awesome-appsec-interview

Awesome AppSec Interview A curated list of resources, practice questions, and study materials to help you prepare for Application Security Engineer interviews, organized by interview type. Contents Interview Overview Secure Code Review Threat Modeling Coding & Scripting Scenario-Based Interviews...

Notes

Security Engineering at Google: My Interview Study Notes By nolang I am a security engineer at Google and these are the notes from when I was studying for the interviews. This is my first job in security and a lot of people have asked me how I studied. My notes consist mostly of a list of terms a...

hyperhives-macos-infostealer-analysis

HyperHives macOS Infostealer — Full Technical Analysis Threat intelligence: Rust-based macOS universal binary infostealer delivered through a fake job interview pipeline on Wellfound formerly AngelList. The operator persona "Felix" from "HyperHive" lured targets into running a malicious installer...

test-your-sysadmin-skills

:star: "A great Admin doesn't need to know everything, but they should be able to come up with amazing solutions to impossible projects. " - cwheeler33 ServerFault :star: "My skills are making things work, not knowing a billion facts. ... If I need to fix a system I’ll identify the problem, check...

cybersecurity-interview-questions

Cybersecurity Interview Questions A Free, Open‑Source Collection for Red Team, Blue Team, Web Security, Incident Response & More Overview...

CVE-2022-37177

CVE-2022-37177 - HireVue-Broken-Or-Risky-Cryptographic-Algorithm When visiting the interview invite link that HireVue provides for an interview, you are directed to a terms page where you agree to the terms before beginning the recorded and timed interview process. This initial HTTP response...

cybersecurity-interview-questions

エンジニアリング面接質問集 サイバーセキュリティにおけるエンジニアリング面接質問の世界へようこそ： セキュリティ＆コンピュータエンジニアリングの面接に関する、素晴らしいフレームワーク、ライブラリ、学習チュートリアル、ビデオ、ウェブキャスト、技術リソース、そしてクールな情報のコレクションです。 すべてのコントリビューターに感謝します。皆さんは素晴らしく、このプロジェクトは皆さんなしでは実現しませんでした！私たちの目標は、コミュニティ主導でカテゴリ別に整理された、よく知られたリソースのコレクションを構築することです。 目次 プログラミング言語／フレームワーク／プラットフォーム Android...

Interview_Tips

面试技巧（信息安全） 本页是我所经历过的面试总结，涵盖了相当广泛的岗位，虽然也收到过多次拒绝，但我从每次面试中学习，收集建设性反馈，并继续前进。 希望这些问题/技巧能对你有所帮助。 它通常涵盖以下岗位： 网络安全实习生 渗透测试实习生 / 红队 Web 应用 / 应用安全实习生 产品安全实习生 基础设施安全实习生 快速提示： 提前回顾你的简历，并预先向自己提出与简历相关的问题 如果你不了解某个问题/概念，不要绕着话题打转，要表达出只要给我一个工作环境，你就能学会它 你不可能什么都知道，如果答错了或需要澄清，请虚心接受 提前准备一段简短的自我介绍，用于介绍自己...

security-interview-questions

来源 测验：https://quizlet.com/231268221/general-information-security-questions-flash-cards/ SANS 速查表：https://www.sans.org/blog/the-ultimate-list-of-sans-cheat-sheets/ Offensive Security（OSCP）：https://411hall.github.io/OSCP-Preparation/ https://medium.com/@falconspy/oscp-exam-attempt-1-1893df5a0a00...

infosec-interview-questions

信息安全面试题 面向信息安全岗位的面试题合集 目录 应用程序安全 架构师 蓝队 加密 取证 综合 事件响应 网络 红队 漏洞管理 致谢 应用程序安全 如果在传输过程中必须同时加密和压缩数据，你会先做哪一步？为什么？ 压缩旨在利用数据中的模式来减小其体积。 加密旨在将数据随机化，使其在没有密钥的情况下无法被解读。 如果先加密再压缩，那么压缩将毫无用处。压缩对随机数据不起作用。 如果先压缩再加密，攻击者便可以借助消息长度（压缩率）中的模式来推断出关于数据的信息，并有可能破坏加密（如 CRIME 攻击）。 参考资料： 先加密还是先压缩？ CRIME 攻击者可以利用 HTTP 头注入漏洞做些什么...

Security_Engineer_Interview_Questions

安全工程师面试问题 2016年春天，我花了几个小时浏览Glassdoor.com，查看用户们在应聘安全工程师职位时提交的安全面试问题。我把所有不重复的问题都记了下来，这就是你看到的：原始的求职面试问题。这些问题显然也是Google、Salesforce、LinkedIn等公司会问的。 我故意没有把问题对应到具体公司。这不是本仓库的重点，学习才是。 安全领域难以全面掌握，更不用说融会贯通了。不过，我把问题按逻辑主题进行了分组。我也会定期在https://medium.com/@theporkskewer 上回答这些问题。 如果你觉得这个话题有用，这里有一些额外资源：...

Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands

The Computer Emergency Response Team of Ukraine CERT-UA has disclosed details of a new social engineering campaign orchestrated by Russian nation-state threat actors targeting IT workers in the country by masquerading as recruiters to trick them into installing malware. CERT-UA pinned the activit...

MAL-2026-13549 Malicious code in dojo-rn-interview (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42dcf2c659fc0c8b63b90671ae2a865a7811d5eeaaf321aab8355358117be47d [email protected] declares a preinstall script that runs index.js on npm install. The script collects host identifiers via os.hostname,...

Malicious code in dojo-rn-interview (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42dcf2c659fc0c8b63b90671ae2a865a7811d5eeaaf321aab8355358117be47d [email protected] declares a preinstall script that runs index.js on npm install. The script collects host identifiers via os.hostname,...

MAL-2026-12362 Malicious code in digital-interview-digital-interview-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f67152c58e29424a173ed692a1c5e15d980cc0b54518accf2f9d2811747b9fc3 On require of the package, helpers.js downloads a platform-specific binary from Cloudflare workers.dev hosts whose names are reconstructed at runtime...

Malicious code in ailaunchkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 998620f0a5d4d55fb3afccbaa210f7822a002db4b8ad09d5dae4954723264fb7 Package ailaunchkit version 0.1.2 on PyPI was scanned across 6 files with no static-rule matches and no traced behaviors indicating exfiltration,...

Malicious code in catalogai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccb9ff2c71a85c2bac770a874ed3c811e963ba9b3da37417fb600678d8119991 catalogai 0.1.2 presents itself as a semantic-search / AI-catalog library but the shipped modules perform browser credential theft and...

Malicious code in aiassistcore (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9561c11926b1e2d0a7f38f91edc062a77b27e624521dd7c1e500ef3c16a157a2 The package presents itself as 'AI assistant utilities' but its workspace.py implements two active attacks against the installer's Windows session. A...

Malicious code in aichannel (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e51fdc38d5678b9b9a96014b69db1062b6ecc71b8986a837b4e9ba8d03d7214 Package connects to a hardcoded C2 socket server SOCKETSERVERHOST/SOCKETSERVERPORT from cognikit.config and runs a typed-message session loop that...

Fake Coding Tests Deliver OtterCookie-Aligned Malware Hidden in SVG Flag Images

North Korean threat actors linked to the Contagious Interview campaign have been observed employing steganography in SVG image files to conceal malicious payloads as part of a campaign using fake job postings and coding challenges. "Any user who ran the project ended up with a four-stage payload...