<?xml version="1.0" encoding="utf-8" ?><rss version="2.0"><channel><title><![CDATA[c0c0cf的专栏]]></title><description><![CDATA[j2ee security]]></description><link>https://blog.youkuaiyun.com/c0c0cf</link><language>zh-cn</language><generator>https://blog.youkuaiyun.com/</generator><copyright><![CDATA[Copyright &copy; c0c0cf]]></copyright><item><title><![CDATA[Java安全结构 沙盒模型]]></title><link>https://blog.youkuaiyun.com/c0c0cf/article/details/53405804</link><guid>https://blog.youkuaiyun.com/c0c0cf/article/details/53405804</guid><author>c0c0cf</author><pubDate>Wed, 30 Nov 2016 11:22:28 +0800</pubDate><description><![CDATA[JAVA的安全模型不同于传统的安全方法，传统的安全方法中，大多数操作系统允许应用程序充分访问系统资源，在操作系统不提供安全保护的机器里，运行环境不能被信任。为了弥补这个缺陷，安全策略经常要求在应用程序执行之前对应用程序建立信任，例如要求程序员在执行从网上获得的应用程序前，先检查病毒和源代码中不安全的代码。这种方法有2个问题：
(1)确定程序是否安全的检查很复杂很浪费时间，很少有程序员愿意花时间读]]></description><category></category></item><item><title><![CDATA[Hadoop存在巨大数据安全风险的十个理由]]></title><link>https://blog.youkuaiyun.com/c0c0cf/article/details/53043480</link><guid>https://blog.youkuaiyun.com/c0c0cf/article/details/53043480</guid><author>c0c0cf</author><pubDate>Sat, 05 Nov 2016 09:10:27 +0800</pubDate><description><![CDATA[http://sec.chinabyte.com/249/12600749.shtml 
　1、Hadoop不是专为企业数据而生　　像许多开拓性的IT技术(如TCP / IP或Unix)一样，,Hadoop的概念并非来自企业用户，企业安全更是无从谈起。使用Hadoop的最初目的是管理公开可用的信息，,如Web链接。其是针对大量的非结构化数据在分布式计算环境中设计的，并没有形成书面的安全、合规、加密、]]></description><category></category></item><item><title><![CDATA[Apache Wicket 6.23.0 – Deserialization gadget]]></title><link>https://blog.youkuaiyun.com/c0c0cf/article/details/52685172</link><guid>https://blog.youkuaiyun.com/c0c0cf/article/details/52685172</guid><author>c0c0cf</author><pubDate>Tue, 27 Sep 2016 22:04:59 +0800</pubDate><description><![CDATA[Apacge Wicket简介：


Wicket是一个Java 语言的Web开发框架，与Struts，WebWork，Tapestry   相类似。其特点在于对Html和代码进行了有效的分离（有利于程序员和美工的合作），基于规则的配置(减少了XML   等配置文件的使用)，学习曲线较低（开发方式与C/S相似），更加易于调试（错误类型比较少，而且容易定位）。




摘要：

]]></description><category></category></item><item><title><![CDATA[甲方安全工作二三事]]></title><link>https://blog.youkuaiyun.com/c0c0cf/article/details/52665453</link><guid>https://blog.youkuaiyun.com/c0c0cf/article/details/52665453</guid><author>c0c0cf</author><pubDate>Sun, 25 Sep 2016 23:44:39 +0800</pubDate><description><![CDATA[观点：保证基础设施安全的情况下，甲方安全是需要围绕着业务开展的，一切需要为业务服务，脱离业务去做安全是脱离企业竞争原则的，安全越贴近业务越好。

熟悉组织架构

1、熟悉组织架构，因为在甲方大多数工作是需要业务方配合的。了解一个业务线适合的安全接口人，最好对安全感兴趣并且对该业务线产品非常熟悉的人。快速了解公司的一些安全产品，每个产品提供怎么样场景的安全服务，向业务推广。

2、熟悉安]]></description><category></category></item><item><title><![CDATA[Apache Mina 2.0.13 - Remote Command Execution]]></title><link>https://blog.youkuaiyun.com/c0c0cf/article/details/52632044</link><guid>https://blog.youkuaiyun.com/c0c0cf/article/details/52632044</guid><author>c0c0cf</author><pubDate>Fri, 23 Sep 2016 01:03:46 +0800</pubDate><description><![CDATA[新浪微博:

http://weibo.com/u/2275304001/home?wvr=5
微信公众号

DebugPwn






Apache Mina 2.0.13 - Remote Command Execution

2016-09-22 0c0c0f译 0c0c0f


Apache Mina介绍：

Apache Mina是一个能够帮助用户]]></description><category></category></item><item><title><![CDATA[CVE-2016-4977 RCE in Spring Security OAuth漏洞分析]]></title><link>https://blog.youkuaiyun.com/c0c0cf/article/details/52613002</link><guid>https://blog.youkuaiyun.com/c0c0cf/article/details/52613002</guid><author>c0c0cf</author><pubDate>Wed, 21 Sep 2016 20:43:40 +0800</pubDate><description><![CDATA[新浪微博:

http://weibo.com/u/2275304001/home?wvr=5
微信公众号

DebugPwn




漏洞描述：

When processing authorization requests using the whitelabel views, the response_type parameter value was executed]]></description><category></category></item><item><title><![CDATA[Spring Boot框架Whitelabel Error Page SpEL注入漏洞分析]]></title><link>https://blog.youkuaiyun.com/c0c0cf/article/details/52551210</link><guid>https://blog.youkuaiyun.com/c0c0cf/article/details/52551210</guid><author>c0c0cf</author><pubDate>Thu, 15 Sep 2016 22:01:31 +0800</pubDate><description><![CDATA[微信公众号:DebugPwn







新浪微博:http://weibo.com/u/2275304001?refer_flag=1005055010_




SpEL Introduction

The Spring Expression Language (SpEL for short) is a powerful expression language ]]></description><category></category></item><item><title><![CDATA[JAVA反序列化安全]]></title><link>https://blog.youkuaiyun.com/c0c0cf/article/details/52551183</link><guid>https://blog.youkuaiyun.com/c0c0cf/article/details/52551183</guid><author>c0c0cf</author><pubDate>Thu, 15 Sep 2016 21:56:03 +0800</pubDate><description><![CDATA[微信公众号:DebugPwn




新浪微博:

http://weibo.com/u/2275304001/home?wvr=5




漏洞简介:

反序列化漏洞有十年的历史，存在于不同的编程语言中，最为明显的当属Java、PHP、Python、Ruby。漏洞的本质就是反序列化机制打破了数据和对象的边界，导致攻击者注入的恶意序列化数据在反序列化过程中被还原成对象，]]></description><category></category></item><item><title><![CDATA[socket i/o模型]]></title><link>https://blog.youkuaiyun.com/c0c0cf/article/details/25073461</link><guid>https://blog.youkuaiyun.com/c0c0cf/article/details/25073461</guid><author>c0c0cf</author><pubDate>Mon, 05 May 2014 19:18:42 +0800</pubDate><description><![CDATA[完成端口模型:]]></description><category></category></item><item><title><![CDATA[findall函数的语法]]></title><link>https://blog.youkuaiyun.com/c0c0cf/article/details/24930605</link><guid>https://blog.youkuaiyun.com/c0c0cf/article/details/24930605</guid><author>c0c0cf</author><pubDate>Sat, 03 May 2014 18:24:00 +0800</pubDate><description><![CDATA[用于非重复的搜索某字符串中一个正则表达式]]></description><category></category></item><item><title><![CDATA[juery插件文件上传]]></title><link>https://blog.youkuaiyun.com/c0c0cf/article/details/21164687</link><guid>https://blog.youkuaiyun.com/c0c0cf/article/details/21164687</guid><author>c0c0cf</author><pubDate>Thu, 13 Mar 2014 12:54:55 +0800</pubDate><description><![CDATA['onSelect': function (e, queueId, fileObj) {
                   alert("唯一标识:" + queueId + "\r\n" + "文件名：" + fileObj.name + "\r\n" + "文件大小：" + fileObj.size + "\r\n" + "创建时间：" + fileObj.creationDate + ]]></description><category></category></item><item><title><![CDATA[NVelocity]]></title><link>https://blog.youkuaiyun.com/c0c0cf/article/details/19765421</link><guid>https://blog.youkuaiyun.com/c0c0cf/article/details/19765421</guid><author>c0c0cf</author><pubDate>Sun, 23 Feb 2014 19:16:25 +0800</pubDate><description><![CDATA[NVelocity  .NET的模板引擎（templateengine）。]]></description><category></category></item><item><title><![CDATA[用c#做接受邮件的程序-jmailfree_msi]]></title><link>https://blog.youkuaiyun.com/c0c0cf/article/details/19004513</link><guid>https://blog.youkuaiyun.com/c0c0cf/article/details/19004513</guid><author>c0c0cf</author><pubDate>Sun, 09 Feb 2014 11:16:05 +0800</pubDate><description><![CDATA[0x00:
要使 C# 代码引用 COM 对象和接口，需要在 C# 内部版本中包含 COM 接口的 .NET 框架定义。完成此操作的最简单方法是使用 TlbImp.exe（类型库导入程序），它是一个包括在 .NET 框架 SDK 中的命令行工具。TlbImp 将 COM 类型库转换为 .NET 框架元数据，从而有效地创建一个可以从任何托管语言调用的托管包装。用 TlbImp 创建的 .NET 框]]></description><category></category></item><item><title><![CDATA[andriod环境搭建]]></title><link>https://blog.youkuaiyun.com/c0c0cf/article/details/18953845</link><guid>https://blog.youkuaiyun.com/c0c0cf/article/details/18953845</guid><author>c0c0cf</author><pubDate>Thu, 06 Feb 2014 22:23:39 +0800</pubDate><description><![CDATA[1.adt插件
2.sdk
3.Please ensure that adb is correctly located at 'D:\Andriod\adt-bundle-window “can be executed.
报告这样的错误进入到

D:\Andriod\adt-bundle-windows-x86_64-20131030\adt-bundle-windows-x86_64-]]></description><category></category></item><item><title><![CDATA[流程起点模型]]></title><link>https://blog.youkuaiyun.com/c0c0cf/article/details/18550959</link><guid>https://blog.youkuaiyun.com/c0c0cf/article/details/18550959</guid><author>c0c0cf</author><pubDate>Mon, 20 Jan 2014 11:55:19 +0800</pubDate><description><![CDATA[1.单起点模型
2.多起点模型
3.]]></description><category></category></item><item><title><![CDATA[jbpm工作流环境搭建]]></title><link>https://blog.youkuaiyun.com/c0c0cf/article/details/18505935</link><guid>https://blog.youkuaiyun.com/c0c0cf/article/details/18505935</guid><author>c0c0cf</author><pubDate>Sun, 19 Jan 2014 17:13:33 +0800</pubDate><description><![CDATA[1.安装nat
下载地址：http://ant.apache.org/bindownload.cgi
2.
配置ANT_HOME， 
新建用户用户变量(这里当然也可以新建系统变量)：ANT_HOME， 
设置值为：D:CompSoft\apache-ant-1.8.3 
把 %ANT_HOME%\bin 加入到系统变量 PATH 中。 
检查ant是否正确安装：cmd输入ant，提示]]></description><category></category></item><item><title><![CDATA[spring]]></title><link>https://blog.youkuaiyun.com/c0c0cf/article/details/17291533</link><guid>https://blog.youkuaiyun.com/c0c0cf/article/details/17291533</guid><author>c0c0cf</author><pubDate>Thu, 12 Dec 2013 23:34:02 +0800</pubDate><description><![CDATA[HTTP Status 500 - Servlet.init() for servlet test threw exception

type Exception report

message Servlet.init() for servlet test threw exception

description The server encountered an internal ]]></description><category></category></item><item><title><![CDATA[Convention插件]]></title><link>https://blog.youkuaiyun.com/c0c0cf/article/details/9904001</link><guid>https://blog.youkuaiyun.com/c0c0cf/article/details/9904001</guid><author>c0c0cf</author><pubDate>Sun, 11 Aug 2013 19:57:31 +0800</pubDate><description><![CDATA[struts2的Cinvention插件主要特点就是"约定由于配置".
安装Convention插件Struts2项目下的struct2-convention-plugin-2.2.1.jar文件复制到Struts2应用的WEB-INF\lib路径下
Convention插件会自动搜索位于action,actions,structs,structs2包下的所有java类,Convention插]]></description><category></category></item><item><title><![CDATA[WinsockAPI值WSAWaitForMultipleEvents函数]]></title><link>https://blog.youkuaiyun.com/c0c0cf/article/details/9027439</link><guid>https://blog.youkuaiyun.com/c0c0cf/article/details/9027439</guid><author>c0c0cf</author><pubDate>Wed, 05 Jun 2013 08:49:13 +0800</pubDate><description><![CDATA[DWORDD WSAWaitForMultipleEvents(
  DWORD cEvents,
  const WSAEVENT *lphEvents,
  BOOL fWaitAll,
  DWORD dwTimeout,
  BOOL fAlertable
)
cEvents:lphEvents所指事件对象举兵数组中的数目，事件对象句柄的数目最大值WSA_MAXIMUM_WA]]></description><category></category></item><item><title><![CDATA[Winsock之WinInet]]></title><link>https://blog.youkuaiyun.com/c0c0cf/article/details/9025701</link><guid>https://blog.youkuaiyun.com/c0c0cf/article/details/9025701</guid><author>c0c0cf</author><pubDate>Tue, 04 Jun 2013 21:18:22 +0800</pubDate><description><![CDATA[WinInet基础,MFC提供了Win32 Internet扩展接口，即WinInet,WinInet为通用互联网协议(HTTP,FTP,Gopher)提供了统一的函数集，都采用熟悉的Win32 API接口。利用这些统一的函数集，大大简化了针对HTTP,FTP等协议的编程，从而轻松的将Internet集成到自己的应用程序中。底层协议转换只要对源代码稍加改动就可以完成，例如:FTP->HTTP
W]]></description><category></category></item></channel></rss>