capabilities faster and responding more effectively to changes in operations, technology, and budgets. This guide provides DoD acquisition professionals with details on how to adopt Agile practices within each element apply. Agile requires a set of processes, roles, and culture that will take time to employ. This guide is intended to show how the DoD could tailor the Defense Acquisition Framework to benefit from Agile but don’t know how to apply Agile within the unique and complex DoD acquisition environment. This guide seeks to adapt proven principles of Agile development specifically to the DoD context. More and

查找⽬标⽹站泄露的各类敏感⽂件, ⽹站备份⽂件, 敏感配置⽂件, 源码 , 别⼈的webshell, 等等等...] ⽬标站点⾃身在前端代码中泄露的各种敏感信息 fofa / shodan / bing / google hacking 深度利⽤ 搜集⽬标 学⽣学号 / 员⼯⼯号 / ⽬标邮箱 [ 并顺⼿到各个社⼯库中去批量查询这些邮箱曾经是否泄露过密码 ] ⽬标⾃⼰对外提供的各种 技术⽂档 / wiki ⾥泄露的各种账号密码及其它敏感信息 ⽬标所⽤ Waf 种类识别 与 绕过 BypassWAF ⽂件上传 / 读取 / 下载 BypassWAF Sql注⼊ BypassWAF RCE BypassWAF 各类Java Web中间件已知Nday漏洞利⽤ BypassWAF Webshell 免杀 其它更多 待补充修 其它更多 , 待补充修正... 0x02 ⼊⼝权限获取 [外部防御重⼼ 故,仅仅只挑选了⼀些相对会经常遇到的,且实战中确实能有效协助快速getshell 的 "中间件" , "开源程序" 及 "web组件" 针对各类 Java 中间件的各种已知 Nday 漏洞利⽤ 不同于其它脚本类web程序,Java的运⾏权限通常都⽐较⾼,甚⾄⼤部分都是直接⽤root/administrator/system 权限在跑 所以拿到的shell权限⼀般也⾮常⾼,通常都直接是服务器权限

d. Google Web Server (GWS) team was struggling with changes – Hard line: no changes would be accepted into GWS without accompanying automated tests. Spread Testing Grouplet team approach. Google – single build & package software, runs automated unit tests, and code quality (static analysis, coverage, style, etc.) 2. Package the code only once – use the same packages throughout the pipeline 3. Captures

is Velocity all about? What did I learn? Service Workers: The Practical Bits by Patrick Meenan (Google) @patmeenan http://www.slideshare.net/patrickmeenan/service-workers-for-performance  They are effectively mentor telling you what not to worry about  Perf events mixed mode can show stack traces of both Java and native system calls Continuous Delivery in Financial Training by David Genn (IG) @david_genn

Faults & errors 10. Circuit breaker trips 11. Delays 12. Backup success/failure d. USE TELEMETRY TO GUIDE PROBLEM-SOLVING i. Don’t practice “Mean Time until Declared Innocent” – culture of blame encourages way to do that operation.” d. HAVE DEVELOPERS INITIALLY SELF-MANAGE THEIR PRODUCTION SERVICE i. Google has development groups self-manage their services in production before they become eligible for

experienceCoaching JourneyCoaching“I don’t do anything!”Coach • Bulldozer – Remove impediments • Shepherd – Guide back to agile principles • Servant Leader – Serve the team, not you • Performance Guardian – Facilitate Authority Process Authority *Adopted from Agile Coaching Institute Develop them all! Let your style change!Agile Team Stages Learn It Get It Make It Your OwnFrom Shu To Ri • Recognize the ‘Edge’

and analysis tools 6. Tutorials and standards ii. Google – Single repository with over 1B files and over 2B SLOC, over 25K engineers for every Google property d. SPREAD KNOWLEDGE BY USING AUTOMATED TESTS INTERNAL CONSULTING AND COACHES TO SPREAD PRACTICES i. Capital One – SMEs hold open office hours ii. Google Testing Grouplet and Testing on the Toilet periodical 1. Started Test Certified Levels for teams

potential through autonomy and mastery  Agile is a journey, not a place and the Agile Coach is the guide  A coach must have a deep understanding of the Agile Principles and real world experience  Start power of Agile frameworks (Scrum, Kanban) is that they create/sustain these conditions How  Guide people towards applying agile principles within the organization  Do not direct or force individuals

que.com/ [2] Personal Productivity Using The Pomodoro Technique, Daniel Hinojosa, https://docs.google.com/presentation/d/1ufjcILARuowbv3Y9r-FP9-x3kmlIzq7bvOJBxRVh3-w/ present#slide=id.i0 [3] Flow: The