vulnstack2 of red sun safety ATT & CK target aircraft combat series

Typera root URL: PIC \ att & CK target combat series - vulnstack2 statement study hard and make progress every day Environment configuration Baidu members can download directly from the cloud without any address http://vulnstack.qiyuanxuetang.net/vuln/detail/3/ While downloading, you can start the network configuration of vmware The ...

Added by ramram on Fri, 04 Mar 2022 17:49:56 +0200

php disable_function bypass

bypass disable_functions disable_functions is PHP Ini, which can be used to set the PHP environment to prohibit the use of some functions. Usually, the website administrator can disable some dangerous command execution functions for security reasons. If you want to add it, it's in PHP Ini, separated by commas. to configure Open PHP Ini, sear ...

Added by powelly on Thu, 03 Mar 2022 14:54:45 +0200

Certificate super detailed parsing of cer Certificate (serial number, issuer, public key, etc.)

We generally say that certificate is digital certificate: digital certificate refers to a digital authentication that marks the identity information of all communication parties in Internet communication. People can use it to identify each other on the Internet There are generally two kinds: PFX certificate and CER certificate PFX certificate ...

Added by evdawg80 on Wed, 02 Mar 2022 12:28:49 +0200

Original title of CTFSHOW competition (web711-web725)

Because there are many topics, many places are relatively simple. I hope the masters will understand.. web711 Scanning the directory found robots Txt, prompt static / secret key txt Access to get a string ctfshow_love_you Then enter the normal page, there is a login and registration, randomly register a user, and after logging in, it is fo ...

Added by slyte33 on Sun, 27 Feb 2022 13:22:34 +0200

[OS command injection 01] common functions that may cause OS command injection (system, exec, passthru, popen and backquote structure)

1. Overview of OS command injection Background: when programmers use script language (such as PHP) to develop applications, script language development is very fast, concise and convenient, but it is also accompanied by some problems, such as slow speed, unable to touch the bottom of the system, etc. When developing applications, especiall ...

Added by jonnym00 on Sun, 27 Feb 2022 06:35:42 +0200

Thinkphp6.0.x Deserialization Analysis

Impact Version Thinkphp6.0.0~6.0.2 Environment Setup Phpstudy: OS: WindowsPHP: 7.3.4ThinkPHP: 6.0.1 Create a test environment: composer create-projec topthink/think:6.0.* tp6.0.1 Then enter composer.json modifies "topthink/framework": "6.0.1" and executes composer update Create entry points: app/controller/Index.p ...

Added by NFD on Wed, 23 Feb 2022 19:20:03 +0200

phpMyAdmin common getshell methods

catalogue preface 1, View phpMyAdmin version 2, phpmyadmin common getshell methods 1. Premise 2. Website physical path acquisition method 3. Get shell through into outfile 4. Write shell through log file 5. Write shell through slow query 6. Create database and table and write to webshell summary preface phpMyAdmin is a MySQL databa ...

Added by cags on Mon, 21 Feb 2022 15:02:01 +0200

File upload vulnerability -- replay of upload labs shooting range (off 8-17)

Download range link Related principles ① $DATA bypass: php under windows system, if the file name + ":: $DATA" The DATA after:: $DATA will be treated as a file stream, the suffix will not be detected, and the file name before:: $DATA will be retained In this way, the purpose of bypassing suffix detection can be achieved Level 9 Sou ...

Added by sasito on Fri, 18 Feb 2022 13:02:20 +0200

Self study Shiro framework notes

Introduction to Shiro framework 1, Shiro overview 1.1 what is Shiro . Apache Shiro is a powerful and easy-to-use Java security framework, which provides functions such as authentication, authorization, encryption and session management. Shiro can provide comprehensive security management services for any application. It can be used not only ...

Added by kraen123 on Mon, 14 Feb 2022 14:34:10 +0200

log4j vulnerability analysis and summary

The Remote Code Execution Vulnerability of log4j2 [cve-2021-44228] exposed on December 8, 2021 can be called an epic nuclear bomb vulnerability. Although after such a long time, most of the relevant vulnerabilities in the current network have been repaired, they can still be found... Many leaders and research institutions on the Internet have a ...

Added by KrisNz on Sun, 13 Feb 2022 18:24:21 +0200