358 matches found
Notes
Google安全工程：我的面试学习笔记 作者 nolang 我是Google的一名安全工程师，这些是我准备面试时做的笔记。这是我的第一份安全工作，很多人问过我是如何学习的。我的笔记主要由一系列需要学习的术语和技术组成，外加一些帮助我记住某些细节的小贴士。我还包含了面试技巧和学习策略，这些与了解要学习哪些主题同样重要。 我会不定期更新笔记以涵盖更多主题。列表中包含很多很多主题和术语。请仔细思考你申请的职位，并针对性地学习。没人期望你成为所有领域的专家。 如果你的编码能力较弱：...
test-your-sysadmin-skills
:star: "一位优秀的系统管理员不需要知道一切，但他们应该能够针对不可能的项目提出惊人的解决方案。 " - cwheeler33 ServerFault :star: "我的技能是让事情运转起来，而不是知道十亿个事实。... 如果我需要修复一个系统，我会识别问题，检查日志并查找错误。如果我需要实施一个解决方案，我会研究正确的方案，实施并记录它，之后除非我经常与它互动，否则只会有一个大致的了解……这就是为什么要有文档。 " - Sparcrypt Reddit ℹ️ 该项目包含 284 个测试问题和答案，可用于测试您的知识或在 Linux nix 系统管理员等职位的面试/考试中使用。 ✔️...
security-interview-questions
Sources QUIZ: https://quizlet.com/231268221/general-information-security-questions-flash-cards/ SANS Cheat Sheets: https://www.sans.org/blog/the-ultimate-list-of-sans-cheat-sheets/ Offensive Security OSCP: https://411hall.github.io/OSCP-Preparation/...
awesome-appsec-interview
Awesome Entrevista AppSec Una lista curada de recursos, preguntas de práctica y materiales de estudio para ayudarte a prepararte para entrevistas de Ingeniero de Seguridad de Aplicaciones , organizadas por tipo de entrevista. Contenido Resumen de la Entrevista Revisión de Código Seguro Modelado d...
hyperhives-macos-infostealer-analysis
HyperHives macOS信息窃取器 — 全面技术分析 威胁情报： 基于Rust的macOS通用二进制信息窃取器，通过Wellfound（原名AngelList）上的虚假面试流程 投递。操作者身份为来自"HyperHive"的"Felix"，诱骗目标从macos.hyperhives.net运行恶意安装程序。本仓库记录了完整的静态分析：571个加密配置值已恢复 ，包括C2 URL、Sentry DSN以及276个被针对的Chrome扩展ID 。 | ---|--- 样本 SHA-256|...
cybersecurity-interview-questions
Preguntas de Entrevista en Ciberseguridad Una colección gratuita y de código abierto para Red Team, Blue Team, Seguridad Web, Respuesta a Incidentes y más...
Interview_Tips
Consejos para entrevistas Seguridad de la Información Esta página es un resumen de las entrevistas por las que he pasado; cubrí una variedad considerable de roles, recibí múltiples rechazos, pero aprendí de cada entrevista, recopilé comentarios constructivos y seguí adelante. Espero que estas...
Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands
The Computer Emergency Response Team of Ukraine CERT-UA has disclosed details of a new social engineering campaign orchestrated by Russian nation-state threat actors targeting IT workers in the country by masquerading as recruiters to trick them into installing malware. CERT-UA pinned the activit...
MAL-2026-12362 Malicious code in digital-interview-digital-interview-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f67152c58e29424a173ed692a1c5e15d980cc0b54518accf2f9d2811747b9fc3 On require of the package, helpers.js downloads a platform-specific binary from Cloudflare workers.dev hosts whose names are reconstructed at runtime...
Malicious code in ailaunchkit (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 998620f0a5d4d55fb3afccbaa210f7822a002db4b8ad09d5dae4954723264fb7 Package ailaunchkit version 0.1.2 on PyPI was scanned across 6 files with no static-rule matches and no traced behaviors indicating exfiltration,...
Malicious code in catalogai (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccb9ff2c71a85c2bac770a874ed3c811e963ba9b3da37417fb600678d8119991 catalogai 0.1.2 presents itself as a semantic-search / AI-catalog library but the shipped modules perform browser credential theft and...
Malicious code in aiassistcore (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9561c11926b1e2d0a7f38f91edc062a77b27e624521dd7c1e500ef3c16a157a2 The package presents itself as 'AI assistant utilities' but its workspace.py implements two active attacks against the installer's Windows session. A...
Malicious code in aichannel (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e51fdc38d5678b9b9a96014b69db1062b6ecc71b8986a837b4e9ba8d03d7214 Package connects to a hardcoded C2 socket server SOCKETSERVERHOST/SOCKETSERVERPORT from cognikit.config and runs a typed-message session loop that...
Fake Coding Tests Deliver OtterCookie-Aligned Malware Hidden in SVG Flag Images
North Korean threat actors linked to the Contagious Interview campaign have been observed employing steganography in SVG image files to conceal malicious payloads as part of a campaign using fake job postings and coding challenges. "Any user who ran the project ended up with a four-stage payload...
CVE-2026-15137
A weakness has been identified in code-projects Interview Management System 1.0. This vulnerability affects unknown code of the file \inc\classes\View.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been made available to the...
EUVD-2026-42493
A weakness has been identified in code-projects Interview Management System 1.0. This vulnerability affects unknown code of the file \inc\classes\View.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been made available to the...
CVE-2026-15137
CVE-2026-15137 affects code-projects Interview Management System 1.0. The vulnerability arises from insecure handling of the input argument ID in file inc\classes\View.php , which enables SQL injection . The issue is exploitable remotely with no authentication, and public exploits are reported. C...
CVE-2026-15137 code-projects Interview Management System View.php sql injection
A weakness has been identified in code-projects Interview Management System 1.0. This vulnerability affects unknown code of the file \inc\classes\View.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been made available to the...
North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign
The North Korean threat actors linked to the Contagious Interview campaign have been observed publishing 108 unique packages and web browser extensions spanning npm, Packagist, Go, and Google Chrome as part of an ongoing activity referred to as PolinRider. "The campaign remains active, and new...
