52gov.com

leesec.com

Leesec's Blog | 喜欢旅行、街舞、极限运动. | 第2页

http://www.leesec.com/page/2

PASS MIN LEN=8 #设定最小用户密码长度为8 越大越好. Cat /etc/pam.d/system-auth password required /lib/security/$ISA/pam cracklib.so retry=3 minlen=9 dcredit=-1 ucredit=-1 lcredit=-1 ocredit=-1. Auth required pam tally2.so deny=3 unlock time=600 even deny root root unlock time=1200. Even deny root 也限制root用户. Root unlock time 设定root用户锁定后，多少时间后解锁，单位是秒. Ls -l /etc/passwd 644 or 600 or 000 ls -l /etc/shadow 600 or 000 ls -l /etc/group 644 or 600 or 000. Cat /etc/login.defs 查看umask 是否为027 or 077. Last awk '{print $1}' sort uniq.

leesec.com

工具：php实现穷举域名功能 | Leesec's Blog

http://www.leesec.com/archives/488

假设某网站域名为http:/ www.wangzhan.com，要实现这个功能. Http:/ www.aangzhan.com. Http:/ www.wangzhan.com. Echo 'string:'.$str zuo.' '.$str you. r n;. Echo $host. r n;. 2015 年 4 月 1 日. App安全测试之WebView rce学习笔记 →. A href= title= abbr title= acronym title= b blockquote cite= cite code del datetime= em i q cite= s strike strong. Python blind injection.py demo for mysql. Dedecms v5.7sp1 0day. WP Cumulus Flash tag cloud by Roy Tanck. Rookxy' s blog.

leesec.com

l2tp vpn | Leesec's Blog

http://www.leesec.com/archives/tag/l2tp-vpn

第一种 openswan xl2tpd 安装后，我发现这个只能用WINDOW连接，IOS系统连接不了VPN，所以被迫使用第二种方法。 第二种 strongswan xl2tpd 安装后，IOS、WINDOW系统都可以连接成功。 2strongswan xl2tpd 一键安装脚本 Centos6.5亲测成功. 2015 年 3 月 5 日. Python blind injection.py demo for mysql. Dedecms v5.7sp1 0day. WP Cumulus Flash tag cloud by Roy Tanck. Rookxy' s blog.

leesec.com

leesec | Leesec's Blog

http://www.leesec.com/archives/author/admin

Python blind injection.py demo for mysql. Thread num ). Mozilla/5.0 (Macintosh; Intel Mac OS X 10 7 3) AppleWebKit/534.55.3 (KHTML, like Gecko) Version/5.1.3 Safari/534.53.10'. User agent ). E: #time.sleep(0.01). String num ). String num ,. Http:/ 10.211.55.20/testmysql.php? Test=1'%20and%20if(mid(lpad(bin(length(user() ),8,0),. Http:/ 10.211.55.20/testmysql.php? 1%29%29%29,8,0%29,. Blind injection (. 2015 年 10 月 16 日. Thread num ). Http:/ i.youku.com/u/U. 2015 年 10 月 15 日. Bundle savedInstanceState ).

leesec.com

linux configure | Leesec's Blog

http://www.leesec.com/archives/tag/linux-configure

PASS MIN LEN=8 #设定最小用户密码长度为8 越大越好. Cat /etc/pam.d/system-auth password required /lib/security/$ISA/pam cracklib.so retry=3 minlen=9 dcredit=-1 ucredit=-1 lcredit=-1 ocredit=-1. Auth required pam tally2.so deny=3 unlock time=600 even deny root root unlock time=1200. Even deny root 也限制root用户. Root unlock time 设定root用户锁定后，多少时间后解锁，单位是秒. Ls -l /etc/passwd 644 or 600 or 000 ls -l /etc/shadow 600 or 000 ls -l /etc/group 644 or 600 or 000. Cat /etc/login.defs 查看umask 是否为027 or 077. Last awk '{print $1}' sort uniq.

leesec.com

linux安全配置检查项 | Leesec's Blog

http://www.leesec.com/archives/474

PASS MIN LEN=8 #设定最小用户密码长度为8 越大越好. Cat /etc/pam.d/system-auth password required /lib/security/$ISA/pam cracklib.so retry=3 minlen=9 dcredit=-1 ucredit=-1 lcredit=-1 ocredit=-1. Auth required pam tally2.so deny=3 unlock time=600 even deny root root unlock time=1200. Even deny root 也限制root用户. Root unlock time 设定root用户锁定后，多少时间后解锁，单位是秒. Ls -l /etc/passwd 644 or 600 or 000 ls -l /etc/shadow 600 or 000 ls -l /etc/group 644 or 600 or 000. Cat /etc/login.defs 查看umask 是否为027 or 077. Last awk '{print $1}' sort uniq.

leesec.com

浅谈UTF-32编码 | Leesec's Blog

http://www.leesec.com/archives/465

最近在收集曾经没完全弄明白例子(新手一枚)，http:/ zone.wooyun.org/content/4448 这篇文章里介绍utf-32编码绕过google的xss过滤，成功在ie9以下版本执行js脚本。 0x00][0x00][0x3C][0x00] – 㰀. 0x00][0x00][0x3E][0x00] – 㸀. 00%00%22%00 – ( 字符是%00%00%22%00 通过 utf-32转换utf-8得到的)接下来看例子. 运行后输出 %E2%88%80 也就是 字符. 接着我们就可以写出二哥demo页面 http:/ www.leesec.com/utf-32.php? DOCTYPE html html head meta charset=utf-8 /meta /head body input type=text value=? 2015 年 1 月 10 日. Python blind injection.py demo for mysql. Dedecms v5.7sp1 0day. WP Cumulus Flash tag cloud by Roy Tanck.