热点概要：GNU Wget < 1.18访问列表绕过/条件竞争漏洞、理解ECMAScript6、通过JavaScript Less 编译器不信任的less文件导致的RCE问题、android N 手机加密的限制

国内热词：

---

美国绿党候选人以投票机可能被黑为由呼吁在三个摇摆州重新计票

Snowden 能被要求在德国NSA调查中作证

欧洲火星登陆器坠毁是持续一秒钟的故障导致的

为什么中国南方电网切断交流电网

Google DeepMind AI比人类专业人士更擅长读唇语

Google向记者和学者警告国家支持的黑客攻击

资讯类：

---

CERT建议微软不要取消对EMET的支持,因为他比win10自带的防护要好

http://www.theregister.co.uk/2016/11/24/cert_no_microsoft_even_win_7_emet_is_better_than_solo_win_10/

超过13万的美国海军个人数据泄漏

http://www.reuters.com/article/us-usa-cyber-navy-idUSKBN13J001

匿名者建议川普让John McAfee来安全美国的网络

http://www.newsweek.com/anonymous-backs-mcafee-aid-trump-securing-america-hackers-524250

技术类：

---

Kiwicon X 安全会议的所有视频

https://www.youtube.com/playlist?list=PLWC1moz0aOb-h-6zlwviD304yBXeUnfFa

IDA Python插件DriverBuddy脚本辅助逆向windows内核驱动

https://github.com/nccgroup/DriverBuddy

ZeroNights 2016安全会议PPT：I Know Where Your Page Lives: Derandomizing the latest Windows 10 Kernel

https://github.com/IOActive/I-know-where-your-page-lives

Devknox：自动修复安全问题的工具

https://blog.devknox.io/devknox-autocorrect-for-security-issues/

pycookiecheat:从浏览器的已验证会话中借用Cookie以便在Python脚本中使用

https://github.com/n8henrie/pycookiecheat

理解ECMAScript 6

https://leanpub.com/understandinges6/read

Linux Kernel 2.6.32-642 / 3.16.0-4 inode整形溢出POC

https://cxsecurity.com/issue/WLB-2016110205

HardenedBSD-stable 10-STABLE v46.19发行

http://hardenedbsd.org/article/op/2016-11-23/stable-release-hardenedbsd-stable-10-stable-v4619

Less.js: 通过JavaScript Less 编译器不信任的less文件导致的RCE问题

http://seclists.org/fulldisclosure/2016/Nov/133

给PowerShell Empire配置一个信任的证书

http://www.blackhillsinfosec.com/?p=5447

GNU Wget < 1.18访问列表绕过/条件竞争漏洞

https://legalhackers.com/advisories/Wget-Exploit-ACL-bypass-RaceCond-CVE-2016-7098.html

使用 rcsi.exe 绕过应用白名单

https://enigma0x3.net/2016/11/21/bypassing-application-whitelisting-by-using-rcsi-exe/

建立一个网络域名的白名单

http://threatcrowd.blogspot.com/2016/11/building-whitelist-of-network-domains.html

android N 手机加密的限制

https://blog.cryptographyengineering.com/2016/11/24/android-n-encryption/

Python隐写工具

https://github.com/fgrimme/Matroschka

magento恶意重定向到一键付款页面

https://blog.sucuri.net/2016/11/malicious-redirect-injected-magento-one-page-checkout.html

Windows x64 – Download & Execute Shellcode

https://www.exploit-db.com/exploits/40821/

Windows 10 KASLR Recovery with TSX 

http://blog.frizk.net/2016/11/windows-10-kaslr-recovery-with-tsx.html