[B! security][*php] sugizouã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

sugizou id:sugizou

securityã¨*phpã«é–¢ã™ã‚‹sugizouã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (13)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

mixiã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®ãƒ—ãƒãƒ•ã‚£ãƒ¼ãƒ«ã‚’å¤–éƒ¨ã¸æŒã¡å‡ºã—ã€ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹åŒ–ã™ã‚‹ã‚·ã‚¹ãƒ†ãƒ ã¯ä½œæˆå¯èƒ½*ãƒ›ãƒ¼ãƒ ãƒšãƒ¼ã‚¸ã‚’ä½œã‚‹äººã®ãƒã‚¿å¸³
(2007/7/29 11:11æ›´æ–°) è¿½åŠ è¨˜äº‹ã¯è¨˜äº‹ã®æœ€å¾Œã« å…¨å›½ã®mixiãƒ¦ãƒ¼ã‚¶ãƒ¼é”ã€‚ SNSã¨ã¯ï¼Ÿã¨èžã‹ã‚Œã¦ç”ãˆã‚Œã¾ã™ã‹ï¼Ÿ é–‰éŽ–çš„ï¼Ÿå°è¦æ¨¡æ—¥è¨˜ï¼Ÿ ãã‚“ãªã®ã¯æ˜”ã®è©±ã€‚ ãã‚ãã‚ãƒ—ãƒãƒ•ã‚£ãƒ¼ãƒ«ã«æœ¬åã‚’ã€ä½•ã‚‚è€ƒãˆãšã«å…¥åŠ›ã™ã‚‹äº‹ã«ã¤ã„ã¦ã¡ã‚ƒã‚“ã¨è€ƒãˆã¦ãã ã•ã„ã€‚ ãªãœã‹ï¼Ÿ ãƒ—ãƒãƒ•ã‚£ãƒ¼ãƒ«ã¯mixiã‚¢ã‚«ã‚¦ãƒ³ãƒˆã‚’æŒã£ã¦ã„ãªã„äººã§ã‚‚ã€ã‚ã‚‹æ–¹æ³•ã§è¦‹ã‚Œã‚‹ã‹ã‚‰ã§ã™ã€‚ ãˆï¼Ÿãªã‚“ã¦ä»Šæ›´èžã‹ãªã„ã§ãã ã•ã„ãã€‚ ä¼šå“¡æ•°1000ä¸‡äººçªç ´ã—ã¦ã„ã‚‹æ™‚ç‚¹ã§ã€ãƒ—ãƒãƒ•ã‚£ãƒ¼ãƒ«ã‚’å…¨ä½“ã«å…¬é–‹ã—ã¦ã„ã‚‹äººã¯å±…ã¾ã™ã‘ã©ã€ãã‚“ãªè¦æ¨¡ã˜ã‚ƒã‚ã‚Šã¾ã›ã‚“ã€‚ ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆãƒ¦ãƒ¼ã‚¶ãƒ¼å…¨ã¦ãŒã€ã‚ãªãŸã®ãƒ—ãƒãƒ•ã‚£ãƒ¼ãƒ«ã‚’è¦‹ã‚‹ã“ã¨ãŒå‡ºæ¥ã¾ã™ã€‚ï¼ˆä»Šã®ã¨ã“ã‚ï¼‰ ç°¡ç•¥çš„ã«æ¬¡ã®ã‚ˆã†ãªã‚·ã‚¹ãƒ†ãƒ ã‚’æ§‹ç¯‰ã—ã¾ã™ ã€ä½¿ã†ã‚‚ã®ã€‘ ãƒ»http://mixilabo.com/index.cgi?fn=get_friend_home&id= ãƒ»PHPï¼ˆç§ãŒPHPãƒ¦ãƒ¼ã‚¶ãƒ¼ã ã‹ã‚‰ï¼‰ ä½œæ¥ã‚’ç°¡ç•¥
sugizou 2007/07/26
"ä½•ä»¶ã‹é©å½“ã«æ•°å—ã‚’å…¥åŠ›ã™ã‚‹ã¨ã‚ã‹ã‚Šã¾ã™ãŒã€æ‰€åœ¨åœ°ã¨æœ¬åã®å…¬é–‹ã—ã¦ã„ã‚‹äººã®æ•°ã¯è†¨å¤§ã§ã™ã€‚ã“ã‚Œã¯éžå¸¸ã«å±é™ºãªçŠ¶æ…‹ã§ã‚ã‚‹ã¨è€ƒãˆã¦ãã ã•ã„ã€‚"ã€€ã“ã£ã¡ã®ãŒå¤§äº‹ã ã¨æ€ã†ã€‚

mixi

*php

security
ãƒªãƒ³ã‚¯
globã§ä»»æ„ã‚³ãƒ¼ãƒ‰å®Ÿè¡Œã®è„†å¼±æ€§
Last Updated on: 2018å¹´8æœˆ13æ—¥Firstã«PHPã®globã§ä»»æ„ã‚³ãƒ¼ãƒ‰å®Ÿè¡Œã®è„†å¼±æ€§ã€ã¨ã‚ã£ãŸã®ã§CVSã‚’è¦‹ã¦ã¿ã‚‹ã¨globç”¨ã®ãƒ¡ãƒ¢ãƒªæ§‹é€ ä½“ã‚’æœªåˆæœŸåŒ–ã§ä½¿ç”¨ã—ã¦ã„ã‚‹ã‚³ãƒ¼ãƒ‰ãŒä¿®æ£ã•ã‚Œã¦ã„ã¾ã—ãŸã€‚æœªåˆæœŸåŒ–ã®æ§‹é€ ä½“ãƒ¡ãƒ¢ãƒªã‚’ä»»æ„ãƒ‡ãƒ¼ã‚¿ã§æ›¸ãæ›ãˆã‚‹å¿…è¦ãŒã‚ã‚‹ã®ã§ã€æ”»æ’ƒã‚’è¡Œã†ã«ã¯æ”»æ’ƒãŒå¯èƒ½ã¨ãªã‚‹ãƒ¡ãƒ¢ãƒªãƒ¬ã‚¤ã‚¢ã‚¦ãƒˆã‚’ä½œã‚‹æ¯”è¼ƒçš„ç‰¹æ®Šãªã‚³ãƒ¼ãƒ‰ãŒå¿…è¦ã«ãªã‚‹ã¨æ€ã‚ã‚Œã¾ã™ã€‚ ä»»æ„ã‚³ãƒ¼ãƒ‰å®Ÿè¡Œã®è„†å¼±æ€§ã¨ã—ã¦ Remotely Exploitable : Yes Locally Exploitable : Yes ã®å‰²ã«ã¯ Rated as : Moderate Risk ã¨ãªã£ã¦ã„ã¾ã™ã€‚ã“ã‚Œã¯æ”»æ’ƒå¯èƒ½ãªãƒ¡ãƒ¢ãƒªãƒ¬ã‚¤ã‚¢ã‚¦ãƒˆä½œæˆã¯ã‚ã¾ã‚Šç›´æ„Ÿçš„ã§ã¯ãªã„ã‹ã‚‰ã€ã‚‚ã—ãã¯PoCãƒ¬ãƒ™ãƒ«ã®é€šå¸¸ã§ã¯èµ·ã“ã‚Šãˆãªã„çŠ¶æ³ç”¨ã®æ”»æ’ƒã‚³ãƒ¼ãƒ‰ã®ã¿ä½œæˆã•ã‚Œã¦ã„ã‚‹ã‹ã‚‰ã ã¨æ€ã‚ã‚Œã¾ã™ã€‚ ã“ã‚Œã¯PHP5.2.3ä»¥ä¸‹ã®è„†å¼±æ€§ã§ã™ã€‚ä»¥ä¸‹ã¯HE
sugizou 2007/07/21
*php

security
ãƒªãƒ³ã‚¯
[ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£]ç”»åƒã¸ã®PHPã‚³ãƒžãƒ³ãƒ‰æŒ¿å…¥ â€• T.Teradaã®æ—¥è¨˜
ã ã„ã¶æ™‚é–“ãŒãŸã£ã¦ã—ã¾ã„ã¾ã—ãŸãŒã€å¤§åž£ã•ã‚“ã®ä»¥ä¸‹ã®ãƒ–ãƒã‚°ã«ã‚³ãƒ¡ãƒ³ãƒˆã—ãŸã“ã¨ãªã©ã‚’ã¾ã¨ã‚ã¾ã™ã€‚ ç”»åƒãƒ•ã‚¡ã‚¤ãƒ«ã«PHPã‚³ãƒ¼ãƒ‰ã‚’åŸ‹ã‚è¾¼ã‚€æ”»æ’ƒã¯æ—¢çŸ¥ã®å•é¡Œ â€“ yohgaki's blog ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰ç”»åƒã‚’åˆ©ç”¨ã—ãŸæ”»æ’ƒã«ã¤ã„ã¦ã§ã™ã€‚ æ”»æ’ƒã®æ¦‚è¦ ç”»åƒãƒ•ã‚¡ã‚¤ãƒ«ã«PHPã‚³ãƒžãƒ³ãƒ‰ã‚’æŒ¿å…¥ã™ã‚‹æ”»æ’ƒã¯ã€å¤§ãã2ç¨®é¡žã«åˆ†ã‘ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚ 1ã¤ã¯ã€ç”»åƒã®ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰æ©Ÿèƒ½ã‚’æŒã¤ã‚µã‚¤ãƒˆè‡ªèº«ã‚’ç‹™ã†æ”»æ’ƒã§ã™ã€‚PHPã§é–‹ç™ºã•ã‚Œã¦ãŠã‚Šã€ä»»æ„ã®æ‹¡å¼µåã®ãƒ•ã‚¡ã‚¤ãƒ«ã®ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰ã‚’è¨±ã™ã‚µã‚¤ãƒˆã§ã¯ã€æ‹¡å¼µåãŒphpãªã©ã®ãƒ•ã‚¡ã‚¤ãƒ«ã‚’ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰ã•ã‚Œã‚‹æã‚ŒãŒã‚ã‚Šã¾ã™ã€‚ æ‹¡å¼µåãŒphpãªã©ã®ãƒ•ã‚¡ã‚¤ãƒ«ã«ä»•è¾¼ã¾ã‚ŒãŸPHPã‚³ãƒžãƒ³ãƒ‰ã¯ã€ãã®ãƒ•ã‚¡ã‚¤ãƒ«ã«HTTP/HTTPSã§ã‚¢ã‚¯ã‚»ã‚¹ã•ã‚ŒãŸéš›ã«å®Ÿè¡Œã•ã‚Œã¾ã™ã€‚æ”»æ’ƒè€…ã¯ã€ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰ãƒ•ã‚¡ã‚¤ãƒ«ã‚’é€šã˜ã¦ã€ç”»åƒãŒç½®ã‹ã‚Œã‚‹Webã‚µãƒ¼ãƒä¸Šã§ä»»æ„ã®ã‚³ãƒžãƒ³ãƒ‰ã‚’å®Ÿè¡Œã™ã‚‹ã“ã¨ã§ãã¾ã™ã€‚ ã“ã®è„†å¼±æ€§ã¯ã€ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰å¯èƒ½ãªãƒ•
sugizou 2007/07/18
*php

security
ãƒªãƒ³ã‚¯
$intval * 1ã§ã‚µãƒ‹ã‚¿ã‚¤ã‚ºâ€¦
ãŸã¾ãŸã¾è¦‹ãŸPHPã®ã‚³ãƒ¼ãƒ‰ã§SQLæ–‡ä¸ã®æ•´æ•°å€¤ã‚’ $intval * 1 ã¨ã—ã¦æ•´æ•°åž‹ã«ã™ã‚‹ã‚µãƒ‹ã‚¿ã‚¤ã‚ºãŒã‚ã‚Šã¾ã—ãŸã€‚ã“ã®æ–¹æ³•ã‚’ãŠè–¦ã‚ã™ã‚‹ã‚ã‘ã§ã¯ã‚ã‚Šã¾ã›ã‚“ãŒã€ä»¥å‰ã®ã‚¨ãƒ³ãƒˆãƒª http://blog.ohgaki.net/index.php/yohgaki/2007/07/04/example_1428_a_best_practice_query ã§sprintf()ã®%dã‚’ä½¿ã†æ–¹æ³•ã‚ˆã‚Šã¯ã¾ã—ã§ã™ã€‚ $ php -r â€œecho â€˜99999999999999â€™ * 1;â€ 99999999999999 å®Ÿè¡Œã—ãŸãƒžã‚·ãƒ³ã¯32bitã®Linuxã‚·ã‚¹ãƒ†ãƒ ã§ã™ãŒæµ®å‹•å°æ•°ç‚¹åž‹ã«è‡ªå‹•å¤‰æ›ã•ã‚Œã‚‹ã®ã§2^31ã‚’è¶Šãˆã‚‹å€¤ã§ã‚‚æ£ã—ãè¡¨ç¤ºã•ã‚Œã¾ã™ã€‚ä¸€æ–¹ã€PHPãƒžãƒ‹ãƒ¥ã‚¢ãƒ«ã®æ–¹æ³•ã ã¨ $ php -r â€œprintf(â€˜%dâ€™, â€˜99999999999999â€™ * 1);â€ 276447231 ã¨ãªã£ã¦ã—ã¾ã„ã¾ã™
sugizou 2007/07/14
*php

security
ãƒªãƒ³ã‚¯
GDã«ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ›ãƒ¼ãƒ«
GDã®é–‹ç™ºã¯çµ‚ã‚ã£ã¦ã„ã‚‹ã€ã¨æ€ã£ã¦ã„ãŸã‚‰php.netã§ãƒ›ã‚¹ãƒˆã—ã¦ãŸã‚“ã§ã™ãã€‚PHPã®ç‹¬è‡ªæ‹¡å¼µãªã©è‰²ã€…è¿½åŠ ã•ã‚Œã¦ã„ãŸã®ã§è‡ªç„¶ãªæµã‚Œã¨ã¯æ€ã„ã¾ã™ã€‚ CVE-2007-3472ã€CVE-2007-3473ã€CVE-2007-3474ã€CVE-2007-3475ã€CVE-2007-3476ã€CVE-2007-347ã€CVE-2007-3478 ã¨GDãƒ©ã‚¤ãƒ–ãƒ©ãƒªã®è„†å¼±æ€§ãŒãƒ¬ãƒãƒ¼ãƒˆã•ã‚Œã¦ã„ã¾ã™ã€‚ æ•´æ•°ã‚ªãƒ¼ãƒãƒ¼ãƒ•ãƒãƒ¼ç‰ã¯ãšã£ã¨ä»¥å‰ã«æŒ‡æ‘˜ã•ã‚Œã€ãšã„ã¶ã‚“é•·ã„é–“ãƒ‡ã‚£ã‚¹ãƒˆãƒªãƒ“ãƒ¥ãƒ¼ã‚¿ãŒãƒ‘ãƒƒãƒã§å¯¾å¿œã—ã¦ã„ãŸå•é¡Œã¨åŒä¸€ã®ã‚ˆã†ãªæ°—ãŒã—ã¾ã™ãŒã€ã©ã†ãªã‚“ã§ã—ã‚‡?
sugizou 2007/07/03
*php

gd

security
ãƒªãƒ³ã‚¯
æºå¸¯ç”¨ã‚¦ã‚£ãƒ«ã‚¹ãŒæµè¡Œã—ã¦ã„ã‚‹ã¨ã¯èžã„ã¦ã„ã¾ã—ãŸãŒã€12ä¸‡å°ã¨ã¯â€¦
æœ€è¿‘ã€ç”»åƒãŒã‚‰ã¿ã‚¨ãƒ³ãƒˆãƒªãŒå¤šã„ã§ã™ã€‚ ã“ã®å®¹ç–‘è€…ãŒé–‹ç™ºã—ãŸã‚¦ã‚£ãƒ«ã‚¹ã¯Buletoothå†…è”µåž‹ã®æºå¸¯é›»è©±ã§ç”¨ã„ã‚‰ã‚Œã¦ã„ã‚‹Symbian ç¤¾è£½ã®çµ„ã¿è¾¼ã¿æ©Ÿå™¨ç”¨OSã«æ„ŸæŸ“ã™ã‚‹ã¨ã„ã†ã‚‚ã®ã€‚ã‚¢ãƒ€ãƒ«ãƒˆç”»åƒãƒ•ã‚¡ã‚¤ãƒ«ãªã©ã‚’çµŒç”±ã—ã¦ä»–ã®æºå¸¯é›»è©±ã«æ„ŸæŸ“ã€‚ã‚¦ã‚£ãƒ«ã‚¹ã«æ„ŸæŸ“ã—ãŸæºå¸¯é›»è©±ã¯12ä¸‡å°è¿‘ãã«ã‚‚åŠã‚“ã§ã„ãŸã€‚ ä½œè€…ãŒé€®æ•ã•ã‚ŒãŸãã†ã§ã™ãŒã€ã©ã“ã‹ã‚‰å‡ºæ‰€ãŒåˆ¤ã£ãŸã®ã‹èˆˆå‘³ãŒã‚ã‚Šã¾ã™ã€‚ æœ€è¿‘ã®ã‚¨ãƒ³ãƒˆãƒªã§ç”»åƒã®ãƒãƒªãƒ‡ãƒ¼ã‚·ãƒ§ãƒ³ã«ãƒ•ã‚©ãƒ¼ãƒžãƒƒãƒˆå¤‰æ›ã‚’ç”¨ã„ãŸæ–¹æ³•ã‚’ç´¹ä»‹ã—ã¾ã—ãŸã€‚ã€Œè‡ªåˆ†ã®ã‚µã‚¤ãƒˆã ã‘å®ˆã‚Œã‚Œã°è‰¯ã„ã®ã§ã¯?ã€ã¨ã•ã‚Œã‚‹æ„è¦‹ã‚’é ‚ã„ã¦ã„ãŸã®ã§ã™ãŒã€ãã†ã¯è¨€ã£ã¦ã„ã‚‰ã‚Œãªã„äº‹ä¾‹ã®ä¸€ã¤ã ã¨æ€ã„ã¾ã™ã€‚ å‚è€ƒï¼š http://blog.ohgaki.net/index.php/yohgaki/2007/06/24/c_ra_a_a_ia_ca_la_ljavascripta_e_na http://blog.ohgaki.net/in
sugizou 2007/06/26
*php

security

mobile
ãƒªãƒ³ã‚¯
yohgaki's blog - ç”»åƒãƒ•ã‚¡ã‚¤ãƒ«ã«JavaScriptã‚’éš ã™
Last Updated on: 2014å¹´12æœˆ5æ—¥å‰å›žã®ã‚¨ãƒ³ãƒˆãƒªã§ã‚¤ãƒ¡ãƒ¼ã‚¸ãƒ•ã‚¡ã‚¤ãƒ«ã«ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’åŸ‹ã‚è¾¼ã‚“ã§æ”»æ’ƒã™ã‚‹æ–¹æ³•ã«ã¤ã„ã¦è¨˜è¼‰ã—ã¾ã—ãŸãŒã€æœ€è¿‘ã‚¤ãƒ¡ãƒ¼ã‚¸ãƒ•ã‚¡ã‚¤ãƒ«ã«ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’åŸ‹ã‚è¾¼ã‚€äº‹ä¾‹ãŒè©±é¡Œã«ãªã£ãŸãŸã‚ã‹ ha.ckersã«JavaScriptã‚’ã‚¤ãƒ¡ãƒ¼ã‚¸ãƒ•ã‚¡ã‚¤ãƒ«ã«éš ã™æ–¹æ³•ãŒç´¹ä»‹ã•ã‚Œã¦ã„ã¾ã™ã€‚ http://ha.ckers.org/blog/20070623/hiding-js-in-valid-images/ <script src="http://cracked.example.com/cracked.gif">ãªã©ã¨XSSæ”»æ’ƒã‚’æ‹¡å¼µã™ã‚‹æ‰‹æ®µã«åˆ©ç”¨å¯èƒ½ã§ã™ã€‚ã‚µãƒ³ãƒ—ãƒ«ã¨ã—ã¦Flickerã«JavaScriptã‚’åŸ‹ã‚è¾¼ã‚“ã ã‚¤ãƒ¡ãƒ¼ã‚¸ãƒ•ã‚¡ã‚¤ãƒ«ãŒã‚¢ãƒƒãƒ—ã•ã‚Œã¦ã„ã¾ã™ã€‚ ã“ã®ã‚¤ãƒ¡ãƒ¼ã‚¸ãƒ•ã‚¡ã‚¤ãƒ«ã¯ä¸Šæ‰‹ãç´°å·¥ã—ã¦ã„ã‚‹ã®ã§ç”»åƒã¨ã—ã¦ã‚‚è¡¨ç¤ºã•ã‚Œã€JavaScriptã‚‚å®Ÿè¡Œã§ãã¾ã™ã€‚ Flickerã¯ç”»
sugizou 2007/06/24
*php

image

javascript

security
ãƒªãƒ³ã‚¯
ç”»åƒãƒ•ã‚¡ã‚¤ãƒ«ã« PHP ã‚³ãƒ¼ãƒ‰ã‚’åŸ‹ã‚è¾¼ã‚€æ”»æ’ƒã¯æ—¢çŸ¥ã®å•é¡Œ
Last Updated on: 2015å¹´9æœˆ10æ—¥å›½å†…å¤–ã®ãƒ¡ãƒ‡ã‚£ã‚¢ã§ã€Œç”»åƒãƒ•ã‚¡ã‚¤ãƒ«ã«æ”»æ’ƒç”¨ã®PHPã‚³ãƒ¼ãƒ‰ãŒå«ã¾ã‚Œã¦ã„ãŸã€ã¨æ¯”è¼ƒçš„å¤§ããå–ã‚Šä¸Šã’ã‚‰ã‚Œã¦ã„ã¾ã™ã€‚ã—ã‹ã—ã€ã“ã®æ”»æ’ƒæ‰‹æ³•ã¯å¤ãã‹ã‚‰çŸ¥ã‚‰ã‚Œã¦ã„ãŸæ–¹æ³•ã§ã™ã€‚æ¡ä»¶ã¯å¤šå°‘åŽ³ã—ããªã‚Šã¾ã™ãŒPerl, Ruby, Pythonã§ã‚‚åŒæ§˜ã®æ”»æ’ƒã¯è€ƒãˆã‚‰ã‚Œã¾ã™ã€‚PHPã®å ´åˆã¯è¨€èªžä»•æ§˜çš„ã«ä»–ã®è¨€èªžã«æ¯”ã¹æ”»æ’ƒãŒå®¹æ˜“ã§ã™ã€‚ å…¸åž‹çš„ãªæ”»æ’ƒã®ã‚·ãƒŠãƒªã‚ªã¯æ¬¡ã®é€šã‚Šã§ã™ã€‚ è¿½è¨˜ï¼šTokenizerã‚’ä½¿ã£ãŸä¾‹ã«ä¿®æ£ã—ã¾ã—ãŸã€‚ ã‚¢ãƒãƒ€ãªã©ã®ç”»åƒãƒ•ã‚¡ã‚¤ãƒ«ã‚’ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰ã§ãã‚‹ã‚µã‚¤ãƒˆã‚’æŽ¢ã™ ãƒãƒ¼ã‚«ãƒ«ãƒ•ã‚¡ã‚¤ãƒ«ã‚¤ãƒ³ã‚¯ãƒ«ãƒ¼ãƒ‰ãƒã‚°ã‚’æŽ¢ã™ ç”»åƒãƒ•ã‚¡ã‚¤ãƒ«ã«ã‚µã‚¤ãƒˆãŒåˆ©ç”¨ã—ã¦ã„ã‚‹è¨€èªžã®ã‚³ãƒ¼ãƒ‰ã‚’åŸ‹ã‚è¾¼ã‚€ æ”»æ’ƒã‚³ãƒ¼ãƒ‰ã‚’å«ã‚“ã ãƒ•ã‚¡ã‚¤ãƒ«ã‚’ç”»åƒãƒ•ã‚¡ã‚¤ãƒ«ã¨ã—ã¦ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰ã™ã‚‹ ãƒãƒ¼ã‚«ãƒ«ãƒ•ã‚¡ã‚¤ãƒ«ã‚¤ãƒ³ã‚¯ãƒ«ãƒ¼ãƒ‰ãƒã‚°ã‚’åˆ©ç”¨ã—ã¦æ”»æ’ƒã‚³ãƒ¼ãƒ‰ã‚’å®Ÿè¡Œã™ã‚‹ PHPã®å ´åˆã€ãƒªãƒ¢ãƒ¼ãƒˆã‚¤ãƒ³ã‚¯ãƒ«ãƒ¼ãƒ‰ãƒã‚°ã‚’æ”»æ’ƒã™ã‚‹ãŸã‚ã®æ”»æ’ƒç”¨ã‚³
sugizou 2007/06/24
*php

image

security
ãƒªãƒ³ã‚¯
XSSã‚’å‰Šé™¤ã—ã€éžæŽ¨å¥¨ã®è¦ç´ ã‚’å¤‰æ›! - HTMLãƒ•ã‚£ãƒ«ã‚¿ã€ŒHTML Purifier 2.0ã€ | ã‚¨ãƒ³ã‚¿ãƒ¼ãƒ—ãƒ©ã‚¤ã‚º | ãƒžã‚¤ã‚³ãƒŸã‚¸ãƒ£ãƒ¼ãƒŠãƒ«
20æ—¥(ç±³å›½æ™‚é–“)ã€HTML Purifierã®æœ€æ–°ç‰ˆã¨ãªã‚‹ã€ŒHTML Purifier 2.0ã€ãŒå…¬é–‹ã•ã‚ŒãŸã€‚HTML Purifierã¯PHPã§é–‹ç™ºã•ã‚ŒãŸHTMLãƒ•ã‚£ãƒ«ã‚¿ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã€‚GNU LESSER GENERAL PUBLIC LICENSE Version 2.1ã®ã‚‚ã¨ã€ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã¨ã—ã¦å…¬é–‹ã•ã‚Œã¦ã„ã‚‹ã€‚æ¨™æº–ä»•æ§˜ã«æº–æ‹ ã—ã¦ã„ã‚‹HTMLãƒ‡ãƒ¼ã‚¿ã‚’ãƒ•ã‚£ãƒ«ã‚¿ãƒªãƒ³ã‚°ã™ã‚‹ãŸã‚ã®ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã§ã€XSSãªã©å±é™ºæ€§ã®ã‚ã‚‹ã‚³ãƒ¼ãƒ‰ã‚’å‰Šé™¤ã™ã‚‹éš›ã«å½¹ç«‹ã¤ã»ã‹ã€BBCodeã«å¯¾ã™ã‚‹ä»£æ›¿ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã¨ã—ã¦ã‚‚æ´»ç”¨ã§ãã‚‹ã€‚ 2.0ã«ãŠã‘ã‚‹ä¸»ãªå¤‰æ›´ç‚¹ã¯ã‚¢ãƒ¼ã‚ãƒ†ã‚¯ãƒãƒ£ã«å¯¾ã—ã¦2ã¤ã®å¤§ããªå¤‰æ›´ãŒåŠ ãˆã‚‰ã‚ŒãŸç‚¹ã«ã‚ã‚‹ã€‚ã¾ãšæŽ¨å¥¨ã•ã‚Œã¦ã„ãªã„è¦ç´ ã‚’æ¨™æº–æŽ¨å¥¨ã•ã‚Œã¦ã„ã‚‹ã‚‚ã®ã«å¤‰æ›ã™ã‚‹TidyãŒå¤‰æ›´ã•ã‚Œã¦ãŠã‚Šã€æ–°ã—ã„è¦ç´ ã‚„å±žæ€§ã‚’ç°¡å˜ã«ä½œæˆã™ã‚‹ãŸã‚ã®Advanced APIã«ã‚‚å¤‰æ›´ãŒåŠ ãˆã‚‰ã‚Œã¦ã„ã‚‹ã€‚ä»¥å‰ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‹ã‚‰2.
sugizou 2007/06/22
*php

security

xss
ãƒªãƒ³ã‚¯
PHPã‚³ãƒ¼ãƒ‰ã®XSSã‚„SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³è„†å¼±æ€§ã‚’ãƒã‚§ãƒƒã‚¯ã™ã‚‹ã€ŒPixyã€:phpspoté–‹ç™ºæ—¥èªŒ
Pixy: XSS and SQLI Scanner for PHP Pixy is a Java program that performs automatic scans of PHP source code, aimed at the detection of XSS and SQL injection vulnerabilities. PHPã‚³ãƒ¼ãƒ‰ã®XSSã‚„SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³è„†å¼±æ€§ã‚’ãƒã‚§ãƒƒã‚¯ã™ã‚‹ã€ŒPixyã€ã€‚ Javaã§æ›¸ã‹ã‚ŒãŸãƒ„ãƒ¼ãƒ«ã®ã‚ˆã†ã§ã™ãŒã€Webã‚¤ãƒ³ã‚¿ãƒ•ã‚§ãƒ¼ã‚¹ã‚‚ç”¨æ„ã•ã‚Œã¦ã„ã¦ã€ã‚µã‚¤ãƒˆä¸Šã§PHPã‚³ãƒ¼ãƒ‰ã®è„†å¼±æ€§ãŒãƒã‚§ãƒƒã‚¯ã§ãã‚‹ã‚ˆã†ã§ã™ã€‚ ä¾‹ãˆã°ã€æ¬¡ã®ã‚ˆã†ãªã‚³ãƒ¼ãƒ‰ã‚’æ¤œè¨¼ã—ã¦ã¿ã¾ã—ã‚‡ã†ã€‚ <?php ï¼„x = ï¼„_GET['x']; echo ï¼„x; ?> ã™ã‚‹ã¨ã€æ¬¡ã®ã‚ˆã†ã«ã€è„†å¼±ãªéƒ¨åˆ†ãŒèµ¤ãè¡¨ç¤ºã•ã‚Œã¾ã—ãŸã€‚ ãªãŠã€ã„ãã¤ã‹è„†å¼±ãªã‚³ãƒ¼ãƒ‰ã‚’è©¦ã—ã¦ã¿ã¾ã—ãŸãŒã€å•é¡Œãªã—ã€ã¨ãªã‚‹ã‚³ãƒ¼ãƒ‰
sugizou 2007/06/22
*php

security
ãƒªãƒ³ã‚¯
PHPMailerã‚³ãƒžãƒ³ãƒ‰ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ â€“ WordPress, Mantis, WebCalendar, Group-Office, Joomla, etc
PHPMailerã‚³ãƒžãƒ³ãƒ‰ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ â€“ WordPress, Mantis, WebCalendar, Group-Office, Joomla, etc Last Updated on: 2018å¹´8æœˆ13æ—¥å€‹äººçš„ã«ã¯å½±éŸ¿ãªã„ã§ã™ãŒã„ã‚ã„ã‚ãªã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã§ä½¿ã‚ã‚Œã¦ã„ã‚‹PHPMailerã¨è¨€ã†ã‚¯ãƒ©ã‚¹ã«ã‚³ãƒžãƒ³ãƒ‰ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã®è„†å¼±æ€§ãŒã‚ã£ãŸã‚ˆã†ã§ã™ã€‚ãƒªãƒ³ã‚¯å…ˆã‚’è¦‹ã‚Œã°escapeshellarg()ã‹escapeshellcmd()ã§ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã™ã¹ãå€‹æ‰€ãŒã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã•ã‚Œã¦ã„ãªã„äº‹ãŒåˆ†ã‹ã‚Šã¾ã™ã€‚ ã©ã®ä½å±é™ºã‹?ã¨è¨€ã†ã¨ç°¡å˜ã«ã‚µãƒ¼ãƒã‚’ä¹—ã£å–ã‚‰ã‚Œã‚‹ï¼ˆä¸æ£ãªãƒ—ãƒã‚»ã‚¹ã‚’å®Ÿè¡Œã•ã‚Œã‚‹ç‰ã€‚ãƒ—ãƒã‚ã‚·ã€SPAMãƒ¡ãƒ¼ãƒ«ä¸ç¶™ã€SSHã‚¢ã‚«ã‚¦ãƒ³ãƒˆã‚¯ãƒ©ãƒƒã‚¯ã€DoSã€etcï¼‰ãã‚‰ã„å±é™ºã§ã™ã€‚å¯¾å‡¦ãŒå¿…è¦ãªæ–¹ã¯æ—©ãå¯¾å‡¦ã™ã¹ãã§ã™ã€‚ ä»¥ä¸‹ã¯full-disclosureã®ãƒ¡ãƒ¼ãƒ«ã§ã™ã€‚ PHPMailer is a w
sugizou 2007/06/22
*php

mail

security
ãƒªãƒ³ã‚¯
PHPã«ã‚ˆã‚‹æ”»æ’ƒã‚³ãƒ¼ãƒ‰ãŒå‡ºç¾--GIFãƒ•ã‚¡ã‚¤ãƒ«ã«éš ã•ã‚Œã‚‹
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ç ”ç©¶è€…ã‚‰ã¯ç±³å›½æ™‚é–“6æœˆ19æ—¥ã€PHPã«ã‚ˆã£ã¦è¨˜è¿°ã•ã‚Œã€GIFãƒ•ã‚¡ã‚¤ãƒ«ã«åŸ‹ã‚è¾¼ã¾ã‚ŒãŸæ”»æ’ƒã‚³ãƒ¼ãƒ‰ã‚’å¤§æ‰‹ã®ç”»åƒãƒ›ã‚¹ãƒ†ã‚£ãƒ³ã‚°ã‚µã‚¤ãƒˆã§ç™ºè¦‹ã—ãŸã€‚SANS Internet Storm Centerã¸ã®æŠ•ç¨¿ã«ã‚ˆã‚‹ã¨ã€ã“ã®æ”»æ’ƒã‚³ãƒ¼ãƒ‰ã¯ãƒ•ã‚¡ã‚¤ãƒ«ã®å…ˆé ã«æ£è¦ã®ç”»åƒã‚’é…ç½®ã™ã‚‹ã“ã¨ã§ç›£è¦–ã®ç›®ã‚’ã™ã‚ŠæŠœã‘ãŸã¨ã„ã†ã€‚ åŒç¤¾ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ–ãƒã‚°ã§ã¯ã€Œã“ã‚Œã¯ã€ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ„ãƒ¼ãƒ«ã‚’è¿‚å›žã—ã€è¦å ±ã‚’é³´ã‚‰ã—ãŸã‚Šæ³¨æ„ã‚’å¼•ã„ãŸã‚Šã™ã‚‹ã“ã¨ãªãæ”»æ’ƒã‚³ãƒ¼ãƒ‰ã‚’ä»–è€…ã«å¼•ãæ¸¡ã™ç‹¡çŒ¾ãªæ–¹æ³•ã ã€ã¨èª¬æ˜Žã•ã‚Œã¦ã„ã‚‹ã€‚ æ‚ªæ„ã®ã‚ã‚‹æ”»æ’ƒè€…ã«ã‚ˆã£ã¦PHPã§è¨˜è¿°ã•ã‚ŒãŸæ”»æ’ƒã‚¹ã‚¯ãƒªãƒ—ãƒˆã¯ç”»åƒãƒ•ã‚¡ã‚¤ãƒ«ã«åŸ‹ã‚è¾¼ã¾ã‚Œã‚‹ã€‚PHPã¯å‹•çš„ãªã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã‚’ä½œæˆã™ã‚‹ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°è¨€èªžã¨ã—ã¦ã‚ˆãç”¨ã„ã‚‰ã‚Œã¦ã„ã‚‹ã€‚ SANS Instituteã®æœ€é«˜èª¿æŸ»è²¬ä»»è€…ï¼ˆChief Research Officerï¼‰ã§ã‚ã‚‹Johannes Ullrichæ°ã¯ã€ã“ã®æ‰‹ã®æ‚ªè³ª
sugizou 2007/06/22
security

*php

*news
ãƒªãƒ³ã‚¯
1