PBKDF2 - Wikipedia
In cryptography, PBKDF1 and PBKDF2 (Password-Based Key Derivation Function 1 and 2) are key derivation functions with a sliding computational cost, used to reduce vulnerability to brute-force attacks.[1] PBKDF2 is part of RSA Laboratories' Public-Key Cryptography Standards (PKCS) series, specifically PKCSÂ #5 v2.0, also published as Internet Engineering Task Force's RFCÂ 2898. It supersedes PBKDF1,
GitHub - feihong-cs/JNDIExploit: A malicious LDAP server for JNDI injection attacks
JNDIExploit 一款用于 JNDI注入 利用的工具，大é‡å‚考/引用了 Rogue JNDI 项目的代ç ，支æŒç›´æŽ¥æ¤å…¥å†…å˜shell，并集æˆäº†å¸¸è§çš„bypass 高版本JDKçš„æ–¹å¼ï¼Œé€‚用于与自动化工具é…åˆä½¿ç”¨ã€‚ 使用说明 使用 java -jar JNDIExploit.jar -h 查看å‚æ•°è¯´æ˜Žï¼Œå…¶ä¸ --ip å‚数为必选å‚æ•° Usage: java -jar JNDIExploit.jar [options] Options: * -i, --ip Local ip address -l, --ldapPort Ldap bind port (default: 1389) -p, --httpPort Http bind port (default: 8080) -u, --usage Show usage (default: false) -h, --help Show thi
Log4j RCE Found | Hacker News
To folks wondering what the issue is about, I'll give a short summary that I myself needed.Typically a logging library has one job to do: swallow the string as if it's some black box and spit it elsewhere as per provided configurations. Log4j though, doesn't treat strings as black boxes. It inspects its contents and checks if it contains any "variables" that need to be resolved before spitting out
us-16-MunozMirosh-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE
A JOURNEY FROM JNDI/LDAP MANIPULATION TO REMOTE CODE EXECUTION DREAM LAND Alvaro Muñoz (@pwntester) Oleksandr Mirosh Who are we • Alvaro Muñoz (@pwntester) • Principal Security Researcher, HPE Fortify • Oleksandr Mirosh • Senior QA Engineer, HPE Fortify Agenda • Introduction to JNDI • JNDI Injection • RMI Vector • Demo: EclipseLink/TopLink • CORBA Vector • LDAP Vector • LDAP Entry Poisoning • Demo
Linux SambaCry
Great news everyone, Windows is not the only operating system with remote code execution via SMB. Linux has also its own, seven-year-old version of the bug. /s This Linux remote execution vulnerability (CVE-2017-7494) affects Samba, the Linux re-implementation of the SMB networking protocol, from versions 3.5.0 onwards (since 2010). The SambaCry moniker was almost unavoidable. The bug, however, ha
Electronã§ã‚¢ãƒ—リを書ãå ´åˆã¯ã€æ°—åˆã„ã¨æ ¹æ€§ã§XSSを発生ã•ã›ãªã„よã†ã«ã—ãªã‘ã‚Œã°ãªã‚‰ãªã„。 - 葉ã£ã±æ—¥è¨˜
ãã®ã†ã¡ã‚‚ã†å°‘ã—ãã¡ã‚“ã¨æ›¸ãã¾ã™ãŒã€ã¨ã‚Šã‚ãˆãšæ™‚é–“ãŒãªã„ã®ã§çµè«–ã ã‘書ãã¨ã€ã‚¿ã‚¤ãƒˆãƒ«ãŒå…¨ã¦ã§Electronã§ã‚¢ãƒ—リを書ãå ´åˆã¯æ°—åˆã„ã¨æ ¹æ€§ã§XSSを発生ã•ã›ãªã„よã†ã«ã—ãªã‘ã‚Œã°ãªã‚‰ãªã„。 ã“ã‚Œã¾ã§Webアプリケーション上ã§XSSãŒå˜åœ¨ã—ãŸã¨ã—ã¦ã‚‚ã€å½±éŸ¿ç¯„囲ã¯ãã®Webアプリケーションã®ä¸ã«ç•™ã¾ã‚‹ã®ã§ã€Webアプリケーションã®æä¾›å´ãŒãれを許容ã™ã‚‹ã®ã§ã‚ã‚Œã°XSSã®å˜åœ¨ã«ç›®ã‚’ã¤ã‚€ã‚‹ã“ã¨ã‚‚ã§ããŸã€‚ã—ã‹ã—ã€Electronアプリã§DOM-based XSSãŒä¸€ã‹æ‰€ã§ã‚‚発生ã™ã‚‹ã¨ã€(ãŠãらã)確実ã«ä»»æ„コード実行ã¸ã¨ã¤ãªãŒã‚Šã€åˆ©ç”¨è€…ã®PCã®(ãã®ãƒ¦ãƒ¼ã‚¶ãƒ¼æ¨©é™ã§ã®)全機能ãŒæ”»æ’ƒè€…ã«ã‚ˆã£ã¦åˆ©ç”¨ã§ãる。 ãã®ãŸã‚ã€Electronã§ã‚¢ãƒ—リケーションを作æˆã™ã‚‹é–‹ç™ºè€…ã¯æ°—åˆã„ã¨æ ¹æ€§ã§XSSを完全ã«ã¤ã¶ã•ãªã‘ã‚Œã°ãªã‚‰ãªã„。 nodeIntegration:falseã‚„Content-Security-Pol
hashcat - advanced password recovery
Signing key on PGP keyservers: RSA, 2048-bit. Key ID: 2048R/8A16544F. Fingerprint: A708 3322 9D04 0B41 99CC 0052 3C17 DA8B 8A16 544F Check out our GitHub Repository for the latest development version GPU Driver requirements: AMD GPUs on Linux require "AMDGPU" (21.50 or later) and "ROCm" (5.0 or later) AMD GPUs on Windows require "AMD Adrenalin Edition" (Adrenalin 22.5.1 exactly) Intel CPUs require
GitHub - dropbox/zxcvbn: Low-Budget Password Strength Estimation
zxcvbn is a password strength estimator inspired by password crackers. Through pattern matching and conservative estimation, it recognizes and weighs 30k common passwords, common names and surnames according to US census data, popular English words from Wikipedia and US television and movies, and other common patterns like dates, repeats (aaa), sequences (abcd), keyboard patterns (qwertyuiop), and
パソコンã®ç™ºã™ã‚‹é›»ç£æ³¢ã‚’AMラジオã§å—ä¿¡ã—ã¦RSA秘密éµãªã©ã‚’è§£æž | スラド ã‚»ã‚ュリティ
ã“ã‚Œã¾ã§ãƒ‘ソコンã®é›»æºé³´ãã‚„é›»ä½ã®æºã‚‰ãŽã‚’利用ã—ã¦RSA秘密éµãªã©ã®è§£æžã«æˆåŠŸã—ã¦ã„るイスラエル・テルアビブ大å¦ã®ç ”究ãƒãƒ¼ãƒ ãŒã€å¸‚販ã®AMラジオを使用ã—ãŸã‚µã‚¤ãƒ‰ãƒãƒ£ãƒãƒ«æ”»æ’ƒã§RSA秘密éµãŠã‚ˆã³ElGamal秘密éµã®èªã¿å–ã‚Šã«æˆåŠŸã—ã¦ã„ãŸãã†ã (ç ”ç©¶ãƒãƒ¼ãƒ ã«ã‚ˆã‚‹è§£èª¬è¨˜äº‹ã€ è«–æ–‡: PDF〠The Registerã®è¨˜äº‹)。 ç ”ç©¶ãƒãƒ¼ãƒ ã§ã¯ã€GnuPGã§å¾©å·ã‚’実行ã™ã‚‹éš›ã€ãƒ‘ソコンãŒç™ºã™ã‚‹é›»ç£æ³¢ã®å‘¨æ³¢æ•°ãŒå¤‰å‹•ã—ã€1.5～2MHzã®FMæ³¢ã¨ã—ã¦å—ä¿¡å¯èƒ½ãªç‚¹ã«æ³¨ç›®ã€‚ãã“ã§ã€USB接続ã®SDR(ソフトウェア無線)å—信機ドングルã¨ãƒ«ãƒ¼ãƒ—アンテナã€ãƒŽãƒ¼ãƒˆãƒ‘ソコンを組ã¿åˆã‚ã›ã¦ã‚¿ãƒ¼ã‚²ãƒƒãƒˆã®ç§˜å¯†éµè§£æžã‚’試ã¿ãŸã¨ã“ã‚ã€3072ビットElGamal秘密éµã¨4096ビットRSA秘密éµã‚’ãã‚Œãžã‚Œæ•°ç§’ã§å–å¾—ã§ããŸã¨ã„ã†ã€‚ã¾ãŸã€SDRドングルã¨ãƒ«ãƒ¼ãƒ—アンテナã€OSã‚’Debianã«å¤‰æ›´ã—ãŸAndroid TVドングルを使
Windows 7ã®èµ·å‹•æ™‚ã«ç®¡ç†è€…権é™ã‚’強制的ã«å–å¾—ã™ã‚‹è£æŠ€
Windows 7ã®èµ·å‹•ç”»é¢ã§ä½¿ã£ã¦ã„るパスワードを忘れã¦ã—ã¾ã„ã€ãƒã‚°ã‚¤ãƒ³ã§ããªã„ã¨ã„ã†éžå¸¸äº‹æ…‹ã«å‡ºãã‚ã—ãŸã¨ãã«ã€ç®¡ç†è€…権é™ã‚’å–å¾—ã—ãŸçŠ¶æ…‹ã§ã‚³ãƒžãƒ³ãƒ‰ãƒ—ãƒãƒ³ãƒ—トを立ã¡ä¸Šã’られるè£æŠ€ã‚’知ã£ã¦ãŠã‘ã°ã€ã‚³ãƒžãƒ³ãƒ‰å…¥åŠ›ã§ã‚ã£ã¨ã„ã†é–“ã«ãƒ‘スワードをè¨å®šã—ç›´ã—ã¦ãƒã‚°ã‚¤ãƒ³ã™ã‚‹ã“ã¨ãŒå¯èƒ½ã§ã™ã€‚ã¨ã„ã†ã“ã¨ã§ã€å®Ÿéš›ã«ã†ã¾ãã„ãã®ã‹ã€ç®¡ç†è€…権é™ã‚’強制的ã«å–å¾—ã™ã‚‹è£æŠ€ã‚’試ã—ã¦ã¿ã¾ã—ãŸã€‚ãªãŠã€ã“ã®è£æŠ€ã¯æ‰‹é †ã‚’é–“é•ãˆã‚‹ã¨PCãŒæ£å¸¸ã«èµ·å‹•ã—ãªããªã‚‹å±é™ºãŒã‚る点ã«ã¯æ³¨æ„ãŒå¿…è¦ã§ã™ã€‚ A tutorial on how to get into an admin account on ANY computer. - Imgur http://imgur.com/gallery/H8obU é›»æºãƒœã‚¿ãƒ³ã‚’押ã—ã¦PCã‚’èµ·å‹•ã•ã›ã€ã€ŒWindowsã‚’èµ·å‹•ã—ã¦ã„ã¾ã™ã€ã¨è¡¨ç¤ºã•ã‚Œã¦ã„ã‚‹é–“ã«ã€PCã®é›»æºãƒœã‚¿ãƒ³ã‚’長押ã—ã—ã¦å¼·åˆ¶çš„ã«PCをシャット
OS X 10.10 Yosemite: The Ars Technica Review
When the book is finally closed on the product line known as OS X, last year’s release of OS X 10.9 Mavericks may end up getting short shrift. Sure, it brought tangible energy saving benefits to Mac laptop owners, but such gains are quickly taken for granted; internal changes and new frameworks are not as memorable to customers as they may be to developers and technophiles. And while Mavericks inc
原田ウイルス - Wikipedia
ã“ã®è¨˜äº‹ã¯æ¤œè¨¼å¯èƒ½ãªå‚考文献や出典ãŒå…¨ã示ã•ã‚Œã¦ã„ãªã„ã‹ã€ä¸å分ã§ã™ã€‚ å‡ºå…¸ã‚’è¿½åŠ ã—ã¦è¨˜äº‹ã®ä¿¡é ¼æ€§å‘上ã«ã”å”力ãã ã•ã„。（ã“ã®ãƒ†ãƒ³ãƒ—レートã®ä½¿ã„方） 出典検索?: "原田ウイルス" – ニュース · 書ç±Â · スカラー · CiNii · J-STAGE · NDL · dlib.jp · ジャパンサーãƒÂ · TWL (2018å¹´7月) 原田ウイルス（ã¯ã‚‰ã ウイルス）ã¯ã€ä¸»ã«ãƒ•ã‚¡ã‚¤ãƒ«å…±æœ‰ã‚½ãƒ•ãƒˆã§ã‚ã‚‹Winnyã‚„Shareãªã©ã‚’介ã—ã¦æ„ŸæŸ“ã™ã‚‹ã‚³ãƒ³ãƒ”ュータウイルスã§ã‚る。 ファイル共有ソフト以外ã®ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ€ãªã©ã§ã‚‚確èªã•ã‚Œã¦ãŠã‚Šã€ã‚¦ã‚¤ãƒ«ã‚¹ãƒ•ã‚¡ã‚¤ãƒ«ã‚’実行ã—ãŸéš›ã«ã€ŒåŽŸç”°ã€ã¨å乗る人物画åƒãŒè¡¨ç¤ºã•ã‚Œã‚‹ã‚¦ã‚¤ãƒ«ã‚¹ã®ç·ç§°ã§ã‚‚ã‚る。ãªãŠã€ã“ã®ã€ŒåŽŸç”°ã€ã¨ã„ã†äººç‰©è‡ªèº«ã¯ã‚¦ã‚¤ãƒ«ã‚¹ã®ä½œæˆè€…ã§ã¯ãªã„[1]。 原田ウイルスã¯å°‚用ã®ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã‚’使ã£ã¦å®¹æ˜“ã«ä½œã‚Œã‚‹ãŸã‚ã€åˆå¿ƒè€…ã§ã‚‚ç°¡å˜ã«ä½œã‚Œã‚‹[2]。ãれゆãˆã€äºœç¨®ã¯10
山田ウイルス - Wikipedia
Winnyã‚„Shareã®å ´åˆã¯ã‚¦ã‚¤ãƒ«ã‚¹ãŒå«ã¾ã‚Œã‚‹ãƒ•ã‚¡ã‚¤ãƒ«ã‚’入手ã—ã¦å®Ÿè¡Œå¾Œã€2ã¡ã‚ƒã‚“ãã‚‹ãªã©ã®é›»å掲示æ¿ã‚„メールãªã©ã®å ´åˆã¯ã‚¦ã‚¤ãƒ«ã‚¹ãŒå«ã¾ã‚Œã‚‹ãƒ•ã‚¡ã‚¤ãƒ«ãŒä¿ç®¡ã•ã‚Œã¦ã„ã‚‹å ´æ‰€ã®ãƒªãƒ³ã‚¯ã‚’クリックã—ã€ãƒ•ã‚¡ã‚¤ãƒ«ã‚’ダウンãƒãƒ¼ãƒ‰ã—ã¦å®Ÿè¡Œå¾Œã«æ„ŸæŸ“ã™ã‚‹å ´åˆãŒå¤šã„。 ã“ã®ã‚¦ã‚¤ãƒ«ã‚¹ã«æ„ŸæŸ“ã™ã‚‹ã¨ã€PCã‚’Webサーãƒã¨ã—ã¦æ©Ÿèƒ½ã•ã›ã€ãƒ‡ã‚¹ã‚¯ãƒˆãƒƒãƒ—を一定時間ãŠãã«ã‚ャプãƒãƒ£ã—ã¦æŒ‡å®šã•ã‚ŒãŸãƒ¡ãƒ¼ãƒ«ã‚¢ãƒ‰ãƒ¬ã‚¹ã«è»¢é€ã—ãŸã‚Šã€ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ€ãƒ¼ã«ç”»åƒã‚’貼るã»ã‹ã€ç‰¹å®šã®ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªã«ã‚るファイルをWebã«å…¬é–‹ã™ã‚‹ã€‚ã¾ãŸã€2ã¡ã‚ƒã‚“ãã‚‹ãªã©ã®æŽ²ç¤ºæ¿ã«ã€ãƒªãƒ¢ãƒ¼ãƒˆãƒ›ã‚¹ãƒˆæƒ…å ±ã‚’å…¬é–‹ã—ãŸä¸Šã§ã€Œãˆãˆã‘ã¤ã—ã¨ã‚‹ã®ã‰(*´Д`)ﾊｧﾊｧã€ãªã©ã®ã‚ˆã†ãªæ›¸ãè¾¼ã¿ã‚’è¡Œã†ã€‚ ã•ã‚‰ã«ã¯hostsファイルを変更ã—ã€ã‚·ãƒžãƒ³ãƒ†ãƒƒã‚¯ã‚„マイクãƒã‚½ãƒ•ãƒˆãªã©ã®ãƒ™ãƒ³ãƒ€ãƒ¼ã¸ã®ã‚¢ã‚¯ã‚»ã‚¹ã‚’é®æ–ã—ã€æ°‘主党ã®URLã¸ã¨å¤‰æ›´ã—ã¦ã—ã¾ã†ã€‚ãã—ã¦ã€PCを外部ã‹ã‚‰ä»»æ„ã®ã‚³ãƒ¼ãƒ‰ã‚’実行å¯èƒ½ãªçŠ¶æ…‹ã«ç½®ã。
山田オルタナティブ - Wikipedia
山田オルタナティブã¯2006å¹´2月ã”ã‚ã«ç™ºè¦‹ã•ã‚ŒãŸWinnyã‚„Shareãªã©ã®ãƒ•ã‚¡ã‚¤ãƒ«å…±æœ‰ã‚½ãƒ•ãƒˆåˆã¯2ã¡ã‚ƒã‚“ãã‚‹ãªã©ã®åŒ¿å掲示æ¿ã‚„Web上ã®ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ€ã€é›»åメールを媒介ã—ã¦æ„ŸæŸ“ã™ã‚‹ã‚³ãƒ³ãƒ”ュータウイルス（ãƒãƒƒã‚¯ãƒ‰ã‚¢åž‹ãƒˆãƒã‚¤ã®æœ¨é¦¬ï¼‰ã§ã‚る。Windows 98以é™ã®Windowsç³»OS上ã§å‹•ä½œã™ã‚‹ã€‚Antinnyã¨åŒã˜ã暴露ウイルスã¨ã‚‚呼ã°ã‚Œã¦ã„る。 山田オルタナティブã¯ã‚ãã¾ã§é€šç§°ã§ã‚りシマンテックã¯Backdoor.Nodelmã¨å‘¼ã‚“ã§ã„ã‚‹ãªã©ã‚¢ãƒ³ãƒã‚¦ã‚¤ãƒ«ã‚¹ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã‚’開発ã—ã¦ã„る会社ã«ã‚ˆã£ã¦å称ã¯ç•°ãªã‚‹ã€‚ è¦å¯Ÿåºã¯2006å¹´4月7æ—¥ã«ã€Œé‡è¦ãªãŠçŸ¥ã‚‰ã›ã€ã¨ã—ã¦å±±ç”°ã‚ªãƒ«ã‚¿ãƒŠãƒ†ã‚£ãƒ–ã«æ³¨æ„ã™ã‚‹ã‚ˆã†å‘¼ã³ã‹ã‘ãŸ[1]。 「山田ã€ã¯å±±ç”°ã‚¦ã‚¤ãƒ«ã‚¹ã¨å‹•ä½œã«ãŠã‘る共通点ãŒå¤šã„事ã‹ã‚‰æ¥ã‚‹ã€‚オルタナティブã®åå‰ãŒå®šç€ã™ã‚‹ã‚ˆã‚Šå‰ã¯ã€ã€Œæ–°å±±ç”°ã‚¦ã‚¤ãƒ«ã‚¹ã€ã€Œæ–°åž‹å±±ç”°ã€ãªã©ã¨å‘¼ã°ã‚Œã¦ã„ãŸã€‚ 「オルタナティブã€ã¯ã€ã“ã®
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
GitHub - mbechler/marshalsec
GitHub - veracode-research/rogue-jndi: A malicious LDAP server for JNDI injection attacks
GitHub - YfryTchsGD/Log4jAttackSurface
Virus in eslint-scope? · Issue #39 · eslint/eslint-scope
https://techcrunch.com/2016/07/27/security-experts-have-cloned-all-seven-tsa-master-keys/?ncid=rss&sr_share=facebook
What is the most interesting attack made on a website?
{{#tags}}- {{label}}
{{/tags}}