每周蓝军技术推送（2024.7.20-7.26）

https://www.synacktiv.com/publications/injecting-java-in-memory-payloads-for-post-exploitation

https://github.com/myexploit/Hunt

https://github.com/efeali/fragtunnel

https://cti.monster/blog/2024/07/25/pdfdropper.html

https://github.com/0x6rss/pdfdropper

https://github.com/NVISOsecurity/codasm

https://research.checkpoint.com/2024/thread-name-calling-using-thread-name-for-offense/

https://github.com/TierZeroSecurity/edr_blocker

https://tierzerosecurity.co.nz/2024/07/23/edr-telemetry-blocker.html

https://github.com/zer0condition/ZeroHVCI

https://github.com/SamuelTulach/PwnedBoot

https://securityonline.info/cve-2024-39700-cvss-9-9-severe-flaw-in-jupyterlab-template-discovered/

https://research.nccgroup.com/2024/06/11/pumping-iron-on-the-musl-heap-real-world-cve-2022-24834-exploitation-on-an-alpine-mallocng-heap/

https://medium.com/@TalBeerySec/revealing-the-inner-structure-of-aws-session-tokens-a6c76469cba7

https://www.praetorian.com/blog/capturing-exposed-aws-keys-during-dynamic-web-application-tests/

https://llama.meta.com/trust-and-safety/

https://embracethered.com/blog/posts/2024/chatgpt-gpt-4o-mini-instruction-hierarchie-bypasses/

https://embracethered.com/blog/posts/2024/google-colab-image-render-exfil/

https://github.com/timothee-chauvin/eyeballvul

https://arxiv.org/abs/2407.08708

https://posts.specterops.io/phish-out-of-water-aaeb677a5af3

https://security.googleblog.com/2024/07/building-security-into-redesigned.html

https://posts.specterops.io/the-security-principle-every-attacker-needs-to-follow-905cc94ddfc6

https://www.riskinsight-wavestone.com/en/2024/07/datascience-for-redteam-extend-your-attack-surface/

探索金融系统大型机攻击向量

https://blog.nviso.eu/2024/07/16/punch-card-hacking-exploring-a-mainframe-attack-vector/

https://petsymposium.org/popets/2024/popets-2024-0070.pdf

https://br0k3nlab.com/posts/2024/07/introducing-the-rex-rule-explorer-project/

https://censys.com/a-beginners-guide-to-hunting-open-directories/