att

ATT&CK框架学习

孤人 提交于 2019-12-04 20:35:14
ATT&CK模型 ATT&CK是分析攻击者行为(即TTPs)的 威胁分析框架 。ATT&CK框架核心就是以矩阵形式展现的TTPs,即Tactics, Techniques and Procedures(战术、技术及步骤),是指攻击者从踩点到获取数据以及这一过程中的每一步是“如何”完成任务的。 ATT&CK模型分为三部分,分别是 PRE-ATT&CK , ATT&CK for Enterprise 和 ATT&CK for Mobile。 目前只学习 ATT&CK for Enterprise部分。 ATT&CK导航器 https://mitre-attack.github.io/attack-navigator/enterpris 其中,该框架囊括12类战术。 Initial Access 初始访问 Execution 执行 Persistence 持久化 Privilege Escalation 权限提升 Defense Evasion 防御逃逸 Credential Access 凭证获取 Discovery 发现 Lateral Movement 横向移动 Collection 收集 Command and Control 命令与控制 Exfiltration 数据渗出 Impact 影响 除了12种战术,还包括244种在相应战术中应用的具体技术

Does referencing constants without a dollar sign have a distinct meaning?

徘徊边缘 提交于 2019-12-04 05:33:58
问题 I wrote: mov 60, %rax GNU as accepted it, although I should have written mov $60, %rax Is there any difference between two such calls? 回答1: Yes; the first loads the value stored in memory at address 60 and stores the result in rax , the second stores the immediate value 60 into rax . 回答2: Just try it... mov 60,%rax mov $60,%rax mov 0x60,%rax 0000000000000000 <.text>: 0: 48 8b 04 25 3c 00 00 mov 0x3c,%rax 7: 00 8: 48 c7 c0 3c 00 00 00 mov $0x3c,%rax f: 48 8b 04 25 60 00 00 mov 0x60,%rax 16: 00

Defining “variables” in assembly language

六眼飞鱼酱① 提交于 2019-12-04 04:42:06
问题 I underdstand that this is extremely stupid quiestion, but I can't figure an answer for some time How do I correctly declare and define "variables" in GAS AT&T assembly language? For example, I want buffer for 5 bytes, two 1-byte variables (initially with 0 value), 2-byte variable with 0 and 2-byte variable with 10. This code doesn't work correctly, at least debugger says (on the first line of the program, after these declarations, just nop instruction) that b and c are big numbers instead of

Assembly (,%eax,4)

喜你入骨 提交于 2019-12-04 03:40:07
问题 If one of my command lines says: jmp *0x804a180(,%eax,4) what does that mean? I ask specifically because there is no value before the first comma and I'm not sure exactly what the * before the address means. 回答1: This instruction jumps to the location whose value is located at the address calculated as %eax * 4 + 0x804a180 . The * is used in AT&T syntax to indicate indirect jumps and calls. It basically means "jump to the location pointed to by this, instead of the value of this". It is

Trying to reverse engineer a function

冷暖自知 提交于 2019-12-03 22:00:33
问题 I'm trying to understand assembly in x86 more. I have a mystery function here that I know returns an int and takes an int argument. So it looks like int mystery(int n){} . I can't figure out the function in C however. The assembly is: mov %edi, %eax lea 0x0(,%rdi, 8), %edi sub %eax, %edi add $0x4, %edi callq < mystery _util > repz retq < mystery _util > mov %edi, %eax shr %eax and $0x1, %edi and %edi, %eax retq I don't understand what the lea does here and what kind of function it could be.

What is callq instruction?

自闭症网瘾萝莉.ら 提交于 2019-12-03 20:34:09
问题 I have some gnu assembler code for the x86_64 architecture generated by a tool and there are these instructions: movq %rsp, %rbp leaq str(%rip), %rdi callq puts movl $0, %eax I can not find actual documentation on the "callq" instruction. I have looked at http://support.amd.com/TechDocs/24594.pdf which is "AMD64 Architecture Programmer’s Manual Volume 3: General-Purpose and System Instructions" but they only describe CALL near and far instructions. I have looked at documentation for gnu

Look Closer to See Better Recurrent Attention Convolutional Neural Network for Fine-grained Image Re

邮差的信 提交于 2019-12-03 11:04:40
2. Related Work 关于细粒度图像识别的研究沿着两个维度进行,即 判别性特征学习和复杂的局部定位 。 2.1. Discriminative Feature Learning 学习判别性特征对于细粒度图像识别至关重要。由于深度学习的成功,大多数方法依赖于强大的卷积深层特征, 其在通用 和细粒度识别上 比手工制作的特征有着显着改善[4,5,6,17,29]。为了学习更强大的特征表示,深度残差网络[9]通过优化残差函数将CNN加深到152层,其将ImageNet测试集中的错误率降低到3.75%[17]。为了更好地建模细粒度类别中存在的微妙差异,最近提出一种双线性结构[ 19 ]来计算两个独立CNN的成对特征的相互作用来捕获图像的局部差异,这已经取得了鸟类分类中最先进的成果[30]。此外,另一种方法[ 34 ]提出用Fisher Vector[23]统一CNN与空间加权表示,显示了在鸟[30]和狗数据集[13]的优异结果。 2.2. Sophisticated Part Localization 以前的工作主要集中在利用边界框和部分注释等额外注释来定位细粒度识别中的重要区域[10,18,22,30,32,33]。然而,手动注释的大量劳动使得此任务对于大规模的实际问题不可行。最近,出现了一些新的工作,旨在提出一个更一般的情况,并提出使用无监督的方法来挖掘注意力区域

downloading a file that comes as an attachment in a POST request response in PhantomJs

匿名 (未验证) 提交于 2019-12-03 09:14:57
可以将文章内容翻译成中文,广告屏蔽插件可能会导致该功能失效(如失效,请关闭广告屏蔽插件后再试): 问题: I want to download a CSV file, it is generated on a button click through a POST request. I researched to my best on casperJs and phantomJS forums and returned empty handed. In a normal browser like firefox, a browser download dialog window appears after the post request. How to handle this case in PhantomJS TTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Encoding: gzip Vary: Accept-Encoding Server: Microsoft-IIS/7.5 Content-disposition: attachment;filename=ExportData.csv X-AspNet-Version: 2.0.50727 X

CodeIgniter “The filetype you are attempting to upload is not allowed.”

匿名 (未验证) 提交于 2019-12-03 09:06:55
可以将文章内容翻译成中文,广告屏蔽插件可能会导致该功能失效(如失效,请关闭广告屏蔽插件后再试): 问题: I was searching a lot and found many questions regarding this problem, unfortunately none of answers did help me. I'm trying to upload a png image, and I'm receiving the following error: The filetype you are attempting to upload is not allowed. I was following this CI guide to build my code: http://codeigniter.com/user_guide/libraries/file_uploading.html Here is what I got: view file: [..] = form_open_multipart() ?> = form_close() ?> [..] My controller: $config['upload_path'] = './uploads/'; $config['allowed_types'] = 'gif|jpg|png'; $config[

[转帖]IOC Security: Indicators of Attack vs. Indicators of Compromise

家住魔仙堡 提交于 2019-12-03 09:06:11
IOC Security: Indicators of Attack vs. Indicators of Compromise https://www.crowdstrike.com/blog/indicators-attack-vs-indicators-compromise/ December 9, 2014 Jessica DeCianno Endpoint Protection What is an Indicator of Compromise (IOC)? First we should provide a definition of an indicator of compromise (IOC). An IOC is often described in the forensics world as evidence on a computer that indicates that the security of the network has been breached. Investigators usually gather this data after being informed of a suspicious incident, on a scheduled basis, or after the discovery of unusual call