资讯类：

Adobe AEM漏洞将导致运行微软的服务器被黑

http://news.softpedia.com/news/adobe-aem-vulnerability-leads-to-rce-on-microsoft-servers-506958.shtml

安全专家说在通过黑ISIS论坛，揭露其新的恐怖攻击行动

http://news.softpedia.com/news/security-firm-says-it-uncovered-new-terrorist-attacks-after-hacking-isis-forum-506960.shtml

http2协议发现严重的安全漏洞,大概会有八千五百万网站受影响

http://www.zdnet.com/article/severe-vulnerabilities-discovered-in-http2-protocol/#ftag=RSSbaffb68

技术类：

BlackHat2016相关专题：

来自blackhat2016的议题：Into The Core In-Depth Exploration Of Windows 10 IoT Core

https://www.blackhat.com/docs/us-16/materials/us-16-Sabanal-Into-The-Core-In-Depth-Exploration-Of-Windows-10-IoT-Core-wp.pdf

随着blackhat2016会议召开，Kali-Linux-Rolling-2016.2也提供下载了，想尝鲜的同学可以试试

http://kali.jgamblin.com/

来自blackhat2016的议题： next generation assembler framework （下一代反汇编框架）

http://www.keystone-engine.org/docs/BHUSA2016-keystone.pdf

blackhat 2016的议题：从浏览器到系统入侵（$hell on Earth:From Browser to System Compromise)的PPT

https://www.blackhat.com/docs/us-16/materials/us-16-Molinyawe-Shell-On-Earth-From-Browser-To-System-Compromise.pdf

其他技术类文章：

ABPTTS：通过WEB应用服务器上HTTP的TCP隧道，目前服务端仅有SP/WAR和ASP.NET,实际渗透用的着的工具哦

https://github.com/nccgroup/ABPTTS

heist：能够通过TCP窗口(tcp windows)窃取HTTP加密的信息

https://tom.vg/papers/heist_blackhat2016.pdf

一些有趣的复古漏洞以及强制驱动签名

http://kat.lua.cz/posts/Some_fun_with_vintage_bugs_and_driver_signing_enforcement/

前段时间推送过相关新闻，这次在blackhat会议上有细节了 ：Pirating AVS to Bypass Exploit Mitigations

https://www.blackhat.com/docs/us-16/materials/us-16-Yavo-Captain-Hook-Pirating-AVs-To-Bypass-Exploit-Mitigations.pdf

从本地文件包含到代码执行（主要介绍/proc/self.environ,www和ssh日志，上传文件等方法）

http://resources.infosecinstitute.com/local-file-inclusion-code-execution/

F-Secure发布的NanHaiShu（南海鼠）APT报告

https://www.f-secure.com/documents/996508/1030745/nanhaishu_whitepaper.pdf

NELocker – 一个JavaScript勒索样板

https://blogs.forcepoint.com/security-labs/nelocker-javascript-ransomware-boilerplate

Xen exploitation part 3: XSA-182, Qubes escape

http://blog.quarkslab.com/xen-exploitation-part-3-xsa-182-qubes-escape.html

CSS的mix-blend-mode功能能够被用来查看你的浏览历史,demo地址http://lcamtuf.coredump.cx/whack/

https://lcamtuf.blogspot.com/2016/08/css-mix-blend-mode-is-bad-for-keeping.html

Nuuo NVR 和 NETGEAR监控的多个RCE/溢出漏洞

http://seclists.org/bugtraq/2016/Aug/45

破解键盘记录程序hawkeye，让其重生

http://blog.deniable.org/blog/2016/08/04/cracking-hawkeye-keylogger-reborn/

Pwning Your Java Messaging With Deserialization Vulnerabilities（通过反序列化漏洞pwn你的java消息服务）

https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities.pdf

来自dlitchfield的bh议题:Hackproofing Oracle’s eBusiness Suite

https://www.blackhat.com/docs/us-16/materials/us-16-Litchfield-Hackproofing-Oracle-eBusiness-Suite.pdf

使用PowerUpSQL识别域中的SQL服务器弱密码

https://blog.netspi.com/identifying-domain-sql-servers-configured-with-weak-passwords-on-scale-using-powerupsql/

使用持久化WMI事件订阅在windows系统日志记录键盘和鼠标的链接

https://gist.github.com/vector-sec/873eb96251f3bd4bbbd509de9c5fd926

Hunting Lateral Movement （讲的是当攻击者在内网扩展入侵的时候，对其取证）

https://findingbad.blogspot.com/2016/08/hunting-lateral-movement.html

审计Microsoft LAPS环境的资料收集

https://www.pentestgeek.com/penetration-testing/another-lap-around-microsoft-laps

一些利用程序包开始尝试利用Netis路由器后门，有关Netis的漏洞可以参考http://blog.trendmicro.com/trendlabs-security-intelligence/netis-routers-leave-wide-open-backdoor/

https://isc.sans.edu/diary/21337

其他资讯：

360新发布的摩诃草APT组织报告，也就是Dropping Elephant/Patchwork 团队

https://ti.360.com/upload/report/file/mkczzbg1.pdf

文章原文链接:https://www.anquanke.com/post/id/84338