redis rce漏洞安全

My decision to attend a bootcamp for cybersecurity was a surprise for many around me.

我决定参加网络安全训练营的决定令我周围的许多人感到惊讶。

My parents didn’t get why I’d give up on a steady high-paying job, especially with the quarantine recession looming around the corner.

我的父母不明白为什么我会放弃一份稳定的高薪工作,尤其是在检疫性衰退迫在眉睫的情况下。

My boss and the head of people were caught off-guard as I seemed to be hitting my stride in maturing my side of the business.

我的老板和其他人的领导层措手不及,因为我似乎在逐步成熟自己的业务方面大步前进。

My peers were surprised that I’d choose cybersecurity rather software engineering or data science, which were much more popular routes.

我的同龄人惊讶于我选择网络安全而不是软件工程或数据科学,这是更受欢迎的途径。

It’s a bit of a long story, but I hope my meandering 20s can be of some help to other folks trying to find their way.

这是一个漫长的故事,但是我希望我曲折的20多岁能对其他尝试找到路的人有所帮助。

像疯子一样疯狂 (Going Mad as Mad Men)

For those who don’t know me well, I had attended a specialized arts program in high school with the intent to become a designer later on. I liked the idea of doing something creative as a profession, as opposed to becoming a doctor or lawyer like my parents wanted.

对于那些不太了解我的人,我参加了高中的一项专业艺术课程,目的是以后成为一名设计师。 我喜欢做一些具有创造力的职业的想法,而不是像我父母希望的那样成为医生或律师。

Concerned about my future, a family friend who had gotten his MFA later in life recommended that I get a general education first so my options wouldn’t be limited. There were, after all, plenty of washed up creatives that didn’t have backup career paths. After a long wrestle with self-doubt, I gave up a spot at RISD (Rhode Island School of Design) to “sell out” and go to business school at NYU, trading charcoal smudges and ink fumes for Powerpoints and starched collars.

考虑到我的未来,一个在以后生活中获得外交硕士学位的家庭朋友建议我首先接受一般教育,这样我的选择就不会受到限制。 毕竟,有很多被洗掉的创意没有后备的职业道路。 经过长时间的自我怀疑,我放弃了在RISD(罗德岛设计学院)的一个职位,“卖出去”并去了纽约大学的商学院,用炭笔和墨水烟雾买卖Powerpoints和淀粉状衣领。

Although economics and theoretical finance did rekindle an appreciation for quantitative work, I honestly couldn’t see myself being either an investment banker or management consultant. I chose instead to major in marketing as it seemed like a nice link to my creative past, and eventually landed my first gig at a well-known advertising agency.

尽管经济学和理论金融学确实重新激发了对定量工作的重视,但老实说,我不能认为自己是投资银行家或管理顾问。 相反,我选择了主修市场营销,因为这似乎与我的创意过去有着很好的联系,最终我在一家著名的广告公司找到了第一场演出。

Anyone who has worked in advertising can confirm that it’s easy to get caught up in the rhythm of agency life. You start out getting paid shit, so you pick up extra work to impress your boss and get promoted faster. There’s a certain camaraderie among your class of plebs (interns and assistants) due to the shared suffering, and it’s fun to commiserate together over free booze sponsored by a vendor (you’re too poor to buy your own).

任何从事广告工作的人都可以确认,很容易陷入代理人生活的节奏中。 您一开始会获得报酬,所以您会花更多的工作来打动老板并得到更快的晋升。 由于共同的痛苦,您的众生(实习生和助手)中有某种友情,同心同情供应商赞助的免费酒是很有趣的(您太穷了,无法自己购买)。

As you climb the ladder, you sometimes get praised by the client or management (hopefully getting a promotion or better assignment). This addictive dopamine kick helps you forget the fact that you now make less than your assistant now that you don’t qualify for overtime. You and your peers begin to see that there’s less space at the top of the food chain, and start to become more competitive about who has the better clients, who’s busier, etc.

当您爬上梯子时,有时会受到客户或管理人员的称赞(希望得到晋升或更好的分配)。 这种令人上瘾的多巴胺踢脚使您忘记了以下事实:由于您不符合加班资格,现在您的收入低于助手。 您和您的同伴开始看到食物链顶部的空间越来越小,并开始在谁拥有更好的客户,谁更忙等方面变得更具竞争力。

During a particularly dark and slightly alcoholic period of my advertising career, I stumbled across a memoir that art director Linds Redding wrote while struggling with cancer. It cut deep because I realized that the old creative side of me also yearned for some kind of purpose and legacy, and that I wasn’t sure why I was running this particular rat race.

在我广告生涯的一个特别黑暗且略为酗酒的时期,我偶然发现了艺术总监Linds Redding在与癌症作斗争时写的回忆录 。 之所以深入,是因为我意识到我那古老的创造力也渴望某种目的和遗产,而且我不确定为什么要参加这种特殊的竞赛

This was the con. Convincing myself that there was nowhere I’d rather be was just a coping mechanism. I can see that now. It wasn’t really important. Or of any consequence at all, really. How could it be? We were just shifting product. Our product, and the clients’. Just meeting the quota. “Feeding the beast” as I called it on my more cynical days.

这就是骗局。 说服自己,我无处可去只是一种应对机制。 我现在可以看到。 这不是很重要。 或根本没有任何后果。 怎么会这样? 我们只是在转移产品。 我们的产品,以及客户的。 刚达到配额。 在我更愤世嫉俗的日子里,我称其为“喂食野兽”。

So was it worth it?

那值得吗?

Well, of course not. It turns out it was just advertising. There was no higher calling. No ultimate prize. Just a lot of faded, yellowing newsprint, and old video cassettes in an obsolete format I can’t play anymore, even if I was interested. Oh yes, and a lot of framed certificates and little gold statuettes. A shit-load of empty Prozac boxes, wine bottles, a lot of grey hair and a tumour of indeterminate dimensions.

好吧,当然不会。 事实证明,这只是广告。 没有更高的要求。 没有终极奖励。 即使有兴趣,也只能播放许多褪色,泛黄的新闻纸和过时的旧式录像带,我无法播放了。 哦,是的,还有很多裱框的证书和小金像。 一堆空的百忧解盒子,酒瓶,很多白发和大小不确定的肿瘤。

It sounds like I’m feeling sorry for myself again. I’m not. It was fun for quite a lot of the time. I was pretty good at it. I met a lot of funny, talented and clever people, got to become an overnight expert in everything from shower-heads to sheep-dip, got to scratch my creative itch on a daily basis, and earned enough money to raise the family that I love, and even see them occasionally.

听起来我又为自己感到难过。 我不是。 很多时间都很有趣。 我非常擅长。 我遇到了很多有趣,有才华和聪明的人,成为了从淋浴喷头到羊皮浸洗等各种领域的通宵专家,每天都在刮擦我的创意之痒,并赚了足够的钱养育我的家庭爱,甚至偶尔见到他们。

But what I didn’t do, with the benefit of perspective, is anything of any lasting importance. At least creatively speaking. Economically I probably helped shift some merchandise. Enhanced a few companies bottom lines. Helped make one or two wealthy men a bit wealthier than they already were.

但是,从透视的好处来看,我没有做的事情具有任何持久的重要性。 至少是创造性的。 从经济上讲,我可能帮助转移了一些商品。 增强了一些公司的底线。 帮助一个或两个有钱人比他们现在变得更加富有。

As a life, it all seemed like such a good idea at the time.

作为一种生活,当时一切似乎都是一个好主意。

It dawned on me that although I was good at my job, improving the return on ad spend for advertisers was not really the mark I* wanted to make upon the world. From then on, I shifted gears towards finding out “what I wanted to be when I grew up”, and away from blindly climbing a ladder I wasn’t sure I wanted to reach the top of.

我突然意识到,尽管我擅长于工作,但提高广告商的广告支出回报并不是我*想要在世界上留下的烙印。 从那时起,我开始着手研究“长大后想要成为什么样的人”,而不是盲目地爬上一个不确定的梯子,我不确定自己是否想登顶。

*I have many comrades who are still passionate about advertising/marketing, and don’t mean to disparage that in any way. It just wasn’t my cup of tea.

*我有许多同志仍然对广告/营销充满热情,并不打算以任何方式贬低他们。 那不是我的茶。

数学是沉思,不是计算 (Math as Contemplation, Not Calculation)

One of many things I appreciate about my media buying background is that it fostered a natural appreciation for math that I’d forgotten. At its heart, advertising is similar to managing an investment portfolio — as media buyers, we’d try to allocate our clients’ budget in a way that would maximize the return (spend money to make more money). By performing controlled testing, we could figure out whether the “information gain” from purchasing consumer data exceeded the costs, which then enabled us to make recommendations based on cold hard math rather than sales hype.

我对我的媒体购买背景非常感激的一件事就是,它自然而然地激发了我所忘记的数学知识。 从本质上讲,广告类似于管理投资组合-作为媒体购买者,我们将尝试以最大程度地获得回报(花钱赚更多钱)的方式分配客户的预算。 通过执行受控测试,我们可以弄清楚从购买消费者数据中获得的“信息收益”是否超过了成本,这使我们能够基于冷酷的数学而不是销售炒作来提出建议。

After moving “in-house” at several brands to work as a pure data analyst, I was also given the opportunity to see how theoretical concepts from my undergrad education played out in the real world. For example, promotion pricing tests at a DTC (direct to consumer) subscription brand were vivid displays of price elasticity in action. We ended the tests not simply knowing which option was better, but also gaining an understanding on how consumers respond to certain variables in a nonlinear fashion.

在迁移了多个品牌的“内部”人员以担任纯粹的数据分析师之后,我还有机会对本科生的理论观念在现实世界中发挥了作用。 例如,DTC(直接面向消费者)订阅品牌的促销定价测试生动地体现了价格弹性的作用。 我们结束了测试,不仅知道哪个选项更好,而且还了解了消费者如何以非线性方式响应某些变量。

We weren’t performing rocket science, but I began to see that math was not merely useful for bean-counting. Just as literature models the human condition, math allows us to ponder and understand how the world behaves. As we see the world more accurately, we can identify value and opportunities that others can’t.

我们不是在进行火箭科学的研究,但我开始发现数学不仅对bean计数有用。 正如文献模拟人类状况一样,数学使我们能够思考和理解世界的行为。 当我们更准确地看到世界时,我们可以确定他人无法获得的价值和机会

For example, one of my research projects showed that “retargeting” (sending you ads after you leave a site), the bread and butter of most display advertising, isn’t very effective at causing people to buy stuff — it just good at claiming attribution credit for people who would have bought it later anyway. We were able to convince the client to shift their dollars towards broad reach targeting instead, focusing on bringing in new potential customers.

例如,我的一个研究项目表明,“重定向”(离开网站后向您发送广告)是大多数展示广告的基本内容,它在吸引人们购买商品方面不是非常有效-只是声称归功于那些以后会购买它的人。 我们能够说服客户将他们的钱转移到更广泛的目标上,专注于吸引新的潜在客户。

演示地址

“Sabermetrics” as dramatized by “Moneyball”
如“钱球”所戏剧化的“ Sabermetrics”

My work in analytics also led me to study Python programming, where I became enthralled by our ability to use basic building blocks like lists and loops to solve increasingly more difficult problems. It was really exciting for me when I was able to make my own duct-tape solutions work in lieu of formal data engineering resources. Programming is intellectually stimulating in its own philosophical way — I fondly remember a night where the engineering director gave me a heated lesson on what “truthy” and “falsey” meant in Python, a challenging concept to digest given the amount of bourbon we’d just consumed.

我在分析方面的工作也使我学习了Python编程,这让我着迷于使用基本的构建模块(如列表和循环)来解决日益棘手的问题的能力。 当我能够使自己的风管胶带解决方案代替正式的数据工程资源而工作时,这对我来说真的很令人兴奋。 编程以其自己的哲学方式在智力上刺激着我—我深深地记得一个夜晚,工程总监给了我热烈的教训,了解Python中“真实的”和“假的”的含义,鉴于我们需要的波旁威士忌数量,这是一个难以理解的概念刚吃完。

Through all this, I began to see technical work as an alluring stage to discover where I wanted to be.

通过所有这些,我开始将技术工作视为诱人的阶段,以发现自己想要去的地方。

但是为什么要上网? (But Why Cyber?)

At this point you’re probably wondering why I didn’t choose to specialize in either data science or software engineering.

在这一点上,您可能想知道为什么我没有选择专门研究数据科学或软件工程。

Data science is indeed super cool, and I am very grateful for the exposure I had to it while working as an in-house analyst. There were, however, a good handful of reasons why I decided not to go down that path:

数据科学确实非常酷,我非常感谢在担任内部分析师时所经历的一切。 但是,有很多原因使我决定不走这条路:

  • Depending on where you go, data science can be pretty elitist; there are a lot of hiring managers who might not look at you if you don’t have a PhD.根据您的去向,数据科学可以算是精英人士。 如果您没有博士学位,很多招聘经理可能不会看您。
  • On the flip side, the democratization of data science education has produced a glut of entry level data scientists, making it much harder to compete for that entry level role. The advanced practitioners have had to rebrand themselves as machine-learning engineers.另一方面,数据科学教育的民主化导致大量入门级数据科学家,这使得竞争入门级角色变得更加困难。 高级从业者不得不将自己重塑为机器学习工程师。
  • Much of the time spent as an analyst or data scientist is in cleaning up messy data and in producing reporting (not necessarily analysis!). Many companies say they want data science when what they really want is business intelligence.担任分析师或数据科学家所花费的大部分时间都用于清理凌乱的数据和生成报告(不一定是分析!)。 许多公司表示,当他们真正想要的是商业智能时,他们就需要数据科学。

I had considered software engineering bootcamps after seeing several friends pivot from non-tech backgrounds, and happened to stumble across Fullstack Academy’s Hacking 101 intro workshop while researching options. It was really eye-opening to see what was happening outside of election interference — a few years ago, hackers managed to take down parts of the Ukrainian power grid (and there’s evidence that some US systems may also be compromised as sleeper cells).

在看到几个朋友来自非技术领域后,我考虑了软件工程训练营,偶然发现了Fullstack Academy的Hacking 101入门研讨会,同时研究了各种选择。 看到选举干扰之外发生的事情真是让人大开眼界-几年前,黑客设法摧毁了乌克兰的部分电网(有证据表明,某些美国系统也可能因为卧铺细胞而受到损害)。

Cyber attacks invoke the image of a hidden specter, but these stories of damage occurring in the physical world made the threat much more real. Modern wars will be fought primarily with keyboards, not guns.

网络攻击引用了一个隐藏的幽灵的图像,但是这些在物理世界中发生的破坏的故事使威胁更加真实。 现代战争将主要通过键盘而非枪支进行。

This is what really piqued my interest in cybersecurity over engineering; although building cool things does sound fun, the prospect of there being a “just war” to be fought appealed to my desire for purpose. I’m the furthest thing from a jarhead, but being able to protect people while also learning a ton about computers sounded like an awesome gig.

这真正激发了我对网络安全而不是工程的兴趣; 尽管建造凉爽的东西听起来确实很有趣,但是有一场“正义之战”的前景吸引了我对目标的渴望。 我是一个无聊的人,但是能够保护人们的同时也学到了很多有关计算机的知识,听起来像是一场很棒的演出。

In retrospect, the seeds of cybersecurity had already been sown at the beginning of my career. My first job was extremely pivotal because it had exposed me to “surveillance capitalism” — our team specialized in campaigns utilizing user data peddled on the open market (yes, I was to blame for some of those creepy ads). It was easy to take for granted where that data actually came from, because we were dealing with cookie counts in the millions. Things like GDPR (General Data Protection Regulation) only came years after I started working, and as advertisers we merely griped about how it made our jobs harder.

回想起来,网络安全的种子在我职业生涯的开始就已经播下。 我的第一份工作非常关键,因为它使我陷入了“ 监视资本主义 ”的境地-我们的团队专门从事利用在公开市场上兜售的用户数据进行的活动(是的,我要为其中一些令人毛骨悚然的广告负责)。 人们很容易理会这些数据的实际来源,因为我们处理的Cookie数以百万计。 像GDPR(通用数据保护条例)之类的东西才出现在我开始工作数年之后,而作为广告商,我们只是苦苦挣扎,这使我们的工作更加困难。

I realized the weight of advertiser responsibility towards consumer privacy later on, when I was tasked with encrypting user data prior to sharing it with vendors. If you’ve ever received mail ads after submitting your email in a web form, it’s very likely that the advertising brand shared your data with an intermediary vendor that has compiled your data for physical targeting. What is merely one lead out of many for an advertiser is also a risk of life-changing identity theft for an innocent civilian if handled improperly.

后来,当我负责在与供应商共享用户数据之前先对用户数据进行加密时,我意识到了广告客户对消费者隐私的责任感。 如果您曾经在通过Web表单提交电子邮件后收到过邮件广告,那么该广告品牌很有可能会与中间供应商共享您的数据,该中间供应商已将您的数据进行了物理定位。 如果处理不当,对于广告客户而言,仅仅是众多潜在客户中的一个引诱者,还存在着改变无辜平民身份的生活。

Startup hype a la WeWork has glorified growth and valuations above all, but in truth, a fast car needs good brakes. Cybersecurity fills a critical gap in development and operations where prioritization of speed over security can really leave a door open to disaster.

WeWork的初创公司大肆宣传了增长和估值,但实际上, 快车需要良好的刹车 。 网络安全填补了开发和运营中的一个关键缺口,在这些缺口中,优先考虑速度而不是安全确实会给灾难敞开大门。

培训日 (Training Day(s))

I ended up taking the leap to attend Fullstack Academy because I knew how long it would take me to learn all that material while frequently working overtime. Reflecting on the sheer volume of learning that happened, I’m glad I made that choice despite the financial consequences.

我最终跳入了Fullstack Academy,因为我知道在频繁加班的同时学习所有这些材料要花多长时间。 考虑到所发生的大量学习,尽管有经济后果,我还是很高兴自己做出了这样的选择。

My friends who were bootcamp alums warned me that I’d have pretty much no life outside of school, and they were pretty much right. I almost didn’t mind the quarantine situation because I was studying and practicing cyber from the time I woke up to the time I went to sleep. The need to be dedicated to putting in the work cannot be overemphasized, because there’s so much to learn and absorb. I’ve earned a few industry-standard certifications (OSCP and CySA+), and still often feel like I don’t know enough to do the job.

我曾经是训练营校友的朋友们警告我,我在校外几乎没有生活,他们说的很对。 我几乎不介意隔离的情况,因为从醒来一直到睡觉之前,我一直在学习和练习网络。 致力于工作的需求不能过分强调,因为有很多东西要学习和吸收。 我已经获得了一些行业标准的认证(OSCP和CySA +),但仍然常常觉得我不了解该工作。

I didn’t mind the grind, however, because I had such a great time doing it! I honestly think learning about cybersecurity can be a cool hobby even if you don’t intend to practice it professionally.

但是我不介意这种磨练,因为我做得很开心! 老实说,即使您不打算专业地学习网络安全,学习网络安全也可能是一个很酷的爱好。

A few things I’d like to share for those considering a career in cybersecurity and/or a training program like Fullstack Academy:

我想分享给那些考虑从事网络安全和/或像Fullstack Academy这样的培训计划的人的一些事情:

Be comfortable with uncertainty.

适应不确定性。

The teachers and fellows are certainly available and helpful, but will intentionally avoid spoon-feeding you the answers to teach you problem-solving skills for the future. Don’t know how to do something? Try Googling it (first, at least).

老师和同学当然很乐于助人,但会故意避免用汤匙喂您答案,以教会您将来解决问题的能力。 不知道该怎么做? 尝试使用Google搜索 (至少是第一个)。

If you are someone who needs a lot of structure, I would advise that you think carefully about quitting your day job because you will need to spend a lot of time on self-study. The cyber community is quite generous with its time, but this is a trade that also requires self-reliance.

如果您是一个需要很多结构的人,我建议您仔细考虑辞职,因为您将需要花费大量时间进行自学。 网络社区对它的时间很慷慨,但这是一项需要自力更生的行业。

Get ready to read and write…a lot.

准备好阅读和写作...很多。

Cybersecurity training has become a lot more accessible with video and podcast tutorials, etc. However, there are also many resources that are reading-only; depending on the Python module you’re using, the source documentation may be the only reference available.

通过视频和播客教程等,网络安全培训变得更加容易获得。但是,也有许多资源是只读的。 根据您使用的Python模块,源文档可能是唯一可用的参考。

Although videos and podcasts are more accessible and “fun”, the written word is extremely valuable in transmitting complex logic. This applies also to future deliverables as a cybersecurity professional — the client may forget the details of your presentation, but they’ll at least have your write-up to fall back on.

尽管视频和播客更易于访问和“有趣”,但书面文字在传输复杂逻辑方面非常有价值。 这也适用于将来作为网络安全专业人员的可交付成果-客户可能会忘记演示文稿的详细信息,但他们至少会保留您的意见。

It’s ok to suck at first.

一开始没关系。

I went to high school with George Hotz, who was credited to be the first person to unlock the iPhone. There are people like him who just have a natural talent for hacking, and I’ve become ok with not being one of them.

我和乔治·霍茨(George Hotz)一起上了高中,他被公认为是第一个解锁iPhone的人。 像他这样的人只是具有天生的黑客天赋,而我也不能成为其中一员。

What I’ve learned through earning the OSCP certification is that a lot of this comes down to grit. You can learn to do many things in cybersecurity, given enough time and effort (“Try Harder”, per Offensive Security). Give yourself some slack and patience and have faith in the process.

通过获得OSCP认证,我学到的很多东西都归结为毅力。 只要有足够的时间和精力,您就可以学会在网络安全中做很多事情(“进攻性尝试”,即“进攻性安全性”)。 给自己一些懈怠和耐心,并对过程充满信心。

It reminds me of when I was working as a cook at a Japanese restaurant, my head chef didn’t mind that I had zero professional experience. What he demanded instead was that I maintain the kaizen attitude of improving myself at least a little bit each day, learning from my mistakes and purposefully training my skills.

这让我想起了当我在一家日本餐厅做厨师时,我的主厨并不介意我的专业经验为零。 相反,他要求我保持Kaizen态度,即每天至少一点点提高自己,从错误中吸取教训并有目的地训练自己的技能。

哦,你去的地方! (Oh, the places you’ll go!)

Towards the end of my program, one of my bootcamp fellows (https://github.com/binexisHATT) reminded us: “This is not the beginning of the end; it’s the end of the beginning.”

对我节目的最后,我的集训研究员(之一https://github.com/binexisHATT )提醒我们:“ 这不是结束的开始; 这是开始的结尾。”

That could not be any truer. At this moment, I am funemployed and still don’t know what my dream job or the next 5 years looks like. The one thing that I know for sure is that I want to keep exploring this field for it in itself, not simply for the sake of making a lot of money. As someone whose first experience with cybersecurity was a formal training program, I’ve been having a lot of fun catching up on industry history and community lore — the L0pht crew sounded like a dope place to be, and I look forward to finding a tribe of my own.

那再真实不过了。 此时此刻,我已经找到工作了,但仍然不知道我理想的工作或未来五年的状况。 我肯定知道的一件事是,我想继续自己探索这个领域,而不仅仅是为了赚很多钱。 作为最初在网络安全方面经历过正式培训计划的人,我在追赶行业历史和社区传闻中获得了很多乐趣— L0pht船员听起来像是一个无处可逃的地方,我期待找到一个部落我自己的。

演示地址

Perhaps by following my interests and enjoying each step of the way, I’ll have found my calling at the end of the road. After all, it seems like I’ve arrived at this point not by careful planning, but via culmination of all the detours and scenic routes life has taken me on.

也许通过遵循我的兴趣并享受每一步,我会在路的尽头找到自己的呼唤。 毕竟,似乎到达我这一点并不是经过周密的计划,而是经过所有绕行和风景优美的路线的高潮,生活带给我了。

“You look at where you’re going and where you are and it never makes much sense, but then you look back at where you’ve been and a pattern seems to emerge. And if you project forward from that pattern, then sometimes you can come up with something.

“您看着自己要去的地方和现在所处的位置,这从来没有多大意义,但是随后您回头看看曾经去过的地方,似乎出现了一种模式。 而且,如果您从该模式向前发展,那么有时您可以提出一些建议。

Mountains should be climbed with as little effort as possible and without desire. The reality of your own nature should determine the speed. If you become restless, speed up. If you become winded, slow down. You climb the mountain in an equilibrium between restlessness and exhaustion. Then, when you’re no longer thinking ahead, each footstep isn’t just a means to an end but a unique event in itself. This leaf has jagged edges. This rock looks loose. From this place the snow is less visible, even though closer. These are things you should notice anyway. To live only for some future goal is shallow. It’s the sides of the mountain which sustain life, not the top. Here’s where things grow.

应该尽可能少地,没有欲望地爬山。 你自己的本性决定了速度。 如果您变得不安,请加快速度。 如果您感到发狂,请放慢速度。 您在躁动与疲惫之间保持平衡。 然后,当您不再思考时,每一个脚步不仅是达到目的的手段,而且本身就是一个独特的事件。 这片叶子有锯齿状的边缘。 这块石头看起来松动。 从这个地方,即使靠近,雪也很少见。 这些都是您应该注意的事情。 只为将来的目标而生活是很浅薄的。 维持生命的是山的两面,而不是山顶。 这是事情发展的地方。

But of course, without the top you can’t have any sides. It’s the top that defines the sides. So on we go — we have a long way — no hurry — just one step after the next — with a little Chautauqua for entertainment . ― Robert M. Pirsig, Zen and the Art of Motorcycle Maintenance: An Inquiry Into Values

但是,当然,如果没有顶部,您将无法拥有任何一面。 它是定义侧面的顶部。 因此,我们继续前进-我们还有很长的路要走-不着急-下一步仅一步之遥-仅有一点Chautauqua可以娱乐。 ―罗伯特·皮尔西格(Robert M.Pirsig),《 禅宗》和《摩托车维修的艺术:对价值的询问》

翻译自: https://medium.com/atelier-de-sécurité/from-retargeting-to-rce-my-journey-from-advertising-to-cybersecurity-4c6149a25c58

redis rce漏洞安全


http://www.taodudu.cc/news/show-4179809.html

相关文章:

  • 单词整理
  • 一起学英语第二季第五期
  • 【多目标跟踪论文阅读笔记——2021年CVPR论文粗读记录】
  • R-CNN论文精读(论文翻译)
  • A 'Brief' History of Neural Nets and Deep Learning, Part 4
  • [Flink 日记]Exceeded checkpoint tolerable failure threshold.
  • [NACOS HTTP-POST] The maximum number of tolerable server reconnection errors has been reached
  • The maximum number of tolerable server reconnection errors has been reached
  • flink sql 报错:FlinkRuntimeException: Exceeded checkpoint tolerable failure threshold
  • Flink报错:exceeded checkpoint tolerable failure threshould
  • flink设置checkpoint部署后一直重启,出现检查点无法写入的问题
  • flink程序:Exceeded checkpoint tolerable failure threshould
  • 启动报错java.net.ConnectException: [NACOS HTTP-POST] The maximum number of tolerable
  • SpringCloud-11-解决[NACOS HTTP-GET] The maximum number of tolerable server reconnection errors has bee
  • nacos配置中心[NACOS HTTP-GET] The maximum number of tolerable server reconnection errors has been reache
  • org.apache.flink.util.FlinkRuntimeException: Exceeded checkpoint tolerable failure threshold
  • Exceeded checkpoint tolerable failure threshould【记一次flink上线异常】
  • Flink报错:org.apache.flink.util.FlinkRuntimeException: Exceeded checkpoint tolerable failure threshold
  • 记录:Flink checkpoint 过期导致失败(线上问题)
  • Spring Cloud 2.2.2 源码之二十九nacos客户端获取配置原理四
  • Docker-compose编排MySQL+Nacos+Seata
  • 最佳实践:MySQL CDC 同步数据到 ES
  • Flink 生产环境配置建议
  • Flink Checkpoint超时问题
  • Having dreams is what makes life tolerable.
  • java.net.ConnectException: [NACOS HTTP-POST] The maximum number of tolerable server reconnection err
  • Flink任务失败,检查点失效:Exceeded checkpoint tolerable failure threshold.
  • flink 出现反压场景, 异常场景造成Exceeded checkpoint tolerable failure threshold.
  • 新番 | 万万没想到,Hulu有一天也开始推新番了
  • 操作系统简介及编程语言

redis rce漏洞安全_从重新定位到RCE:我从广告到网络安全的旅程相关推荐

  1. rmi反序列化导致rce漏洞修复_企业安全05-Fastjson =1.2.47反序列化RCE漏洞(CNVD-2019-22238)...

    Fastjson <=1.2.47反序列化RCE漏洞(CNVD-2019-22238) 一.漏洞描述 Fastjson 是阿里巴巴的开源JSON解析库,它可以解析 JSON 格式的字符串,支持将 ...

  2. html应用json 文件_安全研究 | Slack桌面应用程序的RCE漏洞+XSS漏洞

    对于Slack的桌面应用程序来说,一些应用内跳转.XSS.逻辑重定向和HTML或javascript注入bug,都有可能导致任意代码执行.这篇Writeup就讲述了作者通过构造HTML注入,绕过Sla ...

  3. 29款DrayTek 路由器受严重RCE漏洞影响

     聚焦源代码安全,网罗国内外最新资讯! 编译:代码卫士 Trellix 公司的安全研究员发现一个严重的远程代码执行 (RCE)漏洞 (CVE-2022-32548),影响29款 DrayTek Vig ...

  4. 山东大学软件学院项目实训-创新实训-山大软院网络攻防靶场实验平台(八)-RCE漏洞

    目录 前言: 1.RCE 漏洞简介 1.1.简介 1.2.危害 1.3.利用 1.3.1.漏洞挖掘 1.3.2.windows下管道符 1.3.3.linux下管道符 1.4.防范 2.相关配置 3. ...

  5. wordpress漏洞_聊聊 WordPress 5.1.1 CSRF to RCE 漏洞

    作者:LoRexxar'@知道创宇404实验室 时间:2019年3月14日 2019年3月13日, RIPS团队公开了一篇关于WordPress 5.1.1的XSS漏洞详情,标题起的很响亮,叫做wor ...

  6. 小米商城html代码_小米6 WiFi验证门户中的RCE漏洞

    介绍 在2018年的Pwn2own上,F-Secure实验室演示了小米6在连接攻击者所控制的恶意WiFi热点后被攻陷.以下是具体步骤: 用户加入由攻击者控制的WiFi,手机会通过发送测试性的HTTP ...

  7. Redis系列漏洞总结

    Redis系列漏洞总结 文章目录 Redis系列漏洞总结 环境:ubuntu16.04,redis5.0.1 redis下载及安装 redis 漏洞利用方式 0x01 绝对路径写shell 0x02 ...

  8. cve-2019-10758 mongo-express rce 漏洞分析

    下面是对漏洞的描述: mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that use ...

  9. 深入分析H2数据库控制台中无需身份验证的RCE漏洞

    简介 最近,JFrog安全研究团队披露了H2数据库控制台中的一个安全漏洞,其编号为CVE-2021-42392.这个安全漏洞与Apache Log4j中臭名昭著的Log4Shell漏洞(JNDI远程类 ...

最新文章

  1. 将新主要功能部署到生产时要考虑的5件事情
  2. Linux系统调优概述
  3. C语言switch中break的作用,C语言中switch...case语句中break的重要性
  4. app中使用用户名/邮箱/手机号登录的思路分析
  5. Android selector中的item的顺序
  6. 学习编程的过程中可能会走哪些弯路,有哪些经验可以参考?
  7. JavaEE实战班第十七天
  8. 怎么用python算单价和总价_用python计算最高投标限价
  9. 大V诞生记 —— 谁是VMware?
  10. ReactiveCocoa中信号的使用
  11. 软件体系架构课下作业01
  12. js layui 弹出子窗体_layui 弹出界面弹框
  13. MSSQL的表备份成INSERT脚本的存储过程
  14. 软件项目测试报价单,某软件项目报价单
  15. python客户端软件开发_用 Python 实现一个简易版 HTTP 客户端
  16. Chrome一直在更新的几个广告拦截插件
  17. 冒泡排序 ← C语言实现
  18. ECshop4.1版本搭建
  19. Python实现支持向量机SVM分类模型线性SVM决策过程的可视化项目实战
  20. NT99141摄像头调试

热门文章

  1. Win10环境下caffe安装与编译
  2. “百钱买百鸡”的问题,题的意思是这样的,5文钱可以买一只公鸡,3文钱可以买一只母鸡,1文钱可以买3只雏鸡,现在用100文钱买100只鸡,鸡各有几只?
  3. 程序员离职后跳槽到国企,每天主动加班到10点,结果试用期没过?
  4. ubuntu18.04 LTS 安装英伟达驱动
  5. 记录webView显示空白的又一坑
  6. Apollo Planning决策规划算法代码详细解析 (13): RuleBasedStopDecider
  7. 前端页面开发浅谈:PC 端设计如何“完美”迁移到移动端?
  8. 香格里拉是如何策划成功的?
  9. 三大突破让人工智能终成现实
  10. 学人工智能看什么书?AI入门书籍推荐