/news/149834.html", "time": "2017-10-03", "level": "", "num_look": 420454, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "大量的苹果Mac电脑无法有效安装针对DFI固件漏洞的修复补丁，或者说其中的大部分Mac电脑压根没有接收到任何的更新提醒。"}
{"title": "如何使用Twitter构建C&C服务器", "url": "https://www.freebuf.com/sectool/149381.html", "time": "2017-10-03", "level": "", "num_look": 583594, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["工具"], "text": "对于渗透测试人员来说，社交平台可以成为命令控制工具，而网络犯罪分子甚至还可以利用社交媒体网络流量来隐藏自己的恶意行为。"}
{"title": "如何在32位系统中使用ROP+Return-to-dl来绕过ASLR+DEP", "url": "https://www.freebuf.com/articles/system/149214.html", "time": "2017-10-03", "level": "", "num_look": 634657, "num_comment": 3, "author": "pwdme", "tags": ["系统安全"], "text": "传统的利用return-to-plt+ROP来绕过ASLR + DEP的技术需要知道库中函数的偏移地址，而在没有libc库的情况下可以使用Return-to-dl-resolve技术来达到动态获得库函数地址的目的"}
{"title": "沉睡一年的“脏牛”又被攻击者利用，Android用户你们还好吗？", "url": "https://www.freebuf.com/news/149327.html", "time": "2017-10-03", "level": "", "num_look": 531051, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "时隔近一年，来自趋势科技的研究人员又发现了“脏牛”的踪迹：一个名为 ZNIU 的恶意程序使用“脏牛”漏洞获取 Android 设备的 root 权限并植入后门，收集设备中的信息。"}
{"title": "美国网件ReadyNAS监控系统非认证远程命令执行漏洞分析", "url": "https://www.freebuf.com/vuls/149563.html", "time": "2017-10-02", "level": "", "num_look": 643533, "num_comment": 1, "author": "ang010ela", "tags": ["漏洞"], "text": "ReadyNAS监控系统是网件公司提出的可直接在ReadyNAS存储设备上安装的，简单易用的网络视频记录软件。安装一些连网的摄像头，监控系统就可以运行了。"}
{"title": "再曝实锤，更多证据显示俄罗斯或干预了去年的美国大选", "url": "https://www.freebuf.com/news/149266.html", "time": "2017-10-02", "level": "", "num_look": 588472, "num_comment": 3, "author": "liki", "tags": ["资讯"], "text": "2016年的美国大选已经快过去一年了，然而现在有更多的证据表明俄罗斯对大选进行了干预。"}
{"title": "简析60度CMS的Cookies欺骗漏洞", "url": "https://www.freebuf.com/articles/web/149232.html", "time": "2017-10-02", "level": "金币+8", "num_look": 726751, "num_comment": 16, "author": "J1anCan", "tags": ["WEB安全"], "text": "本篇文章只是为了和大家分享漏洞的挖掘经验和思路，同时让大家认识到Cookies欺骗漏洞的危害和严重性。"}
{"title": "乱晒登机牌很可能导致你的账户信息被盗用", "url": "https://www.freebuf.com/geek/149227.html", "time": "2017-10-01", "level": "", "num_look": 585055, "num_comment": 9, "author": "Alpha_h4ck", "tags": ["极客"], "text": "如果你打算坐飞机去哪儿旅游的话，你很可能会在机场先晒一波登机牌，但是当你准备把它晒到社交平台（例如Facebook、Instagram和微博）的话，我建议你先考虑清楚。"}
{"title": "iPhone的Wi-Fi芯片漏洞利用POC都公布了，赶紧更新系统吧", "url": "https://www.freebuf.com/news/149453.html", "time": "2017-10-01", "level": "", "num_look": 645620, "num_comment": 9, "author": "AngelaY", "tags": ["资讯"], "text": "本周，谷歌 Project Zero 项目的研究员 Gal Beniamini 公布了 iPhone Wi-Fi 固件的漏洞利用 POC。"}
{"title": "任子行周勇林：产品在心，用户为先；着眼人才，合作共赢 | 国家网络安全宣传周 FreeBuf 专访", "url": "https://www.freebuf.com/articles/people/148786.html", "time": "2017-10-01", "level": "", "num_look": 1890617, "num_comment": 2, "author": "AngelaY", "tags": ["人物志", "活动"], "text": "在近一个小时的采访过程中，周勇林详谈了他入行十余年的经历和感受，没有太多客套话，有的只是一个网安人坚持十余年的志向抱负和理想信念。"}
{"title": "如何用ESP8266做个钓鱼测试WIFI", "url": "https://www.freebuf.com/geek/148996.html", "time": "2017-10-01", "level": "现金奖励", "num_look": 1560793, "num_comment": 48, "author": "天使之神", "tags": ["极客"], "text": "其实关于esp8266网上有许多教程，好多前辈玩这个已经好多年了，但为了给像我这样的小白系统的解决制作过程中的一些问题，我还是写出来。"}
{"title": "从用Basic语言编写日历，到全球Top20 IBM挑战赛得主：蔡立志寄语年轻从业者", "url": "https://www.freebuf.com/fevents/148964.html", "time": "2017-09-30", "level": "", "num_look": 529229, "num_comment": 2, "author": "Elaine_z", "tags": ["活动"], "text": "恰逢上周网络安全周，FreeBuf 有幸见到了上海计算机软件开发中心的蔡立志副主任，并展开了历时一小时的访谈。"}
{"title": "基于Google搜索结果的命令行漏洞扫描工具", "url": "https://www.freebuf.com/sectool/148914.html", "time": "2017-09-30", "level": "", "num_look": 597391, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍一款基于命令行实现的扫描工具-Dorkbot，它可以从Google的搜索结果中扫描出其中可能存在的安全漏洞。"}
{"title": "【漏洞预警】Discuz! 任意文件删除漏洞", "url": "https://www.freebuf.com/vuls/149762.html", "time": "2017-09-30", "level": "红色标题", "num_look": 746791, "num_comment": 13, "author": "Sphinx", "tags": ["漏洞"], "text": "利用特殊构造的请求触发可参与文件删除操作，导致了任意文件删除漏洞的发生。早在2014年有白帽子向官方报告了一个类似的漏洞，但是由于没有修补全导致还有其他方式可以进行利用。"}
{"title": "VIPKID安全团队诚聘安全人才", "url": "https://www.freebuf.com/jobs/149296.html", "time": "2017-09-30", "level": "", "num_look": 418695, "num_comment": 11, "author": "VIPKID安全团队", "tags": ["安全招聘"], "text": "VIPKID 是由创新工场、经纬中国、红杉资本、北极光、真格基金、云锋基金以及由科比创立的Bryant Stibel基金等投资机构联合投资的互联网教育公司，专注为4-12 岁左右的小朋友提供有效、生动的在线英语学习体验。"}
{"title": "基于标记数据学习降低误报率的算法优化", "url": "https://www.freebuf.com/articles/others-articles/149524.html", "time": "2017-09-30", "level": "", "num_look": 581281, "num_comment": 2, "author": "安恒AiLPHA大数据", "tags": ["其他"], "text": "本文介绍利用专家经验持续优化机器学习的方法，对告警数据进行二次分析和学习，从而显著地降低安全威胁告警的误报率。"}
{"title": "如何通过.NET程序绕过UAC", "url": "https://www.freebuf.com/articles/web/148779.html", "time": "2017-09-30", "level": "", "num_look": 475512, "num_comment": 475512, "author": "Covfefe", "tags": ["WEB安全"], "text": ".NET Framework可以通过用户定义的环境变量和CLSID注册表项加载profiler DLL或者是COM组件DLL，进程权限提升时甚至也是一样。"}
{"title": "技术创新引领行业未来 | WitAwards 2017年度技术变革评选「报名进行中」", "url": "https://www.freebuf.com/news/149170.html", "time": "2017-09-30", "level": "", "num_look": 350965, "num_comment": 350965, "author": "FB客服", "tags": ["头条", "活动"], "text": "安全行业总与技术创新息息相关，在这个IT技术大发展大变革的时代，安全行业又将迎来一场怎样的“革命”？"}
{"title": "【FB TV】一周「BUF大事件」：德勤遭网络攻击，全球电子邮件服务器被入侵；维基解密发布俄罗斯机密文件；Burp Suite被曝存在远程代码执行漏洞", "url": "https://www.freebuf.com/video/149709.html", "time": "2017-09-30", "level": "红色标题", "num_look": 1180760, "num_comment": 1180760, "author": "willhuang", "tags": ["视频"], "text": "本周全球四大会计师事务所之一的德勤遭到网络攻击，全球电子邮件服务器被入侵；维基解密发布俄罗斯国家监控设施机密文件；渗透测试工具Burp Suite被曝存在远程代码执行漏洞。"}
{"title": "PC傻瓜式安装黑苹果并打造成全能逆向工作站", "url": "https://www.freebuf.com/geek/149063.html", "time": "2017-09-30", "level": "现金奖励", "num_look": 2979997, "num_comment": 79, "author": "Roy_Chen", "tags": ["极客"], "text": "为什么要安装黑苹果？对于这个问题，不同的人应该有不同的回答。对于学生党来说，花小钱就能体验原版macOS操作系统，学生党时间相对充裕，可以花费巨大的精力在反复的折腾和尝试上面。"}
{"title": "安全专家说Android 8.0和iPhone X一样安全，这是真的吗？", "url": "https://www.freebuf.com/articles/terminal/149161.html", "time": "2017-09-30", "level": "", "num_look": 556620, "num_comment": 5, "author": "欧阳洋葱", "tags": ["终端安全"], "text": "上个月 Android 8.0 以代号 Oreo（奥利奥）的方式问世了，奥利奥感觉比牛轧糖、棉花糖之类的都要甜。而就安全方面的更新，这次可是前所未有的。"}
{"title": "Buf早餐铺 | 暗网毒枭 Gal Vallerius 参加世界胡子大奖赛被捕；NGO网站遭遇鱼叉式钓鱼攻击；企业第三方安全威胁增长", "url": "https://www.freebuf.com/news/149692.html", "time": "2017-09-30", "level": "", "num_look": 403989, "num_comment": 1, "author": "Elaine_z", "tags": ["资讯"], "text": "周五都已经过了，长假还会远吗？"}
{"title": "Signal 新探索：运用英特尔 SGX 加强联系人搜索功能的隐私安全", "url": "https://www.freebuf.com/news/149646.html", "time": "2017-09-29", "level": "红色标题", "num_look": 467291, "num_comment": 2, "author": "Elaine_z", "tags": ["数据安全", "资讯"], "text": "Open Whisper Systems 创始人 Moxie Marlinspike 表示：我们根本不希望人们简单地“相信”我们，这才不是所谓的隐私，用户应该相信技术。"}
{"title": "深信服：做实用有效的安全 | 国家网络安全宣传周展商专访", "url": "https://www.freebuf.com/articles/people/149535.html", "time": "2017-09-29", "level": "", "num_look": 368572, "num_comment": 2, "author": "Sphinx", "tags": ["人物志"], "text": "这次的安全周上，我们看到了国内厂商的典型代表——深信服，并且有幸采访到了深信服安全BU业务总经理马程 ，这位工作11年的老员工为我们揭开了深信服成功背后的秘密。"}
{"title": "这款银行木马被发现使用了NSA“永恒之蓝”EXP", "url": "https://www.freebuf.com/news/149174.html", "time": "2017-09-29", "level": "", "num_look": 404657, "num_comment": 1, "author": "Sphinx", "tags": ["系统安全", "资讯"], "text": "来自Proofpoint安全的研究人员发现了一款名为Retefe的银行木马，这款木马使用了与美国国家安全局相关的永恒之蓝exp。"}
{"title": "如何通过LDAP注入在20秒之内绕过Joomla!的登录认证（含演示视频）", "url": "https://www.freebuf.com/articles/web/149059.html", "time": "2017-09-29", "level": "红色标题", "num_look": 466605, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "Joomla!目前的下载量已经超过了8400万次了，它也已经成为了目前全球最热门的内容管理系统之一。据统计，目前互联网上有大约3.3%的网站内容和文章都是由Joomla！驱动的。"}
{"title": "定位SOAPA深耕企业安全，采访爱马术的决策者——兰云科技周宏斌", "url": "https://www.freebuf.com/fevents/149082.html", "time": "2017-09-29", "level": "", "num_look": 251518, "num_comment": 3, "author": "Elaine_z", "tags": ["活动"], "text": "作为国内首家SOAPA架构的安全厂商，兰云科技的定位是怎样帮助企业寻找到风险应对与安全投入之间的平衡点，构建行之有效的企业安全防护体系呢？"}
{"title": "老牌厂商思科打算用AI创造下一代安全架构 | 国家网络安全宣传周展商专访", "url": "https://www.freebuf.com/articles/neopoints/149007.html", "time": "2017-09-29", "level": "", "num_look": 282259, "num_comment": 2, "author": "Sphinx", "tags": ["观点"], "text": "趁着本届国家安全周的机会，我们有幸探访了思科，听听这个曾经创造了网络的巨头对网络安全的新思考。"}
{"title": "江民科技发布全球网安精英人才追缉令", "url": "https://www.freebuf.com/jobs/149150.html", "time": "2017-09-29", "level": "", "num_look": 297515, "num_comment": 11, "author": "人民的名义", "tags": ["安全招聘"], "text": "江民科技现发布SSS级人才追缉令，缉拿项目经理、售前、Linux/Windows/工程师等各路高手大拿！"}
{"title": "开启夜视功能的摄像机被曝可以暗中传输数据", "url": "https://www.freebuf.com/articles/terminal/149037.html", "time": "2017-09-29", "level": "", "num_look": 396522, "num_comment": 2, "author": "Covfefe", "tags": ["终端安全"], "text": "来自以色列内盖夫本古里安大学的研究人员团队日前证明，配备红外设备以启动夜视功能的的安全摄像机能够被暗中访问，并且还可以传输和接收来自其他网络的数据。"}
{"title": "特别企划 | 10大人工智能技术“加持”的安全公司", "url": "https://www.freebuf.com/special/148829.html", "time": "2017-09-29", "level": "红色标题", "num_look": 382061, "num_comment": 3, "author": "liki", "tags": ["特别企划"], "text": "随着网络威胁愈演愈烈，防火墙和杀毒软件这样的安全产品逐渐变成了古老的工具，企业正在寻找更先进的技术来保护那些关键数据。"}
{"title": "对SUID可提权Root Shell的探究", "url": "https://www.freebuf.com/articles/system/149118.html", "time": "2017-09-29", "level": "现金奖励", "num_look": 499390, "num_comment": 8, "author": "ang010ela", "tags": ["系统安全"], "text": "如果拥有SUID权限，那么就可以利用系统中的二进制文件和工具来进行root提权。"}
{"title": "BUF早餐铺 | Facebook “刷赞”软件 Faceliker 激增；时隔两年，Linux 内核 Bug 被重新归类为安全 Issue；韩国指责朝鲜黑客窃取比特币", "url": "https://www.freebuf.com/news/149481.html", "time": "2017-09-29", "level": "", "num_look": 277108, "num_comment": 1, "author": "liki", "tags": ["资讯"], "text": "韩国指责朝鲜黑客窃取比特币；近日发现 Facebook “刷赞”的恶意软件 Faceliker 激增；时隔两年，Linux 内核 Bug 被重新归类为安全 Issue；中国比特币玩家转战海外；ios app 可以读取用户元数据，暴露定位信息。"}
{"title": "安全咨询「全球第一」的德勤被黑，到底打了谁的脸？", "url": "https://www.freebuf.com/articles/neopoints/149447.html", "time": "2017-09-28", "level": "红色标题", "num_look": 1225743, "num_comment": 8, "author": "Sphinx", "tags": ["观点"], "text": "这次德勤被曝出“大量RDP端口对外”“一个帐号全线入侵”“员工将VPN密码上传Github”等低级风险，而其又有着被Gartner评为全球第一的安全咨询业务和销往全球的安全解决方案……"}
{"title": "麻袋理财首席安全官王耀：安全建设靠积累 | 国家网络安全宣传周FreeBuf专访", "url": "https://www.freebuf.com/articles/neopoints/148754.html", "time": "2017-09-28", "level": "", "num_look": 394168, "num_comment": 9, "author": "Sphinx", "tags": ["观点"], "text": "王耀从2005年开始接触信息安全，至今已经有12个年头，他在大学的主修专业是计算机，对于信息安全技术的研究则完全是出于个人兴趣。"}
{"title": "如何突破Windows环境限制打开“命令提示符”", "url": "https://www.freebuf.com/articles/system/149003.html", "time": "2017-09-28", "level": "红色标题", "num_look": 504734, "num_comment": 7, "author": "secist", "tags": ["系统安全"], "text": "如今，许多企业或组织都会通过使用受限的windows环境来减少系统表面的漏洞。系统加固的越好，那么也就意味着能被访问和使用到的功能就越少。"}
{"title": "Equifax数据泄露事件始末：安全高管退休；检察院介入调查；CEO离职；70万英国公民卷入", "url": "https://www.freebuf.com/news/148042.html", "time": "2017-09-28", "level": "红色标题", "num_look": 715882, "num_comment": 3, "author": "liki", "tags": ["资讯"], "text": "9月28日更新，Equifax被爆出大规模数据泄露之后，高管提前退休、暗网诈骗等负面消息余温未散，又有最新报道称指出，其CEO也即将离职。"}
{"title": "微软宣布延期Office漏洞奖励计划", "url": "https://www.freebuf.com/news/148382.html", "time": "2017-09-28", "level": "", "num_look": 238514, "num_comment": 2, "author": "liki", "tags": ["资讯"], "text": "近日，微软宣布延期 Office 漏洞奖励计划，截止日期到今年年底12月31号，使安全研究人员有更充足的时间提交漏洞。"}
{"title": "东方财富安全管理部诚招贤才", "url": "https://www.freebuf.com/jobs/148963.html", "time": "2017-09-28", "level": "", "num_look": 272526, "num_comment": 12, "author": "东方财富安全应急响应中心", "tags": ["安全招聘"], "text": "东方财富网创办于2004年,始终坚持“用户为王”的经营理念，为全国广大投资者提供专业、及时、全面的金融信息服务。"}
{"title": "深入分析CCleaner后门代码：编译环境污染类的供应链攻击案例", "url": "https://www.freebuf.com/articles/system/149009.html", "time": "2017-09-28", "level": "", "num_look": 347047, "num_comment": 2, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "2017年9月18日，公告称该公司开发的CCleaner 应用程序被植入了恶意代码。导致百万级别的用户受到影响，泄露机器相关的敏感信息甚至极少数被执行了更多的恶意代码。"}
{"title": "谁是年度云安全最佳捍卫者 | WitAwards 2017年度云安全产品及服务评选「报名进行中」", "url": "https://www.freebuf.com/news/149159.html", "time": "2017-09-28", "level": "红色标题", "num_look": 259317, "num_comment": 3, "author": "FB客服", "tags": ["头条", "活动"], "text": "「年度云安全产品及服务」奖项评选，重点关注本年度国内云安全产品的技术创新性、服务普惠性、产品体验及发展前景。"}
{"title": "Linux木马使用被黑物联网设备发送垃圾邮件", "url": "https://www.freebuf.com/news/148950.html", "time": "2017-09-28", "level": "", "num_look": 300577, "num_comment": 2, "author": "Sphinx", "tags": ["资讯"], "text": "僵尸网络的数量在不断增加，对这些网络的用法也推陈出新。最近研究人员发现僵尸网络被用来发送垃圾邮件。"}
{"title": "十分钟看懂MongoDB攻防实战", "url": "https://www.freebuf.com/articles/database/148823.html", "time": "2017-09-28", "level": "", "num_look": 632402, "num_comment": 5, "author": "杭州美创科技", "tags": ["数据安全"], "text": "本文重点介绍针对于NoSQL数据库的攻击，通过MongoDB漏洞攻击Web应用程序。"}
{"title": "BUF早餐铺 | 更多证据显示俄罗斯或干预了去年的美国大选；沉睡一年的“脏牛”又被攻击者利用；Google发布iPhone 7 Wifi漏洞利用POC", "url": "https://www.freebuf.com/news/149342.html", "time": "2017-09-28", "level": "", "num_look": 291806, "num_comment": 3, "author": "Sphinx", "tags": ["资讯"], "text": "再曝实锤，更多证据显示俄罗斯或干预了去年的美国大选；沉睡一年的“脏牛”又被攻击者利用；CBS 网站被发现在用户浏览器中挖矿；Google发布iPhone 7 Wifi漏洞利用POC。"}
{"title": "“幽灵小组”向全球数千家公司发出勒索邮件：9月30日发起DDoS攻击，你收到了吗？", "url": "https://www.freebuf.com/news/149137.html", "time": "2017-09-27", "level": "金币+8", "num_look": 636754, "num_comment": 24, "author": "J1anCan", "tags": ["资讯"], "text": "近日，一自称为“幽灵小组”（Phantom Squad）的DDoS勒索组织向全球数千家公司发起了大规模的垃圾邮件攻击，威胁称，若受害者不支付赎金，就会在9月30日发动DDoS攻击。"}
{"title": "国产漏洞靶场Webug 3.0发布", "url": "https://www.freebuf.com/sectool/148790.html", "time": "2017-09-27", "level": "金币+8", "num_look": 1656520, "num_comment": 96, "author": "小小艾_Joker", "tags": ["工具"], "text": "webug名称定义为“我们的漏洞”靶场环境，基础环境是基于PHP/mysql制作搭建而成，中级环境与高级环境分别都是由互联网漏洞事件而收集的漏洞存在的操作环境。"}
{"title": "超过7%的Amazon S3服务器可公开访问，导致数据泄露事件激增", "url": "https://www.freebuf.com/articles/system/149092.html", "time": "2017-09-27", "level": "", "num_look": 486677, "num_comment": 2, "author": "liki", "tags": ["系统安全"], "text": "在过去的一年中，关于 Amazon S3 服务器泄露数据的报道突然多了起来，这些泄露的数据暴露了许多公司和其客户的私人信息。"}
{"title": "摩拜单车诚聘安全人才", "url": "https://www.freebuf.com/jobs/148947.html", "time": "2017-09-27", "level": "红色标题", "num_look": 576257, "num_comment": 26, "author": "mobiker", "tags": ["安全招聘"], "text": "摩拜单车创建了全球首个智能共享单车模式，其自主研发的专利智能锁集成了 GPS 和通讯模块。"}
{"title": "知道创宇赵伟：单打独斗非好汉，合作方能成就未来 | 国家网络安全宣传周展商专访", "url": "https://www.freebuf.com/articles/neopoints/149250.html", "time": "2017-09-27", "level": "", "num_look": 552201, "num_comment": 6, "author": "Akane", "tags": ["观点"], "text": "在网络安全圈，单打独斗是成不了事的，赵伟希望看到的是业界联合、资源共享、责任共担。"}
{"title": "心脏滴血后的第三年，OpenSSL开源团队访华纪实", "url": "https://www.freebuf.com/fevents/148827.html", "time": "2017-09-27", "level": "红色标题", "num_look": 388044, "num_comment": 5, "author": "Elaine_z", "tags": ["活动"], "text": "在这个隐私丧失的时代里，加密技术能带来什么？OpenSSL开源团队做了些什么？三年之前的心脏滴血漏洞又给他们带来了哪些改变？"}
{"title": "至少两个国家运营商参与了FinFisher间谍软件的传播", "url": "https://www.freebuf.com/news/148674.html", "time": "2017-09-27", "level": "", "num_look": 250202, "num_comment": 1, "author": "liki", "tags": ["资讯"], "text": "ESET的安全研究人员发现在追踪了 FInFIsher （FInSpy）间谍软件的传播情况之后，发现有至少两个国家的互联网服务提供商参与了该恶意软件的分发活动。"}
{"title": "“IOT幽灵”样本分析报告：物联网僵尸网络的监测与分析", "url": "https://www.freebuf.com/articles/terminal/148668.html", "time": "2017-09-27", "level": "现金奖励", "num_look": 397416, "num_comment": 5, "author": "水滴安全实验室", "tags": ["终端安全"], "text": "近年来，国家高度重视物联网的发展，物联网已经上升为国家战略产业。随着物联网的普及，规模的扩大，安全问题也必然随之而来。"}
{"title": "BUF早餐铺 | Cloudflare新服务或将让DDoS攻击成为历史；7%的AWS3服务器不安全；德勤遭数据泄露；全国首例用AI侵犯公民个人信息案破获", "url": "https://www.freebuf.com/news/149205.html", "time": "2017-09-27", "level": "", "num_look": 244620, "num_comment": 3, "author": "AngelaY", "tags": ["资讯"], "text": "深夜的酒不如清晨的粥好喝。按时作息，好好吃早餐，祝你今天也能量满满。"}
{"title": "快讯 | 全球四大会计师事务所之一德勤遭黑客攻击，邮件系统被入侵导致客户敏感邮件泄露", "url": "https://www.freebuf.com/news/149210.html", "time": "2017-09-26", "level": "红色标题", "num_look": 448217, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "就在昨天，作为全球四大会计师事务所的Deloitte（德勤）声称自己经历了一次网络攻击，并导致其全球电子邮件服务器被入侵。在此次事件中，攻击者成功访问了部分客户的私人邮件以及公司的业务计划。"}
{"title": "【周三直播预告】「36W」 白帽大佬的挖洞秘笈分享： HTTP盲攻击的几种思路", "url": "https://www.freebuf.com/fevents/148995.html", "time": "2017-09-26", "level": "红色标题", "num_look": 382484, "num_comment": 2, "author": "FB客服", "tags": ["活动"], "text": "9月27日（周三）12:00公开课报名通道关闭啦！9月27日（周三）21:00公开课直播就要开始啦！"}
{"title": "网站代码中暗藏JS挖矿机脚本", "url": "https://www.freebuf.com/articles/web/149107.html", "time": "2017-09-26", "level": "", "num_look": 1354375, "num_comment": 11, "author": "360安全", "tags": ["WEB安全"], "text": "挖矿机这个名字相信大家已经越来越熟悉，但网页版的挖矿机大家有没有见过呢？"}
{"title": "ACHE：一款功能强大的聚焦型网络爬虫", "url": "https://www.freebuf.com/geek/148568.html", "time": "2017-09-26", "level": "", "num_look": 502989, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["极客"], "text": "今天给大家介绍的是一款名叫ACHE的聚焦型网络爬虫工具，你可以给它指定一个需要搜索的主题或属性内容，它便会给你返回相关的搜索页面。"}
{"title": "披着羊皮的狼：Webfreer翻墙浏览器暗藏挖矿木马", "url": "https://www.freebuf.com/news/148625.html", "time": "2017-09-26", "level": "红色标题", "num_look": 1011994, "num_comment": 6, "author": "腾讯电脑管家", "tags": ["资讯"], "text": "虚拟币通过消耗计算机计算力来产生钱币，面对万亿市值的虚拟币市场，不少不法分子动起了坏心思，“前仆后继”地踏上不一样的挖矿之路。"}
{"title": "上海连尚网络（WiFi万能钥匙）招聘安全工程师", "url": "https://www.freebuf.com/jobs/148906.html", "time": "2017-09-26", "level": "", "num_look": 535275, "num_comment": 20, "author": "半夏初晴。", "tags": ["安全招聘"], "text": "WiFi万能钥匙招聘安全运维工程师，安卓逆向工程师，安全运营专员。"}
{"title": "“包小姐”转战QQ空间，揭开网络招嫖诈骗内幕", "url": "https://www.freebuf.com/articles/network/148894.html", "time": "2017-09-26", "level": "现金奖励", "num_look": 775865, "num_comment": 7, "author": "安全豹", "tags": ["网络安全"], "text": "据不完全统计全世界使用QQ的人数已经超过5亿，而QQ营销的产生就是基于QQ这庞大的使用人群。QQ成了日常交流的主要工具，而这也成为了企业营销的主要战场，赤裸裸的广告轰炸，漫天飞雨般的色情广告。"}
{"title": "常见的WiFi攻击技术及检测方法总结", "url": "https://www.freebuf.com/articles/wireless/148773.html", "time": "2017-09-26", "level": "", "num_look": 993353, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["无线安全"], "text": "在这篇文章中，我们将会对 802.11 的相关内容进行简单的介绍，并针对当前常见的WiFi攻击以及检测技术进行描述。"}
{"title": "系统清理工具CCleaner后门事件后续：黑客删除服务器内容，Avast 公布受感染公司名单", "url": "https://www.freebuf.com/news/148888.html", "time": "2017-09-26", "level": "", "num_look": 497415, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "研究显示，CCleaner 黑客用于存储来自受感染主机数据的数据库空间不足，因此在 9 月 12 日将该数据库删除。这意味着受害者信息现在已经丢失、难以追查。"}
{"title": "基于ThinkPHP的2个CMS后台GetShell利用", "url": "https://www.freebuf.com/articles/web/148629.html", "time": "2017-09-26", "level": "现金奖励", "num_look": 770044, "num_comment": 31, "author": "Mochazz", "tags": ["WEB安全"], "text": "Thinkphp在缓存使用却存在缺陷，生成缓存时，Thinkphp会将数据序列化存进一个php文件，这就产生了很大的安全问题。"}
{"title": "Buf早餐铺 | Adobe 安全团队不小心公开了他们的私钥；恶意软件开发者们偏爱嵌入在线挖矿工具Coinhive；新型恶意软件要求发裸照解锁", "url": "https://www.freebuf.com/news/148907.html", "time": "2017-09-26", "level": "", "num_look": 442755, "num_comment": 4, "author": "Elaine_z", "tags": ["资讯"], "text": "一场秋雨一场寒。你喜欢秋天吗，其实我可不喜欢阴雨连绵，看不见阳光的日子。Buf 早餐铺，每天给你加能量，一起来看看吧！"}
{"title": "解密攻击者如何利用D-Link路由器构建僵尸网络", "url": "https://www.freebuf.com/articles/terminal/148396.html", "time": "2017-09-25", "level": "", "num_look": 428569, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "在这篇文章中，我们将跟大家讨论我们在几台顶级D-Link路由器中发现的安全漏洞。"}
{"title": "利用空调系统对隔离网络中的电脑发送指令", "url": "https://www.freebuf.com/articles/system/148575.html", "time": "2017-09-25", "level": "红色标题", "num_look": 617843, "num_comment": 4, "author": "Sphinx", "tags": ["系统安全", "网络安全"], "text": "供热通风与空气调节（HVAC）系统可以用作传输数据，即便是隔离网络的电脑，黑客也可以利用空调系统向断网的电脑发送指令。"}
{"title": "爱加密科技诚聘安全相关人才", "url": "https://www.freebuf.com/jobs/148395.html", "time": "2017-09-25", "level": "", "num_look": 370568, "num_comment": 3, "author": "guochao610", "tags": ["安全招聘"], "text": "爱加密是全球专业的移动信息安全服务提供商,专注于移动应用安全、大数据及物联网安全，坚持以用户需求为导向、持续不断的创新。"}
{"title": "致敬安全行业年度风云人物 | WitAwards 2017年度安全人物评选「报名进行中」", "url": "https://www.freebuf.com/news/148497.html", "time": "2017-09-25", "level": "红色标题", "num_look": 281334, "num_comment": 2, "author": "FB客服", "tags": ["头条", "资讯"], "text": "如果说安全是互联网的基石，那么他们就是安全行业的中流砥柱——以「年度安全人物」之名向他们致敬。"}
{"title": "让木马病毒DNS数据传输成为历史：看我如何让XShell病毒失效", "url": "https://www.freebuf.com/articles/network/147444.html", "time": "2017-09-25", "level": "金币+12", "num_look": 831755, "num_comment": 12, "author": "ChuanFile", "tags": ["网络安全"], "text": "随着越来越多的公司安全意识提高，大量公司已封锁socket通信，仅允许员工通过http/https协议外网，同时采取了越来越多针对http协议的检测措施."}
{"title": "不请自来 | Redis 未授权访问漏洞深度利用", "url": "https://www.freebuf.com/vuls/148758.html", "time": "2017-09-25", "level": "现金奖励", "num_look": 1034307, "num_comment": 15, "author": "yangyangwithgnu", "tags": ["漏洞"], "text": "redis虽然是高性能内存数据库，但也支持将内存数据保存至硬盘上，实现持久化存储。由于 redis 未强制访问鉴权，导致未授权访问漏洞频发，入侵者借此控制 redis 间接获得系统写文件的能力，极大提升攻击力。"}
{"title": "揭秘：黑客究竟对你的“被盗数据”做了什么？", "url": "https://www.freebuf.com/news/148194.html", "time": "2017-09-25", "level": "", "num_look": 549680, "num_comment": 2, "author": "米雪儿", "tags": ["数据安全", "资讯"], "text": "大多数人已经意识到，由于过去几年信息泄露事件频发（如2016年下半年的雅虎事件，以及近期的Equifax数据泄漏事件），未来身份盗窃的案件将日益增多。"}
{"title": "Buf早餐铺 | 广州GOMO开发的GO输入法收集用户隐私信息；美国证券交易委员会发现黑客疑似窃取财务资料非法牟利；入侵电源管理可以黑掉芯片", "url": "https://www.freebuf.com/news/148681.html", "time": "2017-09-25", "level": "", "num_look": 246678, "num_comment": 3, "author": "Elaine_z", "tags": ["资讯"], "text": "秋意渐浓的日子，Buf早餐铺给你提供温暖的晨间餐，一起来看看吧！"}
{"title": "如何对Flash应用进行渗透测试，并在21点纸牌游戏中作弊", "url": "https://www.freebuf.com/news/148610.html", "time": "2017-09-24", "level": "金币+12", "num_look": 605315, "num_comment": 12, "author": "Alpha_h4ck", "tags": ["WEB安全", "资讯"], "text": "为了能够让大家更好地理解，我选择了21点纸牌游戏作为演示例子。我们将会研究如何控制系统的发牌以及计分逻辑。"}
{"title": "工业控制系统安全之——Modbus学习笔记", "url": "https://www.freebuf.com/articles/ics-articles/148637.html", "time": "2017-09-24", "level": "金币+12", "num_look": 901065, "num_comment": 15, "author": "rye_", "tags": ["工控安全"], "text": "Modbus使用一种简单的MasterandSlave主从协议（客户机/服务器协议）进行通信。客户机作为主站，向服务器发送请求；服务器（从站）接到请求后，对请求进行分析并作出应答。"}
{"title": "pyDHE：一个完整的PythonDiffie-Hellman库", "url": "https://www.freebuf.com/articles/database/148394.html", "time": "2017-09-24", "level": "", "num_look": 411460, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["数据安全"], "text": "今天给大家介绍一款名叫pyDHE的GitHub开源项目，这是一个采用Python开发的完整的Diffie-Hellman库，有需要的同学可以尝试使用或者贡献自己的代码。"}
{"title": "金证科技（港交所）招聘助理安全专家、安全专家", "url": "https://www.freebuf.com/jobs/147934.html", "time": "2017-09-24", "level": "", "num_look": 319524, "num_comment": 19, "author": "LinuxSelf", "tags": ["安全招聘"], "text": "深圳市金证科技股份有限公司（以下简称“金证”）成立于1998年，2003年在上海证券交易所上市（股票代码：600446）。"}
{"title": "美国证券交易委员会系统遭入侵，敏感信息被黑客用于非法获利", "url": "https://www.freebuf.com/news/148767.html", "time": "2017-09-24", "level": "", "num_look": 291159, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "日前， 美国政府机构金融监管部门、美国证券交易委员会（SEC）发布声明，称其财务文件档案系统曾遭黑客入侵，且黑客可能已经利用窃取的信息非法获利。"}
{"title": "Node.js中的内存泄漏分析", "url": "https://www.freebuf.com/articles/web/147956.html", "time": "2017-09-24", "level": "金币+15", "num_look": 501783, "num_comment": 3, "author": "北其Gg", "tags": ["WEB安全"], "text": "内存泄漏是开发者们不能绕过的一个问题，今天让我们来了解如何分析 Node.js 中的内存泄漏。"}
{"title": "僵尸网络Jenki家族IoT变种分析预警", "url": "https://www.freebuf.com/articles/network/148678.html", "time": "2017-09-24", "level": "", "num_look": 513584, "num_comment": 5, "author": "放牛娃", "tags": ["网络安全"], "text": "威胁情报自动化监控 系统再次捕获到Jenki的新家族变种实现从linux x86领域拓展到IoT 和Windows领域，使该僵尸网络快速覆盖多种平台操作系统."}
{"title": "北京昆仑卓越信息安全团队招聘安全大牛", "url": "https://www.freebuf.com/jobs/146935.html", "time": "2017-09-23", "level": "", "num_look": 310487, "num_comment": 2, "author": "kunlunzhuoyue", "tags": ["安全招聘"], "text": "北京昆仑卓越信息技术有限公司成立于2008年，主营业务——数据服务和信息安全服务（信息安全咨询、安全评估、渗透测试、安全集成解决方案等 IT服务）业务。"}
{"title": "【FB TV】一周「BUF大事件」：国家网络安全宣传周在上海举行；美国征信巨头Equifax信息泄漏升级；WitAwards 2017「年度品牌影响力」评选正式启动", "url": "https://www.freebuf.com/video/148766.html", "time": "2017-09-23", "level": "红色标题", "num_look": 1132500, "num_comment": 1, "author": "willhuang", "tags": ["视频"], "text": "本周第四届国家网络安全宣传周在上海举行，中央领导刘云山莅临现场；美国征信巨头Equifax信息泄漏升级；WitAwards 2017「年度品牌影响力」评选正式启动。"}
{"title": "CNNVD关于Apache Tomcat远程代码执行漏洞情况的通报", "url": "https://www.freebuf.com/news/148502.html", "time": "2017-09-23", "level": "", "num_look": 413679, "num_comment": 2, "author": "CNNVD", "tags": ["其他", "资讯"], "text": "近日，国家信息安全漏洞库（CNNVD）接到有关Apache Tomcat存在远程代码执行漏洞（CNNVD-201709-899）情况的报送。"}
{"title": "找出恶意垃圾邮件插件的幕后“真凶”", "url": "https://www.freebuf.com/articles/web/148193.html", "time": "2017-09-23", "level": "", "num_look": 431706, "num_comment": 3, "author": "secist", "tags": ["WEB安全"], "text": "而在本文中，我们将对该恶意插件进一步的探索分析，并最终溯源其幕后人物。"}
{"title": "Handy Collaborator ：用于挖掘out-of-band类漏洞的Burp插件介绍", "url": "https://www.freebuf.com/sectool/147948.html", "time": "2017-09-23", "level": "", "num_look": 474227, "num_comment": 2, "author": "secist", "tags": ["WEB安全", "工具"], "text": "本文我将介绍一个新的 Burp Suite插件Handy Collaborator，是添加到Burp Suite的外部服务器，主要用于挖掘那些仅来自外部服务交互的out-of-band（带外）漏洞和问题。"}
{"title": "Chrome XSS审计之SVG标签绕过", "url": "https://www.freebuf.com/articles/network/147951.html", "time": "2017-09-23", "level": "红色标题", "num_look": 583292, "num_comment": 4, "author": "东林", "tags": ["网络安全"], "text": "我们将从黑盒测试的角度来观察一个逻辑假设和结论, 导致我们的 XSS 向量绕过了xss过滤器。"}
{"title": "科技行业什么技能最吃香？竟然不是写代码", "url": "https://www.freebuf.com/articles/neopoints/147937.html", "time": "2017-09-23", "level": "", "num_look": 412845, "num_comment": 3, "author": "Covfefe", "tags": ["观点"], "text": "你可以在媒体中看到很多以数据为驱动的分析，这些能帮助你了解哪些技能可以提高收入或者帮你找到工作，但这其实并不重要。"}
{"title": "微软安全发布2017上半年勒索软件事件分析与统计图", "url": "https://www.freebuf.com/articles/paper/147638.html", "time": "2017-09-23", "level": "", "num_look": 420407, "num_comment": 1, "author": "Carrie_spinfo", "tags": ["安全报告"], "text": "2017年上半年，勒索软件攻击的复杂程度达到了新的高度。不仅复杂性增加，新的勒索软件代码发布与传播速度也是惊人。"}
{"title": "CNNVD关于电脑垃圾清理软件CCleaner存在恶意代码情况的通报", "url": "https://www.freebuf.com/news/148547.html", "time": "2017-09-22", "level": "", "num_look": 342370, "num_comment": 1, "author": "CNNVD", "tags": ["其他", "资讯"], "text": "CCleaner 5.33.6162版本和CCleaner Cloud 1.07.3191版本中的32位应用程序存在恶意代码，可导致远程代码执行或用户隐私泄露等，造成更严重的危害。"}
{"title": "FreeTalk深圳站明天见 | 这才叫FreeTalk，别的活动只能叫FreeStyle", "url": "https://www.freebuf.com/fevents/147446.html", "time": "2017-09-22", "level": "红色标题", "num_look": 386215, "num_comment": 19, "author": "FB客服", "tags": ["活动"], "text": "“Free” 意味着 FreeBuf 开办以来一直坚持的自由分享精神，也意味着活动完全免费。安全从业者与爱好者们，我们准备好了美味茶歇和精彩议题，在这里等着你！"}
{"title": "还记得针对NPM的Typosquatting攻击吗？这次它又将目标对准了PyPi", "url": "https://www.freebuf.com/news/148153.html", "time": "2017-09-22", "level": "", "num_look": 263858, "num_comment": 2, "author": "liki", "tags": ["资讯"], "text": "近日，斯洛伐克国家安全局（NBU）在 Python 官方的第三方软件存储库——PyPI 上发现10个恶意库。"}
{"title": "安卓Trustzone降级攻击解析", "url": "https://www.freebuf.com/news/148222.html", "time": "2017-09-22", "level": "", "num_look": 412293, "num_comment": 2, "author": "百度安全实验室", "tags": ["终端安全", "资讯"], "text": "如今人们经常在手机上进行账号登录、金钱交易等安全敏感的操作。为了保护这些操作，手机需要能把可信和不可信的程序有效隔离开来。"}
{"title": "我是如何通过CSRF拿到Shell的", "url": "https://www.freebuf.com/vuls/148257.html", "time": "2017-09-22", "level": "现金奖励", "num_look": 782425, "num_comment": 43, "author": "sjy93812", "tags": ["漏洞"], "text": "最近我发现织梦的后台竟然有一个可以直接执行SQL语句的功能，出于职业敏感，又经过一番查找发现了它后台存在一个CSRF的漏洞。"}
{"title": "借贷宝诚聘Linux安全开发工程师", "url": "https://www.freebuf.com/jobs/147739.html", "time": "2017-09-22", "level": "", "num_look": 354593, "num_comment": 9, "author": "Jeames", "tags": ["安全招聘"], "text": "人人行控股是九鼎控股旗下的互联网金融业务板块。人人行控股体系包括借贷宝平台，及九信金融、九云小贷、今始科技（linkface）、九购科技等多个子公司。"}
{"title": "揭秘 | NSA内部文件背后的故事", "url": "https://www.freebuf.com/articles/others-articles/148161.html", "time": "2017-09-22", "level": "红色标题", "num_look": 314546, "num_comment": 1, "author": "Covfefe", "tags": ["其他"], "text": "根据NSA核心情报的内部新闻网站SIDtoday的294篇文章，我们可以看一看NSA背后那些不为人知的故事。"}
{"title": "卡巴斯基2017第二季度APT趋势分析报告", "url": "https://www.freebuf.com/articles/paper/148002.html", "time": "2017-09-22", "level": "", "num_look": 402623, "num_comment": 3, "author": "米雪儿", "tags": ["安全报告"], "text": "自2014年以来，卡巴斯基实验室的全球研究与分析团队（GReAT）就一直在为全球范围内的广大客户提供威胁情报报告，从而提供全面而专业的私人报告服务。"}
{"title": "Linux主机加固丨 防御者如何加强主机权限控制", "url": "https://www.freebuf.com/articles/system/147985.html", "time": "2017-09-22", "level": "金币+8", "num_look": 420993, "num_comment": 8, "author": "悬镜安全实验室", "tags": ["系统安全"], "text": "运维中会受到权限的困扰，给多了就违背了最小权限原则，造成系统出现安全隐患，给少了业务又无法正常进行，下面来看看如何优雅的控制系统权限，保证系统安全。"}
{"title": "BUF早餐铺 | 维基解密瞄准俄罗斯；据传华为被罚5亿，数据丢失遭中国移动“全国系统排查” ；渗透神器Burp Suite被曝远程代码执行漏洞，官方回复称证据不充分", "url": "https://www.freebuf.com/news/148581.html", "time": "2017-09-22", "level": "", "num_look": 289863, "num_comment": 2, "author": "liki", "tags": ["资讯"], "text": "渗透神器Burp Suite被曝远程代码执行漏洞，官方回复称证据不充分；维基解密瞄准俄罗斯；据传华为被罚5亿，数据丢失遭中国移动“全国系统排查”。"}
{"title": "维基解密瞄准俄罗斯：国家机构承包商Peter-Service提供的大规模监控系统公诸于世", "url": "https://www.freebuf.com/news/148614.html", "time": "2017-09-21", "level": "", "num_look": 279372, "num_comment": 3, "author": "AngelaY", "tags": ["资讯"], "text": "维基解密日前发布了一批名为 “Spy File Russia” 的文件，详细介绍了俄罗斯 Peter-Service 公司协助国家机构部署的监控设施。"}
{"title": "如何将Pastebin上的信息应用于安全分析和威胁情报领域", "url": "https://www.freebuf.com/articles/network/147984.html", "time": "2017-09-21", "level": "", "num_look": 571229, "num_comment": 1, "author": "secist", "tags": ["网络安全"], "text": "Pastebin是一个便签类站点，用户可以在该平台任意储存纯文本，例如代码，文字等内容。"}
{"title": "快讯 | 渗透神器Burp Suite被曝远程代码执行漏洞，官方回复称证据不充分", "url": "https://www.freebuf.com/vuls/148516.html", "time": "2017-09-21", "level": "红色标题", "num_look": 524344, "num_comment": 16, "author": "liki", "tags": ["漏洞"], "text": "近日，国外安全人员披露了一个该工具存在远程代码执行漏洞的视频，Burp Suite 官方在推特上对此回复：视频证据并不充分，并有可能是伪造的。"}
{"title": "FFmpeg CVE-2016-10191漏洞分析及利用", "url": "https://www.freebuf.com/vuls/148389.html", "time": "2017-09-21", "level": "", "num_look": 450608, "num_comment": 8, "author": "阿里聚安全", "tags": ["漏洞"], "text": "FFmpeg是一个著名的处理音视频的开源项目，使用者众多。2016年末paulcher发现FFmpeg三个堆溢出漏洞，本文详细分析了CVE-2016-10191。"}
{"title": "Optionsbleed 漏洞泄露 Apache Server 的内存信息", "url": "https://www.freebuf.com/vuls/148525.html", "time": "2017-09-21", "level": "", "num_look": 391531, "num_comment": 2, "author": "Elaine_z", "tags": ["漏洞"], "text": "安全研究员Hanno Böck发现，部分Apache服务器可能因Optionsbleed漏洞泄漏服务器内存信息，这个漏洞和OpenSSL的心脏滴血问题有相似的地方。"}
{"title": "Flash芯片内存提取（一）", "url": "https://www.freebuf.com/geek/147847.html", "time": "2017-09-21", "level": "", "num_look": 641958, "num_comment": 11, "author": "S2ealea", "tags": ["极客"], "text": "作为Flash芯片内容提取系列的第一部分，本文将介绍如何拆焊Flash芯片，设计及制作相应的分线板。"}
{"title": "顺丰金融招聘安全开发高级工程师", "url": "https://www.freebuf.com/jobs/148223.html", "time": "2017-09-21", "level": "", "num_look": 287224, "num_comment": 1, "author": "zglxw", "tags": ["安全招聘"], "text": "顺丰金融（www.sf-financial.com）起步于2011年，一直以来专注于构建和研究具有顺丰特色的金融服务及互联网金融模式。"}
{"title": "Oreint DB 远程代码执行漏洞", "url": "https://www.freebuf.com/vuls/147740.html", "time": "2017-09-21", "level": "金币+8", "num_look": 691201, "num_comment": 4, "author": "cc是我表哥", "tags": ["数据安全", "漏洞"], "text": "由于Orient db启用了这些功能，导致了OrientDB具有一个可以执行常规的功能，并且这个groovy封装器没有沙箱进行保护导致了系统功能被访问，导致我们可以运任何命令。"}
{"title": "蜜罐背后的影子系统探秘", "url": "https://www.freebuf.com/articles/web/147892.html", "time": "2017-09-21", "level": "现金奖励", "num_look": 551312, "num_comment": 15, "author": "糖果L5Q", "tags": ["WEB安全"], "text": "一种部署蜜罐系统的思路是，我们可以在蜜罐被触碰的时候，把流量引入到一台具体的机器上，伪装成一个正常的服务，像侦查机一样，收集攻击服务。"}
{"title": "BUF早餐铺 | 百度杀毒软件被发现窃取用户数据；微软延长漏洞提交截止日期；Fitbit穿戴设备中存在数据泄漏隐患；Chrome扩展程序嵌入挖矿程序", "url": "https://www.freebuf.com/news/148443.html", "time": "2017-09-21", "level": "", "num_look": 319539, "num_comment": 10, "author": "Sphinx", "tags": ["资讯"], "text": "百度杀毒软件被发现窃取用户数据；微软延长漏洞提交截止日期；Chrome扩展程序嵌入Monero挖矿程序，榨干你的CPU。"}
{"title": "最新RTF漏洞野外利用分析报告", "url": "https://www.freebuf.com/vuls/148086.html", "time": "2017-09-21", "level": "", "num_look": 359944, "num_comment": 1, "author": "腾讯电脑管家", "tags": ["漏洞"], "text": "近日发现了刚被微软修复的.NET Framework漏洞（CVE-2017-8759）的野外攻击样本。该漏洞只要用户打开恶意的Office文档就会中招。"}
{"title": "供应链幽灵再现：CCleaner软件攻击分析报告", "url": "https://www.freebuf.com/articles/system/148294.html", "time": "2017-09-21", "level": "", "num_look": 335742, "num_comment": 1, "author": "360安全", "tags": ["系统安全"], "text": "近日，流行系统优化软件CCleaner官方Piriform公司发布的正规安装包被植入恶意代码，该攻击使用了和前段时间xshell后门类似的供应链攻击手法。"}
{"title": "Samba远程代码执行漏洞（CVE-2017-7494）分析", "url": "https://www.freebuf.com/vuls/147954.html", "time": "2017-09-21", "level": "金币+6", "num_look": 441743, "num_comment": 3, "author": "北其Gg", "tags": ["漏洞"], "text": "2017年5月24日Samba发布了4.6.4版本，中间修复了一个严重的远程代码执行漏洞，漏洞编号CVE-2017-7494，漏洞影响了Samba 3.5.0 和包括4.6.4/4.5.10/4.4.14中间的版本。"}
{"title": "卡巴斯基：“连接医疗”（Connected Medicine）的安全隐患及其安全建议", "url": "https://www.freebuf.com/news/148032.html", "time": "2017-09-20", "level": "", "num_look": 237326, "num_comment": 2, "author": "米雪儿", "tags": ["资讯"], "text": "如今，医疗数据分散地存储在数据库、门户网站以及医疗设备之中。这些组织的网络基础设施安全性经常被忽略，而且存储医疗信息的资源也可以通过外部渠道轻松地获取到。"}
{"title": "广东省强网杯CTF Web部分详解", "url": "https://www.freebuf.com/news/147306.html", "time": "2017-09-20", "level": "金币+6", "num_look": 523181, "num_comment": 3, "author": "Mochazz", "tags": [], "text": "周末打了一场CTF，只做了Web部分，学到不少东西，不过Web题量太少了，两天才4题。下面是具体解题思路。"}
{"title": "Android Studio源码扫描工具：Code Arbiter", "url": "https://www.freebuf.com/sectool/147843.html", "time": "2017-09-20", "level": "", "num_look": 533530, "num_comment": 8, "author": "nightmarelee", "tags": ["工具"], "text": "Android Code Arbiter依托FindBugs插件，根据Find Security Bugs为蓝本进行更改，以扩展jar包的形式在FindBugs上运行。"}
{"title": "无声信息Windows安全研究员等岗位招聘", "url": "https://www.freebuf.com/jobs/147344.html", "time": "2017-09-20", "level": "", "num_look": 346604, "num_comment": 19, "author": "silenceHR", "tags": ["安全招聘"], "text": "“四川无声信息技术有限公司”（简称“无声信息”）成立于2000年，现有员工两百余名。十五年来专注于信息安全领域的产品研发和服务。"}
{"title": "你的终端是安全的吗？iTerm2 中可能通过 DNS 请求泄漏隐私信息", "url": "https://www.freebuf.com/news/148292.html", "time": "2017-09-20", "level": "红色标题", "num_look": 498516, "num_comment": 6, "author": "Elaine_z", "tags": ["漏洞", "资讯"], "text": "Mac 上的开发者可能非常熟悉 iTerm2 这款终端应用程序，甚至已经取代了 Apple 官方终端应用的地位。但iTerm2中仍然存在一个严重级别的安全问题——这个问题出现在DNS请求中，可能泄露终端内部分内容。"}
{"title": "Tomcat 远程代码执行漏洞分析（CVE-2017-12615）及补丁 Bypass", "url": "https://www.freebuf.com/vuls/148283.html", "time": "2017-09-20", "level": "红色标题", "num_look": 1301667, "num_comment": 15, "author": "腾讯云安全", "tags": ["漏洞"], "text": "腾讯云安全中心监测到Apache Tomcat修复了2个高危漏洞，分别为：信息泄露漏洞（CVE-2017-12616）、远程代码执行漏洞（CVE-2017-12615）。"}
{"title": "Face ID是否使iPhone X更安全？答案可能取决于你自己", "url": "https://www.freebuf.com/news/147738.html", "time": "2017-09-20", "level": "", "num_look": 237628, "num_comment": 2, "author": "liki", "tags": ["资讯"], "text": "这周的苹果发布会看完之后感觉如何，是否也觉得乏善可陈没有太多亮点呢，当然 iphone X 可算是主角中的主角，尤其搭载了Face ID之后。"}
{"title": "利用PowerShell代码注入漏洞绕过受限语言模式", "url": "https://www.freebuf.com/articles/system/147952.html", "time": "2017-09-20", "level": "金币+6", "num_look": 305257, "num_comment": 1, "author": "北其Gg", "tags": ["系统安全"], "text": "受限语言模式是一种非常有效的机制，能阻止在PowerShell中执行任意未签名的代码。"}
{"title": "VMware修复多个严重SVGA代码执行漏洞", "url": "https://www.freebuf.com/articles/terminal/148050.html", "time": "2017-09-20", "level": "", "num_look": 322192, "num_comment": 1, "author": "Sphinx", "tags": ["终端安全"], "text": "VMware本周发布补丁修复数个漏洞，包括一个严重漏洞，漏洞涉及的产品包括ESXi, vCenter Server, Workstation和Fusion。"}
{"title": "我如何使用Cloud Fuzzing挖到了一个Tcpdump漏洞", "url": "https://www.freebuf.com/articles/network/147955.html", "time": "2017-09-20", "level": "金币+6", "num_look": 530765, "num_comment": 5, "author": "北其Gg", "tags": ["网络安全"], "text": "在这篇文章中，我们将介绍Cloud Fuzzing的完整过程。通过这种技术(softScheck Cloud Fuzing Framework-sCFF)，我成功地在Ubuntu 16.04的tcpdump(4.9版本)中发现了一个安全漏洞。"}
{"title": "BUF早餐铺 | 系统清理工具CCleaner被植入后门，影响200多万用户；新安卓银行木马Red Alert 2.0现身；谷歌巴西官网被黑", "url": "https://www.freebuf.com/news/148234.html", "time": "2017-09-20", "level": "", "num_look": 266552, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "空山新雨后，天气晚来秋。天气转凉了，来 BUF 早餐铺滋补一下吧。"}
{"title": "探访2017国家网络安全宣传周，参展安全厂商巡礼（下）", "url": "https://www.freebuf.com/fevents/148169.html", "time": "2017-09-19", "level": "", "num_look": 341952, "num_comment": 4, "author": "Akane", "tags": ["活动"], "text": "昨天我们的前方记者现场探班，为大家带来了一场专业的展商巡礼，可还是有不少小伙伴表示不过瘾。请各位看官稍安勿躁，下半场才刚刚开始！"}
{"title": "特别企划 | 2017年安全公司并购案迭起，谁在押宝机器学习、人工智能？", "url": "https://www.freebuf.com/special/147148.html", "time": "2017-09-19", "level": "红色标题", "num_look": 356094, "num_comment": 4, "author": "liki", "tags": ["特别企划"], "text": "今年注定是大公司疯狂兼并的年份，而受到大公司青睐的小公司也大多布局在当下非常火热的领域——机器学习，人工智能，自动化技术。"}
{"title": "CNNVD关于多个蓝牙协议安全漏洞情况的通报", "url": "https://www.freebuf.com/news/147886.html", "time": "2017-09-19", "level": "", "num_look": 402888, "num_comment": 2, "author": "CNNVD", "tags": ["漏洞", "资讯"], "text": "近日，国家信息安全漏洞库（CNNVD）收到关于多个蓝牙协议安全漏洞的情况报送，攻击者可利用上述漏洞远程控制支持蓝牙的设备，获取其关键数据和访问权限，传播恶意软件。"}
{"title": "内网漫游（lateral movement）的破解之道", "url": "https://www.freebuf.com/articles/network/147894.html", "time": "2017-09-19", "level": "", "num_look": 652267, "num_comment": 1, "author": "Carrie_spinfo", "tags": ["网络安全"], "text": "“千里之堤毁于蚁穴”的道理用在黑客攻击上同样成立。攻击者只要挖掉房子的一块砖，他就拥有了整个房子的所有权。"}
{"title": "汽车之家诚招安全人才", "url": "https://www.freebuf.com/jobs/147702.html", "time": "2017-09-19", "level": "", "num_look": 288914, "num_comment": 8, "author": "cn_H5", "tags": ["安全招聘"], "text": "汽车之家是中国最值得信赖的汽车互联网服务平台——为汽车消费者提供贯穿选车、买车、用车、置换所有环节的全面、准确、快捷的一站式服务。"}
{"title": "使用Bash Bunny从被锁定的系统抓取登陆凭据", "url": "https://www.freebuf.com/articles/terminal/147642.html", "time": "2017-09-19", "level": "", "num_look": 379430, "num_comment": 7, "author": "secist", "tags": ["终端安全"], "text": "“世界上最先进的USB渗透工具”Bash Bunny是否名不虚传呢？下面，我将通过实例演示如何利用Bash Bunny QuickCreds模块，获取到目标主机上的登陆凭据。"}
{"title": "网页上的污染源：“PM2.5报告”插件实为恶意广告注射器", "url": "https://www.freebuf.com/articles/terminal/147797.html", "time": "2017-09-19", "level": "", "num_look": 336211, "num_comment": 3, "author": "360安全", "tags": ["终端安全"], "text": ""}
{"title": "CVE-2017-8759完美复现（另附加hta+powershell弹框闪烁解决方案）", "url": "https://www.freebuf.com/vuls/147793.html", "time": "2017-09-19", "level": "现金奖励", "num_look": 801098, "num_comment": 54, "author": "Lz1y", "tags": ["漏洞", "系统安全"], "text": "CVE-2017-8759 是前几天出的 0 DAY ,搜了下，国内几乎没有人复现，这个洞总体来说，危害很大，而且比CVE-2017-0199更难防御。"}
{"title": "BUF早餐铺 | 美国征信巨头Equifax高管离职；OurMine泄露Vevo公司内网文件；谷歌意将FTP协议标记为不安全", "url": "https://www.freebuf.com/news/148006.html", "time": "2017-09-19", "level": "", "num_look": 257152, "num_comment": 2, "author": "liki", "tags": ["资讯"], "text": "美国征信巨头Equifax 高管离职；OurMine 泄露 Vevo 公司内网文件；"}
{"title": "系统清理工具CCleaner被植入后门，上百万用户或受感染", "url": "https://www.freebuf.com/news/148119.html", "time": "2017-09-19", "level": "金币+8", "num_look": 678253, "num_comment": 4, "author": "金睛", "tags": ["系统安全", "资讯"], "text": "2017年9月18日，有情报披露，著名的系统优化工具CCleaner的某个版本被发现植入后门，大量使用该工具的用户恐将面临泄密风险。这是继Xshell后门事件后，又一起严重的软件供应链来源攻击事件。"}
{"title": "CNNVD关于WordPress的Display Widgets插件存在恶意代码情况的通报", "url": "https://www.freebuf.com/news/147887.html", "time": "2017-09-18", "level": "", "num_look": 337515, "num_comment": 337515, "author": "CNNVD", "tags": ["漏洞", "资讯"], "text": "近日，CNNVD收到关于WordPress的Display Widgets插件存在恶意代码情况的报送，该插件的两个版本可导致用户的IP地址、UA标识等数据上传到第三方特定服务器。"}
{"title": "探访2017国家网络安全宣传周，参展安全厂商巡礼（上）", "url": "https://www.freebuf.com/fevents/147988.html", "time": "2017-09-18", "level": "红色标题", "num_look": 407522, "num_comment": 5, "author": "Akane", "tags": ["活动"], "text": "2017年第四届国家网络安全宣传周正式拉开帷幕，都有哪些厂商带着“黑科技”参展，跟随前方记者的脚步前往现场一探究竟吧~"}
{"title": "游戏辅助背后的黑产流水线：年劫持攻击千万次牟利数百万", "url": "https://www.freebuf.com/articles/network/147652.html", "time": "2017-09-18", "level": "", "num_look": 732300, "num_comment": 6, "author": "360安全", "tags": ["网络安全"], "text": "近期360互联网安全中心就发现一个专门从事各类免费游戏辅助的开发或二次打包，并进行推广的神秘黑客组织。该组织已经将免费游戏辅助背后的黑产流程化."}
{"title": "Nitol家族韩国僵尸网络变种分析及其威胁情报", "url": "https://www.freebuf.com/articles/network/147591.html", "time": "2017-09-18", "level": "现金奖励", "num_look": 555150, "num_comment": 5, "author": "放牛娃", "tags": ["网络安全"], "text": "本文主要讲的是Nitol家族的Nitol.C衍生版本，一个Nitol家族衍生版本的韩国僵尸网络及其威胁情报。"}
{"title": "景安网络招聘服务器运维工程师", "url": "https://www.freebuf.com/jobs/145910.html", "time": "2017-09-18", "level": "", "num_look": 390819, "num_comment": 31, "author": "意见", "tags": ["安全招聘"], "text": "景安网络是一家致力于电信增值服务运营的高新技术企业，公司主营互联网增值服务业务，主要有：互联网数据中心业务、云计算业务、CDN业务以及互联网安全业务等。"}
{"title": "LANs.py：一款可以实现代码注入，无线渗透和WiFi用户监控的强大工具", "url": "https://www.freebuf.com/sectool/147605.html", "time": "2017-09-18", "level": "", "num_look": 815987, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["工具", "无线安全"], "text": "LANs.py 是一款可以实现代码注入，无线渗透等功能的强大工具。有助于渗透测试人员深入研究无线安全。"}
{"title": "威胁情报的应用让59%的企业及机构感到“鸭梨山大”？", "url": "https://www.freebuf.com/articles/paper/147819.html", "time": "2017-09-18", "level": "", "num_look": 299556, "num_comment": 4, "author": "Elaine_z", "tags": ["安全报告"], "text": "2017年北美80%的组织机构都应用了威胁情报，但他们中的多数还挣扎在的处理“大量”数据和信息的第一线，原因是什么？现状又是怎样？"}
{"title": "Android Message APP 拒绝服务漏洞(CVE-2017-0780)分析与利用", "url": "https://www.freebuf.com/vuls/147601.html", "time": "2017-09-18", "level": "", "num_look": 367655, "num_comment": 3, "author": "任子行", "tags": ["漏洞"], "text": "已经确认漏洞 CVE-2017-0780对最新版本的Nexus 和 Pixel 设备有影响，攻击者可以通过发送恶意彩信到受害人手机实现攻击。"}
{"title": "关于Shell你想知道的都在这儿", "url": "https://www.freebuf.com/articles/system/147768.html", "time": "2017-09-18", "level": "金币+12", "num_look": 1033177, "num_comment": 18, "author": "二楼日记", "tags": ["系统安全"], "text": "其实,个人一直觉得,如果能利用目标系统自身的环境或者工具帮我们搞定的,最好就直接用那个,也省去了不少的麻烦"}
{"title": "BUF早餐铺 | 美国征信巨头Equifax泄露事件详情揭露；克林姆林宫回应美政府机构禁止使用卡巴斯基；开发者使用SDK时不小心嵌入恶意程序", "url": "https://www.freebuf.com/news/147873.html", "time": "2017-09-18", "level": "", "num_look": 291873, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "美国征信巨头Equifax大规模数据泄露事件详情揭露；克林姆林宫回应美国政府禁止使用卡巴斯基；macOS High Sierra的SKEL防护可被绕过，开发者使用SDK时不小心嵌入恶意程序。"}
{"title": "Struts 2 S2-053漏洞分析（附POC）", "url": "https://www.freebuf.com/vuls/147735.html", "time": "2017-09-17", "level": "", "num_look": 755203, "num_comment": 4, "author": "属黄鳝的", "tags": ["漏洞"], "text": "本文主要介绍了 Struts 2 S2-053 漏洞的概述、实例与修复。"}
{"title": "什么才是“年度安全品牌”？| WitAwards 2017年度品牌影响力「报名进行中」", "url": "https://www.freebuf.com/news/topnews/147672.html", "time": "2017-09-17", "level": "红色标题", "num_look": 333085, "num_comment": 4, "author": "FB客服", "tags": ["头条", "活动"], "text": "FreeBuf 将始终秉持最公平公正的态度，以期遴选出 2017 年度在安全领域产品最具竞争力和科技领导力，拥有强大的市场影响和客户口碑，为客户带来最佳安全体验的品牌。"}
{"title": "教你如何和使用这款强大的渗透平台-Xerosploit", "url": "https://www.freebuf.com/sectool/147611.html", "time": "2017-09-17", "level": "", "num_look": 732706, "num_comment": 14, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Xerosploit是一款渗透测试工具包，它的主要功能就是执行中间人攻击。它本身自带有多种功能不同的模块，这些模块具有多种功能。"}
{"title": "网络安全人才出现结构性短缺，实战能力超学历成企业用人首要标准", "url": "https://www.freebuf.com/news/147802.html", "time": "2017-09-17", "level": "", "num_look": 446407, "num_comment": 21, "author": "360企业安全", "tags": ["安全报告", "资讯"], "text": "目前我国重要行业需要各类网络安全人才70万，到2020年这一人才缺口预计将达到140万人。"}
{"title": "如何通过追踪代码自动发现网站之间的“关联”", "url": "https://www.freebuf.com/articles/web/146355.html", "time": "2017-09-17", "level": "", "num_look": 419571, "num_comment": 2, "author": "Covfefe", "tags": ["WEB安全"], "text": "给你敲代码的手指热热身，并准备好享受一些乐趣，因为我们即将要探索如何使用Python自动发现网页之间的关联"}
{"title": "2017杭州孝道科技诚聘安全人员", "url": "https://www.freebuf.com/jobs/129812.html", "time": "2017-09-17", "level": "", "num_look": 293473, "num_comment": 12, "author": "hz_qiufang", "tags": ["安全招聘"], "text": "杭州孝道科技有限公司坐落于美丽的杭州西子湖畔，由原来业内知名企业的资深技术专家、海归博士等人员共同创办。"}
{"title": "卡巴斯基2017年第二季度IT威胁及演变", "url": "https://www.freebuf.com/articles/paper/147562.html", "time": "2017-09-17", "level": "", "num_look": 365216, "num_comment": 1, "author": "米雪儿", "tags": ["安全报告"], "text": "根据卡巴斯基实验室解决方案公布的数据，他们已经在第二个季度为世界各地191个国家的用户检测并阻止了342,566,661次恶意攻击。"}
{"title": "攻击者现可绕过MicrosoftEdge、Google Chrome和Safari的内容安全策略", "url": "https://www.freebuf.com/news/147172.html", "time": "2017-09-16", "level": "", "num_look": 390260, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["WEB安全", "漏洞"], "text": "Talos发布了Microsoft Edge浏览器的安全漏洞细节，受此漏洞影响的还包括旧版本Google Chrome（CVE-2017-5033）以及基于Webkit的浏览器（例如苹果的Safari：CVE-2017-2419）。"}
{"title": "美中不足的IoT：物联网必须要有“网”吗", "url": "https://www.freebuf.com/articles/terminal/147411.html", "time": "2017-09-16", "level": "", "num_look": 372996, "num_comment": 2, "author": "Covfefe", "tags": ["终端安全"], "text": "物联网（IoT）设备正在变得越来越普遍，但并非所有对物联网的努力都以成功告终。"}
{"title": "顺丰速运有限公司信息安全招聘", "url": "https://www.freebuf.com/jobs/147084.html", "time": "2017-09-16", "level": "", "num_look": 372909, "num_comment": 8, "author": "sf_response", "tags": ["安全招聘"], "text": "大家好！ 我们是顺丰信息安全部门，这里有一份有情怀、有激情的工作，请你签收下~"}
{"title": "【限时优惠】FreeBuf精品公开课 | 36W漏洞奖金先生CplusHua： HTTP盲攻击的几种思路", "url": "https://www.freebuf.com/fevents/147603.html", "time": "2017-09-16", "level": "红色标题", "num_look": 752706, "num_comment": 27, "author": "FB客服", "tags": ["活动"], "text": "2016年11月，CplusHua获得AFSRC单个严重漏洞36W现金奖励。2017年9月27日 21:00，CplusHua在FreeBuf公开课分享他的挖洞姿势！19.9元限时优惠价，好的技术与经验值得你付费ヽ(ˋ▽ˊ)ノ"}
{"title": "【FB TV】一周「BUF大事件」：ISC2017中国互联网安全大会在北京国家会议中心举行；维基解密发布CIA系列新工具；Office文档高级威胁攻击漏洞重出江湖", "url": "https://www.freebuf.com/video/147924.html", "time": "2017-09-16", "level": "红色标题", "num_look": 473687, "num_comment": 2, "author": "willhuang", "tags": ["视频"], "text": "本周ISC2017中国互联网安全大会在北京国家会议中心举行，大牛云集、盛况空前；维基解密发布CIA项目文档及网站被黑新进展；Office文档高级威胁攻击漏洞重出江湖。"}
{"title": "利用威胁情报数据平台拓展APT攻击线索一例", "url": "https://www.freebuf.com/articles/network/147795.html", "time": "2017-09-16", "level": "", "num_look": 523860, "num_comment": 1, "author": "奇安信威胁情报中心", "tags": ["网络安全"], "text": "发现高级的定向攻击是否一定需要高级的分析手段？答案是：未必。今天我们就举一个简单的例子，分析对象还是我们的老朋友：海莲花APT团伙。"}
{"title": "新浪微博警告3.4亿用户进行实名登记", "url": "https://www.freebuf.com/news/147480.html", "time": "2017-09-16", "level": "", "num_look": 300722, "num_comment": 8, "author": "Sphinx", "tags": ["资讯"], "text": "新浪微博上周五发布了一则官方声明，要求在9月15日之前实名登记，但是没有说明如果不进行实名的后果。"}
{"title": "美国征信巨头Equifax大规模数据泄露的惨痛教训：不及时修复漏洞，就是给自己埋不定时炸弹", "url": "https://www.freebuf.com/news/147869.html", "time": "2017-09-15", "level": "", "num_look": 527064, "num_comment": 1, "author": "AngelaY", "tags": ["观点", "资讯"], "text": "美国征信巨头 Equifax 日前确认，黑客利用其系统中未修复的 Apache Struts 漏洞（ CVE-2017-5638，3 月 6 日曝光）发起攻击，导致了最近影响恶劣的大规模数据泄漏事件。"}
{"title": "【评论更新“木马”作者回复】“大黄蜂”远控挖矿木马分析与溯源", "url": "https://www.freebuf.com/articles/network/147301.html", "time": "2017-09-15", "level": "红色标题", "num_look": 1668782, "num_comment": 89, "author": "腾讯电脑管家", "tags": ["网络安全"], "text": "腾讯安全反病毒实验室发现了一类远控木马具有爆发的趋势。通过跟踪发现，此类木马不仅保留了远控的功能，而且随着虚拟货币价格的水涨船高，木马加入了挖矿的功能。"}
{"title": "请警惕，性爱机器人可能被黑", "url": "https://www.freebuf.com/articles/neopoints/147571.html", "time": "2017-09-15", "level": "", "num_look": 442306, "num_comment": 7, "author": "vulture", "tags": ["观点"], "text": "2015年，来自计算机和社会责任中心的Kathleen Richardson博士开启了一个项目，反对与机器人的电子性爱，并且警告可能会出现心理和社会问题。"}
{"title": "如何制作基础认证钓鱼页面", "url": "https://www.freebuf.com/articles/web/147207.html", "time": "2017-09-15", "level": "", "num_look": 467762, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "我觉得基础认证的一个非常吸引我的特点就是用户永远不知道是谁在要求他们输入凭证，而这种特性通常会使用户一不小心就落入了网络钓鱼的陷阱之中。"}
{"title": "麦子金服招聘高级信息安全工程师（渗透方向）", "url": "https://www.freebuf.com/jobs/147538.html", "time": "2017-09-15", "level": "", "num_look": 328191, "num_comment": 9, "author": "Cicicheng", "tags": ["安全招聘"], "text": "2009年，本着“让金融温暖而可及”的初衷与理想，麦子金服从金融信息服务平台起步，经过近八年深耕正逐步成长为中国卓越的智能金融服务集团。"}
{"title": "CEH考证攻略之CEH入坑记", "url": "https://www.freebuf.com/articles/others-articles/147487.html", "time": "2017-09-15", "level": "金币+8", "num_look": 668177, "num_comment": 11, "author": "juney", "tags": ["其他"], "text": "以前听过CEH认证，也没太当回事儿，反正我黑或不黑实在不需要一张Paper来证黑证白的，再说久了你会发现生活中不涉黑不涉黄也挺好的。"}
{"title": "浅谈企业内部安全漏洞的运营（一）：规范化", "url": "https://www.freebuf.com/articles/security-management/147394.html", "time": "2017-09-15", "level": "金币+8", "num_look": 874041, "num_comment": 13, "author": "安惞", "tags": ["安全管理"], "text": "作为做过安全管理和运营，也做过SOC产品经理的菜鸟，在此和大家探讨交流下，如何做企业内部的安全漏洞运营。"}
{"title": "如何通过BurpSuiteMacro自动化模糊测试Web应用的输入点", "url": "https://www.freebuf.com/articles/web/147182.html", "time": "2017-09-15", "level": "", "num_look": 415504, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "在这篇文章中，我们将利用BurpSuite Macro来自动化模糊测试注入点的Payload输入，并尽最大可能发挥BurpSuite Macro的自动化功能。"}
{"title": "BUF早餐铺 | 美政府宣布将禁用卡巴斯基产品；Microsoft Word上发现新的漏洞，已经被利用；Wordpress插件出现后门，影响20多万站点", "url": "https://www.freebuf.com/news/147688.html", "time": "2017-09-15", "level": "", "num_look": 284609, "num_comment": 2, "author": "liki", "tags": ["资讯"], "text": "美国政府宣布将禁止使用卡巴斯基的产品；Microsoft Word 上发现新的漏洞，并已经被利用；Wordpress 插件中出现后门，影响20多万安装 Wordpress 的站点。"}
{"title": "安全CDN市场分析 | 动作频出的背后，我们看到一个有野心的Incapsula", "url": "https://www.freebuf.com/news/146980.html", "time": "2017-09-14", "level": "", "num_look": 646557, "num_comment": 5, "author": "liki", "tags": ["安全管理", "资讯"], "text": "Incapsula 以 DDoS 缓解方案与 Web 应用安全而闻名。 而从其最近的动作中不难看出，它的野心并不是想成为第二个 CloudFlare 那么简单。"}
{"title": "Android色情病毒发展史", "url": "https://www.freebuf.com/articles/system/146504.html", "time": "2017-09-14", "level": "", "num_look": 427277, "num_comment": 6, "author": "暗影安全实验室", "tags": ["系统安全"], "text": "面对一些美女快播、美女视频、宅男电影等应用程序，你是否想安装？但可得小心点，这些应用程序不仅涉嫌传播淫秽色情内容，很多程序还被内置恶意代码，导致用户资费损失。"}
{"title": "湖南某科技公司疑似利用Struts 2漏洞传毒挖矿", "url": "https://www.freebuf.com/articles/network/147336.html", "time": "2017-09-14", "level": "", "num_look": 761279, "num_comment": 16, "author": "瑞星", "tags": ["网络安全"], "text": "这又是一个由于没有及时更新Struts2漏洞，导致内网沦陷的案例，黑客利用漏洞植入挖矿软件，疯狂消耗用户机器资源，帮助其赚钱。"}
{"title": "DDoS黑产全链条遭斩断，腾讯云协助警方抓捕58人", "url": "https://www.freebuf.com/news/147595.html", "time": "2017-09-14", "level": "红色标题", "num_look": 487040, "num_comment": 17, "author": "腾讯云安全", "tags": ["资讯"], "text": "跨越全国15省、30+城市，58名犯罪嫌疑人被捕，其包含 DDoS 攻击黑色产业链中的各类角色：发单人、攻击实施人、肉鸡商、出量人、担保人等。"}
{"title": "华润网络招聘安全工程师", "url": "https://www.freebuf.com/jobs/146351.html", "time": "2017-09-14", "level": "", "num_look": 355186, "num_comment": 6, "author": "libin8412", "tags": ["安全招聘"], "text": "我们的安全团队正在组建中，核心成员来自百度阿里，我们正在自建各种安全检测、审计、防护平台，开发风控系统，热切欢迎有想法的你过来。"}
{"title": "挖洞经验 | 看我如何利用SAML漏洞实现Uber内部聊天系统未授权登录", "url": "https://www.freebuf.com/news/147086.html", "time": "2017-09-14", "level": "", "num_look": 340203, "num_comment": 5, "author": "clouds", "tags": ["漏洞", "资讯"], "text": "本文讲述了利用SAML（安全声明标记语言）服务漏洞，绕过优步（Uber）公司内部聊天系统身份认证机制，实现了对该内部聊天系统的未授权登录访问，该漏洞最终获得Uber官方8500美元奖励。"}
{"title": "一款功能丰富的Perl后门程序分析", "url": "https://www.freebuf.com/articles/system/146956.html", "time": "2017-09-14", "level": "现金奖励", "num_look": 548253, "num_comment": 4, "author": "douwanhu", "tags": ["系统安全", "网络安全"], "text": "最近通过Cowrie蜜罐捕获一枚有趣的后门程序，此程序用perl语言编写。功能包括：DDoS（udpflood、tcpflood、httpflood、sqlflood）、hacking（端口扫描、信息收集、本地root、日志清理等）情报信息搜集（packetstorm…"}
{"title": "BUF早餐铺 | 蓝牙协议曝 8 个严重安全漏洞；.NET 0day漏洞被用来传播FinFisher病毒；Adobe修复2个Flash Player严重漏洞", "url": "https://www.freebuf.com/news/147593.html", "time": "2017-09-14", "level": "", "num_look": 224295, "num_comment": 224295, "author": "Sphinx", "tags": ["资讯"], "text": "蓝牙协议曝 8 个严重安全漏洞，可能影响 53 亿有蓝牙功能的设备；.NET 0day漏洞被用来传播FinFisher病毒；Adobe修复2个Flash Player严重漏洞。"}
{"title": "揭密小黑系列：SSL劫持木马的追踪溯源", "url": "https://www.freebuf.com/articles/network/147161.html", "time": "2017-09-14", "level": "", "num_look": 563473, "num_comment": 7, "author": "奇安信威胁情报中心", "tags": ["网络安全"], "text": "为了应对网络劫持，各大网站都开始启用https协议，使得靠劫持http网站闷声发大财的灰产、黑产们坐不住了，一直在寻找劫持https网站的好用方法。"}
{"title": "展望未来五年安全新疆界：2017 ISC次日精彩回顾", "url": "https://www.freebuf.com/fevents/147606.html", "time": "2017-09-14", "level": "", "num_look": 369248, "num_comment": 1, "author": "liki", "tags": ["活动"], "text": "ISC会议来到了第二天，热度却丝毫不减，上午有安全精英峰会，下午有人工智能技术应用安全论坛，精彩纷呈不容错过！"}
{"title": "一个换行符引发的奥斯卡0day漏洞(CVE-2017-8759)重现：最新的Office高级威胁攻击预警", "url": "https://www.freebuf.com/articles/system/147602.html", "time": "2017-09-13", "level": "红色标题", "num_look": 826788, "num_comment": 16, "author": "360安全", "tags": ["系统安全"], "text": "该漏洞在野外被利用时为0day状态，用户打开恶意的Office文档就会中招。"}
{"title": "百度安全实验室：国内近半数 iOS用户未升级最新版本，易受已知高危漏洞威胁", "url": "https://www.freebuf.com/articles/terminal/147265.html", "time": "2017-09-13", "level": "", "num_look": 349604, "num_comment": 4, "author": "百度安全实验室", "tags": ["终端安全"], "text": "OS 10.3.3 于 7.19 日发布至今已有 50 天，仅有 54% 的用户升级到了最新的 iOS 10.3.3 系统，剩余的近半数国内 iOS 设备依然停留在受高危漏洞影响的旧版系统。"}
{"title": "蓝牙协议曝 8 个严重安全漏洞，可能影响 53 亿有蓝牙功能的设备", "url": "https://www.freebuf.com/news/147577.html", "time": "2017-09-13", "level": "红色标题", "num_look": 593429, "num_comment": 7, "author": "AngelaY", "tags": ["资讯"], "text": ""}
{"title": "利用Redis未授权访问漏洞的挖矿病毒阴魂不散", "url": "https://www.freebuf.com/articles/database/147334.html", "time": "2017-09-13", "level": "金币+12", "num_look": 861780, "num_comment": 8, "author": "cgf99", "tags": ["数据安全", "网络安全"], "text": "Redis 默认情况下，会绑定在 0.0.0.0:6379，这样将会将Redis服务暴露到公网上。如果在没有开启认证的情况下，可以导致任意用户未授权访问Redis以及读取Redis的数据。"}
{"title": "如何让微信丢骰子永远只出“666”", "url": "https://www.freebuf.com/articles/terminal/146413.html", "time": "2017-09-13", "level": "现金奖励", "num_look": 1070287, "num_comment": 40, "author": "网络安全通", "tags": ["终端安全"], "text": "每次宅寝室一起点外卖谁下去拿都是个大问题，小编寝室一般选择微信色子谁小谁去拿，但是小编运气不太好 总是输，所以寻思着能不能每次都让色子是6点。"}
{"title": "江苏力驰网络科技股份有限公司招聘渗透部门主管、渗透工程师", "url": "https://www.freebuf.com/jobs/147349.html", "time": "2017-09-13", "level": "", "num_look": 304144, "num_comment": 12, "author": "江苏力驰网络科技股份有限公司", "tags": ["安全招聘"], "text": "我们公司与国内知名网络安全公司、运营商以及政府部门都有良好的业务往来和合作关系，社会资源丰富，发展态势良好。"}
{"title": "【已结束】ISC 2017中国互联网安全大会图文直播", "url": "https://www.freebuf.com/fevents/147251.html", "time": "2017-09-13", "level": "红色标题", "num_look": 547295, "num_comment": 16, "author": "liki", "tags": ["活动"], "text": "9月11号-13日ISC 2017中国互联网安全大会，现场盛况全程图文直播，北京国议咱们不见不散！"}
{"title": "D-link 10个0Day漏洞分析（附细节）", "url": "https://www.freebuf.com/vuls/147445.html", "time": "2017-09-13", "level": "现金奖励", "num_look": 829332, "num_comment": 829332, "author": "ang010ela", "tags": ["漏洞", "终端安全"], "text": "安全研究人员Pierre Kim日前披露D-Link DIR 850LAC1200型双频千兆云路由器被曝10个安全问题，包括XSS攻击，缺乏应有的固件保护，后门和root提权等。"}
{"title": "全能无线渗透测试工具，一个LAZY就搞定了", "url": "https://www.freebuf.com/sectool/146780.html", "time": "2017-09-13", "level": "金币+12", "num_look": 956056, "num_comment": 10, "author": "2cat", "tags": ["工具", "无线安全"], "text": "近来一直在研究无线安全方面的东西，特别是在无线渗透测试这块，每次渗透测试时总要来回不停的切换操作和挑选利器，很是麻烦。就想看看是否可以有一款功能全面的集合型工具。"}
{"title": "BUF早餐铺 | Facebook被罚款143万美元；国家网信办规定10月8日起微信QQ微博必须实名；谷歌将在2018年年初全面禁用Symantec证书", "url": "https://www.freebuf.com/news/147494.html", "time": "2017-09-13", "level": "", "num_look": 262286, "num_comment": 3, "author": "AngelaY", "tags": ["资讯"], "text": "周三的你，吃完早餐，又是元气满满的小天使！"}
{"title": "人，最脆弱也最安全：2017中国互联网安全大会首日纪实", "url": "https://www.freebuf.com/fevents/147478.html", "time": "2017-09-13", "level": "红色标题", "num_look": 353386, "num_comment": 5, "author": "liki", "tags": ["活动"], "text": "周鸿祎：漏洞的价值不亚于传统战争中的炸弹。"}
{"title": "关于8月31日维基解密被攻击的观察与分析", "url": "https://www.freebuf.com/articles/web/147048.html", "time": "2017-09-12", "level": "", "num_look": 327723, "num_comment": 2, "author": "Covfefe", "tags": ["WEB安全"], "text": "十几天前，维基解密遭受了一次攻击，导致很多访问者看到了“OurMine”的声明，他们声称已经获取了维基解密服务器的控制权，实际是怎么回事呢？"}
{"title": "为什么朝鲜格外关注加密货币", "url": "https://www.freebuf.com/news/147425.html", "time": "2017-09-12", "level": "红色标题", "num_look": 285393, "num_comment": 3, "author": "Elaine_z", "tags": ["资讯"], "text": "FireEye团队逐渐发现朝鲜黑客行动与加密货币特别是比特币之间的联系。朝鲜黑客手中的这类资产中仅比特币一项，就自年初增长了近400%。"}
{"title": "软件供应链来源攻击分析报告", "url": "https://www.freebuf.com/articles/paper/147403.html", "time": "2017-09-12", "level": "", "num_look": 447572, "num_comment": 3, "author": "奇安信威胁情报中心", "tags": ["安全报告"], "text": "2017年8月，非常流行的远程终端管理软件 Xshell 被发现植入了后门代码，导致大量使用此款工具的用户泄露主机相关的敏感信息，同时发现大量的使用软件捆绑进行传播"}
{"title": "婚恋网站背后，可能藏着精心设计的钓鱼攻击", "url": "https://www.freebuf.com/news/147412.html", "time": "2017-09-12", "level": "红色标题", "num_look": 442082, "num_comment": 15, "author": "AngelaY", "tags": ["观点", "资讯"], "text": "作为跟程序员这一行业密切相关的 FreeBuf，在表达对 WePhone 开发者的惋惜与尊重的同时，也想从信息安全的角度聊一聊这件事。"}
{"title": "基于Lua插件化的Pcap流量监听代理", "url": "https://www.freebuf.com/news/146841.html", "time": "2017-09-12", "level": "现金奖励", "num_look": 198064, "num_comment": 198064, "author": "糖果L5Q", "tags": ["资讯"], "text": "在每天例行扫描活动中，发现有些应用系统不定期的被扫挂，因为我们不是服务的制造者，没有办法在不同的系统里打印日志，所以我们就想用一个工具来获取特定服务的输入数据流。"}
{"title": "卫达安全渗透测试工程师、售前工程师等众多岗位虚位以待", "url": "https://www.freebuf.com/jobs/145929.html", "time": "2017-09-12", "level": "", "num_look": 254029, "num_comment": 12, "author": "卫达安全", "tags": ["安全招聘"], "text": "听说，那个让黑客颤抖的安全公司招人啦！北京总部目前正在热招的职位 ：渗透测试工程师 / 售前工程师 / 产品工程师 /销售经理等 ，太激动啦，机会不要太多哦~"}
{"title": "一款能检测当前网络中是否存在WiFi- Pineapple并评估当前WiFi安全性的工具 - PiFinger", "url": "https://www.freebuf.com/sectool/147240.html", "time": "2017-09-12", "level": "金币+11", "num_look": 332351, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍一款名叫PiFinger的工具，这款工具可以搜索当前网络环境中是否存在WiFi-Pineapple的痕迹，并对无线网络的安全性进行评分。"}
{"title": "S2-052从Payload到执行浅析", "url": "https://www.freebuf.com/vuls/147170.html", "time": "2017-09-12", "level": "", "num_look": 310738, "num_comment": 2, "author": "华为未然实验室", "tags": ["漏洞"], "text": "S2-052 网上已经公开的payload实际上是marshallsec利用XStream中的ImageIO gadget生成的XML。本文会介绍从payload生成到执行的整个流程。"}
{"title": "Buf早餐铺 | 三星推出20万美元奖金漏洞奖励计划；Crackas With Attitude成员被判入狱5年；韩国安全研究员公开尚未修复的D-Link路由器漏洞细节", "url": "https://www.freebuf.com/news/147304.html", "time": "2017-09-12", "level": "", "num_look": 214283, "num_comment": 3, "author": "Elaine_z", "tags": ["资讯"], "text": "今天是周二啦，安全新闻有哪些？Buf早餐铺，给你一天的能量。"}
{"title": "欧洲人权法院：公司若对工作邮件进行监控，必须提前告知员工", "url": "https://www.freebuf.com/news/146798.html", "time": "2017-09-11", "level": "", "num_look": 181898, "num_comment": 1, "author": "liki", "tags": ["资讯"], "text": "近日，欧洲人权法院做出裁决：公司对工作邮件进行监控，必须提前告知员工。"}
{"title": "网络间谍活动的前世今生", "url": "https://www.freebuf.com/news/146719.html", "time": "2017-09-11", "level": "", "num_look": 262292, "num_comment": 1, "author": "Covfefe", "tags": ["其他", "资讯"], "text": "纵观历史，无论是间谍，破坏，还是其他手段，国家之间总会通过一些秘密行动来渗透对方。20世纪90年代是互联网开始迅速发展的时代，而这个时代正开创了国际间谍活动的新篇章。"}
{"title": "Struts2 新漏洞（S2-052）出现利用实例，面对漏洞企业应当分秒必争", "url": "https://www.freebuf.com/news/147293.html", "time": "2017-09-11", "level": "红色标题", "num_look": 318540, "num_comment": 3, "author": "AngelaY", "tags": ["资讯"], "text": "近日，来自思科 Talos 实验室和 NVISO 实验室的研究员也发现，已经有攻击者真实利用了 S2-052 的漏洞。"}
{"title": "我是怎么打开车库门的：ASKOOK手动解码及重放", "url": "https://www.freebuf.com/articles/wireless/146781.html", "time": "2017-09-11", "level": "现金奖励", "num_look": 762714, "num_comment": 8, "author": "loblab", "tags": ["无线安全", "极客"], "text": "本文以打开无线控制的电动车库卷帘门为目标，深入研究了ASK/OOK的编／解码，并用树莓派+五元钱的发射模块实现了打开车库门的各种姿势。"}
{"title": "黑客可以远程访问医用注射泵，给你提供致命剂量", "url": "https://www.freebuf.com/vuls/147277.html", "time": "2017-09-11", "level": "", "num_look": 304971, "num_comment": 5, "author": "Elaine_z", "tags": ["漏洞", "终端安全"], "text": "ICS-CERT在上周四发布了相关报告，称他们已经发现急性护理环境中使用的注射泵存在被黑客远程访问及操纵的风险，并发布了公开警示信息。"}
{"title": "Nexusguard（耐誉斯凯） 招聘网络安全系统研发工程师", "url": "https://www.freebuf.com/jobs/145993.html", "time": "2017-09-11", "level": "", "num_look": 194382, "num_comment": 6, "author": "NXG_HR", "tags": ["安全招聘"], "text": "Nexusguard是防御全球DDoS攻击的长期领导厂商，站在对抗网络恶意攻击的最前线，保护全球组织的网站、服务和信誉免于来自网络的威胁。。"}
{"title": "一起游戏私服同行发起的DDoS攻击：样本分析与溯源", "url": "https://www.freebuf.com/articles/network/146772.html", "time": "2017-09-11", "level": "", "num_look": 537679, "num_comment": 6, "author": "腾讯电脑管家", "tags": ["网络安全"], "text": "本文详细分析游戏私服同行的攻击样本如何发起DDoS攻击，并溯源其样本源头和传播渠道。"}
{"title": "西方红玫瑰和辣条先生黑产组织深度分析报告", "url": "https://www.freebuf.com/articles/paper/145777.html", "time": "2017-09-11", "level": "现金奖励", "num_look": 451423, "num_comment": 12, "author": "天际友盟", "tags": ["安全报告"], "text": "近期，神州网云依靠高级威胁检测引擎并结合天际友盟的威胁情报，精确发现了多起高级威胁组织的攻击，通过快速有效的一键溯源确定了攻击行为及影响。"}
{"title": "Buf早餐铺 | 浙江大学“海豚攻击”可无声控制语音识别系统；信用监控企业大规模数据泄漏；东欧黑客组织瞄准欧美电力设施", "url": "https://www.freebuf.com/news/147131.html", "time": "2017-09-11", "level": "", "num_look": 204650, "num_comment": 2, "author": "Elaine_z", "tags": ["资讯"], "text": "又是一周新开始，今天吃不吃煎饼果子？看看今天有哪些安全早餐可以享用！"}
{"title": "浙江大学研究人员发现超声波控制语音助手实现远程入侵", "url": "https://www.freebuf.com/news/147122.html", "time": "2017-09-10", "level": "红色标题", "num_look": 334122, "num_comment": 5, "author": "Sphinx", "tags": ["资讯"], "text": "浙江大学的科学家发现，他们可以使用超声波频率这种人耳无法听见的声音，对那些语音助手软件发送指令，从而接管手机、智能家居、甚至是汽车。而且这种攻击方式不需要接触手机。"}
{"title": "Windows内核存在漏洞，影响Windows2000到Windows10所有版本", "url": "https://www.freebuf.com/vuls/147114.html", "time": "2017-09-10", "level": "", "num_look": 374160, "num_comment": 3, "author": "ang010ela", "tags": ["漏洞"], "text": "研究人员最近发现一枚Windows内核0day漏洞，影响Windows2000到Windows10所有版本。恶意软件可利用该漏洞躲过安全软件的检测，但该漏洞利用难度较大。"}
{"title": "国内最震撼的白帽动作大片.avi | 2017漏洞马拉松", "url": "https://www.freebuf.com/fevents/147041.html", "time": "2017-09-10", "level": "红色标题", "num_look": 347446, "num_comment": 6, "author": "漏洞盒子", "tags": ["活动"], "text": "8月12日深夜，我们齐聚一波白帽子搞事情——那一晚发生了什么？至今成谜……"}
{"title": "如何使用PowerShell实现命令控制以及安全检查绕过", "url": "https://www.freebuf.com/articles/system/146251.html", "time": "2017-09-10", "level": "", "num_look": 335425, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "Windows操作系统在全球市场上的占比是大家有目共睹的，而现代Windows平台都默认安装了PowerShell，而且系统管理员还可以毫无限制地访问和使用PowerShell终端。"}
{"title": "小赢科技诚招安全工程师", "url": "https://www.freebuf.com/jobs/145531.html", "time": "2017-09-10", "level": "", "num_look": 213172, "num_comment": 15, "author": "xiaoyinglicai", "tags": ["安全招聘"], "text": "小赢理财（www.xiaoying.com），是中国首家销售众安保险本息全额保障理财产品的互联网金融平台。"}
{"title": "浅谈Windows系统下的网站备份与恢复", "url": "https://www.freebuf.com/articles/system/146675.html", "time": "2017-09-10", "level": "", "num_look": 296469, "num_comment": 1, "author": "Carrie_spinfo", "tags": ["系统安全"], "text": "目前仍有很多网站运营商没有做好备份工作，一旦网站突然“罢工”或遭到病毒感染，一切数据、资源、心血都将付诸东流。"}
{"title": "快讯 丨流行Chrome插件User-Agent Switcher为木马程序，请尽快卸载", "url": "https://www.freebuf.com/news/147188.html", "time": "2017-09-09", "level": "红色标题", "num_look": 1028680, "num_comment": 13, "author": "Akane", "tags": ["资讯"], "text": "刚刚曝出的消息，Chrome商店搜索User-Agent Switcher，排名第一的插件居然是一款木马程序！而这款工具，很多安全技术人员也都在使用。"}
{"title": "安全从业人员常用工具指引", "url": "https://www.freebuf.com/sectool/146877.html", "time": "2017-09-09", "level": "红色标题", "num_look": 947488, "num_comment": 33, "author": "CTNN", "tags": ["工具"], "text": "本文介绍我收集的安全相关工具指南，感谢平台收集并整理众多有用的资料"}
{"title": "宜人贷招聘JAVA构架师（风控）", "url": "https://www.freebuf.com/jobs/145607.html", "time": "2017-09-09", "level": "", "num_look": 173462, "num_comment": 173462, "author": "yirendai_sec", "tags": ["安全招聘"], "text": "宜人贷（NYSE: YRD）是中国领先的在线金融服务平台，由宜信公司2012年推出。宜人贷通过科技驱动金融创新，为中国优质城市白领人群提供高效、便捷、个性化的信用借款咨询服务."}
{"title": "【FB TV】一周「BUF大事件」：Struts2又曝高危远程代码执行漏洞；维基解密发布CIA系列新工具；MongoDB启示录延续", "url": "https://www.freebuf.com/video/147166.html", "time": "2017-09-09", "level": "红色标题", "num_look": 472836, "num_comment": 472836, "author": "willhuang", "tags": ["视频"], "text": "本周Struts2 应用又曝出存在新的高危远程代码执行漏洞，且漏洞影响范围较大；维基解密发布CIA新工具；三个黑客团伙劫持了逾26000多台服务器，被认为是“MongoDB启示录”的延续。来看详细报道吧"}
{"title": "HTTPS劫匪木马暴力升级：破坏ARK攻击杀软", "url": "https://www.freebuf.com/articles/web/146412.html", "time": "2017-09-09", "level": "", "num_look": 322945, "num_comment": 2, "author": "360安全", "tags": ["WEB安全"], "text": "目前，越来越多的网站开始注册证书，提供对HTTPS的支持，保护自己站点不被劫持。而作为对立面的流量劫持攻击，也开始将矛头对准HTTPS。"}
{"title": "螳螂捕蝉黄雀在后，免费散播Cobian远控工具背后的秘密", "url": "https://www.freebuf.com/news/146974.html", "time": "2017-09-09", "level": "", "num_look": 223081, "num_comment": 3, "author": "Sphinx", "tags": ["资讯"], "text": "如果你想在网上找个现成的入侵工具的话就要知道，很多号称黑客“瑞士军刀”的工具都是骗人的。"}
{"title": "CIA 秘密导弹控制项目 Protego：盔甲护身，绝密防御", "url": "https://www.freebuf.com/news/147155.html", "time": "2017-09-08", "level": "", "num_look": 243125, "num_comment": 243125, "author": "AngelaY", "tags": ["资讯"], "text": "维基解密本周照常更新，不过与以往 Vault 7 系列间谍工具或入侵工具不同，今天公布的是一个秘密导弹控制项目 Protego（盔甲护身）。"}
{"title": "ZigBee设备渗透工具：Attify Zigbee Framework", "url": "https://www.freebuf.com/sectool/146486.html", "time": "2017-09-08", "level": "", "num_look": 508396, "num_comment": 6, "author": "Covfefe", "tags": ["工具", "终端安全"], "text": "在这篇文章里，我们将向你介绍Attify Zigbee Framework -一个我们制作的图形化程序，它能帮助你渗透物联网设备且找出基于物联网以及智能设备的Zigbee漏洞。"}
{"title": "Struts S2-052反弹Shell实验", "url": "https://www.freebuf.com/vuls/147017.html", "time": "2017-09-08", "level": "现金奖励", "num_look": 846625, "num_comment": 24, "author": "守望者2018", "tags": ["WEB安全", "漏洞"], "text": "S2-052已经爆出几天了，我这边刚开始测试的时候，感觉能执行的命令比较有限：没有回显，也反弹不了shell。 经过一阵子的测试，最后解决了这些问题。"}
{"title": "大数据时代下的隐私保护", "url": "https://www.freebuf.com/articles/database/146652.html", "time": "2017-09-08", "level": "", "num_look": 986806, "num_comment": 4, "author": "百度安全实验室", "tags": ["数据安全"], "text": "本文介绍了学术界和工业界对于用户隐私保护的努力成果，其中主要讲到了k-匿名化、l-多样化、t-closeness 和 差分隐私，并对它们的优缺点进行了分析。"}
{"title": "小心！Instagram正在监听你的一举一动", "url": "https://www.freebuf.com/articles/terminal/146420.html", "time": "2017-09-08", "level": "", "num_look": 477793, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "Instagram可能一直都在通过手机的麦克风监听你日常生活中的对话。"}
{"title": "如何使用RDP跳过网络隔离？", "url": "https://www.freebuf.com/articles/network/146460.html", "time": "2017-09-08", "level": "", "num_look": 526458, "num_comment": 1, "author": "secist", "tags": ["网络安全"], "text": "本文我将向大家演示，如何通过RDP跳转盒进入隔离/受保护的网络。"}
{"title": "国民技术诚招物联网安全研究员", "url": "https://www.freebuf.com/jobs/145991.html", "time": "2017-09-08", "level": "", "num_look": 223493, "num_comment": 5, "author": "熊猫正正", "tags": ["安全招聘"], "text": "国民技术股份有限公司于2000年成立，2010年4月在深圳创业板上市，是我国网络可信行业领军企业，中国上市公司协会副会长单位。"}
{"title": "Struts Freemarker曝标签远程代码执行中危漏洞（S2-053）", "url": "https://www.freebuf.com/news/137859.html", "time": "2017-09-08", "level": "红色标题", "num_look": 390610, "num_comment": 4, "author": "Shun", "tags": ["漏洞", "资讯"], "text": "2017年9月7日，Apache Struts发布最新的安全公告（S2-053），漏洞级别为中危，该漏洞由京东安全汇报，CVE编号为CVE-2017-12611。"}
{"title": "悄然崛起的挖矿机僵尸网络：打服务器挖价值百万门罗币", "url": "https://www.freebuf.com/articles/web/146393.html", "time": "2017-09-08", "level": "", "num_look": 915358, "num_comment": 7, "author": "360安全", "tags": ["WEB安全"], "text": "360互联网安全中心监测到一种利用被入侵服务器进行门罗币挖矿的僵尸网络，该僵尸网络控制的服务器数量高峰时单日达到两万多台。"}
{"title": "这款2016年就开源的勒索软件，至今仍威胁着全球网络安全", "url": "https://www.freebuf.com/articles/web/144407.html", "time": "2017-09-08", "level": "", "num_look": 295907, "num_comment": 295907, "author": "Sphinx", "tags": ["WEB安全"], "text": "一个在GitHub上开源的PHP勒索软件项目仍然威胁着网络安全，这个项目是2016年早期发布的，已经超过了一年。"}
{"title": "思路分享 | 无弹窗APT渗透实验", "url": "https://www.freebuf.com/articles/network/146650.html", "time": "2017-09-08", "level": "红色标题", "num_look": 736706, "num_comment": 25, "author": "亚信安全", "tags": ["网络安全"], "text": "我研究最近的流行的APT攻击方式，在模拟攻击过程中发现网上公布的poc都会有大大小的缺陷，大多数poc执行过程中都会弹出一闪而过的黑框框。"}
{"title": "BUF早餐铺 | 赛门铁克对能源部门发出预警；黑客正在免费分发后门工具“Cobian RAT”；俄罗斯黑客在本国被判3年监禁；", "url": "https://www.freebuf.com/news/146955.html", "time": "2017-09-08", "level": "", "num_look": 173729, "num_comment": 3, "author": "liki", "tags": ["资讯"], "text": "凉爽的周末即将到来，好天气出游也是一个不错的选择。"}
{"title": "专业度与公信力缔造年度安全盛誉 | WitAwards 2017互联网安全年度评选（报名&提名申请开启）", "url": "https://www.freebuf.com/fevents/146817.html", "time": "2017-09-07", "level": "红色标题", "num_look": 265511, "num_comment": 5, "author": "FB独家", "tags": ["活动"], "text": "WitAwards 2017 互联网安全年度评选即日起正式启动。FreeBuf将以最专业的角度和最公正的态度，发掘优秀行业案例，树立年度标杆，为数万名从业者与数百款安全产品的努力与创新喝彩。"}
{"title": "华为、三星等手机Bootloader被曝存在多个高危漏洞", "url": "https://www.freebuf.com/news/146858.html", "time": "2017-09-07", "level": "", "num_look": 294322, "num_comment": 1, "author": "ang010ela", "tags": ["终端安全", "资讯"], "text": "California大学的研究团队发现主流手机平台的bootloader中存在代码执行和DOS的安全漏洞。研究人员用BootStomp发现了6个新发现的漏洞"}
{"title": "卡巴斯基实验室《2017年Q2垃圾邮件与网络钓鱼分析报告》", "url": "https://www.freebuf.com/articles/network/146587.html", "time": "2017-09-07", "level": "红色标题", "num_look": 523415, "num_comment": 2, "author": "米雪儿", "tags": ["安全报告", "网络安全"], "text": "2017年第二季度，我们发现了一大波恶意钓鱼邮件，这些邮件都将自身伪造成来自知名交付服务公司的通知。"}
{"title": "跨平台宏钓鱼攻击Payload的介绍及使用方式", "url": "https://www.freebuf.com/sectool/146259.html", "time": "2017-09-07", "level": "", "num_look": 403073, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["WEB安全", "工具"], "text": "通过Microsoft Office Word文档或Excel电子表格来实现网络钓鱼是一种非常常见的技术，而多数企业开始部署Mac终端，跨平台的恶意宏Payload也逐渐变得越来越重要了。"}
{"title": "ShadowBrokers 又搞事！每月支付 400 万美元，多获得两份新泄露的文件，你会买吗？（文末有下载地址）", "url": "https://www.freebuf.com/news/146917.html", "time": "2017-09-07", "level": "红色标题", "num_look": 320542, "num_comment": 11, "author": "AngelaY", "tags": ["资讯"], "text": "ShadowBrokers 又搞事了：升级订阅服务，要价更高，内容更多~"}
{"title": "相册类木马专题分析", "url": "https://www.freebuf.com/articles/terminal/146585.html", "time": "2017-09-07", "level": "", "num_look": 252865, "num_comment": 1, "author": "暗影安全实验室", "tags": ["终端安全"], "text": "2016年大量安卓手机用户反馈，其手机会自动向通讯录发送带有链接的短信及出现银行卡自动扣费等现象。安全研究人员针对这系列的木马，进行了相关的分析及追踪。发现黑客通过伪基站向用户发送诱骗短信，或者伪装热门a…"}
{"title": "北京玖富集团诚聘安全开发工程师（坐标望京SOHO）", "url": "https://www.freebuf.com/jobs/145329.html", "time": "2017-09-07", "level": "", "num_look": 150880, "num_comment": 3, "author": "9FHR", "tags": ["安全招聘"], "text": "玖富-（9fbank.com）是中国领先的移动互联网金融综合服务平台,成立于2006年,注册资金2亿元人民币。"}
{"title": "调查显示美国人的VPN使用率更高", "url": "https://www.freebuf.com/news/146806.html", "time": "2017-09-07", "level": "", "num_look": 387050, "num_comment": 4, "author": "Sphinx", "tags": ["资讯"], "text": ""}
{"title": "Struts S2-052漏洞利用方式实验解析（附EXP）", "url": "https://www.freebuf.com/vuls/146874.html", "time": "2017-09-07", "level": "现金奖励", "num_look": 930327, "num_comment": 27, "author": "hjchjcjh", "tags": ["漏洞"], "text": "Struts2的漏洞之王大之名相信已经家户喻晓了，而2017年9月5日又收到来自Struts2新的“惊喜”——S2-052。"}
{"title": "6年的老漏洞", "url": "https://www.freebuf.com/news/146633.html", "time": "2017-09-07", "level": "", "num_look": 220017, "num_comment": 220017, "author": "secist", "tags": ["资讯"], "text": "近日，德国软件开发商HannoBöck称，一个早在2011年就被发现的PDF解析库中的隐蔽bug，如今在大多数主流的PDF阅读器中再次出现。"}
{"title": "数字签名攻击报告：正在摧毁软件身份“信用体系”的安全危机", "url": "https://www.freebuf.com/articles/network/146274.html", "time": "2017-09-07", "level": "", "num_look": 479502, "num_comment": 5, "author": "360安全", "tags": ["网络安全"], "text": "近期，360公司核心安全事业部发现全球范围内的利用软件数字签名的恶意攻击呈活跃趋势，黑客的攻击目标涉及软件开发商、个人用户和重要的政府、企事业单位。"}
{"title": "BUF早餐铺 | 爱沙尼亚ID卡出现问题，影响75万居民；英国政府雇佣网络专家调查暗网；TrustZone降级攻击可以利用旧漏洞攻击Android设备", "url": "https://www.freebuf.com/news/146814.html", "time": "2017-09-07", "level": "", "num_look": 228149, "num_comment": 228149, "author": "Sphinx", "tags": ["资讯"], "text": "白露已经到来，让我们凉爽地看早报~"}
{"title": "CNNVD关于Apache Struts2（S2-052）漏洞情况的通报", "url": "https://www.freebuf.com/news/146828.html", "time": "2017-09-07", "level": "", "num_look": 277426, "num_comment": 277426, "author": "CNNVD", "tags": ["漏洞", "资讯"], "text": ""}
{"title": "XPwn 2017探索未来盛会遥望，迎接我们的会是少数派报告的世界吗？", "url": "https://www.freebuf.com/fevents/146865.html", "time": "2017-09-07", "level": "红色标题", "num_look": 275192, "num_comment": 3, "author": "Akane", "tags": ["活动"], "text": "也许我们真的走到了科技发展的关键拐点，好在我们还有机会，有那么一群人，一直奋斗在信息安全和大数据、机器学习、AI等前沿科学的第一线，为了避免我们的世界线走向黑暗而努力着。"}
{"title": "善其事利其器，看那些安全研究者手中的“利器”", "url": "https://www.freebuf.com/sectool/146669.html", "time": "2017-09-06", "level": "", "num_look": 452859, "num_comment": 5, "author": "liki", "tags": ["工具", "极客"], "text": "一年一度的DefCon大会每年都会吸引全球的安全研究人员慕名而来，它提供了一个结交朋友，展示实力的平台。参会人员的“利器”也是一大焦点。"}
{"title": "针对MSOffice的木马新变种（毒藤）深度分析", "url": "https://www.freebuf.com/articles/system/146415.html", "time": "2017-09-06", "level": "红色标题", "num_look": 321134, "num_comment": 7, "author": "cyj@y5un", "tags": ["系统安全"], "text": "最近FortiGuard实验室研究团队发现Poison Ivy木马（毒藤）新变种开始在感染的ppt文件中传播，Office应用（Word、Excel、PowerPoint、Works等）受此木马影响。"}
{"title": "FICO报告：2017年借记卡物理欺诈案件比去年同期数量上升39％", "url": "https://www.freebuf.com/news/146607.html", "time": "2017-09-06", "level": "", "num_look": 143342, "num_comment": 1, "author": "Elaine_z", "tags": ["资讯"], "text": "犯罪份子总能想出各种手段读取银行卡片，安置摄像头获取信息。2017年1-6月之间，ATM、PoS 等终端上的欺诈情况怎样了，FICO用统计数据给出了答案。"}
{"title": "京东云诚聘云安全人才", "url": "https://www.freebuf.com/jobs/145510.html", "time": "2017-09-06", "level": "", "num_look": 303502, "num_comment": 14, "author": "lucifer_0", "tags": ["安全招聘"], "text": "相对于阿里云、AWS，京东云是个后起之秀；不过依托于京东集团强大的力量作为靠山，京东云的发展会是非常迅猛的。"}
{"title": "用Mitmproxy辅助Sqlmap自动化利用特殊漏洞", "url": "https://www.freebuf.com/sectool/146578.html", "time": "2017-09-06", "level": "现金奖励", "num_look": 453943, "num_comment": 3, "author": "piece of the past", "tags": ["WEB安全", "工具"], "text": "本文主要介绍利用mitmproxy脚本辅助sqlmap，自动化利用漏洞的方法。由于笔者毫无学习更多姿势的上进心，又在处理数据库注入漏洞方面才学浅薄，因此当一个漏洞不能用sqlmap利用的时候笔者就寸步难行了。"}
{"title": "【已结束】XPwn 2017未来安全探索盛会图文直播", "url": "https://www.freebuf.com/fevents/146653.html", "time": "2017-09-06", "level": "", "num_look": 277290, "num_comment": 4, "author": "AngelaY", "tags": ["活动"], "text": "XPwn 2017未来安全探索盛会将于9月6日在北京朝阳区751D-park第一车间（北京市朝阳区酒仙桥路4号）举办，现场盛况请关注FreeBuf图文直播！"}
{"title": "特别企划 | 国足与世界杯虽已无缘，但体育圈的那些黑幕却一直存在", "url": "https://www.freebuf.com/special/146424.html", "time": "2017-09-06", "level": "", "num_look": 317589, "num_comment": 4, "author": "liki", "tags": ["特别企划"], "text": "勒索软件、远程控制、大型企业，一谈到黑客，我们第一时间会联想起这些词。印象中的金融圈，科技圈一直被黑客们所青睐，而对于体育圈来说，是不是就乏善可陈了呢？答案当然是否定的。"}
{"title": "如何通过Python实现自动填写调查问卷", "url": "https://www.freebuf.com/geek/146388.html", "time": "2017-09-06", "level": "现金奖励", "num_look": 528327, "num_comment": 18, "author": "Mochazz", "tags": ["极客"], "text": "快开学了，出现了各种求填写调查问卷的，我才想起来貌似我也还没做，我打算使用”特技”来完成——也就是python。"}
{"title": "BUF早餐铺 | MongoDB 数据库遭大规模勒索攻击；Taringa的2800万账户信息被窃取； 东莞一男子因非法售卖VPN被判刑九个月", "url": "https://www.freebuf.com/news/146697.html", "time": "2017-09-06", "level": "", "num_look": 435247, "num_comment": 7, "author": "AngelaY", "tags": ["资讯"], "text": "一场秋雨一场寒。近两天多雨，大家注意带好雨具添加衣物，同时也要好好吃早餐哦~"}
{"title": "【9月6日更新】漏洞预警 | 高危Struts REST插件远程代码执行漏洞（S2-052）", "url": "https://www.freebuf.com/vuls/146718.html", "time": "2017-09-05", "level": "红色标题", "num_look": 869566, "num_comment": 13, "author": "漏洞盒子", "tags": ["漏洞"], "text": "千疮百孔的Struts2应用又曝出存在新的高危远程代码执行漏洞。该漏洞由lgtm.com的安全研究员汇报，编号为CVE-2017-9805，漏洞危害程度为高危（Critical）。"}
{"title": "【活动】安全人 · 益起来 | 这一次无关安全，只关乎一场梦想的守护", "url": "https://www.freebuf.com/articles/others-articles/146693.html", "time": "2017-09-05", "level": "红色标题", "num_look": 194395, "num_comment": 3, "author": "FB客服", "tags": ["其他"], "text": "安全有温度，安全行业的企业和爱心人士邀您一起行动起来——这一次，无关安全，只关乎一群年轻人的梦想。"}
{"title": "“海莲花”APT团伙的活动新趋势", "url": "https://www.freebuf.com/articles/network/146552.html", "time": "2017-09-05", "level": "", "num_look": 447867, "num_comment": 7, "author": "奇安信威胁情报中心", "tags": ["网络安全"], "text": "前天友商发布了一个关于海莲花APT团伙的新活动报告，揭露了一些新发现的样本和基础设施，本文提供一些360威胁情报中心视野内的信息来构成更大的拼图。"}
{"title": "挖洞经验 | 热门航空网站上的SQLi和XSS漏洞", "url": "https://www.freebuf.com/articles/web/146276.html", "time": "2017-09-05", "level": "红色标题", "num_look": 559329, "num_comment": 19, "author": "secist", "tags": ["WEB安全"], "text": "上个月为了练手，我选择了一个较受欢迎的网站（goodwesite.com）作为我的渗透测试对象。在漏洞挖掘过程中，我发现了该网站存在SQL注入和XSS漏洞。"}
{"title": "好莱坞女星账号被黑，原来是利用了Instagram API漏洞", "url": "https://www.freebuf.com/news/146298.html", "time": "2017-09-05", "level": "", "num_look": 196427, "num_comment": 196427, "author": "liki", "tags": ["资讯"], "text": "最近， Instagram 的泄露事件可谓是十分热闹， freebuf 也在第一时间进行了报道，根据 Instagram 的最新声明，此次攻击可能与 Instagram 上存在API漏洞有关。"}
{"title": "在智能手机上跟踪ADS-B系统的飞机航线信息", "url": "https://www.freebuf.com/geek/146379.html", "time": "2017-09-05", "level": "", "num_look": 412963, "num_comment": 4, "author": "secist", "tags": ["极客"], "text": "“ADS-B Out”是ADS-B的基本功能，它负责将信号从飞机发送方经过视距传播发送给地面接收站或者其他飞机。"}
{"title": "谷歌从Play Store中下架近300款涉嫌DDoS的安卓软件", "url": "https://www.freebuf.com/news/146448.html", "time": "2017-09-05", "level": "", "num_look": 224668, "num_comment": 1, "author": "liki", "tags": ["资讯"], "text": "这周，Google在其安卓商店 Play Store下架近300款涉及 DDoS的软件。"}
{"title": "星瑞格软件招聘信息安全工程师", "url": "https://www.freebuf.com/jobs/145206.html", "time": "2017-09-05", "level": "", "num_look": 168940, "num_comment": 11, "author": "梦想fly", "tags": ["安全招聘"], "text": "福建星瑞格软件有限公司是福建省电子信息集团控股的国有控股企业，是国产数据库软件与信息安全解决方案的领导厂商。"}
{"title": "利用WHID为隔离主机建立隐秘通道", "url": "https://www.freebuf.com/sectool/146376.html", "time": "2017-09-05", "level": "现金奖励", "num_look": 288180, "num_comment": 4, "author": "xiaowuyi", "tags": ["工具"], "text": "WIFI与HID相结合国外有个更专业的名字就是WHID，可以在目标机上形成一个自定义的通道实现目标机与手机或者wifi下其它攻击设备的通讯，相当于给目标机安装了一个自定义网卡。"}
{"title": "特别企划 | 网络空间“列国志”：安全领域的政治风云", "url": "https://www.freebuf.com/special/145809.html", "time": "2017-09-05", "level": "红色标题", "num_look": 311787, "num_comment": 4, "author": "Sphinx", "tags": ["特别企划"], "text": "作为一种成本较低，效果好的攻击方式，网络已经成为政治斗争的新战场。"}
{"title": "谈谈鱼叉式网络钓鱼黑箱粉碎机", "url": "https://www.freebuf.com/articles/web/145723.html", "time": "2017-09-05", "level": "现金奖励", "num_look": 306281, "num_comment": 1, "author": "apathy", "tags": ["WEB安全"], "text": "美国加州大学伯克利分校和LBNL的几位安全研究人员开发了鱼叉式网络钓鱼黑箱粉碎机，通过分析鱼叉式网络钓鱼攻击的根本特点设计了一组新的信誉特征。"}
{"title": "BUF早餐铺 | TigerSwan公司9400份简历在AWS上泄露；谷歌下架300款涉及DDos的安卓应用；Instagram上600万名人账号信息被窃取出售", "url": "https://www.freebuf.com/news/146511.html", "time": "2017-09-05", "level": "", "num_look": 312130, "num_comment": 312130, "author": "AngelaY", "tags": ["资讯"], "text": "宿雨朝来歇，空山秋气清。秋天到了，宜滋补，宜养生，宜多看 FreeBuf 涨知识~"}
{"title": "快讯 | MongoDB数据库遭大规模勒索攻击，被劫持26000多台服务器", "url": "https://www.freebuf.com/news/146570.html", "time": "2017-09-04", "level": "红色标题", "num_look": 404173, "num_comment": 4, "author": "Akane", "tags": ["资讯"], "text": "刚刚曝出的大新闻，MongoDB数据库叕被攻击了。就在上周末，三个黑客团伙劫持了MongoDB逾26000多台服务器，其中规模最大的一组超过22000台。"}
{"title": "教师节礼物 | 15款工具教会“熊孩子”编程", "url": "https://www.freebuf.com/sectool/146397.html", "time": "2017-09-04", "level": "", "num_look": 534150, "num_comment": 8, "author": "米雪儿", "tags": ["工具"], "text": "以下15款教育工具对帮助你的孩子／学生学习编程知识有很大的帮助，它们都有一些共同点：外观五彩缤纷，界面可自由拖拽，基于可视化编程语言"}
{"title": "谈谈端口探测的经验与原理", "url": "https://www.freebuf.com/articles/network/146087.html", "time": "2017-09-04", "level": "红色标题", "num_look": 3756643, "num_comment": 17, "author": "sarleon", "tags": ["网络安全"], "text": "端口探测在渗透测试的信息收集以及威胁情报领域都有着很重要的应用,本文章将从几个方面来介绍端口探测相关的知识。"}
{"title": "再见了，接码平台：交互式语音验证码", "url": "https://www.freebuf.com/articles/network/146246.html", "time": "2017-09-04", "level": "现金奖励", "num_look": 635526, "num_comment": 14, "author": "idapro", "tags": ["网络安全"], "text": "交互式语音验证码的出现，可能要让那些接码平台说再见了。"}
{"title": "深信服安全产品研发大咖引进（高薪+股票）", "url": "https://www.freebuf.com/jobs/144989.html", "time": "2017-09-04", "level": "", "num_look": 252585, "num_comment": 3, "author": "suifeng-刘军", "tags": ["安全招聘"], "text": "“中国卓越雇主”–深信服科技成立于2000年，是中国最大的新网络产品供应商，致力于提供基于创新网络的产品及解决方案，深信服业务涵盖两大领域：网络安全、虚拟化&云计算。"}
{"title": "利用Python实现DGA域名检测", "url": "https://www.freebuf.com/articles/web/145981.html", "time": "2017-09-04", "level": "现金奖励", "num_look": 700529, "num_comment": 9, "author": "feiniao", "tags": ["WEB安全"], "text": "前段时间爆发的利用永恒之蓝进行勒索及xshell等事件，各大厂家都站在不同的角度分析了相应的事件及程序，对于对逆向不了解看着的确很吃力。上段时间看到宫总及袁哥都在讲DNS对于分析这种攻击的可行性。"}
{"title": "揭秘盗取“羊毛党”比特币的钓鱼攻击事件 | 一例C2服务器跟踪分析报告", "url": "https://www.freebuf.com/articles/network/145985.html", "time": "2017-09-04", "level": "红色标题", "num_look": 540829, "num_comment": 9, "author": "dongxun", "tags": ["网络安全"], "text": "在薅羊毛行业繁荣的背后，隐藏着另一神秘的群体，这个神秘的群体寄居在“羊毛党”之上，贪婪地薅着同样贪婪的“羊毛党”的羊毛。"}
{"title": "研究人员找到禁用Intel ME组件的方法（乡村故事版）", "url": "https://www.freebuf.com/news/146032.html", "time": "2017-09-04", "level": "", "num_look": 230718, "num_comment": 4, "author": "奇安信代码卫士", "tags": ["资讯"], "text": "本文试图以故事形式还原PositiveTechnologies公司找到禁用IntelME组件方法的消息，祝各位阅读愉快。"}
{"title": "BUF早餐铺 | 维基解密新框架Angelfire揭露；钓鱼2300万用户的Locky勒索软件变种；Cobian RAT家族背后的秘密后门", "url": "https://www.freebuf.com/news/146299.html", "time": "2017-09-04", "level": "", "num_look": 300689, "num_comment": 300689, "author": "Elaine_z", "tags": ["资讯"], "text": "九月已经来了，十一还会远吗？BUF 早餐铺，每日陪你看新闻~"}
{"title": "SearchSploit漏洞查找工具使用指南", "url": "https://www.freebuf.com/sectool/146106.html", "time": "2017-09-03", "level": "", "num_look": 646264, "num_comment": 6, "author": "Akira", "tags": ["工具"], "text": "“searchsploit”是一个用于Exploit-DB的命令行搜索工具，它还允许你随身带一份Exploit-DB的副本."}
{"title": "招商银行招聘信息安全管理岗位", "url": "https://www.freebuf.com/jobs/144340.html", "time": "2017-09-03", "level": "", "num_look": 357926, "num_comment": 10, "author": "xysky", "tags": ["安全招聘"], "text": "招商银行，是中国第一家完全由企业法人持股的股份制商业银行，简称招行，成于1987年4月8日，由香港招商局集团有限公司创办，是中国内地规模第六大的银行。"}
{"title": "大疆的漏洞奖励计划来了，美国的“安全控诉”是不是可以歇会儿了？", "url": "https://www.freebuf.com/news/146144.html", "time": "2017-09-03", "level": "红色标题", "num_look": 275558, "num_comment": 5, "author": "liki", "tags": ["观点", "资讯"], "text": "周一，大疆宣布启动漏洞奖励计划，意在奖励任何发现软件漏洞的人员，奖励金额在100到30000美元之间。"}
{"title": "利用忘记密码功能绕过Windows auth & BitLocker", "url": "https://www.freebuf.com/articles/web/145994.html", "time": "2017-09-03", "level": "", "num_look": 362308, "num_comment": 8, "author": "secist", "tags": ["WEB安全"], "text": "此外对于加密的笔记本电脑，如果只使用了BitLocker而没有启用PIN，加密和本地认证机制也可以被完全绕过。"}
{"title": "“双子星”文档攻击预警 - 新型的跨平台恶意文档攻击分析报告", "url": "https://www.freebuf.com/articles/system/145543.html", "time": "2017-09-03", "level": "", "num_look": 281957, "num_comment": 3, "author": "360安全", "tags": ["系统安全"], "text": "近日，360公司核心安全部QEX团队和追日团队发现了一种新型的跨平台恶意文档攻击开始流行，并捕获到了该攻击在野外出现的恶意样本。"}
{"title": "WireX Botnet：首个Android DDoS恶意程序", "url": "https://www.freebuf.com/articles/terminal/145955.html", "time": "2017-09-02", "level": "", "num_look": 434646, "num_comment": 4, "author": "腾讯手机管家", "tags": ["系统安全", "终端安全"], "text": "近期，研究人员发现一个名为 WireX 的僵尸网络，这是首个 Android DDoS 恶意程序，数万台 Android 手机沦为肉鸡。"}
{"title": "如何在特定的渗透测试中使用正确的Burp扩展插件", "url": "https://www.freebuf.com/sectool/146247.html", "time": "2017-09-02", "level": "", "num_look": 386755, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Burp Suite是很多渗透测试人员会优先选择使用的一款强大的平台，而且安全社区中也有很多研究人员开发出了大量的功能扩展插件，这些插件不仅能够简化渗透测试的过程。"}
{"title": "斗象科技招聘安全人才", "url": "https://www.freebuf.com/jobs/141820.html", "time": "2017-09-02", "level": "", "num_look": 465912, "num_comment": 19, "author": "FB客服", "tags": ["安全招聘"], "text": "斗象科技成立于2014年5月，是一家创新型互联网安全服务提供商，旗下业务包括FreeBuf、漏洞盒子、网藤智能安全。"}
{"title": "【FB TV】一周「BUF大事件」：2017腾讯安全国际技术峰会深圳举行；维基解密发布“Vault 7”系列新工具；大疆宣布启动漏洞奖励计划", "url": "https://www.freebuf.com/video/146365.html", "time": "2017-09-02", "level": "红色标题", "num_look": 384505, "num_comment": 3, "author": "willhuang", "tags": ["视频"], "text": "本周BUF大事件又为大家带来了成吨新鲜有趣的安全新闻，2017腾讯安全国际技术峰会在深圳举行，各位大牛轮番上阵，分享网络安全新招式。维基解密休息了一周后又来搞事了，你怕不怕？另外，大疆也宣布启动漏洞奖励计划…"}
{"title": "新勒索软件“Defray”可通过Microsoft Word文档传播", "url": "https://www.freebuf.com/news/145983.html", "time": "2017-09-02", "level": "", "num_look": 170420, "num_comment": 170420, "author": "secist", "tags": ["资讯"], "text": "近日，新勒索软件“Defray”可通过Microsoft Word文档传播，而defray在英文当中，正是指提供资金支付一部分成本或费用的意思。"}
{"title": "浅谈多浏览器的自动化测试", "url": "https://www.freebuf.com/articles/others-articles/145586.html", "time": "2017-09-02", "level": "", "num_look": 346930, "num_comment": 2, "author": "岂安科技", "tags": ["其他"], "text": "要是你碰到前端工程师朋友，那聊聊浏览器的兼容性准是没错，这和碰到英国朋友就谈天气是一个道理。大部分程序员朋友们一定会捶胸顿足，连连诉苦."}
{"title": "CIA新一波工具AngelFire： 针对Windows系统的永久恶意框架", "url": "https://www.freebuf.com/news/146345.html", "time": "2017-09-01", "level": "", "num_look": 364423, "num_comment": 6, "author": "AngelaY", "tags": ["资讯"], "text": "本周，维基解密发布了新一款 CIA 工具 AngelFire。AngelFire 是一款框架植入工具，可以作为永久后门留存在被感染系统的分区引导扇区中，对目标系统进行永久远程控制。"}
{"title": "使用DropBox功能将其作为C&C服务器", "url": "https://www.freebuf.com/sectool/146116.html", "time": "2017-09-01", "level": "", "num_look": 354896, "num_comment": 3, "author": "secist", "tags": ["工具"], "text": "许多企业都将DropBox作为他们的共享和数据托管工具。因此，向DropBox服务器发送的流量通常会被限制或归类为恶意域。"}
{"title": "“道德黑客”CEH （Certified Ethical Hacker） 考证全攻略", "url": "https://www.freebuf.com/articles/others-articles/146181.html", "time": "2017-09-01", "level": "金币+20", "num_look": 957707, "num_comment": 16, "author": "juney", "tags": ["其他"], "text": "网上对于CEH认证的中文介绍少，没看到详细攻略。本文简述CEH考证相关问题，给需要的朋友参考~"}
{"title": "你有没有想过，家里用的智能设备可能会暴露你的生活习惯和方式？", "url": "https://www.freebuf.com/articles/terminal/146072.html", "time": "2017-09-01", "level": "", "num_look": 247004, "num_comment": 247004, "author": "liki", "tags": ["终端安全"], "text": "你有没有想过？你家里所用的智能家电可能会暴露你的生活习惯和方式？智能家电产生流量之中的元数据就足以让你暴露。"}
{"title": "挖洞经验 | 把PHP LFI漏洞变成Webshell的思路", "url": "https://www.freebuf.com/articles/web/145861.html", "time": "2017-09-01", "level": "现金奖励", "num_look": 393078, "num_comment": 12, "author": "jfeiyi", "tags": ["WEB安全"], "text": "关注PHP漏洞的朋友一定知道LFI+phpinfo可以搞出一个webshell。接下来，我分享一个思路"}
{"title": "冠群驰骋（互金行业）招聘渗透测试工程师", "url": "https://www.freebuf.com/jobs/144243.html", "time": "2017-09-01", "level": "", "num_look": 209709, "num_comment": 12, "author": "Achilles18", "tags": ["安全招聘"], "text": "冠群驰骋投资管理（北京）有限公司作为一家全国范围内专业扶持中小微企业的P2B金融服务平台，秉承“扶微助小，助梦中国”的企业宗旨，长期关注中小微企业的发展。"}
{"title": "硬核与底层漏洞齐飞：2017腾讯安全国际技术峰会次日精彩回顾", "url": "https://www.freebuf.com/fevents/146209.html", "time": "2017-09-01", "level": "红色标题", "num_look": 1260584, "num_comment": 1260584, "author": "Elaine_z", "tags": ["活动"], "text": "腾讯安全国际技术峰会的第二天依旧是硬核与干货齐飞，趋势科技、Comsecuris、高通、MWR infoSecurity、盘古及 Corellium 嘉宾悉数到场。"}
{"title": "机器人是如何被入侵并被用于监视和破坏的", "url": "https://www.freebuf.com/articles/terminal/145911.html", "time": "2017-09-01", "level": "", "num_look": 300591, "num_comment": 300591, "author": "Covfefe", "tags": ["终端安全"], "text": "很多科幻小说给人留下了很深的印象，以至于有许多人担心某一天家用的机器人或者工业机器人会揭竿而起，开始天网般的起义。"}
{"title": "特别企划 | 维基解密CIA泄露盘点：骇人听闻的攻击部门和全方位黑客工具", "url": "https://www.freebuf.com/special/145818.html", "time": "2017-09-01", "level": "红色标题", "num_look": 577760, "num_comment": 3, "author": "AngelaY", "tags": ["特别企划"], "text": "说起泄露，除了斯洛登棱镜门、Shadow Brokers 泄露 NSA 数据这种大型泄露之外，维基解密泄露的一系列 CIA 文档也可以算是史上较大规模政府机构信息泄露事件了。"}
{"title": "OpenStack：建立虚拟的渗透测试实验环境 - 网络篇", "url": "https://www.freebuf.com/articles/network/145947.html", "time": "2017-09-01", "level": "现金奖励", "num_look": 434007, "num_comment": 2, "author": "zrools", "tags": ["网络安全"], "text": "对一个沙箱环境而言，其中最重要的一点就是网络的隔离，OpenStack网络支持Flat、VLAN、VXLAN等模式，配合路由器和防火墙可轻松虚拟一个简单的企业网络。"}
{"title": "BUF早餐铺 | 当红女星Instagram账号被黑发裸照；Turla APT组织攻击领事馆和大使馆；46.5万台心脏起搏器有漏洞；近3000个比特币挖矿机曝光", "url": "https://www.freebuf.com/news/146218.html", "time": "2017-09-01", "level": "红色标题", "num_look": 341035, "num_comment": 7, "author": "AngelaY", "tags": ["资讯"], "text": "九月第一天，愿你吃好睡好工作好！元气满满每一天！"}
{"title": "逆向一款恶意Eclipse插件的经历", "url": "https://www.freebuf.com/articles/web/145677.html", "time": "2017-08-31", "level": "金币+20", "num_look": 351116, "num_comment": 8, "author": "pingch", "tags": ["WEB安全"], "text": "最近我对信息安全的诸多领域进行了研究，包括二进制、逆向工程到破解WPA。因此，我决定搭建一个信息安全学习博客，用于记录学到的知识。"}
{"title": "如何使用SecGen随机生成漏洞靶机？", "url": "https://www.freebuf.com/sectool/145679.html", "time": "2017-08-31", "level": "", "num_look": 350283, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "对于渗透测试的新手而言，往往需要通过大量的靶机来练手例如 VulnHub、Metasploitable、DVWA等。但我们不难发现这些靶机有个弊端就是，所有的漏洞都是已知和静态的，这与实际场景也存在着较大的出入。"}
{"title": "探索低功耗蓝牙之看我如何逆向物联网灯泡并控制它", "url": "https://www.freebuf.com/articles/terminal/145528.html", "time": "2017-08-31", "level": "", "num_look": 542909, "num_comment": 5, "author": "Covfefe", "tags": ["极客", "终端安全"], "text": "作为一个IoT发烧友和夜猫子安全研究员，IoT一直吸引着我，因为我们每天使用的IoT应用程序都在让生活变得更加轻松便利。"}
{"title": "“金蝉脱壳”病毒分析报告", "url": "https://www.freebuf.com/articles/terminal/145550.html", "time": "2017-08-31", "level": "金币+20", "num_look": 471792, "num_comment": 9, "author": "暗影安全实验室", "tags": ["终端安全"], "text": "近期，暗影实验室监测到与“金蝉脱壳”的典故极其类似的一个病毒家族，该家族样本通过各种伪装手段迷惑和欺骗用户，并在用户不知情的情况下执行各项恶意操作。"}
{"title": "Selena Gomez在Ins发前男友Justin Bieber裸照，还说是弱鸡？原来是账号被黑了", "url": "https://www.freebuf.com/news/146123.html", "time": "2017-08-31", "level": "红色标题", "num_look": 909422, "num_comment": 3, "author": "AngelaY", "tags": ["资讯"], "text": "美国著名女歌手、演员 Selena Gomez 的 Instagram 账号最近被黑，黑客入侵其账号后还发了 Justin Bieber 的裸照（你可以脑补一出前男友的故事了……）"}
{"title": "花生壳黑吃黑之一：Web练手基地", "url": "https://www.freebuf.com/sectool/145718.html", "time": "2017-08-31", "level": "", "num_look": 725018, "num_comment": 18, "author": "刀郎", "tags": ["工具"], "text": "今天给大家带来练手的真实环境，没有看门狗，并且漏洞很多，并且可能有意外收获啊。"}
{"title": "如何绕过windows 2008 R2身份验证？", "url": "https://www.freebuf.com/articles/system/145685.html", "time": "2017-08-31", "level": "", "num_look": 553197, "num_comment": 25, "author": "secist", "tags": ["系统安全"], "text": "本文我将为大家介绍一种，绕过Windows Server 2008 R2服务器的身份验证以及重置系统管理员密码的技术。此技术几乎适用于所有的Windows系统，但必须具备以下两个前提之一。"}
{"title": "OpenStack：建立虚拟的渗透测试实验环境 - 安装篇", "url": "https://www.freebuf.com/sectool/145863.html", "time": "2017-08-31", "level": "现金奖励", "num_look": 404010, "num_comment": 8, "author": "zrools", "tags": ["工具"], "text": "随着云计算技术的兴起，无疑给建立虚拟环境多了一种选择，通过虚拟技术，可以建立更加复杂的测试环境，甚至仿真一个企业网络以便测试各种攻击场景。"}
{"title": "Buf早餐铺 | 大疆也推漏洞奖励计划了；一份超7亿用户的邮箱密码数据正在流通；朝鲜持续对比特币交易平台发动攻击，为增加财政收入？", "url": "https://www.freebuf.com/news/146054.html", "time": "2017-08-31", "level": "", "num_look": 291317, "num_comment": 3, "author": "liki", "tags": ["资讯"], "text": "大疆推出无人机漏洞奖励计划；台风Harvey袭击德州之后，US-CERT针对潜在钓鱼风险发出预警。"}
{"title": "AI时代中的信息安全：2017腾讯安全国际技术峰会首日议题全记录", "url": "https://www.freebuf.com/fevents/146073.html", "time": "2017-08-31", "level": "红色标题", "num_look": 467879, "num_comment": 5, "author": "Sphinx", "tags": ["活动"], "text": "几百人的会场几乎座无虚席，而这场干货满满的会议也并没有让大家失望。"}
{"title": "Cknife的PHP功能部分修正，解决SHELL无法回显以及中文乱码", "url": "https://www.freebuf.com/sectool/144469.html", "time": "2017-08-30", "level": "现金奖励", "num_look": 448769, "num_comment": 10, "author": "Lz1y", "tags": ["工具"], "text": "在现在满大街菜刀都存在后门问题的时候,Cknife横空出世了。因为开源，所以安全。因为可操作的空间挺大的，也十分适合过各种WAF。"}
{"title": "企业安全中DevSecOps的一些思考", "url": "https://www.freebuf.com/articles/es/145567.html", "time": "2017-08-30", "level": "金币+20", "num_look": 657299, "num_comment": 6, "author": "yirendai_sec", "tags": ["企业安全"], "text": "在RSA大会中，“下一代应用及IT基础设施的安全管理模式”，被提升到新高度，大会专门为这个概念和方向设置议题和讨论会，一个新晋热词“DevSecOps”出现了"}
{"title": "Kali Linux下社工密码字典生成工具Cupp和Cewl教程", "url": "https://www.freebuf.com/sectool/144740.html", "time": "2017-08-30", "level": "金币+20", "num_look": 1029866, "num_comment": 7, "author": "少帅力", "tags": ["工具"], "text": "cupp是一款用python语言写成的可交互性的字典生成脚本。尤其适合社会工程学，当你收集到目标的具体信息后，你就可以通过这个工具来智能化生成关于目标的字典。"}
{"title": "【FB TV】BUF大事件番外篇：2017上半年十大黑客事件盘点", "url": "https://www.freebuf.com/video/146010.html", "time": "2017-08-30", "level": "红色标题", "num_look": 494683, "num_comment": 6, "author": "willhuang", "tags": ["视频"], "text": "观众朋友们，观众朋友们，期待已久的BUF大事件番外篇又来啦,本期为大家盘点2017上半年的十大网络安全事件,有你不知道的事么？"}
{"title": "手把手教你利用命令行工具创建LinuxMac系统下的网站备份", "url": "https://www.freebuf.com/articles/system/145614.html", "time": "2017-08-30", "level": "", "num_look": 493487, "num_comment": 3, "author": "Carrie_spinfo", "tags": ["系统安全"], "text": "创建网站备份应该是一个网站管理员最为重要的日常工作之一。但现实情况是，备份这一步往往被很多人忽略，也就是说仍然有很多网管的网站安全意识较低。"}
{"title": "北京中科网航诚挚招聘", "url": "https://www.freebuf.com/jobs/144654.html", "time": "2017-08-30", "level": "", "num_look": 181791, "num_comment": 2, "author": "lovemyself", "tags": ["安全招聘"], "text": "北京中科网航安全技术有限公司成立于2003年，是北京市高新技术企业。"}
{"title": "允许任何人随意生成变体Android勒索软件的新APP正在地下黑客论坛和社交网络传播", "url": "https://www.freebuf.com/news/145867.html", "time": "2017-08-30", "level": "", "num_look": 560038, "num_comment": 3, "author": "secist", "tags": ["资讯"], "text": "据一份报告称，一款来自中国的Android勒索软件生成套件，正在某地下黑客论坛和中国社交网站上传播。黑客只需一次性付款，即可随意创建不受限的勒索软件变体。"}
{"title": "CoinMiner：又一款利用永恒之蓝扩散的挖矿病毒", "url": "https://www.freebuf.com/news/145311.html", "time": "2017-08-30", "level": "", "num_look": 482458, "num_comment": 3, "author": "Sphinx", "tags": ["资讯"], "text": "趋势科技的研究人员发现了一款新的无文件挖矿恶意程序CoinMiner，这又是一款使用永恒之蓝和WMI工具进行传播的软件。"}
{"title": "【已结束】2017 腾讯安全国际技术峰会图文直播", "url": "https://www.freebuf.com/fevents/145854.html", "time": "2017-08-30", "level": "红色标题", "num_look": 388762, "num_comment": 7, "author": "Sphinx", "tags": ["活动"], "text": "2017 腾讯安全国际技术峰会将于8月30日、31日在深圳举行，FreeBuf将带来全程图文直播。"}
{"title": "老树新芽：Windump与大数据工具结合做流量统计分析", "url": "https://www.freebuf.com/articles/network/144767.html", "time": "2017-08-30", "level": "现金奖励", "num_look": 404097, "num_comment": 4, "author": "糖果L5Q", "tags": ["网络安全"], "text": "在Windows上Wireshark的GUI界面很酷，但对于在linux和mac用惯了tcpdump用户来说，用命令行的tcpdump更直接便捷，Windows上有没有类似tcpdump的抓包工具呢？"}
{"title": "Buf早餐铺 | Intel处理器“后门”组件可被禁用，为NSA定制的？WannaCry英雄被捕后没钱打官司，正在众筹；十几万Android手机组僵尸网络，你中招了吗？", "url": "https://www.freebuf.com/news/145954.html", "time": "2017-08-30", "level": "", "num_look": 419208, "num_comment": 1, "author": "欧阳洋葱", "tags": ["资讯"], "text": "先前发现WannaCry死亡开关的安全研究人员Marcus Hutchins在美国被捕，现在他的朋友正在为Hutchins的诉讼费发起众筹。"}
{"title": "黑客的七夕礼物 | 大量IoT设备Telnet密码列表遭泄露", "url": "https://www.freebuf.com/news/145739.html", "time": "2017-08-29", "level": "", "num_look": 568751, "num_comment": 4, "author": "Sphinx", "tags": ["资讯"], "text": "一份包含几千条telnet密码的列表自7月11日起被贴到了Pastebin上，这些密码可以被黑客用来扩大僵尸网络。"}
{"title": "一个Android僵尸网络的败退：网络安全行业合作的成功典范", "url": "https://www.freebuf.com/news/145917.html", "time": "2017-08-29", "level": "", "num_look": 181382, "num_comment": 3, "author": "AngelaY", "tags": ["资讯"], "text": "来自Akamai、Cloudflare,、Flashpoint、谷歌等公司研究员组成的安全团队发现并阻击了一种新的僵尸网络WireX。WireX包含数千台 Android 手机bot，曾大肆进行DDoS攻击。"}
{"title": "“泄露的游戏”为什么总能在我的TimeLine上出现？", "url": "https://www.freebuf.com/news/145799.html", "time": "2017-08-29", "level": "", "num_look": 190435, "num_comment": 2, "author": "liki", "tags": ["资讯"], "text": "这个月对 HBO 来说真可谓相当艰苦的一个月，这件事的周边还真可谓琳琅满目，大众媒体也都在关注这场旷日持久的“泄露的游戏”，连当季大结局剧本都已经泄露了。"}
{"title": "特别企划 | 银行业木马黑产报告", "url": "https://www.freebuf.com/special/145572.html", "time": "2017-08-29", "level": "红色标题", "num_look": 534812, "num_comment": 13, "author": "暗影安全实验室", "tags": ["特别企划"], "text": "随着智能手机和各种数码终端的普及,移动支付已经融入到了人们的生活中。在移动支付给生活带来巨大便利的同时，移动支付安全也成为目前最热门的话题。"}
{"title": "KCon 2017圆满落幕 干货有趣明年再约！", "url": "https://www.freebuf.com/fevents/145874.html", "time": "2017-08-29", "level": "", "num_look": 154255, "num_comment": 154255, "author": "liki", "tags": ["活动"], "text": "KCon 黑客大会，汇聚黑客的智慧。KCon，知道创宇出品，追求干货有趣的黑客大会。"}
{"title": "“大宝剑”的用法：玩玩DEFCON后渗透工具Koadic", "url": "https://www.freebuf.com/sectool/145674.html", "time": "2017-08-29", "level": "现金奖励", "num_look": 473828, "num_comment": 10, "author": "Barshanjiun", "tags": ["工具"], "text": "koadic是在DEFCON上的一个后渗透工具，虽然类似msf 但是它是一款 js/vbs 远控，模块也蛮多的，涉及的功能也很全面 算是“居家旅行，杀人越货”必备良品了。"}
{"title": "郑州向心力2017秋季招聘安全服务工程师", "url": "https://www.freebuf.com/jobs/144044.html", "time": "2017-08-29", "level": "", "num_look": 210156, "num_comment": 3, "author": "ziluobu", "tags": ["安全招聘"], "text": "向心力业务范围涵盖中国及海外多个国家，并在河南、北京、上海、江西、广东、内蒙古、山东、吉林、新疆、陕西设立了常驻分支机构。"}
{"title": "基于Paramiko的高交互SSH蜜罐", "url": "https://www.freebuf.com/sectool/145527.html", "time": "2017-08-29", "level": "现金奖励", "num_look": 553756, "num_comment": 3, "author": "addadd", "tags": ["工具", "网络安全"], "text": "paramiko库，非常好用，既能当ssh client又能当ssh server，模块的文档也非常详细，所以产生了基于paramiko写一个SSH高交互蜜罐的想法。"}
{"title": "聊聊WiFi Hacks：为何你的Karma攻击不好使了", "url": "https://www.freebuf.com/articles/wireless/145259.html", "time": "2017-08-29", "level": "现金奖励", "num_look": 834234, "num_comment": 9, "author": "qingxp9", "tags": ["无线安全"], "text": "三年前我发表了一篇文章《黑客有办法让你自动连上陌生WiFi》，介绍Karma攻击可以让你的无线设备自动连上黑客的WiFi。当时引起了还算比较热烈的讨论，关于WiFi安全，关于Karma攻击等。同时，我也提到WiFi钓鱼将会成…"}
{"title": "Mac下的破解软件真的安全吗？", "url": "https://www.freebuf.com/articles/terminal/145327.html", "time": "2017-08-29", "level": "", "num_look": 456789, "num_comment": 12, "author": "eleme_sec", "tags": ["终端安全"], "text": "针对mac用户的恶意软件逐渐增多，窃取用户的隐私, 监控用户的日常行为, 恶意推广广告, etc。本文研究那些恶意软件背后的套路。"}
{"title": "BUF早餐铺 | 《权力的游戏》本季大结局剧本泄露；AI算法也可以植入后门；针对中国用户的木马开发套装，不用写代码就能打造勒索程序", "url": "https://www.freebuf.com/news/145787.html", "time": "2017-08-29", "level": "", "num_look": 310390, "num_comment": 310390, "author": "Sphinx", "tags": ["资讯"], "text": "没人陪你过七夕，但有人给你送礼物呀~"}
{"title": "七夕祝福 | FreeBuf的黑阔们七夕都怎么过？", "url": "https://www.freebuf.com/fevents/145800.html", "time": "2017-08-28", "level": "红色标题", "num_look": 268142, "num_comment": 7, "author": "Akane", "tags": ["活动"], "text": "对咱们单身狗来说，朋友圈那些秀恩爱的真是满纸荒唐言，一把辛酸泪……前两天有个黑客火了（此人并非斗象科技员工，请勿对号入座），人家凭本事吃饭，他凭本事单身。难道安全工作者都是这样的吗……！？"}
{"title": "使用RTL-SDR，从打开一个车门到批量打开车门", "url": "https://www.freebuf.com/sectool/145670.html", "time": "2017-08-28", "level": "", "num_look": 375834, "num_comment": 10, "author": "Covfefe", "tags": ["工具"], "text": "在最近几年，入侵汽车在当代社会的黑客圈中成为热点，很多文章表明汽车产业还有很多东西等待完善，在本篇文章中，我会让你熟悉我一直研究的一些概念。"}
{"title": "ROPEMAKER：利用简单CSS属性就可以篡改已发送的邮件内容", "url": "https://www.freebuf.com/articles/web/145452.html", "time": "2017-08-28", "level": "红色标题", "num_look": 985310, "num_comment": 4, "author": "liki", "tags": ["WEB安全"], "text": "近日，研究人员发现了一种名为ROPEMAKER的邮件攻击方法，它可以让攻击者通过远程修改css文件来篡改邮件内容。"}
{"title": "又一加密货币网站遭入侵：不明黑客窃取Enigma价值超过47万美元的以太币", "url": "https://www.freebuf.com/news/145181.html", "time": "2017-08-28", "level": "", "num_look": 210370, "num_comment": 3, "author": "AngelaY", "tags": ["资讯"], "text": "近日，由麻省理工学院一群研究生开发的流行加密货币项目平台 Enigma 网站遭不明黑客攻击，价值超过 47 万美元的以太币被窃取。"}
{"title": "YY安全中心的“蜜罐技术”应用实践", "url": "https://www.freebuf.com/articles/network/145691.html", "time": "2017-08-28", "level": "", "num_look": 612113, "num_comment": 9, "author": "yysecurity", "tags": ["企业安全", "网络安全"], "text": "蜜罐技术不是一个新概念，威胁情报概念的流行已有数年时间，在过去三年RSA信息安全大会演讲关键词可以看出，“Threat”和“Intelligence”正成为大家关注的焦点。"}
{"title": "蚂蚁金服诚招安全人才", "url": "https://www.freebuf.com/jobs/143459.html", "time": "2017-08-28", "level": "", "num_look": 317141, "num_comment": 317141, "author": "bbhaveaniceday", "tags": ["安全招聘"], "text": "蚂蚁金服是一家旨在为世界带来普惠金融服务的科技企业。蚂蚁金服起步于 2004 年成立的支付宝。蚂蚁金服现招聘风险情报专家。"}
{"title": "身体改造会是人类的未来吗？身体植入14枚“插件”的生物黑客Patrick Paumen专访", "url": "https://www.freebuf.com/articles/neopoints/145230.html", "time": "2017-08-28", "level": "红色标题", "num_look": 536689, "num_comment": 13, "author": "Sphinx", "tags": ["观点"], "text": "有一群极客，一直致力于改造自己的身体，今天的主角帕特里克·帕门(Patrick Paumen)就是其中的一员。"}
{"title": "特别企划 | 勒索界面进化史：聊聊勒索软件中运用的心理学机制", "url": "https://www.freebuf.com/special/145202.html", "time": "2017-08-28", "level": "红色标题", "num_look": 810626, "num_comment": 2, "author": "Elaine_z", "tags": ["特别企划"], "text": "安全圈内早已听说过 Archievus、Reveton、CryptoLocker、LOcky 等赫赫有名的勒索软件。而在过去几个月里，大众也对勒索软件有了更深刻的认识。"}
{"title": "高通加解密引擎提权漏洞解析", "url": "https://www.freebuf.com/vuls/143789.html", "time": "2017-08-28", "level": "", "num_look": 294686, "num_comment": 294686, "author": "360安全", "tags": ["漏洞"], "text": "这篇文章介绍一下CVE-2016-3935 和CVE-2016-6738 这两个高通加解密引擎（ Qualcomm crypto engine）提权漏洞的成因和利用。"}
{"title": "Buf早餐铺 | CIA利用ExpressLane工具搜集FBI与NSA等机构的数据；FBI逮捕一中国黑客；研究人员发现iOS内核8个漏洞的完整EXP", "url": "https://www.freebuf.com/news/145554.html", "time": "2017-08-28", "level": "", "num_look": 312382, "num_comment": 312382, "author": "Elaine_z", "tags": ["资讯"], "text": "七月流火，九月授衣。今天是 8 月 28 日，农历七月初七。有 FreeBuf 相伴，相信读者们都能度过快乐的七夕！"}
{"title": "安全技术人与政策制定者，如何才能跨过交流鸿沟？", "url": "https://www.freebuf.com/news/145036.html", "time": "2017-08-27", "level": "", "num_look": 228899, "num_comment": 228899, "author": "Covfefe", "tags": ["观点", "资讯"], "text": "IT专业人人士和政策制定者都十分关注网络安全，但是他们似乎没有太多的共同语言，有时甚至是对立的。现在让我们了解在美国，这些网络安全专家是如何找到共同的驻足点的。"}
{"title": "破译优利德旗舰万用表UT181A通讯协议", "url": "https://www.freebuf.com/articles/terminal/145017.html", "time": "2017-08-27", "level": "", "num_look": 327044, "num_comment": 6, "author": "loblab", "tags": ["终端安全"], "text": "UT181A是优利德门下旗舰级手持数字万用表，本文的破解/破译方法及结论应该适用于UT171系列；对破译其它联机通讯的设备也有借鉴意义。"}
{"title": "山东云天招聘高级渗透测试工程师", "url": "https://www.freebuf.com/jobs/143573.html", "time": "2017-08-27", "level": "", "num_look": 332345, "num_comment": 20, "author": "山东云天安全技术有限公司", "tags": ["安全招聘"], "text": "山东云天安全技术有限公司成立于2016年，是一家专注于第三方大数据互联网安全服务商。公司现诚招中高级渗透测试工程师"}
{"title": "最新漏洞利用包可租用每天需80美元", "url": "https://www.freebuf.com/news/145542.html", "time": "2017-08-27", "level": "", "num_look": 246473, "num_comment": 4, "author": "secist", "tags": ["资讯"], "text": "以色列网络安全公司IntSights Cyber Intelligence透露，一种新型的漏洞利用套件正在俄罗斯某地下黑客论坛被进行出售。"}
{"title": "研究人员发现新式鱼叉式钓鱼检测方法，获FaceBook价值10万美元的互联网防御奖", "url": "https://www.freebuf.com/news/144945.html", "time": "2017-08-27", "level": "", "num_look": 193120, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "近日，加利福尼亚大学伯克利分校的一组研究人员获得 Facebook 本年度价值 10 万美元的“互联网防御奖金”，他们研究发现了一种新的在企业网络中检测鱼叉式钓鱼的方法。"}
{"title": "2017年十大安全挑战", "url": "https://www.freebuf.com/news/145227.html", "time": "2017-08-26", "level": "", "num_look": 313258, "num_comment": 4, "author": "Covfefe", "tags": ["资讯"], "text": "SC media访问了这个领域的一些高层，试图询问 2017 年未来几个月即将面临的最大的威胁与问题，文中是详细信息。"}
{"title": "内存取证三项CTF赛题详解", "url": "https://www.freebuf.com/news/145262.html", "time": "2017-08-26", "level": "金币+10", "num_look": 655283, "num_comment": 11, "author": "精灵", "tags": [], "text": "本文主要内容涉及内存取证三项CTF赛题的详解。"}
{"title": "同花顺信息安全部招聘安全开发工程师", "url": "https://www.freebuf.com/jobs/130151.html", "time": "2017-08-26", "level": "", "num_look": 226939, "num_comment": 7, "author": "THSecurityTeam", "tags": ["安全招聘"], "text": "同花顺信息安全部为公司新成立的部门，主要负责公司安全防御体系的建设，保障公司业务安全发展。"}
{"title": "“隐魂”木马篡改主页分析：史上反侦察力最强木马的犯罪素描", "url": "https://www.freebuf.com/articles/system/144792.html", "time": "2017-08-26", "level": "", "num_look": 555188, "num_comment": 9, "author": "360安全", "tags": ["系统安全"], "text": ""}
{"title": "【FB TV】一周「BUF大事件」：国内广告SDK窃取用户数据，感染App下载量过亿；斯诺登公布最新泄露文档；好莱坞艳照门事件再次袭来", "url": "https://www.freebuf.com/video/145659.html", "time": "2017-08-26", "level": "红色标题", "num_look": 521751, "num_comment": 4, "author": "willhuang", "tags": ["视频"], "text": "本周BUF大事件又为大家带来了成吨新鲜有趣的安全新闻，某国内广告SDK窃取用户数据，感染App下载量过亿；前NSA雇员斯诺登公布最新泄露文档；继好莱坞艳照门事件后又一起明星私照大量外泄。"}
{"title": "CovertBand：连“啪啪啪”都能识别的身体运动信息测试", "url": "https://www.freebuf.com/articles/terminal/145153.html", "time": "2017-08-26", "level": "", "num_look": 304888, "num_comment": 6, "author": "clouds", "tags": ["终端安全"], "text": "近期，华盛顿大学Paul G. Allen计算机学院通过研究，实现了一种基于声纳并名为CovertBand的测试，通过该测试，可以对特定范围和有隔离屏障内目标人物的位置及身体运动信息进行捕捉。"}
{"title": "FBI逮捕一名中国黑客：称其贩卖恶意软件，入侵美国人事管理办公室", "url": "https://www.freebuf.com/news/145647.html", "time": "2017-08-25", "level": "", "num_look": 433244, "num_comment": 18, "author": "liki", "tags": ["资讯"], "text": "近日，美国FBI逮捕一名中国公民，FBI宣称他参与的黑客组织曾成功入侵美国人事管理办公室（OPM）。"}
{"title": "CIA 对本国情报机构下手？利用ExpressLane工具搜集FBI与NSA等机构的数据", "url": "https://www.freebuf.com/news/145583.html", "time": "2017-08-25", "level": "红色标题", "num_look": 364674, "num_comment": 3, "author": "AngelaY", "tags": ["资讯"], "text": "维基解密上周休息了一周，本周又来搞事了：新一波 “Vault 7” 系列文档泄露，内容是 CIA 秘密监控全球联络情报机构（包括  FBI、DHS 和 NSA 等），并暗中搜集数据。"}
{"title": "Memsniff：一款开源的memcached流量分析工具", "url": "https://www.freebuf.com/sectool/144901.html", "time": "2017-08-25", "level": "", "num_look": 366430, "num_comment": 2, "author": "米雪儿", "tags": ["工具"], "text": "像大多数大型网络公司一样，Box也依赖于使用分布式缓存层来缓存经常访问的数据。"}
{"title": "2017艳照门还在持续：安妮·海瑟薇等女星私照泄露", "url": "https://www.freebuf.com/news/145348.html", "time": "2017-08-25", "level": "红色标题", "num_look": 1976260, "num_comment": 19, "author": "羽裳", "tags": ["周边", "系统安全"], "text": "好莱坞艳照门事件一波未平一波又起，“2017艳照门”中更多明星私照再遭泄露！"}
{"title": "KCon & Freebuf联合策划 | 分享你最爱的摇滚乐 免费送限量T恤！", "url": "https://www.freebuf.com/fevents/145494.html", "time": "2017-08-25", "level": "红色标题", "num_look": 363042, "num_comment": 35, "author": "FB客服", "tags": ["活动"], "text": "当倡导独立自由思考，给人们追求美好生活的激情和力量的摇滚乐遇上天富正义，敢于追求技术上的极限和突破，为互联网使用者带来更安全体验的黑客将会碰撞出怎样的火花？"}
{"title": "利用脚本注入漏洞攻击ReactJS应用程序", "url": "https://www.freebuf.com/articles/web/144988.html", "time": "2017-08-25", "level": "金币+10", "num_look": 417350, "num_comment": 2, "author": "北其Gg", "tags": ["WEB安全"], "text": "ReactJS是一款能够帮助开发者构建用户接口的热门JavaScript库。在它的帮助下，开发者可以构建出内容丰富的客户端或Web应用，并且提前加载内容以提供更好的用户体验。"}
{"title": "青松云安全诚聘人才", "url": "https://www.freebuf.com/jobs/143010.html", "time": "2017-08-25", "level": "", "num_look": 207956, "num_comment": 4, "author": "qssec", "tags": ["安全招聘"], "text": "招聘岗位：销售总监、大客户销售、品牌公关、C语言开发工程师 、白帽子专家、算法工程师。"}
{"title": "2017，FreeTalk在深圳的N种玩法|议题征集ing", "url": "https://www.freebuf.com/fevents/145489.html", "time": "2017-08-25", "level": "红色标题", "num_look": 203736, "num_comment": 10, "author": "FB客服", "tags": ["活动"], "text": "今年Free Talk走过了上海站，北京站 ，现场都是爆满的状态，之前只能看直播的华南地区白帽们一直问我们：什么时候在华南办啊？"}
{"title": "互联网安全现状Q2报告：旧攻击方式重受青睐，DDoS攻击走向商业化", "url": "https://www.freebuf.com/news/145333.html", "time": "2017-08-25", "level": "", "num_look": 246214, "num_comment": 2, "author": "AngelaY", "tags": ["安全报告", "资讯"], "text": "知名内容分发网络（CDN）和云服务提供商 Akamai Technologies 发布了《 2017 Q2 互联网安全现状报告》，报告显示，与 Q1相比，Q2的 DDoS 攻击数目增加了约 28% 。"}
{"title": "特别企划 |  信息安全行业女性从业者调查：一股温柔而日渐增长的力量", "url": "https://www.freebuf.com/special/144565.html", "time": "2017-08-25", "level": "红色标题", "num_look": 349140, "num_comment": 7, "author": "AngelaY", "tags": ["特别企划"], "text": "当今时代，女性异军突起，也逐渐成长为职场中不容忽视的的中坚力量。那么信息安全行业的女性从业情景又是如何呢？"}
{"title": "挖洞经验 | 记一次曲折的Getshell过程", "url": "https://www.freebuf.com/vuls/144643.html", "time": "2017-08-25", "level": "现金奖励", "num_look": 635130, "num_comment": 21, "author": "三只小潴", "tags": ["WEB安全", "漏洞"], "text": "最近在挖某框架的漏洞，其中挖到一枚Getshell，挖的过程有点曲折感觉可以写篇文章总结一下，方便与各位大牛交流交流。"}
{"title": "Buf早餐铺 | 找到微信0day漏洞给你50万美元；徐玉玉案19岁黑客一审被判有期徒刑6年；美国一艘驱逐舰与油轮相撞，疑似网络攻击所致", "url": "https://www.freebuf.com/news/145483.html", "time": "2017-08-25", "level": "", "num_look": 386161, "num_comment": 6, "author": "欧阳洋葱", "tags": ["资讯"], "text": "有没有想过，找到一个微信的0day漏洞就能拿到50万美元？有家公司正在悬赏，但不是腾讯。"}
{"title": "没有准考证号我是如何暴力查询英语六级成绩的", "url": "https://www.freebuf.com/articles/database/145261.html", "time": "2017-08-24", "level": "现金奖励", "num_look": 1167613, "num_comment": 50, "author": "FlashYo", "tags": ["数据安全"], "text": "正常渠道我是不太可能获取到自己的准考证号了。要等到学校下发成绩单，我估计没半个月是见不到成绩了，甚至更久！与其等那么久，不如想想有什么办法。"}
{"title": "PowerSAP：一款强大的PowerShell SAP安全审计工具", "url": "https://www.freebuf.com/sectool/144824.html", "time": "2017-08-24", "level": "", "num_look": 287577, "num_comment": 287577, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫PowerSAP的工具，该工具在今年正是添加到了BlackHat武器库中。这款工具并没有重复造轮子，并且代码现已全部开源。"}
{"title": "让FBI都头痛的iPhone，竟然被500刀的小工具破解了", "url": "https://www.freebuf.com/sectool/145324.html", "time": "2017-08-24", "level": "红色标题", "num_look": 882102, "num_comment": 32, "author": "liki", "tags": ["工具"], "text": "近日，youtube视频主EverythingApplePro发布了关于破解iphone密码的视频，他使用了一个500刀的设备短时间内就破解了三台iphone的密码。"}
{"title": "如何让僵尸网络控制节点快速遁形", "url": "https://www.freebuf.com/articles/network/145002.html", "time": "2017-08-24", "level": "", "num_look": 322065, "num_comment": 6, "author": "放牛娃", "tags": ["网络安全"], "text": "如何让僵尸网络的 C2 快速遁形呢？样本自动化配置解密就是其中的一个思路！"}
{"title": "特别企划 | Adobe Flash“众望所归”地死了", "url": "https://www.freebuf.com/special/144157.html", "time": "2017-08-24", "level": "", "num_look": 312551, "num_comment": 5, "author": "liki", "tags": ["特别企划"], "text": "Flash已经有20年的历史了，人们用它来开发游戏，看视频。随着Adobe的官方声明，饱受争议的Flash逐渐退出了历史舞台，它的一生是否如大众所说的“罪孽深重”呢？"}
{"title": "360加固保关键技术浅析", "url": "https://www.freebuf.com/articles/terminal/145102.html", "time": "2017-08-24", "level": "现金奖励", "num_look": 636704, "num_comment": 17, "author": "androiddongjian", "tags": ["其他", "终端安全"], "text": "各种APK加固方案在技术选择上可能不尽相同，但它们都有一个共同的理论基础——被加密的目标数据足够安全。安全到静态反编译无法提取完整的目标数据。"}
{"title": "远程终端管理工具Xshell被植入后门代码事件分析报告", "url": "https://www.freebuf.com/articles/terminal/144822.html", "time": "2017-08-24", "level": "", "num_look": 477417, "num_comment": 4, "author": "奇安信威胁情报中心", "tags": ["终端安全"], "text": "Xshell特别是Build 1322在国内的使用面很大，敏感信息的泄露及可能的远程控制导致巨大的安全风险，我们强烈建议用户检查自己所使用的Xshell版本。"}
{"title": "BUF 早餐铺 | 时隔几个月后好莱坞又曝艳照门；Mirai僵尸网络开始采用Pay-for-Play模式；AccuWeather iOS版向广告商提供用户位置信息；曾位列500强榜首的安全企业root9B濒临破产", "url": "https://www.freebuf.com/news/145392.html", "time": "2017-08-24", "level": "", "num_look": 281979, "num_comment": 6, "author": "Sphinx", "tags": ["资讯"], "text": "今天的早餐非常清凉，希望能给大家炎热的夏天消消暑~"}
{"title": "排名并非一切：曾位列500强榜首的安全企业root9B濒临破产", "url": "https://www.freebuf.com/news/145344.html", "time": "2017-08-23", "level": "", "num_look": 256349, "num_comment": 3, "author": "Elaine_z", "tags": ["资讯"], "text": "两个月之前还位列网络安全500强榜首，两个月后就“惨烈地”即将下线？难道是是企业突然遭遇重创……还是其实问题是出在排名上？"}
{"title": "漏洞挖掘小白入坑指南", "url": "https://www.freebuf.com/articles/neopoints/144967.html", "time": "2017-08-23", "level": "", "num_look": 925093, "num_comment": 7, "author": "漏洞盒子", "tags": ["观点"], "text": ""}
{"title": "苹果Touch ID的安全”保险箱“再次被攻破，密钥安全该怎么做？", "url": "https://www.freebuf.com/articles/terminal/144921.html", "time": "2017-08-23", "level": "", "num_look": 367913, "num_comment": 5, "author": "梆梆安全", "tags": ["终端安全"], "text": "iPhone 5s的Secure Enclave遭遇黑客入侵，密钥被披露，在新加坡的黑客大会上还有人为iPhone 5s的Secure Enclave固件提供了提取工具。"}
{"title": "国内某广告SDK会从Android手机中窃取用户数据，感染App下载量过亿", "url": "https://www.freebuf.com/news/145296.html", "time": "2017-08-23", "level": "红色标题", "num_look": 331558, "num_comment": 15, "author": "欧阳洋葱", "tags": ["资讯"], "text": "最近安全专家发现，谷歌官方应用商店的合法App所用的广告SDK会秘密窃取用户数据，这款SDK来自国内。"}
{"title": "报告称勒索软件已成为2017年Q2最流行的邮件投递恶意程序", "url": "https://www.freebuf.com/articles/system/145034.html", "time": "2017-08-23", "level": "", "num_look": 351529, "num_comment": 351529, "author": "羽裳", "tags": ["安全报告", "系统安全"], "text": ""}
{"title": "北京中科网航安全技术有限公司招聘", "url": "https://www.freebuf.com/jobs/143103.html", "time": "2017-08-23", "level": "", "num_look": 193983, "num_comment": 3, "author": "lovemyself", "tags": ["安全招聘"], "text": "北京中科网航安全技术有限公司致力于信息安全相关技术的研究开发，在恶意代码分析、协议识别、协议分析、节点审计、等方面有着深厚的技术积累和丰富的项目经验。"}
{"title": "走近科学：如何一步一步解码复杂的恶意软件", "url": "https://www.freebuf.com/articles/system/145105.html", "time": "2017-08-23", "level": "红色标题", "num_look": 331734, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "虽然我们之前已经给大家介绍过数百种后门以及相应的影响，但今天我们想跟大家更加深入地讨论一些关于恶意软件的分析技术，即如何解码复杂的高级恶意软件。"}
{"title": "特别企划 | 冰山下的威胁：网络攻击中的隐写术", "url": "https://www.freebuf.com/special/144520.html", "time": "2017-08-23", "level": "红色标题", "num_look": 517091, "num_comment": 6, "author": "Elaine_z", "tags": ["特别企划"], "text": "古老的隐写术，在如今危机四伏的当今时代，是否应用在恶意软件中。与此相对的，又有怎样的防御检测方式？"}
{"title": "利用WiFi Pineapple Nano渗透客户端获取SHELL", "url": "https://www.freebuf.com/sectool/144862.html", "time": "2017-08-23", "level": "现金奖励", "num_look": 640235, "num_comment": 4, "author": "ghostsnow", "tags": ["工具", "无线安全"], "text": "今天给大家实际场景演示下如何利用Pineapple Nano来攻击客户端并且获取客户端SHELL的过程。"}
{"title": "BUF 早餐铺 | 安全公司 Root9B 因无力履行债权而濒临倒闭，可能被摘牌；美军将实施按键追踪生物识别系统；Google推出Android 8.0版本", "url": "https://www.freebuf.com/news/145233.html", "time": "2017-08-23", "level": "红色标题", "num_look": 513118, "num_comment": 5, "author": "AngelaY", "tags": ["资讯"], "text": "听说又一个以太币平台被黑了；Android 8.0 正式版终于发布了；美国国防部要采用高级的生物识别系统了；AWS S3 上又有数据泄露了……今天的早餐丰盛多样，快来尝尝吧。"}
{"title": "川普正式宣布将网络司令部升格，独立于国家安全局", "url": "https://www.freebuf.com/news/145148.html", "time": "2017-08-22", "level": "", "num_look": 388536, "num_comment": 3, "author": "liki", "tags": ["资讯"], "text": "上周五（8月18号），川普正式宣布将网络司令部提升为联合作战司令部级别。"}
{"title": "七夕活动 | 你的情人节被FreeBuf承包啦~Dalao同款T恤免费送！", "url": "https://www.freebuf.com/fevents/145180.html", "time": "2017-08-22", "level": "红色标题", "num_look": 1035160, "num_comment": 143, "author": "Akane", "tags": ["活动"], "text": "如果你在七夕收到了一盒巧克力，甚至是Dalao同款FreeBuf定制T恤，不用诧异，因为我们就是这么爱你~"}
{"title": "Nmap的高级漏洞扫描模块Vulscan", "url": "https://www.freebuf.com/sectool/144821.html", "time": "2017-08-22", "level": "", "num_look": 945951, "num_comment": 10, "author": "clouds", "tags": ["工具"], "text": ""}
{"title": "无招胜有招： 看我如何通过劫持COM服务器绕过AMSI", "url": "https://www.freebuf.com/articles/system/144041.html", "time": "2017-08-22", "level": "金币+10", "num_look": 349819, "num_comment": 2, "author": "liulang", "tags": ["系统安全"], "text": "在这篇文章中，我们将阐述一种通过劫持COM服务器来绕过AMSI的方法， 并分析Microsoft如何在build＃16232中修复该绕过，然后再讨论如何再次绕过微软对该漏洞的修复。"}
{"title": "Xshell后门事件中用到的DNS Tunneling技术分析", "url": "https://www.freebuf.com/articles/terminal/144404.html", "time": "2017-08-22", "level": "", "num_look": 363909, "num_comment": 3, "author": "腾讯电脑管家", "tags": ["终端安全"], "text": "最近，Xshell远程终端工具发现被加入了恶意代码，其中被称为DNS Tunneling的作恶手法引起了安全分析人员的注意。"}
{"title": "苏州冠辰招募渗透测试工程师", "url": "https://www.freebuf.com/jobs/142771.html", "time": "2017-08-22", "level": "", "num_look": 293867, "num_comment": 9, "author": "gogogo", "tags": ["安全招聘"], "text": "苏州冠辰计算机信息技术有限公司系苏州柯利达集团控股子公司，主要从事信息安全产品研发、渗透测试、风险评估、信息安全集成、系统集成、智慧城市、大数据平台建设等业务。"}
{"title": "还敢修手机吗？换个屏幕的功夫，手机就可能被劫持", "url": "https://www.freebuf.com/articles/terminal/144923.html", "time": "2017-08-22", "level": "", "num_look": 391758, "num_comment": 6, "author": "Sphinx", "tags": ["终端安全"], "text": "最近结束的USENIX W00T '17安全会议上，来自一所以色列大学的专家们展示了他们的新研究，他们可以通过替换部件来对智能手机或者其他智能设备进行攻击。"}
{"title": "特别企划 | 那些年你“听不懂”的安全名词", "url": "https://www.freebuf.com/special/141237.html", "time": "2017-08-22", "level": "红色标题", "num_look": 617488, "num_comment": 2, "author": "AngelaY", "tags": ["特别企划"], "text": "近几年，各种攻击层出不穷，名字也千奇百怪。本文中，笔者就来说说几个比较好玩的安全名词。也许不够全面，欢迎补充。"}
{"title": "BlackHat后续：可绕过杀软的免杀工具AVPASS？随我一探究竟", "url": "https://www.freebuf.com/articles/terminal/144769.html", "time": "2017-08-22", "level": "", "num_look": 467218, "num_comment": 5, "author": "360安全", "tags": ["终端安全"], "text": "在今年的全球黑客大会BlackHat USA 2017上，有黑客发布了一个名为AVPASS、用来帮助病毒绕过Android杀软检测的免杀工具。"}
{"title": "Buf早餐铺 | 微软本月修复了“类WannaCry”漏洞；ProtonMail 反黑钓鱼攻击者；黑客威胁还要泄漏《权利的游戏》S7E7", "url": "https://www.freebuf.com/news/144915.html", "time": "2017-08-22", "level": "", "num_look": 455454, "num_comment": 1, "author": "Elaine_z", "tags": ["资讯"], "text": "今日的早餐新闻的主角包括，最新斯诺登文档；发出预警的乌克兰央行；被黑客剧透到底的《权力的游戏》；被黑的索尼PSN；反黑钓鱼攻击者的Proton等等。"}
{"title": "斯诺登最新泄露文档：揭秘美国部署在澳洲的秘密监控设施“Rainfall”", "url": "https://www.freebuf.com/news/145006.html", "time": "2017-08-21", "level": "红色标题", "num_look": 385029, "num_comment": 2, "author": "Elaine_z", "tags": ["资讯"], "text": "前 NSA 雇员斯诺登最新泄露的文档，曝光了美国某个位于澳洲北部领地的边远小镇旁的机密设施。这个秘密基地通过监控无线通讯，协助美军展开任务执行。"}
{"title": "挖洞经验 | 利用XSS和CSRF漏洞远程实现PayPal合作方网站未授权账户访问", "url": "https://www.freebuf.com/vuls/144893.html", "time": "2017-08-21", "level": "", "num_look": 572877, "num_comment": 10, "author": "clouds", "tags": ["漏洞"], "text": "继上次发现PayPal远程代码执行漏洞之后，我又通过CSRF和XSS方式发现了PayPal合作方网站的未授权账户访问漏洞，利用该漏洞可以远程窃取用户账户Cookie信息，实现账户劫持。"}
{"title": "Defcon 23最新开源工具NetRipper代码分析与利用", "url": "https://www.freebuf.com/articles/web/144709.html", "time": "2017-08-21", "level": "", "num_look": 429582, "num_comment": 4, "author": "任子行", "tags": ["WEB安全"], "text": "在分析了俄罗斯人被曝光的几个银行木马的源码后，发现其大多均存在通过劫持浏览器数据包来获取用户个人信息的模块。"}
{"title": "如何写好一篇漏洞报告（国外篇）", "url": "https://www.freebuf.com/articles/es/142957.html", "time": "2017-08-21", "level": "红色标题", "num_look": 610066, "num_comment": 4, "author": "漏洞盒子", "tags": ["企业安全"], "text": "如何写好一篇漏洞总结报告，这一直都是一些应用开发公司经常忽略的重要事情，一篇好的漏洞总结报告可以有效帮助开发人员，减少寻找和解决漏洞的时间。"}
{"title": "研究人员演示：用USB设备能够秘密窃取临近USB接口的数据", "url": "https://www.freebuf.com/news/144149.html", "time": "2017-08-21", "level": "", "num_look": 237498, "num_comment": 237498, "author": "liki", "tags": ["终端安全", "资讯"], "text": "近日， 来自澳大利亚阿德莱德大学的研究人员演示了通过USB小工具来监控旁边插入的USB设备的数据流动。"}
{"title": "同盾科技诚招各位移动安全大牛加入", "url": "https://www.freebuf.com/jobs/142968.html", "time": "2017-08-21", "level": "", "num_look": 268798, "num_comment": 4, "author": "seudingo", "tags": ["安全招聘"], "text": "同盾科技成立于2013年，总部位于浙江杭州，是国内专业的第三方大数据智能风控服务提供商。"}
{"title": "浅谈非PE的攻击技巧", "url": "https://www.freebuf.com/articles/terminal/144662.html", "time": "2017-08-21", "level": "红色标题", "num_look": 360830, "num_comment": 7, "author": "安全豹", "tags": ["终端安全"], "text": "近日，金山毒霸安全中心捕获到一例利用邮件传播的非PE样本，类型为lnk快捷方式文件，执行后会下载勒索病毒。"}
{"title": "初探无线安全审计设备WiFi Pineapple Nano系列之PineAP", "url": "https://www.freebuf.com/sectool/144438.html", "time": "2017-08-21", "level": "现金奖励", "num_look": 789290, "num_comment": 2, "author": "ghostsnow", "tags": ["工具", "无线安全"], "text": "今天给大家介绍下Pineapple Nano的一个主要功能模块PineAP和其他几个涉及配合PineAP工作的几个模块的使用方法。"}
{"title": "远控木马上演白利用偷天神技：揭秘假破解工具背后的盗刷暗流", "url": "https://www.freebuf.com/articles/terminal/144590.html", "time": "2017-08-21", "level": "红色标题", "num_look": 371361, "num_comment": 6, "author": "360安全", "tags": ["终端安全"], "text": "如今，不少人为了省钱，会尝试各种免费的方法获取网盘或视频播放器的会员权限，网上也流传着不少“网盘不限速神器”或者“播放器VIP破解工具”。"}
{"title": "Buf早餐铺 | 汽车CAN协议曝严重漏洞；《权力的游戏》社交网络帐号被黑；威胁情报没意思，Flashpoint启动情报学院", "url": "https://www.freebuf.com/news/144808.html", "time": "2017-08-21", "level": "红色标题", "num_look": 291258, "num_comment": 291258, "author": "欧阳洋葱", "tags": ["资讯"], "text": "威胁情报是个好东西，不过Flashpoint认为威胁情报其实只关注了网络安全的IoC，但对企业来说，业务安全是全方位的问题，所以来看看BRI情报吧。"}
{"title": "观点 | 量子卫星很近，但“无法破解”的网络可能还很远", "url": "https://www.freebuf.com/news/144814.html", "time": "2017-08-20", "level": "", "num_look": 300586, "num_comment": 4, "author": "Covfefe", "tags": ["观点", "资讯"], "text": "新闻网站总是很喜欢提到“量子”这个词的科技新闻，看起来如果能再加一点空间旅行的话就更加完美了。"}
{"title": "CVE-2017-3085：Adobe Flash泄漏Windows用户凭证", "url": "https://www.freebuf.com/articles/system/144262.html", "time": "2017-08-20", "level": "", "num_look": 330295, "num_comment": 4, "author": "鸢尾", "tags": ["系统安全"], "text": "本文所述漏洞已向Adobe报告(APSB17-23)，分配的CVE为CVE-2017-3085。"}
{"title": "Xshellghost技术分析 - 入侵感染供应链软件的大规模定向攻击", "url": "https://www.freebuf.com/articles/terminal/144842.html", "time": "2017-08-20", "level": "红色标题", "num_look": 300527, "num_comment": 5, "author": "360安全", "tags": ["终端安全"], "text": "NetSarang旗下多款软件的关键模块被植入了高级后门，这是一起入侵感染供应链软件的大规模攻击事件，我们将其命名为“XshellGhost”（xshell幽灵）。"}
{"title": "骇极安全团队诚招渗透测试工程师、安全销售经理", "url": "https://www.freebuf.com/jobs/142120.html", "time": "2017-08-20", "level": "", "num_look": 263222, "num_comment": 16, "author": "cagetest", "tags": ["安全招聘"], "text": "骇极安全是一支提供网络安全监测服务的团队,从90年代开始从事渗透测试，对国内的互联网安全环境和习惯有深入的经验"}
{"title": "如何确定恶意软件是否在自己的电脑中执行过？", "url": "https://www.freebuf.com/articles/system/144750.html", "time": "2017-08-20", "level": "", "num_look": 467520, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "很不幸，你在自己的电脑里发现了一个恶意的可执行程序！那么问题来了：这个文件到底有没有执行过?"}
{"title": "挖洞经验 | 记一次针对Twitter（Periscope）API 的有趣挖洞经历", "url": "https://www.freebuf.com/vuls/144641.html", "time": "2017-08-20", "level": "", "num_look": 371944, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["漏洞"], "text": "近期，我在Twitter的Periscope服务中发现了一个漏洞。这是一个CSRF（跨站请求伪造）漏洞。"}
{"title": "如何控制一辆福特Fusion概念车", "url": "https://www.freebuf.com/articles/terminal/143197.html", "time": "2017-08-19", "level": "", "num_look": 360214, "num_comment": 3, "author": "饭团君", "tags": ["终端安全"], "text": "对于Voyage来说，他们将不可避免地给乘客提供汽车关键功能的控制权，因为总有一天开车的将不再是我们人类，而这一天马上就要到来了。"}
{"title": "网易（杭州）诚招移动端安全人才", "url": "https://www.freebuf.com/jobs/144434.html", "time": "2017-08-19", "level": "", "num_look": 428297, "num_comment": 3, "author": "neteasehr", "tags": ["安全招聘"], "text": "网易安全部门负责网易公司游戏、电商、金融、音乐、社交等各类应用的安全工作，在这里您可以了解最新的安全保护趋势和最全的安全护城河。"}
{"title": "《网络安全法》执法案例汇总", "url": "https://www.freebuf.com/news/144815.html", "time": "2017-08-19", "level": "", "num_look": 874010, "num_comment": 5, "author": "Akane", "tags": ["资讯"], "text": "自《网络安全法》生效以来，与其相关的执法行为逐渐走向常态。本文收集了2017年6月1日至8月18日间各地落实《网络安全法》相关规定的执法案例如下。"}
{"title": "【FB TV】一周「BUF大事件」：2017CSS中国互联网安全领袖峰会在京举行；HBO数据泄漏事件嫌疑人被捕；暴雪娱乐旗下游戏遭遇DDoS攻击", "url": "https://www.freebuf.com/video/144771.html", "time": "2017-08-19", "level": "红色标题", "num_look": 411287, "num_comment": 411287, "author": "willhuang", "tags": ["视频"], "text": "2017CSS中国互联网安全领袖峰会在京举行，大牛云集、盛况空前；维基解密曝出CIA一款远程实时视频监控工具；HBO数据泄漏事件嫌疑人被捕；暴雪娱乐旗下游戏遭遇DDoS攻击。"}
{"title": "特别企划 | 国内外顶级漏洞赏金计划", "url": "https://www.freebuf.com/news/144135.html", "time": "2017-08-19", "level": "红色标题", "num_look": 513235, "num_comment": 1, "author": "secist", "tags": ["企业安全", "特别企划"], "text": "我们看到在过去的两年间，越来越多的组织开始加入到了这个行列（例如航空，汽车和金融公司）。"}
{"title": "“移花接木”偷换广告：HTTPS劫匪木马每天打劫200万次网络访问", "url": "https://www.freebuf.com/articles/system/144490.html", "time": "2017-08-19", "level": "红色标题", "num_look": 372852, "num_comment": 15, "author": "360安全", "tags": ["系统安全"], "text": "近年来，国内各大网站逐渐升级为HTTPS加密连接，以防止网站内容被篡改、用户数据被监听。但是一向被认为“安全可靠”的HTTPS加密传输，其实也可以被木马轻易劫持。"}
{"title": "FakeNet-NG：新一代的动态网络分析工具", "url": "https://www.freebuf.com/sectool/144247.html", "time": "2017-08-18", "level": "", "num_look": 374681, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["工具"], "text": "FakeNet-NG是一款专为恶意软件分析人员以及渗透测试专家设计的下一代动态网络分析工具，并且支持最新版本的Windows以及Linux平台。"}
{"title": "黑匣子开启：iOS Secure Enclave 固件解密密钥首度“被”公开", "url": "https://www.freebuf.com/news/144670.html", "time": "2017-08-18", "level": "", "num_look": 363503, "num_comment": 1, "author": "Elaine_z", "tags": ["系统安全", "资讯"], "text": "苹果系统向来在安全性上以封闭著称，时至今日，关于 Secure Enclave的公开信息也为之甚少，也许此次的密钥公开是一窥究竟的契机？"}
{"title": "智能卡破解入门二三事", "url": "https://www.freebuf.com/geek/143800.html", "time": "2017-08-18", "level": "红色标题", "num_look": 743714, "num_comment": 12, "author": "饭团君", "tags": ["极客"], "text": "随着智能设备NFC功能的普及，用RFID卡支付现金的模式也越加流行。当我研究HID iClass系统时，我就入手了一个proxmark3。"}
{"title": "网易招聘Windows安全开发工程师", "url": "https://www.freebuf.com/jobs/142717.html", "time": "2017-08-18", "level": "", "num_look": 215876, "num_comment": 17, "author": "网易易盾加固", "tags": ["安全招聘"], "text": "网易安全部门负责网易公司游戏、电商、金融、音乐、社交等各类应用的安全工作，在这里您可以了解最新的安全保护趋势和最全的安全护城河。"}
{"title": "BoopSuite：基于Python编写的无线安全审计套件", "url": "https://www.freebuf.com/sectool/143929.html", "time": "2017-08-18", "level": "红色标题", "num_look": 443484, "num_comment": 8, "author": "secist", "tags": ["工具", "无线安全"], "text": "BoopSuite是一款即将推出的基于python编写的无线安全审计套件。它易于使用功能强大，同时支持2GHz和5GHz频谱，握手包嗅探器（CLI和GUI）"}
{"title": "自动化沙箱打造之“关于XShell我有话说”", "url": "https://www.freebuf.com/geek/144459.html", "time": "2017-08-18", "level": "金币+18", "num_look": 449855, "num_comment": 11, "author": "刀郎", "tags": ["极客"], "text": "最近XShell很是火了一把，每个安全厂商都在发通告，都在分析，反正就是百花齐放，在这里我想做一个总结。"}
{"title": "对一系列邮件攻击的分析与Necurs僵尸网络溯源", "url": "https://www.freebuf.com/articles/terminal/144291.html", "time": "2017-08-18", "level": "金币+18", "num_look": 412448, "num_comment": 4, "author": "腾讯电脑管家", "tags": ["终端安全", "网络安全"], "text": "近日腾讯安全反病毒实验室捕获了一系列通过邮件进行传播的攻击。这次攻击分为三个主要阶段和其后不断地变种攻击，都是借助钓鱼邮件的形式进行传播的。"}
{"title": "Buf早餐铺 | 《权力的游戏》又又又泄露，但这次与黑客无关；卡巴斯基和俄罗斯情报部门勾结？印度政府妄称中国手机窃取信息", "url": "https://www.freebuf.com/news/144601.html", "time": "2017-08-18", "level": "红色标题", "num_look": 368481, "num_comment": 5, "author": "欧阳洋葱", "tags": ["资讯"], "text": "HBO真的太渴望上头条了，所以《泄露的游戏》还在持续中，而这次和黑客都没什么关系。"}
{"title": "这位俄罗斯赌场黑客通过破解老虎机赚了几百万美元（下集）", "url": "https://www.freebuf.com/news/144102.html", "time": "2017-08-17", "level": "红色标题", "num_look": 587327, "num_comment": 13, "author": "Alpha_h4ck", "tags": ["极客", "资讯"], "text": "还记得之前那个专门对赌场老虎机下手的圣彼得堡公司吗？今天让我们来认识一下该公司背后的其中一名管理层-Alex，看看他跟老虎机之间有着怎样的羁绊。"}
{"title": "利用Hackrf进行GPS劫持实验流程攻略", "url": "https://www.freebuf.com/articles/terminal/144296.html", "time": "2017-08-17", "level": "", "num_look": 465277, "num_comment": 7, "author": "网络安全通", "tags": ["终端安全"], "text": "上篇文章我们预告了本次主题是GPS劫持。GPS工作原理就是GPS接收器接收GPS信号并计算出自己所在的经纬度，接下来是劫持过程。"}
{"title": "CovertUtils：一个用于设计和创建后门的Python模块", "url": "https://www.freebuf.com/sectool/143810.html", "time": "2017-08-17", "level": "", "num_look": 349882, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "GitHub上眼花缭乱的后门项目也是令我印象非常深刻的。但是每一个项目似乎都有其自身的短板和优点."}
{"title": "给渗透测试人员的优秀GitHub项目学习资源汇总", "url": "https://www.freebuf.com/sectool/143793.html", "time": "2017-08-17", "level": "红色标题", "num_look": 978705, "num_comment": 22, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家带来的是一套优秀的GitHub项目学习资源（Awesome Hacking），无论你是小白还是渗透测试人员，无论你是白帽子亦或是黑帽黑客，你都可以从中学到很多新的东西。"}
{"title": "深圳道然天下科技公司安全项目招聘渗透工程师", "url": "https://www.freebuf.com/jobs/142720.html", "time": "2017-08-17", "level": "", "num_look": 194403, "num_comment": 14, "author": "fengzhilei", "tags": ["安全招聘"], "text": "深圳道然天下科技有限公司是一家专门从事互联网应用及网络信息安全产品研发的高新技术企业，在网络信息安全领域推出了一系列具有国内外先进水平的产品"}
{"title": "浅谈简易端口扫描威胁感知系统的设计与实现", "url": "https://www.freebuf.com/articles/network/144288.html", "time": "2017-08-17", "level": "现金奖励", "num_look": 685351, "num_comment": 14, "author": "陆仁甲", "tags": ["企业安全", "网络安全"], "text": "在总结了大量的APT攻击方法和思路之后，结合自己分析和思考，针对当前企业面临的大量黑客攻击，而无法得到有效的预警信息，设计了这个简易版本的蜜罐程序。"}
{"title": "初探无线安全审计设备WiFi Pineapple Nano系列之SSLsplit与Ettercap", "url": "https://www.freebuf.com/sectool/144184.html", "time": "2017-08-17", "level": "现金奖励", "num_look": 676678, "num_comment": 21, "author": "ghostsnow", "tags": ["工具", "无线安全"], "text": "The WiFi Pineapple 是由国外无线安全审计公司Hak5开发并售卖的一款无线安全测试神器（俗称大菠萝），从2008年起目前已经发布到第六代产品。"}
{"title": "挖洞经验 | 价值1万美金的谷歌内部主机信息泄露漏洞", "url": "https://www.freebuf.com/vuls/143959.html", "time": "2017-08-17", "level": "", "num_look": 581652, "num_comment": 11, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "文章讲述了乌拉圭17岁高中生Ezequiel Pereira发现谷歌内部主机信息泄露漏洞的过程，该漏洞获得了谷歌方面10000美金赏金，Ezequiel Pereira本人也因此进入Google漏洞名人堂。"}
{"title": "Buf早餐铺|《守望先锋》及《魔兽世界》遭DDoS攻击；又有7款Chrome扩展程序开发者凭证被窃；Airbnb合作LockState智能门锁出问题", "url": "https://www.freebuf.com/news/144378.html", "time": "2017-08-17", "level": "红色标题", "num_look": 381111, "num_comment": 4, "author": "Elaine_z", "tags": ["资讯"], "text": "眼看着一周即将走入周末，但今日的早餐中还是包含不少有趣的新闻"}
{"title": "马斯克的人工智能才会让人类毁灭？那AI还是安全行业的未来吗？", "url": "https://www.freebuf.com/news/144470.html", "time": "2017-08-17", "level": "红色标题", "num_look": 1543044, "num_comment": 10, "author": "欧阳洋葱", "tags": ["资讯"], "text": "你我眼中的人工智能，似乎都在为安全行业的进步找到攻防对称的平衡之道，但这一路可能并没有你想象的那么顺畅。"}
{"title": "深夜快讯：FreeBuf小编真实身份遭泄露", "url": "https://www.freebuf.com/fevents/144458.html", "time": "2017-08-16", "level": "", "num_look": 381701, "num_comment": 37, "author": "Sphinx", "tags": ["活动"], "text": "FreeBuf小编真实身份遭泄露 ，内含绝密对话！"}
{"title": "XShell后门DNS Tunnel编码分析", "url": "https://www.freebuf.com/articles/terminal/144292.html", "time": "2017-08-16", "level": "金币+16", "num_look": 270801, "num_comment": 3, "author": "奇安信威胁情报中心", "tags": ["终端安全"], "text": "XShellGhost 通过 DNS Tunnel 把打点的数据传上去，分析了下编码算法，对数据进行了解密。"}
{"title": "iOS macOS的后渗透利用工具：EggShell", "url": "https://www.freebuf.com/sectool/143846.html", "time": "2017-08-16", "level": "红色标题", "num_look": 381154, "num_comment": 6, "author": "secist", "tags": ["工具"], "text": "EggShell是一款基于Python编写的iOS和macOS的后渗透利用工具。它有点类似于metasploit，我们可以用它来创建payload建立侦听。"}
{"title": "WSH注入技巧分享", "url": "https://www.freebuf.com/articles/system/143957.html", "time": "2017-08-16", "level": "", "num_look": 313507, "num_comment": 313507, "author": "鸢尾", "tags": ["系统安全"], "text": "今天我们就来详细讲讲攻击者通过控制输入，将数据传递给调用的GetObject()函数的技术。"}
{"title": "Xshell软件后门技术分析", "url": "https://www.freebuf.com/articles/terminal/144367.html", "time": "2017-08-16", "level": "", "num_look": 410602, "num_comment": 8, "author": "腾讯电脑管家", "tags": ["终端安全"], "text": "腾讯安全反病毒实验室对XShell远程终端工具中被植入恶意代码一事深入跟进，对此次带有后门的XShell工具进行了分析。"}
{"title": "没想到你是这样的Linux | 终端下有趣的命令合集", "url": "https://www.freebuf.com/news/144050.html", "time": "2017-08-16", "level": "金币+16", "num_look": 679614, "num_comment": 12, "author": "国光", "tags": [], "text": "刚开始接触Linux的我们，肯定认为Linux系统就是那种枯燥的终端界面。然而实际上Linux下的终端还是有很多种有趣的玩法~~"}
{"title": "亚信安全招聘高级安全工程师", "url": "https://www.freebuf.com/jobs/142560.html", "time": "2017-08-16", "level": "", "num_look": 362514, "num_comment": 23, "author": "Cunlin", "tags": ["安全招聘"], "text": "亚信安全于2015年由亚信科技对全球最大的独立网络安全软件提供商趋势科技中国区业务进行收购重组，专注于产业互联网安全服务领域."}
{"title": "PhEmail：基于Python的开源网络钓鱼测试工具", "url": "https://www.freebuf.com/sectool/143794.html", "time": "2017-08-16", "level": "", "num_look": 519697, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["工具", "网络安全"], "text": "PhEmail是一款采用Python编程语言开发的开源网络钓鱼邮件工具，它可以帮助研究人员在进行社会工程学测试的过程中自动化地给目标发送网络钓鱼邮件。"}
{"title": "揭秘比木马挖矿还要“暴利”的网络偷窃行为", "url": "https://www.freebuf.com/articles/network/144053.html", "time": "2017-08-16", "level": "现金奖励", "num_look": 659453, "num_comment": 9, "author": "7763sea", "tags": ["网络安全"], "text": "以一种合理合法的方式运行的他人电脑上，并且不告诉用户，光天化日之下夺走别人到劳动果实才是最大杀器。"}
{"title": "Buf早餐铺 | 《权力的游戏》泄露者被捕；Mozilla将停止Firefox旧版插件功能；朝鲜APT组织Lazarus攻击美国防部承包商", "url": "https://www.freebuf.com/news/144290.html", "time": "2017-08-16", "level": "", "num_look": 284798, "num_comment": 3, "author": "AngelaY", "tags": ["资讯"], "text": "一场秋雨一场寒。最近阴雨不断，天气转凉。今天的早餐比昨天更丰盛，各位 Buffer 多吃一些，养好身体哦~"}
{"title": "2050年的世界会变得怎样？第三届中国互联网安全领袖峰会CSS的遥望", "url": "https://www.freebuf.com/fevents/144304.html", "time": "2017-08-16", "level": "红色标题", "num_look": 458780, "num_comment": 6, "author": "欧阳洋葱", "tags": ["活动"], "text": "像人工智能这样的技术真的能帮助安全行业的发展吗？随着技术的发展，未来50年的世界是否将一片黑暗？"}
{"title": "中国网信办与教育部联手：预期十年打造4-6所国际知名网络安全学院", "url": "https://www.freebuf.com/news/144259.html", "time": "2017-08-15", "level": "", "num_look": 276774, "num_comment": 17, "author": "AngelaY", "tags": ["资讯"], "text": "2017 年 8 月 8 日，中国网信办和教育部面向国内各大高校，联合发布了 “关于印发《一流网络安全学院建设示范项目管理办法》的通知” 。"}
{"title": "如何确认Google用户的具体电子邮件地址（已提交Google漏洞奖励计划）", "url": "https://www.freebuf.com/vuls/143848.html", "time": "2017-08-15", "level": "", "num_look": 1270191, "num_comment": 8, "author": "Alpha_h4ck", "tags": ["WEB安全", "漏洞"], "text": "近期我向Google报告了一个安全问题，这个漏洞将允许攻击者确认某Web页面的访问者是否登录了任意一个Google服务的账号（包括GSuite账号在内）。"}
{"title": "CNNVD 关于美国 Netsarang 公司多款软件存在恶意代码情况的通报", "url": "https://www.freebuf.com/articles/others-articles/144242.html", "time": "2017-08-15", "level": "", "num_look": 296529, "num_comment": 296529, "author": "CNNVD", "tags": ["其他"], "text": "美国 Netsarang 公司的 Xshell、Xmanager 等远程连接产品使用的 nssock2.dll 模块中存在恶意代码，可导致用户服务器账号、密码等信息上传至特定服务器。"}
{"title": "手机没Root？你照样可以渗透路由器", "url": "https://www.freebuf.com/sectool/144177.html", "time": "2017-08-15", "level": "金币+18", "num_look": 1034504, "num_comment": 23, "author": "Covfefe", "tags": ["工具", "无线安全"], "text": "RouterSploit是一个强大的漏洞利用框架，用于快速识别和利用路由器中的普通漏洞，它还有个亮点，就是可以在绝大多数安卓设备上运行。"}
{"title": "系统安全攻防战：DLL注入技术详解", "url": "https://www.freebuf.com/articles/system/143640.html", "time": "2017-08-15", "level": "金币+18", "num_look": 471074, "num_comment": 7, "author": "liulang", "tags": ["系统安全"], "text": "攻击者使用DLL注入的过程中如果被赋予过多的运行特权，那么攻击者就很有可能会在DLL文件中嵌入自己的恶意攻击代码以获取更高的执行权限。"}
{"title": "XShell官方软件被植入后门溯源分析", "url": "https://www.freebuf.com/articles/terminal/144254.html", "time": "2017-08-15", "level": "", "num_look": 548165, "num_comment": 4, "author": "Threatbook", "tags": ["终端安全"], "text": "notped.com和dnsgogle.com均存在多个与此次事件类似的超长子域名，据此判断攻击者为同一团伙的可能性较大，活动时间或可追溯至 2014年。"}
{"title": "Office CVE-2017-8570远程代码执行漏洞复现", "url": "https://www.freebuf.com/vuls/144054.html", "time": "2017-08-15", "level": "金币+18", "num_look": 1056826, "num_comment": 13, "author": "国光", "tags": ["漏洞", "系统安全"], "text": "微软在例行的月度补丁中修复了多个Microsoft Office漏洞，其中的CVE-2017-8570漏洞为一个逻辑漏洞，利用方法简单。网上已经出现该漏洞的利用代码，影响范围较广。"}
{"title": "凡普金科招聘高级安全工程师", "url": "https://www.freebuf.com/jobs/139974.html", "time": "2017-08-15", "level": "", "num_look": 176073, "num_comment": 8, "author": "金融科技", "tags": ["安全招聘"], "text": "凡普互金有限公司（其品牌名为“凡普金科”）是一家金融科技公司，专注于大数据处理和金融科技研发，为普通人提供更高效的智能金融服务和解决方案"}
{"title": "【已结束】2017 CSS中国互联网安全领袖峰会图文直播", "url": "https://www.freebuf.com/fevents/144033.html", "time": "2017-08-15", "level": "红色标题", "num_look": 469955, "num_comment": 5, "author": "Akane", "tags": ["活动"], "text": "13家安全上市公司领袖首聚，开启网络安全战略规划新时代。"}
{"title": "Brida：使用Frida进行移动应用渗透测试", "url": "https://www.freebuf.com/sectool/143360.html", "time": "2017-08-15", "level": "", "num_look": 497119, "num_comment": 7, "author": "鸢尾", "tags": ["WEB安全", "工具"], "text": "Brida是一款 Burp Suite 扩展，作为一座桥梁连接着Burp Suite以及Frida，以帮助用户修改应用程序与后端服务器之间的通信数据为己任。"}
{"title": "安天移动安全联合猎豹移动首次揭露“Operation Manul”疑似在Android端的间谍软件行为", "url": "https://www.freebuf.com/articles/terminal/144061.html", "time": "2017-08-15", "level": "", "num_look": 210247, "num_comment": 210247, "author": "AVLTeam", "tags": ["终端安全"], "text": "去年8月份，美国黑帽大会曾公开发表了一篇报告，揭露了名为“Operation Manul”的组织针对该国相关人士进行的大面积网络攻击和窃听行为，并分析了其在PC端使用的窃听技术及域名。"}
{"title": "史上反侦察力最强木马“隐魂”：撑起色情播放器百万推广陷阱", "url": "https://www.freebuf.com/articles/web/143912.html", "time": "2017-08-15", "level": "红色标题", "num_look": 482307, "num_comment": 9, "author": "360安全", "tags": ["WEB安全"], "text": "近期，360安全中心紧急预警了一款感染MBR（磁盘主引导记录）的“隐魂”木马，该木马捆绑在大量色情播放器的安装包中诱导网民下载。"}
{"title": "Buf早餐铺 | HBO更多电视剧被泄露，这次没有《权力的游戏》；Xshell系列软件官方版本被植入后门；APT28组织用NSA工具监听酒店", "url": "https://www.freebuf.com/news/144186.html", "time": "2017-08-15", "level": "", "num_look": 287646, "num_comment": 287646, "author": "Sphinx", "tags": ["资讯"], "text": "今天的早餐非常丰盛，送给早起上班的你~"}
{"title": "BeRoot：一款功能强大的Windows权限提升工具", "url": "https://www.freebuf.com/sectool/144211.html", "time": "2017-08-14", "level": "", "num_look": 294250, "num_comment": 294250, "author": "Alpha_h4ck", "tags": ["工具", "系统安全"], "text": "BeRoot是一款后渗透工具，它可以帮助测试人员检查常见的Windows错误配置，并从中寻找到能够实现权限提升的方法。"}
{"title": "2017全球威胁情报中心（GTIC）Q2威胁情报报告", "url": "https://www.freebuf.com/articles/security-management/144116.html", "time": "2017-08-14", "level": "金币+15", "num_look": 820899, "num_comment": 1, "author": "米雪儿", "tags": ["安全报告", "安全管理"], "text": "GTIC Q2威胁情报报告介绍了NTT Security研究人员、安全专家以及分析师在过去三个月的研究成果。"}
{"title": "流行远程终端管理工具Xshell被植入后门代码，可能导致敏感信息泄露", "url": "https://www.freebuf.com/vuls/144136.html", "time": "2017-08-14", "level": "红色标题", "num_look": 512941, "num_comment": 8, "author": "奇安信威胁情报中心", "tags": ["漏洞"], "text": "使用了木马化Xshell的用户极可能导致本机或相关所管理远程系统的敏感信息泄露。"}
{"title": "如何使用Airgeddon找回WiFi密码", "url": "https://www.freebuf.com/articles/wireless/143796.html", "time": "2017-08-14", "level": "金币+15", "num_look": 631788, "num_comment": 26, "author": "hardwork", "tags": ["无线安全"], "text": "找回WiFi密码的工具很多，但是arigeddon却很少有人介绍，原理虽然和aircrack-ng类似，但是着实比它强大多了，而且跟新后功能更加强大，使用也方便。"}
{"title": "使用Burp和自定义Sqlmap Tamper利用二次注入漏洞", "url": "https://www.freebuf.com/articles/web/142963.html", "time": "2017-08-14", "level": "", "num_look": 428803, "num_comment": 5, "author": "secist", "tags": ["WEB安全"], "text": "在本文中我将向大家展示，我们最近一个有趣的渗透测试项目的SQLi漏洞。"}
{"title": "Xshell系列软件被植入后门，请尽快更新到最新版本", "url": "https://www.freebuf.com/news/144124.html", "time": "2017-08-14", "level": "红色标题", "num_look": 891143, "num_comment": 21, "author": "Sphinx", "tags": ["资讯"], "text": "Xshell开发公司NetSarang发布公告称，在2017年8月4日与卡巴斯基工程师发现Xshell软件中存在后门。"}
{"title": "美国空军“Hack the Air Force”漏洞奖励项目结束，发放超13万美元奖金", "url": "https://www.freebuf.com/news/144108.html", "time": "2017-08-14", "level": "", "num_look": 157688, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "截至 6 月 23 日，美国国防部“入侵空军”项目结束，共有 272 名白帽黑客参与了这个项目，共提交漏洞 207 个，拿到超过 13 万美元的漏洞奖金。"}
{"title": "新浪安全诚聘高级安全工程师", "url": "https://www.freebuf.com/jobs/141430.html", "time": "2017-08-14", "level": "", "num_look": 187214, "num_comment": 7, "author": "-吗_啡-", "tags": ["安全招聘"], "text": "新浪通过门户网站新浪网(SINA.com)、移动门户手机新浪网(SINA.cn)和社交网络服务及微博客服务新浪微博(Weibo.com)组成数字媒体网络，服务用户。"}
{"title": "这位俄罗斯赌场黑客通过破解老虎机赚了几百万美元（上集）", "url": "https://www.freebuf.com/news/144057.html", "time": "2017-08-14", "level": "金币+15", "num_look": 429711, "num_comment": 9, "author": "Alpha_h4ck", "tags": ["终端安全", "资讯"], "text": "还记得之前那个专门对赌场老虎机下手的圣彼得堡公司吗？今天让我们来认识一下该公司背后的管理层-Alex，看看他跟老虎机之间有着怎样的羁绊。"}
{"title": "多平台密码绕过及提权工具Kon-Boot的使用与防范", "url": "https://www.freebuf.com/sectool/143988.html", "time": "2017-08-14", "level": "红色标题", "num_look": 695954, "num_comment": 15, "author": "Covfefe", "tags": ["工具"], "text": "为你的电脑增设一条防线的最常用，最简单的方法就是用密码将你的电脑保护起来，但是现如今这道防线已经不是那么牢不可破了。"}
{"title": "如何更改手机定位位置？劫持WiFi定位实验", "url": "https://www.freebuf.com/articles/wireless/143292.html", "time": "2017-08-14", "level": "金币+15", "num_look": 955073, "num_comment": 11, "author": "网络安全通", "tags": ["无线安全"], "text": "最近看到周围有小伙伴在研究GPS定位，打算伪造GPS信号更改手机定位位置。但是手机定位可不仅仅是通过GPS，还有Wi-Fi和基站定位。"}
{"title": "假勒索真愤青：永久摧毁文件的israbye病毒分析", "url": "https://www.freebuf.com/articles/database/143958.html", "time": "2017-08-14", "level": "", "num_look": 405156, "num_comment": 10, "author": "360安全", "tags": ["数据安全"], "text": "近期，360安全中心发现国内流入一款名为israbye的“伪勒索病毒”。与普通勒索病毒完全不同的是，israbye会彻底摧毁文件，即使付钱也无法恢复。"}
{"title": "使用Docker环境快速搭建靶机环境", "url": "https://www.freebuf.com/articles/system/143711.html", "time": "2017-08-14", "level": "金币+15", "num_look": 963395, "num_comment": 13, "author": "pageuo", "tags": ["系统安全"], "text": "Docker是近两年来十分流行的开源容器引擎，因此也出现了很多使用docker容器搭建的靶机环境供新手学习和使用。"}
{"title": "Buf早餐铺 | HBO高管疑似支付黑客赎金；“墨子号”量子卫星传回加密信息；华盛顿大学研究人员成功将恶意程序编码在DNA上", "url": "https://www.freebuf.com/news/143960.html", "time": "2017-08-14", "level": "", "num_look": 219726, "num_comment": 1, "author": "Elaine_z", "tags": ["资讯"], "text": "夏意消退，秋意渐浓，八月不知不觉已经进入了第三周，快来 Buf 早餐铺吃饱早餐，对抗秋乏吧。"}
{"title": "HUNT：一款可提升漏洞扫描能力的BurpSuite漏洞扫描插件", "url": "https://www.freebuf.com/sectool/143182.html", "time": "2017-08-13", "level": "", "num_look": 456777, "num_comment": 27, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款BurpSuite插件，这款插件名叫HUNT。它不仅可以识别指定漏洞类型的常见攻击参数，而且还可以在BurpSuite中组织测试方法。"}
{"title": "设计缺陷将导致亚马逊Echo变身成为监听设备", "url": "https://www.freebuf.com/news/142956.html", "time": "2017-08-13", "level": "", "num_look": 328925, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["漏洞", "终端安全"], "text": "MWR的安全研究专家发现亚马逊Echo存在一个物理攻击漏洞，该漏洞将允许攻击者获得设备的root shell。"}
{"title": "小米招聘路由器wifi测试工程师", "url": "https://www.freebuf.com/jobs/142231.html", "time": "2017-08-13", "level": "", "num_look": 209194, "num_comment": 8, "author": "Anna07", "tags": ["安全招聘"], "text": "北京小米科技有限责任公司，成立2010年4月，是一家专注于智能硬件和电子产品研发的移动互联网公司。"}
{"title": "Windows 10 S中的Device Guard详解（上篇）", "url": "https://www.freebuf.com/articles/system/143682.html", "time": "2017-08-13", "level": "红色标题", "num_look": 430721, "num_comment": 2, "author": "华为未然实验室", "tags": ["系统安全"], "text": "本文探讨Windows 10 S（下称Win10S）中的Device Guard（设备保护，下称DG）。我将提取策略，并弄清楚在默认Win10S系统上可以和不可以运行什么。"}
{"title": "【已结束】行动代号010：「漏洞马拉松线下邀请赛」北京站图文直播", "url": "https://www.freebuf.com/fevents/143734.html", "time": "2017-08-12", "level": "红色标题", "num_look": 522222, "num_comment": 17, "author": "漏洞盒子", "tags": ["活动"], "text": "8月12-13日，这里聚集了漏洞盒子精英白帽子举办首届漏洞马拉松线下邀请赛，这可能是最有趣最精彩的线下众测比赛！"}
{"title": "NSA开发的工控ICS/SCADA态势感知开源工具Grassmarlin（附下载地址）", "url": "https://www.freebuf.com/sectool/143106.html", "time": "2017-08-12", "level": "", "num_look": 904880, "num_comment": 7, "author": "Carrie_spinfo", "tags": ["工具", "工控安全"], "text": "GRASSMARLIN是一款由美国国家安全局开发的，能够帮助运维工程师在IP网络上发现并编目监控和数据采集系统（SCADA）和工业控制系统（ICS）主机的开源软件工具。"}
{"title": "“转移战场”的暗网市场继续繁荣", "url": "https://www.freebuf.com/news/143460.html", "time": "2017-08-12", "level": "红色标题", "num_look": 322635, "num_comment": 11, "author": "米雪儿", "tags": ["资讯"], "text": "在两大暗网市场 AlphaBay 和 Hansa 被美欧执法部门关闭之后，暗网市场的供应商并未因此偃旗息鼓，他们转战去了其它仍然活跃的市场。"}
{"title": "默安科技招聘安全专家", "url": "https://www.freebuf.com/jobs/140676.html", "time": "2017-08-12", "level": "", "num_look": 246343, "num_comment": 10, "author": "默安科技", "tags": ["安全招聘"], "text": "默安科技（www.moresec.cn）成立于 2016年，云计算时代的企业安全解决方案提供商，致力于用创新技术解决企业安全问题"}
{"title": "美国科学家将恶意软件植入DNA侵入电脑", "url": "https://www.freebuf.com/news/143930.html", "time": "2017-08-12", "level": "金币+6", "num_look": 199777, "num_comment": 4, "author": "少帅力", "tags": ["资讯"], "text": "美国华盛顿大学的科学家开发了一种生物恶意软件，并称之为第一次“基于DNA的电脑系统入侵行动”。"}
{"title": "利用树莓派追踪飞机航行轨迹的骚姿势分享", "url": "https://www.freebuf.com/geek/142064.html", "time": "2017-08-12", "level": "", "num_look": 531815, "num_comment": 8, "author": "饭团君", "tags": ["极客"], "text": "你知道如何利用你手中的树莓派来观察天空中的飞机吗？通过调谐和接收距离你所在地点250英里以外飞机无线电信号，你就可以追踪飞机航线。"}
{"title": "【FB TV】一周「BUF大事件」：维基解密VAULT 7新工具特工专场；2017黑客奥斯卡公布获奖名单", "url": "https://www.freebuf.com/video/143920.html", "time": "2017-08-12", "level": "红色标题", "num_look": 435371, "num_comment": 1, "author": "willhuang", "tags": ["视频"], "text": "维基解密VAULT 7新工具特工专场；美国陆军停用所有大疆无人机；2017黑客奥斯卡公布获奖名单"}
{"title": "大型挂马团伙“擒狼”攻击分析及溯源报告", "url": "https://www.freebuf.com/articles/system/143517.html", "time": "2017-08-12", "level": "红色标题", "num_look": 385991, "num_comment": 11, "author": "360安全", "tags": ["系统安全"], "text": "7月13日，360安全卫士检测到一起网站广告位挂马事件,大量网络广告出现集体挂马，广告内容以同城交友等诱惑信息为主，预警为“擒狼”木马攻击。"}
{"title": "Gartner 2017年WAF魔力象限报告：云WAF将替代物理设备成为主流", "url": "https://www.freebuf.com/articles/paper/143993.html", "time": "2017-08-11", "level": "", "num_look": 421964, "num_comment": 2, "author": "AngelaY", "tags": ["安全报告"], "text": "2017 年度全球 WAF 市场状况及厂商表现如何？WAF 市场未来发展趋势如何？企业能从报告中获得哪些参考？请看下文对 Gartner 2017 WAF 魔力象限报告的重点摘录内容。"}
{"title": "你家的网络摄像头可能也正被CIA监控，维基解密曝光CIA视频流窃听工具", "url": "https://www.freebuf.com/news/143984.html", "time": "2017-08-11", "level": "", "num_look": 375301, "num_comment": 3, "author": "Sphinx", "tags": ["资讯"], "text": "维基解密再次发布CIA Vault 7工具，可以让特工远程实时监控视频流。"}
{"title": "欧洲国家电网的噩梦：攻击太阳能板就能导致大规模停电？", "url": "https://www.freebuf.com/news/143423.html", "time": "2017-08-11", "level": "", "num_look": 225857, "num_comment": 1, "author": "liki", "tags": ["漏洞", "资讯"], "text": "近日，安全研究员Willem Westerhof在他的相关研究中发现了一些他称为\"Horus Scenario\"的漏洞，黑客可以通过这些漏洞关停电网。"}
{"title": "IsThisLegit+Phinn：采用了机器学习算法的开源网络钓鱼防御与检测工具", "url": "https://www.freebuf.com/sectool/142955.html", "time": "2017-08-11", "level": "", "num_look": 300147, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "现在的黑客技术可以允许网络犯罪分子轻而易举地给成千上万名用户发送钓鱼邮件，而且攻击的成功率还高得惊人。"}
{"title": "乌龙的CVE-2017-8570样本及背后的狗血", "url": "https://www.freebuf.com/news/143685.html", "time": "2017-08-11", "level": "红色标题", "num_look": 500072, "num_comment": 8, "author": "奇安信威胁情报中心", "tags": ["漏洞", "系统安全"], "text": "上周360天眼实验室发现了有国外黑客在Github上发布了CVE-2017-8570漏洞的利用代码，以此之后发现了不少标注为CVE-2017-8570的Office恶意样本。"}
{"title": "绕过反病毒软件的动态分析 ——反病毒软件模型的局限性以及利用", "url": "https://www.freebuf.com/articles/system/143690.html", "time": "2017-08-11", "level": "", "num_look": 257234, "num_comment": 257234, "author": "任子行", "tags": ["系统安全"], "text": "本文原始出处在sevagas，近期在分析wiki泄密CIA的文件时发现了它。虽说是2014年所撰写的内容，但其思路和测试方法依然有一定的研究价值，所以将其翻译供大家借鉴学习。"}
{"title": "上海银基安全招聘信息安全工程师", "url": "https://www.freebuf.com/jobs/139972.html", "time": "2017-08-11", "level": "", "num_look": 216821, "num_comment": 17, "author": "白菜1980", "tags": ["安全招聘"], "text": "上海银基信息安全技术股份有限公司成立于2002年，是一家立足上海、服务于全国的信息安全老牌公司。现招聘招聘信息安全工程师。"}
{"title": "利用Frida从TeamViewer内存中提取密码", "url": "https://www.freebuf.com/sectool/142928.html", "time": "2017-08-11", "level": "红色标题", "num_look": 490346, "num_comment": 13, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍一款能够从TeamViewer内存中提取密码的工具，这款工具名叫Frida。"}
{"title": "一个漏洞能潜伏多少年？细数那些有名的高龄安全漏洞", "url": "https://www.freebuf.com/special/142923.html", "time": "2017-08-11", "level": "金币+8", "num_look": 365783, "num_comment": 2, "author": "bupyeong-in", "tags": ["特别企划"], "text": "今天就为大家细数那些潜伏多年的陈年老漏洞。"}
{"title": "“灵隐”木马黑吃灰：绑架数十款游戏外挂实现恶意推广", "url": "https://www.freebuf.com/articles/system/143461.html", "time": "2017-08-11", "level": "红色标题", "num_look": 420836, "num_comment": 6, "author": "360安全", "tags": ["系统安全"], "text": "今年6月，360安全卫士对“灵隐”木马做了预警。最近一段时间，这伙木马又开始活跃，我们也接到不少网友反馈称受到木马干扰，浏览器被篡改，部分软件被删除。"}
{"title": "Buf早餐铺 | 两名研究人员在DefCon演讲后就被公司解雇；一家神秘公司发布25万美元漏洞奖励项目；黑客“黑了”百度排名", "url": "https://www.freebuf.com/news/143908.html", "time": "2017-08-11", "level": "", "num_look": 295377, "num_comment": 5, "author": "欧阳洋葱", "tags": ["资讯"], "text": "两名 Salesforce 的安全研究人员在上个月的 DEF CON 发表演讲过后，下台就立刻被解雇了，这是什么情况？点进来看看。"}
{"title": "Syzkaller：Linux内核模糊测试工具分享", "url": "https://www.freebuf.com/sectool/142969.html", "time": "2017-08-10", "level": "金币+8", "num_look": 639817, "num_comment": 2, "author": "阡陌时空", "tags": ["工具"], "text": "syzkaller是Google团队开发的一款针对Linux内核进行模糊测试的开源工具，目前还在不断的维护之中。"}
{"title": "浅谈代码审计入门实战：某博客系统最新版审计之旅", "url": "https://www.freebuf.com/news/143554.html", "time": "2017-08-10", "level": "金币+8", "num_look": 783536, "num_comment": 10, "author": "pupiles", "tags": [], "text": "第一次正式的审一次CMS，虽然只是一个很小的博客系统(提交都不一定收的那种)，漏洞也都很简单，但是也算是积累了不少经验，所以最后想来还是在此做个分享。"}
{"title": "Java反序列化危机已过，这次来的是.Net反序列化漏洞", "url": "https://www.freebuf.com/news/143609.html", "time": "2017-08-10", "level": "", "num_look": 345162, "num_comment": 1, "author": "Elaine_z", "tags": ["漏洞", "资讯"], "text": "撼动 Java 世界的反序列化问题如今正在重现， .NET 生态系统也正在遭受反序列化危机，攻击者通过这个漏洞可以在服务器或相关计算机设备上进行恶意代码注入。"}
{"title": "关于C/S架构系统的安全监测", "url": "https://www.freebuf.com/articles/system/143513.html", "time": "2017-08-10", "level": "现金奖励", "num_look": 494214, "num_comment": 37, "author": "smart_annt", "tags": ["系统安全"], "text": "由于工作需求，需要对一大批C/S架构的系统进行测试，所以这几天一直在摸索怎么个套路法，踩过的坑就不发了，直接奔我个人的套路。"}
{"title": "安全公司Carbon Black客户数据泄漏：多家财富1000强企业TB级别隐私数据流出", "url": "https://www.freebuf.com/news/143809.html", "time": "2017-08-10", "level": "", "num_look": 397605, "num_comment": 2, "author": "Elaine_z", "tags": ["数据安全", "资讯"], "text": "安全策略提供商 DirectDefense 在公开博客中写道，这些企业采用的 Carbon Black EDR（终端检测及响应）安全解决方案中存在问题，正在泄漏数十万个敏感文件。"}
{"title": "某大型国有企业招聘网络安全专家", "url": "https://www.freebuf.com/jobs/143817.html", "time": "2017-08-10", "level": "红色标题", "num_look": 405196, "num_comment": 38, "author": "Akane", "tags": ["安全招聘"], "text": "某大型国有企业诚招具有网络安全行业从业经验的技术人才，待遇丰厚（包上海市户口），名额有限不容错过。"}
{"title": "SafeBreach设计的恶意软件可利用云端反病毒代理从终端提取数据", "url": "https://www.freebuf.com/articles/terminal/142724.html", "time": "2017-08-10", "level": "", "num_look": 193043, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "来自SafeBreach的安全研究专家设计出了一种恶意软件，这种恶意软件能够利用云端增强型反病毒（AV）代理从没有直接接入互联网的终端设备中提取数据。"}
{"title": "《2017美国网络犯罪现状报告》：企业今年面临哪些安全问题，应该如何解决？", "url": "https://www.freebuf.com/articles/paper/143754.html", "time": "2017-08-10", "level": "", "num_look": 348534, "num_comment": 348534, "author": "AngelaY", "tags": ["企业安全", "安全报告"], "text": "CSO 的一份新调查表明，网络安全问题引起了美国很多公司的重视，他们开始关注并寻求解决网络安全问题的方法。"}
{"title": "不为人知的地下暗流：揭秘色情推广“影科技”家族背后的流量生意", "url": "https://www.freebuf.com/articles/network/143728.html", "time": "2017-08-10", "level": "红色标题", "num_look": 719239, "num_comment": 13, "author": "腾讯手机管家", "tags": ["网络安全"], "text": "想知道自己为啥话费总是不够用吗？想知道自己手机为啥莫名的卡顿的吗?想知道自己手机里面为啥总有那么些不请自来的APP天天见吗？来看看本文的分析。"}
{"title": "Buf早餐铺 | 《权力的游戏》剧本又遭泄露；微软不再信任沃通和StartCom的证书；爱尔兰电力传输系统运营商被攻击", "url": "https://www.freebuf.com/news/143756.html", "time": "2017-08-10", "level": "红色标题", "num_look": 249414, "num_comment": 4, "author": "Sphinx", "tags": ["资讯"], "text": "黑客再度放出《权力的游戏》S7E5剧本；微软也将不再信任沃通和StartCom颁发的证书；爱尔兰电力传输系统运营商遭遇攻击，黑客至少潜伏2个月。"}
{"title": "国家互联网应急中心（CNCERT）开通“魔鼬”木马感染数据免费查询服务", "url": "https://www.freebuf.com/news/143730.html", "time": "2017-08-09", "level": "", "num_look": 410071, "num_comment": 5, "author": "CNCERT", "tags": ["网络安全", "资讯"], "text": "2017年8月2日开始，一款名为“魔鼬”的木马在互联网大规模传播。“魔鼬”木马可控制感染电脑对外发动拒绝服务攻击，具有潜在危害大、传播范围广等特点。"}
{"title": "绕过杀毒软件与主机入侵防御系统对流量的检测", "url": "https://www.freebuf.com/articles/network/142418.html", "time": "2017-08-09", "level": "", "num_look": 395995, "num_comment": 3, "author": "鸢尾", "tags": ["网络安全"], "text": "终端解决方案会在主机存在的文件中扫描已知恶意软件，主机入侵防御系统(HIPS)会对每个数据包进行检测，然后断开所有不合法的连接。"}
{"title": "“震网三代”CVE-2017-8464漏洞分析和预警", "url": "https://www.freebuf.com/news/143353.html", "time": "2017-08-09", "level": "", "num_look": 523484, "num_comment": 3, "author": "瀚思科技", "tags": ["漏洞", "资讯"], "text": "微软在2017年6月份的补丁中修补了一个快捷方式（CVE-2107-8464）的漏洞，公告称此漏洞被国家背景的网络攻击所使用来实施攻击。"}
{"title": "如何把Photoshop改造成远程控制工具（RAT）来利用", "url": "https://www.freebuf.com/news/142783.html", "time": "2017-08-09", "level": "红色标题", "num_look": 438426, "num_comment": 6, "author": "clouds", "tags": ["工具", "极客"], "text": "作者在本文中通过对Photoshop远程连接功能的改造利用，最终实现了对开启远程连接功能的Photoshop端操作系统的接管控制。"}
{"title": "披着羊皮的狼：攻击者如何利用漏洞以特定图标伪装可执行文件", "url": "https://www.freebuf.com/articles/system/143365.html", "time": "2017-08-09", "level": "", "num_look": 279714, "num_comment": 5, "author": "hey你的拔粪宝", "tags": ["系统安全"], "text": "这个漏洞背后的图标显示bug可以深溯到Windows图像处理代码，其允许攻击者“借来”本地其他常用的图标并自动将可移植的可执行文件伪装起来，更容易诱使用户打开他们。"}
{"title": "观数科技招聘漏洞挖掘工程师", "url": "https://www.freebuf.com/jobs/141468.html", "time": "2017-08-09", "level": "", "num_look": 222615, "num_comment": 3, "author": "wangdaxuanxuan", "tags": ["安全招聘"], "text": "随着全球云计算、大数据技术的兴起，大数据安全一直是制约其发展的关键因素之一，观数科技专业致力于大数据安全技术的研发及服务。"}
{"title": "Office高级威胁漏洞在野利用分析", "url": "https://www.freebuf.com/news/143585.html", "time": "2017-08-09", "level": "红色标题", "num_look": 371675, "num_comment": 7, "author": "360安全", "tags": ["漏洞", "资讯"], "text": "在高级威胁攻击中，黑客远程投递入侵客户端最喜欢的漏洞是office文档漏洞，就在刚刚结束不久的黑帽子大会上，最佳客户端安全漏洞奖颁给了CVE-2017-0199漏洞。"}
{"title": "又见古老的Typosquatting攻击：这次入侵Npm窃取开发者身份凭证", "url": "https://www.freebuf.com/news/143003.html", "time": "2017-08-09", "level": "", "num_look": 294215, "num_comment": 4, "author": "liki", "tags": ["WEB安全", "资讯"], "text": "这次的Typosquatting攻击瞄准了Npm，这么古老的攻击方式竟然也能成功？"}
{"title": "Vuzzer自动漏洞挖掘工具简单分析附使用介绍", "url": "https://www.freebuf.com/sectool/143123.html", "time": "2017-08-09", "level": "现金奖励", "num_look": 715532, "num_comment": 34, "author": "vickylzy", "tags": ["工具"], "text": "Vuzzer 是由多家计算机科学机构 联合开发的工具，有自动漏洞测试功能。"}
{"title": "Buf早餐铺 | FireEye再次表示公司没有被入侵；美军禁用大疆无人机被政府报告打脸；国内首家定位SOAPA的安全公司兰云科技获得5000万融资", "url": "https://www.freebuf.com/news/143649.html", "time": "2017-08-09", "level": "", "num_look": 365627, "num_comment": 365627, "author": "AngelaY", "tags": ["资讯"], "text": "天气逐渐转凉，秋膘要开始贴起来了，各位 Buffer 也要多注意饮食养生哦~ BUF 早餐铺也会根据季节调换口味，但依然美味可口。"}
{"title": "CNNVD关于Windows SMBLoris漏洞情况的通报", "url": "https://www.freebuf.com/news/143352.html", "time": "2017-08-08", "level": "", "num_look": 324399, "num_comment": 2, "author": "CNNVD", "tags": ["漏洞", "资讯"], "text": "近日，在2017DEFCON安全大会上，某安全研究员披露了有关“Windows SMBLoris漏洞”的相关情况。"}
{"title": "当AI遇到网络安全：四层智能化革命蓄势待发", "url": "https://www.freebuf.com/news/143255.html", "time": "2017-08-08", "level": "", "num_look": 265931, "num_comment": 3, "author": "百度安全", "tags": ["资讯"], "text": "在刚刚落幕的第20届Blackhat大会上，“机器学习”被反复提及，人工智能在网络安全各个领域得到广泛探索和应用尝试。"}
{"title": "恶性病毒Kuzzle“攻破”安全厂商白名单，用户重装系统也难以清除", "url": "https://www.freebuf.com/news/142984.html", "time": "2017-08-08", "level": "红色标题", "num_look": 405978, "num_comment": 5, "author": "火绒安全", "tags": ["系统安全", "资讯"], "text": "近日，火绒安全团队截获恶性病毒\"Kuzzle\"，该病毒感染电脑后会劫持浏览器首页牟利，同时接受病毒作者的远程指令进行其他破坏活动。"}
{"title": "科技之殇：端到端加密究竟保护了谁？", "url": "https://www.freebuf.com/articles/database/142797.html", "time": "2017-08-08", "level": "", "num_look": 802606, "num_comment": 4, "author": "Elaine_z", "tags": ["数据安全", "特别企划"], "text": "隐私和安全的边界不断遭受拷问，而被信息时代的大网黏住的人们却无法全身而退。加密通讯日渐流行，恐怖分子也越来越容易逃避监控。"}
{"title": "思源集团诚招安全工程师", "url": "https://www.freebuf.com/jobs/140915.html", "time": "2017-08-08", "level": "", "num_look": 244321, "num_comment": 6, "author": "wuji_sec", "tags": ["安全招聘"], "text": "思源集团是一家以互联网科技产业为核心，房地产服务和投融资业务三位一体的集团型企业。"}
{"title": "2017安全奥斯卡（Pwnie Awards 2017）获奖名单公布", "url": "https://www.freebuf.com/articles/others-articles/143497.html", "time": "2017-08-08", "level": "", "num_look": 192529, "num_comment": 192529, "author": "米雪儿", "tags": ["其他"], "text": "“Pwnie Awards”被誉为全球黑客奥斯卡，始创于2007年，到现在已有11届了（包含本年度）。主要为有重大和突出研究成果的信息安全工作者设立的奖项。"}
{"title": "老毛桃PE盘工具木马：一款“通杀”浏览器的主页劫持大盗", "url": "https://www.freebuf.com/articles/web/143462.html", "time": "2017-08-08", "level": "红色标题", "num_look": 655250, "num_comment": 38, "author": "360安全", "tags": ["WEB安全"], "text": "最近，多个网友反馈称电脑中所有浏览器的主页都被篡改，而且强制锁定为某推广页面。据分析，这是一款假冒“老毛桃”PE盘制作工具的推广木马在恶意作祟。"}
{"title": "基于Wi-Fi的HID注射器，利用WHID攻击实验", "url": "https://www.freebuf.com/articles/web/142650.html", "time": "2017-08-08", "level": "", "num_look": 415576, "num_comment": 8, "author": "网络安全通", "tags": ["WEB安全", "极客"], "text": "WHID 代表基于 Wi-Fi 的 HID 注射器，即对 HID 攻击进行无线化攻击的一种注入工具。"}
{"title": "这回不定位女友了：火车票上的星号暗藏玄机？！", "url": "https://www.freebuf.com/articles/database/143402.html", "time": "2017-08-08", "level": "现金奖励", "num_look": 976650, "num_comment": 44, "author": "刀郎", "tags": ["数据安全"], "text": "昨天回了一次老家，在车上无聊看着火车票，虽然火车票上的身份证打了四个星号，但是是否意味着安全啦？"}
{"title": "Buf早餐铺 | 《权力的游戏》第七季第四集又遭泄露；韩国情报机构承认2012年干涉总统大选；Windows 10支持检测PowerShell攻击", "url": "https://www.freebuf.com/news/143474.html", "time": "2017-08-08", "level": "", "num_look": 425065, "num_comment": 425065, "author": "Sphinx", "tags": ["资讯"], "text": "关注Buf早餐铺，除了有新鲜的早餐，还有美剧更新提醒呢（逃"}
{"title": "CNCERT关于“魔鼬”木马有关情况的预警通报", "url": "https://www.freebuf.com/news/143355.html", "time": "2017-08-07", "level": "", "num_look": 222690, "num_comment": 5, "author": "CNCERT", "tags": ["资讯"], "text": "CNCERT已在第一时间处置了“魔鼬”木马的控制域名www.linux288.com。建议尽快排查自身网络内是否存在上述控制域名访问记录，并更新安全防护软件和特征库到最新版本。"}
{"title": "DEFCON 25趣事之“玩转投票机”", "url": "https://www.freebuf.com/news/142854.html", "time": "2017-08-07", "level": "", "num_look": 241833, "num_comment": 3, "author": "鸢尾", "tags": ["极客", "资讯"], "text": "这是我第一次参加DEF CON，体验过才理解其中的各种妙不可言！这次举办的“Voting Machine Village”活动就非常有趣。"}
{"title": "Angr：一个具有动态符号执行和静态分析的二进制分析工具", "url": "https://www.freebuf.com/sectool/143056.html", "time": "2017-08-07", "level": "金币+12", "num_look": 830780, "num_comment": 5, "author": "StayReal", "tags": ["工具"], "text": "angr是一个二进制代码分析工具，能够自动化完成二进制文件的分析，并找出漏洞。在二进制代码中寻找并且利用漏洞是一项非常具有挑战性的工作。"}
{"title": "浅谈Web渗透测试中的信息收集", "url": "https://www.freebuf.com/articles/web/142767.html", "time": "2017-08-07", "level": "金币+12", "num_look": 758465, "num_comment": 16, "author": "冷瘠薄", "tags": ["WEB安全"], "text": "信息收集对于渗透测试可以说是重中之重，正所谓“知己知彼，百战不殆”。"}
{"title": "“沙虫”二代漏洞（CVE-2017-8570）来袭，影响多个版本Microsoft Office", "url": "https://www.freebuf.com/news/143206.html", "time": "2017-08-07", "level": "红色标题", "num_look": 498439, "num_comment": 6, "author": "金睛", "tags": ["漏洞", "资讯"], "text": "7月下旬，我们监测到有国外黑客在github上上传了CVE-2017-8570漏洞的利用代码，7月29日，我们监测到多个利用该漏洞的恶意文件开始在互联网上传播。"}
{"title": "关于弱密码摄像头被入侵实验", "url": "https://www.freebuf.com/articles/terminal/143023.html", "time": "2017-08-07", "level": "金币+12", "num_look": 582429, "num_comment": 12, "author": "网络安全通", "tags": ["终端安全"], "text": "前不久，央视曝光大量摄像头存在弱密码被黑客入侵后，信息叫卖的情况，为了学习研究弱密码摄像头的危害性，我们打算对此进行复现。"}
{"title": "悬镜高薪聘请安全服务工程师、安全测试工程师、品牌文案策划师", "url": "https://www.freebuf.com/jobs/142414.html", "time": "2017-08-07", "level": "", "num_look": 234285, "num_comment": 19, "author": "悬镜安全实验室", "tags": ["安全招聘"], "text": "悬镜安全实验室的核心成员主要来自北京大学、北京邮电大学等顶级高校及国内大型互联网公司等。"}
{"title": "我们要在任何可能的地方测试XSS漏洞", "url": "https://www.freebuf.com/vuls/142751.html", "time": "2017-08-07", "level": "", "num_look": 647164, "num_comment": 14, "author": "Alpha_h4ck", "tags": ["WEB安全", "漏洞"], "text": "在这篇文章中，我准备跟大家讨论几种不同的场景，在这些场景中，不同的服务都会收集各种各样的数据，但它们又无法正确地去处理这些数据。"}
{"title": "腾讯安全反病毒实验室：揭秘“挂马”黑产最新态势", "url": "https://www.freebuf.com/articles/system/143217.html", "time": "2017-08-07", "level": "红色标题", "num_look": 426332, "num_comment": 17, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "腾讯安全反病毒实验室监测发现，近期有大量“挂马”攻击，受影响地域广泛，涉及全国31个省份，传播方式分为“大站广告挂马”和“自运营网站”等方式。"}
{"title": "看我如何基于Python&Facepp打造智能监控系统", "url": "https://www.freebuf.com/geek/143186.html", "time": "2017-08-07", "level": "现金奖励", "num_look": 677687, "num_comment": 30, "author": "zw97073966", "tags": ["极客"], "text": "因为家里经常没人住，并且还放有其他贵重物品，生怕一不留神，这些租户跳到我家。把这些东西洗劫一空。此时我已经安耐不住内心的小激动！那么。搭建一个智能监控系统可好！"}
{"title": "Buf早餐铺 | WannaCry作者从比特币钱包提现；被FBI逮捕的WannaCry安全专家拒绝认罪", "url": "https://www.freebuf.com/news/143313.html", "time": "2017-08-07", "level": "", "num_look": 449989, "num_comment": 2, "author": "Sphinx", "tags": ["资讯"], "text": "维基解密发布CIA 用来关闭摄像头监控的工具 Dumbo；WannaCry作者开始从比特币钱包提现；又一款Chrome插件被劫持，100万用户可能受影响，快来看看你有没有中招吧！"}
{"title": "挖洞经验 | 看我如何综合利用4个漏洞实现GitHub Enterprise远程代码执行", "url": "https://www.freebuf.com/news/142680.html", "time": "2017-08-06", "level": "", "num_look": 434733, "num_comment": 5, "author": "clouds", "tags": ["漏洞", "资讯"], "text": "我将向大家展示如何通过4个漏洞完美实现GitHub Enterprise的RCE执行，该RCE实现方法与服务器端请求伪造技术（SSRF）相关，技术稍显过时但综合利用威力强大。"}
{"title": "阿里云IoT事业部招聘资深安全测试工程师测试专家", "url": "https://www.freebuf.com/jobs/141166.html", "time": "2017-08-06", "level": "", "num_look": 341447, "num_comment": 8, "author": "woyigui", "tags": ["安全招聘"], "text": "阿里云IoT事业部为大型企业及政府提供云端一体化的基于智慧城市、智慧生活、智慧工业的平台级解决方案。"}
{"title": "“震网三代”（CVE-2017-8464）的几种利用方法与防范", "url": "https://www.freebuf.com/news/143356.html", "time": "2017-08-06", "level": "金币+8", "num_look": 753924, "num_comment": 6, "author": "hey你的拔粪宝", "tags": ["系统安全", "资讯"], "text": "NSA就承认利用过相似漏洞且以“Olympic Game”为代号研发震网病毒，来阻止伊朗发展核武。"}
{"title": "全球国家“破坏性网络攻击” 30 年|Cybereason情报组报告", "url": "https://www.freebuf.com/articles/network/142729.html", "time": "2017-08-06", "level": "红色标题", "num_look": 503683, "num_comment": 2, "author": "AngelaY", "tags": ["安全报告", "特别企划"], "text": "过去 20 年来，破坏性网络攻击的数量日益增多，特征日益凸显，那些与国家支持的黑客有关的破坏性网络攻击尤其如此。"}
{"title": "利用USB RUBBER DUCKY（USB 橡皮鸭）在目标机器上启动Empire或Meterpreter会话", "url": "https://www.freebuf.com/geek/141839.html", "time": "2017-08-06", "level": "", "num_look": 479675, "num_comment": 5, "author": "secist", "tags": ["极客"], "text": "今天我将教大家如何使用Rubber Ducky在渗透中建立Empire或Meterpreter会话连接。本文概述了三种橡皮鸭速度的优化技术，以及最小化用户对Ducky的异常检测。"}
{"title": "Skype-Type：一款通过声音窃取键盘记录的Keylogger工具", "url": "https://www.freebuf.com/sectool/142692.html", "time": "2017-08-05", "level": "", "num_look": 279196, "num_comment": 11, "author": "Alpha_h4ck", "tags": ["工具"], "text": "Skype-Type（简称S&T）是一款功能强大的键盘声音窃听器，这款新颖的安全研究工具将允许他人执行键盘声音窃听攻击。简而言之，S&T可以通过窃听目标用户的键盘声音来窃取数据。"}
{"title": "笑看黑客如何打脸智能枪支", "url": "https://www.freebuf.com/news/142643.html", "time": "2017-08-05", "level": "红色标题", "num_look": 288143, "num_comment": 5, "author": "鸢尾", "tags": ["终端安全", "资讯"], "text": "我认为我们应该对智能机器的狂热追捧停一停了，除非它足够安全当得起“智能”二字。从智能烤箱，安全摄像头到智能汽车 —— 万物皆可破！"}
{"title": "中通快递诚招安全人才", "url": "https://www.freebuf.com/jobs/142173.html", "time": "2017-08-05", "level": "", "num_look": 239025, "num_comment": 8, "author": "ZTO_Misaki", "tags": ["安全招聘"], "text": "中通快递是一家集快递、物流及其他业务于一体的大型集团公司，作为中国最大的快递公司之一，一直致力于营造安全、快捷的快递服务。"}
{"title": "【FB TV】一周「BUF大事件」：维基解密爆出CIA三款新工具；科恩实验室再次远程入侵特斯拉；国内监控产品被曝远程代码执行漏洞", "url": "https://www.freebuf.com/video/143343.html", "time": "2017-08-05", "level": "红色标题", "num_look": 426587, "num_comment": 1, "author": "willhuang", "tags": ["视频"], "text": "CIA工具周更又准时来了；中国一家厂商的17.5万摄像头都存在远程代码执行漏洞；特斯拉汽车又被破解了；还有传说中固若金汤的FireEye公司数据泄露啦！"}
{"title": "域渗透TIPS：获取LAPS管理员密码", "url": "https://www.freebuf.com/articles/web/142659.html", "time": "2017-08-05", "level": "", "num_look": 397419, "num_comment": 1, "author": "鸢尾", "tags": ["WEB安全"], "text": "如果你之前有对启用LAPS机制的主机进行渗透测试，那么你应该能体会到该机制的随机化本地管理员密码是有多么令人痛苦。"}
{"title": "朝鲜高层：其实我们并不“孤独”，我们可以网购、网游、看在线视频", "url": "https://www.freebuf.com/news/142490.html", "time": "2017-08-05", "level": "红色标题", "num_look": 426032, "num_comment": 17, "author": "clouds", "tags": ["资讯"], "text": "在朝鲜只有少部分的政权精英和统治阶层可以自由访问互联网，朝鲜高层对互联网的使用情况并不像想像中那样孤立封闭，相反却是非常与时俱进和高深复杂。"}
{"title": "这款奇特的银行木马可以根据鼠标移动轨迹来区分用户和虚拟机", "url": "https://www.freebuf.com/news/142634.html", "time": "2017-08-04", "level": "", "num_look": 344326, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["系统安全", "资讯"], "text": "新功能包括利用鼠标移动轨迹和文件时间戳来判断沙盒环境，以及从Thunderbird应用（Mozilla的邮件工具）中窃取数据等等。"}
{"title": "详解Windows注册表分析取证", "url": "https://www.freebuf.com/articles/system/142417.html", "time": "2017-08-04", "level": "红色标题", "num_look": 560862, "num_comment": 7, "author": "secist", "tags": ["系统安全"], "text": "在本文中我将为大家详细介绍Windows注册表的工作原理，以及如何对收集用户留下的各类指纹信息。"}
{"title": "美国司法部是如何打造漏洞披露计划框架的？", "url": "https://www.freebuf.com/news/143270.html", "time": "2017-08-04", "level": "", "num_look": 297393, "num_comment": 297393, "author": "AngelaY", "tags": ["资讯"], "text": "美国司法部（DOJ）刑事司网络安全部日前打造了“在线系统漏洞披露计划框架”，旨在帮助组织机构开发正式的漏洞披露计划。"}
{"title": "好莱坞特工的必备：维基解密公开 CIA 用来关闭摄像头监控的工具 Dumbo", "url": "https://www.freebuf.com/news/143233.html", "time": "2017-08-04", "level": "红色标题", "num_look": 564485, "num_comment": 5, "author": "Elaine_z", "tags": ["工具", "资讯"], "text": "我们看到无数的电影中，秘密间谍或银行抢劫者通过劫持监控摄像机，随后秘密行动悄无声息地开始，而现实中 CIA 特工确实是这样做的。"}
{"title": "安天发现新型DDoS攻击木马“魔鼬”", "url": "https://www.freebuf.com/news/142927.html", "time": "2017-08-04", "level": "", "num_look": 563382, "num_comment": 6, "author": "antiylab", "tags": ["网络安全", "资讯"], "text": "2017年7月30日，安天安全研究与应急处理中心（Antiy CERT）的工程师发现一种具备拒绝服务（DDoS）攻击能力的新型木马。经初步分析，安天CERT工程师认为该木马属于一个新家族，并将其命名为“魔鼬”。"}
{"title": "第一只WiFi蠕虫的诞生：完整解析博通WiFi芯片Broadpwn漏洞（含EXP／POC）", "url": "https://www.freebuf.com/vuls/142099.html", "time": "2017-08-04", "level": "红色标题", "num_look": 760392, "num_comment": 5, "author": "Elaine_z", "tags": ["无线安全", "漏洞"], "text": "目前漏洞虽然已经得到修复——但这个漏洞的研究过程也许能给安全研究和防护带来深层次的思考,希望能给大家带来帮助。"}
{"title": "福特、宝马、英菲尼迪和日产汽车TCU存在漏洞，可被远程入侵", "url": "https://www.freebuf.com/news/143040.html", "time": "2017-08-04", "level": "", "num_look": 262399, "num_comment": 3, "author": "Sphinx", "tags": ["资讯"], "text": "三名研究人员发现福特、宝马、英菲尼迪和日产汽车的远程信息处理控制单元(TCU)中存在漏洞，这些TCU都是由Continental AG公司生产的。"}
{"title": "美团点评集团安全部诚聘各类安全与研发人才", "url": "https://www.freebuf.com/jobs/141049.html", "time": "2017-08-04", "level": "", "num_look": 348024, "num_comment": 19, "author": "李发财", "tags": ["安全招聘"], "text": "美团点评集团安全部诚聘各类安全与研发人才啦，以下职位除特别说明外，北京上海两地可选"}
{"title": "Gaza Cybergang APT团伙新样本分析", "url": "https://www.freebuf.com/vuls/142970.html", "time": "2017-08-04", "level": "", "num_look": 552306, "num_comment": 2, "author": "奇安信威胁情报中心", "tags": ["漏洞", "网络安全"], "text": "2017年6月下旬， 360威胁情报中心发现了Gaza Cybergang APT事件的新样本，其特点是恶意代码完全使用网上流行的标准攻击框架Cobalt Strike生成。"}
{"title": "Linux病毒呈爆发式增长，2017年上半年中国网络安全报告", "url": "https://www.freebuf.com/articles/network/142780.html", "time": "2017-08-04", "level": "", "num_look": 626832, "num_comment": 4, "author": "瑞星", "tags": ["安全报告", "网络安全"], "text": "国家信息中心信息与网络安全部与瑞星合作，对2017年1至6月的病毒、恶意网址、移动互联网及企业网络安全做了详细的分析，并对2017年下半年的网络安全趋势做出了预测。"}
{"title": "工具解析|杀毒引擎惨遭打脸，黑帽大会爆惊天免杀工具", "url": "https://www.freebuf.com/news/142758.html", "time": "2017-08-04", "level": "现金奖励", "num_look": 680564, "num_comment": 22, "author": "2cat", "tags": ["工具", "资讯"], "text": "今年的黑帽大会上，可谓是精彩不断。与往届大会对比看来，当属2017这届最有看头。各种推陈出新的技术暂且不论，光是爆出的新免杀工具AVET就足以惊艳全场。"}
{"title": "Buf早餐铺 | 阻击WannaCry的“英雄”被FBI逮捕；赛门铁克即将卖掉SSL业务；美国将确立IoT安全标准法案；", "url": "https://www.freebuf.com/news/143151.html", "time": "2017-08-04", "level": "红色标题", "num_look": 265757, "num_comment": 265757, "author": "AngelaY", "tags": ["资讯"], "text": "走在风中今天阳光依然不温柔，天那么热，地那么烫，还被晒出油~~又是很热的一天，大家记得吃好早餐，补充好能量，才能开启元气满满的一天哦！"}
{"title": "我是如何通过命令执行到最终获取内网Root权限的", "url": "https://www.freebuf.com/articles/web/141579.html", "time": "2017-08-03", "level": "", "num_look": 753963, "num_comment": 20, "author": "secist", "tags": ["WEB安全"], "text": "此前我曾发表过一篇ltr101的文章，这是我该系列的第二篇。本文我将为大家展示最近我在赏金计划中，发现的一个非常cool的漏洞。"}
{"title": "这群白帽子为何812深夜齐聚搞事情？！（内含视频福利）", "url": "https://www.freebuf.com/fevents/143150.html", "time": "2017-08-03", "level": "红色标题", "num_look": 407250, "num_comment": 15, "author": "漏洞盒子", "tags": ["活动"], "text": "白帽子×厂商×24小时——众测还能这么玩？国内反正这是第一次……"}
{"title": "中国深圳一家厂商的智能摄像头曝出漏洞：至少17.5万设备可被远程攻击", "url": "https://www.freebuf.com/news/143024.html", "time": "2017-08-03", "level": "", "num_look": 494007, "num_comment": 2, "author": "Elaine_z", "tags": ["漏洞", "资讯"], "text": "安全研究员已经在多个常用智能摄像头中都发现远程侵入漏洞，涉及 VStarcam、Loftek、以及 Neo IP camera。"}
{"title": "Lalin：一款为Kali集成各种安全工具的懒人工具包", "url": "https://www.freebuf.com/news/142759.html", "time": "2017-08-03", "level": "金币+10", "num_look": 804406, "num_comment": 19, "author": "hey你的拔粪宝", "tags": ["工具", "资讯"], "text": "Lalin是一个Kali专用的懒人工具包，集成了众多较新的工具以及一些基础功能，目前与Kali rolling兼容，适合新手及非深度Kali用户使用。"}
{"title": "使用ESP8266模块进行Deauth攻击及其他WiFi hacks", "url": "https://www.freebuf.com/articles/wireless/142445.html", "time": "2017-08-03", "level": "", "num_look": 1499837, "num_comment": 7, "author": "鸢尾", "tags": ["无线安全"], "text": "得益于Spacehuhn项目，我们可以利用 NodeMCU ESP8266自己动手组装WiFi干扰器(更为精准的无线网络Deauth攻击工具)。"}
{"title": "一个有20年历史的SMB漏洞：一台树莓派就能DoS大型服务器，微软表示不会修复该漏洞", "url": "https://www.freebuf.com/news/142697.html", "time": "2017-08-03", "level": "红色标题", "num_look": 393732, "num_comment": 9, "author": "liki", "tags": ["漏洞", "资讯"], "text": "近日，RiskSense的安全研究人员找到了一个20年之久的Windows SMB漏洞，他们称之为SMBloris，在最近的DEF CON黑客会议上，介绍了他们的发现。"}
{"title": "无线安全课堂：手把手教会你搭建伪AP接入点", "url": "https://www.freebuf.com/news/141977.html", "time": "2017-08-03", "level": "", "num_look": 619098, "num_comment": 619098, "author": "鸢尾", "tags": ["无线安全", "资讯"], "text": "在本攻击场景中，我们将使用到alfa无线网卡以及用于网络访问的以太网连接（虚拟机环境下，物理机下无需此配置）。"}
{"title": "传化物流诚聘安全人才", "url": "https://www.freebuf.com/jobs/141007.html", "time": "2017-08-03", "level": "", "num_look": 226221, "num_comment": 12, "author": "传化物流", "tags": ["安全招聘"], "text": "传化集团创建于1986年，是知名的多元化现代民营企业集团,现员工13000多名，致力于化工、物流、农业、科技城、投资等事业领域,业务覆盖全球80多个国家和地区。"}
{"title": "用Python写成的MCR乐队敲诈者木马：这种操作很朋克！", "url": "https://www.freebuf.com/articles/system/142885.html", "time": "2017-08-03", "level": "红色标题", "num_look": 766970, "num_comment": 19, "author": "360安全", "tags": ["数据安全", "系统安全"], "text": "几年前，敲诈者木马还是一个默默无闻的木马种类。然而，由于其极强的破坏力和直接且丰厚的财富回报，敲诈者木马这几年已经一跃成为曝光率最高的木马类型。"}
{"title": "Web端口复用正向后门研究实现与防御", "url": "https://www.freebuf.com/articles/web/142628.html", "time": "2017-08-03", "level": "现金奖励", "num_look": 608382, "num_comment": 10, "author": "任子行", "tags": ["WEB安全"], "text": "本文将通过分析Net.TCP Port Sharing这个机制，最后实现一个基于端口复用的正向后门，目的是分享一些攻防技术的研究成果，请勿作为非法用途。"}
{"title": "Buf早餐铺 | 国产Neo摄像头曝漏洞；亚马逊Echo可成为监听设备；伊朗黑客组织构造虚拟形象对中东进行社工；宝马等汽车或因TCU问题被远程入侵", "url": "https://www.freebuf.com/news/142916.html", "time": "2017-08-03", "level": "", "num_look": 362163, "num_comment": 362163, "author": "AngelaY", "tags": ["资讯"], "text": "大家好，这里是准点开张的 BUF 早餐铺，今天依旧为大家送上丰盛餐点，包括 BlackHat 和 DEF CON 的更多报道、国际资讯、企业安全、物联网安全等内容。一起来吃肉吧~"}
{"title": "用啥Ngrok，用SSH解决大局域网反向端口转发问题", "url": "https://www.freebuf.com/articles/network/142034.html", "time": "2017-08-02", "level": "金币+18", "num_look": 651233, "num_comment": 7, "author": "Tony Lee", "tags": ["网络安全"], "text": "自从家里换了联通光纤后，联通就在我家宽带出口前搭了一个路由器，我家也彻底沦为192.168.1.0/24段的局域网了"}
{"title": "如何利用神经网络和Python生成指定模式的密码", "url": "https://www.freebuf.com/sectool/142189.html", "time": "2017-08-02", "level": "", "num_look": 421871, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["WEB安全", "工具"], "text": "今天给大家介绍的是Github上一个名叫PyMLProjects的项目，这个项目的目的是为了训练AI来学习人类构造密码的模式，然后我们就可以用AI来生成大量同一模式或种类的密码了。"}
{"title": "如何将简单的Shell转换成为完全交互式的TTY", "url": "https://www.freebuf.com/news/142195.html", "time": "2017-08-02", "level": "红色标题", "num_look": 702142, "num_comment": 2, "author": "secist", "tags": ["WEB安全", "资讯"], "text": "作为一名渗透测试人员，最令人激动的莫过于netcat为我们反弹回了一个shell连接，以及通过id命令查看到一个令人满意的用户权限。"}
{"title": "腾讯MIG无线研发部诚招安全领域人才", "url": "https://www.freebuf.com/jobs/139817.html", "time": "2017-08-02", "level": "", "num_look": 365695, "num_comment": 14, "author": "Riceeeeeeeeee", "tags": ["安全招聘"], "text": "腾讯 MIG 聚焦于移动互联网基础平台，为用户提供安全上网及发现互联网精彩内容的入口服务，同时探索和孵化移动互联网智能硬件新业务。"}
{"title": "特斯拉Model X这次又被腾讯科恩实验室破解了，来看PoC灯光秀", "url": "https://www.freebuf.com/news/142479.html", "time": "2017-08-02", "level": "红色标题", "num_look": 510189, "num_comment": 14, "author": "liki", "tags": ["漏洞", "资讯"], "text": "近日，来自中国的腾讯科技公司的安全研究机构再一次证明了他们可以远程入侵特斯拉。不过，他们利用的漏洞很快被汽车制造商打补丁修复了。"}
{"title": "恶意充电宝的克星——USB安全接口", "url": "https://www.freebuf.com/news/141833.html", "time": "2017-08-02", "level": "金币+18", "num_look": 420294, "num_comment": 16, "author": "网络安全通", "tags": ["极客", "资讯"], "text": "首先，我们需要对USB接口的协议有一个了解。USB（Universal Serial Bus）中文译为通用串行总线，是一种应用在计算机领域的接口技术。"}
{"title": "DEFCON精彩破解：Apple Pay被攻破、机器人解锁保险箱、用声音攻击智能设备（含PPT）", "url": "https://www.freebuf.com/news/142565.html", "time": "2017-08-02", "level": "", "num_look": 447069, "num_comment": 3, "author": "Sphinx", "tags": ["特别企划", "资讯"], "text": "刚刚落下帷幕的BlackHat和DEFCON大会上除了之前我们介绍的精彩议题，还有各种各样的硬件破解技巧，今天就大家介绍一些那些在安全“两会”中的精彩破解。"}
{"title": "Buf早餐铺 | 违反《网络安全法》首例，一公司被罚；印度6万台路由器被攻击；《权力的游戏》剧集泄露； ICS-CERT针对CAN总线漏洞发预警", "url": "https://www.freebuf.com/news/142731.html", "time": "2017-08-02", "level": "", "num_look": 369334, "num_comment": 1, "author": "欧阳洋葱", "tags": ["资讯"], "text": "Black Hat和DEF CON两大盛会刚刚结束，实际上黑客界的著名两会还有许多值得探讨和深入的议题等待各位挖掘。今天的早餐铺也有其中的议题分享哦。"}
{"title": "MobSF：一款功能强大的智能移动安全框架", "url": "https://www.freebuf.com/articles/terminal/141439.html", "time": "2017-08-01", "level": "", "num_look": 847997, "num_comment": 13, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "今天给大家介绍的是一款名叫MobSF的移动安全框架，这是一款功能多合一型的智能框架。"}
{"title": "CNCERT关于异鬼II Bootkit病毒有关情况的预警通报", "url": "https://www.freebuf.com/news/142402.html", "time": "2017-08-01", "level": "", "num_look": 370949, "num_comment": 10, "author": "CNCERT", "tags": ["资讯"], "text": "CNCERT收到腾讯公司关于名为“异鬼II”的bootkit病毒在互联网上大量传播的情况报告。CNCERT及时开展监测分析，发现我国境内已有大量用户感染"}
{"title": "黑客渗透进 FireEye 旗下公司 Mandiant 内网窃取资料：弥天大谎还是确有此事？", "url": "https://www.freebuf.com/news/142686.html", "time": "2017-08-01", "level": "红色标题", "num_look": 587032, "num_comment": 4, "author": "Elaine_z", "tags": ["数据安全", "资讯"], "text": "2014 年刚刚上市不久的安全企业 FireEye 以 10 亿美元收购了 Mandiant，成为当时轰动一时的大手笔收购案；而到了 2017 年就被黑了？"}
{"title": "利用esp8266制作一个可随身携带的WiFi密码钓鱼器", "url": "https://www.freebuf.com/news/141922.html", "time": "2017-08-01", "level": "现金奖励", "num_look": 2396760, "num_comment": 80, "author": "iangzy", "tags": ["工具", "极客"], "text": "玩过WiFi密码破解的对fluxion这框架都不陌生吧。大致原理都是对目标路由器进行deauth攻击，使客户端断网，再诱导客户连接上虚假WIFI从而钓取密码。"}
{"title": "Loadlibrary：将Windows的动态链接库移植到Linux下", "url": "https://www.freebuf.com/sectool/141767.html", "time": "2017-08-01", "level": "金币+18", "num_look": 389843, "num_comment": 6, "author": "风起云端", "tags": ["工具", "系统安全"], "text": "loadlibrar运行在linux上，它可以调用windows上dll文件中的函数，实现windows下的程序在linux上运行。"}
{"title": "知乎招聘安全&反作弊专业人才", "url": "https://www.freebuf.com/news/142090.html", "time": "2017-08-01", "level": "", "num_look": 633116, "num_comment": 18, "author": "rebekah", "tags": ["安全招聘", "资讯"], "text": "知乎是一个真实的网络问答社区，社区氛围友好与理性，连接各行各业的精英。用户分享着彼此的专业知识、经验和见解，为中文互联网源源不断地提供高质量的信息。"}
{"title": "如何使用HackRF做一个简单的IMSI捕获器", "url": "https://www.freebuf.com/news/141988.html", "time": "2017-08-01", "level": "金币+15", "num_look": 594042, "num_comment": 7, "author": "hey你的拔粪宝", "tags": ["极客", "资讯"], "text": "MSI为国际用户识别码（International Mobile Subscriber Identity）的缩写，是用于区分蜂窝网络中不同用户的，在所在蜂窝网络中不重复的识别码。本文介绍使用HackRF one获取IMSI。"}
{"title": "使用Httrack和Tomcat快速搭建本地钓鱼网站", "url": "https://www.freebuf.com/news/141918.html", "time": "2017-08-01", "level": "金币+15", "num_look": 454713, "num_comment": 18, "author": "yuegui_2004", "tags": ["资讯"], "text": "钓鱼网站是黑客或恶意攻击者通过对源网站的复制、模仿等行为所构造的与愿网站相似度极高的网站，从而通过这种相似度极高的网站窃取用户信息。"}
{"title": "Codiad在线IDE框架远程命令执行漏洞分析", "url": "https://www.freebuf.com/articles/web/141788.html", "time": "2017-08-01", "level": "现金奖励", "num_look": 322046, "num_comment": 4, "author": "王一航", "tags": ["WEB安全"], "text": "Codiad 是一个开源基于Web的IDE应用程序，用于在线编写和编辑代码。这个应用程序采用PHP开发，并且不需要一个SQL数据库，数据是存储在一个JSON格式的文件中。"}
{"title": "Buf 早餐铺 | FireEye内部数据遭泄露；谷歌明年10月起不再信任赛门铁克SSL证书；腾讯科恩实验室侵入特斯拉 Model X；开发者请愿开源Flash", "url": "https://www.freebuf.com/news/142556.html", "time": "2017-08-01", "level": "红色标题", "num_look": 333476, "num_comment": 2, "author": "Elaine_z", "tags": ["资讯"], "text": "BlackHat 刚刚结束，预热尚未消退，今天的新闻中就出现了FireEye、谷歌、微软、特斯拉等大公司，是大新闻吗？一起来看看吧"}
{"title": "仅剩5个名额 | 漏洞马拉松线下邀请赛等你来战！", "url": "https://www.freebuf.com/fevents/142645.html", "time": "2017-07-31", "level": "红色标题", "num_look": 366818, "num_comment": 5, "author": "FB客服", "tags": ["活动"], "text": "挖洞好几年，第一次知道线下众测还可以这么有趣……大师傅看到活动公告时就惊呆了！"}
{"title": "新手科普：浅谈家用路由器安全变迁", "url": "https://www.freebuf.com/special/140817.html", "time": "2017-07-31", "level": "", "num_look": 503002, "num_comment": 8, "author": "vulture", "tags": ["特别企划"], "text": "路由器是家庭网络的入口，在IoT浪潮下，路由器也起到了网络守护者的角色。正因为如此，这几年针对路由器的攻击也越来越多，本文就带大家细数这些年针对路由器的攻击。"}
{"title": "“安全服务”木马分析报告", "url": "https://www.freebuf.com/articles/network/141986.html", "time": "2017-07-31", "level": "现金奖励", "num_look": 455805, "num_comment": 12, "author": "暗影安全实验室", "tags": ["网络安全"], "text": "“安全服务”木马通过仿冒安全软件诱导用户下载以及安装运行，之后会在用户手机生成多个伪装正常应用的图标"}
{"title": "如何使用深度学习检测XSS", "url": "https://www.freebuf.com/news/142069.html", "time": "2017-07-31", "level": "现金奖励", "num_look": 952428, "num_comment": 24, "author": "foxscheduler", "tags": ["WEB安全", "资讯"], "text": "众所周知，深度学习在计算机视觉、自然语言处理、人工智能等领域取得了极大的进展，在安全领域也开始崭露头角走向了实际应用。"}
{"title": "美创科技招募售前技术工程师", "url": "https://www.freebuf.com/jobs/141611.html", "time": "2017-07-31", "level": "", "num_look": 235126, "num_comment": 6, "author": "杭州美创科技", "tags": ["安全招聘"], "text": "杭州美创科技有限公司是一家聚焦于数据管理和数据价值的发现与挖掘，围绕数据安全、容灾、集成、分析、运维等多方面铸造数据价值的企业。"}
{"title": "如何利用查表瓶颈，对抗口令Hash破解", "url": "https://www.freebuf.com/articles/database/141615.html", "time": "2017-07-31", "level": "金币+15", "num_look": 421900, "num_comment": 14, "author": "EtherDream", "tags": ["数据安全"], "text": "网站被拖库后，一些弱口令的 hash 很容易被破解还原。本文讲解一种新的存储方式，使攻击者跑 hash 变得更麻烦。"}
{"title": "FireEye发布免费恶意程序分析软件ToolBox", "url": "https://www.freebuf.com/news/142209.html", "time": "2017-07-31", "level": "", "num_look": 357776, "num_comment": 7, "author": "liki", "tags": ["工具", "资讯"], "text": "FireEye刚刚发布了一款软件，这款软件可用于构建完全定制化的虚拟机（VM），其中包含可用于恶意程序分析或其它网络安全相关任务的工具。"}
{"title": "联想Z470黑化之路：硬件升级还能刷苹果Mac系统！", "url": "https://www.freebuf.com/news/141522.html", "time": "2017-07-31", "level": "金币+15", "num_look": 655912, "num_comment": 20, "author": "nmask", "tags": ["极客", "资讯"], "text": "这其中最繁琐的要数装黑苹果系统，技术含量比较高，前2个比较好实现（只要花钱）。一顿操作，终于凑齐了所有所需之物，好了，那么便开始吧！"}
{"title": "信息收集工具recon-ng详细使用教程", "url": "https://www.freebuf.com/sectool/141544.html", "time": "2017-07-31", "level": "现金奖励", "num_look": 722350, "num_comment": 7, "author": "Cesign", "tags": ["工具"], "text": "Recon-ng在渗透过程中主要扮演信息收集工作的角色,同时也可以当作渗透工具，不过相关的攻击模块很少，只有自己扩展。"}
{"title": "Buf早餐铺 | 美国众议院国土通过2项新法案；银行木马Trickbot添加蠕虫传播模块；微信DDoS轰炸服务重出江湖", "url": "https://www.freebuf.com/news/142315.html", "time": "2017-07-31", "level": "", "num_look": 256195, "num_comment": 2, "author": "Elaine_z", "tags": ["资讯"], "text": "新的一周就要开始，不吃早餐怎么行，吃草怎么行！还是来 FreeBuf 一起来看看信息安全最新资讯和时事热点吧，唤醒你的身体和大脑吧。"}
{"title": "Android安全几道入门题目", "url": "https://www.freebuf.com/articles/terminal/139451.html", "time": "2017-07-30", "level": "金币+15", "num_look": 537217, "num_comment": 13, "author": "k00k00", "tags": ["终端安全"], "text": "本文通过几个题目可以让你基本了解android中简单的但比较经典的漏洞、以及简单的android注册机开发的思路。"}
{"title": "深度报道：乌克兰如何会沦为俄罗斯的网络战试验场", "url": "https://www.freebuf.com/news/141277.html", "time": "2017-07-30", "level": "红色标题", "num_look": 768764, "num_comment": 3, "author": "clouds", "tags": ["工控安全", "资讯"], "text": "当WannaCry勒索病毒余波未尽时，Petya又让欧美告急，乌克兰全国沦陷。乌克兰政府宣称其所受到的攻击规模“前所未见”，俄罗斯黑客就是攻击的“幕后黑手”。"}
{"title": "平安银行总行零售信息安全岗位招聘", "url": "https://www.freebuf.com/jobs/141583.html", "time": "2017-07-30", "level": "", "num_look": 406670, "num_comment": 5, "author": "平安银行应用安全团队", "tags": ["安全招聘"], "text": "平安银行股份有限公司是总部设在深圳的全国性股份制商业银行（深圳证券交易所简称：平安银行，证券代码000001）。"}
{"title": "NagaScan：针对Web应用的分布式被动扫描器", "url": "https://www.freebuf.com/vuls/141679.html", "time": "2017-07-30", "level": "", "num_look": 533652, "num_comment": 9, "author": "Alpha_h4ck", "tags": ["WEB安全", "漏洞"], "text": "今天给大家介绍的是一款名叫NagaScan的针对Web应用程序的分布式被动漏洞扫描器，NagaScan目前支持包括XSS、SQL注入、以及文件包含等漏洞。"}
{"title": "挖洞经验 | 看我如何通过子域名接管绕过Uber单点登录认证机制", "url": "https://www.freebuf.com/news/141630.html", "time": "2017-07-30", "level": "", "num_look": 409741, "num_comment": 2, "author": "clouds", "tags": ["资讯"], "text": ""}
{"title": "XSStrike：基于Python的XSS测试工具", "url": "https://www.freebuf.com/sectool/142044.html", "time": "2017-07-29", "level": "", "num_look": 801392, "num_comment": 24, "author": "鸢尾", "tags": ["工具"], "text": "XSStrike是一款用于探测并利用XSS漏洞的脚本"}
{"title": "挖洞经验 | 看我如何利用上传漏洞在PayPal服务器上实现RCE执行", "url": "https://www.freebuf.com/news/141418.html", "time": "2017-07-29", "level": "红色标题", "num_look": 512536, "num_comment": 4, "author": "clouds", "tags": ["漏洞", "资讯"], "text": "当你看到这篇文章标题时，是不是很吃惊，PayPal服务器的RCE漏洞？Dafaq？WTF？真的吗？这当然是真的，很幸运，我通过枚举和域名查找方法发现了该漏洞。"}
{"title": "使用windows文件审计检测honeyfile访问", "url": "https://www.freebuf.com/news/141215.html", "time": "2017-07-29", "level": "", "num_look": 373718, "num_comment": 2, "author": "secist", "tags": ["WEB安全", "资讯"], "text": "随着蜜罐技术的不断深入与成熟，蜜罐早已不再局限于传统的仿真操作系统和服务上了。如今蜜罐的形式和种类也越来越多样化和具有针对性。"}
{"title": "平安科技（深圳）信息安全与内控部安全产品团队招聘", "url": "https://www.freebuf.com/jobs/140592.html", "time": "2017-07-29", "level": "", "num_look": 331319, "num_comment": 1, "author": "foun", "tags": ["安全招聘"], "text": "平安科技是平安集团旗下的全资子公司，是平安集团的高科技内核。"}
{"title": "白帽子兴趣消退：“泥泞中”的苹果漏洞赏金计划", "url": "https://www.freebuf.com/news/140949.html", "time": "2017-07-29", "level": "", "num_look": 322872, "num_comment": 322872, "author": "饭团君", "tags": ["其他", "资讯"], "text": "苹果发布漏洞奖励计划近一年后，却鲜有听闻已有白帽黑客领取漏洞奖励，这种“怪现象”开始导致一些常为苹果公司提交高价值漏洞的安全研究人员开始保留漏洞而不提交官方。"}
{"title": "【FB TV】一周「BUF大事件」：2017BlackHat拉斯维加斯举办；北京警方端掉大型恶意软件开发团伙；瑞典史上最严重的政府数据泄露事件曝光", "url": "https://www.freebuf.com/video/142393.html", "time": "2017-07-29", "level": "红色标题", "num_look": 332684, "num_comment": 332684, "author": "willhuang", "tags": ["视频"], "text": "世界信息安全行业的最高盛会BlackHat在拉斯维加斯举办；北京警方端掉大型恶意软件开发团伙；瑞典史上最严重的政府数据泄露事件曝光，相关负责人遭到严厉处分。想要了解详细内容，请看本周的BUF大事件！"}
{"title": "攻击者侵入系统后如何提升账户权限：提权技术详细分析", "url": "https://www.freebuf.com/news/141335.html", "time": "2017-07-29", "level": "", "num_look": 619800, "num_comment": 6, "author": "secist", "tags": ["系统安全", "网络安全"], "text": ""}
{"title": "【BlackHat 2017】安全“两会”Black Hat与DEF CON大会这20年来的变迁：不只是规模在扩大", "url": "https://www.freebuf.com/special/142385.html", "time": "2017-07-28", "level": "红色标题", "num_look": 2104053, "num_comment": 1, "author": "欧阳洋葱", "tags": ["特别企划"], "text": "Black Hat与DEF CON都在本周进行，这两者在文化方面存在本质差异，后者比前者历史更悠久。在这20年的时间里，安全两会都经历了些什么？"}
{"title": "【BlackHat 2017】勒索软件未来的终极克星？研究人员发明ShieldFS文件系统", "url": "https://www.freebuf.com/news/142326.html", "time": "2017-07-28", "level": "红色标题", "num_look": 476993, "num_comment": 4, "author": "Sphinx", "tags": ["资讯"], "text": "来自意大利的研究人员开发了一种定制的一种文件系统，能够检测到勒索软件感染的迹象，终止恶意行为，并且把被加密的软件还原，成功率高达100%。"}
{"title": "维基解密每周一更：CIA三款工具齐上阵，Mac和Linux用户频躺枪", "url": "https://www.freebuf.com/news/142279.html", "time": "2017-07-28", "level": "", "num_look": 463824, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "本周，维基解密披露了 CIA 的另一个项目 Imperial 中的三款工具，主要针对运行 OS X 系统以及其他 Linux 系统的计算机，目的性较强。"}
{"title": "Lipizzan间谍软件：监控用户手机并窃取隐私", "url": "https://www.freebuf.com/news/142208.html", "time": "2017-07-28", "level": "", "num_look": 445202, "num_comment": 5, "author": "腾讯手机管家", "tags": ["工具", "资讯"], "text": "Google近期披露了一款名为Lipizzan的间谍软件家族(疑似采用的网络武器公司Equus Technologies的技术)试图监控用户的手机。"}
{"title": "关于一个macOS 10.12.2到macOS 10.12.6内核崩溃问题的思索", "url": "https://www.freebuf.com/news/141475.html", "time": "2017-07-28", "level": "现金奖励", "num_look": 347100, "num_comment": 1, "author": "GentleKnife", "tags": ["系统安全", "资讯"], "text": "我曾在macOS 10.12.6发布的当天凌晨给苹果安全部门去信，这几天交流下来，苹果安全部门的口吻是这不是个安全问题，所以秉承着这仅仅是个BUG的原则。"}
{"title": "彻底曝光黑客组织“隐匿者”，目前作恶最多的网络攻击团伙", "url": "https://www.freebuf.com/news/141644.html", "time": "2017-07-28", "level": "红色标题", "num_look": 621319, "num_comment": 9, "author": "火绒安全", "tags": ["安全报告", "资讯"], "text": "经过对大量的病毒攻击事件深入研究，火绒安全实验室挖掘出一个作恶累累的黑客犯罪团伙，并将其命名为\"隐匿者\"，该团伙可能由中国人组成或参与。"}
{"title": "CNNVD关于Microsoft Windows输入验证漏洞情况的通报", "url": "https://www.freebuf.com/news/142130.html", "time": "2017-07-28", "level": "", "num_look": 306411, "num_comment": 1, "author": "CNNVD", "tags": ["漏洞", "资讯"], "text": "Microsoft Windows输入验证漏洞（CNNVD-201706-561）存在于多个版本的Windows系统中，远程攻击者可借助特制的.LNK文件利用该漏洞执行任意代码。"}
{"title": "Petya变种勒索蠕虫启动代码分析", "url": "https://www.freebuf.com/news/142065.html", "time": "2017-07-28", "level": "", "num_look": 307629, "num_comment": 307629, "author": "奇安信威胁情报中心", "tags": ["系统安全", "资讯"], "text": "本文对Petya执行的MBR及文件系统的加密机制做详细的分析。"}
{"title": "墨云科技诚聘安全工程师、移动安全研究员", "url": "https://www.freebuf.com/jobs/140248.html", "time": "2017-07-28", "level": "", "num_look": 294497, "num_comment": 3, "author": "墨云科技", "tags": ["安全招聘"], "text": "北京墨云科技有限公司是中国新兴的网络安全服务厂商，由国内BAT360 公司顶尖的白帽子团队组成。"}
{"title": "色情广告挂马分析：记一次挂马与挖矿之间的“亲密接触”", "url": "https://www.freebuf.com/news/141589.html", "time": "2017-07-28", "level": "红色标题", "num_look": 618751, "num_comment": 13, "author": "腾讯电脑管家", "tags": ["WEB安全", "资讯"], "text": "腾讯安全反病毒实验室发现，有一类木马通过网页广告挂马的方式大规模传播。广告内容为色情链接，诱导用户点击。"}
{"title": "你还在关注勒索病毒？别人已经转行挖矿！", "url": "https://www.freebuf.com/news/141004.html", "time": "2017-07-28", "level": "红色标题", "num_look": 522811, "num_comment": 19, "author": "游戏安全实验室", "tags": ["WEB安全", "资讯"], "text": "近日，腾讯游戏安全中心捕获一款网吧内传播的恶意软件。原以为是常规的网吧盗号木马，但详细分析之后发现并非如此。"}
{"title": "Buf早餐铺 | 俄罗斯即将禁用VPN；微软漏洞奖金最高提升到25万美元；德国政府新款窃听工具曝光；上海一家公司收集手机用户隐私数据", "url": "https://www.freebuf.com/news/142128.html", "time": "2017-07-28", "level": "", "num_look": 259531, "num_comment": 6, "author": "欧阳洋葱", "tags": ["资讯"], "text": "Black Hat USA 2017黑帽大会进行中，不过国内外的安全事件也并没有停歇。"}
{"title": "【BlackHat 2017】美国黑客大会首日议题汇总，演讲PPT下载也在这里", "url": "https://www.freebuf.com/news/142159.html", "time": "2017-07-27", "level": "红色标题", "num_look": 689493, "num_comment": 19, "author": "AngelaY", "tags": ["活动", "资讯"], "text": "今年的 BHUSA 从北京时间 7 月 23 日开始，到北京时间 7 月 28 日结束。前四天照例是各种 Training，而最后两天则是干货满满的各类 Briefing 分享"}
{"title": "CNNVD关于Apache Tomcat安全绕过漏洞情况的通报", "url": "https://www.freebuf.com/news/142009.html", "time": "2017-07-27", "level": "", "num_look": 367931, "num_comment": 4, "author": "CNNVD", "tags": ["资讯"], "text": "近日，国家信息安全漏洞库（CNNVD）收到关于ApacheTomcat安全绕过漏洞情况的报送。攻击者可利用该漏洞绕过安全限制，执行未授权的操作。"}
{"title": "【BlackHat 2017】机器学习对抗机器学习：攻防的新一轮猫鼠游戏", "url": "https://www.freebuf.com/articles/network/141877.html", "time": "2017-07-27", "level": "红色标题", "num_look": 741336, "num_comment": 741336, "author": "AngelaY", "tags": ["特别企划", "网络安全"], "text": "人工智能目前多以机器学习的方式实现，正成为信息安全领域炙手可热的技术。但有专家在 Black Hat USA 2017 大会上指出，机器学习虽然有助于网络安全发展，但并非银弹。"}
{"title": "不老的神器：安全扫描器Nmap渗透使用指南", "url": "https://www.freebuf.com/news/141607.html", "time": "2017-07-27", "level": "现金奖励", "num_look": 1218713, "num_comment": 26, "author": "国光", "tags": ["工具", "资讯"], "text": "nmap是用来探测计算机网络上的主机和服务的一种安全扫描器。为了绘制网络拓扑图Nmap的发送特制的数据包到目标主机然后对返回数据包进行分析。"}
{"title": "旧瓶新酒之ngx_lua & fail2ban实现主动诱捕", "url": "https://www.freebuf.com/news/141469.html", "time": "2017-07-27", "level": "金币+15", "num_look": 250562, "num_comment": 11, "author": "悬镜安全实验室", "tags": ["WEB安全", "资讯"], "text": "本篇原创文章来自悬镜安全实验室，主要通过介绍ngx_lua & fail2ban实现主动诱捕从而达到主机防护的效果。"}
{"title": "实时追踪上百万个手机是种怎样的体验？", "url": "https://www.freebuf.com/news/141114.html", "time": "2017-07-27", "level": "金币+15", "num_look": 771628, "num_comment": 14, "author": "hey你的拔粪宝", "tags": ["无线安全", "终端安全"], "text": "首先要阐明清楚，我们在这里谈的不是如何追踪你丢失的手机，而是追踪每一个人的手机！其实我觉得这件事难度不大，甚至异常简单，所以人们应该意识到这件事的影响。"}
{"title": "安天移动安全联合猎豹揭秘无形之贼Dosoft免杀病毒", "url": "https://www.freebuf.com/articles/system/141564.html", "time": "2017-07-27", "level": "", "num_look": 313172, "num_comment": 1, "author": "AVLTeam", "tags": ["安全报告", "系统安全"], "text": "网络安全的核心本质是攻防对抗。当安全工作者使用手上的安全武器保卫网络安全时，恶意攻击者也在想方设法予以对抗、夹缝求生。"}
{"title": "百度云诚招安全及安全研发人才（含实习）", "url": "https://www.freebuf.com/jobs/140053.html", "time": "2017-07-27", "level": "", "num_look": 259705, "num_comment": 7, "author": "bdy_sec", "tags": ["安全招聘"], "text": "百度云是百度进入中国企业级市场的平台级入口，把百度的先进技术、互联网能力以及生态开放给企业客户。现招聘安全人才。"}
{"title": "一个利用“永恒之蓝”漏洞传播的挖矿程序分析", "url": "https://www.freebuf.com/news/141011.html", "time": "2017-07-27", "level": "现金奖励", "num_look": 504581, "num_comment": 7, "author": "安全豹", "tags": ["系统安全", "资讯"], "text": "近日，渔村安全团队追踪到一个利用永恒之蓝漏洞传播的挖矿程序，其具备高度的模块化和较强的传播能力，在短短数日就感染了数万台用户电脑。"}
{"title": "逆向分析智能窗帘频射协议", "url": "https://www.freebuf.com/geek/141214.html", "time": "2017-07-27", "level": "", "num_look": 284419, "num_comment": 8, "author": "鸢尾", "tags": ["极客"], "text": "近来我热衷于对家庭自动化设备的破解，然后将它们添加到我的Homekit集成包之中。"}
{"title": "修改Metasploit安卓Payload源码以实现持久化访问", "url": "https://www.freebuf.com/sectool/141234.html", "time": "2017-07-27", "level": "现金奖励", "num_look": 449110, "num_comment": 20, "author": "xiaohuanshu", "tags": ["工具"], "text": "Metasploit-Payload是广泛使用的安卓后门之一，然而无论是直接使用msfvenom生成的apk文件，还是通过其他手段将payload注入到已有apk中，其连接稳定性都非常差"}
{"title": "Buf早餐铺 | Adobe计划砍掉Flash；IBM X-Force Red团队为汽车和IoT推出安全测试服务；Roomba扫地机器人即将出售你家地图", "url": "https://www.freebuf.com/news/141927.html", "time": "2017-07-27", "level": "", "num_look": 174917, "num_comment": 174917, "author": "Sphinx", "tags": ["资讯"], "text": "喜大普奔：Adobe终于计划砍掉Flash啦！"}
{"title": "【已结束】“Web扫描那些事儿”「直播传送门」 | FreeBuf公开课", "url": "http://tophant.gensee.com/webcast/site/entry/join-cbc511a16509499dba4f57b80b6fab55", "time": "2017-07-26", "level": "红色标题", "num_look": 71056, "num_comment": 71056, "author": "FB客服", "tags": ["视频"], "text": "讲师刘漩将根据其多年工作经验，站在安全和开发的双重角度，呈现一堂生动的Web扫描课。输入FreeBuf ID看直播参与互动，将有机会获得《白帽子讲Web扫描》赠书1册。"}
{"title": "“异鬼Ⅱ”Bootkit木马详细分析", "url": "https://www.freebuf.com/articles/web/141633.html", "time": "2017-07-26", "level": "红色标题", "num_look": 714379, "num_comment": 16, "author": "腾讯电脑管家", "tags": ["WEB安全", "系统安全"], "text": "下载站的高速下载器一直是恶意木马大规模传播的温床，前段时间的暗云Ⅲ木马通过高速下载器传播推广，感染机器数高达数百万台。"}
{"title": "【BlackHat 2017】议题分享：一款潜伏了多年的Mac恶意程序，为何迄今仍“逍遥法外”？", "url": "https://www.freebuf.com/articles/system/141880.html", "time": "2017-07-26", "level": "", "num_look": 332227, "num_comment": 2, "author": "欧阳洋葱", "tags": ["系统安全"], "text": "前NSA分析师，Patrick Wardle很快将会在Black Hat分享议题 《主动恶意程序分析：通过一台 C&C 服务器来解剖 OSX/Fruitfly》，对恶意程序分析感兴趣的别错过。"}
{"title": "一个生成各种进制格式IP的小工具（附源码）", "url": "https://www.freebuf.com/sectool/140982.html", "time": "2017-07-26", "level": "", "num_look": 495712, "num_comment": 9, "author": "knpewg85942", "tags": ["工具"], "text": "我们在测试系统是否有SSRF漏洞的时候，有时候需要尝试各种进制的IP组合，看看是否能绕过系统的防护，于是就有了本文的这个小程序。"}
{"title": "对赛格威miniPRO平衡车的漏洞研究", "url": "https://www.freebuf.com/news/141219.html", "time": "2017-07-26", "level": "", "num_look": 335863, "num_comment": 1, "author": "柚子", "tags": ["终端安全", "资讯"], "text": "Segway miniPRO电动平衡车存在关键安全漏洞，恶意攻击者利用漏洞可完全控制平衡车。"}
{"title": "反击“猫眼电影”网站的反爬虫策略", "url": "https://www.freebuf.com/news/140965.html", "time": "2017-07-26", "level": "现金奖励", "num_look": 669078, "num_comment": 12, "author": "数月亮的孩子", "tags": ["WEB安全", "资讯"], "text": "从功能上来讲，爬虫一般分为数据采集，处理，储存三个部分。而作为程序员的我们只关心数据采集部分，处理什么的还是交给那些数据分析师去搞吧。"}
{"title": "模仿WannaCry的安卓勒索软件SLocker源码现已公开", "url": "https://www.freebuf.com/news/141546.html", "time": "2017-07-26", "level": "", "num_look": 323941, "num_comment": 1, "author": "hey你的拔粪宝", "tags": ["资讯"], "text": "SLocker勒索软件的源码目前已经在GitHub上泄露，其可被用于开发出更高级的或定制化的勒索软件变种来进行网络犯罪"}
{"title": "揭秘奸商的伎俩：利用树莓派自制“恶意充电宝”实验", "url": "https://www.freebuf.com/articles/others-articles/141569.html", "time": "2017-07-26", "level": "现金奖励", "num_look": 914411, "num_comment": 30, "author": "网络安全通", "tags": ["其他", "极客"], "text": "作为网络安全维护者的我们，为了防止更多的人上当，我们要坚决地披露这种行为。"}
{"title": "Buf早餐铺 | 英国年初向土耳其出口监控设备；Veritaseum 被盗价值840万美元以太币； SLocker 源码泄露；警方打击“火球”团伙卿烨科技", "url": "https://www.freebuf.com/news/141681.html", "time": "2017-07-26", "level": "", "num_look": 310215, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "高温酷暑，催人心焦。何以解忧，唯有早报。不论是国内的异军突起的“海淀网友”还是国外谷歌新推出的安全服务；不论是以太币再次被窃取还是大规模数据泄露，都值得关注"}
{"title": "2017 BlackHat 美国黑帽大会图文直播（北京时间7月25日23:30 到 7月28日9:00）", "url": "https://www.freebuf.com/fevents/141559.html", "time": "2017-07-26", "level": "红色标题", "num_look": 660686, "num_comment": 17, "author": "AngelaY", "tags": ["活动"], "text": "2017 BlackHat 美国黑帽大会主会场内容分享将于北京时间 7 月 26 日 23:00 - 7 月 28 日 9:00 在拉斯维加斯举行。关于主会场分享的精彩内容也会在在 FreeBuf 上进行图文直播。"}
{"title": "Burp Suite扫描器漏洞扫描功能介绍及简单教程", "url": "https://www.freebuf.com/sectool/141435.html", "time": "2017-07-25", "level": "现金奖励", "num_look": 1446361, "num_comment": 15, "author": "pageuo", "tags": ["工具"], "text": "burp suite也提供了一个扫描器的功能，但似乎国内并没有step by step的一个教程，这里给大家简单的介绍下burp suite的漏扫功能。"}
{"title": "HTTPS真的就是安全的象征吗？HTTPS检查工具带来的安全威胁", "url": "https://www.freebuf.com/news/136565.html", "time": "2017-07-25", "level": "", "num_look": 454611, "num_comment": 2, "author": "Sphinx", "tags": ["WEB安全", "特别企划"], "text": "近日US-CERT发布了一则预警对部分HTTPS检查产品发出安全预警，提到部分SSL/TLS拦截软件未能执行有效验证，或者未能充分传递验证状态，这可能被第三方发动中间人攻击。"}
{"title": "如何检测用USB创建并进行类似Stuxnet传播的隐蔽网络", "url": "https://www.freebuf.com/news/140930.html", "time": "2017-07-25", "level": "", "num_look": 349596, "num_comment": 349596, "author": "clouds", "tags": ["系统安全", "资讯"], "text": "本文通过分析利用USB设备创建的隐蔽网络可能性，对其检测和防护方法作出介绍。"}
{"title": "AlphaBay是怎么垮掉的？解密全球最大黑市AlphaBay被查封全过程", "url": "https://www.freebuf.com/news/141308.html", "time": "2017-07-25", "level": "金币+6", "num_look": 866624, "num_comment": 20, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "又一大暗网市场AlphaBay倒下了，而更加悲剧的是，该网站背后的主谋竟在监狱中自杀了……"}
{"title": "社交平台上的桃色陷阱：僵尸网络SIREN侵袭Twitter", "url": "https://www.freebuf.com/news/141074.html", "time": "2017-07-25", "level": "", "num_look": 375094, "num_comment": 1, "author": "Carrie_spinfo", "tags": ["网络安全", "资讯"], "text": "近年来，越来越多的恶意攻击者盯上了各大社交媒体。这些社交平台由于使用便捷、可扩展性强、自动化程度高，受众面广泛等特性，为攻击者发起僵尸网络攻击提供了得天独厚的条件。"}
{"title": "美团金融招聘高级安全人才（北京、上海)", "url": "https://www.freebuf.com/jobs/140080.html", "time": "2017-07-25", "level": "", "num_look": 303798, "num_comment": 19, "author": "f-offsec", "tags": ["安全招聘"], "text": "作为美团点评战略重点业务之一，金融服务平台致力为用户及商家提供全面、高效、稳定、极致的金融服务，安全招聘啦！"}
{"title": "Flash漏洞利用之“喜闻乐见”", "url": "https://www.freebuf.com/vuls/141405.html", "time": "2017-07-25", "level": "金币+6", "num_look": 415569, "num_comment": 5, "author": "tigerlab", "tags": ["漏洞"], "text": "之前，我们讲了二进制漏洞的攻防对抗过程，这回书，我们着重展示下Flash漏洞利用的“喜闻乐见”。"}
{"title": "一起针对蓄电池等制造企业的“蓄力”APT攻击", "url": "https://www.freebuf.com/news/140898.html", "time": "2017-07-25", "level": "", "num_look": 310095, "num_comment": 13, "author": "腾讯电脑管家", "tags": ["系统安全", "资讯"], "text": "2017年7月，腾讯安全反病毒实验室发现了一批行为可疑的邮件，收件方的邮箱地址指向一些欧美大型制造业公司。"}
{"title": "无线键盘易被监听，不知不觉导致信息泄露", "url": "https://www.freebuf.com/geek/140951.html", "time": "2017-07-25", "level": "现金奖励", "num_look": 551401, "num_comment": 13, "author": "网络安全通", "tags": ["极客", "网络安全"], "text": "作为无线键鼠攻击的下篇，本文对采集到的无线电信号进行分析，推导出用户按下了键盘上的哪些键！实施完整的键盘监听攻击。"}
{"title": "获取来源IP地址的正确姿势", "url": "https://www.freebuf.com/articles/web/140669.html", "time": "2017-07-25", "level": "现金奖励", "num_look": 1046988, "num_comment": 30, "author": "戒贤", "tags": ["WEB安全"], "text": "建模完成之后，迫不及待地让同事帮忙把数据提取出来，进行人工审核评估，却发现结果中有很多很多保留IP，心里哇凉哇凉的。"}
{"title": "Buf早餐铺 | 俄罗斯收紧互联网访问政策；匈牙利起诉白帽被4.5万人刷差评；第二大暗网黑市Dream Market也有政府暗门", "url": "https://www.freebuf.com/news/141433.html", "time": "2017-07-25", "level": "", "num_look": 379428, "num_comment": 1, "author": "Elaine_z", "tags": ["资讯"], "text": "大暑节气，不见秋气初生，只觉热浪灼人。趁着早晨时间浏览新闻，我们看到新一天国内国外也发生了各种称不上匪夷所思但也算得上妙趣横生的新闻了"}
{"title": "Vmware虚拟机逃逸漏洞（CVE-2017-4901）Exploit代码分析与利用", "url": "https://www.freebuf.com/news/141442.html", "time": "2017-07-24", "level": "现金奖励", "num_look": 830623, "num_comment": 8, "author": "任子行", "tags": ["系统安全", "资讯"], "text": "2017年7月19 unamer在其github上发布了一个针对Vmware的虚拟机逃逸的exploit源码，使用C++编写。据称影响了Vmware Workstation 12.5.5以前的版本。"}
{"title": "【已结束】FreeBuf公开课直播：Web扫描那些事儿", "url": "https://www.freebuf.com/news/141495.html", "time": "2017-07-24", "level": "红色标题", "num_look": 516651, "num_comment": 97, "author": "FB客服", "tags": ["视频", "资讯"], "text": "本期FreeBuf公开课将从Web 扫描的基础知识讲起，结合多年的安全工作经验，站在安全和开发的双重角度，力求为大家呈现一个生动的Web 扫描知识体系。"}
{"title": "瑞典政府顶级机密数据泄露：或危及国家安全，但当事人只被罚了 8500 美元？", "url": "https://www.freebuf.com/news/141427.html", "time": "2017-07-24", "level": "", "num_look": 547383, "num_comment": 4, "author": "AngelaY", "tags": ["数据安全", "资讯"], "text": "这起数据泄露涉及瑞典交通局的军方顶级机密，总影响国民达上百万。瑞典有关部门表示，这些泄露的数据可能会被其他国家获取，用于信息战争，甚至危害国家安全。"}
{"title": "htcap：一款实用的递归型Web漏洞扫描工具", "url": "https://www.freebuf.com/sectool/140873.html", "time": "2017-07-24", "level": "", "num_look": 550001, "num_comment": 7, "author": "Alpha_h4ck", "tags": ["WEB安全", "工具"], "text": "今天给大家介绍的是一款名叫 htcap 的开源 Web 漏洞扫描工具，它通过拦截 AJAX 调用和页面 DOM 结构的变化并采用递归的形式来爬取单页面应用（SPA）。"}
{"title": "观点 | 全球最大航运企业马士基被黑事件之“痛煞我也”", "url": "https://www.freebuf.com/news/140919.html", "time": "2017-07-24", "level": "金币+6", "num_look": 569258, "num_comment": 5, "author": "langyajiekou", "tags": ["企业安全", "观点"], "text": "6月27日，一种类似于“WannaCry”的新型勒索病毒“Petya”席卷欧洲，其网络攻击范围已从俄罗斯和乌克兰，迅速遍及全球。"}
{"title": "GNOME Files中的Bad Taste漏洞将允许攻击者通过恶意Windows MSI文件攻击Linux系统", "url": "https://www.freebuf.com/news/141031.html", "time": "2017-07-24", "level": "", "num_look": 231248, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "如果你觉得Windows可执行程序无法对Windows电脑造成足够的伤害，那你现在可以尝试通过构造恶意MSI文件来攻击Linux系统了。"}
{"title": "中国平安人寿招聘安全人才", "url": "https://www.freebuf.com/jobs/140300.html", "time": "2017-07-24", "level": "", "num_look": 376842, "num_comment": 30, "author": "风若新", "tags": ["安全招聘"], "text": "中国平安人寿保险股份有限公司成立于2002年，是中国平安保险（集团）股份有限公司旗下的重要成员，开始安全招聘啦！"}
{"title": "QQ定位女友是否回家系列二之定位系统的打造", "url": "https://www.freebuf.com/news/141038.html", "time": "2017-07-24", "level": "金币+15", "num_look": 727383, "num_comment": 44, "author": "刀郎", "tags": ["其他", "资讯"], "text": "上一篇大家讨论得很激烈嘛，这篇接着水！前文中遇到二个问题，问题一：不能同时定位多人；问题二：发送构造页面给女友，但是女友点击后看不到感兴趣的内容，容易产生怀疑。"}
{"title": "BadUSB防御初探", "url": "https://www.freebuf.com/articles/terminal/140619.html", "time": "2017-07-24", "level": "金币+15", "num_look": 429427, "num_comment": 9, "author": "CLAY_CY", "tags": ["极客", "终端安全"], "text": "有关 BadUSB 的防御的中文内容实在有限，且多为建议。笔者受一篇国外技术性文章的启发，对其进行翻译，改进，并增加一些必要的补充，尝试对 windows 环境下的 BadUSB 的具体防御方法进行探究。"}
{"title": "一个函数破解Geetest滑动验证码", "url": "https://www.freebuf.com/articles/web/140693.html", "time": "2017-07-24", "level": "现金奖励", "num_look": 863352, "num_comment": 21, "author": "manwu91", "tags": ["WEB安全"], "text": "本文主要讨论极验滑动验证码的轨迹生成，关于js加密请参见之前的文章。"}
{"title": "BUF早餐铺 | 国际版小米9号平衡车曝严重漏洞；微软将Fancy Bear黑客组织告上法庭；Tor发布漏洞奖励计划", "url": "https://www.freebuf.com/news/141322.html", "time": "2017-07-24", "level": "", "num_look": 245569, "num_comment": 245569, "author": "欧阳洋葱", "tags": ["资讯"], "text": "AlphaBay黑市被查封了的这些天，FreeBuf编辑部周围的气温已经在 40℃ 上下徘徊，只消走出编辑部5分钟，投入周一之前先来光顾一下今天的BUF早餐铺吧。"}
{"title": "【BlackHat 2017】小米9号平衡车国际版存在严重安全漏洞可被攻击者远程控制", "url": "https://www.freebuf.com/news/141341.html", "time": "2017-07-23", "level": "金币+15", "num_look": 546733, "num_comment": 3, "author": "clouds", "tags": ["漏洞", "终端安全"], "text": "安全研究机构IOActive研究员发现了小米生态链企业Segway&Ninebot制造的miniPRO平衡车存在多个关键安全漏洞，可导致严重影响。"}
{"title": "Nexusguard（耐誉斯凯）招聘网络安全高级研发工程师（System）", "url": "https://www.freebuf.com/jobs/141027.html", "time": "2017-07-23", "level": "", "num_look": 322700, "num_comment": 3, "author": "NXG_HR", "tags": ["安全招聘"], "text": "在防御全球DDoS（分散式阻断服务）攻击的领域，Nexusguard 长期位于领先地位，一直站在对抗网络恶意攻击的最前线，保护全球组织的网站、服务和信誉免于来自网络的威胁。"}
{"title": "CVE-2017-4918：VMware Horizon的macOS客户端代码注入漏洞分析", "url": "https://www.freebuf.com/vuls/140672.html", "time": "2017-07-23", "level": "", "num_look": 359319, "num_comment": 359319, "author": "鸢尾", "tags": ["漏洞"], "text": "本文我们将探讨如何通过VMware Horizon macOS客户端版本4.4.0 (5164329)中存在的代码注入漏洞获取本地root权限。"}
{"title": "如何做一个完全体的阿尔法狗", "url": "https://www.freebuf.com/news/140586.html", "time": "2017-07-23", "level": "红色标题", "num_look": 384034, "num_comment": 9, "author": "饭团君", "tags": ["极客", "资讯"], "text": "当时坐在李世石对面的是人而非机器，是否会在无意间对其造成影响？于是我打算做一个完全自动下棋的机器人。"}
{"title": "2017第二届中国信息安全服务年会：多方解读国家政策，推进网络安全法与关键信息基础设施保护落地", "url": "https://www.freebuf.com/news/141270.html", "time": "2017-07-22", "level": "", "num_look": 413951, "num_comment": 7, "author": "Elaine_z", "tags": ["活动", "资讯"], "text": "网络安全防护保障体系下的厂商、服务商、相关单位又能怎样为新形势下的国家信息安全、关键基础设施、工控安全发挥新的力量呢"}
{"title": "King Phisher：一款专业的钓鱼活动工具包", "url": "https://www.freebuf.com/sectool/140863.html", "time": "2017-07-22", "level": "", "num_look": 522727, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫King Phisher的网络钓鱼测试工具，它可以通过模拟现实世界中的钓鱼攻击来提升普通用户的网络安全意识。"}
{"title": "CNNVD“洞察安全”合作计划示范高校授牌仪式圆满举办", "url": "https://www.freebuf.com/news/141216.html", "time": "2017-07-22", "level": "", "num_look": 252850, "num_comment": 1, "author": "CNNVD", "tags": ["资讯"], "text": "国家信息安全漏洞库运行管理中心正式启动“洞察安全”合作计划,并于2017年7月21日在教育部产学合作协同育人项目高峰论坛上,向10所示范高校颁发了证书并授予铜牌。"}
{"title": "【FB TV】一周「BUF大事件」：警方打掉市面上最大打码平台挖掘出一个全链条黑产；思科WebEx视频会议插件再度发现严重RCE漏洞；维基解密又曝CIA新工具", "url": "https://www.freebuf.com/video/141235.html", "time": "2017-07-22", "level": "红色标题", "num_look": 383953, "num_comment": 4, "author": "willhuang", "tags": ["视频"], "text": "警方打掉市面上最大打码平台挖掘出一个全链条黑产；思科WebEx视频会议插件再度发现严重RCE漏洞；维基解密又曝CIA新工具。"}
{"title": "Windows Server 2008将在今年具备TLS 1.2功能", "url": "https://www.freebuf.com/news/140741.html", "time": "2017-07-22", "level": "", "num_look": 347235, "num_comment": 1, "author": "SSLChina", "tags": ["网络安全", "资讯"], "text": "万众期待的TLS1.3即将正式上线，但对于世界上大多数使用互联网的地方而言，支持TLS1.3可能为时尚早。"}
{"title": "移动互联网勒索现象研究报告", "url": "https://www.freebuf.com/news/140553.html", "time": "2017-07-22", "level": "金币+15", "num_look": 471096, "num_comment": 3, "author": "暗影安全实验室", "tags": ["安全报告", "终端安全"], "text": "通过“呼死你”软件不断的向目标用户拨打骚扰电话，使用户无法正常使用手机，然后进行勒索；通过“撞库”筛选有效的账户信息，迫使用户无法正常使用手机进行勒索……"}
{"title": "GitHub现VMware虚拟机逃逸EXP，利用三月曝光的CVE-2017-4901漏洞", "url": "https://www.freebuf.com/articles/system/141179.html", "time": "2017-07-21", "level": "红色标题", "num_look": 849298, "num_comment": 16, "author": "Sphinx", "tags": ["系统安全"], "text": "近日，有人在GitHub上公布了一个VMWare虚拟机逃逸利用工具，它能够攻击12.5.5版本之前的VMware WorkStation。"}
{"title": "路由器固件安全分析技术（二）", "url": "https://www.vulbox.com/knowledge/detail/?id=42", "time": "2017-07-21", "level": "", "num_look": 21396, "num_comment": 21396, "author": "Akane", "tags": ["无线安全"], "text": "本文为系列文章之二，实战一个真实路由器存在的栈溢出漏洞。"}
{"title": "锁定注册表键的“乐趣”", "url": "https://www.freebuf.com/articles/system/140946.html", "time": "2017-07-21", "level": "", "num_look": 506825, "num_comment": 506825, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "假如说你的注册表中有一些非常重要的注册表键，你肯定不希望别人随意修改或删除它们，那你应该怎么办呢？"}
{"title": "探索如何防御恶意bot流量", "url": "https://www.freebuf.com/articles/web/140775.html", "time": "2017-07-21", "level": "金币+15", "num_look": 513151, "num_comment": 7, "author": "UCloud", "tags": ["WEB安全"], "text": "互联网安全公司 Imperva Incapsula 公布的《2016年机器流量报告》（Bot Traffic Report 2016）显示恶意 bot 流量占整体网络流量的比例高达 28.9% 。"}
{"title": "爆破非默认Base64编码表", "url": "https://www.freebuf.com/articles/database/140773.html", "time": "2017-07-21", "level": "现金奖励", "num_look": 710747, "num_comment": 13, "author": "刀郎", "tags": ["数据安全"], "text": "我给 base64Table 替换了，最后的编码结果就变了。遇到这种情况，就要寻找编码表，此时如果 Base64 被代码虚拟化了，怎么办？"}
{"title": "你想要的都在这里！限时免费申请XPwn 2017入场券", "url": "https://www.freebuf.com/fevents/141225.html", "time": "2017-07-21", "level": "", "num_look": 268675, "num_comment": 268675, "author": "cindy", "tags": ["活动"], "text": "XPwn未来安全探索盛会由XCon组委会和北京未来安全信息技术有限公司联合主办，一年一次，如约而至。"}
{"title": "太平保险集团招聘应用安全管理岗（上海）", "url": "https://www.freebuf.com/jobs/140016.html", "time": "2017-07-21", "level": "", "num_look": 318380, "num_comment": 5, "author": "太平保险", "tags": ["安全招聘"], "text": "太平集团一直以来非常重视企业信息安全，投入了大量资源进行信息安全建设，共享中心作为集团的共享运营与信息技术服务平台，热切期望广大人才加盟。"}
{"title": "精彩盘点：2017网络安全法及关键信息基础设施保护培训会", "url": "https://www.freebuf.com/news/141145.html", "time": "2017-07-21", "level": "", "num_look": 389845, "num_comment": 3, "author": "Elaine_z", "tags": ["活动", "资讯"], "text": "人类世界的纷争，似乎永不停歇，这是否是文明繁衍无法避免的伤痛，还只是走向未来新世界黎明前的曙光，我们无从而知，但必须学会保护自己。"}
{"title": "浅析PyCmd加密隐形木马", "url": "https://www.freebuf.com/sectool/140421.html", "time": "2017-07-21", "level": "金币+15", "num_look": 373858, "num_comment": 3, "author": "nmask", "tags": ["工具"], "text": "之前写了一个基于python的一句话木马客户端程序，这个程序的作用大致就是为了绕过防护设备"}
{"title": "BUF早餐铺 | Linux GNOME曝代码执行漏洞；VMware逃逸exp公布；Oracle修复308个漏洞创纪录；Firefox账户系统现15个安全问题", "url": "https://www.freebuf.com/news/141080.html", "time": "2017-07-21", "level": "红色标题", "num_look": 250840, "num_comment": 250840, "author": "Sphinx", "tags": ["资讯"], "text": "这里是 Buf 早餐铺，每天带给你一天的活力，和您一起迎接新一天的挑战！"}
{"title": "Vault 7系列“阴影”项目曝光：雷神公司暗中为CIA提供恶意程序分析", "url": "https://www.freebuf.com/news/141003.html", "time": "2017-07-20", "level": "红色标题", "num_look": 513514, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "本周，维基解密照例披露了Vault 7系列文件，涉及 CIA “阴影”（UMBRAGE）项目以及在项目中CIA 承包商 Raytheon Blackbird Technologies 给出的恶意程序分析"}
{"title": "这款安卓后门GhostCtrl可能是“史上功能最多”的后门", "url": "https://www.freebuf.com/articles/terminal/140916.html", "time": "2017-07-20", "level": "", "num_look": 391102, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "这个世界上从来都不缺Android恶意软件，但我们却很少能够遇到像GhostCtrl后门这种功能如此之多的Android安全威胁。"}
{"title": "以针对Yahoo! 的安全测试为例讲解如何高效的进行子域名收集与筛选", "url": "https://www.freebuf.com/articles/network/140738.html", "time": "2017-07-20", "level": "", "num_look": 398184, "num_comment": 6, "author": "鸢尾", "tags": ["网络安全"], "text": "平常我在Hackerone平台上寻找新目标时，常常会关注厂商响应信息，如果厂商响应越积极我就越感兴趣"}
{"title": "云鼎实验室 | 在“云”端可实现更多安全构想", "url": "https://www.freebuf.com/articles/people/140692.html", "time": "2017-07-20", "level": "", "num_look": 346086, "num_comment": 2, "author": "云鼎实验室", "tags": ["人物志"], "text": "我们的网络世界正在变得越来越危险吗？记者近日采访了腾讯云鼎实验室负责人董志强，在他看来，在网络安全领域，黑客与“白帽子”之间的攻防对抗越来越激烈，但普通用户只要对网络安全有基本的重视，及时更新补丁和杀…"}
{"title": "安全专家竟从电脑的电磁辐射中恢复出了AES256加密密钥", "url": "https://www.freebuf.com/news/140890.html", "time": "2017-07-20", "level": "", "num_look": 464071, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["数据安全", "资讯"], "text": "你可别小看这台设备，因为它可以根据附近电脑发出的电磁辐射来推导出加密密钥。"}
{"title": "绿盟科技招聘安全技术顾问", "url": "https://www.freebuf.com/jobs/139547.html", "time": "2017-07-20", "level": "", "num_look": 327821, "num_comment": 12, "author": "yiyuxuan2009", "tags": ["安全招聘"], "text": "北京神州绿盟信息安全科技股份有限公司（以下简称绿盟科技）成立于2000年4月，总部位于北京。现招聘安全技术顾问。"}
{"title": "物联网安全防护框架与评估模型", "url": "https://www.freebuf.com/articles/ics-articles/140455.html", "time": "2017-07-20", "level": "", "num_look": 637585, "num_comment": 637585, "author": "Carrie_spinfo", "tags": ["工控安全"], "text": "本文将从物联网系统的开发过程和开发完成后的安全评估两方面来论述物联网安全防护的应对措施与建议。"}
{"title": "安全运维之如何将Linux历史命令记录发往远程Rsyslog服务器", "url": "https://www.freebuf.com/articles/system/140543.html", "time": "2017-07-20", "level": "现金奖励", "num_look": 553125, "num_comment": 17, "author": "knpewg85942", "tags": ["系统安全"], "text": "在谁动了我的主机? 之活用History命令|Linux安全运维一文中，作者已经演示了如何将history 命令记录发往本地Rsyslog，本文会介绍将Linux history 记录发往远程Rsyslog 服务器的2种方法。"}
{"title": "重放攻击无线键盘实验，篡改你的输入信息", "url": "https://www.freebuf.com/geek/140837.html", "time": "2017-07-20", "level": "现金奖励", "num_look": 710825, "num_comment": 22, "author": "网络安全通", "tags": ["极客", "网络安全"], "text": "对目前热卖的无线键鼠进行研究之后发现，在无线键鼠和适配器的通讯过程中存在很大的安全漏洞，用户的输入很容易遭受到篡改，造成安全威胁。"}
{"title": "BUF早餐铺 | FedEx年报显示NotPetya事件影响；百度网盘被曝泄露用户数据；FreeRADIUS又曝出15个漏洞；gSOAP漏洞致大量IoT设备遭殃", "url": "https://www.freebuf.com/news/140862.html", "time": "2017-07-20", "level": "红色标题", "num_look": 364958, "num_comment": 2, "author": "Elaine_z", "tags": ["资讯"], "text": "今日的资讯不仅囊括国际时事热点，同时也包含国内安全精要"}
{"title": "gSOAP开源软件开发库曝“绿萝”漏洞，数百万IoT设备岌岌可危", "url": "https://www.freebuf.com/news/140878.html", "time": "2017-07-19", "level": "红色标题", "num_look": 409550, "num_comment": 409550, "author": "AngelaY", "tags": ["终端安全", "资讯"], "text": "安全研究员发现大量 IoT 设备开发者所使用的开源软件开发库 gSOAP 中出现了一个严重的远程代码执行漏洞（Devil's Ivy），可能会影响数百万 IoT 设备。"}
{"title": "WinPayloads：一个可以绕过安全检查的Windowspayload生成器", "url": "https://www.freebuf.com/sectool/140794.html", "time": "2017-07-19", "level": "", "num_look": 433249, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫WinPayloads的Payload生成器，这款工具使用了metasploits meterpreter shellcode。"}
{"title": "通过gpg签名来防止伪造的github commits", "url": "https://www.freebuf.com/news/140413.html", "time": "2017-07-19", "level": "金币+10", "num_look": 361524, "num_comment": 361524, "author": "knpewg85942", "tags": ["网络安全", "资讯"], "text": "在nVisium 公司内部，我们都使用Git办公，我们经常使用github来托管我们的源码。 我们有很多客户也是通过git来管理他们程序的源码。"}
{"title": "浅谈网络安全服务行业现状与展望", "url": "https://www.freebuf.com/news/140214.html", "time": "2017-07-19", "level": "红色标题", "num_look": 383548, "num_comment": 7, "author": "Carrie_spinfo", "tags": ["其他", "资讯"], "text": "两个问题是：您对网络安全行业的个人见解与对未来网络安全行业的展望。"}
{"title": "如何利用密码学以及数论基础攻击一个“宣称安全”的密码系统", "url": "https://www.freebuf.com/articles/database/138060.html", "time": "2017-07-19", "level": "金币+10", "num_look": 424161, "num_comment": 3, "author": "TedZhang", "tags": ["数据安全"], "text": "今天我们讨论如何利用密码学以及数论基础攻击一个宣称安全的密码系统。"}
{"title": "360招聘高级安全研究员", "url": "https://www.freebuf.com/jobs/140827.html", "time": "2017-07-19", "level": "", "num_look": 464052, "num_comment": 24, "author": "360安全", "tags": ["安全招聘"], "text": "360安全运营与应急响应中心开启一大波猛烈的招聘！"}
{"title": "2017年全球数据泄露成本研究报告解读", "url": "https://www.freebuf.com/news/140456.html", "time": "2017-07-19", "level": "", "num_look": 468318, "num_comment": 2, "author": "安华金和", "tags": ["安全报告", "数据安全"], "text": "《2017年全球数据泄露成本研究》研究结果显示,合计数据泄露总成本达到362万美元。"}
{"title": "MOTS攻击之TCP攻击", "url": "https://www.freebuf.com/articles/network/140558.html", "time": "2017-07-19", "level": "现金奖励", "num_look": 520480, "num_comment": 12, "author": "feiniao", "tags": ["网络安全"], "text": "MOTS 其原理是监听与构造响应数据包，并在正常数据包返回之前插入伪造的数据包。其实现的核心条件是 TCP/IP 协议本身实现时并没有考虑这方面的安全问题。"}
{"title": "CVE-2017-7529 Nginx整数溢出漏洞分析", "url": "https://www.freebuf.com/articles/terminal/140402.html", "time": "2017-07-19", "level": "", "num_look": 944301, "num_comment": 10, "author": "银河实验室", "tags": ["终端安全"], "text": "在Nginx的range filter中存在整数溢出漏洞，可以通过带有特殊构造的range的HTTP头的恶意请求引发这个整数溢出漏洞，并导致信息泄露。"}
{"title": "BUF早餐铺 | CoinDash平台ICO融资700万美元被洗劫；谷歌和Facebook被骗超1亿；研究人员打造升级版NSA工具", "url": "https://www.freebuf.com/news/140798.html", "time": "2017-07-19", "level": "红色标题", "num_look": 335073, "num_comment": 3, "author": "欧阳洋葱", "tags": ["资讯"], "text": "这年头诈骗之风盛行，谷歌和Facebook被诈骗1亿美元，甚至都没用上黑客技术手法，而是纯粹的骗术；CoinDash网站进行CIO融资时，3分钟就遭遇黑客入侵..."}
{"title": "思科WebEx视频会议插件再度发现严重RCE漏洞，这是今年第二次了", "url": "https://www.freebuf.com/news/140760.html", "time": "2017-07-18", "level": "红色标题", "num_look": 525196, "num_comment": 2, "author": "Elaine_z", "tags": ["WEB安全", "系统安全"], "text": "思科的 WebEx 浏览器插件（Chrome 和Firefox）中再度发现远程执行代码漏洞，这已经是今年第二次在 WebEx 中发现严重漏洞。"}
{"title": "对某品牌无人机的研究与劫持实验", "url": "https://www.freebuf.com/news/140453.html", "time": "2017-07-18", "level": "金币+10", "num_look": 476197, "num_comment": 15, "author": "网络安全通", "tags": ["极客", "终端安全"], "text": "我们又多了一架无人机，好开心！但是作为一个技术党作为好奇心暴强的人，不搞(zuo)一波岂不是很对不起自己？"}
{"title": "跨平台恶意软件Adwind卷土重来，这一次倒霉的是航空航天领域", "url": "https://www.freebuf.com/articles/system/140200.html", "time": "2017-07-18", "level": "", "num_look": 275481, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "今天的主角是Adwind/jRAT，趋势科技将其标识为JAVA_ADWIND。这是一款跨平台的远程访问木马（RAT）。"}
{"title": "Oracle OAM 10g被曝存在高危远程会话劫持漏洞（附PoC）", "url": "https://www.freebuf.com/news/140397.html", "time": "2017-07-18", "level": "红色标题", "num_look": 551637, "num_comment": 4, "author": "clouds", "tags": ["企业安全", "资讯"], "text": "此前由比利时安全研究者发现的Oracle访问管理组件（OAM）高危漏洞却不包括在此次补丁升级范围之内。"}
{"title": "量子计算从概念走入现实，公钥加密是否岌岌可危", "url": "https://www.freebuf.com/articles/database/139347.html", "time": "2017-07-18", "level": "红色标题", "num_look": 613295, "num_comment": 2, "author": "Elaine_z", "tags": ["数据安全", "特别企划"], "text": "本文整合了量子计算的重要概念，讲述其对于公钥系统 RSA 的威胁、以及美国 NIST 机构提出的量子阻抗计划如何应对量子攻击。"}
{"title": "爱卡汽车诚聘web安全工程师", "url": "https://www.freebuf.com/jobs/138860.html", "time": "2017-07-18", "level": "", "num_look": 292677, "num_comment": 2, "author": "阿九", "tags": ["安全招聘"], "text": "爱卡汽车（北京）创建于2002年8月，是中国汽车行业首屈一指的社会化网络互动媒体，拥有全球最大的汽车主题社区。现招聘web安全工程师。"}
{"title": "利用QQ钓鱼或者定位女友是否回家", "url": "https://www.freebuf.com/articles/web/140111.html", "time": "2017-07-18", "level": "金币+20", "num_look": 1149874, "num_comment": 51, "author": "刀郎", "tags": ["WEB安全"], "text": "随着手机开始普及，现在几乎是人手一部手机，而且qq是必装的app，这正好给了骗子可乘之机，根据你的爱好，给你推送相应的内容，让你防不胜防。"}
{"title": "Struts2 S2-048远程代码执行漏洞分析报告", "url": "https://www.freebuf.com/vuls/140410.html", "time": "2017-07-18", "level": "金币+20", "num_look": 651647, "num_comment": 7, "author": "小挺", "tags": ["漏洞"], "text": "本文使用Apache Struts22.3.24版本作为Struts2 S2-048远程代码执行漏洞的复现演示实例。"}
{"title": "“双枪”狙击：首例连环感染MBR和VBR的顽固木马分析", "url": "https://www.freebuf.com/articles/web/140113.html", "time": "2017-07-18", "level": "", "num_look": 611934, "num_comment": 8, "author": "360安全", "tags": ["WEB安全"], "text": "顽固性木马病毒有感染MBR（磁盘主引导记录）的，最近则出现了一种连环感染MBR和VBR的新型木马，我们将其命名为“双枪”木马。"}
{"title": "BUF早餐铺 | AlphaBay Market被查封;谷歌将替换短信验证码登录方案;思科修复严重漏洞并将收购新安全公司", "url": "https://www.freebuf.com/news/140688.html", "time": "2017-07-18", "level": "红色标题", "num_look": 291348, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "AlphaBay Market被查封；谷歌将替换短信验证码登录方案；Kerberos修复长达20年的漏洞；思科修复严重漏洞并将收购新安全公司；WPSetup攻击未完成安装的WordPress；Flashpoint获2800万美元融资"}
{"title": "以“催眠”绕过认证：一个影响Kerberos协议长达20年的漏洞", "url": "https://www.freebuf.com/news/140647.html", "time": "2017-07-17", "level": "", "num_look": 444464, "num_comment": 444464, "author": "Sphinx", "tags": ["系统安全", "资讯"], "text": "黑客可以利用漏洞提升自己的网络权限，还可以获取内网资源，比如窃取密码。"}
{"title": "SQL注入之骚姿势小记", "url": "https://www.freebuf.com/news/139288.html", "time": "2017-07-17", "level": "金币+20", "num_look": 792861, "num_comment": 23, "author": "fox-style", "tags": ["数据安全", "资讯"], "text": "本人也是刚入门的新人，感觉玩ctf一年以来，考察的sql注入的思路越来越骚，考察的sql语法越来学细……"}
{"title": "网络“投毒”系列报告：全国多省软件升级劫持攻击事件数据分析", "url": "https://www.freebuf.com/news/140079.html", "time": "2017-07-17", "level": "红色标题", "num_look": 384895, "num_comment": 8, "author": "360安全", "tags": ["资讯"], "text": "基于域名bjftzt.cdn.powercdn.com的一组大规模软件升级劫持的影响范围远超WannaCry勒索蠕虫，DNS访问每日活跃数量是后者爆发期间的1000倍"}
{"title": "自学网络安全技术，抵御高额黑产利诱，你了解这些“白帽子”吗？", "url": "https://www.freebuf.com/news/140414.html", "time": "2017-07-17", "level": "", "num_look": 542502, "num_comment": 19, "author": "云鼎实验室", "tags": ["资讯"], "text": "在国家网络安全宣传周首届网络安全技能大赛上，来自全国10所高校的10支顶尖战队一决高下，30名“白帽子”黑客捉对厮杀。"}
{"title": "腾讯安全招聘", "url": "https://www.freebuf.com/jobs/139252.html", "time": "2017-07-17", "level": "", "num_look": 449080, "num_comment": 26, "author": "FTH0926", "tags": ["安全招聘"], "text": "腾讯（www.tencent.com）成立于1998年11月，是目前中国领先的互联网增值服务提供商之一。现开放多个岗位，招聘安全工作人员。"}
{"title": "2.5代指纹追踪技术—跨浏览器指纹识别", "url": "https://www.freebuf.com/articles/web/139984.html", "time": "2017-07-17", "level": "", "num_look": 813826, "num_comment": 31, "author": "默安科技", "tags": ["WEB安全"], "text": "设备指纹技术是一种长久有效的追踪技术，即使攻击者挂再多vpn，也能够准确识别攻击者身份。"}
{"title": "【安全大咖说】FriedAppleTeam越狱团队创始人Max Bazaliy专访| FreeBuf视频", "url": "https://www.freebuf.com/news/topnews/139572.html", "time": "2017-07-17", "level": "红色标题", "num_look": 434781, "num_comment": 434781, "author": "Elaine_z", "tags": ["头条", "视频"], "text": "Max Bazaliy是Lookout公司的安全研究员，他在移动安全、协议分析、漏洞利用等方向上有超过10年的从业经验。"}
{"title": "从javascript脚本混淆说起", "url": "https://www.freebuf.com/articles/system/140062.html", "time": "2017-07-17", "level": "现金奖励", "num_look": 524905, "num_comment": 12, "author": "安全豹", "tags": ["系统安全"], "text": "脚本病毒是一个一直以来就存在，且长期活跃着的一种与PE病毒完全不同的一类病毒类型，其制作的门槛低，容易传播、容易躲避检测，深深吸引着恶意软件制作者。"}
{"title": "BUF早餐铺 | 维基解密CIA拦截安卓短信；永恒之蓝扫描器发现大量漏洞主机；域名商Gandi大量域名遭劫持", "url": "https://www.freebuf.com/news/140467.html", "time": "2017-07-17", "level": "红色标题", "num_look": 278363, "num_comment": 278363, "author": "Sphinx", "tags": ["资讯"], "text": "维基解密：CIA拦截安卓设备短信；黑客扫描未安装完成的WordPress；永恒之蓝扫描器发现大量漏洞主机；卡巴斯基ATM安全软件被曝漏洞；域名商Gandi承认大量域名遭到劫持。"}
{"title": "SpyDealer深度剖析：一个广泛针对中国手机APP进行信息窃取的恶意软件", "url": "https://www.freebuf.com/news/140059.html", "time": "2017-07-16", "level": "", "num_look": 423458, "num_comment": 4, "author": "clouds", "tags": ["系统安全", "资讯"], "text": "SpyDealer恶意软件针对大量中国手机端流行APP开发了信息窃取功能。"}
{"title": "网信招聘信息安全专员", "url": "https://www.freebuf.com/jobs/138768.html", "time": "2017-07-16", "level": "", "num_look": 334031, "num_comment": 3, "author": "jingyunhello", "tags": ["安全招聘"], "text": "网信集团是一家综合金融科技服务集团，由先锋集团与多家专业投资机构共同创办,现诚意招聘信息安全专员中！"}
{"title": "国内研究人员发现GMR-2的安全问题，卫星电话通讯几乎可实时解密", "url": "https://www.freebuf.com/news/140054.html", "time": "2017-07-16", "level": "", "num_look": 438331, "num_comment": 11, "author": "Alpha_h4ck", "tags": ["数据安全", "资讯"], "text": "国内的两名安全研究专家在GMR-2密码实现中发现了漏洞，而这些漏洞将允许攻击者以秒为单位来实时解密卫星电话的通讯数据"}
{"title": "Petya及Notpetya的核心差异分析", "url": "https://www.freebuf.com/articles/system/139909.html", "time": "2017-07-16", "level": "", "num_look": 457489, "num_comment": 457489, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "本文所要讨论的重点就是Petya和Notpetya这两款新型勒索软件之间的核心差异。"}
{"title": "2017年最适用于WIFI HACK的无线网卡推荐", "url": "https://www.freebuf.com/articles/wireless/140065.html", "time": "2017-07-15", "level": "金币+6", "num_look": 1959611, "num_comment": 20, "author": "secist", "tags": ["无线安全"], "text": "初次使用Kali Linux来进行无线渗透的小伙伴都曾遇到过一个非常头疼的问题，就是不知道如何选购一款合适的无线网卡"}
{"title": "投哪网招聘高级（中级）安全工程师", "url": "https://www.freebuf.com/jobs/139412.html", "time": "2017-07-15", "level": "", "num_look": 372843, "num_comment": 4, "author": "superf0sh", "tags": ["安全招聘"], "text": "投哪网累计注册用户超过280万，并持续保持快速增长趋势。现招聘高级（中级）安全工程师"}
{"title": "【FB TV】一周「BUF大事件」：斗象科技发现远程代码执行漏洞；恶意病毒Pengex通过系统盘疯狂传播；维基解密发布两款CIA植入型恶意程序", "url": "https://www.freebuf.com/video/140527.html", "time": "2017-07-15", "level": "红色标题", "num_look": 449561, "num_comment": 449561, "author": "willhuang", "tags": ["视频"], "text": "漏洞预警，斗象科技发现远程代码执行漏洞；恶意病毒Pengex通过系统盘疯狂传播；维基解密发布两款CIA植入型恶意程序"}
{"title": "模板注入病毒攻击美国关键基础设施", "url": "https://www.freebuf.com/news/140136.html", "time": "2017-07-15", "level": "", "num_look": 637410, "num_comment": 4, "author": "亚信安全", "tags": ["工控安全", "资讯"], "text": "美国的制造工厂、核电站和其他能源设施正遭受网络攻击的威胁。此次威胁事件至少攻击了美国十几家电力公司."}
{"title": "看我如何破解OpenNMS哈希密码？", "url": "https://www.freebuf.com/articles/web/140215.html", "time": "2017-07-15", "level": "", "num_look": 570945, "num_comment": 13, "author": "secist", "tags": ["WEB安全", "数据安全"], "text": "在最近的一次渗透测试中，我拿下了一台运行OpenNMS的服务器，并获取了该服务器的root访问权限。"}
{"title": "售价500美元的喀秋莎SQL扫描器好在哪里？", "url": "https://www.freebuf.com/news/140114.html", "time": "2017-07-14", "level": "红色标题", "num_look": 730949, "num_comment": 24, "author": "Sphinx", "tags": ["资讯"], "text": "喀秋莎扫描器的售价达到了500美元，但高昂的售价收到的却是黑客们的好评如潮，那到底这款扫描器好在什么地方呢？"}
{"title": "黑产用“未来武器”破解验证码，打码小工都哭了", "url": "https://www.freebuf.com/news/140151.html", "time": "2017-07-14", "level": "金币+6", "num_look": 948588, "num_comment": 17, "author": "守护者观察", "tags": ["WEB安全", "资讯"], "text": "当我们正讨论如何用AI推动产业升级、改变未来生活时，不法分子也在研究AI技术，并通过各种手段非法牟利。"}
{"title": "维基解密本周更新： CIA Vault 7系列新工具HighRise出现，你的短信分分钟能被窃取", "url": "https://www.freebuf.com/news/140425.html", "time": "2017-07-14", "level": "", "num_look": 533713, "num_comment": 3, "author": "AngelaY", "tags": ["资讯"], "text": "维基解密又更新了一款CIA Vault 7 系列新工具 HighRise（摩天大楼）。这是一款安卓恶意程序，可以拦截 SMS 消息并将其重定向至远程的 CIA 服务器上。"}
{"title": "PSAttack：一个包含所有的渗透测试用例的攻击型Powershell脚本框架", "url": "https://www.freebuf.com/sectool/139910.html", "time": "2017-07-14", "level": "", "num_look": 567809, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "本文所要介绍的是一款名叫PSAttack的框架，该框架中包含有几乎所有的PowerShell攻击脚本。"}
{"title": "隔离网络高级威胁攻击预警分析报告", "url": "https://www.freebuf.com/articles/network/139921.html", "time": "2017-07-14", "level": "", "num_look": 602034, "num_comment": 3, "author": "360安全", "tags": ["安全报告", "网络安全"], "text": "维基解密解密了美国中央情报局(CIA)穹顶7（Vault7）网络武器库中的第十二批档案，被披露的档案中详细描述如何远程隐蔽地入侵访问封闭的计算机网络或独立的安全隔离网络。"}
{"title": "金山云招聘高级安全工程师（渗透、攻防、应急与情报）", "url": "https://www.freebuf.com/jobs/138754.html", "time": "2017-07-14", "level": "", "num_look": 418667, "num_comment": 6, "author": "carrie", "tags": ["安全招聘"], "text": "2016年5月，金山云完成C+轮融资近5000万美元，公司估值超过11亿美元。现招聘高级安全工程师（渗透、攻防、应急与情报）"}
{"title": "诗云碎片：机器学习在入侵检测中的应用初探", "url": "https://www.freebuf.com/articles/network/139532.html", "time": "2017-07-14", "level": "", "num_look": 626030, "num_comment": 12, "author": "AngelaY", "tags": ["特别企划", "网络安全"], "text": "市值十亿美元的网络安全行业也开始应用机器学习来提升网络安全成效并节约成本效益。"}
{"title": "如何使用黑盒方式检测弱密码散列算法（基于碰撞哈希算法）", "url": "https://www.freebuf.com/news/139558.html", "time": "2017-07-14", "level": "", "num_look": 465597, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["数据安全", "资讯"], "text": "2017年2月份，一群来自Google的工程师发现了首次SHA-1碰撞。即使NIST在2011年的时候就已经将这个哈希算法归类为“已过时算法”了，但它目前仍然在大规模地使用。"}
{"title": "更适合作为主系统使用的Parrot Security简介", "url": "https://www.freebuf.com/articles/system/140195.html", "time": "2017-07-14", "level": "现金奖励", "num_look": 910496, "num_comment": 23, "author": "Akira", "tags": ["系统安全"], "text": "Parrot 是一个基于Debian的专注于渗透测试和隐私保护的Linux发行版，但是更加方便日常使用，有贴心的使用体验，丰富的工具，更注重隐私保护。"}
{"title": "BUF早餐铺 | 英国电台遭劫持播放色情歌曲；美国电信Verizon千万级数据泄漏；POS端恶意程序LockPoS肆虐", "url": "https://www.freebuf.com/news/140306.html", "time": "2017-07-14", "level": "红色标题", "num_look": 355357, "num_comment": 6, "author": "Elaine_z", "tags": ["资讯"], "text": "英国电台过去一月内惨遭八次劫持，黑客嚣张播放色情歌曲；担忧网络安全，美国选民或将不考虑参加投票；电信巨头Verizon用户数据泄漏。"}
{"title": "Adobe发布更新，修复Flash严重漏洞", "url": "https://www.freebuf.com/news/140060.html", "time": "2017-07-13", "level": "金币+5", "num_look": 497424, "num_comment": 13, "author": "hey你的拔粪宝", "tags": ["资讯"], "text": "如果你电脑上装有Adobe Flash Player，那么你就有可能成为恶意黑客最喜欢的目标了。"}
{"title": "WannaCry变种导致系统蓝屏分析及防护措施", "url": "https://www.freebuf.com/news/139809.html", "time": "2017-07-13", "level": "", "num_look": 2129232, "num_comment": 6, "author": "亚信安全", "tags": ["系统安全", "资讯"], "text": "此次亚信安全截获的变种依然是通过微软MS17-010漏洞传播，但是其不会加密系统中的文件，却可以导致系统蓝屏。"}
{"title": "【BlackHat 2017】博通曝出Wi-Fi芯片中的BroadPwn漏洞，可能影响到数百万Android及iOS设备", "url": "https://www.freebuf.com/news/139773.html", "time": "2017-07-13", "level": "红色标题", "num_look": 829070, "num_comment": 11, "author": "Elaine_z", "tags": ["无线安全", "终端安全"], "text": "Google发布了Android设备的每月安全更新。目前暂命名为 BroadPWN的漏洞可能会影响到数百万种 Android 设备，以及部分 iPhone设备。"}
{"title": "使用深度学习检测DGA（域名生成算法）", "url": "https://www.freebuf.com/articles/network/139697.html", "time": "2017-07-13", "level": "", "num_look": 1535221, "num_comment": 7, "author": "secist", "tags": ["网络安全"], "text": "DGA（域名生成算法）是一种利用随机字符来生成C&C域名，从而逃避域名黑名单检测的技术手段。"}
{"title": "苏宁金融诚聘信息安全架构师", "url": "https://www.freebuf.com/jobs/139791.html", "time": "2017-07-13", "level": "", "num_look": 322985, "num_comment": 1, "author": "（﹎心麦之田", "tags": ["安全招聘"], "text": "苏宁金融打造了苏宁易付宝、零钱宝、定期理财、任性付等一系列知名产品，为消费者提供多场景的金融服务体验。"}
{"title": "快讯  |  电信巨头威瑞森（Verizon）官方承认600万用户信息泄露", "url": "https://www.freebuf.com/news/140207.html", "time": "2017-07-13", "level": "金币+5", "num_look": 331556, "num_comment": 3, "author": "hey你的拔粪宝", "tags": ["资讯"], "text": "威瑞森公司（Verizon）星期三证实，大约600万客户的个人数据在网上泄露。"}
{"title": "美国能源企业遭到攻击：俄罗斯黑客运用“模版注入”实施的一次巧妙钓鱼", "url": "https://www.freebuf.com/news/139954.html", "time": "2017-07-13", "level": "", "num_look": 574917, "num_comment": 2, "author": "Elaine_z", "tags": ["工控安全", "资讯"], "text": "黑客仍然将目标对准工控系统，巧妙地使用“模版注入”的方式隐匿恶意文档，实施网络钓鱼试图获取相关能源企业的身份凭证"}
{"title": "CTF的现实意义究竟在哪儿？FreeBuf专访清华大学网研院诸葛建伟博士", "url": "https://www.freebuf.com/articles/people/140182.html", "time": "2017-07-13", "level": "红色标题", "num_look": 919866, "num_comment": 29, "author": "欧阳洋葱", "tags": ["人物志"], "text": "有人说，安全界的CTF夺旗赛并非表现真实实力的方式，因为它不以现有软硬件为直接破解或攻击目标，距离现实攻防有距离。真的是这样吗？"}
{"title": "如何利用HackRF进行实时广播", "url": "https://www.freebuf.com/news/139716.html", "time": "2017-07-13", "level": "现金奖励", "num_look": 766495, "num_comment": 17, "author": "hey你的拔粪宝", "tags": ["极客", "资讯"], "text": "HackRF是一个开源硬件工程，由Mike Ossmann发起且被美国国防部高级研究计划局（DRAPA）赞助。"}
{"title": "BUF早餐铺  | 安卓7.1有个可关闭恶意程序的隐藏功能；海量.IO域名可被完全接管？赛门铁克收购Skycure；HoloLens眼镜曝严重漏洞", "url": "https://www.freebuf.com/news/140172.html", "time": "2017-07-13", "level": "红色标题", "num_look": 359373, "num_comment": 2, "author": "欧阳洋葱", "tags": ["资讯"], "text": "微软Patch Tuesday，针对其不同产品修复的55个安全漏洞；在NotPetya事件之后，北约对此事仍在保持严密关注；赛门铁克最近又收购两家安全公司；海量.io域名可被接管。"}
{"title": "Google正在测试“恐慌按钮”：Android用户只需狂按返回键可“秒关”可疑恶意程序", "url": "https://www.freebuf.com/news/140058.html", "time": "2017-07-12", "level": "", "num_look": 421028, "num_comment": 9, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "Google在Android 7.1中增加了一个名叫“恐慌按钮”的行为，该功能将允许攻击者通过狂按返回键来迅速关闭任何可疑的恶意程序。"}
{"title": "“神起”僵尸网络的诱捕与反击（上）", "url": "https://www.freebuf.com/articles/web/139811.html", "time": "2017-07-12", "level": "金币+13", "num_look": 682886, "num_comment": 50, "author": "水滴安全实验室", "tags": ["WEB安全"], "text": "黑客使用了一款名为“神起ddos集群”的软件，主要利用路由器、摄像头等设备，控制了3000+的僵尸网络肉鸡，且规模数量在持续增加。"}
{"title": "挖洞经验|我如何在Twitter上发现了一个CSP绕过+XSS漏洞", "url": "https://www.freebuf.com/news/139672.html", "time": "2017-07-12", "level": "", "num_look": 552777, "num_comment": 7, "author": "Alpha_h4ck", "tags": ["漏洞", "资讯"], "text": "我会跟大家描述我是如何配合另一个CSP（内容安全策略）绕过漏洞并最终在Twitter.com的节点中找到了一个XSS漏洞。"}
{"title": "东方财富诚聘安全开发工程师", "url": "https://www.freebuf.com/jobs/138429.html", "time": "2017-07-12", "level": "", "num_look": 402573, "num_comment": 11, "author": "东方财富安全应急响应中心", "tags": ["安全招聘"], "text": "东方财富网创办于2004年, 始终坚持“用户为王”的经营理念，凭借其专业、及时、全面的财经资讯和金融信息，已成为具有海量用户数的财经门户网站。"}
{"title": "Exploit-database使用新手指南", "url": "https://www.freebuf.com/sectool/139685.html", "time": "2017-07-12", "level": "现金奖励", "num_look": 1296607, "num_comment": 18, "author": "Cesign", "tags": ["工具"], "text": "在我看来，exploit-db是一个漏洞库网站，里面公布有最新漏洞的相关情况，这些可以帮助企业改善公司的安全状况。"}
{"title": "对安全审计软件的一次安全审计", "url": "https://www.freebuf.com/articles/web/139719.html", "time": "2017-07-12", "level": "", "num_look": 352189, "num_comment": 2, "author": "clouds", "tags": ["WEB安全"], "text": "安全产品其实并不安全。就如同一年前我们对企业合规性审计软件进行的一些安全审计那样，它们也会出现漏洞，也会给用户造成安全影响。"}
{"title": "基于Centos搭建ELK环境指南", "url": "https://www.freebuf.com/sectool/139687.html", "time": "2017-07-12", "level": "金币+13", "num_look": 626628, "num_comment": 10, "author": "s1riu5", "tags": ["工具"], "text": ""}
{"title": "【更新360公司回应】火球（Fireball）病毒，是老外如临大敌，还是360指鹿为马？", "url": "https://www.freebuf.com/news/139691.html", "time": "2017-07-12", "level": "现金奖励", "num_look": 735768, "num_comment": 15, "author": "人若无名", "tags": ["系统安全", "资讯"], "text": "两家著名的安全厂商对“相同的”病毒发布了完全不同的信息，让作为一个信息安全爱好者的我不知所措，到底该相信谁呢？!"}
{"title": "CNNVD关于惠普电脑音频驱动程序信息泄露漏洞的情况通报", "url": "https://www.freebuf.com/vuls/139968.html", "time": "2017-07-11", "level": "", "num_look": 580693, "num_comment": 6, "author": "CNNVD", "tags": ["漏洞"], "text": "国家信息安全漏洞库（CNNVD）对进惠普电脑安装的音频驱动程序存在信息泄露漏洞（CNNVD-201705-015）行了跟踪分析，具体情况如下："}
{"title": "CNNVD关于Apache Struts2（S2-048）漏洞情况的通报", "url": "https://www.freebuf.com/vuls/139973.html", "time": "2017-07-11", "level": "", "num_look": 464413, "num_comment": 6, "author": "CNNVD", "tags": ["漏洞"], "text": "国家信息安全漏洞库（CNNVD）对Apache Struts2存在远程代码执行漏洞（CNNVD-201706-928）进行了跟踪分析，情况如下:"}
{"title": "Cobalt strike系列教程更新啦（22-24集）", "url": "http://open.freebuf.com/category/oversea/pentest-oversea", "time": "2017-07-11", "level": "金币+13", "num_look": 10374, "num_comment": 10374, "author": "spxc13243871510", "tags": ["FreeBuf公开课"], "text": "Cobalt strike系列教程（22-24集）三集连播，介绍各种渗透测试技术，就在FreeBuf公开课！"}
{"title": "Avanti Markets自动售货机泄露用户数据：使用生物识别的IoT设备离安全有多远？", "url": "https://www.freebuf.com/news/139948.html", "time": "2017-07-11", "level": "", "num_look": 390208, "num_comment": 3, "author": "AngelaY", "tags": ["终端安全", "资讯"], "text": "一台小小的自动售货机一旦被入侵，那些年你曾刷过的卡、按过的指纹，都可能被黑客窃取。"}
{"title": "你不知道的Chrome开发者工具新功能", "url": "https://www.freebuf.com/news/139720.html", "time": "2017-07-11", "level": "金币+13", "num_look": 719262, "num_comment": 9, "author": "柚子", "tags": ["工具", "资讯"], "text": "Chrome开发者工具还有很多不太出名,但绝对能够对调试和应用创建带来很大便利的功能。"}
{"title": "游戏CS:GO VAC反外挂系统分析", "url": "https://www.freebuf.com/news/139515.html", "time": "2017-07-11", "level": "金币+13", "num_look": 714589, "num_comment": 8, "author": "游戏安全实验室", "tags": ["游戏安全", "系统安全"], "text": "本次以CS:GO作为分析目标，对CS:GO上采取的安全方案做 基础的分析。"}
{"title": "AV-TEST发布报告：恶意程序数量减少，但攻击质量变得越来越高", "url": "https://www.freebuf.com/news/139452.html", "time": "2017-07-11", "level": "", "num_look": 339784, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["安全报告", "资讯"], "text": "根据独立反病毒测试机构AV-TEST发布的2016/2017AV-TEST安全报告，相较于2015年，2016检测到的恶意软件样本数量有所减少，但攻击质量和复杂程度均有所上升。"}
{"title": "沪江招聘安全架构师", "url": "https://www.freebuf.com/jobs/139420.html", "time": "2017-07-11", "level": "", "num_look": 383539, "num_comment": 9, "author": "hujiang", "tags": ["安全招聘"], "text": "沪江是专业的互联网学习平台，致力为用户提供便捷、优质的全方位网络学习产品和服务。现招聘安全架构师。"}
{"title": "挖洞姿势：浅析命令注入漏洞", "url": "https://www.freebuf.com/vuls/139924.html", "time": "2017-07-11", "level": "", "num_look": 702834, "num_comment": 6, "author": "secist", "tags": ["漏洞", "系统安全"], "text": "我们不得不提另外一个叫做远程代码执行（RCE）的漏洞——许多人总会把这两个漏洞混淆，其实它们是有本质的区别的。"}
{"title": "【安全大咖说】专访腾讯科恩实验室创始人成员陈良 | FreeBuf视频", "url": "https://www.freebuf.com/video/139303.html", "time": "2017-07-11", "level": "红色标题", "num_look": 565976, "num_comment": 4, "author": "willhuang", "tags": ["视频"], "text": "陈良，腾讯科恩实验室（前身为Keen Team）创始人成员之一。现负责科恩实验室Pwn2Own比赛项目，主要从事浏览器高级利用技术，Apple系操作系统的漏洞挖掘与利用技术研究。"}
{"title": "MOTS攻击之UDP攻击", "url": "https://www.freebuf.com/articles/network/139403.html", "time": "2017-07-11", "level": "现金奖励", "num_look": 585933, "num_comment": 6, "author": "feiniao", "tags": ["网络安全"], "text": "这段时间抽时间学习了Python，花了几天晚上时间用Python实现了UDP的攻击代码。"}
{"title": "Android SpyDealer木马能窃取超过40款应用数据，淘宝、微博、微信都在列", "url": "https://www.freebuf.com/articles/terminal/139846.html", "time": "2017-07-10", "level": "", "num_look": 522897, "num_comment": 3, "author": "Sphinx", "tags": ["终端安全"], "text": "Palo Alto Networks的安全专家发现一款新的Android木马，取名为SpyDealer，它能够窃取多达40款应用的数据，包括微信、QQ、新浪微博、易信、飞信等，因此针对的主要是中国用户。"}
{"title": "不安全的直接对象引用漏洞入门指南", "url": "https://www.freebuf.com/news/139375.html", "time": "2017-07-10", "level": "", "num_look": 522690, "num_comment": 12, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "自从2010年开始，不安全的直接对象引用（IDOR）就已经成为了OWASP Top 10 Web应用安全风险中影响程度排名第四的安全漏洞了。"}
{"title": "Dr0p1t-Framework：一个可以绕过多数杀软的木马生成框架", "url": "https://www.freebuf.com/sectool/139455.html", "time": "2017-07-10", "level": "", "num_look": 503919, "num_comment": 7, "author": "secist", "tags": ["工具"], "text": "这里我向大家推荐一款叫做Dr0p1t的框架，利用它我们可以轻松地创建一个可以躲避大多数杀软的dropper程序。"}
{"title": "RDPInception：一种利用远程桌面的新型攻击方式", "url": "https://www.freebuf.com/articles/system/139156.html", "time": "2017-07-10", "level": "红色标题", "num_look": 580697, "num_comment": 12, "author": "clouds", "tags": ["系统安全"], "text": "如何成功地对这种受限网络设备完成渗透测试呢？今天我们就来探讨一种新型攻击方法：RDPInception。"}
{"title": "滴滴出行信息安全部诚聘安全领域精英", "url": "https://www.freebuf.com/jobs/139232.html", "time": "2017-07-10", "level": "", "num_look": 408819, "num_comment": 13, "author": "最初呢", "tags": ["安全招聘"], "text": "滴滴出行始终秉承着“安全第一，体验第二，效益第三”的原则，将信息安全放在工作的重中之重。现诚聘各路安全精英。"}
{"title": "维基解密又更新：BothanSpy和Gyrfalcon工具能够窃取SSH身份凭证", "url": "https://www.freebuf.com/news/139470.html", "time": "2017-07-10", "level": "", "num_look": 514189, "num_comment": 514189, "author": "Elaine_z", "tags": ["工具", "资讯"], "text": "维基解密发布 CIA 的 BothanSpy 和 Gyrfalcon 工具的文档，详细揭露了这两款可从 Windows 和 Linux 系统中窃取 SSH 身份凭证的工具"}
{"title": "CDN校验漏洞催生海量网络投毒", "url": "https://www.freebuf.com/news/139358.html", "time": "2017-07-10", "level": "", "num_look": 543844, "num_comment": 7, "author": "天际友盟", "tags": ["网络安全", "资讯"], "text": "我们发现一起利用CDN厂商域名备案漏洞自动化进行大面积恶意软件投放的活动。我们将从事该起活动的组织命名为“Rickydiva”。"}
{"title": "恶性病毒Pengex通过系统盘疯狂传播，攻击所有主流杀软却唯独放过腾讯", "url": "https://www.freebuf.com/news/139381.html", "time": "2017-07-10", "level": "红色标题", "num_look": 586196, "num_comment": 12, "author": "火绒安全", "tags": ["系统安全", "资讯"], "text": "不同于其他\"流量劫持\"类病毒的是，Pengex会主动攻击国内主流的安全软件，使他们失去内核对抗能力。诡异的是它唯独不攻击并且刻意\"放过\"腾讯电脑管家。"}
{"title": "利用MS17-010补丁对比发现的九个漏洞", "url": "https://www.freebuf.com/articles/system/139481.html", "time": "2017-07-10", "level": "现金奖励", "num_look": 523149, "num_comment": 3, "author": "walkerfuz", "tags": ["系统安全"], "text": "这篇翻译是原作者结合NSA泄露的武器库，通过补丁对比从MS17-010中发现的九个漏洞。"}
{"title": "【挖洞经验】我如何挖到了一个价值8000美金的Uber漏洞", "url": "https://www.freebuf.com/vuls/139021.html", "time": "2017-07-09", "level": "", "num_look": 625601, "num_comment": 11, "author": "Alpha_h4ck", "tags": ["漏洞"], "text": "在这篇文章中，我将会跟大家分享一个我在Uber系统中发现的有趣漏洞（Login CSRF + 开放重定向 -> 账户接管）。"}
{"title": "微博招聘安全人才", "url": "https://www.freebuf.com/jobs/138504.html", "time": "2017-07-09", "level": "", "num_look": 386450, "num_comment": 7, "author": "weibo_sec", "tags": ["安全招聘"], "text": "微博是一家提供微型博客服务的类Twitter网站。用户可以通过网页、WAP页面、手机客户端、手机短信、彩信发布消息或上传图片。"}
{"title": "Flexport今年在Hackerone被报告的6个有趣的漏洞", "url": "https://www.freebuf.com/vuls/139171.html", "time": "2017-07-09", "level": "", "num_look": 489133, "num_comment": 4, "author": "secist", "tags": ["漏洞"], "text": "从与Flexport合作至今，我们已经收到了近200份的漏洞报告，包括从nginx头移除服务器令牌到XSS漏洞。以下是我们在这200份报告中挑选出的最有意思的6个漏洞。"}
{"title": "我是如何找一个影响数千职业网站的持续型XSS的", "url": "https://www.freebuf.com/vuls/138911.html", "time": "2017-07-09", "level": "", "num_look": 502140, "num_comment": 2, "author": "secist", "tags": ["WEB安全", "漏洞"], "text": "安全研究员ak1t4最近发现并报告了Teamtailor上一个影响数千职业网站的持续型XSS漏洞的过程，其中也包括Detectify的职业网站。"}
{"title": "德国电子政务通信系统组件存在多个严重漏洞可导致政府交换数据泄露", "url": "https://www.freebuf.com/news/139360.html", "time": "2017-07-08", "level": "", "num_look": 505232, "num_comment": 505232, "author": "clouds", "tags": ["数据安全", "资讯"], "text": "最近，SEC-Consult安全研究者发现，德国电子政务系统通讯库中的OSCI存在多个严重漏洞，可导致政府交换数据被攻击泄露."}
{"title": "深圳人人聚财招聘安全人才", "url": "https://www.freebuf.com/jobs/138162.html", "time": "2017-07-08", "level": "", "num_look": 389644, "num_comment": 6, "author": "bingo", "tags": ["安全招聘"], "text": "人人聚财创建于2011年，是中国互联网金融领域最早的P2P平台之一，是中国小微个人抵押贷款业务的领导者，主营车抵贷核心业务。"}
{"title": "100比特币就可解密所有被NotPetya加密的文件？", "url": "https://www.freebuf.com/news/139454.html", "time": "2017-07-08", "level": "金币+10", "num_look": 360115, "num_comment": 1, "author": "hey你的拔粪宝", "tags": ["资讯"], "text": "就在前几天，有黑客出现了并向Motherboard证明了他们有能力解密一些文件。"}
{"title": "【FB TV】一周「BUF大事件」：全国多省爆发大规模软件升级劫持；第三届军博会在京举行；2017WCTF北京举行", "url": "https://www.freebuf.com/video/139648.html", "time": "2017-07-08", "level": "红色标题", "num_look": 465999, "num_comment": 1, "author": "willhuang", "tags": ["视频"], "text": "本周BUF大事件不仅给大家带来全球最新的安全资讯，还给一直关注并支持我们的Buffer带来了惊喜彩蛋。"}
{"title": "字符编码发展史和密码算法那些事儿", "url": "https://www.freebuf.com/articles/others-articles/136742.html", "time": "2017-07-08", "level": "金币+10", "num_look": 898667, "num_comment": 12, "author": "华为未然实验室", "tags": ["其他", "数据安全"], "text": "本文主要讲述了字符编码的发展史和密码算法的作用。"}
{"title": "Discuz插件禾今微信投票权限和刷票漏洞（内含python脚本）", "url": "https://www.freebuf.com/vuls/138846.html", "time": "2017-07-08", "level": "金币+10", "num_look": 912020, "num_comment": 10, "author": "野狗", "tags": ["漏洞", "网络安全"], "text": "当了程序员总有人认为你就会盗QQ、攻击、修电脑。本文探讨Discuz插件禾今微信投票权限和刷票漏洞，用到的工具包括插件源码、fiddler 4和python"}
{"title": "漏洞预警 | 斗象科技发现高危Struts2 showcase远程代码执行漏洞（S2-048）", "url": "https://www.freebuf.com/news/139644.html", "time": "2017-07-07", "level": "红色标题", "num_look": 1436950, "num_comment": 27, "author": "漏洞盒子", "tags": ["漏洞", "资讯"], "text": "斗象科技（Tophant）的安全研究员icez发现Struts2 showcase应用中存在远程代码执行高危漏洞。Struts2官方已经确认该漏洞（漏洞编号S2-048，CVE编号：CVE-2017-9791），漏洞危害程度为高危(High)。"}
{"title": "CNNVD新版官方网站正式上线", "url": "https://www.freebuf.com/news/139507.html", "time": "2017-07-07", "level": "", "num_look": 908191, "num_comment": 4, "author": "CNNVD", "tags": ["安全管理", "资讯"], "text": "国家信息安全漏洞库（CNNVD）官方网站（http://www.cnnvd.org.cn/）是由中国信息安全测评中心主管负责运营的公益类信息资源性网站。"}
{"title": "卡巴斯基实验室发布开源数字取证工具Bitscout", "url": "https://www.freebuf.com/news/139497.html", "time": "2017-07-07", "level": "", "num_look": 559253, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具", "资讯"], "text": "Bitscout是一款可自定义配置的远程数字取证工具。近日，卡巴斯基实验室的安全研究专家Vitaly Kamluk正式发布了Bitscout的源代码。"}
{"title": "【7.8更新】Android病毒CopyCat已经感染全球1400万台设备", "url": "https://www.freebuf.com/articles/terminal/139539.html", "time": "2017-07-07", "level": "", "num_look": 426110, "num_comment": 4, "author": "Sphinx", "tags": ["终端安全"], "text": "新发现的恶意程序已经感染了超过1400万Android设备，在短短两个月内已经获取了150万美元的收入。"}
{"title": "Oracle golden gate的重要漏洞分析", "url": "https://www.freebuf.com/articles/web/138971.html", "time": "2017-07-07", "level": "", "num_look": 388754, "num_comment": 2, "author": "杭州美创科技", "tags": ["WEB安全"], "text": "本文中会再次证明过度依赖自动化工具的潜在危险，我们也将会讨论一些有关Oracle Golden Gate技术层面的重要弱点（漏洞）。"}
{"title": "Apache CVE-2017-7659漏洞重现及利用分析", "url": "https://www.freebuf.com/vuls/139042.html", "time": "2017-07-07", "level": "金币+10", "num_look": 1129877, "num_comment": 11, "author": "华为未然实验室", "tags": ["漏洞"], "text": "这是apache WEB服务器（httpd）中的一个HTTP 2.0协议处理的漏洞。未然实验室安全研究人员针对此漏洞的技术细节和利用方法进行了深入的研究。"}
{"title": "六月SSL行业新闻回顾", "url": "https://www.freebuf.com/news/138972.html", "time": "2017-07-07", "level": "", "num_look": 298907, "num_comment": 1, "author": "SSLChina", "tags": ["资讯"], "text": "本文回顾了六月SSL行业新闻大事件及其他短新闻"}
{"title": "如何手动将Metasploit的Payloads注入到Android应用中", "url": "https://www.freebuf.com/articles/network/138688.html", "time": "2017-07-07", "level": "", "num_look": 467531, "num_comment": 4, "author": "secist", "tags": ["网络安全"], "text": "在本文我将通过手动的方式将Metasploit的Payloads注入到Android应用中"}
{"title": "上海灵码网络科技有限公司招聘", "url": "https://www.freebuf.com/jobs/138202.html", "time": "2017-07-07", "level": "", "num_look": 396222, "num_comment": 7, "author": "上海灵码网络科技有限公司", "tags": ["安全招聘"], "text": "本公司是以技术为核心的安全服务型公司，公司有着良好的发展前景以及多年的安全行业从业背景，本着以技术为主导营造良好的工作氛围。"}
{"title": "一个人的企业安全建设之路", "url": "https://www.freebuf.com/news/130971.html", "time": "2017-07-07", "level": "现金奖励", "num_look": 1030019, "num_comment": 50, "author": "Sophone", "tags": ["企业安全", "观点"], "text": "目前从事国内某车联网公司，公司团队在300人左右，生产服务器数量在千余台级别，业务线冗长，以下给各位介绍一下个人的工作经验。"}
{"title": "pyrasite – 向python进程注入代码工具", "url": "https://www.freebuf.com/sectool/139120.html", "time": "2017-07-07", "level": "", "num_look": 537686, "num_comment": 2, "author": "Sphinx", "tags": ["工具"], "text": "pyrasite是一款基于python的工具，能够注入代码到python进程中。"}
{"title": "Java 9 HTTP2的支持功能前瞻", "url": "https://www.freebuf.com/news/138987.html", "time": "2017-07-07", "level": "", "num_look": 283345, "num_comment": 283345, "author": "SSLChina", "tags": ["WEB安全", "资讯"], "text": "Java 9预期将于本月27日发布，本文讨论了Java 9与HTTP/2有关的特性。"}
{"title": "FireEye发布调查报告，混淆技术成为了2017年攻击者最喜欢用的技术之一", "url": "https://www.freebuf.com/news/139321.html", "time": "2017-07-06", "level": "", "num_look": 320476, "num_comment": 320476, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "2017年上半年，FireEye的研究显示使用命令行逃逸技术和混淆技术的攻击者数量正在显著增加。"}
{"title": "【7月6日更新】惠普电脑内置键盘记录器？可窃取账号密码等敏感用户信息", "url": "https://www.freebuf.com/news/134727.html", "time": "2017-07-06", "level": "红色标题", "num_look": 868847, "num_comment": 16, "author": "AngelaY", "tags": ["资讯"], "text": "你在使用惠普电脑吗？如果答案是肯定的，那么请小心了，你的音频驱动程序可能会存储你的击键记录，甚至泄露你的重要信息。"}
{"title": "维基解密每周一更：CIA新工具OutlawCountry曝光，可远程监控Linux主机", "url": "https://www.freebuf.com/news/139030.html", "time": "2017-07-06", "level": "", "num_look": 558306, "num_comment": 2, "author": "Sphinx", "tags": ["资讯"], "text": "维基解密刚刚在正在进行的Vault 7项目中发布了一些新的泄露文件，新项目的目的在于让中央情报局能够入侵并且远程监听运行Linux系统的电脑。"}
{"title": "文档型漏洞攻击研究报告", "url": "https://www.freebuf.com/news/139014.html", "time": "2017-07-06", "level": "", "num_look": 579054, "num_comment": 3, "author": "360安全", "tags": ["安全报告", "漏洞"], "text": "本文研究的漏洞文档是指利用漏洞进行网络攻击的恶意文档，且此报告中统计的数据是2017年一月到六月的漏洞文档。"}
{"title": "江西先锋软件集团招聘渗透工程师、安全讲师", "url": "https://www.freebuf.com/jobs/137462.html", "time": "2017-07-06", "level": "", "num_look": 430766, "num_comment": 21, "author": "先锋软件", "tags": ["安全招聘"], "text": "江西先锋软件集团成立于2002年,多年来与政府及军方保持合作关系,一直从事应用软件的研发与推广。现招聘渗透工程师和安全讲师。"}
{"title": "卡巴斯基创始人否认与俄罗斯政府有牵连，表示愿意提供源代码供核查", "url": "https://www.freebuf.com/news/139203.html", "time": "2017-07-06", "level": "", "num_look": 430813, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "卡巴斯基创始人否则公司与俄罗斯克林姆林宫方面有任何牵连，表示愿意给有关部门提供源代码以供审查."}
{"title": "Petya真的没那么简单！北约呼吁发起联合调查，US-CERT发布警报", "url": "https://www.freebuf.com/news/139024.html", "time": "2017-07-06", "level": "红色标题", "num_look": 423012, "num_comment": 4, "author": "AngelaY", "tags": ["系统安全", "资讯"], "text": "NATO认为近期大规模传播的Petya（也叫NotPetya）勒索病毒大规模传播事实上可能是一次国家级别的攻击。"}
{"title": "安全隐患，你对X-XSS-Protection头部字段理解可能有误", "url": "https://www.freebuf.com/articles/web/138769.html", "time": "2017-07-06", "level": "现金奖励", "num_look": 1239245, "num_comment": 11, "author": "bgusko63190", "tags": ["WEB安全"], "text": "我曾做过一个调查，看看网友们对关于X-XSS-Protection 字段的设置中，哪一个设置是最差的，调查结果令我非常吃惊，故有此文。"}
{"title": "盗刷银行卡竟如此简单？10秒复制银行卡原理分享", "url": "https://www.freebuf.com/articles/wireless/136991.html", "time": "2017-07-06", "level": "金币+7", "num_look": 1874355, "num_comment": 30, "author": "慧宇子", "tags": ["无线安全", "极客"], "text": "本文为大家讲解这款企赢银行卡信息采集功能，并盘点一些银行卡复制案例，希望广大读者警惕。"}
{"title": "潘多拉魔盒开启：全国多省爆发大规模软件升级劫持攻击", "url": "https://www.freebuf.com/news/139206.html", "time": "2017-07-05", "level": "红色标题", "num_look": 704837, "num_comment": 24, "author": "360安全", "tags": ["资讯"], "text": "近期有多款软件用户密集反映360“误报了软件的升级程序”，但事实上，这些软件的升级程序已经被不法分子恶意替换。"}
{"title": "研究人员已经在GnuPG加密库中实现RSA-1024破解", "url": "https://www.freebuf.com/news/139162.html", "time": "2017-07-05", "level": "", "num_look": 601379, "num_comment": 3, "author": "Elaine_z", "tags": ["数据安全", "资讯"], "text": "安全研究人员在 GnuPG 加密库 Libgcrypt 中发现了严重级别漏洞，可破解 RSA - 1024 加密，提取 RSA 密钥来解密数据。"}
{"title": "一封伪造邮件引发的“探索”（涉及钓鱼邮件、SPF和DKIM等）", "url": "https://www.freebuf.com/articles/web/138764.html", "time": "2017-07-05", "level": "金币+7", "num_look": 934036, "num_comment": 11, "author": "knpewg85942", "tags": ["WEB安全"], "text": "发伪造邮件让同事去CTO办公室，同事上当了。但是这也让我开始研究伪造邮件是为什么产生的，腾讯企业邮为什么没有拦截。"}
{"title": "NSA的第七种武器|双脉冲星(DoublePulsar) 后门详细分析", "url": "https://www.freebuf.com/news/138725.html", "time": "2017-07-05", "level": "金币+7", "num_look": 704367, "num_comment": 6, "author": "兰云科技银河实验室", "tags": ["系统安全", "资讯"], "text": "NSA的一系列SMB 漏洞利用的背后，最后都会使用到双脉冲星(DoublePulsar)后门。双脉冲星后门是一个无文件内核级的SMB后门。"}
{"title": "南京清华永新招聘售前工程师", "url": "https://www.freebuf.com/jobs/138161.html", "time": "2017-07-05", "level": "", "num_look": 343990, "num_comment": 6, "author": "清华永新", "tags": ["安全招聘"], "text": "南京清华永新网络科技有限公司，是在与清华大学合作的基础上，由国际领先的安全技术团队与清华大学网络行为研究所共同成立的高科技网络安全公司。"}
{"title": "Skype曝出远程栈缓冲区溢出漏洞，或导致攻击者远程执行恶意代码（含演示视频）", "url": "https://www.freebuf.com/news/138822.html", "time": "2017-07-05", "level": "", "num_look": 572458, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["漏洞", "资讯"], "text": "免费Web信息与语音呼叫服务Skype出现严重的远程栈缓冲区溢出安全漏洞（CVE-2017-9948），或将允许任意攻击者远程执行恶意代码并导致系统发生崩溃。"}
{"title": "老听别人说加密算法，现在给你个机会深入了解下", "url": "https://www.freebuf.com/articles/database/138734.html", "time": "2017-07-05", "level": "金币+15", "num_look": 590233, "num_comment": 8, "author": "lalalaha", "tags": ["数据安全"], "text": "本文细致介绍加密算法的前世今生，现在给你个机会深入了解下。"}
{"title": "色情诱导诈骗：20秒小电影撑起6亿黑产", "url": "https://www.freebuf.com/news/138854.html", "time": "2017-07-05", "level": "金币+15", "num_look": 1172506, "num_comment": 29, "author": "守护者观察", "tags": ["资讯"], "text": "在协助警方破案过程中，腾讯守护者计划安全团队也对“色情诱导诈骗”背后的这条完整黑色产业链做了深入分析。"}
{"title": "Gadget构造：从JIT-ROP到对抗XnR", "url": "https://www.freebuf.com/articles/web/138716.html", "time": "2017-07-05", "level": "现金奖励", "num_look": 317048, "num_comment": 3, "author": "cuteme", "tags": ["WEB安全"], "text": "简单地说，本文介绍了两种构造gadget的思路（在浏览器支持JIT的情况下）。"}
{"title": "深度剖析Petya病毒：反社会人格的恶性病毒 只为破坏不为牟利", "url": "https://www.freebuf.com/articles/system/138837.html", "time": "2017-07-04", "level": "", "num_look": 480990, "num_comment": 4, "author": "火绒安全", "tags": ["系统安全"], "text": "6月27日晚间，代号为“Petya”的勒索病毒肆虐全球。病毒作者精心设计制作了传播、破坏的功能模块，勒索赎金的模块却制作粗糙、漏洞百出。"}
{"title": "网卡厂商自动识别工具（Python版， 附源代码）", "url": "https://www.freebuf.com/sectool/138781.html", "time": "2017-07-04", "level": "金币+15", "num_look": 660075, "num_comment": 7, "author": "bgusko63190", "tags": ["工具"], "text": "我写了一个python 版的网卡厂商自动识别工具，支持Linux 和windows 平台使用。"}
{"title": "OOB（out of band）分析系列之DNS渗漏", "url": "https://www.freebuf.com/vuls/138838.html", "time": "2017-07-04", "level": "现金奖励", "num_look": 660086, "num_comment": 9, "author": "温酒", "tags": ["WEB安全", "漏洞"], "text": "SQL注入作为最老的漏洞之一，它的价值随着整个web的发展从来没有过时，足以证明它的地位和价值。"}
{"title": "微众银行招聘网络安全工程师", "url": "https://www.freebuf.com/jobs/136731.html", "time": "2017-07-04", "level": "", "num_look": 384736, "num_comment": 4, "author": "popeylj", "tags": ["安全招聘"], "text": "微众银行是国内首家开业的民营银行，由腾讯、百业源和立业等多家知名企业发起设立"}
{"title": "CS GO游戏AliveNK外挂分析", "url": "https://www.freebuf.com/articles/system/138692.html", "time": "2017-07-04", "level": "", "num_look": 504901, "num_comment": 10, "author": "游戏安全实验室", "tags": ["系统安全"], "text": "尽管此次CS:GO国服进入三套安全方案,但仍然在首测2周内便出现了功能完善的外挂，此次主要以Alive NK对CS:GO外挂进行分析。"}
{"title": "真假应用傻傻分不清，HideIcon病毒玩起“隐身计”", "url": "https://www.freebuf.com/articles/terminal/138694.html", "time": "2017-07-04", "level": "", "num_look": 362149, "num_comment": 362149, "author": "AVLTeam", "tags": ["终端安全"], "text": ""}
{"title": "FreeBuf报道 | 当防火墙都用上龙芯：第三届北京军博会的“国产”迷思", "url": "https://www.freebuf.com/fevents/139049.html", "time": "2017-07-03", "level": "", "num_look": 499999, "num_comment": 9, "author": "欧阳洋葱", "tags": ["活动"], "text": "全场都在用着龙芯的时候，是种怎样的体验？那至少也得是国家级别的安全需求了。"}
{"title": "Petya勒索蠕虫完全分析报告", "url": "https://www.freebuf.com/articles/system/138679.html", "time": "2017-07-03", "level": "", "num_look": 387061, "num_comment": 7, "author": "360安全", "tags": ["系统安全"], "text": "此次Petya勒索病毒变种，使用的传播攻击形式和WannaCry类似，但该病毒除了使用了永恒之蓝漏洞，还罕见的使用了黑客的横向渗透攻击技术。"}
{"title": "深入分析一波，你们说的云安全到底是什么鬼？", "url": "https://www.freebuf.com/articles/neopoints/138657.html", "time": "2017-07-03", "level": "", "num_look": 751287, "num_comment": 3, "author": "青藤云安全", "tags": ["企业安全", "观点"], "text": "云安全到底是什么？是传统厂商的盒子的iso化？是云厂商自身具备的安全能力？还是SaaS提供安全服务？"}
{"title": "Wolf CMS 新旧两个版本中的文件上传漏洞分析", "url": "https://www.freebuf.com/articles/web/138640.html", "time": "2017-07-03", "level": "金币+15", "num_look": 405304, "num_comment": 6, "author": "navyofficer", "tags": ["WEB安全"], "text": ""}
{"title": "智付招聘运维安全工程师、信息安全工程师", "url": "https://www.freebuf.com/jobs/137925.html", "time": "2017-07-03", "level": "", "num_look": 428279, "num_comment": 11, "author": "智付电子支付有限公司", "tags": ["安全招聘"], "text": "智付电子支付有限公司是智付科技集团控股的国内领先的第三方支付企业，现招聘运维安全工程师、信息安全工程师。"}
{"title": "VLC播放器加载恶意字幕文件导致执行任意代码漏洞分析与out-of-bounds write poc实现（CVE-2017-8313，CVE-2017-8312，CVE-2017-8311）", "url": "https://www.freebuf.com/articles/system/138574.html", "time": "2017-07-03", "level": "现金奖励", "num_look": 442524, "num_comment": 3, "author": "nekonekow", "tags": ["系统安全"], "text": "我在震惊之余就有点好奇到底是怎么做到的，但是当时checkpoint说考虑到影响，暂时不会公布细节。刚好这几天有空，就分析了一下"}
{"title": "【已结束】第三届中国(北京)军民融合技术装备博览会现场实况", "url": "https://www.freebuf.com/fevents/138771.html", "time": "2017-07-03", "level": "红色标题", "num_look": 538476, "num_comment": 538476, "author": "Elaine_z", "tags": ["活动"], "text": "第三届中国军民融合技术装备博览会将于2017年7月3日—5日在北京国家会议中心隆重举行。"}
{"title": "今年最新的IC3报告出炉，网络犯罪去年导致超过13亿美元的经济损失", "url": "https://www.freebuf.com/news/138647.html", "time": "2017-07-03", "level": "", "num_look": 412433, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["安全报告", "资讯"], "text": "根据美国联邦调查局互联网犯罪投诉中心（IC3）在今年最新发布的调查报告，IC3在2016年总共接到了298728次有关网络犯罪行为的投诉"}
{"title": "通过服务器日志溯源web应用攻击路径", "url": "https://www.freebuf.com/articles/web/138867.html", "time": "2017-07-03", "level": "", "num_look": 699449, "num_comment": 11, "author": "secist", "tags": ["WEB安全"], "text": "这些日志记录信息也为安全事件的取证分析提供了强有力的证据和溯源的渠道。"}
{"title": "专为渗透测试人员设计的 Python 工具大合集", "url": "https://www.freebuf.com/sectool/138779.html", "time": "2017-07-03", "level": "", "num_look": 1113446, "num_comment": 11, "author": "Alpha_h4ck", "tags": ["工具"], "text": "在这篇文章中，我们会给大家介绍其中的部分工具。"}
{"title": "挖洞经验|雅虎小企业服务平台Luminate身份认证漏洞", "url": "https://www.freebuf.com/vuls/138710.html", "time": "2017-07-02", "level": "", "num_look": 489592, "num_comment": 10, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "在我晚间例行参与的漏洞众测项目中，我决定研究研究Luminate的密码忘记处理功能。"}
{"title": "成都融微软件服务有限公司招聘安全工程师", "url": "https://www.freebuf.com/jobs/137718.html", "time": "2017-07-02", "level": "", "num_look": 480601, "num_comment": 22, "author": "zgwa_rw", "tags": ["安全招聘"], "text": "成都融微软件服务有限公司成立于2004年，隶属于中国电子科技网络信息安全有限公司（以下简称为中国网安） ，由中国网安旗下上海三零卫士全资控股"}
{"title": "黑产大数据：手机黑卡调查", "url": "https://www.freebuf.com/articles/others-articles/135317.html", "time": "2017-07-02", "level": "红色标题", "num_look": 1403994, "num_comment": 27, "author": "威胁猎人", "tags": ["其他", "安全报告"], "text": "手机黑卡似乎和大众没什么关系，但据说见过下面这张图的同学，每天的生活品质能提升30%。"}
{"title": "关于Petya勒索病毒有关情况的预警通报", "url": "https://www.freebuf.com/news/138584.html", "time": "2017-07-02", "level": "", "num_look": 287270, "num_comment": 1, "author": "CNCERT", "tags": ["资讯"], "text": "2017年6月27日晚，据外媒消息，乌克兰等多国正在遭遇Petya勒索病毒袭击，政府、银行等重要系统受攻击影响。此次黑客使用的是Petya勒索病毒的变种Petwarp。"}
{"title": "使用Python检测并绕过Web应用程序防火墙", "url": "https://www.freebuf.com/articles/web/138589.html", "time": "2017-07-02", "level": "", "num_look": 489428, "num_comment": 5, "author": "secist", "tags": ["WEB安全"], "text": "作为一名渗透测试人员，想要更好的突破目标系统，就必须要了解目标系统的WAF规则。"}
{"title": "【FB TV】一周「BUF大事件」：新型勒索病毒Petya席卷欧洲；2017MOSEC上海举行；Win10核心源码与公司内部项目泄露", "url": "https://www.freebuf.com/video/138830.html", "time": "2017-07-01", "level": "红色标题", "num_look": 647253, "num_comment": 1, "author": "willhuang", "tags": ["视频"], "text": "本周全球网络安全领域可谓大事频发，新型勒索病毒Petya席卷欧洲，2017MOSEC上海举行，Win10核心源码与公司内部项目泄露。"}
{"title": "通过非数字和字符的方式实现PHP WebShell", "url": "https://www.freebuf.com/articles/web/138687.html", "time": "2017-07-01", "level": "", "num_look": 677656, "num_comment": 14, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "但如果你想要绕过WAF的话，你还得使用一些其他的技术来重写你的webshell。"}
{"title": "为什么多数顶级黑客都来自俄罗斯而非美国？", "url": "https://www.freebuf.com/articles/neopoints/138302.html", "time": "2017-06-30", "level": "金币+6", "num_look": 1225100, "num_comment": 23, "author": "secist", "tags": ["观点"], "text": "为什么俄罗斯的黑客如此“牛气冲天”呢？本文我将通过各种开源数据，来带大家深入的探讨这一问题。"}
{"title": "PRMitM：一种可重置账号密码的中间人攻击，双因素认证也无效", "url": "https://www.freebuf.com/news/138362.html", "time": "2017-06-30", "level": "", "num_look": 470379, "num_comment": 6, "author": "Sphinx", "tags": ["资讯"], "text": "这种攻击方法被命名为PRMitM，意为“密码重置中间人攻击(Password Reset MitM Attack)”。黑客可以利用这种攻击手法对受害者的账号进行密码重置。"}
{"title": "【BlackHat 2017】剧透Black Hat 2017将要发布的8款安全工具", "url": "https://www.freebuf.com/sectool/138445.html", "time": "2017-06-30", "level": "", "num_look": 637131, "num_comment": 4, "author": "secist", "tags": ["工具"], "text": "在本届Black Hat的工具展示环节，将会为我们带来什么样的先进技术呢？"}
{"title": "上海良腾电子科技有限公司招聘多名高级安全工程师", "url": "https://www.freebuf.com/jobs/137409.html", "time": "2017-06-30", "level": "", "num_look": 405467, "num_comment": 15, "author": "jennyrz", "tags": ["安全招聘"], "text": "上海良腾电子科技有限公司是一家专业从事网络信息安全软件产品开发及相关技术服务的高科技公司，现招聘多名高级安全工程师。"}
{"title": "应用下载需警惕，“猜你妹”病毒潜伏应用市场伺机刷流氓应用", "url": "https://www.freebuf.com/articles/system/138344.html", "time": "2017-06-30", "level": "", "num_look": 411556, "num_comment": 5, "author": "腾讯手机管家", "tags": ["系统安全"], "text": ""}
{"title": "什么是SSL预证书？", "url": "https://www.freebuf.com/articles/web/138062.html", "time": "2017-06-30", "level": "", "num_look": 504363, "num_comment": 1, "author": "SSLChina", "tags": ["WEB安全"], "text": "预证书在证书透明度RFC中定义。本文将用简单的语言解释什么是预先证书，如何使用它们以及它们的工作机制。"}
{"title": "短小精干的Unix类后门Tiny shell的使用与分析", "url": "https://www.freebuf.com/sectool/138350.html", "time": "2017-06-30", "level": "现金奖励", "num_look": 817561, "num_comment": 10, "author": "dapzxb41693", "tags": ["工具"], "text": "Tiny shell是一款非常不错的后门，体积小，功能够用，而且通信加密，源码也不是很复杂，大家有空可拿来自行研究相应的测试和防御手段。"}
{"title": "ShadowBrokers订阅服务全面“升级”，并宣称将揭露某神秘NSA前员工的身份", "url": "https://www.freebuf.com/news/138839.html", "time": "2017-06-30", "level": "", "num_look": 495955, "num_comment": 10, "author": "欧阳洋葱", "tags": ["资讯"], "text": "Shadow Brokers下个月的exploit订阅费用翻倍，涨到200 ZEC了；而且他们开始提供VIP服务了；另外他们打算揭露一个名叫doctor的家伙的身份。"}
{"title": "FreeBuf报道 | WCTF世界黑客大师挑战赛：向着光，追逐光", "url": "https://www.freebuf.com/news/138715.html", "time": "2017-06-29", "level": "", "num_look": 470158, "num_comment": 6, "author": "AngelaY", "tags": ["活动", "资讯"], "text": "由360主办的WCTF于6月27日-29日在北京举行。比赛吸引了来自10个国家的13支队伍，最终，来自中国台湾的 HITCON 217 战队获得冠军。"}
{"title": "你以为Petya真的是勒索软件吗？背后可能是一次国家级攻击", "url": "https://www.freebuf.com/news/138763.html", "time": "2017-06-29", "level": "", "num_look": 507685, "num_comment": 10, "author": "Sphinx", "tags": ["资讯"], "text": "最近这两天，NotPetya勒索软件席卷欧洲。但研究人员的最新研究结果显示，这款病毒其实是个文件擦除病毒，勒索只是其表象。"}
{"title": "WiFi-Pumpkin无线渗透测试框架实战教程", "url": "https://www.freebuf.com/articles/wireless/138063.html", "time": "2017-06-29", "level": "现金奖励", "num_look": 1123495, "num_comment": 10, "author": "blacksunny", "tags": ["无线安全"], "text": "WiFi-Pumpkin是一款专用于无线环境渗透测试的完整框架，利用该工具可以伪造接入点完成中间人攻击，同时也支持一些其他的无线渗透测试功能。"}
{"title": "CIA Vault7 系列后续：新工具“Elsa”可通过WiFi对用户进行定位", "url": "https://www.freebuf.com/sectool/138711.html", "time": "2017-06-29", "level": "", "num_look": 1250921, "num_comment": 6, "author": "Elaine_z", "tags": ["工具"], "text": "维基解密发布了第十二款来自CIA的新工具ELSA的说明文档。这款工具可通过 WiFi 进行目标用户的定位，在用户计算机 WiFi 离线状态也可进行定位。"}
{"title": "对战加密的恶意流量：将机器学习应用到恶意软件识别中去", "url": "https://www.freebuf.com/news/138415.html", "time": "2017-06-29", "level": "", "num_look": 389187, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "来自思科的McGrew一直都在研究如何使用NetFlows配合新的算法来检测恶意软件，如果这些恶意软件借由TLS加密传输，问题可能变得更加复杂。"}
{"title": "JasPer指针未定义漏洞分析", "url": "https://www.freebuf.com/vuls/138242.html", "time": "2017-06-29", "level": "金币+8", "num_look": 417238, "num_comment": 417238, "author": "hwtct", "tags": ["漏洞"], "text": "JapsPer项目是一个开源项目，它提供了一种基于jpeg-2000部分标准。这个项目最初是由Image Power和英属哥伦比亚大学合作完成的。"}
{"title": "VisualThreat招聘汽车信息安全测试专员", "url": "https://www.freebuf.com/jobs/136189.html", "time": "2017-06-29", "level": "", "num_look": 363554, "num_comment": 8, "author": "tofreebug", "tags": ["安全招聘"], "text": "VisualThreat依托硅谷，其汽车信息安全测试技术全球领先。"}
{"title": "你知道吗？有些网站在你点击“提交”按钮之前就已经开始收集数据了", "url": "https://www.freebuf.com/news/138304.html", "time": "2017-06-29", "level": "", "num_look": 442211, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["数据安全", "资讯"], "text": "Gizmodo的研究人员发现，大量网站所用的NaviStone代码在用户填写表单数据的时候，即便用户没有点击“提交”按钮，但网站仍然能获取到这些数据。"}
{"title": "针对巴基斯坦的某APT活动事件分析", "url": "https://www.freebuf.com/news/138196.html", "time": "2017-06-29", "level": "红色标题", "num_look": 477378, "num_comment": 6, "author": "奇安信威胁情报中心", "tags": ["资讯"], "text": "2017年6月， 360威胁情报中心发现了一份可疑的利用漏洞执行恶意代码的Word文档，经过分析后，我们发现这有可能是一起针对巴基斯坦的政府官员的APT攻击事件。"}
{"title": "浅谈CTF中命令执行与绕过的小技巧", "url": "https://www.freebuf.com/articles/web/137923.html", "time": "2017-06-29", "level": "现金奖励", "num_look": 1336607, "num_comment": 12, "author": "pupiles", "tags": ["WEB安全"], "text": "缘起lemon师傅曾经发表的一篇文章，总结的很详细，学到了很多姿势。但是在此我还想画蛇添足的做一些补充及解释。补充一下命令执行的漏洞。"}
{"title": "Petya0627勒索病毒安全预警通告", "url": "https://www.freebuf.com/articles/system/138639.html", "time": "2017-06-28", "level": "", "num_look": 421788, "num_comment": 5, "author": "360安全", "tags": ["系统安全"], "text": "此次黑客使用的是Petya0627勒索病毒，使用的攻击方式和WannaCry相同，由于该病毒是定向投递，所以欧洲感染较多。"}
{"title": "有关Petya勒索软件，你想知道的都在这里", "url": "https://www.freebuf.com/articles/system/138606.html", "time": "2017-06-28", "level": "红色标题", "num_look": 617928, "num_comment": 6, "author": "Sphinx", "tags": ["系统安全"], "text": "从昨天晚上开始，整个安全圈在疯狂传播的无疑就是一款名为Petya的新勒索软件。本文从病毒概况、传播方法、防范措施等角度全面解读了Petya。"}
{"title": "研究人员发现Petya勒索程序“疫苗”，手把手教你免疫Petya", "url": "https://www.freebuf.com/news/138597.html", "time": "2017-06-28", "level": "", "num_look": 525843, "num_comment": 15, "author": "欧阳洋葱", "tags": ["系统安全", "资讯"], "text": "而来自Cybereason的安全研究人员Amit Serper最先找到阻止Petya持续感染计算机的方法，来看看具体是怎么做的！"}
{"title": "我如何找到了Facebook广告服务的信息泄漏漏洞（奖金高达10000美刀）", "url": "https://www.freebuf.com/articles/web/138292.html", "time": "2017-06-28", "level": "", "num_look": 501569, "num_comment": 8, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "Facebook提供了一个GraphQL节点，管理员可以通过这个节点查看广告的用户点击日志。但需要注意的是，并非所有的用户都能够知道某个广告的数据。"}
{"title": "启明星辰集团招聘源代码检测工程师（北京）", "url": "https://www.freebuf.com/jobs/136341.html", "time": "2017-06-28", "level": "", "num_look": 392766, "num_comment": 5, "author": "yifan08", "tags": ["安全招聘"], "text": "启明星辰是国内最具实力的、拥有完全自主知识产权的网络安全产品、可信安全管理平台、安全服务与解决方案的综合提供商。"}
{"title": "Petya勒索软件新变种详细分析报告", "url": "https://www.freebuf.com/articles/system/138575.html", "time": "2017-06-28", "level": "", "num_look": 765007, "num_comment": 14, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "Petya勒索软件肆虐中，本文从其新变种、传播渠道、功能、感染过程与加密勒索细节进行了分析"}
{"title": "NSA正式公开官方GitHub帐号，已经有32个项目", "url": "https://www.freebuf.com/news/138143.html", "time": "2017-06-28", "level": "", "num_look": 415025, "num_comment": 5, "author": "Sphinx", "tags": ["资讯"], "text": "美国国安局一度是美国最神秘的政府部门之一，最近却开设了官方GitHub页面。"}
{"title": "Petya勒索病毒首发技术分析", "url": "https://www.freebuf.com/articles/system/138567.html", "time": "2017-06-28", "level": "", "num_look": 596691, "num_comment": 8, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "哈勃分析系统对收集到的病毒样本进行了分析，并已确认病毒样本通过永恒之蓝传播。"}
{"title": "快讯｜乌克兰遭遇疑似Petya.A勒索蠕虫病毒，多家政府机构及大企业中招", "url": "https://www.freebuf.com/news/138557.html", "time": "2017-06-27", "level": "红色标题", "num_look": 529228, "num_comment": 2, "author": "Akane", "tags": ["资讯"], "text": ""}
{"title": "FreeBuf报道 | WCTF2017世界黑客大师挑战赛首日：我们的征途是星辰大海", "url": "https://www.freebuf.com/fevents/138462.html", "time": "2017-06-27", "level": "", "num_look": 392534, "num_comment": 392534, "author": "Elaine_z", "tags": ["活动"], "text": "为期三天的2017 WCTF 世界黑客大师挑战赛正式拉开序幕，13支优秀国际战队齐聚一堂同台竞技。"}
{"title": "【FB TV】BUF大事件番外篇：大Google新出了个安全游戏，还有这种操作？", "url": "https://www.freebuf.com/video/138375.html", "time": "2017-06-27", "level": "红色标题", "num_look": 516043, "num_comment": 2, "author": "willhuang", "tags": ["视频"], "text": "观众朋友们，观众朋友们，期待已久的BUF大事件番外篇又来啦！"}
{"title": "看我如何偷取别人的云储币（Siacoin）", "url": "https://www.freebuf.com/articles/database/138188.html", "time": "2017-06-27", "level": "", "num_look": 958530, "num_comment": 5, "author": "clouds", "tags": ["数据安全"], "text": "本文讲述了作者如何根据一个云储币（Siacoin）用户发贴，从一个错误密钥中恢复出正确密钥，最终偷取了发贴用户交易账户中的所有云储币。"}
{"title": "最新GhostHook攻击可以绕过Windows PatchGuard防护", "url": "https://www.freebuf.com/news/138216.html", "time": "2017-06-27", "level": "", "num_look": 433670, "num_comment": 5, "author": "secist", "tags": ["系统安全", "资讯"], "text": "安全专家称已经发现了一种可以绕过Windows PatchGuard保护，并将恶意程序钩子植入至Windows内核的方法。"}
{"title": "白利用的集大成者：新型远控木马上演移形换影大法", "url": "https://www.freebuf.com/articles/system/138164.html", "time": "2017-06-27", "level": "", "num_look": 425023, "num_comment": 11, "author": "360安全", "tags": ["系统安全"], "text": "最近，360互联网安全中心发现一款新型远控木马，该木马广泛用于盗取玩家游戏账号及装备。"}
{"title": "悬镜安全实验招聘高级渗透测试人员", "url": "https://www.freebuf.com/jobs/137157.html", "time": "2017-06-27", "level": "", "num_look": 389225, "num_comment": 16, "author": "悬镜安全实验室", "tags": ["安全招聘"], "text": "北京安普诺旗下重点网络攻防实验室-悬镜安全实验室招聘安全服务工程师。"}
{"title": "我是如何轻松拿到Google $1337现金奖励的", "url": "https://www.freebuf.com/articles/web/138198.html", "time": "2017-06-27", "level": "现金奖励", "num_look": 458586, "num_comment": 15, "author": "常运", "tags": ["WEB安全"], "text": "新出的Jenknis漏洞RCE的EXP网上已经在转播了，大概在5月1号出的，网上迅速流出针对Jenknis2.23.1的RCE漏洞POC和EXP。"}
{"title": "各国被黑客泄露的信息都是真的吗？揭秘真相森林中的重重谎言", "url": "https://www.freebuf.com/news/135999.html", "time": "2017-06-27", "level": "红色标题", "num_look": 323344, "num_comment": 2, "author": "AngelaY", "tags": ["资讯"], "text": "日前，安全研究人员发现了一个复杂的全球性虚假信息泄密活动，据分析，这次虚假泄密与黑客组织APT28之前所从事的网络间谍活动存在“重叠”之处。"}
{"title": "【已结束】WCTF 2017 世界黑客大师赛", "url": "https://www.freebuf.com/fevents/138315.html", "time": "2017-06-27", "level": "红色标题", "num_look": 697796, "num_comment": 26, "author": "Elaine_z", "tags": ["活动"], "text": "WCTF 世界黑客大师赛始办于2016年，立足于高水平的黑客技术对抗和交流，本届WCTF 2017比赛于 2017年6月27-29日在北京丽都皇冠酒店举办。"}
{"title": "网络安全新前沿：一张图看80家采用人工智能来做安全的公司", "url": "https://www.freebuf.com/news/137873.html", "time": "2017-06-27", "level": "", "num_look": 617395, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["网络安全", "资讯"], "text": "在这篇文章中，我们会对目前市场上80家引入了人工智能技术的私立安全公司进行分析，并将它们按照各自针对的安全领域分成了九大类。"}
{"title": "韩国遭遇大规模勒索病毒攻击", "url": "https://www.freebuf.com/news/138128.html", "time": "2017-06-27", "level": "", "num_look": 381532, "num_comment": 6, "author": "亚信安全", "tags": ["WEB安全", "资讯"], "text": "韩国网络托管公司 Nayana 上周末遭遇大规模勒索病毒攻击，导致旗下 153 台 Linux 服务器与 3,400 个网站感染 Erebus 勒索软件 。"}
{"title": "漏洞预警 | FFmpeg曝任意文件读取漏洞", "url": "https://www.freebuf.com/vuls/138377.html", "time": "2017-06-26", "level": "红色标题", "num_look": 1012435, "num_comment": 16, "author": "Sphinx", "tags": ["漏洞"], "text": "FFmpeg是一套可以用来记录、转换数字音频、视频，并能将其转化为流的开源计算机程序。"}
{"title": "Google和必应都无法替代的10大深网搜索引擎", "url": "https://www.freebuf.com/news/137844.html", "time": "2017-06-26", "level": "", "num_look": 1477341, "num_comment": 13, "author": "secist", "tags": ["资讯"], "text": "有没有既可以保证高度匿名性，又可以获取到深网内容的搜索引擎呢？下面，我将为大家推荐十款比Google，必应更加“强大”搜索引擎。"}
{"title": "XMan召集令——“第二届XCTF-XMan特训夏令营”开始报名啦！", "url": "https://www.freebuf.com/fevents/138345.html", "time": "2017-06-26", "level": "", "num_look": 453460, "num_comment": 2, "author": "Akane", "tags": ["活动"], "text": "夏令营，就是要你充实、感觉好玩、开眼界！第二届XCTF-XMan特训夏令营，满载大家期望，带着满满干货和诚意，来啦！"}
{"title": "安卓新型恶意木马Xavier的发展过程和技术分析", "url": "https://www.freebuf.com/articles/terminal/137988.html", "time": "2017-06-26", "level": "金币+15", "num_look": 308688, "num_comment": 3, "author": "eridanus96", "tags": ["终端安全"], "text": ""}
{"title": "蚂蚁金服招系统网络安全专家", "url": "https://www.freebuf.com/jobs/137759.html", "time": "2017-06-26", "level": "", "num_look": 518401, "num_comment": 12, "author": "呆子不开口", "tags": ["安全招聘"], "text": "蚂蚁金服招聘系统网络安全专家，此职位主要负责公司内部网络安全规划和实施、网络攻击处置，网络入侵检测系统的完善和运营，应急响应等。"}
{"title": "云安全带来的机遇与挑战： 2020年市场规模将达90亿美元", "url": "https://www.freebuf.com/news/137855.html", "time": "2017-06-26", "level": "", "num_look": 341169, "num_comment": 1, "author": "AngelaY", "tags": ["资讯"], "text": "Gartner公司预计，到2020年，云安全服务市场将达到近90亿美元。"}
{"title": "看我如何利用开发人员所犯的小错误来盗取各种tokens", "url": "https://www.freebuf.com/articles/web/137793.html", "time": "2017-06-26", "level": "", "num_look": 427004, "num_comment": 8, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "在这篇文章中，我将跟大家交流一下如何利用开发人员所犯下的各种错误来窃取敏感的Token。"}
{"title": "CVE-2016-10277在MOTO X手机上的漏洞利用实践", "url": "https://www.freebuf.com/articles/terminal/137995.html", "time": "2017-06-26", "level": "现金奖励", "num_look": 461816, "num_comment": 5, "author": "thor123", "tags": ["终端安全"], "text": "CVE-2016-10277是存在于摩托罗拉系列手机的bootloader高危漏洞，可以通过内核命令注入劫持手机的启动流程，加载攻击者控制的initramfs，从而达到root提权的目的。"}
{"title": "利用Wireshark任意获取QQ好友IP实施精准定位", "url": "https://www.freebuf.com/articles/web/137952.html", "time": "2017-06-25", "level": "金币+15", "num_look": 3359834, "num_comment": 114, "author": "5431", "tags": ["WEB安全"], "text": "虽然网上已经有了很多获取IP的qq插件，但是其原理大致都是相同的，但是插件的安全性而言就不敢恭维了，下面介绍如何利用wireshark获取好友ip。"}
{"title": "利用BeEF REST API自动化控制僵尸主机", "url": "https://www.freebuf.com/articles/network/137662.html", "time": "2017-06-25", "level": "现金奖励", "num_look": 771345, "num_comment": 24, "author": "ssooking", "tags": ["网络安全"], "text": "我发现网上也没有过多关于beef进行批量自动控制这方面内容的介绍，于是学习了一下它的API，顺便练习一下python编程，这里把自己的学习内容分享下。"}
{"title": "Gartner：2017年11大顶尖信息安全技术", "url": "https://www.freebuf.com/articles/paper/137746.html", "time": "2017-06-25", "level": "", "num_look": 832183, "num_comment": 4, "author": "米雪儿", "tags": ["安全报告"], "text": "本文介绍了11项顶尖信息安全技术。"}
{"title": "平安科技（深圳）诚招信息安全顾问", "url": "https://www.freebuf.com/jobs/137167.html", "time": "2017-06-25", "level": "", "num_look": 489949, "num_comment": 12, "author": "艾惠", "tags": ["安全招聘"], "text": "平安科技（深圳）是平安集团旗下的全资子公司，是平安集团的高科技内核。诚招信息安全顾问。"}
{"title": "Android污点分析工具flowdroid源码简析", "url": "https://www.freebuf.com/sectool/137435.html", "time": "2017-06-25", "level": "金币+15", "num_look": 772237, "num_comment": 18, "author": "nightmarelee", "tags": ["工具"], "text": "flowdroid是一款对Android app进行风险分析的应用，下面深入其源码对其工作的流程进行相关的探究。"}
{"title": "32TB Windows 10核心源码与微软内部项目泄露？", "url": "https://www.freebuf.com/news/138279.html", "time": "2017-06-24", "level": "红色标题", "num_look": 695657, "num_comment": 23, "author": "欧阳洋葱", "tags": ["系统安全", "资讯"], "text": "国外媒体报道称，Windows 10内部构建项目及部分核心源码在网上泄露。"}
{"title": "Nexus 9漏洞允许黑客通过耳机接口攻击设备", "url": "https://www.freebuf.com/articles/terminal/137585.html", "time": "2017-06-24", "level": "", "num_look": 534653, "num_comment": 534653, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "本文首先回顾漏洞CVE-2017-0510，然后分析之前的补丁为何无效，接着演示如何利用这个漏洞发动攻击，最后提供CVE-2017-0648解决方案。"}
{"title": "青藤云安全招贤纳士啦", "url": "https://www.freebuf.com/jobs/136564.html", "time": "2017-06-24", "level": "", "num_look": 572078, "num_comment": 14, "author": "青藤云安全", "tags": ["安全招聘"], "text": "青藤云安全招聘安全顾问、安全工程师、产品经理（安全产品方向）等多个岗位。"}
{"title": "小到入侵苹果手表、大到入侵飞机，MOSEC大会干货议题全记录", "url": "https://www.freebuf.com/fevents/138254.html", "time": "2017-06-24", "level": "红色标题", "num_look": 558899, "num_comment": 2, "author": "Sphinx", "tags": ["活动"], "text": "如果你也关注盘古一年一度的此次盛会，就仔细看看这场大会的干货吧——原本MOSEC也就是以干货著称的。"}
{"title": "Linux中的Stack Clash漏洞，可被黑客利用获取本地root权限", "url": "https://www.freebuf.com/news/137824.html", "time": "2017-06-24", "level": "", "num_look": 454085, "num_comment": 1, "author": "Elaine_z", "tags": ["系统安全", "资讯"], "text": "上个月，Qualys的安全研究人员在多种基于Unix的系统上发现名为“Stack Clash”的漏洞，该漏洞能让攻击者在UNIX系统上获得root权限。"}
{"title": "【FB TV】一周「BUF大事件」：《2017年度移动App安全漏洞与数据泄露现状报告》发布；美国史上规模最大选民信息泄露事件", "url": "https://www.freebuf.com/video/138246.html", "time": "2017-06-24", "level": "红色标题", "num_look": 430529, "num_comment": 1, "author": "willhuang", "tags": ["视频"], "text": "本周FreeBuf发布了《2017年度移动App安全漏洞与数据泄露现状报告》，想了解你手中的移动App有何安全隐患么，来看本周的BUF大事件吧。"}
{"title": "专访|恶意软件猎人Pieter Arntz", "url": "https://www.freebuf.com/news/136881.html", "time": "2017-06-24", "level": "", "num_look": 390202, "num_comment": 390202, "author": "secist", "tags": ["人物志", "资讯"], "text": "我们有幸邀请到了安全研究员兼知名博主Pieter Arntz，来为我们揭开他们鲜为人知的幕后故事。"}
{"title": "远程遥控 IPTables 进行端口复用", "url": "https://www.freebuf.com/articles/network/137683.html", "time": "2017-06-23", "level": "金币+20", "num_look": 720436, "num_comment": 4, "author": "n1nty", "tags": ["网络安全"], "text": "有一天坐地铁的时候突然想到利用 iptables nat 表的 PREROUTING 链配合 REDIRECT 应该是可以达到端口复用的效果的。"}
{"title": "路由器固件安全分析技术（一）", "url": "https://www.vulbox.com/knowledge/detail/?id=35", "time": "2017-06-23", "level": "", "num_look": 120932, "num_comment": 120932, "author": "漏洞盒子", "tags": ["网络安全"], "text": "本文可作为路由器安全的入门学习教程，一起学习从零基础从搭建环境开始入门路由器固件安全分析的技术。"}
{"title": "CIA专攻物理隔离网络的工具“残忍的袋鼠”曝光，和震网病毒很相似", "url": "https://www.freebuf.com/news/138179.html", "time": "2017-06-23", "level": "", "num_look": 606641, "num_comment": 6, "author": "欧阳洋葱", "tags": ["资讯"], "text": "年度大戏Vault 7虽然还没到周更的程度，但更新频率也相当频繁；昨天放出了“残忍的袋鼠”恶意程序工具集手册，用来专攻物理隔离网络。"}
{"title": "Tukarla招聘渗透测试工程师", "url": "https://www.freebuf.com/jobs/136961.html", "time": "2017-06-23", "level": "", "num_look": 419190, "num_comment": 13, "author": "Tom101", "tags": ["安全招聘"], "text": "我们是硅谷的初创公司。核心产品是基于形式验证技术的漏洞挖掘工具。因为国内业务增加，需要penetration tester。"}
{"title": "一款玩俄罗斯轮盘的勒索程序：TeslaWare，黑市售价35-70欧元", "url": "https://www.freebuf.com/news/138122.html", "time": "2017-06-23", "level": "", "num_look": 325335, "num_comment": 325335, "author": "secist", "tags": ["资讯"], "text": "据Emsisoft的安全研究员xXToffeeXx介绍，一款名为TeslaWare的勒索程序正被黑客在网上进行推广和出售。"}
{"title": "【已结束】Mosec2017移动安全技术峰会图文直播", "url": "https://www.freebuf.com/fevents/138090.html", "time": "2017-06-23", "level": "红色标题", "num_look": 561709, "num_comment": 2, "author": "Elaine_z", "tags": ["活动"], "text": "第三届MOSEC移动安全技术峰会于2017年6月23日（周五）在上海浦东黄浦江畔上海凯宾斯基大酒店大宴会举行，正在火热直播中！"}
{"title": "威胁情报的前世今生（上篇）", "url": "https://www.freebuf.com/news/137830.html", "time": "2017-06-23", "level": "现金奖励", "num_look": 429875, "num_comment": 3, "author": "桃之夭夭", "tags": ["观点", "资讯"], "text": "今年五月，全国信息安全标准化技术委员会按照GB/T 1.1-2009规则起草的国家标准《信息安全技术 网络安全威胁信息表达模型》开始进入征求意见阶段"}
{"title": "走近黑客雇佣市场：刀尖上“跳舞”，悬崖边狂欢", "url": "https://www.freebuf.com/news/137646.html", "time": "2017-06-23", "level": "红色标题", "num_look": 721917, "num_comment": 11, "author": "AngelaY", "tags": ["特别企划", "资讯"], "text": "随着网络和数据化的普及，人们的互联网意识逐步加强，开始更多地利用网络为自己服务。除正常需求外，某些特殊需求催生并壮大了黑客雇佣服务。"}
{"title": "看我如何从漏洞公告入手黑掉一台打印机", "url": "https://www.freebuf.com/articles/terminal/137672.html", "time": "2017-06-22", "level": "", "num_look": 836707, "num_comment": 8, "author": "clouds", "tags": ["终端安全"], "text": "打印机在整个网络系统和边界范围中的安全问题不容忽视。你知道吗，打印机也需要经常更新补丁固件，打印机系统同样存在很多漏洞。"}
{"title": "安全人员应急响应工具箱", "url": "https://www.freebuf.com/sectool/135564.html", "time": "2017-06-22", "level": "现金奖励", "num_look": 1350149, "num_comment": 9, "author": "Shun", "tags": ["安全管理", "工具"], "text": "本文旨在帮助安全分析师和DFIR团队更好的完成工作，现整理了一些现在比较流行的安全事件应急响应工具和资源列表。"}
{"title": "国内外电商平台反爬虫机制报告", "url": "https://www.freebuf.com/articles/web/137763.html", "time": "2017-06-22", "level": "金币+15", "num_look": 844477, "num_comment": 10, "author": "leopard7777777", "tags": ["WEB安全"], "text": "今天的主题是反爬虫机制，电商平台如何能保护好自己的数据，又不影响正常用户体验，所谓当今业界一场持久的攻防博弈。"}
{"title": "河北龙瀚诚聘安全技术总监、中高级安全工程师等人才", "url": "https://www.freebuf.com/jobs/137222.html", "time": "2017-06-22", "level": "", "num_look": 315607, "num_comment": 3, "author": "龙瀚hr", "tags": ["安全招聘"], "text": "河北龙瀚集团，集团公司注册资金1亿元，集团主营项目涵盖软件系统整体设计开发、网络信息安全、大数据开发与应用、行业媒体平台等多个业务板块。"}
{"title": "韩国网络托管公司Nayana向勒索软件黑客支付100万美元", "url": "https://www.freebuf.com/news/137889.html", "time": "2017-06-22", "level": "", "num_look": 430270, "num_comment": 2, "author": "米雪儿", "tags": ["WEB安全", "资讯"], "text": "韩国网络托管公司 Nayana 上周末（6月10日）遭受网络攻击，该公司向勒索黑客支付价值100万美元的比特币，来解密锁定的文件。"}
{"title": "腾讯云鼎实验室掌门人killer专访：安全路上，杀手没有假期|FreeBuf人物志", "url": "https://www.freebuf.com/articles/people/137348.html", "time": "2017-06-22", "level": "红色标题", "num_look": 793994, "num_comment": 18, "author": "AngelaY", "tags": ["人物志"], "text": "这位杀手，在安全行业从未停下脚步，他跟随时代的步伐和转型的原因不过是对安全的更多追求罢了，这才是让人感觉最酷的事情。"}
{"title": "一次测试引发的探索：关于分号在java web中的一个特性", "url": "https://www.freebuf.com/articles/web/137829.html", "time": "2017-06-22", "level": "现金奖励", "num_look": 409424, "num_comment": 13, "author": "wadcl", "tags": ["WEB安全"], "text": "还记得IIS的解析漏洞吗？xx.asp;.jpg。而最近做测试的时候发现了一个问题，也因此去查看了一下源码，所以我将内容记录下来了并进行了分享。"}
{"title": "2017游戏安全技术竞赛火热启动中", "url": "https://www.freebuf.com/fevents/137220.html", "time": "2017-06-21", "level": "", "num_look": 512422, "num_comment": 7, "author": "游戏安全实验室", "tags": ["活动"], "text": "游戏行业发展迅速的今天，国内的游戏玩家已经达到了6亿的高度。在如此庞大的用户环境下，游戏安全已成为游戏开发公司最为重视的其中一个问题。"}
{"title": "27部优秀的黑客纪录片", "url": "https://www.freebuf.com/articles/others-articles/137664.html", "time": "2017-06-21", "level": "金币+15", "num_look": 1119772, "num_comment": 22, "author": "secist", "tags": ["其他"], "text": "下面，是为大家精心整理的27部黑客题材纪录片，现在让我们一起走近他们的世界。"}
{"title": "盛大游戏安全实验室招聘安全工程师", "url": "https://www.freebuf.com/jobs/137745.html", "time": "2017-06-21", "level": "", "num_look": 644114, "num_comment": 51, "author": "biboro", "tags": ["安全招聘"], "text": "首先，这是一篇招聘文章，盛大游戏安全实验室招聘安全工程师。"}
{"title": "巧用开放图床搭建免费无限容量云网盘", "url": "https://www.freebuf.com/geek/137666.html", "time": "2017-06-21", "level": "现金奖励", "num_look": 864950, "num_comment": 26, "author": "mscb", "tags": ["极客"], "text": "本篇文章，将实现一个利用任意图床上传任意数据，搭建无限容量的网盘的一个方法。适合任何支持图片上传的平台。"}
{"title": "高通（Qualcomm）LK源码深度分析（三）", "url": "https://www.freebuf.com/news/137530.html", "time": "2017-06-21", "level": "现金奖励", "num_look": 636841, "num_comment": 7, "author": "SetRet", "tags": ["终端安全", "资讯"], "text": "本文的分析是紧接着 aboot_init 的分析内容的，只是因为其重要性才单独成为一章。"}
{"title": "Wannacry深度解析：第一阶段tasksche", "url": "https://www.freebuf.com/vuls/135822.html", "time": "2017-06-21", "level": "现金奖励", "num_look": 682260, "num_comment": 5, "author": "TedZhang", "tags": ["漏洞"], "text": "WannaCry 勒索软件是2017年最热门的勒索软件，它利用微软漏洞在全球范围内发起的攻击令世界上100多个国家的成千上万的用户深受影响。俨然一场全球范围内的网络安全普及教育。"}
{"title": "Nmap 7.50更新：自去年12月来的重大更新", "url": "https://www.freebuf.com/news/137706.html", "time": "2017-06-21", "level": "红色标题", "num_look": 9464714, "num_comment": 7, "author": "Elaine_z", "tags": ["工具", "资讯"], "text": "Network Mapper 近日发布了最新更新 Nmap  7.50 ，上一次的更新还需要追溯到2016年12月，而此次的版本上对于对于数百个项功能进行了改进。"}
{"title": "2017年度中国信息安全从业人员现状调查活动", "url": "https://www.freebuf.com/fevents/137875.html", "time": "2017-06-20", "level": "红色标题", "num_look": 668085, "num_comment": 18, "author": "CISP", "tags": ["活动"], "text": "2017年度中国信息安全从业人员现状调查”活动正在进行中。"}
{"title": "用这个隐藏于PHP模块中的rootkit，就能持久接管服务器", "url": "https://www.freebuf.com/news/137724.html", "time": "2017-06-20", "level": "", "num_look": 597524, "num_comment": 12, "author": "AngelaY", "tags": ["WEB安全", "资讯"], "text": "荷兰研究人员Luke Paris创建了一个隐藏在PHP服务器模块中的rootkit，可以被攻击者利用，通过一个很少使用的攻击向量（Apache模块）接管Web服务器。"}
{"title": "子域名发掘神器：AQUATONE", "url": "https://www.freebuf.com/sectool/137806.html", "time": "2017-06-20", "level": "", "num_look": 21284969, "num_comment": 8, "author": "secist", "tags": ["工具"], "text": ""}
{"title": "上海永诺信息招聘安全开发、架构、攻防人才", "url": "https://www.freebuf.com/jobs/136931.html", "time": "2017-06-20", "level": "", "num_look": 353303, "num_comment": 7, "author": "jinjiang84", "tags": ["安全招聘"], "text": "上海永诺信息技术有限公司现为上汽集团下属安吉汽车物流有限公司全资子公司。"}
{"title": "全美最大选民数据泄露：共和党所属数据公司意外泄漏近2亿美国选民个人资料", "url": "https://www.freebuf.com/news/137819.html", "time": "2017-06-20", "level": "红色标题", "num_look": 577339, "num_comment": 38, "author": "Akane", "tags": ["资讯"], "text": "美国共和党全国委员会签约的一家数据公司本月泄漏了超过1.98亿美国公民的政治数据，他们竟然将内部文件保存在了亚马逊可公开访问的服务器上。"}
{"title": "无文件勒索病毒Sorebrect可感染网络共享中的文件", "url": "https://www.freebuf.com/news/137753.html", "time": "2017-06-20", "level": "金币+10", "num_look": 374033, "num_comment": 3, "author": "eridanus96", "tags": ["资讯"], "text": "与传统的勒索病毒不同，Sorebrect主要针对企业的服务器和终端。"}
{"title": "手工检测Web应用指纹的一些技巧", "url": "https://www.freebuf.com/news/137497.html", "time": "2017-06-20", "level": "现金奖励", "num_look": 801607, "num_comment": 15, "author": "m00n1ight", "tags": ["WEB安全", "资讯"], "text": "所有组件都有不同行为，这些不同行为将影响漏洞的存在性和可利用性。所有组件都有可能产生漏洞或者其他安全问题。"}
{"title": "美国针对朝鲜Hidden Cobra组织的恶意程序DeltaCharlie发出预警", "url": "https://www.freebuf.com/news/137417.html", "time": "2017-06-20", "level": "", "num_look": 384116, "num_comment": 2, "author": "Elaine_z", "tags": ["网络安全", "资讯"], "text": "13日中午时分，美国国土安全部（DHS）与美国联邦调查局（FBI）联合发布了关于恶意程序 DeltaCharlie 系列的文件报告。"}
{"title": "盘点21世纪以来最臭名昭著的15起数据安全事件", "url": "https://www.freebuf.com/news/137467.html", "time": "2017-06-20", "level": "", "num_look": 644373, "num_comment": 1, "author": "secist", "tags": ["数据安全", "资讯"], "text": "本文将为大家列举出二十一世纪以来，最臭名昭著的15起数据安全事件。注：以下列举事件并不一定是基于数量，而可能基于损害程度等进行综合评估筛选。"}
{"title": "4G VoLTE存在漏洞可导致手机用户地理位置和其它个人信息泄露", "url": "https://www.freebuf.com/articles/wireless/137536.html", "time": "2017-06-19", "level": "金币+10", "num_look": 576993, "num_comment": 4, "author": "clouds", "tags": ["无线安全"], "text": "法国安全公司 P1 security通过报告方式详细罗列了一长串关于4G VoLTE通话技术的安全问题。"}
{"title": "重磅 | FreeBuf发布2017年度移动App安全漏洞与数据泄露现状报告", "url": "https://www.freebuf.com/articles/paper/137072.html", "time": "2017-06-19", "level": "红色标题", "num_look": 1130937, "num_comment": 9, "author": "FreeBuf咨询", "tags": ["安全报告"], "text": "报告从移动App安全漏洞、App仿冒、数据泄露等安全问题入手，以统计和测试数据为依托，对这些安全问题的现状进行解读和分析。"}
{"title": "2017 GCTF（全球华人网络安全技能大赛）线上赛writeup", "url": "https://www.freebuf.com/articles/others-articles/137491.html", "time": "2017-06-19", "level": "现金奖励", "num_look": 796155, "num_comment": 6, "author": "王大白", "tags": ["其他"], "text": "为了帮助更多刚入门的ctf玩家和对网络安全感兴趣的朋友，我们BOI战队将我们的GCTF解题思路和过程呈现出来。希望本文可以帮到各位读者。"}
{"title": "猎户星空招聘安全工程师", "url": "https://www.freebuf.com/jobs/136875.html", "time": "2017-06-19", "level": "", "num_look": 313198, "num_comment": 2, "author": "Amiee", "tags": ["安全招聘"], "text": "北京猎户星空科技是一家在创始之初就汇聚了全球科技精英的人工智能公司。致力于以人工智能技术打造下一代革命性科技产品，让人们真正从繁复的体力劳动中解放出来。"}
{"title": "教你如何让SSH使用一次性密码登陆", "url": "https://www.freebuf.com/articles/system/137580.html", "time": "2017-06-19", "level": "金币+10", "num_look": 427165, "num_comment": 4, "author": "Zore", "tags": ["系统安全"], "text": "彩色文字认证系统privacyIDEA是一个模块化认证系统，一个认证服务器"}
{"title": "看我如何在赛门铁克邮件安全网关上实现弱口令到RCE漏洞执行", "url": "https://www.freebuf.com/articles/network/137341.html", "time": "2017-06-19", "level": "红色标题", "num_look": 537279, "num_comment": 6, "author": "clouds", "tags": ["网络安全"], "text": "在这篇文章中，我将向大家分享我们团队最近在对某企业真实渗透测试的一个项目，在该项目中我们发现了赛门铁克电子邮件安全网关的一个0day漏洞。"}
{"title": "FIN7 APT组织攻击木马分析报告", "url": "https://www.freebuf.com/articles/network/137612.html", "time": "2017-06-19", "level": "", "num_look": 834645, "num_comment": 4, "author": "奇安信威胁情报中心", "tags": ["安全报告", "特别企划"], "text": "2017年3月，FireEye发布了一篇名黑客组织FIN7的APT攻击简报，报告称FIN7组织以钓鱼邮件为攻击渠道，主要对美国金融机构渗透攻击。"}
{"title": "Kali Linux中优秀Wifi渗透工具TOP 10", "url": "https://www.freebuf.com/sectool/137163.html", "time": "2017-06-19", "level": "", "num_look": 1263440, "num_comment": 8, "author": "Alpha_h4ck", "tags": ["工具", "无线安全"], "text": "本文将会给大家介绍目前最热门的十大WiFi入侵工具，这些工具可以帮助我们测试无线网络环境中存在的潜在安全问题。"}
{"title": "RED_HAWK：基于PHP实现的信息收集与SQL注入漏洞扫描工具", "url": "https://www.freebuf.com/sectool/137238.html", "time": "2017-06-18", "level": "", "num_look": 685340, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的这款工具名叫RED HAWK（红鹰），这是一款采用PHP语言开发的多合一型渗透测试工具。"}
{"title": "今日头条招聘安全工程师", "url": "https://www.freebuf.com/jobs/137196.html", "time": "2017-06-18", "level": "", "num_look": 466630, "num_comment": 10, "author": "bytedance", "tags": ["安全招聘"], "text": "今日头条招聘安全研发工程师和安全运营工程师"}
{"title": "2017年最佳iPhone渗透APP及工具", "url": "https://www.freebuf.com/sectool/137504.html", "time": "2017-06-18", "level": "", "num_look": 875497, "num_comment": 8, "author": "secist", "tags": ["工具"], "text": ""}
{"title": "CTF比赛中SQL注入的一些经验总结", "url": "https://www.freebuf.com/articles/web/137094.html", "time": "2017-06-18", "level": "现金奖励", "num_look": 1245381, "num_comment": 9, "author": "pupiles", "tags": ["WEB安全"], "text": "最近花了一点时间总结了各大平台中注入的trick，自己还是太菜了，多半都得看题解，就特此做了一个paper方便总结"}
{"title": "macOS平台上首现RaaS（勒索软件即服务）模式的恶意软件", "url": "https://www.freebuf.com/articles/system/137531.html", "time": "2017-06-18", "level": "", "num_look": 318375, "num_comment": 318375, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "这也就意味着，任何人都将能够使用MacRansom来发动恶意攻击。"}
{"title": "40个安全专家需要知道的网络安全数据", "url": "https://www.freebuf.com/articles/paper/137317.html", "time": "2017-06-17", "level": "", "num_look": 613355, "num_comment": 3, "author": "secist", "tags": ["安全报告"], "text": "我对大量的分析报告进行了梳理，以便于大家更好地阅读和了解这些内容。以下是关于数据泄露，新兴威胁，软件漏洞，合规性相关问题，网络安全技能等问题的报告集合。"}
{"title": "新浪安全诚聘高级安全工程师", "url": "https://www.freebuf.com/jobs/136922.html", "time": "2017-06-17", "level": "", "num_look": 440349, "num_comment": 11, "author": "-吗_啡-", "tags": ["安全招聘"], "text": "新浪公司是一家服务于中国及全球华人社群的网络媒体公司。帮助广大用户通过互联网和移动设备获得专业媒体和用户自生成的多媒体内容(UGC)并与友人进行兴趣分享。"}
{"title": "美军网络战探寻：南加州沙漠里的坦克“克星”", "url": "https://www.freebuf.com/news/137107.html", "time": "2017-06-17", "level": "", "num_look": 337858, "num_comment": 337858, "author": "clouds", "tags": ["资讯"], "text": "在遥远的南加利福尼亚沙漠，美军正针对其先进的网络武器进行投入战场前的模拟测试。一些测试性工作会在后续的几周在加州欧文堡国家训练中心完成。"}
{"title": "【FB TV】一周「BUF大事件」：类永恒之蓝病毒来袭；微软修复两个漏洞；维基解密披露CIA绝密项目", "url": "https://www.freebuf.com/video/137650.html", "time": "2017-06-17", "level": "红色标题", "num_look": 547730, "num_comment": 547730, "author": "willhuang", "tags": ["视频"], "text": ""}
{"title": "一款用于发现SSRF、XXE、XSS漏洞的小工具", "url": "https://www.freebuf.com/sectool/137367.html", "time": "2017-06-17", "level": "", "num_look": 872374, "num_comment": 7, "author": "Alpha_h4ck", "tags": ["WEB安全", "工具"], "text": "今天给大家介绍的是运行在我自己Web服务器中的一堆脚本，这些脚本可以帮助我快速检测SSRF、Blind XXS以及XXE漏洞，喜欢的朋友可以将它们部署到自己的环境中。"}
{"title": "漏洞预警 | 潜伏长达11年之久的Linux内核漏洞", "url": "https://www.freebuf.com/articles/system/137572.html", "time": "2017-06-16", "level": "", "num_look": 529783, "num_comment": 9, "author": "Sphinx", "tags": ["系统安全"], "text": "上月初，启明星辰ADLab发现四个存在于Linux内核的远程漏洞，并命名为“Phoenix Talon”。影响范围包括所有2.5.69 ~4.11的内核版本。"}
{"title": "Pwn2Own：Safari沙箱逃逸Part 1，从磁盘挂载到权限提升", "url": "https://www.freebuf.com/vuls/137165.html", "time": "2017-06-16", "level": "金币+10", "num_look": 567003, "num_comment": 2, "author": "PaintorYu", "tags": ["漏洞", "系统安全"], "text": "今天我们带来 CVE-2017-2533 / ZDI-17-357，利用 macOS 系统服务中的条件竞争漏洞来提升权限。同时在此次 Pwn2Own 大赛中，我们还会组合多个漏逻辑洞来完成沙箱逃逸。"}
{"title": "携程招聘高级运维安全工程师", "url": "https://www.freebuf.com/jobs/137453.html", "time": "2017-06-16", "level": "", "num_look": 610501, "num_comment": 37, "author": "juney", "tags": ["安全招聘"], "text": "携程旅行网创立于1999年，总部设在中国上海，员工30000余人，被誉为互联网和传统旅游无缝结合的典范。"}
{"title": "CIA Vault7最新泄露文档：樱花盛开", "url": "https://www.freebuf.com/news/137498.html", "time": "2017-06-16", "level": "金币+10", "num_look": 619002, "num_comment": 6, "author": "CYlar", "tags": ["资讯"], "text": "CIA早在2006年便开始了一项名为“樱花盛开”(Cherry Blossom)的项目。曝光的文档资料详实，图文并茂，长达数百页。"}
{"title": "苹果WWDC大会SSL相关亮点回顾", "url": "https://www.freebuf.com/articles/web/137389.html", "time": "2017-06-16", "level": "金币+10", "num_look": 443791, "num_comment": 443791, "author": "satellite4869", "tags": ["WEB安全", "终端安全"], "text": "苹果全球开发者大会上宣布了LibreSSL、TLS 1.3 Beta版、新的证书吊销检查机制。"}
{"title": "手把手教你如何通过流氓WiFi热点实施网络钓鱼", "url": "https://www.freebuf.com/articles/network/137159.html", "time": "2017-06-16", "level": "", "num_look": 1225863, "num_comment": 8, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "想必大家或多或少都听说过社会工程学技术吧？接下来，让我们看看如何在现实生活中运用社工技巧。"}
{"title": "新型PPT钓鱼攻击分析（含gootkit木马详细分析）", "url": "https://www.freebuf.com/articles/system/137244.html", "time": "2017-06-16", "level": "现金奖励", "num_look": 548283, "num_comment": 3, "author": "兰云科技银河实验室", "tags": ["系统安全"], "text": "最近国外友商捕获了一种新型的PPT钓鱼攻击，我们很感兴趣，下载样本进行分析。这种ppt不需要宏就能实现执行powershell,通过网络下载gootkit木马进行控制。"}
{"title": "FBI最想抓获的黑客原来是这几个人", "url": "https://www.freebuf.com/articles/others-articles/136847.html", "time": "2017-06-15", "level": "", "num_look": 549589, "num_comment": 3, "author": "secist", "tags": ["其他"], "text": "在这些网络罪犯当中，有27名被美国联邦调查局列为重点悬赏通缉对象。"}
{"title": "你可以用U盘黑掉一辆马自达", "url": "https://www.freebuf.com/articles/terminal/137393.html", "time": "2017-06-15", "level": "红色标题", "num_look": 702774, "num_comment": 13, "author": "Akane", "tags": ["终端安全"], "text": "得益于三年来一系列的已知Bug，马自达汽车的MZD信息娱乐系统可以通过将U盘插入仪表板进行黑客入侵。"}
{"title": "Md5扩展攻击的原理和应用", "url": "https://www.freebuf.com/articles/database/137129.html", "time": "2017-06-15", "level": "现金奖励", "num_look": 642316, "num_comment": 4, "author": "Guilty and Innocent", "tags": ["数据安全"], "text": "做CTF题目的过程中遇到了md5扩展攻击，参考了几篇文章，感觉写的都有些小缺陷，再发一篇文章，理解md5扩展攻击首先需要了解md5的工作原理."}
{"title": "猎户星空招聘安全工程师", "url": "https://www.freebuf.com/jobs/136876.html", "time": "2017-06-15", "level": "", "num_look": 367443, "num_comment": 8, "author": "Amiee", "tags": ["安全招聘"], "text": "北京猎户星空科技创立于2016年9月，是一家在创始之初就汇聚了全球科技精英的国际化人工智能公司。"}
{"title": "基于unicorn-engine的虚拟机的实现(WxSpectre)", "url": "https://www.freebuf.com/sectool/137339.html", "time": "2017-06-15", "level": "现金奖励", "num_look": 716301, "num_comment": 15, "author": "比尔.盖茨", "tags": ["工具", "系统安全"], "text": "反病毒虚拟机不光是内嵌在反病毒软件内部，来动态执行样本，可以单独用来动态执行批量样本，检测样本恶意行为。"}
{"title": "如何HACK无线家用警报器？", "url": "https://www.freebuf.com/geek/136964.html", "time": "2017-06-15", "level": "", "num_look": 544348, "num_comment": 544348, "author": "secist", "tags": ["极客"], "text": "警报系统在不断的更新和完善，但制造商，安装人员，操作人员和用户对他们的了解程度却远远不够。"}
{"title": "企业安全建设之路：端口扫描（下）", "url": "https://www.freebuf.com/articles/system/137016.html", "time": "2017-06-15", "level": "现金奖励", "num_look": 896285, "num_comment": 21, "author": "bt0sea", "tags": ["企业安全", "系统安全"], "text": "伴随着企业私有云、混合云以及公有云业务部署环境的不断变化，我们适当也要对扫描策略做调整。"}
{"title": "Industroyer去年袭击乌克兰电网？这可能是震网之后最危险的工控恶意程序", "url": "https://www.freebuf.com/news/137200.html", "time": "2017-06-15", "level": "", "num_look": 822613, "num_comment": 1, "author": "Elaine_z", "tags": ["工控安全", "资讯"], "text": "安全专家经调查发现最近一次侵入乌克兰工控系统的罪魁祸首可能是——Win32 / Industroyer。他们发现这个恶意程序能够控制关键工业控制系统。"}
{"title": "如何通过Windows 10中的Guest帐户获取Admin权限（含视频）", "url": "https://www.freebuf.com/articles/system/136942.html", "time": "2017-06-15", "level": "", "num_look": 522953, "num_comment": 9, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": ""}
{"title": "CAN总线简介：如何以编程方式控制汽车", "url": "https://www.freebuf.com/articles/terminal/136966.html", "time": "2017-06-14", "level": "", "num_look": 847758, "num_comment": 4, "author": "clouds", "tags": ["极客", "终端安全"], "text": "我正与Voyage公司的朋友合作研究，以实现福特Fusion空调系统（A/C）的编程控制。"}
{"title": "22款受欢迎的计算机取证工具", "url": "https://www.freebuf.com/sectool/136921.html", "time": "2017-06-14", "level": "", "num_look": 1160607, "num_comment": 8, "author": "secist", "tags": ["工具"], "text": "公安部门和调查机构可以根据自身情况，如预算和现有专家队伍等因素，来选取合适的取证工具。"}
{"title": "掌众金融诚聘高级安全工程师", "url": "https://www.freebuf.com/jobs/136829.html", "time": "2017-06-14", "level": "", "num_look": 363000, "num_comment": 2, "author": "Aforbes", "tags": ["安全招聘"], "text": "掌众金服以用户的资金需求为出发点，通过数据与风控服务连接用户与资金，通过互联网、大数据技术帮助“信用空白”用户建立信用档案。"}
{"title": "漏洞预警 | Windows修复两个严重远程代码执行漏洞（CVE-2017-8543/8464）", "url": "https://www.freebuf.com/articles/system/137283.html", "time": "2017-06-14", "level": "红色标题", "num_look": 811600, "num_comment": 12, "author": "Sphinx", "tags": ["系统安全"], "text": "6月13日，微软发布补丁修复两个严重远程代码执行漏洞，分别存在于LNK文件和Windows Search功能中。"}
{"title": "VM真的比Container更安全吗？", "url": "https://www.freebuf.com/articles/system/136900.html", "time": "2017-06-14", "level": "", "num_look": 423305, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "理论上来说，是的。但在工作实践中，那可就不一定了。"}
{"title": "Linux sudo漏洞（CVE-2017-1000367）复现和利用思路分析", "url": "https://www.freebuf.com/articles/system/136975.html", "time": "2017-06-14", "level": "现金奖励", "num_look": 848985, "num_comment": 8, "author": "李丽", "tags": ["系统安全"], "text": "今年5.30日linux sudo被爆出存在安全漏洞，sudo版本是1.8.20以及之前的版本都有可能会受到漏洞的影响，可以使普通用户造成覆盖任意文件，造成权限的提升。"}
{"title": "Metasploit实验：制作免杀payload+对任意“外网”主机的远控", "url": "https://www.freebuf.com/sectool/136736.html", "time": "2017-06-14", "level": "金币+20", "num_look": 2042638, "num_comment": 55, "author": "haya", "tags": ["工具", "系统安全"], "text": "我发一个文件，你电脑就被我控制了，我可以拍照摄像下载文件，杀毒软件也不管用！"}
{"title": "暗云木马来袭，国家互联网应急中心开通免费查询服务", "url": "https://www.freebuf.com/news/137224.html", "time": "2017-06-13", "level": "", "num_look": 569598, "num_comment": 24, "author": "CNCERT", "tags": ["资讯"], "text": "国家互联网应急中心首次开通了“暗云”木马感染数据免费查询服务"}
{"title": "浅析车联网安全技术要点", "url": "https://www.freebuf.com/articles/terminal/136965.html", "time": "2017-06-13", "level": "金币+8", "num_look": 718686, "num_comment": 5, "author": "Shun", "tags": ["极客", "终端安全"], "text": "我们在享受汽车智能化带给我们便捷和舒适的同时，也面临智能汽车所带来的安全问题，那么智能汽车安全如何分类？黑客如何攻击智能汽车？"}
{"title": "安天移动安全关于“Dvmap”安卓恶意软件分析报告", "url": "https://www.freebuf.com/articles/terminal/137015.html", "time": "2017-06-13", "level": "", "num_look": 591758, "num_comment": 3, "author": "AVLTeam", "tags": ["安全报告", "终端安全"], "text": "基于国际领先的恶意样本静态分析与动态养殖技术以及强大的移动安全大数据能力，安天对“Dvmap”安卓病毒的分析分成移动恶意样本与移动威胁情报分析两个方向。"}
{"title": "摩托罗拉G4 & G5手机被曝存在高危内核命令行注入漏洞", "url": "https://www.freebuf.com/news/137158.html", "time": "2017-06-13", "level": "", "num_look": 490690, "num_comment": 490690, "author": "Alpha_h4ck", "tags": ["漏洞", "终端安全"], "text": "在之前一篇关于Nexus6 root漏洞的文章中，我们曾提到过漏洞CVE-2016-10277很有可能会影响摩托罗拉设备。"}
{"title": "国网电商北京汇通金财急招信息安全渗透测试专家", "url": "https://www.freebuf.com/jobs/136650.html", "time": "2017-06-13", "level": "", "num_look": 420364, "num_comment": 9, "author": "michaelII", "tags": ["安全招聘"], "text": "国网电商北京汇通金财信息科技有限公司诚聘安全工程师，欢迎各位同学投递简历。"}
{"title": "Mac OS下的wifi自动破解工具xwifi", "url": "https://www.freebuf.com/sectool/136664.html", "time": "2017-06-13", "level": "现金奖励", "num_look": 953664, "num_comment": 12, "author": "quanyechavshuo", "tags": ["工具"], "text": "由于macOS存在两个系统缺陷，导致本工具xwifi可以在新版本macOS上自动破解wifi，适用于物理机装mac系统，理论上支持所有版本苹果系统。"}
{"title": "SambaCry真的来了，利用CVE-2017-7494漏洞来挖矿", "url": "https://www.freebuf.com/news/137110.html", "time": "2017-06-13", "level": "红色标题", "num_look": 942214, "num_comment": 11, "author": "Sphinx", "tags": ["漏洞", "系统安全"], "text": "两周前我们曾经预警过一个Samba远程代码执行漏洞，最近两拨研究人员纷纷表示他们发现了针对这个漏洞的攻击。"}
{"title": "SeaGlass：手工搭建伪基站监控系统", "url": "https://www.freebuf.com/sectool/136738.html", "time": "2017-06-13", "level": "现金奖励", "num_look": 926530, "num_comment": 6, "author": "Shun", "tags": ["工具", "无线安全"], "text": "近两年BAT3在国内搭建了强大的伪基站监控系统，在打击犯罪上贡献不少。本文介绍如何手工搭建伪基站监控系统。"}
{"title": "暗云Ⅲ危害——不仅仅是DDoS", "url": "https://www.freebuf.com/articles/network/137156.html", "time": "2017-06-12", "level": "", "num_look": 663826, "num_comment": 13, "author": "腾讯电脑管家", "tags": ["网络安全"], "text": "腾讯电脑管家安全团队基本摸清暗云Ⅲ的感染方式和传播方式，也定位到被感染暗云Ⅲ的机器会在启动时从服务端下载任务脚本包——ndn.db文件。"}
{"title": "ISG中国信息安全技能竞赛：“漏洞盒子杯”青少年网络安全创意征集大赛，万元现金奖励等你来", "url": "https://www.freebuf.com/fevents/137050.html", "time": "2017-06-12", "level": "", "num_look": 587897, "num_comment": 11, "author": "漏洞盒子", "tags": ["活动"], "text": "这次网络安全征集赛不再是技术小哥哥们的专属秀场，更是所有小伙伴们脑洞大开的盛会喔！"}
{"title": "暗云Ⅲ木马传播感染分析", "url": "https://www.freebuf.com/articles/system/136978.html", "time": "2017-06-12", "level": "红色标题", "num_look": 775578, "num_comment": 17, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "“暗云”恶意程序通过对正常的“赤月传说”、“传奇霸业”等游戏微端进行patch，进而伪装成游戏通过各大下载站的下载器等多种传播渠道进行海量推广。"}
{"title": "企业被黑客攻击，“怼回去”合法吗？", "url": "https://www.freebuf.com/articles/neopoints/136719.html", "time": "2017-06-12", "level": "", "num_look": 613738, "num_comment": 13, "author": "Sphinx", "tags": ["企业安全", "观点"], "text": "“我的电脑被黑了，进行反击合法吗？”这个问题现在成为了主动防御概念中的焦点问题。"}
{"title": "巫师开发商CD Projekt Red称游戏《Cyberpunk 2077》文件遭黑客窃取", "url": "https://www.freebuf.com/news/137051.html", "time": "2017-06-12", "level": "", "num_look": 323445, "num_comment": 7, "author": "Akane", "tags": ["资讯"], "text": "这已经不是CD第一次被黑了。今年早些时候，该公司的官方论坛遭到黑客攻击，约有190万个用户帐户被曝光。"}
{"title": "Google Play应用商店惊现首个拥有代码植入能力的Android恶意软件", "url": "https://www.freebuf.com/news/136932.html", "time": "2017-06-12", "level": "", "num_look": 342702, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "与其他root型恶意软件不同，这款恶意软件不仅会将自己的模块植入目标系统中，而且它还会将恶意代码注入至系统运行时库。"}
{"title": "区块链技术的安全价值与局限性解析", "url": "https://www.freebuf.com/articles/others-articles/134818.html", "time": "2017-06-12", "level": "", "num_look": 940348, "num_comment": 3, "author": "Elaine_z", "tags": ["其他", "区块链安全"], "text": "经过了20年的科学研究，在密码学领域和去中心化计算网络上都出现了新的进展，本文对于区块链的安全优势及其局限进行分析。"}
{"title": "“同形异义字”钓鱼攻击，钉钉中招", "url": "https://www.freebuf.com/articles/web/136729.html", "time": "2017-06-12", "level": "现金奖励", "num_look": 855770, "num_comment": 16, "author": "expsky", "tags": ["WEB安全", "网络安全"], "text": "同形异义字钓鱼攻击号称“几乎无法检测”，是最狡猾的钓鱼攻击！腾讯、京东、支付宝、微博、淘宝已面临同形异义字钓鱼攻击的威胁。"}
{"title": "NetUse命令在渗透测试中的连接条件测试", "url": "https://www.freebuf.com/sectool/136655.html", "time": "2017-06-12", "level": "金币+20", "num_look": 650220, "num_comment": 16, "author": "gaearrow", "tags": ["工具", "网络安全"], "text": "笔者为了探索Net Use在不同组网环境、不同系统下的有效连接条件，围绕用户类别、防火墙等不同控制变量进行了本测试。"}
{"title": "深度追踪WannaCry源头轶事", "url": "https://www.freebuf.com/articles/network/136772.html", "time": "2017-06-12", "level": "红色标题", "num_look": 779899, "num_comment": 22, "author": "腾讯电脑管家", "tags": ["网络安全"], "text": "研究显示，WannaCry之后参与敲诈勒索病毒传播的人越来越多，隐匿在各国的黑客们也开始趁机而动，借势骗钱。"}
{"title": "神州优车集团招聘安全工程师", "url": "https://www.freebuf.com/jobs/136237.html", "time": "2017-06-11", "level": "", "num_look": 346653, "num_comment": 3, "author": "Titans", "tags": ["安全招聘"], "text": "神州优车集团是中国出行和汽车领域领先的综合服务平台，公司业务包括神州租车、专车、电商、闪贷等业务。"}
{"title": "通过微信小程序“运维密码”实现SSH双因子认证", "url": "https://www.freebuf.com/articles/database/136555.html", "time": "2017-06-11", "level": "金币+20", "num_look": 622105, "num_comment": 5, "author": "杭州美创科技", "tags": ["数据安全"], "text": "本文主要介绍SSH双因子认证，结合了当下热门的微信小程序的“运维密码”，来实现认证保护。"}
{"title": "没有身份凭证的情况下，攻击者就能登录FreeRADIUS", "url": "https://www.freebuf.com/vuls/136071.html", "time": "2017-06-11", "level": "", "num_look": 591561, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["漏洞", "网络安全"], "text": "近期，来自卢森堡RESTENA的安全研究专家Stefan Winter在当前全球最流行的radius服务器中发现了一个TLS认证绕过漏洞。"}
{"title": "【FB TV】一周「BUF大事件」：《网络安全法》开始施行；首届TCTF线下决赛火热进行；Fireball全球肆虐", "url": "https://www.freebuf.com/video/136920.html", "time": "2017-06-11", "level": "红色标题", "num_look": 602598, "num_comment": 2, "author": "willhuang", "tags": ["视频"], "text": "《网络安全法》开始施行；首届腾讯TCTF线下决赛火热进行；Fireball全球肆虐"}
{"title": "“暗黑流量”超大规模DDoS溯源分析", "url": "https://www.freebuf.com/articles/network/136963.html", "time": "2017-06-10", "level": "", "num_look": 636618, "num_comment": 10, "author": "云鼎实验室", "tags": ["网络安全"], "text": "腾讯云鼎实验室的合作伙伴Panabit于2017年5月26日19点开始，监测到一次大面积网络攻击活动，本次活动呈现的最明显特点是参与攻击的源地址覆盖度超级广泛。"}
{"title": "趣店安全实习生招聘", "url": "https://www.freebuf.com/jobs/135544.html", "time": "2017-06-10", "level": "", "num_look": 492355, "num_comment": 11, "author": "喵喵", "tags": ["安全招聘"], "text": "趣店集团成立于2014年3月，是服务于年轻人的消费金融平台。"}
{"title": "暗云Ⅲ BootKit 木马分析", "url": "https://www.freebuf.com/articles/system/134017.html", "time": "2017-06-10", "level": "", "num_look": 1014075, "num_comment": 17, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "从今年4月开始，“暗云”系列木马卷土重来，再次爆发，本次爆发的暗云木马相比之前的版本有比较明显的晋级特征。"}
{"title": "智库报告：英国“三叉戟”核潜艇系统存在网络安全隐患易受网络攻击", "url": "https://www.freebuf.com/news/136490.html", "time": "2017-06-10", "level": "", "num_look": 513722, "num_comment": 513722, "author": "clouds", "tags": ["安全报告", "资讯"], "text": "最近，伦敦智库英美安全信息委员会（BASIC）发布调查报告称，英国“三叉戟”核潜艇存在严重网络安全隐患。"}
{"title": "路由器的LED灯将允许攻击者从物理隔离计算机中窃取数据", "url": "https://www.freebuf.com/news/136737.html", "time": "2017-06-10", "level": "", "num_look": 405129, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "来自以色列的研究人员在本周发布了一篇研究报告，并演示了如何通过分析路由器LED灯的闪烁信号来从一台物理隔离计算机中提取或转移数据。"}
{"title": "浅谈僵尸网络利器：Fast-flux技术", "url": "https://www.freebuf.com/articles/network/136423.html", "time": "2017-06-10", "level": "现金奖励", "num_look": 769409, "num_comment": 4, "author": "ArkTeam", "tags": ["网络安全"], "text": "不少控制者为了保护C&C主机，使用Fast-flux技术来提高C&C服务器的健壮性。"}
{"title": "NAND闪存中存在安全漏洞，易遭“电容耦合”及“读取干扰”攻击", "url": "https://www.freebuf.com/news/135889.html", "time": "2017-06-09", "level": "", "num_look": 447127, "num_comment": 1, "author": "Elaine_z", "tags": ["资讯"], "text": "卡耐基梅隆大学，希捷科技和苏黎世联邦理工学院的安全专家们在NAND数据存储芯片的专用芯片阵列中发现了安全漏洞"}
{"title": "教你如何使用XSS来搞定当下热门的CMS（含演示视频）", "url": "https://www.freebuf.com/articles/web/136631.html", "time": "2017-06-09", "level": "", "num_look": 561482, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "CMS不仅具有模块安装功能，而且还允许我们查看到系统管理员之前所发送的全部请求。因此，CMS也就成为了XSS攻击的一种绝佳目标。"}
{"title": "MOSEC 2017移动安全技术峰会即将开幕", "url": "https://www.freebuf.com/news/136868.html", "time": "2017-06-09", "level": "", "num_look": 592862, "num_comment": 2, "author": "AdlerI", "tags": ["活动", "资讯"], "text": "第三届MOSEC移动安全技术峰会时间定于2017年6月23日（周五）在上海浦东黄浦江畔上海凯宾斯基大酒店大宴会举行。"}
{"title": "一款针对 macOS FileVault 磁盘文件保护的密码破解器", "url": "https://www.freebuf.com/sectool/136553.html", "time": "2017-06-09", "level": "", "num_look": 524377, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["工具", "数据安全"], "text": "本文介绍的是一款针对macOS FileVault磁盘文件保护功能的密码破解工具，该工具简单易用，希望各位Freebuf的同学能够喜欢。"}
{"title": "东方财富招聘信息安全工程师", "url": "https://www.freebuf.com/jobs/136147.html", "time": "2017-06-09", "level": "", "num_look": 490984, "num_comment": 11, "author": "东方财富安全应急响应中心", "tags": ["安全招聘"], "text": "东方财富网创办于2004年, 始终坚持“用户为王”的经营理念，已成为具有海量用户数的财经门户网站。"}
{"title": "PHP白盒审计工具RIPS源码简析", "url": "https://www.freebuf.com/sectool/136552.html", "time": "2017-06-09", "level": "金币+20", "num_look": 654693, "num_comment": 7, "author": "nightmarelee", "tags": ["WEB安全", "工具"], "text": "RIPS是一款对PHP源码进行风险扫描的工具，这篇文章对其源码进行了解析。"}
{"title": "无需宏，PPT也能用来投递恶意程序", "url": "https://www.freebuf.com/news/136718.html", "time": "2017-06-09", "level": "", "num_look": 586952, "num_comment": 5, "author": "Akane", "tags": ["资讯"], "text": "近日，网络犯罪者开发出了一种新型攻击技术，它可以利用发送PPT文件和鼠标悬停来让用户执行任意代码，并下载恶意程序。"}
{"title": "MSF外网持久控制Android手机并渗透测试局域网", "url": "https://www.freebuf.com/sectool/136574.html", "time": "2017-06-09", "level": "现金奖励", "num_look": 1416798, "num_comment": 44, "author": "求一份网络安全实习", "tags": ["工具", "网络安全"], "text": "以前经常看Freebuf,学到了不少东西,现在想给入门的同学提供一点微小的帮助。"}
{"title": "IBM终于对9个月前发现的严重漏洞发布缓解方案！但白帽子心里委屈……", "url": "https://www.freebuf.com/news/136739.html", "time": "2017-06-09", "level": "", "num_look": 301986, "num_comment": 1, "author": "clouds", "tags": ["资讯"], "text": "IBM总算针对其软件产品中9个月前被发现的严重漏洞发布了修复解决方案，利用该漏洞，攻击者可以从本地网络提权并窃取数据。"}
{"title": "如何在macOS上监听单个应用HTTPS流量", "url": "https://www.freebuf.com/articles/network/136186.html", "time": "2017-06-09", "level": "", "num_look": 386964, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "在这篇文章中，我将教会大家如何在macOS上监听和拦截单个应用的HTTPS加密流量。"}
{"title": "深入理解JAVA反序列化漏洞", "url": "https://www.vulbox.com/knowledge/detail/?id=11", "time": "2017-06-08", "level": "", "num_look": 41351, "num_comment": 41351, "author": "漏洞盒子", "tags": ["漏洞"], "text": "本文的主要内容是由浅入深地从理解漏洞原理到如何排查、防范Java的反序列化漏洞，希望可以帮助到广大的程序员和安全爱好者。"}
{"title": "国内Foscam制造的IP摄像头被曝出大量漏洞", "url": "https://www.freebuf.com/vuls/136794.html", "time": "2017-06-08", "level": "金币+20", "num_look": 755163, "num_comment": 8, "author": "Alpha_h4ck", "tags": ["漏洞"], "text": "据了解，这些漏洞其实早在几个月前就已经上报给厂商了，但直到目前为止我们仍然没有拿到可用的更新补丁。"}
{"title": "Hackerone报告离线版", "url": "https://www.freebuf.com/sectool/136401.html", "time": "2017-06-08", "level": "现金奖励", "num_look": 610377, "num_comment": 10, "author": "陌度", "tags": ["工具"], "text": "之前在hackerone看报告，但是由于一些问题（你懂的）访问很卡，所以干脆弄一个django离线版，而且比起官网还弄了一个搜索功能，进行报告的筛选。"}
{"title": "基于时间和地域构建一个网络诈骗形势模型", "url": "https://www.freebuf.com/news/136455.html", "time": "2017-06-08", "level": "现金奖励", "num_look": 374373, "num_comment": 4, "author": "西角边的MR", "tags": ["其他", "资讯"], "text": "本文从网络中爬取相关的新闻，通过对时域和数量的统计与分析，实现对网络诈骗模型中时间参量的优化，进而达到提高对于网络诈骗的识别效果的目的。"}
{"title": "中兴通讯诚聘信息安全策略规划经理", "url": "https://www.freebuf.com/jobs/136023.html", "time": "2017-06-08", "level": "", "num_look": 438268, "num_comment": 8, "author": "amyqqy", "tags": ["安全招聘"], "text": ""}
{"title": "论如何反击用AWVS的黑客", "url": "https://www.freebuf.com/news/136476.html", "time": "2017-06-08", "level": "现金奖励", "num_look": 977043, "num_comment": 34, "author": "温酒", "tags": ["WEB安全", "资讯"], "text": "这篇文章是教大家如何利用AWVS的特性，拿到对方内网的脆弱设备SHELL，给入侵我们的黑客一个惊喜。"}
{"title": "一个脑洞“颇大”的恶搞链接", "url": "https://www.freebuf.com/articles/web/136299.html", "time": "2017-06-08", "level": "现金奖励", "num_look": 649334, "num_comment": 26, "author": "十页书", "tags": ["WEB安全"], "text": "经过自己多次作死得出几个结果，也得出了一些疑问。经测试市面上多数浏览器都会跪在cr.html面前。"}
{"title": "NSA承包商雇员遭FBI逮捕，俄罗斯干预美国大选内部机密文件曝光", "url": "https://www.freebuf.com/news/136653.html", "time": "2017-06-08", "level": "", "num_look": 431361, "num_comment": 5, "author": "Elaine_z", "tags": ["网络安全", "资讯"], "text": "近日，又有一则新的新闻——NSA承包商雇员被FBI逮捕，掀起了俄罗斯通过黑客攻击干涉2016美国大选事件的新一轮议论。本文梳理了该起事件的最新进展。"}
{"title": "XData勒索病毒加密方式剖析及解密工具", "url": "https://www.freebuf.com/sectool/136540.html", "time": "2017-06-08", "level": "", "num_look": 465553, "num_comment": 1, "author": "腾讯电脑管家", "tags": ["工具", "系统安全"], "text": "腾讯安全反病毒实验室监控到一类“XData”勒索病毒，国内也出现了个别中毒用户。本文着重介绍“XData”勒索 病毒的加密方式，并给出我们的解密工具。"}
{"title": "如何转换永恒之蓝（Eternalblue）的POC", "url": "https://www.freebuf.com/articles/network/136566.html", "time": "2017-06-07", "level": "金币+15", "num_look": 895829, "num_comment": 18, "author": "cc是我表哥", "tags": ["特别企划", "网络安全"], "text": "研究后发现FOFA是支持Ruby的POC，Ruby能做Web编程和系统编程。于是我给自己定了目标：将MS17010的POC录进FOFA里面。"}
{"title": "Powershell编码与混淆", "url": "https://www.freebuf.com/sectool/136328.html", "time": "2017-06-07", "level": "金币+15", "num_look": 778234, "num_comment": 8, "author": "al0ne_", "tags": ["工具"], "text": "今天主要说一下Invoke-Obfuscation 这个powershell混淆编码框架，这也是著名的组织 （海莲花）经常使用的一个工具。"}
{"title": "北京玖富集团诚聘安全工程师（坐标望京SOHO）", "url": "https://www.freebuf.com/jobs/135961.html", "time": "2017-06-07", "level": "", "num_look": 367920, "num_comment": 8, "author": "9FHR", "tags": ["安全招聘"], "text": "玖富-（9fbank.com）是中国领先的移动互联网金融综合服务平台,成立于2006年，注册资金2亿元人民币。"}
{"title": "挖洞经验 | 看我如何找到雅虎的远程代码执行漏洞并获得5500刀奖金", "url": "https://www.freebuf.com/vuls/136603.html", "time": "2017-06-07", "level": "金币+15", "num_look": 676723, "num_comment": 7, "author": "Alpha_h4ck", "tags": ["漏洞"], "text": "几个月前，安全专家在Apache Struts2中发现了一个严重的安全漏洞CVE-2017-5638，可能有些同学已经听说过这件事情。用它其实还能在雅虎再赚钱？"}
{"title": "狄仁杰探案之“永恒之蓝”", "url": "https://www.freebuf.com/articles/system/136298.html", "time": "2017-06-07", "level": "现金奖励", "num_look": 631399, "num_comment": 12, "author": "兰云科技银河实验室", "tags": ["特别企划", "系统安全"], "text": "唐武周年间，WannaCry 蠕虫爆发。朝野之间，电脑屏幕尽呈一片血色，刚刚宁定不久的武周天下，又面临一场浩劫。狄仁杰，元芳，狄春三人奉旨研究此漏洞。"}
{"title": "DeathStar：一键自动化域渗透工具（含演示视频）", "url": "https://www.freebuf.com/sectool/136224.html", "time": "2017-06-07", "level": "", "num_look": 647803, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["工具"], "text": "毕竟，通过“即发即弃”的脚本来自动化获取域管理员权限（Domain Admin）是大家都想实现的一个目标，没错吧？"}
{"title": "谷歌如何用人工智能和集体智慧消灭“有毒评论”", "url": "https://www.freebuf.com/articles/others-articles/136223.html", "time": "2017-06-07", "level": "金币+15", "num_look": 258655, "num_comment": 258655, "author": "heather", "tags": ["其他"], "text": "Perspectives借助机器学习模型评估网络会话影响，其第一个功能识别线上“有毒（Toxic）”评论已经上线。"}
{"title": "WannaCry的一个编码错误，也许能帮我们恢复加密文件", "url": "https://www.freebuf.com/news/136569.html", "time": "2017-06-06", "level": "", "num_look": 396161, "num_comment": 7, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "卡巴斯基实验室针对WannaCry代码进行深入分析，发现WannaCry里面的各种编码错误，这样一来感染的人就有可能进行文件恢复了。"}
{"title": "高通（Qualcomm）LK源码深度分析（二）", "url": "https://www.freebuf.com/articles/terminal/136030.html", "time": "2017-06-06", "level": "现金奖励", "num_look": 613043, "num_comment": 3, "author": "SetRet", "tags": ["终端安全"], "text": "本文承接上期的分析，继续深入高通LK源码分析"}
{"title": "警惕“永恒之蓝”抓鸡工具包里的后门", "url": "https://www.freebuf.com/articles/system/136361.html", "time": "2017-06-06", "level": "金币+15", "num_look": 630112, "num_comment": 14, "author": "msx2009", "tags": ["系统安全"], "text": "前几天晚上闲来无事，朋友给了我一个445批量工具，可能有后门程序，让我分析一下。经过分析我发现后门位于dll文件中，抓鸡大牛们要小心了。"}
{"title": "美创科技招聘信息安全工程师", "url": "https://www.freebuf.com/jobs/135611.html", "time": "2017-06-06", "level": "", "num_look": 382778, "num_comment": 16, "author": "杭州美创科技", "tags": ["安全招聘"], "text": "杭州美创科技有限公司（以下简称“美创科技”）是一家聚焦于数据管理和数据价值的发现与挖掘"}
{"title": "美军网络战探寻：走近赖特-帕特森空军基地网络空间研究中心", "url": "https://www.freebuf.com/news/136417.html", "time": "2017-06-06", "level": "", "num_look": 376291, "num_comment": 6, "author": "clouds", "tags": ["资讯"], "text": "今天，我们一起走进位于俄亥俄州代顿市（Dayton）附近神秘的赖特-帕特森空军基地，见识真实世界中的网络战模样，窥探美空军网络战方式手段。"}
{"title": "你会把安全控制权交由第三方外包吗？", "url": "https://www.freebuf.com/articles/security-management/135951.html", "time": "2017-06-06", "level": "", "num_look": 890591, "num_comment": 6, "author": "clouds", "tags": ["企业安全", "安全管理"], "text": "现在，面对每天频繁多变的网络攻击，很多公司认为，交给第三方更能有效减少安全风险。这种把安全控制权完全交由第三方来管理的手段可不可行？"}
{"title": "MOTS攻击技术分析", "url": "https://www.freebuf.com/articles/network/135960.html", "time": "2017-06-06", "level": "现金奖励", "num_look": 656712, "num_comment": 20, "author": "feiniao", "tags": ["网络安全"], "text": "难道旁路监听的设备可以用来进行攻击，并影响客户端请求最终的响应结果？的确可以！下面我们来介绍MOTS的攻击原理及常见的攻击类型。"}
{"title": "美国国防部承包商将敏感文件遗留在亚马逊服务器上了，任何人都可以访问", "url": "https://www.freebuf.com/news/136187.html", "time": "2017-06-06", "level": "", "num_look": 332305, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "根据一份最新的调查报告显示，美国国防部其中的一个国家顶级情报承包商将大量与美国情报机构有关的敏感文件遗留在了亚马逊的一台公共服务器上。而且更重要的是，这些文件都没有密码保护，这也就意味着任何人都可以…"}
{"title": "证书签发机构StartCom也被曝签发假证书", "url": "https://www.freebuf.com/news/136404.html", "time": "2017-06-05", "level": "", "num_look": 379740, "num_comment": 16, "author": "Sphinx", "tags": ["资讯"], "text": "StartCom之前已经被大部分浏览器取消信任，但前几天被曝光签发了假的证书，包括最高信任级别的 EV 证书。"}
{"title": "如何用HERCULES绕过杀软", "url": "https://www.freebuf.com/articles/system/135938.html", "time": "2017-06-05", "level": "现金奖励", "num_look": 771292, "num_comment": 32, "author": "noosec", "tags": ["系统安全"], "text": "只需简单的设置，就可以利用HERCULES,生成用于Metasploit的免杀payload，可完美绕过当前主流防病毒软件查杀检测。"}
{"title": "中国金融认证中心招聘渗透测试工程师", "url": "https://www.freebuf.com/jobs/135893.html", "time": "2017-06-05", "level": "", "num_look": 495718, "num_comment": 15, "author": "cfca", "tags": ["安全招聘"], "text": "中金金融认证中心有限公司是由中国人民银行于1998年牵头组建，是国家重要的金融信息安全基础设施之一。"}
{"title": "基于bro的计算机入侵取证实战分析", "url": "https://www.freebuf.com/articles/system/135843.html", "time": "2017-06-05", "level": "现金奖励", "num_look": 683003, "num_comment": 11, "author": "Charlene", "tags": ["系统安全", "网络安全"], "text": "计算机取证是运用计算机及其相关科学和技术的原理和方法获取与计算机相关的证据以证明某个客观事实的过程。"}
{"title": "趋势科技发布《勒索软件的过去、现在和未来》安全报告", "url": "https://www.freebuf.com/articles/paper/136213.html", "time": "2017-06-05", "level": "", "num_look": 740497, "num_comment": 740497, "author": "米雪儿", "tags": ["安全报告"], "text": "事实上，在过去的2016年，新出现的勒索病毒种类暴涨了近8倍，收取的赎金接近10亿美元。"}
{"title": "FreeBuf报道 | 首届腾讯TCTF线下决赛全记录：新人赛队 & 国际强队奋力鏖战的30小时", "url": "https://www.freebuf.com/fevents/136325.html", "time": "2017-06-05", "level": "红色标题", "num_look": 688767, "num_comment": 3, "author": "Elaine_z", "tags": ["活动"], "text": "6月3日下午四点，首届腾讯信息安全争霸赛（Tencent Capture The Flag，简称TCTF）圆满结束，为期两天的 0CTF 及 RisingStar CTF 决赛落下帷幕。"}
{"title": "国产流氓软件“火球”分析与溯源", "url": "https://www.freebuf.com/news/136256.html", "time": "2017-06-04", "level": "", "num_look": 519823, "num_comment": 5, "author": "火绒安全", "tags": ["系统安全", "资讯"], "text": "火绒安全团队通过追踪发现，其均由同一作者“baoyu430@gmail.com”制作。作者注册不同网站，制作了一批流氓软件。"}
{"title": "大量第三方库令心脏起搏器存在安全风险", "url": "https://www.freebuf.com/news/135899.html", "time": "2017-06-04", "level": "", "num_look": 449061, "num_comment": 7, "author": "vulture", "tags": ["资讯"], "text": "研究人员仔细分析了四大厂商的心脏起搏器系统，发现了大量会造成严重影响的漏洞。"}
{"title": "NSA武器库Esteemaudit技术解析", "url": "https://www.freebuf.com/sectool/136102.html", "time": "2017-06-04", "level": "", "num_look": 632984, "num_comment": 8, "author": "腾讯电脑管家", "tags": ["工具"], "text": "Esteemaudit”黑客工具，同WannaCry勒索病毒利用的“EternalBlue”黑客工具一样，是 Shadow Brokers”近期泄露的NSA众多漏洞利用工具之一。"}
{"title": "陌陌科技诚聘安全工程师", "url": "https://www.freebuf.com/jobs/134970.html", "time": "2017-06-04", "level": "", "num_look": 468024, "num_comment": 5, "author": "andy110", "tags": ["安全招聘"], "text": "陌陌HR直招职位，诚聘安全工程师。提供有竞争力的薪资待遇、足够宽广的上升空间、一流办公环境和良好工作氛围等。"}
{"title": "信息安全与对抗技术竞赛（ISCC 2017）WriteUp（详细，通俗易懂）", "url": "https://www.freebuf.com/articles/others-articles/135825.html", "time": "2017-06-04", "level": "现金奖励", "num_look": 1031744, "num_comment": 11, "author": "Down_cent", "tags": ["其他"], "text": "本文仅供参考，仅当思路交流使用。本WP记录了ISCC二十多天来的比赛历程。"}
{"title": "Chrome漏洞可致恶意站点在用户在不知情的情况下录制音频和视频", "url": "https://www.freebuf.com/news/136015.html", "time": "2017-06-04", "level": "", "num_look": 409860, "num_comment": 6, "author": "Sphinx", "tags": ["资讯"], "text": "有没有可能我们在不知情的情况下被电脑录音和录像？黑客可以从而听到你的每一通电话，看到你周围的人。这听来恐怖，但有的时候我们真的无法完全知晓我们的电脑在干什么。"}
{"title": "Fireball真相：一个菜鸟级流氓软件竟让老外如临大敌", "url": "https://www.freebuf.com/news/136301.html", "time": "2017-06-03", "level": "", "num_look": 668666, "num_comment": 16, "author": "360安全", "tags": ["系统安全", "资讯"], "text": "究竟这款恶意软件有多么的“复杂”呢？"}
{"title": "这可能是史上最大规模Google Play恶意程序活动", "url": "https://www.freebuf.com/news/136098.html", "time": "2017-06-03", "level": "", "num_look": 519465, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["网络安全", "资讯"], "text": "Google官方App商城Google Play中发现了一种大规模恶意软件活动，这款恶意软件名叫“Judy”，是一款自动点击型恶意软件"}
{"title": "思科和IBM宣布达成历史性的网络安全领域合作伙伴关系", "url": "https://www.freebuf.com/news/136222.html", "time": "2017-06-03", "level": "金币+8", "num_look": 326798, "num_comment": 1, "author": "crown丶prince", "tags": ["资讯"], "text": "科技巨头在劳动力短缺的情况下联手，这将在行业竞争中，使其客户获得更好的服务。"}
{"title": "FreeBuf现场报道|腾讯TCTF决赛首日：赛场内争先恐后，赛场外如火如荼", "url": "https://www.freebuf.com/fevents/136260.html", "time": "2017-06-03", "level": "红色标题", "num_look": 543914, "num_comment": 3, "author": "AngelaY", "tags": ["活动"], "text": "6月2日，首届腾讯信息安全争霸赛（TCTF）决赛首日比赛在深圳拉开帷幕。比赛沙龙齐齐上阵，场内场外气氛热烈！"}
{"title": "河北龙瀚招聘安全技术总监、高级安全工程师等人才", "url": "https://www.freebuf.com/jobs/136166.html", "time": "2017-06-03", "level": "", "num_look": 342452, "num_comment": 7, "author": "龙瀚hr", "tags": ["安全招聘"], "text": "河北龙瀚集团，成立于2012年。集团主营项目涵盖软件系统整体设计开发、网络信息安全、大数据开发与应用、行业媒体平台等多个业务板块。"}
{"title": "安天移动安全2017年Q1移动终端钓鱼网站分析报告", "url": "https://www.freebuf.com/articles/terminal/135986.html", "time": "2017-06-03", "level": "", "num_look": 653240, "num_comment": 3, "author": "AVLTeam", "tags": ["安全报告", "终端安全"], "text": "本报告重点分析了2017年第一季度（Q1）移动终端钓鱼网站整体情况，帮助用户全面了解移动钓鱼网站特性，提高用户安全防范意识。"}
{"title": "一款强大的WordPress漏洞利用框架 - WPXF", "url": "https://www.freebuf.com/articles/web/135777.html", "time": "2017-06-03", "level": "", "num_look": 592986, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "今天给大家介绍的工具是一款Ruby框架，该框架采用模块化开发，旨在帮助安全研究专家对基于WordPress的网站和系统进行渗透测试工作。"}
{"title": "2017年上半年重大黑客事件盘点", "url": "https://www.freebuf.com/news/135842.html", "time": "2017-06-03", "level": "", "num_look": 945021, "num_comment": 7, "author": "secist", "tags": ["特别企划", "资讯"], "text": "在过去的2016年，发生了许多大规模和令人震惊的网络攻击事件。正如我们所预料的，2017年我们将面对更严峻的安全挑战！"}
{"title": "Fireball恶意程序已袭击全球将近2.5亿台PC，背后推手是一家中国电子营销机构", "url": "https://www.freebuf.com/news/136240.html", "time": "2017-06-02", "level": "红色标题", "num_look": 689985, "num_comment": 7, "author": "Sphinx", "tags": ["资讯"], "text": "研究人员发现了一款传播范围极广的恶意软件，感染的计算机数量高达2.5亿，包括Windows和Mac OS。"}
{"title": "Verisign发布2017年Q1全球DDoS攻击趋势报告", "url": "https://www.freebuf.com/articles/network/135756.html", "time": "2017-06-02", "level": "", "num_look": 707395, "num_comment": 2, "author": "米雪儿", "tags": ["安全报告", "网络安全"], "text": "信息安全公司Verisign发布了2017年第一季度的DDos趋势报告。此份报告介绍了该公司观察到的DDoS攻击频率，大小和类型的变化。"}
{"title": "开发者服务是“身份验证安全服务（IDaaS）”的下一个救赎？", "url": "https://www.freebuf.com/articles/neopoints/135920.html", "time": "2017-06-02", "level": "金币+15", "num_look": 387681, "num_comment": 3, "author": "rodgun", "tags": ["观点"], "text": "开发者服务， 是IDaaS创业者们的下一个救赎吗？"}
{"title": "菜鸟顺丰劲爆互怼，却把新生的《网络安全法》撞了个满怀", "url": "https://www.freebuf.com/news/136210.html", "time": "2017-06-02", "level": "", "num_look": 626389, "num_comment": 19, "author": "Akane", "tags": ["观点", "资讯"], "text": "昨天（6月1日）的菜鸟顺丰互怼大戏，双方各执一词，但都声称自己是为了信息安全和用户隐私，好一出互联网罗生门。"}
{"title": "深圳我来贷诚聘安全渗透专家", "url": "https://www.freebuf.com/jobs/136079.html", "time": "2017-06-02", "level": "", "num_look": 423978, "num_comment": 29, "author": "WeLab", "tags": ["安全招聘"], "text": "位于深圳的互联网金融集团WeLab（我来贷）招聘安全渗透专家"}
{"title": "谁动了我的主机? 之活用History命令|Linux安全运维", "url": "https://www.freebuf.com/articles/system/135845.html", "time": "2017-06-02", "level": "金币+15", "num_look": 825867, "num_comment": 14, "author": "悬镜安全实验室", "tags": ["系统安全"], "text": "本篇文章是悬镜安全实验室运维小伙们写的一篇文章，适合初中级运维人员阅读。作者结合自己多年丰富的工作实战经验，讲述了如何活用history命令。"}
{"title": "Cloak & Dagger攻击：一种可针对所有版本Android的攻击技术（含演示视频）", "url": "https://www.freebuf.com/news/135828.html", "time": "2017-06-02", "level": "", "num_look": 429948, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["终端安全", "资讯"], "text": "近期，安全研究专家发现了名为“Cloak and Dagger”的新型攻击，可以拿下目前所有版本的Android操作系统（最高到v7.1.2），十分可怕。"}
{"title": "【已结束】TCTF2017腾讯信息安全争霸赛决赛图文直播", "url": "https://www.freebuf.com/fevents/136177.html", "time": "2017-06-02", "level": "红色标题", "num_look": 571078, "num_comment": 9, "author": "AngelaY", "tags": ["活动"], "text": "首届腾讯信息安全争霸赛(Tencent Capture The Flag，简称TCTF)线下决赛，将于6月2日-4日在深圳举行。首日比赛于6月2日10:00精彩开启。"}
{"title": "如何保护网页按钮不被XSS自动点击", "url": "https://www.freebuf.com/articles/web/135759.html", "time": "2017-06-02", "level": "金币+15", "num_look": 452470, "num_comment": 5, "author": "EtherDream", "tags": ["WEB安全"], "text": ""}
{"title": "SELinux曝新安全漏洞：用户执行sudo命令可获取root权限", "url": "https://www.freebuf.com/vuls/136156.html", "time": "2017-06-02", "level": "", "num_look": 1023011, "num_comment": 36, "author": "Elaine_z", "tags": ["漏洞", "系统安全"], "text": "来自 Qualys Security 的安全专家，最近发现了新的 Linux 系统漏洞。他们发现，利用该漏洞可以实现用户权限的提升，并可以覆盖文件系统中的文件。"}
{"title": "解码新型勒索病毒Spora ，通过IE、Flash漏洞等方式传播", "url": "https://www.freebuf.com/articles/system/136005.html", "time": "2017-06-01", "level": "", "num_look": 384143, "num_comment": 5, "author": "火绒安全", "tags": ["系统安全"], "text": "火绒实验室截获了一个新勒索病毒Spora，通过漏洞和诱骗方式传播，除了加密被感染电脑的本机文件外，还会加密局域网共享文件夹中的文件。"}
{"title": "如何保护企业云免受勒索软件攻击？", "url": "https://www.freebuf.com/articles/security-management/135757.html", "time": "2017-06-01", "level": "", "num_look": 683552, "num_comment": 4, "author": "米雪儿", "tags": ["安全管理"], "text": "以下总结的安全防范措施，将有助于保障你的企业云免受勒索软件攻击威胁"}
{"title": "2017年第一季度信息安全行业融资交易总额创新高", "url": "https://www.freebuf.com/articles/paper/135761.html", "time": "2017-06-01", "level": "", "num_look": 517460, "num_comment": 517460, "author": "Elaine_z", "tags": ["安全报告"], "text": "2017第一季度私有网络安全公司的融资交易数量，达到历史五年的最高水平。"}
{"title": "360智能网联汽车安全实验室招聘安全研究员", "url": "https://www.freebuf.com/jobs/135801.html", "time": "2017-06-01", "level": "", "num_look": 398017, "num_comment": 5, "author": "adrain1987", "tags": ["安全招聘"], "text": "360汽车信息安全实验室由多名不同领域安全专家共同组建，研究方向包括：汽车总线安全、车联网漏洞挖掘、自动驾驶汽车传感器漏洞、V2X通信漏洞。"}
{"title": "分享一种可关闭大多数杀软的技术（对360安全卫士已验证成功）", "url": "https://www.freebuf.com/articles/system/135708.html", "time": "2017-06-01", "level": "金币+15", "num_look": 1102247, "num_comment": 44, "author": "expsky", "tags": ["系统安全"], "text": "真有能关掉杀软的技术手段吗？"}
{"title": "如何理解工控系统中的系统安全风险", "url": "https://www.freebuf.com/news/135674.html", "time": "2017-06-01", "level": "", "num_look": 638497, "num_comment": 638497, "author": "Alpha_h4ck", "tags": ["工控安全", "系统安全"], "text": "我打算在这篇文章中跟大家讨论ICS网络目前所面临的安全风险。"}
{"title": "“数”说Wannacry的比特币钱包", "url": "https://www.freebuf.com/news/135710.html", "time": "2017-06-01", "level": "现金奖励", "num_look": 528859, "num_comment": 20, "author": "追影人", "tags": ["资讯"], "text": "本文便是利用比特币交易明细公开化的特性，从数据的角度扒一扒这三个账户的秘密。"}
{"title": "5个问题快速读懂今起实施的《网络安全法》", "url": "https://www.freebuf.com/news/136090.html", "time": "2017-06-01", "level": "", "num_look": 648854, "num_comment": 14, "author": "欧阳洋葱", "tags": ["资讯"], "text": "通过这个5个问题，让所有关心《网络安全法》的各位清楚，这部法律对我们每个人、企业组织和各种不同的角色而言意味着什么？"}
{"title": "想拥有ShadowBrokers的0day工具吗？现在加入订阅计划，每月仅需23000美元", "url": "https://www.freebuf.com/news/136004.html", "time": "2017-05-31", "level": "", "num_look": 572887, "num_comment": 11, "author": "sunleying", "tags": ["资讯"], "text": "Shadow Brokers在最新的公告中表示，每个月将以订阅的方式出售数据，费用为100Zcash（约23,000美元）每月。"}
{"title": "看我如何发现Twitter任意账户发送推文漏洞并获得7560美元赏金", "url": "https://www.freebuf.com/vuls/135610.html", "time": "2017-05-31", "level": "", "num_look": 1163272, "num_comment": 7, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "在Twitter漏洞赏金项目，我通过一些安全测试发现了Twitter存在的重大漏洞：攻击者不需要获取他人账户权限，就能以任意账户发布推文。"}
{"title": "看个视频也被黑？加载字幕文件触发播放器漏洞实现系统入侵", "url": "https://www.freebuf.com/articles/web/135824.html", "time": "2017-05-31", "level": "", "num_look": 436066, "num_comment": 4, "author": "clouds", "tags": ["WEB安全"], "text": "当受害者加载了攻击者制作的恶意字幕文件后将会触发播放器漏洞，从而实现对受害者系统“悄无声息”地完全控制。"}
{"title": "Linux中的GOT和PLT到底是个啥？", "url": "https://www.freebuf.com/articles/system/135685.html", "time": "2017-05-31", "level": "现金奖励", "num_look": 890533, "num_comment": 9, "author": "PhyzX", "tags": ["系统安全"], "text": "本文以Ian Wienand的博客 为蓝本，在必要的地方予以增补、解释以及再实验，希望读者对PLT和GOT有一个初步的、相对完整的认识。"}
{"title": "改造Nginx，让邮件系统也支持双因子验证", "url": "https://www.freebuf.com/articles/network/135640.html", "time": "2017-05-31", "level": "现金奖励", "num_look": 631066, "num_comment": 10, "author": "idapro", "tags": ["网络安全"], "text": "最近在研究双因子认证的时候突然想到：能不能在邮件系统中应用双因子验证呢？作为一个有了想法就想落地的四有好少年，我决定试试。"}
{"title": "常见无线DOS攻击", "url": "https://www.freebuf.com/articles/wireless/135598.html", "time": "2017-05-31", "level": "金币+15", "num_look": 986068, "num_comment": 14, "author": "gncao", "tags": ["无线安全"], "text": "盘点常见的无线DOS攻击"}
{"title": "对众多知名公司造成影响的Oracle Responsys本地文件包含漏洞", "url": "https://www.freebuf.com/vuls/135512.html", "time": "2017-05-30", "level": "", "num_look": 575245, "num_comment": 575245, "author": "clouds", "tags": ["漏洞"], "text": "今天我要向大家展示的是，我如何发现了Oracle Responsys云服务系统中的一个本地文件包含漏洞（LFI）。"}
{"title": "微信电影票诚聘安全开发工程师", "url": "https://www.freebuf.com/jobs/133685.html", "time": "2017-05-30", "level": "", "num_look": 378541, "num_comment": 4, "author": "manchester", "tags": ["安全招聘"], "text": "北京微影时代科技有限公司，是基于移动社交的电影、演出、体育等文化娱乐营销与发行平台，是移动互联网时代文化娱乐产业与用户之间的“连接者”。"}
{"title": "恶意广告又找到了新的方法绕过广告屏蔽工具", "url": "https://www.freebuf.com/news/135821.html", "time": "2017-05-30", "level": "", "num_look": 504210, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["WEB安全", "资讯"], "text": "广告屏蔽工具已经称为我们对抗恶意广告活动最后的希望了，但这个最后的保护屏障似乎也已经坍塌了。"}
{"title": "Malwaresearch：在Openmalware.org上查找恶意软件的命令行工具", "url": "https://www.freebuf.com/sectool/134229.html", "time": "2017-05-30", "level": "", "num_look": 431792, "num_comment": 4, "author": "米雪儿", "tags": ["工具"], "text": "Malwaresearch是一个在Openmalware.org上查找恶意软件的命令行工具，旨在加快查找及下载恶意软件样本的过程。"}
{"title": "Oracle人力资源管理系统PeopleSoft未授权远程代码执行漏洞解析", "url": "https://www.freebuf.com/vuls/135318.html", "time": "2017-05-29", "level": "", "num_look": 840610, "num_comment": 1, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "根据ERPScan的演讲PDF我发现，尽管网上鲜有PeopleSoft的安全信息，但它其实漏洞重重。"}
{"title": "LoadLibrary：一款能够允许Linux程序从DLL文件中加载或调用函数的工具", "url": "https://www.freebuf.com/sectool/135683.html", "time": "2017-05-29", "level": "", "num_look": 764743, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家推荐的这个代码库能把原生Linux程序从一个WindowsDLL文件中加载或调用功能函数。通过它我们可以把Windows Defender“移植”到Linux平台。"}
{"title": "TLS 1.3如何用性能为HTTPS正名", "url": "https://www.freebuf.com/articles/web/135545.html", "time": "2017-05-29", "level": "金币+12", "num_look": 567870, "num_comment": 3, "author": "lalalaha", "tags": ["WEB安全", "其他"], "text": "如果说 HTTP/2 是当前互联网 Web 发展的讨论热点之一，那么下一个热点应该就是 TLS 1.3 了。"}
{"title": "2017年第一季度中国手机安全状况报告", "url": "https://www.freebuf.com/articles/terminal/135601.html", "time": "2017-05-28", "level": "", "num_look": 813167, "num_comment": 6, "author": "360安全", "tags": ["安全报告", "终端安全"], "text": "2017年第一季度，360互联网安全中心共截获安卓平台新增恶意程序样本222.8万个，平均每天截获新增手机恶意程序样本近2.5万个。"}
{"title": "利用Regsvr32绕过Applocker的限制策略", "url": "https://www.freebuf.com/articles/terminal/135391.html", "time": "2017-05-28", "level": "", "num_look": 678806, "num_comment": 3, "author": "鸢尾", "tags": ["终端安全"], "text": "AppLocker的设计初衷就是为了帮助管理员Windows安装文件。从各种各样的奇淫巧计中我们得知这些限制是可以绕过的。"}
{"title": "SSRF漏洞中绕过IP限制的几种方法总结", "url": "https://www.freebuf.com/articles/web/135342.html", "time": "2017-05-28", "level": "金币+12", "num_look": 1151091, "num_comment": 3, "author": "ArkTeam", "tags": ["WEB安全"], "text": "本文总结了SSRF漏洞中绕过IP限制的几种方法。"}
{"title": "2017中国网络安全技术对抗赛青岛落幕", "url": "https://www.freebuf.com/news/135888.html", "time": "2017-05-27", "level": "", "num_look": 532926, "num_comment": 3, "author": "CNCERT", "tags": ["资讯"], "text": "5月22日，2017中国网络安全技术对抗赛在青岛落下帷幕"}
{"title": "一加手机OTA相关漏洞分析与利用", "url": "https://www.freebuf.com/vuls/135315.html", "time": "2017-05-27", "level": "金币+12", "num_look": 978779, "num_comment": 6, "author": "鸢尾", "tags": ["漏洞", "终端安全"], "text": "本文我们为大家准备了从一加手机1/X/2/3/3T OxygenOS 及 HydrogenOS中发现的漏洞，最新版本(4.1.3/3.0)及以下版本皆受影响。"}
{"title": "换个角度看看，为什么钓鱼攻击总能成功？", "url": "https://www.freebuf.com/articles/web/135199.html", "time": "2017-05-27", "level": "", "num_look": 655055, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["WEB安全", "观点"], "text": "本文分析了钓鱼攻击为什么总能成功，以及用户应该如何防范。"}
{"title": "福建六壬网安诚聘信息安全相关人才", "url": "https://www.freebuf.com/jobs/126501.html", "time": "2017-05-27", "level": "", "num_look": 509282, "num_comment": 11, "author": "六壬网安", "tags": ["安全招聘"], "text": "福建六壬网安股份有限公司（以下简称六壬网安）创立于2009年，专注于信息安全开发、服务以及创新型IT产品研发领域。"}
{"title": "Pwn2own漏洞分享系列：利用macOS内核漏洞逃逸Safari沙盒", "url": "https://www.freebuf.com/vuls/135557.html", "time": "2017-05-27", "level": "", "num_look": 773843, "num_comment": 4, "author": "360安全", "tags": ["漏洞", "系统安全"], "text": "这篇技术分享将介绍我们所利用的macOS内核漏洞的原理和发现细节。"}
{"title": "Intel产品AMT本地及远程提权漏洞（CVE-2017-5689）复现", "url": "https://www.freebuf.com/vuls/135549.html", "time": "2017-05-27", "level": "金币+12", "num_look": 915513, "num_comment": 18, "author": "test124", "tags": ["漏洞"], "text": "Intel旗下产品英特尔主动管理技术（AMT），英特尔标准可管理性（ISM）和英特尔小型企业技术版本部分固件有漏洞（CVE-2017-5689）"}
{"title": "如何用扫描仪控制的恶意程序，从隔离的网络中获取数据（含攻击演示视频）", "url": "https://www.freebuf.com/news/133979.html", "time": "2017-05-27", "level": "金币+12", "num_look": 1093704, "num_comment": 11, "author": "Alpha_h4ck", "tags": ["无线安全", "极客"], "text": "近期，以色列的安全研究专家发明了一种能够从物理隔离网络中窃取数据的新技术。研究人员表示，他们可以从物理隔离网络中的计算机提取出目标数据。"}
{"title": "语言分析发现：WannaCry勒索软件背后的开发者可能是中国人？", "url": "https://www.freebuf.com/articles/system/135758.html", "time": "2017-05-26", "level": "红色标题", "num_look": 1042789, "num_comment": 33, "author": "Sphinx", "tags": ["系统安全"], "text": "Flashpoint的两位研究员Jon Condra和John Costello称，从语言的角度分析，WannaCry勒索软件背后的开发者可能来自说中文的国家。"}
{"title": "NSA武器库之Eternalchampion（永恒冠军）复现", "url": "https://www.freebuf.com/articles/system/135270.html", "time": "2017-05-26", "level": "金币+10", "num_look": 970314, "num_comment": 33, "author": "The thor", "tags": ["系统安全"], "text": "本文复现了NSA中的eternalchampion（永恒冠军）。"}
{"title": "深信服科技高薪引进安全技术总监、安全攻防、安全售前、安全服务等人才", "url": "https://www.freebuf.com/jobs/134086.html", "time": "2017-05-26", "level": "", "num_look": 616908, "num_comment": 17, "author": "leonhr", "tags": ["安全招聘"], "text": "深信服科技股份是专注于云计算／虚拟化、网络安全领域的IT解决方案服务商，致力于提供创新的IT基础设施云计算、网络安全建设解决方案"}
{"title": "深信服安全产品运营总监（市场体系）& 安全攻防专家（研发体系）高薪招聘", "url": "https://www.freebuf.com/jobs/135427.html", "time": "2017-05-26", "level": "", "num_look": 101920, "num_comment": 101920, "author": "suifeng-刘军", "tags": ["安全招聘"], "text": "深信服科技成立于2000年，是中国最大的新网络产品供应商，致力于提供基于创新网络的产品及解决方案。"}
{"title": "如何用短信完成XSS？", "url": "https://www.freebuf.com/articles/web/135419.html", "time": "2017-05-26", "level": "金币+10", "num_look": 590438, "num_comment": 31, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "本文探讨与分析了利用短信完成XSS的过程"}
{"title": "网卡厂商自动识别工具（附源代码）", "url": "https://www.freebuf.com/sectool/135498.html", "time": "2017-05-26", "level": "金币+10", "num_look": 796363, "num_comment": 22, "author": "gaearrow", "tags": ["工具"], "text": "本文分享的工具实现了在ARP命令（arp -a）输出文件上自动添加相应厂商信息的功能。工具虽小，但是解决了实际需求。"}
{"title": "CNNVD新增技术支撑单位暨优秀技术支撑单位颁奖仪式圆满举行", "url": "https://www.freebuf.com/news/135693.html", "time": "2017-05-25", "level": "", "num_look": 418430, "num_comment": 5, "author": "CNNVD", "tags": ["资讯"], "text": "作为“第三届中国大数据安全高层论坛”的重要活动之一，国家信息安全漏洞库（CNNVD）举办了新增技术支撑单位暨优秀技术支撑单位颁奖仪式"}
{"title": "CNNVD关于“永恒之石”病毒的预警报告", "url": "https://www.freebuf.com/vuls/135694.html", "time": "2017-05-25", "level": "", "num_look": 773991, "num_comment": 4, "author": "CNNVD", "tags": ["漏洞"], "text": "国家信息安全漏洞库（CNNVD）收到关于“永恒之石”（EternalRocks）病毒的分析报告。"}
{"title": "一张GIF引发的微信崩溃", "url": "https://www.freebuf.com/articles/terminal/135577.html", "time": "2017-05-25", "level": "现金奖励", "num_look": 2155145, "num_comment": 49, "author": "_Y", "tags": ["终端安全"], "text": "正当我看着俩宝宝撞屁股的GIF图寻开心的时候，微信突然卡死闪退了。。"}
{"title": "Linux内核ROP姿势详解（二）", "url": "https://www.freebuf.com/articles/system/135402.html", "time": "2017-05-25", "level": "金币+10", "num_look": 452372, "num_comment": 3, "author": "houjingyi", "tags": ["系统安全"], "text": "本文我们将使用Linux内核模块在实践中演示ROP链：提权，修复系统并干净地“退出”到用户态。"}
{"title": "中国游戏公司被微软告上法庭，称中国游戏公司正在入侵Xbox账号", "url": "https://www.freebuf.com/news/135609.html", "time": "2017-05-25", "level": "", "num_look": 299471, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "微软将中国游戏公司iGSKY告上法庭，称其入侵Xbox账号。"}
{"title": "雅虎邮箱也“出血”了，雅虎选择弃用ImageMagick", "url": "https://www.freebuf.com/news/135563.html", "time": "2017-05-25", "level": "", "num_look": 352339, "num_comment": 352339, "author": "AngelaY", "tags": ["资讯"], "text": "近日，图像处理库ImageMagick曝出Yahoobleed漏洞，雅虎邮箱个人邮件图片附件与身份凭证等面临泄露风险。漏洞曝出后，雅虎弃用了这个图像处理库。"}
{"title": "漏洞预警|Samba远程代码执行漏洞，影响7年前版本", "url": "https://www.freebuf.com/vuls/135624.html", "time": "2017-05-25", "level": "", "num_look": 894362, "num_comment": 14, "author": "Sphinx", "tags": ["漏洞"], "text": "Samba是Linux和UNIX系统的SMB协议服务软件，此次漏洞最早影响到7年前的版本，黑客可以利用漏洞进行远程代码执行。"}
{"title": "北京中科网航安全技术有限公司招聘", "url": "https://www.freebuf.com/jobs/134511.html", "time": "2017-05-25", "level": "", "num_look": 338098, "num_comment": 5, "author": "lovemyself", "tags": ["安全招聘"], "text": "北京中科网航安全技术有限公司成立于2003年，是北京市高新技术企业。"}
{"title": "WannaCry之后：安全股大涨，CISO年薪百万欧元！", "url": "https://www.freebuf.com/news/135503.html", "time": "2017-05-25", "level": "", "num_look": 314291, "num_comment": 4, "author": "AngelaY", "tags": ["特别企划", "资讯"], "text": "2017年，网络安全市场估值将超过1200亿美元，是十年前的30倍以上！"}
{"title": "如何使用谷歌Chrome浏览器窃取Windows密码", "url": "https://www.freebuf.com/articles/terminal/135155.html", "time": "2017-05-25", "level": "", "num_look": 475361, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["数据安全", "终端安全"], "text": "这篇文章中我们将介绍一种Windows凭证窃取攻击，这种技术会影响目前最流行的Web浏览器-ChromeChrome（默认配置下），以及支持该浏览器的所有Windows版本。"}
{"title": "如何通过IE11浏览器跨域窃取CSV文件信息（含演示视频+PoC）", "url": "https://www.freebuf.com/articles/web/135082.html", "time": "2017-05-25", "level": "", "num_look": 286590, "num_comment": 286590, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "本文分析如何通过IE11浏览器跨域窃取CSV文件信息。"}
{"title": "绕过三星Galaxy S8的虹膜识别？黑客表示非常简单（含攻击演示视频）", "url": "https://www.freebuf.com/news/135600.html", "time": "2017-05-24", "level": "红色标题", "num_look": 363227, "num_comment": 8, "author": "Alpha_h4ck", "tags": ["终端安全", "资讯"], "text": "这一次遭殃的是在中国地区还没正式上市的三星Galaxy S8。"}
{"title": "2017年第一季度安卓系统安全性生态环境研究", "url": "https://www.freebuf.com/articles/terminal/135351.html", "time": "2017-05-24", "level": "", "num_look": 495313, "num_comment": 1, "author": "360安全", "tags": ["安全报告", "终端安全"], "text": "此报告数据来源为70万份“360透视镜”用户主动上传的漏洞检测报告，检测内容包括最近两年的Android和Chrome安全公告中检出率最高的42个漏洞。"}
{"title": "Web开发者安全速查表", "url": "https://www.freebuf.com/articles/web/135278.html", "time": "2017-05-24", "level": "金币+7", "num_look": 633880, "num_comment": 18, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "想要开发出一个安全的、健壮的Web应用其实是非常困难的，如果你觉得这实现起来非常简单的话，那么你一定是一个X炸天的程序猿"}
{"title": "针对亚马逊云存储器S3 BUCKET的渗透测试", "url": "https://www.freebuf.com/articles/web/135313.html", "time": "2017-05-24", "level": "", "num_look": 359639, "num_comment": 359639, "author": "secist", "tags": ["WEB安全"], "text": "在本文中，我将通过一个AWS的实例让大家看到即使没有获取相关凭据，依然可以利用其潜在的安全漏洞，来成功实施我们的渗透测试。"}
{"title": "上海前隆金融招聘安全专家", "url": "https://www.freebuf.com/jobs/135424.html", "time": "2017-05-24", "level": "", "num_look": 258165, "num_comment": 8, "author": "SixSixSix", "tags": ["安全招聘"], "text": "上海前隆金融信息服务有限公司招聘信息安全工程师。"}
{"title": "如何高效利用你所“劫持”的HTTP会话？", "url": "https://www.freebuf.com/articles/web/135220.html", "time": "2017-05-24", "level": "现金奖励", "num_look": 421322, "num_comment": 6, "author": "addadd", "tags": ["WEB安全"], "text": "HTTP是无状态的协议，为了维持和跟踪用户的状态，引入了Cookie和Session，所以说拿到了cookie，就可以获得victim的登录状态，也就达到了会话劫持的效果。"}
{"title": "具有ID欺骗功能的NFS客户端 - NfSpy", "url": "https://www.freebuf.com/sectool/135062.html", "time": "2017-05-24", "level": "", "num_look": 403149, "num_comment": 403149, "author": "Alpha_h4ck", "tags": ["工具"], "text": "本文接受啊了具有ID欺骗功能的NFS客户端 - NfSpy"}
{"title": "朝鲜的网络作战能力究竟如何？来看路透社对朝Unit 180部队的解读", "url": "https://www.freebuf.com/news/135458.html", "time": "2017-05-24", "level": "金币+7", "num_look": 318312, "num_comment": 6, "author": "secist", "tags": ["资讯"], "text": "这是朝鲜主要间谍机构下属，一个被称之为Unit 180的特殊部队。"}
{"title": "最新SMB僵尸网络利用了7个NSA工具，而WannaCry只用了两个……", "url": "https://www.freebuf.com/news/135467.html", "time": "2017-05-24", "level": "", "num_look": 331635, "num_comment": 4, "author": "米雪儿", "tags": ["资讯"], "text": "一种新的蠕虫正在通过SMB传播，这种病毒使用了7种NSA工具，而WannaCry仅使用了两种……"}
{"title": "利用micropython快速实现Badusb及手机摇控扩展", "url": "https://www.freebuf.com/sectool/135232.html", "time": "2017-05-24", "level": "金币+7", "num_look": 548971, "num_comment": 12, "author": "xiaowuyi", "tags": ["工具", "无线安全"], "text": "本文以TPYBoard开发板为例讲解了利用micropython进行HID设备测试的主要方法，使用mt7681模块进行了一个简单的实验，实现了手机摇控键盘输入的测试。"}
{"title": "五年前的今天，TSRC迎来了第一位白帽子", "url": "https://www.freebuf.com/news/others/135219.html", "time": "2017-05-23", "level": "", "num_look": 585430, "num_comment": 9, "author": "腾讯安全平台部", "tags": ["周边"], "text": "「黑客」是大众给他们贴的标签，「白帽子」是他们真正的名字。他们到底是怎样的一群人？"}
{"title": "解读Wannacry背后的匿名网络", "url": "https://www.freebuf.com/articles/network/135443.html", "time": "2017-05-23", "level": "", "num_look": 502059, "num_comment": 8, "author": "腾讯电脑管家", "tags": ["特别企划", "网络安全"], "text": "本文将会深挖Wannacry勒索软件背后的匿名网络，从网络分析层面揭露该病毒的狡猾伎俩。"}
{"title": "PinDemonium通用动态脱壳工具", "url": "https://www.freebuf.com/sectool/135217.html", "time": "2017-05-23", "level": "金币+7", "num_look": 469565, "num_comment": 7, "author": "Lolopop", "tags": ["工具"], "text": "本文是对16年的blackhat大会上PinDemonium通用动态脱壳工具介绍。"}
{"title": "构建一个高交互型的难以发现的蜜罐", "url": "https://www.freebuf.com/sectool/135032.html", "time": "2017-05-23", "level": "金币+7", "num_look": 607200, "num_comment": 6, "author": "secist", "tags": ["工具", "系统安全"], "text": "本文我将手把手的带大家来，构建一个高交互型的蜜罐。我们将会利用到两款开源工具sysdig和falco，来帮助我们快速构建这个系统。"}
{"title": "SMB漏洞引发的“血案”，远不止WannaCry", "url": "https://www.freebuf.com/news/135407.html", "time": "2017-05-23", "level": "", "num_look": 482534, "num_comment": 4, "author": "AngelaY", "tags": ["特别企划", "资讯"], "text": "以下是安全研究人员近期发现的利用SMB漏洞发起的攻击，有些发生在WannaCry之前，有些发生在WannaCry之后。"}
{"title": "阿里安全情报团队广纳贤才", "url": "https://www.freebuf.com/jobs/135073.html", "time": "2017-05-23", "level": "", "num_look": 519213, "num_comment": 27, "author": "阿里安全", "tags": ["安全招聘"], "text": "阿里安全-黑产技术攻防情报团队一直在探索情报在企业的体系化落地应用及情报的价值体现"}
{"title": "国产指纹库平台 - 天蝎指纹库", "url": "https://www.freebuf.com/sectool/135216.html", "time": "2017-05-23", "level": "金币+20", "num_look": 1019448, "num_comment": 38, "author": "破晓", "tags": ["工具"], "text": "信息收集为渗透测试环节一个非常重要的阶段，它关系到后序列策划攻击的成功性。快速收集目标服务信息则需要测试人员熟练运用指纹识别技术。"}
{"title": "2017年Q1安卓ROOT类恶意病毒发展趋势研究报告", "url": "https://www.freebuf.com/articles/terminal/134977.html", "time": "2017-05-23", "level": "", "num_look": 556051, "num_comment": 4, "author": "腾讯手机管家", "tags": ["安全报告", "终端安全"], "text": "Android的开源特性使得大量的厂商加入其阵营,作为当前最大的流量来源,安卓平台是黑产分子眼中的香饽饽，本文分析了2017Q1 Android平台的手机恶意应用。"}
{"title": "全球网友来晒图 | 那些被WannaCry病毒攻击感染的场景", "url": "https://www.freebuf.com/news/135095.html", "time": "2017-05-23", "level": "金币+20", "num_look": 516192, "num_comment": 9, "author": "clouds", "tags": ["特别企划", "资讯"], "text": "欢迎更多真实、高清、无PS、无码的大图............"}
{"title": "以攻防竞赛寻找“红帽”：首届广东省“红帽杯”网络攻防大赛落幕", "url": "https://www.freebuf.com/news/135238.html", "time": "2017-05-22", "level": "", "num_look": 309888, "num_comment": 6, "author": "Sphinx", "tags": ["资讯"], "text": "网络安全人员应该如何培养，社会的安全意识该如何提高？本次的攻防大赛给出了可能的答案。"}
{"title": "维基解密公开CIA Vault7系列中的间谍软件Athena文档", "url": "https://www.freebuf.com/news/135324.html", "time": "2017-05-22", "level": "", "num_look": 591816, "num_comment": 1, "author": "Elaine_z", "tags": ["工具", "资讯"], "text": "继上周五维基解密公开两款恶意软件框架AfterMidnight和Assassin后，5月19日再度在网站上公开CIA Vault7系列中的另一款软件的文档——间谍软件 Athena。"}
{"title": "高通（Qualcomm）LK源码深度分析", "url": "https://www.freebuf.com/news/135084.html", "time": "2017-05-22", "level": "现金奖励", "num_look": 923029, "num_comment": 12, "author": "SetRet", "tags": ["终端安全", "资讯"], "text": "我们对主流bootloader的前身高通 little kernel 进行了深入的源码分析，并对CIA 泄漏的cadmium.pdf文档中的三星bootloader漏洞进行了分析和复现。"}
{"title": "挖洞经验|看我如何挖到了一个价值5K刀的谷歌“404页面”", "url": "https://www.freebuf.com/articles/web/135197.html", "time": "2017-05-22", "level": "红色标题", "num_look": 752483, "num_comment": 13, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "我尝试寻找Google服务中可能存在的安全问题，在寻找漏洞的过程中我遇到了这个页面：https://login.corp.google.com！"}
{"title": "银科控股（纳斯达克上市公司）勾搭信息安全人员、渗透测试人员（上海）", "url": "https://www.freebuf.com/news/134469.html", "time": "2017-05-22", "level": "", "num_look": 422018, "num_comment": 13, "author": "银科控股", "tags": ["安全招聘", "资讯"], "text": "银科投资控股有限公司是中国领先的个人投资与交易服务商，致力于通过金融科技与移动互联网向客户提供最优质的金融信息、工具和服务。"}
{"title": "开源扫描仪的工具箱：安全行业从业人员自研开源扫描器合集", "url": "https://www.freebuf.com/sectool/135151.html", "time": "2017-05-22", "level": "现金奖励", "num_look": 1254425, "num_comment": 22, "author": "Shun", "tags": ["工具"], "text": "Scanners-Box是来自github平台的开源扫描仪的集合，包括子域枚举，数据库漏洞扫描程序，弱密码或信息泄漏扫描仪，端口扫描仪，指纹扫描仪和其他大型扫描仪"}
{"title": "分析静态编译加剥离的ELF文件的一些方法", "url": "https://www.freebuf.com/articles/terminal/134980.html", "time": "2017-05-22", "level": "现金奖励", "num_look": 438132, "num_comment": 13, "author": "兰云科技银河实验室", "tags": ["终端安全"], "text": "我们在分析ELF文件的时候最怕遇到静态编译和剥离外加没有编译器信息的样本了，我学习了一些网上的方法，在这里进行了分析ELF文件的小结。"}
{"title": "战斗的民族：过去8年被绳之以法的8名俄罗斯黑客", "url": "https://www.freebuf.com/news/134879.html", "time": "2017-05-22", "level": "", "num_look": 238444, "num_comment": 4, "author": "米雪儿", "tags": ["资讯"], "text": "过去8年被绳之以法的8名臭名昭著的俄罗斯黑客"}
{"title": "快速构建站点地图工具 - PwnBack", "url": "https://www.freebuf.com/sectool/135074.html", "time": "2017-05-22", "level": "", "num_look": 325194, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具"], "text": "这款名为PwnBack的Burp插件，它可以利用WaybackMachine来为我们生成一个网站的站点地图。"}
{"title": "WanaCrypt0r“想哭”勒索蠕虫数据恢复可行性分析报告", "url": "https://www.freebuf.com/articles/system/135057.html", "time": "2017-05-21", "level": "", "num_look": 523153, "num_comment": 12, "author": "360安全", "tags": ["安全报告", "系统安全"], "text": "本篇技术报告可以帮助大家了解该蠕虫的核心技术原理，并对恢复被加密数据的可行性做进一步探讨。"}
{"title": "九州量子北京研发中心诚聘大量安全人才", "url": "https://www.freebuf.com/jobs/134433.html", "time": "2017-05-21", "level": "", "num_look": 441124, "num_comment": 2, "author": "九州量子", "tags": ["安全招聘"], "text": "浙江九州量子信息技术股份有限公司于2016年6月正式挂牌新三板，成为中国资本市场的“量子通信第一股”，是中国首家市场化运营的量子通信应用全产业链企业。"}
{"title": "国际知名“青少年黑客”盘点", "url": "https://www.freebuf.com/articles/others-articles/134845.html", "time": "2017-05-21", "level": "", "num_look": 492344, "num_comment": 9, "author": "米雪儿", "tags": ["其他"], "text": "全美大学生网络防御大赛（NCCDC）是一项年度盛会，旨在让大学生参与到网络安全活动中来。"}
{"title": "远控木马中的VIP：盗刷网购账户购买虚拟礼品卡", "url": "https://www.freebuf.com/articles/system/135081.html", "time": "2017-05-21", "level": "", "num_look": 352413, "num_comment": 4, "author": "360安全", "tags": ["系统安全"], "text": "“网盘不限速神器”或是“VIP助手”真的靠谱吗？"}
{"title": "网络间谍依然健在：APT32对全球企业的威胁（海莲花）", "url": "https://www.freebuf.com/articles/paper/134908.html", "time": "2017-05-21", "level": "金币+15", "num_look": 894312, "num_comment": 3, "author": "heiben", "tags": ["企业安全", "安全报告"], "text": "Fireeye评估APT32利用独特且功能全面的恶意软件套件与商业渗透工具相结合，开展符合对越南国家利益的有针对性的行动。"}
{"title": "WannaCry勒索病毒详细解读", "url": "https://www.freebuf.com/articles/system/135196.html", "time": "2017-05-20", "level": "红色标题", "num_look": 1030694, "num_comment": 16, "author": "腾讯电脑管家", "tags": ["数据安全", "系统安全"], "text": "5月12日，WannaCry蠕虫通过MS17-010漏洞在全球范围大爆发，感染了大量的计算机。这篇文章更为详细地阐述了WannaCry相关细节。"}
{"title": "守内安信息科技（上海）招聘安全产品技术", "url": "https://www.freebuf.com/news/134461.html", "time": "2017-05-20", "level": "", "num_look": 306929, "num_comment": 4, "author": "Sphinx", "tags": ["安全招聘", "资讯"], "text": "Softnext守内安，专业的企业级邮件安全服务厂商，2013年成为邮件安全领域市占率第一的研发服务商。"}
{"title": "网络安全市场调查：2017年Top15数据榜单", "url": "https://www.freebuf.com/news/134389.html", "time": "2017-05-20", "level": "", "num_look": 249044, "num_comment": 1, "author": "米雪儿", "tags": ["资讯"], "text": "为了帮助大家更为直观地了解网络安全市场，Cybersecurity Ventures最近发布了2017年Top15网络安全数据榜单，其中都包含哪些内容？一起看看吧："}
{"title": "新型勒索病毒软件GruxEr来袭：深度分析如何传播、加密及如何删除", "url": "https://www.freebuf.com/articles/database/134806.html", "time": "2017-05-20", "level": "金币+15", "num_look": 395219, "num_comment": 6, "author": "Shun", "tags": ["数据安全"], "text": "本文旨在帮助您清除Gruxer ransomware感染，并通过此ransomware病毒恢复AES加密文件。"}
{"title": "Facebook：AI正在长大，对抗暴力视频直播仍需人海战术？", "url": "https://www.freebuf.com/articles/neopoints/134761.html", "time": "2017-05-20", "level": "", "num_look": 282076, "num_comment": 1, "author": "heather", "tags": ["观点"], "text": "AI技术在暴力视频面前究竟能发挥多大的用处？Facebook针对AI失效的状况启动了哪些应对措施？对抗暴力视频，真的只能靠人海战术吗？"}
{"title": "WannaCry勒索病毒逆向和内网传播数据分析", "url": "https://www.freebuf.com/news/134989.html", "time": "2017-05-20", "level": "金币+15", "num_look": 397120, "num_comment": 3, "author": "sec360zz", "tags": ["系统安全", "资讯"], "text": "本文对于WannaCry勒索病毒进行逆向和内网传播数据分析"}
{"title": "比WannaCry还要可怕的勒索病毒UIWIX？应对措施看这里", "url": "https://www.freebuf.com/articles/system/135159.html", "time": "2017-05-19", "level": "", "num_look": 323089, "num_comment": 3, "author": "Carrie_spinfo", "tags": ["系统安全"], "text": "WannaCry爆发以后，安全专家正应付得焦头烂额，一波未平、一波又起，国外某些用户的电脑又遭到了第二波攻击。"}
{"title": "开发者最容易犯的十大加密错误（上）", "url": "https://www.freebuf.com/articles/others-articles/134651.html", "time": "2017-05-19", "level": "", "num_look": 252921, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["其他"], "text": "我总结出了目前开发人员最容易犯的十大加密错误。本系列分上下集，希望大家能够从中得到一些加密方面的启示。"}
{"title": "Uber平台现身份认证漏洞，利用漏洞可重置任意账户密码", "url": "https://www.freebuf.com/news/135131.html", "time": "2017-05-19", "level": "", "num_look": 251262, "num_comment": 3, "author": "sunleying", "tags": ["资讯"], "text": "意大利专家Vincenzo C. Aka发现Uber平台存在身份认证漏洞，任意账户都可以利用该漏洞重置密码，该发现于昨日正式公布"}
{"title": "SDL中的密码学应用", "url": "https://www.freebuf.com/articles/database/134783.html", "time": "2017-05-19", "level": "", "num_look": 419818, "num_comment": 1, "author": "yirendai_sec", "tags": ["数据安全", "网络安全"], "text": "当前SDL在具备一定规模的互联网公司已经被开展实践，本文站在SDL威胁建模的角度表述密码学在其中所解决的问题。"}
{"title": "易鑫车贷诚聘初级信息安全工程师", "url": "https://www.freebuf.com/jobs/134374.html", "time": "2017-05-19", "level": "", "num_look": 264395, "num_comment": 8, "author": "c9t9h5", "tags": ["安全招聘"], "text": "易鑫车贷招聘1名初级信息安全工程师。"}
{"title": "AD ACL Scanner：一款扫描活动目录权限并自动生成报告的小工具", "url": "https://www.freebuf.com/sectool/134623.html", "time": "2017-05-19", "level": "", "num_look": 406903, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款基于PowerShell的GUI工具，这款免费工具可以帮助我们生成HTML或CSV格式的活动目录权限报告。"}
{"title": "没有钱的安全部之系统日志安全", "url": "https://www.freebuf.com/articles/system/134807.html", "time": "2017-05-19", "level": "金币+15", "num_look": 670446, "num_comment": 24, "author": "bigface", "tags": ["系统安全"], "text": "Elastic Stack 5.0发布以来，基本上中小企业都可以使用开源的技术来做安全。beats的加入让日志更加灵活，甚至可以通过beats优化部分安全运维的工作。"}
{"title": "看一看这款Proton.B恶意软件会在你的Mac OS上干些什么坏事", "url": "https://www.freebuf.com/articles/system/134647.html", "time": "2017-05-19", "level": "", "num_look": 279173, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "Proton是一个针对macOS系统的恶意软件，它可以窃取密码、提取文件，攻击者甚至还可以利用它来远程登录目标主机，本文对Proton进行了研究。"}
{"title": "Joomla!3.7.0  SQL注入攻击漏洞分析", "url": "https://www.freebuf.com/vuls/135035.html", "time": "2017-05-19", "level": "金币+15", "num_look": 789054, "num_comment": 11, "author": "Shun", "tags": ["WEB安全", "漏洞"], "text": "Joomla是一套世界第二流行的内容管理系统,本文对Joomla!3.7.0  SQL注入攻击漏洞进行了分析"}
{"title": "WannaCry勒索病毒中的愚蠢Bug，赎金打水漂可能正是该漏洞所致……", "url": "https://www.freebuf.com/news/135010.html", "time": "2017-05-18", "level": "", "num_look": 380920, "num_comment": 10, "author": "Elaine_z", "tags": ["资讯"], "text": "自从5月12日开始，WannaCry勒索病毒在全球范围内的大规模爆发，安全研究员在恶意软件的程序编码中，发现了一些“愚蠢”的错误。"}
{"title": "WannaCry数据恢复方案", "url": "https://www.freebuf.com/articles/system/135029.html", "time": "2017-05-18", "level": "", "num_look": 393831, "num_comment": 2, "author": "亚信安全", "tags": ["特别企划", "系统安全"], "text": "5月12日，黑客驱动WannaCry/Wcry蠕虫病毒，向全球用户发出“勒索”挑战。由此，本文分析了数据恢复方案。"}
{"title": "10款中小企业必备的开源免费安全工具", "url": "https://www.freebuf.com/sectool/134639.html", "time": "2017-05-18", "level": "金币+15", "num_look": 731057, "num_comment": 7, "author": "secist", "tags": ["企业安全", "工具"], "text": "一些好的免费开源安全工具，无疑成为了这些中小企业降低成本的首选。"}
{"title": "上海易果生鲜诚聘安全工程师", "url": "https://www.freebuf.com/news/134726.html", "time": "2017-05-18", "level": "", "num_look": 288121, "num_comment": 5, "author": "挖土", "tags": ["安全招聘", "资讯"], "text": "易果生鲜招聘高级信息安全工程师-应用安全方向"}
{"title": "我买的车险，如何泄漏了我的位置？", "url": "https://www.freebuf.com/articles/web/134841.html", "time": "2017-05-18", "level": "", "num_look": 317601, "num_comment": 6, "author": "鸢尾", "tags": ["WEB安全"], "text": "我试着开发我自己所需要的应用程序。使用mitmproxy分析App所使用的API以此来开发我自己的客户端。"}
{"title": "基于大数据和机器学习的Web异常参数检测系统Demo实现", "url": "https://www.freebuf.com/articles/web/134334.html", "time": "2017-05-18", "level": "现金奖励", "num_look": 892275, "num_comment": 15, "author": "foxscheduler", "tags": ["WEB安全", "网络安全"], "text": "所有的机器学习算法都大致可分为训练、检测阶段，基于HMM的web参数异常检测是其中的典型代表，本文尝试将机器学习算法在大数据环境下使用。"}
{"title": "利用HSTS嗅探浏览器历史纪录的三个漏洞", "url": "https://www.freebuf.com/vuls/134536.html", "time": "2017-05-18", "level": "现金奖励", "num_look": 472020, "num_comment": 5, "author": "tocttou", "tags": ["WEB安全", "漏洞"], "text": "本文主要介绍HSTS及其他Web功能带来的一些隐私问题，比如如何利用它们来探测浏览器的用户历史纪录。"}
{"title": "看我如何伪装成APT28进行假冒攻击", "url": "https://www.freebuf.com/articles/system/134431.html", "time": "2017-05-18", "level": "", "num_look": 330851, "num_comment": 6, "author": "clouds", "tags": ["系统安全"], "text": "从趋势科技到ThreatConnect都调查认为证据充分，APT28真的攻击了马克龙竞选团队了吗？我看未必，在此，我就来演示一下如何伪装APT28进行假冒攻击。"}
{"title": "网络保险将改变安全行业的游戏规则？", "url": "https://www.freebuf.com/articles/neopoints/133977.html", "time": "2017-05-17", "level": "", "num_look": 299576, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["观点"], "text": "网络保险市场近期的爆发已经改善了某些行业领域的现状，如果网络保险行业能够解决数据相关的问题，那么网络保险所能做的还会有更多。"}
{"title": "致命漏洞将允许攻击者绕过苹果的OTR签名验证并窃取iCloud钥匙串信息", "url": "https://www.freebuf.com/articles/system/134644.html", "time": "2017-05-17", "level": "", "num_look": 246615, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "iOS平台上与沙盒逃逸有关的攻击面时，我们在iCloud钥匙串同步功能的OTR实现中发现了一个严重的安全漏洞。在这篇文章中，我们将给大家详细描述这个漏洞。"}
{"title": "北京安数云诚聘安全人才", "url": "https://www.freebuf.com/jobs/134242.html", "time": "2017-05-17", "level": "", "num_look": 324133, "num_comment": 7, "author": "kxjhcs", "tags": ["安全招聘"], "text": "北京安数云信息技术有限公司（Beijing Datacloudsec Information Technology Co.,Ltd.），成立于2007年8月23日。"}
{"title": "下一个“永恒之蓝”6月见？Shadow Brokers组织宣布将公开更多0day漏洞！", "url": "https://www.freebuf.com/news/134945.html", "time": "2017-05-17", "level": "红色标题", "num_look": 660303, "num_comment": 18, "author": "Sphinx", "tags": ["特别企划", "资讯"], "text": "几小时前，Shadow Brokers发布了一篇声明，将从2017年6月开始公布更多0day漏洞。"}
{"title": "T-Pot多蜜罐平台：让蜜罐实现更简单", "url": "https://www.freebuf.com/sectool/134504.html", "time": "2017-05-17", "level": "现金奖励", "num_look": 1789983, "num_comment": 36, "author": "失路之人", "tags": ["工具"], "text": "这两年蜜罐技术被关注的越来越多，也渐形成从web业务蜜罐、ssh应用蜜罐、网络协议栈蜜罐到系统主机型蜜罐的各功能型蜜罐。"}
{"title": "暗链隐藏的N种姿势", "url": "https://www.freebuf.com/articles/web/134370.html", "time": "2017-05-17", "level": "现金奖励", "num_look": 604172, "num_comment": 9, "author": "ArkTeam", "tags": ["WEB安全"], "text": "暗链也称黑链，即隐蔽链接，是黑帽SEO的作弊手法之一，其目的就是利用高权重网站外链来提升自身站点排名。本文介绍了暗链的多重隐藏方法。"}
{"title": "以网络摄像头为感染目标的新型IoT僵尸网络Persirai", "url": "https://www.freebuf.com/news/134269.html", "time": "2017-05-17", "level": "", "num_look": 367097, "num_comment": 367097, "author": "clouds", "tags": ["网络安全", "资讯"], "text": "趋势科技（Trend Micro）最近发现了一种新型物联网（IoT）僵尸网络，该僵尸网络利用恶意软件 ELF_PERSIRAI.A进行不断传播感染。"}
{"title": "Windows渗透测试工具：RedSnarf", "url": "https://www.freebuf.com/sectool/134226.html", "time": "2017-05-17", "level": "", "num_look": 611212, "num_comment": 2, "author": "secist", "tags": ["工具"], "text": "RedSnarf是一款专门用于渗透测试及红队的安全工具。RedSnarf通过OpSec技术，从Windows工作站，服务器和域控制器中检索散列和凭据。"}
{"title": "维基解密披露CIA恶意软件框架中的新工具：AfterMidnight与Assassin", "url": "https://www.freebuf.com/news/134854.html", "time": "2017-05-16", "level": "红色标题", "num_look": 417523, "num_comment": 5, "author": "Elaine_z", "tags": ["资讯"], "text": "当整个世界都在忙于应对 WannaCry恶意软件之时，维基解密发布了CIA Vault 7工具包中新的一批文件，详细披露了CIA两个恶意软件工具AfterMidnight以及Assassin。"}
{"title": "LOCKet安全沙龙· 互金平台如何做好安全建设？", "url": "https://www.freebuf.com/fevents/134402.html", "time": "2017-05-16", "level": "", "num_look": 423973, "num_comment": 3, "author": "LOCKet-Sharlyne", "tags": ["活动"], "text": ""}
{"title": "WannaCry惊天大发现！疑似朝鲜黑客组织Lazarus所为", "url": "https://www.freebuf.com/articles/system/134846.html", "time": "2017-05-16", "level": "红色标题", "num_look": 635775, "num_comment": 17, "author": "Threatbook", "tags": ["系统安全"], "text": "微步在线分析师迅速对相关样本进行了同源性分析，发现WannaCry勒索蠕虫与朝鲜黑客组织Lazarus具备较高相似度，出自同一组织的可能性较大。"}
{"title": "“潜盗者”APT渗透攻击揭秘", "url": "https://www.freebuf.com/articles/network/134329.html", "time": "2017-05-16", "level": "", "num_look": 713188, "num_comment": 6, "author": "腾讯电脑管家", "tags": ["网络安全"], "text": "最近，哈勃流量引擎捕获了一起“潜盗者”的渗透攻击事件，这是一起针对欧美企业公司财务人员的APT攻击，本文将进行详细分析。"}
{"title": "学点算法搞安全之apriori", "url": "https://www.freebuf.com/articles/others-articles/130628.html", "time": "2017-05-16", "level": "现金奖励", "num_look": 295414, "num_comment": 4, "author": "兜哥", "tags": ["其他"], "text": "想要了解算法在企业安全建设中的作用的同学们速速来围观"}
{"title": "广西计算中心招聘安全岗位", "url": "https://www.freebuf.com/jobs/134304.html", "time": "2017-05-16", "level": "", "num_look": 330741, "num_comment": 12, "author": "火麒麟", "tags": ["安全招聘"], "text": "广西计算中心招聘网络安全工程师和软件研发工程师。"}
{"title": "Sednit组织使用2个0day漏洞影响法国大选", "url": "https://www.freebuf.com/articles/network/134351.html", "time": "2017-05-16", "level": "金币+6", "num_look": 355247, "num_comment": 3, "author": "鸢尾", "tags": ["网络安全"], "text": "就在上个月，沉寂了一段时间的Sednit又出现在人们视野中。这次又干扰法国大选。"}
{"title": "某云用户网站入侵应急响应", "url": "https://www.freebuf.com/articles/network/134372.html", "time": "2017-05-16", "level": "现金奖励", "num_look": 865752, "num_comment": 64, "author": "feiniao", "tags": ["网络安全"], "text": "用户为保证其他服务器的安全及可用性，把这台虚拟主机给下线了，但是这台虚拟主机是否存在异常？为什么接入网络会导致中断？"}
{"title": "如何使用WhatsApp收集大量数据（附脚本）", "url": "https://www.freebuf.com/sectool/134347.html", "time": "2017-05-16", "level": "金币+6", "num_look": 575178, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["工具", "终端安全"], "text": "如果你想要拿到所有WhatsApp用户的手机号码、头像、以及状态信息，这其实是一件非常简单的事情，而且这些用户甚至都不需要将你添加到他们的通讯录里面。"}
{"title": "IEEE802.11w无线安全协议剖析", "url": "https://www.freebuf.com/articles/wireless/134349.html", "time": "2017-05-16", "level": "现金奖励", "num_look": 653038, "num_comment": 8, "author": "魅影儿", "tags": ["无线安全"], "text": "IEEE 802.11协议规定无线帧包含数据帧、控制帧和管理帧三类，本文将详细剖析此无线安全协议。"}
{"title": "全球安全厂商针对“Wannacry勒索蠕虫”响应与处置方案汇总", "url": "https://www.freebuf.com/news/134771.html", "time": "2017-05-15", "level": "红色标题", "num_look": 591317, "num_comment": 9, "author": "欧阳洋葱", "tags": ["安全报告", "特别企划"], "text": "WannaCry就勒索本质本身而并非多么牛掰的勒索软件，那它为何影响力如此之大？应对WannaCry具体又该怎么做？这篇文章针对各安全厂商的响应与处置方案进行了汇总。"}
{"title": "小议验证码的安全性及如何绕过", "url": "https://www.freebuf.com/articles/database/134343.html", "time": "2017-05-15", "level": "", "num_look": 539713, "num_comment": 7, "author": "secist", "tags": ["数据安全"], "text": "验证码为什么能被绕过？"}
{"title": "关于勒索病毒WannaCry的8个真相", "url": "https://www.freebuf.com/articles/system/134728.html", "time": "2017-05-15", "level": "", "num_look": 486900, "num_comment": 11, "author": "火绒安全", "tags": ["系统安全"], "text": "哪些用户容易被感染，为什么政府机关和大学是重灾区？"}
{"title": "pwnable.tw刷题之dubblesort", "url": "https://www.freebuf.com/articles/others-articles/134271.html", "time": "2017-05-15", "level": "现金奖励", "num_look": 344744, "num_comment": 10, "author": "oO0ps", "tags": ["其他"], "text": "上一篇中我介绍了pwnable.tw中第三题calc的解题思路，在这篇里，我将和大家分享第四题dubblesort的分析过程。"}
{"title": "河北龙瀚科技集团诚聘安全工程师", "url": "https://www.freebuf.com/jobs/134159.html", "time": "2017-05-15", "level": "", "num_look": 346187, "num_comment": 14, "author": "龙瀚hr", "tags": ["安全招聘"], "text": "河北龙瀚科技集团成立于2015年，公司地处晋冀鲁豫四省交界，主营项目包括直销软件系统开发、直销产品推广、直销外事公关咨询、直销媒体平台等。"}
{"title": "WannaCry变种出现新的秘密开关！为何会有秘密开关？", "url": "https://www.freebuf.com/articles/system/134658.html", "time": "2017-05-15", "level": "", "num_look": 626407, "num_comment": 11, "author": "Threatbook", "tags": ["系统安全"], "text": "微步在线对5月12日爆发的WannaCry勒索蠕虫攻击事件保持密切的跟踪。数小时前，微步在线捕获到该蠕虫的第一个真正意义上的新变种，我们对该新蠕虫样本进行了紧急分析。"}
{"title": "Wannacry蠕虫勒索软件处置手册", "url": "https://www.vulbox.com/knowledge/detail/?id=10", "time": "2017-05-15", "level": "红色标题", "num_look": 47908, "num_comment": 47908, "author": "漏洞盒子", "tags": ["系统安全"], "text": "无论企业组织是否感染WannaCry，究竟该如何应对呢？"}
{"title": "WannaCry勒索病毒数据恢复指引", "url": "https://www.freebuf.com/articles/database/134673.html", "time": "2017-05-15", "level": "", "num_look": 647105, "num_comment": 9, "author": "腾讯云安全", "tags": ["数据安全"], "text": "可使用数据恢复软件通过恢复被WannaCry删除的加密前的文件，能恢复部分文件，一定程度上挽回用户损失。"}
{"title": "分享“永恒之蓝（MS17-010）”批量远程检测工具", "url": "https://www.freebuf.com/sectool/134657.html", "time": "2017-05-15", "level": "金币+20", "num_look": 1918387, "num_comment": 51, "author": "李小明‏‏", "tags": ["工具"], "text": "鉴于各位厂家都比较自持，不肯发布简单易用的批量扫描工具，在这里就代发了。各位苦逼网管，你们尽情在自己地盘扫吧。"}
{"title": "使用Kettle模型清洗全国弱口令Top 1000", "url": "https://www.freebuf.com/articles/database/134276.html", "time": "2017-05-15", "level": "金币+20", "num_look": 770877, "num_comment": 23, "author": "水熊科技", "tags": ["数据安全", "网络安全"], "text": "几天前，我在FreeTalk北京站演讲了《数据清洗在网络安全中的应用》，由于时间关系，很多内容并没有讲到，在会议上我展示的两个模型只是非常基础的两个数据处理模型。"}
{"title": "窃取股市交易机密，三名中国黑客被罚9百万美元", "url": "https://www.freebuf.com/news/134427.html", "time": "2017-05-15", "level": "", "num_look": 299371, "num_comment": 8, "author": "Sphinx", "tags": ["资讯"], "text": "三名中国黑客因涉嫌攻击两家纽约律师事务所的邮件服务器被处罚金880万美元，他们窃取了公司2016年12月的合并方案，并用于股票交易中。"}
{"title": "WannaCry勒索病毒分析报告", "url": "https://www.freebuf.com/articles/paper/134637.html", "time": "2017-05-14", "level": "", "num_look": 866950, "num_comment": 16, "author": "瑞星", "tags": ["安全报告"], "text": "瑞星的研究人员对勒索软件进行详细的分析，并且给出多种解决方案，包括“永恒之蓝”病毒免疫工具。"}
{"title": "专家预测第二波WannaCry勒索病毒攻击即将到来！", "url": "https://www.freebuf.com/news/134622.html", "time": "2017-05-14", "level": "金币+20", "num_look": 516563, "num_comment": 28, "author": "clouds", "tags": ["特别企划", "资讯"], "text": "今天一大早，全网的WannaCry蠕虫病毒攻击突然减弱消退了！然而专家称第二波攻击就要来了，你准备好了吗？"}
{"title": "CNNVD关于WannaCry勒索软件攻击事件的分析报告", "url": "https://www.freebuf.com/news/134624.html", "time": "2017-05-14", "level": "", "num_look": 604271, "num_comment": 3, "author": "CNNVD", "tags": ["安全报告", "资讯"], "text": ""}
{"title": "国家信息技术安全研究中心（上海）招聘安全研究人员", "url": "https://www.freebuf.com/jobs/122097.html", "time": "2017-05-14", "level": "", "num_look": 654361, "num_comment": 48, "author": "孙毛毛", "tags": ["安全招聘"], "text": "国家信息技术安全研究中心是经中央编制委员会批准组建的从事信息安全核心技术研究、为国家信息安全保障服务的科研单位。"}
{"title": "WanaCrypt0r勒索蠕虫完全分析报告", "url": "https://www.freebuf.com/articles/system/134621.html", "time": "2017-05-14", "level": "", "num_look": 328008, "num_comment": 328008, "author": "360安全", "tags": ["系统安全", "网络安全"], "text": ""}
{"title": "计算机取证在企业安全中的实际应用", "url": "https://www.freebuf.com/articles/others-articles/134283.html", "time": "2017-05-14", "level": "", "num_look": 601899, "num_comment": 2, "author": "sunleying", "tags": ["企业安全", "其他"], "text": "计算机取证在案件调查中可以帮助调查人员捕获案件进程中的诸多细节。而商业软件在计算机取证中的作用也不容忽视，让我们来看一些具体的分析和案例。"}
{"title": "Squirrelmail远程代码执行漏洞（CVE-2017-7692）复现+修复方案", "url": "https://www.freebuf.com/vuls/133992.html", "time": "2017-05-14", "level": "金币+20", "num_look": 719572, "num_comment": 13, "author": "水清云影", "tags": ["漏洞"], "text": "本文介绍了Squirrelmail远程代码执行漏洞（CVE-2017-7692）复现+修复方案"}
{"title": "WannaCry蠕虫详细分析", "url": "https://www.freebuf.com/articles/system/134578.html", "time": "2017-05-14", "level": "红色标题", "num_look": 2136851, "num_comment": 33, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "木马加密使用AES加密文件，并使用非对称加密算法RSA 2048加密随机密钥，每个文件使用一个随机密钥，理论上不可破解。"}
{"title": "首发 | Wannacry勒索软件母体主程序逆向分析（含临时解决方案自动化工具）", "url": "https://www.freebuf.com/vuls/134602.html", "time": "2017-05-14", "level": "现金奖励", "num_look": 1081042, "num_comment": 9, "author": "expsky", "tags": ["专栏", "漏洞"], "text": "这些高级货能原创出来的人太少了，逆向分析下改造改造这个擅长^_^"}
{"title": "漂浮在海上的这场黑客大赛是表演、也是探索：2017 GeekPwn香港年中赛纪实", "url": "https://www.freebuf.com/fevents/134582.html", "time": "2017-05-14", "level": "红色标题", "num_look": 757399, "num_comment": 5, "author": "欧阳洋葱", "tags": ["活动"], "text": "这场GeekPwn黑客大赛是在公海上进行的，你能想象在船上的黑客大赛是什么样吗？"}
{"title": "思科Talos团队深度解析“WannaCry”勒索软件", "url": "https://www.freebuf.com/news/134566.html", "time": "2017-05-13", "level": "", "num_look": 412872, "num_comment": 12, "author": "Cisco", "tags": ["系统安全", "资讯"], "text": "该恶意软件WannaCry会攻击主机并加密主机上存储的文件，然后要求以比特币的形式支付赎金，思科Talos对此进行了深度解析。"}
{"title": "Wannacry蠕虫勒索软件“永恒之蓝”3种修复方案", "url": "https://www.freebuf.com/vuls/134508.html", "time": "2017-05-13", "level": "现金奖励", "num_look": 1050487, "num_comment": 35, "author": "Shun", "tags": ["漏洞"], "text": "据BBC报道，计算机网络病毒攻击已经扩散到74个国家，包括美国、英国、中国、俄罗斯、西班牙、意大利等。"}
{"title": "国内影响已扩散，利用“NSA武器库”中漏洞的Wannacry蠕虫勒索软件袭击全球（含修复方案）", "url": "https://www.freebuf.com/news/134512.html", "time": "2017-05-13", "level": "红色标题", "num_look": 1253532, "num_comment": 24, "author": "AngelaY", "tags": ["资讯"], "text": "一款名为Wannacry 的蠕虫勒索软件袭击全球网络，这被认为是迄今为止最巨大的勒索交费活动，影响到近百个国家上千家企业及公共组织。"}
{"title": "WiFi万能钥匙招聘安全工程师", "url": "https://www.freebuf.com/jobs/134103.html", "time": "2017-05-13", "level": "", "num_look": 320961, "num_comment": 24, "author": "半夏初晴。", "tags": ["安全招聘"], "text": "连尚网络自主研发的核心产品WiFi万能钥匙，以分享经济的模式，通过云计算和大数据技术，利用热点主人分享的闲置WiFi资源。"}
{"title": "【已结束】2017年GeekPwn年中赛图文直播", "url": "https://www.freebuf.com/fevents/134403.html", "time": "2017-05-13", "level": "红色标题", "num_look": 739064, "num_comment": 8, "author": "Sphinx", "tags": ["活动"], "text": "2017年GeekPwn年中赛将于5月12日-14日在香港“云顶梦号”邮轮举行，乘载挑战、突破、创新的极客精神，开启史上最酷炫的黑客狂欢。"}
{"title": "WHID Injector：将HID攻击带入新境界", "url": "https://www.freebuf.com/geek/133850.html", "time": "2017-05-13", "level": "金币+10", "num_look": 740195, "num_comment": 9, "author": "米雪儿", "tags": ["极客"], "text": "近日，研究人员利用一种廉价的专用硬件，可以对HID设备进行远程控制，这就是WHID的诞生原理。"}
{"title": "刚刚当选法国总统的Macron，被曝竞选团队利用“蜜罐账号”欺骗俄罗斯黑客", "url": "https://www.freebuf.com/news/134434.html", "time": "2017-05-12", "level": "", "num_look": 295550, "num_comment": 2, "author": "Elaine_z", "tags": ["资讯"], "text": "俄罗斯黑客攻击法国总统大选，但似乎无果而终，马克龙的竞选团队通过预警及响应，进行了针对攻击的混淆回击。"}
{"title": "如何在iOS应用程序中用Frida来绕过“越狱检测”?", "url": "https://www.freebuf.com/articles/terminal/134111.html", "time": "2017-05-12", "level": "", "num_look": 625118, "num_comment": 3, "author": "secist", "tags": ["终端安全"], "text": "本文我将为大家展示，如何在iOS应用程序中使用Frida来绕过越狱检测。"}
{"title": "江苏君立华域招聘人才", "url": "https://www.freebuf.com/jobs/133764.html", "time": "2017-05-12", "level": "", "num_look": 420363, "num_comment": 35, "author": "my sunshine", "tags": ["安全招聘"], "text": "江苏君立华域信息安全技术股份有限公司成立于2006年，现有员工100余人，是一家以信息产业为主导的现代化高科技综合性企业。"}
{"title": "支持MACRBACABAC多种模型的Golang访问控制框架Casbin", "url": "https://www.freebuf.com/sectool/134016.html", "time": "2017-05-12", "level": "金币+10", "num_look": 400844, "num_comment": 400844, "author": "hsluoyz", "tags": ["工具"], "text": "本文介绍了一个支持MACRBACABAC多种模型的Golang访问控制框架casbin。"}
{"title": "图片后门捆绑利用工具 - FakeImageExploiter", "url": "https://www.freebuf.com/sectool/134077.html", "time": "2017-05-12", "level": "金币+10", "num_look": 908530, "num_comment": 53, "author": "clouds", "tags": ["工具"], "text": "要向大家推荐一款名为“Fake Image Exploiter”的安全工具。"}
{"title": "关于Android应用程序漏洞的防护措施", "url": "https://www.freebuf.com/articles/terminal/134018.html", "time": "2017-05-12", "level": "", "num_look": 382098, "num_comment": 5, "author": "腾讯手机管家", "tags": ["终端安全"], "text": "由于Android系统的开源性及其Java编写的特殊性，各类Android App经常被爆出漏洞。"}
{"title": "如何编写高质量的Windows Shellcode", "url": "https://www.freebuf.com/articles/system/133990.html", "time": "2017-05-12", "level": "", "num_look": 345048, "num_comment": 7, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "为了方便演示，我将以x86 Shellcode作为样例进行讲解。"}
{"title": "美国在安全教育方面是怎么做的，还有什么地方需要改进？", "url": "https://www.freebuf.com/articles/others-articles/133980.html", "time": "2017-05-11", "level": "", "num_look": 207072, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["其他"], "text": "虽然网络安全教育已经逐渐成熟，而且相应的制度也在逐步完善，但我们仍然有很长的路要走。"}
{"title": "看我如何综合利用3个安全问题成功劫持Flickr账户获得7千美元漏洞赏金", "url": "https://www.freebuf.com/articles/web/133848.html", "time": "2017-05-11", "level": "", "num_look": 363214, "num_comment": 11, "author": "clouds", "tags": ["WEB安全"], "text": "本文中作者通过身份认证参数控制、外部链接重定向和图片处理绕过3个安全问题的综合利用，最终成功实现劫持Flickr的目标账户权限。"}
{"title": "中兴软创科技股份有限公司安全人员招聘", "url": "https://www.freebuf.com/jobs/134101.html", "time": "2017-05-11", "level": "", "num_look": 342945, "num_comment": 8, "author": "Alex_Ding", "tags": ["安全招聘"], "text": "中兴软创积极进军软件信息服务领域，专注于电信领域boss市场的软件产品开发，努力使公司成长为boss领域和电子政务领域软件产品的领跑者。"}
{"title": "防火防盗防间谍：走近中国“反间谍”手段", "url": "https://www.freebuf.com/articles/others-articles/134249.html", "time": "2017-05-11", "level": "", "num_look": 618838, "num_comment": 8, "author": "米雪儿", "tags": ["其他", "特别企划"], "text": "间谍，这一看似古老而遥远的话题正在充斥公众的生活。"}
{"title": "见缝插针：DNS泛解析是怎么被黑客玩坏的", "url": "https://www.freebuf.com/news/133873.html", "time": "2017-05-11", "level": "现金奖励", "num_look": 742909, "num_comment": 63, "author": "feiniao", "tags": ["网络安全", "资讯"], "text": "在现实中，肯定经常存在用户输入错误域名前缀的情况，如果网站服务方考虑的足够人性化，完全可以配置一个DNS解析记录，配置一个默认解析结果。在DNS实现中，的确有这样一套机制，这个称作DNS泛解析。"}
{"title": "Hacking Tools搜罗大集合", "url": "https://www.freebuf.com/sectool/133949.html", "time": "2017-05-11", "level": "现金奖励", "num_look": 806136, "num_comment": 24, "author": "mooction", "tags": ["工具"], "text": "各种各样的黑客工具浩如天上繁星，这也让许多刚刚入门安全技术圈的童鞋感到眼花缭乱，本文整理了常用的安全技术工具，大部分可以在 GitHub 或 SourceForge 下载。"}
{"title": "学点算法搞安全之HMM（下篇）", "url": "https://www.freebuf.com/articles/web/133909.html", "time": "2017-05-11", "level": "金币+20", "num_look": 337559, "num_comment": 5, "author": "兜哥", "tags": ["WEB安全", "专栏"], "text": "把机器当一个刚入行的白帽子，我们训练他学会XSS的攻击语法，然后再让机器从访问日志中寻找符合攻击语法的疑似攻击日志。"}
{"title": "Orcus VM的解题步骤", "url": "https://www.freebuf.com/articles/network/133796.html", "time": "2017-05-10", "level": "金币+20", "num_look": 322915, "num_comment": 5, "author": "鸢尾", "tags": ["网络安全"], "text": "各位朋友，今天我们将要挑战的是由Mr. Viper为vulnerable hub设计的“ORCUS”夺旗挑战赛。"}
{"title": "揭秘来自中国的数字货币“挖矿”军团 - Bondnet僵尸网络", "url": "https://www.freebuf.com/news/134075.html", "time": "2017-05-10", "level": "", "num_look": 442791, "num_comment": 6, "author": "clouds", "tags": ["特别企划", "资讯"], "text": "从目前的情况来看，幕后运营者通过远程控制管理Bondnet网络，进行数字加密货币挖矿，但也随时准备着发起类似于Mirai的DDoS攻击。"}
{"title": "浙江九州量子诚聘大量安全人才(杭州 )", "url": "https://www.freebuf.com/jobs/133692.html", "time": "2017-05-10", "level": "", "num_look": 370610, "num_comment": 5, "author": "九州量子", "tags": ["安全招聘"], "text": "浙江九州量子信息技术股份有限公司于2016年6月正式挂牌新三板，成为中国资本市场的“量子通信第一股”，是中国首家市场化运营的量子通信应用全产业链企业。"}
{"title": "OWASP开源工具antisamy的使用详解", "url": "https://www.freebuf.com/sectool/134015.html", "time": "2017-05-10", "level": "金币+20", "num_look": 551456, "num_comment": 10, "author": "niro001", "tags": ["工具"], "text": "Antisamy是OWASP的一个开源项目，其能够对用户输入的html/css/javascript 脚本进行过滤，确保输入满足规范，无法提交恶意脚本。"}
{"title": "NSA方程式Easybee攻击程序漏洞复现与分析", "url": "https://www.freebuf.com/articles/system/133840.html", "time": "2017-05-10", "level": "金币+20", "num_look": 374834, "num_comment": 6, "author": "天择实习生", "tags": ["系统安全"], "text": "本文将对NSA方程式中的远程攻击程序Easybee漏洞攻击进行复现，并分析漏洞攻击原理。"}
{"title": "印度初创公司开发了下一代区块链网络安全解决方法", "url": "https://www.freebuf.com/news/133852.html", "time": "2017-05-10", "level": "", "num_look": 571818, "num_comment": 3, "author": "米雪儿", "tags": ["资讯"], "text": "一家致力于利用区块链科技实现网络安全的创新型初创公司在印度成立，旨在遏制全球网络犯罪现象。"}
{"title": "WordPress 4.6远程代码执行漏洞分析", "url": "https://www.freebuf.com/vuls/133849.html", "time": "2017-05-10", "level": "", "num_look": 629851, "num_comment": 5, "author": "奇安信威胁情报中心", "tags": ["漏洞"], "text": "本文对WordPress 4.6 版本远程代码执行漏洞进行了分析，在poc中展示了精彩的替换 ／ 和 “ ”(表示空格)的技巧。"}
{"title": "漏洞预警 | Windows系统恶意软件防护引擎曝严重远程代码执行漏洞（CVE-2017-0290）", "url": "https://www.freebuf.com/vuls/134172.html", "time": "2017-05-09", "level": "红色标题", "num_look": 660816, "num_comment": 12, "author": "欧阳洋葱", "tags": ["漏洞", "系统安全"], "text": "微软昨天发布了安全公告——微软自家的恶意程序防护引擎出现高危安全漏洞，Windows Defender、MSE等都受影响。"}
{"title": "如何构建一个反电信网络诈骗基础模型", "url": "https://www.freebuf.com/articles/network/133861.html", "time": "2017-05-09", "level": "现金奖励", "num_look": 435446, "num_comment": 4, "author": "西角边的MR", "tags": ["网络安全"], "text": "本文通过对目前社会上关于网络电信诈骗新闻进行提取，从中分析当前网络诈骗发展趋势和关键因素，进而构建合理的反诈骗模型。"}
{"title": "终端设备和网络事件“自动化响应”到底有多么棘手？", "url": "https://www.freebuf.com/articles/es/133984.html", "time": "2017-05-09", "level": "", "num_look": 439949, "num_comment": 439949, "author": "Alpha_h4ck", "tags": ["企业安全"], "text": "很多企业都部署了自动化系统来预防、检测或调查安全威胁事件，但是实现网络系统和终端设备的事件响应以及威胁缓解的自动化仍是目前一个非常棘手的问题。"}
{"title": "美团点评招聘各类中高级安全与研发岗位", "url": "https://www.freebuf.com/jobs/133705.html", "time": "2017-05-09", "level": "", "num_look": 320290, "num_comment": 10, "author": "ayazero", "tags": ["安全招聘"], "text": "美团、点评招聘各类中高级安全与研发岗位。"}
{"title": "物联网安全风险威胁报告", "url": "https://www.freebuf.com/articles/terminal/133668.html", "time": "2017-05-09", "level": "现金奖励", "num_look": 796472, "num_comment": 14, "author": "魅影儿", "tags": ["安全报告", "终端安全"], "text": "试想一下，无论家用或企业级的互连设备，如接入互联网的交通指示灯，恒温器，或医用监控设备遭到攻击，后果都将非常可怕。"}
{"title": "你来了吗？我来了…「FreeBuf专栏」来了！", "url": "https://www.freebuf.com/news/134113.html", "time": "2017-05-09", "level": "红色标题", "num_look": 705231, "num_comment": 10, "author": "FB客服", "tags": ["特别企划", "资讯"], "text": "我们常常在思考，FB上，是否还有提供更广阔的空间，可以让每一个乐于分享的人施展……"}
{"title": "数据清洗、智能网联汽车与企业安全建设：FreeTalk北京站看点回顾（附PPT下载）", "url": "https://www.freebuf.com/fevents/133993.html", "time": "2017-05-09", "level": "红色标题", "num_look": 841259, "num_comment": 12, "author": "Elaine_z", "tags": ["活动", "特别企划"], "text": "2017年5月6日，本次FreeTalk 2017网络安全沙龙如期在北京举办。让我们第一时间，来看看本次沙龙中的看点吧。"}
{"title": "钓鱼邮件攻击中的猥琐技巧与策略", "url": "https://www.freebuf.com/articles/web/133689.html", "time": "2017-05-09", "level": "现金奖励", "num_look": 799289, "num_comment": 25, "author": "sarleon", "tags": ["WEB安全", "网络安全"], "text": "钓鱼邮件攻击是社会工程学攻击中的一种常见的手段， 一般来说,钓鱼邮件从后续的攻击手段角度，可以分为两类。"}
{"title": "CIA机密文档追踪工具Scribbles详细分析", "url": "https://www.freebuf.com/articles/system/133702.html", "time": "2017-05-09", "level": "现金奖励", "num_look": 705532, "num_comment": 5, "author": "ArkTeam", "tags": ["系统安全"], "text": "近日维基解密发布了CIA“涂鸦”项目的文档和源代码，文本首先通过其源代码，分析该系统生成水印的流程，然后通过实际使用，并对其实际效果进行测试和总结。"}
{"title": "方程式0day ETERNALBLUE复现之Empire & Msfconsole下的shell获取", "url": "https://www.freebuf.com/articles/system/133853.html", "time": "2017-05-09", "level": "金币+10", "num_look": 1199775, "num_comment": 18, "author": "secist", "tags": ["系统安全", "网络安全"], "text": "在本文中我将为大家复现在前段时间被曝出的，方程式0day Eternalblue的利用过程。"}
{"title": "卡巴斯基发布2017年第一季度APT趋势报告", "url": "https://www.freebuf.com/articles/paper/133851.html", "time": "2017-05-08", "level": "", "num_look": 432446, "num_comment": 4, "author": "米雪儿", "tags": ["安全报告"], "text": "2017年第一季度，我们已经向情报服务订阅者发布了33份私人报告，其中包含“攻击指标”（IOC）数据和YARA规则，来协助相关人员进行取证和恶意软件搜索工作。"}
{"title": "英特尔AMT功能远程提权高危漏洞分析", "url": "https://www.freebuf.com/articles/system/134055.html", "time": "2017-05-08", "level": "", "num_look": 335670, "num_comment": 3, "author": "Sphinx", "tags": ["系统安全"], "text": "本周早些时候，英特尔发布了一个高危提权漏洞，远程攻击者可以利用漏洞控制存在PC、笔记本电脑和服务器。"}
{"title": "火币网诚聘高级安全工程师", "url": "https://www.freebuf.com/jobs/133511.html", "time": "2017-05-08", "level": "", "num_look": 344039, "num_comment": 13, "author": "dahuobi", "tags": ["安全招聘"], "text": "火币是面向全球的比特币交易平台，为全球30多个国家和地区200万用户提供安全可信赖的比特币交易及存储服务。"}
{"title": "通过浏览器缓存来bypass nonce script CSP", "url": "https://www.freebuf.com/articles/web/133455.html", "time": "2017-05-08", "level": "现金奖励", "num_look": 488524, "num_comment": 488524, "author": "LoRexxar", "tags": ["WEB安全"], "text": "本文详细分析一种CSP利用浏览器缓存的XSS攻击"}
{"title": "如何创建Powershell持久隐蔽后门", "url": "https://www.freebuf.com/articles/system/133640.html", "time": "2017-05-08", "level": "现金奖励", "num_look": 778590, "num_comment": 13, "author": "al0ne_", "tags": ["系统安全", "网络安全"], "text": "本文介绍了如何创建Powershell持久隐蔽后门。"}
{"title": "如何用前端防御XSS及建立XSS报警机制（三）", "url": "https://www.freebuf.com/articles/web/133509.html", "time": "2017-05-08", "level": "现金奖励", "num_look": 360576, "num_comment": 7, "author": "Black-Hole", "tags": ["WEB安全"], "text": "如何用前端防御XSS及建立XSS报警机制第三部"}
{"title": "解码内置不安全“加密芯片”的勒索软件Gomasom", "url": "https://www.freebuf.com/news/133773.html", "time": "2017-05-08", "level": "现金奖励", "num_look": 179911, "num_comment": 7, "author": "Voraka", "tags": ["资讯"], "text": "其加密方式与网上所描述的加密方式及症状并不完全相同，并且也不能通过网上的解密工具来解密加密后的文件。"}
{"title": "SD-WAN领域16个热门网络产品", "url": "https://www.freebuf.com/news/133069.html", "time": "2017-05-07", "level": "", "num_look": 360691, "num_comment": 1, "author": "米雪儿", "tags": ["特别企划", "网络安全"], "text": "软件定义广域网（SoftwareDefined WAN，SD-WAN）无疑是从2015年到现在企业级广域网布局中最热门的技术之一。"}
{"title": "攻击者利用7号信令（SS7）中的漏洞从德国银行偷取钱财", "url": "https://www.freebuf.com/news/133865.html", "time": "2017-05-07", "level": "", "num_look": 377874, "num_comment": 30, "author": "米雪儿", "tags": ["资讯"], "text": "位于德国的O2-Telefonica公司通过《南德意志报》证实，其公司的部分客户遭受到利用SS7漏洞的网络劫持者攻击。"}
{"title": "Shodan新工具发布：木马恶意软件C&C服务器搜索引擎", "url": "https://www.freebuf.com/sectool/133663.html", "time": "2017-05-07", "level": "", "num_look": 567136, "num_comment": 3, "author": "clouds", "tags": ["工具"], "text": "该工具被集成在Shodan基础搜索引擎之上，可以极大方便广大安全研究人员进行相关恶意软件感染设备的探测发现。"}
{"title": "【已结束】FreeTalk 2017北京站互联网安全沙龙图文直播", "url": "https://www.freebuf.com/fevents/133700.html", "time": "2017-05-06", "level": "红色标题", "num_look": 863910, "num_comment": 9, "author": "Elaine_z", "tags": ["活动"], "text": "FreeTalk 2017北京站活动在5月6日举行，本次活动会在FreeBuf上进行全程图文直播。"}
{"title": "大量APP使用超声波追踪技术获取用户信息，隐私安全或将难以保障", "url": "https://www.freebuf.com/news/133803.html", "time": "2017-05-06", "level": "", "num_look": 247622, "num_comment": 6, "author": "sunleying", "tags": ["资讯"], "text": "研究人员在上周的IEEE欧洲议会上表示，他们发现了234种安卓应用会向用户发出“允许使用麦克风”的请求，以此通过超声波信号追踪用户信息。"}
{"title": "强推HTTPS：Chrome 62将所有需输入数据的HTTP页面标为“不安全”", "url": "https://www.freebuf.com/news/133603.html", "time": "2017-05-06", "level": "", "num_look": 351981, "num_comment": 19, "author": "CA-沃通WoSign", "tags": ["资讯"], "text": "Chrome将进一步扩大HTTP页面“不安全”警告的展示范围。"}
{"title": "九州云腾招聘高级云安全产品经理", "url": "https://www.freebuf.com/jobs/133432.html", "time": "2017-05-06", "level": "", "num_look": 345457, "num_comment": 4, "author": "大牛", "tags": ["安全招聘"], "text": ""}
{"title": "Cobalt Strike学习笔记（持续更新）", "url": "https://www.freebuf.com/sectool/133369.html", "time": "2017-05-06", "level": "现金奖励", "num_look": 1843094, "num_comment": 33, "author": "mx7krshell", "tags": ["工具", "网络安全"], "text": "Cobalt Strike 3.0已经不再使用Metasploit框架而作为一个独立的平台使用，本文介绍了Cobalt Strike的学习方法"}
{"title": "Wordpress 4.6远程代码执行漏洞（CVE-2016-10033）复现环境搭建指南", "url": "https://www.freebuf.com/vuls/133860.html", "time": "2017-05-06", "level": "现金奖励", "num_look": 712280, "num_comment": 12, "author": "p1nk0", "tags": ["WEB安全", "漏洞"], "text": "具体关于漏洞的分析不多说了，FreeBuf之前的文章已经说得很好了，主要是说环境搭建。"}
{"title": "开放运营生态，漏洞管理能力共享：漏洞盒子企业SRC在京发布", "url": "https://www.freebuf.com/fevents/133924.html", "time": "2017-05-06", "level": "红色标题", "num_look": 709468, "num_comment": 3, "author": "Elaine_z", "tags": ["活动"], "text": "企业自营SRC宣传效果不佳，运营成本却居高不下？技术团队能力参差，漏洞审核愈发困难，如何提高效率？漏洞管理平台日趋复杂，持续研发投入是否值得？"}
{"title": "五大危害企业的移动端威胁与安全防御措施", "url": "https://www.freebuf.com/articles/terminal/133231.html", "time": "2017-05-05", "level": "", "num_look": 372869, "num_comment": 3, "author": "Carrie_spinfo", "tags": ["企业安全", "终端安全"], "text": "本文介绍并详细分析了五大危害企业的移动端威胁。"}
{"title": "快速扩散的Google Docs钓鱼攻击：一键接管你的Gmail邮箱", "url": "https://www.freebuf.com/articles/web/133790.html", "time": "2017-05-05", "level": "", "num_look": 460625, "num_comment": 8, "author": "Sphinx", "tags": ["WEB安全"], "text": "近日，互联网行业的记者们纷纷收到了钓鱼邮件，邮件内容是别人分享的Google文档。这种钓鱼攻击把蠕虫传播方式也结合在了一起，并通过手段使得钓鱼更难甄别。"}
{"title": "【已结束】漏洞盒子企业SRC发布会图文直播", "url": "https://www.freebuf.com/fevents/133693.html", "time": "2017-05-05", "level": "红色标题", "num_look": 747727, "num_comment": 5, "author": "漏洞盒子", "tags": ["活动"], "text": "漏洞盒子协助企业构建定制化的SRC，为企业提供漏洞生命周期的管理，一站式安全托管服务，帮助企业实现更便捷高效的SRC运营。"}
{"title": "北京玖富集团诚聘安全工程师", "url": "https://www.freebuf.com/jobs/133788.html", "time": "2017-05-05", "level": "", "num_look": 270247, "num_comment": 10, "author": "9FHR", "tags": ["安全招聘"], "text": "玖富是中国领先的移动互联网金融综合服务平台,成立于2006年,注册资金2亿元人民币。"}
{"title": "利用Outlook Forms绕过VB宏，获取目标Shell", "url": "https://www.freebuf.com/news/133709.html", "time": "2017-05-05", "level": "", "num_look": 436966, "num_comment": 1, "author": "sunleying", "tags": ["漏洞", "资讯"], "text": "Sensepost发现了一种利用Outlook Forms，成功绕过宏规则，获取目标shell的方法，有可能被攻击者恶意利用,但微软似乎并不认为这是一个程序漏洞。"}
{"title": "7步轻松绕过iCloud激活锁", "url": "https://www.freebuf.com/articles/133547.html", "time": "2017-05-05", "level": "", "num_look": 6031841, "num_comment": 21, "author": "鸢尾", "tags": ["其他", "文章"], "text": "在eBay或Amazon购买二手iPhone很有可能是上锁的(即iCloud锁),本文将展示如何绕过iPhone的 iCloud激活锁"}
{"title": "XSS Bot从入门到完成", "url": "https://www.freebuf.com/articles/web/133456.html", "time": "2017-05-05", "level": "现金奖励", "num_look": 483348, "num_comment": 5, "author": "LoRexxar", "tags": ["WEB安全"], "text": "xss在近几年的ctf形式中，越来越受到了人们的重视。下面我们就来看看一个xss bot是怎么完成的。"}
{"title": "PlaidCTF 2017 web writeup", "url": "https://www.freebuf.com/articles/web/133336.html", "time": "2017-05-05", "level": "现金奖励", "num_look": 390482, "num_comment": 3, "author": "LoRexxar", "tags": ["WEB安全"], "text": "前段时间刚刚经历了国际很有名的pctf，本文中稍微整理下pctf2017的web writeup。"}
{"title": "Wordpress曝未经授权的密码重置漏洞（CVE-2017-8295 ）", "url": "https://www.freebuf.com/vuls/133816.html", "time": "2017-05-04", "level": "", "num_look": 800250, "num_comment": 10, "author": "鸢尾", "tags": ["漏洞"], "text": "Wordpress的重置密码功能存在漏洞，在某些情况下（利用难度较高）不需要使用之前的身份令牌验证获取密码重置链接。"}
{"title": "如何快速破解识别APT28网络攻击流量", "url": "https://www.freebuf.com/articles/network/133499.html", "time": "2017-05-04", "level": "", "num_look": 389735, "num_comment": 389735, "author": "clouds", "tags": ["网络安全"], "text": "让我们来看看安全公司Redsocks security如何通过网络流量来快速识别和破解APT28攻击行为。"}
{"title": "【更新WordPress 4.6漏洞利用PoC】PHPMailer曝远程代码执行高危漏洞（CVE-2016-10033）", "url": "https://www.freebuf.com/news/123945.html", "time": "2017-05-04", "level": "金币+8", "num_look": 1261209, "num_comment": 18, "author": "lmj", "tags": ["漏洞", "资讯"], "text": "PHPMailer中一个关键漏洞可能被远程攻击者利用，实现远程任意代码在web服务器的环境中执行。"}
{"title": "成都盈海益讯科技有限公司（几维安全）招聘", "url": "https://www.freebuf.com/jobs/133234.html", "time": "2017-05-04", "level": "", "num_look": 377578, "num_comment": 12, "author": "lpcdma", "tags": ["安全招聘"], "text": ""}
{"title": "一款高度可定制的WiFi钓鱼工具 - WiFiPhisher", "url": "https://www.freebuf.com/sectool/132933.html", "time": "2017-05-04", "level": "", "num_look": 1432474, "num_comment": 13, "author": "Alpha_h4ck", "tags": ["工具"], "text": "WiFiPhisher是一款高度可定制的WiFi钓鱼攻击工具。"}
{"title": "局域网聊天软件攻防战", "url": "https://www.freebuf.com/articles/network/133229.html", "time": "2017-05-04", "level": "现金奖励", "num_look": 707166, "num_comment": 20, "author": "追影人", "tags": ["网络安全"], "text": "不少甲方公司使用聊天软件进行办公通信，而这些软件中同样存在各种安全风险。本文就带大家利用协议分析技术来还原一款局域网聊天软件的通信协议进行攻击示范。"}
{"title": "如何利用Fluxion诱惑目标用户获取WPA密码", "url": "https://www.freebuf.com/articles/wireless/133315.html", "time": "2017-05-04", "level": "金币+8", "num_look": 990241, "num_comment": 14, "author": "煮熟的鸭子", "tags": ["无线安全"], "text": "由于ISP替代了易受攻击的路由器，供渗透测试人员选择的诸如Reaver这样的工具越来越少,幸运的是，几乎所有的系统都有一个常见的漏洞，那就是用户。"}
{"title": "Google最新XSS Game Writeup", "url": "https://www.freebuf.com/articles/web/133384.html", "time": "2017-05-04", "level": "现金奖励", "num_look": 432736, "num_comment": 19, "author": "cDdubz8", "tags": ["WEB安全"], "text": "本文介绍了如何完成谷歌最新的XSSGame的过程，完成了这八个挑战就有机会获得Nexus 5x。"}
{"title": "云端模糊测试挖洞实例", "url": "https://www.freebuf.com/articles/system/133210.html", "time": "2017-05-03", "level": "", "num_look": 306550, "num_comment": 306550, "author": "鸢尾", "tags": ["系统安全"], "text": "在本文中，我们将与你一同走完云端模糊测试的全过程(即部署，Fuzzing以及使用softScheck Cloud Fuzzing Framework (sCFF)框架检索结果)。"}
{"title": "卑躬屈膝“上报”多年的Intel严重漏洞，到现在才修复！", "url": "https://www.freebuf.com/news/133657.html", "time": "2017-05-03", "level": "金币+8", "num_look": 500235, "num_comment": 4, "author": "clouds", "tags": ["漏洞", "资讯"], "text": "漏洞影响所有Intel企业版服务器和综合利用技术，这意味着Intel近十年来的固件芯片都会受到影响！"}
{"title": "银科控股安全人员招聘（纳斯达克上市公司）", "url": "https://www.freebuf.com/jobs/133363.html", "time": "2017-05-03", "level": "", "num_look": 346889, "num_comment": 7, "author": "万严", "tags": ["安全招聘"], "text": "银科投资控股有限公司（简称“银科控股”）是国内的个人投资与交易服务商。"}
{"title": "如何手动注入Payload后门到安卓APK文件并维持访问", "url": "https://www.freebuf.com/articles/terminal/133357.html", "time": "2017-05-03", "level": "现金奖励", "num_look": 783761, "num_comment": 36, "author": "永生", "tags": ["终端安全"], "text": "本文展示了手动注入Payload后门到安卓APK文件并维持访问的详细过程"}
{"title": "【本周六】春意盎然，FreeTalk 2017北京站活动免费报名开启啦！", "url": "https://www.freebuf.com/fevents/132829.html", "time": "2017-05-03", "level": "红色标题", "num_look": 686377, "num_comment": 30, "author": "FB客服", "tags": ["活动"], "text": "初夏的第一个周六，我们在树影斑驳的时光里邀您一起，在北京城以Free之名畅谈安全。"}
{"title": "子域名枚举的艺术", "url": "https://www.freebuf.com/articles/web/133335.html", "time": "2017-05-03", "level": "", "num_look": 486683, "num_comment": 10, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "直接使用搜索引擎查找某个域名的有效子域名"}
{"title": "维基解密公开CIA机密文档追踪工具Scribbles源码（别名为“Snowden Stopper”）", "url": "https://www.freebuf.com/news/133571.html", "time": "2017-05-03", "level": "", "num_look": 333374, "num_comment": 3, "author": "Elaine_z", "tags": ["资讯"], "text": "维基解密在4月28日公开了Scribbles的文件及其源代码。这是一款将web beacon标签加入机密文件中，用以追踪告密者及国外间谍的软件。"}
{"title": "你的数字签名会被撞破么？安全Hash的攻与防", "url": "https://www.freebuf.com/articles/database/133391.html", "time": "2017-05-03", "level": "", "num_look": 574825, "num_comment": 2, "author": "百度安全中心", "tags": ["数据安全"], "text": "安全hash函数是现代应用密码学最重要的基石之一。如果安全hash函数出现安全问题，整个应用密码体系乃至整个互联网的安全都受到严重影响。"}
{"title": "中央网信办发布《网络产品和服务安全审查办法（试行）》", "url": "https://www.freebuf.com/news/133608.html", "time": "2017-05-02", "level": "", "num_look": 269971, "num_comment": 6, "author": "sunleying", "tags": ["资讯"], "text": "本文为网络产品和服务安全审查办法（试行）全文"}
{"title": "一个新IoT僵尸网络正在HTTP 81上大范围传播", "url": "https://www.freebuf.com/articles/network/133233.html", "time": "2017-05-02", "level": "", "num_look": 541998, "num_comment": 3, "author": "360安全", "tags": ["安全报告", "网络安全"], "text": "网络安全研究院近日监测到一个新的僵尸网络正在大范围扫描整个互联网。考虑到该僵尸网络的以下因素，我们决定向安全社区公开我们的发现成果"}
{"title": "游戏外挂网站暗藏病毒：盗号、锁首等数种危害并举", "url": "https://www.freebuf.com/articles/web/133306.html", "time": "2017-05-02", "level": "红色标题", "num_look": 559047, "num_comment": 16, "author": "火绒安全", "tags": ["WEB安全", "系统安全"], "text": "根据技术分析追溯，我们确定一些游戏外挂上的首页劫持病毒的主要传播源是一个游戏外挂网站，进而发现，这个外挂站是一个巨大的“病毒窝点”"}
{"title": "Kali linux发布新版本了，一起来看看都有什么新功能吧", "url": "https://www.freebuf.com/sectool/133526.html", "time": "2017-05-02", "level": "金币+15", "num_look": 1137017, "num_comment": 29, "author": "houjingyi", "tags": ["工具"], "text": "Kali官方近日正式宣布推出Kali Linux 2017.1滚动发行版，它带来了一系列令人兴奋的更新和功能。"}
{"title": "滴滴出行诚聘数据安全运营和安全合规岗位", "url": "https://www.freebuf.com/jobs/133126.html", "time": "2017-05-02", "level": "", "num_look": 328600, "num_comment": 14, "author": "事业斐然", "tags": ["安全招聘"], "text": ""}
{"title": "揭秘薅羊毛过亿的苹果36技术黑产", "url": "https://www.freebuf.com/articles/others-articles/133311.html", "time": "2017-05-02", "level": "现金奖励", "num_look": 565858, "num_comment": 5, "author": "守护者观察", "tags": ["其他", "特别企划"], "text": "许多人开始关注IAP消费，即正常用户在iOS平台上消费后，都需要由苹果与app服务提供方按比例进行收入分账。但无孔不入的黑产人员，也想从中分一杯羹"}
{"title": "断网让女神求你：制作一个廉价的WIFI干扰器", "url": "https://www.freebuf.com/geek/133161.html", "time": "2017-05-02", "level": "现金奖励", "num_look": 2218544, "num_comment": 48, "author": "larblue", "tags": ["极客"], "text": "干扰WiFi运行有很多方法，最近玩esp8266模块放狗找资料，偶然发现一个干扰wifi信号的廉价方法，特与大家分享。"}
{"title": "NSA后门程序DoublePulsar事件后续，清理工具下载点这里", "url": "https://www.freebuf.com/articles/system/133302.html", "time": "2017-05-02", "level": "", "num_look": 629727, "num_comment": 5, "author": "Elaine_z", "tags": ["系统安全"], "text": "微软官方拒绝承认过万Windows计算机被NSA后门程序感染，最新的进展是在本周二，一种可远程卸除DoublePulsar后门的安全工具已被开放在GitHub上。"}
{"title": "浅谈Python网络爬虫", "url": "https://www.freebuf.com/sectool/133046.html", "time": "2017-05-02", "level": "", "num_look": 744525, "num_comment": 9, "author": "ArkTeam", "tags": ["WEB安全", "工具"], "text": "本文简要介绍对于定向信息采集所需了解基本知识和相关技术，以及python中与此相关的库，同时也提供了对与数据抓取有关库的封装实现。"}
{"title": "StringBleed：SNMP协议“上帝模式”漏洞影响多种网络设备", "url": "https://www.freebuf.com/vuls/133517.html", "time": "2017-05-01", "level": "红色标题", "num_look": 584374, "num_comment": 14, "author": "clouds", "tags": ["漏洞"], "text": "至少有78种型号的网络接入和IoT设备受此漏洞影响，攻击者可以利用该漏洞远程获得相关设备的读写权限。"}
{"title": "Makednslog：让我们来看一看这款能够伪造DNS日志的工具", "url": "https://www.freebuf.com/articles/network/132965.html", "time": "2017-05-01", "level": "", "num_look": 343476, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "本文展现给大家一款DNS日志伪造生成工具Makednslog。"}
{"title": "新式攻击使用W3C环境光线传感器来窃取浏览器的敏感信息（含演示视频）", "url": "https://www.freebuf.com/articles/web/133004.html", "time": "2017-05-01", "level": "", "num_look": 287816, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "在这篇文章中，我们将会给大家介绍一种从浏览器中提取敏感信息的方法，而我们所要用到的工具就是你的智能手机或笔记本电脑中的环境光传感器。"}
{"title": "俄罗斯黑客组织“Fancy Bear”最新钓鱼手段", "url": "https://www.freebuf.com/news/133303.html", "time": "2017-05-01", "level": "", "num_look": 332295, "num_comment": 4, "author": "Carrie_spinfo", "tags": ["资讯"], "text": "近两年，俄罗斯黑客似乎异常活跃，他们的魔爪伸向了全球范围内各个行业，尤以屡次干扰政治活动带来了最为恶劣的影响。"}
{"title": "OpenVAS开源风险评估系统部署方案", "url": "https://www.freebuf.com/sectool/133425.html", "time": "2017-04-30", "level": "金币+15", "num_look": 835237, "num_comment": 19, "author": "魅影儿", "tags": ["企业安全", "工具"], "text": "本文档属于部署方案文档，详细介绍了部署方法，搭建部署过程中有很多踩过的坑。"}
{"title": "在图片中加入噪点就能骗过Google最顶尖的图像识别AI", "url": "https://www.freebuf.com/news/132809.html", "time": "2017-04-30", "level": "", "num_look": 540561, "num_comment": 14, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "近期，一群来自华盛顿大学网络安全实验室（NSL）的计算机专家发现，恶意攻击者可以欺骗Google的CloudVision API。"}
{"title": "一种基于机器学习的自动化鱼叉式网络钓鱼思路", "url": "https://www.freebuf.com/articles/web/132811.html", "time": "2017-04-29", "level": "", "num_look": 460237, "num_comment": 460237, "author": "ArkTeam", "tags": ["WEB安全"], "text": "本文将介绍一种基于机器学习的社会工程模型—自动化鱼叉式网络钓鱼。"}
{"title": "打开手机电筒就泄露了银行卡密码？", "url": "https://www.freebuf.com/news/133452.html", "time": "2017-04-29", "level": "", "num_look": 256075, "num_comment": 5, "author": "Carrie_spinfo", "tags": ["资讯"], "text": "据ESET4月19日官方报道，一个具有自动锁屏功能的银行恶意软件近期伪装成Google Play上的手电筒应用，广大安卓用户成为了它的狩猎目标乃至囊中之物。"}
{"title": "2017第一季度安卓短信扣费木马研究：七成扣费木马擅长以”用户的名义”骗取话费", "url": "https://www.freebuf.com/articles/terminal/133118.html", "time": "2017-04-29", "level": "", "num_look": 487042, "num_comment": 3, "author": "腾讯手机管家", "tags": ["安全报告", "终端安全"], "text": "通过海量样本分析发现，短信扣费木马的家族形成与详情是这样的..."}
{"title": "无线安全工具SySS Radio Hack Box – 寻找无线输入设备中的安全漏洞", "url": "https://www.freebuf.com/sectool/132762.html", "time": "2017-04-29", "level": "", "num_look": 303911, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["工具"], "text": "SySS Radio Hack Box是一款针对无线键盘的PoC工具，可以帮助研究人员利用无线键盘中的键击注入漏洞来实施攻击。"}
{"title": "美国国防部“黑了空军（Hack the Air Force）”漏洞奖励计划即将启动，仍由HackerOne运营", "url": "https://www.freebuf.com/news/133433.html", "time": "2017-04-28", "level": "", "num_look": 256171, "num_comment": 3, "author": "Elaine_z", "tags": ["资讯"], "text": "美国国防部（DoD）在成功举办“Hack the Pentagon”和“Hack the Army”活动后，在27日宣布即将举办“Hack the Air Force”漏洞奖励计划项目"}
{"title": "beSTORM之DLL Fuzz入门教程", "url": "https://www.freebuf.com/articles/system/133188.html", "time": "2017-04-28", "level": "现金奖励", "num_look": 352182, "num_comment": 7, "author": "dolphin", "tags": ["系统安全"], "text": "无论在认证测试还是开发生命周期中，供应商均可以使用 beSTORM 来测试产品。该软件能够定制现有模块，并且添加新模块，以直观和易于使用的环境实现所有测试功能。"}
{"title": "锁机生成器病毒，锁定手机并勒索用户钱财", "url": "https://www.freebuf.com/articles/terminal/132887.html", "time": "2017-04-28", "level": "", "num_look": 858771, "num_comment": 6, "author": "腾讯手机管家", "tags": ["终端安全"], "text": "锁屏勒索类病毒即手机被锁定，用户无法正常使用手机, 中毒以后病毒还会向用户勒索钱财。"}
{"title": "飞马大宗诚聘高级安全测试人才", "url": "https://www.freebuf.com/jobs/113861.html", "time": "2017-04-28", "level": "", "num_look": 390807, "num_comment": 22, "author": "Jeff Leung（梁峰）", "tags": ["安全招聘"], "text": "飞马大宗是飞马大宗投资有限公司旗下的大宗商品现货交易平台，目前交易品种主要有 铜、铝、铅、锌、镍等有色金属。"}
{"title": "【新手指南】如何用Ettercap实现“中间人攻击”（二）：HTTP数据劫持", "url": "https://www.freebuf.com/articles/network/132814.html", "time": "2017-04-28", "level": "现金奖励", "num_look": 681837, "num_comment": 5, "author": "gaearrow", "tags": ["网络安全"], "text": "作为《新手指南：如何用Ettercap实现“中间人攻击”》工具介绍 的续篇，本文以某知名下载网站为例，逐步介绍了利用Ettercap，构造过滤规则实现HTTP劫持的整个过程。"}
{"title": "使用Empire“探索”Windows个人电脑", "url": "https://www.freebuf.com/articles/system/133135.html", "time": "2017-04-28", "level": "现金奖励", "num_look": 602174, "num_comment": 21, "author": "amandus", "tags": ["系统安全"], "text": "Empire是针对windows平台的一套渗透工具，包括了从stager生成、提权到渗透维持的一系列功能。"}
{"title": "利用NSA的MS17-010漏洞利用工具实现Win 7和Win Server 2008系统入侵", "url": "https://www.freebuf.com/articles/system/132813.html", "time": "2017-04-28", "level": "金币+10", "num_look": 1436389, "num_comment": 35, "author": "clouds", "tags": ["系统安全"], "text": "用NSA的两个大杀器演示对Win 7和Windows  Server 2008系统进行漏洞利用和入侵控制的过程复现"}
{"title": "一款针对无线键鼠的劫持攻击工具 - Mousejack Transmit", "url": "https://www.freebuf.com/sectool/132808.html", "time": "2017-04-28", "level": "", "num_look": 483565, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["工具"], "text": "我们已经在GitHub代码库中提供了攻击测试的PoC代码，实验过程中的测试目标为罗技ComboMK220键鼠套装。"}
{"title": "神奇的Content-Type：所有版本的IE浏览器都存在的一个0day漏洞", "url": "https://www.freebuf.com/articles/web/132963.html", "time": "2017-04-27", "level": "", "num_look": 408705, "num_comment": 17, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": ""}
{"title": "一款Android漏洞测试套件 - AndroidVTS", "url": "https://www.freebuf.com/sectool/132932.html", "time": "2017-04-27", "level": "", "num_look": 302742, "num_comment": 302742, "author": "Alpha_h4ck", "tags": ["工具"], "text": ""}
{"title": "利用企业邮件系统构造命令控制（C&C）和数据窃取（Exfiltration）通道的思路探讨", "url": "https://www.freebuf.com/articles/network/132962.html", "time": "2017-04-27", "level": "", "num_look": 393049, "num_comment": 1, "author": "clouds", "tags": ["网络安全"], "text": ""}
{"title": "平安科技诚聘各类安全工程师", "url": "https://www.freebuf.com/jobs/132803.html", "time": "2017-04-27", "level": "", "num_look": 320884, "num_comment": 8, "author": "hereholly", "tags": ["安全招聘"], "text": ""}
{"title": "低成本安全硬件实战遇到的那些事", "url": "https://www.freebuf.com/articles/terminal/132952.html", "time": "2017-04-27", "level": "现金奖励", "num_look": 868740, "num_comment": 10, "author": "魍魉", "tags": ["极客", "终端安全"], "text": "笔者希望通过这篇文章，让对此感兴趣的读者在花费较少金钱的情况下体会到硬件安全的魅力所在。"}
{"title": "安全与编程相关的免费电子书集合（含电子书下载）", "url": "https://www.freebuf.com/sectool/132874.html", "time": "2017-04-27", "level": "", "num_look": 488349, "num_comment": 16, "author": "Alpha_h4ck", "tags": ["其他", "工具"], "text": ""}
{"title": "NSA Fuzzbunch中EternalRomance工具复现过程", "url": "https://www.freebuf.com/articles/system/132879.html", "time": "2017-04-27", "level": "金币+15", "num_look": 672776, "num_comment": 35, "author": "feshi7007", "tags": ["系统安全"], "text": "自Shadow Brokers公布NSA泄露工具后，各路大神陆陆续续发表复现过程，这几天也仔细试了各种套路，于是就有了这篇文章。"}
{"title": "新发布的Metasploit Vulnerable Services Emulator能取代传统靶机吗？", "url": "https://www.freebuf.com/sectool/132337.html", "time": "2017-04-27", "level": "", "num_look": 391858, "num_comment": 4, "author": "Sphinx", "tags": ["工具", "系统安全"], "text": "市面上已经有Metasploitable2和Metasploitable3这样专门针对MSF使用的模拟器，也有其他“一众靶机”，为什么又要推出这款？"}
{"title": "PostgreSQL管理工具pgAdmin 4中XSS漏洞的发现和利用", "url": "https://www.freebuf.com/articles/web/132413.html", "time": "2017-04-26", "level": "", "num_look": 326942, "num_comment": 3, "author": "鸢尾", "tags": ["WEB安全"], "text": ""}
{"title": "谍影追踪：全球首例UEFI_BIOS木马分析", "url": "https://www.freebuf.com/articles/system/133243.html", "time": "2017-04-26", "level": "红色标题", "num_look": 541325, "num_comment": 23, "author": "360安全", "tags": ["系统安全"], "text": "我们发现了一种前所未见的新型BIOS BOOTKIT。由于它会在系统中设置间谍账号进行远程控制，我们将其命名为谍影木马。"}
{"title": "AKULAKU招聘信息安全工程师", "url": "https://www.freebuf.com/jobs/133094.html", "time": "2017-04-26", "level": "", "num_look": 209607, "num_comment": 9, "author": "CeciliaMak♡", "tags": ["安全招聘"], "text": "岩心科技是一家创业公司。公司目前正运营一款基于移动购物场景的虚拟信用卡AKULAKU。"}
{"title": "威胁情报怎么用？", "url": "https://www.freebuf.com/articles/neopoints/132941.html", "time": "2017-04-26", "level": "金币+15", "num_look": 365554, "num_comment": 6, "author": "ZenMind", "tags": ["观点"], "text": "威胁情报在国内已经火了几年，威胁情报怎么用，具体的使用场景是什么，这方面的话题似乎较少。下面想根据个人所知，谈谈这方面，不完善准确的地方也请大家指正。"}
{"title": "再见了，打码平台：对抗打码平台的验证码思路", "url": "https://www.freebuf.com/articles/web/133003.html", "time": "2017-04-26", "level": "现金奖励", "num_look": 891623, "num_comment": 39, "author": "idapro", "tags": ["WEB安全", "终端安全"], "text": "打码平台的加入使得图灵测试立即无效——打码平台上活跃的对象还真是人。但这样就没辙了么？No！"}
{"title": "一款Windows系统下不错的提权工具 - BeRoot", "url": "https://www.freebuf.com/sectool/132806.html", "time": "2017-04-26", "level": "", "num_look": 560921, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["工具"], "text": "BeRoot可以帮助我们检查目标Windows系统中存在的错误配置，并找出提权的方法。"}
{"title": "企业如何应对安全威胁？看看更新的NIST网络安全框架", "url": "https://www.freebuf.com/articles/network/132839.html", "time": "2017-04-26", "level": "", "num_look": 364293, "num_comment": 364293, "author": "Elaine_z", "tags": ["网络安全"], "text": ""}
{"title": "NSA武器库之Eternalromance （永恒浪漫） 漏洞分析", "url": "https://www.freebuf.com/articles/system/132805.html", "time": "2017-04-26", "level": "", "num_look": 699771, "num_comment": 13, "author": "360安全", "tags": ["系统安全"], "text": "360Vulcan Team的@pgboy1988和@zhong_sf对Eternalromance使用的漏洞进行了技术分析"}
{"title": "这是个需要“鸟枪换炮”的时代：盘古Janus发布会除了越狱还有什么？", "url": "https://www.freebuf.com/fevents/133247.html", "time": "2017-04-25", "level": "", "num_look": 772404, "num_comment": 18, "author": "欧阳洋葱", "tags": ["活动"], "text": "用简短的语言来说概括什么是Janus，大概可以说，Janus就是盘古基于自己在移动安全分析方面的经验，专门针对移动安全所推的威胁情报类产品。"}
{"title": "Linux系统安全检查工具Lynis 2.4.8发布", "url": "https://www.freebuf.com/sectool/132454.html", "time": "2017-04-25", "level": "金币+15", "num_look": 371680, "num_comment": 5, "author": "phper", "tags": ["工具"], "text": "Lynis是一个为系统管理员提供的 Linux和Unix的审计工具 。"}
{"title": "【已结束】盘古Janus产品发布会图文直播", "url": "https://www.freebuf.com/fevents/133225.html", "time": "2017-04-25", "level": "", "num_look": 512292, "num_comment": 1, "author": "Sphinx", "tags": ["活动"], "text": "Janus是一个由犇众信息盘古实验室研发的移动安全威胁数据平台，此次发布会在上海召开，Freebuf将全程直播。"}
{"title": "Pwnable.tw刷题之calc", "url": "https://www.freebuf.com/articles/others-articles/132283.html", "time": "2017-04-25", "level": "现金奖励", "num_look": 480522, "num_comment": 23, "author": "oO0ps", "tags": ["其他"], "text": "受到基友的耳濡目染，最近开始入坑CTF。接受他的建议，先在pwnable.kr和pwnable.tw两个平台上玩玩题。"}
{"title": "WALNUT攻击：一种针对的MEMS传感器（加速度计）的声学攻击（含视频）", "url": "https://www.freebuf.com/articles/terminal/132381.html", "time": "2017-04-25", "level": "", "num_look": 239090, "num_comment": 239090, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "本文进行这项调查研究的目的是想弄清楚模拟声学注入攻击对电容式MEMS（微型机电系统）加速度计的数字完整性将会产生怎样的影响。"}
{"title": "巨人网络游戏安全人员招聘", "url": "https://www.freebuf.com/jobs/133043.html", "time": "2017-04-25", "level": "", "num_look": 258559, "num_comment": 8, "author": "Sandy_Wang", "tags": ["安全招聘"], "text": "园区硬件设施超赞，环境非常好，得过国内外多项大奖，硬件上来说至少是国内互联网公司的Top5"}
{"title": "可与Mirai比肩的恶意程序Hajime，竟是为了保护IoT设备？", "url": "https://www.freebuf.com/news/132339.html", "time": "2017-04-25", "level": "", "num_look": 208471, "num_comment": 208471, "author": "sunleying", "tags": ["资讯"], "text": "Hajime这个名字或许没那么为人熟知，但提及Mirai，很多人都想起了去年十月那次著名的DDOS攻击。Hajime和Mirai一样，同样参与了那场互联网攻击。"}
{"title": "XSS利用之延长Session生命周期", "url": "https://www.freebuf.com/articles/web/132971.html", "time": "2017-04-25", "level": "现金奖励", "num_look": 286188, "num_comment": 6, "author": "心东", "tags": ["WEB安全"], "text": "简单介绍：PHP session 变量用于存储有关用户会话的信息，或更改用户会话的设置。Session 变量保存的信息是单一用户的，并且可供应用程序中的所有页面使用。"}
{"title": "大数据下全球撞库黑色产业链追踪报告", "url": "https://www.freebuf.com/articles/paper/132812.html", "time": "2017-04-25", "level": "金币+12", "num_look": 676718, "num_comment": 5, "author": "威胁猎人", "tags": ["安全报告"], "text": ""}
{"title": "开源的理念做安全：FreeBuf与HackerOne COO王宁对谈安全众测", "url": "https://www.freebuf.com/articles/people/132072.html", "time": "2017-04-25", "level": "红色标题", "num_look": 892659, "num_comment": 6, "author": "欧阳洋葱", "tags": ["人物志", "企业安全"], "text": "HackerOne公司COO王宁是个物理学博士，先后经历了汽车、在线教育、云计算等先后6家初创公司的洗礼，在这样一名多才多艺的COO心里，安全众测究竟是怎样一种存在？"}
{"title": "NSA工具DoublePulsar已入侵数万Windows设备，来看你是否也在其中？", "url": "https://www.freebuf.com/articles/system/133081.html", "time": "2017-04-24", "level": "", "num_look": 899622, "num_comment": 4, "author": "Elaine_z", "tags": ["系统安全"], "text": "Shadow Brokers黑客组织上周泄露了NSA方程式组织的一些工具，其中名为DoublePulsar的后门程序可利用部分Windows系统漏洞进行恶意代码注入及运行。"}
{"title": "追踪、定位、监听一个也不能少：最强悍的监控间谍软件FlexiSPY源码泄露", "url": "https://www.freebuf.com/news/133037.html", "time": "2017-04-24", "level": "红色标题", "num_look": 857017, "num_comment": 13, "author": "Sphinx", "tags": ["资讯"], "text": "4月22日，黑客FlexiDie公布了大量来自监控软件厂商FlexiSPY的文件，泄露的文件包括源码和一些内部文档。"}
{"title": "前程无忧招聘安全工程师", "url": "https://www.freebuf.com/jobs/132270.html", "time": "2017-04-24", "level": "", "num_look": 222420, "num_comment": 12, "author": "night85", "tags": ["安全招聘"], "text": "前程无忧招聘信息安全工程师、安全开发工程师"}
{"title": "利用Pentestbox打造MS17-010移动\"杀器\"", "url": "https://www.freebuf.com/articles/system/132274.html", "time": "2017-04-24", "level": "现金奖励", "num_look": 1346427, "num_comment": 53, "author": "ssooking", "tags": ["系统安全"], "text": "这分享个人的移植过程，以及在使用攻击代码过程中遇到的问题\r\n思利用现成的神器pentestbox，向里添加攻击代码以及其运行需要的python环境"}
{"title": "大数据安全分析的阶段性建设", "url": "https://www.freebuf.com/articles/database/132027.html", "time": "2017-04-24", "level": "金币+12", "num_look": 359286, "num_comment": 359286, "author": "ZenMind", "tags": ["数据安全"], "text": "基于大数据的安全分析在国内已经火了一段时间，不同行业都在这方面有不少的投入，自建的大数据安全平台项目也屡见不鲜。"}
{"title": "网络流量抓取与还原系统Xplico架构", "url": "https://www.freebuf.com/articles/network/132129.html", "time": "2017-04-24", "level": "金币+12", "num_look": 525369, "num_comment": 7, "author": "yirendai_sec", "tags": ["网络安全"], "text": "xplico的目标在于从抓取的网络流量处还原应用中的数据。"}
{"title": "公有云厂商DDoS防护产品竞品分析", "url": "https://www.freebuf.com/articles/network/132239.html", "time": "2017-04-23", "level": "现金奖励", "num_look": 724182, "num_comment": 25, "author": "bt0sea", "tags": ["网络安全", "观点"], "text": "本文首先从数据分析角度上分析抗D安全业务需求。其次站在产品经理的角度上，深度解析市面的云厂商的抗D产品。最后，站在攻击者的角度上看看攻防双方博弈的手段。"}
{"title": "STIX和TAXII：了解国外较成熟的威胁情报标准", "url": "https://www.freebuf.com/news/132148.html", "time": "2017-04-23", "level": "", "num_look": 436114, "num_comment": 2, "author": "米雪儿", "tags": ["资讯"], "text": "情报的传播速度与广泛程度对于复杂性威胁环境来说至关重要，因此，建立一个自动化的、帮助人为分析或执行的快速防御机制就是首要步骤。"}
{"title": "影子经纪人曝光的NSA大杀器可能与Stuxnet相关", "url": "https://www.freebuf.com/articles/system/132363.html", "time": "2017-04-23", "level": "", "num_look": 388939, "num_comment": 1, "author": "clouds", "tags": ["特别企划", "系统安全"], "text": ""}
{"title": "技术流挂马揭秘：Flash广告与Sage2.0勒索软件的“黑金搭档”", "url": "https://www.freebuf.com/articles/web/132430.html", "time": "2017-04-23", "level": "", "num_look": 288323, "num_comment": 3, "author": "360安全", "tags": ["WEB安全"], "text": "360互联网安全中心近期监测到“我爱卡”网站（51credit.com）出现挂马情况，进一步分析发现，访问该网站会加载跳转到漏洞攻击包（Exploit Kit）页面的恶意Flash广告"}
{"title": "如何使用加密的Payload来识别并利用SQL注入漏洞", "url": "https://www.freebuf.com/articles/database/132189.html", "time": "2017-04-23", "level": "金币+6", "num_look": 556891, "num_comment": 13, "author": "Alpha_h4ck", "tags": ["数据安全"], "text": "在这篇文章中，安全教育培训专家SunilYadav将会讨论一个案例，并介绍如何通过一个加密的Payload来发现并利用SQL注入漏洞。"}
{"title": "【FB TV】一周「BUF大事件」：方程式组织黑客工具包曝光持续更新中；无法被检测的Punycode钓鱼攻击；CIA Vault7泄露文档第五波", "url": "https://www.freebuf.com/video/132936.html", "time": "2017-04-22", "level": "红色标题", "num_look": 669316, "num_comment": 5, "author": "supercoco", "tags": ["视频"], "text": "方程式组织黑客工具包“每周推送”；无法被检测的钓鱼攻击；CIA Vault7泄露文档持续更新中。"}
{"title": "如何用Python和Google“自动化”我的婚礼？", "url": "https://www.freebuf.com/geek/132296.html", "time": "2017-04-22", "level": "金币+6", "num_look": 783567, "num_comment": 6, "author": "米雪儿", "tags": ["极客"], "text": ""}
{"title": "这个工具能帮你识别藏在CloudFlare后的真实IP - HatCloud", "url": "https://www.freebuf.com/sectool/132439.html", "time": "2017-04-22", "level": "金币+6", "num_look": 698772, "num_comment": 19, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "另类追踪之被“策反”的安全机制", "url": "https://www.freebuf.com/articles/web/131631.html", "time": "2017-04-22", "level": "", "num_look": 274925, "num_comment": 1, "author": "ArkTeam", "tags": ["WEB安全"], "text": "浏览器各种保障用户安全的策略和限制极可能被心怀不轨的人利用（即被“策反”），来对用户进行追踪，带来更多的隐私泄露问题和其他的安全隐患。"}
{"title": "解析制作俄罗斯APT组织使用的快捷方式后门文件", "url": "https://www.freebuf.com/articles/system/132075.html", "time": "2017-04-21", "level": "", "num_look": 498767, "num_comment": 4, "author": "clouds", "tags": ["系统安全"], "text": "本文中，我将展示如何制作“奇幻熊式”的恶意快捷方式文件（.lnk），通过该.lnk文件生成的恶意程序主体Dropper可应用于渗透测试场景中。"}
{"title": "数十款Linksys路由器曝高危漏洞，可致远程命令执行及敏感信息泄露", "url": "https://www.freebuf.com/news/132831.html", "time": "2017-04-21", "level": "", "num_look": 297352, "num_comment": 2, "author": "Sphinx", "tags": ["资讯"], "text": "来自IOACTIVE的研究人员最近发现了存在于Linksys智能Wifi路由中的漏洞。"}
{"title": "当心，安卓远控（spynote）升级了……", "url": "https://www.freebuf.com/sectool/132023.html", "time": "2017-04-21", "level": "现金奖励", "num_look": 1058361, "num_comment": 90, "author": "永生", "tags": ["工具", "终端安全"], "text": "最近在某国外论坛上流出一款安卓远控spynote3.2版本，以前freebuf上有人发过spynots2.4版的，不过现在已经升级了，功能变得更加强大，危害更严重。"}
{"title": "Triada：一款能够利用沙盒来躲避安全检测的Android木马", "url": "https://www.freebuf.com/news/131614.html", "time": "2017-04-21", "level": "", "num_look": 449049, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["终端安全", "资讯"], "text": "我们认为，利用沙盒来躲避反病毒检测的恶意软件又将掀起新一轮的安全风暴。"}
{"title": "2017年IT界最“吃香”的技能", "url": "https://www.freebuf.com/news/131852.html", "time": "2017-04-21", "level": "金币+6", "num_look": 330950, "num_comment": 7, "author": "Carrie_spinfo", "tags": ["其他", "资讯"], "text": "我们的专家将在本文中向我们介绍2017年最吃香的十大IT技能。"}
{"title": "借鸡生蛋：DNF恶意外挂登陆器分析", "url": "https://www.freebuf.com/articles/terminal/132222.html", "time": "2017-04-21", "level": "现金奖励", "num_look": 315352, "num_comment": 12, "author": "吃荤的驴子", "tags": ["游戏安全", "终端安全"], "text": "有江湖的地方就有纷争，同样有游戏的地方也就有外挂。"}
{"title": "分析开源CMS TYPO3中的News system模块SQL注入漏洞", "url": "https://www.freebuf.com/articles/web/132070.html", "time": "2017-04-21", "level": "", "num_look": 298217, "num_comment": 2, "author": "鸢尾", "tags": ["WEB安全"], "text": "News module是TYPO3中20种最常用的模块之一，爆出存在SQL注入漏洞。尽管作者已经在4个月中多次联系厂商，然而至今没有发布修复方案。只有当模块参数overrideDemand设置为1时漏洞才可用，然而该参数默认值就为1。"}
{"title": "学点算法搞安全之HMM（上篇）", "url": "https://www.freebuf.com/column/132796.html", "time": "2017-04-20", "level": "现金奖励", "num_look": 694762, "num_comment": 22, "author": "兜哥", "tags": ["专栏"], "text": ""}
{"title": "拍拍贷安全招聘高级安全工程师", "url": "https://www.freebuf.com/jobs/132335.html", "time": "2017-04-20", "level": "", "num_look": 212167, "num_comment": 7, "author": "oldtian", "tags": ["安全招聘"], "text": "拍拍贷成立于2007年6月，公司全称为“上海拍拍贷金融信息服务有限公司”，总部位于国际金融中心的上海， 是中国首批网络信息借贷平台。"}
{"title": "两款针对Linux系统Rootkit和恶意软件的有用检测工具", "url": "https://www.freebuf.com/sectool/132164.html", "time": "2017-04-20", "level": "", "num_look": 293125, "num_comment": 2, "author": "clouds", "tags": ["工具"], "text": "如果你的数据中心架设有Linux服务器，尤其是网站服务器，则更应该对Rootkit木马和恶意软件严密防范，因为一些数据破坏类Rootkit非常危险。"}
{"title": "所谓“优酷数据泄露事件”的客观事实还原", "url": "https://www.freebuf.com/articles/database/132434.html", "time": "2017-04-20", "level": "金币+12", "num_look": 599837, "num_comment": 26, "author": "威胁猎人", "tags": ["数据安全", "特别企划"], "text": "17日网络爆出疑似优酷上亿数据泄漏的新闻，标题为《优酷账号密码疯狂泄露！》"}
{"title": "NSA Fuzzbunch分析与利用案例", "url": "https://www.vulbox.com/knowledge/detail/?id=6", "time": "2017-04-20", "level": "", "num_look": 10037, "num_comment": 10037, "author": "漏洞盒子", "tags": ["WEB安全"], "text": "Shadow Brokers泄露出一份震惊世界的机密文档，其中包含了多个 Windows 远程漏洞利用工具。"}
{"title": "【快讯】洲际酒店集团二度遭遇信用卡数据泄露，超过1000家酒店受影响", "url": "https://www.freebuf.com/news/132408.html", "time": "2017-04-20", "level": "", "num_look": 250925, "num_comment": 250925, "author": "kuma", "tags": ["资讯"], "text": "洲际酒店集团上周公布，该集团旗下逾1000家酒店遭遇信用卡数据泄露。"}
{"title": "医疗行业的安全挑战：勒索软件和IoT只是冰山一角", "url": "https://www.freebuf.com/articles/neopoints/131796.html", "time": "2017-04-20", "level": "", "num_look": 275968, "num_comment": 275968, "author": "secist", "tags": ["观点"], "text": "在去年各行各业都遭受了不同程度的勒索软件攻击，而医疗机构则成了这种威胁的重灾区。"}
{"title": "800元打造物理分辨率2K投影仪全攻略", "url": "https://www.freebuf.com/geek/131984.html", "time": "2017-04-20", "level": "现金奖励", "num_look": 1004481, "num_comment": 15, "author": "diigu", "tags": ["极客"], "text": "本文的内容耗费了作者接近一个月的业余时间去收集整理。在此分享给大家，并希望大家去做出改进和建议，避免重复造轮子。"}
{"title": "ShadowBroker释放的NSA工具中Esteemaudit漏洞复现过程", "url": "https://www.freebuf.com/articles/system/132171.html", "time": "2017-04-20", "level": "金币+12", "num_look": 1747979, "num_comment": 37, "author": "zusheng", "tags": ["系统安全"], "text": "近日臭名昭著的方程式组织工具包再次被公开，TheShadowBrokers在steemit.com博客上提供了相关消息。本文是其中Esteemaudit漏洞复现过程。"}
{"title": "近40家Shoney's餐厅信用卡信息泄漏", "url": "https://www.freebuf.com/news/132357.html", "time": "2017-04-19", "level": "", "num_look": 243954, "num_comment": 3, "author": "Elaine_z", "tags": ["资讯"], "text": "4月14日，Best American Hospitality Copr.（BAHC）公司收到一份报告，这份报告指出网络犯罪团伙通过在其PoS系统上植入恶意软件，成功窃取了近40家Shoney's餐厅的信用卡数据——Shoney's是位于田纳西州的全美家庭式餐…"}
{"title": "快速识别重要威胁：威胁情报与SIEM的结合", "url": "https://www.freebuf.com/articles/security-management/131920.html", "time": "2017-04-19", "level": "金币+12", "num_look": 948312, "num_comment": 6, "author": "飞行鸵鸟", "tags": ["企业安全", "安全管理"], "text": "企业如何通过威胁情报平台来增强SIEM/SOC的安全能力，以便更全面的理解威胁、消除误报，形成主动、智能的防御体系。"}
{"title": "新浪安全2017年人才招聘计划", "url": "https://www.freebuf.com/jobs/132190.html", "time": "2017-04-19", "level": "", "num_look": 364577, "num_comment": 23, "author": "-吗_啡-", "tags": ["安全招聘"], "text": "新浪公司是一家服务于中国及全球华人社群的网络媒体公司。新浪帮助广大用户通过互联网和移动设备获得专业媒体和用户自生成的多媒体内容并与友人进行兴趣分享。"}
{"title": "通过手机传感器嗅探用户输入的密码", "url": "https://www.freebuf.com/articles/terminal/131808.html", "time": "2017-04-19", "level": "", "num_look": 320178, "num_comment": 7, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "近期，研究人员发现了一种恶意JavaScript文件。这种恶意JS文件能够在用户毫不知情的情况下在网站或App中悄悄进行加载，进而破解用户的密码或PIN码。"}
{"title": "CIA Vault7泄露文档第五波：多平台入侵植入和管理控制工具HIVE", "url": "https://www.freebuf.com/news/132067.html", "time": "2017-04-19", "level": "金币+12", "num_look": 562485, "num_comment": 6, "author": "CYlar", "tags": ["工具", "网络安全"], "text": "HIVE是一种恶意软件的后端基础架构，该架构利用一个公开的HTTPS接口作掩护，接受来自被CIA的植入系统发出的隐蔽信息和传送控制命令。"}
{"title": "【更新：谷歌修复漏洞，奖励中国专家】一种几乎无法被检测到的Punycode钓鱼攻击，Chrome、Firefox和Opera等浏览器都中招", "url": "https://www.freebuf.com/news/132240.html", "time": "2017-04-19", "level": "金币+12", "num_look": 506544, "num_comment": 11, "author": "米雪儿", "tags": ["WEB安全", "资讯"], "text": "中国信息安全研究人员发现了一款新型的“几乎不可能检测到的”网络钓鱼攻击手段"}
{"title": "YourRansom：一个开源的加(le)密(suo)玩(tao)具(jian)", "url": "https://www.freebuf.com/sectool/131974.html", "time": "2017-04-19", "level": "金币+12", "num_look": 259449, "num_comment": 2, "author": "popu111", "tags": ["工具", "终端安全"], "text": "YourRansom 是使用 Golang 编写的一个加密工具，具有加密参数内置、密钥随机生成、在线下载readme文件等功能。"}
{"title": "专注“钓鱼人防”：安全新星企业PhishMe浅析", "url": "https://www.freebuf.com/news/topnews/130420.html", "time": "2017-04-19", "level": "红色标题", "num_look": 455365, "num_comment": 1, "author": "kuma", "tags": ["头条", "安全报告"], "text": "人类可以是安全防御中最强大的环节，也可以是最薄弱的环节。"}
{"title": "CNNVD关于多个微软产品漏洞的通报", "url": "https://www.freebuf.com/news/132215.html", "time": "2017-04-18", "level": "", "num_look": 468015, "num_comment": 17, "author": "CNNVD", "tags": ["资讯"], "text": ""}
{"title": "看我如何躺在床上黑掉自家智能电视", "url": "https://www.freebuf.com/articles/terminal/131643.html", "time": "2017-04-18", "level": "金币+9", "num_look": 947463, "num_comment": 17, "author": "Alpha_h4ck", "tags": ["极客", "终端安全"], "text": "如果你也是安全从业者，你可能会很渴望测试你平时使用的payload，可以是路由器Web接口的一个GET参数，也可以是你打印机的控制面板，而我遇到的是一台智能电视。"}
{"title": "Webshell密码极速爆破工具 - cheetah", "url": "https://www.freebuf.com/sectool/132096.html", "time": "2017-04-18", "level": "金币+9", "num_look": 736012, "num_comment": 22, "author": "精灵", "tags": ["工具"], "text": "Cheetah的工作原理是能根据自动探测出的web服务设置相关参数一次性提交大量的探测密码进行爆破，爆破效率是其他普通webshell密码暴力破解工具上千倍。"}
{"title": "MySQL曝中间人攻击Riddle漏洞，可致用户名密码泄露", "url": "https://www.freebuf.com/news/132150.html", "time": "2017-04-18", "level": "", "num_look": 517595, "num_comment": 5, "author": "Sphinx", "tags": ["漏洞", "资讯"], "text": "针对MySQL 5.5和5.6版本的Riddle漏洞会经由中间人攻击泄露用户名密码信息。请尽快更新到5.7版本。"}
{"title": "“变脸窃贼”病毒伪装手机应用，私装短信扣费游戏", "url": "https://www.freebuf.com/articles/terminal/131629.html", "time": "2017-04-18", "level": "", "num_look": 251089, "num_comment": 2, "author": "腾讯手机管家", "tags": ["终端安全"], "text": "近期,腾讯反诈骗实验室接到用户反馈，手机突然收到大量扣费短信息。"}
{"title": "基于ShodanPython库的批量攻击实践", "url": "https://www.freebuf.com/sectool/131765.html", "time": "2017-04-18", "level": "金币+9", "num_look": 541002, "num_comment": 18, "author": "gaearrow", "tags": ["工具"], "text": "本文以MSSQL服务器为切入点，以解决批量目标发现为目标，介绍了一种基于Shodan Python库的攻击方法"}
{"title": "OFFICE OLE2LINK（CVE-2017-0199）漏洞利用详解", "url": "https://www.freebuf.com/articles/system/131969.html", "time": "2017-04-18", "level": "金币+9", "num_look": 1000964, "num_comment": 27, "author": "天择实习生", "tags": ["系统安全"], "text": "FireEye最近公布了一个OFFICE 0day，在无需用户交互的情况下，打开word文档就可以通过hta脚本执行任意代码。"}
{"title": "如何用虚拟货币匿名注册域名", "url": "https://www.freebuf.com/articles/web/131500.html", "time": "2017-04-18", "level": "", "num_look": 429636, "num_comment": 4, "author": "ArkTeam", "tags": ["WEB安全"], "text": "本文将简单谈谈虚拟货币在域名注册上的使用。"}
{"title": "Android安全开发之启动私有组件漏洞浅谈", "url": "https://www.freebuf.com/articles/terminal/131356.html", "time": "2017-04-17", "level": "", "num_look": 268396, "num_comment": 5, "author": "阿里聚安全", "tags": ["终端安全"], "text": "android应用中，如果某个组件对外导出，那么这个组件就是一个攻击面，很有可能就存在很多问题，因为攻击者可以以各种方式对该组件进行测试攻击"}
{"title": "Nebula漏洞利用包CVE-2016-0189漏洞利用分析", "url": "https://www.freebuf.com/sectool/131766.html", "time": "2017-04-17", "level": "现金奖励", "num_look": 506477, "num_comment": 3, "author": "兰云科技银河实验室", "tags": ["WEB安全", "工具"], "text": "在最近的一年里， 漏洞利用工具包(EK/Exploit Kit)市场风云变幻。"}
{"title": "网易（杭州）诚招移动端安全人才", "url": "https://www.freebuf.com/jobs/131896.html", "time": "2017-04-17", "level": "", "num_look": 287703, "num_comment": 14, "author": "网易易盾加固", "tags": ["安全招聘"], "text": "网易安全部门负责网易公司游戏、电商、金融、音乐、社交等各类应用的安全工作，在这里您可以了解最新的安全保护趋势和最全的安全护城河。"}
{"title": "如何通过BurpSuite检测Blind XSS漏洞", "url": "https://www.freebuf.com/articles/web/131545.html", "time": "2017-04-17", "level": "", "num_look": 547120, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "看作者如何用BurpSuite Pro搞定法国黑客年度竞赛“Nuit du Hack 2017”资格预赛中的所有Web安全挑战"}
{"title": "Twitter账户活动情况分析工具 - Simple Twitter Profile Analyzer", "url": "https://www.freebuf.com/sectool/131658.html", "time": "2017-04-17", "level": "", "num_look": 304179, "num_comment": 4, "author": "clouds", "tags": ["工具"], "text": "演示一下如何不使用黑客手段，简单地通过他人Twitter账户获取到一些有用的个人信息。"}
{"title": "Phpcms v9漏洞分析", "url": "https://www.freebuf.com/vuls/131809.html", "time": "2017-04-17", "level": "金币+9", "num_look": 654939, "num_comment": 2, "author": "nightmarelee", "tags": ["漏洞"], "text": "最后就采用动态调试&静态分析的方式对漏洞的触发进行分析"}
{"title": "我与支付宝之间的那些事：基于Python与Face++实现人脸识别", "url": "https://www.freebuf.com/articles/terminal/131755.html", "time": "2017-04-17", "level": "现金奖励", "num_look": 1412790, "num_comment": 38, "author": "zw97073966", "tags": ["其他", "极客"], "text": "“眨眨眼”，支付婊这个刷脸的功能估计让大家都给玩坏了，不过支付宝竟然又出了一个让我沉迷于其中，无法自拔的玩物。"}
{"title": "ShadowBroker释放的NSA工具部分（windows）fb.py复现和中招检查方法", "url": "https://www.freebuf.com/sectool/132076.html", "time": "2017-04-16", "level": "现金奖励", "num_look": 1762884, "num_comment": 92, "author": "常运", "tags": ["工具", "系统安全"], "text": "NSA在12年就写出了这样的工具，现在他们有的工具是什么样的？"}
{"title": "东北大学“谛听”网络安全团队：2016-2017年第一季度工业控制网络安全态势白皮书", "url": "https://www.freebuf.com/articles/paper/131812.html", "time": "2017-04-16", "level": "金币+9", "num_look": 993282, "num_comment": 18, "author": "东北大学谛听网络安全团队", "tags": ["安全报告", "工控安全"], "text": "读者可以通过本白皮书对工控系统漏洞、联网工控设备、SCADA系统和安保摄像头的分布及2016年典型工控安全事件的阐述和分析，全面了解工业控制系统安全现状。"}
{"title": "焦点科技诚聘信息安全达人", "url": "https://www.freebuf.com/jobs/131624.html", "time": "2017-04-16", "level": "", "num_look": 196270, "num_comment": 14, "author": "focuachina", "tags": ["安全招聘"], "text": "焦点科技股份有限公司（股票代码：002315），成立于1996年，是国内领先的电子商务服务提供商，也是国内早期A股上市的综合型电子商务平台运营商。"}
{"title": "“短信拦截马”近期活跃，大肆偷取用户钱财", "url": "https://www.freebuf.com/articles/terminal/131501.html", "time": "2017-04-16", "level": "", "num_look": 480745, "num_comment": 6, "author": "瑞星", "tags": ["终端安全"], "text": "近期，“短信拦截马”这个病毒频繁活跃在各大Android平台上，主要以窃取用户隐私为目的，然后利用盗取的用户信息盗刷银行账户、偷取用户财产等"}
{"title": "2017 OWASP Top 10十大安全漏洞候选出炉，你怎么看？", "url": "https://www.freebuf.com/news/131778.html", "time": "2017-04-16", "level": "", "num_look": 837040, "num_comment": 2, "author": "kuma", "tags": ["资讯"], "text": "OWASP近日公布2017 OWASP Top10（十大安全漏洞列表），增加了2个新分类。"}
{"title": "Windows Server 2012 R2的提权过程解析", "url": "https://www.freebuf.com/articles/system/130352.html", "time": "2017-04-16", "level": "", "num_look": 622425, "num_comment": 8, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "从理论上来说，这个漏洞将允许我们利用任意用户权限并通过一个活动会话来在远程桌面服务器中执行payload。"}
{"title": "ShadowBroker是这样放大招的：Windows零日利用工具更多数据呈现", "url": "https://www.freebuf.com/articles/system/132028.html", "time": "2017-04-15", "level": "", "num_look": 712271, "num_comment": 13, "author": "白帽汇", "tags": ["系统安全"], "text": "你知道ShadowBrokers这一波公布的重磅炸弹产生了多大的影响吗？"}
{"title": "ShadowBrokers方程式工具包浅析，揭秘方程式组织工具包的前世今生", "url": "https://www.freebuf.com/sectool/132029.html", "time": "2017-04-15", "level": "", "num_look": 627507, "num_comment": 14, "author": "腾讯云安全", "tags": ["工具", "系统安全"], "text": "方程式组织工具包再次被公开，本次工具包大小为117.9MB，包含23个黑客工具，其中部分文件显示NSA曾入侵中东SWIFT银行系统，详细信息是这样的..."}
{"title": "揭秘Turla APT的转世前身", "url": "https://www.freebuf.com/articles/network/131613.html", "time": "2017-04-15", "level": "", "num_look": 367072, "num_comment": 1, "author": "clouds", "tags": ["网络安全"], "text": "此文阐述了卡巴斯基分析报告中Thomas Rid和相关安全人员对两个攻击组织的关联性分析。"}
{"title": "【突发新闻】“血雨腥风”将至？方程式组织黑客工具包再曝光，大量针对Windows系统严重0day泄露", "url": "https://www.freebuf.com/news/131994.html", "time": "2017-04-15", "level": "红色标题", "num_look": 886229, "num_comment": 30, "author": "Sphinx", "tags": ["头条", "资讯"], "text": "这周我们又迎来了Shadow Brokers的“每周武器推送”！新公布的文件能够攻击Windows系统，并且能够攻击全球数家使用SWIFT系统的银行机构。"}
{"title": "【FB TV】一周「BUF大事件」：NSA方程式有更多黑客工具下载了；Word曝0day漏洞；iOS 10.3.1高危WiFi芯片漏洞", "url": "https://www.freebuf.com/video/131985.html", "time": "2017-04-15", "level": "红色标题", "num_look": 739242, "num_comment": 13, "author": "supercoco", "tags": ["视频"], "text": "又公开了一波NSA黑客工具，可供下载；Word曝0day漏洞，打开文档就自动安装恶意程序；iOS 10.3.1高危WiFi芯片漏洞"}
{"title": "Longhorn黑客组织就来自中情局：CIA已经针对16个国家发起过攻击", "url": "https://www.freebuf.com/articles/network/131741.html", "time": "2017-04-15", "level": "", "num_look": 354762, "num_comment": 4, "author": "Sphinx", "tags": ["网络安全"], "text": "赛门铁克的研究人员发现，Vault 7泄露文件中的工具在之前的攻击中使用过，攻击瞄准了16个国家的40个目标，这个黑客组织当时被赛门铁克命名为Longhorn。"}
{"title": "EasyCTF 2017 Writeup", "url": "https://www.freebuf.com/articles/others-articles/131073.html", "time": "2017-04-15", "level": "金币+20", "num_look": 661196, "num_comment": 9, "author": "精灵", "tags": ["其他"], "text": "EasyCTF高校黑客大赛的精彩解析在这里。"}
{"title": "近期正热的Word 0day漏洞已经被用于恶意软件散播和国家攻击", "url": "https://www.freebuf.com/news/131918.html", "time": "2017-04-14", "level": "", "num_look": 230107, "num_comment": 2, "author": "bimeover", "tags": ["资讯"], "text": "此漏洞曾被网络犯罪者用于传播恶意软件，甚至还有国家支持的间谍组织用于刺探乌克兰亲俄派。"}
{"title": "FreeBuf公开课 |《网络安全法》企业合规", "url": "http://open.freebuf.com/?p=1072", "time": "2017-04-14", "level": "", "num_look": 28383, "num_comment": 28383, "author": "supercoco", "tags": ["FreeBuf公开课"], "text": "你知道企业合规到底该怎么做吗？"}
{"title": "【漏洞预警】Linux 内核 ipv4/udp.c 远程任意代码执行(CVE-2016-10229)", "url": "https://www.freebuf.com/vuls/131907.html", "time": "2017-04-14", "level": "红色标题", "num_look": 523669, "num_comment": 10, "author": "漏洞盒子", "tags": ["漏洞"], "text": "Linux kernel 4.5之前的版本中的udp.c文件存在安全漏洞，Linux内核中的udp.c允许远程攻击者通过UDP流量执行任意代码"}
{"title": "揭秘HTTPS中S的另一面", "url": "https://www.freebuf.com/articles/web/131277.html", "time": "2017-04-14", "level": "", "num_look": 304837, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "就在我们刚刚弄清楚浏览器地址栏中“HTTPS”的重要性时，垃圾邮件发送者和恶意攻击者早就已经知道应该怎么将系统玩弄于股掌之间了。"}
{"title": "如何写一个DNS压力测试工具", "url": "https://www.freebuf.com/sectool/131383.html", "time": "2017-04-14", "level": "金币+20", "num_look": 380996, "num_comment": 7, "author": "黑戈爾", "tags": ["WEB安全", "工具"], "text": "这个压力测试说好听叫压力测试，说不好点那就是DOS攻击，接下来我就说说我进行压力测试的过程吧"}
{"title": "Facebook上一个有趣的CSRF", "url": "https://www.freebuf.com/vuls/131691.html", "time": "2017-04-14", "level": "金币+15", "num_look": 373899, "num_comment": 5, "author": "zusheng", "tags": ["WEB安全", "漏洞"], "text": "Facebook的群组提供了直接从Dropbox账户上传文件的功能，这种功能是使用了OAuth 2.0协议实现的。"}
{"title": "黑客利用Apache Struts 2漏洞在服务器上传递Cerberus勒索软件", "url": "https://www.freebuf.com/news/131445.html", "time": "2017-04-14", "level": "", "num_look": 233178, "num_comment": 2, "author": "bimeover", "tags": ["资讯"], "text": "最近Apache Struts 2 漏洞被网络罪犯用于传递Cerber勒索软件"}
{"title": "验证码安全那些事", "url": "https://www.freebuf.com/news/131542.html", "time": "2017-04-14", "level": "现金奖励", "num_look": 502100, "num_comment": 14, "author": "LionZ", "tags": [], "text": "最近在研究验证码安全，本文主要分析四种流行的验证码（图形，短信，语音和滑动）进行分析"}
{"title": "最具同情心的勒索软件套件Philadelphia", "url": "https://www.freebuf.com/sectool/131502.html", "time": "2017-04-14", "level": "现金奖励", "num_look": 336768, "num_comment": 5, "author": "Voraka", "tags": ["工具", "数据安全"], "text": "打个巴掌，给颗糖？"}
{"title": "深信服科技招聘安全人才", "url": "https://www.freebuf.com/jobs/130465.html", "time": "2017-04-13", "level": "", "num_look": 290809, "num_comment": 16, "author": "suifeng-刘军", "tags": ["安全招聘"], "text": "深信服科技股份是专注于云计算／虚拟化、网络安全领域的IT解决方案服务商，致力于提供创新的IT基础设施云计算、网络安全建设解决方案"}
{"title": "Arduino+Avr libc制作Badusb原理及示例讲解", "url": "https://www.freebuf.com/articles/system/131363.html", "time": "2017-04-13", "level": "现金奖励", "num_look": 722281, "num_comment": 13, "author": "泥壳安全", "tags": ["极客", "系统安全"], "text": "经过一段时间的学习和研究后，笔者希望通过自己的一些心得体会可以帮助其他人更清晰地认识badusb，也希望这篇文章能够起到一定的启发。"}
{"title": "Word漏洞CVE-2017-0199剖析，微软的补丁你装了吗？", "url": "https://www.freebuf.com/vuls/131814.html", "time": "2017-04-13", "level": "金币+15", "num_look": 637145, "num_comment": 16, "author": "Alpha_h4ck", "tags": ["漏洞", "系统安全"], "text": "本周早前FreeBuf也报道了Word的这一漏洞，在无需启用Word宏的情况下，打开恶意RFT文档就可感染恶意程序，这是怎么做到的呢？"}
{"title": "子域名爆破工具 - 啸天犬", "url": "https://www.freebuf.com/sectool/131640.html", "time": "2017-04-13", "level": "金币+15", "num_look": 579606, "num_comment": 21, "author": "心东", "tags": ["工具"], "text": "很多子域名爆破的工具却忽略了一点，就是爆破前没有做过域传送检测，于是作者就开发了一款名叫 啸天犬的工具--主要偏向于域名收集。"}
{"title": "浅析用户行为分析系统（UEBA）", "url": "https://www.freebuf.com/articles/neopoints/131514.html", "time": "2017-04-13", "level": "金币+15", "num_look": 853133, "num_comment": 1, "author": "ZenMind", "tags": ["观点"], "text": "听的多了，就忍不住想说说自己看到的、理解的UEBA，毕竟没有实际在做这样一个产品，错误难免但也希望能给大家一些可供参考的信息。"}
{"title": "Python安全运维实战：针对几种特定隐藏方式的Webshell查杀", "url": "https://www.freebuf.com/articles/web/131350.html", "time": "2017-04-13", "level": "现金奖励", "num_look": 545518, "num_comment": 19, "author": "北门喂猫", "tags": ["WEB安全"], "text": "今天我们要说的就是： 如何利用python实现针对几种特定隐藏方式的webshell查杀。"}
{"title": "说说Powersploit在内网渗透中的使用", "url": "https://www.freebuf.com/sectool/131275.html", "time": "2017-04-13", "level": "金币+15", "num_look": 850282, "num_comment": 24, "author": "smile苦笑", "tags": ["工具", "网络安全"], "text": "powershell + metasploit，双剑合璧，对我们来说在内网渗透中对我们还是有很大的帮助的，可以说是一个巨大的隐藏宝藏！"}
{"title": "调查：渗透测试人员最爱的安全工具及技术", "url": "https://www.freebuf.com/sectool/131550.html", "time": "2017-04-13", "level": "金币+15", "num_look": 559650, "num_comment": 16, "author": "Alpha_h4ck", "tags": ["工具"], "text": ""}
{"title": "看我如何从一个APK到最终拿下域管理权限?", "url": "https://www.freebuf.com/articles/network/131518.html", "time": "2017-04-12", "level": "金币+15", "num_look": 783633, "num_comment": 27, "author": "secist", "tags": ["网络安全"], "text": ""}
{"title": "PowerMeta：通过Google和Bing搜索特定域名上的有价值文件", "url": "https://www.freebuf.com/sectool/131390.html", "time": "2017-04-12", "level": "", "num_look": 270645, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天给大家介绍的是一款名叫PowerMeta的工具，PowerMeta通过整合Google和Bing搜索实现了用户可以随意搜索特定域名中的所有公开文件。"}
{"title": "【周五预告】FreeBuf公开课 | 《网络安全法》企业合规", "url": "https://www.freebuf.com/open/131767.html", "time": "2017-04-12", "level": "红色标题", "num_look": 358813, "num_comment": 1, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "继上期解读《网络安全法》对白帽子的影响后，本期刘春泉律师将继续为大家解读《网络安全法》对企业的影响。"}
{"title": "新手教程：局域网DNS劫持实战", "url": "https://www.freebuf.com/articles/network/131385.html", "time": "2017-04-12", "level": "金币+15", "num_look": 2711110, "num_comment": 33, "author": "sarleon", "tags": ["网络安全"], "text": "本篇文章主要讲解了局域网内的DNS劫持的方法，原理，防范以及撘环境复现"}
{"title": "基于Session的身份窃取", "url": "https://www.freebuf.com/articles/web/131305.html", "time": "2017-04-12", "level": "现金奖励", "num_look": 436299, "num_comment": 17, "author": "ArkTeam", "tags": ["WEB安全"], "text": "有些网站也会将Session保存在Cookie中，以减轻服务器维护Session的压力。"}
{"title": "针对提权小神器Sherlock的分析与利用", "url": "https://www.freebuf.com/sectool/131393.html", "time": "2017-04-12", "level": "现金奖励", "num_look": 464747, "num_comment": 18, "author": "zusheng", "tags": ["工具"], "text": "Sherlock是一个在Windows下用于本地提权的PowerShell脚本。"}
{"title": "极客DIY：如何动手“组装”一个机器人", "url": "https://www.freebuf.com/geek/131270.html", "time": "2017-04-12", "level": "现金奖励", "num_look": 910577, "num_comment": 66, "author": "hyc66", "tags": ["极客"], "text": "一个需要通电才能维持生命的机器人，不叫机器人，应该叫机械。历经半年时间，北极熊作者开始涉足机器人领域。想要通过人工智能，改变这个世界。"}
{"title": "以中国同为数码为目标的恶意程序Amnesia，影响全球各地22.7万台IoT设备", "url": "https://www.freebuf.com/news/131609.html", "time": "2017-04-11", "level": "", "num_look": 264710, "num_comment": 264710, "author": "secist", "tags": ["资讯"], "text": "Amnesia僵尸网络是一种目前发现的较新的僵尸网络，它允许攻击者利用未修补的远程代码执行漏洞攻击其硬盘录像机( DVR )设备。"}
{"title": "VIPKID安全部诚邀各类安全人才", "url": "https://www.freebuf.com/jobs/131633.html", "time": "2017-04-11", "level": "", "num_look": 458364, "num_comment": 14, "author": "VIPKID安全团队", "tags": ["安全招聘"], "text": "VIPKID创立于2013年，是一家专注为5-12岁小朋友提供有效、生动的英语学习体验的互联网在线教育公司。我们的愿景是，帮助孩子插上语言的翅膀，自由行走于这个星球。"}
{"title": "PHPcms9.6.0 最新版任意文件上传漏洞（直接getshell）", "url": "https://www.freebuf.com/vuls/131648.html", "time": "2017-04-11", "level": "现金奖励", "num_look": 1619757, "num_comment": 37, "author": "三少", "tags": ["WEB安全", "漏洞"], "text": "PHPcms9.6.0 最新版任意文件上传漏洞利用方式"}
{"title": "Metasploit、powershell之Windows错误系统配置漏洞实战提权", "url": "https://www.freebuf.com/articles/system/131388.html", "time": "2017-04-11", "level": "现金奖励", "num_look": 545682, "num_comment": 15, "author": "shuteer", "tags": ["系统安全"], "text": "我们在获得目标机一个普通的权限时，除了常规提权方法外，还可以通过查找目标主机错误的系统配置和漏洞来获取系统权限。"}
{"title": "去年盒子承诺的“普吉”兑现了，今年你想去哪里？", "url": "https://www.freebuf.com/news/131659.html", "time": "2017-04-11", "level": "", "num_look": 201161, "num_comment": 2, "author": "漏洞盒子", "tags": ["资讯"], "text": ""}
{"title": "最新Cybersecurity Ventures网络安全500强，都上榜了哪些新公司？", "url": "https://www.freebuf.com/news/130334.html", "time": "2017-04-11", "level": "", "num_look": 475235, "num_comment": 2, "author": "Sphinx", "tags": ["资讯"], "text": "美国投资咨询机构Cybersecurity Ventures发布了2017 Q1的Top 500榜单。今年的榜单中，我们看到一些比较有代表性的几家公司，在此做个简单盘点。"}
{"title": "浅谈拒绝服务攻击的原理与防御（7）：用Python和C实现syn flood攻击", "url": "https://www.freebuf.com/articles/network/130357.html", "time": "2017-04-11", "level": "现金奖励", "num_look": 616260, "num_comment": 16, "author": "黑戈爾", "tags": ["网络安全"], "text": "你们一般用哪种语言写syn flood攻击工具"}
{"title": "如何用Python批量发现互联网“开放”摄像头", "url": "https://www.freebuf.com/articles/terminal/130758.html", "time": "2017-04-11", "level": "金币+20", "num_look": 666107, "num_comment": 18, "author": "diulei", "tags": ["终端安全"], "text": "现在无论家用还是公司使用摄像头越来越多，但是安全性又如何呐？"}
{"title": "企业安全建设之浅谈办公网安全", "url": "https://www.freebuf.com/articles/es/129230.html", "time": "2017-04-11", "level": "现金奖励", "num_look": 551129, "num_comment": 9, "author": "兜哥", "tags": ["企业安全"], "text": "为避免教科书式的理论说教，本文以攻防的角度，以中型互联网公司为例，讨论下办公网安全建设。"}
{"title": "Word曝0day漏洞：无需启用宏，打开文档就自动安装恶意程序", "url": "https://www.freebuf.com/vuls/131586.html", "time": "2017-04-10", "level": "红色标题", "num_look": 904433, "num_comment": 24, "author": "bimeover", "tags": ["漏洞", "系统安全"], "text": "近日，McAfee和FireEye的安全研究人员发现有人在网络上利用Microsoft Office的0-day漏洞悄悄地在他人电脑上执行代码并安装恶意软件。"}
{"title": "什么是集中管控式大数据安全架构？", "url": "https://www.freebuf.com/articles/database/131268.html", "time": "2017-04-10", "level": "", "num_look": 630393, "num_comment": 5, "author": "银伞数据", "tags": ["企业安全", "数据安全"], "text": "当我们说大数据的时候，已不再是单指海量的数据了，而是基础设施(云服务器)、应用、数据源、分析模型、数据存储和平台的组合，正是这些使得大数据安全面临着不同寻常的挑战。"}
{"title": "CIA泄露文档最新曝光：针对Windows系统的网络武器Grasshopper", "url": "https://www.freebuf.com/news/131563.html", "time": "2017-04-10", "level": "金币+20", "num_look": 469299, "num_comment": 4, "author": "clouds", "tags": ["资讯"], "text": "该工具主要针对Windows系统进行入侵控制，是一套具备模块化、扩展化、免杀和持久驻留的恶意软件综合平台。"}
{"title": "IoT DDoS警报系统是如何帮助我们预测网络攻击的？", "url": "https://www.freebuf.com/articles/terminal/131395.html", "time": "2017-04-10", "level": "", "num_look": 285819, "num_comment": 1, "author": "secist", "tags": ["终端安全"], "text": "目前的DDoS攻击通常采用的是放大攻击(PDF)的手段，攻击者的手中往往会掌握大量的‘肉鸡’服务器。今天要介绍的是IoTPOT，一个用于IoT设备的蜜罐。"}
{"title": "利用Hook技术实现浏览器HTTPS劫持", "url": "https://www.freebuf.com/articles/web/131137.html", "time": "2017-04-10", "level": "现金奖励", "num_look": 867027, "num_comment": 41, "author": "浪子_三少", "tags": ["WEB安全"], "text": "由于https有一些隐含的缺陷或者服务器验证的不严格，https被劫持的可能性存在，本文介绍一种浏览器劫持的方法实现https劫持。"}
{"title": "基于ArduinoLeonardo板子的BadUSB攻击实战", "url": "https://www.freebuf.com/articles/terminal/131193.html", "time": "2017-04-10", "level": "现金奖励", "num_look": 767658, "num_comment": 21, "author": "Professor X", "tags": ["系统安全", "终端安全"], "text": "我在学习领悟之后想到了一些改进方案，比如绕过360主动防御，隐藏攻击行为，payload免杀，针对不联网设备攻击等，现分享如下。"}
{"title": "用机器学习玩转恶意URL检测", "url": "https://www.freebuf.com/articles/network/131279.html", "time": "2017-04-10", "level": "现金奖励", "num_look": 1163037, "num_comment": 30, "author": "Anka9080", "tags": ["网络安全"], "text": "趁着小假期对机器学习应用于威胁检测的这块做了些研究整理了下笔记，以方便大家日后交流学习。"}
{"title": "NSA方程式有更多黑客工具下载了！信息量很大，连中国运营商都被入侵过？", "url": "https://www.freebuf.com/news/131531.html", "time": "2017-04-09", "level": "红色标题", "num_look": 1178998, "num_comment": 37, "author": "欧阳洋葱", "tags": ["工具", "资讯"], "text": "ShadowBrokers还记得吗？他们这次放出了价值100万比特币、来自方程式组织的黑客工具！"}
{"title": "谷歌发现了一个潜伏了三年的Android间谍程序", "url": "https://www.freebuf.com/news/131520.html", "time": "2017-04-09", "level": "", "num_look": 313023, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "它不仅可以从手机的聊天软件中窃取用户的隐私数据，还可以通过手机的摄像头和麦克风来监视用户的一举一动。更重要的是，它还可以进行自毁操作。"}
{"title": "攻击者正在利用Dimnie窃取数据恶意软件攻击GitHub项目的拥有者", "url": "https://www.freebuf.com/news/131278.html", "time": "2017-04-09", "level": "", "num_look": 202382, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "安全研究专家发现，自从今年的一月中旬起，就有攻击者开始利用数据窃取型恶意软件Dimnie来攻击GitHub代码库的所有者了，而这种攻击方法相对来说并没有多少人真正了解。"}
{"title": "“无文件”恶意软件的威力：悄无声息一夜之间从ATM机中窃取80万美元", "url": "https://www.freebuf.com/news/131216.html", "time": "2017-04-09", "level": "", "num_look": 317340, "num_comment": 17, "author": "Sphinx", "tags": ["终端安全", "资讯"], "text": "黑客将目标瞄准了俄罗斯的至少8台ATM，然后在一晚窃取了80万美元。监控显示一个黑客走向ATM机，甚至都没有触碰机器就把现金取了出来。"}
{"title": "网络悍匪劫持巴西网银长达5小时，数百万用户中招", "url": "https://www.freebuf.com/news/131344.html", "time": "2017-04-08", "level": "", "num_look": 232682, "num_comment": 4, "author": "bimeover", "tags": ["资讯"], "text": "他们劫持了一家巴西银行的DNS并将所有的网上银行业务指向伪造的页面，从中获取受害者的信用卡信息。"}
{"title": "提高Linux安全性：14项检查建立安全的Linux服务器", "url": "https://www.freebuf.com/articles/system/131188.html", "time": "2017-04-08", "level": "金币+15", "num_look": 387435, "num_comment": 9, "author": "Enming0924", "tags": ["系统安全"], "text": "Linux安全性有哪些值得改进的地方？这些建议可能对你有帮助。"}
{"title": "任性！三星产品操作系统Tizen被曝存在40多个0day漏洞", "url": "https://www.freebuf.com/news/131364.html", "time": "2017-04-07", "level": "", "num_look": 342185, "num_comment": 3, "author": "clouds", "tags": ["漏洞", "资讯"], "text": "三星产品主流操作系统Tizen存在40多个0-day漏洞，这些漏洞能让黑客非常容易远程攻击和控制三星设备，Neiderman也计划陆续公布这些漏洞。"}
{"title": "八百元八核的服务器？二手服务器（工作站）搭建指南（下）", "url": "https://www.freebuf.com/geek/131151.html", "time": "2017-04-07", "level": "现金奖励", "num_look": 1328846, "num_comment": 61, "author": "Push丶EAX", "tags": ["极客"], "text": "在上一部分我们已经学习了搭建二手服务器的基础知识，这部分，我们将深入学习各种配件的详细参数、选择适合的配置、学习搭建八百元八核的服务器。"}
{"title": "如何使用Ruby构建FTP密码破解器", "url": "https://www.freebuf.com/sectool/131201.html", "time": "2017-04-07", "level": "", "num_look": 269096, "num_comment": 8, "author": "secist", "tags": ["工具"], "text": "这篇文章我将带大家利用Ruby，来构建我们自己的FTP密码破解器。"}
{"title": "【思路分享】如何在Win下查杀Linux恶意文件", "url": "https://www.freebuf.com/articles/system/131077.html", "time": "2017-04-07", "level": "金币+15", "num_look": 391198, "num_comment": 23, "author": "noosec", "tags": ["系统安全"], "text": "如果先使用windows平台下的杀毒软件，去查杀linux文件的话，那效果是会强上一个等级，下面我们就来介绍下如何在windows下查杀linux系统文件的方法，提供一种思路。"}
{"title": "芯片安全漫谈：内置加密芯片的金立M6，真的是“最安全”的手机吗？", "url": "https://www.freebuf.com/articles/terminal/130992.html", "time": "2017-04-07", "level": "红色标题", "num_look": 876268, "num_comment": 33, "author": "欧阳洋葱", "tags": ["数据安全", "特别企划"], "text": "离FreeBuf编辑部不远的地铁站口最近一直贴着金立M6的广告，每天都挥之不去“内置加密安全芯片”宣传词，这手机真的很安全吗？"}
{"title": "太平保险集团共享中心信息安全岗位招聘", "url": "https://www.freebuf.com/jobs/126623.html", "time": "2017-04-06", "level": "", "num_look": 366482, "num_comment": 19, "author": "孙毛毛", "tags": ["安全招聘"], "text": "中国太平保险集团共享服务中心隶属于中国保险行业第一家跨国综合保险金融集团——中国太平保险集团"}
{"title": "Java AMF3曝远程代码执行漏洞", "url": "https://www.freebuf.com/vuls/131335.html", "time": "2017-04-06", "level": "金币+6", "num_look": 554118, "num_comment": 13, "author": "clouds", "tags": ["漏洞"], "text": "德国安全团队@codewhitesec发现了Java AMF3的多个功能实现漏洞，美国CERT/CC也发出了安全预警。"}
{"title": "瑞星劫持浏览器主页分析", "url": "https://www.freebuf.com/articles/web/131156.html", "time": "2017-04-06", "level": "金币+6", "num_look": 637894, "num_comment": 57, "author": "GATA", "tags": ["WEB安全", "系统安全"], "text": "通过在服务进程中监控进程启动，替换浏览器的窗口来劫持主页，可以避免与主页保护软件的正面对抗，达到劫持效果，思路令人佩服。"}
{"title": "看我如何在渗透测试过程中发现并利用Serv-U漏洞进行操作系统提权", "url": "https://www.freebuf.com/articles/system/131170.html", "time": "2017-04-06", "level": "金币+6", "num_look": 686799, "num_comment": 23, "author": "clouds", "tags": ["系统安全"], "text": "最近发现了SolarWinds文件共享程序Serv-U的一个漏洞，通过该漏洞我获得了Serv-U的管理权限，并能以系统用户身份执行远程代码，成功完成操作系统提权。"}
{"title": "iOS 10.3.1修复的那个WiFi芯片漏洞，也影响到了数百万Android手机", "url": "https://www.freebuf.com/news/131295.html", "time": "2017-04-06", "level": "", "num_look": 343684, "num_comment": 15, "author": "kuma", "tags": ["资讯"], "text": "数百万采用博通WiFi芯片的智能手机和智能设备，包括苹果iOS设备和众多品牌的Android设备都可能通过无线被劫持"}
{"title": "Linux下密码抓取神器mimipenguin发布", "url": "https://www.freebuf.com/sectool/131165.html", "time": "2017-04-06", "level": "金币+6", "num_look": 677210, "num_comment": 51, "author": "zusheng", "tags": ["工具"], "text": "只要借用一下电脑，便可轻松拿到密码……“女神，借用电脑一看可否？”"}
{"title": "通过结构化异常处理绕过CFG", "url": "https://www.freebuf.com/articles/system/131032.html", "time": "2017-04-06", "level": "", "num_look": 292731, "num_comment": 1, "author": "金乌实验室", "tags": ["系统安全"], "text": "这篇文章讲述的技术是基于泄漏栈地址并覆盖结构化异常处理程序，将use-after-free转换为结构化异常处理程序覆盖，从而绕过CFG。"}
{"title": "基于Wifipineapple对无线安全情况的综合性调查与研究", "url": "https://www.freebuf.com/articles/wireless/130355.html", "time": "2017-04-06", "level": "现金奖励", "num_look": 628998, "num_comment": 41, "author": "AuroraLab", "tags": ["无线安全"], "text": "用WiFi菠萝模拟“钓鱼Wi-Fi”的实验和数据采集"}
{"title": "Android系统20万美元入侵计划无人问津，研究人员称奖金太少", "url": "https://www.freebuf.com/news/131128.html", "time": "2017-04-05", "level": "", "num_look": 256825, "num_comment": 3, "author": "secist", "tags": ["资讯"], "text": "Google发布了一项针对Android系统的入侵奖金计划，令人尴尬的是，该奖金计划至今无人问津。"}
{"title": "学点算法搞安全之SVM", "url": "https://www.freebuf.com/articles/web/130004.html", "time": "2017-04-05", "level": "现金奖励", "num_look": 814668, "num_comment": 36, "author": "兜哥", "tags": ["WEB安全", "其他"], "text": "介绍安全领域经常用到的机器学习模型，从入门级别的SVM、贝叶斯等到HMM、神经网络和深度学习。"}
{"title": "2017中国网络安全技术对抗赛，FreeBuf全程媒体支持", "url": "https://www.freebuf.com/fevents/131206.html", "time": "2017-04-05", "level": "", "num_look": 396238, "num_comment": 4, "author": "CNCERT", "tags": ["活动"], "text": "CNCERT联合国内多家知名安全企业提供真实安全大数据，选定特定安全场景，面向全国优秀数据科学人才与网络安全人才征集优秀解决方案，期待你的参与！"}
{"title": "绿盟科技招聘安全技术经理", "url": "https://www.freebuf.com/jobs/130856.html", "time": "2017-04-05", "level": "", "num_look": 372415, "num_comment": 40, "author": "yiyuxuan2009", "tags": ["安全招聘"], "text": "绿盟科技招聘安全技术经理"}
{"title": "“简易下水道”：偷跑流量恶意软件分析", "url": "https://www.freebuf.com/articles/system/130899.html", "time": "2017-04-05", "level": "金币+6", "num_look": 364587, "num_comment": 4, "author": "吃荤的驴子", "tags": ["系统安全", "网络安全"], "text": "笔者搜集了部分相关资料，通过对易语言程序结构的学习，分析了一款刷流量的恶意软件。"}
{"title": "关于39美刀的八大热门在线黑客学习课程合集说明", "url": "https://www.freebuf.com/articles/others-articles/130622.html", "time": "2017-04-05", "level": "金币+6", "num_look": 1333774, "num_comment": 69, "author": "lone", "tags": ["FreeBuf公开课", "其他"], "text": "相信各位老司机和实习司机特别关注老美的黑客教程长什么样子"}
{"title": "那些年我们一起守护的“密”", "url": "https://www.freebuf.com/articles/database/130521.html", "time": "2017-04-05", "level": "现金奖励", "num_look": 497484, "num_comment": 18, "author": "追影人", "tags": ["数据安全", "特别企划"], "text": "本文讨论数字加密技术的基本原理、分类、应用以及一些思考，内容较为朴实，请大牛酌情观看。"}
{"title": "Weevely命令传输分析", "url": "https://www.freebuf.com/sectool/130560.html", "time": "2017-04-04", "level": "现金奖励", "num_look": 296201, "num_comment": 1, "author": "codingm3", "tags": ["工具"], "text": "Weevely是一款使用python编写的webshell工具，集webshell生成和连接于一身，可以算作是linux下的一款菜刀替代工具。"}
{"title": "看我如何窃取Messenger.com用户登录认证随机数并获得15000美元漏洞赏金", "url": "https://www.freebuf.com/articles/web/130603.html", "time": "2017-04-04", "level": "", "num_look": 506440, "num_comment": 8, "author": "clouds", "tags": ["WEB安全"], "text": "由于随机数为用户生成了访问messenger.com的会话cookie，这种机制可能会让当前已登入的Facebook用户构造恶意随机数（nonce）和URL，使访问发生跳转。"}
{"title": "在线恶意软件和URL分析集成框架 - MalSub", "url": "https://www.freebuf.com/sectool/130199.html", "time": "2017-04-03", "level": "", "num_look": 334718, "num_comment": 334718, "author": "secist", "tags": ["工具"], "text": "该框架适用于恶意软件分析师，渗透测试人员、安全爱好者从业者，你值得拥有！"}
{"title": "Chrome浏览器上显示绿色标识，你就安全了吗？", "url": "https://www.freebuf.com/articles/database/130914.html", "time": "2017-04-02", "level": "", "num_look": 385880, "num_comment": 5, "author": "secist", "tags": ["数据安全"], "text": "下面，我将带大家深入分析和探讨这个问题，并提出我的解决方案。"}
{"title": "如何用最小的代价完成爬虫需求", "url": "https://www.freebuf.com/articles/web/130291.html", "time": "2017-04-02", "level": "", "num_look": 484124, "num_comment": 8, "author": "岂安科技", "tags": ["WEB安全"], "text": "开发爬虫项目多了后，自然而然的会面对一个问题"}
{"title": "【FB TV】一周「BUF大事件」：IIS 6.0曝远程代码执行漏洞；LastPass再曝高危漏洞；CNNVD有关58同城简历泄露事件的通报", "url": "https://www.freebuf.com/video/131106.html", "time": "2017-04-02", "level": "红色标题", "num_look": 625538, "num_comment": 3, "author": "supercoco", "tags": ["视频"], "text": "IIS 6.0曝出远程代码执行漏洞；LastPass新漏洞，可被窃取用户密码；传闻“700元可采集58同城网站全国简历信息”。"}
{"title": "【原创连载小说】《杀手》第二章：黑夜来临", "url": "https://www.freebuf.com/articles/others-articles/130353.html", "time": "2017-04-02", "level": "现金奖励", "num_look": 270031, "num_comment": 14, "author": "kill47", "tags": ["其他", "特别企划"], "text": "生命的短暂犹如露珠消散，人们在奔波中探寻答案。命运如同大海起伏不定，键盘在黑夜中吟唱悲歌。"}
{"title": "Vault 7泄露第三弹：CIA在恶意程序源码中插入外语，嫁祸中国、俄罗斯等国", "url": "https://www.freebuf.com/news/131048.html", "time": "2017-04-01", "level": "红色标题", "num_look": 528608, "num_comment": 15, "author": "kuma", "tags": ["资讯"], "text": "昨天，维基解密又公布Vault7系列数百份文件，曝光CIA如何将自己发起的攻击伪装成来自俄罗斯、中国、朝鲜和伊朗等其他国家。"}
{"title": "FreeTalk安全沙龙•北京站 演议题征集", "url": "https://www.freebuf.com/fevents/130918.html", "time": "2017-04-01", "level": "", "num_look": 298679, "num_comment": 8, "author": "FB客服", "tags": ["活动"], "text": "只要你的议题与信息安全相关，具备一定的技术含量、经验或思路能够令人耳目一新，你就有机会被邀请到FreeTalk进行分享。"}
{"title": "新型智能电视攻击，90%电视设备受影响！？", "url": "https://www.freebuf.com/news/130900.html", "time": "2017-04-01", "level": "", "num_look": 306604, "num_comment": 4, "author": "clouds", "tags": ["终端安全", "资讯"], "text": "研究员分享了一种针对智能电视的新型攻击方法。"}
{"title": "端点保护的那些事儿：盘点国外流行EDR产品", "url": "https://www.freebuf.com/articles/terminal/131024.html", "time": "2017-04-01", "level": "", "num_look": 698808, "num_comment": 2, "author": "Carrie_spinfo", "tags": ["系统安全", "终端安全"], "text": "近两年，EDR（端点检测与响应）产品在全球信息安全行业中的热度居高不下。"}
{"title": "唯品会品骏控股有限公司招聘信息安全大牛", "url": "https://www.freebuf.com/jobs/130260.html", "time": "2017-04-01", "level": "", "num_look": 246767, "num_comment": 12, "author": "黄惠红", "tags": ["安全招聘"], "text": "傲娇的品牌，呆萌的价格"}
{"title": "“洗碗机”被曝目录穿越漏洞，物联网安全正越来越糟？", "url": "https://www.freebuf.com/news/130561.html", "time": "2017-04-01", "level": "", "num_look": 275646, "num_comment": 2, "author": "孙毛毛", "tags": ["资讯"], "text": "虽然物联网设备的数量呈指数增加，但是这些智能装置的安全等级却没有随之提升，用户依然面临较高的网络攻击风险。"}
{"title": "自动化中间人攻击工具subterfuge小实验", "url": "https://www.freebuf.com/sectool/130456.html", "time": "2017-04-01", "level": "金币+12", "num_look": 577596, "num_comment": 22, "author": "test124", "tags": ["工具"], "text": "Subterfuge是一款用python写的中间人攻击框架，它集成了一个前端和收集了一些著名的可用于中间人攻击的安全工具。"}
{"title": "我的泪水你不懂：企业安全工作落地的一些经验", "url": "https://www.freebuf.com/articles/neopoints/130984.html", "time": "2017-04-01", "level": "金币+12", "num_look": 862870, "num_comment": 48, "author": "猫猫", "tags": ["企业安全", "观点"], "text": "今天分享的是我司的安全制度落地过程中的一些经验。"}
{"title": "【已结束】FreeBuf公开课直播间 |《网络安全法》对白帽子的影响", "url": "http://open.freebuf.com/original/1052.html", "time": "2017-03-31", "level": "红色标题", "num_look": 17070, "num_comment": 17070, "author": "supercoco", "tags": ["视频"], "text": "今年的6月1日，对我们安全圈来说不仅仅是儿童节,它还有另一个重要的意义：《中华人民共和国网络安全法》将在这一天正式施行。"}
{"title": "一种结合了点击劫持、Self-XSS、复制粘贴劫持的新型XSS攻击", "url": "https://www.freebuf.com/articles/web/130462.html", "time": "2017-03-31", "level": "", "num_look": 464338, "num_comment": 9, "author": "bimeover", "tags": ["WEB安全"], "text": "XSS劫持需要其他三种技术配合使用，分别是点击劫持，粘贴劫持以及Self-XSS，甚至还需要一些社会工程学的帮助"}
{"title": "运营商在打击DDoS攻击上有”不容推卸“的责任", "url": "https://www.freebuf.com/articles/neopoints/127807.html", "time": "2017-03-31", "level": "", "num_look": 338641, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["观点"], "text": "在美国，如果你的电脑被黑了，那么这个名叫Dale Drew的人多多少少肯定知道一些内幕。"}
{"title": "京东信息安全部2017年人才招聘", "url": "https://www.freebuf.com/jobs/130773.html", "time": "2017-03-31", "level": "", "num_look": 444324, "num_comment": 16, "author": "京东", "tags": ["安全招聘"], "text": "京东安全应急响应中心现诚意招聘各类人才。"}
{"title": "我们聚集了一批精英白帽子，然后把他们带出了国……", "url": "https://www.freebuf.com/fevents/130768.html", "time": "2017-03-31", "level": "红色标题", "num_look": 486229, "num_comment": 18, "author": "漏洞盒子", "tags": ["活动"], "text": "今年是泰国，明年是哪里？"}
{"title": "有关Cisco IOS&IOS XE Software CMP安全漏洞情况的通报", "url": "https://www.freebuf.com/news/130874.html", "time": "2017-03-31", "level": "", "num_look": 373581, "num_comment": 373581, "author": "CNNVD", "tags": ["漏洞", "资讯"], "text": "该漏洞允许未授权的攻击者执行任意代码、提升权限、重启设备等。国家信息安全漏洞库（CNNVD）对此进行了跟踪分析。"}
{"title": "【新手科普】盘点常见的Web后门", "url": "https://www.freebuf.com/sectool/130526.html", "time": "2017-03-31", "level": "金币+15", "num_look": 740825, "num_comment": 54, "author": "你会忘了我", "tags": ["工具"], "text": "在对一个web站点进行渗透测试的渗透攻击阶段，一般会想办法突破上传限制，向目标可执行目录中写入一个带有攻击性质的脚本来协助获取更大的服务器权限"}
{"title": "如何绕过Win8、Win10的systemsetting与注册表校验设置默认浏览器", "url": "https://www.freebuf.com/articles/system/130288.html", "time": "2017-03-31", "level": "现金奖励", "num_look": 531861, "num_comment": 22, "author": "浪子_三少", "tags": ["系统安全"], "text": "本文就以当下最流行的操作系统win10为例分析下,我们在设置默认浏览器一般会 操作"}
{"title": "智能模糊测试工具Peach Fuzzer官方文档翻译", "url": "https://www.freebuf.com/sectool/130191.html", "time": "2017-03-31", "level": "金币+15", "num_look": 537444, "num_comment": 23, "author": "xiao白鸽", "tags": ["工具"], "text": "作者勤勤恳恳翻译了Peach Fuzzer81页的官方文档"}
{"title": "利用背景流量数据（contexual flow data） 识别TLS加密恶意流量", "url": "https://www.freebuf.com/articles/database/130139.html", "time": "2017-03-30", "level": "", "num_look": 509321, "num_comment": 2, "author": "ArkTeam", "tags": ["数据安全", "网络安全"], "text": "本文就该检测方法进行简要描述，主要参照思科在AISec’16发表的文章"}
{"title": "【周五预告】FreeBuf公开课 | 《网络安全法》对白帽子的影响", "url": "https://www.freebuf.com/video/130785.html", "time": "2017-03-30", "level": "红色标题", "num_look": 616007, "num_comment": 2, "author": "FB客服", "tags": ["FreeBuf公开课", "视频"], "text": "结合相关法律法规及实例，深度解读《网络安全法》对白帽子的影响。"}
{"title": "企业安全漏洞通告引擎", "url": "https://www.freebuf.com/sectool/130605.html", "time": "2017-03-30", "level": "现金奖励", "num_look": 455708, "num_comment": 19, "author": "ripz", "tags": ["企业安全", "工具"], "text": "如今大多数企业都在用漏洞扫描+漏洞通告，但让甲方运维人员从中找到有用的信息，真是异常耗时耗力。"}
{"title": "深信服在引进绝对高端安全人才", "url": "https://www.freebuf.com/jobs/130231.html", "time": "2017-03-30", "level": "", "num_look": 310947, "num_comment": 18, "author": "suifeng-刘军", "tags": ["安全招聘"], "text": "深信服科技成立于2000年，是中国最大的新网络产品供应商，致力于提供基于创新网络的产品及解决方案."}
{"title": "通过BSSID和无线流量传输后门Payload", "url": "https://www.freebuf.com/articles/wireless/130149.html", "time": "2017-03-30", "level": "", "num_look": 595983, "num_comment": 17, "author": "华为未然实验室", "tags": ["无线安全"], "text": "本文将探讨无线接入点（AP）和BSSID（MAC地址AP）"}
{"title": "你的Safari浏览器被“锁”了吗？千万别付赎金，升级iOS 10.3即可", "url": "https://www.freebuf.com/news/130689.html", "time": "2017-03-30", "level": "", "num_look": 364983, "num_comment": 10, "author": "bimeover", "tags": ["终端安全", "资讯"], "text": "3月27日，苹果公司发布iOS 10.3更新，本次更新包括对移动端Safari对JavaScript弹出窗口的处理方式的改变。"}
{"title": "深度：大数据分析公司Palantir如何帮助NSA和他的伙伴们监控全球", "url": "https://www.freebuf.com/news/130358.html", "time": "2017-03-30", "level": "", "num_look": 573833, "num_comment": 573833, "author": "clouds", "tags": ["安全报告", "特别企划"], "text": "据Theintercept网秘密获取的一批文档显示，Palantir一直致力于推动NSA和其国际合作伙伴的全球信息收集网络建设"}
{"title": "成人网站PornHub跨站脚本（XSS）漏洞挖掘记", "url": "https://www.freebuf.com/news/129863.html", "time": "2017-03-30", "level": "金币+8", "num_look": 802083, "num_comment": 24, "author": "Alpha_h4ck", "tags": ["WEB安全", "资讯"], "text": "我在15分钟之内就发现了第一个漏洞，而在几分钟之后我又找出了第二个漏洞。在我整个挖洞生涯中，我从来没有以这么快的速度挖出过漏洞，所以我觉得非常的激动！"}
{"title": "【课后回顾】企业安全建设之使用开源软件建设大规模WAF集群（内含公开课视频）", "url": "https://www.freebuf.com/video/127713.html", "time": "2017-03-29", "level": "现金奖励", "num_look": 808460, "num_comment": 4, "author": "兜哥", "tags": ["FreeBuf公开课", "企业安全"], "text": "本文结合实战经验讲述如何使用开源软件搭建大规模WAF集群"}
{"title": "为什么黑帽黑产，总是领先于安全专家？", "url": "https://www.freebuf.com/articles/neopoints/129921.html", "time": "2017-03-29", "level": "金币+8", "num_look": 492502, "num_comment": 27, "author": "secist", "tags": ["观点"], "text": "为什么黑帽黑客总是在安全技术领域领先于IT安全专家？这是一个值得我们深思的问题。下面我将从这个角度，带大家深入探讨这个问题。"}
{"title": "八百元八核的服务器？二手服务器搭建指南", "url": "https://www.freebuf.com/geek/130366.html", "time": "2017-03-29", "level": "现金奖励", "num_look": 1847026, "num_comment": 73, "author": "Push丶EAX", "tags": ["极客"], "text": "当你在花近万元剁手i7 5960x时，有没有想过在华强北的某个角落，有一群人靠几百块收来的二手服务器配件搭建了一台性能同等的服务器！"}
{"title": "蔚来NIO招聘信息安全架构师", "url": "https://www.freebuf.com/jobs/130005.html", "time": "2017-03-29", "level": "", "num_look": 239610, "num_comment": 14, "author": "Imayday", "tags": ["安全招聘"], "text": "手上有个信息安全架构师的岗位，欢迎有兴趣的小白OR小伙伴骚扰。"}
{"title": "ossim之添加资产全方法", "url": "https://www.freebuf.com/sectool/130008.html", "time": "2017-03-29", "level": "金币+8", "num_look": 324559, "num_comment": 11, "author": "R00to1", "tags": ["工具"], "text": "OSSIM即开源安全信息管理系统(OPEN SOURCE SECURITY INFORMATION MANAGEMENT)，是一个非常流行和完整的开源安全架构体系。"}
{"title": "开源自动化信息收集工具SpiderFoot", "url": "https://www.freebuf.com/sectool/130007.html", "time": "2017-03-29", "level": "", "num_look": 608405, "num_comment": 4, "author": "secist", "tags": ["工具"], "text": "SpiderFoot是一个Python编写的免费开源的网站信息收集类工具，并且支持跨平台运行，适用于Linux、*BSD和Windows系统。"}
{"title": "你从哪里来？从弹窗广告发现“全家桶”的惊人秘密", "url": "https://www.freebuf.com/articles/system/130226.html", "time": "2017-03-29", "level": "金币+8", "num_look": 681414, "num_comment": 51, "author": "布袋和尚", "tags": ["系统安全"], "text": "以前听说过各种“全家桶”，但本来以为只有小白才会中招，没想到自己作为曾经混过安全圈的“业内人士”竟然也失陷了"}
{"title": "Winnti组织是如何利用GitHub来进行C＆C通信的", "url": "https://www.freebuf.com/articles/network/130351.html", "time": "2017-03-29", "level": "", "num_look": 427653, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "近期，安全研究人员发现，一个名叫Winnti的黑客组织把GitHub变成了一个用来跟后门进行C&C远程通信的工具"}
{"title": "如何通过SQL注入获取服务器本地文件", "url": "https://www.freebuf.com/articles/web/130061.html", "time": "2017-03-29", "level": "", "num_look": 506750, "num_comment": 10, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "所以在这篇文章中，我将会给大家讲解这个SQL注入漏洞。实际上，这个漏洞是PHP文件下载函数中的一个本地文件泄露漏洞"}
{"title": "【实验】如何本地搭建Struts2框架对S2-045漏洞进行利用", "url": "https://www.freebuf.com/articles/web/130478.html", "time": "2017-03-28", "level": "金币+8", "num_look": 594465, "num_comment": 14, "author": "青离", "tags": ["WEB安全"], "text": "本教程将介绍如何本地搭建Struts2框架对S2-045漏洞进行利用。"}
{"title": "IoT设备程序开发及编译环境搭建初体验", "url": "https://www.freebuf.com/sectool/130091.html", "time": "2017-03-28", "level": "现金奖励", "num_look": 409655, "num_comment": 3, "author": "scu-igroup", "tags": ["工具", "终端安全"], "text": "本文在对Mirai的源码研究的基础上，实现了一个比较简单的IoT设备开发编译环境。"}
{"title": "涉嫌入侵雅虎的俄罗斯黑客Alexsey Belan常用渗透手段（TTPs）", "url": "https://www.freebuf.com/news/130209.html", "time": "2017-03-28", "level": "", "num_look": 417289, "num_comment": 8, "author": "clouds", "tags": ["资讯"], "text": "M4g就是最近FBI披露参与雅虎数据窃取的黑客Alexsey Belan，他是黑客界的数据窃取老手，也是2013年FBI十大网络通缉犯之一，而且还涉嫌参与去年俄罗斯针对美国大选干预攻击事件，曾被美国司法部四次公开起诉通缉。"}
{"title": "上海前隆金融招聘安全专家", "url": "https://www.freebuf.com/jobs/130136.html", "time": "2017-03-28", "level": "", "num_look": 270584, "num_comment": 6, "author": "SixSixSix", "tags": ["安全招聘"], "text": "上海前隆金融信息服务有限公司是国内首批投身移动互联网金融领域的企业，也是被批核的上海网络信贷会员机构成员。"}
{"title": "【漏洞预警】IIS 6.0曝远程代码执行漏洞CVE-2017-7269", "url": "https://www.freebuf.com/vuls/130531.html", "time": "2017-03-28", "level": "红色标题", "num_look": 1261479, "num_comment": 59, "author": "kuma", "tags": ["漏洞"], "text": "IIS 6.0刚刚被曝存在缓冲区溢出漏洞，可致远程代码执行。该漏洞自2016年7、8月起就已被利用。"}
{"title": "小心！国内的恶意软件正在用伪基站传播Android恶意软件", "url": "https://www.freebuf.com/news/130066.html", "time": "2017-03-28", "level": "", "num_look": 318573, "num_comment": 5, "author": "米雪儿", "tags": ["终端安全", "资讯"], "text": "中国的恶意软件开发者正在使用伪基站（BTS）发送包含Android恶意软件链接的恶意短信。"}
{"title": "反混淆：恢复被OLLVM保护的程序", "url": "https://www.freebuf.com/articles/terminal/130142.html", "time": "2017-03-28", "level": "现金奖励", "num_look": 1017373, "num_comment": 30, "author": "安全豹", "tags": ["系统安全", "终端安全"], "text": "本文展示了如何使用Miasm逆向工程框架来突破所有的保护。"}
{"title": "如何在开放无线网络中嗅探校园网密码", "url": "https://www.freebuf.com/articles/network/129721.html", "time": "2017-03-28", "level": "现金奖励", "num_look": 853804, "num_comment": 28, "author": "addadd", "tags": ["网络安全"], "text": "一个在无线校园网中嗅探校园网账号密码的小程序"}
{"title": "北极熊扫描器4.4企业版发布", "url": "https://www.freebuf.com/sectool/129919.html", "time": "2017-03-27", "level": "金币+8", "num_look": 937165, "num_comment": 69, "author": "hyc66", "tags": ["工具"], "text": "软件已经开发了差不多4年了,2013年中旬至今，没想到竟然积攒了那么多的围观群众耶？！"}
{"title": "八大热门在线黑客学习课程合集：八合一仅售39美元", "url": "https://www.freebuf.com/news/129666.html", "time": "2017-03-27", "level": "金币+8", "num_look": 1662407, "num_comment": 374, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "现在，整个安全行业给白帽黑客提供了大量的工作岗位，如果你缺乏这方面经验或技术的话，你可以通过一些优秀的计算机黑客教程来提高你在信息安全方面的能力。"}
{"title": "同花顺信息安全部招聘web安全工程师", "url": "https://www.freebuf.com/jobs/130178.html", "time": "2017-03-27", "level": "", "num_look": 322026, "num_comment": 21, "author": "THSecurityTeam", "tags": ["安全招聘"], "text": "同花顺信息安全部招聘web安全工程师"}
{"title": "浅谈拒绝服务攻击的原理与防御（5）：NTP反射攻击复现", "url": "https://www.freebuf.com/articles/network/129288.html", "time": "2017-03-27", "level": "现金奖励", "num_look": 646712, "num_comment": 25, "author": "黑戈爾", "tags": ["网络安全"], "text": "本文详细讲述了作者和stream一起复现NTP反射攻击的过程。"}
{"title": "次世代SIEM？IBM眼中的SOAPA", "url": "https://www.freebuf.com/articles/security-management/129450.html", "time": "2017-03-27", "level": "", "num_look": 964912, "num_comment": 2, "author": "米雪儿", "tags": ["企业安全", "安全管理"], "text": "在本次针对IBM 安全部总经理Marc van Zadelhoff的采访中，我们主要对SOAPA的需求、驱动力及其规模等内容进行了探讨。"}
{"title": "浅析国内指纹识别技术（附带小工具）", "url": "https://www.freebuf.com/articles/web/129939.html", "time": "2017-03-27", "level": "现金奖励", "num_look": 1281200, "num_comment": 31, "author": "金乌实验室", "tags": ["WEB安全"], "text": "web指纹识别方法及分析"}
{"title": "MITM渗透工具Bettercap源码分析", "url": "https://www.freebuf.com/sectool/130040.html", "time": "2017-03-27", "level": "现金奖励", "num_look": 387989, "num_comment": 13, "author": "Elie", "tags": ["工具"], "text": "BetterCAP是一个强大，灵活和可移植的工具，用来为执行各种网络类型的MITM攻击，实时操纵HTTP，HTTPS和TCP流量，嗅探凭据等等。"}
{"title": "Facebook反垃圾实践：人工治理与机器算法齐飞", "url": "https://www.freebuf.com/articles/database/129870.html", "time": "2017-03-26", "level": "金币+8", "num_look": 400418, "num_comment": 400418, "author": "heather", "tags": ["企业安全", "数据安全"], "text": "垃圾信息在不断变化，Facebook的反垃圾策略和技术系统也在不断升级。"}
{"title": "【密码学分析】为什么要用BLAKE2替换SHA-1？", "url": "https://www.freebuf.com/articles/database/129260.html", "time": "2017-03-26", "level": "", "num_look": 510042, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["数据安全", "观点"], "text": "如果要代替SHA-1的话，我推荐BLAKE2"}
{"title": "一种会话劫持技术通杀全部Windows版本，但这真的是漏洞吗...", "url": "https://www.freebuf.com/articles/system/129927.html", "time": "2017-03-26", "level": "", "num_look": 377643, "num_comment": 5, "author": "kuma", "tags": ["系统安全"], "text": "以色列安全研究员Alexander Korznikov在个人博客中披露，本地高权限用户可以劫持任何已登录Windows用户会话"}
{"title": "HTTP认证的底层技术简析与揭秘", "url": "https://www.freebuf.com/articles/web/129527.html", "time": "2017-03-26", "level": "", "num_look": 425145, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "这篇文章中，我们将会跟大家详细讨论一下HTTP认证所采用的技术和标准。"}
{"title": "内网漫游之如何使用JavaScript在路由器上执行任意代码", "url": "https://www.freebuf.com/articles/web/129677.html", "time": "2017-03-26", "level": "", "num_look": 347414, "num_comment": 2, "author": "secist", "tags": ["WEB安全"], "text": "在浏览器中运行的网页也可以向本地网络中的Web服务器发起请求。如果这些Web服务器存有漏洞，只需在浏览器中运行相应的代码，就可以利用这些漏洞。"}
{"title": "SHA1碰撞衍生出的BitErrant攻击", "url": "https://www.freebuf.com/articles/system/129166.html", "time": "2017-03-25", "level": "", "num_look": 298431, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "本文将给大家介绍BitErrant攻击，这是由SHA1碰撞衍生出来的一种攻击技术，当SHA1碰撞成为现实，一切皆有可能发生。"}
{"title": "采用端点检测和响应（EDR）解决方案前，你需要了解这10个问题", "url": "https://www.freebuf.com/articles/terminal/129800.html", "time": "2017-03-25", "level": "", "num_look": 585780, "num_comment": 585780, "author": "米雪儿", "tags": ["终端安全", "观点"], "text": "EDR工具通常会记录大量端点和网络事件，然后使用已知的攻击指示器、行为分析和机器学习技术的数据库来持续搜索数据，在早期检测出漏洞并对这些攻击做出快速响应。"}
{"title": "【事件预警】CNNVD有关58同城简历泄露事件的通报", "url": "https://www.freebuf.com/news/130299.html", "time": "2017-03-25", "level": "", "num_look": 353277, "num_comment": 18, "author": "CNNVD", "tags": ["资讯"], "text": "互联网上出现大量爬虫软件，可采集58同城网站全国430多个城市的简历数据。"}
{"title": "【FB TV】一周「BUF大事件」：Apache Struts2再曝远程代码执行漏洞；维基解密放出第二波Vualt 7资料；中国伪基站传播Android恶意软件", "url": "https://www.freebuf.com/video/130333.html", "time": "2017-03-25", "level": "红色标题", "num_look": 571546, "num_comment": 2, "author": "supercoco", "tags": ["视频"], "text": ""}
{"title": "攻击者正在利用Windows的0 day漏洞攻击北美地区100多家企业", "url": "https://www.freebuf.com/news/129862.html", "time": "2017-03-25", "level": "", "num_look": 247145, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["系统安全", "资讯"], "text": "很多以经济利益为目的的黑客团伙变得越来越复杂，而有些犯罪团伙的技术水平已经达到了国家黑客的高度。"}
{"title": "【已结束】FreeBuf公开课直播间 | 企业安全建设之使用开源软件搭建大规模WAF集群", "url": "http://open.freebuf.com/live?id=1021", "time": "2017-03-24", "level": "红色标题", "num_look": 41051, "num_comment": 41051, "author": "supercoco", "tags": ["FreeBuf公开课", "视频"], "text": "今晚8点，兜哥开讲，敬请期待！"}
{"title": "CIA泄露文档第二弹“Dark Matter”：刚出厂的iPhone就感染恶意程序", "url": "https://www.freebuf.com/news/130261.html", "time": "2017-03-24", "level": "红色标题", "num_look": 540219, "num_comment": 7, "author": "Sphinx", "tags": ["资讯"], "text": "维基解密发布第二波Vault 7泄露文件。这波名为“暗物质”的泄露文件中详尽揭露了CIA用来攻击苹果设备的工具。"}
{"title": "“cerber”敲诈者对CVE-2016-7255漏洞利用分析", "url": "https://www.freebuf.com/vuls/130113.html", "time": "2017-03-24", "level": "", "num_look": 369557, "num_comment": 13, "author": "360安全", "tags": ["漏洞", "系统安全"], "text": "Ceber敲诈者木马的新变种利用CVE-2016-7255权限提升漏洞对自身进行提权。本文将分析该敲诈者对CVE-2016-7255权限提升漏洞的利用过程。"}
{"title": "看我如何发现Github企业版程序远程代码执行漏洞并获取18000美元赏金", "url": "https://www.freebuf.com/articles/web/129718.html", "time": "2017-03-24", "level": "", "num_look": 349868, "num_comment": 5, "author": "clouds", "tags": ["WEB安全"], "text": "前有通过Github企业版SQL注入漏洞获得5000美元漏洞赏金的先例，今天我再来深挖深挖深挖......，看看能否发现其它漏洞。"}
{"title": "【周五预告】FreeBuf公开课直播间 | 企业安全建设之使用开源软件搭建大规模WAF集群", "url": "https://www.freebuf.com/video/129957.html", "time": "2017-03-24", "level": "红色标题", "num_look": 697302, "num_comment": 17, "author": "FB客服", "tags": ["企业安全", "活动"], "text": "本次公开课将结合实战经验，讲述如何使用开源软件搭建大规模WAF集群。为了更有通用性，部分自研模块使用了开源组件代替。"}
{"title": "你瞅啥？沈阳汉林科技招人了", "url": "https://www.freebuf.com/jobs/129777.html", "time": "2017-03-24", "level": "", "num_look": 318503, "num_comment": 27, "author": "Dreamdroid", "tags": ["安全招聘"], "text": "沈阳汉林科技诚招安全服务工程师、安全渗透测试工程师"}
{"title": "疯狂的身份证：一张身份证如何攻破人脸识别技术", "url": "https://www.freebuf.com/articles/others-articles/129889.html", "time": "2017-03-24", "level": "现金奖励", "num_look": 1285550, "num_comment": 8, "author": "守护者观察", "tags": ["其他", "数据安全"], "text": "央视“315”晚会曝光了人脸识别领域的安全风险之后，一时间引起广泛关注。其实，绕过人脸识别策略的黑产自去年就开始出现。"}
{"title": "企业安全建设之浅谈数据防泄露", "url": "https://www.freebuf.com/articles/security-management/128491.html", "time": "2017-03-24", "level": "现金奖励", "num_look": 978687, "num_comment": 13, "author": "兜哥", "tags": ["企业安全", "安全管理"], "text": "数据防泄露在每个公司都是很头疼的事情，大大小小的泄露事件也总是不期而至。本文结合我的使用经验从使用的层面介绍常见的数据防泄露技术手段。"}
{"title": "AWS常见安全问题汇总", "url": "https://www.freebuf.com/articles/system/129667.html", "time": "2017-03-24", "level": "现金奖励", "num_look": 458771, "num_comment": 1, "author": "c0debreak", "tags": ["系统安全", "网络安全"], "text": "前段时间看到一个CTF: flaws.cloud，它展示了AWS和S3一些常见的安全问题"}
{"title": "LastPass密码管理器再曝严重漏洞，基于浏览器的密码管理器还能用吗？", "url": "https://www.freebuf.com/news/130073.html", "time": "2017-03-23", "level": "", "num_look": 333196, "num_comment": 4, "author": "米雪儿", "tags": ["漏洞", "资讯"], "text": "安全人员最近发现在 LastPass Chrome 和 Firefox 4.1.42 版本插件中存在三个漏洞，可能会导致用户在使用该组件的过程中泄露密码。"}
{"title": "【干货梳理】Vault7文档曝光的那些CIA网络武器", "url": "https://www.freebuf.com/news/129569.html", "time": "2017-03-23", "level": "", "num_look": 689910, "num_comment": 16, "author": "clouds", "tags": ["特别企划", "资讯"], "text": "让我们随着Freebuf一起来走近CIA的网络军火库"}
{"title": "平安金融壹账通招聘信息安全高级工程师", "url": "https://www.freebuf.com/jobs/130018.html", "time": "2017-03-23", "level": "", "num_look": 267618, "num_comment": 5, "author": "欧阳洋葱", "tags": ["安全招聘"], "text": "平安金融壹账通是中国平安（保险）集团股份有限公司旗下重要成员，前身为2011年7月创立的深圳平安金融科技咨询有限公司。"}
{"title": "PHP网站渗透中的奇技淫巧：检查相等时的漏洞", "url": "https://www.freebuf.com/articles/web/129607.html", "time": "2017-03-23", "level": "现金奖励", "num_look": 804210, "num_comment": 23, "author": "sarleon", "tags": ["WEB安全"], "text": "弱类型，一些方便的特性由于新手程序员的不当使用，造成了一些漏洞，这篇文章就来介绍一下一些渗透中可以用的特性。"}
{"title": "JSShell：一个基于python的交互式Shell", "url": "https://www.freebuf.com/sectool/129164.html", "time": "2017-03-23", "level": "", "num_look": 351302, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具"], "text": "本文将给大家介绍一款基于Web的多用户交互式Shell"}
{"title": "[更新苹果官方回应]苹果公司遭遇黑客组织勒索：不付赎金就曝光或抹除3亿iCloud账户信息", "url": "https://www.freebuf.com/news/130118.html", "time": "2017-03-23", "level": "", "num_look": 222604, "num_comment": 5, "author": "kuma", "tags": ["资讯"], "text": "你是苹果用户吗？你用iCloud同步信息吗？那么你危险了！"}
{"title": "iOS App的加固保护原理", "url": "https://www.freebuf.com/articles/terminal/129640.html", "time": "2017-03-23", "level": "", "num_look": 606811, "num_comment": 20, "author": "网易易盾加固", "tags": ["终端安全"], "text": "本文通过讲解iOS APP的破解分析过程来引出我们要如何的保护我们的应用。"}
{"title": "Linux提权：从入门到放弃", "url": "https://www.freebuf.com/articles/system/129549.html", "time": "2017-03-23", "level": "现金奖励", "num_look": 1492442, "num_comment": 30, "author": "piece of the past", "tags": ["系统安全"], "text": "本文总结了一些Linux系统提权方法"}
{"title": "微软Application Verifier曝0day漏洞，影响趋势科技、卡巴斯基、赛门铁克在内的大量安全产品", "url": "https://www.freebuf.com/vuls/130075.html", "time": "2017-03-22", "level": "", "num_look": 384551, "num_comment": 15, "author": "bimeover", "tags": ["漏洞"], "text": "多家安全厂商受到影响，包括Avast，AVG，Avira，Bitdefender，趋势科技，Comodo科摩多，ESET，F-Secure，卡巴斯基，Malwarebytes，McAfee，Panda，Quick Heal和赛门铁克（Norton）。"}
{"title": "暗战：闪存产品数据安全攻防", "url": "https://www.freebuf.com/articles/database/129650.html", "time": "2017-03-22", "level": "现金奖励", "num_look": 296077, "num_comment": 4, "author": "tgfreebuf", "tags": ["数据安全"], "text": "随着闪存产品运用的日渐普及，围绕它的恢复和销毁的安全探讨也日益增多，在本文中我们尝试加以解析。"}
{"title": "简便的邮箱账户搜集工具Infoga", "url": "https://www.freebuf.com/sectool/129189.html", "time": "2017-03-22", "level": "", "num_look": 368446, "num_comment": 12, "author": "Carrie_spinfo", "tags": ["工具"], "text": "Infoga是一款能够在搜索引擎（Google、Bing、Shodan）和PGP密钥服务器等多种公共资源中搜集邮箱账户的工具。"}
{"title": "Vault 7泄露文档后续：思科针对某个影响到300款交换机的漏洞发出预警", "url": "https://www.freebuf.com/news/129920.html", "time": "2017-03-22", "level": "", "num_look": 310654, "num_comment": 2, "author": "孙毛毛", "tags": ["漏洞", "特别企划"], "text": "CIA Vault7泄露事件余温未过，思科专家就发现其IOS与IOS XE软件集群管理协议存在远程代码执行漏洞。"}
{"title": "微信电影票诚聘安全工程师", "url": "https://www.freebuf.com/jobs/129857.html", "time": "2017-03-22", "level": "", "num_look": 256779, "num_comment": 9, "author": "manchester", "tags": ["安全招聘"], "text": "北京微影时代科技有限公司是基于移动社交的电影、演出、体育等文化娱乐营销与发行平台，是移动互联网时代文化娱乐产业与用户之间的“连接者”。"}
{"title": "数字取证技术 ：Windows内存信息提取", "url": "https://www.freebuf.com/articles/system/129463.html", "time": "2017-03-22", "level": "现金奖励", "num_look": 597761, "num_comment": 17, "author": "Cunlin", "tags": ["系统安全"], "text": "攻击技术贴多如牛毛，眼下不管是网安，还是安全厂商， 欠缺的是对取证技术的研究。"}
{"title": "钓鱼引发的APT攻击回溯：C&C服务器位于韩国，whois注册却在中国上海", "url": "https://www.freebuf.com/news/129845.html", "time": "2017-03-22", "level": "", "num_look": 275752, "num_comment": 10, "author": "bimeover", "tags": ["资讯"], "text": "本文将介绍他是如何发现这种隐匿极深的APT攻击回溯之旅。"}
{"title": "如何利用sdclt磁盘备份工具绕过UAC", "url": "https://www.freebuf.com/sectool/129579.html", "time": "2017-03-22", "level": "金币+15", "num_look": 322623, "num_comment": 9, "author": "c0debreak", "tags": ["工具", "系统安全"], "text": "sdclt 是微软提供的命令行磁盘备份工具，从 Vista 时代引入"}
{"title": "渗透测试中利用基于时间差反馈的远程代码执行漏洞（Timed Based RCE）进行数据获取", "url": "https://www.freebuf.com/articles/web/129045.html", "time": "2017-03-22", "level": "", "num_look": 319666, "num_comment": 7, "author": "clouds", "tags": ["WEB安全"], "text": "以下是测试过程中的相关思路整理，仅供借鉴参考（渗透测试最终利用工具请移步GitHub-TBDEx）。"}
{"title": "【漏洞预警】GitLab曝高危漏洞，可致private token等敏感信息泄露", "url": "https://www.freebuf.com/vuls/129906.html", "time": "2017-03-21", "level": "", "num_look": 386930, "num_comment": 2, "author": "Sphinx", "tags": ["漏洞"], "text": "GitLab于近日发布了8.17.4、8.16.8和8.15.8版本（社区版和企业版），修复多个漏洞，包括一个可导致token泄露的高危漏洞。"}
{"title": "SSH端口转发情景模拟", "url": "https://www.freebuf.com/articles/network/129434.html", "time": "2017-03-21", "level": "", "num_look": 621728, "num_comment": 14, "author": "yirendai_sec", "tags": ["网络安全"], "text": "SSH端口转发能够将其他TCP端口的网络数据通过SSH链接来转发，并且自动提供了相应的加密及解密服务。"}
{"title": "2015与2016年度物联网威胁比较研究：全球受攻击的IoT设备呈指数级增长", "url": "https://www.freebuf.com/articles/terminal/129290.html", "time": "2017-03-21", "level": "金币+13", "num_look": 377187, "num_comment": 2, "author": "TITI", "tags": ["安全报告", "终端安全"], "text": "如果物联网制造商不能确保其设备的绝对安全，对数字经济的潜在影响将是毁灭性的。"}
{"title": "浙江华城技术研究所诚聘信息安全工程师", "url": "https://www.freebuf.com/jobs/129573.html", "time": "2017-03-21", "level": "", "num_look": 261566, "num_comment": 8, "author": "一觉睡到自然醒", "tags": ["安全招聘"], "text": "浙江华城技术研究所诚聘Windows逆向工程师、Android逆向工程师"}
{"title": "【漏洞预警】Apache Struts2再曝远程代码执行漏洞（S2-046 附PoC）", "url": "https://www.freebuf.com/vuls/129871.html", "time": "2017-03-21", "level": "红色标题", "num_look": 849173, "num_comment": 24, "author": "Sphinx", "tags": ["漏洞"], "text": "该漏洞与S2-045 (CVE-2017-5638)相似，但使用了不同的攻击向量。"}
{"title": "研究人员打造可攻陷英特尔SGX硬件安全保护的恶意软件", "url": "https://www.freebuf.com/articles/system/129492.html", "time": "2017-03-21", "level": "", "num_look": 353427, "num_comment": 3, "author": "米雪儿", "tags": ["系统安全"], "text": "2015年，英特尔在发表Skylake处理器平台时推出了SGX，但是相信现在仍然有一些人对SGX的概念有些困惑。那么我们就先对SGX的概念进行简单介绍："}
{"title": "如何配置Linux下的OSSIM-HIDS", "url": "https://www.freebuf.com/sectool/129298.html", "time": "2017-03-21", "level": "现金奖励", "num_look": 405598, "num_comment": 2, "author": "R00to1", "tags": ["工具"], "text": "OSSIM中的HIDS是通过OSSEC来实现的，OSSEC采用服务端和客户端模式，主要通过文件完整性监视，日志监视，rootcheck和进程监视来主动监视Unix系统活动的所有方面。"}
{"title": "我是如何获取全域用户明文密码的？", "url": "https://www.freebuf.com/articles/system/129412.html", "time": "2017-03-21", "level": "现金奖励", "num_look": 523939, "num_comment": 20, "author": "c0debreak", "tags": ["系统安全"], "text": "当我们按下 CTRL + ALT + DEL，修改用户密码时，在 Windows 服务器端，会发生什么呢？"}
{"title": "小心！黑客可以通过声波对你的智能手机和汽车发动攻击了", "url": "https://www.freebuf.com/news/129587.html", "time": "2017-03-20", "level": "", "num_look": 504565, "num_comment": 4, "author": "secist", "tags": ["终端安全", "资讯"], "text": "攻击者只需通过一个售价便宜的便携式扬声器，就能向加速计发送虚假读数，实现对智能手机、汽车以及物联网（IoT）设备的简单控制。"}
{"title": "从遭遇“艳照门2.0”的“赫敏”谈个人隐私保护", "url": "https://www.freebuf.com/news/129689.html", "time": "2017-03-20", "level": "", "num_look": 324972, "num_comment": 9, "author": "Carrie_spinfo", "tags": ["资讯"], "text": "三年前好莱坞的艳照门事件掀起轩然大波后，“艳照门2.0”又来临了"}
{"title": "代码安全、无线攻防、逻辑漏洞与白帽子普法：FreeTalk上海站新鲜速递（附PPT下载地址）", "url": "https://www.freebuf.com/fevents/129723.html", "time": "2017-03-20", "level": "", "num_look": 377762, "num_comment": 11, "author": "kuma", "tags": ["活动"], "text": "3月的上海春雨蒙蒙，2017年第一场FreeTalk就在这样一个午后开始了！"}
{"title": "【重磅】FreeBuf发布2017金融行业应用安全态势报告", "url": "https://www.freebuf.com/news/topnews/128874.html", "time": "2017-03-20", "level": "红色标题", "num_look": 964960, "num_comment": 24, "author": "FreeBuf咨询", "tags": ["头条", "安全报告"], "text": "FreeBuf安全研究院期望和合作伙伴一起，借由金融行业应用安全态势报告来反映该行业在应用安全等方面的现状和趋势。"}
{"title": "Mega木马分析报告", "url": "https://www.freebuf.com/articles/system/129387.html", "time": "2017-03-20", "level": "现金奖励", "num_look": 459410, "num_comment": 12, "author": "兰云科技银河实验室", "tags": ["安全报告", "系统安全"], "text": "Mega木马通过多种手段判断沙箱、虚拟机和杀软来对抗目标环境的安全机制，保证自身能在不在被发现的的情况下运行。"}
{"title": "一种用于在Python字节码中嵌入Payload的隐写工具 - Stegosaurus", "url": "https://www.freebuf.com/sectool/129357.html", "time": "2017-03-20", "level": "", "num_look": 415663, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["工具"], "text": "今天介绍的Stegosaurus是一款隐写工具，可用于在Python字节码文件（pyc或pyo）中嵌入任意Payload"}
{"title": "谈谈软件供应链污染", "url": "https://www.freebuf.com/special/129231.html", "time": "2017-03-20", "level": "现金奖励", "num_look": 351173, "num_comment": 4, "author": "ArkTeam", "tags": ["特别企划"], "text": "是否还记得2015年XcodeGhost事件？软件供应链污染又是怎样一回事？"}
{"title": "美国交通部对Shadow IT的安全管理启示录", "url": "https://www.freebuf.com/news/128149.html", "time": "2017-03-19", "level": "", "num_look": 539895, "num_comment": 539895, "author": "Alpha_h4ck", "tags": ["安全管理", "资讯"], "text": ""}
{"title": "【已结束】FreeTalk安全沙龙上海站图文直播", "url": "https://www.freebuf.com/fevents/129669.html", "time": "2017-03-19", "level": "红色标题", "num_look": 834767, "num_comment": 7, "author": "Sphinx", "tags": ["活动"], "text": "FreeTalk是互联网安全新媒体FreeBuf（FreeBuf.COM）主办的品牌沙龙活动，是全国各地安全爱好者的线下聚会。“Free” 意为 FreeBuf开办以来一直坚持的自由分享精神，也意味着活动完全免费。"}
{"title": "电网遭受攻击停电怎么办？DARPA斥资860万美元计划打造电网攻击预警系统", "url": "https://www.freebuf.com/news/129435.html", "time": "2017-03-19", "level": "", "num_look": 300049, "num_comment": 2, "author": "bimeover", "tags": ["网络安全", "资讯"], "text": "DARPA钦定BAE Systems来加快网络开发的进程，这将有助于在恶意网络攻击后恢复电网。"}
{"title": "湖南金盾、长沙雨人招聘安全岗位", "url": "https://www.freebuf.com/jobs/129178.html", "time": "2017-03-19", "level": "", "num_look": 279058, "num_comment": 27, "author": "湖南省金盾信息安全等级保护评估中心有限公司", "tags": ["安全招聘"], "text": "湖南金盾是湖南省内第一家通过等级测评机构能力评估的第三方测评机构；长沙雨人是一家专注于网络与信息安全服务的专业型IT公司。"}
{"title": "360极速浏览器和360chrome首页设置加密算法", "url": "https://www.freebuf.com/articles/terminal/128902.html", "time": "2017-03-19", "level": "金币+18", "num_look": 347650, "num_comment": 15, "author": "浪子_三少", "tags": ["终端安全"], "text": "现在越来越多厂家劫持用户的浏览器首页，本文将给出关于360浏览器主页设置算法的一些分析"}
{"title": "【FreeBuf公开课】FIT 2017大会精选现已上架FreeBuf公开课", "url": "http://open.freebuf.com/category/original", "time": "2017-03-19", "level": "红色标题", "num_look": 26953, "num_comment": 26953, "author": "supercoco", "tags": ["FreeBuf公开课", "视频"], "text": "你们期待的FIT 2017大会议题精选，终于剪好了……"}
{"title": "【FB TV】一周「BUF大事件」：传闻“京东内鬼泄露50亿条公民信息”；Struts S2-045漏洞影响还在扩大；雅虎5亿账户泄露事件真相", "url": "https://www.freebuf.com/video/129652.html", "time": "2017-03-18", "level": "红色标题", "num_look": 521742, "num_comment": 3, "author": "supercoco", "tags": ["视频"], "text": "“京东内鬼泄露 50 亿条公民信息”传闻从何而来；Struts S2-045漏洞严重程度大；“雅虎5亿账户泄露”的真相原来是这样。"}
{"title": "郑州向心力通信技术股份有限公司2017春季招聘渗透工程师", "url": "https://www.freebuf.com/jobs/128665.html", "time": "2017-03-18", "level": "", "num_look": 252069, "num_comment": 20, "author": "ziluobu", "tags": ["安全招聘"], "text": "向心力业务范围涵盖中国及海外多个国家,公司的成长见证和浓缩了中国电信服务运营市场的发展轨迹，积累了丰富的行业经验，培养了数百名技术专家。"}
{"title": "CIA远程入侵汽车能力细思极恐：4年前美国记者的那场车祸是意外还是人为？", "url": "https://www.freebuf.com/news/129352.html", "time": "2017-03-18", "level": "", "num_look": 246159, "num_comment": 6, "author": "cxt", "tags": ["资讯"], "text": "黑客远程操控车辆的技术是否真的会被某些机构用来策划暗杀？"}
{"title": "安全团队应理解攻击面，更好地分配资金投入", "url": "https://www.freebuf.com/articles/es/129346.html", "time": "2017-03-18", "level": "", "num_look": 347559, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["企业安全"], "text": "攻击面在不断变化，我们该如何更好分配企业在信息安全方面投入的资金并尽可能防御网络攻击？"}
{"title": "【原创连载小说】《杀手》第一章：网络杀手", "url": "https://www.freebuf.com/articles/others-articles/129253.html", "time": "2017-03-18", "level": "现金奖励", "num_look": 653590, "num_comment": 57, "author": "kill47", "tags": ["其他"], "text": "杀手是在生活中受到雇主的雇佣，而去执行杀人任务，最终获得报酬。他们孤独，不轻易相信其他任何的人。他们非常冷酷，面对生命，他们从来不会手下留情。"}
{"title": "针对银行钓鱼事件的分析", "url": "https://www.freebuf.com/articles/web/129079.html", "time": "2017-03-18", "level": "", "num_look": 310896, "num_comment": 4, "author": "secist", "tags": ["WEB安全"], "text": "钓鱼邮件不少人都收到过，本文将简单选取一则银行钓鱼邮件一探究竟"}
{"title": "雅虎5亿账户泄露案真相谍影重重：2名俄罗斯特工+2名黑客", "url": "https://www.freebuf.com/news/129529.html", "time": "2017-03-17", "level": "红色标题", "num_look": 297249, "num_comment": 10, "author": "kuma", "tags": ["资讯"], "text": "雅虎说对了，还真是俄罗斯人干的！"}
{"title": "震惊！你可能下了个假的抢红包神器", "url": "https://www.freebuf.com/articles/terminal/129481.html", "time": "2017-03-17", "level": "", "num_look": 435548, "num_comment": 10, "author": "AVLTeam", "tags": ["终端安全"], "text": "安天移动安全团队和小米MIUI监控数据显示，仿冒抢红包病毒出现的数量和终端感染量在今年1月份出现巨大的增长。"}
{"title": "潜伏7年的Linux内核漏洞CVE-2017-2636曝光，可本地提权", "url": "https://www.freebuf.com/articles/system/129608.html", "time": "2017-03-17", "level": "", "num_look": 634372, "num_comment": 15, "author": "Sphinx", "tags": ["系统安全"], "text": "又一个古老的Linux内核漏洞被曝光！这次的漏洞可以追溯到2009年，影响的linux发行版包括Red Hat、Debian、Fedora、OpenSUSE和Ubuntu。"}
{"title": "Pwn2Own赛况追踪：中国战队连下几城，Edge、Safari、Ubuntu相继遭秒破", "url": "https://www.freebuf.com/news/129585.html", "time": "2017-03-17", "level": "", "num_look": 252005, "num_comment": 9, "author": "欧阳洋葱", "tags": ["资讯"], "text": "今年的Pwn2Own大赛最耀眼的似乎依然是来自中国的几个安全团队。"}
{"title": "凡普金科招聘高级安全工程师——高速成长期的金融科技公司", "url": "https://www.freebuf.com/jobs/129289.html", "time": "2017-03-17", "level": "", "num_look": 306336, "num_comment": 6, "author": "金融科技", "tags": ["安全招聘"], "text": "凡普互金是一家金融科技公司，专注于大数据处理和金融科技研发，用科技缩短人和金融服务的距离，促进金融服务平等化，努力践行普惠金融。"}
{"title": "绕过DVWA所有安全级别的XSS Payload", "url": "https://www.freebuf.com/articles/web/129308.html", "time": "2017-03-17", "level": "", "num_look": 805592, "num_comment": 14, "author": "secist", "tags": ["WEB安全"], "text": "这里我将以DVWA平台为例，向大家展示如何绕过该平台下XSS漏洞（存储和反射型）的，所有安全级别过滤。"}
{"title": "挖矿木马ddg分析", "url": "https://www.freebuf.com/articles/system/129262.html", "time": "2017-03-17", "level": "", "num_look": 506728, "num_comment": 6, "author": "乐视安全应急响应中心", "tags": ["系统安全"], "text": "近年来go语言火热，一些恶意软件也闻风而起，然而go程序在编译过程中集成了大量的基础库，并且不同版本格式也存在较大差异，给逆向带来不小的阻力。"}
{"title": "网络空间搜索引擎全方位评测", "url": "https://www.freebuf.com/sectool/129211.html", "time": "2017-03-17", "level": "", "num_look": 816505, "num_comment": 11, "author": "水熊科技", "tags": ["工具", "特别企划"], "text": "如果说GPS绘制出了世界的地图，那么网络空间搜索引擎就是整个互联网的地图。"}
{"title": "最纯干货！FreeTalk上海站观众报名开启啦（3月19日）", "url": "https://www.freebuf.com/fevents/128539.html", "time": "2017-03-16", "level": "红色标题", "num_look": 457949, "num_comment": 24, "author": "FB客服", "tags": ["活动"], "text": "FreeTalk是互联网安全新媒体FreeBuf（FreeBuf.COM）主办的品牌沙龙活动，是全国各地安全爱好者的线下聚会。"}
{"title": "美国52GB个人身份信息泄露：国防部、沃尔玛、花旗集团等都未能幸免", "url": "https://www.freebuf.com/news/129553.html", "time": "2017-03-16", "level": "", "num_look": 680408, "num_comment": 17, "author": "cxt", "tags": ["企业安全", "资讯"], "text": "这下又一大批私人信息被一锅端了..."}
{"title": "【快讯】好莱坞艳照门2.0！艾玛·沃森等女星隐私照片遭泄", "url": "https://www.freebuf.com/news/129528.html", "time": "2017-03-16", "level": "金币+5", "num_look": 5831639, "num_comment": 45, "author": "米雪儿", "tags": ["头条", "资讯"], "text": "近日又发生一起女星私照大规模泄露事件，照片目前正在美国知名论坛4chan和Reddit上疯传，中招的女星包括艾玛·沃森、阿曼达·塞弗里德等。"}
{"title": "大众车机天宝187A Hack笔记", "url": "https://www.freebuf.com/geek/129160.html", "time": "2017-03-16", "level": "现金奖励", "num_look": 2482851, "num_comment": 67, "author": "mengxp", "tags": ["极客"], "text": "由于本人对硬件也有研究，因此决定买一台天宝187A来研究一下，至于德赛……先好好地在车上服役，暂时不去虐他了…"}
{"title": "湖北灰科招聘安全工程师", "url": "https://www.freebuf.com/jobs/128924.html", "time": "2017-03-16", "level": "", "num_look": 1053539, "num_comment": 36, "author": "yEs、ov3r°先生", "tags": ["安全招聘"], "text": "湖北灰科信息技术有限公司诚招网络安全工程师"}
{"title": "【企业研究报告】新一代防火墙的撕X大戏：Palo Alto Networks安全公司全解读", "url": "https://www.freebuf.com/special/128852.html", "time": "2017-03-16", "level": "红色标题", "num_look": 1291838, "num_comment": 7, "author": "欧阳洋葱", "tags": ["安全报告", "特别企划"], "text": "防火墙究竟是谁发明的？Palo Alto Networks联合创始人Zuk说是他，果真如此吗？"}
{"title": "基于Python的远程管理工具（RAT） - Stitch", "url": "https://www.freebuf.com/sectool/129104.html", "time": "2017-03-16", "level": "", "num_look": 722532, "num_comment": 25, "author": "secist", "tags": ["工具"], "text": "Stitch是一款基于Python的跨平台远程管理工具，允许用户针对Windows, Mac OSX 或 Linux分别定制不同的payload"}
{"title": "这玩意据说是“最先进的USB攻击平台”，只卖99.99美元", "url": "https://www.freebuf.com/news/128788.html", "time": "2017-03-15", "level": "", "num_look": 975966, "num_comment": 19, "author": "Alpha_h4ck", "tags": ["工具", "资讯"], "text": "按照Hak5自己的说法，这款Bash Bunny设备是“世界上最先进的USB攻击工具”，它都有哪些本领呢？"}
{"title": "利用服务器漏洞挖矿黑产案例分析", "url": "https://www.freebuf.com/articles/system/129459.html", "time": "2017-03-15", "level": "", "num_look": 1493666, "num_comment": 10, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "近期，天眼实验室跟踪了一些通过利用这些NDay漏洞攻击服务器获取控制自动化植入挖矿木马的团伙，给大家分析一个真实的案例。"}
{"title": "移动APP安全行业报告（游戏篇）", "url": "https://www.freebuf.com/articles/paper/128946.html", "time": "2017-03-15", "level": "", "num_look": 1109984, "num_comment": 7, "author": "腾讯云安全", "tags": ["安全报告"], "text": "本移动APP安全行业报告将对金融、电商、游戏三大重灾区行业进行分析说明，还原行业本貌。本期为游戏篇。"}
{"title": "北京拓尔思信息技术股份有限公司招聘web安全工程师", "url": "https://www.freebuf.com/jobs/129046.html", "time": "2017-03-15", "level": "", "num_look": 1003952, "num_comment": 28, "author": "Da^Liang", "tags": ["安全招聘"], "text": "北京拓尔思信息技术股份有限公司是领先的大数据技术和服务提供商,期待您的加入"}
{"title": "双尾蝎（APT-C-23）：伸向巴以两国的毒针", "url": "https://www.freebuf.com/articles/system/129223.html", "time": "2017-03-15", "level": "", "num_look": 1109391, "num_comment": 5, "author": "360企业安全", "tags": ["安全报告", "系统安全"], "text": "2016年5月起至今，双尾蝎组织对巴勒斯坦教育机构、军事机构等重要领域展开了有组织、有计划、有针对性的长时间不间断攻击。"}
{"title": "游戏主机加密大对决：PS4 vs Xbox One", "url": "https://www.freebuf.com/articles/terminal/129165.html", "time": "2017-03-15", "level": "", "num_look": 991661, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "你们有没有想过目前哪一款主流游戏主机所采用的信息加密算法是最好的？"}
{"title": "“无文件”攻击方式渗透实验", "url": "https://www.freebuf.com/articles/system/129228.html", "time": "2017-03-15", "level": "红色标题", "num_look": 1786323, "num_comment": 21, "author": "亚信安全", "tags": ["系统安全", "网络安全"], "text": "前几天看了《全球上百家银行和金融机构感染了一种“无文件”恶意程序，几乎无法检测》，觉得powershell很是神奇，希望亲手实验一下，以最大程度还原无文件攻击方式。"}
{"title": "Mariadb蜜罐：用改造过的服务端攻击客户端", "url": "https://www.freebuf.com/sectool/128947.html", "time": "2017-03-15", "level": "现金奖励", "num_look": 423263, "num_comment": 21, "author": "c0debreak", "tags": ["工具", "网络安全"], "text": "这里介绍一个神奇的 Mariadb 服务端插件，它可以用来做蜜罐，在渗透中也可以用来搞定某些服务器，你懂的"}
{"title": "【FreeBuf公开课】当我们在谈论OWASP Top10的时候，我们在谈论什么？", "url": "http://open.freebuf.com/inland/912.html", "time": "2017-03-14", "level": "红色标题", "num_look": 50819, "num_comment": 2, "author": "supercoco", "tags": ["FreeBuf公开课", "视频"], "text": "那么多年了，但你真的理解OWASP Top10吗？漏洞盒子曾老师让你放学别走。"}
{"title": "38款Android设备预装恶意程序，三星、OPPO、小米等都中招", "url": "https://www.freebuf.com/news/129267.html", "time": "2017-03-14", "level": "", "num_look": 357355, "num_comment": 15, "author": "Sphinx", "tags": ["终端安全", "资讯"], "text": "CheckPoint的专家们最近在38台Android设备中发现了严重的感染情况，重点是这些恶意软件并不是用户主动安装的，而是在购买时就预装的。"}
{"title": "合天智汇人才招募", "url": "https://www.freebuf.com/jobs/128975.html", "time": "2017-03-14", "level": "", "num_look": 266554, "num_comment": 21, "author": "合天智汇", "tags": ["安全招聘"], "text": "湖南合天智汇信息技术有限公司主要从事网络安全平台技术研究及产品研发，在基于大数据分析的安全技术和应用平台技术方面有深厚的积淀。"}
{"title": "企业安全建设之主机级资产管理与分析", "url": "https://www.freebuf.com/articles/security-management/127851.html", "time": "2017-03-14", "level": "现金奖励", "num_look": 759076, "num_comment": 11, "author": "兜哥", "tags": ["企业安全", "安全管理"], "text": "通常认为企业安全视角的资产包括网络级、应用级、主机级。本文重点讲解如何利用开源软件获取主机级资产以及入侵检测和主机审计。"}
{"title": "自己动手Bypass Android Exchange", "url": "https://www.freebuf.com/articles/terminal/128828.html", "time": "2017-03-14", "level": "现金奖励", "num_look": 394928, "num_comment": 7, "author": "diigu", "tags": ["终端安全"], "text": "客户端的安全验证完全由客户端软件按照Exchange标准自行验证，服务器并未验证客户端是否满足安全需求，让客户端的验证功能废除掉即可达到绕过的目的。"}
{"title": "企业安全建设之路：端口扫描（上）", "url": "https://www.freebuf.com/articles/es/128526.html", "time": "2017-03-14", "level": "现金奖励", "num_look": 645933, "num_comment": 22, "author": "bt0sea", "tags": ["企业安全"], "text": "互联网安全运维人员如何建立自己企业的运维平台"}
{"title": "利用Powershell和ceye.io实现Windows账户密码回传", "url": "https://www.freebuf.com/articles/system/129068.html", "time": "2017-03-14", "level": "金币+20", "num_look": 432140, "num_comment": 10, "author": "s1riu5", "tags": ["系统安全"], "text": "之前我一直不习惯Windows的主要原因是他那孱弱的命令行工具，稍微了解了Powershell之后差点跪下了，真的是一款非常了不起的工具。"}
{"title": "【你为什么走上信息安全这条“不归路”？】春困Say No！FreeBuf送书活动给你补气", "url": "https://www.freebuf.com/fevents/129232.html", "time": "2017-03-14", "level": "红色标题", "num_look": 1075611, "num_comment": 527, "author": "FB客服", "tags": ["活动"], "text": "一年之计在于春，让我们开始读书吧！"}
{"title": "安天发布2016移动安全年报：威胁的全面迁徙", "url": "https://www.freebuf.com/articles/terminal/128999.html", "time": "2017-03-13", "level": "", "num_look": 424430, "num_comment": 424430, "author": "AVLTeam", "tags": ["安全报告", "终端安全"], "text": "安天从2005年开始，每年年初公布年报，对上一年度网络威胁状况进行总结，对威胁演进趋势做出预测。"}
{"title": "批量Struts S2-045漏洞检测及利用", "url": "https://www.freebuf.com/sectool/129224.html", "time": "2017-03-13", "level": "金币+20", "num_look": 2026821, "num_comment": 29, "author": "wwwillgaiiam", "tags": ["WEB安全", "工具"], "text": "很多公司已经紧锣旗鼓地修复了漏洞，尽管如此，互联网上还是有大批未修复的目标。。。"}
{"title": "闲话文件上传漏洞", "url": "https://www.freebuf.com/vuls/128846.html", "time": "2017-03-13", "level": "现金奖励", "num_look": 1926127, "num_comment": 32, "author": "sarleon", "tags": ["WEB安全", "漏洞"], "text": "文件上传漏洞是web安全中经常利用到的一种漏洞形式。这种类型的攻击从大的类型上来说，是攻击数据与代码分离原则的一种攻击。"}
{"title": "中国石油规划总院第三方招聘", "url": "https://www.freebuf.com/jobs/128601.html", "time": "2017-03-13", "level": "", "num_look": 350720, "num_comment": 40, "author": "弓汝", "tags": ["安全招聘"], "text": "中国石油规划总院（CPPEI）是中国石油天然气股份有限公司直属的决策支持机构。"}
{"title": "如何写一个CTF比赛中的CrackMe？", "url": "https://www.freebuf.com/articles/system/128659.html", "time": "2017-03-13", "level": "金币+20", "num_look": 391173, "num_comment": 8, "author": "cnRay", "tags": ["系统安全"], "text": "如果你对逆向工程、CTF比赛有好奇心或者想制作自己的CrackMe并逼疯其他的参赛者，那么本文就是专门写给你的。"}
{"title": "详解OSSIM-OSSEC WIN 4771案例", "url": "https://www.freebuf.com/articles/system/128749.html", "time": "2017-03-13", "level": "现金奖励", "num_look": 367982, "num_comment": 13, "author": "R00to1", "tags": ["系统安全"], "text": "来看下,怎么一步一步配置4771暴力破解攻击的报警."}
{"title": "专坑国人！不法分子正大量滥用苹果iOS企业证书", "url": "https://www.freebuf.com/news/129066.html", "time": "2017-03-13", "level": "现金奖励", "num_look": 1375030, "num_comment": 17, "author": "venkkk", "tags": ["漏洞", "资讯"], "text": "不发分子通过滥用或购买企业证书打包非法App的情况，传播大量涉黄涉赌应用，专坑中国人！"}
{"title": "物联网设备Telnet口令快速扫描工具", "url": "https://www.freebuf.com/sectool/128661.html", "time": "2017-03-12", "level": "现金奖励", "num_look": 813959, "num_comment": 35, "author": "scu-igroup", "tags": ["工具"], "text": "本文介绍了一个多线程telnet快速扫描器，可以快速地实现telnet物联网设备的密码扫描，并将扫描结果存入库中。"}
{"title": "首席信息安全官是怎样炼成的：FreeBuf专访联想CISO Richard Rushing", "url": "https://www.freebuf.com/articles/people/125201.html", "time": "2017-03-12", "level": "", "num_look": 686359, "num_comment": 2, "author": "kuma", "tags": ["人物志", "安全管理"], "text": "与联想CISO Richard Rushing一起聊理想谈人生"}
{"title": "安数云通诚招网络安全人员", "url": "https://www.freebuf.com/jobs/128131.html", "time": "2017-03-12", "level": "", "num_look": 280969, "num_comment": 27, "author": "安数云通", "tags": ["安全招聘"], "text": "安数云通是一家为重要职能部门和大中型企业提供网络安全技术产品和网络安全服务的高科技网络公司，诚邀您的加入。"}
{"title": "你值得拥有的8大国际安全认证", "url": "https://www.freebuf.com/news/128826.html", "time": "2017-03-12", "level": "", "num_look": 1427390, "num_comment": 19, "author": "secist", "tags": ["安全管理", "资讯"], "text": "哪些证书才是国际认可的高质量网络安全人才证书？来看看这八项"}
{"title": "京东官方声明回应50亿条公民信息泄漏传言", "url": "https://www.freebuf.com/news/129076.html", "time": "2017-03-12", "level": "金币+10", "num_look": 462326, "num_comment": 27, "author": "lr3800_", "tags": ["资讯"], "text": "郑某鹏在工作一段时间获取信任后，利用工作之便窃取网站的核心数据。"}
{"title": "如何用0day漏洞黑掉西部数据NAS存储设备", "url": "https://www.freebuf.com/vuls/128734.html", "time": "2017-03-12", "level": "", "num_look": 1130791, "num_comment": 7, "author": "clouds", "tags": ["漏洞", "终端安全"], "text": "这篇文章向大家展示的是对西部数据（Western Digital ）网络存储设备（NAS）的漏洞发现和入侵利用过程。"}
{"title": "聊聊身份欺诈和窃取那些事", "url": "https://www.freebuf.com/articles/database/128194.html", "time": "2017-03-11", "level": "", "num_look": 1206323, "num_comment": 15, "author": "Alpha_h4ck", "tags": ["数据安全", "观点"], "text": "在应对身份盗窃这一问题上，人们在不断尝试着新的花样——比如将用户的个人物理属性纳入考虑范围"}
{"title": "骇极安全团队诚招python工程师、渗透测试工程师", "url": "https://www.freebuf.com/jobs/128658.html", "time": "2017-03-11", "level": "", "num_look": 1078884, "num_comment": 26, "author": "cagetest", "tags": ["安全招聘"], "text": "骇极安全是一支提供专业网络安全监测服务的团队，30人的团队中大多数成员都有着技术背景，其中领队就是一名拥有20多年经验的美国黑客。"}
{"title": "针对一伙WordPress犯罪团伙的深度技术分析", "url": "https://www.freebuf.com/news/128424.html", "time": "2017-03-11", "level": "", "num_look": 198829, "num_comment": 1, "author": "secist", "tags": ["资讯"], "text": "如何对一个黑产团伙追根溯源"}
{"title": "【FB TV】一周「BUF大事件」：中情局数千份机密文档泄露；Apache Struts2 曝任意代码执行漏洞；泄露14亿信息的公司竟是它", "url": "https://www.freebuf.com/video/129071.html", "time": "2017-03-11", "level": "红色标题", "num_look": 488549, "num_comment": 6, "author": "supercoco", "tags": ["视频"], "text": "维基曝光规模最大的CIA机密文件；Struts2再曝高危漏洞；“14亿身份信息泄露案”答案揭晓。"}
{"title": "端点安全CrowdStrike与评测机构NSS Labs之间的互撕，究竟错在谁？", "url": "https://www.freebuf.com/news/128750.html", "time": "2017-03-11", "level": "", "num_look": 218704, "num_comment": 218704, "author": "cxt", "tags": ["特别企划", "资讯"], "text": "独立评测机构是安全企业发展的助力吗？"}
{"title": "当企业安全边界被打破，IoT与微服务威胁需要重视", "url": "https://www.freebuf.com/articles/security-management/124008.html", "time": "2017-03-11", "level": "", "num_look": 552628, "num_comment": 552628, "author": "kuma", "tags": ["企业安全", "安全管理"], "text": "威胁企业安全的新技术频出，相关负责人应采用更全面的企业风险管理方法。"}
{"title": "阿里聚安全2016年报", "url": "https://www.freebuf.com/articles/paper/128901.html", "time": "2017-03-11", "level": "", "num_look": 271916, "num_comment": 2, "author": "阿里聚安全", "tags": ["安全报告"], "text": "本报告重点聚焦在2016年阿里聚安全所关注的移动安全及数据风控上呈现出来的安全风险，在移动安全方面重点分析了病毒、仿冒、漏洞三部分，帮助用户了解业务安全端安全方面应该注意的风险。"}
{"title": "关于“Vault 7”CIA泄露文档，你想知道的都在这里", "url": "https://www.freebuf.com/news/128982.html", "time": "2017-03-10", "level": "红色标题", "num_look": 725239, "num_comment": 11, "author": "kuma", "tags": ["资讯"], "text": "这两天网上相关CIA泄露文档的情报已经相当多样，FreeBuf在此做了一些简单的整理。"}
{"title": "北京安普诺高薪聘请安全人才（期权激励）", "url": "https://www.freebuf.com/jobs/128474.html", "time": "2017-03-10", "level": "", "num_look": 235367, "num_comment": 18, "author": "悬镜安全实验室", "tags": ["安全招聘"], "text": "北京安普诺作为业界领先的专注云主机安全加固一站式解决方案提供商，目前已成功获得国内互联网安全巨头的Pre A轮战略投资。"}
{"title": "大华科技11款摄像头产品被曝预留了后门，可远程获取管理员账户密码（厂商已更新补丁）", "url": "https://www.freebuf.com/news/128963.html", "time": "2017-03-10", "level": "", "num_look": 396131, "num_comment": 8, "author": "欧阳洋葱", "tags": ["资讯"], "text": "大华科技最近针对自家产品发布了一波补丁，但有安全专家爆料，补丁修复的“严重漏洞”实际上是厂商预留的一个后门。"}
{"title": "用Google破解Google的ReCaptchav2 验证码", "url": "https://www.freebuf.com/articles/web/128851.html", "time": "2017-03-10", "level": "", "num_look": 859416, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["WEB安全", "数据安全"], "text": "这是一个名叫ReBreakCaptcha的逻辑漏洞，而这个漏洞将允许你轻松地绕过网站所采用的GoogleReCaptcha v2验证码。"}
{"title": "如何手写一款SQL injection tool？", "url": "https://www.freebuf.com/sectool/128503.html", "time": "2017-03-10", "level": "现金奖励", "num_look": 501308, "num_comment": 21, "author": "黑戈爾", "tags": ["工具", "数据安全"], "text": "文章主要是为了帮助刚刚踏入安全界的新手们学习sql注入知识，自己手写一个注入工具能让你更好的熟悉注入的原理和过程"}
{"title": "全球2016年第四季度医疗行业威胁分析与报告出炉", "url": "https://www.freebuf.com/articles/paper/128848.html", "time": "2017-03-10", "level": "金币+14", "num_look": 185350, "num_comment": 185350, "author": "TITI", "tags": ["安全报告"], "text": "近年来，医疗行业面临的威胁情况愈发的严峻了。但医疗行业对安全的投入有待进一步提升。"}
{"title": "朝鲜使用先进工具监视公民的数字生活", "url": "https://www.freebuf.com/news/128759.html", "time": "2017-03-10", "level": "", "num_look": 265778, "num_comment": 12, "author": "米雪儿", "tags": ["资讯"], "text": "朝鲜公民越来越多地使用移动设备连接彼此，朝鲜政府开始开发先进的工具用于监视其公民的数字生活。"}
{"title": "一款好用的php webshell检测工具", "url": "https://www.freebuf.com/sectool/128592.html", "time": "2017-03-09", "level": "金币+14", "num_look": 527573, "num_comment": 11, "author": "六翼", "tags": ["工具"], "text": "PHP-malware-finder 是一款优秀的检测webshell和恶意软件混淆代码的工具。"}
{"title": "好未来安全工程师招聘", "url": "https://www.freebuf.com/jobs/128515.html", "time": "2017-03-09", "level": "", "num_look": 242104, "num_comment": 10, "author": "beike2012", "tags": ["安全招聘"], "text": "好未来是一家中国领先的K12教育科技企业，加入好未来的你将大有作为。"}
{"title": "看我如何发现Facebook注册用户手机号码", "url": "https://www.freebuf.com/vuls/128456.html", "time": "2017-03-09", "level": "", "num_look": 1464873, "num_comment": 11, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "近期，曾通过链接重定向方法劫持川普Twitter的比利时黑客@securinti，发现了从Facebook查找注册用户手机号码的方法"}
{"title": "窥探：闪存盘加密区攻防实战", "url": "https://www.freebuf.com/articles/terminal/128505.html", "time": "2017-03-09", "level": "现金奖励", "num_look": 1002970, "num_comment": 2, "author": "tgfreebuf", "tags": ["终端安全"], "text": "本文通过真实案例来看对于闪存盘加密区攻防的实战"}
{"title": "无文件Powershell恶意程序使用DNS作为隐蔽信道", "url": "https://www.freebuf.com/articles/network/128770.html", "time": "2017-03-09", "level": "", "num_look": 1103178, "num_comment": 3, "author": "白熊", "tags": ["网络安全"], "text": "思科Talos安全团队最近发现一款Powershell恶意程序，用DNS进行双向通信"}
{"title": "一张图看懂IoT发展及安全性现状", "url": "https://www.freebuf.com/articles/terminal/128148.html", "time": "2017-03-09", "level": "", "num_look": 783587, "num_comment": 6, "author": "secist", "tags": ["安全报告", "终端安全"], "text": "Gartner 预计2016年用于IoT安全方面的支出达到了惊人的3482亿美元，这个数字预计将在2020年及以后继续变大。"}
{"title": "Natas overthewire 0-15解题报告", "url": "https://www.freebuf.com/articles/others-articles/128481.html", "time": "2017-03-08", "level": "现金奖励", "num_look": 543689, "num_comment": 13, "author": "sarleon", "tags": ["其他", "极客"], "text": "natas overthewire是一个web安全相关的CTF，题目设计的十分精巧，值得web安全工程师尝试"}
{"title": "敲诈者病毒VirLocker卷土重来 （内含恢复指南）", "url": "https://www.freebuf.com/articles/system/128492.html", "time": "2017-03-08", "level": "金币+14", "num_look": 274132, "num_comment": 2, "author": "cnRay", "tags": ["系统安全"], "text": "VirLocker是主流多态性敲诈者病毒的首例并且它不给它的受害者留下痛苦的代价。VirLocker 能够像其他恶意软件一样从它的作者那里传播开来, 但是VirLocker在感染其他用户时做了优化。"}
{"title": "WikiLeaks Vault 7档案下载（包含大量 CIA 工具和文档）", "url": "https://www.freebuf.com/news/128815.html", "time": "2017-03-08", "level": "金币+14", "num_look": 1663575, "num_comment": 26, "author": "bobylive", "tags": ["工具", "资讯"], "text": "我们已经在对档案进行分析并提取干货，欢迎大家留意后续干货利用分析文章。"}
{"title": "滴滴出行诚聘安全工程师", "url": "https://www.freebuf.com/jobs/128335.html", "time": "2017-03-08", "level": "", "num_look": 368656, "num_comment": 24, "author": "安惞", "tags": ["安全招聘"], "text": "滴滴出行“安全第一，体验第二，效率第三”，将安全放在极为重要的位置，对于安全人才求贤若渴，不用担心你是一个人在做安全！"}
{"title": "中情局数千份机密文档泄露：各种0day工具、恶意程序应有尽有", "url": "https://www.freebuf.com/news/128802.html", "time": "2017-03-08", "level": "金币+14", "num_look": 1570339, "num_comment": 22, "author": "clouds", "tags": ["资讯"], "text": "维基解密最近再度获取了数千份文件——据说这些文件是来自CIA，文件细数了CIA所用的网络入侵工具及其拥有的入侵能力。"}
{"title": "这款奇葩的Android勒索软件竟然让受害者用语音说出解锁密码", "url": "https://www.freebuf.com/news/127810.html", "time": "2017-03-08", "level": "", "num_look": 231638, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "这是一款针对国人的勒索软件，锁屏界面会显示勒索人的QQ，解锁的时候还用了百度TTL进行语音输入。"}
{"title": "Pwn2Own十周年官方总结：黑客大赛推动安全研究", "url": "https://www.freebuf.com/articles/others-articles/128479.html", "time": "2017-03-08", "level": "金币+14", "num_look": 1011921, "num_comment": 1, "author": "安全研究所", "tags": ["其他", "活动"], "text": "2017年是Pwn2Own黑客大赛十周年，赛事主办方ZDI特别在官方博客发文“PWN2OWN：THE ROOT OF RESEARCH”，总结了Pwn2Own对安全研究的推动作用"}
{"title": "互联网公司WAF系统设计", "url": "https://www.freebuf.com/articles/network/128370.html", "time": "2017-03-08", "level": "金币+20", "num_look": 666395, "num_comment": 16, "author": "chengfangang", "tags": ["企业安全", "网络安全"], "text": "互联网公司的业务倾向于云平台，云WAF就应运而生，除去考虑硬件WAF的考虑，下面只讲基于互联网公司的需求，打造一款WAF联动系统。"}
{"title": "中睿天下招聘安全人才", "url": "https://www.freebuf.com/jobs/128168.html", "time": "2017-03-07", "level": "", "num_look": 264352, "num_comment": 9, "author": "中睿天下", "tags": ["安全招聘"], "text": "中睿天下成立于2014年6月，致力于在中国的信息化大浪潮中，帮助大型企业高效解决基础信息安全的问题。"}
{"title": "关于Apache Struts2（S2-045）漏洞情况的通报", "url": "https://www.freebuf.com/vuls/128736.html", "time": "2017-03-07", "level": "", "num_look": 1535638, "num_comment": 12, "author": "CNNVD", "tags": ["漏洞"], "text": "国家信息安全漏洞库（CNNVD）收到关于Apache Struts2 （S2-045）远程代码执行漏洞（CNNVD-201703-152）的情况报送。"}
{"title": "Metasploit官方攻防模拟实训工具：Metasploit Vulnerable Services Emulator发布", "url": "https://www.freebuf.com/sectool/128609.html", "time": "2017-03-07", "level": "", "num_look": 548075, "num_comment": 7, "author": "bimeover", "tags": ["工具"], "text": "作为一款开源工具，安全人员可以通过它提供的漏洞操作平台来测试渗透测试目标。"}
{"title": "【漏洞预警】Apache Struts2 曝任意代码执行漏洞 (S2-045,CVE-2017-5638)", "url": "https://www.freebuf.com/vuls/128668.html", "time": "2017-03-07", "level": "红色标题", "num_look": 2531434, "num_comment": 35, "author": "漏洞盒子", "tags": ["漏洞"], "text": "Struts 2再爆高危漏洞CVE-2017-5638 黑客利用Jakarta上传插件可远程执行代码"}
{"title": "隐私泄露：查开房网站的背后", "url": "https://www.freebuf.com/news/128317.html", "time": "2017-03-07", "level": "现金奖励", "num_look": 1964135, "num_comment": 54, "author": "金乌实验室", "tags": ["特别企划", "资讯"], "text": "随着网络的发展，个人信息泄露情况不断升级，个人信息在“黑市”的贩卖也日益猖獗。"}
{"title": "低成本安全硬件（二）：RFID on PN532", "url": "https://www.freebuf.com/articles/terminal/128238.html", "time": "2017-03-07", "level": "现金奖励", "num_look": 1194527, "num_comment": 32, "author": "ya0guang", "tags": ["极客", "终端安全"], "text": "在该系列中，笔者希望对此感兴趣的读者在花费较少金钱的情况下体会到硬件安全的魅力所在。"}
{"title": "企业安全建设之搭建开源SIEM平台（下）", "url": "https://www.freebuf.com/articles/network/127988.html", "time": "2017-03-07", "level": "金币+20", "num_look": 521478, "num_comment": 10, "author": "兜哥", "tags": ["企业安全", "网络安全"], "text": "SIEM，顾名思义就是针对安全信息和事件的管理系统，针对大多数企业是不便宜的安全系统，本文结合作者经验介绍如何使用开源软件离线分析数据，使用算法挖掘未知攻击行为。"}
{"title": "通过DNS AAAA记录和IPv6地址传输后门有效载荷", "url": "https://www.freebuf.com/articles/network/128410.html", "time": "2017-03-06", "level": "", "num_look": 389908, "num_comment": 3, "author": "华为未然实验室", "tags": ["网络安全"], "text": "本文将介绍如何使用DNS流量中的IPv6地址(AAAA)记录传输有效载荷(payload)。"}
{"title": "谷歌SSRF漏洞解析：利用谷歌应用工具发现谷歌内部DNS信息", "url": "https://www.freebuf.com/articles/network/128508.html", "time": "2017-03-06", "level": "", "num_look": 403021, "num_comment": 4, "author": "clouds", "tags": ["网络安全"], "text": "谷歌应用套装G Suite网站toolbox.googleapps.com存在SSRF漏洞，通过该漏洞可以进一步查询谷歌内部DNS服务器，获取到谷歌公司内部IP地址、域名解析记录和各种服务器主机信息"}
{"title": "不学奥斯卡黑《长城》，回味马特达蒙《谍影重重5》的技术亮点", "url": "https://www.freebuf.com/articles/others-articles/127993.html", "time": "2017-03-06", "level": "", "num_look": 348862, "num_comment": 6, "author": "孙毛毛", "tags": ["其他", "特别企划"], "text": "忘记《长城》吧，细细回味《谍影重重5》中马特达蒙的黑阔姿势！"}
{"title": "【Update!】是谁泄露14亿信息？原来是垃圾邮件公司的数据备份", "url": "https://www.freebuf.com/news/128568.html", "time": "2017-03-06", "level": "红色标题", "num_look": 550172, "num_comment": 17, "author": "孙毛毛", "tags": ["资讯"], "text": "“数据泄露搜寻者”Chris Vickery在3月3号发Twitter预告称将在美国时间3月6日公布一起“14亿身份信息泄露案”。"}
{"title": "趣店安全招聘", "url": "https://www.freebuf.com/jobs/128283.html", "time": "2017-03-06", "level": "", "num_look": 463507, "num_comment": 13, "author": "喵喵", "tags": ["安全招聘"], "text": "趣店集团成立于2014年3月，是服务于年轻人的消费金融平台"}
{"title": "浅谈拒绝服务攻击的原理与防御（4）：新型DDOS攻击 - Websocket和临时透镜", "url": "https://www.freebuf.com/news/127533.html", "time": "2017-03-06", "level": "现金奖励", "num_look": 521700, "num_comment": 12, "author": "黑戈爾", "tags": [], "text": "今天我要讲的是还没有发生过大规模攻击行为的新方法--websocket和临时透镜"}
{"title": "Cobalt Strike内网穿梭之如何在互联网中建立一个属于自己的Cobalt Strike服务器", "url": "https://www.freebuf.com/articles/network/128121.html", "time": "2017-03-06", "level": "现金奖励", "num_look": 583535, "num_comment": 12, "author": "Dreamdroid", "tags": ["网络安全"], "text": "如果你有自己独立的ipv4地址，那你可以不看本文了。本文主要是给那些没有独立ip地址还没有钱买vps的穷屌丝黑客们的。"}
{"title": "招商银行招聘信息安全管理岗位", "url": "https://www.freebuf.com/jobs/128279.html", "time": "2017-03-05", "level": "", "num_look": 397208, "num_comment": 9, "author": "xysky", "tags": ["安全招聘"], "text": "招商银行，是中国内地规模第六大的银行、香港中资金融股的八行五保之一。"}
{"title": "Trustwave：中国制GSM语音网关存在Root权限后门", "url": "https://www.freebuf.com/news/128421.html", "time": "2017-03-05", "level": "红色标题", "num_look": 366059, "num_comment": 4, "author": "cxt", "tags": ["网络安全", "资讯"], "text": "这不是国产设备第一次被发现留有后门了..."}
{"title": "移动APP安全行业报告电商篇", "url": "https://www.freebuf.com/articles/terminal/128125.html", "time": "2017-03-05", "level": "", "num_look": 354699, "num_comment": 354699, "author": "腾讯云安全", "tags": ["安全报告", "终端安全"], "text": "移动APP安全行业报告将对金融、电商、游戏三大重灾区行业进行举例分析并配以图表说明，还原移动APP安全行业本貌。本期来看电商篇。"}
{"title": "腾讯反病毒实验室：“敲诈者”黑产研究报告", "url": "https://www.freebuf.com/articles/terminal/128144.html", "time": "2017-03-05", "level": "", "num_look": 1429483, "num_comment": 10, "author": "腾讯电脑管家", "tags": ["安全报告", "终端安全"], "text": "不法分子还会利用宏发动什么样的攻击？面对这样的木马又应该如何防范？"}
{"title": "担心投票系统被黑，详解荷兰政府为何决定在大选中使用手工计票", "url": "https://www.freebuf.com/news/127877.html", "time": "2017-03-05", "level": "", "num_look": 162611, "num_comment": 4, "author": "clouds", "tags": ["其他", "资讯"], "text": "大选计票软件安全性如何？看安全专家详细分析"}
{"title": "国家计算机网络应急技术处理协调中心广东分中心2017年度第二次公开招聘人员通告", "url": "https://www.freebuf.com/jobs/128411.html", "time": "2017-03-04", "level": "", "num_look": 260693, "num_comment": 16, "author": "kuma", "tags": ["安全招聘"], "text": "国家计算机网络应急技术处理协调中心广东分中心2017年度第二次公开招聘"}
{"title": "手电筒惊现海量Root病毒：私自扣费、强装病毒、恶意弹窗", "url": "https://www.freebuf.com/articles/terminal/128430.html", "time": "2017-03-04", "level": "红色标题", "num_look": 413794, "num_comment": 13, "author": "腾讯手机管家", "tags": ["终端安全"], "text": "近期出现的手电筒root病毒，一旦在手机上成功安装后，即会通过私自发送扣费短信订制包月业务，造成用户话费损失，并注入大量恶意elf文件至手机system目录，危害用户手机系统安全。"}
{"title": "SHA-1碰撞攻击将会对我们产生怎样的现实影响？", "url": "https://www.freebuf.com/articles/system/128011.html", "time": "2017-03-04", "level": "", "num_look": 323455, "num_comment": 3, "author": "clouds", "tags": ["系统安全"], "text": "在真实的信息安全世界中，SHA-1哈希碰撞攻击又会怎样对个人和组织机构造成何种威胁呢？"}
{"title": "【RSA 2017专题】RSA大会Keynotes议题Highlight（附PPT下载）", "url": "https://www.freebuf.com/fevents/127241.html", "time": "2017-03-04", "level": "", "num_look": 331401, "num_comment": 2, "author": "cxt", "tags": ["活动", "特别企划"], "text": "RSA 2017上都有哪些精彩的主题演讲？让我们来简单回顾一二"}
{"title": "【FB TV】一周「BUF大事件」：Cloudflare泄露用户信息；MySQL数据库成为猎杀目标，遭勒索攻击；碰撞攻击实例后的首位受害者WebKit", "url": "https://www.freebuf.com/video/128486.html", "time": "2017-03-04", "level": "红色标题", "num_look": 474092, "num_comment": 1, "author": "supercoco", "tags": ["视频"], "text": "Cloudflare泄露用户信息长达数月；大量MySQL数据库遭勒索攻击；碰撞攻击首位受害者WebKit"}
{"title": "企业安全建设之基础安全建设", "url": "https://www.freebuf.com/articles/neopoints/127508.html", "time": "2017-03-04", "level": "金币+15", "num_look": 464897, "num_comment": 9, "author": "兜哥", "tags": ["企业安全", "观点"], "text": "结合实战经验，和大家讨论下互联网公司的基础安全建设中十分重要的安全区域划分以及主机加固。"}
{"title": "雅虎又泄露3200万账户数据，这次是因为“cookie伪造”攻击", "url": "https://www.freebuf.com/news/128401.html", "time": "2017-03-03", "level": "", "num_look": 267070, "num_comment": 20, "author": "孙毛毛", "tags": ["资讯"], "text": "请注意，这并非前几个月爆出的大规模数据泄露事件，而是又一次数据泄露事件。"}
{"title": "Adwind RAT针对企业攻击，目标超过100个国家和地区", "url": "https://www.freebuf.com/news/128021.html", "time": "2017-03-03", "level": "金币+15", "num_look": 227035, "num_comment": 227035, "author": "卡巴斯基1111", "tags": ["安全报告", "系统安全"], "text": "这种多功能后门程序被用来对超过100个国家和地区的1,500个企业和组织实施攻击。"}
{"title": "有趣又有用の安全人才简历投递功能上线了(・。・)", "url": "https://www.freebuf.com/jobs/127792.html", "time": "2017-03-03", "level": "红色标题", "num_look": 355514, "num_comment": 19, "author": "FB客服", "tags": ["安全招聘"], "text": "FreeBuf团队对招聘和简历投递功能进行了一次有趣的升级。"}
{"title": "对登录中账号密码进行加密之后再传输的爆破的思路和方式", "url": "https://www.freebuf.com/articles/web/127888.html", "time": "2017-03-03", "level": "现金奖励", "num_look": 891105, "num_comment": 28, "author": "yiran4827", "tags": ["WEB安全"], "text": "渗透测试过程中遇到web登录的时候，很多场景账号密码都是经过js加密之后再请求发送。这里分析四种方式进行绕过加密爆破。"}
{"title": "Palo Alto Networks1.05亿美元收购LightCyber，进一步加强行为分析技术", "url": "https://www.freebuf.com/news/128187.html", "time": "2017-03-03", "level": "", "num_look": 221743, "num_comment": 1, "author": "bimeover", "tags": ["资讯"], "text": "当地时间周二，网络安全公司Palo Alto宣布以1.05亿美元收购威胁检测初创公司LightCyber。"}
{"title": "六种常用的网络流量特征提取工具", "url": "https://www.freebuf.com/sectool/128008.html", "time": "2017-03-03", "level": "", "num_look": 1136368, "num_comment": 15, "author": "ArkTeam", "tags": ["工具", "网络安全"], "text": "在互联网用户行为分析和异常行为检测的相关研究中，协议识别和特征提取是网络流量特征分析的重要技术手段。下面，本文为大家介绍几款常用的网络流量特征提取的工具。"}
{"title": "如何对iOS App进行打补丁和重新签名", "url": "https://www.freebuf.com/articles/terminal/127200.html", "time": "2017-03-03", "level": "", "num_look": 376200, "num_comment": 6, "author": "华为未然实验室", "tags": ["终端安全"], "text": "福利来了，你可以按照以下过程对修改后的应用程序进行重新签名，然后便可在自己的设备上运行该应用程序。注意，该技术仅适用于非FairPlay加密二进制文件。"}
{"title": "Cobalt Strike高级渗透视频教程系列（FreeBuf公开课）", "url": "http://open.freebuf.com/author/spxc13243871510", "time": "2017-03-02", "level": "", "num_look": 57286, "num_comment": 57286, "author": "spxc13243871510", "tags": ["视频"], "text": "Cobalt Strike高级渗透教程都在这！"}
{"title": "网信集团安全部招聘启事", "url": "https://www.freebuf.com/jobs/128167.html", "time": "2017-03-02", "level": "", "num_look": 257651, "num_comment": 19, "author": "北北北北", "tags": ["安全招聘"], "text": "网信集团是一家综合金融科技服务集团，由先锋集团与多家专业投资机构共同创办。"}
{"title": "【挖洞经验】如何在一条UPDATE查询中实现SQL注入", "url": "https://www.freebuf.com/articles/web/127535.html", "time": "2017-03-02", "level": "", "num_look": 476834, "num_comment": 11, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "我发现了一个非常有意思的SQL注入漏洞。"}
{"title": "泰迪熊智能玩具泄露数百万音频信息和用户密码", "url": "https://www.freebuf.com/news/128195.html", "time": "2017-03-02", "level": "", "num_look": 206336, "num_comment": 4, "author": "孙毛毛", "tags": ["资讯"], "text": "家长要当心，泰迪熊智能玩具会带来潜在的隐私和数据安全风险"}
{"title": "移位溢注：告别靠人品的偏移注入", "url": "https://www.freebuf.com/articles/web/127924.html", "time": "2017-03-02", "level": "现金奖励", "num_look": 616983, "num_comment": 12, "author": "SeagullGR", "tags": ["WEB安全", "数据安全"], "text": "本文中作者研究了一种新的注入技术让“偏移注入不再需要人品”，定义为：“移位溢注技术”。"}
{"title": "【快讯】乐天中国官网疑似遭遇黑客攻击，至今无法访问", "url": "https://www.freebuf.com/news/128267.html", "time": "2017-03-02", "level": "红色标题", "num_look": 433967, "num_comment": 37, "author": "kuma", "tags": ["资讯"], "text": "昨天下午，乐天中国官网遭遇黑客攻击，截至发稿时，乐天中国网站依然无法访问。"}
{"title": "企业安全建设之搭建开源SIEM平台（中）", "url": "https://www.freebuf.com/special/127264.html", "time": "2017-03-02", "level": "现金奖励", "num_look": 492993, "num_comment": 23, "author": "兜哥", "tags": ["企业安全", "特别企划"], "text": "本文结合作者的经验介绍如何使用开源软件离线分析数据，使用攻击建模的方式识别攻击行为。"}
{"title": "浅谈Web端权限维持", "url": "https://www.freebuf.com/articles/web/127806.html", "time": "2017-03-01", "level": "", "num_look": 412072, "num_comment": 16, "author": "i春秋学院", "tags": ["WEB安全"], "text": "web端权限维持技术各种各样，不仅于此，只有你想不到，没有渗透测试人员做不到。"}
{"title": "浙江大华诚招安全人才（杭州）", "url": "https://www.freebuf.com/jobs/128142.html", "time": "2017-03-01", "level": "", "num_look": 214498, "num_comment": 5, "author": "dhsec", "tags": ["安全招聘"], "text": "浙江大华技术股份有限公司是领先的监控产品供应商和解决方案服务商，现诚邀安全人才，只为客户提供更安全放心的产品。"}
{"title": "一款国产Nmap在线扫描系统", "url": "https://www.freebuf.com/sectool/127670.html", "time": "2017-03-01", "level": "金币+15", "num_look": 640019, "num_comment": 18, "author": "Kiderroot", "tags": ["工具"], "text": "为什么重复造这个轮子？答：学习php。"}
{"title": "扒一扒这两天有关阿里云经典网络安全性的争论", "url": "https://www.freebuf.com/articles/others-articles/128113.html", "time": "2017-03-01", "level": "", "num_look": 483614, "num_comment": 17, "author": "安全深扒", "tags": ["其他", "观点"], "text": "对此事还未或略有耳闻的吃瓜群众，不妨随扒爷一起全程围观一下吧。"}
{"title": "卡巴斯基顶级安全专家叛国罪后续：7年前的案子，为何现在才提起？", "url": "https://www.freebuf.com/news/127999.html", "time": "2017-03-01", "level": "", "num_look": 229317, "num_comment": 2, "author": "cxt", "tags": ["资讯"], "text": "关于卡巴斯基安全专家和FSB官员涉嫌叛国的证据7年前就已经递交给克里姆林宫了..."}
{"title": "scapy在wlan中的应用", "url": "https://www.freebuf.com/sectool/127989.html", "time": "2017-03-01", "level": "现金奖励", "num_look": 841295, "num_comment": 17, "author": "addadd", "tags": ["工具", "无线安全"], "text": "又是scapy，这是python的一个网络编程方面的库，它在wlan中也有很强大的应用。"}
{"title": "应用程序白名单和受限Powershell绕过方法详解", "url": "https://www.freebuf.com/articles/system/127764.html", "time": "2017-03-01", "level": "", "num_look": 372967, "num_comment": 1, "author": "华为未然实验室", "tags": ["系统安全"], "text": "Windows 10下能否采用反射PE注入攻击方法绕过应用程序白名单呢？让我们一探究竟。"}
{"title": "KindEditor开源富文本编辑框架XSS漏洞", "url": "https://www.freebuf.com/articles/web/128076.html", "time": "2017-03-01", "level": "现金奖励", "num_look": 681222, "num_comment": 33, "author": "Fire_l25", "tags": ["WEB安全"], "text": "最近接触到了KindEditor输入框架，后来发现该框架存在一个存储型的XSS注入问题。"}
{"title": "如何正确地在Android手机上安装国产软件？", "url": "https://www.freebuf.com/articles/terminal/127510.html", "time": "2017-02-28", "level": "红色标题", "num_look": 775941, "num_comment": 29, "author": "JohnChu", "tags": ["终端安全"], "text": "国产软件往往会申请与之功能不符的权限，读取用户手机信息，开机后就驻足系统。如何正确地安装国产流氓软件呢？笔者整理了一些思路供大家探讨。"}
{"title": "怎样的Hash算法能对抗硬件破解？", "url": "https://www.freebuf.com/articles/database/127676.html", "time": "2017-02-28", "level": "金币+18", "num_look": 488538, "num_comment": 15, "author": "EtherDream", "tags": ["数据安全"], "text": "硬件的仍在不断进步，系统安全等级若不提高，暴力破解将会越来越容易。因此，一种能抵抗「硬件破解」的 Hash 算法，显得很有必要。"}
{"title": "拉勾网诚聘高级安全开发工程师", "url": "https://www.freebuf.com/jobs/127826.html", "time": "2017-02-28", "level": "", "num_look": 296368, "num_comment": 45, "author": "wexiaojiu", "tags": ["安全招聘"], "text": "拉勾网，专注互联网职业机会，期待您的加入"}
{"title": "低成本玩转硬件安全（一）：BadUSB on Arduino", "url": "https://www.freebuf.com/geek/127601.html", "time": "2017-02-28", "level": "现金奖励", "num_look": 893300, "num_comment": 38, "author": "ya0guang", "tags": ["极客"], "text": "在该系列中，笔者希望对此感兴趣的读者在花费较少金钱的情况下体会到硬件安全的魅力所在。"}
{"title": "浅谈拒绝服务攻击的原理与防御（3）：反射DDOS攻击利用代码", "url": "https://www.freebuf.com/articles/network/127218.html", "time": "2017-02-28", "level": "金币+18", "num_look": 624476, "num_comment": 20, "author": "黑戈爾", "tags": ["网络安全"], "text": "我发第一篇DDOS文章的时候freebuf就502了。凑巧了，弄得我都不敢发利用代码了，但是我想了一天以后我觉得我还是发出来吧"}
{"title": "下一个猎杀目标：近期大量MySQL数据库遭勒索攻击", "url": "https://www.freebuf.com/news/127945.html", "time": "2017-02-28", "level": "红色标题", "num_look": 511518, "num_comment": 11, "author": "bimeover", "tags": ["资讯"], "text": "攻击者劫持了数百个MySQL数据库，删除了存储数据，并留下勒索信息，要求支付0.2比特币的赎金（约为235美元）。"}
{"title": "平安银行零售科技诚招安全工程师", "url": "https://www.freebuf.com/jobs/127111.html", "time": "2017-02-27", "level": "", "num_look": 260460, "num_comment": 10, "author": "hereholly", "tags": ["安全招聘"], "text": "平安银行是中国平安集团下唯一全国性股份制商业银行。"}
{"title": "虽然SHA-1遭遇碰撞攻击，但“天还没塌”", "url": "https://www.freebuf.com/news/127939.html", "time": "2017-02-27", "level": "红色标题", "num_look": 315155, "num_comment": 6, "author": "Sphinx", "tags": ["资讯"], "text": "上周四Google与荷兰研究机构CWI宣布首例SHA-1碰撞攻击实例。仅仅一天后的周五就出现了首个碰撞攻击的攻击受害者。我们的网络空间还安全吗？"}
{"title": "安卓现新的木马病毒，可模仿用户点击下载危险的恶意软件", "url": "https://www.freebuf.com/news/127203.html", "time": "2017-02-27", "level": "", "num_look": 304577, "num_comment": 5, "author": "金乌实验室", "tags": ["终端安全", "资讯"], "text": "威胁来自于一个模仿Adobe Flash Player的恶意APP，可为多种危险的恶意软件提供潜在的入口。"}
{"title": "窃听乌克兰超70家机构的Operation BugDrop行动分析：幕后黑客高度组织化、经济实力雄厚", "url": "https://www.freebuf.com/articles/system/127561.html", "time": "2017-02-27", "level": "", "num_look": 280484, "num_comment": 5, "author": "欧阳洋葱", "tags": ["系统安全"], "text": "最近CyberX观察到一种恶意攻击，主要针对乌克兰各个行业，包括基建、媒体、科研机构等。其部署的恶意程序会开启目标设备麦克风来录制音频..."}
{"title": "深度分析APT28最新作品", "url": "https://www.freebuf.com/articles/paper/127711.html", "time": "2017-02-27", "level": "", "num_look": 654046, "num_comment": 8, "author": "腾讯电脑管家", "tags": ["安全报告"], "text": ""}
{"title": "赌场老千与老虎机的故事（下集）：在伪随机数的帮助下走远了", "url": "https://www.freebuf.com/articles/others-articles/127320.html", "time": "2017-02-27", "level": "金币+18", "num_look": 512210, "num_comment": 11, "author": "Alpha_h4ck", "tags": ["其他", "特别企划"], "text": "在“出老千”的路上越走越远"}
{"title": "手把手教你构建8个GPU的破密码机", "url": "https://www.freebuf.com/sectool/127327.html", "time": "2017-02-27", "level": "红色标题", "num_look": 885360, "num_comment": 48, "author": "Alpha_h4ck", "tags": ["工具", "极客"], "text": "这台密码破解机既不需要任何的“黑魔法”，也不需要你花大量时间和精力去组装各种乱七八糟的零配件。"}
{"title": "乐视云计算诚招安全英才", "url": "https://www.freebuf.com/jobs/126851.html", "time": "2017-02-26", "level": "", "num_look": 237820, "num_comment": 16, "author": "乐视安全", "tags": ["安全招聘"], "text": "乐视云计算诚招安全英才，多职位等你来"}
{"title": "边信道攻击新花样：硬盘LED灯也会泄漏你的信息", "url": "https://www.freebuf.com/news/127629.html", "time": "2017-02-26", "level": "", "num_look": 453704, "num_comment": 5, "author": "cxt", "tags": ["数据安全", "资讯"], "text": "你可能从未想过，有一天硬盘指示灯也会出卖你的信息"}
{"title": "医疗设备已成为入侵医疗网络的关键切入点", "url": "https://www.freebuf.com/news/127117.html", "time": "2017-02-26", "level": "", "num_look": 263778, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["其他", "终端安全"], "text": "一位病人正躺在医院的病床上等待医务人员帮他进行血气分析，但他并不知道的是，他的个人信息此时此刻可能比他的身体还要危险。"}
{"title": "往水里投毒？解析针对工业控制系统的勒索攻击", "url": "https://www.freebuf.com/articles/terminal/127424.html", "time": "2017-02-26", "level": "", "num_look": 501869, "num_comment": 1, "author": "clouds", "tags": ["安全报告", "工控安全"], "text": "佐治亚理工学院网络安全专家开发了第一个针对可编程逻辑控制器（PLC）的勒索软件，模拟城市供水设施作为勒索攻击目标进行攻击建模和影响评估。"}
{"title": "如何做好“智慧城市”的安全防护？美国加州圣地亚哥市经验谈", "url": "https://www.freebuf.com/articles/network/127232.html", "time": "2017-02-26", "level": "", "num_look": 329306, "num_comment": 3, "author": "Carrie_spinfo", "tags": ["网络安全", "观点"], "text": "今天就让FreeBuf跟随Gary Hayslip来看一看他是如何保护圣地亚哥市的网络安全的。"}
{"title": "岂安科技2017诚聘安全、产品、销售人才", "url": "https://www.freebuf.com/jobs/126864.html", "time": "2017-02-25", "level": "", "num_look": 184798, "num_comment": 8, "author": "岂安科技", "tags": ["安全招聘"], "text": "岂安，专注于为互联网企业提供业务风控解决方案，让“羊毛党”、“爬虫党”、“盗号党”无所遁形，保护客户海量营销资金适得其用"}
{"title": "Cloudflare泄露用户信息长达数月：系“编程错误”导致", "url": "https://www.freebuf.com/news/127861.html", "time": "2017-02-25", "level": "", "num_look": 306432, "num_comment": 5, "author": "cxt", "tags": ["资讯"], "text": "作为网站安全服务商，出现这样的错误实属不该..."}
{"title": "【FB TV】一周「BUF大事件」：Google研究人员宣布完成全球首例SHA-1哈希碰撞；新曝芯片漏洞，可使ASLR保护失效；风险中的Android车控App", "url": "https://www.freebuf.com/video/127862.html", "time": "2017-02-25", "level": "红色标题", "num_look": 245341, "num_comment": 2, "author": "supercoco", "tags": ["视频"], "text": "SHA-1算法已不再可靠；新曝芯片漏洞，影响数百万设备；不那么安全的Android车控App"}
{"title": "打印机安全研究（二）：打印机攻击测试方法和利用工具", "url": "https://www.freebuf.com/articles/terminal/126455.html", "time": "2017-02-25", "level": "", "num_look": 656661, "num_comment": 5, "author": "clouds", "tags": ["特别企划", "终端安全"], "text": "打印机攻击测试方法和利用工具都有哪些？"}
{"title": "【RSA 2017专题】勒索软件新威胁：你敢不付赎金，我就敢往你喝的水里投毒", "url": "https://www.freebuf.com/news/127371.html", "time": "2017-02-25", "level": "", "num_look": 217967, "num_comment": 4, "author": "kuma", "tags": ["资讯"], "text": "勒索软件也可以攻击关键基础设施"}
{"title": "企业邮件安全防护经验总结", "url": "https://www.freebuf.com/articles/security-management/127752.html", "time": "2017-02-25", "level": "", "num_look": 1148630, "num_comment": 3, "author": "联想安全应急响应中心", "tags": ["企业安全", "安全管理"], "text": "目前大众普遍认为邮件安全就是钓鱼攻击（phishing），其实邮件安全的领域很广，本文基于工作中的知识与大家多维度分享一下。"}
{"title": "腾讯安全平台部招聘安全人才", "url": "https://www.freebuf.com/jobs/127282.html", "time": "2017-02-24", "level": "", "num_look": 399675, "num_comment": 32, "author": "RanDom", "tags": ["安全招聘"], "text": "深圳市腾讯计算机系统有限公司是中国最大的互联网综合服务提供商之一。"}
{"title": "伪装QQ飞车外挂的“MBR锁”木马分析", "url": "https://www.freebuf.com/articles/system/127600.html", "time": "2017-02-24", "level": "", "num_look": 318909, "num_comment": 20, "author": "360安全", "tags": ["系统安全"], "text": ""}
{"title": "暗影追踪：谁是LeakedSource.com的幕后运营者？", "url": "https://www.freebuf.com/articles/web/127544.html", "time": "2017-02-24", "level": "", "num_look": 446217, "num_comment": 3, "author": "clouds", "tags": ["WEB安全", "特别企划"], "text": "抛开LeakedSource的合法性不谈，该文对特定网络身份轮廓的剖绘值得参考研究。"}
{"title": "KasperskyOS安全操作系统终于发布了，一点儿Linux血统都没有", "url": "https://www.freebuf.com/news/127587.html", "time": "2017-02-24", "level": "", "num_look": 329132, "num_comment": 19, "author": "bimeover", "tags": ["资讯"], "text": "2月20日，KasperskyOS终于发布了。"}
{"title": "Google研究人员宣布完成全球首例SHA-1哈希碰撞！", "url": "https://www.freebuf.com/news/127750.html", "time": "2017-02-24", "level": "红色标题", "num_look": 572065, "num_comment": 13, "author": "Sphinx", "tags": ["网络安全", "资讯"], "text": "SHA-1算法已经不再可靠，Google建议切换到更安全的算法。"}
{"title": "Google基础设施安全设计概述翻译&导读", "url": "https://www.freebuf.com/articles/paper/127744.html", "time": "2017-02-24", "level": "金币+10", "num_look": 373655, "num_comment": 4, "author": "职业欠钱", "tags": ["企业安全", "安全报告"], "text": "笔者英文并不太优秀，但是这次也是一字一句的硬啃下来了，只因为相信，这是一篇值得精读多遍的真正好文。"}
{"title": "FuzzDomain域名爆破工具发布以及开源", "url": "https://www.freebuf.com/sectool/127400.html", "time": "2017-02-24", "level": "现金奖励", "num_look": 515784, "num_comment": 16, "author": "Chora", "tags": ["工具"], "text": "个人认为信息收集是渗透测试中最重要的部分，它将直接影响到渗透测试的结果。今天给大家分享的是信息收集中的一小部分，域名爆破。"}
{"title": "浅谈Web客户端追踪", "url": "https://www.freebuf.com/articles/web/127266.html", "time": "2017-02-24", "level": "现金奖励", "num_look": 1131815, "num_comment": 9, "author": "ArkTeam", "tags": ["WEB安全"], "text": "文本对主流的Web客户端追踪技术进行了简要分析，并给出相关参考供感兴趣的朋友深入"}
{"title": "全球能源互联网研究院招聘信息安全工程师", "url": "https://www.freebuf.com/jobs/127034.html", "time": "2017-02-23", "level": "", "num_look": 232356, "num_comment": 8, "author": "secsgri", "tags": ["安全招聘"], "text": "全球能源互联网研究院（以下简称“联研院”）是国家电网公司直属科研单位，国内首家专业从事全球能源互联网关键技术和设备开发的高端研发机构。"}
{"title": "【更新PoC】潜伏11年的Linux内核提权漏洞曝光", "url": "https://www.freebuf.com/news/127620.html", "time": "2017-02-23", "level": "", "num_look": 1433079, "num_comment": 15, "author": "kuma", "tags": ["漏洞", "资讯"], "text": "Linux内核近日又曝出权限提升漏洞，该漏洞可追溯至2005年，漏洞影响Linux操作系统主要发行版本。"}
{"title": "企业安全建设之搭建开源SIEM平台（上）", "url": "https://www.freebuf.com/special/127172.html", "time": "2017-02-23", "level": "现金奖励", "num_look": 926088, "num_comment": 26, "author": "兜哥", "tags": ["企业安全", "特别企划"], "text": "本文结合作者的经验介绍下如何使用开源软件搭建企业的SIEM系统"}
{"title": "Python与Java曝漏洞，黑客利用FTP注入攻击可绕过防火墙", "url": "https://www.freebuf.com/vuls/127595.html", "time": "2017-02-23", "level": "", "num_look": 1253468, "num_comment": 3, "author": "Sphinx", "tags": ["漏洞", "系统安全"], "text": "Java和Python存在漏洞，不能正确地验证FTP URL，导致黑客能够绕过防火墙访问本地网络。"}
{"title": "Wifi密码破解实战", "url": "https://www.freebuf.com/articles/wireless/127261.html", "time": "2017-02-23", "level": "现金奖励", "num_look": 4316091, "num_comment": 89, "author": "schip", "tags": ["无线安全", "极客"], "text": "破解 WIFI 密码从失败到成功，从成功到写成记录，每一步都比想象的要曲折。"}
{"title": "PHP成为首个在内核中嵌入加密库的编程语言", "url": "https://www.freebuf.com/news/127506.html", "time": "2017-02-23", "level": "", "num_look": 302850, "num_comment": 6, "author": "bimeover", "tags": ["资讯"], "text": "PHP团队通过投票的方式一致通过了“将Libsodium库集成到PHP内核中”的议题，使得PHP成为首个使用公认现代加密库的编程语言。"}
{"title": "新一代子域名爆破工具brutedns", "url": "https://www.freebuf.com/sectool/127099.html", "time": "2017-02-23", "level": "金币+17", "num_look": 891876, "num_comment": 37, "author": "yanxiu0614", "tags": ["工具"], "text": "一直相信不要重复造轮子这句话，但是如果可以造出来更好的轮子，我认为那就应该勇敢的去造。总结一下工具特点：人无我有，人有我优。"}
{"title": "移动APP安全行业报告金融篇", "url": "https://www.freebuf.com/articles/paper/127487.html", "time": "2017-02-23", "level": "", "num_look": 289263, "num_comment": 9, "author": "腾讯云安全", "tags": ["安全报告"], "text": "本移动APP安全行业报告将对金融行业进行分析，还原移动 APP 安全行业本貌。"}
{"title": "美创科技诚招售前安全人才", "url": "https://www.freebuf.com/jobs/126601.html", "time": "2017-02-22", "level": "", "num_look": 164555, "num_comment": 6, "author": "美创MC", "tags": ["安全招聘"], "text": "“美创科技”是一家专注提供数据安全、容灾备份的安全产品服务提供商。"}
{"title": "【24日晚8点】FreeBuf公开课（直播）：解读IBM企业安全报告，探讨企业安全新趋势", "url": "http://open.freebuf.com/inland/879.html", "time": "2017-02-22", "level": "红色标题", "num_look": 40616, "num_comment": 40616, "author": "supercoco", "tags": ["活动"], "text": "今晚八点不见不散！（有福利哦~）"}
{"title": "关于WPS Office安全漏洞情况的通报", "url": "https://www.freebuf.com/vuls/127553.html", "time": "2017-02-22", "level": "", "num_look": 1183308, "num_comment": 5, "author": "CNNVD", "tags": ["漏洞"], "text": "国家信息安全漏洞库（CNNVD）收到关于WPS Office缓冲区错误漏洞的情况报送，并于第一时间与软件厂商“北京金山办公软件公司”进行了沟通。"}
{"title": "矛与盾：二进制漏洞攻防思想对抗", "url": "https://www.freebuf.com/articles/system/127207.html", "time": "2017-02-22", "level": "现金奖励", "num_look": 609434, "num_comment": 13, "author": "tigerlab", "tags": ["系统安全"], "text": "有人的地方就有江湖，有江湖的地方就有争斗，有争斗就有攻防。人类争斗最初是利用拳脚，冷兵器时代是刀枪，热兵器时代是枪炮，而在计算机平台上，人们的武器换成了——代码。"}
{"title": "WAF自动化暴破（绕过）脚本xwaf", "url": "https://www.freebuf.com/sectool/127001.html", "time": "2017-02-22", "level": "金币+17", "num_look": 596937, "num_comment": 30, "author": "quanyechavshuo", "tags": ["工具"], "text": "xwaf是一个python写的waf自动绕过工具,上一个版本是bypass_waf,xwaf相比bypass_waf更智能,可无人干预,自动暴破waf"}
{"title": "域名背后的真相，一个黑产团伙的沦陷", "url": "https://www.freebuf.com/articles/terminal/127228.html", "time": "2017-02-22", "level": "现金奖励", "num_look": 1740173, "num_comment": 92, "author": "金乌实验室", "tags": ["其他", "特别企划"], "text": "很多小伙伴溯源一般只追查到whois信息，但个人认为该信息未必是真实有效的，挖掘背后的信息才是正章。"}
{"title": "偷车其实很简单：你知道Android车控App有多不安全吗？", "url": "https://www.freebuf.com/news/127398.html", "time": "2017-02-22", "level": "", "num_look": 341128, "num_comment": 8, "author": "孙毛毛", "tags": ["终端安全", "资讯"], "text": "一款应用就能偷车？"}
{"title": "浅谈拒绝服务攻击的原理与防御（2）：反射型DDOS", "url": "https://www.freebuf.com/news/127116.html", "time": "2017-02-22", "level": "现金奖励", "num_look": 370592, "num_comment": 11, "author": "黑戈爾", "tags": [], "text": "前几天提交了一篇关于DDOS攻击的文章到今天下午才审核通过发表出来，所以晚上闲来无事在接着写下面的内容，今天我就不多说废话了直接来干货。"}
{"title": "血雨腥风未止，IBM公布Shamoon恶意程序攻击链细节", "url": "https://www.freebuf.com/news/127214.html", "time": "2017-02-22", "level": "", "num_look": 220684, "num_comment": 1, "author": "kuma", "tags": ["安全报告", "资讯"], "text": "IBM安全专家发布报告，公布了升级版Shamoon网络武器的攻击链细节。"}
{"title": "Cobalt Strike之DNS Beacon使用记录", "url": "https://www.freebuf.com/sectool/127125.html", "time": "2017-02-21", "level": "现金奖励", "num_look": 500453, "num_comment": 7, "author": "补丁君", "tags": ["工具"], "text": "笔者介绍了Cobalt Strike DNS Beacon的使用心得"}
{"title": "访问一个网站就能让ASLR保护失效，百万设备陷入危机", "url": "https://www.freebuf.com/vuls/127229.html", "time": "2017-02-21", "level": "红色标题", "num_look": 1122109, "num_comment": 7, "author": "bimeover", "tags": ["漏洞", "系统安全"], "text": "安全研究员发现一个芯片漏洞，此漏洞影响到数以百万计的设备，不管设备上安装的是什么操作系统或是应用程序，这个漏洞都能让设备的防黑保护无效化。"}
{"title": "针对网银木马Ursnif的全球网络分销检测及分析", "url": "https://www.freebuf.com/articles/terminal/127464.html", "time": "2017-02-21", "level": "", "num_look": 445330, "num_comment": 445330, "author": "secist", "tags": ["安全报告", "终端安全"], "text": "臭名昭著的网银木马 Ursnif（a.k.a Gozi），在过去的一年多里，一直将日本作为其主要的攻击对象。"}
{"title": "浅谈XXE攻击", "url": "https://www.freebuf.com/articles/web/126788.html", "time": "2017-02-21", "level": "金币+12", "num_look": 1688035, "num_comment": 12, "author": "wenjian_tk0", "tags": ["WEB安全"], "text": "本文主要讨论什么是XML外部实体，这些外部实体是如何被攻击的。"}
{"title": "针对Android沙盒的“中间APP攻击”", "url": "https://www.freebuf.com/articles/terminal/127441.html", "time": "2017-02-21", "level": "", "num_look": 315739, "num_comment": 2, "author": "Sphinx", "tags": ["终端安全"], "text": "Android for Work是Android的“沙盒”机制，最近来自Skycure 的安全研究人员发现，Android for Work可以通过一种“中间app攻击”的方式被Hack。"}
{"title": "伊朗黑客对中东发起名为Magic Hound的网络间谍行为", "url": "https://www.freebuf.com/news/127211.html", "time": "2017-02-21", "level": "", "num_look": 202642, "num_comment": 3, "author": "孙毛毛", "tags": ["资讯"], "text": "近期，安全研究人员发现被称为Magic Hound的网络间谍行为与伊朗黑客和Shamoon 2恶意软件有关。"}
{"title": "TEW-654TR路由器漏洞分析和挖掘", "url": "https://www.freebuf.com/vuls/126766.html", "time": "2017-02-20", "level": "现金奖励", "num_look": 1189968, "num_comment": 10, "author": "默安科技_影武者实验室", "tags": ["漏洞", "终端安全"], "text": "拜读完devttys0前辈的\"exploiting embedded systems\"系列，分析了下相关固件"}
{"title": "美国DHS发布《“灰熊草原”网络攻击活动深入分析报告》", "url": "https://www.freebuf.com/special/126918.html", "time": "2017-02-20", "level": "", "num_look": 268444, "num_comment": 268444, "author": "clouds", "tags": ["安全报告", "特别企划"], "text": ""}
{"title": "58集团诚招安全人才", "url": "https://www.freebuf.com/jobs/127244.html", "time": "2017-02-20", "level": "", "num_look": 287516, "num_comment": 20, "author": "kuma", "tags": ["安全招聘"], "text": "58集团诚招高级安全工程师、高级开发工程师、高级业务安全开发工程师"}
{"title": "Lcx的多种用法：3个功能+9个参数，你会怎么玩？", "url": "https://www.freebuf.com/sectool/126967.html", "time": "2017-02-20", "level": "现金奖励", "num_look": 691168, "num_comment": 25, "author": "ForWhat", "tags": ["工具"], "text": "刚接触黑客技术时，struts2漏洞利用工具正流行，当时也下载了一个玩玩，上传了很多菜刀木马，不过这时候就有个问题：无法连接到被控制计算机的3389。"}
{"title": "JavaScript的注入引出技术诈骗", "url": "https://www.freebuf.com/articles/web/126964.html", "time": "2017-02-20", "level": "金币+12", "num_look": 369499, "num_comment": 6, "author": "zusheng", "tags": ["WEB安全"], "text": "这种恶意软件巧妙的隐藏了自己，网络管理员很难能识别它。"}
{"title": "赌场老千与老虎机的故事（上集）：赌场惊现神人", "url": "https://www.freebuf.com/articles/others-articles/126789.html", "time": "2017-02-20", "level": "金币+12", "num_look": 833806, "num_comment": 26, "author": "Alpha_h4ck", "tags": ["其他", "特别企划"], "text": "在2014年6月的某一天，美国圣路易斯卢米埃尔广场赌场的会计师发现他们赌场的几台老虎机有几天突然失控了。"}
{"title": "【RSA 2017专题】从RSA 2017看云安全落地实践", "url": "https://www.freebuf.com/articles/neopoints/127004.html", "time": "2017-02-19", "level": "", "num_look": 305693, "num_comment": 1, "author": "绿盟科技", "tags": ["特别企划", "观点"], "text": "RSA大会开始的第一天迎来了三个seminar，其中要数CSA的最引人关注，这从等候入场的队伍之长中可见一斑。"}
{"title": "Pentester Lab课程<from SQL injection to Shell II>通关流程详解", "url": "https://www.freebuf.com/news/126735.html", "time": "2017-02-19", "level": "", "num_look": 452490, "num_comment": 9, "author": "鸢尾", "tags": [], "text": "本次实验挑战的内容：获取管理后台权限以及上传webshell"}
{"title": "美国一大学遭到5000余台校园物联网设备DDoS攻击", "url": "https://www.freebuf.com/news/127052.html", "time": "2017-02-19", "level": "", "num_look": 213553, "num_comment": 213553, "author": "bimeover", "tags": ["资讯"], "text": "美国一大学校园网遭到DDoS攻击，大批学生表示网速慢成狗。经校方人员调查后发现，发起DDoS攻击的正是校园周围5000多台IoT（物联网）设备构成的僵尸网络。"}
{"title": "加油站也会被黑？来看看这个攻击案例", "url": "https://www.freebuf.com/articles/terminal/127175.html", "time": "2017-02-19", "level": "金币+5", "num_look": 307738, "num_comment": 5, "author": "clouds", "tags": ["终端安全"], "text": "Veeder Root，美国维德路特公司是加油站地下油罐液位仪的发明者，也是全球加油站液位仪的最大供应商。"}
{"title": "【RSA 2017专题】RSA 2017大会亮点产品一瞥", "url": "https://www.freebuf.com/fevents/127076.html", "time": "2017-02-19", "level": "", "num_look": 347473, "num_comment": 1, "author": "Sphinx", "tags": ["活动", "特别企划"], "text": "RSA是世界上最大的安全会议，本周在旧金山举行，来自世界各地的与会者聚在一起，听取最新的抵御网络攻击的策略。 以下是会议上宣布的一些新安全产品的简要说明。"}
{"title": "神州优车集团招聘安全人才", "url": "https://www.freebuf.com/jobs/126877.html", "time": "2017-02-18", "level": "", "num_look": 189811, "num_comment": 8, "author": "Titans", "tags": ["安全招聘"], "text": "神州优车集团是中国出行和汽车领域领先的综合服务平台，现诚优秀人才，期待您的加入。"}
{"title": "【FB TV】一周「BUF大事件」：RSA 2017盘点报道；大型暗网市场Hansa发布漏洞悬赏；Windows木马开始全面传播Mirai", "url": "https://www.freebuf.com/video/127263.html", "time": "2017-02-18", "level": "红色标题", "num_look": 235665, "num_comment": 2, "author": "supercoco", "tags": ["视频"], "text": "带你走进美国RSA创新沙盒大赛；暗网市场Hansa正经悬赏漏洞；恶意程序Mirai传播新升级。"}
{"title": "全球首艘黑客邮轮起锚在即，你够实力上船吗？", "url": "https://www.freebuf.com/news/127194.html", "time": "2017-02-17", "level": "", "num_look": 378328, "num_comment": 23, "author": "newie", "tags": ["活动", "资讯"], "text": "从特斯拉到无人机，从物联网到人工智能，全球首个关注智能生活的安全极客大赛GeekPwn（极棒）现场总是上演着令人应接不暇的智慧碰撞。"}
{"title": "宜人贷安全团队招聘人才", "url": "https://www.freebuf.com/jobs/127101.html", "time": "2017-02-17", "level": "", "num_look": 184443, "num_comment": 2, "author": "yirendai_pentest", "tags": ["安全招聘"], "text": "一家年轻的具有无限潜力的金融科技公司，这里有无限可能在等你。"}
{"title": "FreeTalk全国巡演议题召集令", "url": "https://www.freebuf.com/news/127114.html", "time": "2017-02-17", "level": "红色标题", "num_look": 298552, "num_comment": 24, "author": "FB客服", "tags": ["活动", "资讯"], "text": "2017 FreeTalk全国巡演又要开始啦！"}
{"title": "暴风影音AviIndexChunk字段堆溢出漏洞分析实战", "url": "https://www.freebuf.com/vuls/126892.html", "time": "2017-02-17", "level": "现金奖励", "num_look": 1117716, "num_comment": 11, "author": "walkerfuz", "tags": ["漏洞"], "text": "年前Fuzzing暴风影音时，得到一个avi格式poc样本，MSEC插件提示Exploitable，一直拖到现在才把整个分析过程整理出来。"}
{"title": "色情网站YouPorn发布最高达2.5万美元的漏洞奖励计划", "url": "https://www.freebuf.com/news/127091.html", "time": "2017-02-17", "level": "红色标题", "num_look": 534073, "num_comment": 19, "author": "孙毛毛", "tags": ["资讯"], "text": "YouPorn是世界上访问量最大的色情网站之一，近期YouPorn与HackerOne携手，发布漏洞奖励计划，最高奖金可达2.5万美元。"}
{"title": "【RSA2017专题】盘点RSA 2017展台上的那些威胁情报产品", "url": "https://www.freebuf.com/news/127067.html", "time": "2017-02-17", "level": "", "num_look": 318431, "num_comment": 6, "author": "飞行鸵鸟", "tags": ["观点", "资讯"], "text": "“威胁情报”从理念到产品再到客户投入使用只用了短短几年时间，这些嗅觉敏锐的企业如何占得市场先机？下面就从本届RSA大会上选出几家有代表性的威胁情报厂商一睹究竟"}
{"title": "使用Kali Nethunter破解802.1x安全性WiFi", "url": "https://www.freebuf.com/sectool/126787.html", "time": "2017-02-17", "level": "现金奖励", "num_look": 787922, "num_comment": 11, "author": "ya0guang", "tags": ["工具", "无线安全"], "text": "作者参考了GitHub上一则针对Hostapd-wpe的用法，分享如何用Kali Nethunter破解1x认证wifi"}
{"title": "JSONP注入解析", "url": "https://www.freebuf.com/articles/web/126347.html", "time": "2017-02-17", "level": "", "num_look": 873566, "num_comment": 9, "author": "鸢尾", "tags": ["WEB安全"], "text": "JSONP注入是一个不太常见但影响非常广泛且极危险的漏洞。"}
{"title": "完美世界诚聘安全渗透、安全运维、开发等岗位", "url": "https://www.freebuf.com/jobs/126732.html", "time": "2017-02-16", "level": "", "num_look": 276631, "num_comment": 17, "author": "何艺", "tags": ["安全招聘"], "text": "完美信息安全部团队负责完美集团所有安全业务，业务类型多样化，工作富有挑战性，期待你的加入，一起成长。"}
{"title": "【新手指南】浅谈拒绝服务攻击的原理与防御（1）:普通拒绝服务攻击", "url": "https://www.freebuf.com/articles/network/126702.html", "time": "2017-02-16", "level": "金币+5", "num_look": 950752, "num_comment": 31, "author": "黑戈爾", "tags": ["网络安全"], "text": "普通拒绝服务攻击是指一些传统的攻击方式，如：SYN FLOOD攻击、ACK FLOOD攻击、CC攻击、UDP  FLOOD攻击等等，本文将详细介绍。"}
{"title": "【RSA 2017专题】成为高水平CISO的5大秘密，将在RSA揭晓", "url": "https://www.freebuf.com/articles/security-management/126852.html", "time": "2017-02-16", "level": "", "num_look": 492807, "num_comment": 1, "author": "kuma", "tags": ["企业安全", "安全管理"], "text": "高水平的CISO具备什么样的能力？他们的能力如何评估？IANS Research开发的CISO Impact模型，也许可以揭示成功的CISO背后的秘密。"}
{"title": "宏木马现身MacOS平台", "url": "https://www.freebuf.com/news/126837.html", "time": "2017-02-16", "level": "", "num_look": 310572, "num_comment": 2, "author": "腾讯电脑管家", "tags": ["系统安全", "资讯"], "text": "随着勒索软件在2016年的爆发，大量的恶意软件选择在邮件中使用含有宏的word文档进行伪装攻击。"}
{"title": "一款轻量级Web漏洞教学演示系统（DSVW）", "url": "https://www.freebuf.com/sectool/126707.html", "time": "2017-02-16", "level": "金币+12", "num_look": 641942, "num_comment": 16, "author": "MyKings", "tags": ["工具"], "text": "Damn Small Vulnerable Web (DSVW) 是使用Python语言开发的 Web应用漏洞的演练系统。"}
{"title": "Google Project Shield如何抵御DDoS攻击？这个案例可以初探端倪", "url": "https://www.freebuf.com/articles/network/126845.html", "time": "2017-02-16", "level": "", "num_look": 409802, "num_comment": 11, "author": "clouds", "tags": ["网络安全"], "text": "今天就让我们随着FreeBuf来一起了解下谷歌Project Shield的这桩“壮举”。"}
{"title": "宜信总部诚招中高级安全工程师", "url": "https://www.freebuf.com/jobs/126645.html", "time": "2017-02-15", "level": "", "num_look": 231779, "num_comment": 6, "author": "EvaYue", "tags": ["安全招聘"], "text": "诚招中高级安全工程师"}
{"title": "企业安全建设之自建准入系统", "url": "https://www.freebuf.com/articles/security-management/126643.html", "time": "2017-02-15", "level": "现金奖励", "num_look": 842252, "num_comment": 25, "author": "兜哥", "tags": ["企业安全", "安全管理"], "text": "本文介绍了下自建准入系统的经历，该系统在某大型互联网公司稳定运行了5年。"}
{"title": "Java RMI远程反序列化任意类及远程代码执行解析（CVE-2017-3241 ）", "url": "https://www.freebuf.com/vuls/126499.html", "time": "2017-02-15", "level": "现金奖励", "num_look": 1625466, "num_comment": 9, "author": "jfeiyi", "tags": ["WEB安全", "漏洞"], "text": "本打算慢慢写出来的，但前几天发现国外有研究员发了一篇关于这个CVE的文章，他和我找到的地方很相似。"}
{"title": "如何从新闻中识别骗子们的小套路", "url": "https://www.freebuf.com/articles/web/126708.html", "time": "2017-02-15", "level": "现金奖励", "num_look": 585903, "num_comment": 16, "author": "西角边的MR", "tags": ["WEB安全", "特别企划"], "text": "作者以某新闻网站为平台，对电信诈骗的相关新闻进行了提取和分析，试图从获取的信息中分析出诈骗分子的小“套路”。"}
{"title": "暗网做生意不容易：黑市开搞漏洞奖励计划，最高奖励10比特币", "url": "https://www.freebuf.com/news/126429.html", "time": "2017-02-15", "level": "", "num_look": 292509, "num_comment": 9, "author": "孙毛毛", "tags": ["资讯"], "text": "原来暗网也需要白帽子！"}
{"title": "新曝WordPress REST API内容注入漏洞详解", "url": "https://www.freebuf.com/vuls/126734.html", "time": "2017-02-15", "level": "", "num_look": 1305168, "num_comment": 3, "author": "华为未然实验室", "tags": ["WEB安全", "漏洞"], "text": "近日，一个由REST API引起的影响WorePress4.7.0和4.7.1版本的漏洞被披露，该漏洞可以导致WordPress所有文章内容可以未经验证被查看，修改，删除，甚至创建新的文章，危害巨大。"}
{"title": "【RSA 2017专题】什么才是真正的创新？", "url": "https://www.freebuf.com/articles/neopoints/126926.html", "time": "2017-02-15", "level": "", "num_look": 223068, "num_comment": 1, "author": "Carrie_spinfo", "tags": ["观点"], "text": "创新是否真的像我们想象的那么困难？"}
{"title": "【RSA 2017专题】斩获RSA创新沙盒大赛冠军，UnifyID认证方案有何特别之处？", "url": "https://www.freebuf.com/news/126942.html", "time": "2017-02-14", "level": "", "num_look": 248832, "num_comment": 2, "author": "kuma", "tags": ["活动", "资讯"], "text": "UnifyID凭借全隐式认证，夺得2017RSA创新沙盒冠军"}
{"title": "看我如何发现Uber合作方网站XXE 0day漏洞并获得9000美元赏金", "url": "https://www.freebuf.com/vuls/126603.html", "time": "2017-02-14", "level": "金币+12", "num_look": 1193367, "num_comment": 9, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "俄罗斯白帽子在这篇文章中分享了该漏洞的发现过程。"}
{"title": "安洵信息（成都、上海）招贤纳士", "url": "https://www.freebuf.com/jobs/126752.html", "time": "2017-02-14", "level": "", "num_look": 395511, "num_comment": 48, "author": "安洵信息", "tags": ["安全招聘"], "text": "只有牛逼的公司，才配拥有牛逼的员工"}
{"title": "【漏洞预警】QEMU高危漏洞可执行任意代码 影响国内多家公有云平台", "url": "https://www.freebuf.com/vuls/126854.html", "time": "2017-02-14", "level": "", "num_look": 1146240, "num_comment": 5, "author": "360安全", "tags": ["漏洞"], "text": "近期QEMU官方修复了一个严重漏洞，这是QEMU的VGA设备Cirrus CLGD 54xx VGA中的内存越界访问读写漏洞，可造成宿主机层面的任意代码执行。"}
{"title": "我的日志分析之道：简单的Web日志分析脚本", "url": "https://www.freebuf.com/sectool/126698.html", "time": "2017-02-14", "level": "现金奖励", "num_look": 1466576, "num_comment": 33, "author": "金乌实验室", "tags": ["WEB安全", "工具"], "text": "事情的起因是这样的，由于工作原因需要分析网站日志，服务器是windows，iis日志，在网上找了找，github找了找，居然没找到，看来只有自己动手丰衣足食。"}
{"title": "写在RSA Conference 2017之前：威胁检测与响应的痛点", "url": "https://www.freebuf.com/articles/neopoints/126634.html", "time": "2017-02-14", "level": "", "num_look": 308559, "num_comment": 2, "author": "飞行鸵鸟", "tags": ["企业安全", "观点"], "text": "作者在文中阐述了关于“威胁检测与响应”的观点和对即将到来的RSA Conference 2017的期待"}
{"title": "产品经理眼中比较理想的WEB扫描器", "url": "https://www.freebuf.com/articles/web/125990.html", "time": "2017-02-14", "level": "金币+16", "num_look": 541771, "num_comment": 19, "author": "兜哥", "tags": ["WEB安全", "观点"], "text": "文是以一个产品经理的角度讨论其中更细分的一个领域，WEB漏洞扫描器。本人并不是产品经理，所谓产品经理的视角其实是兼顾甲方和乙方的立场。"}
{"title": "密码管理器的攻防博弈", "url": "https://www.freebuf.com/articles/database/126494.html", "time": "2017-02-14", "level": "", "num_look": 376078, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["数据安全"], "text": "密码管理器的便捷性肯定会让每一个用户对密码管理器的安全产生质疑。"}
{"title": "易宝支付招聘安全工程师", "url": "https://www.freebuf.com/jobs/126563.html", "time": "2017-02-13", "level": "", "num_look": 183535, "num_comment": 9, "author": "plane636", "tags": ["安全招聘"], "text": "易宝以交易服务改变生活为使命，致力成为世界一流的交易服务平台"}
{"title": "攻击者使用“非恶意软件”也能识别，来看看这个即将在RSA 2017上发布的新技术", "url": "https://www.freebuf.com/news/126542.html", "time": "2017-02-13", "level": "", "num_look": 218797, "num_comment": 1, "author": "cxt", "tags": ["终端安全", "资讯"], "text": "即将在RSA2017上亮相的Streamming Prevention端点防护技术有哪些特点？先睹为快。"}
{"title": "安天移动安全&中国电信云堤联合报告《Dark  Mobile Bank之钓鱼篇》", "url": "https://www.freebuf.com/articles/terminal/126826.html", "time": "2017-02-13", "level": "", "num_look": 398738, "num_comment": 2, "author": "AVLTeam", "tags": ["安全报告", "终端安全"], "text": "随着越来越多的黑客转向以社会工程学方法来实施网络攻击，此类行为已经呈现出上升甚至泛滥的趋势。这份报告将带你深入其中，一探究竟。"}
{"title": "使用Burpsuite代理和pypcap抓包进行抢红包的尝试", "url": "https://www.freebuf.com/sectool/125969.html", "time": "2017-02-13", "level": "现金奖励", "num_look": 688844, "num_comment": 25, "author": "whoisyourdaddy", "tags": ["工具", "极客"], "text": "年底各厂陆续举办年会，年会期间自然少不了红包，只不过我厂年底搞了个APP专门进行抢红包，国际惯例，手快有，手慢无。于是萌生了利用脚本尝试抢红包的想法。"}
{"title": "【原创工具】勒索软件终结者：勒索软件，今天叔叔要教导你一些做人的道理！", "url": "https://www.freebuf.com/sectool/126342.html", "time": "2017-02-13", "level": "金币+16", "num_look": 790593, "num_comment": 46, "author": "倪茂志", "tags": ["工具", "数据安全"], "text": "开发这块软件的初衷是从14年勒索软件大爆发到现在，依然没有一个行之有效的解决方案，实在是令我有点看不下去了。因此呢我头悬梁，菊刺骨。卧薪尝胆，下班就往家里赶，耗尽所有节假日。终于开发出了勒索软件终结者。"}
{"title": "阿里云云盾Web应用防火墙深度测评", "url": "https://www.freebuf.com/articles/web/126008.html", "time": "2017-02-13", "level": "", "num_look": 618313, "num_comment": 15, "author": "FreeBuf咨询", "tags": ["WEB安全", "特别企划"], "text": "今年的WitAwards 2016互联网安全年度评选中，阿里云云盾Web应用防火墙赢得了大众和评委的认可，斩获「年度云安全产品及服务」奖项，那么云盾WAF是如何脱颖而出的呢？"}
{"title": "这款可能来自伊朗的Mac恶意程序，已经在针对美国国防工业了", "url": "https://www.freebuf.com/articles/system/126605.html", "time": "2017-02-13", "level": "", "num_look": 307645, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["特别企划", "系统安全"], "text": "我们认为此次事件是这款恶意软件第一次真正试图感染目标设备，而且代码中类似“持久性感染”这样的功能也无法正常工作。"}
{"title": "万达电商（飞凡）招聘安全人才", "url": "https://www.freebuf.com/jobs/126274.html", "time": "2017-02-12", "level": "", "num_look": 359498, "num_comment": 18, "author": "lion_00", "tags": ["安全招聘"], "text": "通过全新的线上线下结合的营销方式，飞凡为购物中心搭建Wi-Fi、Beacon等信息化基础设施建设，以及停车、找店、排队、电影等服务，增强消费者线下购物体验。"}
{"title": "基于WAVSEP的靶场搭建指南", "url": "https://www.freebuf.com/sectool/125940.html", "time": "2017-02-12", "level": "金币+16", "num_look": 510760, "num_comment": 7, "author": "兜哥", "tags": ["工具"], "text": "介绍一款叫做WAVSEP的漏洞检测环境或者称\"靶场\"。"}
{"title": "安全厂商间真的能“数据共享，协同合作”吗？", "url": "https://www.freebuf.com/articles/neopoints/126490.html", "time": "2017-02-12", "level": "", "num_look": 264047, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["特别企划", "观点"], "text": "安全厂商合作显得理想化，但这是时代的要求。"}
{"title": "2017年全球8大网络安全威胁趋势预测", "url": "https://www.freebuf.com/news/125995.html", "time": "2017-02-12", "level": "", "num_look": 366812, "num_comment": 12, "author": "彩云安全", "tags": ["观点", "资讯"], "text": "2016年很危险，2017年会更危险。"}
{"title": "OPPO安全中心招聘", "url": "https://www.freebuf.com/jobs/126121.html", "time": "2017-02-11", "level": "", "num_look": 327780, "num_comment": 30, "author": "px1005", "tags": ["安全招聘"], "text": "OPPO是广东欧珀移动通信有限公司旗下品牌，是一家全球性的智能终端和移动互联网公司。"}
{"title": "基于机器学习的web异常检测", "url": "https://www.freebuf.com/articles/web/126543.html", "time": "2017-02-11", "level": "", "num_look": 770524, "num_comment": 6, "author": "阿里聚安全", "tags": ["WEB安全"], "text": "基于机器学习技术的新一代web入侵检测技术有望弥补传统规则集方法的不足，为web对抗的防守端带来新的发展和突破。"}
{"title": "【FB TV】一周「BUF大事件」：黑客逐步泄露窃取的900Gb Cellebrite数据；Netgear路由器存在密码绕过漏洞；Forrester公布2016年数据泄露排名", "url": "https://www.freebuf.com/video/126769.html", "time": "2017-02-11", "level": "红色标题", "num_look": 295512, "num_comment": 2, "author": "supercoco", "tags": ["视频"], "text": "900Gb Cellebrite被窃数据，黑客正在泄露部分工具；Netgear路由器存在密码绕过漏洞，你是否中招;2016年数据泄露的前几名都是谁？"}
{"title": "打印机安全研究（一）：不容乐观的网络打印机安全状况", "url": "https://www.freebuf.com/articles/terminal/126259.html", "time": "2017-02-11", "level": "", "num_look": 543421, "num_comment": 2, "author": "clouds", "tags": ["特别企划", "终端安全"], "text": "在这篇文章中，我们总结了基于网络打印机的攻击场景概述，同时展示了攻击者可以如何入侵一台存在漏洞的打印机。"}
{"title": "观点：攻防对抗终将转变为AI大战", "url": "https://www.freebuf.com/news/126216.html", "time": "2017-02-11", "level": "", "num_look": 194141, "num_comment": 1, "author": "bimeover", "tags": ["其他", "资讯"], "text": "安全人员不断改变着战略，但是在和黑客的战争中似乎还是失败了。"}
{"title": "国内某知名应用市场遭仿冒，EvilPea病毒也玩起O2O", "url": "https://www.freebuf.com/news/125918.html", "time": "2017-02-10", "level": "", "num_look": 206859, "num_comment": 5, "author": "AVLTeam", "tags": ["安全报告", "资讯"], "text": "病毒开发者也来蹭O2O的热点，将线上攻击与线下攻击结合，为感染用户提供“上门服务”……"}
{"title": "分析无线遥控器信号并制作Hack硬件进行攻击", "url": "https://www.freebuf.com/articles/wireless/126330.html", "time": "2017-02-10", "level": "现金奖励", "num_look": 670720, "num_comment": 8, "author": "ZMOM1031", "tags": ["无线安全", "终端安全"], "text": "无线遥控器在我们生活中非常常见。本文将针对最常见的3态8位遥控器介绍缺陷并设计Hack硬件攻击。"}
{"title": "大话蜜罐日志分析", "url": "https://www.freebuf.com/articles/web/126340.html", "time": "2017-02-10", "level": "现金奖励", "num_look": 692286, "num_comment": 28, "author": "Leon不会玩QEMU", "tags": ["WEB安全", "网络安全"], "text": "在部署蜜罐之后，会产生大量的日志，对于威胁情报而言，我们需要通过这些日志来提取其中的有用的数据，本文将会描述提取那些数据用来完成分析。"}
{"title": "钓鱼新套路：自动检查受害者输入的帐号密码是否真实", "url": "https://www.freebuf.com/articles/web/126210.html", "time": "2017-02-10", "level": "", "num_look": 322081, "num_comment": 2, "author": "cxt", "tags": ["WEB安全"], "text": "网络钓鱼者常常需要针对不同的银行和地区的伪造不同的钓鱼页面，但是PayPal的全球性和使用率却使得攻击者可以编织一张网，捞尽四海鱼。"}
{"title": "全球上百家银行和金融机构感染了一种“无文件”恶意程序，几乎无法检测", "url": "https://www.freebuf.com/news/126686.html", "time": "2017-02-09", "level": "红色标题", "num_look": 558244, "num_comment": 12, "author": "孙毛毛", "tags": ["资讯"], "text": "根据卡巴斯基发布的最新报告，超过140家美国、南美、欧洲和非洲的银行、通讯企业和政府机构感染了一种几乎无法被检测到的极为复杂的无文件恶意程序。"}
{"title": "中译语通科技有限（北京）公司诚意招聘安全人才", "url": "https://www.freebuf.com/jobs/126248.html", "time": "2017-02-09", "level": "", "num_look": 166773, "num_comment": 5, "author": "gyreg", "tags": ["安全招聘"], "text": "中译语通科技（北京）有限公司整合自然语言处理技术、大数据技术和40余年积累的亿万级语言大数据与服务经验，构建起“译见”大数据分析平台。"}
{"title": "安全众测平台HackerOne获得4000万美元C轮融资", "url": "https://www.freebuf.com/news/126655.html", "time": "2017-02-09", "level": "", "num_look": 192572, "num_comment": 4, "author": "bimeover", "tags": ["资讯"], "text": "HackerOne表示他们会把资金用于技术研发、业务扩展、壮大白帽子社区，计划白帽子数量将超过10万人。"}
{"title": "Zimperium开始悬赏Android和iPhone漏洞利用代码", "url": "https://www.freebuf.com/news/126231.html", "time": "2017-02-09", "level": "", "num_look": 213073, "num_comment": 213073, "author": "Alpha_h4ck", "tags": ["终端安全", "资讯"], "text": "该公司将在2017年提供150万美元的总预算来收购Google和苹果移动系统的N-day漏洞利用代码及利用方法。"}
{"title": "15万台打印机被黑，打印出了一堆奇怪的东西", "url": "https://www.freebuf.com/news/126336.html", "time": "2017-02-09", "level": "", "num_look": 321281, "num_comment": 16, "author": "bimeover", "tags": ["资讯"], "text": "据他本人声称，他控制这些打印机的目的是为了提高人们对打印机安全的认识，打印机在安全这块儿实在太薄弱了。"}
{"title": "用Hackrf One制作超级跑马机", "url": "https://www.freebuf.com/geek/126236.html", "time": "2017-02-09", "level": "现金奖励", "num_look": 1196112, "num_comment": 40, "author": "b41k3r", "tags": ["极客"], "text": "Hackrf one可以稳定的伪造 GPS 信号，并且不需要安装在接收设备上，只要是在发射范围内的接收机，都可能被伪造的信号欺骗，所以可以把它当做”超级跑马机”使用。"}
{"title": "Kali下常用安全工具中文参数说明（160个）", "url": "https://www.freebuf.com/sectool/125984.html", "time": "2017-02-09", "level": "现金奖励", "num_look": 1079892, "num_comment": 37, "author": "屌丝绅士", "tags": ["工具"], "text": "由于篇幅有限，只列举部分，ps：第一次发有什么不对的 还望各位大大指正"}
{"title": "有了漏洞扫描器，如何用好？一点不成熟的小总结", "url": "https://www.freebuf.com/articles/neopoints/126205.html", "time": "2017-02-09", "level": "现金奖励", "num_look": 1119247, "num_comment": 42, "author": "安惞", "tags": ["企业安全", "安全管理"], "text": "这里就讲一讲在甲方互联网公司，扫描器在具体实践中的用法，个人浅见，欢迎交流分享。"}
{"title": "115科技诚聘安全人才", "url": "https://www.freebuf.com/jobs/126316.html", "time": "2017-02-08", "level": "", "num_look": 205594, "num_comment": 12, "author": "路人Q", "tags": ["安全招聘"], "text": "115科技是一家拥有自主知识产权，以云存储为核心的互联网服务提供商。"}
{"title": "斗象科技2017春季招聘吹响集结号！", "url": "https://www.freebuf.com/jobs/126464.html", "time": "2017-02-08", "level": "红色标题", "num_look": 395422, "num_comment": 21, "author": "FB独家", "tags": ["安全招聘"], "text": "与我们一起扬帆起航、乘风破浪，打造创新力的科技产品与平台，驶向更具互联网精神的安全新世代。"}
{"title": "统计显示威胁情报并没有想象中那么好，原因在哪儿？", "url": "https://www.freebuf.com/articles/paper/126068.html", "time": "2017-02-08", "level": "", "num_look": 309248, "num_comment": 9, "author": "bimeover", "tags": ["企业安全", "安全报告"], "text": "77%的安全专家表示，威胁情报对企业安全而言非常关键；但仅有27%表示其组织有效地利用了威胁数据。问题出在哪儿？"}
{"title": "云计算如何冲破安全市场的“玻璃天花板”？FreeBuf专访阿里云云计算安全事业部资深总监肖力", "url": "https://www.freebuf.com/articles/people/125494.html", "time": "2017-02-08", "level": "", "num_look": 422563, "num_comment": 8, "author": "kuma", "tags": ["人物志"], "text": "如何突破信息安全市场的天花板？云计算大概是个不错的突破口。"}
{"title": "互联网企业安全建设之路：规划篇", "url": "https://www.freebuf.com/articles/security-management/126202.html", "time": "2017-02-08", "level": "现金奖励", "num_look": 1176908, "num_comment": 29, "author": "SecSky", "tags": ["企业安全", "安全管理"], "text": "这是一篇关于互联网企业安全建设的文章。作者希望借此把自己之前做过的和目前正在做的一些事情以及想法总结一下。"}
{"title": "又一款奇特的勒索软件：只要阅读两篇有关勒索软件的文章，就可以解锁！", "url": "https://www.freebuf.com/news/124633.html", "time": "2017-02-08", "level": "", "num_look": 321480, "num_comment": 14, "author": "Alpha_h4ck", "tags": ["系统安全", "资讯"], "text": "如果你不幸感染了这款勒索软件，你所要做的就是接受教育，阅读两篇关于网络安全意识的文章，好好学习一下勒索软件的相关知识"}
{"title": "AngularJS沙箱绕过：反射型XSS导致麦当劳用户密码泄露", "url": "https://www.freebuf.com/vuls/125932.html", "time": "2017-02-08", "level": "金币+7", "num_look": 474364, "num_comment": 6, "author": "heiben", "tags": ["WEB安全", "漏洞"], "text": "通过不安全加密存储漏洞和反射型服务端跨站脚本漏洞就可以盗取麦当劳用户密码，本文将演示作者是如何做到的"}
{"title": "针对北约成员国的恶意Office文档分析", "url": "https://www.freebuf.com/articles/system/126166.html", "time": "2017-02-07", "level": "", "num_look": 290218, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "可以对目标系统执行数据嗅探和踩点侦查，可以躲避安全产品的沙箱检测和虚拟分析，还可以利用Flash payload触发系统中的漏洞。"}
{"title": "是谁导致华盛顿特区70%的CCTV系统瘫痪？", "url": "https://www.freebuf.com/news/126082.html", "time": "2017-02-07", "level": "", "num_look": 217898, "num_comment": 6, "author": "cxt", "tags": ["资讯"], "text": "勒索软件的威胁在不断加剧，我们应当做好防范"}
{"title": "Anonymous攻陷暗网服务提供商Freedom Hosting II，约1/5暗网网站下线", "url": "https://www.freebuf.com/news/126335.html", "time": "2017-02-07", "level": "", "num_look": 413559, "num_comment": 6, "author": "cxt", "tags": ["网络安全", "资讯"], "text": "那些纵容儿童色情大行其道的网络提供商要小心了，也许下一个就是你"}
{"title": "安全管理该重视“社交关系”了，白名单也许是最佳方案", "url": "https://www.freebuf.com/articles/neopoints/125961.html", "time": "2017-02-07", "level": "", "num_look": 525488, "num_comment": 525488, "author": "vulture", "tags": ["安全管理", "观点"], "text": "OSI框架中的第八层应该是“管理”"}
{"title": "全解Google（谷歌）基础设施架构安全设计", "url": "https://www.freebuf.com/special/126159.html", "time": "2017-02-07", "level": "金币+7", "num_look": 696856, "num_comment": 9, "author": "clouds", "tags": ["企业安全", "安全报告"], "text": "本文针对谷歌技术基础设施的安全设计作了简要介绍，这些技术基础设施为谷歌全球信息系统提供了一系列安全防护。"}
{"title": "那些年我们“投（shua）”过的票（续）", "url": "https://www.freebuf.com/articles/web/125921.html", "time": "2017-02-07", "level": "现金奖励", "num_look": 546942, "num_comment": 15, "author": "西毒若相惜", "tags": ["WEB安全", "特别企划"], "text": "上篇的博主好像就死磕一个网站，使出了浑身解数与其进行对抗，最终胜利。这里我写一篇续集，来帮大家梳理一下几乎所有的刷票类型。刷票难度从简到难，循序渐进。"}
{"title": "51信用卡招聘安全工程师", "url": "https://www.freebuf.com/jobs/126185.html", "time": "2017-02-06", "level": "", "num_look": 318574, "num_comment": 24, "author": "51信用卡管家", "tags": ["安全招聘"], "text": ""}
{"title": "一个人的“安全部”", "url": "https://www.freebuf.com/articles/security-management/126254.html", "time": "2017-02-06", "level": "现金奖励", "num_look": 1789298, "num_comment": 63, "author": "LionZ", "tags": ["企业安全", "安全管理"], "text": "我在某教育公司负责公司整体安全，保护6000多万“熊孩子”的安全。"}
{"title": "【快讯】洲际酒店（IHG）集团旗下12家酒店遭遇大规模数据泄露", "url": "https://www.freebuf.com/news/126301.html", "time": "2017-02-06", "level": "", "num_look": 396072, "num_comment": 8, "author": "孙毛毛", "tags": ["资讯"], "text": "黑客利用恶意软件入侵了洲际酒店集团12家酒店的支付系统并窃取了信用卡信息。"}
{"title": "我与学校SafeConnect软件斗智斗勇的经历", "url": "https://www.freebuf.com/news/topnews/125994.html", "time": "2017-02-06", "level": "现金奖励", "num_look": 691182, "num_comment": 24, "author": "zasdfgbnm", "tags": ["其他", "头条"], "text": "看美国留学生如何与学校监视系统作斗争。"}
{"title": "GPS追踪工具Traccar体验", "url": "https://www.freebuf.com/sectool/125998.html", "time": "2017-02-06", "level": "现金奖励", "num_look": 588896, "num_comment": 35, "author": "syttc", "tags": ["工具"], "text": "成功体验GPS追踪工具Traccar"}
{"title": "好消息！最新Metasploit加入硬件测试功能", "url": "https://www.freebuf.com/sectool/126207.html", "time": "2017-02-06", "level": "", "num_look": 315140, "num_comment": 2, "author": "Sphinx", "tags": ["工具"], "text": "Metasploit测试框架现在加入了新功能，让用户更容易地进行硬件设备的分析测试。"}
{"title": "如何绕过Windows 10的CFG机制", "url": "https://www.freebuf.com/articles/system/126007.html", "time": "2017-02-05", "level": "", "num_look": 428973, "num_comment": 1, "author": "鸢尾", "tags": ["系统安全"], "text": "本文来源于我在2016年7月的研究结论，由于各种原因现在才能发布。"}
{"title": "基于开源程序漏洞的攻击在2017年将增长20%", "url": "https://www.freebuf.com/articles/security-management/125861.html", "time": "2017-02-05", "level": "", "num_look": 558457, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["企业安全", "安全报告"], "text": "管理开源组件的问题已经成为了一个非常棘手的问题。"}
{"title": "为什么我们不能再过度依赖网关了？", "url": "https://www.freebuf.com/articles/network/125569.html", "time": "2017-02-05", "level": "", "num_look": 388806, "num_comment": 5, "author": "kuma", "tags": ["网络安全", "观点"], "text": "过度依赖网关，会将数据、用户、客户、企业及其声誉置于风险之中。"}
{"title": "【快讯】卡巴斯基顶级安全研究员因叛国罪被捕，卡巴斯基回应“与我们无关”", "url": "https://www.freebuf.com/news/126249.html", "time": "2017-02-04", "level": "红色标题", "num_look": 298916, "num_comment": 9, "author": "欧阳洋葱", "tags": ["资讯"], "text": "俄罗斯当局逮捕卡巴斯基实验室的顶级安全研究人员Ruslan Stoyanov，罪名是叛国罪。"}
{"title": "企业安全拥抱开源之利用Freeipa实现Linux用户身份、权限的统一管理", "url": "https://www.freebuf.com/sectool/125387.html", "time": "2017-02-04", "level": "现金奖励", "num_look": 659675, "num_comment": 9, "author": "agui", "tags": ["企业安全", "工具"], "text": "在未部署统一身份管理系统时，管理员需要分别在每一台主机上为对应的系统管理员创建、维护账号和密码，无法进行统一的管理，统一身份认证系统可以帮助解决问题."}
{"title": "美国国防部DARPA想要创建安全数据共享技术", "url": "https://www.freebuf.com/news/125672.html", "time": "2017-02-04", "level": "", "num_look": 216931, "num_comment": 1, "author": "孙毛毛", "tags": ["资讯"], "text": "目前DARPA机构正试图寻求建议：如何使用手提式设备远程安全共享数据？"}
{"title": "大量开发者会将访问token和API密钥硬编码至Android应用", "url": "https://www.freebuf.com/articles/terminal/125544.html", "time": "2017-02-04", "level": "", "num_look": 547522, "num_comment": 5, "author": "cxt", "tags": ["数据安全", "终端安全"], "text": "将机密凭证硬编码到移动应用中的方式很可能导致关键数据泄漏。"}
{"title": "图解Meterpreter实现网络穿透的方法", "url": "https://www.freebuf.com/articles/network/125278.html", "time": "2017-02-04", "level": "", "num_look": 1329715, "num_comment": 10, "author": "鸢尾", "tags": ["网络安全"], "text": "本文我们将通过示例分析攻击者是如何运用各种方法进行网络穿透的。"}
{"title": "【漏洞预警】WordPress又曝漏洞：REST API由于权限控制失效致内容注入", "url": "https://www.freebuf.com/vuls/126120.html", "time": "2017-02-03", "level": "", "num_look": 434440, "num_comment": 7, "author": "漏洞盒子", "tags": ["漏洞"], "text": "WordPress再曝内容注入漏洞，影响到REST API。"}
{"title": "【漏洞预警】Windows SMBv3远程攻击0day漏洞威胁通告", "url": "https://www.freebuf.com/vuls/126100.html", "time": "2017-02-03", "level": "红色标题", "num_look": 837432, "num_comment": 10, "author": "360安全", "tags": ["漏洞"], "text": "未经身份验证的攻击者可以迫使受影响系统蓝屏崩溃，此漏洞也存在进一步远程执行代码的高危风险。"}
{"title": "大量Netgear路由器存在密码绕过漏洞，来看你家路由器是否中枪", "url": "https://www.freebuf.com/news/126063.html", "time": "2017-02-03", "level": "红色标题", "num_look": 598935, "num_comment": 34, "author": "孙毛毛", "tags": ["漏洞", "资讯"], "text": "Netgear路由器又遭遇一起严重安全漏洞，影响范围包括数十种路由器型号。"}
{"title": "机器学习与人工智能将应用于哪些安全领域？", "url": "https://www.freebuf.com/articles/neopoints/125625.html", "time": "2017-02-03", "level": "红色标题", "num_look": 423514, "num_comment": 2, "author": "bimeover", "tags": ["特别企划", "观点"], "text": "机器学习正在不断加的加快前进的脚步，是时候来探讨这个问题了。人工智能真的能在未来对抗网络攻击，自主地保护我们的系统吗？"}
{"title": "怕被删帖？试试这款去中心化的建站平台吧！", "url": "https://www.freebuf.com/sectool/125936.html", "time": "2017-02-03", "level": "", "num_look": 608061, "num_comment": 13, "author": "Sphinx", "tags": ["工具", "网络安全"], "text": "ZeroNet是一款新的去中心化P2P网络，他能够让用户规避审查，并且保障用户隐私。"}
{"title": "PentestBox入门实战教程", "url": "https://www.freebuf.com/sectool/125881.html", "time": "2017-02-03", "level": "金币+8", "num_look": 1245514, "num_comment": 14, "author": "lr3800_", "tags": ["工具"], "text": "PentestBox是一款Windows平台下预配置的便携式开源渗透测试环境，它不同于运行在虚拟机或者双启动环境的Linux渗透测试发行版。"}
{"title": "使用Sysmon和Splunk探测网络环境中横向渗透", "url": "https://www.freebuf.com/sectool/125846.html", "time": "2017-02-03", "level": "金币+17", "num_look": 657814, "num_comment": 5, "author": "evileo", "tags": ["企业安全", "工具"], "text": "本篇文章介绍通过部署Sysmon并将日志发送到SIEM来探测横向渗透。"}
{"title": "从内网弱口令到公网智能路由器", "url": "https://www.freebuf.com/vuls/125271.html", "time": "2017-02-03", "level": "现金奖励", "num_look": 688057, "num_comment": 7, "author": "tonybreak", "tags": ["漏洞", "终端安全"], "text": "智能路由器听上去智能，实际上真的是这样吗？"}
{"title": "Android是今年的漏洞之王？CVE Details的数据根本就不靠谱！", "url": "https://www.freebuf.com/articles/neopoints/125701.html", "time": "2017-02-02", "level": "", "num_look": 289574, "num_comment": 2, "author": "cxt", "tags": ["观点"], "text": "Android如何荣膺2016漏洞之王？CVE Details的报告靠谱吗？"}
{"title": "法庭文件揭秘：美国联邦调查局是如何监听汽车15年的", "url": "https://www.freebuf.com/news/125433.html", "time": "2017-02-01", "level": "", "num_look": 220171, "num_comment": 8, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "我们每天所能接触到的电子设备几乎都可以接入网络，而其中的安全隐患则不容小觑。"}
{"title": "【FreeBuf年货】2017年你不能错过的13场海外顶级信息安全峰会", "url": "https://www.freebuf.com/news/125543.html", "time": "2017-01-31", "level": "", "num_look": 252185, "num_comment": 2, "author": "孙毛毛", "tags": ["特别企划", "资讯"], "text": "新年新气象，新一季的信息安全会议正在逼近。。。"}
{"title": "企业应该如何应对上报的安全漏洞报告？", "url": "https://www.freebuf.com/articles/security-management/125606.html", "time": "2017-01-31", "level": "", "num_look": 467296, "num_comment": 467296, "author": "Alpha_h4ck", "tags": ["企业安全", "安全管理"], "text": "虽然现在外面有很多人都非常愿意帮助你的企业去解决你们的安全问题，但企业是不是也应该思考一下如何通过自己的努力来处理这些安全问题呢？"}
{"title": "MBR勒索木马再度来袭：GoldenEye分析", "url": "https://www.freebuf.com/articles/system/124134.html", "time": "2017-01-30", "level": "", "num_look": 423489, "num_comment": 7, "author": "360安全", "tags": ["系统安全"], "text": "今年上半年，破坏力极强的修改MBR并加密MFT的勒索木马Petya就引起了高度关注，该作者下半年又出品了最新的勒索木马“GoldenEye”。"}
{"title": "【FreeBuf年终策划】2016年的黑客活动对政治造成了哪些影响", "url": "https://www.freebuf.com/articles/others-articles/125814.html", "time": "2017-01-30", "level": "", "num_look": 330758, "num_comment": 1, "author": "clouds", "tags": ["其他", "特别企划"], "text": "纵观历史，出于政治动机的网络攻击一直热衷于左右公众舆论来实现其特殊目的，攻击者不仅利用社交媒体来扰乱是非、传播谣言和造假新闻，对地区地缘政治造成了重要影响。"}
{"title": "Brave浏览器被曝安全漏洞：黑客可伪造网址欺骗用户", "url": "https://www.freebuf.com/news/125166.html", "time": "2017-01-29", "level": "", "num_look": 307032, "num_comment": 1, "author": "cxt", "tags": ["漏洞", "资讯"], "text": "近日，Hackerone上的安全人士披露了尘封3个月的Brave浏览器漏洞"}
{"title": "南非国有银行是如何看待勒索攻击的？", "url": "https://www.freebuf.com/articles/neopoints/125101.html", "time": "2017-01-29", "level": "", "num_look": 240287, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["企业安全", "观点"], "text": "2015年11月，南非第一国民银行收到了一封来自于黑客组织Armada Collective(无敌舰队)的勒索邮件，随后银行便遭受了一次具有挑衅性质的洪泛攻击（flood attack），但是银行所部属的安全防御系统成功地缓解了这次攻击。"}
{"title": "【FreeBuf年货】春节回家聊什么？你可以给长辈这些安全建议啊", "url": "https://www.freebuf.com/articles/others-articles/125608.html", "time": "2017-01-28", "level": "红色标题", "num_look": 400403, "num_comment": 6, "author": "kuma", "tags": ["其他", "特别企划"], "text": "先说各位新年好！现如今新潮的长辈也都用上互联网了，让一般群众也重视安全问题，来听听安全专家的建议。"}
{"title": "春节难得团聚，回家少玩手机", "url": "https://www.freebuf.com/news/125772.html", "time": "2017-01-26", "level": "红色标题", "num_look": 253996, "num_comment": 13, "author": "欧阳洋葱", "tags": ["其他", "资讯"], "text": "FreeBuf的小编们要回乡过年啦，你也在回家的路上了吗？"}
{"title": "对话信息共享与分析中心（ISAC）CEO：网络安全威胁信息共享的新挑战", "url": "https://www.freebuf.com/articles/security-management/125667.html", "time": "2017-01-26", "level": "", "num_look": 438956, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["安全管理"], "text": "我们采访到了IACI的首席执行官Michael Echols，此前他曾在美国国土安全部就职，当时他主要研究的是如何利用公共与私人合作关系来解决国家网络安全所面临的威胁。"}
{"title": "2016年CNVD漏洞数据统计：高危漏洞占比持续递增", "url": "https://www.freebuf.com/vuls/125951.html", "time": "2017-01-25", "level": "", "num_look": 701286, "num_comment": 3, "author": "CNCERT", "tags": ["安全报告", "漏洞"], "text": "2016年，国家信息安全漏洞共享平台（CNVD）共收录通用软硬件漏洞10822个。"}
{"title": "物联网究竟有多不安全？2016年IOT设备漏洞情况汇总", "url": "https://www.freebuf.com/articles/terminal/125947.html", "time": "2017-01-25", "level": "", "num_look": 496877, "num_comment": 496877, "author": "CNCERT", "tags": ["安全报告", "终端安全"], "text": "国家信息安全漏洞共享平台（以下简称CNVD）对2016年收录的IOT设备漏洞进行了统计，相关情况简报都在这里。"}
{"title": "Necurs要回来了，Locky还会远吗", "url": "https://www.freebuf.com/articles/system/125718.html", "time": "2017-01-25", "level": "", "num_look": 360526, "num_comment": 360526, "author": "华为未然实验室", "tags": ["系统安全"], "text": "在10月份，Locky还占据着全球恶意软件排行榜的首位，到了12月却跌出了前十。如果你以为Locky会就此谢幕，那你就错了。"}
{"title": "三星SmartCam智能摄像头曝高危命令注入漏洞，可被黑客完全控制", "url": "https://www.freebuf.com/vuls/125448.html", "time": "2017-01-25", "level": "", "num_look": 397795, "num_comment": 4, "author": "cxt", "tags": ["漏洞", "终端安全"], "text": "安全监控摄像头也不再安全"}
{"title": "Android系统中也存在Web注入吗？", "url": "https://www.freebuf.com/articles/terminal/125809.html", "time": "2017-01-25", "level": "", "num_look": 436008, "num_comment": 1, "author": "secist", "tags": ["数据安全", "终端安全"], "text": "我们正对这方面的攻击做深入的研究调查，并希望能给大家一个相对满意的答复。"}
{"title": "企业选购或厂商优化SIEM产品时应考虑哪些因素？", "url": "https://www.freebuf.com/articles/neopoints/125859.html", "time": "2017-01-24", "level": "金币+15", "num_look": 494123, "num_comment": 5, "author": "Carrie_spinfo", "tags": ["企业安全", "安全管理"], "text": "本文共包含4个部分：架构概述、SIEM功能、成本审核及其它服务。"}
{"title": "看我如何发现Facebook的ImageMagick漏洞并获得4万美元赏金", "url": "https://www.freebuf.com/vuls/125613.html", "time": "2017-01-24", "level": "金币+15", "num_look": 708280, "num_comment": 20, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文中我要和大家分享的是，我如何发现Facebook存在的ImageMagick漏洞。"}
{"title": "Cobalt strike在内网渗透中的使用", "url": "https://www.freebuf.com/sectool/125237.html", "time": "2017-01-24", "level": "现金奖励", "num_look": 893200, "num_comment": 19, "author": "yangxiaocheng", "tags": ["工具", "系统安全"], "text": "Cobalt strike不仅仅是用在钓鱼邮件，同时也是一款非常强大的内网渗透利器，下面我们就来介绍一下如何利用其在内网中配合一些脚本来横冲直撞。"}
{"title": "全球安全专业人才匮乏到什么程度？", "url": "https://www.freebuf.com/news/125716.html", "time": "2017-01-24", "level": "", "num_look": 270545, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["企业安全", "资讯"], "text": "全球范围内的各行各业目前都十分缺乏安全技术人才，而安全人才出现断层也已经成为了一个不争的事实。"}
{"title": "2016年度Web漏洞统计之Exploit-db", "url": "https://www.freebuf.com/vuls/125382.html", "time": "2017-01-23", "level": "金币+15", "num_look": 635056, "num_comment": 8, "author": "youyou0635", "tags": ["WEB安全", "漏洞"], "text": "随着2016年的过去，新的一年到来，让我们针对web漏洞进行一次“大数据”分析。"}
{"title": "Python的无状态SYN快速扫描", "url": "https://www.freebuf.com/sectool/125491.html", "time": "2017-01-23", "level": "现金奖励", "num_look": 753276, "num_comment": 13, "author": "addadd", "tags": ["工具", "网络安全"], "text": "我们可以使用无状态的扫描，提升扫描速度。"}
{"title": "平安科技（深圳）信息安全与内控部安全产品团队招聘", "url": "https://www.freebuf.com/jobs/125390.html", "time": "2017-01-22", "level": "", "num_look": 263395, "num_comment": 3, "author": "foun", "tags": ["安全招聘"], "text": "平安科技安全产品团队成立于2015年4月，我们的使命是为集团提供监控、防范外星人的武器装备，强化我们的防御能力。"}
{"title": "美国陆军公布“Hack the Army”众测结果：修复118个漏洞，奖金超10万美元", "url": "https://www.freebuf.com/news/125847.html", "time": "2017-01-22", "level": "红色标题", "num_look": 259158, "num_comment": 1, "author": "bimeover", "tags": ["资讯"], "text": "美国陆军总共收到了416份漏洞报告，其中118个属有效报告，发现漏洞的白帽子们总奖金超过10万美元。"}
{"title": "WAF产品经理眼中比较理想的WAF", "url": "https://www.freebuf.com/articles/neopoints/125807.html", "time": "2017-01-22", "level": "金币+15", "num_look": 822338, "num_comment": 32, "author": "兜哥", "tags": ["企业安全", "特别企划"], "text": "我理想中的WAF部分功能有的厂商在做了，完全实现的还没有。"}
{"title": "专访”新世界黑客组织“成员Kapustkiy", "url": "https://www.freebuf.com/articles/people/125333.html", "time": "2017-01-22", "level": "", "num_look": 453964, "num_comment": 6, "author": "secist", "tags": ["人物志"], "text": "他正目不转睛的盯着电脑屏幕，飞快的敲打着键盘。没错，这就是他日常的工作状态。"}
{"title": "那些年我们“投（shua）”过的票", "url": "https://www.freebuf.com/articles/web/125470.html", "time": "2017-01-22", "level": "现金奖励", "num_look": 681451, "num_comment": 16, "author": "wadcl", "tags": ["WEB安全", "其他"], "text": "最近朋友圈中时不时有人要帮忙投个票啥的，又想起N年前，为了学习代码的同时能够更好的用于实战，想找一些事来做一做。"}
{"title": "美国保监部门重启调查：确定Anthem网络攻击是国家支持黑客所为", "url": "https://www.freebuf.com/news/125381.html", "time": "2017-01-22", "level": "", "num_look": 217186, "num_comment": 1, "author": "clouds", "tags": ["资讯"], "text": "国家支持黑客以窃取数据为目的对Anthem开展了网络攻击，但在公开版本的调查报告中没有提及具体攻击发起国家。"}
{"title": "【FB TV】一周「BUF大事件」：FireEye报告认定APT28具俄罗斯政府背景；Shadow Brokers宣布退隐江湖；google chrome的网页自动填充带隐患", "url": "https://www.freebuf.com/video/125796.html", "time": "2017-01-21", "level": "红色标题", "num_look": 307258, "num_comment": 6, "author": "supercoco", "tags": ["视频"], "text": "著名APT28黑客组织，尽是俄罗斯政府背后支持的；Shadow Brokers售卖NSA方程式小组工具效果不佳，退隐江湖？"}
{"title": "【FreeBuf年终策划】2016十大安全漏洞", "url": "https://www.freebuf.com/vuls/125559.html", "time": "2017-01-21", "level": "", "num_look": 445865, "num_comment": 4, "author": "secist", "tags": ["漏洞", "特别企划"], "text": ""}
{"title": "2016年，你被 DDoS 了吗？海内外数据大盘点", "url": "https://www.freebuf.com/articles/network/125372.html", "time": "2017-01-21", "level": "", "num_look": 396935, "num_comment": 10, "author": "腾讯云安全", "tags": ["网络安全"], "text": "有关 DDoS 攻击的事件实在太多太多，此处选取的5起在国际上都造成了一定影响力"}
{"title": "革命性创新？走近“高水准”新型勒索软件Spora", "url": "https://www.freebuf.com/special/125402.html", "time": "2017-01-21", "level": "", "num_look": 333597, "num_comment": 5, "author": "Carrie_spinfo", "tags": ["特别企划"], "text": "因其特有的功能以及高水准的技术与展示界面引起了我们的注意。本文不但会介绍Spora的内部工作原理，还将介绍其索取赎金的现代化商业模式。"}
{"title": "华为招聘网络安全架构师和设计师", "url": "https://www.freebuf.com/jobs/125083.html", "time": "2017-01-20", "level": "", "num_look": 338843, "num_comment": 13, "author": "wanganyu", "tags": ["安全招聘"], "text": "华为是全球领先的信息与通信技术（ICT）解决方案供应商"}
{"title": "BlackHole重出江湖：一次针对专业军事论坛的“游击式”挂马事件分析报告", "url": "https://www.freebuf.com/articles/web/125662.html", "time": "2017-01-20", "level": "", "num_look": 328930, "num_comment": 6, "author": "360安全", "tags": ["WEB安全"], "text": "军事论坛“军号网”上出现可疑的挂马行为，随即进行追踪分析。经过进一步确认，发现这很可能是有明确目标的针对性攻击事件。"}
{"title": "有关事件响应（IR）自动化和协同的几点反思", "url": "https://www.freebuf.com/articles/neopoints/125274.html", "time": "2017-01-20", "level": "", "num_look": 443814, "num_comment": 443814, "author": "FireFrank", "tags": ["企业安全", "安全管理"], "text": "就在本周，我重新回顾了几个有关事件响应（IR）自动化和协同的采访。很多专业从事网络安全的专业人士参与了这些采访，他们共同指出了一些值得我们反思的问题"}
{"title": "瑞星2016年中国信息安全报告", "url": "https://www.freebuf.com/articles/paper/125696.html", "time": "2017-01-20", "level": "", "num_look": 387688, "num_comment": 22, "author": "瑞星", "tags": ["安全报告"], "text": "近期，瑞星公司发布了《2016年中国信息安全报告》，对2016年1至12月的病毒、恶意网址、移动互联网及企业信息安全做了详细的分析，并对2017年的信息安全趋势做出了预测。"}
{"title": "你猜2016年最常用密码还会是“123456”吗？", "url": "https://www.freebuf.com/news/125374.html", "time": "2017-01-20", "level": "", "num_look": 389832, "num_comment": 29, "author": "cxt", "tags": ["资讯"], "text": "这是个值得探讨的问题，毕竟安全专家常年鼓励用户不要使用简单的密码，2016年的情况应该会好一些吧？"}
{"title": "使用Frida配合Burp Suite追踪API调用", "url": "https://www.freebuf.com/articles/web/125260.html", "time": "2017-01-20", "level": "", "num_look": 556205, "num_comment": 5, "author": "vulture", "tags": ["WEB安全"], "text": "Burp是用来进行web测试的工具，而对于移动应用的测试应该也大致相同。我想要让burp跟frida配合起来，截获/修改burp中的API调用。"}
{"title": "一种极为高效的钓鱼技术，骗取Gmail用户账户", "url": "https://www.freebuf.com/articles/web/125275.html", "time": "2017-01-20", "level": "金币+7", "num_look": 534373, "num_comment": 13, "author": "secist", "tags": ["WEB安全"], "text": "一种更加隐蔽有效的网络钓鱼技术，正试图骗取 Gmail 用户账户信息。"}
{"title": "小米安全中心招聘", "url": "https://www.freebuf.com/jobs/125599.html", "time": "2017-01-19", "level": "", "num_look": 314132, "num_comment": 11, "author": "小米安全中心", "tags": ["安全招聘"], "text": "小米科技有限责任公司成立于2010年4月，是一家专注于智能硬件和电子产品研发的移动互联网公司。"}
{"title": "FortiGuard实验室2017年网络安全行业趋势预测分析", "url": "https://www.freebuf.com/articles/neopoints/125016.html", "time": "2017-01-19", "level": "", "num_look": 259235, "num_comment": 4, "author": "Carrie_spinfo", "tags": ["安全报告", "观点"], "text": "新年伊始，FortiGuard威胁研究与响应实验室便马不停蹄地发布了2017年网络安全热点问题的研究报告。"}
{"title": "能DDoS的勒索木马FireCrypt进一步分析", "url": "https://www.freebuf.com/articles/database/125329.html", "time": "2017-01-19", "level": "", "num_look": 460171, "num_comment": 12, "author": "腾讯电脑管家", "tags": ["数据安全"], "text": "经分析，该类样本通过木马生成器自定义生成，运行该样本会对特定文件类型进行AES加密，同时伴随着持续但微弱的DDoS行为(请求特定网站下载文件)。"}
{"title": "GoDaddySSL验证过程出现bug，CA证书颁发自动化值得思考", "url": "https://www.freebuf.com/news/125186.html", "time": "2017-01-19", "level": "", "num_look": 218653, "num_comment": 3, "author": "FireFrank", "tags": ["资讯"], "text": "GoDaddy在注册商的域名验证过程中发现了一个bug，于2017年1月10日强制撤回超过6000个客户的SSL证书，并重新签发了新的SSL证书。"}
{"title": "添加Metasploit-payload到已有的Android项目中", "url": "https://www.freebuf.com/articles/terminal/125272.html", "time": "2017-01-19", "level": "现金奖励", "num_look": 458020, "num_comment": 6, "author": "xiaohuanshu", "tags": ["系统安全", "终端安全"], "text": "在写这篇文章之前，笔者可以说是对java一窍不通，也从来没有写过什么Android应用，就是在已有Apk源码的情况下，用了比较另类的方式，添加metasploit后门。"}
{"title": "WhatsApp的“后门”是故意为之，还是提升体验的副产品？", "url": "https://www.freebuf.com/news/125427.html", "time": "2017-01-18", "level": "", "num_look": 337414, "num_comment": 6, "author": "孙毛毛", "tags": ["终端安全", "资讯"], "text": "据说WhatsApp存在着这样一个后门：无论是公司或入侵者，更甚者包括情报机构，都可以在不破坏加密的情况下拦截并获取用户的加密信息。"}
{"title": "百度云招聘安全及安全研发岗位", "url": "https://www.freebuf.com/jobs/125525.html", "time": "2017-01-18", "level": "", "num_look": 411628, "num_comment": 51, "author": "孙毛毛", "tags": ["安全招聘"], "text": "百度云是百度基于多年技术积累推出的云计算产品，具有安全，稳定，高性能，高可扩展性的特点。"}
{"title": "看我如何利用漏洞窃取麦当劳网站注册用户密码", "url": "https://www.freebuf.com/vuls/125509.html", "time": "2017-01-18", "level": "", "num_look": 508144, "num_comment": 16, "author": "clouds", "tags": ["WEB安全", "漏洞"], "text": "本文讲述了利用不安全的加密存储漏洞和服务端反射型XSS漏洞，实现对麦当劳网站（McDonalds.com）注册用户的密码窃取。"}
{"title": "针对NETFLIX的新型钓鱼攻击的精妙之处", "url": "https://www.freebuf.com/articles/web/125257.html", "time": "2017-01-18", "level": "金币+8", "num_look": 351584, "num_comment": 6, "author": "华为未然实验室", "tags": ["WEB安全"], "text": "最近，火眼(FireEye)实验室发现了针对Netflix（一家在世界多国提供网络视频点播的公司）的一种新型网络钓鱼攻击，该攻击旨在窃取用户的信用卡数据和其他个人信息。"}
{"title": "在Python中重构vsFTPd后门漏洞", "url": "https://www.freebuf.com/vuls/125246.html", "time": "2017-01-18", "level": "金币+8", "num_look": 496247, "num_comment": 10, "author": "zusheng", "tags": ["漏洞", "系统安全"], "text": "在本文中，我们将重新用Python来一步步的编写这个漏洞的利用程序，主要是触发后门然后连接shell"}
{"title": "如何破解12位+字符的高强度密码？", "url": "https://www.freebuf.com/articles/database/125051.html", "time": "2017-01-18", "level": "金币+8", "num_look": 957948, "num_comment": 20, "author": "secist", "tags": ["数据安全", "特别企划"], "text": "在这篇文章，我将演示 Hashcat的组合及混合 两种攻击方式。这些例子将让你看到，攻击者是如何利用那些硬件设备，来对那些所谓的高强度密码，进行有效攻击的。"}
{"title": "新晋漏洞攻击套件Sundown Exploit Kits分析", "url": "https://www.freebuf.com/vuls/125168.html", "time": "2017-01-18", "level": "", "num_look": 335073, "num_comment": 2, "author": "亚信安全", "tags": ["漏洞"], "text": "今年五月开始Nuclear EK开始逐渐销声匿迹，Angler EK 也几乎在同一时间消失了。这一现象可能与相关的俄罗斯黑客组织被捕有关。"}
{"title": "腾讯安全招聘", "url": "https://www.freebuf.com/jobs/125418.html", "time": "2017-01-17", "level": "", "num_look": 418628, "num_comment": 25, "author": "匿名1668", "tags": ["安全招聘"], "text": "腾讯安全招聘高级风险控制工程师&项目管理高级工程师。"}
{"title": "Apache shiro 1.2.4版本远程命令执行漏洞详解", "url": "https://www.freebuf.com/articles/system/125187.html", "time": "2017-01-17", "level": "现金奖励", "num_look": 573760, "num_comment": 10, "author": "zhujunboabc", "tags": ["系统安全"], "text": "网上关于apache shiro 1.2.4版本的漏洞整理报告写的过于的简单，或许是大佬们讲的比较专业，我这个小白看不懂的缘故，特地在本地做一次完整的展现。"}
{"title": "扩充僵尸网络至企业内网核心区", "url": "https://www.freebuf.com/articles/system/125177.html", "time": "2017-01-17", "level": "金币+8", "num_look": 460377, "num_comment": 14, "author": "Sh4dow@foxmail.com", "tags": ["系统安全"], "text": "这次我们使用一个很老的漏洞抓取肉鸡，发现还是能找到1000多台全球主机，基本都在企业内网，包括国内外知名企业。"}
{"title": "用Raspberry Pi Zero打造“即插即用”的Web服务器", "url": "https://www.freebuf.com/geek/125145.html", "time": "2017-01-17", "level": "金币+8", "num_look": 607305, "num_comment": 19, "author": "yfgeek", "tags": ["极客"], "text": "虽然Raspberry Pi Zero只有4.5英镑，非常便宜，但确实具有局限性，由于缺少网口、WiFi，功能比较单一，可曾设想，用它打造一个完美的“即插即用”的Web服务器？"}
{"title": "安全抽象：网络安全生态系统从复杂臃肿到有效自动化的发展之道", "url": "https://www.freebuf.com/articles/neopoints/125175.html", "time": "2017-01-17", "level": "", "num_look": 459384, "num_comment": 6, "author": "clouds", "tags": ["安全管理", "观点"], "text": "我们的网络安全生态系统需要：简化！这是安全的根本性挑战"}
{"title": "利用Volatility进行Windows内存取证分析(二)：内核对象、内核池学习小记", "url": "https://www.freebuf.com/sectool/124800.html", "time": "2017-01-17", "level": "现金奖励", "num_look": 530739, "num_comment": 8, "author": "ExpLife", "tags": ["工具", "系统安全"], "text": "windows下内存取证的内容概括起来讲就是检测系统中有没有恶意程序,有没有隐藏进程,有没有隐藏文件,有没有隐藏服务,有没有隐藏的驱动,有没有隐藏网络端口等等."}
{"title": "深圳市安络科技有限公司招聘渗透测试工程师", "url": "https://www.freebuf.com/jobs/124926.html", "time": "2017-01-16", "level": "", "num_look": 428674, "num_comment": 44, "author": "ghost119", "tags": ["安全招聘"], "text": "安络科技有限公司诚聘渗透测试工程师"}
{"title": "观点：洋葱服务为什么没被成功接盘？", "url": "https://www.freebuf.com/articles/neopoints/125284.html", "time": "2017-01-16", "level": "金币+8", "num_look": 463005, "num_comment": 7, "author": "flashoop", "tags": ["观点"], "text": "昨天一条朋友圈的文章被刷屏了，国内身份认证服务产品洋葱即将全部停止服务。"}
{"title": "绕过网站安全狗拦截，上传Webshell技巧总结（附免杀PHP一句话）", "url": "https://www.freebuf.com/articles/web/125084.html", "time": "2017-01-16", "level": "现金奖励", "num_look": 1099126, "num_comment": 40, "author": "1_2", "tags": ["WEB安全"], "text": "这篇文章我介绍一下我所知道的绕过网站安全狗上传WebShell的方法。"}
{"title": "中国安全行业的下一波春天在哪儿？FreeBuf对话威胁情报专家、知名安全投资人金湘宇", "url": "https://www.freebuf.com/articles/people/124958.html", "time": "2017-01-16", "level": "红色标题", "num_look": 677591, "num_comment": 16, "author": "欧阳洋葱", "tags": ["人物志"], "text": "任何一个行业的发展，从长远的角度来看，它一定会有很多次朝阳，也会有很多次‘不朝阳’。这和大海的涨潮退潮、四季的更替是一样的。安全行业也不例外。"}
{"title": "一款能在GitHub代码库中探测密钥的工具：Truffle Hog", "url": "https://www.freebuf.com/sectool/125037.html", "time": "2017-01-16", "level": "", "num_look": 372834, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["工具"], "text": "这款名叫“Truffle Hog”的免费开源工具可以帮助开发人员检测自己在GitHub上发布的项目代码是否意外泄漏了密钥。"}
{"title": "FireEye发布报告《风暴中心的APT28》：揭秘俄罗斯政府操控的黑客组织APT28", "url": "https://www.freebuf.com/news/125295.html", "time": "2017-01-15", "level": "红色标题", "num_look": 532378, "num_comment": 8, "author": "cxt", "tags": ["资讯"], "text": "FireEye发布黑客活动分析报告，目标直指APT28。FireEye的报告提到，APT28由俄罗斯政府幕后操纵，从先前奥运会的兴奋剂丑闻到美国总统大选干涉都有其身影。"}
{"title": "智能电量表和电气设施都存在安全隐患", "url": "https://www.freebuf.com/news/124574.html", "time": "2017-01-15", "level": "", "num_look": 286997, "num_comment": 16, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "智能电表中严重的安全漏洞将会继续让用户和电力基础设施暴露于恶意网络攻击的安全风险之中。但更加可怕的是，有些安全专家认为黑客甚至可以直接让这些智能电表爆炸。"}
{"title": "新手指南：如何用Ettercap实现“中间人攻击”（附下载链接）", "url": "https://www.freebuf.com/sectool/125104.html", "time": "2017-01-15", "level": "", "num_look": 793366, "num_comment": 15, "author": "Carrie_spinfo", "tags": ["工具"], "text": "Ettercap是一款实现“中间人攻击”的多功能工具，具有嗅探实时连接、内容过滤以及其它非常有趣的功能。"}
{"title": "使用电蚊拍DIY USBKILL", "url": "https://www.freebuf.com/sectool/124949.html", "time": "2017-01-15", "level": "现金奖励", "num_look": 672494, "num_comment": 30, "author": "lr3800_", "tags": ["工具", "极客"], "text": "如何DIY一个低成本的USB杀手"}
{"title": "史上导致数百万美元损失的10大计算机漏洞", "url": "https://www.freebuf.com/vuls/124449.html", "time": "2017-01-14", "level": "", "num_look": 385163, "num_comment": 2, "author": "clouds", "tags": ["漏洞", "特别企划"], "text": ""}
{"title": "众安保险推出免费电信诈骗保险", "url": "https://www.freebuf.com/news/125078.html", "time": "2017-01-14", "level": "", "num_look": 286197, "num_comment": 10, "author": "bimeover", "tags": ["其他", "资讯"], "text": "现在居然有针对电话诈骗的保险了。"}
{"title": "Shadow Brokers决定退隐江湖，并放出方程式免费入侵工具（附下载地址）", "url": "https://www.freebuf.com/news/124990.html", "time": "2017-01-14", "level": "红色标题", "num_look": 1572085, "num_comment": 49, "author": "bimeover", "tags": ["工具", "资讯"], "text": "Shadow Brokers宣布退隐江湖，停止售卖黑客工具。"}
{"title": "【FB TV】一周「BUF大事件」：支付宝被曝“致命”漏洞；ODNI报告指控俄罗斯干涉美国大选；MongoDB数据被疯狂屠戮", "url": "https://www.freebuf.com/video/125266.html", "time": "2017-01-14", "level": "红色标题", "num_look": 229786, "num_comment": 2, "author": "supercoco", "tags": ["视频"], "text": "支付宝被曝漏洞，“熟人可百分百修改登陆密码”；ODNI报告扯出猛料；MongoDB遭到入侵、勒索的数据库数量持续上升。"}
{"title": "观点：“被客户”安全评估背后的那些血与泪", "url": "https://www.freebuf.com/articles/neopoints/124798.html", "time": "2017-01-14", "level": "", "num_look": 213097, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["特别企划", "观点"], "text": "事实上，他们一般都只是直接运行Nessus、Qualys或Nmap来进行检查的…"}
{"title": "新华三集团安全产品线招聘", "url": "https://www.freebuf.com/jobs/125149.html", "time": "2017-01-13", "level": "", "num_look": 346622, "num_comment": 17, "author": "yangguo5257", "tags": ["安全招聘"], "text": "新华三集团是全球领先的新IT解决方案领导者，致力于新IT解决方案和产品的研发、生产、咨询、销售及服务"}
{"title": "手机破解专家Cellebrite公司被黑，900GB数据泄露", "url": "https://www.freebuf.com/news/125218.html", "time": "2017-01-13", "level": "红色标题", "num_look": 387621, "num_comment": 5, "author": "cxt", "tags": ["资讯"], "text": "猎人被狐狸咬了一口——这是一个专门破解他人数据的公司自身被破解的故事。"}
{"title": "一场屠戮MongoDB的盛宴反思：超33000个数据库遭遇入侵勒索", "url": "https://www.freebuf.com/articles/database/125127.html", "time": "2017-01-13", "level": "", "num_look": 1000718, "num_comment": 4, "author": "cxt", "tags": ["数据安全"], "text": "不做好数据库安全，下一个被盯上的也许是你"}
{"title": "阿里巴巴直播防控中的实人认证技术", "url": "https://www.freebuf.com/articles/others-articles/124975.html", "time": "2017-01-13", "level": "", "num_look": 240795, "num_comment": 5, "author": "阿里聚安全", "tags": ["其他"], "text": "网络直播在进行实人认证时，需要对主播进行识别。阿里聚安全实人认证中的技术能够大大提供自动化认证率和审核效率。"}
{"title": "利用Cobalt strike一步步教你发送钓鱼邮件", "url": "https://www.freebuf.com/sectool/124905.html", "time": "2017-01-13", "level": "现金奖励", "num_look": 936699, "num_comment": 16, "author": "yangxiaocheng", "tags": ["工具"], "text": "试着利用Cobalt strike进行钓鱼邮件的制作及发送"}
{"title": "乌克兰又断电了，看Ukrenergo断电事件的技术分析与防护方案", "url": "https://www.freebuf.com/articles/system/124979.html", "time": "2017-01-13", "level": "", "num_look": 508615, "num_comment": 10, "author": "绿盟科技", "tags": ["系统安全"], "text": "Ukrenergo是乌克兰国内的主要能源供应企业，12月17日晚，该公司经历了一次供电故障，影响部分变电站自动化控制系统，以下是绿盟对此事件的分析。"}
{"title": "Snuck：一款自动化XSS漏洞扫描工具（含下载）", "url": "https://www.freebuf.com/sectool/124845.html", "time": "2017-01-13", "level": "", "num_look": 1171378, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["工具"], "text": "snuck是一款自动化的漏洞扫描工具，它可以帮助你扫描Web应用中存在的XSS漏洞。"}
{"title": "易鑫车贷招聘资深信息安全工程师", "url": "https://www.freebuf.com/jobs/124969.html", "time": "2017-01-12", "level": "", "num_look": 433471, "num_comment": 34, "author": "王秦", "tags": ["安全招聘"], "text": "易鑫车贷诚聘资深信息安全工程师"}
{"title": "全球第三方反作弊游戏平台ESEA数据泄漏最新进展", "url": "https://www.freebuf.com/news/124987.html", "time": "2017-01-12", "level": "金币+12", "num_look": 249743, "num_comment": 1, "author": "FireFrank", "tags": ["资讯"], "text": "全球第三方反作弊游戏平台ESEA遭到敲诈勒索攻击，其泄漏的信息于上周末在网络上出现。"}
{"title": "CSO观点：企业建立漏洞奖励计划，就足够了吗？", "url": "https://www.freebuf.com/articles/security-management/124652.html", "time": "2017-01-12", "level": "", "num_look": 189349, "num_comment": 189349, "author": "Alpha_h4ck", "tags": ["企业安全", "安全管理"], "text": "许多企业本身也聘请安全专家，但为什么还要设立漏洞奖励计划呢？而且实际上，企业设立漏洞奖励计划也面临诸多挑战。"}
{"title": "PHPMailer任意文件读取漏洞分析（CVE-2017-5223）", "url": "https://www.freebuf.com/vuls/124820.html", "time": "2017-01-12", "level": "现金奖励", "num_look": 806310, "num_comment": 5, "author": "Yxlink", "tags": ["漏洞"], "text": "PHPMailer低于5.2.21版本存在任意文件读取漏洞，成功利用该漏洞，可获取服务器中的任意文件内容。"}
{"title": "看我是如何跟羊毛党战斗的之我也变成羊毛党", "url": "https://www.freebuf.com/articles/web/124883.html", "time": "2017-01-12", "level": "现金奖励", "num_look": 824248, "num_comment": 39, "author": "西毒若相惜", "tags": ["WEB安全", "其他"], "text": "快钱、飞凡双旦活动已经过去，这里跟大家分享下我是如何跟羊毛党战斗的。"}
{"title": "【FreeBuf年终策划】盘点2016年针对苹果Mac系统的恶意软件（附样本下载）", "url": "https://www.freebuf.com/articles/system/124728.html", "time": "2017-01-12", "level": "", "num_look": 465085, "num_comment": 4, "author": "clouds", "tags": ["特别企划", "系统安全"], "text": "就2016年出现的Mac系统恶意软件作一些盘点分析，并对每个恶意软件的功能特点、感染方式、驻留机制及清除方法作出描述说明。"}
{"title": "有趣！10个你不得不知的Linux终端游戏", "url": "https://www.freebuf.com/articles/others-articles/124743.html", "time": "2017-01-12", "level": "金币+12", "num_look": 940989, "num_comment": 8, "author": "secist", "tags": ["其他", "极客"], "text": "相比 Windows 系统，Linux 确实也少了许多的娱乐性。但是这篇文章可能会改变你的一些想法，其实 Linux 终端也有不少有意思的小游戏。"}
{"title": "上海前隆金融招聘安全专家", "url": "https://www.freebuf.com/jobs/124832.html", "time": "2017-01-11", "level": "", "num_look": 260648, "num_comment": 8, "author": "SixSixSix", "tags": ["安全招聘"], "text": "招聘内部信息安全专家、IT内审、内部安全体系建设人员等职位。"}
{"title": "看我如何发现Github企业版程序SQL注入漏洞并获得5000美刀赏金", "url": "https://www.freebuf.com/vuls/124864.html", "time": "2017-01-11", "level": "金币+12", "num_look": 568697, "num_comment": 14, "author": "clouds", "tags": ["漏洞"], "text": "通过下载GitHub企业版试用版本软件进行分析，作者花了一周时间，发现了其中存在的SQL注入漏洞，并获得了5000美元漏洞赏金。"}
{"title": "【你评论，我送书】无线电&硬件安全好书“年货”推荐啦", "url": "https://www.freebuf.com/fevents/124927.html", "time": "2017-01-11", "level": "红色标题", "num_look": 915664, "num_comment": 246, "author": "FB客服", "tags": ["活动"], "text": "当你的能力还驾驭不了你的目标，那你就该沉下心来历练；当你的才华还撑不起你的雄心，那就静下心来读书。"}
{"title": "付了钱也不解锁：进化为勒索软件的KillDisk越来越流氓了", "url": "https://www.freebuf.com/news/124783.html", "time": "2017-01-11", "level": "", "num_look": 304416, "num_comment": 11, "author": "Sphinx", "tags": ["资讯"], "text": "如果你不幸遭遇了Linux版KillDisk，建议你还是不要支付赎金了。"}
{"title": "如何找到SQL注入中的盐", "url": "https://www.freebuf.com/articles/web/124785.html", "time": "2017-01-11", "level": "", "num_look": 467139, "num_comment": 6, "author": "Avenger", "tags": ["WEB安全"], "text": "我们从相对简单的 SQL 盲注入手，展现其如何被利用到可以执行远程代码。在测试的过程中会用到 Dunacn"}
{"title": "美国联邦贸易委员会与D-Link撕上法庭，称其路由器安全性太差", "url": "https://www.freebuf.com/news/124824.html", "time": "2017-01-10", "level": "", "num_look": 244917, "num_comment": 1, "author": "cxt", "tags": ["终端安全", "资讯"], "text": "美联邦贸易委员会（FTC）于上周四控告台湾友讯集团（D-Link），称其生产的路由器和网络摄像头存在安全漏洞，用户面临被黑客攻击的风险。"}
{"title": "疑似俄罗斯黑客团体Fancy Bear使用的攻击程序源码文件", "url": "https://www.freebuf.com/articles/system/124775.html", "time": "2017-01-10", "level": "", "num_look": 480918, "num_comment": 6, "author": "clouds", "tags": ["特别企划", "系统安全"], "text": "近期，安全研究人员在Github上发现了疑似俄罗斯黑客团体Fancy Bear使用的网络攻击相关源代码程序，这些程序用于攻击端与受害端的通信控制。"}
{"title": "利用Volatility进行Windows内存取证分析(一)：初体验", "url": "https://www.freebuf.com/sectool/124690.html", "time": "2017-01-10", "level": "现金奖励", "num_look": 1005647, "num_comment": 10, "author": "ExpLife", "tags": ["工具"], "text": "Volatility是一款非常强大的内存取证工具，可以用于windows,linux,mac osx,android等系统内存取证。"}
{"title": "【更新支付宝回应】风控缺陷？支付宝曝“致命”漏洞，他人能改你的密码", "url": "https://www.freebuf.com/news/124847.html", "time": "2017-01-10", "level": "红色标题", "num_look": 1062256, "num_comment": 41, "author": "kuma", "tags": ["漏洞", "资讯"], "text": "就在刚才，支付宝被曝光“熟人可以修改登录密码”漏洞。据说“陌生人有1/5的机会登录你的支付宝，而熟人甚至100%可以登录你的支付宝”。"}
{"title": "使用OpenBTS基站测试物联网模块安全性", "url": "https://www.freebuf.com/articles/wireless/124147.html", "time": "2017-01-10", "level": "", "num_look": 1145039, "num_comment": 10, "author": "漏洞盒子", "tags": ["无线安全"], "text": "本文分享了如何通过SDR加开源项目搭建伪基站并使用伪基站的GPRS功能作为网关来进行GSM/GPRS网络测试，并对GSM模块的硬件流量进行拦截、分析、重放等。"}
{"title": "3xp10it自动化渗透测试框架1.0", "url": "https://www.freebuf.com/sectool/124615.html", "time": "2017-01-10", "level": "金币+9", "num_look": 508874, "num_comment": 24, "author": "quanyechavshuo", "tags": ["工具"], "text": "3xp10it是一个自动化渗透测试框架,目前没有做到完全自动化"}
{"title": "如何远程操控一场“物理入侵”：FreeBuf专访机器人安全研究者烧鸡", "url": "https://www.freebuf.com/articles/people/124681.html", "time": "2017-01-10", "level": "红色标题", "num_look": 550815, "num_comment": 22, "author": "孙毛毛", "tags": ["人物志"], "text": "走近令人脑洞大开的机器人“物理入侵”案背后。"}
{"title": "一款恶性Rootkit木马分析 ——“狼人杀”木马潜伏数十万台电脑", "url": "https://www.freebuf.com/articles/system/124001.html", "time": "2017-01-09", "level": "", "num_look": 462181, "num_comment": 11, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "该木马通过多种技术手段隐藏并保护自身，骗过了几乎所有安全软件的检测和查杀。"}
{"title": "ODNI最新报告：干涉美国大选的黑客活动就是普京“下令”发起的", "url": "https://www.freebuf.com/news/124762.html", "time": "2017-01-09", "level": "", "num_look": 231580, "num_comment": 7, "author": "kuma", "tags": ["资讯"], "text": "美国国家情报主任办公室发布最新报告《针对近期美国大选中俄罗斯活动与意图的评估》，提到就是俄罗斯总统普京“下令”发动网络攻击和宣传活动影响美国大选。"}
{"title": "机器学习对抗性攻击报告", "url": "https://www.freebuf.com/articles/neopoints/124614.html", "time": "2017-01-09", "level": "", "num_look": 528659, "num_comment": 5, "author": "百度安全实验室", "tags": ["观点"], "text": "科技的发展使人工智能离人类的生活越来越近，其中隐含的安全问题也渐渐引起顶级安全专家们的关注。"}
{"title": "蜜罐揭秘真实的Mirai僵尸网络", "url": "https://www.freebuf.com/articles/terminal/124717.html", "time": "2017-01-09", "level": "现金奖励", "num_look": 602010, "num_comment": 8, "author": "tigerlab", "tags": ["特别企划", "终端安全"], "text": "我们决定使出洪荒之力，通过构建针对性蜜罐系统，主动探测揭秘当前互联网上真实隐藏着的 Mirai僵尸网络。"}
{"title": "流氓软件化身“卫士”，携带病毒对抗安全软件", "url": "https://www.freebuf.com/articles/system/124548.html", "time": "2017-01-09", "level": "", "num_look": 797989, "num_comment": 13, "author": "火绒安全", "tags": ["系统安全"], "text": "近期我们接到用户反馈。刚刚装好的系统无法安装火绒安全软件，表现为：安装程序执行安装步骤到一半的时候，安装程序自己消失，除此以外浏览器首页也被恶意篡改。"}
{"title": "巡风扫描系统试用体验报告", "url": "https://www.freebuf.com/sectool/124365.html", "time": "2017-01-09", "level": "现金奖励", "num_look": 1649619, "num_comment": 53, "author": "nibiwodong", "tags": ["工具"], "text": "近期，同程SRC发布了巡风扫描系统，用于内网资产发现和漏洞扫描。"}
{"title": "来看一部追踪被盗手机的记录片《Find My Phone》", "url": "https://www.freebuf.com/news/124282.html", "time": "2017-01-08", "level": "", "num_look": 412284, "num_comment": 8, "author": "clouds", "tags": ["其他", "视频"], "text": "来自荷兰的电影系学生安东尼·范德梅尔曾有过手机被盗经历，他精心设计了一场追踪手机盗贼的戏，并把其拍摄成了记录片《寻找我的手机》。"}
{"title": "使用树莓派打造面部识别安全设备", "url": "https://www.freebuf.com/geek/123099.html", "time": "2017-01-08", "level": "", "num_look": 518324, "num_comment": 5, "author": "鸢尾", "tags": ["极客"], "text": "借助树莓派，纯手工打造的一款面部识别安全设备。"}
{"title": "为保护隐私而生，反取证操作系统：kodachi", "url": "https://www.freebuf.com/sectool/124486.html", "time": "2017-01-08", "level": "", "num_look": 710975, "num_comment": 11, "author": "secist", "tags": ["工具", "系统安全"], "text": "Kodachi Linux 是一款基于 Debian 8.6 的操作系统。它是专为保护用户隐私而设计的，因此具有高度的安全及匿名性，并具备反调查取证的特点。"}
{"title": "卫达安全诚聘信息安全专家", "url": "https://www.freebuf.com/jobs/124511.html", "time": "2017-01-07", "level": "", "num_look": 228763, "num_comment": 14, "author": "卫达安全", "tags": ["安全招聘"], "text": "北京卫达科技有限公司（VEDA）全球首创“智能动态防御”技术，致力于成为全球领先的网络安全技术服务提供商。"}
{"title": "美情报机构：俄罗斯涉嫌通过黑客攻击和散布虚假消息干预美国大选", "url": "https://www.freebuf.com/news/124662.html", "time": "2017-01-07", "level": "", "num_look": 169168, "num_comment": 6, "author": "clouds", "tags": ["资讯"], "text": "美国情报机构指出，俄罗斯黑客在美国大选期间对美发动了黑客攻击，但声明也认为俄罗斯并没有改变票数统计或干预投票过程。"}
{"title": "【FB TV】一周「BUF大事件」：FBI官网被黑，泄露数据已公布；俄罗斯干预美国大选的JAR报告之安全专家不同看法；Android获封年度“漏洞之王”", "url": "https://www.freebuf.com/video/124692.html", "time": "2017-01-07", "level": "红色标题", "num_look": 239373, "num_comment": 1, "author": "supercoco", "tags": ["视频"], "text": "FBI网站说黑就黑；俄罗斯干预美国大选的JAR报告然并软；2016年度Andriod系统以漏洞数量夺得榜首。"}
{"title": "【FreeBuf年终策划】2016年最活跃的五个黑客组织", "url": "https://www.freebuf.com/special/124452.html", "time": "2017-01-07", "level": "", "num_look": 293303, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["特别企划"], "text": "Freebuf将带领各位同学回顾一下2016年最顶尖的五大黑客组织，这些组织曾策划并发动了2016年最可怕的网络攻击。"}
{"title": "提权利器Cobalt Strike发布3.6版本", "url": "https://www.freebuf.com/sectool/122742.html", "time": "2017-01-06", "level": "", "num_look": 724200, "num_comment": 10, "author": "鸢尾", "tags": ["工具"], "text": "目前网上能找到3.5版本的破解版本，相关破解以及工具使用技巧在FB上资源还是挺多的。"}
{"title": "【更新官方回应】FBI网站被黑致数据泄露？官方称这根本是个骗局", "url": "https://www.freebuf.com/news/124547.html", "time": "2017-01-06", "level": "红色标题", "num_look": 467444, "num_comment": 19, "author": "bimeover", "tags": ["资讯"], "text": "黑客CyberZeist上个月入侵了FBI网站，并将获取到的几个备份文件公布在了Pastebin，数据内容包括姓名、SHA1加密密码、SHA1盐和电子邮件。"}
{"title": "流氓会武功：这款勒索软件不仅能勒索，还能DDoS", "url": "https://www.freebuf.com/articles/system/124618.html", "time": "2017-01-06", "level": "", "num_look": 426371, "num_comment": 4, "author": "secist", "tags": ["系统安全"], "text": "一款名为 FireCrypt 的勒索软件正悄然来袭。"}
{"title": "阿里巴巴直播内容风险防控中的AI力量", "url": "https://www.freebuf.com/articles/others-articles/124364.html", "time": "2017-01-06", "level": "", "num_look": 347439, "num_comment": 6, "author": "阿里聚安全", "tags": ["其他"], "text": "直播作为近来新兴的互动形态，其内容风险监控成为一个全新的课题。"}
{"title": "基于约束的SQL攻击", "url": "https://www.freebuf.com/articles/web/124537.html", "time": "2017-01-06", "level": "红色标题", "num_look": 960465, "num_comment": 29, "author": "鸢尾", "tags": ["WEB安全"], "text": "绝大部分开发者都意识到SQL注入漏洞的存在，在本文我想与读者共同去探讨另一种与SQL数据库相关的漏洞，其危害与SQL注入不相上下。"}
{"title": "【FreeBuf年终策划】2017年最好用的Android渗透工具合集", "url": "https://www.freebuf.com/sectool/124507.html", "time": "2017-01-06", "level": "金币+5", "num_look": 941762, "num_comment": 13, "author": "Alpha_h4ck", "tags": ["工具"], "text": "在这篇文章中，我们将会给大家介绍几款超级好用的Android端黑客工具，这些App不仅功能十分强大，而且使用起来也非常的简单。"}
{"title": "启明星辰集团招聘源代码检测工程师（北京）", "url": "https://www.freebuf.com/jobs/124354.html", "time": "2017-01-05", "level": "", "num_look": 246220, "num_comment": 21, "author": "qimingxingchenHR", "tags": ["安全招聘"], "text": "启明星辰公司是国内颇具实力的、拥有完全自主知识产权的网络安全产品、可信安全管理平台、安全服务与解决方案的综合提供商。"}
{"title": "Android当选“2016漏洞之王”", "url": "https://www.freebuf.com/news/124593.html", "time": "2017-01-05", "level": "", "num_look": 242818, "num_comment": 6, "author": "孙毛毛", "tags": ["资讯"], "text": "根据汇总CVE数据的网站出具的2016年度CVE Details报告显示，Andriod系统以523个漏洞位居榜首，成为名符其实的第一名。"}
{"title": "2016中国电脑恶意程序伪装与欺骗性研究报告", "url": "https://www.freebuf.com/articles/system/124350.html", "time": "2017-01-05", "level": "", "num_look": 371893, "num_comment": 1, "author": "360安全", "tags": ["安全报告", "特别企划"], "text": "本次报告专门针对这些被用户手动放行的，具有强烈欺骗性的恶意程序（简称：欺骗性恶意程序）进行深入的抽样分析研究。"}
{"title": "关于PHP7漏洞情况的通报", "url": "https://www.freebuf.com/vuls/124519.html", "time": "2017-01-05", "level": "", "num_look": 436772, "num_comment": 2, "author": "CNNVD", "tags": ["漏洞"], "text": "近日，国家信息安全漏洞库（CNNVD）收到多个关于“PHP7”漏洞情况的报送。"}
{"title": "全球最大成人网站安全做得很不错……", "url": "https://www.freebuf.com/articles/neopoints/124503.html", "time": "2017-01-05", "level": "", "num_look": 3259186, "num_comment": 17, "author": "bimeover", "tags": ["观点"], "text": "我发现PornHub（国外最大的成人网站）在安全方面似乎比某些‘安全’公司做的还要好一些……"}
{"title": "安卓无线渗透利器：Hijacker", "url": "https://www.freebuf.com/sectool/124156.html", "time": "2017-01-05", "level": "", "num_look": 1108383, "num_comment": 9, "author": "secist", "tags": ["工具", "无线安全"], "text": "Hijacker 是一个安卓平台下的无线渗透工具。"}
{"title": "浅析ReDoS的原理与实践", "url": "https://www.freebuf.com/articles/network/124422.html", "time": "2017-01-05", "level": "现金奖励", "num_look": 886408, "num_comment": 10, "author": "MyKings", "tags": ["网络安全"], "text": "攻击者可以构造特殊的字符串来大量消耗服务器的系统资源，造成服务器的服务中断或停止。"}
{"title": "Oracle的酒店管理平台RCE漏洞以及持卡人数据泄漏（CVE-2016-5663/4/5）", "url": "https://www.freebuf.com/vuls/123989.html", "time": "2017-01-05", "level": "", "num_look": 355892, "num_comment": 355892, "author": "鸢尾", "tags": ["漏洞", "系统安全"], "text": "Oracle Opera（原Micros Opera）是一款用于酒店集团订单管理的主流软件。凯悦和希尔顿等酒店就使用该软件来管理订单以及处理付款流程。"}
{"title": "PhpMailer、SwiftMailer、ZendMail接连曝RCE高危漏洞，影响数百万Web服务器", "url": "https://www.freebuf.com/news/124492.html", "time": "2017-01-04", "level": "红色标题", "num_look": 403912, "num_comment": 7, "author": "Sphinx", "tags": ["漏洞", "资讯"], "text": "研究人员发现了一个存在于一些常见的开源PHP库中的高危漏洞，黑客可以利用这个漏洞远程执行任意命令，存在漏洞的PHP库包括SwiftMailer、PhpMailer和ZendMail。"}
{"title": "美团点评技术工程部重金悬赏高级安全人才（北京、上海）", "url": "https://www.freebuf.com/jobs/124171.html", "time": "2017-01-04", "level": "", "num_look": 398826, "num_comment": 22, "author": "花小花", "tags": ["安全招聘"], "text": "美团点评是最大的本地服务电子商务平台。"}
{"title": "国际航空订票系统存在漏洞，可轻易取消、修改航班预约", "url": "https://www.freebuf.com/news/124348.html", "time": "2017-01-04", "level": "", "num_look": 334532, "num_comment": 4, "author": "bimeover", "tags": ["漏洞", "资讯"], "text": "每天几百万人使用的旅行订票系统居然是一个缺乏现代认证手段的不安全的系统。攻击者能够轻易地更改一个人预约、取消此人的航班。"}
{"title": "你所不知道的FIT 2017台前幕后大揭秘（附大会议题PPT）", "url": "https://www.freebuf.com/news/topnews/124133.html", "time": "2017-01-04", "level": "红色标题", "num_look": 380914, "num_comment": 8, "author": "bimeover", "tags": ["头条", "活动"], "text": "FIT 2017火爆台前及冰山之下的一面，治愈一下你们受伤的心灵。（要下载PPT的，请直接拉到文章最末）"}
{"title": "安全专家：俄罗斯干预美国大选的JAR报告并没有什么软用", "url": "https://www.freebuf.com/news/124373.html", "time": "2017-01-04", "level": "", "num_look": 205375, "num_comment": 5, "author": "孙毛毛", "tags": ["资讯"], "text": "继上周FBI和DHS发布联合报告，奥巴马对俄罗斯涉嫌干预美国大选进行制裁之后，事态进一步发酵，但发展的方向却好像并不是美国官方预期的那样。"}
{"title": "国内首个CTFcrack框架开发流程（附Git地址）", "url": "https://www.freebuf.com/sectool/124304.html", "time": "2017-01-04", "level": "金币+15", "num_look": 503828, "num_comment": 31, "author": "A先森", "tags": ["工具"], "text": "我开发了CTFcrackTools这个国内首个CTFcrack框架，很少上墙外找CTF工具。"}
{"title": "让你的安卓手机变成HID渗透工具之badandroid", "url": "https://www.freebuf.com/articles/terminal/124306.html", "time": "2017-01-04", "level": "现金奖励", "num_look": 756890, "num_comment": 15, "author": "7763sea", "tags": ["终端安全"], "text": "今天我们要实现的是用你的安卓手机实现HID攻击。由于usb通信需要修改内核才能实现所以需要更换内核。"}
{"title": "揭秘：Signal通讯加密APP究竟是如何避开审查的", "url": "https://www.freebuf.com/news/124351.html", "time": "2017-01-04", "level": "", "num_look": 634354, "num_comment": 8, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "关注通讯加密软件Signal的同学也许会知道，这个安全与加密社区中的翘楚一直都在与App在线审查做斗争。"}
{"title": "【FIT 2017精选】黑客 Only_guest 亲身讲述的三个“非主流诈骗”故事", "url": "https://www.freebuf.com/articles/people/124363.html", "time": "2017-01-03", "level": "红色标题", "num_look": 1171456, "num_comment": 37, "author": "谢幺", "tags": ["人物志", "特别企划"], "text": "这个轻松搞到马云马化腾周鸿祎的住址和电话，还曾定位全成都出租车轨迹的男人，在FIT 2017大会上，亲身讲述了自己遭遇的三次“非主流诈骗”的过程。"}
{"title": "MINIFILTER实现文件重定向之从分析到实现", "url": "https://www.freebuf.com/articles/system/124155.html", "time": "2017-01-03", "level": "金币+15", "num_look": 444473, "num_comment": 8, "author": "lzldhu", "tags": ["系统安全"], "text": "为了解决例如系统关键目录或者业务敏感目录被放入恶意的可执行程序或者网页文件等，一些安全软件会使用文件过滤驱动的技术结合一定的检测规则来达到保护系统和业务安全的一些目的。"}
{"title": "移动渗透测试平台搭建 - NetHunter 3.0", "url": "https://www.freebuf.com/sectool/124074.html", "time": "2017-01-03", "level": "现金奖励", "num_look": 1091307, "num_comment": 22, "author": "gowabby", "tags": ["工具"], "text": "NetHunter是一款专为渗透测试人员打造的基于CyanogenMod的android的第三方ROM的一个内核，通过精心的设计与技术实现了一些渗透工具的移植。"}
{"title": "对某路由器进行的渗透测试", "url": "https://www.freebuf.com/articles/terminal/124069.html", "time": "2017-01-03", "level": "现金奖励", "num_look": 1364643, "num_comment": 17, "author": "默安科技_影武者实验室", "tags": ["极客", "终端安全"], "text": "路由器渗透测试示例"}
{"title": "“微信支付大盗”来袭，有人被盗近万元", "url": "https://www.freebuf.com/articles/terminal/124040.html", "time": "2017-01-03", "level": "", "num_look": 740602, "num_comment": 22, "author": "安全豹", "tags": ["终端安全"], "text": "近日，猎豹移动安全实验室捕获到一类高度危险的盗取微信支付资金类的手机病毒，多款手机ROM和APP中均捆绑了该病毒。"}
{"title": "平安金科招聘信息安全工程师", "url": "https://www.freebuf.com/jobs/115004.html", "time": "2017-01-02", "level": "", "num_look": 356045, "num_comment": 21, "author": "欧阳洋葱", "tags": ["安全招聘"], "text": "平安金融科技是中国平安保险（集团）股份有限公司旗下重要成员之一。"}
{"title": "iOS 10 iMessage字符崩溃Bug又来了", "url": "https://www.freebuf.com/news/124291.html", "time": "2017-01-02", "level": "金币+15", "num_look": 485103, "num_comment": 14, "author": "yfgeek", "tags": ["漏洞", "资讯"], "text": "近日，黑客@vincedes3发现了一个Bug，该Bug同样利用了和当年iOS 8的iMessage短信Bug的类似手法，将一段恶意代码发送给受害者，受害者在接收短信后，浏览短信即可中招。"}
{"title": "“数据泄露界”的Google：神秘网站LeakedSource和它的30亿数据", "url": "https://www.freebuf.com/news/124149.html", "time": "2017-01-02", "level": "金币+15", "num_look": 424162, "num_comment": 9, "author": "clouds", "tags": ["特别企划", "资讯"], "text": "试试LeakedSource吧，一个被称为“数据泄露领域的Google搜索引擎”。"}
{"title": "2017年信息安全部门的工作会是什么样？", "url": "https://www.freebuf.com/articles/neopoints/123959.html", "time": "2017-01-02", "level": "", "num_look": 516902, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["安全管理", "特别企划"], "text": "转眼2017就到，这两年的安全行业变迁之快是很多人都不曾想见的，随之而来就是企业信息安全部门工作的变动。"}
{"title": "如何更好地预防移动端勒索软件的侵害？要从勒索软件的运行机制入手", "url": "https://www.freebuf.com/articles/terminal/123412.html", "time": "2017-01-01", "level": "", "num_look": 299227, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["终端安全", "观点"], "text": "我们将在这篇文章中讨论移动端勒索软件的检测和缓解思路。我们希望通过这些技术方面内容的分享，提升安全行业对移动端勒索软件的理解。"}
{"title": "【FreeBuf年终策划】2016十大最具国际影响力的黑客事件", "url": "https://www.freebuf.com/news/124246.html", "time": "2017-01-01", "level": "", "num_look": 347961, "num_comment": 6, "author": "secist", "tags": ["特别企划", "资讯"], "text": "在过去的 2016年，发生了许多大规模和令人震惊的网络攻击事件。"}
{"title": "2016，我的年终总结", "url": "https://www.freebuf.com/news/119689.html", "time": "2016-12-31", "level": "红色标题", "num_look": 443969, "num_comment": 33, "author": "孙毛毛", "tags": ["其他", "特别企划"], "text": "你所不知道的FreeBuf……内有年度宣传片放送！"}
{"title": "挑战中寻找机遇：FreeBuf2017互联网安全创新大会（FIT）次日素描", "url": "https://www.freebuf.com/news/topnews/124099.html", "time": "2016-12-31", "level": "", "num_look": 340294, "num_comment": 3, "author": "kuma", "tags": ["头条", "活动"], "text": "你看到的也许是问题，而他们看到的是机遇。"}
{"title": "PHP7曝出三个高危0-day漏洞，还有一个仍未修复", "url": "https://www.freebuf.com/news/124159.html", "time": "2016-12-31", "level": "", "num_look": 399688, "num_comment": 6, "author": "kuma", "tags": ["资讯"], "text": "PHP7出现三个高危0-day漏洞，可允许攻击者完全控制使用PHP语言的网站。"}
{"title": "年度盛誉揭晓 | WitAwards 2016互联网安全年度评选结果", "url": "https://www.freebuf.com/news/topnews/124132.html", "time": "2016-12-31", "level": "红色标题", "num_look": 421633, "num_comment": 3, "author": "FB独家", "tags": ["头条", "活动"], "text": "6个项目分别摘获年度品牌力量、年度技术变革、年度创新产品、年度安全云产品及服务、年度安全人物、年度安全团队奖项。"}
{"title": "2016年信息安全行业十大收购事件", "url": "https://www.freebuf.com/articles/others-articles/123831.html", "time": "2016-12-30", "level": "金币+10", "num_look": 480370, "num_comment": 6, "author": "SAINTSEC TEAM", "tags": ["其他", "安全管理"], "text": "2016年信息安全行业的十大收购事件"}
{"title": "FBI和DHS发布联合报告，奥巴马对俄罗斯涉嫌干预美国大选进行制裁", "url": "https://www.freebuf.com/news/124137.html", "time": "2016-12-30", "level": "", "num_look": 277352, "num_comment": 13, "author": "孙毛毛", "tags": ["资讯"], "text": "美国联邦调查局（FBI）和国土安全部（DHS）于12月29日发布了一份解密报告，报告中详细分析了俄罗斯如何干预美国大选。"}
{"title": "移动平台流量黑产研究：色情播放器类恶意软件产业链", "url": "https://www.freebuf.com/articles/terminal/124018.html", "time": "2016-12-30", "level": "红色标题", "num_look": 700767, "num_comment": 14, "author": "360手机卫士", "tags": ["安全报告", "特别企划"], "text": "这些可疑链接指向的文件均为名称具有诱惑性、图标暴露的色情播放器类恶意软件"}
{"title": "安全扫描神器Nmap 7.40新版发布，提升大规模扫描效率", "url": "https://www.freebuf.com/sectool/124060.html", "time": "2016-12-30", "level": "金币+10", "num_look": 516769, "num_comment": 7, "author": "jackyu", "tags": ["工具"], "text": "本次更新大幅度提升了Nmap在进行高频率、大规模扫描任务时的性能。"}
{"title": "合法练习黑客技术？这15个网站也许可以帮到你", "url": "https://www.freebuf.com/special/123961.html", "time": "2016-12-30", "level": "金币+10", "num_look": 1958067, "num_comment": 29, "author": "Alpha_h4ck", "tags": ["特别企划"], "text": "无论你是开发人员、安全专家、审计人员、或者是渗透测试人员，你都可以利用这些网站来提升你的黑客技术。"}
{"title": "FreeBuf 2017互联网安全创新大会视频&图文直播(已结束)", "url": "https://www.freebuf.com/fevents/123889.html", "time": "2016-12-29", "level": "红色标题", "num_look": 8128720, "num_comment": 92, "author": "kuma", "tags": ["活动"], "text": "一年一度，不容错过！"}
{"title": "黑市的医疗数据价格跌至10美元以下，黑客纷纷转向勒索软件", "url": "https://www.freebuf.com/news/123748.html", "time": "2016-12-29", "level": "", "num_look": 184686, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "一份研究报告显示，在今年的地下黑市市场中，各大医院的被盗医疗数据售价急剧下跌。"}
{"title": "把握时代脉动：FreeBuf 2017互联网安全创新大会（FIT）首日精彩速递", "url": "https://www.freebuf.com/fevents/124045.html", "time": "2016-12-29", "level": "红色标题", "num_look": 293437, "num_comment": 4, "author": "Sphinx", "tags": ["活动"], "text": "机遇是什么？一个逆势上扬的行当就是“机遇”。这样的机遇，在整个时代的大背景下，显得更为突兀，犹如心跳般一张一翕地表现出脉动。"}
{"title": "史上最大型广告欺诈活动Methbot：黑客是如何每天赚到500万美元的", "url": "https://www.freebuf.com/news/123681.html", "time": "2016-12-29", "level": "金币+10", "num_look": 268073, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "每天赚500万美元不是梦，只要你学会这种广告欺诈法！"}
{"title": "IoTSeeker：物联网设备默认密码扫描检测工具", "url": "https://www.freebuf.com/sectool/123977.html", "time": "2016-12-29", "level": "", "num_look": 499672, "num_comment": 12, "author": "clouds", "tags": ["工具"], "text": "IoTSeeker，Rapid7出品，是一款物联网默认密码凭据网络扫描工具。"}
{"title": "平安科技安全团队诚招安全工程师", "url": "https://www.freebuf.com/jobs/123145.html", "time": "2016-12-28", "level": "", "num_look": 191665, "num_comment": 2, "author": "hereholly", "tags": ["安全招聘"], "text": "平安科技（深圳）有限公司成立于2008年9月，是世界500强企业——中国平安保险（集团）股份有限公司旗下全资子公司，其前身为平安集团的信息管理中心。"}
{"title": "C++虚函数逆向教程（1）", "url": "https://www.freebuf.com/articles/system/123821.html", "time": "2016-12-28", "level": "金币+9", "num_look": 394573, "num_comment": 4, "author": "L-Team", "tags": ["特别企划", "系统安全"], "text": "关于C++程序的逆向，网络上已经有很多文章了，这些文章也或多或少的提到了虚函数。这篇文章中，我想着重介绍一下在代码量比较大的程序中我们应该如何处理虚函数。"}
{"title": "滥用Edge浏览器的“恶意站点警告”特性，实现地址栏欺骗", "url": "https://www.freebuf.com/articles/web/122924.html", "time": "2016-12-28", "level": "", "num_look": 524619, "num_comment": 1, "author": "鸢尾", "tags": ["WEB安全"], "text": "在Edge上用于防止驱动式攻击的SmartScreen技术，它可以屏蔽掉被列入黑名单的URL，本文就是通过滥用Edge浏览器的‘恶意站点警告’特性，实现地址栏欺骗。"}
{"title": "Fansmitter ：利用声波入侵物理隔离系统", "url": "https://www.freebuf.com/articles/wireless/123329.html", "time": "2016-12-28", "level": "", "num_look": 812873, "num_comment": 11, "author": "ArkTeam", "tags": ["其他", "无线安全"], "text": "本文就今年以色列本古里安大学Negev网络安全中心研究人员提出的利用声波从物理隔离系统中窃取数据的技术——Fansmitter进行较为深入的解读。"}
{"title": "恶意程序伪装成 Windows“另存为”对话框欺骗用户", "url": "https://www.freebuf.com/news/123711.html", "time": "2016-12-27", "level": "", "num_look": 325781, "num_comment": 5, "author": "secist", "tags": ["系统安全", "资讯"], "text": "恶意程序伪装成 Windows“另存为”对话框欺骗用户。"}
{"title": "使用Docker搭建Web漏洞测试环境", "url": "https://www.freebuf.com/sectool/123907.html", "time": "2016-12-27", "level": "现金奖励", "num_look": 944634, "num_comment": 14, "author": "MyKings", "tags": ["WEB安全", "工具"], "text": "有没有轻量级的能够快速搭建 Web 漏洞的测试环境呢? 答案是有的, 那就是 docker! 接下来我们就使用 docker 进行环境搭建。"}
{"title": "分享一些支持企业安全工作的免费工具", "url": "https://www.freebuf.com/sectool/123851.html", "time": "2016-12-27", "level": "", "num_look": 413552, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["企业安全", "工具"], "text": "目前市面上有很多功能强大的免费安全工具，包括情报工具、在软件开发阶段保证安全性的工具、渗透测试工具和取证工具等"}
{"title": "从雅虎10亿事件回顾数据泄露的这11年", "url": "https://www.freebuf.com/articles/database/123643.html", "time": "2016-12-27", "level": "", "num_look": 496924, "num_comment": 3, "author": "bimeover", "tags": ["数据安全", "特别企划"], "text": "借此机会我们回顾一下自2005年以来11年间规模最大、影响最深远的数据泄露。"}
{"title": "漏洞披露究竟怎么做更”合适“？看看美国相关部门怎么看", "url": "https://www.freebuf.com/articles/neopoints/123847.html", "time": "2016-12-27", "level": "", "num_look": 233372, "num_comment": 2, "author": "clouds", "tags": ["安全报告", "特别企划"], "text": "当安全研究者发现一个软件产品漏洞后，最好的漏洞披露方式是什么？"}
{"title": "七种方法绕过安卓手机锁屏", "url": "https://www.freebuf.com/articles/terminal/123862.html", "time": "2016-12-27", "level": "", "num_look": 1165033, "num_comment": 10, "author": "secist", "tags": ["终端安全"], "text": "别以为你锁屏我就没辙了！"}
{"title": "思科CloudCenter Orchestrator系统曝提权漏洞CVE-2016-9223", "url": "https://www.freebuf.com/vuls/123888.html", "time": "2016-12-26", "level": "", "num_look": 217316, "num_comment": 217316, "author": "bimeover", "tags": ["漏洞"], "text": "思科提醒用户Cisco CloudCenter Orchestrator系统存在提权漏洞——CVE-2016-9223，可能已经被用于网络攻击。"}
{"title": "巴诺NOOK电子书感染了广升的恶意程序，回传用户数据至中国……", "url": "https://www.freebuf.com/news/123879.html", "time": "2016-12-26", "level": "", "num_look": 351695, "num_comment": 2, "author": "kuma", "tags": ["终端安全", "资讯"], "text": "LinuxJournal发现巴诺新款NOOK电子书也用了回传数据的广升固件。"}
{"title": "布谷鸟沙箱初体验", "url": "https://www.freebuf.com/articles/system/123816.html", "time": "2016-12-26", "level": "现金奖励", "num_look": 1016712, "num_comment": 34, "author": "ExpLife", "tags": ["系统安全"], "text": "最近笔者体验了一下布谷鸟这款开源的沙箱，按照官方文档搭建环境的时候遇到了各种各样安装报错的情况，所以笔者将成功搭建流程以及自动化分析样本的流程记录了下来。"}
{"title": "使用第三方库进行软件开发的安全风险研究", "url": "https://www.freebuf.com/articles/security-management/123359.html", "time": "2016-12-26", "level": "金币+9", "num_look": 505500, "num_comment": 6, "author": "clouds", "tags": ["安全管理"], "text": "很多软件由于长期使用第三方库文件，导致了持续的安全问题。"}
{"title": "BackdoorMan，帮你找到系统中的后门文件", "url": "https://www.freebuf.com/sectool/123189.html", "time": "2016-12-26", "level": "", "num_look": 469582, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["工具"], "text": "BackdoorMan是一款采用Python语言开发的开源工具，它可以帮助你找出系统中的恶意文件、隐藏的PHP脚本以及可疑的Shell脚本。"}
{"title": "【FreeBuf年终策划】2016年Exploit Kits漏洞TOP 10分析", "url": "https://www.freebuf.com/vuls/123328.html", "time": "2016-12-25", "level": "", "num_look": 1234149, "num_comment": 5, "author": "dawner", "tags": ["安全报告", "漏洞"], "text": "本文将简单介绍2016年漏洞工具包（Exploit Kits）中的漏洞榜TOP 10。"}
{"title": "新手指南：DVWA-1.9全级别教程（完结篇，附实例）之XSS", "url": "https://www.freebuf.com/articles/web/123779.html", "time": "2016-12-25", "level": "金币+9", "num_look": 6137189, "num_comment": 43, "author": "lonehand", "tags": ["WEB安全"], "text": "本篇为完结篇，介绍XSS模块的相关内容。"}
{"title": "平安科技信息安全及内控部招聘", "url": "https://www.freebuf.com/jobs/123737.html", "time": "2016-12-25", "level": "", "num_look": 252768, "num_comment": 6, "author": "seablue", "tags": ["安全招聘"], "text": "平安科技招聘云安全产品经理"}
{"title": "测试加密方案中的缺陷？试试谷歌的这款工具（附下载地址）", "url": "https://www.freebuf.com/sectool/123679.html", "time": "2016-12-25", "level": "", "num_look": 224886, "num_comment": 224886, "author": "bimeover", "tags": ["工具"], "text": "Wycheproof是谷歌开源的加密库测试项目，它包含一系列安全测试，用来检测加密库（cryptographic libraries）软件是否存在已知的攻击漏洞。"}
{"title": "调查显示，越来越多的攻击活动不再依赖恶意软件了", "url": "https://www.freebuf.com/articles/paper/123246.html", "time": "2016-12-25", "level": "", "num_look": 243872, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["安全报告"], "text": "根据CarbonBlack的最新研究报告，现在越来越多的攻击者在进行恶意活动时并不需要依赖恶意软件了。"}
{"title": "微众银行安全招聘，期待有梦想的各位加入", "url": "https://www.freebuf.com/jobs/123572.html", "time": "2016-12-24", "level": "", "num_look": 285388, "num_comment": 13, "author": "k2016", "tags": ["安全招聘"], "text": "微众银行安全招聘，期待有梦想的各位加入"}
{"title": "流行应用AddThis存在postMessage XSS漏洞漏洞，百万站点受影响", "url": "https://www.freebuf.com/news/123284.html", "time": "2016-12-24", "level": "", "num_look": 274080, "num_comment": 2, "author": "鸢尾", "tags": ["漏洞", "资讯"], "text": ""}
{"title": "恶意程序分析利器PowerShellArsenal", "url": "https://www.freebuf.com/sectool/123524.html", "time": "2016-12-24", "level": "金币+10", "num_look": 359656, "num_comment": 9, "author": "zusheng", "tags": ["工具"], "text": "PowerShellArsenal是一个PowerShell模块，它的功能是帮助逆向工程师来分析.NET恶意软件"}
{"title": "KALI LINUX安装Metasploitable 3", "url": "https://www.freebuf.com/sectool/123290.html", "time": "2016-12-24", "level": "", "num_look": 965038, "num_comment": 24, "author": "SAINTSEC TEAM", "tags": ["工具"], "text": "为了满足你们强烈的欲望，这里就再介绍一下KALI Linux 最新版环境下安装Metasploitable 3的步骤吧"}
{"title": "【第二届漏洞马拉松】这可能是年底最后一波互联网漏洞奖金大放送", "url": "https://www.freebuf.com/news/123745.html", "time": "2016-12-23", "level": "红色标题", "num_look": 258534, "num_comment": 4, "author": "漏洞盒子", "tags": ["资讯"], "text": "我们期待通过你我的努力让整个互联网生态更加健康与安全，也让白帽子的智慧与发现更具价值。"}
{"title": "海康威视萤石安全岗位招聘", "url": "https://www.freebuf.com/jobs/123769.html", "time": "2016-12-23", "level": "", "num_look": 234887, "num_comment": 7, "author": "sp7test", "tags": ["安全招聘"], "text": "萤石安全组成立于2013年7月1日，目前已经形成了明确的安全分工与合作机制，同时也积累了一定的家庭视频监控的安全案例。"}
{"title": "间谍行动无止尽：俄罗斯APT小组利用Android木马追踪乌克兰炮兵部队", "url": "https://www.freebuf.com/news/123774.html", "time": "2016-12-23", "level": "", "num_look": 255530, "num_comment": 6, "author": "Sphinx", "tags": ["资讯"], "text": "俄罗斯APT小组Fancy Bear又搞了个大新闻。Fancy Bear小组的成员从2014年底到2016年利用Android恶意软件跟踪乌克兰炮兵部队。"}
{"title": "“净广大师”病毒HTTPS劫持技术深度分析", "url": "https://www.freebuf.com/articles/terminal/123554.html", "time": "2016-12-23", "level": "红色标题", "num_look": 722586, "num_comment": 18, "author": "火绒安全", "tags": ["终端安全"], "text": "近期，火绒团队截获一个由商业软件携带的病毒。在目前的“流量劫持”类病毒中，该病毒策略高明、技术暴力，并攻破HTTPS的“金钟罩”，使得反劫持技术面临严峻挑战。"}
{"title": "流行开源电子邮件程序Roundcube v1.2.2命令执行漏洞分析", "url": "https://www.freebuf.com/vuls/122658.html", "time": "2016-12-23", "level": "", "num_look": 467695, "num_comment": 4, "author": "鸢尾", "tags": ["WEB安全", "漏洞"], "text": "Roundcube是一款被广泛使用的开源的电子邮件程序，在全球范围内有很多组织和公司都在使用，但是Roundcube v1.2.2被爆出命令执行漏洞。"}
{"title": "【FreeBuf年终策划】盘点2016年“最创新”的8种攻击方式", "url": "https://www.freebuf.com/articles/others-articles/123607.html", "time": "2016-12-23", "level": "金币+10", "num_look": 307852, "num_comment": 5, "author": "米雪儿", "tags": ["其他", "特别企划"], "text": "我们就一起看看今年那些白帽黑客带来的最为酷炫的攻击方式吧。"}
{"title": "企业对安全运营中心（SOC）的投入真的有用吗？", "url": "https://www.freebuf.com/articles/neopoints/123539.html", "time": "2016-12-23", "level": "", "num_look": 571910, "num_comment": 18, "author": "孙毛毛", "tags": ["安全管理", "观点"], "text": "最近采用的安全措施没有达到预期中的影响力？这可能对很对企业来说都成了一个问题。"}
{"title": "美丽联合集团安全应急响应中心(MLSRC)正式上线", "url": "https://www.freebuf.com/news/others/123608.html", "time": "2016-12-23", "level": "", "num_look": 667415, "num_comment": 15, "author": "Lightless", "tags": ["周边"], "text": "美联SRC的建立，旨在联合安全领域的个人以及团队共同发现潜在的安全威胁，全方位地保障平台消费者的权益。"}
{"title": "又一场黑掉飞机的大戏？IOActive研究员声称可入侵松下机载娱乐系统", "url": "https://www.freebuf.com/vuls/123712.html", "time": "2016-12-23", "level": "金币+10", "num_look": 289582, "num_comment": 5, "author": "clouds", "tags": ["漏洞"], "text": "松下航空电子严重质疑IOActive的研究测试，并呼吁IOActive尽快澄清。&*%这都是些什么剧情....."}
{"title": "周三发车！FreeBuf互联网安全创新大会（FIT 2017）搭车指南", "url": "https://www.freebuf.com/news/123609.html", "time": "2016-12-22", "level": "红色标题", "num_look": 384537, "num_comment": 25, "author": "FB独家", "tags": ["头条", "特别企划"], "text": "如何优雅地刷卡上车开启飙车之旅，这篇参会指南将呈上本届FIT现场剧透。"}
{"title": "诈骗网站利用LinkedIn和Baidu进行隐蔽跳转的分析", "url": "https://www.freebuf.com/news/123116.html", "time": "2016-12-22", "level": "", "num_look": 202815, "num_comment": 7, "author": "clouds", "tags": ["资讯"], "text": "诈骗网站利用双重URL跳转获得受害者信任。"}
{"title": "iOS安全审计入门", "url": "https://www.freebuf.com/articles/terminal/123098.html", "time": "2016-12-22", "level": "", "num_look": 497513, "num_comment": 7, "author": "latiaojun", "tags": ["特别企划", "终端安全"], "text": "本文旨在提供iOS应用程序安全审核方法的概述，并介绍一些可用于执行分析的工具。"}
{"title": "自动化、安全分析和人工智能，从Gartner预测看网络安全新规则", "url": "https://www.freebuf.com/articles/neopoints/123545.html", "time": "2016-12-22", "level": "", "num_look": 475310, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["企业安全", "安全管理"], "text": "让我们来看一看Gartner公司对于信息安全现状的一些评估和预测。"}
{"title": "五大安全研究者必用的搜索引擎", "url": "https://www.freebuf.com/sectool/123503.html", "time": "2016-12-22", "level": "金币+6", "num_look": 986759, "num_comment": 21, "author": "secist", "tags": ["工具"], "text": "Shodan 并不是唯一一个针对联网设备的搜索引擎，还有其它许多类似的搜索引擎。"}
{"title": "HTTP/2性能更好，但是安全性又如何呢？", "url": "https://www.freebuf.com/news/123455.html", "time": "2016-12-22", "level": "", "num_look": 280569, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["WEB安全", "资讯"], "text": "我们真的有必要急于升级到HTTP/2吗？"}
{"title": "福建六壬网安诚聘安全人才", "url": "https://www.freebuf.com/jobs/123326.html", "time": "2016-12-21", "level": "", "num_look": 234933, "num_comment": 14, "author": "六壬网安", "tags": ["安全招聘"], "text": "福建六壬网安股份有限公司诚招信息安全工程师及安全研究开发工程师"}
{"title": "【FreeBuf年终策划】我们能从2016年的七大网络安全事故中学到些什么", "url": "https://www.freebuf.com/articles/neopoints/123321.html", "time": "2016-12-21", "level": "", "num_look": 348429, "num_comment": 9, "author": "Alpha_h4ck", "tags": ["特别企划", "观点"], "text": "年关将至，我们专门总结了一下2016年的七大安全事件，希望各位安全从业人员能够从这些事件中吸取教训，更好地面对2017年所带来的安全挑战。"}
{"title": "【漏洞预警】OpenSSH现中危漏洞，可致远程代码执行", "url": "https://www.freebuf.com/news/123614.html", "time": "2016-12-21", "level": "", "num_look": 851924, "num_comment": 8, "author": "Sphinx", "tags": ["漏洞", "资讯"], "text": "OpenSSH现RCE漏洞，危险程度有多少，一起来看一下吧～"}
{"title": "一个和任天堂游戏机有关的0-day漏洞，可能对大多Linux系统造成影响", "url": "https://www.freebuf.com/news/123521.html", "time": "2016-12-21", "level": "", "num_look": 235338, "num_comment": 2, "author": "clouds", "tags": ["漏洞", "资讯"], "text": "上个月我们才说利用任天堂FC游戏音乐，能够触发Ubuntu系统中的漏洞；实际上，超任的游戏音乐也可以！"}
{"title": "【快讯】乌克兰再次发生大规模停电事故，疑似遭遇黑客攻击", "url": "https://www.freebuf.com/news/123577.html", "time": "2016-12-21", "level": "", "num_look": 250744, "num_comment": 6, "author": "kuma", "tags": ["资讯"], "text": "乌克兰电力公司疑遭遇黑客攻击，首都部分地区发生大规模停电。"}
{"title": "红包外挂那点事", "url": "https://www.freebuf.com/articles/terminal/123275.html", "time": "2016-12-21", "level": "现金奖励", "num_look": 1329697, "num_comment": 46, "author": "薛定谔的大表哥", "tags": ["极客", "终端安全"], "text": "眼看又到年关了，抢红包神器的需求很强烈！很急！很关键！"}
{"title": "Shadow Brokers热卖中的NSA方程式黑客工具预览：是否值得剁手？", "url": "https://www.freebuf.com/news/123410.html", "time": "2016-12-21", "level": "", "num_look": 405663, "num_comment": 6, "author": "ArthurKiller", "tags": ["资讯"], "text": "原本，Shadow Brokers打算对这些泄露工具进行众筹销售。但是由于众筹效果不明显，所以Shadow Brokers决定将这些泄露工具打包出售。"}
{"title": "DNSChanger卷土重来，家用路由器当心了", "url": "https://www.freebuf.com/news/123391.html", "time": "2016-12-21", "level": "", "num_look": 650330, "num_comment": 2, "author": "kuma", "tags": ["终端安全", "网络安全"], "text": "圣诞节快来了，各类打折活动即将到来，与此同时，新型的恶意软件已经上线。"}
{"title": "《网络安全法》并不完美，仍需完善 | FreeBuf专访知名律师刘春泉", "url": "https://www.freebuf.com/articles/others-articles/122752.html", "time": "2016-12-20", "level": "红色标题", "num_look": 493177, "num_comment": 6, "author": "FB独家", "tags": ["人物志", "其他"], "text": "《网络安全法》能不能解决现如今中国互联网安全的问题——读完这篇专访，你可能会有个答案。"}
{"title": "平安科技银河安全实验室招聘，期待各位的加入", "url": "https://www.freebuf.com/jobs/123147.html", "time": "2016-12-20", "level": "", "num_look": 281914, "num_comment": 9, "author": "银河实验室", "tags": ["安全招聘"], "text": "银河实验室是信息安全部下的一个相对独立的分组，主要从事技术的研究和安全测试工作。"}
{"title": "搭建属于你自己的维基站点：MediaWiki", "url": "https://www.freebuf.com/sectool/123271.html", "time": "2016-12-20", "level": "", "num_look": 528807, "num_comment": 7, "author": "secist", "tags": ["工具"], "text": "打造专属于你的维基百科。"}
{"title": "这个300美金的设备能够在30秒内窃取你的Mac密码（含攻击演示视频）", "url": "https://www.freebuf.com/sectool/123196.html", "time": "2016-12-20", "level": "金币+5", "num_look": 321050, "num_comment": 8, "author": "Alpha_h4ck", "tags": ["工具", "系统安全"], "text": "如果你的MacBook处于睡眠状态或者是锁屏状态，那么黑客就可以通过这款价值300美元的新设备和一些开源软件在三十秒钟之内窃取你笔记本电脑的密码。"}
{"title": "hash_hmac函数使用不当造成的安全问题", "url": "https://www.freebuf.com/articles/web/122726.html", "time": "2016-12-20", "level": "", "num_look": 375073, "num_comment": 5, "author": "漏洞盒子", "tags": ["WEB安全"], "text": "近期有国外安全人员挖掘到api.wordpress.org的一个RCE漏洞，可以影响到远程更新的Wordpress网站。"}
{"title": "2017年网络安全五大趋势", "url": "https://www.freebuf.com/articles/security-management/123089.html", "time": "2016-12-20", "level": "", "num_look": 570917, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["安全管理"], "text": "回首2016年，网络安全无疑扮演着一个十分重要的角色，连总统大选都没能逃过黑客丑闻和数据泄漏等厄运。在即将到来的2017年，我们会遇到哪些恐怖的事情呢？"}
{"title": "Shell批量登陆和执行安全基线检查脚本", "url": "https://www.freebuf.com/sectool/123094.html", "time": "2016-12-20", "level": "现金奖励", "num_look": 678061, "num_comment": 21, "author": "nothing100", "tags": ["工具", "系统安全"], "text": "由于没有相关自动化安全检查基线设备，为了方便自己工作，写了个shell脚本，批量登陆、执行、提取远程服务器数据。"}
{"title": "平安人寿招聘信息安全工程师（深圳）", "url": "https://www.freebuf.com/jobs/122142.html", "time": "2016-12-19", "level": "", "num_look": 235243, "num_comment": 15, "author": "elephant", "tags": ["安全招聘"], "text": "中国平安人寿保险股份有限公司成立于2002年，是中国平安保险（集团）股份有限公司旗下的重要成员"}
{"title": "雅虎10亿账户数据去年就在暗网以30万美金出售，3名土豪已经出手", "url": "https://www.freebuf.com/news/123202.html", "time": "2016-12-19", "level": "红色标题", "num_look": 1038237, "num_comment": 10, "author": "bimeover", "tags": ["观点", "资讯"], "text": "距离上一次5亿数据泄露过去没多久，雅虎又一次让我们大吃一惊，这一次雅虎泄露的账户数量足足有10亿之多。"}
{"title": "Splunk大数据分析经验分享：从入门到夺门而逃", "url": "https://www.freebuf.com/articles/database/123006.html", "time": "2016-12-19", "level": "现金奖励", "num_look": 2123089, "num_comment": 31, "author": "Porsche", "tags": ["数据安全", "特别企划"], "text": "关于Splunk的文章网上非常少，中文的官方文档也很少，作者用自己通俗易懂的语言非常详细地写了splunk的安装、CLI命令、SPL语言、数据分析等。"}
{"title": "使用WireShark生成地理位置数据地图（含演示视频）", "url": "https://www.freebuf.com/sectool/122747.html", "time": "2016-12-19", "level": "", "num_look": 499955, "num_comment": 12, "author": "Alpha_h4ck", "tags": ["工具", "特别企划"], "text": "我们将会在这篇文章中教会大家如何使用MaxmindGeoLite数据库来生成一个地理位置数据地图。"}
{"title": "PHP垃圾回收机制UAF漏洞分析", "url": "https://www.freebuf.com/vuls/122938.html", "time": "2016-12-19", "level": "现金奖励", "num_look": 517427, "num_comment": 6, "author": "ph1re", "tags": ["WEB安全", "漏洞"], "text": "很全面的PHP垃圾回收机制UAF漏洞分析"}
{"title": "【FB TV】一周「BUF大事件」：京东千万账户泄漏；Skype的Mac OS版本中发现后门；雅虎再次泄漏10亿账户", "url": "https://www.freebuf.com/video/123293.html", "time": "2016-12-18", "level": "红色标题", "num_look": 273909, "num_comment": 3, "author": "supercoco", "tags": ["视频"], "text": "双十二临近时，京东被曝出泄漏千万账户；Skype的Mac OS版本中预留后门；雅虎再次泄漏10亿账户"}
{"title": "脑洞：如何打造《速7》中“上帝之眼”现实版？", "url": "https://www.freebuf.com/articles/others-articles/123013.html", "time": "2016-12-18", "level": "金币+5", "num_look": 729788, "num_comment": 25, "author": "secist", "tags": ["其他", "极客"], "text": "在电影《速度与激情7》中有一种被称为“上帝之眼”的监控系统，这种系统可以打开所有视频监控的电子设备。那么在现实中我们可以打造一个这样的超级黑客系统吗？"}
{"title": "英国发布国家安全战略年度报告，网络安全将成重中之重", "url": "https://www.freebuf.com/news/122765.html", "time": "2016-12-18", "level": "", "num_look": 134965, "num_comment": 134965, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "英国政府近日发布了2016年第一份国家安全战略年度报告，并在报告中详细阐述了2015年英国国家安全战略的实施情况。"}
{"title": "病毒四度升级：揭露一例跨期两年的电信诈骗进化史", "url": "https://www.freebuf.com/articles/terminal/122793.html", "time": "2016-12-17", "level": "", "num_look": 303075, "num_comment": 4, "author": "AVLTeam", "tags": ["安全报告", "终端安全"], "text": "自2014年9月起，安天AVL移动安全团队持续检测到一类基于Android移动平台的间谍类病毒，病毒样本大多伪装成名为“最高人民检察院”的应用。"}
{"title": "Aircrack-ng 扩展 : Marfil", "url": "https://www.freebuf.com/sectool/122847.html", "time": "2016-12-17", "level": "", "num_look": 526230, "num_comment": 4, "author": "secist", "tags": ["工具", "无线安全"], "text": "一款小巧实用的无线扩展工具。"}
{"title": "安全可靠的匿名文件分享工具：OnionShare", "url": "https://www.freebuf.com/sectool/122910.html", "time": "2016-12-17", "level": "", "num_look": 633551, "num_comment": 13, "author": "secist", "tags": ["工具", "数据安全"], "text": "打造高度安全的匿名文件共享环境。"}
{"title": "资产管理和风险处理一体化，初创公司凌晨网络科技发布两款新品", "url": "https://www.freebuf.com/news/122915.html", "time": "2016-12-17", "level": "", "num_look": 176227, "num_comment": 4, "author": "kuma", "tags": ["活动", "资讯"], "text": "凌晨网络科技在前两天的发布会上发布了Tucana和Ore Sand矿砂系统"}
{"title": "兴华永恒（成都）招聘移动安全（漏洞方向）工程师", "url": "https://www.freebuf.com/jobs/121854.html", "time": "2016-12-16", "level": "", "num_look": 262257, "num_comment": 26, "author": "夜未央", "tags": ["安全招聘"], "text": "兴华永恒(北京)招聘移动安全（漏洞方向）工程师,工作地点成都。"}
{"title": "Shadow Brokers开始直接出售NSA方程式黑客工具，欲购从速！", "url": "https://www.freebuf.com/news/123199.html", "time": "2016-12-16", "level": "", "num_look": 421686, "num_comment": 5, "author": "Sphinx", "tags": ["资讯"], "text": "Shadow Brokers改变销售模式，在地下论坛直接开卖NSA黑客工具，工具可单独出售，欲购从速！"}
{"title": "Syscan360会议胸牌破解揭秘", "url": "https://www.freebuf.com/articles/terminal/123121.html", "time": "2016-12-16", "level": "", "num_look": 583374, "num_comment": 12, "author": "阿里IOT安全专家 谢君", "tags": ["极客", "终端安全"], "text": "Syscan360安全会议的一个亮点就是360的独角兽团队设计的一款电子badge(胸牌)供参加人员进行破解尝试，本文深度探讨了破解过程。"}
{"title": "黑客专访：天才黑客Gabriel Bergel的黑客人生", "url": "https://www.freebuf.com/articles/others-articles/122798.html", "time": "2016-12-16", "level": "金币+8", "num_look": 760228, "num_comment": 9, "author": "Alpha_h4ck", "tags": ["人物志", "其他"], "text": "我们有幸能够采访到GabrielBergel（@gbergel），它是目前黑客圈内最具天赋的黑客之一。"}
{"title": "使用轻量级工具Sysmon监视你的系统", "url": "https://www.freebuf.com/sectool/122779.html", "time": "2016-12-16", "level": "现金奖励", "num_look": 1169791, "num_comment": 10, "author": "Green_m", "tags": ["工具", "系统安全"], "text": "sysmon是由Windows Sysinternals出品的一款Sysinternals系列中的工具，用来监视和记录系统活动，并记录到windows事件日志。"}
{"title": "传播恶意软件最有效帮手：超95%的PowerShell脚本都是恶意脚本", "url": "https://www.freebuf.com/news/122589.html", "time": "2016-12-16", "level": "", "num_look": 221349, "num_comment": 4, "author": "latiaojun", "tags": ["资讯"], "text": "最强大的恶意软件工具并非暗网深处的神器，而是藏在每个企业“床底下”。"}
{"title": "85%的企业认为自己有能力抵御网络攻击，可实际情况是...", "url": "https://www.freebuf.com/articles/security-management/122734.html", "time": "2016-12-16", "level": "", "num_look": 402062, "num_comment": 6, "author": "孙毛毛", "tags": ["企业安全", "安全管理"], "text": "作为企业负责人，你是不是觉得公司的一切都尽在自己掌控？以下统计结果可能会令你大吃一惊"}
{"title": "McAfee Linux版本2016漏洞合集（含漏洞利用PoC）", "url": "https://www.freebuf.com/vuls/123022.html", "time": "2016-12-16", "level": "", "num_look": 376450, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["漏洞", "特别企划"], "text": ""}
{"title": "众安科技安监团队诚聘", "url": "https://www.freebuf.com/jobs/122722.html", "time": "2016-12-15", "level": "", "num_look": 282581, "num_comment": 15, "author": "- -", "tags": ["安全招聘"], "text": "众安科技是众安保险成立的全资子公司"}
{"title": "McAfee VirusScan Linux企业版存在多个高危漏洞，请尽快升级", "url": "https://www.freebuf.com/news/122905.html", "time": "2016-12-15", "level": "", "num_look": 262552, "num_comment": 4, "author": "bimeover", "tags": ["漏洞", "资讯"], "text": "Intel Security旗下的安全产品McAfee VirusScan Linux企业版被曝受10个漏洞影响，由几个漏洞构成的攻击链可以完成以root权限执行远程代码。"}
{"title": "研究人员发现macOS版Skype内置了后门", "url": "https://www.freebuf.com/news/122985.html", "time": "2016-12-15", "level": "", "num_look": 245561, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["终端安全", "资讯"], "text": "Trustwave的安全研究专家在Skype的Mac OS X桌面端API中发现了可被利用的安全问题。"}
{"title": "又是雅虎，又10亿账户泄露！论数据泄露谁与争锋", "url": "https://www.freebuf.com/news/123036.html", "time": "2016-12-15", "level": "红色标题", "num_look": 473655, "num_comment": 11, "author": "孙毛毛", "tags": ["资讯"], "text": "雅虎貌似已经成为了大规模数据泄露的代名词，所曝光的用户信息也是没有最多，只有更多。"}
{"title": "多款廉价Android手机再曝固件后门，联想手机也在其列", "url": "https://www.freebuf.com/news/122880.html", "time": "2016-12-15", "level": "", "num_look": 409626, "num_comment": 11, "author": "Sphinx", "tags": ["终端安全", "资讯"], "text": "之前我们报道过两起Android手机暗藏漏洞的事件，而周一，来自俄罗斯杀软厂商Dr.Web（大蜘蛛）的研究人员又发现了暗藏漏洞的现象。"}
{"title": "SAINTSEC教你玩转Metasploitable 3", "url": "https://www.freebuf.com/sectool/122626.html", "time": "2016-12-15", "level": "", "num_look": 1053661, "num_comment": 32, "author": "SAINTSEC TEAM", "tags": ["工具"], "text": "Metasploitable 3不是像之前的版本那样直接下载虚拟机，这篇文章演示了在Windows 10系统中使用powershell来安装的过程。"}
{"title": "Bruteforcer：分布式多线程破解RAR文件密码（附工具下载）", "url": "https://www.freebuf.com/sectool/122481.html", "time": "2016-12-15", "level": "", "num_look": 817177, "num_comment": 20, "author": "米雪儿", "tags": ["工具"], "text": "本篇文章主要讲解如何运用Bruteforcer高效快速的破解RAR密码。"}
{"title": "利用XML签名攻击绕过SAML2.0单点登录", "url": "https://www.freebuf.com/articles/web/122365.html", "time": "2016-12-15", "level": "", "num_look": 336815, "num_comment": 4, "author": "鸢尾", "tags": ["WEB安全"], "text": "当前，大多数SAML使用者不会去验证响应是否正确，从而会允许攻击者完全绕过身份验证。"}
{"title": "发起DDoS攻击有积分和奖励，土耳其黑客是这么玩的", "url": "https://www.freebuf.com/news/122316.html", "time": "2016-12-14", "level": "", "num_look": 192526, "num_comment": 8, "author": "Sphinx", "tags": ["资讯"], "text": "安全公司Forcepoint发现，一个名叫Surface Defense（表面防御）的DDoS平台让其他土耳其黑客参与一场“游戏”，游戏的内容就是通过攻击政治网站得分。"}
{"title": "【更新Beta版固件下载】Netgear多个型号路由器曝远程任意命令注入漏洞，官方提供临时解决方案", "url": "https://www.freebuf.com/news/122596.html", "time": "2016-12-14", "level": "红色标题", "num_look": 682887, "num_comment": 18, "author": "欧阳洋葱", "tags": ["漏洞", "资讯"], "text": "Netgear的最新安全公告明确了漏洞存在性，且漏洞覆盖范围有所扩大，同时表示正在开发新版固件修复漏洞。"}
{"title": "调查报告：75%的企业不能对数据泄露事件作出有效的检测响应", "url": "https://www.freebuf.com/articles/database/122687.html", "time": "2016-12-14", "level": "", "num_look": 510513, "num_comment": 1, "author": "clouds", "tags": ["企业安全", "安全报告"], "text": ""}
{"title": "防火防盗反钓鱼，2016年全球网络钓鱼总汇概览", "url": "https://www.freebuf.com/articles/web/120890.html", "time": "2016-12-14", "level": "红色标题", "num_look": 698210, "num_comment": 26, "author": "latiaojun", "tags": ["WEB安全", "安全报告"], "text": "防火防盗反钓鱼，毫无疑问，网络钓鱼已经成为一个非常严重的威胁，并充斥在我们生活的各个角落，而且，钓鱼者的攻击手法越来越新，更让我们防不胜防。"}
{"title": "中国市场手机系统安全检测报告", "url": "https://www.freebuf.com/articles/terminal/122667.html", "time": "2016-12-14", "level": "", "num_look": 379512, "num_comment": 23, "author": "360手机卫士", "tags": ["安全报告", "终端安全"], "text": "经过对25个Android系统漏洞的研究，我们可以看出仍然存在大量未升级至新版本系统和未打补丁的设备正在被使用。"}
{"title": "这款勒索软件很有个性：要么付钱，要么帮忙再感染两台PC", "url": "https://www.freebuf.com/news/122610.html", "time": "2016-12-14", "level": "", "num_look": 365910, "num_comment": 28, "author": "Alpha_h4ck", "tags": ["数据安全", "系统安全"], "text": "最近出现一款很有意思的勒索软件，如果被感染的用户不想花钱解锁文件，那么也可以选择把勒索软件传播出去来免费获取解锁密钥。"}
{"title": "使用Dirty COW获取T-Mobile LG V20机型Root权限", "url": "https://www.freebuf.com/vuls/122543.html", "time": "2016-12-14", "level": "", "num_look": 906856, "num_comment": 11, "author": "secist", "tags": ["漏洞", "终端安全"], "text": "如何利用脏牛漏洞LG最新的旗舰手机LG V20刷机。"}
{"title": "奥巴马的最后一击：彻查美国大选中的俄罗斯黑客行为", "url": "https://www.freebuf.com/news/122714.html", "time": "2016-12-13", "level": "", "num_look": 163063, "num_comment": 2, "author": "kuma", "tags": ["资讯"], "text": "即将离任的奥巴马总统命令美国情报众机构，全面彻查大选前针对民主党组织的网络攻击行为。"}
{"title": "FIT大会精彩抢先看：给你这样的“LIVE”气氛！", "url": "https://www.freebuf.com/news/122307.html", "time": "2016-12-13", "level": "红色标题", "num_look": 245078, "num_comment": 2, "author": "FB独家", "tags": ["活动", "资讯"], "text": "放学别走，还没做好功课的赶紧补习！"}
{"title": "刷机教程：教你如何打造一台渗透测试手机", "url": "https://www.freebuf.com/articles/terminal/121430.html", "time": "2016-12-13", "level": "", "num_look": 634158, "num_comment": 22, "author": "dawner", "tags": ["终端安全"], "text": "下面这篇文章给大家展示怎样打造自己的攻击测试手机，大家可以在上面跑Kali系统和AOPP（安卓开源攻击测试项目）。"}
{"title": "安全科普：SQLi Labs 指南（Part 3）", "url": "https://www.freebuf.com/articles/web/122247.html", "time": "2016-12-13", "level": "金币+13", "num_look": 584716, "num_comment": 10, "author": "houjingyi", "tags": ["WEB安全"], "text": "Freebuf上有两篇SQLi Labs的教程，但只讲到了第八课。我最近也在学习SQLi Labs，接合youtube上的视频和网上的资料，自己做了后面的一些课程，发出来和大家一起学习交流。"}
{"title": "史上最全的njRAT通信协议分析", "url": "https://www.freebuf.com/articles/network/122244.html", "time": "2016-12-13", "level": "现金奖励", "num_look": 1540684, "num_comment": 13, "author": "菠菜", "tags": ["网络安全"], "text": "Njrat,又称Bladabindi，该木马家族使用.NET框架编写，是一个典型的RAT类程序。"}
{"title": "iOSSecAudit：一个iOS APP安全审计工具", "url": "https://www.freebuf.com/sectool/122512.html", "time": "2016-12-13", "level": "现金奖励", "num_look": 556701, "num_comment": 4, "author": "薛定谔的大表哥", "tags": ["工具"], "text": "这个iOS App审计工具，用于辅助人工审计，将所有的工作合并在一个shell中进行，免去来回切换shell的过程，对建设移动端工具链也算是大有裨益。"}
{"title": "蚂蚁金服诚招安全人才", "url": "https://www.freebuf.com/jobs/122240.html", "time": "2016-12-12", "level": "", "num_look": 313950, "num_comment": 14, "author": "蚂蚁金服", "tags": ["安全招聘"], "text": "蚂蚁金服诚招安全人才（风险情报专家、安全工程师/资深安全工程师），地点杭州"}
{"title": "雅虎邮箱存储型XSS漏洞，黑客能看任何人的邮件", "url": "https://www.freebuf.com/vuls/122455.html", "time": "2016-12-12", "level": "", "num_look": 554485, "num_comment": 23, "author": "Sphinx", "tags": ["WEB安全", "漏洞"], "text": "上周雅虎邮箱修复了一个安全漏洞，整个攻击过程只需要受害者打开攻击者所发送的邮件，不需要其他的交互行为。"}
{"title": "当攻击者熟读兵法，Camouflage病毒实战演示暗度陈仓之计", "url": "https://www.freebuf.com/articles/terminal/122215.html", "time": "2016-12-12", "level": "", "num_look": 238322, "num_comment": 7, "author": "AVLTeam", "tags": ["安全报告", "终端安全"], "text": "amouflage病毒详细分析文档"}
{"title": "伯克利研究生是如何发现苹果设备超级间谍软件Pegasus的", "url": "https://www.freebuf.com/vuls/122285.html", "time": "2016-12-12", "level": "金币+10", "num_look": 425563, "num_comment": 5, "author": "clouds", "tags": ["人物志", "漏洞"], "text": "今年夏天，作为Citizens Lab高级安全研究员的伯克利硕士Bill Marczak，偶然发现了苹果超级间谍软件Pegasus"}
{"title": "TDD 方法开发渗透测试工具：代理扫描器（第二集）", "url": "https://www.freebuf.com/sectool/122124.html", "time": "2016-12-12", "level": "现金奖励", "num_look": 609268, "num_comment": 8, "author": "VillanCh", "tags": ["工具", "网络安全"], "text": "使用TDD开发多线程扫描工具。"}
{"title": "主动欺骗蜜罐系统Beeswarm简介", "url": "https://www.freebuf.com/sectool/122214.html", "time": "2016-12-12", "level": "", "num_look": 581285, "num_comment": 8, "author": "ArkTeam", "tags": ["工具", "系统安全"], "text": "Beeswarm是一个主动蜜罐系统，通过部署一些模拟真实用户的节点与蜜罐系统通信，从而引诱窃听了这些会话的攻击者攻击蜜罐系统，以捕获发现攻击。"}
{"title": "HackerOne平台2016年最具竞争力的漏洞悬赏项目", "url": "https://www.freebuf.com/articles/others-articles/122291.html", "time": "2016-12-11", "level": "", "num_look": 312645, "num_comment": 4, "author": "米雪儿", "tags": ["其他", "安全报告"], "text": "年末将至，让我们一同回顾一下2016年hackerone上最优秀的六个众测项目。"}
{"title": "京东千万条账户数据泄露？京东回应称系2013年的漏洞所致", "url": "https://www.freebuf.com/news/122524.html", "time": "2016-12-11", "level": "红色标题", "num_look": 536356, "num_comment": 30, "author": "欧阳洋葱", "tags": ["特别企划", "资讯"], "text": "一本财经在报道中提到：“一些地下渠道，开始对数据进行明码标价，价格从‘10万到70万’不等。”"}
{"title": "国外网络犯罪分子购买“裤子”的9大途径", "url": "https://www.freebuf.com/news/122418.html", "time": "2016-12-11", "level": "", "num_look": 543030, "num_comment": 6, "author": "米雪儿", "tags": ["数据安全", "资讯"], "text": "这篇文章为大家总结一些热门网站，大家可以在此访问隐私数据、凭证以及购买攻击工具，甚至有些工具还可以免费下载哦："}
{"title": "弹性边界：如何利用环境变量进行提权", "url": "https://www.freebuf.com/articles/system/121734.html", "time": "2016-12-11", "level": "", "num_look": 317137, "num_comment": 3, "author": "鸢尾", "tags": ["系统安全"], "text": "对于一个像样的系统来说，环境变量就是其最根本，这里的系统包括但不仅限于Unix (Linux, BSD), Windows以及OS X。"}
{"title": "Distributed Guessing新型攻击方式可在六秒内黑掉VISA信用卡（含PoC视频）", "url": "https://www.freebuf.com/news/122513.html", "time": "2016-12-10", "level": "", "num_look": 265481, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["数据安全", "资讯"], "text": "这种新型的攻击方法可以在六秒钟之内黑掉VISA信用卡。"}
{"title": "【FB TV】一周「BUF大事件」：“鑫胖”家的红星3.0系统曝漏洞；Apache Tomcat再曝远程代码执行漏洞；Linux内核竞争条件漏洞", "url": "https://www.freebuf.com/news/122500.html", "time": "2016-12-10", "level": "红色标题", "num_look": 227496, "num_comment": 3, "author": "supercoco", "tags": ["资讯"], "text": "朝鲜红星3.0系统有漏洞；Tomcat被爆远程代码执行漏洞；德国工业巨头遭遇间谍攻击..."}
{"title": "拍拍贷安全招聘安全工程师与信息安全经理", "url": "https://www.freebuf.com/jobs/122263.html", "time": "2016-12-09", "level": "", "num_look": 182303, "num_comment": 7, "author": "latiaojun", "tags": ["安全招聘"], "text": "拍拍贷成立于2007年6月，是一家由工商部门特批，获批“金融信息服务”的经营范围，得到政府认可的互联网金融平台，也是中国首批网络信息借贷平台。"}
{"title": "TR-064漏洞受影响厂商设备及TR-064协议安全性分析", "url": "https://www.freebuf.com/vuls/122160.html", "time": "2016-12-09", "level": "", "num_look": 420554, "num_comment": 1, "author": "clouds", "tags": ["漏洞", "终端安全"], "text": "除了telnet扫描之外，还有什么方法可以大规模感染IoT设备？"}
{"title": "Metasploitable 3正式发布，附赠全球CTF大赛", "url": "https://www.freebuf.com/news/122341.html", "time": "2016-12-09", "level": "红色标题", "num_look": 1192888, "num_comment": 21, "author": "ArthurKiller", "tags": ["资讯"], "text": "全球CTF大赛已经开始，赶快下载Metasploitable 3试试手吧！"}
{"title": "可能是史上最先进的恶意广告攻击：一个Banner就感染了上百万PC，雅虎、MSN等大型网站都中招", "url": "https://www.freebuf.com/articles/web/122300.html", "time": "2016-12-09", "level": "红色标题", "num_look": 621889, "num_comment": 13, "author": "孙毛毛", "tags": ["WEB安全", "系统安全"], "text": "如果你在过去的两个月内访问了任意主流网站，那么恭喜你，你的电脑很有可能已经中招了。"}
{"title": "从Locky新变种谈敲诈者木马的一些免疫技巧", "url": "https://www.freebuf.com/articles/system/121714.html", "time": "2016-12-09", "level": "", "num_look": 277968, "num_comment": 4, "author": "360安全", "tags": ["系统安全"], "text": "本文旨在通过对Locky新变种的一些技术细节的分析来谈谈对此类木马的免疫手段。"}
{"title": "小技巧：如何发现是否有人用USB偷插你的电脑？", "url": "https://www.freebuf.com/articles/system/122134.html", "time": "2016-12-09", "level": "金币+6", "num_look": 685821, "num_comment": 18, "author": "dawner", "tags": ["数据安全", "系统安全"], "text": "利用windows注册表来检测是否曾经有一个特殊的USB设备连接过你的电脑。"}
{"title": "TDD 方法开发渗透测试工具：代理扫描器（第一集）", "url": "https://www.freebuf.com/sectool/122123.html", "time": "2016-12-09", "level": "现金奖励", "num_look": 557831, "num_comment": 1, "author": "VillanCh", "tags": ["工具", "网络安全"], "text": "Test-Driven Development 顾名思义，就是利用测试来驱动(督促)开发进展中文名也就是测试驱动开发，简称 TDD，本文将讲解如何利用TDD开发渗透扫描器。"}
{"title": "威胁情报分析之牛刀小试：“BITTER”事件的分析总结", "url": "https://www.freebuf.com/articles/neopoints/122088.html", "time": "2016-12-09", "level": "金币+6", "num_look": 291005, "num_comment": 5, "author": "墨侠", "tags": ["特别企划", "观点"], "text": "近日，Forcepoint公司披露了一起针对巴基斯坦政府部门的APT攻击事件。墨侠团队通过对网络基础设施的关联信息分析，得到了BITTER与APT 28组织很可能师出同门的结论。"}
{"title": "顺丰金融诚聘安全人才", "url": "https://www.freebuf.com/jobs/121856.html", "time": "2016-12-08", "level": "", "num_look": 314404, "num_comment": 11, "author": "newie", "tags": ["安全招聘"], "text": "顺丰金融是顺丰旗下互联网金融新平台，归属于顺丰恒通支付有限公司。致力于为用户提供安全、便捷的综合金融服务。"}
{"title": "企业安全拥抱开源之FREEOTP部署实战", "url": "https://www.freebuf.com/news/122217.html", "time": "2016-12-08", "level": "现金奖励", "num_look": 588729, "num_comment": 6, "author": "agui", "tags": ["企业安全", "工具"], "text": "安全建设过程中，总体预算、投入产出比均是首先需要考虑的问题，缺少具备开发能力的人员、缺少资金预算的情况下，开源产品就成了必然的选择。"}
{"title": "Linux提权？这四个脚本可以帮助你", "url": "https://www.freebuf.com/sectool/121847.html", "time": "2016-12-08", "level": "", "num_look": 694710, "num_comment": 9, "author": "鸢尾", "tags": ["工具", "系统安全"], "text": "当你在目标机器上尝试提升权限时还有一些Linux脚本可供使用，这些类型的脚本将会为你节省很多时间。"}
{"title": "索尼80款监控摄像头存秘密后门，IoT设备的加速沦陷", "url": "https://www.freebuf.com/vuls/122201.html", "time": "2016-12-08", "level": "", "num_look": 447303, "num_comment": 5, "author": "Sphinx", "tags": ["漏洞", "网络安全"], "text": "索尼生产的80款网络摄像头中存在硬编码的登陆信息，存在漏洞的摄像头都来自Sony Professional Ipela Engine系列的IP摄像头。"}
{"title": "运维请注意：”非常危险“的Linux命令大全", "url": "https://www.freebuf.com/articles/system/122126.html", "time": "2016-12-08", "level": "", "num_look": 547622, "num_comment": 35, "author": "dawner", "tags": ["系统安全"], "text": "Linux命令是一种很有趣且有用的东西，但在你不知道会带来什么后果的时候，它又会显得非常危险。所以，在输入某些命令前，请多多检查再敲回车。"}
{"title": "动手打造自己的渗透工具（浏览器篇）", "url": "https://www.freebuf.com/sectool/122030.html", "time": "2016-12-08", "level": "现金奖励", "num_look": 623202, "num_comment": 24, "author": "cDdubz8", "tags": ["工具"], "text": "本文将会演示怎样使用Python导出Windows系统上浏览器保存的密码、书签、浏览历史等敏感数据。"}
{"title": "大多网络犯罪一个月可赚1000到3000美元", "url": "https://www.freebuf.com/news/121939.html", "time": "2016-12-08", "level": "", "num_look": 235840, "num_comment": 11, "author": "Alpha_h4ck", "tags": ["特别企划", "资讯"], "text": "一项最新的调查报告显示，目前绝大多数的网络犯罪分子一个月可以挣到1000至3000美金，而且其中有20%的网络罪犯在一个月内可以挣到20000美金以上。"}
{"title": "【漏洞预警】ImageMagick压缩TIFF图片远程代码执行漏洞（CVE-2016-8707）", "url": "https://www.freebuf.com/vuls/122139.html", "time": "2016-12-07", "level": "红色标题", "num_look": 405925, "num_comment": 15, "author": "漏洞盒子", "tags": ["漏洞"], "text": "ImageMagick软件可用来显示、转换以及编辑图形，支持超过200种图像文件格式，并且可以跨平台运行。近日该软件被爆出存在远程代码执行漏洞。"}
{"title": "年末了，盘点2016年最严重的7起DDoS攻击事件", "url": "https://www.freebuf.com/special/121838.html", "time": "2016-12-07", "level": "", "num_look": 495285, "num_comment": 5, "author": "米雪儿", "tags": ["安全报告", "特别企划"], "text": "随着黑客技术的不断发展，人们越来越难以区分真实世界和恐怖电影之间的区别， 2016年的DDoS攻击事件更是加深了人们的这种感觉。"}
{"title": "【漏洞预警】CVE-2016-8655：Linux内核竞争条件漏洞，可致本地提权 (附PoC)", "url": "https://www.freebuf.com/vuls/122152.html", "time": "2016-12-07", "level": "红色标题", "num_look": 819284, "num_comment": 21, "author": "漏洞盒子", "tags": ["漏洞"], "text": "Seclists.org最新披露了Linux的竞争条件漏洞，漏洞编号为CVE-2016-8655。此漏洞可用于从低权限进程中执行内核代码。"}
{"title": "如何用极路由+OpenWrt+RTL电视棒搭建一台SDR服务器，并隐秘地捕获和传输数据", "url": "https://www.freebuf.com/articles/wireless/121961.html", "time": "2016-12-07", "level": "", "num_look": 1057201, "num_comment": 13, "author": "漏洞盒子", "tags": ["无线安全"], "text": "近期因为有个从异地捕获无线信号的需求，便尝试着用OpenWrt+公网IP搭建了一台SDR服务器。"}
{"title": "用手机从锁定的计算机中偷取凭证信息", "url": "https://www.freebuf.com/news/120174.html", "time": "2016-12-07", "level": "", "num_look": 418150, "num_comment": 11, "author": "鸢尾", "tags": ["网络安全", "资讯"], "text": "一台Android手机，就能从锁定的Windows计算机中偷取凭证信息。本文探讨了"}
{"title": "英国GCHQ正式发布开源数据分析工具CyberChef（含使用示例）", "url": "https://www.freebuf.com/news/121888.html", "time": "2016-12-07", "level": "", "num_look": 337995, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["工具", "资讯"], "text": "CyberChef是一款新型的Web工具，安全研究人员可以使用这款工具对数据进行复杂的分析或解码工作"}
{"title": "“鑫胖”家的红星3.0系统被曝漏洞，可远程执行任意命令注入", "url": "https://www.freebuf.com/news/121969.html", "time": "2016-12-07", "level": "红色标题", "num_look": 824620, "num_comment": 25, "author": "bimeover", "tags": ["漏洞", "资讯"], "text": "近日，有黑客团队曝出红星3.0漏洞，可执行远程任意命令注入。"}
{"title": "burpsuite_pro_v1.7.11破解版（含下载）", "url": "https://www.freebuf.com/sectool/121992.html", "time": "2016-12-06", "level": "", "num_look": 3021677, "num_comment": 32, "author": "jackyu", "tags": ["工具"], "text": "BurpSuite是一款信息安全从业人员必备的集成型的渗透测试工具"}
{"title": "企业安全团队强大与否，看这八个关键指标", "url": "https://www.freebuf.com/articles/security-management/119915.html", "time": "2016-12-06", "level": "", "num_look": 462702, "num_comment": 11, "author": "latiaojun", "tags": ["企业安全", "安全管理"], "text": "企业安全管理对企业来说至关重要，而具体有那些指标，并没有一个统一的标准，本文仅复述了国外企业安全管理的一些经验，与大家一起分享。"}
{"title": "“P2P安全通讯工具”ShadowTalk确实安全可靠吗？", "url": "https://www.freebuf.com/sectool/122036.html", "time": "2016-12-06", "level": "现金奖励", "num_look": 494117, "num_comment": 7, "author": "DarkRayTeam", "tags": ["工具", "特别企划"], "text": "沙话（shadowTalk），作为一个基于P2P加密通讯的即时聊天工具脱颖而出，但是它确实安全可靠吗？"}
{"title": "【快讯】日本化妆品牌资生堂确认42万用户数据泄露，包括大量信用卡信息", "url": "https://www.freebuf.com/news/122058.html", "time": "2016-12-06", "level": "红色标题", "num_look": 239564, "num_comment": 9, "author": "孙毛毛", "tags": ["资讯"], "text": "日本化妆品巨头之一的资生堂公司被曝数据泄露，部分用户的财务信息也可能已经泄露。"}
{"title": "Java Web本地提权以及数据劫持思路（以Tomcat为例）", "url": "https://www.freebuf.com/articles/web/121867.html", "time": "2016-12-06", "level": "金币+12", "num_look": 435819, "num_comment": 14, "author": "jfeiyi", "tags": ["WEB安全"], "text": "如何在tomcat中利用这个特性做到提权和劫持数据呢？"}
{"title": "Win10 Edge浏览器从越界写到任意内存读写", "url": "https://www.freebuf.com/articles/system/121690.html", "time": "2016-12-06", "level": "现金奖励", "num_look": 396162, "num_comment": 7, "author": "BoA", "tags": ["系统安全"], "text": "对两个Edge脚本引擎漏洞的见解"}
{"title": "频繁“被破解”，从“背锅侠”特斯拉看IoT安全", "url": "https://www.freebuf.com/articles/neopoints/121651.html", "time": "2016-12-06", "level": "红色标题", "num_look": 328425, "num_comment": 3, "author": "ArthurKiller", "tags": ["观点"], "text": "某些不负责任媒体及号称安全媒体的“炒作”、“故事会”背后，真相往往并不是你“看到”的那样。"}
{"title": "俄罗斯中央银行被黑，20亿卢布为何不翼而飞？", "url": "https://www.freebuf.com/news/121966.html", "time": "2016-12-05", "level": "", "num_look": 348150, "num_comment": 14, "author": "latiaojun", "tags": ["资讯"], "text": "此次俄央行被黑事件是否与前两天FSB的声明有关？20亿卢布如何不翼而飞？这一切都是谜。"}
{"title": "HCTF 2016网络攻防大赛官方Writeup", "url": "https://www.freebuf.com/articles/web/121778.html", "time": "2016-12-05", "level": "现金奖励", "num_look": 2291782, "num_comment": 10, "author": "sysorem", "tags": ["WEB安全", "其他"], "text": "历时48小时，第八届HCTF网络安全对抗赛正式完结。本次题目共分为5层 ，下面逐层奉上各位师傅的解题姿势。"}
{"title": "专家观点：不建议在SCADA系统中部署防火墙", "url": "https://www.freebuf.com/articles/security-management/121663.html", "time": "2016-12-05", "level": "", "num_look": 1046713, "num_comment": 6, "author": "clouds", "tags": ["安全管理", "工控安全"], "text": "对于那些还未受到网络攻击的关键基础设施，或许有人会给出自欺欺人的解释：这是因为，攻击将同样使得黑客受到影响。这完全是一种掩耳盗铃的说法！"}
{"title": "Shodan新手入坑指南", "url": "https://www.freebuf.com/sectool/121339.html", "time": "2016-12-05", "level": "现金奖励", "num_look": 4014077, "num_comment": 30, "author": "xiaix", "tags": ["工具"], "text": "Shodan是一个搜索引擎，但它与 Google 这种搜索网址的搜索引擎不同，Shodan 是用来搜索网络空间中在线设备的。"}
{"title": "Splunk+蜜罐+防火墙=简易WAF", "url": "https://www.freebuf.com/articles/web/121679.html", "time": "2016-12-05", "level": "现金奖励", "num_look": 824717, "num_comment": 24, "author": "ripz", "tags": ["WEB安全", "企业安全"], "text": "在企业安全建设中，可以利用大数据来实时分析攻击，通过防火墙联动来自动封禁恶意IP，其优点是配置灵活，且无需串联新设备。"}
{"title": "Aveo恶意软件分析", "url": "https://www.freebuf.com/articles/system/121662.html", "time": "2016-12-04", "level": "", "num_look": 295485, "num_comment": 295485, "author": "Avenger", "tags": ["系统安全"], "text": "Aveo 恶意软件家族与 ForrmerFirstRAT 恶意软件家族有密切的联系，二者都针对日语用户，Aveo 可以接收多种命令，这将允许攻击者完全控制感染主机。"}
{"title": "一群极其注重隐私的人士，开发了一款超级安全的Android系统", "url": "https://www.freebuf.com/news/121538.html", "time": "2016-12-04", "level": "", "num_look": 310039, "num_comment": 8, "author": "Alpha_h4ck", "tags": ["终端安全", "资讯"], "text": "Tor项目的开发人员已经设计出了一种安全的Android手机原型，开发这个原型的目的是为了帮助用户保护自己的隐私信息，并且防止用户感染移动端的恶意软件。"}
{"title": "案例分析：利用OAuth实施钓鱼", "url": "https://www.freebuf.com/articles/web/119615.html", "time": "2016-12-04", "level": "", "num_look": 612942, "num_comment": 8, "author": "latiaojun", "tags": ["WEB安全"], "text": "OAUTH协议为用户资源的授权提供了一个安全的、开放而又简易的标准。"}
{"title": "新手指南：DVWA-1.9全级别教程之SQL Injection(Blind)", "url": "https://www.freebuf.com/articles/web/120985.html", "time": "2016-12-04", "level": "现金奖励", "num_look": 1929376, "num_comment": 34, "author": "lonehand", "tags": ["WEB安全"], "text": "本文介绍SQL Injection（Blind）模块的相关内容，后续教程会在之后的文章中给出。"}
{"title": "【漏洞预警】Apache Tomcat再曝远程代码执行漏洞(CVE-2016-8735)", "url": "https://www.freebuf.com/news/121868.html", "time": "2016-12-03", "level": "红色标题", "num_look": 1390118, "num_comment": 10, "author": "漏洞盒子", "tags": ["资讯"], "text": "时隔十月发布的CVE-2016-5425Apache Tomcat本地提权漏洞预警不久，近日Apache Tomcat又被爆出存在远程代码执行漏洞(CVE-2016-8735)。"}
{"title": "维基解密网站下线4小时，与《41号修订案》有关？", "url": "https://www.freebuf.com/news/121803.html", "time": "2016-12-03", "level": "", "num_look": 176141, "num_comment": 11, "author": "Sphinx", "tags": ["资讯"], "text": "12月1日早晨，维基解密网站遭受攻击，攻击导致网站下线达4小时。两天前，维基解密发布了来自美国政府承包商HBGary的6万封邮件。"}
{"title": "【FB TV】一周「BUF大事件」：360手机助手“黑科技”；黑客攻击德国电信，致使90万路由器下线；SIEM会被SOAPA取代吗？", "url": "https://www.freebuf.com/video/121858.html", "time": "2016-12-03", "level": "红色标题", "num_look": 260922, "num_comment": 3, "author": "supercoco", "tags": ["视频"], "text": "360手机助手“黑科技”，安装静悄悄；德国电信断网事件，与mirai僵尸网络的新变种有关。"}
{"title": "深入了解VoWiFi安全性", "url": "https://www.freebuf.com/articles/wireless/120909.html", "time": "2016-12-03", "level": "", "num_look": 588093, "num_comment": 1, "author": "鸢尾", "tags": ["无线安全"], "text": "VoWiFi是通过WiFi网络提供的语音业务，本文将就VoWiFi的安全性进行讨论。"}
{"title": "10大预测：2017年网络安全的趋势可能是这样的...", "url": "https://www.freebuf.com/articles/network/120094.html", "time": "2016-12-03", "level": "", "num_look": 554245, "num_comment": 5, "author": "dawner", "tags": ["安全报告", "网络安全"], "text": "2016年眨眼之间即将过去，我们这时候已经可以对明年的某些趋势进行预测了。"}
{"title": "如何正确响应安全事件？", "url": "https://www.freebuf.com/articles/neopoints/120311.html", "time": "2016-12-02", "level": "", "num_look": 397908, "num_comment": 7, "author": "Alpha_h4ck", "tags": ["安全管理", "观点"], "text": "在这场没有硝烟的信息化战争中，企业或组织不应该孤身奋战，而是应该与某些安全技术合作，以共同应对日趋复杂的安全风险。"}
{"title": "WiFi信号干扰可以泄漏你的密码和敏感信息", "url": "https://www.freebuf.com/news/120128.html", "time": "2016-12-02", "level": "金币+12", "num_look": 592730, "num_comment": 17, "author": "米雪儿", "tags": ["数据安全", "无线安全"], "text": "研究人员发现，你在手机上输入密码时，肢体动作会干扰WiFi信号，黑客可通过分析WiFi信号干扰，窃取你的敏感信息，比如你的密码、PINs以及按键信息等。"}
{"title": "Dorothy2：一个开源的僵尸网络分析框架", "url": "https://www.freebuf.com/sectool/120560.html", "time": "2016-12-02", "level": "", "num_look": 322007, "num_comment": 322007, "author": "Alpha_h4ck", "tags": ["工具", "网络安全"], "text": "Dorothy2是一款采用Ruby语言开发的恶意软件／僵尸网络分析框架，你可以使用Dorothy2框架来对可疑的二进制代码进行分析。"}
{"title": "谁对企业安全工作有最大推动力？", "url": "https://www.freebuf.com/articles/neopoints/121040.html", "time": "2016-12-02", "level": "", "num_look": 371738, "num_comment": 8, "author": "Alpha_h4ck", "tags": ["安全管理", "特别企划"], "text": "无论负责企业安全管理工作的人是谁，任何一个企业或组织不仅要将信息安全方面必要的投入成本加入预算之中，而且还要让“信息安全”成为企业文化的一部分。"}
{"title": "有史以来最严重：超100万谷歌账户被黑，Android恶意程序Gooligan正极速蔓延", "url": "https://www.freebuf.com/news/121685.html", "time": "2016-12-02", "level": "红色标题", "num_look": 350874, "num_comment": 11, "author": "孙毛毛", "tags": ["终端安全", "资讯"], "text": "你在用Android手机吗？要当心了！这款恶意程序每天都感染超过1万部Android手机。"}
{"title": "【WitAwards 2016 “年度安全产品”参评巡礼】天际友盟Alice威胁情报溯源平台产品解读", "url": "https://www.freebuf.com/special/121142.html", "time": "2016-12-02", "level": "", "num_look": 311673, "num_comment": 1, "author": "FreeBuf咨询", "tags": ["安全报告", "特别企划"], "text": "在这篇文章中，我们将针对天际友盟的威胁情报产品进行产品解读，并期望借这篇文章的机会，更深入地聊一聊威胁情报，及其市场现状。"}
{"title": "宜信诚招中高级安全工程师", "url": "https://www.freebuf.com/jobs/121646.html", "time": "2016-12-01", "level": "", "num_look": 198753, "num_comment": 14, "author": "EvaYue", "tags": ["安全招聘"], "text": "宜信公司创建于2006年，总部位于北京，是一家集财富管理、信用风险评估与管理、信用数据整合服务于一体的综合性现代服务业企业。"}
{"title": "内网穿透：Android木马进入高级攻击阶段", "url": "https://www.freebuf.com/articles/terminal/121634.html", "time": "2016-12-01", "level": "", "num_look": 442872, "num_comment": 14, "author": "360手机卫士", "tags": ["终端安全"], "text": "通过代理穿透内网绕过防火墙的手段在PC上并不新鲜，然而以手机终端为跳板实现对企业内网的渗透还是首见，本文将带你一探究竟。"}
{"title": "注意了，cURL的漏洞也不少", "url": "https://www.freebuf.com/vuls/121581.html", "time": "2016-12-01", "level": "", "num_look": 472674, "num_comment": 12, "author": "Sphinx", "tags": ["漏洞", "系统安全"], "text": "安全专家对cURL进行了审计，发现了数十个漏洞。"}
{"title": "SOAPA来临，SIEM时代终结？", "url": "https://www.freebuf.com/news/121588.html", "time": "2016-12-01", "level": "", "num_look": 547290, "num_comment": 12, "author": "latiaojun", "tags": ["企业安全", "安全管理"], "text": "SIEM系统据说遇到了前所未有的挑战，而取代SIEM的是一种叫SOAPA的平台，这究竟是什么样的平台？"}
{"title": "一个CMS案例实战讲解PHP代码审计入门", "url": "https://www.freebuf.com/articles/web/121314.html", "time": "2016-12-01", "level": "现金奖励", "num_look": 604620, "num_comment": 29, "author": "大胖", "tags": ["WEB安全"], "text": "php代码审计：顾名思义就是检查php源代码中的缺点和错误信息，分析并找到这些问题引发的安全漏洞。"}
{"title": "政府与企业在网络安全上该如何“共赢”？听听NSA局长怎么说", "url": "https://www.freebuf.com/news/120927.html", "time": "2016-12-01", "level": "", "num_look": 240724, "num_comment": 2, "author": "孙毛毛", "tags": ["安全管理", "观点"], "text": "网络攻击是一场没有硝烟也不分国界的战争"}
{"title": "揭秘360手机助手未经用户同意，自动开启辅助功能的“黑科技”", "url": "https://www.freebuf.com/articles/terminal/121253.html", "time": "2016-12-01", "level": "现金奖励", "num_look": 1302248, "num_comment": 43, "author": "Venscor", "tags": ["特别企划", "终端安全"], "text": "我们发现，只有360手机助手能够不经过用户交互，自己启动AccessibilityService。为什么360手机助手可以做到？带着这样的好奇，我们来探寻其背后的黑科技。"}
{"title": "Win10攻击神技巧：系统更新时长按 SHIFT+F10 键可以打开CMD界面", "url": "https://www.freebuf.com/vuls/121578.html", "time": "2016-11-30", "level": "金币+6", "num_look": 576458, "num_comment": 14, "author": "clouds", "tags": ["漏洞"], "text": "当Win10在更新并安装相关系统版本时，长按SHIFT+F10键，将会打开CMD命令行控制界面！"}
{"title": "FIT大会精彩抢先看——安全产业与创业创新那点事", "url": "https://www.freebuf.com/news/121595.html", "time": "2016-11-30", "level": "红色标题", "num_look": 237835, "num_comment": 1, "author": "FB独家", "tags": ["活动", "资讯"], "text": "2017 FreeBuf互联网安全创新大会邀请到了业界各路勇于创新的“开拓者”们，引领创业的“实践者”们，聊聊他们如何把握时代机遇。"}
{"title": "关于机器学习在网络安全中的五大误解", "url": "https://www.freebuf.com/articles/neopoints/121243.html", "time": "2016-11-30", "level": "", "num_look": 379117, "num_comment": 7, "author": "Avenger", "tags": ["观点"], "text": ""}
{"title": "WAFNinja：灵活的WAF自动化Fuzz工具", "url": "https://www.freebuf.com/sectool/120816.html", "time": "2016-11-30", "level": "", "num_look": 404258, "num_comment": 8, "author": "dawner", "tags": ["工具"], "text": "WAFNinja是一款用python写的命令行工具，它可以帮助渗透测试人员免去部分手动输入的烦恼。"}
{"title": "德国电信断网事件详细分析：mirai僵尸网络的新变种和旧主控", "url": "https://www.freebuf.com/articles/paper/121563.html", "time": "2016-11-30", "level": "", "num_look": 328809, "num_comment": 2, "author": "360安全", "tags": ["安全报告"], "text": "德国电信在2016年11月28日前后遭遇一次大范围的网络故障。在这次故障中，2千万固定网络用户中的大约90万个路由器发生故障（约4.5%），并由此导致大面积网络访问受限。"}
{"title": "Linux强化论：15步打造一个安全的Linux服务器", "url": "https://www.freebuf.com/articles/system/121540.html", "time": "2016-11-30", "level": "金币+6", "num_look": 706843, "num_comment": 14, "author": "Alpha_h4ck", "tags": ["特别企划", "系统安全"], "text": "我将会与大家分享一些能够让你的Linux主机更加安全的方法，其中还会包括一些渗透测试技巧。"}
{"title": "【企业研究报告】FreeBuf Insight：网络安全创新企业Top 10解读之root9B", "url": "https://www.freebuf.com/news/topnews/118716.html", "time": "2016-11-30", "level": "红色标题", "num_look": 374723, "num_comment": 3, "author": "FreeBuf咨询", "tags": ["头条", "安全报告"], "text": "论root9B如何超过FireEye，成为今年《网络安全创新500强企业》榜单的绝对黑马。"}
{"title": "斯诺登最新泄露文档：纽约AT&T大厦可能是NSA进行数据监控的秘密基地", "url": "https://www.freebuf.com/news/121112.html", "time": "2016-11-30", "level": "", "num_look": 188195, "num_comment": 3, "author": "clouds", "tags": ["资讯"], "text": "在这里，NSA接入AT&T通讯骨干网络，进行电话、传真和互联网数据的窃听监控"}
{"title": "企业级物联网系统安全如何做？", "url": "https://www.freebuf.com/articles/system/121199.html", "time": "2016-11-30", "level": "现金奖励", "num_look": 444522, "num_comment": 5, "author": "bt0sea", "tags": ["安全管理", "系统安全"], "text": "各企业对自身物联网安全没有一个整体的概念，要么自研或者寻找现成的安全解决方案。在这样的背景下，想谈谈自己的观点，说明一下企业级物联网安全如何做"}
{"title": "旧金山市交通系统遭勒索软件感染细节进一步公布，还能继续“免费”坐地铁么？", "url": "https://www.freebuf.com/news/121472.html", "time": "2016-11-29", "level": "", "num_look": 210026, "num_comment": 6, "author": "孙毛毛", "tags": ["资讯"], "text": "上周五有黑客入侵了旧金山市交通局（MUNI），导致上周末乘客能够免费坐地铁。"}
{"title": "Uber修复三个漏洞，白帽子获数千美金奖励（含漏洞分析）", "url": "https://www.freebuf.com/news/121345.html", "time": "2016-11-29", "level": "", "num_look": 279507, "num_comment": 15, "author": "bimeover", "tags": ["漏洞", "资讯"], "text": "安全专家Kevin Roh在Uber的在线APP Uber Central中发现三个漏洞，可造成用户数据泄露。Uber已及时修复。"}
{"title": "以色列凭什么成为全球监控技术的中心？", "url": "https://www.freebuf.com/special/120592.html", "time": "2016-11-29", "level": "", "num_look": 348953, "num_comment": 3, "author": "clouds", "tags": ["特别企划"], "text": "本方介绍了以色列一流监控技术形成的原因和背景，从侧面反映出以色列经济从传统向基于互联网的市场转型环境和趋势。"}
{"title": "德国电信遭黑客攻击：90万路由器下线 大量用户无法访问互联网", "url": "https://www.freebuf.com/news/121449.html", "time": "2016-11-29", "level": "红色标题", "num_look": 497777, "num_comment": 9, "author": "kuma", "tags": ["漏洞", "资讯"], "text": "德国电信近日遭遇网络攻击，超90万路由器无法联网，德国电信方面已经确认了此事。"}
{"title": "神级脚本大集合之PowerShell-Suite", "url": "https://www.freebuf.com/sectool/120675.html", "time": "2016-11-29", "level": "现金奖励", "num_look": 562404, "num_comment": 9, "author": "zusheng", "tags": ["工具"], "text": "PowerShell-Suite是b33f创建的一个GitHub项目，主要收集了目前神器级别的PowerShell攻击脚本。本文向大家详细介绍了里面各个脚本的使用方法。"}
{"title": "如何使用WLAN的SSID提取用户的凭证数据", "url": "https://www.freebuf.com/sectool/120950.html", "time": "2016-11-29", "level": "", "num_look": 440815, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["工具", "无线安全"], "text": "SSID最多只支持32字节的数据，所以我们并没有多少可以提取的数据。不过，我们的确可以从如此有限的数据中提取出像用户凭证这样的信息。"}
{"title": "浅谈Web前端僵尸网络", "url": "https://www.freebuf.com/articles/network/120749.html", "time": "2016-11-29", "level": "现金奖励", "num_look": 637202, "num_comment": 3, "author": "ArkTeam", "tags": ["网络安全"], "text": "本文将介绍一种基于Web前端的僵尸网络"}
{"title": "不试你可能会后悔，Windows渗透测试利器Pentest Box", "url": "https://www.freebuf.com/sectool/120877.html", "time": "2016-11-28", "level": "红色标题", "num_look": 2274744, "num_comment": 109, "author": "ArthurKiller", "tags": ["工具", "特别企划"], "text": "写这个专题还得从前几天FreeBuf上的一篇文章说起，当时评论里面对这个黑客是各种嘲讽——我认为Kali中阿D最好使，Windows中Pentest Box最好使。"}
{"title": "以为禁用麦克风就不会被监听了吗？用耳机也可以哟", "url": "https://www.freebuf.com/news/121015.html", "time": "2016-11-28", "level": "", "num_look": 307269, "num_comment": 9, "author": "孙毛毛", "tags": ["终端安全", "资讯"], "text": "有没有想过会有人透过你的网络摄像头监视你，通过你的麦克风监听你？"}
{"title": "“优雅”的Linux漏洞：用罕见方式绕过ASLR和DEP保护机制", "url": "https://www.freebuf.com/articles/terminal/120911.html", "time": "2016-11-28", "level": "", "num_look": 322989, "num_comment": 322989, "author": "Sphinx", "tags": ["终端安全"], "text": "最近公布的一段exp代码能够在打完补丁的Fedora等Linux系统上进行drive-by攻击，从而安装键盘记录器、后门和其他恶意软件。"}
{"title": "深入探究文件Fuzz工具之Peach实战", "url": "https://www.freebuf.com/sectool/120650.html", "time": "2016-11-28", "level": "现金奖励", "num_look": 807005, "num_comment": 6, "author": "overXsky", "tags": ["工具", "极客"], "text": "本文详细介绍了文件Fuzz工具Peach的使用，涵盖了基于Python的2.3旧版本和基于C#的3.1新版本。"}
{"title": "Geoip可视化攻击图谱：打造专属的炫酷风", "url": "https://www.freebuf.com/sectool/120518.html", "time": "2016-11-28", "level": "", "num_look": 374769, "num_comment": 7, "author": "dawner", "tags": ["工具"], "text": "Geoip可视化攻击图谱可以用于实时显示您正在遭受的网络攻击，它会跟踪系统日志文件，解析出日志里的源IP、目的IP、源端口和目的端口。"}
{"title": "关键基础设施是否会成为DDoS攻击的新目标？答案是不大会", "url": "https://www.freebuf.com/articles/terminal/120701.html", "time": "2016-11-28", "level": "", "num_look": 451040, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["工控安全", "终端安全"], "text": "安全专家认为，类似电网和天然气管道等关键基础设施不太可能会遭到大规模的DDoS攻击，虽然关键基础设施中也存在严重的安全问题。"}
{"title": "Mirai感染监控摄像头过程观察，几十秒就完成感染", "url": "https://www.freebuf.com/news/120544.html", "time": "2016-11-27", "level": "", "num_look": 718310, "num_comment": 8, "author": "kuma", "tags": ["终端安全", "资讯"], "text": "你家的摄像头还好吗？"}
{"title": "新手指南：DVWA-1.9全级别教程之SQL Injection", "url": "https://www.freebuf.com/articles/web/120747.html", "time": "2016-11-27", "level": "金币+14", "num_look": 3226359, "num_comment": 49, "author": "lonehand", "tags": ["WEB安全"], "text": "SQL注入漏洞的危害是巨大的，常常会导致整个数据库被“脱裤”，尽管如此，SQL注入仍是现在最常见的Web漏洞之一。"}
{"title": "爱尔兰数万宽带Modem存在漏洞可被远程入侵控制", "url": "https://www.freebuf.com/news/121025.html", "time": "2016-11-27", "level": "", "num_look": 349506, "num_comment": 4, "author": "clouds", "tags": ["漏洞", "网络安全"], "text": "爱尔兰最大的ISP提供商为数万客户提供使用的Eir D1000宽带调制解调器存在漏洞，可被远程入侵控制。"}
{"title": "斗鱼招聘安全人才", "url": "https://www.freebuf.com/jobs/121180.html", "time": "2016-11-26", "level": "", "num_look": 367335, "num_comment": 20, "author": "武汉斗鱼网络科技有限公司", "tags": ["安全招聘"], "text": "斗鱼招募高级WEB安全工程师、信息安全管理工程师和高级数据安全工程师"}
{"title": "NTP漏洞可致Windows系统触发DoS", "url": "https://www.freebuf.com/vuls/121129.html", "time": "2016-11-26", "level": "", "num_look": 329486, "num_comment": 1, "author": "vulture", "tags": ["漏洞", "系统安全"], "text": "研究人员发布了针对cve-2016-9311漏洞的PoC，这个漏洞能够导致NTP守护进程崩溃，并且触发Windows系统拒绝服务。"}
{"title": "关于Jenkins CLI漏洞情况的通报", "url": "https://www.freebuf.com/vuls/120420.html", "time": "2016-11-26", "level": "", "num_look": 360721, "num_comment": 2, "author": "CNNVD", "tags": ["WEB安全", "漏洞"], "text": "该漏洞源于Jenkins CLI存在Java反序列化问题，从而导致远程攻击者可在Jenkins上执行任意代码，进一步控制服务器。"}
{"title": "【FB TV】一周「BUF大事件」：又一家中国公司被曝在安卓设备中植入Rootkit；短短的5秒视频就会使你的iPhone奔溃；卡巴斯基推出全新自主开发安全系统", "url": "https://www.freebuf.com/video/121200.html", "time": "2016-11-26", "level": "红色标题", "num_look": 238048, "num_comment": 2, "author": "supercoco", "tags": ["视频"], "text": "又一家中国公司在安卓设备中留有后门；这个5秒视频就能让iPhone奔溃。"}
{"title": "树莓派变身世界第一款声控导弹", "url": "https://www.freebuf.com/news/120106.html", "time": "2016-11-26", "level": "", "num_look": 256580, "num_comment": 14, "author": "饭团君", "tags": ["资讯"], "text": "近日在乌克兰国际安防系统与设备展览会（ Bezpeka Security Trade Show）上出现了一款新型的导弹武器系统，而该系统主要以树莓派为基础建立的。"}
{"title": "数字电视也不安全了？2016 SyScan 360大会全记录之二", "url": "https://www.freebuf.com/fevents/121082.html", "time": "2016-11-26", "level": "", "num_look": 197530, "num_comment": 4, "author": "latiaojun", "tags": ["活动"], "text": "攻击电视、银行安全防御、IOS漏洞分析、浏览器漏洞你想要的都在这里。"}
{"title": "关于“魅魔”漏洞情况的通报", "url": "https://www.freebuf.com/vuls/120662.html", "time": "2016-11-25", "level": "", "num_look": 317434, "num_comment": 2, "author": "CNNVD", "tags": ["漏洞", "终端安全"], "text": "还记得上周外媒曝光上海广升FOTA固件升级在Android设备上的问题吗？CNNVD最近对其中的命令执行漏洞进行了跟踪分析。"}
{"title": "卡巴斯基发布自家操作系统Kaspersky OS：历时14年从头打造", "url": "https://www.freebuf.com/news/121099.html", "time": "2016-11-25", "level": "", "num_look": 469977, "num_comment": 19, "author": "孙毛毛", "tags": ["网络安全", "资讯"], "text": "为人熟知的网络安全和杀毒软件公司卡巴斯基推出了新的安全操作系统：Kaspersky OS，而且这款系统并不基于Linux。"}
{"title": "在HTTPS安全页面中加载HTTP不安全的内容，如何绕过安全警告？", "url": "https://www.freebuf.com/news/120281.html", "time": "2016-11-25", "level": "", "num_look": 625522, "num_comment": 2, "author": "鸢尾", "tags": ["WEB安全", "资讯"], "text": "在HTTPS页面中加载HTTP内容，浏览器是会向用户发出警告的，那么对攻击者而言，如何绕过这样的警告呢？"}
{"title": "【已结束】SyScan360国际前瞻信息安全会议图文直播（Live）", "url": "https://www.freebuf.com/fevents/121077.html", "time": "2016-11-25", "level": "红色标题", "num_look": 553147, "num_comment": 2, "author": "孙毛毛", "tags": ["活动"], "text": "SyScan360国际前瞻信息安全会议由SyScan与360公司共同举办。大会邀请世界各地优秀互联网安全专家分享最新信息安全研究成果，发表最新国际安全消息。"}
{"title": "美国政府邀请黑客攻击美军网站 Hack the Army漏洞奖励计划启动", "url": "https://www.freebuf.com/news/121004.html", "time": "2016-11-25", "level": "", "num_look": 279074, "num_comment": 15, "author": "Sphinx", "tags": ["资讯"], "text": "美国国防部和HackerOne公司宣布了一个新的漏洞赏金计划，以奖励那些成功入侵美军网站，发现未补丁漏洞的黑客们。黑客们可以尽情进行安全测试了。"}
{"title": "用“一年不能啪啪啪”来换“信息安全”，你愿意吗？39%的美国人表示愿意", "url": "https://www.freebuf.com/articles/others-articles/120865.html", "time": "2016-11-25", "level": "", "num_look": 510706, "num_comment": 22, "author": "Alpha_h4ck", "tags": ["其他", "特别企划"], "text": "百分之四十的美国人（39%）愿意用一年不“啪啪啪”来换取自己免受黑客攻击、身份信息被盗、或者账号失窃等安全问题所带来的困扰。"}
{"title": "2016年智能网联汽车信息安全测试报告（摘要版）", "url": "https://www.freebuf.com/articles/terminal/120510.html", "time": "2016-11-25", "level": "金币+6", "num_look": 425255, "num_comment": 3, "author": "tofreebug", "tags": ["安全报告", "终端安全"], "text": "为了更好地对汽车信息安全测试现状做最新的全方位的调研和评估，VisualThreat在2016年下半年度对6款车型进行了信息安全评分测试。"}
{"title": "原创工具：Pinda套件---恶意样本分析利器", "url": "https://www.freebuf.com/sectool/120863.html", "time": "2016-11-25", "level": "现金奖励", "num_look": 414457, "num_comment": 7, "author": "比尔.盖茨", "tags": ["工具", "系统安全"], "text": "该工具对于分析恶意代码比较有用，原理就是用pin动态结果，结合ida强大的反汇编功能，来加速恶意代码分析。"}
{"title": "人工智能安全来袭？2016 SyScan 360大会最全记录", "url": "https://www.freebuf.com/news/121043.html", "time": "2016-11-25", "level": "", "num_look": 200071, "num_comment": 2, "author": "ArthurKiller", "tags": ["资讯"], "text": "SyScan360由奇虎360公司举办，会议中涉及众多技术干货，包括但不限于APT攻击，汽车安全，人工智能安全，Windows安全，iOS安全，Mac OS安全等。"}
{"title": "WordPress自动更新机制的严重漏洞：全球超1/4网站可被黑客一举击溃", "url": "https://www.freebuf.com/vuls/121018.html", "time": "2016-11-24", "level": "", "num_look": 365935, "num_comment": 8, "author": "欧阳洋葱", "tags": ["WEB安全", "漏洞"], "text": "全球超过1/4的网站都存在安全风险？黑客利用WordPress自动更新机制，就能一次将恶意代码部署到所有这些网站中..."}
{"title": "FIT 2017大会精彩抢先看：企业安全工坊——不谈空话，多点实践与分享", "url": "https://www.freebuf.com/news/120874.html", "time": "2016-11-24", "level": "红色标题", "num_look": 265910, "num_comment": 2, "author": "FB独家", "tags": ["活动", "资讯"], "text": "甲方与乙方共聚一堂，我们期待他们分享的技术和解决方案，可以为关注企业安全的你带来收获。"}
{"title": "值得收藏！国外最佳互联网安全博客TOP30", "url": "https://www.freebuf.com/news/120254.html", "time": "2016-11-24", "level": "", "num_look": 520859, "num_comment": 14, "author": "阿里聚安全", "tags": ["资讯"], "text": "最近有国外网站对50多个互联网安全博客做了相关排名，小编整理其中排名前30的安全博客，希望能给大家带来一些帮助。"}
{"title": "【快讯】当心！这段5秒的视频能让所有iPhone崩溃！", "url": "https://www.freebuf.com/news/120966.html", "time": "2016-11-24", "level": "", "num_look": 284475, "num_comment": 19, "author": "kuma", "tags": ["资讯"], "text": "iPhone又出现新的漏洞：用户播放某个视频时，机器会崩溃。"}
{"title": "服务器的神秘来客：XTBL敲诈者木马技术分析", "url": "https://www.freebuf.com/articles/paper/119942.html", "time": "2016-11-24", "level": "", "num_look": 239920, "num_comment": 12, "author": "360安全卫士", "tags": ["安全报告"], "text": "XTBL敲诈者是一款专门针对Windows服务器的敲诈者木马。自今年六月起，国内不少服务器开始出现XTBL敲诈者感染迹象，而且还出现了多个变种。"}
{"title": "《斯诺登风暴》：斯诺登的电影来了（附BD种子+中文字幕下载）", "url": "https://www.freebuf.com/news/120485.html", "time": "2016-11-24", "level": "", "num_look": 390111, "num_comment": 16, "author": "clouds", "tags": ["资讯"], "text": "导演奥利佛·斯通（Oliver Stone）这一次把目光瞄向了因揭露美国监听世界丑闻而名声大噪的爱德华·斯诺登。"}
{"title": "一个网站图标引发的血案！绕过同源策略，判断你是否登录了某网站", "url": "https://www.freebuf.com/vuls/120049.html", "time": "2016-11-24", "level": "", "num_look": 495301, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["WEB安全", "漏洞"], "text": "目前大多数主流的网络平台都会在没有得到你同意的情况下泄漏你的登录状态。"}
{"title": "Struts Convention插件漏洞(CVE-2016-6795)分析", "url": "https://www.freebuf.com/vuls/120451.html", "time": "2016-11-24", "level": "现金奖励", "num_look": 348234, "num_comment": 3, "author": "angelwhu", "tags": ["WEB安全", "漏洞"], "text": "上个月就发布了一个等级为高Struts2的漏洞。本文本着学习的态度，把这个漏洞从源码角度分析下，并分享了自己分析漏洞的方法和过程。"}
{"title": "【WitAwards 2016 “年度安全产品”参评巡礼】云上主机卫士：椒图科技云锁产品解读", "url": "https://www.freebuf.com/special/120139.html", "time": "2016-11-23", "level": "", "num_look": 275281, "num_comment": 3, "author": "FreeBuf咨询", "tags": ["特别企划"], "text": "云计算越来越普及，主机加固服务能否也步入云端？"}
{"title": "中国创新技术保障世界互联网大会网络安全  阿里云圆满护航", "url": "https://www.freebuf.com/fevents/120475.html", "time": "2016-11-23", "level": "", "num_look": 179789, "num_comment": 5, "author": "阿里云安全", "tags": ["活动"], "text": "就在世界互联网大会网友和会议嘉宾享用网络便利时，背后是一场看不见的技术较量。阿里云用自主研发的新技术 “Netguard”保障了网络空间的清朗。"}
{"title": "关于nginx提权漏洞情况的通报", "url": "https://www.freebuf.com/vuls/121202.html", "time": "2016-11-23", "level": "", "num_look": 360464, "num_comment": 360464, "author": "CNNVD", "tags": ["漏洞"], "text": "nginx官方及相关操作系统厂商对上述漏洞已发布升级公告。由于上述漏洞影响范围广，危害级别高，国家信息安全漏洞库（CNNVD）对此进行了跟踪分析。"}
{"title": "简单方法检测远端用户的反病毒软件", "url": "https://www.freebuf.com/articles/system/120453.html", "time": "2016-11-23", "level": "现金奖励", "num_look": 287668, "num_comment": 6, "author": "Avenger", "tags": ["系统安全"], "text": "为了确保更安全，我给Windows 7系统安装了卡巴斯基互联网安全防病毒软件。一天我在某Web页面看到一段有趣的代码，在我看来它不该出现在页面上。"}
{"title": "威胁趋势预警：Carbanak网络犯罪团伙开始瞄准酒店和餐饮业", "url": "https://www.freebuf.com/news/120467.html", "time": "2016-11-23", "level": "", "num_look": 114212, "num_comment": 114212, "author": "米雪儿", "tags": ["资讯"], "text": "臭名昭著的Carbanak犯罪团伙正转变攻击方向，集中火力瞄准酒店和餐饮行业。"}
{"title": "锦行科技新发布的“幻云”，要为黑客制造“盗梦空间”", "url": "https://www.freebuf.com/news/120802.html", "time": "2016-11-23", "level": "", "num_look": 342411, "num_comment": 16, "author": "孙毛毛", "tags": ["活动", "资讯"], "text": "有经验的攻击者很容易识破单个蜜罐，幻云会通过各种类型的蜜罐打造一个类似于迷宫的内网环境，敌人进来出不去。"}
{"title": "暗网有一半以上的数据都是合法的！包括7%的色情网站", "url": "https://www.freebuf.com/articles/web/120725.html", "time": "2016-11-23", "level": "金币+6", "num_look": 904872, "num_comment": 17, "author": "Alpha_h4ck", "tags": ["WEB安全", "观点"], "text": "安全公司近期的一项调查表明，在暗网中，有一半以上的网络通信数据属于合法数据，而网络攻击和欺诈活动的数量更是低得惊人。"}
{"title": "高级自动化钓鱼框架PhishLulz已经发布，是灾难还是救星？", "url": "https://www.freebuf.com/news/120719.html", "time": "2016-11-23", "level": "", "num_look": 487528, "num_comment": 5, "author": "ArthurKiller", "tags": ["工具", "资讯"], "text": "2016年11月的新西兰黑客大会Kiwicon上，FortConsult的网络安全专家Michele Orru发布了一款自动化网络钓鱼工具，并且将其命名为PhishLulz。"}
{"title": "新手指南：DVWA-1.9全级别教程之Insecure CAPTCHA", "url": "https://www.freebuf.com/articles/web/119692.html", "time": "2016-11-23", "level": "金币+6", "num_look": 1115330, "num_comment": 22, "author": "lonehand", "tags": ["WEB安全"], "text": "本文介绍Insecure CAPTCHA模块的相关内容，验证逻辑、伪造绕过都不是事。"}
{"title": "赛门铁克23亿美元收购LifeLock 旨在打造“全球最大消费级安全业务”", "url": "https://www.freebuf.com/news/120697.html", "time": "2016-11-22", "level": "", "num_look": 168508, "num_comment": 3, "author": "latiaojun", "tags": ["资讯"], "text": "通过此次收购，赛门铁克希望将旗下的诺顿反病毒（Norton AntiVirus）业务与Life Lock整合到一个产品线中，从而令自己的地位更加稳固。"}
{"title": "APK文件分析工具：AppMon", "url": "https://www.freebuf.com/sectool/120010.html", "time": "2016-11-22", "level": "", "num_look": 574711, "num_comment": 5, "author": "clouds", "tags": ["工具"], "text": "AppMon可以通过二进制指令获取app程序运行记录，并显示调用函数和相关参数。"}
{"title": "利用SQLite数据库文件实现任意代码执行", "url": "https://www.freebuf.com/vuls/120213.html", "time": "2016-11-22", "level": "", "num_look": 581307, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["漏洞", "特别企划"], "text": "近期，我们对贝尔金WeMo智能家居设备的安全性进行了分析。在研究过程中，我们开发出了一种新型的SQL注入技术，这项技术针对的是SQLite数据库。"}
{"title": "专访Kapustkiy——那个最近黑了多国大使馆的黑客", "url": "https://www.freebuf.com/news/120406.html", "time": "2016-11-22", "level": "", "num_look": 391456, "num_comment": 10, "author": "kuma", "tags": ["资讯"], "text": "近日黑客Kapustkiy连续对多个大使馆发起攻击，怒刷各大外媒头条，于是SecurityAffairs对Kapustkiy进行了专访。"}
{"title": "新来的安全专家，几个月后，哭了……", "url": "https://www.freebuf.com/articles/others-articles/120382.html", "time": "2016-11-22", "level": "", "num_look": 446021, "num_comment": 21, "author": "神秘的程序员们", "tags": ["其他"], "text": "办公室来了个安全专家，仅仅是半个月的时候，一切就变得格外悲剧。"}
{"title": "术业有专攻：网络安全领域急需的8大热门技能，你达标没？", "url": "https://www.freebuf.com/articles/security-management/120051.html", "time": "2016-11-22", "level": "金币+8", "num_look": 436779, "num_comment": 8, "author": "米雪儿", "tags": ["安全管理", "特别企划"], "text": "网络安全行业的发展催生了大批就业机会，目前的人才技能还不能完全满足安全行业的职业需求，本文列举了行业的几大热门技能，大家快来查缺补漏。"}
{"title": "爆料：安卓“间谍门”事件愈演愈烈，又一家中国公司被曝在300万台安卓设备中植入rootkit", "url": "https://www.freebuf.com/news/120639.html", "time": "2016-11-21", "level": "红色标题", "num_look": 691254, "num_comment": 21, "author": "ArthurKiller", "tags": ["资讯"], "text": "国外安全研究人员最近发现上海另一家公司生产的Android手机居然也藏有Rootkit（隐蔽性恶意软件）。"}
{"title": "盘点七大最严重的美国政府数据泄露事件", "url": "https://www.freebuf.com/articles/neopoints/120211.html", "time": "2016-11-21", "level": "", "num_look": 372819, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["特别企划", "观点"], "text": "根据美国隐私维权组织最新发布的消息，联邦政府和州政府在近期公布了过去五年内所发生的总共203次数据泄漏事件。"}
{"title": "Ubuntu系统中居然存在任天堂红白游戏机的漏洞", "url": "https://www.freebuf.com/news/120381.html", "time": "2016-11-21", "level": "", "num_look": 238037, "num_comment": 4, "author": "latiaojun", "tags": ["资讯"], "text": "在Ubuntu 12.04.5版本上的多媒体框架中存在一个漏洞，该漏洞可以被NES播放的声音文件利用，这个漏洞只存在于特定版本的ubuntu中。"}
{"title": "30秒攻破任意密码保护的PC：深入了解5美元黑客神器PoisonTap", "url": "https://www.freebuf.com/sectool/120354.html", "time": "2016-11-21", "level": "金币+8", "num_look": 977532, "num_comment": 40, "author": "clouds", "tags": ["WEB安全", "工具"], "text": "近日，著名硬件黑客Samy Kamkar利用5美元设备打造的黑客工具PoisonTap，只需30秒，就可以攻破设置有任意密码的电脑系统，并实现长期后门安装。"}
{"title": "利用《魔兽争霸3》漏洞传播的“萝莉”蠕虫分析", "url": "https://www.freebuf.com/news/120136.html", "time": "2016-11-21", "level": "红色标题", "num_look": 1064613, "num_comment": 43, "author": "腾讯电脑管家", "tags": ["网络安全", "资讯"], "text": "这款蠕虫是通过《魔兽争霸3》地图进行传播的，通过分析和搜索相关信息，结合大量网友反馈，重现的中毒场景是这样的..."}
{"title": "新手指南：DVWA-1.9全级别教程之File Upload", "url": "https://www.freebuf.com/articles/web/119467.html", "time": "2016-11-21", "level": "金币+8", "num_look": 1973979, "num_comment": 49, "author": "lonehand", "tags": ["WEB安全"], "text": "DVWA是一个用来进行安全脆弱性鉴定的PHP/MySQL Web应用，旨在帮助web开发者更好的理解web应用安全防范的过程。"}
{"title": "谷歌工程师：杀毒软件根本没什么用", "url": "https://www.freebuf.com/news/120397.html", "time": "2016-11-20", "level": "红色标题", "num_look": 830880, "num_comment": 77, "author": "孙毛毛", "tags": ["资讯"], "text": "如果说你还认为杀毒软件对每个电脑用户都是必不可少的，谷歌的高级安全工程师Darren Bilby可能会给你一个不一样的答案。"}
{"title": "美国国土安全部发布《物联网安全指导原则》", "url": "https://www.freebuf.com/news/120249.html", "time": "2016-11-20", "level": "", "num_look": 278094, "num_comment": 278094, "author": "clouds", "tags": ["安全管理", "资讯"], "text": "本报告向物联网设备和系统相关开发商、生产商、管理者及个人提供了一组安全规则建议，以供参考。"}
{"title": "魔波广告恶意病毒简析", "url": "https://www.freebuf.com/articles/system/120008.html", "time": "2016-11-20", "level": "", "num_look": 301125, "num_comment": 4, "author": "腾讯手机管家", "tags": ["系统安全"], "text": "魔波广告恶意病毒通过仿冒浏览器，播放器和一些游戏等进行传播"}
{"title": "英国最大的移动运营商Three遭黑客入侵 600万用户数据泄漏", "url": "https://www.freebuf.com/news/120465.html", "time": "2016-11-20", "level": "", "num_look": 202292, "num_comment": 6, "author": "米雪儿", "tags": ["资讯"], "text": "英国最大的移动运营商之一Three公司承认系统被黑客闯入，约600万用户的个人数据可能面临泄漏风险。"}
{"title": "【FB TV】一周「BUF大事件」：一台笔记本发起DDoS攻击；泄露你隐私的WIFI；美国网络安全创新企业圣地", "url": "https://www.freebuf.com/news/120427.html", "time": "2016-11-19", "level": "红色标题", "num_look": 285297, "num_comment": 1, "author": "supercoco", "tags": ["视频", "资讯"], "text": "驱动大规模DDoS攻击需要什么，只需一台笔记本；未解密的无线信号，也会泄漏我们的隐私，这是为什么呢；美国最著名网络安全创新地区有哪些？"}
{"title": "大数据隐私保护技术之脱敏技术探究", "url": "https://www.freebuf.com/articles/database/120040.html", "time": "2016-11-19", "level": "现金奖励", "num_look": 909730, "num_comment": 5, "author": "BeyondHannn", "tags": ["安全管理", "数据安全"], "text": "大数据时代也带来了隐私信息保护方面的难题，即如何在实现大数据高效共享的同时，保护敏感信息不被泄露。本文从数据脱敏防护这一手段进行了阐释。"}
{"title": "没时间了，赶紧上车！教你如何在一小时之内加密你的整个数字生活", "url": "https://www.freebuf.com/sectool/120027.html", "time": "2016-11-19", "level": "", "num_look": 601902, "num_comment": 11, "author": "Alpha_h4ck", "tags": ["工具", "网络安全"], "text": "英国监控计划的标语，“如果你没有什么值得隐瞒的，你就没有什么好担心的。”但任何人都理由去保护自己的设备、文件、以及他们与亲人朋友间的通信。"}
{"title": "直面冥王：最新爆发的C#敲诈木马HadesLocker解读", "url": "https://www.freebuf.com/news/120157.html", "time": "2016-11-19", "level": "", "num_look": 326725, "num_comment": 4, "author": "腾讯电脑管家", "tags": ["系统安全", "资讯"], "text": "之前出现的C#语言编写的木马只是简单地调用了一些C#库来辅助开发，这次的变种增加了多层嵌套解密、动态反射调用等复杂手段，提升了分析难度。"}
{"title": "非人类俱乐部WiFi万能钥匙招聘安全人才", "url": "https://www.freebuf.com/jobs/120360.html", "time": "2016-11-18", "level": "", "num_look": 336251, "num_comment": 13, "author": "sylvie", "tags": ["安全招聘"], "text": "WiFi万能钥匙全球用户总量已达9亿, 月活跃户用5.2亿，仅次于微信、QQ。"}
{"title": "浅谈如何利用IP数据来辅助风控和安全系统", "url": "https://www.freebuf.com/special/120041.html", "time": "2016-11-18", "level": "", "num_look": 384431, "num_comment": 8, "author": "岂安科技", "tags": ["特别企划"], "text": "从最近几年开始，IP在作为用户标识的作用日渐削弱，从而极大的影响到了其在安全防范和风险控制方面的有效性。"}
{"title": "PHP Trick 总结与探讨（一）", "url": "https://www.freebuf.com/news/119969.html", "time": "2016-11-18", "level": "现金奖励", "num_look": 374327, "num_comment": 8, "author": "VillanCh", "tags": [], "text": "这篇文章不是给 PHP 程序员看的，而是给渗透测试爱好者准备的，\\(￣︶￣*\\))。"}
{"title": "绕过密码就能访问iPhone照片或消息 连iOS 10也受影响（含演示视频）", "url": "https://www.freebuf.com/news/120366.html", "time": "2016-11-18", "level": "金币+10", "num_look": 590903, "num_comment": 18, "author": "Alpha_h4ck", "tags": ["漏洞", "资讯"], "text": "最近几个大版本的iOS锁屏保护机制存在安全漏洞，心怀不轨的人可以利用这个漏洞轻而易举地绕过iPhone的锁屏密码并访问你手机中的照片和消息。"}
{"title": "本地试用软件：无限期使用通用方法", "url": "https://www.freebuf.com/articles/system/119887.html", "time": "2016-11-18", "level": "现金奖励", "num_look": 745303, "num_comment": 40, "author": "Blus", "tags": ["系统安全"], "text": "本文针对在有效期内使用的软件以及倒计时类的软件，讲了在虚拟机里运行使用和在真实机运行使用的两种方法。"}
{"title": "每个无线路由器都是窃听神器：房间里的一举一动它都能感应", "url": "https://www.freebuf.com/news/119120.html", "time": "2016-11-18", "level": "", "num_look": 779499, "num_comment": 25, "author": "饭团君", "tags": ["无线安全", "资讯"], "text": "即便不对无线信号承载的数据本身进行解密，无线信号也能泄露我们的隐私，比如你在房间里干什么，房间里有多少人，你用键盘输入了哪些文字..."}
{"title": "ATM机渗透测试的攻防实践", "url": "https://www.freebuf.com/articles/terminal/119338.html", "time": "2016-11-18", "level": "金币+10", "num_look": 603825, "num_comment": 21, "author": "dawner", "tags": ["系统安全", "终端安全"], "text": "ATM为人们提供了便捷，现在大家不必去银行就能进行现金交易。用户使用它可以对资金进行敏感操作，当然其中脆弱的通信环节也引来了大量黑客的觊觎。"}
{"title": "Linux爆新漏洞，长按回车键70秒即可获得root权限", "url": "https://www.freebuf.com/articles/system/120280.html", "time": "2016-11-17", "level": "红色标题", "num_look": 1476964, "num_comment": 62, "author": "Sphinx", "tags": ["系统安全"], "text": "按住回车70秒，黑客就能在linux系统绕过认证，进而获取root权限，并能远程控制经过加密的linux系统。"}
{"title": "CHM渗透：从入门到“入狱”", "url": "https://www.freebuf.com/articles/system/119874.html", "time": "2016-11-17", "level": "现金奖励", "num_look": 1063610, "num_comment": 43, "author": "ruo", "tags": ["极客", "系统安全"], "text": "文章给出最终版代码，测试的心酸撸主右手可以作证。"}
{"title": "详细议程公布！关于FIT 2017大会，你想了解的都在这", "url": "https://www.freebuf.com/news/120225.html", "time": "2016-11-17", "level": "红色标题", "num_look": 258017, "num_comment": 4, "author": "FB独家", "tags": ["资讯"], "text": "今年的FIT2017都有哪些看点？请来了哪些大腕儿？你想知道的都在这里！"}
{"title": "你的iPhone也出现“澳门赌场”日历推送了吗？分析邪恶的“苹果日历推”产业链", "url": "https://www.freebuf.com/articles/terminal/120036.html", "time": "2016-11-17", "level": "现金奖励", "num_look": 563758, "num_comment": 24, "author": "熊猫正正", "tags": ["系统安全", "终端安全"], "text": "电脑经常会出现日历推送信息究竟是什么原因？里面又隐藏着什么？"}
{"title": "MalwareMustDie关闭博客网站，抗议NSA利用恶意软件攻击公共机构", "url": "https://www.freebuf.com/news/120144.html", "time": "2016-11-17", "level": "", "num_look": 151370, "num_comment": 5, "author": "AVLTeam", "tags": ["资讯"], "text": "著名的反恶意软件组织MalwareMustDie决定关闭其博客网站，以抗议NSA（美国国家安全局）利用黑客工具入侵无辜国家的教育和公共服务器。"}
{"title": "从Tesco银行账户被盗看金融企业安全应急措施", "url": "https://www.freebuf.com/news/119431.html", "time": "2016-11-17", "level": "", "num_look": 234301, "num_comment": 5, "author": "孙毛毛", "tags": ["企业安全", "安全管理"], "text": "Tesco（乐购）作为英国最大的零售商，在上周末不幸遭遇网络抢劫。"}
{"title": "Cellebrite公司专访：为FBI破解手机的以色列移动设备取证公司", "url": "https://www.freebuf.com/articles/others-articles/119888.html", "time": "2016-11-17", "level": "", "num_look": 415063, "num_comment": 4, "author": "clouds", "tags": ["人物志", "其他"], "text": "今年早些时候，FBI和苹果公司因枪击案凶手的IPhone手机解锁问题大打嘴仗，使得这家名不见经传的以色列移动取证公司成为了公众焦点。"}
{"title": "极客DIY：制作一个可以面部、自主规划路径及语音识别的无人机", "url": "https://www.freebuf.com/geek/119389.html", "time": "2016-11-16", "level": "", "num_look": 345740, "num_comment": 4, "author": "饭团君", "tags": ["极客"], "text": "经过我的研究和选择之后，我觉得选择Parrot AR.Drone2无人机，当然你可以购买全新的无人机，但这里考虑成本的问题，我觉得使用二手的无人机。"}
{"title": "如何恢复Linux中的误删文件", "url": "https://www.freebuf.com/sectool/119574.html", "time": "2016-11-16", "level": "", "num_look": 467118, "num_comment": 8, "author": "Alpha_h4ck", "tags": ["工具", "特别企划"], "text": "在开始教程之前我有必要提醒大家，使用窗口管理器（GUI）删除文件和使用命令行工具（CLI）删除文件这两种方法之间是有区别的。"}
{"title": "修补网络安全人才缺口要多少钱？美国国家标准及技术研究：36万美元", "url": "https://www.freebuf.com/articles/others-articles/119342.html", "time": "2016-11-16", "level": "金币+6", "num_look": 356574, "num_comment": 9, "author": "米雪儿", "tags": ["其他", "安全管理"], "text": "美国国家标准及技术研究所（NIST）正式推出一款名为“CyberSeek”的交互式在线工具，旨在帮助网络安全求职者提供更多就业机会，同时帮助雇主们识别所需的技能娴熟的员工。"}
{"title": "只用一台笔记本发动DDoS攻击，就能让大型服务器下线", "url": "https://www.freebuf.com/news/119952.html", "time": "2016-11-16", "level": "红色标题", "num_look": 706164, "num_comment": 20, "author": "孙毛毛", "tags": ["网络安全", "资讯"], "text": "BlackNurse能够让独立入侵者用有限的资源驱动大规模DDoS攻击，直接将大型服务器踢下线。"}
{"title": "静态分析工具大集合", "url": "https://www.freebuf.com/sectool/119680.html", "time": "2016-11-16", "level": "金币+6", "num_look": 864492, "num_comment": 11, "author": "鸢尾", "tags": ["工具"], "text": "这是一个静态分析工具大集合，其中[OSS]代表开源软件，[PROPRIETARY]代表付费软件，欢迎各位补充。"}
{"title": "使用USRP探索无线世界 Part 1：USRP从入门到追踪飞机飞行轨迹", "url": "https://www.freebuf.com/articles/wireless/119950.html", "time": "2016-11-15", "level": "红色标题", "num_look": 1091439, "num_comment": 18, "author": "漏洞盒子", "tags": ["无线安全"], "text": "使用USRP探索无线世界，把无形的无线电波\"可视化\""}
{"title": "蔓灵花APT行动攻击报告", "url": "https://www.freebuf.com/articles/paper/120002.html", "time": "2016-11-15", "level": "", "num_look": 455238, "num_comment": 12, "author": "360安全", "tags": ["安全报告"], "text": "日前，360追日团队发布名为《蔓灵花攻击行动》的简报，又披露了一个针对中国政府机构和能源行业发起APT攻击的海外黑客组织。该黑客组织与此前披露的摩诃草APT组织类似，同样以中国和巴基斯坦作为攻击目标，意在窃取…"}
{"title": "对上司有意见？将打印机改造成伪基站监视他", "url": "https://www.freebuf.com/news/118869.html", "time": "2016-11-15", "level": "", "num_look": 296589, "num_comment": 16, "author": "kuma", "tags": ["资讯"], "text": "你对上司有意见吗？你讨厌同事吗？想不想监视他们？新西兰工程师教你，怎样在办公室打印机里藏一个手机基站，监视他们！"}
{"title": "极客DIY：如何用Siri与树莓派“交互”", "url": "https://www.freebuf.com/geek/119719.html", "time": "2016-11-15", "level": "", "num_look": 651330, "num_comment": 18, "author": "山东安云", "tags": ["极客"], "text": "本着折腾到死的极客心态，从网上淘了一块树莓派对苹果推出的HomeKit智能家居平台进行逆向。"}
{"title": "网络安全的未来：13位投资人，企业家，公司高层及政府官员的看法", "url": "https://www.freebuf.com/articles/neopoints/119629.html", "time": "2016-11-15", "level": "金币+6", "num_look": 273132, "num_comment": 1, "author": "游鱼在侧", "tags": ["观点"], "text": "信息安全行业投资过热？看专家如何解读。"}
{"title": "斩断恶性病毒的运输线 ，用动态防御阻击“脚本类下载器”", "url": "https://www.freebuf.com/articles/system/119271.html", "time": "2016-11-15", "level": "", "num_look": 271008, "num_comment": 11, "author": "火绒安全", "tags": ["系统安全"], "text": "近年来，因为病毒的制作者逐渐发现了脚本类病毒相较于PE病毒所具有的优势，所以脚本类病毒样本开始呈井喷式增长。"}
{"title": "美国大型成人网站遭黑，4.12亿用户数据曝光", "url": "https://www.freebuf.com/news/119931.html", "time": "2016-11-15", "level": "", "num_look": 567840, "num_comment": 32, "author": "kuma", "tags": ["资讯"], "text": "美国成人网站遭黑，4.12亿用户数据遭泄露。"}
{"title": "FIT 2017大会精彩抢先看：一场创新安全技术的派对", "url": "https://www.freebuf.com/news/119802.html", "time": "2016-11-14", "level": "红色标题", "num_look": 226552, "num_comment": 4, "author": "FB独家", "tags": ["资讯"], "text": "对于黑客和极客们，最令人振奋的莫过于有关创新安全技术的分享与讨论，今天我们就来看看FIT 2017 【X-TECH】论坛有哪些亮点。"}
{"title": "企业如何应对安全产品“误报”？", "url": "https://www.freebuf.com/articles/neopoints/119525.html", "time": "2016-11-14", "level": "金币+10", "num_look": 265878, "num_comment": 2, "author": "Carrie_spinfo", "tags": ["安全管理", "观点"], "text": "误报最常见的成因是配置不良或调整不佳的安全工具，本文推荐了7个降低误报率的基本习惯，值得学习。"}
{"title": "如何利用LTE网络协议漏洞把手机踢下网", "url": "https://www.freebuf.com/articles/network/119635.html", "time": "2016-11-14", "level": "", "num_look": 407599, "num_comment": 16, "author": "Sphinx", "tags": ["网络安全"], "text": "研究人员在欧洲黑帽大会上演示了如何攻击LTE网络协议。攻击者可以选择暂时或永久地关闭特定用户的连接把他们踢下网，也可以针对某一整个地区实施攻击。"}
{"title": "异次元窃贼：使用AutoIt脚本进行键盘记录窃取的“新奇玩法”", "url": "https://www.freebuf.com/articles/system/119695.html", "time": "2016-11-14", "level": "", "num_look": 304456, "num_comment": 4, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "与通常的木马不同的是，新发现的这类木马在payload中大量使用了混淆的AutoIt脚本来实现各种恶意功能，包括混淆、虚拟机检测、傀儡进程内存替换、键盘记录等行为。"}
{"title": "“成人影集”样本分析（下篇）", "url": "https://www.freebuf.com/articles/system/119653.html", "time": "2016-11-14", "level": "现金奖励", "num_look": 402377, "num_comment": 15, "author": "expsky", "tags": ["安全报告", "系统安全"], "text": "该木马可以比特币挖矿、网络嗅探、代理服务、ddos攻击、自保护、文本记录、web邮件、传播等等字眼，木马功能非常丰富。"}
{"title": "2016年3例严重工控安全事故经验教训总结", "url": "https://www.freebuf.com/news/118984.html", "time": "2016-11-14", "level": "金币+10", "num_look": 571316, "num_comment": 3, "author": "clouds", "tags": ["安全报告", "工控安全"], "text": "在此，我们就2016年三次主要ICS事件进行讨论，综合专家意见，总结经验。"}
{"title": "天方夜谭？避免DDoS的唯一可行方案", "url": "https://www.freebuf.com/articles/network/118778.html", "time": "2016-11-14", "level": "金币+10", "num_look": 419109, "num_comment": 22, "author": "Alpha_h4ck", "tags": ["网络安全", "观点"], "text": "这是个DDoS攻击越来越普遍的时代，之前针对Dyn的攻击让美国半个互联网都瘫痪了，对此我们有什么解决方案吗？Infoworld作者脑洞大开给出了这样一个答案，来看看！"}
{"title": "珠海市魅族科技招聘安全测试工程师", "url": "https://www.freebuf.com/jobs/118372.html", "time": "2016-11-13", "level": "", "num_look": 253924, "num_comment": 16, "author": "魅族科技（中国）有限公司", "tags": ["安全招聘"], "text": "魅族科技招聘安全测试工程师，薪资待遇10K-30K。"}
{"title": "美国孕育网络安全创新企业的7大圣地", "url": "https://www.freebuf.com/news/118868.html", "time": "2016-11-13", "level": "", "num_look": 199896, "num_comment": 4, "author": "米雪儿", "tags": ["其他", "特别企划"], "text": "出于这个原因，安全企业在获得他们发展所需的资本、技能和机会后开始涌现到以下几大地区。"}
{"title": "当人工智能应用于黑色产业", "url": "https://www.freebuf.com/news/118642.html", "time": "2016-11-13", "level": "", "num_look": 262214, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["特别企划", "观点"], "text": "虽然恶意软件+人工智能现在还没有被利用，但是迟早会被用上的，到时候，我们怎么办？"}
{"title": "Anonymous黑客专访：LulzCart出狱后的日常", "url": "https://www.freebuf.com/news/118154.html", "time": "2016-11-13", "level": "金币+10", "num_look": 425000, "num_comment": 23, "author": "Alpha_h4ck", "tags": ["人物志", "特别企划"], "text": "你想知道Anonymous黑客组织的黑客在被警方逮捕并判刑之后会发生什么事吗？来看看Anonymous著名黑客LulzCart的亲身遭遇。"}
{"title": "湖北灰科诚招渗透工程师", "url": "https://www.freebuf.com/jobs/119817.html", "time": "2016-11-12", "level": "", "num_look": 421810, "num_comment": 48, "author": "湖北灰科信息技术有限公司", "tags": ["安全招聘"], "text": "湖北灰科信息技术有限公司一家专业从事于为公检法等机关单位提供网络信息安全软件产品开发及相关技术服务的高科技公司"}
{"title": "【FB TV】一周「BUF大事件」：利用Mirai僵尸网络企图关闭国家网络；可自己发明加密算法的AI；Gmail被发现存高危漏洞", "url": "https://www.freebuf.com/video/119864.html", "time": "2016-11-12", "level": "红色标题", "num_look": 478515, "num_comment": 1, "author": "supercoco", "tags": ["视频"], "text": "Google的人工智能可以自己发明加密算法，人工智能的发展会去向何方。"}
{"title": "新手指南：DVWA-1.9全级别教程之File Inclusion", "url": "https://www.freebuf.com/articles/web/119150.html", "time": "2016-11-12", "level": "金币+10", "num_look": 1877230, "num_comment": 34, "author": "lonehand", "tags": ["WEB安全"], "text": "File Inclusion，意思是文件包含（漏洞），是指当服务器开启allow_url_include选项时，就可以通过php的某些特性函数利用url去动态包含文件。"}
{"title": "信息安全人才依旧奇缺，企业真的无人可用了吗？", "url": "https://www.freebuf.com/articles/neopoints/118777.html", "time": "2016-11-12", "level": "", "num_look": 255216, "num_comment": 11, "author": "Alpha_h4ck", "tags": ["观点"], "text": "随着科技的不断发展，企业也逐渐开始在自身的业务处理流程中引入云计算、移动办公、物联网、以及大数据等新兴技术了。"}
{"title": "揭开暗网服务的神秘面纱（上）", "url": "https://www.freebuf.com/articles/network/119334.html", "time": "2016-11-12", "level": "金币+10", "num_look": 625374, "num_comment": 9, "author": "Alpha_h4ck", "tags": ["特别企划", "网络安全"], "text": "目前暗网服务器存在的五大安全问题"}
{"title": "第二届OTA大数据分析与风险管理峰会", "url": "https://www.freebuf.com/fevents/119832.html", "time": "2016-11-11", "level": "", "num_look": 187309, "num_comment": 2, "author": "欧阳洋葱", "tags": ["活动"], "text": "2016年第二届OTA大数据分析与风险管理峰会将于2016年12月3日在上海金茂君悦大酒店举办。"}
{"title": "Android N如何限制重置密码以遏制勒索软件", "url": "https://www.freebuf.com/articles/terminal/119316.html", "time": "2016-11-11", "level": "", "num_look": 289665, "num_comment": 5, "author": "360手机卫士", "tags": ["终端安全"], "text": "Android N如何设置才能避免勒索软件？看看360官方是怎么回答的。"}
{"title": "一次XorDDos变种样本的分析实战记录(附工具下载）", "url": "https://www.freebuf.com/articles/system/119374.html", "time": "2016-11-11", "level": "现金奖励", "num_look": 775920, "num_comment": 17, "author": "熊猫正正", "tags": ["系统安全"], "text": "XorDDos类型样本主要特点，用暴力猜解目标机器ssh弱密码的方式，入侵目标机器，然后执行相应的shell脚本。"}
{"title": "【WitAwards 2016 “年度创新产品”参评巡礼】微步在线ThreatBook威胁情报产品分析", "url": "https://www.freebuf.com/special/118981.html", "time": "2016-11-11", "level": "", "num_look": 392727, "num_comment": 1, "author": "FreeBuf咨询", "tags": ["特别企划"], "text": "威胁情报究竟是怎样一种存在形式？借着分析微步在线ThreatBook威胁情报产品之机，我们就来谈一谈威胁情报的定义、部署、标准等方面问题。"}
{"title": "比一比Nmap、Zmap、Masscan三种扫描工具", "url": "https://www.freebuf.com/sectool/119340.html", "time": "2016-11-11", "level": "现金奖励", "num_look": 1486308, "num_comment": 14, "author": "ArkTeam", "tags": ["工具"], "text": "Nmap、Zmap、Masscan，扫描工具哪家强？"}
{"title": "CSS2016干货一览：用PS4办公？秒破Surface？显卡还能助力自动驾驶...", "url": "https://www.freebuf.com/fevents/119720.html", "time": "2016-11-10", "level": "", "num_look": 190362, "num_comment": 2, "author": "欧阳洋葱", "tags": ["活动"], "text": "有没有想过用游戏机来办公？知不知道其实只需要1秒就能攻破Surface Pro？CSS 2016今天的分论坛上呈现了不少类似这样的干货！"}
{"title": "好用的Google漏洞爬虫：Google Mass Explorer", "url": "https://www.freebuf.com/sectool/119668.html", "time": "2016-11-10", "level": "", "num_look": 509615, "num_comment": 13, "author": "dawner", "tags": ["WEB安全", "工具"], "text": "Google不止是搜索引擎，它还可以当作漏洞扫描器。"}
{"title": "用好OnionScan，自己动手制作暗网爬虫", "url": "https://www.freebuf.com/sectool/118856.html", "time": "2016-11-10", "level": "", "num_look": 715000, "num_comment": 10, "author": "Alpha_h4ck", "tags": ["工具", "特别企划"], "text": "喜大普奔！OnionScan0.2终于发布啦！在新版OnionScan中，最引人注目的一个新功能就是“custom crawls”（自定义爬取）"}
{"title": "这真的不是科幻大片！ HACK DEMO环节主角招募中", "url": "https://www.freebuf.com/news/119435.html", "time": "2016-11-10", "level": "红色标题", "num_look": 269242, "num_comment": 6, "author": "shiery0207", "tags": ["活动", "资讯"], "text": "还记得去年FreeBuf互联网安全创新大会上的神奇魔法吗？"}
{"title": "Trick蠕虫病毒来袭，幕后主使竟是一名高中生", "url": "https://www.freebuf.com/articles/terminal/119056.html", "time": "2016-11-10", "level": "", "num_look": 496305, "num_comment": 38, "author": "AVLTeam", "tags": ["终端安全"], "text": "近期，安天AVL移动安全团队和小米MIUI安全中心发现一款携带勒索功能的拦截马Trick，经过样本溯源发现，该病毒竟出自国内一名高中生之手。"}
{"title": "信息安全行业女性Tracy Maleeff专访", "url": "https://www.freebuf.com/articles/neopoints/119175.html", "time": "2016-11-10", "level": "金币+7", "num_look": 459781, "num_comment": 10, "author": "Alpha_h4ck", "tags": ["人物志", "特别企划"], "text": "任何行业都需要有女性的参与，信息安全行业同样也是如此。"}
{"title": "全球19家值得关注的物联网安全初创企业", "url": "https://www.freebuf.com/news/119139.html", "time": "2016-11-10", "level": "", "num_look": 287570, "num_comment": 5, "author": "clouds", "tags": ["资讯"], "text": "近期，物联网设备（IoT）遭恶意软件感染发起的DDos攻击占据新闻头条。"}
{"title": "BB机如何威胁工控系统安全？", "url": "https://www.freebuf.com/news/118854.html", "time": "2016-11-10", "level": "", "num_look": 531527, "num_comment": 17, "author": "latiaojun", "tags": ["工控安全", "无线安全"], "text": "虽说黑客针对工艺系统的攻击较少，但我们也还是发现，其实ICS也面临严重的威胁。"}
{"title": "安全从来不止是安全企业的事！第二届中国互联网安全领袖峰会CSS与会有感", "url": "https://www.freebuf.com/fevents/119655.html", "time": "2016-11-09", "level": "", "num_look": 218128, "num_comment": 1, "author": "欧阳洋葱", "tags": ["活动"], "text": "有关“连接”的话题，已经被很多安全企业提出过很多次，可是腾讯在这届CSS2016之上还是将协作、连接、聚力说出了点儿新花样。"}
{"title": "网络安全公司逐步开始使用人工智能技术", "url": "https://www.freebuf.com/news/119088.html", "time": "2016-11-09", "level": "", "num_look": 351794, "num_comment": 5, "author": "kuma", "tags": ["资讯"], "text": "风投数据公司CB Insights研究发现，网络安全公司逐渐开始使用人工智能技术，改善安全防御体系，开创网络防护新时代。"}
{"title": "【WitAwards 2016“年度安全人物”参评巡礼】论武功，何知边和高：专访AFSRC TOP白帽子“咖啡”", "url": "https://www.freebuf.com/articles/people/118587.html", "time": "2016-11-09", "level": "", "num_look": 365950, "num_comment": 9, "author": "kuma", "tags": ["人物志", "特别企划"], "text": "电商里最厉害的白帽子"}
{"title": "针对白俄罗斯军事通讯社的APT样本分析", "url": "https://www.freebuf.com/articles/network/119137.html", "time": "2016-11-09", "level": "现金奖励", "num_look": 422420, "num_comment": 1, "author": "菠菜", "tags": ["特别企划", "网络安全"], "text": "从我们最初得到的email来看，攻击者针对是白俄罗斯共和国国防部武装部队军事通讯社进行的定向攻击。"}
{"title": "【已结束】CSS2016中国互联网安全领袖峰会视频&图文直播（Live）", "url": "https://www.freebuf.com/fevents/119355.html", "time": "2016-11-09", "level": "红色标题", "num_look": 516659, "num_comment": 1, "author": "欧阳洋葱", "tags": ["活动"], "text": "中国互联网安全领袖峰会(Cyber Security Summit，简称CSS)由腾讯公司、中国电子技术标准化研究院等企事业单位共同创办，今年的CSS有哪些好玩的？"}
{"title": "Gmail存高危漏洞，用户帐号可被轻松破解", "url": "https://www.freebuf.com/news/119229.html", "time": "2016-11-09", "level": "", "num_look": 582839, "num_comment": 19, "author": "latiaojun", "tags": ["漏洞", "资讯"], "text": "Gmail发现关键漏洞，黑客轻松几步就能破解任意Gmail账户，你的Gmail还安全吗？"}
{"title": "专攻企业高管的安卓商业间谍软件Exaspy被揭露", "url": "https://www.freebuf.com/articles/terminal/119529.html", "time": "2016-11-09", "level": "", "num_look": 306261, "num_comment": 3, "author": "米雪儿", "tags": ["终端安全"], "text": "研究人员已经在该公司副总裁的 Android 6.0.1 设备上发现了该恶意软件。目前，我们已经获得用户允许，披露一些关于Skycure发现间谍软件应用程序的细节。"}
{"title": "渗透测试神器Burp Suite v1.7.08发布（含下载）", "url": "https://www.freebuf.com/sectool/118802.html", "time": "2016-11-08", "level": "金币+8", "num_look": 615907, "num_comment": 38, "author": "jackyu", "tags": ["工具"], "text": "从应用程序攻击表面的最初映射和分析，到寻找和利用安全漏洞等过程，所有工具为支持整体测试程序而无缝地在一起工作。"}
{"title": "【购票折扣】FIT 2017精彩抢先看：以全球视野看安全产业发展", "url": "https://www.freebuf.com/news/118855.html", "time": "2016-11-08", "level": "红色标题", "num_look": 251213, "num_comment": 8, "author": "FB独家", "tags": ["头条", "特别企划"], "text": "本届FIT大会亮点颇多，三十多场主题讨论聚焦当下最受关注的“企业安全建设”“移动安全”“网络安全与人工智能”“网络安全法”等议题。"}
{"title": "浅谈大数据应用的隐私保护", "url": "https://www.freebuf.com/articles/neopoints/118976.html", "time": "2016-11-08", "level": "现金奖励", "num_look": 388370, "num_comment": 15, "author": "hxhacker", "tags": ["安全管理", "观点"], "text": "你的数据不仅某府想要，黑客更想要。"}
{"title": "席卷全球的“霸屏”病毒：技术分析与处理", "url": "https://www.freebuf.com/articles/terminal/118773.html", "time": "2016-11-08", "level": "", "num_look": 333318, "num_comment": 17, "author": "猎豹移动安全实验室", "tags": ["安全报告", "终端安全"], "text": "霸屏类病毒在最近两个月有蔓延的势头，尤其在俄罗斯、墨西哥等一些国家，危害极其严重。全球每天的感染手机在3万台以上。"}
{"title": "OAuth2.0部署不当，数十亿Android App账户存泄露风险", "url": "https://www.freebuf.com/news/119308.html", "time": "2016-11-08", "level": "", "num_look": 411319, "num_comment": 5, "author": "kuma", "tags": ["漏洞", "资讯"], "text": "香港大学的三名安全研究人员发现，众多支持单点登录的App没有正确部署OAuth2.0认证协议，攻击者可利用此漏洞远程登陆任何用户的App账户。"}
{"title": "Metasploitable 2系列教程：漏洞评估", "url": "https://www.freebuf.com/articles/network/117444.html", "time": "2016-11-08", "level": "金币+8", "num_look": 641230, "num_comment": 10, "author": "secist", "tags": ["网络安全"], "text": "本篇文章将从 Metasploitable 2 虚拟机的网络侧，对可获取的漏洞进行评估。"}
{"title": "Mac OSX系统下的渗透利用工具Empyre", "url": "https://www.freebuf.com/sectool/118715.html", "time": "2016-11-08", "level": "", "num_look": 734908, "num_comment": 5, "author": "clouds", "tags": ["工具", "终端安全"], "text": "我虽然是个苹果脑残粉，但是在安全方面，我还是不愿相信苹果的“神话”。"}
{"title": "个人情报收集系统浅谈", "url": "https://www.freebuf.com/articles/others-articles/117380.html", "time": "2016-11-08", "level": "红色标题", "num_look": 947848, "num_comment": 28, "author": "ArthurKiller", "tags": ["其他", "数据安全"], "text": "搭建一个个人情报收集系统有多难？"}
{"title": "要上天？Google的人工智能可以自己发明加密算法", "url": "https://www.freebuf.com/news/119081.html", "time": "2016-11-08", "level": "", "num_look": 264074, "num_comment": 10, "author": "米雪儿", "tags": ["资讯"], "text": "Google在“邪路”上已经走的越来越远，现在Google人工智能可以自己发明加密算法，避免遭到窃听。"}
{"title": "双11福利帖｜漏洞盒子带你任性带你飞", "url": "https://www.freebuf.com/fevents/119328.html", "time": "2016-11-07", "level": "红色标题", "num_look": 435561, "num_comment": 20, "author": "漏洞盒子", "tags": ["活动", "特别企划"], "text": "11+11=光棍节 or 购物节？"}
{"title": "启明星辰入侵检测本部WAF产线诚聘安全研究员", "url": "https://www.freebuf.com/jobs/118736.html", "time": "2016-11-07", "level": "", "num_look": 379016, "num_comment": 32, "author": "venustech-hr", "tags": ["安全招聘"], "text": "启明星辰公司成立于1996年，由留美博士严望佳女士创建。"}
{"title": "人大刚刚通过的《网络安全法》都有哪些看点？", "url": "https://www.freebuf.com/news/119207.html", "time": "2016-11-07", "level": "红色标题", "num_look": 694518, "num_comment": 30, "author": "kuma", "tags": ["头条", "特别企划"], "text": "十二届全国人大常委会第二十四次会议于11月7日上午，以154票赞成、1票弃权表决通过《中华人民共和国网络安全法》"}
{"title": "【快讯】印度驻7国使馆网站数据库遭黑客泄露", "url": "https://www.freebuf.com/news/119242.html", "time": "2016-11-07", "level": "", "num_look": 335950, "num_comment": 10, "author": "clouds", "tags": ["资讯"], "text": "6日，黑客Kapustkiy在Twitter上发贴，通过Pastebin共享网站，泄露了印度驻瑞士、马里、罗马尼亚、意大利、马拉维、南非和利比亚大使馆网站数据库。"}
{"title": "“抗马”小兵的一次实战记录", "url": "https://www.freebuf.com/articles/system/118928.html", "time": "2016-11-07", "level": "金币+16", "num_look": 303099, "num_comment": 13, "author": "wilsonlee", "tags": ["系统安全"], "text": "刚工作不久就遭遇了3次木马，第一是root木马，控制服务器对阿里某云进行流量攻击，后两次是木马攻击，使得服务器CPU异常的高，开发工程师无法正常登录。"}
{"title": "有人企图利用Mirai僵尸网络关闭某个国家的互联网", "url": "https://www.freebuf.com/news/119068.html", "time": "2016-11-07", "level": "", "num_look": 264932, "num_comment": 13, "author": "孙毛毛", "tags": ["资讯"], "text": "有人打算利用Mirai僵尸网络对一个国家发起大规模DDoS攻击，企图关闭整个国家的互联网！"}
{"title": "更便捷的中间人攻击框架Xerosploit", "url": "https://www.freebuf.com/sectool/118574.html", "time": "2016-11-07", "level": "", "num_look": 883501, "num_comment": 47, "author": "补丁君", "tags": ["工具"], "text": "在国外网站的一篇文章中发现有提到这款中间人框架，顺藤摸瓜拿来实践一番，发现确实很可以，确实很方便，不敢独享。"}
{"title": "云计算时代传统安全企业路在何方？阿里云高级安全专家邬怡这么说", "url": "https://www.freebuf.com/news/117202.html", "time": "2016-11-07", "level": "", "num_look": 310831, "num_comment": 3, "author": "欧阳洋葱", "tags": ["人物志", "特别企划"], "text": "在前不久的云栖大会上，阿里云高级安全专家邬怡和我们谈了谈在云计算的当下，传统安全厂商面临的选择问题。"}
{"title": "【WitAwards 2016“年度安全产品”参评巡礼】网络安全界中的“瑞士军刀”：长矛深度安全检测平台评测", "url": "https://www.freebuf.com/sectool/118929.html", "time": "2016-11-07", "level": "红色标题", "num_look": 463520, "num_comment": 14, "author": "FreeBuf咨询", "tags": ["工具", "特别企划"], "text": "长矛深度安全检测平台，有人说它是中国版的Metasploit，有人说它是安全界的瑞士军刀，还有人说它是自动化渗透平台，更有人说它是......"}
{"title": "珠海大横琴科技高薪诚聘信息安全专家", "url": "https://www.freebuf.com/jobs/118431.html", "time": "2016-11-06", "level": "", "num_look": 389518, "num_comment": 28, "author": "守月人", "tags": ["安全招聘"], "text": "大横琴科技，给人才一个实现梦想的平台。"}
{"title": "Meterpreter免杀技巧分享（亲测有效）", "url": "https://www.freebuf.com/sectool/118714.html", "time": "2016-11-06", "level": "现金奖励", "num_look": 1585558, "num_comment": 16, "author": "Green_m", "tags": ["工具", "系统安全"], "text": "meterpreter因为其简单多变的结构，强大的功能，在渗透中面对未知杀软环境的情况下效果不错。"}
{"title": "域名劫持事件发生后的应急响应策略", "url": "https://www.freebuf.com/articles/security-management/118425.html", "time": "2016-11-06", "level": "金币+16", "num_look": 493839, "num_comment": 3, "author": "dawner", "tags": ["安全管理"], "text": "在某周六的早上，你作为一家大公司的CSO（首席安全官），突然开始收到了雪片般飞来的消息。他们告诉你有游客在访问了你公司的网址后，浏览到了各种恶意内容。"}
{"title": "【FB TV】一周「BUF大事件」：影响出乎意料的“脏牛”漏洞；方程式黑客工具及文件再曝光；致半个美国互联网瘫痪的DDoS攻击实为误伤？", "url": "https://www.freebuf.com/video/119112.html", "time": "2016-11-05", "level": "红色标题", "num_look": 282636, "num_comment": 6, "author": "supercoco", "tags": ["视频"], "text": "“脏牛”漏洞的影响可远远不止一点；方程式组织内部黑客工具及文件再一次公布。"}
{"title": "TK在2016 BlackHat黑帽大会演讲视频：How Do I Get Big Brother Power？", "url": "https://www.freebuf.com/video/117302.html", "time": "2016-11-05", "level": "", "num_look": 448247, "num_comment": 32, "author": "clouds", "tags": ["视频"], "text": "看视频，有技术，有段子，还有demo，How Do I Get Big Brother Power？（\"我是如何获得大哥级神力的?”）"}
{"title": "新型DDos攻击：利用LDAP服务器实现攻击放大", "url": "https://www.freebuf.com/vuls/118337.html", "time": "2016-11-05", "level": "", "num_look": 526412, "num_comment": 4, "author": "latiaojun", "tags": ["漏洞", "网络安全"], "text": "Corero公司表示，通过进一步调查发现，黑客利用LDAP协议向目标发送垃圾流量，之前其它攻击中从未利用过该技术。"}
{"title": "勒索软件的开源真的有利于信息安全的发展吗？", "url": "https://www.freebuf.com/articles/neopoints/117474.html", "time": "2016-11-05", "level": "", "num_look": 221409, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["观点"], "text": "把勒索软件的源代码上传到GitHub？安全研究专家现在也无法确定这样做是否真的有利于信息安全的发展。"}
{"title": "华为流程与IT招聘高级网络安全工程师", "url": "https://www.freebuf.com/jobs/118159.html", "time": "2016-11-04", "level": "", "num_look": 319638, "num_comment": 15, "author": "spy_xiao", "tags": ["安全招聘"], "text": "华为正在招牛人，会是你吗？"}
{"title": "【漏洞预警】GitLab未授权访问漏洞可导致远程命令执行", "url": "https://www.freebuf.com/vuls/119055.html", "time": "2016-11-04", "level": "红色标题", "num_look": 528293, "num_comment": 1, "author": "ArthurKiller", "tags": ["漏洞", "系统安全"], "text": "2016年11月3日，美国众测平台HackerOne公布了GitLab的目录遍历漏洞，同时表示该漏洞可导致远程命令执行。"}
{"title": "【漏洞预警】MySQL现高危漏洞，可致服务器root权限被窃取", "url": "https://www.freebuf.com/news/119022.html", "time": "2016-11-04", "level": "红色标题", "num_look": 655236, "num_comment": 17, "author": "Sphinx", "tags": ["漏洞", "资讯"], "text": "波兰黑客本周公布了两个MySQL漏洞的PoC。第一个针对的是高危权限提升漏洞，而另一个PoC针对的则是一个新的root权限提升漏洞。"}
{"title": "安全开发Java动态代理", "url": "https://www.freebuf.com/articles/web/118334.html", "time": "2016-11-04", "level": "现金奖励", "num_look": 375682, "num_comment": 13, "author": "碳烤鱿鱼丝", "tags": ["WEB安全"], "text": "从几个方面，帮大家理解动态代理知识。"}
{"title": "选出你心中的安全Top Icon！ WitAwards 2016互联网安全年度评选“全网公投”火热开启", "url": "https://www.freebuf.com/news/118150.html", "time": "2016-11-04", "level": "红色标题", "num_look": 336376, "num_comment": 20, "author": "FB独家", "tags": ["头条", "活动"], "text": "历时50天，近400项申报及提名经激烈角逐，共预录取106席入围项目，现邀请您代表从业者，共同选出安全领域Top Icon，为安全产业的年度卓越喝彩！"}
{"title": "厉害了，word哥！4步轻松绕过PayPal双重验证机制", "url": "https://www.freebuf.com/vuls/117648.html", "time": "2016-11-04", "level": "", "num_look": 385064, "num_comment": 4, "author": "latiaojun", "tags": ["漏洞"], "text": "PayPal修复了一个非常明显的身份认证漏洞，该漏洞会导致认证机制失效。"}
{"title": "Malloc两种内存获取方式的区别", "url": "https://www.freebuf.com/articles/terminal/118211.html", "time": "2016-11-04", "level": "金币+11", "num_look": 360746, "num_comment": 5, "author": "Ox9A82", "tags": ["系统安全", "终端安全"], "text": "malloc是如何通过调用brk或mmap这两种syscall之一来获取内存的。"}
{"title": "恶意软件作者演示愚蠢的加密错误，安全专家或可轻易破解", "url": "https://www.freebuf.com/articles/system/117559.html", "time": "2016-11-04", "level": "金币+11", "num_look": 243345, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "想要编写安全的代码是一件非常具有挑战性的事情，而正确地在软件中使用加密算法则更加需要下苦功夫。"}
{"title": "谷歌又双叒叕曝光Windows的0day漏洞，微软很不开心", "url": "https://www.freebuf.com/news/118699.html", "time": "2016-11-04", "level": "", "num_look": 339014, "num_comment": 10, "author": "kuma", "tags": ["漏洞", "资讯"], "text": "谷歌近日再次曝光Windows 0day漏洞，称该漏洞可影响所有现行的Windows操作系统，而微软还没来得及修复。"}
{"title": "腾讯云安全团队诚招志士", "url": "https://www.freebuf.com/jobs/118338.html", "time": "2016-11-03", "level": "", "num_look": 636454, "num_comment": 10, "author": "孙毛毛", "tags": ["安全招聘"], "text": "云+未来，这场竞技，你愿意放马过来吗？"}
{"title": "新手指南：DVWA-1.9全级别教程之CSRF", "url": "https://www.freebuf.com/articles/web/118352.html", "time": "2016-11-03", "level": "金币+11", "num_look": 2813474, "num_comment": 43, "author": "lonehand", "tags": ["WEB安全"], "text": "DVWA是一个用来进行安全脆弱性鉴定的PHP/MySQL Web应用，旨在帮助web开发者更好的理解web应用安全防范的过程。"}
{"title": "信息安全行业洗牌观察记", "url": "https://www.freebuf.com/articles/neopoints/118682.html", "time": "2016-11-03", "level": "金币+11", "num_look": 541251, "num_comment": 30, "author": "SSW", "tags": ["观点"], "text": "作者在安全行业耕耘多年，以独到的眼光对安全行业未来的变化进行了大胆的预测，相信在未来越来越多的安全需求趋于通用化。"}
{"title": "关于Joomla!内容管理系统漏洞情况的通报", "url": "https://www.freebuf.com/vuls/118789.html", "time": "2016-11-03", "level": "", "num_look": 348608, "num_comment": 16, "author": "CNNVD", "tags": ["漏洞"], "text": "近日，国家信息安全漏洞库（CNNVD）收到关于Joomla!内容管理系统存在安全绕过漏洞(CNNVD-201610-739)及远程提权漏洞(CNNVD-201610-740)的情况报送。"}
{"title": "中国美女黑客披露LTE伪基站攻击 通话和短信都可以被截获", "url": "https://www.freebuf.com/news/118169.html", "time": "2016-11-03", "level": "金币+11", "num_look": 964443, "num_comment": 59, "author": "Alpha_h4ck", "tags": ["无线安全", "网络安全"], "text": "美女黑客张婉桥在4G LTE通信网络中发现了安全漏洞，并且在Ruxcon黑客大会上向全世界展示了如何拦截LTE通信网络中的语音通信和短信消息。"}
{"title": "Net Cease：微软研究员研发的反探测工具", "url": "https://www.freebuf.com/sectool/117761.html", "time": "2016-11-03", "level": "", "num_look": 255811, "num_comment": 3, "author": "dawner", "tags": ["工具"], "text": "近日微软研究人员Itay Grady和Tal Be’ery发布了Powershell脚本Net Cease，它可以防止攻击者在企业内网中获取到突破点后，继续横向扩展获取敏感信息。"}
{"title": "全球25家最值得关注的新兴安全厂商", "url": "https://www.freebuf.com/articles/security-management/118083.html", "time": "2016-11-03", "level": "金币+11", "num_look": 497996, "num_comment": 11, "author": "Carrie_spinfo", "tags": ["安全管理", "特别企划"], "text": "有哪些新兴的安全厂商值得一看？"}
{"title": "这个19KB的“成人影集”到底做了什么？", "url": "https://www.freebuf.com/articles/system/118114.html", "time": "2016-11-03", "level": "现金奖励", "num_look": 992547, "num_comment": 29, "author": "expsky", "tags": ["系统安全"], "text": "一个19KB“成人影集”引发的血案，值得一看。"}
{"title": "新美大（美团点评）招聘高级安全工程师", "url": "https://www.freebuf.com/jobs/118222.html", "time": "2016-11-02", "level": "", "num_look": 272065, "num_comment": 11, "author": "花小花", "tags": ["安全招聘"], "text": "来美团为消费者和商家的的交易安全保驾护航，构建一个安全的O2O平台。"}
{"title": "Shadow Brokers公布被NSA入侵的各国服务器名单，中国为重灾区", "url": "https://www.freebuf.com/news/118531.html", "time": "2016-11-02", "level": "", "num_look": 576868, "num_comment": 26, "author": "latiaojun", "tags": ["资讯"], "text": "一大波NSA黑客工具来袭，NSA黑客的主要目标是中国。"}
{"title": "Pwn2Own 2016：中国黑客团队实现入侵Nexus6P和iPhone6S，斩获21.5万美金", "url": "https://www.freebuf.com/news/118013.html", "time": "2016-11-02", "level": "", "num_look": 237598, "num_comment": 16, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "腾讯科恩实验室的安全研究人员在2016年Pwn2Own黑客大赛上仅用了五分钟便成功入侵了Nexus6P和iPhoneiOS 10.1，并一举揽获了21.5万美元的大赛奖金。"}
{"title": "普通硬件就能破解GSM A5加密算法", "url": "https://www.freebuf.com/news/117897.html", "time": "2016-11-02", "level": "", "num_look": 330938, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["网络安全", "资讯"], "text": "还在使用GSM手机的各位要小心了。"}
{"title": "“九头虫”病毒技术分析报告", "url": "https://www.freebuf.com/articles/terminal/117028.html", "time": "2016-11-02", "level": "", "num_look": 355137, "num_comment": 11, "author": "阿里聚安全", "tags": ["安全报告", "终端安全"], "text": "九头虫病毒被阿里聚安全研究人员深度解析"}
{"title": "ios测试神器needle使用环境搭建", "url": "https://www.freebuf.com/articles/terminal/118021.html", "time": "2016-11-02", "level": "金币+10", "num_look": 365449, "num_comment": 10, "author": "andy110", "tags": ["终端安全"], "text": "这是Mwrlabs 继drozer之后，又出一款ios测试神器needle。"}
{"title": "路由追踪程序Traceroute分析与科普", "url": "https://www.freebuf.com/articles/network/118221.html", "time": "2016-11-02", "level": "", "num_look": 981200, "num_comment": 5, "author": "ArkTeam", "tags": ["网络安全"], "text": "本次实验使用Wireshark抓取数据包进行简要分析来验证traceroute和tracert的实现原理。"}
{"title": "使用各种扫描工具的你，不但踩了“蜜罐”可能还要被团灭了", "url": "https://www.freebuf.com/articles/network/116922.html", "time": "2016-11-02", "level": "现金奖励", "num_look": 873186, "num_comment": 22, "author": "evil7", "tags": ["特别企划", "网络安全"], "text": "我们就来分析一下已经爆出来的，或还没说破的那些反杀Show。"}
{"title": "滴滴出行安全部诚聘安全英才", "url": "https://www.freebuf.com/jobs/117668.html", "time": "2016-11-01", "level": "", "num_look": 503858, "num_comment": 37, "author": "安惞", "tags": ["安全招聘"], "text": "滴滴出行安全部诚聘英才，现急招，资深安全平台技术运营。"}
{"title": "看完这篇报告，ATM取款机上的指纹识别你还敢用吗？", "url": "https://www.freebuf.com/articles/paper/116923.html", "time": "2016-11-01", "level": "", "num_look": 433273, "num_comment": 7, "author": "欧阳洋葱", "tags": ["安全报告"], "text": "将生物识别身份认证技术应用到ATM机上真的安全吗？卡巴斯基的这份报告给出了比较全面的解答。"}
{"title": "中国最大的Webshell后门箱子调查，所有公开大马全军覆没", "url": "https://www.freebuf.com/news/topnews/118424.html", "time": "2016-11-01", "level": "红色标题", "num_look": 4247880, "num_comment": 255, "author": "匿名A", "tags": ["WEB安全", "头条"], "text": "某安全人员打入核心黑产圈子，黑产圈内成员一月收入超过百万。"}
{"title": "神秘力量入侵，FreeBuf邀您参战：FreeBuf互联网安全创新（FIT 2017）大会序言", "url": "https://www.freebuf.com/news/118124.html", "time": "2016-11-01", "level": "红色标题", "num_look": 324421, "num_comment": 7, "author": "FB独家", "tags": ["头条", "特别企划"], "text": "一年一度，2017 FreeBuf互联网安全创新大会 强势降临。"}
{"title": "Gartner发布2016 SIEM魔力象限报告，IBM、Splunk持续领跑", "url": "https://www.freebuf.com/articles/security-management/118376.html", "time": "2016-11-01", "level": "", "num_look": 533001, "num_comment": 4, "author": "kuma", "tags": ["安全报告", "安全管理"], "text": "Gartner最近公布了针对SIEM产品的魔力象限——所谓的SIEM也就是安全信息和事件管理平台。"}
{"title": "如何使用ODROID-C2打造个人专属的渗透测试系统？", "url": "https://www.freebuf.com/sectool/118183.html", "time": "2016-11-01", "level": "金币+10", "num_look": 475164, "num_comment": 15, "author": "secist", "tags": ["工具", "系统安全"], "text": "纯技术流的攻略走一波~~~"}
{"title": "这款小型设备可以劫持几乎所有飞行中的无人机", "url": "https://www.freebuf.com/news/118015.html", "time": "2016-11-01", "level": "", "num_look": 389058, "num_comment": 5, "author": "latiaojun", "tags": ["工具", "资讯"], "text": "现在，你可以通过一款小型设备就能劫持任何飞行中的无人机了！！！"}
{"title": "Metasploitable 2系列教程：信息收集", "url": "https://www.freebuf.com/articles/network/117269.html", "time": "2016-11-01", "level": "金币+10", "num_look": 509991, "num_comment": 7, "author": "secist", "tags": ["特别企划", "网络安全"], "text": "列举有关 Metasploitable 2 这个系统的相关漏洞，并利用漏洞来收集和获取我们所需要的信息。"}
{"title": "金山云招聘安全运维工程师", "url": "https://www.freebuf.com/jobs/117513.html", "time": "2016-10-31", "level": "", "num_look": 184395, "num_comment": 6, "author": "金山云", "tags": ["安全招聘"], "text": "金山云是金山集团旗下控股公司，为用户和企业提供云服务产品。"}
{"title": "工业防火墙又出事了！施耐德工业防火墙被爆严重安全漏洞", "url": "https://www.freebuf.com/news/118167.html", "time": "2016-10-31", "level": "", "num_look": 289532, "num_comment": 289532, "author": "Alpha_h4ck", "tags": ["头条", "漏洞"], "text": "工业安全公司CyberX的安全研究专家在2016年工业控制系统（ICS）网络安全大会上披露了好几个严重的安全漏洞。"}
{"title": "如何利用Rowhammer漏洞Root Android手机（含演示视频+Exploit源码）", "url": "https://www.freebuf.com/news/118163.html", "time": "2016-10-31", "level": "金币+8", "num_look": 620677, "num_comment": 8, "author": "Alpha_h4ck", "tags": ["终端安全", "资讯"], "text": "近期，安全研究专家通过研究发现了一种root安卓手机的新方法，即通过Rowhammer漏洞来root安卓手机。"}
{"title": "Linux平台“盖茨木马”分析", "url": "https://www.freebuf.com/articles/system/117823.html", "time": "2016-10-31", "level": "", "num_look": 600370, "num_comment": 10, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "本文针对盖茨木马样本进行了细致的分析，同时介绍了多种在Linux环境下的安全工具。"}
{"title": "论如何在CTF比赛中搅“shi”", "url": "https://www.freebuf.com/articles/web/118149.html", "time": "2016-10-31", "level": "现金奖励", "num_look": 1003965, "num_comment": 23, "author": "Virink", "tags": ["WEB安全", "其他"], "text": "phithon神：“比赛就是和他人竞争的过程，通过各种手段阻止对手拿分我觉得也是一种能力。”"}
{"title": "APT攻击双城记：中国黑客干的？", "url": "https://www.freebuf.com/news/117952.html", "time": "2016-10-31", "level": "", "num_look": 286709, "num_comment": 8, "author": "clouds", "tags": ["安全报告", "特别企划"], "text": "这是最好的时代，这是最坏的时代。最近，俄罗斯对美国和其它国际组织开展的APT攻击占据新闻头条，而在聚光灯外，中国的APT攻击也异常活跃。"}
{"title": "你家路由器“有趣”的24小时：路由器真的安全吗？（含视频）", "url": "https://www.freebuf.com/news/topnews/117748.html", "time": "2016-10-31", "level": "金币+8", "num_look": 550834, "num_comment": 17, "author": "Alpha_h4ck", "tags": ["其他", "头条"], "text": "随着Mirai恶意软件的开源，今后将会有越来越多的物联网设备暴露于安全风险之中，我们真的准备好了吗？"}
{"title": "为什么企业应该聘用黑客：如果你无法打败他们，那么就让他们加入你的团队", "url": "https://www.freebuf.com/articles/neopoints/117440.html", "time": "2016-10-31", "level": "", "num_look": 254828, "num_comment": 10, "author": "Alpha_h4ck", "tags": ["观点"], "text": "黑客的力量常常令人望而生畏，企业是应避而远之，还是应加以利用？看专家如何看待黑客的力量。"}
{"title": "文档化身商业木马，对“盗神”的分析与溯源", "url": "https://www.freebuf.com/news/117354.html", "time": "2016-10-30", "level": "", "num_look": 234319, "num_comment": 6, "author": "腾讯电脑管家", "tags": ["系统安全", "资讯"], "text": "某波兰黑客团队制作的木马在全世界进行传播"}
{"title": "上周针对Dyn的DDoS攻击，其实只是一名脚本小子想要攻击PSN，却误伤了Dyn？", "url": "https://www.freebuf.com/news/117830.html", "time": "2016-10-30", "level": "", "num_look": 239233, "num_comment": 3, "author": "孙毛毛", "tags": ["资讯"], "text": "Dyn很有可能是被误伤的？"}
{"title": "InTerCyber公司在消息系统中发现了一个严重的漏洞", "url": "https://www.freebuf.com/news/117588.html", "time": "2016-10-30", "level": "", "num_look": 143887, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "安全研究人员表示，Telegram、WhatsApp、以及Signal都将会受到这个漏洞的影响。"}
{"title": "如何从内存提取LastPass中的账号密码", "url": "https://www.freebuf.com/articles/system/117553.html", "time": "2016-10-30", "level": "", "num_look": 596595, "num_comment": 5, "author": "鸢尾", "tags": ["数据安全", "系统安全"], "text": "先声明，这个并不是last pass的漏洞，主要是读取内存记录和历史记录。"}
{"title": "【FB TV】一周「BUF大事件」：上周末大半美国互联网瘫痪；富士康在代工安卓手机留下后门；猪队友坑Cellebrite公司致软件遭泄露", "url": "https://www.freebuf.com/video/118123.html", "time": "2016-10-29", "level": "红色标题", "num_look": 282149, "num_comment": 4, "author": "supercoco", "tags": ["特别企划", "视频"], "text": "是什么致使半个美国互联网瘫痪？富士康在代工制造某些Android智能手机时留下了后门？"}
{"title": "阿里聚安全Android应用漏洞扫描器解析：本地拒绝服务检测详解", "url": "https://www.freebuf.com/sectool/117547.html", "time": "2016-10-29", "level": "", "num_look": 289137, "num_comment": 8, "author": "阿里聚安全", "tags": ["工具"], "text": "本地DOS漏洞详解"}
{"title": "脏牛漏洞影响范围超出想象，以后所有Android手机都能被Root？", "url": "https://www.freebuf.com/news/117677.html", "time": "2016-10-29", "level": "", "num_look": 512787, "num_comment": 14, "author": "kuma", "tags": ["资讯"], "text": "还记得上周的脏牛漏洞吗？这个漏洞也影响到了Android系统，而且是几乎所有版本，分分钟完成root操作！"}
{"title": "【威胁预警】AtomBombing内存注入技术影响全部Windows系统", "url": "https://www.freebuf.com/news/118026.html", "time": "2016-10-28", "level": "红色标题", "num_look": 518577, "num_comment": 22, "author": "ArthurKiller", "tags": ["漏洞", "系统安全"], "text": "AtomBombing内存注入技术可以影响所有的windows系统，无法被杀毒软件查杀，并且无法修复。"}
{"title": "业界：看雪科技获得永洲创投500万元天使轮融资", "url": "https://www.freebuf.com/news/118047.html", "time": "2016-10-28", "level": "", "num_look": 205284, "num_comment": 11, "author": "欧阳洋葱", "tags": ["资讯"], "text": "看雪科技获得永洲创投500万元天使轮融资——这是紧跟昨天安洵信息获得天使轮融资之后，永洲创投的又一次投资行为。"}
{"title": "2016 Q2被黑网站趋势报告：哪家CMS最易招黑？黑客入侵网站后会干什么？", "url": "https://www.freebuf.com/articles/web/117011.html", "time": "2016-10-28", "level": "", "num_look": 396926, "num_comment": 12, "author": "MarquisF", "tags": ["WEB安全", "安全报告"], "text": "FreeBuf对这份报告进行了摘要汇总，包括哪家CMS更容易被黑，以及黑客入侵站点后通常都喜欢做些什么。"}
{"title": "云上需要“支付宝”吗？数据加密初创公司LOCKet在首场发布会上如此阐释", "url": "https://www.freebuf.com/fevents/117954.html", "time": "2016-10-28", "level": "", "num_look": 275200, "num_comment": 7, "author": "kuma", "tags": ["活动"], "text": "还记得今年8月份百度云的事件吗？一夜之间，你放在百度网盘的照片、视频消失得无影无踪，大量色情视频替代了用户原来的文件，网盘用户顿时炸开了锅。"}
{"title": "Mirai物联网僵尸攻击深度解析", "url": "https://www.freebuf.com/articles/terminal/117927.html", "time": "2016-10-28", "level": "", "num_look": 1277112, "num_comment": 10, "author": "ADLab", "tags": ["安全报告", "终端安全"], "text": "Mirai深度解析，了解美国为什么会被断网。"}
{"title": "解码Sofacy APT组织开发新的Flash Player利用平台——DealersChoice", "url": "https://www.freebuf.com/sectool/117073.html", "time": "2016-10-28", "level": "", "num_look": 286739, "num_comment": 1, "author": "米雪儿", "tags": ["工具"], "text": "Sofacy APT组织开发新的Flash Player利用平台"}
{"title": "一步一步教你如何解锁被盗的iPhone 6S", "url": "https://www.freebuf.com/news/117369.html", "time": "2016-10-28", "level": "金币+6", "num_look": 2122156, "num_comment": 21, "author": "Alpha_h4ck", "tags": ["特别企划", "终端安全"], "text": "如何攻破六位密码和touch ID来解锁你的iphone6s手机。"}
{"title": "尴尬了，以色列数字取证公司软件遭泄漏", "url": "https://www.freebuf.com/news/117914.html", "time": "2016-10-28", "level": "红色标题", "num_look": 334520, "num_comment": 25, "author": "latiaojun", "tags": ["资讯"], "text": "一个专门“读取”他人敏感数据的公司，自己的核心产品竟会被泄漏，也是没谁了。"}
{"title": "【WitAwards 2016“年度安全云及云服务”参评巡礼】云端“挑战者”：金山云安全服务评测", "url": "https://www.freebuf.com/articles/neopoints/117916.html", "time": "2016-10-27", "level": "红色标题", "num_look": 449682, "num_comment": 6, "author": "FreeBuf咨询", "tags": ["安全报告", "特别企划"], "text": "云已经是互联网发展的一种趋势，那么金山优势如何保障云安全的？"}
{"title": "安洵信息获千万级天使轮融资：创投看中公共安全市场", "url": "https://www.freebuf.com/news/117903.html", "time": "2016-10-27", "level": "", "num_look": 391744, "num_comment": 27, "author": "欧阳洋葱", "tags": ["资讯"], "text": "最近安洵信息获得永洲创投提供的千万级天使轮融资，安洵信息对投资公司而言最大的价值在哪儿呢？"}
{"title": "“红遍全球”的恶意软件Mirai，你所需要知道的那些事", "url": "https://www.freebuf.com/news/topnews/117788.html", "time": "2016-10-27", "level": "", "num_look": 710157, "num_comment": 14, "author": "clouds", "tags": ["头条", "特别企划"], "text": "让我们随着FreeBuf来简单了解一下Mirai吧！"}
{"title": "PunkSPIDER：开源大型自动化扫描系统", "url": "https://www.freebuf.com/sectool/117105.html", "time": "2016-10-27", "level": "", "num_look": 382939, "num_comment": 5, "author": "dawner", "tags": ["工具"], "text": "PunkSPIDER是一款由PunkSCAN出品的大型WEB漏洞扫描器。"}
{"title": "开源团队内部贡献平台Mooder", "url": "https://www.freebuf.com/sectool/117524.html", "time": "2016-10-27", "level": "", "num_look": 445742, "num_comment": 24, "author": "phithon", "tags": ["工具"], "text": "有的人把Mooder理解为一个漏洞平台：团队成员可以提交漏洞，管理员进行审核与评分，最后能够兑换礼品或兑换其他人的漏洞。"}
{"title": "Metasploitable 2系列教程：漏洞利用之Unreal IRCd 3.2.8.1", "url": "https://www.freebuf.com/sectool/117491.html", "time": "2016-10-27", "level": "金币+6", "num_look": 489156, "num_comment": 9, "author": "secist", "tags": ["工具", "网络安全"], "text": "如何利用 Metasploitable 2 上 Unreal IRCd service 存在的漏洞。"}
{"title": "看我如何用一千块钱搭个八核十六线程、32G内存的工作站", "url": "https://www.freebuf.com/articles/others-articles/117242.html", "time": "2016-10-27", "level": "现金奖励", "num_look": 2642937, "num_comment": 98, "author": "Push丶EAX", "tags": ["其他", "极客"], "text": "1200块的神机。秒天，秒地，秒I7！"}
{"title": "关于物联网设备安全漏洞引发大规模网络攻击事件的通报", "url": "https://www.freebuf.com/news/117853.html", "time": "2016-10-26", "level": "", "num_look": 284822, "num_comment": 4, "author": "CNNVD", "tags": ["资讯"], "text": "近期，互联网上披露了有关“大量物联网设备存在弱口令漏洞”的相关情况。"}
{"title": "Ruler：一款利用Exchange服务渗透的安全工具", "url": "https://www.freebuf.com/sectool/117516.html", "time": "2016-10-26", "level": "金币+6", "num_look": 568138, "num_comment": 17, "author": "Carrie_spinfo", "tags": ["工具"], "text": "Ruler是一款能够通过MAPI/HTTP协议与Exchange服务器交互的工具。其目的在于测试outlook客户端的邮件规则"}
{"title": "万能手机破解的正确姿势", "url": "https://www.freebuf.com/articles/terminal/117069.html", "time": "2016-10-26", "level": "", "num_look": 404854, "num_comment": 8, "author": "饭团君", "tags": ["特别企划", "终端安全"], "text": "手机设置了指纹加密就一定安全吗？下面就一起来了解一下吧。"}
{"title": "渗透利器Weevely之奇淫技巧篇", "url": "https://www.freebuf.com/sectool/117085.html", "time": "2016-10-26", "level": "金币+16", "num_look": 869021, "num_comment": 12, "author": "zusheng", "tags": ["WEB安全", "工具"], "text": "本文介绍的不是Weevely最基本的功能，而是在渗透测试过程中使用它的奇淫技巧。"}
{"title": "CIO与CISO的角色演变", "url": "https://www.freebuf.com/articles/security-management/117173.html", "time": "2016-10-26", "level": "", "num_look": 479175, "num_comment": 1, "author": "kuma", "tags": ["安全管理"], "text": "CISO一般是向CIO汇报，但是随着安全变得越来越重要，这种情况正在悄然改变。那么，这将如何改变两者之间的关系？两者如何更好地合作？"}
{"title": "实用技巧：如何通过IP地址进行精准定位", "url": "https://www.freebuf.com/sectool/117164.html", "time": "2016-10-26", "level": "金币+16", "num_look": 6212478, "num_comment": 77, "author": "allen权", "tags": ["其他", "工具"], "text": "如何利用高精度IP定位API接口。"}
{"title": "Samsung Pay漏洞深度剖析", "url": "https://www.freebuf.com/articles/terminal/117145.html", "time": "2016-10-26", "level": "现金奖励", "num_look": 306787, "num_comment": 7, "author": "狴犴安全团队", "tags": ["终端安全"], "text": "Samsung Pay是不是真的这么不堪一击呢？"}
{"title": "恶意软件伪装“正规军”，撕开Booster Cleaner“画皮”下的真相", "url": "https://www.freebuf.com/articles/terminal/117525.html", "time": "2016-10-25", "level": "", "num_look": 211692, "num_comment": 1, "author": "AVLTeam", "tags": ["终端安全"], "text": "AVLTeam揭发Booster Cleaner私底下的肮脏“交易”"}
{"title": "过期签名“红颜”木马分析", "url": "https://www.freebuf.com/articles/system/117264.html", "time": "2016-10-25", "level": "", "num_look": 313837, "num_comment": 8, "author": "360安全", "tags": ["系统安全"], "text": "更改系统时间，使用过期的数字签名。"}
{"title": "Linux进程隐藏的一种实现思路", "url": "https://www.freebuf.com/articles/system/117234.html", "time": "2016-10-25", "level": "红色标题", "num_look": 689711, "num_comment": 35, "author": "NSRC", "tags": ["系统安全"], "text": "当务之急是需要将这些监控进程隐藏起来，对Linux略知一二的楼主自然也就接受挑战啦。"}
{"title": "浏览器插件的攻击向量", "url": "https://www.freebuf.com/articles/web/117112.html", "time": "2016-10-25", "level": "现金奖励", "num_look": 582385, "num_comment": 11, "author": "Black-Hole", "tags": ["WEB安全", "系统安全"], "text": "本篇文章说的内容，可以给大家打开一个新的攻击思路，做APT攻击的话也会有奇效。"}
{"title": "招商银行招聘信息安全相关岗位", "url": "https://www.freebuf.com/jobs/117582.html", "time": "2016-10-25", "level": "", "num_look": 442033, "num_comment": 24, "author": "xysky", "tags": ["安全招聘"], "text": "招商银行，是中国第一家完全由企业法人持股的股份制商业银行，简称招行，成于1987年4月8日，由香港招商局集团有限公司创办，是中国内地规模第六大的银行。"}
{"title": "解读NSA史上最大型泄露事件：50TB数据、5亿页政府文档失窃", "url": "https://www.freebuf.com/news/117545.html", "time": "2016-10-25", "level": "", "num_look": 248344, "num_comment": 9, "author": "kuma", "tags": ["特别企划", "资讯"], "text": "NSA承包商雇员窃取海量数据，遭美国司法部起诉。"}
{"title": "手把手教你解密MacOS平台下的Chrome密码", "url": "https://www.freebuf.com/articles/web/117038.html", "time": "2016-10-25", "level": "", "num_look": 587332, "num_comment": 9, "author": "Alpha_h4ck", "tags": ["WEB安全", "数据安全"], "text": "那么对于我们这些Mac用户来说，当我们需要快速导出Chrome中存储的全部密码时，我们该怎么做呢？"}
{"title": "为何大部分人都在使用不安全的密码？", "url": "https://www.freebuf.com/articles/security-management/117058.html", "time": "2016-10-25", "level": "", "num_look": 404252, "num_comment": 14, "author": "孙毛毛", "tags": ["安全报告", "安全管理"], "text": "一项新的调查中显示，绝大多数人明知重复使用密码带来的风险，还一意孤行的使用自己的“旧”密码。"}
{"title": "2016 GeekPwn极客嘉年华技术亮点与大赛纪实", "url": "https://www.freebuf.com/fevents/117599.html", "time": "2016-10-25", "level": "红色标题", "num_look": 404066, "num_comment": 7, "author": "ArthurKiller", "tags": ["活动", "特别企划"], "text": "极客们破解的不只是Pwn，更是一次次的极限。"}
{"title": "安卓手机的后门控制工具SPADE", "url": "https://www.freebuf.com/articles/terminal/117347.html", "time": "2016-10-24", "level": "", "num_look": 428555, "num_comment": 12, "author": "clouds", "tags": ["终端安全"], "text": ""}
{"title": "是谁那么大本事让美国半个互联网瘫痪？有家中国企业牵扯其中？", "url": "https://www.freebuf.com/news/117561.html", "time": "2016-10-24", "level": "红色标题", "num_look": 347959, "num_comment": 15, "author": "欧阳洋葱", "tags": ["资讯"], "text": "上周末美国大半个互联网都沦陷了，发起攻击的黑客究竟是何许人也？竟有一家中国企业牵扯其中？"}
{"title": "分析感染华硕路由器的P2P僵尸网络程序TheMoon", "url": "https://www.freebuf.com/articles/terminal/117437.html", "time": "2016-10-24", "level": "", "num_look": 321709, "num_comment": 3, "author": "clouds", "tags": ["终端安全"], "text": "在这篇文章中，我们将对一个感染华硕路由器的P2P僵尸网络程序（bot）进行分析。"}
{"title": "走近科学：希拉里团队邮箱是如何被黑客入侵的", "url": "https://www.freebuf.com/news/117464.html", "time": "2016-10-24", "level": "金币+8", "num_look": 567624, "num_comment": 17, "author": "clouds", "tags": ["其他", "特别企划"], "text": "Podesta无意点击了邮件中的恶意链接，其邮箱密码就成了黑客的“囊中之物”。"}
{"title": "【已结束】2016 GeekPwn极棒嘉年华图文直播", "url": "https://www.freebuf.com/fevents/117483.html", "time": "2016-10-24", "level": "红色标题", "num_look": 574911, "num_comment": 574911, "author": "FB独家", "tags": ["活动", "特别企划"], "text": "GeekPwn嘉年华将于10月24日再次拉开大幕，FreeBuf前线记者全程在线直播本次活动。"}
{"title": "图片钓鱼：追捕漏网之鱼", "url": "https://www.freebuf.com/articles/web/117148.html", "time": "2016-10-24", "level": "现金奖励", "num_look": 414750, "num_comment": 9, "author": "mscb", "tags": ["WEB安全"], "text": "不点开新建标签页的链接就安全了？别急！现在是时候追捕剩下的漏网之鱼了。"}
{"title": "前CIA和NSA局长：黑外国政府？我们本来就干这事儿", "url": "https://www.freebuf.com/news/117163.html", "time": "2016-10-24", "level": "", "num_look": 182778, "num_comment": 8, "author": "孙毛毛", "tags": ["资讯"], "text": "前CIA和NSA局长言辞激烈，抨击克里姆林宫试图干预美国大选。"}
{"title": "富士康代工的Android手机中惊现“Pork Explosion”漏洞", "url": "https://www.freebuf.com/news/116987.html", "time": "2016-10-24", "level": "", "num_look": 237440, "num_comment": 7, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "安全研究专家JonSawyer公开表示，他在某些由富士康代工制造的Android智能手机中发现了一个后门。"}
{"title": "CSP的今世与未来", "url": "https://www.freebuf.com/articles/web/116836.html", "time": "2016-10-23", "level": "", "num_look": 388895, "num_comment": 4, "author": "阿里聚安全", "tags": ["WEB安全"], "text": "CSP的今世与未来，带你了解什么是CSP"}
{"title": "如何破解一台智能咖啡机", "url": "https://www.freebuf.com/vuls/116627.html", "time": "2016-10-23", "level": "金币+8", "num_look": 417762, "num_comment": 17, "author": "饭团君", "tags": ["漏洞"], "text": "近日有国外黑客破解一台智能咖啡机，下面就一起来看一下吧。"}
{"title": "日本核研究实验室的研究数据和用户信息遭黑客窃取", "url": "https://www.freebuf.com/news/116984.html", "time": "2016-10-23", "level": "", "num_look": 138278, "num_comment": 6, "author": "米雪儿", "tags": ["资讯"], "text": "日本富山大学向日本媒体透露，2015年11月—2016年6月期间，黑客针对日本富山大学氢同位素研究中心发起多起攻击。"}
{"title": "CISCO Nexus系列交换机发布重要补丁更新", "url": "https://www.freebuf.com/vuls/116238.html", "time": "2016-10-22", "level": "", "num_look": 250925, "num_comment": 2, "author": "dawner", "tags": ["漏洞"], "text": "思科近日发布了一批的补丁，主要针对的是CISCO Nexus 7000系列交换机以及带有Nexus OS的软件。"}
{"title": "加密软件VeraCrypt审计报告公布，发现多个高危漏洞（附报告下载）", "url": "https://www.freebuf.com/news/117029.html", "time": "2016-10-22", "level": "", "num_look": 279824, "num_comment": 6, "author": "latiaojun", "tags": ["漏洞", "资讯"], "text": "在 DuckDuckGo 和 VikingVPN 的资助下，QuarksLab 对开源加密软件 VeraCrypt 进行了安全审计。此次审计发现了8个高危漏洞和10多个中低级别的漏洞。"}
{"title": "【FB TV】一周「BUF大事件」可通过人体传输数据；Diffie-Hellman密钥交换技术被攻破；维基创始人阿桑奇被传死亡", "url": "https://www.freebuf.com/video/117387.html", "time": "2016-10-22", "level": "红色标题", "num_look": 281060, "num_comment": 4, "author": "supercoco", "tags": ["特别企划", "视频"], "text": "用人体传输数据？Diffie-Hellman密钥交换技术被攻破？"}
{"title": "美国半个互联网瘫痪了！DNS服务提供商遭遇几波大规模DDoS攻击", "url": "https://www.freebuf.com/news/117403.html", "time": "2016-10-22", "level": "红色标题", "num_look": 673444, "num_comment": 18, "author": "欧阳洋葱", "tags": ["资讯"], "text": "昨天晚上到今天早晨，DNS服务提供商Dyn遭遇大规模DDoS攻击，导致了美国互联网大面积瘫痪，Twitter、GitHub等大量站点无法访问。"}
{"title": "sudo-snooper：一款伪装成sudo命令的“蜜罐”脚本", "url": "https://www.freebuf.com/sectool/116942.html", "time": "2016-10-22", "level": "金币+8", "num_look": 316679, "num_comment": 18, "author": "phper", "tags": ["工具"], "text": "内网渗透测试中，你值得使用的小工具。"}
{"title": "警惕，WinRAR和TrueCrypt安装程序在用户电脑中植入恶意程序", "url": "https://www.freebuf.com/articles/system/116407.html", "time": "2016-10-22", "level": "红色标题", "num_look": 483708, "num_comment": 28, "author": "latiaojun", "tags": ["系统安全"], "text": "新一波恶意软件来袭，你需要警惕你的WinRAR."}
{"title": "【快讯】印度遭遇史上最大型银行数据泄漏事件，疑似中国黑客所为", "url": "https://www.freebuf.com/news/117324.html", "time": "2016-10-21", "level": "", "num_look": 370269, "num_comment": 9, "author": "latiaojun", "tags": ["数据安全", "资讯"], "text": "近日有黑客使用恶意软件入侵了日立支付服务(Hitachi Payment Services)系统，并盗取了印度320万用户的借记卡信息。 据说和中国黑客有关！"}
{"title": "智能硬件设备八大安全问题分析", "url": "https://www.freebuf.com/articles/terminal/117262.html", "time": "2016-10-21", "level": "", "num_look": 433847, "num_comment": 5, "author": "360安全", "tags": ["终端安全"], "text": "目前，IoT 技术还处于起步阶段，与金融、电子商务等其他行业相比，安全性尚未得到充分理解和明确定义，而该文主要归纳总结了智能设备常见的八大安全漏洞。"}
{"title": "漏洞预警：Linux内核9年高龄的“脏牛”0day漏洞", "url": "https://www.freebuf.com/vuls/117331.html", "time": "2016-10-21", "level": "红色标题", "num_look": 1529376, "num_comment": 21, "author": "漏洞盒子", "tags": ["漏洞", "系统安全"], "text": "Linux内核已有9年高龄的0day漏洞今天很火，编号为CVE-2016-5195，但它在网络上还有另一个大名——“脏牛”。"}
{"title": "关于Cisco ASA Software安全漏洞情况的通报", "url": "https://www.freebuf.com/vuls/117270.html", "time": "2016-10-21", "level": "", "num_look": 277800, "num_comment": 2, "author": "CNNVD", "tags": ["漏洞"], "text": "该漏洞源于Cisco ASA防火墙对NetBIOS协议数据解析时产生溢出错误，攻击者可利用该漏洞对内存数据进行覆盖，从而执行任意代码。"}
{"title": "如何用kwetza给安卓应用加后门", "url": "https://www.freebuf.com/articles/terminal/116924.html", "time": "2016-10-21", "level": "", "num_look": 592791, "num_comment": 7, "author": "鸢尾", "tags": ["终端安全"], "text": "这篇文章将会描述一种在Android可执行文件中种后门的方法。在接下来的动手操作部分，我将使用到开源工具Kwetza，没错作者就是我……"}
{"title": "漏洞预警：joomla，ja-k2-filter-and-search 组件0day 注入漏洞", "url": "https://www.freebuf.com/news/117143.html", "time": "2016-10-21", "level": "", "num_look": 290904, "num_comment": 7, "author": "漏洞盒子", "tags": ["漏洞", "资讯"], "text": "近日，国外安全研究员Dimitrios Roussis和 Evangelos Apostoloudis 发现joomla的ja-k2-filter-and-search组件存在SQL注入漏洞。"}
{"title": "新手指南：DVWA-1.9全级别教程之Command Injection", "url": "https://www.freebuf.com/articles/web/116714.html", "time": "2016-10-21", "level": "金币+15", "num_look": 1828484, "num_comment": 18, "author": "lonehand", "tags": ["WEB安全"], "text": "最新的DVWA已经更新到1.9版本（http://www.dvwa.co.uk/），而网上的教程大多停留在旧版本，且没有针对DVWA high级别的教程，因此萌发了一个撰写新手教程的想法。"}
{"title": "维基解密创始人被“死亡”，真相竟是……", "url": "https://www.freebuf.com/news/116919.html", "time": "2016-10-21", "level": "", "num_look": 448645, "num_comment": 14, "author": "latiaojun", "tags": ["资讯"], "text": "维基解密创始人Julian Assange被宣告“死亡”，竟跟这些人有关。"}
{"title": "为何你的浏览器不信任GlobalSign签发的HTTPS证书？", "url": "https://www.freebuf.com/news/116786.html", "time": "2016-10-21", "level": "", "num_look": 492507, "num_comment": 6, "author": "kuma", "tags": ["资讯"], "text": "就在上周，GlobalSign在更新一个交叉证书时，无意间吊销了中间证书，造成许多网站不再被浏览器和应用信任。"}
{"title": "FreeBuf商城上新｜您的假期余额虽已不足，但FB商城上新仍在继续", "url": "https://www.freebuf.com/fevents/116996.html", "time": "2016-10-20", "level": "", "num_look": 238767, "num_comment": 21, "author": "FB客服", "tags": ["活动"], "text": "FreeBuf商城更新啦！！！"}
{"title": "“杀手”木马：一个浏览器恶意插件行为分析", "url": "https://www.freebuf.com/articles/web/117002.html", "time": "2016-10-20", "level": "", "num_look": 425435, "num_comment": 10, "author": "腾讯电脑管家", "tags": ["WEB安全"], "text": "一款通过浏览器插件作恶的“杀手”木马"}
{"title": "恶意软件即服务（MaaS）出租业务：新一代黑客工具套件OffensiveWare", "url": "https://www.freebuf.com/news/116440.html", "time": "2016-10-20", "level": "", "num_look": 327427, "num_comment": 3, "author": "米雪儿", "tags": ["工具", "资讯"], "text": "连黑客工具都往Saas这个趋势发展，厉害了word哥！"}
{"title": "子域名搜集思路与技巧梳理", "url": "https://www.freebuf.com/articles/web/117006.html", "time": "2016-10-20", "level": "红色标题", "num_look": 1470985, "num_comment": 35, "author": "NSRC", "tags": ["WEB安全"], "text": "本文适合Web安全爱好者，其中会提到8种思路，7个工具和还有1个小程序，看本文前需要了解相关的Web基础知识、子域名相关概念和Python 程序的基础知识。"}
{"title": "这款安卓木马会问你要张自拍", "url": "https://www.freebuf.com/articles/terminal/116775.html", "time": "2016-10-20", "level": "", "num_look": 283189, "num_comment": 4, "author": "孙毛毛", "tags": ["终端安全"], "text": "一旦用户不小心下载了新版的Acecard木马，就会要求他们上传一张手持身份证明的自拍照。"}
{"title": "由大型物联网僵尸网络驱动的DDoS攻击", "url": "https://www.freebuf.com/news/116629.html", "time": "2016-10-20", "level": "", "num_look": 343860, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "近日，Cloudflare公司发布了一份安全研究报告。在报告中，该公司的研究人员对近期的两次由大型物联网僵尸网络驱动的DDoS攻击进行了分析。"}
{"title": "终极加密：用人体传输密码", "url": "https://www.freebuf.com/news/116633.html", "time": "2016-10-19", "level": "", "num_look": 215917, "num_comment": 16, "author": "饭团君", "tags": ["资讯"], "text": "数据应该如何传输一直都饱受争议。近日，华盛顿大学的研究人员开发的一个新系统，可以通过身体来传输密码并解锁设备。"}
{"title": "【WitAwards 2016 “年度安全产品”参评巡礼】阿里聚安全移动安全组件解析", "url": "https://www.freebuf.com/special/116245.html", "time": "2016-10-19", "level": "", "num_look": 291944, "num_comment": 1, "author": "FreeBuf咨询", "tags": ["安全报告", "特别企划"], "text": "阿里聚安全是一个面向开发者，以移动应用安全为核心的开放平台。"}
{"title": "由HITCON 2016一道web聊一聊php反序列化漏洞", "url": "https://www.freebuf.com/vuls/116705.html", "time": "2016-10-19", "level": "现金奖励", "num_look": 848260, "num_comment": 17, "author": "grt1stnull", "tags": ["WEB安全", "漏洞"], "text": "反序列化漏洞在各种语言中都较为常见，此文详细介绍了php的反序列化漏洞。"}
{"title": "如何进行Linux平台共享库替换", "url": "https://www.freebuf.com/articles/system/116489.html", "time": "2016-10-19", "level": "现金奖励", "num_look": 373281, "num_comment": 21, "author": "gaearrow", "tags": ["系统安全"], "text": "Linux平台共享库之动态替换和静态替换"}
{"title": "ES6中的模板字符串和新XSS Payload", "url": "https://www.freebuf.com/articles/web/116825.html", "time": "2016-10-19", "level": "现金奖励", "num_look": 319336, "num_comment": 11, "author": "Sunnieli", "tags": ["WEB安全"], "text": ""}
{"title": "仿冒公检法手机诈骗简析", "url": "https://www.freebuf.com/articles/terminal/116908.html", "time": "2016-10-18", "level": "红色标题", "num_look": 515736, "num_comment": 13, "author": "腾讯手机管家", "tags": ["安全报告", "终端安全"], "text": "简析目前电信诈骗中最大的毒瘤——仿冒公检法类。"}
{"title": "美国军方无人机失控，难道是SIPRnet秘密网络被黑？", "url": "https://www.freebuf.com/news/116671.html", "time": "2016-10-18", "level": "", "num_look": 193109, "num_comment": 9, "author": "孙毛毛", "tags": ["资讯"], "text": "Creech空军基地一系列引人注目的空袭任务发生重大失误，美国空军正在调查这次事故原因跟他们使用的平行网络SIPRNet有什么联系。"}
{"title": "漏洞盒子 | 九月风云榜", "url": "https://www.freebuf.com/news/116945.html", "time": "2016-10-18", "level": "", "num_look": 189070, "num_comment": 7, "author": "漏洞盒子", "tags": ["资讯"], "text": "天气逐渐转凉，看着周围的小伙伴们都戴上了男/女朋友亲手织的围巾，是不是各种羡慕嫉妒恨？"}
{"title": "全球居然有200万IoT设备还存在12年前的OpenSSH“骨灰级”漏洞！", "url": "https://www.freebuf.com/news/116776.html", "time": "2016-10-18", "level": "", "num_look": 271735, "num_comment": 7, "author": "ArthurKiller", "tags": ["资讯"], "text": "洞不在新，能用就行：由于IoT厂商安全意识薄弱，大部分IoT设备存在12年前的SSH漏洞。"}
{"title": "Cerber敲诈者家族再升级：Cerber4变身随机后缀", "url": "https://www.freebuf.com/articles/system/116761.html", "time": "2016-10-18", "level": "", "num_look": 328393, "num_comment": 12, "author": "360安全", "tags": ["系统安全"], "text": "针对Cerber4勒索木马的详细分析"}
{"title": "中国制造IOT设备遭恶意软件Mirai感染成为近期DDOS攻击主力", "url": "https://www.freebuf.com/news/116722.html", "time": "2016-10-18", "level": "金币+9", "num_look": 478746, "num_comment": 5, "author": "clouds", "tags": ["特别企划", "资讯"], "text": "调查后表示，DDOS攻击使用了多达150万被入侵设备组成的“僵尸网络”，其中大部份为中国大华（DAHUA）公司生产的网络摄像头。"}
{"title": "谁给了你第一个手机病毒？安卓手机病毒来源分析", "url": "https://www.freebuf.com/articles/terminal/116583.html", "time": "2016-10-18", "level": "", "num_look": 460637, "num_comment": 7, "author": "猎豹移动安全实验室", "tags": ["安全报告", "终端安全"], "text": "用户手机的第一个病毒从何而来？这篇文章也许能给你答案。"}
{"title": "注意了，使用Sqlmap的你可能踩中了“蜜罐”", "url": "https://www.freebuf.com/sectool/116706.html", "time": "2016-10-18", "level": "现金奖励", "num_look": 1037728, "num_comment": 44, "author": "九如", "tags": ["工具", "数据安全"], "text": "注意了，使用sqlmap的你"}
{"title": "D-Link DWR-932B LTE路由器中发现多个后门", "url": "https://www.freebuf.com/vuls/116735.html", "time": "2016-10-17", "level": "金币+9", "num_look": 296743, "num_comment": 6, "author": "MarquisF", "tags": ["漏洞"], "text": "如果你有一个类似于DWR-932 B LTE的D-Link路由器，别等待它缓慢的固件升级了，还是直接放弃它比较好。"}
{"title": "漏洞盒子助你“攻进”GeekPwn：Geek攻破的不止是Pwn，是思维的极限", "url": "https://www.freebuf.com/fevents/116779.html", "time": "2016-10-17", "level": "", "num_look": 186712, "num_comment": 6, "author": "漏洞盒子", "tags": ["活动"], "text": "就算攻破了所有的Pwn，也攻不破你的心，但是，GeeKPwn心一直为你打开。"}
{"title": "安全之战：QCon上海2016精彩前瞻", "url": "https://www.freebuf.com/news/116667.html", "time": "2016-10-17", "level": "", "num_look": 175146, "num_comment": 2, "author": "newie", "tags": ["资讯"], "text": "即将于10月20~22日举行的QCon上海 2016 上，“安全之战”专题将从代码服用攻击与防御、企业级风险感知体系等层面，全面解析安全的挑战与应对之道。"}
{"title": "国外黑客发现的海康威视远程系统XXE漏洞分析", "url": "https://www.freebuf.com/vuls/116613.html", "time": "2016-10-17", "level": "金币+10", "num_look": 1224153, "num_comment": 15, "author": "clouds", "tags": ["漏洞"], "text": "通过固件提取分析，挖到一个海康的XXE注入漏洞"}
{"title": "一个漏洞泄露你的邮箱的所有秘密", "url": "https://www.freebuf.com/vuls/116670.html", "time": "2016-10-17", "level": "", "num_look": 391457, "num_comment": 3, "author": "360手机卫士", "tags": ["漏洞"], "text": "该漏洞可导致恶意应用获取到电子邮件内的数据，可能是电子邮件内容、电子邮件附件甚至账号密码。"}
{"title": "巧用COM接口IARPUninstallStringLauncher绕过UAC", "url": "https://www.freebuf.com/articles/system/116611.html", "time": "2016-10-17", "level": "现金奖励", "num_look": 603403, "num_comment": 17, "author": "ExpLife", "tags": ["系统安全"], "text": "编码实现程序自身调用windows卸载接口从而绕过UAC"}
{"title": "移动APP安全揭秘之第二期：授权登录的安全短板", "url": "https://www.freebuf.com/articles/terminal/116445.html", "time": "2016-10-17", "level": "", "num_look": 325193, "num_comment": 5, "author": "腾讯云安全", "tags": ["终端安全"], "text": "两年前新加坡南洋理工大学一位名叫 Wang Jing 的博士生，发现了 OAuth 和 OpenID 开源登录工具的“隐蔽重定向”漏洞(Covert Redirect)，博足了全世界眼球。"}
{"title": "国产“一句话”管理工具：开山斧", "url": "https://www.freebuf.com/sectool/116318.html", "time": "2016-10-17", "level": "金币+10", "num_look": 692642, "num_comment": 27, "author": "TrueByte", "tags": ["工具"], "text": "先有菜刀，后有蚁剑，现在有个开山斧！"}
{"title": "厉害了，Word哥：NSA如何破解数万亿份加密连接？", "url": "https://www.freebuf.com/news/116663.html", "time": "2016-10-16", "level": "", "num_look": 267515, "num_comment": 7, "author": "ArthurKiller", "tags": ["资讯"], "text": "NSA对HTTPS加密数据已经可以秒解！厉害了，word哥！"}
{"title": "Firefox新增安全机制：附加组件签名机制", "url": "https://www.freebuf.com/news/116498.html", "time": "2016-10-16", "level": "", "num_look": 211413, "num_comment": 2, "author": "ArkTeam", "tags": ["终端安全", "资讯"], "text": "笔者就详细介绍下Firefox浏览器新增的安全机制—附加组件签名机制，以帮助用户更好地了解和使用Firefox。"}
{"title": "黑客修改WordPress核心文件，劫持网站流量", "url": "https://www.freebuf.com/articles/web/116484.html", "time": "2016-10-16", "level": "", "num_look": 819997, "num_comment": 7, "author": "felix", "tags": ["WEB安全"], "text": "一个网站如何被用来传播有关Windwos序列号的广告内容。"}
{"title": "新手指南：DVWA-1.9全级别教程之Brute Force", "url": "https://www.freebuf.com/articles/web/116437.html", "time": "2016-10-16", "level": "金币+10", "num_look": 3741194, "num_comment": 35, "author": "lonehand", "tags": ["WEB安全"], "text": "新手看过来，DVWA最新版本教程"}
{"title": "【FB TV】一周「BUF大事件」： Dropbox先前泄露的6800万账号影响大；外泄的黑客服务清单；黑客游戏《Hackmud》学习游戏两不误", "url": "https://www.freebuf.com/video/116695.html", "time": "2016-10-15", "level": "红色标题", "num_look": 325400, "num_comment": 7, "author": "supercoco", "tags": ["视频"], "text": "新款多人在线游戏黑客游戏《Hackmud》来啦。"}
{"title": "来自日本的声音：CODEBLUE 2016信息安全大会召开在即", "url": "https://www.freebuf.com/fevents/116405.html", "time": "2016-10-15", "level": "", "num_look": 174725, "num_comment": 174725, "author": "欧阳洋葱", "tags": ["活动"], "text": "日本最大的信息安全大会CODEBLUE很快就要在本月20、21日与日本新宿召开了。"}
{"title": "无线宝宝wifi热点共享软件刷流量行为分析", "url": "https://www.freebuf.com/articles/system/116460.html", "time": "2016-10-15", "level": "", "num_look": 490028, "num_comment": 9, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "某wifi热点共享软件下载恶意程序,并解密运行传播。"}
{"title": "传输层安全协议抓包分析之SSL/TLS", "url": "https://www.freebuf.com/articles/network/116497.html", "time": "2016-10-15", "level": "", "num_look": 877366, "num_comment": 11, "author": "ArkTeam", "tags": ["网络安全"], "text": "SSL/TLS是保护计算机网络通讯安全的一类加密协议，它们在传输层上给原先非安全的应用层协议提供加密保护"}
{"title": "云上的世界是否真的更安全？2016杭州·云栖大会云安全看点", "url": "https://www.freebuf.com/fevents/116699.html", "time": "2016-10-15", "level": "", "num_look": 212480, "num_comment": 7, "author": "欧阳洋葱", "tags": ["活动"], "text": "仍有许多用户担心，上云是否真的安全。这是今天下午的云安全专场主要谈及的话题。"}
{"title": "云杉美菜诚聘安全人才", "url": "https://www.freebuf.com/jobs/116680.html", "time": "2016-10-14", "level": "", "num_look": 232592, "num_comment": 9, "author": "大果子", "tags": ["安全招聘"], "text": "美菜网作为食材B2B平台，一直致力于用前卫的理念和先进的科技颠覆中国农业市场，致力于帮助全国近千万家餐厅和蔬菜店铺做采购。"}
{"title": "全球最大比特币钱包运营商Blockchain遭遇DNS劫持攻击", "url": "https://www.freebuf.com/news/116591.html", "time": "2016-10-14", "level": "", "num_look": 484037, "num_comment": 13, "author": "latiaojun", "tags": ["网络安全", "资讯"], "text": "闻所未闻，比特币钱包公司Blockchain遭受了DNS劫持攻击，"}
{"title": "渗透航空WiFi一些攻防姿势", "url": "https://www.freebuf.com/articles/wireless/117228.html", "time": "2016-10-14", "level": "", "num_look": 525347, "num_comment": 1, "author": "饭团君", "tags": ["无线安全"], "text": "如果有人跟你说，未来的飞机恐怖威胁事件根本无需这么麻烦，作案工具只需一台能轻松通过安检的笔记本电脑即可，你是否会对此感到即好奇又害怕呢？"}
{"title": "亚马逊否认数据泄露，然后要求用户重置密码……", "url": "https://www.freebuf.com/news/116572.html", "time": "2016-10-14", "level": "", "num_look": 184559, "num_comment": 2, "author": "孙毛毛", "tags": ["资讯"], "text": "亚马逊最近“出于谨慎的考虑”，开始重置部分用户的密码。"}
{"title": "【直播中】2016杭州云栖大会图文直播", "url": "https://www.freebuf.com/fevents/116503.html", "time": "2016-10-14", "level": "红色标题", "num_look": 711146, "num_comment": 1, "author": "FB独家", "tags": ["活动"], "text": "2016杭州·云栖大会今天拉开帷幕。和FreeBuf一起来看马云爸爸和云栖上的安全议题！"}
{"title": "新加坡正式公布国家网络安全策略", "url": "https://www.freebuf.com/news/116395.html", "time": "2016-10-14", "level": "", "num_look": 241037, "num_comment": 4, "author": "clouds", "tags": ["资讯"], "text": "10月10日，在为期3天的新加坡国际网络周（SICW）开幕式上，新加坡总理李显龙正式宣布了该国的网络安全策略报告。"}
{"title": "数字签名中的幽灵——阈下信道", "url": "https://www.freebuf.com/articles/network/115840.html", "time": "2016-10-14", "level": "现金奖励", "num_look": 411710, "num_comment": 8, "author": "1phan", "tags": ["网络安全"], "text": "本文使用了Simmons论文中的公式，提到的阈下信道方案也并非作者发现，都是很多密码学家们的研究成果。不过这篇文章是作者原创，作者在各个平台都搜索过，似乎还没人发表过类似的科普文章。"}
{"title": "这份外泄的黑客服务清单又要掀起一场腥风血雨", "url": "https://www.freebuf.com/news/116492.html", "time": "2016-10-14", "level": "金币+8", "num_look": 234332, "num_comment": 10, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "印度Aglaya公司制作了一份长达20页的产品宣传册，内容包括全球政府会议上宣传监控工具和黑客工具的供货商们。"}
{"title": "数据和石油哪个更重要？2016杭州·云栖大会首日素描", "url": "https://www.freebuf.com/fevents/116620.html", "time": "2016-10-13", "level": "红色标题", "num_look": 345392, "num_comment": 14, "author": "欧阳洋葱", "tags": ["活动"], "text": "今年云栖大会对“数据”的讲解可能会颠覆你对数据这个词汇的认知！"}
{"title": "法国TV5Monde电视台差点遭俄罗斯黑客毁灭", "url": "https://www.freebuf.com/news/116328.html", "time": "2016-10-13", "level": "", "num_look": 167886, "num_comment": 1, "author": "米雪儿", "tags": ["资讯"], "text": "法国V5Monde电视台总负责人Yves Bigot表示，发生在2015年4月份的那场网络攻击差点将V5Monde电视台的整个基础设施彻底毁灭。"}
{"title": "黑产上演《三体》剧情：蠕虫病毒入侵手机群发“钓鱼”短信", "url": "https://www.freebuf.com/articles/terminal/116507.html", "time": "2016-10-13", "level": "", "num_look": 272925, "num_comment": 14, "author": "AVLTeam", "tags": ["终端安全"], "text": "在收到附带“钓鱼”链接的短信时，不要点开！不要点开！不要点开！！！"}
{"title": "Android系统新权限模型剖析与预警", "url": "https://www.freebuf.com/articles/terminal/116347.html", "time": "2016-10-13", "level": "", "num_look": 247781, "num_comment": 5, "author": "360手机卫士", "tags": ["终端安全"], "text": "前不久Google发布了新的系统版本Android7.0。在之前发布的6.0版本中，引入了一种新的权限模型。"}
{"title": "PHP7.0.0格式化字符串漏洞与EIP劫持分析", "url": "https://www.freebuf.com/vuls/116398.html", "time": "2016-10-13", "level": "现金奖励", "num_look": 283203, "num_comment": 4, "author": "zzz66686", "tags": ["漏洞"], "text": "在这里对PHP7.0.0格式化字符串漏洞进行一些简要分析，并讨论一下利用该漏洞劫持EIP的潜在方法。"}
{"title": "HackerOne CEO专访：我们正在打造全球最大的安全人才库", "url": "https://www.freebuf.com/articles/neopoints/116064.html", "time": "2016-10-13", "level": "金币+8", "num_look": 356458, "num_comment": 9, "author": "clouds", "tags": ["人物志", "观点"], "text": "在这篇访谈中，美国国际数据集团CCO John Gallant与Marten Mickos就HackerOne的运营模式和平台机制作了深入交流"}
{"title": "GnuRadio Hacking②：使用SDR嗅探北欧芯片无线键盘鼠标数据包", "url": "https://www.freebuf.com/articles/wireless/115440.html", "time": "2016-10-13", "level": "", "num_look": 685766, "num_comment": 11, "author": "漏洞盒子", "tags": ["无线安全"], "text": "使用SDR嗅探北欧芯片无线键盘鼠标跳频数据包"}
{"title": "解决麻烦还是制造麻烦？Windows故障诊断平台也能传播恶意软件", "url": "https://www.freebuf.com/news/116275.html", "time": "2016-10-12", "level": "", "num_look": 205653, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "“故障诊断平台”（WTP）原本可以帮助用户解决那些在Windows日常使用过程中遇到的问题，但在攻击者的眼中，它却成为了一个非常实用的攻击工具。"}
{"title": "【漏洞预警】基于RedHat发行的Apache Tomcat本地提权漏洞（CVE-2016-5425）", "url": "https://www.freebuf.com/news/116412.html", "time": "2016-10-12", "level": "", "num_look": 455524, "num_comment": 12, "author": "ArthurKiller", "tags": ["漏洞", "资讯"], "text": "Tomcat最近总想搞一些大新闻，一个月都没到，Tomcat又爆出漏洞——这次是Tomcat 基于RedHat发行版的本地提权漏洞。"}
{"title": "这是一款新出的黑客游戏《Hackmud》", "url": "https://www.freebuf.com/news/116251.html", "time": "2016-10-12", "level": "", "num_look": 1442929, "num_comment": 17, "author": "饭团君", "tags": ["资讯"], "text": "近日一款黑客游戏出现在市面上并引发了大量的讨论，下面就来介绍并向大家推荐一下这款游戏。"}
{"title": "【WitAwards 2016“年度安全产品”参评巡礼】验证安全2.0时代：极验验证码评测", "url": "https://www.freebuf.com/articles/others-articles/116331.html", "time": "2016-10-12", "level": "红色标题", "num_look": 439600, "num_comment": 16, "author": "FreeBuf咨询", "tags": ["其他", "安全报告"], "text": "验证码的设计是人能理解而机器无法理解的图像含义，但是随着OCR技术的发展，传统验证码已经严重影响用户体验。"}
{"title": "浅析互联网后最具颠覆性创新技术——区块链安全", "url": "https://www.freebuf.com/articles/database/116203.html", "time": "2016-10-12", "level": "现金奖励", "num_look": 873289, "num_comment": 3, "author": "白泽安全团队", "tags": ["区块链安全", "数据安全"], "text": "本文简单介绍区块链并浅析区块链可能存在的安全问题。"}
{"title": "你知道你的Mac摄像头正在偷窥你吗？这款工具或许能帮你", "url": "https://www.freebuf.com/sectool/116051.html", "time": "2016-10-12", "level": "", "num_look": 872420, "num_comment": 9, "author": "latiaojun", "tags": ["工具"], "text": "前NSA员工打造出一款能防止Mac电脑摄像头被侵入的新工具，妈妈再也不用担心隐私泄露了。"}
{"title": "前有猛狐挡路，后有苹果逼宫，沃通这次能否度过生死劫？", "url": "https://www.freebuf.com/articles/web/116201.html", "time": "2016-10-11", "level": "", "num_look": 378375, "num_comment": 13, "author": "latiaojun", "tags": ["WEB安全"], "text": "前有猛狐挡路，后有水果逼宫，沃通（WoSign）是否能将自己玩活？"}
{"title": "黑产白皮书 DDoS 篇——乌云笼罩下的产业百态", "url": "https://www.freebuf.com/articles/network/116340.html", "time": "2016-10-11", "level": "", "num_look": 535171, "num_comment": 28, "author": "腾讯云安全", "tags": ["安全报告", "网络安全"], "text": "当你面对 DDoS ，充分了解攻击者也是制胜关键。"}
{"title": "揭秘花招最多的三种敲诈者木马", "url": "https://www.freebuf.com/articles/system/115583.html", "time": "2016-10-11", "level": "", "num_look": 315534, "num_comment": 22, "author": "360安全", "tags": ["系统安全"], "text": "对于一个“正经”的黑产从业者来说，利益最大化是他所追求的目标，而利益最大化的实现无非需要两个方面来支撑，一是成本最小化，二是收入最大化。当然，那些制作、传播敲诈者木马的黑产从业者也深谙此道。"}
{"title": "希拉里PK川普激战正酣，看看黑客如何“干预”美国总统大选", "url": "https://www.freebuf.com/articles/others-articles/110144.html", "time": "2016-10-11", "level": "", "num_look": 538114, "num_comment": 9, "author": "kuma", "tags": ["其他", "特别企划"], "text": "联邦调查局（FBI）已经展开调查“民主党全国委员会（DNC）的电脑被黑”事件。越来越多的证据表明俄罗斯可能参与本此攻击。"}
{"title": "点击一张图片背后的风险", "url": "https://www.freebuf.com/articles/web/116003.html", "time": "2016-10-11", "level": "现金奖励", "num_look": 930745, "num_comment": 39, "author": "mscb", "tags": ["WEB安全"], "text": "你相信吗？仅仅是因为你点击了某个你一只在访问网站里的一张图片，导致你的用户名、密码泄漏，甚至电脑被植入病毒。"}
{"title": "僵尸网络的全球分布图原来是这样的……", "url": "https://www.freebuf.com/news/115943.html", "time": "2016-10-11", "level": "", "num_look": 458959, "num_comment": 9, "author": "kuma", "tags": ["其他", "网络安全"], "text": "一大波僵尸即将来袭。"}
{"title": "Jndi注入及Spring RCE漏洞分析", "url": "https://www.freebuf.com/vuls/115849.html", "time": "2016-10-11", "level": "现金奖励", "num_look": 537171, "num_comment": 19, "author": "碳烤鱿鱼丝", "tags": ["WEB安全", "漏洞"], "text": "十一期间重新关注了2016 BlackHat上面的议题，其中jndi注入引起了我的关注，本文主要分为以下3个部分，理解jndi、    分析jndi注入问题，以及Srping RCE漏洞形成的原因。"}
{"title": "闭关修炼半年，曾定向攻击台湾大选的APT组织再度回归", "url": "https://www.freebuf.com/articles/system/115791.html", "time": "2016-10-10", "level": "现金奖励", "num_look": 274108, "num_comment": 15, "author": "菠菜", "tags": ["系统安全"], "text": "分析一款利用CVE-2012-0158漏洞的木马样本，主要针对漏洞利用成功后的shellcode解密功能及木马功能。"}
{"title": "Android安全开发之安全使用HTTPS", "url": "https://www.freebuf.com/articles/terminal/115934.html", "time": "2016-10-10", "level": "", "num_look": 291240, "num_comment": 8, "author": "阿里聚安全", "tags": ["终端安全"], "text": "浅谈Android APP开发中的HTTPS使用规范"}
{"title": "“闭塞网络”攻击思路总结", "url": "https://www.freebuf.com/articles/wireless/116169.html", "time": "2016-10-10", "level": "金币+7", "num_look": 637244, "num_comment": 9, "author": "MarquisF", "tags": ["无线安全"], "text": "如何从不联网的电脑中盗取1KB名叫“新建文本文档”内容为test的txt文件？"}
{"title": "斯诺登力荐，号称史上最安全的即时通信应用Signal", "url": "https://www.freebuf.com/sectool/116009.html", "time": "2016-10-10", "level": "", "num_look": 758960, "num_comment": 13, "author": "dawner", "tags": ["工具"], "text": "为什么Signal会被认为是最安全的即时消息应用？这是由于它只会储存很少量的关于用户和事件的信息。"}
{"title": "关于Tomcat本地提权漏洞情况的通报", "url": "https://www.freebuf.com/vuls/116115.html", "time": "2016-10-10", "level": "", "num_look": 313227, "num_comment": 6, "author": "CNNVD", "tags": ["漏洞"], "text": "近日，互联网上披露了关于Tomcat启动脚本存在本地提权漏洞（CNNVD-201609-410 ）的情况。"}
{"title": "打造“免杀”的恶意程序需要多久？用这个工具，只要几分钟", "url": "https://www.freebuf.com/sectool/115915.html", "time": "2016-10-10", "level": "红色标题", "num_look": 618981, "num_comment": 20, "author": "felix", "tags": ["工具", "终端安全"], "text": "意大利萨尼奥大学（the University of Sannio）的研究团队Iswatlab，证实了打造一个能够规避杀软的恶意程序有多么容易。"}
{"title": "超轻量级反爬虫方案", "url": "https://www.freebuf.com/articles/web/115960.html", "time": "2016-10-10", "level": "", "num_look": 741783, "num_comment": 10, "author": "岂安科技", "tags": ["WEB安全"], "text": "爬虫在情报获取、虚假流量、动态定价、恶意攻击、薅羊毛等方面都能起到很关键的作用，所以每家公司都或多或少的需要开发一些爬虫程序，业界在这方面的成熟的方案也非常多；有矛就有盾，每家公司也相应的需要反爬虫…"}
{"title": "雅虎开发出一款可扫描所有用户邮件的工具？专为美国政府定制！", "url": "https://www.freebuf.com/news/115954.html", "time": "2016-10-09", "level": "", "num_look": 344192, "num_comment": 10, "author": "孙毛毛", "tags": ["资讯"], "text": "雅虎为美国政府定制了一个秘密工具，可以对上百万雅虎邮箱进行实时扫描，便于NSA和FBI收集信息。而且据说这款工具还不止是扫描那么简单！"}
{"title": "神器Nmap web版：Rainmap Lite", "url": "https://www.freebuf.com/sectool/115782.html", "time": "2016-10-09", "level": "金币+10", "num_look": 709317, "num_comment": 13, "author": "ymmy", "tags": ["WEB安全", "工具"], "text": "Nmap对应Web应用程序Rainmap Lite，允许用户从手机/平板电脑/网络浏览器启动Nmap扫描！"}
{"title": "每16台Android手机中，就有一台受BadKernel漏洞的影响", "url": "https://www.freebuf.com/articles/terminal/115933.html", "time": "2016-10-09", "level": "金币+10", "num_look": 326585, "num_comment": 8, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "据估算，每十六台Android手机中，就会有一台受到BadKernel漏洞的影响。不仅如此，目前大部分热门手机中都存在这个漏洞，例如LG、三星、摩托罗拉和华为等。"}
{"title": "美国国家安全局（NSA）资料再遭泄露", "url": "https://www.freebuf.com/news/116023.html", "time": "2016-10-09", "level": "", "num_look": 208793, "num_comment": 9, "author": "饭团君", "tags": ["资讯"], "text": "据最新报道美国国家安全局（NSA）承包商雇员Thomas martin因窃取国家机密而遭到逮捕。"}
{"title": "僵尸网络的发展，“智能设备”可帮了大忙（含Top 10物联网设备弱口令 ）", "url": "https://www.freebuf.com/news/115777.html", "time": "2016-10-09", "level": "金币+10", "num_look": 324871, "num_comment": 5, "author": "寰者", "tags": ["终端安全", "资讯"], "text": "在过去的两年里，发现的所有物联网恶意软件基本都是同样的运作原理思路。"}
{"title": "Dropbox先前泄露的6800万账号，已可随意下载", "url": "https://www.freebuf.com/articles/database/115942.html", "time": "2016-10-09", "level": "", "num_look": 537726, "num_comment": 16, "author": "latiaojun", "tags": ["数据安全"], "text": "美国云存储服务Dropbox周三确认，2012年时发现并披露的一次数据泄露事故影响要比之前预计的更严重。有报道称，此次数据泄露事故影响了近6800万帐号。"}
{"title": "漏洞预警：JPEG 2000某漏洞可执行任意代码", "url": "https://www.freebuf.com/vuls/115916.html", "time": "2016-10-08", "level": "", "num_look": 349748, "num_comment": 9, "author": "漏洞盒子", "tags": ["漏洞"], "text": "最近思科的Talos安全团队披露了JPEG 2000的一个零日漏洞，该漏洞可以执行任意代码。"}
{"title": "“狸猫换太子”躲避扫描：Cerber3敲诈者木马分析", "url": "https://www.freebuf.com/articles/system/115754.html", "time": "2016-10-08", "level": "", "num_look": 289816, "num_comment": 8, "author": "360安全", "tags": ["系统安全"], "text": "近日，360互联网安全中心捕获到一款名为“cerber3”的敲诈者木马。该敲诈者木马会加密计算机中的重要文件，加密的文件类型包括但不限于.doc,.ppt,.xls.,.jpg,.zip,.pdf等180多种类型。"}
{"title": "真的有可能吗？某以色列公司宣称破解了WhatsApp加密通信", "url": "https://www.freebuf.com/news/115700.html", "time": "2016-10-08", "level": "", "num_look": 393281, "num_comment": 9, "author": "ArthurKiller", "tags": ["资讯"], "text": "某以色列公司已经能够破解WhatsApp的加密通信"}
{"title": "Web应用防火墙（WAF）竞品分析", "url": "https://www.freebuf.com/articles/web/115407.html", "time": "2016-10-08", "level": "现金奖励", "num_look": 1746026, "num_comment": 61, "author": "bt0sea", "tags": ["WEB安全"], "text": "本文站在安全产品经理的角度上，做的WAF竞品分析，包含：行业现状分析、产品功能分析、交互设计分析、运营及推广策略（偏重PR）。"}
{"title": "【WitAwards 2016 “年度安全产品”参评巡礼】思科Firepower 4100系列新一代防火墙解析", "url": "https://www.freebuf.com/news/115572.html", "time": "2016-10-08", "level": "", "num_look": 390844, "num_comment": 4, "author": "FreeBuf咨询", "tags": ["安全报告", "特别企划"], "text": "在这篇文章中，我们将简单就思科Firepower 4100系列新一代防火墙产品做分析，包括产品配置、特色，新一代防火墙的市场现状和发展趋势等。"}
{"title": "GnuRadio Hacking ①：使用GnuRadio+SDR破解固定码无线遥控", "url": "https://www.freebuf.com/articles/wireless/115289.html", "time": "2016-10-08", "level": "", "num_look": 1076118, "num_comment": 23, "author": "漏洞盒子", "tags": ["无线安全"], "text": "如何在两分钟内破解一枚跳蛋"}
{"title": "漏洞预警：Tomcat曝本地提权漏洞 （CVE-2016-1240 附PoC）", "url": "https://www.freebuf.com/vuls/115862.html", "time": "2016-10-07", "level": "红色标题", "num_look": 1465688, "num_comment": 13, "author": "漏洞盒子", "tags": ["漏洞"], "text": "Tomcat于10月1日曝出本地提权漏洞CVE-2016-1240。攻击者利用该漏洞，仅需低权限Tomcat用户就能获取到系统的ROOT权限。"}
{"title": "攻击苹果用户，黑客组织APT28这次用了新招", "url": "https://www.freebuf.com/news/115856.html", "time": "2016-10-07", "level": "", "num_look": 196271, "num_comment": 196271, "author": "饭团君", "tags": ["资讯"], "text": "一个名为APT28的俄罗斯黑客组织，在过去十年中针对北约、东欧及高加索地区的政府系统开展网络间谍活动，而现在他们又将目光转移到了苹果设备。"}
{"title": "【报名进行时】WitAwards 2016“年度安全产品”&“年度安全云及云服务”报名开启", "url": "https://www.freebuf.com/news/115496.html", "time": "2016-10-07", "level": "红色标题", "num_look": 211375, "num_comment": 211375, "author": "FB独家", "tags": ["头条", "资讯"], "text": "WitAwards 2016年度评选将紧随安全行业脉搏，针对这一年安全产品与云服务的创新、技术、可靠性进行评估，向出色的产品服务致敬。"}
{"title": "玩出C&C服务器地址隐身的新花样，看看这个恶意软件怎么做的", "url": "https://www.freebuf.com/articles/system/115809.html", "time": "2016-10-07", "level": "金币+5", "num_look": 458017, "num_comment": 12, "author": "dawner", "tags": ["系统安全", "网络安全"], "text": "恶意软件作者们一直在凭借自己天马行空的想法，艰难地绕过安全研究人员的追踪和检测。"}
{"title": "kill.exe溢出漏洞分析与EXP讨论", "url": "https://www.freebuf.com/articles/system/115571.html", "time": "2016-10-07", "level": "现金奖励", "num_look": 304183, "num_comment": 7, "author": "zzz66686", "tags": ["系统安全"], "text": "前几日，笔者在exploit-db上发现了一个kill.exe的溢出漏洞，在众多的UAF漏洞中，这种单纯的溢出漏洞简直如一股清泉一般，遂将其捡了出来，深入地看了看。"}
{"title": "Windows小工具：LnkDown快捷方式加载Payload", "url": "https://www.freebuf.com/articles/system/115689.html", "time": "2016-10-06", "level": "现金奖励", "num_look": 403214, "num_comment": 29, "author": "键盘手", "tags": ["系统安全"], "text": "隔空怀孕术之快捷方式加载payload"}
{"title": "太空基础设施安全：网络安全最前沿", "url": "https://www.freebuf.com/articles/others-articles/115787.html", "time": "2016-10-05", "level": "金币+5", "num_look": 413222, "num_comment": 16, "author": "clouds", "tags": ["其他", "安全报告"], "text": "通常，人们在讨论国家关键基础设施的网络威胁时，往往忽视了卫星和其它太空设备存在的漏洞攻击。"}
{"title": "DDoS敲诈组织Armada Collective开始玩勒索软件了？怎么看都是个外行", "url": "https://www.freebuf.com/news/115084.html", "time": "2016-10-05", "level": "", "num_look": 240659, "num_comment": 3, "author": "孙毛毛", "tags": ["终端安全", "资讯"], "text": "给网站站长发勒索邮件似乎是发家致富的好机会。尤其如果你还敢于冒充Armada Collective这样的DDoS组织，那应该机会更大！"}
{"title": "你相信存在没有漏洞的代码吗？美国人正在研究", "url": "https://www.freebuf.com/news/115573.html", "time": "2016-10-05", "level": "", "num_look": 343608, "num_comment": 19, "author": "米雪儿", "tags": ["资讯"], "text": "DARPA有个HACMS项目，即“高可信军事网络系统”，开发“formal verification”技术。据说利用这种技术的产品几乎做到了固若金汤。"}
{"title": "北极熊扫描器4.0发布，无需过多介绍的国产安全工具", "url": "https://www.freebuf.com/sectool/115690.html", "time": "2016-10-04", "level": "金币+5", "num_look": 884864, "num_comment": 36, "author": "hyc66", "tags": ["工具"], "text": "喜讯！喜讯！北极熊扫描器4.0发布！"}
{"title": "2016年中国互联网仿冒态势分析报告", "url": "https://www.freebuf.com/articles/terminal/115187.html", "time": "2016-10-04", "level": "", "num_look": 224541, "num_comment": 3, "author": "阿里聚安全", "tags": ["安全报告", "终端安全"], "text": "《2016年中国互联网仿冒态势分析报告》显示多数热门应用存在仿冒，成为电信线上新型的诈骗手段，广东北京等地成为重灾区。"}
{"title": "Rotten Tomato APT组织仍在行动", "url": "https://www.freebuf.com/articles/system/115612.html", "time": "2016-10-03", "level": "现金奖励", "num_look": 378423, "num_comment": 12, "author": "亚信安全", "tags": ["安全报告", "系统安全"], "text": "亚信安全发现Rotten Tomato的APT攻击行动一直没有消失，一个看似老旧的CVE-2012-0158仍然在被黑客利用。"}
{"title": "国庆看剧：亦真亦假的美剧《黑客军团》", "url": "https://www.freebuf.com/news/115597.html", "time": "2016-10-03", "level": "金币+5", "num_look": 357211, "num_comment": 11, "author": "饭团君", "tags": ["资讯"], "text": "《黑客军团》可以称得上首部真正与现实的黑客技术以及黑客文化嫁接起来的电视剧、"}
{"title": "【FB TV】一周「BUF大事件」：一个FBI被坑的故事；英国拟在国内创建国家防火墙；OVH遭遇史上最大DDOS攻击", "url": "https://www.freebuf.com/video/115756.html", "time": "2016-10-02", "level": "", "num_look": 195949, "num_comment": 1, "author": "supercoco", "tags": ["视频"], "text": "FBI被坑？英国要创建一个国家防火墙？"}
{"title": "走近科学：“爱因斯坦”（EINSTEIN）计划综述", "url": "https://www.freebuf.com/articles/network/115408.html", "time": "2016-10-02", "level": "现金奖励", "num_look": 615830, "num_comment": 2, "author": "ArkTeam", "tags": ["安全报告", "特别企划"], "text": "爱因斯坦计划可以看成是网络态势感知的实际大规模运用，尽管存在非议，但美国政府仍然对此表示支持并将持续拓展其中的项目。"}
{"title": "Dracnmap：基于nmap的图形化网络信息搜集工具", "url": "https://www.freebuf.com/sectool/117092.html", "time": "2016-10-01", "level": "", "num_look": 304242, "num_comment": 304242, "author": "dawner", "tags": ["工具"], "text": "虽然nmap本身有很多命令供用户选择，能够让工具更加实用，但复杂命令和操作也让很多新用户望而却步。"}
{"title": "iOS冰与火之歌（番外篇）：基于PEGASUS（Trident三叉戟）的OS X 10.11.6本地提权", "url": "https://www.freebuf.com/vuls/115545.html", "time": "2016-10-01", "level": "", "num_look": 307922, "num_comment": 6, "author": "阿里聚安全", "tags": ["漏洞", "终端安全"], "text": "从PEGASUS漏洞形成的原因开始分析，然后一步步写出OS X上利用PEGASUS提权的攻击代码。"}
{"title": "某国家正在测试“关闭互联网”方法", "url": "https://www.freebuf.com/news/115503.html", "time": "2016-10-01", "level": "", "num_look": 392610, "num_comment": 13, "author": "孙毛毛", "tags": ["资讯"], "text": "据国外知名安全专家Bruce Schneier称，某国政府正在测试能强制下线所有互联网设备的方法。"}
{"title": "关于QQ浏览器等应用“WormBrowser”漏洞情况的通报", "url": "https://www.freebuf.com/news/115639.html", "time": "2016-09-30", "level": "", "num_look": 259122, "num_comment": 5, "author": "CNNVD", "tags": ["漏洞", "资讯"], "text": "关于QQ浏览器等应用“WormBrowser”漏洞情况的通报"}
{"title": "苹果的20万赏金算什么？有公司悬赏150万买iOS 10的0-day漏洞", "url": "https://www.freebuf.com/news/115706.html", "time": "2016-09-30", "level": "", "num_look": 256998, "num_comment": 8, "author": "孙毛毛", "tags": ["资讯"], "text": "有家名叫Zerodium的公司，他们收集各类0day漏洞，再高价卖给包括政府在内等有需要的客户。"}
{"title": "这个恶意软件“奇葩”的反虚拟机技巧", "url": "https://www.freebuf.com/articles/system/115556.html", "time": "2016-09-30", "level": "金币+10", "num_look": 417734, "num_comment": 11, "author": "clouds", "tags": ["系统安全"], "text": "最近，我分析到一个行为异常的恶意软件样本。由于很难发现该恶意软件的真实行为，所以我花了很多时间去调试分析。然而在分析过程中，又有多种因素会导致运行崩溃和异常。在此，我就发表了对该恶意软件反虚拟机的一…"}
{"title": "对“利比亚天蝎”网络间谍活动的分析调查（附样本下载）", "url": "https://www.freebuf.com/articles/network/115280.html", "time": "2016-09-30", "level": "金币+10", "num_look": 379281, "num_comment": 5, "author": "clouds", "tags": ["安全报告", "网络安全"], "text": "利比亚的政权动荡和长期内战可能众所周知，但其网络间谍和黑客活动或许鲜为人知。在这篇报告中，我们将首次披露一例涉及利比亚的恶意软件网络攻击活动。"}
{"title": "WIN10下ROP初体验", "url": "https://www.freebuf.com/articles/system/115366.html", "time": "2016-09-30", "level": "现金奖励", "num_look": 350295, "num_comment": 7, "author": "与非门salome", "tags": ["系统安全"], "text": "本文中将会展示2类方法绕过DEP（数据执行保护），但其核心都是ROP(返回导向编程的思想)。"}
{"title": "Gartner最新发布：WAF和UTM安全产品全球市场格局", "url": "https://www.freebuf.com/news/115624.html", "time": "2016-09-29", "level": "", "num_look": 360384, "num_comment": 7, "author": "小黑羊", "tags": ["资讯"], "text": "今天发两个Gartner的魔力象限，都是9月新鲜出炉的，即WAF和UTM。"}
{"title": "解包分析攻击越南机场和其它组织机构的间谍程序", "url": "https://www.freebuf.com/articles/system/113570.html", "time": "2016-09-29", "level": "", "num_look": 337417, "num_comment": 17, "author": "clouds", "tags": ["安全报告", "特别企划"], "text": "根据前期入侵越南组织机构的间谍程序捕获样本，入侵活动涉及7月底对越南两大机场的攻击事件，攻击中使用的恶意软件用于窃取越南航空公司40万会员信息。"}
{"title": "“智慧城市”背后的安全隐患", "url": "https://www.freebuf.com/articles/neopoints/115234.html", "time": "2016-09-29", "level": "金币+10", "num_look": 319528, "num_comment": 23, "author": "clouds", "tags": ["观点"], "text": ""}
{"title": "Android漏洞CVE-2015-3825分析及exploit实战：从Crash到劫持PC", "url": "https://www.freebuf.com/vuls/115352.html", "time": "2016-09-29", "level": "现金奖励", "num_look": 464593, "num_comment": 5, "author": "thor123", "tags": ["漏洞", "终端安全"], "text": "CVE-2015-3825是去年Android系统爆出的高危漏洞，通过该漏洞可以实现Android系统提权及代码执行等一系列攻击行为。"}
{"title": "华润网络招聘信息安全工程师", "url": "https://www.freebuf.com/jobs/115363.html", "time": "2016-09-28", "level": "", "num_look": 354069, "num_comment": 23, "author": "crc_security", "tags": ["安全招聘"], "text": ""}
{"title": "美国参议员质问雅虎：早就知道5亿账户被盗 却为何等了2个月才公开？", "url": "https://www.freebuf.com/news/115588.html", "time": "2016-09-28", "level": "", "num_look": 394404, "num_comment": 7, "author": "欧阳洋葱", "tags": ["资讯"], "text": "雅虎最近的日子很不好过，上周宣布5亿用户数据被盗之后，各种麻烦不断，连参议员都找上门了。"}
{"title": "VaultPasswordView：可用于查看windows Vault密码的工具", "url": "https://www.freebuf.com/sectool/115339.html", "time": "2016-09-28", "level": "金币+10", "num_look": 423437, "num_comment": 14, "author": "zusheng", "tags": ["工具"], "text": "VaultPasswordView是Windows 10/8/7系统的密码破解工具"}
{"title": "逆向工厂（二）：静态分析技术", "url": "https://www.freebuf.com/articles/system/114904.html", "time": "2016-09-28", "level": "现金奖励", "num_look": 787314, "num_comment": 39, "author": "追影人", "tags": ["特别企划", "系统安全"], "text": "接着上一章，阐述静态分析的原理方法，程序的静态结构，常见流程控制语句的静态反编译形态，并且通过实例来掌握利用IDA逆向工具的静态逆向分析技术。"}
{"title": "iOS 10备份加密破解速度提升2500倍，Keychain将不再安全", "url": "https://www.freebuf.com/news/115406.html", "time": "2016-09-28", "level": "", "num_look": 302433, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["漏洞", "资讯"], "text": "这个安全漏洞将允许攻击者通过一种新型的攻击方法来绕过iOS10设备本地（iTunes）备份的密码保护机制。"}
{"title": "【WitAwards 2016 “年度安全产品”参评巡礼】做最干净的杀毒软件：火绒安全软件评测", "url": "https://www.freebuf.com/news/115378.html", "time": "2016-09-27", "level": "红色标题", "num_look": 582679, "num_comment": 40, "author": "FreeBuf咨询", "tags": ["安全报告", "特别企划"], "text": "火绒曾被众多网友评价为国内最具良心杀毒软件之一，也被称为最安静的一款杀毒软件。"}
{"title": "智能手机可通过测量电磁能和声波来入侵3D打印机", "url": "https://www.freebuf.com/articles/terminal/115269.html", "time": "2016-09-27", "level": "", "num_look": 473923, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["极客", "终端安全"], "text": "安全研究人员发现了一种新型的攻击方法，攻击者或可利用这种方法来通过手机窃取3D打印机中的敏感数据。"}
{"title": "1Tbps！OVH遭遇史上最大DDoS攻击", "url": "https://www.freebuf.com/news/115372.html", "time": "2016-09-27", "level": "", "num_look": 625474, "num_comment": 15, "author": "孙毛毛", "tags": ["资讯"], "text": "网站托管服务公司OVH遭遇了前所未有的大型DDoS攻击，服务器被攻击的峰值可达每秒1Tb。"}
{"title": "双刃剑与灰色地带：“泄露数据收藏家”的素描", "url": "https://www.freebuf.com/news/114337.html", "time": "2016-09-27", "level": "红色标题", "num_look": 354440, "num_comment": 4, "author": "孙毛毛", "tags": ["其他", "特别企划"], "text": "无论是国内还是国外，都存在着这样一群匿名人士，他们乐于对已经被盗的数据库进行备份和收集——这里我们暂且称他们为“泄露数据收藏家”"}
{"title": "打开文件夹就运行？COM劫持利用新姿势", "url": "https://www.freebuf.com/articles/system/115241.html", "time": "2016-09-27", "level": "现金奖励", "num_look": 430261, "num_comment": 15, "author": "菠菜", "tags": ["系统安全"], "text": "打开文件夹就能运行指定的程序？这不是天方夜谭，而是在现实世界中确实存在的。利用本文探讨的com劫持技术，可以轻松实现出打开文件夹就运行指定代码的功能。"}
{"title": "警方可以通过智能手机来追踪简易爆炸装置", "url": "https://www.freebuf.com/articles/others-articles/115126.html", "time": "2016-09-27", "level": "", "num_look": 228071, "num_comment": 9, "author": "Alpha_h4ck", "tags": ["其他"], "text": "智能手机不仅可以用作引爆简易爆炸装置的触发器，在美国执法部门的眼中，手机还有一个最重要的功能，那就是用来追踪简易爆炸装置。"}
{"title": "「知乎」招聘安全人才", "url": "https://www.freebuf.com/jobs/115236.html", "time": "2016-09-26", "level": "红色标题", "num_look": 621536, "num_comment": 68, "author": "知乎安全", "tags": ["安全招聘"], "text": "知乎是一个真实的网络问答社区，社区氛围友好与理性，连接各行各业的精英。"}
{"title": "研究人员开发了一款无法被检测到的工控系统PLC Rootkit", "url": "https://www.freebuf.com/news/115005.html", "time": "2016-09-26", "level": "", "num_look": 384978, "num_comment": 5, "author": "米雪儿", "tags": ["工控安全", "系统安全"], "text": "工控系统的新威胁：一款无法检测到的PLC Rootkit。"}
{"title": "远控盗号木马伪装成850Game作恶", "url": "https://www.freebuf.com/articles/system/115194.html", "time": "2016-09-26", "level": "", "num_look": 439299, "num_comment": 13, "author": "360安全", "tags": ["安全报告", "系统安全"], "text": "近期，360QVM团队捕获到一类在网上广泛传播的远控盗号木马，该木马伪装为正规棋牌游戏850Game的安装程序，在伪造的钓鱼网站上挂马并诱骗用户下载。"}
{"title": "教你如何使用微信网页版“抓取”微信撤回消息", "url": "https://www.freebuf.com/articles/web/115273.html", "time": "2016-09-26", "level": "金币+20", "num_look": 631901, "num_comment": 19, "author": "hualuorenjia", "tags": ["WEB安全"], "text": "有个高中微信搞笑群，常发一些搞笑的图片，但是发后就撤回了，一不小心就看不到了，所以就想着怎么查看撤回的图片或者文字。"}
{"title": "浅析思科0day漏洞CVE-2016-6415", "url": "https://www.freebuf.com/vuls/115207.html", "time": "2016-09-26", "level": "金币+20", "num_look": 588944, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["漏洞", "网络安全"], "text": "最近思科又发布了一份安全公告，提到方程式BENIGNCERTAIN工具利用的一个心漏洞。在这篇文章中，我们将带大家了解这个漏洞的详细情况。"}
{"title": "Gemalto：2016上半年泄露级别指数调查报告", "url": "https://www.freebuf.com/articles/database/115028.html", "time": "2016-09-26", "level": "", "num_look": 375167, "num_comment": 375167, "author": "米雪儿", "tags": ["安全报告", "数据安全"], "text": "近日，数字安全领域全球领导者金雅拓公司发布了2016上半年泄露级别指数的调查结果，这一最新报告显示，2016上半年的数据泄露数量与去年相比呈现大幅上升的情况。"}
{"title": "NSA泄露文件深度分析（二）：运营商", "url": "https://www.freebuf.com/articles/network/115158.html", "time": "2016-09-26", "level": "金币+20", "num_look": 612297, "num_comment": 6, "author": "tom_vodu", "tags": ["安全报告", "特别企划"], "text": "NSA不再是针对传统的安全漏洞，而是换了一种全新攻击思路，去利用互联网用户对互联网的信任去攻击目标。"}
{"title": "Xposed模块编写的那些事", "url": "https://www.freebuf.com/articles/terminal/114910.html", "time": "2016-09-25", "level": "现金奖励", "num_look": 1254186, "num_comment": 16, "author": "L5", "tags": ["终端安全"], "text": "xposed框架提供了不需要修改系统源码就能灵活定制系统功能的能力，极大的方便了安全研究人员的工作。"}
{"title": "美国警察监控民众手机花式玩法：Harris公司产品揭秘一条龙", "url": "https://www.freebuf.com/articles/wireless/114916.html", "time": "2016-09-25", "level": "", "num_look": 678549, "num_comment": 8, "author": "dawner", "tags": ["无线安全", "特别企划"], "text": "美国Harris公司拥有一款监听设备Stingray，迄今为止已经在执法机构使用了15年。"}
{"title": "英国情报机构GCHQ拟在英国设立国家防火墙", "url": "https://www.freebuf.com/news/114925.html", "time": "2016-09-25", "level": "红色标题", "num_look": 344833, "num_comment": 20, "author": "米雪儿", "tags": ["资讯"], "text": "英国情报机构 GCHQ（政府与通信总局，英国政府设立在切尔滕纳姆的电子监听中心）拟在国内创建一个国家防火墙来保护国家免受网络攻击。"}
{"title": "关于思科网际操作系统漏洞情况的通报", "url": "https://www.freebuf.com/vuls/115239.html", "time": "2016-09-24", "level": "", "num_look": 256405, "num_comment": 2, "author": "CNNVD", "tags": ["漏洞"], "text": "该漏洞可造成受影响网络设备的内存数据遭到泄露，导致大量明文数据被恶意获取。"}
{"title": "【FB TV】一周「BUF大事件」：荷兰计算机系学生对小米手机的研究发现；Bilal Bot恶意软件作者主动联系了厂商；被黑的广告运营公司Clixsence", "url": "https://www.freebuf.com/video/115181.html", "time": "2016-09-24", "level": "红色标题", "num_look": 354620, "num_comment": 14, "author": "supercoco", "tags": ["视频"], "text": "小米手机居然有后门？恶意程序作者还主动联系安全厂商？"}
{"title": "中国科恩实验室实现远程侵入特斯拉Model S", "url": "https://www.freebuf.com/news/115059.html", "time": "2016-09-24", "level": "", "num_look": 356836, "num_comment": 3, "author": "dawner", "tags": ["漏洞", "资讯"], "text": "中国黑客团队远程侵入特斯拉Model S，只差控制挖掘机啦！"}
{"title": "Windows内网渗透提权的几个实用命令", "url": "https://www.freebuf.com/articles/system/114731.html", "time": "2016-09-24", "level": "金币+8", "num_look": 999295, "num_comment": 17, "author": "clouds", "tags": ["系统安全"], "text": "这不是一篇渗透测试指导，而是简单介绍了几个Windows内网提权的实用命令，以供我等菜鸟学习观摩。"}
{"title": "FBI被坑了！破解iPhone 5c的密码其实只要100美元", "url": "https://www.freebuf.com/articles/terminal/115040.html", "time": "2016-09-24", "level": "", "num_look": 447119, "num_comment": 16, "author": "欧阳洋葱", "tags": ["终端安全"], "text": "FBI今年4月份的时候宣称，针对圣贝纳迪诺枪击案涉案iPhone 5c，他们花了150万美元攻破了开机密码。然而最近有研究人员却表示，只要100美元就能搞定！"}
{"title": "快讯：iPhone7已经可以实现越狱", "url": "https://www.freebuf.com/news/115214.html", "time": "2016-09-23", "level": "", "num_look": 335288, "num_comment": 11, "author": "孙毛毛", "tags": ["资讯"], "text": "新的iPhone7和iPhone7 Plus开始销售还没到一周的时间，但就在这短短的时间里，iOS系统已经被成功“越狱”了。"}
{"title": "Android平台渗透测试套件zANTI v2.5发布（含详细说明）", "url": "https://www.freebuf.com/sectool/115051.html", "time": "2016-09-23", "level": "金币+8", "num_look": 3461627, "num_comment": 29, "author": "ymmy", "tags": ["工具"], "text": "zANTI是一款Android平台下的渗透测试工具，支持嗅探已连接的网络、支持中间人攻击测试、端口扫描、Cookie获取及路由安全测试等操作。"}
{"title": "Android虚拟机调试器原理与实现", "url": "https://www.freebuf.com/articles/terminal/114869.html", "time": "2016-09-23", "level": "现金奖励", "num_look": 612610, "num_comment": 16, "author": "安全豹", "tags": ["终端安全"], "text": "本文主要讲解Android虚拟机动态调试背后涉及到的技术原理，除了JDWP协议细节，还包括任意位置断点、堆栈输出、变量值获取等基础调试功能的具体实现。"}
{"title": "在OS X 平台下利用恶意软件实现密码拦截与提权（含Github源码和演示视频）", "url": "https://www.freebuf.com/articles/system/115079.html", "time": "2016-09-23", "level": "", "num_look": 226506, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "就在几周之前，一则关于“Dropbox攻击Mac OSX”的新闻出现在了在各大安全网站的头条上。"}
{"title": "DARPA如何定义网络作战空间", "url": "https://www.freebuf.com/articles/others-articles/114692.html", "time": "2016-09-23", "level": "现金奖励", "num_look": 483220, "num_comment": 4, "author": "ArkTeam", "tags": ["其他", "安全报告"], "text": "参考美国国防部先进研究项局（DARPA）的PLANX项目，通过网络作战空间的定义和项目范围来窥测应如何描述网络作战空间。"}
{"title": "隐秘通讯与跳板？C&C服务器究竟是怎么一回事", "url": "https://www.freebuf.com/articles/network/114122.html", "time": "2016-09-23", "level": "", "num_look": 1165374, "num_comment": 25, "author": "ArthurKiller", "tags": ["特别企划", "网络安全"], "text": "C&C服务器，其全称为command and control server。C&C服务器不仅可以为黑客提供便利的资源管理平台，也可以保障其个人隐私安全。"}
{"title": "【报名进行时】WitAwards 2016年度安全研究者&年度安全团队报名开启", "url": "https://www.freebuf.com/news/114988.html", "time": "2016-09-22", "level": "红色标题", "num_look": 254568, "num_comment": 254568, "author": "FB独家", "tags": ["头条", "资讯"], "text": "身边的人们追求很多，而他们的目标只有一个。我们用WitAwards 2016，致敬为安全默默做出贡献的他们。"}
{"title": "方程式再曝0day漏洞：超84万思科设备受影响", "url": "https://www.freebuf.com/news/115118.html", "time": "2016-09-22", "level": "红色标题", "num_look": 662673, "num_comment": 7, "author": "欧阳洋葱", "tags": ["漏洞", "资讯"], "text": "思科这两天又发布了一份安全公告，明确编号为CVE-2016-6415漏洞的存在性，这也是先前方程式泄露的BenignCertain工具相关漏洞。"}
{"title": "今晚DDoS全面进攻将至？全球各大新闻媒体严阵以待", "url": "https://www.freebuf.com/news/115091.html", "time": "2016-09-22", "level": "", "num_look": 255366, "num_comment": 13, "author": "ArthurKiller", "tags": ["资讯"], "text": "2016年9月22日，Powerful Greek Army黑客小组将会对CBS, ABC, NBC, CNN 和 FOX等全球多家新闻媒体展开DDOS攻击。"}
{"title": "网络设备漏洞分析技术研究（KCON2016议题）", "url": "https://www.freebuf.com/articles/system/114741.html", "time": "2016-09-22", "level": "", "num_look": 386579, "num_comment": 5, "author": "墨侠", "tags": ["安全报告", "系统安全"], "text": "面对越来越多的网络设备层的攻击行为，作为致力于建设中国互联网网络安全的一份子，团队对部分网络设备的漏洞利用进行大量的研究和分析。"}
{"title": "伴着WSF重新杀回的Zepto勒索软件，它都对文档都做了什么", "url": "https://www.freebuf.com/articles/system/114540.html", "time": "2016-09-22", "level": "现金奖励", "num_look": 260137, "num_comment": 13, "author": "降草", "tags": ["系统安全"], "text": "PE文件有着天生的躲避白名单的基因，这就使得越来越多的恶意PE采用“曲线救国”——使用非PE来进行加载执行。本文分析的就是通过wsf脚本下载勒索软件后加载执行，以实现加密用户文件勒索比特比的目的。"}
{"title": "巧妙思路获得全球部分暗网商家物理分布图", "url": "https://www.freebuf.com/news/114850.html", "time": "2016-09-22", "level": "", "num_look": 385294, "num_comment": 15, "author": "ArthurKiller", "tags": ["其他", "特别企划"], "text": "或许，在互联网上找到一个人的物理位置，只需要一张照片足以。"}
{"title": "朝鲜DNS数据泄露：“互联网”规模极小，居然只有28个可访问网站…", "url": "https://www.freebuf.com/news/114990.html", "time": "2016-09-22", "level": "红色标题", "num_look": 1300877, "num_comment": 25, "author": "clouds", "tags": ["资讯"], "text": "由于朝鲜顶级域名服务器的配置错误，任何人都可以向该域名服务器发出查询请求。有人通过一份脚本对此域名服务器进行了记录跟踪下载。"}
{"title": "漫谈Domain Flux僵尸网络", "url": "https://www.freebuf.com/articles/network/114693.html", "time": "2016-09-22", "level": "现金奖励", "num_look": 540463, "num_comment": 5, "author": "ArkTeam", "tags": ["特别企划", "网络安全"], "text": "活用Domain Flux协议，该如何防御僵尸网络。"}
{"title": "Apache日志实时分析工具：ARTLAS", "url": "https://www.freebuf.com/sectool/114794.html", "time": "2016-09-22", "level": "", "num_look": 383455, "num_comment": 4, "author": "felix", "tags": ["工具"], "text": "ARTLAS（Apache Real Time Logs Analyzer System）是一个Apache日志实时分析器。"}
{"title": "中兴通讯诚聘安全人才", "url": "https://www.freebuf.com/jobs/114809.html", "time": "2016-09-21", "level": "", "num_look": 211744, "num_comment": 6, "author": "amyqqy", "tags": ["安全招聘"], "text": ""}
{"title": "安全行业到底多缺人才？众人科技以职业高校切入安全教育", "url": "https://www.freebuf.com/fevents/114914.html", "time": "2016-09-21", "level": "", "num_look": 264296, "num_comment": 19, "author": "孙毛毛", "tags": ["活动"], "text": "谈剑峰说：“可能很难想象安全行业究竟有多缺人，就算是到5万月薪，可能都很难找到需要的人才。”那么借着这次活动，顺便来谈谈安全行业的现状。"}
{"title": "Metasploit曝远程代码执行漏洞：别惹我，我疯起来连自己都黑", "url": "https://www.freebuf.com/vuls/114927.html", "time": "2016-09-21", "level": "红色标题", "num_look": 1159422, "num_comment": 16, "author": "ArthurKiller", "tags": ["漏洞"], "text": "Metasploit存在反序列化漏洞，可远程非授权执行代码"}
{"title": "全球近80万FTP服务器账号可被未授权访问", "url": "https://www.freebuf.com/articles/system/114884.html", "time": "2016-09-21", "level": "", "num_look": 382140, "num_comment": 11, "author": "ArthurKiller", "tags": ["系统安全"], "text": "给我一根1MB宽带，我可以扫遍全球！"}
{"title": "灵活布置、可二次开发的乌云公开漏洞及知识库搜索", "url": "https://www.freebuf.com/sectool/114909.html", "time": "2016-09-21", "level": "现金奖励", "num_look": 720368, "num_comment": 41, "author": "grt1stnull", "tags": ["工具"], "text": "感谢hanc00l爬取了wooyun的网页，才使乌云关闭后，大家依旧可以访问以前的漏洞库、知识库。"}
{"title": "【企业研究报告】FreeBuf Insight：网络安全创新企业Top 10解读之Bit9（Carbon Black）", "url": "https://www.freebuf.com/news/topnews/114088.html", "time": "2016-09-21", "level": "红色标题", "num_look": 819893, "num_comment": 11, "author": "欧阳洋葱", "tags": ["头条", "安全报告"], "text": "本期FreeBuf Insight安全创新企业Top 10系列解读将尝试从这些有限的资料中，大致勾勒出Carbon Black（Bit9）公司的轮廓。"}
{"title": "“奥巴马时代”10大网络安全成就解读", "url": "https://www.freebuf.com/articles/others-articles/114722.html", "time": "2016-09-21", "level": "金币+7", "num_look": 273436, "num_comment": 2, "author": "米雪儿", "tags": ["其他", "安全报告"], "text": "在过去的七年半时间里，奥巴马政府在网络安全领域下达了哪些行政命令，做出了哪些重大举措和改革？"}
{"title": "自动执行Nmap扫描的工具：LazyMap", "url": "https://www.freebuf.com/sectool/114701.html", "time": "2016-09-21", "level": "", "num_look": 493958, "num_comment": 7, "author": "felix", "tags": ["工具"], "text": "LazyMap可以自动进行nmap扫描，并且能自动生成定制的Nessus策略。"}
{"title": "安天AVL联合小米MIUI，首擒顽固病毒“不死鸟”", "url": "https://www.freebuf.com/articles/terminal/114813.html", "time": "2016-09-20", "level": "", "num_look": 390140, "num_comment": 25, "author": "AVLTeam", "tags": ["终端安全"], "text": "不死鸟作为希腊神话中的一种怪物，拥有不断再生的能力，每当寿限将至时，它会在巢穴中自焚，并在三天后重新复活。"}
{"title": "华为消费者BG云服务招聘各类互联网安全人才", "url": "https://www.freebuf.com/jobs/114691.html", "time": "2016-09-20", "level": "", "num_look": 520219, "num_comment": 36, "author": "ayazero", "tags": ["安全招聘"], "text": "国内手机第一品牌，全球No.3，遍布全球国家和区域的云服务，包含账号、Appstore、手机服务（类似icloud）、支付、SNS、电商……等一些列互联网服务"}
{"title": "一种新型ATM分离器：Periscope Skimming", "url": "https://www.freebuf.com/articles/terminal/114669.html", "time": "2016-09-20", "level": "", "num_look": 226645, "num_comment": 6, "author": "clouds", "tags": ["终端安全"], "text": "美国特勤局警告银行和ATM供应商应特别注意一种名为“Periscope Skimming”的新型ATM分离器"}
{"title": "十秒内黑掉Facebook主页？这个漏洞竟然价值1.6万美金（含漏洞分析）", "url": "https://www.freebuf.com/news/114727.html", "time": "2016-09-20", "level": "金币+8", "num_look": 443173, "num_comment": 16, "author": "Alpha_h4ck", "tags": ["漏洞", "资讯"], "text": "如何黑掉你的Facebook？这位来自印度的安全研究专家表示有话要说。"}
{"title": "动手打造Bypass UAC自动化测试小工具，可绕过最新版Win10", "url": "https://www.freebuf.com/sectool/114592.html", "time": "2016-09-20", "level": "现金奖励", "num_look": 732018, "num_comment": 15, "author": "ExpLife", "tags": ["工具", "系统安全"], "text": "新的BypassUAC小工具，可绕过最新版Win10。"}
{"title": "兔子洞能装得下一只熊吗？对美国州立选举委员会网络攻击事件的调查", "url": "https://www.freebuf.com/articles/network/114571.html", "time": "2016-09-20", "level": "金币+8", "num_look": 313761, "num_comment": 7, "author": "clouds", "tags": ["安全报告", "网络安全"], "text": "经ThreatConnect分析，确认黑客攻击美国两个州立选举委员会使用的俄罗斯网络架构，与针对乌克兰和土耳其政府的钓鱼攻击活动相关。"}
{"title": "WitAwards 2016互联网安全年度评选【奖项报名/行业评委申请 正式启动】", "url": "https://www.freebuf.com/news/114737.html", "time": "2016-09-19", "level": "红色标题", "num_look": 859803, "num_comment": 13, "author": "FB独家", "tags": ["头条", "资讯"], "text": "一路走来，犹如行进在刀锋间，每一步都能感受脉搏翕动；仿佛置身于星空下，抬头仰望无限机遇；安全与你同在，感受脉动与机遇。"}
{"title": "660万明文密码泄露，知名广告公司Clixsence被黑客端了个底朝天", "url": "https://www.freebuf.com/news/114670.html", "time": "2016-09-19", "level": "金币+8", "num_look": 376471, "num_comment": 18, "author": "獬豸凌", "tags": ["资讯"], "text": ""}
{"title": "门罗币XMR挖矿恶意软件正在利用希捷NAS设备进行传播", "url": "https://www.freebuf.com/news/114500.html", "time": "2016-09-19", "level": "", "num_look": 339189, "num_comment": 2, "author": "米雪儿", "tags": ["资讯"], "text": "Sophos称，2016年上半年已探测到超过170万的设备感染Mal/Miner-C恶意软件。"}
{"title": "如何利用c118搭建基站发短信实验？", "url": "https://www.freebuf.com/articles/wireless/114517.html", "time": "2016-09-19", "level": "现金奖励", "num_look": 1191956, "num_comment": 39, "author": "diulei", "tags": ["无线安全"], "text": "本文详细讲解了如何利用c118来自己搭建基站发短信。"}
{"title": "渗透测试发展史", "url": "https://www.freebuf.com/special/114216.html", "time": "2016-09-19", "level": "", "num_look": 436389, "num_comment": 6, "author": "felix", "tags": ["安全报告", "特别企划"], "text": "在50多年的时间里，网络安全测试方法是如何一步一步发展到今天的。"}
{"title": "两年内赚到60万美元？走近以色列在线攻击服务vDOS", "url": "https://www.freebuf.com/articles/network/114615.html", "time": "2016-09-19", "level": "金币+8", "num_look": 379650, "num_comment": 8, "author": "dawner", "tags": ["特别企划", "网络安全"], "text": "攻击者变受害人——vDOS反被黑。细数其运作模式及洗钱行为。"}
{"title": "APP漏洞自动化扫描专业评测报告（下篇）", "url": "https://www.freebuf.com/articles/terminal/114453.html", "time": "2016-09-19", "level": "现金奖励", "num_look": 408289, "num_comment": 15, "author": "Sunnieli", "tags": ["安全报告", "终端安全"], "text": "作为本系列的最后一篇，本文在上篇中选取的4个APP中随机选择一个测试结果来进行对比。"}
{"title": "FB商城上新｜让我们荡起双桨，徜徉在GEEK的海洋", "url": "https://www.freebuf.com/news/114657.html", "time": "2016-09-18", "level": "", "num_look": 197360, "num_comment": 8, "author": "FB客服", "tags": ["资讯"], "text": "从收集到的民意来看，除了零食，大家对数码、配件、书籍也是有一定需求的，所以知书达理的小编从中挑选了一些。"}
{"title": "可远程安装任意APP，小米手机藏后门？小米官方否认", "url": "https://www.freebuf.com/news/114665.html", "time": "2016-09-18", "level": "红色标题", "num_look": 624806, "num_comment": 41, "author": "孙毛毛", "tags": ["终端安全", "资讯"], "text": "国外媒体Hack News报道称，为了解开这些疑惑，来自荷兰的计算机系学生Thijs Broenink，调查研究了自己小米Mi4手机。"}
{"title": "SQLiScanner：又一款基于SQLMAP和Charles的被动SQL 注入漏洞扫描工具", "url": "https://www.freebuf.com/sectool/114635.html", "time": "2016-09-18", "level": "", "num_look": 776313, "num_comment": 48, "author": "Blur", "tags": ["工具"], "text": "叕一款基于SQLMAP和Charles的被动SQL 注入漏洞扫描工具。"}
{"title": "都是权限惹的祸：安卓恶意APP如何将其他APP中的私有数据搞到手", "url": "https://www.freebuf.com/articles/terminal/114330.html", "time": "2016-09-18", "level": "", "num_look": 388692, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["终端安全"], "text": "从Android的诞生之日起，其文件系统中就一直存在着权限问题，虽然只是低危漏洞。在该漏洞提交给谷歌后，谷歌给了500美元的漏洞奖金。"}
{"title": "解密方程式组织的Unix后门NOPEN", "url": "https://www.freebuf.com/articles/system/114607.html", "time": "2016-09-18", "level": "金币+8", "num_look": 521553, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["特别企划", "系统安全"], "text": "近日，Vectra公司对其中的一份泄漏文件进行了分析，并且发现了一个名叫“NOPEN”的Unix远程管理工具（RAT）。"}
{"title": "如何从未联网PC中获取信息？试试让USB接口变身无线电发射器", "url": "https://www.freebuf.com/articles/wireless/113561.html", "time": "2016-09-18", "level": "", "num_look": 616670, "num_comment": 14, "author": "孙毛毛", "tags": ["无线安全"], "text": "看USB如何变身mini射频发射器，从离线PC盗取密钥。"}
{"title": "买台量子计算机，分分钟破解加密算法", "url": "https://www.freebuf.com/articles/database/114354.html", "time": "2016-09-17", "level": "", "num_look": 623199, "num_comment": 21, "author": "欧阳洋葱", "tags": ["数据安全"], "text": "量子计算如此彪悍，破解加密算法都不在话下。我们现在所用的部分加密工具，到2026年就有1/7的概率遭破解；到了2031年，概率升至50%。"}
{"title": "解读美国国会关于OPM数据泄露事件的调查报告", "url": "https://www.freebuf.com/articles/paper/114342.html", "time": "2016-09-17", "level": "金币+7", "num_look": 323168, "num_comment": 5, "author": "clouds", "tags": ["安全报告"], "text": "美国政府历史上最大的数据泄露案件之一，调差报告分析原因竟是由于OPM领导不力，缺乏安全意识。"}
{"title": "安卓ELF恶意软件深度分析", "url": "https://www.freebuf.com/articles/system/113964.html", "time": "2016-09-16", "level": "", "num_look": 391738, "num_comment": 7, "author": "猎豹移动安全实验室", "tags": ["系统安全"], "text": "现如今的Android病毒从日益从简单发展到复杂，从单纯的dex病毒转向为elf病毒。"}
{"title": "黑客眼中的像素追踪技术（Pixel tracking）", "url": "https://www.freebuf.com/articles/network/114402.html", "time": "2016-09-16", "level": "金币+7", "num_look": 613867, "num_comment": 8, "author": "Alpha_h4ck", "tags": ["网络安全"], "text": "像素追踪技术是一种只有电子邮件营销平台才会使用的技术。但是现在安全研究专家发现，这项技术似乎已经成为黑客工具了。"}
{"title": "逆向工厂（一）：从hello world开始", "url": "https://www.freebuf.com/special/114231.html", "time": "2016-09-16", "level": "现金奖励", "num_look": 1207944, "num_comment": 49, "author": "追影人", "tags": ["特别企划"], "text": "从本篇起，逆向工厂带大家从程序起源讲起，领略计算机程序逆向技术，深入探索逆向的魅力。"}
{"title": "DBPwAudit：数据库密码审计工具", "url": "https://www.freebuf.com/sectool/114050.html", "time": "2016-09-15", "level": "金币+7", "num_look": 292170, "num_comment": 4, "author": "莫须有", "tags": ["工具"], "text": "DBPwAudit是一个Java数据库密码审计工具，是一个可以执行在线审计密码质量的数据库引擎。该应用程序可以通过复制新的JDBC驱动程序到JDBC目录来添加额外的数据库驱动程序。"}
{"title": "Android系统到底安不安全？细数Android7.0 Nougat的几大安全增强功能", "url": "https://www.freebuf.com/news/114224.html", "time": "2016-09-15", "level": "", "num_look": 418176, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["终端安全", "资讯"], "text": "Android牛轧糖安全性能分析"}
{"title": "社工案例：骗子骗了我500美元，最后却求我不要告诉他父母", "url": "https://www.freebuf.com/articles/others-articles/114301.html", "time": "2016-09-15", "level": "", "num_look": 393164, "num_comment": 20, "author": "Alpha_h4ck", "tags": ["其他"], "text": "作者在网上被人骗走了500美元的苹果购物卡，励志的作者最终通过自己的努力把卡拿了回来，他是怎么做到的？"}
{"title": "冒用数字签名的对抗：亟需加强的签名审核", "url": "https://www.freebuf.com/articles/paper/114502.html", "time": "2016-09-14", "level": "", "num_look": 283421, "num_comment": 7, "author": "360安全", "tags": ["安全报告"], "text": "7月份，360白名单分析组捕获并查杀了一批具有知名公司签名的木马，并于8月中旬在国内首发分析报告，但此类木马并没有销声匿迹，而是在默默地为中秋佳节的爆发做准备。"}
{"title": "看看影音恶意挖矿行为分析", "url": "https://www.freebuf.com/articles/system/114522.html", "time": "2016-09-14", "level": "现金奖励", "num_look": 933527, "num_comment": 36, "author": "安全豹", "tags": ["安全报告", "系统安全"], "text": "近日，部分用户出现电脑GPU占用率高，电脑温度升高。经过远程调试分析发现是看看影音在后台偷偷利用用户电脑运算资源进行以太币挖矿。"}
{"title": "漏洞盒子 | 八月风云榜", "url": "https://www.freebuf.com/news/114516.html", "time": "2016-09-14", "level": "", "num_look": 219460, "num_comment": 10, "author": "漏洞盒子", "tags": ["资讯"], "text": "漏洞盒子的技术部门伙伴对8月份的情况进行了回顾与评定。评定结果已经出炉，分为「白帽子排行」「团队排行」。"}
{"title": "趋势科技：“不越狱 装正版”？海马应用市场的广告程序已感染超7500万iOS用户", "url": "https://www.freebuf.com/news/114458.html", "time": "2016-09-14", "level": "红色标题", "num_look": 347561, "num_comment": 8, "author": "欧阳洋葱", "tags": ["资讯"], "text": "就算不越狱，你的iPhone也可能被第三方市场中的恶意程序感染，比如海马苹果助手。"}
{"title": "MarketsandMarkets：渗透测试市场前景大好，2021年将达到17亿美元", "url": "https://www.freebuf.com/articles/neopoints/114168.html", "time": "2016-09-14", "level": "", "num_look": 356780, "num_comment": 9, "author": "米雪儿", "tags": ["安全报告", "观点"], "text": "渗透测试市场预计将以23.7%的复合年增长率从2016年的5.947亿美元增长至2021年17.243亿美元。"}
{"title": "Foxscan：一款基于SQLMAP的主动和被动资源发现扫描工具", "url": "https://www.freebuf.com/sectool/114235.html", "time": "2016-09-14", "level": "现金奖励", "num_look": 703833, "num_comment": 39, "author": "风炫520", "tags": ["工具"], "text": "一个新的漏洞扫描工具-Foxscan"}
{"title": "揭秘：美国警方监控技术大曝光", "url": "https://www.freebuf.com/news/113918.html", "time": "2016-09-14", "level": "金币+7", "num_look": 406739, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["其他", "安全报告"], "text": "近日，The Intercept曝光了美国执法部门所使用的监控技术种类。"}
{"title": "巴尔的摩为何成为了美国研究监控技术的“实验室”", "url": "https://www.freebuf.com/articles/others-articles/114009.html", "time": "2016-09-14", "level": "", "num_look": 270291, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["其他", "安全报告"], "text": "这些监控技术的使用范围和权限一直都是公众关注的焦点，而近期美国国内所爆出的监控丑闻又引发了另一个值得思考的问题：这一次为什么偏偏是巴尔的摩呢？"}
{"title": "USB Kill v2.0，一个可以瞬间烧毁电脑或平板的“U盘”", "url": "https://www.freebuf.com/news/114391.html", "time": "2016-09-13", "level": "金币+6", "num_look": 1353092, "num_comment": 24, "author": "Alpha_h4ck", "tags": ["终端安全", "资讯"], "text": "在很多科幻题材的电影中，黑客可以通过远程操作来“引爆”某一台计算机。现实中这一想法能否成真？"}
{"title": "FFMpeg 3.1.3修复来自支付宝unLimit Security Team的高危漏洞", "url": "https://www.freebuf.com/vuls/114484.html", "time": "2016-09-13", "level": "", "num_look": 285967, "num_comment": 3, "author": "unLimit安全小组", "tags": ["漏洞"], "text": "近日，FFMpeg3.1.3发布，并修复了高危漏洞CVE-2016-6920。"}
{"title": "详解GPS欺骗：针对导航系统的「致命攻击」", "url": "https://www.freebuf.com/articles/wireless/114249.html", "time": "2016-09-13", "level": "金币+6", "num_look": 722358, "num_comment": 7, "author": "clouds", "tags": ["无线安全", "特别企划"], "text": "神秘的是——国防部长阿什顿卡特只是简单回应到：那些训练有素的船员“迷航”了，调查在进行中。"}
{"title": "跨平台后门Mokes现已加入OS X豪华午餐", "url": "https://www.freebuf.com/news/114236.html", "time": "2016-09-13", "level": "", "num_look": 248651, "num_comment": 4, "author": "Alpha_h4ck", "tags": ["系统安全", "资讯"], "text": "卡巴斯基实验室发现了一种恶意软件，这种恶意软件可以在目前主流的几款操作系统平台上运行，包括Windows、Linux和Mac OSX。"}
{"title": "Sundown EK：漏洞利用工具中的抄袭大师", "url": "https://www.freebuf.com/news/113878.html", "time": "2016-09-13", "level": "", "num_look": 222863, "num_comment": 9, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "Sundown是目前市场上最新款的漏洞利用工具，而Sundown的作者也成功地证明了自己其实就是一个抄袭大师。"}
{"title": "浅析基于用户（角色）侧写的内部威胁检测系统", "url": "https://www.freebuf.com/articles/network/114087.html", "time": "2016-09-13", "level": "现金奖励", "num_look": 552699, "num_comment": 7, "author": "木千之", "tags": ["特别企划", "网络安全"], "text": "离职员工对于任何一个组织而言都是潜在的巨大威胁，然而现实中的内部威胁检测系统至今蒙着神秘的面纱，不仅没有统一的设计标准，也没有得到普遍认可的商业版本。"}
{"title": "新手教程：如何使用Burpsuite抓取手机APP的HTTPS数据", "url": "https://www.freebuf.com/articles/terminal/113940.html", "time": "2016-09-13", "level": "金币+6", "num_look": 1900100, "num_comment": 25, "author": "smartdone", "tags": ["终端安全"], "text": "本文一步步教你使用Burpsuite抓取Android手机应用的的HTTPS数据。"}
{"title": "漏洞预警：MySQL代码执行0-day漏洞 可本地提权", "url": "https://www.freebuf.com/vuls/114408.html", "time": "2016-09-13", "level": "红色标题", "num_look": 1244522, "num_comment": 20, "author": "欧阳洋葱", "tags": ["漏洞"], "text": "本地和远程攻击者成功利用该漏洞，可以ROOT权限执行代码，完全控制服务器。"}
{"title": "详解Windows Shim的攻防利用", "url": "https://www.freebuf.com/articles/system/114287.html", "time": "2016-09-12", "level": "现金奖励", "num_look": 466581, "num_comment": 4, "author": "nickchang", "tags": ["系统安全"], "text": "理论上说，任何的计算机问题都可以新增一层逻辑来解决。Shim也是这么一个垫在应用程序和windowsAPI之间的逻辑层。"}
{"title": "基于Github的源码白盒扫描工具Raptor", "url": "https://www.freebuf.com/sectool/114017.html", "time": "2016-09-12", "level": "", "num_look": 431763, "num_comment": 4, "author": "dawner", "tags": ["工具"], "text": "Raptor（猛禽）是一款基于WEB界面的github源代码扫描器。你只需要给它一个Github repository的URL地址，它就能进行自动扫描。"}
{"title": "NSA（美国国安局）泄漏Exploit分析", "url": "https://www.freebuf.com/articles/others-articles/114187.html", "time": "2016-09-12", "level": "现金奖励", "num_look": 545532, "num_comment": 7, "author": "tigerlab", "tags": ["其他", "特别企划"], "text": "多数漏洞的验证分析情况已有同行分享，现将我们对另外三个未见分析的漏洞的验证分析分享给大家，其中包括fortinet、juniper、Cisco三种设备漏洞。"}
{"title": "Infection Monkey：数据中心边界及内部服务器安全检测工具", "url": "https://www.freebuf.com/sectool/113745.html", "time": "2016-09-12", "level": "", "num_look": 342475, "num_comment": 2, "author": "dawner", "tags": ["工具"], "text": "Infection Monkey是一款由以色列安全公司GuardiCore在2016黑帽大会上发布的数据中心安全检测工具。"}
{"title": "应用深度学习与大数据分析识别诈骗（骚扰）电话", "url": "https://www.freebuf.com/articles/others-articles/113990.html", "time": "2016-09-12", "level": "现金奖励", "num_look": 696603, "num_comment": 20, "author": "猎豹移动威胁情报中心", "tags": ["其他", "数据安全"], "text": "猎豹移动总裁傅盛说：深度学习是基于多层神经网路，并以海量数据做为输入的自主学习方法 [1]；其本质就是透过很多小的数学元件组合成一个复杂模型再用来解复杂的问题。"}
{"title": "You dirty RAT：地下网络犯罪世界的“黑吃黑”", "url": "https://www.freebuf.com/articles/system/113906.html", "time": "2016-09-11", "level": "金币+6", "num_look": 409367, "num_comment": 4, "author": "米雪儿", "tags": ["安全报告", "系统安全"], "text": "有时候，黑客之间也存在“黑吃黑”的勾当，那可不，真实的事件就是这样发生的..."}
{"title": "你的Outlook真的安全？一条恶意规则远程攻陷你的工作站！", "url": "https://www.freebuf.com/articles/system/114077.html", "time": "2016-09-11", "level": "金币+6", "num_look": 323178, "num_comment": 7, "author": "SkyMine", "tags": ["系统安全"], "text": "只需要Outlook的一条恶意规则，就能远程攻陷你的工作站！以前构建Outlook恶意规则的方法都很麻烦，这次的就不同了。"}
{"title": "Android Accessibility 安全性研究报告", "url": "https://www.freebuf.com/articles/terminal/114045.html", "time": "2016-09-11", "level": "", "num_look": 533911, "num_comment": 2, "author": "360手机卫士", "tags": ["安全报告", "终端安全"], "text": "本报告结合对一款滥用Accessibility的木马的分析，从Accessbility的设计初衷、技术发展、滥用情况等角度研究Accessibility的安全性。"}
{"title": "匡恩网络招聘安全人才", "url": "https://www.freebuf.com/jobs/114033.html", "time": "2016-09-11", "level": "", "num_look": 334066, "num_comment": 15, "author": "匡恩网络", "tags": ["安全招聘"], "text": ""}
{"title": "【FB TV】一周「BUF大事件」：一张照片黑入手机；多数主流网站网址的不安全属性；被球迷告上法庭的NBA金州勇士队", "url": "https://www.freebuf.com/news/114209.html", "time": "2016-09-10", "level": "红色标题", "num_look": 281886, "num_comment": 4, "author": "supercoco", "tags": ["资讯"], "text": "只要一张照片，安卓手机怎么就被黑了呢？NBA金州勇士队为何会被球迷告上法庭..."}
{"title": "如何构造Office漏洞POC（以CVE-2012-0158为例）", "url": "https://www.freebuf.com/articles/system/113945.html", "time": "2016-09-10", "level": "", "num_look": 461877, "num_comment": 7, "author": "维一零", "tags": ["系统安全"], "text": "本文详细的讲解了CVE-2012-0158漏洞的原理，以及如何基于原理手动构造出可利用的POC样本，给大家弹一个计算器瞅瞅。"}
{"title": "木马作者联系安全厂商，请求修正描述……", "url": "https://www.freebuf.com/news/113982.html", "time": "2016-09-10", "level": "", "num_look": 294612, "num_comment": 13, "author": "Sphinx", "tags": ["资讯"], "text": "Android银行木马Bilal Bot恶意软件作者主动向IBM的X-Force安全团队联系，要求修正他们对这个木马的描述。"}
{"title": "恶意软件防卫指南（下）：远离网络安全威胁，让电信诈骗分子见鬼去吧", "url": "https://www.freebuf.com/special/113705.html", "time": "2016-09-10", "level": "", "num_look": 319088, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["特别企划"], "text": "如果你不幸中招的话，你应该怎么办呢？在你失去理智之前，请先尝试这篇文章中所介绍的十个简单的操作方法。"}
{"title": "周末娱乐：讲真，这才是我所说黑客的定义！", "url": "https://www.freebuf.com/news/113820.html", "time": "2016-09-10", "level": "金币+8", "num_look": 293495, "num_comment": 11, "author": "evil7", "tags": ["资讯"], "text": "看到一篇挺好玩的文章，哈哈，翻译过来你们感受一下这geekstyle的魔性。"}
{"title": "谷歌Chrome56正式将HTTP页面标记“不安全”", "url": "https://www.freebuf.com/news/114113.html", "time": "2016-09-09", "level": "金币+8", "num_look": 210591, "num_comment": 12, "author": "liaoxj2046", "tags": ["资讯"], "text": "9月8日谷歌宣布，从2017年1月（Chrome56）开始，正式将某些HTTP页面标记“不安全”。"}
{"title": "【快讯】英特尔将以31亿美元出售McAfee", "url": "https://www.freebuf.com/news/114065.html", "time": "2016-09-09", "level": "", "num_look": 242214, "num_comment": 5, "author": "Sphinx", "tags": ["资讯"], "text": "英特尔于今日宣布将出售Intel Security (原McAfee)大量股份给美国投资公司TPG。"}
{"title": "【FB视频】FreeBuf专访亚太互联网络信息中心主席Paul Wilson", "url": "https://www.freebuf.com/video/113421.html", "time": "2016-09-09", "level": "", "num_look": 297444, "num_comment": 10, "author": "supercoco", "tags": ["人物志", "视频"], "text": "Paul Wilson担任亚太互联网络信息中心主席一职已经超过15年，对互联网治理、资源管理有着非常丰富的经验，快来听一听他对与互联网、IPv6、DNS服务器的看法吧~"}
{"title": "一个“良心未泯”的国产敲诈者病毒分析", "url": "https://www.freebuf.com/articles/system/114046.html", "time": "2016-09-09", "level": "红色标题", "num_look": 659203, "num_comment": 30, "author": "360安全", "tags": ["系统安全"], "text": ""}
{"title": "shard：密码重用检测工具", "url": "https://www.freebuf.com/sectool/113785.html", "time": "2016-09-09", "level": "", "num_look": 371810, "num_comment": 15, "author": "felix", "tags": ["工具"], "text": "许多用户都会在不同网站使用相同的密码，这种做法势必会带来很多安全隐患，而今天要介绍的shard就是一个检测密码重用的命令行工具。"}
{"title": "社工方法加载OLE对象，更改浏览器代理设置窃取信息", "url": "https://www.freebuf.com/news/113868.html", "time": "2016-09-09", "level": "", "num_look": 193904, "num_comment": 6, "author": "clouds", "tags": ["资讯"], "text": "最近，我们发现了使用社工方法加载恶意OLE 对象，通过更改用户浏览器代理设置来窃取敏感信息的攻击。"}
{"title": "国产山寨版比特币敲诈木马分析", "url": "https://www.freebuf.com/articles/system/112256.html", "time": "2016-09-08", "level": "", "num_look": 312333, "num_comment": 9, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": ""}
{"title": "关于爱快iKuai路由产品漏洞情况的通报", "url": "https://www.freebuf.com/news/114047.html", "time": "2016-09-08", "level": "", "num_look": 592590, "num_comment": 8, "author": "CNNVD", "tags": ["漏洞", "资讯"], "text": ""}
{"title": "Python勒索软件来袭，国产杀软集体失身", "url": "https://www.freebuf.com/articles/system/113937.html", "time": "2016-09-08", "level": "现金奖励", "num_look": 605664, "num_comment": 18, "author": "降草", "tags": ["系统安全"], "text": "近日，fortinet截获名为“Fscociety Locker”的勒索软件。之所以叫这名字，是因为勒索软件作者是美剧“黑客军团”的粉丝。"}
{"title": "GitHub上10个最受欢迎的安全项目", "url": "https://www.freebuf.com/sectool/113919.html", "time": "2016-09-08", "level": "", "num_look": 615472, "num_comment": 10, "author": "米雪儿", "tags": ["工具"], "text": "GitHub有个地方可以帮你获寻最热门的安全项目，就是GitHub Showcases板块。板块中罗列了当下GitHub上最受欢迎的开源安全项目。"}
{"title": "打脸NSA：法国前情报官员证实NSA曾入侵法国总统府网络", "url": "https://www.freebuf.com/news/113991.html", "time": "2016-09-08", "level": "金币+8", "num_look": 233786, "num_comment": 6, "author": "clouds", "tags": ["特别企划", "资讯"], "text": "看完上述斯诺登泄露的文件，结合这次法国情报官员的证实，恍然大悟：这其实是一份法方发给NSA，用来“打脸”NSA的前奏文件。"}
{"title": "安全科普：HTTPS初探", "url": "https://www.freebuf.com/articles/database/113738.html", "time": "2016-09-08", "level": "现金奖励", "num_look": 654860, "num_comment": 17, "author": "HPT", "tags": ["数据安全"], "text": "本篇主要讲述HTTPS的安全性以及怎么达到这种安全性的细节，对新手而言会有不错的科普价值。"}
{"title": "端到端加密（E2EE）技术分析：在移动应用中实现安全通信的利器", "url": "https://www.freebuf.com/articles/database/113855.html", "time": "2016-09-08", "level": "", "num_look": 745923, "num_comment": 12, "author": "Alpha_h4ck", "tags": ["数据安全", "网络安全"], "text": "实际上，我们可以将端到端加密（E2EE）视作一种目前比较安全的通信系统。"}
{"title": "高级浏览器漏洞攻击包：BrowserExploit", "url": "https://www.freebuf.com/sectool/113417.html", "time": "2016-09-07", "level": "", "num_look": 406604, "num_comment": 12, "author": "米雪儿", "tags": ["工具"], "text": "BrowserExploit是一种先进的浏览器漏洞攻击包（通常指利用浏览器的漏洞来渗透目标）"}
{"title": "一张图片能导致数百万Android手机被黑？", "url": "https://www.freebuf.com/news/113965.html", "time": "2016-09-07", "level": "", "num_look": 370468, "num_comment": 8, "author": "欧阳洋葱", "tags": ["资讯"], "text": "谷歌刚刚发布了9月份的Android更新补丁，修复了一个先前鲜为人知的漏洞：一张图片就能让设备变砖，或者远程代码执行。"}
{"title": "NSO到底是个什么样的公司？揭秘三叉戟0day的缔造者", "url": "https://www.freebuf.com/articles/others-articles/113852.html", "time": "2016-09-07", "level": "", "num_look": 276728, "num_comment": 3, "author": "dawner", "tags": ["其他", "安全报告"], "text": "前一阵iOS的0-day漏洞曝光，Pegasus恶意程序也被揭露。而这款恶意程序的始作俑者NSO Group究竟是家什么样的公司呢？"}
{"title": "BEC诈骗横行，企业员工如何防钓鱼？", "url": "https://www.freebuf.com/articles/security-management/113412.html", "time": "2016-09-07", "level": "", "num_look": 398426, "num_comment": 2, "author": "米雪儿", "tags": ["企业安全", "安全管理"], "text": "勒索软件攻击可能是企业和机构面临的最新威胁，另一个更为突出的应该就非商业电邮诈骗（BEC）莫属了。"}
{"title": "齐博CMS splitword.php后门解密", "url": "https://www.freebuf.com/articles/web/113720.html", "time": "2016-09-07", "level": "金币+8", "num_look": 515621, "num_comment": 15, "author": "ruo", "tags": ["WEB安全"], "text": "齐博CMS是一款非常优秀的内容管理系统，但也不得不说其后门事件也层出不穷，本文就解密齐博代码来看他的后门。"}
{"title": "“风水逆转”：获取云端虚拟机的完整控制权其实很容易", "url": "https://www.freebuf.com/articles/system/113790.html", "time": "2016-09-07", "level": "", "num_look": 270330, "num_comment": 9, "author": "欧阳洋葱", "tags": ["系统安全"], "text": "最近有安全研究人员提出一种名为“风水翻转”的攻击技术，主要针对同处一个云环境下的其他虚拟机。其本质是物理内存的比特位翻转。"}
{"title": "2016年DDoS攻击趋势分析报告", "url": "https://www.freebuf.com/articles/network/113528.html", "time": "2016-09-06", "level": "", "num_look": 476235, "num_comment": 5, "author": "米雪儿", "tags": ["安全报告", "网络安全"], "text": "根据NexusGuard公司的研究结果表明，2016年第二季度的DDoS攻击较之第一季度呈现83%的增长幅度。在所有攻击行为中， DNS成为2016年使用的最普遍的协议（2015年为NTP和SSDP）。"}
{"title": "知名色情网站Brazzers 80万用户数据遭泄露", "url": "https://www.freebuf.com/news/113904.html", "time": "2016-09-06", "level": "", "num_look": 615431, "num_comment": 21, "author": "ArthurKiller", "tags": ["资讯"], "text": "国外媒体爆料Brazzers的论坛被黑客攻击，80万个用户的信息遭到泄露，泄露的信息中包含用户的邮箱，明文密码，用户名等私人信息。"}
{"title": "【快讯】明晨4点发起全面攻击？国内外多家大型企业收到“黑客恐吓信”", "url": "https://www.freebuf.com/news/113877.html", "time": "2016-09-06", "level": "", "num_look": 306802, "num_comment": 18, "author": "ArthurKiller", "tags": ["资讯"], "text": "据FreeBuf了解，近日国内外很多大企业都收到了一份威胁邮件——邮件内容表示，如果公司不支付赎金，那么会遭受到非常猛烈的网络攻击。"}
{"title": "色情手机APP暗藏杀机：SexTrap病毒解析", "url": "https://www.freebuf.com/articles/terminal/113521.html", "time": "2016-09-06", "level": "", "num_look": 416436, "num_comment": 8, "author": "AVLTeam", "tags": ["终端安全"], "text": "色情APP进行木马传播，严厉谴责这些“黑车老司机”！"}
{"title": "活在Web流量完全加密的世界里：FreeBuf专访赛门铁克全球高级业务发展总监Dean Coclin", "url": "https://www.freebuf.com/articles/people/112226.html", "time": "2016-09-06", "level": "", "num_look": 332133, "num_comment": 5, "author": "欧阳洋葱", "tags": ["人物志"], "text": "Coclin认定，未来的Web世界一定是完完全全经过了加密的世界，虽然现在HTTPS的占有率仅3%。"}
{"title": "一次对个人服务器入侵事件的调查", "url": "https://www.freebuf.com/articles/system/113774.html", "time": "2016-09-06", "level": "金币+8", "num_look": 630660, "num_comment": 17, "author": "clouds", "tags": ["特别企划", "系统安全"], "text": "这一切还要从我收到的通知邮件：“Your server is sending spam\"说起。"}
{"title": "13个有用的渗透测试资源博客", "url": "https://www.freebuf.com/news/113401.html", "time": "2016-09-06", "level": "", "num_look": 746455, "num_comment": 15, "author": "felix", "tags": [], "text": "我们提供13个最有用的渗透测试博客，帮你获取最新知识，激励你的白帽人生。"}
{"title": "NBA金州勇士队官方APP居然玩非法窃听……", "url": "https://www.freebuf.com/news/113734.html", "time": "2016-09-06", "level": "", "num_look": 192617, "num_comment": 5, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "与总冠军擦肩而过已经是够悲剧的了，但是现在勇士队却又遭到了球迷的起诉，原因竟是因为勇士队官方APP会监视并记录用户的隐私信息。"}
{"title": "漏洞盒子：中秋送礼，我们是认真的", "url": "https://www.freebuf.com/fevents/113835.html", "time": "2016-09-05", "level": "", "num_look": 262136, "num_comment": 19, "author": "漏洞盒子", "tags": ["活动"], "text": "这个中秋你打算怎么过？要不要来看看盒子妹给你准备的中秋礼物！"}
{"title": "恶意软件防卫指南（上）：你知道自己感染了恶意软件吗？", "url": "https://www.freebuf.com/articles/neopoints/113678.html", "time": "2016-09-05", "level": "", "num_look": 391535, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["特别企划", "观点"], "text": "让我们一起看一看计算机感染了恶意软件之后，会出现哪些症状。"}
{"title": "TheFatRat：Msfvenom傻瓜化后门生成工具", "url": "https://www.freebuf.com/sectool/113597.html", "time": "2016-09-05", "level": "", "num_look": 1045082, "num_comment": 17, "author": "Sphinx", "tags": ["工具"], "text": "本工具能使用msfvenom生成后门，程序能够用meterpreter reverse_tcp payload编译C语言程序，并能够绕过杀软。"}
{"title": "BlackHat议题解析：Windows程序的数字签名校验“漏洞”", "url": "https://www.freebuf.com/vuls/113527.html", "time": "2016-09-05", "level": "现金奖励", "num_look": 428627, "num_comment": 23, "author": "维一零", "tags": ["漏洞"], "text": "今年黑帽大会上，国外安全研究员展示了如何通过Windows的数字签名bypass对恶意程序代码的检测。本文侧重于展示其中数字签名的的校验“漏洞”。"}
{"title": "安洵信息招聘安全人才", "url": "https://www.freebuf.com/jobs/113503.html", "time": "2016-09-05", "level": "红色标题", "num_look": 417724, "num_comment": 37, "author": "安洵信息", "tags": ["安全招聘"], "text": "安洵信息技术有限公司（简称安洵信息）是一家专注于信息安全的技术型企业，因规模扩大，急需招聘一批有志之士加入。"}
{"title": "从某云服务商溯源黑客老巢：实例讲解Botnet僵尸网络和DDoS", "url": "https://www.freebuf.com/articles/system/113690.html", "time": "2016-09-05", "level": "现金奖励", "num_look": 926232, "num_comment": 22, "author": "挑灯看剑", "tags": ["安全报告", "特别企划"], "text": "本人最近在某云服务器上捕获到一只活跃Bot僵尸，然后顺藤摸瓜成功进入黑客的C&C控制中心，观察到黑客团伙每天都会利用Botnet僵尸网络发动DDoS攻击。"}
{"title": "机器人的洪流：刷库、撞库那些事儿", "url": "https://www.freebuf.com/articles/others-articles/113183.html", "time": "2016-09-05", "level": "", "num_look": 359724, "num_comment": 13, "author": "阿里云誉反欺诈", "tags": ["其他", "安全报告"], "text": "面对社会上层出不穷的诈骗新闻，我们可以发现骗子们诈骗成功的一个关键是：骗子们知道你叫什么、住在哪里、买了什么东西、花了多少钱。"}
{"title": "MSRC全球白帽贡献榜第8的奥义：FreeBuf专访百度安全实验室X-Team负责人黄正", "url": "https://www.freebuf.com/articles/people/113223.html", "time": "2016-09-05", "level": "", "num_look": 600220, "num_comment": 15, "author": "欧阳洋葱", "tags": ["人物志"], "text": "你能想象吗？在MSRC Top 100黑客贡献榜上排名第八的黄正，回家其实很爱种花种草、养猫养鱼。"}
{"title": "全解美军“水下黑客平台”安纳波利斯号核潜艇", "url": "https://www.freebuf.com/articles/others-articles/113696.html", "time": "2016-09-04", "level": "金币+10", "num_look": 508333, "num_comment": 4, "author": "clouds", "tags": ["其他", "特别企划"], "text": ""}
{"title": "链接地址中的target=”_blank”属性，为钓鱼攻击打开了大门", "url": "https://www.freebuf.com/vuls/113634.html", "time": "2016-09-04", "level": "", "num_look": 638813, "num_comment": 8, "author": "Alpha_h4ck", "tags": ["漏洞"], "text": "主流的互联网服务提供商都会在网页的链接地址中加入target=”_blank”属性，而这绝对是一种非常不安全的行为。"}
{"title": "好莱坞电影中七大「最玄幻」的黑客桥段", "url": "https://www.freebuf.com/articles/others-articles/113670.html", "time": "2016-09-04", "level": "金币+10", "num_look": 879202, "num_comment": 21, "author": "Alpha_h4ck", "tags": ["其他", "特别企划"], "text": "在很多好莱坞电影和美剧中，导演们通常都会把黑客塑造成一个神一样的存在。"}
{"title": "隐藏Android系统Root状态？这个APP可以帮你做到", "url": "https://www.freebuf.com/news/113493.html", "time": "2016-09-04", "level": "", "num_look": 1613361, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["工具", "终端安全"], "text": "著名Android开发者Chainfire发布了一款名为“Suhide”的APP，这款新型APP允许用户针对特定的应用程序来隐藏Android设备的Root状态。"}
{"title": "【FB TV】一周「BUF大事件」：Dropbox用户数据被拖；沃通SSL证书在搞啥；基于Twitter的安卓僵尸网络厉害了", "url": "https://www.freebuf.com/video/113673.html", "time": "2016-09-03", "level": "红色标题", "num_look": 255598, "num_comment": 4, "author": "supercoco", "tags": ["视频"], "text": "网上居然流通着6800万Dropbox帐号密码，这又是什么时候泄露的呢。"}
{"title": "Bypass UAC的一个实例分析", "url": "https://www.freebuf.com/articles/system/112823.html", "time": "2016-09-03", "level": "现金奖励", "num_look": 419532, "num_comment": 13, "author": "zzz66686", "tags": ["系统安全"], "text": "本文运用bypass UAC技术的病毒实例Cerber进行分析，通过逆向分析该实例让读者能够对bypass UAC的完整执行过程有一个正确的认识。"}
{"title": "关于近期曝光的针对银行SWIFT系统攻击事件综合分析", "url": "https://www.freebuf.com/articles/terminal/113606.html", "time": "2016-09-02", "level": "", "num_look": 359630, "num_comment": 5, "author": "360安全", "tags": ["安全报告", "终端安全"], "text": "2016 年 2 月孟加拉国央行被黑客攻击导致 8100 万美元被窃取的事件被曝光后，针对银行 SWIFT 系统的其他网络攻击事件逐一被公开。"}
{"title": "sshhipot：一款高交互的SSH蜜罐", "url": "https://www.freebuf.com/sectool/113594.html", "time": "2016-09-02", "level": "金币+6", "num_look": 337369, "num_comment": 7, "author": "phper", "tags": ["工具"], "text": "目前这个项目仍在研发中，欢迎提出宝贵意见。"}
{"title": "“百家”木马集团第二弹：冒领数字签名", "url": "https://www.freebuf.com/articles/system/113418.html", "time": "2016-09-02", "level": "红色标题", "num_look": 478490, "num_comment": 28, "author": "腾讯电脑管家", "tags": ["安全报告", "系统安全"], "text": "腾讯反病毒实验室对百家木马进行深入的分析挖掘，发现了其另一种入白方式——冒领数字签名(即通过伪造公司资料，向签名机构申请知名公司数字签名证书)。"}
{"title": "劫持Chrome浏览器的“新方法”", "url": "https://www.freebuf.com/articles/web/113326.html", "time": "2016-09-02", "level": "", "num_look": 456762, "num_comment": 11, "author": "Alpha_h4ck", "tags": ["WEB安全"], "text": "在这篇文章中，我们将会给大家介绍一种专门针对谷歌Chrome浏览器用户的新型诈骗技术。"}
{"title": "如何将旧电脑改造为渗透工具", "url": "https://www.freebuf.com/sectool/113181.html", "time": "2016-09-02", "level": "现金奖励", "num_look": 916213, "num_comment": 65, "author": "zml1780593909", "tags": ["工具", "极客"], "text": "旧电脑其实也是可以很方便地打造成渗透工具的！有DIY精神就行。"}
{"title": "FreeTalk·深圳站大揭秘（含议题PPT下载）", "url": "https://www.freebuf.com/fevents/113408.html", "time": "2016-09-02", "level": "", "num_look": 229309, "num_comment": 4, "author": "FB客服", "tags": ["活动"], "text": "没有天气预报所说的雷雨，天气也没有那么燥热。FreeTalk时隔两年再次来到鹏城深圳，在软件产业基地的3W咖啡举办。"}
{"title": "D-Link路由器固件后门，导致内网域名劫持", "url": "https://www.freebuf.com/articles/terminal/113487.html", "time": "2016-09-02", "level": "红色标题", "num_look": 672170, "num_comment": 22, "author": "安洵信息", "tags": ["特别企划", "终端安全"], "text": "DI系类产品都是上网行为管理认证路由器，功能比较强大，大多数都是企业在使用，可以根据京东的评论数量来推算销量，受害者至少一万。"}
{"title": "Avazu Holding诚聘移动安全人才", "url": "https://www.freebuf.com/jobs/113206.html", "time": "2016-09-01", "level": "", "num_look": 221872, "num_comment": 3, "author": "midmanworks", "tags": ["安全招聘"], "text": "AVAZU HOLDING集团2009年成立于德国，旗下公司业务横跨广告，APP、游戏、投资领域。"}
{"title": "OneLogin官方宣布服务器遭到入侵，攻击者可窥探用户个人数据", "url": "https://www.freebuf.com/news/113523.html", "time": "2016-09-01", "level": "金币+6", "num_look": 169013, "num_comment": 169013, "author": "xiaoqiang0304", "tags": ["资讯"], "text": "近日，OneLogin公司向外宣布，由于他们的服务器存在一个安全漏洞，黑客可以窥探到用户的个人数据（Secure notes）。"}
{"title": "如何“组合拳”渗透开发者的本地数据库", "url": "https://www.freebuf.com/articles/database/111692.html", "time": "2016-09-01", "level": "", "num_look": 522926, "num_comment": 4, "author": "dawner", "tags": ["数据安全", "网络安全"], "text": "你可能不知道，一些本地运行的服务能跟你在外网访问的网站进行通信，黑客也许能借此从你本地服务中窃取数据。"}
{"title": "【今日头条】6800万Dropbox帐号密码遭泄露", "url": "https://www.freebuf.com/news/113472.html", "time": "2016-09-01", "level": "红色标题", "num_look": 421336, "num_comment": 16, "author": "Sphinx", "tags": ["资讯"], "text": "最近6800万Dropbox账号密码在网上传播，快去看看你的帐号是否也在其列。不过据Dropbox所说也不必太过担心，这些数据实际是源自2012年数据泄露事件。"}
{"title": "一起看看首届XPwn大会都破解了啥？", "url": "https://www.freebuf.com/fevents/113432.html", "time": "2016-09-01", "level": "", "num_look": 293178, "num_comment": 11, "author": "ArthurKiller", "tags": ["活动"], "text": "8月31日，第一届XPwn在北京召开，参赛选手成功攻破了小米，索尼，思科，极路由，西门子等众多厂商的相关硬件设备。"}
{"title": "蜜罐系统设计的一些想法", "url": "https://www.freebuf.com/articles/system/113031.html", "time": "2016-09-01", "level": "现金奖励", "num_look": 630545, "num_comment": 10, "author": "Leon不会玩QEMU", "tags": ["系统安全"], "text": ""}
{"title": "勒索软件已“崛起”，企业准备好了吗？", "url": "https://www.freebuf.com/articles/security-management/112836.html", "time": "2016-09-01", "level": "", "num_look": 450363, "num_comment": 7, "author": "bimeover", "tags": ["安全管理", "特别企划"], "text": "从2014年到2015年，勒索软件的增长可以说是爆发式的，这一年中勒索软件数量相对于2014年整整翻了5倍，且支付金额也在快速增加。"}
{"title": "键盘记录器变身！揭秘间谍软件中的“战斗机”Agent Tesla", "url": "https://www.freebuf.com/news/113285.html", "time": "2016-09-01", "level": "", "num_look": 349700, "num_comment": 4, "author": "孙毛毛", "tags": ["特别企划", "系统安全"], "text": "这款间谍软件真的很“好用”！"}
{"title": "国内CA机构沃通错误颁发GitHub域名SSL证书", "url": "https://www.freebuf.com/news/113297.html", "time": "2016-08-31", "level": "红色标题", "num_look": 755936, "num_comment": 25, "author": "Sphinx", "tags": ["资讯"], "text": "国内CA机构沃通被爆在没有审核域名归属的情况下，给申请者颁发了一张GitHub根域名的SSL证书。"}
{"title": "看警方如何社工暗网恋童网站逮捕虐童狂魔", "url": "https://www.freebuf.com/news/113231.html", "time": "2016-08-31", "level": "金币+6", "num_look": 696432, "num_comment": 19, "author": "clouds", "tags": ["资讯"], "text": "在本文中，警方讲述了如何潜伏控制该暗网网站并抓获虐童狂魔的过程。"}
{"title": "Linux netfilter OOB root提权漏洞分析", "url": "https://www.freebuf.com/vuls/112969.html", "time": "2016-08-31", "level": "现金奖励", "num_look": 427554, "num_comment": 14, "author": "肥肥草", "tags": ["漏洞"], "text": "ExploitDatabase网站最近贴出了一个netfilter模块的提权POC，这篇文章对此进行了分析和成果共享。"}
{"title": "耸人听闻还是真相？简要分析浑水资本发布的圣犹达公司心脏医疗设备安全报告", "url": "https://www.freebuf.com/articles/paper/113349.html", "time": "2016-08-31", "level": "金币+6", "num_look": 413330, "num_comment": 6, "author": "clouds", "tags": ["安全报告"], "text": "知名做空机构浑水资本发布报告称，著名医疗器械公司圣犹达生产的多款心脏植入设备存在多个重大安全漏洞，可导致“致命性”网络攻击，对患者生命安全造成威胁。"}
{"title": "安全奥斯卡（Pwnie Awards 2016）获奖名单", "url": "https://www.freebuf.com/news/113309.html", "time": "2016-08-31", "level": "金币+6", "num_look": 329914, "num_comment": 7, "author": "米雪儿", "tags": ["其他", "特别企划"], "text": "这是一场有关“精彩极了”和“糟糕透了”的安全评选活动，历经10年的安全界奥斯卡这一次又会为我们呈现怎样的精彩..."}
{"title": "【已结束】2016 XPwn未来探索盛会图文直播（Live）", "url": "https://www.freebuf.com/fevents/113362.html", "time": "2016-08-31", "level": "红色标题", "num_look": 473800, "num_comment": 473800, "author": "ArthurKiller", "tags": ["活动"], "text": "FreeBuf小编前线为您带来XPwn最新安全资讯，FB将会全程在线直播此次大会！"}
{"title": "扒一扒浏览器的安全机制", "url": "https://www.freebuf.com/articles/network/112956.html", "time": "2016-08-31", "level": "现金奖励", "num_look": 466386, "num_comment": 8, "author": "ArkTeam", "tags": ["网络安全"], "text": "随着互联网深入人们的生活，浏览器的发展更加丰富多彩，与此同时，浏览器的安全问题也备受关注。本篇文章就来扒一扒主流浏览器实现了什么样的安全机制。"}
{"title": "Android APP安全评估工具Drozer PC端重要代码解析", "url": "https://www.freebuf.com/articles/terminal/112732.html", "time": "2016-08-31", "level": "金币+6", "num_look": 245610, "num_comment": 1, "author": "wangshu", "tags": ["终端安全"], "text": "这一期探讨一下drozer PC端代码解析，主要是为了写自己的工具而去研究其代码，还是抛砖引玉。"}
{"title": "宜人贷安全部门招聘", "url": "https://www.freebuf.com/jobs/113288.html", "time": "2016-08-30", "level": "", "num_look": 294727, "num_comment": 32, "author": "宜人", "tags": ["安全招聘"], "text": "具有竞争力的薪资、六险一金、弹性工作制、双休、节假日补贴、餐费补贴、零食水果供应、交通便利、帅哥美女环绕......"}
{"title": "Dark Mobile Bank之移动银行应用仿冒攻击威胁分析报告", "url": "https://www.freebuf.com/articles/terminal/112942.html", "time": "2016-08-30", "level": "", "num_look": 235059, "num_comment": 2, "author": "AVLTeam", "tags": ["安全报告", "终端安全"], "text": "安天AVL移动安全团队以银行用户为对象，针对仿冒钓鱼类攻击进行详尽的威胁分析并提出可采取的防范策略。"}
{"title": "1/4企业第三方应用存在安全隐患", "url": "https://www.freebuf.com/articles/security-management/111856.html", "time": "2016-08-30", "level": "", "num_look": 341516, "num_comment": 11, "author": "Sphinx", "tags": ["安全管理"], "text": "根据CloudLock的报告，平均每家企业会使用733个第三方应用，而这些应用中，27%都是高危应用。"}
{"title": "Opera浏览器同步服务被黑，用户数据和存储密码泄露", "url": "https://www.freebuf.com/news/113149.html", "time": "2016-08-30", "level": "金币+6", "num_look": 230700, "num_comment": 6, "author": "獬豸凌", "tags": ["资讯"], "text": "8月26日晚，知名浏览器厂商Opera发布公告，表示其云同步服务遭遇黑客攻击，开启了浏览器同步功能的用户将受影响。"}
{"title": "VirusTotal平台将新增CrowdStrike和Invincea两款扫描引擎", "url": "https://www.freebuf.com/news/113219.html", "time": "2016-08-30", "level": "", "num_look": 243581, "num_comment": 3, "author": "Alpha_h4ck", "tags": ["资讯"], "text": "谷歌公司在上周正式宣布，VirusTotal恶意软件扫描平台将会新增两款扫描引擎，即CrowdStrike和Invincea。"}
{"title": "泰国ATM机攻击事件罪魁祸首：恶意软件“RIPPER”分析", "url": "https://www.freebuf.com/news/113217.html", "time": "2016-08-30", "level": "", "num_look": 254986, "num_comment": 1, "author": "Alpha_h4ck", "tags": ["头条", "安全报告"], "text": "上周泰国银行ATM机被攻击，1200万泰铢被盗，FireEye对导致ATM机遭遇攻击的恶意软件进行了分析。"}
{"title": "Pegasus间谍套件内部原理及流程剖析", "url": "https://www.freebuf.com/articles/system/113113.html", "time": "2016-08-30", "level": "金币+6", "num_look": 424021, "num_comment": 4, "author": "Roy_Chen", "tags": ["特别企划", "系统安全"], "text": "三叉戟间谍套件技术分析，窥探高精度定向间谍软件的内部原理。"}
{"title": "LOKI：一款APT威胁指标扫描软件", "url": "https://www.freebuf.com/sectool/113050.html", "time": "2016-08-30", "level": "红色标题", "num_look": 517191, "num_comment": 14, "author": "clouds", "tags": ["工具"], "text": "LOKI是一款APT入侵痕迹扫描软件，以入侵威胁指标(IOC)和黑客工具特征为对象，发现入侵事件和痕迹。"}
{"title": "代码战争：伪装和狙杀，从“壳”到“病毒混淆器”", "url": "https://www.freebuf.com/articles/system/112631.html", "time": "2016-08-30", "level": "", "num_look": 395380, "num_comment": 13, "author": "火绒安全", "tags": ["系统安全"], "text": "在病毒与安全软件的代码对抗过程中，“壳”一直扮演着极为重要的角色。"}
{"title": "KCon黑客大会第二日议题荟萃", "url": "https://www.freebuf.com/fevents/113151.html", "time": "2016-08-29", "level": "", "num_look": 257803, "num_comment": 9, "author": "ArthurKiller", "tags": ["活动", "特别企划"], "text": "早上九点，KCon第二日拉开序幕。"}
{"title": "爆料全球首个基于Twitter的Android僵尸网络", "url": "https://www.freebuf.com/news/112960.html", "time": "2016-08-29", "level": "", "num_look": 472585, "num_comment": 14, "author": "Alpha_h4ck", "tags": ["终端安全", "资讯"], "text": "黑客正通过使用Twitter社交网络来控制一些Twitter用户的Android智能手机。"}
{"title": "iOS“远程越狱”间谍软件Pegasus技术分析", "url": "https://www.freebuf.com/articles/terminal/113128.html", "time": "2016-08-29", "level": "", "num_look": 461966, "num_comment": 4, "author": "vulture", "tags": ["终端安全"], "text": "iOS上周爆出三个0day漏洞，攻击者可以利用这三个漏洞远程越狱，并安装间谍软件。Lookout公司把这款软件命名为Pegasus，并对其技术细节进行了分析。"}
{"title": "Cisco SNMP RCE漏洞复现过程", "url": "https://www.freebuf.com/vuls/112589.html", "time": "2016-08-29", "level": "现金奖励", "num_look": 1139205, "num_comment": 36, "author": "tahf", "tags": ["漏洞"], "text": "作为一名技术小白，想分享下分析\\eqgrp-free-file\\Firewall\\EXPLOITS\\EXBA的思路、搭建漏洞环境的过程和利用条件测试。本文具有极强的可操作性，请勿用于非法途径。"}
{"title": "Web安全测试中常见逻辑漏洞解析（实战篇）", "url": "https://www.freebuf.com/vuls/112339.html", "time": "2016-08-29", "level": "红色标题", "num_look": 2992045, "num_comment": 26, "author": "漏洞盒子", "tags": ["漏洞", "特别企划"], "text": "今天漏洞盒子安全研究团队就与大家分享Web安全测试中逻辑漏洞的挖掘经验。"}
{"title": "围观方程式组织“杀器”ExtraBacon，思科新版ASA防火墙也遭殃", "url": "https://www.freebuf.com/news/112946.html", "time": "2016-08-28", "level": "红色标题", "num_look": 550939, "num_comment": 5, "author": "欧阳洋葱", "tags": ["资讯"], "text": "ShadowBrokers公布的一款漏洞利用工具ExtraBacon能完全攻占思科ASA防火墙，最近又有修改版出现，新版ASA软件也不能幸免。"}
{"title": "初步分析勒索软件ZEPTO", "url": "https://www.freebuf.com/articles/system/112328.html", "time": "2016-08-28", "level": "现金奖励", "num_look": 386029, "num_comment": 13, "author": "langyajiekou", "tags": ["系统安全"], "text": "前段时间突然收到一个客户的电话，报告说她的电脑出了问题，所有文件都无法打开了，据她们自己的IT人员发现所有文件都多了一个.zepto的扩展名。"}
{"title": "开源BTS产品中存在多处漏洞，攻击者或可劫持手机通讯基站", "url": "https://www.freebuf.com/vuls/112914.html", "time": "2016-08-28", "level": "金币+11", "num_look": 524011, "num_comment": 6, "author": "Alpha_h4ck", "tags": ["无线安全", "漏洞"], "text": "在这篇文章中，我将会给大家介绍一下我在这款开源产品中所发现的多个漏洞，这些漏洞将允许攻击者入侵基站收发信台（BTS），并远程控制它的信号收发模块。"}
{"title": "oclhashcat：离线hash密码破解工具官方文档（中文版）", "url": "https://www.freebuf.com/sectool/112479.html", "time": "2016-08-28", "level": "金币+11", "num_look": 975409, "num_comment": 11, "author": "Beta_Mao", "tags": ["工具"], "text": "oclhashcat是个离线hash密码破解工具，与hashcat不同，它支持GPU破解，速度更快，且支持更多hash算法！"}
{"title": "KCon大会首日速描：黑客们团结起来", "url": "https://www.freebuf.com/fevents/113054.html", "time": "2016-08-27", "level": "红色标题", "num_look": 428027, "num_comment": 23, "author": "ArthurKiller", "tags": ["活动"], "text": "KCon黑客大会可算是国内最具干货的黑客大会之一了，因此俘获安全技术人员的芳心也许并不是一件困难的事情。"}
{"title": "周末啦，来看看萌妹子「网络安全不烦恼」", "url": "https://www.freebuf.com/video/113012.html", "time": "2016-08-27", "level": "", "num_look": 350628, "num_comment": 29, "author": "bilibili", "tags": ["视频"], "text": "这次的作品是和一个公益项目合作完成的，倡导网络安全，提倡大家保护好自己的账号密码。"}
{"title": "【FB TV】一周「BUF大事件」（20160820-20160826）", "url": "https://www.freebuf.com/news/113027.html", "time": "2016-08-27", "level": "", "num_look": 207747, "num_comment": 3, "author": "supercoco", "tags": ["资讯"], "text": "微信新漏洞，小心手机微信被远程哦；NSA被黑事件热度持续；TOR部分社区员工呼吁罢工...这周都有哪些安全资讯呢？"}
{"title": "【直播中】KCON 2016 黑客大会图文直播（Live）", "url": "https://www.freebuf.com/fevents/113003.html", "time": "2016-08-27", "level": "红色标题", "num_look": 581766, "num_comment": 1, "author": "FB独家", "tags": ["活动", "特别企划"], "text": "网络空间里的黑客对抗早已白热化，「探索一切、攻破一切」——FreeBuf从北京带来精彩直播！"}
{"title": "中东网络暗战：针对叙利亚反对派的网络攻击Group5", "url": "https://www.freebuf.com/articles/network/112734.html", "time": "2016-08-27", "level": "", "num_look": 320117, "num_comment": 1, "author": "clouds", "tags": ["安全报告", "网络安全"], "text": "本报告描述了以叙利亚反对派为目标，精心策划的恶意软件攻击。"}
{"title": "滴滴出行诚招安全运营人才", "url": "https://www.freebuf.com/jobs/112777.html", "time": "2016-08-26", "level": "", "num_look": 291167, "num_comment": 9, "author": "大米米", "tags": ["安全招聘"], "text": "福利多多，每日零食水果吃不完；弹性工作，不用为早起发愁；环境优美，帅哥美女一大摞。"}
{"title": "4封邮件神秘失踪，谁在利用磁盘加密软件VeraCrypt监视研究人员？", "url": "https://www.freebuf.com/news/112547.html", "time": "2016-08-26", "level": "", "num_look": 276691, "num_comment": 5, "author": "米雪儿", "tags": ["资讯"], "text": "8月13日，OSTIF在其博客中证实，怀疑存在第三方截取了OSTIF，VeraCrypt 团队以及QuarksLab之间的邮件。"}
{"title": "【快讯】iOS曝严重安全漏洞：iPhone用户或已被监听数年", "url": "https://www.freebuf.com/news/112967.html", "time": "2016-08-26", "level": "红色标题", "num_look": 1026312, "num_comment": 29, "author": "欧阳洋葱", "tags": ["漏洞", "资讯"], "text": "今天你升级iOS 9.3.5了吗？赶快升级吧，你可能已经被监听数年。"}
{"title": "DIY天线自动追踪系统OpenATS", "url": "https://www.freebuf.com/articles/wireless/112380.html", "time": "2016-08-26", "level": "现金奖励", "num_look": 1498078, "num_comment": 56, "author": "OpenATS", "tags": ["无线安全", "极客"], "text": "玩无线电的可能都知道，在跟卫星进行通信的时候，由于很多卫星是非静止的，这时候就需要一个自动追踪天线。市面上有的商业成品的追踪天线价格较高，所以我打算自制一个。"}
{"title": "Mimikatz小实验：黄金票据+dcsync", "url": "https://www.freebuf.com/sectool/112594.html", "time": "2016-08-26", "level": "", "num_look": 658011, "num_comment": 5, "author": "dawner", "tags": ["工具", "系统安全"], "text": "这篇博文是为了解释下Benjamin Delpy（@gentilkiwi）在这条推特上写的东西，看官们且耐住性子。"}
{"title": "法国潜艇制造商DCNS大量文件遭泄露（附泄露样例文档下载）", "url": "https://www.freebuf.com/news/112909.html", "time": "2016-08-25", "level": "", "num_look": 300430, "num_comment": 12, "author": "clouds", "tags": ["资讯"], "text": "法国防务承包商海军造船局集团可能被经济间谍入侵，包含22400页“鲉鱼级”潜艇相关的大量机密文件遭到泄露。"}
{"title": "谷歌为Mac OS打造开源恶意检测系统", "url": "https://www.freebuf.com/sectool/112585.html", "time": "2016-08-25", "level": "", "num_look": 321925, "num_comment": 8, "author": "dawner", "tags": ["工具"], "text": "谷歌最近正致力于打造一款针对MacOS的恶意检测系统，目前它已经在Github上开源。"}
{"title": "泰国ATM机被入侵导致1200万泰铢被盗", "url": "https://www.freebuf.com/news/112861.html", "time": "2016-08-25", "level": "", "num_look": 277360, "num_comment": 10, "author": "ArthurKiller", "tags": ["资讯"], "text": "在本周三，泰国警方表示他们发现泰国大约一千台ATM机被入侵，并且1200万泰铢已经被盗。"}
{"title": "少了FB商城的月饼，再圆的月亮也有残缺…", "url": "https://www.freebuf.com/fevents/112878.html", "time": "2016-08-25", "level": "", "num_look": 242004, "num_comment": 13, "author": "FB客服", "tags": ["活动"], "text": "中秋之时，没有什么事情是一块月饼解决不了的。如果有，那么就两块。如果还不行，那么就买一盒。"}
{"title": "必虎路由器大量高危漏洞分析", "url": "https://www.freebuf.com/news/112626.html", "time": "2016-08-25", "level": "红色标题", "num_look": 883337, "num_comment": 15, "author": "ArthurKiller", "tags": ["终端安全", "资讯"], "text": "虎之力路由器！你，值得拥有！"}
{"title": "Masscan：最快的互联网IP端口扫描器", "url": "https://www.freebuf.com/sectool/112583.html", "time": "2016-08-25", "level": "金币+15", "num_look": 2412500, "num_comment": 25, "author": "monster93", "tags": ["工具"], "text": "Masscan号称是最快的互联网端口扫描器，最快可以在六分钟内扫遍互联网。"}
{"title": "攻击者利用虚拟机“掩盖”恶意行为", "url": "https://www.freebuf.com/news/112643.html", "time": "2016-08-25", "level": "", "num_look": 271130, "num_comment": 6, "author": "bimeover", "tags": ["资讯"], "text": "SecureWorks公司公布了一种入侵方式——攻击者在目标电脑上尝试安装并运行虚拟机，达到掩盖恶意操作的目的。"}
{"title": "游戏厂商Epic Games官方论坛被黑，80万用户信息遭泄露", "url": "https://www.freebuf.com/news/112827.html", "time": "2016-08-25", "level": "", "num_look": 217791, "num_comment": 5, "author": "Sphinx", "tags": ["资讯"], "text": "以游戏引擎Unreal Engine和《战争机器》系列游戏闻名的Epic Games公司论坛遭到不明黑客的攻击，攻击者窃取了超过80万的论坛账号信息。"}
{"title": "漏洞盒子7月风云榜", "url": "https://www.freebuf.com/news/112652.html", "time": "2016-08-24", "level": "", "num_look": 242240, "num_comment": 11, "author": "FB客服", "tags": ["资讯"], "text": "本次上榜白帽子将获得游戏标配：蓝牙游戏手柄!!!"}
{"title": "细数iOS上的那些安全防护", "url": "https://www.freebuf.com/articles/terminal/112811.html", "time": "2016-08-24", "level": "", "num_look": 770537, "num_comment": 35, "author": "阿里移动安全", "tags": ["终端安全"], "text": "为了让大家能够更加系统性地了解iOS上的安全机制，本文从代码签名,  沙盒机制  和利用缓解三方面，对iOS的系统安全机制进行总结。"}
{"title": "中国信通院发布移动互联网金融APP信息安全现状白皮书", "url": "https://www.freebuf.com/news/112423.html", "time": "2016-08-24", "level": "", "num_look": 304109, "num_comment": 5, "author": "Sphinx", "tags": ["资讯"], "text": "8月19日发布的《移动互联网金融APP信息安全现状白皮书》显示，目前国内移动互联网金融APP存在大量信息安全问题。"}
{"title": "Cowrie蜜罐部署教程", "url": "https://www.freebuf.com/articles/network/112065.html", "time": "2016-08-24", "level": "金币+25", "num_look": 1144487, "num_comment": 36, "author": "ripz", "tags": ["网络安全"], "text": "cowrie是一个具有中等交互的SSH蜜罐，安装在Linux中，它可以获取攻击者用于暴力破解的字典、输入的命令以及上传或下载的恶意文件。"}
{"title": "真相依旧扑朔迷离：5大问题回顾NSA被黑事件", "url": "https://www.freebuf.com/news/112663.html", "time": "2016-08-24", "level": "", "num_look": 603668, "num_comment": 7, "author": "欧阳洋葱", "tags": ["资讯"], "text": "如果你错过本次事件的诸多细节也没关系，这篇文章将为各位梳理NSA被黑事件的来龙去脉，5个问答就说清楚。"}
{"title": "GSM Hacking Part ② ：使用SDR捕获GSM网络数据并解密", "url": "https://www.freebuf.com/articles/wireless/111577.html", "time": "2016-08-24", "level": "", "num_look": 866700, "num_comment": 21, "author": "漏洞盒子", "tags": ["无线安全", "特别企划"], "text": "在文章第一部分 GSM Hacking Part ① ：使用SDR扫描嗅探GSM网络搭建了嗅探GSM流量的环境，在第二部中，我们来讨论如何捕获发短信以及通话过程中的流量，从捕获到的数据中解密提取出短信文字以及通话语音。"}
{"title": "关于微信“BadKernel”漏洞情况的通报", "url": "https://www.freebuf.com/vuls/112634.html", "time": "2016-08-23", "level": "", "num_look": 677458, "num_comment": 13, "author": "CNNVD", "tags": ["漏洞"], "text": "近日，国家信息安全漏洞库收到360安全卫士阿尔法团队关于Chrome V8引擎“BadKernel”漏洞的情况报送。"}
{"title": "微信曝远程任意代码执行漏洞，可被远程控制", "url": "https://www.freebuf.com/news/112613.html", "time": "2016-08-23", "level": "红色标题", "num_look": 1018944, "num_comment": 21, "author": "360手机卫士", "tags": ["漏洞", "资讯"], "text": "近日，360手机卫士阿尔法团队（AlphaTeam）独家发现微信远程任意代码执行漏洞，将其命名为badkernel。"}
{"title": "PGP没你想象的那么安全", "url": "https://www.freebuf.com/news/112502.html", "time": "2016-08-23", "level": "", "num_look": 312238, "num_comment": 4, "author": "dawner", "tags": ["资讯"], "text": "PGP在实际使用中，可能没有理论上那么安全。"}
{"title": "用“洪荒之力”也难保安全的EMV芯片卡", "url": "https://www.freebuf.com/articles/wireless/112593.html", "time": "2016-08-23", "level": "现金奖励", "num_look": 531218, "num_comment": 8, "author": "白泽安全团队", "tags": ["无线安全"], "text": "EMV芯片卡的出现是为了解决一直困扰银行业多年的磁条卡盗刷问题。"}
{"title": "自动化渗透测试工具包APT2", "url": "https://www.freebuf.com/sectool/112300.html", "time": "2016-08-23", "level": "", "num_look": 567485, "num_comment": 9, "author": "felix", "tags": ["工具"], "text": "APT2能执行NMap扫描，或者导入Nexpose、Nessus、Nmap的扫描结果。"}
{"title": "威胁分析：Turla APT所用的多个IP隶属多家卫星服务运营商", "url": "https://www.freebuf.com/articles/network/112483.html", "time": "2016-08-23", "level": "", "num_look": 357372, "num_comment": 2, "author": "clouds", "tags": ["安全报告", "特别企划"], "text": "Turla APT的多个攻击IP隶属于多家卫星服务运营商，并且攻击者还通过这些IP注册了大量新的C&C域名。"}
{"title": "250万美元/年！来看看目前最大的恶意软件即服务(RaaS)利润环", "url": "https://www.freebuf.com/news/112278.html", "time": "2016-08-23", "level": "金币+25", "num_look": 187355, "num_comment": 5, "author": "米雪儿", "tags": ["资讯"], "text": "研究人员声称已经发现了目前最大的勒索软件即服务（RaaS）利润环。臭名昭著的Cerber勒索软件通过RAAS模式攻击目标计算机用户，每年可获利约250万美元。"}
{"title": "追踪溯源：希拉里邮箱泄露事件", "url": "https://www.freebuf.com/articles/others-articles/111720.html", "time": "2016-08-22", "level": "", "num_look": 410089, "num_comment": 7, "author": "苏哲", "tags": ["其他", "特别企划"], "text": "从追踪溯源的角度来看，这次跟踪证据链比较弱，挖的东西形不成链路，至少无法说服我。"}
{"title": "东巽科技2046Lab团队APT报告：“丰收行动”（DX-APT1）", "url": "https://www.freebuf.com/articles/paper/111557.html", "time": "2016-08-22", "level": "现金奖励", "num_look": 422398, "num_comment": 8, "author": "某人", "tags": ["安全报告"], "text": "本次“丰收行动”，再一次证明了APT攻击的存在和长期活跃，目标以巴基斯坦、中国等国家的科研院所、军事院校和外交官员为主。"}
{"title": "知名渗透测试厂商团队的报告模板（含下载）", "url": "https://www.freebuf.com/sectool/112346.html", "time": "2016-08-22", "level": "", "num_look": 622309, "num_comment": 15, "author": "clouds", "tags": ["工具", "观点"], "text": "作为参考，这里收集了一些知名渗透测试厂商团队的报告模板。"}
{"title": "DNS Tunneling及相关实现", "url": "https://www.freebuf.com/sectool/112076.html", "time": "2016-08-22", "level": "现金奖励", "num_look": 1110651, "num_comment": 19, "author": "novsec", "tags": ["工具", "网络安全"], "text": "DNS Tunneling，是隐蔽信道的一种，通过将其他协议封装在DNS协议中传输建立通信。"}
{"title": "NSA（美国国安局）泄漏文件深度分析（PART 1）", "url": "https://www.freebuf.com/news/topnews/112447.html", "time": "2016-08-21", "level": "现金奖励", "num_look": 1163866, "num_comment": 31, "author": "tom_vodu", "tags": ["头条", "特别企划"], "text": "NSA泄露门涉及到的防火墙品牌在中国占比超过了60%，在世界范围内更甚。夸张的说就是全中国60%的公司及部门内网可以被工具拥有者直接访问。"}
{"title": "DDoSCoin详情：加密货币奖励用户参与 DDoS 攻击", "url": "https://www.freebuf.com/articles/neopoints/112178.html", "time": "2016-08-21", "level": "金币+25", "num_look": 220098, "num_comment": 3, "author": "米雪儿", "tags": ["观点"], "text": "通过DDOS获取电子货币，最邪恶的电子货币！没有之一！"}
{"title": "微软开源PowerShell并支持Linux和OS X", "url": "https://www.freebuf.com/news/112435.html", "time": "2016-08-20", "level": "", "num_look": 258181, "num_comment": 6, "author": "bimeover", "tags": ["资讯"], "text": "8月19日，微软宣布开源PowerShell，支持Linux和OS X，并在GitHub上传了PowerShell脚本语言和命令行外壳。"}
{"title": "海南腾远科技招聘安全人才", "url": "https://www.freebuf.com/jobs/111776.html", "time": "2016-08-20", "level": "", "num_look": 380672, "num_comment": 42, "author": "tyetech", "tags": ["安全招聘"], "text": "因公司业务快速发展，现诚邀各类安全人才加盟腾远科技安全团队"}
{"title": "逆向分析及识别恶意代码中的AES算法", "url": "https://www.freebuf.com/articles/database/111756.html", "time": "2016-08-20", "level": "现金奖励", "num_look": 621277, "num_comment": 4, "author": "zzz66686", "tags": ["数据安全"], "text": "AES算法，即高级加密标准，在密码学中又称为Rijndael加密算法。本文简单介绍了几款勒索软件的AES算法识别。"}
{"title": "快速读懂无线安全", "url": "https://www.freebuf.com/articles/wireless/112221.html", "time": "2016-08-20", "level": "现金奖励", "num_look": 1015329, "num_comment": 37, "author": "icecolor不疯不魔不成活", "tags": ["无线安全"], "text": "这是一篇入门级别的个人无线渗透指南，讲解WiFi破解的基本方法。"}
{"title": "【FB TV】一周「BUF大事件」（20160813-20160819）", "url": "https://www.freebuf.com/video/112382.html", "time": "2016-08-20", "level": "红色标题", "num_look": 322123, "num_comment": 14, "author": "supercoco", "tags": ["视频"], "text": "美国国家安全局NSA居然遭到黑客组织入侵，这个黑客组织到底做了什么？"}
{"title": "揭秘Chimera勒索软件", "url": "https://www.freebuf.com/articles/system/112142.html", "time": "2016-08-20", "level": "金币+8", "num_look": 285016, "num_comment": 2, "author": "Alpha_h4ck", "tags": ["系统安全"], "text": "在这篇文章中，我们将会披露更多相关的技术细节，我们将会给大家介绍如何利用这些泄漏出来的密钥来解密文件。"}
{"title": "CVE-2016-5696漏洞分析：TCP侧信道安全", "url": "https://www.freebuf.com/vuls/111943.html", "time": "2016-08-19", "level": "金币+8", "num_look": 653840, "num_comment": 18, "author": "Leon不会玩QEMU", "tags": ["漏洞"], "text": "在这篇文章中，我们要讨论一个最新的TCP侧信道的漏洞（CVE-2016-5696）。"}
{"title": "ngrok一款内网穿透+记录HTTP请求的神器(支持HTTPS)", "url": "https://www.freebuf.com/sectool/111956.html", "time": "2016-08-19", "level": "金币+8", "num_look": 1662121, "num_comment": 25, "author": "2429946577", "tags": ["工具"], "text": "双方都是内网的反弹shell工具。"}
{"title": "首汽约车招聘安全工程师", "url": "https://www.freebuf.com/jobs/111947.html", "time": "2016-08-19", "level": "", "num_look": 228078, "num_comment": 9, "author": "首汽约车", "tags": ["安全招聘"], "text": "“首汽约车”是首约科技（天津）有限公司携手首汽集团联合打造的约租车平台，自上线以来， 正在努力打造定制化专车服务业的第一品牌。"}
{"title": "火狐、Chrome皆中招：针对主流浏览器的网址欺诈漏洞", "url": "https://www.freebuf.com/vuls/112259.html", "time": "2016-08-19", "level": "", "num_look": 500180, "num_comment": 8, "author": "Sphinx", "tags": ["漏洞", "网络安全"], "text": "研究员Rafay Baloch发现了Chrome和Firefox中存在的网址欺诈漏洞，漏洞的原因是对某些Unicode字符处理不当。"}
{"title": "Equation Group泄露文件分析", "url": "https://www.freebuf.com/special/112272.html", "time": "2016-08-19", "level": "现金奖励", "num_look": 800005, "num_comment": 14, "author": "白泽安全团队", "tags": ["特别企划"], "text": "从目前已知的情况来看，如果此次公布的资料都是真的（可信度极高），这又将是一次严重的安全事件，媲美甚至将超过去年发生的Hacking Team事件的影响。"}
{"title": "基于Pari数学软件浅谈RSA算法相关密码题型（基础篇）", "url": "https://www.freebuf.com/articles/database/112019.html", "time": "2016-08-19", "level": "现金奖励", "num_look": 459354, "num_comment": 8, "author": "陡壁", "tags": ["数据安全"], "text": "本人将通过自己粗浅的理解用三到四个篇章为大家理一理与RSA密码算法相关的几类CTF题型。"}
{"title": "解码针对工业工程领域的网络攻击 Operation Ghoul（食尸鬼行动）", "url": "https://www.freebuf.com/articles/network/112249.html", "time": "2016-08-19", "level": "金币+8", "num_look": 339932, "num_comment": 3, "author": "clouds", "tags": ["特别企划", "网络安全"], "text": "Operation Ghoul针对30多个国家的工业、制造业和工程管理机构发起了定向渗透入侵。"}
{"title": "14亿Android设备受Linux TCP漏洞的影响", "url": "https://www.freebuf.com/news/112245.html", "time": "2016-08-18", "level": "", "num_look": 284056, "num_comment": 9, "author": "bimeover", "tags": ["资讯"], "text": "Linux TCP连接漏洞存在于世界上80%的安卓设备，约14亿台安卓智能手机、平板电脑受此漏洞影响。"}
{"title": "途牛招聘安全风控专家", "url": "https://www.freebuf.com/jobs/111980.html", "time": "2016-08-18", "level": "", "num_look": 288998, "num_comment": 18, "author": "盾牛", "tags": ["安全招聘"], "text": "途牛旅游网于2006年10月创立于南京，以“让旅游更简单”为使命，为消费者提供由北京、上海、广州、深圳、南京等64个城市出发的旅游产品预订服务"}
{"title": "走近科学：“索伦之眼”深入追踪", "url": "https://www.freebuf.com/articles/network/112038.html", "time": "2016-08-18", "level": "", "num_look": 636283, "num_comment": 25, "author": "墨侠", "tags": ["特别企划", "网络安全"], "text": "2016年8月8日，卡巴斯基和赛门铁克相继披露出一个长期对中国、俄罗斯等国进行APT攻击的组织——ProjectSauron（也被称作索伦之眼）"}
{"title": "Exploits Database数据大揭秘：全球黑客都在关注什么？", "url": "https://www.freebuf.com/articles/neopoints/111861.html", "time": "2016-08-18", "level": "现金奖励", "num_look": 451886, "num_comment": 25, "author": "追影人", "tags": ["特别企划", "观点"], "text": "Exploit-db号称“全球漏洞库”，网站收集了来自全球白帽子提交的各类漏洞信息。本文从数据的角度带大家通过这个全球漏洞库看看黑客们都在关注些什么？"}
{"title": "解密Myspace密码的姿势", "url": "https://www.freebuf.com/articles/database/111884.html", "time": "2016-08-18", "level": "现金奖励", "num_look": 558796, "num_comment": 21, "author": "tigerlab", "tags": ["数据安全", "特别企划"], "text": "LeakedSource（被入侵数据的有偿搜索引擎）直接宣称他们将破解98%到99%的密码。我们泰格实验室的小伙伴也想试验一下破解这些密码的难度！"}
{"title": "何必对安全行业如此悲观？看ISC 2016的那些干货议题", "url": "https://www.freebuf.com/fevents/112212.html", "time": "2016-08-18", "level": "红色标题", "num_look": 473552, "num_comment": 5, "author": "欧阳洋葱", "tags": ["活动", "特别企划"], "text": "ISC 2016第二日全记录：在昨天McAfee提出人类或将走向陨灭之后，ISC今天又交了一份答卷。"}
{"title": "APP漏洞自动化扫描专业评测报告（中篇）", "url": "https://www.freebuf.com/articles/terminal/111819.html", "time": "2016-08-18", "level": "现金奖励", "num_look": 463068, "num_comment": 13, "author": "Sunnieli", "tags": ["安全报告", "终端安全"], "text": "上篇文章中我们对各大APP漏洞自动化扫描平台进行了评测，本篇将以各个厂商的扫描能力作为分析维度展开。"}
{"title": "如何使用SDR+inspectrum逆向分析无线遥控信号", "url": "https://www.freebuf.com/articles/wireless/111801.html", "time": "2016-08-18", "level": "", "num_look": 858543, "num_comment": 14, "author": "漏洞盒子", "tags": ["无线安全", "极客"], "text": "本文将分享使用SDR+inspectrum逆向分析无线遥控信号的一些姿势。"}
{"title": "weblogic安全配置二三事", "url": "https://www.freebuf.com/articles/network/111405.html", "time": "2016-08-18", "level": "金币+10", "num_look": 678746, "num_comment": 10, "author": "shewey", "tags": ["安全管理", "网络安全"], "text": "本文就总结一下weblogic安全配置过程中遇到的一些坑，并给出正确的姿势。"}
{"title": "漏洞预警：zabbix再爆高危SQL注入漏洞，可获操作系统权限", "url": "https://www.freebuf.com/vuls/112197.html", "time": "2016-08-17", "level": "红色标题", "num_look": 1547157, "num_comment": 46, "author": "漏洞盒子", "tags": ["漏洞"], "text": "zabbix是一个开源的企业级性能监控解决方案，目前发现zabbix存在前台SQL注入漏洞。"}
{"title": "Android安全测试工具Drozer之手机端agent源码解析", "url": "https://www.freebuf.com/articles/terminal/111863.html", "time": "2016-08-17", "level": "金币+10", "num_look": 307485, "num_comment": 4, "author": "wangshu", "tags": ["终端安全"], "text": "本文主要解析移动端agent代码，为各位同学后续写自己的安全工具起到抛砖引玉的个作用。"}
{"title": "组合漏洞或可远程重置全系列三星手机", "url": "https://www.freebuf.com/news/112036.html", "time": "2016-08-17", "level": "", "num_look": 431068, "num_comment": 16, "author": "banish", "tags": ["漏洞", "资讯"], "text": "多个漏洞组合起来，或导致黑客可远程重置所有三星手机。"}
{"title": "26款优秀的Android逆向工程工具", "url": "https://www.freebuf.com/sectool/111532.html", "time": "2016-08-17", "level": "金币+10", "num_look": 1493403, "num_comment": 11, "author": "米雪儿", "tags": ["工具", "终端安全"], "text": "工欲善其事必先利其器，好的Android逆向工程工具在逆向破解工程中起到事半功倍的作用。"}
{"title": "【已结束】2016 ISC安全峰会视频&图文直播（Live）", "url": "https://www.freebuf.com/special/112024.html", "time": "2016-08-17", "level": "红色标题", "num_look": 567008, "num_comment": 567008, "author": "FB独家", "tags": ["特别企划"], "text": "FreeBuf小编前线为您带来ISC最新安全资讯，FB将会全程在线直播此次大会！"}
{"title": "安全摘记：互联网安全小兵的日常", "url": "https://www.freebuf.com/articles/network/111071.html", "time": "2016-08-17", "level": "现金奖励", "num_look": 653664, "num_comment": 49, "author": "starshine", "tags": ["网络安全", "观点"], "text": "生活不只有眼前的苟且，还有诗和甲方。于是，我来到了甲方，成为了一个互联网安全小兵。"}
{"title": "ISC 2016的“协同联动”畅想：是神话还是未来？", "url": "https://www.freebuf.com/news/topnews/112106.html", "time": "2016-08-17", "level": "红色标题", "num_look": 310485, "num_comment": 8, "author": "欧阳洋葱", "tags": ["头条", "活动"], "text": "本届ISC 2016大会提倡的核心理念是“协同联动，共建安全+命运共同体”，听起来有没有感觉很熟悉？"}
{"title": "Anonymous对世界反兴奋剂机构和国际体育仲裁法庭发起攻击", "url": "https://www.freebuf.com/news/111998.html", "time": "2016-08-16", "level": "金币+10", "num_look": 213313, "num_comment": 2, "author": "麻辣烫", "tags": ["资讯"], "text": "日前，一个声称归属于匿名者波兰分支的Twitter账号发布消息称攻击了世界反兴奋剂机构和体育仲裁法庭( WADA-CAS )的服务器"}
{"title": "国网全球能源互联网研究院招聘逆向分析工程师", "url": "https://www.freebuf.com/jobs/111693.html", "time": "2016-08-16", "level": "", "num_look": 317254, "num_comment": 17, "author": "hardstone", "tags": ["安全招聘"], "text": "全球能源互联网研究院前身为国网智能电网研究院，2016年2月经国家工商总局于核准，变更为“全球能源互联网研究院”，是国家电网公司直属科研单位。"}
{"title": "快报！快报！NSA被黑，或有可能成为第二个TheHackingTeam事件！", "url": "https://www.freebuf.com/news/112053.html", "time": "2016-08-16", "level": "金币+20", "num_look": 903715, "num_comment": 58, "author": "Mickeyyyyy", "tags": ["资讯"], "text": "根据国外媒体的最新爆料，美国国家安全局（NSA）貌似遭到了黑客的攻击。这个黑客团伙声称他们入侵了“Equation Group”（方程式组织），并将他们从该黑客组织的计算机系统中所获取到的大部分黑客工具全部泄漏在了互联…"}
{"title": "恶意程序报告在线查询工具", "url": "https://www.freebuf.com/sectool/111348.html", "time": "2016-08-16", "level": "现金奖励", "num_look": 415045, "num_comment": 22, "author": "鬼魅羊羔", "tags": ["工具"], "text": "这个工具呢，是用C#写的，主要通过MD5，自动去特定的网站搜索历史信息，并且把自己查过的内容，选择性的保存到本地，以便日后再查。"}
{"title": "揭秘ProjectSauron/Strider：顶级的网络间谍平台暗中窃取政府加密通讯数据", "url": "https://www.freebuf.com/articles/system/111616.html", "time": "2016-08-16", "level": "金币+20", "num_look": 293214, "num_comment": 4, "author": "米雪儿", "tags": ["系统安全"], "text": "过去几年间，媒体报道的“APT相关”事件普遍存在被夸大的成分。除了一些比较突出的“例外”，卡巴斯基的研究员最近就发现的一个较为“例外”的间谍平台：“ProjectSauron”。"}
{"title": "HEIST攻击解析：从HTTPS加密数据中获取明文", "url": "https://www.freebuf.com/articles/web/111927.html", "time": "2016-08-16", "level": "现金奖励", "num_look": 545125, "num_comment": 6, "author": "Sunnieli", "tags": ["WEB安全", "网络安全"], "text": "在Black Hat 2016大会上，两名比利时的安全研究人员展示了他们今年的研究成果。他们发现了一个WEB攻击方式可以绕过HTTPS加密得到明文信息。他们把这种攻击方式叫做HEIST攻击。"}
{"title": "专访铱迅信息CEO、T00ls论坛创始人杨谦：百载文枢江左，东南辈出英豪", "url": "https://www.freebuf.com/articles/people/111627.html", "time": "2016-08-16", "level": "", "num_look": 605689, "num_comment": 15, "author": "T00ls安全", "tags": ["人物志"], "text": "杨谦，十年前是T00ls创始人之一，十年后是铱迅信息CEO，典型的创业黑客代表。"}
{"title": "SOCKS代理：从科学上网到内网漫游", "url": "https://www.freebuf.com/news/topnews/111545.html", "time": "2016-08-16", "level": "现金奖励", "num_look": 1124664, "num_comment": 21, "author": "tahf", "tags": ["头条", "特别企划"], "text": "搜集并测试了一些Windows平台下的SOCKS代理工具，自己简单搭建的一套模拟环境来展示SOCKS代理在内网漫游时的使用姿势并推荐几款Windows平台下实用的SOCKS代理工具。"}
{"title": "大众曝漏洞：1亿大众汽车门锁可被远程打开", "url": "https://www.freebuf.com/news/111769.html", "time": "2016-08-15", "level": "金币+20", "num_look": 382845, "num_comment": 14, "author": "SkyMine", "tags": ["漏洞", "资讯"], "text": "根据最新的研究，利用大约1亿辆大众汽车共同存在的漏洞可以让小偷远程通过无线信号打开大众汽车的车门。"}
{"title": "微店（杭州）招聘安全工程师", "url": "https://www.freebuf.com/jobs/111591.html", "time": "2016-08-15", "level": "", "num_look": 205600, "num_comment": 9, "author": "muhuo", "tags": ["安全招聘"], "text": "微店 | 口袋购物公司，于2011年5月成立，是一家致力移动互联网购物领域的公司，于2014年完成了3.5亿美金的C轮融资。"}
{"title": "浅析金融大数据安全", "url": "https://www.freebuf.com/articles/database/109775.html", "time": "2016-08-15", "level": "现金奖励", "num_look": 493544, "num_comment": 5, "author": "mcvoodoo", "tags": ["数据安全", "观点"], "text": "随着大数据的发展，从银行到P2P再到保险、证券等，越来越多的金融企业开始建设自己的大数据平台。"}
{"title": "全自动挖洞？正确姿势看首届「CGC人机漏洞挖掘对战赛」", "url": "https://www.freebuf.com/articles/neopoints/111712.html", "time": "2016-08-15", "level": "", "num_look": 614096, "num_comment": 9, "author": "Sphinx", "tags": ["特别企划", "观点"], "text": "FreeBuf作为业内知名专业媒体，自觉有必要带着客观敬畏的态度，与大家聊聊这场Defcon人机漏洞挖掘对战赛。"}
{"title": "公民实验室：中国BAT巨头Web浏览器隐私和安全问题", "url": "https://www.freebuf.com/articles/others-articles/111835.html", "time": "2016-08-15", "level": "金币+20", "num_look": 312519, "num_comment": 16, "author": "米雪儿", "tags": ["其他", "安全报告"], "text": "加拿大多伦多大学公民实验室的研究人员总结了中国三大巨头的浏览器——阿里巴巴的 UC 浏览器、腾讯的 QQ 浏览器和百度的浏览器的隐私与安全问题。"}
{"title": "细说USB安全：这年头真的还有USB设备是安全的吗？", "url": "https://www.freebuf.com/articles/terminal/111905.html", "time": "2016-08-15", "level": "", "num_look": 444450, "num_comment": 13, "author": "欧阳洋葱", "tags": ["特别企划", "系统安全"], "text": "你以为现在的USB设备还有安全性可言吗？连鼠标都可能在神不知鬼不觉的情况下传播了恶意程序！"}
{"title": "社工库数据格式化之Kettle Spoon", "url": "https://www.freebuf.com/articles/database/111386.html", "time": "2016-08-15", "level": "", "num_look": 926100, "num_comment": 21, "author": "ArthurKiller", "tags": ["数据安全"], "text": "搭建个本地的社工库怎么那么复杂？"}
{"title": "MONSOON APT：印度针对中国和其它周边国家发起的APT攻击", "url": "https://www.freebuf.com/articles/network/111870.html", "time": "2016-08-14", "level": "金币+20", "num_look": 541823, "num_comment": 8, "author": "clouds", "tags": ["安全报告", "特别企划"], "text": "本报告对MONSOON APT进行了深入的研究调查，囊括了之前未被发现的恶意软件、受害者和攻击架构。"}
{"title": "RIG exploit kit：恶意活动分析报告", "url": "https://www.freebuf.com/articles/web/110835.html", "time": "2016-08-14", "level": "", "num_look": 430984, "num_comment": 1, "author": "dawner", "tags": ["WEB安全", "安全报告"], "text": "现在，我们来研究下RIG的exploit kit，看看它有什么特别的分发渠道和payload。"}
{"title": "DOTA2论坛被黑，近200万用户详细信息被窃取", "url": "https://www.freebuf.com/news/111762.html", "time": "2016-08-14", "level": "金币+7", "num_look": 201860, "num_comment": 7, "author": "麻辣烫", "tags": ["资讯"], "text": "今年7月10日一次攻击导致DOTA2官方开发者论坛被攻破，近200万用户的详细信息被窃取。"}
{"title": "一个文件，百种名称，百种行为：“百家”木马集团分析", "url": "https://www.freebuf.com/articles/system/111451.html", "time": "2016-08-14", "level": "", "num_look": 359600, "num_comment": 14, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "腾讯反病毒实验室拦截到一批伪装成客户通知单的木马，该木马会根据自身文件名的不同而进行多种不同的恶意行为。"}
{"title": "CrackMapExec：Windows活动目录（AD）渗透测试工具集", "url": "https://www.freebuf.com/sectool/111546.html", "time": "2016-08-14", "level": "", "num_look": 424904, "num_comment": 8, "author": "dawner", "tags": ["工具"], "text": "CrackMapExec是一款针对Windows活动目录（AD）进行渗透测试的精巧工具集。"}
{"title": "Kali Linux渗透基础知识整理（四）：维持访问", "url": "https://www.freebuf.com/sectool/109957.html", "time": "2016-08-13", "level": "金币+7", "num_look": 710749, "num_comment": 11, "author": "sysorem", "tags": ["工具", "特别企划"], "text": "在获得了目标系统的访问权之后，攻击者需要进一步维持这一访问权限。"}
{"title": "【FB TV】一周「BUF大事件」（20160806-201608012）", "url": "https://www.freebuf.com/news/111825.html", "time": "2016-08-13", "level": "红色标题", "num_look": 385384, "num_comment": 21, "author": "supercoco", "tags": ["视频", "资讯"], "text": "除一周概要外，本期「BUF大事件」还公布了上期谜题讲解。恭喜三位Buffer：半壶纱、 fr33man、嘎巴嘎巴；答对上期的谜题，赢得了金币奖励。"}
{"title": "说说最近的一个电商网站“钓鱼”案例", "url": "https://www.freebuf.com/articles/web/109729.html", "time": "2016-08-13", "level": "", "num_look": 425896, "num_comment": 3, "author": "dawner", "tags": ["WEB安全"], "text": "在今天介绍的案例中，攻击者直接在被黑的合法电商网站上，劫持了付款页面。"}
{"title": "IPS Community Suite PHP远程代码执行漏洞分析(CVE-2016-6174)", "url": "https://www.freebuf.com/vuls/111116.html", "time": "2016-08-12", "level": "", "num_look": 410425, "num_comment": 10, "author": "知道创宇", "tags": ["WEB安全", "漏洞"], "text": "IPS Community Suite 4.1.12.3版本及以下版本中存在PHP代码注入漏洞，该漏洞源于程序未能充分过滤content_class请求参数。"}
{"title": "Android安全开发之通用签名风险", "url": "https://www.freebuf.com/articles/terminal/111363.html", "time": "2016-08-12", "level": "", "num_look": 308556, "num_comment": 3, "author": "阿里聚安全", "tags": ["终端安全"], "text": "阿里聚安全漏洞扫描器有一项检测服务是检测APP的通用签名风险。"}
{"title": "Linux设备TCP连接曝高危漏洞：只要接入网络就可能被攻击", "url": "https://www.freebuf.com/news/111735.html", "time": "2016-08-12", "level": "", "num_look": 753741, "num_comment": 12, "author": "欧阳洋葱", "tags": ["漏洞", "资讯"], "text": "Linux服务器的TCP连接方案存在高危安全漏洞，攻击者可利用该漏洞来劫持未加密Web流量。"}
{"title": "浅谈互联网隐私安全", "url": "https://www.freebuf.com/articles/neopoints/111299.html", "time": "2016-08-12", "level": "现金奖励", "num_look": 551253, "num_comment": 9, "author": "追影人", "tags": ["观点"], "text": "如今，互联网已经与我们的生活密切融合，我们的一举一动都会在网络上留下蛛丝马迹，而这些数据的泄露往往会带来很多麻烦事。"}
{"title": "揭秘：俄罗斯APT漏洞利用工具包", "url": "https://www.freebuf.com/articles/network/111490.html", "time": "2016-08-12", "level": "金币+7", "num_look": 545959, "num_comment": 13, "author": "clouds", "tags": ["安全报告", "特别企划"], "text": "Recorded Future 通过对俄罗斯APT组织的关注，重点分析了33个被广泛用于信息窃取和渗透入侵的已知漏洞。"}
{"title": "【BlackHat 2016议题】如何通过盗取EMV卡的数据，让ATM机吐出5万美元", "url": "https://www.freebuf.com/news/111412.html", "time": "2016-08-12", "level": "", "num_look": 237853, "num_comment": 5, "author": "bimeover", "tags": ["资讯"], "text": "两名研究人员在2016美国黒帽大会上（Black Hat USA 2016 ）推出了一种新的信用卡中间人攻击"}
{"title": "高度可定制化的远程访问木马“Remvio”，仅售58美金", "url": "https://www.freebuf.com/news/111499.html", "time": "2016-08-11", "level": "", "num_look": 403919, "num_comment": 23, "author": "Mickeyyyyy", "tags": ["工具", "资讯"], "text": "最近一位名叫“z3r0”的恶意软件作者正在向外界出售一款远程访问木马，价格仅需58美金。"}
{"title": "近期曝光的针对银行SWIFT系统攻击事件综合分析", "url": "https://www.freebuf.com/articles/paper/111488.html", "time": "2016-08-11", "level": "", "num_look": 506997, "num_comment": 5, "author": "360安全", "tags": ["安全报告"], "text": "2016年2月孟加拉国央行被黑客攻击导致8100万美元被窃取的事件被曝光后，如越南先锋银行、厄瓜多尔银行等，针对银行SWIFT系统的其他网络攻击事件逐一被公开。"}
{"title": "微信私钥泄露的危害：一个微信公众号漏洞案例分析", "url": "https://www.freebuf.com/vuls/111439.html", "time": "2016-08-11", "level": "", "num_look": 1089219, "num_comment": 30, "author": "岚岚自语", "tags": ["WEB安全", "漏洞"], "text": "这篇文章主要告诫各位微信公众号开发人员关于WECHAT_APPID和WECHAT_APPSECRET的重要性。"}
{"title": "国际事件解析：用DNS欺骗获得一个 .int 域名的控制权", "url": "https://www.freebuf.com/articles/network/111143.html", "time": "2016-08-11", "level": "金币+7", "num_look": 501940, "num_comment": 5, "author": "Avenger", "tags": ["特别企划", "网络安全"], "text": "对于一个攻击者而言，只需要进行少量的研究和扫描就能获得你受限顶级域名的子域名或者域名的控制，这并不困难 。"}
{"title": "白帽笔记：我的“一日一洞”高效漏洞挖掘之旅", "url": "https://www.freebuf.com/articles/web/111139.html", "time": "2016-08-11", "level": "金币+12", "num_look": 1098970, "num_comment": 20, "author": "clouds", "tags": ["WEB安全", "观点"], "text": "2016年初，我就给自己设定了一个目标：在这一年中，平均每天挖掘出一个漏洞。"}
{"title": "2016年中回顾：网络安全威胁TOP6分析报告", "url": "https://www.freebuf.com/articles/database/111351.html", "time": "2016-08-11", "level": "金币+12", "num_look": 476105, "num_comment": 6, "author": "dawner", "tags": ["安全报告", "数据安全"], "text": "本文是对2016年上半年网络安全威胁TOP6的回顾，其中包括勒索软件、数据泄露、身份盗窃、移动安全、物联网、虚拟现实等方面的安全威胁。"}
{"title": "一路向南｜FreeTalk深圳站报名啦！", "url": "https://www.freebuf.com/fevents/111644.html", "time": "2016-08-10", "level": "红色标题", "num_look": 264705, "num_comment": 16, "author": "FB客服", "tags": ["活动"], "text": "FreeTalk深圳站免费报名通道开启，让我们一路向南，相约南都深圳！"}
{"title": "如何用前端防御XSS及建立XSS报警机制", "url": "https://www.freebuf.com/articles/web/110583.html", "time": "2016-08-10", "level": "", "num_look": 798894, "num_comment": 21, "author": "Black-Hole", "tags": ["WEB安全"], "text": "虽然说前端防御XSS比较麻烦，但是，不是一定不行。"}
{"title": "FireEye奇葩裁员理由：中国黑客减少了，修复勒索软件太容易了……", "url": "https://www.freebuf.com/news/111581.html", "time": "2016-08-10", "level": "红色标题", "num_look": 389888, "num_comment": 13, "author": "bimeover", "tags": ["资讯"], "text": "8月9日，FierEye宣布裁员计划，根据第二季度财政报告，FireEye决定裁掉300到400名员工。"}
{"title": "mth3l3m3nt：Web渗透测试辅助框架", "url": "https://www.freebuf.com/sectool/110983.html", "time": "2016-08-10", "level": "", "num_look": 300673, "num_comment": 10, "author": "dawner", "tags": ["工具"], "text": "OWASP Mth3l3m3nt框架是一款优秀的渗透测试辅助框架，可WEB接口进行数据交互，借助集成的小工具来辅助测试人员进行渗透测试。"}
{"title": "【DEFCON亮点】首款智能温控系统勒索软件，利用显示器也能黑入电脑系统", "url": "https://www.freebuf.com/news/111513.html", "time": "2016-08-10", "level": "", "num_look": 223846, "num_comment": 4, "author": "bimeover", "tags": ["特别企划", "资讯"], "text": "今年的DEFCON黑客大会给大家带来了很多有意思的技术和工具，而在众多议题中，以下两个尤为夺人眼球。"}
{"title": "一名白帽子是如何说服CEO增加漏洞奖金的……", "url": "https://www.freebuf.com/news/110920.html", "time": "2016-08-10", "level": "红色标题", "num_look": 410278, "num_comment": 15, "author": "欧阳洋葱", "tags": ["资讯"], "text": "安全研究人员Malcolm最近在博客中记录了他帮助Imgur发现安全问题的全过程，还成功说服了CEO给予自己更多奖励。"}
{"title": "GSM Hacking Part ① ：使用SDR扫描嗅探GSM网络", "url": "https://www.freebuf.com/articles/wireless/110773.html", "time": "2016-08-10", "level": "", "num_look": 1224098, "num_comment": 21, "author": "漏洞盒子", "tags": ["无线安全"], "text": "通过这篇文章我们将揭秘如何通过电视棒、HackRF、BladeRF等SDR硬件嗅探、解密GSM基站的通信数据包..."}
{"title": "网络蜜罐技术探讨", "url": "https://www.freebuf.com/articles/network/111155.html", "time": "2016-08-10", "level": "现金奖励", "num_look": 1130134, "num_comment": 40, "author": "bt0sea", "tags": ["网络安全", "观点"], "text": "之前在FreeBuf发表的第一篇有关蜜罐文章，当时引起了业界不小的轰动。"}
{"title": "HEIST攻击：从HTTPS加密数据中获取明文", "url": "https://www.freebuf.com/news/111421.html", "time": "2016-08-09", "level": "", "num_look": 369265, "num_comment": 10, "author": "ArthurKiller", "tags": ["漏洞", "资讯"], "text": "在Black Hat 2016大会上，两名比利时的安全研究人员展示了他们今年的研究成果——HEIST攻击。"}
{"title": "南海网络谍影：F-Secure报告之木马NanHaiShu分析", "url": "https://www.freebuf.com/articles/network/111330.html", "time": "2016-08-09", "level": "", "num_look": 488869, "num_comment": 10, "author": "clouds", "tags": ["安全报告", "网络安全"], "text": "该木马的主要攻击对象为政府和私营机构，其中包括几个值得注意的目标: 菲律宾司法部、亚太经合组织APEC峰会组织者和一家跨国律师事务所。"}
{"title": "用IRC协议与PHP木马“聊天”", "url": "https://www.freebuf.com/articles/web/110859.html", "time": "2016-08-09", "level": "现金奖励", "num_look": 646707, "num_comment": 15, "author": "expsky", "tags": ["WEB安全"], "text": "最近，我们的网络监测设备中发现了revslider.zip文件，解压后的两个php文件mil.php，pbot.php都经过了编码处理，非常可疑。"}
{"title": "三星支付存在漏洞可导致黑客进行交易劫持", "url": "https://www.freebuf.com/vuls/111349.html", "time": "2016-08-09", "level": "金币+12", "num_look": 335137, "num_comment": 11, "author": "SkyMine", "tags": ["漏洞"], "text": "西班牙安全研究人员发现了Samsung Pay三星支付的安全漏洞。这个漏洞一旦被利用，黑客将可以利用另一个设备来对受害者进行交易劫持。"}
{"title": "那些年我们一起追逐过的安全工具", "url": "https://www.freebuf.com/sectool/110526.html", "time": "2016-08-09", "level": "金币+12", "num_look": 1430441, "num_comment": 115, "author": "ArthurKiller", "tags": ["工具", "特别企划"], "text": "从阿D到SQLMAP，从Cain到Metasploit.....那些已深藏在互联网角落的经典安全工具，代表着曾经的我们。"}
{"title": "2016年最值得关注的9家云安全初创企业", "url": "https://www.freebuf.com/articles/paper/111009.html", "time": "2016-08-09", "level": "金币+12", "num_look": 362487, "num_comment": 6, "author": "米雪儿", "tags": ["安全报告"], "text": "调查显示，2016年网络安全领域的风险投资将达到4亿美元"}
{"title": "近期接连爆出的Telegram漏洞到底是怎么回事？", "url": "https://www.freebuf.com/vuls/111245.html", "time": "2016-08-08", "level": "", "num_look": 432591, "num_comment": 8, "author": "Sphinx", "tags": ["漏洞", "终端安全"], "text": "最近这两天，号称“最安全”的通讯应用Telegram接连爆出漏洞，又是剪贴板信息泄露，又是1500万伊朗用户手机号曝光，究竟这两个漏洞有多危险呢？"}
{"title": "高通曝Quadrooter高危漏洞， 影响全球9亿安卓用户", "url": "https://www.freebuf.com/vuls/111362.html", "time": "2016-08-08", "level": "红色标题", "num_look": 512844, "num_comment": 11, "author": "米雪儿", "tags": ["漏洞"], "text": "高通公司的处理器惊现4种新型漏洞，影响全球9亿多安卓用户，通过这些漏洞，黑客可以完全控制受影响的手机。"}
{"title": "开源的威胁情报收集器：OSTrICa", "url": "https://www.freebuf.com/sectool/111049.html", "time": "2016-08-08", "level": "", "num_look": 463351, "num_comment": 463351, "author": "felix", "tags": ["工具"], "text": "OSTrICa是一款开源威胁情报收集器，也是一个插件模式的框架，能够可视化展示收集到的威胁情报数据。"}
{"title": "摩诃草APT组织大揭秘", "url": "https://www.freebuf.com/articles/security-management/111166.html", "time": "2016-08-08", "level": "", "num_look": 898072, "num_comment": 12, "author": "360安全", "tags": ["安全报告", "安全管理"], "text": "摩诃草组织是一个来自于南亚地区的境外APT组织，该组织已持续活跃了7年。"}
{"title": "广告商可以通过手机电量跟踪你", "url": "https://www.freebuf.com/news/111013.html", "time": "2016-08-08", "level": "", "num_look": 360465, "num_comment": 12, "author": "Sphinx", "tags": ["终端安全", "资讯"], "text": "根据一份普林斯顿大学研究员的报告，电池状态已经在一些网站被用来跟踪你的在线活动。漏洞触发的原因是因为电池状态API。"}
{"title": "APP漏洞自动化扫描专业评测报告（上篇）", "url": "https://www.freebuf.com/articles/terminal/111130.html", "time": "2016-08-08", "level": "现金奖励", "num_look": 772147, "num_comment": 13, "author": "Sunnieli", "tags": ["安全报告", "特别企划"], "text": "为了了解目前国内移动APP在线漏洞扫描平台的发展情况，我进行了一次移动安全扫描平台的评测分析。"}
{"title": "暴雪以及英雄联盟游戏服务器遭遇大规模DDoS攻击", "url": "https://www.freebuf.com/news/111295.html", "time": "2016-08-07", "level": "金币+7", "num_look": 334691, "num_comment": 9, "author": "SkyMine", "tags": ["资讯"], "text": "近日，自称PoodleCorp的黑客组织对暴雪公司以及英雄联盟游戏服务器进行了一系列大规模的分布式拒绝服务攻击（DDOS）。"}
{"title": "安全科普：漏洞扫描那些事", "url": "https://www.freebuf.com/sectool/110460.html", "time": "2016-08-07", "level": "金币+7", "num_look": 904555, "num_comment": 13, "author": "felix", "tags": ["工具"], "text": "漏洞扫描器是什么？全球有哪些流行的漏扫？这篇文章旨在给新手做个指南。"}
{"title": "使用Docker构建Web渗透测试工具容器", "url": "https://www.freebuf.com/sectool/110981.html", "time": "2016-08-07", "level": "", "num_look": 587884, "num_comment": 10, "author": "felix", "tags": ["工具"], "text": "Docker是世界领先的软件集装化平台，针对不同的渗透测试类型，我们完全可以使用Docker创建相应的环境。"}
{"title": "VIPKID安全团队诚邀各类安全人才", "url": "https://www.freebuf.com/jobs/111227.html", "time": "2016-08-06", "level": "", "num_look": 218144, "num_comment": 6, "author": "VIPKID安全团队", "tags": ["安全招聘"], "text": "VIPKID创立于2013年，是一家专注为5-12岁小朋友提供有效、生动的英语学习体验的互联网在线教育公司。"}
{"title": "【FB TV】一周「BUF大事件」v2.0首播（201600730-20160805）", "url": "https://www.freebuf.com/news/111274.html", "time": "2016-08-06", "level": "红色标题", "num_look": 369149, "num_comment": 25, "author": "supercoco", "tags": ["特别企划", "视频"], "text": "BUF大事件正式升级为2.0版本上线——咱们萌萌哒的FB主播终于「露面」啦，第一期「有奖安全谜题」也同期发布！"}
{"title": "多线程WEB安全日志分析脚本", "url": "https://www.freebuf.com/sectool/110644.html", "time": "2016-08-06", "level": "金币+7", "num_look": 548554, "num_comment": 7, "author": "piaox", "tags": ["工具"], "text": "为了方便平时定期web服务器安全日志分析，闲暇时写了个小脚本，支持自动scp远程web服务器日志到本地，然后多线程安全分析。"}
{"title": "【BlackHat专题】议题花絮一箩筐：Pwnie Awards、灯泡传播病毒、会场WiFi有人捣乱...", "url": "https://www.freebuf.com/news/111244.html", "time": "2016-08-06", "level": "红色标题", "num_look": 316502, "num_comment": 5, "author": "欧阳洋葱", "tags": ["特别企划", "资讯"], "text": "Black Hat USA 2016的最后一天还有些啥料呢？我们来随意抖一抖。"}
{"title": "苹果发布首期漏洞赏金计划，最高奖20万美元", "url": "https://www.freebuf.com/news/111200.html", "time": "2016-08-05", "level": "", "num_look": 197190, "num_comment": 4, "author": "bimeover", "tags": ["资讯"], "text": "Nice！这很苹果。"}
{"title": "浅谈业务安全通用解决方案的构建", "url": "https://www.freebuf.com/articles/neopoints/110681.html", "time": "2016-08-05", "level": "", "num_look": 439368, "num_comment": 4, "author": "阿里云誉反欺诈", "tags": ["安全管理", "观点"], "text": "安全从业者加入公司的初衷绝对不是“阻碍业务发展”，那么安全解决方案能否成为“业务促进者”，而非“业务阻碍者”呢？答案是肯定。"}
{"title": "陌陌科技诚聘安全工程师", "url": "https://www.freebuf.com/jobs/111194.html", "time": "2016-08-05", "level": "", "num_look": 216842, "num_comment": 8, "author": "andy110", "tags": ["安全招聘"], "text": "“陌陌”是北京陌陌科技有限公司于 2011 年 8 月起推出的一款基于地理位置的移动社交产品。"}
{"title": "HTTP2.0协议被曝4个高危漏洞，可致服务器崩溃", "url": "https://www.freebuf.com/news/111111.html", "time": "2016-08-05", "level": "", "num_look": 456675, "num_comment": 19, "author": "bimeover", "tags": ["漏洞", "资讯"], "text": "有研究人员花费4个月的时间在HTTP2.0协议中发现4个缺陷！"}
{"title": "小心Windows旧版认证暴露你的系统帐户密码", "url": "https://www.freebuf.com/vuls/110941.html", "time": "2016-08-05", "level": "", "num_look": 345249, "num_comment": 8, "author": "Sphinx", "tags": ["漏洞"], "text": "当你正在浏览网页时，Windows上的一个漏洞就可能把你电脑的用户名密码、微软登录信息，甚至还有你VPN的账号密码泄露给了网站。"}
{"title": "【BlackHat专题】Black Hat 2016黑客大会DAY 1，都有哪些干货议题？", "url": "https://www.freebuf.com/news/111125.html", "time": "2016-08-05", "level": "红色标题", "num_look": 404279, "num_comment": 9, "author": "欧阳洋葱", "tags": ["头条", "特别企划"], "text": "7月30日-8月2日的头4天是针对不同人群的Training，最后两天就是众所期盼的各种Keynote了，不管是技术的还是行业的，还有Arsenal工具陈列分会场、Pwnie Awards颁奖等内容。"}
{"title": "DNS Shell初体验", "url": "https://www.freebuf.com/sectool/110815.html", "time": "2016-08-05", "level": "现金奖励", "num_look": 697745, "num_comment": 20, "author": "ArkTeam", "tags": ["工具", "网络安全"], "text": "我们今天介绍一个利用 DNS 协议进行通信的反弹 Shell，和 ICMP 反弹 Shell 的原理几乎相同，只是传输的协议变为了 DNS。"}
{"title": "比特币交易网站Bitfinex遭黑客入侵，约6700万美元被盗", "url": "https://www.freebuf.com/news/111004.html", "time": "2016-08-04", "level": "", "num_look": 233842, "num_comment": 6, "author": "bimeover", "tags": ["资讯"], "text": "Bitfinex将会关闭网站进行为期数日的漏洞维护。据悉黑客可以利用该漏洞盗取用户资金。"}
{"title": "【BlackHat专题】Black Hat 2016上，你值得关注的8款安全工具", "url": "https://www.freebuf.com/sectool/111065.html", "time": "2016-08-04", "level": "金币+8", "num_look": 421345, "num_comment": 6, "author": "米雪儿", "tags": ["工具"], "text": "哪些渗透测试，逆向工程以及其他安全工具将在Black Hat2016大会上绽放异彩？一起拭目以待吧。"}
{"title": "Python渗透工具的架构探讨", "url": "https://www.freebuf.com/sectool/111046.html", "time": "2016-08-04", "level": "现金奖励", "num_look": 511493, "num_comment": 12, "author": "VillanCh", "tags": ["工具"], "text": "在最近忙活的一些事情中，体会到：如果你写的不是一个脚本，那么作为一个有命令行交互的工具，整个工具的结构和可拓展性就应该称为一个非常重要的部分。"}
{"title": "Kali Linux渗透基础知识整理（三）：漏洞利用", "url": "https://www.freebuf.com/sectool/109955.html", "time": "2016-08-04", "level": "金币+8", "num_look": 1395227, "num_comment": 39, "author": "sysorem", "tags": ["工具", "特别企划"], "text": "漏洞利用阶段利用已获得的信息和各种攻击手段实施渗透。网络应用程序漏洞诊断项目的加密通信漏洞诊断是必须执行的。"}
{"title": "【安全大咖说】专访盘古团队联合创始人、犇众信息CTO徐昊", "url": "https://www.freebuf.com/articles/people/110912.html", "time": "2016-08-04", "level": "红色标题", "num_look": 675466, "num_comment": 17, "author": "ArthurKiller", "tags": ["人物志"], "text": "徐昊亦是盘古iOS越狱工具的开发主力之一，拥有超过10年的信息安全领域从业经验。"}
{"title": "对各大知名密码管理器的对比", "url": "https://www.freebuf.com/articles/database/110864.html", "time": "2016-08-04", "level": "", "num_look": 746598, "num_comment": 11, "author": "Sphinx", "tags": ["安全报告", "安全管理"], "text": "本文将给大家介绍现在市面上各平台都有哪些优秀的密码管理器。"}
{"title": "OAuth 2.0攻击面与案例总结", "url": "https://www.freebuf.com/articles/web/110757.html", "time": "2016-08-04", "level": "现金奖励", "num_look": 558370, "num_comment": 5, "author": "cdxy", "tags": ["WEB安全"], "text": "本文整理了OAuth 2.0的攻击面+实际案例+辅助测试代码。"}
{"title": "Google宣布对其域名启用HSTS协议", "url": "https://www.freebuf.com/news/110759.html", "time": "2016-08-03", "level": "", "num_look": 221067, "num_comment": 11, "author": "anyway5", "tags": ["资讯"], "text": "如果你访问的网站启用了HSTS，那么浏览器将会记住这一标记，确保未来每次访问该网站都会自动定向到HTTPS。"}
{"title": "【企业研究报告】FreeBuf Insight：网络安全创新企业Top 10解读之FireEye", "url": "https://www.freebuf.com/news/topnews/110221.html", "time": "2016-08-03", "level": "红色标题", "num_look": 739186, "num_comment": 8, "author": "FreeBuf咨询", "tags": ["头条", "安全报告"], "text": "这次FreeBuf Insight要尝试解读的，是近些年来在安全领域红透半边天的FireEye——火眼公司。"}
{"title": "小心，Android木马工具SpyNote免费啦！远程监听就是这么简单", "url": "https://www.freebuf.com/news/110776.html", "time": "2016-08-03", "level": "", "num_look": 1252508, "num_comment": 31, "author": "欧阳洋葱", "tags": ["终端安全", "资讯"], "text": "最近Palo Alto Networks发现了一款面向大众免费派发的RAT，名为SpyNote。"}
{"title": "安全专家用3D打印复制出了7把美国“海关锁”主钥", "url": "https://www.freebuf.com/news/110650.html", "time": "2016-08-03", "level": "金币+6", "num_look": 256649, "num_comment": 8, "author": "dawner", "tags": ["资讯"], "text": "由于美国政府坚持对加密安全植入后门的一惯的做法，TSA在无意中外泄的“海关锁”主钥图片，反而让\"物理黑客\"钻了空档。"}
{"title": "【经验】使用Androl4b进行安卓APP安全测试（Part 1）", "url": "https://www.freebuf.com/articles/terminal/110374.html", "time": "2016-08-03", "level": "", "num_look": 541116, "num_comment": 25, "author": "漏洞盒子", "tags": ["终端安全"], "text": "文章第一部分主要分享Androl4b中部分工具的一些基础使用。"}
{"title": "企业内部威胁案例：被炒鱿鱼的网络工程师，造成花旗银行北美90%网络瘫痪", "url": "https://www.freebuf.com/articles/security-management/110604.html", "time": "2016-08-03", "level": "", "num_look": 440492, "num_comment": 9, "author": "dawner", "tags": ["安全管理"], "text": "一名叫Lennon Ray Brown的网络工程师因为绩效评定不佳而被责令解雇，于是他在下班后对公司展开了「报复」。"}
{"title": "【快讯】南洋股份宣布将以57亿元收购天融信", "url": "https://www.freebuf.com/news/110954.html", "time": "2016-08-02", "level": "红色标题", "num_look": 391559, "num_comment": 16, "author": "欧阳洋葱", "tags": ["资讯"], "text": "南洋股份准备以57亿元的价格收购北京天融信科技股份有限公司"}
{"title": "伊朗互联网提供商遭以色列黑客入侵，大量数据泄露", "url": "https://www.freebuf.com/news/110865.html", "time": "2016-08-02", "level": "", "num_look": 234618, "num_comment": 4, "author": "clouds", "tags": ["资讯"], "text": "一名自称为以色列的黑客（twitter账号为@zurael_stz），泄露了大量伊朗互联网提供商网站Parsiva.dba.co.ir数据，并声称其中包含52000多名注册用户信息。"}
{"title": "Adobe Flash Player漏洞（CVE-2016-4117）样本分析", "url": "https://www.freebuf.com/vuls/110707.html", "time": "2016-08-02", "level": "", "num_look": 412575, "num_comment": 8, "author": "奇安信威胁情报中心", "tags": ["漏洞"], "text": "本文主要针对CVE-2016-4117漏洞的原理、触发、利用过程进行完整的技术分析。"}
{"title": "事件调查：尼日利亚网络犯罪分子针对印度关键行业发起的网络攻击", "url": "https://www.freebuf.com/special/110622.html", "time": "2016-08-02", "level": "", "num_look": 281602, "num_comment": 3, "author": "clouds", "tags": ["安全报告", "特别企划"], "text": "你可能会认为目前大多数的网络犯罪问题仅涉及几个“热点”国家，如中国、俄罗斯和伊朗等。然而，这并不是完全事实。"}
{"title": "【BlackHat 2016专题】黑客奥斯卡：Pwnie Awards那些事儿", "url": "https://www.freebuf.com/articles/others-articles/110804.html", "time": "2016-08-02", "level": "金币+6", "num_look": 270931, "num_comment": 2, "author": "寰者", "tags": ["其他", "特别企划"], "text": "一年一度的全球黑客大会Black Hat即将举行（将于8月3日举行），而与此同时，有着「黑客奥斯卡」奖之称的Pwnie Awards也将公布归属。"}
{"title": "T50：一款优秀的网站压力测试工具", "url": "https://www.freebuf.com/sectool/110212.html", "time": "2016-08-02", "level": "", "num_look": 551889, "num_comment": 6, "author": "felix", "tags": ["工具"], "text": "T50是一款网络层压力测试工具。"}
{"title": "企业自研扫描器之路：信息收集模块", "url": "https://www.freebuf.com/articles/web/110307.html", "time": "2016-08-02", "level": "现金奖励", "num_look": 672346, "num_comment": 36, "author": "wadcl", "tags": ["WEB安全", "观点"], "text": "现有的wvs、appscan等这类工具，由于种种原因和环境，并不能满足我们的需求，所以只能走入自研之路。"}
{"title": "BlackHat（世界黑帽大会）官方APP出现两个逻辑漏洞", "url": "https://www.freebuf.com/news/110748.html", "time": "2016-08-01", "level": "", "num_look": 538893, "num_comment": 14, "author": "ArthurKiller", "tags": ["漏洞", "资讯"], "text": "BlackHat大会马上就要举行了，作为全世界最出名的黑帽安全大会，自然受到很多人的关注。"}
{"title": "vFeed：结构化的漏洞与威胁数据库（支持CVE、CWE和OVAL）", "url": "https://www.freebuf.com/sectool/110586.html", "time": "2016-08-01", "level": "", "num_look": 293181, "num_comment": 1, "author": "felix", "tags": ["工具"], "text": "vFeed以JSON格式输出漏洞的详细信息，可以作为漏洞查询的一个工具使用。"}
{"title": "网络安全初创公司PhishMe获得4250万美元的C轮融资", "url": "https://www.freebuf.com/news/110713.html", "time": "2016-08-01", "level": "", "num_look": 206390, "num_comment": 5, "author": "米雪儿", "tags": ["资讯"], "text": "该公司旨在通过为企业员工提供持续性的安全培训，来帮助企业阻止网络钓鱼攻击和其他类型的网络安全威胁。"}
{"title": "魔兽世界中招：一条命令行就能劫持你的游戏（附劫持代码和视频）", "url": "https://www.freebuf.com/vuls/110592.html", "time": "2016-08-01", "level": "", "num_look": 379546, "num_comment": 11, "author": "clouds", "tags": ["漏洞"], "text": "最近出现了一种涉及社工技术的新型游戏攻击骗局，攻击者利用了魔兽世界（World of Warcraft，WoW）游戏插件中一个隐藏的功能。"}
{"title": "赛门铁克：企业请注意！Patchwork APT攻击范围已扩展到各行各业", "url": "https://www.freebuf.com/news/110431.html", "time": "2016-08-01", "level": "", "num_look": 190097, "num_comment": 3, "author": "欧阳洋葱", "tags": ["资讯"], "text": "Patchwork先前一直是以政府以及与政府相关的组织为攻击目标的，最近则开始针对企业目标发起APT攻击。"}
{"title": "【行研】FreeBuf发布2016年上半年金融行业应用安全态势报告", "url": "https://www.freebuf.com/news/topnews/110132.html", "time": "2016-08-01", "level": "红色标题", "num_look": 560027, "num_comment": 17, "author": "FreeBuf咨询", "tags": ["头条", "安全报告"], "text": "FreeBuf本次调研报告的目的是从一定程度上呈现2016年上半年金融行业整体安全状态。"}
{"title": "大数据安全分析的前世今生", "url": "https://www.freebuf.com/articles/database/110234.html", "time": "2016-08-01", "level": "现金奖励", "num_look": 791778, "num_comment": 9, "author": "木千之", "tags": ["数据安全", "特别企划"], "text": "我们已然处于“大数据”时代，不仅仅是“数据”，而且是“大”数据。"}
{"title": "2016携程信息安全沙龙：甲方企业安全的力量与荣耀（8月20日）", "url": "https://www.freebuf.com/fevents/110534.html", "time": "2016-07-31", "level": "", "num_look": 198944, "num_comment": 6, "author": "携程信息安全部", "tags": ["活动"], "text": "由携程信息安全部主办，5位重量级企业演讲嘉宾会分享他们从未对外公布的企业安全实践经验。"}
{"title": "XEN虚拟机监控器出现“致命”漏洞", "url": "https://www.freebuf.com/news/110479.html", "time": "2016-07-31", "level": "", "num_look": 270979, "num_comment": 1, "author": "bimeover", "tags": ["漏洞", "资讯"], "text": "使用x86硬件的半虚拟化用户需要注意：该漏洞版本已确定为CVE-2016-6258，并且能够影响Xen的所有版本。"}
{"title": "一站式建站平台Deer.io，居然成为了网络犯罪的天堂", "url": "https://www.freebuf.com/news/110413.html", "time": "2016-07-31", "level": "", "num_look": 220071, "num_comment": 3, "author": "Sphinx", "tags": ["资讯"], "text": "网络公司Digital Shadows发布了一篇详细报告称，俄罗斯的建站网站Deer.io打着建站的旗号，实际已经成为了黑客们售卖数据、服务的庇护所。"}
{"title": "瑞星2016年上半年中国信息安全报告之个人互联网安全", "url": "https://www.freebuf.com/articles/paper/110391.html", "time": "2016-07-30", "level": "", "num_look": 346352, "num_comment": 23, "author": "瑞星", "tags": ["安全报告"], "text": "针对中国2016年1至6月的网络安全现状与趋势进行统计、研究和分析。"}
{"title": "【FB TV】一周「BUF大事件」（201600723-20160729）", "url": "https://www.freebuf.com/video/110602.html", "time": "2016-07-30", "level": "红色标题", "num_look": 310174, "num_comment": 7, "author": "supercoco", "tags": ["视频"], "text": "斯诺登为何改行做iphone手机壳了？"}
{"title": "一个纯JS脚本的文档敲诈者剖析（附解密工具）", "url": "https://www.freebuf.com/articles/system/110358.html", "time": "2016-07-30", "level": "", "num_look": 384611, "num_comment": 8, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "近日，腾讯反病毒实验室拦截到一个名为RAA的敲诈者木马，其所有的功能均在JS脚本里完成。"}
{"title": "内部威胁那些事儿（五）：案例分析", "url": "https://www.freebuf.com/articles/neopoints/107472.html", "time": "2016-07-30", "level": "现金奖励", "num_look": 669130, "num_comment": 4, "author": "木千之", "tags": ["安全管理", "特别企划"], "text": "经典的内部威胁几个案例及作者的分析"}
{"title": "Kali Linux渗透基础知识整理（二）：漏洞扫描", "url": "https://www.freebuf.com/sectool/109952.html", "time": "2016-07-30", "level": "金币+15", "num_look": 1746452, "num_comment": 17, "author": "sysorem", "tags": ["工具", "特别企划"], "text": "Kali Linux渗透基础知识整理（二）漏洞扫描"}
{"title": "QRLJacking：如何劫持快速登陆时使用的二维码", "url": "https://www.freebuf.com/articles/web/110510.html", "time": "2016-07-29", "level": "", "num_look": 500630, "num_comment": 9, "author": "Sphinx", "tags": ["WEB安全"], "text": "来自埃及的黑客Mohamed Elnouby想出了对二维码登录进行劫持的方法，并且发布了PoC演示。"}
{"title": "夜访Hacking Team黑客", "url": "https://www.freebuf.com/articles/people/109966.html", "time": "2016-07-29", "level": "", "num_look": 404660, "num_comment": 8, "author": "饭团君", "tags": ["人物志"], "text": "入侵Hacking Team的黑客公开接受记者采访，还原当时的场景。"}
{"title": "OPENVAS源码编译解析", "url": "https://www.freebuf.com/articles/system/110027.html", "time": "2016-07-29", "level": "现金奖励", "num_look": 461611, "num_comment": 15, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "一方面是满足自己的完美心理，另一方面就是加深对各模块的理解。废话不多说，来看一下我的OPENVAS源码编译之路吧。"}
{"title": "未来已来，云上安全SaaS化势不可挡", "url": "https://www.freebuf.com/articles/neopoints/109938.html", "time": "2016-07-29", "level": "现金奖励", "num_look": 251902, "num_comment": 5, "author": "s3curity", "tags": ["观点"], "text": "安全领域值得浓墨重彩书写的变革已经悄然而至。"}
{"title": "美国漏洞众测平台HackerOne运营模式解读与分析", "url": "https://www.freebuf.com/articles/neopoints/110430.html", "time": "2016-07-29", "level": "现金奖励", "num_look": 810887, "num_comment": 19, "author": "clouds", "tags": ["安全报告", "特别企划"], "text": "3月，当美国国防部宣布与HackerOne合作邀请黑客参与“Hack the Pentagon”的漏洞奖励计划之后，让HackerOne再次成为业界焦点。"}
{"title": "IBM Rational AppScan 9.0.3 （含下载）", "url": "https://www.freebuf.com/sectool/110090.html", "time": "2016-07-29", "level": "金币+15", "num_look": 876971, "num_comment": 20, "author": "wanju", "tags": ["工具"], "text": "Appscan是web应用程序渗透测试舞台上使用最广泛的工具之一，有助于专业安全人员进行Web应用程序自动化脆弱性评估。"}
{"title": "勒索软件撕逼大战：Chimera软件秘钥遭同行泄露", "url": "https://www.freebuf.com/news/110371.html", "time": "2016-07-29", "level": "", "num_look": 186131, "num_comment": 6, "author": "米雪儿", "tags": ["资讯"], "text": "近日，Petya 和 Mischa勒索软件家族的开发者在网络上公布了其竞争对手——Chimera勒索软件的秘钥。"}
{"title": "从思科推出1000万美元奖学金计划，看国内安全教育何去何从？", "url": "https://www.freebuf.com/news/109637.html", "time": "2016-07-29", "level": "", "num_look": 214912, "num_comment": 17, "author": "anyway5", "tags": ["观点", "资讯"], "text": "从思科推出1000万美元奖学金计划，看国内安全教育何去何从？"}
{"title": "易宝支付招聘安全工程师", "url": "https://www.freebuf.com/jobs/110099.html", "time": "2016-07-28", "level": "", "num_look": 225244, "num_comment": 14, "author": "plane636", "tags": ["安全招聘"], "text": "因公司扩张业务增长需要，招聘小伙伴来加入易宝安全团队。"}
{"title": "LastPass再曝多枚高危漏洞，用户账号信息存在被盗风险", "url": "https://www.freebuf.com/news/110378.html", "time": "2016-07-28", "level": "红色标题", "num_look": 529803, "num_comment": 11, "author": "ArthurKiller", "tags": ["漏洞", "资讯"], "text": "LastPass是全球最流行的云密码管理工具之一。日前LastPass曝出URL伪造漏洞和命令执行高危漏洞。"}
{"title": "如何用Splunk建立可疑DNS报警系统", "url": "https://www.freebuf.com/articles/network/110130.html", "time": "2016-07-28", "level": "现金奖励", "num_look": 519469, "num_comment": 8, "author": "langyajiekou", "tags": ["网络安全"], "text": "想了很久，发现Freebuf中甚少提到Splunk大数据分析的应用，在此抛砖引玉。"}
{"title": "黑莓发布“全球最安全Android手机”DTEK50", "url": "https://www.freebuf.com/news/110261.html", "time": "2016-07-28", "level": "", "num_look": 343245, "num_comment": 9, "author": "欧阳洋葱", "tags": ["资讯"], "text": "黑莓刚刚宣布推出“全球最安全Android智能手机”DTEK50，到底有多安全呢？"}
{"title": "ISIS都在使用哪些通讯APP？", "url": "https://www.freebuf.com/news/109907.html", "time": "2016-07-28", "level": "", "num_look": 315443, "num_comment": 5, "author": "饭团君", "tags": ["其他", "资讯"], "text": "ISIS组织成员平常都喜欢用哪些聊天工具？他们对安全又是否格外在意？"}
{"title": "小米范系列渗透测试工具介绍", "url": "https://www.freebuf.com/sectool/109949.html", "time": "2016-07-28", "level": "现金奖励", "num_look": 1077399, "num_comment": 58, "author": "shentouceshi", "tags": ["工具"], "text": "为了提高工作效率，最近写了几款渗透测试类的工具，在这里给大家分享一下。"}
{"title": "知道创宇招聘安全架构师", "url": "https://www.freebuf.com/jobs/109954.html", "time": "2016-07-27", "level": "", "num_look": 299337, "num_comment": 18, "author": "yyzz", "tags": ["安全招聘"], "text": "知道创宇是国内最早提出网站安全云监测及云防御的高新企业，现招聘安全架构师。"}
{"title": "大量无线键盘存在KeySniffer漏洞，可嗅探用户输入", "url": "https://www.freebuf.com/vuls/110265.html", "time": "2016-07-27", "level": "", "num_look": 463848, "num_comment": 13, "author": "Sphinx", "tags": ["漏洞", "终端安全"], "text": "几美元的一根天线、一个无线发射器，还有几行Python代码，有了这些，黑客就可以在几十米开外记录下你的用户名、密码，总之就是你用无线键盘输入的任何信息。"}
{"title": "我是如何黑进成人生活网站Pornhub拿到2万美元赏金的", "url": "https://www.freebuf.com/vuls/110110.html", "time": "2016-07-27", "level": "", "num_look": 1052110, "num_comment": 20, "author": "banish", "tags": ["漏洞"], "text": "老司机们对Pornhub也不会陌生了(//∇//)\\，此处略去一万字"}
{"title": "波兰国防部数据遭窃，黑客索要$50000赎金", "url": "https://www.freebuf.com/news/109935.html", "time": "2016-07-27", "level": "金币+5", "num_look": 226649, "num_comment": 13, "author": "千千晚风", "tags": ["资讯"], "text": "一群自称“Pravyy Sector”（右边界）的黑客在推特上勒索波兰政府。"}
{"title": "Dmitry：深度信息挖掘工具", "url": "https://www.freebuf.com/sectool/110014.html", "time": "2016-07-27", "level": "", "num_look": 650575, "num_comment": 9, "author": "dawner", "tags": ["工具"], "text": "Dmitry是一个由C语言编写的UNIX/(GNU)Linux命令行工具，它可用于收集主机相关信息。"}
{"title": "浅谈开源威胁情报工具和技术", "url": "https://www.freebuf.com/sectool/110096.html", "time": "2016-07-27", "level": "金币+5", "num_look": 793819, "num_comment": 5, "author": "felix", "tags": ["工具", "特别企划"], "text": "今天让我们探讨下威胁管理中的开源情报吧。"}
{"title": "Kali Linux渗透基础知识整理（一）：信息搜集", "url": "https://www.freebuf.com/sectool/109944.html", "time": "2016-07-26", "level": "金币+5", "num_look": 1590461, "num_comment": 20, "author": "sysorem", "tags": ["工具"], "text": "最近要给一些新人做培训，整理些东西，算不上什么太高端的内容，只是简单的整理下了，我觉得对于小白的话也还算是干货。"}
{"title": "FreeBuf登陆成功，你有一份礼包待领取", "url": "https://www.freebuf.com/fevents/110175.html", "time": "2016-07-26", "level": "", "num_look": 363181, "num_comment": 37, "author": "FB客服", "tags": ["活动"], "text": "FreeBuf 六周年，不忘初心。"}
{"title": "台湾第一银行ATM机“自动吐钱”事件分析", "url": "https://www.freebuf.com/articles/terminal/110078.html", "time": "2016-07-26", "level": "", "num_look": 447903, "num_comment": 12, "author": "360安全", "tags": ["安全报告", "终端安全"], "text": "2016年7月中，我国台湾地区的台湾第一银行旗下20多家分行的41台ATM机遭遇黑客攻击，被盗8327余万新台币。"}
{"title": "安全报告剖析：采矿行业面临的网络间谍攻击威胁", "url": "https://www.freebuf.com/articles/network/109940.html", "time": "2016-07-26", "level": "金币+10", "num_look": 661662, "num_comment": 2, "author": "clouds", "tags": ["安全报告", "安全管理"], "text": "本文通过研究现代采矿业的运营模式，调查与采矿行业相关的网络间谍攻击活动，了解采矿行业面临的信息安全威胁，并提出综合防御建议。"}
{"title": "蚂蚁金服（支付宝）急聘移动安全工程师", "url": "https://www.freebuf.com/jobs/110053.html", "time": "2016-07-26", "level": "", "num_look": 328326, "num_comment": 13, "author": "unLimit安全小组", "tags": ["安全招聘"], "text": "蚂蚁金服－支付宝急聘移动端安全测试开发工程师、Android安全工程师、iOS安全工程师等职位。"}
{"title": "谷歌：新安卓系统Android 7.0 Root难度将加大", "url": "https://www.freebuf.com/news/109770.html", "time": "2016-07-26", "level": "", "num_look": 572204, "num_comment": 15, "author": "bimeover", "tags": ["资讯"], "text": "Android 7.0 牛轧糖将会安装一种新的开机验证功能，Root难度会因该功能而加大"}
{"title": "解析Mr.Robot第二季第一集中的真实案例", "url": "https://www.freebuf.com/news/109860.html", "time": "2016-07-26", "level": "红色标题", "num_look": 1349694, "num_comment": 21, "author": "bimeover", "tags": ["其他", "资讯"], "text": "接下来的内容涉及剧透，如果你还没有看过第二季第一集，慎入。"}
{"title": "RFID Hacking ④:ProxMark3 破解门禁", "url": "https://www.freebuf.com/articles/wireless/109151.html", "time": "2016-07-26", "level": "", "num_look": 1431370, "num_comment": 17, "author": "漏洞盒子", "tags": ["无线安全"], "text": "门禁系统作为企业物理第一道屏障，这些硬件基础设施安全是否一直都被忽视？"}
{"title": "斯诺登发明了一种检测和阻拦无线监听的iPhone外壳", "url": "https://www.freebuf.com/news/109927.html", "time": "2016-07-25", "level": "金币+10", "num_look": 488280, "num_comment": 23, "author": "banish", "tags": ["无线安全", "资讯"], "text": "斯诺登担心智能手机的蜂窝信号可以被定位从而暴露自己的地理位置。于是他最近发明了一个可检测和阻止政府监听的iPhone外壳。"}
{"title": "分析重装系统也无法清除的鬼影病毒", "url": "https://www.freebuf.com/articles/system/109515.html", "time": "2016-07-25", "level": "现金奖励", "num_look": 551226, "num_comment": 24, "author": "expsky", "tags": ["安全报告", "系统安全"], "text": "鬼影病毒的详细分析报告，重装系统也无法清除。"}
{"title": "使用免费http代理IP进行内网扫描", "url": "https://www.freebuf.com/vuls/109540.html", "time": "2016-07-25", "level": "现金奖励", "num_look": 4626740, "num_comment": 41, "author": "tonybreak", "tags": ["漏洞"], "text": "发现的漏洞之免费代理IP的那些事情，你家的网络慢了吗？"}
{"title": "Pokémon Go 安全问题浅析", "url": "https://www.freebuf.com/special/109873.html", "time": "2016-07-25", "level": "现金奖励", "num_look": 322380, "num_comment": 14, "author": "ArkTeam", "tags": ["安全报告", "特别企划"], "text": "本文针对Pokémon Go面临的安全风险做了简单的介绍及分析并提出了一些安全建议。"}
{"title": "【安全大咖说】专访俄罗斯汽车黑客Michael Elizarov | FreeBuf视频", "url": "https://www.freebuf.com/articles/people/109828.html", "time": "2016-07-25", "level": "", "num_look": 373791, "num_comment": 5, "author": "ArthurKiller", "tags": ["人物志", "特别企划"], "text": "FreeBuf小编对来自俄罗斯的著名汽车黑客Michael进行了专访，他对汽车安全有什么看法？"}
{"title": "mimikittenz（咪咪猫）：又一个Windows密码获取神器", "url": "https://www.freebuf.com/sectool/109958.html", "time": "2016-07-25", "level": "金币+10", "num_look": 755728, "num_comment": 31, "author": "banish", "tags": ["工具"], "text": "咪咪猫（mimikittenz）是一个Powershell工具，不仅仅名字很萌。"}
{"title": "【头条】盘古团队发布iOS 9.2-9.3.3越狱工具", "url": "https://www.freebuf.com/news/109977.html", "time": "2016-07-24", "level": "红色标题", "num_look": 359373, "num_comment": 19, "author": "ArthurKiller", "tags": ["头条", "资讯"], "text": "在盘古未发布越狱工具之前，中国的越狱工具一向是由国外的安全团队提供。而这次盘古率先发放了IOS 9.2至IOS 9.3.3的越狱插件。"}
{"title": "全国高校网安联赛X-NUCA·2016赛季大幕开启", "url": "https://www.freebuf.com/articles/109781.html", "time": "2016-07-24", "level": "", "num_look": 258315, "num_comment": 1, "author": "X-NUCA", "tags": ["文章"], "text": "全国高校网安联赛(National University Cybersecurity Association，简称X-NUCA)正式拉开帷幕！"}
{"title": "走近科学：朝鲜黑客是如何崛起的", "url": "https://www.freebuf.com/articles/others-articles/109841.html", "time": "2016-07-24", "level": "金币+10", "num_look": 545377, "num_comment": 12, "author": "饭团君", "tags": ["其他", "安全报告"], "text": "在过去，朝鲜一直被认为是“在地球上网络以及社会发展最孤立的国家”，但现在，这个国家却成为了国际网络最大的威胁之一。"}
{"title": "世界最大反恐数据库在暗网出售，卖家称数据真实有效", "url": "https://www.freebuf.com/news/109468.html", "time": "2016-07-24", "level": "", "num_look": 331931, "num_comment": 4, "author": "饭团君", "tags": ["资讯"], "text": "反恐数据库在暗网上出售。"}
{"title": "VirLock敲诈者新变种分析及解密方法", "url": "https://www.freebuf.com/articles/system/109834.html", "time": "2016-07-24", "level": "", "num_look": 282760, "num_comment": 6, "author": "360安全", "tags": ["安全报告", "系统安全"], "text": "VirLock的新变种的查杀量呈现上升趋势，通过分析，发现其新变种采用了多种手段来对抗杀软。"}
{"title": "【FB TV】一周「BUF大事件」（201600716-20160722）", "url": "https://www.freebuf.com/news/109892.html", "time": "2016-07-23", "level": "红色标题", "num_look": 278160, "num_comment": 7, "author": "supercoco", "tags": ["视频", "资讯"], "text": "本周全球范围内发生了哪些安全大事件？FB主播告诉你。"}
{"title": "使用Python工具分析风险数据", "url": "https://www.freebuf.com/sectool/109479.html", "time": "2016-07-23", "level": "", "num_look": 502149, "num_comment": 11, "author": "岂安科技", "tags": ["工具", "数据安全"], "text": "工欲善其事，必先利其器，本文向大家介绍一些Python数据分析的“神兵利器“。"}
{"title": "扑面而来的“技术宅”气息：CFF·黑客秀纪实", "url": "https://www.freebuf.com/fevents/109897.html", "time": "2016-07-23", "level": "", "num_look": 268773, "num_comment": 12, "author": "欧阳洋葱", "tags": ["活动", "特别企划"], "text": "“大暑”是一年中最热的时候，2016中国网络空间安全（上海）论坛选在这个时间点前后开办，大约也是想借三伏天的“火热”气势。"}
{"title": "2016上半年DDoS攻击报告：DDoS攻击的规模和攻击频率都在不断攀升", "url": "https://www.freebuf.com/news/109639.html", "time": "2016-07-23", "level": "", "num_look": 442260, "num_comment": 7, "author": "bimeover", "tags": ["网络安全", "资讯"], "text": "2016年上半年，规模最大的DDoS攻击流量达到579Gb/s，较2015年提高73%。"}
{"title": "Python渗透测试框架：PytheM", "url": "https://www.freebuf.com/sectool/109816.html", "time": "2016-07-22", "level": "金币+9", "num_look": 484698, "num_comment": 7, "author": "felix", "tags": ["工具"], "text": "PytheM是一个Python渗透测试框架"}
{"title": "美国大选选民登记数据在暗网大肆贩卖", "url": "https://www.freebuf.com/news/109406.html", "time": "2016-07-22", "level": "金币+9", "num_look": 325482, "num_comment": 4, "author": "banish", "tags": ["网络安全", "资讯"], "text": "黑客在暗网大肆贩卖美国大选选民的登记数据，美国选举协助委员协会对此却一无所知。"}
{"title": "NSA局长：美军网络部队已处于战备状态", "url": "https://www.freebuf.com/news/109753.html", "time": "2016-07-22", "level": "", "num_look": 276061, "num_comment": 6, "author": "clouds", "tags": ["资讯"], "text": "网络司令部下属的网络任务部队（Cyber Mission Force,CMF）将在9月30日前完成初始作战能力建设。"}
{"title": "中国新型Web Shell “菜刀-Cknife”遭国外安全公司曝光", "url": "https://www.freebuf.com/news/109776.html", "time": "2016-07-22", "level": "金币+9", "num_look": 921835, "num_comment": 33, "author": "米雪儿", "tags": ["WEB安全", "资讯"], "text": "该新型Webshell工具，名为“Cknife”，2015年12月首发。"}
{"title": "一款能把你的摄像头连上暗网的Mac恶意软件", "url": "https://www.freebuf.com/articles/terminal/109472.html", "time": "2016-07-22", "level": "", "num_look": 299509, "num_comment": 9, "author": "Sphinx", "tags": ["终端安全"], "text": "一款名为Backdoor.MAC.Eleanor的恶意软件悄然植入到了虚假软件EasyDoc Coverter.app中，并且将你的摄像头暴露在暗网中。"}
{"title": "对一次网络钓鱼攻击的逆向分析", "url": "https://www.freebuf.com/articles/web/109563.html", "time": "2016-07-22", "level": "", "num_look": 411768, "num_comment": 3, "author": "clouds", "tags": ["WEB安全"], "text": "最近发现的两个钓鱼攻击域名，成功攻击了超过1000名用户，而且后来又牵扯出一堆钓鱼域名。"}
{"title": "iPhone和Mac用户请注意：接收一条MMS消息，你的密码可能就被盗了", "url": "https://www.freebuf.com/news/109758.html", "time": "2016-07-21", "level": "红色标题", "num_look": 607729, "num_comment": 16, "author": "欧阳洋葱", "tags": ["漏洞", "资讯"], "text": "这次曝光的高危漏洞影响范围波及iPhone、iPod touch、Apple TV、Apple Watch、Mac设备。"}
{"title": "Linux Rootkit 系列五：感染系统关键内核模块实现持久化", "url": "https://www.freebuf.com/articles/system/109034.html", "time": "2016-07-21", "level": "现金奖励", "num_look": 378988, "num_comment": 10, "author": "novice", "tags": ["系统安全"], "text": "Linux Rootkit 系列五之感染系统关键内核模块实现持久化。"}
{"title": "销声匿迹后，黑市xDedic再次「重出江湖」", "url": "https://www.freebuf.com/news/109254.html", "time": "2016-07-21", "level": "", "num_look": 230687, "num_comment": 9, "author": "anyway5", "tags": ["资讯"], "text": "xDedic黑市再一次在Tor中出现，之前用户在这一平台上的注册是免费的，而这次新用户完成注册需要另外支付50美元。"}
{"title": "走近科学：Chrome恶意插件如何入侵用户计算机？", "url": "https://www.freebuf.com/vuls/109703.html", "time": "2016-07-21", "level": "金币+9", "num_look": 592622, "num_comment": 8, "author": "dawner", "tags": ["WEB安全", "漏洞"], "text": "在这篇文章中，笔者将分享身边一个感染恶意插件的案例。"}
{"title": "苏宁易购安全部门招聘", "url": "https://www.freebuf.com/jobs/109572.html", "time": "2016-07-21", "level": "", "num_look": 349846, "num_comment": 15, "author": "欧阳洋葱", "tags": ["安全招聘"], "text": "苏宁易购，是苏宁电器旗下新一代B2C网上购物平台（www.suning.com）。"}
{"title": "Tunnel：论如何在内网中自由渗透", "url": "https://www.freebuf.com/sectool/109223.html", "time": "2016-07-21", "level": "现金奖励", "num_look": 842178, "num_comment": 37, "author": "戒贤", "tags": ["工具", "网络安全"], "text": "能够成功地通过web漏洞获取到webshell，对于一次完整的渗透测试来说，仅仅相当于万里长征的第一步。"}
{"title": "业界：网络安全分析平台Bay Dynamics获2300万美元融资", "url": "https://www.freebuf.com/news/109519.html", "time": "2016-07-21", "level": "金币+5", "num_look": 175122, "num_comment": 11, "author": "米雪儿", "tags": ["资讯"], "text": "近日，网络安全分析平台Bay Dynamics完成了由Carrick Capital Partners领投的2300万美元的B轮融资。"}
{"title": "FreeBuf登陆日 | 说出你和FB的故事", "url": "https://www.freebuf.com/fevents/109693.html", "time": "2016-07-20", "level": "红色标题", "num_look": 786759, "num_comment": 68, "author": "FB客服", "tags": ["活动"], "text": "FreeBuf六周年，说说你和FB的故事"}
{"title": "揭秘：攻击者如何在Kali Linux中搭建钓鱼热点", "url": "https://www.freebuf.com/articles/wireless/108830.html", "time": "2016-07-20", "level": "", "num_look": 1136047, "num_comment": 24, "author": "漏洞盒子", "tags": ["无线安全"], "text": "通过这篇文章向您揭秘：黑客是如何搭建钓鱼热点并入侵受害者账户的。"}
{"title": "玩Pokémon GO前你必须要注意这6件事", "url": "https://www.freebuf.com/news/109500.html", "time": "2016-07-20", "level": "", "num_look": 224090, "num_comment": 11, "author": "bimeover", "tags": ["资讯"], "text": "《精灵宝可梦Go》（《Pokémon GO》）仅发布两周，风靡全球，玩家已沉迷于抓精灵无法自拔。"}
{"title": "大量医疗数据被倒卖，究竟谁该担责？", "url": "https://www.freebuf.com/news/108959.html", "time": "2016-07-20", "level": "", "num_look": 330842, "num_comment": 3, "author": "饭团君", "tags": ["安全管理", "观点"], "text": ""}
{"title": "ISIS顶级圣战论坛管理员被黑，数据资料遭泄露", "url": "https://www.freebuf.com/news/109571.html", "time": "2016-07-20", "level": "", "num_look": 231909, "num_comment": 4, "author": "clouds", "tags": ["资讯"], "text": "Abu Alaaina Khorasani，一位被专家称为网络圣战论坛“著名”成员的顶级ISIS网络论坛管理员，其相关账户被黑客入侵，造成了资料泄露。"}
{"title": "用人工智能来检测和修复漏洞？比人类快百倍", "url": "https://www.freebuf.com/news/109380.html", "time": "2016-07-20", "level": "", "num_look": 344259, "num_comment": 21, "author": "饭团君", "tags": ["资讯"], "text": "要是有套系统能自动发现并修复漏洞，而且速度还比人类快几百倍，人类岂不是舒服多了？"}
{"title": "【企业研究报告】FreeBuf Insight：网络安全创新企业Top 10解读之Sophos", "url": "https://www.freebuf.com/news/108453.html", "time": "2016-07-20", "level": "红色标题", "num_look": 410270, "num_comment": 5, "author": "FreeBuf咨询", "tags": ["头条", "安全报告"], "text": "安全企业创新Top 10系列文章首篇谈的是一家名为Sophos的企业，这究竟是家什么样的公司？"}
{"title": "攻防对抗中，企业如何像黑客一样思考", "url": "https://www.freebuf.com/articles/security-management/108810.html", "time": "2016-07-19", "level": "金币+5", "num_look": 483396, "num_comment": 20, "author": "米雪儿", "tags": ["企业安全", "安全管理"], "text": "企业需要改变自身的思维方式，通过模拟黑客攻击来不断地锻炼自己的安全防御和运营团队。"}
{"title": "Httpoxy远程代理感染漏洞", "url": "https://www.freebuf.com/vuls/109451.html", "time": "2016-07-19", "level": "金币+5", "num_look": 632859, "num_comment": 12, "author": "banish", "tags": ["漏洞", "网络安全"], "text": "一个漏洞隐藏了15年的时间，今天它终于被曝光了。"}
{"title": "被控盗取航空机密，中国公民苏斌被美国判处46个月监禁", "url": "https://www.freebuf.com/news/109389.html", "time": "2016-07-19", "level": "", "num_look": 573959, "num_comment": 25, "author": "anyway5", "tags": ["资讯"], "text": "近日，美国对中国“黑客”苏斌进行了宣判，判决46个月的监禁。"}
{"title": "国内APP漏洞扫描收费情况调查", "url": "https://www.freebuf.com/news/109218.html", "time": "2016-07-19", "level": "现金奖励", "num_look": 323844, "num_comment": 8, "author": "Sunnieli", "tags": ["资讯"], "text": "其实在选择市面上这些移动安全类的产品时，经常为各种复杂的数据而感到疑惑，不知道怎么来评判各自的性能以及价格，从而选择出一款性价比高的安全产品。"}
{"title": "Badtunnel远程恶意劫持利用", "url": "https://www.freebuf.com/articles/web/109345.html", "time": "2016-07-19", "level": "", "num_look": 460299, "num_comment": 12, "author": "四维创智", "tags": ["WEB安全"], "text": "Badtunnel远程劫持漏洞详解和利用。"}
{"title": "为什么这么多创业公司都在做“蜜罐”？也许这篇文章能告诉你", "url": "https://www.freebuf.com/articles/database/109322.html", "time": "2016-07-19", "level": "现金奖励", "num_look": 1398321, "num_comment": 30, "author": "bt0sea", "tags": ["数据安全", "特别企划"], "text": "很多行业包括金融机构是不允许在业务服务器上安装安全解决方案的，甚至配置日志系统都不可以，那么，目前部署蜜罐是最好的解决方案了。"}
{"title": "台湾ATM机遭黑客攻击被窃7000万的背后", "url": "https://www.freebuf.com/news/109304.html", "time": "2016-07-19", "level": "", "num_look": 343880, "num_comment": 9, "author": "banish", "tags": ["终端安全", "资讯"], "text": "此案作为台湾的第一起银行自动取款机遭受恶意攻击案件而引起执法机关的高度重视。"}
{"title": "傲游浏览器把全球用户的这些数据偷偷传回了北京服务器……", "url": "https://www.freebuf.com/news/109418.html", "time": "2016-07-18", "level": "红色标题", "num_look": 612319, "num_comment": 36, "author": "欧阳洋葱", "tags": ["数据安全", "资讯"], "text": "老外最近正在关注傲游浏览器的一些小动作：它会周期性地将用户数据传回中国北京。"}
{"title": "TaintDroid剖析之DVM变量级污点跟踪（下篇）", "url": "https://www.freebuf.com/articles/terminal/109339.html", "time": "2016-07-18", "level": "", "num_look": 160759, "num_comment": 160759, "author": "阿里聚安全", "tags": ["终端安全"], "text": "TaintDroid对类的静态域、实例域以及数组的污点跟踪的分析。"}
{"title": "解读联想预装程序LSC的三个CVE高危漏洞", "url": "https://www.freebuf.com/vuls/109255.html", "time": "2016-07-18", "level": "", "num_look": 249425, "num_comment": 4, "author": "clouds", "tags": ["漏洞"], "text": "联想电脑预装程序LSC曾在去年被爆出严重安全问题。近期，该程序的多个安全问题导致了三个 CVE 高危漏洞。"}
{"title": "Ubuntu官网论坛再次被黑，又是SQL注入惹的祸", "url": "https://www.freebuf.com/news/109312.html", "time": "2016-07-18", "level": "", "num_look": 337868, "num_comment": 15, "author": "dawner", "tags": ["资讯"], "text": "近日Ubuntu官方论坛被黑，泄露了超过200万数据，本次泄露的用户数据包括IP地址、用户名和电子邮件地址。"}
{"title": "D-Link云摄像头超过120款产品存在漏洞，约40万台设备受影响", "url": "https://www.freebuf.com/news/108870.html", "time": "2016-07-18", "level": "", "num_look": 245806, "num_comment": 3, "author": "anyway5", "tags": ["资讯"], "text": "之前也有过摄像头存在安全漏洞，隐私被泄露出去的事件。这次事件的主角轮到了D-Link云摄像头。"}
{"title": "BruteXSS：XSS暴力破解神器", "url": "https://www.freebuf.com/sectool/109239.html", "time": "2016-07-18", "level": "金币+10", "num_look": 966676, "num_comment": 27, "author": "ymmy", "tags": ["工具"], "text": "本文介绍了一款自动进行插入XSS，并且可以自定义攻击载荷。"}
{"title": "攻击检测和防范方法之日志分析", "url": "https://www.freebuf.com/articles/web/109001.html", "time": "2016-07-18", "level": "现金奖励", "num_look": 823268, "num_comment": 5, "author": "shewey", "tags": ["WEB安全", "数据安全"], "text": "本文主要考虑如何通过日志分析技术实现对攻击的检测和防范技术。"}
{"title": "知名商业软件“喂养”病毒产业链：“Toxik”病毒追踪", "url": "https://www.freebuf.com/articles/system/109112.html", "time": "2016-07-18", "level": "现金奖励", "num_look": 721452, "num_comment": 37, "author": "火绒安全", "tags": ["安全报告", "特别企划"], "text": "许多知名商业软件（包括某些安全软件）在明明知情的情况下，却利用病毒或黑产组织推广自家产品——从某种意义上来说，是知名软件公司们“喂养”着众多病毒制造者。"}
{"title": "2016 FreeTalk沙龙深圳站•议题征集", "url": "https://www.freebuf.com/fevents/109048.html", "time": "2016-07-17", "level": "", "num_look": 259565, "num_comment": 12, "author": "FB客服", "tags": ["活动"], "text": "时隔两年，FreeTalk将再次来到深圳。只要你的议题具有一定的技术含量，经验、想法或思路能够令人耳目一新，那你就能站上FreeTalk的分享平台。"}
{"title": "FB商城新品上架｜新奇好物等你来抢", "url": "https://www.freebuf.com/news/109280.html", "time": "2016-07-17", "level": "", "num_look": 187853, "num_comment": 16, "author": "FB客服", "tags": ["资讯"], "text": "FreeBuf商城更新啦！！！"}
{"title": "这是一款仅针对「中国网民」的勒索软件（含源码下载）", "url": "https://www.freebuf.com/news/109242.html", "time": "2016-07-17", "level": "红色标题", "num_look": 458074, "num_comment": 18, "author": "饭团君", "tags": ["资讯"], "text": "该恶意勒索软件源码在几个月前出现在了GitHub上，上面显示开发者是中国的工程师马升豪。"}
{"title": "SQLCipher之攻与防", "url": "https://www.freebuf.com/articles/database/108904.html", "time": "2016-07-17", "level": "金币+10", "num_look": 421153, "num_comment": 6, "author": "titan39", "tags": ["数据安全"], "text": "SQLite是一个轻量的、跨平台的、开源的数据库引擎，它的在读写效率、消耗总量、延迟时间和整体简单性上具有的优越性，使其成为移动平台数据库的最佳解决方案。"}
{"title": "【FB TV】一周「BUF大事件」（201600709-20160715）", "url": "https://www.freebuf.com/news/109201.html", "time": "2016-07-16", "level": "红色标题", "num_look": 313219, "num_comment": 2, "author": "FB视频", "tags": ["视频", "资讯"], "text": "Pokémon Go捕捉小精灵好有趣，小心恶意软件暗处埋伏。"}
{"title": "匿名者（Anonymous）组织成功入侵南非国防局武器供应商服务器", "url": "https://www.freebuf.com/news/108996.html", "time": "2016-07-16", "level": "", "num_look": 257867, "num_comment": 16, "author": "米雪儿", "tags": ["资讯"], "text": "知名黑客组织“匿名者”（Anonymous）已经成功攻击了Armscor服务器，并泄露了相关数据。Armscor是南非的官方武器采购机构，负责南非国防部的武器和军事装备供应。"}
{"title": "暗云ⅡBootKit木马分析", "url": "https://www.freebuf.com/articles/system/109096.html", "time": "2016-07-15", "level": "", "num_look": 601277, "num_comment": 17, "author": "腾讯电脑管家", "tags": ["安全报告", "系统安全"], "text": "新发现的暗云木马在模块分工、技术对抗等方面与老暗云相比有着明显的晋级特征，因此我们将本次爆发的木马取名为暗云Ⅱ。"}
{"title": "漏洞盒子｜六月白帽风云榜", "url": "https://www.freebuf.com/news/109037.html", "time": "2016-07-15", "level": "", "num_look": 211991, "num_comment": 4, "author": "FB客服", "tags": ["资讯"], "text": "漏洞盒子之六月风云榜，快来看看你是否在榜单内吧！"}
{"title": "全面梳理TheCthulhu网站公布的那些泄露数据，并扒一扒TheCthulhu其人", "url": "https://www.freebuf.com/news/topnews/109125.html", "time": "2016-07-15", "level": "现金奖励", "num_look": 629975, "num_comment": 13, "author": "clouds", "tags": ["头条", "特别企划"], "text": "一个“神奇”的网站出现了，该网站通过匿名方式获取并公布了一些重要泄露数据，如FBI-DHS雇员信息、CIA局长邮箱信息、NASA无人机信息、Myspace和LinkedIn泄露数据等。"}
{"title": "智能穿戴设备会泄露你的银行卡密码？", "url": "https://www.freebuf.com/news/108856.html", "time": "2016-07-15", "level": "", "num_look": 169686, "num_comment": 3, "author": "饭团君", "tags": ["资讯"], "text": "智能穿戴设备超级酷，不过……小心你的银行卡密码啊喂！"}
{"title": "Bugcrowd白帽风云榜：全球TOP7 「漏洞猎人」", "url": "https://www.freebuf.com/news/109067.html", "time": "2016-07-15", "level": "金币+9", "num_look": 437925, "num_comment": 13, "author": "米雪儿", "tags": ["特别企划", "资讯"], "text": "在全球各地，有这样一群人，他们每天足不出户，只是坐在电脑前；他们不干别的，每天就在各大网站找bug找漏洞。"}
{"title": "谷歌Chrome加入防篡改系统，可抵御量子计算机攻击", "url": "https://www.freebuf.com/news/108843.html", "time": "2016-07-15", "level": "金币+9", "num_look": 273398, "num_comment": 15, "author": "dawner", "tags": ["资讯"], "text": "谷歌Chrome浏览器的金丝雀（Canary）版本不一般。"}
{"title": "ISC 2016召开在即：这次的规模那是相当大", "url": "https://www.freebuf.com/news/109134.html", "time": "2016-07-14", "level": "", "num_look": 185047, "num_comment": 11, "author": "欧阳洋葱", "tags": ["资讯"], "text": "将于8月16日在国家会议中心举行的第四届中国互联网安全大会ISC 2016，筹备工作已经就绪。"}
{"title": "2016阿里安全峰会第二天：有哪些好玩的议题？", "url": "https://www.freebuf.com/fevents/109119.html", "time": "2016-07-14", "level": "", "num_look": 307854, "num_comment": 9, "author": "欧阳洋葱", "tags": ["活动"], "text": "2016阿里安全峰会的第二日开设了12个分论坛，每个论坛都有不少主题演讲，干货不少。"}
{"title": "NeutrinoEK来袭：爱拍网遭敲诈者病毒挂马", "url": "https://www.freebuf.com/articles/web/109062.html", "time": "2016-07-14", "level": "", "num_look": 291692, "num_comment": 14, "author": "360安全", "tags": ["WEB安全"], "text": "360安全团队检测到在爱拍网（aipai.com）上出现国外攻击包挂马传播敲诈者病毒的情况，这就是著名的NeutrinoEK。"}
{"title": "攻击中东欧的间谍工具集", "url": "https://www.freebuf.com/news/108937.html", "time": "2016-07-14", "level": "", "num_look": 305325, "num_comment": 9, "author": "felix", "tags": ["工具", "资讯"], "text": "在过去的一年里，ESET检测并分析了若干有针对性的进行间谍活动的恶意软件，被称作SBDH工具集。"}
{"title": "【已结束】2016阿里安全峰会视频&图文直播（LIVE）", "url": "https://www.freebuf.com/fevents/108911.html", "time": "2016-07-14", "level": "红色标题", "num_look": 966653, "num_comment": 966653, "author": "FB独家", "tags": ["活动"], "text": "作为阿里安全峰会的战略媒体支持、阿里安全峰会“安全攻防论坛”出品方，FreeBuf届时将全程图文直播此次盛会"}
{"title": "1.4亿小米手机受远程执行代码漏洞影响", "url": "https://www.freebuf.com/news/108995.html", "time": "2016-07-14", "level": "", "num_look": 378962, "num_comment": 20, "author": "米雪儿", "tags": ["漏洞", "资讯"], "text": "该漏洞存在于旧版MIUI分析套件中，被MIUI的多个应用程式使用。小米方面早些时候释出MIUI 7.2全球稳定版意图修补该漏洞，并呼吁用户尽快更新。"}
{"title": "反欺诈组织Cifas调查报告：一起来看看欺诈业现状", "url": "https://www.freebuf.com/articles/database/108755.html", "time": "2016-07-14", "level": "", "num_look": 342672, "num_comment": 5, "author": "dawner", "tags": ["安全报告", "数据安全"], "text": "防欺诈组织Cifas发布报告，一起来看看欺诈行业的市场现状如何。"}
{"title": "如何编写Windows安全检查脚本？（简化为批处理）", "url": "https://www.freebuf.com/sectool/108682.html", "time": "2016-07-14", "level": "现金奖励", "num_look": 526743, "num_comment": 20, "author": "鬼魅羊羔", "tags": ["工具", "系统安全"], "text": "Windows系统问题太多，要关注的地方也数不胜数，做日常检查，真的要一个命令一个命令的翻，确实麻烦。"}
{"title": "安卓破解版Pokémon Go？DroidJack木马开始蔓延", "url": "https://www.freebuf.com/news/109023.html", "time": "2016-07-13", "level": "", "num_look": 231427, "num_comment": 3, "author": "dawner", "tags": ["资讯"], "text": "风头正劲的Pokémon Go（口袋妖怪Go）当之无愧成为了安卓和iphone中最受欢迎的游戏。"}
{"title": "“聚力赋能”的全面扩张：2016阿里安全峰会首日深度解析", "url": "https://www.freebuf.com/fevents/109010.html", "time": "2016-07-13", "level": "红色标题", "num_look": 295104, "num_comment": 4, "author": "欧阳洋葱", "tags": ["活动", "特别企划"], "text": "2016阿里安全峰会今年的主题是“聚力赋能”，实际上阿里一直在提这个概念，那么这次有什么新货吗？"}
{"title": "51信用卡管家招聘Web安全工程师", "url": "https://www.freebuf.com/jobs/108913.html", "time": "2016-07-13", "level": "", "num_look": 269027, "num_comment": 12, "author": "51信用卡管家", "tags": ["安全招聘"], "text": "这是一个在半年内拿到数轮融资的创业公司（清流资本、SIG资本三大），这是一个将自己定位于中国最NB的移动互联网金融公司。"}
{"title": "Struts2漏洞利用工具Devmode版发布（附带源码）", "url": "https://www.freebuf.com/sectool/108896.html", "time": "2016-07-13", "level": "金币+7", "num_look": 1109736, "num_comment": 12, "author": "m0ney", "tags": ["工具"], "text": "上个月月中Struts2的漏洞预警才出，这次最新的远程代码执行漏洞已经马不停蹄地赶来了。"}
{"title": "Stuxnet纪录片《Zero Days》北美上映 （附影片种子）", "url": "https://www.freebuf.com/news/108844.html", "time": "2016-07-13", "level": "", "num_look": 384630, "num_comment": 16, "author": "clouds", "tags": ["其他", "资讯"], "text": "Stuxnet蠕虫纪录片《Zero Days》来了！"}
{"title": "俄罗斯黑客组织Lurk与Angler与Necurs僵尸网络之间存在关联", "url": "https://www.freebuf.com/news/108855.html", "time": "2016-07-13", "level": "", "num_look": 164868, "num_comment": 164868, "author": "米雪儿", "tags": ["资讯"], "text": "安全专家怀疑，俄罗斯警方5月底逮捕黑客组织Lurk与之后钓鱼攻击工具包Angler Exploit Kit不明所以的停止更新之间存在关联。"}
{"title": "「安全大咖说」专访360核心安全负责人：郑文彬（MJ0011）| FB视频", "url": "https://www.freebuf.com/video/108532.html", "time": "2016-07-13", "level": "红色标题", "num_look": 655274, "num_comment": 19, "author": "Sophia", "tags": ["人物志", "视频"], "text": "MJ曾发现多个Windows安全漏洞并获得微软致谢，号称“中国内核安全第一人”。"}
{"title": "使用GnuRadio + OpenLTE + SDR 搭建4G LTE 基站（上）", "url": "https://www.freebuf.com/articles/wireless/108417.html", "time": "2016-07-13", "level": "红色标题", "num_look": 1809261, "num_comment": 25, "author": "漏洞盒子", "tags": ["无线安全", "极客"], "text": "国外安全大会上从数年前2G GSM攻击议题到近期的LTE 4G安全议题，基站通信安全一直备受安全爱好者关注。"}
{"title": "业界：网络安全的“战国时代”来临，永信至诚发起亿元创投基金", "url": "https://www.freebuf.com/fevents/108918.html", "time": "2016-07-12", "level": "", "num_look": 198926, "num_comment": 198926, "author": "欧阳洋葱", "tags": ["活动"], "text": "永信至诚今天上午正式登录新三板，下午又举办了一场题为开启网络安全“战国时代”的发布会。"}
{"title": "漏洞预警：Struts2 devMode导致远程代码执行漏洞", "url": "https://www.freebuf.com/news/108924.html", "time": "2016-07-12", "level": "红色标题", "num_look": 877698, "num_comment": 5, "author": "漏洞盒子", "tags": ["漏洞", "资讯"], "text": "当Struts2开启devMode模式时，将导致严重远程代码执行漏洞。"}
{"title": "黑客+摇滚=？与FreeBuf一起揭开谜底", "url": "https://www.freebuf.com/news/108875.html", "time": "2016-07-12", "level": "", "num_look": 262962, "num_comment": 19, "author": "知道创宇", "tags": ["资讯"], "text": "七月下旬听黑客自己的摇滚乐，一起High！"}
{"title": "宝马车载娱乐系统ConnectedDrive曝远程操控0day漏洞", "url": "https://www.freebuf.com/vuls/108841.html", "time": "2016-07-12", "level": "", "num_look": 344169, "num_comment": 4, "author": "dawner", "tags": ["WEB安全", "漏洞"], "text": "安全研究员BenjaminKunz Mejri在向宝马官方提交漏洞五个月后（官方还是没打补丁），昨日公布了两个Web 0day漏洞。"}
{"title": "拥有300万安装量的应用是如何恶意推广刷榜的？", "url": "https://www.freebuf.com/articles/terminal/108849.html", "time": "2016-07-12", "level": "", "num_look": 287337, "num_comment": 8, "author": "阿里聚安全", "tags": ["终端安全"], "text": "近期，阿里移动安全发现一款名叫“魔百Wi-Fi”应用，该应用官方的一个版本捆绑了多个病毒，目的是对GooglePlay 商店应用刷榜和刷大量未知应用安装量。"}
{"title": "IBM报告解读：交通运输行业成为网络攻击高风险目标", "url": "https://www.freebuf.com/news/108592.html", "time": "2016-07-12", "level": "", "num_look": 178088, "num_comment": 1, "author": "饭团君", "tags": ["安全报告", "资讯"], "text": "交通运输行业的网络服务越来越便捷，同时风险也越来越高。"}
{"title": "解剖最近被发现的Mac OS木马 - OSX/Keydnap", "url": "https://www.freebuf.com/articles/system/108732.html", "time": "2016-07-12", "level": "金币+7", "num_look": 367240, "num_comment": 6, "author": "clouds", "tags": ["系统安全"], "text": "近期，ESET安全公司发现了一例针对Mac 用户的恶意木马程序 OSX/Keydnap，该恶意程序窃取苹果系统密码信息并驻留于Mac OS系统中成为后门木马。"}
{"title": "不解密数据竟也能识别TLS加密的恶意流量？", "url": "https://www.freebuf.com/news/108628.html", "time": "2016-07-12", "level": "", "num_look": 516622, "num_comment": 3, "author": "欧阳洋葱", "tags": ["网络安全", "资讯"], "text": "企业一般流量和恶意流量如果都采用TLS协议，其实有办法在不对数据做解密的情况下将恶意流量识别出来。"}
{"title": "WordPress插件Jetpack存储型XSS漏洞原理分析及复现", "url": "https://www.freebuf.com/vuls/108611.html", "time": "2016-07-11", "level": "现金奖励", "num_look": 353402, "num_comment": 2, "author": "ArkTeam", "tags": ["WEB安全", "漏洞"], "text": "WordPress母公司Automattic发布了插件Jetpack 4.0.3版本，修复了一个威胁程度较高的存储型XSS漏洞，小于4.0.3的版本都会被影响。"}
{"title": "亚马逊泄露8万多名Kindle用户密码？", "url": "https://www.freebuf.com/news/108800.html", "time": "2016-07-11", "level": "", "num_look": 227448, "num_comment": 4, "author": "欧阳洋葱", "tags": ["资讯"], "text": "最近有名黑客宣称攻入了亚马逊的一台服务器，还公布了8万多名Kindle用户登录信息，但好像情况没那么简单。"}
{"title": "文件监控程序V2.0改进版（网站防挂马好手）", "url": "https://www.freebuf.com/sectool/108387.html", "time": "2016-07-11", "level": "现金奖励", "num_look": 524211, "num_comment": 45, "author": "鬼魅羊羔", "tags": ["工具"], "text": "前段时间给一个客户维护服务器，服务器总是被挂马，装了个某狗，然后并没有解决问题，到不是说安全狗不行，是现在很多防护软件并不贴心啊。"}
{"title": "躲不掉的红色炸弹，这次真的「爆」了", "url": "https://www.freebuf.com/articles/terminal/108731.html", "time": "2016-07-11", "level": "现金奖励", "num_look": 592310, "num_comment": 17, "author": "expsky", "tags": ["终端安全"], "text": "收到朋友的婚宴请帖后通常都要破费，而且不便躲避，所以请帖也俗称红色炸弹，而这次的红色炸弹真的就爆了！"}
{"title": "自动化恶意软件分析系统Cuckoo安装、配置详解", "url": "https://www.freebuf.com/sectool/108533.html", "time": "2016-07-11", "level": "", "num_look": 1135518, "num_comment": 14, "author": "深信服千里目安全实验室", "tags": ["工具"], "text": "Cuckoo 是一款用 Python 编写的开源的自动化恶意软件分析系统。"}
{"title": "揭秘Patchwork APT攻击 ：一个与中国南海和东南亚问题相关的网络攻击组织", "url": "https://www.freebuf.com/articles/network/108637.html", "time": "2016-07-11", "level": "金币+12", "num_look": 665972, "num_comment": 9, "author": "clouds", "tags": ["安全报告", "网络安全"], "text": "一个与东南亚和中国南海问题相关，并以包括美国在内的全球政府和公司为目标的APT攻击被发现 。"}
{"title": "Flash XSS检测脚本的简单实现", "url": "https://www.freebuf.com/sectool/108568.html", "time": "2016-07-10", "level": "现金奖励", "num_look": 491300, "num_comment": 7, "author": "whoamisb", "tags": ["WEB安全", "工具"], "text": "这里主要是讲如何快速扫描到有问题的flash文件，用于批量，有时候很笨的方法也会有奇效，下面记录一下在实现过程中的一些思路和遇到的一些坑。"}
{"title": "来自入侵美国民主党委员会的黑客自白书", "url": "https://www.freebuf.com/news/108571.html", "time": "2016-07-09", "level": "金币+12", "num_look": 205161, "num_comment": 8, "author": "clouds", "tags": ["资讯"], "text": "近日，GUCCIFER 2.0在其WORDPRESS空间上就入侵事件作了「自白」。"}
{"title": "360安全路由HackPwn大赛悬赏60万给自己“找茬”", "url": "https://www.freebuf.com/fevents/108530.html", "time": "2016-07-09", "level": "", "num_look": 203394, "num_comment": 9, "author": "360安全", "tags": ["活动"], "text": "360安全路由HackPwn大赛悬赏60万给自己“找茬”。"}
{"title": "一周「BUF大事件」（201600702-20160708）", "url": "https://www.freebuf.com/video/108646.html", "time": "2016-07-09", "level": "红色标题", "num_look": 279897, "num_comment": 7, "author": "supercoco", "tags": ["视频"], "text": "充实的一周又结束了…"}
{"title": "两名中国“ATM黑客”遭巴基斯坦警方调查", "url": "https://www.freebuf.com/news/108341.html", "time": "2016-07-09", "level": "", "num_look": 273563, "num_comment": 8, "author": "饭团君", "tags": ["终端安全", "资讯"], "text": "巴基斯坦联邦调查局最近正在调查一起用ATM分离器盗取信用卡的案子，涉案两名犯罪分子都是中国人。"}
{"title": "图解6月全球安全事件", "url": "https://www.freebuf.com/news/108598.html", "time": "2016-07-09", "level": "", "num_look": 189884, "num_comment": 2, "author": "青藤云安全", "tags": ["资讯"], "text": "2016年6月安全事件大合集。"}
{"title": "漏洞预警：Spring Boot框架表达式注入漏洞", "url": "https://www.freebuf.com/news/108665.html", "time": "2016-07-08", "level": "", "num_look": 584258, "num_comment": 2, "author": "漏洞盒子", "tags": ["漏洞", "资讯"], "text": "Spring Boot框架的SpEL表达式注入通用漏洞最新曝光。"}
{"title": "RDP连接降级攻击以及规避方法解析", "url": "https://www.freebuf.com/articles/system/108346.html", "time": "2016-07-08", "level": "金币+12", "num_look": 476099, "num_comment": 4, "author": "felix", "tags": ["系统安全", "网络安全"], "text": "如果终端服务器配置不正确，那么RDP连接就可能面临降级攻击的风险。"}
{"title": "十八岁白帽子与“攻陷五角大楼”众测计划", "url": "https://www.freebuf.com/news/108454.html", "time": "2016-07-08", "level": "", "num_look": 257568, "num_comment": 19, "author": "ArthurKiller", "tags": ["资讯"], "text": "让我们震惊的是这次参加计划的黑客里面有一名18岁的高中生。"}
{"title": "安洵信息招聘安全人才", "url": "https://www.freebuf.com/jobs/108481.html", "time": "2016-07-08", "level": "", "num_look": 321353, "num_comment": 9, "author": "安洵信息", "tags": ["安全招聘"], "text": "安洵信息招聘渗透测试工程师与安全研发工程师各5人"}
{"title": "如何编写自己的Linux安全检查脚本？", "url": "https://www.freebuf.com/sectool/108564.html", "time": "2016-07-08", "level": "现金奖励", "num_look": 762210, "num_comment": 29, "author": "鬼魅羊羔", "tags": ["工具"], "text": "脚本大致内容：基本信息统计（IP地址、MAC地址、端口信息、服务信息等）、主机安全检查（包括等保三级要求主机相关的检查点）、系统性能统计、恶意代码、程序检查等。"}
{"title": "Dark Reading年中数据泄露报告：2016年TOP7安全事件盘点", "url": "https://www.freebuf.com/news/108298.html", "time": "2016-07-08", "level": "金币+12", "num_look": 252839, "num_comment": 2, "author": "米雪儿", "tags": ["安全报告", "资讯"], "text": "说起今年的重大安全事件，你脑海里浮现的是哪几起？"}
{"title": "围观2016年最活跃的“顶级Exploit Kit”", "url": "https://www.freebuf.com/news/108512.html", "time": "2016-07-08", "level": "金币+12", "num_look": 343032, "num_comment": 6, "author": "米雪儿", "tags": ["安全报告", "资讯"], "text": "一起瞧瞧当下最活跃的流行工具包：Angler，RIG和Neutrino"}
{"title": "“中国”制造：悍马（Hummer）病毒家族技术分析报告", "url": "https://www.freebuf.com/news/108561.html", "time": "2016-07-07", "level": "红色标题", "num_look": 462272, "num_comment": 28, "author": "猎豹移动威胁情报中心", "tags": ["特别企划", "资讯"], "text": "猎豹移动安全实验室对某移动端木马的详细分析"}
{"title": "悲剧，TP-LINK官方域名被匿名人士注册了……", "url": "https://www.freebuf.com/news/108521.html", "time": "2016-07-07", "level": "红色标题", "num_look": 530793, "num_comment": 34, "author": "ArthurKiller", "tags": ["资讯"], "text": "小编才得到这个消息的时候是一脸的懵逼。。。"}
{"title": "俄罗斯黑客破解了游戏加密技术Denuvo", "url": "https://www.freebuf.com/news/108206.html", "time": "2016-07-07", "level": "", "num_look": 279945, "num_comment": 8, "author": "饭团君", "tags": ["资讯"], "text": "Denuvo加密技术可以防止第三方对游戏进行破解，是全球最热门的游戏防破解技术之一。近日一名俄罗斯黑客可能已经掌握了一种全新破解该技术的方法。"}
{"title": "Linux Rootkit 系列四：对于系统调用挂钩方法的补充", "url": "https://www.freebuf.com/articles/system/108392.html", "time": "2016-07-07", "level": "现金奖励", "num_look": 399660, "num_comment": 12, "author": "arciryas", "tags": ["系统安全"], "text": "本篇文章按照之前文章所说的，来介绍linux rootkit中的系统调用挂钩技术。"}
{"title": "iCloud艳照门第二位涉案黑客，现已认罪伏法", "url": "https://www.freebuf.com/news/108426.html", "time": "2016-07-07", "level": "", "num_look": 202947, "num_comment": 6, "author": "米雪儿", "tags": ["资讯"], "text": "近日，2014年好莱坞女星“艳照门”案件第二位涉案黑客伏法，将面临最高5年的有期徒刑。"}
{"title": "揭秘基于注册表隐藏的无文件攻击", "url": "https://www.freebuf.com/articles/system/108288.html", "time": "2016-07-07", "level": "金币+20", "num_look": 341424, "num_comment": 11, "author": "ArkTeam", "tags": ["系统安全"], "text": "最早使用该技术的是2014年GData公司发现的点击欺诈软件Poweliks。随后，多款恶意程序甚至APT组织使用这种无文件持久化攻击技术。"}
{"title": "兴华永恒(北京)招聘逆向分析工程师", "url": "https://www.freebuf.com/jobs/108228.html", "time": "2016-07-06", "level": "", "num_look": 227444, "num_comment": 12, "author": "夜未央", "tags": ["安全招聘"], "text": "兴华永恒(北京)招聘逆向分析工程师"}
{"title": "英国国防部在线网关存在漏洞，军队内部数据面临泄露威胁", "url": "https://www.freebuf.com/news/108433.html", "time": "2016-07-06", "level": "金币+20", "num_look": 207165, "num_comment": 3, "author": "clouds", "tags": ["资讯"], "text": "英国研究人员Mohammed Adel发现了英国国防部在线网关的漏洞，由于该网关系统仅限国防部内部雇员使用，可能会使攻击者获取内部信息。"}
{"title": "如何逆向破解HawkEye keylogger键盘记录器，进入攻击者邮箱？", "url": "https://www.freebuf.com/articles/system/108289.html", "time": "2016-07-06", "level": "金币+20", "num_look": 415389, "num_comment": 8, "author": "clouds", "tags": ["安全报告", "系统安全"], "text": "某黑客辛辛苦苦写了一堆脚本，不仅被别人反编译，邮箱也被盗了.....为此默哀。"}
{"title": "一家中国广告公司，如何利用恶意软件感染全球8500万台手机", "url": "https://www.freebuf.com/news/108366.html", "time": "2016-07-06", "level": "红色标题", "num_look": 931865, "num_comment": 49, "author": "欧阳洋葱", "tags": ["头条", "资讯"], "text": "最近Check Point发布了一份报告，揭露中国的一家广告公司是如何向8500万台Android手机传播恶意程序的。"}
{"title": "微软致Office 365用户：小心0day勒索软件", "url": "https://www.freebuf.com/news/108027.html", "time": "2016-07-06", "level": "", "num_look": 173606, "num_comment": 5, "author": "dawner", "tags": ["资讯"], "text": "在今时今日，如果你觉得仅仅依靠微软Office 365的安全组件就能免于被黑，那就大错特错了。"}
{"title": "TaintDroid深入剖析之启动篇", "url": "https://www.freebuf.com/articles/system/108276.html", "time": "2016-07-05", "level": "", "num_look": 311759, "num_comment": 2, "author": "阿里聚安全", "tags": ["系统安全"], "text": "TaintDroid深入剖析之启动篇"}
{"title": "短讯：黑客公布Myspace泄露数据", "url": "https://www.freebuf.com/news/108351.html", "time": "2016-07-05", "level": "金币+20", "num_look": 270134, "num_comment": 15, "author": "clouds", "tags": ["资讯"], "text": "Twitter 名为@CthulhuSec的用户曝光了大量Myspace数据信息，声称这些信息为Myspace早前几年泄露的相关信息。"}
{"title": "2016阿里安全峰会（7月13-14日），FreeBuf全程支持", "url": "https://www.freebuf.com/fevents/108328.html", "time": "2016-07-05", "level": "", "num_look": 258183, "num_comment": 8, "author": "阿里安全", "tags": ["活动"], "text": "作为阿里安全峰会的战略媒体支持、阿里安全峰会“安全攻防论坛”出品方，FreeBuf届时将全程图文直播此次盛会并带来深度报道，敬请关注！"}
{"title": "高通芯片存缺陷，可破解Android全磁盘加密", "url": "https://www.freebuf.com/news/108287.html", "time": "2016-07-05", "level": "", "num_look": 384343, "num_comment": 8, "author": "Sophia", "tags": ["资讯"], "text": "安卓的全磁盘加密技术，全让高通芯片给毁了……"}
{"title": "日本旅游业巨头JTB旅行社793万条用户数据泄露", "url": "https://www.freebuf.com/news/108304.html", "time": "2016-07-05", "level": "", "num_look": 189544, "num_comment": 10, "author": "米雪儿", "tags": ["资讯"], "text": "日本最大的旅游公司JTB Corp称，黑客窃取了公司793万条护照、家庭住址和电子邮箱地址信息。"}
{"title": "特斯拉自动驾驶事故复现分析", "url": "https://www.freebuf.com/news/108252.html", "time": "2016-07-05", "level": "", "num_look": 430598, "num_comment": 6, "author": "360安全", "tags": ["安全报告", "极客"], "text": "特斯拉自动驾驶事故详细分析"}
{"title": "动手搭建DDoS演练：揭秘在线DDoS攻击平台（下）", "url": "https://www.freebuf.com/news/107916.html", "time": "2016-07-05", "level": "红色标题", "num_look": 2084864, "num_comment": 40, "author": "ArthurKiller", "tags": ["特别企划", "网络安全"], "text": "本章将讲解DDOS脚本的使用和生成，DDOS API的搭建和利用，以及在线DDOS平台搭建的注意事项和全部源码提供。"}
{"title": "对话印度黑客：CloudSec云安全公司创始人Rahul Sasi", "url": "https://www.freebuf.com/news/107974.html", "time": "2016-07-05", "level": "", "num_look": 276416, "num_comment": 3, "author": "寰者", "tags": ["人物志", "特别企划"], "text": "Securityaffairs与印度黑客Rahul Sasi聊了什么？"}
{"title": "BrowserBackdoor：一款基于JavaScript WebSocket的后门套装", "url": "https://www.freebuf.com/sectool/107695.html", "time": "2016-07-04", "level": "", "num_look": 337789, "num_comment": 4, "author": "安小白", "tags": ["工具"], "text": "BrowserBackdoor是一款基于Electron框架的后门安全测试工具，使用JavaScriptWebSocket来连接监听器。"}
{"title": "“数”说FreeBuf六周年，感谢有你", "url": "https://www.freebuf.com/news/108235.html", "time": "2016-07-04", "level": "现金奖励", "num_look": 433457, "num_comment": 52, "author": "追影人", "tags": ["头条", "资讯"], "text": "本文来自于FB热心网友，“大数据”细说FreeBuf六周年发展历程"}
{"title": "思科为何斥资近3亿美元收购云安全提供商CloudLock？", "url": "https://www.freebuf.com/news/108119.html", "time": "2016-07-04", "level": "", "num_look": 249994, "num_comment": 3, "author": "欧阳洋葱", "tags": ["特别企划", "观点"], "text": ""}
{"title": "五大移动应用加固平台评测", "url": "https://www.freebuf.com/articles/terminal/108064.html", "time": "2016-07-04", "level": "现金奖励", "num_look": 649062, "num_comment": 20, "author": "Sunnieli", "tags": ["安全报告", "终端安全"], "text": "对移动应用开发工程师而言，应用自动化加固是个便捷的方案，本文对比了5个主流的加固平台。"}
{"title": "2016年巴西奥运会期间可能存在的信息安全威胁", "url": "https://www.freebuf.com/news/108205.html", "time": "2016-07-03", "level": "金币+15", "num_look": 224049, "num_comment": 6, "author": "clouds", "tags": ["特别企划", "资讯"], "text": "我们针对那些前往巴西观看奥运会的游客和计划在线观看比赛的观众，讨论了他们可能面临的信息安全威胁。"}
{"title": "GSMA移动安全论坛：IoT时代，安全准备好了吗？", "url": "https://www.freebuf.com/fevents/108085.html", "time": "2016-07-03", "level": "", "num_look": 202702, "num_comment": 4, "author": "Sophia", "tags": ["活动", "特别企划"], "text": "GSMA第一届移动安全论坛，22位专家齐聚一堂。"}
{"title": "备份文件就能防勒索软件？没那么简单", "url": "https://www.freebuf.com/news/108098.html", "time": "2016-07-03", "level": "", "num_look": 254975, "num_comment": 16, "author": "饭团君", "tags": ["资讯"], "text": "很多人以为只要把重要文件备份起来，就可以无视勒索软件了，但情况可没有这么乐观。"}
{"title": "英国脱欧公投，看黑客如何玩「入侵刷票」", "url": "https://www.freebuf.com/news/108038.html", "time": "2016-07-02", "level": "", "num_look": 228599, "num_comment": 15, "author": "饭团君", "tags": ["资讯"], "text": "英国脱欧难道是黑客搞的鬼？"}
{"title": "一周「BUF大事件」（20160625-20160701）", "url": "https://www.freebuf.com/video/108169.html", "time": "2016-07-02", "level": "红色标题", "num_look": 342757, "num_comment": 18, "author": "supercoco", "tags": ["特别企划", "视频"], "text": "*应FB读者强烈要求，本周FreeBuf主播妹纸首度献声，赶快上车收看吧！"}
{"title": "MOSEC大会速描：移动大牛来袭，前方高能！", "url": "https://www.freebuf.com/fevents/108129.html", "time": "2016-07-01", "level": "", "num_look": 227974, "num_comment": 14, "author": "ArthurKiller", "tags": ["活动", "特别企划"], "text": "盘古团队最后放大招，全场残血！"}
{"title": "如何用深度学习识别网络欺诈?", "url": "https://www.freebuf.com/articles/paper/108123.html", "time": "2016-07-01", "level": "红色标题", "num_look": 709809, "num_comment": 15, "author": "猎豹移动威胁情报中心", "tags": ["安全报告"], "text": "深度学习、类神经网路以及卷积类神经网路，以及我们如何构思对抗欺诈广告这方面的创新应用。"}
{"title": "SSLyze：开源SSL安全监控工具", "url": "https://www.freebuf.com/sectool/107967.html", "time": "2016-07-01", "level": "金币+15", "num_look": 397534, "num_comment": 11, "author": "zhuzhibo0", "tags": ["工具"], "text": "作者编写的SSL安全监控工具"}
{"title": "Linux Rootkit系列三：实例详解 Rootkit 必备的基本功能", "url": "https://www.freebuf.com/articles/system/107829.html", "time": "2016-07-01", "level": "现金奖励", "num_look": 616598, "num_comment": 20, "author": "novice", "tags": ["系统安全"], "text": "在 上一篇文章中笔者详细地阐述了基于直接修改系统调用表 的挂钩， 文章强调以代码与动手实验为核心。"}
{"title": "技术报告：APT组织Wekby利用DNS请求作为C&C设施，攻击美国秘密机构", "url": "https://www.freebuf.com/articles/network/107914.html", "time": "2016-06-30", "level": "", "num_look": 491651, "num_comment": 7, "author": "极客小默", "tags": ["安全报告", "特别企划"], "text": "Wekby这些年一直活跃在医疗、电信、航空航天、国防和高科技等多个领域。它会在漏洞出现的第一时间就对其大加利用，就像在HackingTeam那样。"}
{"title": "Linux内核中的递归漏洞利用", "url": "https://www.freebuf.com/vuls/107440.html", "time": "2016-06-30", "level": "金币+18", "num_look": 356559, "num_comment": 4, "author": "Michael23", "tags": ["漏洞", "系统安全"], "text": "Linux内核中存在一个任意递归漏洞。安装Ubuntu时若选择了home目录加密，该漏洞即可由本地用户触发。"}
{"title": "全球2.5万网络摄像机被黑，用于构建DDOS攻击僵尸网络", "url": "https://www.freebuf.com/news/108045.html", "time": "2016-06-30", "level": "金币+18", "num_look": 288542, "num_comment": 9, "author": "dawner", "tags": ["资讯"], "text": "被黑的网络摄像机IP地址分布在世界各地，不少于105个国家，总数量超过2.5万。"}
{"title": "BlackHat会议上将公布一款免费的汽车黑客工具", "url": "https://www.freebuf.com/news/107950.html", "time": "2016-06-30", "level": "", "num_look": 220427, "num_comment": 3, "author": "饭团君", "tags": ["资讯"], "text": "阿D已经无法满足我的欲望，汽车黑客工具包即将来临！"}
{"title": "Seekret：GitHub仓库和目录敏感信息搜索工具", "url": "https://www.freebuf.com/sectool/107996.html", "time": "2016-06-30", "level": "", "num_look": 460268, "num_comment": 9, "author": "felix", "tags": ["工具"], "text": "Seekret是一个可以从各种源里面查找敏感信息的Go库和命令行工具。"}
{"title": "如何获取安卓iOS上的微信聊天记录、通过Metasploit控制安卓", "url": "https://www.freebuf.com/articles/terminal/107801.html", "time": "2016-06-30", "level": "红色标题", "num_look": 1348319, "num_comment": 41, "author": "漏洞盒子", "tags": ["终端安全"], "text": "在这篇文章中我们将讨论如何获取安卓、苹果设备中的微信聊天记录，并演示如何利用后门通过Metasploit对安卓设备进行控制实验。"}
{"title": "阿里云的SaaS预言：2016云栖大会·成都峰会一览", "url": "https://www.freebuf.com/fevents/108015.html", "time": "2016-06-29", "level": "红色标题", "num_look": 377458, "num_comment": 5, "author": "欧阳洋葱", "tags": ["活动", "特别企划"], "text": "FreeBuf小编这次参加2016云栖大会·成都峰会，听得最多的一个词就是SaaS——阿里云试图将安全企业的SaaS化做出了更为彻底的解读。"}
{"title": "百卓网络招聘安全研究员", "url": "https://www.freebuf.com/jobs/107843.html", "time": "2016-06-29", "level": "", "num_look": 232497, "num_comment": 9, "author": "百卓网络", "tags": ["安全招聘"], "text": "百卓网络招聘逆向分析工程师与安全研究员"}
{"title": "自动化检测CSRF（第二篇）", "url": "https://www.freebuf.com/articles/web/107623.html", "time": "2016-06-29", "level": "现金奖励", "num_look": 477851, "num_comment": 6, "author": "Black-Hole", "tags": ["WEB安全", "特别企划"], "text": "本章，重点就说明“如何检测对方是否开启了Referer检测机制”。"}
{"title": "SWIFT惊天银行大劫案全程分析", "url": "https://www.freebuf.com/articles/network/107900.html", "time": "2016-06-29", "level": "现金奖励", "num_look": 1173050, "num_comment": 4, "author": "白泽安全团队", "tags": ["特别企划", "网络安全"], "text": "本文将针对孟加拉国央行被盗的案例进行了技术分析，还原银行被盗的整个过程。"}
{"title": "ISIS发布“黑客猎杀名单”", "url": "https://www.freebuf.com/news/107641.html", "time": "2016-06-29", "level": "金币+18", "num_look": 272772, "num_comment": 8, "author": "饭团君", "tags": ["资讯"], "text": "最近一些支持ISIS的黑客组织发布了一份“kill lists（猎杀名单）”，这份名单上出现了3600名美国居民的名字。"}
{"title": "20年来的管中一窥：FBI究竟是如何窃听你的计算机的？", "url": "https://www.freebuf.com/news/topnews/107813.html", "time": "2016-06-29", "level": "", "num_look": 314473, "num_comment": 1, "author": "欧阳洋葱", "tags": ["头条", "特别企划"], "text": "FBI追踪人类计算机的历史至少也有20年了，虽然我们没法完整还原这20年来FBI的所作所为，却也可从只字片语中管控窥豹。"}
{"title": "获取乘客和车主的个人信息？这记Uber逻辑漏洞“组合拳”值得一看", "url": "https://www.freebuf.com/vuls/107881.html", "time": "2016-06-28", "level": "红色标题", "num_look": 474781, "num_comment": 15, "author": "ArthurKiller", "tags": ["WEB安全", "漏洞"], "text": "Uber的六个逻辑漏洞分析，感觉666"}
{"title": "Godless类恶意APP可Root 90%安卓设备", "url": "https://www.freebuf.com/news/107835.html", "time": "2016-06-28", "level": "", "num_look": 213136, "num_comment": 5, "author": "dawner", "tags": ["资讯"], "text": "Godless能root掉近90%的安卓手机。"}
{"title": "UnicornTeam2016纳新计划", "url": "https://www.freebuf.com/jobs/107703.html", "time": "2016-06-28", "level": "", "num_look": 401350, "num_comment": 15, "author": "360天巡实验室", "tags": ["安全招聘"], "text": "独角兽安全团队（Unicorn Team）在无线电研究领域拥有资深经验。"}
{"title": "新手指南：如何使用c118+osmocombb进行短信嗅探实验？", "url": "https://www.freebuf.com/sectool/107755.html", "time": "2016-06-28", "level": "金币+10", "num_look": 2041030, "num_comment": 52, "author": "diulei", "tags": ["工具", "无线安全"], "text": ""}
{"title": "Gartner：企业安全10大趋势预测", "url": "https://www.freebuf.com/news/107837.html", "time": "2016-06-28", "level": "", "num_look": 387430, "num_comment": 4, "author": "欧阳洋葱", "tags": ["企业安全", "安全管理"], "text": "咨询公司Gartner最近总结了今年企业面临安全问题的5个核心领域，还做出了未来趋势的预测。"}
{"title": "不需要苹果官方支持，可重置MAC系统固件密码", "url": "https://www.freebuf.com/news/107785.html", "time": "2016-06-28", "level": "", "num_look": 557455, "num_comment": 10, "author": "ArthurKiller", "tags": ["资讯"], "text": "安全研究人员fG!发现了一种可以重置iMac和MacBook固件密码的方法，并且不需要苹果公司官方的在线支持。"}
{"title": "以色列研究人员实现利用计算机风扇噪音窃听", "url": "https://www.freebuf.com/news/107733.html", "time": "2016-06-28", "level": "红色标题", "num_look": 503141, "num_comment": 29, "author": "饭团君", "tags": ["资讯"], "text": "连PC中的CPU风扇都能成为数据泄露的手段。"}
{"title": "NSA报告：将深入挖掘对物联网和生物医学设备的“窃听”能力", "url": "https://www.freebuf.com/news/106655.html", "time": "2016-06-28", "level": "金币+10", "num_look": 182958, "num_comment": 5, "author": "极客小默", "tags": ["资讯"], "text": "据最新情报，美国国家安全局（NSA）也在利用物联网。"}
{"title": "Swagger曝远程代码执行漏洞，影响Java、PHP、NodeJS等众多开发语言", "url": "https://www.freebuf.com/news/107790.html", "time": "2016-06-27", "level": "", "num_look": 384943, "num_comment": 8, "author": "ArthurKiller", "tags": ["资讯"], "text": "Swagger远程代码执行漏洞影响众多等语言"}
{"title": "谈谈物联网与摄像头安全", "url": "https://www.freebuf.com/news/107712.html", "time": "2016-06-27", "level": "金币+10", "num_look": 378115, "num_comment": 12, "author": "饭团君", "tags": ["资讯"], "text": "安全公司Protection1发布的研究报告再度警示摄像头的安全问题惹人忧。"}
{"title": "FreeBuf Insight：探访「暗网地下黑市」", "url": "https://www.freebuf.com/news/topnews/107555.html", "time": "2016-06-27", "level": "红色标题", "num_look": 1652648, "num_comment": 47, "author": "ArthurKiller", "tags": ["头条", "安全报告"], "text": "这个世界上，有阴就会有阳，有白天就会有黑夜，有地表就会有地下。"}
{"title": "如何防止Mimikatz「获取」Windows密码", "url": "https://www.freebuf.com/vuls/107340.html", "time": "2016-06-27", "level": "金币+10", "num_look": 652057, "num_comment": 10, "author": "东二门陈冠希", "tags": ["漏洞", "系统安全"], "text": "这个神器可以轻松从内存中获取Windows的登录密码……好在还有解决方案！"}
{"title": "Umap2：开源USB host安全评估工具", "url": "https://www.freebuf.com/sectool/107444.html", "time": "2016-06-27", "level": "", "num_look": 293227, "num_comment": 3, "author": "安小白", "tags": ["工具"], "text": "Umap2是一款由NCC Group和Cisco SAS小组开发的、基于python的USB host安全评估工具。"}
{"title": "极客DIY：制作一款智能家用温控器（PART 2）", "url": "https://www.freebuf.com/geek/104830.html", "time": "2016-06-26", "level": "", "num_look": 369722, "num_comment": 2, "author": "饭团君", "tags": ["极客"], "text": "制作智能家用温控器系列文章第二篇。"}
{"title": "韩国挫败了朝鲜黑客大规模网络攻击", "url": "https://www.freebuf.com/news/107690.html", "time": "2016-06-26", "level": "金币+10", "num_look": 377849, "num_comment": 16, "author": "watcher", "tags": ["资讯"], "text": "朝鲜黑客一直以来被指责持续对韩国组织，金融机构，银行和媒体发动针对性攻击。"}
{"title": "ARM栈溢出攻击实践：从虚拟环境搭建到ROP利用", "url": "https://www.freebuf.com/articles/terminal/107276.html", "time": "2016-06-26", "level": "现金奖励", "num_look": 848309, "num_comment": 4, "author": "thor123", "tags": ["极客", "终端安全"], "text": "当前的Android手机普遍采用ARM主芯片，试试如何在Linux + ARM的环境下，进行缓存溢出攻击吧。"}
{"title": "一分钟看完本周「BUF大事件」（20160618-0624）", "url": "https://www.freebuf.com/video/107698.html", "time": "2016-06-25", "level": "红色标题", "num_look": 284203, "num_comment": 5, "author": "supercoco", "tags": ["视频"], "text": "这周全球范围内都有哪些信息泄漏，黑客动向以及安全事件呢，FreeBuf视频组带你一分钟看尽。"}
{"title": "内部威胁那些事儿（四）：内部欺诈", "url": "https://www.freebuf.com/articles/security-management/106792.html", "time": "2016-06-25", "level": "现金奖励", "num_look": 492612, "num_comment": 1, "author": "木千之", "tags": ["安全管理"], "text": "电子欺诈在实际中有多种表现形式，其中最引人注目的莫过于身份欺诈领域的信用卡欺诈。"}
{"title": "百度开放云招聘安全岗位", "url": "https://www.freebuf.com/jobs/107638.html", "time": "2016-06-24", "level": "", "num_look": 378766, "num_comment": 26, "author": "百度开放云", "tags": ["安全招聘"], "text": "抓住Robin特批的机会，未来有一天，你可以跟别人吹牛逼说，当初我可是百度CEO Robin审核特批进百度的！"}
{"title": "FreeBuf文库功能上线：文海求知，有“库”相伴", "url": "https://www.freebuf.com/news/107629.html", "time": "2016-06-24", "level": "红色标题", "num_look": 893600, "num_comment": 19, "author": "FB客服", "tags": ["周边", "资讯"], "text": "Freebuf的文库上线了，或许你可以用这项新特性找到适合你阅读，和真正想找的内容。"}
{"title": "揭秘用“世界上最好的编程语言”制作的敲诈者木马", "url": "https://www.freebuf.com/articles/system/107478.html", "time": "2016-06-24", "level": "", "num_look": 446880, "num_comment": 22, "author": "360安全", "tags": ["系统安全"], "text": "你永远叫不醒一个装睡的人。但，快递小哥可以！"}
{"title": "Android安全开发之ZIP文件目录遍历", "url": "https://www.freebuf.com/articles/terminal/107585.html", "time": "2016-06-24", "level": "", "num_look": 318578, "num_comment": 1, "author": "阿里聚安全", "tags": ["终端安全"], "text": "ZIP压缩包文件中允许存在“../”的字符串，攻击者可通过精心构造ZIP文件，利用多个“../”从而改变ZIP包中某个文件的存放位置，覆盖替换掉应用原有的文件。"}
{"title": "利用Arduino快速制作Teensy BadUSB", "url": "https://www.freebuf.com/sectool/107242.html", "time": "2016-06-24", "level": "现金奖励", "num_look": 2336992, "num_comment": 54, "author": "维克斯", "tags": ["工具", "极客"], "text": "想自己DIY一个BadUSB？其实用Arduino就可以搞定，来看这则简易教程。"}
{"title": "IP whois介绍和部署实践", "url": "https://www.freebuf.com/articles/network/107372.html", "time": "2016-06-24", "level": "现金奖励", "num_look": 716334, "num_comment": 13, "author": "戒贤", "tags": ["网络安全"], "text": "国内可能有前人摸索过，但是目前还没有在某个平台上看到有人提起，所以才斗胆来写了这篇文章。"}
{"title": "“隐秘拍摄”实战：用树莓派制作一台可穿戴摄像机", "url": "https://www.freebuf.com/geek/105159.html", "time": "2016-06-24", "level": "", "num_look": 604479, "num_comment": 9, "author": "老王隔壁的白帽子", "tags": ["极客"], "text": "怎么用树莓派做一台属于自己的可穿戴摄像头呢？其实也并不难。"}
{"title": "FireEye报告：中国网络间谍行动减少源于中美协议与军事改革", "url": "https://www.freebuf.com/news/107572.html", "time": "2016-06-23", "level": "金币+6", "num_look": 293477, "num_comment": 13, "author": "米雪儿", "tags": ["资讯"], "text": "FireEye发布报告称自2014年年中起，中国政府已经减少了针对美国的网络攻击活动。"}
{"title": "开源压缩库Libarchive曝高危漏洞，影响Debian Linux、FreeBSD等大量产品", "url": "https://www.freebuf.com/news/107566.html", "time": "2016-06-23", "level": "", "num_look": 464394, "num_comment": 3, "author": "欧阳洋葱", "tags": ["漏洞", "资讯"], "text": "Libarchive是个开源压缩库，最近它又被曝出几个比较危险的安全漏洞，波及范围也比较广。"}
{"title": "走近科学：揭秘在线DDoS攻击平台（上）", "url": "https://www.freebuf.com/special/107119.html", "time": "2016-06-23", "level": "红色标题", "num_look": 1472054, "num_comment": 21, "author": "ArthurKiller", "tags": ["特别企划"], "text": "隐隐于地下的在线DDoS攻击平台，你了解多少。"}
{"title": "Exploit Kit攻击工具包流量锐减96%！这段时间究竟发生了什么？", "url": "https://www.freebuf.com/news/107467.html", "time": "2016-06-23", "level": "", "num_look": 350400, "num_comment": 2, "author": "欧阳洋葱", "tags": ["网络安全", "资讯"], "text": "自今年4月份以来，Exploit Kit恶意流量竟然锐减了多达96%，难道互联网安全的形势正一片大好？"}
{"title": "将Firefox打造成渗透测试利器：Firefox Security Toolkit", "url": "https://www.freebuf.com/sectool/107362.html", "time": "2016-06-23", "level": "金币+6", "num_look": 586756, "num_comment": 11, "author": "felix", "tags": ["工具"], "text": "把火狐浏览器转换成渗透测试套件，你信不？"}
{"title": "自动化检测CSRF（第一章）", "url": "https://www.freebuf.com/articles/web/107207.html", "time": "2016-06-23", "level": "现金奖励", "num_look": 601083, "num_comment": 11, "author": "Black-Hole", "tags": ["WEB安全"], "text": "之前写过自动化检测XSS插件，今天来一发自动化检测CSRF的插件。"}
{"title": "平安科技银河实验室招聘安全研究员", "url": "https://www.freebuf.com/jobs/107408.html", "time": "2016-06-22", "level": "", "num_look": 333234, "num_comment": 8, "author": "银河实验室", "tags": ["安全招聘"], "text": "平安科技银河实验室招聘招聘APP（Android）、Web高级安全研究员"}
{"title": "只用一个WiFi，渗透进企业全部内网", "url": "https://www.freebuf.com/articles/wireless/107249.html", "time": "2016-06-22", "level": "红色标题", "num_look": 1180676, "num_comment": 14, "author": "360天巡实验室", "tags": ["无线安全"], "text": "基于无线的企业渗透测试"}
{"title": "暴雪再躺枪，惨遭黑客狂打脸", "url": "https://www.freebuf.com/news/107421.html", "time": "2016-06-22", "level": "金币+6", "num_look": 362813, "num_comment": 10, "author": "米雪儿", "tags": ["资讯"], "text": "黑客公开在Twitter上表示“嘿，暴雪。不要管我，你们还是做些准备吧。小心我的数据包。谢谢~么么哒”"}
{"title": "Wget漏洞（CVE-2016-4971）利用方式解析", "url": "https://www.freebuf.com/vuls/107206.html", "time": "2016-06-22", "level": "金币+12", "num_look": 692397, "num_comment": 24, "author": "liduzhizi", "tags": ["漏洞", "系统安全"], "text": "近日，CVE-2016-4971漏洞被正式披露，该漏洞影响全部旧版本wget。"}
{"title": "企业共享威胁情报？困难远远比想象中多", "url": "https://www.freebuf.com/articles/security-management/107281.html", "time": "2016-06-22", "level": "", "num_look": 344227, "num_comment": 6, "author": "Sophia", "tags": ["安全管理", "特别企划"], "text": "网络威胁情报共享本来让企业之间实现更快速的信息传递，为何企业并不那么配合？"}
{"title": "摩根士丹利银行“失职”，罚款100万美元是多是少？", "url": "https://www.freebuf.com/news/107339.html", "time": "2016-06-22", "level": "", "num_look": 308423, "num_comment": 4, "author": "东二门陈冠希", "tags": ["资讯"], "text": "730000客户的信息未能得到应有的保护，100万美元是多是少？"}
{"title": "细数Android N的安全改进", "url": "https://www.freebuf.com/news/107333.html", "time": "2016-06-22", "level": "", "num_look": 342350, "num_comment": 1, "author": "Sphinx", "tags": ["终端安全", "资讯"], "text": "Android N针对用户层面的改进其实不多，但在针对开发者的安全层面却有诸多改进。"}
{"title": "DDOS攻击商业破坏力研究报告", "url": "https://www.freebuf.com/news/107261.html", "time": "2016-06-21", "level": "", "num_look": 247246, "num_comment": 5, "author": "360安全", "tags": ["头条", "文章"], "text": ""}
{"title": "读云：云安全责任共担模式解读", "url": "https://www.freebuf.com/news/topnews/107277.html", "time": "2016-06-21", "level": "现金奖励", "num_look": 229985, "num_comment": 6, "author": "s3curity", "tags": ["头条", "特别企划"], "text": "自从大雄供职阿尔法星球某云计算厂商安全岗位后，入驻他公司公共云的朋友越来越多，但是随之而来大雄的困扰也在增加。"}
{"title": "连连支付招聘信息安全工程师", "url": "https://www.freebuf.com/jobs/107255.html", "time": "2016-06-21", "level": "", "num_look": 359556, "num_comment": 25, "author": "连连银通", "tags": ["安全招聘"], "text": "连连银通电子支付有限公司成立于2003年，注册资金1.05亿元，现招聘信息安全工程师。"}
{"title": "运用Fluxion高效破解WiFi密码", "url": "https://www.freebuf.com/sectool/107237.html", "time": "2016-06-21", "level": "红色标题", "num_look": 1519724, "num_comment": 88, "author": "ArthurKiller", "tags": ["工具"], "text": "社会工程学和无线破解的结合"}
{"title": "BurpSuite插件开发Tips：请求响应参数的AES加解密", "url": "https://www.freebuf.com/articles/terminal/106673.html", "time": "2016-06-21", "level": "金币+12", "num_look": 420943, "num_comment": 10, "author": "bit4woo", "tags": ["终端安全"], "text": "自己使用burp进行测试的过程中遇到好些接口是有sign的，如果修改了请求参数都需要重新计算sign值……"}
{"title": "他用10年前的攻击手法感染了17000多名开发者的电脑", "url": "https://www.freebuf.com/news/107150.html", "time": "2016-06-21", "level": "", "num_look": 415018, "num_comment": 10, "author": "欧阳洋葱", "tags": ["WEB安全", "特别企划"], "text": "听过Typosquatting攻击吗？这是已经有10年历史的攻击手法了，居然还能瞒过17000多台电脑。"}
{"title": "还有王法吗？美国联邦调查局开发人脸识别系统，数据源涉及公民隐私", "url": "https://www.freebuf.com/news/107036.html", "time": "2016-06-21", "level": "", "num_look": 254256, "num_comment": 8, "author": "Sophia", "tags": ["资讯"], "text": "这次的人脸识别系统可以获得对41.1亿证件照片的访问权限，数据量如此庞大，从何而来？"}
{"title": "公有云OpenStack安全产品设计思路", "url": "https://www.freebuf.com/news/topnews/107203.html", "time": "2016-06-21", "level": "现金奖励", "num_look": 664546, "num_comment": 12, "author": "bt0sea", "tags": ["头条", "特别企划"], "text": "本文主要向大家介绍一下公有云OpenStack安全威胁需求、OpenStack自身安全特性、和如何设计针对OpenStack安全威胁的产品。"}
{"title": "中兴通讯招聘信息安全工程师（深圳总部）", "url": "https://www.freebuf.com/jobs/107035.html", "time": "2016-06-20", "level": "", "num_look": 240262, "num_comment": 7, "author": "amyqqy", "tags": ["安全招聘"], "text": "中兴通讯招聘信息安全工程师"}
{"title": "测试Web应用程序中的竞争条件", "url": "https://www.freebuf.com/articles/network/107077.html", "time": "2016-06-20", "level": "", "num_look": 534894, "num_comment": 6, "author": "东二门陈冠希", "tags": ["网络安全"], "text": "本文将对“竞争条件”漏洞是什么及该类漏洞可能出现的场景进行讨论，并使用Burp来模拟整个流程"}
{"title": "什么是“移动端应用协作”（MAC）攻击？", "url": "https://www.freebuf.com/articles/terminal/107079.html", "time": "2016-06-20", "level": "", "num_look": 255291, "num_comment": 8, "author": "dawner", "tags": ["终端安全"], "text": "Intel安全团队最近表示，他们检测到恶意代码被发布在数以千计的安卓包里。"}
{"title": "如何写好一份渗透测试报告？", "url": "https://www.freebuf.com/articles/security-management/107076.html", "time": "2016-06-20", "level": "", "num_look": 877615, "num_comment": 12, "author": "东二门陈冠希", "tags": ["安全管理"], "text": "大部分的渗透测试人员情愿复习19次TCP数据包结构的工作原理，也不愿意写一份报告。"}
{"title": "让子弹多飞一会：论如何优化DDoS", "url": "https://www.freebuf.com/articles/network/107012.html", "time": "2016-06-20", "level": "现金奖励", "num_look": 688818, "num_comment": 30, "author": "nickchang", "tags": ["网络安全"], "text": "假设1枚炮弹击中目标的伤害为10，而4枚炮弹同时击中目标的伤害为200。现在我方只有一门火炮，4枚炮弹。此火炮每次只能发射一枚炮弹。问如何操作可以使其伤害达到200？"}
{"title": "从ATM抢钱没那么容易：揭秘ATM攻击那点事", "url": "https://www.freebuf.com/articles/terminal/107083.html", "time": "2016-06-20", "level": "红色标题", "num_look": 479095, "num_comment": 9, "author": "欧阳洋葱", "tags": ["特别企划", "终端安全"], "text": "ATM机的安全问题究竟是怎么来的？ATM机攻击又有哪些手法？"}
{"title": "TechCrunch：当网络恐怖主义打响时，硅谷人将成为战士", "url": "https://www.freebuf.com/articles/neopoints/106705.html", "time": "2016-06-19", "level": "", "num_look": 252552, "num_comment": 3, "author": "极客小默", "tags": ["观点"], "text": "网络恐怖主义来时，谁来保护我们？"}
{"title": "物理Hacking之通过摄影收集情报", "url": "https://www.freebuf.com/geek/106835.html", "time": "2016-06-19", "level": "", "num_look": 367179, "num_comment": 11, "author": "东二门陈冠希", "tags": ["极客", "特别企划"], "text": "虽然大多数文章都在讨论如何通过互联网查询、社工、捡垃圾、域名搜索和非入侵式的扫描，但本文讨论的是物理渗透中通过摄影来进行信息搜集。"}
{"title": "TeamView余波危机，英国运营商TalkTalk用户深陷水火", "url": "https://www.freebuf.com/news/106789.html", "time": "2016-06-18", "level": "", "num_look": 168325, "num_comment": 3, "author": "米雪儿", "tags": ["资讯"], "text": "近日，深陷被黑疑云的TeamViewer再次被推至风口浪尖，而此次躺枪的是TalkTalk用户。"}
{"title": "一分钟看完本周「全球安全大事件」（20160611-0617）", "url": "https://www.freebuf.com/news/107164.html", "time": "2016-06-18", "level": "红色标题", "num_look": 354298, "num_comment": 9, "author": "FB视频", "tags": ["视频", "资讯"], "text": "本周全球都发生了哪些安全大事件？FreeBuf视频组带你一分钟看尽。"}
{"title": "Verizon邮箱现奇葩漏洞，个人邮件可被转发到任意邮箱", "url": "https://www.freebuf.com/news/107089.html", "time": "2016-06-18", "level": "", "num_look": 393742, "num_comment": 4, "author": "ArthurKiller", "tags": ["WEB安全", "漏洞"], "text": "非常奇葩的逻辑漏洞，不知道国内的厂商有没有，白帽小伙伴们可以测试一下。"}
{"title": "CVE-2014-6352漏洞及定向攻击样本分析", "url": "https://www.freebuf.com/vuls/106853.html", "time": "2016-06-18", "level": "", "num_look": 304346, "num_comment": 1, "author": "奇安信威胁情报中心", "tags": ["漏洞"], "text": "CVE-2014-6352漏洞基本分析及现实中利用此漏洞执行定向攻击的案例"}
{"title": "解读Gartner 2016年十大信息安全技术", "url": "https://www.freebuf.com/articles/security-management/107149.html", "time": "2016-06-17", "level": "金币+8", "num_look": 505247, "num_comment": 3, "author": "米雪儿", "tags": ["安全管理"], "text": "Gartner分析师在会上公布了他们关于2016年十大信息安全技术的研究成果。"}
{"title": "美国民主党委员会遭黑客“GUCCIFER 2.0”反复打脸", "url": "https://www.freebuf.com/news/107008.html", "time": "2016-06-17", "level": "", "num_look": 269907, "num_comment": 5, "author": "ArthurKiller", "tags": ["资讯"], "text": "美国民主党遭到黑客“打脸”"}
{"title": "漏洞盒子助力TechCrunchShanghai2016黑客马拉松", "url": "https://www.freebuf.com/fevents/107118.html", "time": "2016-06-17", "level": "", "num_look": 170833, "num_comment": 1, "author": "漏洞盒子", "tags": ["活动"], "text": "Hackathon，即黑客马拉松，参加团队在 24 小时内进行产品策划和开发。漏洞盒子作为官方合作伙伴支撑本次活动。"}
{"title": "泄露数据告诉你，黑客论坛Nulled.IO用户都用哪些密码？", "url": "https://www.freebuf.com/articles/database/106953.html", "time": "2016-06-17", "level": "现金奖励", "num_look": 735540, "num_comment": 22, "author": "tigerlab", "tags": ["数据安全"], "text": "我们泰格实验室的小伙伴们也做了一次密码破解实验，不过我们没法邀请到职业黑客来破解密码，只能小伙伴们自己扛着算盘上了。"}
{"title": "后门BROOTKIT代码学习和原理分析", "url": "https://www.freebuf.com/sectool/106836.html", "time": "2016-06-17", "level": "现金奖励", "num_look": 373281, "num_comment": 9, "author": "_zero", "tags": ["工具", "系统安全"], "text": "周末闲来无事，想找点东西学习一下，随手翻到了之前看到的一篇关于brootkit的文章，知道它是用Bash写的一个后门程序。"}
{"title": "攻陷五角大楼：白帽子在美国防御系统中发现超100个安全漏洞", "url": "https://www.freebuf.com/news/106947.html", "time": "2016-06-17", "level": "", "num_look": 276631, "num_comment": 12, "author": "ArthurKiller", "tags": ["资讯"], "text": "美国政府拿出15万美元与美国最大的漏洞提交平台Hackone合作了一个众测项目——攻陷五角大楼计划。"}
{"title": "WAFNinja：一款绕过WAF的渗透测试工具", "url": "https://www.freebuf.com/sectool/106747.html", "time": "2016-06-17", "level": "金币+8", "num_look": 505871, "num_comment": 20, "author": "ymmy", "tags": ["工具"], "text": "在我们平时做渗透测试的时候，难免会遇到各种WAF的阻挡。"}
{"title": "地下黑市xDedic出售70000台被黑服务器，最便宜的只要6美刀", "url": "https://www.freebuf.com/news/107028.html", "time": "2016-06-16", "level": "", "num_look": 281223, "num_comment": 5, "author": "欧阳洋葱", "tags": ["资讯"], "text": "卡巴斯基最近发布xDedic地下黑市报告，这家黑市提供的服务似乎还挺“周到”。"}
{"title": "Fox-IT：疑似中国网络间谍APT组织“Mofang”浮出水面", "url": "https://www.freebuf.com/news/106996.html", "time": "2016-06-16", "level": "金币+9", "num_look": 386936, "num_comment": 34, "author": "米雪儿", "tags": ["资讯"], "text": "根据安全公司Fox-IT的报告，APT组织Mofang对印度、德国、美国、加拿大等多个国家进行APT攻击，时间长达4余年。"}
{"title": "窃听狂魔：隐藏在jar包之后的木马", "url": "https://www.freebuf.com/articles/system/106980.html", "time": "2016-06-16", "level": "", "num_look": 515910, "num_comment": 9, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "该木马通常被在打包后jar的Java Applet应用程序中，通过网页进行传播"}
{"title": "每秒复制15张银行卡的“黑科技”，已加入暗网“黑产旗舰店”", "url": "https://www.freebuf.com/news/106743.html", "time": "2016-06-16", "level": "", "num_look": 386876, "num_comment": 10, "author": "米雪儿", "tags": ["资讯"], "text": "目前，代号为“CC Buddies”的犯罪组织正在暗网出售一种高科技设备，该设备可以复制非接触式借记卡的数据。"}
{"title": "经济间谍罪？给中国政府提供源代码，IBM在华雇员被美国控诉", "url": "https://www.freebuf.com/news/106906.html", "time": "2016-06-16", "level": "", "num_look": 247726, "num_comment": 5, "author": "Sophia", "tags": ["资讯"], "text": "去年IBM在华公司雇员徐家强被以“盗窃商业机密罪”起诉，时隔半年，怎么就变成了“经济间谍罪”"}
{"title": "赛门铁克46.5亿美元巨额收购Blue Coat，安全专家表示这不合理！", "url": "https://www.freebuf.com/news/106886.html", "time": "2016-06-16", "level": "", "num_look": 426986, "num_comment": 6, "author": "欧阳洋葱", "tags": ["网络安全", "资讯"], "text": "如果你一直在关注安全圈的时事，就应该知道，Blue Coat是一家充满争议的安全公司"}
{"title": "走近科学：”种子“的前世今生", "url": "https://www.freebuf.com/articles/others-articles/106826.html", "time": "2016-06-16", "level": "现金奖励", "num_look": 768873, "num_comment": 23, "author": "追影人", "tags": ["其他", "特别企划"], "text": "“种子”是生命的起点，是未来的希望，同时也解决了无数宅男腐女的寂寞时光。"}
{"title": "漏洞预警：Struts 2再曝远程代码执行漏洞S2-037 （CVE-2016-4438）", "url": "https://www.freebuf.com/news/106954.html", "time": "2016-06-15", "level": "红色标题", "num_look": 843838, "num_comment": 21, "author": "0xroot", "tags": ["漏洞", "资讯"], "text": "之前才发现Struts 2的S2-033漏洞没多久，今天又有高危漏洞曝出了！"}
{"title": "陌陌诚聘安全研发工程师", "url": "https://www.freebuf.com/jobs/106917.html", "time": "2016-06-15", "level": "", "num_look": 319808, "num_comment": 4, "author": "andy110", "tags": ["安全招聘"], "text": "陌陌招聘安全研发工程师"}
{"title": "BadTunnel：影响Win95到Win10的“超级漏洞”（CVE-2016-3213）", "url": "https://www.freebuf.com/vuls/106877.html", "time": "2016-06-15", "level": "金币+9", "num_look": 886684, "num_comment": 45, "author": "vul_wish", "tags": ["漏洞"], "text": "昨日，微软发布了一个高危漏洞的补丁，该漏洞由玄武实验室创建者于旸（中国安全圈人称TK教主）发现，并将其命名为“BadTunnel”。"}
{"title": "MS WORD加密及破解原理分析", "url": "https://www.freebuf.com/articles/system/106651.html", "time": "2016-06-15", "level": "现金奖励", "num_look": 930172, "num_comment": 7, "author": "ArkTeam", "tags": ["系统安全"], "text": "加密的WORD文档遭遇“秒破”，密码形同虚设，这在多年前是一件神奇而不可思议的事情，其真相和原理如何？"}
{"title": "逆向工程分析：摩托罗拉安全摄像头究竟有多不安全？", "url": "https://www.freebuf.com/vuls/106511.html", "time": "2016-06-15", "level": "", "num_look": 502201, "num_comment": 6, "author": "饭团君", "tags": ["极客", "漏洞"], "text": "虽然叫“安全”摄像头，它们本身的安全性或许并不怎么样。这款摩托罗拉Focus 73户外安全摄像头即是如此。"}
{"title": "Android N宣布弃用加密体系Cryto Provider", "url": "https://www.freebuf.com/news/106708.html", "time": "2016-06-15", "level": "", "num_look": 329376, "num_comment": 3, "author": "老王隔壁的白帽子", "tags": ["终端安全", "资讯"], "text": "本周，谷歌又宣布Android N将不会再采用Cryto Provider。"}
{"title": "黑莓愿意递交用户数据，协助各国警方执法", "url": "https://www.freebuf.com/news/106701.html", "time": "2016-06-15", "level": "", "num_look": 158539, "num_comment": 5, "author": "极客小默", "tags": ["资讯"], "text": "加拿大广播公司CBC News调查发现，黑莓内部成立了一个专门的部门，帮助世界各地的执法部门拦截用户数据（包括BBM信息）。"}
{"title": "围观“风格迥异”的澳洲黑客大会", "url": "https://www.freebuf.com/news/106671.html", "time": "2016-06-15", "level": "", "num_look": 220041, "num_comment": 9, "author": "米雪儿", "tags": ["头条", "资讯"], "text": "看惯了循规蹈矩、西装革履的安全大会，你是否期待一种形式灵活、气氛活跃的黑客会议？"}
{"title": "Bolek银行木马：金融恶意软件市场的新威胁", "url": "https://www.freebuf.com/articles/system/106782.html", "time": "2016-06-15", "level": "", "num_look": 214454, "num_comment": 1, "author": "vul_wish", "tags": ["系统安全"], "text": "该木马可以感染Windows32位和64位系统，一旦收到远程服务器指令，会通过RDP（远程桌面协议）打开设备与攻击者的反向连接。"}
{"title": "宝宝树招聘安全相关人才", "url": "https://www.freebuf.com/jobs/106296.html", "time": "2016-06-14", "level": "", "num_look": 269963, "num_comment": 16, "author": "adlife", "tags": ["安全招聘"], "text": "宝宝树作为中国母婴与家庭服务领军企业。"}
{"title": "卡巴斯基发现ATM病毒Skimmer改进版", "url": "https://www.freebuf.com/articles/terminal/106103.html", "time": "2016-06-14", "level": "金币+5", "num_look": 231226, "num_comment": 6, "author": "felix", "tags": ["终端安全"], "text": "今年，我们的全球研究与分析团队和渗透测试团队发现了一个改进版的Skimmer。"}
{"title": "WWDC2016安全快讯：提高安全性，macOS、iOS、tvOS、watchOS文件系统全部换新", "url": "https://www.freebuf.com/news/106734.html", "time": "2016-06-14", "level": "", "num_look": 204129, "num_comment": 6, "author": "欧阳洋葱", "tags": ["资讯"], "text": "昨晚的WWDC2016，各位果粉都看了吗？"}
{"title": "HITB16议题解析：Java应用ORM注入开发新方法", "url": "https://www.freebuf.com/vuls/106605.html", "time": "2016-06-14", "level": "金币+5", "num_look": 310903, "num_comment": 3, "author": "极客小默", "tags": ["漏洞"], "text": "今年的HITB会议十分有趣，其中一个由安全研究员Mikhail Egorov和Sergey Soldatov提出的议题“Java应用ORM注入开发新方法”引发了热议。"}
{"title": "第三方服务侧漏：Let's Encrypt泄露7618名用户邮箱地址", "url": "https://www.freebuf.com/news/106614.html", "time": "2016-06-14", "level": "", "num_look": 219467, "num_comment": 4, "author": "dawner", "tags": ["资讯"], "text": "Let's Encrypt是一个为站长们提供免费SSL证书的项目，最近他们泄露了7000多名用户的电子邮件地址。"}
{"title": "某厂2016实习招聘安全技术试题答案及解析", "url": "https://www.freebuf.com/articles/others-articles/106534.html", "time": "2016-06-14", "level": "现金奖励", "num_look": 960144, "num_comment": 79, "author": "ymmy", "tags": ["其他"], "text": "鉴于曾经做过腾讯找招聘-安全技术笔试题目，故留此一记，以作怀念。"}
{"title": "自动驾驶汽车要火了，安全威胁谁来负责？", "url": "https://www.freebuf.com/news/106610.html", "time": "2016-06-14", "level": "金币+5", "num_look": 467819, "num_comment": 6, "author": "watcher", "tags": ["无线安全", "资讯"], "text": "自动驾驶汽车在安全方面有哪些问题？"}
{"title": "子域名爆破工具subDomainsBrute", "url": "https://www.freebuf.com/sectool/106625.html", "time": "2016-06-14", "level": "金币+5", "num_look": 1345434, "num_comment": 19, "author": "zhuzhibo0", "tags": ["工具"], "text": "本文就是来讲一个通过小字典地柜的方式去发现三级、四级、五级等一些不容易被探测到的域名的小工具。"}
{"title": "端午“擒马”记：黑产是如何强刷用户银行卡8.1万元的？", "url": "https://www.freebuf.com/articles/network/106623.html", "time": "2016-06-13", "level": "现金奖励", "num_look": 843113, "num_comment": 40, "author": "豆芽菜", "tags": ["网络安全"], "text": "今年端午节特意动用带薪年假，在家本着远离黑客，远离江湖，舒舒服服和家人享受几天假期，谁知却早已深陷江湖。"}
{"title": "开源网络实时分析工具Skydive", "url": "https://www.freebuf.com/sectool/106632.html", "time": "2016-06-13", "level": "金币+5", "num_look": 469417, "num_comment": 9, "author": "felix", "tags": ["工具"], "text": "Skydive是一个开源的网络实时分析工具，可以分析网络拓扑和协议。"}
{"title": "FreeBuf Insight：2016上半年国外最具“钱景”的安全创业公司", "url": "https://www.freebuf.com/news/topnews/106579.html", "time": "2016-06-13", "level": "现金奖励", "num_look": 457171, "num_comment": 8, "author": "米雪儿", "tags": ["其他", "头条"], "text": "在过去五年里，已经有1208家网络安全创业公司获得约73亿美元的风险投资。"}
{"title": "写在LinkedIn、Myspace数据泄露后：安全风险管理，你的企业准备好了吗？", "url": "https://www.freebuf.com/articles/security-management/106577.html", "time": "2016-06-13", "level": "", "num_look": 267226, "num_comment": 3, "author": "安小白", "tags": ["安全管理"], "text": "对于业务包含敏感数据的企业来说，适当进行网络风险管理实践培训是非常有必要的。"}
{"title": "最新APT组织Gaza Cybergang揭秘", "url": "https://www.freebuf.com/news/106582.html", "time": "2016-06-13", "level": "金币+5", "num_look": 205611, "num_comment": 1, "author": "饭团君", "tags": ["资讯"], "text": "近日以色列安全公司ClearSky发现了一个活跃的APT攻击组织Gaza Cybergang，下面就随着FreeBuf来了解一下吧。"}
{"title": "黑客利用Wi-Fi远程关闭三菱欧蓝德汽车防盗报警器", "url": "https://www.freebuf.com/news/106319.html", "time": "2016-06-13", "level": "金币+5", "num_look": 221689, "num_comment": 2, "author": "vul_wish", "tags": ["资讯"], "text": "三菱欧蓝德汽车的配置中存在安全漏洞，攻击者可通过Wi-Fi禁用防盗报警器。"}
{"title": "超3200万Twitter账户密码泄露，Twitter表示“不能怪我”！", "url": "https://www.freebuf.com/news/106571.html", "time": "2016-06-12", "level": "", "num_look": 461503, "num_comment": 6, "author": "欧阳洋葱", "tags": ["数据安全", "资讯"], "text": "黑市最近有出现超过3200万名用户的Twitter账户密码泄露信息，可Twitter说责任不在他们身上。"}
{"title": "大量思科设备存在IPv6死亡之Ping漏洞", "url": "https://www.freebuf.com/news/106545.html", "time": "2016-06-12", "level": "金币+12", "num_look": 400510, "num_comment": 9, "author": "dawner", "tags": ["网络安全", "资讯"], "text": "思科最近向企业网管们发出警告，旗下某些网络设备在处理IPv6包时存在漏洞，该漏洞的影响范围还不仅限于思科自家的产品。"}
{"title": "企业应对恶意勒索软件有新招：大量存储比特币", "url": "https://www.freebuf.com/news/106519.html", "time": "2016-06-12", "level": "", "num_look": 221908, "num_comment": 5, "author": "饭团君", "tags": ["资讯"], "text": "企业如果遇到恶意勒索软件肿么办？ Citrix公司的研究报告称，很多公司找到了应对威胁的办法。"}
{"title": "BLE Hacking：使用Ubertooth one扫描嗅探低功耗蓝牙", "url": "https://www.freebuf.com/articles/wireless/106298.html", "time": "2016-06-12", "level": "红色标题", "num_look": 1085578, "num_comment": 3, "author": "漏洞盒子", "tags": ["无线安全"], "text": "低功耗蓝牙其特点具备节能、便于采用，是蓝牙技术专为物联网开发的技术版本。本文将分享如何嗅探BLE的通信数据。"}
{"title": "开源系统漏洞扫描工具Binmap使用文档", "url": "https://www.freebuf.com/sectool/106349.html", "time": "2016-06-12", "level": "金币+12", "num_look": 444554, "num_comment": 2, "author": "东二门陈冠希", "tags": ["工具"], "text": "开源工具binmap是用来扫描文件系统，可用于获取二进制文件信息、依赖关系以及软连接等。"}
{"title": "暗网卖家自称NSA（美国国家安全局）天价出售数据", "url": "https://www.freebuf.com/news/106503.html", "time": "2016-06-11", "level": "", "num_look": 223305, "num_comment": 7, "author": "饭团君", "tags": ["资讯"], "text": "之前你或许在FreeBuf上多次听说过暗网中的“地下数据拍卖”，而下面的这则消息来自最近的真实交易。"}
{"title": "为什么世界5大顶级PC厂商屡曝安全问题？", "url": "https://www.freebuf.com/news/106394.html", "time": "2016-06-11", "level": "", "num_look": 187806, "num_comment": 5, "author": "简单", "tags": ["资讯"], "text": "像微软这类知名的开发商通常会付诸大量精力在操作系统和应用的安全问题上，一旦发现问题，立马修复并及时通知用户。"}
{"title": "腐烂的苹果：对一大波iCloud钓鱼网站的监测与分析", "url": "https://www.freebuf.com/articles/web/106459.html", "time": "2016-06-10", "level": "红色标题", "num_look": 554851, "num_comment": 11, "author": "欧阳洋葱", "tags": ["WEB安全"], "text": "今年一季度出现了一大波以中国和英国苹果用户为攻击目标的钓鱼域名，而且手段还挺高明。"}
{"title": "窃听又有新技术，手机振动马达瞬间就变麦克风", "url": "https://www.freebuf.com/news/106467.html", "time": "2016-06-10", "level": "金币+12", "num_look": 306305, "num_comment": 13, "author": "饭团君", "tags": ["终端安全", "资讯"], "text": "手机里面的振动马达也能在不知不觉中当成麦克风来用，这样手机也就成了天然的窃听装置。"}
{"title": "微软欲打造基于“区块链”技术的身份识别系统", "url": "https://www.freebuf.com/news/106362.html", "time": "2016-06-09", "level": "", "num_look": 253300, "num_comment": 1, "author": "dawner", "tags": ["区块链安全", "资讯"], "text": "最近，微软尝试打造基于区块链的身份识别系统。为此微软还找来了其他合作伙伴。"}
{"title": "从小扎的“dadada”来扒扒：Linkedin泄露数据中最不安全的6款密码", "url": "https://www.freebuf.com/news/106415.html", "time": "2016-06-09", "level": "红色标题", "num_look": 573753, "num_comment": 19, "author": "Sophia", "tags": ["资讯"], "text": "小扎的密码都被黑了，你的还安全吗？"}
{"title": "Anomali实验室报告：大量企业面临社工威胁", "url": "https://www.freebuf.com/articles/paper/106357.html", "time": "2016-06-08", "level": "", "num_look": 231276, "num_comment": 2, "author": "饭团君", "tags": ["安全报告"], "text": "诈骗可以说是一种典型的违法行为，可以危害到全球任何一家公司，骗子通过克隆一些知名站点的信息就可以轻松的骗取现金。"}
{"title": "以色列公司开发新型监控系统，可窃听全球手机", "url": "https://www.freebuf.com/news/106247.html", "time": "2016-06-08", "level": "红色标题", "num_look": 431742, "num_comment": 13, "author": "饭团君", "tags": ["资讯"], "text": "拦截全球任何一部通信设备发出的信息？可能有人认为这只是电影里面才能出现的剧情。而据最新报道，以色列一家公司做到了。"}
{"title": "MOSEC 2016移动安全技术峰会即将开幕", "url": "https://www.freebuf.com/fevents/106410.html", "time": "2016-06-08", "level": "", "num_look": 166208, "num_comment": 2, "author": "FB独家", "tags": ["活动"], "text": "第二届MOSEC移动安全技术峰会时间定于2016年7月1日（周五）在上海浦东黄浦江畔上海凯宾斯基大酒店大宴会举行。"}
{"title": "勒索软件没有你想象中的那么挣钱", "url": "https://www.freebuf.com/articles/paper/106151.html", "time": "2016-06-08", "level": "", "num_look": 264555, "num_comment": 5, "author": "饭团君", "tags": ["安全报告"], "text": "近日Flashpoint对当前的恶意勒索活动作出了一份报告，并在报告中对恶意勒索活动作出了独到的见解。"}
{"title": "黑客西行记：KCon西部黑客大会纪实", "url": "https://www.freebuf.com/fevents/106311.html", "time": "2016-06-07", "level": "", "num_look": 267113, "num_comment": 15, "author": "欧阳洋葱", "tags": ["活动"], "text": "像KCon黑客大会这样的盛会，选在西安这样的城市召开，并且还赋以“KCon西部黑客大会”的名头，是为了让KCon听起来有更响亮的逼格吗？"}
{"title": "漏洞盒子魔兽英雄传 | 6月12日，等你来战！", "url": "https://www.freebuf.com/fevents/106301.html", "time": "2016-06-07", "level": "红色标题", "num_look": 334545, "num_comment": 13, "author": "漏洞盒子", "tags": ["活动"], "text": "只看魔兽大电影，不过瘾！6月12日至6月21日期间，加入漏洞盒子魔兽英雄传，更有丰厚奖励等着你！"}
{"title": "如何在各种编程语言中生成安全的随机数？", "url": "https://www.freebuf.com/articles/system/106234.html", "time": "2016-06-07", "level": "金币+8", "num_look": 657638, "num_comment": 13, "author": "felix", "tags": ["系统安全", "网络安全"], "text": "生成安全的随机数据指什么？为什么要生成安全的随机数据？之前一些文献中这并没有很好得说明如何生成“安全”的随机数。"}
{"title": "安卓设备安全测试框架DTF", "url": "https://www.freebuf.com/sectool/106261.html", "time": "2016-06-07", "level": "金币+8", "num_look": 299051, "num_comment": 3, "author": "HSpirit", "tags": ["工具", "终端安全"], "text": "安卓设备测试框架（Android Device Testing Framework ，简称DTF）是一个可以帮助研究人员进行漏洞挖掘的数据收集和分析框架。"}
{"title": "还怕没电？华盛顿大学研发出“无线电充电”微型电脑", "url": "https://www.freebuf.com/geek/106254.html", "time": "2016-06-07", "level": "金币+8", "num_look": 364887, "num_comment": 5, "author": "dawner", "tags": ["极客"], "text": "在智能设备中，电池续航是个很大的短板，可是你听过直接用无线电供电的产品吗？"}
{"title": "运维配置缺陷导致大量MongoDB数据信息遭泄露", "url": "https://www.freebuf.com/news/106204.html", "time": "2016-06-07", "level": "", "num_look": 252258, "num_comment": 5, "author": "饭团君", "tags": ["资讯"], "text": "近日，黑客组织GhostShell泄露了大量的MongoDB数据库用户资料。"}
{"title": "Nessus API连接工具AutoNessus", "url": "https://www.freebuf.com/sectool/106218.html", "time": "2016-06-07", "level": "金币+8", "num_look": 596764, "num_comment": 12, "author": "phper", "tags": ["工具"], "text": "许多企业的安全工程师使用Nessus进行安全基线检查和合规性工作。"}
{"title": "Javascript CTF挑战赛全攻略", "url": "https://www.freebuf.com/articles/web/106084.html", "time": "2016-06-07", "level": "金币+8", "num_look": 623813, "num_comment": 13, "author": "东二门陈冠希", "tags": ["WEB安全"], "text": "Javascript CTF比赛的形式其实跟其他的CTF大同小异，利用客户端身份验证过程的漏洞找到Flag，同时这也展示了客户端验证是多么的不可靠。"}
{"title": "Wfuzz：一款强大的Web Fuzz测试工具", "url": "https://www.freebuf.com/sectool/106147.html", "time": "2016-06-06", "level": "", "num_look": 750209, "num_comment": 9, "author": "dawner", "tags": ["工具"], "text": "Wfuzz是一个基于Python的Web爆破程序，它支持多种方法来测试WEB应用的漏洞。"}
{"title": "【快讯】俄罗斯最大社交网站VK.com被黑，1.71亿用户账号仅售1比特币", "url": "https://www.freebuf.com/news/106185.html", "time": "2016-06-06", "level": "金币+8", "num_look": 1000643, "num_comment": 46, "author": "米雪儿", "tags": ["资讯"], "text": "欧洲最大社交网站VK.com被黑客入侵， 1.71亿名用户账号信息泄露。"}
{"title": "ALICTF 2016落幕：常胜世界冠军PPP不敌神秘战队", "url": "https://www.freebuf.com/fevents/106180.html", "time": "2016-06-06", "level": "", "num_look": 333252, "num_comment": 5, "author": "FB独家", "tags": ["活动"], "text": "ALICTF 2016暨XCTF杭州站国际赛已落下帷幕，在焦点对决中，PPP微弱劣势不敌神秘国际战队40thieves（四十大盗），遗憾获得第二。"}
{"title": "315Mhz、433Mhz无线遥控信号的解码分析和模拟", "url": "https://www.freebuf.com/articles/wireless/105398.html", "time": "2016-06-06", "level": "现金奖励", "num_look": 895698, "num_comment": 12, "author": "午夜的电波", "tags": ["无线安全"], "text": "315MHz遥控器使用广泛，学习和深入了解其原理和实际操作，在获得无限乐趣的同时，可以学会防止自己的车被盗，并可以自己开发更安全的遥控锁设备。"}
{"title": "如何逆向Wyse终端的口令加密机制", "url": "https://www.freebuf.com/articles/terminal/105475.html", "time": "2016-06-06", "level": "", "num_look": 241533, "num_comment": 5, "author": "felix", "tags": ["终端安全"], "text": "瘦客户端变得越来越流行，因为它提供了一种实现虚拟化基础设施的方法。它通常是以桌面环境或者独立程序的形式出现的。"}
{"title": "暗网交易分析报告：年营收高达1亿美元，数据让人震惊", "url": "https://www.freebuf.com/articles/paper/105981.html", "time": "2016-06-06", "level": "红色标题", "num_look": 510402, "num_comment": 17, "author": "饭团君", "tags": ["安全报告"], "text": "这份报告足以让你震惊——美国地下产业“发展”蓬勃。"}
{"title": "一个MongoDB注入攻击案例分析", "url": "https://www.freebuf.com/articles/web/106085.html", "time": "2016-06-06", "level": "金币+8", "num_look": 746627, "num_comment": 3, "author": "东二门陈冠希", "tags": ["WEB安全", "数据安全"], "text": "因为MongoDB并不是SQL作为查询语句，所以人们可能会以为这样的数据库难以进行注入攻击？然而事实上并非如此。"}
{"title": "【安全快讯】明星安全扫描器公司Acunetix被黑", "url": "https://www.freebuf.com/news/106119.html", "time": "2016-06-05", "level": "", "num_look": 399261, "num_comment": 25, "author": "cindy", "tags": ["头条", "资讯"], "text": "就在昨天（6月4日），Acunetix官网被克罗地亚黑客篡改，挂上了“黑页”。"}
{"title": "Stuxnet震网“影子”再现，西门子ICS/SCADA设备不幸躺枪", "url": "https://www.freebuf.com/news/106049.html", "time": "2016-06-04", "level": "", "num_look": 366119, "num_comment": 10, "author": "Sophia", "tags": ["资讯"], "text": "六年前，震网Stuxnet摧毁了多台伊朗核电站离心机；六年后，和Stuxnet十分相似的Irongate出现了。"}
{"title": "地下黑市以2800美元出售4.27亿MySpace账户密码", "url": "https://www.freebuf.com/news/105935.html", "time": "2016-06-04", "level": "金币+5", "num_look": 466744, "num_comment": 7, "author": "米雪儿", "tags": ["数据安全", "资讯"], "text": "付费黑客数据检索引擎LeakedSource透露4.27亿条MySpace用户凭证被泄露，昨天，母公司时代（Time Inc）承认微博服务遭到数据泄露，并重复了一些我们已经知晓的细节。"}
{"title": "通杀全版本Windows的0day漏洞？黑客只卖9万美元", "url": "https://www.freebuf.com/news/106008.html", "time": "2016-06-04", "level": "金币+5", "num_look": 384621, "num_comment": 22, "author": "米雪儿", "tags": ["资讯"], "text": "近日，一名黑客公然在网上叫卖可攻击Windows 2000到Windows10所有版本的零日漏洞，售价9万美元。"}
{"title": "TeamViewer服务器挂了，被黑谣言四起", "url": "https://www.freebuf.com/news/106036.html", "time": "2016-06-03", "level": "金币+5", "num_look": 518957, "num_comment": 11, "author": "米雪儿", "tags": ["资讯"], "text": "6月1日周三，TeamViewer网站进入离线状态，原因是啥？"}
{"title": "SWIFT之殇：针对越南先锋银行的黑客攻击技术初探", "url": "https://www.freebuf.com/vuls/106026.html", "time": "2016-06-03", "level": "", "num_look": 542760, "num_comment": 5, "author": "360安全", "tags": ["漏洞", "系统安全"], "text": "本文深入分析了截获的黑客攻击越南先锋银行所使用的恶意代码样本，并由此对此次事件中的黑客攻击技术进行了初步探索。"}
{"title": "手机数据传输安全分析", "url": "https://www.freebuf.com/articles/wireless/105872.html", "time": "2016-06-03", "level": "", "num_look": 444310, "num_comment": 4, "author": "dawner", "tags": ["无线安全", "终端安全"], "text": "平时我们会用手机拍照，在社交网络中分享我们的心情；发送邮件、短信以及拨打电话。所以，这些信息则让我们的智能手机成为黑客眼热的宝库。"}
{"title": "移动平台千王之王大揭秘", "url": "https://www.freebuf.com/articles/paper/105960.html", "time": "2016-06-03", "level": "", "num_look": 296479, "num_comment": 11, "author": "360手机卫士", "tags": ["安全报告"], "text": "扒一扒六合彩与黑客们的前世今生"}
{"title": "WinPcap开发（三）：欺骗与攻击", "url": "https://www.freebuf.com/articles/network/105853.html", "time": "2016-06-03", "level": "现金奖励", "num_look": 494802, "num_comment": 8, "author": "追影人", "tags": ["网络安全"], "text": "本章节将介绍ARP欺骗与中间人攻击的相关知识，并利用winpcap进行相关实验。"}
{"title": "如何使用XSSaminer工具在PHP源码中挖掘XSS漏洞", "url": "https://www.freebuf.com/sectool/105888.html", "time": "2016-06-03", "level": "", "num_look": 407134, "num_comment": 4, "author": "安小白", "tags": ["工具"], "text": "我近期发现了一种通过寻找共性pattern在PHPsource码中发掘跨站脚本漏洞的简单方法。"}
{"title": "《通天神偷》之溜进某电力公司服务器", "url": "https://www.freebuf.com/news/105921.html", "time": "2016-06-03", "level": "红色标题", "num_look": 366803, "num_comment": 10, "author": "饭团君", "tags": ["资讯"], "text": "不知道有没有小伙伴看过一部叫做《通天神偷》的电影，下面要讲的故事就和这部电影有些类似。"}
{"title": "如何用ELK和Wazuh搭建 PCI-DSS（支付卡行业安全标准）", "url": "https://www.freebuf.com/articles/system/105879.html", "time": "2016-06-03", "level": "", "num_look": 658788, "num_comment": 3, "author": "东二门陈冠希", "tags": ["安全管理", "系统安全"], "text": "支付卡行业数据安全标准(PCI-DSS)是一种常见的IT行业的规范，主要用于电子信用卡业务例如Visa信用卡和万事达卡。"}
{"title": "美国政府至今仍在使用软盘和“古董级”IT系统", "url": "https://www.freebuf.com/news/105919.html", "time": "2016-06-03", "level": "", "num_look": 247680, "num_comment": 22, "author": "寰者", "tags": ["资讯"], "text": "当前部分美国政府部门仍在使用较为过时的系统，而其中包含了美国国防部的核武器管理系统。"}
{"title": "行业资讯：微步在线完成3500万人民币A轮融资", "url": "https://www.freebuf.com/news/105958.html", "time": "2016-06-02", "level": "", "num_look": 571711, "num_comment": 12, "author": "FB独家", "tags": ["资讯"], "text": "近日，国内首家威胁情报公司微步在线(ThreatBook)完成A轮融资，本轮投资由如山创投领投，北极光与华软投资跟投，规模达3500万元。"}
{"title": "渗透测试工具实战技巧合集", "url": "https://www.freebuf.com/sectool/105524.html", "time": "2016-06-02", "level": "金币+5", "num_look": 8102035, "num_comment": 83, "author": "xiaix", "tags": ["WEB安全", "工具"], "text": "本文为作者总结自己在渗透测试中常用的一些小技巧。"}
{"title": "盗版用户面临的“APT攻击”风险", "url": "https://www.freebuf.com/articles/system/105892.html", "time": "2016-06-02", "level": "金币+5", "num_look": 371628, "num_comment": 14, "author": "火绒安全", "tags": ["系统安全"], "text": "APT即“通过较为高级的手段这对特定群体产生的持续性威胁”，针对盗版用户的病毒威胁，也在APT攻击之列。"}
{"title": "揭秘最新APT组织Stealth Falcon，疑似属于阿联酋政府", "url": "https://www.freebuf.com/articles/paper/105867.html", "time": "2016-06-02", "level": "金币+5", "num_look": 254296, "num_comment": 2, "author": "饭团君", "tags": ["安全报告"], "text": "Stealth Falcon主要通过恶意软件以及社工方式来获取阿联酋的记者、活动家、持不同政见者。"}
{"title": "验证码对抗之路及现有验证机制介绍", "url": "https://www.freebuf.com/articles/security-management/105890.html", "time": "2016-06-02", "level": "", "num_look": 435559, "num_comment": 9, "author": "阿里云誉反欺诈", "tags": ["安全管理"], "text": "yahoo邮箱在九几年的时候，业务深受各种邮箱机器人的困扰，存在着大量的垃圾邮件，于是他们找到了当时仍在读大学的路易斯·冯·安，设计了经典的图形验证码。"}
{"title": "研究人员发明“完美”数据外泄方法", "url": "https://www.freebuf.com/articles/database/105874.html", "time": "2016-06-02", "level": "", "num_look": 313526, "num_comment": 7, "author": "vulture", "tags": ["数据安全"], "text": "来自以色列SafeBreach公司的研究人员对敏感数据外泄方法进行了广泛的分析，并发明了他们心目中认为最“完美” 的方法。"}
{"title": "雅虎某团体的6500万Tumblr账户数据在黑市热卖", "url": "https://www.freebuf.com/news/105886.html", "time": "2016-06-02", "level": "金币+5", "num_look": 285453, "num_comment": 8, "author": "dawner", "tags": ["数据安全", "资讯"], "text": "本月早些时候Tumblr曾透露，某第三方团体曾在2013年被雅虎收购前，大量的邮箱账号和密码已被黑客获取。"}
{"title": "用树莓派做好防火防盗的心理安慰工作", "url": "https://www.freebuf.com/articles/terminal/105637.html", "time": "2016-06-02", "level": "现金奖励", "num_look": 745657, "num_comment": 23, "author": "zhangtory", "tags": ["极客", "终端安全"], "text": "毕业季又要到了，在外面租了房子，担心家里会遭小偷，或者哪个插头没拔引起火灾，树莓派可以派上用场。"}
{"title": "Node.js应用的反向shell", "url": "https://www.freebuf.com/vuls/105788.html", "time": "2016-06-02", "level": "", "num_look": 346321, "num_comment": 4, "author": "东二门陈冠希", "tags": ["WEB安全", "漏洞"], "text": "在对某小型Web开发者团队的移动应用进行安全评估的过程中，发现了Node.js反向Shell的问题。"}
{"title": "Android安全开发之Provider组件安全", "url": "https://www.freebuf.com/articles/terminal/105857.html", "time": "2016-06-01", "level": "", "num_look": 255974, "num_comment": 3, "author": "阿里聚安全", "tags": ["终端安全"], "text": ""}
{"title": "一张图告诉你全球政府黑客的地理位置", "url": "https://www.freebuf.com/news/105827.html", "time": "2016-06-01", "level": "红色标题", "num_look": 600850, "num_comment": 18, "author": "简单", "tags": ["头条", "资讯"], "text": "曾几何时，间谍们想尽办法隐藏他们踪迹，比如使用层层混淆技术、代理服务器等，所以要想搜集他们的网上情报几乎是不可能的事情。"}
{"title": "利用PHP 7中的OPcache来实现Webshell", "url": "https://www.freebuf.com/articles/105793.html", "time": "2016-06-01", "level": "", "num_look": 472491, "num_comment": 15, "author": "东二门陈冠希", "tags": ["WEB安全", "文章"], "text": "在本文中我们将分析通过利用PHP7默认的 OPcache引擎来对漏洞进行利用的技巧。"}
{"title": "企业安全人才能力提升？专攻安全教育的永信至诚这么看", "url": "https://www.freebuf.com/fevents/105748.html", "time": "2016-06-01", "level": "", "num_look": 238764, "num_comment": 13, "author": "Sophia", "tags": ["活动"], "text": "永信至诚旨在把安全教育的企业市场与个人学习市场连接。"}
{"title": "rop-tool：一款辅助撰写二进制exp的工具", "url": "https://www.freebuf.com/sectool/105715.html", "time": "2016-06-01", "level": "", "num_look": 480477, "num_comment": 2, "author": "dawner", "tags": ["工具", "系统安全"], "text": "rop-tool是一款能帮助你制作二进制exp的工具。"}
{"title": "漏洞频发的医疗系统，下一站安全or灭亡？", "url": "https://www.freebuf.com/news/105742.html", "time": "2016-06-01", "level": "金币+5", "num_look": 232914, "num_comment": 8, "author": "米雪儿", "tags": ["资讯"], "text": "近日，一款在美国被广泛应用于医疗机构的APP被爆存在“后门”，任何人只要拥有硬编码凭证就可以获取和修改病人的私密数据。"}
{"title": "六一特辑：那些年，我们一起追的“少年黑客”们", "url": "https://www.freebuf.com/news/topnews/105758.html", "time": "2016-06-01", "level": "现金奖励", "num_look": 564348, "num_comment": 23, "author": "米雪儿", "tags": ["头条", "特别企划"], "text": "那些“天才少年黑客”们，他们的未来是荣耀还是锒铛，也许一开始就已经注定。"}
{"title": "利用私有DNS，“查找我的 iPhone”可被轻松绕过", "url": "https://www.freebuf.com/articles/terminal/105780.html", "time": "2016-06-01", "level": "金币+5", "num_look": 391388, "num_comment": 23, "author": "Sphinx", "tags": ["终端安全"], "text": "iPhone自带的“寻找我的iPhone”功能一直以来都是小偷们需要解决的问题之一。这个功能会在你遗失手机时帮助你定位，而实际上小偷总能找到办法绕过这个“守护者”。"}
{"title": "“SandJacking”攻击：在未越狱的 iOS 设备上安装恶意应用", "url": "https://www.freebuf.com/vuls/105727.html", "time": "2016-05-31", "level": "", "num_look": 293289, "num_comment": 4, "author": "vul_wish", "tags": ["漏洞", "终端安全"], "text": "HITB 2016，安全研究员Chilik Tamir发表一个关于“SandJacking”攻击的演讲，利用未打补丁的iOS漏洞在未越狱的iOS设备上使用恶意版本替换合法的应用程序。"}
{"title": "金融行业该怎样对待“黑客”？", "url": "https://www.freebuf.com/news/104959.html", "time": "2016-05-31", "level": "", "num_look": 225030, "num_comment": 6, "author": "简单", "tags": ["资讯"], "text": "美国证券交易委员会（SEC）主席Mary Jo White声明：金融系统面临的最大威胁是网络安全。"}
{"title": "美人鱼行动：长达6年的境外定向攻击活动揭露", "url": "https://www.freebuf.com/articles/network/105726.html", "time": "2016-05-31", "level": "红色标题", "num_look": 569919, "num_comment": 6, "author": "奇安信威胁情报中心", "tags": ["安全报告", "网络安全"], "text": "美人鱼行动是境外APT组织主要针对政府机构的攻击活动，持续时间长达6年的网络间谍活动，已经证实有针对丹麦外交部的攻击。"}
{"title": "极客DIY：制作一款智能家用温控器（第一部分）", "url": "https://www.freebuf.com/geek/104617.html", "time": "2016-05-31", "level": "", "num_look": 426801, "num_comment": 11, "author": "饭团君", "tags": ["极客"], "text": "我现在想要利用手里的树莓派制作一款WiFi智能温控器，这样我就可以将设备接上电源安装在大厅，然后随时可以监控室内温度。"}
{"title": "Linux Rootkit 系列二：基于修改 sys_call_table 的系统调用挂钩", "url": "https://www.freebuf.com/sectool/105713.html", "time": "2016-05-31", "level": "现金奖励", "num_look": 625414, "num_comment": 20, "author": "novice", "tags": ["工具"], "text": "本文不打算给大家介绍三种不同的系统调用挂钩技术，相反，本文仅详细讲解最简单的系统调用挂钩方案，并且基于这个方案实现最基本的文件监视工具。"}
{"title": "基于Python的反连Shell和后渗透工具", "url": "https://www.freebuf.com/sectool/105698.html", "time": "2016-05-31", "level": "金币+6", "num_look": 378760, "num_comment": 6, "author": "felix", "tags": ["工具"], "text": "这是一个基于Python的反连shell，并且具备后渗透阶段的一些功能。"}
{"title": "内部威胁那些事儿（三）：信息窃取", "url": "https://www.freebuf.com/articles/network/105633.html", "time": "2016-05-30", "level": "现金奖励", "num_look": 471163, "num_comment": 4, "author": "木千之", "tags": ["安全管理", "网络安全"], "text": "我们将从基本概念、威胁模型等角度进一步分析信息窃取类威胁。"}
{"title": "新浪微博招聘安全工程师", "url": "https://www.freebuf.com/jobs/105652.html", "time": "2016-05-30", "level": "", "num_look": 316706, "num_comment": 9, "author": "weibo_sec", "tags": ["安全招聘"], "text": "新浪微博安全招聘"}
{"title": "逆向华为路由器第三部分", "url": "https://www.freebuf.com/geek/105617.html", "time": "2016-05-30", "level": "", "num_look": 333037, "num_comment": 7, "author": "饭团君", "tags": ["极客"], "text": "在前面两个部分（1,2）已经介绍了UART，BusyBox等部分的逆向调试，而这篇将会开始在流量分析方面下手，来逆向出更多的信息。"}
{"title": "【安全预警】Forbidden attack：7万台web服务器陷入被攻击的险境", "url": "https://www.freebuf.com/vuls/105644.html", "time": "2016-05-30", "level": "金币+6", "num_look": 371013, "num_comment": 7, "author": "dawner", "tags": ["漏洞"], "text": "最近，根据某国际安全小组的研究表明，金融巨头Visa旗下部分受HTTPS保护的网站最近被发现了一种漏洞，访客浏览器将会访问到恶意内容。"}
{"title": "混搭新式：社工+powershell，轻松畅游主机", "url": "https://www.freebuf.com/articles/web/105641.html", "time": "2016-05-30", "level": "金币+6", "num_look": 518386, "num_comment": 10, "author": "东二门陈冠希", "tags": ["WEB安全"], "text": "在渗透测试过程有时候会需要从已经被入侵的主机拿到你想要的凭据。你需要做的第一件事是，通过社工的方式进入他们的电脑。"}
{"title": "使用橡皮鸭硬件绕过杀软，渗透Win 7", "url": "https://www.freebuf.com/articles/system/105616.html", "time": "2016-05-30", "level": "金币+6", "num_look": 580599, "num_comment": 15, "author": "Sphinx", "tags": ["系统安全"], "text": "本文将演示如何使用USB Rubber Ducky和unicorn攻击一台运行AVG2015杀毒软件并且补丁全部打上的Windows7电脑。本教程仅供学习，请勿用作非法用途"}
{"title": "韩国空军官方网站遭到网络攻击，是朝鲜搞的鬼？", "url": "https://www.freebuf.com/news/105602.html", "time": "2016-05-29", "level": "", "num_look": 233373, "num_comment": 8, "author": "watcher", "tags": ["资讯"], "text": "韩国空军网站感染恶意代码，这次朝鲜又被怀疑了。"}
{"title": "MySpace出现史上最大规模数据泄露事件", "url": "https://www.freebuf.com/news/105589.html", "time": "2016-05-28", "level": "金币+6", "num_look": 407125, "num_comment": 6, "author": "饭团君", "tags": ["资讯"], "text": "最新的消息是社交网站MySpace也遭到了数据泄露，而泄露的数据比领英还要多。"}
{"title": "从零开始学Fuzzing系列：带领nduja突破Grinder的壁垒", "url": "https://www.freebuf.com/articles/web/105510.html", "time": "2016-05-28", "level": "现金奖励", "num_look": 521113, "num_comment": 14, "author": "walkerfuz", "tags": ["WEB安全"], "text": "本文主要讲述了如何解决浏览器Fuzzing过程中遇到的样本难以精简这一问题。可能读者看到最终的解决方法会豁然开朗，但笔者解决这个问题的过程却是十分坎坷的。希望能通过本文，和大家分享我解决问题的心路历程。"}
{"title": "成都力合智远安全人才招聘", "url": "https://www.freebuf.com/jobs/105224.html", "time": "2016-05-27", "level": "", "num_look": 330704, "num_comment": 19, "author": "softbug", "tags": ["安全招聘"], "text": "成都力合智远信息技术有限公司是一家创业公司，在做信息安全硬件相关的产品，扁平化层级，简单的人际关系，期待你的加入！"}
{"title": "谷歌Abacus计划将掀起一场密码变革", "url": "https://www.freebuf.com/news/105451.html", "time": "2016-05-27", "level": "", "num_look": 259865, "num_comment": 9, "author": "简单", "tags": ["头条", "资讯"], "text": "Abacus计划推出一种融合了生物特征识别技术（包括面部识别技术和语音识别技术）和地理位置信息的登录方式。"}
{"title": "AlphaBay：目前全球“人气最旺”的暗网黑市", "url": "https://www.freebuf.com/news/105479.html", "time": "2016-05-27", "level": "金币+6", "num_look": 1065349, "num_comment": 13, "author": "饭团君", "tags": ["资讯"], "text": "根据SurfWatch实验室最新的报告称，目前AlphaBay已经成为最受欢迎的暗网黑市。"}
{"title": "近期全球网络银行劫案频发，SWIFT系统遭质疑", "url": "https://www.freebuf.com/news/105205.html", "time": "2016-05-27", "level": "", "num_look": 193885, "num_comment": 3, "author": "米雪儿", "tags": ["资讯"], "text": "厄瓜多尔银行Banco Del Austro of Cuenca成为网络盗窃案件受害者，攻击者通过关于SWIFT系统的漏洞盗取了1200百万美元。"}
{"title": "基于Python使用Gmail通信的Windows后门：Gdog", "url": "https://www.freebuf.com/sectool/105144.html", "time": "2016-05-27", "level": "", "num_look": 351524, "num_comment": 6, "author": "felix", "tags": ["工具"], "text": "Gdog是一款基于Python，以Gmail作为命令和控制服务器的Winddows后门工具，具有隐蔽性的优势，可以帮助安全测试工程师进行渗透测试工作。"}
{"title": "TP-Link交换机嗅探与反嗅探", "url": "https://www.freebuf.com/articles/network/105379.html", "time": "2016-05-27", "level": "", "num_look": 586569, "num_comment": 14, "author": "东二门陈冠希", "tags": ["网络安全"], "text": "某款TP-LINK交换机有一个带镜像功能的端口，这可以让我很轻松的嗅探到经过各个接口的数据的具体情况。"}
{"title": "把脑洞印在T恤上——2016年FreeBuf T恤征集活动", "url": "https://www.freebuf.com/fevents/105436.html", "time": "2016-05-27", "level": "红色标题", "num_look": 1232410, "num_comment": 457, "author": "DearJJJ", "tags": ["活动"], "text": "2016年Freebuf T恤征集活动，邀你一起开脑洞！"}
{"title": "火眼实验室恶意软件开源分析工具Flare-floss", "url": "https://www.freebuf.com/sectool/105252.html", "time": "2016-05-27", "level": "金币+6", "num_look": 461142, "num_comment": 2, "author": "老王隔壁的白帽子", "tags": ["工具"], "text": "许多恶意软件编写者都会通过混淆一个可执行文件的关键部分来躲避启发式的检测方法，而不是通过加强保护壳的方式"}
{"title": "Fingerprintjs2：一款开源设备指纹采集器", "url": "https://www.freebuf.com/sectool/105353.html", "time": "2016-05-26", "level": "", "num_look": 1071348, "num_comment": 2, "author": "安小白", "tags": ["工具"], "text": "最初的fingerprintjs库创建于2012年，但是由于新版本的开发很难保持向后兼容，因此Fingerprintjs2项目中增加了很多的新内容。"}
{"title": "GSM Hacking：如何对GSM/GPRS网络测试进行测试？", "url": "https://www.freebuf.com/articles/wireless/105324.html", "time": "2016-05-26", "level": "金币+6", "num_look": 749523, "num_comment": 15, "author": "饭团君", "tags": ["无线安全", "极客"], "text": "本文介绍了使用USRP搭建测试基站，并对网络连接、数据流量、语音通话等功能进行调试以及其安全性进行分析。"}
{"title": "2016中国网络空间安全（上海）论坛，今年瞄准跨境电商安全", "url": "https://www.freebuf.com/fevents/105370.html", "time": "2016-05-26", "level": "", "num_look": 183704, "num_comment": 2, "author": "Sophia", "tags": ["活动"], "text": "2016中国网络空间安全（上海）论坛将于7月21日在上海举办,这次有什么新话题？"}
{"title": "平安付安全中心招聘安全工程师", "url": "https://www.freebuf.com/jobs/104756.html", "time": "2016-05-26", "level": "", "num_look": 281993, "num_comment": 9, "author": "平安壹钱包安全中心", "tags": ["安全招聘"], "text": "平安付安全中心安全招聘"}
{"title": "WinPcap威力加强版：这个国产开源工具获得了Google赞助", "url": "https://www.freebuf.com/sectool/104701.html", "time": "2016-05-26", "level": "红色标题", "num_look": 815061, "num_comment": 24, "author": "0xroot", "tags": ["工具"], "text": "Npcap项目是最初2013年由Nmap网络扫描器项目创始人Gordon Lyon和北京大学罗杨博士发起，由Google公司Summer of Code计划赞助的一个开源项目。"}
{"title": "剪贴板劫持：复制粘贴中暗藏杀机", "url": "https://www.freebuf.com/articles/system/105318.html", "time": "2016-05-26", "level": "金币+6", "num_look": 407542, "num_comment": 5, "author": "鸢尾", "tags": ["系统安全"], "text": "本文将详细的向各位讲述“剪贴板劫持”攻击如何诱骗用户运行恶意代码。"}
{"title": "密码学专家Jon Callas重返Apple，强化产品安全性", "url": "https://www.freebuf.com/news/105399.html", "time": "2016-05-26", "level": "", "num_look": 265512, "num_comment": 6, "author": "米雪儿", "tags": ["资讯"], "text": "1995年他就加入了苹果，两年后离职，再于2009年重返苹果，曾负责苹果的加密及资料保护系统，以及OS X的安全机制，近期宣布重新加盟苹果公司。"}
{"title": "使用Windbg和Python进行堆跟踪", "url": "https://www.freebuf.com/articles/system/103816.html", "time": "2016-05-26", "level": "", "num_look": 357107, "num_comment": 3, "author": "老王隔壁的白帽子", "tags": ["系统安全"], "text": "这篇文章主要展示如何使用Windbg的Python脚本，以及如何建立一个基本堆模拟器。"}
{"title": "Linux堆内存管理深入分析（下）", "url": "https://www.freebuf.com/articles/security-management/105285.html", "time": "2016-05-26", "level": "", "num_look": 434761, "num_comment": 2, "author": "阿里聚安全", "tags": ["安全管理"], "text": "使用隐式链表来管理内存chunk总会涉及到内存的遍历，效率极低。"}
{"title": "风控反欺诈领域恶意竞争，输的是谁？", "url": "https://www.freebuf.com/articles/neopoints/105244.html", "time": "2016-05-25", "level": "", "num_look": 412385, "num_comment": 7, "author": "外卖来了", "tags": ["观点"], "text": "反欺诈市场春天来了，商战也来了."}
{"title": "日本16州ATM机沦陷，14亿日元不翼而飞", "url": "https://www.freebuf.com/news/105225.html", "time": "2016-05-25", "level": "", "num_look": 263826, "num_comment": 8, "author": "FireFrank", "tags": ["资讯"], "text": "一伙罪犯团伙3小时内从日本16个州的ATM机中窃取14亿日元。"}
{"title": "斯诺登：澳大利亚的监视政策比NSA还下流", "url": "https://www.freebuf.com/news/105275.html", "time": "2016-05-25", "level": "", "num_look": 247329, "num_comment": 8, "author": "简单", "tags": ["资讯"], "text": "NSA泄密者斯诺登表示上周澳大利亚联邦警察对国家带宽网络（NBN）的突袭属于滥用权力的行为。"}
{"title": "如何用蜜罐追踪黑客（第一集）", "url": "https://www.freebuf.com/articles/network/105158.html", "time": "2016-05-25", "level": "金币+8", "num_look": 636774, "num_comment": 9, "author": "老王隔壁的白帽子", "tags": ["网络安全"], "text": "国外安全研究员在谷歌云上建立了6个蜜罐并进行了几个月的探索，结果如何，一起来看。"}
{"title": "Marvel团队高薪聘请高级安全研究员", "url": "https://www.freebuf.com/jobs/105128.html", "time": "2016-05-25", "level": "", "num_look": 274580, "num_comment": 13, "author": "360MarvelTeam", "tags": ["安全招聘"], "text": ""}
{"title": "2016年Q2《网络安全创新500强》榜单解读", "url": "https://www.freebuf.com/news/105229.html", "time": "2016-05-25", "level": "现金奖励", "num_look": 519281, "num_comment": 5, "author": "米雪儿", "tags": ["头条", "资讯"], "text": "美国投资咨询机构Cybersecurity Ventures发布了2016 Q2《网络安全创新500强》企业榜单。"}
{"title": "平安金融科技招聘安全工程师", "url": "https://www.freebuf.com/news/89086.html", "time": "2016-05-25", "level": "", "num_look": 556680, "num_comment": 24, "author": "路由器", "tags": ["安全招聘", "资讯"], "text": "深圳平安金融科技咨询有限公司是中国平安保险（集团）股份有限公司旗下重要成员之一。"}
{"title": "安全招聘中，如何招到优秀的Web渗透测试人员？", "url": "https://www.freebuf.com/articles/neopoints/105156.html", "time": "2016-05-25", "level": "金币+8", "num_look": 668783, "num_comment": 20, "author": "东二门陈冠希", "tags": ["观点"], "text": "安全团队如何招到合适的成员？"}
{"title": "国外渗透测试攻略：渗透联合利华，访问13.2G数据？也许并不难", "url": "https://www.freebuf.com/articles/network/104940.html", "time": "2016-05-25", "level": "金币+8", "num_look": 510220, "num_comment": 16, "author": "xiaix", "tags": ["特别企划", "网络安全"], "text": "一位同学提到他现在正在联合利华公司里实习，这是荷兰一家非常知名的公司，那么以这家公司来进行演示一定非常酷。"}
{"title": "RFIDler：一款定义RFID的读、写、仿真器的开源软件", "url": "https://www.freebuf.com/sectool/104898.html", "time": "2016-05-24", "level": "金币+8", "num_look": 565398, "num_comment": 16, "author": "东二门陈冠希", "tags": ["工具"], "text": "RFID这样的技术看起来都很神秘，实际上他是依赖于很多物理学原理的，比如”电磁感应原理”。本文将介绍RFIDler开源软件以及相关原理。"}
{"title": "一种常规Android脱壳技术的拓展（附工具）", "url": "https://www.freebuf.com/sectool/105147.html", "time": "2016-05-24", "level": "", "num_look": 1719812, "num_comment": 32, "author": "Drizzle.Risk", "tags": ["工具", "终端安全"], "text": "我在Github上看了几个脱壳工具的代码。其中一个我感觉很有趣， 正是strazzere大神的android-unpacker。"}
{"title": "全球能源互联网研究院招聘安信息全渗透人员", "url": "https://www.freebuf.com/jobs/104905.html", "time": "2016-05-24", "level": "", "num_look": 295436, "num_comment": 12, "author": "secsgri", "tags": ["安全招聘"], "text": "国家电下网全球能源互联网研究院安全招聘。"}
{"title": "内部威胁那些事儿（二）：系统破坏", "url": "https://www.freebuf.com/articles/security-management/105166.html", "time": "2016-05-24", "level": "现金奖励", "num_look": 296264, "num_comment": 6, "author": "木千之", "tags": ["安全管理"], "text": "今天我们来详细分析第一种基本威胁类型：系统破坏。"}
{"title": "WinPcap开发（二）：扫描探测", "url": "https://www.freebuf.com/articles/network/105036.html", "time": "2016-05-24", "level": "现金奖励", "num_look": 509595, "num_comment": 11, "author": "追影人", "tags": ["网络安全"], "text": "本章节将详细介绍利用winpcap进行网络节点存活性探测及端口开放状态扫描的“姿势”。"}
{"title": "如何通过WIFI渗透企业内网？", "url": "https://www.freebuf.com/articles/wireless/105092.html", "time": "2016-05-24", "level": "红色标题", "num_look": 1157316, "num_comment": 26, "author": "felix", "tags": ["无线安全", "网络安全"], "text": "本文将演示如何通过WIFI获取目标网络的敏感信息，获取整个域，并攻破目标网络里的重要资源。"}
{"title": "User Agent注入攻击及防御", "url": "https://www.freebuf.com/articles/web/105124.html", "time": "2016-05-24", "level": "", "num_look": 593769, "num_comment": 13, "author": "xiaix", "tags": ["WEB安全"], "text": ""}
{"title": "最新活动：首届WCTF世界黑客大师赛（6月1-3日）", "url": "https://www.freebuf.com/fevents/105001.html", "time": "2016-05-23", "level": "", "num_look": 277748, "num_comment": 7, "author": "Sophia", "tags": ["活动"], "text": "首届WCTF世界黑客大师赛都要干啥？"}
{"title": "印度多个商业、政府组织遭受间谍团体Suckfly攻击", "url": "https://www.freebuf.com/articles/network/104954.html", "time": "2016-05-23", "level": "", "num_look": 319849, "num_comment": 2, "author": "安小白", "tags": ["网络安全"], "text": "Suckfly使用其自定义的恶意软件Backdoor.Nidiran进行感染，而该恶意软件在印度地区的活跃度比其他地区都高。"}
{"title": "走近黑客产业链：藏匿在黑暗世界的暴利链条", "url": "https://www.freebuf.com/news/topnews/104953.html", "time": "2016-05-23", "level": "现金奖励", "num_look": 706124, "num_comment": 18, "author": "米雪儿", "tags": ["头条", "安全报告"], "text": "当你肆无忌惮地使用互联网带给你的便捷时，你可曾知道，有一群神秘人物正隐藏在黑暗处，试图夺走你辛苦争来的金钱与网络信用。"}
{"title": "工具推荐： 汽车CAN总线分析框架CANToolz", "url": "https://www.freebuf.com/sectool/104985.html", "time": "2016-05-23", "level": "", "num_look": 326362, "num_comment": 7, "author": "小番番", "tags": ["工具"], "text": "CANToolz 是一个分析控制局域网络CAN和设备的框架，是一款很优秀的汽车安全分析工具。"}
{"title": "使用VOLATILITY发现高级恶意软件", "url": "https://www.freebuf.com/articles/system/104899.html", "time": "2016-05-23", "level": "", "num_look": 318387, "num_comment": 4, "author": "老王隔壁的白帽子", "tags": ["系统安全"], "text": "在这篇文章中会介绍使用“内存取证”技术来检测高级的恶意软件感染。"}
{"title": "【FreeBuf人物志】硅谷投资人弓峰敏漫谈：互联网安全创投的现在与未来", "url": "https://www.freebuf.com/news/topnews/104956.html", "time": "2016-05-23", "level": "红色标题", "num_look": 476531, "num_comment": 3, "author": "Sophia", "tags": ["人物志", "头条"], "text": "国内安全圈创业公司的现状如何?他们又将走向何方？硅谷投资人弓峰敏怎么看？"}
{"title": "从0到TrustZone第三篇：从QSEE劫持Linux内核", "url": "https://www.freebuf.com/vuls/104733.html", "time": "2016-05-23", "level": "", "num_look": 456026, "num_comment": 1, "author": "安小白", "tags": ["漏洞", "系统安全"], "text": "在前一篇文章中，我们介绍了QSEE的漏洞及利用，接下来让我们将重点转移到QSEE shellcode。"}
{"title": "看我如何用XSS“干掉”8/9的顶级杀软厂商", "url": "https://www.freebuf.com/vuls/105011.html", "time": "2016-05-23", "level": "金币+9", "num_look": 724840, "num_comment": 23, "author": "dawner", "tags": ["WEB安全", "漏洞"], "text": "我们针对世界上Top 9杀软公司的网站里攻克下了8个，成功实现了XSS的利用。"}
{"title": "赛门铁克/诺顿反病毒引擎远程Heap/Pool内存损坏漏洞分析（CVE-2016-2208）", "url": "https://www.freebuf.com/vuls/104852.html", "time": "2016-05-22", "level": "", "num_look": 372234, "num_comment": 9, "author": "vul_wish", "tags": ["漏洞"], "text": "近日，Symantec和Norton产品中使用的核心杀毒引擎被曝存在高危漏洞。"}
{"title": "太平洋网络诚招安全工程师（实习生）", "url": "https://www.freebuf.com/jobs/104916.html", "time": "2016-05-22", "level": "", "num_look": 504895, "num_comment": 17, "author": "Shirley66666", "tags": ["安全招聘"], "text": "太平洋网络安全招聘。"}
{"title": "使用Maltego进行互联网情报收集（入门篇）", "url": "https://www.freebuf.com/sectool/104949.html", "time": "2016-05-22", "level": "金币+9", "num_look": 2153016, "num_comment": 37, "author": "watcher", "tags": ["工具", "网络安全"], "text": "我们来介绍下如何使用Maltego来进行情报收集吧！"}
{"title": "如何自己搭建钓鱼网站检测系统", "url": "https://www.freebuf.com/articles/web/104870.html", "time": "2016-05-21", "level": "", "num_look": 627440, "num_comment": 16, "author": "阿里云誉反欺诈", "tags": ["WEB安全"], "text": "目前“钓鱼攻击”已经为了网络欺诈的重要一环，因此反钓鱼系统在电子商务、金融证券、电信运营商等企业的安全运营中起着越来越重要的地位。"}
{"title": "教你搭建你自己的“深度学习”机器", "url": "https://www.freebuf.com/articles/others-articles/104968.html", "time": "2016-05-21", "level": "金币+9", "num_look": 878158, "num_comment": 26, "author": "东二门陈冠希", "tags": ["其他", "极客"], "text": "对于那些不能深度学习功能的GPU，本文将会一步一步的教大家如何构建一个自己的深度学习机器。"}
{"title": "支持拖放的“点击劫持漏洞”利用工具：CJExploiter", "url": "https://www.freebuf.com/sectool/104892.html", "time": "2016-05-21", "level": "金币+9", "num_look": 317878, "num_comment": 4, "author": "felix", "tags": ["工具"], "text": "CJExploiter是一个支持拖放的点击劫持漏洞利用开发辅助工具。"}
{"title": "【520漏洞盒子帮你表白】一封白帽子的表白信", "url": "https://www.freebuf.com/fevents/104961.html", "time": "2016-05-20", "level": "红色标题", "num_look": 428101, "num_comment": 17, "author": "漏洞盒子", "tags": ["活动"], "text": "盒子小妹提醒各位白帽子：好好挖洞，礼物会有的，女朋友也会有的！"}
{"title": "转账3块扣1900？对支付宝木马的分析与追踪", "url": "https://www.freebuf.com/articles/system/104929.html", "time": "2016-05-20", "level": "红色标题", "num_look": 844478, "num_comment": 39, "author": "奇安信威胁情报中心", "tags": ["特别企划", "系统安全"], "text": "支付宝作为国内在线支付市场的老大饱受恶意代码的侵扰，黑产总在如何通过支付宝骗取钱财上发挥着聪明才智。"}
{"title": "1.17亿LinkedIn领英数据正在暗网地下黑市热卖", "url": "https://www.freebuf.com/news/104895.html", "time": "2016-05-20", "level": "金币+9", "num_look": 487849, "num_comment": 2, "author": "dawner", "tags": ["资讯"], "text": "为了安全起见，请尽快更改你的LinkedIn密码。"}
{"title": "如何用Canarytokens搭建蜜罐并检测可疑入侵", "url": "https://www.freebuf.com/sectool/104901.html", "time": "2016-05-20", "level": "", "num_look": 338845, "num_comment": 2, "author": "寰者", "tags": ["工具"], "text": "在本文中，我们将通过使用 Canarytokens工具来搭建蜜罐，对特殊资源的异常访问行为进行感知，及时发现入侵痕迹。"}
{"title": "平安科技诚招信息安全岗位若干", "url": "https://www.freebuf.com/jobs/104872.html", "time": "2016-05-20", "level": "", "num_look": 331991, "num_comment": 17, "author": "alenna_dong", "tags": ["安全招聘"], "text": "平安科技安全产品团队成立于2015年4月，我们的使命是为集团提供监控、防范外星人的武器装备，强化我们的防御能力。"}
{"title": "逆向破解H.Koenig 遥控器 Part 2", "url": "https://www.freebuf.com/geek/104801.html", "time": "2016-05-20", "level": "金币+5", "num_look": 175206, "num_comment": 2, "author": "老王隔壁的白帽子", "tags": ["极客"], "text": "文章第二部分将分析遥控信号。"}
{"title": "逆向破解 H.Koenig 遥控器（Part 1）", "url": "https://www.freebuf.com/articles/wireless/104680.html", "time": "2016-05-20", "level": "", "num_look": 331071, "num_comment": 4, "author": "老王隔壁的白帽子", "tags": ["无线安全"], "text": "iRobot的遥控器似乎是依靠红外，而H.koenig已经选择了在2.4 GHz ISM频段上的一个RF遥控操作。本系列文章我们将逆向分析其遥控器。"}
{"title": "安卓Hacking：转储和分析APP内存", "url": "https://www.freebuf.com/articles/terminal/104795.html", "time": "2016-05-20", "level": "", "num_look": 286006, "num_comment": 8, "author": "东二门陈冠希", "tags": ["终端安全"], "text": ""}
{"title": "BurpSuite日志分析过滤工具，加快SqlMap进行批量扫描的速度", "url": "https://www.freebuf.com/sectool/104855.html", "time": "2016-05-20", "level": "", "num_look": 506970, "num_comment": 11, "author": "Tony Lee", "tags": ["工具"], "text": "这是一个Python3写的，用于过滤BurpSuite日志的小程序。"}
{"title": "从安全漏洞看印度国家银行APP为何“技术落后10年”", "url": "https://www.freebuf.com/news/104797.html", "time": "2016-05-19", "level": "金币+5", "num_look": 497353, "num_comment": 9, "author": "东二门陈冠希", "tags": ["漏洞", "资讯"], "text": "白帽子对印度最大的国有银行进行分析发现存在重大漏洞，他把漏洞提交后，却..."}
{"title": "如何发现和检测Facebook上的机器人？", "url": "https://www.freebuf.com/news/104800.html", "time": "2016-05-19", "level": "", "num_look": 334117, "num_comment": 3, "author": "老王隔壁的白帽子", "tags": ["资讯"], "text": "对区分出真实的人类行为和机器账号生成的仿人类行为，研究者们一直乐此不疲。这次他们又搞出了什么新方法？"}
{"title": "深度：远控木马Posion Ivy开始肆虐缅甸和其它亚洲国家", "url": "https://www.freebuf.com/articles/paper/104819.html", "time": "2016-05-19", "level": "金币+5", "num_look": 500054, "num_comment": 3, "author": "felix", "tags": ["安全报告"], "text": "臭名昭著的远程控制木马Poison Ivy（后面称作PIVY）最近开始重新露出水面。并且出现了一些新行为。过去一年，已经发现PIVY为了种种企图攻击了许多亚洲国家。"}
{"title": "看我如何逆向智能手环控制无人机", "url": "https://www.freebuf.com/geek/104799.html", "time": "2016-05-19", "level": "", "num_look": 328512, "num_comment": 5, "author": "老王隔壁的白帽子", "tags": ["极客"], "text": "逆向智能手环，强行开发使其能够控制无人机。"}
{"title": "北京中睿天下iLAB实验室安全招聘", "url": "https://www.freebuf.com/jobs/104415.html", "time": "2016-05-19", "level": "", "num_look": 281216, "num_comment": 6, "author": "Distance_admin", "tags": ["安全招聘"], "text": "北京中睿天下信息技术有限公司）成立于2013年，是一家拥有全方位多元化立体防护产品的信息安全厂商和解决方案提供商。"}
{"title": "又一平台因黑客入侵而倒闭，比特币还有春天吗？", "url": "https://www.freebuf.com/news/104782.html", "time": "2016-05-19", "level": "", "num_look": 378287, "num_comment": 2, "author": "简单", "tags": ["资讯"], "text": "经专业的网络安全公司调查确认之后，比特币平台Gatecoin公开声明其系统遭到黑客入侵，15%的数字资产存款失窃。"}
{"title": "看我如何绕过一个Webshell认证", "url": "https://www.freebuf.com/articles/web/104730.html", "time": "2016-05-19", "level": "", "num_look": 555353, "num_comment": 14, "author": "felix", "tags": ["WEB安全"], "text": ""}
{"title": "新丝绸之路3.0再现暗网黑市", "url": "https://www.freebuf.com/news/104745.html", "time": "2016-05-19", "level": "金币+5", "num_look": 2387498, "num_comment": 13, "author": "米雪儿", "tags": ["资讯"], "text": "这已经是丝绸之路的第四次“复活”之旅了。"}
{"title": "Web爬虫：多线程、异步与动态代理初步", "url": "https://www.freebuf.com/articles/web/104732.html", "time": "2016-05-19", "level": "现金奖励", "num_look": 937292, "num_comment": 9, "author": "zrools", "tags": ["WEB安全"], "text": "使用Python3简单实现一个单机版多线程/异步+多代理的爬虫，没有分布式、不谈高效率，先跑起来再说，脑补开始。"}
{"title": "爱在心口难开，520漏洞盒子帮你表白", "url": "https://www.freebuf.com/fevents/104773.html", "time": "2016-05-18", "level": "", "num_look": 338927, "num_comment": 22, "author": "漏洞盒子", "tags": ["活动"], "text": "You are the apple of my eye, so give me a chance to love you..."}
{"title": "国外知名黑客论坛被黑，疑因imageTragick漏洞", "url": "https://www.freebuf.com/news/104757.html", "time": "2016-05-18", "level": "", "num_look": 269139, "num_comment": 8, "author": "watcher", "tags": ["资讯"], "text": "知名黑客论坛Nulled.io在本月早些时候遭到黑客入侵，一大批数据遭到泄漏，包括用户的电子邮箱地址，哈希密码，ip地址以及其它一些细节。"}
{"title": "百度安全诚聘安全工程师", "url": "https://www.freebuf.com/jobs/104739.html", "time": "2016-05-18", "level": "", "num_look": 468844, "num_comment": 31, "author": "百度安全", "tags": ["安全招聘"], "text": "百度安全专注于安全技术的研发工作，为20余家应用市场和全球10亿用户保驾护航。"}
{"title": "渗透测试中如何收集利用SNMP协议数据", "url": "https://www.freebuf.com/articles/network/104522.html", "time": "2016-05-18", "level": "", "num_look": 430534, "num_comment": 3, "author": "xiaix", "tags": ["网络安全"], "text": "今天我从渗透测试的角度讲述如何通过收集分析数据来发现并利用暴露的 SNMP 服务。"}
{"title": "美国白帽用漏洞奖励做公益", "url": "https://www.freebuf.com/news/104641.html", "time": "2016-05-18", "level": "红色标题", "num_look": 323000, "num_comment": 12, "author": "米雪儿", "tags": ["资讯"], "text": ""}
{"title": "GNURadio For Windows编译安装脚本v1.1.1发布", "url": "https://www.freebuf.com/sectool/104682.html", "time": "2016-05-18", "level": "", "num_look": 470580, "num_comment": 6, "author": "dawner", "tags": ["工具"], "text": "Windows安装GNURadio时，会自动化下载一系列powershell脚本，在源里进行build。"}
{"title": "2016年最佳的15款Android黑客工具", "url": "https://www.freebuf.com/sectool/104671.html", "time": "2016-05-18", "level": "金币+10", "num_look": 7297622, "num_comment": 22, "author": "watcher", "tags": ["工具", "无线安全"], "text": "借助于这些黑客工具，你就可以使用安卓手机来进行渗透测试和安全测试。"}
{"title": "海莲花重出水面：一个新近真实攻击案例的分析", "url": "https://www.freebuf.com/articles/paper/104638.html", "time": "2016-05-18", "level": "", "num_look": 471902, "num_comment": 8, "author": "奇安信威胁情报中心", "tags": ["安全报告"], "text": "发布报告一年左右的今天，我们还在持续监测着海莲花团伙的活动，最近的大网数据显示在4月份就发生了数百例新的感染，威胁并没有出现缓解的迹象。"}
{"title": "漫谈流量劫持", "url": "https://www.freebuf.com/articles/web/104426.html", "time": "2016-05-18", "level": "红色标题", "num_look": 1064382, "num_comment": 27, "author": "安全豹", "tags": ["WEB安全"], "text": "在鼠标点击的一刹那，流量在用户系统中流过层层节点，在路由的指引下奔向远程服务器，这段路程中短兵相接的战斗往往是最激烈的。"}
{"title": "技术分享：如何在Docker容器中运行Metasploit？", "url": "https://www.freebuf.com/sectool/104524.html", "time": "2016-05-18", "level": "金币+10", "num_look": 399988, "num_comment": 3, "author": "老王隔壁的白帽子", "tags": ["工具"], "text": "在docker容器中运行Metasploit Framework，可以绕开安装代码和依赖的痛苦。"}
{"title": "漏洞预警：Docker Swarm Manager远程管理端口访问", "url": "https://www.freebuf.com/vuls/104666.html", "time": "2016-05-17", "level": "红色标题", "num_look": 430563, "num_comment": 4, "author": "漏洞盒子", "tags": ["漏洞"], "text": "利用 Docker 节点上开放的 TCP 端口 2375 远程执行 Docker 命令，进而可获取服务器 Root 权限。"}
{"title": "深入分析跨平台网络电信诈骗", "url": "https://www.freebuf.com/articles/network/104576.html", "time": "2016-05-17", "level": "", "num_look": 513237, "num_comment": 4, "author": "360手机卫士", "tags": ["安全报告", "特别企划"], "text": "电信网络诈骗，这一次用了什么招？"}
{"title": "Panopticon：一款开源跨平台的汇编逆向工具", "url": "https://www.freebuf.com/sectool/104045.html", "time": "2016-05-17", "level": "金币+10", "num_look": 279904, "num_comment": 4, "author": "安小白", "tags": ["工具"], "text": "Panopticon是一款使用Rust语言编写的跨平台的逆向工程反汇编工具，其中包含反编译、分析反编译和修补各种平台上的二进制文件和指令集的功能。"}
{"title": "深圳腾讯电脑管家招聘安全研究员", "url": "https://www.freebuf.com/jobs/104304.html", "time": "2016-05-17", "level": "", "num_look": 349397, "num_comment": 14, "author": "腾讯电脑管家", "tags": ["安全招聘"], "text": "腾讯公司成立于1998年11月， 是目前中国最大的互联网综合服务提供商之一，也是中国服务用户最多的互联网企业之一。"}
{"title": "“棱镜门续集”大戏开演：美国媒体曝光首批斯诺登泄密文件", "url": "https://www.freebuf.com/news/104607.html", "time": "2016-05-17", "level": "", "num_look": 331035, "num_comment": 7, "author": "0xroot", "tags": ["资讯"], "text": "这篇文章为您揭秘：斯诺登文档中都披露了哪些不为人知的秘密和勾当？"}
{"title": "黑产揭秘：“打码平台”那点事儿", "url": "https://www.freebuf.com/articles/others-articles/104536.html", "time": "2016-05-17", "level": "红色标题", "num_look": 2568147, "num_comment": 27, "author": "阿里云誉反欺诈", "tags": ["其他", "安全报告"], "text": "本文将带你走近互联网业务眼前的威胁——图片打码平台和短信打码平台。"}
{"title": "国外隐私泄露看的过瘾吗？这次中招的是中国大佬们", "url": "https://www.freebuf.com/news/104467.html", "time": "2016-05-17", "level": "金币+10", "num_look": 539337, "num_comment": 20, "author": "米雪儿", "tags": ["资讯"], "text": "最近，几十个中国名人（包括马云、王健林等）的个人信息被曝光在一个名为“shenfenzhen（身份证？）”的Twitter账号上。"}
{"title": "极客教学：如何使用树莓派击落&劫持无人机", "url": "https://www.freebuf.com/geek/104532.html", "time": "2016-05-17", "level": "", "num_look": 413601, "num_comment": 8, "author": "dawner", "tags": ["极客"], "text": "四轴无人机能够以独特视角记录下高质量的视频，但是联邦航空管理局（FAA）称，这些无人驾驶系统在安全和隐私方面的可靠性有待商榷。"}
{"title": "企业安全建设初期的几点反思", "url": "https://www.freebuf.com/articles/security-management/104526.html", "time": "2016-05-17", "level": "现金奖励", "num_look": 674048, "num_comment": 24, "author": "IIIIsh", "tags": ["安全管理"], "text": "企业安全建设初期有哪些注意事项？这篇文章告诉你答案。"}
{"title": "工具推荐：Dradis，Kali渗透测试报告生成器", "url": "https://www.freebuf.com/sectool/104410.html", "time": "2016-05-17", "level": "", "num_look": 511065, "num_comment": 2, "author": "东二门陈冠希", "tags": ["工具"], "text": "许多渗透测试人员发现报告的制作是一个无聊的过程，因为它需要大量的时间和精力。本文中我们将分享一款自动化报告生成器。"}
{"title": "如何自动化检测海康威视设备弱口令？", "url": "https://www.freebuf.com/articles/terminal/104472.html", "time": "2016-05-17", "level": "现金奖励", "num_look": 855302, "num_comment": 19, "author": "DMZLab", "tags": ["终端安全"], "text": "本文将分享使用Python自动化检测海康设备弱口令的一些姿势。"}
{"title": "飞越珠海来看你：2016 GeekPwn澳门全程纪实", "url": "https://www.freebuf.com/news/104418.html", "time": "2016-05-16", "level": "红色标题", "num_look": 581517, "num_comment": 20, "author": "FB独家", "tags": ["头条", "活动"], "text": "FreeBuf作为GeekPwn（极棒）官方方合作媒体，前往澳门现场报道这一极客狂欢盛宴。"}
{"title": "针对Phorum开源论坛项目的安全评估报告", "url": "https://www.freebuf.com/articles/web/104088.html", "time": "2016-05-16", "level": "", "num_look": 336892, "num_comment": 1, "author": "watcher", "tags": ["WEB安全", "安全报告"], "text": "我们将对Phorum社区程序的一些重要面进行安全评估。"}
{"title": "公有云安全修炼之路，郭靖和周伯通带你走", "url": "https://www.freebuf.com/articles/neopoints/104451.html", "time": "2016-05-16", "level": "红色标题", "num_look": 407191, "num_comment": 5, "author": "s3curity", "tags": ["观点"], "text": "在看似威胁众多的弱势背景下，为什么公有云安全性比私有云更胜一筹？"}
{"title": "VOIP Hacking：攻击者是如何篡改VOIP电话的？", "url": "https://www.freebuf.com/articles/network/103813.html", "time": "2016-05-16", "level": "", "num_look": 407524, "num_comment": 5, "author": "东二门陈冠希", "tags": ["网络安全"], "text": "本次实验介绍电话信号的篡改：一种旨在通信会话中插入、修改和删除VoIP包的中间人攻击。"}
{"title": "【FreeBuf视频】《安全大咖说》专访知道创宇CTO杨冀龙（watercloud）", "url": "https://www.freebuf.com/video/104310.html", "time": "2016-05-16", "level": "红色标题", "num_look": 495569, "num_comment": 10, "author": "FB视频", "tags": ["人物志", "视频"], "text": "从\"纯技术屌丝\"到CTO，杨冀龙在98年就预言到未来计算是云的时代，云时代主要依赖水利发电与水利智能， 所以给自己取了预言性的名字——watercloud。"}
{"title": "技术分享：如何使用Metasploit对安卓手机进行控制", "url": "https://www.freebuf.com/articles/terminal/104407.html", "time": "2016-05-16", "level": "金币+7", "num_look": 1330977, "num_comment": 27, "author": "东二门陈冠希", "tags": ["终端安全"], "text": "在这次的实验中，我会使用kali linux和安卓模拟器演示如何使用Metasploit框架控制Android设备。"}
{"title": "Manalyze：PE文件的静态分析工具", "url": "https://www.freebuf.com/sectool/104378.html", "time": "2016-05-16", "level": "", "num_look": 338268, "num_comment": 7, "author": "Sphinx", "tags": ["工具"], "text": "我认为很多专家用户，即病毒分析人员可以使用一种能够提供尽可能多信息的工具来分析PE可执行文件，并且由他们自己来做最后的决定。"}
{"title": "如何在网络中追踪入侵者（三）：主机追踪", "url": "https://www.freebuf.com/articles/network/104251.html", "time": "2016-05-15", "level": "金币+7", "num_look": 379934, "num_comment": 3, "author": "老王隔壁的白帽子", "tags": ["特别企划", "网络安全"], "text": "在这个系列的最后一部分，我们将会描述利用免费工具在主机上进行追踪的一些要点。"}
{"title": "悲剧：海盗湾将永久失去其主域名.SE", "url": "https://www.freebuf.com/news/104357.html", "time": "2016-05-14", "level": "", "num_look": 230498, "num_comment": 4, "author": "watcher", "tags": ["资讯"], "text": "瑞典法院星期四裁决，收回海盗湾的'ThePirateBay.se' 和 'PirateBay.se'域名，并将其交给国家。"}
{"title": "阿里ASRC 2016白帽大会，他们玩儿了啥？", "url": "https://www.freebuf.com/fevents/104353.html", "time": "2016-05-14", "level": "红色标题", "num_look": 439693, "num_comment": 24, "author": "Sophia", "tags": ["活动"], "text": "​这段话不禁让小编想到漫威中的超级英雄们，虽然能力不凡，但平日里他们也许恰恰只是那些生活平凡的普通人。"}
{"title": "Windows Zero-Day漏洞（CVE-2016-0167）：攻击支付卡数据", "url": "https://www.freebuf.com/vuls/104323.html", "time": "2016-05-14", "level": "金币+7", "num_look": 341432, "num_comment": 6, "author": "vul_wish", "tags": ["漏洞"], "text": "2016年3月，出现了一批包含经济动机的以零售、餐饮和酒店业为目标的攻击，这些攻击邮件中包含大量带有嵌入式宏的Microsoft Word文档，一旦下载就会执行一个名为PUNCHBUGGY的下载器。"}
{"title": "无线安全渗透测试套件WiFi-Pumpkin新版本发布", "url": "https://www.freebuf.com/sectool/104233.html", "time": "2016-05-14", "level": "", "num_look": 451727, "num_comment": 26, "author": "饭团君", "tags": ["工具"], "text": "WiFi-Pumpkin是一款无线安全检测工具，利用该工具可以伪造接入点完成中间人攻击，同时也支持一些其它的无线渗透功能。"}
{"title": "JS编写的银行木马是怎样的存在？一起逆向来看看", "url": "https://www.freebuf.com/articles/system/104254.html", "time": "2016-05-14", "level": "", "num_look": 316935, "num_comment": 2, "author": "老王隔壁的白帽子", "tags": ["系统安全"], "text": "Gootkit——在一些地方也被称为Xswkit ，是一款几乎完全用JavaScript编写的银行恶意软件。"}
{"title": "DarkHotel定向攻击样本分析", "url": "https://www.freebuf.com/articles/system/104333.html", "time": "2016-05-13", "level": "", "num_look": 377233, "num_comment": 9, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "DarkHotel团伙在2014年被卡巴斯基做过一次暴光，但直到最近还一直非常活跃。"}
{"title": "工具推荐：NFC门禁卡一键模拟器", "url": "https://www.freebuf.com/sectool/104307.html", "time": "2016-05-13", "level": "", "num_look": 2632513, "num_comment": 42, "author": "混乱之治", "tags": ["工具"], "text": "使用这个工具可以用手机模拟门禁卡。"}
{"title": "识别WEB应用防火墙（WAF）？这个工具能帮到你", "url": "https://www.freebuf.com/sectool/104256.html", "time": "2016-05-13", "level": "金币+6", "num_look": 535948, "num_comment": 15, "author": "felix", "tags": ["工具"], "text": "WAFW00F可以提取Web应用防火墙的指纹，识别WAF产品类型。"}
{"title": "外媒报道：中国知名ARM制造商全志科技在Linux中留下内核后门", "url": "https://www.freebuf.com/news/104270.html", "time": "2016-05-13", "level": "金币+6", "num_look": 558169, "num_comment": 14, "author": "dawner", "tags": ["系统安全", "资讯"], "text": "全志科技（Allwinner）在设备内核中留下后门，轻轻松松获取设备最高权限。"}
{"title": "比特币敲诈者现身中文版Word", "url": "https://www.freebuf.com/articles/system/104221.html", "time": "2016-05-13", "level": "", "num_look": 525907, "num_comment": 15, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "在众多绑票软件中，比特币敲诈者无疑是最猖狂的。其黑产模式之完善，归根于比特币支付无法被追踪这一特性。"}
{"title": "安卓变僵尸：新型病毒“维京部落”分析", "url": "https://www.freebuf.com/articles/terminal/104049.html", "time": "2016-05-13", "level": "", "num_look": 222028, "num_comment": 4, "author": "Sphinx", "tags": ["终端安全"], "text": "这款病毒能够执行广告欺诈，还能进行DDoS攻击、发送垃圾信息等。至少已经有5款应用通过了Google Play的病毒扫描。"}
{"title": "美剧《黑客军团》官网被爆存在漏洞", "url": "https://www.freebuf.com/news/104265.html", "time": "2016-05-13", "level": "金币+6", "num_look": 290848, "num_comment": 15, "author": "watcher", "tags": ["资讯"], "text": "《黑客军团》是一部美国心理惊悚电视剧，该剧讲述了一名纽约市网络安全工程师对抗大集团的故事。该电视剧的第二季将于2016年7月13日重回美国的电视屏幕。"}
{"title": "汽车之家诚招安全人才", "url": "https://www.freebuf.com/jobs/103729.html", "time": "2016-05-13", "level": "", "num_look": 293971, "num_comment": 8, "author": "cn_H5", "tags": ["安全招聘"], "text": "汽车之家是中国最值得信赖的汽车互联网服务平台——为汽车消费者提供贯穿选车、买车、用车、置换所有环节的全面、准确、快捷的一站式服务。"}
{"title": "走近Docker安全扫描器", "url": "https://www.freebuf.com/sectool/104080.html", "time": "2016-05-13", "level": "", "num_look": 366705, "num_comment": 5, "author": "东二门陈冠希", "tags": ["工具"], "text": "本文是关于一款Docker安全扫描器的一般性使用介绍，其原名为Project Nautilus。它可以作为Docker云私有仓库或者Docker Hub官方仓库的扩展服务。"}
{"title": "Linux堆内存管理深入分析（上）", "url": "https://www.freebuf.com/articles/system/104144.html", "time": "2016-05-13", "level": "", "num_look": 495053, "num_comment": 7, "author": "阿里聚安全", "tags": ["系统安全"], "text": "近年来，漏洞挖掘越来越火，各种漏洞挖掘、利用的分析文章层出不穷。从大方向来看，主要有基于栈溢出的漏洞利用和基于堆溢出的漏洞利用两种。国内关于栈溢出的资料相对较多，这里就不累述了，但是关于堆溢出的漏洞…"}
{"title": "内网渗透防御：如何防御Hash注入攻击", "url": "https://www.freebuf.com/articles/terminal/104063.html", "time": "2016-05-13", "level": "红色标题", "num_look": 609798, "num_comment": 3, "author": "felix", "tags": ["安全管理", "系统安全"], "text": "渗透测试人员对Pass-the-Hash（PtH）我们常在渗透测试中用到它。不管你有多少经验，你对问题了解得可能不深，或许还不知道它是怎么解决的，注意是“解决”而不是“修复”。"}
{"title": "【RFID Hacking③】ProxMark3使用案例：嗅探银行闪付卡信息", "url": "https://www.freebuf.com/geek/104239.html", "time": "2016-05-12", "level": "红色标题", "num_look": 877121, "num_comment": 17, "author": "吃葡萄不吐葡萄皮的雪碧", "tags": ["极客", "特别企划"], "text": "通过本文我们将学习如何使用ProxMark3嗅探RFID通信数据。"}
{"title": "世界上最大色情网站Pornhub发起漏洞奖励，严重漏洞奖25000美元", "url": "https://www.freebuf.com/news/104190.html", "time": "2016-05-12", "level": "", "num_look": 572085, "num_comment": 29, "author": "Sophia", "tags": ["资讯"], "text": "一起用更安全的姿势来看AV，好不好？"}
{"title": "Facebook CTF平台宣布开源", "url": "https://www.freebuf.com/sectool/104092.html", "time": "2016-05-12", "level": "", "num_look": 1140868, "num_comment": 28, "author": "xiaoqin00", "tags": ["工具"], "text": "入侵计算机，网络和网站很容易让你进监狱。但是如果你有一个安全合法的环境来免费测试和练习你的黑客技能呢? 你还会入侵计算机，入侵网络，入侵网站吗？"}
{"title": "优分期招聘安全专家/安全工程师", "url": "https://www.freebuf.com/jobs/104159.html", "time": "2016-05-12", "level": "", "num_look": 205078, "num_comment": 9, "author": "xyoo", "tags": ["安全招聘"], "text": "优分期是北京和创未来网络科技有限公司旗下网站，总部位于北京，是面向在校大学生提供分期付款购物服务的在线商城。"}
{"title": "用Python和Smali模拟器搞定一个加混淆、防篡改的APK逆向", "url": "https://www.freebuf.com/articles/web/103980.html", "time": "2016-05-12", "level": "", "num_look": 566450, "num_comment": 7, "author": "NoSecTec", "tags": ["WEB安全", "网络安全"], "text": "他试图通过解混淆一个APK，来理解该APK的混淆基址和防篡改保护机制。"}
{"title": "【已结束】GeekPwn澳门站，这一次黑阔们会施展哪些绝技？", "url": "https://www.freebuf.com/fevents/104106.html", "time": "2016-05-12", "level": "红色标题", "num_look": 499866, "num_comment": 25, "author": "FB独家", "tags": ["活动", "特别企划"], "text": "GeekPwn澳门站，FreeBuf现场直击"}
{"title": "从CSE Asia 2016亚洲消费电子展看智能设备安全", "url": "https://www.freebuf.com/news/104094.html", "time": "2016-05-12", "level": "", "num_look": 274355, "num_comment": 2, "author": "Sophia", "tags": ["头条", "活动"], "text": "现在问题来了：会展上令人目不暇接的智能设备真能保护你的安全？"}
{"title": "ImageMagick（CVE-2016-3714）执行过程，漏洞分析以及修复方案", "url": "https://www.freebuf.com/vuls/104048.html", "time": "2016-05-12", "level": "现金奖励", "num_look": 824246, "num_comment": 10, "author": "Luverose", "tags": ["WEB安全", "头条"], "text": "在本周二，ImageMagick披露出了一个严重的0day漏洞，此漏洞允许攻击者通过上传恶意构造的图像文件，在目标服务器执行任意代码。在这篇文章中我们将分析利用这个漏洞。"}
{"title": "杭州默安科技影武者实验室安全招聘", "url": "https://www.freebuf.com/jobs/103986.html", "time": "2016-05-12", "level": "", "num_look": 665897, "num_comment": 27, "author": "iceyes", "tags": ["安全招聘"], "text": "杭州默安科技影武者实验室安全岗位招聘"}
{"title": "RSA 2016议题：如何用Splunk分析日志检测恶意行为", "url": "https://www.freebuf.com/news/103135.html", "time": "2016-05-12", "level": "", "num_look": 376423, "num_comment": 2, "author": "老王隔壁的白帽子", "tags": ["数据安全", "资讯"], "text": "ark Russinovich在RSA 2016上做了关于sysmon的演讲，它的EventIDs，和解释了如何利用sysmon来检测恶意软件。"}
{"title": "构建互联网企业风控系统方法论", "url": "https://www.freebuf.com/articles/security-management/104104.html", "time": "2016-05-12", "level": "", "num_look": 330447, "num_comment": 7, "author": "阿里云誉反欺诈", "tags": ["安全管理"], "text": "风控概念针对不同的行业(如金融)，不同的业务场景(如贷款)都有不同的解决方案。"}
{"title": "安全预警：WordPress论坛插件bbPress存在存储型XSS漏洞，影响修复版本2.5.9以前所有版本", "url": "https://www.freebuf.com/vuls/103520.html", "time": "2016-05-12", "level": "红色标题", "num_look": 505124, "num_comment": 3, "author": "寰者", "tags": ["WEB安全", "漏洞"], "text": "近日，WordPress母公司Automattic发布了bbPress 2.5.9版本，在这个官方的WordPress论坛插件的最新版本中，修复了一个威胁程度较高的存储型XSS漏洞，影响范围包括现有的bbPress版本，即版本< 2.5.9的皆会受到影响。"}
{"title": "极客DIY：制作一款属于自己的街机", "url": "https://www.freebuf.com/geek/104014.html", "time": "2016-05-12", "level": "", "num_look": 366377, "num_comment": 4, "author": "饭团君", "tags": ["极客"], "text": "还记得那些给人带来乐趣的街机吗？你是不是也想拥有一款属于自己的街机呢？"}
{"title": "内部威胁那些事儿（一）", "url": "https://www.freebuf.com/news/topnews/104030.html", "time": "2016-05-12", "level": "现金奖励", "num_look": 701755, "num_comment": 5, "author": "木千之", "tags": ["头条", "特别企划"], "text": "基于近一年的研究调研，我整理出当前内部威胁研究的相关情况，供诸位FB同仁讨论交流，以作抛砖引玉之用。"}
{"title": "巧用python和libnmapd，一行代码提取Nmap扫描结果", "url": "https://www.freebuf.com/articles/network/104002.html", "time": "2016-05-12", "level": "金币+6", "num_look": 621087, "num_comment": 9, "author": "xiaix", "tags": ["网络安全"], "text": "每当我进行内网渗透面对大量主机和服务时，我总是习惯使用自动化的方式从 nmap 扫描结果中提取信息。"}
{"title": "360 Marvel Team虚拟化漏洞第五弹：CVE-2016-3710 Dark Portal漏洞分析", "url": "https://www.freebuf.com/articles/network/103962.html", "time": "2016-05-11", "level": "", "num_look": 365246, "num_comment": 6, "author": "360安全", "tags": ["安全报告", "网络安全"], "text": "本文将详细分析已经潜伏了编号CVE-2016-3710（英文名：Dark Portal，中文名：传送门）的越界读写内存漏洞的相关知识。"}
{"title": "数据危机：24小时 TOP4 数据泄露事件", "url": "https://www.freebuf.com/news/103991.html", "time": "2016-05-11", "level": "金币+6", "num_look": 401871, "num_comment": 9, "author": "米雪儿", "tags": ["数据安全", "资讯"], "text": "以下是今天为大家总结的过去24小时内发生的TOP 4数据泄露事件。"}
{"title": "从0到TrustZone（第二篇）： QSEE提权漏洞及利用（CVE-2015-6639）", "url": "https://www.freebuf.com/vuls/103893.html", "time": "2016-05-11", "level": "", "num_look": 476488, "num_comment": 4, "author": "安小白", "tags": ["漏洞"], "text": "在本文中，我们讨论一下如何发现并利用一个漏洞，获取高通的安全可执行环境(QSEE)的代码执行权限"}
{"title": "一万两千个PoC背后隐藏的信息", "url": "https://www.freebuf.com/articles/neopoints/103947.html", "time": "2016-05-11", "level": "红色标题", "num_look": 413042, "num_comment": 5, "author": "寰者", "tags": ["观点"], "text": "威胁情报公司Recorded Future的安全研究人员对发布在网络上的PoC exploits进行了分析，我们一起来看看他们的分析结果 :)"}
{"title": "逆向华为路由器（第二部分）", "url": "https://www.freebuf.com/geek/103551.html", "time": "2016-05-11", "level": "金币+6", "num_look": 340423, "num_comment": 3, "author": "饭团君", "tags": ["极客"], "text": "如果想要在硬件方向进行逆向工作，但是没有什么时间。这往往会进行不到一个更高的层次，例如网络漏洞、ISP 协议等。"}
{"title": "案例分享：Lansweeper 5 认证风险利用", "url": "https://www.freebuf.com/articles/terminal/103634.html", "time": "2016-05-11", "level": "", "num_look": 234591, "num_comment": 4, "author": "东二门陈冠希", "tags": ["系统安全", "终端安全"], "text": "Lansweeper是一个资产管理软件，可以扫描你的网络环境，获取系统信息、网络接口、资产状态等等。"}
{"title": "2016年全球TOP10安全并购案，哪些领域成为大佬的“眼中宝”？", "url": "https://www.freebuf.com/news/topnews/103895.html", "time": "2016-05-11", "level": "现金奖励", "num_look": 413961, "num_comment": 5, "author": "米雪儿", "tags": ["头条", "安全管理"], "text": "为了理清哪些企业又被哪些大佬看中了，进而推断出未来科技发展趋势，特此总结了2016年以来的大型收购案件。"}
{"title": "形同虚设：花费700美元便可突破门禁", "url": "https://www.freebuf.com/vuls/103872.html", "time": "2016-05-11", "level": "", "num_look": 303893, "num_comment": 6, "author": "米雪儿", "tags": ["漏洞"], "text": "近日，黑客向Tech Insider展示了如何通过在亚马逊和eBay上购买价值700美元的电子零件来克隆门禁卡，成功闯入办公室的全过程。"}
{"title": "如何在网络中追踪入侵者（二）：高阶模式", "url": "https://www.freebuf.com/articles/network/103817.html", "time": "2016-05-11", "level": "金币+6", "num_look": 1970700, "num_comment": 8, "author": "老王隔壁的白帽子", "tags": ["安全管理", "网络安全"], "text": "在这个系列的第二部分，我会检查这些信号并且讨论它们在被动DNS中可以怎样使用来追踪网络中未知的恶意攻击者。"}
{"title": "CobaltStrike最新版完美破解方法", "url": "https://www.freebuf.com/sectool/103766.html", "time": "2016-05-10", "level": "红色标题", "num_look": 1406566, "num_comment": 23, "author": "DMZLab", "tags": ["工具"], "text": "Cobalt Strike 一款以metasploit为基础的GUI的框架式渗透工具，本文将分享如何破解其最新版本。"}
{"title": "ZAProxy：寻找Web应用程序漏洞的综合性渗透测试工具", "url": "https://www.freebuf.com/sectool/103803.html", "time": "2016-05-10", "level": "", "num_look": 481831, "num_comment": 13, "author": "饭团君", "tags": ["工具"], "text": "OWASP Zed Attack Proxy (ZAP)是一款用于寻找Web应用程序漏洞的综合性渗透测试工具，同时它也易于使用。"}
{"title": "建立你自己的Passive DNS收集系统", "url": "https://www.freebuf.com/articles/network/103815.html", "time": "2016-05-10", "level": "", "num_look": 665048, "num_comment": 14, "author": "东二门陈冠希", "tags": ["网络安全"], "text": "在本篇文章中，我将会向大家介绍如何在Ubuntu服务器上搭建一个Bro IDS并且安装一个bro-pdns来记录DNS的查询记录，存入SQL数据库中。"}
{"title": "科幻成真：索尼研发能拍照能录像的隐形眼镜", "url": "https://www.freebuf.com/news/103821.html", "time": "2016-05-10", "level": "", "num_look": 213435, "num_comment": 6, "author": "dawner", "tags": ["资讯"], "text": "如果我说你现在眨眨眼睛，就能够以视频片段的方式记录下看见的事物，你会相信么？"}
{"title": "如何在网络中追踪入侵者（一）：架构", "url": "https://www.freebuf.com/articles/network/103818.html", "time": "2016-05-10", "level": "金币+6", "num_look": 634038, "num_comment": 9, "author": "老王隔壁的白帽子", "tags": ["安全管理", "网络安全"], "text": "一个功能齐全的追踪平台极大的提升了追踪者的能力，但是安全预算有限并且公司不会总是投资有前途的技术。幸运的是，有好几种廉价的追踪方式。"}
{"title": "关于Apache Struts 2 S2-032漏洞威胁监测和应急处置的情况公告", "url": "https://www.freebuf.com/vuls/103823.html", "time": "2016-05-10", "level": "", "num_look": 314763, "num_comment": 3, "author": "CNCERT", "tags": ["漏洞"], "text": "4月底，Apache Struts 2 S2-032远程代码执行漏洞的利用代码被披露并在短时间内迅速传播。"}
{"title": "技术分析：微软 Office 365平台SAML服务漏洞，可越权访问其他用户资源", "url": "https://www.freebuf.com/vuls/103718.html", "time": "2016-05-10", "level": "", "num_look": 416604, "num_comment": 3, "author": "寰者", "tags": ["WEB安全", "漏洞"], "text": "近期，两位安全研究人员，Klemen Bratec及 Ioannis Kakavas，公布了他们发现的一个在Microsoft Office 365平台上的SAML服务漏洞。"}
{"title": "极客DIY：制作一款属于自己的谷歌眼镜", "url": "https://www.freebuf.com/geek/103783.html", "time": "2016-05-10", "level": "", "num_look": 444650, "num_comment": 4, "author": "饭团君", "tags": ["极客"], "text": "你想不想拥有一款属于自己的虚拟现实眼镜，是否因为看到此类眼镜的价格之后心碎了？"}
{"title": "安全报告：通过NVD漏洞库看近年漏洞发展趋势", "url": "https://www.freebuf.com/vuls/103661.html", "time": "2016-05-10", "level": "", "num_look": 331207, "num_comment": 3, "author": "东二门陈冠希", "tags": ["安全报告", "漏洞"], "text": "本篇文章将会对NVD漏洞库过去5年的漏洞进行分析，看看漏洞的发展趋势是怎么样的。"}
{"title": "大数据追踪黑客：美国“神盾局”DARPA将开发新算法打击恐怖主义", "url": "https://www.freebuf.com/news/103639.html", "time": "2016-05-09", "level": "", "num_look": 208040, "num_comment": 11, "author": "dawner", "tags": ["资讯"], "text": "为提高监视行动并准确打击恐怖主义，以及有效地对犯罪分子进行追踪，美国“神盾局”DARPA将开发新算法。"}
{"title": "惊心命局：心脏手术中杀软扫描引医疗设备死机", "url": "https://www.freebuf.com/news/103745.html", "time": "2016-05-09", "level": "", "num_look": 261795, "num_comment": 10, "author": "米雪儿", "tags": ["终端安全", "资讯"], "text": "一台关键医疗设备在心脏手术期间因为软件所运行的PC上安装的杀毒软件的定时扫描而崩溃。"}
{"title": "黑客是如何“一键”盗取汽车的？（附演示视频）", "url": "https://www.freebuf.com/news/103648.html", "time": "2016-05-09", "level": "红色标题", "num_look": 363262, "num_comment": 7, "author": "饭团君", "tags": ["头条", "资讯"], "text": "近日发生了一件有趣的汽车失窃案。"}
{"title": "安全预警：PHP zip组件整型溢出可远程命令执行", "url": "https://www.freebuf.com/vuls/103705.html", "time": "2016-05-09", "level": "红色标题", "num_look": 512263, "num_comment": 10, "author": "白帽汇", "tags": ["漏洞"], "text": "在php7.x的版本，当用getformindex和getfromname ziparchive的方式读取压缩包时，导致堆溢出。"}
{"title": "距离感染中文版Office还远吗？勒索软件Locky最新传播载体分析", "url": "https://www.freebuf.com/articles/system/103730.html", "time": "2016-05-09", "level": "", "num_look": 253963, "num_comment": 7, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "基于比特币的匿名支持体系使勒索软件这个商业模式轻松完成了闭环，而Locky勒索软件家族可能是其中最贪婪粗放的一个，漫天撒网以期最大范围地捞取不义之财。"}
{"title": "2.7亿Gmail、雅虎和Hotmail账号遭泄露", "url": "https://www.freebuf.com/news/103646.html", "time": "2016-05-09", "level": "红色标题", "num_look": 707828, "num_comment": 23, "author": "米雪儿", "tags": ["数据安全", "资讯"], "text": "俄罗斯用户的Gmail、雅虎及微软电邮Hotmail等2.723亿个帐号惨遭泄露，并在俄罗斯地下黑市进行交易。"}
{"title": "如何黑掉 Telegram 以及 WhatsApp？", "url": "https://www.freebuf.com/vuls/103676.html", "time": "2016-05-09", "level": "", "num_look": 552963, "num_comment": 5, "author": "饭团君", "tags": ["漏洞"], "text": "在上周出现了一条新闻， Telegram以及WhatsApp并没有你想的那么安全。"}
{"title": "工具推荐：OWASP VBScan 0.1.6 - Black Box vBulletin漏洞扫描器", "url": "https://www.freebuf.com/sectool/103392.html", "time": "2016-05-09", "level": "", "num_look": 343540, "num_comment": 2, "author": "0xroot", "tags": ["工具"], "text": "OWASP VBScan (VBulletin Vulnerability Scanner的简写)，VBScan是采用Perl语言开发的一个开源项目，可对vBulletin CMS进行漏洞扫描检测。"}
{"title": "最新研究：电脑病毒或可通过声音进行传播", "url": "https://www.freebuf.com/news/103693.html", "time": "2016-05-09", "level": "金币+6", "num_look": 407610, "num_comment": 23, "author": "watcher", "tags": ["系统安全", "资讯"], "text": "安全研究者发现电脑病毒\"badBiOS\"可以通过麦克风音频流进行传播。"}
{"title": "美国将研究一新技术用来识别和跟踪全球的黑客", "url": "https://www.freebuf.com/news/103663.html", "time": "2016-05-08", "level": "", "num_look": 341587, "num_comment": 5, "author": "watcher", "tags": ["网络安全", "资讯"], "text": "去年，美国总统奥巴马签署了美国自由法案也正是因为这一原因，该法案结束了美国情报机构对国内电话数据进行的大规模监视活动。"}
{"title": "Hash Algorithm Identifier：一款快速识别Hash加密类型的工具", "url": "https://www.freebuf.com/sectool/103666.html", "time": "2016-05-08", "level": "", "num_look": 410681, "num_comment": 7, "author": "watcher", "tags": ["工具"], "text": "Hash identifier的代码并不是很有效率，有大量的if-else-if，并且有许多方法构造是重复的，这一切使得它的代码十分冗余。"}
{"title": "75%安卓设备受威胁，都是高通API代码惹的祸", "url": "https://www.freebuf.com/news/103672.html", "time": "2016-05-08", "level": "金币+6", "num_look": 210676, "num_comment": 12, "author": "米雪儿", "tags": ["资讯"], "text": "近日，美国网络安全公司FireEye披露了一个严重的信息泄露漏洞，该漏洞是由移动芯片巨头高通公司引入到 Android系统中的。"}
{"title": "Windows内核漏洞CVE-2016-0143分析", "url": "https://www.freebuf.com/vuls/103064.html", "time": "2016-05-06", "level": "", "num_look": 387822, "num_comment": 4, "author": "路由器", "tags": ["漏洞"], "text": "4月20日，Nils Sommer在exploitdb上爆出了一枚新的Windows内核漏洞PoC。"}
{"title": "如何手工渗透测试Web应用程序（一）：入门", "url": "https://www.freebuf.com/articles/web/103557.html", "time": "2016-05-06", "level": "", "num_look": 671665, "num_comment": 12, "author": "felix", "tags": ["WEB安全"], "text": "世界上大多数公司都非常关注对web应用程序的手动测试，而不是运行web应用程序扫描器——因为它会限制你的知识和技能，影响在测试中寻找漏洞的视野。"}
{"title": "观点：勒索软件过时了？他们正开始吞噬物联网", "url": "https://www.freebuf.com/articles/wireless/103516.html", "time": "2016-05-06", "level": "", "num_look": 385418, "num_comment": 4, "author": "felix", "tags": ["无线安全", "观点"], "text": "你觉得人们会付多少钱来移除心脏起搏器上的勒索软件？这个场景并不遥远，而且非常有致命性。"}
{"title": "PitGen：帮你利用010Editor的模板生成对应的Peach PIT", "url": "https://www.freebuf.com/sectool/103548.html", "time": "2016-05-06", "level": "", "num_look": 255042, "num_comment": 4, "author": "CNNVD", "tags": ["工具"], "text": "使用这个工具，最大的便利就是不用再重复地人工将类型转换成PIT语法写进去，可以提高PIT的编写效率。"}
{"title": "极客DIY：通过树莓派发送摩斯码", "url": "https://www.freebuf.com/geek/103560.html", "time": "2016-05-06", "level": "", "num_look": 361970, "num_comment": 12, "author": "zhuzhibo0", "tags": ["极客"], "text": "这是一个开源的工具可以让树莓派提供RESTful API的方式，你可以发送一个消息给树莓派，然后将转换成摩斯密码,然后通过控制LED灯表现出来。"}
{"title": "郑州向心力安全实验室招聘安全工程师", "url": "https://www.freebuf.com/jobs/103391.html", "time": "2016-05-06", "level": "", "num_look": 239874, "num_comment": 25, "author": "ziluobu", "tags": ["安全招聘"], "text": "向心力历经十多年的发展，公司的成长见证和浓缩了中国电信服务运营市场的发展轨迹，积累了丰富的行业经验，培养了数百名技术专家。"}
{"title": "Qualcomm MSM debugfs内核任意地址写入漏洞分析（CVE-2016-2443）", "url": "https://www.freebuf.com/vuls/103583.html", "time": "2016-05-06", "level": "", "num_look": 273105, "num_comment": 3, "author": "vul_wish", "tags": ["漏洞"], "text": "谷歌发布 5 月份补丁更新，本次共修复了32个漏洞。其中包含一个Qualcomm漏洞，威胁等级为高危。"}
{"title": "黑科技来临！IBM向公众开放试用“量子计算机”", "url": "https://www.freebuf.com/news/103524.html", "time": "2016-05-06", "level": "金币+5", "num_look": 334779, "num_comment": 13, "author": "dawner", "tags": ["资讯"], "text": "在此之前，我们可能看见过网上有量子计算机模拟器。但是，像这样昂贵而先进的硬件设备在网上向公众开放使用，还属首次。"}
{"title": "WinPcap开发（一）：零基础入门", "url": "https://www.freebuf.com/articles/system/103526.html", "time": "2016-05-05", "level": "现金奖励", "num_look": 962464, "num_comment": 16, "author": "追影人", "tags": ["系统安全", "网络安全"], "text": "winpcap是windows平台下一个免费的网络访问系统，可用于windows系统下的网络编程。"}
{"title": "坐牢还不够，“Gozi”银行木马制造者又被重罚700万美元", "url": "https://www.freebuf.com/news/103573.html", "time": "2016-05-05", "level": "", "num_look": 207381, "num_comment": 10, "author": "米雪儿", "tags": ["资讯"], "text": "“Gozi”银行木马制造者在监狱中度过3个年头后，被责令支付700万美元，以弥补其对银行业造成的惨重损失。"}
{"title": "上帝也无奈：Win10“上帝模式”深陷恶意软件魔爪", "url": "https://www.freebuf.com/news/103577.html", "time": "2016-05-05", "level": "金币+5", "num_look": 257753, "num_comment": 6, "author": "米雪儿", "tags": ["资讯"], "text": "研究人员已经确定一款新型恶意程序正在利用WINDOWS的“上帝模式”为非作歹，威胁用户安全。"}
{"title": "如何安全清理隐私数据？", "url": "https://www.freebuf.com/articles/database/103509.html", "time": "2016-05-05", "level": "", "num_look": 372189, "num_comment": 1, "author": "小番番", "tags": ["数据安全"], "text": "我们经常需要在程序中存储隐私数据，我们通常需要在使用之后清理它们在内存中的痕迹，从而使潜在的入侵者无法获得这些数据。"}
{"title": "北极熊扫描器3.8企业版发布", "url": "https://www.freebuf.com/sectool/103482.html", "time": "2016-05-05", "level": "红色标题", "num_look": 1068718, "num_comment": 20, "author": "hyc66", "tags": ["工具"], "text": "本次3.8版本升级为企业版应用，支持网站爬虫，资源自动寻获功能，软件使用完全免费~"}
{"title": "隐藏在图片中的恶魔：揭秘“数字隐写术”工作原理", "url": "https://www.freebuf.com/news/topnews/103455.html", "time": "2016-05-05", "level": "金币+5", "num_look": 622138, "num_comment": 5, "author": "xiaix", "tags": ["头条", "系统安全"], "text": "隐藏在图片文件中的恶意软件是如何工作的？通过这篇文章我们来告诉你。"}
{"title": "技术分享：利用树莓派进行ARM缓冲区溢出Exploit练习", "url": "https://www.freebuf.com/articles/system/103435.html", "time": "2016-05-05", "level": "", "num_look": 398367, "num_comment": 2, "author": "鸢尾", "tags": ["系统安全"], "text": "我是在树莓派上进行练习，如果你没有一个能够使用的设备，你也可以设置一个QEMU环境跟着文章进度一起玩耍。"}
{"title": "游戏中学会撸代码：这些编程学习网站不容错过", "url": "https://www.freebuf.com/geek/103452.html", "time": "2016-05-05", "level": "金币+5", "num_look": 1326306, "num_comment": 17, "author": "饭团君", "tags": ["极客"], "text": "本文介绍的网站是从200多个游戏编程网站选出的12个网站，你可以通过下面的网站在游戏中学习编程。"}
{"title": "数据监控跟踪网站PwnedList将因安全问题关闭", "url": "https://www.freebuf.com/news/103400.html", "time": "2016-05-05", "level": "", "num_look": 321305, "num_comment": 2, "author": "寰者", "tags": ["WEB安全", "漏洞"], "text": "网络泄露数据监控跟踪网站PwnedList因安全漏洞问题将关闭。"}
{"title": "安全预警：ImageMagick图象处理软件存在远程代码执行(CVE-2016-3714)", "url": "https://www.freebuf.com/vuls/103504.html", "time": "2016-05-05", "level": "金币+5", "num_look": 1169764, "num_comment": 22, "author": "watcher", "tags": ["WEB安全", "漏洞"], "text": "本周二，ImageMagick披露出了一个严重的0day漏洞，此漏洞允许攻击者通过上传恶意构造的图像文件，在目标服务器执行任意代码。"}
{"title": "招商银行招聘信息安全相关岗位", "url": "https://www.freebuf.com/jobs/102730.html", "time": "2016-05-04", "level": "", "num_look": 350174, "num_comment": 23, "author": "xysky", "tags": ["安全招聘"], "text": "招商银行，是中国第一家完全由企业法人持股的股份制商业银行，简称招行。"}
{"title": "被动式Web扫描器的技术实现", "url": "https://www.freebuf.com/articles/web/103462.html", "time": "2016-05-04", "level": "现金奖励", "num_look": 434360, "num_comment": 9, "author": "q6e79d", "tags": ["WEB安全"], "text": "有很多自动化工具提供给安全研究员使用——比如Sqlmap,Openvas等强大工具，但是我这里主要是说明场景和自己实现被动扫描。"}
{"title": "Android恶意软件又出新招：伪装Google Chrome升级，窃取银行卡数据", "url": "https://www.freebuf.com/news/103403.html", "time": "2016-05-04", "level": "", "num_look": 205670, "num_comment": 6, "author": "米雪儿", "tags": ["资讯"], "text": "Android用户请注意：最新发现的恶意软件可以窃取您的银行信息以及监测您的短信内容等。"}
{"title": "pyMagic：用python控制的Geek入门神器", "url": "https://www.freebuf.com/sectool/103374.html", "time": "2016-05-04", "level": "现金奖励", "num_look": 607425, "num_comment": 23, "author": "comover", "tags": ["工具", "极客"], "text": "这个项目是由剑桥大学的理论物理学家(theoretical physicist)Damien George发起的，一个用python语言来控制硬件的项目。"}
{"title": "10岁黑客发现Instagram漏洞获奖一万美元，你10岁在干嘛？", "url": "https://www.freebuf.com/news/103410.html", "time": "2016-05-04", "level": "金币+5", "num_look": 388772, "num_comment": 36, "author": "米雪儿", "tags": ["资讯"], "text": "一个来自芬兰的10岁小男孩发现了一个漏洞，这个漏洞使得他获得访问Instagram服务器的权限，并且可以利用此漏洞删除Instagram用户的任何文字评论。"}
{"title": "Lua游戏逆向及破解方法介绍", "url": "https://www.freebuf.com/articles/system/103388.html", "time": "2016-05-04", "level": "", "num_look": 1347656, "num_comment": 10, "author": "游戏安全实验室", "tags": ["安全管理", "系统安全"], "text": "越来越多的Cocos-lua端游开发者转移到手游平台，Lua脚本编写逻辑的手游也是越来越多，其安全性值得关注。"}
{"title": "一俄罗斯黑客被银行索赔数百万美元", "url": "https://www.freebuf.com/news/103379.html", "time": "2016-05-04", "level": "", "num_look": 154360, "num_comment": 2, "author": "饭团君", "tags": ["资讯"], "text": "一名已经在美国服刑三年的俄罗斯男子被要求支付700万美元，以用来赔付给那些遭受到其计算机病毒危害的银行。"}
{"title": "技术分享：逆向分析ATM分离器", "url": "https://www.freebuf.com/geek/103315.html", "time": "2016-05-04", "level": "", "num_look": 238952, "num_comment": 6, "author": "饭团君", "tags": ["极客"], "text": "攻击者有不少选择，但使用传统的方式即将ATM分离器偷取你卡里的信息然后偷走你的钱。"}
{"title": "Phishing Frenzy：钓鱼测试利器", "url": "https://www.freebuf.com/sectool/101663.html", "time": "2016-05-04", "level": "", "num_look": 285677, "num_comment": 2, "author": "亲爱的兔子", "tags": ["工具"], "text": "Phishing Frenzy是一个开源的钓鱼测试工具，该工具旨在帮助安全研究人员简化钓鱼过程，并提供最佳的安全服务。"}
{"title": "三星SmartThings平台被爆新漏洞，可触发火灾报警器", "url": "https://www.freebuf.com/news/103348.html", "time": "2016-05-04", "level": "", "num_look": 252148, "num_comment": 2, "author": "米雪儿", "tags": ["漏洞", "资讯"], "text": "研究人员发现三星SmartThings平台存在多个漏洞，为攻击者入侵受害者家中敞开大门。"}
{"title": "新版BlackArch Linux发布，提供1400款渗透测试工具", "url": "https://www.freebuf.com/sectool/103367.html", "time": "2016-05-03", "level": "红色标题", "num_look": 783051, "num_comment": 26, "author": "watcher", "tags": ["工具"], "text": "此版本为白帽子和安全研究人员提供了大约1400款渗透测试工具。"}
{"title": "新机制，新考验：Windows10(14316) Linux子系统分析", "url": "https://www.freebuf.com/articles/system/103342.html", "time": "2016-05-03", "level": "", "num_look": 373175, "num_comment": 5, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "在build 2016大会上，微软宣布windows10 中将原生支持bash，并且号称在windows中加入了一个Linux子系统。"}
{"title": "互联网核心组件NTPD被曝多个漏洞，可致系统时间无法正常同步", "url": "https://www.freebuf.com/vuls/103330.html", "time": "2016-05-03", "level": "", "num_look": 353022, "num_comment": 2, "author": "路由器", "tags": ["漏洞", "网络安全"], "text": "2015年12月到2016年2月，360信息安全部云安全团队先后发现了4个和NTPD(网络时间守护协议进程)相关包含匿名拒绝服务的漏洞。"}
{"title": "一个“特别”的Word宏病毒深度分析", "url": "https://www.freebuf.com/articles/system/103309.html", "time": "2016-05-03", "level": "现金奖励", "num_look": 558287, "num_comment": 14, "author": "nickchang", "tags": ["系统安全", "网络安全"], "text": "最近收到了一个带word附件的垃圾邮件，于是乎就进行了深度分析。"}
{"title": "扑朔比特币，迷离中本聪：比特币创始人中本聪的真实身份终曝光", "url": "https://www.freebuf.com/news/103321.html", "time": "2016-05-03", "level": "红色标题", "num_look": 635948, "num_comment": 23, "author": "米雪儿", "tags": ["资讯"], "text": "关于中本聪——比特币创始人的身份之谜已经揭开，他就是澳大利亚企业家Craig Steven Wright。"}
{"title": "黑客组织匿名者（Anonymous）再作祟，DDoS攻击希腊银行网站", "url": "https://www.freebuf.com/news/103313.html", "time": "2016-05-03", "level": "金币+5", "num_look": 243387, "num_comment": 20, "author": "米雪儿", "tags": ["资讯"], "text": "Anonymous组织以反对银行金融腐败为由，对希腊银行网站发起大规模DDoS攻击，致使希腊银行网站关闭。"}
{"title": "黑帽SEO升级：克隆版网站窃取谷歌排名", "url": "https://www.freebuf.com/articles/database/103288.html", "time": "2016-05-03", "level": "", "num_look": 406062, "num_comment": 8, "author": "dawner", "tags": ["数据安全"], "text": "内容抓取行为就是使用自动化脚本，从其他网站复制所有的内容，最后对其进行克隆重建。"}
{"title": "京东诚聘安全行业人才", "url": "https://www.freebuf.com/jobs/103297.html", "time": "2016-05-03", "level": "", "num_look": 333278, "num_comment": 13, "author": "路由器", "tags": ["安全招聘"], "text": "智能家居安全、移动安全、云安全~~~对,这不是梦。京东为你创造更好的机会来施展你的技能"}
{"title": "CVE-2016-1019：Magnitude攻击工具里的flash漏洞", "url": "https://www.freebuf.com/vuls/102337.html", "time": "2016-05-03", "level": "", "num_look": 270681, "num_comment": 3, "author": "江湖小吓", "tags": ["漏洞"], "text": ""}
{"title": "云誉反欺诈2016年第一季度钓鱼网站报告", "url": "https://www.freebuf.com/articles/paper/102942.html", "time": "2016-05-03", "level": "", "num_look": 307657, "num_comment": 3, "author": "阿里云誉反欺诈", "tags": ["安全报告"], "text": "本报告由阿里云誉反欺诈团队撰写，数据采集自阿里云誉反欺诈钓鱼检测系统。"}
{"title": "Hacking Team的drive-by攻击被曝光", "url": "https://www.freebuf.com/articles/103004.html", "time": "2016-05-03", "level": "", "num_look": 236710, "num_comment": 1, "author": "FireFrank", "tags": ["文章"], "text": ""}
{"title": "网络认证破解工具Ncrack新版发布", "url": "https://www.freebuf.com/sectool/103224.html", "time": "2016-05-02", "level": "金币+5", "num_look": 445280, "num_comment": 9, "author": "饭团君", "tags": ["工具"], "text": "Ncrack是一个高速的网络认证破解工具，它可以帮助企业测试所有的网络主机和网络设备的密码强度。"}
{"title": "补丁时间：NTP守护进程中有数个漏洞需修复", "url": "https://www.freebuf.com/news/103118.html", "time": "2016-05-02", "level": "金币+5", "num_look": 185968, "num_comment": 2, "author": "简单", "tags": ["资讯"], "text": "现在什么时间了？漏洞时间！赶紧修复漏洞！"}
{"title": "前美国大使馆官员因性敲诈及网络跟踪被判4年监禁", "url": "https://www.freebuf.com/news/103065.html", "time": "2016-05-02", "level": "", "num_look": 208901, "num_comment": 5, "author": "米雪儿", "tags": ["资讯"], "text": "2015年，前美国大使馆官员Michael Ford被指控色情敲诈和网络跟踪等多项罪名，如今，他被判处4年9个月的监禁。"}
{"title": "预警：恶意勒索软件已经破坏公司电力以及供水系统", "url": "https://www.freebuf.com/news/103247.html", "time": "2016-05-01", "level": "", "num_look": 161244, "num_comment": 1, "author": "饭团君", "tags": ["资讯"], "text": "现在越来越多的恶意勒索软件已经瞄准了医院、企业、个人电脑等。"}
{"title": "工具推荐：Raptor WAF，轻量级WEB应用防火墙", "url": "https://www.freebuf.com/sectool/103060.html", "time": "2016-05-01", "level": "", "num_look": 349983, "num_comment": 8, "author": "0xroot", "tags": ["工具"], "text": "Raptor是一款采用C语言编写的WEB应用防火墙，使用DFA来阻止SQL注入、Xss目录遍历等攻击。"}
{"title": "儿童节，与盒子君聊点羞羞的事儿！", "url": "https://www.freebuf.com/fevents/105778.html", "time": "2016-05-01", "level": "红色标题", "num_look": 177911, "num_comment": 1, "author": "漏洞盒子", "tags": ["活动"], "text": "借良辰吉日，漏洞盒子邀宝宝们一起分享童年趣（qiu）！事（shi）！"}
{"title": "小心！别在Github上泄露了你Slack的token", "url": "https://www.freebuf.com/articles/network/103231.html", "time": "2016-04-30", "level": "金币+5", "num_look": 367925, "num_comment": 7, "author": "Sphinx", "tags": ["网络安全"], "text": "大量的开发者们把他们的Slack登录凭证上传到了Github和其他公开网站上，任何人都可以偷偷监控他们的对话，或者下载通过Slack传输的数据。"}
{"title": "经验分享：如何用grep对PHP进行代码审计", "url": "https://www.freebuf.com/articles/web/103131.html", "time": "2016-04-30", "level": "金币+5", "num_look": 374432, "num_comment": 15, "author": "东二门陈冠希", "tags": ["WEB安全"], "text": "如何用grep对PHP进行代码审计?一起来看这篇文章。"}
{"title": "思科发现一千两百万台PC存在后门间谍程序", "url": "https://www.freebuf.com/news/103203.html", "time": "2016-04-30", "level": "", "num_look": 201595, "num_comment": 5, "author": "米雪儿", "tags": ["资讯"], "text": "安全专家提醒广大PC用户：法国Tuto4PC公司悄悄在PC上绑定广告软件和间谍软件。"}
{"title": "美高院欲修改法律允许FBI入侵世界任何电脑", "url": "https://www.freebuf.com/news/103215.html", "time": "2016-04-30", "level": "金币+5", "num_look": 261534, "num_comment": 24, "author": "Sphinx", "tags": ["系统安全", "资讯"], "text": "FBI现在可以合法地入侵世界上任何一台电脑，他们唯一要做的就是需要一张搜查令，这张搜查令可以是任何一个地方法官发布的。"}
{"title": "漫谈混淆技术：从Citadel混淆壳说起", "url": "https://www.freebuf.com/articles/web/103188.html", "time": "2016-04-29", "level": "", "num_look": 295607, "num_comment": 3, "author": "奇安信威胁情报中心", "tags": ["WEB安全"], "text": "Citadel是一个zeus的衍生版本,其较zeus更加的健壮,也更稳定。"}
{"title": "新手指南：安卓移动终端的一次渗透实验", "url": "https://www.freebuf.com/articles/terminal/103128.html", "time": "2016-04-29", "level": "金币+5", "num_look": 477398, "num_comment": 19, "author": "寰者", "tags": ["终端安全"], "text": "通过使用虚拟Android系统，模拟移动终端的操作，来帮助我们逐步实现使用一个名为QPython的APP来对本地网络中的服务器telnet服务进行枚举暴破。"}
{"title": "从0到TrustZone第一篇：探究高通的 SEE（安全可执行环境）", "url": "https://www.freebuf.com/articles/system/103152.html", "time": "2016-04-29", "level": "金币+5", "num_look": 726220, "num_comment": 2, "author": "安小白", "tags": ["系统安全"], "text": "在本篇文章中，我们将讨论高通安全执行环境（QSEE）。"}
{"title": "匿名者Anonymous入侵肯尼亚外交部，1TB机密文件流入黑市", "url": "https://www.freebuf.com/news/103037.html", "time": "2016-04-29", "level": "金币+5", "num_look": 325903, "num_comment": 6, "author": "米雪儿", "tags": ["数据安全", "资讯"], "text": "为抗议腐败、虐待儿童和雇佣童工，黑客组织“匿名者”入侵肯尼亚外交部服务器并泄露1TB机密文件。"}
{"title": "极客DIY：利用树莓派制作一款口袋电脑", "url": "https://www.freebuf.com/geek/102975.html", "time": "2016-04-29", "level": "金币+5", "num_look": 825339, "num_comment": 17, "author": "饭团君", "tags": ["极客"], "text": "如何利用树莓派制作一款口袋电脑？一起来看这里。"}
{"title": "如何对西数硬盘固件进行逆向分析（下）", "url": "https://www.freebuf.com/geek/102983.html", "time": "2016-04-29", "level": "红色标题", "num_look": 378153, "num_comment": 3, "author": "老王隔壁的白帽子", "tags": ["极客"], "text": "虽然硬盘模型之间的确其地址不同，但是我的布局可以给你一个好的思路。"}
{"title": "银行先进的反欺诈是如何设计的？", "url": "https://www.freebuf.com/articles/database/103132.html", "time": "2016-04-29", "level": "红色标题", "num_look": 837725, "num_comment": 11, "author": "杨税令", "tags": ["数据安全", "网络安全"], "text": "为了你的钱和我的钱，为了让那些优秀的互联网金融公司活下去，我们今天就来探讨一下银行的反欺诈是如何设计的。"}
{"title": "Verizon报告称两成数据泄露皆因“杂项错误”", "url": "https://www.freebuf.com/articles/database/103093.html", "time": "2016-04-29", "level": "", "num_look": 254758, "num_comment": 1, "author": "Sphinx", "tags": ["数据安全"], "text": "根据Verizon发布的2016年数据泄漏调查报告(DBIR)，数据泄露的主要原因是“杂项错误”，也就是那些员工所犯的各种错误使得攻击者有机可乘。"}
{"title": "Cookie前缀如何让Cookie更安全？", "url": "https://www.freebuf.com/articles/web/103089.html", "time": "2016-04-29", "level": "", "num_look": 336403, "num_comment": 1, "author": "xiaix", "tags": ["WEB安全"], "text": ""}
{"title": "FB公开课后记：如何XSS自动化入侵内网", "url": "https://www.freebuf.com/articles/web/103097.html", "time": "2016-04-28", "level": "现金奖励", "num_look": 922977, "num_comment": 34, "author": "Black-Hole", "tags": ["WEB安全", "特别企划"], "text": "这里我将会使用其他办法“绕过浏览器的同源策略”。"}
{"title": "从果粉到黑吃黑：一个论坛挂马的奇异反转", "url": "https://www.freebuf.com/news/topnews/103096.html", "time": "2016-04-28", "level": "", "num_look": 371624, "num_comment": 7, "author": "360安全", "tags": ["WEB安全", "头条"], "text": "继上个星期国内知名果粉社区威锋网(上周事件一出，威锋网已修复)遭黑客挂马事件后，360安全卫士再度发现该黑客还在其他网站论坛进行挂马。"}
{"title": "技术分享：逆向海盗船k95机械键盘", "url": "https://www.freebuf.com/geek/102613.html", "time": "2016-04-28", "level": "红色标题", "num_look": 389894, "num_comment": 5, "author": "饭团君", "tags": ["极客"], "text": "在这篇文章中我们将分享如何逆向海盗船k95机械键盘。"}
{"title": "老牌技术会议XKungfoo 2016首日看点", "url": "https://www.freebuf.com/fevents/103035.html", "time": "2016-04-28", "level": "", "num_look": 204327, "num_comment": 2, "author": "路由器", "tags": ["活动"], "text": "xKungfoo专注于现今流行的安全技术话题，以及深入的黑客和防护技术讨论，演讲者与参会者必须为中国人。"}
{"title": "恶意软件混淆检测算法分析", "url": "https://www.freebuf.com/articles/terminal/102984.html", "time": "2016-04-28", "level": "", "num_look": 274571, "num_comment": 3, "author": "老王隔壁的白帽子", "tags": ["终端安全"], "text": "现在McAfee实验室正在研究一种新的恶意宏变种，可以在一定程度上识别虚拟机，沙箱等机制的检测。"}
{"title": "军火库（第一期）：无线电硬件安全大牛都用哪些利器？", "url": "https://www.freebuf.com/sectool/102998.html", "time": "2016-04-28", "level": "红色标题", "num_look": 1483533, "num_comment": 63, "author": "FB独家", "tags": ["头条", "工具"], "text": "「军火库」系列是FreeBuf最新策划的专题栏目！在本系列文章中，我们将邀请安全圈里某一领域有所专长的安全研究员，分享他们自己情有独钟的工具。"}
{"title": "卡塔尔国家银行被黑，1.4G数据泄露（涉及王室、英国军情六处、法国和波兰等各国情报）", "url": "https://www.freebuf.com/news/102939.html", "time": "2016-04-28", "level": "金币+6", "num_look": 353205, "num_comment": 14, "author": "米雪儿", "tags": ["数据安全", "资讯"], "text": "匿名黑客组织宣布攻破了卡塔尔国家银行系统，并在Cryptome网站上公开了从卡塔尔国家银行(Qatar National Bank)窃取容量超过1.4GB的数据转储文件。"}
{"title": "德国贡德雷明根核电站发现病毒", "url": "https://www.freebuf.com/articles/network/102978.html", "time": "2016-04-28", "level": "", "num_look": 453270, "num_comment": 5, "author": "Sphinx", "tags": ["工控安全", "网络安全"], "text": "根据德国BR24通讯社的报道，贡德雷明根核电站的一个系统中发现了病毒。"}
{"title": "Android Minikin 库越界写拒绝服务漏洞分析", "url": "https://www.freebuf.com/articles/system/102643.html", "time": "2016-04-28", "level": "", "num_look": 347688, "num_comment": 2, "author": "鸢尾", "tags": ["系统安全"], "text": "在本月的Android补丁中，谷歌修复了Minikin库中的一个拒绝服务漏洞(CVE-2016-2414) 。"}
{"title": "4月28日晚FreeBuf公开课（直播课程）：XSS自动化渗透内网", "url": "https://www.freebuf.com/articles/network/102485.html", "time": "2016-04-28", "level": "红色标题", "num_look": 1173808, "num_comment": 67, "author": "banish", "tags": ["FreeBuf公开课", "网络安全"], "text": "本次课程不仅会涉及到使用XSS入侵内网，还会免去繁琐的人工的操作，跟大家聊一聊XSS智能化（自动化）入侵！"}
{"title": "浅析安全自动化编排平台Phantom", "url": "https://www.freebuf.com/articles/security-management/102888.html", "time": "2016-04-28", "level": "", "num_look": 420049, "num_comment": 3, "author": "绿盟科技", "tags": ["安全管理"], "text": ""}
{"title": "2016中国伪基站短信研究报告", "url": "https://www.freebuf.com/articles/network/102944.html", "time": "2016-04-28", "level": "红色标题", "num_look": 597146, "num_comment": 15, "author": "奇安信威胁情报中心", "tags": ["安全报告", "网络安全"], "text": "伪基站是相对于基础电信运营商架设的正常基站而言，由不法分子临时搭建，用于实施电信诈骗或扩散垃圾信息的无线电收发设备。"}
{"title": "美军网络战司令部预向ISIS发动网络攻击，奥巴马主动支持", "url": "https://www.freebuf.com/news/102959.html", "time": "2016-04-28", "level": "", "num_look": 185307, "num_comment": 7, "author": "简单", "tags": ["资讯"], "text": "美国对ISIS的战斗打开了崭新的一页，首次指示已经成立6年的美军网络战司令部（Cyber Command ）对伊斯兰国（ISIS）发动网络攻击。"}
{"title": "乐视云计算诚招安全英才", "url": "https://www.freebuf.com/jobs/102961.html", "time": "2016-04-27", "level": "", "num_look": 267474, "num_comment": 21, "author": "乐视安全", "tags": ["安全招聘"], "text": "领导闲了也会发各类的电子硬件，美女同事超多等等。"}
{"title": "Viber紧随WhatsApp步伐：加强端对端消息加密服务", "url": "https://www.freebuf.com/news/102483.html", "time": "2016-04-27", "level": "", "num_look": 169598, "num_comment": 1, "author": "FireFrank", "tags": ["资讯"], "text": "Viber 将在未来两周内为其全球的用户添加端对端加密服务。"}
{"title": "勒索软件攻击Android设备：索要Apple iTunes礼品卡", "url": "https://www.freebuf.com/news/102850.html", "time": "2016-04-27", "level": "", "num_look": 715318, "num_comment": 6, "author": "晶颜123", "tags": ["系统安全", "资讯"], "text": "研究人员发现，一个exploit kit正在被用于向andorid用户投递恶意欺诈软件。"}
{"title": "新手指南：手把手教你如何搭建自己的渗透测试环境", "url": "https://www.freebuf.com/sectool/102661.html", "time": "2016-04-27", "level": "红色标题", "num_look": 4822779, "num_comment": 43, "author": "felix", "tags": ["工具", "网络安全"], "text": "白帽子是指个体发起的黑客攻击，找到系统潜在的可能被恶意黑客利用的的漏洞或脆弱点。"}
{"title": "交友网站BeautifulPeople被黑，110万用户数据在暗网出售", "url": "https://www.freebuf.com/news/102898.html", "time": "2016-04-27", "level": "", "num_look": 255958, "num_comment": 5, "author": "米雪儿", "tags": ["资讯"], "text": "交友网站BeautifulPeople数据泄露，约110万用户的数据在暗网出售。"}
{"title": "CVE-2016-1019 Flash漏洞被加入漏洞利用工具包“豪华午餐”", "url": "https://www.freebuf.com/vuls/101334.html", "time": "2016-04-27", "level": "金币+8", "num_look": 357834, "num_comment": 11, "author": "老王隔壁的白帽子", "tags": ["漏洞"], "text": "CVE-2016-1019 Flash漏洞被加入到Magnitude漏洞的利用工具包。"}
{"title": "子虚乌有的DDOS攻击，网络勒索组织Armada Collective冒牌者获利10万美元", "url": "https://www.freebuf.com/news/102889.html", "time": "2016-04-27", "level": "", "num_look": 197915, "num_comment": 1, "author": "寰者", "tags": ["资讯"], "text": "近期，出现勒索组织Armada Collective的冒牌者，其在全球范围内以子虚乌有的DDoS攻击，威胁企业组织，要求被勒索企业支付比特币作为赎金。"}
{"title": "Burpsuite插件开发（二）：信息采集插件", "url": "https://www.freebuf.com/sectool/102673.html", "time": "2016-04-27", "level": "", "num_look": 478487, "num_comment": 29, "author": "山东安云", "tags": ["工具"], "text": ""}
{"title": "剖析RTF文件中的Anti-Analysis技术", "url": "https://www.freebuf.com/articles/terminal/102018.html", "time": "2016-04-27", "level": "", "num_look": 298857, "num_comment": 2, "author": "东二门陈冠希", "tags": ["终端安全"], "text": "这篇文章主要介绍几个最近的恶意RTF文件中存在的Anti-Analysis反分析技术，以及进一步提高rtfobj的处理能力。"}
{"title": "暴力枚举短URL获取私有分享文件", "url": "https://www.freebuf.com/articles/web/102138.html", "time": "2016-04-27", "level": "", "num_look": 269748, "num_comment": 1, "author": "老王隔壁的白帽子", "tags": ["WEB安全"], "text": "通过bit.ly，goo.gl生成的短URLs，以及其他相似的服务都非常短以至于能够被暴力扫描。我们通过扫描发现了大量的微软OneDrive账号的私有文档。"}
{"title": "渗透实验故事：从CSV到CMD到qwerty", "url": "https://www.freebuf.com/vuls/102790.html", "time": "2016-04-27", "level": "", "num_look": 489861, "num_comment": 2, "author": "dawner", "tags": ["漏洞", "系统安全"], "text": "最近持续不断的针对性恶意email附件攻击，让我想起了今年1月份在都柏林举办的NCC会议上，笔者曾发表的一篇总结报告。"}
{"title": "史上最大银行失窃案竟是由于未装防火墙 ？", "url": "https://www.freebuf.com/news/102731.html", "time": "2016-04-27", "level": "", "num_look": 322848, "num_comment": 5, "author": "米雪儿", "tags": ["网络安全", "资讯"], "text": "研究人员发现，黑客之所以可以访问孟加拉银行网络盗窃巨额资金，是由于其使用二手路由器且未设置防火墙。"}
{"title": "针对金融领域伪基站钓鱼黑产的分析报告", "url": "https://www.freebuf.com/articles/paper/102736.html", "time": "2016-04-26", "level": "", "num_look": 336439, "num_comment": 8, "author": "白帽汇", "tags": ["安全报告"], "text": "伪基站钓鱼一直以来都是导致金融巨额损失的重灾区，即使在法律和技术进行安全管控的情况下，形式也变得越来越严峻。"}
{"title": "KKK网站遭遇匿名者幽灵小队的DDoS攻击关闭", "url": "https://www.freebuf.com/news/102710.html", "time": "2016-04-26", "level": "", "num_look": 180684, "num_comment": 3, "author": "米雪儿", "tags": ["资讯"], "text": "匿名者组织对KKK KNIGHTS官方网站发起约4小时的DDoS攻击，致使该网站关闭。"}
{"title": "Struts2 S2 - 032远程代码执行分析", "url": "https://www.freebuf.com/vuls/102836.html", "time": "2016-04-26", "level": "", "num_look": 704431, "num_comment": 21, "author": "安恒信息安全研究院", "tags": ["漏洞"], "text": "Struts 2是Struts的下一代产品，是在 struts 1和WebWork的技术基础上进行了合并的全新的Struts 2框架。"}
{"title": "上海0con落幕，这场“学术派基因”的会议都有哪些看点？", "url": "https://www.freebuf.com/fevents/102694.html", "time": "2016-04-26", "level": "", "num_look": 188502, "num_comment": 2, "author": "路由器", "tags": ["活动", "特别企划"], "text": "0con，暨0ops conference，由上海交通大学0ops战队主办。"}
{"title": "冒充最高检网络电信诈骗之追溯", "url": "https://www.freebuf.com/articles/network/102803.html", "time": "2016-04-26", "level": "", "num_look": 568057, "num_comment": 15, "author": "奇安信威胁情报中心", "tags": ["网络安全"], "text": "诈骗，跟生物的历史一样长，而且永远都会存在。每当人类拓展出一片新的生存环境，诈骗也立即随之而来生根发芽。"}
{"title": "使用HackRF+GNU Radio 破解吉普车钥匙信号", "url": "https://www.freebuf.com/vuls/102593.html", "time": "2016-04-26", "level": "金币+4", "num_look": 852782, "num_comment": 11, "author": "饭团君", "tags": ["头条", "极客"], "text": "本文将演示使用Gnu Radio重放吉普车遥控信号。"}
{"title": "DameWare迷你远程遥控漏洞（CVE-2016-2345）：让你玩转远程控制器", "url": "https://www.freebuf.com/articles/terminal/102204.html", "time": "2016-04-26", "level": "", "num_look": 278043, "num_comment": 1, "author": "江湖小吓", "tags": ["终端安全"], "text": "在做安全评估的时候，我们常常会碰到一些允许管理员在网络上远程管理系统的软件。"}
{"title": "那些年，我们用来“躲避”杀毒软件的工具", "url": "https://www.freebuf.com/sectool/102595.html", "time": "2016-04-26", "level": "", "num_look": 405754, "num_comment": 13, "author": "felix", "tags": ["工具", "终端安全"], "text": "在渗透测试的时候，我们可能需要规避杀软程序，特别是在post攻击阶段要在目标机器上执行特定文件的时候。"}
{"title": "9340万墨西哥选民数据库被“晒”上网", "url": "https://www.freebuf.com/news/102696.html", "time": "2016-04-26", "level": "金币+4", "num_look": 318264, "num_comment": 11, "author": "米雪儿", "tags": ["数据安全", "资讯"], "text": "由于MongoDB数据库配置不当，导致墨西哥9340万选民数据泄露！"}
{"title": "GSM Hacking：使用BladeRF、树莓派、YatesBTS搭建便携式GSM基站", "url": "https://www.freebuf.com/geek/102729.html", "time": "2016-04-25", "level": "金币+4", "num_look": 1063410, "num_comment": 19, "author": "鸢尾", "tags": ["极客", "特别企划"], "text": "在没有SDR之前，玩GSM并不便宜，本文我们将用树莓派和BladeRF+YatesBTS进行GSM Hacking。"}
{"title": "漏洞盒子 | 白帽月度风云榜", "url": "https://www.freebuf.com/special/102597.html", "time": "2016-04-25", "level": "", "num_look": 313986, "num_comment": 9, "author": "漏洞盒子", "tags": ["特别企划"], "text": "阳春三月，莺飞草长，上个月漏洞盒子平台上提交的漏洞可谓百花齐放，盒子君在此向白帽子致敬。"}
{"title": "技术分享：渗透Facebook的思路与发现", "url": "https://www.freebuf.com/articles/web/102618.html", "time": "2016-04-25", "level": "金币+4", "num_look": 672625, "num_comment": 16, "author": "b0920075", "tags": ["WEB安全"], "text": "白帽子分享渗透Facebook的思路，并在渗透成功后发现前人留下的后门，FB为此奖励了白帽子1万美刀。"}
{"title": "如何对西数硬盘固件进行逆向分析", "url": "https://www.freebuf.com/geek/102675.html", "time": "2016-04-25", "level": "金币+4", "num_look": 477500, "num_comment": 11, "author": "老王隔壁的白帽子", "tags": ["极客"], "text": "一起来看作者是如何逆向分析西数硬盘固件的吧。"}
{"title": "美国国防部计划为美军制作高度安全的通讯APP", "url": "https://www.freebuf.com/news/102649.html", "time": "2016-04-25", "level": "", "num_look": 162854, "num_comment": 1, "author": "vulture", "tags": ["资讯"], "text": "美国国防部高级研究计划局现在在寻找私人部门来为美军开发一款高度安全的”通讯和交易”平台。"}
{"title": "Black hole开发工具包作者被判7年有期徒刑", "url": "https://www.freebuf.com/news/101985.html", "time": "2016-04-25", "level": "金币+4", "num_look": 210400, "num_comment": 11, "author": "晶颜123", "tags": ["资讯"], "text": "臭名昭著的“Black hole”开发工具包的作者——“Paunch”已被莫斯科法院判处7年有期徒刑。"}
{"title": "TEST LAB V8在线渗透实验室教程（四）", "url": "https://www.freebuf.com/articles/system/102374.html", "time": "2016-04-25", "level": "红色标题", "num_look": 488381, "num_comment": 7, "author": "felix", "tags": ["系统安全", "网络安全"], "text": "这一部分我们将渗透SSH-Dev和Portal系统。"}
{"title": "MMD-0053-2016：ELF/STD IRC Bot恶意软件分析", "url": "https://www.freebuf.com/articles/system/102432.html", "time": "2016-04-25", "level": "", "num_look": 378100, "num_comment": 2, "author": "vul_wish", "tags": ["系统安全", "网络安全"], "text": "近日，谷歌的安全专家称，谷歌云网络中发现了ELF恶意软件。"}
{"title": "极客DIY：如何制作一个显卡？", "url": "https://www.freebuf.com/geek/102342.html", "time": "2016-04-25", "level": "红色标题", "num_look": 553569, "num_comment": 11, "author": "饭团君", "tags": ["极客"], "text": "在2015年十月的时候，作者决定开始为这个计算机做个显卡，当时第一个想法就是“我开始为自己做显卡了，这得有多难”。"}
{"title": "澳大利亚政府公开网络安全战略", "url": "https://www.freebuf.com/news/102568.html", "time": "2016-04-25", "level": "", "num_look": 199083, "num_comment": 1, "author": "简单", "tags": ["资讯"], "text": "近日，澳大利亚政府公开4年内计划花费近2.3亿澳元在国家重要基础设施的攻击防护上，并承认他们具有极强的发动网络攻击的能力。"}
{"title": "Plaid CTF 2016 - Tonnerre解题思路", "url": "https://www.freebuf.com/articles/web/102285.html", "time": "2016-04-23", "level": "", "num_look": 272999, "num_comment": 3, "author": "鸢尾", "tags": ["WEB安全"], "text": "他们会不会将用户数据和网页内容存储在同一个数据库呢？"}
{"title": "TEST LAB V8在线渗透实验室教程（三）", "url": "https://www.freebuf.com/articles/system/102287.html", "time": "2016-04-23", "level": "", "num_look": 366344, "num_comment": 2, "author": "felix", "tags": ["系统安全", "网络安全"], "text": "这一部分我们将演示渗透Mail和SSH系统。"}
{"title": "新型跨平台的键盘记录恶意软件PWOBot曝光", "url": "https://www.freebuf.com/news/102450.html", "time": "2016-04-23", "level": "", "num_look": 182120, "num_comment": 2, "author": "米雪儿", "tags": ["资讯"], "text": "最近，安全研究人员发现了一款具有潜在威胁的跨平台恶意软件家族——PWOBot。"}
{"title": "FBI花费了100多万美元只为破解iPhone？", "url": "https://www.freebuf.com/news/102559.html", "time": "2016-04-23", "level": "金币+5", "num_look": 195899, "num_comment": 6, "author": "晶颜123", "tags": ["资讯"], "text": "4月21日周四，联邦调查局局长James Comey称：“为破解去年加州圣伯纳迪诺的枪击案中，伊斯兰极端分子法鲁克使用的iPhone 5C手机，FBI向为他们提供黑客服务的公司支付了100多万美元。”"}
{"title": "合纵绿盟、8款安全产品发布，阿里云高调进军安全市场", "url": "https://www.freebuf.com/news/102587.html", "time": "2016-04-22", "level": "", "num_look": 298264, "num_comment": 6, "author": "路由器", "tags": ["资讯"], "text": "4月20日，在云栖大会·深圳峰会上，阿里云发布了8款安全产品，我们不禁感叹——阿里是要全面进军安全市场了吗？"}
{"title": "手把手教你用Python爬虫煎蛋妹纸海量图片", "url": "https://www.freebuf.com/news/others/102315.html", "time": "2016-04-22", "level": "红色标题", "num_look": 1722130, "num_comment": 36, "author": "岂安科技", "tags": ["周边"], "text": "最近听说煎蛋上有好多可爱的妹子，而且爬虫从妹子图抓起练手最好，毕竟动力大嘛。"}
{"title": "法网恢恢：SpyEye木马核心开发者遭判刑", "url": "https://www.freebuf.com/news/102542.html", "time": "2016-04-22", "level": "", "num_look": 368694, "num_comment": 6, "author": "晶颜123", "tags": ["网络安全", "资讯"], "text": ""}
{"title": "我是如何破解亚马逊一键购物按钮的？", "url": "https://www.freebuf.com/vuls/102446.html", "time": "2016-04-22", "level": "金币+5", "num_look": 354485, "num_comment": 9, "author": "饭团君", "tags": ["漏洞"], "text": "亚马逊Dash按钮。它是塑料做的实体按钮，可以贴在或者挂在物品上，每个按钮只对应一样商品，按一下，就可以买下这件商品。"}
{"title": "Mac党福利：研究人员开发免费的Ransomware检测工具", "url": "https://www.freebuf.com/sectool/102398.html", "time": "2016-04-22", "level": "", "num_look": 291954, "num_comment": 1, "author": "dawner", "tags": ["工具", "数据安全"], "text": "RansomWhere是一款通用的免费ransomware检测工具，帮助Mac OS X用户识别疑似的ransomware软件。"}
{"title": "CNCERT发布2015中国互联网网络安全态势综述", "url": "https://www.freebuf.com/articles/paper/102513.html", "time": "2016-04-22", "level": "", "num_look": 278010, "num_comment": 5, "author": "CNCERT", "tags": ["安全报告"], "text": "本报告在对我国互联网宏观安全态势监测的基础上，着重分析和总结2015年我国互联网网络安全状况，并预测2016年网络安全热点问题。"}
{"title": "看我如何破解微软手环！", "url": "https://www.freebuf.com/geek/102491.html", "time": "2016-04-22", "level": "金币+5", "num_look": 436083, "num_comment": 5, "author": "watcher", "tags": ["极客"], "text": "通过这篇文章我们一起来看如何Hacking微软手环"}
{"title": "黑客讲述渗透Hacking Team全过程（详细解说）", "url": "https://www.freebuf.com/articles/102500.html", "time": "2016-04-22", "level": "红色标题", "num_look": 2358664, "num_comment": 21, "author": "寰者", "tags": ["文章"], "text": "近期，黑客Phineas Fisher在pastebin.com上讲述了入侵Hacking Team的过程，以下为其讲述的原文情况。"}
{"title": "PowerWare：勒索软件如何温柔地借刀杀人", "url": "https://www.freebuf.com/articles/system/101464.html", "time": "2016-04-22", "level": "现金奖励", "num_look": 425718, "num_comment": 4, "author": "深信服千里目安全实验室", "tags": ["系统安全"], "text": "2016 年 3 月底，一个名为 PowerWare 的新型加密勒索软件通过钓鱼邮件袭击了一家医疗组织，被国外安全公司 Carbon Black 捕获。"}
{"title": "如何从ios8内存中获取敏感数据？", "url": "https://www.freebuf.com/articles/terminal/102241.html", "time": "2016-04-22", "level": "", "num_look": 283754, "num_comment": 4, "author": "xiaoqin00", "tags": ["系统安全", "终端安全"], "text": "如何从ios8内存中获取敏感数据？一起来看本文。"}
{"title": "GozNym恶意软件盯上加拿大和美国的银行系统", "url": "https://www.freebuf.com/news/102458.html", "time": "2016-04-22", "level": "", "num_look": 188997, "num_comment": 1, "author": "米雪儿", "tags": ["系统安全", "资讯"], "text": "美国和加拿大的银行系统正在经受双重威胁，该威胁就是结合了Nymaim与Gozi ISFB的功能强大的恶意软件——GozNym。"}
{"title": "预测85%的网络攻击：麻省理工学院研发人工智能系统AI2", "url": "https://www.freebuf.com/news/102430.html", "time": "2016-04-21", "level": "", "num_look": 190841, "num_comment": 5, "author": "tutuk", "tags": ["资讯"], "text": "MIT(麻省理工学院)安全研究人员近来研发的“AI2”或许可以——“AI2”是基于人工智能的网络安全平台，可准确预测85%的网络攻击。"}
{"title": "可信前端之路：代码保护", "url": "https://www.freebuf.com/articles/web/102269.html", "time": "2016-04-21", "level": "", "num_look": 504460, "num_comment": 5, "author": "阿里云誉反欺诈", "tags": ["WEB安全"], "text": "在信息安全领域，可信系统（Trusted system）是一个让人心动的目标。"}
{"title": "Win32.Adware.ADClick分析报告", "url": "https://www.freebuf.com/articles/paper/102439.html", "time": "2016-04-21", "level": "", "num_look": 196788, "num_comment": 10, "author": "腾讯电脑管家", "tags": ["安全报告"], "text": "每个讨厌的广告弹窗背后总有一个精心筹谋的心机。"}
{"title": "闹剧何时休?又一家比特币平台因黑客攻击而停业", "url": "https://www.freebuf.com/news/101737.html", "time": "2016-04-21", "level": "金币+5", "num_look": 166513, "num_comment": 7, "author": "米雪儿", "tags": ["资讯"], "text": "CoinWallet公司——为用户提供线上比特币和multicoin钱包业务的比特币平台，在2016年4月初公司遭遇数据泄露的丑闻后，宣布关闭其服务。"}
{"title": "浅析BGP路由前缀攻击检测", "url": "https://www.freebuf.com/articles/network/102386.html", "time": "2016-04-21", "level": "", "num_look": 428003, "num_comment": 1, "author": "东二门陈冠希", "tags": ["网络安全"], "text": "作为法国互联网主动监测的一部分，ANSSI监视器从2011年开始主动监测互联网中的BGP行为。"}
{"title": "Android APP检测之自动化检测实战：五大APP安全在线检测平台对比", "url": "https://www.freebuf.com/articles/terminal/102396.html", "time": "2016-04-21", "level": "红色标题", "num_look": 1414824, "num_comment": 17, "author": "DMZLab", "tags": ["终端安全"], "text": "最近一直在研究的检测，写了一个系列的文章——手工检测，自动化检测，常见漏洞分析。今天给大家带来的是自动化检测。"}
{"title": "TEST LAB V8（二）：Cisco设备和Terminal系统", "url": "https://www.freebuf.com/articles/system/102237.html", "time": "2016-04-21", "level": "红色标题", "num_look": 504129, "num_comment": 5, "author": "felix", "tags": ["系统安全", "网络安全"], "text": "在这一部分，我们将看到如何通过网关192.168.101.7找到Cisco设备和Terminal系统的token。"}
{"title": "如何绕过Edge XSS过滤器？", "url": "https://www.freebuf.com/articles/web/102206.html", "time": "2016-04-21", "level": "金币+5", "num_look": 317011, "num_comment": 4, "author": "xiaix", "tags": ["WEB安全"], "text": "过去 IE 有一个缺陷，你可以使用位置对象作为一个函数，并结合 toString/valueOf 按照对象的字面意义来执行代码。"}
{"title": "验证码的前世今生（今生篇）", "url": "https://www.freebuf.com/articles/web/102276.html", "time": "2016-04-21", "level": "", "num_look": 787042, "num_comment": 14, "author": "阿里云誉反欺诈", "tags": ["WEB安全", "网络安全"], "text": "最黑暗的时刻也是光明即将来临的时刻——在传统验证码的末日新的反向图灵测试机制浴火重生。"}
{"title": "短网址服务可能泄露你的敏感信息", "url": "https://www.freebuf.com/articles/database/102034.html", "time": "2016-04-21", "level": "金币+5", "num_look": 330375, "num_comment": 2, "author": "dawner", "tags": ["数据安全"], "text": "安全研究人员发现通过枚举短网址，可以发现网络上的敏感信息。"}
{"title": "FreeBuf独家：黑客攻防人机大战，我们将看到什么？", "url": "https://www.freebuf.com/news/102302.html", "time": "2016-04-20", "level": "", "num_look": 364320, "num_comment": 9, "author": "FB独家", "tags": ["头条", "特别企划"], "text": "AlphaGo赢了，黑客界的人机大战又来了，这一次中国人不仅仅是观众了。"}
{"title": "安全预警：JBoss 应用平台后门导致约320万服务器面临威胁 （附检测及利用工具）", "url": "https://www.freebuf.com/vuls/102031.html", "time": "2016-04-20", "level": "金币+5", "num_look": 588705, "num_comment": 15, "author": "寰者", "tags": ["WEB安全", "漏洞"], "text": "近期勒索软件事件大量扩散，攻击者利用JBoss Java应用平台存在的漏洞，入侵企业服务器，并将勒索软件散播至所有与服务器连接的客户端上。"}
{"title": "如何通过VOIP内网评估获取域管理员权限？", "url": "https://www.freebuf.com/articles/network/102136.html", "time": "2016-04-20", "level": "", "num_look": 331514, "num_comment": 2, "author": "老王隔壁的白帽子", "tags": ["网络安全"], "text": "通过VOIP内部评估，我们对5060和5061端口进行了扫描找到已经开机的IP话机。 然后我们找到了一个范围然后开始连接到每个电话开启了80端口的web页面。"}
{"title": "瑞典称其国家重要基础设施正在遭受俄罗斯黑客攻击", "url": "https://www.freebuf.com/news/101884.html", "time": "2016-04-20", "level": "", "num_look": 147249, "num_comment": 3, "author": "米雪儿", "tags": ["资讯"], "text": "近日瑞典表示，其国家的网络空间正在遭受来自俄罗斯方面的网络威胁。"}
{"title": "ShapeShift 因前雇员泄漏数据损失价值23万美金的比特币", "url": "https://www.freebuf.com/news/102271.html", "time": "2016-04-20", "level": "", "num_look": 174814, "num_comment": 2, "author": "FireFrank", "tags": ["资讯"], "text": "加密的货币交易平台ShapeShift因前雇员泄漏数据损失价值23万美金的比特币 。"}
{"title": "工具推荐：Recon-ng，WEB安全探测框架", "url": "https://www.freebuf.com/sectool/102256.html", "time": "2016-04-20", "level": "金币+5", "num_look": 496323, "num_comment": 3, "author": "dawner", "tags": ["WEB安全", "工具"], "text": ""}
{"title": "完美世界信息安全部诚聘安全岗位", "url": "https://www.freebuf.com/jobs/102185.html", "time": "2016-04-20", "level": "", "num_look": 288497, "num_comment": 13, "author": "何艺", "tags": ["安全招聘"], "text": "完美世界信息安全部安全招聘。"}
{"title": "Kickass Torrents因欺诈网站标签问题惨遭三大浏览器屏蔽", "url": "https://www.freebuf.com/news/101606.html", "time": "2016-04-20", "level": "", "num_look": 236069, "num_comment": 2, "author": "米雪儿", "tags": ["WEB安全", "资讯"], "text": "Chrome、Firefox、Safari这三大浏览器已经将Kickass Torrents打上了欺诈网站、已上报伪冒网站、可疑钓鱼网站警告标签。"}
{"title": "QADARS V3恶意软件域名生成算法分析", "url": "https://www.freebuf.com/articles/network/102019.html", "time": "2016-04-20", "level": "", "num_look": 364230, "num_comment": 3, "author": "东二门陈冠希", "tags": ["网络安全"], "text": "在今年三月份，下面的样本引起了我的兴趣——因为是通过DGA（域名生成算法）来和C&C服务器进行通信："}
{"title": "TEST LAB V8在线渗透实验室教程（一）", "url": "https://www.freebuf.com/articles/web/102123.html", "time": "2016-04-20", "level": "", "num_look": 615091, "num_comment": 14, "author": "felix", "tags": ["WEB安全", "系统安全"], "text": "Test Lab是一个与Offensive Security的实验室类似的在线渗透测试虚拟实验室。"}
{"title": "工具推荐：Windows-Exploit-Suggester（Windows下提权辅助工具）", "url": "https://www.freebuf.com/sectool/102139.html", "time": "2016-04-20", "level": "", "num_look": 717257, "num_comment": 21, "author": "watcher", "tags": ["WEB安全", "工具"], "text": "此工具是一款非常好用的Windows下提权辅助工具(已经支持Windows 10下的提权了)，国内已经有许多人在用了..."}
{"title": "加拿大警方是怎样获得黑莓加密秘钥的？", "url": "https://www.freebuf.com/news/102079.html", "time": "2016-04-20", "level": "", "num_look": 250907, "num_comment": 11, "author": "tutuk", "tags": ["终端安全", "资讯"], "text": "在这件事上，或许黑莓公司还欠公众一个解释。"}
{"title": "暗网聊天室：匿名者组织最新授课平台", "url": "https://www.freebuf.com/news/102146.html", "time": "2016-04-20", "level": "", "num_look": 548562, "num_comment": 14, "author": "dawner", "tags": ["资讯"], "text": "暗网将承接匿名者的聊天室服务，这群黑客想通过这一项新的服务，对大众网友们进行网络教育和技术武装。"}
{"title": "世界读书日：《白帽子讲浏览器安全》", "url": "https://www.freebuf.com/fevents/102205.html", "time": "2016-04-19", "level": "红色标题", "num_look": 954633, "num_comment": 301, "author": "路由器", "tags": ["活动"], "text": "过几天就是4月23日——世界读书日啦，大家要积极响应联合国的号召哦。"}
{"title": "“僵尸之手”：一种伪装成正常应用的恶意病毒", "url": "https://www.freebuf.com/articles/102132.html", "time": "2016-04-19", "level": "", "num_look": 441199, "num_comment": 7, "author": "AVLTeam", "tags": ["文章", "终端安全"], "text": "“僵尸之手”——一种伪装成正常应用，并通过远程指令控制中毒手机，实施恶意行为的病毒。"}
{"title": "黑客爆料Hacking Team入侵细节", "url": "https://www.freebuf.com/news/102173.html", "time": "2016-04-19", "level": "金币+15", "num_look": 415361, "num_comment": 15, "author": "晶颜123", "tags": ["头条", "资讯"], "text": "近日，黑客PhineasFisher透露了当初如何侵入了意大利安全公司 Hacking Team的相关细节。"}
{"title": "App劫持病毒剖析：你的应用是如何被替换的？", "url": "https://www.freebuf.com/articles/terminal/102163.html", "time": "2016-04-19", "level": "", "num_look": 294208, "num_comment": 3, "author": "阿里聚安全", "tags": ["终端安全"], "text": "App劫持是指执行流程被重定向，又可分为Activity劫持、安装劫持、流量劫持、函数执行劫持等。"}
{"title": "和他相比，《绝命毒师》里的老白似乎是输了……", "url": "https://www.freebuf.com/articles/people/102064.html", "time": "2016-04-19", "level": "红色标题", "num_look": 656164, "num_comment": 15, "author": "cindy", "tags": ["人物志", "特别企划"], "text": "回顾往事，这件事就像我们在《绝命毒师》结局看到的一样"}
{"title": "Nmap备忘单：从探索到漏洞利用（Part 5）", "url": "https://www.freebuf.com/articles/system/102137.html", "time": "2016-04-19", "level": "金币+15", "num_look": 586604, "num_comment": 11, "author": "东二门陈冠希", "tags": ["系统安全"], "text": "这是Nmap备忘单的最后一部分，在这里主要讲述漏洞评估和渗透测试。"}
{"title": "海中捞针：从《最强大脑》里“水哥”的绝技到设备指纹", "url": "https://www.freebuf.com/articles/database/102094.html", "time": "2016-04-19", "level": "", "num_look": 683282, "num_comment": 3, "author": "阿里云誉反欺诈", "tags": ["数据安全"], "text": "在网络中，你所不知道的角落里，也有很多很多的“水哥”在注视着你们，静静的看着你们的所有活动，并默默把每一幕记了下来。"}
{"title": "MS Office CVE-2015-1641 恶意 Exploit 样本分析", "url": "https://www.freebuf.com/articles/terminal/101937.html", "time": "2016-04-19", "level": "", "num_look": 410916, "num_comment": 1, "author": "xiaix", "tags": ["终端安全"], "text": "在对最近的一个恶意 MS Office 文档样本进行分析时，我们发现了一些有趣的特性。"}
{"title": "DRAKVUF：无Agent的恶意软件动态分析系统", "url": "https://www.freebuf.com/sectool/101871.html", "time": "2016-04-19", "level": "金币+5", "num_look": 275033, "num_comment": 3, "author": "Sphinx", "tags": ["工具"], "text": "DRAKVUF是一款恶意软件动态分析系统，它能深度追踪病毒样本，从内存中提取被删除的文件，并且无需在虚拟机里安装别的分析软件。"}
{"title": "Qbot回归，已感染5.4万台计算机", "url": "https://www.freebuf.com/news/102038.html", "time": "2016-04-19", "level": "金币+5", "num_look": 226753, "num_comment": 3, "author": "vul_wish", "tags": ["终端安全", "资讯"], "text": "近日，BAESystems的安全人员发表了一篇关于Qbot网络感知蠕虫回归的调查报告，指出已经感染了5.4万台计算机。"}
{"title": "工具推荐：Backdoor-apk，安卓APK文件后门测试工具", "url": "https://www.freebuf.com/sectool/101983.html", "time": "2016-04-18", "level": "金币+5", "num_look": 504600, "num_comment": 4, "author": "饭团君", "tags": ["工具"], "text": "backdoor-apk简化了在Android APK文件中添加后门的过程。"}
{"title": "“小马激活”病毒新变种分析报告", "url": "https://www.freebuf.com/articles/system/102087.html", "time": "2016-04-18", "level": "红色标题", "num_look": 1029439, "num_comment": 66, "author": "火绒安全", "tags": ["系统安全"], "text": "我们之前称其为“苏拉克”病毒，随着其不断地改变与安全软件的对抗方式，“苏拉克”这个名字已经不被病毒作者使用，所以我们将其统称为“小马激活”病毒。"}
{"title": "一美国公司因邮件欺诈被盗1亿美元", "url": "https://www.freebuf.com/news/101992.html", "time": "2016-04-18", "level": "", "num_look": 210834, "num_comment": 2, "author": "vulture", "tags": ["资讯"], "text": "路透社报道称，某美国公司遭到邮件欺诈，攻击者从公司偷走近1亿美元，这也是数额最大的一起电邮欺诈案件。"}
{"title": "果粉请注意，上威锋网当心遭遇“挂马”攻击", "url": "https://www.freebuf.com/articles/database/102080.html", "time": "2016-04-18", "level": "红色标题", "num_look": 617674, "num_comment": 9, "author": "路由器", "tags": ["数据安全", "网络安全"], "text": "4月18日消息，360安全卫士官方微博发布警报称，国内知名的苹果用户中文论坛威锋网（feng.com）已被黑客大面积挂马。"}
{"title": "工具推荐：v0lt，CTF安全工具包", "url": "https://www.freebuf.com/sectool/101797.html", "time": "2016-04-18", "level": "", "num_look": 552223, "num_comment": 7, "author": "4idol0n", "tags": ["工具"], "text": "v0lt，CTF安全工具包，麻雀虽小五脏俱全，赛棍必备。"}
{"title": "BankInfo Security发布金融信息安全界Top 10 影响力排行榜", "url": "https://www.freebuf.com/news/101981.html", "time": "2016-04-18", "level": "红色标题", "num_look": 241843, "num_comment": 2, "author": "米雪儿", "tags": ["资讯"], "text": "BankInfo Security发布了其第四年度银行业信息安全影响力排行榜，他们在塑造银行业与信息安全相连的方式上取得了突出成绩和贡献。"}
{"title": "苹果不再为Windows版的QuickTime提供安全更新", "url": "https://www.freebuf.com/news/101975.html", "time": "2016-04-18", "level": "", "num_look": 192980, "num_comment": 6, "author": "江湖小吓", "tags": ["资讯"], "text": "QuickTime被爆存在远程代码执行漏洞，而苹果将不再为Windows版本的QuickTime提供安全更新。"}
{"title": "C99 php webshell攻击加剧，大量WordPress站点遭受威胁", "url": "https://www.freebuf.com/news/101924.html", "time": "2016-04-18", "level": "金币+5", "num_look": 504055, "num_comment": 12, "author": "寰者", "tags": ["WEB安全", "资讯"], "text": ""}
{"title": "无线安全审计工具 FruityWifi v2.4 发布", "url": "https://www.freebuf.com/sectool/101656.html", "time": "2016-04-18", "level": "金币+5", "num_look": 368662, "num_comment": 4, "author": "亲爱的兔子", "tags": ["工具"], "text": "FruityWifi是一款无线安全审计工具，基于 wifi pineapple设计。"}
{"title": "窥探任意邮箱账户，黑市报价129美元", "url": "https://www.freebuf.com/news/101677.html", "time": "2016-04-18", "level": "", "num_look": 243975, "num_comment": 8, "author": "亲爱的兔子", "tags": ["资讯"], "text": "如果你想窥探一下另一半的邮箱邮件但却没有什么思路或者方法，怎么办？近日Dell 发布了一份报告，下面就来了解一下吧。"}
{"title": "WebUSB API：让你的USB设备安全的接入网络", "url": "https://www.freebuf.com/sectool/101511.html", "time": "2016-04-17", "level": "", "num_look": 393659, "num_comment": 1, "author": "dawner", "tags": ["WEB安全", "工具"], "text": "有两个谷歌工程师开发了名为WebUSB的API（草拟版本），它能通过WEB安全地连接你的USB设备，其间不需要经过本地驱动。"}
{"title": "勒索软件Locky、Tesalcrypt等使用了新的工具躲避检测", "url": "https://www.freebuf.com/sectool/101502.html", "time": "2016-04-17", "level": "", "num_look": 195558, "num_comment": 2, "author": "老王隔壁的白帽子", "tags": ["工具"], "text": "今天我们发现Locky勒索软件家族使用一种新的工具来躲避检测，并且可能已经感染了很多节点。"}
{"title": "前路透社记者帮助Anonymous获两年牢狱之灾", "url": "https://www.freebuf.com/news/101810.html", "time": "2016-04-17", "level": "", "num_look": 209561, "num_comment": 4, "author": "dawner", "tags": ["资讯"], "text": "前路透社记者Matthew Keys，曾在去年被指控给予了匿名者（Anonymous）组织某方面的帮助。现在，他将因黑客犯罪面临两年的牢狱生涯。"}
{"title": "RFID Hacking②：PM3入门指南", "url": "https://www.freebuf.com/news/100925.html", "time": "2016-04-17", "level": "", "num_look": 1271195, "num_comment": 26, "author": "吃葡萄不吐葡萄皮的雪碧", "tags": ["资讯"], "text": "Proxmark3是由一款用于RFID安全研究开源硬件，可以在RFID环境中进行嗅探、读取以及克隆等相关攻击操作。"}
{"title": "通杀Windows的Badlock是啥？该如何修复？", "url": "https://www.freebuf.com/vuls/101935.html", "time": "2016-04-16", "level": "金币+5", "num_look": 320771, "num_comment": 3, "author": "FireFrank", "tags": ["漏洞", "终端安全"], "text": "2016年4月12日，Windows 和 Samba 中揭露出了一个非常关键的安全漏洞。"}
{"title": "技术分享：逆向破解华为路由器第一部分", "url": "https://www.freebuf.com/news/topnews/101852.html", "time": "2016-04-16", "level": "金币+5", "num_look": 440726, "num_comment": 13, "author": "饭团君", "tags": ["头条", "极客"], "text": "本文将会介绍逆向华为 HG533路由器的过程。"}
{"title": "技术分享：如何利用文件上传执行XSS？", "url": "https://www.freebuf.com/articles/web/101843.html", "time": "2016-04-15", "level": "金币+5", "num_look": 572220, "num_comment": 15, "author": "xiaix", "tags": ["WEB安全"], "text": "利用文件上传实现XSS攻击是一个Hacking Web应用的很好机会，一起通过本文来看如何通过文件上传实现xss攻击。"}
{"title": "叙利亚政府网络被黑，泄露43GB数据", "url": "https://www.freebuf.com/news/101589.html", "time": "2016-04-15", "level": "", "num_look": 262586, "num_comment": 7, "author": "简单", "tags": ["资讯"], "text": "叙利亚政府网络被黑客攻击，43GB数据泄露，Cyber Justice Team（网络空间正义小组）称对此事负责。"}
{"title": "技术解析：锁屏绕过，三星Galaxy系列手机也能“被”呼出电话", "url": "https://www.freebuf.com/vuls/101804.html", "time": "2016-04-15", "level": "", "num_look": 359497, "num_comment": 12, "author": "寰者", "tags": ["漏洞", "终端安全"], "text": "近期，由两位安全研究人员，Roberto Paleari及Aristide Fattori，发布了关于三星Galaxy手机设备安全漏洞的技术细节。"}
{"title": "技术分享：PHP序列化/对象注入漏洞的利用", "url": "https://www.freebuf.com/vuls/101794.html", "time": "2016-04-15", "level": "红色标题", "num_look": 542673, "num_comment": 13, "author": "dawner", "tags": ["WEB安全", "漏洞"], "text": "本文是关于PHP序列化/对象注入漏洞分析的短篇，文章讲述了如何获取主机的远程shell。"}
{"title": "国家信息安全漏洞库（CNNVD）发布《信息安全漏洞态势报告（2015年度）》", "url": "https://www.freebuf.com/articles/paper/99866.html", "time": "2016-04-15", "level": "", "num_look": 463135, "num_comment": 5, "author": "CNNVD", "tags": ["安全报告"], "text": "今年3月份，国家信息安全漏洞库（CNNVD）通过对2015年度信息技术产品的安全漏洞数据进行统计分析，发布年度信息安全漏洞态势报告。"}
{"title": "房多多招聘安全工程师", "url": "https://www.freebuf.com/jobs/101821.html", "time": "2016-04-15", "level": "", "num_look": 209405, "num_comment": 8, "author": "路由器", "tags": ["安全招聘"], "text": "房多多是国内首家移动互联网房产交易服务平台。"}
{"title": "微软的潮流范儿：死之蓝屏里加上了二维码", "url": "https://www.freebuf.com/articles/system/101654.html", "time": "2016-04-15", "level": "金币+5", "num_look": 266992, "num_comment": 14, "author": "dawner", "tags": ["系统安全"], "text": "如果你是一名微软Windows用户，你可能曾经遇到过臭名昭著的“死之蓝屏”（BSOD）。"}
{"title": "安全预警：全球1.35亿的ARRIS有线调制解调器可被远程攻击", "url": "https://www.freebuf.com/news/101244.html", "time": "2016-04-15", "level": "", "num_look": 200336, "num_comment": 7, "author": "tutuk", "tags": ["资讯"], "text": "ARRIS SURFboard的有线调制解调器中被发现一枚安全漏洞，攻击者可远程攻击全球约1.35亿的设备。"}
{"title": "“通杀Windows”的BadLock漏洞是怎么被玩坏的？", "url": "https://www.freebuf.com/news/101754.html", "time": "2016-04-15", "level": "", "num_look": 301285, "num_comment": 4, "author": "SamSmith", "tags": ["头条", "资讯"], "text": "4月12日，微软发布安全公告披露了一个名为BadLock的严重漏洞。然而，大家对它并不陌生，BadLock不仅是个有Logo有官网的“名洞”，它的披露流程也引起了安全行业的热议。"}
{"title": "苹果OSX Message跨域脚本攻击漏洞详解（CVE-2016-1764）", "url": "https://www.freebuf.com/vuls/101631.html", "time": "2016-04-15", "level": "", "num_look": 267962, "num_comment": 2, "author": "vul_wish", "tags": ["漏洞", "终端安全"], "text": "只要用户点击URL，攻击便会成功。另外，如果受害者启用了短信转发功能，攻击者便可以恢复经由受害者iPhone的任何信息。"}
{"title": "Petya中的Salsa：算法修改带来的缺陷", "url": "https://www.freebuf.com/vuls/101714.html", "time": "2016-04-14", "level": "", "num_look": 268491, "num_comment": 1, "author": "腾讯电脑管家", "tags": ["漏洞"], "text": "最近Leo Stone给出了破解Petya密钥的完整爆破代码和解密工具，并指出Petya作者是采用变种的Salsa20算法来进行密钥的校验。"}
{"title": "技术分享：如何Hacking MongoDB？", "url": "https://www.freebuf.com/articles/network/101494.html", "time": "2016-04-14", "level": "金币+5", "num_look": 439514, "num_comment": 5, "author": "东二门陈冠希", "tags": ["网络安全"], "text": "本篇文章主要向大家介绍我在使用MongoDB的过程中遇到的问题，以及它是如何被用来修改数据库记录的。"}
{"title": "预警：亚马逊出售的监控摄像机存在预装恶意软件", "url": "https://www.freebuf.com/news/101726.html", "time": "2016-04-14", "level": "", "num_look": 181886, "num_comment": 3, "author": "米雪儿", "tags": ["资讯"], "text": "广大用户请注意，即便是亚马逊上购买的知名品牌的电子产品也可能存在恶意软件。"}
{"title": "SiDDOS：通过SQL注入实施DDOS攻击的方法", "url": "https://www.freebuf.com/articles/web/101658.html", "time": "2016-04-14", "level": "", "num_look": 550370, "num_comment": 13, "author": "watcher", "tags": ["WEB安全", "网络安全"], "text": "在此教程中，我们将讨论如何使用sql注入来对一个网站实施DDOS攻击。"}
{"title": "工具推荐：Scanner Routerhunter，路由器漏洞扫描器", "url": "https://www.freebuf.com/sectool/101180.html", "time": "2016-04-14", "level": "金币+8", "num_look": 898926, "num_comment": 9, "author": "ymmy", "tags": ["工具"], "text": "一款自动挖掘路由器漏洞的测试工具，它能够自动化在互联网大范围搜索包含漏洞的路由，进行测试、进一步确认这些漏洞问题"}
{"title": "经验分享：挖洞联盟第一季漏洞精选", "url": "https://www.freebuf.com/articles/web/100920.html", "time": "2016-04-14", "level": "红色标题", "num_look": 581869, "num_comment": 12, "author": "漏洞盒子", "tags": ["WEB安全"], "text": "3月10日-28日，“挖洞联盟”团队赛的角逐如火如荼进行，小编在此精心整理了本次联盟赛中出现的优秀漏洞，希望各位白帽子能有所收获。"}
{"title": "FB题外话：科比最后的战役", "url": "https://www.freebuf.com/news/others/101704.html", "time": "2016-04-14", "level": "", "num_look": 812954, "num_comment": 10, "author": "FB独家", "tags": ["周边"], "text": "今天，告别的时刻终于来临，却难言说再见。传奇般的20年，FreeBuf与你一起致敬。"}
{"title": "针对非Webapp测试的Burp技巧（二）：扫描、重放", "url": "https://www.freebuf.com/articles/web/100875.html", "time": "2016-04-14", "level": "金币+8", "num_look": 537366, "num_comment": 6, "author": "dawner", "tags": ["WEB安全"], "text": "在本系列连载的第一节中，笔者谈到了关于burp对非webapp的功能测试。"}
{"title": "恶意软件逆向分析系列（一）：在汇编语言中识别重要的代码结构", "url": "https://www.freebuf.com/articles/network/101499.html", "time": "2016-04-14", "level": "金币+8", "num_look": 411071, "num_comment": 9, "author": "老王隔壁的白帽子", "tags": ["网络安全"], "text": "这一系列的文章都是与恶意软件相关的课程，因此我们首先从PE和ELF文件的完整结构讲起。"}
{"title": "如何应对伪造的SSL证书？", "url": "https://www.freebuf.com/vuls/101479.html", "time": "2016-04-14", "level": "金币+8", "num_look": 521248, "num_comment": 3, "author": "watcher", "tags": ["WEB安全", "漏洞"], "text": "在互联网中，仍存在一个巨大的加密后门，可怕的是大部分人却并不知道。"}
{"title": "如何证明你是“比特币之父”中本聪？", "url": "https://www.freebuf.com/news/101420.html", "time": "2016-04-14", "level": "", "num_look": 294609, "num_comment": 11, "author": "明明知道", "tags": ["资讯"], "text": "“秘密意味着权力和神秘感，但我慢慢意识道，并且接受了这一点——世上没有永远的秘密。”中本聪头号候选者Wright曾在一篇博文中如是说。"}
{"title": "趣火星之支付宝、网银盗刷事件：一种补卡攻击的套路全分析", "url": "https://www.freebuf.com/news/topnews/101618.html", "time": "2016-04-13", "level": "红色标题", "num_look": 1237778, "num_comment": 48, "author": "奇安信威胁情报中心", "tags": ["头条", "数据安全"], "text": "本文对一个网友的被骗经历揭密其背后的逻辑，一切基于网友所提供出来的信息。"}
{"title": "FreeBuf春季招聘开启，创业Team就差你了", "url": "https://www.freebuf.com/jobs/101608.html", "time": "2016-04-13", "level": "", "num_look": 628455, "num_comment": 36, "author": "thanks", "tags": ["安全招聘"], "text": "欢迎砸简历或内推（内推成功入职，送iphone6喔~）"}
{"title": "PHP Utility Belt 远程代码执行漏洞的验证与分析", "url": "https://www.freebuf.com/articles/web/99176.html", "time": "2016-04-13", "level": "", "num_look": 259774, "num_comment": 5, "author": "navyofficer", "tags": ["WEB安全"], "text": "PHP Utility Belt是一款为PHP程序开发人员使用的一套工具集，在这篇文章中我们将分析其一个远程代码执行漏洞。"}
{"title": "“心脏出血”漏洞可导致密码泄露", "url": "https://www.freebuf.com/news/101417.html", "time": "2016-04-13", "level": "金币+8", "num_look": 391699, "num_comment": 3, "author": "vul_wish", "tags": ["漏洞", "资讯"], "text": "10日，安全人员又发现了Heartbleed漏洞的踪迹，利用该漏洞的攻击者可获取用户密码，并诱使用户访问伪造的网站。"}
{"title": "技术分享：利用异常实现反调试", "url": "https://www.freebuf.com/articles/terminal/99454.html", "time": "2016-04-13", "level": "", "num_look": 390021, "num_comment": 7, "author": "felix", "tags": ["系统安全", "终端安全"], "text": "本文将分享如何利用异常实现反调试"}
{"title": "工具推荐：INURLB，一款高级黑客搜索引擎工具", "url": "https://www.freebuf.com/sectool/101465.html", "time": "2016-04-13", "level": "金币+8", "num_look": 766196, "num_comment": 18, "author": "dawner", "tags": ["WEB安全", "工具"], "text": "INURLB是一款基于PHP的黑客高级搜索引擎，其支持24个搜索引擎，拥有6个深度web或者特殊选项。"}
{"title": "拨开迷雾：央视曝光“5分钟网上买到上千银行卡信息”究竟是怎么一回事？", "url": "https://www.freebuf.com/articles/terminal/101372.html", "time": "2016-04-13", "level": "红色标题", "num_look": 717509, "num_comment": 18, "author": "0xroot", "tags": ["终端安全", "观点"], "text": "一条短信导致银行卡被盗刷？一个验证码让你倾家荡产？一起来看关于黑产的伪基站揭秘!"}
{"title": "Android勒索软件研究报告", "url": "https://www.freebuf.com/articles/terminal/101365.html", "time": "2016-04-13", "level": "", "num_look": 406779, "num_comment": 14, "author": "360手机卫士", "tags": ["终端安全"], "text": "手机勒索软件是一种通过锁住用户移动设备，使用户无法正常使用设备，并以此胁迫用户支付解锁费用的恶意软件。"}
{"title": "工具推荐：Vuls，一款优秀的Linux漏洞扫描器", "url": "https://www.freebuf.com/sectool/101408.html", "time": "2016-04-13", "level": "金币+10", "num_look": 1544141, "num_comment": 6, "author": "FireFrank", "tags": ["工具", "系统安全"], "text": "一款使用go语言开发的Linux漏洞扫描器，实用！nice！"}
{"title": "极客DIY：童年的掌上游戏机", "url": "https://www.freebuf.com/news/100996.html", "time": "2016-04-13", "level": "金币+10", "num_look": 292994, "num_comment": 6, "author": "亲爱的兔子", "tags": ["极客", "资讯"], "text": "还记得过去的掌上游戏机吗？一名网友在YouTube上面上传了一个DIY掌上游戏机的视频，下面就一起来怀念一下童年的见闻。"}
{"title": "针对非Webapp测试的Burp技巧(一)：拦截和代理监听", "url": "https://www.freebuf.com/articles/terminal/100908.html", "time": "2016-04-13", "level": "金币+10", "num_look": 638909, "num_comment": 13, "author": "FireFrank", "tags": ["系统安全", "终端安全"], "text": "Burp不仅仅可以被用于Web应用程序测试。我常在移动端和胖客户端测试中使用Burp。如果应用使用了HTTP方法，那么Burp绝对会成为你最好的选择。"}
{"title": "黑暗幽灵（DCM）木马详细分析", "url": "https://www.freebuf.com/articles/system/101447.html", "time": "2016-04-13", "level": "红色标题", "num_look": 3868674, "num_comment": 203, "author": "腾讯电脑管家", "tags": ["系统安全", "网络安全"], "text": "只要插上网线或连上WIFI，无需任何操作，不一会儿电脑就被木马感染了，这可能吗？"}
{"title": "RouterSploit：路由器漏洞检测及利用框架", "url": "https://www.freebuf.com/sectool/101441.html", "time": "2016-04-13", "level": "金币+10", "num_look": 1105549, "num_comment": 19, "author": "寰者", "tags": ["工具"], "text": "RouteSploit框架是一款开源的漏洞检测及利用框架，其针对的对象主要为路由器等嵌入式设备。"}
{"title": "黑客组织APT6入侵美国政府网络长达数年，奥巴马造吗？", "url": "https://www.freebuf.com/news/101012.html", "time": "2016-04-12", "level": "", "num_look": 256653, "num_comment": 4, "author": "简单", "tags": ["资讯"], "text": "联邦调查局发布一个警告通知，APT6（一个政府赞助黑客组织）已经入侵进美国政府网络长达数年的时间。"}
{"title": "Nmap备忘单：从探索到漏洞利用（Part 4）", "url": "https://www.freebuf.com/sectool/101335.html", "time": "2016-04-12", "level": "金币+10", "num_look": 691893, "num_comment": 6, "author": "东二门陈冠希", "tags": ["WEB安全", "工具"], "text": "这是我们的Nmap备忘单的第四部分。本文中我们将讨论更多东西关于扫描防火墙，IDS / IPS 逃逸，Web服务器渗透测试等。"}
{"title": "极客DIY：利用Arduino 制作一个小机器人", "url": "https://www.freebuf.com/geek/101222.html", "time": "2016-04-12", "level": "", "num_look": 477191, "num_comment": 6, "author": "亲爱的兔子", "tags": ["极客"], "text": "Arduino是一款开源电子原型平台,包含硬件（各种型号的Arduino板）和软件（Arduino IDE)。"}
{"title": "北京VTech团队招聘移动安全工程师", "url": "https://www.freebuf.com/jobs/101331.html", "time": "2016-04-12", "level": "", "num_look": 191958, "num_comment": 7, "author": "antoxu", "tags": ["安全招聘"], "text": "我们提供挑战神经的工作机会及待遇，如果你也厌倦平凡，那就和我们一起改变世界。"}
{"title": "阿里云安全发布2015年度态势感知报告：预警撞库攻击", "url": "https://www.freebuf.com/articles/paper/101354.html", "time": "2016-04-12", "level": "", "num_look": 342323, "num_comment": 5, "author": "阿里云安全", "tags": ["安全报告"], "text": "4月12日，阿里云安全团队正式对外发布《2015年度云盾态势感知报告》。"}
{"title": "CVE-2016-1494 (python - rsa)漏洞详解", "url": "https://www.freebuf.com/articles/terminal/101200.html", "time": "2016-04-12", "level": "现金奖励", "num_look": 628470, "num_comment": 14, "author": "uncleheart", "tags": ["系统安全", "终端安全"], "text": "CVE-2016-1494这一漏洞是Python-rsa的签名伪造。"}
{"title": "工具推荐：三款自动化代码审计工具", "url": "https://www.freebuf.com/sectool/101256.html", "time": "2016-04-12", "level": "", "num_look": 1692802, "num_comment": 18, "author": "istr33", "tags": ["工具"], "text": "在本文中将分享三款自动化代码审计工具。"}
{"title": "黑客事件中如何实现利益最大化？", "url": "https://www.freebuf.com/news/101131.html", "time": "2016-04-12", "level": "", "num_look": 192273, "num_comment": 4, "author": "简单", "tags": ["资讯"], "text": "近几年，网络犯罪事件频繁发生，网络攻击技术也日趋高超，然而对于网络犯罪者来说，怎样实现攻击利益最大化才是问题的关键。"}
{"title": "4月9日FreeTalk·北京站全程揭秘", "url": "https://www.freebuf.com/fevents/101317.html", "time": "2016-04-11", "level": "红色标题", "num_look": 371844, "num_comment": 13, "author": "FB独家", "tags": ["活动"], "text": "FreeBuf工作人员提前在场地调试设备的时候，大家都来问，“什么时候路演？”、“虽然我不懂安全这块儿，但是依旧觉得很厉害啊”、“哪里可以买票？”"}
{"title": "“海盗网站”Kickass成为第一家推出双重认证的Torrent网站", "url": "https://www.freebuf.com/news/101265.html", "time": "2016-04-11", "level": "", "num_look": 190056, "num_comment": 2, "author": "米雪儿", "tags": ["资讯"], "text": "盗版网站KickassTorrents将推出双重认证，以保障用户帐号安全和隐私。"}
{"title": "GSM BTS Hacking: 利用BladeRF和开源BTS 5搭建基站", "url": "https://www.freebuf.com/geek/101166.html", "time": "2016-04-11", "level": "金币+10", "num_look": 750895, "num_comment": 17, "author": "亲爱的兔子", "tags": ["极客", "特别企划"], "text": "如果你已经购买了Nuand（官方）BladeRF x40，那么就可以在上面运行OpenBTS并可以输入一些指令来完成一些任务。"}
{"title": "Linux ASLR漏洞：攻击者可无限禁用ASLR（CVE-2016-3672）", "url": "https://www.freebuf.com/vuls/101169.html", "time": "2016-04-11", "level": "金币+5", "num_look": 302057, "num_comment": 2, "author": "vul_wish", "tags": ["漏洞"], "text": "近日，安全人员修复了一个Linux ASLR中比较古老的漏洞，拥有x86设备上的32位应用程序使用权限的任何用户，通过将RLIMIT_STACK资源设置为“无限制”可以禁用ASLR。"}
{"title": "Powershell恶意代码的N种姿势", "url": "https://www.freebuf.com/articles/database/101267.html", "time": "2016-04-11", "level": "", "num_look": 761595, "num_comment": 4, "author": "奇安信威胁情报中心", "tags": ["安全管理", "数据安全"], "text": "Powershell，曾经Windows系统管理员的称手工具，在恶意代码制造和传播者手里也被玩得花样百出。"}
{"title": "DDoS恶意软件发展史", "url": "https://www.freebuf.com/articles/terminal/101018.html", "time": "2016-04-11", "level": "现金奖励", "num_look": 439487, "num_comment": 5, "author": "bt0sea", "tags": ["终端安全", "网络安全"], "text": "本文主要和大家聊聊DDoS攻击软件的发展史，同时，从黑产业务需求角度分析形成原因，从宏观上透视anti-DDoS安全行业的安全解决方案。"}
{"title": "如何通过一张照片来获取ip地址？", "url": "https://www.freebuf.com/articles/database/101233.html", "time": "2016-04-11", "level": "金币+5", "num_look": 1455774, "num_comment": 48, "author": "watcher", "tags": ["数据安全", "网络安全"], "text": "在本教程中，我们将学习如何用一张照片来盗取ip地址。"}
{"title": "DHT爬虫：18.4GB种子分析小记", "url": "https://www.freebuf.com/articles/database/101110.html", "time": "2016-04-11", "level": "现金奖励", "num_look": 1650596, "num_comment": 24, "author": "zrools", "tags": ["数据安全"], "text": "通过本文我们将学习如何利用爬虫对种子数据进行分析和分类。"}
{"title": "TREASUREHUNT：为黑客特别定制的POS恶意软件工具", "url": "https://www.freebuf.com/sectool/101183.html", "time": "2016-04-11", "level": "", "num_look": 215094, "num_comment": 2, "author": "江湖小吓", "tags": ["工具"], "text": "自2015年初POS恶意软件的数量就在不断增长。这种软件一般都是将窃取的银行卡信息上传到一个指定的CNC服务器上。"}
{"title": "OSVDB创始人：开源漏洞数据库现在为何关闭了？", "url": "https://www.freebuf.com/news/101162.html", "time": "2016-04-11", "level": "", "num_look": 339267, "num_comment": 4, "author": "SamSmith", "tags": ["漏洞", "资讯"], "text": "开源漏洞数据库OSVDB是一个建立于2002年的独立安全漏洞信息的开放平台，研究者可以不受大型企业软件公司的监督自主进行安全信息的交流。"}
{"title": "俄罗斯黑客为优化“服务”开始加班了", "url": "https://www.freebuf.com/news/100989.html", "time": "2016-04-10", "level": "", "num_look": 234843, "num_comment": 7, "author": "SamSmith", "tags": ["资讯"], "text": "全世界的网络攻击者已经开始延长工作时间，以确保向“客户”提供优质的服务，其中最勤快的要数俄罗斯黑客了。"}
{"title": "Maligno：一个开源的渗透测试工具", "url": "https://www.freebuf.com/sectool/101211.html", "time": "2016-04-10", "level": "", "num_look": 373276, "num_comment": 4, "author": "felix", "tags": ["工具"], "text": "Maligno是一个基于FreeBSD许可证的开源的渗透测试工具。使用Python编写，最大限度与Metasploit兼容。"}
{"title": "真实的暗网是一个不足30000的站点的黑色网络地带", "url": "https://www.freebuf.com/news/101202.html", "time": "2016-04-10", "level": "金币+5", "num_look": 974026, "num_comment": 14, "author": "寰者", "tags": ["头条", "资讯"], "text": "关于“暗网”这个词，在当下也逐渐被公众所熟知，而一提到“暗网”，相信大部分人最初的印象会想到毒品、数据、个人隐私信息、赌博、军火、黑客等标签。"}
{"title": "FBI称其破解工具无法破解iphone5s，6s和6s plus", "url": "https://www.freebuf.com/news/101189.html", "time": "2016-04-09", "level": "金币+5", "num_look": 232200, "num_comment": 13, "author": "watcher", "tags": ["资讯"], "text": "FBI表示破解iPhone5c的工具并不适用于iphone 5s及其之后机型。"}
{"title": "白宫拒绝支持加密立法提案", "url": "https://www.freebuf.com/news/101179.html", "time": "2016-04-09", "level": "金币+5", "num_look": 152328, "num_comment": 5, "author": "FireFrank", "tags": ["资讯"], "text": "知情人士称，白宫拒绝支持给公众，他们选择起草立法法案，授予法官权利使其能够得到科技公司如苹果公司等必须帮助执法部门破解加密数据。"}
{"title": "阿塞拜疆黑客攻击俄罗斯驻亚美尼亚大使馆的官方Twitter帐户", "url": "https://www.freebuf.com/news/101001.html", "time": "2016-04-09", "level": "", "num_look": 145329, "num_comment": 2, "author": "米雪儿", "tags": ["资讯"], "text": "来自阿塞拜疆的反亚美尼亚黑客团队攻击了驻亚美尼亚的俄罗斯大使馆的官方Twitter账号。"}
{"title": "你造吗？恶意软件连老司机也骗了", "url": "https://www.freebuf.com/news/100705.html", "time": "2016-04-08", "level": "", "num_look": 183531, "num_comment": 2, "author": "亲爱的兔子", "tags": ["资讯"], "text": "近日，美国宾夕法尼亚州发生了一件事情，令当地很多老司机感到头疼。"}
{"title": "Petya：将勒索软件带向底层", "url": "https://www.freebuf.com/articles/terminal/101133.html", "time": "2016-04-08", "level": "金币+5", "num_look": 534959, "num_comment": 9, "author": "东二门陈冠希", "tags": ["终端安全"], "text": "Petya和其他流行勒索软件不一样，它是通过攻击底层的磁盘架构达到无法访问整个系统的目的。"}
{"title": "一个DOS攻击木马的详细分析过程", "url": "https://www.freebuf.com/articles/network/100609.html", "time": "2016-04-08", "level": "现金奖励", "num_look": 552733, "num_comment": 18, "author": "expsky", "tags": ["网络安全"], "text": "网路流量里发现了大量的的1.exe的文件，而且一直在持续，第一感觉就像是一个木马程序，而且每个1.exe的MD5都不一样。"}
{"title": "意大利政府撤销Hacking Team软件出口许可证，只能在欧盟地区售卖软件", "url": "https://www.freebuf.com/news/101046.html", "time": "2016-04-08", "level": "", "num_look": 169417, "num_comment": 3, "author": "FireFrank", "tags": ["资讯"], "text": "Hacking Team要哭了：意大利政府撤销Hacking Team软件出口许可证，只能在欧盟地区售卖软件！"}
{"title": "Adobe Flash Player真的走入了绝境？", "url": "https://www.freebuf.com/vuls/100965.html", "time": "2016-04-08", "level": "金币+6", "num_look": 265668, "num_comment": 10, "author": "watcher", "tags": ["漏洞"], "text": "Adobe Flash Player可以流畅地应用于各种平台，但是也正是因为其应用的广泛性和其本身的脆弱性，导致它总是受到黑客们的青睐，这一次也不例外。"}
{"title": "浅析巴西恶意软件进化史", "url": "https://www.freebuf.com/articles/system/101004.html", "time": "2016-04-08", "level": "", "num_look": 329871, "num_comment": 3, "author": "felix", "tags": ["安全报告", "系统安全"], "text": "巴西的恶意软件日复一日地持续进化着，这使它变得越来越复杂。如果你想了解当前各种各样的恶意软件是怎么工作的，你可以直接跳到第三节。"}
{"title": "WordPress和Joomla网站：遭受欺骗jQuery攻击", "url": "https://www.freebuf.com/articles/web/100974.html", "time": "2016-04-08", "level": "", "num_look": 287185, "num_comment": 5, "author": "dawner", "tags": ["WEB安全", "系统安全"], "text": "JQuery是一个非常主流的JS代码库，它的出现主要是为了消除不同浏览器之前的JS实现差异。"}
{"title": "“挖洞联盟”第一季团队赛颁奖礼", "url": "https://www.freebuf.com/fevents/101047.html", "time": "2016-04-07", "level": "", "num_look": 598496, "num_comment": 12, "author": "漏洞盒子", "tags": ["活动"], "text": "在为期半个多月的“挖洞联盟”第一季比赛过程中，盒子君感受到了广大白帽子漏洞挖掘的热情以及战友间的浓浓激情。"}
{"title": "网思科平科技有限公司安全招聘", "url": "https://www.freebuf.com/jobs/100907.html", "time": "2016-04-07", "level": "", "num_look": 287468, "num_comment": 17, "author": "网思科平", "tags": ["安全招聘"], "text": "网思科平科技有限公司简介：专业从事网络安全研究研究和大数据分析与增值业务。"}
{"title": "特朗普酒店再次被黑，信用卡数据泄露", "url": "https://www.freebuf.com/news/101045.html", "time": "2016-04-07", "level": "", "num_look": 162364, "num_comment": 2, "author": "stacey", "tags": ["资讯"], "text": ""}
{"title": "Facebook新技术可识别李逵or李鬼", "url": "https://www.freebuf.com/news/101028.html", "time": "2016-04-07", "level": "金币+6", "num_look": 176328, "num_comment": 6, "author": "米雪儿", "tags": ["资讯"], "text": "Facebook团队正开发一个全新的工具，旨在通过自动扫描识别正在假冒自己的身份在社交平台上进行骚扰活动等。"}
{"title": "让安全攻城狮增值的五大职业技能", "url": "https://www.freebuf.com/news/100934.html", "time": "2016-04-07", "level": "", "num_look": 281587, "num_comment": 13, "author": "SamSmith", "tags": ["资讯"], "text": "这里列举了网络安全职业的五项热门专业技能，数据说话，仅供参考。"}
{"title": "揭秘如何用Python黑掉智能锅炉", "url": "https://www.freebuf.com/vuls/100872.html", "time": "2016-04-07", "level": "金币+6", "num_look": 323164, "num_comment": 4, "author": "亲爱的兔子", "tags": ["漏洞"], "text": "去年我买了一个新的冷凝式锅炉(家用取暖产品)，于是考虑上面必须有一个“智能恒温器”。"}
{"title": "Apple iOS 9.3 S/Plus – 触摸密码绕过漏洞", "url": "https://www.freebuf.com/articles/terminal/100967.html", "time": "2016-04-07", "level": "金币+6", "num_look": 325053, "num_comment": 12, "author": "vulture", "tags": ["终端安全"], "text": "漏洞实验室核心研究团队在苹果iOS 9.3.1 iPhone 6S & Plus机型上发现了一个本地密码绕过漏洞。"}
{"title": "异常中的异常：借助系统异常处理特例实现匪夷所思的漏洞利用", "url": "https://www.freebuf.com/vuls/100951.html", "time": "2016-04-07", "level": "红色标题", "num_look": 376419, "num_comment": 4, "author": "腾讯玄武实验室", "tags": ["漏洞"], "text": "Windows系统的异常处理流程中存在一些小小的特例，借助这些特例，就可以知其不可写而写，知其不可执行而执行。"}
{"title": "微软最新账户身份验证漏洞分析", "url": "https://www.freebuf.com/vuls/100912.html", "time": "2016-04-07", "level": "金币+6", "num_look": 278402, "num_comment": 1, "author": "vul_wish", "tags": ["漏洞"], "text": "英国安全顾问Jack Whitton在微软的身份验证系统中发现了一个重要漏洞，攻击者可访问用户的Outlook、Azure和Office账户，为此微软支付了1.3万美元奖金。"}
{"title": "WhatsApp默认为10亿用户提供点对点加密技术", "url": "https://www.freebuf.com/news/100946.html", "time": "2016-04-07", "level": "", "num_look": 284892, "num_comment": 7, "author": "watcher", "tags": ["终端安全", "资讯"], "text": "Facebook宣布，目前已经为有10亿多用户的聊天应用WhatsApp改进了默认的加密设置，从2016年4月5日起，所有的WhatsApp通讯信息都将默认采用点对点加密技术。"}
{"title": "思科FirePower系列防火墙存在漏洞，允许恶意软件绕过检测", "url": "https://www.freebuf.com/vuls/100842.html", "time": "2016-04-06", "level": "", "num_look": 265278, "num_comment": 5, "author": "米雪儿", "tags": ["漏洞"], "text": "“思科 Firepower系统软件的恶意文件检测和拦截功能中的漏洞，可能会允许未经身份验证的远程攻击者绕过受影响系统上的恶意软件检测机制。”"}
{"title": "Traccar：支持在线追踪功能的开源GPS追踪工具", "url": "https://www.freebuf.com/sectool/100696.html", "time": "2016-04-06", "level": "金币+8", "num_look": 449108, "num_comment": 13, "author": "亲爱的兔子", "tags": ["工具"], "text": "Traccar是一个开源的GPS追踪软件，可以安装在设备上定位设备的地理位置。把一部智能手机变成一个追踪器！"}
{"title": "一个信息偷窃软件的研究案例（三）", "url": "https://www.freebuf.com/articles/terminal/100690.html", "time": "2016-04-06", "level": "", "num_look": 326206, "num_comment": 1, "author": "felix", "tags": ["终端安全", "网络安全"], "text": "本文会从上次分析剩下的地方开始：加密算法。接着，我们将看到Pony如何把加密后的数据发往服务器，然后完成恶意软件通常会做的清除痕迹工作作为结束。"}
{"title": "Python爬虫开发（三-续）：快速线程池爬虫", "url": "https://www.freebuf.com/articles/system/100668.html", "time": "2016-04-06", "level": "现金奖励", "num_look": 770568, "num_comment": 10, "author": "VillanCh", "tags": ["系统安全"], "text": "本文主要讲一下轻型线程池爬虫，同时也为大家提供一个思路。代码都是经过调试的，并且留了相对友好的用户接口。"}
{"title": "Acunetix Web Vulnarability Scanner V10.5 详细中文手册", "url": "https://www.freebuf.com/sectool/100713.html", "time": "2016-04-06", "level": "现金奖励", "num_look": 2435662, "num_comment": 27, "author": "Porsche", "tags": ["安全管理", "工具"], "text": "Acunetix Web Vulnerability Scanner（简称AWVS）是一款知名的Web网络漏洞扫描工具，它通过网络爬虫测试你的网站安全，检测流行安全漏洞。"}
{"title": "极客DIY：如何构建一台属于自己的基站", "url": "https://www.freebuf.com/geek/100735.html", "time": "2016-04-06", "level": "金币+8", "num_look": 2094577, "num_comment": 30, "author": "亲爱的兔子", "tags": ["极客", "特别企划"], "text": "这篇文章将会介绍如何建立一个小型便携式GSM基站，GSM网络可以遭到攻击/劫持/拦截，当然你可以利用相对价格比较低的电子设备做到这一点。而本文也仅仅供交流学习使用。"}
{"title": "帮FBI抓住他，300万美元轻松到手", "url": "https://www.freebuf.com/news/100840.html", "time": "2016-04-06", "level": "金币+8", "num_look": 335006, "num_comment": 13, "author": "米雪儿", "tags": ["数据安全", "资讯"], "text": "一款影响全球的恶意软件核心开发者，一张2014年来自FBI的300万美元悬赏令，至今仍寻获未果，现在给你认领这300万美元的机会。"}
{"title": "关注漏洞盒子订阅号，即有机会获取门票 FREE TALK•北京站", "url": "https://www.freebuf.com/news/topnews/98346.html", "time": "2016-04-05", "level": "红色标题", "num_look": 556078, "num_comment": 20, "author": "FB独家", "tags": ["头条", "活动"], "text": "即日起至4月9日，你可以报名参加FreeBuf举办的Freetalk北京站，填写的资料越详细通过审核的概率就越大，"}
{"title": "Android提权漏洞CVE-2014-7920、CVE-2014-7921分析", "url": "https://www.freebuf.com/vuls/100785.html", "time": "2016-04-05", "level": "", "num_look": 366516, "num_comment": 3, "author": "阿里聚安全", "tags": ["漏洞", "终端安全"], "text": "这是Android mediaserver的提权漏洞，利用CVE-2014-7920和CVE-2014-7921实现提权，从0权限提到media权限。"}
{"title": "麻省理工（MIT）开发新型WiFi定位系统，蹭网者靠边", "url": "https://www.freebuf.com/news/100748.html", "time": "2016-04-05", "level": "金币+8", "num_look": 242354, "num_comment": 5, "author": "亲爱的兔子", "tags": ["资讯"], "text": "美国麻省理工学院计算机科学及人工智能实验室（CSAIL）建立了一个新系统Chronos ，利用该系统可以定位人或物品。"}
{"title": "Free Star木马分析与追溯", "url": "https://www.freebuf.com/articles/network/100827.html", "time": "2016-04-05", "level": "", "num_look": 474278, "num_comment": 16, "author": "奇安信威胁情报中心", "tags": ["网络安全"], "text": "近期我们看到了一些较新版本的大灰狼木马采用了一种新的上线方式，与利用QQ空间、微博、博客或者网盘等方式上线相似。"}
{"title": "渗透测试中上传文件到目标系统的四种姿势", "url": "https://www.freebuf.com/articles/network/100788.html", "time": "2016-04-05", "level": "金币+8", "num_look": 519111, "num_comment": 9, "author": "xiaix", "tags": ["网络安全"], "text": "Windows 有一个程序叫 debug，这个程序可以将十六进制的机器码转换为可执行的文件。"}
{"title": "技术揭秘：黑客是如何利用Metasploit接管后门和僵尸网络的？", "url": "https://www.freebuf.com/articles/system/100774.html", "time": "2016-04-05", "level": "", "num_look": 555960, "num_comment": 4, "author": "felix", "tags": ["系统安全", "网络安全"], "text": "这篇文章中，我们将讨论利用Metasploit来攻击并接管常见的后门和僵尸网络的话题。"}
{"title": "SHA-1和SHA-2组合拳绕过恶意软件检测机制", "url": "https://www.freebuf.com/articles/system/100225.html", "time": "2016-04-05", "level": "", "num_look": 201660, "num_comment": 1, "author": "dawner", "tags": ["系统安全"], "text": "赛门铁克公司最近在其博客指出，他们感知出恶意软件的一个令人不安的攻击趋势：在盗用正常的SHA-2证书后，恶意软件能存活的更加容易。"}
{"title": "和黑客玩场游戏：利用CryptoWall跟踪器搞砸黑客小心思", "url": "https://www.freebuf.com/articles/database/100764.html", "time": "2016-04-05", "level": "金币+8", "num_look": 400800, "num_comment": 6, "author": "江湖小吓", "tags": ["数据安全", "网络安全"], "text": "在一次TED演讲上有个人演示了一个和419骗子交互的游戏——当你回复垃圾邮件后会发生什么，于是我也有了和黑客打游击战的想法。"}
{"title": "开发者的好帮手：可视化的差异合并工具Meld", "url": "https://www.freebuf.com/sectool/100381.html", "time": "2016-04-05", "level": "", "num_look": 312278, "num_comment": 2, "author": "dawner", "tags": ["安全管理", "工具"], "text": "它可以帮你检查代码更迭并理解补丁，甚至可以帮你找出发生了什么，帮你避免一些不必要的错误。"}
{"title": "极客DIY：利用一些旧零件来组装iphone SE", "url": "https://www.freebuf.com/geek/100744.html", "time": "2016-04-05", "level": "金币+5", "num_look": 452147, "num_comment": 2, "author": "watcher", "tags": ["极客"], "text": "随着iphone SE正式投入了市场，许多DIY爱好者对iphone SE进行了研究。其中，知名的DIY网站iFixit就对iphone SE进行了拆机分析。"}
{"title": "黑客组织匿名者（Anonymous）入侵肯尼亚石油公司网站", "url": "https://www.freebuf.com/news/100738.html", "time": "2016-04-04", "level": "", "num_look": 188811, "num_comment": 7, "author": "stacey", "tags": ["资讯"], "text": "匿名者（Anonymous）盯上了肯尼亚石油公司。"}
{"title": "Maktub Locker：美丽而又危险的勒索软件", "url": "https://www.freebuf.com/articles/network/100219.html", "time": "2016-04-04", "level": "金币+5", "num_look": 374770, "num_comment": 3, "author": "老王隔壁的白帽子", "tags": ["网络安全"], "text": "Maktub Locker是一款勒索软件，GUI界面设计的很漂亮，并且有着一些有趣的特征。"}
{"title": "供应链安全问题再现：一个药品管理系统怎么会有1400个漏洞？", "url": "https://www.freebuf.com/news/100504.html", "time": "2016-04-04", "level": "", "num_look": 269213, "num_comment": 3, "author": "明明知道", "tags": ["漏洞", "系统安全"], "text": "工控系统网络应急响应小组（ICS-CERT）周二发布的公告显示，一个被广泛使用的用药管理系统中存在超过1400个漏洞。"}
{"title": "美国成立新网络安全部门，应对网络安全问题", "url": "https://www.freebuf.com/news/100577.html", "time": "2016-04-04", "level": "", "num_look": 174041, "num_comment": 3, "author": "亲爱的兔子", "tags": ["资讯"], "text": "3月25日美国海军陆战队宣布成立了一个新的部门，开展网络空间防御行动。"}
{"title": "直击Black Hat Asia黑帽亚洲峰会：无人机又飞走了", "url": "https://www.freebuf.com/news/100625.html", "time": "2016-04-03", "level": "红色标题", "num_look": 501953, "num_comment": 4, "author": "哆啦A梦", "tags": ["无线安全", "资讯"], "text": "没有采用加密的专业版无人机很容易WiFi被勾搭，信号就被复制了，接着就飞走了....."}
{"title": "Linux Remaiten恶意软件正在部署物联网设备僵尸网络", "url": "https://www.freebuf.com/articles/terminal/100601.html", "time": "2016-04-03", "level": "", "num_look": 327078, "num_comment": 4, "author": "米雪儿", "tags": ["终端安全", "网络安全"], "text": "ESET安全公司的研究人员发现一款恶意软件，以物联网设备如路由器、网关和无线接入点等为攻击目标。"}
{"title": "PETYA勒索软件：可加密整个硬盘，锁定用户计算机", "url": "https://www.freebuf.com/articles/system/100196.html", "time": "2016-04-03", "level": "", "num_look": 344156, "num_comment": 4, "author": "vul_wish", "tags": ["数据安全", "系统安全"], "text": "安全专家发现了一款新型的勒索恶意软件——Petya，它可造成计算机蓝屏死机（BSoD），并在操作系统加载前，将常规的Windows图标替换成闪烁的、由红色和白色组成的图像。"}
{"title": "FB视频：纪录片《暗网》之勒索软件篇", "url": "https://www.freebuf.com/articles/terminal/100355.html", "time": "2016-04-02", "level": "红色标题", "num_look": 693945, "num_comment": 9, "author": "FB视频", "tags": ["系统安全", "终端安全"], "text": "Detox何人？他是一名在暗网中发布勒索软件的黑客。 我们与他取得了联系......"}
{"title": "浏览器Lexer与XSS-HTML编码", "url": "https://www.freebuf.com/articles/web/100675.html", "time": "2016-04-02", "level": "现金奖励", "num_look": 354774, "num_comment": 9, "author": "VillanCh", "tags": ["WEB安全"], "text": "本文将分享一些浏览器Lexer以及XSS-HTML编码的姿势。"}
{"title": "安全预警：一个影响1.3亿苹果用户的漏洞利用代码", "url": "https://www.freebuf.com/news/100605.html", "time": "2016-04-02", "level": "", "num_look": 291676, "num_comment": 6, "author": "亲爱的兔子", "tags": ["漏洞", "资讯"], "text": "近日，有安全研究人员发布了一条推文，提及苹果设备的漏洞以及有关漏洞的程序代码。"}
{"title": "工具推荐：Netdata，Linux性能实时监测工具", "url": "https://www.freebuf.com/sectool/100484.html", "time": "2016-04-02", "level": "金币+5", "num_look": 945665, "num_comment": 38, "author": "watcher", "tags": ["工具"], "text": "本文将推荐一款Linux性能实时监测工具。"}
{"title": "受伤的不只有苹果，谷歌已经被勒令解锁了", "url": "https://www.freebuf.com/articles/terminal/100581.html", "time": "2016-04-01", "level": "金币+5", "num_look": 260103, "num_comment": 10, "author": "watcher", "tags": ["终端安全"], "text": "随着FBI宣布其成功破解了San Bernardino枪击案凶手的iPhone 5C手机，苹果与美国联邦调查局(FBI)之间的斗争，或许已经接近尾声。然而..."}
{"title": "新型恶意软件TreasureHunt已瞄准零售商和银行", "url": "https://www.freebuf.com/news/100497.html", "time": "2016-04-01", "level": "", "num_look": 188373, "num_comment": 2, "author": "亲爱的兔子", "tags": ["资讯"], "text": "近日，FireEye发现了一种新型POS机恶意软件，同时该恶意软件已经将目标转移至零售商和银行。"}
{"title": "Nmap备忘单：从探索到漏洞利用（Part3）", "url": "https://www.freebuf.com/vuls/100580.html", "time": "2016-04-01", "level": "金币+5", "num_look": 589567, "num_comment": 4, "author": "东二门陈冠希", "tags": ["漏洞"], "text": "众所周知NMAP是经常用来进行端口发现、端口识别，除此之外还可以做什么呢？"}
{"title": "浅谈2016年医疗行业面临的几种安全威胁", "url": "https://www.freebuf.com/articles/network/100545.html", "time": "2016-04-01", "level": "", "num_look": 389491, "num_comment": 2, "author": "简单", "tags": ["网络安全"], "text": "近几年，物联网行业势如破竹般的崛起，从安全角度来看，医疗设备行业作为物联网中一个重要组成部分，其安全问题不容小觑。"}
{"title": "探秘国内地下数据交易市场", "url": "https://www.freebuf.com/news/topnews/100459.html", "time": "2016-04-01", "level": "现金奖励", "num_look": 1176252, "num_comment": 32, "author": "mcvoodoo", "tags": ["头条", "数据安全"], "text": "由于大数据的兴起，对社会产生了巨大的改变，拥有数据则拥有未来。"}
{"title": "Linux系统审计工具 Lynis 新版本发布", "url": "https://www.freebuf.com/articles/100223.html", "time": "2016-04-01", "level": "金币+12", "num_look": 373900, "num_comment": 4, "author": "亲爱的兔子", "tags": ["工具", "文章"], "text": "Lynis是一个为系统管理员提供的 Linux和Unix的审计工具 。"}
{"title": "深信服科技招聘安全架构师、安全售前专家", "url": "https://www.freebuf.com/jobs/100210.html", "time": "2016-04-01", "level": "", "num_look": 250693, "num_comment": 13, "author": "leonhr", "tags": ["安全招聘"], "text": "深信服科技成立于2000年，是中国最大的新网络产品供应商，致力于提供基于创新网络的产品及解决方案。"}
{"title": "一个信息偷窃软件的研究案例（二）", "url": "https://www.freebuf.com/articles/network/100376.html", "time": "2016-04-01", "level": "", "num_look": 321349, "num_comment": 1, "author": "felix", "tags": ["网络安全"], "text": "在这第二部分的分析中，我们将会研究Pony如何偷窃数据，并且如何发送给C&C服务器。"}
{"title": "人机接口工具Kautilya：渗透测试的好帮手", "url": "https://www.freebuf.com/sectool/100101.html", "time": "2016-04-01", "level": "", "num_look": 319860, "num_comment": 2, "author": "dawner", "tags": ["工具", "系统安全"], "text": "Kautilya是一个给人机接口设备提供各种payload的工具包，比如可以烧录给teensy，它可以帮助人们进行渗透测试。"}
{"title": "威胁情报基础：爬取、行走、分析（Part 3）", "url": "https://www.freebuf.com/articles/security-management/100298.html", "time": "2016-04-01", "level": "", "num_look": 341387, "num_comment": 3, "author": "SamSmith", "tags": ["安全管理"], "text": "这是威胁情报基础三部曲的最后一篇，本文将继续讨论威胁情报如何在安全操作中实施的。"}
{"title": "如何利用Locky勒索软件漏洞制造“疫苗”？", "url": "https://www.freebuf.com/vuls/100213.html", "time": "2016-03-31", "level": "金币+12", "num_look": 295337, "num_comment": 5, "author": "极客小默", "tags": ["漏洞", "系统安全"], "text": "我们在2009年向Conflicker.C申请制造”疫苗”，目的就是保护工作站和服务器免受病毒肆虐的侵害。让我们来看看同样的办法能否够应用于Locky勒索软件？"}
{"title": "如何远程控制别人的无线鼠标：深度揭露mouseJack内幕", "url": "https://www.freebuf.com/vuls/100501.html", "time": "2016-03-31", "level": "", "num_look": 605377, "num_comment": 20, "author": "阿里安全", "tags": ["漏洞", "终端安全"], "text": "多产商生产的无线鼠标和无线键盘存在安全漏洞，攻击者可在远达100米的范围内可以远程控制受害者的无线鼠标并进行一些恶意操作。"}
{"title": "苹果公司要求FBI公布破解iPhone的技术细节", "url": "https://www.freebuf.com/news/100524.html", "time": "2016-03-31", "level": "金币+12", "num_look": 313638, "num_comment": 16, "author": "watcher", "tags": ["系统安全", "资讯"], "text": "苹果的律师正在研究如何使用法律手段，去迫使政府移交相关的技术细节，但是直到星期二，苹果公司仍没有更新这一事件的进展"}
{"title": "黑掉70多款监控摄像头？so easy！", "url": "https://www.freebuf.com/news/100190.html", "time": "2016-03-31", "level": "金币+12", "num_look": 497916, "num_comment": 5, "author": "极客小默", "tags": ["安全管理", "漏洞"], "text": "近日，一位安全研究员发现70多个供应商售卖的监控摄像头很容易受到远程代码执行（RCE）攻击。"}
{"title": "我是如何让一台1977年的电脑连接上WiFi的？", "url": "https://www.freebuf.com/geek/100322.html", "time": "2016-03-31", "level": "金币+12", "num_look": 359918, "num_comment": 9, "author": "亲爱的兔子", "tags": ["极客"], "text": "电影中在第七区，美国国防部部长想要派空军轰炸威震天，就让其中一个黑客通过一台旧电脑联系空军发出信息。"}
{"title": "APK瘦身记，如何实现高达53%的压缩效果", "url": "https://www.freebuf.com/articles/security-management/100433.html", "time": "2016-03-31", "level": "", "num_look": 467720, "num_comment": 10, "author": "阿里聚安全", "tags": ["安全管理"], "text": "欲瘦身，我们先找找胖的原因和问题。"}
{"title": "打狗棒法之进阶篇：Cknife修改配置法秒过安全狗", "url": "https://www.freebuf.com/articles/web/100432.html", "time": "2016-03-31", "level": "现金奖励", "num_look": 753728, "num_comment": 11, "author": "Chora", "tags": ["WEB安全", "系统安全"], "text": "绕过安全狗系列文章进阶篇"}
{"title": "JSPrime：基于JavaScript DOM XSS检测的轻量级代码审计工具", "url": "https://www.freebuf.com/articles/web/100413.html", "time": "2016-03-31", "level": "金币+12", "num_look": 419528, "num_comment": 7, "author": "寰者", "tags": ["WEB安全"], "text": "随着前端技术人才需求的不断增加，越来越多的开发者逐渐将JavaScript作为其开发语言的第一选择。本文中我们将推荐一款基于JavaScript DOM XSS检测的轻量级代码审计工具。"}
{"title": "“狡猾”的USB木马被发现：威胁物理隔离的系统", "url": "https://www.freebuf.com/articles/system/100060.html", "time": "2016-03-31", "level": "金币+12", "num_look": 292170, "num_comment": 6, "author": "寰者", "tags": ["系统安全"], "text": "目前发现一类难以检测分析的USB木马，该木马主要对物理隔离的系统进行感染传播，是一款网络及工业间谍活动中的“理想”木马。"}
{"title": "Client病毒已感染超7万人，暗扣费并频弹广告", "url": "https://www.freebuf.com/articles/terminal/100468.html", "time": "2016-03-30", "level": "", "num_look": 264528, "num_comment": 9, "author": "猎豹移动安全实验室", "tags": ["终端安全"], "text": "猎豹移动安全实验室与安天AVL移动安全团队于2015年下半年，共同截获一款名为Client的木马病毒，并且对该病毒进行持续监测。"}
{"title": "跪求浏览器拦截本站的解决方案……", "url": "https://www.freebuf.com/news/100405.html", "time": "2016-03-30", "level": "红色标题", "num_look": 529171, "num_comment": 32, "author": "FB独家", "tags": ["资讯"], "text": "面对火狐、谷歌浏览器拦截本站tools页面，小编哭了……"}
{"title": "黑客入侵自来水厂，无意中修改参数竟被发现", "url": "https://www.freebuf.com/news/99749.html", "time": "2016-03-30", "level": "", "num_look": 292835, "num_comment": 9, "author": "亲爱的兔子", "tags": ["资讯"], "text": "一个黑客组织无意间进入到一废水处理系统中，并修改了处理水中化学物的含量参数。"}
{"title": "技术分享：如何用Solr搭建大数据查询平台", "url": "https://www.freebuf.com/articles/database/100423.html", "time": "2016-03-30", "level": "现金奖励", "num_look": 1123070, "num_comment": 44, "author": "b41k3r", "tags": ["数据安全"], "text": "如何用Solr搭建大数据查询平台呢？一起来看这篇文章吧。"}
{"title": "谷歌确认100万Gmail邮箱遭政府黑客攻击", "url": "https://www.freebuf.com/news/100312.html", "time": "2016-03-30", "level": "金币+6", "num_look": 490076, "num_comment": 12, "author": "简单", "tags": ["资讯"], "text": "谷歌确认最近有100万的Gmail账户被政府黑客攻击，他们已经采取措施提升邮箱安全警示服务，保护用户免受政府黑客和监视活动的攻击。"}
{"title": "Burp Suite新手指南", "url": "https://www.freebuf.com/articles/web/100377.html", "time": "2016-03-30", "level": "", "num_look": 2174397, "num_comment": 6, "author": "vulture", "tags": ["WEB安全"], "text": "Burp Suite想必大家都用过，但是大家未必知道它的所有功能。因此，本文的主要目的就是尽量深入介绍各种功能。"}
{"title": "Petya敲诈木马拆解", "url": "https://www.freebuf.com/articles/web/100386.html", "time": "2016-03-30", "level": "", "num_look": 528755, "num_comment": 7, "author": "腾讯电脑管家", "tags": ["WEB安全", "网络安全"], "text": "近日，安全厂商G-Data发布报告说，发现了一种新的敲诈类木马Petya。"}
{"title": "BCTF解题报告", "url": "https://www.freebuf.com/news/topnews/100143.html", "time": "2016-03-30", "level": "现金奖励", "num_look": 572919, "num_comment": 6, "author": "lyuchen65", "tags": ["头条", "网络安全"], "text": "本文是Nu1L团队参加BCTF比赛给出的解题思路"}
{"title": "【信息安全创投巡礼】苹果天使基金：我们为什么专注于信息安全领域投资？", "url": "https://www.freebuf.com/news/topnews/100257.html", "time": "2016-03-30", "level": "", "num_look": 344702, "num_comment": 6, "author": "FB独家", "tags": ["头条", "观点"], "text": "什么样的公司和产品才会受到投资者的追捧？中国信息安全领域的独角兽公司又在哪里？"}
{"title": "这名黑客的四行代码让数千台打印机宣传种族主义", "url": "https://www.freebuf.com/articles/web/100255.html", "time": "2016-03-30", "level": "", "num_look": 455716, "num_comment": 11, "author": "寰者", "tags": ["WEB安全", "网络安全"], "text": "知名黑客Auernheimer在博客中承认入侵了上千台网络打印机，并使其打印出带有种族主义及反犹太人等信息的内容。"}
{"title": "一个信息偷窃软件的研究案例（一）", "url": "https://www.freebuf.com/articles/network/100054.html", "time": "2016-03-29", "level": "", "num_look": 358380, "num_comment": 2, "author": "felix", "tags": ["网络安全"], "text": "信息偷窃软件（stealer）是一种寻找机器上保存的密码并且远程发送给攻击者的恶意软件。"}
{"title": "FBI成功破解枪手iPhone 5C，苹果该如何接招？", "url": "https://www.freebuf.com/news/100287.html", "time": "2016-03-29", "level": "金币+6", "num_look": 265674, "num_comment": 9, "author": "FireFrank", "tags": ["终端安全", "资讯"], "text": "美国司法部表示，FBI已经访问了存储在圣贝纳迪诺恐怖分子iPhone中的加密数据。"}
{"title": "一次对支付宝木马的分析溯源之旅", "url": "https://www.freebuf.com/articles/terminal/100285.html", "time": "2016-03-29", "level": "红色标题", "num_look": 1029863, "num_comment": 46, "author": "奇安信威胁情报中心", "tags": ["终端安全", "网络安全"], "text": "与网络的黑暗面斗争中，我们看到太多的年轻人陷入黑产的陷井，少数人暴发横财及时收手还能全身而退，多数人身处产业链的底端所得不多却受牢狱之灾。"}
{"title": "极客DIY：开源WiFi智能手表制作", "url": "https://www.freebuf.com/geek/100164.html", "time": "2016-03-29", "level": "金币+6", "num_look": 456851, "num_comment": 6, "author": "亲爱的兔子", "tags": ["极客", "视频"], "text": "如果你喜欢拥有一款属于自己的无线手表，那么请不要错过，相信阅读完这篇文章对你会很有帮助。"}
{"title": "黑客组织“匿名者”重启攻击行动，目标加拿大矿业公司", "url": "https://www.freebuf.com/news/100239.html", "time": "2016-03-29", "level": "", "num_look": 158521, "num_comment": 2, "author": "FireFrank", "tags": ["资讯"], "text": "BCGold公司成为匿名者组织打击跨国公司的最新受害者。"}
{"title": "Oracle out-of-band release for Java SE Vulnerability漏洞分析(CVE-2016-0636)", "url": "https://www.freebuf.com/vuls/100217.html", "time": "2016-03-29", "level": "", "num_look": 309220, "num_comment": 3, "author": "四叶草安全", "tags": ["漏洞", "系统安全"], "text": "本文分析的漏洞:CVE-2016-0636，此漏洞是安全研究员（Adam Gowdiak）于2013年报告给Oracle的漏洞（CVE-2013-5838）的变体。"}
{"title": "Nmap备忘单：从探索到漏洞利用（Part 2）", "url": "https://www.freebuf.com/sectool/100221.html", "time": "2016-03-29", "level": "金币+8", "num_look": 718380, "num_comment": 7, "author": "东二门陈冠希", "tags": ["WEB安全", "工具"], "text": "这是我们的第二期NMAP备忘单。基本上，我们将讨论一些高级NMAP扫描的技术，我们将进行一个中间人攻击(MITM)。现在，游戏开始了。"}
{"title": "Elasticsearch目录遍历漏洞（CVE-2015-5531）复现与分析（附PoC）", "url": "https://www.freebuf.com/vuls/99942.html", "time": "2016-03-29", "level": "", "num_look": 652501, "num_comment": 8, "author": "wenjian_tk0", "tags": ["漏洞"], "text": "Elasticsearch是荷兰Elasticsearch公司的一套基于全文搜索引擎Apache Lucene构建的开源分布式RESTful搜索引擎。"}
{"title": "Libheap：一款用于分析Glibc堆结构的GDB调试工具", "url": "https://www.freebuf.com/sectool/99893.html", "time": "2016-03-29", "level": "", "num_look": 342375, "num_comment": 1, "author": "vul_wish", "tags": ["工具"], "text": "Libheap是一个用于在Linux平台上分析glibc堆结构的GDB调试脚本,使用Python语言编写。"}
{"title": "应用Truecaller存在远程利用漏洞，影响一亿安卓设备", "url": "https://www.freebuf.com/vuls/100103.html", "time": "2016-03-29", "level": "", "num_look": 267897, "num_comment": 1, "author": "米雪儿", "tags": ["漏洞", "终端安全"], "text": "猎豹移动安全研究实验室的安全研究人员发现呼叫管理应用程序Truecaller存在严重漏洞。"}
{"title": "如何编写burpsuite联动sqlmap的插件", "url": "https://www.freebuf.com/sectool/100093.html", "time": "2016-03-28", "level": "", "num_look": 735970, "num_comment": 33, "author": "山东安云", "tags": ["工具"], "text": "在本文中将分享如何编写一个Burpsuite联动sqlmap的插件。"}
{"title": "腾讯科恩实验室，寻找下一个Master of Pwn！", "url": "https://www.freebuf.com/jobs/99924.html", "time": "2016-03-28", "level": "", "num_look": 417102, "num_comment": 12, "author": "nforest", "tags": ["安全招聘"], "text": "腾讯KeenLab安全招聘。"}
{"title": "如何利用十行代码，绕过杀毒软件实现免杀？", "url": "https://www.freebuf.com/articles/system/100147.html", "time": "2016-03-28", "level": "金币+8", "num_look": 1059245, "num_comment": 35, "author": "xiaix", "tags": ["系统安全"], "text": "本文将讲述如何利用十行代码绕过杀毒软件，实现免杀。"}
{"title": "美国警察逮捕“控制”彩票中奖的六名犯罪嫌疑人", "url": "https://www.freebuf.com/news/100105.html", "time": "2016-03-28", "level": "", "num_look": 186108, "num_comment": 3, "author": "亲爱的兔子", "tags": ["资讯"], "text": "根据Hartford Courant报道称，美国康涅狄格州警察已经抓捕了六名操控彩票中奖的犯罪嫌疑人。"}
{"title": "“听说你爱我”网游盗号木马追踪", "url": "https://www.freebuf.com/articles/terminal/100109.html", "time": "2016-03-28", "level": "", "num_look": 234938, "num_comment": 10, "author": "360安全", "tags": ["终端安全"], "text": "近期有玩家反映游戏遭木马盗号，并发现黑客就像阴魂不散一样随时都能控制电脑。"}
{"title": "漏洞盒子助力“黑客秀”，不服者今夏来战", "url": "https://www.freebuf.com/fevents/100110.html", "time": "2016-03-28", "level": "", "num_look": 182886, "num_comment": 4, "author": "漏洞盒子", "tags": ["活动"], "text": "这是一次对传统安全的挑战，这是一场对黑客精神的膜拜，这是一个安全至上的开放时代。当防火墙遇上白帽子，今夏好戏即将上演！"}
{"title": "微软SQL Server透明数据加密（TDE）剖析及破解（下）", "url": "https://www.freebuf.com/articles/system/100082.html", "time": "2016-03-28", "level": "金币+8", "num_look": 491542, "num_comment": 1, "author": "FireFrank", "tags": ["系统安全", "网络安全"], "text": "大家都认为加密是好事，但是没有考虑特定的攻击场景，这种想法已经成为了一种趋势，但是加密的确是必要的，并且非常能说明问题。"}
{"title": "丝绸之路（Silk Road）沉浮录：你不知道的那一面（上）", "url": "https://www.freebuf.com/news/100042.html", "time": "2016-03-28", "level": "金币+8", "num_look": 656468, "num_comment": 6, "author": "简单", "tags": ["头条", "资讯"], "text": "我们只知道丝绸之路是一个买卖毒品的网站，但是从未了解过它的内部结构，以及是如何做到风生水起的。"}
{"title": "Subgraph OS：保护用户安全隐私的系统", "url": "https://www.freebuf.com/sectool/100091.html", "time": "2016-03-28", "level": "金币+8", "num_look": 267686, "num_comment": 3, "author": "亲爱的兔子", "tags": ["工具"], "text": "Subgraph OS作为目前第一款为GNU/Linux桌面安全而打造的GNU/Linux发行版受到了不少来自社区的好评。"}
{"title": "浅析基于态势感知的网络安全事件预测方法", "url": "https://www.freebuf.com/articles/network/100041.html", "time": "2016-03-27", "level": "现金奖励", "num_look": 556074, "num_comment": 9, "author": "木千之", "tags": ["网络安全", "观点"], "text": "当前机器学习应用的焦点在于能够及时检测出系统/组织中发生的攻击威胁，从而缩短攻击发生到应急响应的时间差。"}
{"title": "威胁情报基础：爬取、行走、分析（Part 2）", "url": "https://www.freebuf.com/articles/neopoints/100034.html", "time": "2016-03-27", "level": "", "num_look": 320068, "num_comment": 5, "author": "SamSmith", "tags": ["安全管理", "观点"], "text": "这是威胁情报基础三部曲的第二篇，我们将讨论是如何在安全操作中运用威胁情报以及其基本原理。"}
{"title": "黑客窃取Verizon公司用户资料后在线出售", "url": "https://www.freebuf.com/news/100062.html", "time": "2016-03-27", "level": "", "num_look": 261000, "num_comment": 261000, "author": "亲爱的兔子", "tags": ["资讯"], "text": "据 KrebsOnSecurity报道称，Verizon公司客户数据在地下网络市场被人出售。"}
{"title": "这部叫《暗网》的纪录片，讲了个X的暗网！", "url": "https://www.freebuf.com/news/others/99848.html", "time": "2016-03-26", "level": "红色标题", "num_look": 5809015, "num_comment": 43, "author": "llopppp", "tags": ["周边", "视频"], "text": "其实，有的时候比暗网更可怕的，是人心。"}
{"title": "揭秘黑客是如何黑掉三星NX300智能相机的", "url": "https://www.freebuf.com/vuls/99951.html", "time": "2016-03-26", "level": "金币+5", "num_look": 392677, "num_comment": 3, "author": "亲爱的兔子", "tags": ["漏洞", "终端安全"], "text": "三星NX300是一款无反光相机且内置NFC功能并可以连接WiFi。"}
{"title": "商业日志管理系统发展史", "url": "https://www.freebuf.com/articles/neopoints/99947.html", "time": "2016-03-26", "level": "现金奖励", "num_look": 420822, "num_comment": 10, "author": "bt0sea", "tags": ["安全管理", "观点"], "text": "日志管理系统是信息安全发展过程中一直存在的业务系统，日志是安全的传感器，所以很有必要研究一下日志管理系统发展历史，以及以日志管理系统发展趋势。"}
{"title": "Nmap备忘单：从探索到漏洞利用 Part1", "url": "https://www.freebuf.com/sectool/99956.html", "time": "2016-03-26", "level": "金币+5", "num_look": 1108130, "num_comment": 23, "author": "东二门陈冠希", "tags": ["WEB安全", "工具"], "text": "在侦查过程中，信息收集的初始阶段是扫描。"}
{"title": "探寻APT的化学本质与破解之术", "url": "https://www.freebuf.com/articles/neopoints/100004.html", "time": "2016-03-25", "level": "", "num_look": 235859, "num_comment": 4, "author": "SamSmith", "tags": ["观点"], "text": "对抗APT是场“持久战”，攻与防的对抗永远不会停止，APT 也不会就此消失，网络安全的攻防技术就是在攻与防的对立统一中在寻求突破"}
{"title": "HID高级攻击姿势：利用PowerShell脚本进行文件窃取", "url": "https://www.freebuf.com/articles/100026.html", "time": "2016-03-25", "level": "", "num_look": 483998, "num_comment": 16, "author": "mrzcpo", "tags": ["文章"], "text": "又到了期中考试了，我又要去偷答案了，一直发现远程下载运行exe的方式不太好，容易报毒所以这里打算用ps脚本。"}
{"title": "FBI高价悬赏通缉三名叙利亚黑客", "url": "https://www.freebuf.com/news/99955.html", "time": "2016-03-25", "level": "", "num_look": 185134, "num_comment": 1, "author": "FireFrank", "tags": ["资讯"], "text": "FBI将三名叙利亚电子军团成员以攻击罪名起诉并将其加入顶级通缉名单。"}
{"title": "一中国商人在美法院承认曾从事网络间谍活动", "url": "https://www.freebuf.com/news/99958.html", "time": "2016-03-25", "level": "金币+5", "num_look": 251749, "num_comment": 12, "author": "米雪儿", "tags": ["资讯"], "text": "2014年被捕的中国商人Su Bin日前承认与人合谋试图入侵美国国防承包商的计算机网络，窃取敏感的军事数据及军用飞机的机密数据传输回中国。"}
{"title": "Oracle发布紧急Java更新，修复关键漏洞", "url": "https://www.freebuf.com/news/99973.html", "time": "2016-03-25", "level": "金币+5", "num_look": 388033, "num_comment": 6, "author": "vul_wish", "tags": ["漏洞", "资讯"], "text": "日前，Oracle发布了紧急Java安全更新，修复了一个关键漏洞CVE-2016-0636。"}
{"title": "伪基站识别技巧（一）", "url": "https://www.freebuf.com/articles/terminal/99957.html", "time": "2016-03-25", "level": "", "num_look": 954263, "num_comment": 20, "author": "阿里安全", "tags": ["终端安全"], "text": "不知道为什么，感觉伪基站又有些卷土重来的趋势，不想废话，先分享几个伪基站识别技巧，供拍砖交流。"}
{"title": "3·15晚会报道的无人机是怎么被劫持的？", "url": "https://www.freebuf.com/articles/wireless/99962.html", "time": "2016-03-25", "level": "红色标题", "num_look": 857706, "num_comment": 22, "author": "腾讯安全平台部", "tags": ["无线安全", "终端安全"], "text": "在2015年GeekPwn的开场项目中，笔者利用一系列漏洞成功演示劫持了一架正在飞行的大疆精灵3代无人机。"}
{"title": "打狗棒法之：Cknife（C刀）自定义模式秒过安全狗（二）", "url": "https://www.freebuf.com/articles/web/99874.html", "time": "2016-03-25", "level": "现金奖励", "num_look": 431763, "num_comment": 18, "author": "melodyzx1", "tags": ["WEB安全"], "text": "使用Cknife绕过安全狗系列文章第二篇。"}
{"title": "Kitty：Python语言编写的Fuzzing框架", "url": "https://www.freebuf.com/sectool/99895.html", "time": "2016-03-25", "level": "", "num_look": 402556, "num_comment": 1, "author": "felix", "tags": ["工具"], "text": "Kitty是一款用Python语言编写的开源的模块化、可扩展的模糊测试框架。"}
{"title": "FBI破解iPhone可能只需1500美元，之前大费周章意欲何为？", "url": "https://www.freebuf.com/news/99921.html", "time": "2016-03-25", "level": "金币+5", "num_look": 320469, "num_comment": 7, "author": "米雪儿", "tags": ["数据安全", "资讯"], "text": "美国联邦调查局（FBI）已经成功寻求到破解iPhone手机的方法，因此本周早些时候就破解一事召开的法院听证会被无限期延迟。"}
{"title": "取代苹果公司，是谁在帮助FBI解锁iPhone？", "url": "https://www.freebuf.com/news/99876.html", "time": "2016-03-24", "level": "", "num_look": 355932, "num_comment": 6, "author": "哆啦A梦", "tags": ["终端安全", "资讯"], "text": "据以色列《新消息报》称，以色列移动取证软件公司Cellebrite正在协助美国FBI解锁一部有恐怖分子使用过的iPhone手机。而FBI为此支付了1.5万美元。"}
{"title": "白帽汇招聘安全工程师", "url": "https://www.freebuf.com/jobs/99849.html", "time": "2016-03-24", "level": "", "num_look": 642551, "num_comment": 125, "author": "白帽汇", "tags": ["安全招聘"], "text": "白帽汇安全招聘。"}
{"title": "Android应用安全开发之浅谈加密算法的坑", "url": "https://www.freebuf.com/articles/terminal/99868.html", "time": "2016-03-24", "level": "", "num_look": 342565, "num_comment": 10, "author": "阿里聚安全", "tags": ["终端安全"], "text": "Android开发中，难免会遇到需要加解密一些数据内容存到本地文件、或者通过网络传输到其他服务器和设备的问题。"}
{"title": "使用WinDbg调试Windows内核(二)", "url": "https://www.freebuf.com/articles/network/99856.html", "time": "2016-03-24", "level": "金币+5", "num_look": 373139, "num_comment": 1, "author": "老王隔壁的白帽子", "tags": ["网络安全"], "text": "本篇文章介绍了windbg调试内核的高级调试技巧。"}
{"title": "微软SQL Server透明数据加密（TDE）剖析及破解（上）", "url": "https://www.freebuf.com/articles/network/99831.html", "time": "2016-03-24", "level": "金币+5", "num_look": 435824, "num_comment": 1, "author": "FireFrank", "tags": ["安全管理", "网络安全"], "text": "本次调查开始于一个我和客户讨论：他们是否应该安装TDE。"}
{"title": "美国指责伊朗攻击大坝，“网络松鼠”暗暗窃喜", "url": "https://www.freebuf.com/news/99745.html", "time": "2016-03-24", "level": "", "num_look": 286628, "num_comment": 2, "author": "极客小默", "tags": ["安全管理", "文章"], "text": "网络末日战的故事里，中东地区国家入侵美国的水坝或电网，造成一些微妙的影响，就好像是好莱坞种族主义惊悚电影里的情节。"}
{"title": "台湾大选定向攻击案例研究", "url": "https://www.freebuf.com/articles/web/99687.html", "time": "2016-03-24", "level": "金币+5", "num_look": 357421, "num_comment": 6, "author": "鸢尾", "tags": ["WEB安全"], "text": "2016年1月，蔡英文当选为台湾首位女领导。在大选之前，据报道此次选举发生了一系列的网络威胁事件。"}
{"title": "这24款汽车可能被黑客开走", "url": "https://www.freebuf.com/news/99705.html", "time": "2016-03-24", "level": "金币+5", "num_look": 236053, "num_comment": 6, "author": "亲爱的兔子", "tags": ["漏洞", "资讯"], "text": "近年来，不少汽车盗窃案件的发生是因为有人利用一神秘装置接近通过无线钥匙开车门，并在很短的时间内打开车门开走汽车。"}
{"title": "谷歌紧急释放补丁，修复安卓系统高危提权漏洞（CVE-2015-1805）", "url": "https://www.freebuf.com/vuls/99715.html", "time": "2016-03-23", "level": "金币+5", "num_look": 337902, "num_comment": 14, "author": "米雪儿", "tags": ["漏洞", "终端安全"], "text": "谷歌发布了紧急安全补丁来修复影响Android操作系统的特权提升漏洞（CVE-2015-1805）。"}
{"title": "为动物争取权益：匿名者（Anonymous）公布日本旅游网数据", "url": "https://www.freebuf.com/news/99620.html", "time": "2016-03-23", "level": "金币+5", "num_look": 171132, "num_comment": 2, "author": "dawner", "tags": ["资讯"], "text": "一群自称KARMASEC的“匿名者”黑客组织表示，他们渗透进日本山口县旅游推广部的网站，并泄露部分数据。"}
{"title": "谁看了你的Instagram账户？又是谁盗取了你的密码？", "url": "https://www.freebuf.com/articles/web/99657.html", "time": "2016-03-23", "level": "", "num_look": 354654, "num_comment": 3, "author": "鸢尾", "tags": ["WEB安全"], "text": "移动应用程序目前已经成为最有效的攻击向量之一，这些网络罪犯最喜欢的一种方法便是流行应用程序的滥用。"}
{"title": "技术剖析韩剧《幽灵》中使用的隐写术", "url": "https://www.freebuf.com/articles/database/99504.html", "time": "2016-03-23", "level": "现金奖励", "num_look": 783075, "num_comment": 38, "author": "追影人", "tags": ["数据安全"], "text": "隐写术是信息隐藏的一个重要分支，在这篇文章中我们将学习数字图像的隐写技术。"}
{"title": "深度解读“短信拦截马”的黑产利益链", "url": "https://www.freebuf.com/articles/wireless/99702.html", "time": "2016-03-23", "level": "", "num_look": 760996, "num_comment": 11, "author": "瑞星", "tags": ["安全报告", "数据安全"], "text": "近期，我们接到多方用户电话，称安卓手机中毒，接到很多莫名其妙的陌生短信，短信内容中包含一个网址，点击后自动下载一个apk程序让用户安装。"}
{"title": "如何防护神器Mimikatz对域环境进行渗透", "url": "https://www.freebuf.com/articles/terminal/99547.html", "time": "2016-03-23", "level": "现金奖励", "num_look": 434257, "num_comment": 3, "author": "agui", "tags": ["安全管理", "系统安全"], "text": "在这篇文章中我们将学习如何防护神器Mimikatz对域环境进行渗透。"}
{"title": "丹麦设政府黑客学院，培育一支网络军队", "url": "https://www.freebuf.com/news/99664.html", "time": "2016-03-23", "level": "", "num_look": 184302, "num_comment": 5, "author": "简单", "tags": ["资讯"], "text": "上周，丹麦国家情报机构PET宣布计划成立一个丹麦黑客学院，旨在提升本国网络安全能力以及对抗外来的网络威胁。"}
{"title": "FBI曾要求加密服务商Lavabit监视斯诺登邮件", "url": "https://www.freebuf.com/news/99570.html", "time": "2016-03-23", "level": "", "num_look": 195297, "num_comment": 2, "author": "米雪儿", "tags": ["资讯"], "text": "最近，由于美国政府的一个失误，曝光了一份Lavabit案的法院文件显示：斯诺登曾被联邦调查局作为目标实施监视。"}
{"title": "苹果新手机刚发布，黑客大赛就悬赏10万美元破解iPhone", "url": "https://www.freebuf.com/news/others/99704.html", "time": "2016-03-22", "level": "", "num_look": 600417, "num_comment": 5, "author": "Sodagreen", "tags": ["周边", "活动"], "text": "一场手机安全极限挑战赛Pwn0rama亚太手机安全挑战赛将于3月23日在新加坡举行，组委会悬赏超过50万美元邀请全球黑客破解包括iPhone在内的十大流行手机。"}
{"title": "处理旧手机，99%的人都不知道的几招", "url": "https://www.freebuf.com/articles/terminal/99540.html", "time": "2016-03-22", "level": "", "num_look": 364108, "num_comment": 5, "author": "路由器", "tags": ["终端安全", "观点"], "text": "肾3，肾4，肾5，肾6，马上又要肾7了，更新换代的旧手机怎么办？"}
{"title": "打狗棒法之：Cknife（C刀）自定义模式秒过安全狗", "url": "https://www.freebuf.com/articles/web/99642.html", "time": "2016-03-22", "level": "现金奖励", "num_look": 1093271, "num_comment": 29, "author": "Chora", "tags": ["WEB安全", "系统安全"], "text": "在这篇文章中，我们将介绍一些Cknife的使用方法。"}
{"title": "惊：黑客居然可以看到正在做“羞羞的事”的你！", "url": "https://www.freebuf.com/articles/terminal/99611.html", "time": "2016-03-22", "level": "金币+10", "num_look": 472127, "num_comment": 15, "author": "FireFrank", "tags": ["终端安全"], "text": "喜欢爱爱的人要小心啦，联网性爱玩具很容易受到黑客攻击！黑客不仅可以远程控制性爱玩具，还能同时录制视频，将你打入地狱无法正常生活。"}
{"title": "苹果新品发布会为何特意提到iOS升级？", "url": "https://www.freebuf.com/news/99638.html", "time": "2016-03-22", "level": "金币+10", "num_look": 231746, "num_comment": 5, "author": "米雪儿", "tags": ["系统安全", "终端安全"], "text": "研究人员发现一个iOS零日漏洞，允许攻击者解密通过iMessage发送的照片和视频。"}
{"title": "黑客组织Buhtrap半年内成功攻击俄罗斯银行多达13次", "url": "https://www.freebuf.com/news/99551.html", "time": "2016-03-22", "level": "", "num_look": 204750, "num_comment": 1, "author": "亲爱的兔子", "tags": ["资讯"], "text": "在2015年8月至2016年2月间，黑客组织Buhtrap已经成功地对俄罗斯银行发起了13次网络攻击。"}
{"title": "技术分享：如何在PowerShell脚本中嵌入EXE文件", "url": "https://www.freebuf.com/articles/terminal/99631.html", "time": "2016-03-22", "level": "金币+10", "num_look": 475008, "num_comment": 7, "author": "xiaix", "tags": ["系统安全", "终端安全"], "text": "在这篇文章中我们将分享如何在PowerShell脚本中嵌入EXE文件。"}
{"title": "BetterCap：一个模块化的轻便的MiTM框架", "url": "https://www.freebuf.com/sectool/99607.html", "time": "2016-03-22", "level": "金币+10", "num_look": 442817, "num_comment": 5, "author": "felix", "tags": ["工具"], "text": "BetterCap是一个功能强大、模块化、轻便的MiTM框架，可以用来对网络开展各种类型的中间人攻击（Man-In-The-Middle）。"}
{"title": "使用WinDbg调试Windows内核(一)", "url": "https://www.freebuf.com/articles/web/99512.html", "time": "2016-03-22", "level": "金币+10", "num_look": 723386, "num_comment": 3, "author": "老王隔壁的白帽子", "tags": ["WEB安全", "网络安全"], "text": "如果可以检查操作系统的内部工作过程，那么将会是一种强大的能力。"}
{"title": "谷歌下架一款用于监控印度军队的聊天应用软件", "url": "https://www.freebuf.com/news/99541.html", "time": "2016-03-22", "level": "金币+10", "num_look": 202637, "num_comment": 1, "author": "寰者", "tags": ["终端安全", "资讯"], "text": "印度电视台CNN-IBN报道称，日前发现巴基斯坦正通过一款名为SmeshApp的Android APP来收集印度军方情报。"}
{"title": "孟加拉国银行被黑案：安全调查专家“失踪”之谜", "url": "https://www.freebuf.com/news/99498.html", "time": "2016-03-22", "level": "", "num_look": 270033, "num_comment": 5, "author": "dawner", "tags": ["资讯"], "text": "作为孟加拉国银行8100万美元盗窃案与媒体对话的代表人，34岁安全研究员Tanvir Hassan Zoha在指责孟加拉国央行官员在此案中的疏忽失职后，突然失踪。"}
{"title": "360安全专家刘健皓解读《2015汽车信息安全年度报告》", "url": "https://www.freebuf.com/articles/neopoints/99573.html", "time": "2016-03-21", "level": "", "num_look": 243724, "num_comment": 4, "author": "360安全", "tags": ["安全报告", "观点"], "text": "过去一年来，中国的车联网技术正从观望阶段，转变成高速建设阶段，各大车厂都开始了车联网系统的设计、规划与开发。"}
{"title": "BoxSoft WAV to MP3 Converter 软件漏洞分析（CVE-2015-7243）", "url": "https://www.freebuf.com/vuls/99560.html", "time": "2016-03-21", "level": "", "num_look": 237488, "num_comment": 4, "author": "聚锋实验室", "tags": ["漏洞"], "text": "BoxSoft WAV to MP3 Converter是一个100%免费功能强大的音频转换工具，可以批量的把WAV格式文件转换成高质量的MP3音频文件。"}
{"title": "留意你的电脑：内存条容易遭到恶意攻击", "url": "https://www.freebuf.com/news/99467.html", "time": "2016-03-21", "level": "", "num_look": 244445, "num_comment": 10, "author": "亲爱的兔子", "tags": ["漏洞", "资讯"], "text": "近日安全研究人员展示了一种新的Rowhammer攻击，利用该技术可攻击某些DDR4内存模块。"}
{"title": "解读2015年互联网UGC内容发展态势，安全事件频发", "url": "https://www.freebuf.com/articles/paper/99221.html", "time": "2016-03-21", "level": "", "num_look": 366954, "num_comment": 3, "author": "阿里聚安全", "tags": ["安全报告"], "text": "本文分享阿里巴巴《2015互联网安全年报》系列之四《2015内容安全年报》，希望帮助读者了解互联网UGC内容的安全管控状况。"}
{"title": "工具推荐：Cknife，跨平台版中国菜刀正式开源", "url": "https://www.freebuf.com/sectool/99461.html", "time": "2016-03-21", "level": "金币+10", "num_look": 1975581, "num_comment": 42, "author": "Chora", "tags": ["工具"], "text": "跨平台版中国菜刀Cknife正式开源！"}
{"title": "威胁情报基础：爬取、行走、分析（Part 1）", "url": "https://www.freebuf.com/articles/security-management/98950.html", "time": "2016-03-21", "level": "", "num_look": 410422, "num_comment": 7, "author": "SamSmith", "tags": ["安全管理"], "text": "本文旨在帮助对威胁情报感兴趣的人，理解威胁情报和情报分析基础。"}
{"title": "浅析通过电子邮件传递Locky勒索软件", "url": "https://www.freebuf.com/articles/network/99338.html", "time": "2016-03-21", "level": "金币+6", "num_look": 500311, "num_comment": 1, "author": "东二门陈冠希", "tags": ["网络安全"], "text": "Locky是通过垃圾邮件活动传播的一种新型的勒索软件，这个新的恶意软件具有类似于Dridex木马的特征。"}
{"title": "专访知名民间黑客洪流：未竟武侠梦，仗剑行天涯", "url": "https://www.freebuf.com/news/99441.html", "time": "2016-03-21", "level": "", "num_look": 415112, "num_comment": 23, "author": "T00ls安全", "tags": ["人物志", "资讯"], "text": "大学时，洪流一接触到电脑，便开始沉醉于网络，一醉不醒。"}
{"title": "希拉里·克林顿、奥巴马都钟爱的黑莓手机真的无懈可击吗？", "url": "https://www.freebuf.com/news/99487.html", "time": "2016-03-21", "level": "", "num_look": 224824, "num_comment": 6, "author": "简单", "tags": ["资讯"], "text": "近日，希拉里·克林顿请求获得一部和奥巴马总统一样的黑莓手机，但是NSA拒绝了她的这一请求。"}
{"title": "极客大讲堂：手把手教你用树莓派控制红绿灯", "url": "https://www.freebuf.com/geek/99483.html", "time": "2016-03-20", "level": "金币+6", "num_look": 539805, "num_comment": 15, "author": "极客小默", "tags": ["极客"], "text": "手把手教你如何通过树莓派来控制交通信号灯！"}
{"title": "银行大盗“Carbanak”木马攻击目标移至中东", "url": "https://www.freebuf.com/news/99391.html", "time": "2016-03-20", "level": "", "num_look": 228696, "num_comment": 1, "author": "亲爱的兔子", "tags": ["资讯"], "text": "近日，安全公司Proofpoint在收集了黑客组织Carbanak最新活动信息称，目前该组织的攻击目标正在转向中东金融行业高管。"}
{"title": "工具推荐：MobSF，一款开源移动安全测试框架", "url": "https://www.freebuf.com/sectool/99475.html", "time": "2016-03-19", "level": "金币+6", "num_look": 1908407, "num_comment": 35, "author": "寰者", "tags": ["工具", "系统安全"], "text": "移动安全框架 (MobSF) 是一个智能化、一体化的开源移动应用（Android / iOS）自动测试框架，能够对以上两种移动应用进行静态和动态分析。"}
{"title": "美国总统大选，黑客组织“匿名者”（Anonymous）也来凑热闹", "url": "https://www.freebuf.com/news/99168.html", "time": "2016-03-19", "level": "", "num_look": 243645, "num_comment": 5, "author": "米雪儿", "tags": ["资讯"], "text": ""}
{"title": "S2-029 Struts2 标签远程代码执行分析（含POC）", "url": "https://www.freebuf.com/vuls/99432.html", "time": "2016-03-18", "level": "", "num_look": 722797, "num_comment": 24, "author": "安恒信息安全研究院", "tags": ["漏洞"], "text": "Struts2标签库提供了主题、模板支持，极大地简化了视图页面的编写，而且，struts2的主题、模板都提供了很好的扩展性。"}
{"title": "Mousejack Hacking : 如何利用MouseJack进行物理攻击", "url": "https://www.freebuf.com/articles/terminal/97011.html", "time": "2016-03-18", "level": "红色标题", "num_look": 1017131, "num_comment": 38, "author": "漏洞盒子", "tags": ["终端安全", "视频"], "text": "利用mouseJack，黑客可对一百米范围内存在漏洞的无线键鼠进行嗅探甚至劫持，从而控制受害者电脑，向计算机中输入任何指令！"}
{"title": "使用AES-256加密算法的勒索软件SkidLocker分析", "url": "https://www.freebuf.com/articles/terminal/99153.html", "time": "2016-03-18", "level": "金币+6", "num_look": 266871, "num_comment": 1, "author": "东二门陈冠希", "tags": ["终端安全"], "text": "SkidLocker勒索软件使用AES-256加密算法，通过检索文件信息内容来加密不同类型的文件。"}
{"title": "极客DIY：如何利用树莓派提高睡眠质量？", "url": "https://www.freebuf.com/geek/99192.html", "time": "2016-03-18", "level": "金币+6", "num_look": 323308, "num_comment": 6, "author": "亲爱的兔子", "tags": ["极客"], "text": "众所周知睡眠不足会引发很多问题（身体、情绪等），那么怎么和树莓派有关系呢？"}
{"title": "工具推荐：Appie，轻便的Android集成渗透测试环境", "url": "https://www.freebuf.com/sectool/99140.html", "time": "2016-03-18", "level": "", "num_look": 462545, "num_comment": 11, "author": "1_1", "tags": ["工具"], "text": "Appie 是一个预配置好的软件包，可以运行在任何基于Windows的机器上作为Android渗透测试环境。"}
{"title": "Struts2 S2-029远程代码执行漏洞初探", "url": "https://www.freebuf.com/vuls/99234.html", "time": "2016-03-18", "level": "", "num_look": 603394, "num_comment": 19, "author": "阿里云誉反欺诈", "tags": ["WEB安全", "漏洞"], "text": "Struts2 S2-029远程代码执行漏洞分析"}
{"title": "Stagefright漏洞exp公布，数百万安卓手机仍受影响（CVE-2015-3864）", "url": "https://www.freebuf.com/news/99306.html", "time": "2016-03-18", "level": "红色标题", "num_look": 460032, "num_comment": 10, "author": "简单", "tags": ["漏洞", "资讯"], "text": "现如今以色列的安全团队称，他们已经写出了Stagefright漏洞的exp。"}
{"title": "IAT Hooking的一种安全实现方式", "url": "https://www.freebuf.com/articles/system/99141.html", "time": "2016-03-18", "level": "金币+6", "num_look": 414627, "num_comment": 10, "author": "felix", "tags": ["系统安全"], "text": "Hook导入表（IAT hooking）是一个文档齐全的拦截导入函数调用的技术。本文探究了一种能够绕过常规检测机制的IAT hooking实现方法。"}
{"title": "腾讯安全Sniper战队成为Pwn2Own史上首个“破解大师”", "url": "https://www.freebuf.com/news/99344.html", "time": "2016-03-18", "level": "", "num_look": 366280, "num_comment": 31, "author": "腾讯电脑管家", "tags": ["资讯"], "text": "黑客“世界杯”走了，黑客世界总冠军来了！"}
{"title": "渗透测试神器Burpsuite Pro v1.6.38（含下载）", "url": "https://www.freebuf.com/sectool/99127.html", "time": "2016-03-18", "level": "", "num_look": 980292, "num_comment": 27, "author": "legendsec", "tags": ["工具"], "text": "众所周知，Burp Suite是响当当的web应用程序渗透测试集成平台。"}
{"title": "为解锁iPhone，警长威胁要逮捕“无赖”蒂姆•库克", "url": "https://www.freebuf.com/news/98979.html", "time": "2016-03-18", "level": "", "num_look": 183979, "num_comment": 9, "author": "极客小默", "tags": ["资讯"], "text": "苹果不遵守法院命令解锁设备的行为引起了佛罗里达州警长的注意，他曾经威胁如果逮到机会一定会逮捕苹果CEO库克。"}
{"title": "在win 8.1和win 10上恢复bitlocker驱动器加密私钥", "url": "https://www.freebuf.com/articles/system/99206.html", "time": "2016-03-17", "level": "金币+6", "num_look": 378613, "num_comment": 4, "author": "鸢尾", "tags": ["系统安全"], "text": "如何在win 8.1和win 10上恢复bitlocker驱动器加密私钥呢？一起来通过这篇文章学习一下。"}
{"title": "中国黑客在Pwn2Own 2016上是怎样一种存在？", "url": "https://www.freebuf.com/news/99201.html", "time": "2016-03-17", "level": "红色标题", "num_look": 3157927, "num_comment": 23, "author": "明明知道", "tags": ["资讯"], "text": "Pwn2Own现已经成为奖金额最高的黑客大赛。作为安全界最受瞩目的赛事，今年Pwn2Own首次设立了“破解大师”荣誉称号，简直就是为亚洲人度身定制的！"}
{"title": "安天AVL联合猎豹首曝“多米诺”恶意应用市场APP", "url": "https://www.freebuf.com/articles/terminal/99244.html", "time": "2016-03-17", "level": "", "num_look": 241200, "num_comment": 1, "author": "AVLTeam", "tags": ["终端安全"], "text": "近期AVL移动安全和猎豹移动安全实验室共同截获一款Root病毒下载器。"}
{"title": "探索Flask/Jinja2中的服务端模版注入（二）", "url": "https://www.freebuf.com/articles/web/98928.html", "time": "2016-03-17", "level": "", "num_look": 495294, "num_comment": 3, "author": "鸢尾", "tags": ["WEB安全"], "text": "本文就来讲讲进一步研究Flask/Jinja2中的服务端模版注入获得的结果。"}
{"title": "恶意广告狂潮：美帝遭Angler Exploit侵袭种马", "url": "https://www.freebuf.com/articles/system/99159.html", "time": "2016-03-17", "level": "", "num_look": 248542, "num_comment": 1, "author": "dawner", "tags": ["数据安全", "系统安全"], "text": "在一些知名新闻网站、娱乐门户网站以及政治评论网站中，出现了大量被Angler Exploit进行恶意广告侵害的网友。"}
{"title": "如何在15分钟内利用Shodan进行企业安全审计？", "url": "https://www.freebuf.com/articles/security-management/99139.html", "time": "2016-03-17", "level": "金币+6", "num_look": 429502, "num_comment": 5, "author": "xiaix", "tags": ["企业安全", "安全管理"], "text": "本文我将讲述我是如何在十五分钟内利用Shodan对公司进行了一个简单的安全审查。"}
{"title": "SSLyze：快速全面的SSL安全扫描器", "url": "https://www.freebuf.com/sectool/99151.html", "time": "2016-03-17", "level": "金币+6", "num_look": 556389, "num_comment": 5, "author": "dawner", "tags": ["工具", "系统安全"], "text": "SSLyze是一个Python打造的工具，它可以分析我们用于连接某服务器的SSL配置。"}
{"title": "FireEye：恶意软件家族拥有共同的起源", "url": "https://www.freebuf.com/articles/terminal/99156.html", "time": "2016-03-17", "level": "", "num_look": 185115, "num_comment": 1, "author": "老王隔壁的白帽子", "tags": ["终端安全"], "text": "GM Bot是一款很繁杂的安卓恶意软件家族，2014年年末出现在俄罗斯的地下犯罪网络中。"}
{"title": "glibc库中rand函数的实现详解与预测手法", "url": "https://www.freebuf.com/articles/web/99093.html", "time": "2016-03-17", "level": "", "num_look": 320329, "num_comment": 6, "author": "YoungC", "tags": ["WEB安全"], "text": "glibc是GNU发布的libc库，即c运行库。glibc是linux系统中最底层的api，几乎其它任何运行库都会依赖于glibc。"}
{"title": "赛门铁克（Symantec）发布2016年2月威胁情报报告", "url": "https://www.freebuf.com/articles/network/99074.html", "time": "2016-03-17", "level": "", "num_look": 349213, "num_comment": 1, "author": "空白", "tags": ["安全报告", "网络安全"], "text": "2016年2月的最新报告显示：每125封电子邮件当中就有1封带有恶意软件。"}
{"title": "观点：全自动安全漏洞扫描器的低准确率与高性价比", "url": "https://www.freebuf.com/news/98981.html", "time": "2016-03-17", "level": "", "num_look": 201372, "num_comment": 4, "author": "极客小默", "tags": ["观点", "资讯"], "text": "在印度果阿的Nullcon安全会议上，Gibler为来自10个不同工业部门的100位NCC客户指定了一款不知名的全自动扫描器。"}
{"title": "法网恢恢：当年的iCloud艳照门涉案黑客，现已认罪伏法", "url": "https://www.freebuf.com/news/99115.html", "time": "2016-03-16", "level": "金币+6", "num_look": 393775, "num_comment": 9, "author": "米雪儿", "tags": ["资讯"], "text": ""}
{"title": "迈阿密风云：盗取信用卡真的只需要3秒吗？", "url": "https://www.freebuf.com/news/99004.html", "time": "2016-03-16", "level": "金币+6", "num_look": 263674, "num_comment": 1, "author": "亲爱的兔子", "tags": ["终端安全", "资讯"], "text": "ATM分离器已经出现多年，但下面文章要介绍的是一种改进的盗取信用卡手法。"}
{"title": "ar-drone：GitHub上劫持控制无人机的开源项目", "url": "https://www.freebuf.com/sectool/99010.html", "time": "2016-03-16", "level": "金币+6", "num_look": 345774, "num_comment": 5, "author": "vul_wish", "tags": ["工具"], "text": "AR Drone是一种价格实惠、功能完善的四轴飞行器，使用一种专有的固件，使用户可以通过官方的FreeFlight手机应用借助WIFI进行控制。"}
{"title": "美指责中国黑客涉嫌网络勒索，外交部：无稽之谈", "url": "https://www.freebuf.com/news/98933.html", "time": "2016-03-16", "level": "", "num_look": 208482, "num_comment": 9, "author": "简单", "tags": ["资讯"], "text": "四家安全公司对美国公司所遭遇的勒索软件攻击进行调查，发现黑客使用的攻击策略和工具与之前中国政府支持的网络入侵很相似。"}
{"title": "“3·15”的正确打开方式：黑客在晚会上PWN了什么？", "url": "https://www.freebuf.com/news/topnews/99013.html", "time": "2016-03-16", "level": "红色标题", "num_look": 489160, "num_comment": 14, "author": "FB独家", "tags": ["头条"], "text": "从今以后，黑客只分两种：上过“315”和没上过的......"}
{"title": "支付宝招聘安全研发工程师", "url": "https://www.freebuf.com/jobs/99025.html", "time": "2016-03-16", "level": "", "num_look": 293600, "num_comment": 13, "author": "路由器", "tags": ["安全招聘"], "text": "支付宝（www.alipay.com）成立于2004年，是中国最多人选用的第三方网上支付平台。"}
{"title": "某杀毒软件的crash dump 分析", "url": "https://www.freebuf.com/articles/system/99021.html", "time": "2016-03-16", "level": "现金奖励", "num_look": 326387, "num_comment": 4, "author": "nickchang", "tags": ["系统安全"], "text": "最近一次升级以后，杀毒软件经常莫名其妙的崩溃。把crash dump问题和环境反馈给客服，客服称他们认为该崩溃是和Citrix冲突导致的。"}
{"title": "探索Flask/Jinja2中的服务端模版注入（一）", "url": "https://www.freebuf.com/articles/web/98619.html", "time": "2016-03-16", "level": "金币+5", "num_look": 660488, "num_comment": 6, "author": "鸢尾", "tags": ["WEB安全"], "text": "作为一名经常使用Flask框架进行开发的人来说，James的研究促使我下定决心去研究在使用Flask/Jinja2框架进行应用开发时服务端模版注入的一些细节。"}
{"title": "jo：通过shell命令创建JSON", "url": "https://www.freebuf.com/sectool/98569.html", "time": "2016-03-16", "level": "金币+5", "num_look": 343318, "num_comment": 3, "author": "FireFrank", "tags": ["工具"], "text": "一起来看如何通过shell命令来创建JSON吧"}
{"title": "安卓恶意软件GMBot 2.0版本出现：售价比原版本贵三倍", "url": "https://www.freebuf.com/news/98651.html", "time": "2016-03-16", "level": "", "num_look": 248210, "num_comment": 248210, "author": "亲爱的兔子", "tags": ["终端安全", "资讯"], "text": "在过去的几周，IBM X-Force团队检测到了第二个版本的GM Bot银行木马病毒。"}
{"title": "漏洞预警：Apache Struts 2 远程代码执行漏洞(CVE-2016-0785)", "url": "https://www.freebuf.com/news/98992.html", "time": "2016-03-15", "level": "红色标题", "num_look": 1334044, "num_comment": 24, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "目前Apache官方已发布公告，该漏洞危险级别为高危。不过目前暂无漏洞细节。"}
{"title": "Pwn2Own大赛前瞻：Chrome难度第一，VMware最神秘", "url": "https://www.freebuf.com/news/98932.html", "time": "2016-03-15", "level": "", "num_look": 249117, "num_comment": 10, "author": "buddy", "tags": ["资讯"], "text": "李世石已经用一场胜利捍卫了人类荣誉。世界最顶尖的黑客，也该让机器尝尝人类的厉害了。"}
{"title": "抗议警察枪击无辜少年，美帝警方和机场网站又遭DDoS", "url": "https://www.freebuf.com/news/98868.html", "time": "2016-03-15", "level": "金币+5", "num_look": 349737, "num_comment": 6, "author": "dawner", "tags": ["网络安全", "资讯"], "text": "黑客宣称，对盐湖警方、机场实施了一系列DDoS攻击，为了抗议盐湖城警方对一名少年枪击多次导致其昏迷。"}
{"title": "Cyborg Hawk Linux：一款用于渗透测试的Linux发行版", "url": "https://www.freebuf.com/sectool/98853.html", "time": "2016-03-15", "level": "金币+5", "num_look": 702340, "num_comment": 22, "author": "felix", "tags": ["工具"], "text": "Cyborg Hawk可以用于网络安全和审计以及数字取证。它还包含多种工具，适合于移动安全和无线网络安全测试。"}
{"title": "五角大楼官员：无人机已用于境内监控", "url": "https://www.freebuf.com/news/98864.html", "time": "2016-03-15", "level": "", "num_look": 145100, "num_comment": 2, "author": "亲爱的兔子", "tags": ["资讯"], "text": "近日出现了美国国防部检察长一份报告，在报告中透露军用无人机已经被用于非军事用途。"}
{"title": "利用“数学建模-图论模型”进行自动化内网渗透测试", "url": "https://www.freebuf.com/articles/network/98870.html", "time": "2016-03-15", "level": "", "num_look": 429684, "num_comment": 7, "author": "斯诺登", "tags": ["网络安全"], "text": "活动目录域中的权限提升是大多数入侵者与内网管理员斗争过程中非常重要的一部分。"}
{"title": "浅谈移动APP攻击", "url": "https://www.freebuf.com/articles/terminal/98722.html", "time": "2016-03-15", "level": "金币+5", "num_look": 490157, "num_comment": 12, "author": "东二门陈冠希", "tags": ["终端安全"], "text": "在我为一个企业演示什么是真正的安全威胁的时候，就想着能不能写一个工具可以不用通过root权限就能访问文件系统，于是BackHack就诞生了。"}
{"title": "岂安科技产品和技术中心诚意邀请您的加入", "url": "https://www.freebuf.com/jobs/98424.html", "time": "2016-03-15", "level": "", "num_look": 251573, "num_comment": 4, "author": "岂安科技", "tags": ["安全招聘"], "text": "岂安科技，专注于为互联网企业提供业务风控解决方案。"}
{"title": "WireEdit ：一款编辑网络数据包的可视化编辑工具", "url": "https://www.freebuf.com/sectool/98695.html", "time": "2016-03-15", "level": "金币+8", "num_look": 439202, "num_comment": 11, "author": "亲爱的兔子", "tags": ["工具"], "text": "WireEdit 是一个用来编辑网络数据包的可视化编辑工具，同时也是一个跨平台的网络数据包编辑器。"}
{"title": "FIT 2016集锦 | 知道创宇CEO 赵伟：安全云与大数据，安全新挑战的解决之道", "url": "https://www.freebuf.com/news/topnews/98814.html", "time": "2016-03-15", "level": "", "num_look": 315275, "num_comment": 4, "author": "FB独家", "tags": ["头条", "视频"], "text": "2016 FreeBuf 互联网安全创新大会“产业创新论坛”上，知道创宇CEO赵伟发表《安全云与大数据，安全新挑战的解决之道》主题演讲。"}
{"title": "从 RSA 热词看威胁情报在 NGFW 上的落地", "url": "https://www.freebuf.com/articles/system/98790.html", "time": "2016-03-14", "level": "", "num_look": 371166, "num_comment": 5, "author": "网康科技", "tags": ["系统安全", "网络安全"], "text": "当今NGFW必须备五大核心要素以对抗新型安全威胁，其中一条就是外部的安全智能。"}
{"title": "恶意软件帮助黑客完成史上最大银行劫案？", "url": "https://www.freebuf.com/news/98737.html", "time": "2016-03-14", "level": "", "num_look": 190732, "num_comment": 6, "author": "米雪儿", "tags": ["资讯"], "text": "调查人员怀疑孟加拉央行被盗案背后的攻击者使用恶意软件来收集美联储抢劫案的相关信息。"}
{"title": "苏宁安全招聘WEB、移动安全专家", "url": "https://www.freebuf.com/jobs/98740.html", "time": "2016-03-14", "level": "", "num_look": 256079, "num_comment": 12, "author": "路由器", "tags": ["安全招聘"], "text": "苏宁易购，是苏宁电器旗下新一代B2C网上购物平台。"}
{"title": "Mac勒索软件KeRanger其实是Linux.Encoder的一个变种", "url": "https://www.freebuf.com/news/98724.html", "time": "2016-03-14", "level": "金币+8", "num_look": 219173, "num_comment": 3, "author": "老王隔壁的白帽子", "tags": ["终端安全", "资讯"], "text": "这个Transmission的BT更新客户端木马KeRanger开创了多个先例——首例影响Mac OS X的勒索软件，首列通过合法开发者签署的更新软件来扩散以及首例跨平台的勒索软件。"}
{"title": "技术分享：逆向三星S6的调制解调器", "url": "https://www.freebuf.com/articles/terminal/98495.html", "time": "2016-03-14", "level": "金币+8", "num_look": 244274, "num_comment": 3, "author": "FireFrank", "tags": ["终端安全"], "text": "在这片文章中，我们会着重探讨三星S6调制解调器SM-G920F。"}
{"title": "反DDoS安全公司Staminus遭网络攻击，敏感数据泄露", "url": "https://www.freebuf.com/news/98642.html", "time": "2016-03-14", "level": "", "num_look": 202601, "num_comment": 4, "author": "亲爱的兔子", "tags": ["资讯"], "text": "一伙不明身份的黑客攻击了DDoS攻击防护公司Staminus，并从其服务器上窃取了敏感信息。"}
{"title": "Clusterd：专门渗透应用服务器的开源工具包", "url": "https://www.freebuf.com/sectool/98723.html", "time": "2016-03-14", "level": "金币+8", "num_look": 346276, "num_comment": 10, "author": "老王隔壁的白帽子", "tags": ["工具"], "text": "Clusterd是一款专门用于渗透应用服务器开源工具包，可以自动化的识别服务器指纹、探测并且自动对服务器进行攻击。"}
{"title": "进击的比特币勒索者Locky", "url": "https://www.freebuf.com/articles/network/98730.html", "time": "2016-03-14", "level": "红色标题", "num_look": 676019, "num_comment": 7, "author": "阿里安全", "tags": ["网络安全"], "text": "2015年年末，基于邮件的比特币勒索(VVV)在中国开始猖獗，尤其以12月最为严重。"}
{"title": "技术分享：WIFI钓鱼的入门姿势", "url": "https://www.freebuf.com/articles/wireless/98532.html", "time": "2016-03-14", "level": "金币+8", "num_look": 1862290, "num_comment": 26, "author": "东二门陈冠希", "tags": ["无线安全"], "text": "该实验先是搭建一个测试环境，然后创建一个假的无线接入点，把网络连接连接到假的接入点并且强迫用户连接假的无线点。"}
{"title": "微软“WebDAV”提权漏洞（cve-2016-0051）初探", "url": "https://www.freebuf.com/vuls/98486.html", "time": "2016-03-14", "level": "", "num_look": 314138, "num_comment": 2, "author": "聚锋实验室", "tags": ["漏洞"], "text": "本文通过基础性的研究，大概的探究下了漏洞的修补前后和执行的过程，供大家参考。"}
{"title": "传奇黑客McAfee：人生就是个大写的“作死”", "url": "https://www.freebuf.com/news/98475.html", "time": "2016-03-14", "level": "红色标题", "num_look": 694372, "num_comment": 12, "author": "哆啦A梦", "tags": ["人物志", "资讯"], "text": "对于一些狂人而言，人生就是从这里飞到那里，养新的狗，泡新的妞，过你永远无法想象的生活。"}
{"title": "美军“明星战机”F-35出现雷达系统漏洞", "url": "https://www.freebuf.com/news/98593.html", "time": "2016-03-13", "level": "金币+8", "num_look": 205884, "num_comment": 2, "author": "亲爱的兔子", "tags": ["漏洞", "资讯"], "text": "据报道F-35“闪电Ⅱ”（F-35 Lightning II）战斗机被爆其系统上出现了问题。"}
{"title": "芝加哥警方抓捕了一名63岁地铁黑客", "url": "https://www.freebuf.com/news/98596.html", "time": "2016-03-13", "level": "", "num_look": 425776, "num_comment": 24, "author": "简单", "tags": ["资讯"], "text": "芝加哥便衣警察今日抓捕了一名63岁的老大爷，原因是这位大爷经常在地铁上用干扰设备干扰乘客的手机。"}
{"title": "向中国菜刀致敬！中国蚁剑：一款跨平台的开源网站管理工具", "url": "https://www.freebuf.com/sectool/98681.html", "time": "2016-03-13", "level": "红色标题", "num_look": 2261343, "num_comment": 42, "author": "蚁逅", "tags": ["工具"], "text": "这篇文章我们将推荐一款和菜刀功能类似的工具：蚁剑，和菜刀不同的是它能跨平台，最重要的一点：开源！"}
{"title": "如何理解堆和堆溢出漏洞的利用？", "url": "https://www.freebuf.com/vuls/98404.html", "time": "2016-03-13", "level": "金币+10", "num_look": 930870, "num_comment": 11, "author": "老王隔壁的白帽子", "tags": ["漏洞"], "text": "这篇文章细致的描述了堆并且会教你如何编写基于堆溢出漏洞的利用。"}
{"title": "美国防部设立新项目邀请专家应对国家安全", "url": "https://www.freebuf.com/news/98663.html", "time": "2016-03-13", "level": "", "num_look": 135848, "num_comment": 135848, "author": "亲爱的兔子", "tags": ["资讯"], "text": "DARPA是美国国防部重大科技攻关项目的组织、协调、管理机构和军用高技术预研工作的技术管理部门"}
{"title": "安恒信息招聘安全工程师", "url": "https://www.freebuf.com/jobs/98503.html", "time": "2016-03-12", "level": "", "num_look": 290266, "num_comment": 13, "author": "h3ll0", "tags": ["安全招聘"], "text": "杭州安恒信息技术有限公司(DBAPPSecurity)是由国家千人计划专家范渊先生于2007年创办，是中国领先的信息安全产品和服务解决方案提供商。"}
{"title": "卡巴斯基发现迄今为止最具威胁性的安卓木马Triada", "url": "https://www.freebuf.com/articles/terminal/98592.html", "time": "2016-03-12", "level": "金币+10", "num_look": 348846, "num_comment": 8, "author": "米雪儿", "tags": ["终端安全"], "text": "卡巴斯基实验室专家检测出一种名为Triada的最新安卓木马，是至今检测出的最具有威胁性的移动木马病毒。"}
{"title": "预警：兵风暴（Pawn Storm）网络间谍活动正在转移目标", "url": "https://www.freebuf.com/news/98451.html", "time": "2016-03-12", "level": "", "num_look": 136131, "num_comment": 1, "author": "亲爱的兔子", "tags": ["资讯"], "text": "近日趋势科技发布报告称，网络间谍活动“Pawn Storm”正在转移目标，最新的目标瞄准了土耳其高级官员。"}
{"title": "SpagoBI的远程代码执行漏洞分析（需要认证权限）", "url": "https://www.freebuf.com/news/98450.html", "time": "2016-03-12", "level": "", "num_look": 235247, "num_comment": 4, "author": "常运", "tags": ["漏洞", "资讯"], "text": "通常情况下，我并不会在补丁更新之前就公布漏洞信息。但是在这一个案例中，该漏洞需要认证权限才可利用，所以利用起来还是比较困难的。"}
{"title": "工具推荐：Inspeckage，安卓动态分析工具", "url": "https://www.freebuf.com/sectool/98607.html", "time": "2016-03-12", "level": "金币+10", "num_look": 572296, "num_comment": 6, "author": "vul_wish", "tags": ["工具"], "text": "Inspeckage是一个用于提供Android应用程序动态分析的工具。通过对Android API的函数使用hook技术，帮助用户了解应用程序在运行时的行为。"}
{"title": "两个什么样的漏洞，可让十亿安卓手机被获取Root权限？", "url": "https://www.freebuf.com/news/98470.html", "time": "2016-03-12", "level": "", "num_look": 367362, "num_comment": 9, "author": "简单", "tags": ["漏洞", "终端安全"], "text": "数十亿的安卓设备上发现安全漏洞，攻击者可通过简单的操作获取root访问权限。"}
{"title": "阿里发布2015物联网安全年报，威胁攻击日益凸显", "url": "https://www.freebuf.com/articles/terminal/98336.html", "time": "2016-03-11", "level": "", "num_look": 276009, "num_comment": 2, "author": "阿里聚安全", "tags": ["安全报告", "终端安全"], "text": "物联网设备让我们的生活变得便利的同时，也给黑客提供了新的土壤，所暴露出的安全问题越来越多，被关注度也与日俱增。"}
{"title": "互联网业务安全之通用安全风险模型", "url": "https://www.freebuf.com/articles/security-management/98257.html", "time": "2016-03-11", "level": "", "num_look": 432667, "num_comment": 5, "author": "阿里云誉反欺诈", "tags": ["安全管理"], "text": "业务安全从流程设计维度可划分为账户体系安全、交易体系安全、支付体系安全、用户信息存储安全。"}
{"title": "恐怖组织伊斯兰国（ISIS）数据遭泄露，2.2万名成员个人信息全部曝光", "url": "https://www.freebuf.com/news/98541.html", "time": "2016-03-11", "level": "金币+10", "num_look": 830548, "num_comment": 12, "author": "寰者", "tags": ["资讯"], "text": "事件的起源来自于一个“对组织失望”的ISIS战士，而他也最终决定离开这个恐怖组织。同时在离开前，他带走了大约22000名恐怖分子的个人登记表扫描件。"}
{"title": "技术分享：通过Kerberos Unconstrained Delegation获取到域管理员", "url": "https://www.freebuf.com/articles/terminal/98530.html", "time": "2016-03-11", "level": "金币+10", "num_look": 389044, "num_comment": 8, "author": "老王隔壁的白帽子", "tags": ["系统安全", "终端安全"], "text": "用常用的方法貌似没办法找到到域管理员身份认证的位置。通过这篇文章来学习一下作者是如何解决这个问题的。"}
{"title": "从云安全角度看RSA 2016美国大会", "url": "https://www.freebuf.com/articles/terminal/98459.html", "time": "2016-03-11", "level": "", "num_look": 217603, "num_comment": 2, "author": "阿里云安全", "tags": ["终端安全"], "text": "今年RSA 2016美国的主题是“Connect to Protect”  ，这是一个内涵过于丰富以至于有些隐晦的话题。"}
{"title": "PyYAML 对象类型解析导致的命令执行问题", "url": "https://www.freebuf.com/articles/system/98539.html", "time": "2016-03-11", "level": "", "num_look": 385535, "num_comment": 3, "author": "知道创宇", "tags": ["系统安全", "网络安全"], "text": "本文仅记录了PyCon 2015上@Tom Eastman所讲的关于 Python 序列化格式的安全议题中所提到的 Python PyYAML 模块在处理 YAML 格式数据时所存在的问题。"}
{"title": "万达电商招聘安全人才", "url": "https://www.freebuf.com/jobs/98412.html", "time": "2016-03-11", "level": "", "num_look": 360983, "num_comment": 21, "author": "lion_00", "tags": ["安全招聘"], "text": "万达电商招聘安全人才，小伙伴赶快砸简历去吧！"}
{"title": "工具推荐：ATSCAN，功能强大的Perl脚本扫描器", "url": "https://www.freebuf.com/sectool/98515.html", "time": "2016-03-11", "level": "金币+15", "num_look": 422754, "num_comment": 17, "author": "felix", "tags": ["工具"], "text": "使用perl语言编写的开源的扫描器，功能丰富强大，除了基本的tcp和udp端口扫描之外，还可以搜索wordpress、joomla等网站并进行口令猜解等攻击。"}
{"title": "开发指南之Git命令的最佳实践技巧", "url": "https://www.freebuf.com/sectool/98396.html", "time": "2016-03-11", "level": "金币+15", "num_look": 338696, "num_comment": 6, "author": "FireFrank", "tags": ["工具"], "text": "在开发中我们常常会使用到git，那么git的使用都有哪些技巧呢？一起来看这篇文章。"}
{"title": "苹果高管公开反对iPhone解锁提议，美国政府将与苹果公司对簿公堂", "url": "https://www.freebuf.com/news/98522.html", "time": "2016-03-11", "level": "金币+15", "num_look": 297099, "num_comment": 3, "author": "FireFrank", "tags": ["资讯"], "text": "苹果互联网和服务首席警告说：如果FBI对iPhone制造商采取法律行动，那么\"安全的时代即将结束\"。"}
{"title": "门户应用Apache Jetspeed 2.3.0及早期版本：远程代码执行漏洞分析", "url": "https://www.freebuf.com/vuls/98407.html", "time": "2016-03-10", "level": "金币+15", "num_look": 327650, "num_comment": 2, "author": "dawner", "tags": ["WEB安全", "漏洞"], "text": "作为我个人“友情检测开源软件安全”的项目之一，我准备玩玩Apache Jetspeed 2（v2.30）。"}
{"title": "技术剖析Potato提权原理", "url": "https://www.freebuf.com/sectool/98316.html", "time": "2016-03-10", "level": "现金奖励", "num_look": 615467, "num_comment": 27, "author": "tahf", "tags": ["工具", "系统安全"], "text": "前一阵子收录了一个名为Potato的提权工具，发现该工具提权的姿势与以往工具不太一样，而且与WPAD代理有关，于是展开测试和分析。"}
{"title": "孟加拉央行被黑客盗一亿美元，要起诉美联储", "url": "https://www.freebuf.com/news/98406.html", "time": "2016-03-10", "level": "", "num_look": 197054, "num_comment": 3, "author": "米雪儿", "tags": ["资讯"], "text": "不明身份的黑客已经从美国联邦储备银行纽约分行的孟加拉银行帐户盗取一亿美元。"}
{"title": "云存储平台&服务安全分析报告", "url": "https://www.freebuf.com/news/97925.html", "time": "2016-03-10", "level": "红色标题", "num_look": 400830, "num_comment": 4, "author": "简单", "tags": ["头条", "安全报告"], "text": "本报告展示了一种新型的攻击，我们称之为“Man in the cloud（MITC）”，专门攻击各云存储平台。"}
{"title": "百度自动驾驶事业部招聘网络安全工程师", "url": "https://www.freebuf.com/jobs/97914.html", "time": "2016-03-10", "level": "", "num_look": 251332, "num_comment": 4, "author": "Joanna", "tags": ["安全招聘"], "text": "百度无人驾驶汽车和自动驾驶自行车都是 IDL（深度学习研究院）负责的项目。"}
{"title": "俄罗斯黑市竟兜售“会讲话”的赎金勒索软件", "url": "https://www.freebuf.com/news/98146.html", "time": "2016-03-10", "level": "金币+15", "num_look": 271829, "num_comment": 5, "author": "dawner", "tags": ["工具", "系统安全"], "text": "想象一下这样的场景，你所有重要的文件都被勒索赎金软件加密。紧接着，你收到该软件的提示，需要付钱才能解锁那些文件。"}
{"title": "揭开异常工作的恶意文档的秘密", "url": "https://www.freebuf.com/news/98275.html", "time": "2016-03-10", "level": "金币+15", "num_look": 198840, "num_comment": 1, "author": "东二门陈冠希", "tags": ["资讯"], "text": "有时会出现一些让人感到陌生的恶意文档，这类恶意文档不能被工具或者沙盒分析。本文将对其进行深入研究。"}
{"title": "长城网际聚锋实验室招贤纳士啦", "url": "https://www.freebuf.com/jobs/98345.html", "time": "2016-03-10", "level": "", "num_look": 410831, "num_comment": 25, "author": "聚锋实验室", "tags": ["安全招聘"], "text": "中电长城网际系统应用有限公司招聘各类安全工程师。"}
{"title": "勒索软件PadCrypty域名生成算法分析", "url": "https://www.freebuf.com/articles/system/98403.html", "time": "2016-03-10", "level": "金币+15", "num_look": 230792, "num_comment": 2, "author": "东二门陈冠希", "tags": ["系统安全"], "text": "PadCrypt是一款勒索软件的名字，MalwareHunterTeam在推特上提到了PadCrypt version 2.2.86.1的域名生成算法（DGA）。"}
{"title": "2016 RSA议题：云计算当道，企业该如何阻止恶意软件？", "url": "https://www.freebuf.com/articles/98381.html", "time": "2016-03-10", "level": "", "num_look": 156011, "num_comment": 1, "author": "SamSmith", "tags": ["文章"], "text": "有数据表明，储存于云端应用中的每100个文件中就有4个含恶意软件。"}
{"title": "曾拿美国前总统开刀的黑客要被引渡回美国了", "url": "https://www.freebuf.com/news/98308.html", "time": "2016-03-10", "level": "", "num_look": 169973, "num_comment": 3, "author": "晶颜123", "tags": ["资讯"], "text": ""}
{"title": "战胜棋王后，人工智能是否可以颠覆安全？", "url": "https://www.freebuf.com/news/98249.html", "time": "2016-03-09", "level": "红色标题", "num_look": 576374, "num_comment": 20, "author": "哆啦A梦", "tags": ["资讯"], "text": "在昨天的赛前发布会上，谷歌董事长施密特表示，输赢都是人类的胜利。"}
{"title": "Acunetix Web Vulnerability Scanner 10.5发布（含破解版下载）", "url": "https://www.freebuf.com/sectool/98310.html", "time": "2016-03-09", "level": "红色标题", "num_look": 1797699, "num_comment": 27, "author": "init5", "tags": ["工具"], "text": "Acunetix Web Vulnerability Scanner 10.5发布,快过来下载吧。"}
{"title": "“舞毒蛾”木马演变报告", "url": "https://www.freebuf.com/articles/wireless/98307.html", "time": "2016-03-09", "level": "", "num_look": 391432, "num_comment": 5, "author": "360手机卫士", "tags": ["安全报告", "无线安全"], "text": "近期，360移动安全团队监测到一款云控木马正在集中爆发。该木马家族最早于2015年2月被360移动安全团队捕获，目前已经累计样本超过1.2万个。"}
{"title": "某世界500强全球云服务招聘资深攻防类安全专家、安全产品研发技术专家", "url": "https://www.freebuf.com/jobs/98170.html", "time": "2016-03-09", "level": "", "num_look": 282518, "num_comment": 17, "author": "ayazero", "tags": ["安全招聘"], "text": "公司定位全球性云服务，几百亿至千亿美金业务规模，完全的互联网氛围，兼具体量和成长速度，体量决定安全的舞台有多大，能做的事情有多少。"}
{"title": "硝烟再起：韩国称朝鲜黑客攻击韩方政府官员智能机", "url": "https://www.freebuf.com/news/98300.html", "time": "2016-03-09", "level": "金币+7", "num_look": 235602, "num_comment": 6, "author": "米雪儿", "tags": ["终端安全", "资讯"], "text": "韩国国家情报院表示：在二月下旬和三月上旬间，来自朝鲜的网络间谍从韩国主要官员的智能手机中窃取了大量敏感数据和文本消息等。"}
{"title": "技术分享：如何用Python和PyInstaller编写Windows恶意代码", "url": "https://www.freebuf.com/vuls/98273.html", "time": "2016-03-09", "level": "金币+7", "num_look": 324136, "num_comment": 7, "author": "老王隔壁的白帽子", "tags": ["漏洞"], "text": "本文主要展示的是通过使用python和PyInstalle来构建恶意软件的一些poc。"}
{"title": "技术分享：CBC中Padding Oracle攻击的再解读，如何攻破HTTPS？", "url": "https://www.freebuf.com/vuls/98156.html", "time": "2016-03-09", "level": "", "num_look": 456257, "num_comment": 4, "author": "Tony Lee", "tags": ["漏洞", "系统安全"], "text": "Padding Oracle攻击再解读，详解如何攻破HTTPS……"}
{"title": "51信用卡管家招聘安全工程师", "url": "https://www.freebuf.com/jobs/96945.html", "time": "2016-03-09", "level": "", "num_look": 212519, "num_comment": 13, "author": "51信用卡管家", "tags": ["安全招聘"], "text": "杭州恩牛网络技术有限公司，成立于2012年5月，首创了帮助用户一键智能管理信用卡账单的“51信用卡管家”APP..."}
{"title": "黑了Facebook账户，白帽子成功拿到一万五千美元的奖励", "url": "https://www.freebuf.com/news/98274.html", "time": "2016-03-09", "level": "金币+7", "num_look": 341664, "num_comment": 10, "author": "老王隔壁的白帽子", "tags": ["资讯"], "text": "通过一个简单的不需要用户交互的漏洞就能黑掉所有Facebook用户的账号，使得我能查看被黑用户的敏感信息。"}
{"title": "Hacking Team RCS植入安装程序分析", "url": "https://www.freebuf.com/articles/terminal/98281.html", "time": "2016-03-09", "level": "", "num_look": 250017, "num_comment": 1, "author": "vul_wish", "tags": ["系统安全", "终端安全"], "text": "近期，有安全人员发文称，Hacking Team 的RCS植入安装程序中使用了苹果的加密二进制库，我们一起来看分析。"}
{"title": "Python爬虫开发（五）：反爬虫措施以及爬虫编写注意事项", "url": "https://www.freebuf.com/news/topnews/98188.html", "time": "2016-03-09", "level": "现金奖励", "num_look": 843108, "num_comment": 9, "author": "VillanCh", "tags": ["WEB安全", "头条"], "text": "在关于爬虫技术点的一系列文章完成之后，想到由一个读者在评论区留言希望了解一下爬虫和反爬虫的内容，因此准备就这个问题进行一些介绍。"}
{"title": "Microsoft OAuth接口XSS，影响用户账号安全", "url": "https://www.freebuf.com/articles/web/98006.html", "time": "2016-03-09", "level": "金币+7", "num_look": 284395, "num_comment": 2, "author": "东二门陈冠希", "tags": ["WEB安全"], "text": "Wesley Wineberg在微软OAuth 认证接口发现的一个CSRF漏洞的同时也激起了我能在这个地方再找到一个漏洞的信心（作者谜一样的自信），因此我打算深入分析一下这个认证接口。"}
{"title": "文字幽灵：黑客通过Word文件便可盗取你的账户余额", "url": "https://www.freebuf.com/news/98165.html", "time": "2016-03-09", "level": "金币+7", "num_look": 218726, "num_comment": 3, "author": "亲爱的兔子", "tags": ["漏洞", "资讯"], "text": "近日有安全研究人员曝光了一种新的word文档病毒，利用该病毒攻击者可以窃取你银行账户里的现金。"}
{"title": "“挖洞联盟”团队赛：我们与漏洞的距离，还差一个你！", "url": "https://www.freebuf.com/fevents/98028.html", "time": "2016-03-08", "level": "", "num_look": 280723, "num_comment": 9, "author": "漏洞盒子", "tags": ["活动"], "text": "你与我们的距离，只差加入“挖洞联盟（LOH）”"}
{"title": "用于渗透测试WordPress的Ruby框架：WordPress Exploit Framework", "url": "https://www.freebuf.com/sectool/98142.html", "time": "2016-03-08", "level": "金币+7", "num_look": 419889, "num_comment": 9, "author": "felix", "tags": ["WEB安全", "工具"], "text": "这个Ruby框架包含一些能够渗透测试WordPress网站和系统的模块，用户也可以自己开发模块扩展其功能。"}
{"title": "【FreeBuf视频】《安全大咖说》专访阿里云云计算安全事业部资深总监肖力", "url": "https://www.freebuf.com/news/topnews/98169.html", "time": "2016-03-08", "level": "", "num_look": 2315306, "num_comment": 8, "author": "FB视频", "tags": ["人物志", "头条"], "text": "肖力，阿里云云计算安全事业部资深总监。2005年进入阿里巴巴，是阿里巴巴第一位安全工程师，2009年加入阿里云计算公司。"}
{"title": "惊！黑客可隔空从手机中窃取账号密码！", "url": "https://www.freebuf.com/news/98157.html", "time": "2016-03-08", "level": "金币+7", "num_look": 525459, "num_comment": 13, "author": "简单", "tags": ["终端安全", "资讯"], "text": "安全研究员们每周都会新发现一些iOS平台的exp或者安卓平台的exp，但是最近有安全团队发现一个exp可同时利用iOS和安卓两个平台。"}
{"title": "针对印度外交和军事的网络间谍活动：Operation Transparent Tribe", "url": "https://www.freebuf.com/news/98020.html", "time": "2016-03-08", "level": "金币+7", "num_look": 322300, "num_comment": 1, "author": "米雪儿", "tags": ["网络安全", "资讯"], "text": "Operation Transparent Tribe 是由Darien Huss发起的，通过APT手段攻击印度的外交和军事组织，近期被Proof point公司的研究人员所发现。"}
{"title": "青藤云安全招募安全研究员", "url": "https://www.freebuf.com/jobs/98034.html", "time": "2016-03-08", "level": "", "num_look": 242092, "num_comment": 9, "author": "青藤云安全", "tags": ["安全招聘"], "text": "青藤云安全是一家专注于互联网企业安全的新兴公司，团队主要由互联网研发和安全专家组成。"}
{"title": "“洋葱狗”潜伏3年终曝光，定期偷袭能源及交通行业", "url": "https://www.freebuf.com/articles/network/98151.html", "time": "2016-03-08", "level": "", "num_look": 520814, "num_comment": 5, "author": "360安全", "tags": ["安全管理", "网络安全"], "text": "360天眼实验室的追日团队日前披露称，一个名为“洋葱狗”（OnionDog）的黑客组织长期对亚洲国家的能源、交通等基础行业进行网络渗透和情报窃取。"}
{"title": "大话数据库SQL注入的N种姿势", "url": "https://www.freebuf.com/articles/web/98119.html", "time": "2016-03-08", "level": "", "num_look": 603081, "num_comment": 7, "author": "安华金和", "tags": ["WEB安全"], "text": "在数据库漏洞中最为常见的漏洞类型是SQL注入漏洞。数据库安全专家结合多年的实践结果总结出了数据库注入的分类分享给大家，以便大家对SQL注入型漏洞有一个更加全面的了解。"}
{"title": "Deepviz SDK 的 Python 接口浅析", "url": "https://www.freebuf.com/articles/network/98011.html", "time": "2016-03-08", "level": "金币+5", "num_look": 328679, "num_comment": 3, "author": "东二门陈冠希", "tags": ["网络安全"], "text": "今天是我们最后一次发布我们的Python SDK 链接库来支持用户快速的在他们已有的项目和平台中使用我们的Deepviz技术。"}
{"title": "阿里发布2015移动安全漏洞年报", "url": "https://www.freebuf.com/vuls/98052.html", "time": "2016-03-08", "level": "", "num_look": 329649, "num_comment": 2, "author": "阿里聚安全", "tags": ["安全报告", "漏洞"], "text": "2015是不平凡的一年，各界媒体对移动应用的漏洞关注度也越来越高，漏洞的产生不仅带来用户设备与信息的安全影响，也给企业带来业务或声誉上的损失。"}
{"title": "Mac用户请注意：首款勒索软件已经现身", "url": "https://www.freebuf.com/news/98072.html", "time": "2016-03-08", "level": "", "num_look": 333905, "num_comment": 3, "author": "SamSmith", "tags": ["终端安全", "资讯"], "text": "KeRanger是第一款被发现针对OS系统的勒索软件，它一旦运行，便会对用户设备进行加密，不仅仅用户正常使用，还对用户发出支付1个比特币（大约2600人民币）的勒索要求。"}
{"title": "当地铁遇上黑客，会有什么故事发生？", "url": "https://www.freebuf.com/articles/terminal/98026.html", "time": "2016-03-07", "level": "红色标题", "num_look": 940687, "num_comment": 20, "author": "1ight", "tags": ["数据安全", "终端安全"], "text": "本文的目的是分享地铁系统的渗透测试思路，而不是成为地铁非法入侵犯罪的呈堂证据。——爱因斯坦"}
{"title": "使用Deepviz帮助恶意软件研究", "url": "https://www.freebuf.com/articles/network/97860.html", "time": "2016-03-07", "level": "金币+5", "num_look": 308819, "num_comment": 1, "author": "东二门陈冠希", "tags": ["网络安全"], "text": "这篇文章我们想展示我们的SDK（REST API的简单集合）能做什么，如何将它整合到你的事件响应工作流中，比如整合到分析流程。"}
{"title": "安全研究员是如何破解智能机指纹锁的？（含报告及演示视频）", "url": "https://www.freebuf.com/news/97981.html", "time": "2016-03-07", "level": "金币+5", "num_look": 257173, "num_comment": 3, "author": "亲爱的兔子", "tags": ["漏洞", "资讯"], "text": "来自密歇根州立大学计算机科学与工程学院的Kai Cao和Anil K. Jain可在15分钟或更短时间破解智能机。"}
{"title": "Evolution（进化）： 谭晓生的RSAC 2016随笔", "url": "https://www.freebuf.com/articles/neopoints/98044.html", "time": "2016-03-07", "level": "", "num_look": 396107, "num_comment": 2, "author": "360安全", "tags": ["企业安全", "安全管理"], "text": "RSA大会无疑是网络安全行业最重要的会议之一，是年度安全产品大检阅，喜欢特立独行的安全圈人士当然少不了拿RSA调侃。"}
{"title": "金山云诚聘安全研发工程师", "url": "https://www.freebuf.com/jobs/97938.html", "time": "2016-03-07", "level": "", "num_look": 201936, "num_comment": 8, "author": "金山云", "tags": ["安全招聘"], "text": "金山云是金山集团旗下控股公司，依托金山集团26年的深厚技术积累，以业内领先的用户体验和服务端技术，为用户和企业提供国内领军级云服务产品。"}
{"title": "【后续跟进】隔墙有耳：利用电磁信号窃取目标信息项目代码已开源", "url": "https://www.freebuf.com/news/97822.html", "time": "2016-03-07", "level": "金币+5", "num_look": 329431, "num_comment": 4, "author": "亲爱的兔子", "tags": ["资讯"], "text": ""}
{"title": "Drown跨协议攻击TLS漏洞分析", "url": "https://www.freebuf.com/vuls/97879.html", "time": "2016-03-07", "level": "", "num_look": 497156, "num_comment": 6, "author": "百度安全", "tags": ["漏洞"], "text": "北京时间 2016年3月2日，OpenSSL官方发布了新的安全公告。公告中提及修复了一个高危漏洞——DROWN跨协议攻击TLS漏洞。百度云安全威胁管理团队联合百度安全应急响应中心第一时间对事件触发应急响应和全网感知，深度分…"}
{"title": "苹果公司K.O.美国司法部，不提供后门", "url": "https://www.freebuf.com/news/97676.html", "time": "2016-03-07", "level": "", "num_look": 148522, "num_comment": 6, "author": "简单", "tags": ["资讯"], "text": "周一，联邦法官与司法部进行了一场辩论，结果很出人意料，联邦法官们支持苹果公司。"}
{"title": "WordPress 自定义内容类型管理插件（CCTM）存在后门，可窃取管理员账号密码", "url": "https://www.freebuf.com/articles/web/97990.html", "time": "2016-03-07", "level": "金币+5", "num_look": 470718, "num_comment": 2, "author": "寰者", "tags": ["WEB安全", "数据安全"], "text": "Sucuri安全团队研究人员近日指出WordPress一款插件（自定义内容管理）CCTM存在后门。"}
{"title": "千元电子保险箱居然这样就被打开了", "url": "https://www.freebuf.com/news/97996.html", "time": "2016-03-07", "level": "金币+5", "num_look": 377559, "num_comment": 9, "author": "亲爱的兔子", "tags": ["漏洞", "资讯"], "text": "随着电子保险柜的普及，目前已经有越来越多的人开始重视电子保险柜的安全性，最近有安全研究人员曝光了一种破解电子保险柜的方法。"}
{"title": "NetreSec谈天朝运营商数据包注入攻击", "url": "https://www.freebuf.com/articles/network/97984.html", "time": "2016-03-06", "level": "金币+15", "num_look": 641411, "num_comment": 16, "author": "xiaix", "tags": ["网络安全"], "text": "我们之前曾发过关于数据包注入攻击的博客，今天我们还想跟大家分享一些来自真实世界的包注入攻击情报。"}
{"title": "Flexera FlexNet Publisher中基于栈的缓冲区溢出漏洞分析（CVE-2015-8277）", "url": "https://www.freebuf.com/vuls/97467.html", "time": "2016-03-06", "level": "", "num_look": 217484, "num_comment": 3, "author": "vul_wish", "tags": ["漏洞"], "text": "近日，安全人员在Flexera FlexNet Publisher(License Manager)中发现了一个基于栈的缓冲区溢出漏洞。"}
{"title": "360端游终极火力“隐身”、“秒杀”等漏洞解析", "url": "https://www.freebuf.com/vuls/97234.html", "time": "2016-03-06", "level": "现金奖励", "num_look": 339671, "num_comment": 18, "author": "CoolCmd", "tags": ["漏洞"], "text": "一哥们因为股票被套，用插件玩终极火力解闷，奈何水平太菜光有透视还是被虐，请我帮他整点杀手锏，于是逆向分析之。"}
{"title": "最新研究表明比特币安全性令人堪忧", "url": "https://www.freebuf.com/news/97730.html", "time": "2016-03-05", "level": "", "num_look": 238030, "num_comment": 12, "author": "亲爱的兔子", "tags": ["资讯"], "text": "你现在还对比特币交易有意向吗？如果你对比特币交易感兴趣，那么请阅读下文吧，相信对你会很有帮助。"}
{"title": "Darkhotel APT强势回归：第一个目标锁定中国电信", "url": "https://www.freebuf.com/news/97842.html", "time": "2016-03-05", "level": "", "num_look": 252919, "num_comment": 9, "author": "简单", "tags": ["资讯"], "text": "Darkhotel APT组织又回来了，重返后的第一个目标就是中国和朝鲜通信公司的高管们。"}
{"title": "知识技能瞬间点满？现代科学的突破？", "url": "https://www.freebuf.com/news/97863.html", "time": "2016-03-05", "level": "", "num_look": 248844, "num_comment": 7, "author": "dawner", "tags": ["极客", "资讯"], "text": "或许很多人都幻想过，自己不需要做任何努力，就能学习到新技能或知识。"}
{"title": "DTD/XXE 攻击笔记分享", "url": "https://www.freebuf.com/articles/web/97833.html", "time": "2016-03-05", "level": "金币+15", "num_look": 969079, "num_comment": 6, "author": "xiaix", "tags": ["WEB安全"], "text": "当评估基于 XML 服务的安全性时，不能忘了基于的 DTD 的攻击，例如：XML外部实体注入攻击(XXE)。"}
{"title": "技术分享：几种常见的JavaScript混淆和反混淆工具分析实战", "url": "https://www.freebuf.com/articles/web/97945.html", "time": "2016-03-05", "level": "金币+15", "num_look": 1507708, "num_comment": 5, "author": "xiaix", "tags": ["WEB安全"], "text": "在这篇文章里，我们将分享几种常见的 JavaScript 混淆和反混淆工具。"}
{"title": "亚马逊移除了设备加密功能：肯定没和苹果商量过", "url": "https://www.freebuf.com/news/97895.html", "time": "2016-03-04", "level": "", "num_look": 245617, "num_comment": 2, "author": "SamSmith", "tags": ["数据安全", "终端安全"], "text": "正当苹果公司与FBI因设备加密问题展开激战正酣，另一科技巨头亚马逊则反其道行之，在Fire平板最新系统中移除了设备加密功能。"}
{"title": "不是闹鬼，是病毒！全球首个Golem（傀儡）病毒感染数万手机", "url": "https://www.freebuf.com/vuls/97710.html", "time": "2016-03-04", "level": "", "num_look": 339001, "num_comment": 22, "author": "猎豹移动安全实验室", "tags": ["漏洞", "终端安全"], "text": "3月2日，猎豹移动安全实验室发现一枚新型安卓木马，名为Golem（傀儡），是Ghost Push （幽灵推）的变种病毒。"}
{"title": "基于用户行为动态变化的内部威胁检测方法", "url": "https://www.freebuf.com/articles/system/97703.html", "time": "2016-03-04", "level": "现金奖励", "num_look": 495941, "num_comment": 7, "author": "木千之", "tags": ["安全管理", "系统安全"], "text": "今天我们给大家介绍一个降低主动检测误报率的方法，该方法考虑了用户行为的变化，从而建立了一个动态的分类器。"}
{"title": "猴赛雷！RSA 大会徽章扫描应用程序爆出漏洞", "url": "https://www.freebuf.com/news/97835.html", "time": "2016-03-04", "level": "金币+15", "num_look": 175880, "num_comment": 6, "author": "米雪儿", "tags": ["资讯"], "text": "BLUE BOX公司的安全研究人员发现，RSA2016大会上使用的徽章扫描APP存在一个硬编码的默认密码。"}
{"title": "Hacking Team针对Mac的恶意软件代码分析", "url": "https://www.freebuf.com/articles/terminal/97864.html", "time": "2016-03-04", "level": "", "num_look": 214502, "num_comment": 3, "author": "vul_wish", "tags": ["终端安全"], "text": "为了了解该恶意软件的原理和功能，有安全人员对HackingTeam使用的新的后门和病毒植入程序进行了深入的分析。"}
{"title": "国产WEB扫描器北极熊使用技巧", "url": "https://www.freebuf.com/sectool/97865.html", "time": "2016-03-04", "level": "", "num_look": 565067, "num_comment": 25, "author": "hyc66", "tags": ["工具"], "text": "北极熊扫描器到目前为止已经度过了3个年头，作者一直在学习中，坚持更新软件，改进程序，修正BUG，那么北极熊扫描器这款软件怎么玩？作为国产WEB扫描器他的优点在哪里？"}
{"title": "如何找到含有特定字符串的恶意软件样本？", "url": "https://www.freebuf.com/articles/network/97734.html", "time": "2016-03-04", "level": "金币+15", "num_look": 407252, "num_comment": 1, "author": "东二门陈冠希", "tags": ["网络安全"], "text": "查找恶意样本中的特定字符串是很有用的，比如你有可能寻找到那些针对不同目标的却具有相似代码的恶意样本。本文会对这一点进行详细描述。"}
{"title": "ATM僵尸：第一款窃取以色列银行金钱的木马", "url": "https://www.freebuf.com/news/97735.html", "time": "2016-03-04", "level": "", "num_look": 161977, "num_comment": 2, "author": "FireFrank", "tags": ["资讯"], "text": "2015年11月，卡巴斯基实验室的研究人员发现了一种银行木马-ATM僵尸，它被认为是第一款能够从以色列银行窃取金钱的恶意软件。"}
{"title": "ATM黑客全球狂卷3.6亿，面临近250年刑期", "url": "https://www.freebuf.com/news/97789.html", "time": "2016-03-04", "level": "金币+6", "num_look": 264780, "num_comment": 6, "author": "亲爱的兔子", "tags": ["数据安全", "资讯"], "text": "去年夏天，一名土耳其公民Ercan Findikoglu被引渡到美国，而目前，他将面临着纽约法官提出的18项罪名指控。"}
{"title": "深度剖析幽灵电子书：一双窥视安全人员的无形之眼", "url": "https://www.freebuf.com/articles/database/97821.html", "time": "2016-03-03", "level": "红色标题", "num_look": 1102099, "num_comment": 52, "author": "瑞星", "tags": ["安全管理", "数据安全"], "text": "2016年2月26日，一个网络安全相关的QQ群内，一名用户分享了一份名为“网络安全宝典.chm”的电子书供大家下载。"}
{"title": "美军首次邀请黑客“攻陷五角大楼”", "url": "https://www.freebuf.com/news/97798.html", "time": "2016-03-03", "level": "", "num_look": 313111, "num_comment": 10, "author": "SamSmith", "tags": ["安全管理", "资讯"], "text": "美国国防部宣布邀请数千名经过审核的黑客参与下月举行的五角大楼漏洞奖励计划。但......参与者必须是美国公民。T_T"}
{"title": "乐视云诚招安全英才", "url": "https://www.freebuf.com/jobs/97810.html", "time": "2016-03-03", "level": "", "num_look": 237330, "num_comment": 16, "author": "乐视安全", "tags": ["安全招聘"], "text": "2014年1月27日，乐视网与乐视控股双方共同投资，正式成立“乐视云计算有限公司”。"}
{"title": "SSCTF线上赛解题报告Part 3（解密和溢出）", "url": "https://www.freebuf.com/news/topnews/97556.html", "time": "2016-03-03", "level": "现金奖励", "num_look": 396313, "num_comment": 8, "author": "lyuchen65", "tags": ["头条", "网络安全"], "text": "第二届SSCTF大赛上周落下帷幕，本系列是最终排名第三的Nu1L_XCTF团队带来的解题报告。"}
{"title": "坚决不给政府WhatsApp数据：Facebook拉美副总裁被捕", "url": "https://www.freebuf.com/articles/database/97742.html", "time": "2016-03-03", "level": "金币+6", "num_look": 294636, "num_comment": 7, "author": "dawner", "tags": ["数据安全", "观点"], "text": "Apple并不是唯一承受法院命令压力的科技公司，Facebook也面临着类似的窘境。"}
{"title": "OpenSSL CVE-2016-0800 和 CVE-2016-0703 漏洞修复细节拾趣", "url": "https://www.freebuf.com/vuls/97727.html", "time": "2016-03-03", "level": "", "num_look": 358375, "num_comment": 5, "author": "360安全", "tags": ["漏洞"], "text": "我们在今天的内部运维修复中发现了个有趣的现象或者说尝试，我们想去确定禁止不安全的加密套件会对今天的两个高危漏洞有什么影响。"}
{"title": "勒索软件 “Locky”深度分析", "url": "https://www.freebuf.com/articles/terminal/97704.html", "time": "2016-03-03", "level": "", "num_look": 515098, "num_comment": 15, "author": "金山安全", "tags": ["终端安全"], "text": "金山安全反病毒实验室采集到Locky样本，分析发现勒索提示可以显示中文，可见此次勒索事件与以往“国外中招，中国躺枪”不同，犯罪集团的矛头开始指向中国用户。"}
{"title": "一个罕见的MSSQL注入漏洞案例", "url": "https://www.freebuf.com/vuls/97545.html", "time": "2016-03-03", "level": "金币+6", "num_look": 450331, "num_comment": 15, "author": "xiaix", "tags": ["数据安全", "漏洞"], "text": "这里作者准备分享一个在去年Google赏金计划中发现的相当罕见漏洞，也是作者在整个渗透测试生涯中唯一一次遇到的。"}
{"title": "10个问题帮您厘清什么是CTF", "url": "https://www.freebuf.com/fevents/97519.html", "time": "2016-03-03", "level": "", "num_look": 401057, "num_comment": 9, "author": "cindy", "tags": ["活动"], "text": "Capture The Flag（简称CTF），直译为“夺旗赛”，起源于1996年举办的DEF CON全球黑客大会，最早是交流安全技术的重要途径。"}
{"title": "火星探测器软件的开源库被恶意利用", "url": "https://www.freebuf.com/news/97668.html", "time": "2016-03-03", "level": "金币+6", "num_look": 238903, "num_comment": 5, "author": "亲爱的兔子", "tags": ["漏洞", "资讯"], "text": "近日Palo Alto Networks发布报告称火星探测器软件的开源库被恶意利用。"}
{"title": "SSCTF线上赛解题报告Part2（杂项部分&Web）", "url": "https://www.freebuf.com/news/topnews/97511.html", "time": "2016-03-02", "level": "现金奖励", "num_look": 392397, "num_comment": 4, "author": "lyuchen65", "tags": ["WEB安全", "头条"], "text": "第二届SSCTF大赛上周落下帷幕，本系列是最终排名第三的Nu1L_XCTF团队带来的解题报告。"}
{"title": "Jenkins之Java反序列化漏洞分析（CVE-2016-0792）", "url": "https://www.freebuf.com/vuls/97659.html", "time": "2016-03-02", "level": "金币+6", "num_look": 459984, "num_comment": 2, "author": "vul_wish", "tags": ["漏洞"], "text": "Jenkins近日修复了一个可通过低权限用户调用API服务致使的命令执行漏洞：低权限用户通过构造一个恶意的XML文档并发送至服务端接口，使服务端解析时调用API执行外部命令。"}
{"title": "2015 Android 恶意软件威胁报告（下）：Android勒索软件和SMS木马造成的威胁日益严峻", "url": "https://www.freebuf.com/articles/security-management/97544.html", "time": "2016-03-02", "level": "金币+6", "num_look": 348008, "num_comment": 2, "author": "FireFrank", "tags": ["安全报告", "安全管理"], "text": "一些非常流行的全球性的恶意软件家族在下半年期间被报道涉及通过勒索软件、SMS发送应用和木马窃取设备数据。"}
{"title": "FIT 2016集锦 | Hack Demo：银行卡之偷天换日", "url": "https://www.freebuf.com/news/topnews/97646.html", "time": "2016-03-02", "level": "红色标题", "num_look": 914890, "num_comment": 21, "author": "FB独家", "tags": ["头条", "视频"], "text": "在FIT 互联网安全创新大会上，安全圈第一帅黑客、360独角兽团队Unicorn Team负责人杨卿与两位同事现场演绎了攻击者是如何在不接触的情况下，1秒钟盗取银行卡信息！"}
{"title": "安卓版百度浏览器远程代码执行漏洞分析", "url": "https://www.freebuf.com/vuls/97607.html", "time": "2016-03-02", "level": "金币+6", "num_look": 371076, "num_comment": 9, "author": "dawner", "tags": ["漏洞", "系统安全"], "text": "国外安全研究员发现百度浏览器安卓版存在远程代码执行漏洞，一起通过本文来看一下对该漏洞的分析。"}
{"title": "OpenSSL又出新漏洞，超过1100万https站点受影响", "url": "https://www.freebuf.com/vuls/97608.html", "time": "2016-03-02", "level": "金币+10", "num_look": 1081275, "num_comment": 26, "author": "常运", "tags": ["漏洞"], "text": "攻击者可以利用DROWN来对目标服务器进行中间人攻击，受影响的网站还包括雅虎、新浪以及阿里巴巴等大型网站在内。"}
{"title": "阿里安全发布2015移动安全病毒年报", "url": "https://www.freebuf.com/articles/terminal/97563.html", "time": "2016-03-02", "level": "", "num_look": 261517, "num_comment": 4, "author": "阿里聚安全", "tags": ["安全报告", "终端安全"], "text": "根据阿里移动安全的分析统计，2015年移动恶意代码数量和用户感染量虽然呈现出一定程度的下降趋势，但全年仍有18%的设备感染过病毒。"}
{"title": "Web版勒索软件CTB-Locker PHP源码现身GitHub", "url": "https://www.freebuf.com/news/97605.html", "time": "2016-03-02", "level": "金币+10", "num_look": 288005, "num_comment": 6, "author": "寰者", "tags": ["WEB安全", "资讯"], "text": "勒索软件CTB-Locker出现其Web演化版本，可感染网页站点。据分析，其编码为采用PHP编写，目前源码已被托管至GitHub上。"}
{"title": "腾讯社交网络事业群安全中心招聘安全岗位", "url": "https://www.freebuf.com/jobs/96926.html", "time": "2016-03-02", "level": "", "num_look": 191364, "num_comment": 2, "author": "腾讯SNG安全中心", "tags": ["安全招聘"], "text": "腾讯公司成立于1998年11月， 是目前中国最大的互联网综合服务提供商之一，也是中国服务用户最多的互联网企业之一。"}
{"title": "我是如何在谷歌协作社区（GWC）中发现反射型、存储型、DOM型漏洞的？", "url": "https://www.freebuf.com/vuls/97463.html", "time": "2016-03-02", "level": "金币+10", "num_look": 235549, "num_comment": 3, "author": "东二门陈冠希", "tags": ["漏洞"], "text": "Google Work Connect是一个由系统、应用管理员和合作伙伴组成的社区系统。不久之前，我在GWC社区系统发现了反射型、存储型、DOM型的XSS。"}
{"title": "安全研究人员发现 Hacking Team 新开发不易察觉的Mac恶意软件", "url": "https://www.freebuf.com/news/97551.html", "time": "2016-03-02", "level": "金币+10", "num_look": 380825, "num_comment": 2, "author": "极客小默", "tags": ["WEB安全", "安全管理"], "text": "研究者在HackingTeam上发现了新开发的Mac恶意软件，这项发现促使了投机活动。"}
{"title": "囧：微软增强减灾体验工具（EMET）可使自己失效", "url": "https://www.freebuf.com/news/97451.html", "time": "2016-03-02", "level": "", "num_look": 190661, "num_comment": 1, "author": "晶颜123", "tags": ["系统安全", "资讯"], "text": "FireEye两名安全研究人员已经找到一种方法，通过利用Microsoft的增强减灾体验工具（EMET）可以破解工具本身。"}
{"title": "国外安全研究员：中国ISP将用户的合法流量劫持至恶意（广告/恶意软件）站点", "url": "https://www.freebuf.com/news/97497.html", "time": "2016-03-01", "level": "金币+10", "num_look": 803768, "num_comment": 51, "author": "常运", "tags": ["资讯"], "text": "国外安全人员透露：中国ISP（互联网服务提供商）正在将用户的合法通信流量重定向至加载了恶意软件和广告的恶意网络站点。"}
{"title": "SSCTF线上赛解题报告Part1（逆向部分）", "url": "https://www.freebuf.com/news/topnews/97432.html", "time": "2016-03-01", "level": "现金奖励", "num_look": 307607, "num_comment": 12, "author": "lyuchen65", "tags": ["头条"], "text": "第二届SSCTF大赛上周落下帷幕，本系列是最终排名第三的Nu1L_XCTF团队带来的解题报告。"}
{"title": "【FreeBuf视频】《安全大咖说》专访IBM大中华区移动互联、信息安全、物联网技术总经理林育震", "url": "https://www.freebuf.com/video/97366.html", "time": "2016-03-01", "level": "红色标题", "num_look": 425453, "num_comment": 3, "author": "FB视频", "tags": ["人物志", "视频"], "text": "林育震，IBM大中华区移动互联、信息安全、物联网技术总经理，IBM全球技术理事、IBM 全球技术学院院士、全球杰出工程师，并且领导多个大中华区技术团队。"}
{"title": "从《2015年中国互联网安全报告》看安全趋势发展", "url": "https://www.freebuf.com/articles/paper/97469.html", "time": "2016-03-01", "level": "", "num_look": 290602, "num_comment": 6, "author": "kaduo521", "tags": ["安全报告"], "text": "360发布了《2015年中国互联网安全报告》，报告从恶意程序、钓鱼网站、骚扰电话、垃圾短信、网络诈骗、网络安全几年部分分析了2015年我国互联网安全的整体情况。"}
{"title": "OSX SIP机制的“那些事”", "url": "https://www.freebuf.com/articles/system/97411.html", "time": "2016-03-01", "level": "现金奖励", "num_look": 597907, "num_comment": 5, "author": "熊猫正正", "tags": ["系统安全"], "text": "OSX是苹果公司为Mac系列产品开发的专属操作系统，是第一个基于FreeBSD系统采用面向对象操作系统。"}
{"title": "在恶意软件的宏中插入8KB单个命令行", "url": "https://www.freebuf.com/articles/network/97214.html", "time": "2016-03-01", "level": "", "num_look": 336022, "num_comment": 2, "author": "东二门陈冠希", "tags": ["网络安全"], "text": "“几天前，有人给我了一个奇怪的恶意宏样本，这个样本无法被在线的沙盒和普通工具检测到。”"}
{"title": "饿了么安全团队诚邀请您的加入", "url": "https://www.freebuf.com/jobs/97453.html", "time": "2016-03-01", "level": "", "num_look": 359224, "num_comment": 18, "author": "路由器", "tags": ["安全招聘"], "text": "饿了么 是中国专业的网上订餐平台。公司创立于2009年4月。"}
{"title": "Python爬虫开发（四）：动态加载页面的解决方案与爬虫代理", "url": "https://www.freebuf.com/news/topnews/97275.html", "time": "2016-03-01", "level": "现金奖励", "num_look": 1181461, "num_comment": 28, "author": "VillanCh", "tags": ["WEB安全", "头条"], "text": "作者在本系列文章开头就说了会提供动态加载网页的解决方案，在这篇文章里提出了这个解决方案，用来解决以前我们没有办法的问题。"}
{"title": "绿盟科技带你看 RSA 2016 创新沙盒", "url": "https://www.freebuf.com/news/topnews/97349.html", "time": "2016-03-01", "level": "", "num_look": 271350, "num_comment": 1, "author": "绿盟科技", "tags": ["头条"], "text": "RSA大会的“创新沙盒”评选活动，可以算的上安全界的“奥斯卡”，每年的入选企业会成为本年度安全创新技术风向标，往往在下一轮的收购热潮中。"}
{"title": "Porn clicker木马再次来袭，影响Google Play数百款应用", "url": "https://www.freebuf.com/articles/terminal/97149.html", "time": "2016-03-01", "level": "", "num_look": 189563, "num_comment": 3, "author": "vul_wish", "tags": ["终端安全"], "text": "近日ESET的安全人员在Google Play应用商店中发现数百款应用感染了Porn clicker木马。"}
{"title": "直击RSA：2016 创意沙盒入围企业以及网络安全发展趋势前瞻", "url": "https://www.freebuf.com/news/topnews/97205.html", "time": "2016-02-29", "level": "现金奖励", "num_look": 266600, "num_comment": 4, "author": "晶颜123", "tags": ["头条", "观点"], "text": "全球最具影响力的网络安全展会 RSA 2016 将于2月29日在美国旧金山召开，本届大会的主题为“连接安全”(Connect to Protect)。"}
{"title": "Python爬虫开发（三）：数据存储以及多线程", "url": "https://www.freebuf.com/news/topnews/97288.html", "time": "2016-02-29", "level": "现金奖励", "num_look": 833830, "num_comment": 11, "author": "VillanCh", "tags": ["WEB安全", "头条"], "text": "本文我们就两个方面来讨论如何改进我们的爬虫：数据存储和多线程，当然我承认这是为我们以后要讨论的一些东西做铺垫。"}
{"title": "2016宏病毒分析及预防报告(1-2月)", "url": "https://www.freebuf.com/articles/terminal/97263.html", "time": "2016-02-29", "level": "", "num_look": 287459, "num_comment": 3, "author": "安全狗团队", "tags": ["安全报告", "终端安全"], "text": "笔者对近期的一些主流安全事件中涉及的宏病毒技术的整理研究。宏病毒出没，务必小心！"}
{"title": "极客DIY：简易安装魔镜大合集，总有一款适合你", "url": "https://www.freebuf.com/geek/97233.html", "time": "2016-02-29", "level": "金币+6", "num_look": 1077978, "num_comment": 9, "author": "亲爱的兔子", "tags": ["极客"], "text": "智能镜子已经不再是什么新鲜的事情了，但接下来介绍的“魔镜”成本比过去同期的项目作品要低的很多，同时安装起来也轻松的很多。"}
{"title": "2015 Android 恶意软件威胁报告（上）：Android 勒索软件和 SMS 木马造成的威胁日益严峻", "url": "https://www.freebuf.com/articles/terminal/97276.html", "time": "2016-02-29", "level": "金币+6", "num_look": 287588, "num_comment": 2, "author": "FireFrank", "tags": ["安全报告", "安全管理"], "text": "勒索软件在过去几年中一直困扰着Windows PC，但最近，勒索软件的平台已经不局限于Windows系统，它的魔爪已经伸向了Linux和Android。"}
{"title": "PowerPoint 自定义操作上传恶意payload", "url": "https://www.freebuf.com/articles/network/97211.html", "time": "2016-02-29", "level": "金币+6", "num_look": 323588, "num_comment": 2, "author": "xiaix", "tags": ["网络安全"], "text": "在对最近的网络钓鱼攻击进行分析时我们发现，攻击者开始使用 PowerPoint 自定义操作来代替宏触发恶意 Payload。"}
{"title": "Windows平台shellcode开发入门（三）", "url": "https://www.freebuf.com/articles/system/97215.html", "time": "2016-02-29", "level": "金币+6", "num_look": 418234, "num_comment": 5, "author": "Rabbit_Run", "tags": ["系统安全"], "text": ""}
{"title": "百度浏览器的隐私安全问题分析", "url": "https://www.freebuf.com/news/97003.html", "time": "2016-02-29", "level": "金币+6", "num_look": 430360, "num_comment": 9, "author": "极客小默", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "民调机构称美国人民更希望苹果公司配合FBI", "url": "https://www.freebuf.com/news/97246.html", "time": "2016-02-28", "level": "金币+6", "num_look": 258601, "num_comment": 9, "author": "FireFrank", "tags": ["数据安全", "终端安全"], "text": ""}
{"title": "残留的Ramnit埋伏中国热门网站后台", "url": "https://www.freebuf.com/articles/database/97212.html", "time": "2016-02-27", "level": "金币+6", "num_look": 527068, "num_comment": 10, "author": "江湖小吓", "tags": ["数据安全", "网络安全"], "text": "当我们从阅读邮递员送来纸质报纸变成在网上阅读新闻，我们就将自己暴露在了危险的虚拟世界。"}
{"title": "使用Dmitry Sklyarov的方法来破解一款流行的4G调制解调器", "url": "https://www.freebuf.com/articles/terminal/97218.html", "time": "2016-02-27", "level": "金币+6", "num_look": 394907, "num_comment": 3, "author": "老王隔壁的白帽子", "tags": ["安全管理", "终端安全"], "text": "逆向工程师如果对设备代码和固件系统进行检测时，发现了许多经过加密处理的固件文件，该怎么办？"}
{"title": "利用 Python 特性在 Jinja2 模板中执行任意代码", "url": "https://www.freebuf.com/articles/system/97146.html", "time": "2016-02-26", "level": "", "num_look": 438784, "num_comment": 6, "author": "知道创宇", "tags": ["系统安全"], "text": "本文讲解了Python模板引擎Jinja2在服务端模板注入(SSTI)中的具体利用方法。"}
{"title": "验证码的前世今生（前世篇）", "url": "https://www.freebuf.com/articles/network/97030.html", "time": "2016-02-26", "level": "", "num_look": 1183937, "num_comment": 14, "author": "阿里云誉反欺诈", "tags": ["安全管理", "网络安全"], "text": "常在网上晃悠的人，对验证码都不会陌生。那这些看上去跟我们要做的事情完全无关的验证码到底有何作用呢？"}
{"title": "网络小黑揭秘系列之黑产江湖黑吃黑——中国菜刀的隐形把手", "url": "https://www.freebuf.com/articles/system/97169.html", "time": "2016-02-26", "level": "红色标题", "num_look": 1048320, "num_comment": 34, "author": "奇安信威胁情报中心", "tags": ["系统安全"], "text": "去年12月，360天眼实验室发布了“网络小黑揭秘系列之黑色SEO初探”，揭露了网络上的黑色SEO活动，而这回我们的主角是大家喜闻乐见的中国菜刀。"}
{"title": "MouseJack：利用15美元的工具和15行代码控制无线鼠标和键盘", "url": "https://www.freebuf.com/articles/wireless/97023.html", "time": "2016-02-26", "level": "金币+6", "num_look": 500238, "num_comment": 11, "author": "极客小默", "tags": ["无线安全"], "text": "Bastille的研究团队发现了一种针对蓝牙键盘鼠标的攻击，攻击者可以利用漏洞控制你的电脑操作。研究团队将此漏洞命名为MouseJack。"}
{"title": "Cash：Javascript打造的Unix Shell", "url": "https://www.freebuf.com/sectool/97115.html", "time": "2016-02-26", "level": "金币+6", "num_look": 299100, "num_comment": 4, "author": "dawner", "tags": ["安全管理", "工具"], "text": "Cash是一种纯粹由ES6（Javascript）实现的跨平台的Unix shell，可以在windows下使用。"}
{"title": "释放文件到临时文件夹中所引发的安全问题", "url": "https://www.freebuf.com/articles/terminal/96863.html", "time": "2016-02-26", "level": "金币+6", "num_look": 293177, "num_comment": 6, "author": "东二门陈冠希", "tags": ["系统安全", "终端安全"], "text": "近期，McAfee的高级漏洞检测系统（AEDS）检测到了一些有趣的RTF文件。这些RTF文件在文档中执行“额外”的内容。"}
{"title": "阿里巴巴最新发布的企业安全产品究竟是啥？", "url": "https://www.freebuf.com/news/97100.html", "time": "2016-02-26", "level": "", "num_look": 231376, "num_comment": 9, "author": "明明知道", "tags": ["资讯"], "text": "2月25日，阿里巴巴正式推出了企业安全产品——阿里聚安全，为企业提供“淘宝同款”的安全防护技术。"}
{"title": "逆向在线游戏：创建一个包记录器和编辑器", "url": "https://www.freebuf.com/articles/96976.html", "time": "2016-02-26", "level": "金币+6", "num_look": 281012, "num_comment": 9, "author": "老王隔壁的白帽子", "tags": ["文章"], "text": "在这篇博客中，我准备向大家展示如何逆向在线游戏猎龙，为其创建一个包记录器和编辑器。而在后续的博客中我可能还会展示如何发送我们自己的数据包。"}
{"title": "还在担心WiFi成本高吗？新技术帮你解决难题", "url": "https://www.freebuf.com/news/96960.html", "time": "2016-02-26", "level": "金币+6", "num_look": 404469, "num_comment": 3, "author": "亲爱的兔子", "tags": ["无线安全", "资讯"], "text": "你还在担心你的WiFi（wife）吗？不要担心，近日来自华盛顿大学的计算机科学家和电气工程师团队已经开发出一种非常高效的Wi-Fi无线网络技术。"}
{"title": "支付宝“隐私门”和“十万悬赏”，我们和云舒聊了聊", "url": "https://www.freebuf.com/news/topnews/97001.html", "time": "2016-02-25", "level": "红色标题", "num_look": 1045919, "num_comment": 54, "author": "FB独家", "tags": ["头条", "安全管理"], "text": "2月24日，阿里资深安全专家云舒的一篇《别BB，放码过来拿10万现金吧》，将支付宝“隐私门”引入另一个高潮。"}
{"title": "代号“沙尘暴”：黑客剑指日本关键基础设施", "url": "https://www.freebuf.com/news/96971.html", "time": "2016-02-25", "level": "", "num_look": 193971, "num_comment": 5, "author": "s0far", "tags": ["资讯"], "text": "近日，安全公司Cylance公开了一个针对日本商业和关键基础设施，代号“沙尘暴”行动的黑客活动。"}
{"title": "用图论的方法自动搜索域管理员", "url": "https://www.freebuf.com/articles/terminal/96975.html", "time": "2016-02-25", "level": "金币+6", "num_look": 266716, "num_comment": 7, "author": "东二门陈冠希", "tags": ["终端安全"], "text": "本文将介绍如何在成百上千个工作站和服务器的渗透环境中用图论的方法自动搜索域管理员。"}
{"title": "【回播已更新】FreeBuf公开课：企业安全新思维研讨 （IBM官方授课）", "url": "https://www.freebuf.com/video/96716.html", "time": "2016-02-25", "level": "", "num_look": 303709, "num_comment": 13, "author": "FB视频", "tags": ["视频"], "text": "本课程适用于企业安全从业者、企业安全管理者，探讨如何做好安全风险评估和防御方案。"}
{"title": "大批WordPress网站被渗透 ，成为DDOS攻击源", "url": "https://www.freebuf.com/news/96845.html", "time": "2016-02-25", "level": "", "num_look": 499569, "num_comment": 19, "author": "青藤云安全", "tags": ["资讯"], "text": "安全研究人员发现，数万WordPress站点被利用于实施第7层DDos攻击，如果Pingback功能默认开启，全球任何一个WordPress站点都可能被利用。"}
{"title": "Foolav：免杀小工具+win主机运行任意payload", "url": "https://www.freebuf.com/sectool/96970.html", "time": "2016-02-25", "level": "金币+6", "num_look": 515492, "num_comment": 10, "author": "dawner", "tags": ["工具", "系统安全"], "text": "在渗透测试中，当你需要执行如meterpreter等的payload，而又需要做免杀时，下面这段代码编译的exe也许会对你产生帮助。"}
{"title": "Teensy HID 攻击工具 Kautilya 的改进与稳定利用分析", "url": "https://www.freebuf.com/articles/system/96737.html", "time": "2016-02-25", "level": "现金奖励", "num_look": 399155, "num_comment": 12, "author": "harnnless", "tags": ["极客", "系统安全"], "text": "HID 即 Human Interface Devices 人机接口设备。HID攻击意味着模拟 HID 设备与主机通讯的攻击行为。最常见的攻击形式是模拟成USB HID设备如USB键盘。"}
{"title": "拨开迷雾：究竟是谁窃取了好莱坞明星裸照？", "url": "https://www.freebuf.com/news/96911.html", "time": "2016-02-25", "level": "金币+6", "num_look": 381291, "num_comment": 5, "author": "FireFrank", "tags": ["数据安全", "资讯"], "text": "现年29岁的Andrew Helton被指控窃取好莱坞明星的裸体照而拘留，罪名黑客攻击、计算机欺骗和滥用法案。让人意想不到的是：这位波特兰居民竟然承认了罪行！"}
{"title": "如何编写自己的Web日志分析脚本？", "url": "https://www.freebuf.com/articles/web/96675.html", "time": "2016-02-24", "level": "现金奖励", "num_look": 1161545, "num_comment": 35, "author": "鬼魅羊羔", "tags": ["WEB安全"], "text": "自动分析中间件日志，通过从Web日志中，找出存在的SQL注入、XSS脚本攻击等攻击行为，进行筛选。"}
{"title": "安全产业走向云服务的五点趋势分析和所要具备的关键能力", "url": "https://www.freebuf.com/news/96927.html", "time": "2016-02-24", "level": "", "num_look": 203960, "num_comment": 2, "author": "路由器", "tags": ["资讯"], "text": "云计算从出现到日趋成熟不过十余载，在经历了移动端用户迅速暴增、大数据的应用与物联网的崛起……"}
{"title": "YARA：抗击恶意代码的神兵利器", "url": "https://www.freebuf.com/articles/96903.html", "time": "2016-02-24", "level": "金币+6", "num_look": 892388, "num_comment": 2, "author": "Rabbit_Run", "tags": ["工具", "文章"], "text": "YARA是一款旨在帮助恶意软件研究人员识别和分类恶意软件样本的开源工具。"}
{"title": "易宝支付招聘安全工程师", "url": "https://www.freebuf.com/jobs/96925.html", "time": "2016-02-24", "level": "", "num_look": 248353, "num_comment": 23, "author": "plane636", "tags": ["安全招聘"], "text": "易宝于2003年8月成立，总部位于北京，现有上千名员工，在北京、上海、广东、天津、四川、山东、江苏、浙江、福建、陕西等设有32家分公司。"}
{"title": "ZergHelper：成功绕过iOS App Store的代码审查的风险软件", "url": "https://www.freebuf.com/articles/terminal/96898.html", "time": "2016-02-24", "level": "金币+15", "num_look": 587066, "num_comment": 19, "author": "vul_wish", "tags": ["终端安全"], "text": "近期有安全人员发现，有一款APP成功绕过了Apple的代码审查机制。"}
{"title": "清华博士陈建军“CDN转发循环（Forwarding Loop）攻击”研究获国际学术大奖", "url": "https://www.freebuf.com/news/96874.html", "time": "2016-02-24", "level": "", "num_look": 341549, "num_comment": 12, "author": "bonABC", "tags": ["资讯"], "text": "清华大学博士生陈建军（导师段海新教授）等研究者在美国举行的学术会议NDSS’16 上发表的论文 被评为杰出论文 。"}
{"title": "2016·西安SSCTF，第二届XCTF联赛西安站国际赛", "url": "https://www.freebuf.com/fevents/96486.html", "time": "2016-02-24", "level": "", "num_look": 220260, "num_comment": 5, "author": "四叶草安全", "tags": ["活动"], "text": "四叶草安全于2016年2月举办第二届SSCTF大赛，同时SSCTF也将作为国内最高级别的CTF联赛—XCTF的西安站，即“第二届XCTF联赛西安站国际赛暨2016·西安SSCTF”。"}
{"title": "FBI和苹果的大战结束？强酸和激光可破解iPhone手机加密数据", "url": "https://www.freebuf.com/news/96840.html", "time": "2016-02-24", "level": "红色标题", "num_look": 360563, "num_comment": 20, "author": "简单", "tags": ["资讯"], "text": "有人提供了两种可以提取iPhone手机数据的技术，一种是脱盖（decapping），一种是利用红外激光技术。"}
{"title": "指尖上的艺术：键盘贪食蛇", "url": "https://www.freebuf.com/news/96774.html", "time": "2016-02-24", "level": "金币+15", "num_look": 343542, "num_comment": 10, "author": "亲爱的兔子", "tags": ["极客", "资讯"], "text": "如果你对DIY键盘感兴趣，那么就不要错过这篇文章。"}
{"title": "Python爬虫开发（二）：整站爬虫与Web挖掘", "url": "https://www.freebuf.com/news/topnews/96821.html", "time": "2016-02-24", "level": "现金奖励", "num_look": 1162102, "num_comment": 37, "author": "VillanCh", "tags": ["WEB安全", "头条"], "text": "本文主要介绍关于爬虫的一些理论和约定协议，然后相对完整完成一个爬虫的基本功能。"}
{"title": "基于多域信息融合的内部威胁检测", "url": "https://www.freebuf.com/articles/network/96778.html", "time": "2016-02-23", "level": "现金奖励", "num_look": 479626, "num_comment": 14, "author": "木千之", "tags": ["网络安全"], "text": "作为猴年的第一篇，我们延续上年“内部威胁检测”的主题，介绍下内部威胁检测领域中的信息融合技术。"}
{"title": "被开启的潘多拉：安卓恶意软件GM Bot源代码被公开", "url": "https://www.freebuf.com/news/96811.html", "time": "2016-02-23", "level": "", "num_look": 395606, "num_comment": 7, "author": "SamSmith", "tags": ["终端安全", "资讯"], "text": "一款安卓恶意软件源代码惊现网络，不仅免费提供，还附有攻击感染设备的教程和说明。"}
{"title": "Python爬虫开发（一）：零基础入门", "url": "https://www.freebuf.com/news/topnews/96763.html", "time": "2016-02-23", "level": "现金奖励", "num_look": 1494252, "num_comment": 32, "author": "VillanCh", "tags": ["WEB安全", "头条"], "text": "爬虫技术是数据挖掘，测试技术的重要的组成部分，是搜索引擎技术的核心。"}
{"title": "通过 DLL 注入和代码修改绕过 XIGNCODE3 的反作弊保护", "url": "https://www.freebuf.com/articles/terminal/96741.html", "time": "2016-02-23", "level": "", "num_look": 968540, "num_comment": 9, "author": "老王隔壁的白帽子", "tags": ["终端安全"], "text": "本文我展示的方法实现起来非常简单，并且可以适用于使用XIGNCODE3的任何游戏。"}
{"title": "滴滴出行招聘高级运维安全研发工程师", "url": "https://www.freebuf.com/jobs/96776.html", "time": "2016-02-23", "level": "", "num_look": 244613, "num_comment": 18, "author": "淡定淞淞", "tags": ["安全招聘"], "text": "废话不多说，滴滴出行有豪气著称的老板，高大上的年会奖品，丰厚的年终奖，人性化的管理，高成长空间的期权。"}
{"title": "新型恶意勒索软件DMA Locker分析", "url": "https://www.freebuf.com/articles/network/96738.html", "time": "2016-02-23", "level": "金币+15", "num_look": 361277, "num_comment": 3, "author": "东二门陈冠希", "tags": ["网络安全"], "text": "DMA Locker是今年早些时候出现的一款勒索软件。目前为止该勒索软件的影响范围比较小，但我们还是想提醒您，它仍然存在。"}
{"title": "Gogs：一个比gitlab更好用的代码托管平台", "url": "https://www.freebuf.com/sectool/96732.html", "time": "2016-02-23", "level": "", "num_look": 368887, "num_comment": 8, "author": "亲爱的兔子", "tags": ["工具"], "text": "Gogs 的目标是打造一个最简单、最快速和最轻松的方式搭建自助 Git 服务。"}
{"title": "工具推荐：striptls审计代理", "url": "https://www.freebuf.com/sectool/95855.html", "time": "2016-02-23", "level": "", "num_look": 357896, "num_comment": 1, "author": "Zer0yu", "tags": ["工具", "网络安全"], "text": "本工具是一款STARTTLS剥离攻击的POC实现。"}
{"title": "Linux Mint网站被黑，下载链接指向带有后门的ISO镜像", "url": "https://www.freebuf.com/news/96693.html", "time": "2016-02-22", "level": "", "num_look": 199639, "num_comment": 6, "author": "简单", "tags": ["资讯"], "text": "你在2016年2月20日下载过Linux Mint吗？你可能已经感染了病毒……"}
{"title": "加密并不是危如累卵，FBI知道苹果已经拥有所需密钥", "url": "https://www.freebuf.com/articles/terminal/96585.html", "time": "2016-02-22", "level": "金币+8", "num_look": 377912, "num_comment": 17, "author": "极客小默", "tags": ["数据安全", "终端安全"], "text": "只要手机使用PIN，联邦调查局都可以解锁。如果是使用安全密码锁定，就算是用特殊的固件也难以解锁手机。"}
{"title": "aswSnx.sys中的内核分页池缓冲区溢出漏洞分析（CVE-2015-8620）", "url": "https://www.freebuf.com/vuls/96572.html", "time": "2016-02-22", "level": "金币+8", "num_look": 248234, "num_comment": 5, "author": "vul_wish", "tags": ["漏洞"], "text": "安全人员在Avast Virtualization内核模式驱动(aswSnx.sys)中发现一个安全漏洞，使用普通账户登录的本地攻击者可利用该漏洞提升权限，以系统权限执行任意代码，进而完全控制受影响主机。"}
{"title": "微店招聘安全工程师", "url": "https://www.freebuf.com/jobs/96549.html", "time": "2016-02-22", "level": "", "num_look": 241581, "num_comment": 21, "author": "muhuo", "tags": ["安全招聘"], "text": "微店 | 口袋购物，一家专注于移动电子商务的公司，现高薪招聘安全工程师。"}
{"title": "新型word文档恶意勒索软件出现，每日可感染达十万台计算机", "url": "https://www.freebuf.com/news/96570.html", "time": "2016-02-22", "level": "金币+8", "num_look": 277644, "num_comment": 17, "author": "亲爱的兔子", "tags": ["漏洞", "资讯"], "text": "如果你最近收到一封邮件，而这封邮件里面包含一个微软word文档，那么你就需要小心了。"}
{"title": "支离破碎的无线防盗报警器让入侵者畅通无阻", "url": "https://www.freebuf.com/news/96582.html", "time": "2016-02-22", "level": "", "num_look": 285665, "num_comment": 2, "author": "极客小默", "tags": ["漏洞", "资讯"], "text": "超过20万家庭使用的安全系统都有着一个难以修复的漏洞，这使得精通科技的窃贼可以在几百英尺之外解除警报。"}
{"title": "最受欢迎的14款渗透测试工具", "url": "https://www.freebuf.com/sectool/96574.html", "time": "2016-02-22", "level": "金币+8", "num_look": 1229955, "num_comment": 16, "author": "东二门陈冠希", "tags": ["工具"], "text": "就像任何事物都有两面，黑客既可以进行恶意的攻击破坏，同样也可以通过利用自己的技术去找到系统的漏洞、缺陷等，然后通知相关企业进行修复已获得更好的防护。"}
{"title": "完美(世界)集团信息安全部诚聘(北京)", "url": "https://www.freebuf.com/jobs/96530.html", "time": "2016-02-21", "level": "", "num_look": 287298, "num_comment": 29, "author": "何艺", "tags": ["安全招聘"], "text": "2016年1月，完美环球以120亿元的交易对价收购了曾经的母公司完美世界100%股权，使得在美上市八年的老牌游戏巨头正式回归A股。"}
{"title": "PHP 使用 rand() 函数生成令牌安全吗？", "url": "https://www.freebuf.com/articles/96599.html", "time": "2016-02-21", "level": "金币+8", "num_look": 442529, "num_comment": 2, "author": "xiaix", "tags": ["文章", "网络安全"], "text": "本文将展示预测使用 rand 产生的令牌其实并不那么困难。"}
{"title": "赛门铁克（Symantec）发布2016年1月份威胁情报报告", "url": "https://www.freebuf.com/articles/network/96546.html", "time": "2016-02-21", "level": "", "num_look": 373400, "num_comment": 1, "author": "Sphinx", "tags": ["安全报告", "网络安全"], "text": "2016年1月的最新报告显示：社交媒体诈骗呈增长，而鱼叉式网络钓鱼活动有减少。"}
{"title": "巴黎恐怖袭击事件本不该发生，错在谁？", "url": "https://www.freebuf.com/news/96533.html", "time": "2016-02-20", "level": "", "num_look": 191673, "num_comment": 11, "author": "简单", "tags": ["资讯"], "text": "NSA局长称巴黎恐怖袭击事件本不该发生，是因为加密通信阻碍了他们对信息的搜集，误了大事。"}
{"title": "饿了么诚聘行业英才", "url": "https://www.freebuf.com/jobs/96565.html", "time": "2016-02-20", "level": "", "num_look": 245159, "num_comment": 13, "author": "路由器", "tags": ["安全招聘"], "text": "饿了么是中国最专业的网上订餐平台，已覆盖中国数百个城市，数千万用户。"}
{"title": "闭路电视探头究竟有多不安全？", "url": "https://www.freebuf.com/vuls/96412.html", "time": "2016-02-19", "level": "", "num_look": 641624, "num_comment": 25, "author": "vulture", "tags": ["漏洞", "终端安全"], "text": "闭路电视在我们生活中无处不在，很多商家、户主用它来保护自己的财产，然而研究人员发现，某款CCTV摄像头存在大量安全隐患。"}
{"title": "库克大战FBI，科技大佬们站在哪一边？", "url": "https://www.freebuf.com/news/96502.html", "time": "2016-02-19", "level": "", "num_look": 248119, "num_comment": 15, "author": "哆啦A梦", "tags": ["资讯"], "text": "美国法院要求苹果配合FBI解锁枪击案凶手所用iPhone手机，遭到库克的拒绝，而硅谷领袖们并没有坐视不管。"}
{"title": "NoSQLMap：开源自动化NoSQL数据库破解工具", "url": "https://www.freebuf.com/sectool/96465.html", "time": "2016-02-19", "level": "金币+8", "num_look": 385726, "num_comment": 6, "author": "FireFrank", "tags": ["工具"], "text": "NoSQLMap是一款Python编写的开源工具，常用于审计NoSQL数据库中的自动注入攻击。"}
{"title": "开发安全指南：如何安全地储存用户密码", "url": "https://www.freebuf.com/articles/web/96473.html", "time": "2016-02-19", "level": "金币+8", "num_look": 664526, "num_comment": 9, "author": "东二门陈冠希", "tags": ["WEB安全"], "text": "作为一名合格的开发一定要知道如何在PHP、Java、C#.net、Ruby、Python、Node.js等各大语言中安全地储存用户密码。"}
{"title": "外媒质疑美国安局（NSA）天网，或已误杀千人", "url": "https://www.freebuf.com/news/96443.html", "time": "2016-02-19", "level": "红色标题", "num_look": 568367, "num_comment": 32, "author": "明明知道", "tags": ["网络安全", "资讯"], "text": "美国NSA一项名为“天网”SKYNET的计划，使用机器学习算法分析帮助NSA寻找潜在恐怖分子。如今外媒开始质疑这个项目可能已经“误杀上千无辜平民”。"}
{"title": "盘点2015年度10大安卓手机系统级病毒", "url": "https://www.freebuf.com/articles/network/96413.html", "time": "2016-02-19", "level": "", "num_look": 442879, "num_comment": 6, "author": "360手机卫士", "tags": ["网络安全"], "text": "随着移动端Android系统安全软件对APP应用层查杀能力趋于成熟以及Google对Android安全性的重视，病毒与反病毒的主战场已逐渐从APP层扩展到Linux系统层。"}
{"title": "前程无忧招聘安全工程师", "url": "https://www.freebuf.com/articles/96378.html", "time": "2016-02-19", "level": "", "num_look": 278126, "num_comment": 21, "author": "night85", "tags": ["文章"], "text": "“前程无忧”(Nasdaq: JOBS)是国内第一个集多种媒介资源优势的专业人力资源服务机构。"}
{"title": "极客DIY：使用树莓派制作一架四轴无人机", "url": "https://www.freebuf.com/geek/96399.html", "time": "2016-02-19", "level": "金币+15", "num_look": 2081317, "num_comment": 50, "author": "亲爱的兔子", "tags": ["极客"], "text": "如果你想DIY一台属于自己的无人机，那么接下来可以阅读这篇文章，阅读完毕之后也许对你会有启发。"}
{"title": "俄罗斯间谍组织Pawn Storm新武器：Linux Fysbis木马", "url": "https://www.freebuf.com/news/96429.html", "time": "2016-02-19", "level": "", "num_look": 209313, "num_comment": 1, "author": "简单", "tags": ["资讯"], "text": "PaloAlto恶意软件研究员发现了一个名为Fysbis的木马，是俄罗斯政府支持的网络间谍组织Pawn Storm所使用的一个简单而有效的Linux木马。"}
{"title": "Apple Pay终于来了，支付安全性呢？", "url": "https://www.freebuf.com/news/96408.html", "time": "2016-02-18", "level": "红色标题", "num_look": 463534, "num_comment": 20, "author": "空白", "tags": ["资讯"], "text": "2016年2月18日凌晨5：00，Apple Pay业务在中国大陆正式上线。"}
{"title": "AIL-Framework：潜在信息泄露分析框架", "url": "https://www.freebuf.com/sectool/96389.html", "time": "2016-02-18", "level": "", "num_look": 258220, "num_comment": 1, "author": "vul_wish", "tags": ["工具"], "text": "AIL是一个用于分析潜在的信息泄露的模块化框架，主要针对非结构化的数据资源，如Pastebin网站的粘贴数据等。"}
{"title": "警告：Adobe Creative Cloud漏洞导致Mac用户数据删除", "url": "https://www.freebuf.com/news/96332.html", "time": "2016-02-18", "level": "金币+15", "num_look": 213406, "num_comment": 3, "author": "dawner", "tags": ["漏洞", "资讯"], "text": "有报道称，有一个Mac版本的Creative Cloud服务会不经过用户允许，直接越权删除本地的用户数据。"}
{"title": "法官要求苹果公司协助FBI解锁手机，库克表示会上诉！", "url": "https://www.freebuf.com/news/96293.html", "time": "2016-02-18", "level": "", "num_look": 430958, "num_comment": 24, "author": "明明知道", "tags": ["数据安全", "终端安全"], "text": "本周二，法官裁定苹果必须向FBI提供技术帮助，但苹果CEO库克昨天表示此举会威胁到用户安全，并将提起上诉。"}
{"title": "安天AVL Team发布2015移动安全年报", "url": "https://www.freebuf.com/articles/terminal/96219.html", "time": "2016-02-18", "level": "", "num_look": 297516, "num_comment": 6, "author": "AVLTeam", "tags": ["安全报告", "终端安全"], "text": "Android和iOS在2009至2010年期间，均出现具有典型意义和影响力的恶意代码家族。因此，自2009年以来，安全工作者与恶意代码的对抗可谓经历了六年博弈之难。"}
{"title": "无需密码攻击 Microsoft SQL Server", "url": "https://www.freebuf.com/articles/network/96333.html", "time": "2016-02-18", "level": "金币+15", "num_look": 540241, "num_comment": 11, "author": "xiaix", "tags": ["网络安全"], "text": "最近的一次渗透测试里，在我们捕获的一些数据包中发现了一些未经加密的 Microsoft SQL Server(MSSQL) 流量。"}
{"title": "腾讯社交网络事业群安全中心招聘安全工程师", "url": "https://www.freebuf.com/jobs/96251.html", "time": "2016-02-18", "level": "", "num_look": 324634, "num_comment": 9, "author": "腾讯电脑管家", "tags": ["安全招聘"], "text": "腾讯公司成立于1998年11月， 是目前中国最大的互联网综合服务提供商之一，也是中国服务用户最多的互联网企业之一。"}
{"title": "如何防御“神器”Mimikatz窃取系统密码？", "url": "https://www.freebuf.com/sectool/96209.html", "time": "2016-02-18", "level": "红色标题", "num_look": 683332, "num_comment": 14, "author": "vulture", "tags": ["工具", "系统安全"], "text": "Mimikatz是一款能够从Windows中获取内存，并且获取明文密码和NTLM哈希值的神器，本文将介绍如何防御这款软件获取密码。"}
{"title": "震网病毒大电影《Zero Days》明日首映，解密美国以色列网络攻击行动", "url": "https://www.freebuf.com/news/96259.html", "time": "2016-02-18", "level": "", "num_look": 545519, "num_comment": 11, "author": "简单", "tags": ["资讯"], "text": "2010年震网病毒首次被发现，60%的受害主机位于伊朗境内，其中受害最严重的为伊朗核工厂。明天解密这一超级病毒的大电影将会在柏林国际电影节上首映。"}
{"title": "永不消逝的电波（四）：从无线电角度揭秘定位劫持", "url": "https://www.freebuf.com/news/topnews/87353.html", "time": "2016-02-17", "level": "红色标题", "num_look": 1046606, "num_comment": 26, "author": "吃葡萄不吐葡萄皮的雪碧", "tags": ["头条", "无线安全"], "text": "2015年的时候，360以及阿里均在黑客大会上带来了GPS劫持的演讲，给大家揭开了GPS Hacking的神秘面纱。本文我们将围绕无线电来分析和学习如何进行定位的劫持和伪造。"}
{"title": "连环套：欺诈木马伪基站+伪10086让人防不胜防", "url": "https://www.freebuf.com/articles/96246.html", "time": "2016-02-17", "level": "", "num_look": 602229, "num_comment": 21, "author": "腾讯电脑管家", "tags": ["数据安全", "文章"], "text": "现如今话费充值只需要下载一个中国移动的app，即可在手机上方便的完成操作。但是这也给一些不法分子带来了可乘之机。"}
{"title": "Linux glibc再曝漏洞：可导致Linux软件劫持", "url": "https://www.freebuf.com/news/96244.html", "time": "2016-02-17", "level": "金币+15", "num_look": 531127, "num_comment": 13, "author": "vul_wish", "tags": ["漏洞", "资讯"], "text": "安全人员发现GNU C Library (glibc)中存在严重的安全漏洞，可导致Linux平台上执行任意代码，获取密码，监视用户，甚至控制计算机。"}
{"title": "XSS探究：对可利用点进行关联的奇妙旅程", "url": "https://www.freebuf.com/articles/network/96177.html", "time": "2016-02-17", "level": "金币+8", "num_look": 509046, "num_comment": 11, "author": "东二门陈冠希", "tags": ["网络安全"], "text": "Macy's这个站点，从流量上来说这是一个很有价值的网站，但是从安全的角度来说就不是了。"}
{"title": "如何用Wireshark捕获USB数据？", "url": "https://www.freebuf.com/articles/system/96216.html", "time": "2016-02-17", "level": "金币+8", "num_look": 1499935, "num_comment": 16, "author": "老王隔壁的白帽子", "tags": ["数据安全", "极客"], "text": "现在越来越多的电子设备采用USB接口进行通讯，通讯标准也在逐步提高。还在好奇这些设备是如何工作的？试试用Wireshark捕获USB数据吧。"}
{"title": "对meterpreter的http或https的handler进行识别和攻击", "url": "https://www.freebuf.com/articles/web/94959.html", "time": "2016-02-17", "level": "金币+8", "num_look": 327282, "num_comment": 3, "author": "东二门陈冠希", "tags": ["WEB安全"], "text": "本文将展示如何对meterpreter的https或http的handler进行识别，以及如何进行拒绝服务攻击。"}
{"title": "针对爱尔兰DDoS攻击的取证分析", "url": "https://www.freebuf.com/articles/network/96179.html", "time": "2016-02-17", "level": "金币+8", "num_look": 353785, "num_comment": 2, "author": "xiaix", "tags": ["网络安全"], "text": "本文首先会针对此次DDoS攻击进行取证分析，随后会给出缓解这类DDoS攻击的方法。"}
{"title": "隔墙有耳：黑客可以“听到”离线计算机的密钥", "url": "https://www.freebuf.com/news/96147.html", "time": "2016-02-17", "level": "红色标题", "num_look": 493557, "num_comment": 11, "author": "明明知道", "tags": ["数据安全", "终端安全"], "text": "以色列安全研究者设计出一种盗取计算机数据的方法，而这台“倒霉”电脑不仅没有联网，还是隔壁房间的。"}
{"title": "如何建立并夯实威胁情报生态体系的基础？", "url": "https://www.freebuf.com/articles/neopoints/95813.html", "time": "2016-02-17", "level": "", "num_look": 379882, "num_comment": 5, "author": "绿盟科技", "tags": ["安全管理", "观点"], "text": "威胁情报是高级威胁对抗能力的基石，其重要性已经得到管理层和业界的充分重视。但如何逐步建立并夯实威胁情报生态体系的基础，对业界来说依然是个挑战。"}
{"title": "玩跨界？三款最优秀平价SDR对比", "url": "https://www.freebuf.com/sectool/96133.html", "time": "2016-02-16", "level": "", "num_look": 813800, "num_comment": 11, "author": "0xroot", "tags": ["工具", "无线安全"], "text": "近几年是SDR的黄金年代：已有三款新的SDR平台面世，用户可以有很多选择。这篇文章将比较这三款SDR平台：Great Scott Gadgets生产的HackRF,Nuand生产的bladeRF,和Ettus生产的USRP(B200/210)。"}
{"title": "土耳其国家警察服务器遭攻击，17.8G数据外泄", "url": "https://www.freebuf.com/news/96087.html", "time": "2016-02-16", "level": "金币+8", "num_look": 402933, "num_comment": 16, "author": "亲爱的兔子", "tags": ["数据安全", "资讯"], "text": "近日土耳其国家警察(EMG)服务器遭到网络攻击，泄露大量数据。"}
{"title": "Empire模拟案例的学习", "url": "https://www.freebuf.com/sectool/96019.html", "time": "2016-02-16", "level": "金币+8", "num_look": 340809, "num_comment": 4, "author": "老王隔壁的白帽子", "tags": ["工具", "系统安全"], "text": "本文将通过一个模拟的案例向大家展示从初次访问到最终的权限获得，让大家深刻的体会Empire的强大功能。"}
{"title": "1970成为iOS之殇，熊孩子又该如何自救？", "url": "https://www.freebuf.com/news/96072.html", "time": "2016-02-16", "level": "金币+8", "num_look": 549948, "num_comment": 30, "author": "0xroot", "tags": ["漏洞", "资讯"], "text": "继上个月的十二行代码分分钟让浏览器崩溃iPhone重启事件之后，近日又有网友爆出：如果把64位的iOS设备系统时间修改为1970年1月1日，设备重启后将变砖。如果遇到熊孩子吧你的手机变砖了那么来看看。"}
{"title": "房多多招聘安全工程师", "url": "https://www.freebuf.com/jobs/96086.html", "time": "2016-02-16", "level": "", "num_look": 188185, "num_comment": 17, "author": "路由器", "tags": ["安全招聘"], "text": "房多多是国内首家移动互联网房产交易服务平台。"}
{"title": "深度学习：能击败欧洲围棋冠军，还能防恶意软件", "url": "https://www.freebuf.com/articles/network/96027.html", "time": "2016-02-16", "level": "", "num_look": 417354, "num_comment": 8, "author": "明明知道", "tags": ["网络安全"], "text": "上月底，权威科学杂志Nature发表了一篇关于谷歌人工智能程序AlphaGo击败欧洲围棋冠军的文章，其中介绍了AlphaGo程序的细节。"}
{"title": "Metasploit中的JAVA反向TCP做法的研究", "url": "https://www.freebuf.com/articles/system/95810.html", "time": "2016-02-16", "level": "", "num_look": 302688, "num_comment": 9, "author": "Tony Lee", "tags": ["系统安全"], "text": "在研究CVE-2015-7450这个JAVA反序列化漏洞时，面临着一个问题：在WebSphere中，该漏洞仅可以执行命令，但是不能回显执行结果。"}
{"title": "利用51单片机制作廉价盒仔机器人", "url": "https://www.freebuf.com/geek/95920.html", "time": "2016-02-16", "level": "", "num_look": 307247, "num_comment": 13, "author": "xiaowuyi", "tags": ["极客"], "text": "BOXZ，昵称盒仔，是一款开源的互动娱乐平台，很多盒仔的制作都是用arduino完成的。假期没事，带着宝宝们用51制作了一个廉价的BOXZ。"}
{"title": "恶意Office文件捆绑kasidet和dridex后门", "url": "https://www.freebuf.com/articles/network/96011.html", "time": "2016-02-16", "level": "金币+8", "num_look": 362139, "num_comment": 2, "author": "老王隔壁的白帽子", "tags": ["网络安全"], "text": "我们已经介绍过Direx木马通过Office宏病毒等不同的方法来进行传播。而在过去的两周,我们发现这些宏病毒不仅可以释放Direx后门，还会释放Kasidet后门。"}
{"title": "Lobotomy：安卓系统评估渗透测试工具包", "url": "https://www.freebuf.com/sectool/95881.html", "time": "2016-02-16", "level": "金币+8", "num_look": 339459, "num_comment": 3, "author": "亲爱的兔子", "tags": ["工具"], "text": "Lobotomy是一款运行在Python环境下的安卓系统评估工具包，它可以帮助安全研究人员评估不同Android逆向工程任务。"}
{"title": "Windows最新“WebDAV”提权漏洞介绍（MS16-016）", "url": "https://www.freebuf.com/vuls/95950.html", "time": "2016-02-15", "level": "", "num_look": 652999, "num_comment": 15, "author": "SamSmith", "tags": ["漏洞"], "text": "这个漏洞是由于Windows中的WebDAV未正确处理WebDAV客户端发送的信息导致的。"}
{"title": "XSS过滤器Bypass的一些姿势", "url": "https://www.freebuf.com/articles/web/95446.html", "time": "2016-02-15", "level": "金币+5", "num_look": 617136, "num_comment": 18, "author": "xiaix", "tags": ["WEB安全"], "text": "XSS 攻击是一种攻击者将 JavaScript 代码注入到用户运行页面中的攻击。在本文中会先展示一些尝试过滤 JavaScript 的代码，并随后给出其绕过方法。"}
{"title": "商业级别Fortify白盒神器介绍与使用分析", "url": "https://www.freebuf.com/sectool/95683.html", "time": "2016-02-15", "level": "", "num_look": 1348131, "num_comment": 27, "author": "心东", "tags": ["WEB安全", "工具"], "text": "fottify全名叫：Fortify SCA ，是HP的产品 ，是一个静态的、白盒的软件源代码安全测试工具。"}
{"title": "有情有意，FreeBuf & 漏洞盒子新年招聘啦！", "url": "https://www.freebuf.com/jobs/95963.html", "time": "2016-02-15", "level": "红色标题", "num_look": 407619, "num_comment": 21, "author": "thanks", "tags": ["安全招聘"], "text": "如果你已厌倦了那些无法施展才能的空间，期待更具创新力和挑战性的事业，或是拿够了上家公司的年终奖，快看这里。"}
{"title": "如何配置一台Firefox OS电视机", "url": "https://www.freebuf.com/geek/95893.html", "time": "2016-02-15", "level": "金币+5", "num_look": 316037, "num_comment": 5, "author": "亲爱的兔子", "tags": ["极客"], "text": "想不想配置一台开源免费操作系统的电视机？"}
{"title": "SET工具包新版本发布", "url": "https://www.freebuf.com/sectool/95880.html", "time": "2016-02-15", "level": "", "num_look": 411702, "num_comment": 5, "author": "亲爱的兔子", "tags": ["工具"], "text": ""}
{"title": "关于Fuzz工具的那些事儿", "url": "https://www.freebuf.com/sectool/76861.html", "time": "2016-02-15", "level": "金币+5", "num_look": 1733707, "num_comment": 12, "author": "极客小默", "tags": ["WEB安全", "工具"], "text": "在安全测试中，模糊测试（fuzz testing）是一种介于完全的手工渗透测试与完全的自动化测试之间的安全性测试类型。这里介绍了16个功能强大的模糊测试工具。"}
{"title": "XSS探究：不安全的EZDATA脚本", "url": "https://www.freebuf.com/articles/network/94467.html", "time": "2016-02-15", "level": "", "num_look": 424898, "num_comment": 3, "author": "东二门陈冠希", "tags": ["网络安全"], "text": "在这篇文章中，我将对\"EZDATA\"这个不安全的脚本进行分析。"}
{"title": "极客美女打造一款能做“口活”的装置", "url": "https://www.freebuf.com/news/95772.html", "time": "2016-02-15", "level": "", "num_look": 327939, "num_comment": 10, "author": "亲爱的兔子", "tags": ["极客", "资讯"], "text": ""}
{"title": "FIT 2016集锦 | 解锁iOS手势密码的正确姿势", "url": "https://www.freebuf.com/news/95861.html", "time": "2016-02-14", "level": "", "num_look": 332466, "num_comment": 4, "author": "cindy", "tags": ["头条", "终端安全"], "text": "手势密码，就是用一个手势作为密码，手机界面上有9个点，任意连接其中若干个点就能组成一个图案，这个图案即可作为一种密码。"}
{"title": "simtrace之探秘SIM卡中的世界", "url": "https://www.freebuf.com/news/topnews/95815.html", "time": "2016-02-14", "level": "现金奖励", "num_look": 451448, "num_comment": 6, "author": "kotobukki", "tags": ["头条", "极客"], "text": "这个世界上并没有多少人知道SIM卡中的操作系统是基于jvm的。"}
{"title": "FIT 2016集锦 | Hack Demo：黑客叔叔的保险箱", "url": "https://www.freebuf.com/news/95789.html", "time": "2016-02-13", "level": "", "num_look": 259844, "num_comment": 6, "author": "FB独家", "tags": ["资讯"], "text": "今年初举办的FreeBuf互联网安全创新大会（FIT）“Hack Demo”环节中的一场重头戏就是由黑客叔叔(p0tt1)所带来的现场展示——《魔法师的保险箱》。"}
{"title": "NSA负责人现场教学如何进行系统渗透", "url": "https://www.freebuf.com/news/95447.html", "time": "2016-02-12", "level": "", "num_look": 239532, "num_comment": 9, "author": "简单", "tags": ["资讯"], "text": "NSA负责黑客行动的 Tailored Access Operation负责人Rob Joyce发表了演讲，阐述网络安全的最佳实践，透露了NSA黑客入侵一个网络的途径。"}
{"title": "极客DIY：RFID飞贼打造一款远距离渗透利器", "url": "https://www.freebuf.com/sectool/95594.html", "time": "2016-02-11", "level": "金币+5", "num_look": 680862, "num_comment": 19, "author": "banish", "tags": ["工具", "无线安全"], "text": "本文使用最新的渗透工具RFID飞贼（Tastic RFID Thief）和RFID感应破解技术来获取一些拥有安防的建筑物的访问权限。"}
{"title": "苹果iOS系统被曝出现漏洞：可使锁屏密码失去作用", "url": "https://www.freebuf.com/news/95755.html", "time": "2016-02-10", "level": "金币+5", "num_look": 298346, "num_comment": 10, "author": "亲爱的兔子", "tags": ["漏洞", "资讯"], "text": "近日安全研究人员发现了iOS 8和iOS 9系统漏洞，利用该漏洞可以使锁屏密码完全失去作用。"}
{"title": "Dridex僵尸网络服务器遭劫持，为用户下载免费防病毒软件", "url": "https://www.freebuf.com/news/95763.html", "time": "2016-02-07", "level": "", "num_look": 203946, "num_comment": 2, "author": "寰者", "tags": ["资讯"], "text": "匿名白帽劫持Dridex僵尸网络C&C服务器，将原本用于传播，针对银行业务的木马替换成免费杀毒软件Avira（小红伞）。"}
{"title": "利用Linux内核里的Use-After-Free（UAF）漏洞提权", "url": "https://www.freebuf.com/vuls/95708.html", "time": "2016-02-07", "level": "现金奖励", "num_look": 796323, "num_comment": 14, "author": "nickchang", "tags": ["漏洞", "系统安全"], "text": "上个月爆出的CVE-2016-0728 本地提权漏洞让大家的目光又一次聚焦在linux内核安全上。"}
{"title": "FIT 2016集锦 | 线性资本王淮：我们为什么会投资安全领域？", "url": "https://www.freebuf.com/news/topnews/95582.html", "time": "2016-02-06", "level": "", "num_look": 2110640, "num_comment": 3, "author": "FB独家", "tags": ["头条", "视频"], "text": "2016 FreeBuf互联网安全创新大会（FIT）“产业创新论坛”上，线性资本合伙人王淮针对《关于安全领域投资的8个问题》进行了一一解答。"}
{"title": "手把手教你找回加密程序的密码", "url": "https://www.freebuf.com/articles/system/95702.html", "time": "2016-02-06", "level": "现金奖励", "num_look": 764241, "num_comment": 21, "author": "追影人", "tags": ["数据安全", "系统安全"], "text": "前不久一朋友说忘了加密程序的密码，里面有很多重要信息，希望我能帮TA找回密码。心想不就是点一下“忘记密码”么，所以爽快答应了，然后就发生了接下来故事。"}
{"title": "黑客组织匿名者(Anonymous)公布近100个泰国监狱网站数据", "url": "https://www.freebuf.com/news/95710.html", "time": "2016-02-05", "level": "", "num_look": 220484, "num_comment": 5, "author": "亲爱的兔子", "tags": ["资讯"], "text": ""}
{"title": "维基解密创始人阿桑奇要自首？", "url": "https://www.freebuf.com/news/95694.html", "time": "2016-02-04", "level": "", "num_look": 220090, "num_comment": 9, "author": "亲爱的兔子", "tags": ["资讯"], "text": "维基解密创办人阿桑奇周四表示，他会根据联合国任意拘留问题工作组即将做出的结论而考虑是否于周五离开厄瓜多尔大使馆，向英国警方自首。"}
{"title": "键盘记录工具PyKeylogger", "url": "https://www.freebuf.com/sectool/95671.html", "time": "2016-02-04", "level": "金币+6", "num_look": 515528, "num_comment": 7, "author": "寰者", "tags": ["工具"], "text": "PyKeylogger 1.2.1 是一个Linux下的python版击键记录工具，它通过使用Xlib库来监控键盘状态，并且支持GNU通用公共授权。"}
{"title": "BypassUAC：Windows系统UAC绕过利器", "url": "https://www.freebuf.com/sectool/95661.html", "time": "2016-02-04", "level": "金币+6", "num_look": 696621, "num_comment": 15, "author": "JackFree", "tags": ["工具", "系统安全"], "text": "BypassUAC是一款工具，它使用Windows系统内置的AutoElevate后门攻陷Windows用户帐户控制（UAC）机制。"}
{"title": "Ubuntu 12.04安装嗅探蓝牙数据包的Kismet和Wireshark", "url": "https://www.freebuf.com/sectool/95426.html", "time": "2016-02-04", "level": "金币+6", "num_look": 397192, "num_comment": 5, "author": "江湖小吓", "tags": ["工具"], "text": ""}
{"title": "工具推荐：HardeningONE(类Unix系统安全检查脚本)", "url": "https://www.freebuf.com/sectool/95599.html", "time": "2016-02-04", "level": "", "num_look": 207438, "num_comment": 3, "author": "我是酱油男", "tags": ["工具"], "text": "hardeningone是一款类Unix系统安全检查bash shell脚本，适合信安审计人员或信安测试人员使用。"}
{"title": "“绿色”并不代表安全，一个隐藏在绿色软件中的木马分析", "url": "https://www.freebuf.com/articles/system/95571.html", "time": "2016-02-03", "level": "", "num_look": 300821, "num_comment": 16, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "“绿色软件”由于其免安装、解压即可使用，也会给人予安全的感觉，因此深受广大网友的喜爱。然而这些“绿色软件”真的都安全吗？"}
{"title": "SLOTH：一个新型的TLS1.2降级攻击", "url": "https://www.freebuf.com/vuls/95560.html", "time": "2016-02-03", "level": "金币+6", "num_look": 488242, "num_comment": 1, "author": "vul_wish", "tags": ["漏洞", "网络安全"], "text": "上个月，Computer Science and Automation (INRIA)的安全研究人员在TLS 1.2协议的实现过程中发现一个新漏洞，并将该新型攻击命名为“SLOTH”。"}
{"title": "简单易用的钓鱼渗透测试工具Weeman新版发布", "url": "https://www.freebuf.com/sectool/95589.html", "time": "2016-02-03", "level": "金币+6", "num_look": 421896, "num_comment": 15, "author": "亲爱的兔子", "tags": ["工具"], "text": ""}
{"title": "黑客组织AnonSec公开约250G NASA数据，曾尝试黑掉无人机", "url": "https://www.freebuf.com/news/95610.html", "time": "2016-02-03", "level": "", "num_look": 242190, "num_comment": 9, "author": "亲爱的兔子", "tags": ["资讯"], "text": "近日黑客组织AnonSec公布了约 250G数据，而这些数据都是来自美国国家航空航天局（NASA）。"}
{"title": "一个“美女”木马的自白", "url": "https://www.freebuf.com/articles/terminal/95570.html", "time": "2016-02-03", "level": "", "num_look": 292987, "num_comment": 13, "author": "腾讯电脑管家", "tags": ["终端安全"], "text": "在打开手机浏览器的时候，如果发现浏览器弹出74443网址导航页面，或者在你打开常用APP的时候，弹出推广信息，那么多半可以确定你手机感染了广告木马。"}
{"title": "VirusTotal支持固件病毒的检测", "url": "https://www.freebuf.com/articles/system/95568.html", "time": "2016-02-03", "level": "", "num_look": 312840, "num_comment": 2, "author": "Sphinx", "tags": ["系统安全"], "text": "在线病毒扫描网站VirusTotal提供对固件的检测了，它能够帮助你识别你的固件是合法的还是恶意的。"}
{"title": "工具推荐：Shellsploit，ShellCode生成器", "url": "https://www.freebuf.com/sectool/95039.html", "time": "2016-02-03", "level": "", "num_look": 499331, "num_comment": 5, "author": "我是酱油男", "tags": ["工具"], "text": "Shellsploit让你生成定制shellcodes、后门、各种操作系统的攻击代码。同时可以使用它来进行代码混淆工作。"}
{"title": "美国中情局抓捕斯诺登的计划曝光", "url": "https://www.freebuf.com/news/95572.html", "time": "2016-02-03", "level": "", "num_look": 226544, "num_comment": 3, "author": "亲爱的兔子", "tags": ["资讯"], "text": "近日Denfri.dk曝光了一组文件，而文件中证实了CIA计划抓捕并引渡爱德华·斯诺登的计划。"}
{"title": "乌克兰BlackEnergy新动向：通过Word文档进行APT攻击", "url": "https://www.freebuf.com/news/95449.html", "time": "2016-02-02", "level": "金币+5", "num_look": 357430, "num_comment": 4, "author": "老王隔壁的白帽子", "tags": ["资讯"], "text": "大概在2014年，一个特别的BlackEnergy组织开始引起大家的注意，他们开发了监测控制和数据采集类的插件来威胁ICS并且在全世界范围都非常活跃。"}
{"title": "安全研究人员最爱的15款操作系统（含下载）", "url": "https://www.freebuf.com/sectool/95435.html", "time": "2016-02-02", "level": "", "num_look": 1462119, "num_comment": 42, "author": "SamSmith", "tags": ["头条", "工具"], "text": "渗透测试中国内外都有哪些不错的操作系统呢？这里我们列举出15个用于渗透测试的操作系统，以及相关下载链接供大家参考选择！"}
{"title": "工具推荐：Androl4b，安卓安全评估测试利器", "url": "https://www.freebuf.com/sectool/95243.html", "time": "2016-02-02", "level": "金币+5", "num_look": 934993, "num_comment": 25, "author": "banish", "tags": ["工具"], "text": "Androl4b是一个基于ubuntu mate的安卓安全评估&测试的系统，系统集成了安全爱好者和研究者对于逆向工程以及恶意软件分析所需的工具。"}
{"title": "CTF工具集合安装脚本操作姿势", "url": "https://www.freebuf.com/sectool/94235.html", "time": "2016-02-02", "level": "金币+5", "num_look": 1016830, "num_comment": 10, "author": "FireFrank", "tags": ["工具"], "text": "这是一个创建各种搜索工具的安装脚本。当然，这并不难，但是把他们整合起来是一件非常给力的事儿，因为这样在新的机器上部署这些东西就会变得很简单了。"}
{"title": "2015 微软Windows漏洞报告", "url": "https://www.freebuf.com/news/topnews/95317.html", "time": "2016-02-02", "level": "", "num_look": 328244, "num_comment": 3, "author": "寰者", "tags": ["头条", "系统安全"], "text": "本文主要针对2015年微软、谷歌等公司相应产品新的安全防护机制或安全功能进行分析。"}
{"title": "OpPuraVida进行时：匿名者组织（Anonymous）入侵哥斯达黎加政府服务器", "url": "https://www.freebuf.com/news/95231.html", "time": "2016-02-02", "level": "", "num_look": 151077, "num_comment": 2, "author": "欢脱的小火鸡", "tags": ["文章", "资讯"], "text": "匿名者组织与LulzSec组织的支持者们一起入侵了哥斯达黎加外交部的服务器并且泄露了在其中的注册用户的登录信息。这一次活动是以OpPuraVida运动为旗号进行的。"}
{"title": "世界最大执法人员组织“美国警察同业会”计算机系统遭黑客攻击", "url": "https://www.freebuf.com/news/95363.html", "time": "2016-02-01", "level": "", "num_look": 250108, "num_comment": 2, "author": "亲爱的兔子", "tags": ["资讯"], "text": "日前，世界上最大的执法人员组织“美国警察同业会”计算机系统遭到黑客攻击，大量数据外泄。"}
{"title": "匿名者（Anonymous）入侵美国州议会网站，影响2016大选", "url": "https://www.freebuf.com/news/95249.html", "time": "2016-02-01", "level": "", "num_look": 210423, "num_comment": 4, "author": "FireFrank", "tags": ["资讯"], "text": "2016年爱荷华州党团会议网站遭\"匿名者保守派\"入侵，美国大选受到影响。"}
{"title": "OpenSSL高危漏洞：允许黑客解密HTTPS通信流量（CVE-2016-0701）", "url": "https://www.freebuf.com/vuls/95320.html", "time": "2016-02-01", "level": "金币+5", "num_look": 566060, "num_comment": 3, "author": "dawner", "tags": ["WEB安全", "数据安全"], "text": "OpenSSL加密代码库的维护者们宣布修复了一个高危漏洞。该漏洞能让黑客获取在HTTPS和其他安全传输层，对加密通信进行解密的密钥。"}
{"title": "美国 VisualThreat 车联网安全公司招聘", "url": "https://www.freebuf.com/articles/94184.html", "time": "2016-02-01", "level": "", "num_look": 302924, "num_comment": 12, "author": "tofreebug", "tags": ["安全招聘", "文章"], "text": "VisualThreat公司是国内最早涉足汽车安全领域的高科技创业公司。总部美国硅谷，分支在上海，北京和底特律。"}
{"title": "一个有趣的实例让NoSQL注入不再神秘", "url": "https://www.freebuf.com/articles/database/95314.html", "time": "2016-02-01", "level": "现金奖励", "num_look": 869466, "num_comment": 16, "author": "VillanCh", "tags": ["数据安全"], "text": "本文主要讲一下mongodb带来的安全问题，然后由一个有趣的CTF实例介绍对NoSQL的injection。"}
{"title": "走近YouTuBe上最受欢迎的黑客", "url": "https://www.freebuf.com/news/94668.html", "time": "2016-02-01", "level": "红色标题", "num_look": 681598, "num_comment": 23, "author": "0xroot", "tags": ["头条", "资讯"], "text": "骚年，还记得《FreeBuf2014贺岁视频: 极客教你如何劫持无人机》这篇文章吗，今天我们要说的主角就是教我们劫持无人机的这个极客。"}
{"title": "OWASP ZSC Shellcoder：定制个人专属Shellcode", "url": "https://www.freebuf.com/sectool/95250.html", "time": "2016-02-01", "level": "金币+5", "num_look": 326339, "num_comment": 3, "author": "FireFrank", "tags": ["工具"], "text": "OWASP ZSC是一款用Python编写的开源软件，它可以帮助你在你的操作系统中生成自定义的Shellcode。"}
{"title": "移动应用渗透测试的军火库清单", "url": "https://www.freebuf.com/sectool/95284.html", "time": "2016-02-01", "level": "金币+5", "num_look": 829151, "num_comment": 15, "author": "Rabbit_Run", "tags": ["工具", "终端安全"], "text": "本文将针对主流移动平台（Android和iOS）的渗透测试工具按照类别整理出来，同时对每个工具进行了简短介绍并列出推荐指数。"}
{"title": "安卓提权漏洞分析（CVE-2014-7920、CVE-2014-7921）", "url": "https://www.freebuf.com/vuls/94509.html", "time": "2016-02-01", "level": "金币+5", "num_look": 288872, "num_comment": 2, "author": "vul_wish", "tags": ["漏洞"], "text": "近日，安全专家发现两个安卓漏洞，若两者结合使用，就可以在mediaserver进程中执行任意代码，且没有任何权限要求。"}
{"title": "乌克兰电网攻击第二季", "url": "https://www.freebuf.com/news/95269.html", "time": "2016-01-31", "level": "", "num_look": 373664, "num_comment": 5, "author": "Threatbook", "tags": ["系统安全", "资讯"], "text": "微步在线近日捕获的威胁信息表明：攻击者伪装成乌克兰国家电力公司定向发送精心伪装的钓鱼邮件，且此次使用的木马并非BlackEnergy。"}
{"title": "虚拟主机管理公司cPanel被黑，用户数据泄露", "url": "https://www.freebuf.com/news/94977.html", "time": "2016-01-31", "level": "", "num_look": 202084, "num_comment": 4, "author": "简单", "tags": ["资讯"], "text": "近日，虚拟主机管理公司cPanel承认被黑，已通知用户其信息或已被泄露。"}
{"title": "领跑全球安全行业，为什么是以色列？", "url": "https://www.freebuf.com/news/topnews/95136.html", "time": "2016-01-31", "level": "红色标题", "num_look": 357092, "num_comment": 5, "author": "明明知道", "tags": ["头条"], "text": "以色列还被誉为“中东硅谷”，目前以色列拥有超过300家网络安全公司，更是缔造了仅次于美国的全球第二大安全产业规模。"}
{"title": "DLL注入的几种姿势（二）：CreateRemoteThread And More", "url": "https://www.freebuf.com/articles/system/94693.html", "time": "2016-01-31", "level": "", "num_look": 1245702, "num_comment": 6, "author": "老王隔壁的白帽子", "tags": ["系统安全"], "text": "关于这个系列其实有很多内容，并且在给出的实例都是自己编写的源码，在Open security和Infosec Institute中也有相关文章介绍。"}
{"title": "Kali 2.0安装与使用指南", "url": "https://www.freebuf.com/sectool/95167.html", "time": "2016-01-31", "level": "现金奖励", "num_look": 2888877, "num_comment": 35, "author": "coco413", "tags": ["头条", "工具"], "text": "在本文中给大家介绍安装Kali之后，最接近正确配置的kali过程。"}
{"title": "极客DIY：打造属于自己的无线移动渗透测试箱", "url": "https://www.freebuf.com/articles/95220.html", "time": "2016-01-30", "level": "金币+8", "num_look": 506708, "num_comment": 8, "author": "亲爱的兔子", "tags": ["文章", "极客"], "text": "下面介绍的这个箱子被称为“MiTM(中间人攻击)WiFi箱”，使用这个箱子可以完成一些无线审计工作，同时也可以伪造接入点并完成中间人攻击。"}
{"title": "第二届XCTF联赛：ZCTF-writeup", "url": "https://www.freebuf.com/articles/web/94444.html", "time": "2016-01-30", "level": "现金奖励", "num_look": 998119, "num_comment": 7, "author": "lyuchen65", "tags": ["WEB安全"], "text": "第二届XCTF联赛郑州站比赛暨”赛客”杯网络安全对抗赛现已正式开启，ZCTF比赛分为线上初赛和线下决赛，我们一起来看看线上初赛的一些解题思路吧。"}
{"title": "Linux内核ROP姿势详解(一)", "url": "https://www.freebuf.com/articles/system/94198.html", "time": "2016-01-30", "level": "", "num_look": 696078, "num_comment": 1, "author": "FireFrank", "tags": ["系统安全"], "text": "ROP（Return-oriented programming）是一种新型基于代码复用技术的攻击，攻击者供已有的库或可执行文件中提取指令片段、构建恶意代码。"}
{"title": "加拿大基础设施平均2天遭遇一次大规模黑客攻击", "url": "https://www.freebuf.com/news/94873.html", "time": "2016-01-30", "level": "", "num_look": 144713, "num_comment": 3, "author": "简单", "tags": ["资讯"], "text": "大约两个月内，加拿大重要基础设施遭遇了25次国家支持的黑客攻击。"}
{"title": "紧跟谷歌脚步，三星修复Galaxy高危漏洞", "url": "https://www.freebuf.com/news/95049.html", "time": "2016-01-29", "level": "", "num_look": 248422, "num_comment": 3, "author": "dawner", "tags": ["终端安全", "资讯"], "text": "三星本月发布的最新版本的漏洞修复中，包含有对任意代码执行、内存错误、重置出厂设置，以及重新激活锁（FRP/RL）漏洞的补丁。"}
{"title": "2016 黑客必备的Android应用都有哪些？", "url": "https://www.freebuf.com/sectool/95020.html", "time": "2016-01-29", "level": "", "num_look": 1640982, "num_comment": 55, "author": "w85040", "tags": ["工具", "无线安全"], "text": "根据业界的一系列评测以及亲身经验，我们整理出了这份最佳Android黑客应用清单。"}
{"title": "Windows平台shellcode开发入门（二）", "url": "https://www.freebuf.com/articles/system/94774.html", "time": "2016-01-29", "level": "金币+8", "num_look": 454713, "num_comment": 6, "author": "Rabbit_Run", "tags": ["系统安全"], "text": "为能够正确地编写 Windows 平台的 Shellcode ，作者将会在本文中讲述所需要的信息：进程环境块 ， PE 文件格式及 X86 汇编简介。"}
{"title": "Ruby on Rails 远程代码执行漏洞分析 (CVE-2016-0752)", "url": "https://www.freebuf.com/vuls/94714.html", "time": "2016-01-29", "level": "金币+8", "num_look": 456918, "num_comment": 6, "author": "老王隔壁的白帽子", "tags": ["漏洞"], "text": "如果你的应用中使用了动态渲染路径，那么很不幸，该应用目前存在通过本地文件包含而导致远程代码执行的漏洞。"}
{"title": "如何正确的对安卓手机进行数据恢复？", "url": "https://www.freebuf.com/articles/database/94792.html", "time": "2016-01-29", "level": "现金奖励", "num_look": 1731073, "num_comment": 66, "author": "叶大人", "tags": ["数据安全"], "text": "想干好一件事，绝不是仅仅机械性的重复固有动作，必须要加入个人的思考。比如对安卓手机的数据恢复，你真的会吗？"}
{"title": "BackBox 4.5新版本发布", "url": "https://www.freebuf.com/sectool/94790.html", "time": "2016-01-29", "level": "", "num_look": 277647, "num_comment": 7, "author": "亲爱的兔子", "tags": ["工具"], "text": "BackBox是基于Ubuntu的Linux发行版，同时它也是一款用于网络渗透测试及安全评估的操作系统。"}
{"title": "平安科技招募各类安全工程师", "url": "https://www.freebuf.com/jobs/92315.html", "time": "2016-01-29", "level": "", "num_look": 259399, "num_comment": 8, "author": "hereholly", "tags": ["安全招聘"], "text": "平安科技（深圳）产品安全团队面向平安集团的核心业务，负责移动互联网金融产品、银行业务、保险业务等的安全保障工作。"}
{"title": "雅虎邮箱XSS漏洞细节分析", "url": "https://www.freebuf.com/vuls/94255.html", "time": "2016-01-29", "level": "金币+8", "num_look": 386432, "num_comment": 9, "author": "dawner", "tags": ["WEB安全", "漏洞"], "text": "本月雅虎邮箱爆出了一个XSS漏洞，该漏洞允许代码嵌入特殊格式的电子邮件。在用户预览邮件时，不知不觉就会自动触发XSS。"}
{"title": "Chrome恶意扩展程序可监控用户上网行为", "url": "https://www.freebuf.com/news/94787.html", "time": "2016-01-29", "level": "", "num_look": 234932, "num_comment": 2, "author": "亲爱的兔子", "tags": ["漏洞", "资讯"], "text": "近日安全公司Malwarebytes的研究人员对一款恶意Chrome扩展程序进行了深入调查。"}
{"title": "使用Radare2和Ruby开发恶意软件配置解析器", "url": "https://www.freebuf.com/articles/system/94912.html", "time": "2016-01-28", "level": "", "num_look": 608497, "num_comment": 2, "author": "banish", "tags": ["系统安全"], "text": "Radare2这款开源代码的逆向工程平台近来得到了很多关注，这里我不仅仅想浏览一些文档，我还想尝试用Radare来实现遍历代码。"}
{"title": "想知道WiFi密码？摸摸香蕉吧！", "url": "https://www.freebuf.com/news/94656.html", "time": "2016-01-28", "level": "金币+8", "num_look": 422611, "num_comment": 12, "author": "亲爱的兔子", "tags": ["极客", "资讯"], "text": "过去在公共场所你可能需要问周围人或查看墙上贴的纸条才能知道WiFi的密码，而现在你只需要一根香蕉就可以解决这个问题。"}
{"title": "如何防范Windows命令行工具遭黑客滥用？", "url": "https://www.freebuf.com/articles/system/94675.html", "time": "2016-01-28", "level": "金币+8", "num_look": 330703, "num_comment": 5, "author": "东二门陈冠希", "tags": ["系统安全"], "text": "本文中的这个项目将展示如何通过揭露攻击者在被入侵的Windows操作系统上所使用的Windows命令以及限制普通用户不必要的命令执行来减轻攻击所造成的影响。"}
{"title": "辟谣：以色列电网躺枪，被黑的是电力局", "url": "https://www.freebuf.com/news/94862.html", "time": "2016-01-28", "level": "", "num_look": 196807, "num_comment": 5, "author": "Threatbook", "tags": ["资讯"], "text": "微步在线（Treatbook）根据已有的线索和报道，确认此次被攻破的是以色列国家电力局，而非国家电网系统。"}
{"title": "NanoLocker勒索软件的逆向分析", "url": "https://www.freebuf.com/articles/network/94595.html", "time": "2016-01-28", "level": "金币+8", "num_look": 399440, "num_comment": 2, "author": "FireFrank", "tags": ["网络安全"], "text": "这个勒索软件和赛门铁克以前发布的分析文章中阐述的勒索软件不同，它很不寻常。鉴于这一事实，笔者决定逆向几个样品，了解一下它是怎么工作的。"}
{"title": "斯诺登再出山，质疑ISIS巴黎攻击宣传视频", "url": "https://www.freebuf.com/news/94690.html", "time": "2016-01-28", "level": "", "num_look": 254595, "num_comment": 2, "author": "FireFrank", "tags": ["资讯"], "text": "斯诺登认为\"ISIS视频中的'加密邮箱'已经被确认是伪造的了。\""}
{"title": "Python渗透测试工具合集", "url": "https://www.freebuf.com/sectool/94777.html", "time": "2016-01-28", "level": "金币+8", "num_look": 1749566, "num_comment": 42, "author": "xiaix", "tags": ["工具"], "text": "如果你热爱漏洞研究、逆向工程或者渗透测试，我强烈推荐你使用 Python 作为编程语言。"}
{"title": "HTTP Evasions原理解析：分块传输绕过防火墙", "url": "https://www.freebuf.com/articles/network/94506.html", "time": "2016-01-28", "level": "", "num_look": 523552, "num_comment": 4, "author": "老王隔壁的白帽子", "tags": ["网络安全"], "text": "本文主要是通过Transfer-Encoding字段分块请求包来绕过防火墙。"}
{"title": "Pastebin Hacking新姿势：使用jQuery替换进行恶意软件传播", "url": "https://www.freebuf.com/articles/web/94237.html", "time": "2016-01-28", "level": "", "num_look": 325288, "num_comment": 7, "author": "寰者", "tags": ["WEB安全"], "text": "随着各种网络技术不断发展，黑客对于网站攻击也总是不断变换策略以及通过互相之间的交流来改进攻击技术。"}
{"title": "Operation Emmental：攻击移动银行用户的犯罪行动", "url": "https://www.freebuf.com/news/94430.html", "time": "2016-01-28", "level": "金币+8", "num_look": 193333, "num_comment": 1, "author": "dawner", "tags": ["终端安全", "资讯"], "text": "想像一下这样一个情景：你的“银行”来了一个通知，给你一个链接让你下载并更新你的手机应用。下载了应用后，它会向你请求获取管理权限。"}
{"title": "Dridex出现新型变种木马，专攻英国银行客户", "url": "https://www.freebuf.com/news/94149.html", "time": "2016-01-27", "level": "", "num_look": 192255, "num_comment": 1, "author": "JackFree", "tags": ["资讯"], "text": "根据IBM X-Force团队安全专家们的消息，他们发现了一波通过Andromeda僵尸网络传播的新型恶意活动。"}
{"title": "Google Nest智能设备逆向姿势详解", "url": "https://www.freebuf.com/articles/terminal/94544.html", "time": "2016-01-27", "level": "", "num_look": 241889, "num_comment": 3, "author": "erutluv", "tags": ["终端安全"], "text": "Nest的产品中一个比较厉害的特点就是它们全部都是些只能通过Web操作的产品，而获取Nest摄像头或者恒温器数据的唯一途径就是通过Nests的云。"}
{"title": "RWMC：利用PowerShell提取Windows账号密码的利器", "url": "https://www.freebuf.com/sectool/94559.html", "time": "2016-01-27", "level": "金币+8", "num_look": 462703, "num_comment": 11, "author": "JackFree", "tags": ["工具"], "text": "RWMC是一个Windows PowerShell脚本，使用它和CDB命令行选项就可以提取Windows凭证。"}
{"title": "联想茄子快传（Lenovo ShareIT）被曝多处漏洞", "url": "https://www.freebuf.com/articles/terminal/94519.html", "time": "2016-01-27", "level": "", "num_look": 351745, "num_comment": 9, "author": "东二门陈冠希", "tags": ["终端安全"], "text": "茄子快传是一款跨平台近场传输软件，可支持安卓/苹果/电脑/WP等设备,其服务被爆存在硬编码密码、信息泄露、敏感信息没有加密、未授权漏洞。"}
{"title": "全国招聘：启明星辰邀您共解烧脑高数题", "url": "https://www.freebuf.com/jobs/94357.html", "time": "2016-01-27", "level": "", "num_look": 438915, "num_comment": 77, "author": "花小花", "tags": ["安全招聘"], "text": "启明星辰招聘信息安全顾问、安全服务工程师、安全运维工程师，小伙伴赶快砸简历吧！"}
{"title": "FreeBSD远程DoS攻击的利用分析（CVE-2016-1879）", "url": "https://www.freebuf.com/vuls/94591.html", "time": "2016-01-27", "level": "", "num_look": 403026, "num_comment": 5, "author": "dawner", "tags": ["漏洞", "系统安全"], "text": "FreeBSD团队宣布他们的操作系统存在严重的漏洞，黑客可以利用这个漏洞进行DoS（拒绝服务）攻击，提权或窃取系统敏感信息。"}
{"title": "利用Linux内核的信息泄露绕过kALSR防护机制", "url": "https://www.freebuf.com/vuls/94530.html", "time": "2016-01-27", "level": "", "num_look": 337223, "num_comment": 4, "author": "Rabbit_Run", "tags": ["漏洞", "系统安全"], "text": "据研究人员所知，主流发行版默认不开启kALSR防护机制。"}
{"title": "如何用Scapy写一个端口扫描器？", "url": "https://www.freebuf.com/sectool/94507.html", "time": "2016-01-27", "level": "", "num_look": 829384, "num_comment": 17, "author": "xiaix", "tags": ["工具"], "text": "文中讲解每种扫描的原理，随后会提供具体实现代码。"}
{"title": "Magento存在XSS漏洞，在线商城可被攻击者操控", "url": "https://www.freebuf.com/vuls/94277.html", "time": "2016-01-27", "level": "", "num_look": 247089, "num_comment": 1, "author": "寰者", "tags": ["漏洞"], "text": "Magento是一套开源的电子商务系统，可处理电子商务各方面的需求，包括像购物、航运、产品评论等等，帮助建设多用途和适用面广的电子商务网站。"}
{"title": "白帽子发现美军网站SQL注入漏洞，可获取敏感数据", "url": "https://www.freebuf.com/news/94549.html", "time": "2016-01-26", "level": "", "num_look": 254632, "num_comment": 10, "author": "SamSmith", "tags": ["漏洞", "资讯"], "text": "去年有报道称，美军收购软件漏洞为网战准备。而美军自己的网站和服务器究竟又有多安全？"}
{"title": "PayPal远程命令执行漏洞分析", "url": "https://www.freebuf.com/vuls/94445.html", "time": "2016-01-26", "level": "", "num_look": 391863, "num_comment": 4, "author": "老王隔壁的白帽子", "tags": ["WEB安全", "漏洞"], "text": "2015年12月，笔者在PayPal的某个分站中发现了一个能够远程执行任意shell命令的java反序列化漏洞，并且能够影响到PayPal的产品数据库。"}
{"title": "Broadlink智能生态系列漏洞详解", "url": "https://www.freebuf.com/articles/terminal/94485.html", "time": "2016-01-26", "level": "", "num_look": 388862, "num_comment": 7, "author": "阿里安全", "tags": ["终端安全"], "text": "我们将以Broadlink的智能插座作为研究目标来窥探整个博联智能生态网络的安全，该系列漏洞在2015年的GeekPWN智能设备破解上演示过。"}
{"title": "渗透系统Parrot Security OS新版本发布", "url": "https://www.freebuf.com/sectool/94192.html", "time": "2016-01-26", "level": "", "num_look": 366387, "num_comment": 19, "author": "亲爱的兔子", "tags": ["工具"], "text": "Parrot Security OS是一款基于Debian渗透测试系统，团队对这一版本做了很过测试，并更新了云端版，使得新版系统更加稳定高效。"}
{"title": "沙盒游戏《我的世界》惊现仿冒游戏下载器", "url": "https://www.freebuf.com/articles/94456.html", "time": "2016-01-26", "level": "", "num_look": 488907, "num_comment": 1, "author": "AVLTeam", "tags": ["数据安全", "文章"], "text": "《我的世界》是一款自由度极高的沙盒游戏，上线以来，一直备受网友追捧。但是，一款仿冒《我的世界》游戏下载器的恶意软件被截获。"}
{"title": "嘲风网络安全技术沙龙", "url": "https://www.freebuf.com/fevents/94477.html", "time": "2016-01-26", "level": "", "num_look": 233449, "num_comment": 10, "author": "路由器", "tags": ["活动"], "text": "嘲风网络安全技术沙龙将于2016年1月28日20时在昆明举行。"}
{"title": "Skype用户的春天：IP地址终于可以匿了", "url": "https://www.freebuf.com/news/94433.html", "time": "2016-01-26", "level": "", "num_look": 408183, "num_comment": 4, "author": "dawner", "tags": ["网络安全", "资讯"], "text": "Skype本周在一篇官方博文中宣布，他们现在可以隐藏用户的IP地址，保护用户不受网络攻击的侵害。最新版本的Skype软件默认启用了这个新的安全特性。"}
{"title": "X86-64下的汇编代码调试解析", "url": "https://www.freebuf.com/articles/web/94291.html", "time": "2016-01-26", "level": "金币+8", "num_look": 527842, "num_comment": 5, "author": "老王隔壁的白帽子", "tags": ["WEB安全"], "text": "这篇文章对于一些经常用gdb的大牛来说应该是最基本的东西了，但是这里我只想分享一些基本的工具或者其他我找到的一些有用的东西。"}
{"title": "如何设置并使用Firefox沙盒？", "url": "https://www.freebuf.com/sectool/94194.html", "time": "2016-01-26", "level": "金币+8", "num_look": 367462, "num_comment": 2, "author": "寰者", "tags": ["WEB安全", "工具"], "text": "本文描述及介绍了Firefox浏览器中一些比较常见的沙盒设置，可作为平时闲暇时操作的参考。"}
{"title": "世界十大黑客组织都是哪些？", "url": "https://www.freebuf.com/news/94263.html", "time": "2016-01-26", "level": "红色标题", "num_look": 1262393, "num_comment": 10, "author": "丝绸之路", "tags": ["资讯"], "text": "这里梳理了十大黑客组织，看看他们是如何“改变世界”的。"}
{"title": "GCHQ自建的语音加密协议存在后门，可解密所有VoIP通信", "url": "https://www.freebuf.com/news/94098.html", "time": "2016-01-26", "level": "", "num_look": 290865, "num_comment": 1, "author": "简单", "tags": ["数据安全", "资讯"], "text": "英国政府自制一个官方语音加密协议——MIKEY-SAKKE，希望能建立一个产品生态系统，然而里面存在一个严重后门。"}
{"title": "技术分析：Apple syslogd提权漏洞，影响众多iOS、OSX版本（CVE-2016-1722）", "url": "https://www.freebuf.com/vuls/94236.html", "time": "2016-01-25", "level": "", "num_look": 250160, "num_comment": 3, "author": "江湖小吓", "tags": ["漏洞", "终端安全"], "text": "这次iOS 9.2.1最新更新中苹果修复了一个代码执行漏洞，这一漏洞在Mac OSX中也同样存在，而且众多版本受到影响！"}
{"title": "黑客组织匿名者(Anonymous)攻击日本机场网站，抗议捕杀海豚活动", "url": "https://www.freebuf.com/news/94349.html", "time": "2016-01-25", "level": "", "num_look": 321018, "num_comment": 8, "author": "亲爱的兔子", "tags": ["资讯"], "text": ""}
{"title": "极客DIY：廉价电视棒玩转GNSS-SDR，实现GPS实时定位", "url": "https://www.freebuf.com/articles/wireless/94213.html", "time": "2016-01-25", "level": "", "num_look": 918519, "num_comment": 7, "author": "Rabbit_Run", "tags": ["无线安全", "极客"], "text": "realtek瑞昱RTL2832U芯片,也称作电视棒，很多安全爱好者都用它接收ADS-B飞机信号，在这篇文章里，我们将用它来实现GPS实时定位。"}
{"title": "使用PowerShell脚本做Windows键盘记录器", "url": "https://www.freebuf.com/geek/94309.html", "time": "2016-01-25", "level": "", "num_look": 457084, "num_comment": 4, "author": "xiaix", "tags": ["极客"], "text": "最近终于有机会为我经常借鉴学习的项目 PowerSploit 做出了贡献。"}
{"title": "FIT 2016集锦：一个Sales Man的自我修养（视频）", "url": "https://www.freebuf.com/news/topnews/93960.html", "time": "2016-01-25", "level": "红色标题", "num_look": 444145, "num_comment": 4, "author": "FB独家", "tags": ["头条", "视频"], "text": "无论你是技术人员、安全小白，还是销售或企业管理者，都不该错过他的声音。"}
{"title": "网络间谍又添利器：新型远程访问木马Trochilus", "url": "https://www.freebuf.com/news/94240.html", "time": "2016-01-25", "level": "", "num_look": 250848, "num_comment": 8, "author": "JackFree", "tags": ["资讯"], "text": "研究人员发现了一场新型的网络间谍活动，它依赖于大量远程访问木马（RAT），该木马背后的攻击者主要使用了包含了一个.RAR附件恶意软件的恶意邮件，并且它能够躲避沙箱分析。"}
{"title": "苏宁易购安全部门招聘", "url": "https://www.freebuf.com/jobs/93751.html", "time": "2016-01-25", "level": "", "num_look": 251877, "num_comment": 8, "author": "tombook", "tags": ["安全招聘"], "text": "苏宁易购，是苏宁电器旗下新一代B2C网上购物平台（www.suning.com）。"}
{"title": "好书推荐：《Wireshark网络分析的艺术》", "url": "https://www.freebuf.com/fevents/94090.html", "time": "2016-01-25", "level": "红色标题", "num_look": 1840998, "num_comment": 139, "author": "路由器", "tags": ["活动"], "text": "FreeBuf特别为你准备了一份新年好礼，众多大牛力荐的《Wireshark网络分析的艺术》一书，让你的技能知识在新年更上一个台阶！"}
{"title": "PowerShell利用工具：扩展你的Empire", "url": "https://www.freebuf.com/sectool/94275.html", "time": "2016-01-25", "level": "金币+8", "num_look": 378279, "num_comment": 4, "author": "dawner", "tags": ["工具", "系统安全"], "text": "本文将会展示Empire如何进行横向扩展，其中会涵盖提权、权限保持、数据挖掘、态势感知以及TrollSploit等等。"}
{"title": "HTTP Evasions原理解析：Deflate压缩绕过防火墙", "url": "https://www.freebuf.com/articles/web/94283.html", "time": "2016-01-25", "level": "", "num_look": 410063, "num_comment": 9, "author": "老王隔壁的白帽子", "tags": ["WEB安全"], "text": "本文是HTTP Evasions系列的第二篇文章，本文主要讲就是通过发送一个经过压缩的响应包来绕过防火墙。"}
{"title": "硬盘数据恢复的神器有哪些？", "url": "https://www.freebuf.com/sectool/94140.html", "time": "2016-01-25", "level": "红色标题", "num_look": 795368, "num_comment": 30, "author": "SamSmith", "tags": ["工具"], "text": "这里列举了十个用于硬盘数据恢复的工具。它们依靠效率和效果在众多同类工具中脱颖而出。让我们一同了解一下吧！"}
{"title": "Google财经被曝反射文件下载(RFD)漏洞", "url": "https://www.freebuf.com/articles/network/94044.html", "time": "2016-01-25", "level": "", "num_look": 382585, "num_comment": 8, "author": "vulture", "tags": ["网络安全"], "text": "一位葡萄牙的网络安全专家David Sopas发现了影响Google财经的一个反射文件下载(RFD)漏洞。"}
{"title": "巴西地下网络犯罪市场愈演愈烈", "url": "https://www.freebuf.com/news/93940.html", "time": "2016-01-25", "level": "", "num_look": 160781, "num_comment": 2, "author": "简单", "tags": ["资讯"], "text": "​趋势科技发表了一篇关于巴西地下网络犯罪的新报告，网络犯罪生态系统正在成为世界上最严峻的事情。"}
{"title": "英国核潜艇还在运行旧版操作系统，易遭网络攻击", "url": "https://www.freebuf.com/news/94173.html", "time": "2016-01-25", "level": "", "num_look": 302274, "num_comment": 2, "author": "亲爱的兔子", "tags": ["资讯"], "text": "在2014年4月8日微软正式终止Windows XP操作系统的服务支持，尽管该公司在过去18个月已发出了很多警告，仍然有很多公司和组织继续运行Windows XP操作系统。"}
{"title": "Applocker：Windows网络保护之应用程序控制策略", "url": "https://www.freebuf.com/sectool/93632.html", "time": "2016-01-24", "level": "", "num_look": 407041, "num_comment": 1, "author": "江湖小吓", "tags": ["工具", "网络安全"], "text": "应用白名单是一个很强大的技术，可以保护我们电脑免受未知的恶意软件的侵害，但它从来没有被真正地使用。"}
{"title": "DVRF：路由器漏洞练习靶机 Damn Vulnerable Router Firmware", "url": "https://www.freebuf.com/sectool/93695.html", "time": "2016-01-24", "level": "", "num_look": 307524, "num_comment": 2, "author": "我是酱油男", "tags": ["工具"], "text": "这个项目的目的是来帮助人们学习X86_64之外其他架构环境，同时还帮助人们探索路由器固件里面的奥秘。"}
{"title": "Adobe Reader及Acrobat Pro特权提升漏洞解析(CVE-2015-5090)", "url": "https://www.freebuf.com/vuls/93919.html", "time": "2016-01-24", "level": "", "num_look": 340773, "num_comment": 2, "author": "老王隔壁的白帽子", "tags": ["漏洞"], "text": "CVE-2015-5090是存在于Adobe Reader/Acrobat Pro中的一个bug，并且早在几个月前就已经被发现并提交至ZDI了。本文主要是讲这个bug的细节，并分享几种不同攻击方法。"}
{"title": "RSA大会网上注册被吐槽：收集注册者Twitter明文凭证", "url": "https://www.freebuf.com/news/94158.html", "time": "2016-01-24", "level": "", "num_look": 164587, "num_comment": 2, "author": "JackFree", "tags": ["资讯"], "text": "最近，安全专家们在Twitter上发现一个奇怪现象，那就是RSA信息安全大会网站注册页面要求收集注册者的Twitter登录明文凭证。"}
{"title": "内核区域URL过滤漏洞影响三星Note 3、Galaxy S6(CVE-2016-2036)", "url": "https://www.freebuf.com/vuls/94212.html", "time": "2016-01-23", "level": "", "num_look": 203420, "num_comment": 1, "author": "FireFrank", "tags": ["漏洞"], "text": "一个影响三星Note 3、Galaxy S6手机的Bug——内核区域的URL过滤会出现什么问题？"}
{"title": "使用UFW防火墙拦截特定IP地址", "url": "https://www.freebuf.com/articles/system/93992.html", "time": "2016-01-23", "level": "金币+10", "num_look": 351667, "num_comment": 8, "author": "Rabbit_Run", "tags": ["系统安全"], "text": "UFW（Uncomplicated Firewall）是一个iptables的前端应用程序，尤其适合作为单台服务器或主机的防火墙。"}
{"title": "Windows提权姿势之Hot Potato", "url": "https://www.freebuf.com/articles/system/93484.html", "time": "2016-01-23", "level": "", "num_look": 516610, "num_comment": 4, "author": "living", "tags": ["系统安全"], "text": "​Hot Potato适用于windows7,8,10,Server 2008,Server2012上的权限提升，是一种新颖的网络攻击方式。"}
{"title": "Hacking Team流量攻击之EXE攻击分析", "url": "https://www.freebuf.com/articles/system/93394.html", "time": "2016-01-23", "level": "现金奖励", "num_look": 505262, "num_comment": 5, "author": "LiukerTeam", "tags": ["系统安全"], "text": "上一篇文章《中间人攻击之html注入》中，已分析了IPA的三大攻击方式之一的html注入攻击。本文重点分析其EXE注入的攻击方式。"}
{"title": "Kali 2.0 Rolling版发布", "url": "https://www.freebuf.com/sectool/94051.html", "time": "2016-01-23", "level": "", "num_look": 770247, "num_comment": 33, "author": "亲爱的兔子", "tags": ["工具"], "text": "Kali2.0(2016.1)新版本发布啦！"}
{"title": "皇家墨尔本医院Windows XP电脑中毒，这病怎么治？", "url": "https://www.freebuf.com/news/93854.html", "time": "2016-01-23", "level": "", "num_look": 207781, "num_comment": 6, "author": "SamSmith", "tags": ["系统安全", "资讯"], "text": "澳大利亚皇家墨尔本医院Windows XP系统被一种病毒感染，导致医院陷入瘫痪，不仅很多医疗诊断工作采用人工方法处理，就连病人信息也受影响。"}
{"title": "美国伊朗“换囚”，美方释放一名伊朗黑客", "url": "https://www.freebuf.com/news/94009.html", "time": "2016-01-22", "level": "", "num_look": 191685, "num_comment": 6, "author": "亲爱的兔子", "tags": ["资讯"], "text": "目前美国已经释放四名伊朗人，其中有一名是伊朗黑客。"}
{"title": "深度分析微软Office RTF文件堆溢出漏洞（CVE-2016-0010）", "url": "https://www.freebuf.com/vuls/94027.html", "time": "2016-01-22", "level": "", "num_look": 417232, "num_comment": 5, "author": "老王隔壁的白帽子", "tags": ["漏洞"], "text": "这个漏洞是由于MS Office未能正确解析RTF文档所造成的堆溢出漏洞，成功利用此漏洞可以使得攻击者远程执行代码。"}
{"title": "苹果修复iOS严重漏洞，黑客可从设备窃取cookie（CVE-2016-1730）", "url": "https://www.freebuf.com/vuls/94001.html", "time": "2016-01-22", "level": "金币+10", "num_look": 390869, "num_comment": 3, "author": "dawner", "tags": ["WEB安全", "数据安全"], "text": "近日，苹果修复了iOS中一个严重的漏洞。这个漏洞允许黑客伪装成终端用户，获取网站未加密cookie的读写权限。"}
{"title": "“暗影大盗”远控木马分析报告", "url": "https://www.freebuf.com/articles/database/94054.html", "time": "2016-01-22", "level": "", "num_look": 520191, "num_comment": 9, "author": "腾讯电脑管家", "tags": ["安全报告", "数据安全"], "text": "经多个用户反馈，有骗子谎称交易游戏装备，将压缩包发过来诱导其点击其中的“图片”。"}
{"title": "Asacub进化史：如何从间谍软件到银行恶意软件", "url": "https://www.freebuf.com/news/93961.html", "time": "2016-01-22", "level": "金币+10", "num_look": 161028, "num_comment": 3, "author": "vul_wish", "tags": ["资讯"], "text": "近日，安全人员对移动端银行木马Trojan-Banker.AndroidOS.Asacub进行了深入分析，发现其恶意功能随着版本的改变不断增加。"}
{"title": "Windows平台shellcode开发入门（一）", "url": "https://www.freebuf.com/articles/system/93983.html", "time": "2016-01-22", "level": "金币+10", "num_look": 472759, "num_comment": 11, "author": "Rabbit_Run", "tags": ["系统安全"], "text": "本文简要介绍shellcode开发技术及其特点。理解这些概念可以有助于我们编写自己的shellcode。"}
{"title": "微软Office Excel远程代码执行漏洞（CVE-2016-0035）分析", "url": "https://www.freebuf.com/articles/terminal/93475.html", "time": "2016-01-22", "level": "", "num_look": 407674, "num_comment": 7, "author": "老王隔壁的白帽子", "tags": ["终端安全"], "text": "最近我发现了Excel程序（所有版本）在处理特别构造的excel文件时，存在一个Use-After-Free漏洞。"}
{"title": "哪些方法可以绕过PowerShell Execution Policy？", "url": "https://www.freebuf.com/articles/system/93829.html", "time": "2016-01-22", "level": "", "num_look": 516074, "num_comment": 2, "author": "mrzcpo", "tags": ["系统安全"], "text": "本文将介绍在没有系统管理员权限的情况下绕过PowerShell execution policy的15种方法。"}
{"title": "Noriben沙箱：分分钟搞定恶意软件", "url": "https://www.freebuf.com/sectool/93828.html", "time": "2016-01-22", "level": "金币+9", "num_look": 450706, "num_comment": 5, "author": "dawner", "tags": ["工具", "系统安全"], "text": "数年前，我构建了一个恶意软件分析沙箱脚本，用于每日的分析和逆向工作。现在让我给大家展示下如何在几秒钟内，不用太多设置，就能进行恶意软件分析。"}
{"title": "“123456”蝉联年度最弱密码", "url": "https://www.freebuf.com/news/93809.html", "time": "2016-01-22", "level": "", "num_look": 205496, "num_comment": 9, "author": "亲爱的兔子", "tags": ["资讯"], "text": "SplashData近日公布了2015年最糟糕密码排行榜，那么小伙伴们知道排在第一位的密码是什么吗？"}
{"title": "2015中国APT研究报告：中国是APT攻击的主要受害国", "url": "https://www.freebuf.com/articles/network/93916.html", "time": "2016-01-21", "level": "", "num_look": 553019, "num_comment": 5, "author": "奇安信威胁情报中心", "tags": ["安全报告", "网络安全"], "text": "中国是APT（高级持续性威胁）攻击的主要受害国，国内多个省、市受到不同程度的影响，其中北京、广东是重灾区，行业上教育科研、政府机构是APT攻击的重点关注领域。"}
{"title": "广州天融信招渗透测试人员与代码审计人员", "url": "https://www.freebuf.com/jobs/93477.html", "time": "2016-01-21", "level": "", "num_look": 277954, "num_comment": 27, "author": "topsec", "tags": ["安全招聘"], "text": ""}
{"title": "Kill Chain：Kali Linux 2.0下可匿名控制台", "url": "https://www.freebuf.com/sectool/93910.html", "time": "2016-01-21", "level": "", "num_look": 358021, "num_comment": 9, "author": "亲爱的兔子", "tags": ["工具"], "text": "Kill Chain 是Kali Linux 2.0系统中的一个可匿名的控制台，能与Tor、OpenVas、Veil-Evasion、Websploit、WiFite等工具联动，在渗透测试的时候进行辅助。"}
{"title": "技术分享：如何扫描统计全国Telnet默认口令", "url": "https://www.freebuf.com/articles/terminal/93851.html", "time": "2016-01-21", "level": "现金奖励", "num_look": 737499, "num_comment": 23, "author": "zrools", "tags": ["系统安全", "终端安全"], "text": "在日常工作中，我们经常会遇到针对全国甚至针对全网对某一漏洞/安全事件做数据统计分析。这时我们该怎么做呢？在本文中，我将用Telnet弱口令给大家做示范希，望能唤起相关人员的安全意识，以提高网络空间的安全防御…"}
{"title": "雅虎修复邮箱漏洞，研究人员获得一万美元奖金", "url": "https://www.freebuf.com/news/93873.html", "time": "2016-01-21", "level": "", "num_look": 217974, "num_comment": 5, "author": "亲爱的兔子", "tags": ["漏洞", "资讯"], "text": "目前雅虎修复了一个可被攻击者用于劫持用户邮箱的漏洞。"}
{"title": "HTTP逃逸原理解析：使用HTTP 0.9进行绕过", "url": "https://www.freebuf.com/articles/web/93699.html", "time": "2016-01-21", "level": "", "num_look": 445963, "num_comment": 7, "author": "老王隔壁的白帽子", "tags": ["WEB安全"], "text": "本文是HTTP逃逸系列的第一篇文章。主要是说大多数防火墙只是通过规则判断出错误的包进行阻塞，因此其实可以轻易的让防火墙无法理解的数据包绕过防火墙。"}
{"title": "网藤漏洞感知系统 | 漏洞盒子新品发布会（视频）", "url": "https://www.freebuf.com/news/93877.html", "time": "2016-01-21", "level": "", "num_look": 587632, "num_comment": 2, "author": "漏洞盒子", "tags": ["周边", "资讯"], "text": "2016 FreeBuf互联网安全创新大会（FIT）上，漏洞盒子发布了旗下最新产品——网藤智能安全系统（cvs.vulbox.com）"}
{"title": "Linux内核提权漏洞的分析和利用（CVE-2016-0728）", "url": "https://www.freebuf.com/vuls/93799.html", "time": "2016-01-21", "level": "", "num_look": 1026285, "num_comment": 16, "author": "SamSmith", "tags": ["漏洞"], "text": "目前有超过66%的安卓手机和1000万Linux PC和服务器都受到这项内存泄露漏洞的影响。"}
{"title": "MD5碰撞的演化之路", "url": "https://www.freebuf.com/articles/93780.html", "time": "2016-01-21", "level": "", "num_look": 557733, "num_comment": 18, "author": "360安全", "tags": ["文章"], "text": "自从王小云破解MD5算法后，国内外对MD5碰撞的相关研究与恶意利用从未停止。"}
{"title": "如何使用Metabrik实现恶意软件分析的自动化", "url": "https://www.freebuf.com/articles/system/93408.html", "time": "2016-01-21", "level": "", "num_look": 298087, "num_comment": 1, "author": "老王隔壁的白帽子", "tags": ["系统安全"], "text": "在这篇文章中我们会展示如何使用Metabrik来进行恶意软件分析的自动化，使你在对Windows系统建立了一个快照之后，就可以在虚拟机上运行恶意程序了。"}
{"title": "解析针对知名密码存储软件LastPass的钓鱼攻击", "url": "https://www.freebuf.com/articles/web/93727.html", "time": "2016-01-21", "level": "", "num_look": 256549, "num_comment": 1, "author": "xiaix", "tags": ["WEB安全"], "text": "最近作者发现了一个针对LastPass的钓鱼攻击，其允许攻击者窃取一个LastPass用户的邮箱、密码甚至二次验证的验证码，这就使得攻击者可以完全获取到用户存储在LastPass上的密码和文档。"}
{"title": "物理黑：关于HID的一些攻击姿势解析", "url": "https://www.freebuf.com/articles/system/92519.html", "time": "2016-01-21", "level": "现金奖励", "num_look": 531018, "num_comment": 17, "author": "mrzcpo", "tags": ["系统安全"], "text": "临近期末考试了，利用烧鹅配合一个简单的木马程序其实可以轻松的从老师的电脑里拿到考卷甚至答案，可惜太贵了。"}
{"title": "深夜话题：这十二行代码是如何让浏览器爆炸的？", "url": "https://www.freebuf.com/articles/terminal/93807.html", "time": "2016-01-20", "level": "红色标题", "num_look": 1516402, "num_comment": 107, "author": "0xroot", "tags": ["活动", "终端安全"], "text": "使用这十二行JavaScript代码能让firefox、chrome、safari等众多浏览器崩溃，甚至让iPhone重启！"}
{"title": "构建云安全体系前需了解的六个基本策略", "url": "https://www.freebuf.com/articles/neopoints/93693.html", "time": "2016-01-20", "level": "", "num_look": 223746, "num_comment": 4, "author": "青藤云安全", "tags": ["观点"], "text": ""}
{"title": "2016中国信息安全服务年会召开在即", "url": "https://www.freebuf.com/fevents/93791.html", "time": "2016-01-20", "level": "", "num_look": 225302, "num_comment": 5, "author": "路由器", "tags": ["活动"], "text": "“2016中国信息安全服务年会”以“信息安全服务走向‘互联网+’时代”为主题，将与1月24日在北京召开。"}
{"title": "从crash到漏洞利用：CVE-2015-6086越界读取漏洞分析（BYPASS ASLR）", "url": "https://www.freebuf.com/vuls/93682.html", "time": "2016-01-20", "level": "", "num_look": 488291, "num_comment": 6, "author": "老王隔壁的白帽子", "tags": ["WEB安全", "漏洞"], "text": "这是一个存在于Internet Explorer9-11中的越界读取bug。这个漏洞存在将近5年之久，直到2015年4月才被发现。"}
{"title": "PPmoney招聘网络安全工程师", "url": "https://www.freebuf.com/jobs/93608.html", "time": "2016-01-20", "level": "", "num_look": 206028, "num_comment": 8, "author": "韩晓东", "tags": ["安全招聘"], "text": "PPmoney互联网金融平台（ppmoney.com）由广州万惠投资管理有限公司负责运营，经营团队由金融服务、风险管理及电子商务等业界一流的专业人士组成。"}
{"title": "美国白宫高级顾问John Holdren成为黑客组织最新攻击目标", "url": "https://www.freebuf.com/news/93669.html", "time": "2016-01-20", "level": "", "num_look": 184550, "num_comment": 2, "author": "亲爱的兔子", "tags": ["资讯"], "text": "​继CIA局长John Brennan、FBI副局长Mark Giuliano、美国国家情报局局长James Clapper之后，现在，又一位美国政府官员遭到了黑客的袭击，这次沦为受害者的则是奥巴马总统科学技术高级顾问John Holdren。"}
{"title": "CrackMapExec：域环境渗透中的瑞士军刀", "url": "https://www.freebuf.com/sectool/93680.html", "time": "2016-01-20", "level": "", "num_look": 543699, "num_comment": 17, "author": "0xroot", "tags": ["工具"], "text": "CrackMapExec：使用Python编写的一款工具，堪称Windows 活动目录/域 环境渗透测试里的一把瑞士军刀，这工具功能真的很强大！"}
{"title": "IE漏洞攻防编年简史", "url": "https://www.freebuf.com/articles/system/93598.html", "time": "2016-01-20", "level": "", "num_look": 313289, "num_comment": 4, "author": "阿尔法实验室", "tags": ["系统安全"], "text": "本文对历史上的微软IE 浏览器的影响较大0day做了梳理，讨论了IE漏洞在攻击防御技术上的进化，以及记录了此类漏洞前人们在历史上遗留下来的对抗经验和足迹。"}
{"title": "GeekPwn2016打造全新赛制，澳门站全球黑客招募", "url": "https://www.freebuf.com/fevents/93631.html", "time": "2016-01-20", "level": "", "num_look": 255044, "num_comment": 4, "author": "geekpwn", "tags": ["活动"], "text": "GeekPwn2016来了！1月20日，世界黑客大赛GeekPwn（极棒）2016正式发布黑客招募令，将于5月12日举办澳门站比赛。"}
{"title": "网银木马分析：警惕山寨版“话费充值软件”", "url": "https://www.freebuf.com/articles/terminal/93671.html", "time": "2016-01-20", "level": "", "num_look": 270922, "num_comment": 28, "author": "360安全", "tags": ["终端安全"], "text": "360成都反病毒中心拦截到一类隐蔽在话费充值软件包中的病毒，用户感染该病毒后，会出现资金被盗的情况。"}
{"title": "Linux新型木马Ekocms出现，会截屏、录音", "url": "https://www.freebuf.com/news/93660.html", "time": "2016-01-20", "level": "", "num_look": 235847, "num_comment": 5, "author": "亲爱的兔子", "tags": ["漏洞", "资讯"], "text": "俄罗斯杀软厂商Dr.Web近日发现了Linux平台新型木马Linux.Ekocms.1。目前从截获的木马样本来看，该木马能够截屏和录制音频文件，并发送给远程服务器。"}
{"title": "暗黑客栈CVE-2015-8651漏洞原理分析", "url": "https://www.freebuf.com/articles/network/93516.html", "time": "2016-01-20", "level": "", "num_look": 534011, "num_comment": 2, "author": "安天追影", "tags": ["网络安全"], "text": "2015年12月28号，Adobe发布安全公告修补了19个漏洞。其中一个漏洞CVE-2015-8651被境外“暗黑客栈”组织用于对国内企业高管发起APT攻击。"}
{"title": "钓鱼攻击工具包Angler Exploit Kit已感染超过90,000个网站", "url": "https://www.freebuf.com/news/93594.html", "time": "2016-01-20", "level": "金币+6", "num_look": 150626, "num_comment": 1, "author": "vul_wish", "tags": ["资讯"], "text": "近期，Palo Alto Networks的分析报告显示，Angler Exploit Kit的持续感染已经导致超过90000个网站被攻破，且大多数网站在Alexa排名的前十万中。"}
{"title": "黑暗力量（BlackEnergy）再现，乌克兰最大机场网络遭到攻击", "url": "https://www.freebuf.com/news/93601.html", "time": "2016-01-20", "level": "", "num_look": 231127, "num_comment": 1, "author": "亲爱的兔子", "tags": ["资讯"], "text": "据最新消息称，乌克兰方面在找到基辅鲍里斯波尔机场遭受网络攻击的证据后，已经向所有的系统管理人员发出警告。"}
{"title": "韩剧《幽灵》中的黑客工具都有哪些？", "url": "https://www.freebuf.com/news/topnews/93415.html", "time": "2016-01-19", "level": "金币+6", "num_look": 966226, "num_comment": 39, "author": "raycel", "tags": ["其他", "头条"], "text": "相信安全圈里边，绝大多数人都有看过韩剧《幽灵》，这部电视剧中，荧幕上的黑客情节里都有哪些我们所熟悉的工具、技术出现呢？我们一起来看看吧。"}
{"title": "挥手过安检：他借助植入手掌的芯片而成功登机", "url": "https://www.freebuf.com/news/93350.html", "time": "2016-01-19", "level": "金币+6", "num_look": 249275, "num_comment": 11, "author": "亲爱的兔子", "tags": ["极客", "资讯"], "text": "近日在瑞典首都斯德哥尔摩阿兰达机场，安德里亚斯•斯约斯特罗姆 （Andreas Sjöström）借助皮下植入的智能芯片，成功登机。"}
{"title": "猪八戒网招聘安全工程师", "url": "https://www.freebuf.com/jobs/93537.html", "time": "2016-01-19", "level": "", "num_look": 258591, "num_comment": 19, "author": "齐迹", "tags": ["安全招聘"], "text": "猪八戒网安全招聘"}
{"title": "盗用过期数字签名的DDoS样本分析", "url": "https://www.freebuf.com/articles/network/93517.html", "time": "2016-01-19", "level": "", "num_look": 393004, "num_comment": 3, "author": "安天追影", "tags": ["网络安全"], "text": "2016年1月，安天追影小组通过安天态势感知系统发现了一款带有过期签名的DDoS恶意程序，该样本盗用了韩国NHN公司美国分公司的数字签名,以躲避杀软检测。"}
{"title": "Tails：一款专注于隐私保护的开源操作系统", "url": "https://www.freebuf.com/sectool/93470.html", "time": "2016-01-19", "level": "金币+5", "num_look": 323402, "num_comment": 9, "author": "亲爱的兔子", "tags": ["工具"], "text": "Tails是一个Live操作系统，旨在保护您的个人隐私，同时也可实现匿名访问网络，这在提供了便携性的同时，也能够更好地保护个人隐私。"}
{"title": "漏洞盒子12月“互联网漏洞之星”", "url": "https://www.freebuf.com/articles/others-articles/93219.html", "time": "2016-01-19", "level": "", "num_look": 144111, "num_comment": 5, "author": "漏洞盒子", "tags": ["其他"], "text": "回首2015，最长情的故事是白帽子们日夜的陪伴。"}
{"title": "“点击劫持”：伪造Cookie提示弹窗诱使用户点击", "url": "https://www.freebuf.com/news/92650.html", "time": "2016-01-19", "level": "", "num_look": 320960, "num_comment": 2, "author": "JackFree", "tags": ["安全管理", "资讯"], "text": "MalwareBytes的专家发现了一种“点击劫持”恶意活动，诱使用户点击一个看似合法的欧洲cookie法律通知，以此来达到盈利目的。"}
{"title": "深入剖析某国外组织针对中国境内企业的APT攻击(CVE-2015-8651)", "url": "https://www.freebuf.com/articles/network/93474.html", "time": "2016-01-19", "level": "", "num_look": 432051, "num_comment": 4, "author": "Threatbook", "tags": ["安全报告", "网络安全"], "text": "2015年12月31日，微步在线对一起利用Flash零日漏洞的APT攻击做了分析和预警，并通过溯源分析确定了其幕后的黑客组织为“DarkHotel”。"}
{"title": "火狐扩展中心持久性XSS分析", "url": "https://www.freebuf.com/articles/web/93424.html", "time": "2016-01-19", "level": "金币+5", "num_look": 380966, "num_comment": 4, "author": "老王隔壁的白帽子", "tags": ["WEB安全"], "text": "最近，国外有大牛发现Mozilla FireFox插件扩展中心存在Xss漏洞，究竟是什么问题导致的这一漏洞呢？我们一起来看这篇分析。"}
{"title": "解密BBOSS组织：全球超十二万站点的地下掌控者", "url": "https://www.freebuf.com/articles/system/93491.html", "time": "2016-01-19", "level": "红色标题", "num_look": 891483, "num_comment": 18, "author": "阿里安全", "tags": ["系统安全", "网络安全"], "text": "每一天我们都在疑惑，疑惑我们所处的世界，疑惑这个世界呈现出的不断超出我们认知的事物。"}
{"title": "IDAPython：让你的生活更美好（五）", "url": "https://www.freebuf.com/articles/system/93440.html", "time": "2016-01-19", "level": "金币+5", "num_look": 377341, "num_comment": 1, "author": "东二门陈冠希", "tags": ["系统安全"], "text": "我们继续IDAPython让生活更美好序列，这一部分我们解决逆向工程师日常遇到的问题：提取执行的内嵌代码。"}
{"title": "山东安云信息招聘网络安全人员（济南、青岛）", "url": "https://www.freebuf.com/jobs/90524.html", "time": "2016-01-19", "level": "", "num_look": 302984, "num_comment": 33, "author": "xxfocus", "tags": ["安全招聘"], "text": ""}
{"title": "BackdoorMe：功能强大的自动化后门", "url": "https://www.freebuf.com/sectool/93409.html", "time": "2016-01-18", "level": "金币+5", "num_look": 426557, "num_comment": 2, "author": "dawner", "tags": ["工具", "系统安全"], "text": "Backdoorme是一个拥有强大能力的Unix后门，其使用了强扩展性的metasploit接口。在未来，这种依赖性随着这款的工具的扩展会逐渐降低。"}
{"title": "DLL注入的几种姿势（一）：Windows Hooks", "url": "https://www.freebuf.com/articles/system/93413.html", "time": "2016-01-18", "level": "金币+5", "num_look": 1527274, "num_comment": 13, "author": "老王隔壁的白帽子", "tags": ["系统安全"], "text": "DLL注入的目的是将代码放进另一个进程的地址空间中，所以要怎样才能实现DLL注入呢？"}
{"title": "技术揭秘：如何分析中国菜刀是否包含后门？", "url": "https://www.freebuf.com/articles/system/93323.html", "time": "2016-01-18", "level": "现金奖励", "num_look": 1537278, "num_comment": 53, "author": "simeon", "tags": ["系统安全"], "text": "互联网上流传的工具很多是带有后门的，那么在著名的webshell管理工具中国菜刀会不会留有后门呢？"}
{"title": "政策有变，“晚婚假病毒”借机来袭", "url": "https://www.freebuf.com/articles/93416.html", "time": "2016-01-18", "level": "", "num_look": 345146, "num_comment": 6, "author": "腾讯电脑管家", "tags": ["文章", "网络安全"], "text": "国家将取消晚婚假。消息一出就一直备受大家的关注，新闻、政府文件也成为了大家获取第一手消息的主要途径。最近发现，有一类感染型病毒正借此机会大肆传播。"}
{"title": "黑客组织匿名者（Anonymous）公开泰国最高法院数据", "url": "https://www.freebuf.com/news/93291.html", "time": "2016-01-18", "level": "", "num_look": 182780, "num_comment": 5, "author": "亲爱的兔子", "tags": ["资讯"], "text": "在黑客组织“匿名者”发布 #BoycottThailand项目十天多天后，“匿名者”今日又宣称已对泰国最高法院网站发起网络攻击，并公开了近1GB的数据。"}
{"title": "四个参数搞定安卓驱动fuzzing！（附DeathFuzzer工具）", "url": "https://www.freebuf.com/sectool/92638.html", "time": "2016-01-18", "level": "现金奖励", "num_look": 386815, "num_comment": 15, "author": "成王败寇", "tags": ["工具", "终端安全"], "text": "安卓驱动的fuzz其实与linux驱动fuzz差不太多，都会使用ioctl或者直接读写的方式进行访问，所不同的是，由于安卓内核的精简性，你会受到很多开发环境上的制约。"}
{"title": "完美世界安全岗位招聘", "url": "https://www.freebuf.com/jobs/93305.html", "time": "2016-01-18", "level": "", "num_look": 188836, "num_comment": 6, "author": "何艺", "tags": ["安全招聘"], "text": "完美世界诚聘：安全开发、安全分析和安全运维工程师。"}
{"title": "Jinfinity：Java反序列化DDoS工具", "url": "https://www.freebuf.com/articles/93387.html", "time": "2016-01-18", "level": "金币+5", "num_look": 228441, "num_comment": 3, "author": "xiaix", "tags": ["文章"], "text": "伴随着很多关于 Java 反序列化漏洞的讨论，本文分享的是一款开源 DDoS 工具，你可以下载并使用它让目标耗尽所有的内存处理反序列对象，最终造成拒绝服务。"}
{"title": "木马SlemBunk再次进化，瞄准全球Android手机银行用户", "url": "https://www.freebuf.com/articles/93329.html", "time": "2016-01-17", "level": "", "num_look": 275518, "num_comment": 2, "author": "江湖小吓", "tags": ["文章"], "text": "FireEye专家们最近发现SlemBunk再次进化了，这次它变身成了一个瞄准全球手机银行用户的强大的Android木马。"}
{"title": "Mac GateKeeper漏洞补丁无效，仍可被绕过进行攻击", "url": "https://www.freebuf.com/vuls/93357.html", "time": "2016-01-17", "level": "", "num_look": 266979, "num_comment": 1, "author": "寰者", "tags": ["漏洞", "终端安全"], "text": "近日，安全专家Patrick Wardle称，此前苹果发布的用于修复加固Mac OS X GateKeeper漏洞的补丁是无效的。"}
{"title": "ISIS开发新型加密安卓通讯软件", "url": "https://www.freebuf.com/news/93331.html", "time": "2016-01-17", "level": "", "num_look": 298428, "num_comment": 1, "author": "亲爱的兔子", "tags": ["资讯"], "text": "据报道：目前ISIS又开发了一款新的通信软件。"}
{"title": "基于用户命令行为的内部威胁检测实验", "url": "https://www.freebuf.com/articles/database/93108.html", "time": "2016-01-16", "level": "现金奖励", "num_look": 614518, "num_comment": 2, "author": "木千之", "tags": ["安全管理", "数据安全"], "text": "作为抛砖引玉，今天我就为大家带来一个基于用户命令行为数据的内部威胁检测实验，希望在FreeBuf上可以涌现更多机器学习在安全领域应用研究的好文章。"}
{"title": "一款无线安全渗透测试套件：WiFi-Pumpkin", "url": "https://www.freebuf.com/sectool/93286.html", "time": "2016-01-16", "level": "金币+5", "num_look": 703537, "num_comment": 22, "author": "亲爱的兔子", "tags": ["工具"], "text": "WiFi-Pumpkin是一款无线安全检测工具，利用该工具可以伪造接入点完成中间人攻击，同时也支持一些其它的无线渗透功能。"}
{"title": "GlassFish任意文件读取漏洞跟踪报告", "url": "https://www.freebuf.com/vuls/93338.html", "time": "2016-01-16", "level": "", "num_look": 295555, "num_comment": 2, "author": "阿里云安全", "tags": ["漏洞"], "text": "GlassFish 是一款用于构建 Java EE的应用服务组件。2015年10月，被爆出通用任意文件读取漏洞。利用这个漏洞，攻击者可读取服务器上任意文件。"}
{"title": "卡巴斯基实验室发现Silverlight零日漏洞", "url": "https://www.freebuf.com/articles/network/93184.html", "time": "2016-01-16", "level": "", "num_look": 361228, "num_comment": 1, "author": "晶颜123", "tags": ["网络安全"], "text": "日前，卡巴斯基实验室发现了在Silverlight应用程序中存在一个危险的零日漏洞，为百万用户带来安全隐患。"}
{"title": "适用于IDA Pro的CGEN框架介绍", "url": "https://www.freebuf.com/articles/security-management/92938.html", "time": "2016-01-15", "level": "金币+5", "num_look": 383203, "num_comment": 3, "author": "东二门陈冠希", "tags": ["安全管理"], "text": "我通常在IDA Pro中做逆向工作，但是有一小部分处理器IDA并不支持。幸运的是，objdump可以支持这些小众的处理器架构。"}
{"title": "关于匿名者组织（Anonymous），你都知道哪些？", "url": "https://www.freebuf.com/news/93238.html", "time": "2016-01-15", "level": "金币+5", "num_look": 536281, "num_comment": 10, "author": "亲爱的兔子", "tags": ["资讯"], "text": "黑客组织匿名者比你想象的规模还要庞大，同时匿名者也开始变得“众所周知”，名声大震。"}
{"title": "VxWorks Fuzzing 之道：VxWorks 工控实时操作系统漏洞挖掘调试与利用揭秘", "url": "https://www.freebuf.com/news/93201.html", "time": "2016-01-15", "level": "红色标题", "num_look": 515324, "num_comment": 13, "author": "知道创宇", "tags": ["工控安全", "资讯"], "text": "VxWorks 是世界上使用最广泛的一种在嵌入式系统中部署的实时操作系统，是由美国WindRiver公司（简称风河公司，即WRS 公司）于1983年设计开发的。"}
{"title": "德国情报机构再次与NSA合作，共享公民数据", "url": "https://www.freebuf.com/news/93139.html", "time": "2016-01-15", "level": "", "num_look": 165767, "num_comment": 4, "author": "bonABC", "tags": ["资讯"], "text": "德国媒体报道，德国政府几乎从未停止过对民众的监视活动，并且为了更精确的监视公民的活动，BND选择继续和美国NSA合作。"}
{"title": "从零开始学Fuzzing系列：浏览器fuzz工具探究之框架篇", "url": "https://www.freebuf.com/sectool/93130.html", "time": "2016-01-15", "level": "现金奖励", "num_look": 560101, "num_comment": 6, "author": "walkerfuz", "tags": ["头条", "工具"], "text": "希望通过本篇小文，能与大家共同领略前辈们在浏览器漏洞fuzz这一方向上留下的足迹与智慧。"}
{"title": "Python-rsa中的签名伪造", "url": "https://www.freebuf.com/news/92976.html", "time": "2016-01-15", "level": "金币+5", "num_look": 386012, "num_comment": 4, "author": "东二门陈冠希", "tags": ["漏洞", "资讯"], "text": "通过看python-rsa的源代码，我们发现它存在一个漏洞，该漏洞是基于Bleichenbacher'06 attack研究出来的针对RSA签名伪造的一个简单的变种，是由于公钥指数太低导致的。"}
{"title": "数据库安全小议", "url": "https://www.freebuf.com/articles/database/92921.html", "time": "2016-01-15", "level": "", "num_look": 399248, "num_comment": 3, "author": "SamSmith", "tags": ["数据安全", "观点"], "text": "数据库安全目前是安全从业者讨论的重要主题之一。随着越来越多的突发事件发生，是时候采取一些行动了。"}
{"title": "造型奇葩：金士顿推出“安全U盘”", "url": "https://www.freebuf.com/news/93206.html", "time": "2016-01-14", "level": "", "num_look": 200931, "num_comment": 10, "author": "FireFrank", "tags": ["资讯"], "text": "金士顿推出了新的U盘系列，旨在为注重安全的IT人士提供更好的体验。"}
{"title": "Android系统调用hook研究（一）", "url": "https://www.freebuf.com/articles/system/93168.html", "time": "2016-01-14", "level": "", "num_look": 403709, "num_comment": 4, "author": "银河实验室", "tags": ["系统安全"], "text": "提到Xposed，大家应该都非常熟悉，它主要在Java层对目标函数进行hook，对于底层的系统调用则无能为力。"}
{"title": "趋势科技杀毒软件被曝严重漏洞，黑客能够窃取你的所有密码", "url": "https://www.freebuf.com/news/93156.html", "time": "2016-01-14", "level": "", "num_look": 290200, "num_comment": 6, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "如果你电脑上安装了趋势科技（Trend Micro）的杀毒软件，那么此时你需要当心啦，因为趋势科技安全软件中存在一个严重漏洞。"}
{"title": "通过浏览器远程利用Microsoft Office DLL（MS15-132）劫持漏洞", "url": "https://www.freebuf.com/vuls/92935.html", "time": "2016-01-14", "level": "", "num_look": 315082, "num_comment": 3, "author": "东二门陈冠希", "tags": ["漏洞"], "text": "数周之前，安全研究员Parvez Anwar在其个人推特上贴出了大量的微软Office DLL劫持漏洞。"}
{"title": "欧洲刑警组织逮捕比特币敲诈团伙DD4BC核心成员", "url": "https://www.freebuf.com/news/93010.html", "time": "2016-01-14", "level": "", "num_look": 152229, "num_comment": 1, "author": "亲爱的兔子", "tags": ["资讯"], "text": "目前欧洲刑警组织宣布已经逮捕DD4BC黑客组织的核心成员。"}
{"title": "Shellcode分析工具PyAna", "url": "https://www.freebuf.com/sectool/92990.html", "time": "2016-01-14", "level": "金币+6", "num_look": 326612, "num_comment": 3, "author": "JackFree", "tags": ["工具", "系统安全"], "text": "Shellcode分析非常重要。然而，静态分析效果不佳，并且很容易失败。另外，静态分析工具通常不是免费的。"}
{"title": "【更新漏洞盒子在线检测】飞塔(FortiGate)疑似存在SSH后门（影响4.0 到 5.0.7版本）", "url": "https://www.freebuf.com/vuls/93045.html", "time": "2016-01-14", "level": "红色标题", "num_look": 598056, "num_comment": 15, "author": "白帽汇", "tags": ["漏洞"], "text": "1月12日，twitter用户@esizkur 发表信息说Fortigate存在ssh后门，影响版本从4.0到5.0.7，并在给出的链接中附上了完整的攻击利用代码。"}
{"title": "Lobotomy：Android逆向工程框架（Part2）", "url": "https://www.freebuf.com/articles/terminal/92986.html", "time": "2016-01-14", "level": "", "num_look": 251760, "num_comment": 4, "author": "JackFree", "tags": ["终端安全"], "text": "在本文中，我们将介绍如何使用Lobotomy反编译APK，以及如何将不可调试的安卓应用转换成可调试的应用程序。"}
{"title": "Joy：捕获数据包、分析网络流量数据、网络取证及安全监控工具", "url": "https://www.freebuf.com/sectool/93017.html", "time": "2016-01-14", "level": "金币+6", "num_look": 266927, "num_comment": 2, "author": "FireFrank", "tags": ["工具"], "text": "Joy是一个捕获数据包、分析网络流量数据、网络研究取证及安全监控的工具。"}
{"title": "ELF HFS水坑攻击解析（CVE-2014-6332）", "url": "https://www.freebuf.com/vuls/93009.html", "time": "2016-01-14", "level": "金币+6", "num_look": 546580, "num_comment": 5, "author": "dawner", "tags": ["WEB安全", "漏洞"], "text": "CVE-2014-6332是一枚win95+IE3–Win10+IE11全版本执行漏洞，上一个本博客讲的水坑攻击案例分析，这次是一个SSH攻击向量。"}
{"title": "美国密歇根理工大学发明“无人捕获机”用于反恐工作", "url": "https://www.freebuf.com/news/92998.html", "time": "2016-01-14", "level": "", "num_look": 179501, "num_comment": 2, "author": "亲爱的兔子", "tags": ["极客", "资讯"], "text": "近日美国密歇根理工大学的研究人员开发了一种新型的无人机。"}
{"title": "2015 WitAwards互联网安全年度评选揭晓", "url": "https://www.freebuf.com/news/92887.html", "time": "2016-01-13", "level": "", "num_look": 326986, "num_comment": 4, "author": "FB独家", "tags": ["头条", "活动"], "text": "2015 WitAwards互联网安全年度评选颁奖典礼2016年1月9日下午隆重举行，各大奖项已全面揭晓！"}
{"title": "可视门铃竟然可以泄露WiFi密码", "url": "https://www.freebuf.com/news/93063.html", "time": "2016-01-13", "level": "", "num_look": 225498, "num_comment": 3, "author": "亲爱的兔子", "tags": ["漏洞", "资讯"], "text": "近日Pen Test Partners公司发现门铃竟然可以泄露WiFi密码。"}
{"title": "节前移动支付诈骗增多，南方地区受损严重", "url": "https://www.freebuf.com/news/others/93071.html", "time": "2016-01-13", "level": "", "num_look": 498098, "num_comment": 6, "author": "腾讯雷霆行动", "tags": ["周边"], "text": "春节临近，聚会、发红包、买年货、购机票......手机移动支付行为越来越多，互联网诈骗呈现高发态势。"}
{"title": "乌克兰电网遭黑客攻击事件之Black Energy（黑暗力量）深入分析", "url": "https://www.freebuf.com/articles/network/93092.html", "time": "2016-01-13", "level": "红色标题", "num_look": 1376828, "num_comment": 6, "author": "金山安全", "tags": ["安全管理", "工控安全"], "text": "2016年1月6日，据英国《金融时报》报道，上周乌克兰电网系统遭黑客攻击，数百户家庭供电被迫中断，这是有史以来首次导致停电的网络攻击。"}
{"title": "Kali linux 2.0安装后的10点配置建议", "url": "https://www.freebuf.com/sectool/93032.html", "time": "2016-01-13", "level": "", "num_look": 536963, "num_comment": 17, "author": "沈园", "tags": ["工具"], "text": "自Kali 2.0发布以来，我们发现在安装kali之后经常会重复一些配置操作，对此，我们想要把它们分享出来，希望对大家也能够有所帮助。"}
{"title": "思科Jabbar聊天客户端易受中间人攻击", "url": "https://www.freebuf.com/articles/network/92549.html", "time": "2016-01-13", "level": "", "num_look": 317324, "num_comment": 1, "author": "vul_wish", "tags": ["网络安全"], "text": "思科发布官方公告称，其聊天客户端Jabbar中存在安全漏洞，易遭受中间人攻击。"}
{"title": "欧洲刑警组织联合执法行动逮捕国际ATM犯罪组织", "url": "https://www.freebuf.com/news/92619.html", "time": "2016-01-13", "level": "", "num_look": 173062, "num_comment": 173062, "author": "亲爱的兔子", "tags": ["终端安全", "资讯"], "text": "欧洲刑警组织和欧洲检察官组织近日在罗马尼亚的联合执法行动中,逮捕了八名涉嫌参与和利用恶意程序Tyupkin非法ATM取款的国际犯罪团伙。"}
{"title": "IDAPython：让你的生活更美好（四）", "url": "https://www.freebuf.com/articles/system/92505.html", "time": "2016-01-13", "level": "", "num_look": 375774, "num_comment": 3, "author": "东二门陈冠希", "tags": ["系统安全"], "text": "前三部分已经验证了用IDAPython能够让工作变的更简单，这一部分让我们看看逆向工程师如何使用IDAPython的颜色和强大的脚本特性。"}
{"title": "分析取证指南：取证工具推荐", "url": "https://www.freebuf.com/sectool/92946.html", "time": "2016-01-13", "level": "", "num_look": 550441, "num_comment": 6, "author": "SecDarker", "tags": ["工具"], "text": "推荐一些很Nice的取证工具。"}
{"title": "Word类型混淆漏洞原理分析（CVE-2015-1641）", "url": "https://www.freebuf.com/vuls/92962.html", "time": "2016-01-13", "level": "", "num_look": 307004, "num_comment": 11, "author": "安全狗攻防实验室", "tags": ["漏洞"], "text": "今年4月份微软修补了一个名为CVE-2015-1641的word类型混淆漏洞，攻击者可以构造嵌入了docx的rtf文档进行攻击。"}
{"title": "猎豹移动安全实验室研究和开发职位招聘", "url": "https://www.freebuf.com/jobs/92940.html", "time": "2016-01-13", "level": "", "num_look": 235079, "num_comment": 7, "author": "路由器", "tags": ["安全招聘"], "text": "猎豹移动于2010年10月由金山安全和可牛影像合并而成，是Google Play全球工具类榜单排名第一的移动应用开发商。"}
{"title": "Oracle：安卓反混淆工具", "url": "https://www.freebuf.com/sectool/92545.html", "time": "2016-01-13", "level": "", "num_look": 460108, "num_comment": 3, "author": "FireFrank", "tags": ["工具"], "text": "Oracle：基于Dalvik 反混淆的一种模式，它使用了有限执行来提高语义分析。此外，这个灵感激发了另一个安卓反混淆工具：Simplify。"}
{"title": "334年！26岁土耳其黑客因网络诈骗被判超长刑期", "url": "https://www.freebuf.com/news/92853.html", "time": "2016-01-13", "level": "", "num_look": 218270, "num_comment": 4, "author": "亲爱的兔子", "tags": ["资讯"], "text": "2016年1月10日，一名26岁的男性Onur KOPçAK被判334有期徒刑。"}
{"title": "海德薇（Hedwig）组织分析报告：一场无法结束的博弈", "url": "https://www.freebuf.com/news/92945.html", "time": "2016-01-12", "level": "", "num_look": 405960, "num_comment": 7, "author": "启明星辰", "tags": ["安全报告", "网络安全"], "text": "相比于匿名者黑客组织，还有一个行事低调，以破坏或窃取数据为目标的黑客组织更应该引起我们的关注，它就是海德薇（Hedwig）组织。"}
{"title": "如何通过配置NGINX和NGINX Plus来缓解DDoS攻击？", "url": "https://www.freebuf.com/articles/system/92907.html", "time": "2016-01-12", "level": "金币+5", "num_look": 340617, "num_comment": 3, "author": "xiaix", "tags": ["系统安全"], "text": "来自NGINX官方文档讲述如何配置 NGINX 和 NGINX Plus 缓解 DDoS 攻击。"}
{"title": "2016 FreeBuf互联网安全创新大会（FIT）精彩全纪录（下）", "url": "https://www.freebuf.com/fevents/92840.html", "time": "2016-01-12", "level": "红色标题", "num_look": 496839, "num_comment": 9, "author": "FB独家", "tags": ["活动"], "text": "第二日不仅有特约嘉宾的精彩议题、“漏洞感知系统 - 网藤”的发布、魔术师的保险箱HackDemo秀，帅锅专场不容错过！"}
{"title": "解密新晋信息窃取木马Spymel", "url": "https://www.freebuf.com/articles/database/92904.html", "time": "2016-01-12", "level": "金币+5", "num_look": 271136, "num_comment": 3, "author": "vul_wish", "tags": ["数据安全"], "text": "近日，ThreatLabZ安全研究团队发现了一种新的木马家族——Spymel，该木马旨在窃取信息，且通过使用合法的数字证书逃避检测。本文对该木马进行分析。"}
{"title": "新增30多种工具：BlackArch Linux新版发布", "url": "https://www.freebuf.com/sectool/92874.html", "time": "2016-01-12", "level": "金币+5", "num_look": 272951, "num_comment": 9, "author": "亲爱的兔子", "tags": ["工具"], "text": "BlackArch Linux 是一个轻量的、灵活的、基于 Arch linux 的渗透测试发行版，主要面向测试人员与安全研究者群体。目前平台集成的工具已经超过1337款."}
{"title": "黑科技新篇章：利用神经网络破解密码", "url": "https://www.freebuf.com/news/92797.html", "time": "2016-01-12", "level": "金币+5", "num_look": 429728, "num_comment": 9, "author": "我是酱油男", "tags": ["网络安全", "资讯"], "text": "目前人们已经在入侵检测系统或类似的安全防御策略里使用神经网络了。但是如果从攻击者角度出发，神经网络是否可以用来帮助开展攻击或者入侵行为。"}
{"title": "谷歌Play商城又现恶意程序", "url": "https://www.freebuf.com/news/92602.html", "time": "2016-01-12", "level": "", "num_look": 211745, "num_comment": 4, "author": "亲爱的兔子", "tags": ["终端安全", "资讯"], "text": "近日谷歌从Play商城移除了13款含有恶意病毒的应用程序。"}
{"title": "中间人攻击之html注入", "url": "https://www.freebuf.com/articles/system/92783.html", "time": "2016-01-12", "level": "现金奖励", "num_look": 632851, "num_comment": 10, "author": "LiukerTeam", "tags": ["系统安全"], "text": "一家意大利软件厂商被攻击，其掌握的387.05GB漏洞（包括0day）数据泄露出来，由此可能引发的动荡，引起了业界一片哗然。"}
{"title": "MEDCIN引擎的漏洞利用详解", "url": "https://www.freebuf.com/vuls/92676.html", "time": "2016-01-12", "level": "金币+5", "num_look": 193337, "num_comment": 4, "author": "江湖小吓", "tags": ["漏洞"], "text": "几个月前，国外安全研究员在MEDCIN引擎旧版本的安全评估中发现了一个漏洞，于是他向厂商报告待厂商修复之后又发现了几个漏洞，一起来看CVE-2015-2898、CVE-2015-2901、CVE-2015-2900、CVE-2015-2899、CVE-2015-6006…"}
{"title": "安卓智能电视：恶意应用的新战场", "url": "https://www.freebuf.com/vuls/92671.html", "time": "2016-01-12", "level": "", "num_look": 222412, "num_comment": 2, "author": "dawner", "tags": ["漏洞", "系统安全"], "text": "智能电视不仅是显示设备，有的个体甚至还可以运行安卓应用。诚然，这些特性是非常有用的，但是也给用户带来了一定的风险。"}
{"title": "ISIS推出第一期“网络安全”在线杂志", "url": "https://www.freebuf.com/news/92624.html", "time": "2016-01-12", "level": "", "num_look": 184562, "num_comment": 5, "author": "亲爱的兔子", "tags": ["资讯"], "text": "有媒体报道称，在2015年12月ISIS推出了一款全新的“网络安全”在线杂志。"}
{"title": "英伟达GPU被曝漏洞，可查看色情网站浏览历史", "url": "https://www.freebuf.com/news/92753.html", "time": "2016-01-11", "level": "金币+5", "num_look": 258396, "num_comment": 9, "author": "亲爱的兔子", "tags": ["漏洞", "资讯"], "text": "近日一个游戏玩家曝光了Nvidia GPU上一个漏洞，利用该漏洞可以查看Chrome浏览器隐身模式浏览色情网站的画面。"}
{"title": "“最安全”智能机Blackphone上发现高危漏洞", "url": "https://www.freebuf.com/news/92534.html", "time": "2016-01-11", "level": "金币+5", "num_look": 156528, "num_comment": 5, "author": "FireFrank", "tags": ["资讯"], "text": "Blackphone被普遍认为是目前最安全的Android智能机。不幸的是，无论设计者把系统设计的怎么安全，它肯定还是存在漏洞的。"}
{"title": "打造安全界的“江左盟”：蚂蚁金服安全应急响应中心（AFSRC）上线", "url": "https://www.freebuf.com/news/92785.html", "time": "2016-01-11", "level": "", "num_look": 636034, "num_comment": 9, "author": "路由器", "tags": ["周边", "安全管理"], "text": "蚂蚁金服安全应急响应中心（AFSRC）已于1月11日正式上线。"}
{"title": "PS4 Linux破解团队：会继续深入挖掘并对外公布细节", "url": "https://www.freebuf.com/news/92535.html", "time": "2016-01-11", "level": "", "num_look": 166035, "num_comment": 4, "author": "亲爱的兔子", "tags": ["资讯"], "text": "2015年最后一天，天才破解团队fail0verflow宣布成功破解PlayStation 4游戏主机，并使其可运行Gentoo Linux操作系统。"}
{"title": "一次关于安全圈与交通圈的碰撞思考", "url": "https://www.freebuf.com/articles/neopoints/92733.html", "time": "2016-01-11", "level": "现金奖励", "num_look": 456795, "num_comment": 23, "author": "MrRight-VIP", "tags": ["安全管理", "工控安全"], "text": "北京的交通发达又复杂，便利又拥堵，作为每天奔波在这城市的我，难免会把安全圈和交通圈联系在一起。"}
{"title": "苹果非官方应用市场从中国向全球扩张", "url": "https://www.freebuf.com/news/92618.html", "time": "2016-01-11", "level": "金币+5", "num_look": 219072, "num_comment": 2, "author": "寰者", "tags": ["终端安全", "资讯"], "text": "目前为非越狱的iOS设备提供应用下载的非官方应用商店平台目前正从中国市场扩展到世界多个国家。"}
{"title": "ClassyShark：轻便的安卓可执行文件浏览器", "url": "https://www.freebuf.com/sectool/92655.html", "time": "2016-01-11", "level": "金币+5", "num_look": 326772, "num_comment": 3, "author": "dawner", "tags": ["工具", "系统安全"], "text": "ClassyShark是一款便利的文件浏览器，它可以浏览安卓下可执行的程序。此外，它拥有安卓APK和桌面版JAR的客户端。"}
{"title": "2016 FreeBuf互联网安全创新大会（FIT）精彩全纪录（上）", "url": "https://www.freebuf.com/news/topnews/92565.html", "time": "2016-01-11", "level": "红色标题", "num_look": 1049703, "num_comment": 12, "author": "FB独家", "tags": ["头条", "活动"], "text": "我们把魔都浅水湾文化艺术中心化作一座充满魔力的城堡，互联网安全的神秘力量在这个角落迸发出无穷的光芒。"}
{"title": "通过机器学习进行恶意软件分析：Deepviz中的聚类算法基本原理", "url": "https://www.freebuf.com/articles/network/92472.html", "time": "2016-01-11", "level": "", "num_look": 417872, "num_comment": 2, "author": "东二门陈冠希", "tags": ["网络安全"], "text": "我们发现很多的音像公司开始接触机器学习和人工智能，希望能找到一条快速有效的途径来分析并隔离新型的恶意软件，同时扩大恶意软件库。"}
{"title": "案例剖析：针对打印机的APT攻击", "url": "https://www.freebuf.com/articles/terminal/92482.html", "time": "2016-01-11", "level": "金币+5", "num_look": 310084, "num_comment": 5, "author": "东二门陈冠希", "tags": ["终端安全"], "text": "一直以来我们都在讨论多功能打印机（MFP）在企业环境下所带来的风险，以及攻击者如何轻易的利用其来进行恶意攻击。"}
{"title": "602Gbps：针对BBC的攻击成为史上最强DDoS攻击", "url": "https://www.freebuf.com/news/92631.html", "time": "2016-01-11", "level": "金币+5", "num_look": 181904, "num_comment": 1, "author": "JackFree", "tags": ["资讯"], "text": "声称对BBC攻击负责的黑客组织New World Hacking透露，对BBC的DDoS攻击强度已经达到了602GBps，这将成为史上强度最大的DDoS攻击。"}
{"title": "朝鲜核试验后，韩国提升网络防御等级", "url": "https://www.freebuf.com/news/92612.html", "time": "2016-01-11", "level": "", "num_look": 143115, "num_comment": 3, "author": "亲爱的兔子", "tags": ["资讯"], "text": "在上周朝鲜进行了核试验，目前韩国军方表示将提高网络安全防御级别。"}
{"title": "时代华纳表示约有32万用户数据泄露", "url": "https://www.freebuf.com/news/92538.html", "time": "2016-01-09", "level": "", "num_look": 282141, "num_comment": 4, "author": "亲爱的兔子", "tags": ["数据安全", "资讯"], "text": "目前时代华纳有线电视透露称，可能有将近32万用户的数据泄露。"}
{"title": "Oz沙盒技术详解", "url": "https://www.freebuf.com/articles/system/92115.html", "time": "2016-01-09", "level": "", "num_look": 264949, "num_comment": 264949, "author": "东二门陈冠希", "tags": ["系统安全"], "text": "OZ系统是通过把Linux的桌面程序运行在隔离的安全沙盒中来保护程序的安全，从而避免攻击者可以轻易的利用应用程序的漏洞进一步攻击系统。"}
{"title": "乌克兰电网之殇：沙虫（Sandworm）团队或为幕后凶手", "url": "https://www.freebuf.com/news/92459.html", "time": "2016-01-09", "level": "", "num_look": 219609, "num_comment": 219609, "author": "dawner", "tags": ["系统安全", "资讯"], "text": "据研究表明，攻击乌克兰电网的俄罗斯黑客，很可能是我们熟知的沙虫（Sandworm）团队。"}
{"title": "戴尔被黑？骗子冒充客服人员骗取钱财", "url": "https://www.freebuf.com/news/92427.html", "time": "2016-01-09", "level": "", "num_look": 207686, "num_comment": 207686, "author": "亲爱的兔子", "tags": ["资讯"], "text": "我们可能都遇到过那些伪装成“Windows技术服务支持”的诈骗电话，我相信不少人都清楚这样的电话是诈骗行为。"}
{"title": "在线直播！FreeBuf互联网安全创新大会（FIT）互动指南", "url": "https://www.freebuf.com/news/92321.html", "time": "2016-01-08", "level": "红色标题", "num_look": 396297, "num_comment": 13, "author": "FB独家", "tags": ["头条", "活动"], "text": "FIT大会全程将由“龙珠直播”进行独家线上视频直播，届时微信微博同步互动全面开放，请各位备好爆米花、零食和啤酒，共享年度盛宴。"}
{"title": "“百脑虫”手机病毒分析报告", "url": "https://www.freebuf.com/vuls/92490.html", "time": "2016-01-08", "level": "", "num_look": 379768, "num_comment": 15, "author": "360手机卫士", "tags": ["安全报告", "漏洞"], "text": "2015 年末，360移动安全团队发现一类“百脑虫”手机病毒，它会伪装成色情类应用感染用户。"}
{"title": "Windbg入门实战讲解", "url": "https://www.freebuf.com/articles/system/92499.html", "time": "2016-01-08", "level": "", "num_look": 1132436, "num_comment": 9, "author": "聚锋实验室", "tags": ["系统安全"], "text": "windbg作为windows调试的神器。是查看内核某些结构体，挖掘漏洞，调试系统内核，调试驱动等必不可少的工具。"}
{"title": "IDAPython：让你的生活更美好（三）", "url": "https://www.freebuf.com/articles/system/92488.html", "time": "2016-01-08", "level": "", "num_look": 353412, "num_comment": 2, "author": "东二门陈冠希", "tags": ["系统安全"], "text": "在过去两个部分中，我们已经讨论了使用IDAPython 让逆向工程更容易一些。这一部分我们来看一下条件断点。"}
{"title": "Zerodium为Adobe Flash的堆隔离保护机制漏洞悬赏10万美金", "url": "https://www.freebuf.com/news/92432.html", "time": "2016-01-08", "level": "", "num_look": 152361, "num_comment": 152361, "author": "江湖小吓", "tags": ["资讯"], "text": "虽然Adobe Flash播放器存在太多问题已经被要求退休了，但是Adobe内部研究员和供应商依然继续投资这Flash播放器并建立了相关针对攻击的措施。"}
{"title": "Comcast Xfinity家庭安全系统被曝严重漏洞", "url": "https://www.freebuf.com/news/92500.html", "time": "2016-01-07", "level": "", "num_look": 156604, "num_comment": 2, "author": "vul_wish", "tags": ["资讯"], "text": "近日，研究人员发现Comcast Xfinity家庭安全系统中存在一个安全漏洞，攻击者可以在不触发警报的前提下进入用户住宅。"}
{"title": "Linux内核group_info UAF漏洞利用（CVE-2014-2851）", "url": "https://www.freebuf.com/vuls/92465.html", "time": "2016-01-07", "level": "", "num_look": 286502, "num_comment": 5, "author": "xiaix", "tags": ["漏洞"], "text": "本案例研究 CVE-2014-2851 漏洞，其影响 Linux 内核直到3.14.1版本。"}
{"title": "Burpsuite插件开发之RSA加解密", "url": "https://www.freebuf.com/articles/security-management/92376.html", "time": "2016-01-07", "level": "", "num_look": 409931, "num_comment": 5, "author": "绿盟科技", "tags": ["安全管理"], "text": "本文主要记录了一个解密请求包，插入payload，再加密的插件开发过程，插件应用场景主要是用于通过分析apk的实现。"}
{"title": "揭秘交友诈骗如何月入过万美元", "url": "https://www.freebuf.com/news/92466.html", "time": "2016-01-07", "level": "", "num_look": 183715, "num_comment": 3, "author": "亲爱的兔子", "tags": ["资讯"], "text": "从勒索软件的部署到恶意广告，目前很多网络犯罪分子都实现操作自动化了。"}
{"title": "亚马逊EC2主机环境：挖掘Node/Express应用上的SSRF漏洞", "url": "https://www.freebuf.com/vuls/92423.html", "time": "2016-01-07", "level": "金币+10", "num_look": 411419, "num_comment": 3, "author": "dawner", "tags": ["WEB安全", "漏洞"], "text": "笔者最近在挖某应用的漏洞时，恰好遇到了一个SSRF（Server Side Request Forgery）。"}
{"title": "钓鱼邮件初探：黑客是如何进行邮件伪造的？", "url": "https://www.freebuf.com/sectool/92397.html", "time": "2016-01-07", "level": "现金奖励", "num_look": 1718248, "num_comment": 31, "author": "dontshoot", "tags": ["工具", "网络安全"], "text": "在这篇文章中，我们介绍的这款工具可以最大程度的欺骗你的邮箱，更不要提你的眼睛。"}
{"title": "教你构建自己的yara数据库", "url": "https://www.freebuf.com/sectool/92399.html", "time": "2016-01-07", "level": "", "num_look": 513054, "num_comment": 6, "author": "安全狗攻防实验室", "tags": ["工具", "数据安全"], "text": "之前有看到过一些关于yara的文章，但基本是关于规则怎么写的翻译文章，本文教你构建自己的yara数据库。"}
{"title": "Fake_AP模式下的Easy-Creds浅析", "url": "https://www.freebuf.com/articles/wireless/92266.html", "time": "2016-01-07", "level": "现金奖励", "num_look": 563624, "num_comment": 10, "author": "icecolor不疯不魔不成活", "tags": ["无线安全"], "text": "Easy-Creds 是一款欺骗嗅探为主的攻击脚本工具，他具备arp毒化，dns毒化等一些嗅探攻击模式。它最亮的地方就是它的fakeAP功能。"}
{"title": "IDAPython：让你的生活更美好（二）", "url": "https://www.freebuf.com/sectool/92168.html", "time": "2016-01-07", "level": "", "num_look": 343473, "num_comment": 1, "author": "东二门陈冠希", "tags": ["工具"], "text": "shellcode和恶意软件使用hash算法混淆加载的函数和链接库，这项技术被广泛使用。使用IDAPython ，我们能够很容易的解决这个很有挑战性的问题。"}
{"title": "荷兰政府：保证不强制在任何产品中留有后门", "url": "https://www.freebuf.com/news/92326.html", "time": "2016-01-07", "level": "", "num_look": 141896, "num_comment": 2, "author": "简单", "tags": ["资讯"], "text": "荷兰政府认为现阶段他们不宜采取限制性的法律措施来反对加密机制的开发和使用。"}
{"title": "打造一款简单的调试监控器", "url": "https://www.freebuf.com/sectool/92279.html", "time": "2016-01-06", "level": "", "num_look": 385839, "num_comment": 6, "author": "CNNVD", "tags": ["工具"], "text": "在Fuzzing过程中，必须要监控程序的执行状态，若程序发生异常，立即保存测试用例，以便将来对其进行重现。"}
{"title": "网络世界的罪恶天堂：暗网发展调研报告", "url": "https://www.freebuf.com/articles/92296.html", "time": "2016-01-06", "level": "红色标题", "num_look": 905803, "num_comment": 28, "author": "深圳市极限网络科技有限公司", "tags": ["头条", "安全报告"], "text": "“暗网”更确切的技术名字叫“隐藏的服务器”，域名数量是表层网络的400倍到500倍，访问者在上面不会留下任何痕迹。"}
{"title": "某僵尸网络被控端恶意样本分析", "url": "https://www.freebuf.com/articles/92289.html", "time": "2016-01-06", "level": "", "num_look": 550283, "num_comment": 13, "author": "360安全", "tags": ["文章", "网络安全"], "text": "近期, 360天眼威胁感知系统排查后发现有恶意攻击者利用redis crackit漏洞入侵服务器并种植了名为unama的恶意程序。"}
{"title": "Joomla漏洞每天受到黑客16600次扫描攻击", "url": "https://www.freebuf.com/news/92306.html", "time": "2016-01-06", "level": "", "num_look": 202999, "num_comment": 4, "author": "Dreamdroid", "tags": ["资讯"], "text": "每当新出一个漏洞时候，黑客就会抓紧时间，在茫茫的互联网中找易受攻击的网站，然后入侵该站点。"}
{"title": "漏洞盒子互联网威胁情报奖励计划（试行）启动公告", "url": "https://www.freebuf.com/news/92338.html", "time": "2016-01-06", "level": "", "num_look": 163138, "num_comment": 5, "author": "漏洞盒子", "tags": ["资讯"], "text": "即日起，漏洞盒子正式启动互联网威胁情报奖励计划。"}
{"title": "通过Docker搭建开源版IVRE", "url": "https://www.freebuf.com/sectool/92179.html", "time": "2016-01-06", "level": "现金奖励", "num_look": 484123, "num_comment": 17, "author": "HackLiu", "tags": ["工具"], "text": "本文档介绍开源IVRE项目的安装、部署和配置。本文档的目的是提供给IVRE项目学习、研究人员，利于他们更快的搭建和部署IVRE。"}
{"title": "Phpsploit：隐蔽的Post-Exploitation框架", "url": "https://www.freebuf.com/sectool/92154.html", "time": "2016-01-06", "level": "", "num_look": 348112, "num_comment": 9, "author": "0xroot", "tags": ["工具"], "text": "Phpsploit是一个远程控制框架，为客户端与服务器间提供shell交互连接。能够对Getshell的服务器进行管理实现权限提升。"}
{"title": "IDAPython：让你的生活更美好（一）", "url": "https://www.freebuf.com/sectool/92107.html", "time": "2016-01-06", "level": "金币+5", "num_look": 640178, "num_comment": 9, "author": "东二门陈冠希", "tags": ["工具"], "text": "IDAPython是IDA的一个功能强大的扩展特性，对外提供了大量的IDA API调用。"}
{"title": "2015年全球数据安全事件盘点分析", "url": "https://www.freebuf.com/articles/92077.html", "time": "2016-01-06", "level": "", "num_look": 507055, "num_comment": 1, "author": "安华金和", "tags": ["安全报告", "数据安全"], "text": "2015年，全球61个国家出现79790起数据泄露事件，其中2122起已经得到确认。"}
{"title": "俄通信部长Instagram账户遭土耳其黑客攻击", "url": "https://www.freebuf.com/news/92076.html", "time": "2016-01-06", "level": "", "num_look": 127131, "num_comment": 127131, "author": "亲爱的兔子", "tags": ["资讯"], "text": "报道称，土耳其黑客攻击了俄罗斯通信与大众传媒部部长Nikolai Nikiforov的Instagram账户。"}
{"title": "安全研究人员发现了第一个使用JS的勒索软件", "url": "https://www.freebuf.com/news/92263.html", "time": "2016-01-05", "level": "金币+5", "num_look": 209152, "num_comment": 5, "author": "Sodagreen", "tags": ["资讯"], "text": "在过去的一年中，出现了一大堆的“勒索SasS”的行为，例如Tox、Fakben或者Radamant。这里，让我们将焦点汇聚在最新的恶意行动当中。"}
{"title": "2015最酷的Hack方式有哪些？", "url": "https://www.freebuf.com/news/90714.html", "time": "2016-01-05", "level": "红色标题", "num_look": 531328, "num_comment": 7, "author": "简单", "tags": ["网络安全", "资讯"], "text": "2015年，见惯了大大小小的安全漏洞和事件，真正能在海马区雁过留痕的又有哪些呢？小编整理了部分令人为之惊叹的攻击方式！"}
{"title": "SSHBearDoor：BlackEnergy（黑暗力量）家族新宠", "url": "https://www.freebuf.com/articles/system/92196.html", "time": "2016-01-05", "level": "金币+5", "num_look": 229512, "num_comment": 2, "author": "dawner", "tags": ["系统安全"], "text": "SSHBearDoor：一种SSH Service后门，BlackEnergy家族利用这个后门攻击新闻媒体和电气能源行业。"}
{"title": "Linux工作站安全检查清单解析", "url": "https://www.freebuf.com/articles/system/92073.html", "time": "2016-01-05", "level": "金币+5", "num_look": 316030, "num_comment": 7, "author": "xiaix", "tags": ["系统安全"], "text": "本文档目标读者为使用 Linux 工作站进行访问和管理项目基础设施团队中的系统管理员。"}
{"title": "Apache被曝疑似mod_status模块的0day", "url": "https://www.freebuf.com/vuls/92232.html", "time": "2016-01-05", "level": "", "num_look": 281051, "num_comment": 9, "author": "白帽汇", "tags": ["漏洞"], "text": "Twitter上有安全人员发现2016年1月1日后，互联网上有大量的主机被扫描，且带入了一个奇怪的扫描特征，疑似一个Apache mod_status模块的0day！"}
{"title": "匿名者（Anonymous）攻击多个沙特阿拉伯政府网站，抗议处决行为", "url": "https://www.freebuf.com/news/92225.html", "time": "2016-01-05", "level": "", "num_look": 351068, "num_comment": 3, "author": "亲爱的兔子", "tags": ["网络安全", "资讯"], "text": "黑客组织匿名者(Anonymous)关闭了数个隶属于沙特阿拉伯的网站，以此抗议该国在1月1日对47名囚犯的处决行为。"}
{"title": "GPS卫星定位平台漏洞成灾，用户位置信息告急", "url": "https://www.freebuf.com/articles/92211.html", "time": "2016-01-05", "level": "", "num_look": 673721, "num_comment": 22, "author": "360安全", "tags": ["数据安全", "文章"], "text": "近日，新闻中曝光了多起通过GPS定位设备跟踪绑架事件。很多用户都来咨询，有没有方法进行检测？"}
{"title": "首款基于“深度学习”的手机安全软件问世，号称可抵御0day攻击", "url": "https://www.freebuf.com/news/92153.html", "time": "2016-01-05", "level": "", "num_look": 217243, "num_comment": 3, "author": "哆啦A梦", "tags": ["终端安全", "资讯"], "text": "赛门铁克安卓手机安全产品首次运用深度学习（Deep Learning），而这一基于大数据的训练不久将传播至其他平台，毋庸置疑。"}
{"title": "一次对JSocket远控的分析", "url": "https://www.freebuf.com/articles/terminal/92108.html", "time": "2016-01-05", "level": "现金奖励", "num_look": 283432, "num_comment": 5, "author": "nickchang", "tags": ["终端安全"], "text": "近期，朋友的电脑中毒了。从杀毒软件的告警信息看，这个被隔离的文件的扩展名是oDhoel，但是它包含了几个.class文件。"}
{"title": "浅析QNX系统的shadowed密码Hash格式", "url": "https://www.freebuf.com/articles/system/92090.html", "time": "2016-01-05", "level": "金币+8", "num_look": 275364, "num_comment": 2, "author": "东二门陈冠希", "tags": ["系统安全"], "text": "QNX(Quick UNIX)是一个unix家族的实时操作系统，首次发行于1980年，2010年被黑莓公司收购。"}
{"title": "如何在开房时检查“偷窥摄像头”？", "url": "https://www.freebuf.com/news/92004.html", "time": "2016-01-05", "level": "红色标题", "num_look": 1408449, "num_comment": 17, "author": "亲爱的兔子", "tags": ["头条", "无线安全"], "text": "在某些场合（比如酒店、洗手间），我们会担心坏人会利用隐藏的摄像头进行偷窥和监视。而这类摄像头往往又很难被发现，这着实让人困扰。"}
{"title": "使用Whoosh实现的社工库应用", "url": "https://www.freebuf.com/articles/database/92118.html", "time": "2016-01-04", "level": "", "num_look": 556120, "num_comment": 14, "author": "银河实验室", "tags": ["数据安全"], "text": "整理电脑的时候翻出了之前用Python写的一个社工库，使用Whoosh对社工库文件按行分词建立索引，直接利用索引来查密码，返回json格式结果。"}
{"title": "新“马”新气象，拦你没商量", "url": "https://www.freebuf.com/articles/92072.html", "time": "2016-01-04", "level": "", "num_look": 450462, "num_comment": 10, "author": "AVLTeam", "tags": ["文章", "网络安全"], "text": "近期，AVL移动安全团队接到一例用户的可疑短信鉴别请求。"}
{"title": "2016年移动安全趋势及威胁预测", "url": "https://www.freebuf.com/news/91525.html", "time": "2016-01-04", "level": "金币+8", "num_look": 185635, "num_comment": 1, "author": "简单", "tags": ["头条", "资讯"], "text": "2015年这一年间发生了很多令我们很震惊的事件，透过这些大事件和漏洞，我们可以预测一下2016年移动安全趋势和可能存在的安全威胁。"}
{"title": "Java反序列化集成工具", "url": "https://www.freebuf.com/sectool/92011.html", "time": "2016-01-04", "level": "红色标题", "num_look": 1628702, "num_comment": 70, "author": "wooyaa", "tags": ["工具"], "text": "Java反序列化漏洞已经被曝出一段时间了，本人参考了网上大神的放出来的工具，将Jboss、Websphere和weblogic的反序列化漏洞的利用集成到了一起。"}
{"title": "2015年被发现安全漏洞最多的公司竟是苹果？", "url": "https://www.freebuf.com/vuls/92012.html", "time": "2016-01-04", "level": "金币+8", "num_look": 381413, "num_comment": 22, "author": "寰者", "tags": ["头条", "漏洞"], "text": "从CVE发布的统计结果来看，在2015年全年，所属产品中被发现CVE 漏洞数量最多的公司是苹果公司。"}
{"title": "域安全篇：寻找SYSVOL里的密码和攻击GPP（组策略偏好）", "url": "https://www.freebuf.com/vuls/92016.html", "time": "2016-01-04", "level": "金币+8", "num_look": 503338, "num_comment": 4, "author": "dawner", "tags": ["漏洞", "系统安全"], "text": "在2015年的黑帽大会和DEFCON上，我曾谈过黑客会如何从域用户提权到域管理。"}
{"title": "逆向工具之Reverse", "url": "https://www.freebuf.com/sectool/91986.html", "time": "2016-01-04", "level": "", "num_look": 389467, "num_comment": 3, "author": "寰者", "tags": ["工具"], "text": "Reverse是一个用来解析二进制文件的逆向工程工具，而且它可以生成更具可读性的代码（类C语言）并带有彩色标识的语法，便于研究人员进行阅读代码。"}
{"title": "攻击BBC的黑客组织故技重施，攻击美总统候选人官方网站", "url": "https://www.freebuf.com/news/91984.html", "time": "2016-01-04", "level": "", "num_look": 134324, "num_comment": 1, "author": "亲爱的兔子", "tags": ["资讯"], "text": "美国总统候选人唐纳德·特朗普的官方竞选网站遭到黑客攻击，而参与这起事件的黑客组织早前曾声称对BBC网络攻击事件负责。"}
{"title": "毒贩利用漏洞入侵无人机实现非法偷渡", "url": "https://www.freebuf.com/news/91912.html", "time": "2016-01-03", "level": "金币+8", "num_look": 309586, "num_comment": 8, "author": "亲爱的兔子", "tags": ["终端安全", "资讯"], "text": "美国最新报告显示，毒贩们正利用黑客技术入侵空中交通工具在美墨边境非法偷渡。"}
{"title": "FLARE脚本系列：自动解码混淆字符串", "url": "https://www.freebuf.com/sectool/91910.html", "time": "2016-01-03", "level": "金币+5", "num_look": 219797, "num_comment": 4, "author": "江湖小吓", "tags": ["工具"], "text": "这篇文章拓展了高级逆向工程（FLARE）脚本系列的一个工具——调试器。"}
{"title": "ProxyBack技术分析：可以将你电脑变成代理服务器的恶意软件", "url": "https://www.freebuf.com/articles/network/91860.html", "time": "2016-01-03", "level": "金币+5", "num_look": 444270, "num_comment": 1, "author": "呆瓜路", "tags": ["网络安全"], "text": "在因特网上，匿名代理在保护个人隐私上扮演着重要的角色。然而，当有人未经许可私自将他们的系统变成代理服务器时，他们的处境就危险了。"}
{"title": "继BBC“掉线”之后，世界多地区的WhatsApp也发生中断", "url": "https://www.freebuf.com/news/91870.html", "time": "2016-01-03", "level": "金币+5", "num_look": 205357, "num_comment": 4, "author": "亲爱的兔子", "tags": ["系统安全", "资讯"], "text": "著名即时通讯软件WhatsApp在新年前夕出现了中断问题，许多人想用WhatsApp与亲戚朋友联系时，却发现其无法使用。"}
{"title": "误伤？！反ISIS黑客组织称其DDoS攻击BBC为测试", "url": "https://www.freebuf.com/news/91963.html", "time": "2016-01-03", "level": "金币+5", "num_look": 279900, "num_comment": 15, "author": "亲爱的兔子", "tags": ["资讯"], "text": "目前一伙反ISIS黑客组织声称对12月31日发生的英国广播公司（BBC）网络攻击事件负责。"}
{"title": "智能电视将成为网络攻击的新切入点", "url": "https://www.freebuf.com/news/91819.html", "time": "2016-01-02", "level": "金币+5", "num_look": 161198, "num_comment": 2, "author": "vul_wish", "tags": ["资讯"], "text": "据安全专家称，智能电视可能成为主要的攻击向量之一。"}
{"title": "仿生免疫系统将左右网络安全的未来？", "url": "https://www.freebuf.com/articles/neopoints/91796.html", "time": "2016-01-02", "level": "", "num_look": 222974, "num_comment": 6, "author": "明明知道", "tags": ["观点"], "text": "网络安全的博弈远不是一场注定失败的战斗，而我们所需要灵感或许可以从生物学中找到。"}
{"title": "Windows、Linux后门解析", "url": "https://www.freebuf.com/articles/system/91791.html", "time": "2016-01-02", "level": "现金奖励", "num_look": 1080127, "num_comment": 18, "author": "SecDarker", "tags": ["系统安全"], "text": "深度解析Windows、Linux中的后门"}
{"title": "用树莓派和显示器制作一面“魔镜”", "url": "https://www.freebuf.com/sectool/91497.html", "time": "2016-01-02", "level": "", "num_look": 1088371, "num_comment": 19, "author": "0xroot", "tags": ["工具", "极客"], "text": "这篇文章介绍的是用树莓派、显示器、双面镜制作的一面镜子。"}
{"title": "庖丁解牛之UPack工作原理及实例分析（三）", "url": "https://www.freebuf.com/articles/security-management/91520.html", "time": "2016-01-01", "level": "", "num_look": 311674, "num_comment": 5, "author": "绿盟科技", "tags": ["安全管理"], "text": "本文在前两篇的基础上对于动态调试之UPack中查找OEP作了深入阐述。"}
{"title": "极客DIY：使用Arduino制作一块开源手表", "url": "https://www.freebuf.com/geek/91814.html", "time": "2016-01-01", "level": "金币+5", "num_look": 487434, "num_comment": 8, "author": "FireFrank", "tags": ["极客"], "text": "使用Arduino DIY一块开源手表"}
{"title": "推特、脸书或因提醒用户受政府监控而违法", "url": "https://www.freebuf.com/news/91773.html", "time": "2016-01-01", "level": "金币+5", "num_look": 451781, "num_comment": 6, "author": "亲爱的兔子", "tags": ["网络安全", "资讯"], "text": "近日，英国通过一项法案，如果科技公司提醒用户政府存在潜在监控行为，那么公司负责人将面临长达两年有期徒刑。"}
{"title": "英国广播公司（BBC）新年前夕遭到网络攻击", "url": "https://www.freebuf.com/news/91862.html", "time": "2016-01-01", "level": "金币+5", "num_look": 249866, "num_comment": 2, "author": "亲爱的兔子", "tags": ["资讯"], "text": "英国广播公司（BBC）网站12月31日早晨因大规模的网络攻击而瘫痪。"}
{"title": "境外“暗黑客栈”组织对国内企业高管发起APT攻击", "url": "https://www.freebuf.com/articles/network/91851.html", "time": "2015-12-31", "level": "", "num_look": 424527, "num_comment": 11, "author": "Threatbook", "tags": ["网络安全", "观点"], "text": "Adobe于12月28日发布了一个应急补丁用于修复Flash 播放器的多个安全漏洞。有线索表明其中之一已被用于APT(高级可持续性)攻击。"}
{"title": "系统有毒：“苏拉克”木马详细分析", "url": "https://www.freebuf.com/articles/network/91811.html", "time": "2015-12-31", "level": "", "num_look": 690531, "num_comment": 19, "author": "腾讯电脑管家", "tags": ["网络安全"], "text": "刚重装的系统就中毒了，这是很多网友常常遇到的事，难道是中了引导区木马？甚至bios中毒？"}
{"title": "庖丁解牛之UPack工作原理及实例分析（二）", "url": "https://www.freebuf.com/articles/security-management/91518.html", "time": "2015-12-31", "level": "", "num_look": 290814, "num_comment": 7, "author": "绿盟科技", "tags": ["安全管理"], "text": "UPack是软件逆向工程中常见课题；上一篇已经对Runtime压缩基础知识进行了介绍。"}
{"title": "针对典型钓鱼攻击的溯源与反控制", "url": "https://www.freebuf.com/articles/network/91738.html", "time": "2015-12-31", "level": "", "num_look": 455067, "num_comment": 14, "author": "阿尔法实验室", "tags": ["网络安全"], "text": "近来，我们收到了一些针对天融信公用邮箱的长矛式定点攻击邮件，这些邮件五花八门，但是最终的目的还是要诱骗出邮箱的登录口令。"}
{"title": "FIT 2017大会精彩抢先看：Hack Demo，黑客不能说的秘密", "url": "https://www.freebuf.com/news/topnews/91711.html", "time": "2015-12-31", "level": "红色标题", "num_look": 388587, "num_comment": 6, "author": "FB独家", "tags": ["头条", "活动"], "text": "2016年1月8日、9日上海浅水湾文化艺术中心将上演一场黑客魔幻破解秀，届时任魔都天高地厚、浦江两岸风起云涌。"}
{"title": "回看2015：那些让人心悸的勒索软件", "url": "https://www.freebuf.com/news/topnews/91074.html", "time": "2015-12-31", "level": "金币+10", "num_look": 385960, "num_comment": 5, "author": "简单", "tags": ["头条", "系统安全"], "text": "古语云：谈虎色变，其实谈到勒索软件也会让人变脸，因为连FBI都表示束手无策。FBI曾公开表示如果感染了勒索软件最明智的选择是依条件支付。"}
{"title": "微软上传用户磁盘加密密钥副本到微软服务器中", "url": "https://www.freebuf.com/news/91726.html", "time": "2015-12-31", "level": "金币+10", "num_look": 231051, "num_comment": 7, "author": "Sphinx", "tags": ["系统安全", "资讯"], "text": "如果你是用微软账号登录Windows 10，那你得知道，你的电脑会自动上传你的恢复密钥。"}
{"title": "360 Marvel Team虚拟化漏洞第四弹：CVE-2015-8567漏洞分析", "url": "https://www.freebuf.com/vuls/91603.html", "time": "2015-12-31", "level": "", "num_look": 247379, "num_comment": 5, "author": "360MarvelTeam", "tags": ["漏洞"], "text": "本文为该系列的第四篇文章，也是今年的收官之作，文章将详细分析编号为CVE-2015-8567的qemu内存泄露漏洞的相关知识。"}
{"title": "亚马逊aws-shell：AWS CLI的交互式shell", "url": "https://www.freebuf.com/sectool/91580.html", "time": "2015-12-31", "level": "金币+10", "num_look": 247733, "num_comment": 3, "author": "dawner", "tags": ["工具", "系统安全"], "text": "Aws cli 是AWS(亚马逊云服务)的统一管理工具，其基于python开发，是在boto基础上的增强和封装。"}
{"title": "案例分享：疯狂的广告邮件", "url": "https://www.freebuf.com/articles/others-articles/91633.html", "time": "2015-12-31", "level": "", "num_look": 267229, "num_comment": 14, "author": "聚锋实验室", "tags": ["其他"], "text": "我们经常收到广告邮件，很多人以为广告邮件就是商家直接用自己的电脑和邮箱发出，今天这篇文章将会告诉你广告邮件不止这么简单，可以说是疯狂。"}
{"title": "这个恶意程序可以将你电脑变成代理服务器", "url": "https://www.freebuf.com/news/91581.html", "time": "2015-12-31", "level": "", "num_look": 228669, "num_comment": 3, "author": "亲爱的兔子", "tags": ["终端安全", "资讯"], "text": "安全公司Palo Alto Networks的研究人员发现了一种新的恶意程序家族ProxyBack，能将被感染的电脑变成代理服务器。"}
{"title": "庖丁解牛之UPack工作原理及实例分析（一）", "url": "https://www.freebuf.com/articles/91499.html", "time": "2015-12-30", "level": "", "num_look": 335578, "num_comment": 5, "author": "绿盟科技", "tags": ["安全管理", "文章"], "text": "本篇对Runtime压缩基础知识进行了介绍。"}
{"title": "极客教你DIY星球大战中的酷炫“光剑”", "url": "https://www.freebuf.com/geek/91634.html", "time": "2015-12-30", "level": "金币+10", "num_look": 429277, "num_comment": 14, "author": "亲爱的兔子", "tags": ["极客"], "text": "如果你有空余的时间，为什么不尝试像Bob Clagett一样制作一把超大款的星战“光剑”？"}
{"title": "俄罗斯最大搜索引擎Yandex源代码遭前雇员白菜价出售", "url": "https://www.freebuf.com/news/91576.html", "time": "2015-12-30", "level": "金币+10", "num_look": 217535, "num_comment": 13, "author": "亲爱的兔子", "tags": ["资讯"], "text": "就在圣诞节前夕，俄罗斯知名搜索引擎Yandex搜索引擎的源代码被爆在暗网上出售。"}
{"title": "谷歌浏览器插件AVG Web TuneUp曝多个高危漏洞，影响900万用户", "url": "https://www.freebuf.com/vuls/91606.html", "time": "2015-12-30", "level": "金币+10", "num_look": 355098, "num_comment": 3, "author": "SecDarker", "tags": ["漏洞"], "text": "今年8月15日, 来自project zero的成员Tavis提交了谷歌浏览器插件 AVG Web TuneUp的多个漏洞，由于该插件活跃用户约900万，所以影响范围非常广。"}
{"title": "新一代强悍web蠕虫被捕获，已感染千余网站", "url": "https://www.freebuf.com/articles/web/91139.html", "time": "2015-12-30", "level": "现金奖励", "num_look": 1256788, "num_comment": 27, "author": "KibodWapon", "tags": ["WEB安全", "系统安全"], "text": "这个蠕虫很新颖而且强大，功能上相当于一个综合漏洞扫描器。感染后的bot会从服务端接收指令，进行ddos攻击，漏洞扫描感染其他主机，作为http proxy，生成irc服务端等等。"}
{"title": "针对国外一款超火约会软件Tinder的取证分析", "url": "https://www.freebuf.com/articles/terminal/91546.html", "time": "2015-12-30", "level": "", "num_look": 329807, "num_comment": 1, "author": "哆啦A梦", "tags": ["终端安全"], "text": "Tinder是一款拥有数百万用户的热门交（yue）友(pao)软件。"}
{"title": "Android恶意软件使用内置防火墙屏蔽安全软件", "url": "https://www.freebuf.com/news/91563.html", "time": "2015-12-30", "level": "金币+10", "num_look": 238915, "num_comment": 4, "author": "Sphinx", "tags": ["终端安全", "资讯"], "text": "恶意软件的开发者们真是极为聪明，最近安全研究人员们发现开发者们现在使用开源的Android防火墙屏蔽安全软件与云服务器的通信。"}
{"title": "Libc堆管理机制及漏洞利用技术 (一）", "url": "https://www.freebuf.com/articles/system/91527.html", "time": "2015-12-30", "level": "现金奖励", "num_look": 602320, "num_comment": 6, "author": "ysyy", "tags": ["系统安全"], "text": "作为一个Windows下的病毒分析人员，决定拿Linux下libc的堆管理机制来出出气。"}
{"title": "朝鲜红星操作系统被指监控用户操作行为", "url": "https://www.freebuf.com/news/91555.html", "time": "2015-12-30", "level": "金币+5", "num_look": 230699, "num_comment": 8, "author": "寰者", "tags": ["系统安全", "资讯"], "text": "近日，在德国的汉堡会议上，有安全专家指出朝鲜自主研发的计算机操作系统（红星系统）允许监控民众私人计算机的操作行为。"}
{"title": "2015年数据库漏洞威胁报告", "url": "https://www.freebuf.com/vuls/91285.html", "time": "2015-12-29", "level": "", "num_look": 316766, "num_comment": 3, "author": "安华金和", "tags": ["安全报告", "漏洞"], "text": "回忆2015年整年发生的数据泄露事件，2015年一月机锋论坛包括用户名、邮箱、加密密码的2300万用户信息泄漏。"}
{"title": "用树莓派制作一台平板电脑", "url": "https://www.freebuf.com/geek/91402.html", "time": "2015-12-29", "level": "", "num_look": 622931, "num_comment": 16, "author": "0xroot", "tags": ["极客"], "text": ""}
{"title": "美国1.9亿选民信息泄露，当局熟视无睹", "url": "https://www.freebuf.com/news/91505.html", "time": "2015-12-29", "level": "", "num_look": 209791, "num_comment": 11, "author": "简单", "tags": ["资讯"], "text": "​一数据库因配置不当，导致美国1.91亿选民信息泄露，包括姓名、家庭住址、投票ID、出生日期、电话号码。"}
{"title": "检测一下你的专业指数：2015年十大测试工具你认识几个？", "url": "https://www.freebuf.com/sectool/91462.html", "time": "2015-12-29", "level": "红色标题", "num_look": 726366, "num_comment": 39, "author": "FireFrank", "tags": ["工具"], "text": "如果你真的喜欢安全，了解下面这些工具是你通往大神之路的必备良品，快来看看都有哪些工具并学习一下吧！"}
{"title": "欧洲信用卡终端机仍存在严重漏洞", "url": "https://www.freebuf.com/news/91461.html", "time": "2015-12-29", "level": "金币+5", "num_look": 161744, "num_comment": 1, "author": "FireFrank", "tags": ["资讯"], "text": "当美国准备转向使用\"芯片和密码\"模型的信用卡交易时，欧洲还在开心的使用传统的更加安全的人工方式进行交易。但是，欧洲现在的信用卡交易方式出现问题是迟早的事。"}
{"title": "Altman3：完美运行在多个平台的渗透测试软件", "url": "https://www.freebuf.com/sectool/91123.html", "time": "2015-12-29", "level": "金币+5", "num_look": 333437, "num_comment": 9, "author": "我是酱油男", "tags": ["工具"], "text": "Altman3 是一款渗透测试软件，代码托管于Github。"}
{"title": "0CTF 2016入选明年DEF CON CTF资格赛", "url": "https://www.freebuf.com/fevents/91320.html", "time": "2015-12-29", "level": "", "num_look": 232867, "num_comment": 232867, "author": "路由器", "tags": ["活动"], "text": "12月14日，世界黑客大赛DEF CON CTF主办方正式宣布，明年4月由中国0ops团队在上海举办的国际信息安全技术挑战赛（0CTF 2016）的冠军队伍，将获得直通DEF CON CTF总决赛的门票。"}
{"title": "一种确保Java程序安全的简单方式", "url": "https://www.freebuf.com/articles/system/91164.html", "time": "2015-12-29", "level": "金币+5", "num_look": 270264, "num_comment": 1, "author": "JackFree", "tags": ["系统安全"], "text": "其实从Java 1.1开始，Java中就存在一种方式来限制代码执行，并能够防止远程代码执行，这就是SecurityManager。"}
{"title": "在Kali 2.0下安装破解最新版Cobalt Strike", "url": "https://www.freebuf.com/sectool/91144.html", "time": "2015-12-29", "level": "", "num_look": 710431, "num_comment": 18, "author": "Mikolen", "tags": ["工具"], "text": "Cobalt Strike-Armitage是一个图形化的metasploit管理工具，它可视化你的攻击目标，推荐exploit和公开了metasploit框架的高级功能。"}
{"title": "极客DIY：使用树莓派制作一套“NAS+私有云盘+下载机”", "url": "https://www.freebuf.com/sectool/91255.html", "time": "2015-12-29", "level": "现金奖励", "num_look": 2491577, "num_comment": 12, "author": "HackLiu", "tags": ["工具", "极客"], "text": "使用树莓派和移动硬盘自己DIY一个下载器"}
{"title": "恶意广告软件利用User.js文件禁用Firefox安全浏览功能", "url": "https://www.freebuf.com/news/91183.html", "time": "2015-12-29", "level": "金币+5", "num_look": 168727, "num_comment": 1, "author": "寰者", "tags": ["终端安全", "资讯"], "text": "近日，安全专家发现有2款PUP（潜在恶意程序）能够暗中关闭Firefox的安全浏览功能，以便能在浏览器中自动播放垃圾广告。"}
{"title": "看似鸡肋的ESPCMS后台注入，其实可以很好玩", "url": "https://www.freebuf.com/vuls/91443.html", "time": "2015-12-28", "level": "", "num_look": 345509, "num_comment": 14, "author": "阿里安全", "tags": ["漏洞"], "text": "昨日，乌云漏洞平台公开了一个ESPCMS的注入漏洞，阿里云计算安全攻防对抗团队的小伙伴第一时间对漏洞做了一个影响评估，没想到结果竟是这样。"}
{"title": "OLEOutlook利用：一封邮件绕过所有企业安全防控", "url": "https://www.freebuf.com/vuls/91220.html", "time": "2015-12-28", "level": "金币+5", "num_look": 520975, "num_comment": 16, "author": "鸢尾", "tags": ["漏洞", "终端安全"], "text": "在本文中，我会向大家展示如何通过Email将一个可执行文件嵌入到公司网络。伪装成一份Word文档，绕过防火墙，目前该问题还没有任何补丁发布！"}
{"title": "青藤云安全获宽带资本、红点创投六千万人民币A轮融资", "url": "https://www.freebuf.com/news/91305.html", "time": "2015-12-28", "level": "", "num_look": 162389, "num_comment": 8, "author": "路由器", "tags": ["资讯"], "text": "12月28日，互联网企业安全初创公司青藤云安全宣布获得来自宽带资本、红点创投的六千万人民币A轮融资，该金额刷新了国内安全初创企业A轮融资记录。"}
{"title": "评委们眼中的2015互联网安全年度评选", "url": "https://www.freebuf.com/news/topnews/89860.html", "time": "2015-12-28", "level": "红色标题", "num_look": 404181, "num_comment": 6, "author": "FB独家", "tags": ["头条", "活动"], "text": "2015即将过去，评委们对过去一年发生的林林总总的安全事件有何看法？他们对各大奖项的评选标准和看法又有哪些？"}
{"title": "技术揭秘：为什么伪造SHA-1证书比找SHA-1哈希碰撞难？", "url": "https://www.freebuf.com/articles/network/91339.html", "time": "2015-12-28", "level": "金币+8", "num_look": 505376, "num_comment": 10, "author": "xiaix", "tags": ["网络安全", "观点"], "text": "本文将讲述如何利用哈希碰撞来伪造数字证书，以及证书颁发机构如何通过例如使用随机证书序列号等措施使得攻击者更加难以伪造数字证书。"}
{"title": "勒索软件Gomasom受害者的福音：免费解锁的工具已出", "url": "https://www.freebuf.com/news/91251.html", "time": "2015-12-28", "level": "金币+8", "num_look": 212585, "num_comment": 6, "author": "dawner", "tags": ["资讯"], "text": "来自Emsisoft的安全研究员Fabian Wosar，他推出了一款针对Gomasom恶意赎金软件的解锁工具。与此同时，相应的用户指南被放在了Bleeping Computer论坛上。"}
{"title": "BadBarcode条码攻击浅析", "url": "https://www.freebuf.com/news/topnews/91097.html", "time": "2015-12-28", "level": "现金奖励", "num_look": 313033, "num_comment": 9, "author": "阿金", "tags": ["头条", "极客"], "text": "其实关于条码及二维码的安全研究由来已久，本文主要为大家介绍一下badbarcode最基本的原理以及简单的badbarcode攻击。"}
{"title": "剑走偏锋：基于静态检测的IE漏洞检测工具IEFuzz", "url": "https://www.freebuf.com/sectool/91180.html", "time": "2015-12-28", "level": "金币+8", "num_look": 309468, "num_comment": 10, "author": "寰者", "tags": ["WEB安全", "工具"], "text": "本文主要分享一款静态的IE浏览器模糊测试工具，该工具被称为IEFuzz。我们知道，像其他大部分软件一样，浏览器也往往通过两种方式进行模糊测试，一种为静态，另外一种则为动态。"}
{"title": "对匿名社交应用Yik Yak的安卓APP逆向之旅", "url": "https://www.freebuf.com/articles/terminal/91171.html", "time": "2015-12-28", "level": "金币+8", "num_look": 253275, "num_comment": 7, "author": "JackFree", "tags": ["终端安全"], "text": "本文主要对安卓平台上的匿名社交媒体应用Yik Yak进行逆向分析，发现该APP用到了代码混淆、字符串混淆、防签名篡改校验等技术，并总结了APP分析的流程和方法。"}
{"title": "如何基于菜刀PHP一句话实现单个文件批量上传？", "url": "https://www.freebuf.com/sectool/91082.html", "time": "2015-12-28", "level": "现金奖励", "num_look": 715243, "num_comment": 13, "author": "安全小飞侠", "tags": ["工具"], "text": "如何快速的实现文件的批量上传呢？本文尝试以菜刀的php一句话为例来分析一下如何实现这类需求。"}
{"title": "Lobotomy：Android逆向工程框架（Part1）", "url": "https://www.freebuf.com/sectool/91202.html", "time": "2015-12-28", "level": "金币+8", "num_look": 274791, "num_comment": 5, "author": "鸢尾", "tags": ["头条", "工具"], "text": "该系列文章是Lobotomy框架的一份指南，该框架也可以说是rotlogix对技术的沉淀。"}
{"title": "Ramnit僵尸网络归来，被猜测为同一团队所为", "url": "https://www.freebuf.com/news/91214.html", "time": "2015-12-28", "level": "", "num_look": 145709, "num_comment": 1, "author": "亲爱的兔子", "tags": ["资讯"], "text": "2015年2月底，欧洲刑警组织(Europol)与多家网络安全公司摧毁了金融诈骗网站Ramnit僵尸网络的C&C(命令与控制)服务器。"}
{"title": "PHP代码审计工具Rips Scanners v0.5曝本地文件包含漏洞", "url": "https://www.freebuf.com/vuls/91064.html", "time": "2015-12-27", "level": "", "num_look": 330723, "num_comment": 13, "author": "我是酱油男", "tags": ["漏洞"], "text": "RIPS是一个用php编写的源代码分析工具，它使用了静态分析技术，能够自动化地挖掘PHP源代码潜在的安全漏洞。渗透测试人员可以直接容易的审阅分析结果，而不用审阅整个程序代码。"}
{"title": "针对Linux系统全盘加密的启动攻击", "url": "https://www.freebuf.com/articles/system/91151.html", "time": "2015-12-27", "level": "", "num_look": 277542, "num_comment": 1, "author": "vulture", "tags": ["系统安全"], "text": "最近，我们高谭数码科技(GDS)的研究人员讨论了针对Linux系统全盘加密的冷启动攻击，大家都认为这种攻击是可行的，但执行这么一次攻击有多难？攻击的可行性有多少呢？"}
{"title": "土耳其上周遭遇了史上最大规模的网络攻击", "url": "https://www.freebuf.com/news/91124.html", "time": "2015-12-27", "level": "金币+8", "num_look": 325706, "num_comment": 5, "author": "亲爱的兔子", "tags": ["资讯"], "text": "报道称目前土耳其注册网站上周遭遇了史上最大规模的网络攻击。"}
{"title": "跨平台版中国菜刀Cknife发布", "url": "https://www.freebuf.com/sectool/91105.html", "time": "2015-12-27", "level": "金币+8", "num_look": 2121368, "num_comment": 72, "author": "Chora", "tags": ["工具"], "text": "Cknife是一款类似于菜刀的工具，和菜刀不同的是它采用Java编写，和Burp Suite一样可以跨平台使用。"}
{"title": "黑客组织Phantom Squad圣诞节发起DDoS攻击，多款知名游戏受影响", "url": "https://www.freebuf.com/news/91100.html", "time": "2015-12-26", "level": "金币+8", "num_look": 165807, "num_comment": 1, "author": "亲爱的兔子", "tags": ["文章", "资讯"], "text": "曾经承诺要在圣诞假期里向Xbox Live和PlayStation Network发起攻击的黑客组织Phantom Squad，已经开始向EA(Electronic Arts)发动了小规模的网络攻击。"}
{"title": "可穿戴设备可成为黑客埋伏在你身边的间谍", "url": "https://www.freebuf.com/news/91115.html", "time": "2015-12-26", "level": "金币+8", "num_look": 171403, "num_comment": 8, "author": "JackFree", "tags": ["资讯"], "text": "最新研究表明，智能手表、健康追踪器（Fitness Tracker）等腕带和臂章设备有可能被攻击者用来监视你"}
{"title": "良心赞助者：愿帮助树莓派安装后门程序", "url": "https://www.freebuf.com/news/91098.html", "time": "2015-12-26", "level": "金币+8", "num_look": 251672, "num_comment": 6, "author": "亲爱的兔子", "tags": ["文章", "资讯"], "text": "在上周三，Raspberry Pi基金会公布一条消息，消息称有人曾表示愿出资在其设备中安装一款恶意软件。"}
{"title": "JAVA序列化和反序列化，以及漏洞补救", "url": "https://www.freebuf.com/vuls/90840.html", "time": "2015-12-26", "level": "", "num_look": 1261634, "num_comment": 4, "author": "绿盟科技", "tags": ["WEB安全", "漏洞"], "text": "Joomla漏洞在官方发布升级版和补丁之前，已经在各种地下黑色产业链中流传了一段时间，恐怕并且已经有不少网站被黑客拿下。"}
{"title": "凯悦酒店证实：公司支付系统遭到攻击", "url": "https://www.freebuf.com/news/90998.html", "time": "2015-12-26", "level": "", "num_look": 189261, "num_comment": 2, "author": "亲爱的兔子", "tags": ["资讯"], "text": "凯悦酒店集团目前发布证明证实，该公司支付处理系统已遭恶意软件感染。"}
{"title": "如何彻底清除硬盘里的数据？", "url": "https://www.freebuf.com/news/91059.html", "time": "2015-12-25", "level": "红色标题", "num_look": 772511, "num_comment": 48, "author": "小太阳花", "tags": ["终端安全", "资讯"], "text": "如果只是泡水被打湿，数据很容易恢复，要彻底毁掉一块硬盘还需要有更有效的方法。"}
{"title": "Linux 恶意程序分析学习笔记", "url": "https://www.freebuf.com/articles/system/90936.html", "time": "2015-12-25", "level": "现金奖励", "num_look": 547251, "num_comment": 7, "author": "SecDarker", "tags": ["系统安全"], "text": "Linux 下的恶意程序相对windows来说应该是非常少的，在​病毒库网站中几十上百个病毒样本中才会出现一个linux的样本。"}
{"title": "专访尹毅（法师Seay）：少年成名，野路子的奇妙逆袭", "url": "https://www.freebuf.com/articles/people/90997.html", "time": "2015-12-25", "level": "", "num_look": 1114776, "num_comment": 63, "author": "T00ls安全", "tags": ["人物志"], "text": "尹毅（法师Seay），一位90后，却又是有点不同的一位。他是阿里集团最年轻的P7，有着非凡的成长经历。"}
{"title": "Joomla反序列化漏洞的查漏补缺", "url": "https://www.freebuf.com/vuls/91012.html", "time": "2015-12-25", "level": "", "num_look": 340518, "num_comment": 6, "author": "绿盟科技", "tags": ["漏洞"], "text": "Joomla改变了PHP默认的SESSION处理方式了吗？"}
{"title": "DVNA：Node.js打造的开源攻防平台", "url": "https://www.freebuf.com/sectool/91004.html", "time": "2015-12-25", "level": "金币+5", "num_look": 367337, "num_comment": 3, "author": "dawner", "tags": ["WEB安全", "工具"], "text": "DVNA是一款免费软件：你可以根据GNU GPL里的条款，在此版本或者以后的版本里，对它进行提交修改。"}
{"title": "【更新海康威视独家回应】2015年国内数据安全事件盘点", "url": "https://www.freebuf.com/news/90865.html", "time": "2015-12-25", "level": "红色标题", "num_look": 438119, "num_comment": 11, "author": "安华金和", "tags": ["头条", "资讯"], "text": "12月，以“互联互通、共享共治——构建网络空间命运共同体”为主题的第二届世界互联网在浙江乌镇又一次震撼世界。"}
{"title": "使用Python Shells绕过杀毒软件", "url": "https://www.freebuf.com/articles/network/90966.html", "time": "2015-12-25", "level": "金币+5", "num_look": 477977, "num_comment": 7, "author": "FireFrank", "tags": ["网络安全"], "text": "如果你使用二进制，而这个二进制文件被You can bypass AV修改导致它的签名被移除了，然后加密、打包，修改源代码或者重新编辑源代码并使用我个人最喜欢的自定义程序。"}
{"title": "利用Censys批量获取Juniper Netscreen后门", "url": "https://www.freebuf.com/vuls/90886.html", "time": "2015-12-25", "level": "现金奖励", "num_look": 513762, "num_comment": 11, "author": "阿金", "tags": ["漏洞", "系统安全"], "text": "Censys是一款用以搜索联网设备信息的新型搜索引擎，通过这篇文章，我们来学习一下如何利用它来批量找出存在后门的Juniper Netscreen设备。"}
{"title": "入侵明星账户窃取性爱视频，巴哈马男子面临起诉", "url": "https://www.freebuf.com/news/90945.html", "time": "2015-12-25", "level": "金币+5", "num_look": 220901, "num_comment": 7, "author": "亲爱的兔子", "tags": ["资讯"], "text": "巴哈马男子阿朗佐·诺尔斯（Alonzo Knowles）被控以计算机病毒程序入侵130余位明星的邮件账户并窃取性爱视频、色情照片、电影剧本以及其他敏感的私人信息。"}
{"title": "雅虎提醒用户小心政府黑客攻击", "url": "https://www.freebuf.com/news/90838.html", "time": "2015-12-24", "level": "", "num_look": 194474, "num_comment": 2, "author": "简单", "tags": ["资讯"], "text": "Twitter和Facebook之前都曾提醒其用户正在被政府黑客监视，这次雅虎再次发声提醒用户，他们或许正在被政府赞助黑客监视。"}
{"title": "利用Shodan和Censys进行信息侦查", "url": "https://www.freebuf.com/articles/web/90887.html", "time": "2015-12-24", "level": "金币+5", "num_look": 686103, "num_comment": 7, "author": "JackFree", "tags": ["WEB安全"], "text": "在渗透测试的初始阶段，Shodan、Censys等在线资源可以作为一个起点来识别目标机构的技术痕迹。"}
{"title": "Tap Lan 实战之“伪装的路由”", "url": "https://www.freebuf.com/news/topnews/90843.html", "time": "2015-12-24", "level": "现金奖励", "num_look": 740411, "num_comment": 64, "author": "creturn", "tags": ["头条", "极客"], "text": "要是能黑掉随便一个安服的人，请你吃一个星期羊肉泡馍！"}
{"title": "美监狱系统漏洞存在13年，提前释放服刑者3000多人", "url": "https://www.freebuf.com/news/90881.html", "time": "2015-12-24", "level": "金币+5", "num_look": 162833, "num_comment": 9, "author": "亲爱的兔子", "tags": ["资讯"], "text": "目前由于一个计算机系统错误，美国华盛顿州已经有将近3200名囚犯被提早放出。"}
{"title": "杀器BLUTO：DNS探测+域名猜解+邮箱枚举", "url": "https://www.freebuf.com/sectool/90898.html", "time": "2015-12-24", "level": "金币+5", "num_look": 459486, "num_comment": 6, "author": "dawner", "tags": ["工具", "网络安全"], "text": "BLUTO是一款信息探测和爆破工具，它的功能有DNS探测、暴力猜解、DNS域传送，和电子邮箱枚举。"}
{"title": "如何用机器学习的方法检测恶意软件", "url": "https://www.freebuf.com/articles/network/90844.html", "time": "2015-12-24", "level": "", "num_look": 506757, "num_comment": 6, "author": "明明知道", "tags": ["网络安全"], "text": "恶意软件的全面研究可以说不是个简单的任务。"}
{"title": "微软OneNote 2013空指针读取或造成RCE", "url": "https://www.freebuf.com/vuls/90793.html", "time": "2015-12-24", "level": "金币+6", "num_look": 217538, "num_comment": 1, "author": "鸢尾", "tags": ["漏洞"], "text": "根据WinDBG的!exploitable扩展，微软OneNote 2013至少存在一个拒绝服务漏洞并且极易造成远程代码执行。"}
{"title": "PHP序列化与反序列化解读", "url": "https://www.freebuf.com/articles/web/90837.html", "time": "2015-12-24", "level": "现金奖励", "num_look": 522539, "num_comment": 2, "author": "cone", "tags": ["WEB安全"], "text": "花费了点时间研究了下PHP序列化,写在这里。一是方便自己知识点记忆,二是帮助同样有疑问的人,欢迎指正错误。"}
{"title": "征战不断：亚美尼亚黑客公布阿塞拜疆政府服务器敏感数据", "url": "https://www.freebuf.com/news/90586.html", "time": "2015-12-24", "level": "", "num_look": 325226, "num_comment": 5, "author": "寰者", "tags": ["网络安全", "资讯"], "text": "来自的蒙特·梅尔科尼安网络军队(MMCA)的亚美尼亚黑客从阿塞拜疆政府服务器上获取敏感数据，并在FaceBook上公布，数据主要包含阿塞拜疆公民有关信息。"}
{"title": "美国五角大楼计划推出对付ISIS网络活动新武器", "url": "https://www.freebuf.com/news/90748.html", "time": "2015-12-23", "level": "金币+6", "num_look": 281015, "num_comment": 2, "author": "亲爱的兔子", "tags": ["资讯"], "text": "​五角大楼有消息称，美国军方领导人计划针对ISIS（Daesh、IS、ISIL）开发和部署恶意程序的打算，以期达到破坏ISIS组织计算机网络、阻碍其线上活动的目的。"}
{"title": "Java反序列化漏洞之weblogic本地利用实现篇", "url": "https://www.freebuf.com/vuls/90802.html", "time": "2015-12-23", "level": "现金奖励", "num_look": 1876570, "num_comment": 37, "author": "rebeyond", "tags": ["漏洞", "系统安全"], "text": "weblogic在国内的的应用范围比较广，维护人员也都意识到了这个漏洞的危害性，只是网上公开的检测方法易用性不是太好，检测起来比较麻烦。"}
{"title": "【安全创业巡礼】专访洋葱创始人吴洪声：让繁琐的密码从此消失", "url": "https://www.freebuf.com/news/90481.html", "time": "2015-12-23", "level": "", "num_look": 386677, "num_comment": 6, "author": "FB独家", "tags": ["人物志", "资讯"], "text": "如今，我们无时无刻不在和密码打交道，手机密码、银行卡密码、支付宝密码…"}
{"title": "自动化的Serpico：渗透测试报告的好帮手", "url": "https://www.freebuf.com/sectool/90747.html", "time": "2015-12-23", "level": "金币+6", "num_look": 413620, "num_comment": 7, "author": "dawner", "tags": ["工具", "网络安全"], "text": "Serpico是一款帮助渗透测试生成报告的协作工具。简单来说，它能自动化生成报告，减少浪费在撰写上面的时间。"}
{"title": "4000个微笑表情能使WhatsApp崩溃？", "url": "https://www.freebuf.com/news/90730.html", "time": "2015-12-23", "level": "金币+6", "num_look": 372503, "num_comment": 26, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "一位独立研究员报告了存在于WhatsApp中的一个新漏洞，通过利用该漏洞，任何人都可以远程使WhatsApp崩溃。"}
{"title": "一周PowerShell脚本Day 5：DNS和ICMP脚本", "url": "https://www.freebuf.com/sectool/90616.html", "time": "2015-12-23", "level": "金币+6", "num_look": 508916, "num_comment": 3, "author": "xiaix", "tags": ["工具"], "text": "通常情况下防火墙都不会主动过滤ICMP和DNS数据包，这就让我们可以使用它们。下面就让我们来看看具体怎么利用吧。"}
{"title": "揭秘：广告拦截软件如何赚钱？", "url": "https://www.freebuf.com/articles/others-articles/90583.html", "time": "2015-12-23", "level": "金币+6", "num_look": 187742, "num_comment": 5, "author": "FireFrank", "tags": ["其他"], "text": "生活中没有免费的午餐，同理，拦截软件也不是免费的，也就是说拦截广告也可以赚钱。"}
{"title": "SlemBunk：以全球银行APP用户为目标的Android木马家族", "url": "https://www.freebuf.com/articles/terminal/90686.html", "time": "2015-12-23", "level": "", "num_look": 184006, "num_comment": 2, "author": "vul_wish", "tags": ["终端安全"], "text": "FireEye的移动研究员近日发现了一系列Android木马程序，这些程序通过模仿33个全球金融管理机构和服务提供商的合法APP执行一系列恶意行为，称之为“SlemBunk”。"}
{"title": "海盗湾创始人出狱后开发无限复制MP3的装置", "url": "https://www.freebuf.com/news/90620.html", "time": "2015-12-23", "level": "金币+6", "num_look": 163498, "num_comment": 8, "author": "亲爱的兔子", "tags": ["资讯"], "text": "最近海盗湾的创始人皮特·桑德(Peter Sunde)开发了一台无限复制MP3的装置。"}
{"title": "浏览器三巨头：明年中期放弃对SHA-1证书支持", "url": "https://www.freebuf.com/news/90589.html", "time": "2015-12-22", "level": "", "num_look": 186441, "num_comment": 5, "author": "dawner", "tags": ["资讯"], "text": "现在谷歌表示，将于明年中期正式放弃Chrome对于SHA-1证书的支持。"}
{"title": "Microsoft Outlook曝严重漏洞，可导致远程代码执行", "url": "https://www.freebuf.com/vuls/90473.html", "time": "2015-12-22", "level": "金币+6", "num_look": 641600, "num_comment": 15, "author": "寰者", "tags": ["漏洞", "系统安全"], "text": "近期，微软发布了一系列补丁，修复了自身产品中一些影响广泛以及关键的Bug，其中包括更新了微软Office套件版本，解决了其中的部分安全问题。"}
{"title": "Windows内核漏洞MS15-010/CVE-2015-0057分析及利用（含EXP）", "url": "https://www.freebuf.com/vuls/90501.html", "time": "2015-12-22", "level": "金币+7", "num_look": 460039, "num_comment": 11, "author": "鸢尾", "tags": ["漏洞"], "text": "早在2015年初Udi Yavo[1]发现一枚影响Windows XP到Windows 10(预览版)的Windows内核漏洞，以下为两篇有关CVE-2015-0057的分析文章。"}
{"title": "安全创业巡礼：专访大数据安全公司瀚思科技", "url": "https://www.freebuf.com/news/topnews/90187.html", "time": "2015-12-22", "level": "", "num_look": 188716, "num_comment": 6, "author": "FB独家", "tags": ["头条"], "text": "传统以防御为核心（Signature Based）的安全策略已经过时，信息安全正在变成一个大数据分析问题，大规模的安全数据需要被有效地关联、分析和挖掘。"}
{"title": "物联网安全：LED灯中存在多个安全漏洞", "url": "https://www.freebuf.com/articles/terminal/90543.html", "time": "2015-12-22", "level": "", "num_look": 306041, "num_comment": 2, "author": "vul_wish", "tags": ["终端安全"], "text": "近日，有国外安全专家发现Zengge公司的WIFI LED灯中存在多个安全漏洞。"}
{"title": "Sublist3r：子域名快速枚举工具", "url": "https://www.freebuf.com/sectool/90584.html", "time": "2015-12-22", "level": "金币+7", "num_look": 1044407, "num_comment": 13, "author": "寰者", "tags": ["工具"], "text": "Sublist3r是一个python版工具，其设计原理是基于通过使用搜索引擎，从而对站点子域名进行列举。"}
{"title": "2013至2015年iOS平台网银应用安全性对比", "url": "https://www.freebuf.com/news/90574.html", "time": "2015-12-22", "level": "金币+7", "num_look": 152523, "num_comment": 1, "author": "JackFree", "tags": ["资讯"], "text": "本文主要从传输安全、编译器保护、UIWebView、数据存储、日志文件、二进制文件等方面研究了它们的安全性。"}
{"title": "一周PowerShell脚本Day 4：WMI脚本", "url": "https://www.freebuf.com/sectool/90454.html", "time": "2015-12-22", "level": "金币+7", "num_look": 228260, "num_comment": 3, "author": "xiaix", "tags": ["工具"], "text": "欢迎来到一周Powershell脚本的第四天。今天我所将讨论的脚本跟前几天的大不相同，我们将讨论利用WMI的脚本。"}
{"title": "POSIX shell技巧分享篇", "url": "https://www.freebuf.com/news/topnews/90492.html", "time": "2015-12-22", "level": "", "num_look": 325184, "num_comment": 2, "author": "dawner", "tags": ["头条", "系统安全"], "text": "本文是用来记录我发现的一些有用的小技巧，这是关于POSIX（以及其他不符规范）的shell脚本技巧的paper。"}
{"title": "Android WebView远程执行代码漏洞浅析", "url": "https://www.freebuf.com/vuls/90552.html", "time": "2015-12-22", "level": "", "num_look": 608316, "num_comment": 5, "author": "绿盟科技", "tags": ["漏洞", "系统安全"], "text": "本文从WebView的概念开始详细介绍了webView漏洞的成因、利用和检测方法，并在文章的末尾对此类漏洞进行了一些思考和总结。"}
{"title": "黑客组织SkidNP：圣诞节将攻击Steam和“我的世界”服务器", "url": "https://www.freebuf.com/news/90395.html", "time": "2015-12-22", "level": "", "num_look": 187819, "num_comment": 4, "author": "亲爱的兔子", "tags": ["资讯"], "text": "近日，一黑客组织“SkidNP”表示计划在圣诞节期间攻击Steam和“我的世界”服务器。"}
{"title": "匿名者(Anonymous)向土耳其根域名服务器发起DDos攻击", "url": "https://www.freebuf.com/news/90404.html", "time": "2015-12-21", "level": "金币+7", "num_look": 185205, "num_comment": 9, "author": "亲爱的兔子", "tags": ["资讯"], "text": "12月14日，由NIC.tr管理的土耳其根DNS服务器遭到了一次40Gbps DDoS大型网络攻击。"}
{"title": "京东金融支付产品技术部招募安全工程师", "url": "https://www.freebuf.com/jobs/90268.html", "time": "2015-12-21", "level": "", "num_look": 193350, "num_comment": 12, "author": "京东金融", "tags": ["安全招聘"], "text": "​京东金融，于2013年10月开始独立运营。"}
{"title": "一周PowerShell脚本Day 3：HTTPS脚本", "url": "https://www.freebuf.com/sectool/90416.html", "time": "2015-12-21", "level": "金币+7", "num_look": 270939, "num_comment": 3, "author": "xiaix", "tags": ["工具"], "text": "欢迎来到一周PowerShell脚本的第三天，今天我们将讨论HTTP/HTTPS。"}
{"title": "超过650TB MongoDB数据在互联网上裸奔", "url": "https://www.freebuf.com/news/90398.html", "time": "2015-12-21", "level": "", "num_look": 362591, "num_comment": 4, "author": "JackFree", "tags": ["数据安全", "资讯"], "text": "超过650TB的MongoDB数据因数据库配置不当而暴露，其中的大多数数据库都托管在Amazon、阿里巴巴和DigitalOcean运营的云计算平台上。"}
{"title": "我有两把枪：Powershell + HTA", "url": "https://www.freebuf.com/sectool/90362.html", "time": "2015-12-21", "level": "现金奖励", "num_look": 1100742, "num_comment": 77, "author": "LJokerP", "tags": ["工具"], "text": "众所周知，Powershell早已被集成到了windows的环境中，国外大牛玩得不亦乐乎，而国内圈子却很少听到讨论Powershell的..."}
{"title": "插了广告又挂马：“叮叮天气”搞了上百家网站", "url": "https://www.freebuf.com/articles/terminal/90302.html", "time": "2015-12-21", "level": "", "num_look": 345273, "num_comment": 8, "author": "360安全", "tags": ["终端安全"], "text": "从16日开始，叮叮天气拉取并插入浏览器进行劫持的广告有一个伪装成“大战神”的广告包含了漏洞挂马代码，导致用户在访问各大知名网站时遭到挂马攻击。"}
{"title": "iOS越狱设备木马TinyV出现", "url": "https://www.freebuf.com/news/90281.html", "time": "2015-12-21", "level": "", "num_look": 210860, "num_comment": 2, "author": "亲爱的兔子", "tags": ["漏洞", "资讯"], "text": "近日网络安全公司Palo Alto Networks公司的安全研究人员Claud Xiao发布了一篇内容为分析新木马“TinyV”的文章。"}
{"title": "极客美女又来了：发明实体版水果忍者", "url": "https://www.freebuf.com/news/90343.html", "time": "2015-12-21", "level": "金币+5", "num_look": 241237, "num_comment": 14, "author": "亲爱的兔子", "tags": ["极客", "资讯"], "text": "还记得那个打造扇脸闹钟的极客美女吗？这个美女最近又做了一个好玩的设备，可以让你感受真实版的水果忍者。"}
{"title": "安全研究员发现Instagram漏洞，遭FaceBook高管威胁", "url": "https://www.freebuf.com/news/90345.html", "time": "2015-12-21", "level": "金币+5", "num_look": 221561, "num_comment": 5, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "安全研究员曾发现了Instagram中一系列安全漏洞和配置缺陷，利用漏洞他获取在Instagram服务器上敏感数据的权限；在他向相关厂商报告了这些漏洞后，却受到了Facebook的威胁！"}
{"title": "安全研究员发现HIV交友APP漏洞，反被厂商用艾滋病威胁", "url": "https://www.freebuf.com/news/90287.html", "time": "2015-12-20", "level": "金币+5", "num_look": 251166, "num_comment": 8, "author": "江湖小吓", "tags": ["资讯"], "text": "一个专为艾滋病阳性用户网上交友的应用程序开发商用艾滋病病毒威胁安全研究人员不能向他们通知程序中任何安全漏洞。"}
{"title": "浅析PRODIGAL：真实企业中的内部威胁检测系统", "url": "https://www.freebuf.com/articles/security-management/90286.html", "time": "2015-12-20", "level": "现金奖励", "num_look": 453945, "num_comment": 16, "author": "windhawk", "tags": ["安全管理"], "text": "内部威胁（Insider Threats, ITs）已经成为了威胁美国政府和企业界的主要问题，通过这篇文章我们一起来学习如何检测自己企业中的内部威胁。"}
{"title": "日本研究者通过手机对联网汽车发起DDoS攻击", "url": "https://www.freebuf.com/news/90348.html", "time": "2015-12-20", "level": "金币+5", "num_look": 152907, "num_comment": 3, "author": "JackFree", "tags": ["资讯"], "text": "日本广岛城市大学信息科学研究生院的副教授展示了如何利用一个APP和一个定制的WiFi设备来攻击联网汽车的。"}
{"title": "2016企业安全9大技术趋势", "url": "https://www.freebuf.com/articles/neopoints/90276.html", "time": "2015-12-19", "level": "", "num_look": 408018, "num_comment": 6, "author": "360安全", "tags": ["企业安全", "安全管理"], "text": "2015年威胁情报受到热捧，预计2016年威胁情报需求将持续升温。"}
{"title": "一周PowerShell脚本Day 2：UDP交互式PowerShell脚本", "url": "https://www.freebuf.com/sectool/90191.html", "time": "2015-12-19", "level": "金币+5", "num_look": 234113, "num_comment": 3, "author": "xiaix", "tags": ["工具"], "text": "欢迎来到一周PowerShell脚本的第二天。今天我会介绍使用UDP的交互式PowerShell脚本。"}
{"title": "圣经和古兰经APP中被发现监控木马", "url": "https://www.freebuf.com/news/90299.html", "time": "2015-12-19", "level": "金币+5", "num_look": 232960, "num_comment": 4, "author": "月球下雨了", "tags": ["终端安全", "资讯"], "text": "圣经和古兰经应用程序当中发现了百余种恶意软件，其中大部分可以在Android商店找到，iOS中也发现了一些。"}
{"title": "InterApp：可窃取周围任意手机数据的系统", "url": "https://www.freebuf.com/news/90272.html", "time": "2015-12-18", "level": "金币+5", "num_look": 244590, "num_comment": 14, "author": "bonABC", "tags": ["资讯"], "text": "几乎所有的网站和app都会搜集用户的数据，然后自己使用这些数据或者卖给广告商以谋取利益。"}
{"title": "SECCON 2015 CTF精选：一道400分的Android APK逆向题", "url": "https://www.freebuf.com/articles/others-articles/90203.html", "time": "2015-12-18", "level": "金币+5", "num_look": 442439, "num_comment": 13, "author": "小太阳花", "tags": ["其他"], "text": "这是一道SECCON 2015 CTF挑战赛中“Android APK 逆向”的第二道题目，提示为：“key 就存储在应用程序中，但是你需要hack掉服务器。”"}
{"title": "黑吃黑：鬼影DDoS黑客追踪", "url": "https://www.freebuf.com/articles/terminal/90121.html", "time": "2015-12-18", "level": "", "num_look": 695336, "num_comment": 16, "author": "安天追影", "tags": ["系统安全", "终端安全"], "text": "安天追影小组通过威胁态势感知系统发现了一个DDoS攻击控制事件。从一个控制事件开始进行了一次黑客追踪之旅。"}
{"title": "索尼PS4破解之用户层代码执行", "url": "https://www.freebuf.com/geek/90015.html", "time": "2015-12-18", "level": "金币+5", "num_look": 251722, "num_comment": 4, "author": "鸢尾", "tags": ["极客"], "text": "ROP只是以一种聪明的方法执行现有的加载到内存中的代码，同时在技术上来讲ROP是一种图灵完全性(Turing complete)。"}
{"title": "听说抢火车票也能开外挂了？别逗了！", "url": "https://www.freebuf.com/news/90142.html", "time": "2015-12-18", "level": "", "num_look": 295495, "num_comment": 7, "author": "AVLTeam", "tags": ["终端安全", "资讯"], "text": "12月8日，春运火车票开始预售。大批“城市候鸟们”蜂拥至12306购票网站、客户端，只为能抢到助他们完成春节迁徙的车票。"}
{"title": "FireEye：Active PowerShell窃取数据之谜", "url": "https://www.freebuf.com/articles/database/90052.html", "time": "2015-12-18", "level": "金币+5", "num_look": 279636, "num_comment": 2, "author": "FireFrank", "tags": ["安全报告", "数据安全"], "text": "火眼发现：攻击者通过Windows的PowerShell来窃取受害者的数据，通过火眼的这篇文章，我们一起来看攻击者是如何通过PowerShell脚本来窃取受害者数据的呢？"}
{"title": "一周PowerShell脚本Day 1：TCP交互式PowerShell脚本", "url": "https://www.freebuf.com/sectool/89918.html", "time": "2015-12-18", "level": "金币+5", "num_look": 332625, "num_comment": 5, "author": "xiaix", "tags": ["工具"], "text": "我发现很多的黑客和防御者都不知道PowerShell能做什么以及PowerShell是多么的方便。"}
{"title": "OSX内核调试技巧分享", "url": "https://www.freebuf.com/articles/system/90049.html", "time": "2015-12-18", "level": "现金奖励", "num_look": 745755, "num_comment": 18, "author": "熊猫正正", "tags": ["系统安全"], "text": "最近几年android/ios的木马，漏洞不断增加，有利益的地方，就有人想从中获利，随着市场的越来越大，肯定会有越来越多的黑（灰）产人员想从中获利。"}
{"title": "圣诞大作战：黑客组织计划攻击微软Xbox和索尼游戏网络", "url": "https://www.freebuf.com/news/89922.html", "time": "2015-12-18", "level": "", "num_look": 336677, "num_comment": 4, "author": "亲爱的兔子", "tags": ["网络安全", "资讯"], "text": "近日一个用户名为Phantom Squad的账号在Twitter上宣布，他们将在今年圣诞节攻击并关闭微软Xbox Live和索尼PlayStation Network(PSN)网站。"}
{"title": "Joomla高危漏洞扫描事件分析", "url": "https://www.freebuf.com/articles/database/90002.html", "time": "2015-12-17", "level": "", "num_look": 377171, "num_comment": 9, "author": "白帽汇", "tags": ["数据安全", "观点"], "text": "12月14日，Joomla官方网站紧急发布了一条由于安全漏洞引发的版本更新（3.4.6）。"}
{"title": "Grub2被曝登陆验证绕过0Day，影响众多Linux版本（CVE-2015-8370）", "url": "https://www.freebuf.com/vuls/90048.html", "time": "2015-12-17", "level": "金币+10", "num_look": 909225, "num_comment": 15, "author": "SecDarker", "tags": ["数据安全", "漏洞"], "text": "研究人员发现了一个Grub2的漏洞，这一漏洞在某些情况下可被利用，允许攻击者本地绕过任何形式的认证，从而获得计算机的控制权。"}
{"title": "没有色彩的TK教主和他的腾讯玄武实验室", "url": "https://www.freebuf.com/news/topnews/89937.html", "time": "2015-12-17", "level": "红色标题", "num_look": 1119616, "num_comment": 44, "author": "FB独家", "tags": ["人物志", "头条"], "text": "年轻的玄武实验室在教主的引导下创造着怎样的价值？在FreeBuf与TK的对话中，教主又透露了哪些讯息？"}
{"title": "N3XT芯片：秒杀传统硅芯片1000遍", "url": "https://www.freebuf.com/articles/database/89927.html", "time": "2015-12-17", "level": "", "num_look": 312186, "num_comment": 7, "author": "dawner", "tags": ["数据安全", "观点"], "text": "卡内基梅隆大学、斯坦福大学以及加州大学伯克利分校的研究人员，他们发现了一种新的材料，可以用来替代电子设备里的传统硅芯片，让传统的设备处理速度快上1000倍。"}
{"title": "网络小黑揭秘系列之黑色SEO初探", "url": "https://www.freebuf.com/articles/terminal/89961.html", "time": "2015-12-17", "level": "红色标题", "num_look": 720578, "num_comment": 29, "author": "奇安信威胁情报中心", "tags": ["终端安全"], "text": "360天眼实验室在日常的恶意代码处理时注意到了一个文件名为“YY某主播视频.exe”的远控木马。"}
{"title": "“饿狼”背后的秘密：一个恶意木马的深度剖析", "url": "https://www.freebuf.com/articles/network/89890.html", "time": "2015-12-17", "level": "", "num_look": 390759, "num_comment": 6, "author": "腾讯电脑管家", "tags": ["网络安全", "观点"], "text": "由于该病毒安装大量恶意应用到系统目录，我们形象的把它比作“饿狼”。"}
{"title": "编号666：谷歌发现FireEye设备高危漏洞", "url": "https://www.freebuf.com/vuls/89828.html", "time": "2015-12-17", "level": "金币+10", "num_look": 321838, "num_comment": 7, "author": "鸢尾", "tags": ["漏洞", "终端安全"], "text": "对于部署了FireEye设备的网络，一个被动监控接口存在的漏洞利用绝对是恶梦：攻击者仅仅只需发送一封电子邮件便可以获得网路分流器访问权限，甚至都不需要接收者打开这封恶意电子邮件，只是接收便行了！"}
{"title": "一款使用RTF文件作为传输向量的恶意软件分析", "url": "https://www.freebuf.com/articles/system/89912.html", "time": "2015-12-17", "level": "金币+10", "num_look": 212954, "num_comment": 3, "author": "JackFree", "tags": ["系统安全"], "text": "在分析恶意软件过程中，我们经常看到，攻击者以创新的方式使用特性传输和混淆恶意软件。"}
{"title": "阿里巴巴安全部招聘实战渗透手", "url": "https://www.freebuf.com/jobs/89800.html", "time": "2015-12-17", "level": "", "num_look": 399183, "num_comment": 51, "author": "阿里巴巴安全", "tags": ["安全招聘"], "text": "阿里巴巴招聘资深安全工程师、安全专家或高级安全专家，提供极具行业竞争力的待遇。"}
{"title": "“极具破坏性”的Kerberos协议漏洞，可导致系统完全被控制", "url": "https://www.freebuf.com/articles/system/89652.html", "time": "2015-12-17", "level": "", "num_look": 290113, "num_comment": 3, "author": "vul_wish", "tags": ["系统安全"], "text": "近日，安全专家在Windows的Kerberos身份验证系统中发现了一个“极具破坏性”的漏洞。去年就曾曝出该系统中的一个相似漏洞，导致攻击者控制整个网络，包括安装程序和删除数据。"}
{"title": "动手打造一个内网“间谍”设备（F-BOMB）", "url": "https://www.freebuf.com/articles/89762.html", "time": "2015-12-17", "level": "金币+10", "num_look": 283765, "num_comment": 16, "author": "kn1f4", "tags": ["工具", "文章"], "text": "由于Pwnie Express/Wifi Pineapple 商业气息过于浓厚，Pwn Pi 造价高，架构差等原因，所以选择Mini Pwner做详细教程"}
{"title": "黑客组织VandaSec：英政府出售的IP地址关联ISIS的Twitter账号", "url": "https://www.freebuf.com/news/89841.html", "time": "2015-12-17", "level": "", "num_look": 170347, "num_comment": 1, "author": "亲爱的兔子", "tags": ["文章", "资讯"], "text": "近日黑客组织VandaSec曝光了一些关于英国政府出售的IP地址跟ISIS用于网络宣传的Twitter账号存有联系的信息。"}
{"title": "安全圈都有哪些又酷又萌的妹子？（下篇）", "url": "https://www.freebuf.com/news/topnews/89699.html", "time": "2015-12-16", "level": "红色标题", "num_look": 753298, "num_comment": 58, "author": "FB独家", "tags": ["其他", "头条"], "text": "她们来自天南海北，她们的经历各不相同，她们或学霸、或汉子、或逗比、或女神，性格迥异的她们同在网络安全这一领域积极耕耘。"}
{"title": "趋势科技：德国是欧盟地下网络犯罪市场中的领头羊", "url": "https://www.freebuf.com/news/89675.html", "time": "2015-12-16", "level": "", "num_look": 155860, "num_comment": 5, "author": "简单", "tags": ["资讯"], "text": "趋势科技调查德国网络犯罪论坛，总结出德国是欧盟国家中最高级的网络犯罪生态系统，完胜法国和西班牙的地下市场。"}
{"title": "汽车黑客揭秘：我是如何通过逆向API接口黑掉宝马i3的", "url": "https://www.freebuf.com/articles/terminal/89568.html", "time": "2015-12-16", "level": "", "num_look": 295858, "num_comment": 10, "author": "空白", "tags": ["终端安全"], "text": "我们的终极目标是获取通过API暴露出的所有汽车功能。"}
{"title": "Xcode 7 Bitcode的工作流程及安全性评估", "url": "https://www.freebuf.com/articles/others-articles/89806.html", "time": "2015-12-16", "level": "", "num_look": 218183, "num_comment": 4, "author": "360NirvanTeam", "tags": ["其他"], "text": "本文首先介绍 Bitcode 相关的工作流程，评估了Bitcode 相关的攻击面，并介绍针对各个攻击面的测试方法及目前的测试结果。"}
{"title": "英国警方开始着手处理脚本小子和少年黑客", "url": "https://www.freebuf.com/news/89774.html", "time": "2015-12-16", "level": "金币+4", "num_look": 190889, "num_comment": 9, "author": "dawner", "tags": ["资讯"], "text": "近日，英国执法机构正在整顿青少年涉及黑客行业，防止他们参加网络犯罪。"}
{"title": "锐捷网络招聘高级安全专家", "url": "https://www.freebuf.com/jobs/89807.html", "time": "2015-12-16", "level": "", "num_look": 195258, "num_comment": 13, "author": "路由器", "tags": ["安全招聘"], "text": "锐捷网络，中国数据通信解决方案领导品牌。"}
{"title": "【FireEye报告】LATENTBOT：有本事你就来抓我啊", "url": "https://www.freebuf.com/articles/terminal/89662.html", "time": "2015-12-16", "level": "金币+4", "num_look": 318937, "num_comment": 2, "author": "鸢尾", "tags": ["系统安全", "终端安全"], "text": "FireEye最近捕获了一个代码高度混淆的Bot，命名为LatentBot。"}
{"title": "Braviax与Fakerean的家族木马编年史", "url": "https://www.freebuf.com/articles/others-articles/89392.html", "time": "2015-12-16", "level": "", "num_look": 298084, "num_comment": 2, "author": "xiaix", "tags": ["其他", "网络安全"], "text": "在这篇文章中作者会对FakeAV家族的木马按时间线从2009年开始至今进行一个分析。"}
{"title": "“土人”不土，“救火”生猛，谭校长的方法论", "url": "https://www.freebuf.com/articles/89602.html", "time": "2015-12-16", "level": "", "num_look": 267311, "num_comment": 2, "author": "安在信息安全新媒体", "tags": ["人物志", "文章"], "text": "谭校长，360公司的VP、CPO（首席隐私官）谭晓生。"}
{"title": "婚外恋网站Ashley Madison新进展：会员遭信件勒索", "url": "https://www.freebuf.com/news/89676.html", "time": "2015-12-16", "level": "", "num_look": 212370, "num_comment": 1, "author": "亲爱的兔子", "tags": ["资讯"], "text": "有爆料称有人使用美国邮政局向Ashley Madison用户投递了敲诈勒索信件。"}
{"title": "Joomla对象注入漏洞分析（含漏洞利用方式）", "url": "https://www.freebuf.com/vuls/89754.html", "time": "2015-12-15", "level": "红色标题", "num_look": 1802506, "num_comment": 33, "author": "百度安全", "tags": ["漏洞"], "text": "joomla对象注入漏洞，无需登录，前台即可执行代码。"}
{"title": "专访Palo Alto大中华区技术总监耿强：解析下一代防火墙Wild Fire", "url": "https://www.freebuf.com/video/87419.html", "time": "2015-12-15", "level": "", "num_look": 353248, "num_comment": 6, "author": "FB视频", "tags": ["人物志", "视频"], "text": "耿强（KK），Palo Alto Networks大中华区技术总监，拥有超过20年的网络安全工作经验。"}
{"title": "Spy Banker木马新变种Telax利用谷歌云服务器进行传播", "url": "https://www.freebuf.com/news/89354.html", "time": "2015-12-15", "level": "", "num_look": 164617, "num_comment": 2, "author": "JackFree", "tags": ["资讯"], "text": "安全公司Zscaler发现一种新型恶意活动，它基于一种新型的Spy Banker网银恶意软件Telax，利用谷歌云服务器来驻留木马下载器。"}
{"title": "Windows恶意代码分析学习笔记", "url": "https://www.freebuf.com/sectool/89230.html", "time": "2015-12-15", "level": "现金奖励", "num_look": 584871, "num_comment": 21, "author": "SecDarker", "tags": ["工具"], "text": "在没有恶意代码分析所需要的一些知识和技能的情况下，使用现成的杀毒工具无疑是最好的方法。"}
{"title": "Twitter向用户发出警告：你们被国家黑客盯上了", "url": "https://www.freebuf.com/news/89601.html", "time": "2015-12-15", "level": "金币+4", "num_look": 184126, "num_comment": 4, "author": "dawner", "tags": ["资讯"], "text": "​一些致力于安全和隐私保护工作者的Twitter用户被官方告知，他们的账户已经被某些国家黑客盯上了。"}
{"title": "利用Chakra JIT绕过DEP和CFG", "url": "https://www.freebuf.com/articles/system/89616.html", "time": "2015-12-15", "level": "红色标题", "num_look": 390206, "num_comment": 3, "author": "腾讯玄武实验室", "tags": ["系统安全"], "text": "JIT Spray是一种诞生于2010年的漏洞利用技术，可将Shellcode嵌入到JIT引擎生成的可执行代码中。"}
{"title": "Joomla再曝高危0day漏洞，可进行远程命令执行", "url": "https://www.freebuf.com/vuls/89599.html", "time": "2015-12-15", "level": "金币+4", "num_look": 498969, "num_comment": 8, "author": "寰者", "tags": ["漏洞"], "text": "Joomla安全团队紧急发布了3.4.6版本，修复了一个高危0day漏洞。据悉，该漏洞从被发现到安全补丁的发布，已经超过两天，目前也已经通过其他渠道在流传。可以想象，将会有多少Joomla站点遭受入侵。"}
{"title": "聊聊鲜为人知的美军内部异常监测系统（ADAMS）", "url": "https://www.freebuf.com/articles/terminal/89399.html", "time": "2015-12-15", "level": "金币+4", "num_look": 289307, "num_comment": 9, "author": "windhawk", "tags": ["数据安全", "终端安全"], "text": "由于ADAMS涉及军方，因此所传资料甚少。自己在网上淘了许久，将现有的信息稍作整理，供感兴趣的朋友一览。"}
{"title": "CI工具一周课程Day 5：防御措施和其他", "url": "https://www.freebuf.com/sectool/89270.html", "time": "2015-12-15", "level": "金币+5", "num_look": 175263, "num_comment": 1, "author": "xiaix", "tags": ["工具"], "text": "欢迎来到CI工具一周教程的第五天。我们将在这一个系列教程中讨论CI工具的安全问题。"}
{"title": "5毛钱打造自己的Throwing Star LAN Tap", "url": "https://www.freebuf.com/articles/89552.html", "time": "2015-12-15", "level": "金币+5", "num_look": 810799, "num_comment": 29, "author": "creturn", "tags": ["文章", "极客"], "text": "网路分流器(Network Tap)可以透明串联在网络中实现网络流量的监控,在这篇文章里我们来学习如何低成本自己DIY一个分流器。"}
{"title": "发动机防盗控制系统被曝可被远程攻击", "url": "https://www.freebuf.com/news/89308.html", "time": "2015-12-15", "level": "", "num_look": 190097, "num_comment": 2, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "一位新西兰专家发现，因为一个漏洞的存在，数以万计的发动机防盗控制系统可被远程攻击。"}
{"title": "欧洲航天局遭匿名者（Anonymous）攻击泄露大量数据", "url": "https://www.freebuf.com/news/89533.html", "time": "2015-12-14", "level": "", "num_look": 267630, "num_comment": 7, "author": "亲爱的兔子", "tags": ["数据安全", "资讯"], "text": "近日黑客组织匿名者在网上发布消息称拿下了欧洲航天局（ESA）的一些数据，并称此举为“for the LulZ”。"}
{"title": "【12月15日更新赛门铁克官方回应​】Google宣布全系列产品不再信任赛门铁克某款根证书", "url": "https://www.freebuf.com/news/89530.html", "time": "2015-12-14", "level": "金币+5", "num_look": 428954, "num_comment": 10, "author": "Sphinx", "tags": ["终端安全", "资讯"], "text": "Google宣布在接下来的几周，Google会在Chrome、Android和其他Google产品中将把赛门铁克颁发的“Class 3 Public Primary CA”根证书设为不可信。"}
{"title": "从e租宝被查看P2P网站应用安全", "url": "https://www.freebuf.com/articles/others-articles/89473.html", "time": "2015-12-14", "level": "红色标题", "num_look": 746416, "num_comment": 39, "author": "安全豹", "tags": ["其他", "网络安全"], "text": "有关e租宝公司被调查的新闻在微博、朋友圈被引爆刷屏。许多人看中P2P理财的高收益，却忽视其中的风险。"}
{"title": "专访腾讯应急响应中心TSRC：“国内最早SRC” 的前世今生", "url": "https://www.freebuf.com/articles/others-articles/89450.html", "time": "2015-12-14", "level": "", "num_look": 363053, "num_comment": 5, "author": "FB独家", "tags": ["人物志", "其他"], "text": "“国内最早SRC”的秘密武器究竟是什么？"}
{"title": "FLARE IDA Pro的脚本系列：自动化提取函数参数", "url": "https://www.freebuf.com/sectool/89273.html", "time": "2015-12-14", "level": "金币+5", "num_look": 492600, "num_comment": 5, "author": "江湖小吓", "tags": ["工具"], "text": "很久以前FB发过一篇FLARE高级逆向工程团队的IDA Pro脚本系列上集，这次下集来了。所有的脚本和插件依然都可以从GitHub中下载。"}
{"title": "中国研究出世界上第一辆意念控制的汽车", "url": "https://www.freebuf.com/news/89338.html", "time": "2015-12-14", "level": "金币+5", "num_look": 400778, "num_comment": 31, "author": "JackFree", "tags": ["资讯"], "text": "根据中国研究人员声称，他们已经研制出世界上第一辆意念控制的汽车，即使用人类的脑电波来驾驶汽车。"}
{"title": "Windows媒体中心的漏洞分析与利用", "url": "https://www.freebuf.com/vuls/89301.html", "time": "2015-12-14", "level": "金币+5", "num_look": 219919, "num_comment": 2, "author": "鸢尾", "tags": ["漏洞", "系统安全"], "text": "微软在今年9月8日报告中提到修复了一个Windows媒体中心存在的远程代码执行漏洞。"}
{"title": "英国科研学术网络Janet遭遇DDoS攻击", "url": "https://www.freebuf.com/news/89268.html", "time": "2015-12-14", "level": "", "num_look": 124862, "num_comment": 2, "author": "亲爱的兔子", "tags": ["资讯"], "text": "Janet是一个面向英国科学研究和教育机构设立的专用网络，但是在12月4号到8号期间，该网络遭到了大规模的分布式拒绝服务（DDoS）攻击。"}
{"title": "VVV病毒真相：日本闹翻天中国也躺枪", "url": "https://www.freebuf.com/articles/89264.html", "time": "2015-12-14", "level": "", "num_look": 476865, "num_comment": 11, "author": "360安全", "tags": ["文章", "漏洞"], "text": "已经沉寂一段时间的CryptoLocker（文档加密敲诈者）类木马，本月初在国内又开始传播感染。"}
{"title": "乱弹Flask注入", "url": "https://www.freebuf.com/articles/web/88768.html", "time": "2015-12-14", "level": "金币+5", "num_look": 722532, "num_comment": 8, "author": "鸢尾", "tags": ["WEB安全"], "text": "在本文中我们会乱弹Flask框架中的安全特性以及一些潜在的问题，例如服务端模版注入，跨站脚本，HTML属性注入inject。"}
{"title": "Censys：一款洞察互联网秘密的新型搜索引擎", "url": "https://www.freebuf.com/news/89285.html", "time": "2015-12-14", "level": "金币+5", "num_look": 860694, "num_comment": 4, "author": "JackFree", "tags": ["资讯"], "text": "Censys是一款用以搜索联网设备信息的新型搜索引擎，安全专家可以使用它来评估他们实现方案的安全性"}
{"title": "Modbus TCP流量分析", "url": "https://www.freebuf.com/articles/web/88944.html", "time": "2015-12-13", "level": "金币+5", "num_look": 428179, "num_comment": 5, "author": "鸢尾", "tags": ["WEB安全"], "text": ""}
{"title": "加密困局：FBI要求科技公司停止提供通信加密服务", "url": "https://www.freebuf.com/news/89177.html", "time": "2015-12-13", "level": "金币+5", "num_look": 278307, "num_comment": 4, "author": "寰者", "tags": ["数据安全", "资讯"], "text": "通信加密技术一直以来对于美国政府监控恐怖活动来说，无疑是一道巨大的阻碍。"}
{"title": "揭秘：安卓木马是如何盗取用户手机银行的", "url": "https://www.freebuf.com/news/topnews/89176.html", "time": "2015-12-13", "level": "金币+7", "num_look": 743866, "num_comment": 8, "author": "FireFrank", "tags": ["头条", "安全报告"], "text": "随着手机银行涉及的金钱数额越来越大，攻击者要找到更多创造性的方式来窃取金钱。"}
{"title": "专访知名民间黑客“核攻击”：在自己的道路上，谱写自己的传奇", "url": "https://www.freebuf.com/news/89379.html", "time": "2015-12-13", "level": "红色标题", "num_look": 692887, "num_comment": 28, "author": "T00ls安全", "tags": ["人物志", "资讯"], "text": "本期我们采访了“核攻击”。核攻击，一个再熟悉不过的ID，混迹于各大组织论坛。名声在外，兴趣广泛，涉猎奇多。"}
{"title": "三大杀毒软件存严重漏洞，杀软可变黑客工具", "url": "https://www.freebuf.com/news/89157.html", "time": "2015-12-13", "level": "金币+7", "num_look": 280588, "num_comment": 1, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "enSilo的安全专家们在众多杀毒软件中发现了一个严重的安全漏洞，黑客利用该漏洞能把杀毒软件变成黑客的攻击工具，受影响的杀毒软件包括AVG、McAfee、卡巴斯基。"}
{"title": "利用Python pickle实现任意代码执行", "url": "https://www.freebuf.com/articles/system/89165.html", "time": "2015-12-12", "level": "金币+7", "num_look": 460336, "num_comment": 8, "author": "JackFree", "tags": ["系统安全"], "text": "本文中将向大家介绍如何利用Python pickle进行任意代码执行操作。"}
{"title": "注意！Win10的11月更新重启数据收集功能", "url": "https://www.freebuf.com/news/89138.html", "time": "2015-12-12", "level": "", "num_look": 241149, "num_comment": 9, "author": "江湖小吓", "tags": ["终端安全", "资讯"], "text": "Windows 10偷窥用户已经不是一个新鲜事了，虽然之前强制升级系统还是 Windows 10的11月更新都可以看到电脑和平板电脑的性能明显改善了，但更新后，用户还是发现了一些之前没有注意到的问题。"}
{"title": "美国一名少年极客打造会飞的“烤肉机”", "url": "https://www.freebuf.com/news/88979.html", "time": "2015-12-12", "level": "", "num_look": 178143, "num_comment": 7, "author": "亲爱的兔子", "tags": ["极客", "资讯"], "text": "一名来自康涅狄格州的青年人Austin Haughwout在视频网站YouTube上传了一段关于家庭自制武装无人机“飞行手枪”引发热议。"}
{"title": "Google出台新的安全机制保证安卓用户安全上网", "url": "https://www.freebuf.com/articles/system/89013.html", "time": "2015-12-11", "level": "", "num_look": 208683, "num_comment": 4, "author": "FireFrank", "tags": ["系统安全"], "text": "Google安全上网一直在保护数十亿用户的互联网免受恶意软件、流氓软件和社工网站的侵害。"}
{"title": "007黑客组织及其地下黑产活动分析报告", "url": "https://www.freebuf.com/articles/others-articles/89229.html", "time": "2015-12-11", "level": "红色标题", "num_look": 469415, "num_comment": 13, "author": "360安全", "tags": ["其他", "安全报告"], "text": "这是我们目前捕获到的影响范围最大，持续时间最长的地下产业链活动。"}
{"title": "生物黑客打造新产品：电子纹身", "url": "https://www.freebuf.com/news/89117.html", "time": "2015-12-11", "level": "金币+7", "num_look": 280310, "num_comment": 5, "author": "亲爱的兔子", "tags": ["极客", "资讯"], "text": "纹身通常是被认为是表达个性或者向被追求者示爱的一种方式。但是，国外一个名为Chaotic Moon Studios的工作室制作的电子纹身居然被用于医疗行业。"}
{"title": "海事安全篇：船舶黑匣子VDR是如何被黑掉的？", "url": "https://www.freebuf.com/vuls/89181.html", "time": "2015-12-11", "level": "", "num_look": 249917, "num_comment": 2, "author": "dawner", "tags": ["漏洞", "系统安全"], "text": "在港口、船舶和海事范围，有着各种设施和多种设备系统，它们对于各国各部门有着重要意义，我们需要花精力去保障它们的安全。"}
{"title": "Xboxlive数字证书私钥泄露，用户或被中间人攻击", "url": "https://www.freebuf.com/news/89125.html", "time": "2015-12-11", "level": "", "num_look": 161418, "num_comment": 5, "author": "简单", "tags": ["资讯"], "text": "微软确认*Xboxlive.com域名的SSL/TLS数字证书私人密钥遭到泄露，可被攻击者用于尝试发动中间人攻击。"}
{"title": "从一条微博揭秘“专黑大V名人”的定向攻击", "url": "https://www.freebuf.com/articles/network/89197.html", "time": "2015-12-11", "level": "", "num_look": 450290, "num_comment": 22, "author": "360安全", "tags": ["网络安全"], "text": "本月初微博上有知名大V晒出一封私信截图，私信是以某记者名义发出，要求采访该大V博主，并提供了一个网盘链接作为“采访提纲”。"}
{"title": "工控网络协议模糊测试：用peach对modbus协议进行模糊测试", "url": "https://www.freebuf.com/articles/security-management/88249.html", "time": "2015-12-11", "level": "现金奖励", "num_look": 706743, "num_comment": 26, "author": "blacksunny", "tags": ["安全管理", "工控安全"], "text": "工业控制网络协议模糊测试的目的是测试工业控制网络协议的实现的健壮性，它是采用构造畸形数据包，将畸形数据包发送给被测工控目标，从而测试被测工业控制网络协议的安全性。"}
{"title": "QQ盗号木马黑色产业链追踪", "url": "https://www.freebuf.com/articles/network/88708.html", "time": "2015-12-11", "level": "", "num_look": 589087, "num_comment": 16, "author": "安天追影", "tags": ["安全报告", "网络安全"], "text": "近期安天追影小组利用威胁感知系统捕获到一起木马传输事件，黑客组织通过 QQ 盗号木马，盗取受害者账号及密码。"}
{"title": "雅虎邮箱公布修复XSS攻击漏洞（含XSS漏洞测试视频）", "url": "https://www.freebuf.com/vuls/89008.html", "time": "2015-12-11", "level": "", "num_look": 261504, "num_comment": 3, "author": "寰者", "tags": ["漏洞", "视频"], "text": "雅虎邮箱宣布目前已经修复此前被发现但未公布的一个高危漏洞，该漏洞可导致数亿雅虎邮箱用户遭受恶意邮件的攻击。"}
{"title": "华盛顿邮报曝光FBI：执法过程中使用零日（0day）漏洞", "url": "https://www.freebuf.com/news/89026.html", "time": "2015-12-11", "level": "", "num_look": 192918, "num_comment": 2, "author": "亲爱的兔子", "tags": ["漏洞", "资讯"], "text": "近日，美国联邦调查局FBI被曝光针对社会存有威胁性的嫌疑人追踪中使用“零日漏洞”。"}
{"title": "Zbot木马型间谍软件新变种", "url": "https://www.freebuf.com/news/89060.html", "time": "2015-12-10", "level": "", "num_look": 366906, "num_comment": 3, "author": "金山毒霸", "tags": ["网络安全", "资讯"], "text": "多个用户部署的一体化平台上发现了几起相似恶意样本案例，经鉴定确认为Zbot家族新型变种，代号TrojanSpy:Zbot.HID。"}
{"title": "【回播已更新】FreeBuf公开课：动态调试APP与静态调试APP", "url": "https://www.freebuf.com/news/88358.html", "time": "2015-12-10", "level": "", "num_look": 366376, "num_comment": 17, "author": "banish", "tags": ["视频", "资讯"], "text": "由熟悉的白细胞团队的北斗妹子给大家带来直播课程，她将给大家动态分析调试安卓程序，使用另类smali代码注入法让你眼前一亮。"}
{"title": "实例讲解如何利用Python编写Exploit", "url": "https://www.freebuf.com/articles/system/88994.html", "time": "2015-12-10", "level": "红色标题", "num_look": 666764, "num_comment": 17, "author": "JackFree", "tags": ["系统安全"], "text": "本项目的主要目的是学习编写一个Exploit的基本知识。"}
{"title": "木马通过修改手机ROOT工具攻击安卓设备", "url": "https://www.freebuf.com/articles/terminal/88915.html", "time": "2015-12-10", "level": "", "num_look": 237060, "num_comment": 3, "author": "vul_wish", "tags": ["终端安全"], "text": "该木马通过使用商业root工具获取手机root访问权限，进而获取安卓设备的敏感信息，并影响范围甚广。"}
{"title": "美国前官员被曝光：利用黑客技术从事“性勒索”", "url": "https://www.freebuf.com/news/89030.html", "time": "2015-12-10", "level": "", "num_look": 220720, "num_comment": 9, "author": "亲爱的兔子", "tags": ["资讯"], "text": "据美国司法部证实，一名36岁男子被指控发动一项国际黑客活动，并威胁数百名女性提供自己的性暴露内容。"}
{"title": "Kali 2.0教程：如何安装Veil-Evasion", "url": "https://www.freebuf.com/sectool/89024.html", "time": "2015-12-10", "level": "金币+8", "num_look": 845149, "num_comment": 21, "author": "dawner", "tags": ["工具", "系统安全"], "text": "Veil Evasion是一个可执行文件，它被用来生成Metasploit的payload，能绕过常见杀软。"}
{"title": "从零开始学Fuzzing系列：浏览器挖掘框架Morph诞生记", "url": "https://www.freebuf.com/sectool/89001.html", "time": "2015-12-10", "level": "现金奖励", "num_look": 738294, "num_comment": 12, "author": "walkerfuz", "tags": ["工具", "漏洞"], "text": "即将讲述的Morph框架是本文作者基于Puzzor大神《如何进行浏览器Fuzz》思路编写的一款轻量级浏览器Fuzz框架。"}
{"title": "解密：“比特币之父”中本聪可能是澳大利亚学者", "url": "https://www.freebuf.com/news/88958.html", "time": "2015-12-10", "level": "", "num_look": 161474, "num_comment": 9, "author": "Sphinx", "tags": ["资讯"], "text": "由《连线》杂志和Gizmodo进行的独立调查显示，“比特币之父”中本聪可能是一个澳大利亚企业家，名字叫做Craig Steven Wright。"}
{"title": "CI工具一周课程Day 4：常见问题集合及利用", "url": "https://www.freebuf.com/sectool/88808.html", "time": "2015-12-10", "level": "金币+8", "num_look": 174460, "num_comment": 2, "author": "xiaix", "tags": ["工具"], "text": "欢迎来到CI工具一周教程的第四天。我们将在这一个系列教程中讨论CI工具的安全问题。"}
{"title": "如何利用Capstone引擎写一个Android反汇编工具", "url": "https://www.freebuf.com/sectool/88799.html", "time": "2015-12-10", "level": "金币+8", "num_look": 347454, "num_comment": 5, "author": "鸢尾", "tags": ["工具"], "text": "在进行一些逆向工程时，偶然想到我还没有一款用于安卓反汇编二进制文件的工具。"}
{"title": "工具科普：如何使用WPScan辅助渗透WordPress网站", "url": "https://www.freebuf.com/sectool/88653.html", "time": "2015-12-10", "level": "金币+8", "num_look": 610811, "num_comment": 11, "author": "FireFrank", "tags": ["工具"], "text": "WPScan是一个扫描WordPress漏洞的黑盒子扫描器，它可以为所有Web开发人员扫描WordPress漏洞并在他们开发前找到并解决问题。"}
{"title": "今年“白帽”都挖到了什么？细数2015年那些影响到了世界的漏洞", "url": "https://www.freebuf.com/vuls/88939.html", "time": "2015-12-10", "level": "", "num_look": 223116, "num_comment": 4, "author": "不是养蚕人", "tags": ["其他", "漏洞"], "text": "即将过去的2015年是网络安全如履薄冰的一年，.所幸在全球白帽黑客的努力下，很多致命漏洞都赶在坏人发现之前就已经被厂商修补。"}
{"title": "趋势科技：北美地下市场对公众开放", "url": "https://www.freebuf.com/news/88963.html", "time": "2015-12-09", "level": "", "num_look": 152832, "num_comment": 4, "author": "简单", "tags": ["资讯"], "text": "一般来说网络犯罪地下市场都很隐蔽，一般不会被发现，更不用说渗透进入了。但北美地下市场很开放，人人都可以进入。"}
{"title": "美国特勤局特工调查“暗网”监守自盗获刑", "url": "https://www.freebuf.com/news/88871.html", "time": "2015-12-09", "level": "", "num_look": 166675, "num_comment": 3, "author": "亲爱的兔子", "tags": ["资讯"], "text": "近日，一名前美国特勤局特工Shaun Bridges，被法庭判决将要接受78个月的牢狱处罚和50万美元的赔偿。"}
{"title": "2015年末最流行手机木马趋势分析报告", "url": "https://www.freebuf.com/articles/terminal/88929.html", "time": "2015-12-09", "level": "", "num_look": 219125, "num_comment": 3, "author": "360手机卫士", "tags": ["安全报告", "终端安全"], "text": "在2015年第三季度，平均每天安卓平台截获新增恶意手机程序样本将近6.07万个，平均每天恶意程序感染量达到83.9万人次。"}
{"title": "Facebook赞助Let's Encrypt项目：让HTTPS能够更简单", "url": "https://www.freebuf.com/news/88870.html", "time": "2015-12-09", "level": "金币+8", "num_look": 221458, "num_comment": 3, "author": "dawner", "tags": ["资讯"], "text": "Let’s Encrypt（一起来加密）宣布，他们已经发布了最新的公测版本，而Facebook成为了其最新的金牌赞助商。"}
{"title": "Java反序列化漏洞执行命令回显实现及Exploit下载", "url": "https://www.freebuf.com/sectool/88908.html", "time": "2015-12-09", "level": "现金奖励", "num_look": 1208577, "num_comment": 43, "author": "rebeyond", "tags": ["工具", "漏洞"], "text": "公司漏扫需要加规则来识别这种漏洞，而客户的漏扫又时常会工作在纯内网的环境下，因此远程加载类的方法行不通。想到自己写一个利用工具。"}
{"title": "滥用Android ClipData会有什么后果？", "url": "https://www.freebuf.com/news/88835.html", "time": "2015-12-09", "level": "金币+6", "num_look": 442705, "num_comment": 3, "author": "鸢尾", "tags": ["资讯"], "text": "ClipData.Item是ClipData中的一个item，在ClipData.Item中有一个名为coerceToText()的十分有趣的公共操作方法。"}
{"title": "反恐黑客组织：ISIS为通信安全开发手机APP", "url": "https://www.freebuf.com/news/88867.html", "time": "2015-12-09", "level": "", "num_look": 209582, "num_comment": 11, "author": "vulture", "tags": ["资讯"], "text": "Ghost Security Group称，他们发现了一款ISIS开发的Android手机app，这款app是ISIS成员们为了安全通信而使用的。"}
{"title": "Uproot：使用powershell编写基于主机的IDS", "url": "https://www.freebuf.com/sectool/88609.html", "time": "2015-12-09", "level": "金币+6", "num_look": 222301, "num_comment": 4, "author": "鸢尾", "tags": ["工具", "系统安全"], "text": "Uproot是一款基于主机的入侵检测系统(HIDS)，其利用持续运行的Windows管理规范服务(WMI)事件订阅，在一个网络中检测恶意行为。"}
{"title": "漏洞盒子11月“互联网漏洞之星”", "url": "https://www.freebuf.com/fevents/88770.html", "time": "2015-12-09", "level": "", "num_look": 167243, "num_comment": 3, "author": "漏洞盒子", "tags": ["活动"], "text": "哪怕寒冬腊月，漏洞盒子白帽子们还是一如既往的专注于帮助企业找出安全漏洞。"}
{"title": "CI工具一周课程Day 3：Go和CruiseControl", "url": "https://www.freebuf.com/sectool/88482.html", "time": "2015-12-09", "level": "金币+6", "num_look": 235228, "num_comment": 1, "author": "xiaix", "tags": ["工具"], "text": "Go是一个开源的CI工具，可以在这里找到。跟之前讨论的CI工具一样，Go也支持分布式构建。"}
{"title": "永不消逝的电波（三）：低功耗蓝牙（BLE）入门之如何调戏别人的小米手环", "url": "https://www.freebuf.com/news/88281.html", "time": "2015-12-09", "level": "红色标题", "num_look": 1559390, "num_comment": 17, "author": "吃葡萄不吐葡萄皮的雪碧", "tags": ["头条", "无线安全"], "text": "BLE低功耗蓝牙即：蓝牙4.0，是专门面向对成本和功耗都有较高要求的无线方案，可广泛用于卫生保健、体育健身、家庭娱乐、安全保障等诸多领域。"}
{"title": "社交媒体和骗局：赛门铁克发布2015网站安全威胁报告", "url": "https://www.freebuf.com/news/88719.html", "time": "2015-12-09", "level": "", "num_look": 254966, "num_comment": 3, "author": "路由器", "tags": ["安全报告", "资讯"], "text": "2014 年，一些罪犯卑鄙地利用了“社会认同”效应的威力——这个概念是指人们认为那些被其他人分享或认可的事物更有价值。"}
{"title": "联想、戴尔和东芝电脑曝严重OEM漏洞", "url": "https://www.freebuf.com/news/88650.html", "time": "2015-12-09", "level": "金币+6", "num_look": 191784, "num_comment": 2, "author": "江湖小吓", "tags": ["漏洞", "资讯"], "text": "最近，联想的设备又可以被很容易地劫持，同时戴尔和东芝的个人电脑也因为严重漏洞而受到影响。"}
{"title": "三年前的libupnp库漏洞，腾讯QQ音乐终于修复了", "url": "https://www.freebuf.com/news/88266.html", "time": "2015-12-08", "level": "", "num_look": 352385, "num_comment": 6, "author": "简单", "tags": ["漏洞", "资讯"], "text": "由于3年前的一个漏洞，今天仍然有610万台设备可被远程代码执行，包括智能手机、路由器、智能电视等，而且这个漏洞早在3年前就已经修复。"}
{"title": "浅析Linux堆溢出之fastbin", "url": "https://www.freebuf.com/news/88660.html", "time": "2015-12-08", "level": "", "num_look": 856096, "num_comment": 13, "author": "银河实验室", "tags": ["资讯"], "text": "前端时间参加RCTF比赛，遇到了一道堆溢出的题目shaxian。漏洞本身是比较明显的，但由于对堆溢出并不熟悉，没有能够找到利用方法。"}
{"title": "针对路由器的MIPS架构Linux木马详解", "url": "https://www.freebuf.com/articles/network/88798.html", "time": "2015-12-08", "level": "", "num_look": 416774, "num_comment": 6, "author": "腾讯电脑管家", "tags": ["网络安全"], "text": "Linux系统上的木马相对Windows系统较少。又因MIPS架构的应用局限性，所以MIPS架构上的Linux木马更是少之又少。"}
{"title": "FBI、警察和白帽子联手摧毁Dorkbot僵尸网络", "url": "https://www.freebuf.com/news/88655.html", "time": "2015-12-08", "level": "金币+6", "num_look": 202577, "num_comment": 4, "author": "dawner", "tags": ["资讯"], "text": "近日，FBI、国际刑警组织、欧洲刑警组织以及各大安全公司的白帽子们，联手摧毁了僵尸网络Dorkbot。"}
{"title": "北极熊扫描器3.5发布：增加超级搜索，云平台支持在线安装配置等功能", "url": "https://www.freebuf.com/sectool/88362.html", "time": "2015-12-08", "level": "", "num_look": 347776, "num_comment": 22, "author": "w85040", "tags": ["工具"], "text": "本软件是一款为白帽子提供网站安全检测的软件，软件完全免费,您可以使用本软件对站点进行分析，从侧面来帮助您获得更多信息。"}
{"title": "来自地狱犬的追踪：深度分析Labrador病毒", "url": "https://www.freebuf.com/articles/system/88570.html", "time": "2015-12-08", "level": "", "num_look": 242311, "num_comment": 11, "author": "安全狗攻防实验室", "tags": ["系统安全"], "text": "Labrade（Hellhound-20157516）病毒可通过感染大量的exe程序，使得运行中的进程所对应的PE文件被感染、注册表被修改等，对用户威胁巨大。"}
{"title": "【FreeBuf视频】《黑客人物志》专访知名白帽子、PKAV团队负责人张瑞冬（Only_guest）", "url": "https://www.freebuf.com/news/88157.html", "time": "2015-12-08", "level": "红色标题", "num_look": 970088, "num_comment": 30, "author": "FB视频", "tags": ["人物志", "头条"], "text": "张瑞冬，双螺旋攻防实验室负责人、PKAV团队负责人、四川大学特聘网络安全专家。而他在安全圈更为人所熟知的则是他的ID——Only_guest。"}
{"title": "霍尼韦尔Midas气体检测器被曝严重漏洞，再为工控安全敲响警钟", "url": "https://www.freebuf.com/vuls/88657.html", "time": "2015-12-08", "level": "", "num_look": 325566, "num_comment": 2, "author": "dawner", "tags": ["工控安全", "漏洞"], "text": "知名高新制造业公司Honeywell最近发布了固件更新包，以修复Midas气体探测器的两个高危漏洞。"}
{"title": "奥巴马呼吁社交媒体帮助打击ISIS，引来争议", "url": "https://www.freebuf.com/news/88665.html", "time": "2015-12-08", "level": "金币+5", "num_look": 123661, "num_comment": 1, "author": "亲爱的兔子", "tags": ["资讯"], "text": "目前美国总统奥巴马正在积极呼吁社交媒体巨头帮助打击ISIS。"}
{"title": "浅析基于用户文件对象的内部攻击检测方法", "url": "https://www.freebuf.com/articles/network/88324.html", "time": "2015-12-08", "level": "现金奖励", "num_look": 389288, "num_comment": 4, "author": "windhawk", "tags": ["网络安全"], "text": "机器学习在安全的诸多领域都有应用，比如恶意代码的识别检测、入侵检测系统中的主动防御等。今天我们先来介绍下机器学习技术在内部攻击检测（Insider Attack Detection）领域的一些应用。"}
{"title": "女性的力量：安全圈都有哪些又酷又萌的妹子？（中篇）", "url": "https://www.freebuf.com/news/topnews/88545.html", "time": "2015-12-08", "level": "红色标题", "num_look": 551011, "num_comment": 28, "author": "FB独家", "tags": ["其他", "头条"], "text": "这是一个女性和男性同台竞技的时代，性别差异从来都不是成功的条件或壁垒。"}
{"title": "开源网络取证工具Xplico", "url": "https://www.freebuf.com/sectool/88496.html", "time": "2015-12-08", "level": "金币+5", "num_look": 382590, "num_comment": 4, "author": "FireFrank", "tags": ["工具"], "text": "Xplico的目标是提取互联网流量并捕获应用数据中包含的信息。"}
{"title": "新加坡国立大学打造新加坡首个室内载人飞行器", "url": "https://www.freebuf.com/news/88288.html", "time": "2015-12-08", "level": "", "num_look": 176998, "num_comment": 1, "author": "亲爱的兔子", "tags": ["极客", "资讯"], "text": "新加坡国立大学（National University of Singapore)工程系的八位学生制作了一款新型的飞行器。"}
{"title": "技术分析：攻击者是如何利用系统命令盲注实现“拖库”的？", "url": "https://www.freebuf.com/articles/web/88354.html", "time": "2015-12-07", "level": "金币+5", "num_look": 647564, "num_comment": 9, "author": "寰者", "tags": ["WEB安全", "数据安全"], "text": "“拖库”是近年来我们常常耳闻的名词，那么攻击者在实施“拖库”时都有哪些特殊的姿势？我们又该如何防御？"}
{"title": "中美网络安全对话：中国承认黑客入侵OPM，但非官方行为", "url": "https://www.freebuf.com/news/88275.html", "time": "2015-12-07", "level": "金币+5", "num_look": 608679, "num_comment": 33, "author": "江湖小吓", "tags": ["数据安全", "资讯"], "text": "中国政府表示他们逮捕了今年早些时候针对美国办公室（OPM）大规模网络攻击背后的犯罪黑客。"}
{"title": "找钢网安全岗位招聘", "url": "https://www.freebuf.com/jobs/88040.html", "time": "2015-12-07", "level": "", "num_look": 254194, "num_comment": 6, "author": "juney", "tags": ["安全招聘"], "text": "找钢网成立于2012年初，是国内的钢铁全产业链电商平台。"}
{"title": "轻松的方式解读“臭名昭著”的DDoS工具LOIC（低轨道离子加农炮）源码", "url": "https://www.freebuf.com/sectool/88356.html", "time": "2015-12-07", "level": "现金奖励", "num_look": 715596, "num_comment": 9, "author": "VillanCh", "tags": ["工具", "系统安全"], "text": "Loic（低轨道离子加农炮）是一个叫4Chan-affiliated的团体开发的，这个工具被成千上万的匿名使用者使用，在网络环境中，造成了很多混乱。"}
{"title": "Rekoobe：一款针对Linux的恶意软件", "url": "https://www.freebuf.com/news/88396.html", "time": "2015-12-07", "level": "", "num_look": 171968, "num_comment": 3, "author": "Sphinx", "tags": ["资讯"], "text": "来自俄罗斯杀毒厂商Dr. Web的专家发现了Rekoobe，这是一款针对Linux系统的恶意软件。"}
{"title": "【全民投票开启】WitAwards 2015互联网安全年度评选", "url": "https://www.freebuf.com/news/88422.html", "time": "2015-12-07", "level": "红色标题", "num_look": 373463, "num_comment": 16, "author": "FB独家", "tags": ["头条", "活动"], "text": "WitAwards 2015互联网安全年度评选全民投票今日开启！投出宝贵一票，更可赢取FIT大会门票！"}
{"title": "LuManager 高危SQL注入0day分析", "url": "https://www.freebuf.com/vuls/88271.html", "time": "2015-12-07", "level": "红色标题", "num_look": 584442, "num_comment": 20, "author": "阿里安全", "tags": ["漏洞", "系统安全"], "text": "LuManager是一种基于FreeBSD、Zijidelu、Debian、Centos、Ubuntu等Linux/Unix系统的网站服务器管理软件，目前有大量国内用户使用。"}
{"title": "匿名者组织（Anonymous）将在12月11日举行隆重的“反ISIS”活动", "url": "https://www.freebuf.com/news/88402.html", "time": "2015-12-07", "level": "金币+5", "num_look": 165797, "num_comment": 9, "author": "亲爱的兔子", "tags": ["资讯"], "text": "近日，黑客组织匿名者(Anonymous)打算组织一场新的反ISIS运动。"}
{"title": "运维说：Nessus和Powershell更配哟", "url": "https://www.freebuf.com/articles/web/88327.html", "time": "2015-12-07", "level": "金币+5", "num_look": 320795, "num_comment": 5, "author": "鸢尾", "tags": ["WEB安全", "系统安全"], "text": "在日常的安全评估工作中，时常会对内部主机进行验证扫描，寻找那些因为错过打补丁时间或者是错误配置所导致漏洞。"}
{"title": "CI工具一周课程Day 2：TeamCity", "url": "https://www.freebuf.com/sectool/88370.html", "time": "2015-12-07", "level": "金币+5", "num_look": 213932, "num_comment": 2, "author": "xiaix", "tags": ["工具"], "text": "欢迎来到CI工具一周教程的第二天。我计划做一个关于CI工具的系列教程。"}
{"title": "libupnp漏洞归来影响大量智能系统设备", "url": "https://www.freebuf.com/news/88368.html", "time": "2015-12-07", "level": "金币+4", "num_look": 178590, "num_comment": 2, "author": "亲爱的兔子", "tags": ["漏洞", "资讯"], "text": "目前趋势科技发布了一份报告显示，便携式UPnP设备SDK当中存在一个被称为 libupnp的漏洞，出现在数以百万计的智能电视，智能手机和路由器当中。"}
{"title": "漏洞细节：VTech平板电脑：多个数据泄露的隐患暗藏", "url": "https://www.freebuf.com/vuls/88323.html", "time": "2015-12-06", "level": "金币+4", "num_look": 212992, "num_comment": 4, "author": "dawner", "tags": ["漏洞", "终端安全"], "text": "在最近的VTech数据泄露事件后，大家或许认为VTech的电子玩具安全性不会比现在更糟糕了。然而就在这种情况下，我们又发现了两个漏洞"}
{"title": "一波未平一波又起：VTech用户数据泄露后，又被爆出两个重大漏洞", "url": "https://www.freebuf.com/news/88197.html", "time": "2015-12-06", "level": "", "num_look": 163246, "num_comment": 3, "author": "0xroot", "tags": ["资讯"], "text": "近日，全球最大婴幼儿电子学习产品制造商Vtech（伟易达）被曝480万家长及640万儿童信息泄露。随后有安全研究人员在InnoTab Max产品中发现两个重大漏洞！"}
{"title": "谷歌收集学生信息新进展：反驳EFF投诉", "url": "https://www.freebuf.com/news/88139.html", "time": "2015-12-06", "level": "", "num_look": 135401, "num_comment": 1, "author": "亲爱的兔子", "tags": ["资讯"], "text": "近日，电子前哨基金会（Electronic Frontier Foundation简称EFF）曾指责谷歌秘密收集学生们的线上往来数据，而这种情况显然已经违背了承诺和法律。"}
{"title": "你的数据值多少钱？来自暗网市场的调查报告", "url": "https://www.freebuf.com/news/topnews/88325.html", "time": "2015-12-06", "level": "金币+4", "num_look": 835417, "num_comment": 8, "author": "寰者", "tags": ["WEB安全", "头条"], "text": "全球知名安全厂商Mcafee实验室发布了一份关于暗网市场上出售来自各个行业敏感数据的价格的报告"}
{"title": "暗网“丝绸之路”二号人物落网面临终身监禁", "url": "https://www.freebuf.com/news/88329.html", "time": "2015-12-05", "level": "金币+4", "num_look": 254506, "num_comment": 7, "author": "亲爱的兔子", "tags": ["文章", "资讯"], "text": "美国联邦检察官在周五证实，名为Roger Thomas Clark的男子在泰国被逮捕，目前正在处理引渡回美国的相关事宜。"}
{"title": "知名Hash密码猜测工具：Hashcat开源", "url": "https://www.freebuf.com/news/88296.html", "time": "2015-12-05", "level": "", "num_look": 491749, "num_comment": 9, "author": "明明知道", "tags": ["工具", "资讯"], "text": "北京时间12月5日凌晨，hashcat的作者“atom”宣布将工具开源。"}
{"title": "加拿大计划招募网络安全专家成立新部门", "url": "https://www.freebuf.com/news/88167.html", "time": "2015-12-05", "level": "", "num_look": 142804, "num_comment": 4, "author": "亲爱的兔子", "tags": ["资讯"], "text": "目前加拿大皇家骑警（Royal Canadian Mounted Police，简称RCMP）宣布了一项遏制网络犯罪增长的战略计划。"}
{"title": "从“大韩通运快递”支付病毒窥见：短信木马开始袭击韩国", "url": "https://www.freebuf.com/articles/terminal/88234.html", "time": "2015-12-04", "level": "", "num_look": 203377, "num_comment": 5, "author": "腾讯手机管家", "tags": ["终端安全"], "text": "近期发现一经过二次打包伪装成韩国知名软件——“大韩通云快递”的病毒，它会上传用户账号密码至指定服务器，造成用户财产损失。"}
{"title": "为什么WAF（应用防火墙）不能确保数据库安全？", "url": "https://www.freebuf.com/articles/88190.html", "time": "2015-12-04", "level": "", "num_look": 508531, "num_comment": 19, "author": "ONEASP", "tags": ["WEB安全", "文章"], "text": "不要以为有了 WAF 的保护，数据库安全就万无一失了。事实上，数据库仍然存在很大的安全隐患。"}
{"title": "Wordbrutepress：针对Wordpress XML-RPC的大型暴力破解测试工具", "url": "https://www.freebuf.com/sectool/88148.html", "time": "2015-12-04", "level": "", "num_look": 346636, "num_comment": 8, "author": "FireFrank", "tags": ["工具"], "text": "Wordbrutepress是一种有标准的支持多线程的Wordpress Brute Force和XML-RPC登录方法，针对Wordpress XML-RPC的大型暴力破解攻击工具。"}
{"title": "专访知名黑客陆羽：俯瞰陆地、振羽翱翔", "url": "https://www.freebuf.com/articles/88077.html", "time": "2015-12-04", "level": "红色标题", "num_look": 747356, "num_comment": 43, "author": "T00ls安全", "tags": ["人物志", "文章"], "text": "本期采访的人物是360网络攻防实验室负责人、知名黑客陆羽。"}
{"title": "WiFi有毒：如何建立一个自动文件下载的网络接入点", "url": "https://www.freebuf.com/sectool/88132.html", "time": "2015-12-04", "level": "金币+4", "num_look": 550410, "num_comment": 11, "author": "SecDarker", "tags": ["工具"], "text": "本文中我将完整的阐述如何通过建立一个网络接入点来使得用户进行自动文件下载。"}
{"title": "FBI被曝强制企业上交用户隐私信息", "url": "https://www.freebuf.com/news/87832.html", "time": "2015-12-04", "level": "", "num_look": 265117, "num_comment": 3, "author": "banish", "tags": ["数据安全", "资讯"], "text": "日前，联邦调查局（ FBI）被第一次曝出可以使用国家安全信函（NSLS）强制性要求企业交出敏感用户数据，即使他们并无相关授权证。"}
{"title": "CI工具一周课程Day 1：Jenkins", "url": "https://www.freebuf.com/sectool/88143.html", "time": "2015-12-04", "level": "金币+4", "num_look": 353300, "num_comment": 7, "author": "xiaix", "tags": ["工具"], "text": "持续集成(Continuous Integration，CI)工具经常被开发者所使用，常在一些程序开发组织中用于开发、项目管理和源代码管理等。"}
{"title": "在巴西乱发恶意评论，可能会遭到实体攻击", "url": "https://www.freebuf.com/news/88062.html", "time": "2015-12-04", "level": "金币+4", "num_look": 153881, "num_comment": 3, "author": "亲爱的兔子", "tags": ["其他", "资讯"], "text": "该活动目的是引起大众关注，让人们思考在网络上发表歧视言论的后果，而非打击报复行动......"}
{"title": "为什么说你的API并不安全？", "url": "https://www.freebuf.com/articles/security-management/87522.html", "time": "2015-12-04", "level": "金币+5", "num_look": 370712, "num_comment": 4, "author": "florence", "tags": ["安全管理"], "text": "希望所有API开发者都能看一看这篇文章。我将解释API认证的基础和目前业内最好的做法。"}
{"title": "利用F5 ICall脚本提权漏洞分析(CVE-2015-3628)", "url": "https://www.freebuf.com/vuls/87239.html", "time": "2015-12-04", "level": "金币+5", "num_look": 214380, "num_comment": 4, "author": "xiaix", "tags": ["漏洞"], "text": "今年早些时候，GDS在F5 BIG-IP LTM中发现了一个漏洞，这个漏洞允许受限的用户访问系统后进行提取并且在提权成功后远程执行命令。"}
{"title": "Adele强势归来，歌迷称个人信息因购票遭泄露", "url": "https://www.freebuf.com/articles/system/87984.html", "time": "2015-12-04", "level": "", "num_look": 186277, "num_comment": 5, "author": "明明知道", "tags": ["系统安全"], "text": "购买Adele巡回音乐会的热情粉丝告诉BBC，他们在购票过程中看到了其他人的地址及信用卡信息。"}
{"title": "GCHQ被控“持续”非法入侵", "url": "https://www.freebuf.com/news/88007.html", "time": "2015-12-03", "level": "金币+5", "num_look": 138314, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "在Privacy International（隐私国际）和ISP的诉讼案面前，英国间谍机构政府通信总部GCHQ首次承认入侵了电脑。"}
{"title": "3G/4G调制解调器中的安全漏洞：可致设备被完全控制", "url": "https://www.freebuf.com/news/88102.html", "time": "2015-12-03", "level": "金币+5", "num_look": 363580, "num_comment": 7, "author": "vul_wish", "tags": ["无线安全", "漏洞"], "text": "近日，安全专家在调查中发现，来自四个厂商的蜂窝调制解调器中存在跨站脚本漏洞、跨站请求伪造漏洞和远程代码执行漏洞，并可能遭受完整性攻击。"}
{"title": "2016 FreeBuf互联网安全创新大会（FIT）：共探安全创新源动力", "url": "https://www.freebuf.com/news/88052.html", "time": "2015-12-03", "level": "红色标题", "num_look": 400137, "num_comment": 12, "author": "FB独家", "tags": ["头条", "资讯"], "text": "冬去春来，2016年1月8日-9日，请随着FreeBuf迎接2016第一缕阳光。"}
{"title": "VulnHub挑战赛Pipe解题思路", "url": "https://www.freebuf.com/articles/web/87131.html", "time": "2015-12-03", "level": "", "num_look": 322365, "num_comment": 6, "author": "鸢尾", "tags": ["WEB安全"], "text": "今天我将给大家演示我是如何解决VulnHub挑战赛这道名为Pipe题目的。"}
{"title": "漏洞之王：Flash将灭亡？Adobe推出Animate CC为其延续", "url": "https://www.freebuf.com/news/88045.html", "time": "2015-12-03", "level": "金币+5", "num_look": 198254, "num_comment": 6, "author": "vul_wish", "tags": ["资讯"], "text": "Adobe发表声明，将Flash Professional CC更名为Animate CC，在维持原有Flash开发工具的基础上，新增 HTML 5 创作工具"}
{"title": "暗网论坛Darkode卷土重来", "url": "https://www.freebuf.com/news/88010.html", "time": "2015-12-03", "level": "金币+5", "num_look": 378321, "num_comment": 6, "author": "江湖小吓", "tags": ["资讯"], "text": "Damballa安全中心的专家在暗网里发现了再次兴起的Darkode论坛。"}
{"title": "针对TCP握手的欺骗", "url": "https://www.freebuf.com/articles/network/87998.html", "time": "2015-12-03", "level": "金币+5", "num_look": 430322, "num_comment": 12, "author": "xiaix", "tags": ["网络安全"], "text": "通常人们总是会质疑到TCP握手过程中两端都认证了彼此的IP地址。那么这种攻击会告诉我们这并不总是真的。"}
{"title": "奇虎360安服部工程师职位招聘", "url": "https://www.freebuf.com/jobs/87912.html", "time": "2015-12-03", "level": "", "num_look": 421006, "num_comment": 34, "author": "洋葱Ycong", "tags": ["安全招聘"], "text": "奇虎360安全服务团队招聘安全服务工程师、安全开发工程师。"}
{"title": "揭开山寨应用的伪装面具", "url": "https://www.freebuf.com/news/87951.html", "time": "2015-12-03", "level": "", "num_look": 162448, "num_comment": 6, "author": "AVLTeam", "tags": ["资讯"], "text": ""}
{"title": "【FIT互联网安全创新大会前奏】2015年，哪一朵云最值得你的信赖？", "url": "https://www.freebuf.com/news/87028.html", "time": "2015-12-03", "level": "红色标题", "num_look": 310578, "num_comment": 4, "author": "FB独家", "tags": ["资讯"], "text": "2015年涌现出的诸多云计算服务商中，哪一个才是我们公认的最值得信赖的安全云？"}
{"title": "华为Wimax路由器被爆存在多个漏洞", "url": "https://www.freebuf.com/articles/terminal/87957.html", "time": "2015-12-03", "level": "金币+5", "num_look": 245621, "num_comment": 2, "author": "鸢尾", "tags": ["终端安全"], "text": "华为BM626e是一款设计很不严谨的Wimax路由器/Ap设备，其可为互联网提供一个Wimax网络。"}
{"title": "新手对Mirage后门的简单分析", "url": "https://www.freebuf.com/articles/network/87634.html", "time": "2015-12-03", "level": "现金奖励", "num_look": 332037, "num_comment": 5, "author": "shuxiang", "tags": ["网络安全"], "text": "Mirage 是一个2012年的后门木马，攻击目标是政府组织、能源公司、军队机构等。"}
{"title": "地下交易的新PoS恶意软件：Pro PoS", "url": "https://www.freebuf.com/news/87878.html", "time": "2015-12-03", "level": "金币+4", "num_look": 166511, "num_comment": 3, "author": "江湖小吓", "tags": ["资讯"], "text": "一个被称为Pro PoS解决方案的新PoS恶意软件菌株现在正在地下黑市频繁地交易。"}
{"title": "谷歌被曝秘密收集学生信息", "url": "https://www.freebuf.com/news/87947.html", "time": "2015-12-03", "level": "金币+4", "num_look": 154646, "num_comment": 2, "author": "亲爱的兔子", "tags": ["文章", "资讯"], "text": "近日，电子前哨基金会（Electronic Frontier Foundation简称EFF）向美国联邦贸易委员会(FTC)举报谷歌秘密收集学生的网络数据。"}
{"title": "360MarvelTeam虚拟化漏洞第三弹：CVE-2015-7504漏洞分析", "url": "https://www.freebuf.com/articles/87949.html", "time": "2015-12-02", "level": "", "num_look": 513942, "num_comment": 11, "author": "360MarvelTeam", "tags": ["文章", "网络安全"], "text": "今天的主角就是这枚编号CVE-2015-7504的，一枚同时影响kvm和xen平台的高危虚拟化安全漏洞。"}
{"title": "圣诞将至，你敢给孩子买芭比娃娃吗？", "url": "https://www.freebuf.com/news/87853.html", "time": "2015-12-02", "level": "", "num_look": 167729, "num_comment": 8, "author": "简单", "tags": ["资讯"], "text": "圣诞节就要到了，你有没有想过要买一个芭比娃娃送给女儿呢？"}
{"title": "阿里移动发布2015第三季度安全报告", "url": "https://www.freebuf.com/articles/neopoints/87929.html", "time": "2015-12-02", "level": "", "num_look": 229634, "num_comment": 2, "author": "阿里聚安全", "tags": ["安全报告", "观点"], "text": "此报告对移动应用的病毒、漏洞、仿冒三大类安全问题进行了分析。"}
{"title": "百万物联网设备或因使用相同的密钥受到攻击", "url": "https://www.freebuf.com/articles/terminal/87604.html", "time": "2015-12-02", "level": "", "num_look": 302033, "num_comment": 1, "author": "vul_wish", "tags": ["终端安全"], "text": "IT安全公司SEC Consult的一份分析报告指出，上百万的嵌入式设备，都使用相同的、硬编码的SSH加密密钥或HTTPS服务器证书。"}
{"title": "手把手教你DIY一个CloudEye", "url": "https://www.freebuf.com/sectool/87846.html", "time": "2015-12-02", "level": "现金奖励", "num_look": 539933, "num_comment": 9, "author": "KibodWapon", "tags": ["工具", "极客"], "text": "最近随着blind型的ssrf、xxe等漏洞的火爆，CloudEye这类第三方刺探漏洞服务器闪亮登场了。那么今天我们来动手DIY一个NoeYe。"}
{"title": "FBI针对“12亿互联网认证信息被盗”疑犯展开调查", "url": "https://www.freebuf.com/news/87883.html", "time": "2015-12-02", "level": "金币+4", "num_look": 155711, "num_comment": 5, "author": "Sphinx", "tags": ["资讯"], "text": "一位俄罗斯嫌犯声称他窃取了12亿邮箱密码登录信息，现在FBI正在追捕这名黑客。"}
{"title": "无线渗透环境Xiaopan OS新版本发布", "url": "https://www.freebuf.com/sectool/87386.html", "time": "2015-12-02", "level": "金币+4", "num_look": 606579, "num_comment": 10, "author": "亲爱的兔子", "tags": ["工具", "无线安全"], "text": "Xiaopan OS是一个容易上手的无线渗透环境，无论是初学者还是无线安全专家均可轻松上手使用。"}
{"title": "逆向工程(三)：实例破解", "url": "https://www.freebuf.com/articles/system/87723.html", "time": "2015-12-02", "level": "现金奖励", "num_look": 825810, "num_comment": 20, "author": "VillanCh", "tags": ["系统安全"], "text": "这次我们将破解一款真正的商业程序。"}
{"title": "一些值得收藏的PowerShell工具", "url": "https://www.freebuf.com/sectool/87647.html", "time": "2015-12-02", "level": "金币+4", "num_look": 605688, "num_comment": 8, "author": "SecDarker", "tags": ["工具"], "text": "本文分享了部分PowerShell工具，拿走，不谢！"}
{"title": "ISIS的网络安全行动手册里都讲了些什么？", "url": "https://www.freebuf.com/news/87719.html", "time": "2015-12-02", "level": "金币+4", "num_look": 168988, "num_comment": 5, "author": "亲爱的兔子", "tags": ["资讯"], "text": "在巴黎恐怖袭击事件之后，一些媒体披露了ISIS有一本秘密网络安全行动手册，而这本手册由一家叫做Cyberkov的科威特安全公司撰写，但ISIS成员将其挪为己用。"}
{"title": "匿名者组织攻击联合国气候变化峰会，大量网站数据泄露", "url": "https://www.freebuf.com/news/87824.html", "time": "2015-12-01", "level": "金币+4", "num_look": 213353, "num_comment": 13, "author": "亲爱的兔子", "tags": ["资讯"], "text": "黑客组织匿名者(Anonymous)在对ISIS成员展开网络攻击之后，日前，黑客组织匿名者又将目标转向了正在法国巴黎召开的联合国(UN)气候变化峰会。"}
{"title": "Sigreturn Oriented Programming (SROP) Attack攻击原理", "url": "https://www.freebuf.com/articles/network/87447.html", "time": "2015-12-01", "level": "现金奖励", "num_look": 699772, "num_comment": 7, "author": "mctrain", "tags": ["网络安全"], "text": "SROP，和BROP一样，这个工作也是发表在国际安全领域最顶级会议Oakland 2014上。"}
{"title": "英国Trident核武器系统可被网络攻击", "url": "https://www.freebuf.com/news/87646.html", "time": "2015-12-01", "level": "", "num_look": 151390, "num_comment": 8, "author": "简单", "tags": ["资讯"], "text": "前英国国防部长Des Browne警告称，Trident核武器系统存在安全隐患，可能会被网络攻击者攻击。"}
{"title": "Windows 10下注册表如何隐藏？", "url": "https://www.freebuf.com/articles/system/87624.html", "time": "2015-12-01", "level": "", "num_look": 254894, "num_comment": 4, "author": "银河实验室", "tags": ["系统安全"], "text": "今天是第一篇：移植Hook GetCellRoutine()到Windows 10。以后会陆续分享其他Windows 10内核方面的文章。"}
{"title": "Sniffly： 利用HSTS和CSP嗅探浏览器历史记录", "url": "https://www.freebuf.com/articles/87641.html", "time": "2015-12-01", "level": "金币+5", "num_look": 458498, "num_comment": 1, "author": "寰者", "tags": ["工具", "文章"], "text": "Sniffly是一种通过利用HSTS和内容安全策略进行攻击的方式，它允许任意网站嗅探用户的浏览器历史。"}
{"title": "以一种轻松的方式来看ARPspoof源码", "url": "https://www.freebuf.com/sectool/87293.html", "time": "2015-12-01", "level": "现金奖励", "num_look": 461388, "num_comment": 8, "author": "VillanCh", "tags": ["工具"], "text": "如果你的目标是渴望拥有自己的渗透测试工具，编写自己的xxxtools，那么看一些简单的工具的源码一定大有裨益。"}
{"title": "【FIT互联网安全创新大会前奏】安全圈都有哪些又酷又萌的妹子？（上篇）", "url": "https://www.freebuf.com/news/87337.html", "time": "2015-12-01", "level": "红色标题", "num_look": 821890, "num_comment": 87, "author": "FB独家", "tags": ["其他", "头条"], "text": "安全圈里为数不多的女生，不仅是安全圈里一道风景，更为整个行业带来活力和清新。谁会成为“2015互联网安全年度评选”年度安全宝贝？"}
{"title": "程序猿也疯狂：一款插件给写代码带来的超爽视觉震撼", "url": "https://www.freebuf.com/sectool/87655.html", "time": "2015-12-01", "level": "", "num_look": 1284063, "num_comment": 42, "author": "0xroot", "tags": ["工具", "极客"], "text": "如果来点音乐、再配上机械键盘的话，写代码是不是爽到爆呢？"}
{"title": "渗透测试大礼包：BlackArch Linux v2015.11.24发布", "url": "https://www.freebuf.com/sectool/87591.html", "time": "2015-12-01", "level": "", "num_look": 457064, "num_comment": 15, "author": "0xroot", "tags": ["工具"], "text": "BlackArch Linux是基于Arch Linux的发行版，其包含了1308款工具，主要面向渗透人员与安全爱好者。"}
{"title": "网络小黑揭秘系列之私服牧马人", "url": "https://www.freebuf.com/articles/network/87592.html", "time": "2015-12-01", "level": "红色标题", "num_look": 728334, "num_comment": 38, "author": "奇安信威胁情报中心", "tags": ["网络安全"], "text": "一次次的扒皮往往都是从一个最简单的线索开始，比如一个IP、域名或程序样本。这回的也不例外。"}
{"title": "一个安全故事：获取Belkin WeMo智能电源开关的ROOT权限", "url": "https://www.freebuf.com/articles/terminal/87502.html", "time": "2015-12-01", "level": "金币+5", "num_look": 205398, "num_comment": 6, "author": "xiaix", "tags": ["终端安全"], "text": "这篇文章记录了我面对那些曾经听说过但从未见过的设备和协议攻击的经历。"}
{"title": "从无线电到网络色情：英国间谍追溯网民的上网身份", "url": "https://www.freebuf.com/articles/87415.html", "time": "2015-12-01", "level": "金币+5", "num_look": 189019, "num_comment": 5, "author": "crown丶prince", "tags": ["文章"], "text": "这是一份直指核心绝密项目的报告：记录“每个在互联网上可见用户”的网络浏览习惯。"}
{"title": "QEMU新虚拟机逃逸漏洞深入分析", "url": "https://www.freebuf.com/vuls/87673.html", "time": "2015-11-30", "level": "", "num_look": 406160, "num_comment": 8, "author": "360安全", "tags": ["漏洞"], "text": "QEMU是由法布里斯·贝拉(Fabrice Bellard)所编写的以GPL许可证分发源码的模拟处理器。它可以模拟多款不同架构的CPU，还包含部分硬件模拟。"}
{"title": "匿名者组织入侵冰岛政府网站，抗议商业捕鲸", "url": "https://www.freebuf.com/news/87701.html", "time": "2015-11-30", "level": "金币+5", "num_look": 142049, "num_comment": 5, "author": "FireFrank", "tags": ["资讯"], "text": "匿名攻击者开始了名为 #OpWhales的行动并关闭了几乎所有冰岛政府的官方网站长达13个小时，这一行动旨在抗议冰岛的商业捕鲸行为。"}
{"title": "浅谈如何建立互联网风控系统", "url": "https://www.freebuf.com/articles/others-articles/87556.html", "time": "2015-11-30", "level": "", "num_look": 659431, "num_comment": 8, "author": "岂安科技", "tags": ["其他", "网络安全"], "text": "本文旨在通过个人角度对一些风险相关的概念进行通俗化的阐述。"}
{"title": "开发者福利：solarized跨平台配色方案", "url": "https://www.freebuf.com/sectool/87294.html", "time": "2015-11-30", "level": "", "num_look": 479827, "num_comment": 8, "author": "0xroot", "tags": ["工具"], "text": "Solarized 是目前最完整的终端、编辑器、开发工具的配色项目，适用于Mac OS X、Linux、 Windows系统以及各种编辑器和命令行终端。"}
{"title": "揭开XSSI攻击的神秘面纱", "url": "https://www.freebuf.com/articles/web/87374.html", "time": "2015-11-30", "level": "金币+5", "num_look": 481998, "num_comment": 11, "author": "SecDarker", "tags": ["WEB安全", "系统安全"], "text": "Cross Site Script Inclusion (XSSI) 跨站脚本包含是一种允许攻击者通过恶意JS绕过边界窃取信息的攻击技术。"}
{"title": "SpyderSec挑战赛解题思路解析", "url": "https://www.freebuf.com/articles/web/86716.html", "time": "2015-11-30", "level": "", "num_look": 230413, "num_comment": 5, "author": "鸢尾", "tags": ["WEB安全"], "text": "今天我们要解决的这个挑战赛十分有趣，该挑战赛名为SpyderSec。"}
{"title": "全球最大婴幼儿电子学习产品制造商Vtech（伟易达）被曝480万家长及儿童信息泄露", "url": "https://www.freebuf.com/news/87515.html", "time": "2015-11-30", "level": "", "num_look": 239265, "num_comment": 4, "author": "寰者", "tags": ["系统安全", "资讯"], "text": "Vtech伟易达，公司位于香港，一家主要设计和销售儿童电子学习玩具的公司"}
{"title": "Windows提权的几种姿势", "url": "https://www.freebuf.com/vuls/87463.html", "time": "2015-11-30", "level": "红色标题", "num_look": 1070355, "num_comment": 17, "author": "xiaix", "tags": ["漏洞", "系统安全"], "text": "想象这种画面：你拿到了一台机器上Meterpreter会话了，然后你准备运行getsystem命令进行提权，但如果提权没有成功，你就准备认输了吗？"}
{"title": "安全应急响应工具年末大放送（含下载）", "url": "https://www.freebuf.com/sectool/87400.html", "time": "2015-11-30", "level": "金币+10", "num_look": 893771, "num_comment": 17, "author": "鸢尾", "tags": ["头条", "工具"], "text": "这个安全应急响应工具和资源旨在帮助安全分析师更好的完成工作。"}
{"title": "逆向工程（二）：从一个简单的实例来了解PE文件", "url": "https://www.freebuf.com/articles/system/86596.html", "time": "2015-11-30", "level": "现金奖励", "num_look": 1080753, "num_comment": 36, "author": "VillanCh", "tags": ["系统安全"], "text": "本文将从一个简单的实例来了解PE文件。"}
{"title": "态势感知将DDOS扼杀在摇篮中：涉及数千台PostgreSQL服务器", "url": "https://www.freebuf.com/articles/network/87479.html", "time": "2015-11-30", "level": "", "num_look": 411555, "num_comment": 18, "author": "阿里安全", "tags": ["网络安全"], "text": "近日，阿里云盾的态势感知系统成功捕获到一起利用PostgreSQL弱口令批量植入木马的事件。"}
{"title": "NSA陆续结束大范围监听美国公民电话项目", "url": "https://www.freebuf.com/news/87461.html", "time": "2015-11-30", "level": "", "num_look": 165682, "num_comment": 2, "author": "亲爱的兔子", "tags": ["资讯"], "text": "目前美国国家安全局（NSA）将结束大范围监听美国公民电话的项目，而将监听对象更严格地锁定为可疑人员。"}
{"title": "两款披着色情外衣的恶意软件分析", "url": "https://www.freebuf.com/articles/terminal/87160.html", "time": "2015-11-29", "level": "", "num_look": 280158, "num_comment": 9, "author": "SecDarker", "tags": ["终端安全"], "text": "统计显示在互联网中约有30%的流量都直接或者间接的与色情相关，这就使得许多恶意软件的作者都会将其作为感染大量用户的首要选择。"}
{"title": "俄罗斯黑客是如何滥用twitter作为Hammertoss C&C服务器的？", "url": "https://www.freebuf.com/news/87325.html", "time": "2015-11-29", "level": "", "num_look": 224444, "num_comment": 3, "author": "简单", "tags": ["资讯"], "text": "我们曾用它来追踪一个叫做Hammertoss的复杂俄罗斯恶意软件，该恶意软件的创造者滥用知名网站（比如twitter和github）来跃过防火墙和躲避追踪。"}
{"title": "黑客用核开发组件（Nuclear exploit kit）散播Cryptowall 4.0勒索软件", "url": "https://www.freebuf.com/news/87359.html", "time": "2015-11-29", "level": "", "num_look": 213886, "num_comment": 1, "author": "cindy", "tags": ["资讯"], "text": "黑客用核开发组件（Nuclear exploit kit）散播Cryptowall 4.0勒索软件，用户将更加危险。"}
{"title": "英国17岁黑客攻击赌博网站遭判决", "url": "https://www.freebuf.com/news/87412.html", "time": "2015-11-28", "level": "金币+10", "num_look": 398707, "num_comment": 6, "author": "亲爱的兔子", "tags": ["资讯"], "text": "来自英国诺丁汉郡的17岁少年Max Whitehouse今年年初对一家在线赌博网站发起了DDoS网络攻击。"}
{"title": "联想系统更新中发现的两枚提权漏洞原理分析", "url": "https://www.freebuf.com/articles/system/87162.html", "time": "2015-11-28", "level": "", "num_look": 193154, "num_comment": 5, "author": "鸢尾", "tags": ["系统安全"], "text": "联想最新发布的系统更新公告中的两个提权漏洞是我在几周前提交的(CVE-2015-8109，CVE-2015-8110)IOActive以及联想在这个报告中发出警告！"}
{"title": "MagSpoof：能预测并窃取你下一张信用卡号码的廉价设备", "url": "https://www.freebuf.com/news/87225.html", "time": "2015-11-28", "level": "", "num_look": 416007, "num_comment": 12, "author": "JackFree", "tags": ["工具", "资讯"], "text": "硬件黑客Samy Kamkar已经搭建了一个成本10美元的设备，它可以预测并存储成百上千个美国运通信用卡号码，并允许任何人使用它进行无线支付交易，即使是在非无线终端上。"}
{"title": "针对一款DDoS木马的简要分析", "url": "https://www.freebuf.com/articles/terminal/86576.html", "time": "2015-11-28", "level": "", "num_look": 232468, "num_comment": 232468, "author": "明明知道", "tags": ["系统安全", "终端安全"], "text": "本文是国外研究者对一款DDoS木马的分析，木马文件MD5为：67877403db7f8ce451b72924188443f8"}
{"title": "安全专家揭秘索尼影业被黑事件攻击原理", "url": "https://www.freebuf.com/news/86866.html", "time": "2015-11-28", "level": "", "num_look": 249078, "num_comment": 9, "author": "cindy", "tags": ["资讯"], "text": "时隔一年，索尼影视事件依然记忆犹新，安全研究人员也并未放弃对该案件的研究。近日新发现了造成索尼被入侵的真正原因。"}
{"title": "不止一个！戴尔又一根证书漏洞被黑客利用", "url": "https://www.freebuf.com/articles/87363.html", "time": "2015-11-27", "level": "", "num_look": 347385, "num_comment": 6, "author": "Threatbook", "tags": ["文章", "漏洞"], "text": "在某些戴尔系统中发现了第二个自签名的根证书DSDTestProvider，并且同样附带了私钥。"}
{"title": "麻省理工学院（MIT）打造可食用性电子设备", "url": "https://www.freebuf.com/news/86540.html", "time": "2015-11-27", "level": "金币+10", "num_look": 181180, "num_comment": 7, "author": "亲爱的兔子", "tags": ["极客", "资讯"], "text": "麻省理工学院（MIT）在近期开发出一种更为先进的设备，因为这种设备是可以被病人“吃”下去的。"}
{"title": "防鼠也要防猫：0day检测工具也会做坏事", "url": "https://www.freebuf.com/news/87116.html", "time": "2015-11-27", "level": "金币+10", "num_look": 167139, "num_comment": 5, "author": "跳动的心", "tags": ["资讯"], "text": "​对一些企业、机构来说，这些天不仅要考虑0day漏洞的威胁问题，还要担心0day检测（zero detection）恶意软件的威胁。"}
{"title": "俄罗斯黑客利用“反向ATM攻击”技术盗取近400万美元现金", "url": "https://www.freebuf.com/news/87217.html", "time": "2015-11-27", "level": "金币+10", "num_look": 259015, "num_comment": 6, "author": "JackFree", "tags": ["终端安全", "资讯"], "text": "俄罗斯网络罪犯使用了一种称为“反向ATM攻击（Reverse ATM Attack）”的技术，并成功地从至少五个不同的银行盗取了2.52亿卢布（合380万美元）。"}
{"title": "让你家的楼宇门变聪明：基于树莓派实现任意终端控制楼宇门", "url": "https://www.freebuf.com/geek/86906.html", "time": "2015-11-27", "level": "现金奖励", "num_look": 870177, "num_comment": 52, "author": "豆豆青春不喂狗", "tags": ["极客"], "text": "寒冷冬天的早晨，你躺在被窝里，门铃响了，你需要立刻起床穿衣服，然后去开门。现在树莓派能帮你或得一个从容穿衣的时间。"}
{"title": "“会说话的键盘”：一个恶意推广木马的详细分析", "url": "https://www.freebuf.com/articles/terminal/87204.html", "time": "2015-11-27", "level": "", "num_look": 192256, "num_comment": 9, "author": "腾讯电脑管家", "tags": ["终端安全"], "text": "11月中旬，一款名为“会说话的键盘”的流氓软件呈爆发式增长，拦截量一夜之间从零增长到20多万，通过回溯发现主要由“刚需”的色情播放器推广安装。"}
{"title": "竞技世界招聘安全工程师", "url": "https://www.freebuf.com/jobs/83952.html", "time": "2015-11-27", "level": "", "num_look": 192857, "num_comment": 13, "author": "竞技世界", "tags": ["安全招聘"], "text": "竞技世界招聘安全工程师"}
{"title": "盘点好莱坞电影里10大最佳黑客攻击场景", "url": "https://www.freebuf.com/articles/87129.html", "time": "2015-11-27", "level": "", "num_look": 570395, "num_comment": 11, "author": "E安全app", "tags": ["头条", "文章"], "text": "好莱坞的电影里总是不乏科幻、黑科技以及黑客的内容，电影里那些炫目的黑客技巧总是让人大呼过瘾"}
{"title": "“5hm00p”：全球首位公开参与特定目标猎杀的黑客", "url": "https://www.freebuf.com/news/87121.html", "time": "2015-11-27", "level": "", "num_look": 170393, "num_comment": 10, "author": "亲爱的兔子", "tags": ["其他", "资讯"], "text": "在巴黎遭到ISIS恐怖袭击之后，有不少的黑客组织及个人加入到这场与恐怖组织的战斗当中，由此带来的效果有好有坏。"}
{"title": "Amazon AWS Java SDK漏洞披露", "url": "https://www.freebuf.com/vuls/87072.html", "time": "2015-11-27", "level": "金币+6", "num_look": 199973, "num_comment": 2, "author": "xiaix", "tags": ["漏洞"], "text": "官方的AWS SDK常被Java开发者用于整合一系列的AWS服务，包括像Amazon S3中整合Amazon APIs用于存储和索引文件等。"}
{"title": "恶意软件研究者的福音：PROCESS DUMP v1.5正式发布", "url": "https://www.freebuf.com/sectool/86833.html", "time": "2015-11-27", "level": "", "num_look": 307894, "num_comment": 3, "author": "空白", "tags": ["工具"], "text": "导出恶意软件进程内存的Windows逆向命令行工具再次回归了。"}
{"title": "安卓恶意软件Shedun回归影响大量安卓用户（含视频）", "url": "https://www.freebuf.com/news/86623.html", "time": "2015-11-27", "level": "", "num_look": 188577, "num_comment": 1, "author": "亲爱的兔子", "tags": ["漏洞", "资讯"], "text": "移动安全公司Lookout发现，即便用户已经明确拒绝了界面跳转出来的安装请求，一些Android广告软件仍旧会自行开始在系统安装。"}
{"title": "匿名者组织攻破ISIS暗网站点：药不能停", "url": "https://www.freebuf.com/articles/87172.html", "time": "2015-11-26", "level": "金币+6", "num_look": 265913, "num_comment": 9, "author": "FireFrank", "tags": ["文章"], "text": "隶属于黑客组织匿名者的黑客团体GhostSec于周三攻破了ISIS的暗网宣传网站，用百忧解广告替换网站内容。"}
{"title": "代码审计思路之实例解说全文通读", "url": "https://www.freebuf.com/vuls/87138.html", "time": "2015-11-26", "level": "红色标题", "num_look": 923955, "num_comment": 44, "author": "seay", "tags": ["WEB安全", "漏洞"], "text": "在我的新书发布之际，借用这篇文章跟大家分享下代码审计的一些思路。"}
{"title": "机器学习来了，安全行业准备好了吗？", "url": "https://www.freebuf.com/articles/neopoints/87031.html", "time": "2015-11-26", "level": "", "num_look": 414472, "num_comment": 12, "author": "明明知道", "tags": ["观点"], "text": "机器学习就是黑客技能、数学和统计学知识的加和。"}
{"title": "DockerMaze迷宫挑战赛write-up", "url": "https://www.freebuf.com/articles/web/86843.html", "time": "2015-11-26", "level": "金币+6", "num_look": 236717, "num_comment": 4, "author": "鸢尾", "tags": ["WEB安全"], "text": "今年11月16~17日在巴萨罗那举行的Dockercon eu 2015，Schibsted Team发布了一个DockerMaze挑战赛，就跟我们90年代玩的跑出迷宫游戏差不多。"}
{"title": "谷歌可远程更改安卓设备密码，影响74%设备", "url": "https://www.freebuf.com/news/86821.html", "time": "2015-11-26", "level": "金币+6", "num_look": 256139, "num_comment": 13, "author": "亲爱的兔子", "tags": ["漏洞", "终端安全"], "text": "根据纽约地区检察官办公室的一份报告所述，只要有法院命令，谷歌能够非常容易地远程重置旧版本Android系统的密码。"}
{"title": "P2P端口映射开源工具：狗洞（dog-tunnel）", "url": "https://www.freebuf.com/sectool/87071.html", "time": "2015-11-26", "level": "", "num_look": 565908, "num_comment": 14, "author": "0xroot", "tags": ["工具"], "text": "狗洞是一个高速的P2P端口映射工具，同时支持Socks5代理。"}
{"title": "从异常挖掘到CC攻击地下黑客团伙", "url": "https://www.freebuf.com/articles/web/86948.html", "time": "2015-11-26", "level": "", "num_look": 422260, "num_comment": 12, "author": "百度安全", "tags": ["WEB安全"], "text": "11月13日，百度云安全天网系统发现了安全宝某重点客户网站上的异常行为。之后分析人员发现这是一起针对安全宝某重点客户的持续攻击。最终在客户系统上放置了Web后门。"}
{"title": "分析报告：嵌入恶意payload的Word文档", "url": "https://www.freebuf.com/articles/system/86941.html", "time": "2015-11-26", "level": "", "num_look": 236358, "num_comment": 2, "author": "dawner", "tags": ["系统安全"], "text": "一周前，SANS ISC管理和自由安全顾问Xavier Mertens先生分析了一篇恶意word文档，下面是他对此给出的分析报告。"}
{"title": "极客玩转辐射4 pip boy设备的正确姿势", "url": "https://www.freebuf.com/articles/terminal/86752.html", "time": "2015-11-26", "level": "金币+5", "num_look": 287318, "num_comment": 4, "author": "鸢尾", "tags": ["极客", "终端安全"], "text": "与其早前版本一样，辐射4也配备有一个pip boy设备，这设备十分炫酷，今天我们就来好好玩玩吧！"}
{"title": "俄罗斯、澳大利亚相继开发新的反窃听系统", "url": "https://www.freebuf.com/news/86018.html", "time": "2015-11-26", "level": "金币+5", "num_look": 122861, "num_comment": 1, "author": "江湖小吓", "tags": ["资讯"], "text": "据俄罗斯制造商ICD透露，他们设计开发出了一款先进的系统，用于保护通信信道以打击秘密窃听。无独有偶，堪培拉物理学家也研究出了一个“牢不可破”的网络安全系统，还得到了全球认可。"}
{"title": "戴尔eDellRoot后门后续：根证书自带私钥，可导致中间人攻击", "url": "https://www.freebuf.com/articles/86953.html", "time": "2015-11-25", "level": "", "num_look": 251374, "num_comment": 1, "author": "百度安全", "tags": ["文章", "漏洞"], "text": "此漏洞可导致中间人攻击，且已发现利用此漏洞制作的病毒，这对被安装了后门的用户是个严重的安全威胁。"}
{"title": "ISIS使用的Telegram通信软件牢不可破？", "url": "https://www.freebuf.com/news/86905.html", "time": "2015-11-25", "level": "", "num_look": 293892, "num_comment": 9, "author": "vul_wish", "tags": ["资讯"], "text": "Telegram即时通讯软件由于ISIS的使用而被大家熟知，其开发者声称，它的安全性远高于同类型软件。近日，安全专家发现Telegram软件并不是不可攻破 。"}
{"title": "使用scapy做扫描器的一些技巧", "url": "https://www.freebuf.com/sectool/86922.html", "time": "2015-11-25", "level": "金币+5", "num_look": 251891, "num_comment": 8, "author": "xiaix", "tags": ["工具"], "text": "有些时候nmap的扫描很嘈杂会触发主机或者网络的IPS警报。那么在进行扫描的时候一个可行的选项是使用ARP Ping。"}
{"title": "KK插件病毒感染全球700万台手机，证据显示幕后黑手来自深圳", "url": "https://www.freebuf.com/articles/terminal/86921.html", "time": "2015-11-25", "level": "红色标题", "num_look": 570452, "num_comment": 16, "author": "FireFrank", "tags": ["系统安全", "终端安全"], "text": "一旦手机被KK插件感染，系统中会频繁弹出恶意广告并警告手机被感染了，同时提供了其他应用程序进行下载安装。"}
{"title": "戴尔曝eDellRoot根证书后门", "url": "https://www.freebuf.com/articles/terminal/86968.html", "time": "2015-11-25", "level": "", "num_look": 434204, "num_comment": 8, "author": "Sphinx", "tags": ["终端安全"], "text": "最近，Duo实验室的安全研究人员在戴尔笔记本中发现了一些奇怪的证书，跟之前联想的Superfish事件一样，这些证书会增加用户受到黑客攻击的风险。"}
{"title": "【视频已更新】FreeTalk成都站：火锅和黑客更配哦", "url": "https://www.freebuf.com/news/83612.html", "time": "2015-11-25", "level": "红色标题", "num_look": 392512, "num_comment": 21, "author": "FB独家", "tags": ["活动", "资讯"], "text": "FreeTalk成都站活动圆满结束，我们一起来看活动现场速记..."}
{"title": "Chrome第三方扩展程序被曝光可记录隐私信息并出售", "url": "https://www.freebuf.com/news/86932.html", "time": "2015-11-25", "level": "", "num_look": 193989, "num_comment": 1, "author": "亲爱的兔子", "tags": ["漏洞", "资讯"], "text": "安全公司Detectify目前表示有些Chrome扩展程序会追踪用户的上网历史记录，甚至还包括Facebook Connect的私密访问令牌。"}
{"title": "SQLMap的前世今生（Part2）：数据库指纹识别", "url": "https://www.freebuf.com/sectool/86886.html", "time": "2015-11-25", "level": "", "num_look": 422050, "num_comment": 9, "author": "安全豹", "tags": ["工具", "系统安全"], "text": "SQLMap在扫描SQL的逻辑到底是怎样实现的呢，接下来就探讨下SQLMap的扫描逻辑，通过了解SQLMap的扫描逻辑打造一款属于自己的SQL扫描工具。"}
{"title": "JBOSS发现Java反序列化远程命令执行漏洞", "url": "https://www.freebuf.com/articles/86950.html", "time": "2015-11-25", "level": "", "num_look": 904156, "num_comment": 9, "author": "百度安全", "tags": ["文章"], "text": "近日，多篇关于jboss的java反序列化漏洞的文章盛传于网络。那么到底是不是只要用了jboss就会存在这个漏洞？"}
{"title": "破解Hidden Tear勒索软件的加密机制", "url": "https://www.freebuf.com/articles/system/86549.html", "time": "2015-11-25", "level": "", "num_look": 266500, "num_comment": 3, "author": "JackFree", "tags": ["系统安全"], "text": "三个月前我发布了世界上第一个开源勒索软件Hidden Tear，现在我想解释一下发布这款开源勒索软件背后的想法。"}
{"title": "CTF小技巧：文本解密工具 Text Decoder Toolkit", "url": "https://www.freebuf.com/sectool/86269.html", "time": "2015-11-25", "level": "", "num_look": 450068, "num_comment": 15, "author": "明明知道", "tags": ["工具"], "text": "这里我提供了三个思路，但我相信一定会有其他更好的方法。"}
{"title": "Codetainer：基于浏览器的Docker容器", "url": "https://www.freebuf.com/sectool/86327.html", "time": "2015-11-25", "level": "", "num_look": 238678, "num_comment": 2, "author": "0xroot", "tags": ["工具"], "text": "基于浏览器的Docker容器，你可以通过Codetainer创建基于浏览器的代码运行沙箱，可以方便地嵌入到你的Web 应用中。"}
{"title": "恐怖袭击警报邮件暗藏木马", "url": "https://www.freebuf.com/news/86460.html", "time": "2015-11-25", "level": "", "num_look": 138941, "num_comment": 3, "author": "简单", "tags": ["资讯"], "text": "网络犯罪者假借迪拜、巴林岛、土耳其、加拿大执法机构官员的名义发送恐怖袭击警报邮件，实质上这些邮件是暗藏Sockrat后门的钓鱼邮件。"}
{"title": "一个可感染电脑的APK木马分析", "url": "https://www.freebuf.com/articles/network/86793.html", "time": "2015-11-24", "level": "", "num_look": 383736, "num_comment": 5, "author": "腾讯电脑管家", "tags": ["网络安全"], "text": "该病毒监听系统开机广播，开机自启动；启动后，该病毒会发送消息给服务器，并不断接收、执行服务器发送的指令。"}
{"title": "社交网站LinkedIn（领英）修复帮助中心处的XSS", "url": "https://www.freebuf.com/news/86748.html", "time": "2015-11-24", "level": "金币+4", "num_look": 294942, "num_comment": 4, "author": "dawner", "tags": ["WEB安全", "漏洞"], "text": "LinkedIn的开发人员在这周修复了一个存储型跨站脚本漏洞，黑客用它可以在LinkedIn的帮助论坛中散布XSS蠕虫。"}
{"title": "TrueCrypt漏洞分析：比人们想象的更加安全", "url": "https://www.freebuf.com/vuls/86565.html", "time": "2015-11-24", "level": "金币+4", "num_look": 455800, "num_comment": 4, "author": "dawner", "tags": ["数据安全", "漏洞"], "text": "TrueCrypt是一款安全隐私爱好者所喜爱的数据加密工具，但是最近它爆出了一些漏洞。"}
{"title": "逆向工程（一）：汇编、逆向工程基础篇", "url": "https://www.freebuf.com/news/others/86147.html", "time": "2015-11-24", "level": "现金奖励", "num_look": 2544984, "num_comment": 47, "author": "VillanCh", "tags": ["周边", "系统安全"], "text": "汇编是逆向工程的基础，这篇文章讲解并不深入但是覆盖了你刚开始学习汇编需要了解的所有基础知识！"}
{"title": "CloudFare被匿名者组织威胁：下架所有ISIS宣传网站", "url": "https://www.freebuf.com/news/86741.html", "time": "2015-11-24", "level": "金币+4", "num_look": 200650, "num_comment": 16, "author": "FireFrank", "tags": ["资讯"], "text": "CloudFare被匿名者组织威胁，要求其下架所有与ISIS有关的网站。"}
{"title": "从少量访问日志还原黑客攻击过程", "url": "https://www.freebuf.com/articles/web/86406.html", "time": "2015-11-24", "level": "金币+4", "num_look": 428353, "num_comment": 16, "author": "liduzhizi", "tags": ["WEB安全", "系统安全"], "text": "武侠世界里，常常会提到“尸体会说话”，而在网络的攻防世界里，日志是最重要的追踪手段。"}
{"title": "广告联盟变身挂马联盟，HackingTeam漏洞袭击百万网民", "url": "https://www.freebuf.com/articles/86649.html", "time": "2015-11-24", "level": "", "num_look": 196288, "num_comment": 7, "author": "360安全", "tags": ["文章"], "text": "多家知名网站CVE-2015-5122Flash漏洞挂马，影响用户均超过百万，都是利用国内知名厂商平台进行传播，而幕后金主也包括国内多家大厂商。"}
{"title": "俄罗斯网络犯罪团伙3年内“赚取”7.9亿美元", "url": "https://www.freebuf.com/news/86677.html", "time": "2015-11-24", "level": "", "num_look": 180334, "num_comment": 5, "author": "cindy", "tags": ["资讯"], "text": "俄罗斯网络犯罪者在2012年至2015年间已经盗取了7.9亿美元。他们的目标范围及其广泛，全球的个人、企业、金融机构均是他们的攻击目标。"}
{"title": "浅析安全威胁情报共享框架OpenIOC", "url": "https://www.freebuf.com/sectool/86580.html", "time": "2015-11-24", "level": "现金奖励", "num_look": 947406, "num_comment": 7, "author": "windhawk", "tags": ["头条", "安全管理"], "text": "OpenIOC本身是开放、灵活的框架，因此你随时可以根据发现添加新的情报，完善你的IOC（Indicator of Compromise）。"}
{"title": "音乐众筹网站Patreon数据泄露后遭邮件勒索", "url": "https://www.freebuf.com/news/86546.html", "time": "2015-11-24", "level": "金币+4", "num_look": 277568, "num_comment": 3, "author": "亲爱的兔子", "tags": ["数据安全", "资讯"], "text": "众筹网站Patreon近日收到邮件称，如果用户想要要回自己的信息，需要向他们提供1比特币的赎金，并还在上面附上了提交比特币的网站。"}
{"title": "安全扫描神器Nmap 7新版发布", "url": "https://www.freebuf.com/news/86527.html", "time": "2015-11-23", "level": "金币+4", "num_look": 699585, "num_comment": 21, "author": "JackFree", "tags": ["工具", "资讯"], "text": "在长达3.5年之后，Fyodor终于发布了著名开源网络检索工具的最新版本Nmap7。"}
{"title": "iPhone和Android，哪个更安全？", "url": "https://www.freebuf.com/news/85824.html", "time": "2015-11-23", "level": "金币+4", "num_look": 449571, "num_comment": 20, "author": "vul_wish", "tags": ["观点", "资讯"], "text": "最近Checkmarx and AppSec Labs实验室的一份调查显示，Android的安全性比iPhone更高。"}
{"title": "Java反序列化漏洞批量检测（附POC）", "url": "https://www.freebuf.com/vuls/86566.html", "time": "2015-11-23", "level": "金币+4", "num_look": 1840115, "num_comment": 18, "author": "CUBESEC", "tags": ["漏洞"], "text": "Java反序列化漏洞可以利用Apache Commons Collections这个常用的Java库来实现任意代码执行。"}
{"title": "漏洞收购平台Zerodium公布各类软件和数字入侵方法的价格表", "url": "https://www.freebuf.com/news/86511.html", "time": "2015-11-23", "level": "", "num_look": 230069, "num_comment": 3, "author": "江湖小吓", "tags": ["其他", "资讯"], "text": "11月18日Zerodium（0day中间商）发布了各类从网络罪犯购买然后转售给需求者的目标软件和入侵方法的价格表。"}
{"title": "喜达屋旗下54家酒店遭POS恶意软件植入，房客银行数据遭泄露", "url": "https://www.freebuf.com/news/86572.html", "time": "2015-11-23", "level": "", "num_look": 192070, "num_comment": 2, "author": "寰者", "tags": ["系统安全", "资讯"], "text": "喜达屋集团是全球最大的饭店及娱乐休闲集团之一，目前被发现为信用卡信息窃取恶意软件（POS 恶意软件）所渗透。"}
{"title": "【FIT互联网安全创新大会前奏】2015年，网友眼中的流氓软件都有哪些？", "url": "https://www.freebuf.com/news/85911.html", "time": "2015-11-23", "level": "红色标题", "num_look": 408664, "num_comment": 32, "author": "路由器", "tags": ["头条", "活动"], "text": "FreeBuf 主办“2015互联网安全年度评选”WitAwards报名正在进行中，年度流氓软件等你来提名！"}
{"title": "勒索软件Chimera背后藏着什么秘密？", "url": "https://www.freebuf.com/articles/system/86330.html", "time": "2015-11-23", "level": "金币+4", "num_look": 241340, "num_comment": 1, "author": "JackFree", "tags": ["系统安全"], "text": "本文中，我们将一步一步深入分析Chimera勒索软件，共同分析它是如何一步步进行感染、勒索用户的。"}
{"title": "IBM加密工具平台Identity Mixer近日向开发者开放", "url": "https://www.freebuf.com/sectool/86507.html", "time": "2015-11-23", "level": "", "num_look": 329837, "num_comment": 2, "author": "寰者", "tags": ["工具", "网络安全"], "text": "IBM公司的加密工具平台：Identity Mixer，提供平台所需用户身份认证信息，且能确保用户个人数据安全的工具，目前已经对开发人员开放了。"}
{"title": "安卓耗电之谜：罪魁祸首竟是隐藏通信", "url": "https://www.freebuf.com/news/86463.html", "time": "2015-11-23", "level": "金币+5", "num_look": 168643, "num_comment": 3, "author": "FireFrank", "tags": ["资讯"], "text": "我们知道app是从云端传入传出数据的，但是研究者们最近发现其实大概一半的通信数据对用户都没有任何好处。"}
{"title": "KillerRat：埃及黑客开发针对Windows平台的新型RAT", "url": "https://www.freebuf.com/sectool/86094.html", "time": "2015-11-22", "level": "金币+5", "num_look": 407066, "num_comment": 21, "author": "寰者", "tags": ["工具", "系统安全"], "text": "埃及黑客基于njRAT工具包开发了新的间谍软件，被称为KillerRat，据称，该RAT能够规避几乎所有防病毒和防恶意软件的扫描和检测。"}
{"title": "Xindi僵尸网络可能会导致网络广告客户损失30亿美元", "url": "https://www.freebuf.com/news/86359.html", "time": "2015-11-22", "level": "", "num_look": 404187, "num_comment": 1, "author": "江湖小吓", "tags": ["文章", "资讯"], "text": "如果还没有找到办法来解决Xindi僵尸网络的扩散，那么一些在线广告客户（登广告的公司）可能会在2016年年底亏损数十亿。"}
{"title": "【永不消逝的电波（二）】HackRF入门：家用无线门铃信号重放", "url": "https://www.freebuf.com/news/topnews/83650.html", "time": "2015-11-22", "level": "红色标题", "num_look": 1144464, "num_comment": 25, "author": "吃葡萄不吐葡萄皮的雪碧", "tags": ["头条", "无线安全"], "text": "永不消逝的电波（一）让 我们了解了无线电的发展史以及无线电的一些物理知识，在第二篇里我们将用HackRF录制家用门铃的无线信号，然后重放门铃信号。"}
{"title": "VMware更新 | 修复Apache Flex BlazeDS中的漏洞", "url": "https://www.freebuf.com/news/86423.html", "time": "2015-11-22", "level": "金币+5", "num_look": 211017, "num_comment": 2, "author": "简单", "tags": ["漏洞", "系统安全"], "text": "VMware发布了数个产品的版本更新，目的是修复Apache Flex BlazeDS中的一个漏洞。"}
{"title": "巴黎恐怖袭击事件后美国科技巨头拒绝解除加密", "url": "https://www.freebuf.com/news/86444.html", "time": "2015-11-22", "level": "", "num_look": 147255, "num_comment": 3, "author": "亲爱的兔子", "tags": ["资讯"], "text": "此前美国信息技术工业协会(ITIC)称，不应该以国家安全的名义削弱加密强度，从而帮助政府监控电子设备。"}
{"title": "【FreeBuf视频】《安全大咖说》专访赛门铁克全球信任服务技术总监Hari Veladanda", "url": "https://www.freebuf.com/news/topnews/86412.html", "time": "2015-11-21", "level": "红色标题", "num_look": 395277, "num_comment": 3, "author": "FB视频", "tags": ["人物志", "头条"], "text": "Hari Veladanda，拥有19年软件行业工作经验，其中12年专注在安全领域。"}
{"title": "美国广告商新技术：可跨平台追踪用户", "url": "https://www.freebuf.com/news/86008.html", "time": "2015-11-21", "level": "", "num_look": 127540, "num_comment": 1, "author": "亲爱的兔子", "tags": ["资讯"], "text": "这些广告在隐蔽的情况下加载嵌入高频音频，能够迅速扫描确定包括手机、平板、网络电视、电脑、可穿戴设备，然后迅速写入浏览器的缓存中，并且间接监控追踪用户IP。"}
{"title": "巴黎恐怖袭击后英国政界部分政客呼吁新网络监控法", "url": "https://www.freebuf.com/news/85941.html", "time": "2015-11-21", "level": "", "num_look": 129983, "num_comment": 6, "author": "亲爱的兔子", "tags": ["资讯"], "text": "上周五巴黎恐怖袭击事件发生之后，英国部分政界人士正呼吁政府尽快出台监控法规。"}
{"title": "CTF竞赛“拉仇恨”过多，巴西军方惨遭黑客入侵", "url": "https://www.freebuf.com/news/85867.html", "time": "2015-11-20", "level": "", "num_look": 166296, "num_comment": 6, "author": "寰者", "tags": ["资讯"], "text": "本周早些时候，巴西军方的服务器被黑客入侵，导致了大约7000名军方官员的私人信息被窃取。"}
{"title": "卡巴斯基辣评2016安全趋势：APT攻击将死，“后门买卖”会更加活跃", "url": "https://www.freebuf.com/articles/network/86360.html", "time": "2015-11-20", "level": "金币+5", "num_look": 403078, "num_comment": 6, "author": "dawner", "tags": ["网络安全", "观点"], "text": "卡巴斯基公司预测，在2016年APT攻击会不复存在，以后只会产生更深度、更具破坏性的攻击，让网络犯罪更加难以追踪检测。"}
{"title": "自我复制、跨平台型安卓恶意软件出现（附源码）", "url": "https://www.freebuf.com/news/85292.html", "time": "2015-11-20", "level": "", "num_look": 233192, "num_comment": 7, "author": "亲爱的兔子", "tags": ["漏洞", "资讯"], "text": "荷兰代尔夫特理工大学（Technische Universiteit Delft）的安全研究人员们，已经创建出了一款可以跨网络自我复制的Android应用程序。"}
{"title": "微软CEO：我们将为Win 10建立专业安全团队", "url": "https://www.freebuf.com/news/86083.html", "time": "2015-11-20", "level": "金币+5", "num_look": 161191, "num_comment": 5, "author": "vul_wish", "tags": ["资讯"], "text": "微软一直强调注重隐私和云安全。对于Windows 10，微软承诺将建立网络安全团队，并对该领域进行投资支持。"}
{"title": "HackRF嗅探蓝牙重放iBeacons信号", "url": "https://www.freebuf.com/articles/wireless/86345.html", "time": "2015-11-20", "level": "", "num_look": 890813, "num_comment": 5, "author": "JackFree", "tags": ["无线安全", "网络安全"], "text": "使用HackRF嗅探蓝牙重放iBeacons的信号"}
{"title": "CSAW2015决赛：使用vDSO重写绕过SMEP", "url": "https://www.freebuf.com/articles/system/86243.html", "time": "2015-11-20", "level": "", "num_look": 314835, "num_comment": 6, "author": "鸢尾", "tags": ["系统安全"], "text": "今年的CSAW决赛中有几个不错的内核挑战，今天我们解决的是来自Michael Coppola的StringIPC。"}
{"title": "BBScan：信息泄漏批量扫描脚本", "url": "https://www.freebuf.com/sectool/85729.html", "time": "2015-11-20", "level": "金币+6", "num_look": 607651, "num_comment": 9, "author": "exploit.py", "tags": ["工具"], "text": "BBScan是一个迷你的信息泄漏批量扫描脚本。规则字典非常小，但尽量保证准确和可利用性。"}
{"title": "微软修复Bitlocker驱动器加密工具的绕过漏洞", "url": "https://www.freebuf.com/sectool/86132.html", "time": "2015-11-20", "level": "金币+6", "num_look": 271043, "num_comment": 3, "author": "江湖小吓", "tags": ["工具", "漏洞"], "text": "微软最近修复了Windows Bitlocker驱动器加密中的一个漏洞，这个漏洞可以被用来快速绕过加密功能获取到受害者加密的重要信息。"}
{"title": "英国一名15岁男孩被指攻击全球网络和散布暴恐信息", "url": "https://www.freebuf.com/news/86064.html", "time": "2015-11-20", "level": "金币+6", "num_look": 317497, "num_comment": 3, "author": "亲爱的兔子", "tags": ["网络安全", "资讯"], "text": "​一名英国青少年被指控一系列针对全球多家网站的网络攻击，并通过社交媒体散播美国境内各大航空公司存在炸弹威胁的虚假恐怖信息。"}
{"title": "Cybersecurity报告（二）：NSA调查称全球没有一款漏洞扫描工具真正有效", "url": "https://www.freebuf.com/news/85149.html", "time": "2015-11-19", "level": "", "num_look": 203286, "num_comment": 5, "author": "青藤云安全", "tags": ["资讯"], "text": "报告覆盖了本季度值得关注的网络安全业务包括市场规模、行业预测、支出、新兴业务及公司、投资、并购和IPO等事件。"}
{"title": "以安全产品经理的视角设计应用的登陆功能SDK（BRD篇）", "url": "https://www.freebuf.com/articles/neopoints/86049.html", "time": "2015-11-19", "level": "现金奖励", "num_look": 333101, "num_comment": 8, "author": "bt0sea", "tags": ["安全管理", "观点"], "text": "Business Requirements Document：用途用于产品在投入研发之前，由企业高层作为决策评估的重要依据，通过本文档需要说服企业领导认同其商业价值所在。"}
{"title": "美国会议员：关闭社交媒体网站以阻止ISIS恐怖袭击", "url": "https://www.freebuf.com/news/86065.html", "time": "2015-11-19", "level": "", "num_look": 127473, "num_comment": 9, "author": "简单", "tags": ["资讯"], "text": "美国国会议员Joe Barton制定了一个阻止恐怖主义的计划：关闭网站，包括社交媒体网站。"}
{"title": "【回播已更新】 FreeBuf公开课（直播课程）：Android组件与数据存储安全分析及实战", "url": "https://www.freebuf.com/articles/terminal/85706.html", "time": "2015-11-19", "level": "红色标题", "num_look": 309795, "num_comment": 5, "author": "banish", "tags": ["终端安全"], "text": "白细胞团队Andriod系列课程再次归来！"}
{"title": "【FIT互联网安全创新大会前奏】2015年，网络安全市场都发生了哪些投融资事件？", "url": "https://www.freebuf.com/news/86098.html", "time": "2015-11-19", "level": "", "num_look": 179266, "num_comment": 5, "author": "明明知道", "tags": ["头条", "资讯"], "text": "这里梳理了2015年你不可错过的安全市场行业风投以及并购信息。"}
{"title": "【更新360手机助手官方最新回应】360躺枪：又一虫洞漏洞“DimensionDoor”曝光", "url": "https://www.freebuf.com/vuls/86222.html", "time": "2015-11-19", "level": "红色标题", "num_look": 1071343, "num_comment": 10, "author": "E安全app", "tags": ["漏洞", "网络安全"], "text": "360手机助手应用当中存在着类似的问题，而这一几乎可能导致相同远程代码执行的漏洞被称为“DimensionDoor”。"}
{"title": "浅析Android开源渗透测试框架Drozer中的反射交互机制", "url": "https://www.freebuf.com/sectool/86180.html", "time": "2015-11-19", "level": "", "num_look": 627133, "num_comment": 12, "author": "安全豹", "tags": ["工具", "网络安全"], "text": "Drozer是MWR Labs开发的一款开源Android渗透测试框架。"}
{"title": "黑客制造：XXE漏洞自动挖掘工具", "url": "https://www.freebuf.com/articles/web/86007.html", "time": "2015-11-19", "level": "金币+6", "num_look": 536558, "num_comment": 4, "author": "florence", "tags": ["WEB安全"], "text": "最近我们在测定一个RESRful web service时开发了一个工具来从系统中自动挖掘XXE(XML External Entity)漏洞。"}
{"title": "匿名者发布三个黑客攻击操作指南“教你如何攻击ISIS”", "url": "https://www.freebuf.com/news/86175.html", "time": "2015-11-19", "level": "金币+6", "num_look": 1055726, "num_comment": 41, "author": "寰者", "tags": ["WEB安全", "周边"], "text": "为了鼓励人们参与到针对ISIS的网络战中来，国际黑客组织匿名者公布了三个黑客攻击操作指南。这三个指南主要针对的对象是隶属于ISIS的网站。"}
{"title": "深圳极限网络科技公司招聘安全人员", "url": "https://www.freebuf.com/jobs/85558.html", "time": "2015-11-19", "level": "", "num_look": 362866, "num_comment": 43, "author": "深圳极限网络", "tags": ["安全招聘"], "text": "深圳极限网络科技公司招聘安全工程师"}
{"title": "Redis事件综合分析", "url": "https://www.freebuf.com/articles/terminal/86130.html", "time": "2015-11-19", "level": "红色标题", "num_look": 563524, "num_comment": 7, "author": "百度安全", "tags": ["安全管理", "数据安全"], "text": "通过发现redis可以通过写入SSH Key进而控制服务器，安全人员开始大量关注这一事件。"}
{"title": "UC浏览器：ZipInputStream引发的思考", "url": "https://www.freebuf.com/articles/web/86086.html", "time": "2015-11-19", "level": "金币+6", "num_look": 361288, "num_comment": 5, "author": "鸢尾", "tags": ["WEB安全"], "text": "ZipInputStream对于zip文档不安全的处理方式会直接导致将设备最终控制权交给攻击者，攻击者能够遍历整个路径并写入任何数据。"}
{"title": "PNG图片处理库libpng曝出漏洞", "url": "https://www.freebuf.com/news/86074.html", "time": "2015-11-19", "level": "金币+4", "num_look": 253785, "num_comment": 1, "author": "亲爱的兔子", "tags": ["漏洞", "系统安全"], "text": "图片处理库libpng日前曝出漏洞，目前已初步修复漏洞。"}
{"title": "Vizio智能电视再躺枪：贩卖用户数据可被中间人截胡", "url": "https://www.freebuf.com/vuls/85217.html", "time": "2015-11-18", "level": "", "num_look": 279011, "num_comment": 5, "author": "dawner", "tags": ["数据安全", "漏洞"], "text": "这次我们要介绍的是针对Vizio智能电视的中间人攻击，它在与服务器验证HTTPS证书时是可以被绕过的。"}
{"title": "通过Word文档进行感染的新型PoS机恶意程序出现", "url": "https://www.freebuf.com/news/85703.html", "time": "2015-11-18", "level": "金币+4", "num_look": 414202, "num_comment": 2, "author": "亲爱的兔子", "tags": ["漏洞", "资讯"], "text": "“AbaddonPOS ”除了包含Vawtrack银行木马，还包含钓鱼攻击工具包、Bedep广告欺诈恶意软件、Pony infostealer和TinyLoader等恶意程序。"}
{"title": "暗网将成为ISIS的下一个避风港", "url": "https://www.freebuf.com/articles/86048.html", "time": "2015-11-18", "level": "", "num_look": 285693, "num_comment": 19, "author": "FireFrank", "tags": ["文章"], "text": "Al-Hayat是一个传播公布在不同在线平台有关ISIS信息的机构，Al-Hayat近期宣布ISIS意图将其所有行动移到暗网进行。"}
{"title": "Gmail安卓APP中的漏洞使得任何人都可以发送欺诈邮件", "url": "https://www.freebuf.com/news/85692.html", "time": "2015-11-18", "level": "", "num_look": 214539, "num_comment": 4, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "​安全研究人员Yan Zhu在谷歌邮箱安卓APP中发现了一个有趣的漏洞，可以让任何人发送一封看起来是其他人发送的邮件。"}
{"title": "三星Android 5设备滥用wifiCredService导致远程代码执行", "url": "https://www.freebuf.com/news/85958.html", "time": "2015-11-18", "level": "金币+4", "num_look": 251074, "num_comment": 11, "author": "鸢尾", "tags": ["终端安全", "资讯"], "text": "本文具体分析了最近在Google漏洞赏金计划中披露的三星Android5设备漏洞"}
{"title": "斯诺登应该为巴黎恐怖袭击背锅？通信加密造成的惨案？", "url": "https://www.freebuf.com/news/86032.html", "time": "2015-11-18", "level": "金币+4", "num_look": 409359, "num_comment": 22, "author": "dawner", "tags": ["网络安全", "资讯"], "text": "当今社会下，恐怖分子越来越多地使用高级先进的端对端加密技术，以至于执法者都没能及时赶上他们的脚步。"}
{"title": "Chrome浏览器0day使得数百万安卓设备遭受远程威胁", "url": "https://www.freebuf.com/news/85681.html", "time": "2015-11-18", "level": "金币+4", "num_look": 262993, "num_comment": 10, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "来自中国奇虎360的安全研究员Guang Gong在最新版本的安卓平台Chrome浏览器中发现一个严重的0day漏洞。"}
{"title": "FreeBuf全球安全事件纵览（2015年10月）：追着光影奔跑", "url": "https://www.freebuf.com/news/85800.html", "time": "2015-11-18", "level": "红色标题", "num_look": 345403, "num_comment": 6, "author": "简单", "tags": ["头条", "安全报告"], "text": "我的心曾悲伤七次——忘了是第几次，在黑与白之间，我选择了白。"}
{"title": "地下黑客市场出现FAKBEN勒索软件服务", "url": "https://www.freebuf.com/news/85622.html", "time": "2015-11-18", "level": "金币+4", "num_look": 158886, "num_comment": 2, "author": "JackFree", "tags": ["其他", "资讯"], "text": "通过使用这种CryptoLocker勒索软件服务，客户能够定制自己的CryptoLocker变种，并能够管理恶意活动。"}
{"title": "黑客溯源：“领跑吧”广告木马追踪", "url": "https://www.freebuf.com/articles/system/85559.html", "time": "2015-11-17", "level": "", "num_look": 406064, "num_comment": 14, "author": "安天追影", "tags": ["系统安全", "网络安全"], "text": "近期安天追影团队通过追影监控平台发现黑客以各种手段传播广告获利木马，受害主机感染木马后，会自动访问“领跑网吧广告传媒”的计费广告链接。"}
{"title": "匿名者向ISIS宣战：我们将追捕恶行到底", "url": "https://www.freebuf.com/news/85931.html", "time": "2015-11-17", "level": "金币+4", "num_look": 255379, "num_comment": 15, "author": "banish", "tags": ["观点", "资讯"], "text": "周日，匿名者组织在法国的YouTube上发表了一个宣战视频，表示“opParis”的伊始，发起了一场在网上封锁ISIS的每一个媒体宣传渠道和”猎杀“ISIS支持者的活动。"}
{"title": "FBI确认马萨诸塞州某军火库遭盗窃", "url": "https://www.freebuf.com/news/85856.html", "time": "2015-11-17", "level": "金币+4", "num_look": 133307, "num_comment": 7, "author": "dawner", "tags": ["资讯"], "text": "美国联邦调查局表示，目前已经确认来自马萨诸塞州的某军火库遭到入室盗窃。"}
{"title": "谷歌应用商店付费应用保护算法失效", "url": "https://www.freebuf.com/news/85913.html", "time": "2015-11-17", "level": "", "num_look": 173100, "num_comment": 7, "author": "Trustlook", "tags": ["资讯"], "text": "Trustlook手机安全研究团队发现谷歌应用商店付费应用保护算法存在漏洞。"}
{"title": "“蜥蜴之尾”：长老木马四代分析报告", "url": "https://www.freebuf.com/vuls/85904.html", "time": "2015-11-17", "level": "", "num_look": 282446, "num_comment": 18, "author": "360手机卫士", "tags": ["漏洞", "终端安全"], "text": "随着移动端安全软件对APK的查杀能力趋于成熟以及Google对Android安全性重视的提高，病毒与反病毒的主战场已逐渐从APP层扩展到Linux底层。"}
{"title": "揭秘：ISIS恐怖分子在巴黎如何使用PS4讨论并策划暴动", "url": "https://www.freebuf.com/news/85852.html", "time": "2015-11-17", "level": "金币+8", "num_look": 243624, "num_comment": 14, "author": "FireFrank", "tags": ["观点", "资讯"], "text": "法国当局在对恐怖袭击调查中，追查到了比利时首都布鲁塞尔附近几起对恐怖分子据点的搜查。证据中包括至少一台PS4游戏主机。比利时副首相Jan Jambon曾表示，ISIS人员使用游戏机来进行联络。"}
{"title": "Jenkins CommonCollections 漏洞完美利用工具", "url": "https://www.freebuf.com/sectool/85836.html", "time": "2015-11-17", "level": "金币+8", "num_look": 739800, "num_comment": 18, "author": "c0debreak", "tags": ["工具", "漏洞"], "text": "这周很火的一个漏洞，通过这个漏洞，可以执行任意java代码，影响 Jenkins、WebSphere、WebLogic 等一系列流行服务。"}
{"title": "Redis漏洞攻击植入木马逆向分析", "url": "https://www.freebuf.com/vuls/85833.html", "time": "2015-11-17", "level": "", "num_look": 343253, "num_comment": 7, "author": "阿里安全", "tags": ["漏洞"], "text": "2015年11月10日，阿里云安全团队捕获到黑客大规模利用Redis漏洞的行为，获取机器root权限，并植入木马进行控制，异地登录来自IP：104.219.xxx.xxx。"}
{"title": "路由器安全测试工具Router Scan v2.53发布（含下载）", "url": "https://www.freebuf.com/sectool/85718.html", "time": "2015-11-17", "level": "金币+8", "num_look": 634304, "num_comment": 28, "author": "w85040", "tags": ["工具"], "text": "Router Scan是一款路由器安全测试工具，可以指定IP段对路由器进行暴力破解等安全测试，支持各大品牌型号的路由器。"}
{"title": "FBI很气愤：黑了CIA的熊孩子又回来了", "url": "https://www.freebuf.com/news/84808.html", "time": "2015-11-17", "level": "金币+8", "num_look": 227474, "num_comment": 7, "author": "江湖小吓", "tags": ["系统安全", "资讯"], "text": "一群年仅十几岁自称“Crackas With Attitude”（CWA）的黑客组织成员频频入侵联邦系统骚扰美国政府。"}
{"title": "腾讯玄武实验室亮相东京：BadBarcode条码攻击，一张纸入侵企业号星舰", "url": "https://www.freebuf.com/news/85630.html", "time": "2015-11-17", "level": "金币+8", "num_look": 290361, "num_comment": 9, "author": "江湖小吓", "tags": ["其他", "资讯"], "text": "最近东京举办的2015年PacSec会议中，腾讯玄武实验室的研究员通过条形码扫描仪扫描中毒的条形码打开了机器上的shell。"}
{"title": "美国警用执法照相机发现预装病毒", "url": "https://www.freebuf.com/news/85724.html", "time": "2015-11-16", "level": "金币+8", "num_look": 205628, "num_comment": 12, "author": "亲爱的兔子", "tags": ["漏洞", "资讯"], "text": "美国iPower技术公司已经发现，通过马特尔电子销售公司的警用执法相机内出货就已经感染了Conficker蠕虫病毒 (Win32/Conficker.B!inf)。"}
{"title": "巴黎袭击前夜，匿名者组织反ISIS账号被封", "url": "https://www.freebuf.com/news/85803.html", "time": "2015-11-16", "level": "金币+8", "num_look": 299580, "num_comment": 26, "author": "banish", "tags": ["观点", "资讯"], "text": "据悉，就在巴黎袭击前几个小时，Facebook封锁了一组匿名者组织用来揭露 ISIS成员的Facebook账户。"}
{"title": "招商银行安全岗位招聘", "url": "https://www.freebuf.com/jobs/85768.html", "time": "2015-11-16", "level": "", "num_look": 263028, "num_comment": 12, "author": "xysky", "tags": ["安全招聘"], "text": "招商银行安全岗位招聘"}
{"title": "我是如何对dnsmasq使用afl-fuzz差点拯救互联网的？", "url": "https://www.freebuf.com/news/85762.html", "time": "2015-11-16", "level": "金币+8", "num_look": 529809, "num_comment": 9, "author": "xiaix", "tags": ["漏洞", "资讯"], "text": "现在，通过一些新方法使用fuzzing，我发现了一个几乎可以完全被利用的漏洞。"}
{"title": "微软Windows FastFAT.sys FAT分区拒绝服务漏洞重现", "url": "https://www.freebuf.com/articles/system/84761.html", "time": "2015-11-16", "level": "金币+8", "num_look": 201582, "num_comment": 5, "author": "鸢尾", "tags": ["系统安全"], "text": "还记得去年的MS14-063 FAT32驱动内核溢出漏洞么？今天出续集了，但是这一次是在FAT12分区。"}
{"title": "2016 FreeBuf互联网安全创新大会：Hack Demo环节征集【进行时】", "url": "https://www.freebuf.com/news/topnews/85274.html", "time": "2015-11-16", "level": "红色标题", "num_look": 484294, "num_comment": 9, "author": "FB独家", "tags": ["头条", "活动"], "text": "征集的Demo包括且不拘泥于安全工具/产品、攻防演示、技术试验或报告、漏洞报告或演示"}
{"title": "谷歌、推特、脸书针对巴黎恐怖袭击相继推出新服务", "url": "https://www.freebuf.com/news/85690.html", "time": "2015-11-16", "level": "金币+8", "num_look": 133192, "num_comment": 5, "author": "亲爱的兔子", "tags": ["资讯"], "text": "社交媒体脸书（Facebook）和推特（Twitter）均立即发布新的功能，让全世界的人们及时了解亲友的安危。"}
{"title": "首个Linux勒索软件马失前蹄：加密存在漏洞可被人攻破", "url": "https://www.freebuf.com/vuls/85647.html", "time": "2015-11-16", "level": "", "num_look": 312080, "num_comment": 5, "author": "dawner", "tags": ["漏洞", "系统安全"], "text": "在Windows里很早就有了赎金勒索软件，直到Linux中的Linux.Encoder.1，也就是第一个linux勒索软件的出现。"}
{"title": "payload实例分析：加密的恶意文档", "url": "https://www.freebuf.com/articles/terminal/85442.html", "time": "2015-11-16", "level": "金币+8", "num_look": 234981, "num_comment": 2, "author": "鸢尾", "tags": ["系统安全", "终端安全"], "text": "我们今天分析的这份恶意office文档其本身是一个下载器：2ELJ2E1OPJ0OT.doc"}
{"title": "OmniRAT变种木马被恶意利用", "url": "https://www.freebuf.com/news/85281.html", "time": "2015-11-16", "level": "", "num_look": 654257, "num_comment": 3, "author": "banish", "tags": ["终端安全", "资讯"], "text": "近期，Avast的工作人员针对OmniRAT（跨平台远程管理工具）出台了一份恶意利用分析文件。"}
{"title": "三星Galaxy手机通话可被黑客远程监听和记录", "url": "https://www.freebuf.com/news/85614.html", "time": "2015-11-16", "level": "金币+5", "num_look": 202159, "num_comment": 4, "author": "JackFree", "tags": ["资讯"], "text": "三星galaxy手机可被黑客远程拦截并监听语音通话，甚至可以录制所有的语音通话内容。"}
{"title": "入侵摩根大通黑客被捕", "url": "https://www.freebuf.com/news/85152.html", "time": "2015-11-15", "level": "金币+5", "num_look": 190813, "num_comment": 5, "author": "banish", "tags": ["资讯"], "text": "入侵美国最大银行摩根大通的黑客被抓，他们的入侵功绩真不小呢！"}
{"title": "FB独家：ISIS在网络战场是怎样一种存在？", "url": "https://www.freebuf.com/news/85645.html", "time": "2015-11-15", "level": "红色标题", "num_look": 769122, "num_comment": 18, "author": "FB独家", "tags": ["头条", "网络安全"], "text": "巴黎恐怖袭击已造成100多人死亡，ISIS究竟是什么组织？他们在网络战场的攻击从未停止，我们又当如何应对？"}
{"title": "物联网设备已沦陷，咖啡机也不能例外", "url": "https://www.freebuf.com/vuls/84938.html", "time": "2015-11-14", "level": "", "num_look": 331425, "num_comment": 9, "author": "简单", "tags": ["漏洞", "终端安全"], "text": "随着物联网设备的广泛使用，我们被黑客攻击的范围也在不断扩大，我们周边的智能设备是网络犯罪者们首要选择的攻击目标"}
{"title": "WAP：一款WEB安全检测工具", "url": "https://www.freebuf.com/sectool/85316.html", "time": "2015-11-14", "level": "金币+5", "num_look": 475429, "num_comment": 12, "author": "banish", "tags": ["工具", "漏洞"], "text": "Web Application Protection（WAP）是用于源代码静态分析和数据挖掘的一个工具,WAP主要检测使用PHP（4.0版本及以上）编写的web应用程序。"}
{"title": "Fareit木马分析与防护", "url": "https://www.freebuf.com/news/85568.html", "time": "2015-11-14", "level": "", "num_look": 405248, "num_comment": 1, "author": "绿盟科技", "tags": ["网络安全", "观点"], "text": "Fareit木马，主要是通过发送垃圾邮件，骗取用户点击运行exe文件来入侵目标主机，进而窃取FTP客户端保存的站点信息与用户密码。"}
{"title": "极客美女喊你起床，不起床“啪啪啪”（含教学视频）", "url": "https://www.freebuf.com/geek/85473.html", "time": "2015-11-14", "level": "金币+5", "num_look": 422762, "num_comment": 10, "author": "亲爱的兔子", "tags": ["极客"], "text": "近日国外一名以专业制造者和机械发烧友自称的美女带来了更新奇的设备：如果闹钟响了你还不起床的话，会被“啪啪啪”——扇脸。"}
{"title": "利用QQ邮箱漏洞进行钓鱼事件溯源", "url": "https://www.freebuf.com/news/85586.html", "time": "2015-11-13", "level": "红色标题", "num_look": 875408, "num_comment": 24, "author": "奇安信威胁情报中心", "tags": ["WEB安全", "漏洞"], "text": "天眼安全实验室对利用QQ邮箱漏洞进行钓鱼这一事件进行了深度跟踪与溯源。"}
{"title": "HTTPie：WEB开发调试工具", "url": "https://www.freebuf.com/sectool/85232.html", "time": "2015-11-13", "level": "", "num_look": 316333, "num_comment": 7, "author": "0xroot", "tags": ["工具"], "text": "HTTPie 是命令行形式的HTTP客户端。可通过简单的http命令，可配合语法发送任意HTTP请求数据，并在终端以代码高亮的形式输出。"}
{"title": "安全研究人员发现可以利用推特控制僵尸网络(附工具下载)", "url": "https://www.freebuf.com/news/85408.html", "time": "2015-11-13", "level": "金币+5", "num_look": 276702, "num_comment": 1, "author": "亲爱的兔子", "tags": ["WEB安全", "资讯"], "text": "英国安全研究人员Paul Amar打造出一款工具，能够利用推特私信（DMs）功能操控僵尸网络。"}
{"title": "CTF：HITB 2015 加密解密部分Write-up", "url": "https://www.freebuf.com/articles/web/84744.html", "time": "2015-11-13", "level": "金币+5", "num_look": 498325, "num_comment": 13, "author": "鸢尾", "tags": ["WEB安全", "系统安全"], "text": "加密类300分这道挑战题目是有关于RSA生成的质数p和q。我们现目前获得了一份RSA加密过的邮件mail.msg，以及隐藏有公钥的证书hitbctf.crt。"}
{"title": "杭州安恒信息技术有限公司招聘", "url": "https://www.freebuf.com/articles/85447.html", "time": "2015-11-13", "level": "", "num_look": 273465, "num_comment": 10, "author": "modkk", "tags": ["安全招聘", "文章"], "text": "杭州安恒信息技术有限公司招聘安全类人才"}
{"title": "可爱的“黑客”：为了乘客安全黑进机场网站", "url": "https://www.freebuf.com/news/85382.html", "time": "2015-11-13", "level": "", "num_look": 231631, "num_comment": 20, "author": "江湖小吓", "tags": ["资讯"], "text": ""}
{"title": "OWASP移动安全测试指南抢先看：证书锁定绕过", "url": "https://www.freebuf.com/articles/web/85320.html", "time": "2015-11-13", "level": "金币+5", "num_look": 349954, "num_comment": 5, "author": "鸢尾", "tags": ["WEB安全", "终端安全"], "text": "Certificate Pinning(证书锁定)是一项额外的安全层，对于应用程序而言它可以确保远程服务器提供的证书唯一性。"}
{"title": "事件还原：一封QQ恶意邮件，导致Apple ID密码丢失", "url": "https://www.freebuf.com/vuls/85053.html", "time": "2015-11-13", "level": "红色标题", "num_look": 821663, "num_comment": 22, "author": "银河实验室", "tags": ["漏洞"], "text": "一个朋友丢了一台iPhone 6 Plus，用iCloud开启了丢失模式。直到某一天收了一封QQ邮件，几分钟后APPLE ID被修改了，丢失的iPhone 6 Plus从iCloud中移除了。"}
{"title": "PhishReporter：一款内嵌到Outlook客户端的恶意邮件报告工具（附下载）", "url": "https://www.freebuf.com/sectool/84521.html", "time": "2015-11-13", "level": "金币+8", "num_look": 293584, "num_comment": 1, "author": "寰者", "tags": ["工具", "系统安全"], "text": "美国密苏里州大学的安全研究员近日开发了一个微软Outlook邮件客户端的内嵌钓鱼邮件报告工具PhishReporter，可以帮助用户将疑似诈骗邮件或者钓鱼邮件一键发送到预先设定的收件人邮箱。"}
{"title": "App Store出现下载多于50万次的恶意软件", "url": "https://www.freebuf.com/news/85213.html", "time": "2015-11-13", "level": "金币+8", "num_look": 138058, "num_comment": 3, "author": "亲爱的兔子", "tags": ["资讯"], "text": "InstaAgent 是一款连接到 Instagram 的应用程序，可以追踪账户的访问记录并涉嫌存储用户名和密码，并发送给可疑的远程服务器。"}
{"title": "现实版钢铁侠：生物黑客将 LED 灯移植到自己的身体中", "url": "https://www.freebuf.com/geek/85215.html", "time": "2015-11-12", "level": "金币+8", "num_look": 245937, "num_comment": 11, "author": "亲爱的兔子", "tags": ["极客"], "text": "最近的“生物黑客”圈子里出现了将 LED 灯通过手术移植到自己的身体中。"}
{"title": "利用Padding Oracle攻击获取加密密钥", "url": "https://www.freebuf.com/articles/web/84498.html", "time": "2015-11-12", "level": "金币+8", "num_look": 403779, "num_comment": 7, "author": "JackFree", "tags": ["WEB安全", "数据安全"], "text": "本文中我想分享一些利用padding oracle漏洞的实用技巧，这种类型的漏洞允许攻击者解密密文以及加密明文。"}
{"title": "安全融资新纪录：Nessus母公司Tenable获2.5亿美元B轮投资", "url": "https://www.freebuf.com/news/85216.html", "time": "2015-11-12", "level": "", "num_look": 194838, "num_comment": 4, "author": "青藤云安全", "tags": ["资讯"], "text": "网络安全公司Tenable Network Security近日宣布获得2.5亿美元B轮融资，创下业界融资最高纪录。"}
{"title": "Security Onion（安全洋葱）：专注入侵检测", "url": "https://www.freebuf.com/sectool/84043.html", "time": "2015-11-12", "level": "", "num_look": 845775, "num_comment": 10, "author": "0xroot", "tags": ["安全管理", "工具"], "text": "Security Onion基于Ubuntu，包含了入侵检测、网络安全监控、日志管理所需的Snort、Suricata、Bro、OSSEC、Sguil、Squert、ELSA、Xplico、NetworkMiner等。"}
{"title": "iBackDoor：疑似后门，影响iOS应用的高风险代码", "url": "https://www.freebuf.com/news/85143.html", "time": "2015-11-12", "level": "金币+8", "num_look": 285635, "num_comment": 1, "author": "洛竹渲", "tags": ["系统安全", "终端安全"], "text": "FireEye的移动安全研究人员发现了嵌入到iOS应用中的疑似“后门”行为的mobiSage广告库，并且这些应用都是由App Store发布的。"}
{"title": "谷歌宣布：Chrome浏览器结束对Windowsxp的支持", "url": "https://www.freebuf.com/news/85209.html", "time": "2015-11-12", "level": "金币+8", "num_look": 155157, "num_comment": 9, "author": "亲爱的兔子", "tags": ["资讯"], "text": "谷歌早前曾表示会在2015年结束后，会结束对Windows XP版Chrome浏览器的支持。"}
{"title": "分析单字节XOR的Word宏病毒文档", "url": "https://www.freebuf.com/articles/web/84918.html", "time": "2015-11-12", "level": "金币+8", "num_look": 242117, "num_comment": 4, "author": "鸢尾", "tags": ["WEB安全"], "text": "当反汇编恶意软件样本时，其实我们就是在分析寻找攻击者所疏忽的地方。"}
{"title": "ISIS黑客组织为了复仇入侵54000多个推特账户", "url": "https://www.freebuf.com/news/84956.html", "time": "2015-11-12", "level": "金币+8", "num_look": 167550, "num_comment": 8, "author": "亲爱的兔子", "tags": ["资讯"], "text": "宣称支持ISIS的黑客组织Cyber Caliphate近日非法入侵了54000个推特账户,并且泄露了美国中央情报局和联邦调查局官员们的在线数据。"}
{"title": "MOTS(Man-on-the-Side)：一种隐秘的攻击", "url": "https://www.freebuf.com/articles/web/85129.html", "time": "2015-11-12", "level": "金币+8", "num_look": 446439, "num_comment": 6, "author": "I12016", "tags": ["WEB安全", "网络安全"], "text": "​​斯诺登曝光了美国国家安全局的Man-on-the-Side攻击能力之后，我们看到已经有人发现既有的一些IDS特征也是能够检测这类攻击的。"}
{"title": "智慧之美：2015 WitAwards互联网安全年度评选【参选报名开启】", "url": "https://www.freebuf.com/news/84599.html", "time": "2015-11-12", "level": "红色标题", "num_look": 398937, "num_comment": 16, "author": "FB独家", "tags": ["头条", "活动"], "text": "60天，12个奖项，32位专家，10W+从业者，共同见证2015互联网安全年度盛誉。"}
{"title": "Vizio智能电视：玩弄用户数据的好手", "url": "https://www.freebuf.com/news/85050.html", "time": "2015-11-12", "level": "金币+8", "num_look": 253727, "num_comment": 2, "author": "dawner", "tags": ["数据安全", "资讯"], "text": "在我们的认知里，传统的电视机厂商总是不断吹嘘其智能电视的功能和特性。然而..."}
{"title": "五个关于工控系统安全的神观点", "url": "https://www.freebuf.com/news/84970.html", "time": "2015-11-12", "level": "", "num_look": 324817, "num_comment": 2, "author": "明明知道", "tags": ["其他", "工控安全"], "text": "这里我们列举了商业工控系统中常见的五个神观点，大致可以解释为什么传统空气隔绝和以网络安全为基础的方法不足以保护工业系统。"}
{"title": "Redis未授权访问配合SSH key文件利用分析：ZoomEye全球最新独家数据 V2", "url": "https://www.freebuf.com/vuls/85188.html", "time": "2015-11-11", "level": "红色标题", "num_look": 678242, "num_comment": 20, "author": "知道创宇", "tags": ["漏洞", "网络安全"], "text": "根据ZoomEye的探测，全球无验证可直接利用Redis国家与地区中，排名前三的分别是中国、美国和德国。"}
{"title": "利用双11购物节“乘火打劫”的木马分析", "url": "https://www.freebuf.com/articles/terminal/85169.html", "time": "2015-11-11", "level": "", "num_look": 218131, "num_comment": 5, "author": "腾讯电脑管家", "tags": ["终端安全"], "text": "近期腾讯反病毒实验室拦截到流氓软件“多彩便签”正在大量推广一个伪装成“阿里妈妈推广程序”的木马，该木马强对抗杀软，恶意锁主页，危害十分严重。"}
{"title": "JAVA之殇：一个影响广泛的Java工具集RCE漏洞", "url": "https://www.freebuf.com/articles/web/85164.html", "time": "2015-11-11", "level": "", "num_look": 592188, "num_comment": 8, "author": "0xroot", "tags": ["WEB安全", "系统安全"], "text": ""}
{"title": "Redis未授权访问导致可远程获得服务器权限", "url": "https://www.freebuf.com/vuls/85021.html", "time": "2015-11-11", "level": "", "num_look": 1234097, "num_comment": 10, "author": "CUBESEC", "tags": ["漏洞"], "text": "魔方安全团队监控到针对Redis未授权访问的一种新型攻击方式，在特定条件下，可远程导致服务器沦陷。"}
{"title": "短信木马2.0来袭：“网络木马”即将泛滥", "url": "https://www.freebuf.com/articles/terminal/85096.html", "time": "2015-11-11", "level": "", "num_look": 213349, "num_comment": 7, "author": "腾讯手机管家", "tags": ["终端安全"], "text": "支付类病毒日益变化，获取短信隐私的行为已经由短信转发变成了网络系统统一管理，比现在的更加智能化、系统化和可视化。"}
{"title": "Comcast公司20万用户数据在暗网被出售，到底谁该负责？", "url": "https://www.freebuf.com/news/85109.html", "time": "2015-11-11", "level": "金币+5", "num_look": 194350, "num_comment": 7, "author": "FireFrank", "tags": ["资讯"], "text": "Comcast公司是美国知名的跨国传媒公司。上周末，有人发现该公司的用户登录凭证在互联网黑市\"暗网\"上被出售。"}
{"title": "华为CPE设备存在远程任意文件读取漏洞（附EXP）", "url": "https://www.freebuf.com/vuls/84904.html", "time": "2015-11-11", "level": "", "num_look": 448196, "num_comment": 12, "author": "0xroot", "tags": ["无线安全", "漏洞"], "text": "华为CPE设备存在远程任意文件读取漏洞"}
{"title": "来自中国的秘密：预装木马的安卓平板正在销往全世界", "url": "https://www.freebuf.com/articles/terminal/85046.html", "time": "2015-11-11", "level": "金币+5", "num_look": 506389, "num_comment": 18, "author": "寰者", "tags": ["系统安全", "终端安全"], "text": "其中最让我们担心的是，这些预装了木马的平板电脑在许多电商平台都有出售，不乏零售巨头，像亚马逊。"}
{"title": "谷歌开源人工智能系统 TensorFlow", "url": "https://www.freebuf.com/news/84989.html", "time": "2015-11-11", "level": "金币+5", "num_look": 282134, "num_comment": 12, "author": "FireFrank", "tags": ["资讯"], "text": "谷歌于周一发布全新人工智能系统TensorFlow。该系统可被用于语音识别或照片识别等多项机器深度学习领域。"}
{"title": "美国联邦通信委员（FCC）不强制要求网站“请勿追踪”", "url": "https://www.freebuf.com/news/84455.html", "time": "2015-11-11", "level": "金币+5", "num_look": 117784, "num_comment": 1, "author": "亲爱的兔子", "tags": ["资讯"], "text": "目前美国联邦通信委员会（FCC）明确表示不强制要求网站接受“请勿追踪”（Do Not Track）请求。"}
{"title": "Hacking Team安卓浏览器攻击过程中的漏洞分析 Stage4", "url": "https://www.freebuf.com/vuls/84720.html", "time": "2015-11-11", "level": "现金奖励", "num_look": 271725, "num_comment": 3, "author": "MarcusAurelius", "tags": ["漏洞", "终端安全"], "text": "本文将分析Stage4所进行的操作，攻击者通过Stage3中所使用的方法，泄漏出libc中的函数指针，并加载一个传入的动态链接库。"}
{"title": "Jenkins弱口令扫描器", "url": "https://www.freebuf.com/sectool/84739.html", "time": "2015-11-11", "level": "金币+5", "num_look": 533344, "num_comment": 13, "author": "blackye", "tags": ["工具"], "text": "Jenkins弱口令扫描器"}
{"title": "业界良心：黑莓手机可以绕过运营商提供Android安全补丁", "url": "https://www.freebuf.com/news/84714.html", "time": "2015-11-11", "level": "金币+5", "num_look": 149779, "num_comment": 5, "author": "FireFrank", "tags": ["资讯"], "text": "各家Android手机制造商设法每月按时进行安全更新，但是安全更新通常需要获得运营商的批准，黑莓公司表示，黑莓甚至可以在手机锁定在特定网络的情况下，对其（Priv model）直接打补丁。"}
{"title": "观点：我们为什么需要威胁情报？", "url": "https://www.freebuf.com/articles/others-articles/84814.html", "time": "2015-11-10", "level": "金币+5", "num_look": 435268, "num_comment": 1, "author": "JackFree", "tags": ["其他", "观点"], "text": "本文中我们就来亲密接触一下威胁情报，并了解它所具有的功能，然后给出几个威胁情报的最佳实践示例，最后分析威胁情报有助于SIEM解决什么问题。"}
{"title": "Poweliks：不断进化的免文件型恶意软件", "url": "https://www.freebuf.com/articles/others-articles/84611.html", "time": "2015-11-10", "level": "", "num_look": 310111, "num_comment": 3, "author": "I12016", "tags": ["其他"], "text": "本文将向读者介绍Poweliks的一个新变种，它的特点是具备令人难以置信的低检出率。"}
{"title": "研究表明：安卓和iOS应用无节操滥用邮箱和定位数据", "url": "https://www.freebuf.com/news/84807.html", "time": "2015-11-10", "level": "金币+5", "num_look": 176209, "num_comment": 3, "author": "dawner", "tags": ["终端安全", "资讯"], "text": "某最新研究表明，73%的安卓应用会向第三方共享用户的邮箱地址，而47%的IOS用户会给第三方提供用户定位数据。"}
{"title": "“低成本”PoS攻击案例分析", "url": "https://www.freebuf.com/articles/terminal/84443.html", "time": "2015-11-10", "level": "金币+5", "num_look": 233723, "num_comment": 2, "author": "鸢尾", "tags": ["终端安全"], "text": "在我们的调查中，我们捕获了一个十分有趣的“低成本”PoS攻击案例。本文旨在揭开其神秘面纱。"}
{"title": "陆金所招聘安全工程师", "url": "https://www.freebuf.com/jobs/84903.html", "time": "2015-11-10", "level": "", "num_look": 255177, "num_comment": 19, "author": "路由器", "tags": ["安全招聘"], "text": "上海陆家嘴国际金融资产交易市场股份有限公司（陆金所）招聘安全类人才。"}
{"title": "无线网络渗透工具：Infernal-Twin", "url": "https://www.freebuf.com/news/84696.html", "time": "2015-11-10", "level": "", "num_look": 580006, "num_comment": 8, "author": "简单", "tags": ["工具", "无线安全"], "text": "Infernal-Twin 是一个自动化的渗透测试工具，开发目的是通过自动化的Evil Twin攻击来评估无线的安全性。"}
{"title": "不要指望STARTTLS自动加密你的电子邮件", "url": "https://www.freebuf.com/articles/database/83660.html", "time": "2015-11-10", "level": "金币+6", "num_look": 461079, "num_comment": 1, "author": "江湖小吓", "tags": ["数据安全", "网络安全"], "text": "虽然当下STARTTLS（纯文本通信协议扩展）和其他三个安全扩展已被应用，但他们依然没办法很好地保护邮件安全。"}
{"title": "华为Mate7存安全漏洞，多版本受影响", "url": "https://www.freebuf.com/vuls/84700.html", "time": "2015-11-10", "level": "金币+6", "num_look": 198832, "num_comment": 3, "author": "洛竹渲", "tags": ["漏洞"], "text": "华为Mate7的HIFI驱动程序中存在一个内存堆溢出安全漏洞。攻击者可能诱使用户安装恶意应用程序并用应用程序读取和修改内存数据。"}
{"title": "比特币偷窃者Dyreza的核心代码及技术分析", "url": "https://www.freebuf.com/articles/terminal/84607.html", "time": "2015-11-10", "level": "金币+6", "num_look": 349798, "num_comment": 2, "author": "寰者", "tags": ["系统安全", "终端安全"], "text": "在本文中，我们将对两个 payload 进行分析研究，这两个恶意程序之间是相互配合的，一个被称为 Upatre，一个被称为Dyreza。"}
{"title": "极客DIY：树莓派安装kali后的简单配置", "url": "https://www.freebuf.com/geek/84426.html", "time": "2015-11-10", "level": "金币+6", "num_look": 1935804, "num_comment": 10, "author": "s1riu5", "tags": ["极客"], "text": "这篇文章主要介绍树莓派版Kali在安装以后需要进行的一些配置..."}
{"title": "自己动手打造家庭安保系统", "url": "https://www.freebuf.com/geek/84648.html", "time": "2015-11-10", "level": "金币+6", "num_look": 338172, "num_comment": 5, "author": "xiaix", "tags": ["极客"], "text": "学习技能的一个好途径就是自己动手做一个家庭安保系统，特别是使用Arduino这种单片机来实现。"}
{"title": "Chimera勒索软件升级：不给钱就公布个人信息", "url": "https://www.freebuf.com/news/84609.html", "time": "2015-11-10", "level": "金币+6", "num_look": 157617, "num_comment": 1, "author": "亲爱的兔子", "tags": ["资讯"], "text": "Chimera勒索软件在对用户计算机中的目标文件进行加密过后，就会威胁用户如果不在限定期限内掏钱赎回这些文件的话，就将这些文件公布到网上。"}
{"title": "对抗PowerShell上的攻击策略", "url": "https://www.freebuf.com/articles/network/84473.html", "time": "2015-11-09", "level": "金币+6", "num_look": 397018, "num_comment": 3, "author": "江湖小吓", "tags": ["网络安全"], "text": "PowerShell是个很强大很强大的命令行，可以在Windows环境下做几乎所有的东西。有什么理由让我们不喜欢？"}
{"title": "像加载DLL一样加载EXE", "url": "https://www.freebuf.com/articles/system/84509.html", "time": "2015-11-09", "level": "", "num_look": 380059, "num_comment": 7, "author": "Sphinx", "tags": ["系统安全"], "text": "在这篇文章里我们来讨论如何像加载DLL一样加载EXE"}
{"title": "CWA黑客组织黑进了美国逮捕记录数据库", "url": "https://www.freebuf.com/news/84511.html", "time": "2015-11-09", "level": "金币+6", "num_look": 196575, "num_comment": 10, "author": "JackFree", "tags": ["资讯"], "text": "由一群青少年组成的黑客组织将其目标瞄向了包括FBI实时聊天系统、专用于美国联邦调查局（FBI）和执法机构的JABS系统。"}
{"title": "专访知名民间黑客Rices：没有思维的东西很安全, 有思维的人不可预知", "url": "https://www.freebuf.com/articles/neopoints/84216.html", "time": "2015-11-09", "level": "", "num_look": 589755, "num_comment": 33, "author": "T00ls安全", "tags": ["人物志", "观点"], "text": "Rices的故事很多人都知道：写过lpk、渗透过各大开源程序、挖过很多0day，作为知名的民间黑客，Rices的背后又有哪些鲜为人知的故事？"}
{"title": "Linux勒索软件恶意来袭", "url": "https://www.freebuf.com/news/84487.html", "time": "2015-11-09", "level": "金币+6", "num_look": 226468, "num_comment": 8, "author": "JackFree", "tags": ["系统安全", "资讯"], "text": "俄罗斯反病毒公司Doctor Web的研究人员发现一种新型勒索恶意软件，该勒索软件瞄准了Linux用户，目前该恶意软件已经感染了数十个用户。"}
{"title": "平安科技（深圳）信息安全与内控部安全实验室招聘", "url": "https://www.freebuf.com/jobs/84640.html", "time": "2015-11-09", "level": "", "num_look": 240953, "num_comment": 7, "author": "路由器", "tags": ["安全招聘"], "text": "平安科技（深圳）有限公司信息安全与内控部安全实验室招聘安全类人才"}
{"title": "修改Metasploit x64模版逃避杀软", "url": "https://www.freebuf.com/articles/web/84468.html", "time": "2015-11-09", "level": "金币+6", "num_look": 441496, "num_comment": 6, "author": "鸢尾", "tags": ["WEB安全", "网络安全"], "text": "在Windows桌面下执行渗透测试任务时，许多测试人员采用类似Veil的Powershell Empire工具将ShellCode注入到内存之中。"}
{"title": "点亮我的攻击地图：树莓派蜜罐节点部署实战", "url": "https://www.freebuf.com/articles/terminal/84405.html", "time": "2015-11-09", "level": "现金奖励", "num_look": 984392, "num_comment": 19, "author": "starshine", "tags": ["安全管理", "极客"], "text": "本文测试的内容是在已搭建好MHN中心服务器的前提下，尝试用树莓派搭建Dionaea 蜜罐 ，部署在局域网内。"}
{"title": "AndroidVTS：Android手机漏洞缺陷检测App", "url": "https://www.freebuf.com/sectool/84526.html", "time": "2015-11-09", "level": "金币+6", "num_look": 315028, "num_comment": 7, "author": "寰者", "tags": ["工具"], "text": "Android用户现在有了一个轻量的手机漏洞缺陷检查工具：Android VTS，来帮助用户检查他们的手机是否存在相应的漏洞。"}
{"title": "通信公司Cox因钓鱼骗局泄露客户数据，被罚近六十万美金", "url": "https://www.freebuf.com/news/84518.html", "time": "2015-11-09", "level": "金币+6", "num_look": 272149, "num_comment": 2, "author": "Sookiemo", "tags": ["数据安全", "资讯"], "text": "因为脆弱的信息安全防护而泄露了客户信息的代价是多少？对于Cox通信公司而言，答案是将近六十万美元的罚款。"}
{"title": "现实版黑客军团：ProtonMail遭遇DDOS攻击", "url": "https://www.freebuf.com/news/84416.html", "time": "2015-11-08", "level": "金币+6", "num_look": 381485, "num_comment": 9, "author": "亲爱的兔子", "tags": ["文章", "网络安全"], "text": "提供端对端加密电子邮件服务的ProtonMail过去几天遭到了DDoS攻击，服务下线，它的部分上游供应商的网络也因此下线。"}
{"title": "号称“最强钉子户”：新型自我Root安卓广告应用", "url": "https://www.freebuf.com/news/topnews/84205.html", "time": "2015-11-08", "level": "金币+6", "num_look": 227578, "num_comment": 2, "author": "dawner", "tags": ["头条", "系统安全"], "text": "研究人员发现了几种新的安卓广告软件，它们非常难卸载，而且存在将手机root的风险。此外，它们还会伪装成不同的应用，如推特、Facebook、甚至Okta等等。"}
{"title": "【FreeBuf视频】《安全大咖说》专访杭州安恒总裁范渊", "url": "https://www.freebuf.com/news/83894.html", "time": "2015-11-07", "level": "红色标题", "num_look": 479837, "num_comment": 13, "author": "FB视频", "tags": ["人物志", "头条"], "text": "《安全大咖说》专访杭州安恒CEO范渊"}
{"title": "vbulletin论坛0day技术分析", "url": "https://www.freebuf.com/vuls/84259.html", "time": "2015-11-07", "level": "金币+6", "num_look": 336906, "num_comment": 4, "author": "鸢尾", "tags": ["WEB安全", "漏洞"], "text": "vBulletin是一款商业论坛和博客平台，其是由PHP开发距今约有10年的历史了。这款论坛程序十分流行，在全球TOP 100K站点中约有78%的站点使用该平台。"}
{"title": "BT天堂网站挂马事件后续：“大灰狼”远控木马分析及幕后真凶调查", "url": "https://www.freebuf.com/articles/web/84374.html", "time": "2015-11-07", "level": "", "num_look": 1173638, "num_comment": 35, "author": "360安全", "tags": ["WEB安全"], "text": "9月初360安全团队披露bt天堂网站挂马事件，该网站被利用IE神洞CVE-2014-6332挂马，如果用户没有打补丁或开启安全软件防护，电脑会自动下载执行大灰狼远控木马程序。"}
{"title": "还在担心隐私泄露？试试新版火狐吧", "url": "https://www.freebuf.com/news/84143.html", "time": "2015-11-07", "level": "金币+6", "num_look": 295943, "num_comment": 15, "author": "亲爱的兔子", "tags": ["工具", "资讯"], "text": "Mozilla发布了Firefox 42正式版，但是不同以往的是，这次居然提供了64位版本的下载，而且是正式版。"}
{"title": "大波Mac OS X恶意软件来袭", "url": "https://www.freebuf.com/news/84198.html", "time": "2015-11-06", "level": "金币+6", "num_look": 196151, "num_comment": 13, "author": "dawner", "tags": ["终端安全", "资讯"], "text": "据Bit9+ Carbon Black研究小组发布的报告称，在2015年发现了948个OS X恶意软件实例。今年OS X的恶意软件样本数量是2010-2014年加起来的五倍还多。"}
{"title": "匿名者兑现承诺公布3K党成员名单", "url": "https://www.freebuf.com/news/84289.html", "time": "2015-11-06", "level": "金币+6", "num_look": 311035, "num_comment": 9, "author": "banish", "tags": ["数据安全", "资讯"], "text": "周四，匿名者组织在网上发布了他们称为Ku Klux Klan（三K党）的成员以及他们支持者的名单。"}
{"title": "伊朗黑客的复仇：瞄准美国白宫官员的电邮及社交账号", "url": "https://www.freebuf.com/news/84222.html", "time": "2015-11-06", "level": "金币+6", "num_look": 137753, "num_comment": 3, "author": "亲爱的兔子", "tags": ["资讯"], "text": "伊朗伊斯兰革命卫队近几周加强了对白宫官员的电邮和社交账号的网络攻击，这些攻击据信与一名拥有伊朗和美国双重国籍的商人在德黑兰被捕有关。"}
{"title": "四维创智（北京）科技安全岗位招聘", "url": "https://www.freebuf.com/jobs/84237.html", "time": "2015-11-06", "level": "", "num_look": 196520, "num_comment": 13, "author": "hkt", "tags": ["安全招聘"], "text": ""}
{"title": "Blackhat Europe 2015议题前瞻：当心你的手机", "url": "https://www.freebuf.com/news/84212.html", "time": "2015-11-06", "level": "", "num_look": 187914, "num_comment": 2, "author": "Rabbit_Run", "tags": ["头条", "资讯"], "text": "Blackhat Europe 2015将于11月10日在荷兰阿姆斯特丹召开。本次大会上智能手机再次成为大会主角，揣着手机的小伙伴们颤抖吧！"}
{"title": "苹果TV拒绝涉及含“苹果越狱”内容程序", "url": "https://www.freebuf.com/news/84209.html", "time": "2015-11-06", "level": "金币+6", "num_look": 179355, "num_comment": 1, "author": "banish", "tags": ["系统安全", "资讯"], "text": "周六，混沌电脑俱乐部（CCC）声称苹果公司拒绝了他们所提供的Apple TV应用程序，原因是此应用程序包含计算机安全会议内容。"}
{"title": "BetaBot木马分析报告", "url": "https://www.freebuf.com/vuls/84239.html", "time": "2015-11-06", "level": "", "num_look": 379703, "num_comment": 8, "author": "阿里安全", "tags": ["漏洞", "网络安全"], "text": "国外攻击者主要使用Zeus、CryptoWall、Bedep、各类常见RAT工具等作为恶意负载，但在最近我们监控恶意威胁的过程中，高级BetaBot木马。"}
{"title": "Mabouia：史上第一款Mac OS X勒索赎金软件（含视频）", "url": "https://www.freebuf.com/news/84226.html", "time": "2015-11-06", "level": "金币+6", "num_look": 290541, "num_comment": 5, "author": "dawner", "tags": ["数据安全", "系统安全"], "text": "一名巴西籍的网络安全研究员昨日公布了Mabouia ransomware的POC，这是史上第一款针对Mac OS X的ransomware。"}
{"title": "揭秘中国第三大黑色产业：网络诈骗地下产业链分析", "url": "https://www.freebuf.com/articles/network/84192.html", "time": "2015-11-06", "level": "", "num_look": 500790, "num_comment": 10, "author": "360安全", "tags": ["网络安全"], "text": "网络诈骗犯罪近年来呈现持续高发的状态，成为互联网上的公害之一。"}
{"title": "Windows网络保护之本地管理员帐户管理", "url": "https://www.freebuf.com/news/84048.html", "time": "2015-11-06", "level": "金币+8", "num_look": 176736, "num_comment": 1, "author": "江湖小吓", "tags": ["资讯"], "text": "众所周知，系统中都存在本地管理帐户，如本地管理员帐户，root账户或应用程序为了能在所有系统中共享数据而特定设置了一个通用的账户密码。"}
{"title": "从一个锁主页木马里挖出的惊天“暗杀黑名单”", "url": "https://www.freebuf.com/vuls/84153.html", "time": "2015-11-06", "level": "红色标题", "num_look": 507925, "num_comment": 27, "author": "腾讯电脑管家", "tags": ["漏洞"], "text": "近日腾讯反病毒实验室拦截到一个非常特殊木马，该木马集成了多种木马的特点和技术，通过多种流氓软件推广传播。"}
{"title": "黑市热卖杀器GovRAT：恶意软件数字签名平台", "url": "https://www.freebuf.com/news/84126.html", "time": "2015-11-06", "level": "金币+8", "num_look": 388255, "num_comment": 7, "author": "dawner", "tags": ["工具", "数据安全"], "text": "数字签名证书在黑市作为一个珍贵的商品，越来越多的人开始做这个有利可图的生意。"}
{"title": "知名论坛程序vBulletin 5曝远程命令执行漏洞，可能已泄露千万用户数据", "url": "https://www.freebuf.com/news/84024.html", "time": "2015-11-05", "level": "金币+8", "num_look": 238970, "num_comment": 9, "author": "banish", "tags": ["漏洞", "资讯"], "text": "周一， 有报道指出vBulletin开发者网站遭遇黑客攻击并且泄露了将近48万vBulletin用户的敏感信息。"}
{"title": "无锡公安抓获DDoS攻击黑客", "url": "https://www.freebuf.com/news/84132.html", "time": "2015-11-05", "level": "", "num_look": 519729, "num_comment": 41, "author": "阿里安全", "tags": ["资讯"], "text": "今年8月份，中新网发布了一则关于无锡公安人员抓获一名涉嫌DDoS攻击某公司网站的黑客的新闻。"}
{"title": "服务端模板注入攻击 （SSTI）之浅析", "url": "https://www.freebuf.com/vuls/83999.html", "time": "2015-11-05", "level": "", "num_look": 535634, "num_comment": 3, "author": "RickGray", "tags": ["漏洞", "系统安全"], "text": "本文将结合更为具体的示例对服务端模板注入的原理和扫描检测方法做一个浅析。"}
{"title": "亲历2015首届安全领袖峰会CSS：One World, One Dream", "url": "https://www.freebuf.com/news/84114.html", "time": "2015-11-05", "level": "红色标题", "num_look": 281837, "num_comment": 7, "author": "明明知道", "tags": ["活动", "观点"], "text": "FB小编带来的首届安全领袖峰会CSS的独家报道。"}
{"title": "美国真实上演黑客版《无间道》", "url": "https://www.freebuf.com/news/84086.html", "time": "2015-11-05", "level": "金币+8", "num_look": 199804, "num_comment": 8, "author": "亲爱的兔子", "tags": ["资讯"], "text": "一名27岁的男子因试图雇佣黑客抹除自己在法院的罚金，在网上发布广告后不料引来警探“卧底执法”。"}
{"title": "Fuzzing初学者指南：利用Address Sanitizer找到更多BUG", "url": "https://www.freebuf.com/news/83811.html", "time": "2015-11-05", "level": "金币+8", "num_look": 616004, "num_comment": 7, "author": "ch4nge", "tags": ["资讯"], "text": "内存访问错误是模糊测试通常能够发现的一类错误，其主要是由于程序对不该进行读写操作的内存进行了操作，从而导致了应用程序的崩溃。"}
{"title": "谷歌自查安卓系统漏洞 三星安全隐患颇多", "url": "https://www.freebuf.com/news/84031.html", "time": "2015-11-05", "level": "金币+8", "num_look": 123469, "num_comment": 1, "author": "亲爱的兔子", "tags": ["资讯"], "text": "近一周的时间里，谷歌的团队一直在尝试挑战“Android的安全界限”，它们想知道自己能否通过一定的手段，远程获取到用户的通讯录、照片和信息。"}
{"title": "Hacking Team安卓浏览器攻击过程中的漏洞分析 Stage3", "url": "https://www.freebuf.com/vuls/83950.html", "time": "2015-11-05", "level": "现金奖励", "num_look": 222754, "num_comment": 4, "author": "MarcusAurelius", "tags": ["漏洞", "终端安全"], "text": "本文将要分析的Stage3过程，通过修改TextNode节点对象中的函数指针信息，执行ROP操作，最终达到关闭dep的目的。"}
{"title": "未来：只懂计算机的黑客不是好黑客", "url": "https://www.freebuf.com/articles/83705.html", "time": "2015-11-05", "level": "金币+8", "num_look": 231348, "num_comment": 8, "author": "江湖小吓", "tags": ["文章"], "text": "黑客世界正在改变。相对于针对计算机编程的黑客行为，未来黑客将基于化学，生物学和物理学。"}
{"title": "英国政府立法禁止使用加密通信，苹果公司或放弃英国市场", "url": "https://www.freebuf.com/news/84016.html", "time": "2015-11-05", "level": "金币+8", "num_look": 170063, "num_comment": 10, "author": "FireFrank", "tags": ["资讯"], "text": "新的法律提案预计在周三亮相，此次提案强迫其为英国政府提供已加密的个人数据的解密方式，以保护公民免受恐怖分子和犯罪分子的威胁。"}
{"title": "【11.5更新最新版本已修复】百度真的修复了所有的WormHole漏洞么?", "url": "https://www.freebuf.com/vuls/84017.html", "time": "2015-11-04", "level": "红色标题", "num_look": 722714, "num_comment": 59, "author": "渔村安全实验室", "tags": ["漏洞", "终端安全"], "text": "最近百度WormHole漏洞门闹的沸沸扬扬,只要安装了百度相关的app,手机处于联网的状态,手机就有被控制的风险,现在百度真的修复了漏洞吗？"}
{"title": "XcodeGhost S：变种带来的又一波影响", "url": "https://www.freebuf.com/news/84064.html", "time": "2015-11-04", "level": "", "num_look": 253588, "num_comment": 14, "author": "洛竹渲", "tags": ["漏洞", "终端安全"], "text": "日前，FireEye安全研究员通过持续监控用户网络发现，XcodeGhost的影响并没有停止，而是通过修改后保持了影响的持久性，该变种被称为XcodeGhost S。"}
{"title": "【直播已结束】FreeBuf公开课：Android逆向分析基础篇之格式篇", "url": "https://www.freebuf.com/news/83964.html", "time": "2015-11-04", "level": "红色标题", "num_look": 353032, "num_comment": 10, "author": "FB视频", "tags": ["活动", "资讯"], "text": "本次课程将给大家详细介绍Android的Dalvik VM汇编语言、Dex和ODex文件格式以及Smali文件格式。"}
{"title": "他是全球首位在身体中植入比特币芯片的黑客", "url": "https://www.freebuf.com/news/83983.html", "time": "2015-11-04", "level": "金币+7", "num_look": 269899, "num_comment": 20, "author": "简单", "tags": ["资讯"], "text": "黑客的世界已经疯狂了，传统的黑客已经不能满足他们需求，开始转向生物入侵。"}
{"title": "极客DIY：使用树莓派和kali Linux打造便携式渗透套件", "url": "https://www.freebuf.com/sectool/83885.html", "time": "2015-11-04", "level": "", "num_look": 1548681, "num_comment": 26, "author": "0xroot", "tags": ["工具", "极客"], "text": "打造一份属于自己的便携式渗透套件，可以随时携带哦 :）"}
{"title": "职业勒索吸金软件：CryptoWall", "url": "https://www.freebuf.com/news/83765.html", "time": "2015-11-04", "level": "", "num_look": 266833, "num_comment": 13, "author": "简单", "tags": ["资讯"], "text": "crypt系列的勒索软件，是一种非常聪明的恶意软件，其中使用的木马可以枚举出受害者设备上的文件系统，以便发现并入侵所有可能的文档。"}
{"title": "渗透测试工具：The TrustedSec Attack Platform（TAP）", "url": "https://www.freebuf.com/sectool/83671.html", "time": "2015-11-04", "level": "金币+7", "num_look": 346266, "num_comment": 4, "author": "FireFrank", "tags": ["工具"], "text": "TAP是建立远程渗透测试的平台型软件。"}
{"title": "浅谈如何实现任意手机查询物理位置", "url": "https://www.freebuf.com/articles/83818.html", "time": "2015-11-04", "level": "现金奖励", "num_look": 1831868, "num_comment": 33, "author": "bt0sea", "tags": ["安全管理", "文章"], "text": "任意手机查询物理位置，这些功能如果是你开发需要使用什么技术手段实现？"}
{"title": "恶意代码清除实战", "url": "https://www.freebuf.com/articles/web/83860.html", "time": "2015-11-04", "level": "", "num_look": 350535, "num_comment": 20, "author": "绿盟科技", "tags": ["WEB安全"], "text": "​什么是恶意代码，指令集？是二进制可执行指令？还是脚本语言？字处理宏语言？其他指令集等等……"}
{"title": "英国电信公司沃达丰遭到网络攻击", "url": "https://www.freebuf.com/news/83772.html", "time": "2015-11-04", "level": "金币+7", "num_look": 143747, "num_comment": 3, "author": "亲爱的兔子", "tags": ["文章", "资讯"], "text": "英国有2000万客户的电信公司沃达丰(Vodafone)遭到黑客攻击。"}
{"title": "Anonymous宣称将公布3K党成员名单", "url": "https://www.freebuf.com/news/83932.html", "time": "2015-11-03", "level": "金币+7", "num_look": 396413, "num_comment": 26, "author": "dawner", "tags": ["资讯"], "text": "Anonymous组织相信大家都不陌生，他们的行事一向漠视规则。最近，该组织宣称他们会在11月5日前，披露3K党（KKK）的成员或者亲近3K党的派系成员等近千人的个人信息。"}
{"title": "漏洞盒子携手科技猫：当白帽子遇上萌妹子", "url": "https://www.freebuf.com/news/83731.html", "time": "2015-11-03", "level": "", "num_look": 246280, "num_comment": 22, "author": "漏洞盒子", "tags": ["活动", "资讯"], "text": "来自漏洞盒子的黑客们正在准备去攻破一个世界难题，而且，他将要面对的不是一个萌妹子，而是一群萌妹子。"}
{"title": "黑客攻破苹果iOS9获100万美元奖金", "url": "https://www.freebuf.com/articles/terminal/83882.html", "time": "2015-11-03", "level": "金币+7", "num_look": 240341, "num_comment": 13, "author": "亲爱的兔子", "tags": ["终端安全"], "text": "一个黑客团队通过针对iOS9系统的完美越狱，而获得了另外一家公司提供的100万美元奖金。"}
{"title": "自适应安全厂商illumio 1.4亿美元融资背后", "url": "https://www.freebuf.com/articles/neopoints/83675.html", "time": "2015-11-03", "level": "", "num_look": 300848, "num_comment": 2, "author": "青藤云安全", "tags": ["安全管理", "观点"], "text": "众多安全厂商推出了多种多样的产品和解决方案，其中初创明星公司illumio的自适应安全平台最受瞩目。"}
{"title": "2015第三季度云盾互联网应用威胁报告", "url": "https://www.freebuf.com/news/83812.html", "time": "2015-11-03", "level": "", "num_look": 201947, "num_comment": 5, "author": "阿里安全", "tags": ["头条", "安全报告"], "text": "云盾互联网应用威胁报告聚焦在互联网用户面临的Web应用层攻击、面向互联网系统的暴力破解以及恶意文件三个方面的威胁形势。"}
{"title": "Play框架的XML Entity Exploit", "url": "https://www.freebuf.com/vuls/83599.html", "time": "2015-11-03", "level": "", "num_look": 239868, "num_comment": 3, "author": "VillanCh", "tags": ["漏洞"], "text": "本渗透测试练习提供专门的练习平台，大家可以在pentesterLab中下载VM镜像，还可以读一下原文英文教程。"}
{"title": "百度系应用WormHole漏洞细节分析", "url": "https://www.freebuf.com/vuls/83789.html", "time": "2015-11-03", "level": "金币+7", "num_look": 890203, "num_comment": 29, "author": "gh0stbo", "tags": ["头条", "漏洞"], "text": "百度moplus SDK的一个被称为虫洞（Wormhole）的漏洞被报导后“一石激起千层浪”，它被植入到14000款app当中。"}
{"title": "Fuzzing初学者指南：教你如何使用zzuf", "url": "https://www.freebuf.com/news/83737.html", "time": "2015-11-03", "level": "金币+7", "num_look": 297353, "num_comment": 6, "author": "ch4nge", "tags": ["资讯"], "text": "模糊测试（Fuzzing），是一种通过向目标系统提供非预期的输入并监视异常结果来发现软件漏洞的方法，通常情况下我们会使用一个有效的输入和添加随机误差来完成。"}
{"title": "伪装成word的安卓恶意软件", "url": "https://www.freebuf.com/articles/83606.html", "time": "2015-11-03", "level": "", "num_look": 359715, "num_comment": 6, "author": "月尽西楼", "tags": ["文章", "网络安全"], "text": "Zscaler的安全研究员德赛称他们发现了数百个感染事件，尤其是针对中国用户的。恶意程序伪装成word文档。"}
{"title": "《刑法修正案（九）》：对网络黑产伸出重拳", "url": "https://www.freebuf.com/news/83615.html", "time": "2015-11-03", "level": "红色标题", "num_look": 444049, "num_comment": 22, "author": "明明知道", "tags": ["其他", "资讯"], "text": "此次修正案维护信息网络安全，进一步加强公民个人信息保护，增加了编造与传播虚假信息犯罪等成为刑九的一大亮点。"}
{"title": "CyberSecurity 2015 Q3报告（一）：市场形势一派大好", "url": "https://www.freebuf.com/news/83465.html", "time": "2015-11-02", "level": "", "num_look": 203402, "num_comment": 1, "author": "青藤云安全", "tags": ["企业安全", "头条"], "text": "本文为美国专注安全领域的投资咨询机构Cybersecurity Ventures发布2015年Q3季度报告。"}
{"title": "构建识别恶意软件Autopsy python yara扫描模块", "url": "https://www.freebuf.com/sectool/83531.html", "time": "2015-11-02", "level": "金币+8", "num_look": 271376, "num_comment": 2, "author": "鸢尾", "tags": ["工具"], "text": "YARA是一款用于识别恶意软件的优秀工具，你可以自己编写规则，也可以借助预制的规则yararules。"}
{"title": "抛砖引玉：GeekPwn2015胸卡ESP8266 12E串口调试", "url": "https://www.freebuf.com/news/82986.html", "time": "2015-11-02", "level": "", "num_look": 574676, "num_comment": 8, "author": "0xroot", "tags": ["资讯"], "text": "相信今年参加GeekPwn活动的很多同学都获得了一枚GeekPwn的胸牌，为方便大家对胸牌进行一些调试和破解，这里分享一些关于这枚胸牌的一些信息"}
{"title": "RFID安全十大问题与威胁", "url": "https://www.freebuf.com/vuls/83677.html", "time": "2015-11-02", "level": "金币+8", "num_look": 353027, "num_comment": 8, "author": "xiaix", "tags": ["漏洞", "终端安全"], "text": "和其它安全设备一样，RFID设备的安全性并不完美。尽管RFID设备得到了广泛的应用，但其带来的安全威胁需要我们在设备部署前解决。"}
{"title": "游族网络招聘高级信息安全工程师", "url": "https://www.freebuf.com/jobs/83711.html", "time": "2015-11-02", "level": "", "num_look": 185901, "num_comment": 14, "author": "路由器", "tags": ["安全招聘"], "text": "游族网络成立于2009年，是一家以网页游戏和手机游戏为核心，集研发、运营、发行为一体的综合性轻娱乐互动娱乐企业，"}
{"title": "FltSetSecurityObject函数引起的Win2003Sp2死锁分析", "url": "https://www.freebuf.com/vuls/83487.html", "time": "2015-11-02", "level": "", "num_look": 185680, "num_comment": 17, "author": "云锁", "tags": ["漏洞"], "text": "Minifilter是微软提供的开发Windows文件过滤驱动的一个框架，很多安全防护类软件都会用到。"}
{"title": "英国警方想方设法窥探民众的网络足迹", "url": "https://www.freebuf.com/news/83578.html", "time": "2015-11-02", "level": "金币+8", "num_look": 120787, "num_comment": 2, "author": "亲爱的兔子", "tags": ["资讯"], "text": "目前英国警方正在说服政府赋予他们浏览全国用户访问记录的权力，一旦获得这项权利，通讯公司将向警方提供过去一年的用户访问记录。"}
{"title": "【微博直播】首届CSS峰会：关注企业信息安全，百位CTO闭门探讨“2016第一步”", "url": "https://www.freebuf.com/news/82448.html", "time": "2015-11-02", "level": "红色标题", "num_look": 295333, "num_comment": 2, "author": "路由器", "tags": ["活动", "资讯"], "text": "首届中国互联网安全领袖峰会将于11月3日至4日在北京国家会议中心召开。"}
{"title": "ELF反调试初探", "url": "https://www.freebuf.com/sectool/83509.html", "time": "2015-11-02", "level": "", "num_look": 614713, "num_comment": 7, "author": "银河实验室", "tags": ["工具"], "text": "ELF是Unix及类Unix系统下可执行文件、共享库等二进制文件标准格式。为了提高动态分析的难度，我们往往需要对ELF文件增加反调试措施。"}
{"title": "行业报告：医疗数据泄露愈发严重，谁之过错？", "url": "https://www.freebuf.com/news/83545.html", "time": "2015-11-02", "level": "红色标题", "num_look": 337294, "num_comment": 3, "author": "cindy", "tags": ["头条", "资讯"], "text": "Trustwave发布了一份2015年医疗行业的安全报告，发现有91%的调查对象认为针对医疗行业的网络攻击活动越来越多。"}
{"title": "卡巴斯基发布两款勒索软件的解密工具，受害者可尝试进行解密", "url": "https://www.freebuf.com/news/83610.html", "time": "2015-11-02", "level": "金币+8", "num_look": 462403, "num_comment": 12, "author": "寰者", "tags": ["工具", "终端安全"], "text": "卡巴斯基实验室发布了勒索软件CoinVault及Bitcryptor的解密工具。"}
{"title": "Oracle中泄露“天机”的TNS", "url": "https://www.freebuf.com/sectool/83471.html", "time": "2015-11-01", "level": "", "num_look": 318051, "num_comment": 9, "author": "安华金和", "tags": ["工具", "数据安全"], "text": "没有ip和端口黑客对数据库的攻击将无从下手，也就无法对数据库发动真正有效的进攻。所以防止数据库ip 、端口和版本号的泄露是防止黑客入侵数据库的第一道防线。"}
{"title": "调查报告：苹果应用对windows用户的威胁最大", "url": "https://www.freebuf.com/news/83492.html", "time": "2015-11-01", "level": "金币+8", "num_look": 152143, "num_comment": 2, "author": "简单", "tags": ["安全报告", "资讯"], "text": "苹果的windows 应用超越甲骨文的Java，成为美国windows PC用户面临的最大安全风险。"}
{"title": "【FreeBuf视频】《安全大咖说》专访原翰海源创始人，现阿里巴巴资深安全专家方兴（flashsky）", "url": "https://www.freebuf.com/news/topnews/83364.html", "time": "2015-10-31", "level": "红色标题", "num_look": 633851, "num_comment": 11, "author": "FB视频", "tags": ["人物志", "头条"], "text": "方兴，原翰海源创始人，现任阿里巴巴资深安全专家，他被更多人所熟知的则是他的别号：flashsky（闪空）。"}
{"title": "如何下载所有已注册的域名列表", "url": "https://www.freebuf.com/articles/others-articles/83429.html", "time": "2015-10-31", "level": "金币+2", "num_look": 347535, "num_comment": 3, "author": "明明知道", "tags": ["其他"], "text": "在信息安全方面，对域名列表的利用可以有很多，例如蓄意拼写错误监测（防止“蓄意错误拼写的抢注”）、DGA监测、位翻转监测等。"}
{"title": "利用javascript压缩工具留下后门", "url": "https://www.freebuf.com/vuls/83422.html", "time": "2015-10-31", "level": "现金奖励", "num_look": 301248, "num_comment": 2, "author": "living", "tags": ["漏洞"], "text": "JS几乎处处可见其身影(从浏览器，到服务器，到arduino,到机器人，甚至某一天还可能在汽车上见到它的踪迹)。但是javascript是解释型语言，不是编译型语言。"}
{"title": "麻省理工大学新发明：暗黑WiFi透视技术", "url": "https://www.freebuf.com/news/83524.html", "time": "2015-10-31", "level": "金币+2", "num_look": 258283, "num_comment": 13, "author": "亲爱的兔子", "tags": ["极客", "资讯"], "text": "美国麻省理工学院（MIT）宣布，该大学的研究人员开发出了一种可以通过WiFi信号来检测人体移动情况的系统（Wi-Vi）。"}
{"title": "高科技犯罪：新西兰犯罪分子60秒偷走一辆车", "url": "https://www.freebuf.com/news/83409.html", "time": "2015-10-30", "level": "金币+2", "num_look": 228693, "num_comment": 18, "author": "亲爱的兔子", "tags": ["终端安全", "资讯"], "text": "一名男子在没有车钥匙的情况下，光天化日就把一辆价值16万5千美元的捷豹轿车偷走了，这个过程居然只花了60秒。"}
{"title": "利用Window.Opener绕过CSRF保护", "url": "https://www.freebuf.com/vuls/83398.html", "time": "2015-10-30", "level": "金币+2", "num_look": 345466, "num_comment": 7, "author": "xiaix", "tags": ["WEB安全", "漏洞"], "text": "随着Web应用的流行，安全问题日益受到瞩目。目前Web应用的安全性更多依靠Web开发人员来保障，而非依靠客户端验证机制。"}
{"title": "上海国凯英计算机有限公司招聘安全工程师、逆向工程师", "url": "https://www.freebuf.com/jobs/83044.html", "time": "2015-10-30", "level": "", "num_look": 194773, "num_comment": 8, "author": "国凯英", "tags": ["安全招聘"], "text": "上海国凯英计算机科技有限公司成立于2010年，位于上海张江高科技园区，是一家致力于网络信息安全领域的技术研究、产品开发、技术服务的公司。"}
{"title": "恶意色情软件攻击中国大陆、台湾、日本安卓用户", "url": "https://www.freebuf.com/news/83384.html", "time": "2015-10-30", "level": "金币+2", "num_look": 507715, "num_comment": 11, "author": "鸢尾", "tags": ["漏洞", "终端安全"], "text": "与色情有关的应用，总是伴随着木马、诈骗等负面信息，却也一直火爆不衰。"}
{"title": "【抽奖结果发布】FreeBuf公开课（直播）：AppScan使用教程与高手进阶（IBM官方授课）", "url": "https://www.freebuf.com/video/82109.html", "time": "2015-10-30", "level": "", "num_look": 624178, "num_comment": 22, "author": "FB视频", "tags": ["安全管理", "网络安全"], "text": "相信大家对AppScan已经有一定的了解了，但是其实它还有很多高级的功能和技巧可以帮您获得更好的测试效果。"}
{"title": "“破天”：Xen虚拟化平台虚拟机逃逸漏洞分析", "url": "https://www.freebuf.com/vuls/83403.html", "time": "2015-10-30", "level": "", "num_look": 408144, "num_comment": 13, "author": "阿里安全", "tags": ["无线安全", "漏洞"], "text": "Xen是领先的开源虚拟化平台，支撑着亚马逊云、阿里云等众多知名的公有云服务的基础建设，因此，保证虚拟化基础设施的安全性具有重要意义。"}
{"title": "LMD Tool：Linux 恶意软件检测工具", "url": "https://www.freebuf.com/sectool/83423.html", "time": "2015-10-30", "level": "金币+2", "num_look": 347296, "num_comment": 4, "author": "寰者", "tags": ["工具"], "text": "Linux恶意软件检测工具（LMD）是一个GNU GPLv2许可下发布的Linux恶意软件扫描器，其设计理念是是针对在共享主机环境中所面临的威胁。"}
{"title": "Windows用户帐户控制 (UAC) 的绕过与缓解方式", "url": "https://www.freebuf.com/articles/system/83369.html", "time": "2015-10-30", "level": "金币+2", "num_look": 493349, "num_comment": 6, "author": "西域使者", "tags": ["系统安全"], "text": "这篇博文讲述了如何轻松地绕过 UAC 提升提示并且可以采取哪些措施来减轻这种威胁。"}
{"title": "数据防泄漏DLP技术深度剖析", "url": "https://www.freebuf.com/news/83405.html", "time": "2015-10-30", "level": "", "num_look": 508623, "num_comment": 17, "author": "绿盟科技", "tags": ["安全管理", "系统安全"], "text": "通过智能化的数据安全管控，企业管理员可以按照数据的重要程度有针对性的对数据进行控制。"}
{"title": "全球最大的免费Web托管公司000Webhost被黑，1350万明文密码泄露", "url": "https://www.freebuf.com/news/83363.html", "time": "2015-10-30", "level": "", "num_look": 396951, "num_comment": 18, "author": "简单", "tags": ["资讯"], "text": "​全球最流行的免费Web 托管公司000Webhost遭遇了一次大规模的数据泄露事件，1350万用户的个人数据泄露。"}
{"title": "罪与罚：近几年最惹争议的黑客判决", "url": "https://www.freebuf.com/news/83199.html", "time": "2015-10-29", "level": "金币+2", "num_look": 359718, "num_comment": 17, "author": "明明知道", "tags": ["其他", "资讯"], "text": "Alphabet员工行为准则：应该做正确的事——遵守法律、行为端正并相互尊重。"}
{"title": "新军事战略：俄罗斯计划切断美军海底光纤", "url": "https://www.freebuf.com/news/83121.html", "time": "2015-10-29", "level": "金币+2", "num_look": 192656, "num_comment": 16, "author": "亲爱的兔子", "tags": ["资讯"], "text": "据报道称目前俄罗斯海军正在制定一项新的网络作战计划，该计划的内容是当战争来临时切断用于网络通信的海底电缆。"}
{"title": "CVE-2015-7857 Joomla注入漏洞利用工具", "url": "https://www.freebuf.com/sectool/82812.html", "time": "2015-10-29", "level": "金币+5", "num_look": 394006, "num_comment": 11, "author": "菊花", "tags": ["工具"], "text": "Joomla是一套获得过多个奖项的内容管理系统，它采用PHP＋MySQL数据库开发，可以运行在Linux、Windows、MacOSX、Solaris等多种平台上"}
{"title": "FireEye：应用程序兼容性缓存的调查", "url": "https://www.freebuf.com/articles/network/83311.html", "time": "2015-10-29", "level": "金币+5", "num_look": 335627, "num_comment": 3, "author": "江湖小吓", "tags": ["网络安全"], "text": "Windows应用程序兼容性缓存分析受到一限制：缓存中的数据是唯一在系统关机或重新启动的时候序列化到注册表。"}
{"title": "WhatsApp被曝内部收集用户数据", "url": "https://www.freebuf.com/news/83260.html", "time": "2015-10-29", "level": "金币+5", "num_look": 167620, "num_comment": 5, "author": "江湖小吓", "tags": ["资讯"], "text": "New Haven大学研究人员进行了一项新的研究，在研究过程中发现WhatsApp会收集通讯数据，包括号码，通话时间等信息。这意味着用户的数据被人“偷窥”了。"}
{"title": "面对勒索软件，FBI也认怂了", "url": "https://www.freebuf.com/news/83216.html", "time": "2015-10-29", "level": "", "num_look": 231323, "num_comment": 9, "author": "简单", "tags": ["资讯"], "text": "如果你的电脑被黑客入侵，感染了恶意程序，并且黑客挟持其中的数据要求你支付赎金，那就按条件支付他们吧，不要期望FBI会帮你救出数据。"}
{"title": "FreeBuf 追踪报道：虫洞（wormhole）漏洞来袭，多款百度热门安卓应用中枪", "url": "https://www.freebuf.com/news/83271.html", "time": "2015-10-28", "level": "红色标题", "num_look": 796040, "num_comment": 44, "author": "FB独家", "tags": ["头条", "终端安全"], "text": "日前，有安全研究员曝出百度旗下多款APP存在wormhole漏洞，安卓手机无论是否root，只要连接了网络便存在被远程操控的风险。"}
{"title": "CVE-2015-6971：对联想电脑系统更新组件的漏洞分析", "url": "https://www.freebuf.com/news/83210.html", "time": "2015-10-28", "level": "", "num_look": 153935, "num_comment": 5, "author": "鸢尾", "tags": ["资讯"], "text": "联想在今年春季修复了第一批漏洞，我决定深入了解这些补丁来验证这些存在的漏洞，结果我发现了一枚相关漏洞(CVE-2015-6971)。"}
{"title": "针对Mac的恶意软件数量正急剧上升", "url": "https://www.freebuf.com/news/83123.html", "time": "2015-10-28", "level": "金币+5", "num_look": 183044, "num_comment": 4, "author": "江湖小吓", "tags": ["终端安全", "资讯"], "text": "上周，Bit9 + Carbon Black发布了一份报告指出，2015年针对OS X的恶意软件是前五年的五倍。"}
{"title": "KVM基于内核的虚拟机概念理解与客户机浅析", "url": "https://www.freebuf.com/articles/82951.html", "time": "2015-10-28", "level": "现金奖励", "num_look": 279378, "num_comment": 2, "author": "VillanCh", "tags": ["工具", "文章"], "text": "严格来说KVM是属于云计算-虚拟化的范畴。今天我们着重来介绍KVM的比较深入的知识。"}
{"title": "新智能应用：视觉障碍患者的希望", "url": "https://www.freebuf.com/news/83130.html", "time": "2015-10-28", "level": "金币+5", "num_look": 162508, "num_comment": 5, "author": "dawner", "tags": ["极客", "资讯"], "text": "由于电脑在人类中的普及，大家可以借助机器人和人工智能，帮助世界的视觉障碍患者全球导航。"}
{"title": "有米SDK获取已安装应用列表技术分析", "url": "https://www.freebuf.com/articles/terminal/83100.html", "time": "2015-10-28", "level": "", "num_look": 245892, "num_comment": 12, "author": "墨贝科技", "tags": ["终端安全"], "text": "在iOS平台下，有米SDK会搜集已安装应用列表、当前应用等信息，并且，有米SDK使用私有API来实现此目的。"}
{"title": "15岁少年因涉嫌攻击英国电信运行商TalkTalk被拘留", "url": "https://www.freebuf.com/news/83055.html", "time": "2015-10-28", "level": "", "num_look": 238742, "num_comment": 4, "author": "明明知道", "tags": ["WEB安全", "资讯"], "text": "10月26日下午英国警方逮捕了一名15岁网络犯罪嫌疑人。该男孩因涉嫌参与TalkTalk网络攻击而被拘留，随后将接受警方审讯。"}
{"title": "美国部署最复杂的间谍程序：德国总理被窃听", "url": "https://www.freebuf.com/news/83089.html", "time": "2015-10-28", "level": "", "num_look": 181787, "num_comment": 2, "author": "简单", "tags": ["资讯"], "text": "德国总理安吉拉·默克尔曾被NSA间谍窃听，然而她并不是唯一一个被NSA间谍窃听的德国高官。"}
{"title": "业界：绿盟发布基于攻击链的威胁感知系统", "url": "https://www.freebuf.com/news/83102.html", "time": "2015-10-27", "level": "", "num_look": 612900, "num_comment": 10, "author": "绿盟科技", "tags": ["其他", "头条"], "text": "新常态下需要对网络威胁的行为通过大数据分析的方式，直观的给客户展示出整个动态攻击过程。"}
{"title": "Bashlite恶意软件阴魂未散：智能设备面临新考验", "url": "https://www.freebuf.com/articles/83045.html", "time": "2015-10-27", "level": "", "num_look": 296542, "num_comment": 2, "author": "360安全", "tags": ["安全管理", "文章"], "text": "近日，360QVM团队又捕获了Bashlite恶意程序的最新变种，并追踪到了相关多个平台的恶意程序。"}
{"title": "针对朝鲜网络攻击，韩国高调举办黑客大赛", "url": "https://www.freebuf.com/news/83007.html", "time": "2015-10-27", "level": "金币+5", "num_look": 341935, "num_comment": 18, "author": "亲爱的兔子", "tags": ["文章", "资讯"], "text": "韩国目前正在积极武装自己在网络领域的作战能力，用来抵御来自朝鲜的网络攻击威胁。"}
{"title": "​魔方安全科技诚招安全开发工程师", "url": "https://www.freebuf.com/jobs/83033.html", "time": "2015-10-27", "level": "", "num_look": 248199, "num_comment": 16, "author": "CUBESEC", "tags": ["安全招聘"], "text": "魔方安全科技，简称CUBESEC，由原NSTRT团队成员121创立，作为一支专业化的安全团队，我们一直致力于为企业提供专业的安全解决方案。"}
{"title": "观点：没有BAT3级的应急响应中心，互联网公司该如何应对数据泄露事件？", "url": "https://www.freebuf.com/articles/system/82988.html", "time": "2015-10-27", "level": "", "num_look": 567643, "num_comment": 5, "author": "青藤云安全", "tags": ["企业安全", "系统安全"], "text": "当黑客攻击事件是不可避免的，预防和响应是否得就反映了企业应对风险和危机的能力水准？"}
{"title": "Flatabulous：Ubuntu系统美化主题", "url": "https://www.freebuf.com/sectool/82993.html", "time": "2015-10-27", "level": "", "num_look": 657744, "num_comment": 17, "author": "0xroot", "tags": ["工具"], "text": "Flatabulous是针对Ubuntu和其他基于Linux、debian的Flat主题。"}
{"title": "钓鱼骗局：通过伪造App Store支付链接误导用户", "url": "https://www.freebuf.com/news/83016.html", "time": "2015-10-27", "level": "金币+5", "num_look": 355319, "num_comment": 2, "author": "寰者", "tags": ["WEB安全", "网络安全"], "text": "网络犯罪目前又将目标指向苹果用户，他们通过更加成熟的钓鱼手法，由此获取用户个人敏感数据。"}
{"title": "Hacking Team安卓浏览器攻击过程中的漏洞分析 Stage 2", "url": "https://www.freebuf.com/vuls/82977.html", "time": "2015-10-27", "level": "现金奖励", "num_look": 282621, "num_comment": 13, "author": "MarcusAurelius", "tags": ["漏洞", "终端安全"], "text": "此攻击流程共分5个阶段，本人之前的前两篇文章，已对Stage0，Stage1进行了分析，本文主要分析Stage2的工作。"}
{"title": "汽车入侵又出奇招：奥迪 TT 被攻破", "url": "https://www.freebuf.com/news/82960.html", "time": "2015-10-27", "level": "", "num_look": 165564, "num_comment": 5, "author": "简单", "tags": ["资讯"], "text": "汽车的自动化控制系统让我们有了更好的驾驶体验，然而同时也提高了被黑客入侵的风险。"}
{"title": "维基解密公布部分CIA局长布伦南邮箱泄露资料", "url": "https://www.freebuf.com/news/82885.html", "time": "2015-10-26", "level": "", "num_look": 396786, "num_comment": 4, "author": "亲爱的兔子", "tags": ["安全管理", "网络安全"], "text": "上周星期四，维基解密发布了第二批关于美国中央情报局局长布伦南的私人电子邮件，其中包括他的联系人名单的相关文件。"}
{"title": "新浪微博诚招各类安全人才", "url": "https://www.freebuf.com/jobs/82956.html", "time": "2015-10-26", "level": "", "num_look": 221078, "num_comment": 13, "author": "长得吸引仇恨", "tags": ["安全招聘"], "text": "2014年3月27日，新浪微博正式更名为“微博”，微博于2014年4月17日在美国纳斯达克正式挂牌上市。"}
{"title": "玩转metasploit系列（第八集）", "url": "https://www.freebuf.com/articles/82872.html", "time": "2015-10-26", "level": "金币+5", "num_look": 727276, "num_comment": 15, "author": "ArthurKiller", "tags": ["WEB安全", "文章"], "text": "今天要说的是用netripper对浏览进程进行监听从而绕过https加密."}
{"title": "11岁萌妹子创业：在线出售超强安全密码", "url": "https://www.freebuf.com/news/82912.html", "time": "2015-10-26", "level": "金币+5", "num_look": 564195, "num_comment": 30, "author": "亲爱的兔子", "tags": ["安全管理", "资讯"], "text": "目前数据泄露正在以前所未有的速度迅速进行，我们的在线密码常常遇到安全问题，影响肯定是惊人的。然而，这不禁引发了一个疑问，世界有强大的密码？"}
{"title": "利用PHP内核变量绕过disable_functions（附完整代码）", "url": "https://www.freebuf.com/articles/web/82801.html", "time": "2015-10-26", "level": "金币+5", "num_look": 560845, "num_comment": 3, "author": "I12016", "tags": ["WEB安全", "系统安全"], "text": "在https://rdot.org网站上面，一篇俄语文章专门介绍了如何使用fopen/fread/fwrite函数来操纵内存文件/proc/self/mem。"}
{"title": "Joomla 3.x Sql注入漏洞分析", "url": "https://www.freebuf.com/articles/82811.html", "time": "2015-10-26", "level": "", "num_look": 589712, "num_comment": 7, "author": "阿里安全", "tags": ["文章", "漏洞"], "text": "阿里安全带来的Joomla 3.x Sql注入漏洞分析。"}
{"title": "恶意程序Android.Fakelogin危及手机银行安全", "url": "https://www.freebuf.com/articles/terminal/82847.html", "time": "2015-10-26", "level": "金币+5", "num_look": 196348, "num_comment": 1, "author": "寰者", "tags": ["终端安全"], "text": "赛门铁克安全研究专家近期发现一种新的专门针对手机银行的木马，被称为Android.Fakelogin。"}
{"title": "这两天黑客都做了什么？老司机带你飞过GeekPwn", "url": "https://www.freebuf.com/news/82868.html", "time": "2015-10-25", "level": "红色标题", "num_look": 571408, "num_comment": 15, "author": "FB独家", "tags": ["头条", "活动"], "text": "2015年10月24日，由知名白帽黑客团队KEEN主办的GeekPwn2015嘉年华在申城上演，FreeBuf为你带来全程精彩盘点！"}
{"title": "案例学习：如何通过ICMP tunnel获取未过滤数据", "url": "https://www.freebuf.com/news/82564.html", "time": "2015-10-25", "level": "", "num_look": 394200, "num_comment": 4, "author": "鸢尾", "tags": ["网络安全", "资讯"], "text": "在本文中，Shyam将为我们讲述如何通过ICMP tunnel获取未过滤数据。"}
{"title": "恶意邮件里的doc文件解析", "url": "https://www.freebuf.com/articles/82814.html", "time": "2015-10-25", "level": "金币+8", "num_look": 391976, "num_comment": 2, "author": "江湖小吓", "tags": ["文章", "网络安全"], "text": "有些恶意软件经常通过垃圾邮件作为进入电脑的途径。通常他们会先部署简单的陷阱:将打包好的可执行文件发送到伪装的doc文件里。"}
{"title": "马航MH17事件调查组遭俄罗斯黑客组织攻击", "url": "https://www.freebuf.com/news/82830.html", "time": "2015-10-25", "level": "", "num_look": 372508, "num_comment": 1, "author": "亲爱的兔子", "tags": ["文章", "网络安全"], "text": "​有报道称最近俄罗斯黑客攻击了被击落的马航客机MH17背后的调查小组的办公系统。"}
{"title": "初学者福利：XVWA黑客靶场发布", "url": "https://www.freebuf.com/news/82125.html", "time": "2015-10-24", "level": "金币+8", "num_look": 658650, "num_comment": 14, "author": "鸢尾", "tags": ["工具", "漏洞"], "text": "Xtreme Vulnerable Web Application (XVWA)是一款使用PHP/MySQL编写的靶场，可以帮助初学者快速学习安全姿势。"}
{"title": "针对无人机的常见攻击方式", "url": "https://www.freebuf.com/articles/wireless/82837.html", "time": "2015-10-24", "level": "", "num_look": 735801, "num_comment": 17, "author": "360UnicornTeam", "tags": ["无线安全"], "text": "目前无人机市场越来越火，无人机的厂商也越来越多并因此产生了一个新的问题——无人机的安全问题。"}
{"title": "英国电信运营商TalkTalk数据泄露，影响4百万用户", "url": "https://www.freebuf.com/news/82832.html", "time": "2015-10-24", "level": "金币+8", "num_look": 218918, "num_comment": 3, "author": "寰者", "tags": ["资讯"], "text": "据称，因TalkTalk系统中部分用户数据并没有采取加密，所以存在泄露的风险。"}
{"title": "敲竹杠新玩法：随机化密码后邮件勒索", "url": "https://www.freebuf.com/articles/82793.html", "time": "2015-10-24", "level": "", "num_look": 535346, "num_comment": 14, "author": "360安全", "tags": ["安全管理", "文章"], "text": "近期360QVM团队截获到了一批伪装成游戏外挂、QQ刷钻、游戏刷装备等类型的敲诈软件。"}
{"title": "世界上第一款针对无人机的非致命性武器", "url": "https://www.freebuf.com/news/82623.html", "time": "2015-10-24", "level": "金币+8", "num_look": 198135, "num_comment": 7, "author": "亲爱的兔子", "tags": ["资讯"], "text": "美国Battelle公司已经开发了一种新型肩式步枪对付存在设计缺陷的无人机。"}
{"title": "MDM移动终端管理系统SAP Afaria的存储型XSS漏洞利用过程", "url": "https://www.freebuf.com/vuls/82730.html", "time": "2015-10-23", "level": "金币+8", "num_look": 186983, "num_comment": 1, "author": "寰者", "tags": ["漏洞", "系统安全"], "text": "在这里，将会演示对 SAP Afaria（一款全球知名的MDM手机终端管理软件）进行漏洞分析,同时分析网络攻击者如何利用漏洞进行攻击。"}
{"title": "CTF writeup：HITCON - PhishingMe", "url": "https://www.freebuf.com/articles/system/82717.html", "time": "2015-10-23", "level": "", "num_look": 263918, "num_comment": 6, "author": "鸢尾", "tags": ["系统安全"], "text": "PhishingMe有趣的介绍告知我们可以在.doc中定义一个VBScript宏钓鱼，Here we go！"}
{"title": "移动APP安全测试要点解析", "url": "https://www.freebuf.com/news/82777.html", "time": "2015-10-23", "level": "", "num_look": 350490, "num_comment": 12, "author": "绿盟科技", "tags": ["安全管理", "观点"], "text": "结合Android APP安全测试实例，讲解评估特点，并将评估检查点、评估细节和整改建议一一列出，给大家提供移动终端APP安全测试的思路。"}
{"title": "北京安赛招聘Web安全售前售后工程师", "url": "https://www.freebuf.com/jobs/70915.html", "time": "2015-10-23", "level": "", "num_look": 193230, "num_comment": 20, "author": "za@bslab.org", "tags": ["安全招聘"], "text": "北京安赛位于北京市海淀区，公司致力于为企业提供真实有效的安全解决方案。"}
{"title": "打造一个自动检测页面是否存在XSS的插件（完结篇）", "url": "https://www.freebuf.com/sectool/82743.html", "time": "2015-10-23", "level": "现金奖励", "num_look": 506783, "num_comment": 11, "author": "Black-Hole", "tags": ["WEB安全", "工具"], "text": "打造一个自动检测页面是否存在XSS的插件完结篇，增加了几个小功能。"}
{"title": "淘米客SDK被曝可劫持用户的所有短信", "url": "https://www.freebuf.com/news/82648.html", "time": "2015-10-23", "level": "", "num_look": 251352, "num_comment": 11, "author": "鸢尾", "tags": ["资讯"], "text": "安装使用了IAPs的应用十分危险，因为通常这些应用能够读取发送到用户手机上的所有短信。"}
{"title": "新痛点：APT组织PawnStorm 0Day如何绕过Java点击播放保护", "url": "https://www.freebuf.com/articles/web/82679.html", "time": "2015-10-23", "level": "红色标题", "num_look": 397849, "num_comment": 4, "author": "哆啦A梦", "tags": ["WEB安全"], "text": "Pawn Storm对于这一手段运用得炉火纯青，因为它在今年年初针对北约成员以及白宫进行的攻击中利用了这些漏洞的exp。"}
{"title": "极客Hacking：手把手教你Root谷歌OnHub路由器", "url": "https://www.freebuf.com/news/topnews/82147.html", "time": "2015-10-23", "level": "", "num_look": 449024, "num_comment": 10, "author": "0xroot", "tags": ["头条", "无线安全"], "text": "Google OnHub是谷歌于今年八月下旬发布的智能路由器。在这篇文章里我们来讨论一下怎么获得路由器的root权限。"}
{"title": "走近科学：伪基站诈骗分析", "url": "https://www.freebuf.com/news/topnews/82661.html", "time": "2015-10-23", "level": "现金奖励", "num_look": 477818, "num_comment": 19, "author": "Praise", "tags": ["头条", "系统安全"], "text": "前日，楼主路过某商场附近收到10086发来一条短信，关于“积分兑换现金”的消息处于职业警觉立即意思到是个骗局....."}
{"title": "苹果更新49个补丁，盘古越狱使用的漏洞被修复", "url": "https://www.freebuf.com/news/82642.html", "time": "2015-10-23", "level": "", "num_look": 153143, "num_comment": 5, "author": "简单", "tags": ["资讯"], "text": "本周二又迎来了另外一波补丁，修复了大量OS X、iOS、Safari、 iTunes、watchOS（智能手表操作系统）中的漏洞。"}
{"title": "Magento网站被攻击并传播恶意软件", "url": "https://www.freebuf.com/news/82422.html", "time": "2015-10-22", "level": "", "num_look": 338220, "num_comment": 3, "author": "Sphinx", "tags": ["网络安全", "资讯"], "text": "eBay投资的电子商务系统Magento是广受赞誉的全球最优秀的电子商务系统，然而就是这样一个使用者众多的平台却屡屡遭受黑客攻击。"}
{"title": "十秒内黑掉Fitbit智能手环（视频）", "url": "https://www.freebuf.com/news/82585.html", "time": "2015-10-22", "level": "", "num_look": 259279, "num_comment": 6, "author": "亲爱的兔子", "tags": ["终端安全", "视频"], "text": "新的研究表明，Fitbit手环抵御不了一个简单的恶意攻击。恶意程序可以在用户不知情的情况下发送到Fitbit设备上同时恶意程序可以感染同步数据采集的计算机上。"}
{"title": "针对芯片密码技术的新型诈骗手段出现", "url": "https://www.freebuf.com/articles/terminal/82606.html", "time": "2015-10-22", "level": "金币+7", "num_look": 193843, "num_comment": 2, "author": "江湖小吓", "tags": ["终端安全"], "text": "近日，Computerphile已经发布了关于这种诈骗战术的YouTube视频，其中诈骗者对EMV（芯片密码）卡的实施了操作。"}
{"title": "crossdomain.xml的邪恶用法实例", "url": "https://www.freebuf.com/articles/web/82551.html", "time": "2015-10-22", "level": "", "num_look": 573082, "num_comment": 6, "author": "鸢尾", "tags": ["WEB安全"], "text": "crossdomain.xml文件指定访问的域名读/写请求，应该将该文件限制在可信网站之内，然而在spreaker网站上却并非如此。"}
{"title": "维基解密发力，CIA局长邮件内容即将曝光", "url": "https://www.freebuf.com/news/82583.html", "time": "2015-10-22", "level": "金币+7", "num_look": 215506, "num_comment": 13, "author": "dawner", "tags": ["其他", "资讯"], "text": "维基解密，这个反保密和透明度的组织近日声称，他们已经获得中央情报局（CIA）局长布伦南的个人邮件内容。"}
{"title": "MWI-5：利用Office宏下载键盘记录器的攻击活动分析", "url": "https://www.freebuf.com/vuls/82511.html", "time": "2015-10-22", "level": "红色标题", "num_look": 572538, "num_comment": 4, "author": "空白", "tags": ["WEB安全", "漏洞"], "text": "在这里我们将详细说明一个木马部署的特殊方式，即利用一个商业键盘记录器应用程序在亚洲的大部分地区进行感染。"}
{"title": "美运营商4G网络存在漏洞，波及所有安卓用户", "url": "https://www.freebuf.com/vuls/82276.html", "time": "2015-10-22", "level": "金币+7", "num_look": 366357, "num_comment": 4, "author": "寰者", "tags": ["漏洞", "网络安全"], "text": "美国主要无线运营商Verizon Wireless和AT&T存在网络漏洞，会对接入网络中的所有安卓版本用户的安全性和个人隐私造成损害。"}
{"title": "隐秘攻击：恶意病毒可使智能手机加速老化", "url": "https://www.freebuf.com/news/82337.html", "time": "2015-10-22", "level": "", "num_look": 182615, "num_comment": 3, "author": "明明知道", "tags": ["终端安全", "资讯"], "text": "近日纽约大学研究人员发表了一篇论文阐明：恶意病毒是如何加速智能手机老化的？"}
{"title": "eFast：山寨谷歌浏览器恶意来袭", "url": "https://www.freebuf.com/articles/web/82414.html", "time": "2015-10-21", "level": "金币+7", "num_look": 281802, "num_comment": 8, "author": "寰者", "tags": ["WEB安全"], "text": "eFast恶意软件从表面上看起来很像谷歌浏览器，但它会执行删除Chrome浏览器的操作，然后自我安装替代Chrome浏览器。"}
{"title": "西部数据（WD）自加密硬盘被曝存在漏洞", "url": "https://www.freebuf.com/vuls/82420.html", "time": "2015-10-21", "level": "", "num_look": 326397, "num_comment": 8, "author": "dawner", "tags": ["漏洞", "终端安全"], "text": "研究人员称，有几个版本加密西部数据硬盘有着许多的漏洞，黑客一旦获取到了物理接触的机会，就能轻松获取里面的数据，在这期间可以无视硬盘的密码。"}
{"title": "Win10Pcap-Exploit：利用Win10Pcap内核驱动程序漏洞实现本地提权", "url": "https://www.freebuf.com/news/82310.html", "time": "2015-10-21", "level": "金币+7", "num_look": 376045, "num_comment": 6, "author": "鸢尾", "tags": ["漏洞", "资讯"], "text": "前几天我在win10pcap驱动中发现一枚可以进行本地提权的漏洞，当时就已经报告给官方，现在已可以通过更新得到修复。"}
{"title": "解密：地下黑市都在卖什么？", "url": "https://www.freebuf.com/news/82321.html", "time": "2015-10-21", "level": "金币+7", "num_look": 857705, "num_comment": 21, "author": "简单", "tags": ["头条", "安全报告"], "text": "地下黑市都在卖什么？PayPal账户？还是信用卡、借记卡数据？"}
{"title": "美国高中生黑掉了CIA局长私人邮箱", "url": "https://www.freebuf.com/news/82385.html", "time": "2015-10-21", "level": "金币+6", "num_look": 315887, "num_comment": 11, "author": "亲爱的兔子", "tags": ["文章", "资讯"], "text": "一个未成年黑客声称自己黑进了美国中央情报局（CIA）局长John Brennan（约翰·布伦南）的美国在线电子邮箱账号并且窃取了大量敏感资料。"}
{"title": "通过IOS/Android App获取APP后端数据", "url": "https://www.freebuf.com/articles/web/82315.html", "time": "2015-10-21", "level": "现金奖励", "num_look": 728573, "num_comment": 10, "author": "bt0sea", "tags": ["WEB安全"], "text": "移动应用产业以爆炸性的速度呈指数增长，但移动应用的安全问题落后于应用的发展速度。"}
{"title": "极客DIY：打造你的专属黑客U盘", "url": "https://www.freebuf.com/articles/terminal/82238.html", "time": "2015-10-21", "level": "金币+6", "num_look": 1296933, "num_comment": 19, "author": "哆啦A梦", "tags": ["极客", "终端安全"], "text": "由于“Bad USB漏洞”的存在，USB闪存驱动器也成了常见的攻击目标。"}
{"title": "黑科技再现：黑客通过智能水壶窃取Wifi密码", "url": "https://www.freebuf.com/news/82216.html", "time": "2015-10-21", "level": "金币+6", "num_look": 240993, "num_comment": 6, "author": "dawner", "tags": ["终端安全", "资讯"], "text": "安全研究者在伦敦某场节目里他演示了如何连上目标的智能水壶，然后窃取你的Wifi密码。"}
{"title": "【FreeBuf视频】《安全大咖说》专访微步在线（ThreatBook）CEO薛锋：威胁情报已有燎原之势", "url": "https://www.freebuf.com/news/topnews/82313.html", "time": "2015-10-20", "level": "红色标题", "num_look": 609772, "num_comment": 10, "author": "FB视频", "tags": ["人物志", "头条"], "text": "FreeBuf专访原亚马逊中国首席安全官，现ThreatBook CEO薛锋。"}
{"title": "专访老牌安全社区T00LS创始人xiaomi：技术是一把双刃剑，我更看重剑本身", "url": "https://www.freebuf.com/articles/neopoints/82164.html", "time": "2015-10-20", "level": "金币+6", "num_look": 648565, "num_comment": 24, "author": "T00ls安全", "tags": ["人物志", "观点"], "text": "本期采访的人物是xiaomi，好友们习惯称其为米总，土司安全社区创始人之一。"}
{"title": "REST API安全设计指南", "url": "https://www.freebuf.com/articles/web/82108.html", "time": "2015-10-20", "level": "", "num_look": 424029, "num_comment": 9, "author": "绿盟科技", "tags": ["WEB安全"], "text": "REST它利用传统Web特点，提出一个既适于客户端应用又适于服务端的应用的、统一架构，极大程度上统一及简化了网站架构设计。"}
{"title": "Facebook新功能：可知NSA的间谍行动", "url": "https://www.freebuf.com/news/82261.html", "time": "2015-10-20", "level": "", "num_look": 151594, "num_comment": 5, "author": "简单", "tags": ["资讯"], "text": "Facebook刚发布了一项新的通知功能：如果你的社交账号被政府黑客劫持或者攻击，那么Facebook则会给你一个警告通知。"}
{"title": "另类远控：木马借道商业级远控软件的隐藏运行实现", "url": "https://www.freebuf.com/articles/82240.html", "time": "2015-10-20", "level": "", "num_look": 693053, "num_comment": 3, "author": "360安全", "tags": ["数据安全", "文章"], "text": "与传统木马相比，商业级远控软件的监控能力毫不逊色，只不过这类软件有着合法身份，并且在安装和运行时都会有明显提示。"}
{"title": "Kali Shellter 5.1：动态ShellCode注入工具 绕过安全软件", "url": "https://www.freebuf.com/sectool/81955.html", "time": "2015-10-20", "level": "", "num_look": 597555, "num_comment": 26, "author": "0xroot", "tags": ["工具", "系统安全"], "text": ""}
{"title": "警方杀器X射线货车：你的一切无所遁形", "url": "https://www.freebuf.com/news/82181.html", "time": "2015-10-20", "level": "", "num_look": 151541, "num_comment": 5, "author": "dawner", "tags": ["资讯"], "text": "纽约警察局使用了超级X射线货车，这是当局曾死守的机密。这类车辆称为Z背散射厢式货车，警局可以通过它进行辐射扫描，从而看到其他汽车内、甚至房屋内的情形，以此作为反恐的手段。"}
{"title": "开源网络安全检测系统NST新版发布", "url": "https://www.freebuf.com/sectool/81852.html", "time": "2015-10-20", "level": "金币+6", "num_look": 478672, "num_comment": 13, "author": "亲爱的兔子", "tags": ["工具"], "text": ""}
{"title": "黑客的日常：Hacking网络摄像头（Part1）", "url": "https://www.freebuf.com/articles/wireless/81985.html", "time": "2015-10-20", "level": "金币+6", "num_look": 684257, "num_comment": 6, "author": "鸢尾", "tags": ["无线安全", "极客"], "text": "虽然说大部分折扣店的电子产品都是一堆应该丢尽垃圾桶的东西，但是偶尔一些产品还是存在Hacking价值的。"}
{"title": "ROOT工具为漏洞利用大开“方便之门”", "url": "https://www.freebuf.com/news/82048.html", "time": "2015-10-20", "level": "", "num_look": 276558, "num_comment": 8, "author": "小太阳花", "tags": ["漏洞", "终端安全"], "text": "通过推广强大的Root利用程序，为数不多的应用程序经销商正在将数以百万计的安卓用户置于十分危险的境地。"}
{"title": "微信电影票招聘资深安全工程师", "url": "https://www.freebuf.com/jobs/82120.html", "time": "2015-10-19", "level": "", "num_look": 208643, "num_comment": 10, "author": "Amiee", "tags": ["安全招聘"], "text": "北京微影时代科技有限公司是腾讯与贝森资本、中国文化产业投资基金联合投资的基于移动互联网的电影服务平台。"}
{"title": "B374K PHP WEBSHELL：一款简单却功能强大的远程管理工具", "url": "https://www.freebuf.com/sectool/82015.html", "time": "2015-10-19", "level": "", "num_look": 908974, "num_comment": 26, "author": "0xroot", "tags": ["工具"], "text": "B374K WebShell 是一个非常有用的远程管理工具，管理员通过浏览器就可以远程管理远程计算机。B374K非常简单，简单到只有一个php文件，但是功能却非常非常强大。"}
{"title": "科索夫黑客向ISIS递交美国军方人员的敏感信息，将被判35年", "url": "https://www.freebuf.com/news/82072.html", "time": "2015-10-19", "level": "", "num_look": 154982, "num_comment": 7, "author": "简单", "tags": ["资讯"], "text": "马来西亚当局在吉隆坡逮捕了一名科索夫公民，原因是他入侵了某公司电脑、并向ISIS（ISIL）提供美国军方人员的个人信息。"}
{"title": "木马盗用“风行播放器”签名流氓推广", "url": "https://www.freebuf.com/articles/terminal/82023.html", "time": "2015-10-19", "level": "", "num_look": 326797, "num_comment": 33, "author": "360安全", "tags": ["终端安全"], "text": "该程序静默安装，无法卸载，通过LSP注入系统各个联网进程执行，是一款植入用户计算机的后门程序。"}
{"title": "走近科学：揭开伪基站的神秘面纱", "url": "https://www.freebuf.com/news/81793.html", "time": "2015-10-19", "level": "金币+15", "num_look": 856842, "num_comment": 16, "author": "敏争", "tags": ["头条", "网络安全"], "text": "​“伪基站”目前已经成为广告、诈骗等垃圾短信的重要实施手段。"}
{"title": "32个国家被部署了政府监控软件FinFisher", "url": "https://www.freebuf.com/news/82013.html", "time": "2015-10-19", "level": "金币+15", "num_look": 170842, "num_comment": 3, "author": "dawner", "tags": ["资讯"], "text": "一项新调查显示：政府使用FinFisher软件的数量开始上升。在过去的几年里，该实验室的研究人员一直在监控集权政府对类似监控软件的使用。"}
{"title": "如何防止自家1024位Diffie-Hellman被破解", "url": "https://www.freebuf.com/news/81940.html", "time": "2015-10-19", "level": "金币+15", "num_look": 428718, "num_comment": 5, "author": "江湖小吓", "tags": ["网络安全", "资讯"], "text": "两位安全研究者提出NSA已经能够通过攻击1024位素数的Diffie-Hellman密钥交换算法解密大量HTTPS、SSH和VPN连接。"}
{"title": "FBI、EC3、众安全公司共同击败了Dridex僵尸网络", "url": "https://www.freebuf.com/news/81883.html", "time": "2015-10-19", "level": "", "num_look": 250583, "num_comment": 2, "author": "简单", "tags": ["系统安全", "资讯"], "text": "在美国执法部门、欧盟执法部门、安全公司的共同努力下，最终成功粉碎了Dridex的僵尸网络活动。"}
{"title": "WAF的XSS绕过姿势", "url": "https://www.freebuf.com/articles/web/81959.html", "time": "2015-10-18", "level": "金币+15", "num_look": 806365, "num_comment": 12, "author": "月尽西楼", "tags": ["WEB安全"], "text": "由于应用防火墙的广泛使用，实验测试WAF抵御xss攻击的能力变的很有必要。"}
{"title": "当Twitter成为一个功能齐全的后门C&C服务器", "url": "https://www.freebuf.com/news/81914.html", "time": "2015-10-18", "level": "红色标题", "num_look": 511744, "num_comment": 16, "author": "月球下雨了", "tags": ["WEB安全", "资讯"], "text": "这一项目显然是受到了Gcat后门使用Gmail账户作为C&C服务器的启发。"}
{"title": "Hacking Team漏洞大范围挂马，上百万电脑中招", "url": "https://www.freebuf.com/vuls/81963.html", "time": "2015-10-18", "level": "", "num_look": 346407, "num_comment": 21, "author": "腾讯电脑管家", "tags": ["WEB安全", "漏洞"], "text": "被称作“黑客核武库”的Hacking Team泄漏数据大大降低了黑客攻击的门槛，把整个黑色产业链的技术水平提高一个档次。"}
{"title": "浅谈八大顶尖网银恶意软件", "url": "https://www.freebuf.com/news/81950.html", "time": "2015-10-18", "level": "金币+15", "num_look": 184395, "num_comment": 3, "author": "dawner", "tags": ["系统安全", "观点"], "text": "Cyphort分析了黑客使用的八个破坏银行和电子支付的恶意软件，这些恶意金融软件侵害和威胁了数以百万计的用户。"}
{"title": "“无密码时代”的前奏：Yahoo Account Key", "url": "https://www.freebuf.com/news/81934.html", "time": "2015-10-17", "level": "金币+15", "num_look": 423806, "num_comment": 15, "author": "寰者", "tags": ["文章", "资讯"], "text": ""}
{"title": "APT组织PawnStorm利用最新Flash零日漏洞攻击各国外交部", "url": "https://www.freebuf.com/news/81869.html", "time": "2015-10-17", "level": "金币+15", "num_look": 346089, "num_comment": 1, "author": "晶颜123", "tags": ["WEB安全", "漏洞"], "text": "近日，趋势科技的研究人员发现了一个新型Flash漏洞被PawnStorm网络间谍行动利用对世界各地的外交部展开攻击。"}
{"title": "Android 5.0屏幕录制漏洞（CVE-2015-3878）威胁预警", "url": "https://www.freebuf.com/vuls/81905.html", "time": "2015-10-17", "level": "", "num_look": 800908, "num_comment": 18, "author": "360手机卫士", "tags": ["漏洞"], "text": "低技术门槛的漏洞利用或木马制作隐藏着极大的安全威胁，当这种安全威胁遇上手机用户的低安全意识时可能导致Android平台恶意软件的大规模爆发。"}
{"title": "比XcodeGhost更邪恶的手段30年前就出现了", "url": "https://www.freebuf.com/news/81860.html", "time": "2015-10-16", "level": "", "num_look": 218100, "num_comment": 5, "author": "空白", "tags": ["资讯"], "text": "最近在开发者圈里讨论最多的莫过于 XcodeGhost。其实在30年前，更高明的手段就出现了。"}
{"title": "word类型混淆漏洞（CVE-2015-1641）分析", "url": "https://www.freebuf.com/vuls/81868.html", "time": "2015-10-16", "level": "", "num_look": 631693, "num_comment": 14, "author": "阿里安全", "tags": ["漏洞"], "text": "今年4月份微软修补了一个名为CVE-2015-1641的word类型混淆漏洞，攻击者可以构造嵌入了docx的rtf文档进行攻击。"}
{"title": "FreeBuf全球安全事件纵览（2015年9月）：最可爱的黑客", "url": "https://www.freebuf.com/news/topnews/81390.html", "time": "2015-10-16", "level": "红色标题", "num_look": 322889, "num_comment": 5, "author": "简单", "tags": ["其他", "头条"], "text": "拿起一面镜子，细看镜中的每一条纹理，却发现越来越陌生；搜索记忆深处的暗格，才发现曾经青涩的面庞消失殆尽，双眸中多了几分坚毅。"}
{"title": "美玉在外，败絮其中：色播病毒的那些事儿", "url": "https://www.freebuf.com/news/81828.html", "time": "2015-10-16", "level": "", "num_look": 266728, "num_comment": 10, "author": "腾讯电脑管家", "tags": ["终端安全", "资讯"], "text": "长期以来，色播类App屡见不鲜，其背后是巨大的金钱利益，是病毒主要栖息之地。"}
{"title": "黑客可利用无线电波控制你的手机", "url": "https://www.freebuf.com/news/81806.html", "time": "2015-10-16", "level": "", "num_look": 247433, "num_comment": 10, "author": "简单", "tags": ["资讯"], "text": "​如果你的手机突然间自动拨打电话、发送短信、浏览网页，而且你完全不知情，这时你会是什么反应呢？"}
{"title": "云控广告“游戏盒子”死灰复燃", "url": "https://www.freebuf.com/articles/terminal/81819.html", "time": "2015-10-16", "level": "", "num_look": 260516, "num_comment": 10, "author": "360安全", "tags": ["终端安全"], "text": "360互联网安全中心拦截了大量可疑流氓推广样本，这些样本伪装成游戏盒子，安装后接收云端指令，会强制下载推广软件、弹窗、修改主页。"}
{"title": "剑桥大学研究发现87%的安卓设备不安全", "url": "https://www.freebuf.com/news/81805.html", "time": "2015-10-15", "level": "", "num_look": 231766, "num_comment": 11, "author": "明明知道", "tags": ["系统安全", "终端安全"], "text": "研究人员指出原始设备制造商（OEM）缺乏系统更新或为安卓的不安全主要原因；评分显示Nexus为最安全的手机，尽管只得到了10分中的5.5分。"}
{"title": "路由器驱动组件NetUSB（CVE-2015-3036 ）远程代码执行exp", "url": "https://www.freebuf.com/vuls/81773.html", "time": "2015-10-15", "level": "金币+7", "num_look": 279599, "num_comment": 12, "author": "菊花", "tags": ["漏洞"], "text": "KCodes NetUSB是Linux内核模块，可通过IP提供USB设备网络共享功能。由台湾企业盈码科（KCodes）开发。"}
{"title": "联合图像专家小组（JPEG）委员正在考虑数字版权保护", "url": "https://www.freebuf.com/news/81770.html", "time": "2015-10-15", "level": "", "num_look": 163203, "num_comment": 8, "author": "江湖小吓", "tags": ["其他", "资讯"], "text": "试一下你便会发现，Adobe PS软件或复印机的嵌入式软件禁止让你扫描或复印钞票。"}
{"title": "无须字母构建XSS向量", "url": "https://www.freebuf.com/articles/web/81688.html", "time": "2015-10-15", "level": "金币+7", "num_look": 363391, "num_comment": 23, "author": "鸢尾", "tags": ["WEB安全", "其他"], "text": "在此，我将分享一个以前没有接触过的一个XSS攻击向量"}
{"title": "非科幻：你的大脑代码会被黑", "url": "https://www.freebuf.com/news/81667.html", "time": "2015-10-15", "level": "", "num_look": 265151, "num_comment": 24, "author": "小太阳花", "tags": ["资讯"], "text": "安全研究者表示盗取、控制以及重播脑电图中的脑电波方法已经出现，这类检测工具存在严重的安全隐患，而医疗行业就妥善保护脑电波记录采取的预防措施甚少。"}
{"title": "动态二进制检测框架Pin简介及API Log Tool", "url": "https://www.freebuf.com/sectool/81666.html", "time": "2015-10-15", "level": "金币+7", "num_look": 529125, "num_comment": 31, "author": "比尔.盖茨", "tags": ["工具"], "text": "Pin 是一种动态二进制检测框架，适用于x86,x64架构，一般用于程序动态分析用，是多个平台都支持，windows ，linux,OSX。"}
{"title": "日本的网络犯罪日益飙升，是加盟还是威胁？", "url": "https://www.freebuf.com/news/81636.html", "time": "2015-10-14", "level": "", "num_look": 167319, "num_comment": 6, "author": "简单", "tags": ["资讯"], "text": "日本的网络犯罪在不断的增长，但使用的恶意程序都是通过地下论坛从其他国家买来的，想必未来他们会开发属于自己的恶意程序。"}
{"title": "iOS核心应用设计漏洞，暴露用户Apple ID凭证", "url": "https://www.freebuf.com/news/81621.html", "time": "2015-10-14", "level": "金币+7", "num_look": 217400, "num_comment": 6, "author": "江湖小吓", "tags": ["终端安全", "资讯"], "text": "Check Point提醒苹果iOS的核心应用程序可能会暴露用户的凭据。所幸的是iOS 9包含有相关的补丁。"}
{"title": "谷歌AdMob过滤器漏洞，恶意广告偷偷潜入应用", "url": "https://www.freebuf.com/news/81614.html", "time": "2015-10-14", "level": "", "num_look": 188193, "num_comment": 3, "author": "dawner", "tags": ["资讯"], "text": "有安卓应用开发人员抱怨道，因为官方广告网络监管不力，导致本应无公害的安卓应用染上了恶意广告。"}
{"title": "USB Killer 2.0：新版本摧毁计算机更轻松", "url": "https://www.freebuf.com/news/81589.html", "time": "2015-10-14", "level": "金币+7", "num_look": 1457186, "num_comment": 45, "author": "鸢尾", "tags": ["资讯"], "text": "俄罗斯安全研究员Hephaestos(id:h3phaestos)设计了一个奇特的U盘，当把U盘插入计算机时它可以破坏掉计算机敏感组件。"}
{"title": "Kemoge病毒来袭：哈勃深度分析", "url": "https://www.freebuf.com/articles/terminal/81563.html", "time": "2015-10-14", "level": "", "num_look": 239498, "num_comment": 7, "author": "腾讯电脑管家", "tags": ["终端安全"], "text": "最近，哈勃分析系统捕获了一类恶意病毒，该类病毒会主动获取Root权限、私自安装其他应用、卸载安全软件，给用户带来巨大风险。"}
{"title": "【FreeBuf视频】《安全大咖说》专访UCloud CEO 季昕华：打造一个开放的安全云", "url": "https://www.freebuf.com/news/topnews/81510.html", "time": "2015-10-14", "level": "红色标题", "num_look": 458288, "num_comment": 9, "author": "FB视频", "tags": ["人物志", "头条"], "text": "Ucloud CEO季昕华做客《安全大咖说》。"}
{"title": "初学者也能学会的云桌面虚拟化", "url": "https://www.freebuf.com/sectool/81465.html", "time": "2015-10-13", "level": "现金奖励", "num_look": 920832, "num_comment": 35, "author": "VillanCh", "tags": ["工具", "极客"], "text": "桌面虚拟化技术并不是那么遥不可及，我们来讲讲开源的虚拟化技术KVM-QEMU-SPICE来搭建一个虚拟机服务器然后来进行访问。"}
{"title": "阿里云栖大会14日启动：FreeBuf独家首发《2015第三季度云盾互联网DDoS状态和趋势报告》", "url": "https://www.freebuf.com/news/81492.html", "time": "2015-10-13", "level": "红色标题", "num_look": 305985, "num_comment": 6, "author": "FB独家", "tags": ["活动", "资讯"], "text": "自2015年后，在某些新型行业和竞争非常激烈的行业中，DDoS攻击已经成为同行之间竞争、恶意组织敲诈勒索的一个常用手段。"}
{"title": "渗透测试系统BackBox Linux 4.4 发布", "url": "https://www.freebuf.com/sectool/81436.html", "time": "2015-10-13", "level": "", "num_look": 382787, "num_comment": 12, "author": "帅气凌云", "tags": ["工具"], "text": "Backbox Linux又更新啦，这次新版本为4.4 。"}
{"title": "如何突破限制，在PC上调试微信手机页面", "url": "https://www.freebuf.com/geek/81420.html", "time": "2015-10-13", "level": "金币+12", "num_look": 1511211, "num_comment": 25, "author": "chitanda", "tags": ["极客"], "text": "而众所周知手机上非常不利于调试页面，所以需要能在电脑上打开并进行调试。"}
{"title": "美媒质疑华为代工的谷歌Nexus 6P安全性", "url": "https://www.freebuf.com/news/81395.html", "time": "2015-10-13", "level": "", "num_look": 351644, "num_comment": 27, "author": "空白", "tags": ["终端安全", "资讯"], "text": "与华为合作，谷歌意在重返中国市场。可情况真的是美媒担心的那样：谷歌为了讨好中国拿美国用户的信息安全做交易？"}
{"title": "RFID Hacking：看我如何突破门禁潜入FreeBuf大本营", "url": "https://www.freebuf.com/news/topnews/80786.html", "time": "2015-10-13", "level": "金币+12", "num_look": 1565250, "num_comment": 39, "author": "吃葡萄不吐葡萄皮的雪碧", "tags": ["头条", "极客"], "text": "某天，偶然间拿到了FreeBuf保安队队长的工卡信息，终于有机会去做一些羞羞的事情了…"}
{"title": "道琼斯公司被黑，泄露大量用户信息", "url": "https://www.freebuf.com/news/81385.html", "time": "2015-10-13", "level": "", "num_look": 215907, "num_comment": 3, "author": "简单", "tags": ["系统安全", "资讯"], "text": "上周末，道琼斯公司（Dow Jones）CEO承认了公司数据泄露事件，有3500位用户的数据（支付卡信息、通讯信息等）被黑客未授权访问。"}
{"title": "XML-RPC放大攻击：针对WordPress的“暴力美学”", "url": "https://www.freebuf.com/vuls/81331.html", "time": "2015-10-12", "level": "金币+12", "num_look": 392393, "num_comment": 4, "author": "dawner", "tags": ["WEB安全", "漏洞"], "text": "暴力猜解攻击是我们至今为止，在互联网上看到的最古老而常见的攻击之一。黑客可以通过SSH和FTP协议，暴力猜解攻击你的WEB服务器。"}
{"title": "国产安全扫描器北极熊V3.3新版发布", "url": "https://www.freebuf.com/sectool/81334.html", "time": "2015-10-12", "level": "", "num_look": 443869, "num_comment": 39, "author": "w85040", "tags": ["工具"], "text": "继官司风暴后，北极熊从2.6停止更新，时隔一年，再次更新。"}
{"title": "FreeBuf专访：遇见破解吉普车的天才黑客Miller", "url": "https://www.freebuf.com/news/topnews/81187.html", "time": "2015-10-12", "level": "", "num_look": 289628, "num_comment": 7, "author": "FB独家", "tags": ["头条"], "text": "传奇黑客Charlie Miller近日接受了FreeBuf专访。"}
{"title": "解析P2P金融的业务安全", "url": "https://www.freebuf.com/news/topnews/81062.html", "time": "2015-10-12", "level": "现金奖励", "num_look": 533672, "num_comment": 13, "author": "mcvoodoo", "tags": ["其他", "头条"], "text": "今天我要谈的是甲方眼里的业务安全问题，甲方和乙方在业务安全的视野上会有一些区别和一些重合。"}
{"title": "黑幕解密：中国黑客借非法应用产业链，每天攫取数百万美金", "url": "https://www.freebuf.com/articles/81308.html", "time": "2015-10-12", "level": "红色标题", "num_look": 610466, "num_comment": 13, "author": "哆啦A梦", "tags": ["文章", "无线安全"], "text": "Ghost Push病毒家族已经影响了全球超过116个国家的90万多安卓用户，据推测，开发者每天可从这个非法产业链中获取至少405万美元的暴利。"}
{"title": "利用PowerShell绕过UAC", "url": "https://www.freebuf.com/articles/system/81286.html", "time": "2015-10-12", "level": "金币+12", "num_look": 490306, "num_comment": 4, "author": "JackFree", "tags": ["系统安全"], "text": "在本文中，我们将尝试各种方法和代码来绕过UAC。"}
{"title": "外媒：中国第一次在美国政府的要求下拘捕黑客", "url": "https://www.freebuf.com/news/81276.html", "time": "2015-10-12", "level": "金币+12", "num_look": 461557, "num_comment": 26, "author": "xiaoqin00", "tags": ["资讯"], "text": "中国政府为了缓解与华盛顿的紧张局势，进行了一个前所未有的举动：在美国的强烈要求下，悄悄逮捕了极少数黑客。"}
{"title": "网件（Netgear）路由器被曝严重的DNS漏洞,易遭黑客入侵", "url": "https://www.freebuf.com/news/81272.html", "time": "2015-10-12", "level": "金币+12", "num_look": 314098, "num_comment": 6, "author": "寰者", "tags": ["漏洞", "资讯"], "text": "近日，网件（Netgear）路由器被发现存在严重的DNS漏洞，目前，网件还未修补该已公布的漏洞，"}
{"title": "思科（Cisco）搅了攻击者三千万美金的“生意”", "url": "https://www.freebuf.com/news/81036.html", "time": "2015-10-11", "level": "", "num_look": 253908, "num_comment": 3, "author": "空白", "tags": ["WEB安全", "资讯"], "text": "安全研究者深入研究了使用臭名昭著的钓鱼工具包Angler Exploit Kit的犯罪团伙，他们利用恶意软件攻击每月盗取高达300万美元的收益。"}
{"title": "杀毒软件Avast被曝0day漏洞，可被利用在用户电脑上执行恶意代码", "url": "https://www.freebuf.com/news/81102.html", "time": "2015-10-11", "level": "金币+5", "num_look": 209199, "num_comment": 4, "author": "寰者", "tags": ["漏洞", "资讯"], "text": "Google安全专家Tavis Ormandy，发现一个Avast杀毒软件的0day漏洞，该漏洞可能导致攻击者侵入用户电脑，并在用户电脑上执行代码。"}
{"title": "2015年9月数据安全漏洞分析报告", "url": "https://www.freebuf.com/news/81108.html", "time": "2015-10-10", "level": "", "num_look": 192947, "num_comment": 2, "author": "安华金和", "tags": ["资讯"], "text": "国内数据库安全厂商安华金和，根据每日整理发布来自各漏洞平台的安全资讯，以月为单位，将高危漏洞汇总，形成分析报告，分享广大用户及合作伙伴。"}
{"title": "针对Alexa Top 100站点进行的一次钓鱼攻击分析", "url": "https://www.freebuf.com/news/81016.html", "time": "2015-10-10", "level": "金币+5", "num_look": 200524, "num_comment": 7, "author": "鸢尾", "tags": ["资讯"], "text": "我们将会探讨Alexa Top 100域名中网络钓鱼防御手法，同时也会揭露一些针对这些域名做钓鱼攻击的案例。"}
{"title": "域控权限持久化之DSRM", "url": "https://www.freebuf.com/articles/system/80968.html", "time": "2015-10-10", "level": "现金奖励", "num_look": 542139, "num_comment": 15, "author": "丝绸之路", "tags": ["系统安全", "网络安全"], "text": "本文将讲述当攻击者拥有了域管理员权限后如何将权限持久化的方法。"}
{"title": "IBM研究发现：代码签名证书成为流行的网络犯罪物", "url": "https://www.freebuf.com/news/81083.html", "time": "2015-10-10", "level": "", "num_look": 343030, "num_comment": 3, "author": "江湖小吓", "tags": ["网络安全", "资讯"], "text": "最近IBM的X-Force研究人员从CaaS中发现网络犯罪分子会利用暗网销售高档代码证书，他们从受信任的证书颁发机构获取然后贩卖给任何有兴趣购买的人。"}
{"title": "三星LoopPay攻击事件本质：监控消费者个人行为？", "url": "https://www.freebuf.com/news/81099.html", "time": "2015-10-10", "level": "", "num_look": 145337, "num_comment": 2, "author": "dawner", "tags": ["资讯"], "text": "周三一位安全分析师曾提出，三星子公司LoopPay的安全漏洞与其说是普通的手机用户数据泄露，还不如称其为有关部门试图实施的监控行动。"}
{"title": "【更新PPT下载】网络安全黑暗森林法则：2015中国互联网安全大会（ISC）深度回顾", "url": "https://www.freebuf.com/news/80820.html", "time": "2015-10-10", "level": "红色标题", "num_look": 687605, "num_comment": 15, "author": "FB独家", "tags": ["活动", "资讯"], "text": ""}
{"title": "Android应用方法隐藏及反调试技术浅析", "url": "https://www.freebuf.com/articles/terminal/80996.html", "time": "2015-10-10", "level": "", "num_look": 911769, "num_comment": 8, "author": "安全豹", "tags": ["系统安全", "终端安全"], "text": "Android应用的加固和对抗不断升级，出现了隐藏方法加固，运行时动态恢复和反调试等方法来对抗，本文通过实例来分析有哪些对抗和反调试手段。"}
{"title": "卡巴斯基实验室又发现一个全球性间谍组织——Winnti group", "url": "https://www.freebuf.com/news/80926.html", "time": "2015-10-10", "level": "", "num_look": 217867, "num_comment": 5, "author": "简单", "tags": ["资讯"], "text": "据卡巴斯基发现，Winnti group从2009年一直活跃至今，全球有超过30家游戏公司和在线游戏平台都遭到该组织的攻击。"}
{"title": "Hacking Team安卓浏览器攻击过程中的漏洞分析 Stage1", "url": "https://www.freebuf.com/vuls/80873.html", "time": "2015-10-09", "level": "现金奖励", "num_look": 275760, "num_comment": 8, "author": "MarcusAurelius", "tags": ["漏洞", "终端安全"], "text": "作者的上一篇文章《Hacking Team安卓浏览器攻击过程中的漏洞分析 Stage0》，已对stage0进行了分析，本文主要分析stage1的工作。"}
{"title": "Fareit恶意软件又出躲避检测新方法", "url": "https://www.freebuf.com/news/80612.html", "time": "2015-10-09", "level": "", "num_look": 142608, "num_comment": 2, "author": "江湖小吓", "tags": ["资讯"], "text": "思科安全专家Talos团队发现了Fareit信息窃取器的一个新品种，在进行每次攻击的时候它都会使用一个不同的哈希文件以避免AV检测。"}
{"title": "Kemoge：一款影响超过20国的安卓恶意程序", "url": "https://www.freebuf.com/news/80876.html", "time": "2015-10-09", "level": "", "num_look": 261766, "num_comment": 3, "author": "鸢尾", "tags": ["终端安全", "资讯"], "text": "FireEye实验室一位移动安全研究专家近期发现一款迅速蔓延全球的可完全控制Android设备的恶意软件家族病毒——Kemoge。"}
{"title": "走近科学：了解SPICE用户手册", "url": "https://www.freebuf.com/sectool/80424.html", "time": "2015-10-09", "level": "金币+5", "num_look": 330390, "num_comment": 3, "author": "VillanCh", "tags": ["工具"], "text": "Spice 是一个开源的远程计算机解决方案，并且提供了客户端入口来远程遥控展示区域和设备。"}
{"title": "利用无人机或吸尘器黑掉企业无线打印机", "url": "https://www.freebuf.com/news/80906.html", "time": "2015-10-09", "level": "", "num_look": 434214, "num_comment": 3, "author": "JackFree", "tags": ["网络安全", "资讯"], "text": "研究人员发现，使用一架无人机和一部智能手机就能在办公楼外拦截无线打印机传输的数据。"}
{"title": "安全狗攻防实验室招人啦", "url": "https://www.freebuf.com/jobs/80245.html", "time": "2015-10-09", "level": "", "num_look": 370074, "num_comment": 59, "author": "安全狗攻防实验室", "tags": ["安全招聘"], "text": "安全狗攻防实验室隶属于厦门服云信息科技有限公司（安全狗），安全工作从来不应该局限在一个领域，我们致力于针对最新的网络攻防技术和安全漏洞进行深入研究，为产品研发注入新鲜的血液。"}
{"title": "IOS越狱恶意软件：WiFi破解大师", "url": "https://www.freebuf.com/articles/wireless/80822.html", "time": "2015-10-09", "level": "现金奖励", "num_look": 486862, "num_comment": 12, "author": "mryu1", "tags": ["无线安全", "终端安全"], "text": "之前Xcode事件把iOS系统终端安全再次推向了风口浪尖，AppStore已然如此那作为越狱系统应用商店的Cydia中的APP又会是如何呢？"}
{"title": "热榜：2015年度渗透测试神器TOP 10", "url": "https://www.freebuf.com/sectool/80846.html", "time": "2015-10-09", "level": "", "num_look": 629185, "num_comment": 23, "author": "小太阳花", "tags": ["工具"], "text": "这里我们将为大家梳理出2015年度十大最佳渗透测试工具。来看看，有没有你爱的那一个呢？"}
{"title": "韩国首尔地铁遭网络攻击，指责朝鲜所为", "url": "https://www.freebuf.com/news/80727.html", "time": "2015-10-08", "level": "金币+5", "num_look": 254637, "num_comment": 15, "author": "亲爱的兔子", "tags": ["系统安全", "资讯"], "text": "据最近报道称韩国的首都，首尔市中心的地铁系统在2014年曾被朝鲜黑客攻击，同时当地的一名议员也称该事件的罪魁祸首是朝鲜。"}
{"title": "地方商业银行APP安全性分析", "url": "https://www.freebuf.com/articles/terminal/80744.html", "time": "2015-10-08", "level": "现金奖励", "num_look": 720063, "num_comment": 36, "author": "bt0sea", "tags": ["终端安全"], "text": "各个地方商业都相继推出了自家的银行App，但是对于这种新的商业模式和业务接口，你们的App安全做好接受国内上万白帽子的众测的准备了么？"}
{"title": "伪装成PayPal的网银木马瞄准安卓用户", "url": "https://www.freebuf.com/news/80663.html", "time": "2015-10-08", "level": "金币+5", "num_look": 257486, "num_comment": 4, "author": "JackFree", "tags": ["终端安全", "资讯"], "text": "黑客利用虚假的PayPal应用更新邮件瞄准了安卓用户，邮件中嵌入有一个安卓网银恶意软件的链接。"}
{"title": "Weblogic弱口令扫描器", "url": "https://www.freebuf.com/sectool/80536.html", "time": "2015-10-08", "level": "", "num_look": 643714, "num_comment": 24, "author": "帅气凌云", "tags": ["WEB安全", "工具"], "text": "这么久以来，至少我自己还没有在网上找到过一款Weblogic弱口令扫描器，想自己写一款。"}
{"title": "解密：攻击者是如何一步步拿下你的WhatsApp数据库", "url": "https://www.freebuf.com/articles/terminal/80625.html", "time": "2015-10-08", "level": "", "num_look": 331482, "num_comment": 5, "author": "JackFree", "tags": ["终端安全"], "text": "针对已root过的安卓移动设备，本文主要讲解远程攻击并解密WhatsApp数据库的详细过程。"}
{"title": "斯诺登曝光英国情报机构：利用一条短信就能黑掉你的智能手机", "url": "https://www.freebuf.com/news/80672.html", "time": "2015-10-08", "level": "金币+5", "num_look": 239664, "num_comment": 7, "author": "JackFree", "tags": ["终端安全", "资讯"], "text": "没有办法停止秘密服务监视用户的智能手机，这是美国告密者爱德华·斯诺登又一次给我们的启示。"}
{"title": "攻击新姿势：通过入侵Outlook Web应用（OWA）服务器来破坏机构网络", "url": "https://www.freebuf.com/news/80637.html", "time": "2015-10-08", "level": "金币+5", "num_look": 460271, "num_comment": 6, "author": "JackFree", "tags": ["网络安全", "资讯"], "text": "研究人员发现了一种先进的恶意软件，它可以通过感染机构的Outlook Web应用（OWA）邮件服务器来破坏机构的网络。"}
{"title": "谷歌发布安卓Stagefright 2.0漏洞的安全补丁", "url": "https://www.freebuf.com/news/80648.html", "time": "2015-10-07", "level": "", "num_look": 245970, "num_comment": 7, "author": "JackFree", "tags": ["漏洞", "系统安全"], "text": "据悉，谷歌修复了安卓中最新的Stagefright 2.0漏洞，并通过OTA向Nexus设备上推送了更新。"}
{"title": "J2EEScan：J2EE安全扫描（Burp插件）", "url": "https://www.freebuf.com/sectool/80535.html", "time": "2015-10-06", "level": "金币+5", "num_look": 523087, "num_comment": 9, "author": "帅气凌云", "tags": ["工具"], "text": ""}
{"title": "XDCTF2015代码审计全解", "url": "https://www.freebuf.com/articles/web/80528.html", "time": "2015-10-06", "level": "现金奖励", "num_look": 562084, "num_comment": 23, "author": "phithon", "tags": ["WEB安全"], "text": "第六届西电信息安全大赛（XDCTF2015）代码审计writeup"}
{"title": "YiSpecter——隐匿于iOS色情视频应用下的木马", "url": "https://www.freebuf.com/news/80562.html", "time": "2015-10-05", "level": "金币+5", "num_look": 448115, "num_comment": 13, "author": "Sphinx", "tags": ["终端安全", "资讯"], "text": "距离XcodeGhost事件还不到一个月的时间，安全研究人员又发现了一款iOS恶意软件，这款软件针对的目标既包含越狱的手机也包含没有越狱的手机。"}
{"title": "如何利用Nexus 5伪造一张门禁卡", "url": "https://www.freebuf.com/news/topnews/80368.html", "time": "2015-10-05", "level": "现金奖励", "num_look": 4706154, "num_comment": 89, "author": "seudingo", "tags": ["头条", "极客"], "text": "只要简单模拟一个相同id的卡就可以刷开门禁。"}
{"title": "路由器“保护”天使：“恶意软件”Linux.Wifatch", "url": "https://www.freebuf.com/news/80510.html", "time": "2015-10-04", "level": "金币+5", "num_look": 247426, "num_comment": 16, "author": "寰者", "tags": ["资讯"], "text": "著名安全厂商赛门铁克，目前发现一个“保护”路由器安全的恶意软件，该恶意软件的行为跟大部分的恶意软件相同，都是感染用户脆弱的路由设备，同时通过p2p网络进行升级，来隐藏自己。"}
{"title": "苹果公司CEO蒂姆·库克回应：我们从来不帮助任何政府获取用户信息", "url": "https://www.freebuf.com/news/80479.html", "time": "2015-10-04", "level": "", "num_look": 202726, "num_comment": 20, "author": "亲爱的兔子", "tags": ["资讯"], "text": "\"苹果公司不会让任何政府访问其客户的加密数据\"，Tim Cook 在本周接受采访时说道。"}
{"title": "美股网络券商史考特证券承认被黑，460万客户受影响", "url": "https://www.freebuf.com/news/80488.html", "time": "2015-10-03", "level": "", "num_look": 311347, "num_comment": 5, "author": "月球下雨了", "tags": ["数据安全", "资讯"], "text": "美国网络券商史考特（Scottrade）公司与10月2日证实自己曾遭到网络攻击者袭击，但表示，此次袭击的焦点集中于客户姓名及物理地址，而非财务信息。"}
{"title": "还在使用TrueCrypt？当心这两个危险漏洞", "url": "https://www.freebuf.com/news/80390.html", "time": "2015-10-03", "level": "", "num_look": 342618, "num_comment": 7, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "安全专家James Forshaw发现了TrueCrypt中的两个重要漏洞，这两个漏洞存在于TrueCrypt安装在Windows系统上的驱动程序中。"}
{"title": "数据公司被黑客入侵，造成T-Mobile1500万用户信息外泄", "url": "https://www.freebuf.com/news/80463.html", "time": "2015-10-03", "level": "", "num_look": 417935, "num_comment": 10, "author": "哆啦A梦", "tags": ["数据安全", "资讯"], "text": "全球数据服务集团益百利公司电脑遭到黑客入侵，受影响的服务器上有益百利的客户 T-Mobile 的数据，包括美国 1500 万客户和信用申请人的信息。"}
{"title": "悉数美剧《黑客军团》中的黑客工具", "url": "https://www.freebuf.com/news/80383.html", "time": "2015-10-02", "level": "金币+15", "num_look": 1659071, "num_comment": 47, "author": "JackFree", "tags": ["资讯"], "text": "本篇文章中主要列举《Mr. Robot》电视剧中主要用到的黑客工具，并对它们所对应的现实中的黑客工具做一简要介绍。"}
{"title": "Stagefright 2.0漏洞来袭 影响上亿安卓用户", "url": "https://www.freebuf.com/news/80427.html", "time": "2015-10-02", "level": "", "num_look": 371361, "num_comment": 12, "author": "亲爱的兔子", "tags": ["漏洞", "资讯"], "text": "安卓系统用户注意了:由于最新的两个最新的stagefright漏洞披露，估计超过10亿的安卓系统用户将遭受该漏洞影响。"}
{"title": "WinRAR 0day漏洞（附利用过程）", "url": "https://www.freebuf.com/vuls/80380.html", "time": "2015-10-02", "level": "现金奖励", "num_look": 704451, "num_comment": 24, "author": "亲爱的兔子", "tags": ["漏洞", "系统安全"], "text": ""}
{"title": "挡人财路！俄国大蜘蛛杀毒软件Dr.Web遭黑客燃烧弹物理攻击", "url": "https://www.freebuf.com/news/80430.html", "time": "2015-10-02", "level": "", "num_look": 380296, "num_comment": 25, "author": "0xroot", "tags": ["资讯"], "text": "Dr.Web因为揭露专门感染ATM自动取款机的Trojan.Skimer.18木马程序，且在自家产品中嵌入封锁该程序的机制，而惹来自称代表全球犯罪组织的Syndicate集团报复，使得公司一个实验室遭受两次实体燃烧弹的攻击。"}
{"title": "泰国欲建立自己的GFW", "url": "https://www.freebuf.com/news/80399.html", "time": "2015-10-01", "level": "金币+15", "num_look": 389176, "num_comment": 28, "author": "亲爱的兔子", "tags": ["资讯"], "text": "泰国当局正计划加强对互联网的控制，通过建立一个国家网关性质的唯一互联网接入点，使他们能够更好地监控本国网络使用情况。"}
{"title": "百度回应质疑：防御1Tbps DDoS攻击流量是如何做到的？", "url": "https://www.freebuf.com/news/topnews/80267.html", "time": "2015-10-01", "level": "", "num_look": 659991, "num_comment": 27, "author": "百度安全", "tags": ["头条", "网络安全"], "text": "不少来自安全圈、IT界的怀疑声音：这么大的流量，是从哪来的？百度这次声称的流量是真实的吗，攻击的手段是足够“专业”的吗？"}
{"title": "微软回应windows 10的间谍问题，将继续搜集用户数据", "url": "https://www.freebuf.com/news/80354.html", "time": "2015-10-01", "level": "", "num_look": 166871, "num_comment": 3, "author": "简单", "tags": ["资讯"], "text": "自windows 10出现就一直被爆出会搜集用户数据，而就在本周一，微软终于回应了这些搜集用户数据的行为。"}
{"title": "Shopify贸易平台面临RFD攻击，且未修复", "url": "https://www.freebuf.com/news/80302.html", "time": "2015-10-01", "level": "", "num_look": 216910, "num_comment": 216910, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "Shopify是一个多渠道的贸易平台，它帮助人们进行网上销售、实体店销售，以及二者的结合销售。WebSegura的著名安全研究员Davis Sopas在Shopify的服务中发现了一个反射型的文件名下载漏洞。"}
{"title": "刨根问底：Hash传递攻击原理探究", "url": "https://www.freebuf.com/articles/terminal/80186.html", "time": "2015-10-01", "level": "现金奖励", "num_look": 724156, "num_comment": 7, "author": "walkerfuz", "tags": ["系统安全", "终端安全"], "text": "Hash机制是目前比较安全的一种加密，不可能让微软放弃Hash吧，所以企业解决这个疑问的重点不在于Hash的使用，而在于使用之前Hash的获取上。"}
{"title": "注册仅一日，斯诺登推特吸粉将破百万", "url": "https://www.freebuf.com/news/80359.html", "time": "2015-09-30", "level": "红色标题", "num_look": 384350, "num_comment": 13, "author": "明明知道", "tags": ["资讯"], "text": "数十万粉丝来袭，斯诺登心里却只有NSA。"}
{"title": "Linux XOR DDoS僵尸网络发起强有力的DDoS攻击", "url": "https://www.freebuf.com/news/80311.html", "time": "2015-09-30", "level": "金币+15", "num_look": 246400, "num_comment": 3, "author": "JackFree", "tags": ["资讯"], "text": "Akamai的专家们发现Linux XOR DDoS僵尸网络，它是一个恶意的网络基础设施，可用于对几十个目标发起强有力的DDoS攻击。此外，它主要针对游戏领域和教育行业的网站。"}
{"title": "Windows蓝屏死机骗局：新的恶意钓鱼方式", "url": "https://www.freebuf.com/news/80308.html", "time": "2015-09-30", "level": "金币+15", "num_look": 344928, "num_comment": 13, "author": "寰者", "tags": ["WEB安全", "资讯"], "text": "新的恶意骗局：恶意软件的制作者们，劫持了Windows系统中的最让人崩溃的蓝屏死机，制造了钓鱼骗局。"}
{"title": "通过PHP反序列化进行远程代码执行", "url": "https://www.freebuf.com/vuls/80293.html", "time": "2015-09-30", "level": "", "num_look": 956103, "num_comment": 8, "author": "JackFree", "tags": ["WEB安全", "漏洞"], "text": "最近我们遇到了一段有趣的PHP代码，它可能会导致远程代码执行（RCE）漏洞，但对它进行利用却有点棘手。"}
{"title": "感染韩国网站的银行恶意软件分析", "url": "https://www.freebuf.com/news/80282.html", "time": "2015-09-30", "level": "", "num_look": 369828, "num_comment": 1, "author": "小太阳花", "tags": ["网络安全", "资讯"], "text": "2015年9月18日我们在网站koreatimes.com 上捕捉到一个恶意二进制代码，进一步调查发现这是个专门针对韩国网站及韩国银行的恶意活动。"}
{"title": "追踪黑客论坛，解密黑暗之渊", "url": "https://www.freebuf.com/news/80273.html", "time": "2015-09-30", "level": "金币+12", "num_look": 265643, "num_comment": 16, "author": "简单", "tags": ["资讯"], "text": "黑客论坛是“黑暗力量”的集合地，在这里，黑客们可以买卖exp，讨论新漏洞，获取建议等。"}
{"title": "LFI with PHPInfo本地测试过程", "url": "https://www.freebuf.com/articles/web/79830.html", "time": "2015-09-30", "level": "现金奖励", "num_look": 692274, "num_comment": 19, "author": "Drops@ZUT", "tags": ["WEB安全"], "text": "LFI with PHPInfo是国外研究员在2001年公布的本地文件包含利用方法。作为新手，经过几天的研究学习，把自己的学习过程进行总结，与大家共享。"}
{"title": "众筹发力：9美元的口袋电脑就要出售了", "url": "https://www.freebuf.com/news/80205.html", "time": "2015-09-29", "level": "金币+12", "num_look": 574922, "num_comment": 35, "author": "亲爱的兔子", "tags": ["极客", "资讯"], "text": "众筹的梦想，终于要圆了：一款搭载着Linux系统、价格只需9美元的电脑就要出售了。"}
{"title": "如何从受感染的PDF文件中提取Payload？", "url": "https://www.freebuf.com/vuls/80072.html", "time": "2015-09-29", "level": "金币+12", "num_look": 479358, "num_comment": 8, "author": "鸢尾", "tags": ["漏洞", "网络安全"], "text": "受感染的PDF文件近乎是拥有特权般影响用户，因为这个文档格式十分普遍几乎人人都在使用。此外，其可利用许多的阅读器漏洞隐形且姿势十分优雅的加载恶意软件。"}
{"title": "新型的DDOS攻击 ：控制大量智能手机浏览器发起流量", "url": "https://www.freebuf.com/news/80209.html", "time": "2015-09-29", "level": "金币+12", "num_look": 411170, "num_comment": 8, "author": "寰者", "tags": ["WEB安全", "资讯"], "text": "一个移动广告网络已经可以被用来将成千上万的手机浏览器同时指向在一个网站，使这个网站服务器宕机，从而达到分布式拒绝服务的目的。"}
{"title": "中美网络安全达成共识之漫谈：未来路长且艰", "url": "https://www.freebuf.com/news/80119.html", "time": "2015-09-29", "level": "", "num_look": 171284, "num_comment": 4, "author": "明明知道", "tags": ["资讯"], "text": "一个是发明了互联网的国家，一个是现在拥有互联网用户最多的国家，此次达成的“共识”似乎仍不能解决两国目前共同面临的网络安全争议。"}
{"title": "间谍新高度：航空航天探测器被当作间谍武器", "url": "https://www.freebuf.com/news/80104.html", "time": "2015-09-29", "level": "", "num_look": 192205, "num_comment": 10, "author": "简单", "tags": ["资讯"], "text": "某黑客组织近日研发并测试了一款航空航天探测器，旨在搜集政府、组织流经平流层的信号，这一发明开创了间谍政府情报（及其武器）的新篇章。"}
{"title": "案例学习：将手机网络广告作为DDoS向量", "url": "https://www.freebuf.com/news/80014.html", "time": "2015-09-29", "level": "", "num_look": 173177, "num_comment": 4, "author": "鸢尾", "tags": ["资讯"], "text": "最近一次不寻常的DDoS攻击吸引了我们的眼球，我们注意到有大量的HTTP请求涌向我们的一位客户，攻击并不涉及TCP数据包注入。"}
{"title": "第六届西电信息安全大赛（XDCTF2015）", "url": "https://www.freebuf.com/news/80099.html", "time": "2015-09-28", "level": "", "num_look": 302046, "num_comment": 9, "author": "phithon", "tags": ["活动", "资讯"], "text": "XDCTF是一项面向全国在校大学生的信息安全类比赛，由西电信息安全协会与网络攻防实训基地联合举办。"}
{"title": "一款流行DDoS木马工具的分析", "url": "https://www.freebuf.com/articles/terminal/80079.html", "time": "2015-09-28", "level": "", "num_look": 426509, "num_comment": 13, "author": "阿里安全", "tags": ["系统安全", "终端安全"], "text": "近期，阿里云云盾安全攻防对抗团队通过异常流量分析和攻击溯源发现了一种被大量肉鸡使用，面向目标IP发起DDoS攻击的木马工具。"}
{"title": "Tiger –UNIX：一款开源安全审计 入侵检测工具", "url": "https://www.freebuf.com/sectool/80035.html", "time": "2015-09-28", "level": "金币+12", "num_look": 310685, "num_comment": 10, "author": "寰者", "tags": ["工具"], "text": "Tiger 是一个完全由shell脚本编写的UNIX的免费、开源安全工具，适用于安全审计和入侵检测。"}
{"title": "久游网招聘安全渗透人员", "url": "https://www.freebuf.com/jobs/79893.html", "time": "2015-09-28", "level": "", "num_look": 197536, "num_comment": 25, "author": "Jason0818", "tags": ["安全招聘"], "text": "久游网（www.9you.com），2003年4月份成立于上海，中国第一代互联网游戏运营商。"}
{"title": "IPv6的开端？北美耗尽IPv4地址", "url": "https://www.freebuf.com/news/80046.html", "time": "2015-09-28", "level": "", "num_look": 217922, "num_comment": 13, "author": "dawner", "tags": ["其他", "资讯"], "text": "事实上，2011年整个亚洲的IPv4地址就已经用完了，欧洲的则在2012年用完，只有北美的苦撑到了今天。"}
{"title": "CTF Writeup：CSAW CTF 2015 Web500解题过程", "url": "https://www.freebuf.com/news/79957.html", "time": "2015-09-28", "level": "金币+12", "num_look": 746529, "num_comment": 15, "author": "鸢尾", "tags": ["WEB安全", "资讯"], "text": "Web类500分的题是我见过的最有趣的，也是最符合真实环境的题目。接下来我就来讲讲我们是如何拿到这道题的旗子的。"}
{"title": "Android漏洞检测套件", "url": "https://www.freebuf.com/news/80028.html", "time": "2015-09-28", "level": "", "num_look": 222857, "num_comment": 4, "author": "鸢尾", "tags": ["资讯"], "text": "Android Vulnerability Test Suite（Android漏洞检测套件），鼓励开放收集的数据，帮助社区一起来维护Android安全。"}
{"title": "360MarvelTeam虚拟化漏洞第二弹：CVE-2015-5279 漏洞分析", "url": "https://www.freebuf.com/articles/79897.html", "time": "2015-09-28", "level": "", "num_look": 175407, "num_comment": 3, "author": "360MarvelTeam", "tags": ["文章"], "text": "云计算目前已成为一种被大多数互联网公司接受的服务模式，它提供了定制化的硬件资源、应用以及服务。"}
{"title": "雅虎发布开源Web应用安全扫描器Gryffin", "url": "https://www.freebuf.com/news/79982.html", "time": "2015-09-27", "level": "金币+6", "num_look": 356724, "num_comment": 11, "author": "JackFree", "tags": ["工具", "资讯"], "text": "雅虎开源了Web应用安全扫描器Gryffin。"}
{"title": "让ATM机自动吐现金：新型恶意软件GreenDispenser被发现", "url": "https://www.freebuf.com/news/79933.html", "time": "2015-09-26", "level": "金币+6", "num_look": 216978, "num_comment": 4, "author": "寰者", "tags": ["资讯"], "text": "安全专家最近发现一个新的恶意软件GreenDispenser，该恶意软件为非法分子窃取毫无防护之力的ATM现金提供了强大的臂助。"}
{"title": "新型漏洞：利用浏览器Cookie绕过HTTPS并窃取私人信息", "url": "https://www.freebuf.com/news/79934.html", "time": "2015-09-26", "level": "金币+6", "num_look": 559603, "num_comment": 9, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "近期，一个存在于主要浏览器的Web cookie中的严重漏洞被发现，它使安全的浏览方式（HTTPS）容易遭受中间人攻击。"}
{"title": "英国政府为高校提供50万英镑基金，培养网安人才", "url": "https://www.freebuf.com/news/79559.html", "time": "2015-09-26", "level": "金币+6", "num_look": 141130, "num_comment": 4, "author": "亲爱的兔子", "tags": ["其他", "资讯"], "text": "英国宣布将会提供一个50万英镑的基金来帮助高校开展网络安全技能教育，根本上帮助他们构建创新的教学方法。"}
{"title": "联想再度被爆预安装间谍软件", "url": "https://www.freebuf.com/news/79906.html", "time": "2015-09-26", "level": "金币+6", "num_look": 241403, "num_comment": 13, "author": "跳动的心", "tags": ["资讯"], "text": "联想的产品再度被发现安装了间谍程序收集用户数据。"}
{"title": "CTF writeup：CSAW CTF 2015 Web200解题过程", "url": "https://www.freebuf.com/articles/others-articles/79737.html", "time": "2015-09-25", "level": "金币+6", "num_look": 431811, "num_comment": 10, "author": "鸢尾", "tags": ["其他"], "text": "Lawn Care Simulator是一个用来显示小草生长过程的简单网页应用。"}
{"title": "2015中国信息安全技能竞赛（ISG）技术挑战赛报名开始", "url": "https://www.freebuf.com/fevents/79885.html", "time": "2015-09-25", "level": "", "num_look": 220411, "num_comment": 9, "author": "ISG", "tags": ["活动"], "text": "ISG 2015技术挑战赛已经开始接受报名"}
{"title": "全球最大保险公司之一Ace推出一亿美元网络安全险", "url": "https://www.freebuf.com/news/79809.html", "time": "2015-09-25", "level": "", "num_look": 379142, "num_comment": 6, "author": "明明知道", "tags": ["网络安全", "资讯"], "text": "这家全球最大保险公司之一计划提供金额高达一亿美元的网络安全保险。"}
{"title": "安全产品评测：阿里云盾安全威胁情报“态势感知”", "url": "https://www.freebuf.com/news/79556.html", "time": "2015-09-25", "level": "红色标题", "num_look": 521907, "num_comment": 16, "author": "0xroot", "tags": ["资讯"], "text": "针对传统的网络威胁，我们通常以特征检测为主，而新型威胁更多地利用0day进行攻击，这意味着我们无法提前获知特征信息，现有检测机制也就基本失效。"}
{"title": "绕过微软控制流防护（CFG）保护机制", "url": "https://www.freebuf.com/news/79563.html", "time": "2015-09-25", "level": "", "num_look": 245931, "num_comment": 3, "author": "空白", "tags": ["系统安全", "资讯"], "text": "随着每次新的安全机制的房补，研究人员和黑客都会想法设法地找到破解或者通过它的方式，此次CFG也不能例外。"}
{"title": "苹果官方发布受XcodeGhost影响最大的25个App", "url": "https://www.freebuf.com/news/79799.html", "time": "2015-09-25", "level": "金币+6", "num_look": 316001, "num_comment": 3, "author": "寰者", "tags": ["资讯"], "text": "苹果在今天更新了其官方的FAQ官网，其中列举了目前在XcodeGhost恶意感染中影响最大的25个app。"}
{"title": "44CON议题解析：使用PowerShell掌控活动目录", "url": "https://www.freebuf.com/news/topnews/79538.html", "time": "2015-09-25", "level": "现金奖励", "num_look": 269225, "num_comment": 9, "author": "丝绸之路", "tags": ["头条"], "text": "本议题讨论的内容并不是关于活动目录和PowerShell的教程，其目的是激发大家去思考如何使活动目录更好的工作。"}
{"title": "木马GetShell的另类姿势", "url": "https://www.freebuf.com/articles/web/78806.html", "time": "2015-09-25", "level": "现金奖励", "num_look": 464848, "num_comment": 11, "author": "冰海", "tags": ["WEB安全"], "text": "扫C段时发现一机器有phpMyAdmin服务，就尝试了一下弱口令，root123果断进入，然后就开始了下面的故事。"}
{"title": "【精彩议题更新】ISC 2015“APT与新威胁论坛”议题抢先看", "url": "https://www.freebuf.com/news/76870.html", "time": "2015-09-25", "level": "红色标题", "num_look": 695908, "num_comment": 10, "author": "FB独家", "tags": ["活动", "资讯"], "text": "数字犯罪：针对APT威胁的深度调查、歌者之眼：国内APT事例揭秘、网络安全威胁中的商业军火、使用一个PC和示波器克隆3G/4G SIM卡……"}
{"title": "巧妙在Global.asa文件里使用的.htaccess小技巧", "url": "https://www.freebuf.com/articles/web/79616.html", "time": "2015-09-25", "level": "", "num_look": 297159, "num_comment": 1, "author": "dawner", "tags": ["WEB安全", "安全管理"], "text": "很多人都知道，黑客们都会利用Apache配置的.htaccess文件去覆盖默认的WEB网站的配置。"}
{"title": "美国海军研发新的防御系统抵御网络攻击", "url": "https://www.freebuf.com/news/79391.html", "time": "2015-09-25", "level": "金币+4", "num_look": 169960, "num_comment": 2, "author": "亲爱的兔子", "tags": ["文章", "资讯"], "text": "根据最新报道，美国海军已经宣布，目前正在开发一个安全系统，以保护其船队免受网络攻击。"}
{"title": "XcodeGhost机读威胁情报IOC", "url": "https://www.freebuf.com/news/79787.html", "time": "2015-09-24", "level": "", "num_look": 390853, "num_comment": 9, "author": "Threatbook", "tags": ["工具", "资讯"], "text": "我们对XcodeGhost的作者及其攻击目的进行了深度分析后，公开发布可机读的IOC威胁情报（基于OpenIOC格式）。"}
{"title": "植物大战僵尸2、糖果传奇、神庙逃亡等热门游戏APP可能让你的手机染上木马病毒", "url": "https://www.freebuf.com/news/79581.html", "time": "2015-09-24", "level": "金币+4", "num_look": 229943, "num_comment": 8, "author": "亲爱的兔子", "tags": ["终端安全", "资讯"], "text": "在苹果编译器后门事件发生之后，Google Play（Google应用市场）也不是那么安全了。"}
{"title": "Intel、英国电信等30多家科技公司齐聚英国，共商物联网安全", "url": "https://www.freebuf.com/news/79614.html", "time": "2015-09-24", "level": "金币+4", "num_look": 186482, "num_comment": 1, "author": "寰者", "tags": ["系统安全", "资讯"], "text": "为了更好地加强智能设备的安全性，来自全球的30多个技术团队齐集英国，将联合对智能设备的安全性进行深度探测。"}
{"title": "苹果手表watchOS 2更新：修复大量代码执行漏洞", "url": "https://www.freebuf.com/news/79397.html", "time": "2015-09-24", "level": "", "num_look": 188685, "num_comment": 2, "author": "江湖小吓", "tags": ["终端安全", "资讯"], "text": "令果粉们激动的watchOS 2终于来了，这是一个可以自己打造的手表系统，同时新版本进行了大量的安全补丁。"}
{"title": "解析网购订单信息泄露的秘密", "url": "https://www.freebuf.com/articles/database/79513.html", "time": "2015-09-24", "level": "现金奖励", "num_look": 951208, "num_comment": 14, "author": "mcvoodoo", "tags": ["数据安全", "网络安全"], "text": "每次大家都很愤怒的认为电商平台在出卖自己的信息，然而事实上是怎样，我想从我负责订单信息泄露两年的实际经历来谈谈我的看法。"}
{"title": "John McAfee：中国航班上的乘客手机被监控", "url": "https://www.freebuf.com/news/79603.html", "time": "2015-09-24", "level": "金币+4", "num_look": 201412, "num_comment": 7, "author": "JackFree", "tags": ["资讯"], "text": "McAfee：有关部门利用IMSI-catchers技术监视了4家中国航空公司航班上的乘客，当飞机上的旅客试图连接互联网时，该设备就能够入侵他们的手机。"}
{"title": "DNS批量检测工具：DNS_Transfer_Check", "url": "https://www.freebuf.com/sectool/79315.html", "time": "2015-09-24", "level": "金币+4", "num_look": 391268, "num_comment": 13, "author": "Layert", "tags": ["工具"], "text": "DNS区域传送指的是一台备用服务器使用来自主服务器的数据刷新自己的域（zone）数据库。"}
{"title": "渗透测试系统BackBox Linux 4.3 发布", "url": "https://www.freebuf.com/sectool/79388.html", "time": "2015-09-24", "level": "金币+4", "num_look": 286258, "num_comment": 20, "author": "帅气凌云", "tags": ["工具"], "text": "BackBox是基于Ubuntu的发行，它被开发用于网络渗透测试及安全评估。"}
{"title": "荒唐：印度禁止删除90天内的通信记录", "url": "https://www.freebuf.com/news/79493.html", "time": "2015-09-24", "level": "金币+4", "num_look": 235721, "num_comment": 14, "author": "简单", "tags": ["资讯"], "text": "如果你删除了90天以内发送（接收）的WhatsApp消息或者邮件，那么你就摊上事儿了。"}
{"title": "iOS 9漏洞：利用Siri绕过锁屏访问私人图片和联系人", "url": "https://www.freebuf.com/news/79406.html", "time": "2015-09-23", "level": "金币+4", "num_look": 546768, "num_comment": 26, "author": "JackFree", "tags": ["资讯"], "text": "利用了苹果的私人助理Siri，绕过运行iOS 9的锁屏iOS设备（iPhone、iPad或iPod touch）的安全机制，这使得攻击者在30秒或许更短时间内就能访问设备中的照片和联系人。"}
{"title": "网络资源重污染：超过20家知名下载站植入Killis木马", "url": "https://www.freebuf.com/vuls/79490.html", "time": "2015-09-23", "level": "", "num_look": 564925, "num_comment": 20, "author": "360安全", "tags": ["漏洞", "网络安全"], "text": "Xcode编译器引发的苹果病毒大爆发事件还未平息，又一起严重的网络资源带毒事故出现在PC互联网上。"}
{"title": "Google Play遭遇黑客攻击，波及上百万安卓用户", "url": "https://www.freebuf.com/news/79460.html", "time": "2015-09-23", "level": "金币+4", "num_look": 252422, "num_comment": 29, "author": "Dreamdroid", "tags": ["资讯"], "text": "据报道，疑似中国的黑客组织在Google应用商店上放置了恶意应用程序——大脑测试应用程序（Brain Test app）。"}
{"title": "pfSense目录遍历漏洞分析", "url": "https://www.freebuf.com/vuls/79423.html", "time": "2015-09-23", "level": "金币+4", "num_look": 221884, "num_comment": 1, "author": "I12016", "tags": ["漏洞"], "text": "在本文中，我们将向大家介绍在pfSense的2.1.3以及更低版本中的CVE-2014-4690漏洞；对于更高的版本来说，pfSense已经修复了这个漏洞。"}
{"title": "远程控制工具VNC拒绝服务漏洞分析", "url": "https://www.freebuf.com/sectool/79223.html", "time": "2015-09-23", "level": "", "num_look": 491294, "num_comment": 6, "author": "360安全", "tags": ["工具", "漏洞"], "text": "Qemu是一款处理器模拟软件，可以提供用户模式模拟和系统模式模拟。"}
{"title": "SAP Afaria产品曝一系列严重漏洞，影响大量移动设备", "url": "https://www.freebuf.com/news/79229.html", "time": "2015-09-23", "level": "", "num_look": 173901, "num_comment": 1, "author": "简单", "tags": ["漏洞", "资讯"], "text": "Afaria是德国SAP软件公司开发的一个移动设备管理（MDM）解决方案，是目前市场上最为流行的MDM解决方案，大约有6300个企业用它管理着1亿300万的移动设备。"}
{"title": "美通信基础设施被黑：外媒怀疑中国所为", "url": "https://www.freebuf.com/news/79346.html", "time": "2015-09-23", "level": "金币+8", "num_look": 149556, "num_comment": 7, "author": "bonABC", "tags": ["资讯"], "text": "未知黑客继续将目标锁定在美国的重要通信基础设施上，周一，也就是9月14日，未知黑客切断了加利福尼亚利弗莫尔市的重要网络光纤电缆。"}
{"title": "永别了：谷歌宣布放弃RC4和SSLv3协议", "url": "https://www.freebuf.com/news/78855.html", "time": "2015-09-23", "level": "金币+8", "num_look": 250515, "num_comment": 3, "author": "月尽西楼", "tags": ["资讯"], "text": "谷歌计划这周开始正式放弃支持流计算RC4和SSlv3协议。二者都有很长的历史，它们也曾暴露出了很多漏洞。"}
{"title": "联姻百度，云防火墙CloudFlare完成1.1亿美元D轮融资", "url": "https://www.freebuf.com/news/79396.html", "time": "2015-09-22", "level": "", "num_look": 193992, "num_comment": 7, "author": "phper", "tags": ["其他", "资讯"], "text": "该轮融资由 Fidelity 领投，不过引人瞩目的是参投的还包括 Google、微软、百度、高通等几大巨头。"}
{"title": "MS15-083：Windows SMB内存损坏漏洞分析", "url": "https://www.freebuf.com/vuls/78842.html", "time": "2015-09-22", "level": "金币+8", "num_look": 290365, "num_comment": 13, "author": "鸢尾", "tags": ["漏洞", "系统安全"], "text": "2015年8月11日微软发布了14个安全补丁，其中就包括一个SMB服务器补丁。在本文我将解释我是如何触发该漏洞的。"}
{"title": "IIS6堆喷射及内存破坏漏洞利用图示详解", "url": "https://www.freebuf.com/vuls/79215.html", "time": "2015-09-22", "level": "金币+8", "num_look": 352272, "num_comment": 12, "author": "I12016", "tags": ["WEB安全", "漏洞"], "text": "利用COM ActiveX中的漏洞是一个好点子，下面我们就以活动服务器页面（Active Server Page，ASP）为例详细说明此类漏洞的利用方法。"}
{"title": "2015年8月数据安全漏洞分析报告", "url": "https://www.freebuf.com/news/79286.html", "time": "2015-09-22", "level": "", "num_look": 215810, "num_comment": 18, "author": "安华金和", "tags": ["资讯"], "text": "2015年8月，我们通过每日安全资讯总结发布了102个数据泄密高危漏洞，这些漏洞分别来自漏洞盒子、乌云、补天等平台，涉及11个行业。"}
{"title": "中秋福利：黑客题材美剧《天蝎》第二季回归", "url": "https://www.freebuf.com/news/79083.html", "time": "2015-09-22", "level": "金币+8", "num_look": 450192, "num_comment": 27, "author": "亲爱的兔子", "tags": ["资讯"], "text": "《天蝎》，是一部关于网络安全的动作悬疑电视剧。"}
{"title": "Hacking Team安卓浏览器攻击过程中的漏洞分析 Stage0", "url": "https://www.freebuf.com/vuls/78594.html", "time": "2015-09-22", "level": "现金奖励", "num_look": 497695, "num_comment": 20, "author": "MarcusAurelius", "tags": ["漏洞", "终端安全"], "text": "Hacking team今年爆出了针对android4.0.x-4.3.xandroid浏览器的漏洞攻击利用代码。该利用过程分为5个复杂的Stage，本文首先分析了第1个Stage，即Stage0。"}
{"title": "微软修复SharePoint 2013 XSS漏洞", "url": "https://www.freebuf.com/news/78889.html", "time": "2015-09-22", "level": "", "num_look": 205237, "num_comment": 3, "author": "鸢尾", "tags": ["漏洞", "资讯"], "text": "SharePoint是Microsoft Office套件中的一款工具，可为个人和公司创建门户页面。"}
{"title": "完美世界招聘各类安全人才", "url": "https://www.freebuf.com/jobs/79188.html", "time": "2015-09-22", "level": "", "num_look": 209378, "num_comment": 24, "author": "何艺", "tags": ["安全招聘"], "text": "完美世界（北京）网络技术有限公司（以下简称：完美世界）是中国领先的网络游戏开发商和运营商之一。"}
{"title": "打造一个自动检测页面是否存在XSS的插件Ⅲ", "url": "https://www.freebuf.com/articles/web/79013.html", "time": "2015-09-22", "level": "现金奖励", "num_look": 428756, "num_comment": 14, "author": "Black-Hole", "tags": ["WEB安全"], "text": "本章主要是对“form表单XSS检测”进行介绍，以及对反馈页面的修改。上一章我就说过“form表单XSS检测”有点复杂。"}
{"title": "WordPress漏洞分析（CVE-2015-5714 & CVE-2015-5715）", "url": "https://www.freebuf.com/vuls/79008.html", "time": "2015-09-22", "level": "金币+8", "num_look": 351081, "num_comment": 3, "author": "RickGray", "tags": ["WEB安全", "漏洞"], "text": "近日，WordPress 发布了新版本4.3.1，其中修复了几个严重的安全问题，一个跨站脚本漏洞（CVE-2015-5714）和一个权限提升漏洞（CVE-2015-5715）。"}
{"title": "美空军新型机载攻击平台：可监听附近敌人封闭的军事网络", "url": "https://www.freebuf.com/news/79023.html", "time": "2015-09-22", "level": "金币+8", "num_look": 143175, "num_comment": 1, "author": "亲爱的兔子", "tags": ["资讯"], "text": "在美国国家海港马里兰州举行的美国空军协会航空航天会议上，少将伯克威尔逊透露了一个新的美国空军的项目。"}
{"title": "安卓粉的愤怒：苹果首款Android App遭疯狂差评", "url": "https://www.freebuf.com/news/79262.html", "time": "2015-09-22", "level": "金币+8", "num_look": 334865, "num_comment": 10, "author": "dawner", "tags": ["资讯"], "text": "几天前，苹果在Google商店亮相它的第一款官方安卓App“Move to iOS”。"}
{"title": "如何有效绕过Android kptr_restrict", "url": "https://www.freebuf.com/vuls/77143.html", "time": "2015-09-21", "level": "金币+10", "num_look": 340636, "num_comment": 10, "author": "living", "tags": ["漏洞", "系统安全"], "text": "本文中，我会探讨一些自己发现的绕过Android kptr_restrict的方法，这些方法使得那些在利用之前需要获取内核加载的虚拟地址信息的漏洞利用更容易。"}
{"title": "别用Chrome浏览这篇文章，会崩溃！", "url": "https://www.freebuf.com/news/79096.html", "time": "2015-09-21", "level": "金币+10", "num_look": 698548, "num_comment": 61, "author": "鸢尾", "tags": ["其他", "资讯"], "text": "甚至鼠标只是在这16个字节组成的链接周围移动都可导致Chrome崩溃。"}
{"title": "AVG反病毒公司计划向广告商出售用户个人数据", "url": "https://www.freebuf.com/news/79030.html", "time": "2015-09-21", "level": "", "num_look": 295152, "num_comment": 13, "author": "西域使者", "tags": ["数据安全", "资讯"], "text": "捷克共和国的反病毒公司AVG已宣布了他们的隐私策略，为了从其免费的反病毒软件赚钱他们将向在线广告商出售收集收集到的用户的数据。"}
{"title": "老树开新花：DLL劫持漏洞新玩法", "url": "https://www.freebuf.com/articles/78807.html", "time": "2015-09-21", "level": "现金奖励", "num_look": 878965, "num_comment": 25, "author": "丝绸之路", "tags": ["文章"], "text": "DLL劫持漏洞已经是一个老生常谈，毫无新鲜感的话题了。DLL劫持技术也已经是黑客们杀人越货，打家劫舍必备的武器。"}
{"title": "玩转树莓派：OpenHAB的入门（二）", "url": "https://www.freebuf.com/geek/78462.html", "time": "2015-09-21", "level": "", "num_look": 372083, "num_comment": 1, "author": "江湖小吓", "tags": ["极客"], "text": "安装了OpenHAB和Demo House后，让我们继续。"}
{"title": "同程旅游招聘信息安全工程师", "url": "https://www.freebuf.com/jobs/78410.html", "time": "2015-09-21", "level": "", "num_look": 186278, "num_comment": 16, "author": "madmaner", "tags": ["安全招聘"], "text": "同程旅游招聘信息安全工程师"}
{"title": "外卖O2O App安全性分析：App漏洞评估平台技术细节", "url": "https://www.freebuf.com/articles/terminal/78699.html", "time": "2015-09-21", "level": "现金奖励", "num_look": 595850, "num_comment": 26, "author": "bt0sea", "tags": ["安全报告", "终端安全"], "text": "在移动互联网和O2O大潮的席卷下，外卖市场逐渐进入的白领的视野，在BAT三巨头砸钱培育市场的情况下，白领的已经更改就餐习惯。"}
{"title": "借用UAC完成的提权思路分享", "url": "https://www.freebuf.com/articles/others-articles/78758.html", "time": "2015-09-21", "level": "", "num_look": 349196, "num_comment": 10, "author": "安全豹", "tags": ["其他", "系统安全"], "text": "如果我们通过某种方式劫持了通过用户UAC验证的程序，那么相应的我们的程序也就实现了提权的过程。"}
{"title": "惊讶！微软开发自己的Linux 操作系统", "url": "https://www.freebuf.com/news/78984.html", "time": "2015-09-21", "level": "", "num_look": 209540, "num_comment": 8, "author": "arain", "tags": ["资讯"], "text": "这款系统叫作Azure Cloud Switch (ACS)，用来确保微软数据中心交换机等网络设备的正常运行。"}
{"title": "D-Link的“福利”：开源固件包里放私钥彩蛋", "url": "https://www.freebuf.com/news/78979.html", "time": "2015-09-20", "level": "金币+10", "num_look": 165600, "num_comment": 3, "author": "dawner", "tags": ["资讯"], "text": "恶意软件开发者并不是每一次都需要为他们的恶意软件来窃取或者购买一个有效的代码签名证书，有时候制造厂商在无意中的泄露，就会给黑客提供了便利。"}
{"title": "小心访问：WordPress平台网站正受到攻击", "url": "https://www.freebuf.com/news/78740.html", "time": "2015-09-20", "level": "", "num_look": 319016, "num_comment": 4, "author": "亲爱的兔子", "tags": ["WEB安全", "漏洞"], "text": "最新报道称攻击者已经成功劫持上千使用WordPress平台的网站，同时利用恶意软件程序攻击不知情的网站访问者。"}
{"title": "反向Shell与Windows多媒体中心远程执行漏洞（CVE-2015-2509）利用", "url": "https://www.freebuf.com/vuls/78760.html", "time": "2015-09-20", "level": "", "num_look": 285236, "num_comment": 11, "author": "I12016", "tags": ["漏洞"], "text": "在本文中，我们会简单介绍反向shell和CVE-2015-2509漏洞，最后详细介绍该漏洞的方法。"}
{"title": "最易被黑客攻击汽车：吉普切诺基、英菲尼迪Q50、凯迪拉克普锐斯、福特Fusion", "url": "https://www.freebuf.com/news/78873.html", "time": "2015-09-20", "level": "", "num_look": 151592, "num_comment": 3, "author": "鸢尾", "tags": ["资讯"], "text": "吉普-切诺基2014，英菲尼迪-Q50 2014，凯迪拉克-凯雷德2015，丰田-普锐斯2010款和2014款，福特-Fusion（福特蒙迪欧的欧版）2014上榜。"}
{"title": "致爱喝咖啡的你：星巴克官网曝严重漏洞，会员账户存盗窃风险（视频）", "url": "https://www.freebuf.com/news/78947.html", "time": "2015-09-20", "level": "", "num_look": 251713, "num_comment": 3, "author": "dawner", "tags": ["资讯"], "text": "如果你在星巴克网站注册过会员，那么建议你得改密码了。"}
{"title": "涅槃团队：Xcode幽灵病毒存在恶意下发木马行为", "url": "https://www.freebuf.com/vuls/78945.html", "time": "2015-09-19", "level": "红色标题", "num_look": 583221, "num_comment": 40, "author": "360NirvanTeam", "tags": ["漏洞"], "text": "360 Nirvan Team 团队还原了恶意iOS应用与C2服务器的通信协议，从而可以实际测试受感染的iOS应用哪些恶意行为"}
{"title": "迷雾重重：XcodeGhost究竟是恶意病毒还是“无害的实验”？", "url": "https://www.freebuf.com/news/78862.html", "time": "2015-09-19", "level": "红色标题", "num_look": 617630, "num_comment": 23, "author": "0xroot", "tags": ["头条", "系统安全"], "text": "号称影响了超过1亿用户（保守估计）的后门鬼魅，一句“苦逼iOS开发者的意外发现”就可以推脱？"}
{"title": "更多思科路由器发现后门：中国有4台", "url": "https://www.freebuf.com/news/78730.html", "time": "2015-09-19", "level": "", "num_look": 413736, "num_comment": 11, "author": "哆啦A梦", "tags": ["终端安全", "资讯"], "text": "安全公司FireEye前两天刚刚发布报告称在四个国家的14台思科路由器上发现SYNful Knock后门程序，现在又发现79台路由器存在相同后门。"}
{"title": "平安金科招聘信息安全高级工程师", "url": "https://www.freebuf.com/jobs/78651.html", "time": "2015-09-19", "level": "", "num_look": 198857, "num_comment": 5, "author": "rake1", "tags": ["安全招聘"], "text": ""}
{"title": "铁虎行动（Operation Iron Tiger）：已窃取美国国防部上亿份数据", "url": "https://www.freebuf.com/news/78798.html", "time": "2015-09-19", "level": "", "num_look": 269253, "num_comment": 19, "author": "森碟", "tags": ["安全报告", "资讯"], "text": "关于攻击者，趋势再次将矛头指向中国，但并未提供证据。"}
{"title": "席卷全球的幽灵推（Ghost Push）病毒分析报告", "url": "https://www.freebuf.com/articles/terminal/78781.html", "time": "2015-09-18", "level": "", "num_look": 548525, "num_comment": 29, "author": "金山毒霸", "tags": ["安全报告", "终端安全"], "text": "这是一枚每日感染量超过60万，号称“史上最牛”的手机病毒。"}
{"title": "Xcode木马样本分析及被挂马的红包插件", "url": "https://www.freebuf.com/articles/terminal/78808.html", "time": "2015-09-18", "level": "", "num_look": 706659, "num_comment": 29, "author": "360安全", "tags": ["终端安全", "网络安全"], "text": "通过我们对Top1000 的扫描，发现以下app版本受影响"}
{"title": "Dukes APT 组织：7年来一直被俄罗斯政府撑腰的APT组织", "url": "https://www.freebuf.com/news/78728.html", "time": "2015-09-18", "level": "", "num_look": 184595, "num_comment": 2, "author": "简单", "tags": ["安全报告", "资讯"], "text": "F-Secure的安全研究员发布了一个特别有意思的报告，报告中详细阐明了名为Dukes的俄罗斯APT组织的网络间谍活动；另外，安全研究员们还推测该组织的后台是俄罗斯政府。"}
{"title": "浅析大规模DDOS防御架构：应对T级攻防", "url": "https://www.freebuf.com/articles/network/78660.html", "time": "2015-09-18", "level": "", "num_look": 662676, "num_comment": 15, "author": "ayazero", "tags": ["网络安全"], "text": "在讲防御之前简单介绍一下各类攻击，因为DDOS是一类攻击而并不是一种攻击，并且DDOS的防御是一个可以做到相对自动化但做不到绝对自动化的过程，很多演进的攻击方式自动化不一定能识别，还是需要进一步的专家肉眼判…"}
{"title": "玩转树莓派：OpenHAB的入门（一）", "url": "https://www.freebuf.com/geek/78452.html", "time": "2015-09-18", "level": "金币+7", "num_look": 450492, "num_comment": 4, "author": "江湖小吓", "tags": ["极客"], "text": "如果你对那些仅仅只是为了控制一盏灯而不得不下载一个特定的App的智能家居感到厌烦，这里有个好消息。"}
{"title": "Symbolic Link漏洞简单背景介绍", "url": "https://www.freebuf.com/vuls/78649.html", "time": "2015-09-18", "level": "", "num_look": 274263, "num_comment": 4, "author": "360安全", "tags": ["漏洞", "系统安全"], "text": "360Vulcan Team也发现了多个使用Symbolic Link绕过EPM沙盒的漏洞，在今年的HITCON安全会议上，我们就公开了我们发现的CVE-2014-6322等沙盒绕过漏洞，包括一个未公开的EPM沙盒绕过漏洞。"}
{"title": "ELK大数据查询系列：Elasticsearch与Logstash基础篇", "url": "https://www.freebuf.com/sectool/78225.html", "time": "2015-09-18", "level": "红色标题", "num_look": 911277, "num_comment": 11, "author": "漏洞盒子安全团队", "tags": ["工具"], "text": "最近漏洞盒子团队内部研究项目用到了海量数据查询，使用到了elasticsearch，由于目前网上资料较少，于是自己写了篇文章，记录在搭建的时候遇到的各种问题及解决办法。"}
{"title": "AirDrop漏洞：数百万苹果设备可被默默安装恶意应用", "url": "https://www.freebuf.com/news/78625.html", "time": "2015-09-18", "level": "", "num_look": 176302, "num_comment": 2, "author": "简单", "tags": ["资讯"], "text": "AirDrop文件传输功能上存在一个漏洞，恶意应用程序可以默默的安装在数百万的Apple设备上，并替换合法app。"}
{"title": "44CON议题《攻击 VxWorks：从石器时代到星际》探究", "url": "https://www.freebuf.com/vuls/78277.html", "time": "2015-09-18", "level": "现金奖励", "num_look": 594501, "num_comment": 10, "author": "丝绸之路", "tags": ["漏洞", "系统安全"], "text": "在2015年9月9日-11日举办的“44 CON 伦敦”峰会中，议题众多，本文将针对“攻击 VxWorks”这个议题进行学习研究。"}
{"title": "iOS漏洞可导致Apple ID被盗", "url": "https://www.freebuf.com/vuls/78595.html", "time": "2015-09-18", "level": "", "num_look": 405169, "num_comment": 7, "author": "阿里聚安全", "tags": ["漏洞", "系统安全"], "text": "在今天发布的iOS 9的升级中，Apple修复了阿里巴巴移动安全团队所发现的三处安全漏洞：CVE-2015-5838, CVE-2015-5834, CVE-2015-5868。"}
{"title": "php小脚本：利用搜索引擎来进行漏洞批量抓取", "url": "https://www.freebuf.com/sectool/78634.html", "time": "2015-09-17", "level": "金币+7", "num_look": 472184, "num_comment": 15, "author": "Dreamdroid", "tags": ["工具"], "text": ""}
{"title": "黑产无间道：黑产威胁情报工作实战", "url": "https://www.freebuf.com/news/topnews/78522.html", "time": "2015-09-17", "level": "现金奖励", "num_look": 632951, "num_comment": 13, "author": "匿名用户", "tags": ["其他", "头条"], "text": ""}
{"title": "2015阿里移动安全挑战赛（第二届）开战在即", "url": "https://www.freebuf.com/fevents/78521.html", "time": "2015-09-17", "level": "", "num_look": 189264, "num_comment": 3, "author": "阿里聚安全", "tags": ["活动"], "text": ""}
{"title": "大数据可视化设计案例分析", "url": "https://www.freebuf.com/articles/neopoints/78488.html", "time": "2015-09-17", "level": "", "num_look": 386321, "num_comment": 8, "author": "绿盟科技", "tags": ["观点"], "text": "大数据可视化是个热门话题，在信息安全领域，数据可视化已经成为网络安全技术的一个重要趋势。"}
{"title": "PfSense XSS漏洞分析", "url": "https://www.freebuf.com/vuls/78561.html", "time": "2015-09-17", "level": "", "num_look": 289822, "num_comment": 4, "author": "I12016", "tags": ["漏洞", "系统安全"], "text": "本文详细介绍了安全研究人员在PfSense中发现的一些XSS漏洞，希望对读者朋友们有所帮助。"}
{"title": "如何阻止微软强制更新你的操作系统", "url": "https://www.freebuf.com/articles/system/78456.html", "time": "2015-09-17", "level": "金币+8", "num_look": 337797, "num_comment": 14, "author": "亲爱的兔子", "tags": ["系统安全"], "text": "本文会介绍如何阻止微软强迫下载Win10更新文件，或者如何删除已经下载的Win10更新文件。"}
{"title": "FreeBuf全球安全事件纵览（2015年8月）：黎明", "url": "https://www.freebuf.com/news/78481.html", "time": "2015-09-17", "level": "红色标题", "num_look": 346672, "num_comment": 10, "author": "简单", "tags": ["头条", "安全报告"], "text": "已经记不清是第几日在第一抹阳光出现的时候醒来，蔚蓝的天空中吹来一丝凉意，没有喧嚣，没有鸟叫，除了电缆中散发的丝丝声响，在这个时分里，一切都是静止的。"}
{"title": "Android 5.x漏洞：黑客可以绕过屏幕密码进入系统", "url": "https://www.freebuf.com/articles/terminal/78455.html", "time": "2015-09-17", "level": "", "num_look": 391888, "num_comment": 17, "author": "Sphinx", "tags": ["终端安全"], "text": "攻击者可以通过漏洞获取上锁设备的全部权限：通过输入超长的字符串导致锁屏和相机的崩溃，然后直接进入主屏。"}
{"title": "心脏滴血远去了吗？20万设备仍受威胁", "url": "https://www.freebuf.com/news/78463.html", "time": "2015-09-16", "level": "", "num_look": 207937, "num_comment": 10, "author": "简单", "tags": ["资讯"], "text": "HeartBleed已经是过去式了吗？NO！事隔一年多之后，臭名昭著的HeartBleed安全漏洞并没有完全消失，仍然对20万的网络设备存在安全威胁。"}
{"title": "Debian新版发布：修复PHP和VirtualBox漏洞", "url": "https://www.freebuf.com/news/78369.html", "time": "2015-09-16", "level": "", "num_look": 183212, "num_comment": 3, "author": "空白", "tags": ["漏洞", "资讯"], "text": "Debian的维护者已经发布了新版本的操作系统来解决存在的多个漏洞，其中包括几个PHP漏洞以及VirtualBox应用程序中的一个漏洞。"}
{"title": "FBI 警告：让物联网设备远离网络", "url": "https://www.freebuf.com/news/78419.html", "time": "2015-09-16", "level": "", "num_look": 309262, "num_comment": 5, "author": "月球下雨了", "tags": ["终端安全", "资讯"], "text": "FBI近日发布一份声明，提醒消费者当心物联网带来的网络犯罪风潮。"}
{"title": "永不消逝的电波（一）：无线电入门篇", "url": "https://www.freebuf.com/articles/wireless/77819.html", "time": "2015-09-16", "level": "红色标题", "num_look": 2059823, "num_comment": 49, "author": "吃葡萄不吐葡萄皮的雪碧", "tags": ["无线安全", "极客"], "text": "国家对无线电台实行“少设严管”的政策，无线电台成为军队、邮电、广播、公安和交通等国家要害部门进行信息通信的重要工具。"}
{"title": "漏洞盒子八月“互联网漏洞之星”", "url": "https://www.freebuf.com/vuls/78316.html", "time": "2015-09-16", "level": "红色标题", "num_look": 364487, "num_comment": 9, "author": "漏洞盒子", "tags": ["活动", "漏洞"], "text": "漏洞盒子8月“互联网漏洞之星”名单公布！"}
{"title": "搜狗安全招聘信息安全工程师", "url": "https://www.freebuf.com/jobs/78306.html", "time": "2015-09-16", "level": "", "num_look": 200956, "num_comment": 18, "author": "空白天空", "tags": ["安全招聘"], "text": "搜狗是中国互联网领先的搜索、输入法、浏览器和其它互联网产品及服务提供商。"}
{"title": "恶意代码的静态分析技术", "url": "https://www.freebuf.com/articles/system/78057.html", "time": "2015-09-16", "level": "金币+8", "num_look": 547573, "num_comment": 12, "author": "月尽西楼", "tags": ["系统安全"], "text": "静态分析技术通常是研究恶意代码的第一步，是分析程序指令与结构来确定功能的过程。"}
{"title": "麻省理工学院、南加大等美国名校的网络安全：勉强及格", "url": "https://www.freebuf.com/news/78336.html", "time": "2015-09-16", "level": "", "num_look": 279774, "num_comment": 8, "author": "小太阳花", "tags": ["数据安全", "资讯"], "text": "近日一份关于全美高等教育安全状况的报告发布，令人惊讶的是，以科技见长的麻省理工学院（MIT）竟然排名垫底，获得61%的最低分。"}
{"title": "KVM虚拟化新型漏洞CVE-2015-6815技术分析", "url": "https://www.freebuf.com/vuls/77834.html", "time": "2015-09-15", "level": "", "num_look": 507571, "num_comment": 10, "author": "360MarvelTeam", "tags": ["漏洞"], "text": "作为云服务的基础，虚拟化系统扮演着非常重要的角色，因为在云生态中主机的硬件多是由虚拟化系统模拟出来的。"}
{"title": "还敢用智能手表吗？三星Gear Live会泄露用户数据", "url": "https://www.freebuf.com/news/78329.html", "time": "2015-09-15", "level": "", "num_look": 167129, "num_comment": 8, "author": "简单", "tags": ["资讯"], "text": "三星Gear Live会泄露用户数据，你还敢用智能手表吗？"}
{"title": "伽利略远程监控系统完全安装指南", "url": "https://www.freebuf.com/news/topnews/78181.html", "time": "2015-09-15", "level": "金币+8", "num_look": 1599709, "num_comment": 156, "author": "RAyH4c", "tags": ["头条", "系统安全"], "text": "7月初，外媒用臭名昭著形容意大利的网络军火商公司hacking team及其被黑事件，黑吃黑的黑客将该公司rcs系统的安装程序、源代码和邮件打包供所有人下载，更有人在github上用hackedteam打趣存储这些资料。"}
{"title": "44CON伦敦：英国最大安全会议议题集合", "url": "https://www.freebuf.com/news/78210.html", "time": "2015-09-15", "level": "", "num_look": 238465, "num_comment": 4, "author": "哆啦A梦", "tags": ["头条", "资讯"], "text": "44CON，现在称作44CON 伦敦，是英国最大的综合年度安全会议和培训活动。"}
{"title": "【补招】斗象科技（FreeBuf、漏洞盒子）招聘强势开启", "url": "https://www.freebuf.com/jobs/72884.html", "time": "2015-09-15", "level": "红色标题", "num_look": 976621, "num_comment": 69, "author": "FB客服", "tags": ["安全招聘"], "text": "我们是一家年轻的互联网安全公司，在做着一些靠谱的事情，努力于安全领域开辟一片蓝海并已初具成果。"}
{"title": "从黑客角度深入剖析跨站请求伪造（CSRF）", "url": "https://www.freebuf.com/vuls/78156.html", "time": "2015-09-15", "level": "金币+8", "num_look": 515192, "num_comment": 11, "author": "I12016", "tags": ["漏洞", "网络安全"], "text": "对于Web应用测试来说，通过人工方式分析代码是非常重要的一种测试手段。"}
{"title": "【更新视频回播】FreeBuf公开课（直播课程）：POWERSHELL内网渗透实例", "url": "https://www.freebuf.com/articles/web/77233.html", "time": "2015-09-15", "level": "金币+8", "num_look": 812971, "num_comment": 41, "author": "1ight", "tags": ["WEB安全", "视频"], "text": "本次公开课面向广大基础学习用户，9月9日（本周三）晚，不见不散。"}
{"title": "HackPwn：九阳智能豆浆机破解细节分析", "url": "https://www.freebuf.com/articles/terminal/78196.html", "time": "2015-09-14", "level": "", "num_look": 801037, "num_comment": 45, "author": "360安全", "tags": ["终端安全"], "text": "九阳DJ08B-D667SG豆浆机是一款智能豆浆机，可以通过配置WIFI连入互联网，用户可以通过“九阳云家电”手机app对豆浆机进行远程控制，实现远程开启、关闭豆浆机等功能。"}
{"title": "SUCEFUL：将ATM变得“惟命是从”的新型恶意程序", "url": "https://www.freebuf.com/articles/terminal/78157.html", "time": "2015-09-14", "level": "", "num_look": 236386, "num_comment": 9, "author": "晶颜123", "tags": ["终端安全"], "text": "近日，美国网络安全公司FireEye的专家发现了一种针对ATM自动取款机的新型恶意程序——SUCEFUL。"}
{"title": "英国政府邮箱系统遭ISIS攻击，皇家机密泄露", "url": "https://www.freebuf.com/news/78142.html", "time": "2015-09-14", "level": "", "num_look": 162049, "num_comment": 7, "author": "简单", "tags": ["资讯"], "text": "根据英国政府通信总部（GCHQ）披露，ISIS恐怖组织劫持了英国政府的机密邮件。内阁中多名部长的邮箱均遭到了攻击，包括内阁大臣Theresa May。"}
{"title": "一黑客团队声称破解1100万偷情网站Ashley Madison的散列密码", "url": "https://www.freebuf.com/news/78063.html", "time": "2015-09-14", "level": "金币+8", "num_look": 197563, "num_comment": 4, "author": "江湖小吓", "tags": ["资讯"], "text": "一个自称CynoSure Prime的黑客团队声称，在刚刚过去的10天里已经破解了上超过1100万使用Bcrypt算法的散列密码。"}
{"title": "安全运维利器：文件系统检测工具AIDE", "url": "https://www.freebuf.com/sectool/78065.html", "time": "2015-09-14", "level": "", "num_look": 276258, "num_comment": 2, "author": "dawner", "tags": ["工具", "系统安全"], "text": "AIDE(Advanced Intrusion Detection Environment)是一款针对文件和目录进行完整性对比检查的程序，它被开发成Tripwire的一个替代品。"}
{"title": "蘑菇街招聘安全架构师+工程师", "url": "https://www.freebuf.com/news/77987.html", "time": "2015-09-14", "level": "", "num_look": 282705, "num_comment": 27, "author": "空白", "tags": ["资讯"], "text": ""}
{"title": "五角大楼又被黑，美国很愤怒", "url": "https://www.freebuf.com/news/78056.html", "time": "2015-09-14", "level": "", "num_look": 349821, "num_comment": 4, "author": "江湖小吓", "tags": ["资讯"], "text": "五角大楼又被黑了，这一次被黑的五角大楼美食广场电脑暴露了员工的银行信息。"}
{"title": "渗透测试神器Burpsuite Pro v1.6.24（含下载）", "url": "https://www.freebuf.com/sectool/77272.html", "time": "2015-09-13", "level": "金币+8", "num_look": 820948, "num_comment": 45, "author": "legendsec", "tags": ["工具"], "text": "Burp Suite允许攻击者结合手工和自动技术去枚举、分析、攻击Web应用程序。"}
{"title": "玩转Win 10的哈希及明文密码", "url": "https://www.freebuf.com/sectool/77846.html", "time": "2015-09-13", "level": "", "num_look": 608854, "num_comment": 16, "author": "明明知道", "tags": ["工具", "系统安全"], "text": "本文中，我将就Win 10系统中hash以及明文密码提取的一些发现进行分享。"}
{"title": "BlackHat议题：利用卫星接收器拓展僵尸网络", "url": "https://www.freebuf.com/articles/system/77932.html", "time": "2015-09-12", "level": "现金奖励", "num_look": 685711, "num_comment": 7, "author": "月尽西楼", "tags": ["系统安全", "网络安全"], "text": "新生的机顶盒（STBs）属于嵌入式Linux卫星电视接收器，有所有类Linux机器的特性，这就足够黑客破解大多数卫星DVB-CA接收卡的加密策略并发展黑色产业链。"}
{"title": "间谍新高度：间谍组织​Turla利用卫星通信隐藏C&C服务器", "url": "https://www.freebuf.com/news/77816.html", "time": "2015-09-12", "level": "金币+8", "num_look": 701470, "num_comment": 6, "author": "简单", "tags": ["网络安全", "资讯"], "text": "卡巴斯基实验室发现Turla APT组织利用卫星通信隐藏自己的C&C服务器位置，进而实施间谍活动。"}
{"title": "绿盟科技2015软件定义安全SDS白皮书发布", "url": "https://www.freebuf.com/vuls/77969.html", "time": "2015-09-12", "level": "", "num_look": 240225, "num_comment": 6, "author": "绿盟科技", "tags": ["其他", "安全报告"], "text": ""}
{"title": "美保险公司Excellus被黑客入侵，影响上千万用户", "url": "https://www.freebuf.com/news/78026.html", "time": "2015-09-11", "level": "", "num_look": 161164, "num_comment": 7, "author": "简单", "tags": ["资讯"], "text": "美国保险公司Excellus的服务器被黑客入侵，上千万用户的私人信息存在泄露风险。"}
{"title": "“贴心”微软：无论升不升Win10，更新文件自动下载", "url": "https://www.freebuf.com/news/78024.html", "time": "2015-09-11", "level": "", "num_look": 316101, "num_comment": 23, "author": "Sphinx", "tags": ["资讯"], "text": "Windows 10已经推出了一个多月，微软为了推广新系统推出了不少新政策，现在Windows Update会自动下载Windows 10的更新文件，不管你有没有选择升级。"}
{"title": "阿里云安全Open API编程比赛诚邀小伙伴参加", "url": "https://www.freebuf.com/fevents/77949.html", "time": "2015-09-11", "level": "", "num_look": 232084, "num_comment": 5, "author": "阿里安全", "tags": ["活动"], "text": "阿里云开源编程马拉松赛——安全类Open API比赛已正式开放报名。几百家媒体，天使、风投、众筹。。。"}
{"title": "SQLMap的前世今生（Part1）", "url": "https://www.freebuf.com/sectool/77948.html", "time": "2015-09-11", "level": "", "num_look": 529705, "num_comment": 18, "author": "安全豹", "tags": ["工具", "系统安全"], "text": "谈到SQL注入，第一时间就会想到神器SQLMAP，SQLMap是一款用来检测与利用的SQL注入开源工具。"}
{"title": "沿街扫描软件：让偷智能设备的人在劫难逃", "url": "https://www.freebuf.com/news/77936.html", "time": "2015-09-11", "level": "金币+5", "num_look": 425995, "num_comment": 19, "author": "dawner", "tags": ["无线安全", "资讯"], "text": "现在我们可以通过扫描嗅探MAC地址，进行被盗设备的追踪。"}
{"title": "用中国移动手机分享热点，小心你的邮件泄露", "url": "https://www.freebuf.com/news/77795.html", "time": "2015-09-11", "level": "红色标题", "num_look": 720284, "num_comment": 25, "author": "漏洞盒子", "tags": ["头条", "资讯"], "text": "利用该漏洞，任何连接你手机热点的人，都可以随意登录并操作你的移动邮箱和移动梦网。"}
{"title": "小米、华为、联想等多家国产品牌手机被经销商预装间谍应用的研究", "url": "https://www.freebuf.com/vuls/77905.html", "time": "2015-09-11", "level": "", "num_look": 473751, "num_comment": 9, "author": "阿里聚安全", "tags": ["漏洞", "系统安全"], "text": "根据德国安全厂商GDATA放出的2015年Q2移动恶意病毒报告中指出：市场上至少有26款的Android手机在卖给消费者时藏有恶意程式"}
{"title": "自动化移动安全渗透测试框架：Mobile Security Framework", "url": "https://www.freebuf.com/sectool/77803.html", "time": "2015-09-11", "level": "", "num_look": 538841, "num_comment": 22, "author": "Sphinx", "tags": ["工具"], "text": "Mobile Security Framework (移动安全框架) 是一款智能、一体化的开源移动应用(Android/iOS)自动渗透测试框架，它能进行静态、动态的分析。"}
{"title": "上海柯力士招聘网络信息安全工程师", "url": "https://www.freebuf.com/jobs/76981.html", "time": "2015-09-10", "level": "", "num_look": 214649, "num_comment": 17, "author": "上海柯力士信息安全技术有限公司", "tags": ["安全招聘"], "text": "上海柯力士信息安全技术有限公司是一家国内领先的信息安全服务供应商。"}
{"title": "老式后门之美：五种复古远程控制工具（含下载）", "url": "https://www.freebuf.com/sectool/77740.html", "time": "2015-09-10", "level": "", "num_look": 450528, "num_comment": 18, "author": "明明知道", "tags": ["工具", "系统安全"], "text": "尽管各式花样翻新的技术与代码层出不穷，可你还记得曾经用过的那些后门吗？"}
{"title": "自动化渗透测试的侦察扫描仪：sn1per", "url": "https://www.freebuf.com/sectool/77754.html", "time": "2015-09-10", "level": "金币+5", "num_look": 395182, "num_comment": 17, "author": "帅气凌云", "tags": ["工具"], "text": "sn1per是一个自动化渗透测试侦察扫描仪可以渗透测试和漏洞扫描过程中使用枚举。"}
{"title": "BlackHat议题： SMB不只是共享你的文件", "url": "https://www.freebuf.com/vuls/77762.html", "time": "2015-09-10", "level": "现金奖励", "num_look": 366464, "num_comment": 4, "author": "月尽西楼", "tags": ["漏洞", "系统安全"], "text": "在本文中，我们展示了一种新的攻击方法破解Windows的SSO特性，影响了Windwos的所有版本包括最新的win10 微软的SMB协议"}
{"title": "105个安全公告：微软2015年公布漏洞数远超去年", "url": "https://www.freebuf.com/news/77760.html", "time": "2015-09-10", "level": "", "num_look": 136633, "num_comment": 4, "author": "江湖小吓", "tags": ["资讯"], "text": ""}
{"title": "解密", "url": "https://www.freebuf.com/articles/system/77631.html", "time": "2015-09-10", "level": "金币+5", "num_look": 258278, "num_comment": 4, "author": "丝绸之路", "tags": ["系统安全"], "text": "最近，我注意到一个讨论Qadars银行木马的论坛主题，Qadars银行木马VirusTotal的检测率非常低(4/56)，我觉得它是一个很合适进行深层次技术探究的候选对象。"}
{"title": "Kirby CMS多枚漏洞分析", "url": "https://www.freebuf.com/news/77519.html", "time": "2015-09-10", "level": "", "num_look": 197961, "num_comment": 3, "author": "鸢尾", "tags": ["漏洞", "资讯"], "text": "Kirby CMS 是一个易用、易安装和设置的非常灵活的CMS系统，无需数据库支持，使用文件系统存储。支持Markdown语法、模板和插件。"}
{"title": "国网智研院公开招聘信息安全渗透、逆向、监测分析人员", "url": "https://www.freebuf.com/jobs/77393.html", "time": "2015-09-09", "level": "", "num_look": 343461, "num_comment": 70, "author": "secsgri", "tags": ["安全招聘"], "text": "在信息安全领域，国网智研院主要从事电网信息安全体系架构设计，关键核心安全防护装备和系统研发，开展智能电网信息系统安全渗透、漏洞挖掘、监测预警分析技术研究。"}
{"title": "Gcat：使用Gmail控制管理的Python后门", "url": "https://www.freebuf.com/sectool/77596.html", "time": "2015-09-09", "level": "金币+8", "num_look": 270206, "num_comment": 8, "author": "鸢尾", "tags": ["工具"], "text": "Gcat是一款使用Gmail控制管理的Python隐形后门。"}
{"title": "Django任意代码执行0day漏洞分析", "url": "https://www.freebuf.com/vuls/77591.html", "time": "2015-09-09", "level": "", "num_look": 485045, "num_comment": 10, "author": "绿盟科技", "tags": ["漏洞"], "text": "从Django的SECTET_KEY到代码执行。Django是一个可以用于快速搭建高性能，优雅的网站的平台，由Python写成。"}
{"title": "白细胞安全团队《新·安全》广州沙龙", "url": "https://www.freebuf.com/fevents/77637.html", "time": "2015-09-09", "level": "", "num_look": 358235, "num_comment": 33, "author": "SAINTSEC TEAM", "tags": ["活动"], "text": "由白细胞安全团队与阿里安全应急响应中心ASRC、百度安全应急响应中心BSRC联合举办，FreeBuf媒体支持的《新·安全》沙龙将于2015年9月19日在广州举行。"}
{"title": "成人播放器偷拍用户私密照片进行勒索", "url": "https://www.freebuf.com/news/77614.html", "time": "2015-09-09", "level": "金币+8", "num_look": 518543, "num_comment": 14, "author": "江湖小吓", "tags": ["终端安全", "资讯"], "text": "这个成人播放器虽然名义上是向用户提供色情内容，但实际上是通过手机的前置摄像头对受害者拍照。"}
{"title": "WhatsApp曝WEB电子名片漏洞 影响数亿用户", "url": "https://www.freebuf.com/news/77634.html", "time": "2015-09-09", "level": "", "num_look": 290565, "num_comment": 6, "author": "dawner", "tags": ["WEB安全", "漏洞"], "text": "安全公司Check Point发现，社交应用WhatsApp出现了一个web漏洞，多达两亿用户遭受影响。"}
{"title": "盘古披露iOS8.4.1内核漏洞 苹果于iOS9中修复部分", "url": "https://www.freebuf.com/news/77616.html", "time": "2015-09-09", "level": "", "num_look": 266950, "num_comment": 2, "author": "Jason0818", "tags": ["系统安全", "终端安全"], "text": ""}
{"title": "Solaris修改指定进程的cr_uid", "url": "https://www.freebuf.com/articles/terminal/77592.html", "time": "2015-09-09", "level": "", "num_look": 287951, "num_comment": 2, "author": "绿盟科技", "tags": ["系统安全", "终端安全"], "text": "Solaris上用MDB修改指定进程的EUID，本文就是解释如何用MDB看一下内核数据结构，具体到这里就是proc_t p_cred->cr_uid。当然，各位内行可以自行发散其意义，开脑洞。"}
{"title": "BurpSuite下一代渗透检测工具：BurpKit", "url": "https://www.freebuf.com/sectool/77436.html", "time": "2015-09-09", "level": "", "num_look": 396231, "num_comment": 14, "author": "小太阳花", "tags": ["工具"], "text": "作为其丰富的功能之一，插件BurpKit提供了双向JavaScript桥梁API，允许用户在同一时间迅速创建能够直接与DOM交互的BurpSuite插件，以及Burp的扩展API。"}
{"title": "安全研究员曝光FireEye核心产品0day漏洞", "url": "https://www.freebuf.com/news/77543.html", "time": "2015-09-08", "level": "", "num_look": 192567, "num_comment": 1, "author": "明明知道", "tags": ["漏洞", "资讯"], "text": "近日，研究人员Kristian Erik Hermansen从FireEye核心产品中发现一个0day漏洞，会导致未经授权的文件泄露。他还提供了一个简短的触发漏洞的例子以及用户数据库文件副本。此外，他还公开兜售其他三个未公开的漏洞。"}
{"title": "瀚思招聘大数据+安全分析人才", "url": "https://www.freebuf.com/jobs/77566.html", "time": "2015-09-08", "level": "", "num_look": 193196, "num_comment": 9, "author": "跳动的心", "tags": ["安全招聘"], "text": "瀚思（HanSight）是国内领先的大数据安全分析初创公司，致力于以大数据的收集、处理与分析技术为驱动，帮助企业实时、自动侦测已经发生或即将发生的内部与外部安全威胁"}
{"title": "小试牛刀：iOS去广告入门实战", "url": "https://www.freebuf.com/articles/terminal/77386.html", "time": "2015-09-08", "level": "现金奖励", "num_look": 340738, "num_comment": 9, "author": "熊猫正正", "tags": ["极客", "终端安全"], "text": ""}
{"title": "美国互联网应急响应中心CERT：希捷无线硬盘出现漏洞", "url": "https://www.freebuf.com/news/77458.html", "time": "2015-09-08", "level": "金币+8", "num_look": 260362, "num_comment": 5, "author": "江湖小吓", "tags": ["无线安全", "漏洞"], "text": "互联网应急中心发布了一则关于希捷无线硬盘的使用警告，因为在该产品中发现有多个漏洞能被攻击者利用来下载磁盘中所有的文件。"}
{"title": "谷歌计划重返中国大陆", "url": "https://www.freebuf.com/news/77474.html", "time": "2015-09-08", "level": "金币+8", "num_look": 278258, "num_comment": 31, "author": "dawner", "tags": ["资讯"], "text": "据悉，互联网巨头谷歌最近在计划将缩水版的Google Play商店，以及安卓穿戴产品引入中国大陆。"}
{"title": "木马的前世今生：上线方式的发展及新型上线方式的实现", "url": "https://www.freebuf.com/articles/terminal/77412.html", "time": "2015-09-08", "level": "现金奖励", "num_look": 968107, "num_comment": 49, "author": "丝绸之路", "tags": ["系统安全", "终端安全"], "text": "远程控制木马大家都不陌生，尤其是早期接触黑客技术的人，应该可以发现早在2007-2009年，这段时间内，国内的“黑客技术”正是蓬勃发展的时期，那个时候，可谓是“战乱纷争，万马奔腾”的年代。"}
{"title": "使用btproxy对蓝牙设备进行安全分析", "url": "https://www.freebuf.com/articles/wireless/77389.html", "time": "2015-09-08", "level": "金币+8", "num_look": 395552, "num_comment": 8, "author": "鸢尾", "tags": ["无线安全", "系统安全"], "text": "最近我比较热衷于调查新技术的安全性能。新设备，尤其是“IoT”领域的新设备，使用蓝牙进行连接的设备。熟悉蓝牙连接方式之后，我就想用明文的方式来看看它的通信数据，有可能的话最好还能修改下其中的数据。"}
{"title": "斯诺登表示留俄并非初衷，希望可以回国", "url": "https://www.freebuf.com/news/77399.html", "time": "2015-09-08", "level": "", "num_look": 178713, "num_comment": 9, "author": "森碟", "tags": ["资讯"], "text": "前美国情报机构雇员斯诺登批评俄罗斯（一个给予其庇护的国家）对人权和网络自由的镇压是根本性的错误，并表示他不愿意在过流亡的生活。"}
{"title": "“短信拦截马”黑色产业链与溯源取证研究", "url": "https://www.freebuf.com/articles/terminal/77331.html", "time": "2015-09-07", "level": "红色标题", "num_look": 1125682, "num_comment": 33, "author": "安全豹", "tags": ["终端安全", "网络安全"], "text": "“短信拦截”木马作为安卓手机病毒中的一类常见样本，近两年来显现出爆发增长的趋势，其背后的黑色产业链也日益发展壮大，已经成为移动支付、网银财产等各环节的焦点安全问题。"}
{"title": "巴克莱银行创建red team，专门攻击自己的系统", "url": "https://www.freebuf.com/news/77329.html", "time": "2015-09-07", "level": "", "num_look": 198275, "num_comment": 4, "author": "简单", "tags": ["系统安全", "资讯"], "text": "巴克莱银行创建了一个红色小组（red team），专门攻击自己的系统，在外部攻击者发现并利用漏洞之前先给予修复。"}
{"title": "HackPwn 2015：SmartCare破解细节分析", "url": "https://www.freebuf.com/news/77340.html", "time": "2015-09-07", "level": "", "num_look": 233462, "num_comment": 3, "author": "360安全", "tags": ["资讯"], "text": ""}
{"title": "打造一个自动检测页面是否存在XSS的插件Ⅱ", "url": "https://www.freebuf.com/sectool/77237.html", "time": "2015-09-07", "level": "现金奖励", "num_look": 456196, "num_comment": 16, "author": "Black-Hole", "tags": ["WEB安全", "工具"], "text": "这一版的变化比上一版有点大，基本等于重写了。因为整个代码的构架被我修改了，更加的直观，及方便修改和定位。"}
{"title": "爱奇艺招聘安全体系工程师", "url": "https://www.freebuf.com/jobs/77286.html", "time": "2015-09-07", "level": "", "num_look": 175293, "num_comment": 18, "author": "cloudbase", "tags": ["安全招聘"], "text": "​爱奇艺，中国视频行业领先者，现招聘安全体系安全工程师。"}
{"title": "一种在恶意软件中常见的字符串和Payload混淆技术", "url": "https://www.freebuf.com/articles/system/77244.html", "time": "2015-09-07", "level": "金币+8", "num_look": 219642, "num_comment": 4, "author": "丝绸之路", "tags": ["系统安全"], "text": "从技术角度来看，这并不是一个复杂的恶意软件。但是它说明了一些恶意软件作者最常用的用于反动态(自动)和静态(手动)分析的技术。"}
{"title": "PayPal修复存储型XSS漏洞", "url": "https://www.freebuf.com/news/77252.html", "time": "2015-09-07", "level": "", "num_look": 196955, "num_comment": 1, "author": "明明知道", "tags": ["漏洞", "资讯"], "text": "BitDefender的安全研究者发现PayPal存储型XSS漏洞，黑客通过漏洞可以对PayPal用户进行多种攻击。"}
{"title": "他山之石：美国的网络安全战略和人才战略简析", "url": "https://www.freebuf.com/articles/neopoints/77246.html", "time": "2015-09-07", "level": "", "num_look": 349637, "num_comment": 8, "author": "360安全", "tags": ["安全报告", "观点"], "text": "美国是全球网络最强国，对全球网络拥有最强的控制力，其网络安全战略最清晰，网络安全能力也最强，不过支撑其网络安全战略和网络安全能力的背后，是其领先的网络人才战略和体系。"}
{"title": "当心！虚假帐户在LinkedIn招聘安全专家", "url": "https://www.freebuf.com/news/77198.html", "time": "2015-09-06", "level": "", "num_look": 165831, "num_comment": 7, "author": "江湖小吓", "tags": ["资讯"], "text": ""}
{"title": "黑客攻破Mozilla Bug跟踪系统库 利用未公开漏洞攻击用户", "url": "https://www.freebuf.com/news/77209.html", "time": "2015-09-06", "level": "", "num_look": 334763, "num_comment": 6, "author": "arain", "tags": ["网络安全", "资讯"], "text": "黑客从Mozilla的Bug跟踪系统Bugzilla成功窃取敏感漏洞信息，并利用未公开漏洞攻击Firefox用户。"}
{"title": "风靡全球的安全应用AppLock，同样可能泄露你的隐私", "url": "https://www.freebuf.com/news/77202.html", "time": "2015-09-06", "level": "", "num_look": 161811, "num_comment": 6, "author": "dawner", "tags": ["资讯"], "text": "安全研究人员发现，DoMobile Ltd.公司开发的知名的安卓安全应用AppLock存在多个漏洞，容易受到黑客攻击。"}
{"title": "基于XMPP协议的新型安卓恶意软件", "url": "https://www.freebuf.com/news/77145.html", "time": "2015-09-06", "level": "", "num_look": 223205, "num_comment": 3, "author": "JackFree", "tags": ["终端安全", "资讯"], "text": "安全研究人员发现一款安卓恶意软件新变种，它伪装成Flash播放器APP诱使用户下载，并以美国国家安全局的名义威胁受害用户缴纳赎金。"}
{"title": "“Carbanak”回来了", "url": "https://www.freebuf.com/news/77110.html", "time": "2015-09-06", "level": "金币+8", "num_look": 468882, "num_comment": 3, "author": "丝绸之路", "tags": ["网络安全", "资讯"], "text": "就在最近，国际战略研究中心(CSIS)进行了取证分析，涉及到Windows客户端被破坏，企图对网上银行交易进行欺诈。"}
{"title": "UPnP曝Filet-O-Firewall漏洞，数百万家庭路由器处于攻击风险之中", "url": "https://www.freebuf.com/news/77057.html", "time": "2015-09-05", "level": "金币+8", "num_look": 283882, "num_comment": 8, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "导致UPnP中漏洞的主要原因在于，其缺乏足够的身份验证机制。"}
{"title": "广告软件利用苹果OS X系统漏洞窃取数据", "url": "https://www.freebuf.com/news/77127.html", "time": "2015-09-05", "level": "", "num_look": 378707, "num_comment": 4, "author": "江湖小吓", "tags": ["漏洞", "系统安全"], "text": "Malwarebytes安全研究人员发现了一个广告软件安装程序正在访问MAC OS X的密码管理系统（Keychain）。"}
{"title": "BWAPP：一款非常好用的漏洞演示平台", "url": "https://www.freebuf.com/sectool/76885.html", "time": "2015-09-05", "level": "金币+8", "num_look": 1979954, "num_comment": 35, "author": "shentouceshi", "tags": ["WEB安全", "工具"], "text": "这是一个集成了各种常见漏洞和最新漏洞的开源Web应用程序，目的是帮助网络安全爱好者、开发人员和学生发现并防止网络漏洞。"}
{"title": "婴儿监视器也不安全，黑掉它其实很容易", "url": "https://www.freebuf.com/news/77096.html", "time": "2015-09-05", "level": "", "num_look": 254232, "num_comment": 4, "author": "JackFree", "tags": ["资讯"], "text": ""}
{"title": "安卓平台Mercury浏览器漏洞分析", "url": "https://www.freebuf.com/vuls/77067.html", "time": "2015-09-05", "level": "", "num_look": 299171, "num_comment": 2, "author": "JackFree", "tags": ["漏洞", "终端安全"], "text": "安卓平台上的Mercury浏览器和其服务器中包含多个漏洞，攻击者可以将这些漏洞结合在一起，在Mercury浏览器的数据目录中执行任意读写文件操作。"}
{"title": "PANDA：下一代动态分析平台", "url": "https://www.freebuf.com/sectool/76665.html", "time": "2015-09-04", "level": "", "num_look": 504295, "num_comment": 11, "author": "鸢尾", "tags": ["安全管理", "工具"], "text": "PANDA是构建于顶级QEMU系统上的新一代动态分析平台，这使得它可以访问所有正在执行的代码并且可在客户虚拟机操作所有数据。"}
{"title": "外媒称小米、华为、联想等26种手机被预装间谍应用", "url": "https://www.freebuf.com/news/77112.html", "time": "2015-09-04", "level": "金币+8", "num_look": 663747, "num_comment": 28, "author": "JackFree", "tags": ["资讯"], "text": ""}
{"title": "WiFi Pineapple的Karma攻击与原理探究", "url": "https://www.freebuf.com/articles/77055.html", "time": "2015-09-04", "level": "", "num_look": 1476006, "num_comment": 25, "author": "安全豹", "tags": ["文章", "无线安全"], "text": "本文将介绍一种不常见的WIFI钓鱼形式——WIFI Pineapple中的Karma功能。"}
{"title": "简洁、多彩和友好：Google换新装了（中文视频）", "url": "https://www.freebuf.com/news/76934.html", "time": "2015-09-03", "level": "", "num_look": 204691, "num_comment": 16, "author": "ysmoe", "tags": ["资讯"], "text": ""}
{"title": "Corebot：一个高度模块化的信息窃取软件", "url": "https://www.freebuf.com/news/76930.html", "time": "2015-09-03", "level": "", "num_look": 168280, "num_comment": 3, "author": "简单", "tags": ["资讯"], "text": "IBM发现了一种新型的数据窃取恶意软件，叫做Corebot。它专门窃取系统、邮件凭证，还有软件密钥，它甚至还可以下载和执行其他的一些恶意程序。"}
{"title": "恩牛（51信用卡管家）招聘信息安全总监", "url": "https://www.freebuf.com/jobs/76990.html", "time": "2015-09-03", "level": "", "num_look": 179503, "num_comment": 8, "author": "Jolyn", "tags": ["安全招聘"], "text": "51信用卡管家是一款具有管理信用卡功能的APP，它通过智能解析信用卡电子账单，来实现持卡人用卡信息管理和个人财务的智能化应用。"}
{"title": "Chrome、Edge、IE和Firefox 明年初将不再支持RC4加密技术", "url": "https://www.freebuf.com/news/77008.html", "time": "2015-09-02", "level": "", "num_look": 367574, "num_comment": 9, "author": "明明知道", "tags": ["WEB安全", "资讯"], "text": "9月1日，谷歌、微软以及Mozilla公司同时宣布明年将不再支持日薄西山的RC4加密算法。"}
{"title": "Empire：PowerShell后期漏洞利用代理工具", "url": "https://www.freebuf.com/articles/web/76892.html", "time": "2015-09-02", "level": "金币+8", "num_look": 966262, "num_comment": 8, "author": "丝绸之路", "tags": ["WEB安全", "系统安全"], "text": "Empire是一个纯碎的PowerShell后期漏洞利用代理工具，它建立在密码学、安全通信和灵活的架构之上。Empire实现了无需powershell.exe就可运行PowerShell代理的功能。"}
{"title": "师傅：攻击14家日本银行的“大师级”新型银行木马", "url": "https://www.freebuf.com/news/76913.html", "time": "2015-09-02", "level": "金币+8", "num_look": 312086, "num_comment": 19, "author": "丝绸之路", "tags": ["安全报告", "系统安全"], "text": "一种新型的高级的银行木马被IBM安全团队X-Force发现并命名为“师傅”(Shifu)。该木马直到2015年4月被发现前一直很活跃。“师傅”目前针对日本14家银行和整个欧洲的电子银行平台。"}
{"title": "Android程序的反编译对抗研究", "url": "https://www.freebuf.com/sectool/76884.html", "time": "2015-09-02", "level": "现金奖励", "num_look": 857631, "num_comment": 25, "author": "安全豹", "tags": ["工具", "极客"], "text": "对抗反编译是指让apk文件或者dex文件无法正常通过反编译工具，而且有可能导致工具异常或者崩溃，如apktool、baksmali、dex2jar、JEB等等工具"}
{"title": "FreeBuf与ISC 2015深度合作，独家承办“APT与新威胁论坛”", "url": "https://www.freebuf.com/news/76866.html", "time": "2015-09-02", "level": "红色标题", "num_look": 364486, "num_comment": 17, "author": "FB独家", "tags": ["活动", "资讯"], "text": "FreeBuf今年与ISC深度合作，独家承办2015ISC “APT与新威胁论坛”。"}
{"title": "ColdFusion爆炸：从XSS到RCE的连锁反应", "url": "https://www.freebuf.com/vuls/76677.html", "time": "2015-09-02", "level": "", "num_look": 311617, "num_comment": 4, "author": "鸢尾", "tags": ["WEB安全", "漏洞"], "text": "在审计ColdFusion 10 以及11的管理面板期间，我发现一个基于DOM的跨站脚本漏洞。"}
{"title": "我是如何发现Google服务器上的LFI漏洞的", "url": "https://www.freebuf.com/vuls/76739.html", "time": "2015-09-02", "level": "", "num_look": 512848, "num_comment": 9, "author": "Sphinx", "tags": ["WEB安全", "漏洞"], "text": "本文将介绍如何利用本地文件包含漏洞读取Google某服务器上的任意文件。漏洞存在于Google的Feedburner中，在提交漏洞后，Google安全团队迅速修复了这一漏洞。"}
{"title": "谷歌为开发者操碎了心：想方设法帮其绕过iOS 9加密", "url": "https://www.freebuf.com/news/76760.html", "time": "2015-09-01", "level": "金币+8", "num_look": 238961, "num_comment": 10, "author": "0xroot", "tags": ["资讯"], "text": "即将于本月发布的新系统iOS 9中，苹果将允许用户在iphone和Ipad上安装广告屏蔽应用，此举将给发行商造成困扰"}
{"title": "逆向路由器固件之SQL注入（Part3）", "url": "https://www.freebuf.com/vuls/76755.html", "time": "2015-09-01", "level": "金币+5", "num_look": 305312, "num_comment": 7, "author": "xd_xd", "tags": ["漏洞"], "text": "在前面的内容中，我们使用TEW-654TR路由器的tftp服务实现了获取目标的管理权限。但是要是tftp没有开放到外网怎么办？"}
{"title": "萤石A1互联网报警盒子破解细节分析", "url": "https://www.freebuf.com/vuls/76815.html", "time": "2015-09-01", "level": "", "num_look": 455952, "num_comment": 4, "author": "360攻防实验室", "tags": ["无线安全", "漏洞"], "text": "萤石A1互联网报警盒子使用“全无线解决方案”，传感器的报警通过433.92MHz射频信号发送给报警主机，报警主机可以通过Wi-Fi联网，将报警上传萤石云端，云端会将信息推送到手机端的“萤石云视频”APP向用户报警。"}
{"title": "我是如何黑掉惠普打印机的？", "url": "https://www.freebuf.com/articles/terminal/76759.html", "time": "2015-09-01", "level": "金币+5", "num_look": 462980, "num_comment": 8, "author": "丝绸之路", "tags": ["终端安全"], "text": "打印机是众多公司的必需品，但如果防范不当，同样可能被黑客入侵。"}
{"title": "俄罗斯黑客组织以EFF（电子前哨基金会）之名发动钓鱼攻击", "url": "https://www.freebuf.com/news/76732.html", "time": "2015-09-01", "level": "", "num_look": 194660, "num_comment": 5, "author": "跳动的心", "tags": ["资讯"], "text": "本月初，俄罗斯政府赞助的APT28组织注册了一个虚假的EFF（电子前哨基金会）域名，向受害者发动鱼叉式钓鱼攻击。"}
{"title": "揭秘：iOS恶意软件KeyRaider如何盗取超过22.5万苹果账户", "url": "https://www.freebuf.com/vuls/76763.html", "time": "2015-09-01", "level": "金币+5", "num_look": 821226, "num_comment": 22, "author": "月尽西楼", "tags": ["数据安全", "漏洞"], "text": "前几天“22 万 iPhone 越狱用户 iCloud 账号被盗”的事，Palo Alto 这篇分析写的很清晰，把技术点和牟利点都讲清楚了。——tombkeeper"}
{"title": "利用Paypal漏洞 黑客盗取你的全部财产于无形", "url": "https://www.freebuf.com/news/76688.html", "time": "2015-08-31", "level": "", "num_look": 320864, "num_comment": 11, "author": "0xroot", "tags": ["漏洞", "资讯"], "text": "埃及安全研究员Ebrahim Hegazy在Paypal支付网站上发现一个关键存储型XSS漏洞，该漏洞可允许攻击者窃取你的登录凭证，甚至以明文格式盗取用户信用卡信息！"}
{"title": "6名少年涉嫌利用DDoS工具发动网络攻击被捕", "url": "https://www.freebuf.com/news/76652.html", "time": "2015-08-31", "level": "", "num_look": 270871, "num_comment": 17, "author": "森碟", "tags": ["资讯"], "text": "6个英国少年涉嫌使用Lizard Squad的DDoS攻击工具Lizard Stresser向网站和服务器发动网络攻击，日前已被警方拘捕。"}
{"title": "魅族科技招聘多个安全岗位招聘", "url": "https://www.freebuf.com/jobs/76397.html", "time": "2015-08-31", "level": "", "num_look": 294669, "num_comment": 21, "author": "魅族科技（中国）有限公司", "tags": ["安全招聘"], "text": "魅族(MEIZU)是中国智能手机厂商，因梦想而立，因热爱而极致；致力于制造设计优雅、简单易用的智能手机。"}
{"title": "mitmproxy套件使用攻略及定制化开发", "url": "https://www.freebuf.com/sectool/76361.html", "time": "2015-08-31", "level": "", "num_look": 1380694, "num_comment": 15, "author": "漏洞盒子安全团队", "tags": ["WEB安全", "工具"], "text": "mitmproxy是一款支持HTTP(S)的中间人代理工具。不同于Fiddler2，burpsuite等类似功能工具，mitmproxy可在终端下运行。"}
{"title": "知名论坛系统MyBB被爆0day漏洞", "url": "https://www.freebuf.com/news/76607.html", "time": "2015-08-31", "level": "", "num_look": 328100, "num_comment": 9, "author": "鸢尾", "tags": ["漏洞", "资讯"], "text": "MyBB是国际上非常优秀的免费论坛软件，最大的特色是简单但是功能却出奇的强大。"}
{"title": "利用Web查询文件(.iqy)有效钓鱼", "url": "https://www.freebuf.com/news/76581.html", "time": "2015-08-30", "level": "金币+5", "num_look": 531853, "num_comment": 7, "author": "鸢尾", "tags": ["资讯"], "text": "几天前我在Casey Smith的twitter上看到了有关iqy文件的一些介绍，和大多数渗透测试人员或者技术狂热者一样我也在探寻它的价值。"}
{"title": "自己动手打造Fiddler挖洞插件", "url": "https://www.freebuf.com/sectool/76579.html", "time": "2015-08-30", "level": "现金奖励", "num_look": 585735, "num_comment": 23, "author": "丝绸之路", "tags": ["工具"], "text": "Fiddler是一款Web调试利器，它拥有强大的调试功能，灵活的配置以及丰富的可扩展功能。本文将介绍自己动手打造Fiddler挖洞插件的过程。"}
{"title": "CVE-2015-4483：使用feed协议绕过火狐 Mixed Content Blocker", "url": "https://www.freebuf.com/vuls/76399.html", "time": "2015-08-29", "level": "金币+5", "num_look": 197216, "num_comment": 3, "author": "living", "tags": ["漏洞"], "text": "在firefox 40中修复了一个漏洞编号为CVE-2015-4483的BUG。"}
{"title": "汽车后服务O2O激战正酣，产品安全谁来重视？", "url": "https://www.freebuf.com/vuls/76537.html", "time": "2015-08-29", "level": "红色标题", "num_look": 385819, "num_comment": 11, "author": "漏洞盒子", "tags": ["头条", "漏洞"], "text": "漏洞盒子近日收到一系列汽车后市场服务O2O APP漏洞，漏洞危害程度较高，涉及厂商也较多，其中不乏行业翘楚。"}
{"title": "如何破解Ubuntu磁盘加密和用户密码", "url": "https://www.freebuf.com/articles/system/76242.html", "time": "2015-08-29", "level": "", "num_look": 451463, "num_comment": 2, "author": "Sphinx", "tags": ["数据安全", "系统安全"], "text": "Ubuntu下有个加密Home目录的功能，原本这是保证系统安全的好方法，但有黑客发现，这个功能不仅可以被爆破，还可能会危及用户登陆密码的安全性。"}
{"title": "【视频回播已更新】FreeBuf公开课（直播课程）：突破延时注入的时间限制", "url": "https://www.freebuf.com/articles/web/73586.html", "time": "2015-08-28", "level": "红色标题", "num_look": 881741, "num_comment": 30, "author": "banish", "tags": ["WEB安全", "网络安全"], "text": "今晚给大家带来秒杀国外延时注入工具的实例（SQLMAP也未能幸免哦），而他又是如何突破延时注入受时间干扰难题呢？"}
{"title": "iOS沙盒漏洞增加企业数据风险级", "url": "https://www.freebuf.com/news/76501.html", "time": "2015-08-28", "level": "", "num_look": 261678, "num_comment": 6, "author": "明明知道", "tags": ["漏洞", "终端安全"], "text": "Appthority研究人员发现一个存在于iOS沙盒应用中的漏洞，低于iOS 8.4.1版本的系统都会受到影响，任何人都可以通过此漏洞访问应用程序的系统设置。"}
{"title": "德国联邦宪法保卫局（BfV）拿国民元数据与NSA交换Xkeyscore", "url": "https://www.freebuf.com/news/76493.html", "time": "2015-08-28", "level": "", "num_look": 220838, "num_comment": 7, "author": "森碟", "tags": ["资讯"], "text": "德国顶级情报机构向美国国家安全局递交了德国国民的元数据，仅仅是为了得到NSA的Xkeyscore系统。"}
{"title": "逆向路由器固件之敏感信息泄露 Part2", "url": "https://www.freebuf.com/articles/terminal/76481.html", "time": "2015-08-28", "level": "", "num_look": 430751, "num_comment": 12, "author": "xd_xd", "tags": ["终端安全"], "text": "本篇文章主要分析的是Trendnet路由器中的一个远程获取路由器权限的漏洞。"}
{"title": "Blackhat专题：WSUS漏洞利用的理论与实践", "url": "https://www.freebuf.com/news/76436.html", "time": "2015-08-28", "level": "现金奖励", "num_look": 319441, "num_comment": 10, "author": "nickchang", "tags": ["漏洞", "资讯"], "text": "Paul Stone和Alex Chapman在blackhat2015提出了一个关于Windows Server Update Service (WSUS) 的漏洞。攻击者可以用中间人攻击利用该漏洞，让用户下载并且安装伪造的更新。"}
{"title": "流量僵尸木马及流量黑产分析报告", "url": "https://www.freebuf.com/articles/terminal/76408.html", "time": "2015-08-28", "level": "", "num_look": 346004, "num_comment": 7, "author": "360手机卫士", "tags": ["终端安全"], "text": "360互联网安全中心检测发现有90款手机应用的部分样本被混入了一段云控代码，该段代码会在用户不知情的情况下，从网上下载恶意插件，然后再后台静默访问某知名导航网站。"}
{"title": "DEFCON CTF全球总决赛：三支中国战队进入世界前六", "url": "https://www.freebuf.com/news/76404.html", "time": "2015-08-28", "level": "金币+5", "num_look": 336330, "num_comment": 12, "author": "qiaojingixiong", "tags": ["其他", "资讯"], "text": "Defcon CTF全球总决赛结束两周之后，结果揭晓：XCTF全国联赛三支队伍HITCON、Blue-lotus与0ops战队包揽第四到第六名，以骄人的战绩为中国在网络安全领域争得了荣耀。"}
{"title": "Android设备频频有坑：Certifi-gate漏洞控制屏幕记录", "url": "https://www.freebuf.com/vuls/76311.html", "time": "2015-08-27", "level": "", "num_look": 243543, "num_comment": 5, "author": "江湖小吓", "tags": ["漏洞"], "text": ""}
{"title": "如何制作Cobalt Strike v2.5破解版", "url": "https://www.freebuf.com/sectool/76206.html", "time": "2015-08-27", "level": "金币+5", "num_look": 708309, "num_comment": 23, "author": "wgboy", "tags": ["工具"], "text": ""}
{"title": "帮女神修手机的意外发现：隐匿在iOS文件系统中的隐私信息", "url": "https://www.freebuf.com/articles/terminal/76317.html", "time": "2015-08-27", "level": "现金奖励", "num_look": 1454104, "num_comment": 57, "author": "piece of the past", "tags": ["终端安全"], "text": "“这些都不是我干的，我就负责说出来。”"}
{"title": "19岁黑客因DDoS英国政府与FBI网站，面临监禁", "url": "https://www.freebuf.com/news/76288.html", "time": "2015-08-27", "level": "", "num_look": 214610, "num_comment": 12, "author": "明明知道", "tags": ["资讯"], "text": "黑客能够成功攻击FBI官方网站，便被视为夺下了行业的“圣杯”。而Floate却轻松做到了。"}
{"title": "中国美女黑客发明“无影鞋”堪比“无影脚”", "url": "https://www.freebuf.com/news/76230.html", "time": "2015-08-27", "level": "金币+5", "num_look": 750091, "num_comment": 82, "author": "简单", "tags": ["资讯"], "text": "黑客圈中的妹子就像国宝一样，相信这位性感的黑客娘更是如此。"}
{"title": "使用Arduino模块实施无线信号的重放攻击", "url": "https://www.freebuf.com/articles/wireless/76220.html", "time": "2015-08-27", "level": "", "num_look": 557231, "num_comment": 10, "author": "鸡肉", "tags": ["无线安全", "极客"], "text": "小情景：如果你在某一天使用无线钥匙卡解锁汽车时候按第二次才成功解锁，那么你的汽车已经被黑客盯上了！"}
{"title": "一个针对中国用户的安卓木马", "url": "https://www.freebuf.com/news/76231.html", "time": "2015-08-26", "level": "金币+5", "num_look": 425148, "num_comment": 12, "author": "UncleCui", "tags": ["终端安全", "资讯"], "text": "Doctor Web安全小组发现了一个新的Android木马，该木马在中国用户之间传播，攻击者可以利用该木马劫持受害者的短信、通话记录、GPS坐标、屏幕截图等大量信息。"}
{"title": "匿名操作系统Whonix v11发布", "url": "https://www.freebuf.com/sectool/76074.html", "time": "2015-08-26", "level": "", "num_look": 638978, "num_comment": 32, "author": "Sphinx", "tags": ["工具"], "text": "Whonix是一个注重匿名、隐私和安全的操作系统。它基于Tor匿名网络，通过隔离手段保证安全。"}
{"title": "偷情网站悬赏50万捉拿泄密黑客，凶手居然是公司内部女员工？", "url": "https://www.freebuf.com/news/76161.html", "time": "2015-08-26", "level": "金币+5", "num_look": 359922, "num_comment": 9, "author": "哆啦A梦", "tags": ["资讯"], "text": ""}
{"title": "逆向路由器固件之解包 Part1", "url": "https://www.freebuf.com/sectool/75915.html", "time": "2015-08-26", "level": "金币+5", "num_look": 808476, "num_comment": 14, "author": "xd_xd", "tags": ["工具"], "text": "这个系列的文章以逆向路由器固件的方式来挖掘路由器中存在的漏洞。本篇文章主要以介绍解包固件工具为主。"}
{"title": "HackPwn2015：IoT智能硬件安全威胁分析", "url": "https://www.freebuf.com/articles/terminal/76210.html", "time": "2015-08-26", "level": "", "num_look": 291149, "num_comment": 1, "author": "360安全", "tags": ["终端安全"], "text": "IoT（物联网）是一种既危险又有趣的混合技术,所谓的混合技术包括移动应用程序、蓝牙、Wi-Fi、zigbee、设备固件、服务、API、以及各种网络协议等。"}
{"title": "轻量级社工钓鱼框架SPF (SpeedPhish Framework)", "url": "https://www.freebuf.com/sectool/76164.html", "time": "2015-08-26", "level": "金币+6", "num_look": 388538, "num_comment": 10, "author": "丝绸之路", "tags": ["工具"], "text": "SPF (SpeedPhish Framework) 是一款用Python编写的轻量级社会工程学钓鱼框架，部署极其简单。可用于快速开展简单的社工钓鱼攻击。"}
{"title": "三星智能冰箱存在漏洞：可导致Gmail身份凭证被窃取", "url": "https://www.freebuf.com/vuls/76169.html", "time": "2015-08-26", "level": "金币+6", "num_look": 208275, "num_comment": 6, "author": "dawner", "tags": ["漏洞"], "text": "最近物联网又出了新的安全问题，这次安全研究人员从三星智能冰箱里提取出了Gmail认证信息。"}
{"title": "阿里移动安全2015年第二季度报告", "url": "https://www.freebuf.com/articles/terminal/76141.html", "time": "2015-08-26", "level": "", "num_look": 333160, "num_comment": 12, "author": "阿里聚安全", "tags": ["其他", "安全报告"], "text": "2015年第二季度移动安全报告新鲜出炉，基于阿里聚安全的监控数据，对移动安全的病毒、漏洞、仿冒三大类问题进行了分析，安全问题依旧不容忽视。"}
{"title": "浅析各类DDoS攻击放大技术", "url": "https://www.freebuf.com/articles/network/76021.html", "time": "2015-08-26", "level": "现金奖励", "num_look": 884006, "num_comment": 10, "author": "月尽西楼", "tags": ["网络安全"], "text": "攻击者可以利用BT种子协议（微传输协议[uTP]，分布hash平台[DHT]，消息流加密[MSE]，BT种子同步[BTSync]）来反射放大结点间传输量。"}
{"title": "Payload生成器：Metasploit AV Evasion", "url": "https://www.freebuf.com/sectool/76073.html", "time": "2015-08-25", "level": "", "num_look": 454003, "num_comment": 19, "author": "0xroot", "tags": ["工具"], "text": "Metasploit AV Evasion Payload生成器，由Daniel Compton开发，能逃过大部分杀毒软件的查杀。"}
{"title": "HackPwn：TCL智能洗衣机破解细节分析", "url": "https://www.freebuf.com/news/76071.html", "time": "2015-08-25", "level": "", "num_look": 501823, "num_comment": 15, "author": "360安全", "tags": ["资讯"], "text": ""}
{"title": "极路由安全设计分析姐妹篇", "url": "https://www.freebuf.com/articles/terminal/76046.html", "time": "2015-08-25", "level": "现金奖励", "num_look": 524599, "num_comment": 11, "author": "bt0sea", "tags": ["极客", "终端安全"], "text": ""}
{"title": "索尼PS4安全现状分析", "url": "https://www.freebuf.com/articles/terminal/75854.html", "time": "2015-08-25", "level": "", "num_look": 264131, "num_comment": 4, "author": "0xroot", "tags": ["系统安全", "终端安全"], "text": "PlayStation 4是一部索尼电脑娱乐推出的电子游戏机，2013年11月15日正式于北美发售，PlayStation 4属于第八世代的游戏机。"}
{"title": "Zscaler：中国APT组织“熊猫使者”的活动新进展", "url": "https://www.freebuf.com/news/76015.html", "time": "2015-08-25", "level": "金币+6", "num_look": 362805, "num_comment": 22, "author": "常运", "tags": ["资讯"], "text": "“熊猫使者”APT组织被怀疑是天朝的一个黑客组织，他们专门以政府和相关领域的技术部门作为其主要的攻击目标，并尝试从这些组织和机构中监视和窃取高科技的知识产权数据。"}
{"title": "Android应用资源文件格式解析与保护对抗研究", "url": "https://www.freebuf.com/articles/terminal/75944.html", "time": "2015-08-25", "level": "现金奖励", "num_look": 798172, "num_comment": 27, "author": "安全豹", "tags": ["终端安全"], "text": "apktool是Android分析中会用到的一个重要的开源工具,但是如今对抗apktool的手段也开始日益增加，本着学习研究的目的,进行了本次anti apktool研究。"}
{"title": "《揭秘家用路由器0day漏洞挖掘技术》问答精选（幸运读者看过来）", "url": "https://www.freebuf.com/fevents/75936.html", "time": "2015-08-25", "level": "红色标题", "num_look": 435058, "num_comment": 28, "author": "FB客服", "tags": ["活动"], "text": "FB客服MM很快会与你们联系哟~"}
{"title": "Fireye：中国黑客攻击印度政府", "url": "https://www.freebuf.com/news/75924.html", "time": "2015-08-25", "level": "金币+6", "num_look": 400608, "num_comment": 12, "author": "简单", "tags": ["头条", "资讯"], "text": "疑似来自中国的间谍组织从2012年起对印度政府机构和大学发动网络攻击，以窃取他们关于边界问题的敏感信息。"}
{"title": "滑板也被黑：蓝牙劫持智能滑板运行【FreeBuf视频】", "url": "https://www.freebuf.com/articles/terminal/75908.html", "time": "2015-08-24", "level": "", "num_look": 2697641, "num_comment": 21, "author": "FB视频", "tags": ["终端安全", "视频"], "text": "上次我们说到了黑掉智能汽车，这次，我们黑小一点的、新奇一点的玩意——智能电动滑板。"}
{"title": "天识科技招聘WEB网络安全工程师", "url": "https://www.freebuf.com/jobs/75863.html", "time": "2015-08-24", "level": "", "num_look": 264977, "num_comment": 24, "author": "lanbo", "tags": ["安全招聘"], "text": "深圳市天识科技有限公司，是中国信息安全及生物识别行业最具影响力的产品和服务供应商，是中国科技开发院的下属骨干企业。"}
{"title": "对《终结者-创世纪》中无缝技术的思考", "url": "https://www.freebuf.com/news/75855.html", "time": "2015-08-24", "level": "", "num_look": 191651, "num_comment": 7, "author": "明明知道", "tags": ["其他", "资讯"], "text": "Marc Goodman——《未来犯罪》一书的作者，他认为设计是最好的防御（design is our best defence）。同时他预测，到2019年网络犯罪让企业承担的损失将多达2万亿美元。"}
{"title": "如何渗透Pocket内网", "url": "https://www.freebuf.com/vuls/75859.html", "time": "2015-08-24", "level": "", "num_look": 314434, "num_comment": 5, "author": "Sphinx", "tags": ["WEB安全", "漏洞"], "text": "利用Pocket特有的一些功能，黑客可从服务器上获取WEB服务、内部IP地址，甚至可以用ssh登陆后端服务器。"}
{"title": "安卓海豚浏览器中的远程代码执行", "url": "https://www.freebuf.com/news/75837.html", "time": "2015-08-24", "level": "", "num_look": 335401, "num_comment": 6, "author": "鸢尾", "tags": ["终端安全", "资讯"], "text": "攻击者有能力通过安卓海豚浏览器控制用户的网络通信数据，可以修改下载和应用浏览器新主题的函数。"}
{"title": "FreeBuf全球安全事件纵览（2015年7月）：流火", "url": "https://www.freebuf.com/news/topnews/75807.html", "time": "2015-08-24", "level": "红色标题", "num_look": 388114, "num_comment": 6, "author": "简单", "tags": ["其他", "头条"], "text": "黑屏、绿字是生活，面具、黑帽是形象，深入骨髓是使命。"}
{"title": "Linux的新文件系统Bcachefs", "url": "https://www.freebuf.com/news/75815.html", "time": "2015-08-24", "level": "", "num_look": 267196, "num_comment": 5, "author": "Sphinx", "tags": ["资讯"], "text": "前Google工程师Kent Overstreet发布了新的开源Linux文件系统，名为Bcachefs。"}
{"title": "卡巴斯基：专业攻击日本的APT组织“蓝白蚁（blue termite）”新动向", "url": "https://www.freebuf.com/news/75738.html", "time": "2015-08-23", "level": "金币+7", "num_look": 437992, "num_comment": 6, "author": "空白", "tags": ["网络安全", "资讯"], "text": "2014年10月，卡巴斯基实验室开始了针对“蓝白蚁”APT的研究，尽管这并不是日本第一次遭遇APT的攻击，但是这次旷日持久的攻击还是有两点与众不同的地方。"}
{"title": "技术分析：在线棋牌游戏的木马“集结号”", "url": "https://www.freebuf.com/news/75775.html", "time": "2015-08-23", "level": "", "num_look": 882403, "num_comment": 16, "author": "360安全", "tags": ["网络安全", "资讯"], "text": "集结号游戏中心是一款拥有较高人气的棋牌游戏平台，包含百余款潮流性竞技休闲游戏，如斗地主、三国赛马、港式五张、对杀牛牛、捕鱼达人等。"}
{"title": "对话Impact Team：让我们继续来聊聊偷情", "url": "https://www.freebuf.com/news/75794.html", "time": "2015-08-23", "level": "金币+7", "num_look": 225868, "num_comment": 14, "author": "明明知道", "tags": ["资讯"], "text": "继本月18日Impact Team黑客组织公布了第一批著名婚外情网站AshleyMadison10G数据之后，8月21日黑客又一次泄露了包括320万封邮件在内的20G信息。"}
{"title": "贝尔金F9K1111固件漏洞分析", "url": "https://www.freebuf.com/articles/terminal/75755.html", "time": "2015-08-22", "level": "金币+7", "num_look": 285248, "num_comment": 6, "author": "JackFree", "tags": ["终端安全"], "text": ""}
{"title": "绿盟科技2015 H1 DDoS态势报告：DDoS攻击两极分化", "url": "https://www.freebuf.com/articles/web/75684.html", "time": "2015-08-22", "level": "", "num_look": 559855, "num_comment": 9, "author": "绿盟科技", "tags": ["WEB安全", "安全报告"], "text": "绿盟科技发布了2015 H1 DDoS威胁报告。"}
{"title": "技术揭秘“QQ空间”自动转发不良信息", "url": "https://www.freebuf.com/vuls/75711.html", "time": "2015-08-22", "level": "金币+7", "num_look": 2362685, "num_comment": 38, "author": "安全豹", "tags": ["WEB安全", "漏洞"], "text": ""}
{"title": "网络攻击战的“丝绸之路”：中国是必经之路", "url": "https://www.freebuf.com/news/75625.html", "time": "2015-08-21", "level": "", "num_look": 215467, "num_comment": 18, "author": "简单", "tags": ["资讯"], "text": "敌在暗，我在明，这是兵家之大忌。"}
{"title": "XLR8钓鱼攻击：到底是谁在钓鱼？", "url": "https://www.freebuf.com/articles/system/75677.html", "time": "2015-08-21", "level": "", "num_look": 443222, "num_comment": 25, "author": "阿里安全", "tags": ["系统安全", "网络安全"], "text": ""}
{"title": "火狐书签扩展应用Pocket：漏洞挖掘没那么难", "url": "https://www.freebuf.com/news/75647.html", "time": "2015-08-21", "level": "", "num_look": 287678, "num_comment": 13, "author": "dawner", "tags": ["WEB安全", "资讯"], "text": "Pocket应用的开发人员最近修复了几个泄露数据的漏洞，黑客可从服务器上获取WEB服务、内部IP地址，以及更多相关的敏感信息。"}
{"title": "Camera360被爆存在漏洞：数据存在泄露风险导致未经授权可访问他人照片", "url": "https://www.freebuf.com/news/75569.html", "time": "2015-08-21", "level": "", "num_look": 318787, "num_comment": 4, "author": "鸢尾", "tags": ["WEB安全", "漏洞"], "text": "Camera360存在隐私数据泄露风险：恶意攻击者可以不经过授权就能够访问到其它用户的云账户和相册。"}
{"title": "FreeBuf Live：HackPWN 2015全程网络视频直播", "url": "https://www.freebuf.com/fevents/75606.html", "time": "2015-08-21", "level": "红色标题", "num_look": 505951, "num_comment": 62, "author": "FB独家", "tags": ["活动"], "text": "究竟HackPWN现场会破解哪些让你大跌眼镜的设备？FreeBuf将全程进行网络视频直播，我们拭目以待。"}
{"title": "由蜜罐引发的物联网安全小谈", "url": "https://www.freebuf.com/news/75577.html", "time": "2015-08-21", "level": "", "num_look": 297862, "num_comment": 6, "author": "明明知道", "tags": ["资讯"], "text": "最近几年，“物联网”正以迅雷不及掩耳之势四处圈地，“凡联网之物都能被黑”的恶名也如影随形。"}
{"title": "Kali Linux中前十名的Wifi攻击工具", "url": "https://www.freebuf.com/sectool/75517.html", "time": "2015-08-21", "level": "", "num_look": 1768216, "num_comment": 24, "author": "0xroot", "tags": ["工具", "无线安全"], "text": "无线网络的攻与防一直是比较热门的话题，由于无线信号可以被一定范围内的任何人接收到（包括死黑阔），这样就给WIFI带来了安全隐患。"}
{"title": "极路由安全设计架构分析", "url": "https://www.freebuf.com/articles/terminal/75524.html", "time": "2015-08-20", "level": "现金奖励", "num_look": 635439, "num_comment": 22, "author": "bt0sea", "tags": ["极客", "终端安全"], "text": "现代智能路由器是物联网的一个重要组成部分，本文将针对智能路由器的代表“极路由”的安全设计架构进行详细的分析。"}
{"title": "上海点融安全沙龙将于8月30日在上海举行", "url": "https://www.freebuf.com/fevents/75046.html", "time": "2015-08-20", "level": "", "num_look": 184944, "num_comment": 5, "author": "Gambler", "tags": ["活动"], "text": "上海点融安全沙龙，将于8月30日在上海soho复兴广场举行。"}
{"title": "成都思维世纪科技招聘安全岗位", "url": "https://www.freebuf.com/jobs/75504.html", "time": "2015-08-20", "level": "", "num_look": 311551, "num_comment": 21, "author": "成都思维世纪科技", "tags": ["安全招聘"], "text": "现因公司在业务安全领域的全国范围内快速发展与布局，需要招聘一批中高端骨干人才。"}
{"title": "逆向分析神器BinNavi开源了", "url": "https://www.freebuf.com/sectool/75529.html", "time": "2015-08-20", "level": "金币+5", "num_look": 557932, "num_comment": 12, "author": "鸢尾", "tags": ["工具"], "text": ""}
{"title": "病毒是如何将文件藏进注册表的", "url": "https://www.freebuf.com/articles/system/75471.html", "time": "2015-08-20", "level": "", "num_look": 325035, "num_comment": 22, "author": "Sphinx", "tags": ["系统安全"], "text": "本文将介绍一种将可执行文件隐藏在Windows注册表的方法，这也是常见的，恶意软件所采用的方法。"}
{"title": "利用Chrome XSS auditor盗取tokens", "url": "https://www.freebuf.com/articles/web/75392.html", "time": "2015-08-20", "level": "", "num_look": 338795, "num_comment": 7, "author": "鸢尾", "tags": ["WEB安全"], "text": "提到XSS auditor我们更多想到的便是绕过。XSS auditor实在可恶，不知让我们死了多少脑细胞，今天咱们就来看看歪果仁是怎样利用Chrome的XSS auditor实现盗取token的，吐一口恶气吧！"}
{"title": "DEFCON黑客大会小记（图集）", "url": "https://www.freebuf.com/news/75425.html", "time": "2015-08-20", "level": "金币+5", "num_look": 342988, "num_comment": 8, "author": "SAINTSEC TEAM", "tags": ["头条", "活动"], "text": "很幸运可以到Defcon大会现场上转一圈，感受国外的顶尖安全会议，不得不说，国外的安全会议真的比国内的安全会议高大上。"}
{"title": "七夕将至，婚外情网站数据终于裸奔了", "url": "https://www.freebuf.com/news/75421.html", "time": "2015-08-20", "level": "红色标题", "num_look": 570549, "num_comment": 27, "author": "明明知道", "tags": ["资讯"], "text": ""}
{"title": "Metasploit CVE-2015-5122 Flash漏洞利用教程", "url": "https://www.freebuf.com/articles/system/75419.html", "time": "2015-08-19", "level": "", "num_look": 836899, "num_comment": 30, "author": "0xroot", "tags": ["系统安全"], "text": ""}
{"title": "Android mediaserver组件曝高危漏洞（CVE-2015-3842），影响所有Android设备", "url": "https://www.freebuf.com/vuls/75509.html", "time": "2015-08-19", "level": "", "num_look": 321286, "num_comment": 12, "author": "Sphinx", "tags": ["漏洞", "终端安全"], "text": "CVE-2015-3842是个影响Android mediaserver的新漏洞，可被利用执行任意代码。"}
{"title": "BugScan圈子沙龙之议题点睛（含PPT下载）", "url": "https://www.freebuf.com/fevents/75268.html", "time": "2015-08-19", "level": "", "num_look": 231581, "num_comment": 6, "author": "kun", "tags": ["活动"], "text": "国内首个漏洞插件沙龙在美丽的西安顺利召开，会议精华详见文章内容。"}
{"title": "Gozi木马不断拓展攻击范围，东欧国家拉响警报", "url": "https://www.freebuf.com/news/75497.html", "time": "2015-08-19", "level": "", "num_look": 177614, "num_comment": 5, "author": "森碟", "tags": ["资讯"], "text": ""}
{"title": "基于Python+协程+多进程的弱密码扫描器", "url": "https://www.freebuf.com/sectool/75385.html", "time": "2015-08-19", "level": "现金奖励", "num_look": 542435, "num_comment": 24, "author": "__Fr1day__", "tags": ["WEB安全", "工具"], "text": "我们的目标是设计一枚通用的弱密码扫描器，功能是针对不同类型的弱密码，可方便的扩展，在此基础上再添加协程和多进程支持。"}
{"title": "联想集团入驻漏洞盒子，发起安全众测现金奖励", "url": "https://www.freebuf.com/news/75407.html", "time": "2015-08-19", "level": "", "num_look": 196367, "num_comment": 4, "author": "漏洞盒子", "tags": ["资讯"], "text": "本周，联想集团宣布与漏洞盒子平台达成安全及漏洞报告方面的合作。"}
{"title": "优化SQLMAP的批量测试功能", "url": "https://www.freebuf.com/sectool/75296.html", "time": "2015-08-19", "level": "现金奖励", "num_look": 778269, "num_comment": 17, "author": "晴天", "tags": ["WEB安全", "工具"], "text": "sqlmap源代码有个小bug，使用history记录批量检测注入时不能全量检测，会漏掉一些URL和参数，本文将介绍自己动手修复bug的方法。"}
{"title": "全球首款开源勒索软件 - Hidden Tear", "url": "https://www.freebuf.com/sectool/75323.html", "time": "2015-08-19", "level": "金币+5", "num_look": 577381, "num_comment": 24, "author": "vulture", "tags": ["工具"], "text": "今年5月，暗网中曾出现过三步即可傻瓜化制作勒索软件的Tox工具，现在，GitHub上又出现了一款开源的勒索软件Hidden Tear。"}
{"title": "秀尔算法：破解RSA加密的“不灭神话”", "url": "https://www.freebuf.com/news/75346.html", "time": "2015-08-19", "level": "金币+5", "num_look": 1122063, "num_comment": 35, "author": "空白", "tags": ["数据安全", "网络安全"], "text": "RSA加密曾被视为最可靠的加密算法，直到秀尔算法出现，打破了RSA的不灭神话。"}
{"title": "好书推荐：《揭秘家用路由器0day漏洞挖掘技术》", "url": "https://www.freebuf.com/fevents/74567.html", "time": "2015-08-19", "level": "红色标题", "num_look": 2361038, "num_comment": 321, "author": "FB独家", "tags": ["活动"], "text": "FreeBuf将在本文评论区特别邀请《揭秘家用路由器0day漏洞挖掘技术》作者“强力坐镇”，与大家面对面在线交流。"}
{"title": "Sadstrot木马分析报告", "url": "https://www.freebuf.com/articles/terminal/75294.html", "time": "2015-08-19", "level": "", "num_look": 312320, "num_comment": 4, "author": "AVLTeam", "tags": ["安全报告", "终端安全"], "text": "AVL移动安全团队截获了一款恶意木马，该木马运行后会窃取用户QQ和微信账户、好友列表、消息记录等，同时会利用subtrate hook框架监控键盘输入的任何信息。"}
{"title": "BlackHat议题分析：浅析BGP劫持利用", "url": "https://www.freebuf.com/articles/network/75305.html", "time": "2015-08-18", "level": "现金奖励", "num_look": 551741, "num_comment": 10, "author": "月尽西楼", "tags": ["网络安全"], "text": "BGP劫持在2008年的defcon大会上就曾经有涉及，然而在2015年的blackhat上又被选为议题，可见问题的严重性，冰冻三尺，非一日之寒，BGP劫持问题有待世界各地的组织携手解决。"}
{"title": "Mac OS X操作系统中又发现2枚权限提升0day漏洞", "url": "https://www.freebuf.com/news/75318.html", "time": "2015-08-18", "level": "", "num_look": 282278, "num_comment": 7, "author": "简单", "tags": ["漏洞", "资讯"], "text": "苹果Mac OS X操作系统中又发现2枚新的0day漏洞，攻击者可提升至root访问权限。"}
{"title": "BlackHat USA 2015 文章中英文索引", "url": "https://www.freebuf.com/news/topnews/75281.html", "time": "2015-08-18", "level": "金币+5", "num_look": 247974, "num_comment": 7, "author": "damage", "tags": ["头条"], "text": "BlackHat 2015黑帽盛会上近百篇会议文章和PPT集锦！"}
{"title": "一次蜿蜒曲折的RFID破解之路", "url": "https://www.freebuf.com/geek/75195.html", "time": "2015-08-18", "level": "金币+5", "num_look": 626455, "num_comment": 33, "author": "造梦者", "tags": ["极客"], "text": "早一段时间看到一篇看雪论坛关于逻辑嗅探破解接触式IC卡口令的文章，激起鄙人对rfid的兴趣。遂准备拿学校的卡一展身手。"}
{"title": "从SQLMap踩坑到如何优雅地控制子进程", "url": "https://www.freebuf.com/sectool/75270.html", "time": "2015-08-18", "level": "红色标题", "num_look": 534085, "num_comment": 10, "author": "漏洞盒子安全团队", "tags": ["工具"], "text": "SQLMap是检测SQL注入漏洞公认的神器，其本身并不支持作为模块导入使用，但是提供了sqlmapapi.py ,它能够启动一个基于bottle的API服务器，对外提供了丰富的API接口。"}
{"title": "Facebook为新类型漏洞发奖金10万刀", "url": "https://www.freebuf.com/news/75231.html", "time": "2015-08-18", "level": "", "num_look": 262041, "num_comment": 9, "author": "明明知道", "tags": ["漏洞", "资讯"], "text": "Facebook成为继微软之后又一为漏洞及防御技术支付六位数奖励的互联网巨头。"}
{"title": "内网渗透辅助利器 - xosVer", "url": "https://www.freebuf.com/sectool/75163.html", "time": "2015-08-18", "level": "金币+5", "num_look": 527069, "num_comment": 28, "author": "丝绸之路", "tags": ["工具"], "text": "xosVer是一款用Python编写的内网渗透辅助工具，它可以获取到内网远程主机的主机名称、操作系统版本信息和该主机所在域或工作组的名称。"}
{"title": "揭秘：美国运营商AT&T与NSA合作监听民众通信始于1985年", "url": "https://www.freebuf.com/news/75236.html", "time": "2015-08-18", "level": "金币+5", "num_look": 205339, "num_comment": 10, "author": "简单", "tags": ["头条", "资讯"], "text": "AT&T在内的每家电信公司在NSA内部都有特殊的隐秘代号。从1985年起，电信公司与NSA勾结在全球范围内实施窃听，监听对象不仅有民众，还有国际组织，包括流经联合国总部大楼的全部网络通信。"}
{"title": "安卓预装插件“证书门”漏洞分析还原", "url": "https://www.freebuf.com/vuls/75228.html", "time": "2015-08-17", "level": "", "num_look": 308785, "num_comment": 12, "author": "360vulpecker", "tags": ["漏洞", "终端安全"], "text": "2015 Blackhat大会上除了爆出一条彩信黑掉安卓手机的Stagefright漏洞，还爆了其他不少安卓漏洞，其中有一个叫“CERTIFI GATE”（证书门）的漏洞。"}
{"title": "NSA Playset项目: “克隆”NSA（美国国安局）军火库", "url": "https://www.freebuf.com/news/topnews/75216.html", "time": "2015-08-17", "level": "金币+5", "num_look": 419764, "num_comment": 7, "author": "Sphinx", "tags": ["头条", "终端安全"], "text": "在文件泄露18个月以后，一个名为NSA Playset的项目成功“克隆”出了这些NSA的军火，并将这些神奇的网络间谍工具送到了人们手中。"}
{"title": "海康威视萤石联动漏洞盒子，发起漏洞现金奖励计划", "url": "https://www.freebuf.com/fevents/74041.html", "time": "2015-08-17", "level": "", "num_look": 252649, "num_comment": 12, "author": "漏洞盒子", "tags": ["活动"], "text": "萤石安全应急响应中心联动漏洞盒子平台，与白帽子、安全厂商、安全团队建立长期沟通交流机制，共同成长。"}
{"title": "黑客通过WiFi让Parrot无人机从天空坠落", "url": "https://www.freebuf.com/news/75147.html", "time": "2015-08-17", "level": "", "num_look": 318377, "num_comment": 6, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "研究人员在DefCon黑客大会上演示了通过WiFi劫持并让Parrot公司生产的无人机从天空中坠落。"}
{"title": "浅谈物联网安全蓝海战略", "url": "https://www.freebuf.com/articles/wireless/75161.html", "time": "2015-08-17", "level": "现金奖励", "num_look": 388055, "num_comment": 7, "author": "bt0sea", "tags": ["无线安全", "终端安全"], "text": "物联网安全如何实现是值得信息安全工作者思考的问题。"}
{"title": "卡巴斯基被曝在用户电脑植入恶意代码，诱导竞争对手杀毒软件误报", "url": "https://www.freebuf.com/news/75181.html", "time": "2015-08-17", "level": "", "num_look": 205802, "num_comment": 15, "author": "明明知道", "tags": ["资讯"], "text": "两名卡巴斯基前雇员称，卡巴斯基曾伪造恶意软件“诱导”竞争对手杀毒软件误报，导致用户系统重要组建（文件）被禁用或删除。"}
{"title": "让GoAgent通过IPV6科学上网", "url": "https://www.freebuf.com/articles/others-articles/75157.html", "time": "2015-08-17", "level": "金币+12", "num_look": 1001967, "num_comment": 50, "author": "Tiank", "tags": ["其他"], "text": "IPV6是最新的网络协议，本次充分利用IPV6的特性，利用IPV6代替IPV4地址，有效避开了IPV4访问外网的尴尬"}
{"title": "四两拨千斤：利用BT软件进行反射型DDoS攻击", "url": "https://www.freebuf.com/news/75167.html", "time": "2015-08-17", "level": "金币+12", "num_look": 311410, "num_comment": 13, "author": "dawner", "tags": ["资讯"], "text": "攻击者利用用户装机量巨大的BT（BitTorrent）软件实施反射型DDoS攻击，攻击者只需要极小的带宽，就能通过“反射”放大50-120倍攻击流量，轻松“摧毁”大型网站。"}
{"title": "清华黑客在创业：FreeBuf专访登上BlackHat的长亭科技杨坤", "url": "https://www.freebuf.com/news/75067.html", "time": "2015-08-17", "level": "红色标题", "num_look": 791425, "num_comment": 28, "author": "FB独家", "tags": ["人物志", "资讯"], "text": "FreeBuf独家对话杨坤，聊一聊这位“清华黑客”是如何创业长亭外、心系古道边。"}
{"title": "本地文件包含漏洞检测工具 - Burp国产插件LFI scanner checks", "url": "https://www.freebuf.com/sectool/75118.html", "time": "2015-08-16", "level": "金币+12", "num_look": 329226, "num_comment": 14, "author": "lufei", "tags": ["工具"], "text": "LFI scanner checks是为了我自己为burp轻量级扫描器做的一个检测LFI漏洞插件。"}
{"title": "一个完美的Bug（CVE-2015-3077）：利用Flash中类型混淆", "url": "https://www.freebuf.com/news/topnews/75111.html", "time": "2015-08-15", "level": "金币+12", "num_look": 274177, "num_comment": 14, "author": "living", "tags": ["头条", "系统安全"], "text": "编写高质量的exp的途径之一就是利用高质量的bug(也就是主动因素都利用编写稳定利用的exp)。"}
{"title": "安卓系统Google Admin应用曝0day漏洞，可绕过沙箱", "url": "https://www.freebuf.com/news/75092.html", "time": "2015-08-15", "level": "", "num_look": 241251, "num_comment": 6, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "该漏洞存在于安卓系统中Google Admin应用程序处理一些URL的方式中，通过该漏洞攻击者可以绕过安卓沙箱机制。"}
{"title": "安全科普：流氓DHCP服务器内网攻击测试", "url": "https://www.freebuf.com/articles/network/74995.html", "time": "2015-08-15", "level": "金币+12", "num_look": 1489118, "num_comment": 65, "author": "s1riu5", "tags": ["网络安全"], "text": "通常内网渗透都是基于ARP的攻击，但ARP攻击对内网的负担太重，很容易被发现。今天讲的是基于DHCP协议的攻击。"}
{"title": "尴尬了：思科自曝ROMMON镜像安全问题，但CVE拒绝给予编号", "url": "https://www.freebuf.com/news/75018.html", "time": "2015-08-14", "level": "", "num_look": 202585, "num_comment": 8, "author": "dawner", "tags": ["资讯"], "text": "令人尴尬的是，这枚思科官方发布的安全预警未被CVE认可。"}
{"title": "看黑客如何分分钟“插队”预约一加手机", "url": "https://www.freebuf.com/articles/web/74987.html", "time": "2015-08-14", "level": "红色标题", "num_look": 696678, "num_comment": 30, "author": "Sphinx", "tags": ["WEB安全"], "text": "我很讨厌一加的预约+邀请系统。"}
{"title": "迅雷防踢补丁：一个刷流量木马的简单分析", "url": "https://www.freebuf.com/articles/system/74963.html", "time": "2015-08-14", "level": "", "num_look": 436935, "num_comment": 10, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "经过回溯分析，我们发现该木马主要通过伪装成迅雷破解补丁、防踢补丁、无限刷会员等补丁文件的方式进行传播，感染量巨大。"}
{"title": "Kali 2.0中无线安全工具更新特性（浅谈pixie结合reaver的攻击原理）", "url": "https://www.freebuf.com/sectool/75015.html", "time": "2015-08-14", "level": "现金奖励", "num_look": 671937, "num_comment": 17, "author": "月尽西楼", "tags": ["工具", "无线安全"], "text": "多米尼克•邦加德发现一些无线ap产生随机数的方法不安全，如果我们能搞清楚随机数是什么，就很容易发现AP的wps pin因为在AP一定会给我们包含pin的hash校验值。"}
{"title": "一条短信黑掉雪弗兰科尔维特跑车（中文视频）", "url": "https://www.freebuf.com/news/75002.html", "time": "2015-08-14", "level": "金币+12", "num_look": 192320, "num_comment": 14, "author": "JackFree", "tags": ["资讯"], "text": "雪弗兰科尔维特跑车中的OBD-II端口中存在安全漏洞，通过该漏洞仅仅利用一条简单的短信就可以控制汽车，包括削减刹车、激活雨刷等操作。"}
{"title": "调查问卷：斯诺登应该被赦无罪吗？", "url": "https://www.freebuf.com/news/74938.html", "time": "2015-08-14", "level": "", "num_look": 242434, "num_comment": 34, "author": "fber", "tags": ["资讯"], "text": "斯诺登披露了NSA搜集情报活动，美国政府因此要指控他，请问你是支持还是反对呢？"}
{"title": "一款流行的VBA宏病毒技术分析", "url": "https://www.freebuf.com/articles/terminal/74921.html", "time": "2015-08-14", "level": "现金奖励", "num_look": 550340, "num_comment": 9, "author": "bugnofree", "tags": ["系统安全", "终端安全"], "text": "对于陌生邮件，一定要慎重的打开，很多人看到邮件，什么都没有想，就直接打开邮件，近期流行的一个宏病毒正是通过邮件进行传播。"}
{"title": "走近韩国黑客神童Lokihardt（中文视频）", "url": "https://www.freebuf.com/video/74982.html", "time": "2015-08-13", "level": "", "num_look": 568751, "num_comment": 24, "author": "FB视频", "tags": ["视频"], "text": "这两天大放异彩的韩国神童黑客Lokihardt其人，其实早在今年3月的Pwn2Own破解大赛上就以通杀IE、Safari和Chrome三大浏览器的0day漏洞。"}
{"title": "联想被爆利用Windows防盗功能做羞羞的事", "url": "https://www.freebuf.com/news/74919.html", "time": "2015-08-13", "level": "", "num_look": 301538, "num_comment": 18, "author": "明明知道", "tags": ["其他", "资讯"], "text": "2014年10月至今年4月，联想利用Windows防盗功能在某些联想台式机和笔记本系统中预装了被称为“联想服务引擎”的软件。"}
{"title": "美国NBC：中国黑客仍在监视美国", "url": "https://www.freebuf.com/news/74870.html", "time": "2015-08-13", "level": "", "num_look": 191615, "num_comment": 9, "author": "森碟", "tags": ["资讯"], "text": "美国情报机构一名高级官员披露，中国黑客还在继续访问奥巴马政府重要官员的私人邮件。这是美媒的污蔑吗？"}
{"title": "漏洞挂马网站趋势分析", "url": "https://www.freebuf.com/articles/network/74894.html", "time": "2015-08-13", "level": "", "num_look": 458188, "num_comment": 13, "author": "腾讯电脑管家", "tags": ["网络安全"], "text": "浏览器漏洞挂马是目前互联网上最常用的攻击手段。它利用了IE等浏览器在开发过程中遗留的一些缺陷，可以在用户不知情的情况下运行攻击者指定的恶意程序。"}
{"title": "黑进机场安检系统？攻击者只需一台普通笔记本电脑", "url": "https://www.freebuf.com/news/74751.html", "time": "2015-08-13", "level": "", "num_look": 221968, "num_comment": 11, "author": "明明知道", "tags": ["资讯"], "text": "安全专家Billy Rios公开了一个令人不安的发现：攻击者使用一台普通的笔记本电脑便可以入侵机场安检网络系统中。"}
{"title": "深度报道：韩国黑客梦之队是怎样炼成的？", "url": "https://www.freebuf.com/news/74802.html", "time": "2015-08-12", "level": "红色标题", "num_look": 999928, "num_comment": 61, "author": "明明知道", "tags": ["头条", "资讯"], "text": "时至今日，依托举国之力和军方背景，韩国将近四年时间终于打造出夺下全球黑客竞赛第一名的梦幻战队。"}
{"title": "金山云招聘安全渗透工程师", "url": "https://www.freebuf.com/jobs/74801.html", "time": "2015-08-12", "level": "", "num_look": 310760, "num_comment": 47, "author": "金山云", "tags": ["安全招聘"], "text": "金山云是金山集团旗下控股公司，依托金山集团26年的深厚技术积累，以业内领先的用户体验和服务端技术，为用户和企业提供国内领军级云服务产品。"}
{"title": "最新黑客大会JEEP汽车91页破解报告（摘要版）", "url": "https://www.freebuf.com/news/topnews/74736.html", "time": "2015-08-12", "level": "现金奖励", "num_look": 362706, "num_comment": 14, "author": "tofreebug", "tags": ["头条", "观点"], "text": "我想再次重复2个月之前提出的一个观点：2015年是汽车安全的元年！"}
{"title": "升级Windows 10后如何回滚？", "url": "https://www.freebuf.com/news/74740.html", "time": "2015-08-12", "level": "", "num_look": 245848, "num_comment": 15, "author": "dawner", "tags": ["资讯"], "text": "自从Win10发布以后，由于微软突如其来的免费政策，数以百万计的Windows用户争先恐后地进行了系统升级。然而发现Win10不适合自己的童鞋，该怎么办呢？"}
{"title": "揭秘：0day漏洞的供应商到底是谁？", "url": "https://www.freebuf.com/news/74757.html", "time": "2015-08-12", "level": "", "num_look": 374875, "num_comment": 15, "author": "cs24", "tags": ["头条", "资讯"], "text": "漏洞市场背后都有哪些0day供应商？是怎么支付的？他们怎样结识上的？哪些漏(ruan)洞(jian)值(an)钱(quan)？这个市场也谈关系吗？"}
{"title": "安全科普：局域网攻击的常见方法", "url": "https://www.freebuf.com/articles/network/74700.html", "time": "2015-08-12", "level": "现金奖励", "num_look": 1680043, "num_comment": 38, "author": "xiaoqin00", "tags": ["网络安全"], "text": "我们一谈起网络攻击，大家的第一反应就是跨网域攻击，横隔千里之外，夺取目标权限。但其实，局域网网攻击在网络攻击中也占有一定的比重。"}
{"title": "Kali2.0正式发布（附下载地址、新特性和更新日志）", "url": "https://www.freebuf.com/sectool/74748.html", "time": "2015-08-12", "level": "金币+10", "num_look": 1670708, "num_comment": 52, "author": "diigu", "tags": ["工具"], "text": "Kali 2.0昨天已经在BlackHat 2015 USA上正式发布了。"}
{"title": "联想招聘助理安全工程师", "url": "https://www.freebuf.com/jobs/74656.html", "time": "2015-08-12", "level": "", "num_look": 217287, "num_comment": 13, "author": "fber", "tags": ["安全招聘"], "text": "因业务扩展，联想现招聘助理安全工程师一名，赶紧砸简历过来吧！"}
{"title": "打造一个自动检测页面是否存在XSS的小插件Ⅰ", "url": "https://www.freebuf.com/sectool/74654.html", "time": "2015-08-12", "level": "现金奖励", "num_look": 809703, "num_comment": 22, "author": "Black-Hole", "tags": ["工具", "极客"], "text": "本文将从每段代码，每个步骤讲解“如何自己写一个自动检测网页是否存在XSS”的插件。"}
{"title": "无人机飞跃高楼攻击计算机网络，技术受美军方青睐", "url": "https://www.freebuf.com/news/74712.html", "time": "2015-08-11", "level": "", "num_look": 183800, "num_comment": 13, "author": "UncleCui", "tags": ["资讯"], "text": "目前无人机攻击主要的手段有：直接破坏Wi-Fi网络、创建WiFi蜜罐，使不小心连接上的用户成为猎物。"}
{"title": "提互联网漏洞，HackPwn 2015门票免费Get", "url": "https://www.freebuf.com/fevents/74650.html", "time": "2015-08-11", "level": "", "num_look": 165247, "num_comment": 7, "author": "漏洞盒子", "tags": ["活动"], "text": "真极客，放胆破。在漏洞盒子提交高质量互联网漏洞，Hackpwn2015安全极客狂欢节门票免费Get！还送360安全充电哦~"}
{"title": "浅谈从反木马角度分析怎样提高木马反跟踪能力", "url": "https://www.freebuf.com/articles/system/74679.html", "time": "2015-08-11", "level": "现金奖励", "num_look": 655349, "num_comment": 19, "author": "南拳daddy", "tags": ["系统安全", "网络安全"], "text": "本文重点对木马网络特征行为进行研究，提高木马反跟踪能力。"}
{"title": "序列化漏洞影响半数以上Android手机", "url": "https://www.freebuf.com/news/74676.html", "time": "2015-08-11", "level": "", "num_look": 347913, "num_comment": 3, "author": "Sphinx", "tags": ["漏洞", "资讯"], "text": "Android平台又爆出一重大漏洞，影响55%的手机。"}
{"title": "安卓预装插件成为攻击入口，可控制整个设备", "url": "https://www.freebuf.com/news/74643.html", "time": "2015-08-11", "level": "金币+1", "num_look": 224527, "num_comment": 3, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "安全研究人员又在安卓设备上发现了一个名为Certifi-Gate的安全漏洞，攻击者可以通过安卓预装插件控制整个安卓设备。"}
{"title": "深信服一大波网络安全中高端岗位集中招聘中（欢迎推荐）", "url": "https://www.freebuf.com/jobs/74282.html", "time": "2015-08-11", "level": "", "num_look": 244196, "num_comment": 26, "author": "48093736", "tags": ["安全招聘"], "text": "现因深信服在网络安全领域的快速发展与布局，需要招聘一批中高端骨干人才。"}
{"title": "卡巴斯基实验室第二季度网络威胁报告：移动恶意软件增长近三倍", "url": "https://www.freebuf.com/news/74630.html", "time": "2015-08-11", "level": "", "num_look": 157650, "num_comment": 2, "author": "空白", "tags": ["其他", "安全报告"], "text": "近日，卡巴斯基实验室发布了第二季度网络威胁报告，总结了该季度的主要安全事件，并且对第二季度网络威胁水平进行了评估。"}
{"title": "黑客在Defcon曝光入侵特斯拉Model S车内系统全过程", "url": "https://www.freebuf.com/news/74594.html", "time": "2015-08-11", "level": "", "num_look": 202532, "num_comment": 7, "author": "UncleCui", "tags": ["资讯"], "text": "他们还能够向Model S发出一条“致死”命令，让Model S关闭系统，然后停车。"}
{"title": "Kali 2.0 ISO镜像文件泄漏，大伙可以提前尝鲜了（含下载地址）", "url": "https://www.freebuf.com/news/74623.html", "time": "2015-08-10", "level": "金币+1", "num_look": 1057600, "num_comment": 46, "author": "diigu", "tags": ["工具", "资讯"], "text": "相信大家一定对后天即将发布的Kali 2.0非常期待，然而今天有消息Kali2的ISO镜像文件泄露了！"}
{"title": "BlackHat 2015黑客大会精华报道（8月6日）", "url": "https://www.freebuf.com/news/74586.html", "time": "2015-08-10", "level": "", "num_look": 221116, "num_comment": 3, "author": "FB独家", "tags": ["活动", "资讯"], "text": "下面是黑帽大会第二日（8月6日）的精彩回顾。"}
{"title": "FireFox文件窃取0day漏洞已被黑客“实战”利用，官方紧急发布修复补丁", "url": "https://www.freebuf.com/news/74562.html", "time": "2015-08-10", "level": "", "num_look": 221239, "num_comment": 8, "author": "dawner", "tags": ["漏洞", "资讯"], "text": "在俄罗斯某网站上，研究人员发现了一枚Firefox浏览器严重0day漏洞的利用程序（Exp）代码，可窃取Windows和Linux用户电脑上的文件。这次安全事件迫使Mozilla官方紧急发布补丁。"}
{"title": "奖项公布：“你为何来到这座城市？”活动完美收官", "url": "https://www.freebuf.com/fevents/74535.html", "time": "2015-08-10", "level": "", "num_look": 268126, "num_comment": 38, "author": "明明知道", "tags": ["活动"], "text": "没上榜的筒子也不要灰心，除去榜单中最终我们还是会抽取共计100个幸运同学，送上FreeBuf或漏洞盒子定制鼠标垫。"}
{"title": "黑客定制无人机：对联网设备进行定位和攻击", "url": "https://www.freebuf.com/news/74493.html", "time": "2015-08-10", "level": "", "num_look": 242615, "num_comment": 8, "author": "JackFree", "tags": ["资讯"], "text": "安全研究人员开发出了一种黑客专属定制型无人机，上面包含有一个特别的追踪工具，利用它能够在飞行范围内发现和攻击联网设备。"}
{"title": "我是如何打造一款自动化SQL注入工具的", "url": "https://www.freebuf.com/sectool/74445.html", "time": "2015-08-10", "level": "现金奖励", "num_look": 1291615, "num_comment": 60, "author": "扛把子首席小弟", "tags": ["WEB安全", "工具"], "text": "各位看官看到标题吐槽帝就开始了：已经有了各种各样的注入工具,为什么还要手工打造一个？"}
{"title": "浙江丽水、巴西客运站广告大屏被黑客劫持播放色情视频", "url": "https://www.freebuf.com/news/74479.html", "time": "2015-08-10", "level": "金币+1", "num_look": 342254, "num_comment": 28, "author": "江湖小吓", "tags": ["资讯"], "text": "近期外媒报道了多起广告大屏被黑的事件，其中有两起发生在巴西客运站和中国浙江丽水某购物中心，其数字屏幕都被黑客挂上了色情视频。"}
{"title": "研究人员可远程窃取安卓手机上的指纹数据", "url": "https://www.freebuf.com/news/74509.html", "time": "2015-08-10", "level": "", "num_look": 229481, "num_comment": 4, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "这种攻击称为“指纹传感器监视攻击”。研究人员张玉龙（Yulong Zhang）透露，黑客可以利用这种方法大规模远程获取指纹。"}
{"title": "菏泽市科技信息网遭遇HackingTeam泄漏的0day漏洞攻击", "url": "https://www.freebuf.com/news/74390.html", "time": "2015-08-09", "level": "", "num_look": 189841, "num_comment": 22, "author": "鸢尾", "tags": ["资讯"], "text": "我们在一家中国网站上发现一个有针对性的攻击，攻击者将HackingTeam里的代码几乎原封不动的照搬上去使用。"}
{"title": "Model S有安全漏洞？特斯拉怒挖谷歌安全负责人", "url": "https://www.freebuf.com/news/74475.html", "time": "2015-08-09", "level": "", "num_look": 140349, "num_comment": 1, "author": "UncleCui", "tags": ["资讯"], "text": "现在看来，特斯拉早就开始关注自家汽车的安全问题，因为它已经从谷歌挖来黑客团队的头头负责特斯拉汽车的安全工作。"}
{"title": "【已结束】FreeBuf公开课（直播课程）：Wireshark安全实战", "url": "https://www.freebuf.com/news/73839.html", "time": "2015-08-09", "level": "红色标题", "num_look": 583359, "num_comment": 36, "author": "banish", "tags": ["活动", "资讯"], "text": "本次公开课特邀讲师 孔韬循（K0r4dji）将给大家详细讲解Wireshark常见的基本功能与实战演练。"}
{"title": "Kali Linux 2.0将在8月11日发布", "url": "https://www.freebuf.com/news/74455.html", "time": "2015-08-08", "level": "金币+3", "num_look": 1034909, "num_comment": 64, "author": "cailinlin", "tags": ["资讯"], "text": "在过去的几个月里，Kali开发小组一直在非常积极地工作，下一代Kali Linux即将与大家见面了。"}
{"title": "FireEye：Hacking Team军火库中大量运用iOS假面攻击", "url": "https://www.freebuf.com/articles/terminal/74414.html", "time": "2015-08-08", "level": "", "num_look": 243255, "num_comment": 6, "author": "鸢尾", "tags": ["终端安全"], "text": "FireEye最近从HackingTeam军火库中发现11款iOS App使用了假面攻击，其中有一款恶意App还是针对未越狱用户的。"}
{"title": "BIOS漏洞影响DELL和苹果系统", "url": "https://www.freebuf.com/news/74393.html", "time": "2015-08-08", "level": "金币+3", "num_look": 272637, "num_comment": 11, "author": "langyajiekou", "tags": ["漏洞", "资讯"], "text": "由于BIOS在从睡眠模式唤醒后因未能正确设置写保护，导致攻击者可刷恶意BIOS镜像，漏洞编号为CVE-2015-2890，影响大量DELL系统。"}
{"title": "因黑客攻击，五角大楼电邮系统被迫关闭已两周", "url": "https://www.freebuf.com/news/74402.html", "time": "2015-08-07", "level": "", "num_look": 232315, "num_comment": 10, "author": "明明知道", "tags": ["其他", "资讯"], "text": "据一位不愿透露姓名的美国国防官员称，攻击者入侵了美国五角大楼联合参谋长所使用的电子邮件系统，迫使美国军方采取脱机方式来“清理”系统。"}
{"title": "中国教授在BlackHat现场演示破解SIM卡AES-128加密", "url": "https://www.freebuf.com/news/74383.html", "time": "2015-08-07", "level": "金币+3", "num_look": 1341518, "num_comment": 81, "author": "空白", "tags": ["资讯"], "text": "使用一个PC和示波器克隆3G/4G SIM卡，破解过程只需十分钟。上海交大教授郁昱现场展示了如何成功复制SIM卡，以及一张克隆卡如何变更了支付宝的密码并潜在盗取账户资金。"}
{"title": "BlackHat黑帽大会上展示了如何利用声波窃取电脑数据", "url": "https://www.freebuf.com/news/74368.html", "time": "2015-08-07", "level": "金币+3", "num_look": 312406, "num_comment": 25, "author": "JackFree", "tags": ["资讯"], "text": "通过声波窃取物理隔离的电脑中数据……这不是科幻。"}
{"title": "戏耍XSS的一些技巧", "url": "https://www.freebuf.com/articles/web/74324.html", "time": "2015-08-07", "level": "现金奖励", "num_look": 679863, "num_comment": 26, "author": "Black-Hole", "tags": ["WEB安全"], "text": "今天说的是说XSS的一些技巧，当然了本文也会深入点，代码我会给上注释，如有不懂请在下面留言回复。"}
{"title": "格式化字符串的漏洞利用（Part 1）", "url": "https://www.freebuf.com/articles/system/74224.html", "time": "2015-08-07", "level": "金币+3", "num_look": 482117, "num_comment": 7, "author": "鸢尾", "tags": ["系统安全"], "text": "格式化字符串漏洞是一类允许攻击者在任意内存地址执行读或者写操作的软件缺陷。本教程主要关注C编程程序以及对格式化字符串函数的利用。"}
{"title": "BlackHat 2015黑客大会精华报道（8月5日）", "url": "https://www.freebuf.com/news/74294.html", "time": "2015-08-06", "level": "红色标题", "num_look": 476665, "num_comment": 17, "author": "FB独家", "tags": ["头条", "活动"], "text": "一年一度黑客大会BlackHat正在赌城拉斯维加斯如期举行，全世界顶级黑客再度聚首，集思广益，技术与观点的交汇相触。"}
{"title": "GasPots蜜罐发现，伊朗和叙利亚网军意图攻击自动化加油站", "url": "https://www.freebuf.com/news/74292.html", "time": "2015-08-06", "level": "", "num_look": 159110, "num_comment": 4, "author": "鸢尾", "tags": ["资讯"], "text": "如今全球许多燃料公司都开始使用联网系统来管理他们的油罐，静下来好好想想，如果一个黑客能够通过远程操作来做这些事情……后果将不堪设想。"}
{"title": "百度开放云高薪招聘安全架构师和虚拟化安全研究员", "url": "https://www.freebuf.com/jobs/74090.html", "time": "2015-08-06", "level": "", "num_look": 210606, "num_comment": 8, "author": "百度安全", "tags": ["安全招聘"], "text": "目前，百度开放云已拥有包括云服务器BCC、负载均衡BLB、对象存储BOS、内容分发网络CDN、关系型数据库RDS等全系列共13款云计算产品。"}
{"title": "利用showModalDialog绕过IE的XSS过滤", "url": "https://www.freebuf.com/articles/web/74280.html", "time": "2015-08-06", "level": "金币+3", "num_look": 255496, "num_comment": 5, "author": "鸢尾", "tags": ["WEB安全"], "text": "今天我想与大家分享一篇使用showModalDialog绕过IE的Xss过滤的文章。"}
{"title": "安卓曝无限重启漏洞（CVE-2015-3823），影响近90%安卓手机用户", "url": "https://www.freebuf.com/news/74261.html", "time": "2015-08-06", "level": "金币+6", "num_look": 325002, "num_comment": 14, "author": "dawner", "tags": ["终端安全", "资讯"], "text": "这枚最新漏洞编号为CVE-2015-3823，黑客可利用该loudo让安卓手机无限重启，这听起来有点像Stagefright漏洞，它源于媒体服务器（mediaserver）内置程序设计不当。"}
{"title": "利用赛门铁克Symantec Endpoint Protection漏洞渗透企业网络", "url": "https://www.freebuf.com/vuls/74256.html", "time": "2015-08-06", "level": "现金奖励", "num_look": 366580, "num_comment": 12, "author": "nickchang", "tags": ["漏洞", "系统安全"], "text": "这种架构的问题是，一旦攻击者拿下了管理端，那么他就可以重新部署安装升级包，把木马藏进安装包，推送至客户端执行，从而拿下整个企业网络。"}
{"title": "Mac平台新型蠕虫病毒曝光", "url": "https://www.freebuf.com/news/74216.html", "time": "2015-08-06", "level": "", "num_look": 318383, "num_comment": 19, "author": "明明知道", "tags": ["系统安全", "终端安全"], "text": "如果你认为苹果Mac电脑比Windows系统更安全，请三思。研究人员已经证明了：那不是真的。"}
{"title": "最新版苹果OS X10.10曝权限提升0day漏洞", "url": "https://www.freebuf.com/news/74180.html", "time": "2015-08-05", "level": "", "num_look": 274719, "num_comment": 5, "author": "江湖小吓", "tags": ["系统安全", "终端安全"], "text": "安全研究人员Stefan Esser发现了一个最新苹果OS X 10.10版本中的权限提升0day漏洞，导致攻击者可以root权限来打开或创建所有OS X系统文件而无需账号密码的验证。"}
{"title": "HTML5：<a>的ping属性之死亡ping与隐私追踪", "url": "https://www.freebuf.com/articles/network/74173.html", "time": "2015-08-05", "level": "现金奖励", "num_look": 522843, "num_comment": 15, "author": "xisigr", "tags": ["网络安全"], "text": "在HTML5中 标签加入了一个新的属性ping。设计者加入它的理由是， Ping可以使浏览器对外发送一个异步请求，通常用来广告的追踪、点击率统计或完成一次HTTP重定向。"}
{"title": "雅虎广告网络被黑，恶意广告感染数百万设备", "url": "https://www.freebuf.com/news/74160.html", "time": "2015-08-05", "level": "", "num_look": 289002, "num_comment": 5, "author": "哆啦A梦", "tags": ["WEB安全", "资讯"], "text": "攻击者在雅虎广告网络中发现一个漏洞，并成功感染了数百万人的电脑。"}
{"title": "ISC 2015中国互联网安全大会亮点抢先看", "url": "https://www.freebuf.com/news/74092.html", "time": "2015-08-05", "level": "红色标题", "num_look": 1278723, "num_comment": 106, "author": "明明知道", "tags": ["活动", "资讯"], "text": "中国互联网安全大会（ISC）是亚太地区规模最大、最具权威性的安全盛会。"}
{"title": "利用Teensy进行em410x卡模拟以及暴力破解em410x类门禁系统", "url": "https://www.freebuf.com/articles/wireless/74133.html", "time": "2015-08-05", "level": "金币+6", "num_look": 459104, "num_comment": 10, "author": "mrzcpo", "tags": ["无线安全", "极客"], "text": "这一次我们说的就是基于125kHz下的EM410x系列用于门禁ID识别之用。"}
{"title": "攻击Square移动读卡器，窃取你的信用卡数据", "url": "https://www.freebuf.com/news/74117.html", "time": "2015-08-05", "level": "", "num_look": 282192, "num_comment": 5, "author": "JackFree", "tags": ["资讯"], "text": "三位安全研究人员将在这两天举行的BlackHat黑客大会上展示他们的研究成果。"}
{"title": "好书推荐：《黑客秘笈：渗透测试实用指南》", "url": "https://www.freebuf.com/fevents/73947.html", "time": "2015-08-04", "level": "红色标题", "num_look": 3092819, "num_comment": 313, "author": "FB客服", "tags": ["活动"], "text": "在本文评论中，晒出你的工作台现状（图片+描述）。FreeBuf将从中抽取30位“桌面达人”，免费赠送新鲜出炉的《黑客秘笈——渗透测试实用指南》。"}
{"title": "开源版ZoomEye：基于Python的网络侦查框架 - IVRE", "url": "https://www.freebuf.com/sectool/74083.html", "time": "2015-08-04", "level": "", "num_look": 623145, "num_comment": 17, "author": "phper", "tags": ["工具"], "text": "IVRE（又名DRUNK）是一款网络侦查框架，包括两个基于p0f和Bro的被动侦查模块和一个基于Nmap&Zmap的主动侦查模块，其功能类似于国内知道创宇公司推出的一款网络空间搜索引擎ZoomEye。"}
{"title": "首届Bugscan沙龙将于8月15号在西安举办", "url": "https://www.freebuf.com/fevents/74060.html", "time": "2015-08-04", "level": "", "num_look": 229566, "num_comment": 10, "author": "kun", "tags": ["活动"], "text": "首届Bugscan圈子沙龙，将于2015年8月15号在西安举办。"}
{"title": "挑战勒索软件：如何夺回“被勒索”的文件？", "url": "https://www.freebuf.com/articles/system/74055.html", "time": "2015-08-04", "level": "", "num_look": 279673, "num_comment": 10, "author": "明明知道", "tags": ["系统安全"], "text": "被勒索软件“绑架”了咋办？"}
{"title": "Mac OS X完美版iOS 8.4太极越狱工具发布", "url": "https://www.freebuf.com/news/74021.html", "time": "2015-08-04", "level": "", "num_look": 150964, "num_comment": 3, "author": "dawner", "tags": ["资讯"], "text": "iOS 8.4用户的福音到来，中国太极越狱团队发布了期待已久的iOS 8.4完美越狱工具。"}
{"title": "流行DNS服务器软件BIND曝严重DoS漏洞", "url": "https://www.freebuf.com/news/74036.html", "time": "2015-08-04", "level": "金币+6", "num_look": 286472, "num_comment": 7, "author": "dawner", "tags": ["漏洞", "资讯"], "text": "BIND是世界上最流行的DNS服务器软件之一。互联网协会（ISC）发布了漏洞CVE-2015-5477的补丁，这是个影响BIND服务器的严重拒绝服务漏洞。"}
{"title": "劫持卫星通信，仅需成本1000美元的设备", "url": "https://www.freebuf.com/news/74025.html", "time": "2015-08-04", "level": "", "num_look": 252475, "num_comment": 24, "author": "JackFree", "tags": ["资讯"], "text": "安全研究人员研制了一种破解卫星跟踪技术的设备，这种设备由现成的元件构成，成本只有1000美元。"}
{"title": "全球最大的比特币交易平台Mt.Gox总裁被日本警方拘捕", "url": "https://www.freebuf.com/news/74042.html", "time": "2015-08-04", "level": "", "num_look": 180217, "num_comment": 9, "author": "森碟", "tags": ["资讯"], "text": "还记得Mt.Gox？没错，就是全球最大的比特币交易平台！"}
{"title": "全球十大必去的黑客大会", "url": "https://www.freebuf.com/news/74013.html", "time": "2015-08-04", "level": "金币+8", "num_look": 747901, "num_comment": 14, "author": "fber", "tags": ["头条", "资讯"], "text": "全球必去的10大安全大会！"}
{"title": "带后门的TrueCrypt：间谍活动“Potao”新发现", "url": "https://www.freebuf.com/news/73973.html", "time": "2015-08-03", "level": "", "num_look": 199878, "num_comment": 4, "author": "明明知道", "tags": ["资讯"], "text": "ESET发布了一份报告显示，代号“Potao行动”的网络间谍活动依赖于挂马TrueCrypt俄语版的软件传播。"}
{"title": "美国国安局（NSA）发布简报：中国黑客5年内成功入侵600多家美国企业机构", "url": "https://www.freebuf.com/news/73988.html", "time": "2015-08-03", "level": "金币+8", "num_look": 395516, "num_comment": 86, "author": "bonABC", "tags": ["资讯"], "text": "美国安局局长兼军事网络部司令官德Rogers称或会破坏中国网络防火墙来报复中国政府。"}
{"title": "Angler钓鱼攻击工具包可感染PoS机系统", "url": "https://www.freebuf.com/news/73911.html", "time": "2015-08-03", "level": "", "num_look": 211269, "num_comment": 3, "author": "JackFree", "tags": ["工具", "资讯"], "text": "趋势科技的安全专家发现，攻击者已经开始利用Angler钓鱼攻击工具包寻找并感染PoS系统。"}
{"title": "Win10新浏览器Edge：性能升，危险增", "url": "https://www.freebuf.com/news/73858.html", "time": "2015-08-03", "level": "", "num_look": 305891, "num_comment": 13, "author": "月球下雨了", "tags": ["资讯"], "text": "相比IE在显著提升了安全性能的同时，Edge也随之带来了旧版中并不存在的新型潜在威胁。"}
{"title": "全程回放：黑客是如何远程控制切诺基汽车的？【FreeBuf视频】", "url": "https://www.freebuf.com/articles/terminal/73814.html", "time": "2015-08-02", "level": "红色标题", "num_look": 775882, "num_comment": 5, "author": "FB视频", "tags": ["终端安全", "视频"], "text": "Charlie Miller和Chris Valasek历时一年，研发出了一套可以攻破切诺基2014款吉普的工具，而且可以通过无线网络进行攻破。"}
{"title": "Windows 10默认上传用户敏感信息", "url": "https://www.freebuf.com/news/73872.html", "time": "2015-08-02", "level": "金币+8", "num_look": 329508, "num_comment": 25, "author": "JackFree", "tags": ["资讯"], "text": "如果你已经安装了Windows 10，并在安装过程中同意了安装条款，这意味着你已经被微软监视了——这并不是阴谋论。"}
{"title": "Android Broadcast组件权限绕过漏洞", "url": "https://www.freebuf.com/articles/terminal/73885.html", "time": "2015-08-02", "level": "", "num_look": 425090, "num_comment": 6, "author": "Lee-Christmas", "tags": ["终端安全"], "text": "Lolipop源码已经放出有些日子了，我发现google在Android 5.0上修复了一个高危漏洞，利用该漏洞可以发送任意广播。"}
{"title": "向网友分享你的WiFi密码：Win10新特性Wi-Fi Sense引争议", "url": "https://www.freebuf.com/news/73837.html", "time": "2015-08-01", "level": "金币+8", "num_look": 311000, "num_comment": 46, "author": "江湖小吓", "tags": ["资讯"], "text": "你应该知道Windows 10新推出的Wi-Fi共享功能Wi-Fi Sense可以自动让你的朋友连接到你的无线网络，而无需提供任何Wi-Fi密码。"}
{"title": "可远程开走通用汽车的黑客设备OwnStar", "url": "https://www.freebuf.com/news/73792.html", "time": "2015-07-31", "level": "", "num_look": 307529, "num_comment": 2, "author": "cindy", "tags": ["资讯"], "text": "OwnStar可劫持OnStar RemoteLink移动APP的流量，对通用汽车进行远程定位、解锁和启动。"}
{"title": "再探Stagefright漏洞：关于POC与EXP", "url": "https://www.freebuf.com/vuls/73791.html", "time": "2015-07-31", "level": "", "num_look": 447417, "num_comment": 6, "author": "金山毒霸", "tags": ["漏洞"], "text": "在之前的《抛砖引玉——Stagefright漏洞初探》中，我们确定了漏洞的产生位置，然后整篇文章就戛然而止了。此漏洞毕竟影响很深，本篇文章来简单扒一扒漏洞利用的方案。"}
{"title": "杀毒软件BitDefender被黑，客户数据疑泄露", "url": "https://www.freebuf.com/news/73793.html", "time": "2015-07-31", "level": "", "num_look": 304673, "num_comment": 11, "author": "明明知道", "tags": ["数据安全", "资讯"], "text": "黑客DedoxRansome说：“我窃取了他们一个主服务器中的登录数据。”"}
{"title": "一次意外的0day之旅", "url": "https://www.freebuf.com/articles/terminal/73775.html", "time": "2015-07-31", "level": "", "num_look": 329822, "num_comment": 32, "author": "百度安全", "tags": ["终端安全"], "text": "这个“0day”，算是我们在构造样本中的副产物。"}
{"title": "首款企业应急响应中心开发框架 - SRCMS·轻响应", "url": "https://www.freebuf.com/news/73766.html", "time": "2015-07-31", "level": "", "num_look": 402633, "num_comment": 21, "author": "martin_zhou", "tags": ["企业安全", "工具"], "text": "Security Response Content Management System（简称：SRCMS/轻响应）是一款针对企业应急响应中心开发的模板框架。"}
{"title": "安卓再曝新漏洞：可远程致使用户无法接打电话", "url": "https://www.freebuf.com/news/73755.html", "time": "2015-07-31", "level": "", "num_look": 300269, "num_comment": 10, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "这两天安全研究人员再曝可远程致使安卓设备无法正常接打电话的最新漏洞。"}
{"title": "Python eval的常见错误封装及利用原理", "url": "https://www.freebuf.com/articles/web/73658.html", "time": "2015-07-31", "level": "现金奖励", "num_look": 336912, "num_comment": 2, "author": "xxlegend", "tags": ["WEB安全"], "text": "最近在代码评审的过程，发现挺多错误使用eval导致代码注入的问题，这些都是血淋淋的教训，大家使用的时候多加注意。"}
{"title": "《史密斯夫妇》黑客版：黑掉智能枪并控制弹道（含视频）", "url": "https://www.freebuf.com/articles/terminal/73667.html", "time": "2015-07-31", "level": "金币+15", "num_look": 265399, "num_comment": 12, "author": "月尽西楼", "tags": ["其他", "终端安全"], "text": "《史密斯夫妇》黑客加强版，随意感受下"}
{"title": "彭博社：中国黑客入侵了美国联合航空公司", "url": "https://www.freebuf.com/news/73724.html", "time": "2015-07-31", "level": "", "num_look": 334277, "num_comment": 8, "author": "明明知道", "tags": ["数据安全", "资讯"], "text": "彭博社报道，盗取了美国保险公司Anthem和联邦人事局千万级敏感数据的中国黑客，大约在同一时间入侵了美国联合航空公司。"}
{"title": "小区RFID电卡的那些事儿", "url": "https://www.freebuf.com/articles/terminal/73666.html", "time": "2015-07-30", "level": "金币+15", "num_look": 704330, "num_comment": 34, "author": "banish", "tags": ["极客", "终端安全"], "text": "炎炎夏日，很快发现每天骑车出去电动车电卡的消费惊人呀……"}
{"title": "Python安全编码与代码审计", "url": "https://www.freebuf.com/articles/web/73669.html", "time": "2015-07-30", "level": "金币+15", "num_look": 496363, "num_comment": 14, "author": "xxlegend", "tags": ["WEB安全"], "text": "现在一般的web开发框架安全已经做的挺好的了，比如大家常用的django，但是一些不规范的开发方式还是会导致一些常用的安全问题，下面就针对这些常用问题做一些总结。"}
{"title": "入侵门禁系统的“神器”仅售10美刀", "url": "https://www.freebuf.com/news/73652.html", "time": "2015-07-30", "level": "", "num_look": 333521, "num_comment": 22, "author": "cindy", "tags": ["资讯"], "text": "下周他们将会在拉斯维加斯举办的Black Hat大会上展示他们的发现及其研究成果，并计划将BLEkey出售，前200个购买者只需10刀就可买到一个。"}
{"title": "键盘敲击识别技术真的靠谱吗？", "url": "https://www.freebuf.com/news/73640.html", "time": "2015-07-30", "level": "", "num_look": 218169, "num_comment": 5, "author": "明明知道", "tags": ["其他", "资讯"], "text": "现在有一个有意思的行为生物识别是“你是如何打字的”，或称为输入行为生物识别技术。"}
{"title": "奥巴马政府拒绝赦免斯诺登的请愿", "url": "https://www.freebuf.com/news/73628.html", "time": "2015-07-30", "level": "金币+15", "num_look": 193196, "num_comment": 24, "author": "arain", "tags": ["资讯"], "text": "近日，美国奥巴马政府正式拒绝了由167954人联合签名的赦免斯诺登的请愿。"}
{"title": "技术分析：关于安卓libStagefright系列漏洞分析", "url": "https://www.freebuf.com/vuls/73618.html", "time": "2015-07-30", "level": "", "num_look": 436067, "num_comment": 6, "author": "百度安全", "tags": ["漏洞"], "text": "此次安全漏洞号称影响“95%”安卓手机的安全。通过跟进此次漏洞的攻击面来看，这种说法毫不夸张。"}
{"title": "黑色藤蔓（Black Vine）：专攻航空航天和医疗保险的网络间谍组织", "url": "https://www.freebuf.com/news/73600.html", "time": "2015-07-30", "level": "金币+15", "num_look": 356805, "num_comment": 10, "author": "森碟", "tags": ["头条", "安全报告"], "text": "赛门铁克认为入侵Anthem的幕后黑手一定是非常强大的网络间谍组织Black Vine（黑色藤蔓），而且Anthem也只是该间谍组织众多攻击目标中的其中一个。"}
{"title": "香港、台湾电视台及政府网站遭Hacking Team泄露武器攻击", "url": "https://www.freebuf.com/news/73585.html", "time": "2015-07-29", "level": "", "num_look": 237517, "num_comment": 10, "author": "明明知道", "tags": ["资讯"], "text": "7月9日开始便有黑客团队对台湾和香港网站发起攻击，所用工具竟然是Hacking Team泄出的Flash漏洞利用程序PoisonIvy。"}
{"title": "苹果APP Store和iTunes Store曝高危漏洞（含视频）", "url": "https://www.freebuf.com/news/73570.html", "time": "2015-07-29", "level": "", "num_look": 235210, "num_comment": 4, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "苹果官方App Store 和iTunes Store中发现一个高危漏洞，影响数百万苹果用户。"}
{"title": "广州天融信招渗透测试人员", "url": "https://www.freebuf.com/jobs/73463.html", "time": "2015-07-29", "level": "红色标题", "num_look": 585382, "num_comment": 47, "author": "topsec", "tags": ["安全招聘"], "text": "北京天融信科技股份有限公司，天融信是中国领先的信息安全产品与服务解决方案提供商。"}
{"title": "如何追踪对方手机GSM网络是否在线", "url": "https://www.freebuf.com/articles/wireless/73545.html", "time": "2015-07-29", "level": "金币+15", "num_look": 422283, "num_comment": 11, "author": "living", "tags": ["无线安全"], "text": "我们可以追踪目标对象的GSM网络活动，知道其设备什么时候是开着的，而又不让其察觉。"}
{"title": "Windows 10发布前夕，微软还在“打地鼠”般匆忙修复漏洞", "url": "https://www.freebuf.com/news/73565.html", "time": "2015-07-29", "level": "金币+15", "num_look": 195732, "num_comment": 11, "author": "arain", "tags": ["资讯"], "text": "微软之前官方宣布将在美国当地时间2015年7月29日正式对外发布Windows 10。"}
{"title": "防黑指南：普通用户上网时该注意什么？", "url": "https://www.freebuf.com/news/topnews/73477.html", "time": "2015-07-29", "level": "", "num_look": 193401, "num_comment": 8, "author": "直接", "tags": ["其他", "头条"], "text": "想要阻挠攻击者最好的方法就是给他们的“工作”增加难度，千万不要成为那个被黑客标记为“简单”的待宰羔羊，要迫使攻击者走投无路然后换个地方寻找猎物。"}
{"title": "利用低端手机入侵被物理隔离的计算机", "url": "https://www.freebuf.com/news/73530.html", "time": "2015-07-29", "level": "金币+4", "num_look": 236819, "num_comment": 12, "author": "JackFree", "tags": ["资讯"], "text": "在核电站等保密环境中通常对计算机进行了物理隔离，但是以色列安全研究人员通过一个低端的手机仍然可以黑掉它们。"}
{"title": "美国国安局（NSA）将销毁海量历史监控数据", "url": "https://www.freebuf.com/news/73527.html", "time": "2015-07-29", "level": "", "num_look": 142241, "num_comment": 3, "author": "Sphinx", "tags": ["资讯"], "text": "对于曾经收集的大量美国电话记录，美国国家安全局（NSA）将会限制数据读取并最终销毁。"}
{"title": "埃隆·马斯克和史蒂芬·霍金联合警告：小心“机器人杀手”", "url": "https://www.freebuf.com/news/73491.html", "time": "2015-07-29", "level": "红色标题", "num_look": 368990, "num_comment": 15, "author": "明明知道", "tags": ["其他", "资讯"], "text": "包括埃隆·马斯克和史蒂芬.霍金在内的一批科学家、研究人员及学者警告：如果再不采取任何预防措施，不久将会出现一场人工智能（AI）军事装备竞赛。"}
{"title": "我是如何在Periscope管理面板中绕过Google认证的", "url": "https://www.freebuf.com/articles/web/73383.html", "time": "2015-07-28", "level": "", "num_look": 286589, "num_comment": 2, "author": "鸢尾", "tags": ["WEB安全"], "text": "Periscope是一个属于Twitter的iOS/Android应用，主要用于现场直播。"}
{"title": "安卓Stagefright高危漏洞初探", "url": "https://www.freebuf.com/articles/terminal/73517.html", "time": "2015-07-28", "level": "", "num_look": 725770, "num_comment": 14, "author": "金山毒霸", "tags": ["终端安全"], "text": "这听起来可是难得一遇的大漏洞啊，作为安全人员，自然要好好扒一扒内幕了。"}
{"title": "寻医问药网招聘信息安全岗", "url": "https://www.freebuf.com/jobs/73468.html", "time": "2015-07-28", "level": "", "num_look": 368502, "num_comment": 16, "author": "xywy", "tags": ["安全招聘"], "text": "寻医问药网成立于2004年，隶属于世纪闻康（北京）科技发展有限公司，是中国最大的一站式互联网医疗服务平台。"}
{"title": "社会工程学工具集Social-Engineer Toolkit基础使用教程", "url": "https://www.freebuf.com/sectool/73409.html", "time": "2015-07-28", "level": "金币+4", "num_look": 1784570, "num_comment": 29, "author": "喵呜君", "tags": ["工具"], "text": "本着有事没事都参一脚的精神，这篇文章只是基础性的简介，并没有全面的去介绍其各种玩法。"}
{"title": "安卓曝大漏洞：一条彩信可控制手机，影响95%设备", "url": "https://www.freebuf.com/news/73411.html", "time": "2015-07-28", "level": "金币+4", "num_look": 957250, "num_comment": 61, "author": "月尽西楼", "tags": ["漏洞", "终端安全"], "text": "只需简单的一条彩信，黑客就可能完全控制用户手机。"}
{"title": "基于Node.js的跨平台Web抓包替换工具 - LivePool", "url": "https://www.freebuf.com/sectool/73408.html", "time": "2015-07-28", "level": "金币+4", "num_look": 589699, "num_comment": 9, "author": "妇科圣手", "tags": ["WEB安全", "工具"], "text": "LivePool 是一个基于 NodeJS，类似 Fiddler 能够支持抓包和本地替换的 Web 开发调试工具，是Tencent AlloyTeam 在开发实践过程总结出的一套的便捷的 WorkFlow 以及调试方案。"}
{"title": "移动APP上的广告劫持每天造成PB级的数据浪费", "url": "https://www.freebuf.com/news/73397.html", "time": "2015-07-28", "level": "", "num_look": 157957, "num_comment": 5, "author": "JackFree", "tags": ["资讯"], "text": "据估计移动平台广告劫持导致每天有PB级（1PB=100万GB）的数据被浪费。"}
{"title": "使用Mozilla Investigator（MIG）检测未知主机", "url": "https://www.freebuf.com/sectool/73338.html", "time": "2015-07-28", "level": "", "num_look": 436232, "num_comment": 1, "author": "鸢尾", "tags": ["工具", "系统安全"], "text": "MIG即使检测数千台服务器速度依旧很快，其只专注于在大量的系统中搜索正则表达式和字符串，非常高效。"}
{"title": "完整，模块化，轻量级，易扩展的MITM框架 - bettercap", "url": "https://www.freebuf.com/sectool/73287.html", "time": "2015-07-28", "level": "金币+4", "num_look": 676945, "num_comment": 13, "author": "鸢尾", "tags": ["工具"], "text": "bettercap是一款完整，模块化，轻量级，易扩展的中间人攻击测试工具和框架。"}
{"title": "有工具了，如何快速发现Windows中毒（含工具下载）", "url": "https://www.freebuf.com/articles/others-articles/73343.html", "time": "2015-07-27", "level": "金币+4", "num_look": 380500, "num_comment": 20, "author": "明明知道", "tags": ["其他", "系统安全"], "text": "本文是之前《没有外部工具，如何快速发现Windows中毒了》的姊妹篇，探讨Windows电脑感染多种典型病毒后，在没有专业杀毒软件情况下的快速检测方法。"}
{"title": "FreeBuf全球安全事件纵览（2015年6月）：彼岸", "url": "https://www.freebuf.com/news/73294.html", "time": "2015-07-27", "level": "红色标题", "num_look": 358031, "num_comment": 6, "author": "cindy", "tags": ["头条", "安全报告"], "text": "当我们仰望不到星空时，或许应当低头看看脚下的路。"}
{"title": "一个用ADS（供选数据流）隐藏Windows后门的方法", "url": "https://www.freebuf.com/articles/73270.html", "time": "2015-07-27", "level": "现金奖励", "num_look": 741639, "num_comment": 27, "author": "nickchang", "tags": ["文章", "系统安全"], "text": "这里介绍另一种方法，把一个后门隐藏在ADS (供选数据流/ alternate data stream)里面。"}
{"title": "使用HTTP Headers防御WEB攻击（Part3）", "url": "https://www.freebuf.com/news/73273.html", "time": "2015-07-27", "level": "", "num_look": 160854, "num_comment": 2, "author": "鸢尾", "tags": ["资讯"], "text": "在本文中，我们将探索如何利用HTTP Headers保卫我们的Cookies。"}
{"title": "远程控制切诺基汽车的攻击方法公布后，克莱斯勒紧急召回140万辆汽车", "url": "https://www.freebuf.com/news/73258.html", "time": "2015-07-27", "level": "金币+4", "num_look": 354847, "num_comment": 19, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "在安全研究人员现场成功演示黑掉一辆切诺基吉普车之后，克莱斯勒公司紧急召回了140万辆可能受影响的汽车。"}
{"title": "强大的安卓手机远程管理工具 - Droidjack", "url": "https://www.freebuf.com/articles/73252.html", "time": "2015-07-26", "level": "红色标题", "num_look": 1543548, "num_comment": 57, "author": "xiaoxin", "tags": ["文章"], "text": "Droidjack是一款针对安卓手机远程管理工具，你可以利用它在PC上对手机进行远程操控，不仅功能强大，使用也很方便。"}
{"title": "苹果、三星纷纷中枪：没有一个智能手表是安全的", "url": "https://www.freebuf.com/news/73239.html", "time": "2015-07-26", "level": "金币+4", "num_look": 222100, "num_comment": 11, "author": "dawner", "tags": ["资讯"], "text": "你有智能手表？那你可得小心了。"}
{"title": "神秘のPKAV团队火热招聘ing~", "url": "https://www.freebuf.com/jobs/73206.html", "time": "2015-07-25", "level": "", "num_look": 558693, "num_comment": 44, "author": "only_guest", "tags": ["安全招聘"], "text": "这是一个誓与AV抢宅男的神秘团队！"}
{"title": "路由器安全测试工具Router Scan  by Stas'M v2.52发布", "url": "https://www.freebuf.com/sectool/73220.html", "time": "2015-07-25", "level": "金币+4", "num_look": 525502, "num_comment": 43, "author": "w85040", "tags": ["工具"], "text": "Router Scan是一款路由器安全测试工具，可以指定IP段对路由器进行暴力破解等安全测试。"}
{"title": "四个IE浏览器0day漏洞被公布", "url": "https://www.freebuf.com/news/73224.html", "time": "2015-07-25", "level": "金币+4", "num_look": 275429, "num_comment": 15, "author": "JohnChu", "tags": ["漏洞", "资讯"], "text": "惠普公司的Zero-Day Initiative (ZDI)团队公布了四个针对微软IE浏览器的0day漏洞，这些漏洞可导致受害者主机被远程执行恶意代码。"}
{"title": "如何在Kali Linux下实现多显示器多壁纸效果", "url": "https://www.freebuf.com/sectool/73111.html", "time": "2015-07-25", "level": "", "num_look": 393311, "num_comment": 13, "author": "banish", "tags": ["其他", "工具"], "text": "研究了一会，我终于找到了一个在linux操作环境下在多个显示器上使用不同壁纸的解决方案了！"}
{"title": "iPhone蓝屏0day漏洞分析：播放视频触发内核拒绝服务", "url": "https://www.freebuf.com/articles/terminal/73177.html", "time": "2015-07-24", "level": "金币+4", "num_look": 398247, "num_comment": 8, "author": "360NirvanTeam", "tags": ["终端安全"], "text": "近期苹果设备的用户点击这个视频链接播放视频时会造成苹果设备重启。"}
{"title": "美国人口普查局系统被黑，匿名者（Anonymous）再袭", "url": "https://www.freebuf.com/news/73182.html", "time": "2015-07-24", "level": "金币+4", "num_look": 259752, "num_comment": 23, "author": "月球下雨了", "tags": ["资讯"], "text": "美国著名黑客组织匿名者Anonymous扫荡了美国人口普查局的服务器，顺走了数据库，然后他们把内容丢到了互联网上……"}
{"title": "窃听电话的Hacking Team RCSAndroid木马", "url": "https://www.freebuf.com/news/73149.html", "time": "2015-07-24", "level": "金币+4", "num_look": 342018, "num_comment": 10, "author": "明明知道", "tags": ["终端安全", "资讯"], "text": "安卓设备小心：4.0-4.3版本都可以被RCSAndroid 搞定。"}
{"title": "Wordpress曝XSS高危漏洞，影响上百万网站", "url": "https://www.freebuf.com/news/73139.html", "time": "2015-07-24", "level": "", "num_look": 302851, "num_comment": 10, "author": "cindy", "tags": ["资讯"], "text": "Wordpress内容管理系统（CMS）刚刚发布了更新——4.2.3版本，修复一个严重的、影响数百万网站的安全漏洞。"}
{"title": "OpenSSH曝高危漏洞，Linux主机面临暴力破解威胁", "url": "https://www.freebuf.com/news/73132.html", "time": "2015-07-24", "level": "金币+4", "num_look": 672519, "num_comment": 21, "author": "Sphinx", "tags": ["资讯"], "text": "OpenSSH软件被爆出一个简单却高危的漏洞，攻击者可以在短时间内进行数千次的登录尝试。"}
{"title": "大数据安全分析之四（分析师篇）", "url": "https://www.freebuf.com/articles/neopoints/73053.html", "time": "2015-07-24", "level": "", "num_look": 338669, "num_comment": 7, "author": "ZenMind", "tags": ["观点"], "text": "解决方案总是要涉及到产品技术、流程和人三个方面，其中人的因素最为重要。"}
{"title": "Hacking Team持续追踪之Flash Exploit", "url": "https://www.freebuf.com/vuls/73074.html", "time": "2015-07-24", "level": "", "num_look": 340667, "num_comment": 8, "author": "ADLab", "tags": ["漏洞"], "text": "7月以来泄露的0day还真是让人欢喜让人忧。相比于Malwaredontneedcoffee时不时放出样本中不人道的混淆加密，人家HackTeam提供的可是缩进工整、变量命名规范、有注释、有辅助调试模块的Exploit工程。"}
{"title": "网速为什么很慢？是路由器选错加密方式了！", "url": "https://www.freebuf.com/news/73079.html", "time": "2015-07-23", "level": "金币+4", "num_look": 1113709, "num_comment": 20, "author": "江湖小吓", "tags": ["无线安全", "资讯"], "text": "通常我们都会对路由器的做出一些安全设置，然而如果安全设置不当可能会使整个网络变慢。"}
{"title": "西门子多个产品存在安全问题，部分补丁已释放", "url": "https://www.freebuf.com/news/73064.html", "time": "2015-07-23", "level": "", "num_look": 246967, "num_comment": 4, "author": "cindy", "tags": ["终端安全", "资讯"], "text": "西门子近日发布了有关软件和固件的安全更新，称公司多个产品都存在安全问题，建议用户尽快更新。"}
{"title": "苹果Yosemite操作系统本地提权：EXP长度不超过一条Twitter", "url": "https://www.freebuf.com/news/73059.html", "time": "2015-07-23", "level": "", "num_look": 189696, "num_comment": 15, "author": "明明知道", "tags": ["资讯"], "text": "苹果最新操作系统Yosemite被爆出一个本地提权漏洞，并已经在OS X 10.10-10.10.4测试成功。"}
{"title": "谷歌、Facebook、雅虎共享IP黑名单", "url": "https://www.freebuf.com/news/73022.html", "time": "2015-07-23", "level": "金币+5", "num_look": 366013, "num_comment": 13, "author": "dawner", "tags": ["WEB安全", "资讯"], "text": "近日网络科技巨头Google、Facebook、Yahoo公司携手启动了一个新计划，阻止黑名单中IP地址刷web流量。"}
{"title": "社工与社工库的那些事", "url": "https://www.freebuf.com/articles/network/72548.html", "time": "2015-07-23", "level": "", "num_look": 779933, "num_comment": 38, "author": "cailinlin", "tags": ["网络安全"], "text": "什么是社工？是不是经常听见说谁又被社工了，或者谁社工了谁？那么到底什么是社工？"}
{"title": "研究人员将在BlackHat大会上展示如何远程控制道奇、吉普汽车", "url": "https://www.freebuf.com/news/72981.html", "time": "2015-07-23", "level": "", "num_look": 254963, "num_comment": 14, "author": "cindy", "tags": ["资讯"], "text": "两位明星级安全研究员Charlie Miller、Chris Valasek又一次向我们展示了利用智能汽车系统漏洞远程入侵一辆联网的吉普切诺基汽车。"}
{"title": "招商银行招聘信息安全岗位", "url": "https://www.freebuf.com/jobs/72948.html", "time": "2015-07-22", "level": "", "num_look": 372941, "num_comment": 23, "author": "xysky", "tags": ["安全招聘"], "text": "招商银行，是中国第一家完全由企业法人持股的股份制商业银行。现总行信息技术部招聘安全管理岗，正式编制，具有竞争力的薪酬。"}
{"title": "「黑客与极客精酿啤酒」已上架FB商城", "url": "https://www.freebuf.com/articles/others-articles/72985.html", "time": "2015-07-22", "level": "", "num_look": 311947, "num_comment": 32, "author": "FB客服", "tags": ["其他"], "text": "FreeBuf联合「零壹精酿」推出全宇宙首支“黑客与极客啤酒”，首批供货（限量）已上架FreeBuf商城。"}
{"title": "没有外部工具，如何快速发现Windows中毒了", "url": "https://www.freebuf.com/articles/others-articles/72904.html", "time": "2015-07-22", "level": "", "num_look": 491481, "num_comment": 30, "author": "明明知道", "tags": ["其他", "系统安全"], "text": "如果你执行了如下检测，便可发现存在感染并快速杀掉它。所有这些事情都可以由一个建立于Windows命令行功能的管理员命令提示符完成。"}
{"title": "漏洞盒子发布《2015上半年度金融行业互联网安全报告》", "url": "https://www.freebuf.com/news/72815.html", "time": "2015-07-22", "level": "红色标题", "num_look": 681740, "num_comment": 14, "author": "漏洞盒子", "tags": ["WEB安全", "头条"], "text": "互联网上数以万计的金融业安全漏洞，可以较为客观的反映一定时间内各金融细分行业的安全状态与威胁挑战。"}
{"title": "全网MongoDB数据库泄露数据量高达595.2TB", "url": "https://www.freebuf.com/news/72942.html", "time": "2015-07-22", "level": "", "num_look": 240999, "num_comment": 7, "author": "dawner", "tags": ["资讯"], "text": "知名设备安全搜索引擎Shodan的创始人John Matherly表示，全网MongoDB数据库泄露数据量高达595.2TB。其中原因多是为MongoDB版本过于老旧或是随意放在公网没有经过身份验证。"}
{"title": "极客DIY：轻松使用树莓派控制灯", "url": "https://www.freebuf.com/news/topnews/72796.html", "time": "2015-07-22", "level": "金币+5", "num_look": 653094, "num_comment": 9, "author": "明明知道", "tags": ["头条", "极客"], "text": "笔者在文章中分享了如何使用树莓派2及一些其他电子元件来控制房间的灯光。"}
{"title": "俄罗斯对五角大楼发动钓鱼攻击", "url": "https://www.freebuf.com/news/72757.html", "time": "2015-07-22", "level": "", "num_look": 185324, "num_comment": 9, "author": "Sphinx", "tags": ["资讯"], "text": "这个来自俄罗斯的顶尖APT（高级持续性威胁）攻击小组曾攻击过美国白宫和国务院，最近又开始对五角大楼发动了钓鱼攻击。"}
{"title": "大数据安全分析之三（可视化篇）", "url": "https://www.freebuf.com/articles/database/72880.html", "time": "2015-07-22", "level": "金币+5", "num_look": 491066, "num_comment": 5, "author": "ZenMind", "tags": ["数据安全", "观点"], "text": "熟悉金字塔原理的人都了解一个事实，人脑的短期记忆最大能够保持7个左右的元素，这意味着在分析工作中只能跟踪非常有限的数据。"}
{"title": "微软发布紧急更新：严重远程代码执行漏洞，影响所有版本Windows", "url": "https://www.freebuf.com/news/72929.html", "time": "2015-07-21", "level": "金币+5", "num_look": 750632, "num_comment": 16, "author": "Sphinx", "tags": ["漏洞", "资讯"], "text": "无论你用的是什么版本Windows系统，建议你都得要更新一下了——这枚高危漏洞能让攻击者远程运行恶意代码控制整个系统。"}
{"title": "爬取QQ空间3000万用户，玩玩大数据分析", "url": "https://www.freebuf.com/articles/others-articles/72886.html", "time": "2015-07-21", "level": "金币+5", "num_look": 974096, "num_comment": 48, "author": "妇科圣手", "tags": ["其他"], "text": "这是我近期使用C#写的一个QQ空间蜘蛛网爬虫程序。程序断断续续的运行了两周，目前总共爬了3000万QQ数据，其中有300万包含用户。"}
{"title": "偷情网站AshleyMadison被黑，3700万用户敏感数据泄露", "url": "https://www.freebuf.com/news/72869.html", "time": "2015-07-21", "level": "金币+5", "num_look": 734259, "num_comment": 26, "author": "fber", "tags": ["资讯"], "text": "号称对此事负责的黑客表示，“这是为了拆穿该网站宣传时作出的不实承诺。”"}
{"title": "韩国特工因Hacking Team事件自杀，死前留书否认监视民众", "url": "https://www.freebuf.com/news/72852.html", "time": "2015-07-21", "level": "", "num_look": 203643, "num_comment": 21, "author": "明明知道", "tags": ["资讯"], "text": "7月19日韩国警方证实，在山间公路的汽车内发现一名韩国国家情报局雇员的尸体，显然是自杀身亡。巧合的是，该男子“是网络技术员，目前引发问题的黑客程序就是他在2012年考虑到工作需要而购买的”。"}
{"title": "Hacking Team泄露的Flash漏洞被利用，皮皮影音播放器广告页被挂马", "url": "https://www.freebuf.com/articles/system/72812.html", "time": "2015-07-21", "level": "", "num_look": 329000, "num_comment": 22, "author": "金山毒霸", "tags": ["系统安全"], "text": "攻击者正在使用Hacking Team已泄露的Flash漏洞进行挂马攻击。"}
{"title": "在公司内部模拟邮件钓鱼攻击？这很有必要", "url": "https://www.freebuf.com/articles/neopoints/72837.html", "time": "2015-07-21", "level": "", "num_look": 925242, "num_comment": 6, "author": "dawner", "tags": ["安全管理", "观点"], "text": "频发的APT攻击事件告诉我们，员工都是企业安全最薄弱的环节。"}
{"title": "巧用网页分析“反击”钓鱼网站", "url": "https://www.freebuf.com/articles/web/72795.html", "time": "2015-07-20", "level": "金币+7", "num_look": 453457, "num_comment": 29, "author": "bawanag", "tags": ["WEB安全"], "text": "这一次我来讲个更绝的，通过分析钓鱼网站获得其传输方法，发送垃圾数据反击作者。"}
{"title": "电脑、手机都断网了，还会被黑客入侵吗？", "url": "https://www.freebuf.com/news/72768.html", "time": "2015-07-20", "level": "", "num_look": 579994, "num_comment": 16, "author": "cindy", "tags": ["其他", "资讯"], "text": "如果电脑、手机都断网了，还会被黑客入侵吗？"}
{"title": "基于代理的Web扫描器的实现", "url": "https://www.freebuf.com/articles/web/72763.html", "time": "2015-07-20", "level": "", "num_look": 416757, "num_comment": 15, "author": "妇科圣手", "tags": ["WEB安全"], "text": "在WEB业务上线前，QA测试阶段，可将QA的浏览器代理设到一个指定的代理中或测试pc拨入特定的vpn中，QA在测试功能的同时， 安全测试也会在后台同步完成，其好处不言而喻。"}
{"title": "美国国家安全局（NSA）发布Linux安全工具", "url": "https://www.freebuf.com/news/72740.html", "time": "2015-07-20", "level": "金币+7", "num_look": 359786, "num_comment": 26, "author": "鸢尾", "tags": ["工具", "资讯"], "text": "美国国家安全局（NSA）发布了一款适用于政府以及私人部门的网络安全工具，也称为系统完整性管理平台。现在你可以在Github上找到这款工具的源码。"}
{"title": "Windows 10新变化：系统自动更新将“强制化”，用户不再可选", "url": "https://www.freebuf.com/news/72737.html", "time": "2015-07-20", "level": "金币+7", "num_look": 555658, "num_comment": 46, "author": "dawner", "tags": ["资讯"], "text": "据悉Windows10将于7月29日推出，微软对软件更新策略做出了重大改变，系统自动更新将变为“强制性”。"}
{"title": "美国UCLA医院遭黑客入侵，450万份医疗记录或泄露", "url": "https://www.freebuf.com/news/72729.html", "time": "2015-07-19", "level": "", "num_look": 208050, "num_comment": 14, "author": "Sphinx", "tags": ["资讯"], "text": "美国加利福尼亚的UCLA医院称其系统遭入侵，导致450万份医疗记录存在泄露风险。"}
{"title": "Hacking Team：攻击向量之Bios Rootkit", "url": "https://www.freebuf.com/articles/system/72713.html", "time": "2015-07-19", "level": "", "num_look": 480687, "num_comment": 24, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "Bios Rootkit是比较高水平的技术，检测很困难。"}
{"title": "极客DIY：自制诡异的人体红外感应灯", "url": "https://www.freebuf.com/geek/72674.html", "time": "2015-07-19", "level": "现金奖励", "num_look": 584230, "num_comment": 25, "author": "zhangtory", "tags": ["极客"], "text": ""}
{"title": "对片上系统进行侧信道电磁分析", "url": "https://www.freebuf.com/articles/terminal/72530.html", "time": "2015-07-18", "level": "现金奖励", "num_look": 434334, "num_comment": 14, "author": "radiowar", "tags": ["终端安全"], "text": "本文比较全面的讲到侧信道攻击对系统芯片的分析，利用AM335X平台以AES算法为例说明了基于ARM核的软件实现、AES协处理器硬件实现或者是拥有快速处理优势的NEON处理器的硬件模块在进行加解密操作的电磁泄漏。"}
{"title": "占据韩国80%市场的TOTOLINK路由器被曝存在后门，影响5万路由器", "url": "https://www.freebuf.com/news/72631.html", "time": "2015-07-17", "level": "金币+7", "num_look": 396278, "num_comment": 19, "author": "鸢尾", "tags": ["漏洞", "资讯"], "text": "TOTOLINK路由器在韩国市场占有率达82.3%。由深圳众唐科技公司负责产品的研发、制造。"}
{"title": "黑客论坛Darkode被FBI拔网线，超过70人被捕", "url": "https://www.freebuf.com/news/72679.html", "time": "2015-07-17", "level": "", "num_look": 281561, "num_comment": 23, "author": "明明知道", "tags": ["资讯"], "text": "FBI已经逮捕超过70名与黑客论坛Darkode有关的犯罪分子，该论坛是黑客组织Lizard Squad（蜥蜴组织）专属交流场所。"}
{"title": "RC4加密已不再安全，破解效率极高（含视频）", "url": "https://www.freebuf.com/news/72622.html", "time": "2015-07-17", "level": "金币+7", "num_look": 859583, "num_comment": 19, "author": "dawner", "tags": ["其他", "资讯"], "text": "现在世界上近三分之一的HTTPS加密连接可被破解，并且效率极高。这种针对RC4加密的破解技术，同样也可以用来破解WiFi数据包。"}
{"title": "网信金融集团招聘安全工程师", "url": "https://www.freebuf.com/jobs/72598.html", "time": "2015-07-17", "level": "", "num_look": 229161, "num_comment": 32, "author": "北北北北", "tags": ["安全招聘"], "text": "网信金融集团由先锋金融与多家专业投资机构共同创办，旗下囊括P2P、众筹、征信、基金销售、第三方支付等全线业务。"}
{"title": "安卓很受伤：Black Hat 2015黑客大会上将公布的6个移动安全威胁", "url": "https://www.freebuf.com/news/72615.html", "time": "2015-07-17", "level": "金币+6", "num_look": 302054, "num_comment": 8, "author": "江湖小吓", "tags": ["头条", "资讯"], "text": "Black Hat 2015召开在即，现在随小编一起瞅瞅下个月将在Black Hat USA公布的一些Android安全威胁吧。"}
{"title": "Hacking Team攻击代码分析Part5：字体0day第二弹+Win32k KALSR绕过漏洞", "url": "https://www.freebuf.com/articles/system/72332.html", "time": "2015-07-17", "level": "", "num_look": 249927, "num_comment": 8, "author": "360安全", "tags": ["系统安全"], "text": "继360Vulcan上周分析了Hacking Team泄露信息中曝光的三个Flash漏洞和一个Adobe Font Driver内核漏洞后（链接见文后）。 Hacking Team泄露信息中仍在不断被发现存在新的攻击代码和0day漏洞。"}
{"title": "走近科学：恶意软件编年史", "url": "https://www.freebuf.com/news/72553.html", "time": "2015-07-17", "level": "金币+6", "num_look": 459638, "num_comment": 26, "author": "月球下雨了", "tags": ["其他", "系统安全"], "text": "30年来，恶意软件已经从“电脑恶作剧”演变为一项价值数十亿美元的“朝阳”产业。"}
{"title": "Defcon黑客大会上将公布5个特斯拉0day漏洞", "url": "https://www.freebuf.com/news/72574.html", "time": "2015-07-17", "level": "", "num_look": 197493, "num_comment": 9, "author": "直接", "tags": ["资讯"], "text": "Rogers表示，在8月6日Defcon黑客大会开幕之前他不会透露任何细节，他承诺这些内容将给世人带来“史诗般”震撼。"}
{"title": "楚门的世界：Ｈacking Team Win32监控代码分析", "url": "https://www.freebuf.com/articles/system/72596.html", "time": "2015-07-16", "level": "", "num_look": 270714, "num_comment": 17, "author": "金山毒霸", "tags": ["系统安全"], "text": "Hacking Team对于Win32平台下的监控非常完善，如果你的电脑被入侵的话，你的个人隐私完全曝光在他人监视之下。"}
{"title": "香港廉政公署和台湾警方曾有意购买Hacking Team间谍程序", "url": "https://www.freebuf.com/news/72587.html", "time": "2015-07-16", "level": "", "num_look": 221879, "num_comment": 9, "author": "cindy", "tags": ["资讯"], "text": "维基解密披露，台湾警局在2012年11月联系Hacking Team邀约产品展示，而香港廉政公署人员在去年6月份联系Hacking Team并表示对远程控制软件Galileo很感兴趣。"}
{"title": "携程安全团队招聘", "url": "https://www.freebuf.com/jobs/71779.html", "time": "2015-07-16", "level": "", "num_look": 249120, "num_comment": 18, "author": "blackrat", "tags": ["安全招聘"], "text": "我们需要的是安全行业的创造者、改变者！别人看重的是你的经验，我们看重你的潜力！"}
{"title": "Hacking Team无需越狱即可监控iOS用户", "url": "https://www.freebuf.com/articles/terminal/72544.html", "time": "2015-07-16", "level": "", "num_look": 517906, "num_comment": 32, "author": "金山毒霸", "tags": ["终端安全"], "text": "在HackingTeam泄漏的文件，我们发现了有针对IOS进行监控的代码，一旦用户点击运行，就会请求获取一些数据的访问权限并追踪用户的位置，日历和联系人。整个过程中手机不需要越狱。"}
{"title": "Hacking Team：核心代码和数据未泄露，一切尽在掌控", "url": "https://www.freebuf.com/news/72529.html", "time": "2015-07-16", "level": "红色标题", "num_look": 472748, "num_comment": 21, "author": "dawner", "tags": ["资讯"], "text": "本周一Hacking Team公司发标声明：核心代码和数据未泄露，一切尽在掌控。即便他们的监控软件源代码泄露，强大的技术优势也不会因此改变。"}
{"title": "玩转Metasploit系列（第七集）", "url": "https://www.freebuf.com/sectool/69362.html", "time": "2015-07-16", "level": "金币+6", "num_look": 882708, "num_comment": 25, "author": "ArthurKiller", "tags": ["工具", "系统安全"], "text": "这章我们具体介绍下Meterpreter。"}
{"title": "解密“智魁”攻击行动", "url": "https://www.freebuf.com/news/topnews/72533.html", "time": "2015-07-16", "level": "红色标题", "num_look": 668183, "num_comment": 22, "author": "阿里安全", "tags": ["头条", "终端安全"], "text": "一次有组织精心打造利用一系列路由器漏洞、后门、密码破解进行渗透攻击行为。阿里安全研究团队将对整个事件的攻击链条和利益关系进行详细分析，包括威胁情报分析的部分结果。"}
{"title": "14个因安全事故引咎辞职的大BOSS", "url": "https://www.freebuf.com/news/72508.html", "time": "2015-07-16", "level": "红色标题", "num_look": 550384, "num_comment": 19, "author": "小太阳花", "tags": ["头条", "安全管理"], "text": "谨以此文献给为关注安全或安全事业奋斗、尚未离职的你。"}
{"title": "格盘也没用：Hacking Team使用UEFI BIOS Rootkit将远控长驻操作系统", "url": "https://www.freebuf.com/news/72482.html", "time": "2015-07-16", "level": "金币+6", "num_look": 396808, "num_comment": 24, "author": "Sphinx", "tags": ["头条", "系统安全"], "text": "Hacking Team使用了UEFI BIOS Rootkit，从而使他们的远程控制系统(RCS)驻足目标系统。"}
{"title": "Java曝高危0day漏洞，已被俄罗斯黑客组织利用", "url": "https://www.freebuf.com/news/72484.html", "time": "2015-07-15", "level": "", "num_look": 291719, "num_comment": 12, "author": "fu4k", "tags": ["漏洞", "资讯"], "text": "今日Java曝高危0day漏洞。趋势科技发出警告称，该漏洞目前已被俄罗斯黑客组织利用，攻击目标主要是美国国防部，北大西洋公约组织的成员国。"}
{"title": "如何黑掉俄克拉荷马州立大学的学生卡（含视频）", "url": "https://www.freebuf.com/articles/terminal/72474.html", "time": "2015-07-15", "level": "", "num_look": 326289, "num_comment": 13, "author": "SAINTSEC TEAM", "tags": ["极客", "终端安全"], "text": "以后给自己免费冲个一卡通、冒充班长发个帖子骂班主任、半夜悄悄溜进女生宿舍什么的，全部将成为现实！"}
{"title": "2015年度开源项目新秀和荣誉榜公布", "url": "https://www.freebuf.com/news/72466.html", "time": "2015-07-15", "level": "", "num_look": 319738, "num_comment": 6, "author": "phper", "tags": ["工具", "资讯"], "text": "黑鸭（Black Duck）软件公布了一份名叫“年度开源项目新秀”的报告，介绍了由全球开源协会发起的10个最有趣、最活跃的新项目。"}
{"title": "HackingTeam安卓监控软件RCS病毒样本分析", "url": "https://www.freebuf.com/articles/terminal/72450.html", "time": "2015-07-15", "level": "", "num_look": 317968, "num_comment": 16, "author": "金山毒霸", "tags": ["终端安全"], "text": "下面就以一个比较典型的病毒变种为例，来看看黑客们是怎么利用RCS技术攻击我们的。"}
{"title": "对某流氓下载软件的简单分析", "url": "https://www.freebuf.com/articles/others-articles/72444.html", "time": "2015-07-15", "level": "现金奖励", "num_look": 450698, "num_comment": 49, "author": "熊猫正正", "tags": ["其他", "观点"], "text": "前两天在网上定购了一款FAST迅捷FW150US的无线网卡，本来是想安装在公司电脑上使用的，无奈公司电脑没有光驱，我的Mac又用不了，只能到网上下载光驱了，于是就有了下面的经历。"}
{"title": "揭秘：Hacking Team远控窃听程序（RCS）的全球热销之路", "url": "https://www.freebuf.com/news/72423.html", "time": "2015-07-15", "level": "金币+5", "num_look": 412468, "num_comment": 14, "author": "dawner", "tags": ["头条", "资讯"], "text": "这两天Hacking Team 400G泄露数据已经在市面上疯传，该公司曾通过分销体系在全世界推广出售了远程控制程序（RCS）。"}
{"title": "玩转Metasploit系列（第六集）", "url": "https://www.freebuf.com/sectool/69358.html", "time": "2015-07-15", "level": "", "num_look": 622533, "num_comment": 13, "author": "ArthurKiller", "tags": ["工具", "系统安全"], "text": "Msfpayload和Msfvenom两个都是payload的生成器，但是msfpayload将会被Metasploit团队放弃研发和更新，转而对msfvenom进行研发。"}
{"title": "Black Hat 2015上将发布的安全工具", "url": "https://www.freebuf.com/sectool/72360.html", "time": "2015-07-15", "level": "", "num_look": 302572, "num_comment": 18, "author": "fu4k", "tags": ["工具"], "text": "每年BlackHat黑客大会都会发布很多精彩的安全工具，2015年注定也不例外。"}
{"title": "三枚Flash 0day漏洞曝光，Flash再次紧急更新", "url": "https://www.freebuf.com/news/72387.html", "time": "2015-07-14", "level": "红色标题", "num_look": 676836, "num_comment": 45, "author": "空白", "tags": ["漏洞", "资讯"], "text": "不管Flash最终何时走向要去的何方，小编还是建议大家速速更新，毕竟安全第一。"}
{"title": "如何让无人机在禁飞区飞起来？", "url": "https://www.freebuf.com/geek/72336.html", "time": "2015-07-14", "level": "", "num_look": 4713067, "num_comment": 32, "author": "360UnicornTeam", "tags": ["极客"], "text": "大学生在禁飞区的清华校园用无人机给女生送戒指，他是如何做到的？"}
{"title": "四种捕获DDoS攻击的监测工具（含报告）", "url": "https://www.freebuf.com/sectool/72363.html", "time": "2015-07-14", "level": "", "num_look": 652895, "num_comment": 9, "author": "哆啦A梦", "tags": ["安全管理", "工具"], "text": "现在有很多防御或缓解DDoS攻击的服务，但是如何第一时间发现网站被D仍然是个难题。这里我们罗列四个帮助识别DDoS攻击的监测工具和方法。"}
{"title": "密码破解神器John the Ripper GUI - Johnny", "url": "https://www.freebuf.com/sectool/72354.html", "time": "2015-07-14", "level": "", "num_look": 555597, "num_comment": 18, "author": "phper", "tags": ["工具"], "text": "Johnny是基于流行密码破解工具John the Ripper开发的跨平台开源GUI。"}
{"title": "比特币云采矿平台Cloudminr.io遭入侵，用户数据被黑客低价“大甩卖”", "url": "https://www.freebuf.com/news/72338.html", "time": "2015-07-14", "level": "", "num_look": 174617, "num_comment": 8, "author": "cindy", "tags": ["资讯"], "text": "黑客入侵了比特币云挖掘平台Cloudminr.io，涂鸦了网站首页并在网络上以1比特币的低价“甩卖”近8万用户数据。"}
{"title": "黑狐木马最新变种“肥兔”详细分析", "url": "https://www.freebuf.com/articles/system/72319.html", "time": "2015-07-14", "level": "红色标题", "num_look": 512136, "num_comment": 29, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "腾讯反病毒实验室拦截到了大量试图通过替换windows系统文件来感染系统的木马，经过回溯分析，发现其主要是通过伪装成“37游戏在线”等安装包进行推广传播，感染量巨大。"}
{"title": "针对三名英国政客的WiFi攻击测试", "url": "https://www.freebuf.com/news/72189.html", "time": "2015-07-14", "level": "", "num_look": 221005, "num_comment": 16, "author": "JackFree", "tags": ["资讯"], "text": "当三位知名英国政客使用未加密的开放WiFi网络时，安全专家立刻黑掉了他们。"}
{"title": "搜狗招聘安全开发工程师", "url": "https://www.freebuf.com/jobs/71700.html", "time": "2015-07-14", "level": "", "num_look": 194847, "num_comment": 3, "author": "DearLi", "tags": ["安全招聘"], "text": "搜狗公司是中国互联网领先的搜索，客户端和移动产品及服务提供商。"}
{"title": "微信也被监控：HackingTeam语音监控代码分析", "url": "https://www.freebuf.com/articles/system/72315.html", "time": "2015-07-13", "level": "", "num_look": 439044, "num_comment": 21, "author": "金山毒霸", "tags": ["系统安全"], "text": "在HackingTeam泄漏的文件，我们发现了有针对主流聊天软件中的语音进行监控的代码，其中包括国内常用的微信。"}
{"title": "技术分析：Hacking Team Flash 0day梅开二度", "url": "https://www.freebuf.com/vuls/72259.html", "time": "2015-07-13", "level": "", "num_look": 287636, "num_comment": 21, "author": "阿里安全", "tags": ["漏洞"], "text": "茫茫JIT CODE中，如何找到我们想要跟踪的代码呢? 借HackingTeam Flash 0day事件详细介绍下调试流程以及jitcode，帮助一些朋友们后续更好的学习。"}
{"title": "迪普网络招聘安全服务工程师、渗透测试工程师", "url": "https://www.freebuf.com/jobs/72294.html", "time": "2015-07-13", "level": "", "num_look": 256032, "num_comment": 28, "author": "迪普科技", "tags": ["安全招聘"], "text": "迪普科技目前是国内创新能力最强的前沿网络厂商。"}
{"title": "Hacking Team数据中惊现第二枚Flash 0day漏洞", "url": "https://www.freebuf.com/news/72268.html", "time": "2015-07-13", "level": "", "num_look": 419517, "num_comment": 31, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "Hacking Team公司上周被黑客攻击，泄露近400GB的数据，里面除了有Flash 0day漏洞CVE-2015-5119外，还有一个高危Flash 0day。"}
{"title": "Meatsploit Framework msfvenom使用简介", "url": "https://www.freebuf.com/sectool/72135.html", "time": "2015-07-13", "level": "金币+15", "num_look": 1289849, "num_comment": 19, "author": "戒贤", "tags": ["工具"], "text": "2015年6月8日，Wei Chen在rapid7官方博客上发文，将于近期移除metasploit-framework版本中的msfencoder和msfpayload，并使用msfvenom取代。"}
{"title": "CANard工具套件：CAN总线安全工具", "url": "https://www.freebuf.com/sectool/72227.html", "time": "2015-07-13", "level": "金币+15", "num_look": 352027, "num_comment": 6, "author": "Rabbit_Run", "tags": ["工具", "终端安全"], "text": "前特斯拉员工Eric Evenchick在年Black Hat Asia 2015大会发布了一款CAN总线协议的安全工具CANard，通过硬件抽象实现对多种CAN适配器的支持，向上提供统一的调用接口。"}
{"title": "2015阿里安全峰会“天下无贼”纪实（下）：谁与争锋", "url": "https://www.freebuf.com/news/topnews/72234.html", "time": "2015-07-13", "level": "", "num_look": 329118, "num_comment": 12, "author": "FB独家", "tags": ["头条", "活动"], "text": "第二天的阵势与嘉宾阵容则同样庞大，设置了“云与端安全”、“电商金融业务安全”以及“白帽子与安全技术”三个分论坛。"}
{"title": "德国爱国者导弹控制系统被黑，攻击者成功执行“未知指令”", "url": "https://www.freebuf.com/news/72197.html", "time": "2015-07-13", "level": "", "num_look": 264748, "num_comment": 21, "author": "JackFree", "tags": ["资讯"], "text": "黑客可能已经窃取了机密信息，并访问了导弹控制模块，这将有可能导致导弹向不明目标发射。"}
{"title": "大数据安全分析（分析篇）", "url": "https://www.freebuf.com/articles/database/72206.html", "time": "2015-07-12", "level": "金币+15", "num_look": 718150, "num_comment": 5, "author": "ZenMind", "tags": ["数据安全", "观点"], "text": "数据是看到的基础条件，但是和真正的看见还有巨大的差距。我们需要看到什么？什么样的方法使我们真正看到？"}
{"title": "一夜回到解放前：英国政府将封杀WhatsApp、iMessage和Snapchat", "url": "https://www.freebuf.com/news/72178.html", "time": "2015-07-12", "level": "金币+15", "num_look": 337663, "num_comment": 34, "author": "Sphinx", "tags": ["资讯"], "text": "对于英国人来说这是个不幸的消息——再过几周就得重新用回传统短信了。"}
{"title": "小酒馆问答包厢：基于问答的经验分享P2P", "url": "https://www.freebuf.com/news/72157.html", "time": "2015-07-11", "level": "", "num_look": 230775, "num_comment": 9, "author": "thanks", "tags": ["资讯"], "text": "黑客与极客领域，将每个人知识、经验和见解组成P2P网络。"}
{"title": "简要分析Hacking Team远程控制系统", "url": "https://www.freebuf.com/articles/system/72138.html", "time": "2015-07-10", "level": "", "num_look": 455969, "num_comment": 17, "author": "绿盟科技", "tags": ["系统安全"], "text": "这是一份快速报告，以便简要分析其中的核心内容——Hacking Team RCS（远程控制系统）。"}
{"title": "OpenSSL最新高危漏洞（CVE-2015-1793）补丁发布", "url": "https://www.freebuf.com/news/72139.html", "time": "2015-07-10", "level": "", "num_look": 358694, "num_comment": 14, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "研究人员Adam Langley/David Benjamin (Google/BoringSSL)近日发现了一枚新的OpenSSL严重安全漏洞，该漏洞的漏洞编号为CVE-2015-1793。攻击者可以绕过证书警告，强制应用程序将无效证书当作合法证书使用。"}
{"title": "安卓adb备份存在漏洞，可注入恶意APK", "url": "https://www.freebuf.com/news/72099.html", "time": "2015-07-10", "level": "金币+15", "num_look": 380680, "num_comment": 9, "author": "living", "tags": ["漏洞", "资讯"], "text": "android在系统备份后还原的处理上存在严重漏洞，使得攻击者可以注入恶意的apk文件到备份文件中(这样还原的时候恶意的应用也安装上去了)。"}
{"title": "2015企业无线网络安全报告", "url": "https://www.freebuf.com/articles/wireless/72084.html", "time": "2015-07-10", "level": "", "num_look": 2391179, "num_comment": 24, "author": "360天巡实验室", "tags": ["无线安全"], "text": "WiFi网络正在越来越多的成为黑客入侵企业内网系统的突破口，由此给企业网络带来新的安全威胁。"}
{"title": "Hacking Team监视代码分析", "url": "https://www.freebuf.com/articles/system/72089.html", "time": "2015-07-10", "level": "", "num_look": 295465, "num_comment": 10, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "Hacking Team这次泄露的信息包括很多监视代码。"}
{"title": "2015阿里安全峰会“天下无贼”纪实（上）：华山论剑", "url": "https://www.freebuf.com/news/72093.html", "time": "2015-07-10", "level": "红色标题", "num_look": 448928, "num_comment": 13, "author": "FB独家", "tags": ["头条", "活动"], "text": "“今天特别适合‘砸场子’，作为传统安全厂商代表，我来讲一讲。”"}
{"title": "收到“大学录取通知书”之后…", "url": "https://www.freebuf.com/articles/others-articles/73742.html", "time": "2015-07-09", "level": "", "num_look": 273612, "num_comment": 13, "author": "阿金", "tags": ["其他"], "text": ""}
{"title": "攻击微软、苹果的金融间谍组织Morpho浮出水面", "url": "https://www.freebuf.com/news/72079.html", "time": "2015-07-09", "level": "", "num_look": 182037, "num_comment": 10, "author": "cindy", "tags": ["资讯"], "text": "卡巴斯基发现并分析了一个名为Morpho（也叫做Wild Neutron）的金融APT攻击组织，已经成功攻击了苹果、Facebook、宏基、微软在内的多家知名大公司。"}
{"title": "大数据安全分析（理念篇）", "url": "https://www.freebuf.com/articles/database/71978.html", "time": "2015-07-09", "level": "", "num_look": 547646, "num_comment": 14, "author": "ZenMind", "tags": ["企业安全", "数据安全"], "text": "单纯的防御措施无法阻止蓄意的攻击者，这已经是大家都认同的事实，应对挑战业界有了诸多方面的探索和实践，而其中最有趣的就非安全分析莫属了。"}
{"title": "偷走一辆带有车联网功能的比亚迪汽车有多难？", "url": "https://www.freebuf.com/articles/terminal/72055.html", "time": "2015-07-09", "level": "", "num_look": 340807, "num_comment": 12, "author": "刘健皓", "tags": ["终端安全"], "text": "回顾一下比亚迪汽车企业在车联网之前爆露出来的一个云平台的漏洞，由于云服务存在严重安全漏洞，黑客可以编写程序获取任意车主的信息。"}
{"title": "17岁Lizard Squad成员面临高达50700起网络犯罪指控", "url": "https://www.freebuf.com/news/71994.html", "time": "2015-07-09", "level": "金币+4", "num_look": 166409, "num_comment": 6, "author": "arain", "tags": ["资讯"], "text": "臭名昭著的黑客组织Lizard Squad成员Julius日前被指控与50700起网络犯罪行为有关，其中包括去年引发轩然大波的索尼PlayStation网络和微软Xbox Live瘫痪事件。"}
{"title": "“黑帽SEO”添新招：使用PDF文档提高搜索排名", "url": "https://www.freebuf.com/news/72030.html", "time": "2015-07-09", "level": "", "num_look": 239957, "num_comment": 9, "author": "JackFree", "tags": ["资讯"], "text": "研究人员发现，黑客正在使用一种新的“黑帽SEO”方法绕过谷歌网页排名算法，这种新技术依赖于PDF文档。这种方法会误导谷歌索引器，使其认为某个网站与特定领域相关。"}
{"title": "Hacking Team攻击代码分析Part 3 : Adobe Font Driver内核驱动权限提升漏洞", "url": "https://www.freebuf.com/articles/system/71953.html", "time": "2015-07-09", "level": "", "num_look": 205831, "num_comment": 7, "author": "360安全", "tags": ["系统安全"], "text": "Hacking Team还利用了一个Windows中的内核驱动： Adobe Font Driver(atmfd.dll)中存在的一处字体0day漏洞，实现权限提升并绕过沙盒机制。"}
{"title": "【已结束】2015阿里安全峰会图文直播", "url": "https://www.freebuf.com/fevents/71976.html", "time": "2015-07-09", "level": "红色标题", "num_look": 377139, "num_comment": 11, "author": "FB独家", "tags": ["活动"], "text": "FreeBuf作为2015“天下无贼”阿里安全峰会特邀媒体，将全程图文直播本次活动，欢迎关注。"}
{"title": "这个设备可以让你“隐身”连WiFi", "url": "https://www.freebuf.com/news/71979.html", "time": "2015-07-09", "level": "金币+4", "num_look": 658085, "num_comment": 29, "author": "JackFree", "tags": ["工具", "无线安全"], "text": "你只需要将antenna天线连接到计算机的以太网端口，然后它就可以通过低频无线电波连接到远处的WiFi源。"}
{"title": "Avazu招聘移动安全人才", "url": "https://www.freebuf.com/jobs/71947.html", "time": "2015-07-08", "level": "", "num_look": 150727, "num_comment": 5, "author": "Ryan@Avazu", "tags": ["安全招聘"], "text": "Avazu Inc（艾维邑动）是一家集PC和移动互联网广告全球投放，全球专业移动游戏运营及发行的技术型公司，薪资：30-50W。"}
{"title": "Adobe发布官方补丁：修复Hacking Team泄露的Flash 0day漏洞", "url": "https://www.freebuf.com/news/71996.html", "time": "2015-07-08", "level": "", "num_look": 235221, "num_comment": 6, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "Adobe公司今日发布Flash Player更新补丁，用于修复Hacking Team窃取的400G数据中被发现的0day漏洞。攻击者可利用该漏洞使目标机器系统崩溃并获得控制权限。"}
{"title": "北约官网遭ISIS涂鸦", "url": "https://www.freebuf.com/news/71962.html", "time": "2015-07-08", "level": "", "num_look": 271890, "num_comment": 14, "author": "cindy", "tags": ["资讯"], "text": "欧洲时间今天早上，ISIS攻破北约网站eu-nato.gov.ge。官网页面被涂鸦，留下了ISIS的logo和一段文字。"}
{"title": "新型Tinba病毒技术分析", "url": "https://www.freebuf.com/articles/system/71922.html", "time": "2015-07-08", "level": "", "num_look": 236287, "num_comment": 2, "author": "常运", "tags": ["系统安全"], "text": "荷兰安全公司Fox-IT已经将这个有效载荷鉴定为一种新型的Tinba木马病毒，这是一款众所周知的网银恶意软件。"}
{"title": "Hacking Team攻击代码分析Part 2：一个Pwn2Own漏洞的奇幻漂流", "url": "https://www.freebuf.com/articles/system/71838.html", "time": "2015-07-08", "level": "", "num_look": 230246, "num_comment": 10, "author": "360安全", "tags": ["系统安全"], "text": "这个漏洞有个不平凡的故事，今年的Pwn2Own大赛中，前Vupen主力Nicolas Joly正是用这个漏洞拿下了64位Flash插件。"}
{"title": "又一个“心脏滴血”？OpenSSL明日将发布安全补丁，修复未披露的0day高危漏洞", "url": "https://www.freebuf.com/news/71927.html", "time": "2015-07-08", "level": "金币+4", "num_look": 422444, "num_comment": 7, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "不少安全专家推测，这个高危漏洞将可能是另一个“心脏滴血”。"}
{"title": "召回还是远程更新：汽车软件升级到底该咋办？", "url": "https://www.freebuf.com/news/71915.html", "time": "2015-07-08", "level": "", "num_look": 180308, "num_comment": 8, "author": "空白", "tags": ["观点", "资讯"], "text": "作为汽车厂商，你是愿意让汽车召回，还是更愿意在车里坐等系统更新？"}
{"title": "AirLive IP监控相机存在命令注入漏洞，大量产品受影响", "url": "https://www.freebuf.com/news/71870.html", "time": "2015-07-08", "level": "金币+4", "num_look": 222399, "num_comment": 4, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "大量AirLive IP监控摄像机被曝存在命令注入漏洞，攻击者可利用该漏洞窃取用户登录凭证并控制设备。"}
{"title": "WattUP无线充电技术：5米范围内为所有电子设备充电", "url": "https://www.freebuf.com/news/71902.html", "time": "2015-07-08", "level": "", "num_look": 310027, "num_comment": 10, "author": "JackFree", "tags": ["资讯"], "text": "科技公司Energous即将推出一款无线充电器WattUp，可以为5米内所有设备同时进行无线充电。"}
{"title": "【内含福利大礼包】Hacking Team被黑后续：攻击者浮出水面", "url": "https://www.freebuf.com/news/71847.html", "time": "2015-07-07", "level": "红色标题", "num_look": 1005662, "num_comment": 52, "author": "小太阳花", "tags": ["头条", "资讯"], "text": "攻击者通过入侵Hacking Team的两个系统管理员的计算机得以访问公司的内部网络。"}
{"title": "银行木马KINS Builder源码已在网上流传", "url": "https://www.freebuf.com/news/71832.html", "time": "2015-07-07", "level": "", "num_look": 237919, "num_comment": 14, "author": "cindy", "tags": ["资讯"], "text": "MalwareMustDie研究人员发现，网银木马KINS Builder的源代码已经在网络上泄露，很可能会由此迅速扩散。"}
{"title": "Hacking Team攻击代码分析Part 1：Flash 0day", "url": "https://www.freebuf.com/articles/system/71833.html", "time": "2015-07-07", "level": "", "num_look": 495367, "num_comment": 13, "author": "360安全", "tags": ["系统安全", "网络安全"], "text": "360Vulcan Team对这些漏洞进行分析，并分为三个部分将这些0day的信息共享给安全社区，希望软件厂商和安全厂商共同行动，尽快修补和防御着这些“在野”的0day漏洞。"}
{"title": "如何将SQLServer 2000链接服务器的密码破解为明文", "url": "https://www.freebuf.com/articles/database/71750.html", "time": "2015-07-07", "level": "金币+12", "num_look": 359007, "num_comment": 9, "author": "h4ckj1n", "tags": ["数据安全"], "text": "MSSQL有一个LINKSERVER的功能——链接服务器，每字符加密为4位，不用管加密算法，可以撞出来。"}
{"title": "论剑长安：TSRC安全群英汇西安行", "url": "https://www.freebuf.com/news/71804.html", "time": "2015-07-07", "level": "", "num_look": 263175, "num_comment": 18, "author": "腾讯安全平台部", "tags": ["活动", "资讯"], "text": "古有唐僧西行取真经，今有TSRC西行会群英。"}
{"title": "小议安全威胁情报", "url": "https://www.freebuf.com/articles/neopoints/71674.html", "time": "2015-07-07", "level": "金币+12", "num_look": 585412, "num_comment": 6, "author": "ZenMind", "tags": ["观点"], "text": "希望由此能让更多的人去关注威胁情报如何更好的服务用户，而不仅仅是如何建立一套威胁情报的系统。"}
{"title": "聊聊人脸识别支付", "url": "https://www.freebuf.com/news/71782.html", "time": "2015-07-07", "level": "", "num_look": 257615, "num_comment": 20, "author": "cindy", "tags": ["观点", "资讯"], "text": "当用户选择好商品进入支付系统时，它会要求你拍一张自拍照进行验证。"}
{"title": "思科统一CDM平台曝特权账户和静态密码", "url": "https://www.freebuf.com/news/71786.html", "time": "2015-07-07", "level": "金币+12", "num_look": 198746, "num_comment": 4, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "思科旗下的统一CDM（通信域名管理器）被曝包含一个默认无法修改的特权账户并使用静态密码，攻击者可利用对平台进行远程攻击和入侵。"}
{"title": "针对流行手机应用LINE的恶意木马，可窃取用户聊天记录", "url": "https://www.freebuf.com/news/71656.html", "time": "2015-07-06", "level": "金币+12", "num_look": 196300, "num_comment": 6, "author": "江湖小吓", "tags": ["资讯"], "text": "研究人员近日发现了一个针对流行聊天软件LINE的恶意木马，能够从LINE上获取短信，视频，图片，通话记录以及聊天内容。"}
{"title": "特别报道：专业黑客公司Hacking Team被黑，泄露大量内部资料及攻击工具", "url": "https://www.freebuf.com/news/71712.html", "time": "2015-07-06", "level": "红色标题", "num_look": 1235670, "num_comment": 74, "author": "明明知道", "tags": ["头条", "资讯"], "text": "作为一家专业从事监视技术的黑客团队及公司，Hacking Team（以下简称HT）今天亲身体验了内部数据被公之于众的感受。"}
{"title": "如何给中国菜刀添加隐蔽后门", "url": "https://www.freebuf.com/sectool/71668.html", "time": "2015-07-06", "level": "现金奖励", "num_look": 717156, "num_comment": 43, "author": "MatrixH", "tags": ["工具"], "text": "中国菜刀，不用多说，是大多黑阔经常使用的工具，具体使用方法，网上有很多教程，这里我讲下如何给菜刀添加隐蔽后门。"}
{"title": "追踪那些隐藏在暗网深处的匿名者", "url": "https://www.freebuf.com/news/topnews/71669.html", "time": "2015-07-06", "level": "金币+12", "num_look": 823132, "num_comment": 12, "author": "九如", "tags": ["头条", "网络安全"], "text": "纵观暗网的发展史，总有人尝试各种方法挖出匿名用户的真实身份。"}
{"title": "Sqlmap进阶用法：定制payload加速boolean-based注入", "url": "https://www.freebuf.com/articles/71652.html", "time": "2015-07-06", "level": "现金奖励", "num_look": 588264, "num_comment": 13, "author": "piece of the past", "tags": ["文章"], "text": "大家在玩SQL注入的时候大概都遇到过这种特别鸡肋的情况。"}
{"title": "两款免费的Android应用代码安全检测工具", "url": "https://www.freebuf.com/sectool/71587.html", "time": "2015-07-05", "level": "", "num_look": 552207, "num_comment": 6, "author": "空白", "tags": ["工具", "终端安全"], "text": "这篇文章将介绍两个免费的静态分析工具，可以从集成开发环境（IDE）直接扫描你的代码。"}
{"title": "肖恩·帕克：从黑客到亿万富翁", "url": "https://www.freebuf.com/news/topnews/71636.html", "time": "2015-07-05", "level": "金币+12", "num_look": 777965, "num_comment": 40, "author": "hujias", "tags": ["其他", "头条"], "text": "不管和谁见面，他至少迟到2小时——在硅谷，人们把这叫做“肖恩·帕克时间”。"}
{"title": "北美IPv4地址即将用尽", "url": "https://www.freebuf.com/news/71622.html", "time": "2015-07-04", "level": "", "num_look": 241969, "num_comment": 22, "author": "明明知道", "tags": ["资讯"], "text": "互联网正面临用尽IPv4地址的情况。这就意味在将来，想要获得一个IPv4地址将变得愈发困难。"}
{"title": "最新黑客美剧《黑客军团》IMDb评分高达9.4", "url": "https://www.freebuf.com/news/71616.html", "time": "2015-07-03", "level": "金币+6", "num_look": 866288, "num_comment": 25, "author": "妇科圣手", "tags": ["其他", "视频"], "text": "如果最近剧荒，追这部准没错！"}
{"title": "窃密型WebShell检测方法", "url": "https://www.freebuf.com/articles/others-articles/71604.html", "time": "2015-07-03", "level": "", "num_look": 496574, "num_comment": 15, "author": "迷路的指南针", "tags": ["其他", "网络安全"], "text": "​前段时间由于项目的需要也因为正在负责一个后门检测小工具的项目开发所以恶补了一下Webshell检测技术内容，一路天马行空写下此文和大家分享。"}
{"title": "用面包和无线接收器黑一台电脑", "url": "https://www.freebuf.com/news/70872.html", "time": "2015-07-03", "level": "金币+6", "num_look": 541156, "num_comment": 19, "author": "鸢尾", "tags": ["极客", "网络安全"], "text": "最重要的是其成本很低，你只需要一块皮塔面包和一个接收器。"}
{"title": "爱奇艺招聘移动端和Windows桌面端安全工程师", "url": "https://www.freebuf.com/jobs/71575.html", "time": "2015-07-03", "level": "", "num_look": 185427, "num_comment": 10, "author": "cloudbase", "tags": ["安全招聘"], "text": "爱奇艺(iQIYI.COM)网络视频播放平台是国内首家专注于提供免费、高清网络视频服务的大型视频网站。"}
{"title": "Swf Decrypt详解", "url": "https://www.freebuf.com/articles/system/71573.html", "time": "2015-07-03", "level": "", "num_look": 385875, "num_comment": 21, "author": "阿里安全", "tags": ["系统安全"], "text": "攻击在持续，攻击的技术在演进。防御者需要持续的跟进研究和投入。最近Flash 0day频繁出现，将我们更多的目光集中到flash上。"}
{"title": "车真的那么容易偷吗？汽车无线钥匙通信安全的一点科普", "url": "https://www.freebuf.com/geek/71556.html", "time": "2015-07-03", "level": "现金奖励", "num_look": 1381255, "num_comment": 35, "author": "360UnicornTeam", "tags": ["极客", "网络安全"], "text": "不久前在HackPWN的启动仪式上，安全人员仅用2分钟就通过无线钥匙破解了一辆奔驰汽车，看起来黑客要偷走一辆汽车很容易。真的这么简单吗？"}
{"title": "Dino：法国黑客组织“动物农场”APT工具箱又添新武器", "url": "https://www.freebuf.com/news/71532.html", "time": "2015-07-03", "level": "", "num_look": 193109, "num_comment": 5, "author": "cindy", "tags": ["资讯"], "text": "​来自ESET公司的安全专家分析了恶意软件Dino后确信，这个复杂的间谍软件的主人是法国黑客组织“动物农场（Animal Farm）”。"}
{"title": "美国国安局（NSA）仍将继续监控美国公民的手机元数据", "url": "https://www.freebuf.com/news/71554.html", "time": "2015-07-02", "level": "金币+6", "num_look": 170020, "num_comment": 2, "author": "arain", "tags": ["资讯"], "text": "美国外国情报监视法庭（FISC）裁定NSA在接下来的6个月交接期内还可以继续收集和存储美国公民通话记录。"}
{"title": "他们都干了什么？FBI悬赏420万美元捉拿这五个黑客", "url": "https://www.freebuf.com/news/71520.html", "time": "2015-07-02", "level": "金币+6", "num_look": 265559, "num_comment": 12, "author": "月球下雨了", "tags": ["其他", "资讯"], "text": "美国国务院与美国联邦调查局FBI共同悬赏总计420万美元，寻找关于这五位网络犯罪的线索。"}
{"title": "交互式SSH蜜罐 - Cowrie", "url": "https://www.freebuf.com/sectool/71528.html", "time": "2015-07-02", "level": "", "num_look": 441023, "num_comment": 6, "author": "phper", "tags": ["工具"], "text": "Cowrie是一个中型的交互式SSH蜜罐，可以对暴力攻击、入侵等黑客行为进行记录。"}
{"title": "巴西最大银行木马制造者：年仅20岁的大学生Lordfenix", "url": "https://www.freebuf.com/news/71508.html", "time": "2015-07-02", "level": "金币+6", "num_look": 237028, "num_comment": 13, "author": "hujias", "tags": ["其他", "资讯"], "text": "一名年仅20岁的大学生，开发的每一个网银木马在黑市的售卖价均超过300美刀，2年时间谋取了大量不义之财。听起来不可思议？"}
{"title": "揭秘：比特币赌博网站Primedice如何被黑客坑走100万美元的", "url": "https://www.freebuf.com/news/71445.html", "time": "2015-07-02", "level": "金币+6", "num_look": 739306, "num_comment": 15, "author": "明明知道", "tags": ["其他", "头条"], "text": "​黑客利用比特币赌博网站Primedice网上赌场的RNG系统漏洞，导致赌场损失价值100万美金的比特币。这是多么痛的领悟？"}
{"title": "苹果iOS 8.4和OS X 10.10.4修复漏洞一览", "url": "https://www.freebuf.com/news/71489.html", "time": "2015-07-02", "level": "", "num_look": 213196, "num_comment": 3, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "昨天苹果发布了最新iOS 8.4和Mac OS X 10.10.4，新版本系统中包含了大量安全补丁，修复了远程代码执行漏洞、中国地区证书信任等多项安全问题。"}
{"title": "【优秀书评家出炉】好书推荐：《Android安全攻防权威指南》《Web应用安全权威指南》", "url": "https://www.freebuf.com/news/others/70407.html", "time": "2015-07-01", "level": "红色标题", "num_look": 975288, "num_comment": 109, "author": "FB客服", "tags": ["其他", "周边"], "text": "在本文评论中，晒出你最近在读的安全类图书及书评。FreeBuf将从中抽取10位“优质书评家”，免费赠送新鲜出炉的《Android安全攻防权威指南》或《Web应用安全权威指南》。"}
{"title": "KCon黑客大会2015：黑无止境", "url": "https://www.freebuf.com/fevents/71400.html", "time": "2015-07-01", "level": "", "num_look": 561590, "num_comment": 36, "author": "明明知道", "tags": ["活动"], "text": "本届 KCon，将曝光许多黑掉手法，无论是漏洞、攻击、还是反攻，要做到心中有数，才能够坦然面对未来那些未知的东西，才能做好真正的安全。"}
{"title": "一年之后，雅虎终于修复了SSRF漏洞", "url": "https://www.freebuf.com/news/71399.html", "time": "2015-07-01", "level": "", "num_look": 202044, "num_comment": 1, "author": "cindy", "tags": ["资讯"], "text": "​时隔一年之后，雅虎终于修复了图片处理系统上的SSRF（服务端请求伪造）漏洞。"}
{"title": "权限杀手新变种分析报告", "url": "https://www.freebuf.com/articles/terminal/71278.html", "time": "2015-07-01", "level": "", "num_look": 240917, "num_comment": 6, "author": "360手机卫士", "tags": ["终端安全"], "text": "2013年，ROM级内嵌手机病毒“权限杀手”曝光，该病毒通过删除其他应用获取系统ROOT所使用的关键文件，达到自己不被其他应用获取系统ROOT删除的目的，进而实施一系列作恶行为。"}
{"title": "麻省理工学院（MIT）发明漏洞自动修复系统", "url": "https://www.freebuf.com/news/71355.html", "time": "2015-07-01", "level": "", "num_look": 273055, "num_comment": 24, "author": "小太阳花", "tags": ["其他", "资讯"], "text": "MIT研究人员展示了一个新的系统，能够通过导入其他更为安全的应用程序功能，自动修复危险的软件漏洞。"}
{"title": "美国：俄罗斯和中国的网络间谍瞄准英美", "url": "https://www.freebuf.com/news/71384.html", "time": "2015-07-01", "level": "", "num_look": 172071, "num_comment": 15, "author": "JackFree", "tags": ["资讯"], "text": "美国安全研究人员Ali Qamar认为，中国和俄罗斯是网络间谍领域的主要活动者，但并不是唯一国家。"}
{"title": "思科将以6.35亿美元收购网络安全公司OpenDNS", "url": "https://www.freebuf.com/news/71379.html", "time": "2015-07-01", "level": "", "num_look": 151077, "num_comment": 4, "author": "fu4k", "tags": ["资讯"], "text": "网络巨头思科（Cisco）今天宣布同意以6.35亿美元收购网络安全公司、免费域名服务提供商OpenDNS，后者将并入思科的安全业务部门。"}
{"title": "维基解密最新披露：NSA监视法国核电站、飞机、高铁公司", "url": "https://www.freebuf.com/news/71339.html", "time": "2015-07-01", "level": "金币+4", "num_look": 196396, "num_comment": 3, "author": "JohnChu", "tags": ["资讯"], "text": "最新文件显示NSA监视法国的大型公司（核电站、飞机、高铁公司等）尝试获取经济情报。"}
{"title": "Facebook安全扫描工具集成卡巴斯基反病毒引擎", "url": "https://www.freebuf.com/news/71322.html", "time": "2015-07-01", "level": "", "num_look": 186131, "num_comment": 7, "author": "vulture", "tags": ["资讯"], "text": "Facebook在它的防病毒服务中又加入了新武器——全球领先的反病毒软件卡巴斯基。"}
{"title": "国产安全扫描器北极熊V2.9新版发布", "url": "https://www.freebuf.com/sectool/71153.html", "time": "2015-06-30", "level": "", "num_look": 588595, "num_comment": 54, "author": "hyc66", "tags": ["工具"], "text": "本软件是一款为白帽子提供网站安全检测的软件，软件完全免费。"}
{"title": "卡巴斯基：Duqu 2.0 技术分析", "url": "https://www.freebuf.com/news/71327.html", "time": "2015-06-30", "level": "", "num_look": 240651, "num_comment": 3, "author": "安天实验室", "tags": ["系统安全", "资讯"], "text": "本文为安天技术公益翻译组对卡巴斯基实验室发布的《Duqu 2.0技术分析报告》原文翻译。"}
{"title": "黑客使用MERS新闻攻击日本传媒公司", "url": "https://www.freebuf.com/news/71321.html", "time": "2015-06-30", "level": "金币+4", "num_look": 203031, "num_comment": 6, "author": "vulture", "tags": ["资讯"], "text": "攻击者使用中东呼吸综合症（MERS）病毒的爆发作为诱饵，发送钓鱼邮件给日本大众传媒公司，意在获取机密数据。"}
{"title": "漏洞奖励平台HackerOne获得2500万B轮融资", "url": "https://www.freebuf.com/news/71323.html", "time": "2015-06-30", "level": "金币+4", "num_look": 149598, "num_comment": 3, "author": "rvlfly", "tags": ["资讯"], "text": "来自美国的漏洞奖励平台HackerOne一年前获得了900万A轮融资。最近，HackerOne又获得了2500万美元的B轮融资。"}
{"title": "美图秀秀、gReader、福昕PDF阅读器在列：14款Android应用易遭中间人攻击", "url": "https://www.freebuf.com/news/71300.html", "time": "2015-06-30", "level": "金币+4", "num_look": 318129, "num_comment": 6, "author": "Sphinx", "tags": ["漏洞", "资讯"], "text": "AppBugs公司研究人员经过分析发现，市面上有14款总计下载量高达8千万次的流行应用APP在处理社交账号登陆时存在安全风险，极易遭到中间人劫持（MITM）攻击。"}
{"title": "动态Shellcode注入工具 - Shellter", "url": "https://www.freebuf.com/sectool/71230.html", "time": "2015-06-30", "level": "金币+4", "num_look": 398068, "num_comment": 15, "author": "鸢尾", "tags": ["工具"], "text": "由于目前用于辅助渗透测试人员躲避安全软件的工具比较少，所以这里就请大家容我多少几句。"}
{"title": "360招聘安全研究员", "url": "https://www.freebuf.com/jobs/70962.html", "time": "2015-06-30", "level": "", "num_look": 192882, "num_comment": 16, "author": "max110", "tags": ["安全招聘"], "text": "360是中国领先的互联网和手机安全产品及服务供应商。"}
{"title": "大量美国政府网站帐号密码被公布于互联网", "url": "https://www.freebuf.com/news/71297.html", "time": "2015-06-30", "level": "", "num_look": 150500, "num_comment": 3, "author": "Sphinx", "tags": ["资讯"], "text": "近日美国政府网站信息泄露事件中的大量帐号密码数据出现在网络上。"}
{"title": "大学数据安全不可忽视", "url": "https://www.freebuf.com/articles/system/71191.html", "time": "2015-06-30", "level": "金币+4", "num_look": 462456, "num_comment": 23, "author": "SeaCry", "tags": ["系统安全", "网络安全"], "text": "最近黑产肆行，正好前往朋友大学游玩于是测试了一下学校的学生数据安全，希望给大家一个警示，重视内网安全，重视学生数据安全。"}
{"title": "Web下也能玩SQLMap了：基于PHP开发的SQLMAP-Web-GUI", "url": "https://www.freebuf.com/sectool/71241.html", "time": "2015-06-30", "level": "金币+4", "num_look": 511345, "num_comment": 16, "author": "phper", "tags": ["工具"], "text": "今天FreeBuf要介绍的是一款使用PHP作为前端程序开发的Web版SQLMAP，和命令行版一样功能非常齐全。"}
{"title": "Mac OSX Safari 8.0.5 UXSS漏洞技术分析", "url": "https://www.freebuf.com/articles/system/71259.html", "time": "2015-06-29", "level": "金币+4", "num_look": 192837, "num_comment": 6, "author": "living", "tags": ["系统安全"], "text": "该漏洞影响版本在6.2.6,7.1.6,8.0.6[1]之前的Apple Safari浏览器，攻击者可以通过精心构造的网址，绕过同源策略任意读取文件。"}
{"title": "远离Flash，远离危险：从Flash 0day漏洞披露到集成渗透工具包，仅用4天", "url": "https://www.freebuf.com/news/71281.html", "time": "2015-06-29", "level": "金币+4", "num_look": 234915, "num_comment": 14, "author": "月球下雨了", "tags": ["资讯"], "text": "6月27日，渗透测试工具包Magnitude已经成功Adobe Flash Player 0day漏洞，而这个时间仅在Adobe发布修复漏洞补丁后的四天。"}
{"title": "巧用Gmail做你的C&C服务器", "url": "https://www.freebuf.com/sectool/71246.html", "time": "2015-06-29", "level": "金币+4", "num_look": 522801, "num_comment": 22, "author": "fu4k", "tags": ["工具"], "text": "在渗透测试中，C&C（命令与控制）服务器一直是个关键的问题……Gmail或许是一个不错的选择？"}
{"title": "Android调试器存在漏洞，可获取设备内存数据", "url": "https://www.freebuf.com/news/71157.html", "time": "2015-06-29", "level": "金币+4", "num_look": 230518, "num_comment": 6, "author": "Sphinx", "tags": ["漏洞", "资讯"], "text": "趋势科技近日发现了Android调试器Debuggerd中的漏洞，该漏洞可以获取设备内存中的数据，影响系统包括Android 4.0 Ice Cream Sandwich（冰淇淋三明治）到Lollipop（棒棒糖）。"}
{"title": "电子商务系统Magento支付平台被植入恶意代码", "url": "https://www.freebuf.com/news/71190.html", "time": "2015-06-29", "level": "", "num_look": 278538, "num_comment": 4, "author": "Sphinx", "tags": ["WEB安全", "资讯"], "text": "Magento是一套专业开源的电子商务系统，然而Sucuri的研究人员发现有黑客在Magento平台植入恶意代码窃取信用卡数据。"}
{"title": "SCADA工控系统账号正在地下黑市售卖", "url": "https://www.freebuf.com/news/71158.html", "time": "2015-06-29", "level": "金币+4", "num_look": 253743, "num_comment": 6, "author": "vulture", "tags": ["工控安全", "资讯"], "text": "最新调查显示，地下论坛正在售卖SCADA工业控制系统的用户名、密码和其他机密信息。"}
{"title": "大量思科安全设备被曝存在默认SSH密钥", "url": "https://www.freebuf.com/news/71160.html", "time": "2015-06-29", "level": "", "num_look": 316951, "num_comment": 7, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "思科公司透露，大量思科安全设备被曝存在默认SSH密钥，攻击者可以利用该漏洞控制设备。"}
{"title": "隐写术再现：图片木马Stegoloader攻击美国医保公司", "url": "https://www.freebuf.com/news/71177.html", "time": "2015-06-29", "level": "金币+4", "num_look": 304258, "num_comment": 8, "author": "vulture", "tags": ["资讯"], "text": "Stegoloader病毒正在使用“图片隐写术”肆虐全球的计算机系统，根据目前掌握的数据，其主要攻击目标是美国医疗保障公司。"}
{"title": "HackPwn安全极客狂欢节：免费智能硬件申请清单", "url": "https://www.freebuf.com/fevents/71069.html", "time": "2015-06-29", "level": "", "num_look": 208482, "num_comment": 17, "author": "360安全", "tags": ["活动"], "text": "相信还有更多隐藏在民间的高手由于手中没有更多类型可供研究的智能硬件，才没有参与到这场破解的盛宴中，所以HackPwn活动更新了一批智能硬件清单，供真极客们免费申请，放胆破解！"}
{"title": "评测Windows 10虚拟安全模式", "url": "https://www.freebuf.com/articles/system/71108.html", "time": "2015-06-29", "level": "金币+4", "num_look": 287444, "num_comment": 12, "author": "鸢尾", "tags": ["系统安全"], "text": ""}
{"title": "网银大盗Zeus、SpyEye幕后团伙被欧洲警方逮捕", "url": "https://www.freebuf.com/news/71133.html", "time": "2015-06-28", "level": "", "num_look": 183174, "num_comment": 7, "author": "Sphinx", "tags": ["资讯"], "text": "欧洲刑警组织逮捕了一个基于乌克兰的大型网络犯罪团伙，这个团伙被指涉嫌开发、散布和部署著名网银木马Zeus和SpyEye。"}
{"title": "祸起萧墙：由播放器引爆的全国性大规模挂马分析", "url": "https://www.freebuf.com/articles/system/71114.html", "time": "2015-06-27", "level": "红色标题", "num_look": 593062, "num_comment": 38, "author": "360安全", "tags": ["系统安全"], "text": "从6月1日至6月25日，360对播放器挂马的拦截量累计已达到3537406次，这也是今年以来国内最大规模的木马攻击事件。"}
{"title": "再忍不了NSA了：法国或向斯诺登和阿桑奇提供庇护", "url": "https://www.freebuf.com/news/71074.html", "time": "2015-06-27", "level": "金币+4", "num_look": 632612, "num_comment": 19, "author": "Sphinx", "tags": ["资讯"], "text": "因NSA（美国国家安全局）对其领导人的监控，法国政府或将向泄密者斯诺登和阿桑奇提供政治庇护，此举显然具有象征意义。"}
{"title": "安全扫描神器Acunetix Web Vulnerability Scanner 10发布（含破解版下载）", "url": "https://www.freebuf.com/sectool/71091.html", "time": "2015-06-27", "level": "红色标题", "num_look": 4832342, "num_comment": 57, "author": "NEURON信息安全团队", "tags": ["工具"], "text": "伦敦时间2015年6月24日，官方发布了最新版AWVS 10。"}
{"title": "SecureAxcess：这个USB装置可以保证你的邮件、聊天、文件传输安全可靠", "url": "https://www.freebuf.com/news/70965.html", "time": "2015-06-27", "level": "金币+4", "num_look": 275202, "num_comment": 17, "author": "JackFree", "tags": ["工具", "资讯"], "text": "位于佛罗里达克利尔沃特的初创公司开发出一种新的安全工具SecureAxcess，利用该工具可以确保用户的通信及敏感数据安全可靠。"}
{"title": "FreeBuf公开课：Metasploit学习夏令营（第一讲）", "url": "https://www.freebuf.com/news/topnews/70721.html", "time": "2015-06-26", "level": "红色标题", "num_look": 462248, "num_comment": 20, "author": "FB视频", "tags": ["头条", "视频"], "text": "基于目前网络上的Metasploit的教学视频多样性和繁杂性，作者总结了国内外metasploit的教程精华，以自己的独特的方式给出了metasploit测试教程。"}
{"title": "DDoS攻击的发展和应对", "url": "https://www.freebuf.com/articles/network/70992.html", "time": "2015-06-26", "level": "", "num_look": 787666, "num_comment": 14, "author": "阿里安全", "tags": ["网络安全"], "text": "尽可能地对被攻击目标造成最大程度的资源破坏是DDoS攻击的根本初衷。站在这个角度上来看DDoS攻击的发展，可以梳理出清晰的脉络。"}
{"title": "Chrome浏览器静默安装语音搜索插件，Google遭指责", "url": "https://www.freebuf.com/news/70997.html", "time": "2015-06-26", "level": "", "num_look": 246498, "num_comment": 12, "author": "dawner", "tags": ["资讯"], "text": "最近Google似乎遇上了麻烦，人们指责Chrome浏览器悄悄下载并安装一款名为Chrome Hotword的语音搜索扩展，以此监听用户对话。"}
{"title": "六种流行人脸识别APP", "url": "https://www.freebuf.com/news/70984.html", "time": "2015-06-26", "level": "", "num_look": 826367, "num_comment": 4, "author": "codename2015", "tags": ["资讯"], "text": "只因为在人群中多看了你一眼，再也没能忘掉你的容颜。"}
{"title": "Winnti黑客组织将攻击目标扩大至电信和大型制药公司", "url": "https://www.freebuf.com/news/70975.html", "time": "2015-06-26", "level": "", "num_look": 178214, "num_comment": 5, "author": "JackFree", "tags": ["资讯"], "text": "卡巴斯基的安全专家们收集到的证据表明，Winnti黑客组织目前的攻击范围已经不仅限于网络游戏行业，开始扩大到了电信和大型制药公司。"}
{"title": "那个“天使”阿桑奇又回来了", "url": "https://www.freebuf.com/news/70923.html", "time": "2015-06-26", "level": "金币+3", "num_look": 484029, "num_comment": 18, "author": "明明知道", "tags": ["其他", "头条"], "text": "NSA通过电子监听不仅摸清了默克尔的period，也坐实了法国奥朗德与女演员加耶的绯闻。欧洲领导人一个个沦陷，而且都持续了两年多。"}
{"title": "揭秘：深入了解深网（Deep Web）", "url": "https://www.freebuf.com/news/70828.html", "time": "2015-06-26", "level": "", "num_look": 666508, "num_comment": 15, "author": "Sphinx", "tags": ["头条", "资讯"], "text": "提到深网（Deep Web），相信很多人会立即联想到的印象是“一个专门被用来进行违法活动的互联网”，最近趋势科技研究员发布了一份关于深网的报告，希望让读者们对深网有更具体深入的认识。"}
{"title": "云挖矿平台ScryptCC被黑，大量比特币被盗", "url": "https://www.freebuf.com/news/70917.html", "time": "2015-06-26", "level": "", "num_look": 218611, "num_comment": 22, "author": "JackFree", "tags": ["资讯"], "text": ""}
{"title": "走近科学：三星电脑恶意禁用Windows更新“丑闻”", "url": "https://www.freebuf.com/news/70835.html", "time": "2015-06-25", "level": "金币+3", "num_look": 397088, "num_comment": 11, "author": "鸢尾", "tags": ["头条", "系统安全"], "text": "近期有Windows用户反映称，自己的三星电脑上Windows自动更新程序会被随机禁用，这个给他们的PC安全带来了安全隐患。"}
{"title": "入侵日本养老金系统的真凶浮出水面：专攻日本的APT组织“蓝白蚁（blue termite）”", "url": "https://www.freebuf.com/news/70856.html", "time": "2015-06-25", "level": "", "num_look": 190193, "num_comment": 14, "author": "cindy", "tags": ["资讯"], "text": "根据卡巴斯基最新调查报告，入侵日本养老金系统的是专门针对日本的APT攻击组织“蓝白蚁（blue termite）”。"}
{"title": "招商银行招聘安全内控岗", "url": "https://www.freebuf.com/jobs/70737.html", "time": "2015-06-25", "level": "", "num_look": 211104, "num_comment": 16, "author": "xysky", "tags": ["安全招聘"], "text": "招商银行，是中国第一家完全由企业法人持股的股份制商业银行，简称招行，成于1987年4月8日，由香港招商局集团有限公司创办，是中国内地规模第六大的银行、香港中资金融股的八行五保之一。"}
{"title": "微软拒绝修复32位IE漏洞，给出的理由是：32位程序要被淘汰了", "url": "https://www.freebuf.com/news/70833.html", "time": "2015-06-25", "level": "金币+3", "num_look": 252459, "num_comment": 19, "author": "dawner", "tags": ["漏洞", "资讯"], "text": "惠普安全专家Dustin Childs近日披露了一个影响数百万的32位Windows系统的IE漏洞。看起来挺严重是不是？然而，微软似乎并不打算修复这个漏洞……"}
{"title": "对360通信录加密方式的技术分析", "url": "https://www.freebuf.com/articles/terminal/70802.html", "time": "2015-06-25", "level": "", "num_look": 468173, "num_comment": 24, "author": "墨贝科技", "tags": ["终端安全"], "text": "受到David Auerbach[1]的启发，我们分析了360通信录，发现了一些非常有趣的安全问题，这里我们谈谈它传输加密方面的问题。"}
{"title": "评测告诉你：那些免费代理悄悄做的龌蹉事儿", "url": "https://www.freebuf.com/news/70733.html", "time": "2015-06-25", "level": "红色标题", "num_look": 895477, "num_comment": 29, "author": "明明知道", "tags": ["其他", "头条"], "text": "笔者2013年曾发表过一篇文章《免费代理服务器为何免费？》——文中提及代理服务器之所以免费，是因为其可以轻松浸染用户的上网行为并收集数据。"}
{"title": "苹果OS X分布式广告木马分析", "url": "https://www.freebuf.com/articles/system/70715.html", "time": "2015-06-25", "level": "", "num_look": 168475, "num_comment": 1, "author": "鸢尾", "tags": ["系统安全"], "text": "今天Dr.Web公司发布了一篇有关《苹果OS X分布式广告木马的简短分析》，虽然对该木马进行了一些分析，但是具体的细节并没有公布出来"}
{"title": "中国人在BlackHat 2015", "url": "https://www.freebuf.com/news/70547.html", "time": "2015-06-25", "level": "", "num_look": 243914, "num_comment": 4, "author": "萌萌哒", "tags": ["资讯"], "text": "前段时间BlackHat 2015的议题名单出来后反反复复看了四次后，发现了不少我国人的议题诶（记得去年还只有两个）。都有哪些呢？"}
{"title": "腾讯安全团队招聘", "url": "https://www.freebuf.com/jobs/70744.html", "time": "2015-06-24", "level": "", "num_look": 591322, "num_comment": 31, "author": "泡泡", "tags": ["安全招聘"], "text": "众所周知，腾讯是一家互联网公司，过去一段时间，我们都在致力于打造一支顶级的互联网安全团队。"}
{"title": "黑客组织APT3利用Flash 0day漏洞发动大规模钓鱼活动", "url": "https://www.freebuf.com/news/70718.html", "time": "2015-06-24", "level": "", "num_look": 272873, "num_comment": 9, "author": "codename2015", "tags": ["漏洞", "资讯"], "text": "本周二Adobe发布一个紧急安全更新，建议用户及管理员修复Flash Player中编号为CVE-2015-3113的0day漏洞，因为该漏洞正被APT3黑客组织用在大规模的钓鱼攻击活动中。"}
{"title": "美国国安局（NSA）已将攻击目标锁定卡巴斯基等安全公司", "url": "https://www.freebuf.com/news/70694.html", "time": "2015-06-24", "level": "金币+5", "num_look": 271414, "num_comment": 27, "author": "JackFree", "tags": ["资讯"], "text": "斯诺登泄露的文件显示，美国国家安全局（NSA）和GCHQ已将攻击目标瞄向安全软件公司，其中包括卡巴斯基实验室。NSA的目的是从安全软件公司获取情报及用户信息。"}
{"title": "黑客组织春龙（Spring Dragon）发起的APT攻击分析", "url": "https://www.freebuf.com/news/topnews/70543.html", "time": "2015-06-24", "level": "", "num_look": 332136, "num_comment": 8, "author": "dawner", "tags": ["WEB安全", "头条"], "text": "我们在这里分析下前几年的APT案例——黑客组织春龙（Spring Dragon）发起的“Lotus Blossom行动”。"}
{"title": "揭秘：黑客是如何在60秒内偷车的", "url": "https://www.freebuf.com/news/70634.html", "time": "2015-06-24", "level": "金币+5", "num_look": 207517, "num_comment": 16, "author": "鸢尾", "tags": ["资讯"], "text": "从电影《危情谍战》中我获得一丝灵感，接下来我们就谈谈如何与远程设备之间进行通信，从而打开车锁，然后启动一部汽车。"}
{"title": "2015年第二季度全球DDoS威胁报告：38美元租用僵尸网络", "url": "https://www.freebuf.com/news/70480.html", "time": "2015-06-24", "level": "金币+5", "num_look": 497800, "num_comment": 7, "author": "cindy", "tags": ["头条", "安全报告"], "text": "2015年3月1日至5月7日，Incapsula公司对1572个网络层和2714个应用层攻击进行了数据分析并总结出了这份报告。"}
{"title": "FreeBuf公开课：互联网金融的攻防对抗（视频）", "url": "https://www.freebuf.com/video/70654.html", "time": "2015-06-23", "level": "", "num_look": 263054, "num_comment": 25, "author": "FB视频", "tags": ["视频"], "text": "据不完全统计，截至2014年底，已有近165家P2P平台由于黑客攻击造成系统瘫痪、数据被恶意篡改、资金被洗劫一空等。"}
{"title": "Ubuntu曝本地权限提升漏洞（CVE-2015-1328），影响多个版本", "url": "https://www.freebuf.com/news/70615.html", "time": "2015-06-23", "level": "", "num_look": 355621, "num_comment": 16, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "Ubuntu操作系统曝本地权限提升漏洞，影响Ubuntu 12.04、14.04、14.10、15.04版本。目前Ubuntu官方已经修复了该漏洞。"}
{"title": "黑客大神凯文·米特尼克再出山：教你如何攻击光纤网络并窃取敏感数据", "url": "https://www.freebuf.com/news/70598.html", "time": "2015-06-23", "level": "金币+5", "num_look": 1193300, "num_comment": 44, "author": "JackFree", "tags": ["资讯"], "text": "著名黑客凯文·米特尼克（Kevin Mitnick）演示了通过电缆窃取网络数据到底有多么容易，即使目标对象是光纤网络也能够轻而易举的实现。"}
{"title": "利用Pafish侦测虚拟环境", "url": "https://www.freebuf.com/articles/system/70316.html", "time": "2015-06-23", "level": "现金奖励", "num_look": 274136, "num_comment": 14, "author": "nickchang", "tags": ["系统安全"], "text": "当前的病毒分析主要分为静态分析和动态分析。 静态分析并不执行病毒样本，动态分析执行病毒样本。"}
{"title": "信号放大、暴力攻击，偷车的技术含量越来越高了", "url": "https://www.freebuf.com/news/70562.html", "time": "2015-06-23", "level": "", "num_look": 242882, "num_comment": 13, "author": "JackFree", "tags": ["资讯"], "text": ""}
{"title": "波兰国家航空公司遭受网络攻击，超过1400名乘客滞留机场", "url": "https://www.freebuf.com/news/70573.html", "time": "2015-06-23", "level": "金币+5", "num_look": 194582, "num_comment": 9, "author": "JackFree", "tags": ["资讯"], "text": ""}
{"title": "GPS安全性的一点科普", "url": "https://www.freebuf.com/articles/wireless/70578.html", "time": "2015-06-22", "level": "", "num_look": 1026636, "num_comment": 38, "author": "360UnicornTeam", "tags": ["无线安全"], "text": "GPS的安全性并不是一个新话题。"}
{"title": "Nexus设备上的渗透测试平台 - Kali Linux NetHunter", "url": "https://www.freebuf.com/sectool/70540.html", "time": "2015-06-22", "level": "金币+5", "num_look": 625109, "num_comment": 19, "author": "cailinlin", "tags": ["工具"], "text": "NetHunter是一个基于Kali Linux为Nexus设备构建的Android渗透测试平台，其中包括一些特殊和独特的功能。"}
{"title": "SAP HANA系统曝安全漏洞，静态密钥存在数据库里", "url": "https://www.freebuf.com/news/70535.html", "time": "2015-06-22", "level": "", "num_look": 296571, "num_comment": 5, "author": "Sphinx", "tags": ["数据安全", "漏洞"], "text": "SAP知名内存数据库管理系统HANA被曝存在安全漏洞，其静态加密密钥居然存放在数据库中。SAP HANA是SAP有史以来发展最快的产品。"}
{"title": "利用无线电波窃取计算机密码", "url": "https://www.freebuf.com/news/70525.html", "time": "2015-06-22", "level": "金币+6", "num_look": 441533, "num_comment": 20, "author": "JackFree", "tags": ["无线安全", "资讯"], "text": "电脑中的加密密钥可以通过无线电波而泄漏，攻击者只需要廉价的消费级装备即可获取密钥。"}
{"title": "知道电话号码，如何轻松获取电子邮箱", "url": "https://www.freebuf.com/news/70489.html", "time": "2015-06-19", "level": "", "num_look": 814050, "num_comment": 29, "author": "明明知道", "tags": ["安全管理", "资讯"], "text": "知名安全公司赛门铁克（Symantec）发出警告，有一个精装骗局能够获取用户电子邮箱，其中包括了Gmail、Outlook（微软自带管理邮件软件）及Yahoo。"}
{"title": "技术分析：Femtocell家庭基站通信截获、伪造任意短信漏洞", "url": "https://www.freebuf.com/articles/wireless/70458.html", "time": "2015-06-19", "level": "", "num_look": 1893364, "num_comment": 52, "author": "阿里聚安全", "tags": ["无线安全"], "text": "恶意攻击者可以在免费申领一台Femtocell设备之后，迅速地将其改造成伪基站短信群发器和流量嗅探器，影响公众的通信安全。"}
{"title": "表情当密码，这事靠谱么？", "url": "https://www.freebuf.com/news/70436.html", "time": "2015-06-19", "level": "金币+6", "num_look": 403083, "num_comment": 25, "author": "明明知道", "tags": ["头条", "数据安全"], "text": "英国一家科技公司上周演示了一个可以解决密码问题的办法——表情密码。"}
{"title": "安全科普：详解Windows Hash与破解", "url": "https://www.freebuf.com/articles/database/70395.html", "time": "2015-06-19", "level": "金币+6", "num_look": 983961, "num_comment": 15, "author": "小螺号", "tags": ["数据安全"], "text": "在windows中分别用了LM HASH和NTLM HASH对密码进行了加密，所以抓取任意一个HASH都可以破解密码，只不过如果二个HASH都可以抓到，密码的破译成功率会大大提升。"}
{"title": "安全建设需求：生态级公司vs平台级公司", "url": "https://www.freebuf.com/articles/neopoints/70429.html", "time": "2015-06-19", "level": "金币+6", "num_look": 362000, "num_comment": 6, "author": "ayazero", "tags": ["企业安全", "安全管理"], "text": "事实上并不存在我说的这种分类，即生态级公司和平台级公司之间没有必然需要这么做，必然需要那么做的条条框框，但是两者的安全建设需求之间确实不仅仅是量的差别而是质的差别。"}
{"title": "一个QQ钓鱼木马事件的深度追踪", "url": "https://www.freebuf.com/news/topnews/70320.html", "time": "2015-06-19", "level": "现金奖励", "num_look": 1492447, "num_comment": 149, "author": "FGE", "tags": ["头条", "系统安全"], "text": "今天早上刚起来，一个朋友就发给我一个文件，一看文件的名字是拿货清单.tbz2，我第一感觉是病毒，然后就打电话告诉我的那个朋友，她的QQ号码可能被盗了。"}
{"title": "针对IP电话（VoIP）的攻击正逐步上升", "url": "https://www.freebuf.com/news/70317.html", "time": "2015-06-18", "level": "", "num_look": 265375, "num_comment": 7, "author": "Sphinx", "tags": ["资讯"], "text": "新一波针对IP电话的攻击已目标瞄准了英国企业。安全专家们认为，地下犯罪市场中黑客工具的泛滥间接导致了VoIP(Voice over IP)攻击数量上升。"}
{"title": "途牛旅游网招聘高级安全工程师", "url": "https://www.freebuf.com/jobs/70171.html", "time": "2015-06-18", "level": "", "num_look": 266994, "num_comment": 25, "author": "途牛安全", "tags": ["安全招聘"], "text": "中国知名的在线旅游预订平台，现招聘安全岗位。"}
{"title": "安全搜索引擎Shodan（搜蛋）命令行模式使用TIPS", "url": "https://www.freebuf.com/sectool/70373.html", "time": "2015-06-18", "level": "金币+6", "num_look": 1135111, "num_comment": 23, "author": "az0ne", "tags": ["工具"], "text": "Shodan的搜索能力是极其惊人的。无数交通灯、安全摄像头、家庭自动化设备和加热系统都连接着互联网，Shodan可以很轻松地找到它们。"}
{"title": "加拿大政府网站遭到攻击，匿名者（Anonymous）组织称对此事负责", "url": "https://www.freebuf.com/news/70385.html", "time": "2015-06-18", "level": "", "num_look": 241099, "num_comment": 24, "author": "cindy", "tags": ["资讯"], "text": "英国广播公司(BBC)6月18日报道，加拿大政府多个部门的网站17日遭到异常的持续性攻击，目前已基本恢复正常。"}
{"title": "用作电子钱包的Mifare1卡内部数据分析", "url": "https://www.freebuf.com/articles/wireless/70277.html", "time": "2015-06-18", "level": "现金奖励", "num_look": 748406, "num_comment": 32, "author": "MrChi", "tags": ["无线安全", "极客"], "text": "Mifare1卡，又称M1卡或者S50卡。虽然安全漏洞已经被爆出好几年了，但还是非常广泛地作为电子钱包应用于各种消费系统中。一个最典型的例子就是各个单位和高校的水卡、饭卡等。"}
{"title": "一次针对贵金属行业的集体DDoS攻击事件", "url": "https://www.freebuf.com/articles/network/70360.html", "time": "2015-06-18", "level": "", "num_look": 464701, "num_comment": 20, "author": "阿里安全", "tags": ["网络安全"], "text": "2015年6月15日17点31分，阿里云某用户A反馈业务遭受到大流量攻击，攻击峰值流量超过20Gbps。经过云盾安全专家分析，主要攻击类型为SYN Flood、ACK Flood、Connection Flood（连接耗尽）、TCP连接等网络层DDoS攻击。"}
{"title": "2015年夏季国内外重磅黑客峰会参会指南", "url": "https://www.freebuf.com/news/topnews/70207.html", "time": "2015-06-18", "level": "金币+6", "num_look": 396345, "num_comment": 10, "author": "明明知道", "tags": ["其他", "头条"], "text": "FreeBuf精心整理了2015年夏季即将举行的重磅安全峰会&活动档期。"}
{"title": "Trustwave：恶意软件投资回报率高达1425%", "url": "https://www.freebuf.com/news/70245.html", "time": "2015-06-18", "level": "", "num_look": 178139, "num_comment": 6, "author": "thanks", "tags": ["其他", "资讯"], "text": "网络犯罪分子的投资回报率高达1425%，他们的主要开销是购买漏洞利用工具和勒索软件工具，每投资5900美元就可获得84100美元的回报。"}
{"title": "中俄破译“斯诺登情报”，这是真的么？", "url": "https://www.freebuf.com/news/70270.html", "time": "2015-06-18", "level": "", "num_look": 215649, "num_comment": 11, "author": "明明知道", "tags": ["其他", "资讯"], "text": "《星期日泰晤士报》披露，中国和俄罗斯已经联合破解了斯诺登泄密文件。英国情报机关MI6因此撤回了其海外间谍人员。"}
{"title": "三星Galaxy手机输入法曝高危漏洞，攻击者可监控用户摄像头、短信以及安装恶意程序", "url": "https://www.freebuf.com/vuls/70269.html", "time": "2015-06-17", "level": "金币+6", "num_look": 378736, "num_comment": 9, "author": "晶颜123", "tags": ["漏洞"], "text": "三星Galaxy手机近日曝高危漏洞，黑客可暗中监控用户的摄像头和麦克风，读取输入和传出的短信以及安装恶意应用程序，影响全球超过6亿三星手机用户。"}
{"title": "躲避杀软小能手：隐藏于图片中的恶意程序Stegoloader", "url": "https://www.freebuf.com/news/70240.html", "time": "2015-06-17", "level": "", "num_look": 345167, "num_comment": 12, "author": "cindy", "tags": ["系统安全", "资讯"], "text": "戴尔SecureWorks的安全人员周一披露了一种名为Stegoloader的恶意程序，其隐藏于图片文件中，同时采用多种方法躲避杀毒软件的“追杀”。"}
{"title": "爱奇艺招聘安全架构师", "url": "https://www.freebuf.com/jobs/70221.html", "time": "2015-06-17", "level": "", "num_look": 192850, "num_comment": 8, "author": "cloudbase", "tags": ["安全招聘"], "text": "爱奇艺(iQIYI.COM),网络视频播放平台;是国内首家专注于提供免费、高清网络视频服务的大型视频网站。"}
{"title": "三星手机远程代码执行漏洞分析", "url": "https://www.freebuf.com/articles/terminal/70198.html", "time": "2015-06-17", "level": "金币+6", "num_look": 378478, "num_comment": 4, "author": "鸢尾", "tags": ["终端安全"], "text": "在三星设备中预装的快速键盘，无法禁用也无法卸载。即使这个快速键盘并非用户默认使用，攻击者也能够利用！"}
{"title": "Meterpreter：逃避SSL检测", "url": "https://www.freebuf.com/articles/system/70152.html", "time": "2015-06-17", "level": "", "num_look": 412622, "num_comment": 10, "author": "鸢尾", "tags": ["系统安全", "网络安全"], "text": "当执行渗透测试时，SSL检测或许会让你头疼整整一天。这里有一个概念验证，如何调整Metasploit源来逃避SSL检测。"}
{"title": "微软宣布Windows 2003将停止更新", "url": "https://www.freebuf.com/news/70172.html", "time": "2015-06-17", "level": "金币+6", "num_look": 221250, "num_comment": 19, "author": "dawner", "tags": ["资讯"], "text": "微软在去年曾宣布WinXP系统寿终正寝，不再对它进行更新维护，如今终于轮到了Windows 2003了。"}
{"title": "超级病毒Duqu 2.0“持续性”模块分析", "url": "https://www.freebuf.com/news/topnews/70160.html", "time": "2015-06-17", "level": "金币+6", "num_look": 253208, "num_comment": 2, "author": "x0Xo", "tags": ["头条", "系统安全"], "text": "前面我们已经描述过的Duqu2.0实现原理，但是并没有介绍它具有的”可持续性”机制。"}
{"title": "恶意广告正在占领荷兰新闻网站", "url": "https://www.freebuf.com/news/70106.html", "time": "2015-06-17", "level": "", "num_look": 131482, "num_comment": 4, "author": "明明知道", "tags": ["资讯"], "text": "荷兰用户在登录英国卫报、美国赫芬顿邮报、法国世界报等世界主流新闻网站时，会遇到被加载的虚假广告，并最终转向钓鱼者渗透代码工具包。"}
{"title": "安全活动：北京露营大会将上演黑客汽车破解秀", "url": "https://www.freebuf.com/fevents/69999.html", "time": "2015-06-16", "level": "", "num_look": 138657, "num_comment": 4, "author": "360安全", "tags": ["活动"], "text": "在6月19日举行的首届北京露营大会上，将专门设立HackPWN极客工作站，开设黑客汽车破解公开课，向公众演示被称为“最炫酷”的黑客破解汽车秀。"}
{"title": "鑫合汇招聘安全人才", "url": "https://www.freebuf.com/jobs/70069.html", "time": "2015-06-16", "level": "", "num_look": 153759, "num_comment": 10, "author": "鑫合汇安全", "tags": ["安全招聘"], "text": "鑫合汇（www.xinhehui.com）是以P2B（个人到企业或机构）为模式的新型互联网投融平台。"}
{"title": "卡巴斯基：Duqu 2.0病毒使用的数字证书窃取自富士康", "url": "https://www.freebuf.com/news/70107.html", "time": "2015-06-16", "level": "", "num_look": 202057, "num_comment": 7, "author": "cindy", "tags": ["头条", "资讯"], "text": "卡巴斯基实验室遭APT攻击长达数月未发现，进一步的研究发现，入侵卡巴斯基和入侵伊朗核问题“六方”会谈（P5+1）承办酒店电脑的都是超级计算机病毒Duqu 2.0，而且其所使用的合法数字证书竟然盗自富士康公司。"}
{"title": "在线密码管理器LastPass遭入侵", "url": "https://www.freebuf.com/news/70081.html", "time": "2015-06-16", "level": "红色标题", "num_look": 547054, "num_comment": 23, "author": "明明知道", "tags": ["数据安全", "资讯"], "text": "LastPass致用户：请更改你的主密码，并立即启用双因素身份验证！"}
{"title": "首届漏洞马拉松TOP10及奖项公布", "url": "https://www.freebuf.com/news/70011.html", "time": "2015-06-16", "level": "", "num_look": 237938, "num_comment": 11, "author": "漏洞盒子", "tags": ["其他", "活动"], "text": "今日首届“漏洞马拉松”落下帷幕，在短短一个月时间里，组委会累计收到的漏洞数达到700枚，于“金融专场”开启时达到高潮，直接导致漏洞审核员连续加班数周……"}
{"title": "关于建立社工库的经验总结", "url": "https://www.freebuf.com/sectool/70038.html", "time": "2015-06-16", "level": "现金奖励", "num_look": 994059, "num_comment": 29, "author": "iframe", "tags": ["其他", "工具"], "text": "“社工库”是运用社会工程学进行渗透测试时候积累的各方面数据的结构化数据库。"}
{"title": "小技巧：使用Cryptsetup加密U盘", "url": "https://www.freebuf.com/articles/database/70059.html", "time": "2015-06-16", "level": "", "num_look": 366267, "num_comment": 15, "author": "dawner", "tags": ["数据安全"], "text": "这里，我们将向你展示如何加密U盘，妈妈再也不用担心我步陈老师后尘了……"}
{"title": "全球风力发电和太阳能系统存安全缺陷，攻击者可干预能源供给", "url": "https://www.freebuf.com/news/70020.html", "time": "2015-06-16", "level": "", "num_look": 360363, "num_comment": 3, "author": "cindy", "tags": ["工控安全", "漏洞"], "text": "德国安全研究员Maxim Rupp在清洁能源系统（太阳能和风力发电系统）上发现了多个安全问题，攻击者可能会利用此漏洞干扰能源的供给。"}
{"title": "选个“靶子”练练手：15个漏洞测试网站带你飞", "url": "https://www.freebuf.com/news/69821.html", "time": "2015-06-16", "level": "", "num_look": 1817029, "num_comment": 22, "author": "明明知道", "tags": ["其他", "工具"], "text": "通过这15个故意存漏洞网站来提升你的黑客技能，你会成为最好的防守者——无论你是一名开发人员、安全管理者、审计师或者测试人员。请牢记：熟能生巧！"}
{"title": "百度、阿里、腾讯在列：“水坑攻击”利用JSONP劫持跟踪用户", "url": "https://www.freebuf.com/articles/web/70025.html", "time": "2015-06-15", "level": "金币+8", "num_look": 692124, "num_comment": 55, "author": "常运", "tags": ["WEB安全"], "text": "你可以想象一下，如果一个专制国家得到了一种能够获取用户个人隐私信息的工具，而且这种工具能够获取用户在特定网站上的真实姓名，邮箱地址，性别，生日和手机号码等等，那会是个什么样的场景？"}
{"title": "ATM机上看见此物，请立即终止取款并报警", "url": "https://www.freebuf.com/news/70013.html", "time": "2015-06-15", "level": "", "num_look": 337885, "num_comment": 18, "author": "cindy", "tags": ["资讯"], "text": "卡未丢、网银未开通是怎么被盗刷银行卡的？"}
{"title": "安全专家Cesar：交通信号灯和控制系统很不安全（含视频）", "url": "https://www.freebuf.com/news/69974.html", "time": "2015-06-15", "level": "", "num_look": 230394, "num_comment": 6, "author": "dawner", "tags": ["系统安全", "资讯"], "text": "IOActive安全公司CTO、网络安全专家Cesar Cerrudo近日表示，他们已经对世界许多地方的交通灯控制系统和电子信号的安全组件进行了测试。他再次警告IT安全社区：交通信号灯安全问题很大。"}
{"title": "可绕过WAF的Burp Suite插件 - BypassWAF", "url": "https://www.freebuf.com/sectool/69988.html", "time": "2015-06-15", "level": "", "num_look": 553848, "num_comment": 14, "author": "phper", "tags": ["工具"], "text": "这款插件可以帮助你绕过某些WAF。"}
{"title": "HackPwn2015安全极客狂欢节：真极客，放胆破", "url": "https://www.freebuf.com/news/69944.html", "time": "2015-06-15", "level": "", "num_look": 384943, "num_comment": 3, "author": "明明知道", "tags": ["周边", "活动"], "text": "HackPwn2015安全极客狂欢节是全球关注智能生活安全的黑客嘉年华。FreeBuf为本次活动的独家战略合作媒体。"}
{"title": "玩爆EDUP智能插座（Part3）", "url": "https://www.freebuf.com/articles/terminal/69850.html", "time": "2015-06-15", "level": "", "num_look": 254507, "num_comment": 3, "author": "鸢尾", "tags": ["极客", "终端安全"], "text": "在之前我们分析了EDUP设备工作原理以及通信协议，在这一节中我们将会讨论如何实现重放攻击，通过冒充合法服务器获取客户端的控制。"}
{"title": "一台二手电脑引发的离奇“黑客”故事", "url": "https://www.freebuf.com/articles/others-articles/69897.html", "time": "2015-06-15", "level": "金币+8", "num_look": 1271543, "num_comment": 27, "author": "codename2015", "tags": ["其他"], "text": "下面就是我的亲身经历。"}
{"title": "利用Kali进行WiFi钓鱼测试实战", "url": "https://www.freebuf.com/articles/wireless/69840.html", "time": "2015-06-15", "level": "现金奖励", "num_look": 3187680, "num_comment": 65, "author": "piece of the past", "tags": ["无线安全"], "text": "请不要做一只咖啡馆里安静的猥琐大叔。"}
{"title": "年初火了一把的“雇佣黑客”网站Hacker's List，现在还好吗？", "url": "https://www.freebuf.com/news/69904.html", "time": "2015-06-14", "level": "", "num_look": 524841, "num_comment": 20, "author": "codename2015", "tags": ["资讯"], "text": "年初FreeBuf曾经报道过“黑客服务”网站Hacker's List，转眼间半年过去了，Hacker's List还在吗？过的还好吗？"}
{"title": "周末阅读：他改了密码，姑娘说了“Yes, I do”", "url": "https://www.freebuf.com/articles/others-articles/69875.html", "time": "2015-06-13", "level": "红色标题", "num_look": 483791, "num_comment": 32, "author": "明明知道", "tags": ["其他"], "text": "感谢密码，改变了我的生活。如果你还有什么没实现的目标，也把它改成密码试试看吧。"}
{"title": "欧洲多国联合逮捕了49名钓鱼黑客", "url": "https://www.freebuf.com/news/69797.html", "time": "2015-06-13", "level": "", "num_look": 169973, "num_comment": 7, "author": "fber", "tags": ["资讯"], "text": "本周二，6国政府组织联合逮捕了49名网络犯罪嫌疑犯，他们与和“Operation Triangle”钓鱼攻击计划有关。据称这些犯罪者们已经从众多公司卷走了超过600万美元。"}
{"title": "走近科学：周末一起去黑市逛逛", "url": "https://www.freebuf.com/news/69787.html", "time": "2015-06-12", "level": "", "num_look": 265808, "num_comment": 11, "author": "哆啦A梦", "tags": ["其他", "头条"], "text": "黑市现在正在经历急速成长的过程，而地下犯罪也是越来越“流行”了。黑市中提供的最为赚钱的产品就是用户个人信息，这也是常常是网络犯罪的目的所在。"}
{"title": "浅谈Docker隔离性和安全性", "url": "https://www.freebuf.com/articles/system/69809.html", "time": "2015-06-12", "level": "", "num_look": 878769, "num_comment": 4, "author": "fber", "tags": ["系统安全"], "text": "相信很多开发者都默认Docker这样的容器是一种沙盒（sandbox）应用，也就是说他们可以用root权限在Docker中运行随便什么应用，而Docker有安全机制能保护宿主系统。"}
{"title": "FreeBuf全球安全事件纵览（2015年5月）：悠然见南山", "url": "https://www.freebuf.com/news/69594.html", "time": "2015-06-12", "level": "红色标题", "num_look": 407677, "num_comment": 12, "author": "cindy", "tags": ["其他", "头条"], "text": "这个世界是多面的，只是在不同的场景下会呈现出不同的面。而在我们所处的网络时代中，世界向我们呈现次数最多的一些面，就构成了我们时代的特点。"}
{"title": "东软集团安全岗位招聘", "url": "https://www.freebuf.com/jobs/69770.html", "time": "2015-06-12", "level": "", "num_look": 185117, "num_comment": 7, "author": "东软集团网安", "tags": ["安全招聘"], "text": "东软集团是中国领先的IT解决方案与服务供应商，是上市企业，股票代码600718。公司成立于1991年，前身为东北大学下属的沈阳东大开发软件系统股份有限公司和沈阳东大阿尔派软件有限公司。"}
{"title": "HTTPS-Only标准：美国所有政府网站将使用HTTPS加密", "url": "https://www.freebuf.com/articles/web/69769.html", "time": "2015-06-12", "level": "金币+5", "num_look": 333111, "num_comment": 12, "author": "SSLer", "tags": ["WEB安全", "视频"], "text": "美国政府发布一项计划，HTTPS将成为公共网站联邦安全标准，其目标是到2016年12月31日，让美国联邦政府所有网站都使用HTTPS加密。"}
{"title": "微软6月补丁更新日：本月安全形势好转", "url": "https://www.freebuf.com/news/69749.html", "time": "2015-06-12", "level": "", "num_look": 154063, "num_comment": 2, "author": "cindy", "tags": ["资讯"], "text": "本周二（6月9日），微软如期的更新了漏洞补丁。相比于上个月，这个月的漏洞情况明显有了好转，只发布了8个补丁公告，而且只有2个是高危。"}
{"title": "“万蓝”ROM级手机木马分析报告", "url": "https://www.freebuf.com/articles/terminal/69735.html", "time": "2015-06-12", "level": "", "num_look": 342685, "num_comment": 22, "author": "360手机卫士", "tags": ["终端安全"], "text": "今年五月中旬,有用户向360安全中心反馈手机经常自动安装新的游戏应用，经过360互联网安全中心分析排查发现用户中的是一个ROM级别的木马。该木马主要通过获取云端指令进行静默安装推广应用，并可以实现自身升级。木…"}
{"title": "FreeBuf公开课：轻松的方式科普什么是SQL注入攻击（第三集）", "url": "https://www.freebuf.com/articles/web/69705.html", "time": "2015-06-11", "level": "", "num_look": 411744, "num_comment": 17, "author": "FB视频", "tags": ["WEB安全", "视频"], "text": "“安全科普系列”FreeBuf公开课作者weird0（怪蜀黍）在闭关修炼数周之后，在大家的期盼中继续带领大家进行下面的课程。"}
{"title": "打脸事件：卡巴斯基遭APT攻击长达数月未察觉", "url": "https://www.freebuf.com/news/69678.html", "time": "2015-06-11", "level": "金币+5", "num_look": 510459, "num_comment": 21, "author": "cindy", "tags": ["系统安全", "资讯"], "text": "Duqu2.0是现今为止最为复杂的蠕虫，广泛应用于各种APT攻击事件中。全球知名网络安全公司——卡巴斯基实验室经常会披露各机构遭APT攻击，但是这次却亲身感受了下，且被攻击长达数月未察觉。"}
{"title": "关于黑客你不知道的事儿：黑客人数最多的是处女座", "url": "https://www.freebuf.com/fevents/69671.html", "time": "2015-06-11", "level": "", "num_look": 329606, "num_comment": 34, "author": "fber", "tags": ["活动"], "text": "FreeBuf黑客与极客联合GeekPwn发起“中国黑客生存状况调查”现已新鲜出炉，调查结果勾勒出大众对“白帽黑客”人群及安全从业者的双方认知的异同。"}
{"title": "iOS最新漏洞可实现“以假乱真”的iCloud密码钓鱼", "url": "https://www.freebuf.com/news/69650.html", "time": "2015-06-11", "level": "", "num_look": 283860, "num_comment": 10, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "近日安全研究人员发布了一份漏洞利用代码。这份代码表明，攻击者可以通过足以以假乱真的钓鱼，轻易窃取使用最新iOS版本的iCloud密码。"}
{"title": "浅析大规模生产网络的纵深防御架构", "url": "https://www.freebuf.com/articles/system/69643.html", "time": "2015-06-11", "level": "金币+5", "num_look": 420321, "num_comment": 8, "author": "ayazero", "tags": ["系统安全", "观点"], "text": "纵深防御这个在安全行业被用的很烂的词，乙方的顾问写方案时信手捏来，我想大家的理解可能并不一致。其实我比较赞同lake2用的“河防”以及数字公司用的“塔防”的概念，这些都是比较贴近实际的。下面的篇幅仅从自己的理…"}
{"title": "Exploit-Database官方GitHub仓库", "url": "https://www.freebuf.com/sectool/69652.html", "time": "2015-06-11", "level": "", "num_look": 783517, "num_comment": 13, "author": "phper", "tags": ["工具"], "text": "这是著名exploit网站Exploit Database官方Git仓库。"}
{"title": "深入理解hash长度扩展攻击（sha1为例）", "url": "https://www.freebuf.com/articles/web/69264.html", "time": "2015-06-10", "level": "现金奖励", "num_look": 1086117, "num_comment": 18, "author": "QQ4F2DBFB2C71C2EEF0C6129F0B34D3B33", "tags": ["WEB安全"], "text": "为什么会想到这个呢？上周末做了“强网杯”的童鞋们应该都能知道吧，它其中有个密码学的题目就是考的这一点。"}
{"title": "黑掉医院的“新招”：医疗劫持", "url": "https://www.freebuf.com/news/69468.html", "time": "2015-06-10", "level": "", "num_look": 271416, "num_comment": 5, "author": "dawner", "tags": ["终端安全", "资讯"], "text": "知名反诈骗网络安全公司TrapX 发现了医疗领域一个新近流行的攻击手段，可以将这类攻击手段称为医疗劫持，或者MEDIJACK。攻击主要体现在黑客通过渗透进入未打补丁或者老旧的医疗设备系统，从而做更多坏事。"}
{"title": "今年高考首次使用无人机监考，未来或将大范围推行", "url": "https://www.freebuf.com/news/69478.html", "time": "2015-06-10", "level": "金币+5", "num_look": 221850, "num_comment": 20, "author": "dawner", "tags": ["资讯"], "text": "今年高考上，洛阳试点了无人机监考。"}
{"title": "GitHub账户被黑：旧漏洞导致弱密钥大量留存", "url": "https://www.freebuf.com/news/69038.html", "time": "2015-06-10", "level": "", "num_look": 256208, "num_comment": 2, "author": "明明知道", "tags": ["漏洞", "资讯"], "text": "在七年前开发人员发现GitHub存在一个灾难性的漏洞之后，GitHub已经撤销了数量不明的通过密钥访问的账户。这些授权用户登录公共库账户的密钥运用了起初基于linux的Debian系统虚假随意数字生成器。在2006年至2008年的…"}
{"title": "浅谈被加壳ELF文件的DUMP修复", "url": "https://www.freebuf.com/articles/system/69553.html", "time": "2015-06-10", "level": "", "num_look": 337921, "num_comment": 2, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "本文以某加固为例，如何DUMP和修复被加壳的ELF，使其能调试加载。"}
{"title": "跟我学姿势：电影中真实存在的无线黑客技术", "url": "https://www.freebuf.com/articles/wireless/69470.html", "time": "2015-06-09", "level": "金币+5", "num_look": 909458, "num_comment": 34, "author": "mobier", "tags": ["无线安全", "极客"], "text": "前段时间在微博上看到tk教主貌似想拍黑客题材的电影，还有看《战狼》等等不忍直视的电影，另外阿里把“在XX电影中出现在那种黑客技术”作为面试题之一。于是乎我就写下了这篇文章盘点在电影中真实存在的无线hack技术。"}
{"title": "XDB缓冲区溢出漏洞竟然可以颠覆整个数据库？", "url": "https://www.freebuf.com/articles/database/69517.html", "time": "2015-06-09", "level": "", "num_look": 326687, "num_comment": 13, "author": "安华金和", "tags": ["数据安全"], "text": "本文将向大家展示一种黑客入侵数据库的方法，希望能引起大家的警惕。想知道黑客入侵数据库的方法首先要深究黑客入侵数据库的目的。"}
{"title": "快讯：著名0day贩卖网站1337day被CIA控制用来收集用户信息", "url": "https://www.freebuf.com/news/69494.html", "time": "2015-06-09", "level": "金币+6", "num_look": 454105, "num_comment": 20, "author": "xia0k", "tags": ["资讯"], "text": "从声明的内容来看，1337day是因为拒绝了CIA的要求而其域名被CIA劫持，同时CIA还利用了网站进行了钓鱼，但是其服务器却没有出现问题。"}
{"title": "只需几步任何人都能破解你的WhatsApp帐户", "url": "https://www.freebuf.com/news/69254.html", "time": "2015-06-09", "level": "", "num_look": 667318, "num_comment": 8, "author": "江湖小吓", "tags": ["数据安全", "资讯"], "text": "在YouTube有个视频演示了Facebook的社交通讯工具WhatsApp的一个问题。用户如果不注意，就很可能会被任何人轻易地获取到账号密码。"}
{"title": "玩爆EDUP智能插座（Part2）", "url": "https://www.freebuf.com/articles/terminal/69432.html", "time": "2015-06-09", "level": "金币+6", "num_look": 278976, "num_comment": 3, "author": "鸢尾", "tags": ["极客", "终端安全"], "text": ""}
{"title": "揭秘：刀光剑影下的暗网黑市", "url": "https://www.freebuf.com/news/69369.html", "time": "2015-06-09", "level": "金币+6", "num_look": 275377, "num_comment": 12, "author": "dawner", "tags": ["其他", "头条"], "text": "这是一个真实的事件——暗网地下黑市中普通运营商之间的暗战。"}
{"title": "开源HIDS-OSSEC使用实例2：使用联动功能阻断cc攻击", "url": "https://www.freebuf.com/articles/system/69394.html", "time": "2015-06-09", "level": "金币+6", "num_look": 277789, "num_comment": 15, "author": "plane636", "tags": ["系统安全"], "text": "OSSEC作为一款流行的开源HIDS在FreeBuf​上已经有不少文章了，虽然ossec已经内置了一些规则，但要真正满足实际的需求还是远远不够的。这里以一个实例，具体讲解一下如何自己制定一条规则，来加深对ossec的理解。"}
{"title": "400万政府官员信息泄露之后，奥巴马呼吁网络安全改革", "url": "https://www.freebuf.com/news/69404.html", "time": "2015-06-08", "level": "", "num_look": 195605, "num_comment": 14, "author": "cindy", "tags": ["资讯"], "text": "上周五白宫发表文章，力劝国会从“黑暗时代”中走出来，并递交了一份新的网络安全准则，通过列举目前存在的大量安全问题建议推行网络安全改革。"}
{"title": "温州数字电视是如何被黑的 ？", "url": "https://www.freebuf.com/vuls/69368.html", "time": "2015-06-08", "level": "现金奖励", "num_look": 988528, "num_comment": 44, "author": "p0tt1", "tags": ["漏洞", "终端安全"], "text": "文中所提及的漏洞与相关问题，已经提交国家相关部门，并以一个月时间由该部门提出整改建议和大规模整改活动了，所以，大家切勿尝试利用或做违反我国法律法规的事情，否则，极有可能在栅栏里碰到一对好基友。"}
{"title": "技术剖析：海莲花OceanLotus Encryptor样本分析", "url": "https://www.freebuf.com/articles/system/69356.html", "time": "2015-06-08", "level": "金币+6", "num_look": 736020, "num_comment": 37, "author": "比尔.盖茨", "tags": ["安全报告", "系统安全"], "text": "一个APT攻击报告不能详细说明其攻击流程，其他数据分析的再好我觉得都是没有说服力。"}
{"title": "极客DIY：光控自动灯", "url": "https://www.freebuf.com/geek/69229.html", "time": "2015-06-08", "level": "现金奖励", "num_look": 399361, "num_comment": 23, "author": "diy小萝莉", "tags": ["极客"], "text": "光控自动灯可根据光亮的强弱自动的控制灯的开与关，本文小编就帮大家DIY一款属于自己的光控自动灯。"}
{"title": "第一届MOSEC移动安全技术峰会全程全纪实（多图）", "url": "https://www.freebuf.com/news/69299.html", "time": "2015-06-08", "level": "红色标题", "num_look": 424462, "num_comment": 16, "author": "FB独家", "tags": ["头条", "活动"], "text": "最让人记忆深刻的那一定是本届峰会邀请到的诸多国内外知名的安全技术大咖以及他们现场发表的精彩技术演讲！"}
{"title": "记一次对GFW防火墙的探究", "url": "https://www.freebuf.com/articles/network/69042.html", "time": "2015-06-08", "level": "现金奖励", "num_look": 1429893, "num_comment": 25, "author": "Zooood", "tags": ["网络安全"], "text": "今天正在努力的写代码，突然同学传了一个数据包给我，说他的openVPN连不上了。"}
{"title": "“强网杯”网络安全挑战赛WriteUp", "url": "https://www.freebuf.com/articles/web/69260.html", "time": "2015-06-07", "level": "现金奖励", "num_look": 795404, "num_comment": 13, "author": "墨客", "tags": ["WEB安全", "其他"], "text": "“强网杯”挑战赛是面向国内信息安全企业（团队）和高等院校的国家级网络安全赛事，也是第二届国家网络安全宣传周的重要活动之一。"}
{"title": "百度卫士U盘“附送”的木马分析", "url": "https://www.freebuf.com/articles/system/69248.html", "time": "2015-06-06", "level": "红色标题", "num_look": 580779, "num_comment": 35, "author": "不是养蚕人", "tags": ["系统安全"], "text": "前几天打 ACTF 决赛进了第三名，奖品是一堆百度杀毒的U盘。打开后里面一堆百度全家桶不说，居然有一个lpk.dll，百度真是用心良苦。"}
{"title": "研究人员再次发现网银木马Zeus变体，可绕过全部杀毒软件", "url": "https://www.freebuf.com/news/69270.html", "time": "2015-06-06", "level": "", "num_look": 299796, "num_comment": 20, "author": "codename2015", "tags": ["资讯"], "text": "恶意软件分析专家最近发现一款Zeus网银木马的变体，在分析期间该木马竟然完全“隐身”于杀毒引擎检测。"}
{"title": "如何真正成为一个在路上的Linuxer", "url": "https://www.freebuf.com/articles/others-articles/69250.html", "time": "2015-06-06", "level": "", "num_look": 476690, "num_comment": 63, "author": "Lee-Christmas", "tags": ["其他"], "text": "Linux是工具，更像一个信仰。"}
{"title": "芝麻开门：利用电动玩具10秒内打开车库门（视频）", "url": "https://www.freebuf.com/news/69266.html", "time": "2015-06-06", "level": "金币+4", "num_look": 567672, "num_comment": 11, "author": "codename2015", "tags": ["无线安全", "资讯"], "text": "安全研究人员将一款电动玩具打造为“开锁神器”，可在几秒内打开几乎任何有固定密码的车库门。"}
{"title": "开源无线WiFi入侵检测&防护系统 - WAIDPS", "url": "https://www.freebuf.com/sectool/69236.html", "time": "2015-06-05", "level": "", "num_look": 770744, "num_comment": 25, "author": "phper", "tags": ["工具", "无线安全"], "text": "WAIDPS是一个Python编写的无线入侵检测工具，基于Linux平台，完全开源。"}
{"title": "【微博直播中】盘古越狱团队主办：第一届MOSEC移动安全技术峰会（6月5日），FreeBuf全程直播", "url": "https://www.freebuf.com/news/67054.html", "time": "2015-06-05", "level": "红色标题", "num_look": 416653, "num_comment": 14, "author": "cindy", "tags": ["活动", "资讯"], "text": "MOSEC移动安全技术峰会由盘古团队和POC共同举办，第一届会议于2015年在中国上海举办。会议将邀请国内外安全研究人员发表有关移动设备安全的技术演讲。"}
{"title": "美国人事管理局遭遇大规模网络攻击，400万雇员信息被盗", "url": "https://www.freebuf.com/news/69209.html", "time": "2015-06-05", "level": "", "num_look": 255692, "num_comment": 17, "author": "fu4k", "tags": ["资讯"], "text": "美国官员周四透露，黑客通过一次大规模网络攻击入侵了美国人事管理局(OPM)的电脑，导致400万现任和前任员工信息被盗。"}
{"title": "浅谈木马如何隐藏上线IP地址", "url": "https://www.freebuf.com/articles/system/69037.html", "time": "2015-06-05", "level": "现金奖励", "num_look": 668519, "num_comment": 40, "author": "南拳daddy", "tags": ["系统安全", "网络安全"], "text": "木马也叫RAT，或者叫远程管理软件，关于如何隐藏IP地址，应该有不少人在研究，比如ROOTKIT实现文件隐藏、进程隐藏、网络连接隐藏等等。本人才疏学浅,没有深入研究过ROOTKIT，只是谈谈应用层的技术。"}
{"title": "Defcon Quals挑战赛2015 – Twentyfiveseventy关卡WriteUp", "url": "https://www.freebuf.com/articles/system/69056.html", "time": "2015-06-05", "level": "", "num_look": 362707, "num_comment": 7, "author": "鸢尾", "tags": ["系统安全", "网络安全"], "text": "前不久我参加的Defcon Qualification CTF十分有趣，想将这次挑战赛中我用时最长的一个关卡细节分析分享给各位。"}
{"title": "FreeBuf小酒馆：“宇宙首款黑客啤酒”酒标投票", "url": "https://www.freebuf.com/news/69147.html", "time": "2015-06-04", "level": "红色标题", "num_look": 621580, "num_comment": 113, "author": "thanks", "tags": ["其他", "活动"], "text": "第一批货只送不卖——独家邀请FreeBuf小酒馆的内测活跃用户以及积极参与FreeBuf黑客啤酒打造（含本次投票活动）的小伙伴们免费试饮。"}
{"title": "技术分析：本地SWF文件可将任意本地文件泄露于互联网", "url": "https://www.freebuf.com/articles/web/69117.html", "time": "2015-06-04", "level": "金币+4", "num_look": 307605, "num_comment": 10, "author": "living", "tags": ["WEB安全"], "text": "Flash文件在设计的时候就允许本地的swf文件读取任意的本地文件。"}
{"title": "极客DIY：制作一个简单的LED调光灯", "url": "https://www.freebuf.com/geek/68889.html", "time": "2015-06-04", "level": "现金奖励", "num_look": 1386642, "num_comment": 43, "author": "diy小萝莉", "tags": ["极客"], "text": "教程基础，线路简单。过程简易，会的跳过即可，给其他小白一条生路。"}
{"title": "IBM Security AppScan 9.0.2远程代码执行漏洞（含POC）", "url": "https://www.freebuf.com/vuls/69023.html", "time": "2015-06-04", "level": "金币+4", "num_look": 390282, "num_comment": 15, "author": "小歪", "tags": ["漏洞"], "text": "该漏洞基于Windows OLE自动化数组远程代码执行漏洞，远程攻击者可利用此漏洞执行任意代码。"}
{"title": "一张图片黑掉你：在图片中嵌入恶意程序", "url": "https://www.freebuf.com/news/69106.html", "time": "2015-06-04", "level": "红色标题", "num_look": 960272, "num_comment": 26, "author": "phper", "tags": ["WEB安全", "资讯"], "text": "印度Net-Square公司CEO、网络安全专家Saumil Shah最近发现了一种攻击方式。"}
{"title": "八个字符让Skype体验“循环崩溃”", "url": "https://www.freebuf.com/news/69050.html", "time": "2015-06-04", "level": "金币+4", "num_look": 300264, "num_comment": 10, "author": "Sphinx", "tags": ["漏洞", "终端安全"], "text": "Freebuf上周才报道过苹果iOS设备接收到一条精心编写的“乱码”信息时就会立即崩溃，而现在，Skype被爆出也存在类似的bug。"}
{"title": "终于等到你：Windows将加入SSH管理功能", "url": "https://www.freebuf.com/news/69069.html", "time": "2015-06-04", "level": "", "num_look": 353829, "num_comment": 15, "author": "dawner", "tags": ["工具", "资讯"], "text": "​我们在Windows下管理Linux服务器时，都不得不下载并使用第三方SSH客户端，很麻烦是不是？现在好消息来了。"}
{"title": "玩爆EDUP智能插座（Part1）", "url": "https://www.freebuf.com/articles/others-articles/68919.html", "time": "2015-06-03", "level": "金币+4", "num_look": 267573, "num_comment": 20, "author": "鸢尾", "tags": ["其他", "极客"], "text": "智能插座实现了远程开启/关闭连入的设备，的确是一款懒人神器！其实现原理就是通过WiFi模块实现对继电器的开启或者关闭。EDUP智能插座通过用户提供的凭证连接家庭无线网络访问互联网。"}
{"title": "日本养老金系统被“黑”，百万个人信息泄露", "url": "https://www.freebuf.com/news/68995.html", "time": "2015-06-03", "level": "金币+4", "num_look": 444772, "num_comment": 13, "author": "江湖小吓", "tags": ["WEB安全", "数据安全"], "text": "日本养老管理机构一名员工近期在工作中不慎点开一封外来电子邮件中的带病毒附件，致使大约125万份个人信息被泄露。这些数据包括姓名、身份证号、出生日期和居住地址。"}
{"title": "技术剖析：海莲花（OceanLotus）根本不是APT，它只是一个普通木马", "url": "https://www.freebuf.com/news/topnews/68931.html", "time": "2015-06-03", "level": "现金奖励", "num_look": 998694, "num_comment": 112, "author": "毒舌评论砖家", "tags": ["头条", "系统安全"], "text": "上周360发布了一篇关于名为\"海莲花\"的分析报告，当时觉得碉堡了。然后我就很好奇——\"海莲花\"和\"蓝莲花\"啥关系，许巍干的?"}
{"title": "金蝶软件招聘Web安全工程师", "url": "https://www.freebuf.com/jobs/68681.html", "time": "2015-06-02", "level": "", "num_look": 185872, "num_comment": 19, "author": "ppu8", "tags": ["安全招聘"], "text": "金蝶软件始创于1993年，是香港联合交易所主板上市公司。公司拥有友商网（youshang.com）、快递100（kuaidi100.com）、云之家（kdweibo.com）等互联网业务应用。"}
{"title": "GeekPwn携手FreeBuf：中国黑客生存状况调查", "url": "https://www.freebuf.com/news/68802.html", "time": "2015-06-02", "level": "", "num_look": 377061, "num_comment": 32, "author": "FB客服", "tags": ["活动", "资讯"], "text": "GeekPwn携手FreeBuf发起“中国黑客生存状况调查”：截止目前国内最全、最深入的一次黑客调查。"}
{"title": "FBI送助攻：传奇黑客Kim Dotcom的热门域名沦为刀下鱼肉", "url": "https://www.freebuf.com/news/68852.html", "time": "2015-06-02", "level": "", "num_look": 474422, "num_comment": 7, "author": "明明知道", "tags": ["网络安全", "资讯"], "text": "骗子们正在使用前FBI管理的网页域名从事非法传播色情以及广告软件的活动。其中一些被滥用于网络犯罪的站点曾属于Megaupload创始人、“盗版之王”Kim Dotcom。"}
{"title": "开源HIDS-OSSEC使用实例：监测CC攻击", "url": "https://www.freebuf.com/articles/system/68869.html", "time": "2015-06-02", "level": "现金奖励", "num_look": 574688, "num_comment": 12, "author": "plane636", "tags": ["系统安全"], "text": "OSSEC作为一款流行的开源HIDS在FreeBuf​上已经有不少文章了，虽然ossec已经内置了一些规则，但要真正满足实际的需求还是远远不够的。这里以一个实例，具体讲解一下如何自己制定一条规则，来加深对ossec的理解。"}
{"title": "Mac电脑0day漏洞使其可轻易感染rootkit", "url": "https://www.freebuf.com/news/68898.html", "time": "2015-06-02", "level": "", "num_look": 243288, "num_comment": 2, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "近期，网络安全专家Pedro Vilaça在苹果Mac系统中发现了一个低级0day漏洞，特权用户利用该漏洞可以轻易地安装EFI rootkit。MacBook Pro Retina、MacBook Pro和MacBook Air等运行最新EFI固件更新的电脑型号都受此0day…"}
{"title": "大数据安全分析漫谈", "url": "https://www.freebuf.com/articles/database/68877.html", "time": "2015-06-02", "level": "现金奖励", "num_look": 988716, "num_comment": 22, "author": "碳基体", "tags": ["数据安全", "观点"], "text": "大数据安全，顾名思义，用大数据技术解决安全问题。核心——解决安全问题，手段——大数据技术。我们从核心出发，安全问题抽象来说就是攻击与防御，接下来明确防御对象是什么？攻击目的是什么？攻击手段是怎样的？攻击…"}
{"title": "利用hackRF嗅探GSM网络流量", "url": "https://www.freebuf.com/articles/wireless/68736.html", "time": "2015-06-02", "level": "金币+5", "num_look": 1504694, "num_comment": 40, "author": "JackFree", "tags": ["无线安全"], "text": "在本文中，我们将讲述如何使用hackRF嗅探GSM网络的特定频率信号，并能够获取到解码之后的GSM网络流量。"}
{"title": "利用Mono for Android开发的恶意软件", "url": "https://www.freebuf.com/articles/68803.html", "time": "2015-06-01", "level": "", "num_look": 325397, "num_comment": 3, "author": "AVLTeam", "tags": ["文章", "终端安全"], "text": "近期AVL移动安全团队首次发现一款使用Mono for Android开发的恶意APP，该应用除了使用C＃语言开发，还加入了Lua环境，可以执行恶意Lua脚本。"}
{"title": "安全教育：企业安全涵盖哪些事情？", "url": "https://www.freebuf.com/articles/neopoints/68788.html", "time": "2015-06-01", "level": "金币+5", "num_look": 446084, "num_comment": 15, "author": "ayazero", "tags": ["企业安全", "安全管理"], "text": "对整体介绍的部分在前面的篇幅讲的比较多，主要目的是希望“视野”部分不缩水，这些概念在后面篇幅都不打算再展开了，如果你迟迟没看到技术篇，很正常，这只是一个开头而已。下一篇谈谈互联网企业安全管理和传统行业…"}
{"title": "美国曾对朝鲜发动“震网”攻击但未果", "url": "https://www.freebuf.com/news/68728.html", "time": "2015-06-01", "level": "", "num_look": 531043, "num_comment": 16, "author": "codename2015", "tags": ["文章", "网络安全"], "text": "BBC曾发表文章称一名朝鲜高级叛离者指出朝鲜的网军有能力发动可致人类于死地的网络攻击。事实果真如此吗？而美国针对“不知秦汉无论魏晋”的朝鲜互联网又做了什么？"}
{"title": "做一名无线黑客，这些装备你必须有", "url": "https://www.freebuf.com/sectool/68747.html", "time": "2015-06-01", "level": "金币+5", "num_look": 1720918, "num_comment": 88, "author": "mobier", "tags": ["工具", "无线安全"], "text": "在电影里黑客都在大街上或者马路上直接用笔记本“嗒…嗒…嗒…”就把某个东西“黑”掉了——这都是通过无线的。"}
{"title": "玩坏苹果：10个iOS恶作剧（视频）", "url": "https://www.freebuf.com/news/68719.html", "time": "2015-06-01", "level": "金币+5", "num_look": 308918, "num_comment": 19, "author": "codename2015", "tags": ["视频", "资讯"], "text": "用户知道这个bug后，恶作剧遍地打滚，放眼望去Apple移动设备纷纷崩溃，一时间哀鸿遍野不忍直视……"}
{"title": "NSA出品：根据打字和滑屏方式跟踪手机用户", "url": "https://www.freebuf.com/news/68632.html", "time": "2015-06-01", "level": "", "num_look": 221182, "num_comment": 5, "author": "明明知道", "tags": ["极客", "资讯"], "text": "你使用手机屏幕的方式足以让你的智能手机识别出你来。没错，这不是科幻小说，黑科技来了。"}
{"title": "美国：将日本纳入网络攻击防御保护伞", "url": "https://www.freebuf.com/news/68732.html", "time": "2015-05-31", "level": "", "num_look": 205152, "num_comment": 11, "author": "codename2015", "tags": ["资讯"], "text": "美国宣布将其网络防御保护伞覆盖至日本，以助力其亚洲盟友处理针对军事基地及基础设施（如电网等）的网络攻击。"}
{"title": "为什么成为一名程序员这么难？", "url": "https://www.freebuf.com/articles/others-articles/68711.html", "time": "2015-05-31", "level": "金币+5", "num_look": 679826, "num_comment": 51, "author": "1937余天", "tags": ["其他"], "text": "有人说，每个看起来与正常人无异的工程师，其实都是在学习程序开发的途中熬过、压抑过、而且创伤过的反社会人士(sociopaths)。"}
{"title": "行动代号OpChina：国际黑客组织匿名者（Anonymous）宣布今日发动对华网络攻击", "url": "https://www.freebuf.com/news/68672.html", "time": "2015-05-30", "level": "金币+6", "num_look": 1170920, "num_comment": 229, "author": "午夜灰狼哥", "tags": ["资讯"], "text": "国际黑客组织匿名者（Anonymous）联合计划于2015年5月30日发动对华网络攻击，行动代号”OpChina”。目前日本、菲律宾、越南的黑客已响应行动。"}
{"title": "反病毒老兵的“不惑”之思，八小时跨越三十年（内附直播地址）", "url": "https://www.freebuf.com/news/68665.html", "time": "2015-05-30", "level": "", "num_look": 281790, "num_comment": 18, "author": "明明知道", "tags": ["活动", "资讯"], "text": "本报告试图抽取这个演进过程中的跃点、拐点和关键词，并从一个架构师视角来观察与思索这种对抗与演进，尝试总结反病毒技术演进的规律性因素。报告人希望用八小时的时间，与听众一起跨越30年。"}
{"title": "仿冒QQ空间的木马分析报告", "url": "https://www.freebuf.com/articles/terminal/68631.html", "time": "2015-05-29", "level": "", "num_look": 358346, "num_comment": 15, "author": "阿里聚安全", "tags": ["安全报告", "终端安全"], "text": "该木马软件高度仿冒QQ空间网页版，安装后可以正常进入QQ空间查看动态，但其启动后就隐藏桌面图标，拦截用户的所有短信并转发给指定的号码，获取联系人并给所有的亲人朋友发送一条附带链接的短信。"}
{"title": "一例针对中国政府机构的准APT攻击中所使用的样本分析", "url": "https://www.freebuf.com/news/topnews/68671.html", "time": "2015-05-29", "level": "", "num_look": 422642, "num_comment": 11, "author": "AVLTeam", "tags": ["头条", "网络安全"], "text": "安天近期发现一例针对中国政府机构的准APT攻击事件，在攻击场景中，攻击者依托自动化攻击测试平台Cobalt Strike生成的、使用信标（Beacon）模式进行通信的Shellcode，实现了对目标主机进行远程控制的能力。"}
{"title": "“海莲花”APT报告：攻击中国政府海事机构的网络空间威胁", "url": "https://www.freebuf.com/news/topnews/68622.html", "time": "2015-05-29", "level": "红色标题", "num_look": 680254, "num_comment": 32, "author": "360安全", "tags": ["头条", "安全报告"], "text": "OceanLotus通过鱼叉攻击和水坑攻击等方法，配合多种社会工程学手段进行渗透，向境内特定目标人群传播特种木马程序，秘密控制部分政府人员、外包商和行业专家的电脑系统，窃取系统中相关领域的机密资料。"}
{"title": "走近科学：隐藏在图像数据库中的安全问题", "url": "https://www.freebuf.com/articles/database/68623.html", "time": "2015-05-29", "level": "", "num_look": 274471, "num_comment": 3, "author": "哆啦A梦", "tags": ["数据安全"], "text": "本文探索了图像数据库的价值以及调查了其中一些数据库的安全与隐私问题。"}
{"title": "数据驱动安全：谈谈数据分析这点事（1）", "url": "https://www.freebuf.com/articles/database/68617.html", "time": "2015-05-29", "level": "金币+6", "num_look": 305978, "num_comment": 3, "author": "zhuyue", "tags": ["数据安全", "观点"], "text": "如何有效的实现“数据分析+应用变现”，挖掘数据的价值，探索到合理的商业模式，是当务之急。就信息安全行业而言，谈谈数据分析这点事。"}
{"title": "Linux/Moose蠕虫：操纵路由器“帮你玩”社交网络", "url": "https://www.freebuf.com/news/68580.html", "time": "2015-05-29", "level": "", "num_look": 298586, "num_comment": 3, "author": "cindy", "tags": ["终端安全", "资讯"], "text": "ESET的安全研究员发表了一篇技术报告，报告中详细分析了一个新的蠕虫Linux/Moose。它的攻击对象主要是调制解调器、家用路由器，将这些设备变成一个代理网络，然后创建伪造的社交账号实施欺诈行为。"}
{"title": "简明手册：如何在PHP应用中防止SQL注入", "url": "https://www.freebuf.com/articles/web/68527.html", "time": "2015-05-29", "level": "金币+6", "num_look": 377039, "num_comment": 7, "author": "鸢尾", "tags": ["WEB安全"], "text": "代码注入（包括SQL，LDAP，操作系统命令，XPath注入技术）长年保持在OWASP漏洞排名前十。"}
{"title": "玩转Metasploit系列（第五集）", "url": "https://www.freebuf.com/sectool/68409.html", "time": "2015-05-29", "level": "", "num_look": 741294, "num_comment": 37, "author": "ArthurKiller", "tags": ["头条", "工具"], "text": "这集将给大家详细介绍一下Payloads。"}
{"title": "路由器安全检查APP（安卓） - RouterCheck", "url": "https://www.freebuf.com/sectool/68583.html", "time": "2015-05-28", "level": "", "num_look": 461841, "num_comment": 15, "author": "phper", "tags": ["工具"], "text": "RouterCheck是一个基于安卓的路由器与家庭网络安全检查APP，可以检测路由器是否存在安全漏洞和相关风险项。"}
{"title": "CNCERT：2014年中国互联网网络安全态势报告速读", "url": "https://www.freebuf.com/news/68556.html", "time": "2015-05-28", "level": "", "num_look": 239454, "num_comment": 4, "author": "明明知道", "tags": ["其他", "头条"], "text": "国家互联网应急中心（CNCERT）日前发布的《2014年我国互联网网络安全态势报告》数据显示，中国网络安全形式不容乐观，2014年CNCERT通报的漏洞事件达9068起，较2013年增长3倍。"}
{"title": "乐视网招聘安全人才", "url": "https://www.freebuf.com/jobs/68539.html", "time": "2015-05-28", "level": "", "num_look": 270909, "num_comment": 21, "author": "乐视安全", "tags": ["安全招聘"], "text": "乐视网成立于2004年11月，2010年8月12日在中国创业板上市。"}
{"title": "【更新：目前已恢复】快讯：携程全线瘫痪，传言代码被恶意删除", "url": "https://www.freebuf.com/news/68558.html", "time": "2015-05-28", "level": "金币+6", "num_look": 671163, "num_comment": 61, "author": "fber", "tags": ["资讯"], "text": "点击进入携程网，页面显示404报错，虽然点击“返回首页”后依然可以进入携程网，但其功能和其它链接均无法使用。"}
{"title": "CNCERT 2015中国计算机网络安全大会速描：智能网络 安全护航", "url": "https://www.freebuf.com/news/68461.html", "time": "2015-05-28", "level": "", "num_look": 187913, "num_comment": 6, "author": "明明知道", "tags": ["活动", "资讯"], "text": "2015年5月26-28日，由国家互联网应急中心(CNCERT)举办的主题为“智能网络 安全护航”的“2015中国计算机网络安全大会”在江城武汉正式召开。"}
{"title": "伊朗成功粉碎美国对其石油部发动的网络攻击", "url": "https://www.freebuf.com/news/68448.html", "time": "2015-05-28", "level": "", "num_look": 174179, "num_comment": 3, "author": "fber", "tags": ["资讯"], "text": "伊朗政府于周二发出声明：伊朗FATA网络攻击应急中心近日成功挫败了美国向伊朗石油部发动的网络攻击。"}
{"title": "移花接木大法：新型“白利用”华晨远控木马分析", "url": "https://www.freebuf.com/articles/system/68469.html", "time": "2015-05-28", "level": "", "num_look": 415540, "num_comment": 21, "author": "360安全", "tags": ["系统安全"], "text": "该木马伪装成“美女图片”通过社交软件、电子邮件等方式传播，一旦中招，电脑将被黑客发送指令执行摄像头监控、屏幕监控等远程控制行为。"}
{"title": "强强合体：Docker版Kali Linux发布", "url": "https://www.freebuf.com/news/68521.html", "time": "2015-05-27", "level": "金币+3", "num_look": 1449213, "num_comment": 22, "author": "Sphinx", "tags": ["工具", "资讯"], "text": "最近，Kali的开发者们为喜爱Docker的童鞋们发布了新版本。"}
{"title": "为何解放军全军禁用智能穿戴设备？因为可穿戴设备很容易被跟踪", "url": "https://www.freebuf.com/news/68423.html", "time": "2015-05-27", "level": "", "num_look": 300728, "num_comment": 8, "author": "Sphinx", "tags": ["无线安全", "资讯"], "text": "关于可穿戴设备的安全和隐私问题一直引发热议，前不久解放军就曾禁止使用可穿戴设备，原因是可能存在的安全漏洞会导致军事机密暴露。解放军下发禁令是因为一位新兵收到女友送的智能手表，并且用它给战友们拍照。"}
{"title": "FireEye安全专家在钓鱼热潮中挖掘出新型POS恶意软件——NitlovePoS", "url": "https://www.freebuf.com/news/68426.html", "time": "2015-05-27", "level": "", "num_look": 237265, "num_comment": 1, "author": "dawner", "tags": ["终端安全", "资讯"], "text": "恶意软件家族真是花样百出，现如今，又出现了一个新的恶意软件--NitlovePoS，它可以捕获和跟踪支付卡行为，并扫描已经感染的机器。"}
{"title": "30年后，就让我们都等着得wifi癌死吧？！", "url": "https://www.freebuf.com/news/68373.html", "time": "2015-05-27", "level": "", "num_look": 398136, "num_comment": 30, "author": "明明知道", "tags": ["其他", "无线安全"], "text": "无线上网技术取得的重大进步使生活变得更加轻松了，我们可以使用电脑和手机看电影、打游戏或者工作、社交。但是，专家说WiFi有一种严重的缺点，它会让人生病！"}
{"title": "揭秘：北欧国家为何成为各路黑客的首要攻击目标？", "url": "https://www.freebuf.com/news/68401.html", "time": "2015-05-27", "level": "红色标题", "num_look": 472873, "num_comment": 4, "author": "cindy", "tags": ["头条", "网络安全"], "text": "北欧地区以其丰富的自然资源、能源，强大的航空航天和国防，完善的医疗保健和运输体系，以及透明化的政府体制而闻名，在搜集有价值的经济、政治和军事情报方面他们自然而然成为了网络威胁的首要目标。"}
{"title": "犯罪成本越来越低：三步即可傻瓜化制作勒索软件", "url": "https://www.freebuf.com/news/68406.html", "time": "2015-05-27", "level": "金币+3", "num_look": 357141, "num_comment": 19, "author": "vulture", "tags": ["资讯"], "text": "McAfee在暗网中发现了一款专门制作勒索软件的工具，使用这款软件，3步你就能制作勒索软件了。"}
{"title": "玩转Metasploit系列（第四集）", "url": "https://www.freebuf.com/sectool/68205.html", "time": "2015-05-27", "level": "", "num_look": 962842, "num_comment": 28, "author": "ArthurKiller", "tags": ["头条", "工具"], "text": "当我们进行一场渗透测试的时候，我们需要记录大量的信息和数据，而数据库可以为我们节省很多时间。"}
{"title": "幽灵的威胁：针对石油运输船的黑客攻击活动", "url": "https://www.freebuf.com/news/68360.html", "time": "2015-05-26", "level": "", "num_look": 174935, "num_comment": 6, "author": "江湖小吓", "tags": ["资讯"], "text": "熊猫安全公司近日发布了一份关于针对石油运输船的黑客活动报告，该攻击活动被称为“幽灵的威胁”。对石油货物的攻击开始于2013年8月，2014年1月首次被发现，攻击者的主要目的是窃取机密信息以打击石油公司。"}
{"title": "浅谈被加壳ELF的调试", "url": "https://www.freebuf.com/articles/system/67927.html", "time": "2015-05-26", "level": "", "num_look": 421255, "num_comment": 4, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "本文只讨论如何调试被加壳的ELF文件，包括调试中的技巧运用及调试过程中可能遇到的问题的解决方法，不包含如何还原加固的DEX本文将以某加壳程序和某加固为目标。"}
{"title": "胆大包天：黑客团伙Carbanak使用的攻击服务器居然指向了俄罗斯安全局", "url": "https://www.freebuf.com/news/68350.html", "time": "2015-05-26", "level": "金币+3", "num_look": 233695, "num_comment": 7, "author": "vulture", "tags": ["资讯"], "text": "安全研究人员最近发现，黑客团伙Carbanak使用的一台C&CC（命令与控制）服务器居然指向了俄罗斯联邦安全局。"}
{"title": "【金融、游戏专场火热进行中：高额奖金，最后5天】漏洞马拉松：第一届互联网漏洞“奥运会”", "url": "https://www.freebuf.com/news/66741.html", "time": "2015-05-26", "level": "红色标题", "num_look": 360959, "num_comment": 12, "author": "漏洞盒子", "tags": ["活动", "资讯"], "text": "漏洞马拉松是漏洞盒子发起的，以互联网漏洞为基础的大型在线活动。"}
{"title": "用Python解密手机QQ聊天记录", "url": "https://www.freebuf.com/articles/terminal/68224.html", "time": "2015-05-26", "level": "现金奖励", "num_look": 1407750, "num_comment": 38, "author": "piece of the past", "tags": ["终端安全"], "text": "据说手机QQ 2012之后使用记录保存的sqliteDB内容加密，库没有设置密码，直接用sqliteadmin之类的软件打开之后可以看到一堆歪七扭八的字符。那么如何恢复和解密QQ聊天记录呢？"}
{"title": "中国烧鹅系列：利用烧鹅自动执行SD卡上的自定义程序（含视频）", "url": "https://www.freebuf.com/sectool/68265.html", "time": "2015-05-26", "level": "", "num_look": 701645, "num_comment": 31, "author": "BinAry", "tags": ["工具", "无线安全"], "text": "利用烧鹅自动执行SD卡上的自定义程序，可以在很短的时间（5秒左右）完成Attack。"}
{"title": "也门网络军队入侵沙特政府网络，泄露大量机密信息", "url": "https://www.freebuf.com/news/68290.html", "time": "2015-05-25", "level": "", "num_look": 182950, "num_comment": 3, "author": "cindy", "tags": ["资讯"], "text": "上周，也门网络军队（Yemen Cyber Army ）入侵了沙特阿拉伯政府的计算机系统，包括沙特阿拉伯外交部、内政部 、国防部的网站、服务器、数据库等，同时还泄露了上千份高度机密的文件和其他相关数据。"}
{"title": "云控攻击之“人生在世”木马分析", "url": "https://www.freebuf.com/articles/system/68195.html", "time": "2015-05-25", "level": "", "num_look": 603055, "num_comment": 38, "author": "360安全", "tags": ["系统安全"], "text": "‍近期一款名为“人生在世”的木马家族异常活跃，它隐藏在“小马激活”、“种子搜索神器迅雷云播版”、“宝宝CF刷枪软件”、“游戏启动器”等软件中，具有较强的免杀能力和大规模传播能力。"}
{"title": "Android手机恢复出厂设置后，数据依然可恢复", "url": "https://www.freebuf.com/news/68268.html", "time": "2015-05-25", "level": "金币+3", "num_look": 611257, "num_comment": 6, "author": "Sphinx", "tags": ["终端安全", "资讯"], "text": "如果你打算卖掉你的旧Android手机，建议你还是多考虑考虑……Android恢复出厂设置功能有一个漏洞，即使你恢复了出厂设置，黑客依然可以恢复你的登录密码、短信、邮件和图片。"}
{"title": "忘记密码咋办？本地密码检索工具 - LaZagne Project", "url": "https://www.freebuf.com/sectool/68229.html", "time": "2015-05-25", "level": "", "num_look": 413868, "num_comment": 26, "author": "鸢尾", "tags": ["工具"], "text": "截至目前，该工具支持Windows上的22款软件，Linux/Unix-Like OS上的12款软件。"}
{"title": "分析热门的木马Rombertik：“自毁”是为了防止控制端域名被修改", "url": "https://www.freebuf.com/articles/system/68130.html", "time": "2015-05-25", "level": "金币+3", "num_look": 178422, "num_comment": 1, "author": "hellotong", "tags": ["系统安全"], "text": "一旦Rombertik发现有人正在对它进行分析，就会“自杀式袭击”破坏MBR（磁盘主引导区），使系统无法正常启动；如果篡改MBR失败，它还会加密破坏电脑上的文件。"}
{"title": "你的密码保护问题真的安全吗？", "url": "https://www.freebuf.com/news/68251.html", "time": "2015-05-25", "level": "金币+3", "num_look": 410851, "num_comment": 17, "author": "Sphinx", "tags": ["其他", "头条"], "text": "研究表明密码保护这种“忘记密码”后最基本的验证方式存在诸多安全隐患。"}
{"title": "玩转Metasploit系列（第三集）", "url": "https://www.freebuf.com/sectool/67923.html", "time": "2015-05-25", "level": "金币+3", "num_look": 1022164, "num_comment": 26, "author": "ArthurKiller", "tags": ["头条", "工具"], "text": "Metasploit中提供了各种各样的接口。当然，各个接口程序都有他们各自的优点和缺点。接下来，我要对Metasploit中所有的接口程序做解释和实验。"}
{"title": "黑客组织匿名者（Anonymous）公布泰国政府网站数据", "url": "https://www.freebuf.com/news/68247.html", "time": "2015-05-24", "level": "金币+3", "num_look": 292429, "num_comment": 14, "author": "vulture", "tags": ["资讯"], "text": "黑客组织匿名者（Anonymous）日前公布了泰国参议院和公共卫生部的网站数据，包括网站用户的密码，以示对泰国政府对人口贩卖活动不作为的抗议。"}
{"title": "一键获取隐藏Wi-Fi SSID：利用Python和Scapy发现隐藏无线热点", "url": "https://www.freebuf.com/articles/wireless/66118.html", "time": "2015-05-24", "level": "金币+3", "num_look": 1680787, "num_comment": 32, "author": "xia0k", "tags": ["无线安全"], "text": "一旦无线被破解，以目前的无线架构的特点来说，基本上就等于进了家门，危险程度还是很高的。"}
{"title": "多伦多大学：UC浏览器收集并发送用户隐私数据分析报告", "url": "https://www.freebuf.com/news/68137.html", "time": "2015-05-24", "level": "金币+3", "num_look": 644696, "num_comment": 10, "author": "cindy", "tags": ["头条", "安全报告"], "text": "加拿大多伦多大学公民实验室一直在调查研究UC这款亚洲地区较为流行的通信工具。"}
{"title": "中国军报：应对互联网内容进行更严格的管理", "url": "https://www.freebuf.com/news/68167.html", "time": "2015-05-24", "level": "金币+3", "num_look": 281092, "num_comment": 21, "author": "江湖小吓", "tags": ["资讯"], "text": "两天前中国军网上官方发表了一篇文章，表明中国必须向西方对抗，防止中国公民的思想严重受到西方的影响。"}
{"title": "世界上最大成人交友网站AdultFriendFinder数据库泄露，近四百万会员性生活曝光", "url": "https://www.freebuf.com/news/68162.html", "time": "2015-05-23", "level": "金币+3", "num_look": 3223275, "num_comment": 64, "author": "dawner", "tags": ["资讯"], "text": "昨日一位匿名黑客在暗网公开了世界上最大的交友网站之一AdultFriendFinder的数据库，泄漏的数据库信息中括用户的电子邮件、IP、出生日期、性取向等。"}
{"title": "ElasticSearch曝本地任意文件读取漏洞，影响1.4.5和1.5.2之前所有版本（附POC）", "url": "https://www.freebuf.com/vuls/68075.html", "time": "2015-05-22", "level": "金币+3", "num_look": 287631, "num_comment": 7, "author": "jack", "tags": ["漏洞"], "text": "近期在exploit-db上曝出了ElasticSearch插件功能的目录遍历（Path Transversal）引起的本地任意文件读取漏洞，影响1.4.5和1.5.2之前所有版本，漏洞的影响面积还挺大的。"}
{"title": "美医疗保险公司CareFirst被黑，110万用户信息泄露", "url": "https://www.freebuf.com/news/68110.html", "time": "2015-05-22", "level": "", "num_look": 359851, "num_comment": 4, "author": "明明知道", "tags": ["资讯"], "text": "美国大型医疗保险商CareFirst于本周三表示，该公司去年六月发现有黑客入侵，约有110万医疗保险客户的个人信息遭泄露。"}
{"title": "Discuz论坛自动爆破工具原理分析", "url": "https://www.freebuf.com/articles/web/68002.html", "time": "2015-05-22", "level": "金币+3", "num_look": 625321, "num_comment": 15, "author": "魍魉", "tags": ["WEB安全"], "text": "最近爆出关于利用社工库爆破Discuz论坛用户名密码的工具，造成很多大的论坛用户信息泄露，分析原理如下。"}
{"title": "【FreeBuf视频】专访KeenTeam成员Peter：斯洛伐克黑客在中国", "url": "https://www.freebuf.com/video/68076.html", "time": "2015-05-22", "level": "红色标题", "num_look": 453178, "num_comment": 14, "author": "FB视频", "tags": ["人物志", "视频"], "text": "今年3月的Pwn2Own上中国团队Keen Team团队成功拿到了第五个世界冠军，同时也让人们记住了这个年轻面孔——30秒攻破Flash、来自斯洛伐克的黑客Peter。"}
{"title": "超级加农炮（Great Cannon）缺陷探究之JS纰漏篇", "url": "https://www.freebuf.com/articles/network/68055.html", "time": "2015-05-22", "level": "现金奖励", "num_look": 351414, "num_comment": 6, "author": "ArkTeam", "tags": ["网络安全"], "text": "继上次发表在FreeBuf上的文章《超级加农炮（Great Cannon）缺陷探究之TTL篇》之后，我们参考自国外一个研究组织针对此次事件的事后分析，锁定The Great Cannon攻击时所使用的代码。"}
{"title": "HTML5安全分析：本地存储", "url": "https://www.freebuf.com/articles/web/67971.html", "time": "2015-05-22", "level": "", "num_look": 272876, "num_comment": 5, "author": "鸢尾", "tags": ["WEB安全"], "text": "在上一篇文章《HTML5跨域消息发送安全性分析》中，我们讨论了在HTML5下的跨域消息传递。本文将带你去了解另外一个特性。"}
{"title": "德国联邦议院内网再遭黑客入侵", "url": "https://www.freebuf.com/news/68036.html", "time": "2015-05-22", "level": "", "num_look": 165188, "num_comment": 5, "author": "cindy", "tags": ["资讯"], "text": "德国联邦议院日前遭遇黑客入侵，是否造成数据泄露尚不清楚。在今年一月份，联邦议院和联邦总理府的网络也曾遭到黑客攻击。"}
{"title": "仿冒美团红包木马分析报告", "url": "https://www.freebuf.com/articles/terminal/67848.html", "time": "2015-05-21", "level": "", "num_look": 291373, "num_comment": 5, "author": "阿里聚安全", "tags": ["安全报告", "终端安全"], "text": "阿里移动安全实验室截获了一款仿冒美团应用的”美团红包”木马。用户安装木马后根据不同的参数，向服务器投递对应的数据，并上报用户敏感信息。"}
{"title": "又要说再见了？中文维基百科19日下午开始无法访问", "url": "https://www.freebuf.com/news/68011.html", "time": "2015-05-21", "level": "", "num_look": 770552, "num_comment": 27, "author": "明明知道", "tags": ["资讯"], "text": "通常中文维基百科只有部分敏感词条才会被屏蔽，而从5月19日下午起，中国大陆地区网民已无法正常访问。"}
{"title": "防火防盗防同行：木马Rombertik的“自我摧毁”机制原来是为了防盗版", "url": "https://www.freebuf.com/news/67960.html", "time": "2015-05-21", "level": "", "num_look": 147524, "num_comment": 7, "author": "Sphinx", "tags": ["资讯"], "text": "赛门铁克研究人员认为，Rombertik的“自毁”功能是为了防盗版……"}
{"title": "路由器驱动组件NetUSB曝远程溢出漏洞，影响D-Link、NETGEAR、TP-LINK等数以百万网络设备", "url": "https://www.freebuf.com/news/67961.html", "time": "2015-05-21", "level": "金币+5", "num_look": 448253, "num_comment": 5, "author": "dawner", "tags": ["漏洞", "资讯"], "text": "知名路由器D-Link、NETGEAR、TP-LINK上用于共享网络的NetUSB驱动最近被曝存在内存溢出漏洞，影响数以百万计的路由和嵌入式设备。"}
{"title": "浅析点击劫持攻击", "url": "https://www.freebuf.com/articles/web/67843.html", "time": "2015-05-21", "level": "现金奖励", "num_look": 1099548, "num_comment": 16, "author": "ziwen", "tags": ["WEB安全"], "text": "这种漏洞目前在国内一直不被重视，但前一阵子Facebook和YouTube纷纷爆出点击劫持导致大问题的漏洞，国外才开始关注此问题，但国内依然不理不睬，看起来很容易的漏洞，但真的可以造成很大的危害，此文目的既在此。"}
{"title": "中国烧鹅系列：利用烧鹅自动获得反弹SHELL", "url": "https://www.freebuf.com/articles/67931.html", "time": "2015-05-21", "level": "金币+5", "num_look": 888100, "num_comment": 49, "author": "BinAry", "tags": ["工具", "文章"], "text": "烧鹅是RadioWar基于Teensy++ 2.0 AT90USB1286芯片设计的USB Rubber Ducky类开发板，外观看起来很像USB Rubber Ducky（大黄鸭），但并非Hak5所销售版本。"}
{"title": "玩转Metasploit系列（第二集）", "url": "https://www.freebuf.com/sectool/67685.html", "time": "2015-05-21", "level": "金币+5", "num_look": 1241868, "num_comment": 34, "author": "ArthurKiller", "tags": ["头条", "工具"], "text": "在上一节的内容中，大家了解了Metasploit的结构，msfcli的简介,这一节我们主要介绍的是msfcli的理论。"}
{"title": "企业级CRM系统SuiteCRM文件上传漏洞报告（含EXP）", "url": "https://www.freebuf.com/news/67930.html", "time": "2015-05-20", "level": "", "num_look": 254909, "num_comment": 3, "author": "鸢尾", "tags": ["漏洞", "资讯"], "text": "SuiteCRM是一个价格合理并且容易使用的企业级CRM，数千家企业每天使用Sugar去管理销售，市场和客户支持。"}
{"title": "美方以经济间谍罪起诉6名中国公民，天津大学教授被捕", "url": "https://www.freebuf.com/news/67900.html", "time": "2015-05-20", "level": "", "num_look": 230570, "num_comment": 13, "author": "cindy", "tags": ["资讯"], "text": "天津大学教授张浩（Hao Zhang，音译）5月16日从中国飞往美国在洛杉矶机场入境时被捕。"}
{"title": "阿里安全：已捕捉到黑客组织“蜥蜴（Lizard Squad）”最新木马及攻击目标", "url": "https://www.freebuf.com/news/67864.html", "time": "2015-05-20", "level": "", "num_look": 506898, "num_comment": 38, "author": "阿里安全", "tags": ["头条", "网络安全"], "text": "阿里安全研究实验室在2015年5月19日捕捉到全球臭名昭著的“蜥蜴黑客组织（Lizard Squad）”最新的木马蠕虫。"}
{"title": "IPsec Tools拒绝服务0day漏洞详细报告（文后附0day）", "url": "https://www.freebuf.com/vuls/67779.html", "time": "2015-05-20", "level": "金币+5", "num_look": 385681, "num_comment": 5, "author": "鸢尾", "tags": ["漏洞", "网络安全"], "text": "你可能质疑该漏洞甚至未达到中等漏洞的评级，但请记住IPsec是至关重要的基础设施，并且这种攻击只需要两个小的UDP数据包。"}
{"title": "破解入门：如何编写一个Linux 64位软件注册机", "url": "https://www.freebuf.com/articles/system/67683.html", "time": "2015-05-20", "level": "", "num_look": 302513, "num_comment": 6, "author": "鸢尾", "tags": ["系统安全"], "text": "目前大部分有关于破解的资料都是基于X86架构的，而对于X64架构的破解资料却是比较少。"}
{"title": "一个局域网蠕虫详细分析", "url": "https://www.freebuf.com/articles/system/67768.html", "time": "2015-05-20", "level": "", "num_look": 487631, "num_comment": 12, "author": "腾讯电脑管家", "tags": ["系统安全", "网络安全"], "text": "近日，腾讯反病毒实验室从一些物理隔离，大区域超大局域网内发现一蠕虫样本，该蠕虫已在该网络中扩散，甚至渗透到该网络核心服务器上。"}
{"title": "漏洞告诉你：商家为什么都乐于提供免（diao）费（yu）WiFi？", "url": "https://www.freebuf.com/news/66533.html", "time": "2015-05-20", "level": "红色标题", "num_look": 461503, "num_comment": 15, "author": "漏洞盒子", "tags": ["其他", "漏洞"], "text": "号称“O2O时代营销神器”的网格商用WiFi营销系统，“用移动互联网的力量为线下商家带来更多顾客和创造更多收益、让合作商家自愿为顾客提供免费WiFi上网服务”。"}
{"title": "上这个网站，你也可以像黑客那样酷炫", "url": "https://www.freebuf.com/news/67793.html", "time": "2015-05-20", "level": "红色标题", "num_look": 1965136, "num_comment": 45, "author": "fu4k", "tags": ["其他", "资讯"], "text": "这是名副其实的“黑客速成班”——成为电影里才有的大黑客，你要做的，只是花费1秒钟时间登陆这个网站……"}
{"title": "1024妹：如何优雅的用Discuz! 7.2的SQL注入漏洞造福单身男", "url": "https://www.freebuf.com/articles/web/67817.html", "time": "2015-05-20", "level": "", "num_look": 695272, "num_comment": 28, "author": "刘开水", "tags": ["WEB安全", "其他"], "text": "1024妹让1024不将成为历史，用Discuz! 7.2的SQL注入漏洞与代码执行漏洞神器开启批量模式，造福单身男。"}
{"title": "玩转Metasploit系列（第一集）", "url": "https://www.freebuf.com/sectool/67674.html", "time": "2015-05-19", "level": "金币+4", "num_look": 2298063, "num_comment": 31, "author": "ArthurKiller", "tags": ["头条", "工具"], "text": "这篇文章翻译自Offensive-security社区。我希望通过我的翻译能够让国内的安全人员能够有进一步的升华。"}
{"title": "眼见不一定为实：苹果Safari浏览器曝URL欺诈漏洞", "url": "https://www.freebuf.com/news/67737.html", "time": "2015-05-19", "level": "", "num_look": 223310, "num_comment": 10, "author": "fber", "tags": ["漏洞", "资讯"], "text": "苹果Safari浏览器曝出一个可被攻击者用作钓鱼攻击的新漏洞——当用户以为打开某个网站时，其实在访问另一个网址。"}
{"title": "FreeBuf公开课：轻松的方式科普什么是SQL注入攻击（第二集）", "url": "https://www.freebuf.com/articles/web/67621.html", "time": "2015-05-19", "level": "红色标题", "num_look": 549319, "num_comment": 22, "author": "FB视频", "tags": ["WEB安全", "视频"], "text": "本期，怪蜀黍继续开讲：总结了SQL形成的原因、几种类型、寻找的方法以及工具。童鞋们都准备好么，现在开始上课！"}
{"title": "前程无忧招聘信息安全工程师", "url": "https://www.freebuf.com/jobs/67593.html", "time": "2015-05-19", "level": "", "num_look": 168508, "num_comment": 17, "author": "night85", "tags": ["安全招聘"], "text": "“前程无忧”是国内第一个集多种媒介资源优势的专业人力资源服务机构。"}
{"title": "会“自爆”的病毒：揭开Rombertik的神秘面纱", "url": "https://www.freebuf.com/vuls/67680.html", "time": "2015-05-19", "level": "", "num_look": 244163, "num_comment": 10, "author": "360安全", "tags": ["漏洞", "系统安全"], "text": "前不久，思科安全团队披露了一款代号为Rombertik的病毒，它的主要危害是窃取Chrome、Firefox和IE浏览器上输入的文本信息，并采用超级复杂的指令和垃圾代码对抗安全研究人员的分析。"}
{"title": "Fing：这款APP可以告诉你WiFi里都连着哪些设备", "url": "https://www.freebuf.com/sectool/67712.html", "time": "2015-05-19", "level": "", "num_look": 624784, "num_comment": 17, "author": "phper", "tags": ["工具"], "text": "想知道当前Wi-Fi里都连接什么设备？用这个工具就够了。"}
{"title": "英国政府修改法律让“有关部门”的黑客行为合法化", "url": "https://www.freebuf.com/news/67646.html", "time": "2015-05-19", "level": "", "num_look": 165654, "num_comment": 4, "author": "dawner", "tags": ["资讯"], "text": "英国政府近日悄然修改了计算机滥用法案（CMA），特别豁免了包括GCHQ（NSA监控项目的合作方）、警方以及其他电子情报机构的黑客行为。"}
{"title": "小技巧：Mac下Metasploit渗透Oracle环境的搭建", "url": "https://www.freebuf.com/sectool/67592.html", "time": "2015-05-19", "level": "金币+4", "num_look": 286151, "num_comment": 9, "author": "s1riu5", "tags": ["工具"], "text": "Metasploit虽然包含了攻击Oracle的模块，但是本身却没有Oracle环境，在用Metasploit攻击Oracle时报出错误。"}
{"title": "漏洞盒子4月“互联网漏洞之星”公布", "url": "https://www.freebuf.com/articles/others-articles/67456.html", "time": "2015-05-18", "level": "红色标题", "num_look": 350750, "num_comment": 6, "author": "vboxman", "tags": ["其他", "活动"], "text": "樱花落尽阶前月，象床愁倚薰笼。以下10个漏洞当月4月份“互联网漏洞之星”，并获得漏洞盒子特制礼品一份。"}
{"title": "百度招聘高级安全工程师（T4-T6，30-80w）", "url": "https://www.freebuf.com/jobs/67312.html", "time": "2015-05-18", "level": "", "num_look": 293733, "num_comment": 17, "author": "百度云安全", "tags": ["安全招聘"], "text": "百度（Nasdaq：BIDU）是全球最大的中文搜索引擎、最大的中文网站。2000年1月由李彦宏创立于北京中关村，致力于向人们提供“简单，可依赖”的信息获取方式。"}
{"title": "黑客通过舱内娱乐系统短暂控制飞机", "url": "https://www.freebuf.com/news/67599.html", "time": "2015-05-18", "level": "", "num_look": 259911, "num_comment": 8, "author": "明明知道", "tags": ["资讯"], "text": "安全研究人员克里斯罗伯茨Chris Roberts上月曾向美国联邦调查局（FBI）承认，他曾短暂入侵了一家飞机的电子监控系统而控制飞机，导致飞机做出了侧向飞行的动作。"}
{"title": "儿童安全应用mSpy大规模数据泄露，大量儿童信息被黑客曝光", "url": "https://www.freebuf.com/news/67561.html", "time": "2015-05-18", "level": "", "num_look": 226058, "num_comment": 16, "author": "Sphinx", "tags": ["资讯"], "text": "mSpy是市面上最流行的儿童安全应用，家长可以通过mSpy对小孩的移动设备进行追踪。然而最近大量mSpy用户数据出现在“暗网”上，这直接导致数以千计的儿童数据陷入危险境地。"}
{"title": "烧鹅：中国人自己的HID Hacking Device", "url": "https://www.freebuf.com/sectool/67563.html", "time": "2015-05-18", "level": "金币+4", "num_look": 894019, "num_comment": 38, "author": "BinAry", "tags": ["工具", "极客"], "text": "美国有USB Rubber Ducky（橡皮鸭），中国有“烧鹅”，我们自己的HID Hacking Device！"}
{"title": "研究人员公布GAE（谷歌应用引擎）沙箱逃逸及远程代码执行漏洞POC", "url": "https://www.freebuf.com/news/67537.html", "time": "2015-05-18", "level": "", "num_look": 211086, "num_comment": 4, "author": "dawner", "tags": ["漏洞", "资讯"], "text": "去年12月，安全研究人员在谷歌应用引擎（Google App Engine）的Java环境中发现了大量高危漏洞，攻击者可以利用这些漏洞绕过谷歌安全沙盒的保护。而近日研究人员公布了这些漏洞的技术细节和POC。"}
{"title": "100美元打造开锁机器人（视频）", "url": "https://www.freebuf.com/geek/67532.html", "time": "2015-05-18", "level": "", "num_look": 320562, "num_comment": 9, "author": "dawner", "tags": ["极客", "视频"], "text": "使用正确的工具手段来破解组合转盘密码锁是非常容易的，基于这一理论，Kamkar打算自己制作开锁机器人（Combo Breaker）尝试一下。"}
{"title": "FBI：美国宾夕法尼亚州立大学网络中潜伏着来自中国的恶意软件", "url": "https://www.freebuf.com/news/67513.html", "time": "2015-05-18", "level": "金币+3", "num_look": 182602, "num_comment": 18, "author": "江湖小吓", "tags": ["资讯"], "text": "FBI发现，美国宾夕法尼亚州立大学工科学院的网络里存在两个潜伏的恶意软件（如病毒、木马、后门程序）。"}
{"title": "隐藏于Nvidia显卡（GPU）中的木马：可同时感染Mac、Linux及Windows系统", "url": "https://www.freebuf.com/news/67484.html", "time": "2015-05-17", "level": "金币+3", "num_look": 400017, "num_comment": 24, "author": "JackFree", "tags": ["资讯"], "text": "近日，一名匿名开发者发布了一款更为强大的GPU恶意程序，能够同时感染Mac、Linux和Windows三种系统。"}
{"title": "安全事故启示录：回看美国零售巨头塔吉特（Target）大规模数据泄露事件", "url": "https://www.freebuf.com/news/67464.html", "time": "2015-05-16", "level": "", "num_look": 458027, "num_comment": 8, "author": "明明知道", "tags": ["其他", "安全管理"], "text": "如果在起飞时控制不好发动机的动力，就很可能会造成惨烈的坠机。当我们迈向了互联网+的风口，同样也要面对一个不可回避的问题：安全事故。"}
{"title": "FireEye：中国黑客组织APT17利用微软TechNet技术社区作为“攻击中转站”", "url": "https://www.freebuf.com/news/67478.html", "time": "2015-05-15", "level": "金币+3", "num_look": 362886, "num_comment": 16, "author": "dawner", "tags": ["资讯"], "text": "俗话说“最危险的地方就是最安全的地方”，根据美国安全公司FireEye的最新安全报告，中国黑客组织APT17利用微软TechNet技术社区作为“攻击中转站”。"}
{"title": "无奈：喝了杯咖啡，信用卡的钱就被黑客转走了", "url": "https://www.freebuf.com/news/67442.html", "time": "2015-05-15", "level": "", "num_look": 309688, "num_comment": 20, "author": "明明知道", "tags": ["资讯"], "text": "黑客现在能够从使用信用卡支付的星巴克顾客那里盗取信用卡，有近1600万使用星巴克App的用户成为暴露在阳光下的待宰羔羊。"}
{"title": "VENOM \"毒液\"漏洞分析（qemu kvm CVE‐2015‐3456）", "url": "https://www.freebuf.com/articles/67428.html", "time": "2015-05-15", "level": "", "num_look": 337443, "num_comment": 12, "author": "360安全", "tags": ["文章", "漏洞"], "text": "Jason Geffner发现开源计算机仿真器QEMU中存在一个和虚拟软盘控制器相关的安全漏洞，代号VENOM，CVE编号为CVE-2015-3456。利用此漏洞攻击者可以在有问题的虚拟机中进行逃逸,并且可以在宿主机中获得代码执行的权限。"}
{"title": "奇虎360招聘：战略分析经理（安全领域）", "url": "https://www.freebuf.com/jobs/67422.html", "time": "2015-05-15", "level": "", "num_look": 164878, "num_comment": 9, "author": "xueyingyu", "tags": ["安全招聘"], "text": "奇虎360科技有限公司（美国纽约证券交易所NYSE:QIHU）创立于2005年9月，是中国领先的互联网和手机安全产品及服务供应商。"}
{"title": "恶意软件分析基础（Part2）", "url": "https://www.freebuf.com/articles/system/67268.html", "time": "2015-05-15", "level": "", "num_look": 208286, "num_comment": 4, "author": "鸢尾", "tags": ["系统安全"], "text": "在前面《恶意软件分析基础（Part1）》​我们已经介绍了恶意软件静态分析基础知识，这篇文章是关于恶意软件动态分析的技术讲解。"}
{"title": "美电信巨头Verizon曝有重大安全漏洞，泄露客户所有信息", "url": "https://www.freebuf.com/news/67398.html", "time": "2015-05-15", "level": "", "num_look": 176895, "num_comment": 11, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "美国最大的无线通信提供商Verizon存一个重大安全漏洞，利用该漏洞攻击者只需一个浏览器插件及拨打几个电话便可以获得Verizon客户的所有个人信息，同时能够控制客户的Verizon账户。"}
{"title": "抵制中国制造：美国海军将弃用联想服务器", "url": "https://www.freebuf.com/news/67379.html", "time": "2015-05-15", "level": "金币+3", "num_look": 157197, "num_comment": 15, "author": "fber", "tags": ["资讯"], "text": "美国海军正在为它的导弹巡洋舰和驱逐舰寻找新的服务器供应商。虽然之前一直都是使用IBM的服务器，但由于联想于去年收购了IBM x86服务器业务，美国海军出于安全考虑决定另求供应商。"}
{"title": "英国情报机构：黑客们，快到碗里来", "url": "https://www.freebuf.com/news/67353.html", "time": "2015-05-15", "level": "金币+3", "num_look": 136464, "num_comment": 11, "author": "shaxianwei", "tags": ["资讯"], "text": "英国政府通信总部（GCHQ）需要招揽更多黑客。神秘的老牌情报机构如今采用了发布招聘广告及召开新闻发布会的高调方式寻找理想的IT安全人员。这是GCHQ首次公开招募所谓的“计算机网络操作专家”。"}
{"title": "滴滴打车诚招安全工程师、安全开发工程师", "url": "https://www.freebuf.com/jobs/67307.html", "time": "2015-05-14", "level": "", "num_look": 221050, "num_comment": 221050, "author": "IIIIsh", "tags": ["安全招聘"], "text": "我们是国内移动出行行业的领导者。这太官方了，说点实在话吧：我们和其他互联网公司一样，福利很多，还有很（zi）多（ji）美（zheng）女（qu），工作时间非（ou）常（er）弹（jia）性（ban）。"}
{"title": "废弃防火墙：Google决定不再区分内外网", "url": "https://www.freebuf.com/news/67346.html", "time": "2015-05-14", "level": "红色标题", "num_look": 657232, "num_comment": 55, "author": "cindy", "tags": ["企业安全", "资讯"], "text": "Google在自身企业安全实践方面迈出了大胆的一步——不再将自身的企业应用置于防火墙等安全设备的保护之下，不再有内外网之分。"}
{"title": "漏洞预警：“毒液（VENOM）”漏洞影响全球数百万虚拟机安全（附POC）", "url": "https://www.freebuf.com/news/67325.html", "time": "2015-05-14", "level": "金币+3", "num_look": 855762, "num_comment": 14, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "CrowdStrike公司安全研究员称，一个名为“毒液（VENOM）”的QEMU漏洞使数以百万计的虚拟机处于网络攻击风险之中，该漏洞可以造成虚机逃逸，威胁到全球各大云服务提供商的数据安全。"}
{"title": "Flash Player、Reader和Acrobat发布大量安全更新", "url": "https://www.freebuf.com/news/67292.html", "time": "2015-05-14", "level": "", "num_look": 176117, "num_comment": 11, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "Adobe公司近日发布了一次重大更新，修复了Windows、Mac OS X和Linux平台上的Flash Player、Reader和Acrobat产品中的共52个漏洞。"}
{"title": "恶意软件分析基础（Part1）", "url": "https://www.freebuf.com/articles/system/67142.html", "time": "2015-05-14", "level": "金币+5", "num_look": 257761, "num_comment": 9, "author": "鸢尾", "tags": ["系统安全"], "text": "从这里开始，我会将近期对于恶意软件分析的一些研究结果分享给大家。我们会从零基础逐渐提高到一个新的高度，在Part1中我们会讨论静态分析恶意软件。"}
{"title": "霸道安装：伪装FlashPlayer应用木马分析报告", "url": "https://www.freebuf.com/articles/terminal/67143.html", "time": "2015-05-14", "level": "", "num_look": 243926, "num_comment": 7, "author": "Jason_HZ", "tags": ["安全报告", "终端安全"], "text": "阿里移动聚安全技术团队截获了一款用户无法取消、终止或者卸载的木马，包括使用未更新的安全软件也不能有效帮助用户阻止该木马的霸道安装。"}
{"title": "ISIS频繁发动的网络攻击及“拉仇恨”宣传让美国苦不堪言", "url": "https://www.freebuf.com/news/67225.html", "time": "2015-05-14", "level": "", "num_look": 142767, "num_comment": 5, "author": "cindy", "tags": ["资讯"], "text": "恐怖组织ISIS利用网络和社交媒体强化“圣战”意识并散播恐怖信息，最近又频繁放出攻击恐吓和威胁，这使得美国政府异常紧张。"}
{"title": "由家用路由器构成的可“自我复制”僵尸网络", "url": "https://www.freebuf.com/news/67235.html", "time": "2015-05-14", "level": "", "num_look": 183031, "num_comment": 11, "author": "fber", "tags": ["资讯"], "text": "​大量家庭和小型办公室的路由器正处于黑客的控制之下，黑客们不仅利用这些路由器组成僵尸网络进行DDoS攻击，还通过运行特殊的shell脚本使它们“自我复制”。"}
{"title": "【FreeBuf视频】《安全大咖说》专访赵伟：从屌丝到估值20亿安全公司CEO", "url": "https://www.freebuf.com/news/topnews/67203.html", "time": "2015-05-13", "level": "红色标题", "num_look": 407555, "num_comment": 17, "author": "明明知道", "tags": ["人物志", "头条"], "text": "回忆创业初期，北京的八级大风虽然冻得这位创始人眼泪鼻涕齐流，但也没能吹熄赵伟内心的小宇宙，依旧立志网络安全做到最好，要做到国际一流。"}
{"title": "高效的DDoS攻击探测与分析工具 - FastNetMon", "url": "https://www.freebuf.com/news/67204.html", "time": "2015-05-13", "level": "", "num_look": 418584, "num_comment": 10, "author": "phper", "tags": ["资讯"], "text": "FastNetMon这是一个基于多种抓包引擎的DoS/DDoS攻击高效分析工具，可以探测和分析网络中的异常流量情况，同时可以通过外部脚本通知或阻断攻击。"}
{"title": "香港中银、东亚银行遭遇DDoS攻击，攻击者勒索比特币", "url": "https://www.freebuf.com/news/67162.html", "time": "2015-05-13", "level": "", "num_look": 157601, "num_comment": 5, "author": "fber", "tags": ["资讯"], "text": "上周六香港两大银行中银及东亚银行的网站遭到DDoS攻击，被黑客勒索比特币，并扬言称，若不交赎金会进一步瘫痪网站。香港警方已将案件列作勒索案，初步调查发现攻击来自多个国家。"}
{"title": "英国警方发现新奇ATM盗卡装备：针孔摄像机+iPod+读卡器", "url": "https://www.freebuf.com/news/67140.html", "time": "2015-05-13", "level": "金币+5", "num_look": 151918, "num_comment": 8, "author": "dawner", "tags": ["资讯"], "text": "英国警方近日发布了一本图集，里面展示了黑客如何利用针孔照像机和iPod在ATM机上盗取信用卡信息。"}
{"title": "斯诺登：强烈谴责澳大利亚政府强制运营商存储公民通讯数据", "url": "https://www.freebuf.com/news/67036.html", "time": "2015-05-13", "level": "", "num_look": 149782, "num_comment": 8, "author": "cindy", "tags": ["资讯"], "text": "斯诺登近日在墨尔本举行的安全会议上，强烈抨击澳大利亚的《强制保留通讯数据法案》，并声称其未来将会披露的NSA文件中会揭露澳大利亚的监视活动。"}
{"title": "FreeBuf公开课：轻松的方式科普什么是SQL注入攻击（第一集）", "url": "https://www.freebuf.com/articles/web/67089.html", "time": "2015-05-13", "level": "红色标题", "num_look": 573765, "num_comment": 12, "author": "FB视频", "tags": ["WEB安全", "视频"], "text": "FreeBuf作者怪蜀黍继《轻松的方式科普什么是DDoS（分布式拒绝攻击）》之后为童鞋们奉上最新力作：如何轻松驾驭自己的女神？"}
{"title": "新型DDoS攻击LFA：从5月11号网易被攻击谈起", "url": "https://www.freebuf.com/articles/network/67107.html", "time": "2015-05-12", "level": "现金奖励", "num_look": 1063795, "num_comment": 58, "author": "purehat", "tags": ["网络安全"], "text": "5月11日晚上9时许，网易的大量用户发现访问网易新闻出现问题，相应的，有很多游戏用户报告说游戏掉线严重。一时间，有关“网易大楼着火”的谣传甚嚣。"}
{"title": "安全情报共享平台：面对数据泄露，医疗行业决定团结起来", "url": "https://www.freebuf.com/news/67051.html", "time": "2015-05-12", "level": "", "num_look": 211066, "num_comment": 4, "author": "明明知道", "tags": ["其他", "观点"], "text": "国家网络信息分享与分析研究中心（ISAC）当然无法终结网络战争，但是他们必将有助于提升他们的防御能力，而医疗保健行业比其他地方都更需要安全保障。"}
{"title": "PHP Hash比较存在缺陷，影响大量Web网站登录认证、忘记密码等关键业务", "url": "https://www.freebuf.com/news/67007.html", "time": "2015-05-12", "level": "金币+5", "num_look": 690558, "num_comment": 17, "author": "0XFFFF", "tags": ["WEB安全", "漏洞"], "text": "最近一个被称为“Magic Hash”的PHP漏洞可以使得攻击者非法获取用户的账号信息。"}
{"title": "“国产”广告注射器分析：以比价名义强插各大网站", "url": "https://www.freebuf.com/articles/web/66989.html", "time": "2015-05-12", "level": "", "num_look": 262331, "num_comment": 13, "author": "360安全", "tags": ["WEB安全"], "text": "近日谷歌发布的广告注射器报告显示，有5.5%的独立IP地址（大约数百万用户）访问了已经注射广告的谷歌页面，其中超过30%的广告注射器具备偷窃帐号隐私、劫持搜索结果或者引诱用户跳转到第三方网站的功能。"}
{"title": "First Blood：苹果手表Apple Watch首次被黑（视频）", "url": "https://www.freebuf.com/news/67024.html", "time": "2015-05-12", "level": "金币+5", "num_look": 156966, "num_comment": 10, "author": "dawner", "tags": ["视频", "资讯"], "text": "Prominent社区的开发和越狱研究人员Comex在网上发布了一个视频，向人们展示如何黑掉Apple Watch。"}
{"title": "如何黑掉Z-Way控制下的智能家居", "url": "https://www.freebuf.com/news/67017.html", "time": "2015-05-12", "level": "", "num_look": 228284, "num_comment": 2, "author": "dawner", "tags": ["极客", "漏洞"], "text": "Z-Wave是一种新兴的智能家居技术，在欧美已经非常成熟。最近我购置了一块RaZberry板子，开始了我的家具智能化研究之旅。"}
{"title": "如何让旧手机或平板电脑变身“安全眼”？", "url": "https://www.freebuf.com/articles/others-articles/66969.html", "time": "2015-05-12", "level": "", "num_look": 242696, "num_comment": 7, "author": "明明知道", "tags": ["其他", "极客"], "text": "想要时刻关注家中安全却没有足够的钱或者DIY技能去安装一个摄像头，怎么办？"}
{"title": "使用HTTP Headers防御WEB攻击（Part2）", "url": "https://www.freebuf.com/articles/web/66932.html", "time": "2015-05-11", "level": "", "num_look": 292893, "num_comment": 6, "author": "鸢尾", "tags": ["WEB安全"], "text": "本文中我们将会讨论另外一个HTTP Header选项，X-XSS-Protection。和前一篇文章类似，我们会先看看漏洞网页然后再使用这个HTTP头选项来防御。"}
{"title": "使用Chrome插件抓取Facebook用户的好友关系", "url": "https://www.freebuf.com/news/66899.html", "time": "2015-05-11", "level": "", "num_look": 245401, "num_comment": 3, "author": "Sphinx", "tags": ["资讯"], "text": "黑客们的军火库中又添置了一样新武器，这款名为Facebook Friends Mapper的工具能够让他们一键抓取Facebook隐藏好友列表。"}
{"title": "针对网页木马（CVE-2011-1260）的分析与实践", "url": "https://www.freebuf.com/vuls/66865.html", "time": "2015-05-11", "level": "金币+7", "num_look": 422411, "num_comment": 15, "author": "血池摇摆", "tags": ["漏洞"], "text": "我相信很多人了解过pwn2own大赛，心中肯定很膜拜大神，很想深入去了解这到底是什么。但是一看具体的漏洞分析根本看不懂，想必很多人都想找一篇从零基础教学的漏洞分析文章，本文就从零基础去教学。"}
{"title": "为什么我们要使用HTTP Strict Transport Security？", "url": "https://www.freebuf.com/articles/web/66827.html", "time": "2015-05-11", "level": "", "num_look": 1227990, "num_comment": 6, "author": "wenjian_tk0", "tags": ["WEB安全", "网络安全"], "text": "HTTP Strict Transport Security (通常简称为HSTS) 是一个安全功能，它告诉浏览器只能通过HTTPS访问当前资源, 禁止HTTP方式。"}
{"title": "全球95%的SAP企业管理系统存在安全漏洞，可能导致严重的数据泄露", "url": "https://www.freebuf.com/news/66893.html", "time": "2015-05-11", "level": "", "num_look": 228799, "num_comment": 5, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "全世界超过25万企业因SAP系统中存在的一系列安全漏洞而受到影响，可能导致严重的企业数据泄露。"}
{"title": "FreeBuf全球安全事件纵览（2015年4月）：暗流涌动", "url": "https://www.freebuf.com/news/66684.html", "time": "2015-05-11", "level": "红色标题", "num_look": 312756, "num_comment": 7, "author": "cindy", "tags": ["其他", "头条"], "text": "习惯了每天的日出日落、云卷云舒，我们常会忘记一个事实：没有人是真正安全的。"}
{"title": "基于大数据的恐怖分子识别系统：揭秘美国国安局（NSA）“天网计划”", "url": "https://www.freebuf.com/news/66882.html", "time": "2015-05-11", "level": "", "num_look": 229026, "num_comment": 8, "author": "codename2015", "tags": ["其他", "头条"], "text": "美国国安局（NSA）一项名为“天网（SkyNet）”的计划可以基于个人所处位置、拨打电话的地点、时间及去往相关地方的频率分析和寻找恐怖主义分子。"}
{"title": "人工智能的未来：用忆阻器制造神经网络芯片", "url": "https://www.freebuf.com/news/66755.html", "time": "2015-05-11", "level": "", "num_look": 411911, "num_comment": 7, "author": "明明知道", "tags": ["其他", "极客"], "text": "而来自奥地利Graz科技大学的Robert Legenstein认为，如果这个设计可以扩大至大型网络的大小，那么它将颠覆电脑运算的未来。"}
{"title": "Mac下的360“MacKeeper”曝任意代码执行漏洞（附POC）", "url": "https://www.freebuf.com/news/66869.html", "time": "2015-05-10", "level": "金币+7", "num_look": 217847, "num_comment": 10, "author": "Conermx", "tags": ["漏洞", "资讯"], "text": "5月7日，Mackeeper被发现存在严重的安全漏洞，在其处理URL的代码中存在远程代码执行漏洞，当用户访问被恶意构造的网页即可触发漏洞。"}
{"title": "运行于显卡（GPU）的Rootkit木马和键盘记录器问世", "url": "https://www.freebuf.com/news/66803.html", "time": "2015-05-09", "level": "", "num_look": 264382, "num_comment": 10, "author": "JackFree", "tags": ["资讯"], "text": "如今木马后门已完全可以运行在电脑的显卡中，这种独特的运行方式增强了它们的隐匿性，同时还大大提高了恶意行为的执行性能。"}
{"title": "老牌Hash破解网站XMD5宣布免费", "url": "https://www.freebuf.com/news/66815.html", "time": "2015-05-09", "level": "", "num_look": 664178, "num_comment": 81, "author": "iceyes", "tags": ["观点", "资讯"], "text": "五一之前我就在微信圈里面喊过要把XMD5查询免费了。终于在昨天我把大部分的代码调完，正式免费查询了。"}
{"title": "揭秘：美国国安局（NSA）的语音识别技术", "url": "https://www.freebuf.com/news/66747.html", "time": "2015-05-08", "level": "", "num_look": 148337, "num_comment": 8, "author": "cindy", "tags": ["资讯"], "text": "斯诺登泄密各种美国国安局（NSA）的“黑科技”之后，米国人民似乎意识到了无论什么样的通信方式都逃不过来自政府的监控，NSA甚至早在40年前就可以识别语音了。"}
{"title": "小心“医疗黑客”：医院药物输液泵存任意命令执行漏洞，可危及病人生命", "url": "https://www.freebuf.com/news/66679.html", "time": "2015-05-08", "level": "", "num_look": 219338, "num_comment": 12, "author": "明明知道", "tags": ["漏洞", "资讯"], "text": "输液泵是一种能够准确控制输液滴数或输液流速，保证药物能够速度均匀，药量准确并且安全地进入病人体内发挥作用的一种仪器。"}
{"title": "走近科学：盗刷信用卡如此简单，没人管管？", "url": "https://www.freebuf.com/news/topnews/66639.html", "time": "2015-05-08", "level": "现金奖励", "num_look": 1597767, "num_comment": 64, "author": "xxfocus", "tags": ["其他", "头条"], "text": "虽然银行提醒的保护好个人信用卡，个人就真的能保护好吗？"}
{"title": "Unix/Linux系统安全检查工具Lynis 2.1.0发布", "url": "https://www.freebuf.com/sectool/66635.html", "time": "2015-05-08", "level": "", "num_look": 234831, "num_comment": 5, "author": "thanks", "tags": ["工具"], "text": "Lynis是针对Unix/Linux的开源安全检查工具，可以发现潜在的系统安全威胁。"}
{"title": "超级加农炮（Great Cannon）缺陷探究之TTL篇", "url": "https://www.freebuf.com/news/topnews/66665.html", "time": "2015-05-08", "level": "现金奖励", "num_look": 355009, "num_comment": 6, "author": "ArkTeam", "tags": ["头条", "网络安全"], "text": "超级加农大炮真的有传说中的那么厉害吗？本文我们就来抛砖引玉，说说加农大炮的一点缺陷。"}
{"title": "WordPress默认主题存在DOM XSS（跨站脚本）漏洞，影响百万用户", "url": "https://www.freebuf.com/news/66695.html", "time": "2015-05-07", "level": "", "num_look": 223907, "num_comment": 1, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "使用了Genericons包的WordPress插件或主题都可能受一个基于DOM的XSS漏洞影响，因为WordPress默认主题Twenty Fifteen及知名插件Jetpack都包含了存在漏洞的页面example.html。"}
{"title": "联想ThinkPad系列电脑被曝多个安全漏洞", "url": "https://www.freebuf.com/news/66644.html", "time": "2015-05-07", "level": "", "num_look": 587813, "num_comment": 7, "author": "fber", "tags": ["资讯"], "text": "近日，安全公司IOActive在联想系列计算机上发现安全漏洞，攻击者可将电脑上的合法应用程序替换为恶意的应用程序，并可远程执行恶意指令。"}
{"title": "渗透测试神器Burp Suite v1.6.17（含破解版下载）", "url": "https://www.freebuf.com/sectool/66521.html", "time": "2015-05-07", "level": "红色标题", "num_look": 4469490, "num_comment": 39, "author": "收白菜", "tags": ["工具"], "text": "众所周知，Burp Suite是响当当的web应用程序渗透测试集成平台。"}
{"title": "免费的MySQL数据库防火墙 - SQLassie", "url": "https://www.freebuf.com/sectool/66630.html", "time": "2015-05-07", "level": "", "num_look": 254531, "num_comment": 8, "author": "phper", "tags": ["工具"], "text": "SQLassie是一款免费的MySQL数据库防火墙，可以实时阻断SQL注入攻击。SQLassie采用了Bayesian算法发现异常的SQL请求，相当的高效。"}
{"title": "谷歌惊现军用无人机攻击教程", "url": "https://www.freebuf.com/news/66597.html", "time": "2015-05-07", "level": "", "num_look": 181095, "num_comment": 6, "author": "JackFree", "tags": ["资讯"], "text": "近日，谷歌上出现军用无人机的攻击教程，这可能会导致很严重的安全问题和负面影响，例如一架无人机可能会干扰一架飞机，或者向无人机上添加武器，这些举动都可能会带来严重的后果。"}
{"title": "不交赎金就把你上黄网的事儿公之于众：安卓手机上的勒索软件Koler", "url": "https://www.freebuf.com/news/66611.html", "time": "2015-05-07", "level": "红色标题", "num_look": 483348, "num_comment": 35, "author": "JackFree", "tags": ["资讯"], "text": "这是加拿大新出现的一款手机勒索软件，当手机用户访问成人网站时就会感染该恶意软件并遭到勒索。"}
{"title": "上海安洵招聘安全服务工程师", "url": "https://www.freebuf.com/jobs/59764.html", "time": "2015-05-07", "level": "", "num_look": 194618, "num_comment": 35, "author": "冷漠", "tags": ["安全招聘"], "text": "上海安洵信息技术有限公司是行业领先的安全咨询、支持与维护等IT运营服务解决方案提供商。"}
{"title": "“自爆”病毒Rombertik：多级混淆、高度复杂，遭遇分析自动擦除硬盘", "url": "https://www.freebuf.com/news/66545.html", "time": "2015-05-07", "level": "金币+5", "num_look": 224284, "num_comment": 10, "author": "JackFree", "tags": ["系统安全", "资讯"], "text": "Rombertik是一款高度复杂的病毒（恶意软件），它使用了多级混淆、高度复杂的逃避检测技术和反分析技术，并且该恶意软件能够通过擦除硬盘数据防止被他人分析。"}
{"title": "第二届北京网络安全技术大赛夺旗赛Writeup（Web安全篇）", "url": "https://www.freebuf.com/articles/web/66565.html", "time": "2015-05-07", "level": "", "num_look": 653901, "num_comment": 7, "author": "安恒信息", "tags": ["WEB安全", "其他"], "text": "作为“4.29首都网络安全日”的重要活动之一，第二届北京网络安全技术大赛于4月29日成功举办。"}
{"title": "防范社会工程学攻击的简单技巧与姿势", "url": "https://www.freebuf.com/articles/network/66566.html", "time": "2015-05-06", "level": "", "num_look": 718401, "num_comment": 14, "author": "明明知道", "tags": ["网络安全"], "text": "防范社会工程学攻击就必须要知道在网上何时该相信何人。在你提供个人信息前请谨慎地分析每一个情况。在网络上不要过于贪婪了，当一笔交易实在是太“划算”的时候，请三思而后行！"}
{"title": "趣分期招聘高级安全工程师", "url": "https://www.freebuf.com/jobs/66532.html", "time": "2015-05-06", "level": "", "num_look": 171341, "num_comment": 13, "author": "禅大师", "tags": ["安全招聘"], "text": "趣分期成立于2014年4月，是国内领先的面向大学生提供分期消费的金融服务平台，覆盖了全国近3000万大学生用户。"}
{"title": "国产杀毒软件连续因“作弊”遭全球权威评测机构指责", "url": "https://www.freebuf.com/news/66543.html", "time": "2015-05-06", "level": "", "num_look": 190378, "num_comment": 12, "author": "不是养蚕人", "tags": ["资讯"], "text": "本周二AV-Test在内的全球三大权威杀毒软件评测机构宣布撤销2015年授予腾讯电脑管家的所有认证和奖项。这是继360杀毒被撤销AV-Test曾颁发的奖项后，国内杀软再次被测评机构公开指责。"}
{"title": "知道创宇CEO赵伟：七个黑客等级【FreeTalk北京站视频】", "url": "https://www.freebuf.com/news/topnews/66472.html", "time": "2015-05-06", "level": "红色标题", "num_look": 840922, "num_comment": 31, "author": "明明知道", "tags": ["头条", "活动"], "text": "在#FreeTalk北京站#的酒吧演讲中，赵伟就真正的黑客精神、要做世界一流的安全、如何留住黑客、安全技术之道、七个黑客等级一系列问题侃侃而谈。"}
{"title": "浅谈基于JavaScript的DDOS攻击", "url": "https://www.freebuf.com/news/66447.html", "time": "2015-05-06", "level": "", "num_look": 345947, "num_comment": 9, "author": "cindy", "tags": ["WEB安全", "资讯"], "text": "CloudFlare通过对上百万个网站的防护，总结出最古老、最普遍的攻击非DDoS攻击莫属。在传统的DDoS攻击中，攻击者会控制大量的傀儡机，然后向目标服务器发送大量请求，阻止合法用户访问网站。"}
{"title": "小漏洞大危害：点击劫持你的谷歌账户", "url": "https://www.freebuf.com/news/66473.html", "time": "2015-05-06", "level": "金币+5", "num_look": 258235, "num_comment": 4, "author": "fber", "tags": ["漏洞", "资讯"], "text": "谷歌近日修复了一个点击劫持漏洞，攻击者可利用该漏洞恢复或者删除email对话、删除YouTube播放列表、掌控谷歌+账户等等。"}
{"title": "USBKill：黑客防查水表、摧毁罪证的新“武器”", "url": "https://www.freebuf.com/sectool/66498.html", "time": "2015-05-06", "level": "金币+5", "num_look": 367719, "num_comment": 24, "author": "JackFree", "tags": ["工具"], "text": "如今，黑客的军械库中又多了一件新武器——USBKill，他们可以使用该工具将电脑中的信息在“查水表”前彻底摧毁。"}
{"title": "蘑菇街诚招安全研究员", "url": "https://www.freebuf.com/jobs/66182.html", "time": "2015-05-05", "level": "红色标题", "num_look": 461333, "num_comment": 38, "author": "conqu3r", "tags": ["安全招聘"], "text": "蘑菇街是专注于时尚女性消费者的电子商务网站，为爱美的姑娘们提供衣服、鞋子、箱包、配饰和美妆等领域适合年轻女性的商品，蘑菇街APP也成为时尚女性购买和互相分享的必备APP。"}
{"title": "如何大幅提高加密数据库的安全性", "url": "https://www.freebuf.com/articles/database/66440.html", "time": "2015-05-05", "level": "", "num_look": 288672, "num_comment": 5, "author": "明明知道", "tags": ["数据安全"], "text": "你将数据库密钥放在哪里呢？有没有适应硬件安全模块（HSM）？大多数企业都没有使用HSM，其实为了安全他们应该都要使用的。存储明文密码就相当于将钥匙放在门垫上，完全没有安全意识。"}
{"title": "波音787客机可能因安全漏洞在飞行中失控", "url": "https://www.freebuf.com/news/66437.html", "time": "2015-05-05", "level": "", "num_look": 254655, "num_comment": 17, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "美国联邦航空管理局FAA发出警报，波音787梦想客机系统中存在一个安全漏洞，该漏洞可导致飞行过程中突然关闭波音787所有电力供应，最终将导致飞机失控。"}
{"title": "匿名者（Anonymous）攻击世界贸易组织（WTO）网站，内部人员信息泄露", "url": "https://www.freebuf.com/news/66401.html", "time": "2015-05-05", "level": "金币+5", "num_look": 292150, "num_comment": 12, "author": "江湖小吓", "tags": ["WEB安全", "资讯"], "text": "黑客组织匿名者近日入侵了世界贸易组织（WTO）的网站并泄露了大量成员的个人信息。"}
{"title": "时隔六年，维基机密的匿名解密提交系统再次上线", "url": "https://www.freebuf.com/news/66406.html", "time": "2015-05-05", "level": "", "num_look": 135434, "num_comment": 7, "author": "codename2015", "tags": ["资讯"], "text": "现在，我们又可以时不时地期待得到机密新闻以及政府/企业机密文档资料了，因为反机密组织维基解密（WikiLeaks）重新发布了匿名提交敏感信息的功能。维基解密再次向公众开放了系统。"}
{"title": "Trustwave发现首个政治性恶意广告活动", "url": "https://www.freebuf.com/articles/66410.html", "time": "2015-05-05", "level": "", "num_look": 113142, "num_comment": 1, "author": "codename2015", "tags": ["文章"], "text": "安全研究人员认为，此次攻击背后的政治动机让这次安全事件非常有趣。"}
{"title": "数千Linux和FreeBSD服务器感染Mumblehard恶意软件", "url": "https://www.freebuf.com/news/66369.html", "time": "2015-05-04", "level": "", "num_look": 153541, "num_comment": 9, "author": "JackFree", "tags": ["资讯"], "text": "近期ESET专家发现一种新型的恶意软件Mumblehard，该恶意软件至少隐秘存在了五年，感染了数千的Linux和FreeBSD服务器，并利用这些服务器投送垃圾邮件。"}
{"title": "网络钓鱼攻击：Paypal用户很不幸的又中枪", "url": "https://www.freebuf.com/news/66349.html", "time": "2015-05-04", "level": "", "num_look": 315443, "num_comment": 315443, "author": "明明知道", "tags": ["网络安全", "资讯"], "text": "近期有不少网购用户收到一封来自Paypal的电子邮件，里面包含了购买商品的订单详情，并附着一个友情提示链接，其实它就是一钓鱼链接。"}
{"title": "2015网络安全市场报告（下）", "url": "https://www.freebuf.com/news/topnews/66278.html", "time": "2015-05-04", "level": "金币+5", "num_look": 401313, "num_comment": 7, "author": "codename2015", "tags": ["其他", "头条"], "text": "《网络安全市场报告》是美国网络安全公司Cybersecurity Ventures发布的季度报告。由于原文篇幅相当长，FreeBuf将此报告分为多部与各位分享。"}
{"title": "软件逆向之陌路寻踪：突破未注册版软件的限制功能", "url": "https://www.freebuf.com/articles/security-management/66246.html", "time": "2015-05-04", "level": "金币+5", "num_look": 392525, "num_comment": 20, "author": "Drops@ZUT", "tags": ["安全管理"], "text": "试图对一个“太监版”的程序进行完整化，也就是把限制的功能恢复，把阉割的功能添加等等。"}
{"title": "2015全球网络安全市场报告（上）", "url": "https://www.freebuf.com/news/topnews/66263.html", "time": "2015-05-04", "level": "金币+5", "num_look": 250910, "num_comment": 2, "author": "codename2015", "tags": ["其他", "头条"], "text": "《网络安全市场报告》是美国网络安全公司Cybersecurity Ventures发布的季度报告。"}
{"title": "黑客在身体中植入NFC芯片，绕过军事安检实施入侵", "url": "https://www.freebuf.com/news/66167.html", "time": "2015-05-04", "level": "金币+5", "num_look": 428177, "num_comment": 40, "author": "JackFree", "tags": ["资讯"], "text": "这个新闻并非天方夜谭。"}
{"title": "2015年，基于宏的恶意软件数量再次飙升", "url": "https://www.freebuf.com/news/66250.html", "time": "2015-05-03", "level": "", "num_look": 273344, "num_comment": 7, "author": "JackFree", "tags": ["资讯"], "text": "宏病毒在多年前曾经非常流行，之后便销声匿迹。如今这种“古老”的攻击方式结合钓鱼邮件、社会工程学进行传播，大有卷土重来之势。"}
{"title": "黑客电影《我是谁：没有绝对安全的系统》正片（含下载）", "url": "https://www.freebuf.com/news/66289.html", "time": "2015-05-03", "level": "金币+5", "num_look": 3130268, "num_comment": 54, "author": "猴子", "tags": ["其他", "视频"], "text": "超级惊艳的德国电影，豆瓣目前评分8.1。"}
{"title": "MySQL SSL/TLS连接存在安全漏洞，可遭中间人攻击", "url": "https://www.freebuf.com/news/66277.html", "time": "2015-05-03", "level": "金币+4", "num_look": 247060, "num_comment": 3, "author": "0XFFFF", "tags": ["漏洞", "资讯"], "text": "由于客户端在连接MySQL时SSL选项使用不当，将可能引起中间人攻击。该漏洞将导致数据库通信数据以明文形式在网络上传输。"}
{"title": "一起来聊聊这个新职位：大数据安全分析师", "url": "https://www.freebuf.com/articles/others-articles/66214.html", "time": "2015-04-30", "level": "", "num_look": 393305, "num_comment": 5, "author": "明明知道", "tags": ["其他", "观点"], "text": "寻找一名具有数据研究经验的安全分析师以应对现代威胁，就如同寻找一只传说中的独角兽。这人儿也跟就不存在。可这是真的么？"}
{"title": "【FreeTalk北京站视频回顾】白帽子旺角扛把子：那些被忽视在角落里的高危漏洞", "url": "https://www.freebuf.com/news/66209.html", "time": "2015-04-30", "level": "红色标题", "num_look": 337647, "num_comment": 14, "author": "cindy", "tags": ["头条", "资讯"], "text": "“很多企业起初并意识不到自己的系统存在众多问题，让白帽子测试后才意识到，拖库、XSS、提权漏洞等严重风险就在他们身边。”"}
{"title": "友讯（D-Link）、趋势网络路由器曝远程代码执行漏洞", "url": "https://www.freebuf.com/news/66195.html", "time": "2015-04-30", "level": "", "num_look": 224192, "num_comment": 4, "author": "明明知道", "tags": ["漏洞", "资讯"], "text": "由于使用了Realtek瑞昱公司存在漏洞的软件开发工具包（SDK），友讯科技、趋势网络以及其他品牌路由器很容易被攻击者远程执行任意代码。"}
{"title": "同源策略绕过：点击劫持，鼠标劫持，文件劫持（Part3）", "url": "https://www.freebuf.com/news/65979.html", "time": "2015-04-30", "level": "金币+4", "num_look": 209233, "num_comment": 3, "author": "鸢尾", "tags": ["资讯"], "text": "点击劫持是一种恶意攻击技术，用于跟踪网络用户，获取其私密信息或者通过让用户点击看似正常的网页来远程控制其电脑。很多浏览器和操作平台都有这样的漏洞。"}
{"title": "富可视投影仪曝身份验证绕过漏洞，可获取WiFi密码", "url": "https://www.freebuf.com/news/66151.html", "time": "2015-04-30", "level": "", "num_look": 357342, "num_comment": 7, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "由于该投影仪可连接WiFi（用于无线投影），攻击者可以利用该漏洞攻击投影仪所在的网络。"}
{"title": "GitHack：一个git泄露利用脚本", "url": "https://www.freebuf.com/sectool/66096.html", "time": "2015-04-29", "level": "金币+4", "num_look": 1378521, "num_comment": 14, "author": "exploit.py", "tags": ["工具"], "text": "当前大量开发人员使用git进行版本控制，对站点自动部署。如果配置不当，可能会将.git文件夹直接部署到线上环境。这就引起了git泄露漏洞。"}
{"title": "解药来了：思科发布针对勒索软件TeslaCrypt的解密工具", "url": "https://www.freebuf.com/sectool/66060.html", "time": "2015-04-29", "level": "金币+4", "num_look": 1038052, "num_comment": 22, "author": "Sphinx", "tags": ["工具", "系统安全"], "text": "就在上个月，小编的朋友，一位银行高管不慎点开了一封邮件的附件，真真切切的遭遇了原本以为只有在FreeBuf上看到的“新鲜玩意”——勒索软件。"}
{"title": "PayPal曝远程代码执行漏洞（含视频）", "url": "https://www.freebuf.com/news/66082.html", "time": "2015-04-29", "level": "", "num_look": 245305, "num_comment": 4, "author": "Sphinx", "tags": ["漏洞", "资讯"], "text": "日前知名在线支付公司PayPal被曝存在严重的远程代码执行漏洞。"}
{"title": "一个WordPress漏洞所引发的INSERT注入思考", "url": "https://www.freebuf.com/articles/web/65894.html", "time": "2015-04-29", "level": "现金奖励", "num_look": 361815, "num_comment": 10, "author": "Bang", "tags": ["WEB安全"], "text": "这两天在对一个WordPress插件漏洞分析的时候，发现其漏洞存在于Insert语句之中，和之前所接触到的漏洞有很大的不同。于是对这个漏洞进行了深入的分析、实验、思考、总结。"}
{"title": "识别耳朵解锁手机：雅虎带来最新生物识别技术BodyPrint", "url": "https://www.freebuf.com/news/65906.html", "time": "2015-04-29", "level": "", "num_look": 164367, "num_comment": 8, "author": "Sphinx", "tags": ["其他", "资讯"], "text": "从今以后，你不再需要输入锁屏密码或者用指纹解锁。需要解锁时，你只需将手机放在你的耳边。"}
{"title": "360刘建皓：Hacking everything，Everything is hacking", "url": "https://www.freebuf.com/news/topnews/65988.html", "time": "2015-04-28", "level": "红色标题", "num_look": 428636, "num_comment": 9, "author": "明明知道", "tags": ["头条", "极客"], "text": "一个遥控器就可以控制你家的窗帘、电视、豆浆机，让你拥有一个完美的清晨......但是，当黑客控制了这个遥控器后，你可就摊上大事了！"}
{"title": "山东安云信息技术有限公司招聘安全工程师（济南、青岛）", "url": "https://www.freebuf.com/jobs/65748.html", "time": "2015-04-28", "level": "", "num_look": 346536, "num_comment": 45, "author": "xxfocus", "tags": ["安全招聘"], "text": "山东安云信息技术有限公司成立于2013年3月份，注册资金1000万，位于济南市高新区，公司专注于信息安全和云计算领域的前沿技术研究和专业技术服务，致力于为国家和企业提供高端的真实有效的解决方案。"}
{"title": "电子商务系统Magento远程代码漏洞EXP流出，黑客已开始大规模扫描", "url": "https://www.freebuf.com/news/65730.html", "time": "2015-04-28", "level": "金币+4", "num_look": 219236, "num_comment": 11, "author": "dawner", "tags": ["资讯"], "text": "上周FreeBuf报道了电子商务系统Magento远程代码执行漏洞（SUPEE-5344）的消息，现在CheckPoint安全团队放出了漏洞利用（EXP）的部分细节。"}
{"title": "Wordpress曝存储型XSS漏洞，影响4.2及以下版本", "url": "https://www.freebuf.com/news/65926.html", "time": "2015-04-28", "level": "", "num_look": 395059, "num_comment": 16, "author": "fber", "tags": ["漏洞", "资讯"], "text": "Wordpress官方在4月21日发布了新的版本4.1.2，其中提到修复了一个严重的存储型XSS漏洞。而安全研究团队Klikki Oy发现在，新版本（"}
{"title": "揭秘：名震天下的震网病毒（Stuxnet）是如何被发现的？", "url": "https://www.freebuf.com/news/65884.html", "time": "2015-04-28", "level": "", "num_look": 1777375, "num_comment": 10, "author": "明明知道", "tags": ["终端安全", "资讯"], "text": "原本应长期潜伏在计算机控制系统中的震网（Stuxnet）病毒，最终“暴露身份”居然是因为一个低级失误……"}
{"title": "医疗设备“杀毒软件”：医疗安全监控与检测平台WattsUpDoc", "url": "https://www.freebuf.com/news/65899.html", "time": "2015-04-28", "level": "", "num_look": 234780, "num_comment": 6, "author": "JackFree", "tags": ["资讯"], "text": "之前FreeBuf报道过黑客入侵心脏起搏器威胁人们的生命。而最近，两名安全研究人员共同开发了一个名为WattsUpDoc的医疗安全监控与检测平台，它可以监控医疗设备并检测“危及生命安全”的恶意程序。"}
{"title": "同源策略绕过补充（Part2）", "url": "https://www.freebuf.com/news/65669.html", "time": "2015-04-28", "level": "金币+5", "num_look": 175287, "num_comment": 4, "author": "鸢尾", "tags": ["资讯"], "text": "在上一节中，我们了解了几个有关同源策略绕过的例子，接下来在Part2中会介绍Safari，FireFox，云存储，以及CORS中的同源策略绕过例子。"}
{"title": "海底捞、永和、棒约翰、吉野家等中枪：如此强大的全国外卖管理系统，居然完全不设防", "url": "https://www.freebuf.com/news/63900.html", "time": "2015-04-28", "level": "红色标题", "num_look": 426227, "num_comment": 28, "author": "漏洞盒子", "tags": ["头条", "资讯"], "text": ""}
{"title": "三星Galaxy S5最新漏洞：黑客可窃取用户指纹数据", "url": "https://www.freebuf.com/news/65863.html", "time": "2015-04-28", "level": "金币+5", "num_look": 186050, "num_comment": 7, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "火眼（FireEye）安全研究人员在三星Galaxy S5中发现了一个新漏洞。尽管Galaxy手机对指纹进行了加密，但黑客仍然可以克隆手机中的用户指纹数据，进而还原指纹图像，冒充受害者身份。"}
{"title": "360谭晓生：我眼中的RSA 2015 - 改变和信心", "url": "https://www.freebuf.com/articles/neopoints/65809.html", "time": "2015-04-27", "level": "红色标题", "num_look": 425935, "num_comment": 19, "author": "360安全", "tags": ["观点"], "text": "作为360公司的副总裁，谭晓生曾经连续三年参加RSA这一全球安全领域规模最大、最具影响力的行业大会，在他的眼中，每一年的RSA就是对未来安全趋势和安全方向的前瞻和预演。"}
{"title": "谷歌发布分析报告，详解此前GitHub遭遇大流量DDoS攻击全过程", "url": "https://www.freebuf.com/articles/network/65839.html", "time": "2015-04-27", "level": "", "num_look": 553565, "num_comment": 16, "author": "fber", "tags": ["网络安全"], "text": "谷歌近日发表了针对此次攻击的分析报告，还原了整个攻击的全过程。"}
{"title": "RSA会议：2015六大新型攻击趋势", "url": "https://www.freebuf.com/news/65650.html", "time": "2015-04-27", "level": "", "num_look": 206937, "num_comment": 5, "author": "明明知道", "tags": ["头条", "观点"], "text": "SANS专家在RSA会议上向大家展示了未来攻击方式的趋势。"}
{"title": "暗网匿名邮件服务SIGAINT遭情报部门攻击", "url": "https://www.freebuf.com/news/65791.html", "time": "2015-04-27", "level": "", "num_look": 339631, "num_comment": 7, "author": "Sphinx", "tags": ["资讯"], "text": "为了监控犯罪分子的行踪，执法部门和情报机构常常会对暗网及其服务发起渗透攻击。最近暗网匿名邮件服务商SIGAINT向他的用户发送了警告邮件，声称受到了来自疑似执法机构的攻击。"}
{"title": "炫酷的渗透系统Parrot Security OS", "url": "https://www.freebuf.com/sectool/65747.html", "time": "2015-04-27", "level": "金币+5", "num_look": 1120489, "num_comment": 48, "author": "MonkeyKing", "tags": ["工具"], "text": "Parrot Security OS是一款基于Debian渗透测试系统，以其漂亮的UI而出名。"}
{"title": "流行iOS网络通信库AFNetworking曝SSL漏洞，影响银联、中国银行、交通银行在内的2.5万个iOS应用", "url": "https://www.freebuf.com/news/65744.html", "time": "2015-04-26", "level": "金币+5", "num_look": 638813, "num_comment": 20, "author": "Sphinx", "tags": ["漏洞", "资讯"], "text": "FreeBuf测试了几款国内金融类APP，发现银联、中国银行、交通银行的APP纷纷中招。"}
{"title": "对抗NSA（美国国安局）：NSA Quantum注入攻击检测工具问世", "url": "https://www.freebuf.com/news/65725.html", "time": "2015-04-25", "level": "金币+5", "num_look": 474496, "num_comment": 4, "author": "dawner", "tags": ["工具", "网络安全"], "text": "来自Fox-IT的安全专家已经开发出一种可检测NSA Quantum注入攻击的方法，并写出一份有趣的报告，将之公之于众。"}
{"title": "同源策略详解及绕过（Part1）", "url": "https://www.freebuf.com/articles/web/65468.html", "time": "2015-04-25", "level": "金币+5", "num_look": 932008, "num_comment": 13, "author": "鸢尾", "tags": ["WEB安全"], "text": "如果Web世界没有同源策略，当你登录FreeBuf账号并打开另一个站点时，这个站点上的JavaScript可以跨域读取你的FreeBuf账号数据，这样整个Web世界就无隐私可言了。"}
{"title": "招商银行招聘信息安全相关岗位", "url": "https://www.freebuf.com/jobs/65070.html", "time": "2015-04-24", "level": "", "num_look": 357987, "num_comment": 41, "author": "xysky", "tags": ["安全招聘"], "text": "凭借持续的金融创新、优质的客户服务、稳健的经营风格和良好的经营业绩，招行现已发展成为中国境内最具品牌影响力的商业银行之一。"}
{"title": "控制指令高达二十多种：远控木马Dendoroid.B分析报告", "url": "https://www.freebuf.com/articles/terminal/65611.html", "time": "2015-04-24", "level": "", "num_look": 574892, "num_comment": 46, "author": "360手机卫士", "tags": ["终端安全"], "text": "这是一款功能强大的专业间谍软件，它可以通过PC端远程控制中招用户的手机，控制指令高达二十多种，窃取用户手机通讯录，短信，照片及其它重要隐私数据。其命名为Android.Dendoroid.B。"}
{"title": "Ubuntu曝本地权限提升漏洞，影响12.04 - 14.10版本（含EXP）", "url": "https://www.freebuf.com/vuls/65641.html", "time": "2015-04-24", "level": "", "num_look": 408429, "num_comment": 15, "author": "phper", "tags": ["漏洞", "系统安全"], "text": "今天Ubuntu12.04-14.10曝出本地权限提升漏洞，该漏洞由Google的大神Tavis Ormandy发出，包含漏洞利用测试程序。"}
{"title": "美国RSA大会：围观“大事件”的主角", "url": "https://www.freebuf.com/news/65625.html", "time": "2015-04-24", "level": "", "num_look": 143837, "num_comment": 2, "author": "AVLTeam", "tags": ["观点", "资讯"], "text": "这种大并购、大协同，往往消息突然在意料之外，细细思量又在情理之中，既让观者感到震撼，又觉得确实如本届RSA的Slogan一样——变化，是安全的常态。"}
{"title": "卡巴斯基：俄罗斯黑客组织CozyDuke可能是入侵白宫、窃取奥巴马通信的幕后黑手", "url": "https://www.freebuf.com/news/65614.html", "time": "2015-04-24", "level": "金币+6", "num_look": 158445, "num_comment": 15, "author": "fber", "tags": ["资讯"], "text": "卡巴斯基实验室发现另一名为CozyDuke的APT攻击组织，可能就是此前入侵美国国务院和白宫的黑手，当时该组织窃取了美国总统奥巴马的通信、日程安排等非公开敏感信息。"}
{"title": "安卓WiFi管理组件wpa_supplicant存在高危漏洞，可导致泄露内存信息、DoS拒绝服务或任意代码执行", "url": "https://www.freebuf.com/news/65593.html", "time": "2015-04-24", "level": "", "num_look": 229371, "num_comment": 7, "author": "dawner", "tags": ["漏洞", "资讯"], "text": "​流行WLAN无线网络管理组件cwpa_supplicant曝高危漏洞（CVE-2015-1863），可导致泄露内存信息、DoS拒绝服务或任意代码执行。该漏洞主要影响安卓系统，而其它系统也可能会受影响。"}
{"title": "五角大楼将公布网络安全新战略：预警网络战争", "url": "https://www.freebuf.com/news/65535.html", "time": "2015-04-24", "level": "", "num_look": 144287, "num_comment": 4, "author": "明明知道", "tags": ["资讯"], "text": "美国防部公布新的网络安全战略，提升针对网络攻击行为的威慑能力。美国对网络战的重视已经到达一个新高度，且已经完成了发动网络战争的全部准备。"}
{"title": "从2015上海车展看智能汽车安全", "url": "https://www.freebuf.com/news/65462.html", "time": "2015-04-24", "level": "", "num_look": 181601, "num_comment": 10, "author": "刘健皓", "tags": ["其他", "极客"], "text": "随着科技发展，汽车越来越智能化，根据国外机构预测，到2017年，将会有超过60%的汽车会连接到互联网，目前像自动泊车、辅助驾驶、无人驾驶等技术也越来越成熟，此次上海车展也反映了这个趋势。"}
{"title": "百度招聘开放云安全产品经理实习生", "url": "https://www.freebuf.com/jobs/65521.html", "time": "2015-04-23", "level": "", "num_look": 197259, "num_comment": 22, "author": "百度云安全", "tags": ["安全招聘"], "text": "百度（Nasdaq：BIDU）是全球最大的中文搜索引擎、最大的中文网站。2000年1月由李彦宏创立于北京中关村，致力于向人们提供“简单，可依赖”的信息获取方式。"}
{"title": "iOS 8漏洞可致wifi覆盖范围内任意iPhone iPad不断重启（含视频）", "url": "https://www.freebuf.com/news/65552.html", "time": "2015-04-23", "level": "金币+6", "num_look": 445762, "num_comment": 9, "author": "Sphinx", "tags": ["无线安全", "终端安全"], "text": "在周二旧金山的RSA安全会议上，研究人员展示了他们的最新研究成果——iOS 8中的0day漏洞“无iOS区”。顾名思义，能够让某个WiFi范围内的苹果iPhone、iPad、iPods设备不断重启，受害者中招后能做的只能是：跑远点。"}
{"title": "微软：最高奖励高达15000美元，来挖新推出的Spartan浏览器漏洞吧", "url": "https://www.freebuf.com/news/65423.html", "time": "2015-04-23", "level": "", "num_look": 151094, "num_comment": 9, "author": "安恒信息", "tags": ["资讯"], "text": "今天微软宣布扩大漏洞奖励计划范围，将其代号为“Project Spartan”的最新的浏览器纳入其中。"}
{"title": "世界排名第一的电子商务系统Magento曝远程代码执行漏洞", "url": "https://www.freebuf.com/news/65504.html", "time": "2015-04-23", "level": "", "num_look": 262117, "num_comment": 9, "author": "明明知道", "tags": ["漏洞", "资讯"], "text": "eBay投资的电子商务系统Magento在全球范围内一共有超过240000个商家，是广受赞誉的全球最优秀的电子商务系统。然而，一贯低调的Magento近期却“带着”会影响世界数万商家的远程代码执行漏洞（RCE）重新杀入了我们的视…"}
{"title": "使用HTTP Headers防御WEB攻击（Part1）", "url": "https://www.freebuf.com/articles/web/65385.html", "time": "2015-04-23", "level": "金币+6", "num_look": 348746, "num_comment": 12, "author": "鸢尾", "tags": ["WEB安全"], "text": "本系列文章旨在给开发者一个提示，如何使用HTTP头对一些攻击进行防御。"}
{"title": "CrowdStrike：我们挡住了中国黑客组织飓风熊猫（HURRICANE PANDA）的攻击", "url": "https://www.freebuf.com/news/65443.html", "time": "2015-04-23", "level": "金币+6", "num_look": 633999, "num_comment": 24, "author": "fber", "tags": ["网络安全", "资讯"], "text": "CrowdStrike公司官方博客上发表了一篇文章，宣称成功阻挡住了中国黑客组织飓风熊猫（HURRICANE PANDA）的网络攻击。CrowdStrike从2013年就开始调查飓风熊猫，并一直在与之斗争。"}
{"title": "警察叔叔，我来帮你找伪基站了", "url": "https://www.freebuf.com/articles/wireless/65382.html", "time": "2015-04-23", "level": "金币+6", "num_look": 1314212, "num_comment": 24, "author": "banish", "tags": ["无线安全", "极客"], "text": "随着移动通信技术的发展，各种移动通信系统的基站越建越多，基站之间容易产生相互干扰，造成链路质量下降和系统容量降低。其中对无线网络影响最重、危害最大的就是仿真基站系统。"}
{"title": "全球6000万台Mac电脑仍受到Rootpipe漏洞（后门）影响", "url": "https://www.freebuf.com/news/65358.html", "time": "2015-04-23", "level": "", "num_look": 182873, "num_comment": 6, "author": "明明知道", "tags": ["漏洞", "资讯"], "text": "即使是最新Mac OS X Yosemite系统的Apple Mac电脑仍然会受到隐藏的后门“Rootpipe”攻击。"}
{"title": "智能城市系统将成为未来黑客攻击的主要目标（含酷炫视频）", "url": "https://www.freebuf.com/news/65341.html", "time": "2015-04-23", "level": "", "num_look": 141731, "num_comment": 7, "author": "fber", "tags": ["资讯"], "text": "互联网安全专家Cesar Cerrudo再次向业界发出了警告：智能城市系统将是未来黑客们攻击的主要目标。"}
{"title": "启明星辰APS部门急招高级安全工程师数人", "url": "https://www.freebuf.com/jobs/64279.html", "time": "2015-04-22", "level": "", "num_look": 258862, "num_comment": 28, "author": "Mystery", "tags": ["安全招聘"], "text": "启明星辰公司成立于1996年，是由留美博士严望佳女士创建的拥有完全自主知识产权的网络安全高科技企业，是国内最具实力的网络安全产品、可信安全管理平台、专业安全服务与解决方案的综合提供商。"}
{"title": "DO NOT FUCK WITH A HACKER：黑客电子杂志《DNFWAH》第四期", "url": "https://www.freebuf.com/news/65326.html", "time": "2015-04-22", "level": "", "num_look": 269022, "num_comment": 11, "author": "明明知道", "tags": ["WEB安全", "资讯"], "text": "《DNFWAH》是一本电子杂志，分享一些来自不同领域黑客关注的东西和黑客生活。"}
{"title": "一周海外安全事件回顾（20150412-0419）：FireEye的转变", "url": "https://www.freebuf.com/news/65315.html", "time": "2015-04-22", "level": "红色标题", "num_look": 567470, "num_comment": 31, "author": "blackscreen", "tags": ["头条", "资讯"], "text": "最近FireEye连续两份APT报告燃爆安全圈，成为全球最火爆的安全公司。抛开报告本身不说，你知道FireEye公司如何一步一步地完成从技术到情报再到运营的转变吗？"}
{"title": "Adobe Flash播放器最新漏洞（CVE-2015-3044）：摄像头和麦克风可被远程控制（含视频）", "url": "https://www.freebuf.com/news/65294.html", "time": "2015-04-22", "level": "金币+4", "num_look": 216269, "num_comment": 13, "author": "dawner", "tags": ["漏洞", "资讯"], "text": "研究人员最近发现，在Adobe Flash播放器的某些版本存在漏洞，攻击者利用漏洞可以借助电脑的内置摄像头和麦克风对用户进行监控。"}
{"title": "你的比特币安全吗？", "url": "https://www.freebuf.com/news/65046.html", "time": "2015-04-22", "level": "", "num_look": 190504, "num_comment": 5, "author": "明明知道", "tags": ["其他", "资讯"], "text": "尽管比特币被盗后基本无法找回，但是用户可以多加一层安全保护措施，任何比特币的持有者都应对电脑系统做好严密防护。"}
{"title": "匿名者（Anonymous）组织攻下以色列武器制造商网站，泄露大量客户信息", "url": "https://www.freebuf.com/news/65138.html", "time": "2015-04-22", "level": "", "num_look": 273982, "num_comment": 13, "author": "明明知道", "tags": ["WEB安全", "资讯"], "text": "全球最大的黑客组织Anonymous（匿名者）攻击了一家来自以色列的武器进口商、制造商FAB Defense（fab-defense.com），并泄露了其以色列本土与国际客户的登录凭证及个人信息，其中客户包括一些政府官员。"}
{"title": "TSRC安全群英汇上海沙龙纪实", "url": "https://www.freebuf.com/fevents/65123.html", "time": "2015-04-21", "level": "", "num_look": 169375, "num_comment": 8, "author": "腾讯安全平台部", "tags": ["活动"], "text": "TSRC在黄浦江十六号码头的名鑫号游轮上举行了一次别开生面的沙龙活动。"}
{"title": "用Misfortune-Cookie（厄运cookie）给ROM-0 Bug打补丁", "url": "https://www.freebuf.com/articles/terminal/65246.html", "time": "2015-04-21", "level": "金币+4", "num_look": 250927, "num_comment": 3, "author": "embedsecsystems", "tags": ["终端安全"], "text": "这篇文章只是为了好玩，特别是给那些喜欢调整系统的嵌入式黑客们。所以这不是一个正当的修复ROM-0 Bug的手段，好玩的是通过一个bug来修复另外一个bug。"}
{"title": "研究人员在RSA大会上演示利用恶意JPEG图片入侵企业内网", "url": "https://www.freebuf.com/news/65111.html", "time": "2015-04-21", "level": "金币+4", "num_look": 202354, "num_comment": 23, "author": "JackFree", "tags": ["资讯"], "text": "安全研究人员Marcus Murray在正在旧金山举行的RSA大会上公布了​一种利用恶意JPEG图片攻击企业网络内部Windows服务器的新方法。"}
{"title": "汽车之家诚招安全工程师", "url": "https://www.freebuf.com/jobs/64653.html", "time": "2015-04-21", "level": "", "num_look": 203252, "num_comment": 24, "author": "cn_H5", "tags": ["安全招聘"], "text": "汽车之家是中国最值得信赖的汽车互联网服务平台——为汽车消费者提供贯穿选车、买车、用车、置换所有环节的全面、准确、快捷的一站式服务。"}
{"title": "D-Link DIR-890L安全分析报告", "url": "https://www.freebuf.com/vuls/64521.html", "time": "2015-04-21", "level": "金币+4", "num_look": 346500, "num_comment": 9, "author": "0XFFFF", "tags": ["漏洞", "终端安全"], "text": "D-Link路由器最”insane”（疯狂）的一点就是它运行包含数年来已经被揭露的相同的bug的固件，而且这种攻击也一直在持续。然后，我就开始了对它的探索之旅……"}
{"title": "美国RSA大会布展日：中国安全厂商扎堆", "url": "https://www.freebuf.com/news/65026.html", "time": "2015-04-21", "level": "", "num_look": 155474, "num_comment": 10, "author": "AVLTeam", "tags": ["资讯"], "text": "4月18号，我们小分队从北京出发，经过近12小时的飞行，抵达了阳光清爽明媚的旧金山，在经过简短休整后，我们第一时间来到Moscone Center，成为RSA2015第一批注册的参会者。"}
{"title": "新型恶意软件Punkey现已加入POS机木马“豪华午餐”", "url": "https://www.freebuf.com/news/64722.html", "time": "2015-04-21", "level": "", "num_look": 214441, "num_comment": 2, "author": "JackFree", "tags": ["资讯"], "text": "在最近的一次调查中，Trustwave公司的安全专家们遇到了一个名为“Punkey”的新型POS恶意软件，它不仅具有侦察和攻击能力，而且还能够进行远程更新及调整自身功能。"}
{"title": "趋势科技：俄罗斯“兵风暴（Pawn Storm）”网络间谍行动仍在继续", "url": "https://www.freebuf.com/news/64874.html", "time": "2015-04-21", "level": "", "num_look": 345653, "num_comment": 2, "author": "Sphinx", "tags": ["资讯"], "text": "“兵风暴（Pawn Storm）”行动是一场被指由俄罗斯政府支持的黑客组织所进行的网络间谍活动，趋势科技的最新研究报告显示，他们现在仍在大肆进行攻击。"}
{"title": "触目惊心：慈铭、国药阳光体检网站严重漏洞可导致用户体检报告泄露", "url": "https://www.freebuf.com/news/63891.html", "time": "2015-04-21", "level": "红色标题", "num_look": 604720, "num_comment": 35, "author": "漏洞盒子", "tags": ["头条", "漏洞"], "text": "诸如慈铭、国药阳光这类国内领先的体检中心，在建立网上业务的同时，是否有意识到要对客户信息负责？"}
{"title": "用技术解决体验问题：Chrome 43将取消地址栏中的“黄色小三角”警告", "url": "https://www.freebuf.com/news/64878.html", "time": "2015-04-21", "level": "金币+4", "num_look": 348415, "num_comment": 5, "author": "dawner", "tags": ["WEB安全", "资讯"], "text": "有些时候你会发现，在Google Chrome浏览器的地址栏前会出现“黄色小三角”警告。"}
{"title": "FireEye：APT28利用0day漏洞组合向跨国政府机构发动针对性攻击", "url": "https://www.freebuf.com/news/64753.html", "time": "2015-04-21", "level": "", "num_look": 234220, "num_comment": 8, "author": "fber", "tags": ["资讯"], "text": "火眼（FireEye）于周六披露了一个有针对性的攻击活动，俄罗斯威胁组织APT28利用2个0day漏洞入侵了某垂直行业跨国政府机构。"}
{"title": "新西兰与美国合伙监控中国驻新西兰领事馆", "url": "https://www.freebuf.com/news/64627.html", "time": "2015-04-20", "level": "", "num_look": 146688, "num_comment": 11, "author": "明明知道", "tags": ["资讯"], "text": "4月19日，《新西兰先驱报》公布了一封来自爱德华·斯诺登的绝密文件，其中爆光了新西兰通信安全局（GCSB）与美国国家安全局（NSA）合作，对中国驻新西兰奥克兰的总领馆进行监控。"}
{"title": "Safari浏览器cookie访问漏洞影响数十亿苹果产品", "url": "https://www.freebuf.com/news/64581.html", "time": "2015-04-20", "level": "", "num_look": 209924, "num_comment": 8, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "存在于Safari浏览器中的一个cookie访问漏洞（CVE-2015-1126）可能会影响数十亿苹果产品，如果你在使用Safari浏览器，一定要尽快检测它是否受该漏洞影响，若受影响请尽快修复。"}
{"title": "时间短、流量大：DDoS攻击形式正在改变", "url": "https://www.freebuf.com/news/64477.html", "time": "2015-04-20", "level": "金币+4", "num_look": 308332, "num_comment": 4, "author": "穿过大半个中国去睡你", "tags": ["网络安全", "资讯"], "text": "分布式拒绝服务(DDoS)攻击不是什么新鲜事。这种网络攻击可能对企业造成重大财务和声誉损失。但令人无可奈何的是，DDoS攻击近年来在规模和体量上都在持续增长。"}
{"title": "揭秘：地下黑市TheRealDeal提供0day漏洞交易服务", "url": "https://www.freebuf.com/news/64549.html", "time": "2015-04-20", "level": "金币+4", "num_look": 533297, "num_comment": 16, "author": "江湖小吓", "tags": ["其他", "头条"], "text": "最近在洋葱网络Tor中就出现了一个名为TheRealDeal的地下市场，为买卖双方提供了的0day漏洞交易的服务。"}
{"title": "​4.22，FreeBuf小酒馆（bar.freebuf.com）试营业", "url": "https://www.freebuf.com/news/64473.html", "time": "2015-04-20", "level": "红色标题", "num_look": 796443, "num_comment": 30, "author": "FB客服", "tags": ["活动", "资讯"], "text": "有些话，只想在小酒馆说。"}
{"title": "七个黑你的理由", "url": "https://www.freebuf.com/news/topnews/64446.html", "time": "2015-04-20", "level": "", "num_look": 207626, "num_comment": 10, "author": "明明知道", "tags": ["其他", "头条"], "text": "这里列举了七种用户“应该”被黑的理由。"}
{"title": "无线车锁安全性太差了：加拿大发生多起汽车神秘被盗事件", "url": "https://www.freebuf.com/news/64432.html", "time": "2015-04-18", "level": "", "num_look": 461510, "num_comment": 14, "author": "fber", "tags": ["头条", "极客"], "text": "看过《钢铁侠》中的各种酷炫智能装备吧，现在帕萨特、丰田、雷克萨斯、宝马、奔驰都逐步引入了无线技术，虽然价格不菲，但能让你拥有Tony Stark般的科技体验。可是……"}
{"title": "阿里安全研究实验室：IIS服务器漏洞分析", "url": "https://www.freebuf.com/vuls/64415.html", "time": "2015-04-17", "level": "", "num_look": 300781, "num_comment": 15, "author": "阿里安全", "tags": ["头条", "漏洞"], "text": "4月15日，在微软补丁日上微软公布了多个高危漏洞，其中一个MS15-034 漏洞影响面最广，会造成IIS服务器蓝屏崩溃，特殊环境下或导致信息泄露。阿里巴巴安全研究实验室着重分析这一高危漏洞以及给国内互联网带来的影响。"}
{"title": "维基解密公开2014年索尼入侵事件泄密数据", "url": "https://www.freebuf.com/news/64395.html", "time": "2015-04-17", "level": "金币+4", "num_look": 394476, "num_comment": 6, "author": "fber", "tags": ["资讯"], "text": "维基解密于本周四在其网站上公布了去年11月发生的大事件“索尼影视被黑”时泄露的数据，包含30287份索尼影视美国公司的文件和173132封电子邮件。"}
{"title": "这算漏洞？研究人员指责全球最大婚恋网站Match登录页未用HTTPS", "url": "https://www.freebuf.com/news/64379.html", "time": "2015-04-17", "level": "", "num_look": 149989, "num_comment": 10, "author": "明明知道", "tags": ["资讯"], "text": "美国研究者Scott Bryner指出，全球最大婚恋网站Match.com的登录页面不知何原因由HTTPS跳转为HTTP，这意味着用户密码的传输没有受到加密保护，而这个问题已存在数周而无人关注。"}
{"title": "举报腐败行为，证物被警方植入木马", "url": "https://www.freebuf.com/news/64368.html", "time": "2015-04-17", "level": "", "num_look": 145873, "num_comment": 12, "author": "dawner", "tags": ["资讯"], "text": "​一位匿名人士向法院举报史密斯堡警局在内的“有关部门”腐败行为，受举报者委托的律师将证物存放在硬盘里寄送给警方。然而不久之后，警方将这片硬盘植入木马病毒后回寄。"}
{"title": "点击诈骗的罪魁祸首：技术剖析Zero Access木马", "url": "https://www.freebuf.com/articles/system/63904.html", "time": "2015-04-17", "level": "", "num_look": 194860, "num_comment": 2, "author": "鸢尾", "tags": ["系统安全"], "text": "Zero Access Rootkit，它也被叫做恶意软件Smiscar或Max++ rootkit，Crimeware。它在世界范围内已经影响到数百万台计算机，它是造成网络点击诈骗方式的罪魁祸首之一。一旦木马进入用户系统中，他就开始下载各种不同…"}
{"title": "揭秘：黑客反击战APT-on-APT分析报告（含视频）", "url": "https://www.freebuf.com/news/64255.html", "time": "2015-04-17", "level": "金币+4", "num_look": 487086, "num_comment": 17, "author": "fber", "tags": ["头条", "安全报告"], "text": "​电影《古惑仔》中，我们常常看到黑社会团体之间的暴力冲突。而在网络空间里，你见过APT（高级持续性威胁）黑客组织互掐吗？"}
{"title": "【本周日】419北京一夜：FREE TALK•北京站（演讲者公布）", "url": "https://www.freebuf.com/news/topnews/60363.html", "time": "2015-04-17", "level": "红色标题", "num_look": 616551, "num_comment": 47, "author": "FB客服", "tags": ["头条", "活动"], "text": "一路的颠簸，伴着车轮和铁轨的摩擦，辗转上海和深圳，FREE TALK奔腾着驶向北方……4月19日，北京，我们来了。"}
{"title": "Java曝远程代码执行漏洞", "url": "https://www.freebuf.com/news/64305.html", "time": "2015-04-16", "level": "", "num_look": 388987, "num_comment": 22, "author": "fber", "tags": ["漏洞", "资讯"], "text": "今天Java又曝一系列安全漏洞，攻击者可在未授权的情况下在受害者的Java应用上远程执行命令，强烈建议企业尽快更新它们的Java Runtime Environments （JREs） 和（Java Development Kits）JDKs。"}
{"title": "Verizon新鲜发布《2015年数据泄露调查报告》", "url": "https://www.freebuf.com/news/64183.html", "time": "2015-04-16", "level": "金币+4", "num_look": 526078, "num_comment": 6, "author": "005", "tags": ["头条", "安全报告"], "text": "本周一，Verizon发布了一年一度的“2015数据泄露调查报告”《Data Breach Investigations Report》。"}
{"title": "IIS最新高危漏洞（CVE-2015-1635，MS15-034）分析", "url": "https://www.freebuf.com/vuls/64195.html", "time": "2015-04-16", "level": "", "num_look": 1481984, "num_comment": 18, "author": "360安全", "tags": ["漏洞"], "text": "在4月的补丁日，微软通过标记为“高危”的MS15-034补丁，修复了HTTP.SYS中一处远程代码漏洞CVE-2015-1635。"}
{"title": "IIS最新高危漏洞（CVE-2015-1635，MS15-034）POC及在线检测源码", "url": "https://www.freebuf.com/articles/system/64185.html", "time": "2015-04-16", "level": "金币+6", "num_look": 2915122, "num_comment": 35, "author": "xiaoya", "tags": ["系统安全"], "text": "远程执行代码漏洞存在于 HTTP 协议堆栈 (HTTP.sys) 中，当 HTTP.sys 未正确分析经特殊设计的 HTTP 请求时会导致此漏洞。成功利用此漏洞的攻击者可以在系统帐户的上下文中执行任意代码。"}
{"title": "打脸：看我如何用3天时间黑掉“网秦私密空间（NQ Vault）”", "url": "https://www.freebuf.com/articles/terminal/64023.html", "time": "2015-04-16", "level": "金币+6", "num_look": 419917, "num_comment": 20, "author": "鸢尾", "tags": ["终端安全"], "text": "网秦的宣传口号也不错——将你手机里的秘密全部藏起来！"}
{"title": "手机丢了以后，都会发生些什么？", "url": "https://www.freebuf.com/news/topnews/63853.html", "time": "2015-04-16", "level": "现金奖励", "num_look": 1021742, "num_comment": 97, "author": "Drops@ZUT", "tags": ["其他", "头条"], "text": "你的手机丢了？你觉得在多短时间内补卡以及采取什么补救措施是最好的？一个小时？三个小时？还是，明天吧，反正今天找了好久没找到，说不定落在家里了……如果捡到手机的人就是我，你觉得我能做到些什么？"}
{"title": "被黑与被起诉，谷歌最近有点烦", "url": "https://www.freebuf.com/news/64126.html", "time": "2015-04-16", "level": "", "num_look": 147658, "num_comment": 4, "author": "明明知道", "tags": ["资讯"], "text": "本周三，Ne0-h4ck3r、TiGER-M@TE和土耳其黑客F0RTYS3V3N一众劫持了谷歌、谷歌图片、YouTube和雅虎的马拉西亚网站。"}
{"title": "Upgrade DOS攻击可致数十亿Android设备变砖", "url": "https://www.freebuf.com/articles/terminal/64087.html", "time": "2015-04-15", "level": "", "num_look": 358051, "num_comment": 17, "author": "Jason_HZ", "tags": ["终端安全"], "text": "中招之后，用户的手机变成名副其实的“砖头”机，除了砸核桃外一无是处。"}
{"title": "英国超模Kelly Brook再曝艳照", "url": "https://www.freebuf.com/news/64095.html", "time": "2015-04-15", "level": "", "num_look": 890579, "num_comment": 23, "author": "fber", "tags": ["资讯"], "text": "在近日，黑客在Reddit论坛上曝光了一组英国超模Kelly Brook的艳（裸）照，Reddit论坛现已成为黑客们发布明星艳照的主要途径。"}
{"title": "这个男人黑进彩票系统，中了1430W美金", "url": "https://www.freebuf.com/news/64063.html", "time": "2015-04-15", "level": "", "num_look": 226671, "num_comment": 12, "author": "明明知道", "tags": ["资讯"], "text": "2012年1月底，美国爱荷华州一名彩票头奖的幸运儿在中奖一年后、兑奖截止日期前最后两小时才委托一名代理律师认领1430万美元奖金。"}
{"title": "微软补丁日（2015-4-14）：修复众多高危IE、Windows、Office漏洞", "url": "https://www.freebuf.com/news/64044.html", "time": "2015-04-15", "level": "", "num_look": 219400, "num_comment": 2, "author": "fber", "tags": ["漏洞", "资讯"], "text": "每月第二个周二是微软固定的补丁修复日，微软于本周二（2015-4-14）的“补丁日”上修复了大量漏洞，其中包括众多IE、Windows、Office高危漏洞。"}
{"title": "系统命令注入漏洞自动化测试工具 - Commix", "url": "https://www.freebuf.com/sectool/64030.html", "time": "2015-04-15", "level": "", "num_look": 564773, "num_comment": 9, "author": "phper", "tags": ["工具"], "text": "Commix是一个适用于web开发者、渗透测试人员及安全研究者的自动化测试工具，可以帮助他们更高效的发现web应用中的命令注入攻击相关漏洞。"}
{"title": "孟加拉黑客？谷歌马来西亚域名再遭DNS劫持", "url": "https://www.freebuf.com/news/63990.html", "time": "2015-04-15", "level": "", "num_look": 198557, "num_comment": 4, "author": "安恒信息", "tags": ["资讯"], "text": "谷歌（Google）马来西亚网站周二遭遇访问中断，部分用户被重定向到一个网页，网页上赫然写着“谷歌马来西亚网站被黑 #孟加拉黑客#”。"}
{"title": "FakeTaobao木马家族变种演变（二）", "url": "https://www.freebuf.com/articles/system/63881.html", "time": "2015-04-15", "level": "", "num_look": 188696, "num_comment": 6, "author": "360手机卫士", "tags": ["系统安全"], "text": "今年央视315晚会上曝光了\"10086积分兑换\"电信诈骗全过程，详解了不法分子通过伪基站等方式伪装成运营商号码群发诈骗钓鱼短信，钓鱼网站诱导用户下载安装木马软件，致使用户中招。"}
{"title": "恶意代码分析：索尼被黑和朝中社“水坑”攻击可能是同一组织所为", "url": "https://www.freebuf.com/articles/system/63835.html", "time": "2015-04-15", "level": "金币+6", "num_look": 230239, "num_comment": 13, "author": "hellotong", "tags": ["系统安全"], "text": "去年年末最重要的黑客入侵事件恐怕要数索尼影视被黑了，如同电影大片，一夜之间公司所有电脑全部被替换成了一张威胁图片，而就在索尼影视事件发生不久，朝鲜中央通讯社网站也遭到了黑客攻击。究竟到底真凶是谁呢？…"}
{"title": "从零开始学Win32平台缓冲区溢出（Part1）", "url": "https://www.freebuf.com/vuls/63580.html", "time": "2015-04-15", "level": "金币+6", "num_look": 325818, "num_comment": 27, "author": "鸢尾", "tags": ["头条", "漏洞"], "text": "缓冲区溢出是一个常见的软件安全漏洞，即是数据被过多的写入内存或者缓冲区，如果继续写入数据，数据就会溢出到其他缓冲区中，这将会覆盖或者说是破坏已存储的数据。"}
{"title": "WP Super Cache <=1.4.2 存储型XSS漏洞分析", "url": "https://www.freebuf.com/articles/web/63829.html", "time": "2015-04-15", "level": "金币+6", "num_look": 284183, "num_comment": 6, "author": "Yaseng", "tags": ["WEB安全"], "text": "WP Super Cache 会把未缓存过的文件静态化,写入html文件到wp-contents/cache 目录。对于wordpress用户(匿名评论,作者,管理员等)生成一个key,其中key 部分取自访问当前页面的 用户cookie,根据key来找到对应的缓存文…"}
{"title": "Windows曝“重定向SMB”漏洞，影响Win10在内的所有版本（含视频）", "url": "https://www.freebuf.com/news/63964.html", "time": "2015-04-14", "level": "红色标题", "num_look": 468568, "num_comment": 8, "author": "明明知道", "tags": ["漏洞", "资讯"], "text": "近日Cylance公司发布了一个Windows系统严重漏洞，攻击者通过漏洞可以盗取用户认证信息。该漏洞影响包括最新Windows 10预览版在内的所有Windows版本，以及Adobe、苹果、Box、Oracle、Symantec等30多家公司产品。"}
{"title": "全球各国黑客部队战力总览", "url": "https://www.freebuf.com/news/topnews/63869.html", "time": "2015-04-14", "level": "红色标题", "num_look": 755033, "num_comment": 44, "author": "威观世界", "tags": ["其他", "头条"], "text": "出于个人心血来潮，最近搜集了一些各国黑客部队的材料，还挺有意思的，给大家分享分享，里面各部队的战绩资料没有来得及让各个国家确认（估计它们也不会给确认），因此总的结论纯属八卦：P"}
{"title": "当汽车遇到黑客：车联网信息安全研讨会（上海）", "url": "https://www.freebuf.com/fevents/63576.html", "time": "2015-04-14", "level": "", "num_look": 194313, "num_comment": 1, "author": "tofreebug", "tags": ["活动"], "text": "随着汽车越来越高的智能化以及互联网化，它的潜在危险系数也随之增高。汽车安全并不再仅仅处于碰撞测试、硬件上的主、被动安全防护措施阶段，而汽车网络信息安全才是汽车安全的「新战场」。"}
{"title": "事件跟踪：中兴路由器（SOHO Router）后门已清除", "url": "https://www.freebuf.com/news/63760.html", "time": "2015-04-14", "level": "", "num_look": 182861, "num_comment": 10, "author": "明明知道", "tags": ["资讯"], "text": "​2014年3月，FreeBuf报道了中兴公司（ZTE）生产的SOHO Router部分型号路由器中被曝存在后门，目前中兴通讯已联合运营商进行全部在网设备升级工作。"}
{"title": "黑了比尔盖茨银行账户的黑客被捕，缴获多张克隆信用卡", "url": "https://www.freebuf.com/news/63852.html", "time": "2015-04-14", "level": "金币+3", "num_look": 270951, "num_comment": 29, "author": "dawner", "tags": ["资讯"], "text": "Konstantin Simeonov Kavrakov，一位来自保加利亚的黑客，他曾使用伪造的银行卡入侵了ATM机，并且从微软大亨比尔盖茨的账户里窃取了数千美元。"}
{"title": "火眼（FireEye）披露了一个隐藏数十年的网络间谍活动APT30", "url": "https://www.freebuf.com/news/63761.html", "time": "2015-04-14", "level": "红色标题", "num_look": 461984, "num_comment": 29, "author": "cindy", "tags": ["资讯"], "text": "火眼（FireEye）于周日披露了一个长达十年之久的网络间谍活动，主要窃取东南亚和印度地区政府、企业、新闻媒体方面的机密信息。"}
{"title": "逆向分析贝尔金路由器WPS Pin算法", "url": "https://www.freebuf.com/articles/wireless/63627.html", "time": "2015-04-14", "level": "金币+3", "num_look": 395316, "num_comment": 9, "author": "0XFFFF", "tags": ["无线安全", "系统安全"], "text": "在发现D-Link的WPS算法后，我很想看看哪个供应商也许会使用相似的算法，于是我导出了贝尔金设备的固件，然后开始分析。"}
{"title": "万能的暗网：护照、社保卡、医保卡、警徽，10美元各类证件均有“办理”", "url": "https://www.freebuf.com/news/63749.html", "time": "2015-04-14", "level": "金币+3", "num_look": 545274, "num_comment": 22, "author": "dawner", "tags": ["资讯"], "text": "研究人员近日发现，暗网（Dark Web）中的Nucleus网络黑市居然提供办假证甚至警徽伪造服务，价格仅需10美元。"}
{"title": "芯片卡安全的前世、今生与来世", "url": "https://www.freebuf.com/articles/terminal/63670.html", "time": "2015-04-14", "level": "", "num_look": 312009, "num_comment": 5, "author": "codename2015", "tags": ["终端安全"], "text": "刷卡消费早已不是什么新鲜事，然而这一消费方式正在全球悄悄发生变化。横空出世的芯片卡在欧洲已有数年的使用历史，那么芯片卡是否完美地解决了磁条卡存在的安全问题？答案或许并不完美，但“科技改变生活”的说法一…"}
{"title": "美欧执法机构合力攻破僵尸网络BeeBone", "url": "https://www.freebuf.com/news/63637.html", "time": "2015-04-13", "level": "", "num_look": 141564, "num_comment": 3, "author": "banish", "tags": ["资讯"], "text": "近日美欧执法机构已经攻破并且关闭了一个高度复杂的僵尸网络beebone，已经感染了超过12000台计算机，黑客可以通过被感染的机器窃取受害人的银行资料和其他敏感数据。"}
{"title": "FreeBuf公开课：Wi-Fi安全与渗透测试（第二集）", "url": "https://www.freebuf.com/news/topnews/63806.html", "time": "2015-04-13", "level": "红色标题", "num_look": 410071, "num_comment": 18, "author": "FB视频", "tags": ["头条", "视频"], "text": "FBer们，众所期待的《Wi-Fi安全与渗透测试：第二集》来了！"}
{"title": "犯错是人的天性：如何减少人为失误造成的信息安全事故？", "url": "https://www.freebuf.com/news/63754.html", "time": "2015-04-13", "level": "", "num_look": 342196, "num_comment": 2, "author": "明明知道", "tags": ["安全管理", "观点"], "text": "2014年IBM网络安全情报检索显示，高达95%的信息安全事件的发现与人为失误（故意或无意）有关。人为失误不仅仅是影响网络安全的重要因素，同样在航空事故和医疗事故中扮演重要角色。"}
{"title": "卡巴斯基：苹果iOS及Mac系统存在漏洞，可导致远程DoS（拒绝式服务）攻击", "url": "https://www.freebuf.com/news/63608.html", "time": "2015-04-13", "level": "", "num_look": 173573, "num_comment": 8, "author": "codename2015", "tags": ["漏洞", "资讯"], "text": "卡巴斯基研究人员在Apple OS X及iOS操作系统的开源组件Darwin内核中发现一个漏洞Darwin Nuke。该漏洞可导致OS X 10.10以及iOS 8设备受到远程DoS攻击，损害用户设备，并对与之联网的企业网络产生影响。"}
{"title": "解析Joomla GoogleMap插件“反射”式DDoS攻击", "url": "https://www.freebuf.com/articles/web/63565.html", "time": "2015-04-13", "level": "金币+3", "num_look": 334231, "num_comment": 3, "author": "ArkTeam", "tags": ["WEB安全", "网络安全"], "text": "Joomla GoogleMap插件允许服务器作为代理，去请求第三方（攻击目标）的页面内容。这种攻击中“反射”的概念与以往不同，以往的“反射”是指针对于UDP协议，通过修改源IP地址的方法来反射，因此需要很高的系统权限。"}
{"title": "ShellShock（破壳）漏洞余威不减：新ShellShock蠕虫扫描大量脆弱主机展开攻击", "url": "https://www.freebuf.com/news/63628.html", "time": "2015-04-13", "level": "", "num_look": 143338, "num_comment": 4, "author": "codename2015", "tags": ["资讯"], "text": "ShellShock爆发于2014年9月，而时至今日其余威仍在。本周安全研究人员发现了一个恶意活动通过大量存在Bash Shellshock（破壳）漏洞的主机展开攻击。"}
{"title": "企业安全策略越大越好？Facebook CEO扎克伯格给了几点建议", "url": "https://www.freebuf.com/news/63650.html", "time": "2015-04-13", "level": "", "num_look": 198457, "num_comment": 9, "author": "codename2015", "tags": ["观点", "资讯"], "text": "谈到企业安全，大多数管理者都认为一定越大越好——预算更多、范围更广、回报更大。"}
{"title": "事件跟踪：算算“超级加农炮（The Great Cannon）”的成本有多少？", "url": "https://www.freebuf.com/news/63676.html", "time": "2015-04-13", "level": "金币+3", "num_look": 348096, "num_comment": 16, "author": "江湖小吓", "tags": ["其他", "头条"], "text": "最近大家对美国媒体提出的“超级加农炮”议论纷纷。我们不禁疑惑，一个如此巨型的攻击系统建设成本如何？"}
{"title": "利用合法证书签名的恶意软件攻陷俄罗斯金融企业", "url": "https://www.freebuf.com/news/63619.html", "time": "2015-04-13", "level": "", "num_look": 177381, "num_comment": 7, "author": "codename2015", "tags": ["系统安全", "资讯"], "text": "安全研究人员发现一个活跃时间已超过一年且很可能以经济利益为目的的恶意活动，利用复杂的感染技巧攻陷了属于俄罗斯及乌克兰金融企业的计算机系统。"}
{"title": "ISIS对法国电视台攻击中使用了恶意软件Kjw0rm", "url": "https://www.freebuf.com/news/63613.html", "time": "2015-04-12", "level": "", "num_look": 160297, "num_comment": 3, "author": "codename2015", "tags": ["资讯"], "text": "ISIS黑客在针对法国电视台TV5Monde的攻击中使用了恶意软件Kjw0rm。攻击者设法控制了电视台网络的系统及社交媒体账号，干扰电视台的11个频道并利用公司的社交媒体账号发布威胁及敏感信息。"}
{"title": "美媒：中国拥有强大的电子战武器“超级加农炮（The Great Cannon）”", "url": "https://www.freebuf.com/news/63632.html", "time": "2015-04-11", "level": "金币+6", "num_look": 763701, "num_comment": 39, "author": "Conermx", "tags": ["资讯"], "text": "美国媒体指出，过去三个月发生的事情充分显示，过滤入境流量的防御性的GFW防火墙正逐步演变成进攻性的“大炮”。"}
{"title": "中国警方、政府网站遭遇黑客组织Anonymous（匿名者）攻击", "url": "https://www.freebuf.com/news/63589.html", "time": "2015-04-11", "level": "金币+6", "num_look": 723525, "num_comment": 47, "author": "江湖小吓", "tags": ["资讯"], "text": "近期，全球最大的黑客组织Anonymous（匿名者）攻击了包括湖南警察学院在内的多个中国政府及机构网站，以声援香港“占中”人士。"}
{"title": "不懂DDoS攻击，不敢去卖煎饼", "url": "https://www.freebuf.com/news/63506.html", "time": "2015-04-10", "level": "红色标题", "num_look": 426863, "num_comment": 25, "author": "明明知道", "tags": ["其他", "资讯"], "text": "子曰：不懂DDoS，你还敢去卖煎饼啊？——Classic Joke Friday，周末愉快！"}
{"title": "DwallAv手机间谍木马分析报告", "url": "https://www.freebuf.com/articles/terminal/63458.html", "time": "2015-04-10", "level": "", "num_look": 258661, "num_comment": 6, "author": "360手机卫士", "tags": ["安全报告", "终端安全"], "text": "近期我们团队截获了一款功能强大的专业间谍软件，它可以通过PC端远程控制中招用户的手机，控制指令高达二十多种，窃取用户手机通讯录，短信，照片及其它重要隐私数据。"}
{"title": "法国电视台TV5Monde遭遇ISIS的大规模网络攻击", "url": "https://www.freebuf.com/news/63493.html", "time": "2015-04-10", "level": "", "num_look": 176750, "num_comment": 4, "author": "fber", "tags": ["资讯"], "text": "周三晚，法国电视台TV5Monde遭到来自ISIS拥护者、黑客组织Cyber Caliphate的大规模网络攻击，攻击者入侵了电视台的广播传输渠道，劫持了TV5Monde官方网站和社交媒体账号。"}
{"title": "网络间谍战：叙利亚电子军（SEA）入侵多名反政府人士的电子邮箱", "url": "https://www.freebuf.com/news/63373.html", "time": "2015-04-10", "level": "", "num_look": 123631, "num_comment": 4, "author": "江湖小吓", "tags": ["资讯"], "text": "今天小编要和大家谈谈之前Lorenzo Francesco Bicchierai在motherboard上发表的一篇关于叙利亚电子军（SEA）发动一场对抗叙利亚政府反对者的间谍活动的文章。"}
{"title": "黑客利用远控程序AlienSpy传播银行木马", "url": "https://www.freebuf.com/news/63478.html", "time": "2015-04-10", "level": "", "num_look": 176922, "num_comment": 5, "author": "Sphinx", "tags": ["资讯"], "text": "攻击者们利用AlienSpy远控木马控制“肉鸡”以传播银行木马Citadel，并通过植入后门保持攻击的持久性。“肉鸡”分布在各个行业，包括能源公用事业、金融服务、政府执法部门和科技公司。"}
{"title": "安全科普：看视频理解Web应用安全漏洞TOP10（IBM内部视频）", "url": "https://www.freebuf.com/vuls/63426.html", "time": "2015-04-10", "level": "红色标题", "num_look": 684796, "num_comment": 19, "author": "明明知道", "tags": ["WEB安全", "头条"], "text": "IBM安全团队围绕OWASP TOP10安全漏洞进行了详尽的攻防演示。这批视频最初仅供IBM内部使用。"}
{"title": "渗透测试神器Burp Suite v1.6.12破解版下载", "url": "https://www.freebuf.com/sectool/63469.html", "time": "2015-04-09", "level": "金币+6", "num_look": 731195, "num_comment": 42, "author": "langyajiekou", "tags": ["工具"], "text": "Burp Suite 是用于渗透测试web 应用程序的集成平台。v1.6.12版修复了多个bug及功能特性。"}
{"title": "流行WordPress缓存插件WP-Super-Cache曝高危安全漏洞", "url": "https://www.freebuf.com/news/63393.html", "time": "2015-04-09", "level": "", "num_look": 232748, "num_comment": 3, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "流行WordPress缓存插件WP-Super-Cache近日曝出高危漏洞，攻击者可在页面中注入恶意代码，这使得数百万WordPress网站处于危险之中。"}
{"title": "恶意代码分析：台湾官方版英雄联盟LoL和流亡黯道PoE被植入远控工具PlugX", "url": "https://www.freebuf.com/vuls/63151.html", "time": "2015-04-09", "level": "金币+6", "num_look": 362389, "num_comment": 21, "author": "hellotong", "tags": ["漏洞", "系统安全"], "text": "HITCON黑客大会上披露台湾官方版英雄联盟LoL和流亡黯道PoE被植入新型远程控制工具 (RAT) PlugX"}
{"title": "提权广告件PermAd分析报告", "url": "https://www.freebuf.com/articles/network/63217.html", "time": "2015-04-09", "level": "", "num_look": 323203, "num_comment": 10, "author": "AVLTeam", "tags": ["安全报告", "网络安全"], "text": "近期，AVL移动安全团队在GooglePlay应用市场发现一款名为POPBIRD的游戏应用（现已下架），一旦安装，该应用就会立即弹出三只活泼可爱的小鸟图标，迅速调动用户启动该应用的欲望。"}
{"title": "浅谈移动支付的安全问题", "url": "https://www.freebuf.com/vuls/63227.html", "time": "2015-04-09", "level": "", "num_look": 334392, "num_comment": 5, "author": "dawner", "tags": ["漏洞", "观点"], "text": "移动支付过程中，其中部分层面是有一定安全保障的。比如，近距离无线通信技术（NFC）的普及，就意味着我们可以淘汰实体信用卡。事实上，黑客仍然可以通过移动支付的缺陷，夺取用户的数据。成功与否，取决于供应商的…"}
{"title": "使用CommView for WiFi抓取无线报文", "url": "https://www.freebuf.com/sectool/63360.html", "time": "2015-04-09", "level": "金币+6", "num_look": 1650084, "num_comment": 41, "author": "pklpkl0", "tags": ["工具", "无线安全"], "text": "无线的使用已经越来越广泛，咖啡厅、图书馆，甚至洗手间都有无线覆盖。GOD!希望各个厂家的无线射频都达标，对人体无害，要不然。。。。"}
{"title": "2014互联网金融安全漏洞分析报告", "url": "https://www.freebuf.com/news/62730.html", "time": "2015-04-09", "level": "金币+10", "num_look": 285004, "num_comment": 13, "author": "NSTRT", "tags": ["WEB安全", "头条"], "text": "NSTRT团队收集了在2014年互联网金融行业中大量的安全漏洞报告，并对漏洞类型和数量做了统计和分析。"}
{"title": "让以色列从互联网版图中消失：揭秘Anonymous（匿名者）#OpIsrael计划", "url": "https://www.freebuf.com/news/63273.html", "time": "2015-04-09", "level": "", "num_look": 236236, "num_comment": 22, "author": "鸢尾", "tags": ["头条", "资讯"], "text": "这一切，就是匿名者组织发动的以色列网络空间制裁计划——#OpIsrael。"}
{"title": "安全扫描器Netsparker 4 破解版下载", "url": "https://www.freebuf.com/sectool/63352.html", "time": "2015-04-08", "level": "金币+10", "num_look": 649113, "num_comment": 22, "author": "寒剑", "tags": ["工具"], "text": "本文提供的破解方式仅供软件试用，请于24小时内删除"}
{"title": "CNN：俄罗斯黑客攻入美国白宫", "url": "https://www.freebuf.com/news/63308.html", "time": "2015-04-08", "level": "", "num_look": 223822, "num_comment": 18, "author": "明明知道", "tags": ["资讯"], "text": "本周二CNN称，近几个月俄罗斯背景的黑客成功入侵了白宫的非机密电脑系统，并窃取了包括奥巴马的通信、日程安排等非公开敏感信息。"}
{"title": "AwSnap：让全版本（Windows、iOS、Android）Chrome浏览器崩溃的有趣漏洞", "url": "https://www.freebuf.com/news/63233.html", "time": "2015-04-08", "level": "金币+10", "num_look": 341924, "num_comment": 20, "author": "dawner", "tags": ["漏洞", "资讯"], "text": "现在，我们又有了一个更有趣的漏洞。黑客用它可以让你Chrome 41的浏览器崩溃，而且不仅限于Mac系统啦！"}
{"title": "游族网络（上市公司）招聘信息安全批量岗位", "url": "https://www.freebuf.com/jobs/63212.html", "time": "2015-04-08", "level": "", "num_look": 177350, "num_comment": 24, "author": "伯松", "tags": ["安全招聘"], "text": "游族网络成立于2009年，是一家立足游戏研发、全球发行及相关产业经营发展的轻游戏互动娱乐企业，现有员工1000多人。"}
{"title": "﻿戴尔支持软件（Dell System Detect）存在安全漏洞，可被远程执行恶意代码", "url": "https://www.freebuf.com/news/63259.html", "time": "2015-04-08", "level": "", "num_look": 235775, "num_comment": 4, "author": "fber", "tags": ["漏洞", "资讯"], "text": "​预装在戴尔电脑上的支持软件Dell System Detect被发现存在漏洞， 允许攻击者远程执行恶意代码。System Detect是戴尔系统捆绑式的一个软件，只要系统启动，它就会随之自动启动。"}
{"title": "“瘦男孩”（Lanker-Boy）木马分析报告", "url": "https://www.freebuf.com/vuls/63205.html", "time": "2015-04-08", "level": "", "num_look": 446418, "num_comment": 36, "author": "360安全", "tags": ["数据安全", "漏洞"], "text": "网购木马“瘦男孩”（Lanker-Boy）通过篡改支付订单数据，以达到劫持受害网友交易资金的目的，国内已有约百万台电脑受到该木马家族的威胁。"}
{"title": "走近科学：剥开层层迷雾，深度追踪针对GitHub的DDoS攻击", "url": "https://www.freebuf.com/news/topnews/63148.html", "time": "2015-04-08", "level": "金币+10", "num_look": 855017, "num_comment": 41, "author": "WinterIsComing", "tags": ["头条", "网络安全"], "text": "就在几周前，GitHub 网站遭受了有史以来最严重的DDoS攻击。本文中将使用http-traceroute来深入分析此次攻击的来源。"}
{"title": "对话斯诺登：美国人，请继续拍照吧", "url": "https://www.freebuf.com/news/63152.html", "time": "2015-04-08", "level": "", "num_look": 166289, "num_comment": 5, "author": "明明知道", "tags": ["头条", "观点"], "text": "“你们不应该因为政府所犯的错误而改变你自己的行为，如果你因为恐惧而牺牲掉自己的价值观，你就是真的不在乎你的价值观。”"}
{"title": "从零开始学Android应用安全测试（Part4）", "url": "https://www.freebuf.com/news/topnews/63125.html", "time": "2015-04-07", "level": "金币+10", "num_look": 399772, "num_comment": 13, "author": "鸢尾", "tags": ["头条", "终端安全"], "text": "在本节内容中，我们会介绍一款分析安卓应用略屌的工具，在上一节内容我们就已经提及过了，他就是Drozer。"}
{"title": "恶意金融活动（The Dyre Wolf）：窃取企业超过100万美元的银行存款", "url": "https://www.freebuf.com/news/63130.html", "time": "2015-04-07", "level": "", "num_look": 141552, "num_comment": 1, "author": "hujias", "tags": ["资讯"], "text": "​安全研究员最近披露了一个较为活跃的恶意金融活动，攻击者已成功从各企业银行账户中窃取了超过100万美元银行存款。据知此次活动使用的主要把戏有钓鱼邮件、恶意程序和社会工程学。"}
{"title": "土耳其政府以“宣传恐怖主义”为由封锁Twitter、Facebook和YouTube", "url": "https://www.freebuf.com/news/63113.html", "time": "2015-04-07", "level": "", "num_look": 198723, "num_comment": 16, "author": "明明知道", "tags": ["资讯"], "text": "自本月6日起， 土耳其政府因近日社交媒体上疯传的一组恐怖组织枪杀人质照片而下令封锁包括Twitter、Facebook和YouTube在内的166个网站。"}
{"title": "新手教程：利用ubuntu 14.04+apache+modsecurity实现云WAF", "url": "https://www.freebuf.com/articles/web/63076.html", "time": "2015-04-07", "level": "现金奖励", "num_look": 465063, "num_comment": 23, "author": "yangxiaocheng", "tags": ["WEB安全", "无线安全"], "text": "近年来，云计算的热潮推动着IT行业的发展,很多企业的产品或服务都在尽力与云“挂钩”。其中，在国内外信息安全市场中，也多了一个新的概念，就是“云WAF”。"}
{"title": "BitTorrent Sync （点对点文件同步系统）上存在高危命令注入漏洞", "url": "https://www.freebuf.com/news/63100.html", "time": "2015-04-07", "level": "", "num_look": 190662, "num_comment": 6, "author": "fber", "tags": ["资讯"], "text": "据惠普0day计划（ZDI）于上周发布的公告称，BitTorrent Sync上存在一个高危漏洞，攻击者可远程执行任意代码。"}
{"title": "未发现后门：开源加密软件TrueCrypt安全审计结束", "url": "https://www.freebuf.com/news/62990.html", "time": "2015-04-06", "level": "金币+10", "num_look": 253599, "num_comment": 8, "author": "Sphinx", "tags": ["资讯"], "text": "此次NCC的审计人员日前发表了一份长达21页的公开报告，公开了对TrueCrypt的随机数生成程序和关键密钥算法等加密方法的检查结果。"}
{"title": "SEED实验系列：ShellShock攻击实验", "url": "https://www.freebuf.com/articles/network/62622.html", "time": "2015-04-05", "level": "金币+4", "num_look": 502009, "num_comment": 7, "author": "小猴子", "tags": ["网络安全"], "text": "2014年9月24日，Bash中发现了一个严重漏洞shellshock，该漏洞可用于许多系统，并且既可以远程也可以在本地触发。在本实验中，学生需要亲手重现攻击来理解该漏洞，并回答一些问题。"}
{"title": "白帽子发现YouTube任意视频删除漏洞，谷歌奖励5000美金", "url": "https://www.freebuf.com/news/62933.html", "time": "2015-04-03", "level": "金币+4", "num_look": 558042, "num_comment": 49, "author": "明明知道", "tags": ["漏洞", "资讯"], "text": "俄罗斯安全研究员Kamil Hismatullin近日发现YouTube存在逻辑漏洞，通过该漏洞，用户可删除YouTube中的任意视频。在将漏洞提交官方后，Hismatullin获得了谷歌5000美元的奖金。"}
{"title": "谷歌和火狐浏览器将不再信任中国CNNIC数字证书", "url": "https://www.freebuf.com/news/62938.html", "time": "2015-04-03", "level": "金币+4", "num_look": 430371, "num_comment": 35, "author": "fber", "tags": ["资讯"], "text": "谷歌Chrome和Mozilla火狐浏览器（FireFox）近日宣布，将不再信任中国互联网信息中心（CNNIC）数字证书。"}
{"title": "硅谷遇上底特律：2015美国汽车安全峰会参展纪实（多图杀猫）", "url": "https://www.freebuf.com/news/topnews/62515.html", "time": "2015-04-03", "level": "金币+4", "num_look": 320558, "num_comment": 9, "author": "tofreebug", "tags": ["头条", "活动"], "text": "底特律，美国汽车之都。2015 Automotive Cyber Security Summit汽车网络安全峰会就在这里举行。2000美元一张的门票价格，足以秒杀为了免费拿展商纪念品给小孩做玩具同时又能请假参会不用上班的人群。"}
{"title": "从零开始学Android应用安全测试（Part3）", "url": "https://www.freebuf.com/news/topnews/62750.html", "time": "2015-04-03", "level": "", "num_look": 354624, "num_comment": 8, "author": "鸢尾", "tags": ["头条", "终端安全"], "text": "在本节中内容中，我们将看看如何对安卓应用程序中的组件进行攻击测试。"}
{"title": "国际评测机构AV-C公布安卓系统移动安全软件报告", "url": "https://www.freebuf.com/news/62866.html", "time": "2015-04-03", "level": "", "num_look": 212321, "num_comment": 4, "author": "phper", "tags": ["安全报告", "资讯"], "text": "近日，AV-C公布了2015年2月安卓系统（手机及平板电脑）杀毒软件测试报告。"}
{"title": "FreeBuf全球安全事件纵览（2015年第一季度）：一年之计在于春", "url": "https://www.freebuf.com/news/62564.html", "time": "2015-04-03", "level": "红色标题", "num_look": 370987, "num_comment": 17, "author": "明明知道", "tags": ["其他", "头条"], "text": "“一年之计在于春，当万物复苏，黑客们自然也不例外。”小编搜集了大量2015年Q1全球范围内发生的安全事件与漏洞，精心梳理为笔记，希望对关注安全领域的你有所帮助。"}
{"title": "深信服绝对高薪招聘安全人才", "url": "https://www.freebuf.com/jobs/62712.html", "time": "2015-04-03", "level": "", "num_look": 468507, "num_comment": 72, "author": "48093736", "tags": ["安全招聘"], "text": "企业网络安全领导商–深信服科技成立于2000年，是中国最大的新网络产品供应商，是国内企业网络安全领域的领头羊。"}
{"title": "一不留神就被别人当枪使的年代", "url": "https://www.freebuf.com/articles/network/62829.html", "time": "2015-04-03", "level": "金币+4", "num_look": 397406, "num_comment": 13, "author": "不是养蚕人", "tags": ["网络安全"], "text": "已经想不起什么时候我们竟然习惯了小心翼翼地浏览网页，习惯了去时刻提防各种各样的诱骗。"}
{"title": "PHP任意文件上传漏洞（CVE-2015-2348）", "url": "https://www.freebuf.com/vuls/62811.html", "time": "2015-04-02", "level": "金币+4", "num_look": 851025, "num_comment": 39, "author": "Conermx", "tags": ["WEB安全", "漏洞"], "text": "这个漏洞可以绕过你对文件名后缀、文件类型(Content-Type)、Mime type、文件大小等的检查，所以仅仅依靠这些检查是救不了你的。"}
{"title": "安恒信息安全研究院招聘", "url": "https://www.freebuf.com/jobs/62744.html", "time": "2015-04-02", "level": "", "num_look": 277640, "num_comment": 18, "author": "安恒信息", "tags": ["安全招聘"], "text": "加入安恒信息安全研究院：自由发挥空间大，多样的发展路线；高薪机会，多劳多得；团队配合，更好绩效！"}
{"title": "Java官网曝本地文件包含（LFI）漏洞，可读取超过460位Oracle公司员工邮箱", "url": "https://www.freebuf.com/news/62764.html", "time": "2015-04-02", "level": "", "num_look": 311027, "num_comment": 10, "author": "fber", "tags": ["漏洞", "资讯"], "text": "意大利安全研究人员Christian Galeone最近发现一枚Java官网存在的重大安全漏洞，该漏洞可读取网站敏感数据，包括超过460位Oracle公司员工的邮箱。"}
{"title": "奥巴马颁布行政命令：严厉制裁海外黑客，可先斩后奏", "url": "https://www.freebuf.com/news/62735.html", "time": "2015-04-02", "level": "红色标题", "num_look": 481201, "num_comment": 84, "author": "明明知道", "tags": ["资讯"], "text": "“从现在起，我们有权冻结他们的资产。”——4月1号，美国总统巴拉克·奥巴马签署了新的行政命令：任何对美国进行网络攻击的人，都将受到行政制裁。"}
{"title": "“黑狐”木马详细分析", "url": "https://www.freebuf.com/articles/system/62663.html", "time": "2015-04-02", "level": "", "num_look": 217639, "num_comment": 24, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "“黑狐”木马变种繁多，本文通过对“黑狐”木马多个版本的分析对比，来探究当前主流木马在对抗杀软技术、传播渠道、获利方式上的一些特征和线索，也为预知和防御新的变种寻找思路。"}
{"title": "总结Web应用中基于浏览器的安全漏洞", "url": "https://www.freebuf.com/vuls/61872.html", "time": "2015-04-02", "level": "金币+4", "num_look": 295099, "num_comment": 10, "author": "鸢尾", "tags": ["WEB安全", "漏洞"], "text": "Web浏览器或者手机浏览器都是在用户与互联网之间充当着中介者的角色，随着用户越来越多，渐渐的各大浏览器也就成为了黑客攻击的目标。源码中哪怕是一点点小错误，也可能会导致浏览器被黑客利用。"}
{"title": "利用QQ昵称反弹连接木马技术分析", "url": "https://www.freebuf.com/articles/system/62481.html", "time": "2015-04-02", "level": "金币+4", "num_look": 314083, "num_comment": 21, "author": "shadowhunter", "tags": ["系统安全"], "text": "安全研究人员最近发现KRBanker家族新变种,其利用腾讯QQ空间的接口获取反弹连接IP，劫持本机DNS，拦截韩国银行网站钓鱼。本文将对其进行详细的分析。"}
{"title": "伪基站与网络钓鱼的结合利用测试及结果分析", "url": "https://www.freebuf.com/articles/wireless/62535.html", "time": "2015-04-02", "level": "金币+8", "num_look": 679796, "num_comment": 11, "author": "legendsec", "tags": ["无线安全", "网络安全"], "text": "“伪基站”即假基站，设备一般由主机和笔记本电脑组成，通过短信群发器、短信发信机等相关设备能够搜取以其为中心、一定半径范围内的手机卡信息，通过伪装成运营商的基站，冒用他人手机号码强行向用户手机发送诈骗、…"}
{"title": "MOSEC移动安全技术峰会即将召开", "url": "https://www.freebuf.com/news/62798.html", "time": "2015-04-02", "level": "", "num_look": 104768, "num_comment": 104768, "author": "fber", "tags": ["资讯"], "text": "MOSEC移动安全技术峰会由盘古团队和POC共同主办，将于2015年6月5日在中国上海举行，旨在打造移动安全技术的饕餮盛宴。"}
{"title": "匿名者（Anonymous）组织再发声：将对以色列发动“电子大屠杀“", "url": "https://www.freebuf.com/news/62660.html", "time": "2015-04-01", "level": "金币+8", "num_look": 348311, "num_comment": 26, "author": "Rechange", "tags": ["资讯"], "text": "近日全球最大的黑客组织匿名者（Anonymous）发表声明，称将对以色列发动“电子大屠杀”，以将其彻底的从网络空间中清除。"}
{"title": "MongoDB修复一个可被远程利用的DoS（拒绝服务）漏洞", "url": "https://www.freebuf.com/news/62623.html", "time": "2015-04-01", "level": "", "num_look": 182374, "num_comment": 6, "author": "明明知道", "tags": ["漏洞", "资讯"], "text": "广受欢迎的NoSQL数据库MongoDB近日修复了一个严重并且可被远程利用的拒绝服务（DoS）漏洞。该漏洞利用原理是一个会频繁造成数据库崩溃的正则表达式，攻击者可以以此对MongoDB数据库进行远程打击。"}
{"title": "SEED实验系列：格式化字符串漏洞实验", "url": "https://www.freebuf.com/articles/network/62473.html", "time": "2015-04-01", "level": "", "num_look": 458225, "num_comment": 6, "author": "小猴子", "tags": ["网络安全"], "text": "格式化字符串漏洞是由像printf(user_input)这样的代码引起的，本实验将会提供一个具有格式化漏洞的程序，我们将制定一个计划来探索这些漏洞。"}
{"title": "专业窃取能源行业机密的木马Laziok", "url": "https://www.freebuf.com/news/62555.html", "time": "2015-04-01", "level": "", "num_look": 177096, "num_comment": 3, "author": "codename2015", "tags": ["系统安全", "资讯"], "text": "安全研究人员在今年1月份至2月份期间发现一款专门窃取全球能源企业机密的木马Laziok，它们的目标主要是中东地区。"}
{"title": "针对某电商网站流量劫持案例分析与思考", "url": "https://www.freebuf.com/vuls/62561.html", "time": "2015-04-01", "level": "", "num_look": 826964, "num_comment": 50, "author": "腾讯安全平台部", "tags": ["漏洞"], "text": "笔者一般网上购物喜欢用京东。某天在家里访问京东首页的时候突然吃惊地发现浏览器突然跳到了第三方网站再回到京东，心里第一个反应就是中木马了。"}
{"title": "英国犯人利用网络社工成功越狱", "url": "https://www.freebuf.com/news/62550.html", "time": "2015-04-01", "level": "金币+8", "num_look": 186236, "num_comment": 24, "author": "codename2015", "tags": ["资讯"], "text": "最近一个名为Neil Moore的28岁英国犯人利用网络，精心策划了一场逃跑计划，成功骗过监狱官员，将自己释放。"}
{"title": "【Freebuf视频】《FreeBuf人物志》专访360无线安全专家杨卿：登上央视315舞台的假面黑客", "url": "https://www.freebuf.com/video/62160.html", "time": "2015-04-01", "level": "红色标题", "num_look": 472037, "num_comment": 27, "author": "明明知道", "tags": ["人物志", "视频"], "text": "登上315晚会，又同是Freebuf粉的360公司Unicorn Team负责人杨卿（后文简称“卿”，感觉萌萌哒），对于后315时代“免费wifi不安全”这种被疯传的观点怎么看？卿隐藏黑色面具下的颜值究竟如何，你确定你不好奇么！"}
{"title": "数据告诉你：两周时间，你的GPS位置信息被发送了5398次", "url": "https://www.freebuf.com/news/62441.html", "time": "2015-04-01", "level": "金币+8", "num_look": 176226, "num_comment": 21, "author": "Sphinx", "tags": ["资讯"], "text": "你知不知道你的手机把你的位置信息发送给各种公司的频率如何？答案是：2周时间，超过5000次。"}
{"title": "叙利亚电子军（SEA）攻击五大主机托管公司", "url": "https://www.freebuf.com/news/62491.html", "time": "2015-03-31", "level": "", "num_look": 157559, "num_comment": 6, "author": "Rechange", "tags": ["资讯"], "text": "叙利亚电子军（SEA）近日对Bluehost、Hostmonster在内的流行主机托管商发动了攻击，入侵并劫持了主机商的管理后台及官方Twitter账号。"}
{"title": "FreeBuf公开课：轻松的方式科普什么是DDoS（分布式拒绝攻击）", "url": "https://www.freebuf.com/news/topnews/62428.html", "time": "2015-03-31", "level": "红色标题", "num_look": 373860, "num_comment": 9, "author": "FB视频", "tags": ["头条", "视频"], "text": "本课程适合于对安全领域有兴趣或刚入门的初学者。书本或其他资料中对DDoS的描述不免晦涩和乏味，了解DDOS不一定要循规蹈矩，换个角度、以轻松的方式走近DDoS，可能更能让我们茅塞顿开。"}
{"title": "本地文件包含（LFI）漏洞检测工具 - Kadimus", "url": "https://www.freebuf.com/sectool/62404.html", "time": "2015-03-31", "level": "", "num_look": 260567, "num_comment": 3, "author": "phper", "tags": ["工具"], "text": "Kadimus是一个用于检测网站本地文件包含（LFI）漏洞的安全工具。"}
{"title": "万达、步步高等知名企业中枪：代码托管平台GitHub泄露企业机密数据", "url": "https://www.freebuf.com/news/62028.html", "time": "2015-03-31", "level": "红色标题", "num_look": 910847, "num_comment": 12, "author": "漏洞盒子", "tags": ["其他", "头条"], "text": "在公共场所小声说话是为了避免私密的谈话被他人听见，但是在互联网上的“公共场所”——程序员最爱的代码托管平台GitHub，技术小哥们是不是也该注意下，别啥都上传了？"}
{"title": "关于SSL/TLS最新漏洞“受戒礼”初步报告", "url": "https://www.freebuf.com/articles/network/62442.html", "time": "2015-03-31", "level": "金币+8", "num_look": 1956936, "num_comment": 9, "author": "NSTRT", "tags": ["网络安全"], "text": "直到2015年3月，还有约30%的网络通信是由RC4进行保护的。通过“受戒礼”攻击，攻击者可以在特定环境下只通过嗅探监听就可以还原采用RC4保护的加密信息中的纯文本，导致账户、密码、信用卡信息等重要敏感信息暴露。"}
{"title": "SEED实验：缓冲区溢出漏洞实验", "url": "https://www.freebuf.com/articles/network/62373.html", "time": "2015-03-31", "level": "金币+8", "num_look": 677267, "num_comment": 18, "author": "小猴子", "tags": ["网络安全"], "text": "缓冲区溢出漏洞可以被恶意用户利用来改变程序的流控制，甚至执行代码的任意片段。本课程所涉及的实验来自Syracuse SEED labs，并在此基础上为适配实验楼网站环境进行修改。"}
{"title": "RevSlider插件漏洞导致大量WordPress网站被黑", "url": "https://www.freebuf.com/news/62328.html", "time": "2015-03-31", "level": "", "num_look": 334482, "num_comment": 1, "author": "Sphinx", "tags": ["资讯"], "text": "大量攻击者利用Slider Revolution（RevSlider，WordPress常用幻灯片插件）的已知漏洞攻陷了全球范围内至少3,000个WordPress网站。"}
{"title": "更自动、更易用：安全扫描器Netsparker 4新版发布", "url": "https://www.freebuf.com/sectool/62395.html", "time": "2015-03-30", "level": "红色标题", "num_look": 646504, "num_comment": 36, "author": "phper", "tags": ["工具"], "text": "近日Netsparker发布了新版4.0，新版最大的亮点就是安全扫描的自动化程度更高了！安全测试时你不再需要录制登录信息，同时其还支持双因素认证。"}
{"title": "一起聊聊：那些让安全工程师抓狂的逗比用户", "url": "https://www.freebuf.com/news/topnews/62246.html", "time": "2015-03-30", "level": "金币+8", "num_look": 178237, "num_comment": 8, "author": "codename2015", "tags": ["其他", "头条"], "text": "作为一名安全专家，有时候你只能双手捂脸痛哭；不过有时候人们干的那些将企业置于风险境地的事儿又会让你惊得下巴都能掉下来。下面就是这样一些基于真实生活的场景。"}
{"title": "每个账户1 - 5美元：Uber账户和密码正在“暗网”黑市售卖", "url": "https://www.freebuf.com/news/62330.html", "time": "2015-03-30", "level": "金币+8", "num_look": 220810, "num_comment": 5, "author": "Sphinx", "tags": ["资讯"], "text": ""}
{"title": "一款隐藏嵌入式Rookit的DDoS木马分析", "url": "https://www.freebuf.com/articles/system/58836.html", "time": "2015-03-30", "level": "金币+8", "num_look": 477443, "num_comment": 9, "author": "xia0k", "tags": ["系统安全", "网络安全"], "text": "该款木马分析文章在2015年由@PETER KÁLNAI 最先发表于AVAST的公开blog中，木马的架构严谨，设计精良，应该是产业化的一部分。"}
{"title": "如何找出Timsort算法和玉兔月球车中的Bug？", "url": "https://www.freebuf.com/vuls/62129.html", "time": "2015-03-30", "level": "现金奖励", "num_look": 689778, "num_comment": 38, "author": "bindog", "tags": ["其他", "漏洞"], "text": "航空航天技术历来都是国家综合实力的一个重要表现，大家都是不计成本的往里砸钱……当然航空航天技术同时也以高风险著称，一个小零件故障也有可能造成严重后果，所以哪怕多花点钱能提高1%的安全性也是值得的。"}
{"title": "受诫礼攻击：SSL/TLS又曝新漏洞，可明文读取传输数据", "url": "https://www.freebuf.com/news/62301.html", "time": "2015-03-29", "level": "金币+8", "num_look": 594250, "num_comment": 12, "author": "Sphinx", "tags": ["漏洞", "资讯"], "text": "研究人员最近了曝出一个名为“受诫礼”的新型攻击手段，能够窃取通过SSL和TLS协议传输的机密数据。"}
{"title": "极客DIY：只用两步教你制作一款可编程键盘", "url": "https://www.freebuf.com/news/topnews/62269.html", "time": "2015-03-29", "level": "", "num_look": 887406, "num_comment": 18, "author": "Rechange", "tags": ["头条", "极客"], "text": "对于那些工作时需要与许多组合键打交道的人（比如经常使用Photoshop的人）来说，一款可编程键盘无疑是十分实用的。"}
{"title": "GitHub遭遇大流量DDoS攻击，百度否认与其有关", "url": "https://www.freebuf.com/news/62288.html", "time": "2015-03-28", "level": "红色标题", "num_look": 646428, "num_comment": 44, "author": "fu4k", "tags": ["资讯"], "text": "昨日开始，有用户指出百度联盟广告被植入攻击代码，不过该说法遭到了百度官方的否认。截至今日，针对GitHub的DDoS攻击仍未停止。"}
{"title": "北京、上海在内的全球数百家连锁酒店InnGate无线路由器存在严重安全漏洞", "url": "https://www.freebuf.com/news/62198.html", "time": "2015-03-28", "level": "", "num_look": 191135, "num_comment": 6, "author": "明明知道", "tags": ["漏洞", "资讯"], "text": "北京、上海在内的全球数百家连锁酒店的无线路由器存在安全漏洞，攻击者能够得到酒店监控和文档数据、向酒店顾客传播计算机病毒，甚至可以进入酒店预约和控制门禁出入系统。"}
{"title": "拒绝模特、拒绝香艳：今年RSA安全会议明确参展商“着装要求”", "url": "https://www.freebuf.com/news/62261.html", "time": "2015-03-28", "level": "", "num_look": 130150, "num_comment": 7, "author": "codename2015", "tags": ["资讯"], "text": "今年RSA安全大会与往年与众不同——会务组近日向参展商明确了一件事：不准出现展台女郎。"}
{"title": "高颜值、低演技，负分：2015黑客电影《Blackhat》遭吐槽（已更新下载资源）", "url": "https://www.freebuf.com/news/62214.html", "time": "2015-03-27", "level": "红色标题", "num_look": 771632, "num_comment": 37, "author": "cindy", "tags": ["资讯"], "text": "对于这部电影，FreeBuf在去年就有报道，记得当时大家非常期待，因为里面可是有女神汤唯和男神王力宏哦。但是……"}
{"title": "Cisco（思科）半年度补丁日：修复大量IOS漏洞", "url": "https://www.freebuf.com/news/62188.html", "time": "2015-03-27", "level": "", "num_look": 182403, "num_comment": 5, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "思科于本周三发布了操作系统的补丁更新，这是思科固定每半年一次的补丁更新日，下一次更新可能就要等到9月份了。此次总共更新了16个安全漏洞，主要是DOS漏洞和interface wedge漏洞。"}
{"title": "黑客利用PDF生成器窃取WEB服务器上的文件", "url": "https://www.freebuf.com/vuls/62142.html", "time": "2015-03-27", "level": "", "num_look": 212096, "num_comment": 18, "author": "dawner", "tags": ["漏洞"], "text": "TCPDF PDF生成器是当今最流行的用于创建PDF文档的PHP库之一。它每天拥有数百万用户使用量，其载体一般为CMS程序或者其他WEB应用。然而，黑客利用TCPDF的一个漏洞，可以轻松从WEB服务器上窃取文件。"}
{"title": "卡内基梅隆大学研究报告：人们正在被智能手机跟踪", "url": "https://www.freebuf.com/news/62121.html", "time": "2015-03-27", "level": "", "num_look": 131363, "num_comment": 7, "author": "JackFree", "tags": ["资讯"], "text": "​美国卡内基梅隆大学最新研究报告，智能手机及大量的APP正在不断跟踪我们的行迹，它们几乎每3分钟就会请求我们的GPS位置信息。这些数据收集的热潮导致了一个惊人的结果：我们已被智能手机监视。"}
{"title": "利用Instagram API制造“以假乱真”的恶意分享链接", "url": "https://www.freebuf.com/news/62102.html", "time": "2015-03-27", "level": "", "num_look": 240018, "num_comment": 2, "author": "JackFree", "tags": ["WEB安全", "漏洞"], "text": "安全研究人员最近发现了一种利用Instagram API形成的恶意分享链接，由于这个链接指向Instagram域名，所以很容易被用户相信并下载。"}
{"title": "解密千万密码：透过密码看人性", "url": "https://www.freebuf.com/news/topnews/62052.html", "time": "2015-03-26", "level": "金币+15", "num_look": 711423, "num_comment": 32, "author": "codename2015", "tags": ["其他", "头条"], "text": "对于密码，我们已经知道了不少。比如，多数密码短小、简单、且容易破解。但我们对一个人选择某个密码的心理原因却所知甚少。在本文中，我们分析了包括企业CEO、科学家在内的1000万人们的密码选择，来看看密码背后所…"}
{"title": "“撕逼大战”第二季：谷歌发现Windows 7和Windows 8.1中存在本地提权和沙盒逃逸漏洞，微软否认", "url": "https://www.freebuf.com/news/62022.html", "time": "2015-03-26", "level": "", "num_look": 184236, "num_comment": 10, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "谷歌安全团队近日发现Windows 7和Windows 8.1中存在本地提权和沙盒逃逸漏洞，遭到微软无情的否认。谷歌将公布漏洞细节及POC。"}
{"title": "在HTML5移动应用中挖掘XSS漏洞", "url": "https://www.freebuf.com/articles/web/61971.html", "time": "2015-03-26", "level": "金币+15", "num_look": 338965, "num_comment": 12, "author": "Conermx", "tags": ["WEB安全"], "text": "Zoho（全球第一大在线软件提供商，总部位于美国）是一个有着1300万用户的HTML5邮件系统，我打算挖挖他们的漏洞。"}
{"title": "揭秘：钓鱼攻击工具包Angler Exploit Kit初探", "url": "https://www.freebuf.com/news/topnews/61942.html", "time": "2015-03-26", "level": "", "num_look": 857791, "num_comment": 18, "author": "阿里安全", "tags": ["WEB安全", "头条"], "text": "Angler EK钓鱼攻击工具包在2013年才出现，短短2年时间，它就成为了野外利用最常用的EK之一，甚至被一些安全研究人员视为目前世界上最先进的EK。"}
{"title": "FreeBuf公开课：Wi-Fi安全与渗透测试（第一集）", "url": "https://www.freebuf.com/video/61962.html", "time": "2015-03-25", "level": "红色标题", "num_look": 478157, "num_comment": 34, "author": "FB视频", "tags": ["视频"], "text": "本课程适合渗透测试人员、安全研究者和网络管理员，课程结构基于全球畅销书《Backtrack 5无线渗透测试》，讲师是BlackHat、Defcon等全球顶尖安全峰会演讲者Vivek Ramachandran。全系列课程内容包括绕过WLAN认证、破…"}
{"title": "腾讯电脑管家招聘安全工程师", "url": "https://www.freebuf.com/jobs/61784.html", "time": "2015-03-25", "level": "", "num_look": 208769, "num_comment": 14, "author": "腾讯电脑管家", "tags": ["安全招聘"], "text": "腾讯公司成立于1998年11月， 是目前中国最大的互联网综合服务提供商之一，也是中国服务用户最多的互联网企业之一。现招聘安全工程师数名。"}
{"title": "Mozilla官方火速修复Pwn2Own比赛上公开的火狐浏览器漏洞", "url": "https://www.freebuf.com/news/61914.html", "time": "2015-03-25", "level": "", "num_look": 126433, "num_comment": 6, "author": "cindy", "tags": ["资讯"], "text": "Mozilla官方在比赛结束之后立即开发补丁，于昨天发布的Firefox 36中修复了此次比赛中公布的2个高危漏洞。"}
{"title": "APP安全分析之丁盯智能门磁", "url": "https://www.freebuf.com/articles/terminal/61789.html", "time": "2015-03-25", "level": "", "num_look": 257741, "num_comment": 7, "author": "joeyxy", "tags": ["终端安全"], "text": "最近刚入手了丁盯智能门磁这个智能家居硬件，它通过硬件和软件app的结合，来监控门的安全性。看到它验证码中只是四位简单的数字，估计其中可能存在安全漏洞，就着手进行了相关的测试。"}
{"title": "日渐突出的智能联网汽车安全风险", "url": "https://www.freebuf.com/news/topnews/61819.html", "time": "2015-03-25", "level": "", "num_look": 174018, "num_comment": 8, "author": "JackFree", "tags": ["其他", "头条"], "text": "最新调查结果显示，智能联网汽车明显缺乏必要的安全措施，黑客完全可以控制联网车辆，或者通过汽车获取司机的个人信息。"}
{"title": "运营商发行的大量路由器包含高危漏洞，大部分“问题路由器”IP位于中国", "url": "https://www.freebuf.com/news/61860.html", "time": "2015-03-25", "level": "", "num_look": 220695, "num_comment": 8, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "据统计，全球的运营商向大众网民发行了至少70万台ADSL路由器，但不幸的是，这些路由器存在高危漏洞，进而很可能会造成大规模路由器攻击活动。值得一提的是，大多数的“问题路由器”IP地址都位于中国。"}
{"title": "技术分析：重打包的安卓应用是如何绕过杀毒软件盗取你QQ的", "url": "https://www.freebuf.com/articles/terminal/61760.html", "time": "2015-03-25", "level": "现金奖励", "num_look": 772317, "num_comment": 17, "author": "ab6326795", "tags": ["终端安全"], "text": "重新打包APK，轻松盗取QQ号！本文的阅读对象是具有一定android开发经验，想进一步提升自我的Android开发人员。"}
{"title": "黑客可通过电脑热量窃取数据（视频）", "url": "https://www.freebuf.com/news/61754.html", "time": "2015-03-25", "level": "金币+15", "num_look": 541549, "num_comment": 24, "author": "Rechange", "tags": ["视频", "资讯"], "text": "气隙系统（Air-gapped）是一种将电脑进行完全隔离以保护数据安全的系统。目前这种系统多使用于要求高度安全的数据保护，例如军事机密网络以及工业控制系统中的关键设施。"}
{"title": "顺丰招聘IT风险管理高级工程师", "url": "https://www.freebuf.com/jobs/61681.html", "time": "2015-03-24", "level": "", "num_look": 209239, "num_comment": 27, "author": "顺丰", "tags": ["安全招聘"], "text": "顺丰速运招聘IT风险管理高级工程师，有兴趣的小伙伴赶紧报名啦！"}
{"title": "累感不爱：Flash补丁发布四年，漏洞依然还是漏洞", "url": "https://www.freebuf.com/news/61788.html", "time": "2015-03-24", "level": "", "num_look": 174980, "num_comment": 5, "author": "明明知道", "tags": ["漏洞", "资讯"], "text": "早在2011年Adobe Flash就发布的安全漏洞补丁至今仍未能奏效，时至今日攻击者依旧可以利用该漏洞进行攻击，Alexa排名前十的热门网站中有三家都受该漏洞的影响。"}
{"title": "小漏洞大影响：来看看希尔顿酒店官网的CSRF漏洞", "url": "https://www.freebuf.com/news/61776.html", "time": "2015-03-24", "level": "", "num_look": 202785, "num_comment": 7, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "世界级连锁酒店——希尔顿酒店官网上曝CSRF（跨站请求伪造）漏洞，虽然CSRF漏洞在大多数安全研究者眼中算不上“高危”，但这枚漏洞的影响可并不小。"}
{"title": "Cisco IP电话曝高危漏洞可致远程窃听", "url": "https://www.freebuf.com/news/61719.html", "time": "2015-03-24", "level": "", "num_look": 171856, "num_comment": 7, "author": "鸢尾", "tags": ["漏洞", "资讯"], "text": "Cisco小型商业电话的固件曝高危漏洞，攻击者可通过该漏洞监听私人电话以及进行远程拨打电话，而且这一系列恶意行为都不需要任何身份验证。"}
{"title": "解密Nuclear漏洞利用工具包中的Flash漏洞加密手段", "url": "https://www.freebuf.com/sectool/61716.html", "time": "2015-03-24", "level": "金币+4", "num_look": 223630, "num_comment": 4, "author": "WarHead.Team", "tags": ["工具", "漏洞"], "text": "近年来兴起的Exploit Kit（简称EK）集合了各种漏洞利用工具，可对多种文件格式进行自动化分析、漏洞利用测试。比较有名的EK有Blackhole EK，Phoenix EK，Nuclear EK等。"}
{"title": "南京铱迅招聘安全工程师", "url": "https://www.freebuf.com/jobs/61165.html", "time": "2015-03-24", "level": "", "num_look": 184381, "num_comment": 11, "author": "Yxlink", "tags": ["安全招聘"], "text": "南京铱迅信息技术股份有限公司（简称“铱迅信息”），是一家专业从事信息安全的企业。"}
{"title": "钓鱼Wi-Fi及嗅探测试工具 - 3vilTwinAttacker", "url": "https://www.freebuf.com/sectool/61698.html", "time": "2015-03-24", "level": "", "num_look": 495272, "num_comment": 31, "author": "phper", "tags": ["工具"], "text": "3vilTwinAttacker可以建立一个虚假的钓鱼WiFi，表面上这是一个提供上网服务的正常AP（网络接入点），而实际上它却在不知不觉嗅探获取你的网络流量。"}
{"title": "深入分析擅长“自我保护”的网银木马Dridex", "url": "https://www.freebuf.com/news/topnews/61489.html", "time": "2015-03-24", "level": "", "num_look": 276786, "num_comment": 7, "author": "JackFree", "tags": ["头条", "系统安全"], "text": "这个特殊的Dridex新变种采取了一些自我保护措施：例如添加了一个长密码来防止被分析，程序内部添加了对虚拟机环境的检测功能，使得它一旦它检测到自己运行在虚拟机环境，就能自动退出运行。"}
{"title": "左右互博：站在攻击者的角度来做防护", "url": "https://www.freebuf.com/news/topnews/61508.html", "time": "2015-03-24", "level": "现金奖励", "num_look": 664936, "num_comment": 28, "author": "PgHook", "tags": ["WEB安全", "头条"], "text": "在做防护的过程中，我一直在思考：我如果是攻击者，我会怎么来攻击？另一方面，如果你是防守者，有人绕过了你的种种过滤与防御，你还能高枕无忧么？"}
{"title": "迄今为止最为复杂的PoS系统恶意软件PoSeidon", "url": "https://www.freebuf.com/articles/terminal/61583.html", "time": "2015-03-24", "level": "", "num_look": 293305, "num_comment": 1, "author": "Sphinx", "tags": ["终端安全"], "text": "思科安全解决方案(CSS)的研究人员们最近发现了一款新的针对PoS系统的恶意软件PoSeidon，这款恶意软件极为复杂，被称为是迄今为止最为复杂的PoS恶意软件。"}
{"title": "安全扫描器BugScan插件初写心语", "url": "https://www.freebuf.com/sectool/61601.html", "time": "2015-03-23", "level": "", "num_look": 441456, "num_comment": 15, "author": "kun", "tags": ["工具"], "text": "Bugscan平台是基于Python2.7.X开发，所以为了实现良好的兼容，编写插件的时候所使用的平台也应该为Python 2.7.X。"}
{"title": "WordPress插件Google Analytics by Yoast存储型XSS漏洞（含POC）", "url": "https://www.freebuf.com/vuls/61570.html", "time": "2015-03-23", "level": "", "num_look": 157380, "num_comment": 3, "author": "Sphinx", "tags": ["漏洞"], "text": "WordPress著名插件Google Analytics by Yoast插件中曝出存储型XSS漏洞，该漏洞能够让未被授权的攻击者在WordPress管理面板中存储任何HTML代码，包括JavaScript。"}
{"title": "中国首次公开承认拥有黑客部队", "url": "https://www.freebuf.com/news/61600.html", "time": "2015-03-23", "level": "金币+4", "num_look": 1144233, "num_comment": 53, "author": "JackFree", "tags": ["资讯"], "text": "在近日出版的解放军期刊中，中国首次公开承认在其军事组织中存在特殊信息战争部队，也就是以网络为战场的黑客部队。"}
{"title": "SSH会话劫持实现端口转发", "url": "https://www.freebuf.com/articles/network/61579.html", "time": "2015-03-23", "level": "金币+4", "num_look": 443222, "num_comment": 14, "author": "dawner", "tags": ["网络安全"], "text": "在进行渗透测试时，我们有时候会碰到搭建的测试环境、产品服务器、DMZ，这时我们完全可以把它们看作跳板。这些系统被设计成对外交互的接口，这时候我们考虑对其他域里的用户进行SSH会话劫持是个不错的选择。"}
{"title": "一种强大的新型BIOS Bootkit病毒曝光", "url": "https://www.freebuf.com/news/61478.html", "time": "2015-03-23", "level": "金币+4", "num_look": 725762, "num_comment": 26, "author": "JackFree", "tags": ["系统安全", "资讯"], "text": "​安全研究人员开发出一种新的BIOS bootkit病毒，包括华硕、惠普、宏基、技嘉以及微星等在内的各大供应商的主板都受到该病毒影响。"}
{"title": "最新Flash漏洞现已加入Nuclear漏洞利用工具包", "url": "https://www.freebuf.com/news/61493.html", "time": "2015-03-23", "level": "", "num_look": 302539, "num_comment": 10, "author": "Sphinx", "tags": ["工具", "系统安全"], "text": "趋势科技最新研究发现，Nuclear 漏洞利用（Exp）工具包的最新版本已加入了三月刚刚修复的Flash Player漏洞(CVE-2015-0336)。"}
{"title": "千万别点：13个字符立即崩溃你的Mac版Chrome", "url": "https://www.freebuf.com/news/61497.html", "time": "2015-03-22", "level": "金币+4", "num_look": 481424, "num_comment": 36, "author": "Sphinx", "tags": ["资讯"], "text": "千万别点，更别复制这串字符发微博……"}
{"title": "一根网线发起的攻击", "url": "https://www.freebuf.com/news/topnews/61435.html", "time": "2015-03-20", "level": "金币+15", "num_look": 926674, "num_comment": 77, "author": "ＥtherＤream", "tags": ["头条", "网络安全"], "text": "刚上大学没多久，就遇到件头疼事。富二代们刚来就带着笔记本电脑，这让咱们只能玩手机的屌丝辈们羡慕嫉妒恨。"}
{"title": "横古贯今的隐私密史：密码的前世来生", "url": "https://www.freebuf.com/news/topnews/60808.html", "time": "2015-03-20", "level": "", "num_look": 348129, "num_comment": 12, "author": "Mystery", "tags": ["头条"], "text": "21世纪什么最贵？密（秘）码（密）！"}
{"title": "极客DIY：用树莓派制作低成本高清监控摄像机", "url": "https://www.freebuf.com/news/topnews/61378.html", "time": "2015-03-20", "level": "金币+15", "num_look": 1597585, "num_comment": 34, "author": "Rechange", "tags": ["头条", "极客"], "text": "本文将为大家展示一款高清监控摄像机的DIY过程，且相较于其市场价，本次DIY的花费不到其十分之一。另外通过该摄像机，你可以随时从浏览器或者手机中查看监控区域的画面。"}
{"title": "FireEye：11.2%的移动APP仍存在FREAK漏洞", "url": "https://www.freebuf.com/news/61390.html", "time": "2015-03-20", "level": "", "num_look": 302931, "num_comment": 2, "author": "JackFree", "tags": ["漏洞", "终端安全"], "text": "近日美国知名安全公司火眼（FireEye）发布了安全报告，该报告揭示了一个令人不安的事实：虽然官方发布了补丁，但大量的安卓和iOS移动应用仍存RREAK漏洞。"}
{"title": "教你用Python玩转神器Metasploit", "url": "https://www.freebuf.com/sectool/61282.html", "time": "2015-03-20", "level": "金币+15", "num_look": 693451, "num_comment": 14, "author": "zusheng", "tags": ["WEB安全", "工具"], "text": "pymsf是著名安全研究团队Spiderlabs实现的一个Python与Metasploit msgrpc进行通信的python模块，通过它，你可以利用Python玩转渗透测试框架Metasploit。"}
{"title": "FBI调查域名注册商Register.com入侵事件，怀疑中国军方黑客所为", "url": "https://www.freebuf.com/news/61379.html", "time": "2015-03-20", "level": "", "num_look": 301773, "num_comment": 22, "author": "fu4k", "tags": ["资讯"], "text": "美国联邦调查局(FBI)正在调查域名注册商Register.com入侵事件，美方认为中国军方可能参与攻击，Register为全球企业管理着逾140万网址。"}
{"title": "国产工具：渗透测试助手PKAV HTTP Fuzzer发布", "url": "https://www.freebuf.com/sectool/61313.html", "time": "2015-03-19", "level": "红色标题", "num_look": 1501095, "num_comment": 52, "author": "only_guest", "tags": ["工具"], "text": "渗透测试的各位高手们，是不是还在为找不到一个好帮手而郁闷呢？别郁闷了，我来帮你！PKAV HTTP Fuzzer绝对是一你一用就会爱上的好帮手！"}
{"title": "又见朝鲜黑客？韩国核电站数据遭黑客窃取并要求支付赎金", "url": "https://www.freebuf.com/news/61342.html", "time": "2015-03-19", "level": "", "num_look": 159157, "num_comment": 9, "author": "初七", "tags": ["资讯"], "text": "近日韩国政府称，朝鲜黑客入侵了核电站公司“非关键”的内部网络并从中窃取了大量数据。黑客还在Twitter上威胁政府关闭3个反应堆，否则会“摧毁”该设施。"}
{"title": "惠普ArcSight企业安全系列产品曝高危安全漏洞", "url": "https://www.freebuf.com/news/61346.html", "time": "2015-03-19", "level": "", "num_look": 246701, "num_comment": 4, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "本周二，美国卡内基梅隆大学计算机紧急响应小组（CERT）协调中心发布公告，波兰安全研究员Julian Horoszkiewicz在惠普的ArcSight系列产品上发现了5个安全漏洞。"}
{"title": "XSS攻击冷门花样玩法总结", "url": "https://www.freebuf.com/articles/web/61268.html", "time": "2015-03-19", "level": "现金奖励", "num_look": 1513205, "num_comment": 29, "author": "blackhole", "tags": ["WEB安全"], "text": "本文里总结的攻击方式比较冷门，但危害和影响并不小，值得我们关注。"}
{"title": "Pwn2Own战报：腾讯、360各显神通，分别秒杀IE、Flash、PDF项目", "url": "https://www.freebuf.com/news/61335.html", "time": "2015-03-19", "level": "红色标题", "num_look": 417010, "num_comment": 39, "author": "hujias", "tags": ["资讯"], "text": "3月18日，全球顶级黑客大赛Pwn2Own 2015在加拿大温哥华拉开战幕，腾讯电脑管家、Keen Team、360安全团队各显神通，分别秒杀IE、Flash、PDF项目获得冠军。此次中国团队共计斩获奖金20余万美元。"}
{"title": "幽灵漏洞（GHOST）远程利用EXP", "url": "https://www.freebuf.com/vuls/61308.html", "time": "2015-03-19", "level": "", "num_look": 368652, "num_comment": 4, "author": "Conermx", "tags": ["漏洞", "系统安全"], "text": "本文演示一个幽灵漏洞（GHOST）的EXP，这个EXP是Metasploit的一个模块。这个Metasploit模块可以远程利用CVE-2015-0235（glibc 库中 gethostbyname 函数的堆溢出漏洞）漏洞，目标是运行了Exim邮件服务的linux服务器。"}
{"title": "酷炫的开源中间人攻击（MITM）测试套件 - netool.sh（含视频）", "url": "https://www.freebuf.com/sectool/61234.html", "time": "2015-03-19", "level": "", "num_look": 451846, "num_comment": 22, "author": "phper", "tags": ["工具"], "text": "netool.sh为安全研究人员提供了中间人攻击（Man-In-The-Middle）测试的工具套件组合，包括内网安全扫描、嗅探及社会工程学测试，界面十分酷炫。"}
{"title": "半开源Web安全测试与学习平台 - 蚁逅", "url": "https://www.freebuf.com/sectool/61243.html", "time": "2015-03-19", "level": "金币+15", "num_look": 602844, "num_comment": 21, "author": "69氏", "tags": ["工具"], "text": "一个为网络安全爱好者而生的在线代码编写与测试交流平台，一个新生而又不失高大上的漏洞编写以及辅助测试框架。"}
{"title": "Android HTTPS中间人劫持漏洞浅析", "url": "https://www.freebuf.com/articles/terminal/61216.html", "time": "2015-03-19", "level": "", "num_look": 536874, "num_comment": 7, "author": "Jason_HZ", "tags": ["终端安全"], "text": "在各大漏洞平台上，有大量存在HTTPS证书不校验移动安全漏洞，例如国内绝大部分Android APP存在信任所有证书漏洞。本文将一探究竟。"}
{"title": "国网智能电网研究院信息安全实验室安全招聘", "url": "https://www.freebuf.com/jobs/61255.html", "time": "2015-03-18", "level": "", "num_look": 190015, "num_comment": 23, "author": "国家电网", "tags": ["安全招聘"], "text": "国家电网公司（State Grid），简称国家电网、国网，成立于2002年（壬午年）12月29日，是经过国务院同意进行国家授权投资的机构和国家控股公司的试点单位。"}
{"title": "终于轮到你：苹果Mac OS X系统被发现存在DLL劫持漏洞", "url": "https://www.freebuf.com/news/61244.html", "time": "2015-03-18", "level": "", "num_look": 216697, "num_comment": 9, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "DLL劫持从2000年就一直开始困扰着Windows系统，而现在这种攻击方式也在大多人眼中“最安全的操作系统”——苹果Mac OS X上出现了。"}
{"title": "小心盗窃黑科技：ATM Skimmers配合隐形摄像头获取提款密码和银行卡信息", "url": "https://www.freebuf.com/news/61208.html", "time": "2015-03-18", "level": "", "num_look": 428254, "num_comment": 15, "author": "鸢尾", "tags": ["终端安全", "资讯"], "text": "这是一种依附在正常自动提款机上的恶意电子硬件设备。它伪装成正常的键盘和银行卡插槽，与原设备严丝合缝，普通用户很难分辨。通过配合隐形摄像头，犯罪分子窃取用户输入的密码以及银行卡数据。"}
{"title": "走近科学：窥探家庭网络的恶意木马", "url": "https://www.freebuf.com/news/topnews/61047.html", "time": "2015-03-18", "level": "", "num_look": 355420, "num_comment": 6, "author": "JackFree", "tags": ["头条", "网络安全"], "text": "近几年，我们已经看到了很多关于家庭路由器遭受攻击的报道。攻击路由器的恶意软件会将用户的上网访问重定向到各种恶意站点，其他的攻击方式还包括植入后门和DNS劫持。在这些攻击中，攻击者针对家庭网络的攻击意图和…"}
{"title": "金融行业平台常见安全漏洞与防御", "url": "https://www.freebuf.com/news/topnews/61082.html", "time": "2015-03-18", "level": "现金奖励", "num_look": 663836, "num_comment": 36, "author": "NSTRT", "tags": ["WEB安全", "头条"], "text": "我们对曾测试对约多家金融交易平台进行过一次漏洞统计，除了常见的一些如注入、跨站、CSRF、恶意上传等Web漏洞外，部分金融平台在业务功能上存在着严重的风险。"}
{"title": "亦真亦假：技术剖析WordPress黑帽SEO插件", "url": "https://www.freebuf.com/articles/web/61065.html", "time": "2015-03-18", "level": "", "num_look": 242766, "num_comment": 11, "author": "鸢尾", "tags": ["WEB安全"], "text": "就在本周，我遇到一款未经过管理员许可就自动进行了安装的WordPress插件。这是一个典型的黑帽SEO插件，其实现手法十分有趣。"}
{"title": "政治黑客：土耳其黑客组织Alsancak Tim再次破坏40家“政敌”网站", "url": "https://www.freebuf.com/news/61081.html", "time": "2015-03-17", "level": "", "num_look": 130427, "num_comment": 4, "author": "安恒信息", "tags": ["资讯"], "text": "“匿名者”(Anonymous)和“蜥蜴部队”(Lizard Squad)等团体，都算是读者们比较熟悉的了。但是在纷繁的互联网世界，还有很多其它团体“不甘寂寞”，比如在中东造成了不少破坏、并且引发了混乱的Alsancak Tim。"}
{"title": "D-Link（友讯）路由器曝远程文件上传及命令注入漏洞（已发布安全更新）", "url": "https://www.freebuf.com/news/61099.html", "time": "2015-03-17", "level": "", "num_look": 217590, "num_comment": 9, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "D-Link路由器的安全问题还真多，前段时间刚刚爆出家用路由器存在远程命令注入漏洞，之后又有人在其固件上发现了两个远程利用漏洞。攻击者利用漏洞可远程获得路由器权限，甚至在受害设备上执行任意代码。"}
{"title": "Win10将使用P2P进行系统更新，引发安全担忧", "url": "https://www.freebuf.com/news/61058.html", "time": "2015-03-17", "level": "", "num_look": 133090, "num_comment": 5, "author": "Rechange", "tags": ["资讯"], "text": "对于用户来说，微软接纳这一技术无疑是一件十分利好的事。但下载源的合法性和安全性引起人们的担忧。"}
{"title": "告别刷卡：美国最大的无卡ATM网络即将推出", "url": "https://www.freebuf.com/news/61069.html", "time": "2015-03-17", "level": "金币+4", "num_look": 235414, "num_comment": 9, "author": "dawner", "tags": ["资讯"], "text": "加拿大Montreal银行下属单位BMO Harris银行近日推出了美国最大的无卡ATM网络，它允许客户使用自己的智能手机迅速取到现金。"}
{"title": "RFID安全：一次M1卡（洗澡卡、开水卡）破解历程", "url": "https://www.freebuf.com/articles/terminal/60908.html", "time": "2015-03-17", "level": "现金奖励", "num_look": 3679125, "num_comment": 112, "author": "坂田银时", "tags": ["极客", "终端安全"], "text": "随着智能设备以及NFC的普及，用RFID卡支付变得越来越流行。现在的非接触式卡片（包括但不限于社保卡、饭卡、交通卡、门禁卡等）都是使用的RFID技术。与此同时，RFID智能卡也越来越受到攻击者的关注。"}
{"title": "雅虎和谷歌联手对抗NSA：基于浏览器的邮箱加密插件即将上线", "url": "https://www.freebuf.com/news/60990.html", "time": "2015-03-17", "level": "", "num_look": 137974, "num_comment": 6, "author": "cindy", "tags": ["资讯"], "text": "雅虎公司的邮箱被NSA（美国国家安全局）监控的事件披露后，雅虎信息安全部主任Alex Stamos近日宣布雅虎公司将在今年年底对雅虎邮箱实施端对端加密，保证用户数据安全。"}
{"title": "剖析Smack技术远控木马", "url": "https://www.freebuf.com/articles/terminal/60840.html", "time": "2015-03-16", "level": "", "num_look": 274209, "num_comment": 9, "author": "AVLTeam", "tags": ["终端安全"], "text": "AVL移动安全团队近期发现一种基于XMPP Smack Openfire开发的Android间谍软件。"}
{"title": "谷歌应用漏洞泄漏超过28万条私人WHOIS数据", "url": "https://www.freebuf.com/news/60912.html", "time": "2015-03-16", "level": "金币+4", "num_look": 230247, "num_comment": 16, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "谷歌在近日通知了数十万个域名注册者，他们的私人WHOIS信息已经彻底暴露，这些用户存在身份盗窃、网络钓鱼等安全风险。"}
{"title": "使命召唤、魔兽世界、英雄联盟……专攻游戏的勒索软件TeslaCrypt", "url": "https://www.freebuf.com/news/60938.html", "time": "2015-03-16", "level": "", "num_look": 314995, "num_comment": 5, "author": "JackFree", "tags": ["资讯"], "text": "被盯上的游戏包括使命召唤、暗黑破坏神、异尘余生、Minecraft、魔兽争霸、F.E.A.R、刺客信条、生化危机、魔兽世界、英雄联盟以及坦克世界等超过20种。"}
{"title": "一篇文章看懂Pwn2Own与DefconCTF的区别", "url": "https://www.freebuf.com/news/60949.html", "time": "2015-03-16", "level": "", "num_look": 372629, "num_comment": 10, "author": "cindy", "tags": ["其他", "观点"], "text": "借着Pwn2Own 2015开赛在即的间隙，小编从比赛形式、参赛门槛、参赛选手、活动氛围四个维度对两大国际黑客大赛进行全面对比。"}
{"title": "U盘杀手：俄罗斯研究人员利用U盘引爆一台电脑", "url": "https://www.freebuf.com/news/60930.html", "time": "2015-03-16", "level": "金币+4", "num_look": 790207, "num_comment": 31, "author": "dawner", "tags": ["资讯"], "text": "当U盘指示灯开始闪烁，突然，一阵轻烟飘起，一股焦味散出，他的电脑烧毁了……"}
{"title": "Python黑客学习笔记：从HelloWorld到编写PoC（中）", "url": "https://www.freebuf.com/news/topnews/60758.html", "time": "2015-03-16", "level": "金币+20", "num_look": 1255840, "num_comment": 32, "author": "嘎巴嘎巴", "tags": ["WEB安全", "头条"], "text": "本系列文章适合CS在读学生和万年工具党，本文会在英文原文的基础上做些修改，并适当增加些解释说明。学好Python，Hacking for fun！"}
{"title": "多支国内队伍参赛：史上最难Pwn2Own黑客大赛看点", "url": "https://www.freebuf.com/news/60834.html", "time": "2015-03-15", "level": "", "num_look": 147668, "num_comment": 8, "author": "fl00d", "tags": ["资讯"], "text": "即将于五天后（2015年3月18日）在加拿大温哥华开幕的Pwn2Own2015被称为史上最难黑客大赛。"}
{"title": "尴尬了：杀毒软件熊猫卫士误标记自己为病毒，成功自杀", "url": "https://www.freebuf.com/news/60882.html", "time": "2015-03-14", "level": "金币+20", "num_look": 488753, "num_comment": 50, "author": "fu4k", "tags": ["资讯"], "text": "著名杀毒软件熊猫卫士在本周三的一次更新中，将自身核心文件标记为病毒并隔离，导致用户计算机变砖。"}
{"title": "美国NSA棱镜计划2013预算任务", "url": "https://www.freebuf.com/articles/neopoints/60841.html", "time": "2015-03-14", "level": "", "num_look": 164538, "num_comment": 5, "author": "安恒信息", "tags": ["观点"], "text": "最近，沉寂了很久的棱镜门事件再次爆出猛料，针对美国棱镜系统的2013年预算、编制以及更详细的工作任务等信息被披露出来，再次引发各国关注。"}
{"title": "Adobe修复了11个Flash高危漏洞，大多由谷歌Project Zero团队发现", "url": "https://www.freebuf.com/news/60821.html", "time": "2015-03-14", "level": "", "num_look": 180202, "num_comment": 3, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "此次Adobe更新了Flash Player 上的11个高危漏洞，其中大部分都是远程执行任意代码漏洞。"}
{"title": "极客DIY：利用Arduino制作智能家居系统", "url": "https://www.freebuf.com/news/topnews/60740.html", "time": "2015-03-14", "level": "金币+20", "num_look": 903503, "num_comment": 27, "author": "Rechange", "tags": ["头条", "极客"], "text": "本文中所展示的智能家居系统可以对室内外温度、天气变化以及门窗开关变化进行监测，功能相对较为单一，但更多的是提供给各位看官一个思路，希望看完之后能有所收获。"}
{"title": "Android属性allowBackup安全风险浅析", "url": "https://www.freebuf.com/articles/terminal/60778.html", "time": "2015-03-14", "level": "", "num_look": 1876823, "num_comment": 9, "author": "Jason_HZ", "tags": ["终端安全"], "text": "尤其是通讯录应用，一旦应用程序支持备份和恢复功能，攻击者即可通过adb backup和adb restore进行恢复新安装的同一个应用来查看聊天记录等信息。"}
{"title": "以后说话小心点：苹果与第三方公司共享Siri语音数据，“人肉”进行语音分析", "url": "https://www.freebuf.com/news/60766.html", "time": "2015-03-13", "level": "", "num_look": 243731, "num_comment": 13, "author": "Conermx", "tags": ["资讯"], "text": "​如果你使用文字转语音的方式发送私密信息、商量机密，或者其他你不想让别人知道的内容，那就得多留点心眼了。因为所有你跟你的手机讲的话都会被陌生人听到。"}
{"title": "黑莓公司旗下多个产品受到FREAK漏洞影响", "url": "https://www.freebuf.com/news/60772.html", "time": "2015-03-13", "level": "", "num_look": 130052, "num_comment": 4, "author": "cindy", "tags": ["资讯"], "text": "黑莓公司近日发布公告，称其旗下多个产品线受到FREAK SSL漏洞影响，包括多个版本的黑莓手机操作系统、企业服务器和黑莓通讯工具。值得一提的是，黑莓是主动站出来承认自身产品有安全问题。"}
{"title": "“高端”人士必备：新型安全加密通讯应用Otr.to", "url": "https://www.freebuf.com/sectool/60752.html", "time": "2015-03-13", "level": "金币+20", "num_look": 493604, "num_comment": 42, "author": "dawner", "tags": ["工具"], "text": "在斯诺登爆料之后的“全球监控”时代，如果是非常在意数据隐私的“高端人士”（比如记者、商人或者隐秘工作者），那么FreeBuf今天要介绍的这款应用可能会很适合你。"}
{"title": "Dropbox SDK存在远程利用漏洞，已紧急修复", "url": "https://www.freebuf.com/news/60684.html", "time": "2015-03-13", "level": "", "num_look": 166531, "num_comment": 1, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "Dropbox的开发人员近日修复了安卓SDK版存储应用程序上的一个远程利用漏洞，攻击者利用该漏洞可未经用户同意直接把应用程序和Dropbox账户连接。只要用户安装的应用程序使用了含有漏洞的Dropbox SDK，则其敏感信息就…"}
{"title": "Oracle数据库监听器引起的安全威胁与防护技术", "url": "https://www.freebuf.com/articles/database/60598.html", "time": "2015-03-13", "level": "", "num_look": 300099, "num_comment": 5, "author": "安华金和", "tags": ["数据安全"], "text": "虽然安全行业迎来了数据库国产化的春天，但现今Oracle依旧是中国政府机关，使用最广泛的数据库。其安全性受到广泛关注。"}
{"title": "DRAM芯片内核提权漏洞解析", "url": "https://www.freebuf.com/news/60600.html", "time": "2015-03-12", "level": "金币+20", "num_look": 328682, "num_comment": 7, "author": "Rechange", "tags": ["漏洞", "资讯"], "text": "安全研究人员发现在英特尔PC上的Linux系统中可以利用某些种类的DDR DRAM芯片所存在的物理缺陷来获取系统最高权限。"}
{"title": "流行WordPress SEO插件曝高危SQL注入漏洞", "url": "https://www.freebuf.com/news/60715.html", "time": "2015-03-12", "level": "", "num_look": 297250, "num_comment": 17, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "最新消息，全球最流行的CMS应用WordPress插件WordPress SEO by Yoast曝高危SQL注入漏洞，该插件使用频率相当高，用户高达可达千万。"}
{"title": "西安四叶草招聘Python安全研究员", "url": "https://www.freebuf.com/jobs/60011.html", "time": "2015-03-12", "level": "", "num_look": 378047, "num_comment": 36, "author": "kun", "tags": ["安全招聘"], "text": "西安四叶草信息技术有限公司，2012年注册成立于西安市高新技术产业开发基地，注册资金500万元。"}
{"title": "走近科学：硬件“解锁神器”IP BOX如何爆破iPhone锁屏密码", "url": "https://www.freebuf.com/news/topnews/60671.html", "time": "2015-03-12", "level": "红色标题", "num_look": 1059702, "num_comment": 46, "author": "FB情报组", "tags": ["头条", "终端安全"], "text": "国外一款专破苹果手机锁屏密码的工具大家听说过么？这款爆破工具名为IP BOX。目前IP BOX（可能是山寨版）已引进国内，国内商家命名为“苹果报资料解锁神器”，每台价格在780人民币左右。"}
{"title": "Redis数据库安全手册", "url": "https://www.freebuf.com/articles/system/60654.html", "time": "2015-03-12", "level": "金币+12", "num_look": 526534, "num_comment": 6, "author": "ubuntu", "tags": ["数据安全", "系统安全"], "text": "Redis是一个高性能的key-value数据库，这两年可谓火的不行。而Redis的流行也带来一系列安全问题，本文将讲解这方面的内容，包括Redis提供的访问控制和代码安全问题，以及可以由恶意输入和其他类似的手段触发的攻击。"}
{"title": "微软发布针对FREAK漏洞以及Stuxnet病毒的更新", "url": "https://www.freebuf.com/news/60635.html", "time": "2015-03-12", "level": "", "num_look": 119210, "num_comment": 1, "author": "Rechange", "tags": ["资讯"], "text": "​本周二，微软发布了针对FREAK漏洞与Stuxnet（震网）病毒的安全更新。"}
{"title": "Metasploit Payload服务器 - Maligno v2.0", "url": "https://www.freebuf.com/sectool/60632.html", "time": "2015-03-12", "level": "", "num_look": 226748, "num_comment": 4, "author": "phper", "tags": ["工具"], "text": "Maligno是一个Python编写的开源渗透测试工具，可提供Metasploit的各种Payload（攻击负载）。"}
{"title": "技术分析：SecureRandom漏洞详解（CVE-2013-7372）", "url": "https://www.freebuf.com/vuls/60494.html", "time": "2015-03-12", "level": "", "num_look": 292109, "num_comment": 7, "author": "0xr0ot", "tags": ["漏洞"], "text": "Android 4.4之前版本的Java加密架构(JCA)中使用的Apache Harmony 6.0M3及其之前版本的SecureRandom实现存在安全漏洞。"}
{"title": "难度提升、奖金减少：Pwn2Own 2015成为史上“最难”黑客大赛", "url": "https://www.freebuf.com/news/60558.html", "time": "2015-03-11", "level": "金币+12", "num_look": 431949, "num_comment": 24, "author": "不是养蚕人", "tags": ["活动", "资讯"], "text": "2015年的Pwn2Own你在逗我吗？削减了奖金，却增大了难度（64位、EMET、增强沙箱保护、禁止注销/重启等）"}
{"title": ".Chm格式帮助文件作盾，CryptoWall勒索软件卷土重来", "url": "https://www.freebuf.com/news/60537.html", "time": "2015-03-11", "level": "金币+12", "num_look": 184194, "num_comment": 5, "author": "dawner", "tags": ["资讯"], "text": "近日，Bitdefender的安全专家又披露了一种勒索软件CryptoWall变种，攻击者利用了看似安全的.Chm格式帮助文件发起攻击。"}
{"title": "专注苹果10年：揭秘美国中情局（CIA）针对苹果设备的各种破解与监控研究", "url": "https://www.freebuf.com/news/60549.html", "time": "2015-03-11", "level": "", "num_look": 213517, "num_comment": 16, "author": "dawner", "tags": ["资讯"], "text": "美国中央情报局（CIA）已花费了近10年的时间，专注于破解苹果设备的监听以及安全密钥破解。"}
{"title": "京东商城招聘安全工程师", "url": "https://www.freebuf.com/jobs/60357.html", "time": "2015-03-11", "level": "", "num_look": 202716, "num_comment": 24, "author": "京东安全", "tags": ["安全招聘"], "text": "即日起京东面向全国进行招聘，2015年京东安全里程碑期待您的印记！"}
{"title": "从零开始学Android应用安全测试（Part2）", "url": "https://www.freebuf.com/news/topnews/60481.html", "time": "2015-03-11", "level": "金币+12", "num_look": 526478, "num_comment": 20, "author": "鸢尾", "tags": ["头条", "终端安全"], "text": "在这一篇文章中，我会带领大家了解一些信息收集技术，我们将看到如何反编译一款安卓应用程序，分析安卓应用程序的签名以及其他一些东西。"}
{"title": "HTML5跨域消息发送安全性分析", "url": "https://www.freebuf.com/articles/web/60496.html", "time": "2015-03-11", "level": "", "num_look": 222577, "num_comment": 6, "author": "Rechange", "tags": ["WEB安全"], "text": "HTML5是一种新兴的技术，并且在移动APP中也有着广泛的使用。但也正是因为它的一些新特性的出现以及广泛的应用，使得其安全性非常值得关注。"}
{"title": "绿盟科技2014年DDoS威胁报告", "url": "https://www.freebuf.com/news/60515.html", "time": "2015-03-10", "level": "", "num_look": 318619, "num_comment": 10, "author": "绿盟科技", "tags": ["安全报告", "网络安全"], "text": "2014年DDoS攻击方式中出现了新的DDoS反射式放大攻击形式，攻击带宽放大倍数最高可达75倍。在国内，在线游戏已进入DDoS攻击目标的前三。"}
{"title": "印度媒体：Bluebox测试的是高仿山寨货，非小米官方机", "url": "https://www.freebuf.com/news/60467.html", "time": "2015-03-10", "level": "红色标题", "num_look": 414298, "num_comment": 29, "author": "cindy", "tags": ["资讯"], "text": "几天前，美国手机安全公司Bluebox指责小米4智能手机预安装了恶意程序，并存在多项安全漏洞。小米为此发表官方声明——Bluebox测试用的小米手机是从非官方途径获得，它只是一个高仿的“山寨货”。"}
{"title": "Google漏洞可伪造域名邮箱钓鱼", "url": "https://www.freebuf.com/news/60434.html", "time": "2015-03-10", "level": "", "num_look": 294934, "num_comment": 9, "author": "dawner", "tags": ["漏洞", "资讯"], "text": "近日Google Apps for Work曝出一个漏洞，攻击者可以利用该漏洞伪造任意网站的域名邮箱，冒充公司雇员给受害人发送钓鱼邮件。"}
{"title": "反以色列黑客来袭，多个美国执法机构和银行网站被黑", "url": "https://www.freebuf.com/news/60457.html", "time": "2015-03-10", "level": "", "num_look": 124892, "num_comment": 5, "author": "cindy", "tags": ["资讯"], "text": "黑客组织AnonGhost最近疯狂攻击美国最高执法机构网站。"}
{"title": "一层一层剥开你的心：解码“深度伪装”的ZeuS网银木马", "url": "https://www.freebuf.com/news/topnews/60419.html", "time": "2015-03-10", "level": "金币+12", "num_look": 266038, "num_comment": 16, "author": "JackFree", "tags": ["头条", "系统安全"], "text": "我们利用再平常不过的工具Notepad++，一步一步脱去ZeuS木马的伪装外衣，并进行了非常深入的静态分析。"}
{"title": "极客DIY：利用Arduino制作电子鼓", "url": "https://www.freebuf.com/news/topnews/60389.html", "time": "2015-03-10", "level": "金币+12", "num_look": 787382, "num_comment": 22, "author": "Rechange", "tags": ["头条", "极客"], "text": "我一直想学打鼓，但却始终遭到父母的反对，理由是噪音太大，而且十分占空间。多年后，当我掌握了很多电子方面的知识之后，我制作了一个简单的电子鼓，那些问题便迎刃而解，而我也得偿所愿。"}
{"title": "易宝支付招聘信息安全工程师", "url": "https://www.freebuf.com/jobs/60355.html", "time": "2015-03-09", "level": "", "num_look": 334580, "num_comment": 28, "author": "willson", "tags": ["安全招聘"], "text": "易宝支付（YeePay.com）是中国行业支付的开创者和领导者，也是互联网金融和移动互联领军企业。易宝于2003年8月成立，总部位于北京。"}
{"title": "打造Chrome下的HackBar - HackMan", "url": "https://www.freebuf.com/sectool/60379.html", "time": "2015-03-09", "level": "金币+6", "num_look": 1040863, "num_comment": 19, "author": "arschloch", "tags": ["工具"], "text": "请不要说闲的JJ疼，都有了HackBar为毛还要在造轮子……我比较喜欢Chrome的API，就写了"}
{"title": "警惕流行BT客户端μTorrent，它可能正在你的电脑上安装比特币挖矿机", "url": "https://www.freebuf.com/news/60343.html", "time": "2015-03-09", "level": "", "num_look": 230155, "num_comment": 14, "author": "JackFree", "tags": ["资讯"], "text": "最近安装或者更新流行BT下载客户端μTorrent 3.4.2 Build 28913的童鞋们要注意了，因为你可能已经在不经意间安装了一个比特币挖矿机。"}
{"title": "智能家居安全威胁：安全研究人员发现入侵Nest温控器的方法", "url": "https://www.freebuf.com/news/60336.html", "time": "2015-03-09", "level": "", "num_look": 154732, "num_comment": 7, "author": "cindy", "tags": ["资讯"], "text": "之前我们已经讨论过很多针对物联网设备的攻击事件，近日我们又发现了一个针对智能家居设备的攻击方式。"}
{"title": "如何制作属于你的HID Key", "url": "https://www.freebuf.com/sectool/60312.html", "time": "2015-03-09", "level": "现金奖励", "num_look": 463827, "num_comment": 17, "author": "暗夜星辰", "tags": ["头条", "工具"], "text": "有一天早晨，小王去公司上班，在公司一个角落里发现了一个带着USB接口的黑色的小盒子静静的“躺在”那里。"}
{"title": "深入分析新型POS机木马LogPOS", "url": "https://www.freebuf.com/articles/terminal/60214.html", "time": "2015-03-09", "level": "", "num_look": 276003, "num_comment": 6, "author": "JackFree", "tags": ["终端安全"], "text": "近几年POS恶意软件活动频繁，本文就2015年发现的一个新成员LogPOS样本进行分析。该恶意软件的一个重要的特点是其利用了邮件槽，可以躲避传统的检测机制。"}
{"title": "留个心眼：用Find My iPhone锁定手机后别太心急，小心反被钓鱼欺诈", "url": "https://www.freebuf.com/news/60286.html", "time": "2015-03-08", "level": "金币+6", "num_look": 555338, "num_comment": 19, "author": "banish", "tags": ["资讯"], "text": "虽然用户使用了Find My iPhone锁住了丢失的手机，但偷窃者通过伪造icloud页面对受害者实施“钓鱼”，成功对设备解锁。"}
{"title": "美国安全公司指责小米4手机预装恶意APP，小米否认", "url": "https://www.freebuf.com/news/60297.html", "time": "2015-03-08", "level": "金币+6", "num_look": 372426, "num_comment": 12, "author": "Sphinx", "tags": ["终端安全", "资讯"], "text": "近日美国手机安全公司Bluebox称，中国最畅销的Android手机小米4 LTE版预装了恶意APP，并且存在多项安全漏洞。"}
{"title": "使用scrapy爬取sebug漏洞库", "url": "https://www.freebuf.com/articles/web/60247.html", "time": "2015-03-07", "level": "金币+6", "num_look": 228887, "num_comment": 6, "author": "星明月稀", "tags": ["WEB安全"], "text": "由于项目需要抓取sebug的漏洞库内容，就利用scrapy框架简单写了个抓取sebug的爬虫，并存入数据库。"}
{"title": "法国情报机构制造：间谍软件Babar与Casper", "url": "https://www.freebuf.com/news/60204.html", "time": "2015-03-07", "level": "", "num_look": 125917, "num_comment": 1, "author": "cindy", "tags": ["资讯"], "text": "安全研究人员近日研究发现，间谍软件Babar和Casper存在诸多相同点。他们认为这两款间谍软件同根同祖，都为法国情报机构关联的Animal Farm（动物农场）黑客组织开发。"}
{"title": "广告加特技：新加坡广告公司AdNear用无人机搜集用户数据", "url": "https://www.freebuf.com/news/60236.html", "time": "2015-03-06", "level": "", "num_look": 142694, "num_comment": 7, "author": "cindy", "tags": ["资讯"], "text": "“第一次他们让我用无人机偷数据，我是拒绝的”"}
{"title": "对视频监控行业“棱镜门事件”思考", "url": "https://www.freebuf.com/vuls/59681.html", "time": "2015-03-06", "level": "金币+6", "num_look": 258549, "num_comment": 14, "author": "0x000G", "tags": ["漏洞", "观点"], "text": "监控产品作为维护国家公共安全的重要工具。那么是什么样的安全隐患如此高大上，可以造成这么严重的影响？让我们梳理一下这一系列的漏洞，逐一分析原理，揭开其神秘面纱，为行业提供借鉴。"}
{"title": "从零开始学Android应用安全测试（Part1）", "url": "https://www.freebuf.com/news/topnews/60154.html", "time": "2015-03-06", "level": "金币+6", "num_look": 679898, "num_comment": 21, "author": "鸢尾", "tags": ["头条", "终端安全"], "text": "在本系列文章中，利用InsecureBankv2这款含有漏洞的安卓应用，我们可以了解到有关安卓应用安全的种种概念。我们将从一个新手的角度看待每一个问题。"}
{"title": "域名阴影（Domain Shadowing）技术：知名钓鱼攻击工具包Angler Exploit Kit又添杀招", "url": "https://www.freebuf.com/news/60172.html", "time": "2015-03-06", "level": "金币+6", "num_look": 422866, "num_comment": 7, "author": "dawner", "tags": ["资讯"], "text": "臭名昭著的钓鱼工具包Angler Exploit Kit最近更新了许多漏洞利用工具（含0day），以及一项名为“域名阴影（Domain Shadowing）”的新技术，成为当前市面上最“先进”的钓鱼攻击装备。"}
{"title": "爱加密招聘逆向/研发工程师（深圳）", "url": "https://www.freebuf.com/jobs/58289.html", "time": "2015-03-06", "level": "", "num_look": 168968, "num_comment": 7, "author": "ciirwhy", "tags": ["安全招聘"], "text": "北京智游网安科技有限公司是一家专注于手机安全软件以及手机开发者基础服务的技术性公司。"}
{"title": "JoSQL内存数据库远程代码执行漏洞（含EXP）", "url": "https://www.freebuf.com/vuls/60113.html", "time": "2015-03-06", "level": "", "num_look": 306102, "num_comment": 9, "author": "安恒信息", "tags": ["数据安全", "漏洞"], "text": "JoSQL全称SQL for Java Objects,提供了应用SQL语句的Java对象的集合的能力开发，JoSQL提供了搜索，排序，group等对Java对象的集合进行类似SQL的查询应该应用的功能。"}
{"title": "美国第二大医疗保险公司Anthem遭黑客入侵，近8000万用户数据泄露", "url": "https://www.freebuf.com/news/60134.html", "time": "2015-03-06", "level": "", "num_look": 369556, "num_comment": 14, "author": "cindy", "tags": ["资讯"], "text": "美国第二大的医疗保险服务商Anthem宣布，公司信息系统被黑客攻破，近8000万员工和客户资料被盗。在美国，医疗信息被盗的危害超乎你想象，甚至可能危及生命。"}
{"title": "杭州海康威视安全岗位招聘", "url": "https://www.freebuf.com/jobs/59960.html", "time": "2015-03-05", "level": "", "num_look": 184365, "num_comment": 18, "author": "HIK", "tags": ["安全招聘"], "text": "海康威视是领先的安防产品及行业解决方案提供商，面向全球提供领先的安防产品、专业的行业解决方案与优质的服务。现招聘多个安全岗位。"}
{"title": "钓鱼邮件利用路由器CSRF漏洞劫持巴西网民DNS", "url": "https://www.freebuf.com/news/60099.html", "time": "2015-03-05", "level": "", "num_look": 139051, "num_comment": 2, "author": "cindy", "tags": ["资讯"], "text": "攻击者主要是利用家用路由器中存在的安全漏洞入侵，然后修改路由器DNS设置，这种攻击被称为pharming（网址嫁接攻击）。调查显示，攻击者正在通过这种方法劫持巴西网民的网络连接。"}
{"title": "技术分析：时尚时尚最时尚的缓冲区溢出攻击", "url": "https://www.freebuf.com/articles/system/60033.html", "time": "2015-03-05", "level": "", "num_look": 249103, "num_comment": 4, "author": "IDF_Lab", "tags": ["系统安全"], "text": "在当今的操作系统中，内存缺陷漏洞已经越来越难挖掘了，栈保护措施已经使原来的缓冲区溢出利用方法失效了。"}
{"title": "“历史遗留”漏洞：浅析新型SSL/TLS漏洞FREAK", "url": "https://www.freebuf.com/news/60057.html", "time": "2015-03-05", "level": "", "num_look": 797016, "num_comment": 18, "author": "dawner", "tags": ["网络安全", "资讯"], "text": "最近安全研究人员发现一种新型SSL/TLS漏洞。预计在十年内，数以百万计的苹果、安卓用户访问HTTPS网站时将可能遭受中间人进而被窃取账号和密码，即使这些网站使用了加密传输也无济于事。"}
{"title": "渗透测试演练平台RedTigers Hackit通关Writeup", "url": "https://www.freebuf.com/articles/web/60044.html", "time": "2015-03-05", "level": "金币+8", "num_look": 913758, "num_comment": 32, "author": "安全盒子", "tags": ["WEB安全"], "text": "RedTigers-Hackit是一个训练SQLi（SQL注入漏洞）和PHP方面的网站。废话不多说，我们开始过关之旅吧！"}
{"title": "如何破解安卓手机上的图形锁（九宫格锁）", "url": "https://www.freebuf.com/news/topnews/59946.html", "time": "2015-03-05", "level": "现金奖励", "num_look": 4570181, "num_comment": 91, "author": "张召忠", "tags": ["头条", "极客"], "text": "安卓手机的图形锁（九宫格）是3×3的点阵，按次序连接数个点从而达到锁定/解锁的功能。假如你想进入别人的手机，但又不想引起其警觉的话……相信本文会给你带来帮助。"}
{"title": "ElasticSearch Groovy远程代码执行漏洞（CVE-2015-1427）POC", "url": "https://www.freebuf.com/vuls/60037.html", "time": "2015-03-05", "level": "金币+8", "num_look": 337157, "num_comment": 10, "author": "午夜灰狼哥", "tags": ["漏洞"], "text": "近日，ElasticSearch Groovy脚本被爆出存在远程代码执行漏洞。原理已被多人分析过，这里不在重复，直接上大家期待的POC吧！"}
{"title": "广东115.com招聘安全工程师", "url": "https://www.freebuf.com/jobs/59928.html", "time": "2015-03-04", "level": "", "num_look": 187565, "num_comment": 34, "author": "freed", "tags": ["安全招聘"], "text": "公司总部（东莞）环境高大上，一流办公室、餐厅、健身房、游戏厅、豪华电影院、KTV、客房等等。在深圳、广州设有分公司。"}
{"title": "流行运动相机GoPro官网可遍历明文存储的用户账号和密码", "url": "https://www.freebuf.com/news/59998.html", "time": "2015-03-04", "level": "", "num_look": 185453, "num_comment": 7, "author": "hujias", "tags": ["资讯"], "text": "GoPro是目前全球最流行的运动相机品牌，现今已成为极限运动专用相机的代名词。近日安全研究员在GoPro官网上发现了一个安全漏洞，可导致大量用户的用户名和密码泄露。"}
{"title": "利用第三方软件0day漏洞加载和执行的木马分析", "url": "https://www.freebuf.com/articles/system/59985.html", "time": "2015-03-04", "level": "", "num_look": 237511, "num_comment": 14, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "近期腾讯反病毒实验室捕获了一批针对性攻击的高级木马，该木马使用近期热门的时事话题做诱饵，对特殊人群做持续针对性攻击，目前腾讯电脑管家已经能够准确拦截和查杀该木马。"}
{"title": "漏洞预警：MongoDB phpMoAdmin曝远程代码执行漏洞（高危0day）", "url": "https://www.freebuf.com/news/59972.html", "time": "2015-03-04", "level": "", "num_look": 270896, "num_comment": 13, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "大约2个星期前，有超过40000家企业的MongoDB被发现易受黑客的攻击。而就在今天由于黑市上流传的一个高危0day漏洞又一次将MongoDB的用户置于了危险境地。"}
{"title": "记一次Linux服务器被入侵后的检测过程", "url": "https://www.freebuf.com/articles/system/59909.html", "time": "2015-03-04", "level": "现金奖励", "num_look": 1172424, "num_comment": 53, "author": "哈兹本德", "tags": ["系统安全", "网络安全"], "text": "故事是这样的，大年初一，客户反应他们服务器无法访问，查看路由，发现某oracle+tomcat服务器UDP流量超大，把带宽占完了...顾客是上帝！"}
{"title": "技术分析：“厄运cookie”漏洞（CVE-2014-9222）解密", "url": "https://www.freebuf.com/vuls/59927.html", "time": "2015-03-04", "level": "金币+8", "num_look": 392989, "num_comment": 9, "author": "Cawan", "tags": ["漏洞", "终端安全"], "text": "“厄运cookie”漏洞（CVE-2014-9222）被公开了有一阵子，但在公开环境中还是没有深入分析这个漏洞技术细节的文章。"}
{"title": "Samba NetLogon未初始化指针漏洞的复现与浅析（CVE-2015-0240）", "url": "https://www.freebuf.com/vuls/59898.html", "time": "2015-03-04", "level": "金币+8", "num_look": 332195, "num_comment": 16, "author": "hurricaner", "tags": ["漏洞", "系统安全"], "text": "Samba是利用SMB协议实现文件共享的一款著名开源工具套件。日前Samba曝出一个严重安全漏洞，该漏洞出现在smbd文件服务端，漏洞编号为 CVE-2015-0240，可以允许攻击者远程远程执行恶意代码。"}
{"title": "深度解析Windows最新进程隔离机制AppContainer", "url": "https://www.freebuf.com/articles/system/59893.html", "time": "2015-03-03", "level": "", "num_look": 440475, "num_comment": 4, "author": "腾讯电脑管家", "tags": ["系统安全"], "text": "Win8开始，Windows引入了新的进程隔离机制AppContainer，本文中，腾讯反病毒实验室对AppContainer的工作机制做一深入解读。"}
{"title": "ISIS支持者向Twitter创始人发出死亡威胁：将追杀所有Twitter员工", "url": "https://www.freebuf.com/news/59872.html", "time": "2015-03-03", "level": "", "num_look": 208869, "num_comment": 21, "author": "cindy", "tags": ["资讯"], "text": "​鉴于Twitter公司频繁封杀ISIS社交网络账号，ISIS支持者上周日呼吁世界各地的圣战分子追杀Twitter员工……"}
{"title": "蓝光光盘攻击：利用蓝光光盘植入恶意木马", "url": "https://www.freebuf.com/news/59822.html", "time": "2015-03-03", "level": "金币+5", "num_look": 160327, "num_comment": 19, "author": "JackFree", "tags": ["资讯"], "text": "近日，英国安全研究人员Stephen Tomkinson发现两个基于蓝光光盘的攻击方法，通过将恶意文件存植入到蓝光光盘中，在光驱转动时读取光盘中的恶意代码发起感染电脑、网络攻击等恶意活动。"}
{"title": "漏洞预警：D-Link（友讯）路由器存在远程命令注入漏洞", "url": "https://www.freebuf.com/news/59861.html", "time": "2015-03-03", "level": "", "num_look": 322865, "num_comment": 7, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "近日安全研究员在D-Link（友讯）路由器上发现了一个严重的安全漏洞，攻击者可以远程获得设备的最高访问权限（Root），劫持DNS设置或者在设备上执行任意命令。"}
{"title": "Aircrack除破解WiFi密码外的趣味玩法", "url": "https://www.freebuf.com/articles/wireless/59809.html", "time": "2015-03-03", "level": "金币+5", "num_look": 1310766, "num_comment": 36, "author": "D_M", "tags": ["无线安全", "网络安全"], "text": "Aircrack这种屌爆了的攻击测试套件在网上居然只有用它破解WiFi密码的教程，在这里我来扒个冷门，介绍下这款杀器的其他一些有趣的玩法。"}
{"title": "【FreeBuf视频】《安全创业公司巡礼》美国初创公司Digital Guardian：以数据为中心，企业信息全面保护", "url": "https://www.freebuf.com/news/59801.html", "time": "2015-03-03", "level": "", "num_look": 219048, "num_comment": 4, "author": "cindy", "tags": ["头条", "视频"], "text": "这是一家为企业提供信息保护解决方案的公司。Digital Guardian 是公司的旗舰产品，它通过在端点部署代理的方式保护数据免受内外部攻击。"}
{"title": "Huffy：哈夫曼编码的shellcode", "url": "https://www.freebuf.com/articles/system/59781.html", "time": "2015-03-03", "level": "金币+5", "num_look": 235424, "num_comment": 8, "author": "JackFree", "tags": ["系统安全"], "text": "今天我们将共同学习一种新的shellcode编码方式——Huffy，即基于哈夫曼编码的shellcode，这种方式利用哈夫曼树压缩数据的特性来对shellcode进行数据压缩，以达到“短小精悍”的目的。"}
{"title": "开源网站信息收集工具 - SpiderFoot v2.3.0发布", "url": "https://www.freebuf.com/sectool/59813.html", "time": "2015-03-02", "level": "", "num_look": 375260, "num_comment": 7, "author": "phper", "tags": ["工具"], "text": "SpiderFoot是一个免费的、开源的网站信息收集工具，你可以根据指定域名获得信息，如网站子域、电子邮件地址、web服务器版本等等，可以帮助渗透测试人员自动化的实现网站信息收集、资产发现的过程。"}
{"title": "启明星辰安全研究中心招聘Windows/Android安全研究员、源代码安全审计工程师", "url": "https://www.freebuf.com/jobs/59767.html", "time": "2015-03-02", "level": "", "num_look": 202687, "num_comment": 28, "author": "青衫", "tags": ["安全招聘"], "text": "启明星辰安全研究中心招聘新人啦！小伙伴儿们请看过来"}
{"title": "希捷网络存储（NAS）设备上存在0day漏洞，Metasploit已更新漏洞利用程序", "url": "https://www.freebuf.com/news/59770.html", "time": "2015-03-02", "level": "", "num_look": 209412, "num_comment": 7, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "最近安全专家在希捷网络附加存储（NAS）设备上发现了一个高危0day漏洞，攻击者可以未经授权远程执行恶意代码，获得设备Root权限。"}
{"title": "波士顿CTF大赛（Boston Key Party）战果：美国PPP战队夺冠，台湾HITCON第二，国内战队蓝莲花名列第十", "url": "https://www.freebuf.com/news/59751.html", "time": "2015-03-02", "level": "", "num_look": 214660, "num_comment": 8, "author": "hujias", "tags": ["资讯"], "text": "在上周末2/28 - 3/1进行的北美最具影响力的在线CTF大赛——美国波士顿黑客大赛（BostonKeyParty）中，美国PPP战队无悬念夺冠，台湾HITCON以第二名资格获得DEFCON世界大赛门票，国内战队蓝莲花也进入了前十。"}
{"title": "ThinkPHP框架安全实现分析", "url": "https://www.freebuf.com/articles/web/59713.html", "time": "2015-03-02", "level": "现金奖励", "num_look": 749092, "num_comment": 14, "author": "__Fr1day__", "tags": ["WEB安全"], "text": "ThinkPHP框架是国内比较流行的PHP框架之一，虽然跟国外的那些个框架没法比，但优点在于，恩，中文手册很全面。最近研究SQL注入，之前用TP框架的时候因为底层提供了安全功能，在开发过程中没怎么考虑安全问题。"}
{"title": "勒索软件Cryptolocker最新变种感染群晖NAS网络存储设备", "url": "https://www.freebuf.com/news/59687.html", "time": "2015-03-01", "level": "金币+5", "num_look": 254602, "num_comment": 2, "author": "doll", "tags": ["资讯"], "text": "2014年肆虐互联网的勒索软件Cryptolocker变种正如雨后春笋般涌现。现在，Cryptolocker开始向群晖（Synology）网络存储器设备（NAS）发起了攻击。"}
{"title": "安全科普：利用WireShark破解网站密码", "url": "https://www.freebuf.com/articles/network/59664.html", "time": "2015-03-01", "level": "金币+5", "num_look": 1451216, "num_comment": 43, "author": "JackFree", "tags": ["网络安全"], "text": "当我们输入账号、密码登录一个网站时，如果网站允许你使用HTTP（明文）进行身份验证，那么我们完全可以对捕获到的流量进行分析以获取登录账号和密码。"}
{"title": "万万没想到：麦当娜被黑客窃取的新歌，居然登上36个国家iTunes榜单首位", "url": "https://www.freebuf.com/news/59658.html", "time": "2015-02-28", "level": "", "num_look": 153727, "num_comment": 11, "author": "cindy", "tags": ["资讯"], "text": "流行音乐天后麦当娜近日在采访时称，黑客窃取并泄露了她新专辑《Rebel Heart》中尚未发布的新歌，而就在去年12月份，麦当娜的新歌DEMO也曾遭到窃取。"}
{"title": "黑客是如何利用Joomla Google地图插件进行反射DDoS攻击的", "url": "https://www.freebuf.com/news/59587.html", "time": "2015-02-28", "level": "金币+5", "num_look": 316846, "num_comment": 3, "author": "Sphinx", "tags": ["网络安全", "资讯"], "text": "安全研究人员最近发现了大量利用Joomla Google地图插件漏洞进行的反射DDoS攻击。"}
{"title": "Uber数据库遭入侵，50000名司机信息泄露", "url": "https://www.freebuf.com/news/59626.html", "time": "2015-02-28", "level": "", "num_look": 347977, "num_comment": 12, "author": "fu4k", "tags": ["资讯"], "text": "著名打车应用Uber今日发布公告，称其数据库遭到第三方黑客入侵，50000名司机的信息泄露，包括司机姓名和驾驶证号。"}
{"title": "恶意PNG：隐藏在图片中的“恶魔”", "url": "https://www.freebuf.com/articles/system/59594.html", "time": "2015-02-28", "level": "金币+10", "num_look": 446489, "num_comment": 13, "author": "JackFree", "tags": ["系统安全"], "text": "最新的Graftor木马变种可以将恶意DLL文件内嵌到PNG图片中，然后以图片为载体隐藏并将恶意DLL下载到目标系统上，并能够躲避杀毒软件的检测。针对本文中的样本，恶意内容被嵌入在了真实PNG图片数据的末尾。"}
{"title": "海康威视“黑天鹅”事件，安全漏洞是否成为商业竞争武器？", "url": "https://www.freebuf.com/news/59610.html", "time": "2015-02-28", "level": "现金奖励", "num_look": 424872, "num_comment": 19, "author": "北京老烟枪", "tags": ["资讯"], "text": "昨天一则被江苏省公安厅标记为“特急”的通知将著名监控产品供应商海康威视（Hikvision）推至了风口浪尖。"}
{"title": "技术层面小议WP-Slimstat插件高危漏洞", "url": "https://www.freebuf.com/articles/web/59580.html", "time": "2015-02-27", "level": "金币+10", "num_look": 203959, "num_comment": 1, "author": "鸢尾", "tags": ["WEB安全"], "text": "在FreeBuf前几天的《流行WordPress流量统计插件Slimstat存在高危漏洞，影响全球130万网站》报道中，小编已将WP-Slimstat插件的该安全漏洞的各中危害详细述说。那么现在我们再来看看这个漏洞的技术分析吧。"}
{"title": "【明日微博直播】北美最具影响力的在线CTF比赛BostonKeyParty即将在本周末拉开战幕", "url": "https://www.freebuf.com/fevents/59481.html", "time": "2015-02-27", "level": "红色标题", "num_look": 318470, "num_comment": 8, "author": "GCGCGCGCGCGCGC", "tags": ["活动"], "text": "北美最具影响力的在线CTF比赛BostonKeyParty即将在本周六上午开战 。今年这个比赛已经变成CMU（卡耐基梅隆大学）安全必选活动了，欢迎国内朋友们加入一起玩耍！"}
{"title": "保护你的隐私：10项你必须知道的iPhone/iPad iOS 8安全设置", "url": "https://www.freebuf.com/articles/terminal/59478.html", "time": "2015-02-27", "level": "", "num_look": 474754, "num_comment": 7, "author": "phper", "tags": ["终端安全"], "text": "也许你并不知道，苹果iOS 8里包含了多项追踪你的地理位置和个人信息的功能，其中不少是默认开启的，很多APP和广告都在通过这些功能获取你的个人信息。"}
{"title": "300万美元捉拿俄罗斯黑客：FBI重金悬赏GameOver Zeus僵尸网络主谋", "url": "https://www.freebuf.com/news/59534.html", "time": "2015-02-27", "level": "", "num_look": 168313, "num_comment": 14, "author": "Sphinx", "tags": ["资讯"], "text": "美国国务院和联邦调查局（FBI）近日宣布悬赏300万美元寻求逮捕或将一名俄罗斯黑客定罪的信息，他被指使用恶意软件窃取银行账户，窃取金额高达一亿美金。这是迄今为止美国针对网络犯罪案件最高的悬赏金额。"}
{"title": "网银木马VAWTRAK最新变种：以Word宏和PowerShell为武器，瞄准大型国际金融机构", "url": "https://www.freebuf.com/news/59522.html", "time": "2015-02-27", "level": "", "num_look": 200970, "num_comment": 4, "author": "JackFree", "tags": ["系统安全", "资讯"], "text": "该木马大量使用恶意Word宏和Windows PowerShell脚本，攻击者们已经利用该木马瞄准了花旗、汇丰、摩根大通、美国银行在内的国际金融机构。"}
{"title": "保护苹果Mac电脑数据安全，用系统内置工具就可以", "url": "https://www.freebuf.com/articles/system/59499.html", "time": "2015-02-27", "level": "", "num_look": 238989, "num_comment": 4, "author": "JackFree", "tags": ["系统安全"], "text": "当你心爱的苹果电脑遭遇盗窃或是电脑账号被非法入侵时，有没有办法保障电脑里的数据不被窃取？在本文中小编将介绍两种简单且有效的方法来保护我们的Mac电脑数据。"}
{"title": "SIM卡制造商Gemalto确认遭到黑客攻击，但否认密钥被盗", "url": "https://www.freebuf.com/news/59530.html", "time": "2015-02-27", "level": "", "num_look": 122770, "num_comment": 3, "author": "Sphinx", "tags": ["资讯"], "text": "近日SIM卡制造商Gemalto确认其遭到未知黑客的网络攻击，但公司否认加密密钥大规模被盗。"}
{"title": "“PDF文件”内藏乾坤：木马也用云技术", "url": "https://www.freebuf.com/articles/system/59414.html", "time": "2015-02-26", "level": "", "num_look": 342953, "num_comment": 17, "author": "鸢尾", "tags": ["系统安全"], "text": "近期，我们在下载一份PDF文件时发现一枚简单的恶意Downloader（一种病毒类型）。与其他恶意加载器不同，该恶意软件在其二进制中加入了PE Loader。"}
{"title": "快讯：联想官网被黑，内部邮件被劫持", "url": "https://www.freebuf.com/news/59460.html", "time": "2015-02-26", "level": "金币+10", "num_look": 337889, "num_comment": 17, "author": "hujias", "tags": ["资讯"], "text": "联想官方网站Lenovo.com今天凌晨5点左右遭遇黑客攻击，页面被劫持不断播放发型时尚男青年照片，背景音乐则一直播放美国电影《歌舞青春》中的歌曲Breaking Free。"}
{"title": "2014年漏洞最多的操作系统：苹果Mac OS X、iOS和Linux", "url": "https://www.freebuf.com/news/59412.html", "time": "2015-02-26", "level": "金币+10", "num_look": 351200, "num_comment": 20, "author": "Sphinx", "tags": ["其他", "系统安全"], "text": "无论是Mac OS X还是iPhone iOS，苹果系统一直被认为是最安全的操作系统。然而在2014年，苹果系统却获得了漏洞最多的“殊荣”。"}
{"title": "流行WordPress流量统计插件Slimstat存在高危漏洞，影响全球130万网站", "url": "https://www.freebuf.com/news/59443.html", "time": "2015-02-26", "level": "", "num_look": 258140, "num_comment": 2, "author": "hujias", "tags": ["漏洞", "资讯"], "text": "WordPress最流行的插件之一、网站流量实时统计插件WP-Slimstat被曝存在高危漏洞，该漏洞由密钥猜解引发SQL注入，可直接导致网站数据库泄露。"}
{"title": "利用路由器发起攻击：“DDoS之王”Lizard Squad的攻击武器 - Lizard Stresser", "url": "https://www.freebuf.com/news/56253.html", "time": "2015-02-25", "level": "", "num_look": 642671, "num_comment": 15, "author": "cindy", "tags": ["工具", "资讯"], "text": "Lizard所使用的攻击软件名为Lizard Stresser。Lizard Stresser，是一款强大的DDoS工具。目前Lizard Squad团队正打算把它开发为商业版本，作为攻击武器出售。"}
{"title": "免费Android移动应用安全测试虚拟机环境 - AppUse", "url": "https://www.freebuf.com/sectool/59401.html", "time": "2015-02-25", "level": "金币+10", "num_look": 342847, "num_comment": 17, "author": "fu4k", "tags": ["工具"], "text": "AppUse是一款针对Android移动应用安全测试的免费虚拟机环境，由AppSec实验室开发，内置了诸多定制化移动安全分析工具。"}
{"title": "打完微软和索尼，现在轮到谷歌了：Google越南站遭遇DNS劫持，凶手是黑客组织Lizard Squad", "url": "https://www.freebuf.com/news/59365.html", "time": "2015-02-25", "level": "", "num_look": 186402, "num_comment": 11, "author": "Sphinx", "tags": ["资讯"], "text": "前两天访问Google越南站的网民都收到了一个大大的惊喜：他们看到的不是Google的搜索界面，而是一个男人的自拍照。"}
{"title": "Facebook安全专家：联想Superfish事件只是冰山一角", "url": "https://www.freebuf.com/news/59363.html", "time": "2015-02-25", "level": "金币+6", "num_look": 347294, "num_comment": 5, "author": "JohnChu", "tags": ["系统安全", "资讯"], "text": "春节期间，联想PC上发生的“Superfish事件”在国外被炒得火热，昨天Facebook的安全专家发表了一份分析报告，他认为公众所看到的Superfish其实只是冰山一角。"}
{"title": "漏洞预警：著名共享服务套件Samba全部版本存在远程命令执行漏洞", "url": "https://www.freebuf.com/news/59355.html", "time": "2015-02-24", "level": "金币+6", "num_look": 475926, "num_comment": 5, "author": "phper", "tags": ["漏洞", "资讯"], "text": "Samba是在Linux和UNIX系统上实现SMB协议的一款著名开源工具套件。近日Samba曝出一个严重安全漏洞，该漏洞允许攻击者远程执行任意代码。"}
{"title": "西班牙、英国在内多个国家有超过250,000个路由器使用了相同的SSH密钥", "url": "https://www.freebuf.com/news/59331.html", "time": "2015-02-24", "level": "", "num_look": 273001, "num_comment": 6, "author": "Sphinx", "tags": ["资讯"], "text": "网络设备安全搜索引擎Shodan的创始人John Matherly发现西班牙、英国在内的多个国家有超过250,000个路由器使用了相同的SSH密钥。"}
{"title": "三星智能电视安全性再受指责：明文传输用户语音、文字信息", "url": "https://www.freebuf.com/news/59317.html", "time": "2015-02-24", "level": "金币+6", "num_look": 168913, "num_comment": 3, "author": "vulture", "tags": ["资讯"], "text": "此前FreeBuf曾报道过三星智能电视监控用户。然而事情远未结束，这几天关于三星智能电视泄露用户隐私的问题又有了新发现。"}
{"title": "关GPS也没用：手机电池电量会暴露你的行踪，定位准确率高达90%", "url": "https://www.freebuf.com/news/59304.html", "time": "2015-02-23", "level": "金币+6", "num_look": 1272913, "num_comment": 14, "author": "banish", "tags": ["资讯"], "text": "电池电量也会泄露手机位置信息？是的，这并不是天方夜谭。安全研究人员已经实现了一种方法，通过智能手机电池消耗精确获得的你的位置信息。"}
{"title": "玩转渗透神器Kali：Kali Linux作为主系统使用的正确姿势TIPS", "url": "https://www.freebuf.com/articles/system/59258.html", "time": "2015-02-20", "level": "金币+6", "num_look": 4333824, "num_comment": 40, "author": "huatux", "tags": ["系统安全"], "text": "Kali Linux 前身是著名渗透测试系统BackTrack ，是一个基于 Debian 的 Linux 发行版，包含很多安全和取证方面的相关工具。"}
{"title": "【FreeBuf视频】《安全大咖说》专访前Facebook安全经理王淮：我眼中的黑客与极客", "url": "https://www.freebuf.com/news/topnews/58961.html", "time": "2015-02-20", "level": "", "num_look": 360319, "num_comment": 17, "author": "FB视频", "tags": ["人物志", "头条"], "text": "FreeBuf有幸专访了技术出身，曾在海外从事安全工作多年的王淮先生，希望他的故事能让你有所收获。"}
{"title": "漏洞分析：WordPress图片插件Fancybox-For-WordPress漏洞导致批量挂马", "url": "https://www.freebuf.com/articles/web/59178.html", "time": "2015-02-20", "level": "", "num_look": 335095, "num_comment": 6, "author": "Sphinx", "tags": ["WEB安全"], "text": "上周安全研究人员发现部分Wordpress博客遭遇了批量挂马，而这些博客的共同点就是都安装了这款Fancybox插件。"}
{"title": "绕过WiFi验证：四招教你免费使用WiFi", "url": "https://www.freebuf.com/news/topnews/59191.html", "time": "2015-02-19", "level": "金币+6", "num_look": 5851386, "num_comment": 42, "author": "JackFree", "tags": ["头条", "无线安全"], "text": "藉此新春佳节，小编将向大家分享几种绕过常见WiFi身份验证的方法，祝各位过个开心年。"}
{"title": "木马植入全球硬盘、震网病毒幕后黑手：揭秘史上最强攻击组织“方程式（Equation Group）”", "url": "https://www.freebuf.com/news/59185.html", "time": "2015-02-17", "level": "金币+6", "num_look": 1311775, "num_comment": 45, "author": "phper", "tags": ["头条", "资讯"], "text": "​卡巴斯基安全实验室近日发现了一个名为方程式（Equation Group）的史上最强网络犯罪组织。该团伙已活跃近20年，在技术上超越了历史上所有的网络攻击组织。"}
{"title": "IP.Board CMS恶意重定向分析", "url": "https://www.freebuf.com/articles/web/59150.html", "time": "2015-02-17", "level": "", "num_look": 384067, "num_comment": 7, "author": "Sphinx", "tags": ["WEB安全", "网络安全"], "text": "最近Sucuri的研究员最近发现了一个针对IP.Board的重定向。经过分析，研究员们发现这种攻击已经持续了2年之久了。"}
{"title": "多给14天：谷歌Project Zero放宽漏洞披露时限", "url": "https://www.freebuf.com/news/59162.html", "time": "2015-02-16", "level": "金币+6", "num_look": 211096, "num_comment": 3, "author": "hujias", "tags": ["资讯"], "text": "如果漏洞责任方主动联系 Google，并指出漏洞正在被修复但在 90 天的时间窗口内无法完成的话，Google 将会再提供 14 天的宽限期供前者给软件打好补丁。"}
{"title": "全网约有4万MongoDB数据库完全不设防", "url": "https://www.freebuf.com/news/59143.html", "time": "2015-02-16", "level": "金币+6", "num_look": 391940, "num_comment": 15, "author": "JackFree", "tags": ["数据安全", "资讯"], "text": "近日三名德国学生发现，约40000个MongoDB数据库在无任何安全保护的情况下暴露于互联网，攻击者可以轻而易举的获得这些数据库的控制权限。"}
{"title": "【FreeBuf视频】《安全创业公司巡礼》美国初创公司Final：打造最安全的信用卡", "url": "https://www.freebuf.com/news/58971.html", "time": "2015-02-16", "level": "", "num_look": 189146, "num_comment": 8, "author": "Rechange", "tags": ["头条", "视频"], "text": "愤怒不仅出诗人，愤怒也会刺激 GEEK 改变世界。Final 团队想要做的就是打造一款终极进化版本智能信用卡。"}
{"title": "未越狱也中招：iOS平台首个间谍应用（APP）XAgent样本分析", "url": "https://www.freebuf.com/news/59131.html", "time": "2015-02-15", "level": "金币+6", "num_look": 451163, "num_comment": 15, "author": "鸢尾", "tags": ["系统安全", "资讯"], "text": "如果你是一名涉密人员（如军官、国防安全相关人士），使用过iPhone/iPad（iOS7.1以上版本），那么请赶紧仔细检测你的设备吧！"}
{"title": "Windows平台下高级Shellcode编程技术", "url": "https://www.freebuf.com/articles/system/58920.html", "time": "2015-02-15", "level": "金币+6", "num_look": 546579, "num_comment": 23, "author": "kmsrussian", "tags": ["系统安全"], "text": "本文介绍的技术在实战中应用已久，但是由于一些原因并没有做文档化。本文对关键点给出了代码实现，加入了一些笔者的新的理解。"}
{"title": "间谍游戏：用Arduino制作硬件键盘记录器", "url": "https://www.freebuf.com/sectool/59045.html", "time": "2015-02-15", "level": "", "num_look": 606799, "num_comment": 22, "author": "banish", "tags": ["工具", "极客"], "text": "我是总部的Q博士，因为刘尼玛的木马程序被全部查杀，所以他需要一个永远不可能被杀毒软件查到的木马，这个任务自然又落到了我的身上。"}
{"title": "一年一度的Pwn2Own 2015黑客大赛开始报名了", "url": "https://www.freebuf.com/news/59014.html", "time": "2015-02-15", "level": "", "num_look": 224808, "num_comment": 12, "author": "cindy", "tags": ["资讯"], "text": "今年Pwn2Own的奖金预计为：50万美金现金及非现金性奖励。值得一提的是，谷歌Project Zero在今年也加入了赛事赞助行列。"}
{"title": "如何科学的抢红包第二弹", "url": "https://www.freebuf.com/articles/web/59071.html", "time": "2015-02-14", "level": "金币+7", "num_look": 422024, "num_comment": 26, "author": "adrain", "tags": ["WEB安全", "极客"], "text": "自己这段时间正在学习爬虫的相关知识，对scrapy框架有所了解，就利用scrapy对上一篇“科学抢红包”文章中“爬取红包列表”部分进行了重写。"}
{"title": "Google Play商店漏洞：黑客可远程在你的安卓手机上安装恶意APP", "url": "https://www.freebuf.com/news/59057.html", "time": "2015-02-14", "level": "", "num_look": 224336, "num_comment": 8, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "安全研究人员发现Google Play商店中两个严重安全漏洞，可以允许攻击者远程在用户的安卓设备上安装并下载恶意APP（应用）。"}
{"title": "Facebook用户相册任意删除漏洞", "url": "https://www.freebuf.com/news/59011.html", "time": "2015-02-14", "level": "", "num_look": 237018, "num_comment": 14, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "印度安全研究人员Laxman Muthiyah 在Facebook  Graph API上发现一个安全漏洞，攻击者可以利用该漏洞删除任意用户Facebook相册。"}
{"title": "如何科学的抢红包：年末致富有新招，写个程序抢红包", "url": "https://www.freebuf.com/articles/web/59024.html", "time": "2015-02-13", "level": "红色标题", "num_look": 963252, "num_comment": 37, "author": "IDF_Lab", "tags": ["WEB安全", "极客"], "text": "红包纷纷何所似？兄子胡儿曰：“撒钱空中差可拟。”兄女道韫曰：“未若姨妈因风起。”"}
{"title": "渗透测试系统Kali Linux 1.1.0发布", "url": "https://www.freebuf.com/sectool/58841.html", "time": "2015-02-13", "level": "金币+7", "num_look": 436185, "num_comment": 28, "author": "hxdef_tiffany", "tags": ["工具"], "text": "Kali Linux 1.1.0 版本能很好的运行在 ARM 硬件中，使用 Linux Kernel 3.18，更多更新内容请看发行说明。"}
{"title": "安全研究人员Mark Burnett：今天我将公开一千万密码库", "url": "https://www.freebuf.com/news/58993.html", "time": "2015-02-13", "level": "", "num_look": 332773, "num_comment": 33, "author": "fu4k", "tags": ["资讯"], "text": "Mark决定向全世界分享一份密码数据合集，他认为一份精心整理过的用户名及其对应的密码数据将使得普通用户更了解和重视密码安全。"}
{"title": "【FreeBuf视频】《安全创业公司巡礼》美国初创公司Shape Security：使用代码变形技术的僵尸防火墙", "url": "https://www.freebuf.com/news/58973.html", "time": "2015-02-13", "level": "红色标题", "num_look": 337006, "num_comment": 6, "author": "FB视频", "tags": ["视频", "资讯"], "text": "Shape Security是一家由前 Google 员工参与创办的网络安全初创企业，成立于 2010 年，总部亦位于山景城，现有员工 58 人。"}
{"title": "勒索软件CTB-Locker核心原理的一些疑问和分析", "url": "https://www.freebuf.com/articles/system/57918.html", "time": "2015-02-13", "level": "现金奖励", "num_look": 269678, "num_comment": 7, "author": "shadowhunter", "tags": ["系统安全"], "text": "一直在国外流行的勒索软件在前几天“不远万里来到了中国”。当然它并不是来救死扶伤的而是将你的文件加密，然后要求你访问指定的服务器并支付一定比特币来解密它们。"}
{"title": "50元制作PS2键盘无线监控装置", "url": "https://www.freebuf.com/geek/58895.html", "time": "2015-02-12", "level": "现金奖励", "num_look": 497318, "num_comment": 49, "author": "anymous", "tags": ["极客"], "text": "Arduino 不需要知道各种硬件的底层知识，这些底层的调用都已经提前帮你实现好了。"}
{"title": "暗网搜索引擎Memex：美帝最新制造的犯罪追踪神器（含视频）", "url": "https://www.freebuf.com/news/58871.html", "time": "2015-02-12", "level": "金币+7", "num_look": 2094434, "num_comment": 24, "author": "dawner", "tags": ["头条", "网络安全"], "text": "早在一年前，美国国防部先进研究项目局（DARPA）曾透漏过一个秘密项目——一款新型搜索引擎。"}
{"title": "宝马汽车安全漏洞详解：古有伯乐识良驹，今有黑客擒宝马", "url": "https://www.freebuf.com/vuls/58828.html", "time": "2015-02-11", "level": "金币+7", "num_look": 543873, "num_comment": 24, "author": "Rabbit_Run", "tags": ["头条", "漏洞"], "text": "安全专家深入分析宝马汽车ConnectedDrive系统的数据传输过程。最终，他发现一系列安全漏洞，允许未授权的攻击者打开车门。"}
{"title": "裸奔吧！APP：揭秘安卓UC浏览器与PP助手私密文件夹羞羞的事情", "url": "https://www.freebuf.com/news/topnews/58844.html", "time": "2015-02-11", "level": "金币+7", "num_look": 1038600, "num_comment": 68, "author": "p0tt1", "tags": ["其他", "头条"], "text": "这次的事情呢，说起来有点蛋疼。没收了某人的一部手机，心生邪念，想看看他平时都在看那些网页……"}
{"title": "多家知名连锁酒店、高端品牌酒店存在严重安全漏洞，海量开房信息存泄露风险", "url": "https://www.freebuf.com/news/topnews/58843.html", "time": "2015-02-11", "level": "红色标题", "num_look": 644447, "num_comment": 29, "author": "漏洞盒子", "tags": ["WEB安全", "其他"], "text": "知名连锁酒店桔子、锦江之星、速八、布丁；高端酒店万豪（丽思卡尔顿酒店等）、喜达屋（喜来登、艾美酒店等）、洲际（假日酒店等）网站存在高危漏洞，可查看大量房客开房信息。"}
{"title": "黄金搭档：安全研究人员发现Flash 0day漏洞与BEDEP病毒存在密切关联", "url": "https://www.freebuf.com/news/58781.html", "time": "2015-02-11", "level": "", "num_look": 195262, "num_comment": 4, "author": "Sphinx", "tags": ["系统安全", "资讯"], "text": "最近趋势科技的安全研究人员在对Adobe 0day漏洞的跟踪调查中，发现了BEDEP系列病毒与Adobe Flash 0day漏洞存在密切关联。"}
{"title": "漏洞分析：一个Markdown解析器的持久型XSS漏洞（CVE-2014-5144）", "url": "https://www.freebuf.com/articles/web/58687.html", "time": "2015-02-10", "level": "金币+6", "num_look": 353564, "num_comment": 7, "author": "Conermx", "tags": ["WEB安全"], "text": "Markdown是一种轻量级的标记语言，流行程度已经得到了GitHub和Stack Overflow的广泛支持。事实上，很多markdown解析器都没有过滤用户输入的数据，那么如果其被用于评论等功能时，就有可能存在安全风险。"}
{"title": "三星承认其智能电视一直在监控用户", "url": "https://www.freebuf.com/news/58766.html", "time": "2015-02-10", "level": "金币+6", "num_look": 350210, "num_comment": 25, "author": "Conermx", "tags": ["资讯"], "text": "以后坐在智能联网电视面前老实点吧……"}
{"title": "【更新中文视频】全球第一黑客组织Anonymous（匿名者）宣布已拿下数百个ISIS社交网络帐号", "url": "https://www.freebuf.com/news/58765.html", "time": "2015-02-10", "level": "红色标题", "num_look": 707625, "num_comment": 45, "author": "hujias", "tags": ["视频", "资讯"], "text": "日前，黑客组织Anonymous（匿名者）已向恐怖组织ISIS发起大规模网络攻击。ISIS不同于一般的恐怖组织，它善于利用Facebook, Twitter, YouTube和Instagram这类社交网络作为宣传阵地。"}
{"title": "多步CSRF漏洞场景及其利用", "url": "https://www.freebuf.com/articles/web/58387.html", "time": "2015-02-10", "level": "金币+6", "num_look": 314917, "num_comment": 15, "author": "xd_xd", "tags": ["WEB安全"], "text": "CSRF的漏洞原理和利用方式这里就不多赘述了。平时大家讨论的CSRF利用多是发送一次请求。比如CSRF刷粉丝，CSRF发微博。这里主要讨论一个稍微复杂点的利用场景。"}
{"title": "FreeBuf年终策划：2014年互联网安全厂商年终报告汇总（国外版）上", "url": "https://www.freebuf.com/news/topnews/58645.html", "time": "2015-02-10", "level": "金币+6", "num_look": 511657, "num_comment": 9, "author": "Rabbit_Run", "tags": ["其他", "头条"], "text": "作为一名有操守的编辑，我坚持宁缺毋滥，从中筛选出3篇有关互联网整体安全状况的研究报告，提取报告的主要内容供大家参考。"}
{"title": "HTTP(S)网站目录暴破测试工具 - Dirs3arch v0.3.0", "url": "https://www.freebuf.com/sectool/58732.html", "time": "2015-02-10", "level": "", "num_look": 360597, "num_comment": 21, "author": "phper", "tags": ["工具"], "text": "dirs3arch是一个命令行形式的目录暴破测试工具，可以通过暴力尝试的方法发现网站隐藏的目录和文件。"}
{"title": "科诺康（Codenomicon）招聘网络安全服务工程师", "url": "https://www.freebuf.com/jobs/56799.html", "time": "2015-02-09", "level": "", "num_look": 206175, "num_comment": 9, "author": "铁腿草上飞", "tags": ["安全招聘"], "text": "科诺康是一家提供主动性安全解决方案的世界领先厂商，在今年率先发现了被称为信息安全\"核弹级漏洞\"的OpenSSL心脏出血漏洞。"}
{"title": "如此惨淡：著名开源电子邮件加密软件GPG只有一个人维护，而且快破产了", "url": "https://www.freebuf.com/news/58684.html", "time": "2015-02-09", "level": "红色标题", "num_look": 514034, "num_comment": 37, "author": "phper", "tags": ["其他", "资讯"], "text": "Werner Koch从1997年开始写GPG，无论是升级或是打补丁，他基本是在独立运营这款安全软件。最近悲剧发生了——已经53岁的他濒临破产。"}
{"title": "漏洞预警：LG手机认证权限绕过漏洞，可远程控制手机（附POC和视频演示）", "url": "https://www.freebuf.com/news/58653.html", "time": "2015-02-09", "level": "金币+6", "num_look": 276649, "num_comment": 5, "author": "Conermx", "tags": ["漏洞", "资讯"], "text": "安全研究人员最近发现了LG手机一个非常严重的漏洞，攻击者可以在用户毫无察觉的情况下控制LG手机，完全不需要物理接触。攻击者只要跟目标在同一个局域网内就可以实施攻击，比如连了同一个WIFI。"}
{"title": "以假乱真：攻击者利用伪造的WhatsApp Web传播木马", "url": "https://www.freebuf.com/news/58574.html", "time": "2015-02-09", "level": "", "num_look": 164769, "num_comment": 1, "author": "JackFree", "tags": ["资讯"], "text": "上个月，全球流行的移动应用WhatsApp（可以认为是美国的微信）发布了Web版客户端，然而很快“李鬼”WhatsApp Web也紧随而来。目前，通过伪造WhatsApp进行传播的网银木马正在巴西泛滥。"}
{"title": "如何清除Bootkit木马后门", "url": "https://www.freebuf.com/sectool/58631.html", "time": "2015-02-09", "level": "", "num_look": 325651, "num_comment": 13, "author": "鸢尾", "tags": ["工具", "系统安全"], "text": "所有在开机时比Windows内核更早加载，实现内核劫持的技术，都可以称之为Bootkit。"}
{"title": "全面升级：网银木马DYRE最新变种开始利用微软Outlook攻击银行", "url": "https://www.freebuf.com/news/58583.html", "time": "2015-02-09", "level": "", "num_look": 201061, "num_comment": 4, "author": "Sphinx", "tags": ["系统安全", "资讯"], "text": "DYRE是一款针对金融机构的恶意木马，2014年全球范围内多次的网络钓鱼攻击事件中我们曾发现它的踪迹。最近，趋势科技的安全研究人员发现DYRE的最新变种开始利用微软Outlook传播病毒。"}
{"title": "汽车安全：汽车黑客手册（电子书下载）", "url": "https://www.freebuf.com/articles/others-articles/58625.html", "time": "2015-02-09", "level": "", "num_look": 373957, "num_comment": 10, "author": "凌晨几度i", "tags": ["其他", "系统安全"], "text": "今天FreeBuf为大家介绍一本汽车安全技术学习手册。"}
{"title": "汽车安全：我眼中的汽车安全边界防火墙", "url": "https://www.freebuf.com/articles/neopoints/58524.html", "time": "2015-02-08", "level": "", "num_look": 157107, "num_comment": 6, "author": "tofreebug", "tags": ["观点"], "text": "如果说PC安全演变是普通汽车的速度，移动安全发展就像特斯拉了，而车联网发展不亚于Elon Musk的hyperloop。"}
{"title": "真相只有一个：入侵索尼影视的居然是俄罗斯黑客？", "url": "https://www.freebuf.com/news/58552.html", "time": "2015-02-07", "level": "红色标题", "num_look": 351217, "num_comment": 27, "author": "Rechange", "tags": ["资讯"], "text": "在2014年11月索尼影视入侵事件刚刚发生时，所有人都把矛头指向了朝鲜。而就在这两天，一位名为YamaTough的俄罗斯小伙出来爆料了——入侵索尼的真正凶手是俄罗斯黑客。"}
{"title": "通过Google Play商店传播：恶意广告APP感染超过1500万用户", "url": "https://www.freebuf.com/news/58513.html", "time": "2015-02-06", "level": "", "num_look": 220171, "num_comment": 15, "author": "JackFree", "tags": ["资讯"], "text": "近日Avast公司的安全专家发现了3个恶意安卓应用（APP），它们提供恶意广告下载服务。目前全球已有超过1500万用户通过谷歌Play商店受到感染。"}
{"title": "泄露数据中的秘密：中国网民的密码设置习惯", "url": "https://www.freebuf.com/news/58481.html", "time": "2015-02-06", "level": "", "num_look": 481569, "num_comment": 16, "author": "无贼网", "tags": ["WEB安全", "头条"], "text": "2014年又是网络安全史上不平静的一年，从年初的携程的信用卡大规模泄露，再到各种拥有奇怪名字的开源软件漏洞，然后是索尼被黑客翻了个底朝天，年末的时候黑客们又为我们奉上了一道大菜——购票网的撞库事件。"}
{"title": "Python黑客学习笔记：从HelloWorld到编写PoC（上）", "url": "https://www.freebuf.com/news/topnews/58048.html", "time": "2015-02-06", "level": "金币+15", "num_look": 2701386, "num_comment": 75, "author": "嘎巴嘎巴", "tags": ["WEB安全", "头条"], "text": "本系列文章适合CS在读学生和万年工具党，本文会在英文​原文的基础上做些修改，并适当增加些解释说明。"}
{"title": "极客DIY：教你手工制作一台投影仪", "url": "https://www.freebuf.com/geek/58390.html", "time": "2015-02-06", "level": "", "num_look": 756292, "num_comment": 18, "author": "geekman", "tags": ["极客"], "text": "极客君又来啦！今天为大家分享的是投影仪的DIY。对于多数人来说，一台投影仪动辄几千的价格着实让人心碎……那么今天这篇教程能让你省下一半的钱！"}
{"title": "未越狱的iPhone/iPad也中招：走近强大的间谍软件XAgent与MadCap", "url": "https://www.freebuf.com/news/58471.html", "time": "2015-02-06", "level": "红色标题", "num_look": 553216, "num_comment": 13, "author": "cindy", "tags": ["头条", "终端安全"], "text": "即使你使用的是未越狱的iPhone或iPad，现在，你也要多留个心眼了——不要点击任何可疑链接。"}
{"title": "漏洞追踪：最新IE UXSS漏洞技术分析", "url": "https://www.freebuf.com/articles/web/58435.html", "time": "2015-02-05", "level": "金币+15", "num_look": 280479, "num_comment": 13, "author": "Conermx", "tags": ["WEB安全"], "text": "最近David Leo在Full Disclosure上爆出了一个ie的 uxss 漏洞，可以绕过ie的同源策略。FreeBuf也有相关的报道（点我查看）。本文简要分析一下这个漏洞的原理。"}
{"title": "来看看美帝人民的安全意识：安全研究人员指责iOS版Outlook存在多处安全隐患", "url": "https://www.freebuf.com/news/58319.html", "time": "2015-02-05", "level": "", "num_look": 321157, "num_comment": 5, "author": "cindy", "tags": ["安全管理", "资讯"], "text": "前不久微软刚刚发布了iOS版Outlook应用程序，而这几天安全研究人员René Winkelmeyer发现其数个安全隐患，包括微软可以在用户毫不知情的情况下获取用户的邮箱账户和服务器数据。"}
{"title": "最新XSS 0day漏洞来袭，影响最新版本IE浏览器（含POC）", "url": "https://www.freebuf.com/news/58376.html", "time": "2015-02-05", "level": "金币+15", "num_look": 408821, "num_comment": 14, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "安全研究人员近日发现了一个严重的XSS 0day漏洞，该漏洞可影响最新版本的IE浏览器，将用户暴露在被攻击和身份盗窃的危险之中。"}
{"title": "Win10安全特性之执行流保护", "url": "https://www.freebuf.com/articles/security-management/58373.html", "time": "2015-02-05", "level": "", "num_look": 519067, "num_comment": 22, "author": "腾讯电脑管家", "tags": ["安全管理"], "text": "微软在2015年1月22日公布了windows10技术预览版，Build号：9926。电脑管家反病毒实验室第一时间对其引入的新安全特性进行了深入分析。"}
{"title": "揭秘：针对中国移动用户的强大网银木马剖析", "url": "https://www.freebuf.com/news/topnews/58329.html", "time": "2015-02-05", "level": "金币+15", "num_look": 642371, "num_comment": 33, "author": "JackFree", "tags": ["头条", "终端安全"], "text": "我们最近遇到一个安卓平台的网银木马，该木马主要瞄向中国的移动用户，检出率很低。该安卓木马能够拦截短信并寻找特定的关键字，盗取用户网银信息。"}
{"title": "WPA-PSK无线网络破解原理及过程", "url": "https://www.freebuf.com/articles/wireless/58342.html", "time": "2015-02-05", "level": "金币+15", "num_look": 2356098, "num_comment": 46, "author": "shentouceshi", "tags": ["无线安全", "网络安全"], "text": "本文将主要讲讲WPA-PSK类型的无线网络安全问题，当然少不了大家最感兴趣的无线网络破解。"}
{"title": "技术分享：如何在PNG图片的IDAT CHUNKS中插入Webshell", "url": "https://www.freebuf.com/articles/web/58278.html", "time": "2015-02-04", "level": "金币+15", "num_look": 560357, "num_comment": 22, "author": "nandisec", "tags": ["WEB安全"], "text": "把webshell编入一个图片中，就能够绕过绕过服务器的边界过滤，然后就像凭空让shell真实出现了一样。（并不是在comments或者metadata中编码），那么如何只用GD就将PHP shell写入PNG IDAT？"}
{"title": "热门游戏《英雄联盟》再曝漏洞：黑客可访问玩家账户盗取点券和金币", "url": "https://www.freebuf.com/news/58301.html", "time": "2015-02-04", "level": "金币+15", "num_look": 469575, "num_comment": 22, "author": "鸢尾", "tags": ["漏洞", "资讯"], "text": "国外著名社区Reddit近日爆出热门游戏《英雄联盟》（LOL）一个漏洞利用程序（exploit），攻击者可以访问玩家账户，通过Web浏览器打开游戏中的商店进行点券或金币交易。"}
{"title": "阿里巴巴集团安全部招聘启事", "url": "https://www.freebuf.com/jobs/50135.html", "time": "2015-02-04", "level": "", "num_look": 1014618, "num_comment": 61, "author": "北北北北", "tags": ["安全招聘"], "text": "阿里巴巴集团安全部（云盾产品方向）招聘启事（P6或以上级别）"}
{"title": "使用Kali Linux在渗透测试中信息收集", "url": "https://www.freebuf.com/articles/system/58096.html", "time": "2015-02-04", "level": "现金奖励", "num_look": 2475231, "num_comment": 42, "author": "linkbg", "tags": ["系统安全", "网络安全"], "text": "在本文中，我们将讨论渗透测试中第二个阶段——信息收集。我们会介绍Kali中一系列的信息收集工具。在阅读本文之后，我们希望你能对信息收集有更好的理解。"}
{"title": "黑客伪装美女窃取叙利亚反对派近8G军事机密", "url": "https://www.freebuf.com/news/58217.html", "time": "2015-02-04", "level": "金币+15", "num_look": 321617, "num_comment": 26, "author": "cindy", "tags": ["其他", "头条"], "text": "FireEye近日发布报告称，黑客入侵了叙利亚反对派的计算机网络，窃取了近7.7GB的秘密通讯内容和军事计划。"}
{"title": "太平洋网络集团招聘安全工程师", "url": "https://www.freebuf.com/jobs/58120.html", "time": "2015-02-03", "level": "", "num_look": 159144, "num_comment": 18, "author": "judyjnu", "tags": ["安全招聘"], "text": "太平洋网络（股票编号0543）是中国最主要的互联网内容提供商之一，公司致力成为中国互联网专业内容领域的领航者。于2007年成功在香港上市，并被美国《福布斯》杂志评为最佳亚洲企业。"}
{"title": "0day第三弹：又一个Flash严重漏洞曝光", "url": "https://www.freebuf.com/news/58194.html", "time": "2015-02-03", "level": "", "num_look": 209323, "num_comment": 9, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "日前，第三个严重的Flash 0day漏洞现身。该漏洞影响Windows、Linux、Mac系统上Adobe Flash Player 16.0.0.296和所有早期版本，可导致攻击者控制目标系统。"}
{"title": "FreeBuf年终策划：2014国内互联网安全精彩活动回顾", "url": "https://www.freebuf.com/news/57315.html", "time": "2015-02-03", "level": "", "num_look": 210411, "num_comment": 11, "author": "cindy", "tags": ["头条", "资讯"], "text": "小编在此与大家一同回顾2014年，那些给我们留下深刻印象的欢聚时光（排名不分先后）"}
{"title": "修复Firefox（火狐）浏览器常用安全测试插件Live HTTP Headers的replay功能", "url": "https://www.freebuf.com/sectool/58071.html", "time": "2015-02-03", "level": "金币+6", "num_look": 610211, "num_comment": 18, "author": "k623277335", "tags": ["WEB安全", "工具"], "text": "Live Http headers是Firefox下Http头信息捕获利器，常用于安全测试。但不幸的是Replay功能无法在最近版本的Firefox浏览器(35.0.1)中工作，我决定在插件的官方版本更新之前做一个临时的修复。"}
{"title": "第二代树莓派全新发布：900MHz四核ARM Cortex-A7，1G内存，支持Win10", "url": "https://www.freebuf.com/news/58154.html", "time": "2015-02-03", "level": "金币+6", "num_look": 628010, "num_comment": 35, "author": "anymous", "tags": ["极客", "资讯"], "text": "新树莓派2 B型发布，900MHz四核ARM Cortex-A7，1G内存，支持win10！"}
{"title": "Windows10系统的控制流防护机制初窥", "url": "https://www.freebuf.com/articles/system/58138.html", "time": "2015-02-03", "level": "", "num_look": 258445, "num_comment": 12, "author": "JackFree", "tags": ["系统安全"], "text": "操作系统开发人员总是热衷于提高漏洞防御技术，微软在Windows10和Windows8.1Update3（2014年11月发布）系统中已经默认启用了一种新的机制，这种技术称为控制流防护（Control Flow Guard , CFG）。"}
{"title": "中兴路由器（SOHO Router）暗藏后门", "url": "https://www.freebuf.com/news/58137.html", "time": "2015-02-03", "level": "金币+6", "num_look": 225464, "num_comment": 17, "author": "午夜灰狼哥", "tags": ["资讯"], "text": "中兴公司（ZTE）生产的SOHO Router部分型号路由器中被发现存在后门。早在2014年3月，知名安全公司Rapid7就披露了中兴公司的路由器存在已知后门。不过在接下来的几个月内，中兴公司并未对该漏洞进行修复。"}
{"title": "【FreeBuf视频】《安全大咖说》专访阿里安全吴翰清（刺）：勿忘初心", "url": "https://www.freebuf.com/news/topnews/58081.html", "time": "2015-02-03", "level": "红色标题", "num_look": 593547, "num_comment": 37, "author": "FB视频", "tags": ["人物志", "头条"], "text": "两年前FreeBuf曾对道哥（刺）做过专访。光阴匆匆，在经历了一段并不平凡的创业生涯之后，吴翰清又有哪些感悟呢？"}
{"title": "华三通信招聘安全攻防研究和服务工程师", "url": "https://www.freebuf.com/jobs/57908.html", "time": "2015-02-02", "level": "", "num_look": 260485, "num_comment": 46, "author": "finnhoho", "tags": ["安全招聘"], "text": "杭州华三通信技术有限公司（简称华三通信），致力于IT基础架构产品及方案的研究、开发、生产、销售及服务。华三通信在中国设有38个分支机构，目前公司有员工5000人，其中研发人员占55％。"}
{"title": "木马的自我修炼：金融恶意程序f0xy最新变种很机智", "url": "https://www.freebuf.com/news/58072.html", "time": "2015-02-02", "level": "", "num_look": 154020, "num_comment": 10, "author": "cindy", "tags": ["资讯"], "text": "安全研究人员于2015年1月13日发现了第一例f0xy恶意程序，随后f0xy感染能力不断的变化和提高，从最初只能感染Windows Vista，到后来变种可感染Windows XP，而到现在，杀毒软件已经很难发现它了。"}
{"title": "最新传入国内的Virlock“敲诈者”病毒完整技术分析", "url": "https://www.freebuf.com/articles/system/57983.html", "time": "2015-02-02", "level": "", "num_look": 539935, "num_comment": 17, "author": "360安全", "tags": ["安全报告", "系统安全"], "text": "VirLock敲诈者病毒最早在国外流行，比CTB-Locker“敲诈者”病毒感染的文件类型更多，包括了常见的MP3和MPG等影音文件，这意味着受影响的用户范围会更大，传播也会更广。"}
{"title": "美国陆军制造：开源攻击分析框架Dshell", "url": "https://www.freebuf.com/sectool/58038.html", "time": "2015-02-02", "level": "金币+6", "num_look": 269898, "num_comment": 6, "author": "JackFree", "tags": ["工具"], "text": "近日，美国陆军将内部使用的攻击取证分析框架Dshell开源化，陆军研究实验室在曾经的一段时间内使用该工具来检测内部网络攻击。"}
{"title": "移动云存储服务平台Parse下的iOS安全分析", "url": "https://www.freebuf.com/articles/system/58001.html", "time": "2015-02-02", "level": "", "num_look": 353999, "num_comment": 4, "author": "鸢尾", "tags": ["系统安全", "网络安全"], "text": "或许正是Parse这种简单的产品体验，让开发者遗忘了安全问题以及漏洞。"}
{"title": "验证码的未来：扒一扒reCAPTCHA的那些事", "url": "https://www.freebuf.com/news/topnews/57496.html", "time": "2015-02-02", "level": "金币+6", "num_look": 880341, "num_comment": 103, "author": "ArkTeam", "tags": ["WEB安全", "其他"], "text": "reCAPTCHA不仅是一种验证码服务，同时也是一项具有重要意义的文化工程。被Google收购之后，reCAPTCHA内容也更加丰富。"}
{"title": "电子取证实例：基于文件系统的磁盘数据取证分析", "url": "https://www.freebuf.com/articles/system/57804.html", "time": "2015-02-02", "level": "现金奖励", "num_look": 345963, "num_comment": 13, "author": "NSTRT", "tags": ["系统安全"], "text": "随着计算机犯罪个案数字不断上升和犯罪手段的数字化，搜集电子证据的工作成为提供重要线索及破案的关键。恢复已被破坏的计算机数据及提供相关的电子资料证据就是电子取证。"}
{"title": "渗透测试系统BackBox Linux 4.1发布", "url": "https://www.freebuf.com/sectool/58012.html", "time": "2015-02-01", "level": "金币+6", "num_look": 984586, "num_comment": 38, "author": "帅气凌云", "tags": ["工具"], "text": "BackBox是基于Ubuntu的Linux发行版，它是一款用于网络渗透测试及安全评估的操作系统。新版本包括Linux 3.13内核，EFI 模式，匿名模式等。"}
{"title": "CMS漏洞检测工具 - CMSmap", "url": "https://www.freebuf.com/sectool/58022.html", "time": "2015-02-01", "level": "金币+5", "num_look": 1308561, "num_comment": 18, "author": "Dreamdroid", "tags": ["工具"], "text": "CMSmap是一个Python编写的针对开源CMS（内容管理系统）的安全扫描器，它可以自动检测当前国外最流行的CMS的安全漏洞。"}
{"title": "空Word文档附件：绕过垃圾邮件过滤的新方法", "url": "https://www.freebuf.com/news/57944.html", "time": "2015-01-31", "level": "", "num_look": 171862, "num_comment": 10, "author": "Sphinx", "tags": ["资讯"], "text": "安全研究人员最近发现，垃圾邮件发送者们正在使用一种新的手法绕过垃圾邮件过滤系统——空Word文档。"}
{"title": "17岁少年披露“美国版微信”WhatsApp Web两个安全漏洞", "url": "https://www.freebuf.com/news/57926.html", "time": "2015-01-30", "level": "金币+5", "num_look": 243194, "num_comment": 23, "author": "hujias", "tags": ["资讯"], "text": "国外最流行的移动通信APP（也就是美国的微信）WhatsApp最近开发出了网页版。可惜没上线多久，一位17岁的印度少年就发现了它2个安全漏洞。"}
{"title": "D-Link路由器曝远程DNS劫持漏洞", "url": "https://www.freebuf.com/news/57949.html", "time": "2015-01-30", "level": "", "num_look": 310277, "num_comment": 12, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "安全研究人员发现D-Link路由器上存在高危DNS劫持漏洞。不仅如此，该漏洞还影响所有使用ZynOS固件的路由器，品牌包括D-Link（友讯）、TP-Link（深圳普联）、ZTE（中兴通讯）。"}
{"title": "漏洞追踪：Flash严重漏洞（CVE-2015-0311）详细技术分析", "url": "https://www.freebuf.com/vuls/57925.html", "time": "2015-01-30", "level": "", "num_look": 1067358, "num_comment": 11, "author": "TaoGOGO", "tags": ["漏洞"], "text": "上周的Flash 0day漏洞各位玩爽了吧。知其然还要知其所以然，玩耍累了坐下来看看这个漏洞的成因。趋势科技近日对漏洞进行了详细的分析，笔者翻译过来，以飨读者。"}
{"title": "自动化攻击测试平台Cobalt Strike v2.3破解版", "url": "https://www.freebuf.com/sectool/57810.html", "time": "2015-01-30", "level": "", "num_look": 348766, "num_comment": 19, "author": "Jumbo", "tags": ["工具"], "text": "Armitage是一款Java写的Metasploit图形界面的渗透测试软件，可以用它结合Metasploit已知的exploit来针对存在的漏洞进行自动化测试。"}
{"title": "“暗云”BootKit木马详细技术分析", "url": "https://www.freebuf.com/vuls/57868.html", "time": "2015-01-30", "level": "红色标题", "num_look": 1551839, "num_comment": 48, "author": "腾讯电脑管家", "tags": ["漏洞", "系统安全"], "text": "“暗云”是一个迄今为止最复杂的木马之一，感染了数以百万的计算机，暗云木马使用了很多复杂的、新颖的技术来实现长期地潜伏在用户的计算机系统中。其使用了BootKit技术，感染后即使重装格式化硬盘也无法清除。"}
{"title": "Java成为当下美国PC面临的最大安全威胁", "url": "https://www.freebuf.com/news/57874.html", "time": "2015-01-29", "level": "金币+5", "num_look": 188317, "num_comment": 9, "author": "Sphinx", "tags": ["资讯"], "text": "根据安全厂商Secunia最新发布的报告，甲骨文的Java软件是当今美国PC的最大安全威胁，紧随其后的是苹果的Quicktime 7.x。"}
{"title": "绿盟科技沈阳分公司招聘网络安全工程师", "url": "https://www.freebuf.com/jobs/57898.html", "time": "2015-01-29", "level": "", "num_look": 372310, "num_comment": 83, "author": "jelly2014", "tags": ["安全招聘"], "text": "绿盟科技现有员工近1600人。在美国硅谷、日本东京设有分支机构，在开拓北美及亚太地区的海外市场的同时，进行安全战略研究及技术预研。"}
{"title": "漏洞追踪：如何检查并修复GHOST（幽灵）漏洞", "url": "https://www.freebuf.com/articles/system/57878.html", "time": "2015-01-29", "level": "金币+5", "num_look": 225735, "num_comment": 12, "author": "Conermx", "tags": ["系统安全"], "text": "这两天互联网安全圈因GHOST（幽灵）漏洞而变得异常热闹。那么现在问题来了：如何稳定、安全的检查并修复这个漏洞？"}
{"title": "代码相似，著名间谍软件Regin与键盘记录器Qwerty出自同个作者？", "url": "https://www.freebuf.com/news/57862.html", "time": "2015-01-29", "level": "", "num_look": 157460, "num_comment": 10, "author": "cindy", "tags": ["资讯"], "text": "恶意软件Regin和QWERTY的关系如此紧密，是否也暗示着NSA和五只眼（Five Eyes）有着千丝万缕的关联呢？"}
{"title": "一个小白用户的愤怒：铁通广告奇遇记", "url": "https://www.freebuf.com/news/topnews/57818.html", "time": "2015-01-29", "level": "金币+5", "num_look": 871380, "num_comment": 75, "author": "llopppp", "tags": ["其他", "头条"], "text": "在家里用安卓网络机顶盒上土豆网准备看些视频。不过，进入土豆网（www.tudou.com）点开我想看的视频后，发现竟然跳转到了某不知名的淫秽色情网站！"}
{"title": "IE沙箱特权提升漏洞（CVE-2015-0016）分析", "url": "https://www.freebuf.com/articles/system/57822.html", "time": "2015-01-29", "level": "金币+5", "num_look": 221068, "num_comment": 7, "author": "Sphinx", "tags": ["系统安全"], "text": "本月微软的“星期二补丁”如约而至，其中就包括MS15-004补丁，修复了一个可能导致特权提升的漏洞(CVE-2015-0016)，这是一个非常罕见的针对IE沙箱的漏洞，趋势科技的研究员对这个漏洞进行了详细的分析。"}
{"title": "国产开源内网信息收集工具v1.0", "url": "https://www.freebuf.com/sectool/57828.html", "time": "2015-01-29", "level": "金币+5", "num_look": 717911, "num_comment": 69, "author": "小歪", "tags": ["工具"], "text": "这是一个内网信息收集的工具，可用于内网渗透测试辅助之用。为什么要写这个东西呢？就是想把重复的敲打命令直接搞成一键完成，节省时间，节省人工成本。"}
{"title": "一条短信破解“全球最安全的手机​”漏洞披露", "url": "https://www.freebuf.com/news/57824.html", "time": "2015-01-29", "level": "", "num_look": 287555, "num_comment": 10, "author": "Sphinx", "tags": ["终端安全", "资讯"], "text": "Freebuf曾经报道过，号称“全球最安全的手机”的BlackPhone在去年的黑帽大会上被黑客团队TeamAndIRC小组用时5分钟破解，获得root权限。利用这个漏洞，攻击者能够仅用一条短信就攻陷手机，在手机上执行恶意代码。"}
{"title": "FreeBuf年终策划：2014年互联网安全厂商年终报告汇总（国内版）", "url": "https://www.freebuf.com/news/57666.html", "time": "2015-01-29", "level": "金币+5", "num_look": 245932, "num_comment": 16, "author": "Rabbit_Run", "tags": ["头条", "安全报告"], "text": "2014年刚过去，国内各大安全公司、互联网公司陆续出炉了年度安全报告，有杞人忧天的，有推销的，有八卦的，还有灌水的。干货与水货并存，笑点与泪点相伴，槽点多多，请自备瓜子，还有辣条。"}
{"title": "2014腾讯TSRC颁奖典礼速描", "url": "https://www.freebuf.com/fevents/57790.html", "time": "2015-01-28", "level": "", "num_look": 162348, "num_comment": 9, "author": "东莞一日游", "tags": ["活动"], "text": "1月24日，腾讯应急响应中心（简称TSRC）2014年度颁奖典礼在深圳威尼斯酒店举行。本次颁奖特意将主题定为“感谢有你，一路同行”，意在感谢所有2014年为腾讯TSRC贡献过的安全专家。"}
{"title": "远程让手机重启算不算漏洞？至少谷歌（Google）说不算", "url": "https://www.freebuf.com/news/57724.html", "time": "2015-01-28", "level": "", "num_look": 250176, "num_comment": 13, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "安全研究人员近日公布了一个关于安卓（Android）WiFi-Direct的漏洞，该漏洞能够导致安卓设备重启。"}
{"title": "幽灵漏洞（GHOST）影响大量Linux操作系统及其发行版（更新修复方案）", "url": "https://www.freebuf.com/news/57729.html", "time": "2015-01-28", "level": "红色标题", "num_look": 1658742, "num_comment": 54, "author": "hujias", "tags": ["漏洞", "资讯"], "text": "安全研究人员近日曝出一个名为幽灵（GHOST）的严重安全漏洞，这个漏洞可以允许攻击者远程获取操作系统的最高控制权限，影响市面上大量Linux操作系统及其发行版。该漏洞CVE编号为CVE-2015-0235。"}
{"title": "如何远程劫持无人机？揭秘第一个无人机后门MalDrone（含视频）", "url": "https://www.freebuf.com/news/57690.html", "time": "2015-01-28", "level": "金币+7", "num_look": 311560, "num_comment": 19, "author": "鸢尾", "tags": ["其他", "视频"], "text": ""}
{"title": "Wordpress4.0及以下版本Dos攻击漏洞（CVE-2014-9034）的检测和利用", "url": "https://www.freebuf.com/vuls/57543.html", "time": "2015-01-28", "level": "", "num_look": 411892, "num_comment": 7, "author": "Rechange", "tags": ["WEB安全", "漏洞"], "text": "在本文中，我将详细的介绍如何使用漏洞POC（概念验证）工具Searchspoit对你的Wordpress网站（4.0及以下版本）进行Dos攻击漏洞（CVE-2014-9034）的检测和利用。"}
{"title": "【FreeBuf视频】走近科学：如何访问暗网（the Dark Web）", "url": "https://www.freebuf.com/news/topnews/57622.html", "time": "2015-01-28", "level": "红色标题", "num_look": 3751600, "num_comment": 27, "author": "FB视频", "tags": ["头条", "视频"], "text": "访问暗网（the Dark Web）​的方法有很多种，目前最流行的则是Tor（The Onion Router洋葱网络），FreeBuf将在本次视频为你揭秘。"}
{"title": "“顽固木马”对抗技术剖析", "url": "https://www.freebuf.com/articles/system/57334.html", "time": "2015-01-28", "level": "", "num_look": 199204, "num_comment": 11, "author": "金山毒霸", "tags": ["系统安全"], "text": "近期，猎豹移动安全实验室（CMSL）监控显示，在韩国和哥伦比亚分别爆发了针对当地手机银行和Google钱包的支付病毒。这两个病毒都采用技术手段对抗卸载，一旦安装，将很难卸载，我们称之为“顽固木马”。"}
{"title": "漏洞预警：Flash曝严重安全漏洞，影响全部版本Windows系统、IE和FireFox浏览器", "url": "https://www.freebuf.com/vuls/57510.html", "time": "2015-01-27", "level": "红色标题", "num_look": 385163, "num_comment": 19, "author": "cindy", "tags": ["漏洞"], "text": "上周对Adobe公司来说应该是忙碌的一周，虽说漏洞对于Adobe来说早已经是家常便饭，但可远程执行恶意代码、获取系统控制权的高危漏洞并不多见。"}
{"title": "著名盗版资源网站海盗湾或将于2月1日“涅磐重生”", "url": "https://www.freebuf.com/news/57581.html", "time": "2015-01-27", "level": "", "num_look": 244360, "num_comment": 18, "author": "Sphinx", "tags": ["资讯"], "text": "当前海盗湾首页有一个凤凰的图标和倒计时时钟，倒计时指向2月1日。搜索框和分类都已经有了，只是暂时还不能用。页面底部有一艘海盗船正驶往一个小岛，这暗示着网站不久将会卷土重来。"}
{"title": "技术分享：Mysql注入点在limit关键字后面的利用方法", "url": "https://www.freebuf.com/articles/web/57528.html", "time": "2015-01-27", "level": "金币+7", "num_look": 842545, "num_comment": 14, "author": "Conermx", "tags": ["WEB安全", "数据安全"], "text": "描写sql注入利用方法的文章数不胜数，本文将描述一种比较特殊的场景。"}
{"title": "究竟谁在监控我？反监控工具SnoopSnitch", "url": "https://www.freebuf.com/sectool/57487.html", "time": "2015-01-27", "level": "", "num_look": 424026, "num_comment": 14, "author": "JackFree", "tags": ["工具", "无线安全"], "text": "2014年无数的窃听事件告诉我们，“反监控”将会是2015年的一个重要课题。今天我们将介绍一款强大的监控探测工具SnoopSnitch，它是一款移动应用，居家旅行携带非常方便。"}
{"title": "知名WordPress主题Pagelines和Platform权限提升漏洞POC", "url": "https://www.freebuf.com/vuls/57594.html", "time": "2015-01-27", "level": "金币+7", "num_look": 236837, "num_comment": 13, "author": "hzh4k", "tags": ["WEB安全", "漏洞"], "text": "在FreeBuf看到wordpress主题又爆漏洞了，此主题使用量还是很多的……现在你们要的POC来了。"}
{"title": "浏览器也会盗号：邪恶的“山寨”浏览器正在巴西流行", "url": "https://www.freebuf.com/news/57545.html", "time": "2015-01-27", "level": "金币+7", "num_look": 195312, "num_comment": 15, "author": "Sphinx", "tags": ["头条", "资讯"], "text": "IBM Trusteer的威胁与情报小组最近发现一款“山寨”浏览器，黑客可以利用这种精心制作的恶意浏览器窃取用户网银信息，这种犯罪手段正在巴西日益流行。"}
{"title": "马来西亚航空公司遭黑客入侵，疑似黑客组织Lizard Squad所为", "url": "https://www.freebuf.com/news/57541.html", "time": "2015-01-27", "level": "", "num_look": 202599, "num_comment": 8, "author": "cindy", "tags": ["资讯"], "text": "图片的是最上方还有一行字：“404 - Plane Not Found（404——航班未找到）”"}
{"title": "使用Referer Meta标签控制referer", "url": "https://www.freebuf.com/news/57497.html", "time": "2015-01-26", "level": "金币+7", "num_look": 1326813, "num_comment": 7, "author": "Conermx", "tags": ["资讯"], "text": "本文描述了一个关于 http 协议中 referer 的 metadata 参数的提议，使用这个 metadata 参数，html 文档可以控制 http 请求中的 referer ，比如是否发送 referer、只发送 hostname 还是发送完整的 referer 等。"}
{"title": "Windows10安全增强：Build 9926引入的两个字体安全特性", "url": "https://www.freebuf.com/news/57457.html", "time": "2015-01-26", "level": "", "num_look": 235166, "num_comment": 20, "author": "360安全", "tags": ["资讯"], "text": "微软于2015年1月22日，公布了操作系统Windows 10，随后又开放了预览版本的下载（Build：9926）。在这个新的Windows10预览版中，内核版本直接从6.4提升到10.0，同时也带来了一些新的产品形态和用户体验上的诸多改进。"}
{"title": "新型穿墙监控雷达Range-R：让你的隐私无所遁形", "url": "https://www.freebuf.com/news/57446.html", "time": "2015-01-26", "level": "", "num_look": 357592, "num_comment": 22, "author": "dawner", "tags": ["资讯"], "text": "在我们的认知中，政府对民众的监控已经成为一种常态。从电话、电子邮件到通信聊天、社交网络，一切细节都被执法者所掌控着。现如今，他们又玩起了新花样。"}
{"title": "漏洞预警：知名WordPress主题Pagelines和Platform存在高危漏洞", "url": "https://www.freebuf.com/news/57453.html", "time": "2015-01-26", "level": "", "num_look": 229002, "num_comment": 11, "author": "dawner", "tags": ["漏洞", "资讯"], "text": "使用Pagelines和Platform主题的WordPress用户注意了，请尽快更新主题的版本。我们在一次对AF例行审计时，偶然发现了两个严重漏洞：一个权限提升漏洞（影响Pagelines和Platform），以及一个远程代码执行漏洞。"}
{"title": "利用MPI在Kali Linux集群上并行破解密码", "url": "https://www.freebuf.com/articles/database/57388.html", "time": "2015-01-26", "level": "现金奖励", "num_look": 445476, "num_comment": 19, "author": "lfzark", "tags": ["数据安全"], "text": "MPI是一个跨语言的通讯协议，用于编写并行计算机。支持点对点和广播。MPI是一个信息传递应用程序接口，包括协议和和语义说明，他们指明其如何在各种实现中发挥其特性。MPI的目标是高性能，大规模性，和可移植性。"}
{"title": "漏洞盒子（VulBox）3.0上线啦！今日互联网漏洞奖金翻倍", "url": "https://www.freebuf.com/news/57360.html", "time": "2015-01-26", "level": "红色标题", "num_look": 416659, "num_comment": 18, "author": "漏洞盒子", "tags": ["活动", "资讯"], "text": "新版漏洞盒子对视觉和功能进行了全面的升级，产品层面更加细腻和有趣，同时延续了FreeBuf系产品一贯的精致化体验。"}
{"title": "后台开视频点广告：“点击欺诈木马”正在世界范围内泛滥", "url": "https://www.freebuf.com/news/57423.html", "time": "2015-01-25", "level": "", "num_look": 160527, "num_comment": 13, "author": "JackFree", "tags": ["资讯"], "text": "最近一种名为Tubrosa的“点击欺诈木马”正在世界范围内泛滥，这种恶意木马会利用受害者的电脑后台访问网络视频，并悄悄地点击视频中的内嵌广告以赚取广告收入。"}
{"title": "百度云安全部诚招各类安全大咖", "url": "https://www.freebuf.com/jobs/57346.html", "time": "2015-01-24", "level": "", "num_look": 251235, "num_comment": 28, "author": "百度安全", "tags": ["安全招聘"], "text": "百度（Nasdaq：BIDU）是全球最大的中文搜索引擎、最大的中文网站。2000年1月由李彦宏创立于北京中关村，致力于向人们提供“简单，可依赖”的信息获取方式。"}
{"title": "极客DIY：致敬老罗，我的工匠情怀收音机", "url": "https://www.freebuf.com/news/topnews/57213.html", "time": "2015-01-24", "level": "金币+5", "num_look": 404231, "num_comment": 22, "author": "geekman", "tags": ["头条", "极客"], "text": "最近一篇名为《罗永浩告别老罗》的文章在朋友圈流传，内容很长，但读完却只有一声叹息..."}
{"title": "迅雷网络安全招聘：终端安全、渗透测试等岗位", "url": "https://www.freebuf.com/jobs/57178.html", "time": "2015-01-23", "level": "", "num_look": 174176, "num_comment": 19, "author": "__U2__", "tags": ["安全招聘"], "text": "作为中国最大的数字内容发行网络，迅雷正在加速丰富着中国网民的互联网应用。"}
{"title": "CVE-2015-0393：Oracle发布严重安全漏洞预警", "url": "https://www.freebuf.com/news/57292.html", "time": "2015-01-23", "level": "金币+5", "num_look": 234644, "num_comment": 13, "author": "dawner", "tags": ["漏洞", "资讯"], "text": "也许这两天运维同学们需要给自家公司的Oracle产品打上新发布的169安全补丁了……"}
{"title": "这回轮到苹果了：谷歌（Google）今日公布数个苹果0day漏洞", "url": "https://www.freebuf.com/news/57304.html", "time": "2015-01-23", "level": "", "num_look": 184786, "num_comment": 20, "author": "cindy", "tags": ["资讯"], "text": "谷歌Project Zero漏洞研究团队今日公布了苹果数个0day漏洞及技术细节。就在两周前，谷歌刚刚披露了微软Windows8.1 0day漏洞，引发争议。"}
{"title": "FreeBuf年终策划：2014年十大网络钓鱼攻击", "url": "https://www.freebuf.com/news/57263.html", "time": "2015-01-23", "level": "", "num_look": 227835, "num_comment": 9, "author": "Rabbit_Run", "tags": ["头条", "资讯"], "text": "2014年期间，我们观察到最有趣的网络钓鱼发展趋势是什么？"}
{"title": "对时下流行的Android应用加固技术分析", "url": "https://www.freebuf.com/articles/terminal/57169.html", "time": "2015-01-23", "level": "金币+5", "num_look": 946696, "num_comment": 15, "author": "TheFounder", "tags": ["终端安全"], "text": "前段时间，突然发现有的企业客户端apk的加固方式发生了一些变化，勾起了我的兴趣，好东西不敢私藏，分享出来供大家把玩。"}
{"title": "2014年度最危险密码排行榜：“123456”连续四年荣登榜首", "url": "https://www.freebuf.com/news/57204.html", "time": "2015-01-23", "level": "金币+5", "num_look": 502177, "num_comment": 31, "author": "JackFree", "tags": ["安全管理", "资讯"], "text": "这已经是“123456”连续第四年占据“最危险密码”的头号位置了……"}
{"title": "民生电商招聘中高级安全工程师", "url": "https://www.freebuf.com/jobs/57009.html", "time": "2015-01-22", "level": "", "num_look": 272069, "num_comment": 64, "author": "dp_haidao", "tags": ["安全招聘"], "text": "民生电商（www.minshengec.com）是民生银行的兄弟公司，目前主要有b2c,o2o,p2p等业务线。安全部门组建之初，现邀请各位大小黑阔激情加盟。"}
{"title": "如何在渗透测试中利用BASH和DNS下载数据", "url": "https://www.freebuf.com/articles/system/57183.html", "time": "2015-01-22", "level": "金币+5", "num_look": 410125, "num_comment": 25, "author": "Conermx", "tags": ["系统安全", "网络安全"], "text": "在渗透测试过程中，防火墙一般都会禁止服务器对外建立连接，这种情况下使用DNS来下载数据是一种行之有效的方法。本文中作者将根据一个具体的实例来讲解这个方法。"}
{"title": "汽车安全：研究人员发现利用电子狗控制汽车的方法", "url": "https://www.freebuf.com/news/57184.html", "time": "2015-01-22", "level": "", "num_look": 150414, "num_comment": 7, "author": "cindy", "tags": ["资讯"], "text": "近年来智能移动设备、智能家居、智能汽车等层出不穷，它在给我们带来便利的同时也带来了一定的风险。安全研究人员近日利用车载电子狗实地演示了如何入侵汽车。"}
{"title": "使用调试器对安卓APP进行安全测试", "url": "https://www.freebuf.com/articles/terminal/57027.html", "time": "2015-01-22", "level": "金币+11", "num_look": 489906, "num_comment": 12, "author": "JackFree", "tags": ["终端安全"], "text": "在这篇博文中，我将带领大家学习如何将调试器应用到一个Android应用程序上，并利用第一次反编译得到的信息来分析应用的方法调用过程。比较独特的一点是，本方法并不需要获取安卓设备的root权限。"}
{"title": "研究人员发现一种利用Siri窃取苹果iPhone/iPad数据的方法", "url": "https://www.freebuf.com/news/57149.html", "time": "2015-01-22", "level": "", "num_look": 282961, "num_comment": 9, "author": "JackFree", "tags": ["终端安全", "资讯"], "text": "研究人员最近发现一种屌炸天的攻击方法：利用苹果iOS语音服务Siri，结合信号处理中的隐写术原理，可以从越狱的iPhone和iPad中悄悄窃取数据并上传到远程服务器。"}
{"title": "FreeBuf年终策划：2014年全球十大攻击事件", "url": "https://www.freebuf.com/news/57046.html", "time": "2015-01-22", "level": "金币+11", "num_look": 200980, "num_comment": 9, "author": "Rabbit_Run", "tags": ["头条", "资讯"], "text": "2014年可以毫不夸张的定义为网络罪犯和黑客之年，他们以势不可挡的黑客攻击震惊了全世界。"}
{"title": "专访：24岁大学生白帽子Ben的成长史", "url": "https://www.freebuf.com/news/topnews/56951.html", "time": "2015-01-22", "level": "红色标题", "num_look": 588876, "num_comment": 29, "author": "漏洞盒子", "tags": ["人物志", "其他"], "text": "黑客也有好坏之分，也就是所谓的黑帽子和白帽子。24岁的大三学生Behrouz(“Ben”) Sadeghipour就是一名白帽子，他用自己的实际行动在和黑帽子做斗争，与此同时还挣得了大量现金。"}
{"title": "对抗机器人：打造前后端结合的WAF（应用层防火墙）", "url": "https://www.freebuf.com/articles/web/57172.html", "time": "2015-01-21", "level": "金币+11", "num_look": 296829, "num_comment": 9, "author": "ＥtherＤream", "tags": ["WEB安全"], "text": "攻防本为一体，既然能用于攻击，类似的思路同样也可用于防御。如果将前端技术结合到传统的WAF 中，又能有如何的改进？"}
{"title": "知道创宇招聘各项技术达人", "url": "https://www.freebuf.com/jobs/56947.html", "time": "2015-01-21", "level": "", "num_look": 697354, "num_comment": 66, "author": "刘开水", "tags": ["安全招聘"], "text": "继《你将是我遇见最好的男孩》后知道创宇招聘第二弹《你将是我遇到最完美的男人》。"}
{"title": "首次现身中国的CTB-Locker“比特币敲诈者”病毒分析", "url": "https://www.freebuf.com/vuls/57033.html", "time": "2015-01-21", "level": "红色标题", "num_look": 964801, "num_comment": 52, "author": "360安全", "tags": ["漏洞"], "text": "昨天开始，国内有众多网友反馈中了CTB-Locker敲诈者病毒, 电脑里的文档、图片等重要资料被该病毒加密，同时提示受害者在96小时内支付8比特币（约1万元人民币）赎金，否则文件将永久无法打开。"}
{"title": "热门游戏《英雄联盟》和《流放之路》官方版本中被植入木马后门", "url": "https://www.freebuf.com/news/57062.html", "time": "2015-01-21", "level": "金币+11", "num_look": 379617, "num_comment": 32, "author": "hujias", "tags": ["资讯"], "text": "趋势科技近日发现，热门网络游戏《英雄联盟》和《流放之路》的官方版本被植入恶意木马后门（RAT）。攻击者通过入侵游戏运营商实现木马“植入”，目前受害者主要分布在亚洲。"}
{"title": "全球最大域名提供商GoDaddy存在跨站请求伪造（CSRF）漏洞", "url": "https://www.freebuf.com/news/57011.html", "time": "2015-01-21", "level": "", "num_look": 265813, "num_comment": 13, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "安全工程师Dylan Saccomanni近日在GoDaddy域名管理控制台上发现一个跨站请求伪造（CSRF）漏洞，攻击者利用该漏洞可以控制用户在GoDaddy上注册的域名。"}
{"title": "开源漏洞利用测试（Exploit）平台 - Exploit Pack", "url": "https://www.freebuf.com/sectool/57010.html", "time": "2015-01-21", "level": "", "num_look": 1024413, "num_comment": 24, "author": "phper", "tags": ["工具"], "text": "Exploit Pack是一款开源安全渗透测试工具，相比同类型的Metasploit、Immunity Canvas、Core Iimpact，它完全免费，没有任何的限制。"}
{"title": "技术分享：如何利用Dominator发现诺基亚（Nokia）官网DOM型XSS漏洞", "url": "https://www.freebuf.com/vuls/56848.html", "time": "2015-01-21", "level": "金币+11", "num_look": 388327, "num_comment": 4, "author": "Conermx", "tags": ["WEB安全", "漏洞"], "text": "DOM型XSS（跨站脚本）漏洞一般较难于发现，本文中作者使用Dominator来发现并利用一个诺基亚（Nokia）OVI官网的DOM XSS。"}
{"title": "“世界大战”尽在掌控：盘点全球网络攻击实时追踪系统", "url": "https://www.freebuf.com/news/topnews/56910.html", "time": "2015-01-21", "level": "金币+11", "num_look": 5030243, "num_comment": 25, "author": "凌晨几度i", "tags": ["其他", "头条"], "text": "也许你很难想象全球范围内所有攻击活动进行时的壮观场景，也很难了解网络攻击和攻击背后的组织是怎样的……那么本文将带你一览无余。"}
{"title": "Metasploit渗透技巧：后渗透Meterpreter代理", "url": "https://www.freebuf.com/sectool/56432.html", "time": "2015-01-21", "level": "现金奖励", "num_look": 1483316, "num_comment": 63, "author": "kboron", "tags": ["工具", "系统安全"], "text": "正是因为Metasploit团队一直都在努力开发各种攻击测试工具，并将它们贡献给所有Metasploit用户，软件厂商再也不能推迟发布针对已公布漏洞的补丁了。"}
{"title": "去哪儿网招聘安全工程师", "url": "https://www.freebuf.com/jobs/56813.html", "time": "2015-01-20", "level": "", "num_look": 142618, "num_comment": 11, "author": "gyreg", "tags": ["安全招聘"], "text": "全球最大的中文旅行平台，通过网站及移动客户端的全平台覆盖，随时随地为旅行者提供国内外机票、酒店、度假、旅游团购、及旅行信息的深度搜索。"}
{"title": "手段更加高明：微软Outlook在中国再遭中间人劫持", "url": "https://www.freebuf.com/news/56978.html", "time": "2015-01-20", "level": "金币+11", "num_look": 1014363, "num_comment": 18, "author": "Sphinx", "tags": ["资讯"], "text": "2015年1月17日，有用户反映微软Outlook邮件系统的IMAP/SMTP服务器受到攻击，相比去年，这次攻击者的手段更加隐蔽和高明。屡屡遭遇劫持，国内用户的隐私恐怕不保。"}
{"title": "低级失误：美国电信威瑞森（Verizon）APP存在漏洞，可读取500万用户邮箱", "url": "https://www.freebuf.com/news/56903.html", "time": "2015-01-20", "level": "", "num_look": 197668, "num_comment": 17, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "威瑞森（Verizon）是美国最大的电信公司之一。近日安全研究人员在威瑞森（Verizon）旗下的FiOS移动APP上发现了一个高危漏洞，它可以允许攻击者访问数百万的威瑞森用户的邮箱账户。"}
{"title": "CVE-2014-8272漏洞分析：戴尔（Dell）远程控制卡脆弱的Session-ID机制", "url": "https://www.freebuf.com/vuls/56770.html", "time": "2015-01-20", "level": "", "num_look": 208718, "num_comment": 7, "author": "dawner", "tags": ["漏洞"], "text": "我们最近发现了一个Dell集成远程控制卡（iDRAC）的漏洞，Dell集成远程控制卡是集成在服务器上的小型设备。"}
{"title": "2014腾讯TSRC现场颁奖典礼开幕在即", "url": "https://www.freebuf.com/news/others/56835.html", "time": "2015-01-20", "level": "", "num_look": 351157, "num_comment": 7, "author": "腾讯安全平台部", "tags": ["周边", "活动"], "text": "为表达对所有安全专家的感激之情，TSRC将举行线上和现场颁奖典礼。"}
{"title": "这个网站可以帮你雇佣黑客：第一家提供“黑客服务”的网站Hacker’s List", "url": "https://www.freebuf.com/news/56868.html", "time": "2015-01-20", "level": "金币+6", "num_look": 6789032, "num_comment": 193, "author": "dawner", "tags": ["资讯"], "text": "你曾想过要黑掉某个人的网站、QQ、微博账户麽？直接破坏他使用的网络如何？想想就有点小激动呢！等等，自己不会黑客技术咋办？黑客技术不知道哪家强怎么办？现在这里就有个机会，可以让你雇佣到职业的黑客。"}
{"title": "深入调查：当谷歌广告联盟（Google AdSense）广告遭遇恶意利用以后", "url": "https://www.freebuf.com/news/56740.html", "time": "2015-01-20", "level": "金币+6", "num_look": 347199, "num_comment": 4, "author": "Sphinx", "tags": ["WEB安全", "资讯"], "text": "安全研究人员最近注意到大量的网站被莫名其妙地跳转到某几个特定的网站，经过调查，罪魁祸首居然是谷歌广告联盟（Google AdSense）。"}
{"title": "新版中国菜刀（20141213）一句话不支持php assert分析", "url": "https://www.freebuf.com/articles/web/56616.html", "time": "2015-01-20", "level": "现金奖励", "num_look": 853389, "num_comment": 28, "author": "JoyChou", "tags": ["WEB安全"], "text": "前几天下了新版的菜刀，今天发现一个php一句话连不上，但是旧版的菜刀可以连，而且新版是可以连接eval的php一句话。当时挺好奇，排除了非菜刀造成的可能性，就只能是菜刀更新的问题，所以接下来要做的就是分析新版…"}
{"title": "号称要商业化的DDoS工具Lizard Stresser，客户数据库被脱了", "url": "https://www.freebuf.com/news/56841.html", "time": "2015-01-20", "level": "金币+6", "num_look": 260439, "num_comment": 18, "author": "JackFree", "tags": ["资讯"], "text": "就在上周，由黑客组织Lizard Squad开发的DDoS工具Lizard Stresser还声称要商业化，作为“武器”出售给客户。而今天Lizard Stresser的客户数据库已经网上泄露了，其客户数据居然还明文存储……"}
{"title": "完美世界招聘安全测试和开发工程师", "url": "https://www.freebuf.com/jobs/56454.html", "time": "2015-01-19", "level": "", "num_look": 204021, "num_comment": 30, "author": "何艺", "tags": ["安全招聘"], "text": "完美世界（北京）网络技术有限公司（以下简称：完美世界）是中国领先的网络游戏开发商和运营商之一。"}
{"title": "网银大盗：Carberp木马又出新变种", "url": "https://www.freebuf.com/news/56698.html", "time": "2015-01-19", "level": "", "num_look": 191133, "num_comment": 3, "author": "JackFree", "tags": ["资讯"], "text": "赛门铁克公司恶意软件分析专家最近发现了臭名昭著的网银大盗Carberp木马的新变种，该木马可以盗取网民的网银证书和敏感数据。"}
{"title": "从APK解密到批量获取他人信息", "url": "https://www.freebuf.com/articles/web/56728.html", "time": "2015-01-19", "level": "金币+6", "num_look": 666678, "num_comment": 39, "author": "0xExploit", "tags": ["WEB安全", "终端安全"], "text": "本次对这个APK进行分析，通过解密加密的数据，进而发现存在越权漏洞，然后就可以批量下载其他用户的数据。"}
{"title": "破解之美：利用ECB加密缺陷突破cookie加密", "url": "https://www.freebuf.com/news/topnews/56506.html", "time": "2015-01-19", "level": "现金奖励", "num_look": 606943, "num_comment": 29, "author": "NSTRT", "tags": ["WEB安全", "头条"], "text": "古代的密码学是一门加密隐蔽的学科，而现代密码学定义为加密与解密，研究在分组密码与流密码及其应用。一直以来加密与解密都在进行着激烈的对抗。加密者想尽办法让加密得到的信息不容易被破解，而解密者则绞尽脑汁…"}
{"title": "美国两家大型航空公司发生旅客数据泄露，国内航空安全又如何？", "url": "https://www.freebuf.com/news/56683.html", "time": "2015-01-19", "level": "", "num_look": 211378, "num_comment": 7, "author": "JackFree", "tags": ["观点", "资讯"], "text": "美国航空公司和美国联合航空公司大量客户信息被黑客盗取，黑客登录受害账户预定了几十个免费航班。"}
{"title": "注重用户体验：小白也能“轻松上手”的网银盗号工具KL-Remote", "url": "https://www.freebuf.com/news/56609.html", "time": "2015-01-18", "level": "", "num_look": 204641, "num_comment": 13, "author": "cindy", "tags": ["工具", "资讯"], "text": "IBM Trusteer的研究者近期发现一个针对金融网站的强大盗号工具KL-Remote，攻击者可通过该工具幕后操纵受害者的计算机，甚至绕过双因素认证。"}
{"title": "放弃老版本：超过9.3亿安卓手机失去谷歌官方安全保护", "url": "https://www.freebuf.com/news/56619.html", "time": "2015-01-17", "level": "金币+6", "num_look": 322645, "num_comment": 14, "author": "JackFree", "tags": ["终端安全", "资讯"], "text": "面对越来越多基于Android（安卓）系统开发的手机，当前谷歌已经无力直接控制Android设备的安全升级了，这种情况会导致约60%的Android手机处于在安全风险中。"}
{"title": "使用I2P匿名网络通信，又一款勒索软件CryptoWall 3.0来了", "url": "https://www.freebuf.com/news/56578.html", "time": "2015-01-17", "level": "", "num_look": 697892, "num_comment": 18, "author": "Sphinx", "tags": ["工具", "资讯"], "text": "FreeBuf已经报道过不计其数的勒索软件，而最近研究人员又发现了一款特别的——它使用I2P匿名网络进行通信，名为Cryptowall 3.0。"}
{"title": "复仇行动：Notepad++官网被圣战组织黑了", "url": "https://www.freebuf.com/news/56639.html", "time": "2015-01-16", "level": "金币+6", "num_look": 603719, "num_comment": 38, "author": "malayke", "tags": ["资讯"], "text": "流行开源编辑器Notepad++官网被圣战组织黑了。"}
{"title": "揭秘：深入解读针对苹果Mac电脑的ROM级恶意软件“雷击（Thunderstrike）”", "url": "https://www.freebuf.com/news/56493.html", "time": "2015-01-16", "level": "金币+6", "num_look": 479207, "num_comment": 14, "author": "dawner", "tags": ["头条", "漏洞"], "text": "众所周知苹果很安全，但随着恶意软件的发展，凭借现有Mac安全机制想要完全对抗恶意软件变得更加艰难。近期一种新型攻击方法的问世，可让2011年以后生产的苹果Mac电脑感染ROM级恶意程序。"}
{"title": "一些APT攻击案例分享", "url": "https://www.freebuf.com/articles/network/56484.html", "time": "2015-01-16", "level": "", "num_look": 702053, "num_comment": 12, "author": "安恒信息", "tags": ["网络安全"], "text": "APT攻击事件目前趋于爆发式增长，有些黑客秘密潜入重要系统窃取重要情报，而且这些网络间谍行动往往针对国家重要的基础设施和单位进行"}
{"title": "来自日本的色情诱骗：狼友是如何被恶意网页锁定浏览器，乖乖交年费的", "url": "https://www.freebuf.com/news/56550.html", "time": "2015-01-16", "level": "金币+8", "num_look": 655743, "num_comment": 45, "author": "鸢尾", "tags": ["其他", "头条"], "text": "在日本，诱骗攻击已经有十多年的历史了，这种攻击方式主要出现在成人视频服务上。2011年诱骗攻击首次出现于安卓以及IOS智能手机，时下这种攻击方式已经成为日本手机平台上相当严重的安全问题。"}
{"title": "利用HTC One漏洞破解手机PIN密码", "url": "https://www.freebuf.com/vuls/56513.html", "time": "2015-01-16", "level": "", "num_look": 392228, "num_comment": 13, "author": "鸢尾", "tags": ["漏洞", "终端安全"], "text": "HTC One手机运行的是Android 4.2.2、HBOOT 1.54.0000，它存在一个名为Bootloader的漏洞。这个漏洞早在2014年2月份就报告给了HTC官方，并在次月就修复了该漏洞。在得到HTC官方同意后，我们现在就将整个漏洞利用测试…"}
{"title": "通用电气（GE）工控交换机曝高危漏洞", "url": "https://www.freebuf.com/news/56553.html", "time": "2015-01-16", "level": "", "num_look": 235347, "num_comment": 1, "author": "cindy", "tags": ["工控安全", "漏洞"], "text": "安全研究人员近日在通用电气（GE）MultiLink ML800系列的交换机上发现了2个高危漏洞，攻击者可利用该漏洞在未经授权的情况下破解网络流量和发动DOS攻击。"}
{"title": "微软修复8个安全漏洞，包括谷歌披露的0day漏洞", "url": "https://www.freebuf.com/news/56528.html", "time": "2015-01-15", "level": "", "num_look": 230476, "num_comment": 7, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "微软日前发布了最新安全补丁，修复内容包括谷歌90天前提交的0day漏洞等8个安全漏洞。其中Windows Telnet服务远程代码执行漏洞被微软标记为了高危级别，其余7个都是重要级别。"}
{"title": "TP-link TL-WR840N系列路由器存在CSRF漏洞，可修改任意配置（含POC测试过程）", "url": "https://www.freebuf.com/vuls/56526.html", "time": "2015-01-15", "level": "", "num_look": 826864, "num_comment": 15, "author": "Conermx", "tags": ["漏洞", "终端安全"], "text": "TP-Link路由器在国内的用户量很大，最近国外安全研究者发现TP-Link一个系列的路由器存在 CSRF 漏洞，攻击者可以修改路由器的任意配置，包括 DNS 等。"}
{"title": "谷歌再曝Windows8.1漏洞，微软怒了", "url": "https://www.freebuf.com/news/56474.html", "time": "2015-01-15", "level": "金币+8", "num_look": 566563, "num_comment": 30, "author": "JackFree", "tags": ["资讯"], "text": "在微软还未来得及发布漏洞补丁时，谷歌Project Zero小组再次公布了Windows8.1系统的又一新漏洞，该漏洞可导致权限提升。谷歌一系列的漏洞公布惹怒了微软。"}
{"title": "使用渗透测试框架Xposed Framework hook调试Android APP", "url": "https://www.freebuf.com/articles/terminal/56453.html", "time": "2015-01-15", "level": "金币+8", "num_look": 944166, "num_comment": 10, "author": "Conermx", "tags": ["终端安全"], "text": "Xposed Framework 是一个很强大的渗透测试框架，本文中讲述如何用 Xposed Framework hook 一个Android APP中的一个方法并绕过登录验证。"}
{"title": "伪装成USB充电器的无线键盘嗅探器 - KeySweeper", "url": "https://www.freebuf.com/news/56414.html", "time": "2015-01-15", "level": "金币+8", "num_look": 506766, "num_comment": 14, "author": "JackFree", "tags": ["工具", "无线安全"], "text": "安全研究员Samy Kamkar设计了一款名为“KeySweeper”的廉价USB充电器，该充电器可以秘密地记录附近微软无线键盘的敲击数据，然后将数据存储在本地设备或通过网络传输存储到后台。"}
{"title": "Javascript间谍脚本分析：Web恶意程序Scanbox源码分析与演示", "url": "https://www.freebuf.com/sectool/56092.html", "time": "2015-01-14", "level": "金币+8", "num_look": 757855, "num_comment": 34, "author": "ArkTeam", "tags": ["WEB安全", "工具"], "text": "这份名为Scanbox的恶意代码是具有信息收集和键盘记录等间谍功能的Javascript恶意脚本，适用于IE浏览器。Scanbox具有收集主机基本信息、获取主机安装的应用程序、获取Flash版本、获取Office版本、验证Adobe Reader和…"}
{"title": "丝绸之路重生：网络黑市Silk Road Reloaded诞生", "url": "https://www.freebuf.com/news/56365.html", "time": "2015-01-14", "level": "金币+8", "num_look": 386033, "num_comment": 20, "author": "鸢尾", "tags": ["资讯"], "text": "关于网络黑市的故事还远没有结束，近日丝绸之路重生了——使用I2P匿名网络的Silk Road Reloaded诞生。"}
{"title": "可感染Linux平台的最新木马XOR.DDoS", "url": "https://www.freebuf.com/news/56369.html", "time": "2015-01-14", "level": "", "num_look": 554964, "num_comment": 33, "author": "JackFree", "tags": ["资讯"], "text": "对于Windows系统来说，类似的木马存在并不足为奇，但能够感染Linux系统的木马则很少听说。"}
{"title": "移动广告安全现状分析", "url": "https://www.freebuf.com/articles/others-articles/56355.html", "time": "2015-01-14", "level": "", "num_look": 258230, "num_comment": 9, "author": "AVLTeam", "tags": ["其他", "观点"], "text": "时至今日，移动广告行业健康状况是否依然如故？本文将针对目前广告件发展概况做简要分析。"}
{"title": "透析挖洞神器mona.py插件新特性", "url": "https://www.freebuf.com/sectool/56289.html", "time": "2015-01-14", "level": "", "num_look": 478948, "num_comment": 20, "author": "鸢尾", "tags": ["其他", "工具"], "text": "我决定给mona.py插件增加一些新的特性，以便让大家可以更快的寻找到感兴趣的对象。这些新特性仅仅在WinDBG下有效。"}
{"title": "CAD、CorelDRAW、Photo-Paint等软件被曝0day漏洞", "url": "https://www.freebuf.com/news/56347.html", "time": "2015-01-13", "level": "", "num_look": 212219, "num_comment": 22, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "领英（Core Security）安全研究员披露Corel公司CAD、CorelDRAW、Photo-Paint在内数款软件中含有DLL劫持漏洞，该漏洞可允许远程代码执行，目前还没有针对此漏洞的有效补丁。"}
{"title": "苹果OS X Yosemite系统曝多个本地提权漏洞", "url": "https://www.freebuf.com/news/56328.html", "time": "2015-01-13", "level": "金币+8", "num_look": 199527, "num_comment": 9, "author": "Rechange", "tags": ["漏洞", "资讯"], "text": "国外安全研究人员近日曝光最新版Mac OSX 10.10.1系统上存在多处本地提权漏洞，由于提交到苹果官方时间太久都过未得到明确答复，导致研究者直接公布漏洞细节以及利用代码。"}
{"title": "ISIS支持者劫持美国中央司令部社交网络账户，号称已入侵五角大楼", "url": "https://www.freebuf.com/news/56312.html", "time": "2015-01-13", "level": "", "num_look": 372403, "num_comment": 17, "author": "cindy", "tags": ["资讯"], "text": "该组织还在Pastebin上发布了一个恐吓美国军方的帖子，称ISIS已经渗透进五角大楼网络。"}
{"title": "从零开始学CSRF", "url": "https://www.freebuf.com/articles/web/55965.html", "time": "2015-01-13", "level": "现金奖励", "num_look": 3159288, "num_comment": 77, "author": "Black-Hole", "tags": ["WEB安全"], "text": "为什么要拿CSRF来当“攻击手法系列”的开头篇呢？因为CSRF/XSRF我个人喜爱他的程度已经超过XSS了。如果说XSS是一个老虎，那么CSRF就是隐藏在暗处的蛇。"}
{"title": "Kindle也中招：Kindle升级提示暗藏恶意软件", "url": "https://www.freebuf.com/news/56300.html", "time": "2015-01-13", "level": "", "num_look": 174019, "num_comment": 10, "author": "鸢尾", "tags": ["资讯"], "text": "有时候，我们忽略了攻击还可以在其他基于安卓派生的设备上进行，比如说Kindle运行的Fire OS，国内的还有miui，Flyme，阿里云OS，中国移动的Ophone等。"}
{"title": "网络密码嗅探（Web/FTP/Email）工具 - SniffPass", "url": "https://www.freebuf.com/sectool/56280.html", "time": "2015-01-13", "level": "", "num_look": 499064, "num_comment": 17, "author": "phper", "tags": ["工具"], "text": "SniffPass是一个小型的网络密码嗅探（密码找回）工具，它可以捕获并展示网络中传输的密码。"}
{"title": "FreeBuf年终策划：FreeBuf 2014年度最亮评论", "url": "https://www.freebuf.com/news/55878.html", "time": "2015-01-13", "level": "红色标题", "num_look": 291748, "num_comment": 26, "author": "cindy", "tags": ["其他", "头条"], "text": "年末了，回想一下过去的365天里，上万条评论中记录了你我每天在FreeBuf的点点滴滴，有吐槽、有感想，更有灵光一现……也许你已经忘却，但是它却深深扎根在了FreeBuf的硬盘里：）"}
{"title": "偷梁换柱：对一个可疑Payload的研究", "url": "https://www.freebuf.com/articles/web/56107.html", "time": "2015-01-13", "level": "", "num_look": 334129, "num_comment": 9, "author": "dawner", "tags": ["WEB安全"], "text": "我们团队一直致力于研究网络安全领域一些偏门的东西。对我们来说，每天挖掘新鲜的东西、了解攻击者的思路，以及发现最新的技术趋势是一件非常有意思的事。这也给了我们与大家分享的机会。"}
{"title": "拒绝支付赎金，瑞士日内瓦银行大量客户数据被黑客公布", "url": "https://www.freebuf.com/news/56262.html", "time": "2015-01-12", "level": "", "num_look": 165320, "num_comment": 7, "author": "JackFree", "tags": ["资讯"], "text": "Rex Mundi黑客组织日前公布了从瑞士日内瓦银行盗取的大量客户数据，只因该银行拒绝支付10000欧元赎金。"}
{"title": "走近科学：全面了解朝鲜Naenara（我的国家）浏览器", "url": "https://www.freebuf.com/news/56220.html", "time": "2015-01-12", "level": "金币+5", "num_look": 326629, "num_comment": 12, "author": "Sphinx", "tags": ["其他", "资讯"], "text": "Naenara浏览器是朝鲜红星(Red Star)操作系统中的浏览器。美国白帽实验室的Robert Hansen近日撰写了一篇博文，深入探究了这款朝鲜制造的浏览器。"}
{"title": "恶意软件新玩法：隐匿在Pastebin上的后门", "url": "https://www.freebuf.com/news/56063.html", "time": "2015-01-12", "level": "", "num_look": 558271, "num_comment": 6, "author": "Sphinx", "tags": ["WEB安全", "资讯"], "text": "快速分享文本、代码的网站Pastebin常常被黑客们用来分享自己的库、窃取的数据和其他代码，而现在它真的被用于黑客攻击了。"}
{"title": "Arp欺骗原理及Android环境下的检测方法", "url": "https://www.freebuf.com/articles/terminal/55987.html", "time": "2015-01-12", "level": "现金奖励", "num_look": 758194, "num_comment": 25, "author": "difcareer", "tags": ["终端安全", "网络安全"], "text": "本文通过实战演练，演示攻击主机如何在WiFi环境下对网关和Android手机进行双向Arp欺骗。"}
{"title": "深入解读MS14-068漏洞：微软精心策划的后门？", "url": "https://www.freebuf.com/vuls/56081.html", "time": "2015-01-11", "level": "现金奖励", "num_look": 1365761, "num_comment": 76, "author": "walkerfuz", "tags": ["漏洞", "系统安全"], "text": "漏洞曝出后，我发现微软的官方公告存在诸多疑点。于是我开始了分析之旅，通过时隔半月的研究却发现了一个“惊天的秘密”。本文将揭示这个笔者认为有人“精心策划”的漏洞。"}
{"title": "CNN：黑了索尼的朝鲜黑客藏在中国沈阳", "url": "https://www.freebuf.com/news/56106.html", "time": "2015-01-10", "level": "", "num_look": 243064, "num_comment": 31, "author": "cindy", "tags": ["资讯"], "text": "去过沈阳的朋友应该都知道，沈阳有很多朝鲜人经营的餐馆、酒店，但是这些朝鲜人都是些什么身份呢？CNN（美国有线电视新闻网）认为他们中就有攻击索尼影视的朝鲜黑客。"}
{"title": "华硕路由器曝远程命令执行漏洞", "url": "https://www.freebuf.com/news/56074.html", "time": "2015-01-10", "level": "金币+5", "num_look": 289556, "num_comment": 7, "author": "JackFree", "tags": ["漏洞", "资讯"], "text": "华硕路由器固件中被检测出一个严重漏洞，该漏洞能够使得未经身份认证的攻击者在路由器中远程执行任意指令，漏洞可能影响到华硕所有版本的路由器固件。"}
{"title": "FreeBuf公开课•TED系列：美女黑客为你揭秘“互联网免疫系统”", "url": "https://www.freebuf.com/news/topnews/56028.html", "time": "2015-01-09", "level": "", "num_look": 203398, "num_comment": 11, "author": "FB视频", "tags": ["头条", "视频"], "text": "美女网络安全专家Keren Elazari将在此课程中为你娓娓道来：在她看来，黑客是电子网络世界中的“免疫系统”，他们不断的发现网络中存在的弱点，进而督促人们不断修复和完善，最终让整个互联网变得更安全。"}
{"title": "漏洞预警：知名论坛系统vBulletin常用SEO插件VBSEO存在严重安全漏洞", "url": "https://www.freebuf.com/news/56019.html", "time": "2015-01-09", "level": "红色标题", "num_look": 366874, "num_comment": 9, "author": "dawner", "tags": ["漏洞", "资讯"], "text": "vBulletin团队近日向他们所有客户发出警告，其插件VBSEO出现了严重安全漏洞。vBulletin是世界上用户非常广泛的PHP论坛系统，在中国也有很多大型客户，比如蜂鸟网，51团购，海洋部落等在线上万人的论坛都在使用。"}
{"title": "那些年我们一起上过的黑客网站", "url": "https://www.freebuf.com/news/topnews/53432.html", "time": "2015-01-09", "level": "红色标题", "num_look": 2760736, "num_comment": 232, "author": "FB独家", "tags": ["其他", "头条"], "text": "时光荏苒，笔者从99年开始接触网络至今有14年了，有些天天去、天天看的网站他们已经早已不复存在，或者即使存在也早已改头换面。我找了一些那些年曾经上过的黑客站点（2006年以前），与大家一起回忆那段时光。"}
{"title": "京东商城招聘安全工程师（年度最后2位名额）", "url": "https://www.freebuf.com/jobs/55967.html", "time": "2015-01-09", "level": "", "num_look": 189437, "num_comment": 23, "author": "京东安全", "tags": ["安全招聘"], "text": "本年度最后2位安全攻城师招聘名额，想来京东的伙伴抓紧时间投递简历。错过悔一生啊！"}
{"title": "一台手机黑掉ATM：黑客使用三星Galaxy 4手机让ATM取款机吐钱", "url": "https://www.freebuf.com/news/55999.html", "time": "2015-01-09", "level": "金币+6", "num_look": 324747, "num_comment": 30, "author": "JackFree", "tags": ["资讯"], "text": "通过这种攻击方式，黑客只需通过一台三星Galaxy 4手机和一个USB接口电路即可攻击NCR厂商的ATM，使其自动吐钱。"}
{"title": "FBI是如何发现黑客来自朝鲜的？答案很低级", "url": "https://www.freebuf.com/news/55976.html", "time": "2015-01-08", "level": "红色标题", "num_look": 346071, "num_comment": 24, "author": "cindy", "tags": ["资讯"], "text": "美国联邦调查局（FBI）局长James Comey称，FBI之所以会认为索尼影视被黑事件与朝鲜情报局有关，是因为朝鲜政府的黑客们犯了一个十分低级的错误。"}
{"title": "首届华为安全沙龙纪实", "url": "https://www.freebuf.com/news/55936.html", "time": "2015-01-08", "level": "", "num_look": 232606, "num_comment": 20, "author": "005", "tags": ["活动", "资讯"], "text": "12月27日，华为IT在深圳低调的举办第一届网络安全沙龙。"}
{"title": "FreeBuf年终策划：FreeBuf 2014年漏洞分析文章精选", "url": "https://www.freebuf.com/news/55749.html", "time": "2015-01-08", "level": "红色标题", "num_look": 416631, "num_comment": 19, "author": "Rechange", "tags": ["头条", "漏洞"], "text": "阅读它们，你可能恍然大悟，也可能云山雾罩...总之，FreeBuf真心希望你能够有所收获。"}
{"title": "德国新型银行木马Emotet被发现，意在盗取普通网民网银证书", "url": "https://www.freebuf.com/news/55924.html", "time": "2015-01-08", "level": "", "num_look": 170037, "num_comment": 6, "author": "JackFree", "tags": ["资讯"], "text": "微软安全研究人员发现，在德国泛滥的垃圾邮件风潮中正在传播一个强大的银行木马新变种，该木马意在盗取德国普通网民的网银证书。"}
{"title": "极客DIY：教你做一个简单的“太阳能”移动电源", "url": "https://www.freebuf.com/news/topnews/55880.html", "time": "2015-01-08", "level": "金币+6", "num_look": 824669, "num_comment": 39, "author": "geekman", "tags": ["头条", "极客"], "text": "在这篇分享中，我将向大家一步一步的展示如何手工制作一个简单的太阳能移动电源。"}
{"title": "深入了解Google与微软的争议漏洞：NtApphelpCacheControl漏洞分析", "url": "https://www.freebuf.com/vuls/55855.html", "time": "2015-01-07", "level": "", "num_look": 211923, "num_comment": 17, "author": "360安全", "tags": ["漏洞"], "text": "Google Project Zero团队的新晋成员James Forshaw在9月30日向微软提交了名为“NtApphelpCacheControl”的安全问题，并且在Google的漏洞公开期限（90天）后公开了此问题的细节。"}
{"title": "比特币又一噩耗：全球最大的比特币交易平台Bitstamp被攻击损失约500万美元", "url": "https://www.freebuf.com/news/55825.html", "time": "2015-01-07", "level": "", "num_look": 221115, "num_comment": 13, "author": "JackFree", "tags": ["资讯"], "text": "全球最大和最可靠的比特币交易平台之一Bitstamp在周一宣布它们已经成为了黑客攻击的目标，已导致了将近19000比特币被盗（价值约500万美元）"}
{"title": "看我七十二变：HTML5游戏重打包变身安卓恶意软件", "url": "https://www.freebuf.com/news/55843.html", "time": "2015-01-07", "level": "金币+6", "num_look": 305685, "num_comment": 3, "author": "dawner", "tags": ["终端安全", "资讯"], "text": "随着W3C于2013年十月完成HTML5标准制定后，由HTML5编写的WEB应用程序数量一直呈快速增长趋势。我们可以预见越来越多的HTML5应用可能被攻击者利用，由普通Web应用重新打包为恶意移动软件。"}
{"title": "蓝牙设备安全测试工具 - BlueMaho", "url": "https://www.freebuf.com/sectool/55800.html", "time": "2015-01-07", "level": "", "num_look": 318960, "num_comment": 8, "author": "phper", "tags": ["工具"], "text": "BlueMaho是测试蓝牙设备安全性的工具套件，开源免费，由python编写。该工具可用来扫描和跟踪设备，在发现新的蓝牙设备时会发出警报声，是安全工程师测试蓝牙设备安全的好帮手。"}
{"title": "对windows密码抓取神器mimikatz的逆向分析", "url": "https://www.freebuf.com/sectool/55673.html", "time": "2015-01-07", "level": "现金奖励", "num_look": 538070, "num_comment": 34, "author": "dedogger", "tags": ["工具"], "text": "“女神，借用电脑一看可否？”"}
{"title": "FreeBuf年终策划：黑客题材电影、电视剧大合集", "url": "https://www.freebuf.com/news/55576.html", "time": "2015-01-07", "level": "金币+6", "num_look": 1466265, "num_comment": 58, "author": "cindy", "tags": ["其他", "头条"], "text": "春节快到了，FreeBuf小编为各位搜集和网罗了“史上最全”的黑客题材电影和电视剧。大家尽可以挑选自己喜欢的，下载&存储在手机和Pad里，过年有事儿干喽！"}
{"title": "顺丰优选招聘信息安全工程师", "url": "https://www.freebuf.com/jobs/55731.html", "time": "2015-01-06", "level": "", "num_look": 318298, "num_comment": 29, "author": "mmc", "tags": ["安全招聘"], "text": "顺丰优选是由顺丰速运集团倾力打造，以全球优质安全美食为主的网购商城。网站于2012年5月31日正式上线，目前网站商品数量超过一万余种，其中70%均为进口食品，采自全球60多个国家和地区。"}
{"title": "WiFi安全测试工具、蹭网利器 - WiFiPhisher", "url": "https://www.freebuf.com/sectool/55754.html", "time": "2015-01-06", "level": "金币+6", "num_look": 1471451, "num_comment": 54, "author": "hujias", "tags": ["工具"], "text": "虽然现在网上有很多可以破解无线网络的工具，但WiFiPhisher与之不同，它不需要使用暴力破解攻击来获取用户的无线WiFi密码。"}
{"title": "FreeBuf公开课：Metasploit系列教程第二季（T00ls出品）", "url": "https://www.freebuf.com/video/55659.html", "time": "2015-01-06", "level": "红色标题", "num_look": 944433, "num_comment": 74, "author": "T00ls安全", "tags": ["视频"], "text": "本次视频T00ls安全社区联合FreeBuf公开课发布，目前已经在FreeBuf公开课上架。"}
{"title": "深度：针对超强手机木马DenDroid的分析与测试", "url": "https://www.freebuf.com/sectool/55392.html", "time": "2015-01-06", "level": "现金奖励", "num_look": 1220847, "num_comment": 94, "author": "liuz5069", "tags": ["工具", "终端安全"], "text": "今天我们就来研究下这款号称需要300美元的手机远控木马。本文最后会提供相关工具包，有兴趣的同学可以下载哦。"}
{"title": "我母亲遭遇勒索软件CryptoWall的全过程", "url": "https://www.freebuf.com/news/55704.html", "time": "2015-01-06", "level": "", "num_look": 793783, "num_comment": 36, "author": "cindy", "tags": ["系统安全", "资讯"], "text": "感恩节前夕，我母亲在打开电脑里的文件时，发现她所有的文件都被莫名其妙的加密了。随后屏幕上就弹出了一条消息：“你的文件已被加密，要想解密你必须得付给我们500美元。”"}
{"title": "针对苹果电脑的ROM级恶意程序Thunderstrike", "url": "https://www.freebuf.com/news/55716.html", "time": "2015-01-06", "level": "", "num_look": 194480, "num_comment": 12, "author": "JackFree", "tags": ["资讯"], "text": "近日，安全研究人员发现一种让苹果电脑感染ROM级恶意程序的方法。"}
{"title": "Android浏览器跨域数据窃取和Intent Scheme攻击", "url": "https://www.freebuf.com/news/55551.html", "time": "2015-01-05", "level": "金币+8", "num_look": 447124, "num_comment": 23, "author": "dawner", "tags": ["漏洞", "终端安全"], "text": "我们接下来要介绍的这个漏洞，其影响了Android版本4.4以下的自带浏览器和一些其他特定的Android浏览器，它允许黑客读取sqlite格式的cookie数据库文件，从而窃取cookie。"}
{"title": "三星KNOX远程静默安装漏洞深入分析报告", "url": "https://www.freebuf.com/vuls/55657.html", "time": "2015-01-05", "level": "", "num_look": 353570, "num_comment": 11, "author": "360安全", "tags": ["漏洞"], "text": "11月中旬，三星手机被国外安全研究人员曝光了一个严重的安全漏洞,该漏洞影响Galaxy S5,S4,S4 mini,Note 4,Note3以及Ace 4等支持knox的全线三星手机，部分GalaxyS5和 Note 4已修复。"}
{"title": "2015，你该警惕家中的大品牌路由器了：扒一扒那些“开后门”的路由器厂商", "url": "https://www.freebuf.com/news/topnews/55444.html", "time": "2015-01-05", "level": "红色标题", "num_look": 1327780, "num_comment": 22, "author": "Rechange", "tags": ["头条", "终端安全"], "text": "抛开黑客攻击，路由器本身是否也会“监守自盗”？大品牌路由器就一定安全吗？"}
{"title": "技术分享：MSSQL注入xp_cmdshell", "url": "https://www.freebuf.com/articles/web/55577.html", "time": "2015-01-05", "level": "金币+8", "num_look": 1862241, "num_comment": 27, "author": "ruo", "tags": ["WEB安全", "数据安全"], "text": "MSSQL强大的存储过程也为黑客提供了遍历，在相应的权限下，攻击者可以利用不同的存储过程执行不同的高级功能，如增加MSSQL数据库用户，枚举文件目录等等。"}
{"title": "FreeBuf年终策划：FreeBuf 2014十大安全工具", "url": "https://www.freebuf.com/news/55559.html", "time": "2015-01-04", "level": "金币+8", "num_look": 672383, "num_comment": 64, "author": "Rechange", "tags": ["头条", "工具"], "text": "在过去的一年中，FreeBuf发布了146个安全工具，它们或高大上（高冷）或接地气（屌丝）……当然这些都无关紧要，重要的是它们都曾或多或少的为我们提供过帮助。"}
{"title": "盗版开发者的春天？黑客已经泄露Xbox One SDK", "url": "https://www.freebuf.com/news/55611.html", "time": "2015-01-04", "level": "", "num_look": 241319, "num_comment": 14, "author": "JackFree", "tags": ["资讯"], "text": "一周前的圣诞节，由臭名昭著的黑客组织Lizard Squad发起的大量DDoS攻击使得微软的Xbox在线平台瘫痪，但对微软来说这并不是灾难的终结。"}
{"title": "XSS的原理分析与解剖：第四章（编码与绕过）", "url": "https://www.freebuf.com/articles/web/55505.html", "time": "2015-01-04", "level": "现金奖励", "num_look": 977162, "num_comment": 22, "author": "Black-Hole", "tags": ["WEB安全"], "text": "很抱歉，这第四章被我推了几个月，今天是元旦难得有空，就把第四章写下。我先把主要使用的编码说下，介绍完会说下绕过。"}
{"title": "新年第一炮：GitHub上出现可破解iCloud账户的iDict工具", "url": "https://www.freebuf.com/news/55556.html", "time": "2015-01-04", "level": "金币+8", "num_look": 539918, "num_comment": 17, "author": "鸢尾", "tags": ["资讯"], "text": "GitHub上一名为“Pr0x13”的黑客打响了新年第一炮，其发布了一款威胁到苹果iCloud服务的工具——iDict，此款工具号称可让使用者获得大量iCloud账户。"}
{"title": "Google发现Windows 8.1 0day漏洞并公布漏洞验证程序（PoC）", "url": "https://www.freebuf.com/news/55544.html", "time": "2015-01-03", "level": "金币+8", "num_look": 513205, "num_comment": 28, "author": "fu4k", "tags": ["漏洞", "资讯"], "text": "Google安全研究人员发现了一枚Windows 8.1权限提升漏洞，攻击者可以借此漏洞修改系统内容甚至完全控制受害者计算机。目前Google已经公布了漏洞验证程序（PoC）。"}
{"title": "【FreeBuf视频】《安全大咖说》专访腾讯安全胡珀（lake2）：我们开始关注智能设备安全了", "url": "https://www.freebuf.com/news/topnews/54975.html", "time": "2015-01-03", "level": "红色标题", "num_look": 636690, "num_comment": 27, "author": "FB视频", "tags": ["人物志", "头条"], "text": "胡珀（网名lake2）目前任腾讯公司安全平台部总监，因负责腾讯TSRC（安全应急响应中心）为广大白帽子所熟知，江湖人称“TSRC CEO”。"}
{"title": "我是如何发现一枚Cisco XSS（跨站脚本）漏洞的", "url": "https://www.freebuf.com/articles/web/55522.html", "time": "2015-01-03", "level": "金币+8", "num_look": 355387, "num_comment": 18, "author": "鸢尾", "tags": ["WEB安全"], "text": "我在Cisco的IOS SoftwareChecker中找到一枚XSS（跨站脚本）漏洞，漏洞本身并不复杂，在此与大家分享漏洞发现的整个过程。"}
{"title": "数据分析告诉你：Php最不安全，Nginx比Apache安全", "url": "https://www.freebuf.com/news/55511.html", "time": "2015-01-02", "level": "", "num_look": 361427, "num_comment": 19, "author": "phper", "tags": ["WEB安全", "资讯"], "text": "Google安全研究者分析了那些安装PHP、Python、Nginx、Apache、Wordpress的网站，发现70%以上安装着PHP（含有漏洞的版本）的网站都是不安全的。"}
{"title": "2014年移动恶意色情应用研究报告", "url": "https://www.freebuf.com/articles/terminal/55428.html", "time": "2015-01-01", "level": "", "num_look": 395034, "num_comment": 23, "author": "AVLTeam", "tags": ["安全报告", "终端安全"], "text": "我们针对移动恶意色情应用的传播情况、行为特点等进行深入分析。希望帮助大家充分了解移动恶意色情应用的危害性。"}
{"title": "上海速亿软件招聘渗透测试工程师", "url": "https://www.freebuf.com/jobs/55346.html", "time": "2015-01-01", "level": "", "num_look": 184153, "num_comment": 15, "author": "floyd", "tags": ["安全招聘"], "text": "公司长期与国家重点产业项目开展深度合作，业务涉及公安和军队等国家安全的重要领域。"}
{"title": "4G安全：研究人员发现攻击4G无线上网卡和SIM卡的方法", "url": "https://www.freebuf.com/news/55408.html", "time": "2014-12-31", "level": "金币+6", "num_look": 811097, "num_comment": 20, "author": "hujias", "tags": ["无线安全", "终端安全"], "text": "Positive Technologies的研究者在欧洲黑客联盟（Chaos Computer Club）会议上披露了4G USB无线上网卡中存在漏洞，攻击者可以借此入侵4G无线上网卡和SIM卡。"}
{"title": "知名安全检测工具AWVS（Acunetix Web Vulnerability Scanner） v9.5更新", "url": "https://www.freebuf.com/sectool/55374.html", "time": "2014-12-31", "level": "金币+6", "num_look": 863530, "num_comment": 16, "author": "Jumbo", "tags": ["工具"], "text": "Acunetix Web Vulnerability Scanner（简称AWVS）是一款知名的网络漏洞扫描工具。AWVS于2014年12月18日v9.5版更新。"}
{"title": "技术分析：智能硬件蠕虫威胁互联网安全", "url": "https://www.freebuf.com/articles/terminal/55382.html", "time": "2014-12-31", "level": "", "num_look": 401959, "num_comment": 9, "author": "360攻防实验室", "tags": ["终端安全", "网络安全"], "text": "12月10日全球互联网范围DNS流量异常。本次事件攻击自12月10日凌晨起至今仍在持续，为近年来持续时间最长的DNS DDoS攻击，目前已监测到的攻击最大流量近1亿Qps（约合76.38Gbps）"}
{"title": "磊科（NetCore）全系列路由器中的“疑似后门”程序", "url": "https://www.freebuf.com/news/55300.html", "time": "2014-12-31", "level": "金币+6", "num_look": 1011053, "num_comment": 32, "author": "夜未央", "tags": ["终端安全", "资讯"], "text": "路由器如果直接监听端口，可以执行命令上传下载文件，那就有点太说不过去了……这些功能是不是有点过了呢？它是厂商故意设置的后门吗？"}
{"title": "揭秘：对美国国安局（NSA）而言，加密技术大多已形同虚设", "url": "https://www.freebuf.com/news/55324.html", "time": "2014-12-31", "level": "红色标题", "num_look": 391755, "num_comment": 25, "author": "cindy", "tags": ["其他", "头条"], "text": "比如Skype（一个被3亿人使用的网络语音通信工具），NSA用了不到半年的时间就破解了其使用的所有加密技术。"}
{"title": "欧洲黑客联盟（ChaosComputer Club）：只需照片即可获取指纹", "url": "https://www.freebuf.com/news/55334.html", "time": "2014-12-30", "level": "", "num_look": 332965, "num_comment": 27, "author": "Rechange", "tags": ["资讯"], "text": "拍照时喜欢比剪刀手的少年，换个姿势吧！"}
{"title": "量子安全认证：从根本上防止信用卡被克隆", "url": "https://www.freebuf.com/news/55281.html", "time": "2014-12-30", "level": "", "num_look": 132725, "num_comment": 8, "author": "dawner", "tags": ["资讯"], "text": "由于光的量子特性，任何试图篡改量子安全（QSA）认证的行为都会破坏信息的完整性。"}
{"title": "PoisonCake（毒蛋糕）：内置于手机ROM的恶意代码模块", "url": "https://www.freebuf.com/articles/terminal/55169.html", "time": "2014-12-30", "level": "", "num_look": 271959, "num_comment": 4, "author": "AVLTeam", "tags": ["终端安全"], "text": "AVL移动安全团队近日联合LBE发现一款内置于手机ROM的恶意代码模块。由于该恶意代码作者将此恶意模块运行释放的模块称为“Cake”，所以我们将其命名为“PoisonCake（毒蛋糕）”。"}
{"title": "极客DIY：教你打造一副极具工匠情怀的专属耳机", "url": "https://www.freebuf.com/news/topnews/55264.html", "time": "2014-12-30", "level": "金币+6", "num_look": 709036, "num_comment": 57, "author": "geekman", "tags": ["头条", "极客"], "text": "佩戴这样一副亲手DIY又极具工匠精神的酷炫耳机，不管你在挤地铁还是公交，晨跑或是广场舞，都好象漆黑中的萤火虫，是那样的鲜明、光亮……"}
{"title": "黑客叔叔现身：我是怎样把低危漏洞变高危的", "url": "https://www.freebuf.com/news/topnews/55225.html", "time": "2014-12-29", "level": "红色标题", "num_look": 345586, "num_comment": 26, "author": "Rechange", "tags": ["头条", "活动"], "text": "在漏洞盒子平台上做测试必须要明白一点：你的测试，以漏洞为导向还是以结果为导向？换句话说你是想要低危漏洞还是高危漏洞？"}
{"title": "窃取Facebook用户信息：利用Android同源策略漏洞的恶意应用被发现", "url": "https://www.freebuf.com/news/55210.html", "time": "2014-12-29", "level": "金币+6", "num_look": 141913, "num_comment": 3, "author": "dawner", "tags": ["资讯"], "text": "几个月前我们曾研究过Android同源策略（SOP）的漏洞，然而最近出现了一款利用此漏洞对Facebook用户进行攻击的恶意应用，其利用代码基于已公开的Metasploit测试代码。"}
{"title": "测一测才知道，百度安全软件是不是真流氓？", "url": "https://www.freebuf.com/news/topnews/55190.html", "time": "2014-12-29", "level": "现金奖励", "num_look": 1065766, "num_comment": 150, "author": "dedogger", "tags": ["头条", "系统安全"], "text": "这里我选择不同平台安装不同的百度产品，从安装到运行，以及卸载，看看它们到底多流氓。"}
{"title": "WordPress再悲剧：WPcache-Blogger感染事件影响五万WordPress网站", "url": "https://www.freebuf.com/news/55174.html", "time": "2014-12-29", "level": "金币+6", "num_look": 168433, "num_comment": 5, "author": "dawner", "tags": ["资讯"], "text": "近期WordPress安全事件最近频发。今天这场安全事件由一个被恶意软件控制的网站wpcache-blogger.com命名。在过去几天里，已有5万Wordpress网站受到影响。"}
{"title": "免费开源相册Piwigo<= v2.7.1 SQL注入漏洞分析", "url": "https://www.freebuf.com/articles/web/55075.html", "time": "2014-12-28", "level": "金币+6", "num_look": 387707, "num_comment": 8, "author": "xd_xd", "tags": ["WEB安全"], "text": "漏洞公布的时候，piwigo已经更新到了2.7.1。但是，这个漏洞公布的时候确实是一个货真价实的0day，影响piwigo全版本。"}
{"title": "极客DIY：手机文件直传U盘，三步教你做一根OTG传输线", "url": "https://www.freebuf.com/geek/55119.html", "time": "2014-12-27", "level": "金币+7", "num_look": 797432, "num_comment": 29, "author": "geekman", "tags": ["极客"], "text": "制作这根USB线对我来说最大的用处，在于它可以直接将你手机的文件导入U盘或者硬盘。"}
{"title": "知名安全检测工具IBM Rational AppScan v9.0.1.1发布", "url": "https://www.freebuf.com/sectool/55090.html", "time": "2014-12-26", "level": "金币+7", "num_look": 633225, "num_comment": 38, "author": "kartfran", "tags": ["工具"], "text": "Appscan是web应用程序渗透测试舞台上使用最广泛的工具之一，有助于专业安全人员进行Web应用程序自动化脆弱性评估。12月17日，Appscan v9.0.1.1发布。"}
{"title": "我眼中的极客：Just fucking hack it out！", "url": "https://www.freebuf.com/articles/others-articles/54998.html", "time": "2014-12-26", "level": "", "num_look": 261455, "num_comment": 19, "author": "Rechange", "tags": ["其他", "活动"], "text": "“所有的黑客都是极客，极客关心结果，菜鸟才谈过程”——《打造Facebook》作者王淮在FreeTalk活动中这样说道。"}
{"title": "喧嚣背后的真相：12306数据泄露事件深度分析", "url": "https://www.freebuf.com/news/topnews/55093.html", "time": "2014-12-26", "level": "金币+7", "num_look": 916489, "num_comment": 78, "author": "p0tt1", "tags": ["头条", "观点"], "text": "恰逢春运前，铁道部12306网站“13万用户数据泄露”“快去改密码！”“32G用户数据库下载”瞬间刷爆了网络。莫让迷雾遮望眼——作为一个信息安全从业者和技术人，是时候冷静的坐下来看看究竟发生了点什么了。"}
{"title": "新型恶意勒索软件VirLock", "url": "https://www.freebuf.com/news/55003.html", "time": "2014-12-26", "level": "", "num_look": 148902, "num_comment": 4, "author": "cindy", "tags": ["资讯"], "text": "近日，安全公司Sophos和ESET的研究人员发现勒索软件家族又添新成员——一个可自我复制的版本VirLock（又称VirRansom）。"}
{"title": "12306警示录：你的密码在谁的手里？", "url": "https://www.freebuf.com/articles/system/55081.html", "time": "2014-12-25", "level": "", "num_look": 528941, "num_comment": 41, "author": "NSTRT", "tags": ["安全管理", "系统安全"], "text": "早上10点，某漏洞平台上出现了一个严重的安全漏洞信息—12306用户数据库遭到泄露。为了验证该信息的准确性，我们团队对事件进行了一次调查。"}
{"title": "腾讯安全对抗经验分享：数据逐步成为攻防G点", "url": "https://www.freebuf.com/news/topnews/55009.html", "time": "2014-12-25", "level": "", "num_look": 191608, "num_comment": 8, "author": "Rechange", "tags": ["头条", "活动"], "text": "在12月20日进行的FreeTalk深圳站活动上，腾讯安全专家 江虎（xti9er）已与小伙伴们分享了议题《网络军备竞赛》，小编在此对演讲精华内容做出整理，各位一睹为快。"}
{"title": "【FreeBuf视频】揭秘丝绸之路（silkroad）：全球最大网络黑市的兴衰史", "url": "https://www.freebuf.com/news/topnews/54980.html", "time": "2014-12-25", "level": "红色标题", "num_look": 401465, "num_comment": 15, "author": "FB视频", "tags": ["头条", "视频"], "text": "丝绸之路起源于中国，是一条古老的经济交流路线。但是当下“丝绸之路”这个名词却与毒品、非法枪支挂上了勾……今天FreeBuf视频将带你走近这条通往地下黑市的神秘路。"}
{"title": "高潮不断：攻击索尼的“格盘病毒”又重创了韩国核电站", "url": "https://www.freebuf.com/news/54958.html", "time": "2014-12-25", "level": "金币+7", "num_look": 287350, "num_comment": 23, "author": "Sphinx", "tags": ["头条", "系统安全"], "text": "12月21日，一名黑客向韩国水电与核电公司发出严重警告，要求官方立即停止运行核电站。同时黑客还公开了包括核电站设计图在内的4份档案。值得一提的是，这次事件中所用的木马竟然又是“格盘病毒”……"}
{"title": "极路由（HiWiFi）1S硬件分析与改造研究", "url": "https://www.freebuf.com/news/topnews/54862.html", "time": "2014-12-25", "level": "现金奖励", "num_look": 1464693, "num_comment": 17, "author": "幽狼鬼影", "tags": ["头条", "极客"], "text": "极路由一直炒的比较火，直到最近要做一个新的钓鱼设备，正好看到极路由的硬件配置实在是让人心动，考虑很长时间还是决定，选择极路由现售的系列产品作为制作本次无线钓鱼破解设备的原型。"}
{"title": "为修补NTP（网络时间协议）漏洞，苹果发布首个自动更新补丁", "url": "https://www.freebuf.com/news/54907.html", "time": "2014-12-25", "level": "", "num_look": 127310, "num_comment": 2, "author": "Rechange", "tags": ["资讯"], "text": ""}
{"title": "中国电力科学研究院招聘渗透工程师", "url": "https://www.freebuf.com/jobs/54884.html", "time": "2014-12-24", "level": "", "num_look": 229393, "num_comment": 48, "author": "sbhuaidan", "tags": ["安全招聘"], "text": "中国电力科学研究院（简称中国电科院）成立于1951年，是国家电网公司直属科研单位，是中国电力行业多学科、综合性的科研机构。"}
{"title": "《刺杀金正恩》被禁，但你也许能在BT上看到它", "url": "https://www.freebuf.com/news/54895.html", "time": "2014-12-24", "level": "金币+7", "num_look": 517218, "num_comment": 29, "author": "cindy", "tags": ["资讯"], "text": "由于黑客组织GOP的再度威胁，索尼影视被迫撤消了原定于圣诞节当天上映《刺杀金正恩》的计划。但是索尼正在试图通过其他的途径上映这部“禁片”。"}
{"title": "IE漏洞调试之CVE-2013-3893", "url": "https://www.freebuf.com/vuls/54786.html", "time": "2014-12-24", "level": "现金奖励", "num_look": 405719, "num_comment": 11, "author": "dedogger", "tags": ["漏洞", "系统安全"], "text": "Windows平台的漏洞挖掘和安全研究中，IE始终是绕不开的话题。IE漏洞就跟adobe系列一样经典，是学习exploit、shellcode的绝佳途径。"}
{"title": "恶意软件Soaksoak卷土重来？小心你的wordpress网站", "url": "https://www.freebuf.com/news/54883.html", "time": "2014-12-24", "level": "", "num_look": 177001, "num_comment": 6, "author": "Rechange", "tags": ["资讯"], "text": "前不久，Soaksoak曾因感染了十万多个wordpress网站而名声大噪，从上周日的情况来看，Soaksoak大有卷土重来之势。"}
{"title": "见招拆招：破解Oracle数据库密码", "url": "https://www.freebuf.com/articles/database/54767.html", "time": "2014-12-24", "level": "", "num_look": 628279, "num_comment": 6, "author": "安华金和", "tags": ["数据安全"], "text": "本文主要目的，希望通过分享解密方法引起相关人士对网络安全的重视。数据库安全绝不单只数据库本身的安全，和数据库所处的整个环境都有密切关系。"}
{"title": "朝鲜被断网因美国DDoS攻击所致？", "url": "https://www.freebuf.com/news/54819.html", "time": "2014-12-24", "level": "", "num_look": 154633, "num_comment": 19, "author": "cindy", "tags": ["资讯"], "text": "这两天最有意思的新闻莫过于朝鲜被断网了……"}
{"title": "俄罗斯网络威胁概览", "url": "https://www.freebuf.com/news/topnews/54775.html", "time": "2014-12-24", "level": "", "num_look": 241443, "num_comment": 7, "author": "IDF_Lab", "tags": ["其他", "头条"], "text": "与中国和美国不同，俄罗斯是世界上发生恶意网络活动和网络犯罪行为最多的国家。基本上每种经济网络犯罪和政治网络攻击都会在俄罗斯发生，本报告对这两种行为进行了详细的描述。"}
{"title": "朝鲜网络揭秘：金正恩上台后网络大规模整改", "url": "https://www.freebuf.com/news/54799.html", "time": "2014-12-23", "level": "金币+9", "num_look": 1163868, "num_comment": 26, "author": "鸢尾", "tags": ["其他", "头条"], "text": "2011年12月19日，也就是三胖上台后的第三天，我对这一新任领导如何改革朝鲜的网络很是好奇，于是乎就对其网络空间进行了扫描。"}
{"title": "SS7协议曝漏洞，停止使用你的手机？", "url": "https://www.freebuf.com/news/54754.html", "time": "2014-12-23", "level": "", "num_look": 540017, "num_comment": 11, "author": "Rechange", "tags": ["资讯"], "text": "最近，有德国的研究人员发现SS7协议存在巨大安全漏洞，该漏洞可导致用户的电话和短信数据遭到大规模的窃听和盗取，而且更可怕的是，即使使用了最新的蜂窝网络和最先进的加密技术也无济于事。"}
{"title": "技术分享：杂谈如何绕过WAF（Web应用防火墙）", "url": "https://www.freebuf.com/articles/web/54686.html", "time": "2014-12-23", "level": "现金奖励", "num_look": 1752173, "num_comment": 26, "author": "Black-Hole", "tags": ["WEB安全"], "text": "可能在大家眼中WAF就是“不要脸”的代名词。我是站在你们的这一边的，所以，今天我们就来谈谈如何绕过WAF吧。"}
{"title": "走近科学：分析漏洞利用工具包（EXP）家族成员Archie和Astrum", "url": "https://www.freebuf.com/sectool/54781.html", "time": "2014-12-23", "level": "金币+9", "num_look": 457606, "num_comment": 9, "author": "Sphinx", "tags": ["工具", "系统安全"], "text": "漏洞利用工具包（EXP）一直是传播犯罪软件的重要工具。俗话说知己知彼百战百胜，作为安全研究者，我们必须要完全的了解和分析他们。本文将介绍两款最新的流行工具包——Archie和Astrum。"}
{"title": "国产开源网站管理工具 - Altman3新版发布", "url": "https://www.freebuf.com/sectool/54591.html", "time": "2014-12-23", "level": "金币+9", "num_look": 380139, "num_comment": 25, "author": "keepwn", "tags": ["工具"], "text": "Altman是国人开发的一款开源网站管理工具，新版运行更稳定，可以运行在多个平台上。重构了插件框架，并针对实际体验中的大部分操作进行了优化。"}
{"title": "揭秘银行木马Chthonic：网银大盗ZeuS的最新变种", "url": "https://www.freebuf.com/news/topnews/54706.html", "time": "2014-12-23", "level": "金币+9", "num_look": 338598, "num_comment": 9, "author": "Sphinx", "tags": ["头条", "网络安全"], "text": "Zeus是对金融系统威胁最大的僵尸网络之一，控制者借助僵尸程序窃取账户登录信息和信用卡号码。近期卡巴斯基实验室发现了一款ZeuS的最新变种Chthonic。"}
{"title": "Offset2lib攻击测试：看我如何全面绕过64位Linux的内核防护", "url": "https://www.freebuf.com/articles/system/54616.html", "time": "2014-12-22", "level": "金币+9", "num_look": 410591, "num_comment": 35, "author": "dawner", "tags": ["系统安全"], "text": "该攻击能绕过平常使用的保护技术如：禁止运行位(NX)，地址空间布局随机化(ASLR)，堆栈溢出保护(SSP)，并在很短的时间内就能获得一个远程的shell。"}
{"title": "漏洞预警：Google安全研究人员发现NTP（网络时间协议）最新漏洞", "url": "https://www.freebuf.com/news/54698.html", "time": "2014-12-22", "level": "金币+9", "num_look": 502790, "num_comment": 16, "author": "dawner", "tags": ["漏洞", "资讯"], "text": "Google安全研究人员最近发现，NTP协议（网络时间协议）出现了一些新的严重漏洞，NTP 4.2.8之前的版本均受影响，黑客可以利用这些漏洞展开远程攻击。"}
{"title": "2014国内外数据泄密事件大盘点", "url": "https://www.freebuf.com/articles/database/54631.html", "time": "2014-12-22", "level": "", "num_look": 686546, "num_comment": 7, "author": "安华金和", "tags": ["数据安全"], "text": "Verizon发布了《2014年度数据泄露调查报告》，报告中回顾了63737起赛博安全事件和1367起已经确认的数据泄漏事件。"}
{"title": "揭秘：从内部源码看Facebook技术（第一集）", "url": "https://www.freebuf.com/news/topnews/54599.html", "time": "2014-12-22", "level": "金币+9", "num_look": 508174, "num_comment": 8, "author": "鸢尾", "tags": ["其他", "头条"], "text": "​我是一名铁杆Facebook粉丝。曾经有段时间我对Facebook的开源工具Phabricator 进行优化研究，却意外发现了许多有关Facebook的内部资料。"}
{"title": "漏洞预警：厄运cookie（Misfortune Cookie）漏洞影响全球1200万台路由器", "url": "https://www.freebuf.com/news/54688.html", "time": "2014-12-22", "level": "金币+9", "num_look": 436226, "num_comment": 16, "author": "dawner", "tags": ["头条", "漏洞"], "text": "​一个名为“厄运cookie（Misfortune Cookie）”的严重漏洞正在影响全球1200万台路由器安全，D-Link、 TP-Link、华为、中兴等品牌均受到影响，攻击者可以利用漏洞远程控制设备及监控流量。"}
{"title": "大小写惹得祸：Git客户端中曝出高危漏洞", "url": "https://www.freebuf.com/news/54658.html", "time": "2014-12-19", "level": "", "num_look": 231481, "num_comment": 9, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "Git官方近日发布一条重要消息，所有官方版本的Git客户端都存在高危漏洞，包括GitHub Windows 和Mac客户端。GitHub.com和GitHub企业版不会受到直接的影响。"}
{"title": "TSPY_BANKER木马病毒攻击韩国银行", "url": "https://www.freebuf.com/news/54637.html", "time": "2014-12-19", "level": "", "num_look": 172183, "num_comment": 11, "author": "hujias", "tags": ["资讯"], "text": "趋势科技的安全专家检测到了一个名叫TSPY_BANKER.YYSI的新银行木马，它的攻击目标主要是韩国各大金融机构。"}
{"title": "ICANN（域名和地址管理机构）系统遭黑客入侵", "url": "https://www.freebuf.com/news/54626.html", "time": "2014-12-19", "level": "", "num_look": 257863, "num_comment": 12, "author": "cindy", "tags": ["终端安全", "资讯"], "text": "ICANN（域名和地址管理公司）证实他们的系统遭到了黑客入侵，攻击者用一个伪造的ICANN域名骗取内部员工的邮件凭证，继而展开钓鱼攻击。目前该公司正在调查该事件。"}
{"title": "解密所有APP运行过程中的内部逻辑", "url": "https://www.freebuf.com/sectool/54562.html", "time": "2014-12-19", "level": "", "num_look": 569541, "num_comment": 23, "author": "Jason_HZ", "tags": ["工具", "终端安全"], "text": "静态分析越来越不靠谱了，apktool、ApkIDE、jd GUI、dex2jar等已经无法满足大家的需求了。那么问题就来了，小伙伴们真正需要的是什么？"}
{"title": "前美国空军成员DIY无人侦察机，可进行WI-FI密码破解、电话窃听", "url": "https://www.freebuf.com/news/54557.html", "time": "2014-12-19", "level": "", "num_look": 276781, "num_comment": 13, "author": "Rechange", "tags": ["无线安全", "资讯"], "text": "近日，前美国空军成员Mike Tassey 和Rich Perkins成功DIY了一架无人侦察机，该无人侦察机可进行WI-FI密码破解、电话窃听、短信拦截等行为。"}
{"title": "鬼精灵Grinch：比Bash破壳（shellshock）更严重的Linux漏洞", "url": "https://www.freebuf.com/news/54551.html", "time": "2014-12-18", "level": "红色标题", "num_look": 456648, "num_comment": 33, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "安全研究人员在Linux操作系统中发现了一个名为鬼精灵（Grince）的漏洞，该漏洞存在于linux系统中，和Bash破壳（shellshock）漏洞一样可以在受害者机器上获得root权限。"}
{"title": "网站压力测试工具 - 低轨道离子炮（LOIC）v1.0.8更新", "url": "https://www.freebuf.com/sectool/54602.html", "time": "2014-12-18", "level": "", "num_look": 934982, "num_comment": 34, "author": "phper", "tags": ["工具"], "text": "低轨道离子炮(LOIC)是一个开源的网站压力测试和抗拒绝服务测试工具，由C#语言开发。"}
{"title": "奔跑吧少年：史上最大的DDoS攻击案件宣布告破", "url": "https://www.freebuf.com/news/54519.html", "time": "2014-12-18", "level": "金币+4", "num_look": 450166, "num_comment": 32, "author": "鸢尾", "tags": ["资讯"], "text": "非法攻击，洗黑钱，传播艳照——奔跑吧少年……"}
{"title": "RFID入门：Mifare1智能水卡破解分析", "url": "https://www.freebuf.com/news/topnews/54481.html", "time": "2014-12-18", "level": "现金奖励", "num_look": 3171974, "num_comment": 58, "author": "diigu", "tags": ["头条", "无线安全"], "text": "一直手痒RFID这个领域，准备了一段时间，我们就开始今天尝试破解一张水卡（洗澡用，宿舍常见）试试！"}
{"title": "研究人员发现绝大部分酷派（Coolpad）手机暗藏后门", "url": "https://www.freebuf.com/news/54486.html", "time": "2014-12-18", "level": "红色标题", "num_look": 529690, "num_comment": 25, "author": "hujias", "tags": ["漏洞", "资讯"], "text": "网络安全公司Palo Alto披露，酷派安卓设备上存在搜集用户隐私数据的恶意后门程序。酷派是国内知名手机制造商（你常常会在办宽带、话费套餐送手机时遇到它），产品远销国外。"}
{"title": "HTTPS迎来春天：Chrome计划将所有HTTP标记为不安全", "url": "https://www.freebuf.com/news/54423.html", "time": "2014-12-18", "level": "红色标题", "num_look": 292722, "num_comment": 16, "author": "Rechange", "tags": ["资讯"], "text": "Chromium开发团队计划从2015开始将所有HTTP页面标记为不安全，并积极明确的告知用户，HTTP页面并不具有任何数据安全的保护能力，鼓励更多的网站实现更为有效的HTTPS加密。"}
{"title": "愤怒的索尼：索尼发动DDoS攻击反击黑客，向用户散布假冒种子", "url": "https://www.freebuf.com/news/54417.html", "time": "2014-12-18", "level": "", "num_look": 150336, "num_comment": 18, "author": "cindy", "tags": ["资讯"], "text": "最近索尼开始了“复仇行动”——索尼影视向所有分享泄露数据的网站发动了DDOS攻击，向用户散布假冒种子。一来防止信息和盗版电影进一步泄露，二来为了打击GOP黑客组织。"}
{"title": "【已结束】FreeBuf公开课（直播课程）：移动支付的“捕鱼”时代", "url": "https://www.freebuf.com/fevents/53754.html", "time": "2014-12-17", "level": "红色标题", "num_look": 238210, "num_comment": 7, "author": "FB客服", "tags": ["活动"], "text": "从一个安卓木马展开分析，当然，这不是重点。重点是揭露当下一些黑色产业运用的各种技巧。"}
{"title": "创业公司招聘：北京神州华安诚聘安全人才", "url": "https://www.freebuf.com/jobs/54324.html", "time": "2014-12-17", "level": "", "num_look": 253678, "num_comment": 48, "author": "drakan", "tags": ["安全招聘"], "text": "不用拖到最后了。请吐槽：薪资4000～1W……"}
{"title": "工控安全：BlackEnergy（黑暗力量）利用西门子WinCC系统已修复的漏洞发动攻击", "url": "https://www.freebuf.com/news/54159.html", "time": "2014-12-17", "level": "金币+4", "num_look": 229044, "num_comment": 4, "author": "Sphinx", "tags": ["资讯"], "text": "研究人员近日发现，恶意软件BlackEnergy（黑暗力量）正在利用西门子SIMATIC WinCC（西门子最经典的过程监视系统）已经修复的漏洞重新攻击SCADA HMI系统。"}
{"title": "王力宏出演：2015年最新黑客电影《Blackhat》（含预告片）", "url": "https://www.freebuf.com/news/54368.html", "time": "2014-12-17", "level": "金币+4", "num_look": 736637, "num_comment": 27, "author": "Sphinx", "tags": ["视频", "资讯"], "text": "“黑客”已经不仅仅是网络安全专家和罪犯的事啦，它也成为了很多电影的主题。现在又来了一部新黑客电影《Blackhat》。王力宏、汤唯都有出演哦……"}
{"title": "Linux Rootkit系列一：LKM的基础编写及隐藏", "url": "https://www.freebuf.com/articles/system/54263.html", "time": "2014-12-17", "level": "现金奖励", "num_look": 1111119, "num_comment": 37, "author": "arciryas", "tags": ["系统安全"], "text": "总结了下我最近的学习收获，打算发表一系列关于linux rootkit的文章在freebuf上，希望能够帮助到大家。"}
{"title": "蠕虫利用Bash破壳（ShellShock）漏洞感染台湾威联通（QNAP）系统", "url": "https://www.freebuf.com/news/54359.html", "time": "2014-12-17", "level": "", "num_look": 254544, "num_comment": 14, "author": "cindy", "tags": ["资讯"], "text": "一旦QNAP系统感染了该蠕虫病毒，它首先会创建新的系统管理员，然后在目标机器上安装一个永久的后门。最蛋疼的是，蠕虫还会把Shellshock漏洞打上补丁，以防止其他的恶意软件利用该漏洞。"}
{"title": "重庆易极付诚聘信息安全人才", "url": "https://www.freebuf.com/jobs/54314.html", "time": "2014-12-16", "level": "红色标题", "num_look": 465413, "num_comment": 81, "author": "yaoyi2008", "tags": ["安全招聘"], "text": "重庆易极付科技有限公司诞生于2011年7月，同年12月31日获得中国人民银行第三批非金融机构支付业务许可证（又称支付牌照），注册资金1亿元人民币。"}
{"title": "隐藏在分享按钮中的攻击：Blogger.com曝高危CSRF（跨站请求伪造）漏洞", "url": "https://www.freebuf.com/news/54339.html", "time": "2014-12-16", "level": "", "num_look": 172817, "num_comment": 5, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "该漏洞可以使攻击者在博主不知情的情况下撰写和发布博客，同时可以把私密博客公开。Blogger是Google旗下的大型博客服务网站。"}
{"title": "漏洞盒子项目上新：LOCKet加密产品安全测试", "url": "https://www.freebuf.com/fevents/54330.html", "time": "2014-12-16", "level": "", "num_look": 170054, "num_comment": 7, "author": "漏洞盒子", "tags": ["活动"], "text": "LOCKet是一家以独立第三方形式为用户提供数据安全服务的产品，热情邀请漏洞盒子和FreeBuf的白帽子参加测试，奖金丰厚。"}
{"title": "10万WordPress网站沦陷：恶意软件SoakSoak来了", "url": "https://www.freebuf.com/news/54306.html", "time": "2014-12-16", "level": "金币+5", "num_look": 385231, "num_comment": 22, "author": "Sphinx", "tags": ["资讯"], "text": "近几个月，WordPress安全漏洞事件频发。而现在，一款广泛传播的恶意软件已经感染了100,000多个WordPress网站，而且数字仍在增加。"}
{"title": "Oracle数据库漏洞分析：无需用户名和密码进入你的数据库", "url": "https://www.freebuf.com/articles/database/54289.html", "time": "2014-12-16", "level": "", "num_look": 681284, "num_comment": 6, "author": "安华金和", "tags": ["数据安全"], "text": "一般性的数据库漏洞，都是在成功连接或登录数据库后实现入侵；本文介绍两个在2012年暴露的Oracle漏洞，通过这两种漏洞的结合，可以在不掌握用户名/密码的情况下入侵Oracle，从而完成对数据的窃取或者破坏。"}
{"title": "ModSecurity技巧：使用ssdeep检测Webshell", "url": "https://www.freebuf.com/sectool/54222.html", "time": "2014-12-16", "level": "现金奖励", "num_look": 510186, "num_comment": 10, "author": "碳基体", "tags": ["工具"], "text": "最新版本的ModSecurity增加了ssdeep检测webshell的接口，本文讲介绍如何使用它来检测webshell。"}
{"title": "SCTF（三叶草CTF） Write-Up", "url": "https://www.freebuf.com/articles/web/54176.html", "time": "2014-12-16", "level": "现金奖励", "num_look": 1932832, "num_comment": 23, "author": "hhx", "tags": ["WEB安全", "其他"], "text": "SCTF（三叶草CTF）作为XCTF联赛的成都分站赛，由三叶草安全技术小组负责组织。本次比赛采用线上解题形式，比赛冠军队伍直接入围XCTF联赛总决赛。"}
{"title": "披着羊皮的狼：小心隐藏在“刺客信条”游戏中的恶意程序", "url": "https://www.freebuf.com/news/54262.html", "time": "2014-12-15", "level": "", "num_look": 215612, "num_comment": 8, "author": "cindy", "tags": ["资讯"], "text": "​安全研究人员在安卓平台上发现了一款盗版的“刺客信条（Assassin Creed）”游戏APP。盗版也就算了，该APP还被攻击者用来传播恶意软件，窃取用户的个人信息。"}
{"title": "如何打造一款可靠的WAF（Web应用防火墙）", "url": "https://www.freebuf.com/sectool/54221.html", "time": "2014-12-15", "level": "金币+5", "num_look": 1676236, "num_comment": 46, "author": "碳基体", "tags": ["WEB安全", "工具"], "text": "本篇文章从WAF产品研发的角度来YY如何实现一款可靠的WAF，灵感来自ModSecurity等，感谢开源。"}
{"title": "走进科学：现代汽车的大脑与安全", "url": "https://www.freebuf.com/news/topnews/54090.html", "time": "2014-12-15", "level": "现金奖励", "num_look": 501669, "num_comment": 12, "author": "破晓", "tags": ["头条", "极客"], "text": "借着最近某汽车系统被破解，且作为一个汽车改装爱好者的我，就想分享下自己对汽车知识及安全的一些理解。"}
{"title": "如何全面掌控session？且看WebSocket跨站劫持", "url": "https://www.freebuf.com/articles/web/54182.html", "time": "2014-12-15", "level": "金币+5", "num_look": 782182, "num_comment": 29, "author": "dawner", "tags": ["WEB安全"], "text": "WebSockets是一个能够给单TCP连接提供全双工信道的HTML5特性。它的持续性连接功能，使得构建B/S模式的实时应用成为可能。"}
{"title": "强大的网站管理软件 - 中国菜刀20141213新版发布", "url": "https://www.freebuf.com/sectool/54178.html", "time": "2014-12-14", "level": "红色标题", "num_look": 1027194, "num_comment": 58, "author": "unshell", "tags": ["工具"], "text": "中国菜刀用途十分广泛，是一款专业的网站管理软件，支持多种语言，小巧实用，用途广泛，据说是一位中国军人退伍之后的作品。"}
{"title": "留意你的智能设备：智能手表与手机连接时泄露隐私（含视频）", "url": "https://www.freebuf.com/news/54103.html", "time": "2014-12-12", "level": "", "num_look": 253656, "num_comment": 19, "author": "cindy", "tags": ["资讯"], "text": "安全研究人员近日研究发现，在智能手表和安卓手机传输数据时存在安全漏洞，攻击者可以借此暴力攻击用户的手机，然后拦截、破解用户的私密数据，比如你在Facebook上的聊天内容。"}
{"title": "挖洞姿势：特殊的上传技巧，绕过PHP图片转换实现远程代码执行（RCE）", "url": "https://www.freebuf.com/articles/web/54086.html", "time": "2014-12-12", "level": "金币+5", "num_look": 1259969, "num_comment": 63, "author": "phper", "tags": ["WEB安全"], "text": "我使用了一个特殊的图片上传技巧，绕过PHP GD库对图片的转换处理，最终成功实现了远程代码执行。"}
{"title": "云图（CloudAtlas）：网络间谍活动“红色十月”重现江湖", "url": "https://www.freebuf.com/news/54080.html", "time": "2014-12-12", "level": "金币+5", "num_look": 131256, "num_comment": 7, "author": "hujias", "tags": ["资讯"], "text": "卡巴斯基实验室的安全研究人员发现，攻击者正在筹划一个代号为“云图”的新兴网络间谍活动，而这与两年前发生的全球大型间谍活动“红色十月”如出一辙。"}
{"title": "移动恶意代码编年史第二期（更新至2014年11月）", "url": "https://www.freebuf.com/articles/terminal/54056.html", "time": "2014-12-12", "level": "", "num_look": 292903, "num_comment": 6, "author": "AVLTeam", "tags": ["终端安全"], "text": "随着移动恶意代码数量的爆发式增长，本期将典型移动恶意代码内容选取时间更新到2014年11月，同时也增加了iOS平台的部分典型恶意代码及大事件。"}
{"title": "FreeBuf公开课•BlackHat中文视频系列：对社会工程学电话欺诈事件的大数据分析", "url": "https://www.freebuf.com/news/topnews/54034.html", "time": "2014-12-11", "level": "红色标题", "num_look": 2938241, "num_comment": 34, "author": "FB视频", "tags": ["头条", "视频"], "text": "针对日益增长的电话诈骗事件，BlackHat的安全研究人员对其中的共性和特征进行了深入研究。"}
{"title": "雅虎安全团队：漏洞90天不修复，对外公开细节", "url": "https://www.freebuf.com/news/54036.html", "time": "2014-12-11", "level": "", "num_look": 248913, "num_comment": 13, "author": "cindy", "tags": ["资讯"], "text": "雅虎安全团队开始使用与谷歌Project Zero一样的漏洞披露策略——在将漏洞信息通知受影响厂商的90天后，对外界公开漏洞细节。"}
{"title": "自动化网络扫描探测工具 - AutoScan-Network", "url": "https://www.freebuf.com/sectool/54024.html", "time": "2014-12-11", "level": "", "num_look": 418660, "num_comment": 15, "author": "phper", "tags": ["工具"], "text": "AutoScan-Network是一个网络扫描工具，无须任何配置即可对连接的网络进行扫描，可发现网络中的设备信息。"}
{"title": "一个人的武林：内网渗透测试思路（二）", "url": "https://www.freebuf.com/articles/system/53987.html", "time": "2014-12-11", "level": "现金奖励", "num_look": 1047937, "num_comment": 51, "author": "mumaren", "tags": ["系统安全", "网络安全"], "text": "跟web渗透不同，内网渗透需要更多的随机性和突破口，情况较为复杂，遇到障碍，有时可以换种思路突破，很多时候则无奈的只能止步于此。"}
{"title": "这货不是电源：硬件渗透测试平台 - Power Pwn", "url": "https://www.freebuf.com/news/53939.html", "time": "2014-12-11", "level": "", "num_look": 230330, "num_comment": 21, "author": "phper", "tags": ["工具", "资讯"], "text": "Power Pwn是由美国国防部高级计划研究局（DARPA）牵头开发的硬件集成化渗透测试平台，它的外形与普通电源差别不大，目标是帮助企业或个人发现安全漏洞。"}
{"title": "企鹅Turla（Penquin Turla）：史上最复杂的APT间谍软件", "url": "https://www.freebuf.com/news/53931.html", "time": "2014-12-11", "level": "", "num_look": 322690, "num_comment": 14, "author": "cindy", "tags": ["资讯"], "text": "卡巴斯基实验室的安全专家们首次发现了Turla恶意程序的新变种，该恶意程序攻击的主要目标是Linux系统，因此又叫做企鹅Turla（Penquin Turla）。"}
{"title": "POODLE漏洞东山再起，影响TLS安全传输协议", "url": "https://www.freebuf.com/news/53959.html", "time": "2014-12-10", "level": "", "num_look": 744953, "num_comment": 14, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "谷歌安全团队在十月发现的一个高危SSL漏洞POODLE，现在它又东山再起了，这次它影响的是SSL升级版——TLS协议。"}
{"title": "VMware修复XSS漏洞和证书验证问题", "url": "https://www.freebuf.com/news/53919.html", "time": "2014-12-10", "level": "", "num_look": 220824, "num_comment": 6, "author": "Sphinx", "tags": ["资讯"], "text": "VMware本周发布了一系列补丁修复多个漏洞，包括其服务器虚拟化平台。"}
{"title": "插入U盘自动攻击：BadUSB原理与实现（含视频）", "url": "https://www.freebuf.com/articles/terminal/53886.html", "time": "2014-12-10", "level": "红色标题", "num_look": 1916352, "num_comment": 60, "author": "腾讯安全平台部", "tags": ["系统安全", "终端安全"], "text": "笔者使用BadUSB的代码做了个类似的U盘，用户插入U盘，就会自动执行预置在固件中的恶意代码，下载服务器上恶意文件，执行恶意操作。"}
{"title": "代码安全审计：当file_exists遇上eval", "url": "https://www.freebuf.com/articles/web/53656.html", "time": "2014-12-10", "level": "现金奖励", "num_look": 402261, "num_comment": 29, "author": "crsec", "tags": ["WEB安全"], "text": "一些看似用处不大的东西往往会产生漏洞，代码安全审计最重要的就是：细心与耐心，细节决定成败。"}
{"title": "揭开Meterpreter的神秘面纱", "url": "https://www.freebuf.com/articles/system/53818.html", "time": "2014-12-10", "level": "现金奖励", "num_look": 1316062, "num_comment": 38, "author": "codeliker", "tags": ["系统安全", "网络安全"], "text": "用过metasploit的人应该对meterpreter不陌生，它具有强大的功能，简直就是内网渗透测试神器。我决定一窥meterpreter的究竟，了解其工作原理和流程。"}
{"title": "沙盒逃逸：谷歌应用引擎（GAE）中存在30+个沙盒绕过漏洞", "url": "https://www.freebuf.com/news/53866.html", "time": "2014-12-09", "level": "", "num_look": 215569, "num_comment": 7, "author": "phper", "tags": ["漏洞", "资讯"], "text": "安全研究人员在谷歌应用引擎（Google App Engine）的Java环境中发现了大量高危漏洞，攻击者可以利用这些漏洞绕过谷歌安全沙盒的保护。"}
{"title": "朝鲜：黑客入侵索尼影视是正义之举", "url": "https://www.freebuf.com/news/53849.html", "time": "2014-12-09", "level": "", "num_look": 170400, "num_comment": 13, "author": "cindy", "tags": ["资讯"], "text": "面对美国的指控，朝鲜政府于周日发表声明，否认其曾入侵索尼影视，但同时表示他们很支持黑客们的“正义”举动。至于黑客是谁，朝鲜认为可能是他们在海外的“支持者和同情者”。"}
{"title": "有趣的安全实验：利用多线程资源竞争技术上传shell", "url": "https://www.freebuf.com/articles/web/53827.html", "time": "2014-12-09", "level": "金币+15", "num_look": 381044, "num_comment": 17, "author": "dawner", "tags": ["WEB安全"], "text": "通过多线程资源竞争的手段同时上传两个头像，就可以在Apache+Rails环境下实现远程代码执行，这并不是天方夜谭。"}
{"title": "工控安全：巴西知名SCADA曝严重拒绝服务漏洞", "url": "https://www.freebuf.com/news/53704.html", "time": "2014-12-09", "level": "金币+15", "num_look": 249319, "num_comment": 3, "author": "dawner", "tags": ["工控安全", "漏洞"], "text": "巴西知名SCADA（数据采集与监视控制系统）Elipse SCADA近日曝出一个严重的拒绝服务漏洞，目前其官方Elipse已修复此漏洞。SCADA是以计算机为基础的DCS与电力自动化监控系统。"}
{"title": "黑客题材电影：算法（ALGORITHM）", "url": "https://www.freebuf.com/articles/others-articles/53696.html", "time": "2014-12-09", "level": "金币+15", "num_look": 897112, "num_comment": 33, "author": "嘎巴嘎巴", "tags": ["其他", "视频"], "text": "片中的主角是一名从事自由职业的计算机黑客，在一次闯入机密的政府承包商并下载刚刚被开发出的程序后，坏事接踵而来……"}
{"title": "阿里巴巴速卖通曝安全漏洞，可能泄露百万用户个人信息", "url": "https://www.freebuf.com/news/53785.html", "time": "2014-12-08", "level": "金币+15", "num_look": 261955, "num_comment": 27, "author": "hujias", "tags": ["漏洞", "资讯"], "text": "据国外媒体报道，阿里巴巴全球速卖通的网站上曝出安全漏洞。攻击者可以在不知道用户账户密码的情况下，利用该漏洞窃取到全球数百万用户的个人信息。"}
{"title": "极光黄金（AURORAGOLD）行动：拦截并监控全球手机网络", "url": "https://www.freebuf.com/news/53776.html", "time": "2014-12-08", "level": "金币+9", "num_look": 311319, "num_comment": 17, "author": "fu4k", "tags": ["无线安全", "资讯"], "text": "这个代号为AURORAGOLD（极光黄金）的行动由美国国家安全局NSA发动，旨在监视全球的手机网络。"}
{"title": "揭秘网络战军火商Vupen：0day在手，天下我有", "url": "https://www.freebuf.com/news/topnews/53722.html", "time": "2014-12-08", "level": "金币+9", "num_look": 473070, "num_comment": 23, "author": "Rabbit_Run", "tags": ["头条", "观点"], "text": "在广义的入侵技术领域中，攻击者不断被媒体、隐私保护主义者或偶尔法院系统口诛笔伐，然而一家公司却可以置身事外，摆脱干系，它就是Vupen Security。"}
{"title": "阴霾未散：黑客组织GOP开始邮件威胁索尼员工及其家人", "url": "https://www.freebuf.com/news/53720.html", "time": "2014-12-08", "level": "", "num_look": 171879, "num_comment": 13, "author": "cindy", "tags": ["资讯"], "text": "自从黑客组织GOP入侵索尼影视之后，就在连续不断的制造威胁，包括泄露未上映电影、员工私人信息等。现在GOP的黑客们又开始向索尼影视的员工发送威胁邮件。"}
{"title": "价值2000美金的新型POS机恶意软件 - LusyPOS", "url": "https://www.freebuf.com/news/53681.html", "time": "2014-12-08", "level": "", "num_look": 184913, "num_comment": 2, "author": "嘎巴嘎巴", "tags": ["资讯"], "text": "LusyPOS是一款针对零售商POS机的新型恶意软件，目前以2000美元的售价开始在地下市场贩卖。"}
{"title": "谁蹭了我的WiFi？浅谈家用无线路由器攻防", "url": "https://www.freebuf.com/news/topnews/53556.html", "time": "2014-12-08", "level": "现金奖励", "num_look": 903983, "num_comment": 41, "author": "NSTRT", "tags": ["头条", "无线安全"], "text": "本文将针对普通家用无线路由器的常见攻击过程进行拆解并提出相应的防御建议。"}
{"title": "死亡铃声：预装在山寨机中的恶意木马", "url": "https://www.freebuf.com/news/53691.html", "time": "2014-12-07", "level": "", "num_look": 171357, "num_comment": 25, "author": "novice", "tags": ["资讯"], "text": "最近安全研究人员发现了一枚新的手机预装恶意软件——死亡铃声（DeathRing），金立、海尔、山寨三星等手机中招。"}
{"title": "索尼入侵事件新发现：强大的恶意程序BKDR_WIPALL", "url": "https://www.freebuf.com/news/53583.html", "time": "2014-12-05", "level": "金币+9", "num_look": 166337, "num_comment": 11, "author": "hujias", "tags": ["资讯"], "text": "索尼影视员工电脑屏幕上那张被黑图片是由强大的恶意程序BKDR_WIPALL生成的，它可以删除硬盘里的文件、停止微软服务、重启计算机。"}
{"title": "事件追踪：索尼影视员工数据进一步泄露", "url": "https://www.freebuf.com/news/53605.html", "time": "2014-12-05", "level": "", "num_look": 211037, "num_comment": 19, "author": "cindy", "tags": ["资讯"], "text": "索尼影视公司被爆出的资料越来越多，现在不仅仅是一些未上映的电影，这两天大量员工的敏感信息遭到了泄露，包括员工名单、薪资福利、社保号等。"}
{"title": "你听过Wi-Fi信号的声音吗？", "url": "https://www.freebuf.com/geek/53579.html", "time": "2014-12-05", "level": "", "num_look": 210407, "num_comment": 13, "author": "Mystery", "tags": ["极客"], "text": ""}
{"title": "批量Webshell管理工具QuasiBot之后门代码分析", "url": "https://www.freebuf.com/sectool/53554.html", "time": "2014-12-05", "level": "现金奖励", "num_look": 356658, "num_comment": 18, "author": "RickGray", "tags": ["工具"], "text": "在本地使用QuasiBot的时候，发现它的内置后门代码非常不错，所以便有了此文。本文会针对QuasiBot的两种后门代码进行剖析。"}
{"title": "DDoS之王：Xbox Live在线服务遭遇DDoS攻击而瘫痪", "url": "https://www.freebuf.com/news/53520.html", "time": "2014-12-05", "level": "", "num_look": 341732, "num_comment": 14, "author": "Sphinx", "tags": ["资讯"], "text": "黑客组织Lizard Squad已经承认了此次攻击由他们所为，而该组织在Twitter资料页中把自己称作“DDoS之王”。"}
{"title": "组合拳：三个漏洞实现PayPal账户劫持（含演示视频）", "url": "https://www.freebuf.com/news/53519.html", "time": "2014-12-04", "level": "", "num_look": 247940, "num_comment": 5, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "PayPal是eBay旗下流行的第三方支付产品，类似于国内的支付宝。最近有研究者在其web应用程序中发现了三个高危漏洞，攻击者可利用这些漏洞控制任意用户的PayPal账户。"}
{"title": "国产SQL注入漏洞测试工具 - 超级SQL注入工具（SSQLInjection）", "url": "https://www.freebuf.com/sectool/53487.html", "time": "2014-12-04", "level": "金币+9", "num_look": 1662701, "num_comment": 89, "author": "shack2", "tags": ["工具"], "text": "此工具为本人对C#、Socket及HTTP协议、SQL注入进行深入研究后，闲暇时间做的一款SQL注入工具。"}
{"title": "一条消息就崩溃：印度研究人员发现美国版微信WhatsApp漏洞", "url": "https://www.freebuf.com/news/53490.html", "time": "2014-12-04", "level": "", "num_look": 202791, "num_comment": 15, "author": "dawner", "tags": ["资讯"], "text": "用户如果收到了攻击者发送的消息，将不得不把与消息发送人的历史聊天对话删除。因为如果不完全删除聊天对话，应用程序就会一直处于崩溃的状态。"}
{"title": "伊朗黑客组织手术刀（Operation Cleaver）向全球发起攻击", "url": "https://www.freebuf.com/news/53492.html", "time": "2014-12-04", "level": "金币+9", "num_look": 195931, "num_comment": 23, "author": "hujias", "tags": ["资讯"], "text": "伊朗黑客组织“手术刀（Operation Cleaver）”正在全球范围内攻击航空、能源行业和国防领域。“手术刀”由伊朗政府赞助，在它的攻击目标中目前有10个是美国重要基础设施。"}
{"title": "剑指华尔街：黑客组织FIN4将攻击目标锁定美国上市公司", "url": "https://www.freebuf.com/news/53408.html", "time": "2014-12-04", "level": "红色标题", "num_look": 275348, "num_comment": 11, "author": "cindy", "tags": ["资讯"], "text": "2013年以来，FIN4黑客组织已经攻击了超过100家上市公司。该黑客组织专门攻击上市企业，窃取它们内部的并购、收购情报。目前FIN4入侵的100多家公司中，有超过2/3属于医疗和制药行业，其余都是咨询类公司。"}
{"title": "阿里巴巴招聘资深安全工程师、安全专家或高级安全专家", "url": "https://www.freebuf.com/jobs/53440.html", "time": "2014-12-03", "level": "", "num_look": 464024, "num_comment": 52, "author": "阿里巴巴安全", "tags": ["安全招聘"], "text": "阿里巴巴招聘资深安全工程师、安全专家或高级安全专家，提供极具行业竞争力的待遇。"}
{"title": "电脑即刻变砖：FBI警告美国企业警惕“格盘病毒”", "url": "https://www.freebuf.com/news/53387.html", "time": "2014-12-03", "level": "金币+5", "num_look": 289330, "num_comment": 18, "author": "Sphinx", "tags": ["资讯"], "text": "昨天FBI发布了一份长达5页的机密警告，告诫美国企业警惕“格盘病毒”——这种病毒会覆盖受害者硬盘上的数据，使其无法恢复，电脑即刻变砖。"}
{"title": "鼓励原创：FreeBuf原创文章现金奖励计划", "url": "https://www.freebuf.com/fevents/53352.html", "time": "2014-12-03", "level": "红色标题", "num_look": 3220480, "num_comment": 84, "author": "FB客服", "tags": ["活动"], "text": "木有乱七八糟的规则，即日起在FreeBuf投稿的原创文章，稿件一经发布，现金奖励200 - 600元。"}
{"title": "Web Hacking技巧（二）", "url": "https://www.freebuf.com/articles/web/53322.html", "time": "2014-12-03", "level": "金币+5", "num_look": 346285, "num_comment": 17, "author": "xia0k", "tags": ["WEB安全"], "text": "这是web渗透练习的第二篇文章。在这一部分，我们将简单介绍一下目录遍历和关于爬虫的爬取网页关键信息的Tips。"}
{"title": "卢森堡大学：比特币匿名交易也能查到你是谁", "url": "https://www.freebuf.com/news/53182.html", "time": "2014-12-03", "level": "", "num_look": 331888, "num_comment": 16, "author": "dawner", "tags": ["资讯"], "text": "​“比特币交易是匿名的”——大部分人对比特币的印象是如此。不过最近卢森堡大学在一份研究报告中称，黑客如果想要获取你的IP地址和身份信息，即使你使用了Tor网络进行比特币匿名交易也难逃追踪。"}
{"title": "RFID智能卡犯罪：小心你的社保卡、支付卡、交通卡和饭卡", "url": "https://www.freebuf.com/articles/terminal/53092.html", "time": "2014-12-03", "level": "金币+5", "num_look": 689869, "num_comment": 24, "author": "dawner", "tags": ["极客", "终端安全"], "text": "北京地铁票卡被黑，以及不久前在智利发生的交通卡被黑事件都是典型例子：窃贼将NFC手机轻轻靠近交通卡就篡改了卡中的余额。"}
{"title": "一周海外安全事件回顾：混乱的中东网络战", "url": "https://www.freebuf.com/news/53295.html", "time": "2014-12-03", "level": "红色标题", "num_look": 283489, "num_comment": 10, "author": "blackscreen", "tags": ["头条", "资讯"], "text": "敌人的敌人就是朋友，如此简单的逻辑在中东这块神奇的土壤上并不总是成立。在网络上亦然。"}
{"title": "索尼入侵事件与朝鲜有关？揭秘朝鲜黑客部队", "url": "https://www.freebuf.com/news/53333.html", "time": "2014-12-02", "level": "", "num_look": 222541, "num_comment": 21, "author": "hujias", "tags": ["头条", "资讯"], "text": "美国科技博客Re/code今日对惠普及美国军方报告中提及的有关朝鲜黑客部队的要点内容进行了总结。"}
{"title": "事件追踪：五部尚未发行的索尼电影遭泄露", "url": "https://www.freebuf.com/news/53273.html", "time": "2014-12-02", "level": "", "num_look": 263131, "num_comment": 19, "author": "dawner", "tags": ["头条", "资讯"], "text": "继上周黑客组织GOP入侵索尼影视内部网络后，近日《安妮（Annie）》《依然爱丽丝（Still Alice）》等5部索尼出品的尚未发行的新电影出现在盗版网站上。"}
{"title": "Android中间人攻击测试工具（原创） - Lanmitm", "url": "https://www.freebuf.com/sectool/53236.html", "time": "2014-12-02", "level": "金币+5", "num_look": 1881516, "num_comment": 63, "author": "oinux", "tags": ["工具"], "text": "刚好自己也是做Android相关工作的，所以有了自己写一个的想法，依葫芦画瓢开发了这个工具。"}
{"title": "揭秘：充电宝是如何盗取你的个人隐私的？", "url": "https://www.freebuf.com/news/topnews/53260.html", "time": "2014-12-02", "level": "金币+5", "num_look": 1594169, "num_comment": 61, "author": "creturn", "tags": ["头条", "极客"], "text": "中午吃完饭，看到一个央视新闻《别被改装充电宝盗取隐私》，觉得又是啥高大上的东西上了央视，看完后才知道是数字公司的某研究员做的伪装充电宝盗取隐私的玩意。"}
{"title": "美国流行打车APP Uber被曝收集用户隐私", "url": "https://www.freebuf.com/news/53208.html", "time": "2014-12-02", "level": "", "num_look": 220874, "num_comment": 9, "author": "cindy", "tags": ["资讯"], "text": "Uber收集并上传的用户数据包括：GPS定位、网络数据、电话呼叫、短信、手机信息、WIFI连接……还能更全点吗？"}
{"title": "微软：暴力破解面前，增强密码复杂性基本没用", "url": "https://www.freebuf.com/articles/web/53184.html", "time": "2014-12-02", "level": "金币+5", "num_look": 650280, "num_comment": 35, "author": "dawner", "tags": ["WEB安全", "数据安全"], "text": "微软发布的最新研究报告称：增强密码复杂性基本是没有任何意义的。在本文中，我将简要分析一下微软的理论，并且与大家探讨下两个新的密码安全解决方案。"}
{"title": "Windows间谍软件检测工具 - Detekt", "url": "https://www.freebuf.com/sectool/53239.html", "time": "2014-12-02", "level": "", "num_look": 208359, "num_comment": 6, "author": "phper", "tags": ["工具"], "text": "近些年来，越来越多的间谍软件开始窃听个人用户的电子邮箱、通讯软件会话或者摄像头和麦克风，而不少间谍软件在网络黑市上传播。如果你担心你的计算机中存在问题，不妨试试这个工具。"}
{"title": "射手网复活攻略：用百度快照和phantomjs让射手网起死回生", "url": "https://www.freebuf.com/news/topnews/53197.html", "time": "2014-12-01", "level": "金币+5", "num_look": 610590, "num_comment": 40, "author": "b41k3r", "tags": ["其他", "头条"], "text": "射手网关门了，声讨之余，我们可不可以做点别的？我发现一款名为射手播放器的软件仍然可以获取字幕，这就证明字幕文件仍然存在于射手的服务器上……"}
{"title": "一个人的武林：渗透测试常规思路分析（一）", "url": "https://www.freebuf.com/articles/web/53056.html", "time": "2014-12-01", "level": "金币+5", "num_look": 1103281, "num_comment": 39, "author": "mumaren", "tags": ["WEB安全"], "text": "渗透测试技术好比武功的招式套路，在总体套路不变的前提的下招招精进，也可以重组创新。"}
{"title": "走近科学：那些年，媒体笔下被夸大的黑客", "url": "https://www.freebuf.com/news/topnews/53108.html", "time": "2014-12-01", "level": "金币+15", "num_look": 675493, "num_comment": 57, "author": "fu4k", "tags": ["头条", "观点"], "text": "“他们是黑客。在他们看来，攻破网站就好像在打电子游戏。选定目标网站，入侵你的网银账户，定位你的位置，扰乱毫不相干网民们的生活，他们无所不能”——这就是媒体眼中的黑客。"}
{"title": "经验分享：社会工程学数据库搭建TIPS", "url": "https://www.freebuf.com/articles/database/53139.html", "time": "2014-12-01", "level": "金币+15", "num_look": 861679, "num_comment": 42, "author": "InN0t", "tags": ["数据安全"], "text": "最近一直在搞社工库的搭建。网上这方面也有很多文章，但是很少涉及到细节，在此与大家分享一些个人心得。"}
{"title": "Red Hat（红帽中国）招聘渗透测试工程师", "url": "https://www.freebuf.com/jobs/53057.html", "time": "2014-11-29", "level": "", "num_look": 243606, "num_comment": 50, "author": "redhat", "tags": ["安全招聘"], "text": "红帽站在企业IT开源软件开发的最前沿，面向商用市场推出广泛的产品和服务组合。现借FreeBuf招聘招聘渗透测试工程师。"}
{"title": "感恩节送大礼：叙利亚电子军（SEA）入侵美国各大热门媒体网站", "url": "https://www.freebuf.com/news/53048.html", "time": "2014-11-28", "level": "金币+15", "num_look": 165973, "num_comment": 16, "author": "cindy", "tags": ["资讯"], "text": "这两天是美国传统节日感恩节，而就在感恩节当天，叙利亚电子军（SEA）入侵了美国各大热门媒体网站，并在网站的页面上挂出一个感恩节特别窗口，上面写着：你已经被SEA黑了。"}
{"title": "金玉其外败絮其中：百度杀毒“雪狼引擎”逆向分析", "url": "https://www.freebuf.com/articles/system/53021.html", "time": "2014-11-28", "level": "金币+15", "num_look": 985348, "num_comment": 102, "author": "洛阳亲友", "tags": ["系统安全"], "text": "百无聊赖的夜晚，偶尔翻看到这么一篇介绍：“百度首度自研推出的核心查杀引擎「雪狼」，采用全新「量子查杀」技术。”虽然早已不像当年对软件安全那般狂热，但也许是虚荣心作祟，想练练手证明自己宝刀未老。"}
{"title": "IP.Board 3.4.5中SQL注入漏洞的利用与分析", "url": "https://www.freebuf.com/articles/web/53018.html", "time": "2014-11-28", "level": "金币+15", "num_look": 280859, "num_comment": 4, "author": "navyofficer", "tags": ["WEB安全"], "text": "之前在FREEBUF上看到一篇文章IP.Board的漏洞文章，对这个话题比较感兴趣，搭建了实验环境，进行了实验，便有了此文。"}
{"title": "FREE TALK•深圳站：观众报名开放&活动议程公布", "url": "https://www.freebuf.com/fevents/52982.html", "time": "2014-11-28", "level": "红色标题", "num_look": 343768, "num_comment": 27, "author": "FB客服", "tags": ["活动"], "text": "FREE TALK•深圳站 观众报名开放 & 活动议程公布啦！"}
{"title": "偏门系统拾遗：Tru64 Unix系统搭建渗透指南", "url": "https://www.freebuf.com/articles/system/52782.html", "time": "2014-11-28", "level": "", "num_look": 213582, "num_comment": 4, "author": "xia0k", "tags": ["系统安全"], "text": "这里我们就利用这高超的虚拟化技术来摸拟一个并不是那么常用的操作系统Tru64 Ubix操作系统，同时使用Metasploit对其进行简单的渗透演示操作。"}
{"title": "Flash又来补丁了：Adobe紧急发布Flash播放器计划外安全更新", "url": "https://www.freebuf.com/news/52953.html", "time": "2014-11-27", "level": "", "num_look": 182648, "num_comment": 14, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "Flash播放器中存在一个高危远程代码执行漏洞，目前正在被攻击者利用进行大规模的攻击，Adobe已紧急发布了一个计划外的安全更新。"}
{"title": "你所不知道的渗透测试：应用虚拟化的攻防", "url": "https://www.freebuf.com/articles/system/52960.html", "time": "2014-11-27", "level": "金币+15", "num_look": 520427, "num_comment": 25, "author": "NSTRT", "tags": ["系统安全"], "text": "Web渗透测试大家都耳熟能详，但是针对应用虚拟化的渗透测试或许大家比较少接触。本期技术专题将结合过往的项目经验，针对应用虚拟化技术给大家介绍一下相关的攻防技术。"}
{"title": "海康威视（Hikvision）安防监控录像机曝远程代码执行漏洞", "url": "https://www.freebuf.com/vuls/52939.html", "time": "2014-11-27", "level": "金币+15", "num_look": 1382228, "num_comment": 27, "author": "dawner", "tags": ["漏洞", "系统安全"], "text": "知名监控产品供应商海康威视（Hikvision）的大量数码录像机设备被曝存在远程代码执行漏洞，黑客可以由此直接获取设备最高权限。"}
{"title": "事件跟踪：有内鬼？黑客极有可能物理接触了索尼的网络", "url": "https://www.freebuf.com/news/52912.html", "time": "2014-11-27", "level": "金币+15", "num_look": 311040, "num_comment": 15, "author": "嘎巴嘎巴", "tags": ["头条", "资讯"], "text": "据最新消息，黑客很可能通过物理接触索尼公司的网络实现了此次入侵，也就是说在整个事件中，有索尼公司内部员工在做内应。"}
{"title": "技术分析：剖析HikaShop PHP对象注入漏洞", "url": "https://www.freebuf.com/vuls/52693.html", "time": "2014-11-27", "level": "金币+15", "num_look": 290431, "num_comment": 11, "author": "dawner", "tags": ["WEB安全", "漏洞"], "text": "HikaShop是基于著名开源CMS Joomla的电子商务程序，可以帮助用户轻松的开发电子商务网站或网店。今天要讲的这个HikaShop漏洞允许黑客向网站发送恶意指令，从而造成远程代码执行。"}
{"title": "解读安卓渗透神器DroidSheep看ARP欺骗攻击", "url": "https://www.freebuf.com/news/52809.html", "time": "2014-11-27", "level": "金币+15", "num_look": 940539, "num_comment": 18, "author": "ruo", "tags": ["资讯"], "text": "局域网通信是通过MAC地址作为门牌号的，我们通过ARP投毒实现针对主机的欺骗。"}
{"title": "Wordpress 4.0以下版本存在跨站脚本漏洞", "url": "https://www.freebuf.com/news/52895.html", "time": "2014-11-26", "level": "", "num_look": 224939, "num_comment": 12, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "Wordpress是著名的开源CMS（内容管理）系统。近日，在4.0版本以下的Wordpress被发现存在跨站脚本漏洞（XSS）。"}
{"title": "吸烟不仅伤身，还伤电脑：攻击者利用电子香烟传播恶意软件", "url": "https://www.freebuf.com/news/52857.html", "time": "2014-11-26", "level": "金币+5", "num_look": 425267, "num_comment": 29, "author": "hujias", "tags": ["资讯"], "text": "吸烟不仅伤身，还伤电脑……近日，一款中国制造的电子香烟被曝出其通过USB充电时，会自动在用户计算机上安装恶意软件。"}
{"title": "FREE TALK•深圳站 神秘嘉宾揭晓：《打造Facebook》作者 - 王淮", "url": "https://www.freebuf.com/fevents/52821.html", "time": "2014-11-26", "level": "红色标题", "num_look": 316530, "num_comment": 30, "author": "FB客服", "tags": ["活动"], "text": "他是一名黑客工程师，一手开创了Facebook的支付安全领域；他亦是一名作家，畅销书《打造Facebook》迎来经久不息的掌声；他也是创业者，回国后创立投资基金，开启另一段旅途。"}
{"title": "魅族科技急聘系统安全工程师（薪资+不错的股票）", "url": "https://www.freebuf.com/jobs/52681.html", "time": "2014-11-26", "level": "", "num_look": 166864, "num_comment": 30, "author": "西刚", "tags": ["安全招聘"], "text": "魅族公司成立于2003年。创始人从小沉迷电子热爱科技，魅族就是电子梦想和共赢理念的结晶。从创立以来的一次次飞跃不仅是魅族人热爱追求的结果，更是梦想力量的体现。现急聘系统安全工程师。"}
{"title": "全方位加强账户安全：Google发布设备安全管理平台", "url": "https://www.freebuf.com/news/52850.html", "time": "2014-11-26", "level": "", "num_look": 135638, "num_comment": 2, "author": "dawner", "tags": ["资讯"], "text": "为了解决Google账户可能被其他使用设备的人盗用的安全隐患，Google推出了设备安全管理平台，帮助您更好地管理那些您Google账户登录过的设备。"}
{"title": "黑客电影场面再现：索尼影视公司遭入侵", "url": "https://www.freebuf.com/news/52758.html", "time": "2014-11-26", "level": "红色标题", "num_look": 503845, "num_comment": 37, "author": "cindy", "tags": ["资讯"], "text": "据TheNextWeb网站报道，索尼影视公司的网络遭遇了一次很严重的攻击，如同电影里的黑客入侵场面，其公司里的每台电脑的屏幕都被篡改并显示同一张图片。"}
{"title": "Metasploit渗透Ubuntu 12.04攻击测试演练", "url": "https://www.freebuf.com/articles/system/52692.html", "time": "2014-11-26", "level": "金币+5", "num_look": 550276, "num_comment": 26, "author": "xia0k", "tags": ["系统安全", "网络安全"], "text": "这篇文章写来主要是一次娱乐性的安全练习。共享出攻击的细节，渗透的过程不是重点，但文章后半部分维持持久化攻击的一些地方还是很值得学习的，顺便大家也可以再次熟悉一下MSF框架。"}
{"title": "漏洞盒子安全团队招聘安全研究员、安全工程师", "url": "https://www.freebuf.com/jobs/52783.html", "time": "2014-11-25", "level": "", "num_look": 190615, "num_comment": 28, "author": "漏洞盒子", "tags": ["安全招聘"], "text": "企业级安全服务产品 - 漏洞盒子业务上线以来目前已与多家大型知名企业合作，由于业务发展迅速，现诚招安全岗位同学，待遇优厚，优秀人才将纳入期权计划。"}
{"title": "深度：剖析三星Galaxy KNOX远程代码执行漏洞（含视频）", "url": "https://www.freebuf.com/news/52668.html", "time": "2014-11-25", "level": "金币+5", "num_look": 457704, "num_comment": 11, "author": "Sphinx", "tags": ["漏洞", "终端安全"], "text": "本文将详细介绍三星 Galaxy S5最新发现的远程执行漏洞，攻击者可以藉此漏洞入侵系统。目前三星官方已在Galaxy S5、Note 4和Alpha产品中修复此漏洞，但S4，Note 3等三星设备尚未修复。"}
{"title": "土耳其黑客入侵本国电力系统，怒删贫困地区巨额债务账单（含视频）", "url": "https://www.freebuf.com/news/52685.html", "time": "2014-11-25", "level": "", "num_look": 310372, "num_comment": 34, "author": "dawner", "tags": ["资讯"], "text": "土耳其黑客组织RedHack入侵了本国的电力管理系统官网，并且撤销了该国穷困地区Soma价值150万土耳其币（约合65万美元）的债务账单。"}
{"title": "黑客辞典：暗网（the Dark Web）", "url": "https://www.freebuf.com/news/topnews/52445.html", "time": "2014-11-25", "level": "金币+5", "num_look": 2050403, "num_comment": 36, "author": "FB情报组", "tags": ["WEB安全", "头条"], "text": "伴随着丝绸之路的兴衰，在过去的几年中，暗网已经被太多人关注。现在，FreeBuf情报组将带你走近“暗网”这个神秘的地下虚拟世界。"}
{"title": "免费主题暗藏后门，波及WordPress等知名CMS系统", "url": "https://www.freebuf.com/news/52662.html", "time": "2014-11-25", "level": "金币+5", "num_look": 244345, "num_comment": 20, "author": "嘎巴嘎巴", "tags": ["资讯"], "text": "最近美国安全研究者爆料，针对CMS（内容管理系统）网站的数千种插件和主题被植入了名为CryptoPHP的后门，这可能导致大量的Web服务器被攻击者据为己有。"}
{"title": "走近科学：剑指Android和iOS系统的DoubleDirect中间人攻击", "url": "https://www.freebuf.com/news/topnews/52615.html", "time": "2014-11-25", "level": "金币+5", "num_look": 570814, "num_comment": 22, "author": "cindy", "tags": ["头条", "系统安全"], "text": "这种被称为DoubleDirect的技术属于中间人（MITM）攻击的一种。攻击者可以利用这种技术把受害者访问谷歌、Facebook、Twitter上的流量重定向到攻击者控制的设备上，可窃取受害者的私人数据，比如，邮箱ID、登录凭证、…"}
{"title": "黑客伪造Viber未接来电传播病毒", "url": "https://www.freebuf.com/news/52511.html", "time": "2014-11-25", "level": "", "num_look": 154134, "num_comment": 3, "author": "Sphinx", "tags": ["资讯"], "text": "Viber是一种智能手机用的跨平台网络电话及即时通讯软件，类似于微信/QQ语音电话。近日，全球各地的众多Viber用户们都收到了一份虚假邮件，这些自称是来自Viber的邮件提醒你你有一个未接来电。"}
{"title": "华为招聘网络安全工程师", "url": "https://www.freebuf.com/jobs/52381.html", "time": "2014-11-24", "level": "", "num_look": 348183, "num_comment": 79, "author": "zhaopin_001", "tags": ["安全招聘"], "text": "本次招聘部门为华为技术公司网络安全部渗透测试小组，由于业务迅速发展，需要渗透测试和漏洞挖掘人才。"}
{"title": "写在FreeBuf 2015新版上线前", "url": "https://www.freebuf.com/articles/others-articles/52553.html", "time": "2014-11-24", "level": "红色标题", "num_look": 589718, "num_comment": 88, "author": "thanks", "tags": ["其他"], "text": "一点一滴的改变，终会打动你的心。"}
{"title": "Google出品：开源Web App漏洞测试环境 - Firing Range", "url": "https://www.freebuf.com/news/52417.html", "time": "2014-11-24", "level": "", "num_look": 388690, "num_comment": 13, "author": "Sphinx", "tags": ["工具", "资讯"], "text": "Google于周二发布了一个名为Firing Range的安全漏洞测试环境，旨在通过评估Web应用在XSS和其他方面的安全性，提高自动化扫描器的效率。"}
{"title": "Web渗透练习技巧N则（一）", "url": "https://www.freebuf.com/articles/web/52413.html", "time": "2014-11-24", "level": "金币+11", "num_look": 1276474, "num_comment": 24, "author": "xia0k", "tags": ["WEB安全", "网络安全"], "text": "接下来的几篇文章，我将陆续给大家介（ban）绍（yun）一些国外的大牛的web渗透的奇技淫巧，当然这其中肯定也会包括一些基本的但是比较容易被我们忽视的点，希望对研究web或者对web有兴趣的同学有点帮助。"}
{"title": "揭秘：针对PoS机的恶意软件工具箱", "url": "https://www.freebuf.com/news/topnews/52440.html", "time": "2014-11-24", "level": "金币+11", "num_look": 349055, "num_comment": 2, "author": "Sphinx", "tags": ["头条", "终端安全"], "text": "最近两年，PoS恶意软件由于塔吉特、家得宝、Kmart遭遇的POS机攻击而被广泛关注。随着“黑色星期五”购物季的到来，PoS机恶意软件必定会受到关注。"}
{"title": "还能愉快的玩耍吗？恶意木马开始盯上密码管理软件", "url": "https://www.freebuf.com/news/52383.html", "time": "2014-11-23", "level": "", "num_look": 304873, "num_comment": 13, "author": "cindy", "tags": ["安全管理", "资讯"], "text": "网络罪犯们永远在见着拆招。现在，他们又盯上了密码管理软件。攻击者设计了一个Citadel木马配置文件，当用户使用密码管理软件Password Safe和KeePass时，该文件会立即启动键盘记录器。"}
{"title": "百度云安全部招聘云加速高级研发工程师", "url": "https://www.freebuf.com/jobs/52368.html", "time": "2014-11-22", "level": "", "num_look": 163953, "num_comment": 8, "author": "aaa6356", "tags": ["安全招聘"], "text": "百度云加速，是百度旗下为网站提供一站式加速、安全防护和搜索引擎优化的产品，现招聘高级研发工程师。"}
{"title": "安全科普：什么是暴力破解攻击？如何检测和防御？", "url": "https://www.freebuf.com/news/topnews/52361.html", "time": "2014-11-21", "level": "金币+11", "num_look": 524014, "num_comment": 18, "author": "hujias", "tags": ["WEB安全", "头条"], "text": "众所周知，iCloud艳照门其实并不高明，黑客通过暴力破解攻击不断尝试登录用户的账号名和密码，最终获取好莱坞明星的iCloud账号。什么是暴力破解攻击？怎样检测暴力破解攻击以及怎样防护呢？"}
{"title": "Imperva发布新的Bot人机识别服务", "url": "https://www.freebuf.com/news/52338.html", "time": "2014-11-21", "level": "", "num_look": 184098, "num_comment": 5, "author": "cindy", "tags": ["资讯"], "text": "近日，知名企业安全公司Imperva发布了一项可以识别机器和人类用户的新服务——ThreatRadar Bot Protection Services。这项服务可以集成在WAF（Web应用防火墙）中，帮助网站快速的识别僵尸网络，并及时做出防范。"}
{"title": "PHP应用安全静态代码分析工具 - WAP 2.0", "url": "https://www.freebuf.com/sectool/52333.html", "time": "2014-11-21", "level": "金币+11", "num_look": 382081, "num_comment": 25, "author": "fu4k", "tags": ["工具"], "text": "WAP 2.0是一个静态源代码安全分析和数据挖掘工具，可以发现PHP Web应用程序中的安全漏洞，同时具有较低的误报率。"}
{"title": "微财富招募信息安全工程师", "url": "https://www.freebuf.com/jobs/52221.html", "time": "2014-11-21", "level": "", "num_look": 165407, "num_comment": 16, "author": "xocoder", "tags": ["安全招聘"], "text": "微财富致力于为投资者提供多种类的理财产品和理财方案，现招募信息安全工程师。"}
{"title": "震网病毒Stuxnet之子 - Duqu的现身", "url": "https://www.freebuf.com/news/52249.html", "time": "2014-11-20", "level": "金币+11", "num_look": 633300, "num_comment": 23, "author": "phper", "tags": ["头条", "系统安全"], "text": "这个恶意程序被命名为Duqu。赛门铁克公司的Eric Chien和其同事都感到很兴奋，这是难得一见恶意病毒，他们预言Duqu将开启「Stuxnet（震网）的新篇章」"}
{"title": "安全科普：你的密码在谁的手里？", "url": "https://www.freebuf.com/news/topnews/52234.html", "time": "2014-11-20", "level": "金币+11", "num_look": 1072180, "num_comment": 47, "author": "NSTRT", "tags": ["头条", "安全管理"], "text": "前几天，身边的很多朋友出现了密码被盗的现象，有感于普通人对密码的意识比较淡薄，所以本篇文章将会剖析一下黑客盗号常用的手段以及普通人保护自己密码安全所能做的安全措施。"}
{"title": "结合中间人攻击，Pidgin鸡肋漏洞变废为宝", "url": "https://www.freebuf.com/news/51658.html", "time": "2014-11-20", "level": "金币+11", "num_look": 255057, "num_comment": 6, "author": "dawner", "tags": ["漏洞", "系统安全"], "text": "最新版本的开源即时通讯客户端Pidgin 2.10.10这段时间修复了一系列漏洞，其中的SSL/TLS证书验证问题可以被黑客利用来进行中间人攻击。如此一来，某些稍显鸡肋的漏洞也借助中间人攻击变得危害巨大。"}
{"title": "Windows安全通道远程代码执行漏洞（CVE-2014-6321）浅析", "url": "https://www.freebuf.com/vuls/52110.html", "time": "2014-11-20", "level": "金币+11", "num_look": 657630, "num_comment": 13, "author": "Rabbit_Run", "tags": ["漏洞", "系统安全"], "text": "Windows安全通道（SecureChannel，Schannel）惊报漏洞，微软日前发布列为重大等级的MS14-066信息安全公告，揭露了在Schannel中的远程代码执行漏洞（CVE-2014-6321）。"}
{"title": "Sqlmap联合Nginx实现“地毯式”检测网站SQL注入漏洞", "url": "https://www.freebuf.com/articles/web/52103.html", "time": "2014-11-19", "level": "金币+11", "num_look": 744066, "num_comment": 42, "author": "占个位", "tags": ["WEB安全"], "text": "Sqlmap是一个开源的SQL注入漏洞检测工具，Nginx是高性能的WEB服务器。今天我们将二者结合起来，对网站的SQL注入漏洞实现“地毯式”的检测！"}
{"title": "漏洞预警：系统权限提升漏洞（CVE-2014-6324）影响全版本Windows服务器", "url": "https://www.freebuf.com/articles/system/52127.html", "time": "2014-11-19", "level": "金币+11", "num_look": 548102, "num_comment": 23, "author": "langyajiekou", "tags": ["系统安全"], "text": "微软今天发布了一个紧急补丁，修复了一个影响全部版本Windows服务器的严重漏洞，该漏洞允许黑客提升任意普通用户权限成为域管理员（Domain Admin）身份。"}
{"title": "Windows Phone 8.1权限提升漏洞", "url": "https://www.freebuf.com/vuls/52087.html", "time": "2014-11-19", "level": "", "num_look": 174423, "num_comment": 7, "author": "cindy", "tags": ["漏洞"], "text": "在微软公布其存在19年之久的超级漏洞的数周之后，开发者们又在微软最新的操作系统——Windows Phone 8.1上发现了一个漏洞，攻击者可以利用该漏洞破解诺基亚Lumia手机。"}
{"title": "一周海外安全事件回顾（11.03-11.15）：黑暗网络的坠落", "url": "https://www.freebuf.com/news/51974.html", "time": "2014-11-19", "level": "红色标题", "num_look": 365714, "num_comment": 13, "author": "blackscreen", "tags": ["头条", "资讯"], "text": "本月初，FBI等执法部门联手打掉了Silk Road 2.0及其他诸多黑暗站点。我的问题是，How？这正是本期一周回顾要探讨的。"}
{"title": "涨姿势：如何让你的Google账户更安全", "url": "https://www.freebuf.com/news/topnews/51455.html", "time": "2014-11-19", "level": "金币+8", "num_look": 324835, "num_comment": 9, "author": "凌晨几度i", "tags": ["WEB安全", "头条"], "text": "如果你使用Gmail作为你主要的电子邮件，或者长期依赖于谷歌提供的服务，再或者你是“Google脑残粉”……那么这篇文章就值得你来读读。"}
{"title": "广州唯一优品招聘代码安全审计工程师", "url": "https://www.freebuf.com/jobs/51975.html", "time": "2014-11-19", "level": "", "num_look": 233761, "num_comment": 19, "author": "啊卡卡✅", "tags": ["安全招聘"], "text": "唯一优品（ve.cn）于2014年8月1日正式上线，是目前国内最专业的一站式母婴用品网上商城之一，也是最受宝宝喜爱以及靓妈们安心的大型商城之一。现招聘代码安全审计工程师。"}
{"title": "漏洞预警：.NET远程代码执行漏洞（含EXP）", "url": "https://www.freebuf.com/vuls/51981.html", "time": "2014-11-18", "level": "金币+8", "num_look": 757713, "num_comment": 34, "author": "凌晨几度i", "tags": ["漏洞"], "text": "就在上周微软宣布.NET开源的好消息。应用程序开发者们笑了，这没什么……关键是安全研究者们也笑了。就在这两天，.NET被曝远程代码执行漏洞。"}
{"title": "Google与NSA（美国国安局）结盟，共同对抗黑客", "url": "https://www.freebuf.com/news/51956.html", "time": "2014-11-18", "level": "金币+8", "num_look": 360048, "num_comment": 17, "author": "cindy", "tags": ["观点", "资讯"], "text": "2009年12月中旬，谷歌总部的工程师开始怀疑中国的黑客入侵了私人Gmail账户。当谷歌工程师仔细分析调查时，发现它并不是一起普通的网络攻击事件，而是一次复杂的、有针对性的攻击。"}
{"title": "勒索软件CoinVault：拿钱来，给你一个恢复文件的机会", "url": "https://www.freebuf.com/news/51899.html", "time": "2014-11-18", "level": "", "num_look": 510171, "num_comment": 11, "author": "Sphinx", "tags": ["系统安全", "资讯"], "text": "这款木马会向受害者给出“侮辱性的施舍”：提供免费恢复一个文件的机会，告诉受害者我确实能恢复你的文件。"}
{"title": "沙虫漏洞（CVE-2014-4114）利用测试方法", "url": "https://www.freebuf.com/vuls/51735.html", "time": "2014-11-18", "level": "金币+8", "num_look": 450200, "num_comment": 26, "author": "dalin", "tags": ["漏洞", "系统安全"], "text": "此漏洞目前主要被黑客组织用来进行APT（Advanced Persistent Threat）攻击，或者称之为“针对特定目标的攻击”。主要针对政府等大型企业，通过发送邮件的方式进行攻击。"}
{"title": "iOS平台个人网银APP的安全测试报告", "url": "https://www.freebuf.com/articles/terminal/51526.html", "time": "2014-11-18", "level": "金币+8", "num_look": 340062, "num_comment": 7, "author": "liaoxj2046", "tags": ["安全报告", "终端安全"], "text": "几年来，我一直在从事有关个人网银APP的安全性研究。在这份报告中，我使用了黑盒和静态分析的方法，对全球最具影响力的四十个iPhone/ipad网银APP进行了安全测试。"}
{"title": "对抗中间人（MITM）攻击：微软考虑在IE中引入新的防护机制", "url": "https://www.freebuf.com/news/51855.html", "time": "2014-11-18", "level": "", "num_look": 132076, "num_comment": 6, "author": "Sphinx", "tags": ["资讯"], "text": "微软正在考虑引入public-key pinning机制，以抵御针对IE的中间人(MITM)攻击。Public-key pinning作为一项对HTTP的拓展，由Google安全工程师今年10月递交给了互联网工程任务组。"}
{"title": "漏洞盒子项目上新：360加密邮APP（含服务端）+ PC客户端安全测试", "url": "https://www.freebuf.com/fevents/51852.html", "time": "2014-11-17", "level": "红色标题", "num_look": 1184140, "num_comment": 18, "author": "FB客服", "tags": ["活动"], "text": "​本次漏洞盒子测试项目为：360加密邮APP（含服务端）+ PC客户端，奇虎360公司授权和欢迎漏洞盒子及FreeBuf的白帽子对其最新产品“360加密邮”进行安全测试，奖金丰厚。"}
{"title": "Exploit搜索工具 - Pompem", "url": "https://www.freebuf.com/sectool/51796.html", "time": "2014-11-17", "level": "金币+8", "num_look": 347266, "num_comment": 19, "author": "phper", "tags": ["工具"], "text": "如今漏洞越来越多，Exploits（漏洞利用测试程序）的寻找就显得尤为重要。Pompem是一款开源安全工具，可以帮助安全研究人员自动化的搜索Exploit。"}
{"title": "互联网灰色产业链一角：流氓软件也挺“拼”的", "url": "https://www.freebuf.com/articles/system/51749.html", "time": "2014-11-17", "level": "红色标题", "num_look": 440346, "num_comment": 24, "author": "翰海源安全", "tags": ["安全报告", "系统安全"], "text": "目前国内随处可见这类强制捆绑、强制安装的流氓软件，随着这条利益链带来的巨大收益，流氓软件所使用的手段也越来越高级，这些流氓软件采用更加隐蔽、更具迷惑性、更加暴力的推广方式。"}
{"title": "使用Pfsense+Snorby构建入侵检测系统", "url": "https://www.freebuf.com/articles/network/51473.html", "time": "2014-11-17", "level": "金币+8", "num_look": 592385, "num_comment": 20, "author": "www.heetian.com", "tags": ["网络安全"], "text": "黑客攻击是不可避免的，常在江湖飘，哪有不被黑（谁也不敢说自己的网络是绝对安全的）。被黑了怎么办？肯定是第一时间修复漏洞和清除后门啦！该怎么修复漏洞了？漏洞又在那里了？"}
{"title": "监控民众又出新招：美国利用间谍飞机伪装空中移动通信基站", "url": "https://www.freebuf.com/news/51712.html", "time": "2014-11-17", "level": "", "num_look": 201207, "num_comment": 8, "author": "dawner", "tags": ["资讯"], "text": "据最新消息报道，美国政府使用间谍飞机伪装成空中移动信号基站，其配备了特殊军用级设备Dirtbox，可窃听上百万美国民众的手机消息。"}
{"title": "IE远程代码执行漏洞（CVE-2014-6332）利用测试方法", "url": "https://www.freebuf.com/vuls/51628.html", "time": "2014-11-17", "level": "金币+8", "num_look": 953358, "num_comment": 30, "author": "dalin", "tags": ["漏洞", "系统安全"], "text": "IE远程代码执行漏洞（CVE-2014-6332）自Windows 95首次发布（19年前）以来就一直存在。本文描述了该漏洞的利用方法，帮助大家更好的理解和测试漏洞。"}
{"title": "华盛顿邮报：美国气象网络系统遭中国黑客入侵", "url": "https://www.freebuf.com/news/51528.html", "time": "2014-11-16", "level": "", "num_look": 170794, "num_comment": 15, "author": "cindy", "tags": ["资讯"], "text": "据华盛顿邮报报道，中国黑客又一次入侵了美国联邦政府网络，这次入侵的是美国气象网络系统（上次入侵的是美国邮政）。对此指控，中国领事馆予以否认。"}
{"title": "黑市洗牌：Evolution成为丝绸之路2.0灭亡后最大的黑市交易平台", "url": "https://www.freebuf.com/news/51600.html", "time": "2014-11-16", "level": "金币+5", "num_look": 574955, "num_comment": 9, "author": "嘎巴嘎巴", "tags": ["资讯"], "text": "FBI于上周取缔了以丝绸之路2.0为首的多达20余家非法网站，黑市中的“老二老三们”当然知道此时正是扩大市场最好的机会，他们正在加快抢占市场的速度。"}
{"title": "免费开源相册Piwigo <= v2.6.0 SQL注入漏洞（0day）", "url": "https://www.freebuf.com/vuls/51401.html", "time": "2014-11-15", "level": "", "num_look": 264179, "num_comment": 6, "author": "午夜灰狼哥", "tags": ["漏洞"], "text": "Piwigo是世界上最著名的免费开源相册系统之一，由PHP+MySQL架构。由于该框架搭建方便，受到国内外的开发者青睐，近日，Piwigo"}
{"title": "Win95+IE3 - Win10+IE11全版本执行漏洞（含POC）", "url": "https://www.freebuf.com/articles/system/51501.html", "time": "2014-11-14", "level": "金币+5", "num_look": 987759, "num_comment": 75, "author": "qiujianzhong", "tags": ["系统安全"], "text": "微软本月安全更新修复了一个潜藏了18年的IE远程代码执行漏洞（CVE-2014-6332），可以说是给windows吃了一颗大补丸。缺陷出现在VBScript的代码中，自Windows 95首次发布（19年前）以来就一直存在。"}
{"title": "中国电信的失误，俄罗斯发生路由信息泄漏", "url": "https://www.freebuf.com/news/51477.html", "time": "2014-11-14", "level": "", "num_look": 332270, "num_comment": 7, "author": "cindy", "tags": ["资讯"], "text": "由于中国电信的失误，俄罗斯本土的网络流量在不断的向俄罗斯境外路由，这有可能会对俄罗斯的通信安全造成影响。网络监测服务中心Dyn于周四在博客中写到，这次事件是由于边界网关协议（BGP）中存在错误引起的。"}
{"title": "微软披露影响所有Windows版本的高危漏洞", "url": "https://www.freebuf.com/news/51382.html", "time": "2014-11-14", "level": "", "num_look": 264232, "num_comment": 12, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "微软披露了一个存在于所有Windows版本的高危漏洞。建议所有Windows用户，尤其是运行网站的用户应尽快安装微软周二发布的补丁。"}
{"title": "上海三零卫士安全岗位招聘", "url": "https://www.freebuf.com/jobs/51408.html", "time": "2014-11-14", "level": "", "num_look": 252304, "num_comment": 29, "author": "30wish", "tags": ["安全招聘"], "text": "上海三零卫士信息安全有限公司（以下简称公司）是专业从事信息系统安全建设和服务的高新技术企业，公司总部位于上海贝岭大厦。"}
{"title": "我来了，你在哪？FREE TALK•深圳站 议题征集", "url": "https://www.freebuf.com/fevents/51090.html", "time": "2014-11-13", "level": "红色标题", "num_look": 342051, "num_comment": 34, "author": "FB客服", "tags": ["活动"], "text": "12月20日，FreeBuf互联网安全茶话会——FREE TALK即将登陆深圳。没有古板的演讲桌，也没有浓重的商业味。只有属于自由分享的那份轻松，以及免费的零食、饮料和台球桌。深圳站更有神秘嘉宾到场！"}
{"title": "D-Vasive：强大的反间谍APP", "url": "https://www.freebuf.com/news/51313.html", "time": "2014-11-13", "level": "金币+5", "num_look": 189035, "num_comment": 23, "author": "dawner", "tags": ["资讯"], "text": "在芝加哥举办的CIO协同研讨会上，著名杀毒软件迈克菲的创始人John McAfee代表FTC(未来安全系统)公司宣布：FTC官方发布D-Vasive的免费版及专业版，这是一款拥有强大的反间谍+隐私防护功能的移动应用软件。"}
{"title": "专攻全球企业高管：Darkhotel APT组织利用酒店网络进行间谍攻击", "url": "https://www.freebuf.com/news/51179.html", "time": "2014-11-13", "level": "金币+5", "num_look": 193848, "num_comment": 13, "author": "cindy", "tags": ["资讯"], "text": "一个存在长达七年的网络间谍组织正把攻击目标锁定在全球大型企业的高管身上。他们通过高级持续性威胁（APT）攻击，利用0day漏洞利用程序和键盘记录器，从这些企业高管商业访问时所住豪华酒店的网络中提取信息。"}
{"title": "黑客组织AnonGhost攻陷联合国网站", "url": "https://www.freebuf.com/news/51173.html", "time": "2014-11-13", "level": "", "num_look": 192817, "num_comment": 11, "author": "Sphinx", "tags": ["资讯"], "text": "著名的亲巴勒斯坦黑客组织”AnonGhost”今天成功攻陷联合国网站，以抗议以色列在东耶路撒冷全面封闭阿克萨清真寺。这次的攻击名为#OpSaveAlAqsa（拯救阿克萨行动）。"}
{"title": "假面攻击（Masque Attack）详细分析与利用", "url": "https://www.freebuf.com/articles/terminal/51130.html", "time": "2014-11-13", "level": "金币+5", "num_look": 294130, "num_comment": 6, "author": "Xarray", "tags": ["终端安全"], "text": "近期在苹果iOS手机系统上曝光的两个漏洞，WireLurker和Masque Attack,影响了iOS目前到8.1.1 beta的最新版本，而且不受越狱和非越狱环境限制。"}
{"title": "事件跟踪：贝尔金路由器（Belkin router）0day溢出漏洞分析", "url": "https://www.freebuf.com/articles/terminal/51114.html", "time": "2014-11-13", "level": "", "num_look": 447733, "num_comment": 3, "author": "xia0k", "tags": ["终端安全", "网络安全"], "text": "该漏洞主要攻击的是路由器的Web界面,受攻击的路由器型号为N750 DB WIFI 双频N+千兆型,运行的固件版本为firmware F9K1103_WW_1.10.16m。"}
{"title": "Android渗透测试工具 - zANTI（汉化版）", "url": "https://www.freebuf.com/sectool/51103.html", "time": "2014-11-12", "level": "金币+5", "num_look": 1108412, "num_comment": 46, "author": "斐鸽", "tags": ["工具"], "text": "zANTI是一款Android平台下的渗透测试工具，支持嗅探已连接的网络，支持中间人攻击测试、端口扫描、cookie获取、路由安全测试等操作。"}
{"title": "NFC手机：攻破交通卡", "url": "https://www.freebuf.com/articles/wireless/51070.html", "time": "2014-11-12", "level": "红色标题", "num_look": 1123468, "num_comment": 30, "author": "AVLTeam", "tags": ["无线安全", "终端安全"], "text": "AVL移动安全团队最近发现一款利用NFC手机攻击交通卡的恶意软件。将该款恶意软件安装在NFC手机中，窃贼只需将此手机轻轻靠近圣地亚哥交通卡（bip!-card）即可任意篡改卡中的余额。"}
{"title": "假面攻击：你所有的iOS应用都在我们的手掌心", "url": "https://www.freebuf.com/articles/terminal/51036.html", "time": "2014-11-12", "level": "金币+5", "num_look": 352655, "num_comment": 19, "author": "silencezt", "tags": ["终端安全"], "text": "火眼（Fireeye）移动安全研究人员发现那种使用enterprise/ad-hoc授权文件（provisioning）安装的iOS应用会替换掉从App Store下载的正版iOS应用，前提是两个app使用的是相同的bundle identifier。"}
{"title": "苹果设备（iPhone、iPad）GPS定位工具 - iSniff-GPS", "url": "https://www.freebuf.com/sectool/50904.html", "time": "2014-11-12", "level": "金币+5", "num_look": 513980, "num_comment": 18, "author": "Nirvana", "tags": ["工具"], "text": "iSniff-GPS是一个被动式无线网络嗅探工具，它可以捕获附近的iPhone、iPad和其他无线设备所发出SSID，ARP和MDNS (Bonjour) 数据包，确定设备类型及其地理位置。"}
{"title": "金融攻击事件分析:Tyupkin样本技术分析及攻击过程还原", "url": "https://www.freebuf.com/articles/system/50940.html", "time": "2014-11-12", "level": "", "num_look": 215123, "num_comment": 7, "author": "翰海源安全", "tags": ["系统安全"], "text": "前段时间，卡巴斯基发现并报告了一种新型的恶意程序Tyupkin，该恶意程序针对银行的ATM自动取款机发起攻击，通过微软提供的金融服务控件MSXFS.dl来直接操控ATM设备来实现从取款机任意取钱。"}
{"title": "Microsoft昨日发布高达16个安全补丁", "url": "https://www.freebuf.com/news/50969.html", "time": "2014-11-11", "level": "", "num_look": 176133, "num_comment": 10, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "​Microsoft于11月11日（微软发布补丁的固定日期，被称为“补丁星期二”）提前发布了16个安全补丁公告（原计划也是在11日发布），这是近几年来发布补丁数量最多的一次。"}
{"title": "攻击Linux和Cisco思科设备：恶意软件BlackEnergy（黑暗力量）又升级了", "url": "https://www.freebuf.com/news/50644.html", "time": "2014-11-11", "level": "", "num_look": 191273, "num_comment": 21, "author": "dawner", "tags": ["资讯"], "text": "卡巴斯基实验室的安全研究员发现，一款名为BlackEnergy（黑暗力量）的恶意软件已经可以对路由器、Linux系统、Windows系统发起攻击，其中包括思科类网络设备。"}
{"title": "IP.Board<=3.4.7 SQL注入漏洞（0day）POC", "url": "https://www.freebuf.com/vuls/50847.html", "time": "2014-11-11", "level": "金币+5", "num_look": 388370, "num_comment": 14, "author": "午夜灰狼哥", "tags": ["漏洞"], "text": "近日IP.Board爆出重要0day漏洞。IPB论坛全称为Invision Power Board（缩写为IPB或IP.Board），是世界上最著名的论坛程序之一，由PHP+MySQL架构。"}
{"title": "自动化渗透测试工具 - Heybe", "url": "https://www.freebuf.com/sectool/50734.html", "time": "2014-11-11", "level": "金币+5", "num_look": 582972, "num_comment": 19, "author": "嘎巴嘎巴", "tags": ["工具"], "text": "在今年的BlackHat大会上发布了名为Heybe的工具，Heybe是一款包含多个模块的自动渗透测试工具，据称，Heybe可以在几分钟内完成对目标公司所有系统的测试。"}
{"title": "Linux入侵取证：从一次应急事件讲起", "url": "https://www.freebuf.com/articles/system/50728.html", "time": "2014-11-11", "level": "金币+5", "num_look": 856892, "num_comment": 43, "author": "andyhao567", "tags": ["系统安全", "网络安全"], "text": "最近接手了一起应急事件，事件的起因是这样，某IP地址在短时间内攻击国家CN顶级域名(203.119.x.1)近8万次。于是便作为一员接手了此次事件。"}
{"title": "SSLStrip 终极版：Location 瞒天过海", "url": "https://www.freebuf.com/articles/web/50771.html", "time": "2014-11-11", "level": "", "num_look": 384703, "num_comment": 8, "author": "ＥtherＤream", "tags": ["WEB安全", "网络安全"], "text": "之前介绍了 HTTPS 前端劫持 的方案，虽然很有趣，然而现实却并不理想。其唯一、也是最大的缺陷，就是无法阻止脚本跳转。若是没有这个缺陷，那就非常完美了 —— 当然也就没有必要写这篇文章了。"}
{"title": "贝尔金路由器（Belkin router）存在ROOT访问权限漏洞", "url": "https://www.freebuf.com/news/50811.html", "time": "2014-11-11", "level": "", "num_look": 205316, "num_comment": 3, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "安全研究员Marco Vaz 在贝尔金n750型号的路由器中发现一个严重的漏洞，该漏洞可以使攻击者在受害者的设备上获得Root访问权限（也就是管理员权限）"}
{"title": "安全科普：让高大上的Bash破壳漏洞不再难理解（下）", "url": "https://www.freebuf.com/articles/system/50707.html", "time": "2014-11-10", "level": "金币+5", "num_look": 586553, "num_comment": 10, "author": "嘎巴嘎巴", "tags": ["系统安全"], "text": "本文首先从基础讲解一些Bash知识，并尝试理解“破壳”漏洞的一些细节，其次会手把手的带领读者搭建一个漏洞实验环境，并尝试利用这个漏洞进行测试。"}
{"title": "一周海外安全事件回顾（10.27-11.02）：要命的黑客攻击", "url": "https://www.freebuf.com/news/50757.html", "time": "2014-11-10", "level": "金币+5", "num_look": 299484, "num_comment": 8, "author": "blackscreen", "tags": ["头条", "资讯"], "text": "黑客的入侵是否可能威胁到人身安全，甚至导致大规模的人员伤亡呢？超过60%的人认为，在下一个十年你就可能看到这样的事件发生。"}
{"title": "一枚邪恶的输入法浅析", "url": "https://www.freebuf.com/articles/system/50579.html", "time": "2014-11-10", "level": "", "num_look": 270848, "num_comment": 22, "author": "360安全", "tags": ["系统安全"], "text": "近日，360安全中心接到用户的反馈，说自己的浏览器首页被改了，还莫名其妙的弹出好多广告来。经过我们的一番排查，最终捕获到了这样的一款弹广告的输入法……"}
{"title": "事件跟踪：关于iOS平台木马WireLurker的分析", "url": "https://www.freebuf.com/news/topnews/50622.html", "time": "2014-11-10", "level": "金币+5", "num_look": 391130, "num_comment": 7, "author": "Sphinx", "tags": ["头条", "系统安全"], "text": "最近出现了一款名为WireLurker的针对iPhone和Mac OSX平台的恶意软件。也许大家对这个事情已经并不陌生，但刨根问底总是必要的，现在让我们一起来看看细节吧。"}
{"title": "剑走偏锋：细数Shell那些事", "url": "https://www.freebuf.com/articles/system/50361.html", "time": "2014-11-10", "level": "金币+5", "num_look": 821999, "num_comment": 44, "author": "xia0k", "tags": ["系统安全", "网络安全"], "text": "说到Shell，我想大家恐怕都不会太陌生。今天与大家聊聊针对系统的Shell后门。"}
{"title": "深信服20-50W+期权招聘安全界人才", "url": "https://www.freebuf.com/jobs/50620.html", "time": "2014-11-09", "level": "红色标题", "num_look": 406284, "num_comment": 41, "author": "深信服安全", "tags": ["安全招聘"], "text": "深信服防火墙团队因为业务拓展迅速，需要招聘安全人才。薪资福利：25-50W+1W股股票期权+1W股股票期权+固定1年调薪2次+1100元/月补助+免息购房贷款等。"}
{"title": "苹果恶意软件WireLurker锁定Mac OS X和iOS设备", "url": "https://www.freebuf.com/news/50628.html", "time": "2014-11-09", "level": "", "num_look": 254895, "num_comment": 14, "author": "Sphinx", "tags": ["资讯"], "text": "11月5日，一款名为WireLurker的全新系列恶意软件突然出现，让人猝不及防。该恶意软件能够感染运行苹果移动iOS平台的设备以及台式机的Mac OS X操作系统。"}
{"title": "小心你的会员卡：黑客超低价出售希尔顿酒店集团会员卡和积分", "url": "https://www.freebuf.com/news/50535.html", "time": "2014-11-07", "level": "金币+6", "num_look": 548110, "num_comment": 15, "author": "cindy", "tags": ["资讯"], "text": "大多会员卡的持有者并不重视保护卡的安全性，也许是因为他们太有钱了，完全不需要这点小优惠吧。那么现在问题来了：既然各位富豪们那么不在意这点小钱，为什么不捐给FreeBuf呢？"}
{"title": "漏洞挖掘分析：QCMS V2.0命令执行与暴绝对路径漏洞", "url": "https://www.freebuf.com/vuls/50506.html", "time": "2014-11-07", "level": "金币+6", "num_look": 460634, "num_comment": 17, "author": "MXi4oyu", "tags": ["WEB安全", "漏洞"], "text": "QCMS是一款小型的网站管理系统。拥有多种结构类型，包括：ASP+ACCESS、ASP+SQL、PHP+MYSQL。今天叫兄弟们一起挖掘QCMS的漏洞，与大家分享挖洞的全过程。"}
{"title": "APP安全分析之打车软件", "url": "https://www.freebuf.com/articles/terminal/50442.html", "time": "2014-11-07", "level": "", "num_look": 242953, "num_comment": 7, "author": "爱加密", "tags": ["终端安全"], "text": "最近发现某款打车软件的APK非常的火，并听说他们进行了非常严密的防护，防止用户进行二次打包。今天我们来分析一下他的安全性到底如何。"}
{"title": "FreeBuf单身节派对：1111来了，你还是一个人吗？", "url": "https://www.freebuf.com/fevents/50274.html", "time": "2014-11-07", "level": "红色标题", "num_look": 401189, "num_comment": 60, "author": "FB客服", "tags": ["活动"], "text": "习惯了一个人写C，习惯了一个人搞站，习惯了一个人修Bug，一个人想那个ta……2014单身节，FreeBuf陪你一起度过！"}
{"title": "谷歌出品：网络流量安全测试工具Nogotofail", "url": "https://www.freebuf.com/sectool/50324.html", "time": "2014-11-07", "level": "", "num_look": 285792, "num_comment": 9, "author": "cindy", "tags": ["工具"], "text": "从严重的HeartBleed漏洞到苹果的gotofail 漏洞，再到最近的SSL v3 POODLE漏洞……我们已经见识到了网络流量漏洞所带来的巨大灾难。于是“谷人希”来了！谷歌公司最新开发了一款工具——Nogotofail，它可以帮助开发者检测…"}
{"title": "玩坏漏洞：让CVE-2014-4113成功溢出Win8", "url": "https://www.freebuf.com/articles/system/50110.html", "time": "2014-11-07", "level": "金币+6", "num_look": 349331, "num_comment": 10, "author": "Nirvana", "tags": ["系统安全"], "text": "在2014年10月14日的时候，Crowdstrike和FireEye发表了一篇文章，描述了一个新的针对Windows的提权漏洞。Crowdstrike的文章表明：这一新漏洞是在追踪一个高度先进攻击团队飓风熊猫（HURRICANE PANDA）发现的，在这之…"}
{"title": "《如何在发微博（Twitter）时不把自己位置泄露给NSA》：ISIS发布防NSA监视指导手册", "url": "https://www.freebuf.com/news/50263.html", "time": "2014-11-06", "level": "", "num_look": 166453, "num_comment": 8, "author": "Sphinx", "tags": ["资讯"], "text": "ISIS即伊斯兰国，是一个自称建国的活跃在伊拉克和叙利亚的极端恐怖组织。不同于以往的恐怖组织，ISIS十分热衷使用互联网，甚至有自己的Twitter，Facebook等社交媒体。"}
{"title": "提漏洞，拿现金奖励：深信服官方漏洞报告平台长期入驻漏洞盒子", "url": "https://www.freebuf.com/fevents/50289.html", "time": "2014-11-06", "level": "红色标题", "num_look": 276423, "num_comment": 18, "author": "漏洞盒子", "tags": ["活动"], "text": "深信服科技授权和欢迎FreeBuf及漏洞盒子平台上的白帽子对深信服全线产品进行安全测试，白帽子提交漏洞将获得丰厚的现金奖励。"}
{"title": "英国安全研究人员发现VISA无线支付漏洞", "url": "https://www.freebuf.com/news/50226.html", "time": "2014-11-06", "level": "", "num_look": 232103, "num_comment": 7, "author": "嘎巴嘎巴", "tags": ["资讯"], "text": "最近，英国Newcastle大学的安全研究员在VISA的非接触式付款卡中发现了一个安全漏洞，利用该漏洞攻击者只需使用手机就可以从别人的钱包里偷取大量现金。"}
{"title": "论如何优雅地蹭饭：克隆篡改公司饭卡（M1卡）", "url": "https://www.freebuf.com/articles/wireless/50123.html", "time": "2014-11-06", "level": "金币+6", "num_look": 2122266, "num_comment": 54, "author": "conqu3r", "tags": ["无线安全", "极客"], "text": "​最近借了proxmark3来娱乐性的玩下RFID技术，工资甚低的我只好拿公司饭卡实验，优雅地蹭几顿。物业大叔表打我啊！"}
{"title": "Rootpipe：可获取苹果Mac OS X Yosemite系统最高权限的严重漏洞", "url": "https://www.freebuf.com/vuls/50168.html", "time": "2014-11-06", "level": "", "num_look": 238816, "num_comment": 13, "author": "cindy", "tags": ["漏洞"], "text": "​瑞典安全研究人员近日发现了苹果OS X Yosemite 系统中的致命漏洞。该漏洞可以使黑客在目标计算机上提升权限，使之能够获得系统的最高访问权限，也就是我们通常所说的Root权限。"}
{"title": "关于聚合数据窃取用户通讯录的完整分析", "url": "https://www.freebuf.com/articles/terminal/50028.html", "time": "2014-11-05", "level": "", "num_look": 410138, "num_comment": 5, "author": "sha2147483647", "tags": ["终端安全"], "text": "之前在测试聚合数据的 iOS SDK Demo 的时候，发现会请求通讯录权限。然后我就在 Charles 里发现了一个很大的请求，通过逆向工程，发现我的整个通讯录都被上传了。"}
{"title": "荷兰记者口述：危机四伏的公共WiFi", "url": "https://www.freebuf.com/news/topnews/50111.html", "time": "2014-11-05", "level": "红色标题", "num_look": 494998, "num_comment": 31, "author": "cindy", "tags": ["头条", "无线安全"], "text": "黑客Wouter走进一家咖啡馆，优雅的点了杯卡布奇诺。20分钟之后。他已经知道咖啡馆里每个人的出生地、来自哪所学校以及他们在搜索引擎上最近浏览的内容……"}
{"title": "45分钟扫遍全网：最快的互联网扫描工具ZMap 1.2.1版使用手册", "url": "https://www.freebuf.com/sectool/50095.html", "time": "2014-11-05", "level": "红色标题", "num_look": 1077677, "num_comment": 41, "author": "phper", "tags": ["工具"], "text": "ZMap是一个开源网络扫描工具，可以帮助研究人员快速的进行全网检测。只需要一台机器和足够上行网络速度，就可以以达到千兆以太网的理论值速度并在45分钟内扫描全网络IPv4地址。"}
{"title": "安全科普：让高大上的Bash破壳漏洞不再难理解（上）", "url": "https://www.freebuf.com/articles/system/50065.html", "time": "2014-11-05", "level": "金币+6", "num_look": 660186, "num_comment": 10, "author": "嘎巴嘎巴", "tags": ["系统安全"], "text": "本文首先从基础讲解一些Bash知识，并尝试理解“破壳”漏洞的一些细节，其次会手把手的带领读者搭建一个漏洞实验环境，并尝试利用这个漏洞进行测试。"}
{"title": "计算机断网就安全了？空中旅行者（AirHopper）可实现无线电信号窃听", "url": "https://www.freebuf.com/news/49983.html", "time": "2014-11-04", "level": "金币+20", "num_look": 457506, "num_comment": 20, "author": "cindy", "tags": ["极客", "资讯"], "text": "为了保护诸如金融类的敏感信息，许多公司和政府机构都使用了绝对安全的计算机系统，这里所说的绝对安全其实就是让计算机系统隔绝网络。然而，让计算机断网就能做到真正安全吗？"}
{"title": "手机解锁用密码而不是Touch ID，纵容了杀妻嫌疑犯", "url": "https://www.freebuf.com/news/49942.html", "time": "2014-11-04", "level": "", "num_look": 209655, "num_comment": 28, "author": "dawner", "tags": ["资讯"], "text": "当小伙伴们对苹果Touch ID及类似手机指纹解锁功能爱不释手时，近日美国却出现了一个奇葩案件。"}
{"title": "FreeBuf公开课中文译制投票 - Black Hat篇", "url": "https://www.freebuf.com/fevents/49975.html", "time": "2014-11-04", "level": "红色标题", "num_look": 266641, "num_comment": 18, "author": "FB视频", "tags": ["活动"], "text": "BlackHat安全技术大会是全球最为知名的黑客峰会。BlackHat 2014虽已闭幕许久，但仍有不少国内朋友未能有机会领略此次盛会。FreeBuf决定发起投票，对大家感兴趣的内容，FreeBuf将译制发布中文视频！"}
{"title": "如何使用Wappalyzer API进行Web应用指纹识别", "url": "https://www.freebuf.com/sectool/49877.html", "time": "2014-11-04", "level": "金币+20", "num_look": 529701, "num_comment": 15, "author": "碳基体", "tags": ["WEB安全", "工具"], "text": "Web应用指纹识别，是web渗透信息收集最关键的一步，这方面开源的工具也非常多，像BlindElephant，whatweb 以及在非安全圈都很火的wappalyzer。本文主要描述如何使用wappalyzer的perl与php接口进行指纹识别。"}
{"title": "FreeBuf公开课：XML实体攻击 - 从内网探测到命令执行步步惊心（ISC2014 张天琪）", "url": "https://www.freebuf.com/video/49961.html", "time": "2014-11-04", "level": "红色标题", "num_look": 1003951, "num_comment": 19, "author": "FB视频", "tags": ["视频"], "text": "课程详细讲解了拒绝服务、枚举目录、文件读取、内网探测、端口扫描、文件上传、命令执行等XML实体漏洞花式利用的几种方法，演讲者FreeBuf张天琪。"}
{"title": "流行安全聊天APP TextSecure存在“未知密钥共享攻击”漏洞", "url": "https://www.freebuf.com/news/49894.html", "time": "2014-11-04", "level": "金币+20", "num_look": 261171, "num_comment": 9, "author": "Sphinx", "tags": ["漏洞", "资讯"], "text": "TextSecure是Android平台下的一款加密聊天APP，这款免费APP设计目的是为了保证通信隐私。这款APP由Open WhisperSystems开发，代码完全开源，支持端到端短信加密。看起来很安全是不？"}
{"title": "旧瓶装新酒：Google Drive是如何被用于钓鱼攻击的", "url": "https://www.freebuf.com/news/49884.html", "time": "2014-11-03", "level": "", "num_look": 189192, "num_comment": 6, "author": "cindy", "tags": ["WEB安全", "资讯"], "text": "黑客们的目标正在逐渐瞄准那些云存储服务，比如谷歌云端存储（Google Drive）。几天前，趋势科技的安全研究人员就发现了一个盗取用户敏感账户信息的钓鱼攻击活动。"}
{"title": "海盗湾（TPB）联合创始人参与丹麦最大黑客事件", "url": "https://www.freebuf.com/news/49839.html", "time": "2014-11-03", "level": "", "num_look": 144763, "num_comment": 4, "author": "cindy", "tags": ["资讯"], "text": "通过入侵CSC维护的服务器，Svartholm Warg非法进入了公安部的邮箱账户并盗取了超过10000名警察的邮箱地址和密码，还查看了欧洲边境控制的数据库并下载了其中数百万丹麦公民的社会保障号码。"}
{"title": "资料汇总：Wget FTP软链接攻击漏洞（CVE-2014-4877）描述及各安全厂商评析", "url": "https://www.freebuf.com/vuls/49641.html", "time": "2014-11-03", "level": "金币+20", "num_look": 531111, "num_comment": 14, "author": "dawner", "tags": ["漏洞", "系统安全"], "text": "Wget是一款从用于从网络上下载文件的开源工具，使用非常广泛。然而现在，它却出现了一个严重的安全漏洞：当Wget向FTP服务器请求递归目录时，存在一个关于软链接的漏洞，它将允许黑客任意创建文件、目录或软链接。"}
{"title": "背黑锅我来：Facebook为雅虎账户开发额外安全保护", "url": "https://www.freebuf.com/news/48755.html", "time": "2014-11-02", "level": "", "num_look": 197996, "num_comment": 4, "author": "dawner", "tags": ["WEB安全", "资讯"], "text": "在那些使用雅虎邮箱绑定的第三方网站中，Facebook第一个站出来表示：像雅虎这种做法我们需要做出额外的安保措施。"}
{"title": "华硕RT系列无线路由器存在漏洞，可能遭受中间人攻击", "url": "https://www.freebuf.com/news/49696.html", "time": "2014-11-01", "level": "", "num_look": 255539, "num_comment": 5, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "美国安全研究人员发现，华硕RT无线路由器的下载和更新服务是通过未加密的HTTP协议进行的，进而可能会遭到中间人攻击。"}
{"title": "FreeBuf公开课：数据分析、关键词和地下产业（ISC2014 董方）", "url": "https://www.freebuf.com/video/49717.html", "time": "2014-11-01", "level": "", "num_look": 143454, "num_comment": 5, "author": "FB视频", "tags": ["视频"], "text": "本视频为ISC 2014 OWASP分论坛《数据分析、关键词和地下产业》演讲内容，演讲者董方。"}
{"title": "警惕最新的Smoke Loader和Andromeda变种botnet", "url": "https://www.freebuf.com/news/49417.html", "time": "2014-11-01", "level": "", "num_look": 223088, "num_comment": 6, "author": "翰海源安全", "tags": ["系统安全", "资讯"], "text": "Botnet从2014年8月末开始活动，一直持续到2014年10月底，截至目前该Botnet仍然存活。同时我们也在金融、IT、政府、银行等行业发现了攻击样本，我们提醒客户请警惕最新的Smoke Loader和Andromeda变种botnet。"}
{"title": "Nginx下多站点正确限制目录php执行权限", "url": "https://www.freebuf.com/articles/system/49428.html", "time": "2014-10-31", "level": "金币+20", "num_look": 631862, "num_comment": 19, "author": "铁汉", "tags": ["系统安全"], "text": "朋友的服务器配置着实把我吓坏了，我说：“你平时都是这么干的吗？”\r\n朋友：“对啊！把x执行权限取消了，你放什么木马进来，都没办法执行啊！\""}
{"title": "密码分析工具 - Pipal", "url": "https://www.freebuf.com/sectool/49592.html", "time": "2014-10-31", "level": "红色标题", "num_look": 728922, "num_comment": 32, "author": "xia0k", "tags": ["工具"], "text": "在很多情况下，我们需要进行各种各样的分析工作，这里为大家介绍一款密码分析工具——Pipal。"}
{"title": "印度网络威胁概览", "url": "https://www.freebuf.com/articles/network/49464.html", "time": "2014-10-31", "level": "", "num_look": 488216, "num_comment": 2, "author": "IDF_Lab", "tags": ["网络安全"], "text": "印度的IT安全挑战主要集中在来自斯里兰卡、巴基斯坦、马来西亚、印度尼西亚、泰国、中国和俄罗斯等地组织缜密的跨国团伙进行的信用卡和银行卡欺诈方面。"}
{"title": "捆绑安装浏览器：技术剖析搜狗输入法中的猫腻", "url": "https://www.freebuf.com/sectool/49546.html", "time": "2014-10-31", "level": "金币+10", "num_look": 1169162, "num_comment": 64, "author": "洛阳亲友", "tags": ["工具"], "text": "不知道从什么时候开始，上网变成了搜狗浏览器。卸载后，过几天又莫名其妙安装上。搜狗也算是名门正派，竟然会用这么恶劣的手段捆绑软件！这么做跟病毒有什么区别？！"}
{"title": "一周海外安全事件回顾（10.20-10.26）：IoT攻击的崛起", "url": "https://www.freebuf.com/news/49470.html", "time": "2014-10-31", "level": "", "num_look": 215289, "num_comment": 12, "author": "Blackscreen", "tags": ["安全报告", "资讯"], "text": "在Akamai最新的互联网状态报告中，黑客利用物联网（IoT）设备发起攻击成为安全威胁发展的一个重要趋势。"}
{"title": "神秘文件夹Baidu：索尼Xperia手机秘密上传用户数据", "url": "https://www.freebuf.com/news/49465.html", "time": "2014-10-30", "level": "金币+10", "num_look": 552311, "num_comment": 32, "author": "嘎巴嘎巴", "tags": ["资讯"], "text": "如果你有台索尼智能手机，安装了Android 4.4.2或4.4.4的固件，那么在不经意间，你的数据就可能会被上传，即使您没有安装任何应用程序。这相当惊人，但却是真的。作为一家日本企业，这样的行为很难让人理解。"}
{"title": "无需木马感染即可监听键盘：新型恶意软件ScanBox问世", "url": "https://www.freebuf.com/news/49421.html", "time": "2014-10-30", "level": "", "num_look": 362386, "num_comment": 28, "author": "dawner", "tags": ["工具", "资讯"], "text": "通过木马感染才能窃取目标机密的时代一去不复返了。八月问世的键盘记录器ScanBox也许开启了“窃听工具”的新纪元，攻击者将ScanBox恶意Javascript代码植入存在漏洞的网站上，就可以将用户的键盘记录全部截获下来。"}
{"title": "对手机远程控制软件穿透硬件防火墙的分析和研究", "url": "https://www.freebuf.com/articles/network/49271.html", "time": "2014-10-30", "level": "", "num_look": 387212, "num_comment": 15, "author": "南拳daddy", "tags": ["网络安全"], "text": "今天讨论的手机远程控制主要指的是Android类手机远控，采用TCP 反弹连接的方式上线。"}
{"title": "APT28：专攻军事机构和情报部门的俄罗斯黑客组织", "url": "https://www.freebuf.com/news/49401.html", "time": "2014-10-30", "level": "", "num_look": 245590, "num_comment": 5, "author": "嘎巴嘎巴", "tags": ["头条", "资讯"], "text": "FireEye今天发布了一份全面的报告，报告详细描述了一个可能由俄罗斯政府支持的高级持续性威胁（APT）组织。"}
{"title": "漏洞预警：FTP曝严重远程执行漏洞，影响多个版本Unix（附检测脚本）", "url": "https://www.freebuf.com/news/49411.html", "time": "2014-10-30", "level": "金币+10", "num_look": 822530, "num_comment": 43, "author": "嘎巴嘎巴", "tags": ["漏洞", "系统安全"], "text": "10月28日，一份公开的邮件中曝出FTP远程执行命令漏洞，漏洞影响到的Unix系统包括：Fedora, Debian, NetBSD, FreeBSD, OpenBSD, 甚至影响到了苹果的OS X操作系统的最新版本Yosemite 10.10。"}
{"title": "美国电信Verizon被曝追踪移动用户的日常活动", "url": "https://www.freebuf.com/news/49357.html", "time": "2014-10-30", "level": "", "num_look": 126354, "num_comment": 6, "author": "cindy", "tags": ["资讯"], "text": "美国最大的电信机构——威瑞森无线（Verizon），通过在Web请求上添加标记追踪移动客户的网络流量，更可怕的是这一追踪还无法终止。"}
{"title": "Twitter的野心：我们终将弃用密码", "url": "https://www.freebuf.com/news/49056.html", "time": "2014-10-29", "level": "金币+10", "num_look": 366569, "num_comment": 30, "author": "凌晨几度i", "tags": ["资讯"], "text": "国外最流行的微博平台Twitter正在策划一项很大胆的项目：试图率先在Twitter上结束我们所习惯的密码时代。"}
{"title": "Bash破壳漏洞（ShellShock）再变身：针对邮件服务器SMTP攻击", "url": "https://www.freebuf.com/news/49292.html", "time": "2014-10-29", "level": "金币+10", "num_look": 424804, "num_comment": 5, "author": "凌晨几度i", "tags": ["漏洞", "资讯"], "text": "破壳漏洞新的利用方法又来了！根据互联网风暴中心最新消息：破壳漏洞最新利用方法引发的新一轮攻击正在酝酿中，这一次，破壳漏洞形成的僵尸网络利用的是邮件服务器SMTP主机，目标SMTP网关！"}
{"title": "比特币中国（BTCChina）长期入驻漏洞盒子", "url": "https://www.freebuf.com/fevents/49139.html", "time": "2014-10-29", "level": "", "num_look": 244921, "num_comment": 13, "author": "漏洞盒子", "tags": ["活动"], "text": "比特币中国授权和欢迎漏洞盒子平台上的白帽子进行安全测试，白帽子提交安全漏洞，将获得丰厚的现金奖励，11月更有额外奖励！"}
{"title": "如何为Wordpress做安全防护？", "url": "https://www.freebuf.com/articles/web/49210.html", "time": "2014-10-29", "level": "金币+10", "num_look": 504017, "num_comment": 18, "author": "碳基体", "tags": ["WEB安全"], "text": "Wordpress是国人搭建个人博客的首选，其地位等同于论坛搭建首选discuz。最近我决定给裸奔的Wordpress做做安全加固。"}
{"title": "Android恶意木马编年史", "url": "https://www.freebuf.com/articles/terminal/49137.html", "time": "2014-10-29", "level": "", "num_look": 240634, "num_comment": 10, "author": "AVLTeam", "tags": ["终端安全"], "text": "统计2011年至今的移动恶意代码病毒库，可以看到Android平台下的恶意软件数量增长可谓极其迅速，年份间的数量差距几近鸿沟。"}
{"title": "网络安全联盟：威胁组织Axiom来自中国？", "url": "https://www.freebuf.com/news/49200.html", "time": "2014-10-29", "level": "", "num_look": 166427, "num_comment": 4, "author": "xia0k", "tags": ["资讯"], "text": "美国安全公司Novetta Solutions发布了一份报告，该报告详细描述了一个名为Axiom的攻击组织，Novetta认为该组织成员带有中国情报机构的特征。"}
{"title": "callback噩梦：解析著名CMS框架Drupal SQL注入漏洞", "url": "https://www.freebuf.com/vuls/49148.html", "time": "2014-10-29", "level": "金币+10", "num_look": 409582, "num_comment": 12, "author": "嘎巴嘎巴", "tags": ["WEB安全", "漏洞"], "text": "前几天爆了一个 Drupal 的 SQL Injection 注入漏洞，但是这个漏洞不止与 SQL 注入这么简单，还可以利用其来 RCE（远程代码执行）。知名安全研究人员StefanEsser 在 Twitter 上也有提及，可是没有透露细节。"}
{"title": "破壳漏洞（CVE-2014-6271）综合分析：“破壳”漏洞系列分析之三", "url": "https://www.freebuf.com/articles/system/48406.html", "time": "2014-10-29", "level": "", "num_look": 259553, "num_comment": 7, "author": "安天实验室", "tags": ["系统安全"], "text": "安天CERT于 9月25日凌晨开始响应“破壳”漏洞，先后在9月25日发布了《“破壳”漏洞（CVE-2014-6271）综合分析》，在9月30日发布了《“破壳”漏洞相关恶意代码样本分析报告 ——“破壳”漏洞系列分析之二》，并均更新了多个版…"}
{"title": "FreeBuf招聘开发工程师、安全研究员", "url": "https://www.freebuf.com/jobs/49232.html", "time": "2014-10-28", "level": "红色标题", "num_look": 323102, "num_comment": 28, "author": "FB客服", "tags": ["安全招聘"], "text": "我们诚邀以下职能的FreeBuf人，施展你的才华，与我们一起并肩作战。"}
{"title": "Cisco Linksys无线路由固件安全分析与后门研究", "url": "https://www.freebuf.com/articles/terminal/48176.html", "time": "2014-10-28", "level": "", "num_look": 367896, "num_comment": 4, "author": "嘎巴嘎巴", "tags": ["极客", "终端安全"], "text": "最近我对嵌入式设备安全方面比较感兴趣，所以我决定找点东西练练手，于是我在淘宝上搜了一下，发现Linksys WRT54Gv5无线路由比较流行，决定就拿这个下手了。"}
{"title": "三星“找回手机（Find My Mobile）”功能存在0Day漏洞", "url": "https://www.freebuf.com/news/49157.html", "time": "2014-10-28", "level": "", "num_look": 290548, "num_comment": 6, "author": "cindy", "tags": ["资讯"], "text": "美国国家标准与技术研究院（NIST）向广大用户发出了警告：三星手机“找回手机（Find my mobile）”功能存在0Day漏洞。"}
{"title": "1亿份云文件告诉你，云里“秘密”多", "url": "https://www.freebuf.com/news/48782.html", "time": "2014-10-28", "level": "", "num_look": 273277, "num_comment": 12, "author": "凌晨几度i", "tags": ["数据安全", "资讯"], "text": "最近国外一家叫Elastica的机构对超过1亿份被分享和被存储在公共云应用上的海量云文件进行安全分析，得出了一些研究结果，让我们一起来仔细思量。"}
{"title": "用短信传播病毒：最新Android手机勒索软件Koler", "url": "https://www.freebuf.com/news/48928.html", "time": "2014-10-28", "level": "", "num_look": 329378, "num_comment": 16, "author": "cindy", "tags": ["终端安全", "资讯"], "text": "安卓用户又要神经紧绷了，因为又一个新的安卓恶意软件出现了，它叫Koler。Koler通过短信的方式进行传播病毒，并且在用户支付赎金之前，它会一直控制着受感染的手机。"}
{"title": "FB在线交流会：聚焦社会工程学（Social Engineering）", "url": "https://www.freebuf.com/fevents/48857.html", "time": "2014-10-27", "level": "金币+6", "num_look": 650899, "num_comment": 85, "author": "凌晨几度i", "tags": ["活动"], "text": "本期FreeBuf交流会将召集大家一起探讨“社会工程学”这个问题，洞察社会工程师是如何处理和利用人性的安全漏洞，并分享出最佳防护的实践方案。"}
{"title": "针对VBS远控木马的技术分析", "url": "https://www.freebuf.com/articles/web/48706.html", "time": "2014-10-27", "level": "", "num_look": 485469, "num_comment": 17, "author": "360安全", "tags": ["WEB安全", "网络安全"], "text": "我们团队最近捕获到一个vbs后门脚本，发现比较有意思，根据以往遇到的脚本，绝大多数都是蠕虫、下载者，极少遇到本身就是后门或是远程控制类木马。"}
{"title": "走近微软安全技术Shim", "url": "https://www.freebuf.com/news/48878.html", "time": "2014-10-27", "level": "", "num_look": 404732, "num_comment": 5, "author": "Rabbit_Run", "tags": ["系统安全", "资讯"], "text": "上周微软紧急推出针对“微软Office Powerpoint 0day漏洞（CVE-2014-6352）”​的Fix It，其中就采用了Shim技术，用于修复存在安全缺陷的函数。"}
{"title": "Anonymous狂热粉？印度国家海关税务研究院官网遭黑", "url": "https://www.freebuf.com/news/48845.html", "time": "2014-10-27", "level": "", "num_look": 176542, "num_comment": 16, "author": "dawner", "tags": ["资讯"], "text": "某位自称是Anonymous（某黑客组织）粉丝的人，以‘H34r75 7h!3f’为代号，黑掉并涂鸦了印度国家海关税务研究院官网。"}
{"title": "NAT-PMP协议漏洞将1200万路由器置于风险之中", "url": "https://www.freebuf.com/news/48748.html", "time": "2014-10-27", "level": "金币+6", "num_look": 430763, "num_comment": 11, "author": "dawner", "tags": ["资讯"], "text": "存在于嵌入式设备中的漏洞，特别是那种小型办公室和家庭办公的路由，从来都是源源不断的。本周安全研究人员发现了一个严重漏洞，因NAT-PMP协议设计不当将影响超过1200万的路由器设备。"}
{"title": "避免互联网监控：电子前哨基金会（EFF）推出“监控自卫”项目", "url": "https://www.freebuf.com/news/48793.html", "time": "2014-10-26", "level": "", "num_look": 207815, "num_comment": 12, "author": "凌晨几度i", "tags": ["资讯"], "text": "电子前哨基金会(EFF：Electronic Frontier Foundation)近日推出了更新版的“监控自卫”安全指导报告，全面指导你如何保护自己免受来自世界各地的互联网可疑用户的电子监控。"}
{"title": "绿盟科技：2014 上半年反数据泄露报告", "url": "https://www.freebuf.com/articles/others-articles/48597.html", "time": "2014-10-26", "level": "", "num_look": 275803, "num_comment": 10, "author": "绿盟科技", "tags": ["其他", "安全报告"], "text": "2014年上半年数据泄露达485次，在全球范围内相继曝出eBay、Michaels Stores等重大数据泄露事件。5月21日全球最大拍卖网站eBay官网发布通告，称因数据泄露呼吁其用户更新密码。eBay事件只是一个缩影，它反映了当前数…"}
{"title": "VisualThreat移动安全公司招聘安全研究员", "url": "https://www.freebuf.com/jobs/48721.html", "time": "2014-10-25", "level": "", "num_look": 176613, "num_comment": 8, "author": "tofreebug", "tags": ["安全招聘"], "text": "最近汽车安全研究喜报不断，智能汽车安全的重要性也慢慢为大家所接受。乘此时机，借FreeBuf宝地，登一则招聘启事。"}
{"title": "FreeBuf Live：GeekPwn（极客嘉年华）直播专区", "url": "https://www.freebuf.com/fevents/48562.html", "time": "2014-10-24", "level": "红色标题", "num_look": 764272, "num_comment": 54, "author": "FB独家", "tags": ["活动"], "text": "今明两天，FreeBuf将首次采用网络视频直播的方式，为你带来GeekPwn极客嘉年华盛宴。赶紧戳我看直播！"}
{"title": "沙虫（CVE-2014-4114）新变种惊现针对台湾的APT攻击事件中", "url": "https://www.freebuf.com/vuls/48601.html", "time": "2014-10-24", "level": "金币+6", "num_look": 395542, "num_comment": 18, "author": "Rabbit_Run", "tags": ["安全报告", "漏洞"], "text": "Xecure lab在10月17号发现变种的0day漏洞 沙虫（CVE-2014-4114 ）已经被用在针对台湾政府以及各单位的APT攻击中，目前主流的杀毒软件还没办法有效地检测。"}
{"title": "最新Mac OS X Yosemite：偷偷发送用户定位和浏览器搜索数据？", "url": "https://www.freebuf.com/news/48594.html", "time": "2014-10-24", "level": "金币+6", "num_look": 233185, "num_comment": 54, "author": "dawner", "tags": ["资讯"], "text": "苹果最新的桌面操作系统名为Mac OS X 10.10 Yosemite，会在用户使用桌面搜索工具Spotlight时，默认在其不知晓的情况下发送用户搜索记录和定位数据到苹果升级服务器上，再次侵犯了用户的隐私。"}
{"title": "破壳漏洞（CVE-2014-6271）综合分析：“破壳”漏洞系列分析之二", "url": "https://www.freebuf.com/articles/system/48357.html", "time": "2014-10-24", "level": "", "num_look": 266135, "num_comment": 1, "author": "安天实验室", "tags": ["安全报告", "系统安全"], "text": "我们团队于9月25日10时发布了《“破壳”漏洞(CVE-2014-6271)综合分析》，并更新了多个版本。在这个过程中，我们的监测采集和样本交换体系发现了大量利用该漏洞的扫描攻击、后门投放等行为，并发现了多个与此漏洞相关…"}
{"title": "乐蜂网招聘信息安全经理", "url": "https://www.freebuf.com/jobs/48514.html", "time": "2014-10-23", "level": "", "num_look": 151848, "num_comment": 15, "author": "ray422", "tags": ["安全招聘"], "text": "乐蜂成立于2008年，由知名电视人李静创办，是一家明星达人运营、静佳自有品牌及美妆垂直电商为一体的平台。现招聘信息安全经理。"}
{"title": "微软Office Powerpoint遭遇0day漏洞攻击", "url": "https://www.freebuf.com/news/48500.html", "time": "2014-10-23", "level": "", "num_look": 260738, "num_comment": 10, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "黑客们对0day漏洞的攻击利用似乎永无止境。微软公司之前已经修复了Windows上三个0day漏洞，而现在又发现了一个新的PPT 0day漏洞（编号CVE-2014-6352）。据了解这个漏洞影响所有版本的Windows操作系统。"}
{"title": "SSL Strip的未来：HTTPS 前端劫持", "url": "https://www.freebuf.com/articles/web/47076.html", "time": "2014-10-23", "level": "金币+17", "num_look": 693081, "num_comment": 14, "author": "ＥtherＤream", "tags": ["WEB安全", "网络安全"], "text": "在之前介绍的流量劫持文章里，曾提到一种『HTTPS 向下降级』的方案 —— 将页面中的 HTTPS 超链接全都替换成 HTTP 版本，让用户始终以明文的形式进行通信。今天要讲的是一种更有效、更先进的解决方案 —— HTTPS 前端劫…"}
{"title": "在线视频直播！FreeBuf联手GeekPwn（极棒）带来极客盛宴", "url": "https://www.freebuf.com/news/43499.html", "time": "2014-10-23", "level": "红色标题", "num_look": 639214, "num_comment": 151, "author": "FB独家", "tags": ["活动", "资讯"], "text": "FreeBuf正式联手GeekPwn（极棒）极客嘉年华，10月24 - 25日，FreeBuf将首次采用全程网络视频直播的方式，为你带来这场独具匠心的极客盛宴！#据说文章内GeekPwn门票、手指鼠标、主题杯…等你来拿#"}
{"title": "McAfee研究人员发现沙虫（CVE-2014-4114）的官方补丁可被绕过", "url": "https://www.freebuf.com/news/48305.html", "time": "2014-10-23", "level": "金币+17", "num_look": 233011, "num_comment": 15, "author": "Rabbit_Run", "tags": ["漏洞", "资讯"], "text": "我们发现微软的官方补丁(MS14-060, KB3000869)不够完善。换句话说，即使系统已经打了补丁，攻击者仍可以利用该漏洞，已打补丁的用户仍身处危险之中。"}
{"title": "BackBox Linux 4.0 初体验使用小记", "url": "https://www.freebuf.com/sectool/48219.html", "time": "2014-10-23", "level": "金币+17", "num_look": 562977, "num_comment": 29, "author": "帅气凌云", "tags": ["工具"], "text": "BackBox是基于Ubuntu的Linux发行版，它是一款用于网络渗透测试及安全评估的操作系统。BackBox最近发布了4.0版本，本文就将与大家分享BackBox Linux 4.0的使用初体验。"}
{"title": "WiFi分析和安全检测工具：WiFi software Acrylic WiFi Free v2.1", "url": "https://www.freebuf.com/sectool/48410.html", "time": "2014-10-23", "level": "", "num_look": 1001997, "num_comment": 13, "author": "phper", "tags": ["工具"], "text": "Acrylic WiFi 专业版号称是WiFi分析领域最强大的软件，可以识别接入点和WiFi信道，并且可以实时分析802.11a/b/g/n/ac 无线网络。这个软件可以帮助网络管理人员监控无线网络状况，分析数据传输速度，改善公司的WiFi…"}
{"title": "SSL中间人攻击频发，苹果紧急发布iCloud安全更新", "url": "https://www.freebuf.com/news/48390.html", "time": "2014-10-22", "level": "", "num_look": 139047, "num_comment": 1, "author": "cindy", "tags": ["资讯"], "text": "近期一直不断爆出的网络攻击主要是因为使用了一些不安全的证书造成的。对此苹果公司表示：我们应该对此保持高度的警惕，因为我们很难辨别哪些证书是安全的，哪些证书是不安全的。"}
{"title": "安全科普：密码学之碰撞攻击", "url": "https://www.freebuf.com/articles/network/48015.html", "time": "2014-10-22", "level": "", "num_look": 677561, "num_comment": 19, "author": "凌晨几度i", "tags": ["网络安全"], "text": "密码学贯穿于网络信息安全整个过程，在解决信息安全的机密性保护、可鉴别性、完整性保护盒信息抗抵赖等方面发挥着极其重要的作用，可以毫不夸张地说“对密码学或密码技术一无所知的人是不可能从技术层面上完全理解信…"}
{"title": "破壳漏洞（CVE-2014-6271）综合分析：“破壳”漏洞系列分析之一", "url": "https://www.freebuf.com/news/48331.html", "time": "2014-10-22", "level": "", "num_look": 673741, "num_comment": 4, "author": "安天实验室", "tags": ["漏洞", "系统安全"], "text": "根据信息检索，本漏洞发现者为法国GNU/LINUX研究者StéphaneChazelas，发现时间为2014年9月中旬，而披露时间为2014年9月24日。"}
{"title": "谷歌推出两步验证方法：Security Key", "url": "https://www.freebuf.com/news/48267.html", "time": "2014-10-22", "level": "", "num_look": 329732, "num_comment": 14, "author": "Rabbit_Run", "tags": ["观点", "资讯"], "text": "2014年10月22号，谷歌发布了Security Key，一种USB key形式的两步验证（two verification）的方法。如果用户选择该项服务，需要在登录之前插入USB key到自己的计算机上。它有望使谷歌账户更加安全，但需要用户能够…"}
{"title": "KCON v3议题视频（高清）", "url": "https://www.freebuf.com/video/48189.html", "time": "2014-10-22", "level": "金币+17", "num_look": 171347, "num_comment": 10, "author": "leopard7777777", "tags": ["视频"], "text": "「KCon V3 知道安全论坛第三期」力求在国内打造出一个干货高质量有趣又好玩的线下交流论坛，于2014年8月22日成功举行。现分享会议高清视频。"}
{"title": "Win64bit提权0day漏洞（CVE-2014-4113）只是内核模式漏洞的开始", "url": "https://www.freebuf.com/vuls/48239.html", "time": "2014-10-22", "level": "金币+17", "num_look": 394156, "num_comment": 16, "author": "xiaoya", "tags": ["漏洞", "系统安全"], "text": "本次漏洞的存在，绝非一年两年，根据多个样品比较，这个漏洞必定存在了最多五年，最短三年。而这期间都有某些黑客在利用这个漏洞。此次CVE-2014-4113的EXP，经过了至少三次的修改流传，直到当前披露的这一次。"}
{"title": "走近亚洲安全会议HITB", "url": "https://www.freebuf.com/news/48134.html", "time": "2014-10-22", "level": "", "num_look": 204719, "num_comment": 11, "author": "cindy", "tags": ["其他", "资讯"], "text": "HITB（Hack In theBox）安全会议从2003年创立到现在已有11年的历史。HITB多数情况下在亚洲举行，其中大部分是在马来西亚首都吉隆坡；从2010年开始，每年也会在欧洲的阿姆斯特丹举行一次。"}
{"title": "迅雷招聘安全测试攻城师", "url": "https://www.freebuf.com/jobs/48167.html", "time": "2014-10-22", "level": "", "num_look": 161825, "num_comment": 26, "author": "__U2__", "tags": ["安全招聘"], "text": "“全球互联网数据传输第一大港”、“拥有法拉利引擎的云下载服务”——尽管迅雷已经成为了“下载”的代名词，但是今天，作为中国最大的数字内容发行网络，迅雷正在加速丰富着中国网民的互联网应用。"}
{"title": "算不算漏洞？PayPal帐号锁定被绕过引发争议", "url": "https://www.freebuf.com/news/48005.html", "time": "2014-10-21", "level": "金币+3", "num_look": 177529, "num_comment": 11, "author": "嘎巴嘎巴", "tags": ["资讯"], "text": "PayPal公司表示不会为该漏洞支付报酬，因为PayPal认为这超出了他们的奖励范围。但Kunz Mejri坚持认为他应该有资格获得漏洞奖金。"}
{"title": "揭秘：西班牙制造的针对性攻击木马Machete", "url": "https://www.freebuf.com/news/topnews/48069.html", "time": "2014-10-21", "level": "金币+3", "num_look": 429343, "num_comment": 4, "author": "JohnChu", "tags": ["头条", "系统安全"], "text": "“Machete”在西班牙语中指“有针对性的攻击活动”。我们认为这次攻击始于2010年，并于2012年更新完善。而现在攻击仍然非常活跃。"}
{"title": "SSL中间人证书攻击测试演练", "url": "https://www.freebuf.com/sectool/48016.html", "time": "2014-10-21", "level": "金币+3", "num_look": 1704196, "num_comment": 39, "author": "xia0k", "tags": ["工具", "网络安全"], "text": "这几天，SSL证书欺骗可以说是占尽了风头，打开微博，朋友圈，FreeBuf处处可以见到SSL证书欺骗的资讯文章。这次主要是跟大家聊一聊关于SSL证书欺骗和实战演练那点事儿。"}
{"title": "合天智汇招聘网络安全工程师", "url": "https://www.freebuf.com/jobs/48082.html", "time": "2014-10-21", "level": "", "num_look": 162436, "num_comment": 13, "author": "合天智汇", "tags": ["安全招聘"], "text": "湖南合天智汇​信息技术有限公司成立于2013年，主要研究方向包括网络与信息安全、信息内容安全、网络攻防、网络测量、网络计算技术等，现面向全社会招聘网络安全工程师。"}
{"title": "阿里巴巴移动安全分析报告：97%的APP存在安全漏洞", "url": "https://www.freebuf.com/articles/terminal/47465.html", "time": "2014-10-21", "level": "", "num_look": 431633, "num_comment": 17, "author": "Jason_HZ", "tags": ["安全报告", "终端安全"], "text": "android app的安全问题不容乐观，漏洞的存在尤其是高危漏洞，会对app开发者甚至用户带来较大影响，如何提前发现潜在风险、保护开发者和用户的利益是阿里巴巴移动安全团队一直坚持的责任。"}
{"title": "Windows 平台下局域网劫持测试工具 - EvilFoca", "url": "https://www.freebuf.com/sectool/47863.html", "time": "2014-10-21", "level": "金币+3", "num_look": 1857987, "num_comment": 53, "author": "Xarray", "tags": ["工具"], "text": "EvilFoca是Windows环境下基于.NET FrameWork的一款轻量级的劫持测试工具。与BackTrack和Kali_Linux下复杂的命令相比，EvilFoca更加小巧，轻便，简单，但其效果更加显著高效。"}
{"title": "根本停不下来：Yahoo在中国遭遇SSL中间人攻击", "url": "https://www.freebuf.com/news/47979.html", "time": "2014-10-20", "level": "金币+3", "num_look": 515568, "num_comment": 2, "author": "Xarray", "tags": ["资讯"], "text": "2014年10月20日14:30分，雅虎在中国大陆地区再次受到SSL中间人攻击，国内三大运营商访问都存在问题，而香港、美国访问则没有问题。"}
{"title": "关于Android 5.0 Lollipop（棒棒糖）你必须知道的七件事", "url": "https://www.freebuf.com/news/47951.html", "time": "2014-10-20", "level": "", "num_look": 268367, "num_comment": 8, "author": "cindy", "tags": ["资讯"], "text": "继Android Kit-Kat之后，谷歌于周三发布了另一新系统的正式官方名称——Android Lollipop 5.0。"}
{"title": "无间道：NSA在多个国家布控卧底进行网络窃密", "url": "https://www.freebuf.com/news/47881.html", "time": "2014-10-20", "level": "", "num_look": 194685, "num_comment": 14, "author": "dawner", "tags": ["资讯"], "text": "据The Intercept发布的文档所述，该死的NSA（美国国安局）所作所为并不是通过在美国总部设的代理，而是通过其在中国、德国以及韩国的卧底代理，来渗透控制国外的网络设备。"}
{"title": "一周海外安全事件回顾（10.06-10.19）：互联网之王（Godof Internet）", "url": "https://www.freebuf.com/news/47895.html", "time": "2014-10-20", "level": "红色标题", "num_look": 248397, "num_comment": 3, "author": "blackscreen", "tags": ["头条", "资讯"], "text": "如果我们分明有能力使一个企业放弃（对金钱的）贪婪之心但什么也不做，那么这本身就是一种犯罪。"}
{"title": "即插即用设备：反射型DDoS攻击的下一个目标", "url": "https://www.freebuf.com/news/47841.html", "time": "2014-10-20", "level": "金币+3", "num_look": 165087, "num_comment": 7, "author": "dawner", "tags": ["资讯"], "text": "在反射放大DDoS攻击成功染指各种协议如DNS、NTP、SMTP后，黑客们开始流行使用简单服务发现协议（SSDP）-即UPnP（即插即用）协议标准的某部分。相关研究人员警告说，这类攻击猎取的目标是家庭和办公设备。"}
{"title": "西班牙智能电表中惊现漏洞，可导致大面积停电", "url": "https://www.freebuf.com/news/47634.html", "time": "2014-10-20", "level": "金币+3", "num_look": 358304, "num_comment": 20, "author": "xia0k", "tags": ["资讯"], "text": "近来，研究人员发现西班牙所使用的智能电表中存在安全漏洞，该漏洞可以导致电费欺诈甚至进入电路系统导致大面积停电。"}
{"title": "明日边缘：愈演愈烈的POS机网络犯罪", "url": "https://www.freebuf.com/news/47723.html", "time": "2014-10-20", "level": "金币+3", "num_look": 390839, "num_comment": 11, "author": "Rabbit_Run", "tags": ["头条", "终端安全"], "text": "自2013年来，我们发现来自POS恶意软件的威胁急剧性的增长。这次增长类似于其他市场的变化规律-因为零售网络中存留了大量的金融数据。攻击者正在调整枪口，集结力量，向要害部位发起攻击。"}
{"title": "Android下跑kali疑难问题解决方案", "url": "https://www.freebuf.com/articles/terminal/47817.html", "time": "2014-10-20", "level": "金币+3", "num_look": 1643852, "num_comment": 69, "author": "喵呜君", "tags": ["极客", "终端安全"], "text": "说实话现在的智能移动设备是越来越牛逼了。那天你在路上看见一个人猥猥琐琐的的站在路边手指在不断的触控手机并时不时抬头四处张望……八成这人是在等人，剩下两成这人可能正在用手机折腾各大肯德基、星巴克的wifi。"}
{"title": "国内iCloud服务器遭遇中间人攻击，中国苹果用户隐私不保", "url": "https://www.freebuf.com/news/47744.html", "time": "2014-10-19", "level": "金币+3", "num_look": 745648, "num_comment": 32, "author": "佐拉", "tags": ["资讯"], "text": "看到v2ex有人在讨论 iCloud 被中间人劫持。我也去验证了一下。事实证明：若有人不幸运被DNS服务器返回这个icloud.com的IP地址，他存储在icloud的私房照片、密码等信息都存在危险。"}
{"title": "Drupal 7.31 SQL注入漏洞（CVE-2014-3704） EXP测试代码", "url": "https://www.freebuf.com/vuls/47690.html", "time": "2014-10-19", "level": "金币+3", "num_look": 551562, "num_comment": 18, "author": "午夜灰狼哥", "tags": ["漏洞"], "text": "最近频繁爆发各种0day，真是把大家累坏了。Drupal 7.31 SQL注入漏洞(CVE-2014-3704)就是其中一个，该漏洞利用测试方法“简单粗暴”，受到安全研究者们的青睐。"}
{"title": "美国漏洞管理库发布Bash漏洞最新概要", "url": "https://www.freebuf.com/news/47421.html", "time": "2014-10-18", "level": "", "num_look": 148725, "num_comment": 5, "author": "凌晨几度i", "tags": ["资讯"], "text": "最近美国国家网络感知系统发布了一项针对“CVE-2014-6271 bash远程命令执行漏洞（ShellShock破壳）”的概要，“破壳”漏洞远胜“心脏出血”，看来实至名归。"}
{"title": "上海利物盛招聘渗透测试工程师", "url": "https://www.freebuf.com/jobs/47060.html", "time": "2014-10-17", "level": "", "num_look": 180447, "num_comment": 32, "author": "Anonymous_K", "tags": ["安全招聘"], "text": "上海利物盛(LEVSON)网络科技有限公司是一家定位于专注提供信息安全产品和服务的创新型高科技企业。为广大用户提供具备国际安全标准（OWASP、WASC、PCI/DSS）的WEB应用安全产品与服务。"}
{"title": "Safety Check：Facebook推出可应对灾难的通讯平台", "url": "https://www.freebuf.com/news/47524.html", "time": "2014-10-17", "level": "", "num_look": 149003, "num_comment": 7, "author": "cindy", "tags": ["资讯"], "text": "Facebook新推出了一款社交媒体服务平台，这是一款比较前卫的软件。它的功能是用户在遇到严重事件（比如地震、海啸等自然灾害）的情况下，也可以正常的和家人朋友联系。"}
{"title": "观点：从手机的发展聊聊智能汽车安全", "url": "https://www.freebuf.com/articles/wireless/45343.html", "time": "2014-10-17", "level": "金币+7", "num_look": 319593, "num_comment": 8, "author": "tofreebug", "tags": ["无线安全", "终端安全"], "text": "2014年9月我参加拉斯维加斯CTIA移动大会，会议方指出：2017年将有60%的新车（即1000万辆）会装载4G移动电信模块，72%的受访用户表示会推迟一年购车，专门等待智能汽车的出现。智能汽车全球市场将达千亿美元，美国市…"}
{"title": "最好的Android安全测试框架 - Drozer", "url": "https://www.freebuf.com/sectool/47248.html", "time": "2014-10-17", "level": "", "num_look": 551233, "num_comment": 16, "author": "phper", "tags": ["工具"], "text": "drozer是一款针对Android系统的安全测试框架。drozer可以帮助Android app和设备变得更安全，其提供了很多Android平台下的渗透测试exploit供你使用和分享。对于远程的exploit，它可以生成shellcode帮助你进行远程设…"}
{"title": "BadUSB的前世今生：USB RUBBER DUCKY和Teensy USB", "url": "https://www.freebuf.com/sectool/47411.html", "time": "2014-10-17", "level": "金币+7", "num_look": 1192648, "num_comment": 26, "author": "Rabbit_Run", "tags": ["头条", "工具"], "text": "前段时间翻译了有关BadUSB的两篇文章《解密BadUSB：世界上最邪恶的USB外设》和《研究人员公布BadUSB攻击测试（exploit）代码》，大家反应强烈，很多人都在打听BadUSB的实现方法，或者从那里可以买到这样的U盘。"}
{"title": "Zbot老木马换新装：轻松绕过邮箱安全安检", "url": "https://www.freebuf.com/articles/system/47380.html", "time": "2014-10-17", "level": "", "num_look": 373470, "num_comment": 24, "author": "360安全", "tags": ["系统安全"], "text": "最近我们的工程师收到这样一封邮件，发件人显示为“Microsoft outlook”，附件貌似是个音频文件。但是把附件下载到本地一看，却是一个Zbot木马。"}
{"title": "赛门铁克、思科、FireEye、微软等公司联手对抗Hidden Lynx组织", "url": "https://www.freebuf.com/news/47367.html", "time": "2014-10-17", "level": "", "num_look": 234133, "num_comment": 6, "author": "cindy", "tags": ["头条", "资讯"], "text": "通过跨行业的合作，这些公司建立了情报和资源分享平台，全方位、多元化的保护模式大大削弱了恶意软件的攻击性。"}
{"title": "自己动手DIY：极路由贰移植WiFi Pineapple", "url": "https://www.freebuf.com/news/47250.html", "time": "2014-10-17", "level": "金币+7", "num_look": 1204431, "num_comment": 64, "author": "mobier", "tags": ["资讯"], "text": "因为在极路由9003以上版本中，官方加入了防刷固件，无法使用用户通过桶菊花(Rst刷机法)进行刷机，太特么可耻的，所以只能使用ttl刷机法了。"}
{"title": "BackBox Linux 4.0发布", "url": "https://www.freebuf.com/sectool/47189.html", "time": "2014-10-16", "level": "金币+7", "num_look": 492594, "num_comment": 37, "author": "帅气凌云", "tags": ["工具"], "text": "BackBox是基于Ubuntu的Linux发行版，它是一款用于网络渗透测试及安全评估的操作系统。"}
{"title": "巴基斯坦人民党官网被黑：致Bilawal Bhutto的一封信", "url": "https://www.freebuf.com/news/47255.html", "time": "2014-10-16", "level": "金币+7", "num_look": 173121, "num_comment": 16, "author": "dawner", "tags": ["资讯"], "text": "巴基斯坦人民党的官网被印度黑客给黑下来，留下了诸如“Hacked by Black Dragon”这样的字眼儿。网站的首页已经被篡改为印度三色旗，还配上了阿三国歌作背景音乐。"}
{"title": "漏洞盒子-互联网漏洞基金：国内首个互联网安全漏洞奖励计划", "url": "https://www.freebuf.com/news/46888.html", "time": "2014-10-16", "level": "红色标题", "num_look": 544456, "num_comment": 35, "author": "漏洞盒子", "tags": ["活动", "资讯"], "text": "FreeBuf旗下互联网安全测试平台——漏洞盒子(VulBox.COM)于今日宣布，联合多个厂商共同发起互联网安全漏洞奖励计划。单个漏洞单次查看的最高奖励高达40万元。"}
{"title": "SSL v3 Poodle安全漏洞修复建议", "url": "https://www.freebuf.com/news/47172.html", "time": "2014-10-16", "level": "", "num_look": 540848, "num_comment": 6, "author": "cindy", "tags": ["资讯"], "text": "利用SSL保护你的网站流量远远不止是在服务器安装一个SSL证书而已。对初识者来说，你需要选择一组具有高安全保障的密码，同时又不能忽略掉来自旧浏览器上的访问者。"}
{"title": "沙虫（CVE-2014-4114）相关威胁综合分析报告 — 及对追影安全平台检测问题的复盘", "url": "https://www.freebuf.com/articles/network/47284.html", "time": "2014-10-16", "level": "", "num_look": 387461, "num_comment": 9, "author": "安天实验室", "tags": ["安全报告", "网络安全"], "text": "CVE-2014-4114 是OLE包管理INF 任意代码执行漏洞，该漏洞影响Win Vista，Win7等以上操作系统，攻击者使用PowerPoint作为攻击载体，该漏洞是在Microsoft Windows和服务器上的OLE包管理器。"}
{"title": "快讯：Drupal 7.31版本爆严重SQL注入漏洞", "url": "https://www.freebuf.com/vuls/47271.html", "time": "2014-10-16", "level": "红色标题", "num_look": 632455, "num_comment": 19, "author": "pnig0s", "tags": ["WEB安全", "漏洞"], "text": "今早有国外安全研究人员在Twitter上曝出了Drupal 7.31版本的最新SQL注入漏洞，并给出了利用测试的EXP代码。"}
{"title": "AV-Test移动安全测评报告惊现阿里巴巴", "url": "https://www.freebuf.com/news/others/47270.html", "time": "2014-10-16", "level": "", "num_look": 255140, "num_comment": 12, "author": "maxcoco", "tags": ["周边"], "text": "早听说阿里巴巴要进军移动安全领域，但没想到会这么快。笔者眼角扫过9月AV-Test报告，意外揪出阿里巴巴的身影。根据笔者到阿里巴巴安全的朋友嘴里八卦，得知阿里巴巴确实新成立了移动安全团队，而对于这款产品，却…"}
{"title": "保护智能汽车安全：以色列初创网络安全公司Argus", "url": "https://www.freebuf.com/news/47219.html", "time": "2014-10-16", "level": "", "num_look": 148037, "num_comment": 3, "author": "phper", "tags": ["资讯"], "text": "以色列初创公司Argus虚拟网络公司旨在开发系统监控并阻止黑客攻击“联网汽车”，阻止此类事情发生。"}
{"title": "京东商城招聘安全工程师（年度最后5位名额）", "url": "https://www.freebuf.com/jobs/47143.html", "time": "2014-10-16", "level": "", "num_look": 187957, "num_comment": 20, "author": "京东安全", "tags": ["安全招聘"], "text": ""}
{"title": "CrowdStrike：我们是如何发现Win64bit提权0day漏洞（CVE-2014-4113）的", "url": "https://www.freebuf.com/news/47194.html", "time": "2014-10-15", "level": "红色标题", "num_look": 1382054, "num_comment": 36, "author": "cindy", "tags": ["头条", "资讯"], "text": "近日CrowdStrike团队监测到了Win64bit2008 R2计算机上存在可疑的活动。CrowdStrike认为：这些计算机极有可能受到飓风熊猫（HURRICANE PANDA）的控制。"}
{"title": "回顾：互联网安全大会（ISC 2014）干货HighLight", "url": "https://www.freebuf.com/articles/others-articles/47104.html", "time": "2014-10-15", "level": "", "num_look": 151939, "num_comment": 5, "author": "bluewing", "tags": ["其他", "观点"], "text": "距离ISC已经有点久了，这段时间都用来把参会经历晒晒，现在感觉差不多晒干了，所以还是总结下在这次大会中看到、听到、学到关于安全相关的一点见闻，尽量干货。"}
{"title": "漏洞盒子项目上新：小米科技安全测试", "url": "https://www.freebuf.com/fevents/47106.html", "time": "2014-10-15", "level": "", "num_look": 194741, "num_comment": 15, "author": "漏洞盒子", "tags": ["活动"], "text": "小米公司正式成立于2010年4月，是一家专注于智能产品自主研发的移动互联网公司。小米授权漏洞盒子的白帽子参与本次安全测试，漏洞将在厂商完全修复后公布，项目奖励为RANK、FB金币、3台小米手机4以及Cuptime智能水…"}
{"title": "Google发布SSLv3漏洞简要分析报告", "url": "https://www.freebuf.com/news/47089.html", "time": "2014-10-15", "level": "金币+7", "num_look": 804547, "num_comment": 17, "author": "xia0k", "tags": ["安全报告", "漏洞"], "text": "Google表示，他们只能给出一个无奈的建议：关闭客户端SSLv3支持或者服务器SSLv3支持或者两者全部关闭。"}
{"title": "国产“骄傲”：最先进的国产IOS木马Xsser现身分析", "url": "https://www.freebuf.com/news/topnews/46822.html", "time": "2014-10-15", "level": "金币+7", "num_look": 473304, "num_comment": 31, "author": "xia0k", "tags": ["头条", "终端安全"], "text": "前几天，Lacoon移动安全公司的研究人员报告了一个感染iOS越狱手机的间谍程序Xsser mRAT，传闻中标榜此木马为“国产最先进”。"}
{"title": "叙利亚电子军发布自己的Linux发行版 - SEANux", "url": "https://www.freebuf.com/news/46858.html", "time": "2014-10-15", "level": "", "num_look": 203557, "num_comment": 11, "author": "cindy", "tags": ["工具", "资讯"], "text": "网上的许多Linux发行版都是免费的，大部分是由公司、非商业组织和还有个人提供的，而且现在，臭名昭著的叙利亚电子军（SEA）也发布了它自己的Linux发行版，叫做SEANux。"}
{"title": "心血漏洞第二发？SSL v3再曝新漏洞发布预警", "url": "https://www.freebuf.com/news/46991.html", "time": "2014-10-15", "level": "金币+7", "num_look": 357675, "num_comment": 20, "author": "xia0k", "tags": ["漏洞", "资讯"], "text": "风波刚刚过去，我们的厂商还没来得及松口气，今天又收到了另外一则可怕的消息：“心脏滴血（Heartbleed）”又来了！不过这次，是SSL3.0版本。"}
{"title": "Windows任意代码执行0day（CVE-2014-4114）分析报告", "url": "https://www.freebuf.com/news/46956.html", "time": "2014-10-15", "level": "", "num_look": 580912, "num_comment": 38, "author": "翰海源安全", "tags": ["漏洞", "网络安全"], "text": "从virustotal的链接来看，漏洞样本第一次的提交时间是在8月13号，已经在外面漂泊起码2个月以上。"}
{"title": "影响全版本Windows：iSIGHT监控间谍活动发现Windows最新0day漏洞", "url": "https://www.freebuf.com/news/46979.html", "time": "2014-10-15", "level": "金币+7", "num_look": 294807, "num_comment": 15, "author": "xia0k", "tags": ["漏洞", "资讯"], "text": "iSIGHT在俄罗斯网络间谍活动中发现影响全版本Windows系统的最新0day漏洞，漏洞编号为CVE-2014-4114，目前，微软正紧急为该漏洞制作补丁。"}
{"title": "360招聘信息安全工程师、安全技术研究员", "url": "https://www.freebuf.com/jobs/46922.html", "time": "2014-10-14", "level": "", "num_look": 279997, "num_comment": 30, "author": "Mystery", "tags": ["安全招聘"], "text": "奇虎360由周鸿祎创立于2005年9月，主营以360安全卫士、360杀毒为代表的免费网络安全平台，同时拥有奇虎问答等独立业务，董事长是周鸿祎。现招聘信息安全工程师和安全技术研究员。"}
{"title": "快讯：黑客宣称盗取Dropbox700W数据", "url": "https://www.freebuf.com/news/46849.html", "time": "2014-10-14", "level": "红色标题", "num_look": 646352, "num_comment": 21, "author": "Anonymous_K", "tags": ["数据安全", "资讯"], "text": "说好的数据泄露此起彼伏！果然就在昨日，国外某个匿名信息共享网站发布讯息——数以百计的所谓的Dropbox用户名与密码被放出！而且还在不断更新中。"}
{"title": "复用代码引发悲剧：含漏洞的安卓ROM致1000万用户受中间人攻击（MITM）影响", "url": "https://www.freebuf.com/news/46804.html", "time": "2014-10-14", "level": "", "num_look": 131832, "num_comment": 7, "author": "cindy", "tags": ["资讯"], "text": "由于存在漏洞的示例代码，使得超过1000万安装了Cyanogen安卓的用户受中间人（MITM）的攻击，而该漏洞的目标是流行的安卓社区中的任何浏览器。"}
{"title": "漏洞盒子精选集：苏宁安全测试项目", "url": "https://www.freebuf.com/news/topnews/46645.html", "time": "2014-10-14", "level": "金币+7", "num_look": 456269, "num_comment": 25, "author": "xia0k", "tags": ["WEB安全", "头条"], "text": "漏洞盒子-苏宁易购安全测试项目于2014年9月16日-19日进行，目前已落下帷幕。小编在此精心整理了本次测试中出现的优秀漏洞，希望各位白帽子能有所收获。"}
{"title": "谷歌工程师NeelMehta是如何发现心脏滴血漏洞的", "url": "https://www.freebuf.com/news/46685.html", "time": "2014-10-14", "level": "", "num_look": 253848, "num_comment": 20, "author": "cindy", "tags": ["资讯"], "text": "Heartbleed计算机安全漏洞是由谷歌工程师NeelMehta发现的，一向不愿意接受媒体采访的他，今日首次向媒体说出了他是怎样发现这一严重漏洞的；他为什么会去第一时间去查找这一漏洞，并且他预言将有一些类似的东西会继…"}
{"title": "走近BlackEnergy：黑客为乌克兰政府量身打造的犯罪软件", "url": "https://www.freebuf.com/news/46569.html", "time": "2014-10-14", "level": "金币+9", "num_look": 580731, "num_comment": 7, "author": "Rabbit_Run", "tags": ["工具", "网络安全"], "text": "Blackenergy是一个被各种犯罪团伙使用多年的工具。在2014年的夏季，F-Secure团队发现Blackenergy恶意软件的特定样本开始以乌克兰政府作为目标来收集情报。"}
{"title": "上讯信息招聘安全人员", "url": "https://www.freebuf.com/jobs/46588.html", "time": "2014-10-14", "level": "", "num_look": 314565, "num_comment": 86, "author": "hyforsky", "tags": ["安全招聘"], "text": "上海上讯信息技术股份有限公司（以下简称上讯信息）目前公司在西安、上海、北京设立研发中心，现借助FreeBuf平台招聘多个安全岗位。"}
{"title": "2014年第三季度，反射型DDOS攻击仍然非常危险", "url": "https://www.freebuf.com/news/46514.html", "time": "2014-10-13", "level": "", "num_look": 192804, "num_comment": 4, "author": "cindy", "tags": ["资讯"], "text": "ArborATLAS最近发布的报告显示，2014年第三季度的反射型DDoS攻击数量有所增加，尤其是SSDP反射型攻击。"}
{"title": "走进科学：黑客叔叔带你玩转LED_Hacking", "url": "https://www.freebuf.com/news/topnews/46625.html", "time": "2014-10-13", "level": "金币+9", "num_look": 991318, "num_comment": 112, "author": "p0tt1", "tags": ["头条", "极客"], "text": "前阵子看到再传某某组织黑led显示屏和走马灯的新闻，貌似还炒作了\r\n一下，恩，并且把修改文字“系统漏洞，请修补，xxxx 到此一游”。我们今天就来玩玩Led_hacking，一起\r\n揭开它的神秘面(ku)纱(cha)..."}
{"title": "变换姿势：从DHCP再挖破壳漏洞利用", "url": "https://www.freebuf.com/vuls/46603.html", "time": "2014-10-13", "level": "金币+9", "num_look": 287391, "num_comment": 9, "author": "凌晨几度i", "tags": ["漏洞", "系统安全"], "text": "破壳漏洞(Shellshock)影响深远，利用起来似乎没那么容易，所以对于破壳漏洞研究利用的新方法会间歇性地出现。众所周知，利用破壳漏洞攻击Web应用程序一直是热门研究对象，并且通过其他层面挖掘破壳的利用同样是有可…"}
{"title": "揭秘：Windows10预览版监视你一举一动", "url": "https://www.freebuf.com/news/46545.html", "time": "2014-10-13", "level": "红色标题", "num_look": 443690, "num_comment": 35, "author": "凌晨几度i", "tags": ["头条", "资讯"], "text": ""}
{"title": "ISIS网络大战：空洞的威胁还是现实？", "url": "https://www.freebuf.com/articles/neopoints/46309.html", "time": "2014-10-12", "level": "金币+9", "num_look": 205087, "num_comment": 13, "author": "dawner", "tags": ["观点"], "text": "极端激进组织ISIS，在全世界积极投身于社交媒体的行为，已被当作是一种强化“圣战”和恐怖袭击的策略。然而，进一步评定ISIS对美国本土实施网络打击的可能性，需要从一个更广阔的角度进行分析。"}
{"title": "事件跟踪：SnapChat“私照门”由第三方泄露引起", "url": "https://www.freebuf.com/news/46461.html", "time": "2014-10-11", "level": "红色标题", "num_look": 469632, "num_comment": 40, "author": "cindy", "tags": ["头条", "资讯"], "text": "Snapchat图片是由使用了被入侵API的第三方Web app泄露。目前为止，被入侵的app发布了超过100000张的图片，增加了人们对少儿不宜信息发布的担忧。#别问我种子在哪，不要问我从哪里来#"}
{"title": "揭秘：短信拦截木马背后的黑色产业", "url": "https://www.freebuf.com/news/topnews/46441.html", "time": "2014-10-11", "level": "金币+9", "num_look": 374643, "num_comment": 16, "author": "Gandalf", "tags": ["头条", "系统安全"], "text": "短信拦截马，顾名思义是一种可以拦截他人短信木马，就是让被攻击者收不到短信，并将短信内容截取到攻击者手机上。"}
{"title": "一周海外安全事件回顾（9.29-10.05）：黑客与游戏的恩怨", "url": "https://www.freebuf.com/news/46428.html", "time": "2014-10-11", "level": "红色标题", "num_look": 253986, "num_comment": 12, "author": "blackscreen", "tags": ["头条", "安全报告"], "text": "在上周，一个专门以游戏公司为目标的黑客团伙在美国伏法。偷窃的软件列表中赫然包括美军方攻击直升机的训练程序。本期回顾将聚焦在黑客与游戏之间的恩恩怨怨。"}
{"title": "第三方SnapChat客户端遭入侵，上万张、近13G私照泄露", "url": "https://www.freebuf.com/news/46410.html", "time": "2014-10-11", "level": "", "num_look": 262353, "num_comment": 23, "author": "fu4k", "tags": ["资讯"], "text": "某第三方的 SnapChat 客户端一直在存储本应阅后即焚的照片，近期被黑客入侵，获取了近 13G 的照片 / 视频。"}
{"title": "PlayStation4 SDK 1.0遭泄露", "url": "https://www.freebuf.com/news/45851.html", "time": "2014-10-11", "level": "金币+9", "num_look": 185663, "num_comment": 5, "author": "LinuxSpace", "tags": ["资讯"], "text": "近日，PS4开发套件1.0版SDK又被泄露出来，这是要中国还没发售PS4就爆菊的节奏么？应该是我想太多了……"}
{"title": "漏洞盒子：苏宁项目榜单公布，iPhone6花落谁家", "url": "https://www.freebuf.com/fevents/46356.html", "time": "2014-10-10", "level": "红色标题", "num_look": 352343, "num_comment": 28, "author": "FB客服", "tags": ["活动"], "text": "漏洞盒子-苏宁易购安全测试项目于2014年9月16日正式启动。短短三天时间，厂商共计收到漏洞250枚，而“漏洞盒子 - 漏洞黑板报”也在今天闪亮登场！"}
{"title": "研究人员公布BadUSB攻击测试（exploit）代码", "url": "https://www.freebuf.com/news/46291.html", "time": "2014-10-10", "level": "", "num_look": 676825, "num_comment": 31, "author": "Rabbit_Run", "tags": ["工具", "终端安全"], "text": "我一直在关注由两个安全研究人员曝光的一个漏洞利用（exploit）：SR实验室的亚当·考迪尔和布兰登·威尔逊。他们对影响数以百万计的设备的USB固件进行了逆向，可以让黑客向计算机中插入恶意代码。"}
{"title": "从雅虎频繁曝出SQL漏洞看SQL注入威胁", "url": "https://www.freebuf.com/news/46271.html", "time": "2014-10-10", "level": "", "num_look": 252414, "num_comment": 16, "author": "xia0k", "tags": ["WEB安全", "观点"], "text": "SQL注入是一种真正具有威胁的攻击方式，世界各地的黑客每天乐此不疲地进行着SQL注入。"}
{"title": "间谍软件StealthGenie制造商CEO被FBI拘捕", "url": "https://www.freebuf.com/news/46028.html", "time": "2014-10-10", "level": "", "num_look": 337883, "num_comment": 24, "author": "dawner", "tags": ["资讯"], "text": "这款狡猾的手机间谍软件，被人称作StealthGenie。当它被装在受害人手机上时，可以监控受害者的电话、短信、视频、电子邮件以及其他通讯手段。"}
{"title": "内网劫持渗透新姿势：MITMf简要指南", "url": "https://www.freebuf.com/sectool/45796.html", "time": "2014-10-09", "level": "金币+20", "num_look": 2198187, "num_comment": 159, "author": "xia0k", "tags": ["工具", "网络安全"], "text": "这篇文章的主要目的是介绍一下一个最新的中间人攻击测试框架MITMf。工具本身比较新，没找到中文指南，这里就写一篇文章与大家一起交流探讨。"}
{"title": "揭秘：恶意软件是如何操纵ATM机的", "url": "https://www.freebuf.com/news/topnews/46150.html", "time": "2014-10-09", "level": "金币+20", "num_look": 526569, "num_comment": 22, "author": "Rabbit_Run", "tags": ["头条", "系统安全"], "text": "卡巴斯基安全团队对东欧一起针对多款ATM机的网络犯罪进行了取证调查。调查过程中，该团队发现了一款新型的恶意软件Tyupkin，该恶意软件使用了控制活动时段和会话密钥等技术来躲避检测。该恶意软件从一个侧面揭示了…"}
{"title": "安全科普：浮窗登录框的隐患", "url": "https://www.freebuf.com/news/topnews/46126.html", "time": "2014-10-09", "level": "", "num_look": 363302, "num_comment": 11, "author": "嘎巴嘎巴", "tags": ["WEB安全", "头条"], "text": "此文为安全科普系列第三篇，作者EtherDream以图文并茂的形式详细讲解了流量劫持及相关知识，此系列的前两篇文章见文章末的传送门。"}
{"title": "启明星辰招聘高级渗透测试工程师", "url": "https://www.freebuf.com/jobs/46062.html", "time": "2014-10-08", "level": "", "num_look": 376691, "num_comment": 38, "author": "happylj111", "tags": ["安全招聘"], "text": ""}
{"title": "[更新中文视频]黑客组织Anonymous向ISIS宣战", "url": "https://www.freebuf.com/news/45563.html", "time": "2014-10-08", "level": "金币+20", "num_look": 1021660, "num_comment": 52, "author": "dawner", "tags": ["视频", "资讯"], "text": "全美第一的黑客组织Anonymous（匿名者）：“我们向一些国家发出警告，如果他们继续支持ISIS，我们将不得不摧毁他们的虚拟基础设施，而我们组织确实能做到这点。”"}
{"title": "走近科学：中国移动（10086）钓鱼手机APP分析", "url": "https://www.freebuf.com/news/topnews/46055.html", "time": "2014-10-08", "level": "", "num_look": 380528, "num_comment": 18, "author": "0xExploit", "tags": ["头条", "终端安全"], "text": "前几天仿冒中国电信的钓鱼程序，似乎风风火火，今天给大家分析一个中国移动的钓鱼程序。"}
{"title": "Android（4.4版本以下）浏览器同源策略绕过漏洞", "url": "https://www.freebuf.com/vuls/44763.html", "time": "2014-10-08", "level": "", "num_look": 270995, "num_comment": 5, "author": "凌晨几度i", "tags": ["漏洞", "终端安全"], "text": "以下书面记录描述了一个SOP绕过漏洞（漏洞编号CVE-2014-6041)，它是在作者的一个Qmobile Noir A20（Android 4.2.1的浏览器）上发现的，后来继续证实,Sony+ Xperia +Tipo、三星Galaxy、HTC Wildfire、Motrorolla等也…"}
{"title": "更大的iPhone更安全？相同方法破解iPhone6指纹解锁", "url": "https://www.freebuf.com/articles/terminal/45153.html", "time": "2014-10-08", "level": "红色标题", "num_look": 507142, "num_comment": 12, "author": "嘎巴嘎巴", "tags": ["极客", "终端安全"], "text": "你的iPhone指纹解锁可靠么？国外的极客早在iPhone5s上市之后就已经进行了破解，并称iPhone6的指纹解锁可以使用相同的方法进行破解"}
{"title": "境外黑客论坛曝香港壹传媒用户数据下载地址", "url": "https://www.freebuf.com/news/45278.html", "time": "2014-10-08", "level": "红色标题", "num_look": 573783, "num_comment": 26, "author": "Datafind", "tags": ["资讯"], "text": "继网传壹传媒数据库遭泄露后，一份名为“nextmedia.7z”的压缩文件被贴在在国外一家名为antionline的黑客论坛上，文件包含了nextmedia用户的邮箱、手机和密码。"}
{"title": "恶意软件隐藏新技巧 - 密写", "url": "https://www.freebuf.com/articles/web/45698.html", "time": "2014-10-08", "level": "", "num_look": 268872, "num_comment": 20, "author": "麻花藤", "tags": ["WEB安全"], "text": "“密写”技术在很多侦探小说和谍战电影中经常会出现。 间谍用密写药水把情报写在白纸上， 收到情报的上级再通过显影技术把情报还原出来。"}
{"title": "云退出计划：在意外发生时留一手", "url": "https://www.freebuf.com/articles/neopoints/45956.html", "time": "2014-10-07", "level": "", "num_look": 299689, "num_comment": 15, "author": "dawner", "tags": ["安全管理", "观点"], "text": "当你的云服务商将要倒闭或是不再可靠时，你应该做些什么来减少损失呢？你所制定的云战略最需要保证的是数据的安全性和可用性。如果你的云服务商倒闭，需要多少天来进行数据转移？"}
{"title": "微软账号系统遭遇大规模SSL中间人攻击", "url": "https://www.freebuf.com/news/45929.html", "time": "2014-10-06", "level": "金币+20", "num_look": 572928, "num_comment": 24, "author": "Xarray", "tags": ["资讯"], "text": "10月2日至10月6日，微软账号（login.live.com）在中国大陆地区遭受大面积SSL中间人攻击。访问网站后，浏览器提示网站证书不受信任，并且HTTPS（443）端口不可达。"}
{"title": "ISC 2014中国互联网安全大会全纪实", "url": "https://www.freebuf.com/news/topnews/45524.html", "time": "2014-10-06", "level": "红色标题", "num_look": 339950, "num_comment": 22, "author": "FB独家", "tags": ["头条"], "text": "2014年9月24日至25日，亚太信息安全领域最权威的年度峰会——2014中国互联网安全大会(ISC 2014）在北京国家会议中心召开。FreeBuf作为官方独家战略合作媒体参与了本届盛会。"}
{"title": "1/4美国家庭受影响：摩根大通银行爆泄7600W数据", "url": "https://www.freebuf.com/news/45850.html", "time": "2014-10-05", "level": "", "num_look": 344042, "num_comment": 17, "author": "凌晨几度i", "tags": ["资讯"], "text": ""}
{"title": "慎用免费HTTPS：看似美好的免费“通用SSL证书”", "url": "https://www.freebuf.com/articles/neopoints/45822.html", "time": "2014-10-04", "level": "", "num_look": 2950314, "num_comment": 43, "author": "Mystery", "tags": ["观点"], "text": "上个月月底，CloudFlare宣布向所有客户提供免费的SSL支持。一时间，全世界的云计算供应商以及开发者大为欣喜。\r\n但是这块蛋糕真的和大家说的那样好吗？经过一些简单的研究，我们发现了这项服务存在的一些弊端"}
{"title": "黑客电影《我是谁 - 没有绝对安全的系统》预告片（FB视频组）", "url": "https://www.freebuf.com/video/45644.html", "time": "2014-10-02", "level": "红色标题", "num_look": 564674, "num_comment": 40, "author": "FB视频", "tags": ["视频"], "text": "“黑客技术就像魔术，处处充满了欺骗”……现实世界中的Loser，在网络世界却是一手遮天的顶级黑客。"}
{"title": "一周海外安全事件回顾（9.22-9.28）：黑客的下一个攻击工具 - 电冰箱", "url": "https://www.freebuf.com/news/45741.html", "time": "2014-10-02", "level": "", "num_look": 218571, "num_comment": 10, "author": "blackscreen", "tags": ["头条", "资讯"], "text": "一伙儿来自亚洲的疯子正在利用电冰箱发起网络攻击，Akamai如是说。而Anons向ISIS宣战也在上周吸足了眼球。"}
{"title": "敞开的地狱之门：Kerberos协议的滥用", "url": "https://www.freebuf.com/articles/system/45631.html", "time": "2014-10-01", "level": "金币+9", "num_look": 1137407, "num_comment": 16, "author": "Rabbit_Run", "tags": ["系统安全", "网络安全"], "text": "在BlackHat 2014上神器Mimikatz的作者剖析了微软实现的Kerberos协议中存在的安全缺陷，并通过神器Mimikatz新添功能“Golden Ticket”展示了如何利用这些安全缺陷，让Kerberos把守的地狱之门为大家敞开。"}
{"title": "FreeBuf文章更新提醒插件Chrome版", "url": "https://www.freebuf.com/sectool/45639.html", "time": "2014-10-01", "level": "金币+9", "num_look": 306326, "num_comment": 16, "author": "H01ger", "tags": ["工具"], "text": "我为FreeBuf制作的Chrome小插件：为每隔10分钟获取一次FreeBuf的feed，发现有更新后会进行桌面提醒用户，点击即可进入对应页面。"}
{"title": "从语法解析角度分析Bash破壳漏洞", "url": "https://www.freebuf.com/articles/web/45520.html", "time": "2014-09-30", "level": "", "num_look": 499021, "num_comment": 18, "author": "360网站卫士", "tags": ["WEB安全"], "text": "360网站卫士团队结合poc分析了解一下Bash的语法规则，从另外一个角度帮忙大家更好的了解bash以及shellshock漏洞。"}
{"title": "Twitter信息抓取工具 - TinfoLeak", "url": "https://www.freebuf.com/sectool/45548.html", "time": "2014-09-30", "level": "", "num_look": 356130, "num_comment": 6, "author": "嘎巴嘎巴", "tags": ["工具"], "text": "TinfoLeak是一款强大的Twitter用户信息抓取软件，主要的抓取的信息有：\r\nTwitter用户基础信息、用户所使用的操作系统和设备信息、用户的应用和社交网络信息、生成形迹图等。"}
{"title": "AutoIt木马又一发：暗藏神秘照片", "url": "https://www.freebuf.com/articles/system/45276.html", "time": "2014-09-30", "level": "金币+9", "num_look": 654521, "num_comment": 13, "author": "逍遥子", "tags": ["系统安全", "网络安全"], "text": "AutoIt是一个自动化的Windows界面交互的脚本语言，具有很高的灵活性和较低的学习曲线。由于AutoIt解释器本身属于合法程序，黑客可以把恶意代码藏在脚本文件中，从而灵活地创建恶意软件。"}
{"title": "破壳（ShellShock）漏洞样本分析报告", "url": "https://www.freebuf.com/articles/system/45390.html", "time": "2014-09-30", "level": "", "num_look": 666993, "num_comment": 14, "author": "金山毒霸", "tags": ["安全报告", "系统安全"], "text": "破壳漏洞（ShellShock）的严重性被定义为 10 级（最高）,而今年 4 月爆发的 OpenSSL(心脏出血)漏洞才 5 级！"}
{"title": "有关部门修复了Instagram可以被访问的漏洞", "url": "https://www.freebuf.com/news/45470.html", "time": "2014-09-29", "level": "", "num_look": 183642, "num_comment": 20, "author": "cindy", "tags": ["资讯"], "text": "Facebook旗下的照片分享服务Instagram被屏蔽，在国内社交网站如新浪微博上，Instagram搜索也被屏蔽。至此Facebook、Twitter、YouTube等漏洞全部被修复。"}
{"title": "Bash漏洞再次演进：缓冲区溢出导致远程任意命令执行", "url": "https://www.freebuf.com/news/45436.html", "time": "2014-09-29", "level": "金币+9", "num_look": 461817, "num_comment": 21, "author": "xia0k", "tags": ["漏洞", "资讯"], "text": "近几天，Bash漏洞(shellshock)的出现可谓是给安全界投放了一颗重型炸弹，当我们以为CVE-2014-6271已经够劲爆的时候，殊不知，这仅仅是一个开始。"}
{"title": "强烈谴责：FBI对谷歌和苹果的加密策略表示不满", "url": "https://www.freebuf.com/news/45246.html", "time": "2014-09-29", "level": "", "num_look": 234546, "num_comment": 18, "author": "dawner", "tags": ["资讯"], "text": "客户们也许会称赞那些科技公司对自己新产品下的苦功，这些巨头们为了防止用户私密数据被政府机构获取，在加密设备上确实付出了不少，但是FBI（联邦调查局）现在可不怎么待见苹果和谷歌这两个公司了。"}
{"title": "利用Mimikatz提取虚拟机内存中的密码", "url": "https://www.freebuf.com/articles/system/44620.html", "time": "2014-09-29", "level": "", "num_look": 1376259, "num_comment": 27, "author": "xia0k", "tags": ["系统安全"], "text": "神器Mimikatz出自法国大神Benjamin Delpy之手，可以直接获取到大多数windows平台下的明文密码，相比于其他工具，最大的特点是速度极快，无需等待。"}
{"title": "艳照门风波又起：Jennifer Lawrence再曝新私照", "url": "https://www.freebuf.com/news/45303.html", "time": "2014-09-29", "level": "红色标题", "num_look": 988120, "num_comment": 37, "author": "cindy", "tags": ["资讯"], "text": "对于明星的艳照似乎有爆不完的料，近日Fappening 3又破解了部分照片，第三回合的艳照继续上演。第三波爆出的有奥斯卡影后Jennifer Lawrence的新照、《暮光之城》女星Anna Kendrick、超模Cara Delevingne等人的艳照。"}
{"title": "奖金500美元起：微软开启在线服务漏洞赏金计划", "url": "https://www.freebuf.com/news/45362.html", "time": "2014-09-28", "level": "", "num_look": 185222, "num_comment": 12, "author": "xia0k", "tags": ["资讯"], "text": "9月24日，微软宣布开启“在线服务除虫赏金计划”(Microsoft Online Services Bug Bounty Program)，针对微软旗下提供的多项在线服务，白帽子都可以直接向微软官方提交漏洞获取奖金。"}
{"title": "Bash漏洞批量检测工具与修复方案", "url": "https://www.freebuf.com/sectool/45311.html", "time": "2014-09-28", "level": "金币+9", "num_look": 783445, "num_comment": 62, "author": "ziwen", "tags": ["工具", "漏洞"], "text": "Linux官方内置Bash中新发现一个非常严重安全漏洞，黑客可以利用该Bash漏洞完全控制目标系统并发起攻击。本文提供了该漏洞的批量检测工具及最终修复方案。"}
{"title": "Bash漏洞引发僵尸网络狂欢", "url": "https://www.freebuf.com/news/45281.html", "time": "2014-09-28", "level": "红色标题", "num_look": 420974, "num_comment": 9, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "本次Bash漏洞比心脏出血漏洞更容易自动化的去攻击目标，漏洞本身的特性带来了最糟糕的情况就是蠕虫的产生，而这种担心已经得到了证实：更糟糕的情况已经发生了，僵尸网络的狂欢昨天已经开始。"}
{"title": "渗透神器合体：在BurpSuite中集成Sqlmap", "url": "https://www.freebuf.com/sectool/45239.html", "time": "2014-09-28", "level": "金币+10", "num_look": 1601912, "num_comment": 42, "author": "difcareer", "tags": ["工具"], "text": "一款集成sqlmap到burpsuite中的插件（整合两大神器），网上类似的插件对windows支持并不好，于是自己动手开发一款。"}
{"title": "2014工控系统安全态势报告（下载）", "url": "https://www.freebuf.com/articles/system/45084.html", "time": "2014-09-28", "level": "", "num_look": 440749, "num_comment": 12, "author": "绿盟科技", "tags": ["安全报告", "工控安全"], "text": "本报告可以帮助读者了解工控系统安全领域的总体发展态势，并可作为工控安全领域的主管部门、工控系统用户以及工控安全服务商在决定下一步工控安全投入时的决策参考。"}
{"title": "揭秘：如何分分钟黑掉你的eBay账号", "url": "https://www.freebuf.com/news/45166.html", "time": "2014-09-28", "level": "", "num_look": 195887, "num_comment": 5, "author": "xia0k", "tags": ["头条", "资讯"], "text": "四个月前，一位埃及的安全研究员“Yasser H. Ali’”报告了这个漏洞，而且表明这个漏洞有可能被用作有针对性的网络犯罪。下面，让我们看一下这个漏洞是怎么回事。"}
{"title": "用实际危害说话：评定产品安全性的新指标", "url": "https://www.freebuf.com/articles/security-management/44386.html", "time": "2014-09-28", "level": "", "num_look": 271813, "num_comment": 8, "author": "dawner", "tags": ["安全管理"], "text": "研究人员提出了两个新的评估指标：一个可以衡量漏洞是否得到利用，而另一个则可以衡量漏洞的利用频率。"}
{"title": "黑客游戏第二弹：The Hacker's Sandbox", "url": "https://www.freebuf.com/articles/others-articles/44863.html", "time": "2014-09-27", "level": "金币+10", "num_look": 768343, "num_comment": 62, "author": "嘎巴嘎巴", "tags": ["其他"], "text": "这是一款可使用Lua脚本来自制任务的免费黑客游戏，支持Win、Mac和Linux多平台。和很多黑客游戏一样，默认的剧情可能略有老套，但难度和娱乐性还是很平衡的。"}
{"title": "Kali将Android设备变成黑客瑞士军刀", "url": "https://www.freebuf.com/news/45079.html", "time": "2014-09-27", "level": "", "num_look": 952680, "num_comment": 24, "author": "cindy", "tags": ["资讯"], "text": "我们倾注了很大的精力开发了一款测试软件隐私和安全的工具，叫做Kali Linux。它是基于Debian操作系统并由Offensive Security公司策划和研发的，综合了渗透测试和网络监控工具的功能"}
{"title": "花边社：我眼中的ISC 2014美女排行榜", "url": "https://www.freebuf.com/news/45073.html", "time": "2014-09-27", "level": "金币+10", "num_look": 354263, "num_comment": 48, "author": "rach", "tags": ["资讯"], "text": "对于互联网圈内人来说，这两天最火热的莫过于是2014中国互联网安全大会（ISC）。废话到此为止，直接上图，为大家盘点ISC大会的各类妹子。"}
{"title": "大话Apple Pay（苹果支付）安全", "url": "https://www.freebuf.com/articles/terminal/44781.html", "time": "2014-09-26", "level": "金币+10", "num_look": 271936, "num_comment": 7, "author": "Rabbit_Run", "tags": ["终端安全", "观点"], "text": "‍‍‍‍9月10日凌晨，苹果发布了最新iPhone和其首款可穿戴设备Apple Watch。但很多分析师却认为苹果新的移动支付服务Apple Pay才是真正的“游戏改变者”。"}
{"title": "Bash远程解析命令执行漏洞测试方法", "url": "https://www.freebuf.com/vuls/44994.html", "time": "2014-09-26", "level": "金币+10", "num_look": 1369320, "num_comment": 22, "author": "wivndf", "tags": ["WEB安全", "漏洞"], "text": "从昨天开始，这个从澳大利亚远渡重洋而来的BASH远程命令执行漏洞就沸腾了整个FreeBuf，大家都在谈论，“互联网的心脏又出血了”，可是，亲，到底怎么对网站进行测试？"}
{"title": "自动化攻击测试平台Cobalt Strike v2.1（破解版）", "url": "https://www.freebuf.com/sectool/44629.html", "time": "2014-09-26", "level": "金币+10", "num_look": 272932, "num_comment": 13, "author": "Jumbo", "tags": ["工具"], "text": "Armitage是一款Java写的Metasploit图形界面的渗透测试软件，可以用它结合Metasploit已知的exploit来针对存在的漏洞自动化攻击测试。"}
{"title": "Bash漏洞报道：初步补丁并不完整", "url": "https://www.freebuf.com/news/44948.html", "time": "2014-09-26", "level": "", "num_look": 193971, "num_comment": 7, "author": "dawner", "tags": ["漏洞", "资讯"], "text": "在AusCERT（澳大利亚计算机应急响应小组）公布Bash的漏洞利用后，修补该0day已经刻不容缓。\r\n这似乎印证了某名研究员通过Yinette发布的相似成果，该研究员找出了一个恶意软件，其指向了漏洞传播的一个恶意爬虫。"}
{"title": "黑客游戏后续：从Goal游戏说起", "url": "https://www.freebuf.com/articles/others-articles/44706.html", "time": "2014-09-26", "level": "", "num_look": 200033, "num_comment": 8, "author": "凌晨几度i", "tags": ["其他", "极客"], "text": "几天前看到一个简而美的黑客编程游戏,于是乎就嚼了起来~，也拿给了同事瞅瞅。代码很简单，但是思路没有理清楚的话，就很难写出简洁的代码。理清需求，拆分大问题为小问题，是我想传达的。"}
{"title": "一周海外安全事件回顾（9.15-9.21）: 说好的分手呢？", "url": "https://www.freebuf.com/news/44839.html", "time": "2014-09-26", "level": "红色标题", "num_look": 241228, "num_comment": 7, "author": "blackscreen", "tags": ["头条", "资讯"], "text": "于是，我们逆流而上，尽管那迎面而来的潮流不断地把我们推向过去的岁月。"}
{"title": "最新Bash漏洞修补初级方案", "url": "https://www.freebuf.com/vuls/44857.html", "time": "2014-09-25", "level": "金币+10", "num_look": 271269, "num_comment": 2, "author": "evil8", "tags": ["WEB安全", "漏洞"], "text": "Bash爆出远程解析命令执行漏洞（CVE-2014-6271），波及各大Linux发行版与MacOSX系统。这里总结了修复漏洞的一些快速修复办法，包括mod_security和iptables规则。"}
{"title": "威胁远胜“心脏出血”？国外新爆Bash高危安全漏洞", "url": "https://www.freebuf.com/news/44805.html", "time": "2014-09-25", "level": "金币+15", "num_look": 700373, "num_comment": 32, "author": "凌晨几度i", "tags": ["漏洞", "资讯"], "text": "这几天Linux用户们可能不能愉快地玩耍了，红帽(Redhat)安全团队昨天爆出一个危险的Bash Shell漏洞。其带来的威胁可能比早前披露的“心脏出血”漏洞更大更强！"}
{"title": "BASH漏洞初挖掘", "url": "https://www.freebuf.com/news/44768.html", "time": "2014-09-25", "level": "", "num_look": 323285, "num_comment": 14, "author": "Feynman", "tags": ["漏洞", "资讯"], "text": "OpenSSH也因其AcceptEnv、TERM、SSH_ORIGINAL_COMMAND等环境变量受此漏洞影响。目前还有更多的受影响程序和利用方式正在不断地被发掘出来。"}
{"title": "黑客版复仇者联盟：美剧《天蝎》/《Scorpion》", "url": "https://www.freebuf.com/news/44782.html", "time": "2014-09-25", "level": "红色标题", "num_look": 411691, "num_comment": 20, "author": "cindy", "tags": ["资讯"], "text": "据称这是一个真实的故事，主人公的原型为绰号「蝎子」（即剧名）的超级黑客Walter O’Brien。他早年依靠黑客技术成名，后来成为蝎子计算机服务公司的首席执行官，为全球各地的客户提供信息服务。"}
{"title": "AutoIt木马第二发：键盘记录木马分析", "url": "https://www.freebuf.com/articles/system/44721.html", "time": "2014-09-25", "level": "金币+15", "num_look": 336924, "num_comment": 5, "author": "xia0k", "tags": ["系统安全"], "text": "近日，一种新型木马被发现，该恶意软件到目前为止已经感染了数十万计算机，而且感染是世界范围的。据称，其主要窃取被感染者的社交网络账户信息和银行账户的登录凭证。本文是关于这个木马进行的一次分析。"}
{"title": "香港壹传媒步Gmail后尘，数十万明文密码遭泄露", "url": "https://www.freebuf.com/news/44608.html", "time": "2014-09-24", "level": "", "num_look": 246635, "num_comment": 13, "author": "Datafind", "tags": ["资讯"], "text": "周二在国外某黑客论坛发现，香港媒体大亨壹传媒(nextmedia.com)数十万用户账号信息泄露，包括邮箱，明文密码和手机号在内的账户信息被发布到了论坛上。"}
{"title": "Linux内核实现多路镜像流量聚合和复制", "url": "https://www.freebuf.com/sectool/44308.html", "time": "2014-09-24", "level": "金币+15", "num_look": 380143, "num_comment": 9, "author": "linxinsnow", "tags": ["工具", "网络安全"], "text": "我们在进行安全性监控、测试的过程中，难免会遇到这样的问题：需要部署大量基于镜像流量的安全设备，如IPS，异常流量，数据库审计，流量分析等，可是交换机上可以做镜像流量的端口数量有限制，购买专业的设备又太昂…"}
{"title": "百足之虫死而不僵：Auto456家族木马的死灰复燃", "url": "https://www.freebuf.com/articles/system/44463.html", "time": "2014-09-24", "level": "", "num_look": 342221, "num_comment": 12, "author": "tianjiyun", "tags": ["系统安全", "网络安全"], "text": "这样的一个游戏大厅，必然是各路木马的兵家必争之地。于是针对456游戏大厅的各种盗号木马、远控木马也都层出不穷。作为一家互联网安全公司，我们当然也是一直在和各类木马作者不断地对抗。"}
{"title": "广告你敢点么？黑客利用Google广告大量传播恶意软件", "url": "https://www.freebuf.com/news/44524.html", "time": "2014-09-23", "level": "红色标题", "num_look": 263424, "num_comment": 6, "author": "嘎巴嘎巴", "tags": ["资讯"], "text": "黑客正在利用Google的DoubleClick和流行的Zedo广告代理来提供恶意广告，数百万的用户计算机上被安装了恶意软件。"}
{"title": "主动触发被动模式从而挟持无线客户端 – Passive Karma Attack", "url": "https://www.freebuf.com/articles/wireless/44378.html", "time": "2014-09-23", "level": "金币+15", "num_look": 432907, "num_comment": 11, "author": "radiowar", "tags": ["无线安全"], "text": "因为WIFIPineapple的真正作者Robin在近期公开了两个小工具，从而使得被动模式下的客户端被Karma挟持，所以我这个小0day思路就被公开了，所以就写写相关的原理吧，也算是一种整理吧。"}
{"title": "XSS的原理分析与解剖：第三章（技巧篇）", "url": "https://www.freebuf.com/articles/44481.html", "time": "2014-09-23", "level": "金币+15", "num_look": 781132, "num_comment": 52, "author": "Black-Hole", "tags": ["WEB安全", "文章"], "text": "说的xss的原理及不同环境的构造方法。和XSS的分类及挖掘方法。那么本期则说XSS技巧，前面两个干货不太多，讲的都是比较基础的。而这期则是满满的干货。\r\n从本期开始，XSS我就开始深入了。"}
{"title": "雅虎紧急修复了可导致远程命令执行的SQL注入漏洞", "url": "https://www.freebuf.com/news/44369.html", "time": "2014-09-23", "level": "", "num_look": 183861, "num_comment": 12, "author": "xia0k", "tags": ["漏洞", "资讯"], "text": "安全专家、渗透测试师Ebrahim Hegazy（来自的埃及的Zigoo），发现了这枚严重的SQL漏洞。漏洞允许攻击者在root权限下执行任意命令。"}
{"title": "天融信杭州分公司招聘安全产品经理", "url": "https://www.freebuf.com/jobs/44011.html", "time": "2014-09-22", "level": "", "num_look": 171355, "num_comment": 24, "author": "spinfo", "tags": ["安全招聘"], "text": ""}
{"title": "涨姿势：如何在信用卡数据泄露后保护自己", "url": "https://www.freebuf.com/news/topnews/44317.html", "time": "2014-09-22", "level": "", "num_look": 173289, "num_comment": 7, "author": "dawner", "tags": ["其他", "头条"], "text": "也许你和我一样身在天朝，对家得宝（Home Depot）闻所未闻（对不起，这货真的不是加多宝……）。但请亲不要忘记2014年携程旅行网如出一辙的的信用卡信息侧漏悲剧事件。\r\nFreeBuf相信以下姿势会对你和小伙伴们有帮助："}
{"title": "埃及开始监控本国公民的Facebook，Twitter和Skype", "url": "https://www.freebuf.com/news/44259.html", "time": "2014-09-22", "level": "", "num_look": 183153, "num_comment": 11, "author": "dawner", "tags": ["资讯"], "text": "BuzzFeed News报道说，根据一名不愿透露姓名的政府官员所述，See Egypt，正是这家脱胎于美国Blue Coat的姊妹公司,在对埃及国民的在线通讯进行监控。"}
{"title": "深度：为什么Google急着杀死加密算法SHA-1", "url": "https://www.freebuf.com/news/topnews/44288.html", "time": "2014-09-22", "level": "金币+15", "num_look": 1585609, "num_comment": 31, "author": "Rabbit_Run", "tags": ["WEB安全", "头条"], "text": "Google官方博客宣布，将在Chrome浏览器中逐渐降低SHA-1证书的安全指示。但有意思的是Google.com目前使用的也是SHA-1签名的证书，但证书将在3个月内过期，Google将从2015年起使用SHA-2签名的证书。"}
{"title": "中东石化公司遭到分布式木马Citadel攻击", "url": "https://www.freebuf.com/news/44035.html", "time": "2014-09-22", "level": "", "num_look": 161452, "num_comment": 13, "author": "嘎巴嘎巴", "tags": ["资讯"], "text": "这种有针对性的攻击使用的是流行的Citadel木马，这种木马首次发现于2012年，是基于银行木马Zeus的源代码进一步修改的。"}
{"title": "小红伞（Avira）曝严重漏洞，黑客可劫持用户账户（含视频）", "url": "https://www.freebuf.com/news/44343.html", "time": "2014-09-21", "level": "红色标题", "num_look": 326816, "num_comment": 21, "author": "pynwolf", "tags": ["漏洞", "资讯"], "text": "著名的杀毒软件小红伞Avira是一款免费的安全软件，然而其安全备份服务却存在着严重的Web应用漏洞，从而导致攻击者可以劫持用户账户，数百万用户就有可能这不小心成为了“刀俎之肉”。"}
{"title": "Adobe发布了PDF Acrobat和Reader的安全更新", "url": "https://www.freebuf.com/news/44197.html", "time": "2014-09-21", "level": "", "num_look": 157263, "num_comment": 5, "author": "cindy", "tags": ["漏洞", "资讯"], "text": "在延迟一个星期以后，Adobe 终于发布了漏洞的安全更新，这次的安全更新主要是修复Acrobat 和Reader的PDF关键漏洞。"}
{"title": "史上最大卡信息泄露事件：美国家得宝5600万信用卡信息被盗", "url": "https://www.freebuf.com/news/44209.html", "time": "2014-09-20", "level": "金币+5", "num_look": 408740, "num_comment": 20, "author": "凌晨几度i", "tags": ["资讯"], "text": "美国家得宝（Home Depot）公司已承认，几周前其支付系统遭到网络攻击，经过IT安全团队调查，此次黑客攻击最早可能始于今年4月，而到9月2号才得知这个存在许久的黑客窃密事件。而随之泄露的近5600万信用卡用户信息可…"}
{"title": "同盾科技招聘", "url": "https://www.freebuf.com/jobs/43047.html", "time": "2014-09-19", "level": "", "num_look": 356896, "num_comment": 11, "author": "同盾科技", "tags": ["安全招聘"], "text": "我们做了一个很艰难的决定：按照岗位的紧急程度，紧急程度为I级的推荐入职成功，我们送小伙伴iPhone6 一部，其他级别岗位，推荐成功送MX4 一部。"}
{"title": "观点：BAT3安全乱像点评", "url": "https://www.freebuf.com/articles/neopoints/44000.html", "time": "2014-09-19", "level": "", "num_look": 227856, "num_comment": 15, "author": "killer", "tags": ["企业安全", "观点"], "text": "近几年有个新趋势，随着资产配置的变化，WEB安全目前也被归到互联网公司的争战视野内。"}
{"title": "约你战：简而美的黑客游戏", "url": "https://www.freebuf.com/articles/others-articles/44116.html", "time": "2014-09-19", "level": "", "num_look": 304017, "num_comment": 20, "author": "凌晨几度i", "tags": ["其他", "极客"], "text": "这是一款挂载在Github的简而美小游戏，看起来似乎没什么特别之处，挑战考验你对各种编程语言的涉猎或更高层次的挖掘。"}
{"title": "Twitter最新漏洞：黑客可遍历账户删除信用卡（含视频）", "url": "https://www.freebuf.com/news/44012.html", "time": "2014-09-19", "level": "红色标题", "num_look": 266276, "num_comment": 9, "author": "xia0k", "tags": ["漏洞", "资讯"], "text": "埃及研究员Ahmed Mohamed Hassan Aboul-Ela（好长的名字…）曾为Google，Microsoft，Apple等巨头公司提交过多个漏洞。这次，他又在twitter身上斩获新的战功：twitter广告服务允许删除任意用户的信用卡信息。"}
{"title": "BoSSaBoTv2：一种自动化传播的新型僵尸网络", "url": "https://www.freebuf.com/news/44003.html", "time": "2014-09-19", "level": "", "num_look": 154335, "num_comment": 5, "author": "cindy", "tags": ["资讯"], "text": "国外安全公司Trustwave在互联网发现了一种新的僵尸网络，该僵尸网络利用老版本CGI-PHP的漏洞来进行自动化传播，Trustwave命名该僵尸网络为BoSSaBoTv2 。"}
{"title": "小解XP攻防技术", "url": "https://www.freebuf.com/articles/system/43996.html", "time": "2014-09-18", "level": "", "num_look": 265600, "num_comment": 13, "author": "killer", "tags": ["系统安全"], "text": "有一些不了解的朋友可能会问，XP保护，是不是就打开系统防火墙，配置规则，再弄几个安全策略？事实上完全不是这样的。"}
{"title": "安全扫描工具WVS Console版v1.1", "url": "https://www.freebuf.com/sectool/43837.html", "time": "2014-09-18", "level": "金币+5", "num_look": 1018440, "num_comment": 30, "author": "heiben", "tags": ["工具"], "text": ""}
{"title": "TED：互联网可能会崩溃，我们需要B计划（FreeBuf公开课）", "url": "https://www.freebuf.com/video/43984.html", "time": "2014-09-18", "level": "", "num_look": 124051, "num_comment": 3, "author": "FB视频", "tags": ["视频"], "text": "我们过度依赖互联网，虽然它现在运行比较稳定，但是未来很难说，为了以防万一，我们需要建立一个B计划，即在互联网系统崩溃时能够替代它完成一些应急的必须的工作。"}
{"title": "揭秘：职业APT攻击组织Pitty Tiger全解析", "url": "https://www.freebuf.com/news/topnews/43896.html", "time": "2014-09-18", "level": "红色标题", "num_look": 443325, "num_comment": 25, "author": "IDF_Lab", "tags": ["其他", "头条"], "text": "今天，我们决定公开一个叫做“Pitty Tigger” 的APT组织的相关信息。这片报道所涉及的资料，均是AIRBUS Defense & Space的Threat Intelligence组织的第一手信息。"}
{"title": "两枚近期IBM DB2 LUW漏洞提权分析", "url": "https://www.freebuf.com/vuls/43923.html", "time": "2014-09-18", "level": "金币+5", "num_look": 258496, "num_comment": 7, "author": "xia0k", "tags": ["数据安全", "漏洞"], "text": ""}
{"title": "有趣的个人云平台 - Sandstorm", "url": "https://www.freebuf.com/sectool/43879.html", "time": "2014-09-17", "level": "", "num_look": 342041, "num_comment": 6, "author": "cindy", "tags": ["工具"], "text": "Sandstorm 是国外一款开源的项目，它会使你用个人服务像用手机一样的简单。使用者可以使用一个简单的APP 商店安装一些像邮箱、文件编辑、博客软件等等。没有配置文件，没有命令行；所有的东西都是通过你的浏览器完…"}
{"title": "藏宝图：斯诺登公布NSA深度网络监控计划", "url": "https://www.freebuf.com/news/43836.html", "time": "2014-09-17", "level": "", "num_look": 196296, "num_comment": 9, "author": "dawner", "tags": ["资讯"], "text": "斯诺登在新提供的文档里，揭秘了美国国安局（NSA）的深度计划：“将整个网络的所有设备在任何地点、任何时间的动态都纳入监控中”。"}
{"title": "一周海外安全事件回顾（9.8-9.14）：谁动了中本聪的奶酪？", "url": "https://www.freebuf.com/news/topnews/43842.html", "time": "2014-09-17", "level": "红色标题", "num_look": 349366, "num_comment": 16, "author": "blackscreen", "tags": ["头条"], "text": "在上周，发生了一件有意思的事情，一个黑客在论坛以25比特币的价格出售比特币算法发明者Satoshi的邮箱。那么邮箱到底是不是Satoshi的呢？黑客如何拿到？还有，到底Satoshi是谁。"}
{"title": "网络犯罪：iPhone配件帮助窃取ATM密码", "url": "https://www.freebuf.com/news/43649.html", "time": "2014-09-17", "level": "金币+16", "num_look": 401899, "num_comment": 31, "author": "Rabbit_Run", "tags": ["头条", "终端安全"], "text": "在盗窃行业有一个流传很广的俏皮话。如果一个小工具能完成所有的工作，盗取ATM的PIN码简直是小意思（广东话叫:湿湿碎）。听起来像痴人说梦，到底是否成为可能？"}
{"title": "ISIS可能对美国发起大规模网络攻击", "url": "https://www.freebuf.com/news/43691.html", "time": "2014-09-17", "level": "", "num_look": 186412, "num_comment": 7, "author": "凌晨几度i", "tags": ["资讯"], "text": "极端组织ISIS和基地组织(著名恐怖主义组织曾领袖拉登)正加大努力对西方关键基础设施发动重大网络攻击。"}
{"title": "快速、直接的XSS漏洞检测爬虫 - XSScrapy", "url": "https://www.freebuf.com/sectool/43194.html", "time": "2014-09-16", "level": "金币+16", "num_look": 943819, "num_comment": 70, "author": "phper", "tags": ["工具"], "text": "XSScrapy是一个快速、直接的XSS漏洞检测爬虫，你只需要一个URL，它便可以帮助你发现XSS跨站脚本漏洞。"}
{"title": "挖iPhone 6！漏洞盒子项目上新：苏宁易购安全测试", "url": "https://www.freebuf.com/fevents/43393.html", "time": "2014-09-16", "level": "红色标题", "num_look": 262776, "num_comment": 22, "author": "漏洞盒子", "tags": ["活动"], "text": "苏宁易购是苏宁云商旗下新一代B2C综合网上购物平台。本次测试项目类型为“RANK项目「苏宁特别定制版」”，iPhone 6、iPad Air、iPad mini 等你来挖！"}
{"title": "巴西最大报社网站路由被黑，DNS遭篡改", "url": "https://www.freebuf.com/news/43578.html", "time": "2014-09-16", "level": "", "num_look": 145722, "num_comment": 1, "author": "xia0k", "tags": ["资讯"], "text": "网络安全公司SECURI发布报告称，Politica Estadao网站嵌入的iframe中夹带了一个针对家用路由器admin用户密码的暴力破解模块。"}
{"title": "ubuntu上安装Apache2+ModSecurity及自定义WAF规则", "url": "https://www.freebuf.com/articles/web/43559.html", "time": "2014-09-16", "level": "金币+16", "num_look": 533779, "num_comment": 16, "author": "碳基体", "tags": ["WEB安全"], "text": "虽然VPS使用了云WAF功能，但还是有点小担心，为了双重保险，决定使用modsecurity来定制规则，以下介绍如何为apache服务器配置ModSecurity防护罩。本文作者系FreeBuf专栏作者 @碳机体 美眉。"}
{"title": "走近科学：Android系统ROOT后有多脆弱？", "url": "https://www.freebuf.com/articles/terminal/43534.html", "time": "2014-09-15", "level": "金币+16", "num_look": 658703, "num_comment": 51, "author": "成王败寇", "tags": ["终端安全"], "text": "不知道现在有多大比例的安卓（Android）手机进行了ROOT，粗略估计不少于20%。在ROOT过的手机中，有着更多的攻击方法让防护软件无法查杀、无法报警、无法拦截，甚至都来不及惨叫一声就挂掉了。"}
{"title": "开源NAC中的佼佼者 - PacketFence", "url": "https://www.freebuf.com/sectool/43468.html", "time": "2014-09-15", "level": "金币+16", "num_look": 344698, "num_comment": 7, "author": "Nirvana", "tags": ["工具"], "text": ""}
{"title": "火眼（FireEye）实验室FLARE IDA Pro脚本系列：MSDN注释插件", "url": "https://www.freebuf.com/sectool/43334.html", "time": "2014-09-15", "level": "金币+16", "num_look": 547842, "num_comment": 22, "author": "Rabbit_Run", "tags": ["工具"], "text": "火眼实验室的高级逆向工程（简称“FLARE”）团队继续把知识和工具分享给社区。本系列博文以一个用于“自动化恢复恶意程序中的结构化字符串”的脚本作为开头。"}
{"title": "XSS编码剖析", "url": "https://www.freebuf.com/articles/web/43285.html", "time": "2014-09-15", "level": "金币+16", "num_look": 1299485, "num_comment": 38, "author": "0xExploit", "tags": ["WEB安全"], "text": "很多不了解html、js编码的童鞋遇到xss时，都是一顿乱插，姿势对了，就能获得快感，姿势不对，就么反应。另外在freebuf里，有很多文章介绍过跨站编码，有兴趣的，可以搜索下。"}
{"title": "JS投毒的另一种尝试", "url": "https://www.freebuf.com/articles/web/43353.html", "time": "2014-09-13", "level": "金币+16", "num_look": 825241, "num_comment": 27, "author": "戒贤", "tags": ["WEB安全", "网络安全"], "text": "半个月前看了‍‍‍EtherDream写的那篇wifi流量劫持和JS投毒，随手就在公司实验室里折腾了一下，头一次接触这个领域，感觉挺新鲜的。然后又看到sh4dow@lcx.cc写了一篇《内网DNS投毒技术劫持会话》，我决定把我做的东西…"}
{"title": "乌云首届安全峰会速写", "url": "https://www.freebuf.com/articles/others-articles/43320.html", "time": "2014-09-13", "level": "", "num_look": 394774, "num_comment": 70, "author": "dawner", "tags": ["其他"], "text": "乌云首届安全峰会--攻防之城，于2014年9月12日在北京召开。作为一名伪资深会棍，下面为大家分享下会议的部分情况。"}
{"title": "PHP配置安全检查工具 - PCC", "url": "https://www.freebuf.com/sectool/43191.html", "time": "2014-09-12", "level": "金币+16", "num_look": 291858, "num_comment": 17, "author": "phper", "tags": ["工具"], "text": "不少发生在PHP应用上的安全问题都是来源于PHP配置不够规范造成的，那么我们开发了一个工具脚本，可以帮助系统管理员像安全专家一样配置php.ini文件。"}
{"title": "渗透测试：内网DNS投毒技术劫持会话", "url": "https://www.freebuf.com/articles/web/43157.html", "time": "2014-09-12", "level": "金币+16", "num_look": 1229940, "num_comment": 56, "author": "Sh4dow@foxmail.com", "tags": ["WEB安全"], "text": "最近一段时间一直在研究内网中嗅探的一些方法，各种方式的尝试，才找到一个比较靠谱的一种方式。dns投毒与中间人。ARP掉线太高了。单一的ARP掉线也在10分钟内。"}
{"title": "网络罪犯：互联网丛林中的捕猎者", "url": "https://www.freebuf.com/articles/web/43207.html", "time": "2014-09-12", "level": "金币+16", "num_look": 464117, "num_comment": 14, "author": "Rabbit_Run", "tags": ["WEB安全"], "text": "网络罪犯能够部署一个强大的军火库，瞄准任何可能的目标，下至学生上至已退休的老人，追踪他们是否登录到社交网络、是否浏览最新的头条或者是否观看喜欢的视频。"}
{"title": "Apache警告：Tomcat存在远程代码执行漏洞", "url": "https://www.freebuf.com/news/43225.html", "time": "2014-09-12", "level": "", "num_look": 780916, "num_comment": 13, "author": "dawner", "tags": ["漏洞", "资讯"], "text": "在某种情况下，用户可以上传恶意JSP文件到Tomcat服务器上运行，然后执行命令。JSP的后门可以用来在服务器上任意执行命令。"}
{"title": "Linux安全审计工具Lynis 1.6.1版发布，允许低权限下检测", "url": "https://www.freebuf.com/sectool/43185.html", "time": "2014-09-11", "level": "金币+4", "num_look": 208750, "num_comment": 10, "author": "phper", "tags": ["工具"], "text": "在Lynis 1.6.1版本中我们非常高兴的告诉你：加入了新的渗透测试选项(--pentest)，允许你在低系统权限下进行安全扫描检测。"}
{"title": "京东商城诚聘安全攻城师", "url": "https://www.freebuf.com/jobs/43150.html", "time": "2014-09-11", "level": "", "num_look": 212956, "num_comment": 21, "author": "京东安全", "tags": ["安全招聘"], "text": ""}
{"title": "快讯：俄罗斯论坛曝Gmail五百万密码泄露", "url": "https://www.freebuf.com/news/43129.html", "time": "2014-09-11", "level": "金币+4", "num_look": 595643, "num_comment": 54, "author": "Xarray", "tags": ["资讯"], "text": "一份名为“google_5000000.7z”的压缩文件被泄露在一家俄罗斯比特币论坛上，文件包含了五百万的gmail用户的账号和密码。"}
{"title": "一周海外安全事件回顾（8.31-9.6）：扑朔迷离的艳照门", "url": "https://www.freebuf.com/news/topnews/43115.html", "time": "2014-09-11", "level": "红色标题", "num_look": 309211, "num_comment": 10, "author": "blackscreen", "tags": ["头条"], "text": "本文希望可以让你感受一下整个“艳照门”事件前前后后的那些有趣的人和事儿。当影星不容易，当女星更不容易，当使用苹果手机的女星更更不容易。"}
{"title": "危险的极客游戏：直流电（tDCS）刺激你的大脑", "url": "https://www.freebuf.com/geek/43083.html", "time": "2014-09-11", "level": "金币+4", "num_look": 353064, "num_comment": 13, "author": "moquns", "tags": ["极客"], "text": ""}
{"title": "全球最安全手机Blackphone的安全问题和漏洞详解", "url": "https://www.freebuf.com/news/43033.html", "time": "2014-09-10", "level": "", "num_look": 315451, "num_comment": 20, "author": "dawner", "tags": ["漏洞", "终端安全"], "text": "Blackphone,这个载体独立和供应商独立的智能手机，是以存放隐私和让用户拥有直属的权限为目标而被创造出来的，号称全球最安全手机。然而Bluebox安全团队在测试该手机时，发现并不是一无所获。"}
{"title": "常用的渗透测试工具型网站", "url": "https://www.freebuf.com/sectool/42919.html", "time": "2014-09-10", "level": "金币+4", "num_look": 915442, "num_comment": 36, "author": "howisgoing", "tags": ["WEB安全", "工具"], "text": "本着好东西大家一起分享的角度出发，给大家分享一下，我自己在渗透测试过程中经常用到的一些网站。如果大家有好的建议和补充，可以在下方留言评论。"}
{"title": "完美世界招聘信息安全工程师", "url": "https://www.freebuf.com/jobs/41956.html", "time": "2014-09-10", "level": "", "num_look": 445551, "num_comment": 29, "author": "何艺", "tags": ["安全招聘"], "text": ""}
{"title": "深入解析Cookie技术", "url": "https://www.freebuf.com/articles/web/42802.html", "time": "2014-09-10", "level": "金币+4", "num_look": 588788, "num_comment": 17, "author": "猫友", "tags": ["WEB安全"], "text": "在Web技术的发展史上，Cookie技术的出现是一次重大的 变革。但是， Cookie技术又是一项非常有争议的技术，原因不是Cookie的功能太弱，而是认为Cookie的使用会对网络用户的隐私信息构成危害。"}
{"title": "假冒版Flappy Bird：轻松从手机中窃取私照", "url": "https://www.freebuf.com/news/42912.html", "time": "2014-09-10", "level": "金币+4", "num_look": 209779, "num_comment": 15, "author": "dawner", "tags": ["资讯"], "text": "“我真特么是个天才，你们听我说，我在这个应用上改装了……”黑客集团可能使用一个仿造的Flappy Bird应用在安卓设备中手机女性的裸照，然后把它们传输到远程服务器上。"}
{"title": "FreeBuf成为中国互联网安全大会（ISC 2014）战略合作媒体", "url": "https://www.freebuf.com/news/42961.html", "time": "2014-09-09", "level": "红色标题", "num_look": 291157, "num_comment": 25, "author": "FB独家", "tags": ["活动", "资讯"], "text": "亚太最大安全盛会 - 2014中国互联网安全大会(ISC 2014)，将于2014年9月24日-25日在北京召开。FreeBuf作为 ISC 2014官方战略合作媒体，今年又将带来哪些惊喜？"}
{"title": "FB公开课录像：开源安全软件主机IDS-OSSEC的使用方式", "url": "https://www.freebuf.com/video/42951.html", "time": "2014-09-09", "level": "", "num_look": 178706, "num_comment": 4, "author": "FB视频", "tags": ["企业安全", "视频"], "text": "企业安全在一些中小公司往往没有太多的资金支持，在这样的情况下，使用一些开源软件，便是一种比较实(屌)用(丝)的选择了，本次将介绍开源安全软件主机IDS—-OSSEC的使用方式。"}
{"title": "漏洞盒子项目上新：CheckPoint下一代防火墙安全测试", "url": "https://www.freebuf.com/fevents/42926.html", "time": "2014-09-09", "level": "", "num_look": 191365, "num_comment": 26, "author": "漏洞盒子", "tags": ["活动"], "text": "CheckPoint是以色列知名安全公司，本次测试产品为CheckPoint公司下一代防火墙产品。本测试项目为RANK项目，参与测试会奖励RANK和FB金币，同时可申请CVE。漏洞详情信息将在厂商完全修复后一段时间内(遵从负责任的漏…"}
{"title": "互联网减速：Reddit、Kickstarter等顶级科技公司加入“慢行”", "url": "https://www.freebuf.com/news/42820.html", "time": "2014-09-09", "level": "", "num_look": 251919, "num_comment": 13, "author": "dawner", "tags": ["资讯"], "text": "一些大型的美国科技公司已经承诺“慢行”一天，以此抗议联邦政府增加互联网快速道和慢速道之分的决定。但是大家不用担心，这场减速运动实际上不会抑制你的上网速度。"}
{"title": "ICREACH：美国国安局（NSA）秘密制造的隐私搜索引擎", "url": "https://www.freebuf.com/news/42776.html", "time": "2014-09-09", "level": "金币+6", "num_look": 566774, "num_comment": 21, "author": "dawner", "tags": ["头条", "资讯"], "text": "美国国家安全局正在秘密向23个政府机构提供数据，其来源为一个“类谷歌”搜索引擎，它的数据库拥有超过8500亿条数据记录，包括电话号码，电子邮箱，手机地域，网络聊天信息。"}
{"title": "XSS的原理分析与解剖（第二篇）", "url": "https://www.freebuf.com/articles/web/42727.html", "time": "2014-09-09", "level": "金币+6", "num_look": 1852085, "num_comment": 51, "author": "Black-Hole", "tags": ["WEB安全"], "text": "上篇已经说明了xss的原理及不同环境的构造方法。本期来说说XSS的分类及挖掘方法。"}
{"title": "iCloud艳照门后续：看我如何人肉泄露好莱坞明星私照的幕后作者", "url": "https://www.freebuf.com/news/topnews/42570.html", "time": "2014-09-08", "level": "金币+6", "num_look": 620351, "num_comment": 40, "author": "FB情报组", "tags": ["头条"], "text": "我们不禁要问：公然窃取明星隐私公布艳照的幕后作者，究竟是何许人也？"}
{"title": "阿里巴巴安全技术竞赛ALICTF即将开赛", "url": "https://www.freebuf.com/news/others/42827.html", "time": "2014-09-07", "level": "", "num_look": 432046, "num_comment": 19, "author": "阿里巴巴", "tags": ["周边", "活动"], "text": ""}
{"title": "Passera：为每一个网站生成独一无二的强密码", "url": "https://www.freebuf.com/sectool/42740.html", "time": "2014-09-05", "level": "金币+6", "num_look": 230738, "num_comment": 22, "author": "phper", "tags": ["工具"], "text": "一个简单的工具就可以让你为每个网站生成一个强壮的密码？它不需要本地存储，也不需要在线的服务，而是以一个Linux/Mac/Windows和Android App的形态——它就是Passera。"}
{"title": "使用Xenotix_XSS框架进行自动化安全测试", "url": "https://www.freebuf.com/sectool/42722.html", "time": "2014-09-05", "level": "金币+6", "num_look": 483463, "num_comment": 16, "author": "0xExploit", "tags": ["WEB安全", "工具"], "text": "本文简单的介绍Xenotix_XSS框架常用的xss测试自动测试工具，可以用于对页面进行自动扫描。"}
{"title": "加密通讯可以防止隐私窃取，为何我们都不用它？", "url": "https://www.freebuf.com/articles/network/42692.html", "time": "2014-09-05", "level": "金币+6", "num_look": 351785, "num_comment": 13, "author": "常运", "tags": ["网络安全"], "text": "计算机程序员们知道如何创建加密系统，防止包括美国政府在内的任何人破解。那么为何美国国安局仍然可以读取你的私人电邮内容？"}
{"title": "解密BadUSB：世界上最邪恶的USB外设", "url": "https://www.freebuf.com/articles/terminal/42616.html", "time": "2014-09-05", "level": "金币+6", "num_look": 1410585, "num_comment": 47, "author": "Rabbit_Run", "tags": ["终端安全"], "text": "在2014年美国黑帽大会上，柏林SRLabs的安全研究人员展示了他们称为“BadUSB”的攻击方法，这种攻击方法让USB安全和几乎所有和USB相关的设备都陷入危险的状态。"}
{"title": "CDN服务商Akamai警告Linux主机成为DDoS攻击僵尸网络", "url": "https://www.freebuf.com/news/42646.html", "time": "2014-09-04", "level": "金币+6", "num_look": 293177, "num_comment": 18, "author": "phper", "tags": ["资讯"], "text": "著名CDN服务商昨天Akamai发出警告，黑客利用入侵的Linux服务器感染IptabLes及IptabLex病毒，使之成为僵尸网络并对娱乐业企业发动DDoS攻击。"}
{"title": "瞅一瞅Andromeda僵尸网络", "url": "https://www.freebuf.com/articles/system/42408.html", "time": "2014-09-04", "level": "", "num_look": 246213, "num_comment": 8, "author": "IDF_Lab", "tags": ["系统安全"], "text": "Andromeda是一个模块化的bot。最原始的bot仅包含一个加载器，在其运行期间会从C&C服务器上下载相关模块和更新，它同时也拥有反虚拟机和反调试的功能。它会注入到可信进程中来隐藏自己，然后删除原始的bots。"}
{"title": "Android App安全加固行业分析报告", "url": "https://www.freebuf.com/articles/terminal/42525.html", "time": "2014-09-04", "level": "", "num_look": 536405, "num_comment": 22, "author": "SecurityMan", "tags": ["安全报告", "终端安全"], "text": ""}
{"title": "视频：俄罗斯黑客窃取12亿互联网密码事件，谁该为用户负责？", "url": "https://www.freebuf.com/video/42464.html", "time": "2014-09-04", "level": "红色标题", "num_look": 226754, "num_comment": 5, "author": "FB视频", "tags": ["视频"], "text": "至今仍然没有企业站出来对外宣布自己的用户数据被盗，有的只是各媒体的连篇报道。小编不禁疑问，这次事件中遭窃的数据到底是哪些数据？为何迟迟没有企业公开宣称用户数据失窃？到底谁才应该为这次事件负责呢？"}
{"title": "500彩票网招聘安全工程师", "url": "https://www.freebuf.com/jobs/42529.html", "time": "2014-09-03", "level": "", "num_look": 410401, "num_comment": 28, "author": "500彩票网", "tags": ["安全招聘"], "text": ""}
{"title": "Android平台渗透测试套件zANTI 2.0版发布", "url": "https://www.freebuf.com/sectool/42487.html", "time": "2014-09-03", "level": "金币+6", "num_look": 342450, "num_comment": 24, "author": "wmxk007", "tags": ["工具"], "text": ""}
{"title": "Hold安全公司公布俄罗斯大型泄密事件细节", "url": "https://www.freebuf.com/news/42458.html", "time": "2014-09-03", "level": "金币+6", "num_look": 339033, "num_comment": 10, "author": "dawner", "tags": ["资讯"], "text": "Hold安全公司一直在安全界和情报界保持低调，然而，在盯上该俄罗斯犯罪团伙数据泄露后，该公司已经耗费了大量精力，他们无疑会抓住这次机会。"}
{"title": "内网中使用metasploit进行渗透测试", "url": "https://www.freebuf.com/articles/web/42208.html", "time": "2014-09-03", "level": "", "num_look": 1231094, "num_comment": 40, "author": "lshack", "tags": ["WEB安全"], "text": ""}
{"title": "RFID安全审计工具集合 - RadioEye", "url": "https://www.freebuf.com/sectool/42170.html", "time": "2014-09-02", "level": "金币+14", "num_look": 391599, "num_comment": 20, "author": "lenny", "tags": ["工具", "极客"], "text": "RFID RadioEye（http://radioeye.sinaapp.com/​）是一款基于Libnfc开源组件的RFID安全审计工具，主要功能有：卡ID读写、卡数据读写、卡片破解、dump文件导入导出与上传下载。"}
{"title": "POS机恶意程序Backoff影响超过1000家美国企业", "url": "https://www.freebuf.com/news/42169.html", "time": "2014-09-02", "level": "金币+14", "num_look": 186551, "num_comment": 5, "author": "dawner", "tags": ["资讯"], "text": ""}
{"title": "走近科学：如何搞定各种各样的终端机", "url": "https://www.freebuf.com/news/topnews/42295.html", "time": "2014-09-02", "level": "金币+14", "num_look": 1169041, "num_comment": 81, "author": "p0tt1", "tags": ["头条", "极客"], "text": "之前笔者在微信上经常曝光一些搞定的终端机的图片，引起了大家的兴趣，当然了，每次搞定的方法都不一样，并且手机回复大家挨个回复过程实在是有够XO，于是乎有了此文。"}
{"title": "一张图告诉你如何对抗DDoS攻击", "url": "https://www.freebuf.com/articles/network/42321.html", "time": "2014-09-02", "level": "", "num_look": 390949, "num_comment": 14, "author": "绿盟科技", "tags": ["网络安全"], "text": ""}
{"title": "全新的体验与功能：漏洞盒子V2.0上线", "url": "https://www.freebuf.com/news/42273.html", "time": "2014-09-01", "level": "红色标题", "num_look": 262499, "num_comment": 13, "author": "漏洞盒子", "tags": ["资讯"], "text": "漏洞盒子是FreeBuf旗下的互联网安全测试平台，V1.0上线后短短两个月即交出了令人振奋的成绩单。现在，漏洞盒子V2.0来了！"}
{"title": "一周海外安全事件回顾（8.24-8.30）", "url": "https://www.freebuf.com/news/topnews/42231.html", "time": "2014-09-01", "level": "金币+14", "num_look": 285063, "num_comment": 10, "author": "blackscreen", "tags": ["头条"], "text": ""}
{"title": "韩国数据泄露达到2700万，半数韩国人躺枪", "url": "https://www.freebuf.com/news/42140.html", "time": "2014-09-01", "level": "金币+14", "num_look": 303245, "num_comment": 35, "author": "dawner", "tags": ["资讯"], "text": ""}
{"title": "观点：CloudFlare保护下的网络数据绝对不会外泄吗？", "url": "https://www.freebuf.com/articles/neopoints/42171.html", "time": "2014-09-01", "level": "金币+14", "num_look": 371701, "num_comment": 66, "author": "j4n", "tags": ["观点"], "text": ""}
{"title": "支持多代理的攻击测试框架 - MultiProxies", "url": "https://www.freebuf.com/sectool/42103.html", "time": "2014-09-01", "level": "金币+14", "num_look": 427633, "num_comment": 34, "author": "DM_", "tags": ["工具"], "text": ""}
{"title": "FreeBuf茶话会（第一期）现场图集", "url": "https://www.freebuf.com/fevents/42187.html", "time": "2014-08-31", "level": "红色标题", "num_look": 448593, "num_comment": 41, "author": "FB独家", "tags": ["活动"], "text": "本周六（8月30日）进行的「FreeBuf茶话会」第一期围绕DDOS攻击防御和移动支付这两个主题展开。同时，借此Party的机会，FreeBuf也公布了旗下产品漏洞盒子V2.0预告。"}
{"title": "漏洞科普：你对弱口令重视吗？", "url": "https://www.freebuf.com/articles/web/42120.html", "time": "2014-08-30", "level": "金币+14", "num_look": 971008, "num_comment": 34, "author": "猫友", "tags": ["WEB安全"], "text": ""}
{"title": "关于乌云安全峰会的初衷和进展", "url": "https://www.freebuf.com/fevents/41998.html", "time": "2014-08-30", "level": "", "num_look": 218243, "num_comment": 25, "author": "5d1@WooYun", "tags": ["活动"], "text": ""}
{"title": "FaceBook悬赏50000美元奖励互联网安全防御项目", "url": "https://www.freebuf.com/news/41990.html", "time": "2014-08-29", "level": "", "num_look": 145343, "num_comment": 7, "author": "dawner", "tags": ["资讯"], "text": "正因为有一个让世界每人都接入互联网大家庭的梦想，Facebook的创始人马克扎克伯格致力于让互联网变得更加安全。"}
{"title": "HackForums又被黑了", "url": "https://www.freebuf.com/news/41980.html", "time": "2014-08-29", "level": "金币+14", "num_look": 899866, "num_comment": 22, "author": "moquns", "tags": ["资讯"], "text": "没错，Hackforums——地面上最流行的黑客论坛之一，近日又被黑了，这次是来自埃及的黑客Eg-R1z，并且首页被挂上黑页。"}
{"title": "正确姿势：如何调戏蹭网者", "url": "https://www.freebuf.com/articles/web/41504.html", "time": "2014-08-29", "level": "金币+14", "num_look": 1642686, "num_comment": 59, "author": "linvex", "tags": ["WEB安全"], "text": "这篇文章本来是知乎回答的一个问题，但是由于本人五行缺勤奋，所以一直没写（其实是忘了=。=），下面是我的一个实验，如何通过squid调戏那些蹭网的人。没什么技术含量，请大牛不要笑话～"}
{"title": "Netcore路由器存在后门，任何人可远程登陆", "url": "https://www.freebuf.com/news/41940.html", "time": "2014-08-28", "level": "金币+5", "num_look": 697195, "num_comment": 24, "author": "hxdef_tiffany", "tags": ["漏洞", "资讯"], "text": "趋势科技研究人员昨日在官网表示，由中国生产商生产的一系列路由器含有一个严重漏洞，黑客可通过该漏洞监视用户的互联网流量。路由器在中国的品牌名为Netcore，在国外的品牌名为Netis。"}
{"title": "研究人员以92%的成功率劫持Gmail应用", "url": "https://www.freebuf.com/news/41898.html", "time": "2014-08-28", "level": "金币+5", "num_look": 325440, "num_comment": 5, "author": "dawner", "tags": ["资讯"], "text": "加州大学河滨分校一支研究团队能够以高达92%的成功率黑入应用程序。它在所测试的七个中有六个流行应用中具有82%~92%的成功率。在这些应用中，Gmail、大通银行和H&R Block被轻松秒杀。"}
{"title": "一次Wi-Fi入侵实录", "url": "https://www.freebuf.com/articles/wireless/41879.html", "time": "2014-08-28", "level": "金币+5", "num_look": 6667781, "num_comment": 121, "author": "lanwellon", "tags": ["无线安全"], "text": "笔者希望能够通过本文，以一个作者搭建的Wi-Fi入侵实例，来分层次梳理说明Wi-Fi入侵的先后顺序和层级，从而引出各类防护的手段的运作方式。"}
{"title": "信息泄露的幽灵", "url": "https://www.freebuf.com/articles/web/41565.html", "time": "2014-08-28", "level": "金币+5", "num_look": 201290, "num_comment": 6, "author": "Rabbit_Run", "tags": ["WEB安全"], "text": ""}
{"title": "揭秘“食鼠猫”病毒背后的灰色产业链", "url": "https://www.freebuf.com/news/topnews/41797.html", "time": "2014-08-27", "level": "金币+5", "num_look": 413608, "num_comment": 31, "author": "snowlee", "tags": ["头条", "系统安全"], "text": "“食鼠猫”样本作为典型的推广类病毒，对于当前国内病毒传播的流行形势具有一定的代表性。本文尝试通过对样本行为、传播源头的相关分析，溯源追踪其幕后黑手，揭露国内流氓推广类病毒传播与牟利的灰色产业链。"}
{"title": "揭秘：俄罗斯黑客如何盗取12亿用户密码（中文视频）", "url": "https://www.freebuf.com/articles/database/41704.html", "time": "2014-08-27", "level": "", "num_look": 317477, "num_comment": 15, "author": "FB视频", "tags": ["数据安全", "视频"], "text": ""}
{"title": "上市游戏公司招聘系统网络安全工程师", "url": "https://www.freebuf.com/jobs/41561.html", "time": "2014-08-27", "level": "", "num_look": 243971, "num_comment": 32, "author": "xocoder", "tags": ["安全招聘"], "text": ""}
{"title": "我是如何黑掉英国间谍软件公司Gamma的", "url": "https://www.freebuf.com/articles/web/41809.html", "time": "2014-08-27", "level": "金币+5", "num_look": 842805, "num_comment": 21, "author": "浪迹天涯", "tags": ["WEB安全", "系统安全"], "text": "本文来源于黑客自己公布的入侵指南。详细的介绍了从信息收集，到发现目标站点，以及进行源码审计，绕过waf注入，尝试提权服务器的整个过程。"}
{"title": "小米手机MIUI远程代码执行漏洞分析", "url": "https://www.freebuf.com/vuls/41735.html", "time": "2014-08-26", "level": "金币+5", "num_look": 282173, "num_comment": 13, "author": "嘎巴嘎巴", "tags": ["漏洞", "终端安全"], "text": "7月我在研究webview漏洞时专门挑小米手机的MIUI测试了下,发现了非常明显的安全漏洞。通过该漏洞可以远程获取本地APP的权限，突破本地漏洞和远程漏洞的界限。"}
{"title": "VMProtect完全解析之TLS", "url": "https://www.freebuf.com/articles/terminal/41489.html", "time": "2014-08-26", "level": "金币+5", "num_look": 437777, "num_comment": 11, "author": "cxh852456", "tags": ["终端安全"], "text": ""}
{"title": "CloudFlare防护下的破绽：寻找真实IP的几条途径", "url": "https://www.freebuf.com/articles/web/41533.html", "time": "2014-08-26", "level": "金币+5", "num_look": 3221598, "num_comment": 29, "author": "职业投稿人", "tags": ["WEB安全", "观点"], "text": "看Twitter发现CloudFlare总裁什么的最近很高调，北京、香港的跑着参加会议、发表演说什么的，CloudFlare似乎也没那么牛逼吧。"}
{"title": "极限黑客破解：低温环境下读取Android加密数据", "url": "https://www.freebuf.com/articles/terminal/41560.html", "time": "2014-08-26", "level": "金币+5", "num_look": 322753, "num_comment": 28, "author": "麻花藤", "tags": ["极客", "终端安全"], "text": "通过将手机冷却到零下15摄氏度左右，并迅速重启设备，便可读取其中的数据，包括图像、电子邮件、网页浏览历史记录等，更关键的是可在某些特定情况下解密手机的加密存储磁盘！"}
{"title": "走近科学：二维码真的安全吗", "url": "https://www.freebuf.com/news/topnews/41643.html", "time": "2014-08-26", "level": "", "num_look": 885289, "num_comment": 26, "author": "夏克霆", "tags": ["WEB安全", "头条"], "text": "由于二维码技术已经相对成熟，普通用户即可通过网上的二维码转换软件，任意合成二维码，并且从外观上并不能判断其安全性，这就更加方便了黑客针对二维码进行各种非法操作。"}
{"title": "台湾黑客年会HITCON 2014全纪实", "url": "https://www.freebuf.com/news/topnews/41584.html", "time": "2014-08-25", "level": "红色标题", "num_look": 442884, "num_comment": 40, "author": "FB独家", "tags": ["头条"], "text": "把字里行间的台湾，大荧幕上的台湾，小耳机中的台湾，林林总总加在一起，拼凑出对这南国的最初印象，然后带着最好的期许，出发。"}
{"title": "美研究人员发现劫持交通灯其实非常简单", "url": "https://www.freebuf.com/news/41467.html", "time": "2014-08-25", "level": "金币+5", "num_look": 192194, "num_comment": 25, "author": "phper", "tags": ["资讯"], "text": ""}
{"title": "TP-Link网络摄像机的多个漏洞详细分析", "url": "https://www.freebuf.com/articles/system/41479.html", "time": "2014-08-25", "level": "金币+5", "num_look": 310996, "num_comment": 5, "author": "天才布衣", "tags": ["系统安全"], "text": ""}
{"title": "趋势科技发现支付宝安卓版漏洞", "url": "https://www.freebuf.com/articles/terminal/41482.html", "time": "2014-08-25", "level": "金币+4", "num_look": 213250, "num_comment": 8, "author": "趋势科技", "tags": ["终端安全"], "text": ""}
{"title": "黑客落网记：FBI如何抓捕Anonymous核心成员", "url": "https://www.freebuf.com/news/41471.html", "time": "2014-08-24", "level": "金币+4", "num_look": 236904, "num_comment": 21, "author": "hi246", "tags": ["资讯"], "text": "美国新闻网站Daily Dot近日撰文，通过他们掌握的资料和实地采访，还原了全美第一黑客组织Anonymous核心成员被捕的经过。"}
{"title": "CloudFlare：香港PopVote史无前例DDoS攻击事件全解析", "url": "https://www.freebuf.com/articles/system/41460.html", "time": "2014-08-24", "level": "金币+4", "num_look": 602483, "num_comment": 18, "author": "phper", "tags": ["系统安全"], "text": "CloudFlare CEO Matthew Prince于8月19日在台湾黑客年会HITCON上首度公开了他们在香港防御DDoS攻击的过程。"}
{"title": "FreeBuf公开课（直播课程）：开源安全软件主机IDS-OSSEC的使用方式", "url": "https://www.freebuf.com/fevents/41419.html", "time": "2014-08-22", "level": "", "num_look": 214107, "num_comment": 4, "author": "FB独家", "tags": ["企业安全", "活动"], "text": ""}
{"title": "中国Hacker再显神威：劫持越狱IOS设备广告并获利", "url": "https://www.freebuf.com/news/41357.html", "time": "2014-08-22", "level": "金币+4", "num_look": 418552, "num_comment": 13, "author": "moquns", "tags": ["无线安全", "资讯"], "text": ""}
{"title": "走进科学：如何正确的隐藏自己的行踪", "url": "https://www.freebuf.com/news/topnews/41092.html", "time": "2014-08-22", "level": "金币+4", "num_look": 684454, "num_comment": 24, "author": "redsin", "tags": ["头条"], "text": "大家好！我发现很多新人在讨论 “匿名”，所以我想我该写一篇清晰讲解它的教程，无论你是否能够隐藏自己。"}
{"title": "中国黑客被指责曝光了450万患者的信息", "url": "https://www.freebuf.com/news/41334.html", "time": "2014-08-22", "level": "金币+4", "num_look": 205647, "num_comment": 15, "author": "嘎巴嘎巴", "tags": ["资讯"], "text": ""}
{"title": "下一代远程控制木马的思路探讨", "url": "https://www.freebuf.com/articles/system/41241.html", "time": "2014-08-22", "level": "金币+4", "num_look": 705955, "num_comment": 37, "author": "李雪主", "tags": ["系统安全"], "text": ""}
{"title": "Robin Williams死亡下的网络犯罪", "url": "https://www.freebuf.com/news/41301.html", "time": "2014-08-21", "level": "金币+4", "num_look": 134633, "num_comment": 2, "author": "moquns", "tags": ["资讯"], "text": ""}
{"title": "百度诚邀安全业界同仁参加2014百度世界安全论坛", "url": "https://www.freebuf.com/news/others/41281.html", "time": "2014-08-21", "level": "", "num_look": 269696, "num_comment": 13, "author": "c0debreak", "tags": ["周边", "活动"], "text": ""}
{"title": "ossec tips - 让报警显示ip所在地", "url": "https://www.freebuf.com/articles/system/41011.html", "time": "2014-08-21", "level": "金币+4", "num_look": 232552, "num_comment": 9, "author": "willson", "tags": ["系统安全"], "text": ""}
{"title": "Discuz 5.x/6.x/7.x投票SQL注入分析", "url": "https://www.freebuf.com/articles/web/41287.html", "time": "2014-08-21", "level": "金币+4", "num_look": 374241, "num_comment": 9, "author": "diroverflow", "tags": ["WEB安全"], "text": ""}
{"title": "论如何高效的挖掘漏洞", "url": "https://www.freebuf.com/articles/neopoints/41168.html", "time": "2014-08-20", "level": "金币+4", "num_look": 1116741, "num_comment": 44, "author": "Black-Hole", "tags": ["观点"], "text": ""}
{"title": "自动化攻击测试平台Cobalt Strike 2.0.49破解版", "url": "https://www.freebuf.com/sectool/41031.html", "time": "2014-08-20", "level": "金币+4", "num_look": 550513, "num_comment": 44, "author": "legendsec", "tags": ["工具"], "text": ""}
{"title": "简单破解Java浏览器组件jxbrowser", "url": "https://www.freebuf.com/articles/web/41112.html", "time": "2014-08-20", "level": "金币+4", "num_look": 859134, "num_comment": 22, "author": "leopard7777777", "tags": ["WEB安全"], "text": ""}
{"title": "OWASP 2014应用安全论坛(中国互联网大会Web与应用安全分论坛)议程", "url": "https://www.freebuf.com/articles/web/41189.html", "time": "2014-08-19", "level": "", "num_look": 289530, "num_comment": 5, "author": "OWASP中国", "tags": ["WEB安全", "活动"], "text": ""}
{"title": "使用Python进行TCP数据包注入（伪造）", "url": "https://www.freebuf.com/articles/network/41127.html", "time": "2014-08-19", "level": "金币+7", "num_look": 1088837, "num_comment": 19, "author": "moquns", "tags": ["网络安全"], "text": ""}
{"title": "FreeBuf茶话会：小而美的线下沙龙", "url": "https://www.freebuf.com/fevents/41106.html", "time": "2014-08-19", "level": "红色标题", "num_look": 310971, "num_comment": 23, "author": "FB客服", "tags": ["活动"], "text": ""}
{"title": "NSA黑客团队手抖，叙利亚举国断网三日", "url": "https://www.freebuf.com/news/41021.html", "time": "2014-08-18", "level": "金币+7", "num_look": 228349, "num_comment": 22, "author": "pynwolf", "tags": ["资讯"], "text": ""}
{"title": "针对数个前苏联国家使馆的网络间谍活动", "url": "https://www.freebuf.com/news/40918.html", "time": "2014-08-18", "level": "金币+7", "num_look": 168019, "num_comment": 4, "author": "子夏", "tags": ["资讯"], "text": ""}
{"title": "CoolShell解密游戏的WriteUp", "url": "https://www.freebuf.com/news/others/40950.html", "time": "2014-08-18", "level": "", "num_look": 354508, "num_comment": 11, "author": "pynwolf", "tags": ["其他", "周边"], "text": ""}
{"title": "台湾骇客团队HITCON夺全球骇客大赛亚军", "url": "https://www.freebuf.com/news/41043.html", "time": "2014-08-18", "level": "", "num_look": 262146, "num_comment": 8, "author": "FB独家", "tags": ["周边", "资讯"], "text": ""}
{"title": "QQ蠕虫的行为检测方法", "url": "https://www.freebuf.com/articles/system/40828.html", "time": "2014-08-17", "level": "", "num_look": 220452, "num_comment": 10, "author": "Nandisec", "tags": ["系统安全"], "text": "这种蠕虫诞生于QQ体系之上，其影响和传播主要集中在国内地区，因此国外品牌的杀软对这类蠕虫识别和支持非常有限，国内的杀软品牌对该蠕虫检测也不是特别理想。"}
{"title": "BitTorrent Bleep：无法被监控的聊天软件", "url": "https://www.freebuf.com/news/40907.html", "time": "2014-08-16", "level": "金币+7", "num_look": 604957, "num_comment": 41, "author": "phper", "tags": ["工具", "资讯"], "text": ""}
{"title": "比特儿(Bter.com) 比特币交易平台被盗事件全解析", "url": "https://www.freebuf.com/news/topnews/40926.html", "time": "2014-08-15", "level": "金币+7", "num_look": 1206081, "num_comment": 51, "author": "fu4k", "tags": ["WEB安全", "其他"], "text": "比特儿(Bter.com) 比特币交易平台NXT中心账号被黑，黑客盗走5000万NXT，价值1000万人民币。"}
{"title": "漏洞盒子项目上新：360手机安全卫士APP安全测试", "url": "https://www.freebuf.com/fevents/40889.html", "time": "2014-08-15", "level": "红色标题", "num_look": 305073, "num_comment": 16, "author": "FB客服", "tags": ["活动"], "text": "360手机卫士是一款免费的手机安全软件。360手机安全卫士与FreeBuf旗下产品“漏洞盒子（vulbox.com）”达成合作协议，由漏洞盒子的白帽子测试其APP的安全性。下周一准时开启！现金奖励之外，本次测试还有神秘礼物相送…"}
{"title": "Linux蜜罐系统HoneyDrive 3版本发布", "url": "https://www.freebuf.com/sectool/40865.html", "time": "2014-08-15", "level": "金币+7", "num_look": 528361, "num_comment": 23, "author": "H3lvin", "tags": ["工具"], "text": ""}
{"title": "易宝支付招聘信息安全工程师", "url": "https://www.freebuf.com/jobs/40655.html", "time": "2014-08-15", "level": "", "num_look": 254870, "num_comment": 19, "author": "willson", "tags": ["安全招聘"], "text": ""}
{"title": "Worldview-3卫星：从太空看见你的脸", "url": "https://www.freebuf.com/news/40820.html", "time": "2014-08-15", "level": "金币+7", "num_look": 247554, "num_comment": 16, "author": "子夏", "tags": ["资讯"], "text": ""}
{"title": "趋势OfficeScan系列产品漏洞分析", "url": "https://www.freebuf.com/vuls/40733.html", "time": "2014-08-14", "level": "金币+7", "num_look": 554583, "num_comment": 24, "author": "ShadowKeeper", "tags": ["漏洞", "系统安全"], "text": ""}
{"title": "基于HTML5的Canvas指纹跟踪技术", "url": "https://www.freebuf.com/news/40745.html", "time": "2014-08-14", "level": "金币+7", "num_look": 757689, "num_comment": 17, "author": "pynwolf", "tags": ["终端安全", "资讯"], "text": ""}
{"title": "隐忍的黑客宁愿用寻呼机也不用智能手机", "url": "https://www.freebuf.com/news/40671.html", "time": "2014-08-13", "level": "金币+7", "num_look": 296009, "num_comment": 18, "author": "Mystery", "tags": ["资讯"], "text": "Dan Geer在接受采访时说，他不携带手机，认为手机是一种讨厌的东西，虽然它可能对那些做事没提前规划的人有点帮助。"}
{"title": "英国间谍软件公司Gamma遭入侵，黑客公布入侵指南", "url": "https://www.freebuf.com/news/40689.html", "time": "2014-08-13", "level": "金币+6", "num_look": 723164, "num_comment": 38, "author": "phper", "tags": ["资讯"], "text": "Gamma Group International是一家专门贩卖间谍软件给政府和警察机构的欧洲公司。一周前，一名黑客入侵了Gamma公司内网，公开了40GB的内部文档和恶意程序源代码，并发布了一篇入侵指南。"}
{"title": "VirTest5.0特征码定位器（开源）", "url": "https://www.freebuf.com/sectool/40580.html", "time": "2014-08-13", "level": "金币+6", "num_look": 612073, "num_comment": 30, "author": "vscen", "tags": ["工具"], "text": "目前比较常有名气的特征码定位器主要有CCL与MYCCL，他们都采用文件分块定位的办法，定位效果带有运气成份，且可能每次定位出的位置都不尽相同，这个免杀带来了困难。研究杀毒软件特征代码时日渐久，慢慢认识到这样…"}
{"title": "2014 ISCC 赛题总结之密码学", "url": "https://www.freebuf.com/articles/others-articles/40471.html", "time": "2014-08-13", "level": "金币+6", "num_look": 562187, "num_comment": 16, "author": "X-man", "tags": ["其他"], "text": ""}
{"title": "同盾科技获A+轮千万美元投资，专注解决网络欺诈风险", "url": "https://www.freebuf.com/news/40571.html", "time": "2014-08-12", "level": "", "num_look": 177110, "num_comment": 11, "author": "同盾科技", "tags": ["资讯"], "text": "杭州同盾科技由前阿里集团安全部技术总监蒋韬先生创立，整个创始团队基本由前阿里及 PayPal的反网络欺诈科学家和技术高管组建而成。"}
{"title": "安全研究人员证实小米手机发送用户隐私信息", "url": "https://www.freebuf.com/news/40561.html", "time": "2014-08-12", "level": "", "num_look": 491500, "num_comment": 33, "author": "moquns", "tags": ["资讯"], "text": ""}
{"title": "XSS的原理分析与解剖", "url": "https://www.freebuf.com/articles/web/40520.html", "time": "2014-08-12", "level": "金币+6", "num_look": 4488971, "num_comment": 130, "author": "Black-Hole", "tags": ["WEB安全"], "text": "《xss攻击手法》一开始在互联网上资料并不多(都是现成的代码，没有从基础的开始)，直到刺的《白帽子讲WEB安全》和cn4rry的《XSS跨站脚本攻击剖析与防御》才开始好转。"}
{"title": "OWASP 2014应用安全论坛报名启动", "url": "https://www.freebuf.com/fevents/40317.html", "time": "2014-08-12", "level": "", "num_look": 171051, "num_comment": 9, "author": "OWASP中国", "tags": ["活动"], "text": ""}
{"title": "揭秘渗透测试利器：Webshell批量管理工具QuasiBot", "url": "https://www.freebuf.com/sectool/40411.html", "time": "2014-08-12", "level": "金币+6", "num_look": 761105, "num_comment": 22, "author": "phper", "tags": ["WEB安全", "工具"], "text": "QuasiBot是一款php编写的webshell管理工具，可以对webshell进行远程批量管理。这个工具超越于普通的webshell管理是因为其还拥有安全扫描、漏洞利用测试等功能，可以帮助渗透测试人员进行高效的测试工作。"}
{"title": "全球最安全手机Blackphone五分钟遭破解", "url": "https://www.freebuf.com/news/40523.html", "time": "2014-08-12", "level": "", "num_look": 228014, "num_comment": 23, "author": "linso", "tags": ["资讯"], "text": ""}
{"title": "BlackHat：手机运营商软件发现严重漏洞，影响20亿移动设备", "url": "https://www.freebuf.com/news/40443.html", "time": "2014-08-11", "level": "", "num_look": 155373, "num_comment": 7, "author": "xuhao", "tags": ["资讯"], "text": ""}
{"title": "漏洞盒子项目上新：去哪儿网站及APP安全测试", "url": "https://www.freebuf.com/fevents/40230.html", "time": "2014-08-11", "level": "红色标题", "num_look": 293139, "num_comment": 20, "author": "漏洞盒子", "tags": ["活动"], "text": "去哪儿是中国领先的旅游搜索引擎，目前全球最大的中文在线旅行网站，创立于2005年2月，总部在北京。此次测试目标为去哪儿WEB网站（含子域名）以及官方手机APP。"}
{"title": "FireEye系统上如何获得root权限", "url": "https://www.freebuf.com/articles/system/40460.html", "time": "2014-08-11", "level": "金币+6", "num_look": 263068, "num_comment": 11, "author": "litdg", "tags": ["系统安全"], "text": ""}
{"title": "隐藏在注册表的恶意软件 - Poweliks", "url": "https://www.freebuf.com/news/40426.html", "time": "2014-08-11", "level": "金币+6", "num_look": 322597, "num_comment": 22, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "应用层慢速DoS攻击压力测试工具 - SlowHTTPTest", "url": "https://www.freebuf.com/sectool/40413.html", "time": "2014-08-10", "level": "金币+6", "num_look": 599264, "num_comment": 17, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "Geek改变世界", "url": "https://www.freebuf.com/articles/neopoints/40415.html", "time": "2014-08-09", "level": "红色标题", "num_look": 333934, "num_comment": 17, "author": "道哥", "tags": ["观点"], "text": ""}
{"title": "巴勒斯坦黑客为保家卫国入侵以色列电视台（视频）", "url": "https://www.freebuf.com/news/40331.html", "time": "2014-08-09", "level": "金币+6", "num_look": 165606, "num_comment": 12, "author": "pynwolf", "tags": ["资讯"], "text": "近日，有哈马斯（Hamas）的黑客声称成功对以色列电视10频道进行程序破解，并植入了一段未预定的电视信息，“呼吁”以色列结束空袭。"}
{"title": "TED：追踪你的跟踪者（FreeBuf公开课）", "url": "https://www.freebuf.com/video/40334.html", "time": "2014-08-08", "level": "", "num_look": 1604257, "num_comment": 17, "author": "FB视频", "tags": ["视频"], "text": "讲师Gary Kovacs通过一个Firefox扩展应用展示当我们上网时，在被多少网站“跟踪”。“他们”甚至连儿童都不肯放过。意识到我们的网络隐私有多么的不安全了么？"}
{"title": "数千万WordPress和Drupal站点存在DDoS风险", "url": "https://www.freebuf.com/news/40284.html", "time": "2014-08-08", "level": "金币+5", "num_look": 330960, "num_comment": 22, "author": "嘎巴嘎巴", "tags": ["漏洞", "资讯"], "text": "近日白帽子Nir goldshlager发现了WordPress和Drupal存在DDoS攻击风险，受影响的版本为WordPress 3.5 – 3.9和Drupal 6.x – 7.x，根据为维基百科的数据，使用WordPress的站点可能超过6千万，更有超过100万的Drupal网…"}
{"title": "俄罗斯黑客团伙窃取了超过10亿互联网密码", "url": "https://www.freebuf.com/news/40269.html", "time": "2014-08-07", "level": "金币+5", "num_look": 204052, "num_comment": 16, "author": "phper", "tags": ["资讯"], "text": "安全公司Hold Security的研究人员称，俄罗斯黑客借助SQL注入攻击从42万个网站窃取了12亿用户名和密码。"}
{"title": "FB公开课录像：隐蔽通信（FQ）和侦查取证那些事儿", "url": "https://www.freebuf.com/video/40500.html", "time": "2014-08-07", "level": "红色标题", "num_look": 971889, "num_comment": 27, "author": "FB视频", "tags": ["视频"], "text": "对这些年来隐蔽通信（FQ）所采用的各种方法、技术/平台进行系统性的总结归纳和分析比较，从侦查人员的角度阐述可采取的各种取证方法及应对策略。是黑是白，各位自取所需。"}
{"title": "[Blackhat]2014美国黑帽大会有哪些精彩的议题？", "url": "https://www.freebuf.com/news/topnews/40239.html", "time": "2014-08-07", "level": "红色标题", "num_look": 550007, "num_comment": 20, "author": "FB情报组", "tags": ["头条"], "text": "Blackhat安全技术大会是世界上最好的能够了解未来安全趋势的信息峰会。而每次的黑帽大会上，总是会爆出一些让人意想不到的新闻消息出来。下面请跟随FB情报组一起了解下Black Hat 2014 USA峰会上会有哪些精彩的议题…"}
{"title": "BTLE/BT4.0低功耗蓝牙无线发包器（可模拟iBeacon、建链、通信等）", "url": "https://www.freebuf.com/sectool/40078.html", "time": "2014-08-07", "level": "金币+5", "num_look": 379927, "num_comment": 6, "author": "spaceshuttle", "tags": ["工具", "系统安全"], "text": ""}
{"title": "杭州海康威视安全岗位招聘", "url": "https://www.freebuf.com/jobs/40152.html", "time": "2014-08-07", "level": "", "num_look": 225116, "num_comment": 13, "author": "litdg", "tags": ["安全招聘"], "text": ""}
{"title": "[BlackHat]2014黑客奥斯卡奖Pwnie Awards提名名单公布", "url": "https://www.freebuf.com/news/40214.html", "time": "2014-08-06", "level": "", "num_look": 277737, "num_comment": 11, "author": "辛巴达历险记", "tags": ["头条", "资讯"], "text": "正在沙漠赌城拉斯维加斯举行的黑帽大会，黑客奥斯卡奖Pwnie的提名名单已经公布，评委们正在一个秘密的地方投票。将于当地时间8月6日下午6:30公布最终获奖名单（北京时间8月7日早上9:30）。"}
{"title": "TED：日常生活中的网络犯罪（FreeBuf公开课）", "url": "https://www.freebuf.com/video/40176.html", "time": "2014-08-06", "level": "", "num_look": 259438, "num_comment": 20, "author": "FB视频", "tags": ["视频"], "text": "日常生活中由于法律等等的不健全和人们信息安全意识的匮乏，网络犯罪很轻易就渗透入了我们的日常生活中。日常生活中的网络犯罪有哪些，如何防范？且听激动的James Lyne讲师为我们娓娓道来。"}
{"title": "BlackHat会议上将演示如何利用机载WIFI劫持飞机", "url": "https://www.freebuf.com/news/40164.html", "time": "2014-08-06", "level": "金币+5", "num_look": 203051, "num_comment": 17, "author": "phper", "tags": ["资讯"], "text": "Ruben Santamarta将在本周四拉斯维加斯举行的Black Hat会议上介绍利用飞机上的无线网络和娱乐系统劫持飞机。"}
{"title": "缓冲区溢出攻击初学者手册（更新版）", "url": "https://www.freebuf.com/articles/system/40107.html", "time": "2014-08-06", "level": "", "num_look": 917416, "num_comment": 13, "author": "IDF_Lab", "tags": ["系统安全"], "text": ""}
{"title": "VirtualBox 3D加速之虚拟机逃逸漏洞的高级利用", "url": "https://www.freebuf.com/articles/system/39883.html", "time": "2014-08-06", "level": "金币+5", "num_look": 369622, "num_comment": 22, "author": "天才布衣", "tags": ["系统安全"], "text": ""}
{"title": "2014信息安全技能竞赛（ISG）火热报名中", "url": "https://www.freebuf.com/fevents/40122.html", "time": "2014-08-05", "level": "", "num_look": 182499, "num_comment": 10, "author": "ISG", "tags": ["活动"], "text": ""}
{"title": "大众点评网招聘安全工程师", "url": "https://www.freebuf.com/jobs/39972.html", "time": "2014-08-05", "level": "", "num_look": 181059, "num_comment": 15, "author": "yeweit6", "tags": ["安全招聘"], "text": ""}
{"title": "走进科学：对七夕“超级病毒”XX神器的逆向分析", "url": "https://www.freebuf.com/news/topnews/40039.html", "time": "2014-08-05", "level": "金币+5", "num_look": 750522, "num_comment": 60, "author": "墨阳", "tags": ["头条", "终端安全"], "text": "短短今天说这个apk没有任何研究价值，虽然技术是非常拙劣，但是其利用短信不会审核恶意链接的性质传播的方式倒是令人眼前一亮。"}
{"title": "Access数据库基于时间盲注的实现", "url": "https://www.freebuf.com/articles/web/39925.html", "time": "2014-08-05", "level": "金币+5", "num_look": 278742, "num_comment": 7, "author": "msx2009_$$", "tags": ["WEB安全"], "text": "Microsoft Office Access是由微软发布的关系数据库管理系统。它结合了 Microsoft Jet Database Engine 和 图形用户界面两项特点，是 Microsoft Office 的系统程式之一。"}
{"title": "h4k_b4n眼中的GeekPwn", "url": "https://www.freebuf.com/news/40021.html", "time": "2014-08-05", "level": "", "num_look": 186698, "num_comment": 8, "author": "GeekPwn", "tags": ["资讯"], "text": ""}
{"title": "愤怒的白帽子：被Facebook拒绝支付赏金后，白帽子编写大规模攻击工具", "url": "https://www.freebuf.com/news/39880.html", "time": "2014-08-04", "level": "金币+6", "num_look": 342767, "num_comment": 22, "author": "JohnChu", "tags": ["工具", "资讯"], "text": "“我被拒绝支付赏金。那么我的下一步是编写能够大规模劫持账号的自动化工具”他写道，“这是个相当严重的漏洞，请Facebook修复。”"}
{"title": "跟我学姿势：极客教你如何科学的刷卡", "url": "https://www.freebuf.com/geek/39813.html", "time": "2014-08-04", "level": "金币+6", "num_look": 289840, "num_comment": 18, "author": "mobier", "tags": ["极客"], "text": "上一篇《跟我学姿势：极客教你如何科学的看电影》，不知道大家都涨姿势了没有，这次作者再次带来风骚新作。有了这些极客姿势，妈妈再也不担心我的卡丢掉了！"}
{"title": "WordPress xmlrpc利用测试工具多线程版", "url": "https://www.freebuf.com/sectool/39744.html", "time": "2014-08-04", "level": "金币+6", "num_look": 274276, "num_comment": 13, "author": "sipcer", "tags": ["工具"], "text": ""}
{"title": "以色列情报组织摩萨德网站遭到匿名者DDoS攻击", "url": "https://www.freebuf.com/news/39817.html", "time": "2014-08-04", "level": "金币+6", "num_look": 254768, "num_comment": 7, "author": "子夏", "tags": ["资讯"], "text": "近日黑客组织\"匿名者(Anonymous)\"宣布DDoS攻击搞定了以色列情报组织摩萨德的官网。他们的目的是为了抗议以色列在加沙的军事行动导致了大量的平民伤亡。截止到小编测试时，摩萨德的官网依然无法访问。"}
{"title": "Python内网渗透测试信息收集脚本v1.0（开源）", "url": "https://www.freebuf.com/sectool/39875.html", "time": "2014-08-04", "level": "金币+6", "num_look": 1961232, "num_comment": 20, "author": "jackly", "tags": ["工具"], "text": ""}
{"title": "Weevely（php菜刀）工具使用详解", "url": "https://www.freebuf.com/sectool/39765.html", "time": "2014-08-04", "level": "金币+6", "num_look": 1351536, "num_comment": 22, "author": "RickGray", "tags": ["WEB安全", "工具"], "text": "weevely是一款使用python编写的webshell工具（集webshell生成和连接于一身），可以算作是linux下的一款菜刀替代工具（限于php），在linux上使用时还是很给力的，就是某些模块在windows上无法使用，总的来说还是非常…"}
{"title": "Samba 4.x.x全版本存在命令执行漏洞", "url": "https://www.freebuf.com/news/39788.html", "time": "2014-08-02", "level": "金币+6", "num_look": 516250, "num_comment": 23, "author": "子夏", "tags": ["漏洞", "资讯"], "text": "Samba 4.0.0到4.1.10版本的nmbd(the NetBIOS name services daemon)被发现存在远程命令执行漏洞。CVE编号为CVE-2014-3560。目前官方已经发布最新的补丁。"}
{"title": "监控网络流量？支付宝安全控件“附赠”的可疑进程", "url": "https://www.freebuf.com/news/topnews/39805.html", "time": "2014-08-02", "level": "红色标题", "num_look": 674924, "num_comment": 42, "author": "fu4k", "tags": ["头条", "系统安全"], "text": "支付宝的一个进程Alipaybsm.exe被怀疑监控网络流量，它会复制发送的数据到接收缓冲中。我认为以这种方式进行推广的程序，很可能另有其目的，不见得真的是保障个浏览器安全这么简单。"}
{"title": "Cookiel劫持测试工具 - Cookie Injecting Tools", "url": "https://www.freebuf.com/sectool/39707.html", "time": "2014-08-02", "level": "金币+6", "num_look": 448348, "num_comment": 16, "author": "lfzark", "tags": ["工具"], "text": "Cookie Injecting Tools 是一款简单的开源cookie利用工具，是Chrome浏览器上开发的一个扩展插件，能够灵活地进行SQL注入测试，编辑以及添加删除COOKIE，界面简洁，易于使用。‍‍"}
{"title": "认知指纹：颠覆性的身份认证技术", "url": "https://www.freebuf.com/articles/terminal/39668.html", "time": "2014-08-02", "level": "金币+6", "num_look": 352853, "num_comment": 21, "author": "同盾科技", "tags": ["其他", "终端安全"], "text": "如果一个网站只需要输入用户名，然后点击“登录”按钮，就可以成功登录，并且其他人无法进入你的账户，听起来是不是很不可思议？—— 事实上，你输入用户名的时候，网站就已经认出你了。"}
{"title": "跟我学姿势：极客教你如何科学的看电影", "url": "https://www.freebuf.com/news/topnews/39544.html", "time": "2014-08-01", "level": "金币+6", "num_look": 622990, "num_comment": 50, "author": "mobier", "tags": ["头条", "极客"], "text": "俗话说自己动手丰衣足食，小米盒子之类的盒子弱爆了，极客看片自然有极客的做法！"}
{"title": "WordPress xmlrpc利用工具", "url": "https://www.freebuf.com/sectool/39530.html", "time": "2014-08-01", "level": "金币+6", "num_look": 606526, "num_comment": 32, "author": "qingxp9", "tags": ["工具"], "text": ""}
{"title": "上海国凯英计算机有限公司招聘安全工程师、逆向工程师", "url": "https://www.freebuf.com/jobs/39460.html", "time": "2014-08-01", "level": "", "num_look": 170220, "num_comment": 7, "author": "国凯英", "tags": ["安全招聘"], "text": ""}
{"title": "Back Track5下建立“钓鱼”热点测试", "url": "https://www.freebuf.com/articles/wireless/39419.html", "time": "2014-08-01", "level": "金币+6", "num_look": 504210, "num_comment": 23, "author": "Jn·", "tags": ["无线安全"], "text": ""}
{"title": "新密码安全：虹膜扫描能代替密码的位置吗？", "url": "https://www.freebuf.com/news/39609.html", "time": "2014-07-31", "level": "金币+6", "num_look": 397594, "num_comment": 32, "author": "凌晨几度i", "tags": ["极客", "资讯"], "text": "虹膜扫描识别技术一直在军队和政府机构中运用，迄今为止，因为设备庞大笨重而且昂贵，还没有用到智能手机上。而Fidelys smartwatch将为之打开大门。"}
{"title": "Android又爆重大漏洞：谁之祸根，谁该庆幸", "url": "https://www.freebuf.com/news/39599.html", "time": "2014-07-31", "level": "金币+3", "num_look": 200028, "num_comment": 6, "author": "猫友", "tags": ["观点", "资讯"], "text": "当看到这则消息的时候，确实感受到一股莫名的气流在涌动，造成这种气流的主要原因是，有些人在笑、有些人在闹、有些人发愁、有些人则开始策划着什么。目前具体漏洞信息还没有公布，等待黑帽大会上的披露。"}
{"title": "深度调查：俄罗斯黑客是如何入侵纳斯达克的（中文视频）", "url": "https://www.freebuf.com/news/topnews/38604.html", "time": "2014-07-30", "level": "红色标题", "num_look": 262035, "num_comment": 13, "author": "FB视频", "tags": ["头条", "视频"], "text": "黑客组合使用了两个0day漏洞，相比之下Stuxnet蠕虫作者使用了4个0day漏洞。俄罗斯黑客在入侵系统后植入了数字炸弹，可能会造成严重破坏（事件扑朔迷离，本视频由FreeBuf视频组倾力译制，带各位一探究竟）"}
{"title": "KCon 2014（知道安全论坛）议题公布", "url": "https://www.freebuf.com/fevents/39589.html", "time": "2014-07-30", "level": "", "num_look": 272782, "num_comment": 31, "author": "zhitoushun", "tags": ["活动"], "text": "「KCon V3 知道安全论坛第三期」力求在国内打造出一个干货高质量有趣又好玩的线下交流论坛。"}
{"title": "3D打印钥匙帮助我轻松打开了邻居家门", "url": "https://www.freebuf.com/news/39568.html", "time": "2014-07-30", "level": "金币+3", "num_look": 189946, "num_comment": 12, "author": "phper", "tags": ["资讯"], "text": "“当我轻松写意打开了邻居家门时，我想告诉你的是，我完全不知道如何进行机械开锁，甚至都不会使用钩子工具。”"}
{"title": "绿盟科技威胁分析报告 ——DDoS兵器谱2014Q2版", "url": "https://www.freebuf.com/articles/network/39443.html", "time": "2014-07-30", "level": "", "num_look": 364856, "num_comment": 8, "author": "绿盟科技", "tags": ["网络安全"], "text": "网络攻防是发生在第五空间的对抗和战争。这是一个动态的过程，无论攻击者还是防御者都在实战中寻求进步。攻防双方的“兵器”就在这个战场中不断磨砺和进化。"}
{"title": "平安付招聘应用安全工程师", "url": "https://www.freebuf.com/jobs/38925.html", "time": "2014-07-30", "level": "", "num_look": 159336, "num_comment": 13, "author": "maxcoco", "tags": ["安全招聘"], "text": ""}
{"title": "FreeBuf人物志：独家专访埃及顶尖白帽子默罕默德·拉马丹", "url": "https://www.freebuf.com/articles/people/39211.html", "time": "2014-07-30", "level": "红色标题", "num_look": 498043, "num_comment": 37, "author": "FB独家", "tags": ["人物志"], "text": "默罕默德曾经为Google、Facebook、Twitter、微软、苹果等公司提交个多个高价值漏洞，同时也是FreeBuf旗下漏洞盒子（VulBox.COM）的专家团成员。"}
{"title": "远程管理软件PcShare全套源码下载", "url": "https://www.freebuf.com/sectool/39500.html", "time": "2014-07-30", "level": "金币+3", "num_look": 1198943, "num_comment": 70, "author": "无可非议", "tags": ["工具"], "text": ""}
{"title": "防汽车攻击产品比较：Charlie小组和VisualThreat", "url": "https://www.freebuf.com/articles/wireless/39424.html", "time": "2014-07-30", "level": "金币+3", "num_look": 329211, "num_comment": 3, "author": "tofreebug", "tags": ["无线安全", "极客"], "text": "我作为一个传统安全的研究人员和汽车诊断行业人士阿强在本文就防护汽车OBD攻击的问题讨论一下目前公布的两种不同解决思路和对应的演示产品，就当抛砖引玉。"}
{"title": "PayPal支付缺陷造成谎称支付额度漏洞", "url": "https://www.freebuf.com/news/39411.html", "time": "2014-07-29", "level": "金币+3", "num_look": 161951, "num_comment": 5, "author": "嘎巴嘎巴", "tags": ["资讯"], "text": "近日，白帽子Jan Kechel发现了PayPal存在谎称支付额度的漏洞，并证明这可能会并被利用来进行诈骗。"}
{"title": "FreeBuf公开课（直播课程）：隐蔽通信（FQ）和侦查取证那些事儿", "url": "https://www.freebuf.com/fevents/39454.html", "time": "2014-07-29", "level": "", "num_look": 148990, "num_comment": 3, "author": "FB客服", "tags": ["活动"], "text": "对这些年来隐蔽通信（FQ）所采用的各种方法、技术/平台进行系统性的总结归纳和分析比较，从侦查人员的角度阐述可采取的各种取证方法及应对策略。是黑是白，各位自取所需。"}
{"title": "钓鱼攻防对抗战的今日现状：防守方完全落后挨打", "url": "https://www.freebuf.com/articles/security-management/39314.html", "time": "2014-07-29", "level": "金币+3", "num_look": 349998, "num_comment": 7, "author": "mcvoodoo", "tags": ["安全管理"], "text": ""}
{"title": "Black Hat会议上将揭秘如何利用亚马逊云计算挖矿", "url": "https://www.freebuf.com/news/39400.html", "time": "2014-07-28", "level": "金币+3", "num_look": 267549, "num_comment": 12, "author": "phper", "tags": ["资讯"], "text": "黑客们长期以来一直使用恶意程序秘密将受害者的PC变成僵尸网络。但安全研究人员Rob Ragan和Oscar Salazar有着不同的想法：为什么不利用云计算服务商如亚马逊Google等提供的几乎无限的免费计算资源？"}
{"title": "漏洞科普：对于XSS和CSRF你究竟了解多少", "url": "https://www.freebuf.com/articles/web/39234.html", "time": "2014-07-28", "level": "金币+3", "num_look": 1269011, "num_comment": 36, "author": "猫友", "tags": ["WEB安全"], "text": "Web安全成为焦点，但网站的漏洞还是频频出现，在白帽子们进行网站测试时，恐怕对于SQL注入、XSS跨站、CSRF接触最多，但对于网站的开发者们来说，对这些熟知多少？本文从开发者的角度，对于XSS和CSRF进行简要概述。"}
{"title": "FreeBuf独家专访HITCON创办人：来自台湾的骇客精神", "url": "https://www.freebuf.com/news/topnews/39122.html", "time": "2014-07-28", "level": "红色标题", "num_look": 389273, "num_comment": 12, "author": "FB独家", "tags": ["人物志", "头条"], "text": "台湾骇客年会（HITCON）是台湾最大的骇客与资讯安全技术研讨会，将于8月19日-22日在台湾召开。小编有幸邀请到HITCON两位创始人TIM和TT进行了近距离访谈，对HITCON以及台湾黑客文化有了一次深入的了解。"}
{"title": "把废旧智能手机卖了？你可能成为下一个陈冠希", "url": "https://www.freebuf.com/news/39174.html", "time": "2014-07-27", "level": "金币+8", "num_look": 396367, "num_comment": 59, "author": "pynwolf", "tags": ["终端安全", "资讯"], "text": "Avasts成功的恢复了成千上万的私人照片照片，其中包含1500多张小朋友的照片以及750张女性“你懂的”的照片。"}
{"title": "中间人攻击之劫持登录会话（含视频下载）", "url": "https://www.freebuf.com/sectool/39050.html", "time": "2014-07-26", "level": "金币+8", "num_look": 1247228, "num_comment": 85, "author": "Kernelish", "tags": ["WEB安全", "工具"], "text": "中间人攻击（Man-in-the-MiddleAttack，简称“MITM攻击”）。因为几位前辈已经给出了大量的中间人攻击的方法,这里就不再重复了，恰好看到FreeBuf目前没有关于中间人攻击劫持登陆回话的文章，所以就有了本文。"}
{"title": "Prompt(1) to win XSS挑战赛", "url": "https://www.freebuf.com/fevents/38650.html", "time": "2014-07-25", "level": "", "num_look": 357384, "num_comment": 24, "author": "匿名", "tags": ["活动"], "text": ""}
{"title": "域名解析服务器 - OpenerDNS", "url": "https://www.freebuf.com/sectool/39138.html", "time": "2014-07-25", "level": "金币+8", "num_look": 521868, "num_comment": 31, "author": "IceArmour", "tags": ["工具"], "text": ""}
{"title": "路由器安全测试工具 - Router Scan v2.44（汉化版）", "url": "https://www.freebuf.com/sectool/38976.html", "time": "2014-07-25", "level": "金币+8", "num_look": 1634700, "num_comment": 93, "author": "hkk", "tags": ["工具"], "text": "Router Scan v2.44是一款路由器安全测试工具，可以指定IP段对路由器进行暴力破解等安全测试，支持多种TP-LINK、Huawei、Belkin、D-Link等各大品牌型号的路由器。"}
{"title": "渗透辅助工具 - 修改http请求头部chrome扩展下载", "url": "https://www.freebuf.com/sectool/38817.html", "time": "2014-07-25", "level": "金币+8", "num_look": 1323295, "num_comment": 16, "author": "chenyoufu123", "tags": ["工具"], "text": ""}
{"title": "FireEye：发现SCADA间谍软件Havex的最新变种", "url": "https://www.freebuf.com/news/38954.html", "time": "2014-07-25", "level": "金币+8", "num_look": 191287, "num_comment": 6, "author": "S0N1C", "tags": ["资讯"], "text": "​又是Havex，是的，之前介绍过的这个恶意软件，曾经以能源部门相关组织为目标，被用于针对一些欧洲公司实施工业间谍活动，并成功入侵1000多家欧洲和北美能源公司。"}
{"title": "深度分析：华尔街日报数据库可能已经泄露", "url": "https://www.freebuf.com/news/38940.html", "time": "2014-07-24", "level": "金币+8", "num_look": 322578, "num_comment": 20, "author": "FB情报组", "tags": ["头条", "资讯"], "text": "7月21日一个id为w0rm的黑客发了一个出售华尔街日报数据库的twitter，售价为1BTC。并给出了一个数据截图。"}
{"title": "黑了前男友网站：从找SQL注入到后台权限", "url": "https://www.freebuf.com/articles/web/38924.html", "time": "2014-07-24", "level": "金币+8", "num_look": 1171171, "num_comment": 117, "author": "刘开水", "tags": ["WEB安全", "其他"], "text": "其实事情很简单，就是我闲得天灵盖儿疼（蛋疼是男银的事儿！），想知道前男友icloud以及淘宝的密码，看看有木有跟老娘我这么如花似玉打着探照灯都找不到的善良纯情小少女分手后的候补妹纸的照片。"}
{"title": "FreeBuf公开课（直播课程）：Web安全编码基础介绍", "url": "https://www.freebuf.com/fevents/38893.html", "time": "2014-07-23", "level": "红色标题", "num_look": 341768, "num_comment": 21, "author": "FB客服", "tags": ["活动"], "text": ""}
{"title": "利用xmlrpc.php对WordPress进行暴力破解攻击", "url": "https://www.freebuf.com/articles/web/38861.html", "time": "2014-07-23", "level": "金币+8", "num_look": 1110694, "num_comment": 12, "author": "子夏", "tags": ["WEB安全"], "text": ""}
{"title": "平安付招聘安全运营岗", "url": "https://www.freebuf.com/jobs/38786.html", "time": "2014-07-23", "level": "", "num_look": 208775, "num_comment": 22, "author": "xiao.D", "tags": ["安全招聘"], "text": ""}
{"title": "Web安全扫描器Netsparker v3.5.3破解版", "url": "https://www.freebuf.com/sectool/38798.html", "time": "2014-07-22", "level": "金币+8", "num_look": 760953, "num_comment": 33, "author": "闪电小子", "tags": ["工具"], "text": ""}
{"title": "2014年上半年DDoS攻击威胁报告", "url": "https://www.freebuf.com/articles/network/38714.html", "time": "2014-07-22", "level": "", "num_look": 325582, "num_comment": 6, "author": "绿盟科技", "tags": ["安全报告", "网络安全"], "text": ""}
{"title": "MS-DOS时代的计算机病毒是什么样子的?", "url": "https://www.freebuf.com/articles/others-articles/38763.html", "time": "2014-07-22", "level": "金币+8", "num_look": 255511, "num_comment": 16, "author": "phper", "tags": ["其他"], "text": "身为作家也是展出策划人的Bas van de Poel策划了“危险的思想”艺术展，在计算机病毒这个展类里，我们看到画家们将计算史上最凶残的病毒用MS-DOS风格展现在画作中。"}
{"title": "走进科学：酒店保险箱真的保险么？", "url": "https://www.freebuf.com/news/topnews/38727.html", "time": "2014-07-22", "level": "金币+8", "num_look": 510832, "num_comment": 19, "author": "子夏", "tags": ["其他", "头条"], "text": "本文是FreeBuf《走进科学》系列最新力作，翻译自国外安全组织G DATA SecurityLabs一篇针对酒店保险箱的分析报告。他们的研究对象是一款产自中国并且以很多不同的品牌出售的保险柜。"}
{"title": "Web安全扫描器Netsparker v3.5发布", "url": "https://www.freebuf.com/sectool/38731.html", "time": "2014-07-21", "level": "金币+2", "num_look": 240365, "num_comment": 11, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "外媒：环太军演，首次有国家派出电子侦察船参与", "url": "https://www.freebuf.com/news/38709.html", "time": "2014-07-21", "level": "金币+2", "num_look": 195342, "num_comment": 11, "author": "IceArmour", "tags": ["资讯"], "text": "美国发现中国派出了“东调”电子侦察船的踪迹，“东调232”号电子侦察船是中国最新的专用情报搜集舰，从球型天线和各种电子设备林立的特征看，该舰的主要任务可能是进行电子信号情报的监听和分析。"}
{"title": "小米手机被指悄悄连接北京服务器", "url": "https://www.freebuf.com/news/38702.html", "time": "2014-07-21", "level": "金币+2", "num_look": 664642, "num_comment": 91, "author": "phper", "tags": ["资讯"], "text": "一位红米Note手机用户测试后发现，在关闭小米账号和小米云服务等需要连接小米服务器的功能之后，手机仍然在悄悄连接北京服务器。"}
{"title": "基于风控机制的支付产品研讨会（7月24日/上海）", "url": "https://www.freebuf.com/fevents/38627.html", "time": "2014-07-21", "level": "", "num_look": 145859, "num_comment": 1, "author": "同盾科技", "tags": ["活动"], "text": "支付业务依托于交易，而信任是交易的基础，支付机构作为在收付款人之间提供货币资金转移服务的中介机构，业务风险与安全管理是其核心竞争力。"}
{"title": "分布式破解WPA密码工具 - Moscrack V2.8b", "url": "https://www.freebuf.com/sectool/38668.html", "time": "2014-07-21", "level": "金币+2", "num_look": 635937, "num_comment": 20, "author": "H3lvin", "tags": ["工具"], "text": "MOSCRACK是一个perl应用程序，通过Mosix集群软件或是简单的SSH连接，它可在云计算机上方便的破解WPA key。云节点可以运行任何unix主机（包括Cygwin），这意味着Moscrack可以部署在windows操作系统上。"}
{"title": "37游戏安全纳贤令", "url": "https://www.freebuf.com/jobs/38546.html", "time": "2014-07-21", "level": "", "num_look": 229442, "num_comment": 35, "author": "37游戏安全中心", "tags": ["安全招聘"], "text": ""}
{"title": "360成功入侵特斯拉汽车，获特斯拉官方回复", "url": "https://www.freebuf.com/news/38615.html", "time": "2014-07-19", "level": "红色标题", "num_look": 449574, "num_comment": 49, "author": "phper", "tags": ["资讯"], "text": "360的安全研究人员声称发现了特斯拉电动汽车Model S的安全缺陷，允许攻击者远程控制行驶中的汽车车锁、喇叭、闪灯和天窗。"}
{"title": "FB公开课录像：如何建立高效的安全测试", "url": "https://www.freebuf.com/video/38608.html", "time": "2014-07-19", "level": "", "num_look": 163603, "num_comment": 18, "author": "FB视频", "tags": ["视频"], "text": "课程录像不是次次都有的喔，想学习、面对面与讲师交流，还是收直播吧！不费电！"}
{"title": "小米科技招聘高级应用安全工程师数名", "url": "https://www.freebuf.com/jobs/38442.html", "time": "2014-07-19", "level": "", "num_look": 194222, "num_comment": 33, "author": "淡定淞淞", "tags": ["安全招聘"], "text": ""}
{"title": "Havex：以工控设备为狩猎目标的恶意软件", "url": "https://www.freebuf.com/articles/system/38525.html", "time": "2014-07-18", "level": "金币+2", "num_look": 480198, "num_comment": 10, "author": "fubeerf", "tags": ["系统安全"], "text": ""}
{"title": "Android木马分析简介", "url": "https://www.freebuf.com/articles/terminal/38471.html", "time": "2014-07-18", "level": "金币+2", "num_look": 543635, "num_comment": 5, "author": "mcvoodoo", "tags": ["终端安全"], "text": "本文介绍基于Android的手机恶意软件，是一个基础性的介绍，给新入门的人提供一个分析和工具指引。要分析的木马是一个2013年的syssecApp.apk，这个木马的分析能对Android恶意软件有个大概了解。"}
{"title": "俄罗斯黑客组织“蜻蜓”攻击了西部1000多家能源公司", "url": "https://www.freebuf.com/news/38301.html", "time": "2014-07-18", "level": "金币+2", "num_look": 237853, "num_comment": 20, "author": "S0N1C", "tags": ["资讯"], "text": "往日的网络犯罪通常仅注重在PC机上传播恶意代码，并且以PC使用者为目标，不管他们是屌丝还是高富帅。而今，能源部门的各种机构已经变成网络犯罪感兴趣的目标了。"}
{"title": "绿盟科技东北诚聘安全工程师", "url": "https://www.freebuf.com/jobs/38434.html", "time": "2014-07-17", "level": "", "num_look": 182295, "num_comment": 18, "author": "jelly2014", "tags": ["安全招聘"], "text": ""}
{"title": "为了互联网安全？俄罗斯黑客组织入侵CNET", "url": "https://www.freebuf.com/news/38512.html", "time": "2014-07-17", "level": "金币+2", "num_look": 166577, "num_comment": 9, "author": "phper", "tags": ["资讯"], "text": "w0rm称，他们是抱着改进互联网安全的伟大目的去入侵CNET服务器的，以知名网站为目标就是为了增强人们的安全意识。"}
{"title": "如何为SOC配备合适的安全分析师", "url": "https://www.freebuf.com/articles/neopoints/38467.html", "time": "2014-07-17", "level": "金币+2", "num_look": 286868, "num_comment": 14, "author": "cs24", "tags": ["观点"], "text": ""}
{"title": "如何阻止下一次心脏出血漏洞", "url": "https://www.freebuf.com/articles/network/38436.html", "time": "2014-07-17", "level": "", "num_look": 570391, "num_comment": 8, "author": "IDF_Lab", "tags": ["网络安全", "观点"], "text": ""}
{"title": "浅谈php安全", "url": "https://www.freebuf.com/articles/web/38383.html", "time": "2014-07-16", "level": "", "num_look": 672235, "num_comment": 27, "author": "phithon", "tags": ["WEB安全"], "text": "这段时间一直在写一个整站，前几天才基本完成了，所以抽个时间写了一篇对于php安全的总结。技术含量不高，过不了也没关系，希望能一些准备写网站的朋友一点引导。"}
{"title": "安全科普：SQLi Labs 指南 Part 2", "url": "https://www.freebuf.com/articles/web/38315.html", "time": "2014-07-16", "level": "金币+14", "num_look": 712244, "num_comment": 21, "author": "novsec", "tags": ["WEB安全"], "text": ""}
{"title": "无声杯XSS挑战赛-最短、最快、最猥琐", "url": "https://www.freebuf.com/fevents/38402.html", "time": "2014-07-15", "level": "", "num_look": 427391, "num_comment": 22, "author": "only_guest", "tags": ["活动"], "text": "​如果说 web 渗透测试是所谓的\"奇技淫巧\",那 XSS 更算得上是旁门左道了.当然,在黑哥放下他手中的手术刀时,这论调早已不攻自破.诚然,遑论博浪椎抑或鱼肠剑,能干掉目标才重要,不是吗？"}
{"title": "punkspider - 全球Web应用程序漏洞扫描引擎", "url": "https://www.freebuf.com/sectool/38375.html", "time": "2014-07-15", "level": "金币+14", "num_look": 318396, "num_comment": 16, "author": "redsin", "tags": ["工具"], "text": "开发者可通过Punkspider来检测自己的Web应用程序（网站）中是否存在安全隐患。Punkspider是一个全球性的Web应用程序漏洞扫描引擎，可以告知开发者某个Web应用或网站中存在的安全漏洞。"}
{"title": "2014信息安全技能竞赛（ISG）报名将于明日启动", "url": "https://www.freebuf.com/fevents/38394.html", "time": "2014-07-15", "level": "", "num_look": 153027, "num_comment": 7, "author": "上海市信息安全行业协会", "tags": ["活动"], "text": ""}
{"title": "又是蓝翔：中国出口扫描仪被发现携带恶意程序", "url": "https://www.freebuf.com/news/38323.html", "time": "2014-07-15", "level": "金币+14", "num_look": 451276, "num_comment": 56, "author": "Mystery", "tags": ["资讯"], "text": "一家向全球物流和运输公司出售手持扫描仪硬件和软件的中国公司被发现其产品携带了恶意程序。恶意程序渗透到企业内网后会向位于中国的指令控制服务器发送数据，而其中一个指令控制服务器位于山东蓝翔职校。"}
{"title": "京东招聘信息安全工程师", "url": "https://www.freebuf.com/jobs/38291.html", "time": "2014-07-15", "level": "", "num_look": 267116, "num_comment": 19, "author": "h4cker小雅", "tags": ["安全招聘"], "text": ""}
{"title": "Facebook的SDK漏洞威胁数以百万计的手机用户账户", "url": "https://www.freebuf.com/news/38270.html", "time": "2014-07-15", "level": "金币+14", "num_look": 243136, "num_comment": 3, "author": "xia0k", "tags": ["终端安全", "资讯"], "text": "​来自MetaIntell智能手机领导风险管理（MRM）的安全研究人员，发现了一个最新版的Facebook的SDK中的漏洞，该漏洞会暴露数以百万计的Facebook的用户的身份认证令牌，听起来还是很吓人的。"}
{"title": "FreeBuf IOS客户端v1.0发布（粉丝制作版）", "url": "https://www.freebuf.com/sectool/38308.html", "time": "2014-07-14", "level": "金币+14", "num_look": 610979, "num_comment": 63, "author": "这ID是我的", "tags": ["工具"], "text": ""}
{"title": "“DNS隧道”盗号木马分析", "url": "https://www.freebuf.com/articles/network/38276.html", "time": "2014-07-14", "level": "", "num_look": 584763, "num_comment": 34, "author": "360网站卫士", "tags": ["网络安全"], "text": ""}
{"title": "独家: iOS是如何收集用户的地理信息的", "url": "https://www.freebuf.com/news/topnews/38158.html", "time": "2014-07-14", "level": "金币+14", "num_look": 439613, "num_comment": 26, "author": "FB情报组", "tags": ["头条"], "text": "从央视的新闻里我们了解到这个故事应该从三年前讲起……"}
{"title": "迷你卫星：超级便宜超级方便", "url": "https://www.freebuf.com/geek/38250.html", "time": "2014-07-14", "level": "金币+14", "num_look": 166220, "num_comment": 10, "author": "derk", "tags": ["极客"], "text": "SpaceX公司将研发一种迷你卫星Firefly Alpha，你可能无法乘坐它，但这并不阻碍它成为一种太空工具，它将改变我们将技术应用到太空的方式。"}
{"title": "爱奇艺诚聘安全工程师", "url": "https://www.freebuf.com/jobs/38164.html", "time": "2014-07-13", "level": "", "num_look": 188926, "num_comment": 16, "author": "yoyo7171", "tags": ["安全招聘"], "text": ""}
{"title": "揭秘：独特的技术手段，远程控制你的手机", "url": "https://www.freebuf.com/articles/terminal/38086.html", "time": "2014-07-13", "level": "", "num_look": 431125, "num_comment": 7, "author": "Gandalf", "tags": ["终端安全"], "text": "我们最近在分析恶意样本时候发现了两类独特的技术手段，一种利用轻量级web服务器jetty来窃取用户隐私，另一种使用Androidpn推送指令来远程控制。"}
{"title": "漏洞盒子项目上新：BTCC码交易中心网站安全测试", "url": "https://www.freebuf.com/fevents/38175.html", "time": "2014-07-12", "level": "红色标题", "num_look": 270578, "num_comment": 11, "author": "漏洞盒子", "tags": ["活动"], "text": "Btc china（比特币中国）是中国最大的比特币交易平台，占全球比特币交易量的35%。此次测试为比特币中国第二弹，测试目标为BTCC码交易中心。"}
{"title": "印度CA发行商伪造Google雅虎证书", "url": "https://www.freebuf.com/news/38152.html", "time": "2014-07-11", "level": "", "num_look": 219159, "num_comment": 11, "author": "phper", "tags": ["资讯"], "text": ""}
{"title": "汽车攻击离你很近：一分钟变成汽车黑客", "url": "https://www.freebuf.com/news/37937.html", "time": "2014-07-11", "level": "金币+5", "num_look": 604467, "num_comment": 16, "author": "tofreebug", "tags": ["无线安全", "网络安全"], "text": ""}
{"title": "你是我的眼：谷歌眼镜被黑造成隐私泄露", "url": "https://www.freebuf.com/news/38087.html", "time": "2014-07-11", "level": "金币+5", "num_look": 172734, "num_comment": 9, "author": "嘎巴嘎巴", "tags": ["资讯"], "text": ""}
{"title": "南京翰海源寻千里马", "url": "https://www.freebuf.com/jobs/38073.html", "time": "2014-07-11", "level": "", "num_look": 268669, "num_comment": 19, "author": "翰海源安全", "tags": ["安全招聘"], "text": ""}
{"title": "Oracle数据库攻击测试工具 - ODAT", "url": "https://www.freebuf.com/sectool/38078.html", "time": "2014-07-10", "level": "金币+5", "num_look": 303367, "num_comment": 5, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "elasticsearch 漏洞利用工具套装", "url": "https://www.freebuf.com/sectool/38025.html", "time": "2014-07-10", "level": "金币+5", "num_look": 742282, "num_comment": 26, "author": "胖和尚", "tags": ["工具"], "text": ""}
{"title": "阅读boing boing博客可能让你被NSA监视", "url": "https://www.freebuf.com/news/38016.html", "time": "2014-07-10", "level": "金币+5", "num_look": 180593, "num_comment": 9, "author": "pynwolf", "tags": ["资讯"], "text": ""}
{"title": "开源软件是否真的如我们想象中的那样安全？", "url": "https://www.freebuf.com/articles/neopoints/37918.html", "time": "2014-07-10", "level": "金币+5", "num_look": 339987, "num_comment": 9, "author": "常运", "tags": ["观点"], "text": "在两年前开始接触信息安全的时候，从开源的ＧＮＵ，到各种网上各种开源工具，我一直认为，开源即相当安全，可是开源是否真的如我们所愿的那么安全么？"}
{"title": "社会工程学神器 - theHarvester修改版", "url": "https://www.freebuf.com/sectool/37765.html", "time": "2014-07-09", "level": "金币+5", "num_look": 897362, "num_comment": 34, "author": "胖和尚", "tags": ["工具"], "text": ""}
{"title": "深渊熊猫Deep Panda组织被指攻击中东问题专家", "url": "https://www.freebuf.com/news/38005.html", "time": "2014-07-09", "level": "", "num_look": 349834, "num_comment": 18, "author": "fu4k", "tags": ["资讯"], "text": "美国安全公司CrowdStrike称，一直以中国/亚太问题地缘政治专家为攻击目标的黑客组织Deep Panda深渊熊猫最近突然以美国的伊拉克/中东问题专家为目标。中国外交部发言人洪磊在例行记者招待会上否认了这一说法。"}
{"title": "LIFX智能灯泡漏洞泄露WIFI密码", "url": "https://www.freebuf.com/news/37967.html", "time": "2014-07-09", "level": "金币+5", "num_look": 255719, "num_comment": 11, "author": "子夏", "tags": ["资讯"], "text": "​LIFX灯泡是可以由Wi-Fi控制的智能多色LED灯泡，售价99美元。LIFX曾创下Kickstarter众筹平台有史以来最成功的融资活动，​最近有安全研究人员报告LIFX灯泡存在漏洞，黑客可以在距离灯泡30米内获取灯泡连接的WIFI密码。"}
{"title": "Havex：类似Stuxnet的恶意软件袭击欧洲SCADA系统", "url": "https://www.freebuf.com/news/37861.html", "time": "2014-07-09", "level": "金币+5", "num_look": 490736, "num_comment": 12, "author": "S0N1C", "tags": ["工控安全", "资讯"], "text": ""}
{"title": "用Wireshark简单分析HTTPS传输过程-抓包过程", "url": "https://www.freebuf.com/articles/system/37900.html", "time": "2014-07-09", "level": "金币+5", "num_look": 3423587, "num_comment": 18, "author": "常运", "tags": ["系统安全"], "text": "上次写的文章 理解SSL（https）中的对称加密与非对称加密 ，一些小伙伴们说要如果有抓包过程，也就是有图片了解下过程比较好，所以有了这篇文章，写得不好的地方希望大家能提出建议呀，以能改正。"}
{"title": "2014电子商务安全技术峰会（含全议题下载）", "url": "https://www.freebuf.com/news/37849.html", "time": "2014-07-09", "level": "红色标题", "num_look": 319451, "num_comment": 11, "author": "HackLiu", "tags": ["活动", "资讯"], "text": "此次峰会，除了有阿里巴巴、百度、腾讯等国内互联网一线企业身影，国内一些顶尖的技术专家，如国内第一个发布IOS7.1.1完美越狱的盘古团队，因发现微软漏洞获微软10万美金奖励的“TK教主”于旸、FreeBuf的现身也备受业…"}
{"title": "卡巴斯基实验室揭示RDP暴力破解呈上升趋势", "url": "https://www.freebuf.com/news/37854.html", "time": "2014-07-08", "level": "金币+5", "num_look": 330280, "num_comment": 15, "author": "子夏", "tags": ["资讯"], "text": ""}
{"title": "斯诺登泄露：NSA通过33个国家来拦截全球网络通信", "url": "https://www.freebuf.com/news/37735.html", "time": "2014-07-08", "level": "金币+5", "num_look": 187055, "num_comment": 16, "author": "pynwolf", "tags": ["资讯"], "text": "斯诺登最新披露，美国已经和30多个第三方国家达成绝密协议，以便NSA可以监控这些国家光纤光缆，从中得到网络数据。"}
{"title": "安全宝诚聘网站安全工程师", "url": "https://www.freebuf.com/jobs/37804.html", "time": "2014-07-07", "level": "", "num_look": 160655, "num_comment": 21, "author": "feelingmeng", "tags": ["安全招聘"], "text": ""}
{"title": "FreeBuf公开课（直播课程）：如何建立高效的安全测试", "url": "https://www.freebuf.com/fevents/37778.html", "time": "2014-07-07", "level": "", "num_look": 175943, "num_comment": 10, "author": "FB客服", "tags": ["活动"], "text": "快速发展的互联网企业，每天会产生大量多样的产品项目，如何完成高效的安全测试，并能够保障项目的安全性，是当前互联网公司面临的主要问题，本次议题主要讨论如何实现并解决此类问题。"}
{"title": "逆向APK进行smali注入实现“秒破WIFI”", "url": "https://www.freebuf.com/articles/wireless/37689.html", "time": "2014-07-07", "level": "金币+15", "num_look": 816347, "num_comment": 46, "author": "成王败寇", "tags": ["无线安全"], "text": ""}
{"title": "metasploit利用IE漏洞XSS挂马拿内网主机", "url": "https://www.freebuf.com/articles/web/37716.html", "time": "2014-07-07", "level": "金币+15", "num_look": 699622, "num_comment": 32, "author": "Sh4dow@foxmail.com", "tags": ["WEB安全"], "text": ""}
{"title": "通过facebook传播的比特币挖矿木马", "url": "https://www.freebuf.com/news/37673.html", "time": "2014-07-07", "level": "金币+15", "num_look": 188170, "num_comment": 8, "author": "lanlan", "tags": ["资讯"], "text": "葡萄牙，比利时，印度，罗马，西班牙等众多国家的facebook用户，正遭到一种新型木马的攻击，这种木马会控制受害者的主机挖掘比特币。"}
{"title": "斯诺登一周年时间，微软要求改革监听计划", "url": "https://www.freebuf.com/news/37371.html", "time": "2014-07-07", "level": "金币+15", "num_look": 132621, "num_comment": 2, "author": "pynwolf", "tags": ["资讯"], "text": ""}
{"title": "500美元的漏洞赏金廉价吗？以色列黑客为Google提交漏洞引争议", "url": "https://www.freebuf.com/news/37708.html", "time": "2014-07-06", "level": "金币+15", "num_look": 183547, "num_comment": 13, "author": "phper", "tags": ["资讯"], "text": "以色列“白帽”黑客奥伦•哈菲夫（Oren Hafif）发现Gmail存在严重的安全问题。该问题可能导致所有的5亿个账号被盗用。谷歌按照其寻找漏洞奖励计划，给予了哈菲夫500美元的奖励。"}
{"title": "深信服科技招聘 高级安全研究工程师、高级windows驱动工程师", "url": "https://www.freebuf.com/jobs/37602.html", "time": "2014-07-06", "level": "", "num_look": 174171, "num_comment": 23, "author": "leonhr", "tags": ["安全招聘"], "text": ""}
{"title": "窃听风云：生活中无处不在的间谍设备", "url": "https://www.freebuf.com/news/topnews/37703.html", "time": "2014-07-05", "level": "金币+15", "num_look": 279968, "num_comment": 16, "author": "fu4k", "tags": ["头条", "观点"], "text": "几天前一条微博引起众多网友的极大关注，发微博的事主在网上购买了一个型号为羽博YB-647的移动电源，却在使用中不慎将其摔落导致外壳开裂，结果里面露出的东西让他大吃一惊……"}
{"title": "Discuz <= 7.2 SQL注入漏洞详情", "url": "https://www.freebuf.com/vuls/37643.html", "time": "2014-07-04", "level": "", "num_look": 1504267, "num_comment": 14, "author": "千秋丶千年", "tags": ["漏洞"], "text": ""}
{"title": "被黑客删除全部数据，Code Spaces宣布关门", "url": "https://www.freebuf.com/news/37619.html", "time": "2014-07-04", "level": "金币+15", "num_look": 376350, "num_comment": 20, "author": "Mystery", "tags": ["资讯"], "text": "提供代码托管服务的Code Spaces宣布倒闭。从本周开始，网站遭受了DDoS攻击。昨天，攻击者设法删除了所有该公司托管的客户数据和大部分备份。"}
{"title": "安全科普：理解SSL（https）中的对称加密与非对称加密", "url": "https://www.freebuf.com/articles/system/37624.html", "time": "2014-07-04", "level": "金币+15", "num_look": 607962, "num_comment": 15, "author": "常运", "tags": ["系统安全"], "text": ""}
{"title": "超过32000台SuperMicro服务器受到密码泄露漏洞影响", "url": "https://www.freebuf.com/news/37569.html", "time": "2014-07-04", "level": "金币+15", "num_look": 226806, "num_comment": 2, "author": "嘎巴嘎巴", "tags": ["资讯"], "text": ""}
{"title": "搭建开源入侵检测系统Snort，并实现与防火墙联动", "url": "https://www.freebuf.com/articles/system/37507.html", "time": "2014-07-04", "level": "金币+15", "num_look": 918223, "num_comment": 30, "author": "行者向阳", "tags": ["系统安全"], "text": ""}
{"title": "crossdomain.xml文件配置不当利用手法", "url": "https://www.freebuf.com/articles/web/37432.html", "time": "2014-07-03", "level": "金币+15", "num_look": 726779, "num_comment": 12, "author": "子夏", "tags": ["WEB安全"], "text": "不恰当的crossdomain.xml配置对存放了敏感信息的域来说是具有很大风险的。可能导致敏感信息被窃取和请求伪造。攻击者不仅仅可以发送请求，还可以读取服务器返回的信息。"}
{"title": "深圳华为总部招聘安全工程师", "url": "https://www.freebuf.com/jobs/37544.html", "time": "2014-07-03", "level": "", "num_look": 408678, "num_comment": 26, "author": "zhaopin_001", "tags": ["安全招聘"], "text": ""}
{"title": "PHP5.6被发现存在堆溢出漏洞", "url": "https://www.freebuf.com/news/others/37566.html", "time": "2014-07-03", "level": "金币+15", "num_look": 320398, "num_comment": 8, "author": "lanlan", "tags": ["周边"], "text": ""}
{"title": "国产SSL防火墙 - sslfw", "url": "https://www.freebuf.com/sectool/37489.html", "time": "2014-07-02", "level": "", "num_look": 222577, "num_comment": 9, "author": "cj也疯狂", "tags": ["工具"], "text": "sslfw是一款国产免费的ssl防火墙，以协议蜜罐方式防御Heartbleed攻击，抵御任何形式的Heartbleed攻击，从根本上解决Heartbleed攻击的困扰。通过不断更新，从根本上防御后续的0day。"}
{"title": "Retargetable Decompiler 免费的在线反编译引擎", "url": "https://www.freebuf.com/sectool/37512.html", "time": "2014-07-02", "level": "金币+5", "num_look": 850436, "num_comment": 27, "author": "lanlan", "tags": ["工具"], "text": "Retargetable Decompiler的主要目的在于，给大件提供一个灵活的反编译引擎。他是捷克共和国布尔诺科技大学Lissom项目中的一个部分。"}
{"title": "腾讯安全应急响应中心招聘", "url": "https://www.freebuf.com/jobs/37533.html", "time": "2014-07-02", "level": "", "num_look": 528282, "num_comment": 36, "author": "腾讯安全平台部", "tags": ["安全招聘"], "text": "腾讯安全应急响应中心长期面向社会招聘安全开发，安全运营人员，工作地点均在深圳。腾讯提供业界具有竞争力的薪酬水平、海量用户对个人技能意志的磨练、庞大体系对合作共赢的追求。"}
{"title": "迅雷招聘安全运维高级工程师", "url": "https://www.freebuf.com/jobs/37488.html", "time": "2014-07-01", "level": "", "num_look": 162154, "num_comment": 17, "author": "fedroa", "tags": ["安全招聘"], "text": "成立于2003年的迅雷，在创立之初就致力于为全球互联网提供最好的多媒体资源数据传输服务。凭借着下载领域的核心技术，集成了下载、在线播放、游戏等多种产品的迅雷平台，现面向全社会招聘安全工程师。"}
{"title": "测试全球最安全的手机Blackphone", "url": "https://www.freebuf.com/articles/terminal/37495.html", "time": "2014-07-01", "level": "", "num_look": 277089, "num_comment": 25, "author": "fu4k", "tags": ["终端安全"], "text": "当智能手机发展愈发成熟的时候，会涌现出一些有意思的分支，比如有人觉得隐私是一件很严肃的事情，必须认真对待，于是催生了 Blackphone：一款为隐私而生的手机。"}
{"title": "iOS8中Safari可拍照扫描信用卡的新功能安全性存疑", "url": "https://www.freebuf.com/news/37448.html", "time": "2014-07-01", "level": "金币+5", "num_look": 155198, "num_comment": 4, "author": "嘎巴嘎巴", "tags": ["资讯"], "text": ""}
{"title": "漏洞盒子项目上新：BTCChina网站安全测试", "url": "https://www.freebuf.com/fevents/37452.html", "time": "2014-07-01", "level": "红色标题", "num_look": 294923, "num_comment": 16, "author": "漏洞盒子", "tags": ["活动"], "text": "Btc china（比特币中国）是中国最大的比特币交易平台，日前，BTCChina与FreeBuf达成一致，由FreeBuf的白帽子测试其网站的安全性，要求不能影响其网站的正常运行。"}
{"title": "再携手！FreeBuf成为HITCON 2014（台湾黑客年会）大陆地区唯一官方合作媒体", "url": "https://www.freebuf.com/news/37403.html", "time": "2014-06-30", "level": "红色标题", "num_look": 395001, "num_comment": 47, "author": "FB独家", "tags": ["活动", "资讯"], "text": "日前「Freebuf黑客与极客」正式成为「HITCON 2014台湾黑客年会」大陆地区唯一官方合作媒体（白金级）。这是继FreeBuf与HITCON去年初次合作以来，两岸在网络安全领域交流的又一次深入。"}
{"title": "2014巴西世界杯安全团队意外泄露Wi-Fi密码", "url": "https://www.freebuf.com/news/37397.html", "time": "2014-06-30", "level": "金币+5", "num_look": 206822, "num_comment": 29, "author": "phper", "tags": ["资讯"], "text": "该公司一名工作人员在twitter上发布了一张安全监控中心的照片，而照片上直接出现了世界杯安全团队的WiFi密码……神一样的队友。"}
{"title": "十大跨浏览器测试工具", "url": "https://www.freebuf.com/sectool/37393.html", "time": "2014-06-30", "level": "金币+5", "num_look": 403490, "num_comment": 6, "author": "Mystery", "tags": ["工具"], "text": "在多个平台上测试多种浏览器不但是很困难的 – 它几乎不可能的，因为没有那些好的测试工具。今天，我们就为大家提供很多涉及到跨浏览器测试的选择，并且告诉你那些“顶级的浏览器测试工具”，你应该使用哪一个。"}
{"title": "OSX Mavericks系统安装Metasploit教程", "url": "https://www.freebuf.com/articles/system/36924.html", "time": "2014-06-30", "level": "", "num_look": 1033636, "num_comment": 44, "author": "RickGray", "tags": ["系统安全"], "text": ""}
{"title": "黑客们的2014巴西世界杯", "url": "https://www.freebuf.com/articles/others-articles/37204.html", "time": "2014-06-27", "level": "金币+5", "num_look": 161901, "num_comment": 6, "author": "pynwolf", "tags": ["其他"], "text": "对于某些人来说，世界杯这个契机是如此完美的一个机会，他们可以在网上做些什么，你懂的或是不懂的，他都在屏幕前坐着并做着……"}
{"title": "黑客入侵大型对冲基金窃取交易信息", "url": "https://www.freebuf.com/news/37307.html", "time": "2014-06-27", "level": "金币+5", "num_look": 155654, "num_comment": 18, "author": "phper", "tags": ["资讯"], "text": "BAE Systems Applied Intelligence的全球产品总监Paul Henninger透露，身份未知的黑客在八周时间内干扰了一家大型对冲基金的高频交易。"}
{"title": "中国电力科学研究院招聘安全工程师", "url": "https://www.freebuf.com/jobs/37295.html", "time": "2014-06-27", "level": "", "num_look": 169985, "num_comment": 12, "author": "中国电力", "tags": ["安全招聘"], "text": ""}
{"title": "Firefox内存释放重用漏洞高级利用(Pwn2Own2014、CVE-2014-1512)", "url": "https://www.freebuf.com/vuls/37283.html", "time": "2014-06-27", "level": "金币+5", "num_look": 326850, "num_comment": 12, "author": "vscen", "tags": ["漏洞", "系统安全"], "text": ""}
{"title": "GPS系统是如何被黑客欺骗的（FreeBuf公开课更新）", "url": "https://www.freebuf.com/geek/37274.html", "time": "2014-06-26", "level": "红色标题", "num_look": 975548, "num_comment": 12, "author": "FB视频", "tags": ["极客", "视频"], "text": "Todd Humphreys预测，在地理定位世界的不久将来，精确到毫米的GPS“点”将让我们能极度精准定位，“索引搜索”我们的实体物品…… 或在别人不为所知的情况下跟踪他们。"}
{"title": "未知攻，焉知防？——DDoS攻击方法之分析", "url": "https://www.freebuf.com/articles/network/37257.html", "time": "2014-06-26", "level": "", "num_look": 451665, "num_comment": 11, "author": "绿盟科技", "tags": ["网络安全"], "text": ""}
{"title": "酷狗音乐招聘安全工程师", "url": "https://www.freebuf.com/jobs/37249.html", "time": "2014-06-26", "level": "", "num_look": 260321, "num_comment": 27, "author": "酷狗招聘", "tags": ["安全招聘"], "text": ""}
{"title": "漏洞盒子项目上新：某智能硬件产品安全测试", "url": "https://www.freebuf.com/fevents/37210.html", "time": "2014-06-25", "level": "", "num_look": 254759, "num_comment": 14, "author": "漏洞盒子", "tags": ["活动"], "text": "本次测试的产品为某科技公司新推出的一款智能硬件产品 - IP摄像头（类似百度i耳目），由于项目保密级别和对技术要求较高，所以会选取十名白帽子参与测试。"}
{"title": "FREEBUF 2014夏季T恤火热预售", "url": "https://www.freebuf.com/fevents/36516.html", "time": "2014-06-25", "level": "红色标题", "num_look": 550858, "num_comment": 146, "author": "FB客服", "tags": ["活动"], "text": "在前段时间发布的FreeBuf 2014年夏季T恤设计征集活动中，我们收到了N多小伙伴的稿件，在作品中，我们感受到了小伙伴们的热情与艺术细胞，果然每一位黑客都是艺术家。"}
{"title": "用搜索神器Everything定位Webshell木马后门", "url": "https://www.freebuf.com/articles/web/37122.html", "time": "2014-06-25", "level": "金币+6", "num_look": 657611, "num_comment": 20, "author": "_zero", "tags": ["WEB安全"], "text": ""}
{"title": "Windows密码抓取神器mimikatz2.0发布", "url": "https://www.freebuf.com/sectool/37162.html", "time": "2014-06-25", "level": "红色标题", "num_look": 3323494, "num_comment": 151, "author": "墨阳", "tags": ["工具"], "text": "只要借用一下电脑，便可轻松拿到密码……“女神，借用电脑一看可否？”"}
{"title": "XssHtml - 基于白名单的富文本XSS过滤类", "url": "https://www.freebuf.com/sectool/37106.html", "time": "2014-06-25", "level": "金币+6", "num_look": 591575, "num_comment": 15, "author": "phithon", "tags": ["工具"], "text": "关于富文本XSS，我在之前的一篇文章里已经比较详细地说明了一些开源应用使用的XSS Fliter以及绕过方法。之前我也总结了一些fliter的缺点，利用白名单机制完成了一个XSS Fliter类，希望能更大程度地避免富文本XSS的…"}
{"title": "盘古 - 让世界知道中国也有顶尖的技术人才！", "url": "https://www.freebuf.com/news/37165.html", "time": "2014-06-24", "level": "", "num_look": 322184, "num_comment": 22, "author": "盘古团队", "tags": ["资讯"], "text": "6月24日消息，今日0点左右，国内越狱团队“盘古团队”正式发布全球首个iOS7.1.1完美越狱工具，名字为“盘古”。目前该完美越狱工具已经在盘古越狱官网（http://pangu.io）和PP助手首发上线。"}
{"title": "针对XSS漏洞的前端防火墙（2）：可疑模块拦截", "url": "https://www.freebuf.com/articles/web/37022.html", "time": "2014-06-24", "level": "", "num_look": 179868, "num_comment": 1, "author": "gethostbyname", "tags": ["WEB安全"], "text": ""}
{"title": "看NSA黑客如何利用大数据拿下网络系统管理员", "url": "https://www.freebuf.com/news/topnews/37092.html", "time": "2014-06-24", "level": "金币+6", "num_look": 508175, "num_comment": 26, "author": "FB情报组", "tags": ["头条"], "text": "​斯诺登事件已过一年有余，情报组小编翻看众多公布的材料，挑选其中一篇2012年时候的“NSA的内部帖子”，来看看一个NSA黑阔如何利用“大数据”拿下网络系统管理员的攻击思维。"}
{"title": "Motorola C118修改滤波器组件", "url": "https://www.freebuf.com/articles/system/37031.html", "time": "2014-06-24", "level": "金币+6", "num_look": 731109, "num_comment": 29, "author": "radiowar", "tags": ["系统安全"], "text": "关于怎么使用热风枪拆屏蔽盖将在后期更新视频，以下为修改滤波器流程.以下热风枪设置温度只针对快克957DW(不同品牌风枪和型号可能会有温差）。"}
{"title": "无需密码也能验证用户身份", "url": "https://www.freebuf.com/articles/others-articles/36995.html", "time": "2014-06-23", "level": "金币+6", "num_look": 320691, "num_comment": 15, "author": "凌晨几度i", "tags": ["其他", "安全管理"], "text": ""}
{"title": "北京安赛创想招聘安全开发工程师和Web安全工程师", "url": "https://www.freebuf.com/jobs/37099.html", "time": "2014-06-23", "level": "", "num_look": 289695, "num_comment": 31, "author": "za@bslab.org", "tags": ["安全招聘"], "text": "北京安赛创想科技有限公司（简称安赛科技）位于北京市海淀区，公司专注于信息安全前沿技术，致力于为国家和企业提供高端的真实有效的安全解决方案。"}
{"title": "关于”RFID安全技术探讨”的一点小看法", "url": "https://www.freebuf.com/articles/wireless/37050.html", "time": "2014-06-23", "level": "金币+6", "num_look": 529377, "num_comment": 9, "author": "FallenSec", "tags": ["无线安全"], "text": ""}
{"title": "Android渗透测试工具大合集", "url": "https://www.freebuf.com/sectool/36880.html", "time": "2014-06-23", "level": "金币+6", "num_look": 4646680, "num_comment": 39, "author": "Xarray", "tags": ["工具"], "text": "Android传承着Linux的血统，无疑使 渗透 从机器端到各种终端，使用起来更加方便，工具集中了众多方法，大大提高了渗透的效率（当然 不推荐傻瓜式工具，这里只是入门，高手勿喷，初学者了解）"}
{"title": "google chrome 插件 “红杏” 破解版", "url": "https://www.freebuf.com/sectool/36817.html", "time": "2014-06-23", "level": "金币+10", "num_look": 1967868, "num_comment": 179, "author": "dlan", "tags": ["工具"], "text": "因为一些众所周知的原因，很多国外的网站无法用普通手段访问，facebook/twitter这洋的社交网站暂且不说，有时就连google和很多资料网站都无法打开，这让我们这些靠获得国外第一手互联网资料工作的人都很难高效地开…"}
{"title": "深圳某大型通信公司招聘安全工程师", "url": "https://www.freebuf.com/jobs/36986.html", "time": "2014-06-22", "level": "", "num_look": 164101, "num_comment": 33, "author": "shenzhenbaimao", "tags": ["安全招聘"], "text": ""}
{"title": "针对XSS漏洞的前端防火墙（1）：内联事件拦截", "url": "https://www.freebuf.com/articles/web/37021.html", "time": "2014-06-22", "level": "", "num_look": 206646, "num_comment": 8, "author": "gethostbyname", "tags": ["WEB安全"], "text": "关于 XSS 漏洞怎样形成、如何注入、能做什么、如何防范，前人已有无数的探讨，这里就不再累述了。本文介绍的则是另一种预防思路。"}
{"title": "震撼攻击视频！6月19日Facebook遭到大量DDoS攻击", "url": "https://www.freebuf.com/news/36999.html", "time": "2014-06-20", "level": "红色标题", "num_look": 389776, "num_comment": 27, "author": "fu4k", "tags": ["资讯"], "text": "据国外媒体报道，6.19下午4点Facebook发生大规模宕机，电脑无法连上Facebook网站，手机、平板等移动设备的Facebook App也无法连线，Facebook的Messenger即时通讯也无法使用，几乎波及所有服务。"}
{"title": "PayPal金钱翻倍漏洞", "url": "https://www.freebuf.com/news/36952.html", "time": "2014-06-20", "level": "金币+10", "num_look": 166074, "num_comment": 8, "author": "lanlan", "tags": ["资讯"], "text": "私以为这个漏洞并没有听起来这么严重，应该属于利用eBay的消费者保护规则进行诈骗的范畴。不过，发现这个漏洞的黑客很厉害曾入侵过美国白宫。"}
{"title": "ThoughtWorks安全攻防活动", "url": "https://www.freebuf.com/fevents/36958.html", "time": "2014-06-20", "level": "", "num_look": 294105, "num_comment": 6, "author": "thoughtworks", "tags": ["活动"], "text": "转眼间，Open Workshop已经办到第三期了,从三到万是一个跨度，我们欢迎更多热爱编程的朋友和我们一起写程序。我们的形式依旧，抛出问题，15分钟讲解，45五分钟练习，持续3-4个小时。"}
{"title": "如何开始你的CTF比赛之旅", "url": "https://www.freebuf.com/articles/others-articles/36927.html", "time": "2014-06-20", "level": "金币+10", "num_look": 2483139, "num_comment": 37, "author": "IDF_Lab", "tags": ["其他"], "text": ""}
{"title": "以色列网络安全企业BioCatch完成千万美元融资", "url": "https://www.freebuf.com/news/36942.html", "time": "2014-06-20", "level": "", "num_look": 148676, "num_comment": 5, "author": "phper", "tags": ["资讯"], "text": "以色列网络安全初创企业BioCatch的系统通过追踪记录用户的鼠标移动方式来侦查黑客，为金融机构和银行网站提供安全保障。"}
{"title": "心脏出血，丘比特与无线网络", "url": "https://www.freebuf.com/articles/web/36896.html", "time": "2014-06-20", "level": "金币+10", "num_look": 200726, "num_comment": 3, "author": "lanlan", "tags": ["WEB安全"], "text": "心脏出血漏洞又坑了一把无线网络，这次的利用方法比较苛刻，最容易中招的是基于EAP的路由器，也是很多大型公司所使用的路由器。"}
{"title": "Fireeye解剖新型Android恶意软件", "url": "https://www.freebuf.com/articles/terminal/36875.html", "time": "2014-06-20", "level": "金币+10", "num_look": 247969, "num_comment": 11, "author": "secroro", "tags": ["终端安全"], "text": "你是否下载安装过体积很大但是UI或者功能很少的Android应用程序？最近，FireEye实验室移动安全研究人员发现了一种新型的手机恶意软件，在看起来普通的应用下内嵌着加密过的附件程序，很好的隐藏了其进行恶意活动。"}
{"title": "WordPress系统暴力破解测试工具 - wpbf", "url": "https://www.freebuf.com/sectool/36904.html", "time": "2014-06-19", "level": "金币+10", "num_look": 531316, "num_comment": 25, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "山寨机的逆袭？中国产智能手机预装强大间谍软件", "url": "https://www.freebuf.com/news/36884.html", "time": "2014-06-19", "level": "金币+10", "num_look": 158974, "num_comment": 14, "author": "phper", "tags": ["资讯"], "text": "它伪装成Google Play Store（Google市场），会向中国服务器发送手机识别信息和特定数据，还具有远程控制功能，如启动摄像头，并且永远无法卸载……"}
{"title": "Evernote官方社区被黑，用户密码存在泄露风险", "url": "https://www.freebuf.com/news/36865.html", "time": "2014-06-19", "level": "金币+10", "num_look": 176580, "num_comment": 6, "author": "KingD0m", "tags": ["资讯"], "text": ""}
{"title": "中兴通讯诚聘渗透测试工程师", "url": "https://www.freebuf.com/jobs/36858.html", "time": "2014-06-19", "level": "", "num_look": 276281, "num_comment": 15, "author": "superlative1", "tags": ["安全招聘"], "text": ""}
{"title": "详解Mysql安全配置", "url": "https://www.freebuf.com/articles/database/36777.html", "time": "2014-06-19", "level": "金币+10", "num_look": 694791, "num_comment": 18, "author": "LittleHann", "tags": ["数据安全"], "text": "Mysql数据库安全配置、或者叫加固属于风险模型中的一环，它需要安全人员在理论和实践的学习中不断发现新的问题，并针对这些问题对数据的各个方面的配置进行强化。"}
{"title": "黑客可以入侵你的所有设备（FreeBuf公开课更新）", "url": "https://www.freebuf.com/video/36851.html", "time": "2014-06-19", "level": "红色标题", "num_look": 464520, "num_comment": 16, "author": "FB视频", "tags": ["视频"], "text": "在 TEDxMidAtlantic, 阿维·鲁宾讲解了黑客是怎么入侵汽车，智慧型手机和医疗器械，并提醒我们这个可骇程度日益上升的世界的危险性。"}
{"title": "观点：抓住安全行业的入口", "url": "https://www.freebuf.com/articles/neopoints/36554.html", "time": "2014-06-19", "level": "金币+5", "num_look": 162296, "num_comment": 10, "author": "Arrow、", "tags": ["观点"], "text": "如果你正打算进行安全行业，或打算自己在安全行业创业，请好好抓住安全行业的入口，让自己变成颠覆者而不是跟随者。"}
{"title": "你没看错，无需密码就可以访问你的iCloud", "url": "https://www.freebuf.com/news/36811.html", "time": "2014-06-18", "level": "金币+5", "num_look": 215446, "num_comment": 14, "author": "Mystery", "tags": ["资讯"], "text": "美国雅虎报道，俄罗斯一家软件公司 ElcomSoft 升级了旗下的司法取证软件 ElcomSoft Phone Password Breaker，现在不仅可以从 iPhone 和黑莓手机中破解, 获取信息，而且无需用户的 Apple ID 或者密码，就可以访问 iC…"}
{"title": "以色列黑客发现Gmail漏洞 遍历所有用户的电子邮件地址", "url": "https://www.freebuf.com/news/36731.html", "time": "2014-06-18", "level": "金币+5", "num_look": 867972, "num_comment": 9, "author": "pynwolf", "tags": ["漏洞", "资讯"], "text": ""}
{"title": "移动APP背后的秘密：间谍APP大阅兵", "url": "https://www.freebuf.com/articles/terminal/36714.html", "time": "2014-06-18", "level": "金币+5", "num_look": 334754, "num_comment": 15, "author": "Gandalf", "tags": ["终端安全"], "text": "面对如此海量的App，在安装和使用这些形形色色的App时是否想到过这样的事情，一些App背后偷偷地在窃取着您的个人敏感隐私！"}
{"title": "美国中餐馆P.F. Chang's大量信用卡信息泄露", "url": "https://www.freebuf.com/news/36692.html", "time": "2014-06-17", "level": "金币+5", "num_look": 324216, "num_comment": 3, "author": "子夏", "tags": ["资讯"], "text": "据国外媒体报道，6月9日著名的信用卡黑市网站上新出现了大量信用卡售卖信息，经过调查发现被盗的信用卡最近（3月到5月19日之间）都在P.F. Changs中餐馆消费过。6月12日，P.F. Changs发表声明称确认数据已经泄露。"}
{"title": "见招拆招：绕过WAF继续SQL注入常用方法", "url": "https://www.freebuf.com/articles/web/36683.html", "time": "2014-06-17", "level": "金币+5", "num_look": 2033070, "num_comment": 34, "author": "mikey", "tags": ["WEB安全"], "text": ""}
{"title": "大众点评网上海总部招聘安全工程师", "url": "https://www.freebuf.com/jobs/36192.html", "time": "2014-06-16", "level": "", "num_look": 591173, "num_comment": 9, "author": "dianping", "tags": ["安全招聘"], "text": ""}
{"title": "免费DDOS攻击测试工具大合集", "url": "https://www.freebuf.com/sectool/36545.html", "time": "2014-06-16", "level": "金币+5", "num_look": 15043330, "num_comment": 92, "author": "凌晨几度i", "tags": ["工具", "系统安全"], "text": ""}
{"title": "FreeBuf公开课（直播课程）：企业安全那点事 - 应急响应", "url": "https://www.freebuf.com/fevents/36578.html", "time": "2014-06-16", "level": "红色标题", "num_look": 315705, "num_comment": 26, "author": "FB客服", "tags": ["企业安全", "活动"], "text": "安全应急响应是企业安全内永恒的话题。“午夜凶铃”、“消防队员”这类词汇也时常被拿来调侃企业应急响应人员的工作，我也不例外。"}
{"title": "NSA每天以百万级速度从网络中收集你的头像", "url": "https://www.freebuf.com/news/36541.html", "time": "2014-06-16", "level": "金币+5", "num_look": 202465, "num_comment": 12, "author": "凌晨几度i", "tags": ["资讯"], "text": ""}
{"title": "走进科学：揭秘如何入侵电视机", "url": "https://www.freebuf.com/news/topnews/36503.html", "time": "2014-06-16", "level": "金币+5", "num_look": 899276, "num_comment": 41, "author": "三只小潴", "tags": ["头条", "终端安全"], "text": "电视步入了智能时代，一大堆捆绑的流氓软件和广告也从手机和PC转战到了电视平台，所以，让垃圾们都见鬼去吧！我要开始折腾了！"}
{"title": "OSSEC日志泛化及告警规则配置", "url": "https://www.freebuf.com/articles/network/36484.html", "time": "2014-06-16", "level": "金币+5", "num_look": 477501, "num_comment": 3, "author": "blackrat", "tags": ["网络安全"], "text": "OSSEC是一款开源的多平台的入侵检测系统，可以运行于Windows, Linux, OpenBSD/FreeBSD, 以及 MacOS等操作系统中。包括了日志分析，全面检测，root-kit检测。"}
{"title": "外国大牛教你玩转JSP Shell", "url": "https://www.freebuf.com/articles/web/36455.html", "time": "2014-06-13", "level": "金币+5", "num_look": 959702, "num_comment": 23, "author": "lanlan", "tags": ["WEB安全"], "text": ""}
{"title": "暴力破解工具Hydra 8.0版本发布", "url": "https://www.freebuf.com/sectool/36461.html", "time": "2014-06-13", "level": "金币+5", "num_look": 1878321, "num_comment": 22, "author": "子夏", "tags": ["工具"], "text": ""}
{"title": "iOS7系统曝锁屏漏洞：只需两部操作就可控制最近应用（附视频）", "url": "https://www.freebuf.com/news/36428.html", "time": "2014-06-12", "level": "金币+5", "num_look": 360848, "num_comment": 32, "author": "Mystery", "tags": ["资讯"], "text": ""}
{"title": "还有谁？利用Bing搜索的心血漏洞检测工具 - Bing Heartbleed Scan", "url": "https://www.freebuf.com/sectool/36424.html", "time": "2014-06-12", "level": "金币+3", "num_look": 206801, "num_comment": 14, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "Twitter客户端TweetDeck爆严重漏洞，引发大规模XSS蠕虫", "url": "https://www.freebuf.com/news/36410.html", "time": "2014-06-12", "level": "金币+3", "num_look": 151150, "num_comment": 15, "author": "KingDom", "tags": ["资讯"], "text": ""}
{"title": "\"伪中国移动客户端\"--伪基站诈骗", "url": "https://www.freebuf.com/articles/terminal/36406.html", "time": "2014-06-12", "level": "", "num_look": 277918, "num_comment": 9, "author": "Jack_Jia", "tags": ["终端安全"], "text": "近日，百度安全实验室发现一款“伪中国移动客户端”病毒，犯罪分子通过伪基站方式大量发送伪10086的短信，诱导用户点击钓鱼链接；并在钓鱼页面诱导用户输入网银账号、网银密码、下载安装“伪中国移动客户端”病毒。"}
{"title": "谁动了我的汽车—车联网安全探讨", "url": "https://www.freebuf.com/articles/others-articles/36403.html", "time": "2014-06-12", "level": "", "num_look": 297049, "num_comment": 7, "author": "腾讯安全平台部", "tags": ["其他"], "text": "以前，汽车是孤立的，物理隔离的，因此黑客很难远程入侵汽车内部电脑（ECU），除非进行物理入侵，而这个是需要很高的犯罪成本。"}
{"title": "以色列黑客入侵并控制超过800辆私人汽车", "url": "https://www.freebuf.com/news/36385.html", "time": "2014-06-11", "level": "金币+3", "num_look": 314599, "num_comment": 37, "author": "KingDom", "tags": ["资讯"], "text": ""}
{"title": "揭秘：基地组织使用最新加密软件抵御美国监听计划", "url": "https://www.freebuf.com/news/36318.html", "time": "2014-06-11", "level": "金币+3", "num_look": 137368, "num_comment": 6, "author": "pynwolf", "tags": ["资讯"], "text": "最新公布的报告表明，基地组织的恐怖分子已经开始使用强有力的加密技术，摒弃传统的标准通信加密保护，以期确保在其各种通信中的通信安全。"}
{"title": "上海市信息安全行业协会招聘安全岗位", "url": "https://www.freebuf.com/jobs/36362.html", "time": "2014-06-11", "level": "", "num_look": 129975, "num_comment": 17, "author": "上海信安协会", "tags": ["安全招聘"], "text": ""}
{"title": "14岁少年使用默认安全码黑掉ATM取款机", "url": "https://www.freebuf.com/news/36295.html", "time": "2014-06-10", "level": "金币+3", "num_look": 190078, "num_comment": 26, "author": "p@ss", "tags": ["资讯"], "text": "来自加拿大温尼伯的两个14岁的顽皮少年最近发现了一种能够绕过蒙特利尔银行ATM取款机的方法。这听起来也许很疯狂，但是这种方法不需要任何高级的计算机技术--他们仅仅是在网上阅读了一下ATM的操作手册。"}
{"title": "[重磅]FreeBuf公开课即将上线", "url": "https://www.freebuf.com/news/36250.html", "time": "2014-06-10", "level": "红色标题", "num_look": 473365, "num_comment": 117, "author": "FB独家", "tags": ["其他", "资讯"], "text": "FreeBuf认为，任何领域的知识都应纯粹真实，不为乱象而迷失，因避讳而藏掖。"}
{"title": "斯诺登爆料：美国国安局在手机关闭状态下依然可以控制你的手机", "url": "https://www.freebuf.com/news/36205.html", "time": "2014-06-10", "level": "金币+3", "num_look": 172820, "num_comment": 13, "author": "pynwolf", "tags": ["资讯"], "text": ""}
{"title": "疑似APT攻击：空中交通控制系统由于内存不足而瘫痪", "url": "https://www.freebuf.com/news/36201.html", "time": "2014-06-10", "level": "金币+3", "num_look": 127121, "num_comment": 6, "author": "xia0k", "tags": ["资讯"], "text": ""}
{"title": "苏宁易购招聘安全工程师", "url": "https://www.freebuf.com/jobs/35962.html", "time": "2014-06-09", "level": "", "num_look": 224130, "num_comment": 21, "author": "tombook", "tags": ["安全招聘"], "text": "苏宁易购，是苏宁电器旗下新一代B2C网上购物平台（www.suning.com），现已覆盖传统家电、3C电器、日用百货等品类。2011年，苏宁易购将强化虚拟网络与实体店面的同步发展，不断提升网络市场份额。"}
{"title": "漏洞盒子项目上新 - 腾讯手机管家安全测试", "url": "https://www.freebuf.com/news/36220.html", "time": "2014-06-09", "level": "", "num_look": 203286, "num_comment": 10, "author": "FB客服", "tags": ["活动", "资讯"], "text": "腾讯手机管家是腾讯旗下一款永久免费的手机安全与管理软件，今已进驻漏洞盒子，诚邀各位白帽子捉虫，奖金300 - 5000元/每漏洞。"}
{"title": "另一种打开Google网站的方法", "url": "https://www.freebuf.com/articles/others-articles/36185.html", "time": "2014-06-09", "level": "", "num_look": 655719, "num_comment": 29, "author": "Mystery", "tags": ["其他"], "text": ""}
{"title": "沃达丰：多个政府监听用户的电话内容", "url": "https://www.freebuf.com/news/36181.html", "time": "2014-06-09", "level": "", "num_look": 139871, "num_comment": 12, "author": "phper", "tags": ["资讯"], "text": ""}
{"title": "山东华瑞招聘渗透测试工程师", "url": "https://www.freebuf.com/jobs/35583.html", "time": "2014-06-09", "level": "", "num_look": 200174, "num_comment": 26, "author": "子夏", "tags": ["安全招聘"], "text": ""}
{"title": "玩转Google的XSS游戏", "url": "https://www.freebuf.com/articles/web/36072.html", "time": "2014-06-09", "level": "金币+4", "num_look": 541090, "num_comment": 13, "author": "Taskiller", "tags": ["WEB安全"], "text": ""}
{"title": "关于DDoS攻击的认知误区，你中枪了么？", "url": "https://www.freebuf.com/articles/network/36021.html", "time": "2014-06-08", "level": "", "num_look": 829463, "num_comment": 13, "author": "绿盟科技", "tags": ["网络安全"], "text": ""}
{"title": "一周海外安全事件回顾（20140531-0606）", "url": "https://www.freebuf.com/news/topnews/36124.html", "time": "2014-06-08", "level": "金币+4", "num_look": 330277, "num_comment": 9, "author": "blackscreen", "tags": ["头条", "安全报告"], "text": "本期回顾我们谈一个让人不那么愉快的话题：逮捕。在最近两周发生了一连串黑客被逮捕、被通缉的事情，当然，也有被释放的。"}
{"title": "南京焦点科技招聘信息安全工程师", "url": "https://www.freebuf.com/jobs/35831.html", "time": "2014-06-07", "level": "", "num_look": 193084, "num_comment": 13, "author": "焦点科技招聘", "tags": ["安全招聘"], "text": ""}
{"title": "OpenSSL受到多个漏洞影响，官方呼吁尽快升级", "url": "https://www.freebuf.com/news/36035.html", "time": "2014-06-06", "level": "", "num_look": 205121, "num_comment": 2, "author": "blue", "tags": ["资讯"], "text": ""}
{"title": "美国运通公司发生重大信用卡信息泄露事件", "url": "https://www.freebuf.com/news/35979.html", "time": "2014-06-06", "level": "金币+4", "num_look": 260950, "num_comment": 17, "author": "嘎巴嘎巴", "tags": ["资讯"], "text": ""}
{"title": "开源域用户弱口令检(po)测(jie)工具", "url": "https://www.freebuf.com/sectool/35956.html", "time": "2014-06-06", "level": "金币+4", "num_look": 347395, "num_comment": 24, "author": "xocoder", "tags": ["工具"], "text": ""}
{"title": "黑客叔叔教你用云存储离线下“大片”", "url": "https://www.freebuf.com/news/topnews/35982.html", "time": "2014-06-05", "level": "金币+4", "num_look": 1275666, "num_comment": 77, "author": "p0tt1", "tags": ["其他", "头条"], "text": "从此以后，你不用电脑一直开着迅雷不关机了；不用发愁怎么把“东X热”目录命名成“项目文档”了；不用半夜起来看看电脑下载进度了……"}
{"title": "GoAgent漏洞可能导致中间人攻击", "url": "https://www.freebuf.com/vuls/35936.html", "time": "2014-06-05", "level": "金币+4", "num_look": 412746, "num_comment": 26, "author": "virusdefender", "tags": ["漏洞"], "text": "GoAgent (https://github.com/goagent/goagent) 利用 Google App Engine(GAE) 来代理上网的一个工具，深受网民的欢迎。但是，GoAgent 的安装和配置中存在两点严重安全风险的问题却鲜为人知。"}
{"title": "Metasploit系列教程(第一季)", "url": "https://www.freebuf.com/articles/web/35930.html", "time": "2014-06-05", "level": "金币+4", "num_look": 1876429, "num_comment": 156, "author": "羽翼", "tags": ["WEB安全"], "text": ""}
{"title": "APT攻击：趋势科技捕获一次APT攻击活动", "url": "https://www.freebuf.com/articles/web/35898.html", "time": "2014-06-05", "level": "", "num_look": 333515, "num_comment": 25, "author": "趋势科技", "tags": ["WEB安全"], "text": "趋势科技目前正在监视一起专门针对行政单位的攻击活动。趋势科技将这起特定攻击活动命名为PLEAD，来自于其相关恶意软件所发出后门指令的字母。"}
{"title": "移动平台调试利器：GikDbg", "url": "https://www.freebuf.com/sectool/35868.html", "time": "2014-06-05", "level": "金币+4", "num_look": 401526, "num_comment": 18, "author": "胖子", "tags": ["工具"], "text": "OllyDbg 现已广泛用于 PC 平台软件安全领域，GikDbg 是 OllyDbg 向移动平台转移的产物，它可以协助您完成诸如应用调试分析，应用安全评估，应用漏洞挖掘等移动安全领域。"}
{"title": "安全科普：什么是中间人攻击（MITM）", "url": "https://www.freebuf.com/articles/web/35903.html", "time": "2014-06-05", "level": "", "num_look": 504546, "num_comment": 13, "author": "phper", "tags": ["WEB安全", "系统安全"], "text": ""}
{"title": "乐视网招聘安全工程师", "url": "https://www.freebuf.com/jobs/35800.html", "time": "2014-06-04", "level": "", "num_look": 154169, "num_comment": 10, "author": "freebufadmin", "tags": ["安全招聘"], "text": ""}
{"title": "僵尸病毒网络Gameover Zeus被捣毁", "url": "https://www.freebuf.com/news/35848.html", "time": "2014-06-04", "level": "金币+4", "num_look": 302247, "num_comment": 18, "author": "H3lvin", "tags": ["资讯"], "text": "美国司法部3日宣布，国际执法合作破获一个大型全球黑客团体组织，该黑客组织利用电脑病毒从受害者身上窃取超过一亿美元。英国“国家打击犯罪调查局”（NCA）同时也发出警告，这种病毒可以锁住用户个人资料，然后进行…"}
{"title": "开源网站管理工具——Altman", "url": "https://www.freebuf.com/sectool/35817.html", "time": "2014-06-04", "level": "金币+4", "num_look": 716743, "num_comment": 86, "author": "keepwn", "tags": ["工具"], "text": ""}
{"title": "同程旅游招聘信息安全工程师", "url": "https://www.freebuf.com/jobs/35826.html", "time": "2014-06-04", "level": "", "num_look": 141055, "num_comment": 14, "author": "gfllove", "tags": ["安全招聘"], "text": ""}
{"title": "美黑客组织Anonymous计划攻击世界杯赞助商", "url": "https://www.freebuf.com/news/35777.html", "time": "2014-06-03", "level": "金币+5", "num_look": 133586, "num_comment": 10, "author": "凌晨几度i", "tags": ["资讯"], "text": ""}
{"title": "Apple 修复了22个 Safari的漏洞", "url": "https://www.freebuf.com/news/35764.html", "time": "2014-06-03", "level": "金币+5", "num_look": 222874, "num_comment": 2, "author": "lanlan", "tags": ["资讯"], "text": "5月22号，Apple发布了一个关于Safari的补丁，其中修复了22个漏洞，这些漏洞可能会引起代码执行或者是浏览器崩溃。\r\n这些漏洞影响到OS X Mavericks 10.9 下的 Safari 7.0.4 和  OS X Mountain Lion 10.8. 下的Safari…"}
{"title": "走近世界上第一个地下黑市搜索引擎", "url": "https://www.freebuf.com/news/35641.html", "time": "2014-06-02", "level": "金币+5", "num_look": 2275495, "num_comment": 62, "author": "凌晨几度i", "tags": ["工具", "资讯"], "text": "Grams作为第一个搜索黑市的引擎，可以让任何人都可以轻而易举地在线找到非法毒品和其他违禁产品，它的体验能像Google搜索一样快捷。"}
{"title": "一大拨漏洞来袭，eBAY的黑色星期五", "url": "https://www.freebuf.com/news/35683.html", "time": "2014-05-31", "level": "金币+5", "num_look": 190095, "num_comment": 16, "author": "lanlan", "tags": ["资讯"], "text": "eBay没有保护好自己用户的数据，在之前他也犯过类似的错误，但是这次显然eBay的安全团队没有吸取到前车之鉴。这次他们同样要为自己对安全的消极态度买单。"}
{"title": "我理解的360财报：数字华丽安全、搜索前景忧虑", "url": "https://www.freebuf.com/articles/neopoints/35716.html", "time": "2014-05-31", "level": "红色标题", "num_look": 328719, "num_comment": 22, "author": "庄帅", "tags": ["观点"], "text": "第一季度360财报披露的业绩似乎足以让周鸿祎兴奋，但是也透露出360安全用户渗透率创2012年后的新低，以及搜索广告业务增长停滞。360这座冰山下面早已是危机四伏。"}
{"title": "Win8是如何引导你把文件同步至美国的", "url": "https://www.freebuf.com/news/topnews/35610.html", "time": "2014-05-30", "level": "金币+5", "num_look": 501946, "num_comment": 48, "author": "FB情报组", "tags": ["头条"], "text": "​近日，一则名为《中央政府采购禁Win8原因：文件会同步至美国》的新闻在各大媒体广泛传播，虽然FB情报组小编的电脑也是Win8，不过秉着还原场景的原则我们来体验一下“文件是如何同步至美国”的。"}
{"title": "走进科学：揭秘微信支付大盗", "url": "https://www.freebuf.com/news/35628.html", "time": "2014-05-30", "level": "红色标题", "num_look": 441486, "num_comment": 27, "author": "嘎巴嘎巴", "tags": ["其他", "头条"], "text": "手机支付固然便利,然而移动支付在便利人们生活的同时,也面临着越来越多的风险。众多官方的手机网银客户端和支付工具都被黑客克隆成山寨版本，山寨手机支付应用已成为移动支付最大安全风险之一，严重威胁着用户资金…"}
{"title": "被遗弃的孩子：WhatsApp被收购后频繁宕机", "url": "https://www.freebuf.com/news/35625.html", "time": "2014-05-30", "level": "金币+5", "num_look": 141097, "num_comment": 10, "author": "凌晨几度i", "tags": ["资讯"], "text": ""}
{"title": "TrueCrypt可能不安全？", "url": "https://www.freebuf.com/news/35607.html", "time": "2014-05-29", "level": "", "num_look": 203228, "num_comment": 14, "author": "H3lvin", "tags": ["资讯"], "text": "流行的开源加密软件TrueCrypt突然在其官网上建议Windows用户改用微软的BitLocker加密磁盘，并用大红字警告使用TrueCrypt并不安全。在官网彻底大变脸前，TrueCrypt更新了二进制程序。"}
{"title": "渗透测试效率提升工具 - MagicTree", "url": "https://www.freebuf.com/sectool/35470.html", "time": "2014-05-29", "level": "", "num_look": 199551, "num_comment": 11, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "澳大利亚大量Apple设备被黑客锁定并索要赎金", "url": "https://www.freebuf.com/news/35533.html", "time": "2014-05-29", "level": "金币+5", "num_look": 160833, "num_comment": 17, "author": "子夏", "tags": ["资讯"], "text": ""}
{"title": "安全漏洞披露平台HackerOne获900万美元A轮融资", "url": "https://www.freebuf.com/news/35573.html", "time": "2014-05-29", "level": "", "num_look": 159413, "num_comment": 4, "author": "IceArmour", "tags": ["资讯"], "text": "提供安全漏洞披露平台的HackerOne刚刚获得了由 Benchmark 提供的 900 万美元 A 轮融资。"}
{"title": "一周海外安全回顾（5.19-5.25）", "url": "https://www.freebuf.com/news/others/35568.html", "time": "2014-05-29", "level": "金币+5", "num_look": 207223, "num_comment": 10, "author": "blackscreen", "tags": ["周边"], "text": "本期回顾，我们只聊一个事情——UDP反射攻击。这个事情在上周被Akamai／Prolexic炒了一把，说黑客盯上SNMP协议了，用来发起UDP反射攻击。借此扯点闲篇，还是蛮有意思的。"}
{"title": "电子取证之Linux PCI分析", "url": "https://www.freebuf.com/articles/system/35490.html", "time": "2014-05-29", "level": "", "num_look": 189274, "num_comment": 2, "author": "IDF_Lab", "tags": ["系统安全"], "text": "上篇文章为大家讲解了在Linux ext4分区下如何恢复误删除文件的整个过程，每次坐在电脑前，把手机和电脑通过USB接口进行连接，为手机充电。总在想一个问题：“手机和电脑连接后，系统又做了点什么？”这就是整篇文章开…"}
{"title": "AVAST论坛被黑—近40万用户信息泄露", "url": "https://www.freebuf.com/news/35508.html", "time": "2014-05-29", "level": "金币+5", "num_look": 179454, "num_comment": 11, "author": "子夏", "tags": ["资讯"], "text": ""}
{"title": "[附下载]黑客游戏Watch Dogs PC版正式发布", "url": "https://www.freebuf.com/news/35514.html", "time": "2014-05-28", "level": "金币+9", "num_look": 342642, "num_comment": 42, "author": "lock", "tags": ["资讯"], "text": "本作设定在2003年的纽约，一个神秘组织通过电脑掌控了全城，你的行为，想法和人脉他们都知道。玩家将扮演一位“亦正亦邪”的刺客杀手“Aiden Pearce\"，拥有控制整个城市监视器系统的能力，通过Hack城市的电子系统，杀…"}
{"title": "玩转WiFi Pineapple之看我如何优雅的盗取CMCC账号", "url": "https://www.freebuf.com/articles/wireless/35469.html", "time": "2014-05-28", "level": "金币+9", "num_look": 1292973, "num_comment": 78, "author": "az0ne", "tags": ["无线安全"], "text": ""}
{"title": "WordPress Cookie处理流程可导致账户被劫持", "url": "https://www.freebuf.com/news/35483.html", "time": "2014-05-28", "level": "金币+9", "num_look": 158365, "num_comment": 10, "author": "lanlan", "tags": ["资讯"], "text": ""}
{"title": "The Social-Engineer Toolkit V6.0发布", "url": "https://www.freebuf.com/sectool/35455.html", "time": "2014-05-28", "level": "金币+9", "num_look": 199859, "num_comment": 8, "author": "H3lvin", "tags": ["工具"], "text": "社会工程学工具集Social-Engineer Toolkit (SET) v6.0发布。Social Engineering Toolkit (SET)是一个开源、Python驱动的社会工程学渗透测试工具，提供了非常丰富的攻击向量库。"}
{"title": "南京江南天安招聘脚本工程师和安全研究员", "url": "https://www.freebuf.com/jobs/35347.html", "time": "2014-05-28", "level": "", "num_look": 166827, "num_comment": 10, "author": "juney", "tags": ["安全招聘"], "text": ""}
{"title": "掀起你的盖头来，伊朗黑客组织AST浮出水面", "url": "https://www.freebuf.com/news/35092.html", "time": "2014-05-27", "level": "金币+9", "num_look": 170002, "num_comment": 6, "author": "嘎巴嘎巴", "tags": ["资讯"], "text": ""}
{"title": "完整20MHz带宽LTE信号被HACKRF-20M采样率成功解析", "url": "https://www.freebuf.com/articles/wireless/35354.html", "time": "2014-05-27", "level": "金币+9", "num_look": 620672, "num_comment": 9, "author": "scateu", "tags": ["无线安全"], "text": "HACKRF比起电视棒的巨大优势之一是带宽和采样率高了很多，因此如果不用来玩完整带宽的LTE信号的话让掏了比电视棒贵xx倍的钱买HACKRF的人情何以堪！"}
{"title": "Flash跨域数据劫持漏洞，一大波网站受影响", "url": "https://www.freebuf.com/articles/web/35353.html", "time": "2014-05-27", "level": "红色标题", "num_look": 868593, "num_comment": 36, "author": "pnig0s", "tags": ["WEB安全"], "text": "很多上传文件的后端逻辑在实现时，仅仅验证了文件后缀名和Content-Type，没有对上传文件的内容进行验证。通常情况下这样的处理逻辑仅仅是不严谨，不会造成太大的安全隐患。"}
{"title": "途牛旅游网招聘安全经理/高级安全工程师", "url": "https://www.freebuf.com/jobs/35208.html", "time": "2014-05-26", "level": "", "num_look": 389118, "num_comment": 32, "author": "finalbsd", "tags": ["安全招聘"], "text": ""}
{"title": "Firefox/Chrome渗透测试插件推荐", "url": "https://www.freebuf.com/sectool/35250.html", "time": "2014-05-26", "level": "", "num_look": 1642218, "num_comment": 29, "author": "帅气凌云", "tags": ["工具"], "text": ""}
{"title": "五月，渗透师不得不知的微软更新", "url": "https://www.freebuf.com/articles/system/35211.html", "time": "2014-05-26", "level": "金币+9", "num_look": 445197, "num_comment": 19, "author": "cs24", "tags": ["系统安全"], "text": ""}
{"title": "淘宝网招聘高级安全开发工程师", "url": "https://www.freebuf.com/jobs/35171.html", "time": "2014-05-26", "level": "", "num_look": 168927, "num_comment": 7, "author": "woyigui", "tags": ["安全招聘"], "text": "阿里巴巴为全球领先的小企业电子商务公司，也是阿里巴巴集团的旗舰业务。阿里巴巴集团旗下的公司包括阿里巴巴网络有限公司，淘宝网，支付宝，阿里巴巴云计算，天猫，聚划算等。"}
{"title": "北京娜迦信息科技招聘", "url": "https://www.freebuf.com/jobs/35158.html", "time": "2014-05-25", "level": "", "num_look": 226947, "num_comment": 12, "author": "cnrstar", "tags": ["安全招聘"], "text": "Hello,World!这把钥匙给我们打开了程序这个世界的大门，而我们面对的却只是不断的磨砺与挫折。也许这条道路，本身就是一条登峰之路。"}
{"title": "什么是网络安全审查制度？", "url": "https://www.freebuf.com/news/35138.html", "time": "2014-05-23", "level": "红色标题", "num_look": 321025, "num_comment": 21, "author": "FB情报组", "tags": ["观点", "资讯"], "text": ""}
{"title": "酷派手机招聘安全工程师", "url": "https://www.freebuf.com/jobs/35057.html", "time": "2014-05-23", "level": "", "num_look": 168809, "num_comment": 11, "author": "Ronnie", "tags": ["安全招聘"], "text": ""}
{"title": "老外手把手带你搭建DMZ渗透测试实验室（Part 1，2）", "url": "https://www.freebuf.com/articles/network/34712.html", "time": "2014-05-23", "level": "金币+9", "num_look": 690152, "num_comment": 38, "author": "xia0k", "tags": ["网络安全"], "text": "对于一个多功能的渗透测试实验室来说，使用网络模拟器和虚拟机绝逼是一个进行演练的特别好的方式，因为这可以在给定的硬件和软件条件下使用几乎所有的的网络/操作系统的组合。"}
{"title": "NSA截获美国制造商的路由器并安装间谍软件", "url": "https://www.freebuf.com/news/35083.html", "time": "2014-05-23", "level": "金币+8", "num_look": 568163, "num_comment": 9, "author": "pynwolf", "tags": ["终端安全", "网络安全"], "text": ""}
{"title": "安全科普：SQLi Labs 指南 Part 1", "url": "https://www.freebuf.com/articles/web/34619.html", "time": "2014-05-22", "level": "金币+8", "num_look": 1730349, "num_comment": 41, "author": "novsec", "tags": ["WEB安全"], "text": "译者：SQL Libs一直也没看到有人写过比较完整的指南，只有作者在自己的博客上帖了一些tip和一些视频，偶然看到一篇文章在写这个，便拿过来翻一下，以作参考，原文较长，分成几个部分。"}
{"title": "32764端口后门重出江湖，影响多款路由器", "url": "https://www.freebuf.com/articles/terminal/35012.html", "time": "2014-05-22", "level": "金币+8", "num_look": 266379, "num_comment": 11, "author": "pynwolf", "tags": ["终端安全"], "text": ""}
{"title": "eBay遭黑客入侵，大量用户数据泄露", "url": "https://www.freebuf.com/news/35005.html", "time": "2014-05-22", "level": "金币+8", "num_look": 314445, "num_comment": 23, "author": "H3lvin", "tags": ["资讯"], "text": "日前，据外媒报道，财务500强、著名在线拍卖网站ebay遭黑客入侵，大量用户数据可能被窃，这些数据包含EBAY用户的姓名、登陆账号、密码、邮件地址、联系地址、电话号码以及出生日期。"}
{"title": "新浪安全招聘高级研发工程师", "url": "https://www.freebuf.com/jobs/34820.html", "time": "2014-05-21", "level": "", "num_look": 130611, "num_comment": 3, "author": "新浪安全", "tags": ["安全招聘"], "text": ""}
{"title": "美国陆军、海军、空军和陆战队网站遭到Anonymous黑客组织攻击", "url": "https://www.freebuf.com/news/34890.html", "time": "2014-05-21", "level": "金币+8", "num_look": 167033, "num_comment": 15, "author": "phper", "tags": ["资讯"], "text": ""}
{"title": "Gmail的新衣：Google正在测试的新UI", "url": "https://www.freebuf.com/news/34824.html", "time": "2014-05-21", "level": "", "num_look": 143044, "num_comment": 3, "author": "lanlan", "tags": ["资讯"], "text": ""}
{"title": "2014上半年国内安卓银行应用隐私泄露和安全隐患研究报告", "url": "https://www.freebuf.com/articles/wireless/34733.html", "time": "2014-05-21", "level": "金币+8", "num_look": 281451, "num_comment": 12, "author": "tofreebug", "tags": ["安全报告", "无线安全"], "text": ""}
{"title": "酒仙网招聘安全工程师", "url": "https://www.freebuf.com/jobs/31939.html", "time": "2014-05-20", "level": "", "num_look": 157414, "num_comment": 10, "author": "SecSky", "tags": ["安全招聘"], "text": "酒仙网全称为酒仙网电子商务股份有限公司，成立于2009年，总部位于北京，在上海， 广州，太原，武汉，天津等地拥有子公司和仓储运营中心，是目前中国最大的综合性酒类电子商务公司。"}
{"title": "Hacking go lucky：我们是怎么拿下谷歌产品服务器的", "url": "https://www.freebuf.com/news/34592.html", "time": "2014-05-20", "level": "金币+8", "num_look": 234619, "num_comment": 19, "author": "foglunay", "tags": ["WEB安全", "资讯"], "text": ""}
{"title": "BarsWF：GPU破解MD5神器", "url": "https://www.freebuf.com/sectool/34560.html", "time": "2014-05-20", "level": "金币+8", "num_look": 672393, "num_comment": 66, "author": "az0ne", "tags": ["工具"], "text": ""}
{"title": "关于漏洞平台，我们想清楚了", "url": "https://www.freebuf.com/news/topnews/34734.html", "time": "2014-05-20", "level": "红色标题", "num_look": 861769, "num_comment": 84, "author": "root", "tags": ["头条"], "text": "FreeBuf相信，通过在产品中融入契约精神、有效沟通以及资源的合理配置，可以为厂商与白帽子建立信任、尊重、合作与共赢。"}
{"title": "一个远程代码执行漏洞搞定Yahoo, Microsoft, Orange", "url": "https://www.freebuf.com/articles/web/34689.html", "time": "2014-05-20", "level": "金币+8", "num_look": 273213, "num_comment": 17, "author": "lanlan", "tags": ["WEB安全"], "text": ""}
{"title": "新浪微博安全招贤启事", "url": "https://www.freebuf.com/jobs/34679.html", "time": "2014-05-19", "level": "", "num_look": 272967, "num_comment": 19, "author": "蓝色di雪球", "tags": ["安全招聘"], "text": ""}
{"title": "最新Acunetix Web Vulnerability Scanner 9.5破解版", "url": "https://www.freebuf.com/sectool/34653.html", "time": "2014-05-19", "level": "金币+8", "num_look": 1230721, "num_comment": 32, "author": "init5", "tags": ["工具"], "text": ""}
{"title": "一周海外安全事件回顾（20140512-0518）", "url": "https://www.freebuf.com/news/topnews/34645.html", "time": "2014-05-19", "level": "", "num_look": 575785, "num_comment": 3, "author": "blackscreen", "tags": ["头条", "安全报告"], "text": "上周FireEye发布了一份名叫“Operation Saffron Rose”（藏红花玫瑰行动？）的报告，称一个名叫Ajax Security Team的黑客组织正在发起针对美国军事工业的APT攻击。本期回顾就聊聊这个重新浮出水面的伊朗黑客组织。"}
{"title": "Metasploitable2使用指南", "url": "https://www.freebuf.com/articles/system/34571.html", "time": "2014-05-18", "level": "金币+17", "num_look": 3338062, "num_comment": 38, "author": "謝文東的围脖", "tags": ["系统安全", "网络安全"], "text": "Metasploitable2 虚拟系统是一个特别制作的ubuntu操作系统，本身设计作为安全工具测试和演示常见漏洞攻击。版本2已经可以下载，并且比上一个版本包含更多可利用的安全漏洞。"}
{"title": "在渗透测试中使用fuzz技术(附windows安装指南)", "url": "https://www.freebuf.com/articles/network/34136.html", "time": "2014-05-17", "level": "金币+17", "num_look": 843066, "num_comment": 19, "author": "子夏", "tags": ["网络安全"], "text": "不久前，我们接到了一个渗透测试的项目。分配任务的时候，团队里有的同学负责无线渗透，有的负责web应用渗透，我分到的任务是对外网开放的网络端口进行测试。"}
{"title": "你早已被窃听：小心身边不起眼的东西", "url": "https://www.freebuf.com/news/topnews/34410.html", "time": "2014-05-16", "level": "金币+17", "num_look": 511232, "num_comment": 22, "author": "FB情报组", "tags": ["其他", "头条"], "text": "偷拍设备销售的高峰期在2011~2013年，仅一家普通公司一年的营业额就可以达到4亿元以上。可以说整个市场没有哪一家不做这个东西。"}
{"title": "黑了记者：写个恶意软件玩玩（二）", "url": "https://www.freebuf.com/articles/others-articles/34279.html", "time": "2014-05-16", "level": "", "num_look": 141043, "num_comment": 3, "author": "IDF_Lab", "tags": ["其他"], "text": ""}
{"title": "美国记者新书《无处藏身》全方位揭秘NSA（附电子书下载）", "url": "https://www.freebuf.com/news/34338.html", "time": "2014-05-15", "level": "金币+17", "num_look": 334555, "num_comment": 27, "author": "cs24", "tags": ["资讯"], "text": "美国卫报记者格伦·格林沃尔德GlennGreenwald出版新书《No Place to Hide: Edward Snowden, the NSA, and the U.S. SurveillanceState》披露美国国安局NSA监听丑行。"}
{"title": "0day星期三——新型恶意软件遭遇战", "url": "https://www.freebuf.com/articles/system/33989.html", "time": "2014-05-15", "level": "", "num_look": 212405, "num_comment": 12, "author": "IDF_Lab", "tags": ["系统安全"], "text": "这款较为新颖的恶意软件是我昨天遇到的，今天就被我搞定了。它是一个老的2012 CVE的java攻击包（可能针对SecurityManager）的负载。压缩与解压缩的在VirusTotal/Malwr上都没有查到，所以这又是一个0day啊。"}
{"title": "黑了记者：写个恶意软件玩玩（一）", "url": "https://www.freebuf.com/articles/others-articles/34277.html", "time": "2014-05-14", "level": "红色标题", "num_look": 326444, "num_comment": 13, "author": "IDF_Lab", "tags": ["其他"], "text": "潘多省日报（Pando Daily）的编辑Adam Penenberg最近发表了一篇文章《我让黑客来调查我，他们的发现让我不寒而栗》，讲述了我和我的小伙伴“骚扰”他生活的事情。"}
{"title": "中国电科院招渗透测试工程师和逆向分析工程师", "url": "https://www.freebuf.com/jobs/34287.html", "time": "2014-05-14", "level": "", "num_look": 204606, "num_comment": 19, "author": "中国电科院", "tags": ["安全招聘"], "text": "中国电力科学研究院（简称中国电科院​）成立于1951年，是国家电网公司直属科研单位，是中国电力行业多学科、综合性的科研机构，现面向全社会招聘安全工程师。"}
{"title": "使用portspoof调戏网络攻击者", "url": "https://www.freebuf.com/articles/network/34225.html", "time": "2014-05-14", "level": "金币+17", "num_look": 384541, "num_comment": 6, "author": "Taskiller", "tags": ["网络安全"], "text": ""}
{"title": "Kali Linux邮件组首页被黑", "url": "https://www.freebuf.com/news/34256.html", "time": "2014-05-14", "level": "", "num_look": 201513, "num_comment": 4, "author": "子夏", "tags": ["资讯"], "text": ""}
{"title": "开源BUG跟踪平台JIRA目录遍历漏洞分析", "url": "https://www.freebuf.com/articles/web/34051.html", "time": "2014-05-14", "level": "金币+17", "num_look": 348873, "num_comment": 4, "author": "Taskiller", "tags": ["WEB安全"], "text": "最近，一则新发布的公告报告了一个影响Jira 5.0.11和6.0.3版本的目录遍历漏洞，该漏洞在去年7月份被验证，并在接下来的几个月得以修复。"}
{"title": "浅谈linux系统数据恢复", "url": "https://www.freebuf.com/articles/terminal/33986.html", "time": "2014-05-14", "level": "", "num_look": 281204, "num_comment": 8, "author": "IDF_Lab", "tags": ["终端安全"], "text": "程序员的误操作造成数据丢失，忙着一个星期的项目，就这样付之东流了。老板的痛斥、经理的训斥接踵而来。接下来就是没休息、加班，甚至忙到凌晨都不能离开那该死的电脑，都有种想屎的感觉呢？"}
{"title": "Feedly爆出JS注入漏洞", "url": "https://www.freebuf.com/news/34206.html", "time": "2014-05-13", "level": "金币+17", "num_look": 215189, "num_comment": 8, "author": "lanlan", "tags": ["漏洞", "资讯"], "text": "移动互联网无疑是当今的热门，很多的安全从业者和安全公司也纷纷把目光投向了移动安全，下面的漏洞就是一个例子。"}
{"title": "安华信达多个安全职位纳贤", "url": "https://www.freebuf.com/jobs/34078.html", "time": "2014-05-13", "level": "", "num_look": 159734, "num_comment": 19, "author": "alex", "tags": ["安全招聘"], "text": ""}
{"title": "黑客组织Anonymous被指将面临长达440年的牢狱生涯", "url": "https://www.freebuf.com/news/34167.html", "time": "2014-05-13", "level": "金币+17", "num_look": 332867, "num_comment": 13, "author": "xia0k", "tags": ["资讯"], "text": "FBI在4月29日宣布，著名黑客组织Anonymous的某成员在侵入了县政府、学校、德克萨斯州的一个报业组织之后，现在将面临一共44项指控。"}
{"title": "走进科学：我是如何破解学校饭卡实现免费吃饭的", "url": "https://www.freebuf.com/news/topnews/34146.html", "time": "2014-05-12", "level": "金币+17", "num_look": 13580197, "num_comment": 164, "author": "global_hacker", "tags": ["头条", "极客"], "text": "继上次水卡的成功破解，对学校的饭卡也有点想要研究的念头了。既然这样，打铁趁热马上开始动手！"}
{"title": "一周海外安全事件回顾（20140505-0511）", "url": "https://www.freebuf.com/news/topnews/34128.html", "time": "2014-05-12", "level": "红色标题", "num_look": 349213, "num_comment": 10, "author": "blackscreen", "tags": ["头条"], "text": "本期回顾和大家分享一些叙利亚电子军（SEA）的组织结构、老大联系方式、C&C控制台IP地址等有趣的数据。此外，小鸟网发布了加强用户账号安全的“新方案”。最后，专家称至少有30万台服务器仍旧存在OpenSSL滴血漏洞。"}
{"title": "Hibernate HQL注入攻击入门", "url": "https://www.freebuf.com/articles/web/33954.html", "time": "2014-05-12", "level": "金币+8", "num_look": 597890, "num_comment": 5, "author": "Taskiller", "tags": ["WEB安全"], "text": "SQL注入是一种大家非常熟悉的攻击方式，目前网络上有大量存在注入漏洞的DBMS，但是，我在网络上找不到针对Hibernate查询语言的相关资源。因此本文总结了笔者在阅读文档和不断试验过程中的一些经验技巧。"}
{"title": "BT5 + wireshark玩wifi捕获和中间人攻击", "url": "https://www.freebuf.com/articles/wireless/33948.html", "time": "2014-05-12", "level": "金币+8", "num_look": 1485743, "num_comment": 70, "author": "成王败寇", "tags": ["无线安全"], "text": "主要思路是通过伪造相同名称的wifi接入点，配合发送ARP数据包，攻击连入伪造wifi的用户。"}
{"title": "利用metasploit进行信息收集", "url": "https://www.freebuf.com/articles/network/33905.html", "time": "2014-05-12", "level": "金币+8", "num_look": 878295, "num_comment": 17, "author": "子夏", "tags": ["网络安全"], "text": "在进行信息收集的时候，我们既要全面详细的获取目标的信息，又要尽量隐藏自己不被发现。Metasploit作为一个非常全面的渗透工具，用来收集信息也非常好用。本文会详细的介绍如何利用Metasploit进行信息收集。"}
{"title": "百度杯(BCTF)全国网络安全技术对抗赛全纪实", "url": "https://www.freebuf.com/news/topnews/34010.html", "time": "2014-05-11", "level": "金币+8", "num_look": 535970, "num_comment": 64, "author": "FB独家", "tags": ["头条"], "text": "‍‍五月一日，劳动节，Freebuf受蓝莲花邀请，本着劳动最光荣的精神，风尘仆仆不顾一切地前往南京，为大家带来本次BCTF夺旗赛及技术论坛的现场直播。"}
{"title": "高效开源的网络扫描框架NINJA-PingU", "url": "https://www.freebuf.com/sectool/33973.html", "time": "2014-05-10", "level": "金币+8", "num_look": 211859, "num_comment": 9, "author": "lanlan", "tags": ["工具"], "text": ""}
{"title": "短域名服务提供商Bitly密码或已泄露", "url": "https://www.freebuf.com/news/33991.html", "time": "2014-05-09", "level": "金币+8", "num_look": 160585, "num_comment": 4, "author": "Mystery", "tags": ["资讯"], "text": ""}
{"title": "上海全位招募渗透测试工程师", "url": "https://www.freebuf.com/jobs/33961.html", "time": "2014-05-09", "level": "", "num_look": 625450, "num_comment": 74, "author": "全位信息", "tags": ["安全招聘"], "text": "上海全位信息技术有限公司是一家专业致力于互联网信息安全行业的企业，注册资本1000万元，公司拥有强大的技术团队。现根据业务需要特别招募英才，望有识之士加盟。"}
{"title": "使用H2数据库管理系统对REST API进行HQL盲注", "url": "https://www.freebuf.com/articles/web/33833.html", "time": "2014-05-09", "level": "金币+8", "num_look": 187906, "num_comment": 2, "author": "Taskiller", "tags": ["WEB安全"], "text": ""}
{"title": "编写变态的(非字母数字的)PHP后门", "url": "https://www.freebuf.com/articles/web/33824.html", "time": "2014-05-09", "level": "金币+8", "num_look": 583610, "num_comment": 42, "author": "tudouya", "tags": ["WEB安全"], "text": ""}
{"title": "对“QQ中奖诈骗”的一次不完全追踪", "url": "https://www.freebuf.com/articles/web/33760.html", "time": "2014-05-09", "level": "金币+8", "num_look": 279175, "num_comment": 17, "author": "getroot", "tags": ["WEB安全"], "text": ""}
{"title": "五问华为：华为缘何受美国情报部门关注？", "url": "https://www.freebuf.com/news/33898.html", "time": "2014-05-08", "level": "", "num_look": 170315, "num_comment": 12, "author": "小马哥", "tags": ["其他", "资讯"], "text": "在专访中，华为内部一位不愿透露姓名的人士表示，华为及中国国安局早就知道华为受到美国方面监控，并表示华为已不看好美国市场。"}
{"title": "最新Android木马正像蠕虫一样传播", "url": "https://www.freebuf.com/news/33843.html", "time": "2014-05-08", "level": "金币+8", "num_look": 228166, "num_comment": 14, "author": "凌晨几度i", "tags": ["终端安全", "资讯"], "text": ""}
{"title": "赛门铁克想要重新发明杀毒软件", "url": "https://www.freebuf.com/news/33814.html", "time": "2014-05-08", "level": "金币+8", "num_look": 156004, "num_comment": 13, "author": "Mystery", "tags": ["资讯"], "text": "25年前，赛门铁克(Symantec Corp.)发明了商用杀毒软件来保护电脑免遭黑客的攻击。如今，该公司称这样的战术注定将失败。"}
{"title": "车联网安全之OBD盒子类安全隐患猜想", "url": "https://www.freebuf.com/geek/33800.html", "time": "2014-05-08", "level": "金币+8", "num_look": 245557, "num_comment": 3, "author": "radiowar", "tags": ["极客"], "text": "搬家总会看到电梯类有相关的车联网概念硬件的广告，所以这两个星期闲暇之时都会好好了解一下相关的信息，以下就是关于最近某企业发布相关产品所进行安全猜测。"}
{"title": "Struts2 S02-020漏洞检测工具", "url": "https://www.freebuf.com/sectool/33687.html", "time": "2014-05-07", "level": "金币+8", "num_look": 503937, "num_comment": 14, "author": "山东安云", "tags": ["工具"], "text": ""}
{"title": "走进科学：我是如何“黑了”星级酒店的", "url": "https://www.freebuf.com/news/topnews/33816.html", "time": "2014-05-07", "level": "金币+23", "num_look": 1077803, "num_comment": 80, "author": "p0tt1", "tags": ["WEB安全", "头条"], "text": "五一期间，实在是因为离家出走又不能睡大街所以去了一家星级宾馆（这理由我自己都不信，但真的不是去开房，大家就信了，好不好？）"}
{"title": "针对近期“博全球眼球的OAuth漏洞”的分析与防范建议", "url": "https://www.freebuf.com/vuls/33750.html", "time": "2014-05-07", "level": "金币+23", "num_look": 379494, "num_comment": 9, "author": "fooying", "tags": ["漏洞"], "text": "﻿据Cnet报道，新加坡南洋理工大学一位名叫Wang Jing的博士生，发现了OAuth和OpenID开源登录工具的“隐蔽重定向”漏洞(Covert Redirect)。"}
{"title": "OpenSSL空指针引用do_ssl3_write", "url": "https://www.freebuf.com/vuls/33684.html", "time": "2014-05-07", "level": "", "num_look": 186227, "num_comment": 2, "author": "胖子", "tags": ["漏洞"], "text": "我们的UC - KEEL工具发现do_ssl3_write一个空指针引用错误（ssl/s3_pkt.c）用于提醒挂起SSL_MODE_RELEASE_BUFFERS标志。这个错误影响最新的1.0.1分支。"}
{"title": "一周海外安全事件回顾（20140428-0504）", "url": "https://www.freebuf.com/news/topnews/33727.html", "time": "2014-05-06", "level": "金币+23", "num_look": 278117, "num_comment": 3, "author": "blackscreen", "tags": ["头条"], "text": ""}
{"title": "黑掉美国（英国、澳大利亚、法国等）的交通控制系统", "url": "https://www.freebuf.com/articles/network/33715.html", "time": "2014-05-06", "level": "金币+23", "num_look": 310829, "num_comment": 13, "author": "Taskiller", "tags": ["网络安全"], "text": ""}
{"title": "跪求解密：美国国安局(NSA)发布招聘密文", "url": "https://www.freebuf.com/news/33734.html", "time": "2014-05-06", "level": "", "num_look": 214128, "num_comment": 24, "author": "helen重出江湖", "tags": ["资讯"], "text": "美国国安局(NSA)负责招聘的Twitter帐户@NSACareers发表了一条内容看似错乱无章的推特，若能破译这条推特，你就可能被国安局招募。"}
{"title": "输入法应用Swype被质疑跟踪用户位置信息", "url": "https://www.freebuf.com/news/33700.html", "time": "2014-05-05", "level": "", "num_look": 113366, "num_comment": 6, "author": "phper", "tags": ["资讯"], "text": ""}
{"title": "欧洲版2014年最佳安全博客评选结果", "url": "https://www.freebuf.com/news/33646.html", "time": "2014-05-05", "level": "金币+23", "num_look": 147262, "num_comment": 3, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "深夜食堂：脱衣女郎教你学编程", "url": "https://www.freebuf.com/articles/others-articles/33658.html", "time": "2014-05-04", "level": "红色标题", "num_look": 357280, "num_comment": 30, "author": "phper", "tags": ["其他"], "text": "为了让用户对码代码保持足够的热情，他们做了一个非常禽兽的设计：随着编程能力的提升，美女教员身上的衣服会越脱越少……"}
{"title": "像折纸一样操作多屏手机", "url": "https://www.freebuf.com/geek/33655.html", "time": "2014-05-04", "level": "", "num_look": 169142, "num_comment": 5, "author": "phper", "tags": ["极客"], "text": ""}
{"title": "世界上最快的密码破解工具oclHashcat v1.20", "url": "https://www.freebuf.com/sectool/33638.html", "time": "2014-05-04", "level": "", "num_look": 568714, "num_comment": 27, "author": "fu4k", "tags": ["工具"], "text": ""}
{"title": "走进科学: 无线安全需要了解的芯片选型、扫描器使用知识", "url": "https://www.freebuf.com/news/topnews/33524.html", "time": "2014-05-04", "level": "金币+23", "num_look": 808395, "num_comment": 35, "author": "LittleHann", "tags": ["头条", "无线安全"], "text": ""}
{"title": "5.1技术回顾：CVE-2013-0640 AdobeReader任意代码执行漏洞分析", "url": "https://www.freebuf.com/vuls/33448.html", "time": "2014-05-02", "level": "金币+23", "num_look": 359696, "num_comment": 6, "author": "vscen", "tags": ["漏洞", "系统安全"], "text": ""}
{"title": "我是如何利用Facebook DDoS攻击任意网站的", "url": "https://www.freebuf.com/articles/web/33345.html", "time": "2014-04-30", "level": "金币+23", "num_look": 512910, "num_comment": 11, "author": "Taskiller", "tags": ["WEB安全", "网络安全"], "text": "这个bug的利用步骤已经于2014年3月3号向Facebook Bug奖励计划报告了，\r\n下面为大家解密我是如何做到的。"}
{"title": "黑客利用搜狐视频XSS漏洞发动大规模DDoS攻击", "url": "https://www.freebuf.com/news/33385.html", "time": "2014-04-30", "level": "金币+23", "num_look": 250475, "num_comment": 18, "author": "雨路", "tags": ["资讯"], "text": "近日提供DDoS防护的公司Incapsula透露全球第27大网站——搜狐网的一个XSS跨站脚本漏洞成为一起大规模僵尸网络DDoS攻击的源头,黑客掌握了搜狐网的一个存储型跨站脚本漏洞（这个漏洞现已被修复）。"}
{"title": "Struts2安全漏洞频出 ，多因Apache官方代码编写不严谨", "url": "https://www.freebuf.com/articles/web/33301.html", "time": "2014-04-30", "level": "", "num_look": 529952, "num_comment": 12, "author": "360网站卫士", "tags": ["WEB安全"], "text": "日前，Struts2再次爆出安全漏洞，主要影响国内电商、银行、运营商等诸多大型网站和为数众多的政府网站。国外安全研究人员日前发现，Apache Struts2在处理CVE-2014-0094的漏洞补丁中存在缺陷，会被轻易绕过，可导致…"}
{"title": "绿盟科技分析报告：DDoS兵器谱2014Q1版", "url": "https://www.freebuf.com/articles/web/33277.html", "time": "2014-04-30", "level": "", "num_look": 313689, "num_comment": 5, "author": "绿盟科技", "tags": ["WEB安全", "安全报告"], "text": "网络攻防是发生在第五空间的对抗和战争。这是一个动态的过程，无论攻击者还是防御者都在实战中寻求进步。攻防双方的“兵器”就在这个战场中不断磨砺和进化。"}
{"title": "Android系统的阿基里斯之踵：伪造短信篇", "url": "https://www.freebuf.com/articles/terminal/33127.html", "time": "2014-04-29", "level": "", "num_look": 203565, "num_comment": 6, "author": "kotobukki", "tags": ["终端安全"], "text": "本文利用android4.0的一个原生漏洞来伪造短信。无须声明任何权限即可伪造发送方为任何号码的短信给用户。"}
{"title": "Anonymous前黑客充当FBI线人，带头攻击多国政府网站", "url": "https://www.freebuf.com/news/33281.html", "time": "2014-04-29", "level": "金币+3", "num_look": 126815, "num_comment": 13, "author": "Mystery", "tags": ["资讯"], "text": "一位知名网络黑客充当美国联邦调查局线人，带头指挥数百次网络袭击，入侵巴西、伊朗、巴基斯坦、叙利亚、土耳其等多国的政府网站。"}
{"title": "Joomla插件构造函数后门分析", "url": "https://www.freebuf.com/articles/web/33275.html", "time": "2014-04-29", "level": "金币+3", "num_look": 194077, "num_comment": 6, "author": "Taskiller", "tags": ["WEB安全"], "text": ""}
{"title": "一周海外安全事件回顾（20140421-0427）", "url": "https://www.freebuf.com/news/topnews/33285.html", "time": "2014-04-29", "level": "金币+3", "num_look": 225932, "num_comment": 3, "author": "blackscreen", "tags": ["头条", "安全报告"], "text": "本周，我们不谈Struts2补丁漏洞的绕过问题，无论度娘还是谷歌，类似的文章不要太多。我们从更广泛的角度谈谈数据泄漏这个老话题。你知道吗，黑阔对POS系统的入侵，51%是秒入。"}
{"title": "360 HackGame(1-10)通关攻略", "url": "https://www.freebuf.com/articles/web/33145.html", "time": "2014-04-29", "level": "", "num_look": 371945, "num_comment": 15, "author": "sunwell", "tags": ["WEB安全"], "text": ""}
{"title": "绿盟科技威胁分析报告：那些年，那些 Apache Struts2 的漏洞", "url": "https://www.freebuf.com/articles/web/33232.html", "time": "2014-04-29", "level": "红色标题", "num_look": 437953, "num_comment": 16, "author": "绿盟科技", "tags": ["WEB安全"], "text": ""}
{"title": "HeartbleedScanner汉化版-", "url": "https://www.freebuf.com/sectool/33191.html", "time": "2014-04-28", "level": "金币+3", "num_look": 651129, "num_comment": 24, "author": "小威", "tags": ["工具"], "text": "HeartbleedScanner可以扫描WEB服务器、VPN、FTP服务器、eMail服务器、路由器、打印机和智能手机等设备中的心脏出血漏洞。而且可以从存在漏洞的服务器抓取64KB内存，让你直观地看到心脏出血漏洞攻击的厉害。"}
{"title": "手机系统升级可能会“唤醒”潜藏的恶意软件", "url": "https://www.freebuf.com/news/33156.html", "time": "2014-04-28", "level": "金币+3", "num_look": 181566, "num_comment": 8, "author": "sunwell", "tags": ["终端安全", "资讯"], "text": "来自印第安纳Bloomington大学和微软的研究人员发现了一个Android设备的严重缺陷，这个缺陷导致升级之后的Android设备有被恶意软件感染的危险。"}
{"title": "破碎的IE：全版本远程代码执行0day披露CVE-2014-1776", "url": "https://www.freebuf.com/vuls/33193.html", "time": "2014-04-28", "level": "金币+3", "num_look": 294619, "num_comment": 10, "author": "Mystery", "tags": ["漏洞"], "text": ""}
{"title": "Scream VM测试笔记", "url": "https://www.freebuf.com/articles/system/33062.html", "time": "2014-04-28", "level": "金币+3", "num_look": 172432, "num_comment": 8, "author": "Taskiller", "tags": ["系统安全"], "text": ""}
{"title": "Heartbleed 补丁绕过漏洞，又一个乌龙，还是比特币骗局？", "url": "https://www.freebuf.com/news/33029.html", "time": "2014-04-28", "level": "金币+3", "num_look": 191103, "num_comment": 21, "author": "小火柴", "tags": ["资讯"], "text": "他们发现OpenSSL修补方案扔然存在漏洞，在处理变量 DOPENSSL_NO_HEARTBEATS时，未进行边界检查，使他们成功的覆盖\"DOPENSSL_NO_HEARTBEATS\" 变量，继而继续获取64kb的内存数据。"}
{"title": "黑客组织Anonymous正在开发新型无线通信工具", "url": "https://www.freebuf.com/news/33115.html", "time": "2014-04-27", "level": "金币+3", "num_look": 188505, "num_comment": 20, "author": "phper", "tags": ["资讯"], "text": "全美第一黑客组织Anonymous近日宣布他们正在开发一种名为Airchat的新型通讯工具，可以使用不通过手机或因特网进行沟通，取而代之的是使用无线电通讯技术。"}
{"title": "从Android短信漏洞到手机钓鱼木马", "url": "https://www.freebuf.com/articles/terminal/33060.html", "time": "2014-04-27", "level": "金币+3", "num_look": 425175, "num_comment": 10, "author": "三只小潴", "tags": ["终端安全"], "text": "他注意到老总经常在一个在线交易平台上进行操作,他需要一个短信木马来伪造该交易平台发送的短信,诱使老总访问钓鱼页面来获得账号和密码。"}
{"title": "黑暗搜索引擎Shodan Chrome插件", "url": "https://www.freebuf.com/sectool/32993.html", "time": "2014-04-25", "level": "金币+3", "num_look": 1048693, "num_comment": 28, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "华为高管：斯诺登爆料后，我们很忙", "url": "https://www.freebuf.com/news/32957.html", "time": "2014-04-25", "level": "", "num_look": 339439, "num_comment": 14, "author": "fu4k", "tags": ["资讯"], "text": "华为(Huawei)高管近几周奔波于全球各地，力求说服客户放心：他们的设备并没有被攻破。"}
{"title": "开源web漏洞扫描系统 - IronWASP 2014版发布", "url": "https://www.freebuf.com/sectool/32948.html", "time": "2014-04-25", "level": "", "num_look": 442334, "num_comment": 11, "author": "lock", "tags": ["工具"], "text": "IronWASP是一款开源的Web应用程序漏洞扫描系统，用户可以自定义安全扫描，并且可以自己用python/ruby来定义插件系统，来丰富漏洞测试项目，插件系统的语言版本是IronPython和IronRuby，语法上类似CPython和CRuby。"}
{"title": "ISEC完成对TrueCrypt的第一阶段代码审计，未发现安全问题", "url": "https://www.freebuf.com/news/32940.html", "time": "2014-04-25", "level": "", "num_look": 220040, "num_comment": 10, "author": "H3lvin", "tags": ["资讯"], "text": "近日，iSEC公布了完整的审计报告，报告中声明没有完成高危的安全问题，也没有发现任何后门和恶意代码。并提到了TrueCrypt虽然编程风格不是最高雅的，但是这样也不影响大局。"}
{"title": "HP Webinspect 10.0 安全评估工具，附破解补丁", "url": "https://www.freebuf.com/sectool/32860.html", "time": "2014-04-25", "level": "金币+6", "num_look": 1346179, "num_comment": 55, "author": "d3pT1", "tags": ["工具"], "text": ""}
{"title": "Struts2再曝S2-020补丁绕过漏洞 - 万恶的正则表达式", "url": "https://www.freebuf.com/vuls/32884.html", "time": "2014-04-24", "level": "金币+6", "num_look": 468780, "num_comment": 13, "author": "FB情报组", "tags": ["漏洞"], "text": "4月24日，网络曝出文章“安全研究人员指出Apache Struts2在漏洞公告S2-020里，在处理修复CVE-2014-0094的漏洞修补方案存在漏洞，导致补丁被完全绕过。"}
{"title": "WebPwn3r Web应用程序漏洞扫描程序(附视频)", "url": "https://www.freebuf.com/sectool/32791.html", "time": "2014-04-24", "level": "金币+6", "num_look": 299551, "num_comment": 18, "author": "嘎巴嘎巴", "tags": ["工具"], "text": ""}
{"title": "heartbleed漏洞检查工具集合", "url": "https://www.freebuf.com/sectool/32785.html", "time": "2014-04-24", "level": "金币+6", "num_look": 530225, "num_comment": 10, "author": "嘎巴嘎巴", "tags": ["工具"], "text": "4月9日，一个代号“Heartbleed”（意为“心脏出血”）的重大安全漏洞日前被曝光，它能让攻击者从服务器内存中读取包括用户名、密码和信用卡号等隐私信息在内的数据，本文总结了网友开发的Heartbleed漏洞检查工具。"}
{"title": "FreeBuf 2014年夏季T恤设计征集活动", "url": "https://www.freebuf.com/fevents/32821.html", "time": "2014-04-24", "level": "红色标题", "num_look": 594191, "num_comment": 185, "author": "FB客服", "tags": ["活动"], "text": "今年夏季我们准备再次推出纪念T恤，不过这次的设计图案是面对所有人的，也就是说每个人都有机会运用自己的创意，让“FreeBuf”成为今年夏季最独具特色的经典。我们相信，每一位黑客都是艺术家！"}
{"title": "国产BurpSuite插件 Assassin V1.1发布", "url": "https://www.freebuf.com/sectool/32746.html", "time": "2014-04-24", "level": "金币+6", "num_look": 359523, "num_comment": 20, "author": "如果M微笑", "tags": ["工具"], "text": ""}
{"title": "Google Hacking：教你找女神", "url": "https://www.freebuf.com/articles/web/32610.html", "time": "2014-04-24", "level": "金币+6", "num_look": 1676104, "num_comment": 19, "author": "灵柩", "tags": ["WEB安全", "其他"], "text": "此文详细介绍了作者跳出来反社工原文作者的经过，他还透露了女神确实很漂亮。看来都是女神惹的货，看得我等小白简直要按捺不住了……"}
{"title": "基于爬虫结果的web路径扫描程序 - bcrpscan", "url": "https://www.freebuf.com/sectool/32509.html", "time": "2014-04-23", "level": "金币+6", "num_look": 329734, "num_comment": 12, "author": "secfree", "tags": ["工具"], "text": "运维和开发人员可能会将程序源码包或备份文件放在 Web 目录中, 可以通过网络直接访问. 此时 Web 路径扫描就可以发挥作用. 一般都是通过迭代大量的目录和文件名列表发起 HTTP 请求, 根据结果判断文件是否存在。"}
{"title": "Kali-Linux扩充弹药：Kali Linux metapackages", "url": "https://www.freebuf.com/sectool/32691.html", "time": "2014-04-23", "level": "金币+6", "num_look": 666093, "num_comment": 37, "author": "10457793", "tags": ["工具"], "text": ""}
{"title": "浅析FPGA现场可编程门阵列", "url": "https://www.freebuf.com/articles/terminal/30764.html", "time": "2014-04-23", "level": "金币+6", "num_look": 438511, "num_comment": 16, "author": "global_hacker", "tags": ["终端安全"], "text": ""}
{"title": "浑水：网秦第四季度营收造假", "url": "https://www.freebuf.com/news/32717.html", "time": "2014-04-22", "level": "", "num_look": 114545, "num_comment": 8, "author": "fu4k", "tags": ["资讯"], "text": "美国做空机构浑水（Muddy Waters）近日再次发布名为《网秦，骗得了一时骗不了一世》的报告，指责网秦在4月11日发布2013年第四季度财报前后，继续作假。"}
{"title": "视频：FBI警告美在中国留学生勿当间谍", "url": "https://www.freebuf.com/video/32646.html", "time": "2014-04-22", "level": "红色标题", "num_look": 430084, "num_comment": 23, "author": "FB视频", "tags": ["视频"], "text": "情报活动自古以来就活跃在各大国家各种势力之间，和许多国家结下梁子的美国在这方面尤其重视。近日美国FBI在其官网发布这则视频把矛头指向了中国，其中暗含了对中国这个“假想敌”的忧虑。"}
{"title": "Ruby OpenSSL 私钥伪造脚本", "url": "https://www.freebuf.com/sectool/32468.html", "time": "2014-04-22", "level": "金币+6", "num_look": 184008, "num_comment": 2, "author": "胖子", "tags": ["工具"], "text": ""}
{"title": "XKungfoo2014安全会议全程纪实", "url": "https://www.freebuf.com/fevents/32658.html", "time": "2014-04-22", "level": "红色标题", "num_look": 1213153, "num_comment": 39, "author": "FB独家", "tags": ["活动"], "text": "​2014年4月16-17日，北京华永兴安科学技术有限公司承办的XKungfoo2014上海举行，会议有来自各行各业的安全从业人员参加，并有许多重量级人物演讲等。FreeBuf作为独家官方合作媒体全程微博直播（@黑客与极客live）会…"}
{"title": "使用HackRF解调TDD-LTE信号", "url": "https://www.freebuf.com/articles/wireless/32331.html", "time": "2014-04-22", "level": "", "num_look": 880035, "num_comment": 11, "author": "scateu", "tags": ["无线安全"], "text": "软件无线电（Software Defined Radio）以前往往以高（zhuang）大（bi）上（fan）的面目示人，是大公司或学校实验室的高级玩具，一套系统动辄几万甚至几十万，从来都是一个2B（2B = to business）的模式。"}
{"title": "HeartBleed漏洞：血淋淋的外表下却是一片祥和", "url": "https://www.freebuf.com/articles/neopoints/32428.html", "time": "2014-04-22", "level": "金币+5", "num_look": 156952, "num_comment": 1, "author": "SINA2312447841", "tags": ["观点"], "text": "最近Heart bleed漏洞在互联网上掀起了轩然巨波，作为基础安全软件的重大漏洞，影响深远，各大互联网公司、甲方、乙方、白帽子甚至央视等媒体全都行动起来，同仇敌忾，竞相测试、打补丁、升级、报道宣传......"}
{"title": "当黑客邂逅爱情续：不作死就不会死", "url": "https://www.freebuf.com/articles/others-articles/32551.html", "time": "2014-04-21", "level": "红色标题", "num_look": 763269, "num_comment": 70, "author": "小K", "tags": ["其他"], "text": "我不是什么大侠，但是仗着自己有几分电脑知识（弄完才发现跟电脑知识根本没关系），所以也对这个人进行了一番小小的调查。"}
{"title": "看你是否够老 - ipman的vxd程序介绍的翻译", "url": "https://www.freebuf.com/articles/network/32186.html", "time": "2014-04-21", "level": "金币+5", "num_look": 458634, "num_comment": 5, "author": "spaceshuttle", "tags": ["网络安全"], "text": ""}
{"title": "Nmap从探测到漏洞利用备忘录 - Nmap简介(一)", "url": "https://www.freebuf.com/articles/network/32302.html", "time": "2014-04-21", "level": "金币+5", "num_look": 2128861, "num_comment": 18, "author": "novsec", "tags": ["网络安全"], "text": "Nmap (网络映射器)是一个开源工具，它使网络探测和安全审计得以专业化。最初由 Gordon “Fyodor” Lyon 发布。Nmap是一个免费的用来实现网络探测和安全审计的开源程序。"}
{"title": "金蝶软件招贤-Web安全工程师、安全架构师", "url": "https://www.freebuf.com/jobs/32217.html", "time": "2014-04-21", "level": "", "num_look": 164053, "num_comment": 19, "author": "ppu8", "tags": ["安全招聘"], "text": ""}
{"title": "一周海外安全事件回顾（20140414-0420）", "url": "https://www.freebuf.com/news/topnews/32527.html", "time": "2014-04-21", "level": "金币+5", "num_look": 302520, "num_comment": 12, "author": "blackscreen", "tags": ["头条"], "text": "在上周，“心脏滴血”（Heartbleed）仍旧是最热的话题。谁应该为滴血漏洞负主要责任呢？就在安全界争论到最热闹的时候，史上“最伟大”的程序猿出现了。他说，你们都别吵了，那段OpenSSL问题代码尼玛就是我写的。"}
{"title": "开源Web应用防火墙-ModSecurity v2.8发布", "url": "https://www.freebuf.com/sectool/32374.html", "time": "2014-04-20", "level": "金币+5", "num_look": 254676, "num_comment": 14, "author": "litdg", "tags": ["工具"], "text": ""}
{"title": "周末阅读：当黑客邂逅爱情", "url": "https://www.freebuf.com/articles/others-articles/32389.html", "time": "2014-04-19", "level": "金币+5", "num_look": 776359, "num_comment": 102, "author": "凌晨几度i", "tags": ["其他"], "text": "黑客小熊在食堂吃饭，看到一位美女。她的音容笑貌，婀娜多姿的身材，性感的黑丝让他的内心泛起了一丝涟漪。"}
{"title": "安全科普：流量劫持能有多大危害？", "url": "https://www.freebuf.com/articles/web/32258.html", "time": "2014-04-18", "level": "金币+5", "num_look": 514083, "num_comment": 14, "author": "gethostbyname", "tags": ["WEB安全", "网络安全"], "text": "不同的劫持方式，获得的流量也有所差异。DNS 劫持，只能截获通过域名发起的流量，直接使用 IP 地址的通信则不受影响；CDN 入侵，只有浏览网页或下载时才有风险，其他场合则毫无问题；而网关被劫持，用户所有流量都…"}
{"title": "携程安全中心纳贤启示", "url": "https://www.freebuf.com/jobs/32329.html", "time": "2014-04-18", "level": "", "num_look": 172375, "num_comment": 13, "author": "携程安全中心", "tags": ["安全招聘"], "text": ""}
{"title": "国外安全厂商披露30个Java云服务的0day细节", "url": "https://www.freebuf.com/news/32211.html", "time": "2014-04-18", "level": "金币+5", "num_look": 159804, "num_comment": 4, "author": "pynwolf", "tags": ["资讯"], "text": ""}
{"title": "CVE-2014-0160 Heartbleed分析报告", "url": "https://www.freebuf.com/articles/web/31700.html", "time": "2014-04-18", "level": "金币+5", "num_look": 621144, "num_comment": 14, "author": "Gall", "tags": ["WEB安全"], "text": ""}
{"title": "Nmap扫描对比工具--libnmap实践", "url": "https://www.freebuf.com/sectool/32092.html", "time": "2014-04-17", "level": "金币+5", "num_look": 496802, "num_comment": 16, "author": "Gavin", "tags": ["工具"], "text": ""}
{"title": "OpenSSL心脏出血漏洞全回顾", "url": "https://www.freebuf.com/articles/network/32171.html", "time": "2014-04-17", "level": "金币+5", "num_look": 1735764, "num_comment": 14, "author": "安慧科技", "tags": ["网络安全"], "text": ""}
{"title": "奥巴马允许NSA利用网络0day漏洞", "url": "https://www.freebuf.com/news/32203.html", "time": "2014-04-16", "level": "", "num_look": 186225, "num_comment": 11, "author": "phper", "tags": ["资讯"], "text": "“中国人绝不会因为我们放弃‘零日’而放弃‘零日’。”"}
{"title": "安全科普：详解流量劫持的形成原因", "url": "https://www.freebuf.com/articles/network/31707.html", "time": "2014-04-16", "level": "", "num_look": 595232, "num_comment": 16, "author": "gethostbyname", "tags": ["网络安全"], "text": ""}
{"title": "国产BurpSuite 插件 Assassin V1.0发布", "url": "https://www.freebuf.com/sectool/32153.html", "time": "2014-04-16", "level": "金币+15", "num_look": 409723, "num_comment": 38, "author": "如果M微笑", "tags": ["工具"], "text": "Assassin翻译过来刺客的意思，信息探测。目前这个小工具只有两个功能，一个是旁注，另外一个是子域名暴力破解。貌似国内还没有写Burp插件的，没见别人发过，也可能别人早已经写好了在偷偷用了。"}
{"title": "Office”组合”式漏洞攻击样本分析", "url": "https://www.freebuf.com/vuls/31968.html", "time": "2014-04-16", "level": "", "num_look": 269339, "num_comment": 4, "author": "翰海源安全", "tags": ["漏洞"], "text": "网上公开一个疑似CVE-2014-1761的RTF样本，翰海源分析发现该样本并非CVE-2014-1761，而是在一个RTF样本中同时包括了两个漏洞，分别为CVE-2012-0158和CVE-2013-3906，比较特殊。"}
{"title": "360安全卫士被关闭漏洞分析", "url": "https://www.freebuf.com/articles/system/31951.html", "time": "2014-04-16", "level": "金币+15", "num_look": 585916, "num_comment": 46, "author": "椒图科技", "tags": ["系统安全"], "text": ""}
{"title": "锤子科技招聘网络安全工程师", "url": "https://www.freebuf.com/jobs/32060.html", "time": "2014-04-15", "level": "", "num_look": 235760, "num_comment": 36, "author": "锤子科技", "tags": ["安全招聘"], "text": "锤子科技是一家制造移动互联网终端设备的公司，公司的使命是用完美主义的工匠精神，打造用户体验一流的数码消费类产品（智能手机为主），改善人们的生活质量，现招聘安全工程师，详情入内。"}
{"title": "腾讯TSRC 第二届安全沙龙纪实：感恩、交流、开放", "url": "https://www.freebuf.com/news/topnews/32096.html", "time": "2014-04-15", "level": "红色标题", "num_look": 388566, "num_comment": 24, "author": "FB独家", "tags": ["头条"], "text": "2014年4月11-12日，腾讯TSRC举行了第二届的安全沙龙（主题：感恩、交流、开放），会议除了邀请各大SRC平台负责人参加（阿里、百度、当当、网易、迅雷、新浪、华为等）之外，还邀请了众多为TSRC贡献漏洞的白帽子。"}
{"title": "360招聘安全工程师", "url": "https://www.freebuf.com/jobs/31656.html", "time": "2014-04-15", "level": "", "num_look": 320422, "num_comment": 14, "author": "zhuowater", "tags": ["安全招聘"], "text": ""}
{"title": "专家解释“愤怒的小鸟”如何变身间谍", "url": "https://www.freebuf.com/news/32013.html", "time": "2014-04-15", "level": "金币+15", "num_look": 377742, "num_comment": 6, "author": "pynwolf", "tags": ["资讯"], "text": ""}
{"title": "SQLmap简介以及防火墙绕过方法", "url": "https://www.freebuf.com/articles/web/31568.html", "time": "2014-04-15", "level": "金币+15", "num_look": 2050999, "num_comment": 15, "author": "novsec", "tags": ["WEB安全"], "text": "许多现实中对于网站的攻击往往是由于网站没有及时更新或者对于用户的输入没有进行检查。从缓冲区溢出说起，这样一种针对系统脆弱性的威胁，最根本的问题还是在于对于用户的输入没有进行检查。"}
{"title": "记一次完整的办公网渗透到idc过程", "url": "https://www.freebuf.com/articles/web/31891.html", "time": "2014-04-15", "level": "金币+15", "num_look": 424150, "num_comment": 27, "author": "xxx", "tags": ["WEB安全"], "text": "看到各位大神分享他们内网渗透的经验与技巧,小菜打算也来分享分享。个人觉得渗透一个内网并非把所有服务器搞下来算渗透成功,我觉得是把关键性的服务器拿下来就行了,如AD ldap、mail、拿到你想要的东西就是成功(当然…"}
{"title": "北京安信华招聘Web攻防工程师", "url": "https://www.freebuf.com/jobs/31435.html", "time": "2014-04-14", "level": "", "num_look": 143522, "num_comment": 6, "author": "安信华", "tags": ["安全招聘"], "text": ""}
{"title": "新数据证实黑客能通过Heartbleed漏洞窃取私钥", "url": "https://www.freebuf.com/vuls/32004.html", "time": "2014-04-14", "level": "", "num_look": 263759, "num_comment": 5, "author": "JohnChu", "tags": ["WEB安全", "漏洞"], "text": "​网络服务公司Cloudflare周六报道称，与之前的怀疑相反，黑客可以通过被称为“Heartbleed”的重大漏洞从有漏洞的网站中获取私钥。"}
{"title": "科普哈希长度扩展攻击(Hash Length Extension Attacks)", "url": "https://www.freebuf.com/articles/web/31756.html", "time": "2014-04-14", "level": "金币+15", "num_look": 872404, "num_comment": 10, "author": "Ettack", "tags": ["WEB安全"], "text": "貌似大多数渗透师都很少测试密码学方面的漏洞。我一直都对密码学颇有兴趣，于是决定研究web应用开发者误用加密算法的情况，以及如何利用这些漏洞。一月份的时候，我研究了下对于一些比较弱的Message Authentication…"}
{"title": "Web安全扫描器 IBM Appscan 9.0发布", "url": "https://www.freebuf.com/sectool/31762.html", "time": "2014-04-14", "level": "", "num_look": 1282468, "num_comment": 72, "author": "nexpose", "tags": ["工具"], "text": ""}
{"title": "LTE小区搜索软件LTE-Cell-Scanner加入对HackRF的支持", "url": "https://www.freebuf.com/articles/wireless/31724.html", "time": "2014-04-14", "level": "金币+15", "num_look": 304270, "num_comment": 9, "author": "scateu", "tags": ["无线安全"], "text": ""}
{"title": "一周海外安全事件回顾（2014.04.07 – 2014.04.13）", "url": "https://www.freebuf.com/news/topnews/31930.html", "time": "2014-04-14", "level": "金币+10", "num_look": 233460, "num_comment": 12, "author": "blackscreen", "tags": ["头条"], "text": "在上周，“心脏滴血”（Heartbleed）无疑是安全界最大的新闻；事实上，应该是最近几年最大的安全事件。此外，一份包含姓名、照片、用户名和密码的Anonymous成员名单无疑会让你大饱眼福。最后，将和大家分享我常用的一…"}
{"title": "某些浏览器中因cookie设置HttpOnly标志引起的安全问题", "url": "https://www.freebuf.com/articles/web/31644.html", "time": "2014-04-14", "level": "金币+10", "num_look": 684613, "num_comment": 13, "author": "Taskiller", "tags": ["WEB安全"], "text": "如果cookie设置了HttpOnly标志，可以在发生XSS时避免JavaScript读取cookie，这也是HttpOnly被引入的原因。但这种方式能防住攻击者吗？HttpOnly标志可以防止cookie被“读取”，那么能不能防止被“写”呢？答案是否定的。"}
{"title": "国外路由器密码扫描工具", "url": "https://www.freebuf.com/sectool/31680.html", "time": "2014-04-14", "level": "金币+10", "num_look": 528901, "num_comment": 37, "author": "kotobukki", "tags": ["工具"], "text": "本软件善于寻找和确定不同的设备，发现大量已知的路由器或服务器，最重要的是把其中有用的信息，特别是无线网络的保护方法的特点：接入点的接入点名称（加密），接入点（SSID）和密钥（密码）和输出的牌子和路由器…"}
{"title": "分析Wordpress 3.8.2修复的cookie伪造漏洞", "url": "https://www.freebuf.com/vuls/31770.html", "time": "2014-04-13", "level": "金币+10", "num_look": 407778, "num_comment": 30, "author": "Ettack", "tags": ["WEB安全", "漏洞"], "text": "4月8日,wordpress發布了一個重要更新，在該次更新中，修復了一系列安全漏洞。其中最顯眼的就是cookie伪造漏洞（CVE -2014- 0166），我們來看修補的代碼。"}
{"title": "思科Juniper发现多款产品存在Heartbleed漏洞", "url": "https://www.freebuf.com/news/31666.html", "time": "2014-04-12", "level": "金币+10", "num_look": 172041, "num_comment": 8, "author": "嘎巴嘎巴", "tags": ["资讯"], "text": "世界最大网络设备供应商之一的思科公司向客户发出了安全警告​，OpenSSL的Heartbleed安全漏洞不只是影响Web服务器，至少还有13款产品发现存在Heartbleed漏洞，其中包括了IOS XE操作系统。"}
{"title": "浅析白盒审计中的字符编码及SQL注入", "url": "https://www.freebuf.com/articles/web/31537.html", "time": "2014-04-12", "level": "金币+10", "num_look": 715053, "num_comment": 46, "author": "phithon", "tags": ["WEB安全"], "text": "尽管现在呼吁所有的程序都使用unicode编码，所有的网站都使用utf-8编码，来一个统一的国际规范。但仍然有很多，包括国内及国外（特别是非英语国家）的一些cms，仍然使用着自己国家的一套编码，比如gbk，作为自己默…"}
{"title": "技术宅打造全能美剧播放器", "url": "https://www.freebuf.com/articles/others-articles/31576.html", "time": "2014-04-12", "level": "金币+10", "num_look": 232976, "num_comment": 11, "author": "Yaseng", "tags": ["其他", "极客"], "text": "看到有同仁发《权力的游戏》自动追剧脚本,老衲也来凑个热闹..移动端最好的播放器非云播君莫属了,极速而方便,高清而无码,可惜最近资源被和谐,每次有美剧更新需要用浏览器手工添加播放源或者pc端添加,很是麻烦的说。"}
{"title": "白帽黑客为教训客户泄漏数据，遭FBI查水表", "url": "https://www.freebuf.com/news/31660.html", "time": "2014-04-11", "level": "红色标题", "num_look": 345104, "num_comment": 34, "author": "fu4k", "tags": ["资讯"], "text": "David Helkowski曾在咨询公司Canton Group工作，是一位“白帽子”黑客。他利用多个VPN帐号从家中渗透进大学的网络，下载了校警的个人数据，匿名发布在Pastebin上。虽然被捕，但他坚信自己所作所为“在道德上没有犯错。"}
{"title": "观点：从OpenSSL漏洞看各甲方响应质量", "url": "https://www.freebuf.com/articles/neopoints/31529.html", "time": "2014-04-11", "level": "金币+10", "num_look": 141067, "num_comment": 3, "author": "baoz", "tags": ["观点"], "text": "互联网上信息传播速度和影响力比以前增长了不啻数倍，甲方在响应漏洞的时候，咱得跟上节奏，否则就可能被曝光了，在大水军的推动下，安全行业已经升华为情报行业了，嗯，通俗的说就是安全和娱乐挂钩，优雅点就是安…"}
{"title": "三分之一的网络钓鱼针对金融机构", "url": "https://www.freebuf.com/news/31464.html", "time": "2014-04-11", "level": "金币+10", "num_look": 119869, "num_comment": 1, "author": "嘎巴嘎巴", "tags": ["资讯"], "text": "根据卡巴斯基实验室的研究，大约三分之一（ 31.45 ％）的网络钓鱼攻击针对在线金融机构，包括银行、在线商城及电子支付系统。这些钓鱼攻击中， 70.6 ％使用伪造的银行网页，以获取用户机密信息，并窃取金钱从银行帐…"}
{"title": "分享ACTF中题目S4ndbox的解法", "url": "https://www.freebuf.com/articles/web/31231.html", "time": "2014-04-11", "level": "金币+10", "num_look": 190741, "num_comment": 12, "author": "0x710dddd", "tags": ["WEB安全"], "text": ""}
{"title": "判断是否支持Heartbeat的NSE脚本", "url": "https://www.freebuf.com/articles/system/31499.html", "time": "2014-04-11", "level": "金币+10", "num_look": 197605, "num_comment": 2, "author": "尹钰", "tags": ["系统安全"], "text": ""}
{"title": "椒图科技招聘渗透工程师", "url": "https://www.freebuf.com/jobs/31319.html", "time": "2014-04-10", "level": "", "num_look": 252550, "num_comment": 18, "author": "椒图科技", "tags": ["安全招聘"], "text": ""}
{"title": "比想象中更恐怖！OpenSSL“心血”漏洞深入分析", "url": "https://www.freebuf.com/articles/web/31553.html", "time": "2014-04-10", "level": "", "num_look": 936503, "num_comment": 26, "author": "360网站卫士", "tags": ["WEB安全"], "text": "近日，OpenSSL爆出本年度最严重的安全漏洞，此漏洞在黑客社区中被命名为“心脏出血”漏洞。360网站卫士安全团队对该漏洞分析发现，该漏洞不仅是涉及到https开头的网址，还包含间接使用了OpenSSL代码的产品和服务，比…"}
{"title": "论技术宅如何正确的追《权力的游戏》", "url": "https://www.freebuf.com/articles/others-articles/31451.html", "time": "2014-04-10", "level": "金币+10", "num_look": 317885, "num_comment": 13, "author": "ha3ky0u", "tags": ["其他", "极客"], "text": "最近，Game of thrones Season4（权力的游戏）上映了，作为忠实的粉丝，刷了一上午的人人影视啊，我心爱的丹妮丽思。坑爹的HBO一周才更新一次，还尼玛北京时间是周一上午，放在周末让小伙伴们爽一爽不好吗！！！"}
{"title": "Android锁屏破解研究", "url": "https://www.freebuf.com/articles/terminal/31176.html", "time": "2014-04-10", "level": "金币+10", "num_look": 781245, "num_comment": 39, "author": "三只小潴", "tags": ["终端安全"], "text": ""}
{"title": "Web应用手工渗透测试——用SQLMap进行SQL盲注测试", "url": "https://www.freebuf.com/articles/web/31160.html", "time": "2014-04-10", "level": "金币+9", "num_look": 1855459, "num_comment": 19, "author": "Taskiller", "tags": ["WEB安全"], "text": "本文主要关注SQL注入，假设读者已经了解一般的SQL注入技术，在我之前的文章中有过介绍，即通过输入不同的参数，等待服务器的反应，之后通过不同的前缀和后缀（suffix and prefix ）注入到数据库。"}
{"title": "伪造数据生成工具 - Faker", "url": "https://www.freebuf.com/sectool/30730.html", "time": "2014-04-09", "level": "金币+9", "num_look": 310075, "num_comment": 12, "author": "我是酱油男", "tags": ["工具"], "text": "Faker是一款由python语言开发的工具，能够为我们生成伪造数据的Python包，有时候我们需要生成大量看起来正常的伪数据，此时我们可以用到Faker来实现这些目的。Faker可以直接在控制台窗口使用或者通过调用API（应用…"}
{"title": "IIS4\\IIS5 CGI环境块伪造0day漏洞", "url": "https://www.freebuf.com/vuls/31444.html", "time": "2014-04-09", "level": "", "num_look": 268969, "num_comment": 20, "author": "yuange", "tags": ["漏洞"], "text": "大约14年前发现一直到现在的0day……by yuange"}
{"title": "OpenSSL HeartBleed漏洞批量检测工具", "url": "https://www.freebuf.com/sectool/31421.html", "time": "2014-04-09", "level": "金币+9", "num_look": 583674, "num_comment": 26, "author": "溯溪", "tags": ["工具", "网络安全"], "text": ""}
{"title": "人工代码安全审核工具 - Agnitio", "url": "https://www.freebuf.com/sectool/31027.html", "time": "2014-04-09", "level": "", "num_look": 257138, "num_comment": 9, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "百度云安全部招聘安全、研发工程师", "url": "https://www.freebuf.com/jobs/31323.html", "time": "2014-04-09", "level": "", "num_look": 334875, "num_comment": 66, "author": "aaa6356", "tags": ["安全招聘"], "text": ""}
{"title": "基于流量的OpenSSL漏洞利用检测方法", "url": "https://www.freebuf.com/vuls/31391.html", "time": "2014-04-09", "level": "红色标题", "num_look": 547660, "num_comment": 20, "author": "安天实验室", "tags": ["漏洞", "网络安全"], "text": "2014年4月7日OpenSSL发布了安全公告，在OpenSSL1.0.1版本中存在严重漏洞（CVE-2014-0160），此次漏洞问题存在于ssl/dl_both.c文件中。OpenSSL Heartbleed模块存在一个BUG，当攻击者构造一个特殊的数据包，满足用户…"}
{"title": "黑客有办法让你自动连上陌生WiFi", "url": "https://www.freebuf.com/articles/wireless/30874.html", "time": "2014-04-09", "level": "", "num_look": 1036592, "num_comment": 27, "author": "qingxp9", "tags": ["无线安全"], "text": ""}
{"title": "关于安全产品选型的吐槽", "url": "https://www.freebuf.com/articles/neopoints/31298.html", "time": "2014-04-09", "level": "", "num_look": 150175, "num_comment": 11, "author": "srxh1314", "tags": ["观点"], "text": "针对某个人的总是以鸡汤行为来误导有着迫切信息安全需求的人，我决定派出文章讨伐，维护正义，以免更多信息安全从业者受到鸡汤的干扰，轻则导致项目失败，重则个人发展停滞，影响前程。"}
{"title": "快讯：NASA美国航空航天局主站遭入侵，数据库泄露", "url": "https://www.freebuf.com/news/31360.html", "time": "2014-04-08", "level": "金币+9", "num_look": 360746, "num_comment": 24, "author": "pnig0s", "tags": ["资讯"], "text": "ID为@jollyblackbeard的用户在Twitter上爆料NASA(nasa.gov)美国航空航天局主站被入侵，用户数据库遭泄露。数据中包括航天局相关系统的登录用户名，真实姓名，办公邮箱及疑似md5加密的密码。"}
{"title": "[附POC]OpenSSL曝严重安全漏洞，国内大量网站中招", "url": "https://www.freebuf.com/vuls/31339.html", "time": "2014-04-08", "level": "金币+9", "num_look": 1081062, "num_comment": 48, "author": "blue", "tags": ["漏洞"], "text": "OpenSSL的协议中，刚刚曝光了一个“毁灭性”的安全漏洞，或暴露某些重量级服务的加密密钥(cryptographic keys)和私有通信(private communications)。如果你的服务器正在使用OpenSSL 1.0.1f，请务必立即升级到OpenSSL …"}
{"title": "中国团队称成功破解谷歌reCAPTCHA验证码（含视频）", "url": "https://www.freebuf.com/news/31310.html", "time": "2014-04-08", "level": "金币+9", "num_look": 372221, "num_comment": 30, "author": "Mystery", "tags": ["视频", "资讯"], "text": "中国人工智能极客团队MentalTrotter宣布其自主研发的模拟人脑图像识别算法已经成功破解了Google的reCAPTCHA验证码，算法借鉴了认知心理学技术，可以通过真人的心理认知来矫正错误，理论识别率可以高达99%。"}
{"title": "Quantum - NSA最强大的互联网攻击工具", "url": "https://www.freebuf.com/news/31107.html", "time": "2014-04-08", "level": "金币+9", "num_look": 230540, "num_comment": 6, "author": "SINA2312447841", "tags": ["资讯"], "text": "wired最近刊登了一篇详细描述有关Quantum的好文，披露了一些有关NSA Quantum系统的细节，其攻击能力令人印象深刻。从本质上而言，Quantum是一个通用化的数据包注入工具，根据一些预设的模式对互联网的流量进行窃听。"}
{"title": "使用fuzzDB进行web安全测试", "url": "https://www.freebuf.com/articles/web/31076.html", "time": "2014-04-08", "level": "金币+9", "num_look": 434380, "num_comment": 9, "author": "lanlan", "tags": ["WEB安全"], "text": "fuzzDB看字面意思就知道，他是一个用于fuzz网站的库。类似于wwwscan之类工具的字典，但是他的过人住处是他是“开源”的，会有很多大神帮你维护一个字典，想想都心旷神怡啊。"}
{"title": "一次通过漏洞挖掘成功渗透某网站的过程", "url": "https://www.freebuf.com/articles/web/31053.html", "time": "2014-04-08", "level": "金币+9", "num_look": 1645110, "num_comment": 42, "author": "椒图科技", "tags": ["WEB安全"], "text": "我们的一个客户希望我们对其网站进行渗透测试，以发现其脆弱点并协助改进安全性。在拿到对方渗透测试授权之后，我们开始了对其网站的分析。对方主站是一个定制开发的CMS，在进行一系列扫描和分析之后，未发现可利用…"}
{"title": "由XSS漏洞引发的僵尸网络DDos攻击风暴", "url": "https://www.freebuf.com/news/31230.html", "time": "2014-04-08", "level": "金币+9", "num_look": 288293, "num_comment": 20, "author": "lanlan", "tags": ["WEB安全", "资讯"], "text": "昨天，云安全服务提供商Incapsula发现了一种使用流量劫持的方式进行的DDOS，这次攻击使用2000万次get流量席卷了Incapsula的一个用户，这2000万次的流量均来自于22000万互联网用户的浏览器。"}
{"title": "ArduSat：利用开源硬件制造的微型卫星", "url": "https://www.freebuf.com/geek/31173.html", "time": "2014-04-07", "level": "", "num_look": 293383, "num_comment": 10, "author": "河边的鸟爸", "tags": ["极客"], "text": "位于美国加州的 NanoSatisfi 在 Kickstarter 为自己的开源卫星项目 ArduSat 筹资。他们打算利用开源硬件 Arduino，制作一个体积娇小，而且拥有基本探测功能的微型卫星。"}
{"title": "视频：揭秘黑客是如何让ATM机吐钞票的", "url": "https://www.freebuf.com/video/31066.html", "time": "2014-04-07", "level": "红色标题", "num_look": 585158, "num_comment": 29, "author": "FB视频", "tags": ["视频"], "text": ""}
{"title": "Struts2 S2-020在Tomcat 8下的命令执行分析", "url": "https://www.freebuf.com/articles/web/31039.html", "time": "2014-04-06", "level": "", "num_look": 356044, "num_comment": 10, "author": "yiran4827", "tags": ["WEB安全"], "text": "Struts S2-020这个通告已经公布有一段时间了。目前大家都知道这个漏洞可以造成DOS、文件下载等危害，相信各大厂商也已经采取了相应的安全措施。今天是和大家分享一下对这个漏洞的一点研究，包括如何在Tomcat 8下导…"}
{"title": "后XP时代的安全防护问题", "url": "https://www.freebuf.com/vuls/31100.html", "time": "2014-04-05", "level": "红色标题", "num_look": 390676, "num_comment": 22, "author": "tobe", "tags": ["漏洞", "观点"], "text": ""}
{"title": "使用Fiddler的X5S插件查找XSS漏洞", "url": "https://www.freebuf.com/articles/web/30960.html", "time": "2014-04-04", "level": "金币+11", "num_look": 980350, "num_comment": 11, "author": "Taskiller", "tags": ["WEB安全"], "text": ""}
{"title": "ebay旗下电商平台magento go越权管理任意店铺", "url": "https://www.freebuf.com/vuls/30990.html", "time": "2014-04-04", "level": "金币+11", "num_look": 181858, "num_comment": 4, "author": "litdg", "tags": ["漏洞"], "text": "magento go是ebay旗下的一个电商平台，有超过200000活跃店铺。利用该越权漏洞，仅仅使用一个HTTP请求就可以给任意店铺添加管理员账号，从而实现免费购物的梦想。目前该漏洞已经修复。"}
{"title": "NTT发布2014年全球威胁情报报告", "url": "https://www.freebuf.com/news/30794.html", "time": "2014-04-04", "level": "金币+11", "num_look": 156479, "num_comment": 3, "author": "pynwolf", "tags": ["资讯"], "text": "全球威胁情报报告（GTIR）在对2013年发生在全球范围内的十亿起袭击进行了分析，提出了在新的一年中，我们仍将面临各种安全挑战。NTT创新研究院系统地发布了新的全球威胁情报报告（GTIR），以期可以在全球威胁环境日…"}
{"title": "你在逗我吗？韩国军方发现朝鲜“无人机”", "url": "https://www.freebuf.com/news/30985.html", "time": "2014-04-04", "level": "", "num_look": 354121, "num_comment": 13, "author": "fu4k", "tags": ["资讯"], "text": "韩国军方在一边境岛屿上发现一架执行侦查任务的无人机，经调查后得出结论，是朝鲜派出该无人机执行侦查任务。"}
{"title": "详解SQL盲注测试高级技巧", "url": "https://www.freebuf.com/articles/web/30841.html", "time": "2014-04-04", "level": "金币+11", "num_look": 2009362, "num_comment": 17, "author": "lanlan", "tags": ["WEB安全"], "text": "这篇文章主要写了一些加快盲注速度的技巧和盲注中比较精巧的语句，虽然注入并不是什么新技术了。但是数据库注入漏洞依然困扰着每一个安全厂商，也鞭策着每一个安全从业者不断前进。"}
{"title": "北京快网(世纪互联集团)安全工程师招聘", "url": "https://www.freebuf.com/jobs/30892.html", "time": "2014-04-03", "level": "", "num_look": 199464, "num_comment": 20, "author": "世纪互联", "tags": ["安全招聘"], "text": ""}
{"title": "打造可扩展的针对web漏洞的渗透测试平台 - skadi", "url": "https://www.freebuf.com/sectool/30886.html", "time": "2014-04-03", "level": "金币+11", "num_look": 515773, "num_comment": 32, "author": "HoerWing", "tags": ["WEB安全", "工具"], "text": "我们既然有如此丰富的资源，为何不编写一款可扩展的集成各种漏洞扫描和利用功能的渗透测试平台呢。"}
{"title": "堪忧，我国GSM网络中监听可获得明文短信内容", "url": "https://www.freebuf.com/news/30875.html", "time": "2014-04-02", "level": "金币+11", "num_look": 516268, "num_comment": 30, "author": "gamehacker", "tags": ["资讯"], "text": "通过前期对我国的通信情况进行研究，发现我国的情况更让人担忧，经测试发现在我国GSM网络中实施监听可获得明文的短信内容。"}
{"title": "【附PPT】第二届京东JSRC电商安全沙龙纪实", "url": "https://www.freebuf.com/fevents/30718.html", "time": "2014-04-02", "level": "金币+11", "num_look": 355949, "num_comment": 32, "author": "FB独家", "tags": ["活动"], "text": "由京东应急响应中心（JSRC）主办的第二届电商安全沙龙在3月28日上周五召开，小编代表FreeBuf作为媒体支持有幸参加了这次沙龙。"}
{"title": "海康威视录像机（DVR）被用于发动网络攻击和比特币挖矿", "url": "https://www.freebuf.com/news/30814.html", "time": "2014-04-02", "level": "金币+11", "num_look": 322766, "num_comment": 13, "author": "phper", "tags": ["资讯"], "text": ""}
{"title": "2013-2014年度DDoS攻击威胁报告", "url": "https://www.freebuf.com/news/topnews/30674.html", "time": "2014-04-02", "level": "金币+11", "num_look": 339801, "num_comment": 6, "author": "LNST", "tags": ["头条", "安全报告"], "text": "截止到现在，分布式拒绝服务（DDoS）从2013年到今年的前两个月攻击趋于稳定，但总量明显增加。在很大程度上，是因为攻击者广泛采用两种攻击方法：大型同步数据包洪水（SYN Flood攻击）攻击和网络时间协议（NTP）的…"}
{"title": "一周海外安全事件回顾（20140324-0330）", "url": "https://www.freebuf.com/news/topnews/30799.html", "time": "2014-04-01", "level": "金币+11", "num_look": 279748, "num_comment": 9, "author": "blackscreen", "tags": ["头条"], "text": "在上周，最吸引我关注的是两个巨无霸级僵尸网络间矛盾激化进而演变为DDoS大战的事件。此外，就是“众所周知”的NSA对HW的入侵以及被曝光的涉及对全球122位领导人的监听。当然，还有土耳其的绝密视频泄密案。"}
{"title": "Android系统升级提权漏洞", "url": "https://www.freebuf.com/news/30684.html", "time": "2014-04-01", "level": "金币+4", "num_look": 273195, "num_comment": 9, "author": "lanlan", "tags": ["漏洞", "资讯"], "text": "这是一个android提权漏洞，在android进行系统更新时才能触发，看似比较鸡肋，但也可能造成很严重的后果，毕竟，谁都不想让自己手机里的隐私公诸于众。"}
{"title": "西门子集中修复了工控设备中的安全漏洞", "url": "https://www.freebuf.com/news/30620.html", "time": "2014-04-01", "level": "金币+4", "num_look": 234329, "num_comment": 1, "author": "pynwolf", "tags": ["工控安全", "资讯"], "text": "工业控制系统制造商，西门子发布了SIMATIC S7-1200 CPU系列产品的新版本，新版本解决了产品之前存在的6个安全漏洞，并且它的SIMATIC S7-1200 PLC（可编程逻辑控制器），也解决了其存在的另外两个漏洞。"}
{"title": "浅析白盒安全审计中的XSS Fliter", "url": "https://www.freebuf.com/articles/web/30201.html", "time": "2014-04-01", "level": "金币+4", "num_look": 316478, "num_comment": 17, "author": "phithon", "tags": ["WEB安全"], "text": "自己并不擅长xss，作为抛砖引玉的一篇总结文章，分享一下自己的见解，其实写出来感觉很惶恐。都是之前看M写的一些文章学到的姿势，在这里跪谢。我这里的绕过侧重于白盒审计，所以不用各种测试测试很久，只用根据源…"}
{"title": "​​Light4Freedom战队BCTF攻略（下）", "url": "https://www.freebuf.com/articles/web/29899.html", "time": "2014-04-01", "level": "金币+4", "num_look": 234421, "num_comment": 5, "author": "Light4Freedom", "tags": ["WEB安全"], "text": "自从Light4Freedom战队带来了Light4Freedom战队BCTF攻略（上）之后，反响非常强烈，没参加比赛的同学也感受到了比赛的激烈，本次Light4Freedom带来了BCTF攻略系列第二篇，堪称大作，详情请入内。"}
{"title": "安恒杯浙江大学第一届信息安全技术挑战赛，等你来战！！", "url": "https://www.freebuf.com/fevents/30188.html", "time": "2014-03-31", "level": "", "num_look": 233094, "num_comment": 15, "author": "DeAdCaT___", "tags": ["活动"], "text": "在这场战斗中，任何一位选手都可以体验到信息安全技术对抗的魅力：享受见招拆招的思维碰撞、孤军奋战的一往无前、奋勇夺旗的速度与激情！它让你迅速摘掉单板无聊的死宅帽子，即刻变为人们心中的黑客英雄！"}
{"title": "大学那些事：黑客们是如何做到逢考必过的？", "url": "https://www.freebuf.com/news/topnews/30271.html", "time": "2014-03-31", "level": "金币+4", "num_look": 717248, "num_comment": 76, "author": "WF32", "tags": ["其他", "头条"], "text": "挂科生们如何应对考试？对于这个问题，很多人第一想法就是入侵教务系统，然后篡改成绩，但我个人比较鄙视任何修改数据的脑残行为。"}
{"title": "操作系统指纹识别概述", "url": "https://www.freebuf.com/articles/system/30037.html", "time": "2014-03-31", "level": "金币+4", "num_look": 635402, "num_comment": 4, "author": "Taskiller", "tags": ["系统安全"], "text": "操作系统指纹识别一般用来帮助用户识别某台设备上运行的操作系统类型。通过分析设备往网络发送的数据包中某些协议标记、选项和数据，我们可以推断发送这些数据包的操作系统。"}
{"title": "Android vs iOS：未曾停息的强强对决", "url": "https://www.freebuf.com/news/29662.html", "time": "2014-03-30", "level": "金币+4", "num_look": 233349, "num_comment": 19, "author": "凌晨几度i", "tags": ["终端安全", "资讯"], "text": "近期，各种安全事件层出不穷，难以平抚内心浮躁的人们，不妨静下心来品读这篇文章，一位外国朋友对“iOS vs Android”综合的分析。难得一见的对两大移动领域的操作系统的科普文。"}
{"title": "用户名+123456，轻松写意登陆eBay日本论坛", "url": "https://www.freebuf.com/news/30358.html", "time": "2014-03-30", "level": "金币+4", "num_look": 305883, "num_comment": 22, "author": "thanks", "tags": ["WEB安全", "资讯"], "text": "eBay日本近日修复了一个安全漏洞，这个漏洞允许任何人能访问任意注册用户的论坛帐号。开发这套系统的人实现了一个硬编码的论坛密码：用户名+123456。"}
{"title": "周末阅读：黑了初恋", "url": "https://www.freebuf.com/articles/others-articles/30243.html", "time": "2014-03-28", "level": "金币+4", "num_look": 531251, "num_comment": 45, "author": "only_guest", "tags": ["其他"], "text": "这是一个关于初恋的故事。"}
{"title": "WinRar 4.20 - 文件扩展名欺骗(0Day)", "url": "https://www.freebuf.com/news/30045.html", "time": "2014-03-28", "level": "金币+4", "num_look": 304718, "num_comment": 38, "author": "我是酱油男", "tags": ["漏洞", "资讯"], "text": "WinRar 是常用的压缩与解压缩软件工具。它能将数据压缩成.rar或则.zip格式的包。这篇文章就是给大家呈现Winrar 4.20的一个最新漏洞（0 day）,下面是关于zip文件的相关简要介绍。"}
{"title": "黑掉ATM取款机？只需一条短信", "url": "https://www.freebuf.com/news/30046.html", "time": "2014-03-28", "level": "金币+4", "num_look": 425890, "num_comment": 37, "author": "pynwolf", "tags": ["终端安全", "资讯"], "text": "我想在这叹息之余必然要谈及这样一件事，在世界上运行的300多万台ATM机器上，其中约95%依然是XP系统，于是全球即将迎来“旧”ATM“裸奔时代”。"}
{"title": "《2014工业控制系统的安全研究与实践》报告发布", "url": "https://www.freebuf.com/news/others/30035.html", "time": "2014-03-27", "level": "", "num_look": 1242784, "num_comment": 8, "author": "绿盟科技", "tags": ["周边"], "text": "在2013年，工业控制系统的安全问题在国内许多信息安全相关的技术大会上作为重要的研讨议题频繁出现，已成为工业控制系统相关的各行业以及信息安全领域的研究机构、厂商所关注的热点方向之一。同时，国家在政策制订…"}
{"title": "SQL注入之SQLmap入门", "url": "https://www.freebuf.com/articles/web/29942.html", "time": "2014-03-27", "level": "金币+4", "num_look": 9902116, "num_comment": 53, "author": "Taskiller", "tags": ["WEB安全"], "text": "SQLmap是一款用来检测与利用SQL注入漏洞的免费开源工具，有一个非常棒的特性，即对检测与利用的自动化处理（数据库指纹、访问底层文件系统、执行命令）。其主要功能是扫描，发现并利用给定的URL的SQL注入漏洞。"}
{"title": "DNS迭代穷举脚本", "url": "https://www.freebuf.com/sectool/29410.html", "time": "2014-03-27", "level": "金币+4", "num_look": 191977, "num_comment": 8, "author": "我是酱油男", "tags": ["工具"], "text": "在普通的DNS穷举中，如果使用字典进行穷举，会发现没有哪个字典能穷举完所有的域名，国外安全研究者在常年累月的DNS记录收集中发现，很多域名有大量的短主机名，并且很易记，通常为4个字符或更少，所以有了本文的脚…"}
{"title": "OWASP上海沙龙", "url": "https://www.freebuf.com/fevents/29999.html", "time": "2014-03-27", "level": "", "num_look": 160224, "num_comment": 2, "author": "FB客服", "tags": ["活动"], "text": ""}
{"title": "能“干掉”苹果的中国黑客", "url": "https://www.freebuf.com/articles/people/29980.html", "time": "2014-03-26", "level": "红色标题", "num_look": 695206, "num_comment": 80, "author": "phper", "tags": ["人物志"], "text": "他是全球发现苹果漏洞最多的人，他曾穷的住在小黑屋，他经常接到国家安全部门的电话，他差点堵住周鸿祎的路。"}
{"title": "SYNPROXY：最廉价的抗DoS攻击方案", "url": "https://www.freebuf.com/articles/system/29944.html", "time": "2014-03-26", "level": "金币+6", "num_look": 321871, "num_comment": 8, "author": "lanlan", "tags": ["系统安全"], "text": "对于防御Dos攻击来说，我这辈子都不一定能见到完美的解决方案。虽然，有成吨的商用防火墙，可以有效的防御Dos攻击，但是他们都太贵了。作为一个学术型人才，我倾向于使用简单廉价的组合来解决问题。"}
{"title": "走进计算机取证分析的神秘世界", "url": "https://www.freebuf.com/articles/terminal/29653.html", "time": "2014-03-26", "level": "金币+6", "num_look": 590557, "num_comment": 15, "author": "白河·愁", "tags": ["终端安全"], "text": "计算机技术是人们生活的重要组成部分，而且它正在迅速增长，同样发生在计算机犯罪方面，如金融诈骗，非法入侵，身份盗窃和盗窃知识产权。为了对付这些计算机相关的犯罪，计算机取证中起着非常重要的作用。"}
{"title": "2014年国内外信息安全厂家及安全产品分类v1.1", "url": "https://www.freebuf.com/articles/others-articles/29759.html", "time": "2014-03-26", "level": "金币+6", "num_look": 358552, "num_comment": 29, "author": "srxh1314", "tags": ["其他"], "text": "当前，信息网络技术的高速发展和广泛应用，正不断推动着生产方式的深刻变化。在这个进程中，大至国家安全和社会稳定，小至企业利益与个人尊严，关于信息安全的命题始终相伴左右。信息安全之争，面临着内外的双重压…"}
{"title": "两款恶意软件清理工具AdwCleaner和Junkware Removal", "url": "https://www.freebuf.com/sectool/29892.html", "time": "2014-03-25", "level": "金币+6", "num_look": 216757, "num_comment": 10, "author": "phper", "tags": ["工具"], "text": "信不过国内的各种安全卫士？今天为你推荐两款国外的恶意软件清理工具，各位看官可以试试看。"}
{"title": "超过1万台Linux服务器感染了恶意程序", "url": "https://www.freebuf.com/news/29881.html", "time": "2014-03-25", "level": "", "num_look": 145637, "num_comment": 8, "author": "fu4k", "tags": ["资讯"], "text": "杀毒软件公司Eset的研究人员披露了一个正在进行中的恶意程序攻击，被取名为 Operation Windigo（PDF）的恶意攻击感染了超过1万台Linux和Unix服务器，"}
{"title": "[紧急通告]Microsoft Word RTF文件解析错误代码执行0day漏洞", "url": "https://www.freebuf.com/vuls/29866.html", "time": "2014-03-25", "level": "", "num_look": 210782, "num_comment": 16, "author": "绿盟科技", "tags": ["漏洞"], "text": "Microsoft Word在解析畸形的RTF格式数据时存在错误导致内存破坏，使得攻击者能够执行任意代码。当用户使用Microsoft Word受影响的版本打开恶意RTF文件，用户预览或打开恶意的RTF邮件信息，攻击者都可能成功利用此漏…"}
{"title": "金山毒霸引发系统崩溃问题技术分析", "url": "https://www.freebuf.com/articles/network/29800.html", "time": "2014-03-25", "level": "", "num_look": 318075, "num_comment": 12, "author": "猩猩知我心", "tags": ["网络安全"], "text": ""}
{"title": "金山毒霸严重BUG导致大量Win7用户系统崩溃", "url": "https://www.freebuf.com/news/29787.html", "time": "2014-03-24", "level": "", "num_look": 201612, "num_comment": 30, "author": "冰沫如夏", "tags": ["资讯"], "text": "3月23日，百度贴吧“Windows7\"吧今天出现集中反馈，大批网友电脑无法启动系统，屏幕显示金山毒霸的驱动文件KAVbootC.sys缺失或损坏。在金山官方论坛，反映类似情况的用户也不断增加。"}
{"title": "​​Light4Freedom战队BCTF攻略（上）", "url": "https://www.freebuf.com/articles/web/29517.html", "time": "2014-03-24", "level": "金币+6", "num_look": 357222, "num_comment": 35, "author": "Light4Freedom", "tags": ["WEB安全"], "text": ""}
{"title": "黑客开发无人机窃取路人手机隐私信息", "url": "https://www.freebuf.com/news/29732.html", "time": "2014-03-24", "level": "金币+6", "num_look": 171954, "num_comment": 22, "author": "Mystery", "tags": ["资讯"], "text": "无人机可以向手机发送伪装网络信号，连接上后会拦截手机一切信息。我们保存在智能手机或平板电脑上的隐私信息可能会被在天空中盘旋的无人机窃走。黑客已经开发出一种无人机，它可以窃取用户智能手机中的数据，——从…"}
{"title": "携程信用卡门，为啥不用换卡不用销卡（专业吐槽+释疑版）", "url": "https://www.freebuf.com/news/29753.html", "time": "2014-03-24", "level": "红色标题", "num_look": 268530, "num_comment": 21, "author": "baoz", "tags": ["资讯"], "text": "如果你赶时间，又想了解一点点东西，就看橙色字的部分。总而言之，我的建议是：遇到盗刷追回，然后才换卡。首先携程出这个事确实是不应该，我就不补枪了，携程已经被喷的够狠了；另外本人是携程用户但并没有持有一…"}
{"title": "CVE-2013-3897漏洞分析", "url": "https://www.freebuf.com/articles/system/29445.html", "time": "2014-03-24", "level": "金币+6", "num_look": 189546, "num_comment": 7, "author": "vscen", "tags": ["系统安全"], "text": "CVE-2013-3897通过js脚本触发OnPropertyChange事件；当事件被触发的时候新建一些元素,并且之后改变该元素的位置；这时,IE浏览器的CDisplayPointer对象调用到CMarkupPointer虚函数。"}
{"title": "一周海外安全事件回顾（2014.03.17 – 2014.03.23）", "url": "https://www.freebuf.com/news/topnews/29722.html", "time": "2014-03-24", "level": "金币+6", "num_look": 133555, "num_comment": 4, "author": "blackscreen", "tags": ["头条"], "text": "在本期谈谈大家一个非常感兴趣的话题，也是一个疑问，乌克兰和俄罗斯为什么到现在也没有爆发类似爱沙尼亚网络战规模的对抗。按理说，这两个拥有强大黑客组织的国家，在网络上早就应该兵戎相见，但是现实却是那么的“…"}
{"title": "HTTPS对于用户隐私泄露无能为力", "url": "https://www.freebuf.com/news/29586.html", "time": "2014-03-24", "level": "金币+6", "num_look": 162834, "num_comment": 3, "author": "pynwolf", "tags": ["资讯"], "text": ""}
{"title": "阿里巴巴集团安全部纳贤启示", "url": "https://www.freebuf.com/jobs/22725.html", "time": "2014-03-24", "level": "红色标题", "num_look": 322620, "num_comment": 29, "author": "zml", "tags": ["安全招聘"], "text": "阿里巴巴，中国最大的网络公司和世界第二大网络公司，是由马云在1999年一手创立企业对企业的网上贸易市场平台。2003年5月，投资一亿元人民币建立个人网上贸易市场平台——淘宝网。"}
{"title": "老牌漏洞披露平台Full Disclosure宣布关闭", "url": "https://www.freebuf.com/news/29637.html", "time": "2014-03-23", "level": "金币+5", "num_look": 129299, "num_comment": 12, "author": "pynwolf", "tags": ["资讯"], "text": ""}
{"title": "Facebook开发的新编程语言Hack", "url": "https://www.freebuf.com/news/29557.html", "time": "2014-03-22", "level": "", "num_look": 212603, "num_comment": 22, "author": "fu4k", "tags": ["资讯"], "text": ""}
{"title": "移动APP安全在渗透测试中的应用", "url": "https://www.freebuf.com/articles/web/29421.html", "time": "2014-03-21", "level": "金币+5", "num_look": 729510, "num_comment": 21, "author": "seay", "tags": ["WEB安全", "终端安全"], "text": "以往安全爱好者研究的往往是app的本地安全，比如远控、应用破解、信息窃取等等，大多人还没有关注到app服务端的安全问题，于是在这块的安全漏洞非常多。本文以糗事百科为例，挖掘了糗事百科APP的一些安全问题。"}
{"title": "FreeBuf与虎嗅网建立合作伙伴关系", "url": "https://www.freebuf.com/news/29480.html", "time": "2014-03-21", "level": "红色标题", "num_look": 695007, "num_comment": 35, "author": "FB独家", "tags": ["其他", "资讯"], "text": "3月21日，FreeBuf黑客与极客与虎嗅网建立合作伙伴关系，双方今后将在资源、高质量内容共享等方面展开合作，共同推进国内新媒体发展。"}
{"title": "ASLR在Windows与Linux系统之间的差别", "url": "https://www.freebuf.com/articles/system/29392.html", "time": "2014-03-21", "level": "金币+5", "num_look": 440396, "num_comment": 8, "author": "Taskiller", "tags": ["系统安全"], "text": "Hi 基友们，我在上篇文章中讨论了Linux平台上NX的特性。我们已经知道一般情况下NX（Windows平台上称其为DEP）和地址空间分布随机化（ASLR）会同时工作，所以也值得看一下ASLR在Linux平台是如何工作的。"}
{"title": "安全扫描工具Nmap分布式版本- DNmap", "url": "https://www.freebuf.com/sectool/29436.html", "time": "2014-03-21", "level": "", "num_look": 453191, "num_comment": 11, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "射频技术（RFID）的安全协议", "url": "https://www.freebuf.com/articles/terminal/29352.html", "time": "2014-03-21", "level": "金币+5", "num_look": 448062, "num_comment": 6, "author": "yiran4827", "tags": ["终端安全"], "text": "由于安全问题愈发突出，针对这些安全问题的安全协议也相继而出，这些安全协议主要针对应用层的安全问题。多安全协议都是基于密码学中的hash函数来展开的，hash函数通过相应算法的可以将任意长度的消息或者明文映射…"}
{"title": "软件漏洞分析技巧分享", "url": "https://www.freebuf.com/vuls/29357.html", "time": "2014-03-20", "level": "", "num_look": 418975, "num_comment": 9, "author": "腾讯安全平台部", "tags": ["漏洞", "系统安全"], "text": "日常分析软件漏洞时，经常需要耗费比较长的分析时间，少则几小时，多则数天，甚至更久。因此，经常总结一些分析技巧是非常有必要的，针对不同的漏洞类型采取不同的分析思路和技巧，可以有效地提高分析速度。"}
{"title": "基于RDP的SSL中间人攻击", "url": "https://www.freebuf.com/articles/network/29288.html", "time": "2014-03-20", "level": "金币+5", "num_look": 448227, "num_comment": 11, "author": "Taskiller", "tags": ["网络安全"], "text": "本文通过演示在RDP会话期间劫持的按键发送信息，向读者演示了为什么用户忽略那些基于SSL的RDP连接的证书警告可能导致中间人(MiTM)攻击，并总结了一些关于如何避免成为这种攻击的受害者的建议。"}
{"title": "叙利亚电子军（SEA）宣称入侵美军中央指挥部", "url": "https://www.freebuf.com/news/29228.html", "time": "2014-03-20", "level": "", "num_look": 122526, "num_comment": 7, "author": "phper", "tags": ["资讯"], "text": "不久前美国总统奥巴马宣布将针对叙利亚电子军（SAE）发动网络战，而近日SAE即宣称已成功入侵美军中央指挥部，并公布了包含2万多文件的军方在线知识库（ Army Knowledge Online ，AKO）服务器的文件目录。"}
{"title": "上海HP招聘安全工程师", "url": "https://www.freebuf.com/jobs/29333.html", "time": "2014-03-19", "level": "", "num_look": 156334, "num_comment": 9, "author": "HP安全", "tags": ["安全招聘"], "text": ""}
{"title": "一款猥琐的PHP后门分析", "url": "https://www.freebuf.com/articles/web/29307.html", "time": "2014-03-19", "level": "红色标题", "num_look": 744708, "num_comment": 110, "author": "360网站卫士", "tags": ["WEB安全"], "text": "近日，360网站卫士安全团队近期捕获一个基于PHP实现的webshell样本，其巧妙的代码动态生成方式，猥琐的自身页面伪装手法，让我们在分析这个样本的过程中感受到相当多的乐趣。接下来就让我们一同共赏这个奇葩的Websh…"}
{"title": "对门控系统的攻击面检查", "url": "https://www.freebuf.com/articles/system/29172.html", "time": "2014-03-19", "level": "", "num_look": 249976, "num_comment": 9, "author": "IDF_Lab", "tags": ["系统安全"], "text": "近年来，许多企业出于对安全的考虑，开始逐步使用电脑化的门控系统：要求用户拥有中央数据库授权的口令或者刷卡，以确保那些没有授权的人无法进入公司区域或者公司的受限区域。"}
{"title": "撞库攻击：一场需要用户参与的持久战", "url": "https://www.freebuf.com/articles/database/29267.html", "time": "2014-03-19", "level": "金币+5", "num_look": 1683148, "num_comment": 26, "author": "lanlan", "tags": ["数据安全", "观点"], "text": "用户数据泄露一直是如今互联网世界的一个焦点，从最近的京东撞库抹黑事件，到之前的CSDN，如家用户数据的泄露，服务商和黑客之间在用户数据这个舞台上一直在进行着旷日持久的攻防战。"}
{"title": "怪大叔帮美女修电脑，留下木马后门惨遭起诉", "url": "https://www.freebuf.com/news/29225.html", "time": "2014-03-19", "level": "金币+5", "num_look": 247609, "num_comment": 27, "author": "嘎巴嘎巴", "tags": ["其他", "资讯"], "text": "某美女拜托大叔修完电脑后发现自己的摄像头有时会自动开启，感觉此事定有蹊跷的她果断报案（安全意识真高~），警察软禁了大叔之后对电脑进行了取证。"}
{"title": "BCTF Write-up：神秘系统夺Key过程2", "url": "https://www.freebuf.com/articles/others-articles/29126.html", "time": "2014-03-19", "level": "金币+5", "num_look": 125881, "num_comment": 2, "author": "nil", "tags": ["其他"], "text": ""}
{"title": "一种检测ICMP反射攻击/ SMURF攻击的新的理论方法", "url": "https://www.freebuf.com/articles/network/29093.html", "time": "2014-03-19", "level": "金币+6", "num_look": 373613, "num_comment": 4, "author": "Taskiller", "tags": ["网络安全"], "text": "现在有很多方法追溯DoS攻击的源头，但这些技术在追踪ICMP攻击时却不怎么有效。这里所说的“反射ICMP攻击”指的就是SMURF攻击。本文向各位看官演示一种新的模型来追溯由ICMP数据包引起的DOS攻击，该方法非常有效，因为…"}
{"title": "黑客文化沙龙 （上海）第一期 2014-2024安全产业与人才发展云图与投资", "url": "https://www.freebuf.com/fevents/29250.html", "time": "2014-03-19", "level": "", "num_look": 160751, "num_comment": 11, "author": "FB独家", "tags": ["活动"], "text": "本次街角咖啡俱乐部邀请了涵盖技术、安全、创业、风投、互联网等各领域的诸多大V，一起跨界探讨信息安全产业、人才及发展展望。"}
{"title": "赛门铁克发现名为Dendroid的超强手机木马", "url": "https://www.freebuf.com/articles/terminal/29129.html", "time": "2014-03-19", "level": "金币+6", "num_look": 356032, "num_comment": 11, "author": "凌晨几度i", "tags": ["终端安全"], "text": "最近，赛门铁克的研究人员就在手机移动领域发现了一种新的名为Dendroid木马，可以轻松实现对手机远程恶意操控。而在此前赛门铁克发现了一个名为AndroidRAT的android远程管理软件被认为是第一个恶意绑定软件。然而这…"}
{"title": "Paypal的一个Dom型XSS漏洞分析", "url": "https://www.freebuf.com/articles/web/29177.html", "time": "2014-03-18", "level": "金币+6", "num_look": 485563, "num_comment": 9, "author": "litdg", "tags": ["WEB安全"], "text": "DOM xss也称为第三种类型的xss或者类型0。现在DOM型的xss越来越多了，除了因为各种JS库比如YUI，Jquery，Jquery mobile等的使用，还有很多编程语言，比如php更多的支持了HTML5的特性。"}
{"title": "知名渗透测试套件BurpSuite Pro v1.6 beta破解版公布", "url": "https://www.freebuf.com/sectool/29161.html", "time": "2014-03-18", "level": "金币+6", "num_look": 997930, "num_comment": 72, "author": "maxcoco", "tags": ["工具"], "text": ""}
{"title": "一周海外安全事件回顾（2014.03.10–2014.03.16）", "url": "https://www.freebuf.com/news/topnews/29115.html", "time": "2014-03-18", "level": "红色标题", "num_look": 234944, "num_comment": 10, "author": "blackscreen", "tags": ["头条", "安全报告"], "text": "本周北约发布阐述国家网络战的塔林报告（The Tallinn Papers）。这份资料是一份从全局的角度回顾国家网络战历史和主要APT攻击的文章。本期海外安全回顾将着重解读这份报告。"}
{"title": "马航MH370有可能通过“网络劫持”吗？", "url": "https://www.freebuf.com/news/29145.html", "time": "2014-03-18", "level": "金币+6", "num_look": 135876, "num_comment": 3, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "马航官方网站被黑，黑客质疑马来西亚刻意隐瞒", "url": "https://www.freebuf.com/news/28996.html", "time": "2014-03-17", "level": "", "num_look": 180194, "num_comment": 21, "author": "kylin", "tags": ["资讯"], "text": "马来西亚航空公司官方网站旗下edm分站被一名为4z1的马来西亚黑客所黑，黑客留言“I'm From Malaysia But I Dare Not Admit”影射马来西亚政府刻意隐瞒真相，不敢承认事实。"}
{"title": "BCTF Write-up：神秘系统夺Key过程", "url": "https://www.freebuf.com/articles/system/28988.html", "time": "2014-03-17", "level": "", "num_look": 175550, "num_comment": 6, "author": "nil", "tags": ["系统安全"], "text": ""}
{"title": "创见WiFi SD卡破解之路", "url": "https://www.freebuf.com/articles/wireless/28686.html", "time": "2014-03-17", "level": "", "num_look": 430154, "num_comment": 10, "author": "嘎巴嘎巴", "tags": ["无线安全", "极客"], "text": ""}
{"title": "网络安全威胁周报—第201411期", "url": "https://www.freebuf.com/news/29085.html", "time": "2014-03-17", "level": "", "num_look": 110957, "num_comment": 1, "author": "绿盟科技", "tags": ["资讯"], "text": "中国互联网信息中心去年12月发布的《2013年中国网民信息安全状况研究报告》显示，整体上我国信息安全环境不容乐观，有74.1％的网民在此前半年内遇到过安全事件，总人数达4.38亿。"}
{"title": "视频：极客为游戏DIY可佩戴式计算机", "url": "https://www.freebuf.com/video/28592.html", "time": "2014-03-17", "level": "", "num_look": 152280, "num_comment": 2, "author": "FB视频", "tags": ["视频"], "text": "极客Beenay25用一些简单的设备为游戏Cyberpunk LARP手工制作了一套可穿戴设备，从而得以享受更好的游戏体验。"}
{"title": "美团网招聘高级安全工程师", "url": "https://www.freebuf.com/jobs/29068.html", "time": "2014-03-17", "level": "", "num_look": 218888, "num_comment": 12, "author": "amber", "tags": ["安全招聘"], "text": ""}
{"title": "专访BCTF八强战队sigma：不为别的，只为了心中的梦", "url": "https://www.freebuf.com/news/topnews/28581.html", "time": "2014-03-17", "level": "红色标题", "num_look": 517775, "num_comment": 46, "author": "FB独家", "tags": ["人物志", "头条"], "text": "CTF全称就是（Capture The Flag）啦，中文就是夺旗子的小游戏。黑客在一些关卡中通过各种各样的技术找到最终的flag，从而获得加分。\r\n一般CTF比赛中，会涉及MISC,PPC,CRYPTO,PWN,REVERSE,WEB,STEGA这几种题目。"}
{"title": "Linux下由于子进程继承引起的安全问题分析", "url": "https://www.freebuf.com/articles/system/28803.html", "time": "2014-03-17", "level": "金币+6", "num_look": 185193, "num_comment": 1, "author": "Taskiller", "tags": ["系统安全"], "text": "最近我在Linux上利用CERT BFF研究一个PoC。我之前有大量在Windows上写PoC的经验，所以认为将这种技能扩展到不同平台上是个不错的想法。可是，当我获得指令指针的控制权后，却发现几乎可以毫无障碍地使代码执行。"}
{"title": "专访BCTF八强战队0ops - 交大的追风少年", "url": "https://www.freebuf.com/news/topnews/29014.html", "time": "2014-03-17", "level": "红色标题", "num_look": 380911, "num_comment": 3, "author": "FB独家", "tags": ["人物志", "头条"], "text": "BCTF“百度杯”全国网络安全技术对抗赛,是由百度公司主办,清华和北大的安全技术专家提供技术支持,紫金江宁、南京赛宁承办,面向全国范围网络安全技术实战竞赛。FreeBuf在赛后与初赛获得第一名的0ops战队取得了联系，并…"}
{"title": "Facebook存在中间人攻击隐患", "url": "https://www.freebuf.com/news/28921.html", "time": "2014-03-17", "level": "金币+4", "num_look": 166793, "num_comment": 5, "author": "lanlan", "tags": ["WEB安全", "资讯"], "text": "这次的漏洞其实和前一阵爆出的，Open URL Redirection漏洞相似，并不能直接对Facebook的用户造成危害。这次攻击的描述主要针对于盗取用户access token，可见移动端的安全也越来越被研究者和黑可关注。"}
{"title": "中国黑客团队攻破MacOS X与Windows 8.1", "url": "https://www.freebuf.com/news/28774.html", "time": "2014-03-14", "level": "", "num_look": 198211, "num_comment": 43, "author": "路人甲", "tags": ["资讯"], "text": "担任本次Keen Team主攻手的研究员陈良，用时15秒攻破了MacOS X Mavericks 10.9.2，并用20秒攻破Windows 8.1。"}
{"title": "APT防御的他山石—思科内部安全团队解读APT", "url": "https://www.freebuf.com/news/topnews/28718.html", "time": "2014-03-14", "level": "金币+4", "num_look": 258452, "num_comment": 17, "author": "cs24", "tags": ["头条"], "text": "近日FireEye上市大热，360公司也要推出APT防御产品。在APT的战火已经烧到天朝之际，且看看思科自家的安全防御团队CSIRT（response to cyber security incidents for Cisco-owned businesses）在2011年时对APT的认识…"}
{"title": "记BCTF之旅—真假难辨", "url": "https://www.freebuf.com/articles/others-articles/28594.html", "time": "2014-03-14", "level": "金币+4", "num_look": 169848, "num_comment": 7, "author": "ChandlerLeo", "tags": ["其他"], "text": "BCTF“百度杯”全国网络安全技术对抗赛,是由百度公司主办,清华和北大的安全技术专家提供技术支持,紫金江宁、南京赛宁承办,面向全国范围网络安全技术实战竞赛!"}
{"title": "如何安全的存储用户的密码", "url": "https://www.freebuf.com/articles/web/28527.html", "time": "2014-03-13", "level": "金币+4", "num_look": 1346475, "num_comment": 45, "author": "litdg", "tags": ["WEB安全", "数据安全"], "text": "大多数的web开发者都会遇到设计用户账号系统的需求。账号系统最重要的一个方面就是如何保护用户的密码。一些大公司的用户数据库泄露事件也时有发生，所以我们必须采取一些措施来保护用户的密码。"}
{"title": "斯诺登爆料：QQ、飞信也被美国国家安全局监控", "url": "https://www.freebuf.com/news/28665.html", "time": "2014-03-13", "level": "", "num_look": 175237, "num_comment": 32, "author": "破军刀", "tags": ["资讯"], "text": ""}
{"title": "汽车黑客：没有Security就没有Safety", "url": "https://www.freebuf.com/articles/terminal/28576.html", "time": "2014-03-13", "level": "金币+4", "num_look": 369795, "num_comment": 16, "author": "Taskiller", "tags": ["终端安全"], "text": "“汽车黑客”（car hacking） 的话题正越来越多地在媒体和安全公司之间讨论。曾几何时，黑客利用手中的工具黑掉一辆汽车的画面还只是出现在电影中，现如今已经在现实中成为可能，且成为了人们开始担忧的问题，这正是…"}
{"title": "说一道简单的BCTF题 - 分分钟而已", "url": "https://www.freebuf.com/articles/others-articles/28376.html", "time": "2014-03-13", "level": "金币+4", "num_look": 235912, "num_comment": 27, "author": "Int_Null93", "tags": ["其他"], "text": "BCTF“百度杯”全国网络安全技术对抗赛,是由百度公司主办,清华和北大的安全技术专家提供技术支持,紫金江宁、南京赛宁承办,面向全国范围网络安全技术实战竞赛!"}
{"title": "Google的新型可穿戴设备Smart Pills靠胃酸供电", "url": "https://www.freebuf.com/geek/28614.html", "time": "2014-03-13", "level": "", "num_look": 150558, "num_comment": 13, "author": "phper", "tags": ["极客"], "text": "提到可穿戴设备你会想到什么？手环？手表？这些都弱爆了，Google 的 ATAP（ Advanced Technology and Products Group）联合Proteus推出的，在你的肠胃中检测各项身体数据的智能药片马上就要开始生产了。"}
{"title": "安全扫描工具Nmap引擎理解文档", "url": "https://www.freebuf.com/articles/system/28408.html", "time": "2014-03-12", "level": "金币+4", "num_look": 529617, "num_comment": 20, "author": "yiran4827", "tags": ["系统安全", "网络安全"], "text": ""}
{"title": "长沙雨人网安诚聘软件安全工程师", "url": "https://www.freebuf.com/jobs/28435.html", "time": "2014-03-12", "level": "", "num_look": 203993, "num_comment": 18, "author": "4n0wGZ", "tags": ["安全招聘"], "text": "长沙雨人网安是一家专注网络安全运营服务的专业IT公司。公司坚持以“技术创新、服务为本”的原则,通过自主研发安全运营管理平台,为不同行业用户提供可信的安全运营服务。"}
{"title": "BCTF百度杯网络安全大赛部分 write_up", "url": "https://www.freebuf.com/articles/others-articles/28403.html", "time": "2014-03-12", "level": "金币+4", "num_look": 191294, "num_comment": 29, "author": "icefish", "tags": ["其他"], "text": "BCTF“百度杯”全国网络安全技术对抗赛,是由百度公司主办,清华和北大的安全技术专家提供技术支持,紫金江宁、南京赛宁承办,面向全国范围网络安全技术实战竞赛!"}
{"title": "网络安全威胁周报—第201410期", "url": "https://www.freebuf.com/news/28456.html", "time": "2014-03-12", "level": "", "num_look": 122080, "num_comment": 4, "author": "绿盟科技", "tags": ["安全报告", "资讯"], "text": "绿盟科技是中国最早从事网络安全业务的企业之一，成立于2000年4月，总部设在中国北京，现有员工近1600人。在美国硅谷、日本东京设有分支机构，在开拓北美及亚太地区的海外市场的同时，进行安全战略研究及技术预研。"}
{"title": "开源项目CodeCombat：玩游戏就能学会编程", "url": "https://www.freebuf.com/news/28422.html", "time": "2014-03-11", "level": "金币+4", "num_look": 331616, "num_comment": 25, "author": "破军刀", "tags": ["其他", "资讯"], "text": "CodeCombat是一个通过玩游戏来学习编程的网站，也是GitHub上最大的开源CoffeeScript（一种脚本语言，类似JavaScript）项目，有上千程序员和玩家为其编写程序、测试游戏。到目前为止，已经翻译成17种国外语言。"}
{"title": "黑客攻破Mt.Gox服务器，发现部分比特币并未丢失", "url": "https://www.freebuf.com/news/28385.html", "time": "2014-03-11", "level": "", "num_look": 156843, "num_comment": 10, "author": "softbug", "tags": ["资讯"], "text": "黑客攻破了Mt.Gox CEO马克·卡佩尔斯(Mark Karpeles)的Reddit帐号和个人博客，并在其中发布消息称，Mt.Gox实际上仍持有该交易所声称被盗的部分比特币。"}
{"title": "卡巴斯基安全研究员解析狡猾的APT攻击 “The Mask”", "url": "https://www.freebuf.com/news/28268.html", "time": "2014-03-11", "level": "金币+4", "num_look": 200500, "num_comment": 6, "author": "Redo1o8SK", "tags": ["资讯"], "text": "“The mask”是一个起始于2007年甚至可能更早，并一直活跃着的网络间谍行动。这套工具集包括一个极其复杂的恶意攻击软件,一个rootkit，一个bootkit、Mac OS X和Linux版本,可能还有Android和iPad / iPhone(iOS)版本。"}
{"title": "电子商务系统ShopNC多个漏洞(可暴力 getshell)", "url": "https://www.freebuf.com/vuls/28130.html", "time": "2014-03-11", "level": "金币+6", "num_look": 708695, "num_comment": 18, "author": "Yaseng", "tags": ["WEB安全", "漏洞"], "text": "ShopNC是一款S是网城创想公司旗下服务于企业客户的电子商务系统，基于PHP5技术采用MVC 模式开发，本文介绍了shopnc多个漏洞结合,可getshell有点暴力-_-"}
{"title": "俄罗斯悄然打响网络间谍战，Uroburos程序幕后作者？", "url": "https://www.freebuf.com/news/28086.html", "time": "2014-03-11", "level": "金币+6", "num_look": 144842, "num_comment": 9, "author": "pynwolf", "tags": ["资讯"], "text": "俄罗斯在克里米亚的军事活动正成为全世界的焦点，而它在幕后的网络间谍战也正有条不紊的继续着。俄罗斯政府黑客被怀疑是间谍软件Uroburos的幕后作者。"}
{"title": "另一种角度看《RFID Advanced Security》首部曲", "url": "https://www.freebuf.com/articles/wireless/28179.html", "time": "2014-03-11", "level": "金币+6", "num_look": 528705, "num_comment": 43, "author": "FallenSec", "tags": ["无线安全"], "text": "机缘巧合，有幸看到了不少关于RFID的资料，并且有幸看到了《RFID Advanced Security》这份PDF，听说这是国内安全大会上比较早出现关于RFID的议题。"}
{"title": "俄罗斯国际新闻网站被黑，首页涂鸦纳粹字样", "url": "https://www.freebuf.com/news/27829.html", "time": "2014-03-11", "level": "金币+6", "num_look": 144984, "num_comment": 9, "author": "嘎巴嘎巴", "tags": ["资讯"], "text": "就在俄罗斯议会批准普京在克里米亚使用军队后，“今日俄罗斯”网站被黑客攻击，首页上的“俄罗斯”被篡改成“纳粹”近30分钟。幕后的攻击者仍然未知，但据猜测很可能是最近打着#OpRussia旗号并支持乌克兰抗议者的Anonymou。"}
{"title": "利用Google爬虫DDoS任意网站", "url": "https://www.freebuf.com/articles/web/28273.html", "time": "2014-03-11", "level": "金币+6", "num_look": 999534, "num_comment": 20, "author": "Taskiller", "tags": ["WEB安全", "网络安全"], "text": "我和我的小伙伴被这么高的出站流量惊呆了。如果文件再大一点的话，我想其出站流量可以轻易达到Gpbs级，而且进站流量也能达到50-100Mbps。"}
{"title": "对波音公司的新型自毁手机BlackPhone细节的进一步透露", "url": "https://www.freebuf.com/news/28168.html", "time": "2014-03-10", "level": "金币+6", "num_look": 284009, "num_comment": 9, "author": "凌晨几度i", "tags": ["终端安全", "资讯"], "text": "波音，最为人熟知的是它在航空领域的建树，以及作为美国政府一个可信赖的国防承包商身份。不过，不制造手机的飞机厂商不是好的波音公司。下面就一起目睹一下波音公司特制的可自毁的Black手机。"}
{"title": "虐心周末之-BCTF 百度杯网络安全大赛", "url": "https://www.freebuf.com/articles/others-articles/28280.html", "time": "2014-03-10", "level": "金币+6", "num_look": 216677, "num_comment": 17, "author": "leir", "tags": ["其他"], "text": "BCTF“百度杯”全国网络安全技术对抗赛,是由百度公司主办,清华和北大的安全技术专家提供技术支持,紫金江宁、南京赛宁承办,面向全国范围网络安全技术实战竞赛!"}
{"title": "Linux下的常见错误配置", "url": "https://www.freebuf.com/articles/system/27982.html", "time": "2014-03-10", "level": "金币+6", "num_look": 174306, "num_comment": 4, "author": "Taskiller", "tags": ["系统安全"], "text": "​经过对大量客户的配置审计与渗透测试，我们总结出了一些Linux系统下的常见配置错误。我们相信总结、回顾这些常见错误可以在以后为我们节省更多时间与资源，更重要的是可以帮助系统管理员，使其服务器更加安全可靠。"}
{"title": "BCTF Write-up：他乡遇故知", "url": "https://www.freebuf.com/articles/others-articles/28244.html", "time": "2014-03-10", "level": "金币+6", "num_look": 235101, "num_comment": 16, "author": "千秋丶千年", "tags": ["其他"], "text": ""}
{"title": "一周海外安全事件回顾（2014.03.03–2014.03.09）", "url": "https://www.freebuf.com/news/topnews/28214.html", "time": "2014-03-10", "level": "金币+6", "num_look": 213156, "num_comment": 6, "author": "blackscreen", "tags": ["头条"], "text": "上周被多家海外安全媒体津津乐道的竟然是一件300美金的DDoS勒索案。DDoS敲诈者和被敲诈者本身没有任何矛盾或利益冲突。如何让被敲诈者乖乖地把钱掏出来不是一件容易的事情。同样，作为被敲诈的对象，规避/减少勒索…"}
{"title": "Python socket.recvfrom_info()函数中的远程代码执行漏洞", "url": "https://www.freebuf.com/articles/network/27817.html", "time": "2014-03-10", "level": "金币+6", "num_look": 352473, "num_comment": 2, "author": "Taskiller", "tags": ["网络安全"], "text": "最近，pastebin上发布了一个exploit，是关于Python 2.7和3.x版本中的socket.recvfrom_into()函数中一个远程代码执行漏洞（栈溢出）的PoC。有些地方pastebin.com可能被墙了，为了方便，译者把它拷贝到文章里。"}
{"title": "酷似感冒，变色龙病毒可在WiFi接入点间感染", "url": "https://www.freebuf.com/news/28191.html", "time": "2014-03-10", "level": "金币+6", "num_look": 131490, "num_comment": 8, "author": "pynwolf", "tags": ["资讯"], "text": "有的时候我们也许会诧异？计算机病毒可以通过WiFi网络进行“空降”。英国利物浦大学的研究人员已经证实了如同感冒在人与人之间传播一样，WiFi病毒可以在计算机网络之间进行“感染”。"}
{"title": "极客都应该知道的Linux技巧", "url": "https://www.freebuf.com/geek/28064.html", "time": "2014-03-09", "level": "", "num_look": 209604, "num_comment": 8, "author": "破军刀", "tags": ["极客"], "text": "是什么区分开普通的Linux用户和超级极客的呢？很简单：用在学习那些使长时工作转变为一瞬间工作的技巧、诀窍、秘诀和技术上的时间。如果你想提高效率而又不用做这些搜集资料的跑腿活儿，那我们已经收集了50多条简单…"}
{"title": "BCTF百度杯一些小TIPS", "url": "https://www.freebuf.com/articles/others-articles/28084.html", "time": "2014-03-09", "level": "金币+6", "num_look": 313204, "num_comment": 9, "author": "h4dex", "tags": ["其他"], "text": "BCTF“百度杯”全国网络安全技术对抗赛,是由百度公司主办,清华和北大的安全技术专家提供技术支持,紫金江宁、南京赛宁承办,面向全国范围网络安全技术实战竞赛!"}
{"title": "安全狗招聘安全开发工程师", "url": "https://www.freebuf.com/jobs/27713.html", "time": "2014-03-09", "level": "", "num_look": 142006, "num_comment": 11, "author": "mememe", "tags": ["安全招聘"], "text": "安全狗想必大家都有耳闻，没耳闻想必在大家在深夜中叩响各种服务器和网站大门时都会发现安全狗在看守。没错就是我们，专注于服务器安全和网站安全。目前我们已经为国内超过50W台服务器提供安全保护，在国内同类软件…"}
{"title": "周末阅读：一个7岁女孩能告诉你的关于编程的事", "url": "https://www.freebuf.com/articles/others-articles/27787.html", "time": "2014-03-08", "level": "", "num_look": 137545, "num_comment": 11, "author": "小白兔", "tags": ["其他"], "text": "我已忍不住内心的冲动，要告诉你们关于菲茨杰拉德的7岁女儿的故事。在花了一个小时学习编程后，她对编程得出了令人赞叹的体会。我们很幸运，这个聪明的小女孩把她的心得总结成了简洁明了的几个小点。"}
{"title": "SPyEye作者被捕后，Tilon/spyeye2银行木马使用率下降", "url": "https://www.freebuf.com/news/27962.html", "time": "2014-03-07", "level": "金币+6", "num_look": 157832, "num_comment": 8, "author": "litdg", "tags": ["资讯"], "text": "SpyEye从2009年开始感染超过140万电脑。这个木马会窃取用户身份和金钱相关的信息，包括网上银行的认证信息，信用卡信息，用户名，密码，PIN码等。攻击者可以通过C&C服务器控制感染用户的电脑。通过多种手段，包括WE…"}
{"title": "中国的移动网络市场地下黑色产业链概述", "url": "https://www.freebuf.com/news/27722.html", "time": "2014-03-07", "level": "金币+6", "num_look": 204602, "num_comment": 9, "author": "Taskiller", "tags": ["终端安全", "资讯"], "text": "廉价的移动网络接入使世界产生了翻天覆地的变化，越来越多的人开始使用移动设备来工作和娱乐，中国也不例外。根据中国互联网络信息中心（CNNIC）发布的报告，在2013年有81%的人使用他们的移动设备接入网络。"}
{"title": "支付宝安全部纳贤启示", "url": "https://www.freebuf.com/jobs/27844.html", "time": "2014-03-07", "level": "", "num_look": 178278, "num_comment": 17, "author": "cnhawk", "tags": ["安全招聘"], "text": "支付宝，中国最多人选用的第三方网上支付平台。支付宝（www.alipay.com）成立于2004年，是中国最多人选用的第三方网上支付平台。支付宝致力为上亿计的个人及企业用户提供安全可靠、方便快捷的网上支付和收款服务。"}
{"title": "CVE-2014-2206：远程代码执行漏洞大剖析", "url": "https://www.freebuf.com/vuls/27710.html", "time": "2014-03-07", "level": "金币+6", "num_look": 209141, "num_comment": 14, "author": "Taskiller", "tags": ["漏洞"], "text": "前些时候我发布了一篇关于远程代码执行漏洞的安全公告，被CVSS评了10分。该漏洞影响所有版本的GetGo DownloadManager，因此如果有读者在使用这款软件话，请务必用一款更安全的软件代替，因为GetGo项目已经不再被支…"}
{"title": "陌陌科技招聘安全工程师", "url": "https://www.freebuf.com/jobs/27717.html", "time": "2014-03-06", "level": "", "num_look": 182714, "num_comment": 27, "author": "陌陌科技", "tags": ["安全招聘"], "text": "陌陌是陌陌科技的开发的首个基于iPhone和Android、Windows Phone的手机应用，有别于微信、微博、QQ、YY、MSN、群群、遇见等手机社交软件。通过陌陌可以提供真实的位置信息，解决了以往社交软件过于虚幻，缺乏真实的…"}
{"title": "揭密精英黑客俱乐部w00w00，Nmap开发者是成员", "url": "https://www.freebuf.com/news/27865.html", "time": "2014-03-06", "level": "", "num_look": 202034, "num_comment": 8, "author": "phper", "tags": ["资讯"], "text": "对于这些临时凑在一起聚会的老朋友们而言，聚会场地给他们一种似曾相似的感觉：一个采用安全私人服务器的网络聊天室。每一个都是精英黑客组织“w00w00”的前成员，他们在那天下午再次聚在一起，庆祝和分享他们的“胜利…"}
{"title": "安全扫描器IBM Appscan v8.8", "url": "https://www.freebuf.com/sectool/27762.html", "time": "2014-03-06", "level": "", "num_look": 769304, "num_comment": 75, "author": "MeirLin", "tags": ["工具"], "text": ""}
{"title": "对I-Bank虚拟银行系统进行渗透测试", "url": "https://www.freebuf.com/articles/web/27598.html", "time": "2014-03-06", "level": "金币+6", "num_look": 401285, "num_comment": 16, "author": "litdg", "tags": ["WEB安全"], "text": "I-Bank Pro是国际性信息安全竞赛PHDays的一个虚拟银行系统。包含了很多真实银行系统常见的漏洞。本文主要讲述使用Burpsuite对I-Bank系统的登陆功能进行简单测试。"}
{"title": "中国黑客通过地下网络攻击移动用户", "url": "https://www.freebuf.com/news/27711.html", "time": "2014-03-06", "level": "金币+6", "num_look": 186625, "num_comment": 8, "author": "esperanza", "tags": ["终端安全", "资讯"], "text": "趋势科技近期调查发现中国黑客通过地下网络的工具和服务。这样的地下网络遍布全球，尤其是俄罗斯，中国和巴西。由巨额经济利益的驱动，黑客使用各种网络犯罪技术手段，并利用网络安全的各个薄弱环节。"}
{"title": "观点：从RSA看中美安全", "url": "https://www.freebuf.com/articles/neopoints/27752.html", "time": "2014-03-06", "level": "金币+6", "num_look": 252568, "num_comment": 5, "author": "killer", "tags": ["观点"], "text": "美国FBI在RSA上有公开的展台，展示了他们的一些成果和介绍，展台上还有公开的人才招聘活动。NSA为了重建信任派了一个老外（Richard Clarke）谈NSA的棱镜门造成的损失，核心就是他们是为了保护美国人民。"}
{"title": "平安付招聘信息安全工程师", "url": "https://www.freebuf.com/jobs/27623.html", "time": "2014-03-06", "level": "", "num_look": 163380, "num_comment": 22, "author": "maxcoco", "tags": ["安全招聘"], "text": "平安付智能技术有限公司系中国平安集团旗下专业从事第三方支付研究、开发与管理的公司。旗下包括平安付科技服务有限公司及平安付电子支付有限公司两家持有。"}
{"title": "在美中国留学生侵入教授电脑篡改成绩被判刑4年", "url": "https://www.freebuf.com/news/27617.html", "time": "2014-03-06", "level": "金币+6", "num_look": 129062, "num_comment": 18, "author": "Mystery", "tags": ["资讯"], "text": "据美国中文网援引《纽约每日新闻》报道，25岁的普渡大学中国留学生孙超然(音译：Roy Chaoran Sun)被判处四年有期徒刑，罪名是侵入教授的计算机篡改他和其他学生的成绩。"}
{"title": "网络犯罪和网络间谍对经济的影响", "url": "https://www.freebuf.com/articles/neopoints/27726.html", "time": "2014-03-05", "level": "", "num_look": 171973, "num_comment": 4, "author": "IDF_Lab", "tags": ["观点"], "text": "网络犯罪，网络间谍和其他恶意网络活动被一些人称作是“人类历史上最伟大的财富转移”，还有其他人称之为“14万亿美元的经济舍入误差？”。大致估算现有的损失-从十几亿美元到几千亿美元-这已经反映了一些问题。"}
{"title": "上海街角咖啡沙龙之云安全分享会", "url": "https://www.freebuf.com/fevents/27744.html", "time": "2014-03-05", "level": "", "num_look": 155552, "num_comment": 4, "author": "FB独家", "tags": ["活动"], "text": "云计算模式当前已得到业界普遍认同，成为信息技术领域新的发展方向。云计算带来巨大发展机遇的同时又有哪些安全隐患呢？3月15日下午1:30，让我们和讲师一起探讨交流吧，沙龙期待您的到来。"}
{"title": "技术分析：近期港台网站出现的IE“雪人漏洞”挂马攻击", "url": "https://www.freebuf.com/articles/web/27586.html", "time": "2014-03-05", "level": "金币+6", "num_look": 245652, "num_comment": 15, "author": "逍遥子", "tags": ["WEB安全"], "text": ""}
{"title": "FireEye：2013年度APT攻击报告", "url": "https://www.freebuf.com/articles/web/27639.html", "time": "2014-03-05", "level": "金币+9", "num_look": 421048, "num_comment": 15, "author": "lanlan", "tags": ["WEB安全", "安全报告"], "text": "日前，美国Fireeye火眼公司发布报告2013年度APT攻击报告（Advanced Threat Report）。FireEYe在每天分析100个安全攻击事件的基础上，对159个与APT相关的恶意软件家族进行整理，并且在几乎世界上的每个角落都发现过…"}
{"title": "FreeBuf线上活动：2月黑客晒书会（得奖公布)", "url": "https://www.freebuf.com/fevents/27526.html", "time": "2014-03-05", "level": "", "num_look": 190656, "num_comment": 9, "author": "softbug", "tags": ["活动"], "text": ""}
{"title": "简易爬虫搜索引擎 - JSearchEngine", "url": "https://www.freebuf.com/sectool/27400.html", "time": "2014-03-05", "level": "金币+9", "num_look": 316669, "num_comment": 14, "author": "blackjam", "tags": ["工具"], "text": ""}
{"title": "隐藏在安全外衣下的不安全性", "url": "https://www.freebuf.com/articles/web/27509.html", "time": "2014-03-05", "level": "金币+9", "num_look": 180733, "num_comment": 11, "author": "Taskiller", "tags": ["WEB安全"], "text": "SQL注入在安全行业已经成为一个广为熟知的话题，每隔一段时间，就会有相关研究人员放出一些独特的注入技能，与大家共享。最近我恰好也研究出一组数据：MU4"}
{"title": "火币网招聘高级信息安全工程师", "url": "https://www.freebuf.com/jobs/27358.html", "time": "2014-03-04", "level": "", "num_look": 201631, "num_comment": 13, "author": "maxcoco", "tags": ["安全招聘"], "text": "火币网是中国最专业的虚拟币交易平台之一，提供专业的虚拟币电子商务交易。火币网秉承打造中国乃至全球最专业的虚拟币电子商务交易平台的历史使命。火币网是目前国内交易量最大的比特币在线交易平台，后续会推出更…"}
{"title": "玩转无线 -- GNURADIO 简单运用", "url": "https://www.freebuf.com/articles/wireless/27306.html", "time": "2014-03-04", "level": "金币+9", "num_look": 585377, "num_comment": 21, "author": "kevin2600", "tags": ["无线安全", "极客"], "text": "大家好, 我是Insight-labs的旺财，这里放出个旺财在Bsides Toronto 2013 会上RF-Ninjia Hacking议题中的一个案例，随着物联网越来越火热，而物联网又离不开无线，这里旺财把这个简单RF无线分析案例放出来跟大家娱乐…"}
{"title": "集齐7把钥匙，掌控全球互联网DNS", "url": "https://www.freebuf.com/news/27579.html", "time": "2014-03-04", "level": "", "num_look": 178142, "num_comment": 23, "author": "fu4k", "tags": ["资讯"], "text": ""}
{"title": "360网络安全攻防实验室招聘启示", "url": "https://www.freebuf.com/jobs/27137.html", "time": "2014-03-04", "level": "", "num_look": 656648, "num_comment": 46, "author": "cnhacks", "tags": ["安全招聘"], "text": ""}
{"title": "意大利公司Hacking Team向21个国家贩卖间谍软件", "url": "https://www.freebuf.com/news/27401.html", "time": "2014-03-04", "level": "金币+9", "num_look": 138886, "num_comment": 4, "author": "pynwolf", "tags": ["资讯"], "text": ""}
{"title": "linux下利用一次性口令实现安全管理", "url": "https://www.freebuf.com/articles/system/27110.html", "time": "2014-03-04", "level": "金币+9", "num_look": 164557, "num_comment": 10, "author": "黑狐", "tags": ["系统安全"], "text": "Linux服务器一直就是以稳定、高效、安全而著称。安全是比较重要的一个环节，这关系到商业机密，更关系到企业的存亡。本文介绍了如何使用optw生成一次性口令及只允许执行特定命令。"}
{"title": "新《黑客帝国》三部曲有戏了", "url": "https://www.freebuf.com/news/27405.html", "time": "2014-03-03", "level": "", "num_look": 130119, "num_comment": 1, "author": "h4dex", "tags": ["资讯"], "text": ""}
{"title": "教程：五步黑掉Nokia X，刷机安装Googleplay", "url": "https://www.freebuf.com/news/27406.html", "time": "2014-03-03", "level": "", "num_look": 133985, "num_comment": 2, "author": "h4dex", "tags": ["资讯"], "text": "在MWC 2014的诺基亚发布会上，介绍完Nokia X系列机型后，埃洛普点明了Nokia X存在的意义：给人们一扇通往微软的大门。现在看来，有人关掉了这扇门，转身去拥抱那只可爱的绿色机器人。"}
{"title": "漏洞盒子项目上新：联想（中国区及海外）多条业务线安全测试", "url": "https://www.freebuf.com/news/others/59851.html", "time": "2014-03-03", "level": "", "num_look": 97842, "num_comment": 97842, "author": "漏洞盒子", "tags": ["周边"], "text": ""}
{"title": "xKungfoo 2014安全会议召开在即", "url": "https://www.freebuf.com/news/27436.html", "time": "2014-03-03", "level": "红色标题", "num_look": 286548, "num_comment": 19, "author": "FB独家", "tags": ["其他", "资讯"], "text": "xKungfoo 是XCon组委会组织主办的中国人自己的安全技术讨论会议，演讲者与参会者全部为中国人，并仅面向国内广大安全技术和黑客技术爱好者召开。\r\n日前，Freebuf黑客与极客正式成为xKungfoo 2014官方合作媒体。"}
{"title": "视频：No more woof - 不仅仅是知道汪星人在想什么那么简单", "url": "https://www.freebuf.com/geek/27222.html", "time": "2014-03-03", "level": "红色标题", "num_look": 491208, "num_comment": 7, "author": "FB视频", "tags": ["极客", "视频"], "text": ""}
{"title": "请放过“柔软天使”牌卫生纸：黑客攻击卫生纸网站获刑", "url": "https://www.freebuf.com/news/27441.html", "time": "2014-03-03", "level": "金币+9", "num_look": 125382, "num_comment": 7, "author": "pynwolf", "tags": ["资讯"], "text": "Anonymous某些筒子攻击卫生纸厂商的服务器。24岁的Anonymous成员Jacob Wilkens上月被判缓刑2年和11万美金罚款，罪名是攻击“柔软天使”牌卫生纸生产商的服务器，导致网站不能访问。在同月，另一成员以同样罪名被判缓…"}
{"title": "意大利政府发布国家网络空间安全战略框架", "url": "https://www.freebuf.com/news/27247.html", "time": "2014-03-03", "level": "", "num_look": 146712, "num_comment": 1, "author": "Redo1o8SK", "tags": ["资讯"], "text": "日前，意大利政府发表了网络空间战略报告，内阁总统发布了“国家网络空间安全战略框架”，这份重要的文件首次揭示了未来两年内意大利政府的网络策略规划。"}
{"title": "研究人员发现伪装在Github上的比特币窃取木马", "url": "https://www.freebuf.com/news/27149.html", "time": "2014-03-03", "level": "金币+3", "num_look": 117878, "num_comment": 1, "author": "嘎巴嘎巴", "tags": ["资讯"], "text": ""}
{"title": "浪潮信息安全诚聘安全服务工程师", "url": "https://www.freebuf.com/jobs/27159.html", "time": "2014-03-02", "level": "", "num_look": 138241, "num_comment": 11, "author": "lions7", "tags": ["安全招聘"], "text": "浪潮是中国最早的信息安全厂商之一，96年开始进行信息安全产品、技术的研发与推广；是国家信息安全等级保护政策的参与者、制定者和推广者之一；中国主机安全、数据中心安全的领先品牌。"}
{"title": "2013年微软安全漏洞盘点", "url": "https://www.freebuf.com/articles/web/27288.html", "time": "2014-03-01", "level": "金币+3", "num_look": 196310, "num_comment": 10, "author": "lanlan", "tags": ["WEB安全", "系统安全"], "text": "2013年是0-day的高发期，也是安全工程师和黑客之间的博弈最为激烈的一年，微软在这一年推出了很多新的安全机制，黑客们也在尝试很多新颖的攻击思路，下面就来看在2013年对弈双方如何妙招迭出。"}
{"title": "周末阅读：程序员的《权利法案》", "url": "https://www.freebuf.com/news/others/27060.html", "time": "2014-03-01", "level": "", "num_look": 161217, "num_comment": 6, "author": "小白兔", "tags": ["其他", "周边"], "text": ""}
{"title": "对利用Adobe 0day – CVE-2014-0502进行攻击的行为分析", "url": "https://www.freebuf.com/articles/network/27118.html", "time": "2014-02-28", "level": "金币+3", "num_look": 504425, "num_comment": 7, "author": "Taskiller", "tags": ["网络安全"], "text": "前些天FireEye发布了一个利用AdobeFlash的新0day进行攻击的报告，且Adobe已经根据漏洞情况发布了一个安全更新。根据FireEye的报告，许多网站会将访问者重定向到以下包含exploit的恶意服务器。"}
{"title": "DedeCMS全版本通杀SQL注入漏洞利用代码及工具", "url": "https://www.freebuf.com/sectool/27206.html", "time": "2014-02-28", "level": "金币+3", "num_look": 2672229, "num_comment": 52, "author": "千秋丶千年", "tags": ["工具", "漏洞"], "text": ""}
{"title": "用C语言进一步优化Windows Shellcode", "url": "https://www.freebuf.com/articles/system/27122.html", "time": "2014-02-28", "level": "", "num_look": 384605, "num_comment": 7, "author": "IDF_Lab", "tags": ["系统安全"], "text": "我得首先承认，编写shellcode真是让人郁闷极了。虽然可以利用些小技巧来减小payload的大小，但编写shellcode仍然会错误百出，难以维护。例如，我发现跟踪x86中寄存器的分配，确保x86_64栈的对齐真的是件蛋疼的事。"}
{"title": "自从有了小鸭鸭，妈妈再也不用担心我的编程了", "url": "https://www.freebuf.com/news/27029.html", "time": "2014-02-28", "level": "金币+3", "num_look": 136372, "num_comment": 9, "author": "lanlan", "tags": ["资讯"], "text": "从题目就可以看出，这是一篇软文，但是软文的主角DuckDuckGo还是很有意思的。要知道做一款足以挑战Google的搜索引擎，本身就是很酷的一件事情。当无数创业者死在了巨头山寨的威力面前，这只小鸭子却抓住了Google永…"}
{"title": "无锡文思海辉招聘渗透测试工程师", "url": "https://www.freebuf.com/jobs/26983.html", "time": "2014-02-27", "level": "", "num_look": 151661, "num_comment": 17, "author": "dongfangxiaoju", "tags": ["安全招聘"], "text": ""}
{"title": "对特斯拉公司官网的一次渗透测试", "url": "https://www.freebuf.com/articles/web/27138.html", "time": "2014-02-27", "level": "金币+3", "num_look": 319427, "num_comment": 26, "author": "Taskiller", "tags": ["WEB安全"], "text": ""}
{"title": "web应用防火墙 - 安全伞18.5.1免费版本发布", "url": "https://www.freebuf.com/sectool/26989.html", "time": "2014-02-27", "level": "", "num_look": 210773, "num_comment": 11, "author": "lyon", "tags": ["工具"], "text": "​ “Safe3 Web Application Firewall\"是国内安全组织保护伞网络基于新一代Web安全技术开发的全方位企业Web信息安全产品。能有效扫描各种WebShell，同时也可以抵御各种Web攻击。"}
{"title": "应用层防火墙ModSecurity日志控制台 - WAF-FLE", "url": "https://www.freebuf.com/sectool/27096.html", "time": "2014-02-27", "level": "", "num_look": 312771, "num_comment": 4, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "浅谈开源web程序后台的安全性", "url": "https://www.freebuf.com/articles/web/27085.html", "time": "2014-02-27", "level": "", "num_look": 267155, "num_comment": 4, "author": "腾讯安全平台部", "tags": ["WEB安全"], "text": "不知怎的最近甚是思念校园生活，思念食堂的炒饭。那时会去各种安全bbs上刷刷帖子，喜欢看别人写的一些关于安全技巧或经验的总结；那时BBS上很多文章标题都是：成功渗透XXX，成功拿下XXX。"}
{"title": "Web漏洞演练平台 - ZVulDrill", "url": "https://www.freebuf.com/sectool/27027.html", "time": "2014-02-27", "level": "金币+3", "num_look": 644964, "num_comment": 54, "author": "zer0cloud", "tags": ["工具"], "text": "在学习和研究web漏洞的过程中对每一种漏洞都进行了测试，将其整理到了一块儿，于是有了一个简单的Web漏洞演练平台--ZVulDrill，各位安全测试人员可以亲身实践如何利用这个漏洞，同时也可以学习到漏洞的相关知识。"}
{"title": "走近科学：我是如何入侵Instagram查看你的私人片片的", "url": "https://www.freebuf.com/news/topnews/26935.html", "time": "2014-02-27", "level": "金币+3", "num_look": 3299206, "num_comment": 39, "author": "凌晨几度i", "tags": ["WEB安全", "头条"], "text": ""}
{"title": "苹果发布OS X 10.9.2更新,修复SSL漏洞", "url": "https://www.freebuf.com/news/27002.html", "time": "2014-02-26", "level": "", "num_look": 102179, "num_comment": 102179, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "韩国开发针对朝鲜核工业的网络战武器", "url": "https://www.freebuf.com/news/26941.html", "time": "2014-02-26", "level": "金币+5", "num_look": 121975, "num_comment": 3, "author": "lanlan", "tags": ["资讯"], "text": "从枪击事件到几次匿名的黑客攻击，朝鲜半岛事件不断，似乎有什么不知名的力量在挑拨着朝鲜半岛的矛盾。不过朝鲜和韩国都表现出了隐忍的态度。不过在波澜不惊的外表下，两国都在暗自积蓄着自己的网络力量，韩国针对…"}
{"title": "利用Volatility查找系统中的恶意DLL", "url": "https://www.freebuf.com/articles/system/26936.html", "time": "2014-02-26", "level": "金币+5", "num_look": 191705, "num_comment": 1, "author": "Taskiller", "tags": ["系统安全"], "text": "Colin和我最近正致力于研究一个内存镜像，需要找到由svchost.exe加载的所有DLL，选择使用大家熟知的内存分析工具 -- Volatility。Volatility无法通过进程名查看加载的dll，而是通过指定进程的PID来将所有已加载的dl…"}
{"title": "大数据安全分析：我们从日志中得到的（二）", "url": "https://www.freebuf.com/articles/web/26846.html", "time": "2014-02-26", "level": "金币+5", "num_look": 455967, "num_comment": 17, "author": "linxinsnow", "tags": ["WEB安全", "网络安全"], "text": ""}
{"title": "北京星云融创（安全宝）2014年招聘安全服务工程及实习生", "url": "https://www.freebuf.com/jobs/26826.html", "time": "2014-02-25", "level": "", "num_look": 151294, "num_comment": 10, "author": "seay", "tags": ["安全招聘"], "text": ""}
{"title": "微软支付第二个10万美金 - 绿盟科技于旸收入囊中", "url": "https://www.freebuf.com/news/26829.html", "time": "2014-02-25", "level": "金币+5", "num_look": 283524, "num_comment": 23, "author": "Redo1o8SK", "tags": ["资讯"], "text": "近日微软宣布，作为微软安全奖励计划的一部分，已经支付了第二笔全额奖金，获奖者来自绿盟科技的“YangYu”的亚洲安全研究员，获奖原因是YangYu发现了新型的“缓解旁路衍生”变体。"}
{"title": "著名网络黑市丝绸之路2.0被黑，大量用户资金被盗", "url": "https://www.freebuf.com/news/26750.html", "time": "2014-02-25", "level": "金币+5", "num_look": 278930, "num_comment": 7, "author": "pynwolf", "tags": ["资讯"], "text": ""}
{"title": "颤抖了吗？九步逆向破解银行安全令牌", "url": "https://www.freebuf.com/articles/terminal/26631.html", "time": "2014-02-25", "level": "金币+5", "num_look": 368820, "num_comment": 24, "author": "lanlan", "tags": ["终端安全"], "text": "作者历经千辛万苦，逆向了一个银行动态口令的APP，过程艰辛曲折。最后发现，其实生成算法也不算很复杂，其中主要使用了 android_id 系统时间戳 作为生成变量。看起来高大上的动态口令，在逆向工程师抽丝剥茧的分析…"}
{"title": "窃听风暴：Android平台https嗅探劫持漏洞", "url": "https://www.freebuf.com/articles/terminal/26840.html", "time": "2014-02-24", "level": "", "num_look": 367690, "num_comment": 11, "author": "腾讯安全平台部", "tags": ["终端安全"], "text": "去年10月中旬，腾讯安全中心在日常终端安全审计中发现，在Android平台中使用https通讯的app绝大多数都没有安全的使用google提供的API，直接导致https通讯中的敏感信息泄漏甚至远程代码执行。"}
{"title": "CEH认证（道德黑客）官方网站遭黑客入侵", "url": "https://www.freebuf.com/news/26881.html", "time": "2014-02-24", "level": "", "num_look": 344275, "num_comment": 16, "author": "H3lvin", "tags": ["资讯"], "text": "日前，国外黑客入侵EC Council官网，这次攻击造成了6万多名安全工作人员的护照及照片ID曝光，其中包括了来自美国军方、FBI、联合国及NSA的成员。令人诧异的是，人们居然在这份曝光的信息中看到了由爱德华-斯诺登提…"}
{"title": "Linux下内存取证工具Volatility的使用", "url": "https://www.freebuf.com/articles/system/26763.html", "time": "2014-02-24", "level": "金币+5", "num_look": 824735, "num_comment": 10, "author": "白河·愁", "tags": ["系统安全"], "text": "Volatility是开源的Windows，Linux，MaC，Android的内存取证分析工具，由python编写成，命令行操作，支持各种操作系统。本文介绍了Volatility的使用方法，包含获取内存图像，查找可疑文件等。"}
{"title": "久游网招聘安全工程师", "url": "https://www.freebuf.com/jobs/26518.html", "time": "2014-02-24", "level": "", "num_look": 158050, "num_comment": 16, "author": "9you_HR", "tags": ["安全招聘"], "text": ""}
{"title": "Adobe Flash CVE-2014-0497漏洞分析", "url": "https://www.freebuf.com/vuls/26637.html", "time": "2014-02-24", "level": "", "num_look": 241278, "num_comment": 8, "author": "翰海源安全", "tags": ["漏洞", "系统安全"], "text": ""}
{"title": "雪人行动：利用IE10 0day漏洞的APT攻击剑指美国军方情报", "url": "https://www.freebuf.com/news/26772.html", "time": "2014-02-24", "level": "金币+5", "num_look": 322509, "num_comment": 26, "author": "lanlan", "tags": ["WEB安全", "资讯"], "text": ""}
{"title": "手动web应用程序渗透测试-模糊测试中的后缀与前缀", "url": "https://www.freebuf.com/articles/web/26675.html", "time": "2014-02-24", "level": "金币+5", "num_look": 199644, "num_comment": 9, "author": "Redo1o8SK", "tags": ["WEB安全"], "text": ""}
{"title": "关于yubikey对web应用的杞人之忧", "url": "https://www.freebuf.com/articles/web/25703.html", "time": "2014-02-24", "level": "金币+5", "num_look": 299019, "num_comment": 11, "author": "p0tt1", "tags": ["WEB安全"], "text": "Yubikey 是一个小型的USB设备，在电脑看来，它是一个USB键盘设备。当将Yubikey接入电脑后，其上会亮起一个绿色的圆环，代表这个USB键盘已经可以正常传输字符了。"}
{"title": "军火库：渗透测试工具流行性大调查", "url": "https://www.freebuf.com/sectool/26756.html", "time": "2014-02-23", "level": "红色标题", "num_look": 401448, "num_comment": 29, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "利用旧版Android漏洞的E-Z-2-Use攻击代码已在Metasploit发布", "url": "https://www.freebuf.com/news/26731.html", "time": "2014-02-23", "level": "金币+4", "num_look": 305030, "num_comment": 23, "author": "thanks", "tags": ["资讯"], "text": ""}
{"title": "周末阅读：北漂程序员边城的幸福生活", "url": "https://www.freebuf.com/news/others/26497.html", "time": "2014-02-22", "level": "", "num_look": 360607, "num_comment": 32, "author": "小白兔", "tags": ["其他", "周边"], "text": ""}
{"title": "Drozer - Android APP安全评估工具（附测试案例）", "url": "https://www.freebuf.com/sectool/26503.html", "time": "2014-02-21", "level": "", "num_look": 1653299, "num_comment": 20, "author": "testxxtest", "tags": ["工具", "终端安全"], "text": ""}
{"title": "由MtGox停止提现白话比特币交易安全", "url": "https://www.freebuf.com/articles/network/26611.html", "time": "2014-02-21", "level": "金币+4", "num_look": 284234, "num_comment": 4, "author": "pnig0s", "tags": ["网络安全"], "text": "MtGox在2月7号发出公告，声称发现大量无效提现请求，需要分析原因，并暂停了一切提现操作。随后bitstamp等多个知名比特币交易网站均宣布暂停提现，从而引发了炒币者的恐慌，导致比特币价格一度腰斩。2月10号，MtGox…"}
{"title": "视频：WaRP飞思卡尔可穿戴设备 -  CES展会上最酷炫的东西", "url": "https://www.freebuf.com/video/26250.html", "time": "2014-02-21", "level": "红色标题", "num_look": 222213, "num_comment": 11, "author": "FB视频", "tags": ["视频"], "text": ""}
{"title": "iOS开发安全学习工具 - OWASP iGoat", "url": "https://www.freebuf.com/sectool/26526.html", "time": "2014-02-20", "level": "", "num_look": 218845, "num_comment": 10, "author": "fake", "tags": ["工具"], "text": ""}
{"title": "RSA大会播报 - 2014最佳安全博客提名（国外篇）", "url": "https://www.freebuf.com/news/26544.html", "time": "2014-02-20", "level": "金币+4", "num_look": 177684, "num_comment": 9, "author": "005", "tags": ["资讯"], "text": "今年美国RSA大会将在这个月的23-28号举行，每年大会上都会评出过去一年来业内最佳安全博客，该投票已于2月14日停止了投票，大奖得主将于RSA大会上公布。现在我们抢先看看都有哪些提名，最终结果且听下周分解。"}
{"title": "安络科技招聘安全工程师", "url": "https://www.freebuf.com/jobs/26400.html", "time": "2014-02-20", "level": "", "num_look": 154312, "num_comment": 10, "author": "HelloKitty", "tags": ["安全招聘"], "text": ""}
{"title": "人物：他是互联网世界的私家侦探", "url": "https://www.freebuf.com/articles/people/26523.html", "time": "2014-02-19", "level": "", "num_look": 217576, "num_comment": 5, "author": "phper", "tags": ["人物志"], "text": ""}
{"title": "FreeBuf线上活动：2月黑客晒书会（第二期）", "url": "https://www.freebuf.com/fevents/25708.html", "time": "2014-02-19", "level": "红色标题", "num_look": 489836, "num_comment": 73, "author": "softbug", "tags": ["活动"], "text": "继去年的第一期黑客晒书会，我们有很多的朋友都来积极的参与，也获得了不少奖品作为鼓励。大家都纷纷晒出了自己的全部家当，感谢大家对活动的支持。 今年，我们又来了。活动规则还是跟去年一样。"}
{"title": "恶意软件模式匹配利器 - YARA", "url": "https://www.freebuf.com/articles/system/26373.html", "time": "2014-02-19", "level": "", "num_look": 1019902, "num_comment": 2, "author": "IDF_Lab", "tags": ["系统安全"], "text": "YARA是一款旨在帮助恶意软件研究人员识别和分类恶意软件样本的开源工具（由virustotal的软件工程师Victor M. Alvarezk开发），使用YARA可以基于文本或二进制模式创建恶意软件家族描述信息，当然也可以是其他匹配信…"}
{"title": "观点：传统安全企业发展趋势的二些看法", "url": "https://www.freebuf.com/articles/neopoints/26344.html", "time": "2014-02-19", "level": "金币+4", "num_look": 198128, "num_comment": 15, "author": "eip_0x", "tags": ["观点"], "text": ""}
{"title": "解读天书 - 漏洞利用中级技巧的分析", "url": "https://www.freebuf.com/articles/system/26441.html", "time": "2014-02-19", "level": "金币+4", "num_look": 562661, "num_comment": 52, "author": "夜未央", "tags": ["系统安全"], "text": "江湖中一直流传着袁哥的传说，发表的很多文章和微博可能都是当做天书来看，so，本文作者夜未央以袁哥某篇微博为切入点，以实际的案列，详细介绍了漏洞利用中的一些原理的分析，并且遵循思考问题 - 分析问题 - 解决…"}
{"title": "德国媒体：中国黑客去年曾向德国高官发送恶意电邮", "url": "https://www.freebuf.com/news/26417.html", "time": "2014-02-18", "level": "", "num_look": 129833, "num_comment": 7, "author": "fu4k", "tags": ["资讯"], "text": ""}
{"title": "邀您加入趋势科技！Be the best of yourself！", "url": "https://www.freebuf.com/jobs/25869.html", "time": "2014-02-18", "level": "", "num_look": 193395, "num_comment": 17, "author": "trendHR", "tags": ["安全招聘"], "text": "趋势科技创建于1988年，目前在全球50个国家和地区设有分公司，员工总数超过5000人。趋势科技是全球最大的独立安全软件提供商，已是全球公认的服务器、虚拟化和云安全领域的全球领军者。"}
{"title": "Google收购以色列信息安全创业公司SlickLogin", "url": "https://www.freebuf.com/news/26361.html", "time": "2014-02-18", "level": "", "num_look": 145884, "num_comment": 3, "author": "phper", "tags": ["资讯"], "text": "谷歌已经收购以色列信息安全创业公司SlickLogin。该公司的技术使用智能手机和高频声波在网站上进行身份认证。SlickLogin在公司网站上宣布了这笔交易。该公司的团队共有3名成员。"}
{"title": "黑客可以通过3G和4G USB调制解调器钓鱼诈骗", "url": "https://www.freebuf.com/news/26287.html", "time": "2014-02-18", "level": "", "num_look": 155039, "num_comment": 4, "author": "pynwolf", "tags": ["资讯"], "text": "来自瑞典的Andreas Lindh表明，他看过的调制解调器都是通过内置的Web服务器进行管理，它们很容易受到一种常见的黑客攻击——跨站点请求伪造（CRSF）。其产生的后果是，如果一个家庭用户访问了一个嵌入恶意代码的网站…"}
{"title": "淘宝和支付宝认证被爆存在安全缺陷，黑客可登录他人账号进行操作", "url": "https://www.freebuf.com/news/26307.html", "time": "2014-02-18", "level": "", "num_look": 200037, "num_comment": 5, "author": "x0sec", "tags": ["资讯"], "text": ""}
{"title": "安全扫描工具 - NetSparker v3.2.1.0破解版", "url": "https://www.freebuf.com/sectool/26122.html", "time": "2014-02-17", "level": "", "num_look": 251878, "num_comment": 25, "author": "lianfeng", "tags": ["工具"], "text": "Netsparker是一款综合型的web应用安全漏洞扫描工具，它分为专业版和免费版，免费版的功能也比较强大。Netsparker与其他综合性的web应用安全扫描工具相比的一个特点是它能够更好的检测SQL Injection和 Cross-site Sc…"}
{"title": "SPIP漏洞扫描工具 - SPIPScan", "url": "https://www.freebuf.com/sectool/26292.html", "time": "2014-02-17", "level": "", "num_look": 211461, "num_comment": 2, "author": "H3lvin", "tags": ["工具"], "text": "SPIP是一基于Web的内容发布系统，SPIPScan是一款基于python编写的SPIP漏洞扫描程序，该版本支持探测服务器所安装的SPIP插件版本、暴力破解、检测主题版本、敏感文件夹识别等。"}
{"title": "3684个中国政府站点被黑分析", "url": "https://www.freebuf.com/articles/web/26132.html", "time": "2014-02-17", "level": "金币+6", "num_look": 346701, "num_comment": 19, "author": "bittertea", "tags": ["WEB安全"], "text": ""}
{"title": "传统安全企业发展趋势的一些看法", "url": "https://www.freebuf.com/articles/others-articles/26168.html", "time": "2014-02-17", "level": "", "num_look": 218865, "num_comment": 13, "author": "flashsky", "tags": ["其他", "观点"], "text": ""}
{"title": "Cisco Linksys路由器蠕虫The Moon正在蔓延", "url": "https://www.freebuf.com/news/25957.html", "time": "2014-02-15", "level": "金币+6", "num_look": 188422, "num_comment": 15, "author": "litdg", "tags": ["资讯"], "text": ""}
{"title": "Facebook域名被叙利亚电子军劫持！", "url": "https://www.freebuf.com/news/25840.html", "time": "2014-02-14", "level": "金币+6", "num_look": 162349, "num_comment": 16, "author": "凌晨几度i", "tags": ["资讯"], "text": ""}
{"title": "江苏君立华域招聘渗透测试工程师", "url": "https://www.freebuf.com/jobs/25723.html", "time": "2014-02-14", "level": "", "num_look": 473134, "num_comment": 119, "author": "x0sec", "tags": ["安全招聘"], "text": "江苏君立华域信息安全技术有限公司成立于2006年，是一家以信息安全服务为主导的现代化高科技企业，主要为国内各行各业，特别是运营商和大中型企业提供全方位信息安全技术服务。"}
{"title": "云安全初创企业CloudPassage获2550万美元融资", "url": "https://www.freebuf.com/news/25832.html", "time": "2014-02-14", "level": "", "num_look": 119912, "num_comment": 3, "author": "phper", "tags": ["资讯"], "text": ""}
{"title": "美国VisualThreat安全公司上海研发中心招聘移动安全研究员", "url": "https://www.freebuf.com/jobs/25735.html", "time": "2014-02-14", "level": "", "num_look": 246111, "num_comment": 10, "author": "tofreebug", "tags": ["安全招聘"], "text": "美国VisualThreat移动安全公司是企业级移动安全厂商，坐落在美国硅谷。公司创建于2013年，基于下一代大数据移动安全技术, 是当前唯一一家提供跨病毒家族关联的移动威胁防护方案的公司。"}
{"title": "简单抓取FreeBuf工具列表", "url": "https://www.freebuf.com/sectool/25746.html", "time": "2014-02-14", "level": "", "num_look": 254833, "num_comment": 19, "author": "L34Rn", "tags": ["工具"], "text": ""}
{"title": "移动支付安全评测：微信支付篇", "url": "https://www.freebuf.com/articles/wireless/25682.html", "time": "2014-02-14", "level": "金币+6", "num_look": 533493, "num_comment": 25, "author": "Sasha_TL", "tags": ["无线安全"], "text": "我们尽量将评测的所有内容做到客观中立，并且所有测试中的测试项都可以在相同版本中进行验证，感兴趣的朋友可以自己尝试。"}
{"title": "杭州安恒信息招聘安全研究及安全服务岗位", "url": "https://www.freebuf.com/jobs/25669.html", "time": "2014-02-13", "level": "", "num_look": 227414, "num_comment": 20, "author": "DBAppsecurity", "tags": ["安全招聘"], "text": ""}
{"title": "学点编码知识又不会死：Unicode的流言终结者和编码大揭秘", "url": "https://www.freebuf.com/articles/web/25623.html", "time": "2014-02-13", "level": "金币+6", "num_look": 1401258, "num_comment": 25, "author": "IDF_Lab", "tags": ["WEB安全", "其他"], "text": ""}
{"title": "极客有意思：玩转 HID 门禁（视频）", "url": "https://www.freebuf.com/articles/wireless/25691.html", "time": "2014-02-13", "level": "金币+4", "num_look": 731326, "num_comment": 9, "author": "kevin2600", "tags": ["无线安全", "极客"], "text": "简单介绍一下细节，目标是一款在门禁市场非常流行的HID ProxCard. 其工作在125khz 的低频,卡上存有44bits 的ID 号, 而这44bits 又分为商家识别号, 和实际的26bit卡号，注意所有的商家识别号都是固定的哦。"}
{"title": "Facebook推出用于android数据加密的开源API", "url": "https://www.freebuf.com/news/25549.html", "time": "2014-02-13", "level": "金币+4", "num_look": 178249, "num_comment": 178249, "author": "lanlan", "tags": ["资讯"], "text": "facebook开放了一个名叫，“Conceal”的安全工具的源代码，它提供了密码学的Java API接口，这些简单易用的接口可以让应用程序以最优的方式加密数据。"}
{"title": "身份欺诈成为新的热门犯罪手段：每两分钟一个受害者", "url": "https://www.freebuf.com/news/25528.html", "time": "2014-02-13", "level": "金币+4", "num_look": 148892, "num_comment": 2, "author": "lanlan", "tags": ["资讯"], "text": "身份欺诈其实是一种很常见的犯罪手段，比如，你在网上和同学下棋，自己在电脑上开一个下棋软件帮你下，或者考试作弊其实都属于身份欺诈。当然如果这种技术用在窃取金钱和私人信息上，那可就不是那么简单了。"}
{"title": "大数据安全分析：我们从日志中得到的（一）", "url": "https://www.freebuf.com/articles/web/25613.html", "time": "2014-02-13", "level": "金币+4", "num_look": 751019, "num_comment": 22, "author": "linxinsnow", "tags": ["WEB安全", "网络安全"], "text": "在一个嘈杂的环境中，怎样才能尽可能的发现异常？不外乎黑白名单。黑名单，又可以总结出两种方式：1.基于特征的检测，2.基于行为的检测。基于特征，是一种立竿见影的手段，对于一般的攻击很有效，但是永远不可能做…"}
{"title": "PayPal总裁马库斯信用卡遭盗刷", "url": "https://www.freebuf.com/news/25671.html", "time": "2014-02-12", "level": "", "num_look": 151420, "num_comment": 7, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "号称可杀灭99.9%恶意程序的安全工具 - Rootkit Hunter", "url": "https://www.freebuf.com/sectool/25665.html", "time": "2014-02-12", "level": "", "num_look": 364436, "num_comment": 26, "author": "fu4k", "tags": ["工具"], "text": ""}
{"title": "杭州海康威视安全岗位招聘", "url": "https://www.freebuf.com/jobs/25604.html", "time": "2014-02-12", "level": "", "num_look": 156797, "num_comment": 12, "author": "maxcoco", "tags": ["安全招聘"], "text": "海康威视​是领先的安防产品及行业解决方案提供商，致力于不断提升视频处理技术和视频分析技术，面向全球提供领先的安防产品、专业的行业解决方案与优质的服务，为客户持续创造更大价值。"}
{"title": "AV-TEST公布2013年反病毒年度大奖", "url": "https://www.freebuf.com/news/25638.html", "time": "2014-02-12", "level": "红色标题", "num_look": 215718, "num_comment": 21, "author": "phper", "tags": ["资讯"], "text": ""}
{"title": "CloudFlare公司遭遇超过400Gbps DDoS攻击", "url": "https://www.freebuf.com/news/25560.html", "time": "2014-02-12", "level": "金币+4", "num_look": 251160, "num_comment": 13, "author": "嘎巴嘎巴", "tags": ["资讯"], "text": "更令人震精的分析数据来自CloudFlare。CloudFlare在 1月9日的官方博客上对NTP反射放大攻击也进行了分析。NTP反射放大攻击和DNS反射放大攻击有异曲同工之妙，都是基于不需要维护状态的UDP协议。"}
{"title": "波兰遭遇大规模DNS劫持攻击", "url": "https://www.freebuf.com/news/25532.html", "time": "2014-02-12", "level": "金币+4", "num_look": 208217, "num_comment": 10, "author": "litdg", "tags": ["资讯"], "text": ""}
{"title": "分分钟入侵智能汽车，只需20美元", "url": "https://www.freebuf.com/geek/25497.html", "time": "2014-02-12", "level": "金币+4", "num_look": 232547, "num_comment": 13, "author": "lanlan", "tags": ["极客"], "text": "如今智能化已经在我们生活中普及，智能手机，智能电视，智能冰箱，甚至智能汽车，这些智能设备极大的方便了我们的日常生活。但是，这些智能设备也给我们带来了风险，设想一下一个杀手，可以入侵你的智能汽车，很恐…"}
{"title": "将web攻击数据可视化", "url": "https://www.freebuf.com/articles/web/25476.html", "time": "2014-02-12", "level": "金币+4", "num_look": 277566, "num_comment": 14, "author": "Rozero", "tags": ["WEB安全"], "text": ""}
{"title": "北京永信至诚科技有限公司招聘网络渗透攻城狮", "url": "https://www.freebuf.com/jobs/25513.html", "time": "2014-02-11", "level": "", "num_look": 288338, "num_comment": 21, "author": "永信至诚", "tags": ["安全招聘"], "text": "永信至诚科技有限公司是一家真正拥有自主知识产权技术的高科技企业。永信至诚科技有限公司拥有国内一流的网络信息技术研究团队， 现有专职开发人员和研究人员10名，涵盖网络信息获取，数据库信息管理，漏洞挖掘及研…"}
{"title": "黑吃黑！英国情报机构使用DDoS攻击黑客组织", "url": "https://www.freebuf.com/news/25442.html", "time": "2014-02-11", "level": "", "num_look": 214769, "num_comment": 1, "author": "phper", "tags": ["资讯"], "text": ""}
{"title": "撸友福音：DIY简单功能的torrentkitty种子爬虫", "url": "https://www.freebuf.com/articles/web/25392.html", "time": "2014-02-11", "level": "金币+4", "num_look": 2898114, "num_comment": 61, "author": "eip_0x", "tags": ["WEB安全"], "text": "百度之原来这货以前叫小泉彩，貌似动了几个小手术换了个马甲重新出道了。你拍AV你家里知道么？。于是乎下了几个种子看了下，感觉还行（像苍老师什么的我真的没有看过哈哈），狠一点把全集全搞到百度网盘上。"}
{"title": "焦点访谈：极客为什么爱帮妹子配“装备”？", "url": "https://www.freebuf.com/news/topnews/25410.html", "time": "2014-02-10", "level": "", "num_look": 251802, "num_comment": 20, "author": "p0tt1", "tags": ["头条", "极客"], "text": ""}
{"title": "应用层DDoS攻击模拟器 - DDOSIM", "url": "https://www.freebuf.com/sectool/25426.html", "time": "2014-02-10", "level": "", "num_look": 467078, "num_comment": 12, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "网站管理软件 - AspxSpy2014 Final", "url": "https://www.freebuf.com/sectool/24815.html", "time": "2014-02-10", "level": "", "num_look": 579857, "num_comment": 45, "author": "zcgonvh", "tags": ["工具"], "text": "AspxSpy是一款可以对网站进行管理的脚本，此版本为开发版本，未进行任何加密，同时不具备免杀功能。如果没有特殊情况，AspxSpy将不再更新（可能更新插件）。如果有需要的话可以自行进行二次开发，但请保留版权。"}
{"title": "渗透测试的艺术：Root this box第二部曲", "url": "https://www.freebuf.com/articles/web/24733.html", "time": "2014-02-10", "level": "金币+8", "num_look": 542565, "num_comment": 38, "author": "secroro", "tags": ["WEB安全"], "text": "一篇很详细的渗透测试科普文章，从开始的扫描阶段、发现漏洞、上传Webshell、反弹、直到提权一整套流程都在该文中有描述，并且作者每个步骤都写的很详细，作者谨以此文纪念艰辛的web安全学习之路。"}
{"title": "Struts2最近几个漏洞分析&稳定利用Payload", "url": "https://www.freebuf.com/articles/web/25337.html", "time": "2014-02-10", "level": "金币+8", "num_look": 901182, "num_comment": 165, "author": "genxor", "tags": ["WEB安全"], "text": "看到网上关于struts2利用的文章非常多，但是对于漏洞触发跟踪分析的文档比较少，闲来无事跟踪了一下struts最近吵得比较火的两个漏洞，研究了一下能够稳定利用的payload。"}
{"title": "悄悄的干活，打枪的不要！勒索+比特币挖矿木马", "url": "https://www.freebuf.com/news/25247.html", "time": "2014-02-10", "level": "金币+8", "num_look": 230786, "num_comment": 18, "author": "嘎巴嘎巴", "tags": ["资讯"], "text": ""}
{"title": "安全知识：如何在核爆中生存下来", "url": "https://www.freebuf.com/articles/others-articles/25350.html", "time": "2014-02-09", "level": "", "num_look": 320797, "num_comment": 13, "author": "fu4k", "tags": ["其他"], "text": ""}
{"title": "FBI正在打造“恶意软件终极收藏库”", "url": "https://www.freebuf.com/news/25267.html", "time": "2014-02-08", "level": "", "num_look": 108422, "num_comment": 10, "author": "Mystery", "tags": ["资讯"], "text": ""}
{"title": "休闲一刻：一款让你目瞪口呆的创意游戏 - 画中世界", "url": "https://www.freebuf.com/news/others/25287.html", "time": "2014-02-08", "level": "金币+8", "num_look": 202576, "num_comment": 18, "author": "凌晨几度i", "tags": ["其他", "周边"], "text": ""}
{"title": "简单使用wifipineapple进行中间人劫持（MITM）", "url": "https://www.freebuf.com/articles/wireless/25165.html", "time": "2014-02-08", "level": "金币+8", "num_look": 738958, "num_comment": 23, "author": "xixuedafa", "tags": ["无线安全"], "text": ""}
{"title": "走近科学：美国大片中的黑客其实是这样编程的", "url": "https://www.freebuf.com/news/topnews/24805.html", "time": "2014-02-08", "level": "金币+8", "num_look": 547493, "num_comment": 53, "author": "foglunay", "tags": ["其他", "头条"], "text": ""}
{"title": "[安全科普]你必须了解的session的本质", "url": "https://www.freebuf.com/articles/web/24962.html", "time": "2014-02-06", "level": "", "num_look": 240938, "num_comment": 16, "author": "杰克船长", "tags": ["WEB安全"], "text": ""}
{"title": "一周海外安全事件回顾（2014.01.20–2014.02.01）", "url": "https://www.freebuf.com/news/25031.html", "time": "2014-02-05", "level": "金币+8", "num_look": 133735, "num_comment": 12, "author": "blackscreen", "tags": ["头条", "资讯"], "text": ""}
{"title": "快来了！3D全息影像通话不再是个梦", "url": "https://www.freebuf.com/geek/24785.html", "time": "2014-01-29", "level": "", "num_look": 163036, "num_comment": 11, "author": "phper", "tags": ["极客"], "text": ""}
{"title": "黑客的试驾经历：SUV“自由光”试驾之初体验", "url": "https://www.freebuf.com/geek/24713.html", "time": "2014-01-28", "level": "", "num_look": 207445, "num_comment": 17, "author": "IDF_Lab", "tags": ["极客"], "text": ""}
{"title": "漏洞检测框架-CANVAS:MOSDEF基础介绍", "url": "https://www.freebuf.com/articles/system/24685.html", "time": "2014-01-27", "level": "", "num_look": 251812, "num_comment": 8, "author": "IDF_Lab", "tags": ["系统安全"], "text": "Mini Elf Structure and generate，在IDF实验室博客曾介绍payload exec组成结构与生成方法，文章中使用Inlineegg框架来生成Mini Elf，通过linux命令和hex来理解其结构。"}
{"title": "2013海外安全事件汇总（全集）发布", "url": "https://www.freebuf.com/news/topnews/24671.html", "time": "2014-01-27", "level": "金币+8", "num_look": 150953, "num_comment": 12, "author": "blackscreen", "tags": ["头条"], "text": "包括2013年本人跟踪和收集的海外安全事件的全集，150余页，7万余字，包括近千个海外安全事件。每个安全事件均附有外媒报道的URL。在近千个安全事件中，个人总结了包括斯诺登事件、QCF、SEA黑客组织活动在内的2013年…"}
{"title": "VMWare拟15.4亿美金收购安全厂商AirWatch", "url": "https://www.freebuf.com/news/24590.html", "time": "2014-01-27", "level": "金币+5", "num_look": 141453, "num_comment": 3, "author": "pynwolf", "tags": ["资讯"], "text": "VMWare 15亿美金收购安全厂商AirWatch。AirWatch是一家移动安全厂商，成立于2003年，全球1600员工，客户来自150个国家，主要竞争对手包括Cytrix, MobileIron和FrontRange。收购看点：虚拟化和移动安全的结合。"}
{"title": "为Metasploit添加XSSF模块", "url": "https://www.freebuf.com/articles/web/24372.html", "time": "2014-01-27", "level": "", "num_look": 387234, "num_comment": 8, "author": "浩天寰宇", "tags": ["WEB安全"], "text": "在看《Metasploit渗透测试魔鬼训练营》的时候讲的XSSF模块的使用，感觉这个模块很神奇，原理虽然不知道但是觉得应该让大家的Metasploit都添加上这个模块，以备不时之需，本文目的仅仅是分享一下XSSF这个工具的安装…"}
{"title": "职业黑客自述：做得上班族，扮得007", "url": "https://www.freebuf.com/news/others/24609.html", "time": "2014-01-26", "level": "红色标题", "num_look": 359287, "num_comment": 27, "author": "fu4k", "tags": ["其他", "周边"], "text": ""}
{"title": "xss如何加载远程js的一些tips", "url": "https://www.freebuf.com/articles/web/24496.html", "time": "2014-01-26", "level": "", "num_look": 389415, "num_comment": 5, "author": "阿布", "tags": ["WEB安全"], "text": "XSS又叫CSS (Cross-Site Script) ,跨站脚本攻击。恶意攻击者往Web页面里插入恶意html代码，当用户浏览该页之时，嵌入其中Web里面的html代码会被执行，从而达到恶意用户的特殊目的。本文介绍了如何利用xss加载远程js…"}
{"title": "吐血开源，C++多协议下载引擎.", "url": "https://www.freebuf.com/sectool/23935.html", "time": "2014-01-26", "level": "", "num_look": 213489, "num_comment": 13, "author": "vscen", "tags": ["工具"], "text": ""}
{"title": "安全公司新星Aorato推出“行为防火墙”", "url": "https://www.freebuf.com/news/24546.html", "time": "2014-01-26", "level": "金币+5", "num_look": 263119, "num_comment": 14, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "[更新]网站管理软件-Chopper", "url": "https://www.freebuf.com/sectool/23014.html", "time": "2014-01-25", "level": "", "num_look": 314691, "num_comment": 23, "author": "fjhgx", "tags": ["工具"], "text": "中国菜刀，不是原来切菜做饭的道具，而是一款专业的网站管理软件，用途广泛，使用方便，小巧实用。只要支持动态脚本的网站，都可以用中国菜刀来进行管理！"}
{"title": "XSS挑战第一期Writeup", "url": "https://www.freebuf.com/articles/web/24529.html", "time": "2014-01-25", "level": "金币+5", "num_look": 364532, "num_comment": 9, "author": "0x4d", "tags": ["WEB安全"], "text": "这期XSS挑战的起因是在阅读“Modern Web Application Firewalls Fingerprinting and Bypassing XSS Filters”过后，在其中发现了一个很有趣的话题。那就是在圆括号被过滤的情况下，如何去执行javascript。"}
{"title": "DNS污染事件跟踪：为什么.cn和.org域名逃过一劫", "url": "https://www.freebuf.com/articles/network/24425.html", "time": "2014-01-24", "level": "金币+5", "num_look": 918453, "num_comment": 37, "author": "佐拉", "tags": ["网络安全"], "text": "关于中国境内用户访问.com 和.net 域名被解析到65.49.2.178 一事我又有新发现，我发现了为什么.cn 和.org 的域名没有受到影响指向65.49.2.178的原因，证明此事事故与根域名服务器无关。"}
{"title": "CrowdStrike发布年报，中国使者熊猫、俄罗斯活力熊等黑客组织皆上榜", "url": "https://www.freebuf.com/news/24419.html", "time": "2014-01-24", "level": "金币+5", "num_look": 263527, "num_comment": 14, "author": "cs24", "tags": ["资讯"], "text": "22日消息，以提倡“先行打击”对付APT而闻名的美国安全公司CrowdStrike发布“CrowdStrike全球威胁报告—2013年回顾”。报告一语惊人，再次引发媒体热炒。报告还提供了这些攻击者的其中一些流行的攻击技术和策略。"}
{"title": "新的电话拦截恶意软件-Android.HeHe", "url": "https://www.freebuf.com/articles/terminal/24352.html", "time": "2014-01-24", "level": "金币+5", "num_look": 238062, "num_comment": 18, "author": "secroro", "tags": ["终端安全"], "text": "FireEye研究实验室最近发现一个新的Android恶意软件，有六个变种，并且能窃取短信、拦截电话。所有样本一致使用相同的Activity名称，所以命名为“Android.HeHe”。该应用程序伪装成一个给用户推送系统更新的软件，名…"}
{"title": "Citrix XenApp越权访问漏洞", "url": "https://www.freebuf.com/vuls/24221.html", "time": "2014-01-24", "level": "金币+5", "num_look": 325125, "num_comment": 33, "author": "xocoder", "tags": ["漏洞"], "text": "Citrix XenApp™是一种按需应用交付解决方案，能够在数据中心对所有Windows应用实现虚拟化、集中部署和管理，并能作为一项服务、通过任何设备向所有用户交付应用。全世界共有1亿多用户使用XenApp，这充分证实了产品…"}
{"title": "两张图片告诉你为什么域名会被解析到65.49.2.178", "url": "https://www.freebuf.com/articles/network/24360.html", "time": "2014-01-23", "level": "红色标题", "num_look": 499966, "num_comment": 30, "author": "佐拉", "tags": ["网络安全"], "text": ""}
{"title": "分析一个跨平台DDOS僵尸网络", "url": "https://www.freebuf.com/articles/system/24273.html", "time": "2014-01-23", "level": "金币+5", "num_look": 532620, "num_comment": 17, "author": "Rem1x", "tags": ["系统安全", "网络安全"], "text": ""}
{"title": "3DS最新烧录卡即将支持一卡多游", "url": "https://www.freebuf.com/news/24264.html", "time": "2014-01-23", "level": "金币+5", "num_look": 167498, "num_comment": 2, "author": "LinuxSpace", "tags": ["资讯"], "text": "当去年8月份3DS能够玩顺的利用烧录卡玩DB游戏之后，一直以来烧录卡内的TF卡只能烧录一款游戏促使玩家只能买一堆的TF卡去玩各样的游戏。"}
{"title": "现代Linux操作系统的栈溢出（上）", "url": "https://www.freebuf.com/articles/system/24177.html", "time": "2014-01-23", "level": "金币+5", "num_look": 733828, "num_comment": 15, "author": "fubeerf", "tags": ["系统安全"], "text": "本文主要向读者展示栈溢出的基础知识并解释目前现代的Linux发型版本的保护机制。基于上述原因，本文选择了最新的Ubuntu（12.10）作为目标机，因为它集成了很多默认的安全机制，并且它很流行易于安装和使用。平台采…"}
{"title": "微电影：IT男为爱做黑客，无悔青春", "url": "https://www.freebuf.com/video/24253.html", "time": "2014-01-23", "level": "金币+4", "num_look": 453524, "num_comment": 66, "author": "foglunay", "tags": ["视频"], "text": ""}
{"title": "代码，变形！网络安全初创企业Shape以其人之道对付网站攻击", "url": "https://www.freebuf.com/news/24259.html", "time": "2014-01-22", "level": "", "num_look": 183801, "num_comment": 5, "author": "H3lvin", "tags": ["资讯"], "text": "一直以来，安全界都在玩一场猫捉老鼠的游戏，因为恶意软件往往会试图通过不断变形来逃避安全监测。现在，一家网络安全初创企业决定以其人之道还治其 人之身。用攻击者的关键战略之一来保护自己，对付网站攻击。"}
{"title": "科普跨站平台XSS SHELL使用方法", "url": "https://www.freebuf.com/articles/web/24114.html", "time": "2014-01-22", "level": "金币+4", "num_look": 839834, "num_comment": 29, "author": "mker", "tags": ["WEB安全"], "text": "理解xss shell是什么之前，让我们一起回顾一下一些基本的xss（跨站脚本），xss是最常见的一个漏洞，存在于今天许多的web应用程序。xss是攻击者试图通过web应用程序执行恶意脚本的技术，攻击者通过突破同源策略的web…"}
{"title": "那些年，我们一起碰到过的骗局", "url": "https://www.freebuf.com/news/24112.html", "time": "2014-01-22", "level": "金币+4", "num_look": 185784, "num_comment": 11, "author": "pynwolf", "tags": ["资讯"], "text": "现在有很多骗局案例的顺利实施足以给予那些潜在的受害者一些警示，提醒他们避免上当受骗。因此，尽管ESET的大部分业务是主要集中在恶意软件上面，我仍旧花了很多时间在WeLiveSecurity网站以及其他网站上来写这篇有…"}
{"title": "PAM后门编译安装", "url": "https://www.freebuf.com/articles/system/24104.html", "time": "2014-01-22", "level": "", "num_look": 399128, "num_comment": 4, "author": "阿布", "tags": ["系统安全"], "text": ""}
{"title": "2014年1月21日全国DNS污染始末以及分析", "url": "https://www.freebuf.com/articles/network/24180.html", "time": "2014-01-21", "level": "红色标题", "num_look": 1004305, "num_comment": 66, "author": "Ovear", "tags": ["网络安全"], "text": "大概今天15:30的时候，Ovear正在调试新的服务器，结果发现肿么突然上不去了。。结果ping了以下，结果吓尿了，Ovear的域名都指向到[65.49.2.178]这个IP。Ovear第一反应就是，尼玛DNSPOD又被黑了！"}
{"title": "继续追踪今日热点-国内互联网根域名服务器故障", "url": "https://www.freebuf.com/news/24172.html", "time": "2014-01-21", "level": "", "num_look": 185884, "num_comment": 8, "author": "h4dex", "tags": ["资讯"], "text": "2014年1月21日下午15时左右开始，全球大量互联网域名的DNS解析出现问题，一些知名网站及所有不存在的域名，均被错误的解析指向65.49.2.178。"}
{"title": "全国DNS出现大范围访问故障", "url": "https://www.freebuf.com/news/24145.html", "time": "2014-01-21", "level": "", "num_look": 142877, "num_comment": 14, "author": "smbdby", "tags": ["资讯"], "text": ""}
{"title": "气焰嚣张勒索木马：打劫你没商量", "url": "https://www.freebuf.com/news/23964.html", "time": "2014-01-21", "level": "金币+4", "num_look": 246417, "num_comment": 5, "author": "嘎巴嘎巴", "tags": ["其他", "资讯"], "text": ""}
{"title": "史上最全Linux提权后获取敏感信息方法", "url": "https://www.freebuf.com/articles/system/23993.html", "time": "2014-01-21", "level": "金币+4", "num_look": 1067170, "num_comment": 45, "author": "阿布", "tags": ["系统安全"], "text": "在本文开始之前，我想指出我不是专家。据我所知，在这个庞大的区域,没有一个“神奇”的答案.分享，共享（我的出发点）。下面是一个混合的命令做同样的事情，在不同的地方，或只是一个不同的眼光来看待事物。"}
{"title": "黑客游戏Watch Dogs：育碧蒙特利尔的互联网犯罪之城", "url": "https://www.freebuf.com/news/23805.html", "time": "2014-01-21", "level": "金币+4", "num_look": 276234, "num_comment": 28, "author": "lanlan", "tags": ["资讯"], "text": "这个游戏的世界架构和“侠盗猎车手”“虐杀原形”“上古卷轴”有些相似，开放度比较高而且套上了高科技的外衣，并且首发了PC版，感觉可玩性不错。主角是一个邋遢的程序员，主线是他复仇的故事（很老套啊）。"}
{"title": "开心一刻：潜入蓝翔技校二十天之绝密调查黑客", "url": "https://www.freebuf.com/news/others/24023.html", "time": "2014-01-20", "level": "金币+4", "num_look": 444800, "num_comment": 38, "author": "fu4k", "tags": ["其他", "周边"], "text": ""}
{"title": "无力吐槽：中国自主研发操作系统COS（含视频）", "url": "https://www.freebuf.com/news/23933.html", "time": "2014-01-20", "level": "金币+4", "num_look": 345056, "num_comment": 45, "author": "Arrow、", "tags": ["资讯"], "text": ""}
{"title": "Target全额自动清算系统7000万用户信息遭泄露", "url": "https://www.freebuf.com/news/23937.html", "time": "2014-01-20", "level": "金币+4", "num_look": 171109, "num_comment": 1, "author": "凌晨几度i", "tags": ["资讯"], "text": "Target（全称为The Trans-European Automated Real-time Gross settlement Express Transfer）即泛欧实时全额自动清算系统，为欧盟国家提供实时全额清算服务。但是最近Target宣布内部用户数据遭泄露。这将是又一起…"}
{"title": "代理上网行为检测逃脱之Proxifier快速上手", "url": "https://www.freebuf.com/sectool/23846.html", "time": "2014-01-20", "level": "金币+4", "num_look": 510113, "num_comment": 9, "author": "ovov", "tags": ["工具"], "text": "Proxifier是一款功能非常强大的socks5客户端，可以让不支持通过代理服务器工作的网络程序能通过HTTPS或SOCKS代理或代理链。支持 64位系统，支持Xp，Vista，Win7，MAC OS ,支持socks4，socks5，http代理协议。"}
{"title": "对于RootKit的一次假想渗透及防护", "url": "https://www.freebuf.com/articles/network/23665.html", "time": "2014-01-20", "level": "金币+4", "num_look": 834645, "num_comment": 22, "author": "blackshield", "tags": ["网络安全"], "text": "一直听闻FreeBuf里面大牛云集，大神级黑客数不胜数，纠结很久到底要不要露脸写一篇文章，水平有限，学术不精，只是凭在网络中打拼得来的些许经验来跟大家谈一谈Rootkit，如有勘误还望海涵并指出。"}
{"title": "FreeBuf视频组：揭秘美国国安局（NSA）神秘部门TAO（中文字幕）", "url": "https://www.freebuf.com/video/23908.html", "time": "2014-01-19", "level": "红色标题", "num_look": 274387, "num_comment": 10, "author": "FB视频", "tags": ["视频"], "text": "在美国国家安全局(NSA)内部，隐藏着一支鲜为人知的精锐黑客和间谍部队，专门刺探美国海外敌人的情报。去年，专门入侵最困难的目标、获得难以窃取的情报的TAO被曝光。相关资料显示，近年来，TAO已至少成功入侵了89个…"}
{"title": "一周海外安全事件回顾（2014.01.13 – 2014.01.18）", "url": "https://www.freebuf.com/news/topnews/23899.html", "time": "2014-01-19", "level": "金币+10", "num_look": 171938, "num_comment": 3, "author": "blackscreen", "tags": ["头条", "安全报告"], "text": "在思科最新发布的2014年度安全报告中，“客气”地指出“99%的移动恶意软件属于安卓设备”。本周笔者不想历数安卓上的恶意软件，而是由某安全事件引发，简单谈一谈安卓平台上的DDoS应用。"}
{"title": "渗透测试专用版Linux：BackBox3.13发布", "url": "https://www.freebuf.com/sectool/23746.html", "time": "2014-01-19", "level": "", "num_look": 330340, "num_comment": 36, "author": "帅气凌云", "tags": ["工具"], "text": "BackBox团队近日很高兴地宣布Linux的更新版本，版本3.13。BackBox是基于Ubuntu的Linux发行版本，它被用于网络渗透测试及安全评估。"}
{"title": "见解：驳《支付宝不安全》说", "url": "https://www.freebuf.com/articles/others-articles/23757.html", "time": "2014-01-19", "level": "红色标题", "num_look": 296447, "num_comment": 38, "author": "可耻的匿了", "tags": ["其他"], "text": "最近关于支付宝安全的话题炒的水深火热，不少电脑小白看了之后都会评论“以后再也不用支付宝了”“连安全都做不好，还搞什么支付”"}
{"title": "新年伊始，微软再遭叙利亚电子军挑衅", "url": "https://www.freebuf.com/news/23716.html", "time": "2014-01-17", "level": "金币+10", "num_look": 122665, "num_comment": 12, "author": "凌晨几度i", "tags": ["资讯"], "text": ""}
{"title": "root this box", "url": "https://www.freebuf.com/articles/web/23680.html", "time": "2014-01-17", "level": "金币+10", "num_look": 353077, "num_comment": 47, "author": "Rozero", "tags": ["WEB安全"], "text": ""}
{"title": "不容小觑的金融诈骗手段 - 419诈骗", "url": "https://www.freebuf.com/news/23575.html", "time": "2014-01-16", "level": "金币+10", "num_look": 230667, "num_comment": 11, "author": "Redo1o8SK", "tags": ["资讯"], "text": ""}
{"title": "可视化DDoS全球攻击地图", "url": "https://www.freebuf.com/articles/network/23538.html", "time": "2014-01-16", "level": "", "num_look": 1207774, "num_comment": 4, "author": "IDF_Lab", "tags": ["网络安全"], "text": ""}
{"title": "代理上网行为检测逃脱之本地路由引导+SSH隧道", "url": "https://www.freebuf.com/articles/others-articles/23616.html", "time": "2014-01-16", "level": "金币+10", "num_look": 340717, "num_comment": 28, "author": "ovov", "tags": ["其他"], "text": "相信很多公司为了限制员工上网，都会选择一些深信服的设备对用户的流量做控制，一般只会给用户普通的权限，比如只允许浏览某些网页啦，打开个优酷都会被拦截啦。本文简单介绍一个在现有只允许打开某些网站的情况的…"}
{"title": "国产Web漏洞扫描器 - 椰树1.8（大众开放版本）", "url": "https://www.freebuf.com/sectool/23630.html", "time": "2014-01-16", "level": "", "num_look": 719926, "num_comment": 29, "author": "huoquan", "tags": ["工具"], "text": ""}
{"title": "任天堂3DS游戏机烧录卡蓝屏事件", "url": "https://www.freebuf.com/news/23554.html", "time": "2014-01-16", "level": "金币+10", "num_look": 236403, "num_comment": 8, "author": "LinuxSpace", "tags": ["资讯"], "text": ""}
{"title": "Informix数据库SQL注入实战", "url": "https://www.freebuf.com/articles/web/23502.html", "time": "2014-01-16", "level": "金币+10", "num_look": 280388, "num_comment": 10, "author": "Rem1x", "tags": ["WEB安全"], "text": "Informix是IBM公司出品的关系数据库管理系统（RDBMS）家族。作为一个集成解决方案，它被定位为作为IBM在线事务处理（OLTP）旗舰级数据服务系统，该文介绍了Informix数据库的SQL注入案例。"}
{"title": "QQ申诉那点事", "url": "https://www.freebuf.com/articles/network/23516.html", "time": "2014-01-15", "level": "金币+10", "num_look": 1175541, "num_comment": 22, "author": "Mr.m", "tags": ["网络安全"], "text": "这算是一篇扯蛋的文章，也可以说是一个申诉漏洞的总结。以下案例都是我自己亲自试验的。绝无虚假之处，（可能有些地方会夸张把~）"}
{"title": "黑客组织1775 Sec声称攻破苹果用户数据库", "url": "https://www.freebuf.com/news/23595.html", "time": "2014-01-15", "level": "金币+10", "num_look": 193269, "num_comment": 3, "author": "Mystery", "tags": ["资讯"], "text": "声称对最近一次Dropbox宕机时间负责的黑客组织1775 Sec，再次在Twitter宣布了成功攻破苹果数据库的消息——尽管目前看来没有敏感的客户信息被其收集到。"}
{"title": "DNS信息探测工具 - DNSRecon v0.8.6", "url": "https://www.freebuf.com/sectool/23551.html", "time": "2014-01-15", "level": "", "num_look": 297002, "num_comment": 5, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "[更新]基于GPU的HASH破解工具 - oclHashcat v1.0.1", "url": "https://www.freebuf.com/sectool/23416.html", "time": "2014-01-15", "level": "", "num_look": 318472, "num_comment": 16, "author": "hxdef_tiffany", "tags": ["工具"], "text": "oclHashcat-plus是目前最快的md5、phppass、mscash2和wpa/wpa2破解工具，也是世界上唯一一个有基于GPGPU引 擎的破解工具。用十几兆的字典破MSSQL密码，真的是秒破…。"}
{"title": "渗透测试中的冷却启动攻击和其他取证技术", "url": "https://www.freebuf.com/articles/system/23409.html", "time": "2014-01-15", "level": "", "num_look": 240149, "num_comment": 12, "author": "IDF_Lab", "tags": ["系统安全"], "text": ""}
{"title": "互联网世界的毒瘤——僵尸网络", "url": "https://www.freebuf.com/articles/network/23395.html", "time": "2014-01-15", "level": "", "num_look": 584051, "num_comment": 3, "author": "IDF_Lab", "tags": ["网络安全"], "text": "从世界上第一个蠕虫病毒————莫里斯————因其巨大的系统破坏力和传播速度被人们所关注，便意味着在恶意代码斗争的战场上传播速度势必成为新的衍变方式。"}
{"title": "XPath Hacking技术科普", "url": "https://www.freebuf.com/articles/web/23184.html", "time": "2014-01-14", "level": "金币+10", "num_look": 437868, "num_comment": 11, "author": "白河·愁", "tags": ["WEB安全"], "text": "Xpath1.0是一种被很好支持和相当老的在XML文档中选择节点并返回计算后的值的查询语言。大量的编程语言，包括Java、C/C++、Python、C#、JavaScript、Perl等都拥有自购丰富的库支持Xpath1.0"}
{"title": "[细节剖析]X Windows中一个22年的漏洞", "url": "https://www.freebuf.com/vuls/23174.html", "time": "2014-01-14", "level": "金币+10", "num_look": 298190, "num_comment": 20, "author": "fubeerf", "tags": ["其他", "漏洞"], "text": "X Windows系统，今天作为世界各地的Linux桌面，已经存在超过20年了，仍然存在Bug。几天前Sysadmins为libXfont库提供了补丁，来对应新发现的已经在代码中存在了22年的特权升级漏洞，补丁抢在了让人厌烦的exploit前发…"}
{"title": "自制分布式漏洞扫描工具", "url": "https://www.freebuf.com/articles/web/23402.html", "time": "2014-01-13", "level": "金币+10", "num_look": 907052, "num_comment": 34, "author": "TMaMba", "tags": ["WEB安全"], "text": "在渗透测试和安全扫描工作中，发现越来越多站点部署了应用防护系统或异常流量监控系统，其中包括：WEB应用防火墙（软件WAF、硬件WAF、云WAF）、入侵检测系统、入侵防御系统、访问监控系统等。很多防护系统不仅可实…"}
{"title": "关于口令强度等级的设计", "url": "https://www.freebuf.com/articles/others-articles/23383.html", "time": "2014-01-13", "level": "", "num_look": 274386, "num_comment": 14, "author": "IDF_Lab", "tags": ["其他", "系统安全"], "text": ""}
{"title": "窥探用户隐私的幕后之眼 - Web Bugs", "url": "https://www.freebuf.com/articles/web/23079.html", "time": "2014-01-13", "level": "金币+10", "num_look": 326019, "num_comment": 6, "author": "lanlan", "tags": ["WEB安全"], "text": "其实我在翻译这篇文章之前，觉得这可能是一种基于客户端脚本的技术，类似于xss，但是通过翻译了解到，通常web bugs都是由客服务端脚本编写的，比起一些黑客那它来进行入侵，更多的是官方在用户不知情的情况下使用we…"}
{"title": "浅谈webshell检测方法", "url": "https://www.freebuf.com/articles/web/23358.html", "time": "2014-01-13", "level": "金币+10", "num_look": 1462620, "num_comment": 77, "author": "携程安全中心", "tags": ["WEB安全"], "text": "webshell中由于需要完成一些特殊的功能就不可避免的用到一些特殊的函数，我们也就可以对着特征值做检查来定位webshell，同样的webshell本身也会进行加密来躲避这种检测。"}
{"title": "法国出售给阿联酋的卫星可能含有后门组件", "url": "https://www.freebuf.com/news/23296.html", "time": "2014-01-13", "level": "金币+10", "num_look": 103817, "num_comment": 2, "author": "pynwolf", "tags": ["资讯"], "text": ""}
{"title": "路由器再度躺枪：主流厂商设备中被发现后门", "url": "https://www.freebuf.com/news/23158.html", "time": "2014-01-13", "level": "金币+10", "num_look": 222145, "num_comment": 15, "author": "lanlan", "tags": ["漏洞", "资讯"], "text": "路由器中存在后门已经不是什么新鲜事了，我们曾经在主流路由器中发现了很多固件的缺陷，现在我们发现Netgear 和 Linksys 所生产的路由器中也包含相同的问题。法国黑客Eloi Vanderbeken在主流路由器如Netgear, Links…"}
{"title": "一周海外安全事件回顾（2014.01.06 – 2014.01.11）", "url": "https://www.freebuf.com/news/topnews/23307.html", "time": "2014-01-12", "level": "金币+10", "num_look": 262478, "num_comment": 9, "author": "blackscreen", "tags": ["头条"], "text": "本周的焦点，毫无疑问是“PhantomL0rd”和“DERP”，以及合伙炮制的针对包括EA、暴雪等大型游戏公司在内的DDoS攻击。随着事件及其背后动因不断地被挖掘和曝光，我们看到的则是与当初设想完全不同的、一个令人震惊的“秘…"}
{"title": "黑客是如何通过RDP远程桌面服务进行攻击的", "url": "https://www.freebuf.com/articles/system/23211.html", "time": "2014-01-12", "level": "金币+10", "num_look": 555473, "num_comment": 11, "author": "Rem1x", "tags": ["系统安全"], "text": ""}
{"title": "美国警长给妻子电脑安装键盘记录器遭判刑", "url": "https://www.freebuf.com/news/23136.html", "time": "2014-01-11", "level": "金币+10", "num_look": 131753, "num_comment": 16, "author": "凌晨几度i", "tags": ["资讯"], "text": "去年也就是2013年4月22日，美国西维吉尼亚州Clay县的Miles J. Slack做了一个愚蠢的决定。当时他即将离婚，他对妻子和某个人的关系愈发感到忧心忡忡。所以他在正常工作时间进入了妻子的办公场所，找到了她用的个人电…"}
{"title": "dropbox遭匿名者黑客攻击停止服务", "url": "https://www.freebuf.com/news/23219.html", "time": "2014-01-11", "level": "", "num_look": 262390, "num_comment": 6, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "[科普]渗透神器Kali安装使用手册", "url": "https://www.freebuf.com/articles/system/23018.html", "time": "2014-01-10", "level": "", "num_look": 1422154, "num_comment": 45, "author": "雨凉", "tags": ["系统安全"], "text": "Kali是BackTrackLinux完全遵循Debian开发标准彻底的完全重建，全新的目录框架，复查并打包所有工具，如此强大，你准备好了吗"}
{"title": "360招聘网络安全攻防技术研究员", "url": "https://www.freebuf.com/jobs/23049.html", "time": "2014-01-10", "level": "", "num_look": 268144, "num_comment": 25, "author": "cnhacks", "tags": ["安全招聘"], "text": "奇虎360由周鸿祎创立于2005年9月，主营以360安全卫士、360杀毒为代表的免费网络安全平台，同时拥有奇虎问答等独立业务，董事长是周鸿祎。公司主要依靠在线广告及互联网增值业务创收。"}
{"title": "黑客利用时间同步服务DDoS攻击EA等大型游戏网站", "url": "https://www.freebuf.com/news/23125.html", "time": "2014-01-10", "level": "金币+5", "num_look": 251361, "num_comment": 16, "author": "phper", "tags": ["资讯"], "text": ""}
{"title": "Hijack攻击揭秘", "url": "https://www.freebuf.com/articles/web/22999.html", "time": "2014-01-10", "level": "金币+5", "num_look": 409295, "num_comment": 9, "author": "lanlan", "tags": ["WEB安全"], "text": ""}
{"title": "绿盟科技杭州招聘安全工程师", "url": "https://www.freebuf.com/jobs/22986.html", "time": "2014-01-09", "level": "", "num_look": 298023, "num_comment": 27, "author": "wtcsu", "tags": ["安全招聘"], "text": ""}
{"title": "从攻击MS SQL Server到获得系统访问权限", "url": "https://www.freebuf.com/articles/database/22997.html", "time": "2014-01-09", "level": "金币+5", "num_look": 1318927, "num_comment": 31, "author": "pynwolf", "tags": ["数据安全"], "text": "当谈及SQL服务器，几乎所有的系统管理员和数据库管理员都会同意这样一个观点：管理员并不都有设置复杂密码的意识。看起来这或许方便技术支持人员进行简单故障排除，但却过低评估了它的风险性。"}
{"title": "黑客利用USB设备入侵ATM取款机", "url": "https://www.freebuf.com/news/22990.html", "time": "2014-01-08", "level": "金币+5", "num_look": 285325, "num_comment": 16, "author": "Redo1o8SK", "tags": ["资讯"], "text": ""}
{"title": "SSL安全扫描器 - SSLyze", "url": "https://www.freebuf.com/sectool/22984.html", "time": "2014-01-08", "level": "", "num_look": 431509, "num_comment": 8, "author": "H3lvin", "tags": ["工具"], "text": ""}
{"title": "Windows崩溃报告存漏洞，收集的信息或被截获利用", "url": "https://www.freebuf.com/news/22908.html", "time": "2014-01-08", "level": "金币+5", "num_look": 141676, "num_comment": 11, "author": "Mystery", "tags": ["资讯"], "text": "安全研究小组Websense已经发表了其研究的初步结果，强调了Windows\"崩溃报告系统\"所包含的信息和漏洞，有很大的可能会被黑客截获并利用。Windows会通过Dr.Watson服务，进行错误报告的收集和发送工作。"}
{"title": "地下论坛惊见全新档案加密勒索软件PowerLocker", "url": "https://www.freebuf.com/news/22940.html", "time": "2014-01-07", "level": "", "num_look": 173578, "num_comment": 11, "author": "H3lvin", "tags": ["资讯"], "text": "根据最近几星期追踪该安全威胁的安全研究团队指出，某恶意软件开发团队正準备销售能加密受感染电脑上的档案，并要求受害者付赎金好让档恢复正常的全新勒索软件。"}
{"title": "揭秘：中国黑市出售日本银行账号的故事", "url": "https://www.freebuf.com/news/22692.html", "time": "2014-01-07", "level": "红色标题", "num_look": 667314, "num_comment": 29, "author": "general.x", "tags": ["头条", "资讯"], "text": "日本警视厅高官指出：“非法银行账号和网络犯罪之前存在千丝万缕的联系，我们即使用尽招数也不能全部破案。我们现在加强了对来日留学人员的教育，告诉他们当前紧迫的局势，以免被卷入不必要的麻烦。”"}
{"title": "漫谈：黑客，NSA与自由软件", "url": "https://www.freebuf.com/news/topnews/22730.html", "time": "2014-01-07", "level": "金币+5", "num_look": 390829, "num_comment": 17, "author": "citypw", "tags": ["头条", "观点"], "text": "MIT，这个曾经是20世纪黑客的起源地，许多计算机和生物黑客都是在那里成长的，这样的一个黑客心目中的圣地却对Aaron Swartz作出了过分的事情，虽然Aaron离开我们快1年了，但这样的黑客我们不应该忘记他。"}
{"title": "针对工行诈骗黑产团伙的调查回忆录", "url": "https://www.freebuf.com/articles/others-articles/22664.html", "time": "2014-01-07", "level": "", "num_look": 350928, "num_comment": 65, "author": "Evi1m0", "tags": ["其他"], "text": ""}
{"title": "站争：代号1937（番外话-我们网络之间的战争）", "url": "https://www.freebuf.com/articles/others-articles/22035.html", "time": "2014-01-06", "level": "", "num_look": 174943, "num_comment": 11, "author": "4n0wGZ", "tags": ["其他"], "text": ""}
{"title": "时光旅行者利用Twitter发布未来消息？研究员从社交网站找踪跡", "url": "https://www.freebuf.com/news/22886.html", "time": "2014-01-06", "level": "", "num_look": 187026, "num_comment": 37, "author": "H3lvin", "tags": ["资讯"], "text": "美国密西根理工大学的研究人员，最近试图在网络搜寻任何可能从未来回到现在，参与我们生活的时光旅行者的踪跡。他们将研究结果发表在一篇名为「从网路寻找时光旅行证据」的论文中。"}
{"title": "Java编写敏感文件扫描工具", "url": "https://www.freebuf.com/articles/web/22882.html", "time": "2014-01-06", "level": "", "num_look": 277009, "num_comment": 7, "author": "暗影-孤独雪狼", "tags": ["WEB安全"], "text": ""}
{"title": "一周海外安全事件回顾（2013.12.30 – 2014.01.04）", "url": "https://www.freebuf.com/news/topnews/22817.html", "time": "2014-01-06", "level": "金币+5", "num_look": 182976, "num_comment": 11, "author": "blackscreen", "tags": ["头条"], "text": "世人的眼光尽被NSA的“百宝箱”吸引过去，人们惊讶地看到TAO的工具包堪比多啦A梦的口袋。然而，本人认为，在本周更让人感兴趣的是社会化媒体的“沦陷”。"}
{"title": "走近数字保镖Steve", "url": "https://www.freebuf.com/news/22745.html", "time": "2014-01-06", "level": "金币+5", "num_look": 108775, "num_comment": 6, "author": "pynwolf", "tags": ["资讯"], "text": ""}
{"title": "2014年的网络空间：全方位预测", "url": "https://www.freebuf.com/articles/others-articles/22300.html", "time": "2014-01-06", "level": "金币+11", "num_look": 216456, "num_comment": 8, "author": "general.x", "tags": ["其他", "观点"], "text": "黑客、黑客主义、网络战士等词贯穿了2013年的网络空间，同时也将毫无疑问的引领2014年的潮流。本文通过总结7家知名安全研究机构专家的分析结果，客观地为大家展示2014年网络空间的发展趋势。"}
{"title": "Windows的ASLR绕过技巧：利用未经允许执行的插件实现", "url": "https://www.freebuf.com/articles/system/22533.html", "time": "2014-01-06", "level": "金币+11", "num_look": 242597, "num_comment": 4, "author": "fubeerf", "tags": ["系统安全"], "text": "SLR（Address space layout randomization）是一种针对缓冲区溢出的安全保护技术，通过对堆、栈、共享库映射等线性区布局的随机化，通过增加攻击者预测目的地址的难度，防止攻击者直接定位攻击代码位置，达到阻止溢…"}
{"title": "2013年度五大高级攻击事件", "url": "https://www.freebuf.com/news/22138.html", "time": "2014-01-05", "level": "", "num_look": 123228, "num_comment": 5, "author": "maxcoco", "tags": ["资讯"], "text": ""}
{"title": "关于Snapchat应用被黑客攻击事件", "url": "https://www.freebuf.com/news/22593.html", "time": "2014-01-05", "level": "", "num_look": 115486, "num_comment": 1, "author": "Evi1m0", "tags": ["资讯"], "text": ""}
{"title": "反向收费：一个人是怎样利用您桌上的电脑电话进行诈骗的", "url": "https://www.freebuf.com/news/22610.html", "time": "2014-01-05", "level": "", "num_look": 141835, "num_comment": 5, "author": "凌晨几度i", "tags": ["资讯"], "text": ""}
{"title": "白帽子路人甲：写在新年的开始，致敬我的小伙伴们", "url": "https://www.freebuf.com/articles/others-articles/22625.html", "time": "2014-01-04", "level": "", "num_look": 341785, "num_comment": 26, "author": "路人甲", "tags": ["其他", "观点"], "text": ""}
{"title": "创业：黑客小队CageTest推在线网络安全渗透测试平台", "url": "https://www.freebuf.com/news/22614.html", "time": "2014-01-04", "level": "", "num_look": 328729, "num_comment": 31, "author": "fu4k", "tags": ["资讯"], "text": ""}
{"title": "揭秘美国国安局（NSA）的利剑：获取特定情报行动办公室TAO", "url": "https://www.freebuf.com/news/others/22451.html", "time": "2014-01-04", "level": "金币+11", "num_look": 275587, "num_comment": 9, "author": "lanlan", "tags": ["其他", "周边"], "text": "江湖传闻，美国国安局NSA中的TAO机构一直是中情局中的一个秘密武器。他们无所不能，秘密渗透到世界各地的计算机。甚至拦截正在运输的的电子设备，并在其中植入后门。"}
{"title": "Android渗透测试工具包 - Bugtroid", "url": "https://www.freebuf.com/sectool/22520.html", "time": "2014-01-03", "level": "", "num_look": 482063, "num_comment": 26, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "[推广]去哪儿网安全应急响应中心（QSRC）上线啦", "url": "https://www.freebuf.com/news/22509.html", "time": "2014-01-03", "level": "", "num_look": 178832, "num_comment": 15, "author": "gyreg", "tags": ["资讯"], "text": ""}
{"title": "关于企业员工存在的安全风险的一些看法", "url": "https://www.freebuf.com/articles/network/22351.html", "time": "2014-01-03", "level": "金币+11", "num_look": 333666, "num_comment": 5, "author": "litdg", "tags": ["网络安全"], "text": "人是安全管理中最大的安全隐患。不记得这句话从哪里看到的了。不过我们经常会看到类似于从一个司机邮箱渗透到企业重要系统的案例，越来越热的apt攻击也选择人作为突破口。比如针对Google的极光攻击就是因为一个员工…"}
{"title": "[FreeBuf年度巨献]2014网站攻击生存手册", "url": "https://www.freebuf.com/news/topnews/22426.html", "time": "2014-01-03", "level": "红色标题", "num_look": 342389, "num_comment": 36, "author": "FB独家", "tags": ["头条"], "text": ""}
{"title": "微软64位计算器栈溢出分析", "url": "https://www.freebuf.com/articles/system/22183.html", "time": "2014-01-03", "level": "金币+11", "num_look": 303868, "num_comment": 22, "author": "fubeerf", "tags": ["系统安全"], "text": ""}
{"title": "免费代理工具-Proxy King", "url": "https://www.freebuf.com/sectool/22136.html", "time": "2014-01-02", "level": "", "num_look": 553108, "num_comment": 42, "author": "ip77", "tags": ["工具"], "text": "Proxy King 是一款支持指定进程代理的软件,可以帮助用户隐藏本机上网ip.无需用户自备代理,软件有云端内置几千个可用的Socks5代理。可以用来刷投票\\突破网络限制\\隐藏本机IP、同时还有虚拟硬件序列号功能。"}
{"title": "站争：代号1937［第六节：美女？特工？（中）］", "url": "https://www.freebuf.com/articles/others-articles/22190.html", "time": "2014-01-02", "level": "", "num_look": 201649, "num_comment": 19, "author": "4n0wGZ", "tags": ["其他"], "text": "小说以后会将以“虚拟，虚构”来声明，同时会授权给FreeBuf黑客与极客独家首发权利。"}
{"title": "2013德国混沌通信大会资料下载", "url": "https://www.freebuf.com/news/others/22250.html", "time": "2014-01-02", "level": "", "num_look": 173868, "num_comment": 10, "author": "xxFBI", "tags": ["其他", "周边"], "text": ""}
{"title": "轻松一刻：2013年度黑客漫画", "url": "https://www.freebuf.com/news/others/22370.html", "time": "2014-01-02", "level": "红色标题", "num_look": 296075, "num_comment": 18, "author": "general.x", "tags": ["其他", "周边"], "text": ""}
{"title": "ModSecurity SQL注入攻击 - 深度绕过技术挑战", "url": "https://www.freebuf.com/articles/web/22041.html", "time": "2014-01-02", "level": "金币+11", "num_look": 673085, "num_comment": 30, "author": "LittleHann", "tags": ["WEB安全", "数据安全"], "text": "ModSecurity是一个入侵探测与阻止的引擎，它主要是用于Web应用程序所以也可以叫做Web应用程序防火墙.它可以作为Apache Web服务器的一个模块或单独的应用程序来运行。本文主要介绍了针对开源WAF的一次渗透测试比赛中…"}
{"title": "Skimmer中的巨无霸：ATM整机伪造", "url": "https://www.freebuf.com/news/22092.html", "time": "2014-01-02", "level": "", "num_look": 168544, "num_comment": 8, "author": "lanlan", "tags": ["资讯"], "text": ""}
{"title": "460万Snapchat用户电话数据泄漏", "url": "https://www.freebuf.com/news/22286.html", "time": "2014-01-02", "level": "", "num_look": 136330, "num_comment": 6, "author": "zer0sum", "tags": ["资讯"], "text": "上周有安全专家称找到了 Snapchat 的漏洞，而如今，在官方给出解决办法前，一家名为 SnapchatDB! 的网站已经对漏洞加以利用，并且开始提供包含有用户信息的 SQL / CSV 文件了。据悉这次泄漏波及了「大部份」Snapcha…"}
{"title": "2013十大安全事件", "url": "https://www.freebuf.com/news/22002.html", "time": "2014-01-01", "level": "", "num_look": 158748, "num_comment": 9, "author": "lanlan", "tags": ["资讯"], "text": "一个针对用户的4000万借记卡和信用卡的攻击，在几周前的圣诞节被曝光，这在美国用户中引起了轩然大波。商家称消费者的认证和信用记录一直是被密切关注的问题。然而现实与互联网用户仍没有普遍的使用双重验证机制。"}
{"title": "FreeBuf2014贺岁视频: 极客教你如何劫持无人机", "url": "https://www.freebuf.com/video/22160.html", "time": "2013-12-31", "level": "红色标题", "num_look": 455317, "num_comment": 38, "author": "FB视频", "tags": ["视频"], "text": "无人驾驶飞机是一种以无线电遥控或由自身程序控制为主的不载人 飞机。最早用于军用。在大家对Amazon等公司的无人机送货吵得火热的时候，已经有极客开始研究怎么黑掉无人机了。Samy就制作了一个无人机劫持软件，并给…"}
{"title": "最热的前100的Android应用程序已被黑客入侵", "url": "https://www.freebuf.com/news/22087.html", "time": "2013-12-31", "level": "", "num_look": 225771, "num_comment": 5, "author": "Rem1x", "tags": ["资讯"], "text": "根据报告，智能手机现在已经成为网络犯罪分子的严重目标， 现在的黑客专门针对金融应用程序，如那些Android的银行应用程序的53％已被破解，而iOS应用是23％。"}
{"title": "美国国安局（NSA）工具库大揭秘", "url": "https://www.freebuf.com/news/22073.html", "time": "2013-12-31", "level": "金币+11", "num_look": 1130596, "num_comment": 37, "author": "cs24", "tags": ["头条", "资讯"], "text": "12月30日，德国《明镜周刊》发表题为《Shopping for Spy Gear: Catalog Advertises NSA Toolbox》的文章，揭秘NSA工具库已经攻破全球首屈一指的网络设备供应商、电脑供应商的安全防御设备或电子产品。"}
{"title": "利用声学密码分析攻击破译4096位RSA加密算法", "url": "https://www.freebuf.com/news/21862.html", "time": "2013-12-31", "level": "金币+11", "num_look": 672446, "num_comment": 14, "author": "pynwolf", "tags": ["网络安全", "资讯"], "text": ""}
{"title": "站争：代号1937［第五节：美女？特工？上］", "url": "https://www.freebuf.com/articles/others-articles/21887.html", "time": "2013-12-30", "level": "", "num_look": 192067, "num_comment": 21, "author": "4n0wGZ", "tags": ["其他"], "text": ""}
{"title": "巴基斯坦遭受诱惑性文档+Office 0day漏洞的APT攻击", "url": "https://www.freebuf.com/news/21632.html", "time": "2013-12-30", "level": "金币+11", "num_look": 389447, "num_comment": 19, "author": "lanlan", "tags": ["WEB安全", "资讯"], "text": "日前，国外安全公司发现利用微软office漏洞的定向APT攻击，在攻击中使用了ROP和ActiveX controls进行堆喷射攻击，目标主要是巴基斯坦情报局或巴基斯坦军方等，本文详细介绍了该攻击的过程以及使用的手法。"}
{"title": "教你怎样关闭Windows的摄像头指示灯（含视频）", "url": "https://www.freebuf.com/articles/system/21706.html", "time": "2013-12-30", "level": "金币+11", "num_look": 1429691, "num_comment": 31, "author": "litdg", "tags": ["极客", "系统安全"], "text": ""}
{"title": "源代码公开测试-关于天蝎座报毒的真相", "url": "https://www.freebuf.com/news/others/21919.html", "time": "2013-12-30", "level": "", "num_look": 298034, "num_comment": 39, "author": "p0tt1", "tags": ["其他", "周边"], "text": ""}
{"title": "WAF指纹探测及识别技术", "url": "https://www.freebuf.com/articles/web/21744.html", "time": "2013-12-30", "level": "金币+11", "num_look": 764587, "num_comment": 4, "author": "白河·愁", "tags": ["WEB安全"], "text": "利用国际上公认的一种说法：Web应用防火墙是通过执行一系列针对HTTP/HTTPS的安全策略来专门为Web应用提供保护的一款产品。本文介绍了常见的WAF指纹识别的一些技术。"}
{"title": "CVE-2013-3918漏洞分析及分析流程翻译", "url": "https://www.freebuf.com/vuls/21647.html", "time": "2013-12-30", "level": "金币+11", "num_look": 262008, "num_comment": 1, "author": "vscen", "tags": ["漏洞", "系统安全"], "text": "CVE-2013-3918是由于Internet Explorer 7, 8, 9, 10的ActiveX控件中存在内存访问错误，攻击者可利用此漏洞在当前登录用户上下文中执行任意代码。"}
{"title": "快播科技招聘漏洞挖掘、渗透工程师", "url": "https://www.freebuf.com/jobs/21724.html", "time": "2013-12-30", "level": "红色标题", "num_look": 418680, "num_comment": 15, "author": "风兮水痕", "tags": ["安全招聘"], "text": "深圳市快播科技有限公司是中国领先的流媒体应用及娱乐软件开发商和服务供应商。我们致力研究娱乐产业的数字化技术，使得内容的制作、存储及传输变得更容易、快捷。现面向社会招聘渗透测试、漏洞挖掘工程师。"}
{"title": "2013年有超过1400家金融机构被针对性木马攻击", "url": "https://www.freebuf.com/news/21161.html", "time": "2013-12-30", "level": "金币+5", "num_look": 119768, "num_comment": 2, "author": "嘎巴嘎巴", "tags": ["资讯"], "text": ""}
{"title": "一周海外安全事件回顾（12.23 – 12.28）", "url": "https://www.freebuf.com/news/topnews/21841.html", "time": "2013-12-30", "level": "金币+5", "num_look": 229957, "num_comment": 2, "author": "blackscreen", "tags": ["头条", "安全报告"], "text": "斯诺登不是耶稣，但是同样以自己承受苦难换来世人的觉醒。12月25日，英国“第四频道”电视台播放了斯诺登对全人类的一段圣诞祝词视频。与其说是祝词，不如说是对全人类的警示和对某些群体的劝诫。"}
{"title": "Java编写代理服务器(Burp拦截Demo)一", "url": "https://www.freebuf.com/articles/web/21832.html", "time": "2013-12-29", "level": "", "num_look": 496796, "num_comment": 8, "author": "暗影-微笑", "tags": ["WEB安全"], "text": ""}
{"title": "新兴开源扫描器Golismero插件编写-TestingPlugin插件编写（二）", "url": "https://www.freebuf.com/sectool/21752.html", "time": "2013-12-27", "level": "", "num_look": 285267, "num_comment": 285267, "author": "jekkay", "tags": ["其他", "工具"], "text": "Golismero是一款开源的Web扫描器，它不但自带不少的安全测试工具，而且还可导入分析市面流行的扫描工具的结果，比如Openvas,Wfuzz, SQLMap, DNS recon等，并自动分析。Golismero采用插件形式的框架结构，由纯python…"}
{"title": "CEH认证（道德骇客）学习文档下载", "url": "https://www.freebuf.com/articles/others-articles/21605.html", "time": "2013-12-27", "level": "", "num_look": 619553, "num_comment": 24, "author": "xiao_hen", "tags": ["其他"], "text": ""}
{"title": "[抛砖引玉]无处不在的输入点", "url": "https://www.freebuf.com/articles/web/21439.html", "time": "2013-12-27", "level": "金币+5", "num_look": 251600, "num_comment": 14, "author": "litdg", "tags": ["WEB安全"], "text": ""}
{"title": "走近科学：破解苹果MacBook摄像头进行秘密监控", "url": "https://www.freebuf.com/news/21579.html", "time": "2013-12-26", "level": "金币+5", "num_look": 495535, "num_comment": 17, "author": "lanlan", "tags": ["头条", "终端安全"], "text": ""}
{"title": "开源Web应用防火墙（WAF）- ModSecurity v2.7发布", "url": "https://www.freebuf.com/sectool/21385.html", "time": "2013-12-26", "level": "", "num_look": 274380, "num_comment": 18, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "ossec入侵检测日志行为分析", "url": "https://www.freebuf.com/articles/system/21383.html", "time": "2013-12-26", "level": "金币+5", "num_look": 911858, "num_comment": 22, "author": "Rozero", "tags": ["系统安全"], "text": ""}
{"title": "Firefox Crash 0Day分析", "url": "https://www.freebuf.com/vuls/21330.html", "time": "2013-12-26", "level": "", "num_look": 210462, "num_comment": 6, "author": "vscen", "tags": ["漏洞"], "text": ""}
{"title": "定位系统那些事儿", "url": "https://www.freebuf.com/articles/wireless/21519.html", "time": "2013-12-25", "level": "金币+5", "num_look": 745131, "num_comment": 16, "author": "nooper", "tags": ["无线安全"], "text": "LBS随着移动互联网的火热而在近年成为一个火热的概念，其本义是基于位置的服务，而如何定位位置成为LBS中的基本，本篇文章即意在概述下关于定位系统的那些事儿！"}
{"title": "burpsuite_pro_v1.5.20破解版下载", "url": "https://www.freebuf.com/sectool/21446.html", "time": "2013-12-25", "level": "金币+5", "num_look": 1012998, "num_comment": 28, "author": "litdg", "tags": ["工具"], "text": "Burp Suite是一个Web应用程序集成渗透测试平台，它包含了一系列burp工具，这些工具之间有大量接口可以互相通信。平台中所有工具共享同一robust框架，以便统一处理HTTP请求，持久性，认证，上游代理，日志记录，报警…"}
{"title": "国产WEB漏洞扫描器 - 北极熊扫描器", "url": "https://www.freebuf.com/sectool/21350.html", "time": "2013-12-25", "level": "", "num_look": 1377197, "num_comment": 54, "author": "hyc66", "tags": ["工具"], "text": "北极熊扫描器是一款简单的WEB扫描器，包含常见的扫描功能，以及指纹识别，识别常见的CMS并提供渗透方案，本软件还具备的一个特色功能是“熊眼扫描”，能够获取管理后台，提供自动化FTP弱口令破解和SQL弱口令破解，字…"}
{"title": "斯诺登盟友阿贝尔鲍姆声称他在柏林的公寓被入侵", "url": "https://www.freebuf.com/news/21245.html", "time": "2013-12-25", "level": "金币+5", "num_look": 132127, "num_comment": 7, "author": "Rem1x", "tags": ["资讯"], "text": ""}
{"title": "[抛砖引玉]maltego调用nmap进行端口扫描", "url": "https://www.freebuf.com/sectool/21015.html", "time": "2013-12-25", "level": "", "num_look": 358904, "num_comment": 14, "author": "中国公民", "tags": ["工具"], "text": ""}
{"title": "密码重置漏洞那点事儿", "url": "https://www.freebuf.com/articles/web/21214.html", "time": "2013-12-25", "level": "金币+5", "num_look": 342984, "num_comment": 14, "author": "lanlan", "tags": ["WEB安全"], "text": "密码重置功能是一些常见漏洞的起因。例如用户名枚举漏洞（数据库中用户名不存在和密码错误显示不同的错误信息），敏感信息泄露重置密码消息劫持这些都是在密码重置功能中比较常见的漏洞。"}
{"title": "OWASP杭州沙龙“金融&移动安全”纪实", "url": "https://www.freebuf.com/news/topnews/21046.html", "time": "2013-12-25", "level": "", "num_look": 155541, "num_comment": 4, "author": "FB独家", "tags": ["头条"], "text": "上周五（11月27日）杭州举行主题为“金融&移动安全”的沙龙会议，Freebuf作为OWASP中国的合作媒体带来了现场直播（@黑客与极客Live）。虽然选的周五，但来的人还是出乎意料的多，挤满了整个会议厅，后门也站着一群热…"}
{"title": "解放军少将谈中国网络空间未来发展", "url": "https://www.freebuf.com/articles/others-articles/20899.html", "time": "2013-12-25", "level": "", "num_look": 177639, "num_comment": 10, "author": "general.x", "tags": ["其他", "观点"], "text": ""}
{"title": "分享Python编写的网站组件指纹扫描工具.", "url": "https://www.freebuf.com/sectool/21114.html", "time": "2013-12-24", "level": "", "num_look": 286347, "num_comment": 9, "author": "vscen", "tags": ["工具"], "text": ""}
{"title": "圣诞趣闻：NSA—放开那女孩儿！", "url": "https://www.freebuf.com/news/21225.html", "time": "2013-12-24", "level": "金币+5", "num_look": 149222, "num_comment": 11, "author": "general.x", "tags": ["资讯"], "text": "NSA连过圣诞节的孩子们都不放过！在圣诞节来临之际，献上圣诞趣闻一篇，主角当然离不开今年谍战片男一号NSA。祝大家平安夜快乐，圣诞节开心！NSA连过圣诞节幼童们都不放过！充满正义感的我只想大吼一声“放开那女孩…"}
{"title": "OpenSUSE折腾小记", "url": "https://www.freebuf.com/news/others/21009.html", "time": "2013-12-24", "level": "", "num_look": 222746, "num_comment": 6, "author": "dig2dick", "tags": ["周边", "终端安全"], "text": ""}
{"title": "[汇总]2013年度全球重、特大网络安全事件回顾", "url": "https://www.freebuf.com/news/20859.html", "time": "2013-12-24", "level": "金币+5", "num_look": 197238, "num_comment": 8, "author": "general.x", "tags": ["资讯"], "text": ""}
{"title": "RSA否认曾在加密算法中添加后门", "url": "https://www.freebuf.com/news/21083.html", "time": "2013-12-24", "level": "", "num_look": 116284, "num_comment": 4, "author": "Mystery", "tags": ["资讯"], "text": "美国安全服务商RSA今天在官方博客中发表文章，“完全否认”了近期路透社有关该公司与美国国家安全局(NSA)合作，在加密算法中添加后门的报道。两名知情人士称，RSA收受了1000万美元，将NSA提供的方程式设定为BSafe安全…"}
{"title": "2014密码时代已死？六种旨在取代传统密码位置的新奇想法", "url": "https://www.freebuf.com/news/20948.html", "time": "2013-12-23", "level": "金币+5", "num_look": 141365, "num_comment": 15, "author": "pynwolf", "tags": ["资讯"], "text": "今年早些时候，Adobe公司遭受数据泄露产生的的毁灭性破坏凸显出了这样一个事实现状：我们大多数人讨厌密码，而且我们中的很多人真的是非常非常的懒。"}
{"title": "2013黑帽大会：失控 – 针对工业SCADA系统的漏洞利用（三）", "url": "https://www.freebuf.com/articles/system/20920.html", "time": "2013-12-23", "level": "金币+5", "num_look": 253997, "num_comment": 13, "author": "fubeerf", "tags": ["工控安全", "系统安全"], "text": "工业协议被设计成轻量级的并提供控制器和终端之间合理的确定性通信。安全作为协议设计后才考虑到甚至一点儿都没有考虑。简单的串行协议例如Modbus和DNP3是可以通过IP头进行封装，然后通过因特网发送。"}
{"title": "微软修复GDI+ 0day，关注ASLR绕过补丁", "url": "https://www.freebuf.com/news/20963.html", "time": "2013-12-23", "level": "金币+5", "num_look": 199360, "num_comment": 12, "author": "maxcoco", "tags": ["资讯"], "text": ""}
{"title": "剖析：一次入侵Linux服务器的事件记录", "url": "https://www.freebuf.com/articles/system/20830.html", "time": "2013-12-22", "level": "金币+5", "num_look": 368013, "num_comment": 7, "author": "Rem1x", "tags": ["系统安全"], "text": "最近，我注意到多个IP地址试图利用一个PHP漏洞攻击，所以我利用蜜罐记录了结果，此次活动让人想起早期僵尸网络疯狂的日子，用IRC命令控制，以及利用被入侵的主机作为扫描工具。"}
{"title": "一周海外安全事件回顾（12.16 – 12.21）", "url": "https://www.freebuf.com/news/topnews/21005.html", "time": "2013-12-22", "level": "金币+5", "num_look": 172968, "num_comment": 9, "author": "blackscreen", "tags": ["头条"], "text": "毫无疑问，本周最大的安全事件是：NSA只花了1千万美金就买走了一个企业的道德。据路透社报道，NSA曾与加密技术公司RSA达成了1000万美元的协议，将NSA提供留有后门的方程式设定为BSafe安全软件的优先或默认随机数生…"}
{"title": "2014年黑客题材电影：《超验骇客》全长预告片", "url": "https://www.freebuf.com/news/others/20885.html", "time": "2013-12-21", "level": "金币+5", "num_look": 256326, "num_comment": 16, "author": "fu4k", "tags": ["其他", "周边"], "text": ""}
{"title": "2013年度最为重大的网络攻击", "url": "https://www.freebuf.com/news/20807.html", "time": "2013-12-21", "level": "", "num_look": 327250, "num_comment": 9, "author": "blackscreen", "tags": ["网络安全", "资讯"], "text": ""}
{"title": "\"熊猫烧香\"作者出狱后开网络赌场获利800万受审", "url": "https://www.freebuf.com/news/20787.html", "time": "2013-12-20", "level": "红色标题", "num_look": 318851, "num_comment": 42, "author": "李天一", "tags": ["资讯"], "text": "曾因制造并传播“熊猫烧香”病毒而引发社会关注的张顺和李俊在丽水再次“出山”，伙同多人开设网络赌场。昨天，丽水市莲都区人民法院一审公开审理了这一案件。"}
{"title": "全能型反汇编引擎 - Capstone-Engine", "url": "https://www.freebuf.com/sectool/20512.html", "time": "2013-12-20", "level": "", "num_look": 528763, "num_comment": 20, "author": "小C", "tags": ["工具"], "text": "Capstone是一个轻量级的多平台多架构支持的反汇编框架。支持包括ARM，ARM64，MIPS和x86/x64平台，目前Capstone提供了如Python/Go/C#/Java等语言的支持，有较好的可扩展性。"}
{"title": "Liftoh木马钓鱼邮件正在进行时", "url": "https://www.freebuf.com/news/20545.html", "time": "2013-12-20", "level": "", "num_look": 213965, "num_comment": 9, "author": "cs24", "tags": ["资讯"], "text": "12月中，Dell安全团队分析一起最近正在发生的钓鱼邮件。该钓鱼邮件利用“UPS投递通知”为名，向用户安装Liftoh恶意软件。虽然国内少有使用UPS，但是在国外使用UPS为题材的钓鱼邮件并不少见。"}
{"title": "走近黑客Paunch与其所控制的地下黑客帝国", "url": "https://www.freebuf.com/news/others/20682.html", "time": "2013-12-19", "level": "金币+15", "num_look": 272632, "num_comment": 14, "author": "lanlan", "tags": ["其他", "周边"], "text": "在10月初，就有俄罗斯小道消息声称，当局已经逮捕并起诉了 Blackhole exploit kit的主要开发者和散布者 paunch。目前俄罗斯警方和计算机安全领域专家公开了对于paunch的更多细节，并逐渐揭开了paunch的地下黑客帝国…"}
{"title": "NFC协议安全工具-NFCGUI 1.5 Pro版发布", "url": "https://www.freebuf.com/sectool/20728.html", "time": "2013-12-19", "level": "", "num_look": 860592, "num_comment": 10, "author": "radiowar", "tags": ["工具", "极客"], "text": "NFCGUI是由RadioWar开发的一款图形化NFC协议安全分析工具，整体程序基于libnfc完成。考虑到NFCGUI这个想法是我们饭后娱乐而生，所以发布的版本功能有所限制，并且也因为某些“游戏规则”故不发布带有Crack功能版本。"}
{"title": "用Android平板与RaspberryPi配置便携物理渗透设备（Pwn Pad & PwnPi）", "url": "https://www.freebuf.com/articles/terminal/20011.html", "time": "2013-12-19", "level": "金币+15", "num_look": 983220, "num_comment": 55, "author": "FallenSec", "tags": ["极客", "终端安全"], "text": ""}
{"title": "某恶意样本绕过驱动防火墙机制分析学习", "url": "https://www.freebuf.com/articles/system/20491.html", "time": "2013-12-19", "level": "", "num_look": 201474, "num_comment": 12, "author": "翰海源安全", "tags": ["系统安全"], "text": "恶意样本b0005是针对网吧发起攻击的程序。现在网吧中的防护软件，多为网维大师。网维大师具有更新游戏、重启还原等功能。由于网维大师对驱动的防护是通过白名单来实现的，白名单中对驱动才会被放行允许加载。"}
{"title": "视频：美国总统奥巴马号召全民学编程", "url": "https://www.freebuf.com/video/20494.html", "time": "2013-12-19", "level": "红色标题", "num_look": 299170, "num_comment": 23, "author": "FB视频", "tags": ["视频"], "text": ""}
{"title": "2013黑帽大会：失控 – 针对工业SCADA系统的漏洞利用（二）", "url": "https://www.freebuf.com/articles/system/20328.html", "time": "2013-12-18", "level": "金币+15", "num_look": 215727, "num_comment": 17, "author": "fubeerf", "tags": ["系统安全"], "text": ""}
{"title": "人民银行惨遭国外矿工DDOS攻击", "url": "https://www.freebuf.com/news/20509.html", "time": "2013-12-18", "level": "红色标题", "num_look": 273131, "num_comment": 32, "author": "blackjam", "tags": ["资讯"], "text": ""}
{"title": "上海翼火蛇安全公司招聘渗透攻城狮", "url": "https://www.freebuf.com/jobs/20519.html", "time": "2013-12-18", "level": "", "num_look": 222770, "num_comment": 19, "author": "翼火蛇信息安全公司", "tags": ["安全招聘"], "text": ""}
{"title": "NSA：中国制造的BIOS病毒可远程摧毁计算机", "url": "https://www.freebuf.com/news/20475.html", "time": "2013-12-18", "level": "", "num_look": 226330, "num_comment": 26, "author": "phper", "tags": ["资讯"], "text": ""}
{"title": "无线网络嗅探分析工具 - CommView for WiFi 7.0", "url": "https://www.freebuf.com/sectool/20462.html", "time": "2013-12-18", "level": "", "num_look": 886787, "num_comment": 21, "author": "fu4k", "tags": ["工具"], "text": ""}
{"title": "[安全科普]SSRF攻击实例解析", "url": "https://www.freebuf.com/articles/web/20407.html", "time": "2013-12-18", "level": "金币+15", "num_look": 2834563, "num_comment": 33, "author": "litdg", "tags": ["WEB安全"], "text": "很多web应用都提供了从其他的服务器上获取数据的功能。使用用户指定的URL，应用可以获取图片，下载文件等。这个功能如果被恶意使用，可以利用存在缺陷的web应用作为代理攻击远程和本地的服务器。这种形式的攻击称为…"}
{"title": "CVE-2013-3897样本分析学习笔记", "url": "https://www.freebuf.com/vuls/20364.html", "time": "2013-12-17", "level": "", "num_look": 271030, "num_comment": 7, "author": "翰海源安全", "tags": ["漏洞"], "text": "该样本攻击对象为韩国和日本的WinXP IE8用户，利用了IE8的CDisplayPointer对象的一个Use-After-Free漏洞，利用DEPS HeapSpray技术进行堆喷射，通过msvcrt.dll构造ROP链绕过DEP进行利用。"}
{"title": "XSS现代WAF规则探测及绕过技术", "url": "https://www.freebuf.com/articles/web/20282.html", "time": "2013-12-17", "level": "金币+15", "num_look": 1335230, "num_comment": 25, "author": "白河·愁", "tags": ["WEB安全"], "text": ""}
{"title": "物理攻击？那些年我们忽略掉的一些社会工程学手段", "url": "https://www.freebuf.com/news/others/20291.html", "time": "2013-12-17", "level": "金币+15", "num_look": 498357, "num_comment": 50, "author": "p0tt1", "tags": ["其他", "周边"], "text": ""}
{"title": "赛门铁克发布2014年安全趋势，大数据、云等均上榜", "url": "https://www.freebuf.com/news/20298.html", "time": "2013-12-16", "level": "", "num_look": 136753, "num_comment": 10, "author": "h0x4r", "tags": ["资讯"], "text": ""}
{"title": "国外成功使用电视棒接收玉兔登陆信号", "url": "https://www.freebuf.com/geek/20260.html", "time": "2013-12-16", "level": "金币+5", "num_look": 429477, "num_comment": 32, "author": "maxcoco", "tags": ["极客"], "text": "昨天嫦娥三号飞船及玉兔登录器成功登陆月球。我从UTC18:30开始追踪这个信号直到22:30，我在窗口所接收到的玉兔的信号在1Hz频宽上超过了15dB。在月球大概-0.6Hz/s多普勒效应下，登录器的频率是8462.08000MHz。"}
{"title": "巴西银行爆严重漏洞，可查看其他客户余额", "url": "https://www.freebuf.com/news/20254.html", "time": "2013-12-16", "level": "", "num_look": 126500, "num_comment": 5, "author": "lock", "tags": ["资讯"], "text": "日前，据国外媒体zdnet报道，巴西最大的银行巴西银行(Banco Do Brasil)爆出一个严重漏洞，用户可以看到其他用户账户的余额信息，该漏洞存在于该银行的iOS和Android客户端应用上面。"}
{"title": "2013黑帽大会：失控 - 针对工业SCADA系统的漏洞利用（一）", "url": "https://www.freebuf.com/articles/system/20077.html", "time": "2013-12-16", "level": "金币+5", "num_look": 275265, "num_comment": 20, "author": "fubeerf", "tags": ["系统安全"], "text": "标准的SCADA网络由多个层构成的，层与层之间形成了关键系统间的隔离，除此之外，通常能够在其业务网段发现更有危害的网络传输。SCADA网络可以采用多种传输手段来实现远程现场设备和控制网络的通信。"}
{"title": "上海全位招募渗透测试工程师", "url": "https://www.freebuf.com/jobs/20258.html", "time": "2013-12-16", "level": "", "num_look": 326816, "num_comment": 70, "author": "全位科技", "tags": ["安全招聘"], "text": "上海全位信息技术有限公司是一家专业致力于互联网信息安全行业的企业，注册资本1000万元，公司拥有强大的技术团队。现根据业务需要特别招募英才，望有识之士加盟。"}
{"title": "一周海外安全事件回顾（12.09 – 12.14）", "url": "https://www.freebuf.com/news/topnews/20230.html", "time": "2013-12-16", "level": "金币+5", "num_look": 164254, "num_comment": 5, "author": "blackscreen", "tags": ["头条", "安全报告"], "text": "在2010年震网病毒（Stuxnet）被安全研究人员意外发现之后，一个旨在针对伊朗核设施的“邪恶”的网络攻击计划浮出水面，也预示着高持续性威胁（APT，Advanced Persistent Threat）从此成为安全界的焦点。这个震网病毒…"}
{"title": "入侵美国国家实验室盗卖超级计算机资源的黑客被判处18个月监禁", "url": "https://www.freebuf.com/news/20061.html", "time": "2013-12-13", "level": "", "num_look": 132955, "num_comment": 6, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "走近科学：针对高端职业扑克玩家的定向攻击", "url": "https://www.freebuf.com/news/19956.html", "time": "2013-12-13", "level": "金币+5", "num_look": 267486, "num_comment": 12, "author": "litdg", "tags": ["其他", "头条"], "text": ""}
{"title": "FireEye：数字面包屑 - 识别APT攻击来源的7大线索", "url": "https://www.freebuf.com/articles/network/19999.html", "time": "2013-12-12", "level": "", "num_look": 379363, "num_comment": 15, "author": "IceArmour", "tags": ["网络安全"], "text": "在现今网络威胁的情势下，找出敌人是任何防御计划的关键要点。保护资料与财产的关键步骤，在于找出谁是攻击者、他们的运作方式，以及他们的目的。安全公司FireEye 追踪将近 1,500 件攻击活动所组成的样本，描述下列…"}
{"title": "悲剧！美黑客DDos攻击一分钟，赔偿183000美元", "url": "https://www.freebuf.com/news/19968.html", "time": "2013-12-12", "level": "", "num_look": 203216, "num_comment": 31, "author": "fu4k", "tags": ["资讯"], "text": ""}
{"title": "黑客小说：一尘相思一层灰（一）", "url": "https://www.freebuf.com/news/others/19943.html", "time": "2013-12-12", "level": "", "num_look": 244691, "num_comment": 31, "author": "非黑即白", "tags": ["其他", "周边"], "text": ""}
{"title": "Freebuf诚招团队成员（2016.10.18）", "url": "https://www.freebuf.com/jobs/3335.html", "time": "2013-12-12", "level": "红色标题", "num_look": 984014, "num_comment": 120, "author": "FB客服", "tags": ["安全招聘"], "text": ""}
{"title": "WPS 2012/2013 RTF fchars 堆溢出漏洞分析", "url": "https://www.freebuf.com/vuls/19902.html", "time": "2013-12-12", "level": "", "num_look": 208813, "num_comment": 9, "author": "翰海源安全", "tags": ["漏洞"], "text": ""}
{"title": "恶意软件伪装成IIS模块加载，多数防毒产品免杀", "url": "https://www.freebuf.com/articles/web/19798.html", "time": "2013-12-12", "level": "金币+5", "num_look": 300711, "num_comment": 12, "author": "LittleHann", "tags": ["WEB安全"], "text": "最近，国外安全公司发现了一些以DLL动态链接库形式存在的IIS模块存在恶意风险，这些恶意模块之所以受关注，很大原因是因为它们能躲过目前几乎所有的反病毒产品，攻击者借助这些模块发送恶意POST数据包，并遵循恰当…"}
{"title": "湖南高阳通联招聘渗透测试工程师", "url": "https://www.freebuf.com/jobs/19705.html", "time": "2013-12-11", "level": "", "num_look": 241728, "num_comment": 23, "author": "gytl", "tags": ["安全招聘"], "text": "湖南高阳通联信息技术有限公司，是香港上市公司——高阳科技（中国）有限公司（股票代码：HK0818）旗下的全资子公司。高阳通联作为“中国移动全网手机支付”项目的运营支撑公司，诚聘计算机、电子商务、理工科等相关专…"}
{"title": "NoSQL数据库(如MongoDB)自动攻击测试工具 - NOSQLMap", "url": "https://www.freebuf.com/sectool/19698.html", "time": "2013-12-11", "level": "", "num_look": 422071, "num_comment": 6, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "轻松一刻：神秘大黑客Helen究竟是不是“中国匿名者（Anonymous）”", "url": "https://www.freebuf.com/articles/others-articles/19774.html", "time": "2013-12-11", "level": "金币+5", "num_look": 2566213, "num_comment": 178, "author": "4n0wGZ", "tags": ["其他"], "text": ""}
{"title": "OWASP杭州“金融&移动安全”专题论坛", "url": "https://www.freebuf.com/news/19796.html", "time": "2013-12-11", "level": "", "num_look": 157105, "num_comment": 7, "author": "无心喃呢", "tags": ["其他", "周边"], "text": ""}
{"title": "深度：关于社会工程学攻击的一次探索（下）", "url": "https://www.freebuf.com/articles/others-articles/19731.html", "time": "2013-12-11", "level": "", "num_look": 243345, "num_comment": 10, "author": "嘎巴嘎巴", "tags": ["其他"], "text": ""}
{"title": "美国核武器发射密码居然是：00000000", "url": "https://www.freebuf.com/news/19745.html", "time": "2013-12-11", "level": "", "num_look": 256109, "num_comment": 22, "author": "phper", "tags": ["资讯"], "text": ""}
{"title": "魔兽世界遭英美监控", "url": "https://www.freebuf.com/news/19744.html", "time": "2013-12-10", "level": "", "num_look": 125336, "num_comment": 13, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "FireEye：中国黑客攻击欧盟外交部，钓鱼邮件中含裸照", "url": "https://www.freebuf.com/news/19736.html", "time": "2013-12-10", "level": "红色标题", "num_look": 231566, "num_comment": 14, "author": "fly", "tags": ["资讯"], "text": ""}
{"title": "跨协议通信技术利用", "url": "https://www.freebuf.com/articles/web/19622.html", "time": "2013-12-10", "level": "金币+6", "num_look": 356469, "num_comment": 16, "author": "litdg", "tags": ["WEB安全"], "text": "跨协议通信技术(Inter-Protocol Communication)是指两种不同的协议可以交换指令和数据的技术。其中一种称为目标协议，另外一种称为载体协议。目标协议就是我们最终想要通信的协议，而载体协议是用来封装我们最后想…"}
{"title": "安全科普：浅谈沙盒防御APT攻击", "url": "https://www.freebuf.com/articles/network/19503.html", "time": "2013-12-10", "level": "", "num_look": 478160, "num_comment": 49, "author": "ziwen", "tags": ["网络安全"], "text": "最近很多中小型甚至是大型企业都遭受到了很多的APT攻击 并导致机密数据泄漏或服务器权限被黑客获取等。我们要把这种无耻的商业竞争掐死在萌芽中。"}
{"title": "担心软件绑病毒？快关到沙盒里去 - Sandboxie", "url": "https://www.freebuf.com/sectool/19693.html", "time": "2013-12-10", "level": "", "num_look": 244325, "num_comment": 20, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "使用Node.js抓取sebug漏洞目录", "url": "https://www.freebuf.com/articles/web/19685.html", "time": "2013-12-10", "level": "", "num_look": 256767, "num_comment": 11, "author": "ChiChou", "tags": ["WEB安全"], "text": ""}
{"title": "（海外版）你需要修改密码吗？", "url": "https://www.freebuf.com/news/19413.html", "time": "2013-12-10", "level": "", "num_look": 152254, "num_comment": 13, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "如何安全的迁移和维护云服务", "url": "https://www.freebuf.com/articles/others-articles/19627.html", "time": "2013-12-09", "level": "", "num_look": 177312, "num_comment": 6, "author": "Mystery", "tags": ["其他"], "text": ""}
{"title": "渗透测试实战案例：艺帆CMS漏洞分析和官网测试", "url": "https://www.freebuf.com/articles/web/19612.html", "time": "2013-12-09", "level": "", "num_look": 519271, "num_comment": 30, "author": "p0tt1", "tags": ["WEB安全"], "text": ""}
{"title": "世界第一个XSS攻击蠕虫的原理", "url": "https://www.freebuf.com/articles/web/19408.html", "time": "2013-12-09", "level": "金币+6", "num_look": 492178, "num_comment": 17, "author": "Scoundrels", "tags": ["WEB安全"], "text": ""}
{"title": "一周海外安全事件回顾（12.02 – 12.07）", "url": "https://www.freebuf.com/news/topnews/19533.html", "time": "2013-12-09", "level": "金币+6", "num_look": 211000, "num_comment": 6, "author": "blackscreen", "tags": ["头条", "安全报告"], "text": "在Malwarebytes.org发布2013威胁报告中，研究人员认为诸如勒索软件之类的网络诈骗愈演愈烈。同时，drive-by exploits（路过式漏洞攻击） 和 watering hole attack（水坑攻击）的风起云涌成为2013年安全威胁的焦点。"}
{"title": "视频：详解比特币的原理和运行机制", "url": "https://www.freebuf.com/video/19471.html", "time": "2013-12-09", "level": "红色标题", "num_look": 789655, "num_comment": 21, "author": "FB视频", "tags": ["视频"], "text": "投资本是仁者见仁的事儿，与其跟风或者凑热闹，不如多花点时间学习、研究比特币的原理和运行机制，理解去中心化自由货币的思想，做出自己的判断，这是更有意义的。\r\n下面就是FreeBuf为您精心制作的干货视频：《详解…"}
{"title": "深度：震网病毒的秘密（三）", "url": "https://www.freebuf.com/news/19439.html", "time": "2013-12-09", "level": "金币+6", "num_look": 388119, "num_comment": 9, "author": "fubeerf", "tags": ["头条", "资讯"], "text": "相传在2010年的夏天，当震网病毒破坏了Natanz工厂后，由于控制软件存在一个bug，在对该软件进行升级时，震网病毒便由此从核工厂向外界扩散开来。虽然那是个美妙的传说，但不可能是真的。"}
{"title": "[实战]PHP邮件注入攻击技术", "url": "https://www.freebuf.com/articles/web/14918.html", "time": "2013-12-09", "level": "金币+10", "num_look": 397645, "num_comment": 17, "author": "LittleHann", "tags": ["WEB安全"], "text": "如今,互联网的使用急剧上升,但绝大多数互联网用户没有安全知识背景。大多数的人都会使用互联网通过邮件Email的方式和他人进行通信。不幸的是,大多数web开发人员对安全编码没有足够的认识。"}
{"title": "深度：震网病毒的秘密（二）", "url": "https://www.freebuf.com/news/19199.html", "time": "2013-12-06", "level": "金币+10", "num_look": 411398, "num_comment": 10, "author": "fubeerf", "tags": ["资讯"], "text": "的震网病毒变种（译者注：“简单功能”版），与原始版完全不一样（译者注：“复杂功能”），与震网病毒原始版相比，它更简单且缺少隐蔽性。震网病毒的“简单功能”版用来攻击Natanz工厂中的离心机的驱动系统，该驱动系统…"}
{"title": "新兴开源扫描器Golismero插件编写-UI插件编写", "url": "https://www.freebuf.com/sectool/19380.html", "time": "2013-12-06", "level": "金币+10", "num_look": 314662, "num_comment": 22, "author": "jekkay", "tags": ["工具"], "text": "Golismero是一款开源的Web扫描器，它不但自带不少的安全测试工具，而且还可导入分析市面流行的扫描工具的结果，比如Openvas,Wfuzz, SQLMap, DNS recon等，并自动分析。"}
{"title": "深度：关于社会工程学攻击的一次探索（上）", "url": "https://www.freebuf.com/articles/others-articles/19306.html", "time": "2013-12-06", "level": "金币+10", "num_look": 586771, "num_comment": 30, "author": "嘎巴嘎巴", "tags": ["其他"], "text": ""}
{"title": "全色彩3D 打印来了！3D Systems 发布全球第一款连续彩色塑料打印机ProJet 4500", "url": "https://www.freebuf.com/geek/19344.html", "time": "2013-12-06", "level": "", "num_look": 153968, "num_comment": 10, "author": "leo", "tags": ["极客"], "text": ""}
{"title": "《一个路径牵出连环血案》之四“你好，高富帅”（连载）", "url": "https://www.freebuf.com/news/others/19139.html", "time": "2013-12-05", "level": "", "num_look": 300431, "num_comment": 27, "author": "小土鸡", "tags": ["WEB安全", "其他"], "text": ""}
{"title": "揭秘：Skype摒弃TOM携手光明方正的背后", "url": "https://www.freebuf.com/news/19230.html", "time": "2013-12-05", "level": "红色标题", "num_look": 253364, "num_comment": 10, "author": "子夏", "tags": ["资讯"], "text": ""}
{"title": "黑了PS4！PS4越狱0day利用程序公布（含越狱指南）", "url": "https://www.freebuf.com/news/19257.html", "time": "2013-12-04", "level": "", "num_look": 314012, "num_comment": 12, "author": "phper", "tags": ["漏洞", "资讯"], "text": ""}
{"title": "Linux下文件完整性监控工具Tripwire详解", "url": "https://www.freebuf.com/articles/system/19208.html", "time": "2013-12-04", "level": "", "num_look": 542785, "num_comment": 7, "author": "moss", "tags": ["系统安全"], "text": ""}
{"title": "一种利用听不见的声音通信的恶意程序", "url": "https://www.freebuf.com/news/19189.html", "time": "2013-12-04", "level": "", "num_look": 150915, "num_comment": 21, "author": "力宏", "tags": ["资讯"], "text": ""}
{"title": "Dlink发布补丁修复旧路由器漏洞", "url": "https://www.freebuf.com/news/19183.html", "time": "2013-12-04", "level": "", "num_look": 147810, "num_comment": 5, "author": "h0x3r", "tags": ["资讯"], "text": ""}
{"title": "中国电力科学研究院招渗透测试工程师", "url": "https://www.freebuf.com/jobs/19112.html", "time": "2013-12-03", "level": "", "num_look": 290312, "num_comment": 39, "author": "kindsjay", "tags": ["安全招聘"], "text": ""}
{"title": "朝鲜电脑自定义快捷键：Ctrl+J自动输入“金正日”", "url": "https://www.freebuf.com/news/19123.html", "time": "2013-12-03", "level": "", "num_look": 139437, "num_comment": 18, "author": "阿布", "tags": ["资讯"], "text": ""}
{"title": "互联网领域中隐私与数据安全的信任重建", "url": "https://www.freebuf.com/news/19079.html", "time": "2013-12-03", "level": "", "num_look": 139715, "num_comment": 1, "author": "general.x", "tags": ["资讯"], "text": "本文中德国国际安全事务研究所欧盟对外关系部副主任 Annegret·Bendiek和马歇尔基金项目研究员Tim·Ridout就10月美国国家安全局监听事件曝光以来欧洲各国及巴西的反应进行了评论。他们认为，此次事件将对全球经济大环…"}
{"title": "利用WPS 2012/2013 0day针对中国政府部门的定向攻击", "url": "https://www.freebuf.com/vuls/19098.html", "time": "2013-12-03", "level": "", "num_look": 387269, "num_comment": 30, "author": "翰海源安全", "tags": ["漏洞", "网络安全"], "text": ""}
{"title": "《一个路径牵出连环血案》之三“向玩webshell的黑客钓鱼”（连载）", "url": "https://www.freebuf.com/articles/web/18841.html", "time": "2013-12-03", "level": "", "num_look": 280378, "num_comment": 17, "author": "小土鸡", "tags": ["WEB安全"], "text": ""}
{"title": "深度：震网病毒的秘密（一）", "url": "https://www.freebuf.com/articles/system/19059.html", "time": "2013-12-03", "level": "金币+10", "num_look": 1659412, "num_comment": 24, "author": "fubeerf", "tags": ["系统安全"], "text": "看到litdg翻译的《震网的秘密兄弟（一）》,感觉有些地方跟我想象的不一样，所以在litdg兄的基础上就行了更新，我是搞工业自动化的，恰巧阴差阳错的跟信息安全有了些交集，所以以ICS（工业控制系统）的视角，来阐述…"}
{"title": "一周海外安全事件回顾（11.25 – 11.30）", "url": "https://www.freebuf.com/news/topnews/19044.html", "time": "2013-12-02", "level": "金币+10", "num_look": 150285, "num_comment": 12, "author": "blackscreen", "tags": ["头条"], "text": "如果有媒体采访NSA此时此刻的心情，我猜NSA最想说的可能就是：“斯诺登，你他妈有完没完啊！？”"}
{"title": "揭秘国内IDC商家那点小把戏", "url": "https://www.freebuf.com/articles/others-articles/18956.html", "time": "2013-12-02", "level": "金币+10", "num_look": 224980, "num_comment": 25, "author": "Flyfish", "tags": ["其他"], "text": ""}
{"title": "自动化攻击测试平台Cobalt Strike 1.48破解版", "url": "https://www.freebuf.com/sectool/18888.html", "time": "2013-12-02", "level": "", "num_look": 375504, "num_comment": 37, "author": "legendsec", "tags": ["工具"], "text": ""}
{"title": "PlayStation 4", "url": "https://www.freebuf.com/news/18927.html", "time": "2013-12-02", "level": "", "num_look": 125129, "num_comment": 4, "author": "LinuxSpace", "tags": ["资讯"], "text": ""}
{"title": "补丁上的漏洞：微软NDProxy.sys内核漏洞金山毒霸防御绕过（视频）", "url": "https://www.freebuf.com/vuls/18856.html", "time": "2013-11-30", "level": "", "num_look": 198317, "num_comment": 17, "author": "leifeng", "tags": ["漏洞"], "text": ""}
{"title": "一款针对Tomcat服务器的Java蠕虫在全球蔓延", "url": "https://www.freebuf.com/articles/web/18832.html", "time": "2013-11-29", "level": "金币+10", "num_look": 276896, "num_comment": 21, "author": "litdg", "tags": ["WEB安全", "系统安全"], "text": ""}
{"title": "说说无线路由器后门的那些事儿（1）-Dlink篇", "url": "https://www.freebuf.com/articles/wireless/18810.html", "time": "2013-11-29", "level": "金币+10", "num_look": 1046597, "num_comment": 12, "author": "gamehacker", "tags": ["无线安全", "终端安全"], "text": ""}
{"title": "DNS记录引起的内网ip泄露", "url": "https://www.freebuf.com/news/18602.html", "time": "2013-11-29", "level": "", "num_look": 274933, "num_comment": 25, "author": "litdg", "tags": ["资讯"], "text": ""}
{"title": "新加坡的反击：入侵总理网站的两名黑客被捕", "url": "https://www.freebuf.com/news/18801.html", "time": "2013-11-29", "level": "红色标题", "num_look": 318653, "num_comment": 22, "author": "lock", "tags": ["资讯"], "text": "日前，据法新社报道，在前段时间入侵新加坡总理李显龙网站的两名匿名黑客被捕，这两名黑客是一对老少搭档，分别是十七岁和四十二岁，面临着他们的是罚款8000美元以上以及3年有期徒刑，还有狱中的力士肥皂。"}
{"title": "Web网站敏感目录/内容探测工具 - Cansina", "url": "https://www.freebuf.com/sectool/18772.html", "time": "2013-11-29", "level": "红色标题", "num_look": 1118339, "num_comment": 29, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "联众游戏招聘WEB安全工程师", "url": "https://www.freebuf.com/jobs/18691.html", "time": "2013-11-28", "level": "", "num_look": 148833, "num_comment": 14, "author": "solyuan", "tags": ["安全招聘"], "text": ""}
{"title": "《一个路径牵出连环血案》之二“被黑真相”（连载）", "url": "https://www.freebuf.com/articles/web/18686.html", "time": "2013-11-28", "level": "", "num_look": 204545, "num_comment": 13, "author": "小土鸡", "tags": ["WEB安全"], "text": ""}
{"title": "丝绸之路创始人与比特币创始人中本聪有财务往来", "url": "https://www.freebuf.com/news/18607.html", "time": "2013-11-28", "level": "", "num_look": 251752, "num_comment": 12, "author": "JohnChu", "tags": ["资讯"], "text": ""}
{"title": "RadioWar定制版Proxmark3第二批团购预订", "url": "https://www.freebuf.com/geek/18678.html", "time": "2013-11-28", "level": "", "num_look": 227363, "num_comment": 11, "author": "radiowar", "tags": ["极客"], "text": ""}
{"title": "OWASP Xenotix XSS漏洞利用测试框架v4.5发布", "url": "https://www.freebuf.com/sectool/18061.html", "time": "2013-11-28", "level": "", "num_look": 246890, "num_comment": 12, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "《一个路径牵出连环血案》之一“诡异的请求”（连载）", "url": "https://www.freebuf.com/articles/web/18597.html", "time": "2013-11-27", "level": "金币+10", "num_look": 251106, "num_comment": 28, "author": "小土鸡", "tags": ["WEB安全"], "text": ""}
{"title": "视频：黑客组织Anonymous致全体美国公民的一封信（FreeBuf视频组出品）", "url": "https://www.freebuf.com/video/18487.html", "time": "2013-11-27", "level": "红色标题", "num_look": 335922, "num_comment": 26, "author": "FB视频", "tags": ["视频"], "text": "全美第一的黑客组织Anonymous（匿名者）近日发布视频，号召美国人民于11月5号集会游行，反对政府的专制和暴政。Anonymous希望全体美国公民团结一心，不为一个组织，而为一种思想。"}
{"title": "我走了，青春留给北京", "url": "https://www.freebuf.com/articles/others-articles/18568.html", "time": "2013-11-27", "level": "", "num_look": 527984, "num_comment": 73, "author": "IceArmour", "tags": ["其他"], "text": "有时候，就算知道这次出台一定用不到笔记本，但还是毅然决然的背上——因为这是工程师的尊严。"}
{"title": "FBI新加5个大名单，10W美刀通缉黑客", "url": "https://www.freebuf.com/news/18219.html", "time": "2013-11-27", "level": "金币+10", "num_look": 280371, "num_comment": 19, "author": "maxcoco", "tags": ["资讯"], "text": ""}
{"title": "Intel芯片存在后门，即使关机也可被入侵", "url": "https://www.freebuf.com/news/18550.html", "time": "2013-11-27", "level": "红色标题", "num_look": 609164, "num_comment": 34, "author": "blackrat", "tags": ["资讯"], "text": ""}
{"title": "burpsuite_pro_v1.5.18 破解版", "url": "https://www.freebuf.com/sectool/18483.html", "time": "2013-11-27", "level": "", "num_look": 1589521, "num_comment": 63, "author": "BinAry", "tags": ["工具"], "text": ""}
{"title": "跨域资源共享(CORS)安全性浅析", "url": "https://www.freebuf.com/articles/web/18493.html", "time": "2013-11-27", "level": "金币+10", "num_look": 970038, "num_comment": 8, "author": "litdg", "tags": ["WEB安全"], "text": ""}
{"title": "震网的秘密兄弟（一）", "url": "https://www.freebuf.com/articles/system/18197.html", "time": "2013-11-26", "level": "金币+10", "num_look": 421197, "num_comment": 20, "author": "litdg", "tags": ["系统安全"], "text": ""}
{"title": "关于分析Cobalt Strike的beacon.dll的一些TIPS", "url": "https://www.freebuf.com/articles/system/18404.html", "time": "2013-11-26", "level": "金币+10", "num_look": 432250, "num_comment": 16, "author": "Moriarty", "tags": ["系统安全"], "text": ""}
{"title": "Gmail爆重置任意账户密码漏洞", "url": "https://www.freebuf.com/news/18450.html", "time": "2013-11-26", "level": "", "num_look": 213658, "num_comment": 27, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "NSA的恶意程序感染了五万个区域网络", "url": "https://www.freebuf.com/news/18392.html", "time": "2013-11-25", "level": "", "num_look": 145782, "num_comment": 6, "author": "嘎巴嘎巴", "tags": ["资讯"], "text": ""}
{"title": "一周海外安全事件回顾（11.17–11.22）", "url": "https://www.freebuf.com/news/18376.html", "time": "2013-11-25", "level": "", "num_look": 200573, "num_comment": 12, "author": "blackscreen", "tags": ["头条", "资讯"], "text": ""}
{"title": "关于", "url": "https://www.freebuf.com/articles/system/18180.html", "time": "2013-11-25", "level": "金币+10", "num_look": 348470, "num_comment": 12, "author": "Moriarty", "tags": ["系统安全"], "text": ""}
{"title": "走进科学之WAF(Web Appllication Firewall)篇", "url": "https://www.freebuf.com/articles/web/18084.html", "time": "2013-11-25", "level": "金币+10", "num_look": 1357618, "num_comment": 25, "author": "LittleHann", "tags": ["WEB安全"], "text": ""}
{"title": "“X将军”网络战模拟实验室：新型雾计算诱捕技术", "url": "https://www.freebuf.com/articles/network/18340.html", "time": "2013-11-25", "level": "", "num_look": 481161, "num_comment": 47, "author": "general.x", "tags": ["网络安全"], "text": "大家好，欢迎大家再次访问“X将军”网络战模拟实验室，上一期我们探讨了“如何攻击美国无人机“，大家对此看法褒贬不一，的确，争论即是进步的桥梁。"}
{"title": "Github账号遭大规模暴力破解攻击", "url": "https://www.freebuf.com/news/18249.html", "time": "2013-11-23", "level": "", "num_look": 225491, "num_comment": 9, "author": "JohnChu", "tags": ["资讯"], "text": "知名源代码仓库Github日前遭到大规模暴力破解密码的攻击，一些帐号被成功攻破。受影响的GitHub帐号的确切数量不得而知，但GitHub现在的注册页面规定密码需要至少七位，并有至少一个小写字母和一个数字。"}
{"title": "MST for Android - 国产WEB漏洞测试平台手机版", "url": "https://www.freebuf.com/sectool/18108.html", "time": "2013-11-22", "level": "", "num_look": 277463, "num_comment": 26, "author": "sunwell", "tags": ["工具"], "text": ""}
{"title": "走近科学：LG智能电视是怎样监视收集用户信息的", "url": "https://www.freebuf.com/news/topnews/18091.html", "time": "2013-11-22", "level": "金币+5", "num_look": 295247, "num_comment": 12, "author": "JohnChu", "tags": ["头条", "终端安全"], "text": "现在你的电视机会监视你，并且智能地监视你。一名名叫DoctorBeet的英国的博客作者、开发者、Linux狂热爱好者发现LG的智能电视会发送用户个人信息到他们公司的服务器，这些信息包括你观看的频道和观看习惯。"}
{"title": "FreeBuf视频组出品：全球首支3D打印金属枪（视频）", "url": "https://www.freebuf.com/video/18110.html", "time": "2013-11-22", "level": "红色标题", "num_look": 324725, "num_comment": 30, "author": "FB视频", "tags": ["视频"], "text": "位于美国德克萨斯州奥斯汀市的固体概念3D打印公司今年10月宣布：他们用金属粉末制造出了世界上第一把3D打印的手枪，并成功进行了测试。"}
{"title": "windows 2008如何安装Cobalt Strike", "url": "https://www.freebuf.com/articles/others-articles/18096.html", "time": "2013-11-22", "level": "", "num_look": 400986, "num_comment": 5, "author": "lcx", "tags": ["其他"], "text": ""}
{"title": "MSF漏洞攻击练习系统 - Metasploitable2", "url": "https://www.freebuf.com/sectool/18065.html", "time": "2013-11-21", "level": "", "num_look": 1422284, "num_comment": 44, "author": "元首", "tags": ["工具"], "text": ""}
{"title": "无线安全审计工具——FruityWifi v1.6", "url": "https://www.freebuf.com/sectool/18056.html", "time": "2013-11-21", "level": "", "num_look": 386919, "num_comment": 20, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "[更新]hash注入神器WCE发布v1.42beta(32)版本", "url": "https://www.freebuf.com/sectool/18050.html", "time": "2013-11-21", "level": "", "num_look": 414024, "num_comment": 20, "author": "H3lvin", "tags": ["工具"], "text": ""}
{"title": "对抗模拟浏览器的DDOS攻击", "url": "https://www.freebuf.com/articles/web/17988.html", "time": "2013-11-21", "level": "金币+5", "num_look": 261508, "num_comment": 16, "author": "litdg", "tags": ["WEB安全"], "text": ""}
{"title": "揭秘：三一和中联重科背后的网络间谍战", "url": "https://www.freebuf.com/news/17979.html", "time": "2013-11-20", "level": "金币+5", "num_look": 288773, "num_comment": 24, "author": "fu4k", "tags": ["资讯"], "text": "这名曾被警方暂时拘留的中间人也是一名安全工程师，他现在已经成为业界的耻辱。这名前黑客告诉我，“这件事让他十分难堪。”"}
{"title": "利用csrf漏洞上传文件", "url": "https://www.freebuf.com/articles/web/17854.html", "time": "2013-11-20", "level": "", "num_look": 401144, "num_comment": 14, "author": "litdg", "tags": ["WEB安全"], "text": ""}
{"title": "xdef全国网络与信息安全防护峰会议题PPT下载", "url": "https://www.freebuf.com/articles/others-articles/17858.html", "time": "2013-11-20", "level": "", "num_look": 156310, "num_comment": 5, "author": "litdg", "tags": ["其他"], "text": ""}
{"title": "利用windows组策略首选项缺陷获取系统帐号", "url": "https://www.freebuf.com/articles/system/17829.html", "time": "2013-11-20", "level": "", "num_look": 250798, "num_comment": 10, "author": "litdg", "tags": ["系统安全"], "text": ""}
{"title": "新的Linux后门隐藏通信协议", "url": "https://www.freebuf.com/news/17900.html", "time": "2013-11-20", "level": "", "num_look": 201565, "num_comment": 16, "author": "lock", "tags": ["资讯"], "text": ""}
{"title": "如何保护你的计算机不被恶意软件勒索", "url": "https://www.freebuf.com/news/17889.html", "time": "2013-11-20", "level": "金币+5", "num_look": 231803, "num_comment": 13, "author": "嘎巴嘎巴", "tags": ["工具", "资讯"], "text": ""}
{"title": "欧洲黑客团体Inj3ct0r利用0-Day漏洞攻击苹果粉丝论坛", "url": "https://www.freebuf.com/news/17866.html", "time": "2013-11-19", "level": "", "num_look": 176238, "num_comment": 11, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "1千万英国用户被Cryptolocker勒索软件瞄准", "url": "https://www.freebuf.com/articles/system/17847.html", "time": "2013-11-19", "level": "", "num_look": 193347, "num_comment": 18, "author": "JohnChu", "tags": ["系统安全"], "text": ""}
{"title": "谷歌扩大第三方开源补丁奖励范围--提交补丁获得现金奖励", "url": "https://www.freebuf.com/news/17801.html", "time": "2013-11-19", "level": "", "num_look": 120533, "num_comment": 3, "author": "litdg", "tags": ["资讯"], "text": ""}
{"title": "日本字处理软件ichiaro被发现存在0day漏洞", "url": "https://www.freebuf.com/vuls/17798.html", "time": "2013-11-19", "level": "", "num_look": 177511, "num_comment": 10, "author": "softbug", "tags": ["漏洞"], "text": ""}
{"title": "腾讯回应QQ群数据库泄露：两年前已修复", "url": "https://www.freebuf.com/news/17802.html", "time": "2013-11-19", "level": "", "num_look": 280663, "num_comment": 6, "author": "hang333", "tags": ["资讯"], "text": ""}
{"title": "Android下常见终端模拟器和SSH客户端感受及几个Tips", "url": "https://www.freebuf.com/geek/17743.html", "time": "2013-11-19", "level": "金币+5", "num_look": 2412904, "num_comment": 16, "author": "FallenSec", "tags": ["极客"], "text": ""}
{"title": "OWASP CISOS GUIDE(首席安全官指引)内容解析", "url": "https://www.freebuf.com/articles/web/17722.html", "time": "2013-11-19", "level": "", "num_look": 200410, "num_comment": 1, "author": "cnbird", "tags": ["WEB安全"], "text": ""}
{"title": "晚间话题：极客眼中的 Tesla Model S（一）", "url": "https://www.freebuf.com/geek/17736.html", "time": "2013-11-18", "level": "", "num_look": 134293, "num_comment": 6, "author": "fu4k", "tags": ["极客"], "text": ""}
{"title": "NASA又遭黑客入侵， 8个子域名站点被涂鸦", "url": "https://www.freebuf.com/news/17582.html", "time": "2013-11-18", "level": "", "num_look": 152837, "num_comment": 13, "author": "hang333", "tags": ["资讯"], "text": ""}
{"title": "比特币掀淘金潮：价值超$400，挖矿设备卖了$300万", "url": "https://www.freebuf.com/news/17491.html", "time": "2013-11-18", "level": "", "num_look": 169005, "num_comment": 11, "author": "softbug", "tags": ["资讯"], "text": ""}
{"title": "一周海外安全事件回顾（11.10 – 11.16）", "url": "https://www.freebuf.com/news/17690.html", "time": "2013-11-18", "level": "", "num_look": 175371, "num_comment": 5, "author": "blackscreen", "tags": ["头条", "安全报告"], "text": ""}
{"title": "比特币都有哪些基本概念和术语", "url": "https://www.freebuf.com/articles/others-articles/17499.html", "time": "2013-11-18", "level": "", "num_look": 252457, "num_comment": 7, "author": "softbug", "tags": ["其他"], "text": ""}
{"title": "[重磅]FreeBuf优质文章奖励计划", "url": "https://www.freebuf.com/news/17613.html", "time": "2013-11-18", "level": "红色标题", "num_look": 1865779, "num_comment": 102, "author": "FB客服", "tags": ["周边", "资讯"], "text": "我们今天推出「优质文章奖励计划」，更多的是一种激励意义：好的内容，应该被奖励，优秀作者的辛勤工作与智慧结晶，应该被感谢！"}
{"title": "浅谈如何配置一个基本安全的终端机", "url": "https://www.freebuf.com/articles/terminal/17425.html", "time": "2013-11-18", "level": "", "num_look": 209741, "num_comment": 2, "author": "ziwen", "tags": ["终端安全"], "text": ""}
{"title": "FBI警告美国政府：“匿名者”黑客团体来了", "url": "https://www.freebuf.com/news/17579.html", "time": "2013-11-17", "level": "", "num_look": 159093, "num_comment": 6, "author": "hang333", "tags": ["资讯"], "text": ""}
{"title": "英国NCA向公众发出警告：CryptoLocker恶意程序肆虐网络", "url": "https://www.freebuf.com/news/17524.html", "time": "2013-11-16", "level": "", "num_look": 130879, "num_comment": 9, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "安全专家利用IE11漏洞攻破Win8.1", "url": "https://www.freebuf.com/news/17486.html", "time": "2013-11-16", "level": "", "num_look": 144924, "num_comment": 10, "author": "葙守", "tags": ["资讯"], "text": ""}
{"title": "站争：代号1937［第四节：决策！（下）］", "url": "https://www.freebuf.com/articles/others-articles/22033.html", "time": "2013-11-15", "level": "", "num_look": 113523, "num_comment": 113523, "author": "4n0wGZ", "tags": ["其他"], "text": ""}
{"title": "安徽中新软件有限公司招聘信息安全工程师（中新金盾）", "url": "https://www.freebuf.com/jobs/17390.html", "time": "2013-11-15", "level": "", "num_look": 209174, "num_comment": 39, "author": "netciw", "tags": ["安全招聘"], "text": ""}
{"title": "FBI曾怀疑著名科幻小说家阿西莫夫是俄罗斯间谍", "url": "https://www.freebuf.com/news/17453.html", "time": "2013-11-15", "level": "", "num_look": 162391, "num_comment": 9, "author": "maxcoco", "tags": ["资讯"], "text": "1960年，阿西莫夫获得了波斯顿大学生物学的终身教授，但更出名的是因为他在科幻小说领域的成就。而就在同年，一封寄给FBI老大的神秘信件指出阿西莫夫是“工厂（音译）”党的间谍。"}
{"title": "CVE格式即将改变", "url": "https://www.freebuf.com/news/17383.html", "time": "2013-11-15", "level": "", "num_look": 162042, "num_comment": 11, "author": "Shawn the R0ck", "tags": ["资讯"], "text": ""}
{"title": "扬声器和麦克风通信？神秘病毒badBIOS引发质疑", "url": "https://www.freebuf.com/news/16776.html", "time": "2013-11-15", "level": "", "num_look": 129291, "num_comment": 8, "author": "Mystery", "tags": ["资讯"], "text": ""}
{"title": "朝鲜黑客部队达1700人，金正恩称其是尚方宝剑", "url": "https://www.freebuf.com/news/16801.html", "time": "2013-11-15", "level": "", "num_look": 158258, "num_comment": 22, "author": "hang333", "tags": ["资讯"], "text": "朝鲜设立以网络研究所为主的网络司令部，并设置了7个由国防委员会和朝鲜劳动党内共约1700名重要工作人员组成的黑客组织。"}
{"title": "微软成立反网络犯罪中心，工作环境如美剧CSI情景", "url": "https://www.freebuf.com/news/17433.html", "time": "2013-11-15", "level": "", "num_look": 123312, "num_comment": 7, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "免杀Payload生成工具Veil使用视频演示（视频）", "url": "https://www.freebuf.com/video/17369.html", "time": "2013-11-14", "level": "", "num_look": 267805, "num_comment": 11, "author": "wormfox", "tags": ["视频"], "text": ""}
{"title": "Avast!：小型网站最易遭受的3种黑客攻击", "url": "https://www.freebuf.com/articles/web/17339.html", "time": "2013-11-14", "level": "红色标题", "num_look": 280241, "num_comment": 17, "author": "sillywilly", "tags": ["WEB安全"], "text": ""}
{"title": "浅谈终端机与移动设备的沙盒安全", "url": "https://www.freebuf.com/articles/terminal/17274.html", "time": "2013-11-14", "level": "", "num_look": 249552, "num_comment": 16, "author": "ziwen", "tags": ["终端安全"], "text": ""}
{"title": "担心U盘有毒，国际空间站全换Linux系统", "url": "https://www.freebuf.com/news/17300.html", "time": "2013-11-13", "level": "", "num_look": 132324, "num_comment": 16, "author": "blackscreen", "tags": ["资讯"], "text": ""}
{"title": "实时协作工具库 - TogetherJS", "url": "https://www.freebuf.com/sectool/17295.html", "time": "2013-11-13", "level": "", "num_look": 145624, "num_comment": 1, "author": "IceArmour", "tags": ["工具"], "text": ""}
{"title": "国内安全小组Keen Team在Pwn2Own大赛上攻破iOS 7.0.3", "url": "https://www.freebuf.com/news/17279.html", "time": "2013-11-13", "level": "", "num_look": 243282, "num_comment": 36, "author": "maxcoco", "tags": ["资讯"], "text": ""}
{"title": "玩转Samsung RFID门禁卡（视频）", "url": "https://www.freebuf.com/geek/17262.html", "time": "2013-11-13", "level": "", "num_look": 569893, "num_comment": 16, "author": "kevin_2600", "tags": ["极客", "视频"], "text": ""}
{"title": "Python安全测试工具合集（整理）", "url": "https://www.freebuf.com/sectool/17213.html", "time": "2013-11-13", "level": "", "num_look": 620002, "num_comment": 29, "author": "fu4k", "tags": ["工具"], "text": ""}
{"title": "新加坡总理警告匿名黑客组织：不要惹我们！", "url": "https://www.freebuf.com/news/17226.html", "time": "2013-11-13", "level": "红色标题", "num_look": 340435, "num_comment": 25, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "英国举行大规模网络攻防演习，代号“醒鲨2”", "url": "https://www.freebuf.com/news/17237.html", "time": "2013-11-12", "level": "", "num_look": 119877, "num_comment": 1, "author": "Alex", "tags": ["资讯"], "text": ""}
{"title": "手机关闭照样被追踪？诺基亚三星：臣妾做不到啊", "url": "https://www.freebuf.com/news/others/17192.html", "time": "2013-11-12", "level": "", "num_look": 220586, "num_comment": 26, "author": "maxcoco", "tags": ["周边", "终端安全"], "text": ""}
{"title": "俄罗斯核电站和国际空间站曾感染Stuxnet蠕虫", "url": "https://www.freebuf.com/news/17181.html", "time": "2013-11-12", "level": "", "num_look": 132348, "num_comment": 12, "author": "phper", "tags": ["资讯"], "text": ""}
{"title": "FireEye：IE再曝0day漏洞，国内暂未出现攻击", "url": "https://www.freebuf.com/news/17174.html", "time": "2013-11-12", "level": "", "num_look": 196300, "num_comment": 20, "author": "Mystery", "tags": ["漏洞", "资讯"], "text": ""}
{"title": "[科普]DNS相关的攻击介绍", "url": "https://www.freebuf.com/articles/network/17150.html", "time": "2013-11-12", "level": "红色标题", "num_look": 868435, "num_comment": 20, "author": "携程安全中心", "tags": ["网络安全"], "text": ""}
{"title": "酒仙网招聘安全工程师", "url": "https://www.freebuf.com/jobs/15880.html", "time": "2013-11-12", "level": "", "num_look": 166988, "num_comment": 16, "author": "SecSky", "tags": ["安全招聘"], "text": ""}
{"title": "黑客开发对Healthcare.gov发动拒绝服务攻击的软件", "url": "https://www.freebuf.com/news/17143.html", "time": "2013-11-12", "level": "", "num_look": 124523, "num_comment": 3, "author": "yaxi", "tags": ["资讯"], "text": ""}
{"title": "在Windows 2012下面启用MSTSC客户端", "url": "https://www.freebuf.com/articles/others-articles/17071.html", "time": "2013-11-12", "level": "", "num_look": 220305, "num_comment": 2, "author": "softbug", "tags": ["其他"], "text": ""}
{"title": "安全工具Sqlmap免py环境(2013/09/13更新)", "url": "https://www.freebuf.com/sectool/16823.html", "time": "2013-11-11", "level": "", "num_look": 479780, "num_comment": 24, "author": "unshell", "tags": ["工具"], "text": ""}
{"title": "一周海外安全事件回顾（11.04 – 11.09）", "url": "https://www.freebuf.com/news/topnews/17051.html", "time": "2013-11-11", "level": "金币+1", "num_look": 231350, "num_comment": 6, "author": "blackscreen", "tags": ["头条", "安全报告"], "text": ""}
{"title": "apache+php cgi mod(cve-2012-1823)批量检测工具（源码）", "url": "https://www.freebuf.com/sectool/17052.html", "time": "2013-11-11", "level": "", "num_look": 220220, "num_comment": 16, "author": "xocoder", "tags": ["工具"], "text": ""}
{"title": "比特币在线钱包服务遭攻击，黑客窃取4100个比特币", "url": "https://www.freebuf.com/news/17037.html", "time": "2013-11-10", "level": "", "num_look": 151072, "num_comment": 9, "author": "lock", "tags": ["资讯"], "text": "﻿Inputs.io是2013年7月2日建立的一个比特币在线钱包商，虽然才运行几个月，但是在比特币社区中的口碑还是不错的，日前，国外黑客攻击了Inputs.io，并从中盗取了4100个比特币（折合130万美元）。"}
{"title": "斯诺登曾说服几十名同事给他密码", "url": "https://www.freebuf.com/news/16932.html", "time": "2013-11-08", "level": "", "num_look": 141297, "num_comment": 11, "author": "Mystery", "tags": ["资讯"], "text": ""}
{"title": "移花接木，如何利用第三方服务发动WEB攻击", "url": "https://www.freebuf.com/articles/web/16918.html", "time": "2013-11-08", "level": "", "num_look": 201814, "num_comment": 12, "author": "lu4nx", "tags": ["WEB安全"], "text": "继《走近科学：如何利用Google机器人进行SQL攻击》后，咱们来讨论讨论如何利用三方服务进行移花接木。在很久之前，我们就在加速乐的离线日志中发现了来自谷歌爬虫攻击，事实上，不止谷歌爬虫，包括百度之类的也在内。"}
{"title": "[科普]Waf实现扫描器识别 彻底抵挡黑客扫描", "url": "https://www.freebuf.com/articles/web/16806.html", "time": "2013-11-08", "level": "", "num_look": 466805, "num_comment": 15, "author": "seay", "tags": ["WEB安全"], "text": ""}
{"title": "黑客将肉鸡分门别类，女性肉鸡PC大受欢迎", "url": "https://www.freebuf.com/news/16839.html", "time": "2013-11-08", "level": "", "num_look": 277636, "num_comment": 10, "author": "嘎巴嘎巴", "tags": ["资讯"], "text": "通过比特币付款，提供垂直的远控和肉鸡，逐渐占据更大的市场份额，但目前网络犯罪分子开始尝试引入独特的价值主张(UVP)。网络犯罪分子开始推出被控主机的租用、DDos和加密的恶意软件试用。所有的努力都在致力于区分…"}
{"title": "漏洞报告平台那点事", "url": "https://www.freebuf.com/news/topnews/16302.html", "time": "2013-11-08", "level": "红色标题", "num_look": 683530, "num_comment": 54, "author": "iceyes", "tags": ["头条", "观点"], "text": "我既不是互联网公司的员工，也不是知名白帽子，但这一段时间关于甲方SRC平台与第三方平台的种种故事，老马我实在看不下去了了，不吐不快。虽然在以前在微博上说过几次，但每条微博每次只能说那么几个字，根本不能表…"}
{"title": "OSSEC研究-decoder规则语言", "url": "https://www.freebuf.com/articles/system/16736.html", "time": "2013-11-08", "level": "", "num_look": 243759, "num_comment": 4, "author": "yocoa", "tags": ["系统安全"], "text": ""}
{"title": "午夜推荐·情色智能电台", "url": "https://www.freebuf.com/news/others/16829.html", "time": "2013-11-07", "level": "", "num_look": 1342622, "num_comment": 32, "author": "fu4k", "tags": ["其他", "周边"], "text": ""}
{"title": "实例论证：NSA在安全标准中植入了后门", "url": "https://www.freebuf.com/news/16725.html", "time": "2013-11-07", "level": "", "num_look": 155459, "num_comment": 4, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "FreeBuf视频字幕组招聘", "url": "https://www.freebuf.com/jobs/16717.html", "time": "2013-11-07", "level": "红色标题", "num_look": 225635, "num_comment": 25, "author": "FB客服", "tags": ["安全招聘"], "text": ""}
{"title": "PHP,Python领衔互联网开源项目推出赏金猎手计划", "url": "https://www.freebuf.com/news/16650.html", "time": "2013-11-07", "level": "金币+10", "num_look": 188076, "num_comment": 7, "author": "pnig0s", "tags": ["资讯"], "text": ""}
{"title": "nmap速查表v1.0（中文版）", "url": "https://www.freebuf.com/sectool/16410.html", "time": "2013-11-07", "level": "", "num_look": 432113, "num_comment": 8, "author": "咸鱼", "tags": ["工具"], "text": ""}
{"title": "新型威胁分析与防范研究", "url": "https://www.freebuf.com/articles/others-articles/16505.html", "time": "2013-11-07", "level": "", "num_look": 243670, "num_comment": 6, "author": "softbug", "tags": ["其他"], "text": "本文通过对以APT为代表的新型威胁的实例研究，分析了新型威胁的攻击过程、技术特点、当前国内外的发展现状，给出了新型威胁的基本定义和描述，以及应对新型威胁的总体思路和具体具体手段。最后，本文还简要叙述了新…"}
{"title": "走近科学：如何利用Google机器人进行SQL攻击", "url": "https://www.freebuf.com/news/topnews/16519.html", "time": "2013-11-06", "level": "", "num_look": 475430, "num_comment": 58, "author": "maxcoco", "tags": ["WEB安全", "头条"], "text": ""}
{"title": "Google机器人被用于执行SQL注入攻击，通杀Web应用防火墙", "url": "https://www.freebuf.com/news/16509.html", "time": "2013-11-06", "level": "红色标题", "num_look": 213087, "num_comment": 18, "author": "phper", "tags": ["资讯"], "text": "安全公司发现，Google的机器人被用于对客户网站发动SQL注入攻击，迫使其在防火墙中屏蔽了Google的IP地址。这种攻击理论上可绕过任何Web应用防火墙。"}
{"title": "还原策划“搜狗重大安全漏洞可直接登陆数千账户”事件的真相 V2", "url": "https://www.freebuf.com/news/16443.html", "time": "2013-11-06", "level": "红色标题", "num_look": 427075, "num_comment": 59, "author": "i_youyou", "tags": ["资讯"], "text": "2013年11月5日，在卡饭论坛中，一个ID为 k53941的用户，在卡饭论坛发表了一篇名为“搜狗重大安全漏洞可直接登陆数千账户”的帖子，并拷贝一份发布到论坛的国内杀毒板块，图文并茂的说搜狗浏览器的云同步功能导致了用…"}
{"title": "恶意Word附件影响Windows和Office 微软提供临时修复方案", "url": "https://www.freebuf.com/news/16486.html", "time": "2013-11-06", "level": "", "num_look": 132590, "num_comment": 6, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "黑客可远程控制你的手机 - Android 4.4惊爆漏洞（含EXP）", "url": "https://www.freebuf.com/articles/wireless/16423.html", "time": "2013-11-06", "level": "", "num_look": 456666, "num_comment": 19, "author": "maxcoco", "tags": ["无线安全"], "text": ""}
{"title": "了解你的对手：追踪快速响应的APT攻击", "url": "https://www.freebuf.com/articles/system/16389.html", "time": "2013-11-06", "level": "红色标题", "num_look": 423304, "num_comment": 8, "author": "litdg", "tags": ["系统安全", "网络安全"], "text": ""}
{"title": "恶意代码分析利器 - scdbg", "url": "https://www.freebuf.com/sectool/16320.html", "time": "2013-11-05", "level": "", "num_look": 411089, "num_comment": 13, "author": "夜未央", "tags": ["工具"], "text": "scdbg是一款多平台开源的Shellcode模拟运行、分析工具。其基于libemulibrary搭建的虚拟环境，通过模拟32位处理器、内存和基本Windows API运行环境来虚拟执行Shellcode以分析其行为。"}
{"title": "微软将公司安全漏洞赏金提至10万美元", "url": "https://www.freebuf.com/news/16369.html", "time": "2013-11-05", "level": "", "num_look": 115805, "num_comment": 3, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "burpsuite_pro_v1.5.11 破解版", "url": "https://www.freebuf.com/sectool/16340.html", "time": "2013-11-05", "level": "", "num_look": 214253, "num_comment": 24, "author": "天才大帅哥", "tags": ["工具"], "text": ""}
{"title": "一周海外安全事件回顾（10.28 –11.01）", "url": "https://www.freebuf.com/news/16208.html", "time": "2013-11-04", "level": "红色标题", "num_look": 211304, "num_comment": 15, "author": "blackscreen", "tags": ["头条", "安全报告"], "text": ""}
{"title": "诡异事件：神秘跨平台病毒badBIOS", "url": "https://www.freebuf.com/news/16079.html", "time": "2013-11-04", "level": "", "num_look": 299220, "num_comment": 47, "author": "嘎巴嘎巴", "tags": ["资讯"], "text": ""}
{"title": "旨在识别人类的CAPTCHA测试被机器破解了", "url": "https://www.freebuf.com/articles/web/16175.html", "time": "2013-11-04", "level": "", "num_look": 177876, "num_comment": 3, "author": "softbug", "tags": ["WEB安全"], "text": ""}
{"title": "枚举和分析Windows DACLs工具 - WindowsDACLEnumProject", "url": "https://www.freebuf.com/sectool/16251.html", "time": "2013-11-04", "level": "", "num_look": 166981, "num_comment": 7, "author": "lock", "tags": ["工具"], "text": ""}
{"title": "对Adobe", "url": "https://www.freebuf.com/news/16107.html", "time": "2013-11-03", "level": "红色标题", "num_look": 402236, "num_comment": 36, "author": "Mystery", "tags": ["资讯"], "text": ""}
{"title": "DIY一个自动浇花系统", "url": "https://www.freebuf.com/geek/15817.html", "time": "2013-11-03", "level": "", "num_look": 374700, "num_comment": 14, "author": "softbug", "tags": ["极客"], "text": ""}
{"title": "[视频]Hello World—IT男的逆袭", "url": "https://www.freebuf.com/video/15805.html", "time": "2013-11-02", "level": "", "num_look": 571650, "num_comment": 18, "author": "softbug", "tags": ["视频"], "text": ""}
{"title": "黑客组织Anonymous向新加坡政府正式宣战（视频）", "url": "https://www.freebuf.com/news/16039.html", "time": "2013-11-01", "level": "红色标题", "num_look": 368108, "num_comment": 30, "author": "phper", "tags": ["资讯"], "text": ""}
{"title": "Big Brother的Dual_EC_DRBG", "url": "https://www.freebuf.com/news/15969.html", "time": "2013-11-01", "level": "", "num_look": 185847, "num_comment": 6, "author": "Shawn the R0ck", "tags": ["资讯"], "text": ""}
{"title": "梦回大宋 - 安全事件共享构想之OpenIOC", "url": "https://www.freebuf.com/articles/others-articles/15835.html", "time": "2013-11-01", "level": "红色标题", "num_look": 315413, "num_comment": 7, "author": "005", "tags": ["其他"], "text": ""}
{"title": "未来家居概念：飞行机器人、3D打印食物和呼吸墙", "url": "https://www.freebuf.com/geek/15820.html", "time": "2013-11-01", "level": "", "num_look": 155532, "num_comment": 155532, "author": "softbug", "tags": ["极客"], "text": ""}
{"title": "NetGear路由器可以通过命令注入获取ROOT权限[附EXP]", "url": "https://www.freebuf.com/articles/wireless/15641.html", "time": "2013-11-01", "level": "", "num_look": 555472, "num_comment": 5, "author": "Mystery", "tags": ["无线安全"], "text": ""}
{"title": "Hash传递攻击Windows2012远程桌面", "url": "https://www.freebuf.com/articles/system/15757.html", "time": "2013-10-31", "level": "", "num_look": 555469, "num_comment": 20, "author": "litdg", "tags": ["系统安全"], "text": ""}
{"title": "Adobe Photoshop源代码以及3800万用户信息泄漏（更新）", "url": "https://www.freebuf.com/news/15865.html", "time": "2013-10-31", "level": "红色标题", "num_look": 383903, "num_comment": 31, "author": "fu4k", "tags": ["资讯"], "text": "本月初的报导称，黑客窃取了Acrobat等应用程序源代码和290万客户的信息，包括加密密码和信用卡号码。但最新的报导显示，信息泄漏的规模比最初预计的大得多：黑客还窃取了Adobe旗舰产品Photoshop的源代码，以及超过3…"}
{"title": "提取Android进程中的RSAPrivateCrtKey和证书", "url": "https://www.freebuf.com/articles/system/15477.html", "time": "2013-10-31", "level": "", "num_look": 263984, "num_comment": 6, "author": "bincker", "tags": ["系统安全"], "text": ""}
{"title": "RAT终结者在APT中的演变复杂化", "url": "https://www.freebuf.com/articles/web/15791.html", "time": "2013-10-31", "level": "", "num_look": 212055, "num_comment": 3, "author": "softbug", "tags": ["WEB安全", "系统安全"], "text": ""}
{"title": "国产电熨斗内嵌间谍芯片", "url": "https://www.freebuf.com/news/15753.html", "time": "2013-10-31", "level": "红色标题", "num_look": 275676, "num_comment": 21, "author": "maxcoco", "tags": ["资讯"], "text": ""}
{"title": "关于近期发布的apache+php cgi mod攻击代码", "url": "https://www.freebuf.com/articles/web/15774.html", "time": "2013-10-30", "level": "", "num_look": 417766, "num_comment": 11, "author": "素包子", "tags": ["WEB安全"], "text": ""}
{"title": "Outlook Password Dump：快速恢复你遗失的Microsoft Outlook密码", "url": "https://www.freebuf.com/sectool/15518.html", "time": "2013-10-30", "level": "", "num_look": 269385, "num_comment": 8, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "我对Padding Oracle攻击的分析和思考（详细）", "url": "https://www.freebuf.com/articles/web/15504.html", "time": "2013-10-30", "level": "", "num_look": 858359, "num_comment": 22, "author": "LittleHann", "tags": ["WEB安全"], "text": ""}
{"title": "美国国安局间谍术语", "url": "https://www.freebuf.com/news/15532.html", "time": "2013-10-30", "level": "", "num_look": 125127, "num_comment": 2, "author": "sillywilly", "tags": ["资讯"], "text": ""}
{"title": "以色列公路控制系统被黑，导致交通拥堵", "url": "https://www.freebuf.com/news/15661.html", "time": "2013-10-30", "level": "", "num_look": 123513, "num_comment": 7, "author": "嘎巴嘎巴", "tags": ["资讯"], "text": "还记得电影《偷天换日》中那伙黄金大盗么？电影中大盗们入侵了交通系统，控制了红绿灯以便于他们顺利的盗走黄金，这类似的事还真在网络安全最先进的国家之一以色列发生了。"}
{"title": "加拿大12岁少年承认协助黑客组织Anoymous攻击政府网站", "url": "https://www.freebuf.com/news/15628.html", "time": "2013-10-30", "level": "", "num_look": 171802, "num_comment": 21, "author": "Mystery", "tags": ["资讯"], "text": ""}
{"title": "[专题]近期全球APT攻击事件及黑客组织调查报告汇总", "url": "https://www.freebuf.com/news/topnews/15685.html", "time": "2013-10-29", "level": "", "num_look": 181345, "num_comment": 181345, "author": "pnig0s", "tags": ["头条"], "text": ""}
{"title": "[专题]近期路由器后门事件报告汇总[20131101UPDATE]", "url": "https://www.freebuf.com/news/topnews/15678.html", "time": "2013-10-29", "level": "", "num_look": 274817, "num_comment": 14, "author": "pnig0s", "tags": ["头条"], "text": ""}
{"title": "3名黑客被指从美国导弹防御局和NASA挖掘数据", "url": "https://www.freebuf.com/news/15626.html", "time": "2013-10-29", "level": "", "num_look": 106373, "num_comment": 5, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "叙利亚电子军入侵奥巴马网络社交账户", "url": "https://www.freebuf.com/news/15597.html", "time": "2013-10-29", "level": "", "num_look": 119192, "num_comment": 6, "author": "maxcoco", "tags": ["资讯"], "text": ""}
{"title": "人工智能企业Vicarious模拟人脑成功破解文字验证码CAPTCHA", "url": "https://www.freebuf.com/news/15590.html", "time": "2013-10-29", "level": "", "num_look": 153337, "num_comment": 5, "author": "fu4k", "tags": ["资讯"], "text": ""}
{"title": "JSP端口转发工具 - KPortTran", "url": "https://www.freebuf.com/sectool/15364.html", "time": "2013-10-29", "level": "", "num_look": 398204, "num_comment": 19, "author": "KingX", "tags": ["工具"], "text": ""}
{"title": "[科普]如何防止跨站点脚本攻击", "url": "https://www.freebuf.com/articles/web/15188.html", "time": "2013-10-29", "level": "红色标题", "num_look": 853029, "num_comment": 22, "author": "LittleHann", "tags": ["WEB安全"], "text": ""}
{"title": "Linux系统安全检查工具——Lynis", "url": "https://www.freebuf.com/sectool/15515.html", "time": "2013-10-29", "level": "", "num_look": 425494, "num_comment": 16, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "超会躲！变种Terminator木马锁定台湾攻击", "url": "https://www.freebuf.com/news/15546.html", "time": "2013-10-29", "level": "", "num_look": 138238, "num_comment": 12, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "深圳某大型通信公司招聘安全工程师", "url": "https://www.freebuf.com/jobs/15449.html", "time": "2013-10-29", "level": "", "num_look": 195299, "num_comment": 40, "author": "zhaopin_job2013", "tags": ["安全招聘"], "text": ""}
{"title": "JSRC N+1的力量电商安全沙龙全纪实（含PPT）", "url": "https://www.freebuf.com/news/topnews/15455.html", "time": "2013-10-28", "level": "", "num_look": 226664, "num_comment": 28, "author": "FB独家", "tags": ["头条"], "text": ""}
{"title": "第六届腾讯安全技术峰会全纪实（含PPT）", "url": "https://www.freebuf.com/news/topnews/15451.html", "time": "2013-10-28", "level": "", "num_look": 195692, "num_comment": 9, "author": "FB独家", "tags": ["头条"], "text": ""}
{"title": "“X将军”网络战模拟实验室：如何攻击美国无人机", "url": "https://www.freebuf.com/news/topnews/15321.html", "time": "2013-10-28", "level": "", "num_look": 491204, "num_comment": 31, "author": "general.x", "tags": ["头条"], "text": "2011年12月5日，伊朗宣布通过“GPS欺骗技术”，以及在美军无人机编队中植入键盘记录，成功控制飞入本土美国最尖端的RQ-170“哨兵”隐形无人机。从中可以看出其中的核心手段：一是破解无人机与卫星之间的通信，二是通过…"}
{"title": "Binwalk：后门（固件）分析利器", "url": "https://www.freebuf.com/sectool/15266.html", "time": "2013-10-28", "level": "", "num_look": 2147076, "num_comment": 17, "author": "bincker", "tags": ["其他", "工具"], "text": "近期网络上爆发的厂商固件后门漏洞，如D-LINK  腾达路由器后门时用到的分析工具是Binwalk，最近又更新到最新版本。周五抽空翻译了下工具使用方法和例子。Binwalk是一个固件的分析工具，旨在协助研究人员对固件非分…"}
{"title": "亚利桑那大学：美国下一代黑客培养计划", "url": "https://www.freebuf.com/news/15391.html", "time": "2013-10-27", "level": "", "num_look": 177044, "num_comment": 21, "author": "fu4k", "tags": ["资讯"], "text": ""}
{"title": "[视频]我们的大脑会被黑吗？", "url": "https://www.freebuf.com/geek/15374.html", "time": "2013-10-27", "level": "", "num_look": 181696, "num_comment": 20, "author": "phper", "tags": ["极客", "视频"], "text": "我们似乎都能控制着自己的思想和行为，这定义了我们自身。但当生物和科技纠缠进来时。问题来了：我们的大脑会被黑吗？"}
{"title": "[视频]蛋糕背后的大灰狼：你是互联网上的那只小白兔吗？", "url": "https://www.freebuf.com/video/15309.html", "time": "2013-10-25", "level": "红色标题", "num_look": 401766, "num_comment": 49, "author": "only_guest", "tags": ["视频"], "text": "短片中，我们向一位妹子（特别鸣谢演员肉肉）发送一个恶意链接，此链接中含有一枚DOM XSS漏洞。通过这个漏洞获取到了此妹子的浏览器Cookies，从而进入妹子QQ空间，查看一些敏感信息。"}
{"title": "钟馗之眼(ZoomEye)关于D-Link后门的统计分析报告", "url": "https://www.freebuf.com/news/15252.html", "time": "2013-10-25", "level": "", "num_look": 230942, "num_comment": 8, "author": "pnig0s", "tags": ["资讯"], "text": "安全研究员逆向工程发现嵌入式设备商台湾友讯科技（D-Link）路由器多个型号使用的固件系统中存在后门。黑客只需简单操作即可无需经过验证访问路由器的Web管理界面修改设备设置。"}
{"title": "手机安全公司网秦被爆存巨大欺诈，股价瞬间暴跌60%", "url": "https://www.freebuf.com/news/15244.html", "time": "2013-10-25", "level": "", "num_look": 146398, "num_comment": 20, "author": "ti0cy", "tags": ["资讯"], "text": "浑水报告表示，网秦操纵了一场重大的骗局，我们认为这家公司就是“零”。在网秦声称的2012年中国安全服务营收中，至少72%是虚构的。到目前为止，网秦最大的客户实际上就是网秦自己。"}
{"title": "DARPA推网络自动防御系统大奖赛，最高奖金达200万美元", "url": "https://www.freebuf.com/news/15238.html", "time": "2013-10-25", "level": "", "num_look": 113035, "num_comment": 6, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "php.net可能遭黑客入侵，Google将其列为恶意网站", "url": "https://www.freebuf.com/news/15231.html", "time": "2013-10-25", "level": "", "num_look": 135254, "num_comment": 14, "author": "AntBob", "tags": ["资讯"], "text": ""}
{"title": "英国拟招募定罪黑客负责网络安全，审查看重能力", "url": "https://www.freebuf.com/news/15200.html", "time": "2013-10-25", "level": "", "num_look": 114549, "num_comment": 6, "author": "Mystery", "tags": ["资讯"], "text": ""}
{"title": "ISF2013邀请函", "url": "https://www.freebuf.com/news/15215.html", "time": "2013-10-25", "level": "", "num_look": 191514, "num_comment": 6, "author": "ISF2013", "tags": ["周边", "资讯"], "text": "全球信息化进程的高速启动，使信息安全技术进步对整个社会发展的重要性日趋增强；攻击技术朝着高度计划性、专业性、隐蔽性与持续性方向发展，防御技术朝着高度战略性、协同性、动态性与主动性方向发展。"}
{"title": "安全保护技术ASLR绕过启示录", "url": "https://www.freebuf.com/articles/system/15149.html", "time": "2013-10-25", "level": "", "num_look": 505590, "num_comment": 21, "author": "夜未央", "tags": ["系统安全"], "text": "最近许多APT攻击使用了新的技术绕过地址随机化（ASLR），虽然地址随机化是当前操作系统最有效的防护机制之一，但还不够完善。在过去一年里，我们发现了以下几个有趣的绕过ASLR的技术。"}
{"title": "美国军方开发Android终端攻击工具，智能手机或将遥控空袭", "url": "https://www.freebuf.com/news/15169.html", "time": "2013-10-24", "level": "", "num_look": 138590, "num_comment": 9, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "教你几招保障Android手机的安全", "url": "https://www.freebuf.com/articles/terminal/15088.html", "time": "2013-10-24", "level": "", "num_look": 207186, "num_comment": 18, "author": "帅气凌云", "tags": ["终端安全"], "text": ""}
{"title": "国产WEB漏洞测试平台——MST", "url": "https://www.freebuf.com/sectool/15111.html", "time": "2013-10-24", "level": "红色标题", "num_look": 560546, "num_comment": 63, "author": "mstoor", "tags": ["工具"], "text": "Mst是一款Python2.7编写的小漏洞利用平台，可运行在windows | Backtrack | maxosx 等系统，专注于web漏洞的测试和各种利用插件的编写。"}
{"title": "揭秘：迅雷“病毒门”技术解析", "url": "https://www.freebuf.com/news/topnews/15065.html", "time": "2013-10-24", "level": "红色标题", "num_look": 347515, "num_comment": 26, "author": "litdg", "tags": ["头条", "系统安全"], "text": ""}
{"title": "东软集团股份有限公司招聘逆向分析工程师", "url": "https://www.freebuf.com/jobs/14888.html", "time": "2013-10-23", "level": "", "num_look": 163157, "num_comment": 21, "author": "rockl", "tags": ["安全招聘"], "text": "该职位只在北京，正式员工和实习员工都需要。对于实习员工，在逆向方面的要求相对不高。待遇：本科3000，硕士4000。考勤：每周三天以上，实习期三个月以上。"}
{"title": "PC开机自启动程序检查工具——SterJo Startup Patrol v.1.3", "url": "https://www.freebuf.com/sectool/15027.html", "time": "2013-10-23", "level": "", "num_look": 194150, "num_comment": 26, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "印尼超越中国成为最大网络攻击来源", "url": "https://www.freebuf.com/news/14959.html", "time": "2013-10-23", "level": "", "num_look": 118800, "num_comment": 6, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "Blackscreen第三季度海外安全事件汇总发布", "url": "https://www.freebuf.com/news/topnews/14985.html", "time": "2013-10-23", "level": "", "num_look": 173806, "num_comment": 6, "author": "blackscreen", "tags": ["头条", "安全报告"], "text": ""}
{"title": "Google推出DDOS防护项目-Project Shiel", "url": "https://www.freebuf.com/news/14953.html", "time": "2013-10-23", "level": "", "num_look": 170594, "num_comment": 13, "author": "lock", "tags": ["资讯"], "text": ""}
{"title": "京东安全应急响应中心：N+1的力量电商安全沙龙召开在即", "url": "https://www.freebuf.com/news/14995.html", "time": "2013-10-23", "level": "", "num_look": 166660, "num_comment": 25, "author": "FB独家", "tags": ["资讯"], "text": ""}
{"title": "我是如何反编译D-Link路由器固件程序并发现它的后门的", "url": "https://www.freebuf.com/articles/wireless/14964.html", "time": "2013-10-22", "level": "", "num_look": 455300, "num_comment": 15, "author": "IceArmour", "tags": ["无线安全"], "text": ""}
{"title": "安全宝(北京星云融创)招聘安全服务工程师", "url": "https://www.freebuf.com/jobs/14838.html", "time": "2013-10-22", "level": "", "num_look": 181170, "num_comment": 19, "author": "seay", "tags": ["安全招聘"], "text": ""}
{"title": "WiFiPineapple之独立模式小恶作剧", "url": "https://www.freebuf.com/articles/wireless/14807.html", "time": "2013-10-22", "level": "", "num_look": 498373, "num_comment": 19, "author": "radiowar", "tags": ["无线安全", "极客"], "text": ""}
{"title": "Metasploit官网被黑：仅发了一封传真到DNS注册商", "url": "https://www.freebuf.com/news/14896.html", "time": "2013-10-22", "level": "", "num_look": 239407, "num_comment": 28, "author": "Mystery", "tags": ["资讯"], "text": ""}
{"title": "美国前副总统因担心恐怖分子入侵心脏起搏器而关闭无线功能", "url": "https://www.freebuf.com/news/14880.html", "time": "2013-10-22", "level": "", "num_look": 153270, "num_comment": 5, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "烽火通信某款路由器被爆存在漏洞-可远程修改DNS", "url": "https://www.freebuf.com/vuls/14827.html", "time": "2013-10-22", "level": "红色标题", "num_look": 325260, "num_comment": 14, "author": "litdg", "tags": ["漏洞", "终端安全"], "text": ""}
{"title": "“安恒杯”杭州电子科技大学第五届网络攻防大赛暨CTF网络攻防邀请赛", "url": "https://www.freebuf.com/news/14849.html", "time": "2013-10-21", "level": "", "num_look": 338584, "num_comment": 24, "author": "FB独家", "tags": ["资讯"], "text": ""}
{"title": "美国国安局（NSA）秘密机构TAO入侵了墨西哥总统的Email", "url": "https://www.freebuf.com/news/14828.html", "time": "2013-10-21", "level": "", "num_look": 133994, "num_comment": 11, "author": "h4ck3r", "tags": ["资讯"], "text": ""}
{"title": "讨论两个容易被忽视的linux安全权限配置问题", "url": "https://www.freebuf.com/articles/system/13366.html", "time": "2013-10-21", "level": "", "num_look": 214944, "num_comment": 9, "author": "honeypot", "tags": ["系统安全"], "text": ""}
{"title": "Arbor Networks发布2013年第三季度DDOS攻击报告", "url": "https://www.freebuf.com/news/14800.html", "time": "2013-10-21", "level": "", "num_look": 139494, "num_comment": 10, "author": "lock", "tags": ["安全报告", "资讯"], "text": ""}
{"title": "世界第三的比特币交易平台（BTC中国）遭遇数百G级的DDoS攻击", "url": "https://www.freebuf.com/news/14798.html", "time": "2013-10-21", "level": "红色标题", "num_look": 262366, "num_comment": 18, "author": "phper", "tags": ["资讯"], "text": ""}
{"title": "盘点美国防部研发的高科技成果（组图）", "url": "https://www.freebuf.com/geek/14454.html", "time": "2013-10-19", "level": "", "num_look": 151302, "num_comment": 10, "author": "猪哥靓", "tags": ["极客"], "text": ""}
{"title": "“锁定盾牌”—中国可借鉴的网络战攻防演习", "url": "https://www.freebuf.com/news/topnews/14464.html", "time": "2013-10-18", "level": "", "num_look": 253288, "num_comment": 12, "author": "general.x", "tags": ["头条"], "text": ""}
{"title": "LUCI科技头饰让你可以拥有清醒的梦", "url": "https://www.freebuf.com/geek/14452.html", "time": "2013-10-18", "level": "", "num_look": 144604, "num_comment": 4, "author": "猪哥靓", "tags": ["极客"], "text": ""}
{"title": "走近科学：在中国，有爱——腾达Tenda 路由器后门分析", "url": "https://www.freebuf.com/news/topnews/14425.html", "time": "2013-10-18", "level": "", "num_look": 459736, "num_comment": 16, "author": "bincker", "tags": ["头条", "终端安全"], "text": "一直有人认为D-Link是唯一的将在其产品中放置后门供应商，其实这里还有一个供应商也同样在产品中放置了后门，并且可以利用单个UDP数据包就搞定。她——就是腾达。"}
{"title": "硬件“键盘记录器”确实存在，而且比我们想象的强大得多", "url": "https://www.freebuf.com/news/14434.html", "time": "2013-10-18", "level": "", "num_look": 711551, "num_comment": 30, "author": "hehe", "tags": ["资讯"], "text": ""}
{"title": "新型记录大脑活跃性方法或将窃听人类思想", "url": "https://www.freebuf.com/geek/14376.html", "time": "2013-10-18", "level": "", "num_look": 191499, "num_comment": 4, "author": "猪哥靓", "tags": ["极客"], "text": ""}
{"title": "android 安装KALI实测小记", "url": "https://www.freebuf.com/articles/wireless/14382.html", "time": "2013-10-18", "level": "", "num_look": 987057, "num_comment": 21, "author": "菜鸟不会飞", "tags": ["无线安全"], "text": ""}
{"title": "锦江之星酒店客户记录大规模泄漏", "url": "https://www.freebuf.com/news/14387.html", "time": "2013-10-17", "level": "", "num_look": 309670, "num_comment": 21, "author": "开房小王子", "tags": ["资讯"], "text": ""}
{"title": "本地网络连接监测软件SterJo NetStalker v.1.0", "url": "https://www.freebuf.com/sectool/14332.html", "time": "2013-10-17", "level": "", "num_look": 220032, "num_comment": 22, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "CDN流量放大攻击思路", "url": "https://www.freebuf.com/articles/network/14348.html", "time": "2013-10-17", "level": "", "num_look": 472277, "num_comment": 20, "author": "zje2008", "tags": ["网络安全"], "text": ""}
{"title": "分享一份Nmap Cheatsheet(下载)", "url": "https://www.freebuf.com/articles/system/14323.html", "time": "2013-10-16", "level": "", "num_look": 246455, "num_comment": 12, "author": "当当", "tags": ["系统安全"], "text": ""}
{"title": "美国安局（NSA）最高机密的内容收集计划曝光", "url": "https://www.freebuf.com/news/14306.html", "time": "2013-10-16", "level": "", "num_look": 127978, "num_comment": 5, "author": "phper", "tags": ["资讯"], "text": ""}
{"title": "邪恶的JAVA HASH DOS攻击", "url": "https://www.freebuf.com/articles/web/14199.html", "time": "2013-10-16", "level": "", "num_look": 537093, "num_comment": 10, "author": "softbug", "tags": ["WEB安全"], "text": ""}
{"title": "为什么Android使用弱加密算法？", "url": "https://www.freebuf.com/news/14300.html", "time": "2013-10-16", "level": "", "num_look": 181912, "num_comment": 8, "author": "android发烧友", "tags": ["终端安全", "资讯"], "text": ""}
{"title": "同人黑客小说：站争-第三节（上）（连载）", "url": "https://www.freebuf.com/articles/others-articles/14272.html", "time": "2013-10-16", "level": "", "num_look": 204203, "num_comment": 15, "author": "4n0wGZ", "tags": ["其他"], "text": ""}
{"title": "图集：俺在国外当会棍——Sector 2013 会场篇、WIFI篇、CTF篇", "url": "https://www.freebuf.com/news/14053.html", "time": "2013-10-15", "level": "", "num_look": 194356, "num_comment": 17, "author": "kevin_2600", "tags": ["资讯"], "text": ""}
{"title": "逆向工程友讯科技（D-Link）路由器固件后门", "url": "https://www.freebuf.com/news/14240.html", "time": "2013-10-15", "level": "", "num_look": 185272, "num_comment": 13, "author": "share", "tags": ["资讯"], "text": ""}
{"title": "“可汗探索2014”：APT1的复出？", "url": "https://www.freebuf.com/news/14224.html", "time": "2013-10-15", "level": "红色标题", "num_look": 279054, "num_comment": 18, "author": "general.x", "tags": ["资讯"], "text": ""}
{"title": "Cookie利用神器：CookieHacker", "url": "https://www.freebuf.com/sectool/14047.html", "time": "2013-10-15", "level": "", "num_look": 784821, "num_comment": 23, "author": "嘎巴嘎巴", "tags": ["工具"], "text": ""}
{"title": "php://input，php://filter，data URI schema的那些事", "url": "https://www.freebuf.com/articles/web/14097.html", "time": "2013-10-15", "level": "", "num_look": 461372, "num_comment": 22, "author": "碳基体", "tags": ["WEB安全"], "text": ""}
{"title": "Linux主机本地信息自动采集工具（渗透测试必备）", "url": "https://www.freebuf.com/sectool/14181.html", "time": "2013-10-14", "level": "", "num_look": 234654, "num_comment": 9, "author": "thanks", "tags": ["工具"], "text": ""}
{"title": "9月黑客晒书会得奖公布", "url": "https://www.freebuf.com/news/topnews/13755.html", "time": "2013-10-14", "level": "", "num_look": 158665, "num_comment": 14, "author": "softbug", "tags": ["头条"], "text": ""}
{"title": "[预告]新版FreeBuf发布在即", "url": "https://www.freebuf.com/news/14117.html", "time": "2013-10-14", "level": "", "num_look": 268243, "num_comment": 37, "author": "FB客服", "tags": ["周边", "资讯"], "text": ""}
{"title": "谁最给力？国内各大应急响应中心奖励分析", "url": "https://www.freebuf.com/articles/others-articles/13953.html", "time": "2013-10-14", "level": "", "num_look": 462965, "num_comment": 17, "author": "dragonegg", "tags": ["其他", "观点"], "text": ""}
{"title": "同人黑客小说：站争（连载）", "url": "https://www.freebuf.com/articles/others-articles/14043.html", "time": "2013-10-14", "level": "红色标题", "num_look": 403886, "num_comment": 55, "author": "4n0wGZ", "tags": ["其他"], "text": ""}
{"title": "图集：俺在国外当会棍——Sector 2013 开锁篇", "url": "https://www.freebuf.com/news/others/14068.html", "time": "2013-10-14", "level": "", "num_look": 181770, "num_comment": 14, "author": "kevin_2600", "tags": ["周边", "终端安全"], "text": ""}
{"title": "2003年，有人企图在Linux中植入后门", "url": "https://www.freebuf.com/news/14021.html", "time": "2013-10-12", "level": "", "num_look": 141507, "num_comment": 16, "author": "jack32", "tags": ["资讯"], "text": ""}
{"title": "美国网络战战略", "url": "https://www.freebuf.com/news/13981.html", "time": "2013-10-12", "level": "", "num_look": 142819, "num_comment": 10, "author": "general.x", "tags": ["资讯"], "text": ""}
{"title": "美国军方确认存在“钢铁侠武器套装”", "url": "https://www.freebuf.com/geek/13984.html", "time": "2013-10-12", "level": "", "num_look": 179371, "num_comment": 14, "author": "猪哥靓", "tags": ["极客"], "text": ""}
{"title": "关于专业黑客组织「隐秘山猫」的详细报告", "url": "https://www.freebuf.com/news/topnews/13931.html", "time": "2013-10-11", "level": "红色标题", "num_look": 323334, "num_comment": 25, "author": "jobs", "tags": ["头条"], "text": ""}
{"title": "基于psexec的域渗透测试工具—Smbexec v2.0", "url": "https://www.freebuf.com/sectool/13925.html", "time": "2013-10-11", "level": "", "num_look": 350245, "num_comment": 4, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "说说wordpress博客的安全防护", "url": "https://www.freebuf.com/articles/web/13837.html", "time": "2013-10-11", "level": "", "num_look": 270487, "num_comment": 19, "author": "malayke", "tags": ["WEB安全"], "text": ""}
{"title": "善恶有报——当发现我的iPad被盗", "url": "https://www.freebuf.com/articles/terminal/13895.html", "time": "2013-10-11", "level": "", "num_look": 192513, "num_comment": 15, "author": "老鹰", "tags": ["终端安全"], "text": ""}
{"title": "去哪儿网招聘WEB安全工程师", "url": "https://www.freebuf.com/jobs/13883.html", "time": "2013-10-10", "level": "", "num_look": 385946, "num_comment": 40, "author": "gyreg", "tags": ["安全招聘"], "text": ""}
{"title": "专访腾讯TSRC新锐奖得主、挖洞新星instruder", "url": "https://www.freebuf.com/news/others/13819.html", "time": "2013-10-10", "level": "红色标题", "num_look": 565739, "num_comment": 25, "author": "FB独家", "tags": ["人物志", "周边"], "text": ""}
{"title": "Java自动化SQL注入测试工具—jSQL Injection v0.5", "url": "https://www.freebuf.com/sectool/13845.html", "time": "2013-10-10", "level": "", "num_look": 452907, "num_comment": 21, "author": "fake", "tags": ["工具"], "text": ""}
{"title": "据报全球网络自由度下降", "url": "https://www.freebuf.com/news/13606.html", "time": "2013-10-10", "level": "", "num_look": 110275, "num_comment": 1, "author": "general.x", "tags": ["资讯"], "text": ""}
{"title": "Whatsapp/小红伞/AVG/Alexa等官网被黑，黑客呼吁世界和平", "url": "https://www.freebuf.com/news/13786.html", "time": "2013-10-10", "level": "", "num_look": 187516, "num_comment": 11, "author": "maxcoco", "tags": ["资讯"], "text": ""}
{"title": "四大传奇：中国网络黑客组织", "url": "https://www.freebuf.com/news/13781.html", "time": "2013-10-09", "level": "红色标题", "num_look": 782708, "num_comment": 35, "author": "general.x", "tags": ["头条", "资讯"], "text": "2013年的网络空间被一种新型概念主宰：高级可持续性威胁，也就当前网上出镜率很高的“APT攻击”。而极具讽刺意义的是，中国黑客几乎成为了所有APT的代名词。"}
{"title": "绕过VMware虚拟机登录认证神器—VMInjector（含使用心得）", "url": "https://www.freebuf.com/sectool/13738.html", "time": "2013-10-09", "level": "", "num_look": 500642, "num_comment": 29, "author": "litdg", "tags": ["工具", "系统安全"], "text": ""}
{"title": "苹果的加密机制将允许黑客创造强大的OS X恶意程序", "url": "https://www.freebuf.com/news/13749.html", "time": "2013-10-09", "level": "", "num_look": 113091, "num_comment": 3, "author": "嘎巴嘎巴", "tags": ["资讯"], "text": ""}
{"title": "Adobe系统源代码和数百万用户被盗", "url": "https://www.freebuf.com/news/13751.html", "time": "2013-10-09", "level": "", "num_look": 149240, "num_comment": 2, "author": "softbug", "tags": ["资讯"], "text": ""}
{"title": "[RadioWar WIKI]GnuRadio系列之新手试玩", "url": "https://www.freebuf.com/articles/wireless/13655.html", "time": "2013-10-08", "level": "", "num_look": 732001, "num_comment": 17, "author": "radiowar", "tags": ["无线安全", "极客"], "text": ""}
{"title": "第七届新西兰黑客大会Kiwicon（CFP中文）", "url": "https://www.freebuf.com/news/13643.html", "time": "2013-10-08", "level": "", "num_look": 174242, "num_comment": 19, "author": "youhuming", "tags": ["资讯"], "text": ""}
{"title": "FBI是如何破获“美国少女”裸照勒索案的", "url": "https://www.freebuf.com/news/13528.html", "time": "2013-10-08", "level": "", "num_look": 136995, "num_comment": 8, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "Fireeye火眼公司发布报告，评论中国网络间谍活动", "url": "https://www.freebuf.com/news/topnews/13578.html", "time": "2013-10-08", "level": "", "num_look": 320384, "num_comment": 16, "author": "general.x", "tags": ["头条"], "text": ""}
{"title": "上千万台俄罗斯肉鸡被网络犯罪集团贩卖", "url": "https://www.freebuf.com/news/13534.html", "time": "2013-10-03", "level": "", "num_look": 241836, "num_comment": 30, "author": "maxcoco", "tags": ["资讯"], "text": ""}
{"title": "ISC 2013后续：瀚海源CEO方兴对安全行业的一些思考", "url": "https://www.freebuf.com/news/13569.html", "time": "2013-10-02", "level": "", "num_look": 131789, "num_comment": 8, "author": "flash", "tags": ["资讯"], "text": ""}
{"title": "心跳密码，告别密码时代", "url": "https://www.freebuf.com/news/13517.html", "time": "2013-09-30", "level": "", "num_look": 141288, "num_comment": 9, "author": "filed", "tags": ["资讯"], "text": ""}
{"title": "android平台漏洞攻防和代码保护的技术趋势", "url": "https://www.freebuf.com/articles/wireless/13505.html", "time": "2013-09-30", "level": "", "num_look": 232039, "num_comment": 8, "author": "ha4k3r", "tags": ["无线安全"], "text": ""}
{"title": "微软版的Siri将使用游戏Halo中的性感妹子", "url": "https://www.freebuf.com/geek/13487.html", "time": "2013-09-29", "level": "", "num_look": 121548, "num_comment": 3, "author": "geekpark", "tags": ["极客"], "text": ""}
{"title": "Rapid7：IE 0DAY漏洞正活跃于地下", "url": "https://www.freebuf.com/news/13458.html", "time": "2013-09-29", "level": "", "num_look": 130768, "num_comment": 6, "author": "Serpent", "tags": ["资讯"], "text": ""}
{"title": "在线恶意文件检测平台——ByteScanner", "url": "https://www.freebuf.com/sectool/13468.html", "time": "2013-09-29", "level": "", "num_look": 290664, "num_comment": 25, "author": "实习小编", "tags": ["工具"], "text": ""}
{"title": "上周发现的IE 0day漏洞与中国黑客有关联", "url": "https://www.freebuf.com/news/13465.html", "time": "2013-09-29", "level": "", "num_look": 126412, "num_comment": 11, "author": "data", "tags": ["资讯"], "text": ""}
{"title": "跨国高端黑客团体——Icefog", "url": "https://www.freebuf.com/news/13425.html", "time": "2013-09-29", "level": "", "num_look": 272661, "num_comment": 27, "author": "kelz", "tags": ["资讯"], "text": "近日，卡巴斯基实验室的研究人员发布报告，宣布发现一支专门发起APT攻击的高端黑客组织，该组织在2011年开始对日本以及韩国的政府机构、防务公司发起了APT攻击。"}
{"title": "黑客谈Touch ID：虽不完美但是很棒", "url": "https://www.freebuf.com/news/13384.html", "time": "2013-09-27", "level": "", "num_look": 121936, "num_comment": 6, "author": "allen", "tags": ["资讯"], "text": ""}
{"title": "西电第四届网络攻防大赛开放注册", "url": "https://www.freebuf.com/news/13321.html", "time": "2013-09-27", "level": "", "num_look": 218817, "num_comment": 16, "author": "冷夜", "tags": ["资讯"], "text": ""}
{"title": "手把手教你如何在Android手机安装Google Play商店", "url": "https://www.freebuf.com/articles/others-articles/13290.html", "time": "2013-09-27", "level": "", "num_look": 1895626, "num_comment": 7, "author": "softbug", "tags": ["其他"], "text": ""}
{"title": "[科普]编写一个简单的可加载内核模块", "url": "https://www.freebuf.com/articles/system/13260.html", "time": "2013-09-27", "level": "", "num_look": 246057, "num_comment": 6, "author": "litdg", "tags": ["系统安全"], "text": ""}
{"title": "「道哥的黑板报」有感：关于跨越vlan进行arp嗅探的思考", "url": "https://www.freebuf.com/articles/system/13322.html", "time": "2013-09-27", "level": "红色标题", "num_look": 724696, "num_comment": 73, "author": "vodu", "tags": ["系统安全"], "text": ""}
{"title": "[科普]Windows命令行kill进程小技巧", "url": "https://www.freebuf.com/articles/web/13283.html", "time": "2013-09-27", "level": "", "num_look": 459871, "num_comment": 25, "author": "IceArmour", "tags": ["WEB安全"], "text": ""}
{"title": "比利时最大的通信商“Belgacom”网络系统被攻击", "url": "https://www.freebuf.com/news/13127.html", "time": "2013-09-26", "level": "", "num_look": 293464, "num_comment": 7, "author": "小贝", "tags": ["资讯"], "text": ""}
{"title": "让你的安卓设备跑起kali——kali for android", "url": "https://www.freebuf.com/articles/terminal/13209.html", "time": "2013-09-26", "level": "红色标题", "num_look": 3468231, "num_comment": 151, "author": "p0tt1", "tags": ["极客", "终端安全"], "text": "现在大家手上几乎都有安卓的设备了。要是渗透扫描不开kali虚拟机，直接ssh到手机上去扫描，那是一件多么美妙的事情。首先看了下官网的文章，但操作的时候出现了各种问题。下面是我和小伙伴们的过程，分享下自己的经…"}
{"title": "揭秘Hidden Lynx组织的APT攻击行动", "url": "https://www.freebuf.com/news/13226.html", "time": "2013-09-26", "level": "", "num_look": 160149, "num_comment": 8, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "美国安局曾向国际通用加密技术植入后门", "url": "https://www.freebuf.com/news/13035.html", "time": "2013-09-26", "level": "", "num_look": 101814, "num_comment": 2, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "Web应用安全十大主动安全措施", "url": "https://www.freebuf.com/articles/web/13197.html", "time": "2013-09-26", "level": "", "num_look": 202996, "num_comment": 4, "author": "lock", "tags": ["WEB安全"], "text": ""}
{"title": "行业观点：安全服务和安全产品的现状与未来", "url": "https://www.freebuf.com/articles/others-articles/13157.html", "time": "2013-09-25", "level": "", "num_look": 303130, "num_comment": 25, "author": "冷漠_CC", "tags": ["其他", "观点"], "text": ""}
{"title": "知名安全扫描工具AWVS 9（破解版下载）", "url": "https://www.freebuf.com/sectool/13103.html", "time": "2013-09-25", "level": "", "num_look": 1683250, "num_comment": 34, "author": "Anybaby", "tags": ["工具"], "text": ""}
{"title": "喜剧：巴西黑客欲攻击NSA，结果NASA躺枪", "url": "https://www.freebuf.com/news/13031.html", "time": "2013-09-25", "level": "", "num_look": 155883, "num_comment": 13, "author": "maxcoco", "tags": ["资讯"], "text": ""}
{"title": "FireEye：中国黑客攻击美国无人机制造商", "url": "https://www.freebuf.com/news/13094.html", "time": "2013-09-24", "level": "", "num_look": 239583, "num_comment": 22, "author": "thanks", "tags": ["资讯"], "text": ""}
{"title": "解放区？上海自贸区将不设防火长城", "url": "https://www.freebuf.com/news/13081.html", "time": "2013-09-24", "level": "红色标题", "num_look": 239437, "num_comment": 22, "author": "房价房租上涨部门", "tags": ["资讯"], "text": ""}
{"title": "DNS隧道制造工具——iodine", "url": "https://www.freebuf.com/sectool/13073.html", "time": "2013-09-24", "level": "", "num_look": 644143, "num_comment": 13, "author": "fake", "tags": ["工具"], "text": ""}
{"title": "网站指纹识别工具——WhatWeb v0.4.7发布", "url": "https://www.freebuf.com/sectool/13063.html", "time": "2013-09-24", "level": "", "num_look": 946379, "num_comment": 50, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "每月偷窃$50000美金的19岁阿根廷黑客被捕", "url": "https://www.freebuf.com/news/13047.html", "time": "2013-09-24", "level": "", "num_look": 130060, "num_comment": 11, "author": "softbug", "tags": ["资讯"], "text": ""}
{"title": "国外发现勒索软件借助NSA棱镜事件行骗", "url": "https://www.freebuf.com/news/13010.html", "time": "2013-09-23", "level": "", "num_look": 106787, "num_comment": 4, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "世界最大的数据库泄露统计", "url": "https://www.freebuf.com/news/12989.html", "time": "2013-09-23", "level": "", "num_look": 254490, "num_comment": 17, "author": "cs24", "tags": ["其他", "资讯"], "text": ""}
{"title": "Dionaea低交互式蜜罐部署详解", "url": "https://www.freebuf.com/articles/system/12696.html", "time": "2013-09-22", "level": "", "num_look": 456631, "num_comment": 4, "author": "moss", "tags": ["系统安全"], "text": ""}
{"title": "IE浏览器0day促使微软发布紧急补丁", "url": "https://www.freebuf.com/news/12928.html", "time": "2013-09-22", "level": "", "num_look": 121351, "num_comment": 8, "author": "Serpent", "tags": ["资讯"], "text": ""}
{"title": "[技术解析]一份Archmake.COM的渗透测试报告", "url": "https://www.freebuf.com/articles/web/12632.html", "time": "2013-09-22", "level": "", "num_look": 417283, "num_comment": 35, "author": "litdg", "tags": ["WEB安全"], "text": ""}
{"title": "揭秘：疑似中国职业黑客组织——隐秘山猫", "url": "https://www.freebuf.com/news/12884.html", "time": "2013-09-22", "level": "红色标题", "num_look": 430873, "num_comment": 58, "author": "phper", "tags": ["头条", "资讯"], "text": "在过去的几年里，在诸多类型的大型APT（ Advanced Persistent Threats 高可持续性威胁）攻击事件背后，一个神秘组织逐渐浮出水面。赛门铁克安全团队认为，这个组织是黑客中的佼佼者，称他们为“隐秘山猫”。"}
{"title": "iOS 7锁屏漏洞，可绕过密码查看照片等资料（含操作步骤）", "url": "https://www.freebuf.com/news/12854.html", "time": "2013-09-21", "level": "", "num_look": 196838, "num_comment": 20, "author": "猪哥靓", "tags": ["终端安全", "资讯"], "text": ""}
{"title": "加密心跳阻挡试图侵入医用植入物的黑客", "url": "https://www.freebuf.com/news/12898.html", "time": "2013-09-21", "level": "", "num_look": 113916, "num_comment": 3, "author": "当当", "tags": ["资讯"], "text": ""}
{"title": "网络安全公司FireEye IPO达每股20美元，超出此前股票发行价格区间", "url": "https://www.freebuf.com/news/12879.html", "time": "2013-09-21", "level": "", "num_look": 174896, "num_comment": 2, "author": "thanks", "tags": ["资讯"], "text": ""}
{"title": "NSA从法国安全公司VUPEN购买0day漏洞", "url": "https://www.freebuf.com/news/12806.html", "time": "2013-09-20", "level": "", "num_look": 112170, "num_comment": 6, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "曝美国国家安全局（NSA）曾伪装成Google截取用户数据", "url": "https://www.freebuf.com/news/12557.html", "time": "2013-09-18", "level": "", "num_look": 136708, "num_comment": 11, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "对国内各种安全卫士产品的一种通用虐杀、DLL注入、本地代码执行的方法", "url": "https://www.freebuf.com/vuls/12597.html", "time": "2013-09-18", "level": "红色标题", "num_look": 411575, "num_comment": 34, "author": "Drizzle.Risk", "tags": ["漏洞", "视频"], "text": ""}
{"title": "[专题]叙利亚电子军专访：如果美国打我们，我们会开始攻击他们", "url": "https://www.freebuf.com/news/12566.html", "time": "2013-09-18", "level": "", "num_look": 205385, "num_comment": 16, "author": "maxcoco", "tags": ["头条", "资讯"], "text": ""}
{"title": "9.18将至，日本政府呼吁准备应对来自中国的网络攻击", "url": "https://www.freebuf.com/news/12574.html", "time": "2013-09-13", "level": "红色标题", "num_look": 232402, "num_comment": 31, "author": "tobe", "tags": ["资讯"], "text": ""}
{"title": "快速禁用Admin账户工具", "url": "https://www.freebuf.com/sectool/12542.html", "time": "2013-09-13", "level": "", "num_look": 187726, "num_comment": 8, "author": "Serpent", "tags": ["工具"], "text": ""}
{"title": "《卫报》再爆猛料--NSA跟以色列存在数据分享合作关系", "url": "https://www.freebuf.com/news/12527.html", "time": "2013-09-13", "level": "", "num_look": 98863, "num_comment": 98863, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "北京14岁极客发明神奇眼罩可控制梦境（视频）", "url": "https://www.freebuf.com/news/12545.html", "time": "2013-09-13", "level": "", "num_look": 294866, "num_comment": 25, "author": "jobs", "tags": ["极客", "资讯"], "text": ""}
{"title": "地下论坛出售PHP DDOS攻击脚本", "url": "https://www.freebuf.com/news/12536.html", "time": "2013-09-13", "level": "", "num_look": 380837, "num_comment": 21, "author": "lock", "tags": ["资讯"], "text": ""}
{"title": "知名安全扫描工具Appscan8.7破解版（下载）", "url": "https://www.freebuf.com/sectool/12511.html", "time": "2013-09-12", "level": "", "num_look": 782226, "num_comment": 71, "author": "葙守", "tags": ["工具"], "text": ""}
{"title": "苹果透露更多Touch ID的安全细节", "url": "https://www.freebuf.com/news/12510.html", "time": "2013-09-12", "level": "", "num_look": 149443, "num_comment": 149443, "author": "dangdang", "tags": ["资讯"], "text": ""}
{"title": "先行打击行业：深入了解安全公司CrowdStrike", "url": "https://www.freebuf.com/news/12499.html", "time": "2013-09-12", "level": "", "num_look": 497687, "num_comment": 19, "author": "cs24", "tags": ["头条", "资讯"], "text": "过去两年安全领域里，APT攻击成为热门话题，因此而产生的新型公司如雨后春笋。今天我们介绍一个号称改变APT防御游戏规则的新型安全公司CrowdStrike。"}
{"title": "安全深喉-有奖征文大赛第二季获奖作品公布", "url": "https://www.freebuf.com/news/12419.html", "time": "2013-09-12", "level": "", "num_look": 188995, "num_comment": 12, "author": "FB客服", "tags": ["周边", "资讯"], "text": ""}
{"title": "存在漏洞的Java及Flash版本使用者众多", "url": "https://www.freebuf.com/news/12451.html", "time": "2013-09-12", "level": "", "num_look": 139888, "num_comment": 3, "author": "Serpent", "tags": ["资讯"], "text": ""}
{"title": "十字路口的守望者：17岁白帽黑客的成长之路（视频）", "url": "https://www.freebuf.com/video/12984.html", "time": "2013-09-11", "level": "红色标题", "num_look": 520102, "num_comment": 76, "author": "helen", "tags": ["视频"], "text": ""}
{"title": "针对亚马逊云服务器（AWS）的渗透测试工具——Nimbostratus", "url": "https://www.freebuf.com/sectool/12480.html", "time": "2013-09-11", "level": "", "num_look": 299966, "num_comment": 7, "author": "fake", "tags": ["工具"], "text": ""}
{"title": "「棱镜门」再升级？NSA(美国国家安全局)可窃取公民智能手机上的隐私信息", "url": "https://www.freebuf.com/news/12455.html", "time": "2013-09-11", "level": "", "num_look": 157310, "num_comment": 4, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "热议：iPhone 5S使用指纹识别技术，黑客能否破解？", "url": "https://www.freebuf.com/articles/others-articles/12472.html", "time": "2013-09-11", "level": "", "num_look": 153533, "num_comment": 10, "author": "jack", "tags": ["其他"], "text": ""}
{"title": "Facebook再一次拒付赏金：删除Facebook任意账号漏洞", "url": "https://www.freebuf.com/news/12444.html", "time": "2013-09-11", "level": "", "num_look": 165451, "num_comment": 14, "author": "softbug", "tags": ["资讯"], "text": ""}
{"title": "一次服务器被入侵后的分析", "url": "https://www.freebuf.com/articles/system/12443.html", "time": "2013-09-11", "level": "红色标题", "num_look": 486515, "num_comment": 28, "author": "litdg", "tags": ["系统安全"], "text": ""}
{"title": "新型安全公司CrowdStrike获3000万美元融资", "url": "https://www.freebuf.com/news/12454.html", "time": "2013-09-11", "level": "", "num_look": 158079, "num_comment": 8, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "《钢铁侠》中的科技——印度黑客制造人工智能操作系统", "url": "https://www.freebuf.com/news/12388.html", "time": "2013-09-10", "level": "", "num_look": 318904, "num_comment": 12, "author": "嘎巴", "tags": ["资讯"], "text": ""}
{"title": "恶意软件利用广告网络将受害者引导至BLACKHOLE", "url": "https://www.freebuf.com/news/12416.html", "time": "2013-09-10", "level": "", "num_look": 103223, "num_comment": 2, "author": "Serpent", "tags": ["资讯"], "text": ""}
{"title": "ESET发现新的银行木马-Hesperbot", "url": "https://www.freebuf.com/news/12422.html", "time": "2013-09-10", "level": "", "num_look": 129039, "num_comment": 7, "author": "lock", "tags": ["资讯"], "text": ""}
{"title": "英国科学家研发出“不可破解的”量子密码", "url": "https://www.freebuf.com/news/12371.html", "time": "2013-09-06", "level": "", "num_look": 136330, "num_comment": 12, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "外国媒体对中国cn域名被ddos攻击的一篇报导", "url": "https://www.freebuf.com/news/12320.html", "time": "2013-09-06", "level": "", "num_look": 148619, "num_comment": 10, "author": "maxcoco", "tags": ["资讯"], "text": ""}
{"title": "FreeBuf线上活动：9月黑客晒书会（第一期）", "url": "https://www.freebuf.com/news/others/12323.html", "time": "2013-09-06", "level": "红色标题", "num_look": 749142, "num_comment": 115, "author": "softbug", "tags": ["周边", "活动"], "text": ""}
{"title": "又一款linux提权辅助工具 - Linux_Exploit_Suggester", "url": "https://www.freebuf.com/sectool/12365.html", "time": "2013-09-06", "level": "", "num_look": 418332, "num_comment": 8, "author": "H3lvin", "tags": ["工具"], "text": ""}
{"title": "[更新]GPU密码破解工具oclHashcat-plus V0.15", "url": "https://www.freebuf.com/sectool/12360.html", "time": "2013-09-06", "level": "", "num_look": 732590, "num_comment": 14, "author": "lock", "tags": ["工具"], "text": ""}
{"title": "DROPBOX随时可能被黑掉！", "url": "https://www.freebuf.com/news/12339.html", "time": "2013-09-06", "level": "", "num_look": 139330, "num_comment": 9, "author": "softbug", "tags": ["资讯"], "text": ""}
{"title": "基于心跳验证技术的手环：可代替密码和钥匙", "url": "https://www.freebuf.com/geek/12342.html", "time": "2013-09-05", "level": "", "num_look": 298710, "num_comment": 10, "author": "geekpark", "tags": ["极客"], "text": ""}
{"title": "走近科学：揭秘全美第一黑客组织Anonymous（匿名者）的装备库", "url": "https://www.freebuf.com/news/12280.html", "time": "2013-09-05", "level": "红色标题", "num_look": 5156704, "num_comment": 95, "author": "xiao_hen", "tags": ["头条", "工具"], "text": ""}
{"title": "信息系统整体安全生命周期设计", "url": "https://www.freebuf.com/articles/others-articles/12308.html", "time": "2013-09-05", "level": "", "num_look": 217737, "num_comment": 23, "author": "zglxw", "tags": ["其他"], "text": ""}
{"title": "英国议会电脑访问色情网站达30万次", "url": "https://www.freebuf.com/news/12329.html", "time": "2013-09-05", "level": "", "num_look": 171240, "num_comment": 12, "author": "lock", "tags": ["资讯"], "text": ""}
{"title": "怎样解释OSX 10.8和iOS 6系统应用崩溃漏洞的原因？", "url": "https://www.freebuf.com/articles/wireless/12266.html", "time": "2013-09-04", "level": "", "num_look": 220806, "num_comment": 7, "author": "Mystery", "tags": ["无线安全", "终端安全"], "text": ""}
{"title": "数十万中兴设备存在安全隐患", "url": "https://www.freebuf.com/news/12315.html", "time": "2013-09-04", "level": "红色标题", "num_look": 207394, "num_comment": 24, "author": "中枪部门", "tags": ["资讯"], "text": ""}
{"title": "Gamma产品介绍册曝光 执法部门可获类“棱镜”项目监控能力", "url": "https://www.freebuf.com/news/12278.html", "time": "2013-09-04", "level": "", "num_look": 105847, "num_comment": 3, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "思科漏洞导致黑客可以控制其系统（For Windows）", "url": "https://www.freebuf.com/news/12289.html", "time": "2013-09-04", "level": "", "num_look": 120106, "num_comment": 6, "author": "softbug", "tags": ["资讯"], "text": ""}
{"title": "[专题]叙利亚电子军展开反击，入侵美国海军陆战队网站", "url": "https://www.freebuf.com/news/12300.html", "time": "2013-09-04", "level": "", "num_look": 139757, "num_comment": 14, "author": "H3lvin", "tags": ["头条", "资讯"], "text": ""}
{"title": "热议：手机丢了你的支付宝还安全吗？", "url": "https://www.freebuf.com/articles/wireless/12273.html", "time": "2013-09-03", "level": "红色标题", "num_look": 591271, "num_comment": 29, "author": "iceyes", "tags": ["无线安全", "终端安全"], "text": ""}
{"title": "2013年SyScan360前瞻信息安全年会门票限时发送", "url": "https://www.freebuf.com/news/12281.html", "time": "2013-09-03", "level": "红色标题", "num_look": 247995, "num_comment": 16, "author": "FB独家", "tags": ["周边", "活动"], "text": ""}
{"title": "自动无线渗透测试工具——Wi-fEye", "url": "https://www.freebuf.com/sectool/12252.html", "time": "2013-09-03", "level": "", "num_look": 431782, "num_comment": 13, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "携程旅行网招聘安全架构师等", "url": "https://www.freebuf.com/jobs/12264.html", "time": "2013-09-03", "level": "", "num_look": 133957, "num_comment": 17, "author": "ctrip_security", "tags": ["安全招聘"], "text": ""}
{"title": "[专题]美黑客组织Anonymous向SEA（叙利亚电子军）宣战", "url": "https://www.freebuf.com/news/12270.html", "time": "2013-09-03", "level": "", "num_look": 228408, "num_comment": 11, "author": "phper", "tags": ["头条", "资讯"], "text": ""}
{"title": "关于PHP代码审计和漏洞挖掘的一点思考", "url": "https://www.freebuf.com/articles/web/12232.html", "time": "2013-09-02", "level": "", "num_look": 1084167, "num_comment": 22, "author": "LittleHann", "tags": ["WEB安全"], "text": ""}
{"title": "Wireshark（著名抓包工具）电子书整理", "url": "https://www.freebuf.com/articles/others-articles/11989.html", "time": "2013-09-02", "level": "", "num_look": 610181, "num_comment": 39, "author": "xiao_hen", "tags": ["其他"], "text": ""}
{"title": "苹果新技术允许政府远程控制你的iPhone", "url": "https://www.freebuf.com/news/12194.html", "time": "2013-09-02", "level": "", "num_look": 136612, "num_comment": 9, "author": "嘎巴", "tags": ["资讯"], "text": ""}
{"title": "一款国外开源会话劫持（XSS）平台——CookieCatcher", "url": "https://www.freebuf.com/sectool/12248.html", "time": "2013-09-02", "level": "", "num_look": 321573, "num_comment": 4, "author": "geekpark", "tags": ["工具"], "text": ""}
{"title": "观点：给“百度云盘”产品的几点安全建议", "url": "https://www.freebuf.com/articles/others-articles/12238.html", "time": "2013-09-02", "level": "红色标题", "num_look": 488637, "num_comment": 40, "author": "jiayzhan", "tags": ["其他", "观点"], "text": ""}
{"title": "2013电子商务与支付行业——信息安全高峰论坛纪实（上海）", "url": "https://www.freebuf.com/news/others/12224.html", "time": "2013-09-02", "level": "", "num_look": 350176, "num_comment": 8, "author": "maxcoco", "tags": ["其他", "周边"], "text": ""}
{"title": "Socks代理反弹突破内网", "url": "https://www.freebuf.com/articles/system/12182.html", "time": "2013-09-02", "level": "", "num_look": 3891771, "num_comment": 24, "author": "fjhh", "tags": ["系统安全"], "text": ""}
{"title": "OSX 10.8和iOS 6系统爆致应用崩溃的漏洞", "url": "https://www.freebuf.com/news/12205.html", "time": "2013-08-30", "level": "", "num_look": 134486, "num_comment": 6, "author": "奶茶", "tags": ["资讯"], "text": ""}
{"title": "什么是「黑客」？", "url": "https://www.freebuf.com/articles/others-articles/12204.html", "time": "2013-08-30", "level": "", "num_look": 205029, "num_comment": 19, "author": "dangdang", "tags": ["其他"], "text": ""}
{"title": "[8-24,25]TSRC北京安全沙龙实录", "url": "https://www.freebuf.com/news/others/12197.html", "time": "2013-08-30", "level": "", "num_look": 223700, "num_comment": 20, "author": "lake9", "tags": ["其他", "周边"], "text": ""}
{"title": "如何导出Windows哈希系列二", "url": "https://www.freebuf.com/articles/system/12140.html", "time": "2013-08-30", "level": "", "num_look": 273318, "num_comment": 8, "author": "Mystery", "tags": ["系统安全"], "text": ""}
{"title": "美国政府利用Anonymous和Lulzsec等黑客组织对其他国家进行攻击", "url": "https://www.freebuf.com/news/12191.html", "time": "2013-08-30", "level": "", "num_look": 153491, "num_comment": 9, "author": "phper", "tags": ["资讯"], "text": ""}
{"title": "如何攻击WEB应用程序（连载一）", "url": "https://www.freebuf.com/articles/web/12133.html", "time": "2013-08-30", "level": "", "num_look": 470067, "num_comment": 36, "author": "softbug", "tags": ["WEB安全"], "text": ""}
{"title": "杂说卡片与卡片安全 (让我们来说说低频卡/高频卡/磁条卡和接触式卡)", "url": "https://www.freebuf.com/articles/wireless/12164.html", "time": "2013-08-30", "level": "", "num_look": 485217, "num_comment": 22, "author": "waynezhang", "tags": ["无线安全", "极客"], "text": ""}
{"title": "维基解密为斯诺登筹的3791个比特币，折合人民币270W", "url": "https://www.freebuf.com/news/12178.html", "time": "2013-08-30", "level": "", "num_look": 142138, "num_comment": 7, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "24岁黑客因叫卖美国能源部超级计算机账户被捕", "url": "https://www.freebuf.com/news/12155.html", "time": "2013-08-29", "level": "", "num_look": 120980, "num_comment": 10, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "Discuz修改用户密码POC的分析和思考", "url": "https://www.freebuf.com/articles/web/12088.html", "time": "2013-08-29", "level": "", "num_look": 511715, "num_comment": 15, "author": "LittleHann", "tags": ["WEB安全"], "text": ""}
{"title": "18个扩展让你的Firefox成为渗透测试工具", "url": "https://www.freebuf.com/sectool/11544.html", "time": "2013-08-29", "level": "红色标题", "num_look": 994577, "num_comment": 24, "author": "Rocketer", "tags": ["工具"], "text": ""}
{"title": "[实录]被美国0day交易大户1337day欺骗500美金全过程", "url": "https://www.freebuf.com/news/others/12138.html", "time": "2013-08-29", "level": "", "num_look": 416794, "num_comment": 37, "author": "gengencao", "tags": ["WEB安全", "其他"], "text": ""}
{"title": "浅谈企业运维安全", "url": "https://www.freebuf.com/articles/system/12104.html", "time": "2013-08-28", "level": "", "num_look": 498845, "num_comment": 33, "author": "Rozero", "tags": ["企业安全", "系统安全"], "text": ""}
{"title": "SEA利用域名注册系统漏洞修改记录攻击Twitter和纽约时报等热门网站", "url": "https://www.freebuf.com/news/12125.html", "time": "2013-08-28", "level": "", "num_look": 127122, "num_comment": 8, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "windows防火墙日志在IP追踪的利用", "url": "https://www.freebuf.com/articles/system/12057.html", "time": "2013-08-28", "level": "", "num_look": 311561, "num_comment": 4, "author": "litdg", "tags": ["系统安全"], "text": ""}
{"title": "技术剖析中国菜刀之系列二", "url": "https://www.freebuf.com/articles/web/12064.html", "time": "2013-08-28", "level": "红色标题", "num_look": 1345514, "num_comment": 23, "author": "FB独家", "tags": ["WEB安全"], "text": ""}
{"title": "如何导出Windows哈希系列一", "url": "https://www.freebuf.com/articles/system/12035.html", "time": "2013-08-28", "level": "", "num_look": 518670, "num_comment": 21, "author": "Mystery", "tags": ["系统安全"], "text": ""}
{"title": "细数ZoomEye暂停服务背后的故事", "url": "https://www.freebuf.com/news/others/12044.html", "time": "2013-08-27", "level": "", "num_look": 245022, "num_comment": 16, "author": "李天一", "tags": ["其他", "周边"], "text": ""}
{"title": "赶集网招聘安全工程师", "url": "https://www.freebuf.com/jobs/12052.html", "time": "2013-08-27", "level": "", "num_look": 176701, "num_comment": 17, "author": "condor", "tags": ["安全招聘"], "text": ""}
{"title": "Kcon v2知道Web安全论坛全记录", "url": "https://www.freebuf.com/news/11994.html", "time": "2013-08-27", "level": "", "num_look": 278344, "num_comment": 29, "author": "FB独家", "tags": ["资讯"], "text": ""}
{"title": "[FREEBUF人物志]第三期：听黑客圈前辈鹰总（cnhawk郑歆炜）讲故事", "url": "https://www.freebuf.com/news/topnews/11992.html", "time": "2013-08-27", "level": "红色标题", "num_look": 365397, "num_comment": 33, "author": "FB独家", "tags": ["人物志", "头条"], "text": ""}
{"title": "Mozilla推出FuzzDB，安全测试用例数据库", "url": "https://www.freebuf.com/articles/database/11986.html", "time": "2013-08-27", "level": "", "num_look": 220405, "num_comment": 3, "author": "雨路", "tags": ["数据安全"], "text": ""}
{"title": "智能家居协议数据包拦截工具-Z-Force", "url": "https://www.freebuf.com/sectool/12060.html", "time": "2013-08-27", "level": "", "num_look": 221609, "num_comment": 2, "author": "lock", "tags": ["工具", "极客"], "text": ""}
{"title": "Zmap详细用户手册及DDOS的可行性", "url": "https://www.freebuf.com/sectool/11985.html", "time": "2013-08-26", "level": "", "num_look": 687661, "num_comment": 37, "author": "hello world", "tags": ["工具"], "text": ""}
{"title": "日本举办黑客大赛比拼网络攻击技能，数名警察参赛", "url": "https://www.freebuf.com/news/11976.html", "time": "2013-08-26", "level": "", "num_look": 120009, "num_comment": 6, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "服务器文件批量下载工具：Web Cloner v0.1", "url": "https://www.freebuf.com/sectool/11937.html", "time": "2013-08-26", "level": "", "num_look": 236656, "num_comment": 8, "author": "winger", "tags": ["工具"], "text": ""}
{"title": "图片分享站点Pinterest爆漏洞，威胁数千万用户隐私", "url": "https://www.freebuf.com/news/12014.html", "time": "2013-08-26", "level": "", "num_look": 134004, "num_comment": 10, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "XCon上的对3D打印的安全攻击浅析[附中文版pdf下载]", "url": "https://www.freebuf.com/news/12001.html", "time": "2013-08-26", "level": "", "num_look": 133811, "num_comment": 10, "author": "嘎巴嘎巴", "tags": ["资讯"], "text": ""}
{"title": ".cn根域名服务器遭遇有史最大的DDOS攻击", "url": "https://www.freebuf.com/news/12000.html", "time": "2013-08-26", "level": "", "num_look": 157444, "num_comment": 16, "author": "嘎巴嘎巴", "tags": ["资讯"], "text": ""}
{"title": "Linux枚举及权限提升检查工具——LinEnum", "url": "https://www.freebuf.com/sectool/11973.html", "time": "2013-08-23", "level": "", "num_look": 246641, "num_comment": 6, "author": "北极公爵", "tags": ["工具"], "text": ""}
{"title": "后门制造工厂——The Backdoor Factory", "url": "https://www.freebuf.com/sectool/11972.html", "time": "2013-08-23", "level": "", "num_look": 328419, "num_comment": 8, "author": "fake", "tags": ["工具"], "text": ""}
{"title": "[极客有意思]人人都爱免费洗衣", "url": "https://www.freebuf.com/geek/11968.html", "time": "2013-08-23", "level": "", "num_look": 335286, "num_comment": 13, "author": "blue", "tags": ["极客"], "text": ""}
{"title": "浅析CDN安全", "url": "https://www.freebuf.com/articles/web/11947.html", "time": "2013-08-22", "level": "", "num_look": 430828, "num_comment": 19, "author": "mars", "tags": ["WEB安全"], "text": ""}
{"title": "BurpSuite权限提升漏洞检测插件——The Burp SessionAuth", "url": "https://www.freebuf.com/sectool/11905.html", "time": "2013-08-22", "level": "", "num_look": 229714, "num_comment": 9, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "利用Teensy进行EM410x卡模拟以及暴力破解EM410X类门禁系统可行性猜想", "url": "https://www.freebuf.com/geek/11944.html", "time": "2013-08-22", "level": "", "num_look": 212218, "num_comment": 16, "author": "radiowar", "tags": ["极客"], "text": ""}
{"title": "北美英雄联盟遭黑客攻击，批量信用卡信息泄露", "url": "https://www.freebuf.com/news/11940.html", "time": "2013-08-22", "level": "", "num_look": 151577, "num_comment": 8, "author": "lock", "tags": ["资讯"], "text": ""}
{"title": "Chrome发布版本29，修复了25个漏洞", "url": "https://www.freebuf.com/news/11933.html", "time": "2013-08-21", "level": "", "num_look": 119116, "num_comment": 3, "author": "lock", "tags": ["资讯"], "text": ""}
{"title": "从哲学角度看渗透之关于渗透与高智商电影", "url": "https://www.freebuf.com/articles/others-articles/11914.html", "time": "2013-08-21", "level": "红色标题", "num_look": 417588, "num_comment": 32, "author": "helen2013", "tags": ["其他"], "text": ""}
{"title": "OsmocomBB安装方法", "url": "https://www.freebuf.com/articles/wireless/11910.html", "time": "2013-08-21", "level": "", "num_look": 970389, "num_comment": 48, "author": "radiowar", "tags": ["无线安全"], "text": ""}
{"title": "XST漏洞检测工具 - nTrace", "url": "https://www.freebuf.com/sectool/11917.html", "time": "2013-08-21", "level": "", "num_look": 255598, "num_comment": 7, "author": "H3lvin", "tags": ["工具"], "text": ""}
{"title": "没拿到Facebook漏洞奖金，安全同行募资赞助", "url": "https://www.freebuf.com/news/11918.html", "time": "2013-08-21", "level": "", "num_look": 153220, "num_comment": 10, "author": "blue", "tags": ["资讯"], "text": ""}
{"title": "[科普]嗅探(被动嗅探)与ARP欺骗(主动嗅探)详解", "url": "https://www.freebuf.com/articles/system/11846.html", "time": "2013-08-20", "level": "", "num_look": 659523, "num_comment": 17, "author": "mars", "tags": ["系统安全"], "text": ""}
{"title": "本地网络攻击测试集成工具——Zarp", "url": "https://www.freebuf.com/sectool/11902.html", "time": "2013-08-20", "level": "", "num_look": 361085, "num_comment": 9, "author": "thanks", "tags": ["工具"], "text": ""}
{"title": "浅谈web后门隐藏与检测思路", "url": "https://www.freebuf.com/articles/web/11878.html", "time": "2013-08-20", "level": "", "num_look": 364801, "num_comment": 28, "author": "yexia", "tags": ["WEB安全"], "text": ""}
{"title": "[科普]入侵检测系统ossec配置文件详解", "url": "https://www.freebuf.com/articles/system/11862.html", "time": "2013-08-20", "level": "", "num_look": 686149, "num_comment": 10, "author": "Rozero", "tags": ["系统安全"], "text": ""}
{"title": "LastPass泄露明文密码", "url": "https://www.freebuf.com/news/11898.html", "time": "2013-08-20", "level": "", "num_look": 207105, "num_comment": 9, "author": "lock", "tags": ["资讯"], "text": ""}
{"title": "美商用7.5亿台币买下台湾安全公司阿玛科技", "url": "https://www.freebuf.com/news/11895.html", "time": "2013-08-19", "level": "", "num_look": 150007, "num_comment": 14, "author": "g0dh4ck", "tags": ["资讯"], "text": ""}
{"title": "ZMap：在一个小时内扫描整个互联网", "url": "https://www.freebuf.com/sectool/11884.html", "time": "2013-08-19", "level": "", "num_look": 358494, "num_comment": 21, "author": "Jetty", "tags": ["工具"], "text": ""}
{"title": "Facebook创始人扎克伯格个人主页被黑", "url": "https://www.freebuf.com/news/11880.html", "time": "2013-08-19", "level": "", "num_look": 149948, "num_comment": 20, "author": "blue", "tags": ["资讯"], "text": ""}
{"title": "2013中国互联网安全大会门票限时发送", "url": "https://www.freebuf.com/news/others/11863.html", "time": "2013-08-19", "level": "", "num_look": 222042, "num_comment": 37, "author": "FB独家", "tags": ["周边", "活动"], "text": ""}
{"title": "Sharepoint和Frontpage安全审计工具 - Sparty V0.1", "url": "https://www.freebuf.com/sectool/11861.html", "time": "2013-08-19", "level": "", "num_look": 215168, "num_comment": 14, "author": "lock", "tags": ["工具"], "text": ""}
{"title": "越南facebook遭中国黑客入侵", "url": "https://www.freebuf.com/news/11850.html", "time": "2013-08-19", "level": "红色标题", "num_look": 456268, "num_comment": 30, "author": "FB神一样的记者", "tags": ["资讯"], "text": ""}
{"title": "[科普]跨站请求伪造-CSRF防护方法", "url": "https://www.freebuf.com/articles/web/11840.html", "time": "2013-08-19", "level": "", "num_look": 805164, "num_comment": 7, "author": "褪色的黑", "tags": ["WEB安全"], "text": ""}
{"title": "行业内外：网络安全主管年薪80万仍供不应求?", "url": "https://www.freebuf.com/news/11837.html", "time": "2013-08-16", "level": "", "num_look": 146498, "num_comment": 23, "author": "phper", "tags": ["资讯"], "text": ""}
{"title": "TV游戏《WatchDogs》即将发布，预演未来黑客时代", "url": "https://www.freebuf.com/news/11812.html", "time": "2013-08-16", "level": "", "num_look": 124633, "num_comment": 6, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "[更新]开源web漏洞扫描系统-IronWASP v0.9.6.5", "url": "https://www.freebuf.com/sectool/11819.html", "time": "2013-08-16", "level": "", "num_look": 169622, "num_comment": 4, "author": "lock", "tags": ["工具"], "text": ""}
{"title": "中国超过1600个网站遭土耳其黑客入侵", "url": "https://www.freebuf.com/news/11816.html", "time": "2013-08-16", "level": "", "num_look": 331812, "num_comment": 20, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "知名安全扫描器Acunetix WVS中文教程（PDF下载）", "url": "https://www.freebuf.com/news/others/11792.html", "time": "2013-08-15", "level": "", "num_look": 836369, "num_comment": 35, "author": "Gall", "tags": ["其他", "周边"], "text": ""}
{"title": "FreeBuf特别策划：追踪黑客！7月全球网络空间攻击事件全纪录", "url": "https://www.freebuf.com/news/topnews/11796.html", "time": "2013-08-15", "level": "红色标题", "num_look": 214918, "num_comment": 7, "author": "柯南", "tags": ["头条"], "text": ""}
{"title": "无节操的黑客 - 劫持宝宝监视器恐吓婴儿", "url": "https://www.freebuf.com/news/11794.html", "time": "2013-08-15", "level": "", "num_look": 167966, "num_comment": 18, "author": "lock", "tags": ["资讯"], "text": ""}
{"title": "N-Stalker WEB漏洞扫描器", "url": "https://www.freebuf.com/sectool/11740.html", "time": "2013-08-14", "level": "", "num_look": 465209, "num_comment": 11, "author": "unshell", "tags": ["工具"], "text": ""}
{"title": "揭密HTML5带来的攻击手法", "url": "https://www.freebuf.com/articles/web/11779.html", "time": "2013-08-14", "level": "", "num_look": 538439, "num_comment": 14, "author": "lock", "tags": ["WEB安全"], "text": ""}
{"title": "西藏“政府”网站遭黑客实施水坑攻击", "url": "https://www.freebuf.com/news/11781.html", "time": "2013-08-14", "level": "", "num_look": 264401, "num_comment": 22, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "SSH蜜罐工具 - HonSSH", "url": "https://www.freebuf.com/sectool/11777.html", "time": "2013-08-13", "level": "", "num_look": 276889, "num_comment": 11, "author": "lock", "tags": ["工具"], "text": ""}
{"title": "ISF（2013）议题征集函", "url": "https://www.freebuf.com/news/11769.html", "time": "2013-08-13", "level": "红色标题", "num_look": 160622, "num_comment": 8, "author": "ISF2013", "tags": ["资讯"], "text": ""}
{"title": "Cobalt Strike Windows版破解", "url": "https://www.freebuf.com/sectool/11734.html", "time": "2013-08-13", "level": "", "num_look": 350915, "num_comment": 12, "author": "tornado", "tags": ["工具"], "text": ""}
{"title": "大数据在硅谷企业的应用", "url": "https://www.freebuf.com/articles/others-articles/11764.html", "time": "2013-08-13", "level": "", "num_look": 134226, "num_comment": 134226, "author": "tobe", "tags": ["其他"], "text": ""}
{"title": "观点：杀毒软件，这样是否会更好？", "url": "https://www.freebuf.com/articles/others-articles/11718.html", "time": "2013-08-12", "level": "", "num_look": 173297, "num_comment": 18, "author": "softbug", "tags": ["其他", "观点"], "text": ""}
{"title": "恶意软件分析工具 - Pyew", "url": "https://www.freebuf.com/sectool/11758.html", "time": "2013-08-12", "level": "", "num_look": 241530, "num_comment": 3, "author": "why", "tags": ["工具"], "text": ""}
{"title": "LulzSec组织第二大黑客被判处1年监禁，赔偿605,663美元", "url": "https://www.freebuf.com/news/11753.html", "time": "2013-08-12", "level": "", "num_look": 168346, "num_comment": 10, "author": "phper", "tags": ["资讯"], "text": ""}
{"title": "Proxmark3安装Android客户端", "url": "https://www.freebuf.com/geek/11724.html", "time": "2013-08-12", "level": "", "num_look": 585322, "num_comment": 8, "author": "radiowar", "tags": ["极客"], "text": ""}
{"title": "Nmap --script 命令帮助手册", "url": "https://www.freebuf.com/sectool/11717.html", "time": "2013-08-12", "level": "", "num_look": 372642, "num_comment": 10, "author": "ver007", "tags": ["工具"], "text": ""}
{"title": "庆祝10周年，海盗湾发布新款浏览器", "url": "https://www.freebuf.com/news/11748.html", "time": "2013-08-12", "level": "", "num_look": 116435, "num_comment": 5, "author": "blue", "tags": ["资讯"], "text": ""}
{"title": "观点：再谈工程师文化", "url": "https://www.freebuf.com/news/others/11322.html", "time": "2013-08-09", "level": "", "num_look": 175922, "num_comment": 18, "author": "vexs", "tags": ["其他", "周边"], "text": ""}
{"title": "知道创宇招聘各类攻城狮", "url": "https://www.freebuf.com/jobs/11712.html", "time": "2013-08-09", "level": "", "num_look": 301808, "num_comment": 31, "author": "知道创宇", "tags": ["安全招聘"], "text": ""}
{"title": "研究人员指控Google Chrome 密码储存功能有安全漏洞", "url": "https://www.freebuf.com/news/11713.html", "time": "2013-08-09", "level": "", "num_look": 137187, "num_comment": 10, "author": "blue", "tags": ["资讯"], "text": ""}
{"title": "硅谷安全公司扫描之Palo Alto Networks", "url": "https://www.freebuf.com/news/11710.html", "time": "2013-08-09", "level": "", "num_look": 437536, "num_comment": 5, "author": "tobe", "tags": ["资讯"], "text": ""}
{"title": "网络犯罪工具攻克汇丰银行的反木马技术", "url": "https://www.freebuf.com/news/11705.html", "time": "2013-08-09", "level": "", "num_look": 108369, "num_comment": 3, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "在Linux系统上执行MacOS应用的模拟器", "url": "https://www.freebuf.com/articles/others-articles/11683.html", "time": "2013-08-09", "level": "", "num_look": 123125, "num_comment": 3, "author": "h4dex", "tags": ["其他"], "text": ""}
{"title": "KCon v2知道Web安全论坛召开在即", "url": "https://www.freebuf.com/news/others/11694.html", "time": "2013-08-08", "level": "", "num_look": 189186, "num_comment": 16, "author": "知道创宇", "tags": ["其他", "周边"], "text": ""}
{"title": "一小时赚1.5到2万美元的黑客", "url": "https://www.freebuf.com/news/11697.html", "time": "2013-08-08", "level": "", "num_look": 181383, "num_comment": 18, "author": "blue", "tags": ["资讯"], "text": ""}
{"title": "OWASP出品：Xenotix XSS漏洞测试框架", "url": "https://www.freebuf.com/sectool/11678.html", "time": "2013-08-08", "level": "", "num_look": 367289, "num_comment": 29, "author": "fake", "tags": ["工具"], "text": ""}
{"title": "虚拟世界的安全威胁", "url": "https://www.freebuf.com/articles/others-articles/11693.html", "time": "2013-08-08", "level": "", "num_look": 226508, "num_comment": 4, "author": "H3lvin", "tags": ["其他"], "text": ""}
{"title": "Fireeye技术剖析中国菜刀 - Part I", "url": "https://www.freebuf.com/articles/web/11687.html", "time": "2013-08-08", "level": "红色标题", "num_look": 1615097, "num_comment": 58, "author": "lock", "tags": ["WEB安全"], "text": ""}
{"title": "精华解读：从BlackHat2013中我们收获了什么", "url": "https://www.freebuf.com/news/topnews/11667.html", "time": "2013-08-07", "level": "", "num_look": 184297, "num_comment": 11, "author": "Jetty", "tags": ["头条"], "text": ""}
{"title": "飞机也开源了，仅需一万五千美元！", "url": "https://www.freebuf.com/geek/11680.html", "time": "2013-08-07", "level": "", "num_look": 157139, "num_comment": 9, "author": "feelit", "tags": ["极客"], "text": ""}
{"title": "利用vbs优雅的执行shellcode", "url": "https://www.freebuf.com/articles/web/11662.html", "time": "2013-08-07", "level": "", "num_look": 367277, "num_comment": 17, "author": "lcx", "tags": ["WEB安全"], "text": ""}
{"title": "IDS/IPS测试工具（渗透测试必备）", "url": "https://www.freebuf.com/sectool/11675.html", "time": "2013-08-07", "level": "", "num_look": 354271, "num_comment": 13, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "[更新]暴力破解工具Hydra 7.5版本发布", "url": "https://www.freebuf.com/sectool/11650.html", "time": "2013-08-07", "level": "", "num_look": 268961, "num_comment": 2, "author": "unshell", "tags": ["工具"], "text": ""}
{"title": "斯诺登爆料美国1969年登月是造假！", "url": "https://www.freebuf.com/news/11670.html", "time": "2013-08-07", "level": "", "num_look": 191843, "num_comment": 21, "author": "blue", "tags": ["资讯"], "text": ""}
{"title": "[DEFCON 21]黑客公布入侵汽车工具", "url": "https://www.freebuf.com/news/11665.html", "time": "2013-08-07", "level": "", "num_look": 160179, "num_comment": 11, "author": "lock", "tags": ["资讯"], "text": ""}
{"title": "量子传输技术转移一个人需要4500万亿年", "url": "https://www.freebuf.com/geek/11639.html", "time": "2013-08-06", "level": "", "num_look": 171487, "num_comment": 19, "author": "猪哥靓", "tags": ["极客"], "text": ""}
{"title": "信用卡安全问题：被用户忽视的识别码", "url": "https://www.freebuf.com/news/11625.html", "time": "2013-08-06", "level": "", "num_look": 102647, "num_comment": 3, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "[BlackHat 2013]黑客演示如何入侵智能电视", "url": "https://www.freebuf.com/news/11649.html", "time": "2013-08-06", "level": "", "num_look": 200512, "num_comment": 10, "author": "lock", "tags": ["头条", "资讯"], "text": ""}
{"title": "如何评价著名白帽黑客 Barnaby Jack 的生平及成就？", "url": "https://www.freebuf.com/news/11648.html", "time": "2013-08-06", "level": "", "num_look": 582603, "num_comment": 9, "author": "why", "tags": ["资讯"], "text": ""}
{"title": "[专题]BlackHat USA 2013第二天照片集锦", "url": "https://www.freebuf.com/news/11612.html", "time": "2013-08-05", "level": "", "num_look": 145403, "num_comment": 6, "author": "FB独家", "tags": ["头条", "资讯"], "text": ""}
{"title": "FBI使用恶意软件将Android变为间谍设备", "url": "https://www.freebuf.com/news/11642.html", "time": "2013-08-05", "level": "", "num_look": 153864, "num_comment": 6, "author": "Jetty", "tags": ["资讯"], "text": ""}
{"title": "HITCON2013台湾黑客年会全纪实", "url": "https://www.freebuf.com/news/others/11375.html", "time": "2013-08-05", "level": "红色标题", "num_look": 375505, "num_comment": 54, "author": "FB独家", "tags": ["其他", "周边"], "text": ""}
{"title": "中国黑客组织被发现试图渗透进假水电站工控系统", "url": "https://www.freebuf.com/news/11644.html", "time": "2013-08-05", "level": "", "num_look": 170741, "num_comment": 22, "author": "blue", "tags": ["资讯"], "text": ""}
{"title": "盛付通招聘安全工程师", "url": "https://www.freebuf.com/jobs/11607.html", "time": "2013-08-05", "level": "", "num_look": 111369, "num_comment": 11, "author": "xi4od", "tags": ["安全招聘"], "text": ""}
{"title": "黑客推出可将金属硬币兑换成比特币的手提箱", "url": "https://www.freebuf.com/news/11626.html", "time": "2013-08-05", "level": "", "num_look": 106043, "num_comment": 1, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "Inax Satis马桶被爆出漏洞，任何人可进行操控（视频）", "url": "https://www.freebuf.com/news/11627.html", "time": "2013-08-05", "level": "", "num_look": 165032, "num_comment": 15, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "[分享]国内安全组织PKAV-WEB安全培训课件下载", "url": "https://www.freebuf.com/articles/others-articles/11603.html", "time": "2013-08-02", "level": "", "num_look": 610928, "num_comment": 53, "author": "only_guest", "tags": ["其他"], "text": ""}
{"title": "唯品会招聘系统安全工程师", "url": "https://www.freebuf.com/jobs/11593.html", "time": "2013-08-02", "level": "", "num_look": 359334, "num_comment": 50, "author": "Rozero", "tags": ["安全招聘"], "text": ""}
{"title": "[BlackHat 2013]黑客通过Verizon毫微微蜂窝劫持手机通话、短信记录", "url": "https://www.freebuf.com/news/11589.html", "time": "2013-08-02", "level": "", "num_look": 132092, "num_comment": 5, "author": "H3lvin", "tags": ["头条", "资讯"], "text": ""}
{"title": "[BlackHat 2013]研究人员使用iPhone充电器作为黑客工具", "url": "https://www.freebuf.com/news/11586.html", "time": "2013-08-02", "level": "", "num_look": 119710, "num_comment": 7, "author": "lock", "tags": ["头条", "资讯"], "text": ""}
{"title": "Crypton开源数据安全项目：抵御互联网监督保证数据安全", "url": "https://www.freebuf.com/news/11558.html", "time": "2013-08-02", "level": "", "num_look": 95448, "num_comment": 1, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "[专题]BlackHat USA 2013第一天照片集锦", "url": "https://www.freebuf.com/news/11572.html", "time": "2013-08-02", "level": "", "num_look": 163984, "num_comment": 10, "author": "FB独家", "tags": ["头条", "资讯"], "text": ""}
{"title": "iOS&&Android APP渗透测试环境搭建与方法命令 checklist", "url": "https://www.freebuf.com/articles/wireless/11570.html", "time": "2013-08-02", "level": "", "num_look": 354306, "num_comment": 7, "author": "碳基体", "tags": ["无线安全"], "text": ""}
{"title": "Chrome,Firefox成为了账户劫持插件的目标", "url": "https://www.freebuf.com/news/11562.html", "time": "2013-08-01", "level": "", "num_look": 133043, "num_comment": 6, "author": "Jetty", "tags": ["资讯"], "text": ""}
{"title": "谈谈APP创业公司对网络安全认识的周边感悟", "url": "https://www.freebuf.com/articles/others-articles/11546.html", "time": "2013-08-01", "level": "", "num_look": 225988, "num_comment": 14, "author": "softbug", "tags": ["其他", "观点"], "text": ""}
{"title": "N合1Hash生成工具——Hash Console v1.5", "url": "https://www.freebuf.com/sectool/11377.html", "time": "2013-08-01", "level": "", "num_look": 187189, "num_comment": 4, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "揭秘黑帽大会：黑客们的“海天盛筵”", "url": "https://www.freebuf.com/news/11557.html", "time": "2013-08-01", "level": "", "num_look": 114396, "num_comment": 8, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "斯诺登再爆猛料：美国更大规模监控计划曝光", "url": "https://www.freebuf.com/news/11553.html", "time": "2013-08-01", "level": "", "num_look": 99365, "num_comment": 4, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "FireHost发布2013年第二季度排名前四的攻击方法", "url": "https://www.freebuf.com/news/11548.html", "time": "2013-08-01", "level": "", "num_look": 172786, "num_comment": 8, "author": "lock", "tags": ["资讯"], "text": ""}
{"title": "[专题]参加Blackhat和DEFCON会议安全指南", "url": "https://www.freebuf.com/news/11541.html", "time": "2013-07-31", "level": "", "num_look": 142681, "num_comment": 14, "author": "H3lvin", "tags": ["头条", "资讯"], "text": ""}
{"title": "安全深喉：FreebuF&腾讯TSRC有奖征文大赛第二季", "url": "https://www.freebuf.com/news/11345.html", "time": "2013-07-31", "level": "红色标题", "num_look": 263885, "num_comment": 17, "author": "FB独家", "tags": ["周边", "活动"], "text": ""}
{"title": "叙利亚网军劫持路透社官方twitter账户", "url": "https://www.freebuf.com/news/11534.html", "time": "2013-07-31", "level": "", "num_look": 102673, "num_comment": 3, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "土耳其释放被指控从事间谍活动的鸟", "url": "https://www.freebuf.com/news/11532.html", "time": "2013-07-31", "level": "", "num_look": 108389, "num_comment": 4, "author": "blue", "tags": ["资讯"], "text": ""}
{"title": "澳媒：联想PC因芯片存自制“后门”遭多国禁用", "url": "https://www.freebuf.com/news/11536.html", "time": "2013-07-30", "level": "", "num_look": 143644, "num_comment": 9, "author": "trace_1981", "tags": ["资讯"], "text": ""}
{"title": "FREEBUF安全周刊20130722-0726", "url": "https://www.freebuf.com/news/others/11528.html", "time": "2013-07-30", "level": "", "num_look": 140410, "num_comment": 6, "author": "FB独家", "tags": ["其他", "周边"], "text": ""}
{"title": "[专题]Black Hat 2013的热门演讲", "url": "https://www.freebuf.com/news/11523.html", "time": "2013-07-30", "level": "", "num_look": 131609, "num_comment": 7, "author": "blackscreen", "tags": ["头条", "资讯"], "text": ""}
{"title": "应用安全思维系列之二：安全实现", "url": "https://www.freebuf.com/articles/web/11493.html", "time": "2013-07-30", "level": "", "num_look": 255256, "num_comment": 26, "author": "jiayzhan", "tags": ["WEB安全", "企业安全"], "text": ""}
{"title": "黑客演示如何通过笔记本电脑入侵汽车控制系统", "url": "https://www.freebuf.com/news/11510.html", "time": "2013-07-30", "level": "", "num_look": 276288, "num_comment": 10, "author": "Jetty", "tags": ["极客", "资讯"], "text": ""}
{"title": "土耳其机场护照控制系统遭到网络攻击", "url": "https://www.freebuf.com/news/11512.html", "time": "2013-07-30", "level": "", "num_look": 108164, "num_comment": 108164, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "美黑客将在本周Defcon会议公布汽车入侵方式", "url": "https://www.freebuf.com/news/11505.html", "time": "2013-07-29", "level": "", "num_look": 146858, "num_comment": 19, "author": "fake", "tags": ["资讯"], "text": ""}
{"title": "什么是WiFiPineApple之深藏不漏", "url": "https://www.freebuf.com/articles/wireless/11478.html", "time": "2013-07-29", "level": "", "num_look": 508306, "num_comment": 20, "author": "radiowar", "tags": ["无线安全"], "text": ""}
{"title": "插件更新两款-天蝎座web渗透工具集", "url": "https://www.freebuf.com/sectool/11432.html", "time": "2013-07-29", "level": "", "num_look": 297530, "num_comment": 29, "author": "p0tt1", "tags": ["工具"], "text": ""}
{"title": "一种隐藏在JPG图片EXIF中的后门", "url": "https://www.freebuf.com/articles/web/11403.html", "time": "2013-07-29", "level": "", "num_look": 378242, "num_comment": 10, "author": "奇点云安全", "tags": ["WEB安全"], "text": ""}
{"title": "Black Hat USA 2013演讲者ATM黑客Barnaby Jack意外身亡", "url": "https://www.freebuf.com/news/11487.html", "time": "2013-07-27", "level": "红色标题", "num_look": 286142, "num_comment": 33, "author": "tobe", "tags": ["周边", "终端安全"], "text": ""}
{"title": "[专题]Blackhat 2013会议5个有趣的议题", "url": "https://www.freebuf.com/news/11475.html", "time": "2013-07-26", "level": "", "num_look": 152386, "num_comment": 14, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "视频：无人驾驶汽车并非百分百安全 它同样也会被黑", "url": "https://www.freebuf.com/news/11462.html", "time": "2013-07-26", "level": "", "num_look": 112453, "num_comment": 4, "author": "lead", "tags": ["资讯"], "text": ""}
{"title": "黑客爆PayPal SQL注入漏洞，大骂PayPal系统设计烂", "url": "https://www.freebuf.com/news/11459.html", "time": "2013-07-26", "level": "", "num_look": 155823, "num_comment": 12, "author": "phper", "tags": ["资讯"], "text": ""}
{"title": "商业银行木马新秀 - KINS", "url": "https://www.freebuf.com/news/11452.html", "time": "2013-07-26", "level": "", "num_look": 175081, "num_comment": 16, "author": "lock", "tags": ["资讯"], "text": ""}
{"title": "[电子书]渗透测试框架Metasploit基础（中文版PDF）", "url": "https://www.freebuf.com/news/others/11412.html", "time": "2013-07-25", "level": "", "num_look": 498442, "num_comment": 31, "author": "Gall", "tags": ["WEB安全", "其他"], "text": ""}
{"title": "分享一段struts st2漏洞批量查找的Python代码", "url": "https://www.freebuf.com/articles/web/11394.html", "time": "2013-07-25", "level": "", "num_look": 703379, "num_comment": 16, "author": "x55admin", "tags": ["WEB安全"], "text": ""}
{"title": "什么是WiFiPineApple之前世今生", "url": "https://www.freebuf.com/articles/wireless/11361.html", "time": "2013-07-25", "level": "", "num_look": 436850, "num_comment": 3, "author": "radiowar", "tags": ["无线安全", "极客"], "text": ""}
{"title": "SSH暴力破解经久不衰", "url": "https://www.freebuf.com/articles/system/11424.html", "time": "2013-07-25", "level": "", "num_look": 1717290, "num_comment": 21, "author": "H3lvin", "tags": ["系统安全"], "text": ""}
{"title": "梭子鱼网站发现漏洞，泄露用户信息", "url": "https://www.freebuf.com/news/11420.html", "time": "2013-07-25", "level": "", "num_look": 135671, "num_comment": 8, "author": "lock", "tags": ["资讯"], "text": ""}
{"title": "黑客电影《第五阶层》10月上映，揭秘", "url": "https://www.freebuf.com/news/others/11410.html", "time": "2013-07-24", "level": "", "num_look": 209460, "num_comment": 25, "author": "supre", "tags": ["其他", "周边"], "text": ""}
{"title": "接入网络的三星电视容易收到DOS攻击（视频&POC）", "url": "https://www.freebuf.com/news/11383.html", "time": "2013-07-24", "level": "", "num_look": 154015, "num_comment": 13, "author": "Jetty", "tags": ["资讯"], "text": ""}
{"title": "美特工潜入中国重要目标人物家中装间谍软件", "url": "https://www.freebuf.com/news/11380.html", "time": "2013-07-24", "level": "", "num_look": 119737, "num_comment": 3, "author": "ring", "tags": ["资讯"], "text": ""}
{"title": "全能暴力破解测试工具——Patator v0.5", "url": "https://www.freebuf.com/sectool/11372.html", "time": "2013-07-23", "level": "", "num_look": 399036, "num_comment": 14, "author": "geekpark", "tags": ["工具"], "text": ""}
{"title": "演示如何使用USRP监听无线键盘（视频）", "url": "https://www.freebuf.com/articles/wireless/11347.html", "time": "2013-07-23", "level": "", "num_look": 932181, "num_comment": 22, "author": "kevin2600", "tags": ["无线安全", "极客"], "text": ""}
{"title": "[FREEBUF人物志]第二期：专访魏兴国，云安全的追梦者", "url": "https://www.freebuf.com/news/topnews/11351.html", "time": "2013-07-23", "level": "红色标题", "num_look": 775628, "num_comment": 46, "author": "FB独家", "tags": ["人物志", "头条"], "text": ""}
{"title": "FaceBook价值4500美元的安全问题", "url": "https://www.freebuf.com/articles/web/11358.html", "time": "2013-07-23", "level": "", "num_look": 169531, "num_comment": 13, "author": "fake", "tags": ["WEB安全"], "text": ""}
{"title": "HITCON：台湾60家企业仍中APT1网军恶意程序", "url": "https://www.freebuf.com/news/11360.html", "time": "2013-07-23", "level": "", "num_look": 115155, "num_comment": 115155, "author": "iy_zhang", "tags": ["资讯"], "text": ""}
{"title": "神马？关于大数据黑客的吐槽", "url": "https://www.freebuf.com/articles/others-articles/11301.html", "time": "2013-07-22", "level": "", "num_look": 193715, "num_comment": 10, "author": "群水饶城", "tags": ["其他"], "text": ""}
{"title": "研究人员称黑掉一张SIM卡只需几分钟", "url": "https://www.freebuf.com/news/11336.html", "time": "2013-07-22", "level": "", "num_look": 185365, "num_comment": 22, "author": "phper", "tags": ["资讯"], "text": ""}
{"title": "WebServer端口重定向后门的研究", "url": "https://www.freebuf.com/articles/system/11305.html", "time": "2013-07-22", "level": "", "num_look": 355937, "num_comment": 32, "author": "R4cky", "tags": ["系统安全"], "text": ""}
{"title": "Ubuntu论坛，纳斯达克交易所网站遭黑客入侵", "url": "https://www.freebuf.com/news/11328.html", "time": "2013-07-22", "level": "", "num_look": 142130, "num_comment": 2, "author": "lock", "tags": ["资讯"], "text": ""}
{"title": "[专题]Blackhat2013黑帽大会:五款值得一看的黑客工具", "url": "https://www.freebuf.com/news/topnews/11326.html", "time": "2013-07-22", "level": "", "num_look": 193736, "num_comment": 6, "author": "猪哥靓", "tags": ["头条"], "text": ""}
{"title": "[专题]Blackhat2013第一天议题", "url": "https://www.freebuf.com/news/11262.html", "time": "2013-07-22", "level": "红色标题", "num_look": 330005, "num_comment": 21, "author": "FB独家", "tags": ["头条", "资讯"], "text": ""}
{"title": "有才！网友制作的Freebuf壁纸（更新）", "url": "https://www.freebuf.com/news/others/11063.html", "time": "2013-07-19", "level": "", "num_look": 462760, "num_comment": 27, "author": "thanks", "tags": ["其他", "周边"], "text": ""}
{"title": "英国政府将调查华为在英网络安全中心", "url": "https://www.freebuf.com/news/11259.html", "time": "2013-07-19", "level": "", "num_look": 119073, "num_comment": 11, "author": "h4x0r", "tags": ["资讯"], "text": ""}
{"title": "HITCON2013台湾黑客年会，深入解析网络军事行动致命环节", "url": "https://www.freebuf.com/news/11258.html", "time": "2013-07-19", "level": "红色标题", "num_look": 176592, "num_comment": 11, "author": "资安人", "tags": ["资讯"], "text": ""}
{"title": "Facebook的漏洞可以让攻击者在分分钟内重置用户账户密码", "url": "https://www.freebuf.com/news/11181.html", "time": "2013-07-18", "level": "", "num_look": 157016, "num_comment": 10, "author": "phper", "tags": ["资讯"], "text": ""}
{"title": "华硕路由器爆严重安全问题", "url": "https://www.freebuf.com/news/11247.html", "time": "2013-07-18", "level": "", "num_look": 236653, "num_comment": 1, "author": "lock", "tags": ["资讯"], "text": ""}
{"title": "浅谈大型网络入侵检测建设", "url": "https://www.freebuf.com/articles/web/11215.html", "time": "2013-07-18", "level": "", "num_look": 256202, "num_comment": 8, "author": "xti9er", "tags": ["WEB安全"], "text": ""}
{"title": "杭州安恒信息技术有限公司招聘安全服务工程师", "url": "https://www.freebuf.com/jobs/11193.html", "time": "2013-07-18", "level": "", "num_look": 167827, "num_comment": 12, "author": "shack Two", "tags": ["安全招聘"], "text": ""}
{"title": "Struts2最新远程代码执行漏洞（S2-016）官方补丁分析", "url": "https://www.freebuf.com/articles/web/11234.html", "time": "2013-07-17", "level": "", "num_look": 450332, "num_comment": 11, "author": "dingo", "tags": ["WEB安全"], "text": ""}
{"title": "[更新]Struts2再爆远程代码执行漏洞（S2-016）", "url": "https://www.freebuf.com/vuls/11220.html", "time": "2013-07-17", "level": "红色标题", "num_look": 1831727, "num_comment": 61, "author": "phper", "tags": ["漏洞"], "text": ""}
{"title": "中国黑客组织发现第二个Android万能密钥漏洞", "url": "https://www.freebuf.com/news/11214.html", "time": "2013-07-17", "level": "", "num_look": 180284, "num_comment": 6, "author": "Jetty", "tags": ["其他", "周边"], "text": ""}
{"title": "[科普]保护WiFi无线网络安全", "url": "https://www.freebuf.com/articles/wireless/11200.html", "time": "2013-07-17", "level": "", "num_look": 229547, "num_comment": 229547, "author": "G.r0b1n", "tags": ["无线安全"], "text": ""}
{"title": "针对OS X 用户的勒索网页：伪装成FBI，索要解锁费", "url": "https://www.freebuf.com/news/11205.html", "time": "2013-07-17", "level": "", "num_look": 179314, "num_comment": 3, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "[更新源码]如何用ZoomEye（钟馗之眼）批量获得站点权限", "url": "https://www.freebuf.com/articles/web/10918.html", "time": "2013-07-17", "level": "红色标题", "num_look": 1481137, "num_comment": 92, "author": "李天一", "tags": ["WEB安全"], "text": ""}
{"title": "如何设置安全的密码", "url": "https://www.freebuf.com/articles/others-articles/11186.html", "time": "2013-07-17", "level": "", "num_look": 596009, "num_comment": 13, "author": "叉叉树", "tags": ["其他", "安全管理"], "text": ""}
{"title": "如何用电视棒接收飞机信号", "url": "https://www.freebuf.com/geek/11183.html", "time": "2013-07-16", "level": "红色标题", "num_look": 1114090, "num_comment": 35, "author": "fake", "tags": ["极客"], "text": ""}
{"title": "Seay源代码审计系统2.0版本", "url": "https://www.freebuf.com/sectool/11126.html", "time": "2013-07-16", "level": "", "num_look": 563776, "num_comment": 8, "author": "seay", "tags": ["工具"], "text": ""}
{"title": "浅谈Android手机木马手工查杀", "url": "https://www.freebuf.com/articles/wireless/11175.html", "time": "2013-07-16", "level": "", "num_look": 782610, "num_comment": 39, "author": "南拳daddy", "tags": ["无线安全", "终端安全"], "text": ""}
{"title": "[分析]Mac恶意软件使用Right-to-left override技巧", "url": "https://www.freebuf.com/articles/system/11174.html", "time": "2013-07-16", "level": "", "num_look": 227448, "num_comment": 3, "author": "kelz", "tags": ["系统安全"], "text": ""}
{"title": "黑客向NSA和伊朗革命卫队出售0day漏洞", "url": "https://www.freebuf.com/news/11149.html", "time": "2013-07-15", "level": "", "num_look": 123801, "num_comment": 8, "author": "phper", "tags": ["资讯"], "text": ""}
{"title": "应用安全思维系列之一：如何保护密码才安全", "url": "https://www.freebuf.com/articles/web/11020.html", "time": "2013-07-15", "level": "红色标题", "num_look": 324529, "num_comment": 45, "author": "jiayzhan", "tags": ["WEB安全"], "text": ""}
{"title": "传输层攻击方式汇总解析", "url": "https://www.freebuf.com/articles/system/11078.html", "time": "2013-07-15", "level": "", "num_look": 199410, "num_comment": 4, "author": "Seraph", "tags": ["系统安全"], "text": ""}
{"title": "HITCON 2013会议日程公布", "url": "https://www.freebuf.com/news/11115.html", "time": "2013-07-13", "level": "红色标题", "num_look": 297484, "num_comment": 21, "author": "FB独家", "tags": ["其他", "周边"], "text": ""}
{"title": "极客DIY人力直升机，悬停时间突破60秒（视频）", "url": "https://www.freebuf.com/geek/11105.html", "time": "2013-07-12", "level": "", "num_look": 187500, "num_comment": 10, "author": "jobs", "tags": ["极客"], "text": ""}
{"title": "黑客十五年：寻找被黑金毁掉的黑客精神", "url": "https://www.freebuf.com/articles/others-articles/11098.html", "time": "2013-07-12", "level": "红色标题", "num_look": 296592, "num_comment": 46, "author": "fake", "tags": ["其他"], "text": ""}
{"title": "著名开源入侵检测系统(IDS/IPS)：Snort V2.9.5发布", "url": "https://www.freebuf.com/sectool/11095.html", "time": "2013-07-12", "level": "", "num_look": 473553, "num_comment": 11, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "谷歌安全研究人员爆出的IE漏洞被用于大规模定向入侵", "url": "https://www.freebuf.com/news/11084.html", "time": "2013-07-12", "level": "", "num_look": 132334, "num_comment": 10, "author": "J3tty", "tags": ["资讯"], "text": ""}
{"title": "日本游戏厂商Konami3万5千账号密码泄露", "url": "https://www.freebuf.com/news/11092.html", "time": "2013-07-12", "level": "", "num_look": 117366, "num_comment": 117366, "author": "Kowalski", "tags": ["资讯"], "text": ""}
{"title": "FaceBook漏洞可以获取任意账户电子邮件地址", "url": "https://www.freebuf.com/news/11087.html", "time": "2013-07-12", "level": "", "num_look": 505847, "num_comment": 6, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "HP修复StoreOnce的系统后门漏洞", "url": "https://www.freebuf.com/news/11074.html", "time": "2013-07-11", "level": "", "num_look": 114915, "num_comment": 1, "author": "lock", "tags": ["资讯"], "text": ""}
{"title": "观点：「钟馗之眼」之我看（续）", "url": "https://www.freebuf.com/articles/others-articles/11032.html", "time": "2013-07-11", "level": "", "num_look": 324998, "num_comment": 31, "author": "eip_0x", "tags": ["其他"], "text": ""}
{"title": "斯诺登再度爆出猛料,NSA卫星监控系统-SAURON", "url": "https://www.freebuf.com/news/11062.html", "time": "2013-07-11", "level": "", "num_look": 123685, "num_comment": 8, "author": "lock", "tags": ["资讯"], "text": ""}
{"title": "一个绝妙的内核exploit", "url": "https://www.freebuf.com/articles/system/11058.html", "time": "2013-07-11", "level": "", "num_look": 184056, "num_comment": 7, "author": "angelface", "tags": ["系统安全"], "text": ""}
{"title": "Android重大漏洞POC", "url": "https://www.freebuf.com/news/11027.html", "time": "2013-07-10", "level": "", "num_look": 196731, "num_comment": 15, "author": "blue", "tags": ["资讯"], "text": ""}
{"title": "美国紧急报警系统容易受到攻击", "url": "https://www.freebuf.com/news/11025.html", "time": "2013-07-10", "level": "", "num_look": 99461, "num_comment": 1, "author": "lock", "tags": ["资讯"], "text": ""}
{"title": "安全扫描产品Netsparker CE V3.0社区版发布", "url": "https://www.freebuf.com/sectool/11013.html", "time": "2013-07-10", "level": "", "num_look": 207366, "num_comment": 23, "author": "unshell", "tags": ["工具"], "text": ""}
{"title": "日本游戏厂商任天堂近24000个账户泄露", "url": "https://www.freebuf.com/news/11011.html", "time": "2013-07-10", "level": "", "num_look": 114085, "num_comment": 7, "author": "lock", "tags": ["资讯"], "text": ""}
{"title": "Chrome浏览器密码找回工具——Chrome Password Decryptor v4.6", "url": "https://www.freebuf.com/sectool/11000.html", "time": "2013-07-09", "level": "", "num_look": 203832, "num_comment": 15, "author": "kk", "tags": ["工具"], "text": ""}
{"title": "[更新]Patator v0.5 多用途暴力破解工具", "url": "https://www.freebuf.com/sectool/10955.html", "time": "2013-07-09", "level": "", "num_look": 254375, "num_comment": 10, "author": "unshell", "tags": ["工具"], "text": ""}
{"title": "应用安全工作的那些事儿", "url": "https://www.freebuf.com/news/others/10992.html", "time": "2013-07-09", "level": "", "num_look": 275165, "num_comment": 38, "author": "jiayzhan", "tags": ["其他", "周边"], "text": ""}
{"title": "高度模块化网络攻击工具包 - ZARP", "url": "https://www.freebuf.com/sectool/10991.html", "time": "2013-07-09", "level": "", "num_look": 316924, "num_comment": 8, "author": "lock", "tags": ["工具"], "text": ""}
{"title": "埃及多个政府网站遭Anonymous黑客组织入侵", "url": "https://www.freebuf.com/news/10987.html", "time": "2013-07-08", "level": "", "num_look": 148611, "num_comment": 8, "author": "lock", "tags": ["资讯"], "text": ""}
{"title": "观点：「钟馗之眼」之我看", "url": "https://www.freebuf.com/articles/others-articles/10956.html", "time": "2013-07-08", "level": "", "num_look": 518639, "num_comment": 34, "author": "eip_0x", "tags": ["其他", "观点"], "text": ""}
{"title": "安卓新漏洞将于7月末披露", "url": "https://www.freebuf.com/articles/terminal/10984.html", "time": "2013-07-08", "level": "", "num_look": 129294, "num_comment": 4, "author": "Kowalski", "tags": ["终端安全"], "text": ""}
{"title": "安卓新漏洞，9亿安卓设备存风险", "url": "https://www.freebuf.com/news/10954.html", "time": "2013-07-08", "level": "", "num_look": 114194, "num_comment": 4, "author": "Kowalski", "tags": ["资讯"], "text": ""}
{"title": "微软将在本周二修复6个严重的远程代码执行漏洞", "url": "https://www.freebuf.com/news/10976.html", "time": "2013-07-08", "level": "", "num_look": 133311, "num_comment": 3, "author": "security64", "tags": ["资讯"], "text": ""}
{"title": "游戏机开发商Ubisoft被入侵，用户信息泄露", "url": "https://www.freebuf.com/news/10926.html", "time": "2013-07-05", "level": "", "num_look": 132095, "num_comment": 6, "author": "Kowalski", "tags": ["资讯"], "text": ""}
{"title": "俄罗斯前女特工查普曼向斯诺登网上求婚", "url": "https://www.freebuf.com/news/10941.html", "time": "2013-07-05", "level": "", "num_look": 149565, "num_comment": 5, "author": "bytea", "tags": ["资讯"], "text": ""}
{"title": "百度上海研究中心招聘Web安全工程师、开发工程师", "url": "https://www.freebuf.com/jobs/10851.html", "time": "2013-07-04", "level": "", "num_look": 197484, "num_comment": 15, "author": "wofeiwo", "tags": ["安全招聘"], "text": ""}
{"title": "Android黑客工具包——Destiny", "url": "https://www.freebuf.com/sectool/10910.html", "time": "2013-07-04", "level": "", "num_look": 1010012, "num_comment": 21, "author": "a1091481055", "tags": ["工具"], "text": ""}
{"title": "国内某大型IT企业招聘安全研究专家", "url": "https://www.freebuf.com/jobs/10885.html", "time": "2013-07-04", "level": "", "num_look": 237371, "num_comment": 51, "author": "Nexus", "tags": ["安全招聘"], "text": ""}
{"title": "美国空军文化中心网站遭入侵，高度敏感信息泄露", "url": "https://www.freebuf.com/news/10906.html", "time": "2013-07-04", "level": "", "num_look": 291319, "num_comment": 17, "author": "lock", "tags": ["资讯"], "text": ""}
{"title": "钟馗之眼（ZoomEye）：网络空间搜索引擎", "url": "https://www.freebuf.com/news/10877.html", "time": "2013-07-03", "level": "", "num_look": 2850499, "num_comment": 33, "author": "知道创宇安全研究团队", "tags": ["资讯"], "text": ""}
{"title": "研究人员将在Blackhat 2013上讲解如何30秒破解SSL", "url": "https://www.freebuf.com/news/10883.html", "time": "2013-07-03", "level": "", "num_look": 316679, "num_comment": 18, "author": "thanks", "tags": ["资讯"], "text": ""}
{"title": "渗透测试浏览器——HconSTF v0.5", "url": "https://www.freebuf.com/sectool/10875.html", "time": "2013-07-03", "level": "", "num_look": 362997, "num_comment": 17, "author": "lemon", "tags": ["工具"], "text": ""}
{"title": "针对莱特币的新木马被发现", "url": "https://www.freebuf.com/news/10888.html", "time": "2013-07-03", "level": "", "num_look": 156072, "num_comment": 7, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "Carberp源代码泄露后续——黑掉黑客", "url": "https://www.freebuf.com/news/10873.html", "time": "2013-07-02", "level": "", "num_look": 302319, "num_comment": 16, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "开源扫描工具 - SpiderFoot 2.0.2 released", "url": "https://www.freebuf.com/sectool/10824.html", "time": "2013-07-02", "level": "", "num_look": 217253, "num_comment": 6, "author": "unshell", "tags": ["工具"], "text": ""}
{"title": "Android黑客工具自动获取PC相关信息", "url": "https://www.freebuf.com/news/10866.html", "time": "2013-07-02", "level": "", "num_look": 145335, "num_comment": 16, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "麻省理工发明可以穿墙透视的WiFi雷达", "url": "https://www.freebuf.com/geek/10861.html", "time": "2013-07-01", "level": "", "num_look": 194884, "num_comment": 7, "author": "geekpark", "tags": ["极客"], "text": ""}
{"title": "重磅！FreebuF成为HITCON 2013（台湾黑客年会）大陆地区唯一官方合作媒体", "url": "https://www.freebuf.com/news/10388.html", "time": "2013-07-01", "level": "红色标题", "num_look": 251675, "num_comment": 34, "author": "FB独家", "tags": ["头条", "资讯"], "text": ""}
{"title": "走近伪科学：武当山驻少林寺大神父许喇嘛畅谈人生", "url": "https://www.freebuf.com/articles/others-articles/10847.html", "time": "2013-07-01", "level": "", "num_look": 255232, "num_comment": 26, "author": "eip_0x", "tags": ["其他"], "text": ""}
{"title": "吐槽国内各大公司的漏洞报告平台", "url": "https://www.freebuf.com/articles/others-articles/10813.html", "time": "2013-07-01", "level": "红色标题", "num_look": 860582, "num_comment": 41, "author": "扫地僧", "tags": ["其他", "观点"], "text": ""}
{"title": "朝鲜战争纪念日网络攻击详细分析", "url": "https://www.freebuf.com/news/10809.html", "time": "2013-06-28", "level": "", "num_look": 136202, "num_comment": 11, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "安赛(AISec)招聘：高级防火墙研发工程师", "url": "https://www.freebuf.com/jobs/10795.html", "time": "2013-06-28", "level": "", "num_look": 152251, "num_comment": 13, "author": "linx", "tags": ["安全招聘"], "text": ""}
{"title": "黑客窃取Opera签名的数字证书", "url": "https://www.freebuf.com/news/10806.html", "time": "2013-06-28", "level": "", "num_look": 129112, "num_comment": 13, "author": "leo", "tags": ["资讯"], "text": ""}
{"title": "在你的Windows计算机上发现所有隐藏文件——Hidden File Finder", "url": "https://www.freebuf.com/sectool/10799.html", "time": "2013-06-27", "level": "", "num_look": 166044, "num_comment": 5, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "香港理工大学计算机系软件工程方向MPhil/Ph.D学生", "url": "https://www.freebuf.com/jobs/10788.html", "time": "2013-06-27", "level": "", "num_look": 343529, "num_comment": 6, "author": "tonysomerville", "tags": ["安全招聘"], "text": ""}
{"title": "价值50000美元的银行恶意软件源码 - Carberp", "url": "https://www.freebuf.com/news/10793.html", "time": "2013-06-27", "level": "", "num_look": 417571, "num_comment": 23, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "Sqlmap注入技巧收集", "url": "https://www.freebuf.com/articles/web/10789.html", "time": "2013-06-27", "level": "", "num_look": 1255875, "num_comment": 26, "author": "thanks", "tags": ["WEB安全"], "text": ""}
{"title": "奇虎360爆Samsung Galaxy S4存在严重短信欺诈漏洞", "url": "https://www.freebuf.com/news/10786.html", "time": "2013-06-26", "level": "", "num_look": 121823, "num_comment": 7, "author": "周鸿祎", "tags": ["资讯"], "text": ""}
{"title": "斯诺登因害怕监狱无法使用电脑而跑路", "url": "https://www.freebuf.com/news/10783.html", "time": "2013-06-26", "level": "", "num_look": 125508, "num_comment": 5, "author": "jedyu", "tags": ["资讯"], "text": ""}
{"title": "HP D2D/StorOnce备份服务器被爆发现后门", "url": "https://www.freebuf.com/news/10775.html", "time": "2013-06-26", "level": "", "num_look": 154556, "num_comment": 19, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "朝中社等朝鲜主要网站出现瘫痪", "url": "https://www.freebuf.com/news/10772.html", "time": "2013-06-25", "level": "", "num_look": 107361, "num_comment": 6, "author": "vki", "tags": ["资讯"], "text": ""}
{"title": "Anonymous将于6月25日攻击朝鲜网站，宣称公开朝鲜导弹文件", "url": "https://www.freebuf.com/news/10769.html", "time": "2013-06-25", "level": "", "num_look": 196501, "num_comment": 19, "author": "geekpark", "tags": ["资讯"], "text": ""}
{"title": "SQL注入测试工具——Safe3SI_9.0破解版", "url": "https://www.freebuf.com/sectool/10753.html", "time": "2013-06-25", "level": "", "num_look": 876801, "num_comment": 81, "author": "千秋丶千年", "tags": ["工具"], "text": ""}
{"title": "Google Chrome Web Store 加入应用程序扫描功能", "url": "https://www.freebuf.com/news/10761.html", "time": "2013-06-25", "level": "", "num_look": 104226, "num_comment": 104226, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "斯诺登，快跑！", "url": "https://www.freebuf.com/news/10756.html", "time": "2013-06-24", "level": "", "num_look": 126068, "num_comment": 7, "author": "hihei", "tags": ["资讯"], "text": ""}
{"title": "科学家给蜻蜓穿上背包进行脑研究", "url": "https://www.freebuf.com/geek/10748.html", "time": "2013-06-24", "level": "", "num_look": 152169, "num_comment": 7, "author": "bolee", "tags": ["极客"], "text": ""}
{"title": "Facebook泄露了六百万用户的个人信息", "url": "https://www.freebuf.com/news/10743.html", "time": "2013-06-24", "level": "", "num_look": 192332, "num_comment": 13, "author": "txt", "tags": ["资讯"], "text": ""}
{"title": "渗透测试团队协作平台——Dradis Pro", "url": "https://www.freebuf.com/sectool/10744.html", "time": "2013-06-24", "level": "", "num_look": 358280, "num_comment": 13, "author": "反恐精英", "tags": ["工具"], "text": ""}
{"title": "斯诺登抵达莫斯科,打算前往委内瑞拉", "url": "https://www.freebuf.com/news/10741.html", "time": "2013-06-24", "level": "", "num_look": 106953, "num_comment": 9, "author": "blow", "tags": ["资讯"], "text": ""}
{"title": "[赛事回顾]第一届MIT CTF 2011信息战随笔", "url": "https://www.freebuf.com/news/topnews/10736.html", "time": "2013-06-24", "level": "", "num_look": 165383, "num_comment": 25, "author": "CasperKid@CTF", "tags": ["头条"], "text": ""}
{"title": "NSA一天内入侵清华63台计算机和服务器", "url": "https://www.freebuf.com/news/10734.html", "time": "2013-06-24", "level": "", "num_look": 236810, "num_comment": 21, "author": "phper", "tags": ["资讯"], "text": ""}
{"title": "俄罗斯富豪想借科技求永生 欲将大脑植入机器", "url": "https://www.freebuf.com/geek/10717.html", "time": "2013-06-21", "level": "", "num_look": 195704, "num_comment": 24, "author": "white", "tags": ["极客"], "text": ""}
{"title": "黑市交易 - 女性肉鸡价格比男性贵100倍", "url": "https://www.freebuf.com/news/10704.html", "time": "2013-06-21", "level": "红色标题", "num_look": 828811, "num_comment": 62, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "JSONObject输出json串可引发XSS", "url": "https://www.freebuf.com/articles/web/10672.html", "time": "2013-06-21", "level": "", "num_look": 505511, "num_comment": 13, "author": "door2guest", "tags": ["WEB安全"], "text": ""}
{"title": "Android ICS adb调试工具系统还原目录遍历漏洞（可提权）", "url": "https://www.freebuf.com/vuls/10697.html", "time": "2013-06-21", "level": "", "num_look": 214213, "num_comment": 6, "author": "newborn", "tags": ["漏洞", "终端安全"], "text": ""}
{"title": "LinkedIn遭遇DNS劫持攻击", "url": "https://www.freebuf.com/news/10693.html", "time": "2013-06-21", "level": "", "num_look": 105671, "num_comment": 2, "author": "t7", "tags": ["资讯"], "text": ""}
{"title": "微软将为漏洞买单", "url": "https://www.freebuf.com/news/10686.html", "time": "2013-06-20", "level": "", "num_look": 107058, "num_comment": 5, "author": "t7", "tags": ["资讯"], "text": ""}
{"title": "云计算做数据包分析防御DDOS攻击", "url": "https://www.freebuf.com/articles/system/10595.html", "time": "2013-06-20", "level": "", "num_look": 222269, "num_comment": 8, "author": "淡定淞淞", "tags": ["系统安全"], "text": ""}
{"title": "大众点评网域名劫持事件概述", "url": "https://www.freebuf.com/news/10662.html", "time": "2013-06-20", "level": "红色标题", "num_look": 355770, "num_comment": 23, "author": "lion", "tags": ["资讯"], "text": ""}
{"title": "Linux后门之道——NC用法别有洞天", "url": "https://www.freebuf.com/articles/system/10632.html", "time": "2013-06-20", "level": "", "num_look": 1042385, "num_comment": 17, "author": "mjjlove6", "tags": ["系统安全"], "text": ""}
{"title": "angelc0de原创burpsuite系列培训教程（下载）", "url": "https://www.freebuf.com/video/10591.html", "time": "2013-06-19", "level": "", "num_look": 1510814, "num_comment": 74, "author": "小冰", "tags": ["视频"], "text": ""}
{"title": "Defcon CTF 黑客竞赛文化的碎碎念", "url": "https://www.freebuf.com/news/topnews/10599.html", "time": "2013-06-19", "level": "", "num_look": 356982, "num_comment": 25, "author": "CasperKid@Defcon", "tags": ["头条"], "text": ""}
{"title": "美国VPS管理系统SolusVM 1.13.03 SQL注入漏洞（含exp）", "url": "https://www.freebuf.com/vuls/10611.html", "time": "2013-06-19", "level": "", "num_look": 261351, "num_comment": 21, "author": "x-Ai", "tags": ["漏洞"], "text": ""}
{"title": "安全宝-蓝莲花DEFCON CTF 资格赛2013纪实（二）", "url": "https://www.freebuf.com/news/others/10608.html", "time": "2013-06-19", "level": "", "num_look": 197617, "num_comment": 11, "author": "FB独家", "tags": ["其他", "周边"], "text": ""}
{"title": "6月一个被忽视的微软漏洞MS13-051——记大牛分析过程", "url": "https://www.freebuf.com/articles/system/10573.html", "time": "2013-06-19", "level": "", "num_look": 212665, "num_comment": 14, "author": "cs24", "tags": ["系统安全"], "text": ""}
{"title": "大众点评网昨日遭黑，helen否认与其有关", "url": "https://www.freebuf.com/news/10625.html", "time": "2013-06-19", "level": "", "num_look": 315514, "num_comment": 27, "author": "无花果", "tags": ["资讯"], "text": ""}
{"title": "百度新推出杀毒软件“百度杀毒”评测", "url": "https://www.freebuf.com/news/10592.html", "time": "2013-06-18", "level": "", "num_look": 175653, "num_comment": 30, "author": "geekpark", "tags": ["资讯"], "text": ""}
{"title": "深圳市极限网络科技有限公司2013年第四届信息安全沙龙", "url": "https://www.freebuf.com/news/others/10524.html", "time": "2013-06-18", "level": "", "num_look": 202452, "num_comment": 29, "author": "hongygxiang", "tags": ["其他", "周边"], "text": ""}
{"title": "XSS解决方案系列之四：关于编码", "url": "https://www.freebuf.com/articles/web/10478.html", "time": "2013-06-18", "level": "", "num_look": 454283, "num_comment": 35, "author": "jiayzhan", "tags": ["WEB安全"], "text": ""}
{"title": "安全宝-蓝莲花DEFCON CTF 资格赛2013纪实（一）", "url": "https://www.freebuf.com/news/others/10552.html", "time": "2013-06-18", "level": "", "num_look": 394078, "num_comment": 43, "author": "FB独家", "tags": ["其他", "周边"], "text": ""}
{"title": "FDA发布预警称医疗系统面临网络安全威胁", "url": "https://www.freebuf.com/news/10562.html", "time": "2013-06-18", "level": "", "num_look": 124340, "num_comment": 5, "author": "blackscreen", "tags": ["资讯"], "text": ""}
{"title": "苹果公司表示收到美国政府约5000个查询数据请求", "url": "https://www.freebuf.com/news/10550.html", "time": "2013-06-18", "level": "", "num_look": 108195, "num_comment": 108195, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "斯诺登泄密文件表示：英国暗中监视俄罗斯总统", "url": "https://www.freebuf.com/news/10547.html", "time": "2013-06-18", "level": "", "num_look": 101334, "num_comment": 3, "author": "h4x", "tags": ["资讯"], "text": ""}
{"title": "中国首谈斯诺登案，官媒称不帮美国灭火", "url": "https://www.freebuf.com/news/10549.html", "time": "2013-06-17", "level": "", "num_look": 130369, "num_comment": 12, "author": "stone", "tags": ["资讯"], "text": ""}
{"title": "HoneyProxy-中间人SSL代理及传输分析工具", "url": "https://www.freebuf.com/sectool/10530.html", "time": "2013-06-17", "level": "", "num_look": 297594, "num_comment": 11, "author": "bincker", "tags": ["工具"], "text": ""}
{"title": "[安全科普]ARP攻击防范方法总结", "url": "https://www.freebuf.com/articles/system/10517.html", "time": "2013-06-17", "level": "", "num_look": 339002, "num_comment": 14, "author": "Panni_007", "tags": ["系统安全"], "text": ""}
{"title": "MYIIS-VIF（服务器安全专家）全功能免费版本", "url": "https://www.freebuf.com/sectool/10497.html", "time": "2013-06-16", "level": "红色标题", "num_look": 342577, "num_comment": 41, "author": "softbug", "tags": ["工具"], "text": ""}
{"title": "极限网络科技聘网络安全人员", "url": "https://www.freebuf.com/jobs/10459.html", "time": "2013-06-16", "level": "", "num_look": 254661, "num_comment": 18, "author": "G.r0b1n", "tags": ["安全招聘"], "text": ""}
{"title": "如何使用Linux通用后门", "url": "https://www.freebuf.com/sectool/10474.html", "time": "2013-06-14", "level": "", "num_look": 974261, "num_comment": 39, "author": "zafe", "tags": ["工具", "系统安全"], "text": ""}
{"title": "Seay源代码审计系统1.0版本发布", "url": "https://www.freebuf.com/sectool/10472.html", "time": "2013-06-14", "level": "", "num_look": 565289, "num_comment": 28, "author": "seay", "tags": ["工具"], "text": ""}
{"title": "BurpSuite系列使用视频教程（下载）", "url": "https://www.freebuf.com/video/10468.html", "time": "2013-06-14", "level": "红色标题", "num_look": 1247284, "num_comment": 65, "author": "n0h4ck_team", "tags": ["视频"], "text": ""}
{"title": "OWASP发布2013年十大WEB应用安全风险", "url": "https://www.freebuf.com/news/10460.html", "time": "2013-06-14", "level": "", "num_look": 168530, "num_comment": 3, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "[技术实现]美国国安局如何实现海量用户数据的监控？", "url": "https://www.freebuf.com/news/10458.html", "time": "2013-06-14", "level": "", "num_look": 157980, "num_comment": 17, "author": "geekpark", "tags": ["其他", "资讯"], "text": ""}
{"title": "“熊猫烧香”制造者丽水再次犯案被抓", "url": "https://www.freebuf.com/news/10462.html", "time": "2013-06-13", "level": "", "num_look": 254745, "num_comment": 30, "author": "fab", "tags": ["资讯"], "text": ""}
{"title": "揭秘美国安局绝密黑客小组TAO：专攻国外情报", "url": "https://www.freebuf.com/news/10455.html", "time": "2013-06-13", "level": "红色标题", "num_look": 166615, "num_comment": 7, "author": "黑客", "tags": ["头条", "资讯"], "text": ""}
{"title": "FREEBUF一周年限量版T恤火热预售（已售罄）", "url": "https://www.freebuf.com/news/others/10446.html", "time": "2013-06-13", "level": "红色标题", "num_look": 445126, "num_comment": 72, "author": "FB客服", "tags": ["其他", "周边"], "text": ""}
{"title": "完全绕过苹果iOS7系统锁屏", "url": "https://www.freebuf.com/news/10448.html", "time": "2013-06-13", "level": "", "num_look": 234322, "num_comment": 8, "author": "pnig0s", "tags": ["资讯"], "text": ""}
{"title": "<最新进展>斯诺登爆料称美国政府入侵中国网络多年", "url": "https://www.freebuf.com/news/10445.html", "time": "2013-06-13", "level": "", "num_look": 120838, "num_comment": 14, "author": "cnhacker", "tags": ["资讯"], "text": ""}
{"title": "暗组Web杀毒 2.5 启发式查杀 0611 端午版", "url": "https://www.freebuf.com/sectool/10423.html", "time": "2013-06-13", "level": "", "num_look": 187796, "num_comment": 2, "author": "darkray", "tags": ["工具"], "text": ""}
{"title": "渗透测试专用PowerShell——Ninshang v.0.2.7", "url": "https://www.freebuf.com/sectool/10443.html", "time": "2013-06-13", "level": "", "num_look": 527544, "num_comment": 42, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "[更新]前CIA雇员揭露美国政府秘密监视计划", "url": "https://www.freebuf.com/news/10403.html", "time": "2013-06-11", "level": "", "num_look": 149313, "num_comment": 19, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "研究者发现了世界上最狡猾的Android木马", "url": "https://www.freebuf.com/news/10419.html", "time": "2013-06-11", "level": "", "num_look": 205320, "num_comment": 2, "author": "弘弘", "tags": ["资讯"], "text": ""}
{"title": "SQL注入工具 - Pangolin 4.0", "url": "https://www.freebuf.com/sectool/10402.html", "time": "2013-06-11", "level": "", "num_look": 1208376, "num_comment": 23, "author": "unshell", "tags": ["工具"], "text": ""}
{"title": "基于云计算的DDOS攻击缓解方案", "url": "https://www.freebuf.com/articles/others-articles/10412.html", "time": "2013-06-11", "level": "", "num_look": 244892, "num_comment": 5, "author": "H3lvin", "tags": ["其他"], "text": ""}
{"title": "中国将打造世界最快超级计算机", "url": "https://www.freebuf.com/news/10400.html", "time": "2013-06-10", "level": "", "num_look": 128097, "num_comment": 17, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "可以用手势控制的Wi-Fi", "url": "https://www.freebuf.com/geek/10385.html", "time": "2013-06-09", "level": "", "num_look": 176049, "num_comment": 4, "author": "geekpark", "tags": ["极客"], "text": ""}
{"title": "你必须了解的Session的本质", "url": "https://www.freebuf.com/articles/web/10369.html", "time": "2013-06-09", "level": "", "num_look": 906576, "num_comment": 28, "author": "Panni_007", "tags": ["WEB安全"], "text": ""}
{"title": "利用PDF漏洞的比特币木马来袭", "url": "https://www.freebuf.com/news/10379.html", "time": "2013-06-09", "level": "", "num_look": 184887, "num_comment": 10, "author": "翰海源安全", "tags": ["资讯"], "text": ""}
{"title": "敢偷用我的Wi-Fi？看我怎么治你", "url": "https://www.freebuf.com/articles/wireless/10345.html", "time": "2013-06-08", "level": "", "num_look": 355623, "num_comment": 42, "author": "Panni_007", "tags": ["无线安全"], "text": ""}
{"title": "天蝎座Web安全渗透测试工具集V5发布", "url": "https://www.freebuf.com/sectool/10339.html", "time": "2013-06-08", "level": "", "num_look": 287721, "num_comment": 42, "author": "p0tt1", "tags": ["工具"], "text": ""}
{"title": "XSS解决方案系列之三: 例解过后，再回首您正在维护的产品", "url": "https://www.freebuf.com/articles/web/10307.html", "time": "2013-06-07", "level": "", "num_look": 403702, "num_comment": 48, "author": "jiayzhan", "tags": ["WEB安全"], "text": ""}
{"title": "安赛科技（AISec）招聘大量安全人员", "url": "https://www.freebuf.com/jobs/10331.html", "time": "2013-06-07", "level": "", "num_look": 218025, "num_comment": 19, "author": "linx", "tags": ["安全招聘"], "text": ""}
{"title": "北京幻方朗睿招聘安全工程师", "url": "https://www.freebuf.com/jobs/10309.html", "time": "2013-06-07", "level": "", "num_look": 150833, "num_comment": 7, "author": "steven", "tags": ["安全招聘"], "text": ""}
{"title": "如何渗透PayPal(贝宝)用户交易记录系统", "url": "https://www.freebuf.com/articles/web/10270.html", "time": "2013-06-07", "level": "", "num_look": 350083, "num_comment": 9, "author": "bigman", "tags": ["WEB安全"], "text": ""}
{"title": "一次windows2008的提权过程", "url": "https://www.freebuf.com/articles/web/10280.html", "time": "2013-06-07", "level": "红色标题", "num_look": 1903348, "num_comment": 80, "author": "ghy459", "tags": ["WEB安全"], "text": ""}
{"title": "[更新]hash注入神器WCE发布1.4 Beta版本", "url": "https://www.freebuf.com/sectool/10297.html", "time": "2013-06-06", "level": "", "num_look": 735592, "num_comment": 22, "author": "H3lvin", "tags": ["工具"], "text": ""}
{"title": "瑞星网络安全工程师招聘", "url": "https://www.freebuf.com/jobs/10241.html", "time": "2013-06-06", "level": "", "num_look": 222806, "num_comment": 17, "author": "Gall", "tags": ["安全招聘"], "text": ""}
{"title": "[最新]Plesk主机管理软件远程get shell 0day", "url": "https://www.freebuf.com/vuls/10291.html", "time": "2013-06-06", "level": "", "num_look": 298317, "num_comment": 13, "author": "pnig0s", "tags": ["漏洞"], "text": ""}
{"title": "奥巴马将就网络攻击问题向习近平施压", "url": "https://www.freebuf.com/news/10295.html", "time": "2013-06-06", "level": "", "num_look": 171393, "num_comment": 10, "author": "Leaks", "tags": ["资讯"], "text": ""}
{"title": "iphone下的无线嗅探攻击", "url": "https://www.freebuf.com/articles/wireless/10276.html", "time": "2013-06-06", "level": "", "num_look": 1001852, "num_comment": 61, "author": "Black-World", "tags": ["无线安全"], "text": ""}
{"title": "土耳其总理办公室网站遭入侵，部分数据泄露", "url": "https://www.freebuf.com/news/10277.html", "time": "2013-06-06", "level": "", "num_look": 127340, "num_comment": 4, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "卡巴斯基实验室分析公布新的网络间谍活动", "url": "https://www.freebuf.com/news/10272.html", "time": "2013-06-05", "level": "", "num_look": 124272, "num_comment": 6, "author": "hihei", "tags": ["资讯"], "text": ""}
{"title": "你使用频率最高的Linux命令是什么?", "url": "https://www.freebuf.com/news/others/10258.html", "time": "2013-06-05", "level": "", "num_look": 391709, "num_comment": 34, "author": "thanks", "tags": ["其他", "周边"], "text": ""}
{"title": "基于qt的xss扫描脚本", "url": "https://www.freebuf.com/sectool/7684.html", "time": "2013-06-05", "level": "", "num_look": 225647, "num_comment": 7, "author": "muhuo", "tags": ["工具"], "text": ""}
{"title": "快速密码破解工具John the Ripper v1.8.0发布", "url": "https://www.freebuf.com/sectool/10249.html", "time": "2013-06-05", "level": "", "num_look": 398368, "num_comment": 5, "author": "fake", "tags": ["工具"], "text": ""}
{"title": "PPTV招聘安全工程师", "url": "https://www.freebuf.com/jobs/10223.html", "time": "2013-06-05", "level": "", "num_look": 210106, "num_comment": 18, "author": "hongygxiang", "tags": ["安全招聘"], "text": ""}
{"title": "中国解放军电子战演习即将登场", "url": "https://www.freebuf.com/news/10236.html", "time": "2013-06-05", "level": "", "num_look": 164555, "num_comment": 29, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "Metasploit更新", "url": "https://www.freebuf.com/vuls/10219.html", "time": "2013-06-04", "level": "", "num_look": 366892, "num_comment": 8, "author": "phper", "tags": ["漏洞"], "text": ""}
{"title": "Veil - 免杀payload生成工具", "url": "https://www.freebuf.com/sectool/10087.html", "time": "2013-06-04", "level": "", "num_look": 639238, "num_comment": 8, "author": "LinuxSpace", "tags": ["工具"], "text": ""}
{"title": "极客领袖人物 - RMS", "url": "https://www.freebuf.com/geek/10206.html", "time": "2013-06-04", "level": "", "num_look": 265272, "num_comment": 30, "author": "LinuxSpace", "tags": ["极客"], "text": ""}
{"title": "Apache Struts发布重要安全更新", "url": "https://www.freebuf.com/news/10211.html", "time": "2013-06-04", "level": "", "num_look": 113682, "num_comment": 4, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "摩托罗拉研发黑客帝国小药丸，吞下后会变成人肉装置", "url": "https://www.freebuf.com/geek/10115.html", "time": "2013-06-03", "level": "", "num_look": 162833, "num_comment": 6, "author": "猪哥靓", "tags": ["极客"], "text": ""}
{"title": "奥巴马与习近平将会在加利福尼亚州讨论网络安全问题", "url": "https://www.freebuf.com/news/10142.html", "time": "2013-06-03", "level": "", "num_look": 284297, "num_comment": 45, "author": "lotte", "tags": ["资讯"], "text": ""}
{"title": "Android远程控制工具——AndroRat", "url": "https://www.freebuf.com/sectool/10179.html", "time": "2013-06-03", "level": "", "num_look": 3164451, "num_comment": 149, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "KRBanker木马大肆感染韩国金融机构", "url": "https://www.freebuf.com/news/10170.html", "time": "2013-06-03", "level": "", "num_look": 156902, "num_comment": 7, "author": "pnig0s", "tags": ["资讯"], "text": ""}
{"title": "XSS解决方案系列之二：知其所以然---浏览器是如是解码的", "url": "https://www.freebuf.com/articles/web/10121.html", "time": "2013-06-03", "level": "红色标题", "num_look": 885030, "num_comment": 69, "author": "jiayzhan", "tags": ["WEB安全"], "text": ""}
{"title": "针对国外黑客M3QD4D的分析报告（下）", "url": "https://www.freebuf.com/articles/others-articles/10118.html", "time": "2013-06-03", "level": "", "num_look": 201696, "num_comment": 8, "author": "Darksn0w", "tags": ["其他"], "text": ""}
{"title": "WAF绕过的奇技淫巧", "url": "https://www.freebuf.com/articles/web/10099.html", "time": "2013-06-01", "level": "", "num_look": 285446, "num_comment": 20, "author": "livers", "tags": ["WEB安全"], "text": ""}
{"title": "台湾也准备修长城防火墙？", "url": "https://www.freebuf.com/news/10109.html", "time": "2013-05-31", "level": "", "num_look": 165660, "num_comment": 12, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "南京翰海源招聘各种攻城狮(安全、市场，开发)", "url": "https://www.freebuf.com/jobs/10092.html", "time": "2013-05-31", "level": "", "num_look": 165505, "num_comment": 10, "author": "instruder", "tags": ["安全招聘"], "text": ""}
{"title": "黑客1小时内破解16位密码，助力密码安全研究", "url": "https://www.freebuf.com/news/10051.html", "time": "2013-05-31", "level": "", "num_look": 204184, "num_comment": 26, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "厦门吉比特网络招聘安全工程师", "url": "https://www.freebuf.com/jobs/10076.html", "time": "2013-05-31", "level": "", "num_look": 135550, "num_comment": 5, "author": "g-bits", "tags": ["安全招聘"], "text": ""}
{"title": "中国表示已经没有必要窃取美国军事机密", "url": "https://www.freebuf.com/news/10085.html", "time": "2013-05-31", "level": "", "num_look": 189648, "num_comment": 13, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "Apache日志文件漏洞，可能执行任意代码", "url": "https://www.freebuf.com/vuls/10088.html", "time": "2013-05-31", "level": "红色标题", "num_look": 715107, "num_comment": 21, "author": "大树", "tags": ["漏洞"], "text": ""}
{"title": "libnmap - Nmap的Python第三方库", "url": "https://www.freebuf.com/sectool/10071.html", "time": "2013-05-31", "level": "", "num_look": 570559, "num_comment": 6, "author": "LinuxSpace", "tags": ["工具"], "text": ""}
{"title": "渗透测试专用浏览器Sandcat 4.0版本发布", "url": "https://www.freebuf.com/sectool/10057.html", "time": "2013-05-30", "level": "", "num_look": 255719, "num_comment": 14, "author": "pnig0s", "tags": ["工具"], "text": ""}
{"title": "开源CMS框架Drupal社区官网被黑导致账户信息外泄", "url": "https://www.freebuf.com/news/10054.html", "time": "2013-05-30", "level": "", "num_look": 121838, "num_comment": 4, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "社会工程学工具集SET v5.1发布，代号“Name of the Doctor”", "url": "https://www.freebuf.com/sectool/10050.html", "time": "2013-05-30", "level": "", "num_look": 210802, "num_comment": 9, "author": "fake", "tags": ["工具"], "text": ""}
{"title": "FreebuF官方限量版T恤预热", "url": "https://www.freebuf.com/news/others/10042.html", "time": "2013-05-30", "level": "红色标题", "num_look": 462697, "num_comment": 115, "author": "FB客服", "tags": ["其他", "周边"], "text": ""}
{"title": "台湾将成立新的网络战单位", "url": "https://www.freebuf.com/news/10043.html", "time": "2013-05-30", "level": "", "num_look": 155438, "num_comment": 13, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "Paypal拒绝奖励发现XSS漏洞的未成年人", "url": "https://www.freebuf.com/news/10035.html", "time": "2013-05-29", "level": "", "num_look": 175550, "num_comment": 21, "author": "loop", "tags": ["资讯"], "text": ""}
{"title": "澳媒炒作“中国黑客”盗走澳安情局蓝图", "url": "https://www.freebuf.com/news/10027.html", "time": "2013-05-29", "level": "", "num_look": 120569, "num_comment": 5, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "OWASP杭州2013年春季WEB应用安全沙龙速描", "url": "https://www.freebuf.com/news/others/9915.html", "time": "2013-05-29", "level": "", "num_look": 243705, "num_comment": 40, "author": "FB独家", "tags": ["其他", "周边"], "text": ""}
{"title": "802.11 WEP和WPA-PSK破解工具——Aircrack-ng 1.2 Beta 1", "url": "https://www.freebuf.com/sectool/9989.html", "time": "2013-05-28", "level": "", "num_look": 293142, "num_comment": 6, "author": "fake", "tags": ["工具"], "text": ""}
{"title": "美媒爆中国黑客获取大量美国军事武器资料", "url": "https://www.freebuf.com/news/9986.html", "time": "2013-05-28", "level": "", "num_look": 145417, "num_comment": 6, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "XSS解决方案系列之一：淘宝、百度、腾讯的解决方案之瑕疵", "url": "https://www.freebuf.com/articles/web/9928.html", "time": "2013-05-28", "level": "", "num_look": 605965, "num_comment": 39, "author": "jiayzhan", "tags": ["WEB安全"], "text": ""}
{"title": "防御XSS的七条原则", "url": "https://www.freebuf.com/articles/web/9977.html", "time": "2013-05-28", "level": "", "num_look": 1398000, "num_comment": 21, "author": "shineforyou", "tags": ["WEB安全"], "text": ""}
{"title": "linux root exp for 2.6.37-3.x.x x86_64", "url": "https://www.freebuf.com/vuls/9926.html", "time": "2013-05-28", "level": "", "num_look": 436539, "num_comment": 18, "author": "p0tt1", "tags": ["漏洞"], "text": ""}
{"title": "低频RFID卡分析（ID卡为例）", "url": "https://www.freebuf.com/articles/wireless/9921.html", "time": "2013-05-28", "level": "", "num_look": 706441, "num_comment": 19, "author": "lastdinner", "tags": ["无线安全"], "text": ""}
{"title": "LibertyReserve老大被捕，网站停止运营", "url": "https://www.freebuf.com/news/9925.html", "time": "2013-05-27", "level": "", "num_look": 122256, "num_comment": 4, "author": "x39", "tags": ["资讯"], "text": ""}
{"title": "Google宣布提升SSL证书密钥长度", "url": "https://www.freebuf.com/news/9919.html", "time": "2013-05-27", "level": "", "num_look": 155543, "num_comment": 6, "author": "daniel", "tags": ["资讯"], "text": ""}
{"title": "[渗透技巧]python脚本处理伪静态注入", "url": "https://www.freebuf.com/articles/web/9883.html", "time": "2013-05-27", "level": "", "num_look": 471802, "num_comment": 17, "author": "livers", "tags": ["WEB安全"], "text": ""}
{"title": "BackBox Linux 3.05 发布", "url": "https://www.freebuf.com/sectool/9875.html", "time": "2013-05-27", "level": "", "num_look": 158621, "num_comment": 6, "author": "LinuxSpace", "tags": ["工具"], "text": ""}
{"title": "纽约时报：中国民间黑客不容小觑", "url": "https://www.freebuf.com/news/9864.html", "time": "2013-05-24", "level": "", "num_look": 245272, "num_comment": 29, "author": "呵呵哥", "tags": ["资讯"], "text": ""}
{"title": "自动化SQL注入工具——jSQL Injection v0.4", "url": "https://www.freebuf.com/sectool/9857.html", "time": "2013-05-24", "level": "", "num_look": 368126, "num_comment": 14, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "多个游戏引擎爆0day漏洞", "url": "https://www.freebuf.com/news/9850.html", "time": "2013-05-24", "level": "", "num_look": 162386, "num_comment": 7, "author": "kelz", "tags": ["漏洞", "资讯"], "text": ""}
{"title": "Android发现新的恶意软件，可偷偷转发短信", "url": "https://www.freebuf.com/news/9849.html", "time": "2013-05-24", "level": "", "num_look": 146172, "num_comment": 15, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "反向ICMP_shell - icmpsh", "url": "https://www.freebuf.com/sectool/9684.html", "time": "2013-05-24", "level": "", "num_look": 321218, "num_comment": 14, "author": "LinuxSpace", "tags": ["工具"], "text": ""}
{"title": "Twitter启用账号双因素认证机制", "url": "https://www.freebuf.com/news/9829.html", "time": "2013-05-24", "level": "", "num_look": 119608, "num_comment": 4, "author": "st4rw00d", "tags": ["资讯"], "text": ""}
{"title": "黑客改造脑波耳机，让您可以通过思想控制建筑物", "url": "https://www.freebuf.com/geek/9821.html", "time": "2013-05-23", "level": "", "num_look": 229092, "num_comment": 5, "author": "极客小子", "tags": ["极客"], "text": ""}
{"title": "[个人心得]谈渗透测试方法和流程", "url": "https://www.freebuf.com/articles/web/9801.html", "time": "2013-05-23", "level": "红色标题", "num_look": 1307465, "num_comment": 57, "author": "only_guest", "tags": ["WEB安全"], "text": ""}
{"title": "关塔那摩监狱及海军基地因黑客攻击决定关闭WIFI服务", "url": "https://www.freebuf.com/news/9798.html", "time": "2013-05-23", "level": "", "num_look": 99529, "num_comment": 99529, "author": "loveminds", "tags": ["资讯"], "text": ""}
{"title": "美国电网受网络攻击威胁增加", "url": "https://www.freebuf.com/news/9807.html", "time": "2013-05-23", "level": "", "num_look": 114161, "num_comment": 1, "author": "cq", "tags": ["资讯"], "text": ""}
{"title": "Windows内核EPATHOBJ 0day漏洞", "url": "https://www.freebuf.com/vuls/9766.html", "time": "2013-05-23", "level": "", "num_look": 251218, "num_comment": 14, "author": "LinuxSpace", "tags": ["漏洞"], "text": ""}
{"title": "工控设备扫描工具 - PLCScan", "url": "https://www.freebuf.com/sectool/9794.html", "time": "2013-05-23", "level": "", "num_look": 371356, "num_comment": 12, "author": "H3lvin", "tags": ["工具"], "text": ""}
{"title": "Terminals配置文件解密工具", "url": "https://www.freebuf.com/sectool/9437.html", "time": "2013-05-22", "level": "", "num_look": 159613, "num_comment": 159613, "author": "hack520", "tags": ["工具"], "text": ""}
{"title": "输入验证--避免50%（只是经验值）以上的应用安全攻击", "url": "https://www.freebuf.com/articles/web/9672.html", "time": "2013-05-22", "level": "", "num_look": 262453, "num_comment": 4, "author": "jiayzhan", "tags": ["WEB安全"], "text": ""}
{"title": "Struts2再爆远程代码执行漏洞", "url": "https://www.freebuf.com/vuls/9757.html", "time": "2013-05-22", "level": "红色标题", "num_look": 1197153, "num_comment": 30, "author": "st4rw00d", "tags": ["漏洞"], "text": ""}
{"title": "商业网络间谍攻击---剑指巴基斯坦", "url": "https://www.freebuf.com/news/9738.html", "time": "2013-05-21", "level": "", "num_look": 115085, "num_comment": 115085, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "去哪儿网招聘WEB安全工程师/安全主管", "url": "https://www.freebuf.com/jobs/9704.html", "time": "2013-05-21", "level": "", "num_look": 165033, "num_comment": 20, "author": "eyasguo", "tags": ["安全招聘"], "text": ""}
{"title": "托FBI的福，DDoS攻击服务已合法化！", "url": "https://www.freebuf.com/news/9710.html", "time": "2013-05-21", "level": "", "num_look": 237388, "num_comment": 12, "author": "blackscreen", "tags": ["资讯"], "text": ""}
{"title": "说说“史上最大规模的DNS劫持”", "url": "https://www.freebuf.com/articles/web/9723.html", "time": "2013-05-21", "level": "", "num_look": 286884, "num_comment": 8, "author": "余弦", "tags": ["WEB安全"], "text": ""}
{"title": "Android平台下Mysql注入工具——DroidSQLi", "url": "https://www.freebuf.com/sectool/9667.html", "time": "2013-05-20", "level": "", "num_look": 324402, "num_comment": 13, "author": "LinuxSpace", "tags": ["工具"], "text": ""}
{"title": "在线游戏公司挣扎在与DDoS斗争的生存线上", "url": "https://www.freebuf.com/news/9688.html", "time": "2013-05-20", "level": "", "num_look": 177604, "num_comment": 4, "author": "blackscreen", "tags": ["资讯"], "text": ""}
{"title": "Google HackingⅠ", "url": "https://www.freebuf.com/articles/web/9636.html", "time": "2013-05-20", "level": "", "num_look": 536978, "num_comment": 24, "author": "moss", "tags": ["WEB安全"], "text": ""}
{"title": "黑客可利用云开发平台进行DDOS攻击", "url": "https://www.freebuf.com/articles/web/9658.html", "time": "2013-05-20", "level": "", "num_look": 217357, "num_comment": 11, "author": "mars", "tags": ["WEB安全"], "text": ""}
{"title": "雅虎日本遭入侵，疑似22W用户ID泄露", "url": "https://www.freebuf.com/news/9681.html", "time": "2013-05-20", "level": "", "num_look": 154220, "num_comment": 2, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "nginx 1.3.9-1.4.0 DoS PoC", "url": "https://www.freebuf.com/articles/system/9651.html", "time": "2013-05-17", "level": "", "num_look": 220854, "num_comment": 21, "author": "phper", "tags": ["系统安全"], "text": ""}
{"title": "美国多所大学遭黑客入侵，部分数据泄露", "url": "https://www.freebuf.com/news/9633.html", "time": "2013-05-17", "level": "", "num_look": 131124, "num_comment": 10, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "针对国外黑客M3QD4D的分析报告（上）", "url": "https://www.freebuf.com/articles/others-articles/9622.html", "time": "2013-05-17", "level": "", "num_look": 205795, "num_comment": 20, "author": "Darksn0w", "tags": ["其他"], "text": ""}
{"title": "[专题]菲律宾黑客公开求饶：请对准菲政府，别再搞我们了", "url": "https://www.freebuf.com/news/9604.html", "time": "2013-05-16", "level": "", "num_look": 168509, "num_comment": 22, "author": "猪哥靓", "tags": ["头条", "资讯"], "text": ""}
{"title": "美国国家安全局的特工培训手册：怎么当谷歌黑客", "url": "https://www.freebuf.com/news/9598.html", "time": "2013-05-16", "level": "", "num_look": 161873, "num_comment": 11, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "开源网络准入系统 (NAC)——PacketFence v4.0", "url": "https://www.freebuf.com/sectool/9599.html", "time": "2013-05-16", "level": "", "num_look": 281404, "num_comment": 5, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "美丽的“恶行”：DDoS攻击原来这番模样", "url": "https://www.freebuf.com/news/9592.html", "time": "2013-05-16", "level": "", "num_look": 128035, "num_comment": 7, "author": "Sh@doM", "tags": ["资讯"], "text": ""}
{"title": "用于匿名攻击和渗透测试的Linux发行版本-AttackVector", "url": "https://www.freebuf.com/sectool/9442.html", "time": "2013-05-16", "level": "", "num_look": 310256, "num_comment": 17, "author": "LinuxSpace", "tags": ["工具"], "text": ""}
{"title": "FireEye：PlugX老马新用,针对中国政治活动的APT攻击分析", "url": "https://www.freebuf.com/news/9555.html", "time": "2013-05-16", "level": "", "num_look": 306676, "num_comment": 30, "author": "pnig0s", "tags": ["资讯"], "text": ""}
{"title": "彭博终端泄露近万条私人消息", "url": "https://www.freebuf.com/news/9579.html", "time": "2013-05-16", "level": "", "num_look": 173754, "num_comment": 2, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "FreebuF黑客专访系列之吴翰清（刺）：接下来几年，有两样东西必定会火", "url": "https://www.freebuf.com/news/others/9353.html", "time": "2013-05-15", "level": "红色标题", "num_look": 2356384, "num_comment": 73, "author": "FB独家", "tags": ["人物志", "其他"], "text": ""}
{"title": "美司法部窃听美联社通话", "url": "https://www.freebuf.com/news/9557.html", "time": "2013-05-15", "level": "", "num_look": 107178, "num_comment": 1, "author": "孤独剑客", "tags": ["资讯"], "text": ""}
{"title": "高级网络攻击(APT)全景", "url": "https://www.freebuf.com/news/9516.html", "time": "2013-05-15", "level": "", "num_look": 196649, "num_comment": 8, "author": "安天实验室", "tags": ["资讯"], "text": ""}
{"title": "34个使用Raspberry Pi的酷创意", "url": "https://www.freebuf.com/geek/9545.html", "time": "2013-05-15", "level": "", "num_look": 263510, "num_comment": 3, "author": "n00b", "tags": ["极客"], "text": ""}
{"title": "使用树莓派制作乐高机器人", "url": "https://www.freebuf.com/geek/9532.html", "time": "2013-05-14", "level": "", "num_look": 367271, "num_comment": 2, "author": "H3lvin", "tags": ["极客"], "text": ""}
{"title": "路透社报告称美国政府是“0day”漏洞最大的买家", "url": "https://www.freebuf.com/news/9518.html", "time": "2013-05-14", "level": "", "num_look": 186174, "num_comment": 22, "author": "blackscreen", "tags": ["资讯"], "text": ""}
{"title": "一种针对网络图片功能的攻击方式", "url": "https://www.freebuf.com/articles/web/7793.html", "time": "2013-05-14", "level": "", "num_look": 350443, "num_comment": 33, "author": "mars", "tags": ["WEB安全"], "text": ""}
{"title": "ID卡学习笔记", "url": "https://www.freebuf.com/articles/wireless/9490.html", "time": "2013-05-14", "level": "", "num_look": 282426, "num_comment": 10, "author": "open", "tags": ["无线安全"], "text": ""}
{"title": "黑客更改T-Mobile运营商更新 iPhone5速度更快", "url": "https://www.freebuf.com/news/9464.html", "time": "2013-05-14", "level": "", "num_look": 108580, "num_comment": 1, "author": "葙守", "tags": ["资讯"], "text": ""}
{"title": "微软发现恶意浏览器插件可劫持Facebook账户", "url": "https://www.freebuf.com/news/9507.html", "time": "2013-05-14", "level": "", "num_look": 122453, "num_comment": 5, "author": "pnig0s", "tags": ["资讯"], "text": ""}
{"title": "2013年WIFI安全趋势不完全评估", "url": "https://www.freebuf.com/articles/wireless/9496.html", "time": "2013-05-14", "level": "", "num_look": 315541, "num_comment": 24, "author": "sheweize000", "tags": ["无线安全"], "text": ""}
{"title": "[专题]台菲黑客战：台湾骇客已取得菲律宾DNS资料库帐号与密码", "url": "https://www.freebuf.com/news/topnews/9468.html", "time": "2013-05-13", "level": "", "num_look": 360061, "num_comment": 49, "author": "猪哥靓", "tags": ["头条"], "text": ""}
{"title": "美国某实验室承认使用量子网络已经两年多", "url": "https://www.freebuf.com/news/9439.html", "time": "2013-05-13", "level": "", "num_look": 125161, "num_comment": 7, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "新一波针对银行金融和运营商的攻击来袭", "url": "https://www.freebuf.com/news/9459.html", "time": "2013-05-13", "level": "红色标题", "num_look": 230333, "num_comment": 36, "author": "moc375", "tags": ["资讯"], "text": ""}
{"title": "驳《低俗文章之傻傻分不清楚的IC和ID卡》：ID和IC之我见", "url": "https://www.freebuf.com/articles/wireless/9461.html", "time": "2013-05-13", "level": "", "num_look": 351047, "num_comment": 30, "author": "菜鸟不会飞", "tags": ["无线安全", "极客"], "text": ""}
{"title": "[专题]菲律宾黑客攻击台湾政府网站", "url": "https://www.freebuf.com/news/9462.html", "time": "2013-05-13", "level": "", "num_look": 127343, "num_comment": 10, "author": "Katherine", "tags": ["头条", "资讯"], "text": ""}
{"title": "观点：加密软件行业在自我吹嘘下繁荣发展", "url": "https://www.freebuf.com/articles/others-articles/9449.html", "time": "2013-05-13", "level": "", "num_look": 164779, "num_comment": 11, "author": "林超", "tags": ["其他", "观点"], "text": ""}
{"title": "低俗文章之傻傻分不清楚的IC和ID卡", "url": "https://www.freebuf.com/articles/wireless/9451.html", "time": "2013-05-13", "level": "红色标题", "num_look": 641886, "num_comment": 14, "author": "radiowar", "tags": ["无线安全", "极客"], "text": ""}
{"title": "江苏君立华域招聘安全工程师", "url": "https://www.freebuf.com/jobs/9389.html", "time": "2013-05-10", "level": "", "num_look": 207363, "num_comment": 23, "author": "x0sec", "tags": ["安全招聘"], "text": ""}
{"title": "美8名犯罪分子在3个月内从ATM取款机盗取4500万美元现金", "url": "https://www.freebuf.com/news/9410.html", "time": "2013-05-10", "level": "", "num_look": 582731, "num_comment": 10, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "那些强悍的PHP一句话后门", "url": "https://www.freebuf.com/articles/web/9396.html", "time": "2013-05-10", "level": "", "num_look": 4996771, "num_comment": 53, "author": "oooceo", "tags": ["WEB安全"], "text": ""}
{"title": "又一钓鱼经典案列分析", "url": "https://www.freebuf.com/articles/web/9337.html", "time": "2013-05-10", "level": "", "num_look": 219262, "num_comment": 16, "author": "darkray", "tags": ["WEB安全"], "text": ""}
{"title": "大规模捕获IPv4数据包工具-Moloch", "url": "https://www.freebuf.com/sectool/9359.html", "time": "2013-05-10", "level": "", "num_look": 371884, "num_comment": 4, "author": "LinuxSpace", "tags": ["工具"], "text": ""}
{"title": "Adobe发布公告称ColdFusion存在严重漏洞", "url": "https://www.freebuf.com/news/9384.html", "time": "2013-05-09", "level": "", "num_look": 223138, "num_comment": 4, "author": "why", "tags": ["漏洞", "资讯"], "text": ""}
{"title": "Cain & Abel v4.9.44发布", "url": "https://www.freebuf.com/sectool/9354.html", "time": "2013-05-09", "level": "", "num_look": 759501, "num_comment": 34, "author": "moss", "tags": ["工具"], "text": ""}
{"title": "Linode被黑事件始末：Linode只是躺着中枪的路人", "url": "https://www.freebuf.com/news/9367.html", "time": "2013-05-09", "level": "红色标题", "num_look": 269249, "num_comment": 14, "author": "cnhawk", "tags": ["资讯"], "text": ""}
{"title": "美国五角大楼公开指责中国网络军事间谍活动", "url": "https://www.freebuf.com/news/9334.html", "time": "2013-05-09", "level": "", "num_look": 125906, "num_comment": 2, "author": "pnig0s", "tags": ["资讯"], "text": ""}
{"title": "南京某信息安全公司招聘安全职位", "url": "https://www.freebuf.com/jobs/9306.html", "time": "2013-05-09", "level": "", "num_look": 204808, "num_comment": 13, "author": "呆子不开口", "tags": ["安全招聘"], "text": ""}
{"title": "美国五角大楼将组建13支网络进攻团队", "url": "https://www.freebuf.com/news/9324.html", "time": "2013-05-08", "level": "", "num_look": 129336, "num_comment": 6, "author": "phper", "tags": ["资讯"], "text": ""}
{"title": "findmyhash.py--整合各类HASH在线破解服务", "url": "https://www.freebuf.com/sectool/9277.html", "time": "2013-05-08", "level": "", "num_look": 388870, "num_comment": 12, "author": "LinuxSpace", "tags": ["工具"], "text": ""}
{"title": "OWASP杭州2013年春季WEB应用安全沙龙（5月25日）", "url": "https://www.freebuf.com/news/others/9233.html", "time": "2013-05-08", "level": "红色标题", "num_look": 202348, "num_comment": 14, "author": "无心喃呢", "tags": ["其他", "周边"], "text": ""}
{"title": "淡化攻击实现过程，系统化解决应用安全问题才是王道", "url": "https://www.freebuf.com/articles/others-articles/9248.html", "time": "2013-05-08", "level": "", "num_look": 256089, "num_comment": 41, "author": "jiayzhan", "tags": ["其他", "观点"], "text": ""}
{"title": "TCP代理数据篡改工具-HookME v0.2.1.0b", "url": "https://www.freebuf.com/sectool/9274.html", "time": "2013-05-08", "level": "", "num_look": 302904, "num_comment": 7, "author": "why", "tags": ["工具"], "text": ""}
{"title": "小米科技招聘应用安全工程师数名", "url": "https://www.freebuf.com/jobs/9311.html", "time": "2013-05-08", "level": "", "num_look": 223221, "num_comment": 24, "author": "淡定淞淞", "tags": ["安全招聘"], "text": ""}
{"title": "[技术分析]波士顿爆炸案Redkit漏洞利用包解析", "url": "https://www.freebuf.com/news/topnews/9203.html", "time": "2013-05-07", "level": "", "num_look": 218068, "num_comment": 11, "author": "LinuxSpace", "tags": ["WEB安全", "头条"], "text": ""}
{"title": "WiFi Pineapple Mark IV 无线安全审计的利器", "url": "https://www.freebuf.com/sectool/9265.html", "time": "2013-05-07", "level": "", "num_look": 820275, "num_comment": 41, "author": "wormfox", "tags": ["工具"], "text": ""}
{"title": "移动设备取证、恶意软件分析和安全测试套件—Santoku", "url": "https://www.freebuf.com/sectool/9280.html", "time": "2013-05-07", "level": "", "num_look": 266830, "num_comment": 2, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "XCon2013安全焦点信息安全技术峰会议题征集函", "url": "https://www.freebuf.com/news/9256.html", "time": "2013-05-07", "level": "", "num_look": 148434, "num_comment": 11, "author": "xconxfocus", "tags": ["资讯"], "text": ""}
{"title": "影子货币--比特币的另一面", "url": "https://www.freebuf.com/news/9238.html", "time": "2013-05-07", "level": "", "num_look": 150429, "num_comment": 7, "author": "blackscreen", "tags": ["资讯"], "text": ""}
{"title": "中国超过一半的电脑被恶意软件感染", "url": "https://www.freebuf.com/news/9270.html", "time": "2013-05-07", "level": "", "num_look": 142773, "num_comment": 11, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "IE8爆出0day，影响所有版本Windows", "url": "https://www.freebuf.com/news/9234.html", "time": "2013-05-06", "level": "", "num_look": 241616, "num_comment": 31, "author": "hihei", "tags": ["漏洞", "资讯"], "text": ""}
{"title": "乐蜂网高薪招聘白盒审计以及WEB安全高级工程师", "url": "https://www.freebuf.com/jobs/9229.html", "time": "2013-05-06", "level": "", "num_look": 182449, "num_comment": 15, "author": "乐蜂网", "tags": ["安全招聘"], "text": ""}
{"title": "SafeKey团队原创渗透神器—Jscan 1.0发布", "url": "https://www.freebuf.com/sectool/9211.html", "time": "2013-05-06", "level": "", "num_look": 391290, "num_comment": 18, "author": "seay", "tags": ["工具"], "text": ""}
{"title": "SqlMap GUI 汉化版", "url": "https://www.freebuf.com/sectool/9119.html", "time": "2013-05-06", "level": "", "num_look": 531226, "num_comment": 23, "author": "Liuker", "tags": ["工具"], "text": ""}
{"title": "简单绕过安全狗进行任何操作 让狗形同虚设", "url": "https://www.freebuf.com/articles/web/9178.html", "time": "2013-05-06", "level": "", "num_look": 715683, "num_comment": 17, "author": "seay", "tags": ["WEB安全"], "text": ""}
{"title": "利用iframe URI钓鱼(以盗取facebook登陆帐号的钓鱼为例)", "url": "https://www.freebuf.com/articles/web/9181.html", "time": "2013-05-03", "level": "", "num_look": 350434, "num_comment": 14, "author": "碳基体", "tags": ["WEB安全"], "text": ""}
{"title": "高级钓鱼攻击来了：针对拍拍的XSS攻击", "url": "https://www.freebuf.com/articles/web/9186.html", "time": "2013-05-03", "level": "红色标题", "num_look": 695965, "num_comment": 62, "author": "余弦", "tags": ["WEB安全"], "text": ""}
{"title": "北京启明星辰总部招聘安全研究顾问", "url": "https://www.freebuf.com/jobs/9095.html", "time": "2013-05-02", "level": "", "num_look": 286485, "num_comment": 18, "author": "熙雅", "tags": ["安全招聘"], "text": ""}
{"title": "nginx爆整数溢出漏洞最新情况(2013-04-29)", "url": "https://www.freebuf.com/news/topnews/9129.html", "time": "2013-05-02", "level": "", "num_look": 182012, "num_comment": 21, "author": "Shawn the R0ck", "tags": ["头条"], "text": ""}
{"title": "[更新后门样本]Darkleech木马升级：可能是最精良的apache后门", "url": "https://www.freebuf.com/news/9133.html", "time": "2013-05-02", "level": "", "num_look": 258128, "num_comment": 22, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "史上最大流量DDOS攻击者被捕", "url": "https://www.freebuf.com/news/9111.html", "time": "2013-04-28", "level": "", "num_look": 500432, "num_comment": 10, "author": "hihei", "tags": ["资讯"], "text": ""}
{"title": "御剑web指纹识别程序(新出的一款WIN平台CMS指纹识别小工具)", "url": "https://www.freebuf.com/sectool/9090.html", "time": "2013-04-28", "level": "", "num_look": 654930, "num_comment": 24, "author": "majia888", "tags": ["工具"], "text": ""}
{"title": "[视频]利用磁卡导致ATM关机", "url": "https://www.freebuf.com/vuls/9102.html", "time": "2013-04-28", "level": "红色标题", "num_look": 476743, "num_comment": 31, "author": "Kevin2600", "tags": ["漏洞", "终端安全"], "text": ""}
{"title": "三谈企业漏洞收集平台建设", "url": "https://www.freebuf.com/articles/others-articles/9059.html", "time": "2013-04-27", "level": "", "num_look": 214833, "num_comment": 10, "author": "cnhawk", "tags": ["企业安全", "其他"], "text": ""}
{"title": "Metasploit+Python实现NTLMv2攻击", "url": "https://www.freebuf.com/articles/system/9023.html", "time": "2013-04-27", "level": "", "num_look": 367029, "num_comment": 19, "author": "LinuxSpace", "tags": ["系统安全"], "text": ""}
{"title": "再谈企业漏洞收集平台建设", "url": "https://www.freebuf.com/articles/others-articles/9045.html", "time": "2013-04-27", "level": "", "num_look": 157715, "num_comment": 10, "author": "superhei", "tags": ["其他", "观点"], "text": ""}
{"title": "DNS反查工具—Resolver 1.0.9", "url": "https://www.freebuf.com/sectool/9068.html", "time": "2013-04-27", "level": "", "num_look": 205406, "num_comment": 6, "author": "大黑哥", "tags": ["工具"], "text": ""}
{"title": "国外研究社交媒体异常行为检测模型", "url": "https://www.freebuf.com/news/9056.html", "time": "2013-04-27", "level": "", "num_look": 154510, "num_comment": 2, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "美国政府最擅长从微软处获得用户数据", "url": "https://www.freebuf.com/news/9029.html", "time": "2013-04-26", "level": "", "num_look": 149338, "num_comment": 9, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "nginx爆整数溢出漏洞", "url": "https://www.freebuf.com/news/9026.html", "time": "2013-04-26", "level": "红色标题", "num_look": 481453, "num_comment": 36, "author": "Bell", "tags": ["资讯"], "text": ""}
{"title": "FireEye最新报告：当前全球网络攻击态势", "url": "https://www.freebuf.com/news/9009.html", "time": "2013-04-26", "level": "", "num_look": 237577, "num_comment": 2, "author": "pnig0s", "tags": ["资讯"], "text": ""}
{"title": "浅谈企业漏洞收集平台建设", "url": "https://www.freebuf.com/articles/others-articles/8963.html", "time": "2013-04-26", "level": "红色标题", "num_look": 541875, "num_comment": 58, "author": "cnhawk", "tags": ["企业安全", "其他"], "text": ""}
{"title": "Web日志安全分析工具 v2.0发布", "url": "https://www.freebuf.com/sectool/8982.html", "time": "2013-04-25", "level": "", "num_look": 618579, "num_comment": 25, "author": "SecSky", "tags": ["WEB安全", "工具"], "text": ""}
{"title": "漏洞扫描器Nessus 5.2新版发布", "url": "https://www.freebuf.com/sectool/8983.html", "time": "2013-04-25", "level": "", "num_look": 585935, "num_comment": 23, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "中国是全球最大的的APT攻击来源", "url": "https://www.freebuf.com/news/8969.html", "time": "2013-04-25", "level": "", "num_look": 169558, "num_comment": 12, "author": "blackscreen", "tags": ["资讯"], "text": ""}
{"title": "WordPress缓存插件可远程执行PHP代码", "url": "https://www.freebuf.com/vuls/8976.html", "time": "2013-04-25", "level": "", "num_look": 174246, "num_comment": 5, "author": "j4cky", "tags": ["漏洞"], "text": ""}
{"title": "LulzSec疑似首脑在澳洲被捕", "url": "https://www.freebuf.com/news/8967.html", "time": "2013-04-25", "level": "", "num_look": 196316, "num_comment": 8, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "中电长城网际招聘android安全研究员", "url": "https://www.freebuf.com/jobs/8919.html", "time": "2013-04-24", "level": "", "num_look": 160739, "num_comment": 7, "author": "super480", "tags": ["安全招聘"], "text": ""}
{"title": "安全杂谈–腾讯TSRC安全沙龙归来", "url": "https://www.freebuf.com/articles/others-articles/8925.html", "time": "2013-04-24", "level": "", "num_look": 188799, "num_comment": 8, "author": "pnig0s", "tags": ["其他"], "text": ""}
{"title": "腾讯TSRC 2013安全沙龙实录：这个头开的不错", "url": "https://www.freebuf.com/news/others/8883.html", "time": "2013-04-24", "level": "红色标题", "num_look": 291826, "num_comment": 26, "author": "thanks", "tags": ["其他", "周边"], "text": ""}
{"title": "[APT专题]国外发现中国针对美国无人机厂商的APT攻击", "url": "https://www.freebuf.com/news/8933.html", "time": "2013-04-24", "level": "", "num_look": 178023, "num_comment": 7, "author": "hihei", "tags": ["头条", "资讯"], "text": ""}
{"title": "中国占全球计算机攻击流量的41%", "url": "https://www.freebuf.com/news/8927.html", "time": "2013-04-24", "level": "", "num_look": 123782, "num_comment": 4, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "[技术分析]利用波士顿马拉松爆炸案热点的新型APT攻击", "url": "https://www.freebuf.com/news/topnews/8904.html", "time": "2013-04-23", "level": "", "num_look": 255782, "num_comment": 15, "author": "moc375", "tags": ["头条", "系统安全"], "text": ""}
{"title": "漏洞马拉松 - AppScan领取", "url": "https://www.freebuf.com/news/others/65493.html", "time": "2013-04-23", "level": "", "num_look": 150809, "num_comment": 150809, "author": "FB客服", "tags": ["周边"], "text": "​IBM成立「安全部门」，并提出「智能安全」（Security Intelligence）概念，透过崭新的安全观，智能化的信息、更精简且统一的信息设备，传递信息安全的集成式平台蓝图。"}
{"title": "“RFID 破解三两事”讨论总结", "url": "https://www.freebuf.com/articles/wireless/8899.html", "time": "2013-04-23", "level": "", "num_look": 485481, "num_comment": 22, "author": "YunFree", "tags": ["无线安全", "极客"], "text": ""}
{"title": "Ruby on Rails静态代码扫描工具—Brakeman v1.9.5", "url": "https://www.freebuf.com/sectool/8860.html", "time": "2013-04-23", "level": "", "num_look": 278970, "num_comment": 2, "author": "thanks", "tags": ["工具"], "text": ""}
{"title": "利用Nmap对MS-SQLSERVER进行渗透", "url": "https://www.freebuf.com/articles/database/8856.html", "time": "2013-04-23", "level": "", "num_look": 557697, "num_comment": 30, "author": "LinuxSpace", "tags": ["数据安全"], "text": ""}
{"title": "IBM Security AppScan V8.7下载", "url": "https://www.freebuf.com/sectool/8775.html", "time": "2013-04-22", "level": "", "num_look": 574776, "num_comment": 41, "author": "unshell", "tags": ["工具"], "text": ""}
{"title": "关于“RFID破解两三事”的一些事", "url": "https://www.freebuf.com/articles/wireless/8858.html", "time": "2013-04-22", "level": "", "num_look": 1398249, "num_comment": 31, "author": "radiowar", "tags": ["无线安全", "极客"], "text": ""}
{"title": "高危漏洞CVE-2013-0027 EXP，影响IE所有版本", "url": "https://www.freebuf.com/vuls/8852.html", "time": "2013-04-22", "level": "", "num_look": 283013, "num_comment": 8, "author": "H3lvin", "tags": ["漏洞"], "text": ""}
{"title": "RFID破解三两事", "url": "https://www.freebuf.com/articles/wireless/8792.html", "time": "2013-04-22", "level": "红色标题", "num_look": 2484184, "num_comment": 84, "author": "YunFree", "tags": ["无线安全", "极客"], "text": ""}
{"title": "EXP开发辅助工具-PEDA", "url": "https://www.freebuf.com/sectool/8839.html", "time": "2013-04-22", "level": "", "num_look": 350659, "num_comment": 9, "author": "pwnwaffe", "tags": ["工具"], "text": ""}
{"title": "无底线了！黑客利用波士顿和德州爆炸案展开攻击", "url": "https://www.freebuf.com/news/8788.html", "time": "2013-04-22", "level": "", "num_look": 214860, "num_comment": 5, "author": "blackscreen", "tags": ["资讯"], "text": ""}
{"title": "在SQL注入中利用MySQL隐形的类型转换绕过WAF检测", "url": "https://www.freebuf.com/articles/web/8773.html", "time": "2013-04-19", "level": "", "num_look": 533414, "num_comment": 18, "author": "碳基体", "tags": ["WEB安全", "数据安全"], "text": ""}
{"title": "lynis—*nix安全审计工具", "url": "https://www.freebuf.com/sectool/8764.html", "time": "2013-04-19", "level": "", "num_look": 356819, "num_comment": 5, "author": "碳基体", "tags": ["工具", "系统安全"], "text": ""}
{"title": "Facebook Home遭黑客修改：可移植到其他手机上", "url": "https://www.freebuf.com/news/8768.html", "time": "2013-04-19", "level": "", "num_look": 105222, "num_comment": 105222, "author": "vilsn", "tags": ["资讯"], "text": ""}
{"title": "GNU/Linux内核的地址随机化", "url": "https://www.freebuf.com/articles/system/8757.html", "time": "2013-04-19", "level": "", "num_look": 209141, "num_comment": 2, "author": "Shawn the R0ck", "tags": ["系统安全"], "text": ""}
{"title": "13年2月的RSA Conference与硅谷", "url": "https://www.freebuf.com/articles/others-articles/8755.html", "time": "2013-04-18", "level": "", "num_look": 114401, "num_comment": 2, "author": "江海客", "tags": ["其他"], "text": ""}
{"title": "Android数据库导出工具—ADEL", "url": "https://www.freebuf.com/sectool/8752.html", "time": "2013-04-18", "level": "", "num_look": 333992, "num_comment": 3, "author": "fake", "tags": ["工具"], "text": ""}
{"title": "再谈内网渗透", "url": "https://www.freebuf.com/articles/system/8726.html", "time": "2013-04-18", "level": "", "num_look": 2248872, "num_comment": 34, "author": "hongygxiang", "tags": ["系统安全"], "text": ""}
{"title": "利用ModSecurity防御暴力破解", "url": "https://www.freebuf.com/articles/web/8749.html", "time": "2013-04-18", "level": "", "num_look": 690247, "num_comment": 12, "author": "kelz", "tags": ["WEB安全"], "text": ""}
{"title": "网爆安全狗存在远程溢出漏洞", "url": "https://www.freebuf.com/news/8745.html", "time": "2013-04-17", "level": "红色标题", "num_look": 499165, "num_comment": 67, "author": "H3lvin", "tags": ["漏洞", "资讯"], "text": ""}
{"title": "思科(CISCO)研发中心招聘信息安全专家", "url": "https://www.freebuf.com/jobs/8699.html", "time": "2013-04-17", "level": "", "num_look": 155901, "num_comment": 5, "author": "dleyanlin", "tags": ["安全招聘"], "text": ""}
{"title": "[更新]天蝎座扫描器0414官方版", "url": "https://www.freebuf.com/sectool/8568.html", "time": "2013-04-17", "level": "", "num_look": 341022, "num_comment": 16, "author": "p0tt1", "tags": ["工具"], "text": ""}
{"title": "自动化注入神器—Havij 1.17 Pro破解版", "url": "https://www.freebuf.com/sectool/8710.html", "time": "2013-04-17", "level": "", "num_look": 1120385, "num_comment": 43, "author": "unshell", "tags": ["工具"], "text": ""}
{"title": "JWPlayer 5最新SWF XSS 0day分析及POC改进", "url": "https://www.freebuf.com/articles/web/8705.html", "time": "2013-04-17", "level": "", "num_look": 186848, "num_comment": 3, "author": "pnig0s", "tags": ["WEB安全"], "text": ""}
{"title": "黑客声称已取得Linode所有信用卡信息，并公开了代码片段和服务器目录", "url": "https://www.freebuf.com/news/8722.html", "time": "2013-04-17", "level": "", "num_look": 251032, "num_comment": 12, "author": "Vilsn", "tags": ["资讯"], "text": ""}
{"title": "黑客瞄上Dota冠军联赛，开出2万美金“保护费”", "url": "https://www.freebuf.com/news/8658.html", "time": "2013-04-16", "level": "", "num_look": 296288, "num_comment": 17, "author": "blackscreen", "tags": ["资讯"], "text": ""}
{"title": "Cobalt Strike—Armitage商业版", "url": "https://www.freebuf.com/sectool/8445.html", "time": "2013-04-16", "level": "", "num_look": 955395, "num_comment": 7, "author": "元首", "tags": ["工具"], "text": ""}
{"title": "Exploit/漏洞搜索引擎—ExploitSearch.net", "url": "https://www.freebuf.com/sectool/8651.html", "time": "2013-04-16", "level": "", "num_look": 274020, "num_comment": 11, "author": "thanks", "tags": ["工具"], "text": ""}
{"title": "易想团购ajax.php SQL注入分析和Exp", "url": "https://www.freebuf.com/vuls/8558.html", "time": "2013-04-16", "level": "", "num_look": 220047, "num_comment": 3, "author": "f4ckr00t", "tags": ["WEB安全", "漏洞"], "text": ""}
{"title": "在线赌博系统B3W爆出漏洞", "url": "https://www.freebuf.com/news/8622.html", "time": "2013-04-16", "level": "", "num_look": 754444, "num_comment": 10, "author": "kelz", "tags": ["漏洞", "资讯"], "text": ""}
{"title": "美国联邦航空局发表声明，劫持飞机技术只适用于模拟器", "url": "https://www.freebuf.com/news/8604.html", "time": "2013-04-15", "level": "", "num_look": 202768, "num_comment": 9, "author": "Yuuu", "tags": ["资讯"], "text": ""}
{"title": "S-X弱口令扫描工具 V1.0", "url": "https://www.freebuf.com/sectool/8515.html", "time": "2013-04-15", "level": "", "num_look": 1336619, "num_comment": 33, "author": "unshell", "tags": ["工具"], "text": ""}
{"title": "从RadioWar定制版Proxmark3了解与原版Proxmark3区别", "url": "https://www.freebuf.com/geek/8545.html", "time": "2013-04-15", "level": "", "num_look": 322985, "num_comment": 16, "author": "radiowar", "tags": ["极客"], "text": ""}
{"title": "Fedora下安装web漏洞扫描器Arachni", "url": "https://www.freebuf.com/articles/web/8540.html", "time": "2013-04-15", "level": "", "num_look": 414067, "num_comment": 5, "author": "younstar", "tags": ["WEB安全"], "text": ""}
{"title": "卡巴斯基发现专门攻击网游公司的中国黑客组织", "url": "https://www.freebuf.com/news/8569.html", "time": "2013-04-15", "level": "", "num_look": 180233, "num_comment": 14, "author": "Mystery", "tags": ["资讯"], "text": ""}
{"title": "PHPTaint-检测xss/sqli/shell注入的php扩展模块", "url": "https://www.freebuf.com/articles/web/8551.html", "time": "2013-04-13", "level": "红色标题", "num_look": 312189, "num_comment": 23, "author": "碳基体", "tags": ["WEB安全"], "text": ""}
{"title": "如何用Android智能手机劫持一架飞机（PPT下载）", "url": "https://www.freebuf.com/news/8535.html", "time": "2013-04-12", "level": "", "num_look": 174253, "num_comment": 8, "author": "444", "tags": ["资讯"], "text": ""}
{"title": "VoIP渗透测试套件—Viproy", "url": "https://www.freebuf.com/sectool/8531.html", "time": "2013-04-12", "level": "", "num_look": 171633, "num_comment": 1, "author": "fake", "tags": ["工具"], "text": ""}
{"title": "完美世界总部招聘安全工程师", "url": "https://www.freebuf.com/jobs/8489.html", "time": "2013-04-12", "level": "", "num_look": 171375, "num_comment": 16, "author": "完美世界", "tags": ["安全招聘"], "text": ""}
{"title": "天蝎座扫描器V3.130306官方版（更新+下载地址）", "url": "https://www.freebuf.com/sectool/8502.html", "time": "2013-04-12", "level": "", "num_look": 473320, "num_comment": 32, "author": "p0tt1", "tags": ["工具"], "text": ""}
{"title": "浅谈内网渗透", "url": "https://www.freebuf.com/articles/system/8499.html", "time": "2013-04-12", "level": "", "num_look": 1529483, "num_comment": 44, "author": "G.r0b1n", "tags": ["系统安全"], "text": ""}
{"title": "Julius，一个僵尸网络的王者", "url": "https://www.freebuf.com/news/8479.html", "time": "2013-04-12", "level": "", "num_look": 167765, "num_comment": 17, "author": "blackscreen", "tags": ["资讯"], "text": ""}
{"title": "维基解密公开170多万份美国外交记录", "url": "https://www.freebuf.com/news/8466.html", "time": "2013-04-12", "level": "", "num_look": 111859, "num_comment": 3, "author": "jacky", "tags": ["资讯"], "text": ""}
{"title": "蓝盾信息安全技术股份有限公司招聘", "url": "https://www.freebuf.com/jobs/8432.html", "time": "2013-04-11", "level": "", "num_look": 197977, "num_comment": 11, "author": "saint", "tags": ["安全招聘"], "text": ""}
{"title": "[APT专题]中国黑客利用Twitter进行APT攻击", "url": "https://www.freebuf.com/news/topnews/8481.html", "time": "2013-04-11", "level": "", "num_look": 331394, "num_comment": 26, "author": "kelz", "tags": ["WEB安全", "头条"], "text": ""}
{"title": "浏览器沙盒环境—Browser Sandbox", "url": "https://www.freebuf.com/sectool/8477.html", "time": "2013-04-11", "level": "现金奖励", "num_look": 384951, "num_comment": 8, "author": "thanks", "tags": ["工具"], "text": ""}
{"title": "[专题]韩国遭受网络攻击事件水落石出", "url": "https://www.freebuf.com/news/8468.html", "time": "2013-04-11", "level": "", "num_look": 209489, "num_comment": 13, "author": "kelz", "tags": ["头条", "资讯"], "text": ""}
{"title": "[职业人生]一位信息安全从业者的工作总结", "url": "https://www.freebuf.com/articles/others-articles/8447.html", "time": "2013-04-11", "level": "", "num_look": 317529, "num_comment": 22, "author": "cnbird", "tags": ["其他"], "text": ""}
{"title": "知道创宇招聘首席淫秽色情鉴定官", "url": "https://www.freebuf.com/jobs/8444.html", "time": "2013-04-10", "level": "", "num_look": 258352, "num_comment": 25, "author": "路人", "tags": ["安全招聘"], "text": ""}
{"title": "Metasploit结合XSSF使用小记", "url": "https://www.freebuf.com/articles/system/8440.html", "time": "2013-04-10", "level": "", "num_look": 275903, "num_comment": 15, "author": "malayke", "tags": ["系统安全"], "text": ""}
{"title": "首届陕西理工学院“网络攻防大赛”即将进行", "url": "https://www.freebuf.com/news/others/8415.html", "time": "2013-04-10", "level": "", "num_look": 219833, "num_comment": 15, "author": "Circus", "tags": ["其他", "周边"], "text": ""}
{"title": "LFI（本地包含）漏洞助手—Panoptic", "url": "https://www.freebuf.com/sectool/8427.html", "time": "2013-04-10", "level": "", "num_look": 375962, "num_comment": 12, "author": "LinuxSpace", "tags": ["工具"], "text": ""}
{"title": "易想团购系统通杀SQL注入漏洞分析及利用", "url": "https://www.freebuf.com/articles/web/8422.html", "time": "2013-04-10", "level": "", "num_look": 210636, "num_comment": 1, "author": "seay", "tags": ["WEB安全"], "text": ""}
{"title": "机器人终于穿上衣服了！", "url": "https://www.freebuf.com/geek/8421.html", "time": "2013-04-10", "level": "", "num_look": 232069, "num_comment": 4, "author": "H3lvin", "tags": ["极客"], "text": ""}
{"title": "《走进科学》之“黑客来了”观后感—人人都可以5分钟破密码", "url": "https://www.freebuf.com/news/8406.html", "time": "2013-04-09", "level": "红色标题", "num_look": 1006716, "num_comment": 114, "author": "小土鸡", "tags": ["其他", "头条"], "text": ""}
{"title": "黑客、色情、黑公关——管窥中国互联网的地下世界", "url": "https://www.freebuf.com/news/8401.html", "time": "2013-04-09", "level": "", "num_look": 243647, "num_comment": 26, "author": "波波", "tags": ["资讯"], "text": ""}
{"title": "IPv4/IPv6网络安全测试工具—Evil Foca (Alpha版)", "url": "https://www.freebuf.com/sectool/8397.html", "time": "2013-04-09", "level": "", "num_look": 294550, "num_comment": 3, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "技术帝自制LED手表，一般人儿你看不懂", "url": "https://www.freebuf.com/geek/8383.html", "time": "2013-04-09", "level": "", "num_look": 154099, "num_comment": 3, "author": "geekpark", "tags": ["极客"], "text": ""}
{"title": "FlashFXP密码恢复软件-FlashfxpPasswordDecryptor", "url": "https://www.freebuf.com/sectool/8395.html", "time": "2013-04-09", "level": "", "num_look": 186374, "num_comment": 3, "author": "Hacking", "tags": ["工具"], "text": ""}
{"title": "Kali Linux渗透测试系统使用小记", "url": "https://www.freebuf.com/articles/system/8381.html", "time": "2013-04-09", "level": "", "num_look": 520783, "num_comment": 24, "author": "ic3te4r", "tags": ["系统安全"], "text": ""}
{"title": "短信炸弹—用Python模拟ajax请求", "url": "https://www.freebuf.com/sectool/8378.html", "time": "2013-04-08", "level": "", "num_look": 451295, "num_comment": 31, "author": "xfk", "tags": ["WEB安全", "工具"], "text": ""}
{"title": "查找phpwebshell小工具", "url": "https://www.freebuf.com/sectool/8341.html", "time": "2013-04-08", "level": "", "num_look": 206274, "num_comment": 6, "author": "冷冷的夜", "tags": ["工具"], "text": ""}
{"title": "微软将会修复两个严重漏洞，涉及Windows和IE浏览器", "url": "https://www.freebuf.com/news/8366.html", "time": "2013-04-08", "level": "", "num_look": 118268, "num_comment": 1, "author": "pnig0s", "tags": ["资讯"], "text": ""}
{"title": "恶意软件Darkleech大肆感染Apache服务器", "url": "https://www.freebuf.com/news/8363.html", "time": "2013-04-08", "level": "", "num_look": 161926, "num_comment": 13, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "Anonymous组织在大屠杀纪念日展开对以色列的“屠杀”", "url": "https://www.freebuf.com/news/8358.html", "time": "2013-04-08", "level": "", "num_look": 140892, "num_comment": 5, "author": "blackscreen", "tags": ["资讯"], "text": ""}
{"title": "伪装来自扫描仪的恶意邮件诱骗用户中招", "url": "https://www.freebuf.com/news/8335.html", "time": "2013-04-07", "level": "", "num_look": 123110, "num_comment": 123110, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "Android渗透测试虚拟机环境（VM）—AppUse", "url": "https://www.freebuf.com/sectool/8330.html", "time": "2013-04-07", "level": "", "num_look": 313421, "num_comment": 19, "author": "geek", "tags": ["工具"], "text": ""}
{"title": "交互式安全工具控制台—Hackersh 0.1发布", "url": "https://www.freebuf.com/sectool/8285.html", "time": "2013-04-07", "level": "", "num_look": 163308, "num_comment": 3, "author": "LinuxSpace", "tags": ["工具"], "text": ""}
{"title": "通过Skype传播进行比特币挖掘的木马被发现", "url": "https://www.freebuf.com/news/8326.html", "time": "2013-04-07", "level": "", "num_look": 133427, "num_comment": 2, "author": "blackscreen", "tags": ["资讯"], "text": ""}
{"title": "世界最大在线文档库Scridb遭黑客入侵", "url": "https://www.freebuf.com/news/8323.html", "time": "2013-04-07", "level": "", "num_look": 127479, "num_comment": 2, "author": "history", "tags": ["资讯"], "text": ""}
{"title": "ESPCMS最新cookie注入漏洞分析", "url": "https://www.freebuf.com/articles/web/8282.html", "time": "2013-04-04", "level": "", "num_look": 201905, "num_comment": 9, "author": "n3wf", "tags": ["WEB安全"], "text": ""}
{"title": "US-CERT：DNS服务器配置不当是上周300G DDoS的元凶", "url": "https://www.freebuf.com/news/8261.html", "time": "2013-04-03", "level": "", "num_look": 205839, "num_comment": 10, "author": "blackscreen", "tags": ["头条", "资讯"], "text": ""}
{"title": "Acunetix Web Vulnerability Scanner 8.20130308 Release", "url": "https://www.freebuf.com/sectool/8260.html", "time": "2013-04-03", "level": "", "num_look": 354803, "num_comment": 45, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "TCP代理工具(Data tamper)—hookme", "url": "https://www.freebuf.com/sectool/8249.html", "time": "2013-04-03", "level": "", "num_look": 258259, "num_comment": 13, "author": "dangdang", "tags": ["工具"], "text": ""}
{"title": "针对取证的GNU/Linux发行版: PALADIN", "url": "https://www.freebuf.com/sectool/8232.html", "time": "2013-04-03", "level": "", "num_look": 225225, "num_comment": 4, "author": "Shawn the R0ck", "tags": ["工具"], "text": ""}
{"title": "追踪用户点击进行Email钓鱼", "url": "https://www.freebuf.com/articles/web/8087.html", "time": "2013-04-03", "level": "", "num_look": 242771, "num_comment": 3, "author": "LinuxSpace", "tags": ["WEB安全"], "text": ""}
{"title": "网站整站下载工具—HTTrack Website Copier", "url": "https://www.freebuf.com/sectool/8247.html", "time": "2013-04-02", "level": "红色标题", "num_look": 650570, "num_comment": 11, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "phpcms v9本地文件包含漏洞超详细分析", "url": "https://www.freebuf.com/articles/web/8230.html", "time": "2013-04-02", "level": "", "num_look": 599238, "num_comment": 10, "author": "seay", "tags": ["WEB安全"], "text": ""}
{"title": "诺基亚招聘信息安全专家", "url": "https://www.freebuf.com/jobs/8234.html", "time": "2013-04-02", "level": "", "num_look": 158437, "num_comment": 7, "author": "leila", "tags": ["安全招聘"], "text": ""}
{"title": "来自国内的大规模挂马攻击，目标DedeCMS", "url": "https://www.freebuf.com/articles/web/8225.html", "time": "2013-04-02", "level": "", "num_look": 224511, "num_comment": 9, "author": "余弦", "tags": ["WEB安全"], "text": ""}
{"title": "如何监听无线键盘", "url": "https://www.freebuf.com/articles/wireless/8118.html", "time": "2013-04-02", "level": "", "num_look": 430783, "num_comment": 4, "author": "LinuxSpace", "tags": ["无线安全", "终端安全"], "text": ""}
{"title": "渗透测试学习平台-web for pentester", "url": "https://www.freebuf.com/sectool/8215.html", "time": "2013-04-02", "level": "", "num_look": 1163700, "num_comment": 37, "author": "hihei", "tags": ["工具"], "text": ""}
{"title": "PowerSploit+Metasploit=Shells", "url": "https://www.freebuf.com/articles/system/8130.html", "time": "2013-04-01", "level": "", "num_look": 297369, "num_comment": 7, "author": "LinuxSpace", "tags": ["系统安全"], "text": ""}
{"title": "苹果iMessage的DDoS攻击事件预示更大的威胁", "url": "https://www.freebuf.com/news/8197.html", "time": "2013-04-01", "level": "", "num_look": 120294, "num_comment": 120294, "author": "blackscreen", "tags": ["资讯"], "text": ""}
{"title": "[电子书]网络安全杂志S.Y.C《桃园》第六期下载", "url": "https://www.freebuf.com/articles/others-articles/8173.html", "time": "2013-04-01", "level": "", "num_look": 167023, "num_comment": 17, "author": "L.N.", "tags": ["其他"], "text": ""}
{"title": "[php 代码审计]Espcms 暴力注入", "url": "https://www.freebuf.com/vuls/8185.html", "time": "2013-04-01", "level": "", "num_look": 277103, "num_comment": 12, "author": "Yaseng", "tags": ["WEB安全", "漏洞"], "text": ""}
{"title": "黑客利用Evernote帐号控制服务器", "url": "https://www.freebuf.com/news/8165.html", "time": "2013-03-30", "level": "", "num_look": 167276, "num_comment": 2, "author": "LinuxSpace", "tags": ["资讯"], "text": ""}
{"title": "SQLNuke:MYSQL load_file()函数注入工具", "url": "https://www.freebuf.com/sectool/8128.html", "time": "2013-03-29", "level": "", "num_look": 228689, "num_comment": 8, "author": "LinuxSpace", "tags": ["工具"], "text": ""}
{"title": "恶意程序Dexter升级版vSkimmer横空出世", "url": "https://www.freebuf.com/news/8123.html", "time": "2013-03-29", "level": "", "num_look": 107798, "num_comment": 2, "author": "LinuxSpace", "tags": ["资讯"], "text": ""}
{"title": "美国招聘高级分析师对抗中国黑客威胁", "url": "https://www.freebuf.com/news/8117.html", "time": "2013-03-29", "level": "红色标题", "num_look": 214054, "num_comment": 28, "author": "大伯伯", "tags": ["资讯"], "text": ""}
{"title": "Websense安全专家表示：支持Java的浏览器非常脆弱", "url": "https://www.freebuf.com/news/8097.html", "time": "2013-03-29", "level": "", "num_look": 138203, "num_comment": 11, "author": "LinuxSpace", "tags": ["资讯"], "text": ""}
{"title": "D-Link路由器密码找回工具—DLink Password Decryptor", "url": "https://www.freebuf.com/sectool/8105.html", "time": "2013-03-28", "level": "", "num_look": 214890, "num_comment": 3, "author": "fake", "tags": ["工具"], "text": ""}
{"title": "300Gbps！Spamhaus创造DDoS历史", "url": "https://www.freebuf.com/news/8102.html", "time": "2013-03-28", "level": "红色标题", "num_look": 293255, "num_comment": 5, "author": "blackscreen", "tags": ["头条", "资讯"], "text": ""}
{"title": "研究人员称：数码相机可以轻易变为间谍设备", "url": "https://www.freebuf.com/news/8086.html", "time": "2013-03-28", "level": "", "num_look": 106849, "num_comment": 1, "author": "pnig0s", "tags": ["资讯"], "text": ""}
{"title": "看不见硝烟的战场--叙利亚内战背后一边倒的网络战", "url": "https://www.freebuf.com/news/8090.html", "time": "2013-03-28", "level": "", "num_look": 135555, "num_comment": 135555, "author": "blackscreen", "tags": ["资讯"], "text": ""}
{"title": "Openssl renegotiation DoS攻击仍然难以解决", "url": "https://www.freebuf.com/articles/system/8085.html", "time": "2013-03-28", "level": "", "num_look": 188630, "num_comment": 188630, "author": "Shawn the R0ck", "tags": ["系统安全"], "text": ""}
{"title": "研究人员首次发现用于针对性攻击的Android木马", "url": "https://www.freebuf.com/news/8092.html", "time": "2013-03-28", "level": "红色标题", "num_look": 201390, "num_comment": 18, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "世界首部“自发电”数码相机—Low-tech", "url": "https://www.freebuf.com/geek/8079.html", "time": "2013-03-27", "level": "", "num_look": 117900, "num_comment": 5, "author": "geekpark", "tags": ["极客"], "text": ""}
{"title": "HTTP(S)中间人流量分析&蜜罐工具—HoneyProxy", "url": "https://www.freebuf.com/sectool/8073.html", "time": "2013-03-27", "level": "", "num_look": 242031, "num_comment": 15, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "伊斯兰网络战士(Cyber Fighters)攻势的进展和变化", "url": "https://www.freebuf.com/news/8075.html", "time": "2013-03-27", "level": "", "num_look": 175661, "num_comment": 6, "author": "blackscreen", "tags": ["资讯"], "text": ""}
{"title": "社会工程学之诱饵攻击真实案例", "url": "https://www.freebuf.com/articles/others-articles/8067.html", "time": "2013-03-27", "level": "", "num_look": 566602, "num_comment": 20, "author": "hihei", "tags": ["其他"], "text": ""}
{"title": "免费网络监控抓包工具—Capsa", "url": "https://www.freebuf.com/sectool/8071.html", "time": "2013-03-27", "level": "", "num_look": 309157, "num_comment": 18, "author": "evil", "tags": ["工具"], "text": ""}
{"title": "垃圾邮件王者Grum死灰复燃", "url": "https://www.freebuf.com/news/8069.html", "time": "2013-03-27", "level": "", "num_look": 122185, "num_comment": 5, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "MongoDB服务器端的JavaScript注入", "url": "https://www.freebuf.com/articles/database/8051.html", "time": "2013-03-26", "level": "", "num_look": 231886, "num_comment": 231886, "author": "LinuxSpace", "tags": ["数据安全"], "text": ""}
{"title": "白帽大胜入侵者——一场经典的DDoS攻防战", "url": "https://www.freebuf.com/news/8046.html", "time": "2013-03-26", "level": "", "num_look": 310906, "num_comment": 25, "author": "blackscreen", "tags": ["资讯"], "text": ""}
{"title": "ShmooCon 2013演讲者视频合辑", "url": "https://www.freebuf.com/news/8047.html", "time": "2013-03-26", "level": "", "num_look": 121887, "num_comment": 1, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "Discuz防注入函数绕过方法分析及没用心的修复补丁", "url": "https://www.freebuf.com/articles/web/8038.html", "time": "2013-03-25", "level": "", "num_look": 317123, "num_comment": 10, "author": "seay", "tags": ["WEB安全"], "text": ""}
{"title": "Rogue Pi-基于树莓派的渗透Dropbox", "url": "https://www.freebuf.com/articles/terminal/8010.html", "time": "2013-03-25", "level": "", "num_look": 277042, "num_comment": 8, "author": "comeover", "tags": ["终端安全", "视频"], "text": ""}
{"title": "一段黄色笑话引发的DDoS攻击", "url": "https://www.freebuf.com/news/8003.html", "time": "2013-03-25", "level": "红色标题", "num_look": 221904, "num_comment": 10, "author": "blackscreen", "tags": ["资讯"], "text": ""}
{"title": "基于ngx_lua开发的web应用防火墙开源", "url": "https://www.freebuf.com/sectool/7990.html", "time": "2013-03-25", "level": "", "num_look": 313858, "num_comment": 16, "author": "justpost", "tags": ["工具"], "text": ""}
{"title": "也谈谈网络战", "url": "https://www.freebuf.com/articles/others-articles/8016.html", "time": "2013-03-25", "level": "", "num_look": 193256, "num_comment": 21, "author": "eip_0x", "tags": ["其他"], "text": ""}
{"title": "[专题]韩国银行攻击案带给我们的反思", "url": "https://www.freebuf.com/news/7997.html", "time": "2013-03-25", "level": "", "num_look": 179107, "num_comment": 9, "author": "blackscreen", "tags": ["头条", "资讯"], "text": ""}
{"title": "iCloud和Apple ID开始采用双重认证", "url": "https://www.freebuf.com/news/7976.html", "time": "2013-03-24", "level": "", "num_look": 187177, "num_comment": 187177, "author": "LinuxSpace", "tags": ["资讯"], "text": ""}
{"title": "apple ID可绕过安全提示问题直接修改密码漏洞", "url": "https://www.freebuf.com/vuls/7971.html", "time": "2013-03-22", "level": "", "num_look": 475457, "num_comment": 14, "author": "碳基体", "tags": ["漏洞"], "text": ""}
{"title": "[专题]什么原因导致追查攻击韩国幕后的黑手如此困难", "url": "https://www.freebuf.com/news/7967.html", "time": "2013-03-22", "level": "", "num_look": 155220, "num_comment": 6, "author": "blackscreen", "tags": ["头条", "资讯"], "text": ""}
{"title": "分离Weevely加密模块加密任意WebShell", "url": "https://www.freebuf.com/sectool/7875.html", "time": "2013-03-22", "level": "", "num_look": 264998, "num_comment": 6, "author": "冷冷的夜", "tags": ["工具"], "text": ""}
{"title": "黑产科普—最近大规模的QQ空间钓鱼攻击", "url": "https://www.freebuf.com/articles/web/7951.html", "time": "2013-03-22", "level": "", "num_look": 460213, "num_comment": 28, "author": "余弦", "tags": ["WEB安全"], "text": ""}
{"title": "僵尸网络市场调查报告：生机勃勃，人气鼎盛", "url": "https://www.freebuf.com/news/7929.html", "time": "2013-03-22", "level": "", "num_look": 129999, "num_comment": 6, "author": "blackscreen", "tags": ["资讯"], "text": ""}
{"title": "利用Flash漏洞病毒分析报告", "url": "https://www.freebuf.com/articles/web/7934.html", "time": "2013-03-22", "level": "", "num_look": 146903, "num_comment": 6, "author": "H3lvin", "tags": ["WEB安全"], "text": ""}
{"title": "[专题]详细分析韩国网络攻击（Trojan.Hastati）", "url": "https://www.freebuf.com/news/7926.html", "time": "2013-03-22", "level": "", "num_look": 231221, "num_comment": 27, "author": "kelz", "tags": ["头条", "资讯"], "text": ""}
{"title": "padding oracle vul attack实战（视频）", "url": "https://www.freebuf.com/video/7888.html", "time": "2013-03-21", "level": "", "num_look": 973309, "num_comment": 19, "author": "safetest", "tags": ["视频"], "text": ""}
{"title": "[专题]韩国称网络攻击恶意代码来自中国", "url": "https://www.freebuf.com/news/7908.html", "time": "2013-03-21", "level": "", "num_look": 122859, "num_comment": 6, "author": "woi", "tags": ["头条", "资讯"], "text": ""}
{"title": "[专题]韩国针对网络攻击进行调查", "url": "https://www.freebuf.com/news/7897.html", "time": "2013-03-21", "level": "", "num_look": 136856, "num_comment": 1, "author": "blackscreen", "tags": ["头条", "资讯"], "text": ""}
{"title": "XSS漏洞攻击测试平台—XSSF v3.0", "url": "https://www.freebuf.com/sectool/7902.html", "time": "2013-03-21", "level": "", "num_look": 442990, "num_comment": 6, "author": "xsser", "tags": ["工具"], "text": ""}
{"title": "北约全球网络战指南出版", "url": "https://www.freebuf.com/news/7853.html", "time": "2013-03-21", "level": "", "num_look": 112088, "num_comment": 3, "author": "blackscreen", "tags": ["资讯"], "text": ""}
{"title": "[专题]韩国遭受大规模网络攻击，朝鲜黑客所为？", "url": "https://www.freebuf.com/news/7892.html", "time": "2013-03-21", "level": "", "num_look": 163529, "num_comment": 19, "author": "kelz", "tags": ["头条", "资讯"], "text": ""}
{"title": "纽约时报指责美企业遭中国黑客攻击后保持沉默，专家予以回应", "url": "https://www.freebuf.com/news/7822.html", "time": "2013-03-20", "level": "", "num_look": 107252, "num_comment": 107252, "author": "blackscreen", "tags": ["资讯"], "text": ""}
{"title": "针对EA Origin游戏对战平台远程向量攻击", "url": "https://www.freebuf.com/news/7826.html", "time": "2013-03-20", "level": "", "num_look": 128880, "num_comment": 1, "author": "LinuxSpace", "tags": ["资讯"], "text": ""}
{"title": "免费Android客户端静态代码安全分析工具—Dexter", "url": "https://www.freebuf.com/sectool/7843.html", "time": "2013-03-20", "level": "", "num_look": 195200, "num_comment": 8, "author": "马化腾", "tags": ["工具"], "text": ""}
{"title": "攻击美国AT&T电信公司黑客被判刑", "url": "https://www.freebuf.com/news/7851.html", "time": "2013-03-20", "level": "", "num_look": 126876, "num_comment": 10, "author": "hihei", "tags": ["资讯"], "text": ""}
{"title": "趋势科技搭建工控蜜罐系统", "url": "https://www.freebuf.com/news/7833.html", "time": "2013-03-20", "level": "", "num_look": 324280, "num_comment": 14, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "全球黑客在关注什么之exploit-db Web篇", "url": "https://www.freebuf.com/news/7802.html", "time": "2013-03-19", "level": "", "num_look": 398573, "num_comment": 10, "author": "余弦", "tags": ["资讯"], "text": ""}
{"title": "JavaScript控制href属性进行钓鱼", "url": "https://www.freebuf.com/news/7776.html", "time": "2013-03-19", "level": "", "num_look": 188456, "num_comment": 3, "author": "LinuxSpace", "tags": ["资讯"], "text": ""}
{"title": "社会工程学工具集Social-Engineer Toolkit (SET) v4.7发布", "url": "https://www.freebuf.com/sectool/7841.html", "time": "2013-03-19", "level": "", "num_look": 296637, "num_comment": 4, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "黑客入侵赌场摄像头，像电影一样出老千", "url": "https://www.freebuf.com/news/others/7803.html", "time": "2013-03-19", "level": "", "num_look": 214959, "num_comment": 21, "author": "剑心", "tags": ["其他", "周边"], "text": ""}
{"title": "GNU/Linux内核新特性引发提权漏洞", "url": "https://www.freebuf.com/articles/system/7796.html", "time": "2013-03-19", "level": "", "num_look": 156524, "num_comment": 5, "author": "Shawn the R0ck", "tags": ["系统安全"], "text": ""}
{"title": "英国政府宣布“减少网络犯罪合作计划”", "url": "https://www.freebuf.com/news/7772.html", "time": "2013-03-19", "level": "", "num_look": 119196, "num_comment": 119196, "author": "blackscreen", "tags": ["资讯"], "text": ""}
{"title": "T-Mobile被指在英国监控用户的浏览内容", "url": "https://www.freebuf.com/news/7759.html", "time": "2013-03-19", "level": "", "num_look": 98755, "num_comment": 98755, "author": "hotinwei", "tags": ["资讯"], "text": ""}
{"title": "[POC]AMD 显卡催化剂自动更新程序漏洞", "url": "https://www.freebuf.com/news/7780.html", "time": "2013-03-18", "level": "", "num_look": 133513, "num_comment": 2, "author": "LinuxSpace", "tags": ["漏洞", "资讯"], "text": ""}
{"title": "微软漏洞允许USB设备接入绕过安全控制", "url": "https://www.freebuf.com/news/7788.html", "time": "2013-03-18", "level": "", "num_look": 126815, "num_comment": 7, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "俄罗斯研究人员指责华为USB猫（调制解调器）存在漏洞", "url": "https://www.freebuf.com/news/7784.html", "time": "2013-03-18", "level": "", "num_look": 114730, "num_comment": 1, "author": "thanks", "tags": ["资讯"], "text": ""}
{"title": "黑客线上、线下一起搞的伎俩，可能造成对人身安全的威胁", "url": "https://www.freebuf.com/news/7769.html", "time": "2013-03-18", "level": "", "num_look": 137124, "num_comment": 11, "author": "blackscreen", "tags": ["资讯"], "text": ""}
{"title": "渗透测试技巧分享", "url": "https://www.freebuf.com/articles/system/7331.html", "time": "2013-03-18", "level": "", "num_look": 337347, "num_comment": 34, "author": "hack520", "tags": ["系统安全"], "text": ""}
{"title": "NIST公布国家漏洞库（NVD）遭入侵调查的结果", "url": "https://www.freebuf.com/news/7749.html", "time": "2013-03-18", "level": "", "num_look": 122977, "num_comment": 2, "author": "blackscreen", "tags": ["资讯"], "text": ""}
{"title": "惠普LaserJet打印机漏洞可以远程访问数据", "url": "https://www.freebuf.com/news/7721.html", "time": "2013-03-18", "level": "", "num_look": 320222, "num_comment": 1, "author": "LinuxSpace", "tags": ["资讯"], "text": ""}
{"title": "[POC]TP-Link路由器存在漏洞", "url": "https://www.freebuf.com/vuls/7738.html", "time": "2013-03-16", "level": "", "num_look": 315483, "num_comment": 15, "author": "LinuxSpace", "tags": ["漏洞"], "text": ""}
{"title": "美国国家信息安全漏洞库（NVD）被黑", "url": "https://www.freebuf.com/news/7722.html", "time": "2013-03-15", "level": "", "num_look": 210187, "num_comment": 15, "author": "LinuxSpace", "tags": ["资讯"], "text": ""}
{"title": "iOS配置文件漏洞引发恶意软件威胁", "url": "https://www.freebuf.com/news/7720.html", "time": "2013-03-15", "level": "", "num_look": 100610, "num_comment": 2, "author": "LinuxSpace", "tags": ["资讯"], "text": ""}
{"title": "黑帽欧洲2013会议：10个有趣的安全简报", "url": "https://www.freebuf.com/news/topnews/7719.html", "time": "2013-03-15", "level": "", "num_look": 116786, "num_comment": 116786, "author": "猪哥靓", "tags": ["头条"], "text": ""}
{"title": "中国黑客渗透印度国防研究与发展组织", "url": "https://www.freebuf.com/news/7711.html", "time": "2013-03-14", "level": "", "num_look": 140384, "num_comment": 9, "author": "bey0nd", "tags": ["资讯"], "text": ""}
{"title": "BackTrack下一代产品—kali Linux 1.0 发布", "url": "https://www.freebuf.com/sectool/7704.html", "time": "2013-03-14", "level": "", "num_look": 342577, "num_comment": 42, "author": "10457793", "tags": ["工具"], "text": ""}
{"title": "Facebook爆出新的OAuth漏洞", "url": "https://www.freebuf.com/news/7694.html", "time": "2013-03-14", "level": "", "num_look": 131910, "num_comment": 2, "author": "LinuxSpace", "tags": ["资讯"], "text": ""}
{"title": "破解加盐（Salted）SHA256 Hash工具—SHA256 Salted Hash Kracker", "url": "https://www.freebuf.com/sectool/7676.html", "time": "2013-03-14", "level": "", "num_look": 468013, "num_comment": 6, "author": "dangdang", "tags": ["工具"], "text": ""}
{"title": "金山软件集团招聘安全相关人员", "url": "https://www.freebuf.com/jobs/7688.html", "time": "2013-03-13", "level": "", "num_look": 152720, "num_comment": 13, "author": "Crow", "tags": ["安全招聘"], "text": ""}
{"title": "API自动化跟踪工具 - Malpimp", "url": "https://www.freebuf.com/sectool/7672.html", "time": "2013-03-13", "level": "", "num_look": 246605, "num_comment": 6, "author": "flowing", "tags": ["工具"], "text": ""}
{"title": "BackTrack5 R3小笔记", "url": "https://www.freebuf.com/articles/web/7670.html", "time": "2013-03-13", "level": "", "num_look": 251355, "num_comment": 10, "author": "ic3te4r", "tags": ["WEB安全", "系统安全"], "text": ""}
{"title": "北京诚盟微点信息技术有限公司招聘", "url": "https://www.freebuf.com/jobs/7664.html", "time": "2013-03-13", "level": "", "num_look": 137418, "num_comment": 8, "author": "Andyower@", "tags": ["安全招聘"], "text": ""}
{"title": "Metasploit演示：Firebird数据库堆栈溢出漏洞（CVE-2013-2492）", "url": "https://www.freebuf.com/articles/database/7656.html", "time": "2013-03-13", "level": "", "num_look": 219396, "num_comment": 1, "author": "LinuxSpace", "tags": ["数据安全", "视频"], "text": ""}
{"title": "黑客使用中国的恶意软件攻击澳洲储备银行", "url": "https://www.freebuf.com/news/7657.html", "time": "2013-03-13", "level": "", "num_look": 143564, "num_comment": 5, "author": "LinuxSpace", "tags": ["资讯"], "text": ""}
{"title": "看不见的自行车", "url": "https://www.freebuf.com/geek/7643.html", "time": "2013-03-12", "level": "", "num_look": 170041, "num_comment": 13, "author": "马化腾", "tags": ["极客"], "text": ""}
{"title": "苹果App Store与设备间通信存在中间人攻击", "url": "https://www.freebuf.com/news/7655.html", "time": "2013-03-12", "level": "", "num_look": 146297, "num_comment": 3, "author": "LinuxSpace", "tags": ["资讯"], "text": ""}
{"title": "SQL注入自动测试工具—jSQL", "url": "https://www.freebuf.com/sectool/7638.html", "time": "2013-03-12", "level": "", "num_look": 334950, "num_comment": 10, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "伪造DNS/DHCP/HTTP服务器的蜜罐工具—Ghost Phisher", "url": "https://www.freebuf.com/sectool/7603.html", "time": "2013-03-12", "level": "", "num_look": 291842, "num_comment": 2, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "印度黑客再度出击，大规模入侵巴基斯坦政府网站", "url": "https://www.freebuf.com/news/7649.html", "time": "2013-03-12", "level": "", "num_look": 120214, "num_comment": 5, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "如何摧毁互联网？", "url": "https://www.freebuf.com/articles/others-articles/7614.html", "time": "2013-03-11", "level": "", "num_look": 138758, "num_comment": 6, "author": "Mystery", "tags": ["其他"], "text": ""}
{"title": "[GooPass]利用点击劫持和CSRF对Google进行钓鱼攻击", "url": "https://www.freebuf.com/news/7618.html", "time": "2013-03-11", "level": "", "num_look": 179961, "num_comment": 2, "author": "LinuxSpace", "tags": ["资讯"], "text": ""}
{"title": "Phrozen Keylogger Lite v1.0发布", "url": "https://www.freebuf.com/sectool/7624.html", "time": "2013-03-11", "level": "", "num_look": 330573, "num_comment": 19, "author": "LinuxSpace", "tags": ["工具"], "text": ""}
{"title": "Espcms通杀SQL注入漏洞分析(附EXP)", "url": "https://www.freebuf.com/articles/web/7623.html", "time": "2013-03-11", "level": "", "num_look": 462909, "num_comment": 4, "author": "seay", "tags": ["WEB安全"], "text": ""}
{"title": "[CVE-2013-1763]Linux内核3.3-3.8本地提权漏洞", "url": "https://www.freebuf.com/vuls/7612.html", "time": "2013-03-11", "level": "红色标题", "num_look": 390744, "num_comment": 13, "author": "LinuxSpace", "tags": ["漏洞", "系统安全"], "text": ""}
{"title": "通过冷冻手机可以攻破其中的加密数据", "url": "https://www.freebuf.com/articles/terminal/7602.html", "time": "2013-03-08", "level": "", "num_look": 149355, "num_comment": 5, "author": "knife", "tags": ["终端安全"], "text": ""}
{"title": "开源入侵检测系统Snort V2.9.4.1发布", "url": "https://www.freebuf.com/sectool/7601.html", "time": "2013-03-08", "level": "", "num_look": 177180, "num_comment": 12, "author": "thanks", "tags": ["工具"], "text": ""}
{"title": "[CanSecWest2013]Chrome, Firefox, Java, IE10相继被攻破", "url": "https://www.freebuf.com/news/7597.html", "time": "2013-03-08", "level": "", "num_look": 118651, "num_comment": 8, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "[CanSecWest2013]pwn2own黑客大赛,Chrome已被攻陷", "url": "https://www.freebuf.com/news/7594.html", "time": "2013-03-08", "level": "", "num_look": 164220, "num_comment": 21, "author": "hihei", "tags": ["资讯"], "text": ""}
{"title": "使用Burp攻击Web Services", "url": "https://www.freebuf.com/articles/web/7592.html", "time": "2013-03-07", "level": "", "num_look": 501288, "num_comment": 11, "author": "pnig0s", "tags": ["WEB安全"], "text": ""}
{"title": "思科Cisco设备密码恢复工具-Cisco Password Decryptor 2.0", "url": "https://www.freebuf.com/sectool/7584.html", "time": "2013-03-07", "level": "", "num_look": 291311, "num_comment": 7, "author": "kelz", "tags": ["工具"], "text": ""}
{"title": "印度黑客入侵巴基斯坦情报机构", "url": "https://www.freebuf.com/news/7588.html", "time": "2013-03-07", "level": "", "num_look": 147069, "num_comment": 12, "author": "IceArmour", "tags": ["资讯"], "text": ""}
{"title": "社交程序密码恢复工具-Social Password Decryptor v1.5", "url": "https://www.freebuf.com/sectool/7580.html", "time": "2013-03-07", "level": "", "num_look": 157328, "num_comment": 2, "author": "flowing", "tags": ["工具"], "text": ""}
{"title": "APT攻击样本静态分析工具 - MASTIFF V0.5", "url": "https://www.freebuf.com/sectool/7575.html", "time": "2013-03-06", "level": "", "num_look": 194791, "num_comment": 7, "author": "kelz", "tags": ["工具"], "text": ""}
{"title": "CloudFlare公布DDoS事故细节", "url": "https://www.freebuf.com/news/7571.html", "time": "2013-03-06", "level": "", "num_look": 173112, "num_comment": 7, "author": "thanks", "tags": ["资讯"], "text": ""}
{"title": "Oracle发布紧急补丁，修复上周2个Java漏洞", "url": "https://www.freebuf.com/news/7567.html", "time": "2013-03-06", "level": "", "num_look": 105841, "num_comment": 3, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "寻找黑客入侵美国公司的动机", "url": "https://www.freebuf.com/news/7566.html", "time": "2013-03-05", "level": "", "num_look": 141050, "num_comment": 8, "author": "phper", "tags": ["资讯"], "text": ""}
{"title": "流言终结者：“海盗湾把服务器迁到朝鲜”是假的，至少目前是", "url": "https://www.freebuf.com/news/7561.html", "time": "2013-03-05", "level": "", "num_look": 111576, "num_comment": 1, "author": "caiinw", "tags": ["资讯"], "text": ""}
{"title": "Geek们！自己动手，DIY一个数码相机", "url": "https://www.freebuf.com/geek/7559.html", "time": "2013-03-05", "level": "", "num_look": 150022, "num_comment": 7, "author": "geekpark", "tags": ["极客"], "text": ""}
{"title": "三星Galaxy Note II手机惊现可绕过锁屏机制的安全漏洞", "url": "https://www.freebuf.com/news/7556.html", "time": "2013-03-05", "level": "", "num_look": 113981, "num_comment": 5, "author": "monkeydev", "tags": ["资讯"], "text": ""}
{"title": "HTML5浏览器漏洞，用户硬盘或被垃圾数据塞满", "url": "https://www.freebuf.com/news/7550.html", "time": "2013-03-05", "level": "", "num_look": 122136, "num_comment": 6, "author": "hihei", "tags": ["资讯"], "text": ""}
{"title": "Web Exploitation Engine 0.1", "url": "https://www.freebuf.com/sectool/7551.html", "time": "2013-03-05", "level": "", "num_look": 254381, "num_comment": 2, "author": "熙雅", "tags": ["工具"], "text": ""}
{"title": "Android版Nmap—anmap", "url": "https://www.freebuf.com/news/others/7539.html", "time": "2013-03-04", "level": "", "num_look": 695899, "num_comment": 5, "author": "dangdang", "tags": ["周边", "工具"], "text": ""}
{"title": "freebuf安全周刊2月25日-3月1日", "url": "https://www.freebuf.com/news/others/7536.html", "time": "2013-03-04", "level": "", "num_look": 266702, "num_comment": 2, "author": "root", "tags": ["其他", "周边"], "text": ""}
{"title": "Mifare Classic Tool (MCT)，Android平台RFID工具", "url": "https://www.freebuf.com/sectool/7531.html", "time": "2013-03-04", "level": "红色标题", "num_look": 2520055, "num_comment": 19, "author": "鉴澈", "tags": ["工具", "终端安全"], "text": ""}
{"title": "中国黑客攻击美国天然气公司，可引爆管道？", "url": "https://www.freebuf.com/news/7529.html", "time": "2013-03-04", "level": "", "num_look": 164414, "num_comment": 16, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "[视频]Python编写短信炸弹", "url": "https://www.freebuf.com/video/7456.html", "time": "2013-03-01", "level": "", "num_look": 305580, "num_comment": 30, "author": "seckev2013", "tags": ["视频"], "text": ""}
{"title": "深圳极限网络科技公司招聘安全人员", "url": "https://www.freebuf.com/jobs/7496.html", "time": "2013-03-01", "level": "", "num_look": 163554, "num_comment": 11, "author": "数据流", "tags": ["安全招聘"], "text": ""}
{"title": "木马MiniDuke之谜", "url": "https://www.freebuf.com/news/7503.html", "time": "2013-03-01", "level": "", "num_look": 143635, "num_comment": 4, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "罗列2013年国际安全会议", "url": "https://www.freebuf.com/news/others/7479.html", "time": "2013-02-28", "level": "", "num_look": 448472, "num_comment": 36, "author": "kelz", "tags": ["其他", "周边"], "text": ""}
{"title": "Burpsuite教程与技巧之HTTP brute暴力破解", "url": "https://www.freebuf.com/articles/web/7457.html", "time": "2013-02-28", "level": "", "num_look": 1811258, "num_comment": 35, "author": "Gall", "tags": ["WEB安全"], "text": ""}
{"title": "新浪安全招聘解密", "url": "https://www.freebuf.com/articles/7476.html", "time": "2013-02-28", "level": "", "num_look": 201054, "num_comment": 13, "author": "offensive", "tags": ["其他", "文章"], "text": ""}
{"title": "ABC澳大利亚官网被黑，49561个主持人和用户信息遭泄漏", "url": "https://www.freebuf.com/news/7478.html", "time": "2013-02-28", "level": "", "num_look": 121222, "num_comment": 5, "author": "G.r0b1n", "tags": ["资讯"], "text": ""}
{"title": "Java最新版本又现漏洞", "url": "https://www.freebuf.com/news/7475.html", "time": "2013-02-27", "level": "", "num_look": 186712, "num_comment": 19, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "火速围观美国特种兵战场上的智能手机(图)", "url": "https://www.freebuf.com/geek/7442.html", "time": "2013-02-27", "level": "", "num_look": 197707, "num_comment": 11, "author": "cnhawk", "tags": ["极客"], "text": ""}
{"title": "Burpsuite_pro_v1.5.01多平台破解版", "url": "https://www.freebuf.com/sectool/7464.html", "time": "2013-02-27", "level": "", "num_look": 707235, "num_comment": 35, "author": "felixk3y", "tags": ["工具"], "text": ""}
{"title": "Android平台渗透测试套件—zANTI", "url": "https://www.freebuf.com/sectool/7463.html", "time": "2013-02-27", "level": "", "num_look": 909831, "num_comment": 11, "author": "thanks", "tags": ["工具"], "text": ""}
{"title": "中国特色的职业黑客", "url": "https://www.freebuf.com/news/7460.html", "time": "2013-02-27", "level": "红色标题", "num_look": 346026, "num_comment": 97, "author": "bytea", "tags": ["资讯"], "text": ""}
{"title": "linux中发现基于sshd的rootkit", "url": "https://www.freebuf.com/news/7454.html", "time": "2013-02-26", "level": "", "num_look": 126099, "num_comment": 4, "author": "infosec", "tags": ["资讯"], "text": ""}
{"title": "[汉化并修复]渗透测试框架winAUTOPWN v3.2", "url": "https://www.freebuf.com/sectool/7451.html", "time": "2013-02-26", "level": "", "num_look": 260610, "num_comment": 15, "author": "p0tt1", "tags": ["工具"], "text": ""}
{"title": "MrleeProtect游戏保护", "url": "https://www.freebuf.com/articles/system/7435.html", "time": "2013-02-26", "level": "", "num_look": 231888, "num_comment": 3, "author": "不歪", "tags": ["游戏安全", "系统安全"], "text": ""}
{"title": "AuthTrans(原创工具)+BurpSuite的暴力美学-破解Http Basic认证", "url": "https://www.freebuf.com/articles/web/7450.html", "time": "2013-02-26", "level": "", "num_look": 523388, "num_comment": 20, "author": "plusmancn", "tags": ["WEB安全"], "text": ""}
{"title": "英国军情五处和六处招聘中文情报人员", "url": "https://www.freebuf.com/news/7445.html", "time": "2013-02-25", "level": "", "num_look": 338966, "num_comment": 33, "author": "hailstorm", "tags": ["资讯"], "text": ""}
{"title": "FBI搜查微软Xbox720爆料人住所", "url": "https://www.freebuf.com/news/7444.html", "time": "2013-02-25", "level": "", "num_look": 106588, "num_comment": 2, "author": "mohit", "tags": ["资讯"], "text": ""}
{"title": "数以千万计HTC手机存在安全风险", "url": "https://www.freebuf.com/news/7440.html", "time": "2013-02-25", "level": "", "num_look": 126337, "num_comment": 2, "author": "hihei", "tags": ["资讯"], "text": ""}
{"title": "树莓派（Raspberry Pi）渗透测试系统—PwnPi v3.0发布", "url": "https://www.freebuf.com/sectool/7438.html", "time": "2013-02-25", "level": "", "num_look": 419318, "num_comment": 16, "author": "天一哥哥", "tags": ["工具"], "text": ""}
{"title": "BackBoxLinux 3.01发布", "url": "https://www.freebuf.com/sectool/7427.html", "time": "2013-02-25", "level": "", "num_look": 149842, "num_comment": 3, "author": "帅气凌云", "tags": ["工具"], "text": ""}
{"title": "日本科技：实时视频替换，让你与虚拟人物手牵手（视频）", "url": "https://www.freebuf.com/geek/7419.html", "time": "2013-02-22", "level": "", "num_look": 162465, "num_comment": 5, "author": "jobs", "tags": ["极客"], "text": ""}
{"title": "iPhone上将短信内容发送到指定邮箱的方法", "url": "https://www.freebuf.com/articles/terminal/7406.html", "time": "2013-02-22", "level": "", "num_look": 373394, "num_comment": 14, "author": "碳基体", "tags": ["终端安全"], "text": ""}
{"title": "MS-SQL存储过程破解工具—DecryptSQL 3.2.0", "url": "https://www.freebuf.com/sectool/7412.html", "time": "2013-02-22", "level": "", "num_look": 261814, "num_comment": 2, "author": "hack520", "tags": ["工具"], "text": ""}
{"title": "Wireshark v1.9.0 Released", "url": "https://www.freebuf.com/sectool/7414.html", "time": "2013-02-22", "level": "", "num_look": 145388, "num_comment": 1, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "中国国防部称遭黑客攻击，很多IP来自美国", "url": "https://www.freebuf.com/news/7404.html", "time": "2013-02-21", "level": "", "num_look": 124081, "num_comment": 9, "author": "lequiet", "tags": ["资讯"], "text": ""}
{"title": "Mac OS X发现新的木马后门（附样本下载）", "url": "https://www.freebuf.com/news/7401.html", "time": "2013-02-21", "level": "", "num_look": 225274, "num_comment": 14, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "web渗透信息侦察收集工具——Recon-ng", "url": "https://www.freebuf.com/articles/web/7385.html", "time": "2013-02-21", "level": "", "num_look": 835408, "num_comment": 16, "author": "碳基体", "tags": ["WEB安全"], "text": ""}
{"title": "Google Glass官方宣传视频放出，接受公开预订（视频）", "url": "https://www.freebuf.com/geek/7396.html", "time": "2013-02-21", "level": "", "num_look": 142724, "num_comment": 4, "author": "geekpark", "tags": ["极客"], "text": ""}
{"title": "网站技术指纹分析工具（Chrome扩展）—Website Analyzer", "url": "https://www.freebuf.com/sectool/7391.html", "time": "2013-02-20", "level": "", "num_look": 629738, "num_comment": 10, "author": "dangdang", "tags": ["工具"], "text": ""}
{"title": "ecshop最新注入0day分析报告", "url": "https://www.freebuf.com/articles/web/7387.html", "time": "2013-02-20", "level": "", "num_look": 470710, "num_comment": 4, "author": "seay", "tags": ["WEB安全"], "text": ""}
{"title": "SQL注入点自动化利用测试工具—shoryuken", "url": "https://www.freebuf.com/sectool/7386.html", "time": "2013-02-20", "level": "", "num_look": 164484, "num_comment": 2, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "BlackBerry Enterprise Servers爆高危漏洞", "url": "https://www.freebuf.com/news/7383.html", "time": "2013-02-20", "level": "", "num_look": 116052, "num_comment": 4, "author": "j4ckd4y", "tags": ["资讯"], "text": ""}
{"title": "渗透小技巧一则", "url": "https://www.freebuf.com/articles/system/7326.html", "time": "2013-02-20", "level": "", "num_look": 547650, "num_comment": 28, "author": "hack520", "tags": ["系统安全"], "text": ""}
{"title": "三星全新操作系统Tizen 2.0源代码发布", "url": "https://www.freebuf.com/news/7381.html", "time": "2013-02-20", "level": "", "num_look": 145551, "num_comment": 5, "author": "dwich", "tags": ["资讯"], "text": ""}
{"title": "总参三部二局被指对美欧发动网络攻击", "url": "https://www.freebuf.com/news/7372.html", "time": "2013-02-19", "level": "", "num_look": 442475, "num_comment": 31, "author": "solidot", "tags": ["资讯"], "text": ""}
{"title": "汉堡王Twitter账号被黑，头像换成麦当劳", "url": "https://www.freebuf.com/news/7370.html", "time": "2013-02-19", "level": "", "num_look": 121101, "num_comment": 1, "author": "脚本小子", "tags": ["资讯"], "text": ""}
{"title": "Android系统曝隐私问题：冷冻后可获取加密数据", "url": "https://www.freebuf.com/news/7368.html", "time": "2013-02-19", "level": "", "num_look": 127007, "num_comment": 3, "author": "helloboy", "tags": ["资讯"], "text": ""}
{"title": "1337day上出售OFFICE 0DAY", "url": "https://www.freebuf.com/news/7357.html", "time": "2013-02-19", "level": "", "num_look": 140394, "num_comment": 6, "author": "eip_0x", "tags": ["资讯"], "text": ""}
{"title": "SECKEV安全演示视频（六）：Metasploit配置路由器端口转发", "url": "https://www.freebuf.com/video/7344.html", "time": "2013-02-19", "level": "红色标题", "num_look": 231688, "num_comment": 14, "author": "seckev2013", "tags": ["视频"], "text": ""}
{"title": "恶意软件分析工具—Hook Analyser v2.3", "url": "https://www.freebuf.com/sectool/7362.html", "time": "2013-02-19", "level": "", "num_look": 272917, "num_comment": 1, "author": "dangdang", "tags": ["工具"], "text": ""}
{"title": "黑客是怎样入侵你的网站的", "url": "https://www.freebuf.com/articles/web/7359.html", "time": "2013-02-19", "level": "", "num_look": 2683141, "num_comment": 56, "author": "Flamingo", "tags": ["WEB安全"], "text": ""}
{"title": "白名单安全厂商Bit9遭入侵，致恶意软件被信任运行", "url": "https://www.freebuf.com/news/7352.html", "time": "2013-02-19", "level": "", "num_look": 210646, "num_comment": 1, "author": "Bill", "tags": ["资讯"], "text": ""}
{"title": "社会工程学神器—信息收集工具theHarvester v2.2a", "url": "https://www.freebuf.com/sectool/7348.html", "time": "2013-02-18", "level": "", "num_look": 436729, "num_comment": 16, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "Openvz VPS Iptables进行端口转发", "url": "https://www.freebuf.com/articles/web/7327.html", "time": "2013-02-18", "level": "", "num_look": 261951, "num_comment": 1, "author": "hack520", "tags": ["WEB安全"], "text": ""}
{"title": "密码破解工具-Hashkill 0.3.1", "url": "https://www.freebuf.com/sectool/7343.html", "time": "2013-02-18", "level": "", "num_look": 241223, "num_comment": 2, "author": "H3lvin", "tags": ["工具"], "text": ""}
{"title": "Adobe Reader即将发布紧急补丁", "url": "https://www.freebuf.com/news/7341.html", "time": "2013-02-18", "level": "", "num_look": 101631, "num_comment": 1, "author": "无敌最寂寞", "tags": ["资讯"], "text": ""}
{"title": "RDG Tejon Crypter 2013（bypass all）", "url": "https://www.freebuf.com/sectool/7328.html", "time": "2013-02-18", "level": "", "num_look": 214782, "num_comment": 10, "author": "hack520", "tags": ["工具"], "text": ""}
{"title": "设备厂商组建FIDO认证联盟 密码被盗问题将不复存在", "url": "https://www.freebuf.com/articles/terminal/7304.html", "time": "2013-02-17", "level": "", "num_look": 151372, "num_comment": 4, "author": "hxdef_tiffany", "tags": ["终端安全"], "text": ""}
{"title": "疑似中国军方黑客身份曝光", "url": "https://www.freebuf.com/news/7316.html", "time": "2013-02-17", "level": "红色标题", "num_look": 545224, "num_comment": 43, "author": "helloboy", "tags": ["资讯"], "text": ""}
{"title": "[hook.js]通用Javascript函数钩子", "url": "https://www.freebuf.com/articles/7310.html", "time": "2013-02-17", "level": "红色标题", "num_look": 397355, "num_comment": 7, "author": "pnig0s", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "iOS6.1爆严重安全漏洞,解锁不用密码", "url": "https://www.freebuf.com/news/7314.html", "time": "2013-02-17", "level": "", "num_look": 170901, "num_comment": 10, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "John&Hydra Hash破解神器Windows-GUI版", "url": "https://www.freebuf.com/sectool/7290.html", "time": "2013-02-17", "level": "", "num_look": 454096, "num_comment": 18, "author": "bystander", "tags": ["工具"], "text": ""}
{"title": "iOS 6越狱软件Evasi0n的内幕", "url": "https://www.freebuf.com/articles/wireless/7277.html", "time": "2013-02-07", "level": "", "num_look": 249677, "num_comment": 18, "author": "tom165", "tags": ["无线安全", "终端安全"], "text": ""}
{"title": "[视频]RFID Emulator复制门禁卡", "url": "https://www.freebuf.com/video/7272.html", "time": "2013-02-07", "level": "", "num_look": 297345, "num_comment": 11, "author": "cheslink", "tags": ["视频"], "text": ""}
{"title": "SSL/TLS/DTLS爆出漏洞：只需2^23次计算即可还原明文", "url": "https://www.freebuf.com/vuls/7269.html", "time": "2013-02-06", "level": "", "num_look": 209784, "num_comment": 13, "author": "cheslink", "tags": ["漏洞"], "text": ""}
{"title": "诺基亚台湾站点被黑，超过10万账户泄露", "url": "https://www.freebuf.com/news/7267.html", "time": "2013-02-06", "level": "", "num_look": 112706, "num_comment": 1, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "Proxmark3的Android客户端发布", "url": "https://www.freebuf.com/sectool/7244.html", "time": "2013-02-06", "level": "", "num_look": 395923, "num_comment": 8, "author": "BinAry", "tags": ["工具", "无线安全"], "text": ""}
{"title": "Web渗透测试框架-Zed Attack Proxy v 2.0.0（OWASP出品）", "url": "https://www.freebuf.com/sectool/7235.html", "time": "2013-02-06", "level": "", "num_look": 564678, "num_comment": 5, "author": "unshell", "tags": ["工具"], "text": ""}
{"title": "Mega推出漏洞奖励计划 最高提供13500美元奖励金额", "url": "https://www.freebuf.com/news/7239.html", "time": "2013-02-05", "level": "", "num_look": 176719, "num_comment": 9, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "SECKEV安全演示视频（五）：Mifare卡克隆", "url": "https://www.freebuf.com/video/7234.html", "time": "2013-02-05", "level": "", "num_look": 397854, "num_comment": 6, "author": "seckev2013", "tags": ["视频"], "text": ""}
{"title": "iOS 6.x越狱工具evasi0n正式推出", "url": "https://www.freebuf.com/news/7251.html", "time": "2013-02-05", "level": "", "num_look": 165043, "num_comment": 11, "author": "L1n0x", "tags": ["资讯"], "text": ""}
{"title": "使用NTDSXtract离线抓取Domain Hash", "url": "https://www.freebuf.com/articles/system/7205.html", "time": "2013-02-04", "level": "", "num_look": 479281, "num_comment": 11, "author": "0x7c", "tags": ["系统安全"], "text": ""}
{"title": "[个人感想]看天天向上有感—重新认识360董事长周鸿祎", "url": "https://www.freebuf.com/articles/others-articles/7232.html", "time": "2013-02-04", "level": "", "num_look": 179368, "num_comment": 25, "author": "about80Kg", "tags": ["其他"], "text": ""}
{"title": "移动渗透测试套件Revenssis破解—2012最后一个冷笑话", "url": "https://www.freebuf.com/articles/terminal/7231.html", "time": "2013-02-04", "level": "", "num_look": 328869, "num_comment": 23, "author": "rtexil", "tags": ["终端安全"], "text": ""}
{"title": "Twitter遭攻击，25万用户帐号面临风险", "url": "https://www.freebuf.com/news/7221.html", "time": "2013-02-02", "level": "红色标题", "num_look": 148386, "num_comment": 10, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "战术聊天系统-美军如何使用IRC发送战争指令", "url": "https://www.freebuf.com/articles/others-articles/7201.html", "time": "2013-02-01", "level": "", "num_look": 146585, "num_comment": 12, "author": "phper", "tags": ["其他"], "text": ""}
{"title": "纽约时报遭受来自中国的APT攻击", "url": "https://www.freebuf.com/news/7199.html", "time": "2013-02-01", "level": "", "num_look": 125042, "num_comment": 5, "author": "hihei", "tags": ["资讯"], "text": ""}
{"title": "北京启明星辰招聘高级软件工程师", "url": "https://www.freebuf.com/jobs/7174.html", "time": "2013-02-01", "level": "", "num_look": 190096, "num_comment": 14, "author": "熙雅", "tags": ["安全招聘"], "text": ""}
{"title": "手机中的Backtrack—移动渗透测试套件Revenssis", "url": "https://www.freebuf.com/sectool/7188.html", "time": "2013-01-31", "level": "", "num_look": 320134, "num_comment": 22, "author": "thanks", "tags": ["工具"], "text": ""}
{"title": "Paypal被发现存在SQL注入，价值$3000美金", "url": "https://www.freebuf.com/news/7168.html", "time": "2013-01-31", "level": "", "num_look": 182747, "num_comment": 5, "author": "sboscar", "tags": ["周边", "漏洞"], "text": ""}
{"title": "赛门铁克成都研发中心招聘助理软件工程师", "url": "https://www.freebuf.com/jobs/7152.html", "time": "2013-01-31", "level": "", "num_look": 131948, "num_comment": 2, "author": "814ckhum0r", "tags": ["安全招聘"], "text": ""}
{"title": "SECKEV安全演示视频（四）：Metasploit—后门2", "url": "https://www.freebuf.com/video/7108.html", "time": "2013-01-30", "level": "", "num_look": 242259, "num_comment": 14, "author": "seckev2013", "tags": ["视频"], "text": ""}
{"title": "DVR漏洞使黑客轻松控制CCTV摄像机（MSF已更新模块）", "url": "https://www.freebuf.com/news/7154.html", "time": "2013-01-30", "level": "红色标题", "num_look": 327085, "num_comment": 17, "author": "gniq", "tags": ["资讯"], "text": ""}
{"title": "Sqlmap-GUI by Aman Hardikar V2.4.0", "url": "https://www.freebuf.com/sectool/7144.html", "time": "2013-01-30", "level": "", "num_look": 311372, "num_comment": 9, "author": "unshell", "tags": ["工具"], "text": ""}
{"title": "蛋疼的Geek DIY：遥控超人", "url": "https://www.freebuf.com/geek/7150.html", "time": "2013-01-30", "level": "", "num_look": 163719, "num_comment": 3, "author": "geekpark", "tags": ["极客"], "text": ""}
{"title": "UPnP爆协议漏洞，数千万个人设备受威胁[含扫描工具]", "url": "https://www.freebuf.com/news/7148.html", "time": "2013-01-30", "level": "", "num_look": 356493, "num_comment": 11, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "PHP Vulnerability Hunter 1.3.87发布", "url": "https://www.freebuf.com/sectool/7110.html", "time": "2013-01-29", "level": "", "num_look": 209035, "num_comment": 6, "author": "pnig0s", "tags": ["工具"], "text": ""}
{"title": "在Windows运行Android系统—WindowsAndroid", "url": "https://www.freebuf.com/sectool/7126.html", "time": "2013-01-29", "level": "", "num_look": 183344, "num_comment": 7, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "免费安全测试套件PenTBox", "url": "https://www.freebuf.com/sectool/7123.html", "time": "2013-01-29", "level": "", "num_look": 267460, "num_comment": 4, "author": "二伯", "tags": ["工具"], "text": ""}
{"title": "[书籍推荐]黑客社会工程学攻击2", "url": "https://www.freebuf.com/news/others/7140.html", "time": "2013-01-29", "level": "", "num_look": 492070, "num_comment": 12, "author": "phper", "tags": ["其他", "周边"], "text": ""}
{"title": "惠普打印软件JetDirect漏洞致多款网络打印机受威胁（附分析）", "url": "https://www.freebuf.com/articles/system/7115.html", "time": "2013-01-29", "level": "红色标题", "num_look": 462622, "num_comment": 5, "author": "cs24", "tags": ["系统安全"], "text": ""}
{"title": "美国大量增加网络安全人员", "url": "https://www.freebuf.com/news/7119.html", "time": "2013-01-29", "level": "", "num_look": 112490, "num_comment": 6, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "梭子鱼多个产品惊现SSH后门账户", "url": "https://www.freebuf.com/news/7105.html", "time": "2013-01-28", "level": "红色标题", "num_look": 174616, "num_comment": 11, "author": "hihei", "tags": ["资讯"], "text": ""}
{"title": "0day交易系列第二弹：0day交易中的骗术", "url": "https://www.freebuf.com/articles/others-articles/7033.html", "time": "2013-01-28", "level": "", "num_look": 174945, "num_comment": 12, "author": "eip_0x", "tags": ["其他", "视频"], "text": ""}
{"title": "Gozi病毒感染上百万台计算机", "url": "https://www.freebuf.com/news/7103.html", "time": "2013-01-28", "level": "", "num_look": 169952, "num_comment": 2, "author": "Lore", "tags": ["资讯"], "text": ""}
{"title": "[Paper]Web漏洞实战教程(DVWA的使用和漏洞分析)PDF下载", "url": "https://www.freebuf.com/articles/web/7084.html", "time": "2013-01-28", "level": "", "num_look": 895144, "num_comment": 11, "author": "winy", "tags": ["WEB安全"], "text": ""}
{"title": "Spring爆远程代码执行漏洞（含EXP）", "url": "https://www.freebuf.com/news/7080.html", "time": "2013-01-25", "level": "", "num_look": 648397, "num_comment": 20, "author": "kelz", "tags": ["WEB安全", "资讯"], "text": ""}
{"title": "智能手机扫描软件—Overlook Fing", "url": "https://www.freebuf.com/sectool/7078.html", "time": "2013-01-25", "level": "", "num_look": 224938, "num_comment": 8, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "Firefox浏览器键盘记录在线平台", "url": "https://www.freebuf.com/sectool/7075.html", "time": "2013-01-25", "level": "", "num_look": 158834, "num_comment": 3, "author": "eye7s", "tags": ["工具"], "text": ""}
{"title": "[更新下载地址]ScorpioScan—WEB程序审计工具", "url": "https://www.freebuf.com/sectool/7060.html", "time": "2013-01-24", "level": "红色标题", "num_look": 459647, "num_comment": 51, "author": "p0tt1", "tags": ["工具"], "text": ""}
{"title": "[过程剖析]“红色十月”跨国网络攻击报告（节选）", "url": "https://www.freebuf.com/articles/web/6986.html", "time": "2013-01-24", "level": "", "num_look": 188861, "num_comment": 4, "author": "thanks", "tags": ["WEB安全", "系统安全"], "text": ""}
{"title": "iPhone取景器—“白日取景者”", "url": "https://www.freebuf.com/geek/7058.html", "time": "2013-01-24", "level": "", "num_look": 112808, "num_comment": 1, "author": "煎蛋", "tags": ["极客"], "text": ""}
{"title": "BackTrack下一代产品—Kali Linux Teaser即将发布", "url": "https://www.freebuf.com/news/7027.html", "time": "2013-01-24", "level": "", "num_look": 144255, "num_comment": 8, "author": "mr.dion", "tags": ["资讯"], "text": ""}
{"title": "西门子SCADA设备暴力破解工具", "url": "https://www.freebuf.com/sectool/7051.html", "time": "2013-01-24", "level": "", "num_look": 272133, "num_comment": 13, "author": "SCADAStrangeLove", "tags": ["工具", "工控安全"], "text": ""}
{"title": "MIT网站被黑，黑客留下长文思考什么是道德", "url": "https://www.freebuf.com/news/7014.html", "time": "2013-01-23", "level": "", "num_look": 268045, "num_comment": 21, "author": "猪哥靓", "tags": ["其他", "周边"], "text": ""}
{"title": "[内幕]揭露0day交易大户1337day的卑鄙行径", "url": "https://www.freebuf.com/articles/others-articles/7011.html", "time": "2013-01-23", "level": "红色标题", "num_look": 805983, "num_comment": 52, "author": "eip_0x", "tags": ["其他"], "text": ""}
{"title": "智能木马隐藏伪装使用的通讯协议", "url": "https://www.freebuf.com/news/7016.html", "time": "2013-01-23", "level": "", "num_look": 189218, "num_comment": 7, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "渗透测试专用DNS代理—DNSChef", "url": "https://www.freebuf.com/sectool/7013.html", "time": "2013-01-23", "level": "", "num_look": 320870, "num_comment": 3, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "SECKEV安全演示视频（三）：Proxmark3—Mifare卡破解", "url": "https://www.freebuf.com/geek/6977.html", "time": "2013-01-23", "level": "红色标题", "num_look": 750406, "num_comment": 19, "author": "seckev2013", "tags": ["极客", "视频"], "text": ""}
{"title": "黑客组织Anonymous疯狂入侵中国站点思路分析", "url": "https://www.freebuf.com/articles/web/6995.html", "time": "2013-01-22", "level": "", "num_look": 351844, "num_comment": 44, "author": "p0tt1", "tags": ["WEB安全"], "text": ""}
{"title": "PHP安全审计检查列表", "url": "https://www.freebuf.com/articles/web/6992.html", "time": "2013-01-22", "level": "", "num_look": 165155, "num_comment": 2, "author": "mayur", "tags": ["WEB安全"], "text": ""}
{"title": "Dll Hijack检测工具—Dll Hijack Auditor", "url": "https://www.freebuf.com/sectool/6966.html", "time": "2013-01-22", "level": "", "num_look": 221492, "num_comment": 4, "author": "ding", "tags": ["工具"], "text": ""}
{"title": "[技术分析]了解12306购票流程", "url": "https://www.freebuf.com/articles/6952.html", "time": "2013-01-22", "level": "", "num_look": 424368, "num_comment": 23, "author": "Gall", "tags": ["文章"], "text": ""}
{"title": "懒床治疗神器：印度学生发明“电击闹钟”", "url": "https://www.freebuf.com/geek/6974.html", "time": "2013-01-21", "level": "", "num_look": 130000, "num_comment": 5, "author": "geekpark", "tags": ["极客"], "text": ""}
{"title": "2013 Pwn2Own黑客大赛将于3月6日-8日举行", "url": "https://www.freebuf.com/news/6971.html", "time": "2013-01-21", "level": "", "num_look": 133363, "num_comment": 17, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "黑客团体AnonGhost入侵300+以色列网站", "url": "https://www.freebuf.com/news/6967.html", "time": "2013-01-21", "level": "", "num_look": 122279, "num_comment": 1, "author": "exp", "tags": ["资讯"], "text": ""}
{"title": "Wordpress应用层防火墙插件：WP-WAF", "url": "https://www.freebuf.com/sectool/6965.html", "time": "2013-01-21", "level": "", "num_look": 178624, "num_comment": 8, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "Google向密码宣战", "url": "https://www.freebuf.com/news/6962.html", "time": "2013-01-21", "level": "", "num_look": 108507, "num_comment": 4, "author": "nCircle", "tags": ["资讯"], "text": ""}
{"title": "墨西哥国防部网站遭Anonymous攻击，数据全部泄漏", "url": "https://www.freebuf.com/news/6942.html", "time": "2013-01-18", "level": "", "num_look": 118456, "num_comment": 5, "author": "gniq", "tags": ["资讯"], "text": ""}
{"title": "唯品会诚聘安全高手", "url": "https://www.freebuf.com/jobs/6936.html", "time": "2013-01-18", "level": "", "num_look": 190227, "num_comment": 22, "author": "hongygxiang", "tags": ["安全招聘"], "text": ""}
{"title": "[下载]burpsuite_pro_v1.5_crack更新", "url": "https://www.freebuf.com/sectool/6917.html", "time": "2013-01-18", "level": "红色标题", "num_look": 386084, "num_comment": 59, "author": "十年后", "tags": ["工具"], "text": ""}
{"title": "Java零日漏洞威胁未除，最新Java7u11零日漏洞已在售卖", "url": "https://www.freebuf.com/news/6921.html", "time": "2013-01-18", "level": "", "num_look": 124557, "num_comment": 10, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "老牌安全网站Packet Storm推出漏洞奖励计划", "url": "https://www.freebuf.com/news/6912.html", "time": "2013-01-17", "level": "", "num_look": 163735, "num_comment": 10, "author": "tobe", "tags": ["资讯"], "text": ""}
{"title": "穆斯林黑客打造—DDoS黑暗云（Dark Cloud）笼罩美国银行", "url": "https://www.freebuf.com/news/6914.html", "time": "2013-01-17", "level": "", "num_look": 131409, "num_comment": 6, "author": "thanks", "tags": ["资讯"], "text": ""}
{"title": "使用MySQL字符串运算实施精巧化SQL注入攻击", "url": "https://www.freebuf.com/articles/web/6894.html", "time": "2013-01-17", "level": "", "num_look": 478956, "num_comment": 28, "author": "pnig0s", "tags": ["WEB安全"], "text": ""}
{"title": "美国电厂遭受USB病毒攻击", "url": "https://www.freebuf.com/news/6906.html", "time": "2013-01-17", "level": "", "num_look": 135307, "num_comment": 6, "author": "phper", "tags": ["资讯"], "text": ""}
{"title": "SECKEV安全演示视频（二）：Metasploit - 后门安装1", "url": "https://www.freebuf.com/video/6865.html", "time": "2013-01-17", "level": "红色标题", "num_look": 219544, "num_comment": 15, "author": "radiowar", "tags": ["视频"], "text": ""}
{"title": "好奇号发现火星有水的新证据", "url": "https://www.freebuf.com/news/6907.html", "time": "2013-01-17", "level": "", "num_look": 101668, "num_comment": 101668, "author": "dwolla", "tags": ["资讯"], "text": ""}
{"title": "思科Linksys路由器爆出0day", "url": "https://www.freebuf.com/news/6904.html", "time": "2013-01-17", "level": "", "num_look": 187413, "num_comment": 14, "author": "hihei", "tags": ["资讯"], "text": ""}
{"title": "FTP登录密码找回工具—WS_FTP Password Decryptor", "url": "https://www.freebuf.com/sectool/6882.html", "time": "2013-01-16", "level": "", "num_look": 229899, "num_comment": 1, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "RadioWar定制版Proxmark3团购活动", "url": "https://www.freebuf.com/geek/6881.html", "time": "2013-01-16", "level": "", "num_look": 214956, "num_comment": 8, "author": "radiowar", "tags": ["极客"], "text": ""}
{"title": "红色十月(Red October)网络间谍活动被发现", "url": "https://www.freebuf.com/news/6890.html", "time": "2013-01-16", "level": "", "num_look": 135509, "num_comment": 8, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "杭州OWASP沙龙议题PDF及相关资料下载", "url": "https://www.freebuf.com/news/others/6877.html", "time": "2013-01-15", "level": "", "num_look": 210729, "num_comment": 11, "author": "无心喃呢", "tags": ["其他", "周边"], "text": ""}
{"title": "[视频]教你如何下载GHDB(Google Hacking Database)", "url": "https://www.freebuf.com/articles/web/6846.html", "time": "2013-01-15", "level": "", "num_look": 522557, "num_comment": 32, "author": "seckev2013", "tags": ["WEB安全", "极客"], "text": ""}
{"title": "黑客亚伦·斯沃茨曾在自杀前119天发出过一些求助信息", "url": "https://www.freebuf.com/news/6868.html", "time": "2013-01-15", "level": "", "num_look": 225520, "num_comment": 2, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "Exploit防御工具-ExploitShield Browser Edition", "url": "https://www.freebuf.com/sectool/6869.html", "time": "2013-01-15", "level": "", "num_look": 153477, "num_comment": 4, "author": "open", "tags": ["工具"], "text": ""}
{"title": "3684个中国政府站点遭黑客入侵", "url": "https://www.freebuf.com/news/6835.html", "time": "2013-01-14", "level": "", "num_look": 379474, "num_comment": 36, "author": "FastFlux", "tags": ["资讯"], "text": ""}
{"title": "Cisco路由器安全扫描器—OCS v0.2", "url": "https://www.freebuf.com/sectool/6836.html", "time": "2013-01-14", "level": "", "num_look": 206250, "num_comment": 4, "author": "dangdang", "tags": ["工具"], "text": ""}
{"title": "通过DragJacking获取用户隐私数据", "url": "https://www.freebuf.com/articles/web/6812.html", "time": "2013-01-14", "level": "", "num_look": 157825, "num_comment": 9, "author": "pnig0s", "tags": ["WEB安全"], "text": ""}
{"title": "OWASP杭州区沙龙全程回顾（图文实录）", "url": "https://www.freebuf.com/news/others/6809.html", "time": "2013-01-14", "level": "", "num_look": 222161, "num_comment": 25, "author": "thanks", "tags": ["其他", "周边"], "text": ""}
{"title": "NFC协议安全工具-NFCGUI正式版发布", "url": "https://www.freebuf.com/sectool/6826.html", "time": "2013-01-14", "level": "", "num_look": 240456, "num_comment": 2, "author": "radiowar", "tags": ["工具"], "text": ""}
{"title": "26岁计算机黑客亚伦·斯沃茨自杀身亡", "url": "https://www.freebuf.com/news/6815.html", "time": "2013-01-14", "level": "", "num_look": 178556, "num_comment": 13, "author": "猪哥靓", "tags": ["资讯"], "text": ""}
{"title": "[推广]15PB软件安全课程2.0版诞生", "url": "https://www.freebuf.com/news/others/56241.html", "time": "2013-01-12", "level": "", "num_look": 174196, "num_comment": 9, "author": "15pb", "tags": ["周边"], "text": "到今天为止，15PB已经走过了535个日日夜夜，在这535个日日夜夜中，15PB像一位勇敢的、充满敬畏之心的小男孩一样跌跌撞撞的走着，他用自己的坚韧与智慧完成了一次又一次不可能完成的任务，直到今天，他终于感觉自己…"}
{"title": "世界第一把基于Linux的精确锁定步枪", "url": "https://www.freebuf.com/geek/6782.html", "time": "2013-01-11", "level": "", "num_look": 143449, "num_comment": 13, "author": "无心呢喃", "tags": ["极客"], "text": ""}
{"title": "页游安全工具/flash App security Tools", "url": "https://www.freebuf.com/sectool/6797.html", "time": "2013-01-11", "level": "", "num_look": 258782, "num_comment": 5, "author": "碳基体", "tags": ["工具"], "text": ""}
{"title": "网络游戏安全小议（端游/页游/手游）", "url": "https://www.freebuf.com/articles/terminal/6795.html", "time": "2013-01-11", "level": "", "num_look": 256477, "num_comment": 6, "author": "碳基体", "tags": ["终端安全"], "text": ""}
{"title": "“匿名者”请求美国政府将DDoS合法化", "url": "https://www.freebuf.com/news/6791.html", "time": "2013-01-11", "level": "", "num_look": 126830, "num_comment": 10, "author": "bl4ck", "tags": ["资讯"], "text": ""}
{"title": "[更新]新年伊始，Java惊爆首个0day", "url": "https://www.freebuf.com/news/6788.html", "time": "2013-01-11", "level": "", "num_look": 307843, "num_comment": 30, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "[整理]34个windows平台渗透测试工具", "url": "https://www.freebuf.com/sectool/6772.html", "time": "2013-01-11", "level": "", "num_look": 1216520, "num_comment": 16, "author": "thanks", "tags": ["工具"], "text": ""}
{"title": "日本达文西，袖中iPhone机", "url": "https://www.freebuf.com/geek/6780.html", "time": "2013-01-10", "level": "", "num_look": 122678, "num_comment": 7, "author": "geekpark", "tags": ["极客"], "text": ""}
{"title": "Ruby on Rails XML参数注入漏洞(CVE-2013-0156)分析", "url": "https://www.freebuf.com/articles/web/6777.html", "time": "2013-01-10", "level": "", "num_look": 160907, "num_comment": 1, "author": "fake", "tags": ["WEB安全"], "text": ""}
{"title": "Ruby on Rails再爆漏洞:远程任意代码执行", "url": "https://www.freebuf.com/news/6767.html", "time": "2013-01-10", "level": "", "num_look": 140571, "num_comment": 140571, "author": "Mystery", "tags": ["资讯"], "text": ""}
{"title": "Web安全漏洞被动扫描工具—Watcher v1.5.6(Fiddler插件)", "url": "https://www.freebuf.com/sectool/6770.html", "time": "2013-01-10", "level": "", "num_look": 333545, "num_comment": 4, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "Facebook 2013年黑客杯报名开始", "url": "https://www.freebuf.com/news/6768.html", "time": "2013-01-10", "level": "", "num_look": 156783, "num_comment": 11, "author": "孤独剑客", "tags": ["资讯"], "text": ""}
{"title": "美国土安全部诱捕中国盗版软件大王:设计引至塞班岛", "url": "https://www.freebuf.com/news/6760.html", "time": "2013-01-09", "level": "", "num_look": 118201, "num_comment": 16, "author": "手雷", "tags": ["资讯"], "text": ""}
{"title": "[快讯]雅虎邮箱DOM XSS漏洞(含最新演示视频)", "url": "https://www.freebuf.com/news/6749.html", "time": "2013-01-09", "level": "", "num_look": 172987, "num_comment": 12, "author": "papa", "tags": ["资讯"], "text": ""}
{"title": "免费无线密码恢复工具—WiFi Password Decryptor", "url": "https://www.freebuf.com/sectool/6747.html", "time": "2013-01-09", "level": "", "num_look": 168378, "num_comment": 5, "author": "大象", "tags": ["工具"], "text": ""}
{"title": "新发现Yahoo邮箱存在XSS漏洞，4千万邮箱用户面临威胁", "url": "https://www.freebuf.com/news/6744.html", "time": "2013-01-09", "level": "", "num_look": 136573, "num_comment": 2, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "使用web浏览器控制你的Android手机—Remote Web Desktop", "url": "https://www.freebuf.com/sectool/6746.html", "time": "2013-01-09", "level": "", "num_look": 255602, "num_comment": 10, "author": "phper", "tags": ["工具", "终端安全"], "text": ""}
{"title": "Paypal支付1W美元奖励漏洞提交者", "url": "https://www.freebuf.com/news/6745.html", "time": "2013-01-09", "level": "", "num_look": 147410, "num_comment": 9, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "叙利亚国家企业银行遭黑客涂鸦", "url": "https://www.freebuf.com/news/6743.html", "time": "2013-01-09", "level": "", "num_look": 136128, "num_comment": 7, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "Metasploit之使用socket通信的webshell简单分析", "url": "https://www.freebuf.com/articles/web/6740.html", "time": "2013-01-09", "level": "", "num_look": 319884, "num_comment": 11, "author": "y3p", "tags": ["WEB安全"], "text": ""}
{"title": "基于QtWebKit的DOM XSS检测技术", "url": "https://www.freebuf.com/articles/web/6734.html", "time": "2013-01-08", "level": "", "num_look": 242683, "num_comment": 3, "author": "harite", "tags": ["WEB安全"], "text": ""}
{"title": "Wiki.Debian.Org服务器被黑客使用0day攻陷", "url": "https://www.freebuf.com/news/6730.html", "time": "2013-01-08", "level": "", "num_look": 132194, "num_comment": 4, "author": "pnig0s", "tags": ["资讯"], "text": ""}
{"title": "国际银行大盗Hamza Bendelladj被捕", "url": "https://www.freebuf.com/news/6727.html", "time": "2013-01-08", "level": "", "num_look": 260009, "num_comment": 34, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "厦门舜亚科技招聘web安全工程师", "url": "https://www.freebuf.com/jobs/6725.html", "time": "2013-01-08", "level": "", "num_look": 136617, "num_comment": 16, "author": "舜亚科技", "tags": ["安全招聘"], "text": ""}
{"title": "NASA Space your Face站点遭黑客入侵", "url": "https://www.freebuf.com/news/6724.html", "time": "2013-01-08", "level": "", "num_look": 103299, "num_comment": 1, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "Chrome for Android Download函数信息泄漏漏洞（CVE-2012-4906）", "url": "https://www.freebuf.com/vuls/6719.html", "time": "2013-01-08", "level": "", "num_look": 630207, "num_comment": 630207, "author": "thanks", "tags": ["漏洞"], "text": ""}
{"title": "Symantec完整磁盘加密软件爆0day漏洞", "url": "https://www.freebuf.com/news/6710.html", "time": "2013-01-07", "level": "", "num_look": 139840, "num_comment": 7, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "Raspberry Pi（树莓派）：没想到自己会那么成功", "url": "https://www.freebuf.com/geek/6707.html", "time": "2013-01-06", "level": "", "num_look": 202334, "num_comment": 1, "author": "fu4k", "tags": ["极客"], "text": ""}
{"title": "打造一根自己的真3D铅笔", "url": "https://www.freebuf.com/geek/6706.html", "time": "2013-01-06", "level": "", "num_look": 127739, "num_comment": 7, "author": "geekpark", "tags": ["极客"], "text": ""}
{"title": "wordpress的cookies过滤不严导致super cache后台XSS", "url": "https://www.freebuf.com/vuls/6688.html", "time": "2013-01-06", "level": "", "num_look": 813918, "num_comment": 1, "author": "wy315700", "tags": ["漏洞"], "text": ""}
{"title": "CVE-2012-4792 IE 0day (CButton use after free)漏洞分析", "url": "https://www.freebuf.com/articles/system/6702.html", "time": "2013-01-06", "level": "", "num_look": 228725, "num_comment": 5, "author": "h4ckmp", "tags": ["系统安全"], "text": ""}
{"title": "日本农林水产省3000文件遭窃取事件简单分析", "url": "https://www.freebuf.com/news/6693.html", "time": "2013-01-05", "level": "", "num_look": 142620, "num_comment": 11, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "SECKEV安全演示视频（一）：Proxmark3驱动安装", "url": "https://www.freebuf.com/geek/6664.html", "time": "2013-01-05", "level": "", "num_look": 181543, "num_comment": 4, "author": "radiowar", "tags": ["极客", "视频"], "text": ""}
{"title": "OWASP杭州区2013年岁末年初安全沙龙", "url": "https://www.freebuf.com/news/others/6692.html", "time": "2013-01-05", "level": "", "num_look": 170194, "num_comment": 22, "author": "无心喃呢", "tags": ["其他", "周边"], "text": ""}
{"title": "以色列全球招聘网络安全人才", "url": "https://www.freebuf.com/news/6685.html", "time": "2013-01-04", "level": "", "num_look": 143265, "num_comment": 18, "author": "hihei", "tags": ["资讯"], "text": ""}
{"title": "北京启明星辰（广州分公司）招聘金融行业咨询顾问", "url": "https://www.freebuf.com/jobs/6677.html", "time": "2013-01-04", "level": "", "num_look": 176108, "num_comment": 9, "author": "熙雅", "tags": ["安全招聘"], "text": ""}
{"title": "401钓鱼分析", "url": "https://www.freebuf.com/articles/web/6681.html", "time": "2013-01-04", "level": "", "num_look": 260475, "num_comment": 7, "author": "only_guest", "tags": ["WEB安全"], "text": ""}
{"title": "THC-Hydra 7.4.1 最新windows版", "url": "https://www.freebuf.com/sectool/6674.html", "time": "2013-01-04", "level": "", "num_look": 497301, "num_comment": 8, "author": "unshell", "tags": ["工具"], "text": ""}
{"title": "Firefox浏览器键盘记录插件—Xenotix KeylogX", "url": "https://www.freebuf.com/sectool/6668.html", "time": "2013-01-04", "level": "", "num_look": 251194, "num_comment": 7, "author": "jobs", "tags": ["工具"], "text": ""}
{"title": "[极客手工活]DIY可调光LED小台灯全过程", "url": "https://www.freebuf.com/geek/6663.html", "time": "2013-01-01", "level": "", "num_look": 202253, "num_comment": 13, "author": "comeover", "tags": ["极客"], "text": ""}
{"title": "PEB_LDR_DATA结构中获得模块基址和名称详解视频", "url": "https://www.freebuf.com/articles/system/6640.html", "time": "2013-01-01", "level": "", "num_look": 159703, "num_comment": 3, "author": "不歪", "tags": ["系统安全"], "text": ""}
{"title": "Android安全之Dalvik虚拟机&反汇编格式视频讲解", "url": "https://www.freebuf.com/articles/terminal/6634.html", "time": "2012-12-31", "level": "", "num_look": 184662, "num_comment": 4, "author": "不歪", "tags": ["终端安全", "视频"], "text": ""}
{"title": "Microsoft SQL Server指纹识别工具ESF.pl（圣诞版）", "url": "https://www.freebuf.com/sectool/6654.html", "time": "2012-12-31", "level": "", "num_look": 170320, "num_comment": 3, "author": "thanks", "tags": ["工具"], "text": ""}
{"title": "基于Ubuntu的移动渗透测试OS—UbnHD2", "url": "https://www.freebuf.com/sectool/6650.html", "time": "2012-12-31", "level": "", "num_look": 236761, "num_comment": 17, "author": "pap3m", "tags": ["工具"], "text": ""}
{"title": "Umbrella Project 2012安全工具合集—Hacktools Ultra", "url": "https://www.freebuf.com/sectool/6645.html", "time": "2012-12-30", "level": "", "num_look": 237298, "num_comment": 19, "author": "unshell", "tags": ["工具"], "text": ""}
{"title": "一次SWF XSS挖掘和利用", "url": "https://www.freebuf.com/articles/web/6641.html", "time": "2012-12-29", "level": "", "num_look": 356208, "num_comment": 10, "author": "大飞哥", "tags": ["WEB安全"], "text": ""}
{"title": "HyTAQ滚动机器人（视频）", "url": "https://www.freebuf.com/geek/6628.html", "time": "2012-12-28", "level": "", "num_look": 171140, "num_comment": 1, "author": "geekpark", "tags": ["极客"], "text": ""}
{"title": "Raspberry Pi下跑aircrack和reaver破解路由器PIN码", "url": "https://www.freebuf.com/articles/6615.html", "time": "2012-12-28", "level": "", "num_look": 1094854, "num_comment": 41, "author": "minyoni", "tags": ["文章", "无线安全"], "text": ""}
{"title": "Android安全之—Dex文件解析（二）(视频下载)", "url": "https://www.freebuf.com/articles/terminal/6596.html", "time": "2012-12-28", "level": "", "num_look": 159239, "num_comment": 159239, "author": "不歪", "tags": ["终端安全"], "text": ""}
{"title": "Wordpress插件W3 Total Cache爆漏洞可获取密码数据库信息", "url": "https://www.freebuf.com/vuls/6612.html", "time": "2012-12-27", "level": "", "num_look": 381696, "num_comment": 16, "author": "hihei", "tags": ["漏洞"], "text": ""}
{"title": "前端安全饕餮《Web前端黑客技术解密》即将上市", "url": "https://www.freebuf.com/news/6603.html", "time": "2012-12-27", "level": "", "num_look": 301157, "num_comment": 26, "author": "root", "tags": ["资讯"], "text": ""}
{"title": "IPV6 TCP端口扫描工具-topera", "url": "https://www.freebuf.com/sectool/6601.html", "time": "2012-12-26", "level": "", "num_look": 307668, "num_comment": 1, "author": "black", "tags": ["工具"], "text": ""}
{"title": "[预告片]RadioWar与Freebuf 2013年度力荐安全视频系列", "url": "https://www.freebuf.com/news/others/6575.html", "time": "2012-12-26", "level": "", "num_look": 392665, "num_comment": 44, "author": "radiowar", "tags": ["周边", "视频"], "text": ""}
{"title": "RFID开发之圣诞袜的秘密", "url": "https://www.freebuf.com/articles/wireless/6588.html", "time": "2012-12-26", "level": "", "num_look": 302808, "num_comment": 7, "author": "chown", "tags": ["无线安全"], "text": ""}
{"title": "iPhone上使用Burp Suite捕捉HTTPS通信包方法", "url": "https://www.freebuf.com/articles/web/6577.html", "time": "2012-12-26", "level": "", "num_look": 1046053, "num_comment": 13, "author": "碳基体", "tags": ["WEB安全", "终端安全"], "text": ""}
{"title": "1337day圣诞打折：vBulletin 5 0day售300美元", "url": "https://www.freebuf.com/news/6583.html", "time": "2012-12-25", "level": "", "num_look": 165316, "num_comment": 12, "author": "hihei", "tags": ["资讯"], "text": ""}
{"title": "RFID开发之圣诞老人无稽之谈", "url": "https://www.freebuf.com/articles/wireless/6580.html", "time": "2012-12-25", "level": "", "num_look": 339694, "num_comment": 33, "author": "chown", "tags": ["无线安全", "极客"], "text": ""}
{"title": "iAuditor—iOS APP安全审计工具", "url": "https://www.freebuf.com/sectool/6530.html", "time": "2012-12-25", "level": "", "num_look": 320823, "num_comment": 3, "author": "碳基体", "tags": ["工具", "终端安全"], "text": ""}
{"title": "Verizon遭黑客入侵，300W客户记录泄露", "url": "https://www.freebuf.com/news/6566.html", "time": "2012-12-24", "level": "", "num_look": 122898, "num_comment": 6, "author": "Mohit", "tags": ["资讯"], "text": ""}
{"title": "少一个随身携带男人的理由—USB震动棒", "url": "https://www.freebuf.com/geek/6560.html", "time": "2012-12-24", "level": "", "num_look": 200025, "num_comment": 15, "author": "geekpark", "tags": ["极客"], "text": ""}
{"title": "Android安全之—Dex文件解析（一）(视频下载)", "url": "https://www.freebuf.com/articles/terminal/6557.html", "time": "2012-12-24", "level": "", "num_look": 194740, "num_comment": 3, "author": "不歪", "tags": ["终端安全"], "text": ""}
{"title": "暴力破解工具Hydra 7.4版本发布", "url": "https://www.freebuf.com/sectool/6555.html", "time": "2012-12-24", "level": "", "num_look": 274335, "num_comment": 15, "author": "hihei", "tags": ["工具"], "text": ""}
{"title": "Freebuf开通文章收藏功能", "url": "https://www.freebuf.com/news/others/6554.html", "time": "2012-12-24", "level": "", "num_look": 142819, "num_comment": 6, "author": "root", "tags": ["其他", "周边"], "text": ""}
{"title": "VMware View目录遍历漏洞", "url": "https://www.freebuf.com/vuls/6529.html", "time": "2012-12-21", "level": "", "num_look": 352563, "num_comment": 12, "author": "thanks", "tags": ["漏洞"], "text": ""}
{"title": "freebuf安全周刊12月17日-12月21日", "url": "https://www.freebuf.com/news/others/6528.html", "time": "2012-12-21", "level": "", "num_look": 126819, "num_comment": 2, "author": "root", "tags": ["其他", "周边"], "text": ""}
{"title": "基地组织官网遭受海量ddos攻击", "url": "https://www.freebuf.com/news/6525.html", "time": "2012-12-21", "level": "", "num_look": 153649, "num_comment": 11, "author": "hihei", "tags": ["资讯"], "text": ""}
{"title": "apache插件将合法网站变成恶意程序传播平台", "url": "https://www.freebuf.com/news/6524.html", "time": "2012-12-21", "level": "", "num_look": 128388, "num_comment": 2, "author": "x8", "tags": ["资讯"], "text": ""}
{"title": "Freebuf ACR122U团购活动（限量17套）", "url": "https://www.freebuf.com/news/others/6515.html", "time": "2012-12-20", "level": "", "num_look": 310839, "num_comment": 23, "author": "radiowar", "tags": ["周边", "极客"], "text": ""}
{"title": "好马桶用安卓", "url": "https://www.freebuf.com/geek/6500.html", "time": "2012-12-20", "level": "", "num_look": 113021, "num_comment": 1, "author": "jobs", "tags": ["极客"], "text": ""}
{"title": "免费浏览器安全检测工具browserscan(Rapid7公司出品)", "url": "https://www.freebuf.com/sectool/6520.html", "time": "2012-12-20", "level": "", "num_look": 184443, "num_comment": 7, "author": "pand6z", "tags": ["工具"], "text": ""}
{"title": "腾讯安全中心招聘", "url": "https://www.freebuf.com/jobs/6519.html", "time": "2012-12-20", "level": "", "num_look": 285066, "num_comment": 12, "author": "harite", "tags": ["安全招聘"], "text": ""}
{"title": "实时抓取移动设备上的通信包(ADVsock2pipe+Wireshark+nc+tcpdump)", "url": "https://www.freebuf.com/articles/wireless/6517.html", "time": "2012-12-20", "level": "", "num_look": 649255, "num_comment": 40, "author": "碳基体", "tags": ["无线安全"], "text": ""}
{"title": "台湾卡西欧官方网站遭黑客入侵", "url": "https://www.freebuf.com/news/6513.html", "time": "2012-12-19", "level": "", "num_look": 171958, "num_comment": 6, "author": "IceArmour", "tags": ["资讯"], "text": ""}
{"title": "渗透SCADA工控系统过程解析", "url": "https://www.freebuf.com/articles/system/6501.html", "time": "2012-12-19", "level": "", "num_look": 432633, "num_comment": 25, "author": "thanks", "tags": ["工控安全", "系统安全"], "text": ""}
{"title": "FBI备忘录显示黑客成功入侵了商业HVAC工控系统", "url": "https://www.freebuf.com/news/6504.html", "time": "2012-12-19", "level": "", "num_look": 123254, "num_comment": 1, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "韩国APT攻击剑指俄罗斯", "url": "https://www.freebuf.com/news/6503.html", "time": "2012-12-18", "level": "", "num_look": 272063, "num_comment": 8, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "Sqli-Labs专业SQL注入测试平台", "url": "https://www.freebuf.com/news/others/6498.html", "time": "2012-12-18", "level": "", "num_look": 1122284, "num_comment": 24, "author": "pnig0s", "tags": ["周边", "工具"], "text": ""}
{"title": "portable-phpMyAdmin（Wordpress插件）认证绕过(CVE-2012-5469)", "url": "https://www.freebuf.com/vuls/6495.html", "time": "2012-12-18", "level": "", "num_look": 769252, "num_comment": 11, "author": "newborn", "tags": ["漏洞"], "text": ""}
{"title": "Google技术项目经理Kevin Stadmeyer：Google漏洞奖励计划经验分享", "url": "https://www.freebuf.com/news/6496.html", "time": "2012-12-18", "level": "", "num_look": 135385, "num_comment": 6, "author": "harite", "tags": ["资讯"], "text": ""}
{"title": "跨平台网站安全检测工具Cobra", "url": "https://www.freebuf.com/sectool/6463.html", "time": "2012-12-18", "level": "", "num_look": 219334, "num_comment": 8, "author": "near", "tags": ["工具"], "text": ""}
{"title": "定位GFW的python脚本", "url": "https://www.freebuf.com/news/others/6494.html", "time": "2012-12-17", "level": "", "num_look": 323108, "num_comment": 12, "author": "phper", "tags": ["其他", "周边"], "text": ""}
{"title": "Cisco VoIP电话爆远程窃听漏洞", "url": "https://www.freebuf.com/news/6492.html", "time": "2012-12-17", "level": "", "num_look": 135249, "num_comment": 8, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "黑客入侵六国SCADA系统", "url": "https://www.freebuf.com/news/6491.html", "time": "2012-12-17", "level": "", "num_look": 166410, "num_comment": 7, "author": "IceArmour", "tags": ["资讯"], "text": ""}
{"title": "python探测本地包含文件的小工具", "url": "https://www.freebuf.com/sectool/6487.html", "time": "2012-12-17", "level": "", "num_look": 188239, "num_comment": 5, "author": "eip_0x", "tags": ["工具"], "text": ""}
{"title": "[电子书]S.Y.C《桃园》杂志第五期下载", "url": "https://www.freebuf.com/articles/others-articles/6474.html", "time": "2012-12-17", "level": "", "num_look": 132927, "num_comment": 14, "author": "L.N.", "tags": ["其他"], "text": ""}
{"title": "考试作弊必须指南—通信工具篇", "url": "https://www.freebuf.com/geek/6483.html", "time": "2012-12-17", "level": "", "num_look": 183768, "num_comment": 5, "author": "哈哈", "tags": ["极客"], "text": ""}
{"title": "继Adobe漏洞后 黑客声称控制了部分雅虎服务器", "url": "https://www.freebuf.com/news/6488.html", "time": "2012-12-17", "level": "", "num_look": 102184, "num_comment": 3, "author": "xfk", "tags": ["资讯"], "text": ""}
{"title": "ashx绕过防火墙", "url": "https://www.freebuf.com/articles/web/6472.html", "time": "2012-12-15", "level": "", "num_look": 183105, "num_comment": 5, "author": "hfy", "tags": ["WEB安全"], "text": ""}
{"title": "日本悬赏三百万日元通缉黑客", "url": "https://www.freebuf.com/news/6477.html", "time": "2012-12-14", "level": "", "num_look": 162904, "num_comment": 6, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "IE浏览器鼠标坐标跟踪安全风险,通杀全版本", "url": "https://www.freebuf.com/vuls/6470.html", "time": "2012-12-14", "level": "", "num_look": 170152, "num_comment": 7, "author": "G.r0b1n", "tags": ["漏洞"], "text": ""}
{"title": "黑客三分钟入侵澳大利亚国防军事学院", "url": "https://www.freebuf.com/news/6475.html", "time": "2012-12-14", "level": "", "num_look": 132361, "num_comment": 12, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "短信平台相关常见问题整理", "url": "https://www.freebuf.com/articles/web/6462.html", "time": "2012-12-13", "level": "", "num_look": 308198, "num_comment": 14, "author": "IIIIsh", "tags": ["WEB安全"], "text": ""}
{"title": "vBulletin 5 SQL注入0day出售1.2K美元", "url": "https://www.freebuf.com/news/6467.html", "time": "2012-12-13", "level": "", "num_look": 180682, "num_comment": 4, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "0day交易网站ExploitHub被入侵过程解析", "url": "https://www.freebuf.com/news/6465.html", "time": "2012-12-13", "level": "", "num_look": 367133, "num_comment": 41, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "[小技巧]objectif-securite.ch+cain  hash还可以这样", "url": "https://www.freebuf.com/articles/others-articles/6459.html", "time": "2012-12-13", "level": "", "num_look": 171603, "num_comment": 5, "author": "YaZz", "tags": ["其他"], "text": ""}
{"title": "Intel Sysret (CVE-2012-0217)内核提权漏洞", "url": "https://www.freebuf.com/vuls/6457.html", "time": "2012-12-12", "level": "", "num_look": 258688, "num_comment": 5, "author": "G.r0b1n", "tags": ["漏洞"], "text": ""}
{"title": "Android Linux Kernel 2.6本地DoS", "url": "https://www.freebuf.com/vuls/6456.html", "time": "2012-12-12", "level": "", "num_look": 181681, "num_comment": 1, "author": "newborn", "tags": ["漏洞", "系统安全"], "text": ""}
{"title": "撸者利器：遥控机械臂（视频）", "url": "https://www.freebuf.com/geek/6453.html", "time": "2012-12-12", "level": "", "num_look": 188271, "num_comment": 7, "author": "jobs", "tags": ["极客"], "text": ""}
{"title": "瑞星招聘网络安全研究员", "url": "https://www.freebuf.com/jobs/6444.html", "time": "2012-12-12", "level": "", "num_look": 141412, "num_comment": 7, "author": "G.r0b1n", "tags": ["安全招聘"], "text": ""}
{"title": "世界最大石油公司持续遭受网络攻击，即将停产", "url": "https://www.freebuf.com/news/6450.html", "time": "2012-12-12", "level": "", "num_look": 150254, "num_comment": 5, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "病人数据库加密,黑客要求4000美元赎回信息", "url": "https://www.freebuf.com/news/6447.html", "time": "2012-12-11", "level": "", "num_look": 114175, "num_comment": 3, "author": "chan", "tags": ["资讯"], "text": ""}
{"title": "一只会扭动的邪恶USB触手，慎入（图+视频）", "url": "https://www.freebuf.com/geek/6442.html", "time": "2012-12-11", "level": "", "num_look": 240823, "num_comment": 8, "author": "jobs", "tags": ["极客"], "text": ""}
{"title": "关于手机应用安全的一些个人感悟", "url": "https://www.freebuf.com/articles/terminal/6441.html", "time": "2012-12-11", "level": "", "num_look": 210931, "num_comment": 4, "author": "Horse_Luke", "tags": ["终端安全"], "text": ""}
{"title": "三星智能电视爆0day漏洞，可监控、获取root权限等", "url": "https://www.freebuf.com/news/6440.html", "time": "2012-12-11", "level": "", "num_look": 155911, "num_comment": 9, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "如何用手机来操控电脑", "url": "https://www.freebuf.com/geek/6438.html", "time": "2012-12-11", "level": "", "num_look": 137145, "num_comment": 3, "author": "当当", "tags": ["极客"], "text": ""}
{"title": "[快讯]FBI，NASA等遭黑客攻击，一百六十万用户数据泄露", "url": "https://www.freebuf.com/news/6437.html", "time": "2012-12-11", "level": "", "num_look": 143179, "num_comment": 3, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "Sublime text 2 全平台破解总结", "url": "https://www.freebuf.com/sectool/6434.html", "time": "2012-12-10", "level": "", "num_look": 420850, "num_comment": 23, "author": "darkray", "tags": ["工具"], "text": ""}
{"title": "通过img URL实施XSS的解决方案", "url": "https://www.freebuf.com/articles/web/6433.html", "time": "2012-12-10", "level": "", "num_look": 572056, "num_comment": 3, "author": "sofish", "tags": ["WEB安全"], "text": ""}
{"title": "25块显卡联手轻松破解各种密码", "url": "https://www.freebuf.com/news/6431.html", "time": "2012-12-10", "level": "", "num_look": 284136, "num_comment": 24, "author": "黑小子", "tags": ["资讯"], "text": ""}
{"title": "美将详细评估海外黑客破坏", "url": "https://www.freebuf.com/news/6428.html", "time": "2012-12-10", "level": "", "num_look": 140542, "num_comment": 140542, "author": "h0ck3r", "tags": ["资讯"], "text": ""}
{"title": "Burpsuite sqlmap插件", "url": "https://www.freebuf.com/sectool/6426.html", "time": "2012-12-09", "level": "", "num_look": 839445, "num_comment": 16, "author": "lpcdma", "tags": ["工具"], "text": ""}
{"title": "mobile app security PPT下载", "url": "https://www.freebuf.com/articles/terminal/6423.html", "time": "2012-12-07", "level": "", "num_look": 257458, "num_comment": 6, "author": "碳基体", "tags": ["终端安全"], "text": ""}
{"title": "首款中文渗透测试专用Linux系统—MagicBox", "url": "https://www.freebuf.com/sectool/6414.html", "time": "2012-12-07", "level": "", "num_look": 1523559, "num_comment": 41, "author": "分享团", "tags": ["工具"], "text": ""}
{"title": "Sophos《2013安全威胁报告》：Android与Mac平台成攻击新对象", "url": "https://www.freebuf.com/news/6420.html", "time": "2012-12-07", "level": "", "num_look": 112921, "num_comment": 3, "author": "hihei", "tags": ["资讯"], "text": ""}
{"title": "Android木马窃取36亿欧元，百万手机mTAN被盗", "url": "https://www.freebuf.com/news/6419.html", "time": "2012-12-07", "level": "", "num_look": 118860, "num_comment": 8, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "[快讯]Apache Tomcat多个安全漏洞被公布", "url": "https://www.freebuf.com/news/6416.html", "time": "2012-12-06", "level": "", "num_look": 233442, "num_comment": 4, "author": "binker", "tags": ["漏洞", "资讯"], "text": ""}
{"title": "向正在运行的Linux应用程序注入代码", "url": "https://www.freebuf.com/articles/system/6388.html", "time": "2012-12-06", "level": "", "num_look": 689648, "num_comment": 19, "author": "0x80", "tags": ["系统安全"], "text": ""}
{"title": "增强现实灯—让桌面变触屏", "url": "https://www.freebuf.com/geek/6405.html", "time": "2012-12-06", "level": "", "num_look": 123357, "num_comment": 123357, "author": "jker", "tags": ["极客"], "text": ""}
{"title": "NFC协议安全工具-NFCGUI使用帮助", "url": "https://www.freebuf.com/articles/terminal/6412.html", "time": "2012-12-06", "level": "", "num_look": 280906, "num_comment": 280906, "author": "radiowar", "tags": ["终端安全"], "text": ""}
{"title": "FCKEditor 2.6.8文件上传和有趣的DoS漏洞", "url": "https://www.freebuf.com/vuls/6408.html", "time": "2012-12-06", "level": "", "num_look": 478210, "num_comment": 10, "author": "thanks", "tags": ["WEB安全", "漏洞"], "text": ""}
{"title": "让黑阔闻风丧胆的未来手铐", "url": "https://www.freebuf.com/geek/6402.html", "time": "2012-12-05", "level": "", "num_look": 176769, "num_comment": 12, "author": "西瓜哥", "tags": ["极客"], "text": ""}
{"title": "新手入门8个简洁方便的安全工具", "url": "https://www.freebuf.com/sectool/6401.html", "time": "2012-12-05", "level": "", "num_look": 463172, "num_comment": 3, "author": "hihei", "tags": ["工具"], "text": ""}
{"title": "xDef2012安全防护峰会议题《OAuth Security》PPT下载", "url": "https://www.freebuf.com/articles/web/6397.html", "time": "2012-12-05", "level": "", "num_look": 166572, "num_comment": 6, "author": "pnig0s", "tags": ["WEB安全"], "text": ""}
{"title": "快速的MySQL本地和远程密码破解", "url": "https://www.freebuf.com/articles/database/6398.html", "time": "2012-12-05", "level": "", "num_look": 279534, "num_comment": 10, "author": "bieking", "tags": ["数据安全"], "text": ""}
{"title": "说一说新手在寻找XSS时所存在的一些误区", "url": "https://www.freebuf.com/articles/web/6389.html", "time": "2012-12-05", "level": "", "num_look": 300477, "num_comment": 8, "author": "only_guest", "tags": ["WEB安全"], "text": ""}
{"title": "NFC协议安全工具-NFCGUI发布", "url": "https://www.freebuf.com/articles/terminal/6393.html", "time": "2012-12-05", "level": "", "num_look": 319913, "num_comment": 12, "author": "radiowar", "tags": ["终端安全"], "text": ""}
{"title": "日本宇航中心电脑被病毒入侵，火箭资料或已被窃", "url": "https://www.freebuf.com/news/6384.html", "time": "2012-12-04", "level": "", "num_look": 101410, "num_comment": 2, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "社交网站tumblr上恶意蠕虫大肆传播", "url": "https://www.freebuf.com/news/6382.html", "time": "2012-12-04", "level": "", "num_look": 103553, "num_comment": 103553, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "社区", "url": "https://www.freebuf.com/news/others/6378.html", "time": "2012-12-04", "level": "", "num_look": 135748, "num_comment": 2, "author": "root", "tags": ["其他", "周边"], "text": ""}
{"title": "WebCruiser全版本注册机下载", "url": "https://www.freebuf.com/sectool/6375.html", "time": "2012-12-04", "level": "", "num_look": 569086, "num_comment": 32, "author": "n2w", "tags": ["工具"], "text": ""}
{"title": "华硕、TP-LINK等路由器遭黑客攻击", "url": "https://www.freebuf.com/news/6373.html", "time": "2012-12-03", "level": "", "num_look": 222934, "num_comment": 15, "author": "hihei", "tags": ["资讯"], "text": ""}
{"title": "MySQL(Windows)远程提权漏洞[附扫描及利用程序]", "url": "https://www.freebuf.com/sectool/6370.html", "time": "2012-12-03", "level": "", "num_look": 369483, "num_comment": 11, "author": "pnig0s", "tags": ["工具"], "text": ""}
{"title": "MySQL（Linux）远程数据库提权漏洞", "url": "https://www.freebuf.com/vuls/6364.html", "time": "2012-12-03", "level": "", "num_look": 731651, "num_comment": 12, "author": "G.r0b1n", "tags": ["漏洞"], "text": ""}
{"title": "Mini PHP漏洞检测套件-PHPMVS V1.3发布", "url": "https://www.freebuf.com/sectool/6359.html", "time": "2012-11-30", "level": "", "num_look": 189505, "num_comment": 4, "author": "H3lvin", "tags": ["工具"], "text": ""}
{"title": "Nmap6.25圣诞版发布！增加85个新脚本，更优性能，Win8增强特性等", "url": "https://www.freebuf.com/sectool/6358.html", "time": "2012-11-30", "level": "", "num_look": 214649, "num_comment": 3, "author": "thanks", "tags": ["工具"], "text": ""}
{"title": "窃听耳机通过语音指令盗取手机通信录", "url": "https://www.freebuf.com/articles/wireless/6352.html", "time": "2012-11-30", "level": "", "num_look": 209048, "num_comment": 1, "author": "寂寞搬砖工", "tags": ["无线安全", "终端安全"], "text": ""}
{"title": "中国利用黑客攻击迫使美国过滤软件公司和解", "url": "https://www.freebuf.com/news/6349.html", "time": "2012-11-29", "level": "", "num_look": 162040, "num_comment": 21, "author": "hihei", "tags": ["资讯"], "text": ""}
{"title": "ISF2012议题《网络支付安全》PPT下载", "url": "https://www.freebuf.com/articles/web/6344.html", "time": "2012-11-29", "level": "", "num_look": 194847, "num_comment": 12, "author": "thanks", "tags": ["WEB安全"], "text": ""}
{"title": "黑客入侵国际原子能机构服务器，窃取机密信息", "url": "https://www.freebuf.com/news/6340.html", "time": "2012-11-29", "level": "", "num_look": 110052, "num_comment": 2, "author": "t0", "tags": ["资讯"], "text": ""}
{"title": "1300个国外大学数据库遭黑客入侵", "url": "https://www.freebuf.com/news/6339.html", "time": "2012-11-29", "level": "", "num_look": 140030, "num_comment": 2, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "LulzSec成员Jeffrey面临无期徒刑", "url": "https://www.freebuf.com/news/6341.html", "time": "2012-11-29", "level": "", "num_look": 124696, "num_comment": 1, "author": "Grubb", "tags": ["资讯"], "text": ""}
{"title": "智能跳蛋是怎样炼成的", "url": "https://www.freebuf.com/geek/6337.html", "time": "2012-11-28", "level": "", "num_look": 364585, "num_comment": 17, "author": "mariox", "tags": ["极客"], "text": ""}
{"title": "跪了，日本技术宅自制机器人（含视频）", "url": "https://www.freebuf.com/news/others/6334.html", "time": "2012-11-28", "level": "", "num_look": 195712, "num_comment": 13, "author": "greenday", "tags": ["周边", "极客"], "text": ""}
{"title": "最新Java零日漏洞以5位数价格在地下黑市售卖", "url": "https://www.freebuf.com/news/6332.html", "time": "2012-11-28", "level": "", "num_look": 163951, "num_comment": 18, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "针对虚拟机的渗透测试", "url": "https://www.freebuf.com/articles/system/6315.html", "time": "2012-11-28", "level": "", "num_look": 282931, "num_comment": 282931, "author": "thanks", "tags": ["系统安全"], "text": ""}
{"title": "[更新]三星全系打印机发现严重漏洞", "url": "https://www.freebuf.com/news/6330.html", "time": "2012-11-28", "level": "", "num_look": 176340, "num_comment": 10, "author": "hihei", "tags": ["资讯"], "text": ""}
{"title": "国外黑客组织声称发现SCADA系统多个0day", "url": "https://www.freebuf.com/news/6322.html", "time": "2012-11-27", "level": "", "num_look": 196556, "num_comment": 8, "author": "kelz", "tags": ["工控安全", "资讯"], "text": ""}
{"title": "黑客.记忆.信息.间谍", "url": "https://www.freebuf.com/news/6320.html", "time": "2012-11-27", "level": "", "num_look": 119451, "num_comment": 9, "author": "only", "tags": ["资讯"], "text": ""}
{"title": "反向Web Shell处理工具-Shell of the Future", "url": "https://www.freebuf.com/sectool/6319.html", "time": "2012-11-27", "level": "", "num_look": 362167, "num_comment": 12, "author": "hihei", "tags": ["工具"], "text": ""}
{"title": "越狱检测／越狱检测绕过—xCon", "url": "https://www.freebuf.com/articles/wireless/6318.html", "time": "2012-11-27", "level": "", "num_look": 615157, "num_comment": 15, "author": "碳基体", "tags": ["无线安全"], "text": ""}
{"title": "火焰病毒感染法国前总统萨科齐办公室电脑", "url": "https://www.freebuf.com/news/6314.html", "time": "2012-11-27", "level": "", "num_look": 132902, "num_comment": 6, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "新Mac木马确定为针对激进组织", "url": "https://www.freebuf.com/news/6309.html", "time": "2012-11-26", "level": "", "num_look": 104991, "num_comment": 5, "author": "integ", "tags": ["资讯"], "text": ""}
{"title": "巴基斯坦Google、yahoo、微软、Apple等大型网站被黑分析", "url": "https://www.freebuf.com/news/6306.html", "time": "2012-11-26", "level": "", "num_look": 126719, "num_comment": 12, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "google.com.pk和apple.pk等域名遭黑客劫持", "url": "https://www.freebuf.com/news/6305.html", "time": "2012-11-26", "level": "", "num_look": 130334, "num_comment": 1, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "Yahoo邮箱劫持零日漏洞以700美元被售卖(含视频)", "url": "https://www.freebuf.com/news/6301.html", "time": "2012-11-24", "level": "", "num_look": 121241, "num_comment": 9, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "人人网遭受大规模XSS攻击", "url": "https://www.freebuf.com/articles/6295.html", "time": "2012-11-24", "level": "", "num_look": 405018, "num_comment": 21, "author": "bass", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "[影视推荐]黑客题材美剧—网络末日战", "url": "https://www.freebuf.com/news/6292.html", "time": "2012-11-22", "level": "", "num_look": 413811, "num_comment": 12, "author": "global_hacker", "tags": ["资讯"], "text": ""}
{"title": "趋势科技中国研发中心诚招手机安全研究工程师", "url": "https://www.freebuf.com/jobs/6290.html", "time": "2012-11-21", "level": "", "num_look": 152003, "num_comment": 12, "author": "trendHR", "tags": ["安全招聘"], "text": ""}
{"title": "[图]美一黑客因利用AT&T网站漏洞非法获取iPad用户信息获刑", "url": "https://www.freebuf.com/news/6288.html", "time": "2012-11-21", "level": "", "num_look": 225759, "num_comment": 1, "author": "2MB", "tags": ["资讯"], "text": ""}
{"title": "dSploit—Android网络渗透套件测试小记（含视频）", "url": "https://www.freebuf.com/articles/wireless/6279.html", "time": "2012-11-21", "level": "", "num_look": 3148693, "num_comment": 73, "author": "元首", "tags": ["无线安全"], "text": ""}
{"title": "网络设备识别工具—NetSleuth", "url": "https://www.freebuf.com/sectool/6282.html", "time": "2012-11-21", "level": "", "num_look": 218400, "num_comment": 5, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "在标准宽带光纤上实现量子加密", "url": "https://www.freebuf.com/news/6283.html", "time": "2012-11-21", "level": "", "num_look": 111277, "num_comment": 1, "author": "IceArmour", "tags": ["资讯"], "text": ""}
{"title": "Win8的远程桌面漏洞：利用QQ拼音纯净版实现提权", "url": "https://www.freebuf.com/vuls/6280.html", "time": "2012-11-21", "level": "", "num_look": 295844, "num_comment": 31, "author": "xsser", "tags": ["漏洞"], "text": ""}
{"title": "恶意病毒利用Google Docs作中转连接CC服务器", "url": "https://www.freebuf.com/news/6276.html", "time": "2012-11-21", "level": "", "num_look": 118702, "num_comment": 5, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "分布式密码分析框架-Wisecracker", "url": "https://www.freebuf.com/sectool/6275.html", "time": "2012-11-20", "level": "", "num_look": 151484, "num_comment": 2, "author": "bigfoot", "tags": ["工具"], "text": ""}
{"title": "研究人员用心脏细胞和水凝胶做出了会走动的“生物机器人”（图+视频）", "url": "https://www.freebuf.com/geek/6265.html", "time": "2012-11-20", "level": "", "num_look": 120178, "num_comment": 1, "author": "freebuf", "tags": ["极客"], "text": ""}
{"title": "黑客组织“匿名者”公布5000名以色列军官信息", "url": "https://www.freebuf.com/news/6273.html", "time": "2012-11-20", "level": "", "num_look": 127475, "num_comment": 4, "author": "IceArmour", "tags": ["资讯"], "text": ""}
{"title": "pyqt IP段端口扫描工具", "url": "https://www.freebuf.com/sectool/6261.html", "time": "2012-11-20", "level": "", "num_look": 300730, "num_comment": 6, "author": "alalmn", "tags": ["工具"], "text": ""}
{"title": "生命会寻找出路，靠偷取别人基因存活8000万年", "url": "https://www.freebuf.com/news/6267.html", "time": "2012-11-19", "level": "", "num_look": 151657, "num_comment": 8, "author": "西瓜", "tags": ["资讯"], "text": ""}
{"title": "in-appstore.com免费内购方法的完整分析", "url": "https://www.freebuf.com/articles/wireless/6262.html", "time": "2012-11-19", "level": "", "num_look": 777654, "num_comment": 7, "author": "碳基体", "tags": ["无线安全"], "text": ""}
{"title": "FreeBSD服务器遭入侵", "url": "https://www.freebuf.com/news/6263.html", "time": "2012-11-19", "level": "", "num_look": 100922, "num_comment": 1, "author": "IceArmour", "tags": ["资讯"], "text": ""}
{"title": "堪比美剧！John McAfee否认谋杀，正在逃亡", "url": "https://www.freebuf.com/news/6251.html", "time": "2012-11-16", "level": "", "num_look": 133265, "num_comment": 10, "author": "IceArmour", "tags": ["资讯"], "text": ""}
{"title": "3D打印世界：颠覆世界的产品", "url": "https://www.freebuf.com/geek/6245.html", "time": "2012-11-16", "level": "", "num_look": 127965, "num_comment": 4, "author": "8buy", "tags": ["极客"], "text": ""}
{"title": "被Google忽略的XSS漏洞", "url": "https://www.freebuf.com/articles/web/6242.html", "time": "2012-11-16", "level": "", "num_look": 224060, "num_comment": 18, "author": "thanks", "tags": ["WEB安全"], "text": ""}
{"title": "[更新]无线渗透测试套件PwnSTAR", "url": "https://www.freebuf.com/sectool/6240.html", "time": "2012-11-16", "level": "", "num_look": 165090, "num_comment": 4, "author": "kakulukiya", "tags": ["工具"], "text": ""}
{"title": "为再防信息被盗事件发生，NASA计划为其员工的笔记本加密", "url": "https://www.freebuf.com/news/6239.html", "time": "2012-11-16", "level": "", "num_look": 93854, "num_comment": 93854, "author": "G.r0b1n", "tags": ["资讯"], "text": ""}
{"title": "EA游戏平台被黑 用户信息外泄", "url": "https://www.freebuf.com/news/6234.html", "time": "2012-11-15", "level": "", "num_look": 113624, "num_comment": 7, "author": "T0", "tags": ["资讯"], "text": ""}
{"title": "Adobe遭黑客入侵，15W数据泄露", "url": "https://www.freebuf.com/news/6231.html", "time": "2012-11-15", "level": "", "num_look": 191740, "num_comment": 15, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "MAC OS下无线破解工具kisMAC", "url": "https://www.freebuf.com/sectool/6227.html", "time": "2012-11-14", "level": "", "num_look": 434157, "num_comment": 8, "author": "super480", "tags": ["工具"], "text": ""}
{"title": "苹果官网发现XSS漏洞", "url": "https://www.freebuf.com/news/6224.html", "time": "2012-11-14", "level": "", "num_look": 205105, "num_comment": 13, "author": "犀利哥", "tags": ["漏洞", "资讯"], "text": ""}
{"title": "趋势科技警告出现专盗图片文件的病毒", "url": "https://www.freebuf.com/news/6223.html", "time": "2012-11-14", "level": "", "num_look": 129281, "num_comment": 10, "author": "cs24", "tags": ["周边", "资讯"], "text": ""}
{"title": "中情局长与情人共享Gmail帐号，情人或复用密码", "url": "https://www.freebuf.com/news/6221.html", "time": "2012-11-13", "level": "", "num_look": 119335, "num_comment": 4, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "中国屏蔽Google旨在测试外界反应", "url": "https://www.freebuf.com/news/6220.html", "time": "2012-11-13", "level": "", "num_look": 132302, "num_comment": 5, "author": "孤独剑客", "tags": ["资讯"], "text": ""}
{"title": "McAfee创始人涉嫌谋杀被通缉", "url": "https://www.freebuf.com/news/6217.html", "time": "2012-11-13", "level": "", "num_look": 143917, "num_comment": 10, "author": "H3lvin", "tags": ["资讯"], "text": ""}
{"title": "OSSEC系列之四—-active-response", "url": "https://www.freebuf.com/articles/system/6210.html", "time": "2012-11-13", "level": "", "num_look": 210574, "num_comment": 2, "author": "lion_00", "tags": ["系统安全"], "text": ""}
{"title": "树莓派（Raspberry Pi）渗透测试系统—PwnPi v2.0", "url": "https://www.freebuf.com/sectool/6211.html", "time": "2012-11-13", "level": "", "num_look": 420869, "num_comment": 20, "author": "phper", "tags": ["工具", "极客"], "text": ""}
{"title": "TrueCrypt破解工具-TCHead", "url": "https://www.freebuf.com/sectool/6208.html", "time": "2012-11-12", "level": "", "num_look": 727653, "num_comment": 22, "author": "H3lvin", "tags": ["工具"], "text": ""}
{"title": "XSS获取cookie并利用", "url": "https://www.freebuf.com/articles/web/6204.html", "time": "2012-11-12", "level": "", "num_look": 1352478, "num_comment": 24, "author": "xfk", "tags": ["WEB安全"], "text": ""}
{"title": "Android窃取用户信息新思路", "url": "https://www.freebuf.com/articles/terminal/6201.html", "time": "2012-11-12", "level": "", "num_look": 249462, "num_comment": 6, "author": "icefish", "tags": ["终端安全"], "text": ""}
{"title": "单身节寂寞？未来的性爱机器人不仅能给人带来高潮，还有长寿", "url": "https://www.freebuf.com/geek/6206.html", "time": "2012-11-11", "level": "", "num_look": 304987, "num_comment": 23, "author": "单身情歌", "tags": ["极客"], "text": ""}
{"title": "OSSEC系列三--文件监控（SYSCHECK）", "url": "https://www.freebuf.com/articles/system/6175.html", "time": "2012-11-11", "level": "", "num_look": 302486, "num_comment": 302486, "author": "lion_00", "tags": ["系统安全"], "text": ""}
{"title": "页游安全攻与防", "url": "https://www.freebuf.com/articles/web/6197.html", "time": "2012-11-10", "level": "", "num_look": 307494, "num_comment": 9, "author": "碳基体", "tags": ["WEB安全"], "text": ""}
{"title": "[极客有意思]使用arduino进行渗透测试", "url": "https://www.freebuf.com/articles/terminal/6182.html", "time": "2012-11-10", "level": "", "num_look": 924834, "num_comment": 58, "author": "lpcdma", "tags": ["极客", "终端安全"], "text": ""}
{"title": "[快讯]互联网最大规模帐号劫持漏洞即将引爆--用户数据隐私受到再一次考验", "url": "https://www.freebuf.com/news/6189.html", "time": "2012-11-09", "level": "", "num_look": 252631, "num_comment": 28, "author": "root", "tags": ["资讯"], "text": ""}
{"title": "渗透测试神器Burp弹药扩充-fuzzdb", "url": "https://www.freebuf.com/sectool/6181.html", "time": "2012-11-09", "level": "", "num_look": 310016, "num_comment": 12, "author": "l4mbda", "tags": ["工具"], "text": ""}
{"title": "瑞星攻防实验室招聘", "url": "https://www.freebuf.com/jobs/6187.html", "time": "2012-11-09", "level": "", "num_look": 191804, "num_comment": 9, "author": "G.r0b1n", "tags": ["安全招聘"], "text": ""}
{"title": "[户外渗透]自动售药机渗透测试", "url": "https://www.freebuf.com/articles/terminal/6184.html", "time": "2012-11-09", "level": "", "num_look": 359540, "num_comment": 33, "author": "生生不息", "tags": ["终端安全"], "text": ""}
{"title": "OSSEC系列二------编写自己的DECODE（初级）", "url": "https://www.freebuf.com/articles/system/6157.html", "time": "2012-11-09", "level": "", "num_look": 244446, "num_comment": 6, "author": "lion_00", "tags": ["系统安全"], "text": ""}
{"title": "地下黑市爆出Adobe Reader 0day", "url": "https://www.freebuf.com/news/6183.html", "time": "2012-11-09", "level": "", "num_look": 148036, "num_comment": 15, "author": "IceArmour", "tags": ["资讯"], "text": ""}
{"title": "送给键盘控的两款小软件", "url": "https://www.freebuf.com/sectool/6176.html", "time": "2012-11-08", "level": "", "num_look": 136791, "num_comment": 2, "author": "crazyboy", "tags": ["工具"], "text": ""}
{"title": "宅女专用装备—USB供电暖腿袜", "url": "https://www.freebuf.com/geek/6170.html", "time": "2012-11-08", "level": "", "num_look": 186466, "num_comment": 13, "author": "jobs", "tags": ["极客"], "text": ""}
{"title": "对Android最新fakesms漏洞的分析", "url": "https://www.freebuf.com/articles/terminal/6169.html", "time": "2012-11-08", "level": "", "num_look": 247873, "num_comment": 9, "author": "flanker017", "tags": ["终端安全"], "text": ""}
{"title": "技术宅、键盘控的福音—教你用Vimium上Freebuf", "url": "https://www.freebuf.com/sectool/6151.html", "time": "2012-11-08", "level": "", "num_look": 246991, "num_comment": 22, "author": "熙雅", "tags": ["工具"], "text": ""}
{"title": "Wifi蜜罐", "url": "https://www.freebuf.com/sectool/6162.html", "time": "2012-11-07", "level": "", "num_look": 392268, "num_comment": 5, "author": "kk", "tags": ["工具"], "text": ""}
{"title": "[更新]暴力破解工具-Patator V0.4", "url": "https://www.freebuf.com/sectool/6161.html", "time": "2012-11-07", "level": "", "num_look": 211741, "num_comment": 7, "author": "H3lvin", "tags": ["工具"], "text": ""}
{"title": "Burp Suite---BLIND SQL INJECTION", "url": "https://www.freebuf.com/articles/web/6154.html", "time": "2012-11-07", "level": "", "num_look": 312008, "num_comment": 16, "author": "小冰", "tags": ["WEB安全"], "text": ""}
{"title": "将主机IDS OSSEC日志文件存入MYSQL的方法", "url": "https://www.freebuf.com/articles/system/6139.html", "time": "2012-11-07", "level": "", "num_look": 249525, "num_comment": 8, "author": "lion_00", "tags": ["系统安全"], "text": ""}
{"title": "北京启明星辰高薪招聘高级咨询顾问", "url": "https://www.freebuf.com/jobs/6144.html", "time": "2012-11-07", "level": "", "num_look": 239568, "num_comment": 28, "author": "熙雅", "tags": ["安全招聘"], "text": ""}
{"title": "Side Channel攻击—云计算环境的安全威胁", "url": "https://www.freebuf.com/news/6127.html", "time": "2012-11-07", "level": "", "num_look": 274821, "num_comment": 3, "author": "dangdang", "tags": ["WEB安全", "系统安全"], "text": ""}
{"title": "匿名组织入侵 Paypal和多个网站", "url": "https://www.freebuf.com/news/6140.html", "time": "2012-11-06", "level": "", "num_look": 159350, "num_comment": 8, "author": "sphere", "tags": ["资讯"], "text": ""}
{"title": "中国黑客入侵可口可乐公司，关于收购汇源公司的机密文件被盗", "url": "https://www.freebuf.com/news/6129.html", "time": "2012-11-06", "level": "", "num_look": 132118, "num_comment": 1, "author": "pnig0s", "tags": ["资讯"], "text": ""}
{"title": "FreeBUF Proxmark3光棍节团购（限量20套）", "url": "https://www.freebuf.com/geek/6124.html", "time": "2012-11-06", "level": "", "num_look": 240371, "num_comment": 31, "author": "radiowar", "tags": ["极客"], "text": ""}
{"title": "渗透测试实用Cheat Sheet", "url": "https://www.freebuf.com/articles/web/6093.html", "time": "2012-11-06", "level": "", "num_look": 228469, "num_comment": 9, "author": "thanks", "tags": ["WEB安全"], "text": ""}
{"title": "高端黑链SEO—恶意JS脚本注入访问伪随机域名", "url": "https://www.freebuf.com/articles/web/6119.html", "time": "2012-11-06", "level": "", "num_look": 223202, "num_comment": 5, "author": "phper", "tags": ["WEB安全"], "text": ""}
{"title": "JBOSS服务器渗透测试工具—JBoss Autopwn", "url": "https://www.freebuf.com/sectool/6112.html", "time": "2012-11-05", "level": "", "num_look": 307619, "num_comment": 4, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "Python扫描IP段指定端口是否开放（一次扫描20个B网段没问题）", "url": "https://www.freebuf.com/sectool/6097.html", "time": "2012-11-05", "level": "", "num_look": 360700, "num_comment": 8, "author": "alalmn", "tags": ["工具"], "text": ""}
{"title": "Backtrack5 R3实用新工具分析（下）", "url": "https://www.freebuf.com/sectool/6043.html", "time": "2012-11-05", "level": "", "num_look": 237134, "num_comment": 3, "author": "thanks", "tags": ["WEB安全", "工具"], "text": ""}
{"title": "TRENDnet IP Camera Multiple Vulnerabilities", "url": "https://www.freebuf.com/vuls/6099.html", "time": "2012-11-05", "level": "", "num_look": 487599, "num_comment": 5, "author": "hip", "tags": ["无线安全", "漏洞"], "text": ""}
{"title": "Freebuf社区发布公告", "url": "https://www.freebuf.com/news/6020.html", "time": "2012-11-04", "level": "", "num_look": 175299, "num_comment": 16, "author": "root", "tags": ["周边", "资讯"], "text": ""}
{"title": "Windows Server 2008 GPP 安全问题分析", "url": "https://www.freebuf.com/articles/system/6089.html", "time": "2012-11-04", "level": "", "num_look": 233111, "num_comment": 5, "author": "dimanche", "tags": ["系统安全"], "text": ""}
{"title": "配置追踪者—Scylla v1(渗透测试工具)", "url": "https://www.freebuf.com/sectool/6092.html", "time": "2012-11-04", "level": "", "num_look": 227881, "num_comment": 8, "author": "kk", "tags": ["工具"], "text": ""}
{"title": "Python FTP爆破脚本", "url": "https://www.freebuf.com/articles/web/6088.html", "time": "2012-11-03", "level": "", "num_look": 636402, "num_comment": 14, "author": "alalmn", "tags": ["WEB安全"], "text": ""}
{"title": "Burp Suite免费版本（Free Edition）v1.5发布", "url": "https://www.freebuf.com/sectool/6090.html", "time": "2012-11-03", "level": "", "num_look": 286355, "num_comment": 11, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "Novell ConsoleOne Hack Evolution", "url": "https://www.freebuf.com/articles/others-articles/6084.html", "time": "2012-11-02", "level": "", "num_look": 186853, "num_comment": 10, "author": "CasperKid", "tags": ["其他"], "text": ""}
{"title": "恶意软件使用\"新\"技术规避自动威胁分析系统", "url": "https://www.freebuf.com/articles/others-articles/6072.html", "time": "2012-11-02", "level": "", "num_look": 183849, "num_comment": 6, "author": "cs24", "tags": ["其他", "系统安全"], "text": ""}
{"title": "[快讯]Apache设置不严，暴露server-status", "url": "https://www.freebuf.com/news/6077.html", "time": "2012-11-01", "level": "", "num_look": 265029, "num_comment": 5, "author": "cs24", "tags": ["漏洞", "资讯"], "text": ""}
{"title": "神奇WIFI智能笔：将所写内容传给电脑[视频]", "url": "https://www.freebuf.com/geek/6065.html", "time": "2012-11-01", "level": "", "num_look": 149537, "num_comment": 4, "author": "jobs", "tags": ["极客"], "text": ""}
{"title": "iOS平台游戏安全之IPA破解原理及防御(第三弹)", "url": "https://www.freebuf.com/articles/wireless/6068.html", "time": "2012-11-01", "level": "", "num_look": 691983, "num_comment": 10, "author": "碳基体", "tags": ["无线安全"], "text": ""}
{"title": "反击！格鲁吉亚政府控制俄罗斯间谍的电脑", "url": "https://www.freebuf.com/news/6073.html", "time": "2012-11-01", "level": "", "num_look": 133813, "num_comment": 9, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "楼主朋友发现一个非常高端的淘宝店铺骗局", "url": "https://www.freebuf.com/articles/6071.html", "time": "2012-10-31", "level": "", "num_look": 363062, "num_comment": 36, "author": "ssica", "tags": ["其他", "文章"], "text": ""}
{"title": "渗透那些事", "url": "https://www.freebuf.com/articles/web/6057.html", "time": "2012-10-31", "level": "", "num_look": 618429, "num_comment": 71, "author": "G.r0b1n", "tags": ["WEB安全", "其他"], "text": ""}
{"title": "美大学生入侵学校计算机系统盗窃女生隐私信息被法院起诉", "url": "https://www.freebuf.com/news/6060.html", "time": "2012-10-31", "level": "", "num_look": 127905, "num_comment": 14, "author": "supergoku", "tags": ["资讯"], "text": ""}
{"title": "iStrike Shuttle：让你在办公室里轻松操控可发射乒乓球的小型飞行器(图)", "url": "https://www.freebuf.com/geek/6052.html", "time": "2012-10-31", "level": "", "num_look": 155548, "num_comment": 1, "author": "po45", "tags": ["极客"], "text": ""}
{"title": "[预告]Freebuf社区本周发布", "url": "https://www.freebuf.com/news/6051.html", "time": "2012-10-30", "level": "", "num_look": 268347, "num_comment": 43, "author": "root", "tags": ["周边", "资讯"], "text": ""}
{"title": "音乐极客用电子鼓发邮件", "url": "https://www.freebuf.com/geek/6050.html", "time": "2012-10-30", "level": "", "num_look": 129936, "num_comment": 2, "author": "寂寞哥", "tags": ["极客"], "text": ""}
{"title": "流量解码器-Xplico 1.0.1发布", "url": "https://www.freebuf.com/sectool/6044.html", "time": "2012-10-30", "level": "", "num_look": 226903, "num_comment": 226903, "author": "ehagg", "tags": ["工具"], "text": ""}
{"title": "智能手机收集数据，严重侵犯用户隐私", "url": "https://www.freebuf.com/news/6046.html", "time": "2012-10-30", "level": "", "num_look": 122894, "num_comment": 122894, "author": "Talekar", "tags": ["资讯"], "text": ""}
{"title": "调戏突破SecureRDP对远程桌面连接的限制", "url": "https://www.freebuf.com/articles/6039.html", "time": "2012-10-29", "level": "", "num_look": 174879, "num_comment": 5, "author": "only_guest", "tags": ["文章"], "text": ""}
{"title": "黑客组织NullCrew公布美国政府及军队网站数据库", "url": "https://www.freebuf.com/news/6036.html", "time": "2012-10-29", "level": "", "num_look": 151177, "num_comment": 12, "author": "fu4k", "tags": ["资讯"], "text": ""}
{"title": "恶意程序检测软件—X-Ray 2.0", "url": "https://www.freebuf.com/sectool/6034.html", "time": "2012-10-29", "level": "", "num_look": 145158, "num_comment": 145158, "author": "北极", "tags": ["工具"], "text": ""}
{"title": "黑客泄露美国宇航局(NASA)子站源代码[附下载]", "url": "https://www.freebuf.com/news/6029.html", "time": "2012-10-28", "level": "", "num_look": 224797, "num_comment": 7, "author": "pnig0s", "tags": ["资讯"], "text": ""}
{"title": "记一次简单的渗透测试过程", "url": "https://www.freebuf.com/articles/web/6028.html", "time": "2012-10-26", "level": "", "num_look": 512646, "num_comment": 18, "author": "eip_0x", "tags": ["WEB安全"], "text": ""}
{"title": "猎头邮件暴露出Google的一个重大安全漏洞", "url": "https://www.freebuf.com/news/6027.html", "time": "2012-10-26", "level": "", "num_look": 124892, "num_comment": 4, "author": "phper", "tags": ["资讯"], "text": ""}
{"title": "美大学生3D打印模型飞机成功试飞，成本2000美元", "url": "https://www.freebuf.com/geek/6025.html", "time": "2012-10-26", "level": "", "num_look": 116113, "num_comment": 13, "author": "当当", "tags": ["极客"], "text": ""}
{"title": "浅谈协议安全", "url": "https://www.freebuf.com/articles/wireless/6014.html", "time": "2012-10-25", "level": "", "num_look": 213712, "num_comment": 9, "author": "生生不息", "tags": ["无线安全"], "text": ""}
{"title": "PS3加密密钥泄漏", "url": "https://www.freebuf.com/news/6023.html", "time": "2012-10-25", "level": "", "num_look": 110068, "num_comment": 110068, "author": "stories", "tags": ["资讯"], "text": ""}
{"title": "HoneyMap-让你实时了解黑客攻击", "url": "https://www.freebuf.com/sectool/6021.html", "time": "2012-10-25", "level": "", "num_look": 317075, "num_comment": 11, "author": "G.r0b1n", "tags": ["工具"], "text": ""}
{"title": "Backtrack5 R3实用新工具分析（上）", "url": "https://www.freebuf.com/sectool/6012.html", "time": "2012-10-25", "level": "", "num_look": 500671, "num_comment": 26, "author": "thanks", "tags": ["WEB安全", "工具"], "text": ""}
{"title": "Burp Suite PayLoad下载", "url": "https://www.freebuf.com/sectool/6017.html", "time": "2012-10-25", "level": "", "num_look": 395206, "num_comment": 21, "author": "小冰", "tags": ["工具"], "text": ""}
{"title": "国外研究声明-安卓应用程序严重泄露个人信息", "url": "https://www.freebuf.com/news/6018.html", "time": "2012-10-25", "level": "", "num_look": 136217, "num_comment": 11, "author": "v0ex", "tags": ["资讯"], "text": ""}
{"title": "自动XSS过滤突破工具—snuck", "url": "https://www.freebuf.com/sectool/6009.html", "time": "2012-10-24", "level": "", "num_look": 235093, "num_comment": 5, "author": "thanks", "tags": ["工具"], "text": ""}
{"title": "科学家研制新型超密磁带可存储35TB数据", "url": "https://www.freebuf.com/geek/6007.html", "time": "2012-10-24", "level": "", "num_look": 130949, "num_comment": 6, "author": "flgs", "tags": ["极客"], "text": ""}
{"title": "OAuth认证机制中普遍的安全问题", "url": "https://www.freebuf.com/articles/web/5997.html", "time": "2012-10-24", "level": "", "num_look": 408305, "num_comment": 18, "author": "pnig0s", "tags": ["WEB安全"], "text": ""}
{"title": "新的力量, 新的方向-ISF2012安全会议邀请函", "url": "https://www.freebuf.com/news/6004.html", "time": "2012-10-24", "level": "", "num_look": 127807, "num_comment": 3, "author": "ISF2012", "tags": ["周边", "资讯"], "text": ""}
{"title": "FBI官方网站被黑，部分数据泄露", "url": "https://www.freebuf.com/news/5991.html", "time": "2012-10-24", "level": "", "num_look": 175447, "num_comment": 8, "author": "T0", "tags": ["资讯"], "text": ""}
{"title": "安全扫描器N-Stalker Free edition（免费版）简介及使用指南", "url": "https://www.freebuf.com/sectool/5992.html", "time": "2012-10-24", "level": "", "num_look": 515173, "num_comment": 3, "author": "thanks", "tags": ["工具"], "text": ""}
{"title": "法黑客用假冒App吸金 1.7万用户上当", "url": "https://www.freebuf.com/news/5988.html", "time": "2012-10-23", "level": "", "num_look": 117668, "num_comment": 1, "author": "zooo1", "tags": ["资讯"], "text": ""}
{"title": "跨站测试与利用中的绕过技术", "url": "https://www.freebuf.com/articles/web/5984.html", "time": "2012-10-23", "level": "", "num_look": 298745, "num_comment": 10, "author": "fake", "tags": ["WEB安全"], "text": ""}
{"title": "5个被黑的数字道路牌", "url": "https://www.freebuf.com/news/5976.html", "time": "2012-10-23", "level": "", "num_look": 128394, "num_comment": 6, "author": "hac9k", "tags": ["周边", "资讯"], "text": ""}
{"title": "香港理工大学计算机系招收手机安全方向RA或MPhil/Ph.D学生", "url": "https://www.freebuf.com/jobs/5974.html", "time": "2012-10-22", "level": "", "num_look": 163967, "num_comment": 11, "author": "pnig0s", "tags": ["安全招聘"], "text": ""}
{"title": "世界卫生组织WHO受黑客组织Nullcrew攻击", "url": "https://www.freebuf.com/news/5970.html", "time": "2012-10-22", "level": "", "num_look": 119191, "num_comment": 5, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "电击内裤：褥疮患者的福音", "url": "https://www.freebuf.com/geek/5967.html", "time": "2012-10-22", "level": "", "num_look": 121479, "num_comment": 6, "author": "dola", "tags": ["极客"], "text": ""}
{"title": "最新Oracle Database验证协议安全绕过漏洞", "url": "https://www.freebuf.com/vuls/5962.html", "time": "2012-10-21", "level": "", "num_look": 152902, "num_comment": 5, "author": "xfk", "tags": ["漏洞"], "text": ""}
{"title": "miniFlame-火焰木马的小兄弟", "url": "https://www.freebuf.com/news/5959.html", "time": "2012-10-19", "level": "", "num_look": 110992, "num_comment": 8, "author": "pub!1c", "tags": ["资讯"], "text": ""}
{"title": "UPEK指纹认证系统发现重大安全漏洞", "url": "https://www.freebuf.com/news/5957.html", "time": "2012-10-19", "level": "", "num_look": 123115, "num_comment": 1, "author": "Maly", "tags": ["资讯"], "text": ""}
{"title": "WebSploit Framework 2.0.3发布", "url": "https://www.freebuf.com/sectool/5955.html", "time": "2012-10-19", "level": "", "num_look": 203045, "num_comment": 4, "author": "Obama", "tags": ["工具"], "text": ""}
{"title": "医院的医疗设施容易感染恶意程序", "url": "https://www.freebuf.com/news/5953.html", "time": "2012-10-19", "level": "", "num_look": 156041, "num_comment": 3, "author": "t0", "tags": ["资讯"], "text": ""}
{"title": "H.264网络摄像头漏洞测试工具", "url": "https://www.freebuf.com/sectool/5950.html", "time": "2012-10-18", "level": "", "num_look": 435191, "num_comment": 6, "author": "Hashkill", "tags": ["工具"], "text": ""}
{"title": "分享一个最近linux渗透测试案例中碰到的Tips", "url": "https://www.freebuf.com/articles/web/5946.html", "time": "2012-10-18", "level": "", "num_look": 266684, "num_comment": 17, "author": "beach", "tags": ["WEB安全"], "text": ""}
{"title": "Android渗透测试神器新版dSploit v1.0.23b发布", "url": "https://www.freebuf.com/sectool/5947.html", "time": "2012-10-18", "level": "", "num_look": 538328, "num_comment": 29, "author": "jobs", "tags": ["工具"], "text": ""}
{"title": "5次史上最牛的黑客攻击", "url": "https://www.freebuf.com/news/5944.html", "time": "2012-10-17", "level": "", "num_look": 139445, "num_comment": 3, "author": "kk", "tags": ["周边", "资讯"], "text": ""}
{"title": "浏览器steam协议漏洞可以让黑客劫持PC", "url": "https://www.freebuf.com/news/5943.html", "time": "2012-10-17", "level": "", "num_look": 143282, "num_comment": 3, "author": "S4x", "tags": ["资讯"], "text": ""}
{"title": "iOS平台游戏安全再议之存档修改与防御（第二弹）", "url": "https://www.freebuf.com/articles/wireless/5923.html", "time": "2012-10-17", "level": "", "num_look": 504407, "num_comment": 19, "author": "碳基体", "tags": ["无线安全"], "text": ""}
{"title": "如何打造低成本的便携式Proxmark3独立模式", "url": "https://www.freebuf.com/articles/terminal/5921.html", "time": "2012-10-16", "level": "", "num_look": 316325, "num_comment": 7, "author": "radiowar", "tags": ["极客", "终端安全"], "text": ""}
{"title": "加拿大科学家发明魔术手指，让所有物理界面变成触摸屏幕", "url": "https://www.freebuf.com/geek/5934.html", "time": "2012-10-16", "level": "", "num_look": 316174, "num_comment": 316174, "author": "y4pman", "tags": ["极客"], "text": ""}
{"title": "利用sslstrip和ettercap突破ssl嗅探密码", "url": "https://www.freebuf.com/articles/web/5929.html", "time": "2012-10-16", "level": "", "num_look": 2373541, "num_comment": 48, "author": "xfk", "tags": ["WEB安全"], "text": ""}
{"title": "Web应用程序的调试和安全审计工具—Aletheia 0.1.1 发布", "url": "https://www.freebuf.com/sectool/5932.html", "time": "2012-10-16", "level": "", "num_look": 127205, "num_comment": 127205, "author": "superGoku", "tags": ["工具"], "text": ""}
{"title": "1分钟内保护你的Linux服务器—Server Shield v1.0.2", "url": "https://www.freebuf.com/sectool/5927.html", "time": "2012-10-16", "level": "", "num_look": 215244, "num_comment": 10, "author": "thanks", "tags": ["工具"], "text": ""}
{"title": "Android网络嗅探器-Pixie", "url": "https://www.freebuf.com/sectool/5930.html", "time": "2012-10-16", "level": "", "num_look": 639656, "num_comment": 8, "author": "ven0m", "tags": ["工具"], "text": ""}
{"title": "美国怀疑伊朗发起了一连串网络攻击", "url": "https://www.freebuf.com/news/5926.html", "time": "2012-10-15", "level": "", "num_look": 190672, "num_comment": 190672, "author": "9h4ck", "tags": ["资讯"], "text": ""}
{"title": "内网(域)渗透之常见命令(续)", "url": "https://www.freebuf.com/articles/web/5901.html", "time": "2012-10-15", "level": "", "num_look": 1174172, "num_comment": 22, "author": "Gall", "tags": ["WEB安全"], "text": ""}
{"title": "通过HTTP参数污染绕过WAF拦截", "url": "https://www.freebuf.com/articles/web/5908.html", "time": "2012-10-15", "level": "", "num_look": 650379, "num_comment": 21, "author": "pnig0s", "tags": ["WEB安全"], "text": ""}
{"title": "极客用计算器玩切水果(视频)", "url": "https://www.freebuf.com/geek/5918.html", "time": "2012-10-15", "level": "", "num_look": 152501, "num_comment": 7, "author": "superGoku", "tags": ["极客"], "text": ""}
{"title": "Firefox 16漏洞的攻击代码公开", "url": "https://www.freebuf.com/news/5919.html", "time": "2012-10-15", "level": "", "num_look": 97715, "num_comment": 3, "author": "scheduled", "tags": ["资讯"], "text": ""}
{"title": "PHP魔术引号导致IE XSS Filter bypass", "url": "https://www.freebuf.com/articles/web/5915.html", "time": "2012-10-15", "level": "", "num_look": 151337, "num_comment": 2, "author": "badz衰仔", "tags": ["WEB安全"], "text": ""}
{"title": "芬兰研究人员发明震动手套，戴上这只手套找商品更快", "url": "https://www.freebuf.com/geek/5913.html", "time": "2012-10-14", "level": "", "num_look": 117166, "num_comment": 5, "author": "fake", "tags": ["极客"], "text": ""}
{"title": "Mac OS-X Rootkit发布", "url": "https://www.freebuf.com/sectool/5906.html", "time": "2012-10-13", "level": "", "num_look": 203893, "num_comment": 5, "author": "冷锋", "tags": ["工具"], "text": ""}
{"title": "黑客破解NFC公交卡，可无限次乘车", "url": "https://www.freebuf.com/articles/wireless/5903.html", "time": "2012-10-13", "level": "", "num_look": 1147504, "num_comment": 17, "author": "phper", "tags": ["无线安全", "终端安全"], "text": ""}
{"title": "360搜集隐私程序员级分析，供方舟子及大众参考", "url": "https://www.freebuf.com/articles/terminal/5900.html", "time": "2012-10-12", "level": "", "num_look": 286185, "num_comment": 26, "author": "匿名用户", "tags": ["终端安全"], "text": ""}
{"title": "[笔记]PHP一句话Webshell变形总结", "url": "https://www.freebuf.com/articles/web/5896.html", "time": "2012-10-12", "level": "", "num_look": 349235, "num_comment": 8, "author": "darkray", "tags": ["WEB安全"], "text": ""}
{"title": "google和yahoo爱尔兰域名遭劫持", "url": "https://www.freebuf.com/news/5897.html", "time": "2012-10-12", "level": "", "num_look": 105979, "num_comment": 5, "author": "mohit", "tags": ["资讯"], "text": ""}
{"title": "黑客利用Linux电脑在家中自酿可口啤酒(多图)", "url": "https://www.freebuf.com/geek/5893.html", "time": "2012-10-12", "level": "", "num_look": 140156, "num_comment": 7, "author": "cnbeta", "tags": ["极客"], "text": ""}
{"title": "第二届Pwnium大赛：少年黑客攻陷Chrome将获巨奖", "url": "https://www.freebuf.com/news/5889.html", "time": "2012-10-11", "level": "", "num_look": 128664, "num_comment": 7, "author": "hit", "tags": ["资讯"], "text": ""}
{"title": "方舟子论剑网络数据安全", "url": "https://www.freebuf.com/news/5887.html", "time": "2012-10-11", "level": "", "num_look": 142989, "num_comment": 5, "author": "sunshineg", "tags": ["资讯"], "text": ""}
{"title": "Metasploit与Powershell", "url": "https://www.freebuf.com/articles/system/5884.html", "time": "2012-10-11", "level": "", "num_look": 412017, "num_comment": 16, "author": "luke", "tags": ["系统安全"], "text": ""}
{"title": "苹果IOS默认SSH密码Exploit", "url": "https://www.freebuf.com/articles/wireless/5882.html", "time": "2012-10-11", "level": "", "num_look": 336369, "num_comment": 4, "author": "lotte", "tags": ["无线安全", "终端安全"], "text": ""}
{"title": "Exploit防御工具—ExploitShield Browser Edition v0.7 released", "url": "https://www.freebuf.com/sectool/5876.html", "time": "2012-10-11", "level": "", "num_look": 135003, "num_comment": 1, "author": "微笑刺客", "tags": ["工具"], "text": ""}
{"title": "绕过htaccess的限制工具-HTExploit", "url": "https://www.freebuf.com/sectool/5879.html", "time": "2012-10-11", "level": "", "num_look": 187916, "num_comment": 9, "author": "杀戮", "tags": ["工具"], "text": ""}
{"title": "马来西亚HITB安全大会现场照", "url": "https://www.freebuf.com/news/5881.html", "time": "2012-10-11", "level": "", "num_look": 119979, "num_comment": 3, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "利用HTML5全屏API进行钓鱼攻击", "url": "https://www.freebuf.com/articles/web/5878.html", "time": "2012-10-11", "level": "", "num_look": 212464, "num_comment": 4, "author": "why", "tags": ["WEB安全"], "text": ""}
{"title": "日本女程序员通过Github寻找男性伴侣", "url": "https://www.freebuf.com/news/5872.html", "time": "2012-10-10", "level": "", "num_look": 263963, "num_comment": 17, "author": "phper", "tags": ["其他", "周边"], "text": ""}
{"title": "iO平台游戏安全再议之八门神器内存修改，IAP Free游戏内购破解的防御", "url": "https://www.freebuf.com/articles/wireless/5867.html", "time": "2012-10-10", "level": "", "num_look": 442075, "num_comment": 22, "author": "碳基体", "tags": ["无线安全"], "text": ""}
{"title": "漏洞允许跟踪3G网络中任意一部手机", "url": "https://www.freebuf.com/news/5874.html", "time": "2012-10-10", "level": "", "num_look": 109314, "num_comment": 1, "author": "无敌最寂寞", "tags": ["资讯"], "text": ""}
{"title": "Cisco CallManager暴力破解漏洞", "url": "https://www.freebuf.com/vuls/5868.html", "time": "2012-10-09", "level": "", "num_look": 158452, "num_comment": 3, "author": "gap3d", "tags": ["漏洞"], "text": ""}
{"title": "能够提醒前方障碍物的钢盔出炉，从此不怕赶夜路（图）", "url": "https://www.freebuf.com/geek/5862.html", "time": "2012-10-09", "level": "", "num_look": 113072, "num_comment": 4, "author": "丁丁", "tags": ["极客"], "text": ""}
{"title": "思科终止与中兴的战略合作", "url": "https://www.freebuf.com/news/5865.html", "time": "2012-10-09", "level": "", "num_look": 98008, "num_comment": 98008, "author": "Est", "tags": ["资讯"], "text": ""}
{"title": "渗透测试框架（WIN）—winAUTOPWN v3.2 Released", "url": "https://www.freebuf.com/sectool/5860.html", "time": "2012-10-09", "level": "", "num_look": 189190, "num_comment": 10, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "Android网络渗透套件—dSploit", "url": "https://www.freebuf.com/sectool/5858.html", "time": "2012-10-09", "level": "", "num_look": 337313, "num_comment": 16, "author": "jobs", "tags": ["工具", "无线安全"], "text": ""}
{"title": "渗透测试报告生成工具-MagicTree", "url": "https://www.freebuf.com/sectool/5842.html", "time": "2012-10-09", "level": "", "num_look": 230574, "num_comment": 3, "author": "unshell", "tags": ["工具"], "text": ""}
{"title": "北京地铁的电视系统疑似被黑-显示“王鹏你妹”", "url": "https://www.freebuf.com/news/5854.html", "time": "2012-10-08", "level": "", "num_look": 133672, "num_comment": 8, "author": "t0", "tags": ["资讯"], "text": ""}
{"title": "美国会认定华为与中兴威胁美国国家安全", "url": "https://www.freebuf.com/news/5850.html", "time": "2012-10-08", "level": "", "num_look": 124328, "num_comment": 4, "author": "jly@12", "tags": ["资讯"], "text": ""}
{"title": "[视频]黑客攻击魔兽世界，整座城市遭摧毁", "url": "https://www.freebuf.com/news/5849.html", "time": "2012-10-08", "level": "", "num_look": 135535, "num_comment": 5, "author": "Ron Jones", "tags": ["资讯"], "text": ""}
{"title": "[工具]The Social-Engineer Toolkit V4.1发布", "url": "https://www.freebuf.com/sectool/5847.html", "time": "2012-10-08", "level": "", "num_look": 267201, "num_comment": 9, "author": "G.r0b1n", "tags": ["工具"], "text": ""}
{"title": "[八卦周边]美国色情搜索引擎Search.xxx上线，很黄很暴力？", "url": "https://www.freebuf.com/news/5836.html", "time": "2012-09-29", "level": "", "num_look": 1819806, "num_comment": 27, "author": "童童", "tags": ["资讯"], "text": ""}
{"title": "极客折叠自行车 可一键展开或折叠（图）", "url": "https://www.freebuf.com/geek/5831.html", "time": "2012-09-29", "level": "", "num_look": 238782, "num_comment": 6, "author": "fu4k", "tags": ["极客"], "text": ""}
{"title": "iphone渗透测试框架—AppSec Labs iNalyzer", "url": "https://www.freebuf.com/sectool/5826.html", "time": "2012-09-29", "level": "", "num_look": 228058, "num_comment": 12, "author": "jobs", "tags": ["工具"], "text": ""}
{"title": "网络安全的领航上市公司—启明星辰诚邀大家加入", "url": "https://www.freebuf.com/jobs/5823.html", "time": "2012-09-29", "level": "", "num_look": 143652, "num_comment": 11, "author": "xiaohiehie", "tags": ["安全招聘"], "text": ""}
{"title": "Adobe发布公告，签名证书遭恶意盗用", "url": "https://www.freebuf.com/news/5824.html", "time": "2012-09-29", "level": "", "num_look": 110587, "num_comment": 110587, "author": "jas0n", "tags": ["资讯"], "text": ""}
{"title": "FBI用蜜罐抓住试图为军方购买敏感材料的中国商人", "url": "https://www.freebuf.com/news/5821.html", "time": "2012-09-28", "level": "", "num_look": 133869, "num_comment": 15, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "ERP专用渗透测试框架SAP Bizploit v1.50", "url": "https://www.freebuf.com/sectool/5820.html", "time": "2012-09-28", "level": "", "num_look": 169576, "num_comment": 2, "author": "phper", "tags": ["工具"], "text": ""}
{"title": "程序员十大谎言", "url": "https://www.freebuf.com/articles/others-articles/5819.html", "time": "2012-09-28", "level": "", "num_look": 110891, "num_comment": 6, "author": "k3", "tags": ["其他"], "text": ""}
{"title": "虚拟现实眼镜Oculus Rift明年1月发售（图+视频）", "url": "https://www.freebuf.com/news/5817.html", "time": "2012-09-28", "level": "", "num_look": 106201, "num_comment": 2, "author": "匿名用户", "tags": ["极客", "资讯"], "text": ""}
{"title": "日立新技术：一小片玻璃就可永久存储数据", "url": "https://www.freebuf.com/news/5814.html", "time": "2012-09-28", "level": "", "num_look": 122826, "num_comment": 8, "author": "k3", "tags": ["极客", "资讯"], "text": ""}
{"title": "Telvent受攻击，能源部堪忧", "url": "https://www.freebuf.com/news/5808.html", "time": "2012-09-27", "level": "", "num_look": 174534, "num_comment": 6, "author": "jly@12", "tags": ["资讯"], "text": ""}
{"title": "DOM-based XSS扫描工具-Ra.2发布", "url": "https://www.freebuf.com/sectool/5804.html", "time": "2012-09-27", "level": "", "num_look": 305039, "num_comment": 1, "author": "k3", "tags": ["工具"], "text": ""}
{"title": "Samba 0day(CVE-2012-1182)分析及利用", "url": "https://www.freebuf.com/vuls/5802.html", "time": "2012-09-27", "level": "", "num_look": 287862, "num_comment": 12, "author": "Crow", "tags": ["漏洞"], "text": ""}
{"title": "[分析]研究人员重置交通卡数据搭乘免费火车之重置攻击", "url": "https://www.freebuf.com/articles/terminal/5801.html", "time": "2012-09-27", "level": "", "num_look": 229794, "num_comment": 3, "author": "radiowar", "tags": ["极客", "终端安全"], "text": ""}
{"title": "再探内网（域）渗透", "url": "https://www.freebuf.com/articles/web/5783.html", "time": "2012-09-26", "level": "", "num_look": 795801, "num_comment": 42, "author": "Gall", "tags": ["WEB安全"], "text": ""}
{"title": "研究人员发现针对Win8的新型内核级漏洞", "url": "https://www.freebuf.com/news/5792.html", "time": "2012-09-26", "level": "", "num_look": 128279, "num_comment": 4, "author": "G.r0b1n", "tags": ["资讯"], "text": ""}
{"title": "Havij v1.16 Pro Cracked（9.27更新警告）", "url": "https://www.freebuf.com/sectool/5796.html", "time": "2012-09-26", "level": "", "num_look": 349160, "num_comment": 28, "author": "coolice", "tags": ["工具"], "text": ""}
{"title": "研究人员重置交通卡数据搭乘免费火车", "url": "https://www.freebuf.com/news/5788.html", "time": "2012-09-25", "level": "", "num_look": 132673, "num_comment": 2, "author": "tran", "tags": ["资讯"], "text": ""}
{"title": "世界上第一家3D打印机零售店成立", "url": "https://www.freebuf.com/geek/5784.html", "time": "2012-09-25", "level": "", "num_look": 126392, "num_comment": 2, "author": "SuperGoku", "tags": ["极客"], "text": ""}
{"title": "[好书推荐]《黑客大曝光7 - 网络安全机密与解决方案》发布", "url": "https://www.freebuf.com/news/5782.html", "time": "2012-09-25", "level": "", "num_look": 324878, "num_comment": 22, "author": "G.r0b1n", "tags": ["其他", "周边"], "text": ""}
{"title": "怎样获得第一份渗透测试工作", "url": "https://www.freebuf.com/articles/others-articles/5771.html", "time": "2012-09-25", "level": "", "num_look": 823072, "num_comment": 31, "author": "pnig0s", "tags": ["其他"], "text": ""}
{"title": "约900万台计算机感染zeroaccess木马", "url": "https://www.freebuf.com/news/5776.html", "time": "2012-09-25", "level": "", "num_look": 147095, "num_comment": 8, "author": "KUMAR", "tags": ["资讯"], "text": ""}
{"title": "同样的Exploit，iPhone 5也被黑", "url": "https://www.freebuf.com/news/5764.html", "time": "2012-09-24", "level": "", "num_look": 115614, "num_comment": 6, "author": "jobs", "tags": ["资讯"], "text": ""}
{"title": "黑客已经成功将iOS5上的谷歌地图移植到iOS6", "url": "https://www.freebuf.com/news/5763.html", "time": "2012-09-24", "level": "", "num_look": 97931, "num_comment": 97931, "author": "apple", "tags": ["资讯"], "text": ""}
{"title": "浅谈Android软件安全自动化审计", "url": "https://www.freebuf.com/articles/wireless/5761.html", "time": "2012-09-24", "level": "", "num_look": 268013, "num_comment": 4, "author": "腾讯安全平台部", "tags": ["无线安全"], "text": ""}
{"title": "[更新]渗透测试脚本-discover", "url": "https://www.freebuf.com/sectool/5759.html", "time": "2012-09-24", "level": "", "num_look": 266415, "num_comment": 7, "author": "script", "tags": ["工具"], "text": ""}
{"title": "利用patator进行子域名爆破", "url": "https://www.freebuf.com/sectool/5750.html", "time": "2012-09-23", "level": "", "num_look": 288276, "num_comment": 12, "author": "无名", "tags": ["工具"], "text": ""}
{"title": "部分版本Oracle数据库存在暴力破解漏洞", "url": "https://www.freebuf.com/vuls/5746.html", "time": "2012-09-22", "level": "", "num_look": 279313, "num_comment": 6, "author": "phper", "tags": ["漏洞"], "text": ""}
{"title": "苹果iPhone 5预定爆严重漏洞，预约大量被取消", "url": "https://www.freebuf.com/news/5745.html", "time": "2012-09-21", "level": "", "num_look": 121114, "num_comment": 2, "author": "G.r0b1n", "tags": ["资讯"], "text": ""}
{"title": "密码破解工具，John the Ripper 1.7.9-jumbo-7发布", "url": "https://www.freebuf.com/sectool/5744.html", "time": "2012-09-21", "level": "", "num_look": 258411, "num_comment": 4, "author": "kay", "tags": ["工具"], "text": ""}
{"title": "Rapid7 MySQL身份认证绕过漏洞检查工具—ScanNow", "url": "https://www.freebuf.com/sectool/5742.html", "time": "2012-09-21", "level": "", "num_look": 205099, "num_comment": 7, "author": "rapid7", "tags": ["工具"], "text": ""}
{"title": "[更新]GUI界面文件信息取证分析工具-FileInfo V6.0", "url": "https://www.freebuf.com/sectool/5740.html", "time": "2012-09-21", "level": "", "num_look": 159070, "num_comment": 159070, "author": "apple", "tags": ["工具"], "text": ""}
{"title": "Java 0day简略分析", "url": "https://www.freebuf.com/articles/web/5732.html", "time": "2012-09-21", "level": "", "num_look": 206126, "num_comment": 4, "author": "h4ckmp", "tags": ["WEB安全"], "text": ""}
{"title": "两支黑客团队成功攻陷iPhone 4S以及Galaxy S3", "url": "https://www.freebuf.com/news/5739.html", "time": "2012-09-21", "level": "", "num_look": 111393, "num_comment": 5, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "杀毒软件将自己识别为恶意程序", "url": "https://www.freebuf.com/news/5733.html", "time": "2012-09-21", "level": "", "num_look": 114054, "num_comment": 2, "author": "fanze", "tags": ["资讯"], "text": ""}
{"title": "伊朗清真局域网准备就绪", "url": "https://www.freebuf.com/news/5729.html", "time": "2012-09-20", "level": "", "num_look": 126480, "num_comment": 4, "author": "t0", "tags": ["资讯"], "text": ""}
{"title": "分享RSA大会的《分享为协同攻击分析的威胁智能分析》议题", "url": "https://www.freebuf.com/articles/others-articles/5705.html", "time": "2012-09-20", "level": "", "num_look": 129241, "num_comment": 3, "author": "G.r0b1n", "tags": ["其他"], "text": ""}
{"title": "最新IE远程代码执行漏洞分析", "url": "https://www.freebuf.com/articles/web/5719.html", "time": "2012-09-20", "level": "", "num_look": 231018, "num_comment": 7, "author": "h4ckmp", "tags": ["WEB安全"], "text": ""}
{"title": "12306 辅助登录小工具 – 帮你登陆火车票订票网站", "url": "https://www.freebuf.com/sectool/5725.html", "time": "2012-09-20", "level": "", "num_look": 208668, "num_comment": 5, "author": "Live", "tags": ["工具"], "text": ""}
{"title": "Adobe Flash Player远程代码执行漏洞分析（CVE-2012-1535）", "url": "https://www.freebuf.com/articles/web/5708.html", "time": "2012-09-20", "level": "", "num_look": 279286, "num_comment": 2, "author": "h4ckmp", "tags": ["WEB安全"], "text": ""}
{"title": "国外大牛人肉定向攻击远控PlugX开发者全过程分析", "url": "https://www.freebuf.com/articles/others-articles/5718.html", "time": "2012-09-20", "level": "", "num_look": 717915, "num_comment": 22, "author": "cs24", "tags": ["其他"], "text": ""}
{"title": "欧洲著名安全会议Eusecwest即将开幕", "url": "https://www.freebuf.com/news/5706.html", "time": "2012-09-20", "level": "", "num_look": 140400, "num_comment": 8, "author": "tobe", "tags": ["资讯"], "text": ""}
{"title": "WEB安全扫描工具-NIkto 2.1.5发布", "url": "https://www.freebuf.com/sectool/5701.html", "time": "2012-09-19", "level": "", "num_look": 400588, "num_comment": 9, "author": "7dscan-sm", "tags": ["工具"], "text": ""}
{"title": "Defcon20议题资料下载", "url": "https://www.freebuf.com/news/5692.html", "time": "2012-09-19", "level": "", "num_look": 163427, "num_comment": 4, "author": "G.r0b1n", "tags": ["其他", "周边"], "text": ""}
{"title": "从海水中提取铀", "url": "https://www.freebuf.com/news/5704.html", "time": "2012-09-19", "level": "", "num_look": 169044, "num_comment": 5, "author": "dom0", "tags": ["极客", "资讯"], "text": ""}
{"title": "俄罗斯自动攻击工具Black Hole更新v2.0版", "url": "https://www.freebuf.com/news/5678.html", "time": "2012-09-19", "level": "", "num_look": 248666, "num_comment": 9, "author": "匿名用户", "tags": ["周边", "工具"], "text": ""}
{"title": "[0day]最新IE远程代码执行漏洞Exploit", "url": "https://www.freebuf.com/articles/web/5699.html", "time": "2012-09-19", "level": "", "num_look": 394321, "num_comment": 28, "author": "dandan", "tags": ["WEB安全"], "text": ""}
{"title": "开源web漏洞扫描系统-IronWASP V0.9.1.4", "url": "https://www.freebuf.com/sectool/5679.html", "time": "2012-09-18", "level": "", "num_look": 210588, "num_comment": 1, "author": "Package", "tags": ["工具"], "text": ""}
{"title": "RFID消费终端设备安全风险之某高卡破解剖析", "url": "https://www.freebuf.com/articles/terminal/5682.html", "time": "2012-09-18", "level": "", "num_look": 274566, "num_comment": 15, "author": "radiowar", "tags": ["极客", "终端安全"], "text": ""}
{"title": "蘑菇街招聘资深网络安全攻城师", "url": "https://www.freebuf.com/jobs/5687.html", "time": "2012-09-18", "level": "", "num_look": 174778, "num_comment": 21, "author": "kevin8307", "tags": ["安全招聘"], "text": ""}
{"title": "语音命令崩溃银行电话线", "url": "https://www.freebuf.com/news/5685.html", "time": "2012-09-18", "level": "", "num_look": 92945, "num_comment": 1, "author": "phper", "tags": ["资讯"], "text": ""}
{"title": "聪明电脑压力感应垫—用以缓解用户压力", "url": "https://www.freebuf.com/geek/5683.html", "time": "2012-09-18", "level": "", "num_look": 120735, "num_comment": 2, "author": "batman", "tags": ["极客"], "text": ""}
{"title": "世界上第一个NFC超市将在巴黎开放", "url": "https://www.freebuf.com/geek/5681.html", "time": "2012-09-18", "level": "", "num_look": 163146, "num_comment": 1, "author": "yktworld", "tags": ["极客"], "text": ""}
{"title": "PkavProxyPro商业扫描器通用破解程序", "url": "https://www.freebuf.com/articles/web/5676.html", "time": "2012-09-17", "level": "", "num_look": 275056, "num_comment": 6, "author": "only_guest", "tags": ["WEB安全"], "text": ""}
{"title": "[0day]IE execCommand fuction Use after free Vulnerability 0day", "url": "https://www.freebuf.com/vuls/5675.html", "time": "2012-09-17", "level": "", "num_look": 177646, "num_comment": 177646, "author": "南京瀚海源", "tags": ["漏洞"], "text": ""}
{"title": "眼神交流缓和网络敌意", "url": "https://www.freebuf.com/geek/5673.html", "time": "2012-09-17", "level": "", "num_look": 130773, "num_comment": 3, "author": "zeroo", "tags": ["极客"], "text": ""}
{"title": "安全扫描工具NetSparker_2.3_PRO_Crack", "url": "https://www.freebuf.com/sectool/5669.html", "time": "2012-09-17", "level": "", "num_look": 318943, "num_comment": 26, "author": "only_guest", "tags": ["工具"], "text": ""}
{"title": "宝马汽车易遭空白钥匙攻击", "url": "https://www.freebuf.com/geek/5671.html", "time": "2012-09-17", "level": "", "num_look": 157393, "num_comment": 9, "author": "bbc", "tags": ["极客"], "text": ""}
{"title": "安全扫描工具skipfish-v2-09b-released（Google出品）", "url": "https://www.freebuf.com/sectool/5668.html", "time": "2012-09-17", "level": "", "num_look": 154760, "num_comment": 2, "author": "WiFiHacker", "tags": ["工具"], "text": ""}
{"title": "脑机接口技术真能破译我们的想法吗？", "url": "https://www.freebuf.com/geek/5662.html", "time": "2012-09-16", "level": "", "num_look": 116387, "num_comment": 5, "author": "dandan", "tags": ["极客"], "text": ""}
{"title": "Anonymous发言人Barrett Brown在家中被捕(图+视频)", "url": "https://www.freebuf.com/news/5648.html", "time": "2012-09-15", "level": "", "num_look": 125291, "num_comment": 4, "author": "fu4k", "tags": ["资讯"], "text": ""}
{"title": "针对SSL最新攻击方法CRIME的原理及技术细节", "url": "https://www.freebuf.com/articles/web/5636.html", "time": "2012-09-14", "level": "", "num_look": 519436, "num_comment": 7, "author": "pnig0s", "tags": ["WEB安全"], "text": ""}
{"title": "RSA中国2012议题整理下载(更新下载地址)", "url": "https://www.freebuf.com/news/5641.html", "time": "2012-09-14", "level": "", "num_look": 145481, "num_comment": 6, "author": "G.r0b1n", "tags": ["其他", "周边"], "text": ""}
{"title": "使用Android手机驱逐Wifi内的任意IP—WiFiKill", "url": "https://www.freebuf.com/articles/5638.html", "time": "2012-09-14", "level": "", "num_look": 577531, "num_comment": 12, "author": "WiFiHacker", "tags": ["工具", "文章"], "text": ""}
{"title": "Metasploit自动攻击和选择模块攻击详解", "url": "https://www.freebuf.com/articles/web/5628.html", "time": "2012-09-14", "level": "", "num_look": 1917773, "num_comment": 17, "author": "魔术", "tags": ["WEB安全"], "text": ""}
{"title": "研究人员演示劫持HTTPS会话", "url": "https://www.freebuf.com/news/5627.html", "time": "2012-09-14", "level": "", "num_look": 156692, "num_comment": 5, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "Web应用漏洞fuzz工具 - teenage mutant ninja turtles V 1.5", "url": "https://www.freebuf.com/sectool/5623.html", "time": "2012-09-13", "level": "", "num_look": 414873, "num_comment": 16, "author": "open", "tags": ["工具"], "text": ""}
{"title": "RadioWar发布NFC-War预览版(含视频)", "url": "https://www.freebuf.com/geek/5615.html", "time": "2012-09-13", "level": "", "num_look": 389370, "num_comment": 22, "author": "tobe", "tags": ["极客"], "text": ""}
{"title": "IT男专用电路板伦敦地铁图(多图)", "url": "https://www.freebuf.com/geek/5614.html", "time": "2012-09-13", "level": "", "num_look": 117357, "num_comment": 2, "author": "parkour", "tags": ["极客"], "text": ""}
{"title": "XSS Exploit框架 - Xenotix", "url": "https://www.freebuf.com/sectool/5609.html", "time": "2012-09-13", "level": "", "num_look": 229665, "num_comment": 5, "author": "WinD", "tags": ["工具"], "text": ""}
{"title": "教你用十二行代码写出世界一流大学的选课系统", "url": "https://www.freebuf.com/articles/others-articles/5610.html", "time": "2012-09-12", "level": "", "num_look": 259763, "num_comment": 41, "author": "Master", "tags": ["其他"], "text": ""}
{"title": "新型远程控制工具Plugx正在被利用并通过钓鱼攻击日本政府", "url": "https://www.freebuf.com/news/5607.html", "time": "2012-09-12", "level": "", "num_look": 236554, "num_comment": 11, "author": "yuange", "tags": ["资讯"], "text": ""}
{"title": "Hash破解工具John the Ripper​ GUI—John Of yogyafree", "url": "https://www.freebuf.com/sectool/5605.html", "time": "2012-09-12", "level": "", "num_look": 362642, "num_comment": 5, "author": "xsser", "tags": ["工具"], "text": ""}
{"title": "[更新]HTTP Dos攻击压力测试工具-Slowhttptest 1.5", "url": "https://www.freebuf.com/sectool/5599.html", "time": "2012-09-12", "level": "", "num_look": 858418, "num_comment": 9, "author": "flowing", "tags": ["工具"], "text": ""}
{"title": "UGNazi覆灭-黑客Cosmo坠落地球", "url": "https://www.freebuf.com/news/5601.html", "time": "2012-09-12", "level": "", "num_look": 118032, "num_comment": 4, "author": "bytea", "tags": ["资讯"], "text": ""}
{"title": "Anonymous攻击GoDaddy 影响百万网站", "url": "https://www.freebuf.com/news/5597.html", "time": "2012-09-11", "level": "", "num_look": 97708, "num_comment": 4, "author": "unicorn", "tags": ["资讯"], "text": ""}
{"title": "RSA China 2012议题之《亚洲网络犯罪趋势》", "url": "https://www.freebuf.com/articles/web/5591.html", "time": "2012-09-11", "level": "", "num_look": 135068, "num_comment": 3, "author": "G.r0b1n", "tags": ["WEB安全"], "text": ""}
{"title": "手网QQ2012大盗亦有道后门分析与VIP破解", "url": "https://www.freebuf.com/articles/others-articles/5587.html", "time": "2012-09-11", "level": "", "num_look": 188021, "num_comment": 14, "author": "beibei", "tags": ["其他"], "text": ""}
{"title": "蹭不加密WIFI不属于窃听", "url": "https://www.freebuf.com/news/5590.html", "time": "2012-09-11", "level": "", "num_look": 123081, "num_comment": 1, "author": "gooooogle", "tags": ["资讯"], "text": ""}
{"title": "微信任意用户密码修改漏洞分析", "url": "https://www.freebuf.com/articles/web/5584.html", "time": "2012-09-10", "level": "", "num_look": 467949, "num_comment": 36, "author": "only_guest", "tags": ["WEB安全"], "text": ""}
{"title": "新型HTTPS Session劫持攻击—CRIME", "url": "https://www.freebuf.com/articles/system/5585.html", "time": "2012-09-10", "level": "", "num_look": 243194, "num_comment": 3, "author": "DemonHunter", "tags": ["系统安全"], "text": ""}
{"title": "Android安全评估框架—Mercury v1.1 Released", "url": "https://www.freebuf.com/sectool/5579.html", "time": "2012-09-08", "level": "", "num_look": 247011, "num_comment": 2, "author": "fu4k", "tags": ["工具", "无线安全"], "text": ""}
{"title": "[更新]网络入侵检测系统-Suricata 1.4 beta1 发布", "url": "https://www.freebuf.com/sectool/5576.html", "time": "2012-09-07", "level": "", "num_look": 162801, "num_comment": 1, "author": "open", "tags": ["工具"], "text": ""}
{"title": "国内部分厂商接收漏洞报告的邮箱地址及联系方式", "url": "https://www.freebuf.com/news/5567.html", "time": "2012-09-07", "level": "", "num_look": 224618, "num_comment": 9, "author": "tobe", "tags": ["其他", "周边"], "text": ""}
{"title": "RSA2012议题之《SSRF：针对关键业务应用的新威胁》", "url": "https://www.freebuf.com/articles/web/5563.html", "time": "2012-09-07", "level": "", "num_look": 180344, "num_comment": 3, "author": "G.r0b1n", "tags": ["WEB安全"], "text": ""}
{"title": "[视频]美猎豹机器人平均100米奔跑速度超越飞人博尔特", "url": "https://www.freebuf.com/geek/5570.html", "time": "2012-09-07", "level": "", "num_look": 146480, "num_comment": 7, "author": "ltrgoddard", "tags": ["极客"], "text": ""}
{"title": "Symantec Messaging Gateway 9.5默认SSH密码Exploit", "url": "https://www.freebuf.com/articles/web/5565.html", "time": "2012-09-06", "level": "", "num_look": 250205, "num_comment": 12, "author": "howard", "tags": ["WEB安全"], "text": ""}
{"title": "BurpSuite教程与技巧之SQL Injection", "url": "https://www.freebuf.com/articles/5560.html", "time": "2012-09-06", "level": "", "num_look": 756423, "num_comment": 17, "author": "Gall", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "变种Pushdo僵尸网络重出江湖", "url": "https://www.freebuf.com/news/5562.html", "time": "2012-09-06", "level": "", "num_look": 124088, "num_comment": 1, "author": "jly@12", "tags": ["资讯"], "text": ""}
{"title": "新型恶意勒索软件正在崛起", "url": "https://www.freebuf.com/news/5557.html", "time": "2012-09-06", "level": "", "num_look": 106215, "num_comment": 2, "author": "jly@12", "tags": ["资讯"], "text": ""}
{"title": "通过玩游戏记密码", "url": "https://www.freebuf.com/news/5561.html", "time": "2012-09-06", "level": "", "num_look": 105537, "num_comment": 2, "author": "Jose", "tags": ["资讯"], "text": ""}
{"title": "让人抓狂的代码", "url": "https://www.freebuf.com/articles/others-articles/5558.html", "time": "2012-09-05", "level": "", "num_look": 144006, "num_comment": 12, "author": "cwk", "tags": ["其他"], "text": ""}
{"title": "利用智能手机摄像头进行静脉认证", "url": "https://www.freebuf.com/geek/5555.html", "time": "2012-09-05", "level": "", "num_look": 146744, "num_comment": 2, "author": "Matthew Humphries", "tags": ["极客"], "text": ""}
{"title": "SQL注入检测神器Netsparker CE 2.3 released", "url": "https://www.freebuf.com/sectool/5552.html", "time": "2012-09-05", "level": "", "num_look": 303058, "num_comment": 31, "author": "batman", "tags": ["工具"], "text": ""}
{"title": "最新 Java 漏洞攻击以微软通知做诱饵", "url": "https://www.freebuf.com/news/5556.html", "time": "2012-09-05", "level": "", "num_look": 94417, "num_comment": 2, "author": "xuzhe5219", "tags": ["资讯"], "text": ""}
{"title": "[更新]网络安全扫描工具-Skipfish v2.09b", "url": "https://www.freebuf.com/sectool/5553.html", "time": "2012-09-05", "level": "", "num_look": 181437, "num_comment": 3, "author": "promagazine", "tags": ["工具"], "text": ""}
{"title": "[揭秘]Anonymous从FBI处窃取1200万Apple ID号全过程", "url": "https://www.freebuf.com/news/5551.html", "time": "2012-09-04", "level": "", "num_look": 135598, "num_comment": 12, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "绝对安全！俄罗斯军方研发出超级安全的Android 系统", "url": "https://www.freebuf.com/news/5550.html", "time": "2012-09-04", "level": "", "num_look": 108431, "num_comment": 4, "author": "unicorn", "tags": ["资讯"], "text": ""}
{"title": "丰田前雇员非法入侵其供应商门户网站", "url": "https://www.freebuf.com/news/5519.html", "time": "2012-09-04", "level": "", "num_look": 96136, "num_comment": 1, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "伊朗和朝鲜合作对抗国家资助的恶意程序攻击", "url": "https://www.freebuf.com/news/5549.html", "time": "2012-09-04", "level": "", "num_look": 108847, "num_comment": 4, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "Android恶意软件分析", "url": "https://www.freebuf.com/articles/terminal/5524.html", "time": "2012-09-04", "level": "", "num_look": 354883, "num_comment": 15, "author": "cs24", "tags": ["终端安全"], "text": ""}
{"title": "非洲人革命性的智能手机应用-艾滋病现场测试工具", "url": "https://www.freebuf.com/geek/5546.html", "time": "2012-09-04", "level": "", "num_look": 107043, "num_comment": 1, "author": "匿名用户", "tags": ["极客"], "text": ""}
{"title": "freebuf安全周刊8月27日-9月2日", "url": "https://www.freebuf.com/news/5545.html", "time": "2012-09-03", "level": "", "num_look": 110759, "num_comment": 110759, "author": "root", "tags": ["周边", "资讯"], "text": ""}
{"title": "[快讯]Sony再成黑客目标，sonymobile被攻陷", "url": "https://www.freebuf.com/news/5520.html", "time": "2012-09-03", "level": "", "num_look": 120572, "num_comment": 4, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "Freebuf开通官方微信", "url": "https://www.freebuf.com/news/5517.html", "time": "2012-09-03", "level": "", "num_look": 161537, "num_comment": 5, "author": "root", "tags": ["周边", "活动"], "text": ""}
{"title": "利用号码段分析数字公司老总号码", "url": "https://www.freebuf.com/articles/others-articles/5512.html", "time": "2012-09-03", "level": "", "num_look": 201979, "num_comment": 12, "author": "zeracker", "tags": ["其他"], "text": ""}
{"title": "RSA2012参会感想：Scada工控安全审计工具ScadaScan", "url": "https://www.freebuf.com/sectool/5503.html", "time": "2012-09-03", "level": "", "num_look": 201977, "num_comment": 6, "author": "G.r0b1n", "tags": ["工具", "工控安全"], "text": ""}
{"title": "如果能复活已灭绝的物种，我们是否该付诸实施？", "url": "https://www.freebuf.com/geek/5513.html", "time": "2012-09-02", "level": "", "num_look": 178493, "num_comment": 2, "author": "匿名用户", "tags": ["极客"], "text": ""}
{"title": "Ubuntu下安装BeEF", "url": "https://www.freebuf.com/articles/web/5511.html", "time": "2012-09-02", "level": "", "num_look": 832598, "num_comment": 22, "author": "魔术", "tags": ["WEB安全"], "text": ""}
{"title": "无线感应标签—方便地跟踪和寻找物品", "url": "https://www.freebuf.com/geek/5510.html", "time": "2012-09-01", "level": "", "num_look": 109447, "num_comment": 2, "author": "匿名用户", "tags": ["极客"], "text": ""}
{"title": "Windows主机IDS—Patriot NG 2.01", "url": "https://www.freebuf.com/sectool/5508.html", "time": "2012-09-01", "level": "", "num_look": 165242, "num_comment": 3, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "如何从按键音中听出360总裁周鸿祎的手机号码", "url": "https://www.freebuf.com/geek/5507.html", "time": "2012-08-31", "level": "", "num_look": 155229, "num_comment": 11, "author": "匿名用户", "tags": ["极客"], "text": ""}
{"title": "剑桥大学被黑，黑客组织NullCrew要求释放阿桑奇", "url": "https://www.freebuf.com/news/5506.html", "time": "2012-08-31", "level": "", "num_look": 188324, "num_comment": 8, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "社会工程学工具集Social-Engineer Toolkit (SET) v3.7.1发布", "url": "https://www.freebuf.com/sectool/5504.html", "time": "2012-08-30", "level": "", "num_look": 179765, "num_comment": 5, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "Lulzsec全军覆没-最后一名成员被捕", "url": "https://www.freebuf.com/news/5502.html", "time": "2012-08-30", "level": "", "num_look": 235446, "num_comment": 9, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "首个Linux、Mac OS X的跨平台病毒被发现", "url": "https://www.freebuf.com/news/5500.html", "time": "2012-08-30", "level": "", "num_look": 146664, "num_comment": 11, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "HTML5风险TOP10", "url": "https://www.freebuf.com/articles/web/5494.html", "time": "2012-08-29", "level": "", "num_look": 159905, "num_comment": 3, "author": "dongyuedy", "tags": ["WEB安全"], "text": ""}
{"title": "“读心术”崛起：通过这个299美元的硬件，科学家可以找出你的Pin码，你住在哪…", "url": "https://www.freebuf.com/geek/5495.html", "time": "2012-08-28", "level": "", "num_look": 108758, "num_comment": 3, "author": "匿名用户", "tags": ["极客"], "text": ""}
{"title": "匿名组织攻击电子元件公司AVX", "url": "https://www.freebuf.com/news/5490.html", "time": "2012-08-28", "level": "", "num_look": 117848, "num_comment": 3, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "从现实中的案例关注RFID消费终端安全风险", "url": "https://www.freebuf.com/articles/terminal/5473.html", "time": "2012-08-28", "level": "", "num_look": 165304, "num_comment": 9, "author": "radiowar", "tags": ["终端安全"], "text": ""}
{"title": "研究人员将声纹变成密码", "url": "https://www.freebuf.com/news/5489.html", "time": "2012-08-28", "level": "", "num_look": 139756, "num_comment": 139756, "author": "匿名用户", "tags": ["极客", "资讯"], "text": ""}
{"title": "最新Java 0day漏洞分析及EXP下载(CVE-2012-4681)", "url": "https://www.freebuf.com/vuls/5485.html", "time": "2012-08-27", "level": "", "num_look": 374259, "num_comment": 29, "author": "匿名用户", "tags": ["漏洞"], "text": ""}
{"title": "黑客公布上万条，银行和政治家记录", "url": "https://www.freebuf.com/news/5484.html", "time": "2012-08-27", "level": "", "num_look": 203025, "num_comment": 14, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "浅谈开放式风险评估系统OpenVAS", "url": "https://www.freebuf.com/articles/5474.html", "time": "2012-08-27", "level": "", "num_look": 536513, "num_comment": 22, "author": "dongyuedy", "tags": ["文章", "系统安全"], "text": ""}
{"title": "WebCruiser Web Vulnerability Scanner iPhone&iPad版", "url": "https://www.freebuf.com/sectool/5483.html", "time": "2012-08-27", "level": "", "num_look": 219743, "num_comment": 2, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "路由器密码破解工具-Kracker", "url": "https://www.freebuf.com/sectool/5481.html", "time": "2012-08-27", "level": "", "num_look": 696557, "num_comment": 14, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "w3af简单使用教程", "url": "https://www.freebuf.com/articles/5472.html", "time": "2012-08-25", "level": "", "num_look": 1710176, "num_comment": 6, "author": "line", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "Android开源安全评估框架-ASEF", "url": "https://www.freebuf.com/sectool/5470.html", "time": "2012-08-24", "level": "", "num_look": 172153, "num_comment": 3, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "科学家造出新型神器-蠕虫型机器人[视频]", "url": "https://www.freebuf.com/news/5469.html", "time": "2012-08-24", "level": "", "num_look": 430187, "num_comment": 10, "author": "hc360", "tags": ["极客", "资讯"], "text": ""}
{"title": "世界上最大的石油公司Saudi Aramco遭受致命攻击", "url": "https://www.freebuf.com/news/5468.html", "time": "2012-08-24", "level": "", "num_look": 144155, "num_comment": 2, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "针对能源部门的神秘恶意软件-shamoon", "url": "https://www.freebuf.com/news/5467.html", "time": "2012-08-24", "level": "", "num_look": 189969, "num_comment": 2, "author": "赛迪网", "tags": ["资讯"], "text": ""}
{"title": "JBOSS Google Hacking技巧", "url": "https://www.freebuf.com/articles/5463.html", "time": "2012-08-23", "level": "", "num_look": 241166, "num_comment": 4, "author": "匿名用户", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "研究人员首次发现Windows恶意程序感染虚拟机", "url": "https://www.freebuf.com/news/5460.html", "time": "2012-08-23", "level": "", "num_look": 121804, "num_comment": 7, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "iPhone短信欺骗漏洞披露", "url": "https://www.freebuf.com/articles/wireless/5459.html", "time": "2012-08-22", "level": "", "num_look": 279327, "num_comment": 5, "author": "radiowar", "tags": ["无线安全", "终端安全"], "text": ""}
{"title": "X-Fuzzer - 动态浏览器Fuzz工具", "url": "https://www.freebuf.com/sectool/5453.html", "time": "2012-08-22", "level": "", "num_look": 355182, "num_comment": 3, "author": "G.r0b1n", "tags": ["工具"], "text": ""}
{"title": "无线Hacking之D.O.S与AP欺骗", "url": "https://www.freebuf.com/articles/5448.html", "time": "2012-08-22", "level": "", "num_look": 585984, "num_comment": 13, "author": "Crow", "tags": ["文章", "无线安全"], "text": ""}
{"title": "中间人攻击(MITM)防御工具—Etherwall v1.0 Beta3", "url": "https://www.freebuf.com/sectool/5457.html", "time": "2012-08-22", "level": "", "num_look": 176294, "num_comment": 4, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "黑客成功提取人类大脑中敏感数据", "url": "https://www.freebuf.com/news/5454.html", "time": "2012-08-22", "level": "", "num_look": 151881, "num_comment": 7, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "r00tbeer再黑大型企业--飞利浦网站明文密码泄露", "url": "https://www.freebuf.com/news/5451.html", "time": "2012-08-21", "level": "", "num_look": 122871, "num_comment": 7, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "快速检测恶意RTF文件的POC", "url": "https://www.freebuf.com/sectool/5444.html", "time": "2012-08-21", "level": "", "num_look": 186348, "num_comment": 1, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "[图+视频]可改变颜色的硅胶机器人", "url": "https://www.freebuf.com/news/5450.html", "time": "2012-08-21", "level": "", "num_look": 115970, "num_comment": 4, "author": "匿名用户", "tags": ["极客", "资讯"], "text": ""}
{"title": "Web漏洞扫描器-UNISCAN 6.2发布", "url": "https://www.freebuf.com/sectool/5442.html", "time": "2012-08-21", "level": "", "num_look": 219159, "num_comment": 9, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "Sendrawpdu—Iphone短信欺骗工具发布下载", "url": "https://www.freebuf.com/sectool/5440.html", "time": "2012-08-21", "level": "", "num_look": 175357, "num_comment": 12, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "如果黑客控制了训练样本", "url": "https://www.freebuf.com/news/5449.html", "time": "2012-08-21", "level": "", "num_look": 96970, "num_comment": 96970, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "恶意DDOS脚本日志分析报告", "url": "https://www.freebuf.com/articles/web/5439.html", "time": "2012-08-20", "level": "", "num_look": 227568, "num_comment": 7, "author": "tobe", "tags": ["WEB安全"], "text": ""}
{"title": "freebuf安全周刊8月13日-8月19日", "url": "https://www.freebuf.com/news/others/5445.html", "time": "2012-08-20", "level": "", "num_look": 130787, "num_comment": 130787, "author": "root", "tags": ["其他", "周边"], "text": ""}
{"title": "记一次不同寻常的网站渗透测试过程，上传基于time（）", "url": "https://www.freebuf.com/articles/web/5430.html", "time": "2012-08-20", "level": "", "num_look": 190570, "num_comment": 17, "author": "xiaosan123ss", "tags": ["WEB安全"], "text": ""}
{"title": "Chrome浏览器跨站渗透测试框架—XSS ChEF v1.0", "url": "https://www.freebuf.com/sectool/5436.html", "time": "2012-08-20", "level": "", "num_look": 258313, "num_comment": 3, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "Android病毒感染50万中国手机用户及样本下载", "url": "https://www.freebuf.com/news/5435.html", "time": "2012-08-20", "level": "", "num_look": 185876, "num_comment": 8, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "AMD官方博客被黑，数据库用户数据遭泄露", "url": "https://www.freebuf.com/news/5433.html", "time": "2012-08-20", "level": "", "num_look": 242097, "num_comment": 1, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "ZAP介绍", "url": "https://www.freebuf.com/sectool/5427.html", "time": "2012-08-20", "level": "", "num_look": 1600684, "num_comment": 9, "author": "line", "tags": ["工具"], "text": ""}
{"title": "新的力量 新的方向——ISF 2012议题征集函", "url": "https://www.freebuf.com/news/others/5431.html", "time": "2012-08-19", "level": "", "num_look": 133702, "num_comment": 6, "author": "root", "tags": ["其他", "周边"], "text": ""}
{"title": "Email钓鱼测试工具包—Phemail", "url": "https://www.freebuf.com/sectool/5428.html", "time": "2012-08-19", "level": "", "num_look": 240199, "num_comment": 2, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "Anonymous为报复乌干达政府的“反同性恋法案”攻击其网站", "url": "https://www.freebuf.com/news/5423.html", "time": "2012-08-18", "level": "", "num_look": 117942, "num_comment": 3, "author": "jly@12", "tags": ["资讯"], "text": ""}
{"title": "XSS蠕虫与QQ系统消息推送双剑合璧之后", "url": "https://www.freebuf.com/articles/web/5374.html", "time": "2012-08-17", "level": "", "num_look": 245226, "num_comment": 8, "author": "only_guest", "tags": ["WEB安全"], "text": ""}
{"title": "Oracle爆错手工注入", "url": "https://www.freebuf.com/articles/web/5411.html", "time": "2012-08-17", "level": "", "num_look": 1218493, "num_comment": 12, "author": "小冰", "tags": ["WEB安全", "数据安全"], "text": ""}
{"title": "再谈无线网络数据窥探技术", "url": "https://www.freebuf.com/articles/wireless/5410.html", "time": "2012-08-17", "level": "", "num_look": 514045, "num_comment": 10, "author": "paddy", "tags": ["无线安全"], "text": ""}
{"title": "世界上最大的石油公司Saudi Aramco遭受恶意软件攻击", "url": "https://www.freebuf.com/news/5422.html", "time": "2012-08-17", "level": "", "num_look": 134473, "num_comment": 2, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "模拟电路大师Hans R. Camenzind逝世", "url": "https://www.freebuf.com/news/5409.html", "time": "2012-08-16", "level": "", "num_look": 145980, "num_comment": 4, "author": "Hans", "tags": ["资讯"], "text": ""}
{"title": "[学习资料]漏洞挖掘练习环境(linux方向)", "url": "https://www.freebuf.com/sectool/5390.html", "time": "2012-08-16", "level": "", "num_look": 383149, "num_comment": 19, "author": "cs24", "tags": ["工具"], "text": ""}
{"title": "多伦多第一届硬件黑客马拉松", "url": "https://www.freebuf.com/articles/terminal/5401.html", "time": "2012-08-16", "level": "", "num_look": 202226, "num_comment": 2, "author": "kelz", "tags": ["极客", "终端安全"], "text": ""}
{"title": "[点亮你我]Freebuf评论系统增加“亮了”功能", "url": "https://www.freebuf.com/news/others/5402.html", "time": "2012-08-16", "level": "", "num_look": 153423, "num_comment": 5, "author": "root", "tags": ["其他", "周边"], "text": ""}
{"title": "路人眼中的Defcon黑客", "url": "https://www.freebuf.com/news/5391.html", "time": "2012-08-16", "level": "", "num_look": 147847, "num_comment": 9, "author": "tobe", "tags": ["周边", "资讯"], "text": ""}
{"title": "算法能预测未来24小时你身在何处", "url": "https://www.freebuf.com/news/5394.html", "time": "2012-08-15", "level": "", "num_look": 154301, "num_comment": 5, "author": "linsk", "tags": ["极客", "资讯"], "text": ""}
{"title": "[整理]Android平台下渗透测试工具大集合", "url": "https://www.freebuf.com/sectool/5376.html", "time": "2012-08-15", "level": "", "num_look": 545759, "num_comment": 19, "author": "cs24", "tags": ["工具"], "text": ""}
{"title": "xKungFoo2012《WebService Hack》议题PPT下载", "url": "https://www.freebuf.com/news/others/5381.html", "time": "2012-08-15", "level": "", "num_look": 188212, "num_comment": 12, "author": "root", "tags": ["其他", "周边"], "text": ""}
{"title": "美国国家安全局寻求黑客帮助", "url": "https://www.freebuf.com/news/5375.html", "time": "2012-08-15", "level": "", "num_look": 114122, "num_comment": 2, "author": "jly@12", "tags": ["资讯"], "text": ""}
{"title": "QQ漂流瓶飘来的可能是愿望，也有可能是XSS！", "url": "https://www.freebuf.com/articles/web/5373.html", "time": "2012-08-15", "level": "", "num_look": 185254, "num_comment": 16, "author": "only_guest", "tags": ["WEB安全"], "text": ""}
{"title": "卡巴斯基寻民间牛人帮助破解高斯(Gauss)神秘Payload", "url": "https://www.freebuf.com/news/5378.html", "time": "2012-08-15", "level": "", "num_look": 137583, "num_comment": 7, "author": "kelz", "tags": ["资讯"], "text": ""}
{"title": "盲注（Blind SQL Injection）工具—BBQSQL v1.0.0", "url": "https://www.freebuf.com/sectool/5369.html", "time": "2012-08-14", "level": "", "num_look": 328644, "num_comment": 8, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "计算机内存在关机后仍会泄露信息", "url": "https://www.freebuf.com/news/5364.html", "time": "2012-08-14", "level": "", "num_look": 919601, "num_comment": 14, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "34款Firefox渗透测试插件", "url": "https://www.freebuf.com/sectool/5361.html", "time": "2012-08-14", "level": "", "num_look": 2187740, "num_comment": 15, "author": "kelz", "tags": ["工具"], "text": ""}
{"title": "BackTrack5 R3发布", "url": "https://www.freebuf.com/sectool/5363.html", "time": "2012-08-14", "level": "", "num_look": 306080, "num_comment": 13, "author": "saline", "tags": ["工具"], "text": ""}
{"title": "浅析无线网络数据窥探技术", "url": "https://www.freebuf.com/articles/wireless/5351.html", "time": "2012-08-14", "level": "", "num_look": 938538, "num_comment": 39, "author": "Crow", "tags": ["无线安全"], "text": ""}
{"title": "性骚扰是黑客文化的一部分？", "url": "https://www.freebuf.com/news/5358.html", "time": "2012-08-13", "level": "", "num_look": 137765, "num_comment": 9, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "freebuf安全周刊8月6日-8月12日", "url": "https://www.freebuf.com/news/others/5357.html", "time": "2012-08-13", "level": "", "num_look": 212481, "num_comment": 212481, "author": "root", "tags": ["其他", "周边"], "text": ""}
{"title": "一个“神奇”的工具：把 JavaScript 代码转为 ()[]{}!+ 字符", "url": "https://www.freebuf.com/sectool/5352.html", "time": "2012-08-13", "level": "", "num_look": 980150, "num_comment": 13, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "POST/GET参数名称注射", "url": "https://www.freebuf.com/articles/web/5349.html", "time": "2012-08-13", "level": "", "num_look": 194331, "num_comment": 7, "author": "shaun", "tags": ["WEB安全"], "text": ""}
{"title": "研究员发现在世界各地的FinFisher恶意软件服务器", "url": "https://www.freebuf.com/news/5348.html", "time": "2012-08-12", "level": "", "num_look": 138026, "num_comment": 3, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "Burp Suite V1.4.12发布: 新增破解Android SSL功能", "url": "https://www.freebuf.com/sectool/5347.html", "time": "2012-08-12", "level": "", "num_look": 211497, "num_comment": 8, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "SqlmapGUI汉化修正版软件及中文使用说明", "url": "https://www.freebuf.com/sectool/5346.html", "time": "2012-08-10", "level": "", "num_look": 309846, "num_comment": 12, "author": "带刀侍卫", "tags": ["工具"], "text": ""}
{"title": "关于F-BOMB设备以及物理渗透设备介绍", "url": "https://www.freebuf.com/articles/terminal/5310.html", "time": "2012-08-10", "level": "", "num_look": 221549, "num_comment": 4, "author": "radiowar", "tags": ["终端安全"], "text": ""}
{"title": "某国资助的基于火焰平台的银行木马—Gauss被发现", "url": "https://www.freebuf.com/news/5341.html", "time": "2012-08-10", "level": "", "num_look": 127218, "num_comment": 14, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "暴雪承认Battle.Net遭入侵，用户信息泄露", "url": "https://www.freebuf.com/news/5339.html", "time": "2012-08-10", "level": "", "num_look": 108505, "num_comment": 2, "author": "stratsec", "tags": ["资讯"], "text": ""}
{"title": "渗透测试系统 - NETSECLOS V4.0发布", "url": "https://www.freebuf.com/sectool/5335.html", "time": "2012-08-10", "level": "", "num_look": 305581, "num_comment": 16, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "Web应用防篡改工具—AntiDef", "url": "https://www.freebuf.com/sectool/5295.html", "time": "2012-08-09", "level": "", "num_look": 182361, "num_comment": 8, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "黑暗降临: FBI称美国劳工部或发生数据泄露？", "url": "https://www.freebuf.com/news/5284.html", "time": "2012-08-09", "level": "", "num_look": 110516, "num_comment": 4, "author": "tobe", "tags": ["资讯"], "text": ""}
{"title": "NVIDIA修复VGA Window本地权限提升漏洞", "url": "https://www.freebuf.com/articles/system/5307.html", "time": "2012-08-09", "level": "", "num_look": 140201, "num_comment": 5, "author": "cs24", "tags": ["系统安全"], "text": ""}
{"title": "通过NFC技术劫持Andr​​oid和诺基亚智能手机", "url": "https://www.freebuf.com/news/5304.html", "time": "2012-08-09", "level": "", "num_look": 134272, "num_comment": 4, "author": "匿名用户", "tags": ["头条", "资讯"], "text": ""}
{"title": "《Dark Reign 2》源代码泄漏", "url": "https://www.freebuf.com/news/5302.html", "time": "2012-08-08", "level": "", "num_look": 131807, "num_comment": 131807, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "[BlackHat2012工具]PDF安全检测工具Peepdf V0.2", "url": "https://www.freebuf.com/sectool/5293.html", "time": "2012-08-08", "level": "", "num_look": 275131, "num_comment": 3, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "中间人攻击-DNS欺骗", "url": "https://www.freebuf.com/articles/system/5265.html", "time": "2012-08-08", "level": "", "num_look": 1231652, "num_comment": 12, "author": "Heee", "tags": ["系统安全"], "text": ""}
{"title": "Web渗透测试工具-WAppEx", "url": "https://www.freebuf.com/sectool/5290.html", "time": "2012-08-08", "level": "", "num_look": 333228, "num_comment": 16, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "iCloud 账号入侵细节公开", "url": "https://www.freebuf.com/articles/5285.html", "time": "2012-08-07", "level": "", "num_look": 201007, "num_comment": 2, "author": "匿名用户", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "17个不同的端口扫描器下载", "url": "https://www.freebuf.com/sectool/5282.html", "time": "2012-08-07", "level": "", "num_look": 222583, "num_comment": 7, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "Web防火墙（WAF）绕过检测工具-IronBee", "url": "https://www.freebuf.com/sectool/5263.html", "time": "2012-08-07", "level": "", "num_look": 252616, "num_comment": 3, "author": "lxghost", "tags": ["头条", "工具"], "text": ""}
{"title": "[翻译]如何渗透测试WordPress网站", "url": "https://www.freebuf.com/articles/web/5264.html", "time": "2012-08-07", "level": "", "num_look": 493711, "num_comment": 23, "author": "G.r0b1n", "tags": ["WEB安全"], "text": ""}
{"title": "[BlackHat2012工具]微型设备(Teensy)渗透测试脚本集Kautilya", "url": "https://www.freebuf.com/sectool/5280.html", "time": "2012-08-07", "level": "", "num_look": 230132, "num_comment": 4, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "使用NetBios Spoofing技术渗透内网", "url": "https://www.freebuf.com/articles/5238.html", "time": "2012-08-07", "level": "", "num_look": 615862, "num_comment": 46, "author": "thanks", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "BlackHat大会后的WLAN统计报告", "url": "https://www.freebuf.com/news/topnews/5266.html", "time": "2012-08-07", "level": "", "num_look": 161270, "num_comment": 4, "author": "cs24", "tags": ["头条"], "text": ""}
{"title": "Linux主机和MySQL实时监控工具-orzdba", "url": "https://www.freebuf.com/sectool/5262.html", "time": "2012-08-06", "level": "", "num_look": 606815, "num_comment": 606815, "author": "dba", "tags": ["工具"], "text": ""}
{"title": "freebuf安全周刊7月30日-8月5日", "url": "https://www.freebuf.com/news/others/5261.html", "time": "2012-08-06", "level": "", "num_look": 107033, "num_comment": 107033, "author": "root", "tags": ["其他", "周边"], "text": ""}
{"title": "[BlackHat2012工具]ThreadFix漏洞聚合解决方案V1.0 Beta2", "url": "https://www.freebuf.com/sectool/5259.html", "time": "2012-08-06", "level": "", "num_look": 167312, "num_comment": 3, "author": "thanks", "tags": ["工具"], "text": ""}
{"title": "美国导弹防御局要求工作人员停止浏览色情网站", "url": "https://www.freebuf.com/news/5257.html", "time": "2012-08-06", "level": "", "num_look": 140607, "num_comment": 12, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "无线cookie劫持工具-Fern Cookie Hijacker", "url": "https://www.freebuf.com/sectool/5255.html", "time": "2012-08-06", "level": "", "num_look": 329032, "num_comment": 329032, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "[BlackHat2012工具]智能手机渗透测试框架（SPF）V0.1", "url": "https://www.freebuf.com/sectool/5251.html", "time": "2012-08-05", "level": "", "num_look": 190643, "num_comment": 6, "author": "thanks", "tags": ["工具"], "text": ""}
{"title": "[BlackHat2012工具]开源Web应用扫描器Vega1.0 Beta", "url": "https://www.freebuf.com/sectool/5248.html", "time": "2012-08-05", "level": "", "num_look": 225884, "num_comment": 8, "author": "thanks", "tags": ["工具"], "text": ""}
{"title": "[BlackHat2012工具]Google Hacking Diggity工具集", "url": "https://www.freebuf.com/sectool/5246.html", "time": "2012-08-05", "level": "", "num_look": 264781, "num_comment": 6, "author": "thanks", "tags": ["工具"], "text": ""}
{"title": "Freebuf旧版论坛下线，全新社区即将登场", "url": "https://www.freebuf.com/news/others/5225.html", "time": "2012-08-03", "level": "", "num_look": 268298, "num_comment": 30, "author": "root", "tags": ["其他", "周边"], "text": ""}
{"title": "[Python脚本]匿名FTP扫描工具—FtpScan", "url": "https://www.freebuf.com/sectool/5236.html", "time": "2012-08-03", "level": "", "num_look": 310165, "num_comment": 3, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "传P0sixninja在黑帽大会上出售了越狱漏洞", "url": "https://www.freebuf.com/news/topnews/5233.html", "time": "2012-08-02", "level": "", "num_look": 124416, "num_comment": 1, "author": "维维网", "tags": ["头条"], "text": ""}
{"title": "黑客在Defcon建立私人电话网络", "url": "https://www.freebuf.com/news/5227.html", "time": "2012-08-02", "level": "", "num_look": 183543, "num_comment": 16, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "Dropbox确认部分用户被攻击", "url": "https://www.freebuf.com/news/5222.html", "time": "2012-08-01", "level": "", "num_look": 107147, "num_comment": 1, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "HTExploit---HiperText access Exploit", "url": "https://www.freebuf.com/sectool/5216.html", "time": "2012-08-01", "level": "", "num_look": 145964, "num_comment": 1, "author": "unshell", "tags": ["工具"], "text": ""}
{"title": "密码哈希破解工具-Hash Kracker V1.0", "url": "https://www.freebuf.com/sectool/5212.html", "time": "2012-08-01", "level": "", "num_look": 223866, "num_comment": 3, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "[投稿有奖]第一阶段获奖文章名单公布", "url": "https://www.freebuf.com/news/others/5192.html", "time": "2012-08-01", "level": "", "num_look": 164605, "num_comment": 6, "author": "root", "tags": ["其他", "周边"], "text": ""}
{"title": "Mac新恶意软件会监视你的一举一动", "url": "https://www.freebuf.com/news/5210.html", "time": "2012-08-01", "level": "", "num_look": 93458, "num_comment": 93458, "author": "juney", "tags": ["资讯"], "text": ""}
{"title": "Defcon20现场视频", "url": "https://www.freebuf.com/news/5199.html", "time": "2012-07-31", "level": "", "num_look": 147189, "num_comment": 6, "author": "匿名", "tags": ["资讯"], "text": ""}
{"title": "智能手机渗透测试框架 - SPF V0.1", "url": "https://www.freebuf.com/sectool/5201.html", "time": "2012-07-31", "level": "", "num_look": 262634, "num_comment": 15, "author": "cflq3", "tags": ["工具"], "text": ""}
{"title": "Iframe安全威胁", "url": "https://www.freebuf.com/articles/web/5177.html", "time": "2012-07-31", "level": "", "num_look": 471749, "num_comment": 14, "author": "juney", "tags": ["WEB安全"], "text": ""}
{"title": "微软研究员发现了变种Morto蠕虫病毒", "url": "https://www.freebuf.com/news/5202.html", "time": "2012-07-31", "level": "", "num_look": 164307, "num_comment": 1, "author": "jly@12", "tags": ["资讯"], "text": ""}
{"title": "渗透测试、电子取证系统 - Bugtraq-I", "url": "https://www.freebuf.com/sectool/5165.html", "time": "2012-07-31", "level": "", "num_look": 301856, "num_comment": 7, "author": "cflq3", "tags": ["工具"], "text": ""}
{"title": "小心图片泄露你的信息", "url": "https://www.freebuf.com/articles/5184.html", "time": "2012-07-31", "level": "", "num_look": 537244, "num_comment": 11, "author": "jly@12", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "BackTrack5 R3 黑帽版本 发布", "url": "https://www.freebuf.com/sectool/5198.html", "time": "2012-07-31", "level": "", "num_look": 298745, "num_comment": 7, "author": "saline", "tags": ["工具"], "text": ""}
{"title": "育碧的Uplay DRM被发现有后门", "url": "https://www.freebuf.com/news/5171.html", "time": "2012-07-30", "level": "", "num_look": 125914, "num_comment": 1, "author": "leo108", "tags": ["资讯"], "text": ""}
{"title": "freebuf安全周刊7月23日-7月29日", "url": "https://www.freebuf.com/news/others/5168.html", "time": "2012-07-30", "level": "", "num_look": 123308, "num_comment": 123308, "author": "root", "tags": ["其他", "周边"], "text": ""}
{"title": "去哪儿网招聘WEB安全工程师", "url": "https://www.freebuf.com/jobs/5167.html", "time": "2012-07-30", "level": "", "num_look": 147859, "num_comment": 5, "author": "Ecore", "tags": ["安全招聘"], "text": ""}
{"title": "提权辅助小工具-查看文件访问控制列表-checkacl", "url": "https://www.freebuf.com/sectool/5156.html", "time": "2012-07-30", "level": "", "num_look": 203930, "num_comment": 6, "author": "Bing Steve", "tags": ["工具"], "text": ""}
{"title": "PHP代码审计系统—RIPS", "url": "https://www.freebuf.com/sectool/5155.html", "time": "2012-07-30", "level": "", "num_look": 607662, "num_comment": 1, "author": "南国利剑", "tags": ["工具"], "text": ""}
{"title": "中间人攻击-ARP毒化", "url": "https://www.freebuf.com/articles/system/5157.html", "time": "2012-07-30", "level": "", "num_look": 2263342, "num_comment": 23, "author": "Heee", "tags": ["系统安全"], "text": ""}
{"title": "多主机远程脚本执行工具—RemoteScript", "url": "https://www.freebuf.com/sectool/5152.html", "time": "2012-07-29", "level": "", "num_look": 142182, "num_comment": 4, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "GPS缺陷可让黑客跟踪智能手机用户，甚至完全接管移动设备", "url": "https://www.freebuf.com/news/topnews/5149.html", "time": "2012-07-28", "level": "", "num_look": 141348, "num_comment": 2, "author": "leo108", "tags": ["头条"], "text": ""}
{"title": "[7月27日]BlackHat精彩内涵图集（每日更新）", "url": "https://www.freebuf.com/news/topnews/5097.html", "time": "2012-07-27", "level": "", "num_look": 167055, "num_comment": 10, "author": "匿名用户", "tags": ["头条"], "text": ""}
{"title": "[BlackHat专题]黑客能用开源硬件打开百万旅馆房间门", "url": "https://www.freebuf.com/news/topnews/5141.html", "time": "2012-07-27", "level": "", "num_look": 142642, "num_comment": 4, "author": "leo108", "tags": ["头条"], "text": ""}
{"title": "Hotmail、AOL和Yahoo远程密码重置漏洞", "url": "https://www.freebuf.com/articles/5139.html", "time": "2012-07-27", "level": "", "num_look": 179030, "num_comment": 7, "author": "G.r0b1n", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "脚本本地/远程文件包含/读取及文件名截断漏洞FUZZ工具详解", "url": "https://www.freebuf.com/articles/5138.html", "time": "2012-07-27", "level": "", "num_look": 313538, "num_comment": 3, "author": "zeropool", "tags": ["WEB安全", "工具"], "text": ""}
{"title": "[BlackHat专题]The info leak era of software exploitation议题资料下载", "url": "https://www.freebuf.com/news/topnews/5137.html", "time": "2012-07-27", "level": "", "num_look": 141376, "num_comment": 141376, "author": "匿名用户", "tags": ["头条"], "text": ""}
{"title": "[BlackHat专题]各支付终端中存在的严重漏洞", "url": "https://www.freebuf.com/news/topnews/5131.html", "time": "2012-07-27", "level": "", "num_look": 138457, "num_comment": 3, "author": "kelz", "tags": ["头条"], "text": ""}
{"title": "澳大利亚某ISP服务商40GB用户数据被盗", "url": "https://www.freebuf.com/news/5117.html", "time": "2012-07-27", "level": "", "num_look": 101195, "num_comment": 101195, "author": "jly@12", "tags": ["资讯"], "text": ""}
{"title": "[快讯]​BackTrack R3版本即将发布", "url": "https://www.freebuf.com/news/5129.html", "time": "2012-07-26", "level": "", "num_look": 129746, "num_comment": 10, "author": "匿名用户", "tags": ["头条", "资讯"], "text": ""}
{"title": "苹果首次高调现身黑帽大会", "url": "https://www.freebuf.com/news/5118.html", "time": "2012-07-26", "level": "", "num_look": 86279, "num_comment": 86279, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "黑客可通过NFC攻击Android和诺基亚智能机", "url": "https://www.freebuf.com/news/topnews/5114.html", "time": "2012-07-26", "level": "", "num_look": 140870, "num_comment": 2, "author": "leo108", "tags": ["头条"], "text": ""}
{"title": "攻击SharePoint", "url": "https://www.freebuf.com/articles/5108.html", "time": "2012-07-26", "level": "", "num_look": 310931, "num_comment": 6, "author": "G.r0b1n", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "中国信息安全地下产业链调查报告", "url": "https://www.freebuf.com/articles/5104.html", "time": "2012-07-26", "level": "", "num_look": 169288, "num_comment": 5, "author": "zhugejw", "tags": ["其他", "文章"], "text": ""}
{"title": "川渝地区白帽子线下技术沙龙", "url": "https://www.freebuf.com/news/others/5095.html", "time": "2012-07-25", "level": "", "num_look": 157513, "num_comment": 7, "author": "only_guest", "tags": ["其他", "周边"], "text": ""}
{"title": "[BlackHat专题]PwnieAwards 2012奖项提名", "url": "https://www.freebuf.com/news/topnews/5088.html", "time": "2012-07-25", "level": "", "num_look": 158714, "num_comment": 4, "author": "jly@12", "tags": ["头条"], "text": ""}
{"title": "HITCon2012（台湾黑客年会）速描", "url": "https://www.freebuf.com/news/5080.html", "time": "2012-07-25", "level": "", "num_look": 188727, "num_comment": 21, "author": "tobe", "tags": ["资讯"], "text": ""}
{"title": "以太网数据包​生成器PACKETH", "url": "https://www.freebuf.com/sectool/5078.html", "time": "2012-07-25", "level": "", "num_look": 279622, "num_comment": 2, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "[BlackHat专题]渗透测试工具伪装成电源插座", "url": "https://www.freebuf.com/news/topnews/5072.html", "time": "2012-07-25", "level": "", "num_look": 187972, "num_comment": 4, "author": "kelz", "tags": ["头条", "极客"], "text": ""}
{"title": "[BlackHat专题]BlackHat2012会前资料下载", "url": "https://www.freebuf.com/news/topnews/5077.html", "time": "2012-07-25", "level": "", "num_look": 212840, "num_comment": 6, "author": "thanks", "tags": ["头条"], "text": ""}
{"title": "XSS漏洞扫描器 - Xelenium", "url": "https://www.freebuf.com/sectool/5068.html", "time": "2012-07-24", "level": "", "num_look": 871510, "num_comment": 14, "author": "flowing", "tags": ["工具"], "text": ""}
{"title": "[预告]Freebuf将推出BlackHat2012专题", "url": "https://www.freebuf.com/news/5076.html", "time": "2012-07-24", "level": "", "num_look": 153086, "num_comment": 10, "author": "root", "tags": ["资讯"], "text": ""}
{"title": "[更新]开源渗透测试框架 - HconSTF V0.4", "url": "https://www.freebuf.com/sectool/5069.html", "time": "2012-07-24", "level": "", "num_look": 175841, "num_comment": 175841, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "社会工程学工具集Social-Engineer Toolkit (SET) v3.5.1", "url": "https://www.freebuf.com/sectool/5067.html", "time": "2012-07-23", "level": "", "num_look": 252583, "num_comment": 6, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "Chrome浏览器中的渗透测试扩展插件", "url": "https://www.freebuf.com/articles/5052.html", "time": "2012-07-23", "level": "", "num_look": 446886, "num_comment": 13, "author": "unshell", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "freebuf安全周刊7月16日-7月20日", "url": "https://www.freebuf.com/news/others/5066.html", "time": "2012-07-23", "level": "", "num_look": 145396, "num_comment": 5, "author": "root", "tags": ["其他", "周边"], "text": ""}
{"title": "[BlackHat专题]智能电表黑客工具 - termineter发布", "url": "https://www.freebuf.com/sectool/5063.html", "time": "2012-07-23", "level": "", "num_look": 232428, "num_comment": 5, "author": "匿名用户", "tags": ["头条", "工具"], "text": ""}
{"title": "PHP+MYSQL环境下的Cookies爆错注入实战", "url": "https://www.freebuf.com/articles/5047.html", "time": "2012-07-23", "level": "", "num_look": 223602, "num_comment": 223602, "author": "混世魔王", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "一个扫目录扫后台的工具【Sensitive Buster v 1.0】", "url": "https://www.freebuf.com/sectool/5045.html", "time": "2012-07-22", "level": "", "num_look": 321965, "num_comment": 6, "author": "print_0x0000", "tags": ["工具"], "text": ""}
{"title": "论下一代在线安全审计软件", "url": "https://www.freebuf.com/news/others/5054.html", "time": "2012-07-22", "level": "", "num_look": 335934, "num_comment": 17, "author": "zeropool", "tags": ["其他", "周边"], "text": ""}
{"title": "[更新]QuarksPwDump V0.2b", "url": "https://www.freebuf.com/sectool/5049.html", "time": "2012-07-22", "level": "", "num_look": 248748, "num_comment": 4, "author": "unshell", "tags": ["工具"], "text": ""}
{"title": "渗透测试工具 - WS-Attacker 1.1", "url": "https://www.freebuf.com/sectool/5043.html", "time": "2012-07-21", "level": "", "num_look": 275053, "num_comment": 2, "author": "unshell", "tags": ["工具"], "text": ""}
{"title": "凯文·米特尼克加盟以色列移动安全公司Zimperium", "url": "https://www.freebuf.com/news/5042.html", "time": "2012-07-21", "level": "", "num_look": 194352, "num_comment": 7, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "超强验证码", "url": "https://www.freebuf.com/news/others/5036.html", "time": "2012-07-20", "level": "", "num_look": 170923, "num_comment": 6, "author": "匿名用户", "tags": ["其他", "周边"], "text": ""}
{"title": "远程控制工具—RAIORemote", "url": "https://www.freebuf.com/sectool/5032.html", "time": "2012-07-20", "level": "", "num_look": 253279, "num_comment": 4, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "Wi-Fi Hacking", "url": "https://www.freebuf.com/articles/5012.html", "time": "2012-07-20", "level": "", "num_look": 621358, "num_comment": 20, "author": "thanks", "tags": ["文章", "无线安全"], "text": ""}
{"title": "[更新]WIFI密码查找工具 - UFO WARDRIVING V1.7", "url": "https://www.freebuf.com/sectool/5028.html", "time": "2012-07-19", "level": "", "num_look": 301691, "num_comment": 10, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "Kindle Touch远程代码执行漏洞", "url": "https://www.freebuf.com/news/5027.html", "time": "2012-07-19", "level": "", "num_look": 110209, "num_comment": 3, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "[更新]Web应用程序扫描器评估工具-wavsep V1.2", "url": "https://www.freebuf.com/sectool/5024.html", "time": "2012-07-19", "level": "", "num_look": 193752, "num_comment": 2, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "Iphone取证(一)", "url": "https://www.freebuf.com/articles/wireless/5009.html", "time": "2012-07-18", "level": "", "num_look": 330962, "num_comment": 10, "author": "kelz", "tags": ["无线安全", "终端安全"], "text": ""}
{"title": "Yahoo修复45万用户泄露系统漏洞", "url": "https://www.freebuf.com/news/5008.html", "time": "2012-07-18", "level": "", "num_look": 105288, "num_comment": 105288, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "Android 4.1完整支持ASLR技术以提高安全性", "url": "https://www.freebuf.com/news/5006.html", "time": "2012-07-18", "level": "", "num_look": 141254, "num_comment": 6, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "[更新]Metasploit 4.4版本发布", "url": "https://www.freebuf.com/sectool/5004.html", "time": "2012-07-18", "level": "", "num_look": 389603, "num_comment": 8, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "Skype源代码泄露（附下载地址）", "url": "https://www.freebuf.com/news/5002.html", "time": "2012-07-17", "level": "", "num_look": 326967, "num_comment": 26, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "Magento_eCommerce_Platform_XXE_Injection利用", "url": "https://www.freebuf.com/articles/4997.html", "time": "2012-07-17", "level": "", "num_look": 164894, "num_comment": 2, "author": "qingsh4n", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "[快讯]华硕ASUS电子商城被拖库", "url": "https://www.freebuf.com/news/4995.html", "time": "2012-07-17", "level": "", "num_look": 152559, "num_comment": 3, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "ViewState解码工具-ViewStateHacker.v.1.0.4", "url": "https://www.freebuf.com/sectool/4993.html", "time": "2012-07-17", "level": "", "num_look": 447558, "num_comment": 447558, "author": "熙雅", "tags": ["工具"], "text": ""}
{"title": "PHP 5.5新的加密函数-password_hash()", "url": "https://www.freebuf.com/articles/4994.html", "time": "2012-07-17", "level": "", "num_look": 203370, "num_comment": 8, "author": "匿名用户", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "Java GUI界面SQL注入工具 - JSQL", "url": "https://www.freebuf.com/sectool/4991.html", "time": "2012-07-16", "level": "", "num_look": 164669, "num_comment": 2, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "freebuf安全周刊7月9日-7月13日", "url": "https://www.freebuf.com/news/others/4990.html", "time": "2012-07-16", "level": "", "num_look": 131188, "num_comment": 2, "author": "匿名用户", "tags": ["周边", "头条"], "text": ""}
{"title": "Win下渗透测试工具WinPentest v1.3.0", "url": "https://www.freebuf.com/sectool/4987.html", "time": "2012-07-16", "level": "", "num_look": 272537, "num_comment": 13, "author": "熙雅", "tags": ["工具"], "text": ""}
{"title": "Nvidia遭黑客攻击，40万用户数据泄露", "url": "https://www.freebuf.com/news/4984.html", "time": "2012-07-16", "level": "", "num_look": 124504, "num_comment": 3, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "开源入侵检测系统引擎Suricata IDPE 1.3", "url": "https://www.freebuf.com/sectool/4981.html", "time": "2012-07-15", "level": "", "num_look": 226605, "num_comment": 1, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "渗透测试演练工具（VM）OWASPBWA1.0 RC2", "url": "https://www.freebuf.com/sectool/4980.html", "time": "2012-07-15", "level": "", "num_look": 588690, "num_comment": 588690, "author": "unshell", "tags": ["工具"], "text": ""}
{"title": "微软IIS 6.0和7.5的多个漏洞及利用方法", "url": "https://www.freebuf.com/articles/4978.html", "time": "2012-07-14", "level": "", "num_look": 1248469, "num_comment": 5, "author": "Test5", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "雅虎泄露数据用户使用密码排名top10", "url": "https://www.freebuf.com/news/4977.html", "time": "2012-07-13", "level": "", "num_look": 173530, "num_comment": 2, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "[更新]SSL密钥算法检测工具-sslciphercheck v1.4.2", "url": "https://www.freebuf.com/sectool/4976.html", "time": "2012-07-13", "level": "", "num_look": 406887, "num_comment": 8, "author": "熙雅", "tags": ["工具"], "text": ""}
{"title": "OWASP浏览器框架（安全工具套件）Mantra", "url": "https://www.freebuf.com/sectool/4970.html", "time": "2012-07-13", "level": "", "num_look": 729241, "num_comment": 14, "author": "葙守", "tags": ["工具"], "text": ""}
{"title": "[快讯]雅虎45万用户数据泄露", "url": "https://www.freebuf.com/news/4972.html", "time": "2012-07-12", "level": "", "num_look": 210773, "num_comment": 10, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "对zend framework xxe injection 的分析", "url": "https://www.freebuf.com/articles/4960.html", "time": "2012-07-12", "level": "", "num_look": 202905, "num_comment": 2, "author": "FreebuF", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "最新python提权:python-wrapper及python 不可信的搜索路径/代码执行漏洞", "url": "https://www.freebuf.com/vuls/4969.html", "time": "2012-07-12", "level": "", "num_look": 266006, "num_comment": 17, "author": "cs24", "tags": ["漏洞"], "text": ""}
{"title": "SIM卡安全", "url": "https://www.freebuf.com/articles/wireless/4946.html", "time": "2012-07-12", "level": "", "num_look": 473549, "num_comment": 28, "author": "lu4nx", "tags": ["无线安全", "终端安全"], "text": ""}
{"title": "新型Java恶意软件，同时攻击OS X、Win和Linux", "url": "https://www.freebuf.com/news/4964.html", "time": "2012-07-12", "level": "", "num_look": 111045, "num_comment": 111045, "author": "leo108", "tags": ["资讯"], "text": ""}
{"title": "Parallels’Plesk Panel疑似出现零日漏洞", "url": "https://www.freebuf.com/news/4958.html", "time": "2012-07-12", "level": "", "num_look": 169715, "num_comment": 1, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "Solar FTP Server拒绝服务漏洞POC", "url": "https://www.freebuf.com/vuls/4947.html", "time": "2012-07-11", "level": "", "num_look": 158241, "num_comment": 1, "author": "wawt", "tags": ["漏洞"], "text": ""}
{"title": "IIS短文件漏洞安全扫描工具", "url": "https://www.freebuf.com/sectool/4959.html", "time": "2012-07-11", "level": "", "num_look": 437364, "num_comment": 4, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "Scapy，IPTables，Brupsuite在ARP毒化攻击中的实用性技巧", "url": "https://www.freebuf.com/articles/4922.html", "time": "2012-07-11", "level": "", "num_look": 367309, "num_comment": 8, "author": "pnig0s", "tags": ["文章", "系统安全"], "text": ""}
{"title": "渗透测试专用浏览器Sandcat", "url": "https://www.freebuf.com/sectool/4955.html", "time": "2012-07-11", "level": "", "num_look": 423852, "num_comment": 17, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "SQL Injection的深入探讨", "url": "https://www.freebuf.com/articles/4945.html", "time": "2012-07-11", "level": "", "num_look": 260670, "num_comment": 1, "author": "hacxy", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "[更新]WEB服务测试工具 - HTTPTEST V2.2.8", "url": "https://www.freebuf.com/sectool/4941.html", "time": "2012-07-10", "level": "", "num_look": 190171, "num_comment": 1, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "用Nmap脚本检测Poison Ivy Rat控制端", "url": "https://www.freebuf.com/sectool/4940.html", "time": "2012-07-10", "level": "", "num_look": 215669, "num_comment": 2, "author": "cs24", "tags": ["工具"], "text": ""}
{"title": "Velocity Parse()函数引发的本地包含漏洞及利用方法", "url": "https://www.freebuf.com/articles/4904.html", "time": "2012-07-10", "level": "", "num_look": 277760, "num_comment": 10, "author": "thanks", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "DarkComet RAT作者宣布项目停止开发", "url": "https://www.freebuf.com/news/4939.html", "time": "2012-07-10", "level": "", "num_look": 178443, "num_comment": 1, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "[原创]PoisonIvy Rat 远程溢出实战", "url": "https://www.freebuf.com/articles/4921.html", "time": "2012-07-09", "level": "", "num_look": 581454, "num_comment": 5, "author": "darkray", "tags": ["文章", "系统安全"], "text": ""}
{"title": "IIS短文件/文件夹漏洞(汇总整理)", "url": "https://www.freebuf.com/articles/4908.html", "time": "2012-07-09", "level": "", "num_look": 2351764, "num_comment": 9, "author": "cs24", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "[视频]第一期知道创宇Web安全论坛Kcon视频花絮", "url": "https://www.freebuf.com/news/others/4920.html", "time": "2012-07-09", "level": "", "num_look": 211235, "num_comment": 5, "author": "匿名用户", "tags": ["其他", "周边"], "text": ""}
{"title": "proxmark3使用指导手册", "url": "https://www.freebuf.com/articles/4926.html", "time": "2012-07-09", "level": "", "num_look": 723241, "num_comment": 9, "author": "n0h4ck_team", "tags": ["文章", "终端安全"], "text": ""}
{"title": "新Android病毒 MMarketPay.A 超10万手机感染", "url": "https://www.freebuf.com/news/4933.html", "time": "2012-07-09", "level": "", "num_look": 120498, "num_comment": 1, "author": "leo108", "tags": ["资讯"], "text": ""}
{"title": "美国最大一家政府赞助企业“房利美”的SOC主管招聘条件", "url": "https://www.freebuf.com/jobs/4915.html", "time": "2012-07-08", "level": "", "num_look": 119362, "num_comment": 119362, "author": "cs24", "tags": ["安全招聘"], "text": ""}
{"title": "智能手机木马app(Find and Call)惊现app store和google play", "url": "https://www.freebuf.com/news/4909.html", "time": "2012-07-08", "level": "", "num_look": 117869, "num_comment": 117869, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "[快讯]黑客组织Cyber-Warrior被警方逮捕", "url": "https://www.freebuf.com/news/4900.html", "time": "2012-07-07", "level": "", "num_look": 139885, "num_comment": 6, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "IBM最新XSS Analzyer将提供700万XSS漏洞利用规则", "url": "https://www.freebuf.com/news/4896.html", "time": "2012-07-06", "level": "", "num_look": 190471, "num_comment": 17, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "日本三机构破解278位配对密码创世界纪录", "url": "https://www.freebuf.com/news/4884.html", "time": "2012-07-06", "level": "", "num_look": 118895, "num_comment": 5, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "Windows注册表密码信息提取工具Creddump", "url": "https://www.freebuf.com/sectool/4882.html", "time": "2012-07-06", "level": "", "num_look": 226342, "num_comment": 10, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "IPv6攻击测试工具包-THC IPV6 V1.9", "url": "https://www.freebuf.com/sectool/4880.html", "time": "2012-07-06", "level": "", "num_look": 225632, "num_comment": 2, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "使用Proxmark3进行MIFARE Classic卡的安全测试", "url": "https://www.freebuf.com/sectool/4876.html", "time": "2012-07-05", "level": "", "num_look": 354189, "num_comment": 16, "author": "RFIDHacker", "tags": ["工具"], "text": ""}
{"title": "黑客组织Anonymous揭秘：FBI曾悄然组织其活动", "url": "https://www.freebuf.com/news/4868.html", "time": "2012-07-05", "level": "", "num_look": 130963, "num_comment": 8, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "Web应用安全审计工具-WATOBO 0.9.9.pre1发布", "url": "https://www.freebuf.com/sectool/4865.html", "time": "2012-07-05", "level": "", "num_look": 158904, "num_comment": 1, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "Linux的IPsec项目-strongSwan 5.0发布", "url": "https://www.freebuf.com/sectool/4862.html", "time": "2012-07-05", "level": "", "num_look": 132286, "num_comment": 2, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "[视频]Android系统clickjacking攻击", "url": "https://www.freebuf.com/news/4860.html", "time": "2012-07-05", "level": "", "num_look": 113542, "num_comment": 3, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "[BlackHat专题]BlackHat2012兵器谱（预告版）", "url": "https://www.freebuf.com/news/4848.html", "time": "2012-07-04", "level": "", "num_look": 177122, "num_comment": 5, "author": "cs24", "tags": ["头条", "资讯"], "text": ""}
{"title": "LFI本地包含漏洞利用小技巧", "url": "https://www.freebuf.com/articles/4843.html", "time": "2012-07-04", "level": "", "num_look": 414462, "num_comment": 22, "author": "小冰", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "[快讯]多国网站遭入侵，30万个人资料泄露", "url": "https://www.freebuf.com/news/4850.html", "time": "2012-07-04", "level": "", "num_look": 134590, "num_comment": 3, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "[原创工具]替换服务提权可能性检查工具chkPriv", "url": "https://www.freebuf.com/sectool/4834.html", "time": "2012-07-04", "level": "", "num_look": 198036, "num_comment": 16, "author": "pnig0s", "tags": ["工具"], "text": ""}
{"title": "Zemra木马源代码泄露(含源码下载)", "url": "https://www.freebuf.com/news/4849.html", "time": "2012-07-03", "level": "", "num_look": 363837, "num_comment": 8, "author": "leo108", "tags": ["资讯"], "text": ""}
{"title": "中国黑客窃取印度海军情报", "url": "https://www.freebuf.com/news/4841.html", "time": "2012-07-03", "level": "", "num_look": 111364, "num_comment": 4, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "蜜罐系统 - Artillery 0.5.1 alpha发布", "url": "https://www.freebuf.com/sectool/4832.html", "time": "2012-07-03", "level": "", "num_look": 167690, "num_comment": 2, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "补充：FreeBSD全版本Telnetd远程溢出漏洞", "url": "https://www.freebuf.com/news/4830.html", "time": "2012-07-03", "level": "", "num_look": 149409, "num_comment": 149409, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "freebuf安全周刊2012年6月25日-7月1日", "url": "https://www.freebuf.com/news/others/4829.html", "time": "2012-07-02", "level": "", "num_look": 266925, "num_comment": 1, "author": "root", "tags": ["周边", "头条"], "text": ""}
{"title": "如何在BeEF中使用metasploit颠覆你的浏览器", "url": "https://www.freebuf.com/sectool/4799.html", "time": "2012-07-02", "level": "", "num_look": 1316388, "num_comment": 15, "author": "luke", "tags": ["工具"], "text": ""}
{"title": "[回顾]重温黑帽大会的Pwnie Awards", "url": "https://www.freebuf.com/news/4816.html", "time": "2012-07-02", "level": "", "num_look": 139089, "num_comment": 1, "author": "cs24", "tags": ["头条", "资讯"], "text": ""}
{"title": "[首发]知道创宇Web安全论坛议题PPT下载", "url": "https://www.freebuf.com/news/others/4822.html", "time": "2012-07-02", "level": "", "num_look": 224237, "num_comment": 19, "author": "root", "tags": ["其他", "周边"], "text": ""}
{"title": "知道创宇Web安全论坛(Kcon2012)现场报道", "url": "https://www.freebuf.com/news/others/4796.html", "time": "2012-07-02", "level": "", "num_look": 176503, "num_comment": 21, "author": "root", "tags": ["其他", "周边"], "text": ""}
{"title": "[好书推荐]The Web Application Hacker's Handbook（第2版）", "url": "https://www.freebuf.com/news/others/4788.html", "time": "2012-07-01", "level": "", "num_look": 251930, "num_comment": 8, "author": "thanks", "tags": ["其他", "周边"], "text": ""}
{"title": "第一届知道创宇Web安全论坛(Kcon)本周日举行", "url": "https://www.freebuf.com/news/others/4785.html", "time": "2012-06-30", "level": "", "num_look": 167063, "num_comment": 4, "author": "知道创宇", "tags": ["其他", "周边"], "text": ""}
{"title": "[0day快报]FreeBSD全版本Telnetd远程溢出漏洞（附Exp）", "url": "https://www.freebuf.com/vuls/4780.html", "time": "2012-06-30", "level": "", "num_look": 340547, "num_comment": 31, "author": "pnig0s", "tags": ["漏洞"], "text": ""}
{"title": "burpsuite_pro_v1.4.07破解版", "url": "https://www.freebuf.com/sectool/4771.html", "time": "2012-06-30", "level": "", "num_look": 539829, "num_comment": 49, "author": "Eric", "tags": ["工具"], "text": ""}
{"title": "[分析]Struts2远程命令执行漏洞分析", "url": "https://www.freebuf.com/articles/4772.html", "time": "2012-06-29", "level": "", "num_look": 313588, "num_comment": 3, "author": "匿名用户", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "[投稿有奖]Freebuf与腾讯TSRC开展有奖征文活动", "url": "https://www.freebuf.com/news/4767.html", "time": "2012-06-29", "level": "", "num_look": 202344, "num_comment": 13, "author": "root", "tags": ["其他", "周边"], "text": ""}
{"title": "burpsuite v1.4.10发布", "url": "https://www.freebuf.com/sectool/4768.html", "time": "2012-06-29", "level": "", "num_look": 177804, "num_comment": 15, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "[技术心得]利用nod32 HIPS禁止程序启动", "url": "https://www.freebuf.com/articles/4758.html", "time": "2012-06-29", "level": "", "num_look": 298966, "num_comment": 3, "author": "cs24", "tags": ["文章", "系统安全"], "text": ""}
{"title": "全球60家银行遭网络攻击 至少损失8千万美元", "url": "https://www.freebuf.com/news/4756.html", "time": "2012-06-28", "level": "", "num_look": 100287, "num_comment": 4, "author": "leo108", "tags": ["资讯"], "text": ""}
{"title": "[快讯]熊猫安全遭LulzSecMx入侵，部分数据泄露", "url": "https://www.freebuf.com/news/4752.html", "time": "2012-06-28", "level": "", "num_look": 104323, "num_comment": 104323, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "科研人员称可攻破 SecurID 令牌 RSA辟谣", "url": "https://www.freebuf.com/news/4748.html", "time": "2012-06-28", "level": "", "num_look": 147948, "num_comment": 1, "author": "leo108", "tags": ["资讯"], "text": ""}
{"title": "[更新]Gui-for-sqlmap Version17612", "url": "https://www.freebuf.com/sectool/4746.html", "time": "2012-06-28", "level": "", "num_look": 205408, "num_comment": 4, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "Google奖励Chrome 20中的漏洞发现者11500美元", "url": "https://www.freebuf.com/news/4743.html", "time": "2012-06-28", "level": "", "num_look": 118738, "num_comment": 1, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "如何在VPS上搭建远程桌面蜜罐", "url": "https://www.freebuf.com/articles/4728.html", "time": "2012-06-28", "level": "", "num_look": 241946, "num_comment": 3, "author": "darkray", "tags": ["文章", "系统安全"], "text": ""}
{"title": "Android会话劫持安全测试工具DroidSheep", "url": "https://www.freebuf.com/sectool/4723.html", "time": "2012-06-27", "level": "", "num_look": 349030, "num_comment": 16, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "RSA SecurIDs 13分钟内被破解", "url": "https://www.freebuf.com/news/4721.html", "time": "2012-06-27", "level": "", "num_look": 156979, "num_comment": 6, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "[补充]Intel CPU相关隐患问题", "url": "https://www.freebuf.com/news/4720.html", "time": "2012-06-27", "level": "", "num_look": 438750, "num_comment": 438750, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "[TOP10]十大渗透测试演练系统", "url": "https://www.freebuf.com/sectool/4708.html", "time": "2012-06-27", "level": "", "num_look": 4683359, "num_comment": 35, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "US-CERT发出警告：Intel CPU存在隐患", "url": "https://www.freebuf.com/news/4702.html", "time": "2012-06-27", "level": "", "num_look": 108323, "num_comment": 2, "author": "leo108", "tags": ["资讯"], "text": ""}
{"title": "恶意PDF嵌入XDP以绕开防病毒网关", "url": "https://www.freebuf.com/news/4700.html", "time": "2012-06-26", "level": "", "num_look": 127504, "num_comment": 4, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "AutoCAD蠕虫偷窃设计图纸，发回中国", "url": "https://www.freebuf.com/news/4698.html", "time": "2012-06-26", "level": "", "num_look": 115890, "num_comment": 115890, "author": "mimzy", "tags": ["资讯"], "text": ""}
{"title": "[国内首发]最新AutoCAD工业蠕虫病毒样本下载", "url": "https://www.freebuf.com/news/4686.html", "time": "2012-06-26", "level": "", "num_look": 190659, "num_comment": 3, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "开源的暴力破解工具", "url": "https://www.freebuf.com/sectool/4695.html", "time": "2012-06-26", "level": "", "num_look": 433904, "num_comment": 2, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "自定义bash脚本定制自动化各种渗透测试任务", "url": "https://www.freebuf.com/sectool/4689.html", "time": "2012-06-26", "level": "", "num_look": 196038, "num_comment": 1, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "Nmap SQL注入扫描插件Http-sql-injection", "url": "https://www.freebuf.com/sectool/4684.html", "time": "2012-06-25", "level": "", "num_look": 326469, "num_comment": 3, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "freebuf安全周刊2012年6月18日-6月24日", "url": "https://www.freebuf.com/news/others/4682.html", "time": "2012-06-25", "level": "", "num_look": 109265, "num_comment": 109265, "author": "匿名用户", "tags": ["周边", "头条"], "text": ""}
{"title": "[新功能]Freebuf更新记录（2012.6.25）", "url": "https://www.freebuf.com/news/others/4658.html", "time": "2012-06-25", "level": "", "num_look": 193637, "num_comment": 13, "author": "root", "tags": ["其他", "周边"], "text": ""}
{"title": "基于Http Header的SQL注入", "url": "https://www.freebuf.com/articles/4588.html", "time": "2012-06-25", "level": "", "num_look": 344311, "num_comment": 8, "author": "flowing", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "利用Metasploit编写Adobe Flash(CVE-2012-0779)漏洞模块", "url": "https://www.freebuf.com/articles/4618.html", "time": "2012-06-25", "level": "", "num_look": 205909, "num_comment": 3, "author": "匿名用户", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "编程实现遍历ACL访问控制列表检查进程访问权限", "url": "https://www.freebuf.com/articles/4546.html", "time": "2012-06-25", "level": "", "num_look": 328623, "num_comment": 6, "author": "pnig0s", "tags": ["文章", "系统安全"], "text": ""}
{"title": "华中科技大学被黑-女生照片被爆", "url": "https://www.freebuf.com/news/4678.html", "time": "2012-06-24", "level": "", "num_look": 432481, "num_comment": 33, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "美国国土安全局和美国海军网站遭黑客入侵", "url": "https://www.freebuf.com/news/4656.html", "time": "2012-06-24", "level": "", "num_look": 135898, "num_comment": 3, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "俄罗斯僵尸网络幕后黑手被逮捕-控制6百万台肉鸡", "url": "https://www.freebuf.com/news/4631.html", "time": "2012-06-23", "level": "", "num_look": 152994, "num_comment": 4, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "[更新]BackBox Linux 2.05", "url": "https://www.freebuf.com/sectool/4542.html", "time": "2012-06-23", "level": "", "num_look": 185492, "num_comment": 2, "author": "葙守", "tags": ["工具"], "text": ""}
{"title": "Twitter今日多次宕机，黑客宣称攻击所致", "url": "https://www.freebuf.com/news/4534.html", "time": "2012-06-22", "level": "", "num_look": 105059, "num_comment": 105059, "author": "葙守", "tags": ["资讯"], "text": ""}
{"title": "PayPal提供现金悬赏找安全漏洞", "url": "https://www.freebuf.com/news/4562.html", "time": "2012-06-22", "level": "", "num_look": 124287, "num_comment": 2, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "微软公布蓝帽子黑客大赛赛程 赢家得20万美元", "url": "https://www.freebuf.com/news/4533.html", "time": "2012-06-22", "level": "", "num_look": 120846, "num_comment": 120846, "author": "葙守", "tags": ["资讯"], "text": ""}
{"title": "[分析]工业病毒Flamer和Stuxnet的相似度超过你的想象", "url": "https://www.freebuf.com/articles/4518.html", "time": "2012-06-22", "level": "", "num_look": 165632, "num_comment": 1, "author": "pnig0s", "tags": ["文章", "系统安全"], "text": ""}
{"title": "中国黑客通过木马内置聊天功能和AVG研究人员聊天", "url": "https://www.freebuf.com/news/4503.html", "time": "2012-06-21", "level": "", "num_look": 163789, "num_comment": 16, "author": "leo108", "tags": ["资讯"], "text": ""}
{"title": "缅甸与孟加拉国之间的网络战争", "url": "https://www.freebuf.com/news/4482.html", "time": "2012-06-21", "level": "", "num_look": 128938, "num_comment": 1, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "无线渗透测试套件PwnSTAR 0.7", "url": "https://www.freebuf.com/sectool/4471.html", "time": "2012-06-21", "level": "", "num_look": 191406, "num_comment": 2, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "[笔记]AWVS应用之HTTP Fuzzer", "url": "https://www.freebuf.com/articles/4442.html", "time": "2012-06-21", "level": "", "num_look": 445413, "num_comment": 3, "author": "darkray", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "基于CVE-2012-1889的恶意代码在扩散", "url": "https://www.freebuf.com/articles/4445.html", "time": "2012-06-21", "level": "", "num_look": 188646, "num_comment": 2, "author": "pnig0s", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "黑客的巢穴！黑客工作场所探秘", "url": "https://www.freebuf.com/news/4411.html", "time": "2012-06-21", "level": "", "num_look": 165303, "num_comment": 12, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "跨目录渗透字符集", "url": "https://www.freebuf.com/sectool/4344.html", "time": "2012-06-20", "level": "", "num_look": 152103, "num_comment": 1, "author": "cs24", "tags": ["工具"], "text": ""}
{"title": "美国与以色列合伙开发Flame恶意软件 旨在破坏伊朗核计划", "url": "https://www.freebuf.com/news/4401.html", "time": "2012-06-20", "level": "", "num_look": 107085, "num_comment": 107085, "author": "leo108", "tags": ["资讯"], "text": ""}
{"title": "Percona Server 再次澄清 MySQL 的安全漏洞问题", "url": "https://www.freebuf.com/news/4385.html", "time": "2012-06-20", "level": "", "num_look": 114420, "num_comment": 1, "author": "leo108", "tags": ["资讯"], "text": ""}
{"title": "[方法分享]利用输入框进行恶意代码注入", "url": "https://www.freebuf.com/articles/4316.html", "time": "2012-06-20", "level": "", "num_look": 394472, "num_comment": 14, "author": "thanks", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "花费148天终于破解278位密码", "url": "https://www.freebuf.com/news/4360.html", "time": "2012-06-20", "level": "", "num_look": 148869, "num_comment": 4, "author": "leo108", "tags": ["资讯"], "text": ""}
{"title": "Android手机系统锁屏功能信息泄露风险", "url": "https://www.freebuf.com/vuls/4320.html", "time": "2012-06-19", "level": "", "num_look": 158142, "num_comment": 13, "author": "猪哥靓", "tags": ["漏洞"], "text": ""}
{"title": "六名日本人因Android色情病毒被捕", "url": "https://www.freebuf.com/news/4309.html", "time": "2012-06-19", "level": "", "num_look": 125070, "num_comment": 3, "author": "guotie", "tags": ["资讯"], "text": ""}
{"title": "一位黑客的告别之作：79家银行信息被“裸奔”", "url": "https://www.freebuf.com/news/4304.html", "time": "2012-06-19", "level": "", "num_look": 119591, "num_comment": 1, "author": "leo108", "tags": ["资讯"], "text": ""}
{"title": "Webshell代码检测背后的数学应用", "url": "https://www.freebuf.com/articles/4240.html", "time": "2012-06-19", "level": "", "num_look": 355504, "num_comment": 8, "author": "pnig0s", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "[安全要闻]谷歌被黑客组织UGNazi通过社会工程学攻陷", "url": "https://www.freebuf.com/news/4287.html", "time": "2012-06-19", "level": "", "num_look": 185154, "num_comment": 17, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "开源WAF（modsecurity）更新版本至2.6.6", "url": "https://www.freebuf.com/sectool/4274.html", "time": "2012-06-18", "level": "", "num_look": 286896, "num_comment": 286896, "author": "cs24", "tags": ["工具"], "text": ""}
{"title": "只有219字节的javascript游戏", "url": "https://www.freebuf.com/news/others/4267.html", "time": "2012-06-18", "level": "", "num_look": 139556, "num_comment": 2, "author": "flowing", "tags": ["其他", "周边"], "text": ""}
{"title": "快速的渗透测试套件 - Raspberry Pwn", "url": "https://www.freebuf.com/sectool/4261.html", "time": "2012-06-18", "level": "", "num_look": 206781, "num_comment": 2, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "IE漏洞CVE-2012-1889的稳定利用", "url": "https://www.freebuf.com/articles/web/4230.html", "time": "2012-06-18", "level": "", "num_look": 217792, "num_comment": 8, "author": "匿名用户", "tags": ["WEB安全", "系统安全"], "text": ""}
{"title": "unix反病毒工具包 - Clam AntiVirus Toolkit 0.97.5", "url": "https://www.freebuf.com/sectool/4226.html", "time": "2012-06-18", "level": "", "num_look": 123993, "num_comment": 123993, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "freebuf安全周刊2012年6月11日-6月17日", "url": "https://www.freebuf.com/news/others/4214.html", "time": "2012-06-18", "level": "", "num_look": 157071, "num_comment": 157071, "author": "root", "tags": ["周边", "头条"], "text": ""}
{"title": "[连载]Burp Suite详细使用教程-Intruder模块详解(3)", "url": "https://www.freebuf.com/articles/4184.html", "time": "2012-06-18", "level": "", "num_look": 636519, "num_comment": 10, "author": "小冰", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "[发现]韩国黑客电视剧《幽灵》第5集出现的工具", "url": "https://www.freebuf.com/news/others/4179.html", "time": "2012-06-17", "level": "", "num_look": 211328, "num_comment": 12, "author": "douglas", "tags": ["其他", "周边"], "text": ""}
{"title": "暴雷漏洞(CVE-2012-1889)Metasploit利用代码", "url": "https://www.freebuf.com/sectool/4172.html", "time": "2012-06-16", "level": "", "num_look": 227316, "num_comment": 4, "author": "kelz", "tags": ["工具"], "text": ""}
{"title": "字典生成工具", "url": "https://www.freebuf.com/sectool/4086.html", "time": "2012-06-16", "level": "", "num_look": 329425, "num_comment": 1, "author": "leo108", "tags": ["工具"], "text": ""}
{"title": "韩国黑客电视剧《幽灵》第3集出现的工具", "url": "https://www.freebuf.com/news/others/4162.html", "time": "2012-06-16", "level": "", "num_look": 169758, "num_comment": 2, "author": "douglas", "tags": ["其他", "周边"], "text": ""}
{"title": "卡巴斯基专家揭示Flame指令与控制中心架构", "url": "https://www.freebuf.com/news/4161.html", "time": "2012-06-16", "level": "", "num_look": 100945, "num_comment": 100945, "author": "leo108", "tags": ["资讯"], "text": ""}
{"title": "[更新]GPU hash破解工具 - Cryptohaze Multiforcer 1.31a", "url": "https://www.freebuf.com/sectool/4119.html", "time": "2012-06-15", "level": "", "num_look": 217592, "num_comment": 7, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "Intel CPU指令集出现严重漏洞", "url": "https://www.freebuf.com/news/4151.html", "time": "2012-06-15", "level": "", "num_look": 171658, "num_comment": 1, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "WordPress后台密码暴力破解", "url": "https://www.freebuf.com/sectool/4085.html", "time": "2012-06-15", "level": "", "num_look": 446986, "num_comment": 6, "author": "leo108", "tags": ["工具"], "text": ""}
{"title": "web安全训练和教学光盘 - GameOver", "url": "https://www.freebuf.com/sectool/4136.html", "time": "2012-06-15", "level": "", "num_look": 141942, "num_comment": 3, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "PHP 5.4.14 和 5.3.14 发布安全更新", "url": "https://www.freebuf.com/news/4129.html", "time": "2012-06-15", "level": "", "num_look": 140894, "num_comment": 140894, "author": "leo108", "tags": ["资讯"], "text": ""}
{"title": "[更新]挖掘韩国黑客电视剧《幽灵》穿帮镜头", "url": "https://www.freebuf.com/news/others/4087.html", "time": "2012-06-15", "level": "", "num_look": 770333, "num_comment": 69, "author": "匿名用户", "tags": ["其他", "周边"], "text": ""}
{"title": "利用grep查找webshell", "url": "https://www.freebuf.com/articles/4074.html", "time": "2012-06-15", "level": "", "num_look": 311612, "num_comment": 13, "author": "shaun", "tags": ["文章", "系统安全"], "text": ""}
{"title": "微软发行专门针对Flame恶意软件的更新数字证书", "url": "https://www.freebuf.com/news/4114.html", "time": "2012-06-15", "level": "", "num_look": 114228, "num_comment": 114228, "author": "leo108", "tags": ["资讯"], "text": ""}
{"title": "[更新]攻防演练系统 - Metasploitable V2", "url": "https://www.freebuf.com/sectool/4060.html", "time": "2012-06-14", "level": "", "num_look": 330125, "num_comment": 17, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "XSS过滤器 - DeXSS V1.2", "url": "https://www.freebuf.com/sectool/4056.html", "time": "2012-06-14", "level": "", "num_look": 130403, "num_comment": 130403, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "微软：新的IE零日攻击漏洞可劫持Gmail账户", "url": "https://www.freebuf.com/news/4050.html", "time": "2012-06-14", "level": "", "num_look": 99319, "num_comment": 1, "author": "nonozone", "tags": ["资讯"], "text": ""}
{"title": "知道创宇Web安全论坛[第一期]", "url": "https://www.freebuf.com/news/others/4031.html", "time": "2012-06-14", "level": "", "num_look": 186522, "num_comment": 4, "author": "知道创宇", "tags": ["其他", "周边"], "text": ""}
{"title": "Anonymous曝光10000个twitter的oauth token", "url": "https://www.freebuf.com/news/4020.html", "time": "2012-06-13", "level": "", "num_look": 143673, "num_comment": 10, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "[更新]一款非常不错的dll注入器 - RemoteDLL V2", "url": "https://www.freebuf.com/sectool/3970.html", "time": "2012-06-13", "level": "", "num_look": 417298, "num_comment": 4, "author": "kelz", "tags": ["工具"], "text": ""}
{"title": "用来检查CVE-2012-2122漏洞的C程序", "url": "https://www.freebuf.com/sectool/4007.html", "time": "2012-06-13", "level": "", "num_look": 215457, "num_comment": 215457, "author": "leo108", "tags": ["工具"], "text": ""}
{"title": "彩虹表下载地址大集合", "url": "https://www.freebuf.com/sectool/3983.html", "time": "2012-06-13", "level": "", "num_look": 996621, "num_comment": 2, "author": "Crow", "tags": ["工具"], "text": ""}
{"title": "利用Metasploit进行SMB版本的扫描", "url": "https://www.freebuf.com/articles/3948.html", "time": "2012-06-13", "level": "", "num_look": 456264, "num_comment": 5, "author": "谢文东", "tags": ["文章", "系统安全"], "text": ""}
{"title": "[更新]一款强大的远控 - DarkComet RAT V5.3.1", "url": "https://www.freebuf.com/sectool/3957.html", "time": "2012-06-13", "level": "", "num_look": 683260, "num_comment": 15, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "土耳其军队网络遭黑客入侵-官员名单泄漏", "url": "https://www.freebuf.com/news/3950.html", "time": "2012-06-13", "level": "", "num_look": 115452, "num_comment": 115452, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "利用Metasploit辅助模块检测Mysql安全性", "url": "https://www.freebuf.com/articles/3853.html", "time": "2012-06-12", "level": "", "num_look": 447428, "num_comment": 5, "author": "thanks", "tags": ["数据安全", "文章"], "text": ""}
{"title": "MD5破解工具iCrack", "url": "https://www.freebuf.com/sectool/3942.html", "time": "2012-06-12", "level": "", "num_look": 287344, "num_comment": 3, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "Webshell扫描工具WebShellDetector V1.51", "url": "https://www.freebuf.com/sectool/3939.html", "time": "2012-06-12", "level": "", "num_look": 828055, "num_comment": 12, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "[心得]浅析企业内网渗透", "url": "https://www.freebuf.com/articles/3910.html", "time": "2012-06-12", "level": "", "num_look": 267281, "num_comment": 10, "author": "Crow", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "SQL盲注工具-Blind Cat", "url": "https://www.freebuf.com/sectool/3841.html", "time": "2012-06-12", "level": "", "num_look": 363434, "num_comment": 5, "author": "kelz", "tags": ["工具"], "text": ""}
{"title": "[连载]Burp Suite详细使用教程-Intruder模块详解(2)", "url": "https://www.freebuf.com/sectool/3693.html", "time": "2012-06-12", "level": "", "num_look": 1461609, "num_comment": 18, "author": "小冰", "tags": ["WEB安全", "工具"], "text": ""}
{"title": "[更新]Mysql身份认证漏洞及利用(CVE-2012-2122)", "url": "https://www.freebuf.com/vuls/3815.html", "time": "2012-06-11", "level": "", "num_look": 883594, "num_comment": 34, "author": "cs24", "tags": ["漏洞"], "text": ""}
{"title": "携程旅行网招聘安全工程师", "url": "https://www.freebuf.com/jobs/3793.html", "time": "2012-06-11", "level": "", "num_look": 161785, "num_comment": 13, "author": "匿名用户", "tags": ["安全招聘"], "text": ""}
{"title": "破解你的密码需要多长时间？", "url": "https://www.freebuf.com/articles/3788.html", "time": "2012-06-11", "level": "", "num_look": 578880, "num_comment": 11, "author": "匿名用户", "tags": ["数据安全", "文章"], "text": ""}
{"title": "[学习笔记]WireShark Filter应用简介", "url": "https://www.freebuf.com/articles/3767.html", "time": "2012-06-11", "level": "", "num_look": 330093, "num_comment": 2, "author": "darkray", "tags": ["文章", "无线安全"], "text": ""}
{"title": "Brup Suite应用分享之Web漏洞扫描", "url": "https://www.freebuf.com/articles/3677.html", "time": "2012-06-11", "level": "", "num_look": 269060, "num_comment": 6, "author": "Crow", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "入侵检测系统-Suricata 1.3 Beta2 发布", "url": "https://www.freebuf.com/sectool/3778.html", "time": "2012-06-11", "level": "", "num_look": 149564, "num_comment": 149564, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "[更新]Webvulscan 0.12– web应用漏洞黑盒扫描器", "url": "https://www.freebuf.com/sectool/3743.html", "time": "2012-06-11", "level": "", "num_look": 194828, "num_comment": 6, "author": "kelz", "tags": ["工具"], "text": ""}
{"title": "社交网站Tumblr被发现严重跨站漏洞，可被用来传播xss蠕虫", "url": "https://www.freebuf.com/news/3755.html", "time": "2012-06-11", "level": "", "num_look": 114535, "num_comment": 2, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "美国机器人生产公司Robot Coupe遭黑客攻击，大批数据泄露", "url": "https://www.freebuf.com/news/3748.html", "time": "2012-06-11", "level": "", "num_look": 127928, "num_comment": 2, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "浏览器漏洞利用框架BeEF 0.4.3.5 Released", "url": "https://www.freebuf.com/sectool/3688.html", "time": "2012-06-10", "level": "", "num_look": 264758, "num_comment": 264758, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "Freebuf安全周刊2012年6月4日-6月9日", "url": "https://www.freebuf.com/news/others/3672.html", "time": "2012-06-09", "level": "", "num_look": 115591, "num_comment": 115591, "author": "root", "tags": ["其他", "周边"], "text": ""}
{"title": "百度旗下网站目录遍历漏洞", "url": "https://www.freebuf.com/vuls/3664.html", "time": "2012-06-08", "level": "", "num_look": 157169, "num_comment": 9, "author": "南国利剑", "tags": ["漏洞"], "text": ""}
{"title": "LinkedIn泄露密码相关统计", "url": "https://www.freebuf.com/news/3655.html", "time": "2012-06-08", "level": "", "num_look": 129318, "num_comment": 3, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "托尔斯泰狄更斯帮助破译加密密码", "url": "https://www.freebuf.com/news/3650.html", "time": "2012-06-08", "level": "", "num_look": 97908, "num_comment": 97908, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "追溯@潘石屹-潘总数次使用微博评论导致网友隐私泄露的根源", "url": "https://www.freebuf.com/articles/3640.html", "time": "2012-06-08", "level": "", "num_look": 208858, "num_comment": 2, "author": "匿名人士", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "关于渗透的一些资料分享", "url": "https://www.freebuf.com/articles/3603.html", "time": "2012-06-08", "level": "", "num_look": 553164, "num_comment": 9, "author": "darkray", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "BT5字典生成工具包 - Thad0ctor's 1.0", "url": "https://www.freebuf.com/sectool/3629.html", "time": "2012-06-08", "level": "", "num_look": 285938, "num_comment": 1, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "Web Form扫描器 - LiLith", "url": "https://www.freebuf.com/sectool/3622.html", "time": "2012-06-08", "level": "", "num_look": 130433, "num_comment": 1, "author": "葙守", "tags": ["工具"], "text": ""}
{"title": "Last.fm用户密码泄露 官方称正在调查", "url": "https://www.freebuf.com/news/3616.html", "time": "2012-06-08", "level": "", "num_look": 109905, "num_comment": 2, "author": "Mystery", "tags": ["资讯"], "text": ""}
{"title": "如何利用Metasploit制造一个键盘窃听网站", "url": "https://www.freebuf.com/articles/3549.html", "time": "2012-06-08", "level": "", "num_look": 366897, "num_comment": 9, "author": "thanks", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "[个人心得]渗透测试的一些总结", "url": "https://www.freebuf.com/articles/3562.html", "time": "2012-06-08", "level": "", "num_look": 750509, "num_comment": 15, "author": "darkray", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "美国相亲网站eHarmony步LinkedIn后尘-密码大规模泄露", "url": "https://www.freebuf.com/news/3529.html", "time": "2012-06-07", "level": "", "num_look": 151895, "num_comment": 3, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "Dreamweaver密码解密恢复软件 - DreamweaverPasswordDecryptor 1.5", "url": "https://www.freebuf.com/sectool/3521.html", "time": "2012-06-07", "level": "", "num_look": 154957, "num_comment": 154957, "author": "kelz", "tags": ["工具"], "text": ""}
{"title": "[Python脚本]Admin Finder管理后台扫描工具", "url": "https://www.freebuf.com/sectool/3503.html", "time": "2012-06-07", "level": "", "num_look": 342318, "num_comment": 6, "author": "thanks", "tags": ["工具"], "text": ""}
{"title": "网络安全侦察工具Firewalking", "url": "https://www.freebuf.com/sectool/3498.html", "time": "2012-06-07", "level": "", "num_look": 186054, "num_comment": 2, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "GPU hash破解工具- Extreme GPU Bruteforcer 2.2", "url": "https://www.freebuf.com/sectool/3492.html", "time": "2012-06-07", "level": "", "num_look": 209264, "num_comment": 6, "author": "kelz", "tags": ["工具"], "text": ""}
{"title": "Flame利用哈希碰撞攻击伪造微软CA证书", "url": "https://www.freebuf.com/news/3482.html", "time": "2012-06-07", "level": "", "num_look": 331467, "num_comment": 12, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "谷歌发新警告：当心政府资助的攻击", "url": "https://www.freebuf.com/news/3465.html", "time": "2012-06-06", "level": "", "num_look": 109316, "num_comment": 109316, "author": "cyberpolice", "tags": ["资讯"], "text": ""}
{"title": "[快讯]LinkedIn 646万用户密码网上泄露及下载地址(更新)", "url": "https://www.freebuf.com/news/3443.html", "time": "2012-06-06", "level": "", "num_look": 319487, "num_comment": 17, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "LinkedIn应用被曝明文上传用户账号密码信息", "url": "https://www.freebuf.com/news/3433.html", "time": "2012-06-06", "level": "", "num_look": 111063, "num_comment": 3, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "﻿﻿国外黑客组织UGNazi曲折入侵4chan过程", "url": "https://www.freebuf.com/news/3423.html", "time": "2012-06-06", "level": "", "num_look": 183947, "num_comment": 11, "author": "cs24", "tags": ["资讯"], "text": ""}
{"title": "超级火焰(flame)最新病毒样本下载-解压共31M", "url": "https://www.freebuf.com/news/others/3409.html", "time": "2012-06-06", "level": "", "num_look": 478452, "num_comment": 12, "author": "匿名用户", "tags": ["其他", "周边"], "text": ""}
{"title": "web渗透测试套件-WebSploit 1.8", "url": "https://www.freebuf.com/sectool/3399.html", "time": "2012-06-06", "level": "", "num_look": 368648, "num_comment": 7, "author": "kelz", "tags": ["工具"], "text": ""}
{"title": "破解工具包-cyb3rjunk13", "url": "https://www.freebuf.com/sectool/3395.html", "time": "2012-06-06", "level": "", "num_look": 186251, "num_comment": 1, "author": "kelz", "tags": ["工具"], "text": ""}
{"title": "自动化渗透测试脚本Discover", "url": "https://www.freebuf.com/sectool/3390.html", "time": "2012-06-06", "level": "", "num_look": 182101, "num_comment": 182101, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "[技巧]Burp Intruder中的Timing选项的使用", "url": "https://www.freebuf.com/sectool/3369.html", "time": "2012-06-06", "level": "", "num_look": 202930, "num_comment": 1, "author": "pnig0s", "tags": ["工具"], "text": ""}
{"title": "超级火焰病毒Flame被设计专门窃取图纸等文件", "url": "https://www.freebuf.com/news/3347.html", "time": "2012-06-05", "level": "", "num_look": 124076, "num_comment": 1, "author": "shaun", "tags": ["资讯"], "text": ""}
{"title": "WordPress 3.3.2存储型跨站漏洞", "url": "https://www.freebuf.com/vuls/3323.html", "time": "2012-06-05", "level": "", "num_look": 182983, "num_comment": 4, "author": "minminmsn", "tags": ["漏洞"], "text": ""}
{"title": "[资源分享]国外常见密码列表大集合(1)", "url": "https://www.freebuf.com/articles/3311.html", "time": "2012-06-05", "level": "", "num_look": 410687, "num_comment": 8, "author": "flowing", "tags": ["数据安全", "文章"], "text": ""}
{"title": "PostgreSQL发布全系重要安全补丁", "url": "https://www.freebuf.com/news/3292.html", "time": "2012-06-05", "level": "", "num_look": 111464, "num_comment": 111464, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "PDF恶意文档分析-PDFScope", "url": "https://www.freebuf.com/sectool/3283.html", "time": "2012-06-05", "level": "", "num_look": 160962, "num_comment": 160962, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "下一代模糊测试框架 - Dizzy", "url": "https://www.freebuf.com/sectool/3275.html", "time": "2012-06-05", "level": "", "num_look": 186613, "num_comment": 2, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "CactiEZ 中文版snmp默认团体名漏洞", "url": "https://www.freebuf.com/vuls/3208.html", "time": "2012-06-04", "level": "", "num_look": 240893, "num_comment": 4, "author": "南国利剑", "tags": ["漏洞"], "text": ""}
{"title": "微软发布重要安全公告，解决最新发现的非授权数字证书问题。请及时安装最新补丁！", "url": "https://www.freebuf.com/news/3209.html", "time": "2012-06-04", "level": "", "num_look": 128419, "num_comment": 2, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "超级火焰病毒(Flame)允许蓝牙访问", "url": "https://www.freebuf.com/news/3195.html", "time": "2012-06-04", "level": "", "num_look": 124618, "num_comment": 124618, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "美国华盛顿大学和费城大学遭黑客入侵，大量数据泄露！", "url": "https://www.freebuf.com/news/3191.html", "time": "2012-06-04", "level": "", "num_look": 133477, "num_comment": 1, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "[嗅探神器]Intercepter,支持当前所有流行OS", "url": "https://www.freebuf.com/sectool/3175.html", "time": "2012-06-04", "level": "", "num_look": 473741, "num_comment": 8, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "跨域Math.random()随机数预测攻击技术", "url": "https://www.freebuf.com/articles/3005.html", "time": "2012-06-04", "level": "", "num_look": 286745, "num_comment": 3, "author": "pnig0s", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "SQL数据库安全审计工具-xSQL Scanner1.6", "url": "https://www.freebuf.com/sectool/3161.html", "time": "2012-06-04", "level": "", "num_look": 182735, "num_comment": 2, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "[快讯]中国大量政府网站数据泄露-国外黑客组织对中国发动网络战！", "url": "https://www.freebuf.com/news/3086.html", "time": "2012-06-04", "level": "", "num_look": 362450, "num_comment": 8, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "freebuf安全周刊2012年5月28日-6月3日", "url": "https://www.freebuf.com/news/others/3151.html", "time": "2012-06-04", "level": "", "num_look": 143525, "num_comment": 2, "author": "root", "tags": ["其他", "周边"], "text": ""}
{"title": "pWebSuite-基于Perl的Web应用渗透测试套件", "url": "https://www.freebuf.com/sectool/3122.html", "time": "2012-06-03", "level": "", "num_look": 251115, "num_comment": 251115, "author": "pnig0s", "tags": ["工具"], "text": ""}
{"title": "暴力破解工具-Hydra 7.3 windows版本", "url": "https://www.freebuf.com/sectool/3106.html", "time": "2012-06-02", "level": "", "num_look": 1277073, "num_comment": 13, "author": "unshell", "tags": ["工具"], "text": ""}
{"title": "开源数字调查/取证工具 - Sleuth Kit v4.0.0 Beta1", "url": "https://www.freebuf.com/sectool/3097.html", "time": "2012-06-02", "level": "", "num_look": 174761, "num_comment": 174761, "author": "chx4", "tags": ["工具"], "text": ""}
{"title": "[0Day发布]PostgreSQL基于错误XML外部实体攻击", "url": "https://www.freebuf.com/vuls/3036.html", "time": "2012-06-02", "level": "", "num_look": 184911, "num_comment": 7, "author": "thanks", "tags": ["漏洞"], "text": ""}
{"title": "Google收录的敏感词列表还原", "url": "https://www.freebuf.com/news/3000.html", "time": "2012-06-01", "level": "", "num_look": 163957, "num_comment": 163957, "author": "gooooogle", "tags": ["资讯"], "text": ""}
{"title": "Flash跨域策略文件crossdomain.xml安全配置详解", "url": "https://www.freebuf.com/articles/2950.html", "time": "2012-06-01", "level": "", "num_look": 256356, "num_comment": 5, "author": "badz衰仔", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "[技术挑战]记事狗2.5.0鸡肋注入漏洞", "url": "https://www.freebuf.com/vuls/2935.html", "time": "2012-06-01", "level": "", "num_look": 166614, "num_comment": 2, "author": "匿名用户", "tags": ["漏洞"], "text": ""}
{"title": "[更新-目前网络最全]超级火焰Flame病毒样本下载", "url": "https://www.freebuf.com/news/2913.html", "time": "2012-06-01", "level": "", "num_look": 380154, "num_comment": 17, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "Freebuf与腾讯安全中心(TSRC)建立合作伙伴关系", "url": "https://www.freebuf.com/news/2784.html", "time": "2012-06-01", "level": "", "num_look": 252128, "num_comment": 18, "author": "root", "tags": ["其他", "周边"], "text": ""}
{"title": "Web漏洞检查工具Wapiti", "url": "https://www.freebuf.com/sectool/2871.html", "time": "2012-06-01", "level": "", "num_look": 420903, "num_comment": 1, "author": "熙雅", "tags": ["工具"], "text": ""}
{"title": "腾讯在线漏洞反馈平台暨漏洞奖励计划一期上线", "url": "https://www.freebuf.com/news/2750.html", "time": "2012-06-01", "level": "", "num_look": 201601, "num_comment": 2, "author": "腾讯安全平台部", "tags": ["周边", "资讯"], "text": ""}
{"title": "美国海军军方官网被黑，批量数据泄露", "url": "https://www.freebuf.com/news/2877.html", "time": "2012-06-01", "level": "", "num_look": 127450, "num_comment": 127450, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "Flame(超级火焰)病毒清除工具以及手工清除方法", "url": "https://www.freebuf.com/sectool/2776.html", "time": "2012-05-31", "level": "", "num_look": 172817, "num_comment": 1, "author": "南国利剑", "tags": ["工具"], "text": ""}
{"title": "隐藏IP软件-Hide My IP 5.3", "url": "https://www.freebuf.com/sectool/2766.html", "time": "2012-05-31", "level": "", "num_look": 256484, "num_comment": 2, "author": "flowing", "tags": ["工具"], "text": ""}
{"title": "中国工程师承认窃取纽约联储软件源代码", "url": "https://www.freebuf.com/news/2760.html", "time": "2012-05-31", "level": "", "num_look": 99186, "num_comment": 1, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "美资上市网络安全公司招聘资深linux开发和QA测试工程师", "url": "https://www.freebuf.com/jobs/2724.html", "time": "2012-05-31", "level": "", "num_look": 195250, "num_comment": 7, "author": "老毕", "tags": ["安全招聘"], "text": ""}
{"title": "密码爆破工具-Medusa 2.1.1发布", "url": "https://www.freebuf.com/sectool/2723.html", "time": "2012-05-31", "level": "", "num_look": 611436, "num_comment": 10, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "杭州安恒诚聘安全攻城师若干", "url": "https://www.freebuf.com/jobs/2666.html", "time": "2012-05-31", "level": "", "num_look": 165191, "num_comment": 6, "author": "匿名用户", "tags": ["安全招聘"], "text": ""}
{"title": "最新工业病毒Flame（超级火焰）简介", "url": "https://www.freebuf.com/news/2698.html", "time": "2012-05-31", "level": "", "num_look": 202798, "num_comment": 2, "author": "pnig0s", "tags": ["资讯"], "text": ""}
{"title": "Web服务器文件监控平台-Falcon", "url": "https://www.freebuf.com/sectool/2682.html", "time": "2012-05-30", "level": "", "num_look": 248444, "num_comment": 5, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "大规模wep/wpa破解工具 - wifite v2发布", "url": "https://www.freebuf.com/sectool/2633.html", "time": "2012-05-30", "level": "", "num_look": 452629, "num_comment": 452629, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "自动化中间人攻击工具 - subterfuge 3.0发布", "url": "https://www.freebuf.com/sectool/2629.html", "time": "2012-05-30", "level": "", "num_look": 184772, "num_comment": 184772, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "ruby写的SQL注入工具-sqlcake 1.1 发布", "url": "https://www.freebuf.com/sectool/2620.html", "time": "2012-05-30", "level": "", "num_look": 167014, "num_comment": 167014, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "卡巴斯基称发现新Stuxnet病毒Flame（超级火焰）", "url": "https://www.freebuf.com/news/2608.html", "time": "2012-05-30", "level": "", "num_look": 226221, "num_comment": 4, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "浅谈web指纹识别技术", "url": "https://www.freebuf.com/articles/2555.html", "time": "2012-05-30", "level": "", "num_look": 2460363, "num_comment": 28, "author": "kelz", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "透明可扩展的SSL调试工具 - SSLsplit", "url": "https://www.freebuf.com/sectool/2601.html", "time": "2012-05-30", "level": "", "num_look": 225652, "num_comment": 225652, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "公布一些后门网址", "url": "https://www.freebuf.com/vuls/2598.html", "time": "2012-05-30", "level": "", "num_look": 246526, "num_comment": 246526, "author": "匿名用户", "tags": ["漏洞"], "text": ""}
{"title": "在线订单站的一些渗透思路和后门", "url": "https://www.freebuf.com/articles/2547.html", "time": "2012-05-29", "level": "", "num_look": 199960, "num_comment": 6, "author": "黑面", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "卡巴斯基：发现强大的新型木马间谍程序", "url": "https://www.freebuf.com/news/2542.html", "time": "2012-05-29", "level": "", "num_look": 112887, "num_comment": 112887, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "Wireshark1.6.8 Released", "url": "https://www.freebuf.com/sectool/2537.html", "time": "2012-05-29", "level": "", "num_look": 154561, "num_comment": 154561, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "中国制造的芯片含有“后门”？", "url": "https://www.freebuf.com/news/2530.html", "time": "2012-05-29", "level": "", "num_look": 148766, "num_comment": 2, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "[TOP10]最受欢迎的10个Metasploit模块和插件", "url": "https://www.freebuf.com/sectool/2521.html", "time": "2012-05-29", "level": "", "num_look": 513341, "num_comment": 10, "author": "thanks", "tags": ["工具"], "text": ""}
{"title": "Post Exploitation工具 - PowerSploit", "url": "https://www.freebuf.com/sectool/2514.html", "time": "2012-05-29", "level": "", "num_look": 168390, "num_comment": 168390, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "Post Exploitation工具 - PhantomJS", "url": "https://www.freebuf.com/sectool/2508.html", "time": "2012-05-29", "level": "", "num_look": 145312, "num_comment": 145312, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "Web压力测试工具 JMeter 2.7 发布", "url": "https://www.freebuf.com/sectool/2504.html", "time": "2012-05-29", "level": "", "num_look": 148779, "num_comment": 148779, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "PDF密码删除工具-InstantPDFPasswordRemover v1.0", "url": "https://www.freebuf.com/sectool/2497.html", "time": "2012-05-28", "level": "", "num_look": 156692, "num_comment": 1, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "从低级漏洞到获得权限:Honorable Mention Open NFS", "url": "https://www.freebuf.com/articles/2472.html", "time": "2012-05-28", "level": "", "num_look": 267301, "num_comment": 5, "author": "pnig0s", "tags": ["文章", "系统安全"], "text": ""}
{"title": "配置Apache防止webshell上传", "url": "https://www.freebuf.com/articles/2465.html", "time": "2012-05-28", "level": "", "num_look": 254420, "num_comment": 6, "author": "leehenwu", "tags": ["文章", "系统安全"], "text": ""}
{"title": "绿毒大哥:我只是打酱油的,要感谢的是pod2g等人", "url": "https://www.freebuf.com/news/2455.html", "time": "2012-05-28", "level": "", "num_look": 359611, "num_comment": 359611, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "[技巧]使用Burpsuite辅助Sqlmap进行POST注入测试", "url": "https://www.freebuf.com/sectool/2311.html", "time": "2012-05-28", "level": "", "num_look": 2736598, "num_comment": 19, "author": "thanks", "tags": ["工具"], "text": ""}
{"title": "Iptables 1.4.14 发布", "url": "https://www.freebuf.com/news/2437.html", "time": "2012-05-27", "level": "", "num_look": 101772, "num_comment": 101772, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "[黑产创意无限]Discuz发布安全补丁包X2.5 R20120518", "url": "https://www.freebuf.com/news/2403.html", "time": "2012-05-27", "level": "", "num_look": 130482, "num_comment": 2, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "FreebuF.COM会员等级及头衔制度说明", "url": "https://www.freebuf.com/news/others/2362.html", "time": "2012-05-26", "level": "", "num_look": 171890, "num_comment": 8, "author": "root", "tags": ["其他", "周边"], "text": ""}
{"title": "freebuf安全周刊2012年5月21日-5月25日", "url": "https://www.freebuf.com/news/2335.html", "time": "2012-05-26", "level": "", "num_look": 96532, "num_comment": 96532, "author": "root", "tags": ["资讯"], "text": ""}
{"title": "[更新]iOS 5.1.1越狱程序Absinthe 2.0.2正式发布下载", "url": "https://www.freebuf.com/news/2334.html", "time": "2012-05-26", "level": "", "num_look": 111072, "num_comment": 2, "author": "flowing", "tags": ["资讯"], "text": ""}
{"title": "美国新泽西一市长及儿子因非法攻击网站被捕", "url": "https://www.freebuf.com/news/2230.html", "time": "2012-05-25", "level": "", "num_look": 127100, "num_comment": 2, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "[精华收集]php漏洞挖掘书籍pdf", "url": "https://www.freebuf.com/articles/2202.html", "time": "2012-05-25", "level": "", "num_look": 483438, "num_comment": 18, "author": "葙守", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "英国最大的域名提供商遭受中国黑客攻击", "url": "https://www.freebuf.com/news/2194.html", "time": "2012-05-25", "level": "", "num_look": 115023, "num_comment": 1, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "在IPhone/IPad上建立反弹后门", "url": "https://www.freebuf.com/articles/2158.html", "time": "2012-05-25", "level": "", "num_look": 356086, "num_comment": 10, "author": "thanks", "tags": ["文章", "终端安全"], "text": ""}
{"title": "Burp Suite python扩展 - Burpy", "url": "https://www.freebuf.com/sectool/2170.html", "time": "2012-05-25", "level": "", "num_look": 657039, "num_comment": 5, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "Burp Suite详细使用教程-Intruder模块详解", "url": "https://www.freebuf.com/sectool/2079.html", "time": "2012-05-25", "level": "", "num_look": 3438571, "num_comment": 38, "author": "小冰", "tags": ["工具"], "text": ""}
{"title": "360安全漏洞响应平台上线 提交漏洞可获奖励", "url": "https://www.freebuf.com/news/2130.html", "time": "2012-05-24", "level": "", "num_look": 196106, "num_comment": 7, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "[揭秘]卡扎菲的专属黑客部队", "url": "https://www.freebuf.com/news/2061.html", "time": "2012-05-24", "level": "", "num_look": 138353, "num_comment": 3, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "CSRF漏洞利用/测试工具 - CSRF Request Builder", "url": "https://www.freebuf.com/sectool/2056.html", "time": "2012-05-24", "level": "", "num_look": 360297, "num_comment": 2, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "绿盟科技(南京)招聘web安全工程师", "url": "https://www.freebuf.com/jobs/2021.html", "time": "2012-05-24", "level": "", "num_look": 169115, "num_comment": 5, "author": "Nsfocus", "tags": ["安全招聘"], "text": ""}
{"title": "Ph4nt0m Webzine 0x07 Call for Papers", "url": "https://www.freebuf.com/news/others/2023.html", "time": "2012-05-23", "level": "", "num_look": 138793, "num_comment": 3, "author": "匿名用户", "tags": ["其他", "周边"], "text": ""}
{"title": "xFungfoo2012安全会议真诚邀请您的参与", "url": "https://www.freebuf.com/news/2015.html", "time": "2012-05-23", "level": "", "num_look": 149989, "num_comment": 6, "author": "xFungfoo", "tags": ["周边", "资讯"], "text": ""}
{"title": "支付宝招聘安全策略专家/安全应用架构师", "url": "https://www.freebuf.com/jobs/1961.html", "time": "2012-05-23", "level": "", "num_look": 188033, "num_comment": 4, "author": "匿名用户", "tags": ["安全招聘"], "text": ""}
{"title": "[新思路]Flash ExternalInterface函数导致的XSS", "url": "https://www.freebuf.com/articles/2001.html", "time": "2012-05-23", "level": "", "num_look": 226633, "num_comment": 2, "author": "匿名用户", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "研究人员发现移动蜂窝网络安全漏洞", "url": "https://www.freebuf.com/news/1991.html", "time": "2012-05-23", "level": "", "num_look": 114576, "num_comment": 1, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "WHMCS官网被入侵,1.7GB数据被泄露#UGNazi", "url": "https://www.freebuf.com/news/1986.html", "time": "2012-05-23", "level": "", "num_look": 192814, "num_comment": 14, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "[合集]CMS渗透测试工具", "url": "https://www.freebuf.com/sectool/1973.html", "time": "2012-05-23", "level": "", "num_look": 493830, "num_comment": 4, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "phpcodegen-library[php生成shellcode函数库]", "url": "https://www.freebuf.com/sectool/1941.html", "time": "2012-05-22", "level": "", "num_look": 174120, "num_comment": 174120, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "《暗黑3》疑遭黑客攻击 SQL注入致玩家被洗劫", "url": "https://www.freebuf.com/news/1930.html", "time": "2012-05-22", "level": "", "num_look": 97242, "num_comment": 97242, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "关于bom.php", "url": "https://www.freebuf.com/articles/1919.html", "time": "2012-05-22", "level": "", "num_look": 195886, "num_comment": 1, "author": "匿名用户", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "无线破解工具Wifislax 4.1发布", "url": "https://www.freebuf.com/sectool/1905.html", "time": "2012-05-22", "level": "", "num_look": 569281, "num_comment": 4, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "通用漏洞报告模板 (CVRF) v1.1", "url": "https://www.freebuf.com/sectool/1900.html", "time": "2012-05-22", "level": "", "num_look": 219687, "num_comment": 219687, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "网络安全审计工具 Nmap 6 正式版发布，支持 IPv6", "url": "https://www.freebuf.com/sectool/1895.html", "time": "2012-05-22", "level": "", "num_look": 172915, "num_comment": 2, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "通过Zend目录权限不严获取执行权限", "url": "https://www.freebuf.com/articles/1885.html", "time": "2012-05-21", "level": "", "num_look": 154991, "num_comment": 1, "author": "匿名用户", "tags": ["文章", "系统安全"], "text": ""}
{"title": "[升级]freebuf首页增加聚合展示功能", "url": "https://www.freebuf.com/news/others/1866.html", "time": "2012-05-21", "level": "", "num_look": 107616, "num_comment": 3, "author": "root", "tags": ["其他", "周边"], "text": ""}
{"title": "freebuf安全周刊2012年5月14日-5月18日", "url": "https://www.freebuf.com/news/others/1815.html", "time": "2012-05-21", "level": "", "num_look": 103857, "num_comment": 103857, "author": "root", "tags": ["周边", "头条"], "text": ""}
{"title": "日本将举行全国黑客大赛", "url": "https://www.freebuf.com/news/1855.html", "time": "2012-05-21", "level": "", "num_look": 132575, "num_comment": 4, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "Wordpress跨站脚本漏洞", "url": "https://www.freebuf.com/vuls/1850.html", "time": "2012-05-21", "level": "", "num_look": 428348, "num_comment": 428348, "author": "匿名用户", "tags": ["漏洞"], "text": ""}
{"title": "黑客组织Pak Cyber Pyrates入侵印度约4000+网站", "url": "https://www.freebuf.com/news/1844.html", "time": "2012-05-21", "level": "", "num_look": 136302, "num_comment": 136302, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "Web服务器压力测试工具 - HULK", "url": "https://www.freebuf.com/sectool/1833.html", "time": "2012-05-21", "level": "", "num_look": 653330, "num_comment": 13, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "Web表单破解工具 - Brute Forcer v1.1", "url": "https://www.freebuf.com/sectool/1804.html", "time": "2012-05-21", "level": "", "num_look": 255187, "num_comment": 2, "author": "unshell", "tags": ["工具"], "text": ""}
{"title": "PHP 5.4 Win32 Code Execution", "url": "https://www.freebuf.com/articles/1806.html", "time": "2012-05-21", "level": "", "num_look": 180643, "num_comment": 180643, "author": "shaun", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "XOIC DDOS压力测试工具", "url": "https://www.freebuf.com/sectool/1778.html", "time": "2012-05-20", "level": "", "num_look": 1168958, "num_comment": 3, "author": "unshell", "tags": ["工具"], "text": ""}
{"title": "JavaScript注入攻击", "url": "https://www.freebuf.com/articles/1789.html", "time": "2012-05-19", "level": "", "num_look": 195320, "num_comment": 1, "author": "匿名用户", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "中兴公司证实手机后门", "url": "https://www.freebuf.com/news/1786.html", "time": "2012-05-19", "level": "", "num_look": 115652, "num_comment": 115652, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "暴力破解工具THC-Hydra V6.0 WIN版", "url": "https://www.freebuf.com/sectool/1749.html", "time": "2012-05-19", "level": "", "num_look": 450954, "num_comment": 11, "author": "unshell", "tags": ["工具"], "text": ""}
{"title": "匿名组织异议者声称对DDoS海盗湾负责", "url": "https://www.freebuf.com/news/1744.html", "time": "2012-05-18", "level": "", "num_look": 103489, "num_comment": 103489, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "台服暗黑3现账号漏洞无限刷KEY 玩家需警惕", "url": "https://www.freebuf.com/news/1737.html", "time": "2012-05-18", "level": "", "num_look": 108598, "num_comment": 2, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "入侵检测系统 Snort 2.9.2.3 发布", "url": "https://www.freebuf.com/sectool/1725.html", "time": "2012-05-18", "level": "", "num_look": 213232, "num_comment": 213232, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "[Quarks PwDump]Hash dump神器", "url": "https://www.freebuf.com/sectool/1706.html", "time": "2012-05-18", "level": "", "num_look": 600832, "num_comment": 6, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "全球黑客攻击来源报告：中国占13.7%，和美国仍是全球两大黑客事件发源地", "url": "https://www.freebuf.com/news/1721.html", "time": "2012-05-18", "level": "", "num_look": 130089, "num_comment": 2, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "TrueCrypt破解工具 - truecrack", "url": "https://www.freebuf.com/sectool/1717.html", "time": "2012-05-18", "level": "", "num_look": 231318, "num_comment": 231318, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "[技术剖析]由“网路岗可截获QQ密码和聊天记录”谈起", "url": "https://www.freebuf.com/articles/1698.html", "time": "2012-05-17", "level": "", "num_look": 400714, "num_comment": 2, "author": "匿名用户", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "海盗湾因DDoS攻击下线", "url": "https://www.freebuf.com/news/1694.html", "time": "2012-05-17", "level": "", "num_look": 111239, "num_comment": 111239, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "自毁SSD能物理毁灭所有数据", "url": "https://www.freebuf.com/news/1690.html", "time": "2012-05-17", "level": "", "num_look": 152709, "num_comment": 152709, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "Guile可以用于编写exploit测试代码", "url": "https://www.freebuf.com/articles/1682.html", "time": "2012-05-17", "level": "", "num_look": 155132, "num_comment": 155132, "author": "匿名用户", "tags": ["文章", "系统安全"], "text": ""}
{"title": "安圭拉政府网站遭黑客组织UGNazi入侵", "url": "https://www.freebuf.com/news/1678.html", "time": "2012-05-17", "level": "", "num_look": 110892, "num_comment": 110892, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "防0day工具 EMET V3官方发布", "url": "https://www.freebuf.com/sectool/1664.html", "time": "2012-05-17", "level": "", "num_look": 134505, "num_comment": 3, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "[含POC]TFTP服务器读请求远程溢出漏洞", "url": "https://www.freebuf.com/vuls/1658.html", "time": "2012-05-17", "level": "", "num_look": 151634, "num_comment": 151634, "author": "匿名用户", "tags": ["漏洞"], "text": ""}
{"title": "技术剖析：安全浏览器真的安全吗？", "url": "https://www.freebuf.com/articles/1630.html", "time": "2012-05-17", "level": "", "num_look": 172946, "num_comment": 3, "author": "匿名用户", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "菲律宾电视台网站被黑", "url": "https://www.freebuf.com/news/1615.html", "time": "2012-05-16", "level": "", "num_look": 116308, "num_comment": 116308, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "python的常见命令注入威胁", "url": "https://www.freebuf.com/articles/1610.html", "time": "2012-05-16", "level": "", "num_look": 155023, "num_comment": 155023, "author": "shaun", "tags": ["文章", "系统安全"], "text": ""}
{"title": "php的代码混淆工具-carbylamine", "url": "https://www.freebuf.com/sectool/1606.html", "time": "2012-05-16", "level": "", "num_look": 374589, "num_comment": 2, "author": "sn0rt", "tags": ["工具"], "text": ""}
{"title": "web-sorrow - 远程网络安全扫描器(枚举/版本检测等)", "url": "https://www.freebuf.com/sectool/1599.html", "time": "2012-05-16", "level": "", "num_look": 171591, "num_comment": 171591, "author": "sn0rt", "tags": ["工具"], "text": ""}
{"title": "DNS加密工具发布Windows版", "url": "https://www.freebuf.com/sectool/1591.html", "time": "2012-05-16", "level": "", "num_look": 206333, "num_comment": 1, "author": "flowing", "tags": ["工具"], "text": ""}
{"title": "JWPlayer Xss 0day [Flash编程安全问题]", "url": "https://www.freebuf.com/vuls/1577.html", "time": "2012-05-16", "level": "", "num_look": 277195, "num_comment": 1, "author": "匿名用户", "tags": ["漏洞"], "text": ""}
{"title": "解码GWT小工具-degwt", "url": "https://www.freebuf.com/sectool/1570.html", "time": "2012-05-16", "level": "", "num_look": 163016, "num_comment": 163016, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "研究人员用病毒产生电", "url": "https://www.freebuf.com/news/1561.html", "time": "2012-05-15", "level": "", "num_look": 100543, "num_comment": 100543, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "OWASP上海技术沙龙 (2012年第二期)", "url": "https://www.freebuf.com/news/others/1527.html", "time": "2012-05-15", "level": "", "num_look": 130792, "num_comment": 1, "author": "匿名用户", "tags": ["其他", "周边"], "text": ""}
{"title": "CrackDB 数据库破解工具", "url": "https://www.freebuf.com/sectool/1509.html", "time": "2012-05-15", "level": "", "num_look": 229636, "num_comment": 1, "author": "gyreg", "tags": ["工具"], "text": ""}
{"title": "大街网反弹and存储型XSS漏洞及测试Payload", "url": "https://www.freebuf.com/vuls/1506.html", "time": "2012-05-15", "level": "", "num_look": 444131, "num_comment": 26, "author": "pnig0s", "tags": ["漏洞"], "text": ""}
{"title": "黑客入侵美国华盛顿军事部网站导致数据泄露", "url": "https://www.freebuf.com/news/1499.html", "time": "2012-05-15", "level": "", "num_look": 110270, "num_comment": 1, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "永远不要放进数据库里的三样东西", "url": "https://www.freebuf.com/articles/1474.html", "time": "2012-05-15", "level": "", "num_look": 318258, "num_comment": 2, "author": "cnlink", "tags": ["数据安全", "文章"], "text": ""}
{"title": "Webvulscan - web应用漏洞黑盒扫描器", "url": "https://www.freebuf.com/sectool/1466.html", "time": "2012-05-15", "level": "", "num_look": 344906, "num_comment": 12, "author": "unshell", "tags": ["工具"], "text": ""}
{"title": "Burpsuite系列视频教程不加密版第一部分公布下载", "url": "https://www.freebuf.com/articles/1467.html", "time": "2012-05-15", "level": "", "num_look": 250559, "num_comment": 8, "author": "匿名用户", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "中兴手机被发现有后门", "url": "https://www.freebuf.com/news/1458.html", "time": "2012-05-14", "level": "", "num_look": 149610, "num_comment": 5, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "Adobe让步 将为上代软件提供安全更新", "url": "https://www.freebuf.com/news/1453.html", "time": "2012-05-14", "level": "", "num_look": 116901, "num_comment": 2, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "开放式漏洞评估系统OpenVAS 5发布", "url": "https://www.freebuf.com/sectool/1442.html", "time": "2012-05-14", "level": "", "num_look": 232052, "num_comment": 1, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "逆向模拟通信工具-netzob 0.3.2", "url": "https://www.freebuf.com/sectool/1439.html", "time": "2012-05-14", "level": "", "num_look": 184778, "num_comment": 184778, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "SQL注入工具 - sqlcake", "url": "https://www.freebuf.com/sectool/1419.html", "time": "2012-05-14", "level": "", "num_look": 176507, "num_comment": 1, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "windows错误代码查询-Windows Error Lookup Tool", "url": "https://www.freebuf.com/sectool/1417.html", "time": "2012-05-14", "level": "", "num_look": 172154, "num_comment": 172154, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "freebuf安全周刊2012年5月7日-5月11日", "url": "https://www.freebuf.com/news/1412.html", "time": "2012-05-14", "level": "", "num_look": 99613, "num_comment": 99613, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "python写的oracle默认用户猜解", "url": "https://www.freebuf.com/sectool/1400.html", "time": "2012-05-14", "level": "", "num_look": 159119, "num_comment": 3, "author": "Gavin", "tags": ["工具"], "text": ""}
{"title": "美国麻省大学遭印度黑客入侵", "url": "https://www.freebuf.com/news/1401.html", "time": "2012-05-14", "level": "", "num_look": 107754, "num_comment": 2, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "Adobe Photoshop CS5.1 U3D.8BI Buffer Overflow", "url": "https://www.freebuf.com/vuls/1388.html", "time": "2012-05-13", "level": "", "num_look": 127115, "num_comment": 127115, "author": "匿名用户", "tags": ["漏洞"], "text": ""}
{"title": "OAuth 的权限问题与信息安全隐忧", "url": "https://www.freebuf.com/articles/1381.html", "time": "2012-05-13", "level": "", "num_look": 157737, "num_comment": 157737, "author": "匿名用户", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "价值8.7万美元的比特币失窃", "url": "https://www.freebuf.com/news/1377.html", "time": "2012-05-13", "level": "", "num_look": 116300, "num_comment": 116300, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "关于Google Hacking一些Tips", "url": "https://www.freebuf.com/articles/1362.html", "time": "2012-05-12", "level": "", "num_look": 162740, "num_comment": 1, "author": "匿名用户", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "Acunetix Web Vulnerability Scanner 8.x Consultant Edition KeyGen By Hmily[LCG]", "url": "https://www.freebuf.com/sectool/1354.html", "time": "2012-05-11", "level": "", "num_look": 194505, "num_comment": 2, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "自动化模糊测试框架（BFF）- linux和Mac OS X上的fuzzer工具", "url": "https://www.freebuf.com/sectool/1319.html", "time": "2012-05-11", "level": "", "num_look": 221445, "num_comment": 1, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "数字取证工具包-SIFT", "url": "https://www.freebuf.com/sectool/1315.html", "time": "2012-05-11", "level": "", "num_look": 209747, "num_comment": 209747, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "社工利器—theHavrest", "url": "https://www.freebuf.com/sectool/1325.html", "time": "2012-05-11", "level": "", "num_look": 299167, "num_comment": 3, "author": "thanks", "tags": ["工具"], "text": ""}
{"title": "Proxmark3使用案例", "url": "https://www.freebuf.com/articles/1275.html", "time": "2012-05-11", "level": "", "num_look": 804924, "num_comment": 4, "author": "匿名用户", "tags": ["文章", "终端安全"], "text": ""}
{"title": "PDF恶意文档分析工具 - PdfStreamDumper", "url": "https://www.freebuf.com/sectool/1211.html", "time": "2012-05-11", "level": "", "num_look": 302774, "num_comment": 302774, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "绿盟科技招聘WEB安全测试/安全研究攻城师", "url": "https://www.freebuf.com/jobs/1260.html", "time": "2012-05-11", "level": "", "num_look": 174687, "num_comment": 9, "author": "匿名用户", "tags": ["安全招聘"], "text": ""}
{"title": "ScScanner 扫描器", "url": "https://www.freebuf.com/sectool/1259.html", "time": "2012-05-11", "level": "", "num_look": 213126, "num_comment": 2, "author": "疯子", "tags": ["工具"], "text": ""}
{"title": "burpsuite_pro_v1.4.01破解版", "url": "https://www.freebuf.com/sectool/1266.html", "time": "2012-05-10", "level": "", "num_look": 216595, "num_comment": 6, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "Acunetix Web Vulnerability Scanner更新包含php-cgi漏洞检测", "url": "https://www.freebuf.com/sectool/1243.html", "time": "2012-05-10", "level": "", "num_look": 173167, "num_comment": 2, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": ".svn目录泄漏利用脚本", "url": "https://www.freebuf.com/sectool/1220.html", "time": "2012-05-10", "level": "", "num_look": 337971, "num_comment": 337971, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "[内涵图]菲律宾政府呼吁黑客停止对中国网络攻击", "url": "https://www.freebuf.com/news/1216.html", "time": "2012-05-10", "level": "", "num_look": 100370, "num_comment": 3, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "XCon2012议题征集", "url": "https://www.freebuf.com/news/1212.html", "time": "2012-05-10", "level": "", "num_look": 124537, "num_comment": 124537, "author": "xCon", "tags": ["周边", "资讯"], "text": ""}
{"title": "中国和美国将化解网络冷战", "url": "https://www.freebuf.com/news/1202.html", "time": "2012-05-10", "level": "", "num_look": 98976, "num_comment": 98976, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "美国天然气输送系统遭受黑客攻击数月", "url": "https://www.freebuf.com/news/1196.html", "time": "2012-05-09", "level": "", "num_look": 94679, "num_comment": 94679, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "PHP发布修复关键漏洞的新补丁（5.4.3 和 5.3.13）", "url": "https://www.freebuf.com/news/1177.html", "time": "2012-05-09", "level": "", "num_look": 116466, "num_comment": 1, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "55.000+ Twitter帐户数据泄漏及查询地址", "url": "https://www.freebuf.com/news/1174.html", "time": "2012-05-09", "level": "", "num_look": 143310, "num_comment": 2, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "某银行总行安全Team招聘网络蓝军部队", "url": "https://www.freebuf.com/jobs/1161.html", "time": "2012-05-09", "level": "", "num_look": 168855, "num_comment": 6, "author": "niejun2002", "tags": ["安全招聘"], "text": ""}
{"title": "[POC]MS12-032 - Vulnerability in TCP/IP Could Allow Elevation of Privilege", "url": "https://www.freebuf.com/vuls/1151.html", "time": "2012-05-09", "level": "", "num_look": 140585, "num_comment": 140585, "author": "pnig0s", "tags": ["数据安全", "漏洞"], "text": ""}
{"title": "微软5月安全公告发布 Office漏洞可导致黑客攻击", "url": "https://www.freebuf.com/news/1154.html", "time": "2012-05-09", "level": "", "num_look": 101229, "num_comment": 101229, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "中国杭州电子科技大学15W账户数据泄露", "url": "https://www.freebuf.com/news/1141.html", "time": "2012-05-09", "level": "", "num_look": 207287, "num_comment": 15, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "Node.js 爆 HTTP 安全漏洞，建议升级至 0.6.17 稳定版", "url": "https://www.freebuf.com/news/1133.html", "time": "2012-05-09", "level": "", "num_look": 110552, "num_comment": 110552, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "4399厦门招聘多名安全检测工程师", "url": "https://www.freebuf.com/jobs/1121.html", "time": "2012-05-08", "level": "", "num_look": 160441, "num_comment": 160441, "author": "cwk", "tags": ["安全招聘"], "text": ""}
{"title": "python开发反射型XSS漏洞扫描脚本总结", "url": "https://www.freebuf.com/articles/1109.html", "time": "2012-05-08", "level": "", "num_look": 365304, "num_comment": 6, "author": "shaun", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "CVE-2012-1823 php-cgi漏洞 metasploit利用脚本", "url": "https://www.freebuf.com/sectool/1105.html", "time": "2012-05-08", "level": "", "num_look": 206502, "num_comment": 206502, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "90后黑客操纵55台“傀儡机”攻击网游", "url": "https://www.freebuf.com/news/1100.html", "time": "2012-05-08", "level": "", "num_look": 114643, "num_comment": 114643, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "WordPress 3.2.2 存储型跨站漏洞", "url": "https://www.freebuf.com/vuls/1071.html", "time": "2012-05-08", "level": "", "num_look": 153595, "num_comment": 1, "author": "匿名用户", "tags": ["漏洞"], "text": ""}
{"title": "[样本&视频]Adobe Flash Player远程代码执行漏洞(CVE-2012-0779)", "url": "https://www.freebuf.com/vuls/1072.html", "time": "2012-05-08", "level": "", "num_look": 161089, "num_comment": 2, "author": "匿名用户", "tags": ["漏洞"], "text": ""}
{"title": "匿名组织抗议普京就职攻击俄国政府网站", "url": "https://www.freebuf.com/news/1067.html", "time": "2012-05-08", "level": "", "num_look": 103520, "num_comment": 103520, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "wordpress安全插件推荐-MJP Security Plugin", "url": "https://www.freebuf.com/sectool/1062.html", "time": "2012-05-08", "level": "", "num_look": 136149, "num_comment": 136149, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "谷歌严查漏洞 提高悬赏金至2万美元", "url": "https://www.freebuf.com/news/1058.html", "time": "2012-05-08", "level": "", "num_look": 120452, "num_comment": 1, "author": "匿名用户", "tags": ["数据安全", "资讯"], "text": ""}
{"title": "freebuf安全周刊2012年5月1日-5月7日", "url": "https://www.freebuf.com/news/1040.html", "time": "2012-05-07", "level": "", "num_look": 113060, "num_comment": 113060, "author": "root", "tags": ["资讯"], "text": ""}
{"title": "Adobe Flash Player发布最新安全补丁", "url": "https://www.freebuf.com/news/1035.html", "time": "2012-05-07", "level": "", "num_look": 115211, "num_comment": 1, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "恶意软件检测工具-DensityScout", "url": "https://www.freebuf.com/sectool/1032.html", "time": "2012-05-07", "level": "", "num_look": 150968, "num_comment": 150968, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "苹果雪豹操作系统曝漏洞：明文形式记录密码", "url": "https://www.freebuf.com/news/1018.html", "time": "2012-05-07", "level": "", "num_look": 403796, "num_comment": 403796, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "如何使用SQLMap绕过WAF", "url": "https://www.freebuf.com/articles/1000.html", "time": "2012-05-07", "level": "", "num_look": 2358666, "num_comment": 5, "author": "thanks", "tags": ["WEB安全", "文章"], "text": "test"}
{"title": "[WhitePaper]ios应用安全黑白盒测试方法", "url": "https://www.freebuf.com/articles/970.html", "time": "2012-05-07", "level": "", "num_look": 204470, "num_comment": 3, "author": "匿名用户", "tags": ["文章", "终端安全"], "text": ""}
{"title": "域内特定目标渗透测试方法概要", "url": "https://www.freebuf.com/articles/984.html", "time": "2012-05-07", "level": "", "num_look": 234756, "num_comment": 234756, "author": "匿名用户", "tags": ["文章", "系统安全"], "text": ""}
{"title": "最新的PHP补丁并不能修复漏洞", "url": "https://www.freebuf.com/news/962.html", "time": "2012-05-06", "level": "", "num_look": 146497, "num_comment": 6, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "我家菲佣是黑客 - 中菲网络战争全程回顾", "url": "https://www.freebuf.com/news/913.html", "time": "2012-05-06", "level": "", "num_look": 448824, "num_comment": 14, "author": "pnig0s", "tags": ["其他", "周边"], "text": ""}
{"title": "Facebook社工工具-FBPwn 0.1.8", "url": "https://www.freebuf.com/sectool/922.html", "time": "2012-05-05", "level": "", "num_look": 203157, "num_comment": 4, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "CVE-2012-1823 PHP-CGI漏洞批量扫描脚本", "url": "https://www.freebuf.com/sectool/905.html", "time": "2012-05-05", "level": "", "num_look": 263368, "num_comment": 263368, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "16岁黑客狂窃日本6千余张信用卡信息被判刑两年", "url": "https://www.freebuf.com/news/889.html", "time": "2012-05-05", "level": "", "num_look": 300106, "num_comment": 4, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "关于FreeBuf你应该知道的一些事", "url": "https://www.freebuf.com/news/others/864.html", "time": "2012-05-05", "level": "", "num_look": 17487857, "num_comment": 74, "author": "root", "tags": ["其他", "周边"], "text": ""}
{"title": "叙利亚政府利用Skype向抗议者推送恶意程序", "url": "https://www.freebuf.com/news/839.html", "time": "2012-05-05", "level": "", "num_look": 180093, "num_comment": 180093, "author": "flowing", "tags": ["资讯"], "text": ""}
{"title": "五大超级黑帽子黑客和五大超级白帽子黑客【视频】", "url": "https://www.freebuf.com/news/others/840.html", "time": "2012-05-05", "level": "", "num_look": 398778, "num_comment": 9, "author": "flowing", "tags": ["其他", "周边"], "text": ""}
{"title": "WordPress安全检测工具", "url": "https://www.freebuf.com/articles/808.html", "time": "2012-05-05", "level": "", "num_look": 677336, "num_comment": 7, "author": "thanks", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "传黑客可靠聆听键盘声盗密", "url": "https://www.freebuf.com/news/776.html", "time": "2012-05-04", "level": "", "num_look": 161018, "num_comment": 9, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "美欧等多国军网被黑 攻击者称想证明系统存漏洞", "url": "https://www.freebuf.com/news/738.html", "time": "2012-05-04", "level": "", "num_look": 99118, "num_comment": 99118, "author": "pnig0s", "tags": ["资讯"], "text": ""}
{"title": "Backtrack全版本下载地址及汉化详细过程", "url": "https://www.freebuf.com/sectool/752.html", "time": "2012-05-04", "level": "", "num_look": 185727, "num_comment": 2, "author": "backtrack-china", "tags": ["工具"], "text": ""}
{"title": "恐怖组织必备加密工具", "url": "https://www.freebuf.com/sectool/740.html", "time": "2012-05-04", "level": "", "num_look": 192839, "num_comment": 192839, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "CVE-2012-1823（PHP-CGI RCE）的PoC及技术挑战", "url": "https://www.freebuf.com/articles/725.html", "time": "2012-05-04", "level": "", "num_look": 244080, "num_comment": 4, "author": "匿名用户", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "md5/phppass等破解工具-oclHashcat-plus 0.08", "url": "https://www.freebuf.com/sectool/721.html", "time": "2012-05-04", "level": "", "num_look": 224535, "num_comment": 1, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "安全框架-Razorback 0.5.0", "url": "https://www.freebuf.com/sectool/713.html", "time": "2012-05-04", "level": "", "num_look": 138001, "num_comment": 1, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "PHP重要的安全更新：5.4.2 和 5.3.12", "url": "https://www.freebuf.com/news/704.html", "time": "2012-05-04", "level": "", "num_look": 98101, "num_comment": 98101, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "微软下周二将发布7个补丁修复23个安全漏洞", "url": "https://www.freebuf.com/news/698.html", "time": "2012-05-04", "level": "", "num_look": 111151, "num_comment": 1, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "支持验证码的web登录破解工具 - cintruder", "url": "https://www.freebuf.com/sectool/689.html", "time": "2012-05-04", "level": "", "num_look": 294757, "num_comment": 2, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "开源linux远程控制工具 - n00bRAT", "url": "https://www.freebuf.com/sectool/687.html", "time": "2012-05-04", "level": "", "num_look": 384044, "num_comment": 384044, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "中国长城防火墙是否会适得其反？", "url": "https://www.freebuf.com/news/650.html", "time": "2012-05-03", "level": "", "num_look": 394367, "num_comment": 2, "author": "pnig0s", "tags": ["资讯"], "text": ""}
{"title": "CVE-2012-1823 php-cgi远程代码执行", "url": "https://www.freebuf.com/vuls/678.html", "time": "2012-05-03", "level": "", "num_look": 291590, "num_comment": 4, "author": "匿名用户", "tags": ["漏洞"], "text": ""}
{"title": "部分不安全网站传播新型Android病毒", "url": "https://www.freebuf.com/news/667.html", "time": "2012-05-03", "level": "", "num_look": 130515, "num_comment": 130515, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "PUTTY本地端口映射到外网的方法", "url": "https://www.freebuf.com/articles/651.html", "time": "2012-05-03", "level": "", "num_look": 399864, "num_comment": 1, "author": "匿名用户", "tags": ["文章", "系统安全"], "text": ""}
{"title": "第十三届中国信息安全大会会议日程已公布", "url": "https://www.freebuf.com/news/639.html", "time": "2012-05-03", "level": "", "num_look": 158362, "num_comment": 2, "author": "匿名用户", "tags": ["周边", "资讯"], "text": ""}
{"title": "WPBforce - WordPress Brute Force by Gothie", "url": "https://www.freebuf.com/sectool/632.html", "time": "2012-05-03", "level": "", "num_look": 180835, "num_comment": 180835, "author": "unshell", "tags": ["工具"], "text": ""}
{"title": "支持验证码的web登录破解工具 - cintruder", "url": "https://www.freebuf.com/sectool/619.html", "time": "2012-05-03", "level": "", "num_look": 207833, "num_comment": 1, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "SQL注入工具-SQLSentinel_v_0.1_beta", "url": "https://www.freebuf.com/sectool/614.html", "time": "2012-05-03", "level": "", "num_look": 186828, "num_comment": 6, "author": "unshell", "tags": ["工具"], "text": ""}
{"title": "RFID Hacking–资源大合集", "url": "https://www.freebuf.com/news/others/605.html", "time": "2012-05-03", "level": "", "num_look": 560706, "num_comment": 5, "author": "pnig0s", "tags": ["周边", "极客"], "text": ""}
{"title": "工业木马Duqu被发现使用一种未知语言编写", "url": "https://www.freebuf.com/news/580.html", "time": "2012-05-03", "level": "", "num_look": 135472, "num_comment": 3, "author": "pnig0s", "tags": ["资讯"], "text": ""}
{"title": "菲律宾黑客黑掉众多中国政府网站", "url": "https://www.freebuf.com/news/568.html", "time": "2012-05-03", "level": "", "num_look": 158786, "num_comment": 3, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "eUKhost被巴基斯坦黑客团队UrduHack入侵", "url": "https://www.freebuf.com/news/563.html", "time": "2012-05-03", "level": "", "num_look": 125422, "num_comment": 125422, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "MIT黑客公开建筑物变俄罗斯方块的源代码", "url": "https://www.freebuf.com/news/556.html", "time": "2012-05-03", "level": "", "num_look": 137157, "num_comment": 1, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "[EXP]Solarwinds Storage Manager 5.1.0 Remote SYSTEM SQL Injection", "url": "https://www.freebuf.com/vuls/547.html", "time": "2012-05-02", "level": "", "num_look": 160628, "num_comment": 1, "author": "pnig0s", "tags": ["漏洞"], "text": ""}
{"title": "GirlzSoft（本机缓存密码读取工具）", "url": "https://www.freebuf.com/sectool/521.html", "time": "2012-05-02", "level": "", "num_look": 159695, "num_comment": 3, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "屌丝の逆袭——如何干掉一个黑客", "url": "https://www.freebuf.com/articles/466.html", "time": "2012-05-02", "level": "", "num_look": 204213, "num_comment": 9, "author": "匿名用户", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "Windows 8 DEP bypass", "url": "https://www.freebuf.com/vuls/450.html", "time": "2012-05-02", "level": "", "num_look": 175696, "num_comment": 175696, "author": "匿名用户", "tags": ["漏洞"], "text": ""}
{"title": "自动化中间人攻击工具 - subterfuge", "url": "https://www.freebuf.com/sectool/444.html", "time": "2012-05-02", "level": "", "num_look": 341600, "num_comment": 1, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "CVE-2012-1172：PHP Corrupted $_FILES indices lead to security concern", "url": "https://www.freebuf.com/articles/437.html", "time": "2012-05-02", "level": "", "num_look": 272241, "num_comment": 1, "author": "匿名用户", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "如何利用SQL注入制造一个后门", "url": "https://www.freebuf.com/articles/222.html", "time": "2012-05-02", "level": "", "num_look": 923128, "num_comment": 4, "author": "pnig0s", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "密码破解软件，Ophcrack 3.4.0 发布", "url": "https://www.freebuf.com/sectool/426.html", "time": "2012-05-02", "level": "", "num_look": 192106, "num_comment": 1, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "国外黑客的一次目标性渗透测试", "url": "https://www.freebuf.com/articles/198.html", "time": "2012-05-02", "level": "", "num_look": 385862, "num_comment": 8, "author": "thanks", "tags": ["WEB安全", "文章"], "text": ""}
{"title": "FreeBuf.COM全新改版升级", "url": "https://www.freebuf.com/news/others/363.html", "time": "2012-05-01", "level": "", "num_look": 177559, "num_comment": 12, "author": "root", "tags": ["其他", "周边"], "text": ""}
{"title": "Discuz! X2.5 远程代码执行漏洞及EXP[XDAY]", "url": "https://www.freebuf.com/vuls/329.html", "time": "2012-04-28", "level": "", "num_look": 337171, "num_comment": 2, "author": "匿名用户", "tags": ["漏洞"], "text": ""}
{"title": "Google为Chrome引入“ClusterFuzz”严酷测试环境", "url": "https://www.freebuf.com/news/283.html", "time": "2012-04-28", "level": "", "num_look": 191481, "num_comment": 191481, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "SqlMap GUI", "url": "https://www.freebuf.com/sectool/260.html", "time": "2012-04-28", "level": "金币+1", "num_look": 442902, "num_comment": 5, "author": "thanks", "tags": ["工具"], "text": ""}
{"title": "最危险的黑客：不偷你的钱只偷你赚钱的方法", "url": "https://www.freebuf.com/news/249.html", "time": "2012-04-28", "level": "", "num_look": 122137, "num_comment": 122137, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "世界各国管理员帐号写法（用于远程破解）", "url": "https://www.freebuf.com/articles/191.html", "time": "2012-04-27", "level": "", "num_look": 252708, "num_comment": 1, "author": "匿名用户", "tags": ["WEB安全", "数据安全"], "text": ""}
{"title": "伊朗遭病毒攻击后切断炼油厂网络", "url": "https://www.freebuf.com/news/188.html", "time": "2012-04-27", "level": "", "num_look": 115439, "num_comment": 115439, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "VMware证实产品源代码泄漏", "url": "https://www.freebuf.com/news/185.html", "time": "2012-04-27", "level": "", "num_look": 137564, "num_comment": 137564, "author": "匿名用户", "tags": ["资讯"], "text": ""}
{"title": "CERT发布Linux安全工具Triage Tools 1.0", "url": "https://www.freebuf.com/sectool/181.html", "time": "2012-04-27", "level": "", "num_look": 172776, "num_comment": 172776, "author": "匿名用户", "tags": ["工具"], "text": ""}
{"title": "SEO打手攻防小揭密", "url": "https://www.freebuf.com/articles/168.html", "time": "2012-04-27", "level": "", "num_look": 165158, "num_comment": 165158, "author": "匿名用户", "tags": ["其他", "文章"], "text": ""}
{"title": "最新协议漏洞或影响所有4G/5G手机", "url": "https://www.freebuf.com/news/240382.html", "time": "2020-06-16", "level": "", "num_look": 3494, "num_comment": 3, "author": "Sandra1432", "tags": ["资讯"], "text": "近日，研究报告警告称，当前移动网络运营商（MNO）使用的现代通信协议的高危漏洞可被利用，进行用户数据拦截或者假冒，开展欺诈和拒绝服务（DoS）攻击。"}
{"title": "6月17日下午3点见 | 云安全体系建设及HTTPS最佳实践方案公开课分享", "url": "https://www.freebuf.com/open/240375.html", "time": "2020-06-16", "level": "红色标题", "num_look": 2981, "num_comment": 1, "author": "FB客服", "tags": ["FreeBuf公开课"], "text": "6月17日下午15:00，AWS解决方案架构师张明月将为我们带来《云安全体系建设及HTTPS最佳实践方案》公开课。"}
{"title": "2020年Q1垃圾和钓鱼邮件报告", "url": "https://www.freebuf.com/articles/network/238382.html", "time": "2020-06-16", "level": "", "num_look": 4460, "num_comment": 3, "author": "Kriston", "tags": ["网络安全"], "text": "卡巴斯基近日发布2020年Q1垃圾和钓鱼邮件分析报告，以下为报告全文。"}
