CTF-All-In-One/SUMMARY.md
2018-04-08 09:43:42 +08:00

182 lines
10 KiB
Markdown
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

# Summary
GitHub 地址https://github.com/firmianay/CTF-All-In-One
* [简介](README.md)
* [前言](doc/0_preface.md)
* [一、基础知识篇](doc/1_basic.md)
* [1.1 CTF 简介](doc/1.1_ctf.md)
* [1.2 学习方法](doc/1.2_how_to_learn.md)
* [1.3 Linux 基础](doc/1.3_linux_basic.md)
* [1.4 Web 安全基础](doc/1.4_web_basic.md)
* [1.4.1 HTML 基础](doc/1.4.1_html_basic.md)
* [1.4.2 HTTP 协议基础](doc/1.4.2_http_basic.md)
* [1.4.3 JavaScript 基础](doc/1.4.3_javascript_basic.md)
* [1.4.4 常见 Web 服务器基础](doc/1.4.4_webserver_basic.md)
* [1.4.5 OWASP Top Ten Project 漏洞基础](doc/1.4.5_owasp_basic.md)
* [1.4.6 PHP 源码审计基础](doc/1.4.6_php_basic.md)
* [1.5 逆向工程基础](doc/1.5_reverse_basic.md)
* [1.5.1 C 语言基础](doc/1.5.1_c_basic.md)
* [1.5.2 x86/x86-64 汇编基础](doc/1.5.2_x86&x64.md)
* [1.5.3 Linux ELF](doc/1.5.3_elf.md)
* [1.5.4 Windows PE](doc/1.5.4_pe.md)
* [1.5.5 静态链接](doc/1.5.5_static_link.md)
* [1.5.6 动态链接](doc/1.5.6_dynamic_link.md)
* [1.5.7 内存管理](doc/1.5.7_memory.md)
* [1.5.8 glibc malloc](doc/1.5.8_glibc_malloc.md)
* [1.5.9 Linux 内核](doc/1.5.9_linux_kernel.md)
* [1.5.10 Windows 内核](doc/1.5.10_windows_kernel.md)
* [1.6 密码学基础](doc/1.6_crypto_basic.md)
* [1.6.1 初等数论](doc/1.6.1_number_theory.md)
* [1.6.2 近世代数](doc/1.6.2_modern_algebra.md)
* [1.6.3 流密码](doc/1.6.3_stream_cipher.md)
* [1.6.4 分组密码](doc/1.6.4_block_cipher.md)
* [1.6.5 公钥密码](doc/1.6.5_public-key_crypto.md)
* [1.6.6 哈希函数](doc/1.6.6_hash.md)
* [1.6.7 数字签名](doc/1.6.7_digital_signature.md)
* [1.7 Android 安全基础](doc/1.7_android_basic.md)
* [1.7.1 Android 环境搭建](doc/1.7.1_android_env.md)
* [1.7.2 Dalvik 指令集](doc/1.7.2_dalvik.md)
* [1.7.3 ARM 汇编基础](doc/1.7.3_arm.md)
* [1.7.4 Android 常用工具](doc/1.7.4_android_tools.md)
* [二、工具篇](doc/2_tools.md)
* [2.1 VM](doc/2.1_vm.md)
* [2.1.1 QEMU](doc/2.1.1_qemu.md)
* [2.2 gdb/peda](doc/2.2_gdb.md)
* [2.3 ollydbg](doc/2.3_ollydbg.md)
* [2.4 windbg](doc/2.4_windbg.md)
* [2.5 radare2](doc/2.5_radare2.md)
* [2.6 IDA Pro](doc/2.6_idapro.md)
* [2.7 pwntools](doc/2.7_pwntools.md)
* [2.8 zio](doc/2.8_zio.md)
* [2.9 JEB](doc/2.9_jeb.md)
* [2.10 metasploit](doc/2.10_metasploit.md)
* [2.11 binwalk](doc/2.11_binwalk.md)
* [2.12 Burp Suite](doc/2.12_burpsuite.md)
* [2.13 LLDB](doc/2.13_lldb.md)
* [三、分类专题篇](doc/3_topics.md)
* [3.1 Reverse](doc/3.1_reverse.md)
* [3.2 Crypto](doc/3.2_crypto.md)
* [3.2.1 古典密码](doc/3.2.1_classic_crypto.md)
* [3.3 Pwn](doc/3.3_pwn.md)
* [3.3.1 格式化字符串漏洞](doc/3.3.1_format_string.md)
* [3.3.2 整数溢出](doc/3.3.2_integer_overflow.md)
* [3.3.3 栈溢出](doc/3.3.3_stack_overflow.md)
* [3.3.4 返回导向编程ROPx86](doc/3.3.4_rop_x86.md)
* [3.3.5 返回导向编程ROPARM](doc/3.3.5_rop_arm.md)
* [3.3.6 Linux 堆利用(上)](doc/3.3.6_heap_exploit_1.md)
* [3.3.7 Linux 堆利用(中)](doc/3.3.7_heap_exploit_2.md)
* [3.3.8 Linux 堆利用(下)](doc/3.3.8_heap_exploit_3.md)
* [3.3.9 内核 ROP](doc/3.3.9_kernel_rop.md)
* [3.3.10 Linux 内核漏洞利用](doc/3.3.10_linux_kernel_exploit.md)
* [3.3.11 Windows 内核漏洞利用](doc/3.3.11_windows_kernel_exploit.md)
* [3.3.12 竞争条件](doc/3.3.12_race_condition.md)
* [3.4 Web](doc/3.4_web.md)
* [3.4.1 SQL 注入利用](doc/3.4.1_sql_injection.md)
* [3.4.2 XSS 漏洞利用](doc/3.4.2_xss.md)
* [3.5 Misc](doc/3.5_misc.md)
* [3.6 Mobile](doc/3.6_mobile.md)
* [四、技巧篇](doc/4_tips.md)
* 4.1
* [4.2 Linux 命令行技巧](doc/4.2_Linux_terminal_tips.md)
* [4.3 GCC 编译参数解析](doc/4.3_gcc_arg.md)
* [4.4 GCC 堆栈保护技术](doc/4.4_gcc_sec.md)
* [4.5 ROP 防御技术](doc/4.5_defense_rop.md)
* [4.6 one-gadget RCE](doc/4.6_one-gadget_rce.md)
* [4.7 通用 gadget](doc/4.7_common_gadget.md)
* [4.8 使用 DynELF 泄露函数地址](doc/4.8_dynelf.md)
* [4.9 patch 二进制文件](doc/4.9_patch_binary.md)
* [4.10 反调试技术](doc/4.10_antidbg.md)
* [4.11 指令混淆](doc/4.11_instruction_confusion.md)
* [五、高级篇](doc/5_advanced.md)
* [5.0 软件漏洞分析](doc/5.0_vulnerability.md)
* [5.1 模糊测试](doc/5.1_fuzzing.md)
* [5.1.1 AFL fuzzer](doc/5.1.1_afl_fuzzer.md)
* [5.1.2 libFuzzer](doc/5.1.2_libfuzzer.md)
* [5.2 动态二进制插桩](doc/5.2_dyn_binary_instrumentation.md)
* [5.2.1 Pin](doc/5.2.1_pin.md)
* [5.2.2 DynamoRio](doc/5.2.2_dynamorio.md)
* [5.2.3 Valgrind](doc/5.2.3_valgrind.md)
* [5.3 符号执行](doc/5.3_symbolic_execution.md)
* [5.3.1 angr](doc/5.3.1_angr.md)
* [5.3.2 Triton](doc/5.3.2_triton.md)
* [5.3.3 KLEE](doc/5.3.3_klee.md)
* [5.3.4 S²E](doc/5.3.4_s2e.md)
* [5.4 数据流分析](doc/5.4_dataflow_analysis.md)
* [5.4.1 Soot](doc/5.4.1_soot.md)
* [5.5 污点分析](doc/5.5_taint_analysis.md)
* [5.5.1 动态污点分析](doc/5.5.1_dyn_taint_analysis.md)
* [5.6 LLVM](doc/5.6_llvm.md)
* [5.6.1 Clang](doc/5.6.1_clang.md)
* [5.7 Capstone/Keystone](doc/5.7_cap-keystone.md)
* [5.8 SAT/SMT](doc/5.8_sat-smt.md)
* [5.8.1 Z3](doc/5.8.1_z3.md)
* [5.9 基于模式的漏洞分析](doc/5.9_pattern_based_detection.md)
* [5.10 基于二进制比对的漏洞分析](doc/5.10_diff_based_detection.md)
* [5.11 反编译技术](doc/5.11_decompiling.md)
* [5.11.1 RetDec](doc/5.11.1_retdec.md)
* [5.12 Unicorn 模拟器](doc/5.12_unicorn.md)
* [六、题解篇](doc/6_writeup.md)
* pwn
* [6.1.1 pwn HCTF2016 brop](doc/6.1.1_pwn_hctf2016_brop.md)
* [6.1.2 pwn NJCTF2017 pingme](doc/6.1.2_pwn_njctf2017_pingme.md)
* [6.1.3 pwn XDCTF2015 pwn200](doc/6.1.3_pwn_xdctf2015_pwn200.md)
* [6.1.4 pwn BackdoorCTF2017 Fun-Signals](doc/6.1.4_pwn_backdoorctf2017_fun_signals.md)
* [6.1.5 pwn GreHackCTF2017 beerfighter](doc/6.1.5_pwn_grehackctf2017_beerfighter.md)
* [6.1.6 pwn DefconCTF2015 fuckup](doc/6.1.6_pwn_defconctf2015_fuckup.md)
* [6.1.7 pwn 0CTF2015 freenote](doc/6.1.7_pwn_0ctf2015_freenote.md)
* [6.1.8 pwn DCTF2017 Flex](doc/6.1.8_pwn_dctf2017_flex.md)
* [6.1.9 pwn RHme3 Exploitation](doc/6.1.9_pwn_rhme3_exploitation.md)
* [6.1.10 pwn 0CTF2017 BabyHeap2017](doc/6.1.10_pwn_0ctf2017_babyheap2017.md)
* [6.1.11 pwn 9447CTF2015 Search-Engine](doc/6.1.11_pwn_9447ctf2015_search_engine.md)
* [6.1.12 pwn N1CTF2018 vote](doc/6.1.12_pwn_n1ctf2018_vote.md)
* [6.1.13 pwn 34C3CTF2017 readme_revenge](doc/6.1.13_pwn_34c3ctf2017_readme_revenge.md)
* re
* [6.2.1 re XHPCTF2017 dont_panic](doc/6.2.1_re_xhpctf2017_dont_panic.md)
* [6.2.2 re ECTF2016 tayy](doc/6.2.2_re_ectf2016_tayy.md)
* [6.2.3 re Codegate2017 angrybird](doc/6.2.3_re_codegate2017_angrybird.md)
* [6.2.4 re CSAWCTF2015 wyvern](doc/6.2.4_re_csawctf2015_wyvern.md)
* [6.2.5 re PicoCTF2014 Baleful](doc/6.2.5_re_picoctf2014_baleful.md)
* [6.2.6 re SECCON2017 printf_machine](doc/6.2.6_re_seccon2017_printf_machine.md)
* web
* [6.3.1 web HCTF2017 babycrack](doc/6.3.1_web_hctf2017_babycrack.md)
* [七、实战篇](doc/7_exploit.md)
* CVE
* [7.1.1 [CVE-2017-11543] tcpdump 4.9.0 Buffer Overflow](doc/7.1.1_tcpdump_2017-11543.md)
* [7.1.2 [CVE-2015-0235] glibc 2.17 Buffer Overflow](doc/7.1.2_glibc_2015-0235.md)
* [7.1.3 [CVE-2016-4971] wget 1.17.1 Arbitrary File Upload](doc/7.1.3_wget_2016-4971.md)
* [7.1.4 [CVE-2017-13089] wget 1.19.1 Buffer Overflow](doc/7.1.4_wget_2017-13089.md)
* [7.1.5 [CVE2018-1000001] glibc Buffer Underflow](doc/7.1.5_glibc_2018-1000001.md)
* [7.1.6 [CVE-2017-9430] DNSTracer 1.9 Buffer Overflow](doc/7.1.6_dnstracer_2017-9430.md)
* [7.1.7 [CVE-2018-6323] GNU binutils 2.26.1 Integer Overflow](doc/7.1.7_binutils_2018-6323.md)
* Malware
* 7.2.x
* [八、学术篇](doc/8_academic.md)
* Return-Oriented Programming
* [8.1.1 The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86)](doc/8.1.1_return-into-libc_without_function_calls.md)
* [8.1.2 Return-Oriented Programming without Returns](doc/8.1.2_rop_without_returns.md)
* [8.1.3 Return-Oriented Rootkits: Bypassing Kernel Code Integrity Protection Mechanisms](doc/8.1.3_return-oriented_rootkits.md)
* [8.1.4 ROPdefender: A Detection Tool to Defend Against Return-Oriented Programming Attacks](doc/8.1.4_ropdefender.md)
* [8.1.5 Data-Oriented Programming: On the Expressiveness of Non-Control Data Attacks](doc/8.1.5_data-oriented_programming.md)
* [8.1.6 Hacking Blind](doc/8.1.6_hacking_blind.md)
* Symbolic Execution
* [8.2.1 All You Ever Wanted to Know About Dynamic Taint Analysis and Forward Symbolic Execution (but might have been afraid to ask)](doc/8.2.1_dynamic_taint_analysis.md)
* [8.2.2 Symbolic Execution for Software Testing: Three Decades Later](doc/8.2.2_symbolic_execution_for_software_testing.md)
* Code Obfuscation
* Reverse Engineering
* [8.3 New Frontiers of Reverse Engineering](doc/8.3_new_frontiers_of_reverse_engineering.md)
* Android Security
* [8.4 EMULATOR vs REAL PHONE: Android Malware Detection Using Machine Learning](doc/8.4_emulator_vs_real_phone.md)
* [8.5 DynaLog: An automated dynamic analysis framework for characterizing Android applications](doc/8.5_dynalog_an_automated_dynamic_analysis_framework.md)
* [8.6 A Static Android Malware Detection Based on Actual Used Permissions Combination and API Calls](doc/8.6_malware_detection_based_on_actual_used_permissions.md)
* [8.7 MaMaDroid: Detecting Android malware by building Markov chains of behavioral models](doc/8.7_detecting_malware_by_building_markov_chains.md)
* [8.8 DroidNative: Semantic-Based Detection of Android Native Code Malware](doc/8.8_droidnative_semantic-based_detection_of_android_native_code_malware.md)
* [8.9 DroidAnalytics: A Signature Based Analytic System to Collect, Extract, Analyze and Associate Android Malware](doc/8.9_droidanalytics_signature_based_analytic_system.md)
* [九、附录](doc/9_appendix.md)
* [9.1 更多 Linux 工具](doc/9.1_Linuxtools.md)
* [9.2 更多 Windows 工具](doc/9.2_wintools.md)
* [9.3 更多资源](doc/9.3_books_blogs.md)
* [9.4 Linux x86-64 系统调用表](doc/9.4_linux_syscall.md)
* [9.5 幻灯片](doc/9.5_slides.md)