technology under the sun  Solaris, Windows, Linux  Apache, IIS, TCServer, etc.  Oracle, DB2, SQL Server  How we got better  We read and we studied.  Created a self-improvement project  2 week DEG and 3rd Party Application Installations  Route Adds – requires heightened security access  Database Data Script Execution  Load Balancer Node Disablement  OS and Security Patching  Requesting

分析⽬标直接供应商 [尤其是技术外包] 根据前⾯已搜集到的各类信息制作有针对性的弱⼝令字典 ⽬标所⽤ Waf 种类识别 与 绕过 BypassWAF ⽂件上传 / 读取 / 下载 BypassWAF Sql注⼊ BypassWAF RCE BypassWAF 各类Java Web中间件已知Nday漏洞利⽤ BypassWAF Webshell 免杀 其它更多 待补充修 组件的 已知 Nday 漏洞利⽤ IIS 6.0 RCE 短⽂件漏洞 PUT 任意写 Webdav RCE CVE-2017-7269 禅道项⽬管理系统 SQL注⼊ ⽂件读取 远程执⾏ 通达 OA SQL注⼊ 任意上传 Exchange 利⽤接⼝进⾏邮箱⽤户名枚举 针对各个接⼝的弱⼝令爆破 CVE-2020-0688 [ 利⽤前提是需要先得有任意⼀个邮箱⽤户权限 Citrix CVE-2019-19781 Jumpserver 身份验证绕过 Zabbix CVE-2017-2824 SQL注⼊ [ 2.0 ⽼版本 ] 控制台弱⼝令,敏感机器信息泄露 Cacti 低版本 SQL注⼊ 低版本 Q 注 控制台弱⼝令 Nagios CVE-2016-9565 控制台弱⼝令 Webmin RCE CVE-2019-15107

the Four Horsemen ride in just as we start our TV commercial campaign? I will turn off my sarcasm engine for a moment. Look—it turns out that the future involves lots of uncertainty. No one knows exactly

manages the sprint backlog. Developers Develops the software, to include software developers, database administrators and architects, testers, and other technical experts. End Users Conveys operational government can acquire the time and expertise of a contractor team of developers, testers, integrators, database specialists, etc. If using an existing contract vehicle (preferably a portfolio-level contract)

environment, test, c. Swing traffic to new environment, Rollback by swinging traffic back 2. Database changes a. Create two DB – put one in read only mode, backup & restore to new environment, swing