[B! security] akkun_choiã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

Gmail ã‚¢ãƒ‰ãƒ¬ã‚¹å†…ã® ã€Œ.ã€ï¼ˆãƒ”ãƒªã‚ªãƒ‰ï¼‰ ã‚’ç„¡è¦–ã™ã‚‹ä»•æ§˜ãŒãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°ã«æ‚ªç”¨å¯èƒ½ã ã¨ã„ã†æŒ‡æ‘˜

Gmail ã‚¢ãƒ‰ãƒ¬ã‚¹å†…ã® ã€Œ.ã€ï¼ˆãƒ”ãƒªã‚ªãƒ‰ï¼‰ ã‚’ç„¡è¦–ã™ã‚‹ä»•æ§˜ãŒãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°ã«æ‚ªç”¨å¯èƒ½ã ã¨ã„ã†æŒ‡æ‘˜ Gmail ãŒã‚¢ã‚«ã‚¦ãƒ³ãƒˆåã«å«ã¾ã‚Œã‚‹ ã€Œ.ã€ï¼ˆãƒ”ãƒªã‚ªãƒ‰ï¼‰ ã‚’ç„¡è¦–ã™ã‚‹ä»•æ§˜ãŒã€Gmail ã‚¢ãƒ‰ãƒ¬ã‚¹ã‚’ç™»éŒ²ã™ã‚‹ Web ã‚µãƒ¼ãƒ“ã‚¹å´ã®ç‰¹å®šã®ä»•æ§˜ã¨çµ„ã¿åˆã‚ã•ã‚‹ã“ã¨ã«ã‚ˆã£ã¦ãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°ã®ãƒªã‚¹ã‚¯ã‚’å¢—åŠ ã•ã›ã‚‹ã¨ã„ã†æŒ‡æ‘˜ãŒã•ã‚Œã¦ã„ã¾ã—ãŸã®ã§å–ã‚Šä¸Šã’ã¦ã¿ã¾ã™ã€‚ ä»¥å‰ã€ä¸‹è¨˜ã®å‚è€ƒè¨˜äº‹ã§ã‚‚æ›¸ã„ãŸã®ã§ã™ãŒã€å€‹äººå‘ã‘ã® Gmail ã«ã¯ã€æ‰€æœ‰ã—ã¦ã„ã‚‹ã‚¢ã‚«ã‚¦ãƒ³ãƒˆåã« ã€Œ+ã€ ã§ä»»æ„ã®æ–‡å—åˆ—ã‚’ã¤ãªã’ã‚‹ã“ã¨ã§åˆ©ç”¨ã§ãã‚‹ ç–‘ä¼¼ã‚¨ã‚¤ãƒªã‚¢ã‚¹ ï¼ˆä¾¿å®œçš„ã«ã“ã†å‘¼ã³ã¾ã™ï¼‰ æ©Ÿèƒ½ã‚„ã€ã‚¢ã‚«ã‚¦ãƒ³ãƒˆåã«å«ã¾ã‚Œã‚‹ ã€Œ.ã€ï¼ˆãƒ”ãƒªã‚ªãƒ‰ï¼‰ ã‚’ç„¡è¦–ã™ã‚‹ã¨ã„ã†ä»•æ§˜ã‚’ä½¿ã£ã¦ã€åŒæ§˜ã«ç–‘ä¼¼ã‚¨ã‚¤ãƒªã‚¢ã‚¹çš„ãªä½¿ã„æ–¹ãŒã§ãã‚‹ç‚¹ã«è§¦ã‚Œã¾ã—ãŸ ï¼ˆè¨˜äº‹ã¨ã—ã¦ã¯ã€ãã‚Œã¯æœ¬æ¥ã®ã‚¨ã‚¤ãƒªã‚¢ã‚¹ã¨ã¯ç•°ãªã‚‹ã‹ã‚‰æ³¨æ„ã—ã‚ˆã†ã¨ã„ã†å†…å®¹ã§ã™ãŒï¼‰ã€‚ å‚è€ƒ Gmail ã®ã‚¨ã‚¤ãƒªã‚¢ã‚¹ã¯å€‹äººæƒ…å ±æ¼æ´©å¯¾

akkun_choi 2018/04/10

security

ãƒªãƒ³ã‚¯

10 Linux security tools for system administrators | Computer Weekly

akkun_choi 2017/12/07

security

ãƒªãƒ³ã‚¯

Logjam Attack å¯¾ç–ã‚’è¡Œã† : ã‚¢ã‚¸ãƒ£ã‚¤ãƒ«æ ªå¼ä¼šç¤¾

Webã‚µãƒ¼ãƒç¢ºèª The Logjam Attack ã«ã€ Logjam Server Test ã®ãƒªãƒ³ã‚¯ãŒã‚ã‚Šã¾ã™ã€‚ ã“ã“ã§ã‚µãƒ¼ãƒã®è„†å¼±æ€§ãƒ†ã‚¹ãƒˆãŒè¡Œãˆã¾ã™ã€‚ Guide to Deploying Diffie-Hellman for TLS Guide to Deploying Diffie-Hellman for TLS ã® Test A Server æ¬„ã«ãƒã‚§ãƒƒã‚¯ã—ãŸã„ ã‚µãƒ¼ãƒã®URLã‚’å…¥åŠ›ã—ã€[ Go ] ãƒœã‚¿ãƒ³ã‚’ã‚¯ãƒªãƒƒã‚¯ã—ã¾ã™ã€‚ Insecure DHE_EXPORT ãŒ No ã«ãªã£ã¦ã„ãªã„ ( Supported! ã® ) å ´åˆã€Logjam è„†å¼±æ€§ã®å½±éŸ¿ã‚’å—ã‘ã‚‹äº‹ã«ãªã‚Šã¾ã™ã€‚ No ã®å ´åˆã§ã‚‚ã€DHE ãŒ 2048 ãƒ“ãƒƒãƒˆæœªæº€ã®å ´åˆã«ã¯è¦å‘Šè¡¨ç¤ºãŒãªã•ã‚Œã‚‹ã‚ˆã†ã§ã™ã€‚ ã“ã®å ´åˆã€åŒãƒšãƒ¼ã‚¸ä¸‹ã«å¯¾ç– ( å¾Œè¿° ) ãŒè¨˜ã•ã‚Œã‚‹ã®ã§ã€ã‚µãƒ¼ãƒã®è¦ä»¶ç‰ã«å¾“ã£ã¦å¯¾ç–ã‚’è¡Œã†ã‹æ¤œè¨Žã—ã¾ã—ã‚‡ã†ã€‚

akkun_choi 2015/05/22

security

ãƒªãƒ³ã‚¯

Linuxã‚µãƒ¼ãƒã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç– part1

1. 2013/5/13 Kazunori INABA 1 2013.5.10 Garage labsã‚µãƒ¼ãƒãƒ¼éƒ¨8U ï¼ˆæ”¹ï¼‰Linuxã‚µãƒ¼ãƒã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç– ï½žåƒ•ãŒã„ã¤ã‚‚ã‚„ã£ã¦ã„ã‚‹ã“ã¨ part1 ç¨²è‘‰ã€€ä¸€ç´€@æœå¹Œ 2. 2013/5/13 Kazunori INABA 2 è‡ªå·±ç´¹ä»‹ ç¨²è‘‰ã€€ä¸€ç´€ ã‚µãƒ¼ãƒã‚¤ãƒ³ãƒ•ãƒ©å°‚é–€ã®ãƒ•ãƒªãƒ¼ãƒ©ãƒ³ã‚¹ ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ å±‹å·æ±ºã¾ã£ã¦ã„ã¾ã›ã‚“ã€‚ ãŠã‚‚ã«ã‚¢ãƒ—ãƒªé–‹ç™ºä¼æ¥ãƒ»ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢å‘ã‘ã« ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ»å¯ç”¨æ€§ãƒ»æ€§èƒ½ãƒ»æ‹¡å¼µæ€§ã‚’è€ƒæ…®ã—ãŸ ã¡ã‚‡ã£ã¨æ°—ã®åˆ©ã„ãŸ ã‚µãƒ¼ãƒã‚¤ãƒ³ãƒ•ãƒ©æ§‹æˆè¨è¨ˆãƒ»è¨å®šãƒ»æ”¯æ´ã‚„æ—¢å˜ã‚·ã‚¹ãƒ†ãƒ ã®æ€§èƒ½æ”¹å–„èª¿æŸ»ãƒ»æ”¯æ´ ã‚’è¡Œã„ã¾ã™ã€‚ 3. 2013/5/13 Kazunori INABA 3 ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç– - åŸºæœ¬æ–¹é‡ åƒ•ãŒã‚µãƒ¼ãƒã®è¨å®šã‚’è¡Œã†ã¨ãã«ã„ã¤ã‚‚ã‚„ã£ã¦ã„ã‚‹ã“ã¨ã‚’ç™ºè¡¨ã—ã¾ ã™ã€‚ ãƒ»ã§ãã‚‹ã ã‘PaaS, SaaSçš„ãªå¤–éƒ¨ã‚µãƒ¼ãƒ“ã‚¹ã‚„å…±ç”¨ãƒ¬ãƒ³ã‚¿ãƒ« ã‚µãƒ¼ãƒã‚’åˆ©ç”¨ã—ã¦ã€è‡ª

akkun_choi 2015/01/22

security

ãƒªãƒ³ã‚¯

SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³å¯¾ç–ã‚‚ã‚Œã®è²¬ä»»ã‚’é–‹ç™ºä¼šç¤¾ã«å•ã†åˆ¤æ±º

ãƒã‚¤ãƒ³ãƒˆã¯ä¸‹è¨˜ã®é€šã‚Šã§ã™ã€‚ Xç¤¾ï¼ˆåŽŸå‘Šï¼‰ã¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã«ã¤ã„ã¦ç‰¹ã«æŒ‡ç¤ºã¯ã—ã¦ã„ãªã‹ã£ãŸ æå®³è³ å„Ÿã«ã¤ã„ã¦å€‹åˆ¥å¥‘ç´„ã«å®šã‚ã‚‹å¥‘ç´„é‡‘é¡ã®ç¯„å›²å†…ã¨ã™ã‚‹æå®³è³ å„Ÿè²¬ä»»åˆ¶é™ãŒã‚ã£ãŸ å½“åˆã‚·ã‚¹ãƒ†ãƒ ã¯ã‚«ãƒ¼ãƒ‰æ±ºæ¸ˆã‚’å¤–éƒ¨å§”è¨—ã—ç›´æŽ¥ã‚«ãƒ¼ãƒ‰æƒ…å ±ã‚’æ‰±ã£ã¦ã„ãªã‹ã£ãŸ Xç¤¾ãŒã€Œã‚«ãƒ¼ãƒ‰ä¼šç¤¾æ¯Žã®æ±ºæ¸ˆé‡‘é¡ã‚’çŸ¥ã‚ŠãŸã„ã€ã¨Yç¤¾ã«ä¾é ¼ã‚’ã—ã¦ã€ãã®çµæžœã‚«ãƒ¼ãƒ‰æƒ…å ±ã‚’ã„ã£ãŸã‚“DBã«ä¿å˜ã™ã‚‹ä»•æ§˜ã¨ãªã£ãŸï¼ˆ2010å¹´1æœˆ29æ—¥ï¼‰ Xç¤¾ã‹ã‚‰ã®å•ã„åˆã‚ã›ã«å¯¾ã—ã¦Yç¤¾ã¯ã€ã‚«ãƒ¼ãƒ‰æƒ…å ±ã‚’ä¿æŒã—ãªã„æ–¹å¼ã«å¤‰æ›´ã™ã‚‹ã“ã¨ãŒå¯èƒ½ã§ã€ãã®ã»ã†ãŒå®‰å…¨ã¨ãªã‚Šã€è²»ç”¨ã¯20ä¸‡å††ç¨‹åº¦ã§ã‚ã‚‹æ—¨ã‚’ä¼ãˆãŸï¼ˆ2010å¹´9æœˆ27æ—¥ï¼‰ãŒã€ãã®å¾ŒXç¤¾ã¯æ”¹è‰¯ã®æŒ‡ç¤ºã‚’ã—ãªã‹ã£ãŸ ä»¥ä¸‹ã®è„†å¼±æ€§ãã®ä»–ãŒèªã‚ã‚‰ã‚ŒãŸ ã‚·ã‚¹ãƒ†ãƒ ç®¡ç†æ©Ÿèƒ½ã®IDã¨ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãŒ admin/password ã§ã‚ã£ãŸ å€‹äººæƒ…å ±ãŒè¨˜è¼‰ã•ã‚ŒãŸãŠå•ã„åˆã‚ã›ãƒã‚°ãƒ•ã‚¡ã‚¤ãƒ«ã®é–²è¦§ãŒå¯èƒ½ï¼ˆãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªãƒªã‚¹ãƒ†ã‚£ãƒ³ã‚°ã¨æ„å›³ã—ãªã„ãƒ•ã‚¡ã‚¤

akkun_choi 2015/01/22

ãƒªãƒ³ã‚¯

è‡ªå •è½ãªæŠ€è¡“è€…ã®æ—¥è¨˜ : æ§˜ã€…ãªã‚µãƒ¼ãƒãƒ¼ã®POODLE SSLv3è„†å¼±æ€§(CVE-2014-3566)å¯¾ç–ã®ã¾ã¨ã‚(æ›´æ–°3) - livedoor Blogï¼ˆãƒ–ãƒã‚°ï¼‰

åŸºæœ¬ã¯å–°ã£ã¦ã‚‹ã‹é£²ã‚“ã§ã‚‹ã‹ã§ã™ãŒã€ã‚ˆãè¶£å‘³ã§ã‚«ãƒ©ã‚ªã‚±ãƒ»PKIãƒ»ç½²åãƒ»èªè¨¼ãƒ»ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°ãƒ»æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚’ã‚„ã£ã¦ã„ã¾ã™ã€‚æ—…å¥½ãã€‚ãƒ†ãƒ¬ãƒ“å¥½ãã§èŠ¸èƒ½é€š ã‚‚ãã˜ 1. ã¯ã˜ã‚ã« 2. SSLv3ã‚’ç„¡åŠ¹åŒ–ã§ãã‚‹å ´åˆã®ã‚µãƒ¼ãƒãƒ¼å¯¾ç– 2.1. Apache HTTPD Server + mod_ssl 2.2. Apache HTTPD Server + mod_nss 2.3. nginx 2.4. lighttpd 2.5. Microsoft IIS 2.6. (è¨‚æ£)Apache Tomcat (Java JSSE) 2.7. Node.js 2.8. IBM HTTP Server 2.9. Amazon Web Services 2.10. ãã®ä»–ã®ã‚µãƒ¼ãƒãƒ¼ 2.11. SSLv3 ã‚’ç„¡åŠ¹åŒ–ã™ã‚‹ãƒªã‚¹ã‚¯ 2.12. OpenLDAP 3. è«¸èˆ¬ã®äº‹æƒ…ã§ SSLv3 ã‚’æœ‰åŠ¹ã«ã›ã–ã‚‹ã‚’å¾—ãªã„å ´

akkun_choi 2014/10/18

security

ãƒªãƒ³ã‚¯

BASHã®è„†å¼±æ€§ã§CGIã‚¹ã‚¯ãƒªãƒ—ãƒˆã«ã‚¢ãƒ¬ã•ã›ã¦ã¿ã¾ã—ãŸ

ç’°å¢ƒå¤‰æ•°ã«ä»•è¾¼ã¾ã‚ŒãŸã‚³ãƒ¼ãƒ‰ã‚’å®Ÿè¡Œã—ã¦ã—ã¾ã†BASHã®è„†å¼±æ€§ãŒ CGIã‚¹ã‚¯ãƒªãƒ—ãƒˆã«å½±éŸ¿ã‚’ä¸Žãˆã‚‹ã‹è©¦ã—ã¦ã¿ãŸã‚‰çµæžœã¯æ‚²æƒ¨ãªæ„Ÿã˜ã« Tweet 2014å¹´9æœˆ25æ—¥ å¶‹ç”°å¤§è²´ ã“ã®è¨˜äº‹ã¯2014å¹´ã®ã‚‚ã®ã§ã™ æœã‹ã‚‰ Bash specially-crafted environment variables code injection attack ãªã‚‹ã‚‚ã®ã§é¨’ãŽã«ãªã£ã¦ã„ãŸã®ã§ã€ã•ã£ããæ‰‹å…ƒã® Apacheã§è©¦ã—ã¦ã¿ã¾ã—ãŸã€‚ /hoge.cgiã¨ã„ã†URIã§å®Ÿè¡Œã•ã‚Œã‚‹ã‚ˆã†ã«ã€ä¸€è¡Œã®ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã‚’å‡ºåŠ›ã™ã‚‹ã ã‘ã® CGIã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’è¨ç½®ã—ã¾ã™ã€‚ã„ã£ã‘ã‚“ã€ãªã‚“ã®å…¥åŠ›ã‚‚ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆå´ã‹ã‚‰å—ã‘ä»˜ã‘ã¦ã„ãªã„ãŸã‚å±é™ºã®ã‚ã‚Šã‚ˆã†ã‚‚ãªãè¦‹ãˆã¾ã™ã€‚ #!/bin/sh echo "Content-type: text/plain" echo echo "Hi! I'm an ordinary CGI script w

akkun_choi 2014/09/25

security

ãƒªãƒ³ã‚¯

Cybersecurity as a Service Delivered | Sophos

akkun_choi 2014/09/20

security

ãƒªãƒ³ã‚¯

èªè¨¼å±€ã‚’ç«‹ã¦ã¦ã¼ã‚ã‚‚ã†ã‘ã—ãŸã„ã‚“ã§ã™ãŒï¼žç„¡ç†ãªç†ç”±ã‚’ç†è§£ã—ã‚ˆã† - Qiita

SSLã®èªè¨¼å±€ã¨ã‹è¨¼æ˜Žæ›¸ã¨ã‹å‹‰å¼·ã—å§‹ã‚ã¯ãƒ›ãƒ³ãƒˆé›£ã„ã‚ˆã ã“ã®ã¸ã‚“ã®SSL/TLSã®ä»•çµ„ã¿ã£ã¦å‹‰å¼·ã—å§‹ã‚ã®é ƒã¯å‡„ãé›£ã—ãæ„Ÿã˜ã‚‹ã®ã‚ˆãã€‚åˆ†ã‹ã‚Šã‚„ã™ãè§£èª¬ã—ã¦ãã‚Œã¦ã‚‹ã‚µã‚¤ãƒˆã£ã¦ã‚ã‚“ã¾è¦‹ãŸã“ã¨ç„¡ã„ã—ã€‚ ã‚“ã§ã€ >>300,304 ã¿ãŸã„ãªã“ã¨ã¯åƒ•ã‚‚æ˜”è€ƒãˆãŸã“ã¨ã‚ã£ãŸã‚ãƒ¼ã€ã¨æ‡ã‹ã—ã¿ã‚’è¦šãˆãŸã®ã§ãƒ¬ã‚¹ã£ã¦ã¿ãŸã€‚ è¨¼æ˜Žæ›¸ã‚’ç™ºè¡Œã§ãã‚‹ã‹ã©ã†ã‹ã¯è¨¼æ˜Žæ›¸ã®ãƒ•ãƒ©ã‚°ã§æ±ºã¾ã£ã¦ã„ã‚‹ã€ã¨ã„ã† >>303 ã®æŒ‡æ‘˜ã‚‚é‡è¦ã‚ˆãã€‚ ä»¥ä¸‹2chã‚¹ãƒ¬ã‚ˆã‚Šå¼•ç”¨ ä¸å¯§éŽãŽã‚‹ã¨è©•åˆ¤ã®ãƒ¬ã‚¹ã‚’ã—ã¦ã‚‹ID:UyEJo1f2ãŒåƒ•ãªã‚ã‘ã ãŒï½—ã€€2chã ã¨ãã®ã†ã¡å€‰åº«ã«è¡Œã£ã¡ã‚ƒã†ã‹ã‚‚ã—ã‚Œãªã„ã®ã§ã“ã“ã«ãƒ¡ãƒ¢ã€‚ ã€èªè¨¼å±€ã€‘SSLã«é–¢ã™ã‚‹ã‚¹ãƒ¬ 2æžšç›®ã€ã¼ã‚å„²ã‘ã€‘ http://hayabusa6.2ch.net/test/read.cgi/mysv/1286532904/298-309 298 ï¼šDNSæœªç™»éŒ²ã•ã‚“ï¼š2013/05/31(é‡‘) 13:31

akkun_choi 2014/08/07

security

ãƒªãƒ³ã‚¯

äº¬éƒ½éŠ€è¡Œã‚’è£…ã†å½ã‚µã‚¤ãƒˆã€ãƒ¤ãƒ•ãƒ¼ã®æ¤œç´¢é€£å‹•åž‹åºƒå‘Šã«è¡¨ç¤ºã•ã‚Œã‚‹ ::SEM R (#SEMR)

äº¬éƒ½éŠ€è¡Œã‚’è£…ã†å½ã‚µã‚¤ãƒˆã€ãƒ¤ãƒ•ãƒ¼ã®æ¤œç´¢é€£å‹•åž‹åºƒå‘Šã«è¡¨ç¤ºã•ã‚Œã‚‹ äº¬éƒ½éŠ€è¡Œã®ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆãƒãƒ³ã‚ãƒ³ã‚°ã‚’è£…ã£ãŸå½ã‚µã‚¤ãƒˆã®åºƒå‘ŠãŒã€ãƒ¤ãƒ•ãƒ¼ã®æ¤œç´¢ã‚µã‚¤ãƒˆã«è¡¨ç¤ºã•ã‚Œã¦ã„ãŸã€‚æ—¢ã«æŽ²è¼‰ã‚’æ¢ã‚ãŸãŒéŠ€è¡Œã®ä¸€éƒ¨é¡§å®¢ã‹ã‚‰ä¸æ£ã«é€é‡‘ã•ã‚Œã‚‹è¢«å®³ãŒç™ºç”Ÿã€‚ãƒ¤ãƒ•ãƒ¼ã¯ä»Šå¾Œã€å†ç™ºé˜²æ¢ã«å‘ã‘ã¦å¯©æŸ»ã‚’å¼·åŒ–ã—ã¦ã„ãã¨è¡¨æ˜Žã€‚ å…¬é–‹æ—¥æ™‚ï¼š2014å¹´02æœˆ24æ—¥ 15:32 äº¬éƒ½éŠ€è¡Œã®ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆãƒãƒ³ã‚ãƒ³ã‚°ã‚µãƒ¼ãƒ“ã‚¹ã‚’è£…ã£ãŸãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°ã‚µã‚¤ãƒˆãŒã€å›½å†…å¤§æ‰‹æ¤œç´¢ã‚µã‚¤ãƒˆãƒ»ãƒ¤ãƒ•ãƒ¼ã®æ¤œç´¢é€£å‹•åž‹åºƒå‘Šã¨ã—ã¦è¡¨ç¤ºã•ã‚Œã¦ã„ãŸã“ã¨ãŒæ˜Žã‚‰ã‹ã¨ãªã£ãŸã€‚ ãƒ¤ãƒ•ãƒ¼ã«ã‚ˆã‚‹ã¨ã€å•é¡Œã®åºƒå‘ŠãŒæŽ²è¼‰ã•ã‚ŒãŸå¯èƒ½æ€§ãŒã‚ã‚‹ã®ã¯2014å¹´2æœˆ11æ—¥ã‹ã‚‰2æœˆ18æ—¥ã¾ã§ã€‚ä½•è€…ã‹ãŒå½ã‚µã‚¤ãƒˆã‚’ä½œæˆã—ã¦ãƒ¤ãƒ•ãƒ¼ã«åºƒå‘ŠæŽ²è¼‰ã‚’ç”³ã—è¾¼ã‚“ã ã“ã¨ã§ã€é–¢é€£ã™ã‚‹ã‚ãƒ¼ãƒ¯ãƒ¼ãƒ‰ã§æ¤œç´¢ã—ãŸæ™‚ã«æ¤œç´¢çµæžœã«å•é¡Œã®ã‚µã‚¤ãƒˆã¸èª˜å°Žã™ã‚‹åºƒå‘ŠãŒè¡¨ç¤ºã•ã‚Œã‚‹ã‚ˆã†ã«ãªã£ã¦ã„ãŸã€‚äº¬éƒ½éŠ€è¡Œã‹ã‚‰ã®é€šå ±ã‚’å—ã‘ã¦æ—¢ã«é…ä¿¡ã‚’åœæ¢æ¸ˆã¿ã€‚åŒç¤¾ã¯ã€Œä»Šå›žã®äº‹æ…‹

akkun_choi 2014/02/25

security

ãƒªãƒ³ã‚¯

æ¨™æº–ã¨åŸºæœ¬æ¦‚å¿µã‹ã‚‰å¦ã¶æ£ã—ã„ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®åŸºç¤ŽçŸ¥è˜

(Last Updated On: 2018å¹´11æœˆ6æ—¥)ä»Šå›žã¯ä¸€éƒ¨ã®æŠ€è¡“è€…ãŒå‹˜é•ã„ã—ã¦ã„ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æ¦‚å¿µã®è©±ã§ã™ã€‚æŠ€è¡“è€…ã¨ã¯Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢æŠ€è¡“è€…ã‚’æŒ‡ã—ã¦ã„ã¾ã™ãŒã€ä»–ã®åˆ†é‡Žã®æŠ€è¡“è€…ã«ã‚‚åŒã˜å‹˜é•ã„ãŒå¤šã„ã‹ã‚‚çŸ¥ã‚Œã¾ã›ã‚“ã€‚å¸¸è˜ã§ã‚ã‚‹ã¹ãçŸ¥è˜ãŒå¸¸è˜ã§ãªã„ã®ãŒç¾çŠ¶ã®ã‚ˆã†ã§ã™ã€‚å…¨ã¦ã®æŠ€è¡“è€…ãŒçŸ¥ã£ã¦ãŠãã¹ãã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®åŸºç¤ŽçŸ¥è˜ã§ã™ã€‚ æ®‹å¿µãªãŒã‚‰ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã®å®šç¾©ã©ã“ã‚ã‹ã€ãƒ—ãƒã‚°ãƒ©ãƒ ã®æ§‹é€ ãƒ»å‹•ä½œåŽŸç†ã‚‚æ£ã—ãç†è§£ã•ã‚Œã¦ã„ãªã„ã¨è¨€ãˆã‚‹çŠ¶æ…‹ã§ã™ã€‚ ã‚»ã‚ãƒ¥ã‚¢ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã®æ§‹é€ ï¼åŽŸç†ï¼åŽŸå‰‡ ã‚¼ãƒãƒˆãƒ©ã‚¹ãƒˆã¨ãƒ•ã‚§ã‚¤ãƒ«ãƒ•ã‚¡ãƒ¼ã‚¹ãƒˆ ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢é–‹ç™ºã«ã¯è†¨å¤§ãªçŸ¥è˜ãŒå¿…è¦ã§ã™ã€‚ç›®çš„ï¼ˆã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã‚’ä½œã‚‹ã“ã¨ï¼‰ä»¥å¤–ã®çŸ¥è˜ã‚’å–ã‚Šå…¥ã‚Œã‚‹æ©Ÿä¼šã‚„ä½™è£•ãŒç„¡ã‹ã£ãŸæ–¹ã‚‚å¤šã„ã¨æ€ã„ã¾ã™ã€‚ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£åŸºç¤ŽçŸ¥è˜ã‚’çŸ¥ã‚‰ãªã‹ã£ãŸæ–¹ã€å®‰å¿ƒã—ã¦ãã ã•ã„ï¼åŸºæœ¬ã¯ç°¡å˜ã§ã™ã€‚ä¸€åº¦çŸ¥ã£ã¦ã—ã¾ãˆã°å¿˜ã‚Œã‚‹ã‚ˆã†ãªé›£ã—ã„äº‹ã§ã¯ã‚ã‚Šã¾ã›ã‚“ã€‚å‹˜é•ã„

akkun_choi 2014/02/24

ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã¨ã€ãƒ“ã‚¸ãƒã‚¹ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã¯è¨€è‘‰ã®å®šç¾©ãŒé•ã†ã¿ãŸã„ï¼ˆã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®æ–¹ãŒç‹ã„ï¼‰

security

ãƒªãƒ³ã‚¯

å˜ãªã‚‹ OAuth 2.0 ã‚’èªè¨¼ã«ä½¿ã†ã¨ã€è»ŠãŒé€šã‚Œã‚‹ã»ã©ã®ã©ã§ã‹ã„ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ¼ãƒ»ãƒ›ãƒ¼ãƒ«ãŒã§ãã‚‹

In some of the feedback I have gotten on the openID Connect spec, the statement is made that Connect is too complicated. That OAuth 2.0 is all you need to do authentication. Many point to Identity Proâ€¦ è‹±èªžèªã¿ãŸããªã„ã¨ã„ã†äººã®ãŸã‚ã«ç°¡å˜ã«è§£èª¬ã™ã‚‹ã¨â€¦ OAuth 2.0 ã® implicit flow ã‚’ä½¿ã£ã¦ã€Œèªè¨¼ã€ã‚’ã—ã‚ˆã†ã¨ã™ã‚‹ã¨ã€ã¨ã£ã¦ã‚‚å¤§ããªç©´ãŒé–‹ãã¾ã™ã€‚ ã‚«ãƒƒãƒˆï¼†ãƒšãƒ¼ã‚¹ãƒˆã‚¢ã‚¿ãƒƒã‚¯ãŒå¯èƒ½ã ã‹ã‚‰ã§ã™ã€‚ OAuth èªè¨¼ï¼Ÿã¯ã€å›³ï¼‘ã®ã‚ˆã†ãªæµã‚Œã«ãªã‚Šã¾ã™ã€‚ å›³ï¼‘ OAuth èªè¨¼ï¼Ÿã®æµã‚Œ ä¸€è¦‹ã€å•é¡Œãªã•ãã†ã«è¦‹ãˆã¾ã™ã€‚ã—ã‹ã—ã€ãã‚Œã¯ã™ã¹ã¦ã®ã‚µã‚¤ãƒˆãŒã€Œè‰¯ã„ã‚µã‚¤ãƒˆã€ãªã‚‰ã°ã§ã™ã€‚ Site_A

akkun_choi 2013/12/29

security

ãƒªãƒ³ã‚¯

ã€æµ·å¤–ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã€‘ç¬¬87å›žï¼šæž¶ç©ºã®æ–°äººã€Œå¥³æ€§ã€è·å“¡ã‚’ä½¿ã£ãŸä¾µå…¥ãƒ†ã‚¹ãƒˆã€æˆåŠŸçŽ‡100ï¼…ã€€ã»ã‹ã€€

akkun_choi 2013/12/06

security

ãƒªãƒ³ã‚¯

3åˆ†ã§åˆ†ã‹ã‚‹AngularJSã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ - teppeis blog

å…ˆæ—¥ã®ng-mtg#4 AngularJS å‹‰å¼·ä¼šã§LTã—ã‚ˆã†ã¨æ€ã£ãŸã‘ã©ç”³ã—è¾¼ã¿ãŒé–“ã«åˆã‚ãªã‹ã£ãŸã®ã§ãƒ–ãƒã‚°ã«æ›¸ãã¾ã™ã€‚ å…ˆæœˆãƒªãƒªãƒ¼ã‚¹ã•ã‚ŒãŸAngularJS 1.2ã¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãŒã‚“ã°ã£ã¦ã‚‹çš„ãªã“ã¨ã‚’èžã„ãŸã®ã§ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å‘¨ã‚Šã®ä»•çµ„ã¿ã‚’èª¿ã¹ã¦ã¿ã¾ã—ãŸã€‚ ãŠé¡Œã¯ä»¥ä¸‹ã§ã™ã€‚ CSRF JSON CSP (Content Security Policy) Escaping CSRF ãƒ¦ãƒ‹ãƒ¼ã‚¯ãªãƒˆãƒ¼ã‚¯ãƒ³ã‚’HTTPãƒªã‚¯ã‚¨ã‚¹ãƒˆã«è¼‰ã›ã¦ã‚µãƒ¼ãƒãƒ¼ã§ãƒã‚§ãƒƒã‚¯ã™ã‚‹å¯¾å¿œãŒä¸–ã®ä¸ã§ã¯ä¸»æµï¼ˆæœ€è¿‘ã¯ã‚«ã‚¹ã‚¿ãƒ ãƒ˜ãƒƒãƒ€ã®ãƒã‚§ãƒƒã‚¯ã«ã‚ˆã‚‹å¯¾ç–ã‚‚ï¼‰ AngularJSã§ã¯ã€XSRF-TOKEN Cookieã«ãƒˆãƒ¼ã‚¯ãƒ³ãŒè¼‰ã£ã¦ã„ã‚‹ã¨ã€$httpã‚’ä½¿ã£ãŸHTTPãƒªã‚¯ã‚¨ã‚¹ãƒˆã®ãƒ˜ãƒƒãƒ€ã«è‡ªå‹•çš„ã«X-XSRF-TOKENãƒ˜ãƒƒãƒ€ãƒ¼ãŒä»˜ãã€‚ XSRF-TOKEN Cookieã¯ã‚‚ã¡ã‚ã‚“Not HttpOnlyã§ã€‚ Angularç•Œã§ã¯CS

akkun_choi 2013/12/06

security

ãƒªãƒ³ã‚¯

IPAï¼ˆç‹¬ç«‹è¡Œæ”¿æ³•äººæƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹ã€ç†äº‹é•·ï¼šè—¤æ±Ÿ ä¸€æ£ï¼‰ã¯ã€IPAã«å±Šã‘å‡ºã‚‰ã‚Œã‚‹ã€ŒDOM Based XSSã€ã®è„†å¼±æ€§ã«é–¢ã™ã‚‹å±Šå‡ºãŒ2012å¹´å¾ŒåŠã‹ã‚‰å¢—åŠ ã—ã¦ã„ã‚‹ã“ã¨ã‚’è¸ã¾ãˆã€ãã‚Œã‚‰ã®æƒ…å ±ã‚’åˆ†æžã—ã¦å½“è©²è„†å¼±æ€§ã®æ¦‚è¦ã‚„å¯¾ç–ã®ãƒã‚¤ãƒ³ãƒˆã‚’ã¾ã¨ã‚ãŸæŠ€è¡“ãƒ¬ãƒãƒ¼ãƒˆï¼ˆIPAãƒ†ã‚¯ãƒ‹ã‚«ãƒ«ã‚¦ã‚©ãƒƒãƒ ç¬¬13å›žï¼‰ã‚’å…¬é–‹ã—ã¾ã—ãŸã€‚ IPAã«å¤šãã®å±Šå‡ºãŒã‚ã‚‹ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼ˆXSSï¼‰ã®è„†å¼±æ€§ã§ã™ãŒã€2012å¹´ç¬¬1å››åŠæœŸã‹ã‚‰ç¬¬3å››åŠæœŸã®æœŸé–“ã§ã¯åˆè¨ˆ38ä»¶ã ã£ãŸã€ŒDOM Based XSSã€ã¨å‘¼ã°ã‚Œã‚‹ã‚¿ã‚¤ãƒ—ã®ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã®è„†å¼±æ€§ã®å±Šå‡ºãŒã€ç¬¬4å››åŠæœŸã ã‘ã§92ä»¶ï¼ˆç¬¬3å››åŠæœŸã¾ã§ã®ä»¶æ•°æ¯”ç´„2.4å€å¢—ï¼‰ã¨æ€¥å¢—ã—ã¾ã—ãŸã€‚ ä¸€èˆ¬ã«ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã¯ã€ã‚µãƒ¼ãƒå´ã®ãƒ—ãƒã‚°ãƒ©ãƒ ã«ä½œã‚Šè¾¼ã¾ã‚Œã¦ã—ã¾ã†è„†å¼±æ€§ã§ã™ãŒã€ã€ŒDOM Based XSSã€ã¨å‘¼ã°ã‚Œã‚‹ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã®è„†å¼±æ€§ã¯ã€

akkun_choi 2013/09/18

security

ãƒªãƒ³ã‚¯

Apache HTTPD: `Options -FollowSymLinks` ã¯ä¸å®Œå…¨ - ãƒ€ãƒ¡å‡ºã— Blog

ã‚·ãƒ³ãƒœãƒªãƒƒã‚¯ãƒªãƒ³ã‚¯æ”»æ’ƒã‚’é˜²ããŸã‚ã® Apache HTTPD ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã®è§£èª¬ã¯ã“ã¡ã‚‰: Apache HTTPD: mod_allowfileowner https://fumiyas.github.io/apache/mod-allowfileowner.html èƒŒæ™¯ ãƒãƒªãƒãƒƒãƒ—ã®å…±æœ‰ Web ã‚µãƒ¼ãƒ“ã‚¹ä¸‹ã®ã‚µã‚¤ãƒˆæ”¹ã–ã‚“äº‹ä»¶ã§ã€ æ”»æ’ƒæ‰‹æ³•ã®ä¸€ã¤ã¨ã—ã¦ ã€Œä»–ãƒ¦ãƒ¼ã‚¶ãƒ¼æ‰€æœ‰ã®ãƒ•ã‚¡ã‚¤ãƒ«ã¸ã®ã‚·ãƒ³ãƒœãƒªãƒƒã‚¯ãƒªãƒ³ã‚¯ã‚’è‡ªåˆ†ã®ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªä¸‹ã«ä½œã‚Šã€Apache HTTPD çµŒç”±ã§ã‚¢ã‚¯ã‚»ã‚¹ã™ã‚‹ã€æ‰‹é †ãŒåˆ©ç”¨ã•ã‚ŒãŸã‚‰ã—ã„ã€‚ å‚è€ƒ: http://blog.tokumaru.org/2013/09/symlink-attack.html å½“ç¤¾ã‚µãƒ¼ãƒ“ã‚¹ã€Œãƒãƒªãƒãƒƒãƒ—ï¼ãƒ¬ãƒ³ã‚¿ãƒ«ã‚µãƒ¼ãƒãƒ¼ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‚µã‚¤ãƒˆã¸ã®ç¬¬ä¸‰è€…ã«ã‚ˆã‚‹å¤§è¦æ¨¡æ”»æ’ƒã«ã¤ã„ã¦ http://lolipop.jp/info/news/4149/#090

akkun_choi 2013/09/03

security

ãƒªãƒ³ã‚¯

ãƒãƒªãƒãƒƒãƒ—ã®ã‚µã‚¤ãƒˆæ”¹ã–ã‚“äº‹ä»¶ã«å¦ã¶ã‚·ãƒ³ãƒœãƒªãƒƒã‚¯ãƒªãƒ³ã‚¯æ”»æ’ƒã®è„…å¨ã¨å¯¾ç–

æ—¢ã«å ±é“ã•ã‚Œã¦ã„ã‚‹ã‚ˆã†ã«ã€ãƒãƒªãƒãƒƒãƒ—ï¼ãƒ¬ãƒ³ã‚¿ãƒ«ã‚µãƒ¼ãƒãƒ¼ã«å¯¾ã™ã‚‹æ”¹ã–ã‚“æ”»æ’ƒã«ã‚ˆã‚Šã€è¢«å®³ã‚’å—ã‘ãŸãƒ¦ãƒ¼ã‚¶ãƒ¼æ•°ã¯8428ä»¶ã«ã®ã¼ã‚‹ã¨ã„ã†ã“ã¨ã§ã™ã€‚ã“ã“ã¾ã§å½±éŸ¿ãŒå¤§ãããªã£ãŸåŽŸå› ã¯ã€å ±é“ã«ã‚ˆã‚‹ã¨ã€(1)ã€ŒWordPressã®ãƒ—ãƒ©ã‚°ã‚¤ãƒ³ã‚„ãƒ†ãƒ¼ãƒžã®è„†å¼±æ€§ã‚’åˆ©ç”¨ã€ã—ã€ä¸æ£ãªãƒ•ã‚¡ã‚¤ãƒ«ãŒã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰ã•ã‚ŒãŸã€(2)ãƒ‘ãƒ¼ãƒŸãƒƒã‚·ãƒ§ãƒ³è¨å®šã®ä¸å‚™ã‚’æ‚ªç”¨ã•ã‚Œã¦è¢«å®³ãŒæ‹¡å¤§ã—ãŸã€ã¨ã„ã†ã“ã¨ã®ã‚ˆã†ã§ã™ã€‚ 29æ—¥å¤œã®æ™‚ç‚¹ã§ã¯ã€æ”»æ’ƒè€…ã®æ”¹ã–ã‚“æ‰‹æ³•ã«ã¤ã„ã¦ã€ŒWordPressã®ãƒ—ãƒ©ã‚°ã‚¤ãƒ³ã‚„ãƒ†ãƒ¼ãƒžã®è„†å¼±æ€§ã‚’åˆ©ç”¨ã€ã—ã€ä¸æ£ãªãƒ•ã‚¡ã‚¤ãƒ«ãŒã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰ã•ã‚Œã¦ã€Œwp-config.phpã®ã€ã®è¨å®šæƒ…å ±ãŒæŠœãå‡ºã•ã‚ŒãŸã¨èª¬æ˜Žã—ã¦ã„ãŸãŒã€30æ—¥åˆå¾Œ7æ™‚éŽãŽã®èª¬æ˜Žã§ã€ã“ã®è„†å¼±æ€§ãŒä¾µå…¥çµŒè·¯ã¨ãªã£ã¦åŒç¤¾ã®ãƒ‘ãƒ¼ãƒŸãƒƒã‚·ãƒ§ãƒ³è¨å®šã®ä¸å‚™ã‚’æ‚ªç”¨ã•ã‚ŒãŸã“ã¨ãŒåŽŸå› ã ã£ãŸã“ã¨ã‚’æ˜Žã‚‰ã‹ã«ã—ãŸã€‚ ã€Œãƒãƒªãƒãƒƒãƒ—ã€ã®WordPressã‚µã‚¤ãƒˆæ”¹ã–ã‚“è¢«å®³ã€åŽŸå› ã¯ãƒ‘ãƒ¼ãƒŸãƒƒã‚·ãƒ§ãƒ³è¨å®šä¸å‚™

akkun_choi 2013/09/03

security

ãƒªãƒ³ã‚¯

ç”°ä¸é‚¦è£•ï¼ ã•ãã‚‰ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆç¤¾é•·ðŸˆâ€â¬›ðŸ• on Twitter: "å…±ç”¨ã‚µãƒ¼ãƒã®ä»–äººã®è¦—ããŸã„ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªã«ln -sã—ã¦ã€htaccessã®Optionsã§+FollowSymLinksã—ã€ApacheçµŒç”±ã§ãƒ–ãƒ©ã‚¦ã‚¶ã‹ã‚‰ã‚¢ã‚¯ã‚»ã‚¹ã™ã‚‹ã¨ã€ä»–äººã®ãƒ•ã‚¡ã‚¤ãƒ«ãŒè¦‹ã‚Œã¦ã—ã¾ã„ã¾ã™ã€‚ãã—ã¦MySQLã«ã‚¢ã‚¯ã‚»ã‚¹ã™ã‚Œã°â€¦ã¨ã„ã†ã‚‚ã®ã§ã™ã€‚è©³ã—ãã¯æ›¸ãã¾ã›ã‚“ã€‚"

å…±ç”¨ã‚µãƒ¼ãƒã®ä»–äººã®è¦—ããŸã„ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªã«ln -sã—ã¦ã€htaccessã®Optionsã§+FollowSymLinksã—ã€ApacheçµŒç”±ã§ãƒ–ãƒ©ã‚¦ã‚¶ã‹ã‚‰ã‚¢ã‚¯ã‚»ã‚¹ã™ã‚‹ã¨ã€ä»–äººã®ãƒ•ã‚¡ã‚¤ãƒ«ãŒè¦‹ã‚Œã¦ã—ã¾ã„ã¾ã™ã€‚ãã—ã¦MySQLã«ã‚¢ã‚¯ã‚»ã‚¹ã™ã‚Œã°â€¦ã¨ã„ã†ã‚‚ã®ã§ã™ã€‚è©³ã—ãã¯æ›¸ãã¾ã›ã‚“ã€‚

akkun_choi 2013/08/31

security

ãƒªãƒ³ã‚¯

é€ä¿¡ãƒ‰ãƒ¡ã‚¤ãƒ³èªè¨¼ã«ã¤ã„ã¦

é€ä¿¡ãƒ‰ãƒ¡ã‚¤ãƒ³èªè¨¼ã¨ã¯ï¼Ÿ é€ä¿¡ãƒ‰ãƒ¡ã‚¤ãƒ³èªè¨¼ã¨ã¯ã€é€ä¿¡è€…ã®ã‚¢ãƒ‰ãƒ¬ã‚¹ãŒæ£è¦ãªã‚‚ã®ã§ã‚ã‚‹ã“ã¨ã‚’è¨¼æ˜Žã™ã‚‹æŠ€è¡“ã§ã™ã€‚æ£ç¢ºã«è¨€ã†ã¨ã€ãã®ãƒ¡ãƒ¼ãƒ«ã‚¢ãƒ‰ãƒ¬ã‚¹ã®ãƒ‰ãƒ¡ã‚¤ãƒ³ã‚’è¦‹ã¦ã€ãã‚ŒãŒãŒæ£è¦ãªã‚µãƒ¼ãƒãƒ¼ã‹ã‚‰ç™ºä¿¡ã•ã‚Œã¦ã„ã‚‹ã‹å¦ã‹ã‚’æ¤œè¨¼ã—ã¾ã™ã€‚ã“ã‚Œã¯å¤šãã®ã‚¹ãƒ‘ãƒ ãŒé€ä¿¡è€…ã‚’å½ã£ã¦é€ã‚Šã¤ã‘ã‚‰ã‚Œã‚‹ãŸã‚ã€ã“ã†ã—ãŸã€Œãªã‚Šã™ã¾ã—ã€ã‚’æŽ’é™¤ã™ã‚Œã°ã‚¹ãƒ‘ãƒ ãŒæ¸›ã‚‹ã¨ã„ã†è€ƒãˆã«åŸºã¥ã„ã¦é–‹ç™ºã•ã‚ŒãŸæŠ€è¡“ã§ã™ã€‚ä»Šå¾Œã€ã‚¹ãƒ‘ãƒ ã®æ ¹æœ¬çš„ãªè§£æ±ºã®ãŸã‚ã«ã€ã“ã®æŠ€è¡“ãŒæ™®åŠã™ã‚‹ã“ã¨ãŒæœŸå¾…ã•ã‚Œã¦ãŠã‚Šã€ã“ã“ã§ã¯ãã®æ¦‚è¦ã‚’èª¬æ˜Žã—ã¾ã™ã€‚ ã‚¹ãƒ‘ãƒ ã¯ã€Œãªã‚Šã™ã¾ã—ã€ã°ã‹ã‚Š ã¾ãšã€é€ä¿¡ãƒ‰ãƒ¡ã‚¤ãƒ³æŠ€è¡“ã®é‡è¦æ€§ã‚’ç†è§£ã™ã‚‹ãŸã‚ã«ã€ã„ã‹ã«ã€Œãªã‚Šã™ã¾ã—ã€ãŒç°¡å˜ã‹ã‚’ç†è§£ã™ã‚‹ã“ã¨ãŒå¿…è¦ã§ã™ã€‚ãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°è©æ¬ºã‚„è¿·æƒ‘ãƒ¡ãƒ¼ãƒ«ã®ã»ã¨ã‚“ã©ã¯ã€Œãªã‚Šã™ã¾ã—ã€ã«ã‚ˆã£ã¦é€ã‚‰ã‚Œã¦ã„ã¾ã™ã€‚ç¾åœ¨ã®ãƒ¡ãƒ¼ãƒ«é€ä¿¡æŠ€è¡“ã§ã¯ã€é€ä¿¡å…ƒã¨ã•ã‚Œã‚‹From:ã‚¢ãƒ‰ãƒ¬ã‚¹ã‚’ç°¡å˜ã«è©ç§°ã™ã‚‹ã“ã¨ãŒã§ãã‚‹ã‹ã‚‰ã§ã™ã€‚è©¦ã—ã«ã€è‡ªåˆ†ã®ãƒ¡ãƒ¼ãƒ«ã‚½ãƒ•ãƒˆã®è‡ªã‚¢

akkun_choi 2013/08/28

security

ãƒªãƒ³ã‚¯

XSSå†å…¥é–€

4. å…¸åž‹çš„ãªXSSã‚µãƒ³ãƒ—ãƒ«ã«å¯¾ã™ã‚‹ã€Œç´ æœ´ãªç–‘å•ã€ â€¢ ã‚¯ãƒƒã‚ãƒ¼ã®å€¤ãŒã‚¢ãƒ©ãƒ¼ãƒˆã§è¡¨ç¤ºã•ã‚Œã¦ã‚‚ã€ç‰¹ã«å±é™ºæ€§ã¯ãªã„ã‚ˆ ã†ãªæ°—ãŒã™ã‚‹ â€¢ ã‚¯ãƒƒã‚ãƒ¼ã®å€¤ã¯ãƒ–ãƒ©ã‚¦ã‚¶ã®ã‚¢ãƒ‰ã‚ªãƒ³ãªã©ã§ã‚‚è¡¨ç¤ºã§ãã‚‹ã‚ˆã â€¢ ä»»æ„ã®JavaScriptãŒå®Ÿè¡Œã•ã‚Œã‚‹ã¨è¨€ã£ã¦ã‚‚ã€ãƒ›ãƒ¼ãƒ ãƒšãƒ¼ã‚¸ä½œ ã‚Œã°ä»»æ„ã®JavaScriptãŒæ›¸ã‘ã‚‹ã—ã€è¦‹ãŸäººã®ãƒ–ãƒ©ã‚¦ã‚¶ã§å®Ÿè¡Œ ã•ã‚Œã‚‹ã‚ˆãâ€¦ Copyright Â© 2013 HASH Consulting Corp. 4 5. ãã‚‚ãã‚‚ã®ç–‘å•ï¼šJavaScriptã¯å±é™ºã‹? â€¢ å®Ÿã¯ã€JavaScriptã®å®Ÿè¡Œè‡ªä½“ã¯å±é™ºã§ã¯ãªã„ â€¢ Webã¯ã€æœªçŸ¥ã®ï¼ˆã²ã‚‡ã£ã¨ã™ã‚‹ã¨æ‚ªæ„ã®ã‚ã‚‹?ï¼‰ã‚µã‚¤ãƒˆã‚’è¨ªå•ã— ã¦ã‚‚ã€Œæ‚ªã„ã“ã¨ã€ãŒèµ·ããªã„ã‚ˆã†ã«è¨è¨ˆã•ã‚Œã¦ã„ã‚‹ â€¢ JavaScriptã®ã€Œã‚µãƒ³ãƒ‰ãƒœãƒƒã‚¯ã‚¹ã€ã«ã‚ˆã‚‹ä¿è· â€“ JavaScriptã‹ã‚‰ãƒãƒ¼ã‚«ãƒ«ãƒ•ã‚¡ã‚¤ãƒ«ã«ã‚¢ã‚¯ã‚»ã‚¹ã§ããªã„ â€“ JavaScriptã‹ã‚‰ã‚¯ãƒªãƒƒãƒ—

akkun_choi 2013/08/26

security

ãƒªãƒ³ã‚¯

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

ã‚¿ã‚°

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (112)

securityã«é–¢ã™ã‚‹akkun_choiã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (272)

ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2025å¹´1æœˆç¬¬2é€±ï¼‰

æœˆé–“ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2024å¹´12æœˆï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2025å¹´1æœˆç¬¬1é€±ï¼‰

å…¬å¼Twitter

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹

ã‚¿ã‚°

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (112)

securityã«é–¢ã™ã‚‹akkun_choiã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (272)

ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚­ãƒ³ã‚°ï¼ˆ2025å¹´1æœˆç¬¬2é€±ï¼‰

æœˆé–“ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚­ãƒ³ã‚°ï¼ˆ2024å¹´12æœˆï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚­ãƒ³ã‚°ï¼ˆ2025å¹´1æœˆç¬¬1é€±ï¼‰

å…¬å¼Twitter

ã‚­ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (112)

securityã«é–¢ã™ã‚‹akkun_choiã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (272)

ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2025å¹´1æœˆç¬¬2é€±ï¼‰

æœˆé–“ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2024å¹´12æœˆï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2025å¹´1æœˆç¬¬1é€±ï¼‰

å…¬å¼Twitter

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹