[B! summarySite][xss] tsupoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

tsupo id:tsupo

summarySiteã¨xssã«é–¢ã™ã‚‹tsupoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (12)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Apacheç‹™ã„ã®æ”»æ’ƒç™ºç”Ÿã€ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰æµå‡ºã®æã‚Œã‚‚
ãƒã‚°ãƒˆãƒ©ãƒƒã‚ãƒ³ã‚°ã‚½ãƒ•ãƒˆã‚’ãƒ›ã‚¹ãƒ†ã‚£ãƒ³ã‚°ã—ã¦ã„ã‚‹ã‚µãƒ¼ãƒãŒæ”»æ’ƒã‚’å—ã‘ã€JIRAã€Bugzillaã€Confluenceã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãŒæµå‡ºã—ãŸæã‚ŒãŒã‚ã‚‹ã¨ã„ã†ã€‚ Apache Software Foundationã¯4æœˆ13æ—¥ã€ãƒã‚°ãƒˆãƒ©ãƒƒã‚ãƒ³ã‚°ã‚½ãƒ•ãƒˆã€ŒJIRAã€ã‚’ãƒ›ã‚¹ãƒ†ã‚£ãƒ³ã‚°ã—ã¦ã„ã‚‹ã‚µãƒ¼ãƒãŒæ”»æ’ƒã‚’å—ã‘ãŸã¨ãƒ–ãƒã‚°ã§ç™ºè¡¨ã—ãŸã€‚ã“ã®æ”»æ’ƒã«ã‚ˆã‚Šã€Apacheã§ãƒ›ã‚¹ãƒ†ã‚£ãƒ³ã‚°ã—ã¦ã„ã‚‹JIRAã€Bugzillaã€Confluenceã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®ãƒãƒƒã‚·ãƒ¥åŒ–ã•ã‚ŒãŸãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãŒæµå‡ºã—ãŸæã‚ŒãŒã‚ã‚‹ã¨è¦å‘Šã—ãŸã€‚ Apacheã«ã‚ˆã‚Œã°ã€æ”»æ’ƒã«ã¯çŸç¸®URLã‚µãƒ¼ãƒ“ã‚¹ã®TinyURLã‚’ä½¿ã£ã¦ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼ˆXSSï¼‰æ”»æ’ƒã‚³ãƒ¼ãƒ‰ã‚’ä»•è¾¼ã‚“ã URLã¸ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆã™ã‚‹æ‰‹å£ãŒä½¿ã‚ã‚ŒãŸã¨ã„ã†ã€‚Apacheã®ç®¡ç†è€…æ•°äººãŒã“ã®ãƒªãƒ³ã‚¯ã‚’ã‚¯ãƒªãƒƒã‚¯ã—ã¦ã—ã¾ã„ã€JIRAç®¡ç†æ¨©é™ã‚’å«ã‚€ã‚»ãƒƒã‚·ãƒ§ãƒ³ã«ä¾µå…¥ã•ã‚ŒãŸã€‚ ã•ã‚‰ã«XSSæ”»æ’ƒã¨ä¸¦è¡Œ
tsupo 2010/04/15
JIRAã€Bugzillaã€Confluenceã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãŒæµå‡ºã—ãŸæã‚Œ / Apacheã®ç®¡ç†è€…æ•°äººãŒç½ ãƒªãƒ³ã‚¯ã‚’ã‚¯ãƒªãƒƒã‚¯ã—ã¦ã—ã¾ã„ã€JIRAç®¡ç†æ¨©é™ã‚’å«ã‚€ã‚»ãƒƒã‚·ãƒ§ãƒ³ã«ä¾µå…¥ã•ã‚ŒãŸ / ä¸¦è¡Œã—ã¦ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’ç·å½“ã‚Šã™ã‚‹ãƒ–ãƒ«ãƒ¼ãƒˆãƒ•ã‚©ãƒ¼ã‚¹æ”»æ’ƒ

security

apache

tinyurl

XSS

Internet

summarySite
ãƒªãƒ³ã‚¯
JVN#50837839: Oracle Application Server ã«ãŠã‘ã‚‹ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã®è„†å¼±æ€§
Oracle Application Server 10g Release 3 (10.1.3), versions 10.1.3.4.0, 10.1.3.5, 10.1.3.5.1 Oracle Application Server 10g Release 2 (10.1.2), version 10.1.2.3.0
tsupo 2010/01/15
å½±éŸ¿ã‚’å—ã‘ã‚‹ã‚·ã‚¹ãƒ†ãƒ : Oracle Application Server 10g Release 3 (10.1.3), versions 10.1.3.4.0, 10.1.3.5, 10.1.3.5.1, Release 2 (10.1.2), version 10.1.2.3.0 / ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã®è„†å¼±æ€§ãŒå˜åœ¨

security

Oracle

ApplicationServer

XSS

è„†å¼±æ€§

summarySite
ãƒªãƒ³ã‚¯
XSSå¯¾ç–ãƒ‘ãƒƒãƒã‚’å½“ã¦ã¦ã‚‚Railsã«æ®‹ã‚‹è„†å¼±æ€§ - å²©æœ¬éš†å²ã®æ—¥è¨˜å¸³ï¼ˆã‚¢ãƒ¼ã‚«ã‚¤ãƒ–ï¼‰
ã©ã®ã‚ˆã†ãªè„†å¼±æ€§ã‹ å…ˆæ—¥æ›¸ã„ãŸã€ŒRails 2ç³»ã®XSSè„†å¼±æ€§ãŒRuby 1.9ã§ã¯å½±éŸ¿ãªã—ã¨ã•ã‚Œã‚‹ç†ç”±ã€ã¨ã„ã†è¨˜äº‹ã«ã€å¥¥ã•ã‚“ï¼ˆid:kazuhookuï¼‰ã‚ˆã‚Šã€ä¸‹è¨˜ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ã‚³ãƒ¡ãƒ³ãƒˆã‚’ã„ãŸã ãã¾ã—ãŸã€‚ ãŸã¨ãˆã°ãƒ–ãƒã‚°ã®å ´åˆã€èª°ã‹ã«å£Šã‚ŒãŸUTF-8ã‚’å«ã‚€ã‚³ãƒ¡ãƒ³ãƒˆã‚’æ›¸ãè¾¼ã¾ã‚Œã¡ã‚ƒã†ã¨ã€ãã®ãƒ–ãƒã‚°å…¨ä½“ã«ã‚¢ã‚¯ã‚»ã‚¹ã§ããªããªã‚‹(æœ€æ–°ã‚³ãƒ¡ãƒ³ãƒˆä¸€è¦§ã«å‡ºã‚‹ã‹ã‚‰)ã‚“ã˜ã‚ƒãªã„ã‹ã€‚XSSãŒç™ºç”Ÿã—ãªã„ã ã‘ã§è„†å¼±æ€§ãŒã‚ã‚‹ã“ã¨ã¯å¤‰ã‚ã‚‰ãªã„ ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ - kazuhookuã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ / 2009å¹´9æœˆ26æ—¥ ã¾ã£ãŸããŠã£ã—ã‚ƒã‚‹é€šã‚Šã§ã™ã€‚ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®æ§‹æˆã«ã‚ˆã£ã¦ã¯ã€ã‚µãƒ¼ãƒ“ã‚¹è‡ªä½“ãŒæä¾›ã§ããªããªã‚‹å¯èƒ½æ€§ãŒã‚ã‚Šã¾ã™ã€‚ ã“ã®ã‚ˆã†ãªè„†å¼±æ€§ã‚’ä½•ã¨ã‚ˆã¶ã®ã§ã—ã‚‡ã†ã‹ã€‚ã™ã§ã«çµ±ä¸€çš„ãªå‘¼ç§°ãŒã‚ã‚‹ã®ã‹ã©ã†ã‹ã€ç§ã¯çŸ¥ã‚Šã¾ã›ã‚“ã€‚ã‚µãƒ¼ãƒ“ã‚¹ä¸èƒ½ã¨ã„ã†è¦³ç‚¹ã‹ã‚‰ã¯åºƒç¾©ã®DoSè„†å¼±æ€§ã¨ã„ãˆã‚‹ã®ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ã€‚ è¿½è¨˜ï¼ˆ2009-0
tsupo 2009/09/29
ã€ŒRails 2ï¼‹SQLite 3ã¨ã„ã†æ§‹æˆã®å ´åˆã€ç§ã®æ¤œè¨¼ã§ã¯ã€ã‚¢ãƒ—ãƒªé–‹ç™ºè€…ãŒãƒãƒªãƒ‡ãƒ¼ã‚·ãƒ§ãƒ³ãƒã‚¸ãƒƒã‚¯ã‚’åŠ ãˆãªã„é™ã‚Šã€ä¸æ£ãªUTF-8ã‚·ãƒ¼ã‚±ãƒ³ã‚¹ã‚’å«ã‚€ãƒ‡ãƒ¼ã‚¿ãŒç™»éŒ²ã§ãã¦ã—ã¾ã„ã¾ã—ãŸã€

security

ruby

rails

xss

utf-8

technology

summarySite
ãƒªãƒ³ã‚¯
sk
ç§»å‹•ã—ã¾ã™ã€‚ http://skmwin.net/archives/2008/1211165212/
tsupo 2008/12/12
ã€Žã€Œæ•™ãˆã¦åŽ¨ã€ã®ã‚ªã‚¢ã‚·ã‚¹ã€ŒäººåŠ›æ¤œç´¢ã¯ã¦ãªã€ã«ã¦ã€ä»»æ„ã®ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’å®Ÿè¡Œã§ãã‚‹è„†å¼±æ€§ãŒç™ºè¦‹ã•ã‚ŒãŸæ¨¡æ§˜ã€

hatena

äººåŠ›æ¤œç´¢

security

XSS

Internet

summarySite
ãƒªãƒ³ã‚¯
ã¤ã„ã«èµ·ããŸï¼¸ï¼³ï¼³æ”»æ’ƒãƒ»ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ¼ã¯ï¼‘æ—¥ã«ã—ã¦ãªã‚‰ãš ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ¼-æœ€æ–°ãƒ‹ãƒ¥ãƒ¼ã‚¹:IT-PLUS
éºä¼åã‚’åŠ¹çŽ‡ã‚ˆãæ”¹å¤‰ã™ã‚‹ã‚²ãƒŽãƒ ç·¨é›†ç ”ç©¶ã®ç¬¬ä¸€äººè€…ã§ç±³ãƒ–ãƒãƒ¼ãƒ‰ç ”ç©¶æ‰€ã®ãƒ•ã‚§ãƒ³ãƒ»ãƒãƒ£ãƒ³ä¸»ä»»ç ”ç©¶å“¡ã¯ã€ã‚¨ãƒœãƒ©å‡ºè¡€ç†±ã‚„ã‚¸ã‚«ç†±ã®æ—©æœŸè¨ºæ–æŠ€è¡“ã‚’é–‹ç™ºã—ãŸã“ã¨ã‚’æ˜Žã‚‰ã‹ã«ã—ãŸã€‚ã‚¦ã‚¤ãƒ«ã‚¹ã®éºä¼æƒ…å ±ãŒâ€¦ç¶šã å—ç²¾åµã®ã‚²ãƒŽãƒ ç·¨é›†ã€ãªãœå•é¡Œã€€å„ªç”Ÿæ€æƒ³ã¨è¡¨è£ä¸€ä½“ ï¼»æœ‰æ–™ä¼šå“¡é™å®šï¼½ ã‚²ãƒŽãƒ ç·¨é›†é£Ÿå“ã€€è²©å£²å®¹èªã€æ¡ä»¶æº€ãŸã›ã°å®‰å…¨å¯©æŸ»ãªã— ï¼»æœ‰æ–™ä¼šå“¡é™å®šï¼½
tsupo 2008/08/21
äºˆå‘Š.in ã® XSS ã®ä»¶ã¨ã€ã¯ã¾ã¡ã¡ã‚ƒã‚“ã®ã€Œã“ã‚“ã«ã¡ã¯ã“ã‚“ã«ã¡ã¯ï¼ï¼ã€ã®ä»¶ã«ã¤ã„ã¦

security

XSS

CSRF

web

Internet

summarySite
ãƒªãƒ³ã‚¯
å€‹äººã ã‹ã‚‰ç”˜ã„ã®ã‹ãª - ã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ï¼
ã‚ã‚‰ã‚ã‚‰äºˆå‘ŠinãŒXSSã‚„ã‚‰ã‚Œã¡ã‚ƒã£ãŸã‚‰ã—ã„ã§ã™ãï¼ ä½¿ã„å¤ã•ã‚ŒãŸæ‰‹æ³•ï¼Ÿ ã„ã¾ã©ãã‚¨ã‚¹ã‚±ãƒ¼ãƒ—å‡¦ç†ã™ã‚‰ã—ã¦ãªãã¦ãƒ€ã‚µã„ï¼Ÿ é–¢é€£ã®è¨˜äº‹ã«å¯¾ã—ã¦ã€ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ã§ã‚‚è‰²ã€…è¨€ã‚ã‚Œã¦ã„ãŸã‚Šã€ http://b.hatena.ne.jp/t/%E4%BA%88%E5%91%8A.in?threshold=1 ãƒ‹ãƒ¥ãƒ¼ã‚¹ã‚µã‚¤ãƒˆã§ã‚‚ã€ã“ã‚“ãªç…½ã‚Šè¨˜äº‹ã‚’æ›¸ã‹ã‚Œã¦ã„ãŸã‚Šã™ã‚‹ã‘ã‚Œã©â€¦ ä»Šå›žã®ä»¶ã«ã¤ã„ã¦ITä¼æ¥ã«å‹¤ã‚ã‚‹ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã«èžã„ã¦ã¿ã‚‹ã¨ã€ ã€Œã“ã‚Œã¯åˆæ©ä¸ã®åˆæ©ã€‚XSSã‚³ãƒ¼ãƒ‰æ›¸ã„ãŸæ–¹ã‚‚10åˆ†ã‚‚æŽ›ã‹ã£ã¦ãªã„ã‚ˆã€‚ãã‚Œã‚’äº‹å‰ã«å¯¾ç–ã—ã¦ãªã‹ã£ãŸäºˆå‘Šinã«ã¯ã‚‚ã£ã¨ãƒ“ãƒƒã‚¯ãƒªã ã‘ã©ã€ã€ã€ç´ äººãªã®ï¼Ÿã€ ã¨èªžã‚‹ã€‚ äºˆå‘Šinã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£è„†å¼±æ€§ã‚’ç‹™ã£ãŸã‚³ãƒ¼ãƒ‰!?ã€€ã€Œäºˆå‘Šiné–‹ç™ºè€…ã¯ç´ äººã€ http://news.livedoor.com/article/detail/3759632/ ãã‚Œã£ã¦ã©ã†ã ã‚ã†ãã€‚ Googleã‚„Amazo
tsupo 2008/08/04
ã©ã‚“ãªä»•çµ„ã¿ã‹ã¾ã è¦‹ã¦ãªã„ã‚“ã ã‘ã©2chã®CSRFã®æ–¹ãŒã‚„ã°ããªã„ï¼Ÿ â†’ ãã†ãã†ã€ã“ã‚Œã€ã™ã”ã„ã‚„ã°ã„ã¨æ€ã†

security

XSS

CSRF

Internet

summarySite
ãƒªãƒ³ã‚¯
çŠ¯è¡Œäºˆå‘Šã®åŽé›†ãƒ»é€šå ±ã‚µã‚¤ãƒˆ - äºˆå‘Šin
02/18 08:27 å¤ç›®æ¼±çŸ³ / 02/18 08:27 **** / 02/18 08:27 ã“ã‚“ã«ã¡ã¯ã€‚****æ®ºã™ / 02/17 10:46 ****æ®ºã™ åƒè‘‰çœŒæ¾æˆ¸å¸‚*** / 02/17 10:46 ****æ®ºã™ åƒè‘‰çœŒæ¾æˆ¸å¸‚*** / 02/17 10:46 åƒè‘‰çœŒæ¾æˆ¸å¸‚**** / 02/17 10:46 **ã•ã‚“æ®ºã™ãž åƒè‘‰çœŒæ¾æˆ¸å¸‚** / 02/17 08:42 ****æ®ºã™ / 02/17 08:42 ã‚‚ã†ä¸€ç™º ã‚³ãƒ¼ãƒ©ãƒ³ç‡ƒã‚„ã—ã¤ã¤ãƒ / 02/16 09:56 ã˜ã‚ƒã‚****æ®ºã™ / 02/15 12:10 ã“ã‚Œã¯ç¢ºå®Ÿã«ã‚»ãƒ¼ãƒ•ã ã‚wwwwwwww / 02/14 08:01 ï½—ï½—ï½—ï½—ï½—ï½—ï½—ï½—ï½—ï½—ï½—ï½—ï½—ï½—ï½— / 02/13 08:14 ****æ®ºã™ / 02/13 08:13 >>375 **** / 02/11 15:07 ä»Šå¤œã¶ãŸãã‚“ã‚’æ®ºã—ã«è¡Œã / 02/11
tsupo 2008/08/03
çŠ¯è¡Œäºˆå‘Šã®æŠ•ç¨¿æ¬„ã«XSSè„†å¼±æ€§ã‚’çªã„ãŸä¸æ£ãªã‚³ãƒ¼ãƒ‰ / äºˆå‘Šinã¸ã®ã‚¢ã‚¯ã‚»ã‚¹ã¨åŒæ™‚ã«ã€çŠ¯è¡Œäºˆå‘Šæ–‡ã‚’ã€å¼·åˆ¶çš„ã«ï¼’ã¡ã‚ƒã‚“ãã‚‹ã«æŠ•ç¨¿ã•ã‚Œã¦ã—ã¾ã† / è¦è¦–åºã§ã¯ã™ã¹ã¦ã®äº‹å®Ÿã‚’æŠŠæ¡ã—ã¦ãŠã‚Šã€èª¿æŸ»ã‚’è¡Œã£ã¦ã„ã‚‹æœ€ä¸

security

äºˆå‘Šin

XSS

è„†å¼±æ€§

Internet

summarySite
ãƒªãƒ³ã‚¯
[è¦è¦–åºã®ã‚¹ãƒ¬ã¯ã‚¦ã‚£ãƒ«ã‚¹ã‹ãªã‚“ã‹ã˜ã‚ƒãï¼Ÿ] by ====ã€€ã‹ããƒã‚°ã€€âŠ‚äºŒäºŒäºŒï¼ˆã€€ï¼¾Ï‰ï¼¾ï¼‰äºŒâŠƒ
62 ä»¥ä¸‹ã€åç„¡ã—ã«ã‹ã‚ã‚Šã¾ã—ã¦VIPãŒãŠé€ã‚Šã—ã¾ã™2008/08/03(æ—¥) 03:39:40.93 ID:p7o9gAz90 >>5 61 â—†kusai/ZzDI 2008/08/03(æ—¥) 03:23:07.25 ID:7TPSf6W+0 ?Sâ˜…(717781) yutori.2ch.net.hp.infoseek.co.jp/w/r/e/wrestleangel/9989.shtml#host=yutori.2ch.netã€€ã€€ï¼ˆä»¥ä¸‹ç•¥ ã‚’èªã¿è¾¼ã¾ã›ã¦ã„ã¦ã€ãã‚Œã‚’èªã¿è¾¼ã‚€ã¨ â†“ã‚’èªã¿è¾¼ã¾ã›ã¦ yutori.2ch.net.hp.infoseek.co.jp/w/r/e/wrestleangel/post2ch.swf#host=yutori.2ch.netã€€ï¼ˆä»¥ä¸‹ç•¥ http://yutori.2ch.net/test/read.cgi/news4vip/1217701110/ ã¿ãŸ
tsupo 2008/08/03
äºˆå‘Šinã«ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°æ”»æ’ƒ / ã€Œã¤ã¾ã‚Šäºˆå‘Šinè¦‹ã«è¡Œã£ãŸé€šå ±åŽ¨ãŒç«‹ã¦ã•ã›ã‚‰ã‚Œã¦ã‚“ã®ã‹ã€ã€Œå…¨å“¡é€®æ•ã•ã‚ŒãŸã‚‰æ‚²æƒ¨ã ãªï½—ï½—ï½—ã€ â†’ ã†ã£ã¯ã

security

XSS

è„†å¼±æ€§

Internet

summarySite
ãƒªãƒ³ã‚¯
ã‚°ãƒ¼ã‚°ãƒ«ã€ã‚¦ã‚§ãƒ–è„†å¼±æ€§æ¤œçŸ¥ãƒ„ãƒ¼ãƒ«ã€ŒRatProxyã€ã‚’ãƒªãƒªãƒ¼ã‚¹
Googleã¯ç±³å›½æ™‚é–“7æœˆ1æ—¥ã€ã‚¦ã‚§ãƒ–é–‹ç™ºè€…ãŒã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆè„†å¼±æ€§ã‚’ç™ºè¦‹ã—ã€ä¿®æ£ã™ã‚‹ãŸã‚ã®ãƒ„ãƒ¼ãƒ«ã‚’ãƒªãƒªãƒ¼ã‚¹ã—ãŸã€‚ Googleã«ã‚ˆã‚‹ã¨ã€ã€ŒRatProxyã€ã¨å‘¼ã°ã‚Œã‚‹ã“ã®ç„¡æ–™ãƒ„ãƒ¼ãƒ«ã¯ã€åŠè‡ªå‹•åŒ–ã•ã‚ŒãŸå¤§éƒ¨åˆ†ãŒå—å‹•åž‹ã®ã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ç›£è¦–ãƒ„ãƒ¼ãƒ«ã§ã€è¤‡é›‘ãªWeb 2.0ç’°å¢ƒã«ãŠã‘ã‚‹æ—¢å˜ã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ä¸»å°Žåž‹ãƒˆãƒ©ãƒ•ã‚£ãƒƒã‚¯ã®ç›£è¦–ã«åŸºã¥ãæ½œåœ¨çš„å•é¡ŒãŠã‚ˆã³ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£é–¢é€£ã®è¨è¨ˆãƒ‘ã‚¿ãƒ¼ãƒ³ã‚’æ£ç¢ºã‹ã¤é«˜æ„Ÿåº¦ã«æ¤œå‡ºã—ã€è‡ªå‹•çš„ã«æ³¨é‡ˆã‚’ä»˜ã‘ã‚‹ã‚ˆã†ã«æœ€é©åŒ–ã•ã‚Œã¦ã„ã‚‹ã¨ã„ã†ã€‚ åŒãƒ„ãƒ¼ãƒ«ã¯ã¾ãŸã€å¹…åºƒãè„†å¼±æ€§ã‚’æ¤œçŸ¥ã—ã€ãƒ©ãƒ³ã‚¯ä»˜ã‘ã™ã‚‹ã€‚ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒªï¼ˆXSRFï¼‰ã‚„ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼ˆXSSï¼‰ã®ã»ã‹ã€ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ãªã©ã‚‚æ¤œçŸ¥ã™ã‚‹ã€‚
tsupo 2008/07/04
ãƒˆãƒ©ãƒ•ã‚£ãƒƒã‚¯ã‚’ç›£è¦–ã—ã€ãƒ‘ã‚¿ãƒ¼ãƒ³ã‚’æ¤œå‡º / ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒª(XSRF)ã‚„ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°(XSS)ã®ã»ã‹ã€ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ãªã©ã‚‚æ¤œçŸ¥ â†’ ã€Œãƒ©ãƒ³ã‚¯ä»˜ã‘ã€ã§è¦‹é€ƒã—ã‚’é˜²ãæ„å›³

security

webApplication

XSS

CSRF

SQLinjection

commandInjection

Internet

summarySite
ãƒªãƒ³ã‚¯
æŽ²ç¤ºæ¿ã‚½ãƒ•ãƒˆã€ŒRainboardã€ã«XSSã®è„†å¼±æ€§--JVNãªã©ã§è¦å‘Š
å°åˆ·ã™ã‚‹ ãƒ¡ãƒ¼ãƒ«ã§é€ã‚‹ ãƒ†ã‚ã‚¹ãƒˆ HTML é›»åæ›¸ç± PDF ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ ãƒ†ã‚ã‚¹ãƒˆ é›»åæ›¸ç± PDF ã‚¯ãƒªãƒƒãƒ—ã—ãŸè¨˜äº‹ã‚’Myãƒšãƒ¼ã‚¸ã‹ã‚‰èªã‚€ã“ã¨ãŒã§ãã¾ã™ JPCERT/CCã¯12æœˆ12æ—¥ã€æŽ²ç¤ºæ¿ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã€ŒRainboardã€ã«XSSï¼ˆã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼‰ã®è„†å¼±æ€§ãŒç¢ºèªã•ã‚ŒãŸã¨ã—ã¦é–¢é€£æƒ…å ±ã‚’å…¬é–‹ã—ãŸã€‚ã“ã®è„†å¼±æ€§ã¯ã€Rainboardã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³2.02ã¨ãã‚Œä»¥å‰ãŒå½±éŸ¿ã‚’å—ã‘ã‚‹ã€‚ Rainboardã¯ã€UDONãŒæä¾›ã™ã‚‹æŽ²ç¤ºæ¿ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã€‚è©²å½“ã™ã‚‹ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã§ã¯ã€ä»»æ„ã®ã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒåŸ‹ã‚ã“ã‚ã¦ã—ã¾ã†ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã®å•é¡ŒãŒå˜åœ¨ã™ã‚‹ã€‚ã“ã®å•é¡ŒãŒæ‚ªç”¨ã•ã‚Œã‚‹ã¨ã€æ‚ªæ„ã‚ã‚‹ã‚µã‚¤ãƒˆã‹ã‚‰Rainboardã¸ã®ãƒªãƒ³ã‚¯ãªã©é€šã˜ã¦ Cookie ã®å†…å®¹ã‚’ç›—ã¿è¦‹ã‚‰ã‚Œã‚‹ãªã©ã€ä»»æ„ã®Javascriptã‚³ãƒ¼ãƒ‰ãªã©ã‚’å®Ÿè¡Œã•ã‚Œã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ã€‚
tsupo 2007/12/12
Rainboardã¯ã€UDONãŒæä¾›ã™ã‚‹æŽ²ç¤ºæ¿ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ / ä»»æ„ã®ã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒåŸ‹ã‚ã“ã‚ã¦ã—ã¾ã†ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã®å•é¡ŒãŒå˜åœ¨ / Rainboardã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³2.02ã¨ãã‚Œä»¥å‰ãŒå½±éŸ¿ã‚’å—ã‘ã‚‹

security

XSS

Internet

summarySite
ãƒªãƒ³ã‚¯
ã‚µã‚¤ãƒœã‚¦ã‚ºOfficeã‚„ã‚¬ãƒ«ãƒ¼ãƒ³ã«è„†å¼±æ€§--XSSã‚„HTTPãƒ˜ãƒƒãƒ€ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ãªã©
å°åˆ·ã™ã‚‹ ãƒ¡ãƒ¼ãƒ«ã§é€ã‚‹ ãƒ†ã‚ã‚¹ãƒˆ HTML é›»åæ›¸ç± PDF ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ ãƒ†ã‚ã‚¹ãƒˆ é›»åæ›¸ç± PDF ã‚¯ãƒªãƒƒãƒ—ã—ãŸè¨˜äº‹ã‚’Myãƒšãƒ¼ã‚¸ã‹ã‚‰èªã‚€ã“ã¨ãŒã§ãã¾ã™ JPCERT/CCã¯ã“ã®ã»ã©ã€ã‚µã‚¤ãƒœã‚¦ã‚ºè£½å“ã«4ä»¶ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£è„†å¼±æ€§ãŒç¢ºèªã•ã‚ŒãŸã¨ã—ã¦ã€æ³¨æ„ã‚’å‘¼ã³ã‹ã‘ãŸã€‚å¯¾è±¡ã¨ãªã‚‹è£½å“ã¯ã€ã€Œã‚µã‚¤ãƒœã‚¦ã‚º Officeã€ã‚„ã€Œã‚µã‚¤ãƒœã‚¦ã‚º ã‚¬ãƒ«ãƒ¼ãƒ³ã€ãªã©è¤‡æ•°ã®è£½å“ã§ã€ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼ˆXSSï¼‰ã‚„HTTPã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ãªã©ã‚’å®Ÿè¡Œã•ã‚ŒãŸã‚Šã€DoSæ”»æ’ƒã‚’å—ã‘ã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ã€‚ å½±éŸ¿ã‚’å—ã‘ã‚‹ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã¯ã€ã‚µã‚¤ãƒœã‚¦ã‚º Office 6.6ã¨ãã‚Œä»¥å‰ ã€ã‚µã‚¤ãƒœã‚¦ã‚º ã‚¬ãƒ«ãƒ¼ãƒ³ 1.5ã€ã€Œã‚µã‚¤ãƒœã‚¦ã‚º ã‚¬ãƒ«ãƒ¼ãƒ³ ãƒ¯ãƒ¼ã‚¯ãƒ•ãƒãƒ¼ 1.0ã€ã¨ãã‚Œä»¥å‰ã€ã€Œã‚µã‚¤ãƒœã‚¦ã‚º ã‚¬ãƒ«ãƒ¼ãƒ³ ãƒ•ã‚¡ã‚¤ãƒ«ç®¡ç†ã‚µãƒ¼ãƒãƒ¼ 1.0ã€ã¨ãã‚Œä»¥å‰ã€ã€Œã‚µã‚¤ãƒœã‚¦ã‚º ã‚¬ãƒ«ãƒ¼ãƒ³ æŽ²ç¤ºæ¿ã‚µãƒ¼ãƒãƒ¼ 1.0ã€ã¨ãã‚Œä»¥å‰ã€ã€Œã‚µã‚¤ãƒœã‚¦ã‚º ã‚¬ãƒ«ãƒ¼ãƒ³ æ–½è¨äºˆç´„ã‚µãƒ¼ãƒãƒ¼
tsupo 2007/12/12
ã‚µã‚¤ãƒœã‚¦ã‚ºè£½å“ã«4ä»¶ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£è„†å¼±æ€§ / ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã‚„HTTPã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã€DoSæ”»æ’ƒã€ã‚ãƒ£ãƒƒã‚·ãƒ¥ã‚µãƒ¼ãƒã®ã‚ãƒ£ãƒƒã‚·ãƒ¥ã®ä¸Šæ›¸ãã€ä»»æ„ã®Cookieã®ç™ºè¡Œã€ã‚µãƒ¼ãƒã®é‹ç”¨å¦¨å®³ãªã©ã®å¯èƒ½æ€§

security

cybozu

XSS

httpHeaderInjection

Internet

summarySite
ãƒªãƒ³ã‚¯
yohgaki's blog - ã„ã‚ã„ã‚å¤‰ã‚ã£ãŸXSSãŒã‚ã‚Šã¾ã™ãŒ...
ç§ãŒçŸ¥ã‚‰ãªã‹ã£ãŸã ã‘ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ãŒã€ã“ã‚Œã«ã¯ã‹ãªã‚Šé©šãã¾ã—ãŸã€‚ã„ã‚ã‚“ãªæ‰€ã§å•é¡ŒãŒæŒ‡æ‘˜ã•ã‚Œã¦ã„ã¾ã™ãŒã€ECMAScriptã«XMLæ©Ÿèƒ½ã‚’è¿½åŠ ã—ãŸã®ã¯ã©ã†ãªã‚“ã§ã—ã‚‡ã†ãâ€¦. ç¢ºã‹ã«ã‹ãªã‚Šä¾¿åˆ©ãªã®ã§ã™ãŒä»¥ä¸‹ã®ã‚³ãƒ¼ãƒ‰ã§ã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒå®Ÿè¡Œã•ã‚Œã‚‹ã“ã¨ã¯ã»ã¨ã‚“ã©çŸ¥ã‚‰ã‚Œã¦ã„ãªã„ã§ã—ã‚‡ã†ãã€‚ <script> 123[â€+<_>ev</_>+<_>al</_>](â€+<_>aler</_>+<_>t</_>+<_>(1)</_>); </script> å¥½ã‚€ã¨å¥½ã¾ã–ã‚‹é–¢ä¿‚ãªãFirefox 1.5ã‹ã‚‰ä½¿ãˆã‚‹ã®ã§Webé–‹ç™ºè€…ã¯çŸ¥ã£ã¦ãŠã‹ãªã‚Œã°ãªã‚‰ãªã„ã§ã™ã€‚ æ—¥æœ¬èªžè¨³ http://www.ne.jp/asahi/nanto/moon/specs/ecma-357.html åŽŸæ–‡ http://www.ecma-international.org/publications/standards/Ecma-357.
tsupo 2007/10/15
123[''+<_>ev</_>+<_>al</_>](''+<_>aler</_>+<_>t</_>+<_>(1)</_>);

security

ECMAScript

JavaScript

E4X

XML

XSS

Internet

summarySite
ãƒªãƒ³ã‚¯
1