Click to follow the public account, Java dry goodsTimely delivery 1. HTTP Host Header Attacks Since HTTP/1.1, the HTTP Host header is a required request header. It specifies the domain name the client wants to access. For example, when a user accesses https://example.net/web-security, their browser will compose a request containing the Host header as follows: … Read more
Update: Chapter 6 Linux User Pwn IO_FILE 1. 2024-03-23 Update Video: 6-23 House of Qin Se Pi Pa (House of Obstack) 2. 2024-03-23 Update Video: 6-22 House Of Apple3-_IO_wfile_sync 3. 2024-03-23 Update Video: 6-21 House Of Apple3-_IO_wdo_write 4. 2024-03-23 Update Video: 6-19 House Of Apple3-_IO_wfile_underflow 5. 2024-03-23 Update Video: 6-20 House Of Apple3-_IO_wfile_underflow_mmap Do you … Read more
This article is an excellent piece from the Kexue Forum. Kexue Forum Author ID: wmsuper In industrial control systems, to prevent unauthorized modifications to configuration project files, many configuration software support encryption of project files. When opening a password-protected configuration project file, it is necessary to enter the correct password to view and edit the … Read more
This article is a highlight from the Kanxue forum. Author ID: Zeng Banxian The firmware verification defect of Jlink V10 was previously published along with a flashing tool, but the defect requires flashing once and then flashing back. Before the release, during a discussion in a mobile device development group, a group member mentioned that … Read more
This is an exploitation of a stack overflow vulnerability in D-link routers before login. This article focuses on recording the problems and analyses encountered during practical testing, serving as a reading note. Static Analysis The DIR-605L router has a stack overflow at the login point. In the login form, there is a parameter called FILECODE, … Read more
Overview This article mainly discusses five kernel vulnerabilities in the Snapdragon chipsets and ARM Mali GPU. These vulnerabilities have been reported to CISA KEV (Known Exploited Vulnerabilities Catalog). It is understood that all vulnerabilities have been exploited in the wild. Currently, the details of the exploit have not been publicly disclosed, and vendors have released … Read more
Quoted from: “Intelligent Manufacturing Information Security Technology” (Authors: Qin Zhiguang, Nie Xuyun, Qin Zhen) This book has been published, for details please see the end~ 「 1. Overview of Industrial Control Systems」 Industrial control systems (ICS) refer to a general term for various types of control systems, including monitoring and data acquisition systems and distributed … Read more
This article is an excellent piece from the Kanxue Forum. Kanxue Forum Author ID: Feng Yi Ying Han It seems that there is very little content related to the CoAP protocol on domestic security forums like Kanxue, and the CVEs mainly involve vulnerabilities in the CoAP protocol library. Therefore, I will organize and record my … Read more
This article is a highlight from the Kanxue Forum. Author from Kanxue ForumID: Toxic Table of Contents 1. Vulnerability Information 1.1 Brief Description 1.2 Component Overview 1.3 Exploitation 1.4 Impact 1.5 Solutions 2. Vulnerability Reproduction 2.1 Environment Setup 2.2 Reproduction Process 3. Vulnerability Analysis 3.1 Basic Information 3.2 Background Knowledge 3.2.1 Basic Knowledge 3.2.2 Terminology … Read more
This article is a highlight from the Kanxue Forum Author ID on Kanxue Forum: CatF1y House of Cat A new method of exploiting IO in GLIBC discovered in May, applicable to any version (including glibc2.35), named House of Cat and presented in the 2022 Strong Network Cup. Introduction House of Emma is one of the … Read more