How to design a secure external interface, the old programmer summarized these points
Source: blog.csdn.net/xiaolizh/article/details/83011031
Bloggers have previously worked in the collection and payment system of Hengfeng Bank (equivalent to payment interface), including the current OLTP API transaction interface and the external data interface of virtual business. In short, when you have done a lot of projects and written a l ...
Added by Mikester on Thu, 10 Mar 2022 15:14:44 +0200
Nmap has accumulated practical experience for many years
Primary stageI Host discoveryFour layer transmission (TCP+UDP protocol)nmap -sP -PS[Port 1, port 2...Or port range][target](TCP SYN Ping)
nmap -sP -PY[Port 1, port 2][target](SCTP INIT Ping)
nmap -sP -PA[Port 1, port 2][target](TCP ACK Ping)
nmap -sP -PU[Port 1, port 2][target](UDP Ping)Send empty UDP To ports 31 and 338, 40125 port is used by ...
Added by bob_rock on Wed, 09 Mar 2022 13:41:31 +0200
Installation and use of yara
Environment and installation
Operating system: win10
Installation address: https://github.com/VirusTotal/yara/releases/tag/v4.2.0-rc1
Just under this address
Tool use
Open in cmd directory Command:
yara my_rule my_file
The first parameter is your yara rule file, and the second parameter is the detection file, which can be a directo ...
Added by erupt on Wed, 09 Mar 2022 07:38:38 +0200
Cryptography in reverse analysis -- MD5
0x01 introduction
MD5 message digest algorithm (English: MD5 message digest algorithm), a widely used cryptographic hash function, can generate a 128 bit (16 byte) hash value. It can be used to ensure the integrity and consistency of information transmission. Save the password in the database (md5(pass,salt) mode).
0x02 algorithm flow
1. Dat ...
Added by egroeg41 on Tue, 08 Mar 2022 15:25:42 +0200
Security test: Xiaomi (xiaomi.com) website SMS interface security test, is it safe to use sliding verification code?
- "hidden dangers are more dangerous than open fire, prevention is better than disaster relief, and the responsibility is heavier than Mount Tai"
preface
This paper introduces the security test process of sending SMS verification code interface in detail, including ideas, some test codes and test results. This test website ...
Added by melbell on Mon, 07 Mar 2022 17:03:47 +0200
linux_pwn--double free&&qwb2018_raisepig
What is double free
double free, as the name suggests, is released twice. In ctf, it is generally released twice for the same memory block. In fact, this is a little similar to the previous uaf generation method, which needs to meet that the pointer is not set to NULL
ptr=malloc(0x10)
ptr2=malloc(0x10)
free(ptr)
free(ptr2)
free(ptr)
Sin ...
Added by ThaSpY on Sat, 05 Mar 2022 10:00:00 +0200
Red team kill free training Chapter 1 - non executable shellcode
Close to the whole country hw, there will be a series of training articles on the free killing of the red team in the future. I hope you can avoid it indiscriminately on the field and will not release the ready-made loader, but the example is a good loader. Once again, free killing is not a unique talent of a technology, but a hundred flowers b ...
Added by jhuedder on Sat, 05 Mar 2022 08:59:22 +0200
Day03 Shiro study notes
1. Introduction to Shiro
Apache Shiro is an open source security framework that provides authentication, authorization, cryptography, and session management. Shiro framework is intuitive and easy to use. At the same time, it can also provide robust security. Although its function is not as powerful as spring security, it is still enough in ord ...
Added by DimArchon84 on Sat, 05 Mar 2022 08:21:46 +0200
php disable_function bypass
bypass disable_functions
disable_functions is PHP Ini, which can be used to set the PHP environment to prohibit the use of some functions. Usually, the website administrator can disable some dangerous command execution functions for security reasons. If you want to add it, it's in PHP Ini, separated by commas.
to configure
Open PHP Ini, sear ...
Added by powelly on Thu, 03 Mar 2022 14:54:45 +0200
Certificate super detailed parsing of cer Certificate (serial number, issuer, public key, etc.)
We generally say that certificate is digital certificate: digital certificate refers to a digital authentication that marks the identity information of all communication parties in Internet communication. People can use it to identify each other on the Internet
There are generally two kinds: PFX certificate and CER certificate
PFX certificate ...
Added by evdawg80 on Wed, 02 Mar 2022 12:28:49 +0200