How to design a secure external interface, the old programmer summarized these points

Source: blog.csdn.net/xiaolizh/article/details/83011031 Bloggers have previously worked in the collection and payment system of Hengfeng Bank (equivalent to payment interface), including the current OLTP API transaction interface and the external data interface of virtual business. In short, when you have done a lot of projects and written a l ...

Added by Mikester on Thu, 10 Mar 2022 15:14:44 +0200

Nmap has accumulated practical experience for many years

Primary stageI Host discoveryFour layer transmission (TCP+UDP protocol)nmap -sP -PS[Port 1, port 2...Or port range][target](TCP SYN Ping) nmap -sP -PY[Port 1, port 2][target](SCTP INIT Ping) nmap -sP -PA[Port 1, port 2][target](TCP ACK Ping) nmap -sP -PU[Port 1, port 2][target](UDP Ping)Send empty UDP To ports 31 and 338, 40125 port is used by ...

Added by bob_rock on Wed, 09 Mar 2022 13:41:31 +0200

Installation and use of yara

Environment and installation Operating system: win10 Installation address: https://github.com/VirusTotal/yara/releases/tag/v4.2.0-rc1 Just under this address Tool use Open in cmd directory Command: yara my_rule my_file The first parameter is your yara rule file, and the second parameter is the detection file, which can be a directo ...

Added by erupt on Wed, 09 Mar 2022 07:38:38 +0200

Cryptography in reverse analysis -- MD5

0x01 introduction MD5 message digest algorithm (English: MD5 message digest algorithm), a widely used cryptographic hash function, can generate a 128 bit (16 byte) hash value. It can be used to ensure the integrity and consistency of information transmission. Save the password in the database (md5(pass,salt) mode). 0x02 algorithm flow 1. Dat ...

Added by egroeg41 on Tue, 08 Mar 2022 15:25:42 +0200

Security test: Xiaomi (xiaomi.com) website SMS interface security test, is it safe to use sliding verification code?

- "hidden dangers are more dangerous than open fire, prevention is better than disaster relief, and the responsibility is heavier than Mount Tai" preface This paper introduces the security test process of sending SMS verification code interface in detail, including ideas, some test codes and test results. This test website ...

Added by melbell on Mon, 07 Mar 2022 17:03:47 +0200

linux_pwn--double free&&qwb2018_raisepig

What is double free double free, as the name suggests, is released twice. In ctf, it is generally released twice for the same memory block. In fact, this is a little similar to the previous uaf generation method, which needs to meet that the pointer is not set to NULL ptr=malloc(0x10) ptr2=malloc(0x10) free(ptr) free(ptr2) free(ptr) Sin ...

Added by ThaSpY on Sat, 05 Mar 2022 10:00:00 +0200

Red team kill free training Chapter 1 - non executable shellcode

Close to the whole country hw, there will be a series of training articles on the free killing of the red team in the future. I hope you can avoid it indiscriminately on the field and will not release the ready-made loader, but the example is a good loader. Once again, free killing is not a unique talent of a technology, but a hundred flowers b ...

Added by jhuedder on Sat, 05 Mar 2022 08:59:22 +0200

Day03 Shiro study notes

1. Introduction to Shiro Apache Shiro is an open source security framework that provides authentication, authorization, cryptography, and session management. Shiro framework is intuitive and easy to use. At the same time, it can also provide robust security. Although its function is not as powerful as spring security, it is still enough in ord ...

Added by DimArchon84 on Sat, 05 Mar 2022 08:21:46 +0200

php disable_function bypass

bypass disable_functions disable_functions is PHP Ini, which can be used to set the PHP environment to prohibit the use of some functions. Usually, the website administrator can disable some dangerous command execution functions for security reasons. If you want to add it, it's in PHP Ini, separated by commas. to configure Open PHP Ini, sear ...

Added by powelly on Thu, 03 Mar 2022 14:54:45 +0200

Certificate super detailed parsing of cer Certificate (serial number, issuer, public key, etc.)

We generally say that certificate is digital certificate: digital certificate refers to a digital authentication that marks the identity information of all communication parties in Internet communication. People can use it to identify each other on the Internet There are generally two kinds: PFX certificate and CER certificate PFX certificate ...

Added by evdawg80 on Wed, 02 Mar 2022 12:28:49 +0200